{"id":4647,"date":"2022-11-09T13:06:00","date_gmt":"2022-11-09T19:06:00","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=4647"},"modified":"2022-11-09T12:08:56","modified_gmt":"2022-11-09T18:08:56","slug":"how-to-verify-signal-apk","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/how-to-verify-signal-apk\/","title":{"rendered":"How to Verify Signal APK"},"content":{"rendered":"\n<p>These steps are for Windows, but they should be very similar on macOS or Linux.<\/p>\n\n\n\n<p>Prerequisites<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Android Studio installed <\/li>\n\n\n\n<li>Install the latest SDK  <\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Locate apksigner<\/h2>\n\n\n\n<p>Apksigner is part of the Android build tools should be in the SDK directory.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">%APPDATA%..\\Local\\Android\\Sdk\\build-tools\\30.0.0<\/pre>\n\n\n\n<p>Lets open up a terminal and navigate to the build-tools.  Replace 30.0.0 with the actual SDK version you have installed.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cd .\\AppData\\Local\\Android\\Sdk\\build-tools\\30.0.0<\/pre>\n\n\n\n<p>Alternatively use the full path (Replace username and 30.0.0 with actual username and SDK number)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cd C:\\User\\username\\AppData\\Local\\Android\\Sdk\\build-tools\\30.0.0\\<\/pre>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify Signal APK<\/h2>\n\n\n\n<p>We can now verify the Signal APK with the following.  Replace username with your username.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">.\\apksigner.bat verify --print-certs C:\\User\\username\\Downloads\\Signal-Android-website-prod-universal-release-6.0.6.apk<\/pre>\n\n\n\n<p>Scroll up to the top part and look for the part that says<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Signer #1 certificate SHA-256 digest:<\/pre>\n\n\n\n<p>Check the signature against the signature on Signal&#8217;s website\/<\/p>\n\n\n\n<p><a href=\"https:\/\/signal.org\/android\/apk\/\">https:\/\/signal.org\/android\/apk\/<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>You may see a bunch of <\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">WARNING: META-INF\/xxx.version not protected by signature...<\/pre>\n\n\n\n<p>Sounds like this can be expected and is a common thing.  The certificate is stored in META-INF which means that other files stored in META-INF are not protected.  Most of the files in that directory are only version numbers of libraries the app depends on.  There shouldn&#8217;t be anything important so shouldn&#8217;t be a security concern. <\/p>\n\n\n\n<p><a href=\"https:\/\/stackoverflow.com\/questions\/52122546\/apk-metainfo-warning\">https:\/\/stackoverflow.com\/questions\/52122546\/apk-metainfo-warning<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>These steps are for Windows, but they should be very similar on macOS or Linux. Prerequisites Locate apksigner Apksigner is part of the Android build tools should be in the SDK directory. %APPDATA%..\\Local\\Android\\Sdk\\build-tools\\30.0.0 Lets open up a terminal and navigate &hellip; <a href=\"https:\/\/www.incredigeek.com\/home\/how-to-verify-signal-apk\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[573],"tags":[1291,1351,794,1350],"class_list":["post-4647","post","type-post","status-publish","format-standard","hentry","category-security","tag-apk","tag-sha256","tag-signal","tag-verify"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=4647"}],"version-history":[{"count":3,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4647\/revisions"}],"predecessor-version":[{"id":4650,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/4647\/revisions\/4650"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=4647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=4647"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=4647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}