Map the signing responsibility

Write down whether you distribute an APK directly, upload an AAB to Google Play, or support several channels. Identify who holds the upload key and who signs the installable app. These may differ when using Play App Signing. Keep private key material out of build logs and public release artifacts.

Record the expected application identifier and certificate identity for each channel. A package with a valid signature from the wrong certificate may still fail the intended update path. Treat signing identity as a release requirement rather than merely checking whether a verification command exits successfully.

Perform transformations before signing

Code optimization, resource changes and alignment need to occur in the correct native packaging sequence. Android apksigner documentation explicitly notes that changing an APK after signing invalidates its signature. Do not append a marker or remove a mapping file from the final signed package by hand.

If an exposure finding requires a change, fix the build inputs and produce a new legitimate signed export. Preserve the original release for comparison. Hardening tools that rewrite bytes should run only where the packaging workflow can recreate and verify the required signatures.

Verify the actual APK

For an owned APK, use the SDK apksigner verification workflow and inspect the certificate information against the expected release identity. The example below is for an APK, not a universal AAB verification command. Retain the SDK tool version and result with the release identifier.

apksigner verify --verbose --print-certs Example-release.apk

Validate distribution and update behavior

For an app bundle, follow the official app-bundle and signing process, then test the installable artifacts produced for the intended target. A valid upload artifact is one stage of the chain, not evidence that every delivered device package has been exercised. Include a clean install and an update from the currently supported release.

Check behavior that can depend on identity, such as API certificate restrictions, deep links, SDK callbacks and signature-scoped permissions. A new signing experiment can pass ordinary unit tests while breaking these integrations. Record any required device or store checks that could not be run.

After the distribution package is final, create a CloneGuard receipt for the exact retained artifact. The hash inventory detects later changes relative to the trusted record; it does not replace Android signature validation or prove that application logic is difficult to reconstruct. Keep exposure, integrity and compatibility results as distinct evidence.

Practical checklist

  • Record distribution channel and expected certificate.
  • Keep all byte changes before signing.
  • Use APK-specific verification on APKs.
  • Test both installation and the update path.

Sources and further reading

Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.

  1. Android: Sign your app
  2. Android: apksigner

Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.