How do I get the signature checksum of my APK?

Question

I would like to use the signature checksum instead of the package checksum when provisioning a device with a device owner app. The app will be downloaded from an http server.

This post is great when using EXTRA_PROVISIONING_DEVICE_ADMIN_PACKAGE_CHECKSUM: Checksum Error while provisioning Android Lollipop

But I would like to use EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM. See: https://developer.android.com/reference/android/app/admin/DevicePolicyManager.htm

The provisioning app and device owner app will both on be running on Android O.

How do I get the signature checksum of my app that I can use in my key/value pair for NFC?

Chlori

Answer 1

Try this

keytool -list -printcert -jarfile [path_to_your_apk] | grep -Po "(?<=SHA256:) .*" | xxd -r -p | openssl base64 | tr -d '=' | tr -- '+/=' '-_'

In details:

• keytool -list -printcert -jarfile [path_to_your_apk] extracts informations about the certificate of the APK,
• grep -Po "(?<=SHA256:) .*" | xxd -r -p takes the SHA256 hash and converts it to binary,
• openssl base64 encodes it with base64,
• tr -d '=' | tr -- '+/=' '-_' makes it URL-safe (+ is encoded as -, / is encoded as _ and the padding character = is removed).

Candiecandied

Your first step returns, "Not a signed jar file". – Chlori

I am signing my APK with the V2 signing scheme since these apps will only be run on Android O or greater. If I sign them with the V1 signing scheme, this method works great! I think this is a good and valid answer for the V1 scheme. I will open a new question more specific for the V2 scheme. – Chlori

For reference, here is the new question about V2 signing that has been answered. – Candiecandied

When I run this command it run and did not give any error but nothing is shown in result C:\Program Files\Java\jdk-11.0.1\bin>keytool -list -printcert -jarfile "TestDPC_4005.apk" | "C:\Program Files\Git\usr\bin\grep.exe" -Po "(?<=SHA256:) .*" | "C:\Program Files\Git\usr\bin\xxd.exe" -r -p | "C:\Program Files\Git\usr\bin\openssl.exe" base64 | "C:\Program Files\Git\usr\bin\tr.exe" -d '=' | "C:\Program Files\Git\usr\bin\tr.exe" -- '+/=' '-_' – Oday

Is the URL required the https or http is okay. – Fruity