test if a specific key was used to sign an .apk file

Question

I have a .key file and a signed .apk file (android phongap application built using phonegap build).

How can I check if the .apk was signed using that key?

Answer 1

You could retrieve and compare the fingerprints of the public keys included in the apk file and your key file.

For the apk:

1. Unpack the file /META-INF/CERT.RSA from the apk.
2. Use keytool -printcert -file CERT.RSA to compute the SHA1 + MD5 fingerprints.

For the key file:

1. Run keytool -list -v -keystore <keystore file> -alias <key alias>.
2. Input your keystore password.
3. This will output the SHA1 + MD5 fingerprints. If you omit the -v only the MD5 fingerprint will be printed.