Verify apk file downloaded?

1

I trying to find a way to verify apk files I download from F-Droid. I see there is a PGP signature provided with each apk, but I dont know how to implement it for apk verification? I’ve read couple old threads here on forum regarding verification or actually lack of straight forward way to do it.

Is it still the case? Decrypting F-Droid apk in Openkeyvhain results in a crash. Log refers to issues with the apk or it’s encryption. Same fail with Simplex app.

Got a mismatch of sha256 on some non android important app earlier today and decided to verify all apps I am using.

I’d appreciate a helpfull guide.
2

Works appropriately with all F-Droid apps.

7

You just need to import (receive) the key from the link I posted. Then you can check the individual signatures, as shown there.

9

So you take https://f-droid.org/repo/eu.siacs.conversations_4217604.apk and its https://f-droid.org/repo/eu.siacs.conversations_4217604.apk.asc and you can’t verify it?

Do list the steps and your results.

11

This? GPG public key update (#667) · Tasks · F-Droid / admin · GitLab

12

I usually just compare the SHA-256 hash with the one provided on the release page if I want to be extra sure. It sounds a bit technical at first, but once you do it a couple of times it’s actually pretty quick and reassuring.