S06
Signing certificate matchValidated
The app’s real certificate, in hex or colon-separated uppercase, stays clean.
Validatedandroid
How to read this page
A scenario is one test case: prepare the environment, run the steps, then compare the expected result (written before the run) with the observed result (copied from the run, with screenshots).
- S06 · S
- Run on a simulator or emulator — a virtual device on a computer.
- Validated
- Run, and the result matched what was expected.
Why it matters
A tamper check that flags the genuine app is worse than no check. Both common digest formats must match.
Environment
- App
- Example app (Expo SDK 57, React Native 0.86)
- Device
- Pixel 9 Pro emulator (sdk_gphone16k_arm64), API 37
- Build
- Debug, installed with adb
- Library
- 0.2.0
- Certificate
- Debug key, SHA-256 fac61745…3b9c (from apksigner)
Setup
Prepare the environment.Then run the steps.
- 01Read the APK’s SHA-256 with apksigner verify --print-certs.
Steps
What to run.What to read.
- 01Call checkIntegrity({ android: { expectedSigningCertificates: [<hex>] } }).
- 02Repeat with the same digest in uppercase with colons.
Expected result · written before the run
Status: clean1 signal.
Observed result · copied from the run
Status: cleanObserved 2026-09-30.
evidence
correct: clean · colonUpper: cleanChecks this scenario covers
Every check this test case touches — including ones that aren't expected to fire here. The expected and observed results above say which ones should and did. Each links to how the check works.