How to verify a Waykeep download
Early Waykeep builds were reproducible but unsigned, and Android refused every one of them. The fix was a release certificate. Here is how to confirm you have a build signed with it, not just a file with the right name.
Two different checks
A checksum proves the file arrived intact and is the file that was published. A signature proves who signed it and, because Android enforces it on update, that it can replace the copy already on your phone.
You want both. The checksum catches a corrupted or swapped download; the certificate catches a build signed with a different key, which Android will refuse to install over an existing Waykeep anyway — but better to know before you try.
Check the file hash
Compare the published SHA-256 with the file you downloaded.
sha256sum com.waykeep.app_waykeep-v1.1.1_6892-reproducible-release.apk
# macOS
shasum -a 256 com.waykeep.app_waykeep-v1.1.1_6892-reproducible-release.apkCheck the signing certificate
With Android build-tools installed, apksigner prints the certificate that signs the APK. The fingerprint must match the one published with the release.
apksigner verify --print-certs com.waykeep.app_waykeep-v1.1.1_6892-reproducible-release.apkWhat the published values are
Both values are in the release notes for v1.1.1 and in the “Verify this download” panel on the home page. They are also kept in the site source, so the copy on the page and the copy in the release cannot drift apart silently.
- APK SHA-256: d8f7f8fc2339c8f0316046aafcdfb717c5255c0b3421321be75d32a4c6181a97
- Certificate SHA-256: 10a76228001d51448bec8ab43036bf491cba176f6f6e924a18a108607388fb3c
- Signer: CN=Akshat Kotpalliwar, valid to 31 March 2054
If either value does not match
Do not install it. Delete the file and download again from the release page; a mismatch after a second download is a reason to open an issue rather than to continue. Once you have the build installed, every future update must carry the same certificate or Android will reject it — which is why that fingerprint, not the version number, is the thing to keep.