Android APK

Verify integrity: SHA-256 checksum

The fastest check. Confirms the file was not corrupted or tampered with in transit.

cc0001636e0b353992b42404247c4ba05397d3b7ad3a3b0204f88f2fe671f821

sha256sum whenary-1.2.2.apk
# expected: cc0001636e0b353992b42404247c4ba05397d3b7ad3a3b0204f88f2fe671f821

On macOS use shasum -a 256 instead of sha256sum.

Verify authenticity: APK signing certificate

Android enforces that all updates are signed with the same key as the original install. You can independently verify the certificate fingerprint matches the one published here.

# Requires Android SDK build-tools (apksigner):
apksigner verify --print-certs whenary-1.2.2.apk

# Or with keytool (JDK):
keytool -printcert -jarfile whenary-1.2.2.apk

# Or via ADB on a connected device with the app installed:
adb shell pm dump com.whenary.app | grep -A3 "Signatures"

On Android 9+ you can also check Settings → Apps → Whenary → App details on some ROMs.

Verify signature: Minisign (recommended)

Minisign uses Ed25519 to sign the APK. No key management overhead: just install the tool and verify with the public key below.

# Install: https://jedisct1.github.io/minisign/
# Download the .minisig alongside the APK, then:
minisign -V -P RWQZyE41by8JAA8/x6cec7gU7a5xVo0QPXW8uOYf5fb45qkGVru7Uylb -m whenary-1.2.2.apk

# Or with a saved .pub file:
curl -O https://whenary.com/whenary-releases.pub
minisign -V -p whenary-releases.pub -m whenary-1.2.2.apk

The .minisig file is available at https://dl.whenary.com/android/whenary-1.2.2.apk.minisig

Verify signature: GPG / PGP

For users already in the GPG ecosystem. The APK is signed with the Whenary releases key.

# Import the signing key:
gpg --keyserver keys.openpgp.org --recv-keys 7C83207DD1A22E53

# Download the .asc signature alongside the APK, then:
gpg --verify whenary-1.2.2.apk.asc whenary-1.2.2.apk

The .asc file is available at https://dl.whenary.com/android/whenary-1.2.2.apk.asc

Verify signature: Sigstore / cosign

For supply-chain security tooling. The APK is signed with a cosign key pair. The bundle includes the message digest and Ed25519 signature.

# Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
# Download the .sigstore.json bundle alongside the APK, then:
cosign verify-blob \
  --key https://whenary.com/cosign.pub \
  --bundle whenary-1.2.2.apk.sigstore.json \
  --insecure-ignore-tlog \
  whenary-1.2.2.apk

The bundle is available at https://dl.whenary.com/android/whenary-1.2.2.apk.sigstore.json

Key trust & rotation

All signing keys are held offline. If a key is ever compromised or rotated, notice will be published at whenary.com/security and in the app release notes. The APK signing key is bound to the Android keystore. Rotation requires a fresh install.