Update.zip signing- different sha for the same file I am trying to flash a customized update.zip on a pre-Kitkat device.
In the zip there are 2 files with SHA1 signatures of other files in the update. But they have different signatures for the same files.
Example:
META-INF/MANIFEST.MF:
Name: system/lib/libcustom_jni.so
SHA1-Digest: +PhV5XphkQTNTyM2TSRTeiaDlCA=

META-INF/CERT.SF:
Name: system/lib/libcustom_jni.so
SHA1-Digest: 7ooFhqk1oYWF5pmVuSAhF2pFVNw=

I can get the first one using:
sha1sum system/lib/libcustom_jni.so | cut -d\  -f1 | xxd -p -r | base64
+PhV5XphkQTNTyM2TSRTeiaDlCA=

How is the second one computed? The second file has a hash of the first file, so maybe the other hashes are salted with the first file or something?
From what i found in java doc the SHAs should be identical, except all SHAs are the version 1 in the original update.zip.
It seems hat the certificate used to sign the update was the android test one so it should work, but aborts instead.
Answered here as i wrote in the comment. The second hash is a SHA1 of the 3 lines in the manifest file.
I can obtain the second hash by running:
echo 'Name: system/lib/libcustom_jni.so\r\nSHA1-Digest: +PhV5XphkQTNTyM2TSRTeiaDlCA=\r\n\r' | sha1sum | cut -d\  -f1 | xxd -p -r | base64 
7ooFhqk1oYWF5pmVuSAhF2pFVNw=

The echo command adds the final \n so it must be removed from the command to not be duplicated.
Edit for posteriority:
The update.zip is then signed by SignApk using the -w argument, which makes it generate a ZIP comment, without which the installation fails.
The comment consists of signed by SignApk string followed by a signature block. Code at Android SignApk source
This was the last piece of the puzzle that allowed me to create a custom update.zip for my Prestigio tablet.