How to detect if an apk is from the Play Store or Sideloaded? I understand that apps are signed by both Google and the developer.

How do I detect if an apk is from the Play Store or if it is sideloaded.

I'd prefer if the method worked on all major platform only if possible including Android itself.

Even if sideloaded I'd like to know the source of the app. Like is it from Play Store.

I'm thinking of using an app or method that uses signature detection.
You cannot tell if the .apk originally came from Playstore – but you can tell whether it matches the one available at Playstore. Here's what you need:


the .apk in question
the .apk of the same app in the same version from Playstore
openssl


Unzip both .apk (each into its own directory), and compare their certificates (stored in the META-INF/ directory. Details on a thorough comparision can e.g. be found here. The command you'd need is:

openssl pkcs7 -inform DER -in META-INF/CERT.RSA -noout -print_certs -text


Alternatively, if you haven't openssl installed but the Oracle JDK:

keytool -printcert -file META-INF/CERT.RSA


or

jarsigner -verify -certs -verbose ../Example.apk


If the certificates match, both APK files where signed using the same key. Unless the dev's key got compromised, that should mean the potentially sideloaded APK should be fine (no guarantees the dev himself didn't play games – but if size and MD5 of the APK also match, I'd say it's safe).