title: Verifying an APK programmatically using JarSigner
body: <p>I want to use verify an APK from Java code using JarSigner. I am writing an app that programatically installs APKs (much like Google Play) and before installing it checks for the following:</p>
  
  <ul>
  <li>Verify the signature of the .SF file itself.Verify the digest listed
  in each entry in the .SF file with each corresponding section in the
  manifest.<br>
  Verify the digest listed in each entry in the .SF file
  with each corresponding section in the manifest.<br>
  Read each file in
  the JAR file that has an entry in the .SF file. While reading,
  compute the file's digest, and then compare the result with the
  digest for this file in the manifest section.</li>
  </ul>
  
  <p>This is much like running jarsigner with -verify option on command line</p>
  
  <p>I looked up Java documentation, I think I could use <a href="http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b14/sun/security/tools/JarSigner.java#JarSigner.verifyJar%28java.lang.String%29" rel="nofollow">JarSigner.verifyJar()</a> API for this.But this is not public method. Has anyone tried to verify APK from Java code? Will appreciate any pointers.   </p>