Android APK, Self Signing
<p>I am working on a proof of concept related to attestation of a software component ( to be specific, an apk file ) on an android device.   To that end I did the following:</p>

<ol>
<li><p>I programmatically retrieved the digests stored in META/CERT.SF of an application installed on my android tablet( say maps.apk), belonging to AndroidManifest.xml, resources.arsc and classes.dex.   </p></li>
<li><p>Then, I computed the SHA-1 digests of these files and after that did base64 on those digests.  I was able match these to the ones in step 1.</p></li>
</ol>

<p>My question is, where is the role of public key stored in META-INF/CERT.RSA?  Aren’t Digests stored in META-INF/CERT.SF supposed to be signed by private key corresponding to the public key in META-INF/CERT.RSA?</p>
