@marathon Ok, it's not the PEM or DER cert in the meta folder, it's the hash of any (DER encoded? I don't know the default for java's certificate encoder) certificate in the iterator returned by ApkVerifier in https://android.googlesource.com/platform/tools/apksig Which I would expect to be the same as that file but apparently isn't.