Verify an APK Release

Mission

Compare a supplied release manifest, package metadata and hashes before approving a fictional APK.

Required work

1. Hash every supplied package with SHA-256
2. Compare results with the independent release manifest
3. Identify package name, version and expected signer note
4. Write an approve/reject decision with reasons

Evidence to produce

A verification report that records source, package, version, hash result and remaining uncertainty.

Quality checks

The result must identify its source data, separate observation from assumption, preserve supplied originals, and explain any limitation or uncertain conclusion.