Produce an APK Provenance and Integrity Report
Document where an APK came from, what package it claims to be and whether its hashes and signer remain consistent.
Document where an APK came from, what package it claims to be and whether its hashes and signer remain consistent.
Prepare 20m · Build 110m · Verify 30m · Document 20m
Work only inside the folder created by Smartphone-Academy.py prepare apk-provenance-report. Use the supplied samples, your own phone, or systems you are explicitly authorized to administer.
Prepare the Termux workspace
Open Termux in the Academy root and prepare this lab with the local companion. It creates safe samples, notes and evidence files under your Termux account.
python Smartphone-Academy.py prepare apk-provenance-reportNo root. Keep the workspace under $HOME and avoid personal identifiers in evidence.Practical mission
- Use only an APK you are legally allowed to inspect
- Record download source, date, filename, package name and version
- Calculate cryptographic hashes and capture available signer information
- Compare evidence with the expected publisher and state unresolved risks
A provenance report with source, package identity, hashes, signer evidence and decision.
Quality gate
Analyst reflection
Which result from “Compare evidence with the expected publisher and state unresolved risks” needs stronger evidence before it can support a real decision?
After checking the evidence, run python Smartphone-Academy.py complete apk-provenance-report. Progress is stored locally in the Termux home directory.