Verify your download
You don’t have to do this, but you can check that an APK really comes from this project. The signing certificate is what matters: Android only installs updates signed with the same certificate, and only the developer has the key.
- Package name
io.github.nath_goa.usugami (Usugami and Usugami OCR) or io.github.nath_goa.usugami.lite (Usugami Lite)
- Signing certificate SHA-256
6F:4F:23:AD:E0:3E:63:6A:7C:C3:68:16:89:44:D0:CC:FC:81:32:EF:34:C5:0B:C5:A4:6B:0C:A4:CB:BD:F4:ED
On your phone (Android 9 or newer)
Install AppVerifier, then paste these two lines into it after installing Usugami or Usugami OCR (for Usugami Lite, the first line is io.github.nath_goa.usugami.lite):
io.github.nath_goa.usugami
6F:4F:23:AD:E0:3E:63:6A:7C:C3:68:16:89:44:D0:CC:FC:81:32:EF:34:C5:0B:C5:A4:6B:0C:A4:CB:BD:F4:ED
AppVerifier doesn’t run on Android 8.0 or 8.1; use a computer (below) instead.
On a computer: apksigner, checksums and build provenance
Signing certificate with apksigner from the Android SDK build-tools:
apksigner verify --print-certs Usugami.apk
The certificate SHA-256 digest line must read 6f4f23ade03e636a7cc368168944d0ccfc8132ef34c50bc5a46b0ca4cbbdf4ed. The certificate DN line says CN=Nathan Kumtakar, O=Usugami, but anyone can put any name in a certificate, so only the digest proves who signed the APK. (keytool -printcert -jarfile doesn’t work here: Usugami uses the newer APK signature schemes, which keytool can’t read.)
Checksums: download SHA256SUMS.txt from the same release, put it next to the APK you downloaded and run:
sha256sum -c --ignore-missing SHA256SUMS.txt # Linux
shasum -a 256 -c --ignore-missing SHA256SUMS.txt # macOS
Get-FileHash Usugami.apk -Algorithm SHA256 # Windows PowerShell: compare with the file
Your APK must show OK. (SHA256SUMS.txt lists all three editions; --ignore-missing skips the ones you didn’t download.) GitHub also shows each file’s SHA-256 next to it on the release page.
Build provenance: release APKs are built from Usugami’s source by the release workflow on GitHub Actions, which publishes a signed build-provenance attestation for each one. Check it with the GitHub CLI:
gh attestation verify Usugami.apk --repo Nath-Goa/usugami