Verify the APK

Before you install a new version, check two things: that the file is exactly the one we published, and that it is signed with the expected Smartable signing key. It takes a few minutes on a computer.

1. Download from an official source

Use getsmartable.app/get or the releases on GitLab. For the checks below, download the APK and SHA256SUMS from the release into one folder.

2. Check the SHA-256 checksum

Each release lists the APK’s SHA-256 checksum, and the same value is on getsmartable.app/get.

Linux:

sha256sum -c SHA256SUMS

macOS:

shasum -a 256 -c SHA256SUMS

The result must say OK for the APK.

Windows (PowerShell):

Get-FileHash .\smartable-2.2.0-22.apk -Algorithm SHA256

Compare the Hash it prints with the checksum in the release; letter case does not matter.

3. Check the signing certificate

The checksum confirms that the file matches the release. Checking the signature and matching the certificate fingerprint helps confirm that the APK was signed with the expected Smartable signing key.

Use apksigner, which comes with the Android SDK build tools (apksigner.bat on Windows):

apksigner verify --print-certs smartable-2.2.0-22.apk

The line Signer #1 certificate SHA-256 digest must read:

a620bbde76e011db72c5ded72c4c4dc37ab57fb02f91ac840286bd628568e335

The same fingerprint is published on getsmartable.app/get, in the project’s README and in each release. If your result differs, or those places ever disagree, do not install the file, and write to hello@getsmartable.app.

Why this matters for updates

Android installs an update over an existing app only when the update is signed with the same key. Once a genuine copy is installed, a file signed by anyone else cannot replace it.