How to verify our Releases

Android

How to Verify the Bisq APK Signing Certificate

This guide explains how to verify that the APK you downloaded is signed with the official release certificate using the provided release-cert.pem.

Example with first Bisq Android release version 0.1.0

---

1. Verify APK with apksigner

apksigner is part of the Android SDK Build Tools. It can show which certificate was used to sign the APK.

apksigner verify --print-certs Bisq-Android-0.1.0.apk

Expected output:

Verified using v2 scheme (APK Signature Scheme v2)
Number of signers: 1
Signer #1 certificate DN: CN=Bisq, O=Bisq Network, C=EU
Signer #1 certificate SHA-256 digest: 3F:12:AA:BB:...:C8

✅ The SHA-256 digest here should match the fingerprint provided in the release notes.

---

2. Check the fingerprint of the provided PEM certificate

You can also verify the SHA-256 fingerprint of the release-cert.pem file directly using either keytool or openssl.

Using keytool (Java SDK):

keytool -printcert -file release-cert.pem | grep SHA256

Example output:

SHA256: 3F:12:AA:BB:...:C8

Using openssl:

openssl x509 -in release-cert.pem -noout -fingerprint -sha256

Example output:

SHA256 Fingerprint=3F:12:AA:BB:...:C8

---

3. Compare fingerprints

• The SHA-256 from apksigner should match the SHA-256 from release-cert.pem exactly.
• If they match, the APK is signed with the official release key.

---

4. Optional: Verify APK integrity

You can calculate the SHA-256 checksum of the APK file itself to ensure it wasn’t tampered with:

shasum -a 256 Bisq-Android-0.1.0.apk

Compare the result to the checksum provided in the release notes.

---

Summary

• APK Signing Certificate: Verified via apksigner.
• Release Certificate (PEM): Verified via keytool or openssl.
• Integrity Check: Optional, via SHA-256 checksum of the APK.

Following these steps allows users to confidently verify the authenticity and integrity of the Bisq APK.

iOS

TODO