{
  "schemaVersion": 1,
  "id": "cross-channel-android-build-identity-2026-11-11",
  "status": "evidence-reviewed",
  "url": "https://apporiginlab.com/research/cross-channel-android-build-identity/",
  "dataUrl": "https://apporiginlab.com/data/cross-channel-android-build-identity-2026-11-11.json",
  "title": "Same-version Android APKs across distribution channels",
  "description": "Ten freshly acquired APKs form five same-package, same-version channel pairs: two pairs are byte-identical, while three use different signer sets.",
  "question": "When two Android channels publish the same package, version name, and version code, which exact-file, signing, compiled-manifest, permission, and native-library properties stay the same?",
  "evidenceDate": "2026-11-11",
  "updatedDate": "2026-11-11",
  "methodologyVersion": "0.1",
  "selection": "Purposive edge-case sample selected to exercise direct redistribution, repository signing, dual signing variants, and separately built artifacts; not a random or prevalence sample.",
  "toolchain": {
    "androidBuildTools": "37.0.0",
    "apksigJar": "Android SDK Build Tools apksigner.jar",
    "manifestParser": "Android SDK Build Tools aapt2 dump badging/permissions/xmltree",
    "java": "openjdk version \"17.0.20\" 2026-07-21",
    "elfParser": "apporiginlab-pilot-elf64-v1"
  },
  "counts": {
    "artifacts": 10,
    "pairs": 5,
    "byteIdenticalPairs": 2,
    "differentSignerPairs": 3,
    "samePermissionDeclarationPairs": 5,
    "runtimeInstallTests": 0
  },
  "pairs": [
    {
      "pairId": "termux-0.118.3",
      "project": "Termux",
      "classification": "different-signer-sets",
      "byteIdentical": false,
      "signerSame": false,
      "nativeInventorySame": false,
      "manifestComparison": {
        "compiledXmlTreeSame": false,
        "compiledXmlTreeWithoutSourceLinesSame": false,
        "sdkSame": true,
        "requestedPermissionsSame": true,
        "requestedPermissionDeclarationsSame": true,
        "declaredPermissionsSame": true,
        "featuresSame": true
      },
      "artifacts": [
        {
          "id": "termux-fdroid-0.118.3",
          "pairId": "termux-0.118.3",
          "project": "Termux",
          "packageName": "com.termux",
          "versionName": "0.118.3",
          "versionCode": "1002",
          "size": 113880067,
          "sha256": "e6265a57eb5ca363808488e3b01955958bed93bc0c8a0d281849b363b11027ec",
          "channel": "fdroid",
          "channelLabel": "F-Droid",
          "sourcePage": "https://f-droid.org/packages/com.termux/",
          "signers": [
            "228fb2cfe90831c1499ec3ccaf61e96e8e1ce70766b9474672ce427334d41c42"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "9ea70b6348819fa2190f880d93a6f33ec1fa09c290c2bfd5ecbd4135447c245a",
            "compiledXmlTreeWithoutSourceLinesSha256": "d22293512099ae70aeb5ae0df2eb8ea04226018b5dd5a8480415aa1fdd540af0",
            "minSdk": "24",
            "targetSdk": "28",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.DUMP",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.INTERNET",
              "android.permission.MANAGE_EXTERNAL_STORAGE",
              "android.permission.PACKAGE_USAGE_STATS",
              "android.permission.READ_LOGS",
              "android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
              "android.permission.REQUEST_INSTALL_PACKAGES",
              "android.permission.SYSTEM_ALERT_WINDOW",
              "android.permission.VIBRATE",
              "android.permission.WAKE_LOCK",
              "android.permission.WRITE_EXTERNAL_STORAGE",
              "android.permission.WRITE_SECURE_SETTINGS",
              "com.android.alarm.permission.SET_ALARM"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.DUMP",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.MANAGE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.PACKAGE_USAGE_STATS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.READ_LOGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.REQUEST_INSTALL_PACKAGES",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.SYSTEM_ALERT_WINDOW",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.VIBRATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_SECURE_SETTINGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "com.android.alarm.permission.SET_ALARM",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "com.termux.permission.RUN_COMMAND"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 4,
            "inventorySha256": "40d44f849c07f4008924595926b41012e052476481a4a3891878b5e03283ecdf",
            "runtimeStatus": "not-tested"
          }
        },
        {
          "id": "termux-github-0.118.3",
          "pairId": "termux-0.118.3",
          "project": "Termux",
          "packageName": "com.termux",
          "versionName": "0.118.3",
          "versionCode": "1002",
          "size": 117775723,
          "sha256": "7600078440c3c34ef050bc009b00fc3215cb87ec4a449e01a696f74cf4249db2",
          "channel": "developer-github",
          "channelLabel": "GitHub release",
          "sourcePage": "https://github.com/termux/termux-app/releases/tag/v0.118.3",
          "signers": [
            "b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "72adb69ebc2b899bd54b132b1522b730c524b3c9d5a5e0b3073b9f488ffcf455",
            "compiledXmlTreeWithoutSourceLinesSha256": "0f4b7916405fa0191148cc785d0a6a72a7f309721aaaf8b99306b468fe672b34",
            "minSdk": "24",
            "targetSdk": "28",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.DUMP",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.INTERNET",
              "android.permission.MANAGE_EXTERNAL_STORAGE",
              "android.permission.PACKAGE_USAGE_STATS",
              "android.permission.READ_LOGS",
              "android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
              "android.permission.REQUEST_INSTALL_PACKAGES",
              "android.permission.SYSTEM_ALERT_WINDOW",
              "android.permission.VIBRATE",
              "android.permission.WAKE_LOCK",
              "android.permission.WRITE_EXTERNAL_STORAGE",
              "android.permission.WRITE_SECURE_SETTINGS",
              "com.android.alarm.permission.SET_ALARM"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.DUMP",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.MANAGE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.PACKAGE_USAGE_STATS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.READ_LOGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.REQUEST_INSTALL_PACKAGES",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.SYSTEM_ALERT_WINDOW",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.VIBRATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_SECURE_SETTINGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "com.android.alarm.permission.SET_ALARM",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "com.termux.permission.RUN_COMMAND"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 4,
            "inventorySha256": "9a61d07caa834180d4531c9b30da2e99d99b10d104751455cda97c0ca0c195a0",
            "runtimeStatus": "not-tested"
          }
        }
      ],
      "evidence": [
        {
          "id": "termux-installation-sources",
          "sourceType": "first-party-documentation",
          "referenceUrl": "https://raw.githubusercontent.com/termux/termux-app/v0.118.3/README.md",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "6282f3166ce34a24e734a0cfb9610255475ca74a5d81ac444eb0d6b819ecbad7",
          "explanation": "Termux's version-pinned README says APKs from different sources use different signature keys and must not be mixed; maintainers do not control the F-Droid signing keys, while GitHub release and workflow APKs are debuggable and compatible only with each other."
        },
        {
          "id": "fdroid-signing-process",
          "sourceType": "channel-policy",
          "referenceUrl": "https://f-droid.org/en/docs/Signing_Process/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "0c586311c986fb3f15a3fa2bd93f4176a0c4e3dfb994ddb6ee871ed389119bfb",
          "explanation": "F-Droid documents that its tooling can generate and manage a distinct APK signing key for each maintained application. The selected artifacts are still classified from their measured signer fingerprints rather than from policy alone."
        }
      ]
    },
    {
      "pairId": "kernelsu-v3.3.1",
      "project": "KernelSU",
      "classification": "byte-identical",
      "byteIdentical": true,
      "signerSame": true,
      "nativeInventorySame": true,
      "manifestComparison": {
        "compiledXmlTreeSame": true,
        "compiledXmlTreeWithoutSourceLinesSame": true,
        "sdkSame": true,
        "requestedPermissionsSame": true,
        "requestedPermissionDeclarationsSame": true,
        "declaredPermissionsSame": true,
        "featuresSame": true
      },
      "artifacts": [
        {
          "id": "kernelsu-izzy-v3.3.1",
          "pairId": "kernelsu-v3.3.1",
          "project": "KernelSU",
          "packageName": "me.weishu.kernelsu",
          "versionName": "v3.3.1",
          "versionCode": "32680",
          "size": 13637206,
          "sha256": "b4a059ace71de2fa65cc7f12b1c58d55fc23ab25e057ee4230ce779742abe450",
          "channel": "izzyondroid",
          "channelLabel": "IzzyOnDroid",
          "sourcePage": "https://apt.izzysoft.de/fdroid/index/apk/me.weishu.kernelsu",
          "signers": [
            "c371061b19d8c7d7d6133c6a9bafe198fa944e50c1b31c9d8daa8d7f1fc2d2d6"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "67bf407bcabb5c6a4ccce181e268c822b65a7a2599de4524069308e7434d396d",
            "compiledXmlTreeWithoutSourceLinesSha256": "39dfe8e9ea7aa6a86bca435851d7b3e898d573eec1f1fdb73320867b1f619bcb",
            "minSdk": "31",
            "targetSdk": "37",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.faketouch",
                "required": true
              }
            ]
          },
          "native": {
            "libraryCount": 6,
            "inventorySha256": "4664fec5d58bd56ce8f83919003830833c996a0ba5b04010003c011d9a110c96",
            "runtimeStatus": "not-tested"
          }
        },
        {
          "id": "kernelsu-github-v3.3.1",
          "pairId": "kernelsu-v3.3.1",
          "project": "KernelSU",
          "packageName": "me.weishu.kernelsu",
          "versionName": "v3.3.1",
          "versionCode": "32680",
          "size": 13637206,
          "sha256": "b4a059ace71de2fa65cc7f12b1c58d55fc23ab25e057ee4230ce779742abe450",
          "channel": "developer-github",
          "channelLabel": "GitHub release",
          "sourcePage": "https://github.com/tiann/KernelSU/releases/tag/v3.3.1",
          "signers": [
            "c371061b19d8c7d7d6133c6a9bafe198fa944e50c1b31c9d8daa8d7f1fc2d2d6"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "67bf407bcabb5c6a4ccce181e268c822b65a7a2599de4524069308e7434d396d",
            "compiledXmlTreeWithoutSourceLinesSha256": "39dfe8e9ea7aa6a86bca435851d7b3e898d573eec1f1fdb73320867b1f619bcb",
            "minSdk": "31",
            "targetSdk": "37",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "me.weishu.kernelsu.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.faketouch",
                "required": true
              }
            ]
          },
          "native": {
            "libraryCount": 6,
            "inventorySha256": "4664fec5d58bd56ce8f83919003830833c996a0ba5b04010003c011d9a110c96",
            "runtimeStatus": "not-tested"
          }
        }
      ],
      "evidence": [
        {
          "id": "izzy-channel-policy",
          "sourceType": "channel-policy",
          "referenceUrl": "https://apt.izzysoft.de/fdroid/index/info",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "d8e329cc50e4ddd80dd2525c732a855c6bea5fcd95f68a44538890ea7d99013e",
          "explanation": "IzzyOnDroid says it takes official APK binaries from developer repositories and checks the recorded developer signature on updates; the artifact measurements, not this general policy alone, determine whether each selected pair is byte-identical."
        }
      ]
    },
    {
      "pairId": "shizuku-13.6.0",
      "project": "Shizuku",
      "classification": "byte-identical",
      "byteIdentical": true,
      "signerSame": true,
      "nativeInventorySame": true,
      "manifestComparison": {
        "compiledXmlTreeSame": true,
        "compiledXmlTreeWithoutSourceLinesSame": true,
        "sdkSame": true,
        "requestedPermissionsSame": true,
        "requestedPermissionDeclarationsSame": true,
        "declaredPermissionsSame": true,
        "featuresSame": true
      },
      "artifacts": [
        {
          "id": "shizuku-izzy-13.6.0",
          "pairId": "shizuku-13.6.0",
          "project": "Shizuku",
          "packageName": "moe.shizuku.privileged.api",
          "versionName": "13.6.0.r1086.2650830c",
          "versionCode": "1086",
          "size": 2571773,
          "sha256": "6e273ab0e991c4e79bc8b1bbb9b9dd739ccac1a8712a541a214078886b7b790f",
          "channel": "izzyondroid",
          "channelLabel": "IzzyOnDroid",
          "sourcePage": "https://apt.izzysoft.de/fdroid/index/apk/moe.shizuku.privileged.api",
          "signers": [
            "268b5590e868fb08bae7e0ac413564cd1ff88f5ccff74af9dbd0dc918e30db30"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "d2e0c8a397ffc249086f999ca4d67ebbbb1c46ca43cc9d6891bd788a7b0937a6",
            "compiledXmlTreeWithoutSourceLinesSha256": "af34f8a6e36babdd7ae1037f28705304b32206a2826f7bbdc1207cfc0407e05e",
            "minSdk": "24",
            "targetSdk": "36",
            "requestedPermissions": [
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "android.permission.WRITE_SECURE_SETTINGS",
              "moe.shizuku.manager.permission.MANAGER"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_SECURE_SETTINGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "moe.shizuku.manager.permission.MANAGER",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "moe.shizuku.manager.permission.API_V23",
              "moe.shizuku.manager.permission.MANAGER"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 6,
            "inventorySha256": "605f16648e849ef56c3326d7ca219bc3edc95586b252976f86a0a7946480dceb",
            "runtimeStatus": "not-tested"
          }
        },
        {
          "id": "shizuku-github-13.6.0",
          "pairId": "shizuku-13.6.0",
          "project": "Shizuku",
          "packageName": "moe.shizuku.privileged.api",
          "versionName": "13.6.0.r1086.2650830c",
          "versionCode": "1086",
          "size": 2571773,
          "sha256": "6e273ab0e991c4e79bc8b1bbb9b9dd739ccac1a8712a541a214078886b7b790f",
          "channel": "developer-github",
          "channelLabel": "GitHub release",
          "sourcePage": "https://github.com/RikkaApps/Shizuku/releases/tag/v13.6.0",
          "signers": [
            "268b5590e868fb08bae7e0ac413564cd1ff88f5ccff74af9dbd0dc918e30db30"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "d2e0c8a397ffc249086f999ca4d67ebbbb1c46ca43cc9d6891bd788a7b0937a6",
            "compiledXmlTreeWithoutSourceLinesSha256": "af34f8a6e36babdd7ae1037f28705304b32206a2826f7bbdc1207cfc0407e05e",
            "minSdk": "24",
            "targetSdk": "36",
            "requestedPermissions": [
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "android.permission.WRITE_SECURE_SETTINGS",
              "moe.shizuku.manager.permission.MANAGER"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_SECURE_SETTINGS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "moe.shizuku.manager.permission.MANAGER",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "moe.shizuku.manager.permission.API_V23",
              "moe.shizuku.manager.permission.MANAGER"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 6,
            "inventorySha256": "605f16648e849ef56c3326d7ca219bc3edc95586b252976f86a0a7946480dceb",
            "runtimeStatus": "not-tested"
          }
        }
      ],
      "evidence": [
        {
          "id": "izzy-channel-policy",
          "sourceType": "channel-policy",
          "referenceUrl": "https://apt.izzysoft.de/fdroid/index/info",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "d8e329cc50e4ddd80dd2525c732a855c6bea5fcd95f68a44538890ea7d99013e",
          "explanation": "IzzyOnDroid says it takes official APK binaries from developer repositories and checks the recorded developer signature on updates; the artifact measurements, not this general policy alone, determine whether each selected pair is byte-identical."
        }
      ]
    },
    {
      "pairId": "newpipe-0.29.1",
      "project": "NewPipe",
      "classification": "different-signer-sets",
      "byteIdentical": false,
      "signerSame": false,
      "nativeInventorySame": true,
      "manifestComparison": {
        "compiledXmlTreeSame": true,
        "compiledXmlTreeWithoutSourceLinesSame": true,
        "sdkSame": true,
        "requestedPermissionsSame": true,
        "requestedPermissionDeclarationsSame": true,
        "declaredPermissionsSame": true,
        "featuresSame": true
      },
      "artifacts": [
        {
          "id": "newpipe-fdroid-0.29.1",
          "pairId": "newpipe-0.29.1",
          "project": "NewPipe",
          "packageName": "org.schabi.newpipe",
          "versionName": "0.29.1",
          "versionCode": "1015",
          "size": 11507122,
          "sha256": "1d66d19eedbab969b1be2e44e0ea35f5f8921cbe83b5c5ac810767ca1a84b7e8",
          "channel": "fdroid",
          "channelLabel": "F-Droid base build",
          "sourcePage": "https://f-droid.org/packages/org.schabi.newpipe/",
          "signers": [
            "964dfa418e66390110b0c061a0497cbbd7395b8b2526bee4dece95597eb5e9d4"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "00468667f00531be1c7ce3b955f3c9c41144621d395b6c9d4251881c0776a553",
            "compiledXmlTreeWithoutSourceLinesSha256": "cbac9b5a154299d8528cdf1e8eec8cabb34cab3a71c5437fdefd9aadba342b3c",
            "minSdk": "23",
            "targetSdk": "35",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "android.permission.SYSTEM_ALERT_WINDOW",
              "android.permission.WAKE_LOCK",
              "android.permission.WRITE_EXTERNAL_STORAGE",
              "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.SYSTEM_ALERT_WINDOW",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 2,
            "inventorySha256": "693ca696a5678d3ed0e2d0529aa5036395b95862d856ffc29aaae5836a8f2830",
            "runtimeStatus": "not-tested"
          }
        },
        {
          "id": "newpipe-github-0.29.1",
          "pairId": "newpipe-0.29.1",
          "project": "NewPipe",
          "packageName": "org.schabi.newpipe",
          "versionName": "0.29.1",
          "versionCode": "1015",
          "size": 11507122,
          "sha256": "18447bfb1e06d113edc88df93f471827280de06f6f3d4dc42f56f28b9c1bab79",
          "channel": "developer-github",
          "channelLabel": "GitHub release",
          "sourcePage": "https://github.com/TeamNewPipe/NewPipe/releases/tag/v0.29.1",
          "signers": [
            "cb84069bd68116bafae5ee4ee5b08a567aa6d898404e7cb12f9e756df5cf5cab"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "00468667f00531be1c7ce3b955f3c9c41144621d395b6c9d4251881c0776a553",
            "compiledXmlTreeWithoutSourceLinesSha256": "cbac9b5a154299d8528cdf1e8eec8cabb34cab3a71c5437fdefd9aadba342b3c",
            "minSdk": "23",
            "targetSdk": "35",
            "requestedPermissions": [
              "android.permission.ACCESS_NETWORK_STATE",
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
              "android.permission.INTERNET",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.RECEIVE_BOOT_COMPLETED",
              "android.permission.SYSTEM_ALERT_WINDOW",
              "android.permission.WAKE_LOCK",
              "android.permission.WRITE_EXTERNAL_STORAGE",
              "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.ACCESS_NETWORK_STATE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.INTERNET",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.RECEIVE_BOOT_COMPLETED",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.SYSTEM_ALERT_WINDOW",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WRITE_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "org.schabi.newpipe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.touchscreen",
                "required": false
              },
              {
                "name": "android.software.leanback",
                "required": false
              }
            ]
          },
          "native": {
            "libraryCount": 2,
            "inventorySha256": "693ca696a5678d3ed0e2d0529aa5036395b95862d856ffc29aaae5836a8f2830",
            "runtimeStatus": "not-tested"
          }
        }
      ],
      "evidence": [
        {
          "id": "fdroid-reproducible-builds",
          "sourceType": "channel-policy",
          "referenceUrl": "https://f-droid.org/docs/Reproducible_Builds/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "b7c899bdeeedf815ed0995c645097c7b79539827b32bf8ad4c54fdd220996438",
          "explanation": "F-Droid documents both developer-signed reproducible publishing and verification-only rebuilds. A successful verification entry must therefore be interpreted against the specific published artifact and must not be assumed to mean that a GitHub APK is identical."
        },
        {
          "id": "newpipe-fdroid-metadata",
          "sourceType": "channel-metadata",
          "referenceUrl": "https://gitlab.com/fdroid/fdroiddata/-/raw/master/metadata/org.schabi.newpipe.yml",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "b684c90c7eca73c4be6be2e480edea60812ceaf653014ad5bcf28602400ac716",
          "explanation": "The archived F-Droid recipe records NewPipe 0.29.1 (version code 1015), its source commit, and both the F-Droid and upstream certificate fingerprints among the allowed signing keys."
        },
        {
          "id": "newpipe-fdroid-variants",
          "sourceType": "channel-metadata",
          "referenceUrl": "https://f-droid.org/en/packages/org.schabi.newpipe/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "bc11473d622e9ee2a90730e8fdeca1f508314455d003a07bc945bfbad7c9ceac",
          "explanation": "F-Droid lists two 0.29.1 code 1015 variants: an upstream-signed APK with a signer suffix in its filename and a separately built and F-Droid-signed base APK. This pair deliberately measures the base F-Droid-signed URL against GitHub."
        }
      ]
    },
    {
      "pairId": "auxio-4.1.5",
      "project": "Auxio",
      "classification": "different-signer-sets",
      "byteIdentical": false,
      "signerSame": false,
      "nativeInventorySame": false,
      "manifestComparison": {
        "compiledXmlTreeSame": true,
        "compiledXmlTreeWithoutSourceLinesSame": true,
        "sdkSame": true,
        "requestedPermissionsSame": true,
        "requestedPermissionDeclarationsSame": true,
        "declaredPermissionsSame": true,
        "featuresSame": true
      },
      "artifacts": [
        {
          "id": "auxio-fdroid-4.1.5",
          "pairId": "auxio-4.1.5",
          "project": "Auxio",
          "packageName": "org.oxycblt.auxio",
          "versionName": "4.1.5",
          "versionCode": "75",
          "size": 11229630,
          "sha256": "c2053d36c28dbe74de40eadcd8978ec874c465ed3352bba655d4b2b364780b45",
          "channel": "fdroid",
          "channelLabel": "F-Droid",
          "sourcePage": "https://f-droid.org/packages/org.oxycblt.auxio/",
          "signers": [
            "65b3e62a2b57bf73235be6d2d42ae546fcb02fd17f62cd14500d1c412a285972"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "65d5cef4de1087ab6d33b3ca089cac68ac30d0fced55945fa66800033959f452",
            "compiledXmlTreeWithoutSourceLinesSha256": "332c37aa09b0fd85fda8e435b53951079d74e8606f62ff376fab56f4ef0dd38f",
            "minSdk": "24",
            "targetSdk": "36",
            "requestedPermissions": [
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
              "android.permission.FOREGROUND_SERVICE_SPECIAL_USE",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.READ_EXTERNAL_STORAGE",
              "android.permission.READ_MEDIA_AUDIO",
              "android.permission.WAKE_LOCK",
              "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_SPECIAL_USE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.READ_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": "32"
              },
              {
                "name": "android.permission.READ_MEDIA_AUDIO",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.faketouch",
                "required": true
              }
            ]
          },
          "native": {
            "libraryCount": 4,
            "inventorySha256": "d7fbaccac180fd43b19bbfb8d39131f6f1b2ab0e84975cc76e1d4445eb221f70",
            "runtimeStatus": "not-tested"
          }
        },
        {
          "id": "auxio-github-4.1.5",
          "pairId": "auxio-4.1.5",
          "project": "Auxio",
          "packageName": "org.oxycblt.auxio",
          "versionName": "4.1.5",
          "versionCode": "75",
          "size": 11149659,
          "sha256": "ec3ec539aaac978283d3512af01ce26276959e75e831666231070ce9eb8a7b72",
          "channel": "developer-github",
          "channelLabel": "GitHub release",
          "sourcePage": "https://github.com/OxygenCobalt/Auxio/releases/tag/v4.1.5",
          "signers": [
            "da84e2534c1acc0b6e4f57dedb640d4dc893f5bf4137a2e1ecba87adf825ba44"
          ],
          "manifest": {
            "compiledXmlTreeSha256": "65d5cef4de1087ab6d33b3ca089cac68ac30d0fced55945fa66800033959f452",
            "compiledXmlTreeWithoutSourceLinesSha256": "332c37aa09b0fd85fda8e435b53951079d74e8606f62ff376fab56f4ef0dd38f",
            "minSdk": "24",
            "targetSdk": "36",
            "requestedPermissions": [
              "android.permission.FOREGROUND_SERVICE",
              "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
              "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
              "android.permission.FOREGROUND_SERVICE_SPECIAL_USE",
              "android.permission.POST_NOTIFICATIONS",
              "android.permission.READ_EXTERNAL_STORAGE",
              "android.permission.READ_MEDIA_AUDIO",
              "android.permission.WAKE_LOCK",
              "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "requestedPermissionDeclarations": [
              {
                "name": "android.permission.FOREGROUND_SERVICE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_DATA_SYNC",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.FOREGROUND_SERVICE_SPECIAL_USE",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.POST_NOTIFICATIONS",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.READ_EXTERNAL_STORAGE",
                "declaration": "uses-permission",
                "maxSdkVersion": "32"
              },
              {
                "name": "android.permission.READ_MEDIA_AUDIO",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "android.permission.WAKE_LOCK",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              },
              {
                "name": "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION",
                "declaration": "uses-permission",
                "maxSdkVersion": null
              }
            ],
            "declaredPermissions": [
              "org.oxycblt.auxio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION"
            ],
            "features": [
              {
                "name": "android.hardware.faketouch",
                "required": true
              }
            ]
          },
          "native": {
            "libraryCount": 4,
            "inventorySha256": "cf42ba364c34f23907d517168f42bd3e8b410e292a3699a3b64af1ec2612f497",
            "runtimeStatus": "not-tested"
          }
        }
      ],
      "evidence": [
        {
          "id": "fdroid-reproducible-builds",
          "sourceType": "channel-policy",
          "referenceUrl": "https://f-droid.org/docs/Reproducible_Builds/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "b7c899bdeeedf815ed0995c645097c7b79539827b32bf8ad4c54fdd220996438",
          "explanation": "F-Droid documents both developer-signed reproducible publishing and verification-only rebuilds. A successful verification entry must therefore be interpreted against the specific published artifact and must not be assumed to mean that a GitHub APK is identical."
        },
        {
          "id": "fdroid-signing-process",
          "sourceType": "channel-policy",
          "referenceUrl": "https://f-droid.org/en/docs/Signing_Process/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "0c586311c986fb3f15a3fa2bd93f4176a0c4e3dfb994ddb6ee871ed389119bfb",
          "explanation": "F-Droid documents that its tooling can generate and manage a distinct APK signing key for each maintained application. The selected artifacts are still classified from their measured signer fingerprints rather than from policy alone."
        },
        {
          "id": "auxio-fdroid-metadata",
          "sourceType": "channel-metadata",
          "referenceUrl": "https://gitlab.com/fdroid/fdroiddata/-/raw/master/metadata/org.oxycblt.auxio.yml",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "644a10eb373439c926df2faface3f3ecfe8c0dfad5a68bcb6acbd319e5cbea86",
          "explanation": "The archived F-Droid recipe records Auxio 4.1.5 (version code 75), source commit 5bd1efe, NDK r28c, and pre-build changes including removal of gms references before the repository build."
        },
        {
          "id": "auxio-fdroid-verification",
          "sourceType": "reproducible-build-metadata",
          "referenceUrl": "https://verification.f-droid.org/packages/org.oxycblt.auxio/",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "71195dc3df37ba05642b2e4d485872a68d80893d191270ceeab6dec76a0438f7",
          "explanation": "F-Droid's verification page marks Auxio 4.1.5 code 75 as reproducible against the APK published by F-Droid; it does not claim identity with the separately published GitHub APK."
        },
        {
          "id": "auxio-github-release",
          "sourceType": "first-party-documentation",
          "referenceUrl": "https://api.github.com/repos/OxygenCobalt/Auxio/releases/tags/v4.1.5",
          "accessedDate": "2026-11-11",
          "snapshotSha256": "a921f17d012687400081a38dcdee81e8f6baf51429f08d847ada9d388bfec1cb",
          "explanation": "The developer's GitHub release body publishes the APK SHA-256 and certificate hash that match the selected GitHub artifact."
        }
      ]
    }
  ]
}