APP ORIGIN LAB PRE-LAUNCH / NOINDEX

SIGNING HISTORY / EVIDENCE-REVIEWED CANDIDATE

A release note says the signing key changed. The APKs show where.

Nine developer-published GitHub release APKs across Poker Payout, Messages, and OBS Blade reveal four measured signer changes: three match first-party notices; one earlier OBS change has no transition-specific explanation.

01 / RESEARCH QUESTION

Can an announced key change be tied to the files themselves?

Can developer-announced Android signing-key changes be bound to adjacent measured APK signer sets without treating a release note as cryptographic proof of rotation?

The answer in these three cases is narrower than “the app rotated its key.” We can bind a developer statement to measured old and new signer fingerprints. None of the nine APKs contains a verified v3/v3.1 proof-of-rotation lineage, so the announcements remain source-backed explanations—not cryptographic lineage.

THE RESULT

What this batch observed

3
announced replacements bound to measured signer changes
1
earlier signer change without transition-specific evidence
0
verified proof-of-rotation lineage segments in the real sample
0
overwrite-install tests; reinstall effects remain not tested

THREE RELEASE HISTORIES

Each transition keeps its own evidence boundary

CASE 01

Poker Payout

The measured signer changes at 1.2.0, where the developer says the old key was lost and a one-time reinstall is required. The measured 1.4.28 endpoint uses the same new signer.

  1. 1.1.12version code 240558e11420a9…e2853de7
  2. 1.2.0version code 25223c397a82d6…59db35c0
  3. 1.4.28version code 69223c397a82d6…59db35c0
1.1.121.2.0
First-party-announced key replacement

Source-backedThe developer's v1.2.0 release notes say the old signing key was lost, this build uses a new key, and updating from an older build requires a one-time reinstall. Read the developer release note.

1.2.01.4.28
Same measured signer

MeasuredThe two measured endpoints contain the same current signer fingerprint.

BoundaryFour GitHub releases between 1.2.0 and 1.4.28 were not measured, so the endpoint match is not a claim about every intermediate artifact.

CASE 02

Messages

The measured signer changes at 1.0.8, where the developer says a system reset caused the previous key to be lost. Version 1.0.10 retains the measured 1.0.8 signer.

  1. 1.0.7version code 84db7e290e29a…ef4efbfd
  2. 1.0.8version code 9b8bfa22abacb…dca2d9da
  3. 1.0.10version code 12b8bfa22abacb…dca2d9da
1.0.71.0.8
First-party-announced key replacement

Source-backedThe developer's v1.0.8 release notes say the previous signing key was lost in a system reset, the keys changed, and users may need to uninstall and reinstall. Read the developer release note.

1.0.81.0.10
Same measured signer

MeasuredThe two measured endpoints contain the same current signer fingerprint.

BoundaryThe developer says users may need to reinstall. This study did not attempt an overwrite update or measure data loss.

CASE 03

OBS Blade

The 3.2.0 to 4.2.0 change matches a first-party notice. The earlier 2.1.0 to 3.2.0 change has no transition-specific signing statement or verified APK lineage.

  1. 2.1.0version code 20220531011ae300a84a65…de1a8662
  2. 3.2.0version code 20230120039183c56b5518…a7f03ac1
  3. 4.2.0version code 2026102003dacd5fe5e0e0…c64a4c19
2.1.03.2.0
Unexplained signer change

Evidence gapNo transition-specific signing statement or verified lineage was collected for this change.

3.2.04.2.0
First-party-announced key replacement

Source-backedThe developer's 4.2.0 FOSS release notes say the build uses a new signing key and users coming from 3.2 must uninstall it before installing 4.2. Read the developer release note.

BoundaryVersion 2.1.0 is labeled Legacy, while 3.2.0 is a FOSS release published by GitHub Actions and signed with an Android Debug certificate. “Unexplained” does not mean concealed or malicious.

EVIDENCE RECORD

The nine measured artifacts

Each row is a fresh formal download from the project’s GitHub release, verified before classification. Links go to release pages, not APK files. Full values are shown so the evidence can be matched exactly.

Package identity, artifact digest, and current signer for every measured version
Project / versionPackage and sizeAPK SHA-256Current signer SHA-256Source
Poker Payout1.1.12 (24)com.huntercoles.pokerpayout13.0 MiB · v29a4f03129c0af89883ece1005949f6515445c0b803240474ac77670d17a5f4a40558e11420a97f212d7048f6b04351fdc82498f9d69cc5c0115270b5e2853de7Release page
Poker Payout1.2.0 (25)com.huntercoles.pokerpayout13.0 MiB · v28d326f70766465801ee6b843853deae3128cb53feddf91805c57f48ca1eb2433223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0Release page
Poker Payout1.4.28 (69)com.huntercoles.pokerpayout2.4 MiB · v2ec3218870ec32dcf24e05e7f30a40e02cb4fc46275d6081866568609f4e38c3e223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0Release page
OBS Blade2.1.0 (2022053101)com.kounex.obsBlade25.2 MiB · v1 + v21fd9380e2d5a777bd252b1f7c6db393c9d5e5d70ec5d0eda4a0975a4401cfd921ae300a84a6581ddcd430c125860b2444625291d37565ae43b25469ede1a8662Release page
OBS Blade3.2.0 (2023012003)com.kounex.obsBlade25.6 MiB · v1 + v25c9397cf32cf9766797e033426384e72fe9289c865c11ff14d50413edbbbb1169183c56b5518a3215d18c0fe9e244d64a1a94917dd4df86019c46ad7a7f03ac1Release page
OBS Blade4.2.0 (2026102003)com.kounex.obsBlade72.6 MiB · v213ee8eb4feb5185d27be01b09696c30c7d0da8e6badb3c730cf6b5cae6c62d17dacd5fe5e0e07a61ead879829101c36d664e56c5af269f6e9789e102c64a4c19Release page
Messages1.0.7 (8)org.prauga.messages49.1 MiB · v1 + v2cdc4224da333f4b768dc28b4745856958fbd99633e44297c08673230cec5f87b4db7e290e29ae42aa02282b97d4e86edab6700464f7daa4ac8f9a0ceef4efbfdRelease page
Messages1.0.8 (9)org.prauga.messages49.1 MiB · v1 + v29f63cffe482744703a8cc0d176cdcbbcade710d1cb13122a922d39787b5d0dd9b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9daRelease page
Messages1.0.10 (12)org.prauga.messages49.0 MiB · v273c6a968e8b59260019b799b229e604aafa9a47ad6c0bfaf2c3aace878ccf6fcb8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9daRelease page

Reproducible dataDownload the evidence-reviewed JSON snapshot. It excludes APK download URLs and makes no safety verdict.

02 / METHOD

Frozen first, downloaded again, then classified

  1. 01
    Freeze identities and the question

    Record package, version, expected digest, source page, research role, and any transition-specific notice before formal collection.

  2. 02
    Acquire every candidate again

    Download each artifact from its fixed HTTPS release URL. A missing or changed file stays in the denominator as evidence missing.

  3. 03
    Verify package and signature

    Use Android Build Tools 37.0.0, including its apksigner library, to verify identity, schemes, current signer certificates, and v3-family lineage.

  4. 04
    Bind—not substitute—the release note

    Our evidence record ties each first-party notice to one adjacent transition, and its recorded old and new signer sets must equal our measurements. Only Poker Payout’s release notes print the certificate fingerprint itself. The archived page hash records what was reviewed.

  5. 05
    Take the weakest transition

    A project summary cannot use a later explained change to erase an earlier unexplained one. That is why OBS Blade remains unexplained at project level.

Read the site methodologyAPK Signature Scheme v3 reference

LIMITS AND INTERPRETATION

What the evidence does not establish

Not a prevalence sample

The three projects were selected because their release notes exposed a key-change edge case. No percentage generalizes to Android apps.

Installation not tested

Developer reinstall warnings are source-backed statements. This batch did not attempt an overwrite update or measure retained data.

No safety verdict

Signature verification and digest agreement establish file identity and signing relationships, not whether the software is safe.

No hidden lineage claim

A release note can explain a key change, but it is not an APK Signature Scheme proof-of-rotation record.

03 / RELATED-SITE INCREMENT

Why this is not another download page

The related download sites 2113 Apps and TigrinhoAPK are run by the same operator as this site. 2113 Apps’ open-source APK report already publishes current-file hashes, current signer fingerprints, signature schemes, and acquisition checks. TigrinhoAPK publishes a current hash and signer for Poker Payout 1.1.12 and OBS Blade 4.2.0. Neither site publishes all nine historical artifacts, their adjacent signer transitions, archived key-change notices, or the rule that preserves the weakest transition.

This page answers a history-and-evidence question. It does not host files, offer download buttons, review app features, or target an “app name + APK” query.

CORRECTIONS

Challenge the evidence, not just the conclusion

Send the project, version, disputed field, and a primary-source URL to corrections@apporiginlab.com. Ownership is disclosed on the About page.

REVISION HISTORY

  1. Evidence-reviewed candidate 0.2

    Passed two evidence-review rounds. Still not published and still noindex.

  2. Review candidate 0.1

    Built from formal batch 01 after three evidence-review rounds. Not published and still noindex.