APP ORIGIN LAB PRE-LAUNCH / NOINDEX

CROSS-CHANNEL IDENTITY / EVIDENCE-REVIEWED CANDIDATE

Same app. Same version. Not always the same APK.

Ten freshly acquired APKs form five matched channel pairs. KernelSU and Shizuku are byte-identical; Termux, NewPipe, and Auxio use different measured signer sets.

01 / RESEARCH QUESTION

What stays the same when the version label does?

When two Android channels publish the same package, version name, and version code, which exact-file, signing, compiled-manifest, permission, and native-library properties stay the same?

Package name, version name, and version code are matching keys, not proof of one file. This study keeps whole-file identity, signing identity, compiled manifest fields, permission declarations, and native-library inventory separate so one match cannot erase a difference elsewhere.

THE RESULT

What this batch observed

2
pairs were byte-identical across the two selected URLs
3
pairs used different measured signer sets
5
pairs had matching requested-permission declarations
0
runtime install or update tests were performed

FIVE MATCHED PAIRS

Each pair keeps its own source and measurement boundary

PAIR 01

Termux

The selected F-Droid and GitHub APKs differ in bytes, signer, native-library inventory, and compiled manifest. After aapt2 source-line annotations are removed, the GitHub build's android:debuggable=true attribute is the only manifest-tree difference.

APK bytes
Different
Signer set
Different
Manifest without source lines
Different
Permission declarations
Same
Native inventory
Different
  1. F-Droid0.118.3 · code 1002228fb2cfe908…34d41c42
  2. GitHub release0.118.3 · code 1002b6da01480eef…d48ee5e1

SOURCE CONTEXT

  • Termux installation sourcesTermux's version-pinned README says APKs from different sources use different signature keys and must not be mixed; maintainers do not control the F-Droid signing keys, while GitHub release and workflow APKs are debuggable and compatible only with each other.
  • F-Droid signing processF-Droid documents that its tooling can generate and manage a distinct APK signing key for each maintained application. The selected artifacts are still classified from their measured signer fingerprints rather than from policy alone.

BoundaryTermux documents that these source families use different signatures and cannot be mixed. Its README does not explain the measured native-library difference, and this study did not test an update or reinstall.

PAIR 02

KernelSU

The selected IzzyOnDroid and GitHub APKs have the same full-file SHA-256. Their measured signer, compiled manifest, permission declarations, and native inventory therefore match as parts of the same bytes.

APK bytes
Same
Signer set
Same
Manifest without source lines
Same
Permission declarations
Same
Native inventory
Same
  1. IzzyOnDroidv3.3.1 · code 32680c371061b19d8…1fc2d2d6
  2. GitHub releasev3.3.1 · code 32680c371061b19d8…1fc2d2d6

SOURCE CONTEXT

  • IzzyOnDroid repository policyIzzyOnDroid says it takes official APK binaries from developer repositories and checks the recorded developer signature on updates; the artifact measurements, not this general policy alone, determine whether each selected pair is byte-identical.

BoundaryThis exact-file match applies only to KernelSU v3.3.1 at the evidence date. It does not establish that every IzzyOnDroid item or future KernelSU version is redistributed unchanged.

PAIR 03

Shizuku

The selected IzzyOnDroid and GitHub APKs are byte-identical, including the measured signer, compiled manifest, permission declarations, and native-library inventory.

APK bytes
Same
Signer set
Same
Manifest without source lines
Same
Permission declarations
Same
Native inventory
Same
  1. IzzyOnDroid13.6.0.r1086.2650830c · code 1086268b5590e868…8e30db30
  2. GitHub release13.6.0.r1086.2650830c · code 1086268b5590e868…8e30db30

SOURCE CONTEXT

  • IzzyOnDroid repository policyIzzyOnDroid says it takes official APK binaries from developer repositories and checks the recorded developer signature on updates; the artifact measurements, not this general policy alone, determine whether each selected pair is byte-identical.

BoundaryThe result identifies these two exact Shizuku files. IzzyOnDroid's general acquisition policy is context, not a substitute for the measured digest.

PAIR 04

NewPipe

F-Droid lists two APK variants for NewPipe 0.29.1/code 1015. This pair deliberately uses the base F-Droid-signed APK: it differs from GitHub in bytes and signer, while the compared manifest, permission declarations, and native inventory match.

APK bytes
Different
Signer set
Different
Manifest without source lines
Same
Permission declarations
Same
Native inventory
Same
  1. F-Droid base build0.29.1 · code 1015964dfa418e66…7eb5e9d4
  2. GitHub release0.29.1 · code 1015cb84069bd681…f5cf5cab

SOURCE CONTEXT

  • F-Droid reproducible buildsF-Droid documents both developer-signed reproducible publishing and verification-only rebuilds. A successful verification entry must therefore be interpreted against the specific published artifact and must not be assumed to mean that a GitHub APK is identical.
  • NewPipe F-Droid metadataThe archived F-Droid recipe records NewPipe 0.29.1 (version code 1015), its source commit, and both the F-Droid and upstream certificate fingerprints among the allowed signing keys.
  • NewPipe F-Droid variantsF-Droid lists two 0.29.1 code 1015 variants: an upstream-signed APK with a signer suffix in its filename and a separately built and F-Droid-signed base APK. This pair deliberately measures the base F-Droid-signed URL against GitHub.

BoundaryThe developer-signed F-Droid variant is not part of this pair. Matching selected fields is not a claim that the two measured APKs are otherwise equivalent or interchangeable as updates.

PAIR 05

Auxio

The selected F-Droid and GitHub APKs differ in bytes, signer, and native-library inventory. Their compiled manifest, SDK bounds, permission declarations, and feature list match in this measurement.

APK bytes
Different
Signer set
Different
Manifest without source lines
Same
Permission declarations
Same
Native inventory
Different
  1. F-Droid4.1.5 · code 7565b3e62a2b57…2a285972
  2. GitHub release4.1.5 · code 75da84e2534c1a…f825ba44

SOURCE CONTEXT

  • F-Droid reproducible buildsF-Droid documents both developer-signed reproducible publishing and verification-only rebuilds. A successful verification entry must therefore be interpreted against the specific published artifact and must not be assumed to mean that a GitHub APK is identical.
  • F-Droid signing processF-Droid documents that its tooling can generate and manage a distinct APK signing key for each maintained application. The selected artifacts are still classified from their measured signer fingerprints rather than from policy alone.
  • Auxio F-Droid metadataThe archived F-Droid recipe records Auxio 4.1.5 (version code 75), source commit 5bd1efe, NDK r28c, and pre-build changes including removal of gms references before the repository build.
  • Auxio F-Droid verificationF-Droid's verification page marks Auxio 4.1.5 code 75 as reproducible against the APK published by F-Droid; it does not claim identity with the separately published GitHub APK.
  • Auxio GitHub releaseThe developer's GitHub release body publishes the APK SHA-256 and certificate hash that match the selected GitHub artifact.

BoundaryF-Droid's verification record concerns the APK published by F-Droid, not identity with GitHub. The recorded build recipe provides context; this study does not assign every byte difference to one cause.

EVIDENCE RECORD

The ten measured artifacts

Every row is a fresh formal download checked against its frozen package identity and SHA-256 before comparison. Links go to project or repository pages, never APK files.

Channel, package identity, artifact digest, current signer, and source page for every measured APK
Project / channelPackage and sizeAPK SHA-256Current signer SHA-256Source
TermuxF-Droid · 0.118.3com.termuxcode 1002 · 108.6 MiBe6265a57eb5ca363808488e3b01955958bed93bc0c8a0d281849b363b11027ec228fb2cfe90831c1499ec3ccaf61e96e8e1ce70766b9474672ce427334d41c42Source page
TermuxGitHub release · 0.118.3com.termuxcode 1002 · 112.3 MiB7600078440c3c34ef050bc009b00fc3215cb87ec4a449e01a696f74cf4249db2b6da01480eefd5fbf2cd3771b8d1021ec791304bdd6c4bf41d3faabad48ee5e1Source page
KernelSUIzzyOnDroid · v3.3.1me.weishu.kernelsucode 32680 · 13.0 MiBb4a059ace71de2fa65cc7f12b1c58d55fc23ab25e057ee4230ce779742abe450c371061b19d8c7d7d6133c6a9bafe198fa944e50c1b31c9d8daa8d7f1fc2d2d6Source page
KernelSUGitHub release · v3.3.1me.weishu.kernelsucode 32680 · 13.0 MiBb4a059ace71de2fa65cc7f12b1c58d55fc23ab25e057ee4230ce779742abe450c371061b19d8c7d7d6133c6a9bafe198fa944e50c1b31c9d8daa8d7f1fc2d2d6Source page
ShizukuIzzyOnDroid · 13.6.0.r1086.2650830cmoe.shizuku.privileged.apicode 1086 · 2.5 MiB6e273ab0e991c4e79bc8b1bbb9b9dd739ccac1a8712a541a214078886b7b790f268b5590e868fb08bae7e0ac413564cd1ff88f5ccff74af9dbd0dc918e30db30Source page
ShizukuGitHub release · 13.6.0.r1086.2650830cmoe.shizuku.privileged.apicode 1086 · 2.5 MiB6e273ab0e991c4e79bc8b1bbb9b9dd739ccac1a8712a541a214078886b7b790f268b5590e868fb08bae7e0ac413564cd1ff88f5ccff74af9dbd0dc918e30db30Source page
NewPipeF-Droid base build · 0.29.1org.schabi.newpipecode 1015 · 11.0 MiB1d66d19eedbab969b1be2e44e0ea35f5f8921cbe83b5c5ac810767ca1a84b7e8964dfa418e66390110b0c061a0497cbbd7395b8b2526bee4dece95597eb5e9d4Source page
NewPipeGitHub release · 0.29.1org.schabi.newpipecode 1015 · 11.0 MiB18447bfb1e06d113edc88df93f471827280de06f6f3d4dc42f56f28b9c1bab79cb84069bd68116bafae5ee4ee5b08a567aa6d898404e7cb12f9e756df5cf5cabSource page
AuxioF-Droid · 4.1.5org.oxycblt.auxiocode 75 · 10.7 MiBc2053d36c28dbe74de40eadcd8978ec874c465ed3352bba655d4b2b364780b4565b3e62a2b57bf73235be6d2d42ae546fcb02fd17f62cd14500d1c412a285972Source page
AuxioGitHub release · 4.1.5org.oxycblt.auxiocode 75 · 10.6 MiBec3ec539aaac978283d3512af01ce26276959e75e831666231070ce9eb8a7b72da84e2534c1acc0b6e4f57dedb640d4dc893f5bf4137a2e1ecba87adf825ba44Source page

Reproducible dataDownload the evidence-reviewed JSON snapshot. It includes measured permission declarations and source-context references, but no APK download URLs or safety verdict.

02 / METHOD

Pair first, acquire again, then compare independent layers

  1. 01
    Freeze the matching keys

    Declare package name, version name, version code, channel, source page, exact source URL, and expected digest before formal acquisition.

  2. 02
    Archive source context

    Bind channel policy, package metadata, reproducibility records, or first-party distribution documentation to a declared pair. A policy statement cannot replace file measurement.

  3. 03
    Download every file again

    Fetch all ten APKs directly from the frozen HTTPS URLs. A stale cache, missing file, or digest change remains evidence missing rather than becoming a result.

  4. 04
    Verify identity and signing

    Check package/version identity and APK signatures before comparing bytes, current signer sets, or v3-family lineage.

  5. 05
    Keep layers separate

    Compare exact and source-line-neutral compiled-manifest digests, SDK bounds, permission names and declarations, features, and native-library inventory. Matching one layer does not imply matching another.

Read the site methodologyF-Droid reproducible-build reference

LIMITS AND INTERPRETATION

What the evidence does not establish

Not a prevalence sample

The five projects were selected to exercise different channel paths. The 2-of-5 and 3-of-5 counts cannot be generalized to Android apps or repositories.

Runtime not tested

No APK was installed, updated, or exercised. Update compatibility, data migration, visible behavior, and network activity remain untested.

No safety verdict

Different bytes or signers are not evidence of tampering or malware. Byte identity is also not evidence that software is safe.

No local rebuild

Channel reproducibility records are cited as source context. App Origin Lab did not rebuild these five projects from source.

03 / RELATED-SITE INCREMENT

Why this is not another download comparison

The related download sites 2113 Apps and TigrinhoAPK are run by the same operator as this site. As checked on 11 November 2026, 2113 Apps has same-version pages for Termux, KernelSU, Shizuku, NewPipe, and Auxio. Those pages expose the SHA-256 of one measured file in each pair: the Termux and Auxio F-Droid files; the byte-identical KernelSU and Shizuku files; and the developer-signed NewPipe file, not the F-Droid base build used here. TigrinhoAPK’s Auxio 4.1.5 page lists that same F-Droid file.

Neither related site publishes these five frozen same-version pairs, the pair-bound source snapshots, two compiled-manifest digests, declaration-level permission comparison, or the distinction between F-Droid's two NewPipe variants.

This page answers an artifact-identity question. It does not host files, provide download buttons, review app features, or recommend one channel over another.

CORRECTIONS

Challenge the file or the interpretation

Send the project, version, channel, disputed field, and a primary-source URL to corrections@apporiginlab.com. Ownership is disclosed on the About page.

REVISION HISTORY

  1. Evidence-reviewed candidate 0.2

    Passed two page-review rounds. Still not published and still noindex.

  2. Review candidate 0.1

    Drafted from formal batch 01 after two data-review rounds. Not published and still noindex.