title: How does an .apk files get signed
body: <p>This is not a question about how to sign an .apk file. I want to know what does signing actually means and how it is implemented.</p>
  
  <p>Inside the .apk file there is META-INF folder and inside that there are two files.</p>
  
  <p>First one is CERT.SF contains SHA1 hashes for various components and looks like this:</p>
  
  <pre><code>Name: res/layout/main.xml
  SHA1-Digest: Cox/T8fN1X9Hv4VqjH9YKqc/MsM=
  
  Name: AndroidManifest.xml
  SHA1-Digest: wZ418H9Aix1LNch3ci7c+cHyuZc=
  
  Name: resources.arsc
  SHA1-Digest: P+uoRrpFyVW6P3Wf+4vuR2ZSuXY=
  
  Name: classes.dex
  SHA1-Digest: cN3zXtGii9zuTOkBqDTLymeMZQI=
  </code></pre>
  
  <p>There is also a file called CERT.RSA. I assume it is the public key to verify the signature.</p>
  
  <p>My question is, where is the signature for the whole .apk file is stored? And what is actually signed? It could be either</p>
  
  <ul>
  <li>.apk file used as a single binary object and this is signed</li>
  <li>or CERT.SF is signed which contains individual hashes for different components</li>
  </ul>
  
  <p>It would be also much better if you can point me to the documentation of the detailed signing and verification process.</p>