一、手工驗證 用winrar開啟簽名過的apk包，發現多了一個META-INF資料夾： 解壓縮後開啟META-INF目錄，有三個檔案：MANIFEST.MF，CERT.SF，CERT.RSA
本文只講解MANIFEST.MF的生成，用記事本開啟MANIFEST.MF檔案：

Manifest-Version: 1.0
Created-By: 1.0 (Android)

Name: res/drawable-xhdpi/ic_launcher.png
SHA1-Digest: AfPh3OJoypH966MludSW6f1RHg4=

Name: res/menu/main.xml
SHA1-Digest: wXc4zBe0Q2LPi4bMr25yy5JJQig=

Name: AndroidManifest.xml
SHA1-Digest: k3QiLyii25nxkE9q59pXGWI2aTo=

Name: res/drawable-mdpi/ic_launcher.png
SHA1-Digest: RRxOSvpmhVfCwiprVV/wZlaqQpw=

Name: res/drawable-hdpi/ic_launcher.png
SHA1-Digest: Nq8q3HeTluE5JNCBpVvNy3BXtJI=

Name: res/layout/activity_main.xml
SHA1-Digest: qVW+nHovqmEmKpssXKUBidrNDDA=

Name: resources.arsc
SHA1-Digest: luJu2wwHeH7XAJwms2gIq/pco40=

Name: lib/armeabi/libhello-jni.so
SHA1-Digest: uFb6Vfi3T/Rq0dvjgCqW7fKKrzM=

Name: classes.dex
SHA1-Digest: zaipAFvc+AzMSc2nJJG9zIrrfqE=

Name: res/drawable-xxhdpi/ic_launcher.png
SHA1-Digest: GVIfdEOBv4gEny2T1jDhGGsZOBo=

以檔案res/menu/main.xml做驗證，用HashTab檢視該檔案的SHA-1值是C17738CC17B44362CF8B86CCAF6E72CB92494228
複製該二進位制串到WINHEX中：
使用“Base64編碼解碼工具”對此二進位制檔案計算base64編碼：
開啟輸出檔案中的base64編碼為： wXc4zBe0Q2LPi4bMr25yy5JJQig= 是和MANIFEST.MF檔案中res/menu/main.xml對應的SHA1-Digest值是一樣的。 也就是說MANIFEST.MF中儲存了所有其他檔案的SHA-1並base64編碼後的值。 二、android原始碼驗證

            // MANIFEST.MF
            Manifest manifest = addDigestsToManifest(inputJar);
            je = new JarEntry(JarFile.MANIFEST_NAME);
            je.setTime(timestamp);
            outputJar.putNextEntry(je);
            manifest.write(outputJar);

    /** Add the SHA1 of every file to the manifest, creating it if necessary. 
 
*/
    private static Manifest addDigestsToManifest(JarFile jar)
            throws IOException, GeneralSecurityException {
        Manifest input = jar.getManifest();
        Manifest output = new Manifest();
        Attributes main = output.getMainAttributes();
        if (input != null) {
            main.putAll(input.getMainAttributes());
        } else {
            main.putValue("Manifest-Version", "1.0");
            main.putValue("Created-By", "1.0 (Android SignApk)");
        }

        BASE64Encoder base64 = new BASE64Encoder();
        MessageDigest md = MessageDigest.getInstance("SHA1");
        byte[] buffer = new byte[4096];
        int num;

        // We sort the input entries by name, and add them to the
        // output manifest in sorted order.  We expect that the output
        // map will be deterministic.
        TreeMap<String, JarEntry> byName = new TreeMap<String, JarEntry>();

        for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
            JarEntry entry = e.nextElement();
            byName.put(entry.getName(), entry);
        }

        for (JarEntry entry: byName.values()) {
            String name = entry.getName();
            if (!entry.isDirectory() && !name.equals(JarFile.MANIFEST_NAME) &&
                !name.equals(CERT_SF_NAME) && !name.equals(CERT_RSA_NAME) &&
                (stripPattern == null ||
                 !stripPattern.matcher(name).matches())) {
                InputStream data = jar.getInputStream(entry);
                while ((num = data.read(buffer)) > 0) {
                    md.update(buffer, 0, num);
                }

                Attributes attr = null;
                if (input != null) attr = input.getAttributes(name);
                attr = attr != null ? new Attributes(attr) : new Attributes();
                attr.putValue("SHA1-Digest", base64.encode(md.digest()));
                output.getEntries().put(name, attr);
            }
        }

        return output;
    }

也可以看出MANIFEST.MF中儲存了所有其他檔案的SHA-1並base64編碼後的值。