Extract the SHA256 fingerprint of an APK signing cert. Run with $ ./extract_apk_cert_sha256.sh <something.apk>

extract_apk_cert_sha256.sh

#!/usr/bin/env bash
set -e
[ ! -r "$1" ] && echo "usage: $0 <apk>" && exit 1
tmpdir="$(mktemp -d)"
tmpcrt="$(mktemp)"

# unzip the apk into a temporary directory
unzip -qq "$1" -d "$tmpdir"

# extract the public cert from the pkcs7 detached signature
openssl pkcs7 -print_certs \
    -in "$tmpdir/META-INF/SIGNATURE.RSA" -inform DER \
    -out "$tmpcrt"

# calculate the sha256 of the DER form of the cert
echo -n "sha256 of signing cert: "
openssl x509 -in "$tmpcrt" -inform PEM -outform DER | \
    openssl dgst -sha256 -hex | \
    awk '{print $2}' | \
    sed 's/..\B/&:/g' | \
    tr [a-z] [A-Z]

rm -rf "$tmpdir" "$tmpcrt"