MuntashirAkon/AppManager · critical · BackupException

Signing info verification failed.\nInstalled: ${certChecksum

Error message

Signing info verification failed.\nInstalled: ${certChecksumList}\nBackup: ${Arrays.toString(certChecksums)}

What it means

restoreApkFiles() compares the signing-certificate checksums of the currently installed app (PackageUtils.getSigningCertChecksums) with the certificate checksums recorded in the backup (BackupItems.Checksum.getCertChecksums). If a backup certificate checksum is not present among the installed certificates and signature check is not skipped, this BackupException is thrown — the backed-up APK was signed by a different key than the installed app.

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/backup/RestoreOp.java:292

    private void restoreApkFiles() throws BackupException {
        if (!mBackupFlags.backupApkFiles()) {
            throw new BackupException("APK restore is requested but backup doesn't contain any source files.");
        }
        Path[] backupSourceFiles = mBackupItem.getSourceFiles();
        if (backupSourceFiles.length == 0) {
            // No source backup found
            throw new BackupException("Source restore is requested but there are no source files.");
        }
        boolean isVerified = true;
        if (mPackageInfo != null) {
            // Check signature of the installed app
            List<String> certChecksumList = Arrays.asList(PackageUtils.getSigningCertChecksums(mBackupInfo.checksumAlgo, mPackageInfo, false));
            String[] certChecksums = BackupItems.Checksum.getCertChecksums(mChecksum);
            for (String checksum : certChecksums) {
                if (certChecksumList.contains(checksum)) continue;
                isVerified = false;
                if (!mRequestedFlags.skipSignatureCheck()) {
                    throw new BackupException("Signing info verification failed." +
                            "\nInstalled: " + certChecksumList +
                            "\nBackup: " + Arrays.toString(certChecksums));
                }
            }
        }
        if (!mRequestedFlags.skipSignatureCheck()) {
            String checksum;
            for (Path file : backupSourceFiles) {
                checksum = DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, file);
                if (!checksum.equals(mChecksum.get(file.getName()))) {
                    throw new BackupException("Source file verification failed." +
                            "\nFile: " + file +
                            "\nFound: " + checksum +
                            "\nRequired: " + mChecksum.get(file.getName()));
                }
            }
        }
        if (!isVerified) {

View on GitHub (pinned to 0152f468fc)

Solutions

Uninstall the currently installed app, then restore the backup so the backed-up APK (with its original signature) is installed.
If the installed version is the one you want, install its APK instead of the backed-up one so signatures match.
Enable 'skip signature check' in the restore options only if you accept installing over a differently-signed app (data may be rejected by Android for signature mismatch on install).
Verify cert checksums: a mismatched checksum file from another backup can also trigger this; confirm the checksums file belongs to this backup.

Defensive patterns

Strategy: try-catch

Validate before calling

// Compare signatures before restoring:
String[] installed = PackageUtils.getSigningCertChecksums(info.checksumAlgo, packageInfo, false);
String[] backup = BackupItems.Checksum.getCertChecksums(checksums);
boolean compatible = Arrays.stream(backup).allMatch(c -> Arrays.asList(installed).contains(c));
// if !compatible: uninstall first, or skip signature check consciously

Try / catch

try { restoreOp.runRestore(); } catch (BackupException e) {
    if (e.getMessage().startsWith("Signing info verification failed")) {
        // parse Installed/Backup cert lists; offer uninstall-then-restore flow
    }
}

Prevention

Keep backups of the exact APK build you run (same signature) — avoid mixing store and sideloaded variants.
Uninstall before restoring when signatures differ.
Never skip signature checks when restoring backups from untrusted sources.

When it happens

Trigger: During restore, for some checksum in certChecksums, certChecksumList.contains(checksum) is false while mRequestedFlags.skipSignatureCheck() is false; message embeds installed vs backup cert checksum lists.

Common situations: The app was re-signed (e.g. repacked APK, Play Store vs sideloaded signature, debug vs release key); restoring a backup of a modified/forked APK over a store-installed app; the developer rotated signing keys.

Related errors

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/da0d7e421c548804. Report an issue: GitHub.