Guide summary
Audit Android package registration and channel signing for users in Indonesia, where the first verification phase began September 30, 2026.
For: Consumer apps, games, fintech products and third-party stores serving Indonesia.
Release sequence
- Inventory each listing that serves Indonesian users through a participating store.
- Record package name, channel and delivered signing certificate as a separate audit row.
- Use the package-and-certificate check for every row; treat a different-certificate state as a signing-history investigation, not an instruction to rotate a key.
- Assign unresolved console actions to the account owner and prepare Indonesian-language support guidance for user reports.
Quick facts
Illustrative case: the Play artifact matches its registered certificate, but a separately signed OEM-store build does not. Keep those channel records separate and add a legitimate key through the official workflow when required.
Detailed guidance
Keep Indonesia channel records separate
Since September 30, 2026, the first phase applies to installations from participating stores on certified Android 7 or higher devices in Indonesia. A package appearing in more than one store still needs a channel-level audit: store release artifacts, flavors and signing certificates can differ.
When an unresolved row appears, verify the package and full SHA-256 from that channel's production APK, then use the matching Play Console or Android Developer Console account. Prepare Indonesian-language support notes for cases where the package is registered but a particular delivered certificate is not.
- Keep one row per store-delivered artifact.
- Check the full certificate digest; abbreviated examples are not valid inputs.
- Assign an account owner to each open console task.
- Recheck after changing a build flavor, key or distribution channel.
Have the production package name and signing certificate ready? Query the official registration state, then use the result to choose your next step.
Run status check →Frequently asked questions
Why can one store pass while another needs remediation?
A package can be delivered with different signing certificates through separate channel builds. A matching result for one package-and-certificate pair does not establish that another channel's certificate is registered; inspect and check each production artifact independently.
Can the package-only result detect a channel certificate mismatch?
No. A package-only check does not compare a signing identity. Supply the SHA-256 fingerprint extracted from the artifact users receive through that channel, and keep the channel attached to the release record.
Sources and review
Last reviewed: