# Verify an INTERACT app's authenticity

Every INTERACT Android app is signed with a release certificate whose **SHA-256
fingerprint** is published here. Fingerprints are **public identifiers** — not
secrets, not private keys:

- each fingerprint is permanently linked to its app id on Google Play;
- anyone can match an installed or downloaded APK against the fingerprint below
  to confirm it is a genuine INTERACT build;
- **any APK whose fingerprint does not match the one listed here is NOT from
  INTERACT** — do not install it.

## How to check an APK

```bash
APKSIGNER=$(ls ~/Library/Android/sdk/build-tools/*/apksigner | tail -1)
"$APKSIGNER" verify --verbose --print-certs <path-to>.apk | grep -E "DN:|SHA-256"
```

Compare the printed `SHA-256` against the app's row below. A mismatch means the
APK is **not authentic** — report it to WhatsApp **+92 300 2020179**.

(You can read the same fingerprint for a Play-listed app in Google Play Console →
App integrity, or via the Play Store listing — it is public there too.)

## Certificate fingerprints

| App | Package id | SHA-256 certificate fingerprint |
| --- | --- | --- |
| **Sahulat** | `com.interactpak.sahulat` | `543dfc78635c558984ad4b65548357e8e3ae4e731e1d7923c0918a7fbcf2dbf1` |
| **Sahulat Crops** | `com.interactpak.sahulat.sahulat_crops` | `624f58aacb2a4833f7a2f5e76845678f11140d0576860201ab4c87fc356eaad2` |
| **Sahulat Pets** | `com.interactpak.sahulat.sahulat_pets` | `19ff77bf7e3d4bf03c14b813707e86a97dad0f4a8bc7850a88bc29075e2fbb23` |
| **Sahulat Super** | `com.interactpak.sahulat_super` | `b88b3080a1e6419d0c1d529f63e049fbd95b9ca582f1f2df12e1a313db93698b` |
| **Sahulat Connect** | `com.interactpak.sahulat_connect` | `38df7f36ea7f095a7091c709a73a9977363ca6d83051795a4d50da6f712e3141` |
| **LeathX App** | `com.interactpak.leathx` | `1438bd4699126e0a96927acf33d88a4ca22b654687d10187f1fa1322c537f3dd` |
| **Rewards** | `com.interactpak.rewards` | *pending first signed build post-rebrand* |
| **Rewards OS (Movento)** *(retired 2026-04-22)* | `com.interactpak.movento` | `0375e96fd89e4e9525780f38026202bbe90ce6a67a46f884440f99b9e84631d8` |
| **BVI** | `com.interactsolutions.bvi` | `077b762e0409e404c6ee3c54b8de001aba712225263afa7fe628c604eebcac01` |
| **Grower OS (Progressive Farmer)** | `com.interactpak.ff` | *to be recorded on next signed build* |
| **Farmers OS Launcher** | `com.interactpak.farmers_os_launcher` | `05bd193e38371568d3605c4ca8d299220600092ffa54e8427d786727f758b7cc` |
| **BulkSale** | `com.interactpak.bulksale` | `2a24482aed73e4c3ec1e91c3d16393bfa6b2242760285947bd39b51f69dd97cf` |
| **ChemOps** | `com.interactpak.chemops` | `400603f6a09cbf40921be3b0a7af95a0bed1ea3aa5a2e9f2f49f6ac96723c202` |
| **FleetOps** | `com.cgt.fleetops` | `310d8f98ace03444727e4e984b5e27e1a9be037ee24fdf79c88aa5a47754e8e7` |
| **Farmer Education** | `com.interactpak.farmeredu` | `ff9a3185511000aa6a3838ef1cb8b92fe03d410484f8ecd1f71cb2f4483d3205` |
| **Zeka** | `com.interactpak.zeka.zeka` | `d5b34067f1a61bc0065dbf48a6f627dd68e2e75a68b678497e4e18c8663deab2` |
| **Kissan Seminar** | `com.interactpak.kissanseminar` | `a73b6d1b7c81662babd98a3f387b4b4b2c8c1b70f1e243539e90c91e3f360ac9` |
| **TMA Settlement** | `com.interactpak.tmasettlement` | `1f6bb99cc1196054ab9a6c7b0939a1354ded58389d97098f7d2eb10618b75910` |
| **Interact Execute (ExecOS)** | `com.interactpak.execute` | `ae6fd237e8d0288483d6d3636bc98191cece8abbc2546e1c6cbd33c77abae0e2` |
| **Interact Pro** | `com.interactpak.interactpro` | `96b183e62bfcafaf0f6f680ec17371585cfda7d4a071eac0ae99fc088f52983c` |
| **OpenMatrix** | `com.interact.openmatrix` | *pending first signed `publish-ota` build* |
| **TryOn** | `com.interactpak.tryon` | *pending first release-signed `upload-downloads` build* |

## Notes for verifiers

- **Sahulat** — the canonical package id is `com.interactpak.sahulat`. An earlier
  listing used `com.interactpak.qurbanisahulat`; builds under that id, if any
  reached a store, are legacy.
- **Sahulat — certificate rotated 2026-10-02.** The earlier cert
  `eff441555ea43691aa82a739ef6cd7fc6627fb9505cee91eb3ad2116ea879f80` is
  **retired**; the current cert is
  `543dfc78635c558984ad4b65548357e8e3ae4e731e1d7923c0918a7fbcf2dbf1`. A
  pre-2026-10-02 internal build signed with `eff441…` is legitimate-but-superseded;
  every build distributed since carries `543dfc…`.
- Some apps' certificate distinguished name (DN) reads `O=INTERACT, L=Karachi,
  ST=Sindh, C=PK`; the authoritative check is the **SHA-256 fingerprint** above,
  not the DN.