I would like to add a checksum to an Android APK without breaking the signature. Is there any area of the APK, where it is safe and legal to put such data?
I imagine the folder META-INF is excluded when generating the signature, but I have doubts, whether it is legal to add more files here.