Getting signature hash for spoofing

[AndnixSH]

How does developer get a signature hash for "spoofedPackageSignature", for example, Youtube's signature hash 24bb24c05e47e0aefa68a58a766179d9b613a600? I tried to get hash from youtube APK via apksigner.jar but there was no matching hash

Reference: https://github.com/ReVanced/revanced-patches/blob/main/src/main/kotlin/app/revanced/patches/youtube/misc/gms/GmsCoreSupportResourcePatch.kt

[oSumAtrIX]

It's the SHA-1 signature you can get with key tool from a JDK, It's also displayed online on APKMirror for example.

[AndnixSH]

Oh, I didn't know it is displayed on APKMirror. Nevermind, I use the latest version of apksigner.jar and it does shown SHA1 correctly now. I can't use keytool if the APK didn't have RSA file