Validating assetlinks.json

curl -sS "https://digitalassetlinks.googleapis.com/v1/statements:list\
?source.web.site=https://example.com\
&relation=delegate_permission/common.handle_all_urls" | python3 -m json.tool

# Success looks like this — note "maxAge" and an empty debugString:
# {
#   "statements": [
#     {
#       "source":  { "web": { "site": "https://example.com." } },
#       "relation": "delegate_permission/common.handle_all_urls",
#       "target":  { "androidApp": {
#         "packageName": "com.example.shop",
#         "certificate": { "sha256Fingerprint": "14:6D:E9:83:..." }
#       }}
#     }
#   ],
#   "maxAge": "21600s",
#   "debugString": "..."
# }

# --max-redirs 0 is the whole point: Android does not follow redirects,
# so a 301 here is a failure even though a browser would sail through it.
curl -sSI --max-redirs 0 https://example.com/.well-known/assetlinks.json

# Want: HTTP/2 200 and content-type: application/json
# Anything 3xx, a 403, or content-type: text/html is your answer.

# The body, checked for valid JSON and the correct top-level type
curl -sS --max-redirs 0 https://example.com/.well-known/assetlinks.json \
  | python3 -c "
import json,sys
d = json.load(sys.stdin)
assert isinstance(d, list), 'must be a JSON array, not an object'
for s in d:
    print(s['target']['package_name'], s['relation'])
    for fp in s['target']['sha256_cert_fingerprints']:
        print('   ', fp)
"

# 3. What the device concluded. "verified" or it did not work.
adb shell pm get-app-links com.example.shop
adb shell pm verify-app-links --re-verify com.example.shop

# 4. The fingerprint of the build ACTUALLY INSTALLED on the device
adb shell pm path com.example.shop
adb pull /data/app/~~abc123==/com.example.shop-xyz==/base.apk
keytool -printcert -jarfile base.apk | grep -A1 "SHA256:"

# Compare that value against what the file declares. If your app comes
# from Play, expect it to match the Play app signing key, NOT your
# upload key — Google re-signs with a key you do not hold.

#!/usr/bin/env bash
set -euo pipefail

URL="https://example.com/.well-known/assetlinks.json"
EXPECTED_FP="14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:..."

# One 200, no redirects, correct content type
read -r code type < <(
  curl -sS --max-redirs 0 -o /tmp/al.json \
    -w '%{http_code} %{content_type}\n' "$URL"
)
[[ "$code" == "200" ]] || { echo "FAIL: HTTP $code (redirect or block)"; exit 1; }
[[ "$type" == application/json* ]] || { echo "FAIL: type $type"; exit 1; }

# Valid statement list naming the fingerprint we actually ship
python3 - "$EXPECTED_FP" <<'PY'
import json, sys
want = sys.argv[1]
data = json.load(open('/tmp/al.json'))
assert isinstance(data, list), "FAIL: not a JSON array"
found = any(
    want in s["target"].get("sha256_cert_fingerprints", [])
    for s in data
)
assert found, "FAIL: shipped fingerprint is not in the file"
print("assetlinks.json OK")
PY