Genuine WhatsApp from Website is incorrectly verified

[atharen]

Description

WhatsApp installation from website, not Play Store, shown up as may be non-genuine.

Verifying from clipboard using the internal database itself, shown up as success, as demonstrated in the image below.

Context

• AppVerifier InternalDatabaseVerificationInfo Source

Appendix

1. Possibly related? [Feature Request] Hash Displayed on Failure is Confusing: Hash Expected? or Hash Found? #180
2. Feature request, but would be nice to have a link of the original source of the verification info per app.

[Quantum-Future]

I found the same problem with an old version of WhatsApp downloaded through Aurora Store (https://auroraoss.com/aurora-store).
.
WhastApp Ver: 2.25.15.80, Version code: 251580003)

.
But a newer version of WApp (2.25.23.80), installed on another phone, was verified successfully:

It seems the newer version has 2 certificates. The first hash is the same on both versions, but the newer version has an additional hash, right?

[soupslurpr]

WhatsApp has changed to signing their website release with only the first key instead of also the new key they rotated to. They still use the new key in their Play Store release. Presumably, the new key is to comply with Play App Signing.

The database entry needs to be updated.