Android Question VAPT apk

I'm pretty sure that you are confusing two different things - the signing key hash function and the SHA-1 digest. The SHA-1 digest is something that is calculated on the fly.

Hello Erel,

I was able to verify with jarsigner that the application isn't anymore signed using SHA1.

Despite that, I am now seeing the following warning:

This jar contains signatures that does not include a timestamp. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2052-10-10) or after any future revocation date.

I would like to know how can I sign and add the timestamp in the packet.

Thank you

You should ignore it. It is valid until at least 2052.