**Here's the apk I've created.** It should have a version of `1.3.2-ecritique`, and a sha-256 of:

    B2901F3DA894D89B1D5389910D48E241FE8625B6089114ADD449FACF624E098E

https://mega.nz/file/bRdHQKgK#nMFtdAtRvGqyGoBdvM7272dkXP8jP5tCqbtLMcTVw_Y

Generally, you should not trust random apks from strangers. I'd encourage you to convince yourself by doing the following (on Windows; I will assume *nix users can figure out alternatives):

1. Using steps similar to the ones I listed above, get a copy of the Timely 1.3.2 apk from the Play Store. Disassemble it with apktool (into the `timely` folder).
2. Download the apk I linked, and disassemble it with apktool (into the `timely_zipaligned` folder)
3. Verify the sha-256 of my file is as I said. You can do this in Powershell with `Get-FileHash timely_zipaligned.apk`.
4. Comparing the disassembled versions, verify the only changes in `AndroidManifest.xml` are to the first line.
5. In PowerShell, enter [GuyBanay's `Get-FolderHash` function](https://social.technet.microsoft.com/Forums/en-US/2e7db624-2260-4a65-a57b-f6f2e22312f0/sha1-hash-of-an-entire-folder-structure#de5b0020-325f-452d-9183-e75ef989b260).
6. Run `Get-FolderHash` on `timely\smali\ch\bitspin\timely` and on `timely_zipaligned\smali\ch\bitspin\timely`, and verify they're the same.

I get this hash:

    25585a139036a3343b6d07ef994fac02155a4c28969fb4abb9bbebef74ba5faf