Sorry, I didn’t explain it properly earlier.
We are uploading our application to a third-party platform (Clover). To submit the APK for their approval, they require the package to be signed using only the V1 signature scheme.
The ManifestChecksumError mentioned above was likely caused by my attempt to re-sign the APK using jarsigner -keystore... in order to force it to use V1 only (I re-signed it directly after compiling the APK via Voltbuilder, which outputs V1 + V2).
By using the method above (jarsigner -keystore...), I was in fact able to end up with only V1 signing and submit it to Clover. However, they reported the ManifestChecksumError on their side during their signing process.
Another attempt I made was deleting the META-INF folder inside the APK and then re-signing it. This also worked and I was able to submit it to Clover, but this method triggered a virus warning during their initial validation (via www.virustotal.com), so we cannot proceed with that approach.
I believe our only option now is either to generate an unsigned APK or generate an APK signed directly with V1 only.
Below is the documentation for reference:
https://docs.clover.com/dev/docs/generating-a-signed-apk