Tor Browser: copied signature v2/v3 fails (v1 verifies successfully)

[Mynacol]

I'm trying to add Tor Browser for Android to F-Droid. After getting it to build, I fixed the remaining issues preventing reproducible builds. My built APKs are absolutely identical to the production APKs except for the signature. Unfortunately, the signature copying doesn't really work, the v2/v3 signatures don't verify.
Sample output:

$ apksigner verify --verbose --print-certs fdroid-productionsigcopied.apk
DOES NOT VERIFY
ERROR: APK Signature Scheme v3 signer #1: APK integrity check failed. CHUNKED_SHA512 digest mismatch. Expected: <74762368d46562bded31ad407db5aaae93f76640611abcc26a5b7109e3f39b8a2c8c0513fabb0f51cee13b52d60932b810f2bf9b7918fcdafbfd1742f69613c1>, actual: <4fd9e322cfc6b177c9163d55d76af10e920c77490894356bc0ed3084eeaf8213ef12c44af126737f4f0027dcb5b3923b54e2b13ae7a925c44495828d5945a216>

We first assumed the reason is the way how the production APKs are signed. First it is signed with QA test keys, then again zipaligned (which strips the v2/v3 signature). Afterwards it is signed with the production keys.
Therefore the torproject people modified their processes to skip the QA test key signing for production APKs. Unfortunately, the copied signature still doesn't verify. (the linked APKs above, for version 13.5a5, have this modification.)

We all seem to be stuck, maybe you have an idea how to fix the signature copying (building obviously isn't it).

APKs for an older version face the exact same issue. Maybe they help you.

[obfusk]

I am no longer working on reproducible builds for F-Droid, having been given no choice but to leave the project 3 months ago.

[Mynacol]

Oh my, I had no idea. Thanks for sharing the link and I hope F-Droid betters itself.
I find it particularly intriguing that eighthave has dropped your name. (I'd have reached out to this project anyways and I don't expect you to help this cause given the circumstances)

[obfusk]

I will no longer be providing F-Droid with my expertise with (debugging) reproducible builds; how eighthave still feels entitled to it after everything is beyond me.

So indeed I cannot help you.

That said, the issue tracker here is of course always open to anyone else with concrete evidence of an actual bug in apksigcopier.