linkUber Apk Signer

A tool that helps signing, zip aligning and verifying multiple Android application packages (APKs) with either debug or provided release certificates (or multiple). It supports v1, v2 and v3 Android signing scheme. Easy and convenient debug signing with embedded debug keystore. Automatically verifies signature and zipalign after every signing.

Main features:

zipalign, (re)signing and verifying of multiple APKs in one step
verify signature (with hash check) and zipalign of multiple APKs in one step
built-in zipalign & debug keystore for convenient usage
supports v1, v2 and v3 android apk singing scheme
support for multiple signatures for one APK
crypto/signing code relied upon official implementation

Basic usage:

1java -jar uber-apk-signer.jar --apks /path/to/apks

This should run on any Windows, Mac or Linux machine where Java8+ is installed.

linkRequirements

JDK 8
Currently on Linux 32bit: zipalign must be set in PATH

linkDownload

Grab jar from latest Release

linkDemo

linkCommand Line Interface

1-a,--apks            Can be a single apk or a folder containing multiple apks. These are used

2                                  as source for zipalining/signing/verifying. It is also possible to

3                                  provide multiple locations space seperated (can be mixed file folder):

4                                  '/apk /apks2 my.apk'. Folder will be checked non-recursively.

5   --allowResign                  If this flag is set, the tool will not show error on signed apks, but

6                                  will sign them with the new certificate (therefore removing the old

7                                  one).

8   --debug                        Prints additional info for debugging.

9   --dryRun                       Check what apks would be processed without actually doing anything.

10-h,--help                         Prints help docs.

11   --ks                 The keystore file. If this isn't provided, will tryto sign with a debug

12                                  keystore. The debug keystore will be searched in the same dir as

13                                  execution and 'user_home/.android' folder. If it is not found there a

14                                  built-in keystore will be used for convenience. It is possible to pass

15                                  one or multiple keystores. The syntax for multiple params is

16                                  '=' for example: '1=keystore.jks'. Must match the

17                                  parameters of --ksAlias.

18   --ksAlias               The alias of the used key in the keystore. Must be provided if --ks is

19                                  provided. It is possible to pass one or multiple aliases for multiple

20                                  keystore configs. The syntax for multiple params is '='

21                                  for example: '1=my-alias'. Must match the parameters of --ks.

22   --ksDebug            Same as --ks parameter but with a debug keystore. With this option the

23                                  default keystore alias and passwords are used and any arguments relating

24                                  to these parameter are ignored.

25   --ksKeyPass          The password for the key. If this is not provided, caller will get a

26                                  user prompt to enter it. It is possible to pass one or multiple

27                                  passwords for multiple keystore configs. The syntax for multiple params

28                                  is '='. Must match the parameters of --ks.

29   --ksPass             The password for the keystore. If this is not provided, caller will get

30                                  a user prompt to enter it. It is possible to pass one or multiple

31                                  passwords for multiple keystore configs. The syntax for multiple params

32                                  is '='. Must match the parameters of --ks.

33-l,--lineage                The lineage file for apk signer schema v3 if more then 1 signature is

34                                  used. See here https://bit.ly/2mh6iAC for more info.

35-o,--out                    Where the aligned/signed apks will be copied to. Must be a folder. Will

36                                  create, if it does not exist.

37   --overwrite                    Will overwrite/delete the apks in-place

38   --skipZipAlign                 Skips zipAlign process. Also affects verify.

39-v,--version                      Prints current version.

40   --verbose                      Prints more output, especially useful for sign verify.

41   --verifySha256    Provide one or multiple sha256 in string hex representation (ignoring

42                                  case) to let the tool check it against hashes of the APK's certificate

43                                  and use it in the verify process. All given hashes must be present in

44                                  the signature to verify e.g. if 2 hashes are given the apk must have 2

45                                  signatures with exact these hashes (providing only one hash, even if it

46                                  matches one cert, will fail).

47-y,--onlyVerify                   If this is passed, the signature and alignment is only verified.

48   --zipAlignPath           Pass your own zipalign executable. If this is omitted the built-in

49                                  version is used (available for win, mac and linux)

linkExamples

Provide your own out directory for signed apks

1java -jar uber-apk-signer.jar -a /path/to/apks --out /path/to/apks/out

Only verify the signed apks

1java -jar uber-apk-signer.jar -a /path/to/apks --onlyVerify

Sign with your own release keystore

1java -jar uber-apk-signer.jar -a /path/to/apks --ks /path/release.jks --ksAlias my_alias

Provide your own zipalign executable

1java -jar uber-apk-signer.jar -a /path/to/apks --zipAlignPath /sdk/build-tools/24.0.3/zipalign

Provide your own location of your debug keystore

1java -jar uber-apk-signer.jar -a /path/to/apks --ksDebug /path/debug.jks

Sign with your multiple release keystores (see below on how to create a lineage file)

1java -jar uber-apk-signer.jar -a /path/to/apks --lineage /path/sig.lineage --ks 1=/path/release.jks 2=/path/release2.jks --ksAlias 1=my_alias1 2=my_alias2

Use multiple locations or files (will ignore duplicate files)

1java -jar uber-apk-signer.jar -a /path/to/apks /path2 /path3/select1.apk /path3/select2.apk

Provide your sha256 hash to check against the signature:

1java -jar uber-apk-signer.jar -a /path/to/apks --onlyVerify --verifySha256 ab318df27

linkProcess Return Value

This application will return 0 if every signing/verifing was successful, 1 if an error happens (e.g. wrong arguments) and 2 if at least 1 sign/verify process was not successful.

linkDebug Signing Mode

If no keystore is provided the tool will try to automatically sign with a debug keystore. It will try to find on in the following locations (descending order):

Keystore location provided with --ksDebug
debug.keystore in the same directory as the jar executable
debug.keystore found in the /user_home/.android folder
Embedded debug.keystore packaged with the jar executable

A log message will indicate which one was chosen.

linkZipalign Executable

Zipalign is a tool developed by Google to optimize zips (apks). It is needed if you want to upload it to the Playstore otherwise it is optional. By default this tool will try to zipalign the apk, therefore it will need the location of the executable. If the path isn't passed in the command line interface, the tool checks if it is in PATH environment variable, otherwise it will try to use an embedded version of zipalign.

If --skipZipAlign is passed no executable is needed.

linkv1, v2 and v3 Signing Scheme

Android 7.0 introduces APK Signature Scheme v2, a new app-signing scheme that offers faster app install times and more protection against unauthorized alterations to APK files. By default, Android Studio 2.2 and the Android Plugin for Gradle 2.2 sign your app using both APK Signature Scheme v2 and the traditional signing scheme, which uses JAR signing.

APK Signature Scheme v2 is a whole-file signature scheme that increases verification speed and strengthens integrity guarantees by detecting any changes to the protected parts of the APK. The older jarsigning is called v1 schema.

APK Signature Scheme v3 is an extension to v2 which allows a new signature lineage feature for key rotation, which basically means it will be possible to change signature keys.

linkSignature Lineage File in Schema v3

This tool does not directly support the creation of lineage files as it is considered a task done very rarely. You can create a lineage file with a sequence of certificates with Google's apksigner rotate and apply it as -- lineage arguments when signing with multiple keystores:

1apksigner rotate --out sig.lineage \

2    --old-signer --ks debug1.keystore --ks-key-alias androiddebugkey \

3    --new-signer --ks debug2.keystore --ks-key-alias androiddebugkey

4

5java -jar uber-apk-signer.jar -a /path/to/apks --lineage sig.lineage (...)

linkSigned Release Jar

The provided JARs in the Github release page are signed with my private key:

1CN=Patrick Favre-Bulle, OU=Private, O=PF Github Open Source, L=Vienna, ST=Vienna, C=AT

2Validity: Thu Sep 07 16:40:57 SGT 2017 to: Fri Feb 10 16:40:57 SGT 2034

3SHA1: 06:DE:F2:C5:F7:BC:0C:11:ED:35:E2:0F:B1:9F:78:99:0F:BE:43:C4

4SHA256: 2B:65:33:B0:1C:0D:2A:69:4E:2D:53:8F:29:D5:6C:D6:87:AF:06:42:1F:1A:EE:B3:3C:E0:6D:0B:65:A1:AA:88

Use the jarsigner tool (found in your $JAVA_HOME/bin folder) folder to verify.

linkBuild with Maven

Use the Maven wrapper to create a jar including all dependencies

1./mvnw clean install

linkCheckstyle Config File

This project uses my common-parent which centralized a lot of the plugin versions aswell as providing the checkstyle config rules. Specifically they are maintained in checkstyle-config. Locally the files will be copied after you mvnw install into your target folder and is called target/checkstyle-checker.xml. So if you use a plugin for your IDE, use this file as your local configuration.

linkTech Stack

Java 8
Maven

linkLicense

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

1http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Star

Uber Apk Signer Requirements Download Demo Command Line Interface Examples Process Return Value Debug Signing Mode Zipalign Executable v1, v2 and v3 Signing Scheme Signature Lineage File in Schema v3 Signed Release Jar Build with Maven Checkstyle Config File Tech Stack License