How to Sign Android APK or Zip Files

How to Sign Android APK or Zip Files

Posted by lorenz in Android, Featured Articles, Information Technology, Programming on 05 21st, 2010 | 35 responses

Home » Information Technology » Programming » Android » How to Sign Android APK or Zip Files

0digg

When publishing an application or a custom rom  you need to sign the .apk or .zip files with a certificate using a private key. The Android system uses the certificate to identify the author of an application and establish trust relationship between applications. The classic way of doing this was to use keytool then sign it with  jarsigner. In this tutorial i’ll explain an alternative method which is relatively easy to use for most people  using a tool called SignApk.jar.

SignApk.jar is a tool included with the Android platform source bundle, you can download it from here. To use SignApk.jar you have to create a private key with it’s corresponding certificate/public key. To create private/public key pair, you can use Openssl. Openssl is relatively easy to use under unix/linux system. For Windows user, you can download Windows version of Openssl here.

How to create private/public key pair using openssl (windows version)

• Download openssl package from link given above
• Extract it anywhere on your drive (eg. C:\openssl)
• Within openssl directory type (use cmd tool):

  - openssl genrsa -out key.pem 1024
  - openssl req -new -key key.pem -out request.pem
  - openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
  - openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt

  

How to sign apk or zip files using SignApk.jar:

• Download SignApk.rar from link given above
• Extract it  anywhere on your drive (eg. c:\SignApk)
• If you don’t have java installed, download and install it.
• Copy certificate.pem and key.pk8 into your extracted SignApk directory
• Within SignApk directory type:

  java -jar signapk.jar certificate.pem key.pk8 your-app.apk  your-signed-app.apk
  
  OR

  java -jar signapk.jar certificate.pem key.pk8 your-update.zip your-signed-update.zip
  

Note:

If you don’t want to create your own public/private key pair, you can use test key included in SignApk.rar.

Reference:

android-dls.com