apksigcopier(1)

📦
version 1.1.1 · 5 versions
, in debian bookworm, debian trixie, ubuntu noble

✨ apksigcopier(1) — General Commands Manual 🎀

💖 NAME 💖

okay bestie, the name says it all 💅 apksigcopier — copy/extract/patch android APK signatures & compare APKs 🦋

🌸 SYNOPSIS 🌸

okay so here are all the ways you can call it, bestie 🧚

apksigcopier copy [options] signed_apk unsigned_apk output_apk

apksigcopier extract [options] signed_apk output_dir

apksigcopier patch [options] metadata_dir unsigned_apk output_apk

apksigcopier compare [options] first_apk second_apk

apksigcopier --version

apksigcopier --help

apksigcopier [command] --help

🦋 DESCRIPTION 🦋

ngl this tool is literally iconic ✨ it copies android APK signatures from a signed APK over to an unsigned one, which is how you verify reproducible builds 🔥 It can also compare two APKs that have different signatures 💜

👑 COMMANDS 👑

💅 copy

Copy (extract & patch) signatures from signed to unsigned APK. It's giving "do both steps for me" energy 🫶

🌈 extract

Extract APK signatures from signed APK. Just pulling the signature stuff out, no drama 🧚

🍓 patch

Patch extracted APK signatures onto unsigned APK. Slapping the signatures back on 💖

🔥 compare

Compare two APKs by copying the signature from the first to a copy of the second and checking if the resulting APK verifies. Main character behavior, fr fr 👑

This command requires apksigner(1). Bestie, you NEED this one installed or it won't work 😭

NB: copying from an APK v1-signed with signflinger to an APK signed with apksigner works, whereas the reverse fails; see the FAQ in the README. Heads up, this one is lowkey tricky 💀

🎀 OPTIONS 🎀

💅 copy/extract/patch

  • --v1-only [no|auto|yes] — Whether to expect only a v1 signature 🌸 no means a v2 signature is expected as well, auto means the presence of a v2 signature is detected automatically, and yes means a v2 signature is not expected (and ignored if it does exist). Default: no.

You can also set the environment variable APKSIGCOPIER_V1_ONLY instead 🫶

🔥 compare

  • --unsigned — Accept unsigned second_apk 🦋
  • --min-sdk-version — Passed to apksigner(1) when verifying ✨
  • --verify-cmd — Command (with arguments) used to verify APKs. Default: apksigner verify 💜

🌈 ENVIRONMENT VARIABLES 🌈

The following environment variables can be set to 1, yes, or true to override the default behaviour. It's giving customization queen 👑

🧚 APKSIGCOPIER_EXCLUDE_ALL_META

Exclude all metadata files, not just MANIFEST.MF 🙈

🍓 APKSIGCOPIER_COPY_EXTRA_BYTES

Copy extra bytes after data (e.g. an existing v2 signature) 💖

💜 APKSIGCOPIER_SKIP_REALIGNMENT

Skip realignment of ZIP entries 🦋

🧚 EXAMPLES 🧚

Okay bestie, here's how you actually use it 💅

🌸 extract

$ mkdir meta
$ apksigcopier extract signed.apk meta
$ ls -1 meta
8BEA2A77.RSA
8BEA2A77.SF
APKSigningBlock
APKSigningBlockOffset
MANIFEST.MF

🔥 patch

$ apksigcopier patch meta unsigned.apk out.apk

💖 copy

$ apksigcopier copy signed.apk unsigned.apk out.apk

👑 compare

$ apksigcopier compare foo-from-fdroid.apk foo-built-locally.apk
$ apksigcopier compare foo.apk --unsigned foo-unsigned.apk

🦋 SEE ALSO 🦋

slay, go check out apksigner(1) 💅

Copyright © 2023 FC Stegerman. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law 🌈

🎀 AUTHORS 🎀

FC Stegerman <flx@obfusk.net>. The legend herself 👑

Version v1.1.1, dated 2023-02-08, is the latest tea ☕ Love you bestie, byeee 💖🫶🦋

📦 where this page comes from