APKSIGNER(1)

💅 APKSIGNER(1) 💅

Manual name: apksigner(1) 🎀 · Version: 7.0.0_r1 🦋

✨ NAME ✨

apksigner - sign and verify Android APKs 💖

🌸 SYNOPSIS 🌸

Okay so this is a command line tool for signing Android APK files and for checking whether their signatures will verify on Android devices ✨

apksigner  [options] apk

apksigner --version

apksigner --help

apk is just an existing file you want to sign or verify, nothing fancy 🫶

💖 DESCRIPTION 💖

apksig is a project that's literally built to make APK signing easier, plus checking whether an APK's signatures should verify on Android. It supports JAR signing (which Android has used since day one) and APK Signature Scheme v2 (supported since Android Nougat, API Level 24) 🧚

The main thing that makes apksig iconic is that it knows the verification logic changes between different versions of the Android platform 👑 So it can check whether a signed APK is expected to verify on all the Android platform versions that APK supports. When it signs an APK, apksig picks the most appropriate cryptographic algorithms based on the platform versions that APK supports. Main character energy, no cap 💅

👑 COMMANDS 👑

• sign — This signs the provided APK and strips out any pre-existing signatures ✨ Signing uses one or more signers, and each signer is an asymmetric key pair plus a matching certificate. Usually an APK only has one signer, but for each one you need to hand over the signer's private key and certificate 🔑
• verify — This checks whether the provided APK will verify on Android 🔍 By default it checks every Android platform version the APK supports (as declared by minSdkVersion in AndroidManifest.xml). Want a custom range of API Levels instead? Use --min-sdk-version and/or --max-sdk-version 🎯
• lineage — This modifies the capabilities of one or more signers in the provided SigningCertificateLineage 🧬 It's how you revoke the capabilities of an older signing certificate once the install base has moved over to the new one 🫧
• rotate — This takes the provided keys and creates a SigningCertificateLineage entry linking the old to the new 🔄 It's for key rotation using APK Signature Scheme v3 🦋
• version — Show this tool's version number and exit 🌈
• help — Show this usage page and exit 🙋

🎀 OPTIONS 🎀

• -v, --verbose — Turn on verbose output mode, so the tool gets extra chatty 🗣️
• -h, --help — Show help about this command and exit 🙋
• -Werr — Treat warnings as errors 🚨

🧁 sign

Sign the provided APK 🖊️

• --out — The file the signed APK gets written into 📦 By default, the APK is signed in-place, overwriting the input file.

🚨 Heads up bestie: without --out, the original APK gets overwritten in-place. Your input file is literally replaced, so back it up first if you want to keep it 💀

• --min-sdk-version — The lowest API Level on which this APK's signatures will be verified 🔢 By default, the value from AndroidManifest.xml is used. The higher the value, the stronger the security parameters used when signing 🛡️
• --max-sdk-version — The highest API Level on which this APK's signatures will be verified 🔝 By default, the highest possible value is used.
• --v1-signing-enabled — Whether to enable signing with the JAR signing scheme (aka the v1 signing scheme, the one Android has used since day one) 🏛️ By default, this is enabled based on the min and max SDK version (see --min-sdk-version and --max-sdk-version).
• --v2-signing-enabled — Whether to enable signing with APK Signature Scheme v2 (aka the v2 signing scheme, introduced in Android Nougat, API Level 24) 🥞 By default, this is enabled based on the min and max SDK version (see --min-sdk-version and --max-sdk-version).

🫧 per-signer options

These options set up one particular signer ✨ To separate the options of different signers, use --next-signer 🧚

• --next-signer — Delimits the options of two different signers 🪄 You don't need this when you're only using one signer.
• --v1-signer-name — The basename for the files that make up this signer's JAR signature scheme (aka v1 scheme) signature 📁 By default, the KeyStore key alias or the basename of the key file is used.

🔑 per-signer signing key & certificate options

There are two ways to give the signer's private key and certificate, and you pick one 💖

1. A Java KeyStore (see --ks)
2. A private key file in PKCS #8 format plus a certificate file in X.509 format (see --key and --cert)

• --ks — Load the private key and certificate chain from the Java KeyStore that's initialized from the specified file 🗝️ NONE means the KeyStore doesn't need any file, which is the case for some PKCS #11 KeyStores.
• --ks-key-alias — The alias the private key and certificate are stored under in the KeyStore 🏷️ You must specify this if the KeyStore has multiple keys.
• --ks-pass — The KeyStore password (see --ks) 🤫 These formats are supported:
  • pass — password provided inline
  • env — password provided in the named environment variable
  • file — password provided in the named file, as a single line
  • stdin — password provided on standard input, as a single line

A password is required to open a KeyStore 🔐 By default, the tool prompts you for it via the console or standard input. If the same file (including standard input) is used to provide multiple passwords, the passwords get read from that file one line at a time. Passwords are read in the order the signers are specified, and within each signer the KeyStore password is read before the key password 🔁

• --key-pass — The password the private key is protected with 🔏 By default it's assumed that KeyStore keys are protected by the same password as their KeyStore (see --ks-pass). These formats are supported:
  • pass — password provided inline
  • env — password provided in the named environment variable
  • file — password provided in the named file, as a single line
  • stdin — password provided on standard input, as a single line

By default, if the key is password-protected, the tool prompts for the password via the console or standard input 💬 Same deal as above: when one file (including standard input) supplies multiple passwords, they're read one line at a time. Passwords are read in signer order, and within each signer the KeyStore password comes before the key password 🎀

• --pass-encoding — An extra character encoding (e.g., ibm437 or utf-8) to try for passwords that have non-ASCII characters 🌍 KeyStores made by keytool are often encrypted with the console's character encoding instead of the Unicode form of the password 🤯 By default, apksigner tries a few forms of the password: the Unicode form, the form encoded with the JVM default charset, and, on Java 8 and older, the form encoded with the console's charset. On Java 9, apksigner can't detect the console's charset, so you may need to pass --pass-encoding when you're using a non-ASCII password. You might also need it for a KeyStore created by keytool on a different OS or in a different locale 🗺️
• --ks-type — The type/algorithm of KeyStore to use 🧩 By default, the default type is used.
• --ks-provider-name — The name of the JCA Provider to request the KeyStore implementation from 🏭 By default, the highest priority provider is used. For the alternative way to specify a provider, see --ks-provider-class.
• --ks-provider-class — The fully-qualified class name of the JCA Provider to request the KeyStore implementation from 📛 By default, the provider is chosen based on --ks-provider-name.
• --ks-provider-arg — A value passed into the constructor of the JCA Provider class specified by --ks-provider-class 🎁 The value is passed into the constructor as java.lang.String. By default, the no-arg provider constructor is used.
• --key — Load the private key from the specified file 🔓 If the key is password-protected, you'll get a prompt via standard input unless you specify otherwise with --key-pass. The file must be in PKCS #8 DER format.
• --cert — Load the certificate chain from the specified file 📜 The file must be in X.509 PEM or DER format.

🔍 verify

Check whether the provided APK is expected to verify on Android 🕵️‍♀️

• --print-certs — Show information about the APK's signing certificates 📋
• --min-sdk-version — The lowest API Level on which this APK's signatures will be verified 🔢 By default, the value from AndroidManifest.xml is used.
• --max-sdk-version — The highest API Level on which this APK's signatures will be verified 🔝 By default, the highest possible value is used.

✨ AUTHORS ✨

okay so all the credit goes to The Android Open Source Project 💖 they're the ones who wrote this page, so they deserve all the flowers 🌸

---

okay bestie, that's a wrap on apksigner 🎀 this manual page was last updated on 2 December 2016 and it's the APKSIGNER(1) page, so bookmark it for when you need it again 💅 love you, now go sign something 🦋✨