SIGNAPK(1)

💖 SIGNAPK(1) 💖

okay bestie, gather round, because this is the tool for signing JARs and APKs and it's lowkey iconic 🎀

✨ NAME ✨

signapk — the JAR and APK signing tool. that's it, that's the whole vibe 🫶

🌸 SYNOPSIS 🌸

it's a command line tool for signing Android ZIP/JAR/APK files, and here's the shape of it:

signapk [-w] [-a alignment] [-providerClass className] publickey.x509[.pem] privatekey.pk8 [publickey2.x509[.pem] privatekey2.pk8 ...] input.jar output.jar signapk file.jar

and just so we're clear: input.jar is an existing file to sign. yes bestie, it has to already exist, we're signing it not summoning it 💅

🦋 DESCRIPTION 🦋

so what does she actually do? she signs ZIP files — and that includes JARs, APKs, and Over-The-Air (OTA) updates — in a way that's compatible with Android's mincrypt verifier, using EC or RSA keys and SHA1 or SHA-256. no cap.

she can also sign APKs using APK Signature Scheme v2. and fr fr, this is the standard tool used to sign APK and JAR files distributed as part of Android ROMs. main character energy only 👑

🎀 HISTORICAL NOTE 🎀

okay this part is giving lore, and you need it:

• before the KitKat release (aka 4.4.2 aka android-19), signapk straight up ignored the signature algorithm specified in the certificate and always used SHA1withRSA. not me being stubborn 🙈
• starting with JellyBean-MR2 (aka 4.3 aka android-18), the platform supports SHA256withRSA, so we use the signature algorithm in the certificate to select which one to use (SHA256withRSA or SHA1withRSA). also in JellyBean-MR2, EC keys are supported 🦋✨
• and because there are old keys still in use whose certificate actually says MD5withRSA — yeah, MD5, in this economy — those get treated as though they say SHA1withRSA for compatibility with older releases. periodt 💅

🌈 SEE ALSO 🌈

• JAR(1)
• ZIP(1)
• ZIPALIGN(1)
• https://source.android.com/devices/tech/ota/sign_builds.html

👑 AUTHORS 👑

The Android Open Source Project. 💜

and that's the whole page bestie — this was SIGNAPK(1), brought to you by The Android Open Source Project, and she ate, no crumbs. go sign something 🎀✨💖