You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
52 lines
2.7 KiB
52 lines
2.7 KiB
# apksig
|
|
|
|
apksig is a project which aims to simplify APK signing and checking whether APK signatures are
|
|
expected to verify on Android. apksig supports
|
|
[JAR signing](https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html#Signed_JAR_File)
|
|
(used by Android since day one) and
|
|
[APK Signature Scheme v2](https://source.android.com/security/apksigning/v2.html) (supported since
|
|
Android Nougat, API Level 24). apksig is meant to be used outside of Android devices.
|
|
|
|
The key feature of apksig is that it knows about differences in APK signature verification logic
|
|
between different versions of the Android platform. apksig thus thoroughly checks whether an APK's
|
|
signature is expected to verify on all Android platform versions supported by the APK. When signing
|
|
an APK, apksig chooses the most appropriate cryptographic algorithms based on the Android platform
|
|
versions supported by the APK being signed.
|
|
|
|
The project consists of two subprojects:
|
|
|
|
* apksig -- a pure Java library, and
|
|
* apksigner -- a pure Java command-line tool based on the apksig library.
|
|
|
|
|
|
## apksig library
|
|
|
|
apksig library offers three primitives:
|
|
|
|
* `ApkSigner` which signs the provided APK so that it verifies on all Android platform versions
|
|
supported by the APK. The range of platform versions can be customized.
|
|
* `ApkVerifier` which checks whether the provided APK is expected to verify on all Android
|
|
platform versions supported by the APK. The range of platform versions can be customized.
|
|
* `(Default)ApkSignerEngine` which abstracts away signing APKs from parsing and building APKs.
|
|
This is useful in optimized APK building pipelines, such as in Android Plugin for Gradle,
|
|
which need to perform signing while building an APK, instead of after. For simpler use cases
|
|
where the APK to be signed is available upfront, the `ApkSigner` above is easier to use.
|
|
|
|
_NOTE: Some public classes of the library are in packages having the word "internal" in their name.
|
|
These are not public API of the library. Do not use \*.internal.\* classes directly because these
|
|
classes may change any time without regard to existing clients outside of `apksig` and `apksigner`._
|
|
|
|
|
|
## apksigner command-line tool
|
|
|
|
apksigner command-line tool offers two operations:
|
|
|
|
* sign the provided APK so that it verifies on all Android platforms supported by the APK. Run
|
|
`apksigner sign` for usage information.
|
|
* check whether the provided APK's signatures are expected to verify on all Android platforms
|
|
supported by the APK. Run `apksigner verify` for usage information.
|
|
|
|
The tool determines the range of Android platform versions (API Levels) supported by the APK by
|
|
inspecting the APK's AndroidManifest.xml. This behavior can be overridden by specifying the range
|
|
of platform versions on the command-line.
|