Mixing
Recommendations on resigning apk
We have an external vendor who develops an android app for our organization. We want the apk to be signed with our organizational signature, not the vendor signature, when releasing the app to play store. what are the best recommendations on re-signing the android apk?
android apk vendor asked Nov 19 '18 at 21:16
LuckyLucky
103
add a comment |
We have an external vendor who develops an android app for our organization. We want the apk to be signed with our organizational signature, not the vendor signature, when releasing the app to play store. what are the best recommendations on re-signing the android apk?
android apk vendor asked Nov 19 '18 at 21:16
LuckyLucky
103
1
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39
add a comment |
We have an external vendor who develops an android app for our organization. We want the apk to be signed with our organizational signature, not the vendor signature, when releasing the app to play store. what are the best recommendations on re-signing the android apk?
android apk vendor asked Nov 19 '18 at 21:16
LuckyLucky
103
We have an external vendor who develops an android app for our organization. We want the apk to be signed with our organizational signature, not the vendor signature, when releasing the app to play store. what are the best recommendations on re-signing the android apk?
android apk vendor android apk vendor asked Nov 19 '18 at 21:16
LuckyLucky
103
asked Nov 19 '18 at 21:16
LuckyLucky
103
asked Nov 19 '18 at 21:16
LuckyLucky
103
asked Nov 19 '18 at 21:16
LuckyLucky
103
asked Nov 19 '18 at 21:16
LuckyLucky
103
103
1
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39
add a comment |
1
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39
1
1
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39
add a comment |
2 Answers
2
active
oldest
votes
Re-signing the APK will remove the previous signature, so it will work as you expect it.
Recommendation is to use apksigner (released as part of the Android SDK), which offers more secure signing algorithms to sign APKs. The alternative is jarsigner, but it's slower for Android devices to verify the signature (so installation takes more time) and it's not as secure.
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
add a comment |
My recommendation would be to build and sign it yourself from the release branch or using the commit hash of the code (that is verified by QA team of external vendor).
With gradle support in Android projects it is very simple to set up a small script block that will sign the apk with right keys.
For example, in our projects we have created a properties file like this
ANDROID_KEYSTORE_LOCATION=~/.android/debug.keystore
ANDROID_KEYSTORE_PASSWORD=android
ANDROID_KEYSTORE_ALIAS=androiddebugkey
ANDROID_KEYSTORE_ALIAS_PASSWORD=android
You can swap the values in above lines to your release keys when you build in-house, without any modification to gradle script. Of course the vendor has to make a change in gradle build script to read this file.
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53382755%2frecommendations-on-resigning-apk%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Re-signing the APK will remove the previous signature, so it will work as you expect it.
Recommendation is to use apksigner (released as part of the Android SDK), which offers more secure signing algorithms to sign APKs. The alternative is jarsigner, but it's slower for Android devices to verify the signature (so installation takes more time) and it's not as secure.
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
add a comment |
Re-signing the APK will remove the previous signature, so it will work as you expect it.
Recommendation is to use apksigner (released as part of the Android SDK), which offers more secure signing algorithms to sign APKs. The alternative is jarsigner, but it's slower for Android devices to verify the signature (so installation takes more time) and it's not as secure.
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
add a comment |
Re-signing the APK will remove the previous signature, so it will work as you expect it.
Recommendation is to use apksigner (released as part of the Android SDK), which offers more secure signing algorithms to sign APKs. The alternative is jarsigner, but it's slower for Android devices to verify the signature (so installation takes more time) and it's not as secure.
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
Re-signing the APK will remove the previous signature, so it will work as you expect it.
Recommendation is to use apksigner (released as part of the Android SDK), which offers more secure signing algorithms to sign APKs. The alternative is jarsigner, but it's slower for Android devices to verify the signature (so installation takes more time) and it's not as secure.
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
answered Nov 19 '18 at 21:48
PierrePierre
1,606167
1,606167
add a comment |
add a comment |
My recommendation would be to build and sign it yourself from the release branch or using the commit hash of the code (that is verified by QA team of external vendor).
With gradle support in Android projects it is very simple to set up a small script block that will sign the apk with right keys.
For example, in our projects we have created a properties file like this
ANDROID_KEYSTORE_LOCATION=~/.android/debug.keystore
ANDROID_KEYSTORE_PASSWORD=android
ANDROID_KEYSTORE_ALIAS=androiddebugkey
ANDROID_KEYSTORE_ALIAS_PASSWORD=android
You can swap the values in above lines to your release keys when you build in-house, without any modification to gradle script. Of course the vendor has to make a change in gradle build script to read this file.
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
add a comment |
My recommendation would be to build and sign it yourself from the release branch or using the commit hash of the code (that is verified by QA team of external vendor).
With gradle support in Android projects it is very simple to set up a small script block that will sign the apk with right keys.
For example, in our projects we have created a properties file like this
ANDROID_KEYSTORE_LOCATION=~/.android/debug.keystore
ANDROID_KEYSTORE_PASSWORD=android
ANDROID_KEYSTORE_ALIAS=androiddebugkey
ANDROID_KEYSTORE_ALIAS_PASSWORD=android
You can swap the values in above lines to your release keys when you build in-house, without any modification to gradle script. Of course the vendor has to make a change in gradle build script to read this file.
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
add a comment |
My recommendation would be to build and sign it yourself from the release branch or using the commit hash of the code (that is verified by QA team of external vendor).
With gradle support in Android projects it is very simple to set up a small script block that will sign the apk with right keys.
For example, in our projects we have created a properties file like this
ANDROID_KEYSTORE_LOCATION=~/.android/debug.keystore
ANDROID_KEYSTORE_PASSWORD=android
ANDROID_KEYSTORE_ALIAS=androiddebugkey
ANDROID_KEYSTORE_ALIAS_PASSWORD=android
You can swap the values in above lines to your release keys when you build in-house, without any modification to gradle script. Of course the vendor has to make a change in gradle build script to read this file.
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
My recommendation would be to build and sign it yourself from the release branch or using the commit hash of the code (that is verified by QA team of external vendor).
With gradle support in Android projects it is very simple to set up a small script block that will sign the apk with right keys.
For example, in our projects we have created a properties file like this
ANDROID_KEYSTORE_LOCATION=~/.android/debug.keystore
ANDROID_KEYSTORE_PASSWORD=android
ANDROID_KEYSTORE_ALIAS=androiddebugkey
ANDROID_KEYSTORE_ALIAS_PASSWORD=android
You can swap the values in above lines to your release keys when you build in-house, without any modification to gradle script. Of course the vendor has to make a change in gradle build script to read this file.
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
answered Nov 19 '18 at 22:12
prashantprashant
2,04263347
2,04263347
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53382755%2frecommendations-on-resigning-apk%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
You have to sign the apk with the same key every time you do an update. Im not sure if you can change the info on an existing key. If you lose the key you can not do updates
– JRowan
Nov 19 '18 at 21:20
If we were to release the apk to play store, what should we be expecting from the vendor?
– Lucky
Nov 19 '18 at 21:36
Definetly the project with all the files. Android studio the would give you a zip file probably. And the signing key. There are a bunch of different ways to sign these days i think but there should be a signing key
– JRowan
Nov 19 '18 at 21:39