apksigner | lightweight APK signing tool that can be run on Android | Emulator library

I know how to check signatures of apk files, but cannot figure out how to check the trustworthyness of app bundles (apkm). Does anyone have a hint for me?

When e.g. checking the signature of a google camera bundle from apkmirror, it shows that the bundle is signed by apkmirror and not - as expected - by google.

I figured out that I can simply extract the apk files in the bundle and verify their signature (then I get a google signature, as intended). This does not work for all apks though: The "base.apk" does not have a signature. Is there a reason for this? Is the signature for the base.apk maybe included in the other signatures somehow?

Edit: After reading Pierres answer I figured out that the base.apk indeed is also signed. The problem in my case was that the apksigner version in ubuntu 18.04 is outdated and does not support the used signature format.

I am trying to set up a build pipeline for the Xamarin Android app using AzureDevops Pipeline.

The step that is causing my hair to go thin and grey is Signing and Zipaligning.

For signing, I have created a self-signed key using:

keytool -genkeypair -v -keystore keystore.keystore -alias keyAlias -keyalg RSA -keysize 2048 -validity 10000

Then I have added keystore.keystore to azureDevOps secure files location and enabled it for all pipelines

I then set the signing step in the following way:

I have created an application using angular and processed it using Cordova.

Now, when I use cordova build android or cordova build --release android I get the desired result i.e. the app is running on my device, even after signing it (with my.keystore) using the below

I am create my app in ionic v3 with Target SDK version 30 when i am upload my apk on google play console i am getting error "You uploaded an APK with an invalid signature (learn more about signing). Error from apksigner: ERROR: MIN_SIG_SCHEME_FOR_TARGET_SDK_NOT_MET: Target SDK version 30 requires a minimum of signature scheme v2; the APK is not signed with this or a later signature scheme"

When i am making apk with Target SDK version 29 and upload on google play console its upload without any error

i don't no whay google give me an error

create sign in apk proccess are same in Target SDK version 30 or Target SDK version 29 same keystore and all command are same for create sign apk

My command are ionic cordova build --release android

jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore myappname.keystore app-release-unsigned.apk myapp

zipalign -v 4 app-release-unsigned.apk myappname.apk

Please Check what is wrong on about command and let me know it's argent my client are waiting a Target SDK version 30

I am trying to test an apk file using Eclipse, Java, Selenium, Cucumber, and Appium.

In Windows Environment Variables, under System Variables, I have the value of JAVA_HOME set to "C:\Program Files\Java\jdk-15.0.2".

In Eclipse, I'm using the latest JDK 15.0.2 in my run configuration. When I execute a cucumber test, I get the following error:

C:\Users\x\AppData\Local\Programs\Appium\resources\app\node_modules\appium\node_modules\appium-uiautomator2-server\apks\appium-uiautomator2-server-v4.17.4.apk'. Original error: java.lang.UnsupportedClassVersionError: com/android/apksigner/ApkSignerTool has been compiled by a more recent version of the Java Runtime (class file version 53.0), this version of the Java Runtime only recognizes class file versions up to 52.0

I'm using the latest version of JDK so why am I getting this error and how can I resolve it?

The Android developer documentation explained that there is an option --v4-no-merkle-tree but the option does not exist. I'm doing this way to sign via CMD

We are currently signing our Android apps using jarsigner but we want to migrate to using apksigner so we can take advantage of it's additional benefits such as the v2 signing algorithm.

Are there any considerations we need to factor into this migration or is it as simple as changing which tool we are using? Our main concern is obviously to avoid any complications when pushing updated apps to the Play Store.

Is it possible given a released APK file to know the Android build tools version used, especially with utilities like zipalign and apksigner that has been applied to the APK file?

For context, I am trying to use an Azure build pipeline to build multiple flavors of an Android app. Each flavor has its own separate signing keystore, and all of those keystores are stored in my 'secure files' in the library.

However, when I try to dereference the $(Keystore) variable during the 'android signing' task, it doesn't seem to recognize that that is a variable that exists, and tries instead to locate a file called '$(Keystore)'

Am I doing something wrong here? This seems like it should work.

A sanitized example looks like this: