Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I am trying to sign zip packages before flashing them in recovery. By using the test keys by Google, the zip can be verified and flashed successfully. However, when I try to sign using my private keys, the signing process is OK but the verification always fails.

First method: Using keytool and jarsigner

Generating private keys:

keytool -genkey -v -keystore test.keystore alias zippack -keyalg RSA -keysize 2048 -validity 1000

Signing:

jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore test.keystore test.zip zippack

Result:

E: signature verification failed

Second method (a): Using OpenSSL and SignApk.jar

Generating private keys:

openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out request.pem
openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt

Signing:

java -jar -w signapk.jar certificate.pem key.pk8 test.zip test-signed.zip

Result:

E: failed to verify whole file signature
I: verify_file returned 1
E: signature verification failed

Second method (b): OpenSSL and SignApk.jar (changes in commands)

Generating private keys:

Same as above

Signing:

java -jar signapk.jar certificate.pem key.pk8 test.zip test-signed.zip

Result:

E: signature verification failed

That's about what I did. The methods above works for APKs, but not for zips. Anyone can help on this? Thanks in advanced.

P.S. I managed to get a look at the source code for recovery, and found that my errors are generated by this part of the code: https://github.com/CyanogenMod/android_bootable_recovery/blob/jellybean/verifier.c Maybe it might help answering.

share|improve this question
    
This looks like a programming question, and should be on StackOverflow.com instead. –  geffchang Jan 2 '13 at 13:37
    
I don't think so because this is not programming, it is something related to the internals of Android OS. –  Ryuinferno Jan 2 '13 at 15:06

1 Answer 1

up vote 1 down vote accepted

From the code comments:

// ... Verify it matches one of the given public
// keys.

You can't just use any old signature, that would defeat the purpose. APKs, on the other hand, are intended to be created and distributed by anyone and the signature is ostensibly to verify the source rather than limit the source.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.