I'm trying to setup a bulk of tablets with a custom ROM (as a kind of kiosk mode tablets for my company). In short all I'm doing is deleting all kind of stuff from the tablet and then I'm installing just my self-made kiosk app as a launcher app. I've already accomplished that by doing it manually on a rooted tablet. However I need to that for a bulk of tablets so I want to create an update.zip which automates that and apply it to all tablets by adb sideload update.zip.

When I try to load a minimalistic update.zip which I created to just learn and play around with the update.zip archive format I always get the following error:

error message

The minimalistic update.zip which just creates a tiny text file in \system\ to proof that the update really has been applied can be downloaded here: update.zip

What's wrong with my ZIP? All similar questions on this topic seem to be related to signing issues, but:

  • i've signed my ZIP
  • and all the other issues get errors like invalid signature but I don't get any error message at all!

1 Answer 1


OTA update packages must be signed with one of the keys expected by the system or the installation process will reject them.

You cannot just apply a zip to a stock ROM using the stock recovery, even if it is signed. It must be signed with the key used when building the ROM/recovery, which is only available to the device maker. If you want to apply an update you need to have a custom recovery at the very least which should allow you to bypass the signature verification.

Release keys

The Android tree includes test-keys under build/target/product/security. Building an Android OS image using make will sign all .apk files using the test-keys. Since the test-keys are publicly known, anybody can sign their own .apk files with the same keys, which may allow them to replace or hijack system apps built into your OS image. For this reason it is critical to sign any publicly released or deployed Android OS image with a special set of release-keys that only you have access to.

Signatures and sideloading

Before installing a package, recovery will verify that it is signed with one of the private keys matching the public keys stored in the recovery partition, just as it would for a package delivered over-the-air.

  • Well, creating a custom update zip wouldn't make things easier then, when I still need to apply a custom ROM first.
    – miho
    Jun 2, 2016 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .