0

I have an update.zip which include an APK in the system/priv-app/ folder, a boot and shutdown animations and an SSH server among other things. I have the private and public keys of the OEM who sold me tablet so I used sigapk.jar to sign the update.zip file. The command I used is the following:

java -jar signapk.jar -w certificate.x509.pem key.pk8 update.zip update-signed.zip

Then after trying to flash this file via stock recovery using sideload (adb sideload update-signed.zip) I get the following error:

Verifying update package...
E:failed to verify whole-file signature
E:signature verification failed
Restarting adbd...
Installation aborted.

Previously, I was trying to flash the update.zip without signing it and the result was the following:

Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.

Actually I do not know if the difference in the error (footer is wrong --> failed to verify whole-file signature) is because the keys are working or not, or maybe because the file didn't have any signature at all. Can someone help me with this and tell my why is it not working if I am using the OEM's .pem and .pk8 keys?

EDIT:

I also tried adding the certificate.x509.pem file inside the META-INF/com/android/otacert folder inside the update.zip file and then sign it, but that also didn't work.

7
  • The correct tool for signing is apksigner.jar from the Android SDK build-tools.
    – Robert
    Jul 9 '18 at 16:50
  • Try @Robert's suggestions. Also, are you sure that those keys are correct? How did you verify that the key you get is the preinstalled key on your device? Jul 9 '18 at 17:18
  • I have not verified. How can I do it?
    – Storo
    Jul 9 '18 at 17:20
  • @Robert apksigned.jar does not use pk8 and pem files so how can I do it?
    – Storo
    Jul 9 '18 at 17:29
  • Use KeyStore Explorer to convert it to a JKS keystore (new keystore and the import).
    – Robert
    Jul 9 '18 at 17:51
1

You are on the right track. The message "failed to verify whole-file signature", means that the file could not be deemed valid for the provided certificate.

The missing error message indicates that this is the case as the signature could not be matched to the trusted certificate store:

https://android.googlesource.com/platform/bootable/recovery/+/2c6c23f651abb3d215134dfba463eb72a5e9f8eb/verifier.cpp#258

The Android application which runs while sideloading uses a different certificate store than the recovery:

https://source.android.com/devices/tech/ota/sign_builds#signatures-sideloading

Assuming the keys you have are valid for the recovery, you might get away with directly booting into recovery using fastboot, then selecting your signed ZIP from there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.