0

I have an update.zip which include an APK in the system/priv-app/ folder, a boot and shutdown animations and an SSH server among other things. I have the private and public keys of the OEM who sold me tablet so I used sigapk.jar to sign the update.zip file. The command I used is the following:

java -jar signapk.jar -w certificate.x509.pem key.pk8 update.zip update-signed.zip

Then after trying to flash this file via stock recovery using sideload (adb sideload update-signed.zip) I get the following error:

Verifying update package...
E:failed to verify whole-file signature
E:signature verification failed
Restarting adbd...
Installation aborted.

Previously, I was trying to flash the update.zip without signing it and the result was the following:

Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.

Actually I do not know if the difference in the error (footer is wrong --> failed to verify whole-file signature) is because the keys are working or not, or maybe because the file didn't have any signature at all. Can someone help me with this and tell my why is it not working if I am using the OEM's .pem and .pk8 keys?

EDIT:

I also tried adding the certificate.x509.pem file inside the META-INF/com/android/otacert folder inside the update.zip file and then sign it, but that also didn't work.

Improve this question
7
  • The correct tool for signing is apksigner.jar from the Android SDK build-tools.
    – Robert
    Commented Jul 9, 2018 at 16:50
  • Try @Robert's suggestions. Also, are you sure that those keys are correct? How did you verify that the key you get is the preinstalled key on your device?
    – Artic
    Commented Jul 9, 2018 at 17:18
  • I have not verified. How can I do it?
    – Storo
    Commented Jul 9, 2018 at 17:20
  • @Robert apksigned.jar does not use pk8 and pem files so how can I do it?
    – Storo
    Commented Jul 9, 2018 at 17:29
  • Use KeyStore Explorer to convert it to a JKS keystore (new keystore and the import).
    – Robert
    Commented Jul 9, 2018 at 17:51

1 Answer 1

Reset to default
1

You are on the right track. The message "failed to verify whole-file signature", means that the file could not be deemed valid for the provided certificate.

The missing error message indicates that this is the case as the signature could not be matched to the trusted certificate store:

https://android.googlesource.com/platform/bootable/recovery/+/2c6c23f651abb3d215134dfba463eb72a5e9f8eb/verifier.cpp#258

The Android application which runs while sideloading uses a different certificate store than the recovery:

https://source.android.com/devices/tech/ota/sign_builds#signatures-sideloading

Assuming the keys you have are valid for the recovery, you might get away with directly booting into recovery using fastboot, then selecting your signed ZIP from there.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .