1

We have a kiosk application that needs to be able to periodically do OTA updates using our self-made OTA update .zip files.

Our custom OTA update .zip file have the following files:

/data/misc/adb/
        adb_keys
/system
    /priv-app/
        MyApp.apk
    /vendor/
        build.prop
/META-INF/com/google/android/
        update-binary
        updater-script

We have used many different tablets like Galaxy Tab 3, Galaxy Tab 4 and Yoga 3, the only thing we have had to do is to replace the mount command arguments inside updater-script with the right ones for each tablet.

Of couse, since we do not have the release keys of each of these tablets, we have had to replace every Recovery with its own TWRP Recovery replacement, in order to be able to flash our custom OTA update file. All this worked like a charm every time.

Now we bought new tablets from a chinese manufacturer and when we tried to flash our OTA update package we got the following error:

Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.

From that message is clear that error occurred because the OTA update .zip file was not signed. So, I asked from the manufacturer the release keys and the instructions in order to sign our OTA update .zip file and being able to flash it.

The problem is that the manufacturer's engineers have no clue of how to do this (signing OTA update files so they don't get rejected by their Recovery), which seems like a very common problem because we asked in multiple manufacturers and nobody knows how to do this.

So, I would like to ask for your help since I cannot find the instructions on how to sign it. Anybody knows how to do it?

  • No... And no one knows how to do this except software engineers, and if they give you the release keys they should be immediately terminated. This would be an extremely security issue, for example, if I had the release keys for any device, you could immediately bypass any and all security mechanisms, root, and access any data with near zero effort. If any company gave you the release keys, they are basically opening the doors and saying "here, take my business from me, you can have keys". – acejavelin Oct 17 '18 at 16:13
  • The tablet manufacturers actually build different ROMS for their clients so they generate different release keys for each generated ROM so there is no issue in sharing those keys with the company that is paying for that specific ROM. No "extremely security issue" there since our key will be different to all other keys they have generated in the past. – Storo Oct 17 '18 at 16:28
  • If you want to provide self-made OTA update you also have to use your own custom ROM. Then you are able to sign OS and OTA update using the same key. – Robert Oct 17 '18 at 17:24
  • @Storo Then only that manufacturer can give you the keys... Unless you use Robert's suggestion of building your own ROM. – acejavelin Oct 17 '18 at 17:27
  • @Robert and acejavelin what I am asking is actually how do I need to sign my OTA update file in order to be able to flash it. It is clear that it needs to be done with the release keys of the manufacturer of the ROM. What I need from you guys is to tell me what do I do with those keys in order to sign the ZIP file. – Storo Oct 17 '18 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.