What is the official Android repository containing APKSIGNER?

Question

What is the official source for apksigner as referenced e.g. in this answer? People are citing Android Studio, Android SDK Build Tools/Platform Tools/Command Line Tools etc. (as well as some shady archives on Google Drive), but non of these contain the program. I've downloaded, installed and searched them all.

Alternatively, what is the official source for Android SDK Build Tools 24.0.3, which allegedly contains the apksigner?

I've found an apksigner.jar and apksigner.bat inside a private Google repository, but running

apksigner verify --verbose --print-certs <APK file>
apksigner.bat verify --verbose --print-certs <APK file>
apksigner.jar verify --verbose --print-certs <APK file>

doesn't work (no output). This is the content of said batch file apksigner.bat:

@echo off
REM Copyright (C) 2016 The Android Open Source Project
REM
REM Licensed under the Apache License, Version 2.0 (the "License");
REM you may not use this file except in compliance with the License.
REM You may obtain a copy of the License at
REM
REM     http://www.apache.org/licenses/LICENSE-2.0
REM
REM Unless required by applicable law or agreed to in writing, software
REM distributed under the License is distributed on an "AS IS" BASIS,
REM WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
REM See the License for the specific language governing permissions and
REM limitations under the License.

REM don't modify the caller's environment
setlocal

REM Locate apksigner.jar in the directory where apksigner.bat was found and start it.

REM Set up prog to be the path of this script, including following symlinks,
REM and set up progdir to be the fully-qualified pathname of its directory.
set prog=%~f0

rem Check we have a valid Java.exe in the path.
set java_exe=
if exist    "%~dp0..\tools\lib\find_java.bat" call    "%~dp0..\tools\lib\find_java.bat"
if exist "%~dp0..\..\tools\lib\find_java.bat" call "%~dp0..\..\tools\lib\find_java.bat"
if not defined java_exe goto :EOF

set jarfile=apksigner.jar
set "frameworkdir=%~dp0"
rem frameworkdir must not end with a dir sep.
set "frameworkdir=%frameworkdir:~0,-1%"

if exist "%frameworkdir%\%jarfile%" goto JarFileOk
    set "frameworkdir=%~dp0lib"

if exist "%frameworkdir%\%jarfile%" goto JarFileOk
    set "frameworkdir=%~dp0..\framework"

:JarFileOk

set "jarpath=%frameworkdir%\%jarfile%"

set javaOpts=
set args=

REM By default, give apksigner a max heap size of 1 gig and a stack size of 1meg.
rem This can be overridden by using "-JXmx..." and "-JXss..." options below.
set defaultXmx=-Xmx1024M
set defaultXss=-Xss1m

REM Capture all arguments that are not -J options.
REM Note that when reading the input arguments with %1, the cmd.exe
REM automagically converts --name=value arguments into 2 arguments "--name"
REM followed by "value". apksigner has been changed to know how to deal with that.
set params=

:firstArg
if [%1]==[] goto endArgs
set a=%~1

    if [%defaultXmx%]==[] goto notXmx
    if %a:~0,5% NEQ -JXmx goto notXmx
        set defaultXmx=
    :notXmx

    if [%defaultXss%]==[] goto notXss
    if %a:~0,5% NEQ -JXss goto notXss
        set defaultXss=
    :notXss

    if %a:~0,2% NEQ -J goto notJ
        set javaOpts=%javaOpts% -%a:~2%
        shift /1
        goto firstArg

    :notJ
    set params=%params% %1
    shift /1
    goto firstArg

:endArgs

set javaOpts=%javaOpts% %defaultXmx% %defaultXss%
call "%java_exe%" %javaOpts% -Djava.ext.dirs="%frameworkdir%" -jar "%jarpath%" %params%

UPDATE: As suggested, I've now tried apksigner from Android Build Tools. Here is the output:

Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Unknown, OU=Unknown, O=Fiducia IT AG, L=Unknown, ST
=Unknown, C=DE
Signer #1 certificate SHA-256 digest: 53a6afa8f0d219bba2fe84154f256ecec85b34175f
fee5b7387fda0afcc12605
Signer #1 certificate SHA-1 digest: addb5ed43a27660e41acb1d39e85ddd7b9c9807c
Signer #1 certificate MD5 digest: 1be8c130e83eb6b36e4aff93bcdd1b28
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 671eafb570fa9e82cb7a8d5c435dad3d86990a09d5b
20f41b42e3152b3cd5a6a
Signer #1 public key SHA-1 digest: c021e779e6086e20a7c60b05a0c30b94c59c83ba
Signer #1 public key MD5 digest: d42dc7a6bcb0ace30d8ac316bc321c9c
WARNING: META-INF/androidx.navigation_navigation-fragment.version not protected
by signature. Unauthorized modifications to this JAR entry will not be detected.
 Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-camera2.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.customview_customview.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/services/ya.k not protected by signature. Unauthorized modific
ations to this JAR entry will not be detected. Delete or move the entry outside
of META-INF/.
WARNING: META-INF/androidx.room_room-runtime.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-lifecycle.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.browser_browser.version not protected by signature. U
nauthorized modifications to this JAR entry will not be detected. Delete or move
 the entry outside of META-INF/.
WARNING: META-INF/com.google.android.material_material.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.savedstate_savedstate-ktx.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.activity_activity-ktx.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_play_services.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.slidingpanelayout_slidingpanelayout.version not prote
cted by signature. Unauthorized modifications to this JAR entry will not be dete
cted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.dynamicanimation_dynamicanimation.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.exifinterface_exifinterface.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite-ktx.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-extensions.version not protected
by signature. Unauthorized modifications to this JAR entry will not be detected.
 Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.versionedparcelable_versionedparcelable.version not p
rotected by signature. Unauthorized modifications to this JAR entry will not be
detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-ktx.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.preference_preference-ktx.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.preference_preference.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-ui.version not protected by sig
nature. Unauthorized modifications to this JAR entry will not be detected. Delet
e or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-runtime.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.room_room-ktx.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.appcompat_appcompat-resources.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.appcompat_appcompat.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-runtime.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-runtime-ktx.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.window_window.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.cursoradapter_cursoradapter.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.savedstate_savedstate.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.fragment_fragment.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.vectordrawable_vectordrawable.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.fragment_fragment-ktx.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite-framework.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.core_core.version not protected by signature. Unautho
rized modifications to this JAR entry will not be detected. Delete or move the e
ntry outside of META-INF/.
WARNING: META-INF/androidx.vectordrawable_vectordrawable-animated.version not pr
otected by signature. Unauthorized modifications to this JAR entry will not be d
etected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.version n
ot protected by signature. Unauthorized modifications to this JAR entry will not
 be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel-savedstate.version not
protected by signature. Unauthorized modifications to this JAR entry will not be
 detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.security_security-crypto.version not protected by sig
nature. Unauthorized modifications to this JAR entry will not be detected. Delet
e or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-common-ktx.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.biometric_biometric.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-core.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-common.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_android.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.legacy_legacy-support-core-utils.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.viewpager2_viewpager2.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.transition_transition.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.print_print.version not protected by signature. Unaut
horized modifications to this JAR entry will not be detected. Delete or move the
 entry outside of META-INF/.
WARNING: META-INF/androidx.documentfile_documentfile.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.core_core-ktx.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.emoji2_emoji2-views-helper.version not protected by s
ignature. Unauthorized modifications to this JAR entry will not be detected. Del
ete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.recyclerview_recyclerview.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.tracing_tracing.version not protected by signature. U
nauthorized modifications to this JAR entry will not be detected. Delete or move
 the entry outside of META-INF/.
WARNING: META-INF/androidx.startup_startup-runtime.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-fragment-ktx.version not protec
ted by signature. Unauthorized modifications to this JAR entry will not be detec
ted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-core-ktx.version not pro
tected by signature. Unauthorized modifications to this JAR entry will not be de
tected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.arch.core_core-runtime.version not protected by signa
ture. Unauthorized modifications to this JAR entry will not be detected. Delete
or move the entry outside of META-INF/.
WARNING: META-INF/androidx.emoji2_emoji2.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel-ktx.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-runtime-ktx.version not protected
 by signature. Unauthorized modifications to this JAR entry will not be detected
. Delete or move the entry outside of META-INF/.
WARNING: META-INF/services/ta.z not protected by signature. Unauthorized modific
ations to this JAR entry will not be detected. Delete or move the entry outside
of META-INF/.
WARNING: META-INF/INDEX.LIST not protected by signature. Unauthorized modificati
ons to this JAR entry will not be detected. Delete or move the entry outside of
META-INF/.
WARNING: META-INF/androidx.activity_activity.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.drawerlayout_drawerlayout.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.interpolator_interpolator.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/com/android/build/gradle/app-metadata.properties not protected
 by signature. Unauthorized modifications to this JAR entry will not be detected
. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-core.version not protected by signature
. Unauthorized modifications to this JAR entry will not be detected. Delete or m
ove the entry outside of META-INF/.
WARNING: META-INF/androidx.swiperefreshlayout_swiperefreshlayout.version not pro
tected by signature. Unauthorized modifications to this JAR entry will not be de
tected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-service.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-process.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.loader_loader.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.viewpager_viewpager.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.cardview_cardview.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-ui-ktx.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.coordinatorlayout_coordinatorlayout.version not prote
cted by signature. Unauthorized modifications to this JAR entry will not be dete
cted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_core.version not protected by signature. Un
authorized modifications to this JAR entry will not be detected. Delete or move
the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-view.version not protected by signature
. Unauthorized modifications to this JAR entry will not be detected. Delete or m
ove the entry outside of META-INF/.
WARNING: META-INF/androidx.annotation_annotation-experimental.version not protec
ted by signature. Unauthorized modifications to this JAR entry will not be detec
ted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.core_core-splashscreen.version not protected by signa
ture. Unauthorized modifications to this JAR entry will not be detected. Delete
or move the entry outside of META-INF/.

What is the meaning?

Answer 1

I have extended my original answer by a section how to get apksigner without installing Android SDK or Android Studio:

Apksigner is a Java tool and Google provides for start-up a batch file apksigner.bat(Windows) respectively a shell script apksigner.sh (Linux, MacOS). As mentioned before it is included in each build-tools version of Android SDK. If you don't want to install the whole Android SDK (with or without Android Studio) you can directly download build tools and extract and execute apksigner. Links to the all build-tools are provided on this website (the provided links go to the original Google download locations).

I prefer apksigner from build-tools v30:

• build-tools 30.0.1 Linux
• build-tools 30.0.1 MacOS
• build-tools 30.0.1 Windows

You only need the file lib/apksigner.jar from the archive (thus it doesn't matter for which platform you download the build-tools package). Extract it and open a shell in the folder. Then execute java -jar apksigner.jar. To execute you need Java 9 or higher (best one of the Java LTS versions 11 or 17 - e.g. the Eclipse Adoptium OpenJDK release https://adoptium.net).

Using this direct approach the command to execute apksigner is

java -jar apksigner.jar verify --verbose --print-certs "Signal-website-universal-release-4.49.13.apk"