APK Signer
ENTERPRISE This is a SignServer Enterprise feature.
The signer has the fully qualified class name: org.signserver.module.apk.signer.ApkSigner
Overview
The APK Signer signs Android applications in the Android Package Kit (APK) format and supports all three Android application signing schemes:
- v1 scheme: based on JAR signing
- v2 scheme: APK Signature Scheme v2 introduced in Android 7.0.
- v3 scheme: APK Signature Scheme v3 introduced in Android 9.
The APK Signature Scheme v3 introduces signature lineage to support APK key rotation. Key rotation allows changing the signing certificate when a newer version of an Android app is released. Thus, if the initial version of an android app was signed with a given key, it is now possible to switch to a different key if you need to. Reasons for changing the key could be organizational restructuring or reorganization of your key stores, for example. For more information on Android signing and how to set it up in SignServer, see Setting up Android Signing.
The signer supports RSA and ECDSA keys and integration tests are run with RSA 2048 and ECDSA prime256v1 keys.
Setting the SIGNATUREALGORITHM property will only affect the default algorithm used when generating CSRs for the APK Signer. The signature algorithm used when signing depends on the API level, and the key algorithm and size used.
Available Properties
| Property | Description |
|---|---|
| V1_SIGNATURE | Enable (true) to Include APK version 1 signature. Valid values: true, false, or unset. Default: unset. |
| V2_SIGNATURE | Enable (true) to Include APK version 2 signature. Valid values: true, false, or unset. Default: unset. |
| V3_SIGNATURE | Enable (true) to Include APK version 3 signature. Valid values: true, false, or unset. Default: unset. |
| MIN_SDK_VERSION | Minimum SDK version of APK supported to be signed. Valid values: a positive integer, or unset. Default: unset. |
| MAX_SDK_VERSION | Maximum SDK version of APK supported to be signed. Valid values: a positive integer, or unset. Default: unset. |
| DEBUGGABLE_APK_PERMITTED | True if debuggable APK should be allowed to be signed. Valid values: true, or false. Default: false. |
| LINEAGE_FILE_CONTENT | Base 64-encoded content of a lineage file. Default: unset. |
| V1_SIGNATURE_NAME | Signature name to use for version 1 signature. If not set, the common name (CN) from the DN will be used or if not existing the whole DN will be used. Default: unset. |
| OTHER_SIGNERS | Comma-separated list of additional worker names. The certificate and key of the specified signers will be used to create the additional signatures (if specified).
For more information on Signing with Multiple Signers and Rolling Over to a New Key, see Setting up Android Signing. |
| ALLOW_V1_SIGNATURE_OVERRIDE | Enable (true) to allow overriding V1_SIGNATURE in the request. Default: false. |
| ALLOW_V2_SIGNATURE_OVERRIDE | Enable (true) to allow overriding V2_SIGNATURE in the request. Default: false. |
| ALLOW_V3_SIGNATURE_OVERRIDE | Enable (true) to allow overriding V3_SIGNATURE in the request. Default: false. |
| ALLOW_MIN_SDK_VERSION_OVERRIDE | Enable (true) to allow overriding MIN_SDK_VERSION in the request. Default: false. |
| ALLOW_MAX_SDK_VERSION_OVERRIDE | Enable (true) to allow overriding MAX_SDK_VERSION in the request. Default: false. |
| ALLOW_DEBUGGABLE_APK_PERMITTED_OVERRIDE | Enable (true) to allow overriding DEBUGGABLE_APK_PERMITTED in the request. Default: false. |
| ALLOW_V1_SIGNATURE_NAME_OVERRIDE | Enable (true) to allow overriding V1_SIGNATURE_NAME in the request. Default: false. |
| DO_LOGREQUEST_DIGEST | If a digest of the request should be computed and logged. Optional, default: true. |
| LOGREQUEST_DIGESTALGORITHM | Algorithm used to create the message digest (hash) of the request document to put in the log. Default: SHA256. |
| DO_LOGRESPONSE_DIGEST | If a digest of the response should be computed and logged. Optional, default: true. |
| LOGRESPONSE_DIGESTALGORITHM | Algorithm used to create the message digest (hash) of the response document to put in the log. Default: SHA256. |
Request Parameters
| Property | Description |
|---|---|
| V1_SIGNATURE | True if version 1 signature should be included when not configured in the worker, false to skip version 1 signature if configured with the worker property. |
| V2_SIGNATURE | True if version 2 signature should be included when not configured in the worker, false to skip version 2 signature if configured with the worker property. |
| V3_SIGNATURE | True if version 3 signature should be included when not configured in the worker, false to skip version 3 signature if configured with the worker property. |
| MIN_SDK_VERSION | Min SDK version to support for the APK to be signed. Overrides the value configured in the worker, if any. |
| MAX_SDK_VERSION | Max SDK version to support for the APK to be signed. Overrides the value configured in the worker, if any. |
| DEBUGGABLE_APK_PERMITTED | True or false determining if a debuggable APK is permitted to be signed. Overrides the configured in the worker. |
| V1_SIGNATURE_NAME | The signature name to use for the version 1 signature(s), if it is enabled. Overrides the value configured in the worker. |
Worker Log Fields
| Field | Description |
|---|---|
| REQUEST_DIGEST | A message digest (hash) for the request document in hex encoding. |
| REQUEST_DIGEST_ALGORITHM | The name of the message digest (hash) algorithm used for the request digest in the log. |
| RESPONSE_DIGEST | A message digest (hash) for the response document in HEX encoding. |
| RESPONSE_DIGEST_ALGORITHM | The name of the message digest (hash) algorithm used for the response digest in the log. |