Google Git
Sign in
android / platform / tools / apksig / 2ded5eb392c26eb13b96bfcec7e3517bb06eb94c
commit2ded5eb392c26eb13b96bfcec7e3517bb06eb94c[log] [tgz]
authorAlex Klyubin <klyubin@google.com>Thu Jun 22 14:20:04 2017 -0700
committerAlex Klyubin <klyubin@google.com>Mon Jun 26 12:26:23 2017 -0700
treeea42e7a59cb4b64ec1888af3211d03b2eefd5548
parent0f88b97634034673f062a8ac6c3dab7d3d9befe3 [diff]
Add ASN.1 BER parser

This adds an ASN.1 BER parser to be used for parsing PKCS #7 signature
blocks of APK JAR signatures. The main reason for adding the parser
instead of using Sun's/Oracle's sun.** classes is that these classes
will no longer be accessible (by default) in Java 9 and will likely no
longer be accessible at all in a later release of Java.

The parser takes a BER-encoded input and parses it into the ASN.1
structure represented as a Java object. The main entry point of the
parser is Asn1BerParser.parse.

Test: bazel test ...
Test: gradlew test
Bug: 37137869
Change-Id: I56ecef77c3e32d609a9ea00b71467ed4c11b1757
15 files changed
tree: ea42e7a59cb4b64ec1888af3211d03b2eefd5548
  1. etc/
  2. src/
  3. Android.mk
  4. android_plugin_for_gradle.gradle
  5. apksig.iml
  6. BUILD
  7. build.gradle
  8. LICENSE
  9. OWNERS
  10. README.md
README.md

apksig

apksig is a project which aims to simplify APK signing and checking whether APK's signatures should verify on Android. apksig supports JAR signing (used by Android since day one) and APK Signature Scheme v2 (supported since Android Nougat, API Level 24).

The key feature of apksig is that it knows about differences in APK signature verification logic between different versions of the Android platform. apksig can thus check whether a signed APK is expected to verify on all Android platform versions supported by the APK. When signing an APK, apksig will choose the most appropriate cryptographic algorithms based on the Android platform versions supported by the APK being signed.

The project consists of two subprojects:

  • apksig -- a pure Java library, and
  • apksigner -- a pure Java command-line tool based on the apksig library.

apksig library

apksig library offers three primitives:

  • ApkSigner which signs the provided APK so that it verifies on all Android platform versions supported by the APK. The range of platform versions can be customized if necessary.
  • ApkVerifier which checks whether the provided APK is expected to verify on all Android platform versions supported by the APK. The range of platform versions can be customized if necessary.
  • (Default)ApkSignerEngine which abstracts away signing an APK from parsing and building an APK file. This is useful in optimized APK building pipelines, such as in Android Plugin for Gradle, which need to perform signing while building an APK, instead of after. For simpler use cases where the APK to be signed is available upfront, the ApkSigner above is easier to use.

NOTE: Some public classes of the library are in packages having the word “internal” in their name. These are not public API of the library. Do not use *.internal.* classes directly.

apksigner command-line tool

apksigner command-line tool offers two operations:

  • sign the provided APK so that it verifies on all Android platforms supported by the APK. Run apksigner sign for usage information.
  • check whether the provided APK's signatures are expected to verify on all Android platforms supported by the APK. Run apksigner verify for usage information.

The tool determines the range of Android platform versions (API Levels) supported by the APK by inspecting the APK's AndroidManifest.xml. This behavior can be overridden by specifying the range of platform versions on the command-line.