How to Sign Apps
APK Signature and Verification Process
Standard Android System Requirements
- Application Signing:
- All applications must be signed before installation on a standard Android system.
- For detailed instructions, refer to Google's official resources on application signing.
wizarPOS Terminal Specifics
- Enhanced Signature Checks:
- In addition to standard Android signature verification, wizarPOS terminals conduct additional checks using the root certificate chain.
- Only APKs signed with the root certificate or a child certificate are permitted for installation.
- Obtaining a Signing Certificate:
- Developers must acquire a signing certificate issued by wizarPOS.
- Refer to wizarPOSDevCertificateApplyGuide_en.pdf for instructions on applying for this certificate.
- Importing the Certificate Chain:
- After receiving the CSR reply from wizarPOS, import the certificate chain file into your keystore.
- APKs signed with this keystore will be installable on wizarPOS terminals.
Development Mode Terminals
- Relaxed Signature Requirements:
- Terminals in development mode do not require the additional signature verification.
- This allows for the use of ADB to install and debug Android applications in development mode.
Custom Certificate Chains
- Terminal Control:
- The certificate chain issued by wizarpos can be replaced with the terminal owner's own certificate chain.
- This enables terminal owners to have full control over the applications installed on their terminals.
How to sign APK
Use IDE to sign APK
Please refer to Google Sign APP
- Click Build>Generate Signed Bundle/APK
- Select APK
- Choose keystore and input the info in the follow picture, click Next.
- Keep Default settings, set stored path of the signed APK, then click Finish.
Use Android apksigner to sign APK
Please read this apksigner tool.
For Example: Sign an APK using release.jks, which is the only key in the KeyStore:
$ apksigner sign --ks release.jks app.apk
Use command line tool to sign APK(Deprecated)
WizarPOS provides a Java signature tool to help developers sign APK. You can use it on the command line. Please download the signature tool v2.5-81. Make sure you have JRE 1.6 or later installed on your PC.
Run signature tool
In PC, run the follow command:
- Use jks：java -jar <File Path>/SignatureTools.jar sign --keytype jks --apk <File Path>/<in name>.apk --out <File Path>/<out name>.apk --keystore <File Path>/<name>.jks --alias androiddebugkey --storepass wizarpos([Optional]) --sigAlg SHA1withRSA(SHA1withRSA/MD5withRSA/SHA256withRSA, [Optional]) --signatureScheme v2(v1/v2,[Optional]) --zipalign
Replace the real parameter value, and change the key password and store password to your real password.
For Example: java -jar SignatureTools_v2.5-81-g1e5b0ac sign --keytype jks --apk bcare_wallet_beta_andorid6.apk --out bcare_wallet_beta_andorid6_signed3.apk --keystore E:\...\XXX.jks --alias XXX--keypass XXX --storepass XXX --zipalign --quiet
- Use pk8：java -jar <File Path>/SignatureTools.jar sign --keytype pk8 --apk <File Path>/<in name>.apk --out <File Path>/<out name>.apk --keyfile <File Path>/private_pwd.pk8(With or Without password) --certs <File Path>/cert.x509_pwd.pem --keypass android(Optional) --storepass android(Optional) --sigAlg SHA1withRSA(SHA1withRSA/MD5withRSA/SHA256withRSA, Optional) --signatureScheme v2(v1/v2)
Replace the real parameter value, and change the key password and store password to your real password.
| Parameter | Value | Specification |
|---|---|---|
| --keytype | jks or pk8 | The type of the keystore which used to sign the APK. |
| --keystore | The path of the jks key store file | It must be defined when using jks keystore |
| --keyfile | The path of the pk8 file | It must be defined when using pk8 file as keystore. |
| --apk | The file path of the apk before signed | The file path of the apk before signed |
| --out | The file path of the apk after signed | The file path of the apk after signed |
| --alias | Alias name of private key | Alias name of private key in jks file |
| --certs | Certificates file path | When keytype is pk8, this is the certificate chain |
| --storepass | Password of keystore file | Password of keystore file |
| --keypass | password of private key | password of private key in jks file or pk8 file |
| --sigAlg | SHA1withRSA or MD5withRSA or SHA256withRSA | signature algorithm |
| --signatureScheme | v1 or v2 or v1v2 | signature scheme |
| --zipalign | apk zipalign | |
| --quiet | suppress informational messages, only show warnings and errors. |