How to Sign Apps: Difference between revisions

Revision as of 02:56, 26 April 2019

APK Signature Verification

In Android system, all the application should be signed before installed to terminal. Please refer to Google's resource for detail.

In wizarPOS terminal, the system will also verify the certificate chain of the APK signatures, except the normal Android signature checking. So the developer should apply the development certificate to wizarPOS. Please refer to this document wizarPOSDevCertificateApplyGuide_en.pdf. After you get the CSR reply from wizarPOS, please import the certificate chain file to your key store. Then the APK signed by this key store can be installed to wizarPOS production terminal.

By default, the additional signature verification is not required in developing mode terminal. So you can use ADB to install and debug the normal Android APK to developing mode terminal.

The wizarPOS application root certificate can also be update to acquire's own application root certificate to let acquirer (terminal owner) control the terminal application totally.

How to sign app

Sign in an application project

Please refer to Google Sign APP

Sign an APK

WizarPOS provide a signature tool, it is a tool running in PC, and help the developer to sign their APK. Please download the signature tool. Before running it, please make sure that you have installed the JDK operation environment in your PC.

Run signature tool

In PC, run the follow command:

 java -jar SignatureTools.jar sign [--keytype jks|pk8] [--apk <FILE>] [--out <FILE>] [--keystore <FILE.jks>] [--alias <String>] [--keyfile <FILE.pk8>] [--certs <FILE>] [--storepass <String>] [--keypass <String>]

SignatureTools.jar is the signature tool. The following table shows the parameters and their illustrations.

Parameter	Value	Specification
--keytype	Jks or pk8	The store path of the jks file or pk8 file
--apk	The file path of the apk before signed	The file path of the apk before signed
--out	The file path of the apk after signed	The file path of the apk after signed
--keystore	The file path of the jks file	When keytype is jks, this must be assigned
--alias	Alias name of private key	Alias name of private key in jks file
--keyfile	The file path of the pk8 file	When keytype is pk8, this is the private key file path
--certs	Certificates file path	When keytype is pk8, this is the certificate chain
--storepass	Password of keystore file	Password of keystore file
--keypass	password of private key	password of private key in jks file or pk8 file

@@ Line 1: / Line 1: @@
-== WizarPOS sign necessity ==
+== APK Signature Verification ==
-Basically, In Android system, all the application should be signed before installed to terminal. The key used to sign APK is the private key of a RSA key pair in a key store. So in the key store, there is a key pair (private key/ public key) and the public key's certificate.
+In Android system, all the application should be signed before installed to terminal. Please refer to [https://developer.android.com/studio/publish/app-signing.html Google's resource] for detail.
-Please refer to [https://developer.android.com/studio/publish/app-signing.html Google's resource] for detail.
+<p>In wizarPOS terminal, the system will also verify the certificate chain of the APK signatures, except the normal Android signature checking. So the developer should apply the development certificate to wizarPOS. Please refer to this document [ftp://sdkuser:wizsdkar@ftp.wizarpos.com/wizarPOSDevCertificateApplyGuide_en.pdf wizarPOSDevCertificateApplyGuide_en.pdf]. After you get the CSR reply from wizarPOS, please import the certificate chain file to your key store. Then the APK signed by this key store can be installed to wizarPOS production terminal.
-In the signed APK, the certificate relevant to the signing private key is included in the package.
+<p>
-WizarPOS terminals are based on Android System.
+By default, the additional signature verification is not required in developing mode terminal. So you can use ADB to install and debug the normal Android APK to developing mode terminal.
-There are two mode of terminal:
+<p>
-* Production/User mode terminal
+The wizarPOS application root certificate can also be update to acquire's own application root certificate to let acquirer (terminal owner) control the terminal application totally.
-In the production terminal, the public key of the signing private key of the APK will be checked, it should be issued by the app root public key. By default, there is default WizarPOS root public key in the terminal. So you can request production public key to us for your key store (which will be used to sign APK). The applying step is describe in the document [ftp://sdkuser:wizsdkar@ftp.wizarpos.com/wizarPOSDevCertificateApplyGuide_en.pdf wizarPOSDevCertificateApplyGuide_en.pdf]. After get the response certificate file from us, you should import the certificate file to your key store, then all the APK signed by this key store can be installed to production terminal.
-* Developing/Engineer mode terminal
-The developing terminal do not check public key. It's for the developer to debug their app, so it has USB connection and can use ADB debug.
-Please notice, because of this difference, if your developing terminal switch to production terminal, all the application you installed in terminal, which is also not signed by above key store, will be removed automatically.
-Of cause, the default WizarPOS root public key can be updated to terminal owner's root public key in future. So the terminal owner can control their APK certificate by themselves.
 == How to sign app ==