| ... |
... |
@@ -30,10 +30,6 @@ test -f "$android_signing_key_path" || exit_error "$android_signing_key_path is |
|
30
|
30
|
|
|
31
|
31
|
setup_build_tools() {
|
|
32
|
32
|
abt_version=16
|
|
33
|
|
- # If signing 14.5, keep using android-12 build tools
|
|
34
|
|
- # (we can remove this when 15.0 is the stable release)
|
|
35
|
|
- ( test -z "$tbb_version" || echo "$tbb_version" | grep -q '^14\.5' ) && \
|
|
36
|
|
- abt_version=12
|
|
37
|
33
|
build_tools_dir=/signing/android-build-tools
|
|
38
|
34
|
test -f "$build_tools_dir"/android-$abt_version/apksigner || \
|
|
39
|
35
|
exit_error "$build_tools_dir/android-$abt_version/apksigner is missing"
|
| ... |
... |
@@ -41,49 +37,31 @@ setup_build_tools() { |
|
41
|
37
|
}
|
|
42
|
38
|
|
|
43
|
39
|
# Sign individual apk
|
|
|
40
|
+# https://developer.android.com/studio/publish/app-signing#sign-manually
|
|
44
|
41
|
sign_apk() {
|
|
45
|
42
|
INPUTAPK="$1"
|
|
46
|
43
|
OUTPUTAPK="$2"
|
|
|
44
|
+ SIGNEDAPK=$(basename "${INPUTAPK}")
|
|
47
|
45
|
|
|
48
|
|
- # https://developer.android.com/studio/publish/app-signing#sign-manually
|
|
49
|
|
- # After running `gradlew assembleRelease`, creates an unsigned-unaligned apk
|
|
50
|
|
-
|
|
51
|
|
- # Aligning ensures that all uncompressed data starts with a particular byte
|
|
52
|
|
- # alignment relative to the start of the file, which may reduce the amount
|
|
53
|
|
- # of RAM consumed by an app.
|
|
54
|
|
- # zipalign -v -p 4 my-app-unsigned.apk my-app-unsigned-aligned.apk
|
|
55
|
|
- echo Aligning and signing ${INPUTAPK}
|
|
56
|
|
-
|
|
57
|
|
- # Append the different stages of signing
|
|
58
|
|
- UNSIGNED_UNALIGNED_APK=`basename "${INPUTAPK}" | sed 's/\.apk/-unsigned-unaligned.apk/'`
|
|
59
|
|
- UNSIGNED_APK=`echo "${UNSIGNED_UNALIGNED_APK}" | sed 's/-unaligned//'`
|
|
60
|
|
- SIGNED_APK=`echo "${UNSIGNED_APK}" | sed 's/-unsigned//'`
|
|
61
|
|
-
|
|
62
|
|
- # ${INPUTAPK} is full path. We copy to local tmp directory.
|
|
63
|
|
- cp "${INPUTAPK}" "${UNSIGNED_UNALIGNED_APK}"
|
|
64
|
|
-
|
|
65
|
|
- # Step 1: Align
|
|
66
|
|
- zipalign -v -p 4 "${UNSIGNED_UNALIGNED_APK}" "${UNSIGNED_APK}"
|
|
67
|
|
- if [ ! $? = 0 ]; then
|
|
68
|
|
- echo "zipalign failed"
|
|
69
|
|
- exit 1
|
|
70
|
|
- fi
|
|
71
|
|
- echo zipalign succeeded
|
|
72
|
|
-
|
|
73
|
|
- # Step 2: Verify alignment
|
|
74
|
|
- zipalign -vc 4 "${UNSIGNED_APK}"
|
|
|
46
|
+ # Verify alignment before signing
|
|
|
47
|
+ # APKs have various requirements for being published on the Play Store.
|
|
|
48
|
+ # The input APKs should be ready before starting this process.
|
|
|
49
|
+ echo Verifying ${INPUTAPK}
|
|
|
50
|
+ zipalign -c -P 16 4 "${INPUTAPK}"
|
|
75
|
51
|
if [ ! $? = 0 ]; then
|
|
76
|
52
|
echo "zipalign verify failed"
|
|
77
|
53
|
exit 1
|
|
78
|
54
|
fi
|
|
79
|
55
|
echo zipalign verify succeeded
|
|
80
|
56
|
|
|
81
|
|
- # Step 3: Sign
|
|
|
57
|
+ # Sign
|
|
|
58
|
+ echo Signing ${INPUTAPK}
|
|
|
59
|
+
|
|
82
|
60
|
# Use this command if reading key from file
|
|
83
|
|
- apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}"
|
|
|
61
|
+ apksigner sign --verbose -ks ${android_signing_key_path} --ks-type pkcs12 --ks-pass env:KSPASS --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}"
|
|
84
|
62
|
|
|
85
|
63
|
# Or, use below command if using a hardware token
|
|
86
|
|
- # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNED_APK}" "${UNSIGNED_APK}"
|
|
|
64
|
+ # apksigner sign --verbose --provider-class sun.security.pkcs11.SunPKCS11 --provider-arg pkcs11_java.cfg --ks NONE --ks-type PKCS11 --debuggable-apk-permitted=false --out "${SIGNEDAPK}" "${INPUTAPK}"
|
|
87
|
65
|
|
|
88
|
66
|
if [ ! $? = 0 ]; then
|
|
89
|
67
|
echo "apksigner sign failed"
|
| ... |
... |
@@ -91,15 +69,16 @@ sign_apk() { |
|
91
|
69
|
fi
|
|
92
|
70
|
echo apksigner sign succeeded
|
|
93
|
71
|
|
|
94
|
|
- # Step 4: Verify signature
|
|
95
|
|
- apksigner verify --verbose "${SIGNED_APK}"
|
|
|
72
|
+ # Verify signature
|
|
|
73
|
+ apksigner verify --verbose "${SIGNEDAPK}"
|
|
96
|
74
|
if [ ! $? = 0 ]; then
|
|
97
|
75
|
echo "apksigner verify failed"
|
|
98
|
76
|
exit 1
|
|
99
|
77
|
fi
|
|
100
|
|
-
|
|
101
|
|
- mv -f "${SIGNED_APK}" "$OUTPUTAPK"
|
|
102
|
78
|
echo apksigner verify succeeded
|
|
|
79
|
+
|
|
|
80
|
+ mv -f "${SIGNEDAPK}" "${OUTPUTAPK}"
|
|
|
81
|
+ echo ${OUTPUTAPK} signed
|
|
103
|
82
|
}
|
|
104
|
83
|
|
|
105
|
84
|
setup_build_tools
|