Titanium JIRA Archive
Titanium SDK/CLI (TIMOB)

[TIMOB-24517] Android: Add APK signature scheme v2 support

GitHub Issuen/a
TypeNew Feature
PriorityLow
StatusClosed
ResolutionFixed
Resolution Date2020-01-10T15:19:06.000+0000
Affected Version/sn/a
Fix Version/sRelease 9.0.0
ComponentsAndroid
Labelsandroid, apk, sign
ReporterEric Merriman
AssigneeJoshua Quick
Created2017-03-20T20:26:14.000+0000
Updated2020-01-10T15:19:06.000+0000

Description

*Summary:* Titanium currently only supports signing with v1 signature scheme. We should add v2 signing support, which can be verified on Android 7.0 and higher. https://source.android.com/security/apksigning/v2 Note that an APK can be signed by both v1 and v2 at the same time. We still need v1 support for Android OS versions older than 7.0. *Note 1:* This can be signed manually via Android SDK build tool "apksigner". https://developer.android.com/studio/command-line/apksigner *Note 2:* The "gradle" build system automatically signs all built APKs with both v1 and v2. When we add "gradle" build support, then we get v2 signing for free. *Testing:* You can verify which versioning schemes an APK has been signed with at the command line by doing the following...

Open the Mac "Terminal".

CD to directory: ~/Library/Android/sdk/build-tools/<NewestVersion>

Enter: ./apksigner verify -v <PathToApk>

The tool will output something like the below. Make sure v2 is flagged true.

Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false

Comments

  1. Hans Knöchel 2017-03-20

    TIMOB-23803 ?
  2. Gary Mathews 2017-06-04

    Using build-tools 24+ using https://developer.android.com/studio/command-line/apksigner.html will automatically use v2 signing when appropriate.
       apksigner sign --ks this.keystore --ks-pass pass:this.keystoreStorePassword app.apk
       
  3. Lokesh Choudhary 2019-12-19

    Master: https://github.com/appcelerator/titanium_mobile/pull/11339
  4. Lokesh Choudhary 2019-12-20

    FR Passed. PR Merged.
  5. Samir Mohammed 2020-01-10

    Closing ticket, New feaure verified in SDK Version 9.0.0.v20200109153329. Test and other information can be found at: https://github.com/appcelerator/titanium_mobile/pull/11339

JSON Source