Develop Reference

How To Sign APK files? [duplicate]

I've decoded an APK with apktool (as the original source code was lost) so I could fix some issues with the layout xml files. I've then rebuilt it back up with apktool and when I tried to install it on my device (using adb: adb install appname.apk) it gave me this error:
[INSTALL_PARSE_FAILED_NO_CERTIFICATES]
the original apk however was signed by a keystore (on eclipse IDE), this one isn't, how can I sign it properly with it's original keystone file outside Eclipse!?

create a key using
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
then sign the apk using :
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name
check here for more info

Automated Process:
Use this tool (uses the new apksigner from Google):
https://github.com/patrickfav/uber-apk-signer
Disclaimer: Im the developer :)
Manual Process:
Step 1: Generate Keystore (only once)
You need to generate a keystore once and use it to sign your unsigned apk.
Use the keytool provided by the JDK found in %JAVA_HOME%/bin/
keytool -genkey -v -keystore my.keystore -keyalg RSA -keysize 2048 -validity 10000 -alias app
Step 2 or 4: Zipalign
zipalign which is a tool provided by the Android SDK found in e.g. %ANDROID_HOME%/sdk/build-tools/24.0.2/ is a mandatory optimization step if you want to upload the apk to the Play Store.
zipalign -p 4 my.apk my-aligned.apk
Note: when using the old jarsigner you need to zipalign AFTER signing. When using the new apksigner method you do it BEFORE signing (confusing, I know). Invoking zipalign before apksigner works fine because apksigner preserves APK alignment and compression (unlike jarsigner).
You can verify the alignment with
zipalign -c 4 my-aligned.apk
Step 3: Sign & Verify
Using build-tools 24.0.2 and older
Use jarsigner which, like the keytool, comes with the JDK distribution found in %JAVA_HOME%/bin/ and use it like so:
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my.keystore my-app.apk my_alias_name
and can be verified with
jarsigner -verify -verbose my_application.apk
Using build-tools 24.0.3 and newer
Android 7.0 introduces APK Signature Scheme v2, a new app-signing scheme that offers faster app install times and more protection against unauthorized alterations to APK files (See here and here for more details). Therefore, Google implemented their own apk signer called apksigner (duh!)
The script file can be found in %ANDROID_HOME%/sdk/build-tools/24.0.3/ (the .jar is in the /lib subfolder). Use it like this
apksigner sign --ks-key-alias alias_name --ks my.keystore my-app.apk
and can be verified with
apksigner verify my-app.apk
The official documentation can be found here.

fastest way is by signing with the debug keystore:
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore ~/.android/debug.keystore app.apk androiddebugkey -storepass android
or on Windows:
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore %USERPROFILE%/.android/debug.keystore test.apk androiddebugkey -storepass android

You use jarsigner to sign APK's. You don't have to sign with the original keystore, just generate a new one. Read up on the details: http://developer.android.com/guide/publishing/app-signing.html

For those of you who don't want to create a bat file to edit for every project, or dont want to remember all the commands associated with the keytools and jarsigner programs and just want to get it done in one process use this program:
http://lukealderton.com/projects/programs/android-apk-signer-aligner.aspx
I built it because I was fed up with the lengthy process of having to type all the file locations every time.
This program can save your configuration so the next time you start it, you just need to hit Generate an it will handle it for you. That's it.
No install required, it's completely portable and saves its configurations in a CSV in the same folder.

Updated answer
Check https://shatter-box.com/knowledgebase/android-apk-signing-tool-apk-signer/
Old answer
check apk-signer a nice way to sign your app

adb - [INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION]

When changing files in an extracted APK, I re-zip it, change the extension to .apk, and install like this:
$ adb install CustomAPK.apk
2831 KB/s (41896599 bytes in 14.450s)
pkg: /data/local/tmp/CustomAPK.apk
Failure [INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION]
What is this from?

Generate a key and sign the apk: Android Developer Website
Signing Your App Manually
You do not need Android Studio to sign your app. You can sign your app from the command line using standard tools from the Android SDK and the JDK. To sign an app in release mode from the command line:
Generate a private key using keytool. For example:
$ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
This example prompts you for passwords for the keystore and key, and to provide the Distinguished Name fields for your key. It then generates the keystore as a file called my-release-key.keystore. The keystore contains a single key, valid for 10000 days. The alias is a name that you will use later when signing your app.
Compile your app in release mode to obtain an unsigned APK.
Sign your app with your private key using jarsigner:
$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name
This example prompts you for passwords for the keystore and key. It then modifies the APK in-place to sign it. Note that you can sign an APK multiple times with different keys.
Verify that your APK is signed. For example:
$ jarsigner -verify -verbose -certs my_application.apk
Align the final APK package using zipalign.
$ zipalign -v 4 your_project_name-unaligned.apk your_project_name.apk
zipalign ensures that all uncompressed data starts with a particular byte alignment relative to the start of the file, which reduces the amount of RAM consumed by an app.

INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION
for this Uninstall APP and click run button to fix this issue

Build the App, and then Run
solved mine

I only have apk file (not source code) how to sign and zip-align it?

I don't have source code only have .apk file and i want to sign and zip-align it to upload on play store.
How i can do this?

From official guide
Signing Your App Manually
You do not need Android Studio to sign your app. You can sign your app from the command line using standard tools from the Android SDK and the JDK. To sign an app in release mode from the command line:
Generate a private key using keytool. For example:
$ keytool -genkey -v -keystore my-release-key.keystore -alias
alias_name -keyalg RSA -keysize 2048 -validity 10000
This example prompts you for passwords for the keystore and key, and to provide the Distinguished Name fields for your key. It then generates the keystore as a file called my-release-key.keystore. The keystore contains a single key, valid for 10000 days. The alias is a name that you will use later when signing your app.
Compile your app in release mode to obtain an unsigned APK.
Sign your app with your private key using jarsigner:
$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name
This example prompts you for passwords for the keystore and key. It then modifies the APK in-place to sign it. Note that you can sign an APK multiple times with different keys.
4. Verify that your APK is signed. For example:
$ jarsigner -verify -verbose -certs my_application.apk
Align the final APK package using zipalign.
$ zipalign -v 4 your_project_name-unaligned.apk your_project_name.apk
zipalign ensures that all uncompressed data starts with a particular byte alignment relative to the start of the file, which reduces the amount of RAM consumed by an app.

Open an APK file on a Mac?

I just built an appp in phone gap build i'm trying to generate the keystore file,
Does anyone know how to open and sign an apk file in eclipse on a mac?
I'm thinking i'll have to run phonegap locally some how?
Cheers,

If you've built the APK outside of Eclipse, you can sign it on the command line using the Jarsigner tool, as described here in the Android developer documentation.
$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore
my_application.apk alias_name
Where my-release-key.keystore is the path to your keystore, my_application.apk is the path to your APK, and alias_name is the name of the alias you gave the release signing key in your keystore.
Depending on whether you set up a password on your keystore and the signing key within it, you may need to add the flags -storepass mystorepass and -keypass mykeypass.

Can I re-sign an .apk with a different certificate than what it came with?

If I have an apk can I remove the current signing and some how re-sign it with a different .keystore file and still have the application install?
Update: I managed to get it to work with Jorgesys' solution and where I messed up before was that I unzipped the .apk then rezipped it after removing the META-INF folder and changed the file extension back into .apk. What I should have done is simply opened it with winzip and delete the folder inside of winzip.

try this
1) Change the extension of your .apk to .zip
2) Open and remove the folder META-INF
3) Change the extension to .apk
4) Use the jarsigner and zipalign with your new keystore.
hope it helps

If you are looking for a quick simple solution, you can use Google's apksigner command line tool which is available in revision 24.0.3 and higher.
apksigner sign --ks release.jks application.apk
You can find more information about apksigner tool, at the developer Android site.
https://developer.android.com/studio/command-line/apksigner.html
Or, alternatively, you may use an open-source apk-resigner script
Open Source apk-resigner script https://github.com/onbiron/apk-resigner
All you have to do is, download the script and just type:
./signapk.sh application.apk keystore key-pass alias

Note if you use v2 signing schema (which you will automatically if you use build-tools 24.0.3+ in AS) you cannot just remove the META-INF folder from the APK since v2 adds its signing data to a zip meta block.
Google's new apksigner introduced in build-tools 24.03 (Android 7) is however able to resign APKs. You can just repeat the signing command to sign with a new keystore/cert (the old ones will be removed).
apksigner sign --ks keystore.jks signed_app.apk
Shameless plug: if you want a easier tool that can sign multiple apks and has better log output use: https://github.com/patrickfav/uber-apk-signer (uses Google's apksigner.jar in the background)

zip -d my_application.apk META-INF/\*
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name
zipalign -v 4 your_project_name-unaligned.apk your_project_name.apk

Signing for release: $1.apk -> $1_release.apk"
GeneralMills&GoogleApps#2012
Step 1: Removing any previous signing
Change the extension of your .apk to .zip
Open and delete the folder META-INF
Change the extension to .apk
Or
Command:
• zip [originalapk]
Example:
• zip "$1".apk -d
Step 2: Signing with release.keystore..
Command:
• jarsigner –verbose –keystore [keystorefile] –signedjar [unalignedapk] [originalapk] alias_name
Example:
• C:\Program Files\Java\jdk1.6.0_43\bin> jarsigner -verbose -keystore release.keystore -signedjar "$1"_unaligned.apk "$1".apk release
Step 3: Aligning
Command:
• zipalign -f 4 [unalignedapk] [releaseapk]
Example:
• C:\Users\G535940\Downloads\adt-bundle-windows-x86\adt-bundle-windows-x86\sdk\too
ls>zipalign -f 4 "$1"_unaligned.apk "$1"_release.apk
Step 4: Cleaning up
Command:
• rm 4 [unalignedapk]
Example:
• rm "$1"_unaligned.apk
Additional Commands might help:
To generate new key with keytool
keytool -genkey -alias -keystore
To list keys
keytool -list -keystore
Command to generate a keyhash for the Facebook features
Command:
• keytool -exportcert -alias alias_name -keystore [keystorefile] | openssl sha1 -binary | openssl base64
Example:
• C:\Program Files\Java\jdk1.6.0_43\bin>keytool -exportcert -alias release -keyst
ore release.keystore |opens l sha1 -binary | openssl base64
Note:
To sign our apks we have downgraded JDK from 1.7 to 1.6.0_43 update.
Reason:
As of JDK 7, the default signing algorithim has changed, requiring you to specify the signature and digest algorithims (-sigalg and -digestalg) when you sign an APK.
Command:
jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore [keystorefile]
[originalapk] alias_name

All the solutions above work. Just a note why it didn't work for you when you re-zipped:
Some of the files inside the .apk need to remain stored (compression at 0%). This is because Android will use memory mapping (mmap) to read the contents without unpacking into memory. Such files are .ogg and some of the icons.

Assuming your keys are stored in keys.keystore, you can run:
$ keytool -list -keystore keys.keystore
Your keystore contains 1 entry
your_key_alias, Jan 3, 2013, PrivateKeyEntry,
Certificate fingerprint (SHA1): 8C:C3:6A:DC:7E:B6:12:F1:4C:D5:EE:F1:AE:17:FB:90:89:73:50:53
to determine the alias of your key. Then run:
zip -d your_app.apk "META-INF/*"
jarsigner -verbose -keystore keys.keystore \
-sigalg MD5withRSA -digestalg SHA1 -sigfile CERT \
your_app.apk your_key_alias
to re-sign your_app.apk with the key named your_key_alias.
The extra -sigfile CERT option seems to be necessary as of JDK 8.