1

What is the official source for apksigner as referenced e.g. in this answer? People are citing Android Studio, Android SDK Build Tools/Platform Tools/Command Line Tools etc. (as well as some shady archives on Google Drive), but non of these contain the program. I've downloaded, installed and searched them all.

Alternatively, what is the official source for Android SDK Build Tools 24.0.3, which allegedly contains the apksigner?

I've found an apksigner.jar and apksigner.bat inside a private Google repository, but running

apksigner verify --verbose --print-certs <APK file>
apksigner.bat verify --verbose --print-certs <APK file>
apksigner.jar verify --verbose --print-certs <APK file>

doesn't work (no output). This is the content of said batch file apksigner.bat:

@echo off
REM Copyright (C) 2016 The Android Open Source Project
REM
REM Licensed under the Apache License, Version 2.0 (the "License");
REM you may not use this file except in compliance with the License.
REM You may obtain a copy of the License at
REM
REM     http://www.apache.org/licenses/LICENSE-2.0
REM
REM Unless required by applicable law or agreed to in writing, software
REM distributed under the License is distributed on an "AS IS" BASIS,
REM WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
REM See the License for the specific language governing permissions and
REM limitations under the License.

REM don't modify the caller's environment setlocal

REM Locate apksigner.jar in the directory where apksigner.bat was found and start it.

REM Set up prog to be the path of this script, including following symlinks, REM and set up progdir to be the fully-qualified pathname of its directory. set prog=%~f0

rem Check we have a valid Java.exe in the path. set java_exe= if exist "%~dp0..\tools\lib\find_java.bat" call "%~dp0..\tools\lib\find_java.bat" if exist "%~dp0....\tools\lib\find_java.bat" call "%~dp0....\tools\lib\find_java.bat" if not defined java_exe goto :EOF

set jarfile=apksigner.jar set "frameworkdir=%~dp0" rem frameworkdir must not end with a dir sep. set "frameworkdir=%frameworkdir:~0,-1%"

if exist "%frameworkdir%%jarfile%" goto JarFileOk set "frameworkdir=%~dp0lib"

if exist "%frameworkdir%%jarfile%" goto JarFileOk set "frameworkdir=%~dp0..\framework"

:JarFileOk

set "jarpath=%frameworkdir%%jarfile%"

set javaOpts= set args=

REM By default, give apksigner a max heap size of 1 gig and a stack size of 1meg. rem This can be overridden by using "-JXmx..." and "-JXss..." options below. set defaultXmx=-Xmx1024M set defaultXss=-Xss1m

REM Capture all arguments that are not -J options. REM Note that when reading the input arguments with %1, the cmd.exe REM automagically converts --name=value arguments into 2 arguments "--name" REM followed by "value". apksigner has been changed to know how to deal with that. set params=

:firstArg if [%1]==[] goto endArgs set a=%~1

if [%defaultXmx%]==[] goto notXmx
if %a:~0,5% NEQ -JXmx goto notXmx
    set defaultXmx=
:notXmx

if [%defaultXss%]==[] goto notXss
if %a:~0,5% NEQ -JXss goto notXss
    set defaultXss=
:notXss

if %a:~0,2% NEQ -J goto notJ
    set javaOpts=%javaOpts% -%a:~2%
    shift /1
    goto firstArg

:notJ
set params=%params% %1
shift /1
goto firstArg

:endArgs

set javaOpts=%javaOpts% %defaultXmx% %defaultXss% call "%java_exe%" %javaOpts% -Djava.ext.dirs="%frameworkdir%" -jar "%jarpath%" %params%

UPDATE: As suggested, I've now tried apksigner from Android Build Tools. Here is the output:

Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=Unknown, OU=Unknown, O=Fiducia IT AG, L=Unknown, ST
=Unknown, C=DE
Signer #1 certificate SHA-256 digest: 53a6afa8f0d219bba2fe84154f256ecec85b34175f
fee5b7387fda0afcc12605
Signer #1 certificate SHA-1 digest: addb5ed43a27660e41acb1d39e85ddd7b9c9807c
Signer #1 certificate MD5 digest: 1be8c130e83eb6b36e4aff93bcdd1b28
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: 671eafb570fa9e82cb7a8d5c435dad3d86990a09d5b
20f41b42e3152b3cd5a6a
Signer #1 public key SHA-1 digest: c021e779e6086e20a7c60b05a0c30b94c59c83ba
Signer #1 public key MD5 digest: d42dc7a6bcb0ace30d8ac316bc321c9c
WARNING: META-INF/androidx.navigation_navigation-fragment.version not protected
by signature. Unauthorized modifications to this JAR entry will not be detected.
 Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-camera2.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.customview_customview.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/services/ya.k not protected by signature. Unauthorized modific
ations to this JAR entry will not be detected. Delete or move the entry outside
of META-INF/.
WARNING: META-INF/androidx.room_room-runtime.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-lifecycle.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.browser_browser.version not protected by signature. U
nauthorized modifications to this JAR entry will not be detected. Delete or move
 the entry outside of META-INF/.
WARNING: META-INF/com.google.android.material_material.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.savedstate_savedstate-ktx.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.activity_activity-ktx.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_play_services.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.slidingpanelayout_slidingpanelayout.version not prote
cted by signature. Unauthorized modifications to this JAR entry will not be dete
cted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.dynamicanimation_dynamicanimation.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.exifinterface_exifinterface.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite-ktx.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-extensions.version not protected
by signature. Unauthorized modifications to this JAR entry will not be detected.
 Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.versionedparcelable_versionedparcelable.version not p
rotected by signature. Unauthorized modifications to this JAR entry will not be
detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-ktx.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.preference_preference-ktx.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.preference_preference.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-ui.version not protected by sig
nature. Unauthorized modifications to this JAR entry will not be detected. Delet
e or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-runtime.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.room_room-ktx.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.appcompat_appcompat-resources.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.appcompat_appcompat.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-runtime.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-runtime-ktx.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.window_window.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.cursoradapter_cursoradapter.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.savedstate_savedstate.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.fragment_fragment.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.vectordrawable_vectordrawable.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.fragment_fragment-ktx.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite-framework.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.core_core.version not protected by signature. Unautho
rized modifications to this JAR entry will not be detected. Delete or move the e
ntry outside of META-INF/.
WARNING: META-INF/androidx.vectordrawable_vectordrawable-animated.version not pr
otected by signature. Unauthorized modifications to this JAR entry will not be d
etected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.version n
ot protected by signature. Unauthorized modifications to this JAR entry will not
 be detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel-savedstate.version not
protected by signature. Unauthorized modifications to this JAR entry will not be
 detected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.security_security-crypto.version not protected by sig
nature. Unauthorized modifications to this JAR entry will not be detected. Delet
e or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-common-ktx.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.biometric_biometric.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-core.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-common.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_android.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.legacy_legacy-support-core-utils.version not protecte
d by signature. Unauthorized modifications to this JAR entry will not be detecte
d. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.viewpager2_viewpager2.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.transition_transition.version not protected by signat
ure. Unauthorized modifications to this JAR entry will not be detected. Delete o
r move the entry outside of META-INF/.
WARNING: META-INF/androidx.print_print.version not protected by signature. Unaut
horized modifications to this JAR entry will not be detected. Delete or move the
 entry outside of META-INF/.
WARNING: META-INF/androidx.documentfile_documentfile.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.core_core-ktx.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.emoji2_emoji2-views-helper.version not protected by s
ignature. Unauthorized modifications to this JAR entry will not be detected. Del
ete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.recyclerview_recyclerview.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.tracing_tracing.version not protected by signature. U
nauthorized modifications to this JAR entry will not be detected. Delete or move
 the entry outside of META-INF/.
WARNING: META-INF/androidx.startup_startup-runtime.version not protected by sign
ature. Unauthorized modifications to this JAR entry will not be detected. Delete
 or move the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-fragment-ktx.version not protec
ted by signature. Unauthorized modifications to this JAR entry will not be detec
ted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-livedata-core-ktx.version not pro
tected by signature. Unauthorized modifications to this JAR entry will not be de
tected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.arch.core_core-runtime.version not protected by signa
ture. Unauthorized modifications to this JAR entry will not be detected. Delete
or move the entry outside of META-INF/.
WARNING: META-INF/androidx.emoji2_emoji2.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel-ktx.version not protect
ed by signature. Unauthorized modifications to this JAR entry will not be detect
ed. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-runtime-ktx.version not protected
 by signature. Unauthorized modifications to this JAR entry will not be detected
. Delete or move the entry outside of META-INF/.
WARNING: META-INF/services/ta.z not protected by signature. Unauthorized modific
ations to this JAR entry will not be detected. Delete or move the entry outside
of META-INF/.
WARNING: META-INF/INDEX.LIST not protected by signature. Unauthorized modificati
ons to this JAR entry will not be detected. Delete or move the entry outside of
META-INF/.
WARNING: META-INF/androidx.activity_activity.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.drawerlayout_drawerlayout.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/androidx.interpolator_interpolator.version not protected by si
gnature. Unauthorized modifications to this JAR entry will not be detected. Dele
te or move the entry outside of META-INF/.
WARNING: META-INF/com/android/build/gradle/app-metadata.properties not protected
 by signature. Unauthorized modifications to this JAR entry will not be detected
. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-viewmodel.version not protected b
y signature. Unauthorized modifications to this JAR entry will not be detected.
Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-core.version not protected by signature
. Unauthorized modifications to this JAR entry will not be detected. Delete or m
ove the entry outside of META-INF/.
WARNING: META-INF/androidx.swiperefreshlayout_swiperefreshlayout.version not pro
tected by signature. Unauthorized modifications to this JAR entry will not be de
tected. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-service.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.lifecycle_lifecycle-process.version not protected by
signature. Unauthorized modifications to this JAR entry will not be detected. De
lete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.loader_loader.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.viewpager_viewpager.version not protected by signatur
e. Unauthorized modifications to this JAR entry will not be detected. Delete or
move the entry outside of META-INF/.
WARNING: META-INF/androidx.cardview_cardview.version not protected by signature.
 Unauthorized modifications to this JAR entry will not be detected. Delete or mo
ve the entry outside of META-INF/.
WARNING: META-INF/androidx.navigation_navigation-ui-ktx.version not protected by
 signature. Unauthorized modifications to this JAR entry will not be detected. D
elete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.coordinatorlayout_coordinatorlayout.version not prote
cted by signature. Unauthorized modifications to this JAR entry will not be dete
cted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/kotlinx_coroutines_core.version not protected by signature. Un
authorized modifications to this JAR entry will not be detected. Delete or move
the entry outside of META-INF/.
WARNING: META-INF/androidx.camera_camera-view.version not protected by signature
. Unauthorized modifications to this JAR entry will not be detected. Delete or m
ove the entry outside of META-INF/.
WARNING: META-INF/androidx.annotation_annotation-experimental.version not protec
ted by signature. Unauthorized modifications to this JAR entry will not be detec
ted. Delete or move the entry outside of META-INF/.
WARNING: META-INF/androidx.sqlite_sqlite.version not protected by signature. Una
uthorized modifications to this JAR entry will not be detected. Delete or move t
he entry outside of META-INF/.
WARNING: META-INF/androidx.core_core-splashscreen.version not protected by signa
ture. Unauthorized modifications to this JAR entry will not be detected. Delete
or move the entry outside of META-INF/.

What is the meaning?

srhslvmn
  • 289
  • 1
  • 11
  • You forgot to include the error message(s) that you get when you try to execute apksigner. Without them it is difficult to guess what is going wrong. jar files have to be started by the command java -jar apksigner.jar arguments_to_apksigner. The recommended Java version is at the moment 11. – Robert Jul 06 '22 at 06:58
  • 1
    Cross-posted from Stack Overflow: https://stackoverflow.com/q/72876327/2821954 – Andrew T. Jul 06 '22 at 07:38
  • @Robert But that is *precisely* the issue: There is no error message from apksigner, just a blank line in the CLI – srhslvmn Jul 06 '22 at 16:58

1 Answers1

2

I have extended my original answer by a section how to get apksigner without installing Android SDK or Android Studio:

Apksigner is a Java tool and Google provides for start-up a batch file apksigner.bat(Windows) respectively a shell script apksigner.sh (Linux, MacOS). As mentioned before it is included in each build-tools version of Android SDK. If you don't want to install the whole Android SDK (with or without Android Studio) you can directly download build tools and extract and execute apksigner. Links to the all build-tools are provided on this website (the provided links go to the original Google download locations).

I prefer apksigner from build-tools v30:

You only need the file lib/apksigner.jar from the archive (thus it doesn't matter for which platform you download the build-tools package). Extract it and open a shell in the folder. Then execute java -jar apksigner.jar. To execute you need Java 9 or higher (best one of the Java LTS versions 11 or 17 - e.g. the Eclipse Adoptium OpenJDK release https://adoptium.net).

Using this direct approach the command to execute apksigner is

java -jar apksigner.jar verify --verbose --print-certs "Signal-website-universal-release-4.49.13.apk"
Robert
  • 20,025
  • 6
  • 47
  • 66
  • ...that is a much more rounded answer now. But it leaves one important aspect unanswered: What about *official* sources? Is the Google repository that you linked an official source, i.e. can it be trusted? If so, on what basis? On first glance, it could be someone's private Google drive with malware-loaden files. And we're lacking an official source, there is no way for us (at the moment) to verify the authenticity of any of those files from that Google drive. Remember that this question relates to software authentication issues - you can't authenticate software using compromised tools – srhslvmn Jul 06 '22 at 17:04
  • (The unspoken assumption here, of course, is to consider Google Inc. itself a trusted source - which it is not, as exhaustively proven. So strictly speaking, we're still talking about relative security with the metric "authenticity of software relative to its original".) – srhslvmn Jul 06 '22 at 17:10
  • 2
    @kerstin92 Please have a look into the URLs they are dl most likely for download so the host should be unrelated to Google Drive. As far as I know these are the same URLs use by Android SDK for download. If you are unsure about authenticity then please just use the official Android SDK with Android Studio download link from Google web pages. – Robert Jul 06 '22 at 18:28
  • So these are official Google repositories? – srhslvmn Jul 06 '22 at 19:46
  • "If you are unsure about authenticity then please just use the official Android SDK with Android Studio download link from Google web pages." - Android Studio doesn't contain apksigner. If you think it does, you may point towards the exact folder – srhslvmn Jul 06 '22 at 19:46
  • 2
    @kerstin92 Android Studio itself doesn't contain apksigner, but it should contain the official Android SDK Manager that users can use to download any version of build tools from there. The download location will be the same as the location of the Android SDK Manager. Also, yes, dl.google.com is the official Google repo; the linked URL is the same as the one used by the Android SDK Manager. – Andrew T. Jul 07 '22 at 03:22
  • 2
    @kerstin92 If you download and install Android Studio at the end of the installation Android Studio will start, you have to accept the Android SDK license and automatically build-tools for API 33 is downloaded. If you modify the installation and don't start Android Studio at the end the installation is incomplete and thus you don't have apksigner. After a full installation Apksigner can be found here: C:\Users\%username%\AppData\Local\Android\Sdk\build-tools\33.0.0\apksigner.bat – Robert Jul 07 '22 at 07:10
  • @Robert That is super weird. I ran the installation with all options enabled, but didn't immediately start Android Studio but closed the installer first. Does that mean that Build Tools only get installed if Android Studio is immediately launched after installation, directly from the installer, and never if the installer is closed (without any notification indicating this and no option to install it afterwards)? That would be some truly bizarre behavior – srhslvmn Jul 07 '22 at 17:13
  • @kerstin92 I assume that build-tools are always automatically installed on first start of Android Studio. As Andrew already mentioned you can install all SDK components at any time using the Android Studio integrated SDK manager. – Robert Jul 07 '22 at 17:55