Thursday, March 27, 2014

Signing and Verifying APKs

Signing applications with a key has become an essential part in the process for mobile app developers. It's like a signature for the app.

 To know how to sign the applications, visit the android developer reference here.

Now let us see how to verify whether the app ( android build.. APK) is signed or not and with what key.

  As mentioned already in one of my posts that describes how to install APK programmatically, an APK file is a kind of jar file.

 Go to command prompt and type the following and replace <path> and <app_name> accordingly.
   jarsigner -verify <path>/<app_name>.apk

 command. If you see "jar verified" message, it means it is a signed one.

 To know more about the key details, type the below
   jarsigner -verify -verbose -certs <path>/<app_name>.apk

  If you see "CN=Android Debug", this means the .apk was signed with the debug key generated by the Android SDK(means it is unsigned), else you will find something for CN.



References