Manually signing an Android app bundle(aab)

Unity Engine
,
1

Environment :

  • Unity 2017.4.27f1

  • JDK 8u221

  • Android SDK

  • build-tools;27.0.3 | 27.0.3 | Android SDK Build-Tools 27.0.3 | build-tools\27.0.3\

  • build-tools;28.0.0-rc1 | 28.0.0 rc1 | Android SDK Build-Tools 28-rc1 | build-tools\28.0.0-rc1

  • platform-tools | 27.0.1 | Android SDK Platform-Tools | platform-tools

  • platforms;android-27 | 1 | Android SDK Platform 27 | platforms\android-27

  • tools | 26.0.1 | Android SDK Tools 26.0.1 | tools

Hi there, I’m trying to automate my android build process, and I just can’t seem to get past the app signing part.

I already have a test track on Google Play Console setup, and I’ve already had builds uploaded that works fine.

Now I’ve just got a fresh jenkins setup on a macbook, and I wrote build scripts for it, which seems to be working, now comes the signing part. Obviously I don’t feel too comfortable having my keystore and my passphrases committed into my repo, so I try to sign the apk in a shell script after build.

Since Unity can’t build an unsigned aab, I unzip it, removed the META-INF directory, zip it back up, and ran:
jarsigner myapp.aab -keystore mykey -storepass mypassword
I tried uploading that, and Google told me that I “uploaded an APK with an invalid signature”, so I ran:
jarsigner -verify myapp.aab -keystore mykey
who told me that the aab is indeed verified and signed with my key. So I did some googling, and thought maybe it was because my aab wasn’t zip aligned, so I zipaligned it, and it wasn’t that, I still get the same error from google play console, now I am at a loss.

I briefly thought about exporting my build and then build it in Android Studio, but I’m new to jenkins and automation in general and I kinda wanna keep things simple, or at least relatively simple.

So what is the correct way of unsigning and resigning an aab?
And are there any way to build a truly unsigned aab in the first place?

Thanks!

2

I was looking for the same question and this is what I found:

  1. Remove the already singing if any (the meta info folder contain that information and the .aab is just a zip file in the end):
zip -d myApp.aab META-INF/\*
  1. Sign the .aab file with SHA256 (the old v1 signing of apk was SHA1):
jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 -keystore myKeystore.jks myApp.aab mykeystoreAlias -storepass mystorepassword -keypass mykeypass

That did allow me to resign the .aab with different signing option.

2 Likes