標籤文章彙整：key rotation

android apk signing rotation

Posted on by

I did below key rotation on Android 13 emulator and Pixel 5 (Android 10 Emulator not work)

create 3 key store owen1.jks, owen2.jks and owen3.jks

keytool -keystore owen1.jks -genkey -alias owen1 -keyalg rsa
keytool -keystore owen2.jks -genkey -alias owen2 -keyalg rsa
keytool -keystore owen3.jks -genkey -alias owen3 -keyalg rsa

create rotation lineage file

apksigner rotate --out SigningCertificateLineage.owen1.owen2 --old-signer --ks owen1.jks --new-signer --ks owen2.jks
apksigner rotate --out SigningCertificateLineage.owen2.owen3 --old-signer --ks owen2.jks --new-signer --ks owen3.jks

sign serial.apk with each jks

apksigner sign --ks owen1.jks --in serial.apk --out serial.SignedOwen1.apk
apksigner sign --ks owen2.jks --in serial.apk --out serial.SignedOwen2.apk
apksigner sign --ks owen3.jks --in serial.apk --out serial.SignedOwen3.apk

sign serial.apk with rotation data

apksigner sign --ks owen1.jks --next-signer --ks owen2.jks --lineage SigningCertificateLineage.owen1.owen2 --in serial.apk --out serial.rotate.owen1.owen2.apk
apksigner sign --ks owen2.jks --next-signer --ks owen3.jks --lineage SigningCertificateLineage.owen2.owen3 --in serial.apk --out serial.rotate.owen2.owen3.apk

so let’s try the rotation as below steps

[0] 12/29 15:41:51 owenwen@dell:~/jks$ adb install serial.SignedOwen1.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 931 ms

[0] 12/29 15:42:42 owenwen@dell:~/jks$ adb install serial.rotate.owen1.owen2.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 629 ms

[0] 12/29 15:42:52 owenwen@dell:~/jks$ adb install serial.SignedOwen2.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 467 ms

[0] 12/29 15:42:59 owenwen@dell:~/jks$ adb install serial.rotate.owen2.owen3.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 570 ms

[0] 12/29 15:43:05 owenwen@dell:~/jks$ adb install serial.SignedOwen3.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 728 ms

[0] 12/29 15:43:10 owenwen@dell:~/jks$ adb install serial.SignedOwen1.apk
Performing Incremental Install
Serving...
Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Existing package com.sample.app signatures do not match newer version; ignoring!]
Performing Streamed Install
adb: failed to install serial.SignedOwen1.apk: Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Existing package com.sample.app signatures do not match newer version; ignoring!]

[1] 12/29 15:43:14 owenwen@dell:~/jks$ adb shell getprop | grep fingerprint
[ro.bootimage.build.fingerprint]: [google/redfin/redfin:13/TQ1A.221205.011/9244662:user/release-keys]