copy/extract/patch apk signatures
Project description
apksigcopier - copy/extract/patch apk signatures
apksigcopier
is a tool for copying APK signatures from a signed APK
to an unsigned one (in order to verify reproducible builds). Its
command-line tool offers three operations:
- copy signatures directly from a signed to an unsigned APK
- extract signatures from a signed APK to a directory
- patch previously extracted signatures onto an unsigned APK
Extract
$ mkdir meta
$ apksigcopier extract signed.apk meta
$ ls -1 meta
8BEA2A77.RSA
8BEA2A77.SF
APKSigningBlock
APKSigningBlockOffset
MANIFEST.MF
Patch
$ apksigcopier patch meta unsigned.apk out.apk
Copy (Extract & Patch)
$ apksigcopier copy signed.apk unsigned.apk out.apk
Python API
>>> from apksigcopier import do_extract, do_patch, do_copy, gen_dummy_key
>>> config = dict(apksigner_cmd=..., ...)
>>> do_extract(signed_apk, output_dir, v1_only=NO)
>>> do_patch(metadata_dir, unsigned_apk, output_apk, v1_only=NO,
... dummy_keystore=None, config=config)
>>> do_copy(signed_apk, unsigned_apk, output_apk, v1_only=NO,
... dummy_keystore=None, config=config)
>>> gen_dummy_key(keystore, alias="dummy", keyalg="RSA", keysize=4096,
... sigalg="SHA512withRSA", validity=10000,
... storepass="dummy-password", dname="CN=dummy",
... keytool_cmd=config["keytool_cmd"])
CAVEATS
Recent versions of the Android gradle plugin will use zipflinger --
which arranges the contents of the APK differently -- making
apksigcopier
fail to work when using --use-zip=yes
(the default is
no
). You can tell the plugin not to use zipflinger by setting
android.useNewApkCreator=false
in gradle.properties
.
Help
$ apksigcopier --help
Tab Completion
For Bash, add this to ~/.bashrc
:
eval "$(_APKSIGCOPIER_COMPLETE=source_bash apksigcopier)"
For Zsh, add this to ~/.zshrc
:
eval "$(_APKSIGCOPIER_COMPLETE=source_zsh apksigcopier)"
For Fish, add this to ~/.config/fish/completions/apksigcopier.fish
:
eval (env _APKSIGCOPIER_COMPLETE=source_fish apksigcopier)
Requirements
- Python >= 3.5 + click +
apksigner
.
Debian/Ubuntu
$ apt install python3-click apksigner
Installing
Using pip
$ pip install apksigcopier
NB: depending on your system you may need to use e.g. pip3 --user
instead of just pip
.
From git
NB: this installs the latest development version, not the latest release.
$ git clone https://github.com/obfusk/apksigcopier.git
$ cd apksigcopier
$ pip install -e .
NB: you may need to add e.g. ~/.local/bin
to your $PATH
in order
to run apksigcopier
.
To update to the latest development version:
$ cd apksigcopier
$ git pull --rebase
License
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for apksigcopier-0.3.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | bb271ec8fb97e06c4971cd547febf41ffb3f7eca547acf47a2cf4be9bc4b3e2e |
|
MD5 | 952c23e6ba27486c50f5d8c41d6814ed |
|
BLAKE2b-256 | a5435711b06ea9945d785b02fb90ae89e17ea37e143381f8f2b687d9dcbad9d5 |