apksigner issue with AWS KMS

[shyamsundar-toast]

HI,

Looking for some help to sign apksigner using AWS KMS.

Here is my command.
java -cp apksigner.jar:jsign-6.0.jar \ com.android.apksigner.ApkSignerTool sign \ --provider-class net.jsign.jca.JsignJcaProvider \ --provider-arg us-east-1 \ --ks NONE \ --ks-type AWS \ --ks-pass pass:"ASIA45MLNVHC7VXIACY5|JzVT/hyxszUiLOORcVVtOprZMwamxP2owZc729ac" \ --ks-key-alias aosp/apksigner \ --in ./test.apk \ --out ./test-signed.apk

I get the below error,

Error: Could not find or load main class com.android.apksigner.ApkSignerTool Caused by: java.lang.ClassNotFoundException: com.android.apksigner.ApkSignerTool

Is there any setup steps I am missing?
I just downloaded the jsign jar and tried to sign the apk. I also tried to copy the "apksigner" tool from android SDK in the same folder and it didn't help either.

Any help is much appreciated.

[ebourg]

Are you sure the APK Signer jar is named apksigner.jar and not something else?

[shyamsundar-toast]

Good point.

Verified it does have the class files
$ jar -tf apksigner.jar | grep ApkSignerTool com/android/apksigner/ApkSignerTool$1.class com/android/apksigner/ApkSignerTool$ProviderInstallSpec.class com/android/apksigner/ApkSignerTool.class

Does the command and parameters looks okay to you?

[ebourg]

Does java -jar apksigner.jar work?

[shyamsundar-toast]

Yes I verified the apksigner.jar works for signing the apks locally.
Also we tried it from a different setup and made some progress there.

Its related to parsing the certificate.

Failed to load signer "signer #1" java.lang.RuntimeException: Failed to load the certificate from kms_signing_pub_key.pem at net.jsign.KeyStoreType.lambda$getCertificateStore$0(KeyStoreType.java:672) at net.jsign.jca.AmazonSigningService.getCertificateChain(AmazonSigningService.java:151) at net.jsign.jca.SigningServiceKeyStore.engineGetCertificateChain(SigningServiceKeyStore.java:43) at java.base/java.security.KeyStore.getCertificateChain(KeyStore.java:1075) at net.jsign.jca.JsignJcaProvider$JsignJcaKeyStore.engineGetCertificateChain(JsignJcaProvider.java:141) at java.base/java.security.KeyStore.getCertificateChain(KeyStore.java:1075) at com.android.apksigner.SignerParams.loadPrivateKeyAndCertsFromKeyStore(SignerParams.java:359) at com.android.apksigner.SignerParams.loadPrivateKeyAndCerts(SignerParams.java:202) at com.android.apksigner.ApkSignerTool.getSignerConfig(ApkSignerTool.java:438) at com.android.apksigner.ApkSignerTool.sign(ApkSignerTool.java:353) at com.android.apksigner.ApkSignerTool.main(ApkSignerTool.java:92) Caused by: java.security.cert.CertificateException: Unable to initialize, java.io.IOException: Too short at java.base/sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:181) at java.base/sun.security.x509.X509CertImpl.newX509CertImpl(X509CertImpl.java:304) at java.base/sun.security.provider.X509Factory.parseX509orPKCS7Cert(X509Factory.java:471) at java.base/sun.security.provider.X509Factory.engineGenerateCertificates(X509Factory.java:356) at java.base/java.security.cert.CertificateFactory.generateCertificates(CertificateFactory.java:480) at net.jsign.CertificateUtils.loadCertificateChain(CertificateUtils.java:59) at net.jsign.KeyStoreType.lambda$getCertificateStore$0(KeyStoreType.java:670) ... 10 more Caused by: java.io.IOException: Too short at java.base/sun.security.util.DerValue.<init>(DerValue.java:361) at java.base/sun.security.util.DerInputStream.getDerValue(DerInputStream.java:109) at java.base/sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1767) at java.base/sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:178) ... 16 more

The PEM file I have is from KMS directly. Looks like the apksigner needs a certificate in X509 format.
Do you have any instructions on how to create the certs/keys that is compatible with KMS for apk signing?

Really appreciate your timely response. Thanks a lot!

[ebourg]

You can convert the certificate with openssl, see for example https://www.entrust.com/knowledgebase/ssl/how-do-i-convert-my-pem-certificate-to-a-der-certificate-format

[shyamsundar-toast]

Thanks for the suggestions. will try the above.