apksigner fails to sign when keystore and key passwords differ and apksigner isn't explicitly told how to obtain the passwords [37134986]

Fixed

Bug

Status Update

No update yet.

Description

kl...@google.com

created issue #1

Feb 3, 2017 09:24PM

When apksigner is invoked without explicitly specifying how to obtain the keystore and key password, apksigner prompts for keystore password and uses that as the key password as well, making it impossible to use keystores where the keystore password differs from key password. A workaround is to explicitly tell apksigner how to obtain these two passwords. For example, --ks-pass=stdin --key-pass=stdin will force apksigner to prompt for keystore password and then prompt for key password.

STEPS TO REPRODUCE
1. Create a keystore where the keystore password is different from key password.
2. apksigner sign --ks keystore.jks some.apk

EXPECTED RESULTS
apksigner prompts for keystore password, then prompts for key password

ACTUAL RESULTS
apksigner prompts for keystore password, then fails claiming that it can't obtain the key because "Wrong password?"

Comments

kl...@google.com <kl...@google.com> #2Feb 15, 2017 08:36PM

Is this fixed? I'm still seeing this issue with AGP 8.1.0-beta01 + Gradle 8.1

kl...@google.com <kl...@google.com> #3Mar 7, 2017 05:28AM

The fix has not been landed.

kl...@google.com <kl...@google.com> #4Apr 24, 2017 06:23PM

Due to this bug in CI we hit configuration cache invalidation 100% of the time. Can we make sure the fix lands soon? And especially before 8.1.0 stable.

cb...@google.com <cb...@google.com> Apr 24, 2017 06:24PM

Marked as fixed.

ba...@gmail.com <ba...@gmail.com> #5May 7, 2017 02:23AM

I cc'ed you on the CL which should be landed this week.

pr...@gmail.com <pr...@gmail.com> #6May 24, 2017 04:12PM

Aurimas, is this 8.1 blocking for Androidx? If not, feel free to remove the "Blocking release" label.

82...@gmail.com <82...@gmail.com> #7Jan 4, 2019 06:15PM

cherry pick to G is landed.