How to Sign your Android App

Android requires that all apps be digitally signed by the developer. The process for doing so is easy, but a little cryptic. The excerpt below from Building Android Apps with HTML, CSS, and Javascript will help guide you through the process.

Launch the Terminal application and navigate into the KiloGap (or whichever directory your application is stored in) directory:

cd ~/Desktop/KiloGap
Compile the app in release mode:

ant release

You’ll see a page or so of output scroll by, ending with BUILD SUCCESSFUL. An unsigned binary named Kilo-unsigned.apk will now be sitting in the ~/Desktop/KiloGap/bin/ directory.

The ant release command creates an unsigned binary named Kilo-unsigned.apk in the ~/Desktop/KiloGap/bin/ directory
Create a private key:

keytool -genkey -v -keystore keystore -alias alias -keyalg RSA -validity days

This command is interactive and will ask you a bunch of questions. Mine looks like this:

JSC-MBP:KiloGap jstark$ keytool -genkey -v -keystore myAndroidKey.keystore \ -alias myAndroidKeyAlias -keyalg RSA -validity 10000 Enter keystore password: Re-enter new password: What is your first and last name? [Unknown]: Jonathan Stark What is the name of your organizational unit? [Unknown]: What is the name of your organization? [Unknown]: Jonathan Stark Consulting What is the name of your City or Locality? [Unknown]: Providence What is the name of your State or Province? [Unknown]: RI What is the two-letter country code for this unit? [Unknown]: US Is CN=Jonathan Stark, OU=Unknown, O=Jonathan Stark Consulting, L=Providence, ST=RI, C=US correct? [no]: yes Generating 1,024 bit RSA key pair and self-signed certificate (SHA1withRSA) with a validity of 10,000 days for: CN=Jonathan Stark, OU=Unknown, O=Jonathan Stark Consulting, L=Providence, ST=RI, C=US Enter key password for <myAndroidKeyAlias> (RETURN if same as keystore password): [Storing myAndroidKey.keystore]

When the process completes, you should see myAndroidKey.keystore created in the ~/Desktop/KiloGap directory. If you’d like to use this keystore for other apps in the future, you might want to move the keystore file to a more central location.

The keytool command will generate a keystore file named myAndroidKey.keystore in the KiloGap directory

Warning: Do not lose this password. If you forget your keystore password, you won’t be able to update your app once it’s published.
Sign your app with the key you just created:

jarsigner -verbose -keystore myAndroidKey.keystore ./bin/Kilo-unsigned.apk myAndroidKeyAlias

When you run this command, you’ll be asked for your keystore password.
Align the .apk file:

zipalign -v 4 ./bin/Kilo-unsigned.apk ./bin/Kilo.apk

You’ll see a page or so of output scroll by, ending with “Verification successful.” A signed binary named Kilo.apk will now be sitting in the ~/Desktop/KiloGap/bin/ directory. This .apk file is your completed app!