I’m creating a software using AIR that will guide the user through a few steps, to publish an android application (APK file).
The way I am doing this, is that the APK file is already compiled, and all I need to do is replace an XML file in the package, and that will change the behaviour of the application. My big problem now, is that unpacking the apk file, and doing any tiny text edit, and then packing it again, breaks the signature and prevents the application from running on any device, giving a message that the signature is incorrect.
How can I solve this? I want to safely open the APK, write something in a text file, and close it again. Note that this operation will be done on the user’s computer (after he purchases our application) so we’re look for a command-line tool with no special requirements like JDK.
The problem is that once you modify the APK the original signature is no longer valid. You generally can not edit the package and preserve the existing signature you need to modify it first and then sign the APK again with your own signing key.
For an automated workflow you would want an APK tool that can unpack/repack the file and then sign the modified APK. The important part is making sure the signing key is handled securely since anyone who gets it could potentially sign modified versions of your app.
It is a bit like Letter Boxed: the process looks simple on the surface, but one small change can affect the whole solution. If you are wondering how does Letter Boxed work you connect letters from different sides of the box to form words while trying to use every letter efficiently.
