diff --git a/proguard-rules.pro b/proguard-rules.pro
index e427d6ff8..6002ebcc6 100644
--- a/proguard-rules.pro
+++ b/proguard-rules.pro
@@ -20,7 +20,9 @@
 -keepnames class ** { *; }
 
 # BouncyCastle
--keep class org.bouncycastle.jcajce.provider.** { *; }
+-keep class org.bouncycastle.jcajce.provider.asymmetric.rsa.**SHA1** { *; }
+-keep class org.bouncycastle.jcajce.provider.asymmetric.RSA** { *; }
+-keep class org.bouncycastle.jcajce.provider.digest.SHA1** { *; }
 -dontwarn javax.naming.**
 
 # Gson
diff --git a/src/main/java/com/topjohnwu/magisk/utils/ZipUtils.java b/src/main/java/com/topjohnwu/magisk/utils/ZipUtils.java
index bdece8192..190495e21 100644
--- a/src/main/java/com/topjohnwu/magisk/utils/ZipUtils.java
+++ b/src/main/java/com/topjohnwu/magisk/utils/ZipUtils.java
@@ -7,10 +7,12 @@ import com.topjohnwu.crypto.SignAPK;
 import com.topjohnwu.magisk.MagiskManager;
 
 import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.InputStream;
+import java.io.OutputStream;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -56,14 +58,24 @@ public class ZipUtils {
     }
 
     public static void signZip(InputStream is, File output, boolean minSign) throws Exception {
-        signZip(new JarMap(is, false), output, minSign);
+        try (JarMap map = new JarMap(is, false)) {
+            signZip(map, output, minSign);
+        }
     }
 
     public static void signZip(File input, File output, boolean minSign) throws Exception {
-        signZip(new JarMap(input, false), output, minSign);
+        try (JarMap map = new JarMap(input, false)) {
+            signZip(map, output, minSign);
+        }
     }
 
     public static void signZip(JarMap input, File output, boolean minSign) throws Exception {
+        try (BufferedOutputStream out = new BufferedOutputStream(new FileOutputStream(output))) {
+            signZip(input, out, minSign);
+        }
+    }
+
+    public static void signZip(JarMap input, OutputStream output, boolean minSign) throws Exception {
         AssetManager assets = MagiskManager.get().getAssets();
         SignAPK.signZip(
                 assets.open(Const.PUBLIC_KEY_NAME), assets.open(Const.PRIVATE_KEY_NAME),