Rename module

utils/.gitignore

@@ -0,0 +1 @@
+/build

utils/build.gradle

@@ -0,0 +1,38 @@
+apply plugin: 'java-library'
+
+apply plugin: 'com.github.johnrengelman.shadow'
+apply plugin: 'java'
+
+sourceCompatibility = "1.8"
+targetCompatibility = "1.8"
+
+jar {
+    manifest {
+        attributes 'Main-Class': 'com.topjohnwu.utils.ZipSigner'
+    }
+}
+
+shadowJar {
+    baseName = 'zipsigner'
+    classifier = null
+    version = 2.1
+}
+
+buildscript {
+    repositories {
+        jcenter()
+    }
+    dependencies {
+        classpath 'com.github.jengelman.gradle.plugins:shadow:2.0.2'
+    }
+}
+
+repositories {
+    jcenter()
+}
+
+dependencies {
+    implementation fileTree(include: ['*.jar'], dir: 'libs')
+    implementation 'org.bouncycastle:bcprov-jdk15on:1.58'
+    implementation 'org.bouncycastle:bcpkix-jdk15on:1.58'
+}

utils/src/main/java/com/topjohnwu/utils/ByteArrayStream.java

@@ -0,0 +1,34 @@
+package com.topjohnwu.utils;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+public class ByteArrayStream extends ByteArrayOutputStream {
+    public byte[] getBuf() {
+        return buf;
+    }
+    public synchronized void readFrom(InputStream is) {
+        readFrom(is, Integer.MAX_VALUE);
+    }
+    public synchronized void readFrom(InputStream is, int len) {
+        int read;
+        byte buffer[] = new byte[4096];
+        try {
+            while ((read = is.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
+                write(buffer, 0, read);
+                len -= read;
+            }
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+    }
+    public synchronized void writeTo(OutputStream out, int off, int len) throws IOException {
+        out.write(buf, off, len);
+    }
+    public ByteArrayInputStream getInputStream() {
+        return new ByteArrayInputStream(buf, 0, count);
+    }
+}

utils/src/main/java/com/topjohnwu/utils/CryptoUtils.java

@@ -0,0 +1,135 @@
+package com.topjohnwu.utils;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x9.X9ObjectIdentifiers;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.GeneralSecurityException;
+import java.security.Key;
+import java.security.KeyFactory;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.security.spec.ECPrivateKeySpec;
+import java.security.spec.ECPublicKeySpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.HashMap;
+import java.util.Map;
+
+class CryptoUtils {
+
+    private static final Map<String, String> ID_TO_ALG;
+    private static final Map<String, String> ALG_TO_ID;
+
+    static {
+        ID_TO_ALG = new HashMap<>();
+        ALG_TO_ID = new HashMap<>();
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA256.getId(), "SHA256withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA384.getId(), "SHA384withECDSA");
+        ID_TO_ALG.put(X9ObjectIdentifiers.ecdsa_with_SHA512.getId(), "SHA512withECDSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), "SHA1withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(), "SHA256withRSA");
+        ID_TO_ALG.put(PKCSObjectIdentifiers.sha512WithRSAEncryption.getId(), "SHA512withRSA");
+        ALG_TO_ID.put("SHA256withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA256.getId());
+        ALG_TO_ID.put("SHA384withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA384.getId());
+        ALG_TO_ID.put("SHA512withECDSA", X9ObjectIdentifiers.ecdsa_with_SHA512.getId());
+        ALG_TO_ID.put("SHA1withRSA", PKCSObjectIdentifiers.sha1WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA256withRSA", PKCSObjectIdentifiers.sha256WithRSAEncryption.getId());
+        ALG_TO_ID.put("SHA512withRSA", PKCSObjectIdentifiers.sha512WithRSAEncryption.getId());
+    }
+
+    private static String getSignatureAlgorithm(Key key) throws Exception {
+        if ("EC".equals(key.getAlgorithm())) {
+            int curveSize;
+            KeyFactory factory = KeyFactory.getInstance("EC");
+            if (key instanceof PublicKey) {
+                ECPublicKeySpec spec = factory.getKeySpec(key, ECPublicKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else if (key instanceof PrivateKey) {
+                ECPrivateKeySpec spec = factory.getKeySpec(key, ECPrivateKeySpec.class);
+                curveSize = spec.getParams().getCurve().getField().getFieldSize();
+            } else {
+                throw new InvalidKeySpecException();
+            }
+            if (curveSize <= 256) {
+                return "SHA256withECDSA";
+            } else if (curveSize <= 384) {
+                return "SHA384withECDSA";
+            } else {
+                return "SHA512withECDSA";
+            }
+        } else if ("RSA".equals(key.getAlgorithm())) {
+            return "SHA256withRSA";
+        } else {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+    }
+
+    static AlgorithmIdentifier getSignatureAlgorithmIdentifier(Key key) throws Exception {
+        String id = ALG_TO_ID.get(getSignatureAlgorithm(key));
+        if (id == null) {
+            throw new IllegalArgumentException("Unsupported key type " + key.getAlgorithm());
+        }
+        return new AlgorithmIdentifier(new ASN1ObjectIdentifier(id));
+    }
+
+    static boolean verify(PublicKey key, byte[] input, byte[] signature,
+                          AlgorithmIdentifier algId) throws Exception {
+        String algName = ID_TO_ALG.get(algId.getAlgorithm().getId());
+        if (algName == null) {
+            throw new IllegalArgumentException("Unsupported algorithm " + algId.getAlgorithm());
+        }
+        Signature verifier = Signature.getInstance(algName);
+        verifier.initVerify(key);
+        verifier.update(input);
+        return verifier.verify(signature);
+    }
+
+    static byte[] sign(PrivateKey privateKey, byte[] input) throws Exception {
+        Signature signer = Signature.getInstance(getSignatureAlgorithm(privateKey));
+        signer.initSign(privateKey);
+        signer.update(input);
+        return signer.sign();
+    }
+
+    static X509Certificate readCertificate(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            return (X509Certificate) cf.generateCertificate(input);
+        } finally {
+            input.close();
+        }
+    }
+
+    /** Read a PKCS#8 format private key. */
+    static PrivateKey readPrivateKey(InputStream input)
+            throws IOException, GeneralSecurityException {
+        try {
+            ByteArrayStream buf = new ByteArrayStream();
+            buf.readFrom(input);
+            byte[] bytes = buf.toByteArray();
+            /* Check to see if this is in an EncryptedPrivateKeyInfo structure. */
+            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(bytes);
+            /*
+             * Now it's in a PKCS#8 PrivateKeyInfo structure. Read its Algorithm
+             * OID and use that to construct a KeyFactory.
+             */
+            ASN1InputStream bIn = new ASN1InputStream(new ByteArrayInputStream(spec.getEncoded()));
+            PrivateKeyInfo pki = PrivateKeyInfo.getInstance(bIn.readObject());
+            String algOid = pki.getPrivateKeyAlgorithm().getAlgorithm().getId();
+            return KeyFactory.getInstance(algOid).generatePrivate(spec);
+        } finally {
+            input.close();
+        }
+    }
+}

utils/src/main/java/com/topjohnwu/utils/JarMap.java

@@ -0,0 +1,122 @@
+package com.topjohnwu.utils;
+
+import java.io.Closeable;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashMap;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarInputStream;
+import java.util.jar.Manifest;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipFile;
+
+/*
+* A universal random access interface for both JarFile and JarInputStream
+*
+* In the case when JarInputStream is provided to constructor, the whole stream
+* will be loaded into memory for random access purposes.
+* On the other hand, when a JarFile is provided, it simply works as a wrapper.
+* */
+
+public class JarMap implements Closeable, AutoCloseable {
+    private JarFile jarFile;
+    private JarInputStream jis;
+    private boolean isInputStream = false;
+    private LinkedHashMap<String, JarEntry> bufMap;
+
+    public JarMap(File file) throws IOException {
+        this(file, true);
+    }
+
+    public JarMap(File file, boolean verify) throws IOException {
+        this(file, verify, ZipFile.OPEN_READ);
+    }
+
+    public JarMap(File file, boolean verify, int mode) throws IOException {
+        jarFile = new JarFile(file, verify, mode);
+    }
+
+    public JarMap(String name) throws IOException {
+        this(new File(name));
+    }
+
+    public JarMap(String name, boolean verify) throws IOException {
+        this(new File(name), verify);
+    }
+
+    public JarMap(InputStream is) throws IOException {
+        this(is, true);
+    }
+
+    public JarMap(InputStream is, boolean verify) throws IOException {
+        isInputStream = true;
+        bufMap = new LinkedHashMap<>();
+        jis = new JarInputStream(is, verify);
+        JarEntry entry;
+        while ((entry = jis.getNextJarEntry()) != null) {
+            bufMap.put(entry.getName(), new JarMapEntry(entry, jis));
+        }
+    }
+
+    public File getFile() {
+        return isInputStream ? null : new File(jarFile.getName());
+    }
+
+    public Manifest getManifest() throws IOException {
+        return isInputStream ? jis.getManifest() : jarFile.getManifest();
+    }
+
+    public InputStream getInputStream(ZipEntry ze) throws IOException {
+        return isInputStream ? ((JarMapEntry) bufMap.get(ze.getName())).data.getInputStream() :
+                jarFile.getInputStream(ze);
+    }
+
+    public OutputStream getOutputStream(ZipEntry ze) {
+        if (!isInputStream) // Only support InputStream mode
+            return null;
+        ByteArrayStream bs = ((JarMapEntry) bufMap.get(ze.getName())).data;
+        bs.reset();
+        return bs;
+    }
+
+    public byte[] getRawData(ZipEntry ze) throws IOException {
+        if (isInputStream) {
+            return ((JarMapEntry) bufMap.get(ze.getName())).data.toByteArray();
+        } else {
+            ByteArrayStream bytes = new ByteArrayStream();
+            bytes.readFrom(jarFile.getInputStream(ze));
+            return bytes.toByteArray();
+        }
+    }
+
+    public Enumeration<JarEntry> entries() {
+        return isInputStream ? Collections.enumeration(bufMap.values()) : jarFile.entries();
+    }
+
+    public ZipEntry getEntry(String name) {
+        return getJarEntry(name);
+    }
+
+    public JarEntry getJarEntry(String name) {
+        return isInputStream ? bufMap.get(name) : jarFile.getJarEntry(name);
+    }
+
+    @Override
+    public void close() throws IOException {
+        (isInputStream ? jis : jarFile).close();
+    }
+
+    private static class JarMapEntry extends JarEntry {
+        ByteArrayStream data;
+        JarMapEntry(JarEntry je, InputStream is) {
+            super(je);
+            data = new ByteArrayStream();
+            data.readFrom(is);
+        }
+    }
+}

utils/src/main/java/com/topjohnwu/utils/SignAPK.java

@@ -0,0 +1,524 @@
+package com.topjohnwu.utils;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.DEROutputStream;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.cert.jcajce.JcaCertStore;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessableByteArray;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.CMSSignedDataGenerator;
+import org.bouncycastle.cms.CMSTypedData;
+import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.util.encoders.Base64;
+
+import java.io.BufferedOutputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.io.FilterOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.PrintStream;
+import java.io.RandomAccessFile;
+import java.security.DigestOutputStream;
+import java.security.GeneralSecurityException;
+import java.security.MessageDigest;
+import java.security.PrivateKey;
+import java.security.Provider;
+import java.security.Security;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TreeMap;
+import java.util.jar.Attributes;
+import java.util.jar.JarEntry;
+import java.util.jar.JarFile;
+import java.util.jar.JarOutputStream;
+import java.util.jar.Manifest;
+import java.util.regex.Pattern;
+
+/*
+* Modified from from AOSP(Marshmallow) SignAPK.java
+* */
+
+public class SignAPK {
+
+    private static final String CERT_SF_NAME = "META-INF/CERT.SF";
+    private static final String CERT_SIG_NAME = "META-INF/CERT.%s";
+
+    public static Provider sBouncyCastleProvider;
+    // bitmasks for which hash algorithms we need the manifest to include.
+    private static final int USE_SHA1 = 1;
+    private static final int USE_SHA256 = 2;
+
+    static {
+        sBouncyCastleProvider = new BouncyCastleProvider();
+        Security.insertProviderAt(sBouncyCastleProvider, 1);
+    }
+
+    public static void signZip(InputStream cert, InputStream key,
+                               JarMap input, OutputStream output) throws Exception {
+        File temp1 = File.createTempFile("signAPK", null);
+        File temp2 = File.createTempFile("signAPK", null);
+        try {
+            try (OutputStream out = new BufferedOutputStream(new FileOutputStream(temp1))) {
+                signZip(cert, key, input, out, false);
+            }
+
+            ZipAdjust.adjust(temp1, temp2);
+
+            try (JarMap map = new JarMap(temp2, false)) {
+                signZip(cert, key, map, output, true);
+            }
+        } finally {
+            temp1.delete();
+            temp2.delete();
+        }
+    }
+
+    public static void signZip(InputStream cert, InputStream key,
+                               JarMap input, OutputStream output, boolean minSign) throws Exception {
+        int alignment = 4;
+        int hashes = 0;
+        if (cert == null) {
+            cert = SignAPK.class.getResourceAsStream("/keys/testkey.x509.pem");
+        }
+        X509Certificate certificate = CryptoUtils.readCertificate(cert);
+        hashes |= getDigestAlgorithm(certificate);
+
+        // Set the ZIP file timestamp to the starting valid time
+        // of the 0th certificate plus one hour (to match what
+        // we've historically done).
+        long timestamp = certificate.getNotBefore().getTime() + 3600L * 1000;
+        if (key == null) {
+            key = SignAPK.class.getResourceAsStream("/keys/testkey.pk8");
+        }
+        PrivateKey privateKey = CryptoUtils.readPrivateKey(key);
+
+        if (minSign) {
+            signWholeFile(input.getFile(), certificate, privateKey, output);
+        } else {
+            JarOutputStream outputJar = new JarOutputStream(output);
+            // For signing .apks, use the maximum compression to make
+            // them as small as possible (since they live forever on
+            // the system partition).  For OTA packages, use the
+            // default compression level, which is much much faster
+            // and produces output that is only a tiny bit larger
+            // (~0.1% on full OTA packages I tested).
+            outputJar.setLevel(9);
+            Manifest manifest = addDigestsToManifest(input, hashes);
+            copyFiles(manifest, input, outputJar, timestamp, alignment);
+            signFile(manifest, input, certificate, privateKey, outputJar);
+            outputJar.close();
+        }
+    }
+
+    /**
+     * Return one of USE_SHA1 or USE_SHA256 according to the signature
+     * algorithm specified in the cert.
+     */
+    private static int getDigestAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        if ("SHA1WITHRSA".equals(sigAlg) ||
+                "MD5WITHRSA".equals(sigAlg)) {     // see "HISTORICAL NOTE" above.
+            return USE_SHA1;
+        } else if (sigAlg.startsWith("SHA256WITH")) {
+            return USE_SHA256;
+        } else {
+            throw new IllegalArgumentException("unsupported signature algorithm \"" + sigAlg +
+                    "\" in cert [" + cert.getSubjectDN());
+        }
+    }
+    /** Returns the expected signature algorithm for this key type. */
+    private static String getSignatureAlgorithm(X509Certificate cert) {
+        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
+        String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
+        if ("RSA".equalsIgnoreCase(keyType)) {
+            if (getDigestAlgorithm(cert) == USE_SHA256) {
+                return "SHA256withRSA";
+            } else {
+                return "SHA1withRSA";
+            }
+        } else if ("EC".equalsIgnoreCase(keyType)) {
+            return "SHA256withECDSA";
+        } else {
+            throw new IllegalArgumentException("unsupported key type: " + keyType);
+        }
+    }
+    // Files matching this pattern are not copied to the output.
+    private static Pattern stripPattern =
+            Pattern.compile("^(META-INF/((.*)[.](SF|RSA|DSA|EC)|com/android/otacert))|(" +
+                    Pattern.quote(JarFile.MANIFEST_NAME) + ")$");
+
+    /**
+     * Add the hash(es) of every file to the manifest, creating it if
+     * necessary.
+     */
+    private static Manifest addDigestsToManifest(JarMap jar, int hashes)
+            throws IOException, GeneralSecurityException {
+        Manifest input = jar.getManifest();
+        Manifest output = new Manifest();
+        Attributes main = output.getMainAttributes();
+        if (input != null) {
+            main.putAll(input.getMainAttributes());
+        } else {
+            main.putValue("Manifest-Version", "1.0");
+            main.putValue("Created-By", "1.0 (Android SignApk)");
+        }
+        MessageDigest md_sha1 = null;
+        MessageDigest md_sha256 = null;
+        if ((hashes & USE_SHA1) != 0) {
+            md_sha1 = MessageDigest.getInstance("SHA1");
+        }
+        if ((hashes & USE_SHA256) != 0) {
+            md_sha256 = MessageDigest.getInstance("SHA256");
+        }
+        byte[] buffer = new byte[4096];
+        int num;
+        // We sort the input entries by name, and add them to the
+        // output manifest in sorted order.  We expect that the output
+        // map will be deterministic.
+        TreeMap<String, JarEntry> byName = new TreeMap<String, JarEntry>();
+        for (Enumeration<JarEntry> e = jar.entries(); e.hasMoreElements(); ) {
+            JarEntry entry = e.nextElement();
+            byName.put(entry.getName(), entry);
+        }
+        for (JarEntry entry: byName.values()) {
+            String name = entry.getName();
+            if (!entry.isDirectory() &&
+                    (stripPattern == null || !stripPattern.matcher(name).matches())) {
+                InputStream data = jar.getInputStream(entry);
+                while ((num = data.read(buffer)) > 0) {
+                    if (md_sha1 != null) md_sha1.update(buffer, 0, num);
+                    if (md_sha256 != null) md_sha256.update(buffer, 0, num);
+                }
+                Attributes attr = null;
+                if (input != null) attr = input.getAttributes(name);
+                attr = attr != null ? new Attributes(attr) : new Attributes();
+                if (md_sha1 != null) {
+                    attr.putValue("SHA1-Digest",
+                            new String(Base64.encode(md_sha1.digest()), "ASCII"));
+                }
+                if (md_sha256 != null) {
+                    attr.putValue("SHA-256-Digest",
+                            new String(Base64.encode(md_sha256.digest()), "ASCII"));
+                }
+                output.getEntries().put(name, attr);
+            }
+        }
+        return output;
+    }
+
+    /** Write to another stream and track how many bytes have been
+     *  written.
+     */
+    private static class CountOutputStream extends FilterOutputStream {
+        private int mCount;
+        public CountOutputStream(OutputStream out) {
+            super(out);
+            mCount = 0;
+        }
+        @Override
+        public void write(int b) throws IOException {
+            super.write(b);
+            mCount++;
+        }
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            super.write(b, off, len);
+            mCount += len;
+        }
+        public int size() {
+            return mCount;
+        }
+    }
+    /** Write a .SF file with a digest of the specified manifest. */
+    private static void writeSignatureFile(Manifest manifest, OutputStream out,
+                                           int hash)
+            throws IOException, GeneralSecurityException {
+        Manifest sf = new Manifest();
+        Attributes main = sf.getMainAttributes();
+        main.putValue("Signature-Version", "1.0");
+        main.putValue("Created-By", "1.0 (Android SignApk)");
+        MessageDigest md = MessageDigest.getInstance(
+                hash == USE_SHA256 ? "SHA256" : "SHA1");
+        PrintStream print = new PrintStream(
+                new DigestOutputStream(new ByteArrayOutputStream(), md),
+                true, "UTF-8");
+        // Digest of the entire manifest
+        manifest.write(print);
+        print.flush();
+        main.putValue(hash == USE_SHA256 ? "SHA-256-Digest-Manifest" : "SHA1-Digest-Manifest",
+                new String(Base64.encode(md.digest()), "ASCII"));
+        Map<String, Attributes> entries = manifest.getEntries();
+        for (Map.Entry<String, Attributes> entry : entries.entrySet()) {
+            // Digest of the manifest stanza for this entry.
+            print.print("Name: " + entry.getKey() + "\r\n");
+            for (Map.Entry<Object, Object> att : entry.getValue().entrySet()) {
+                print.print(att.getKey() + ": " + att.getValue() + "\r\n");
+            }
+            print.print("\r\n");
+            print.flush();
+            Attributes sfAttr = new Attributes();
+            sfAttr.putValue(hash == USE_SHA256 ? "SHA-256-Digest" : "SHA1-Digest-Manifest",
+                    new String(Base64.encode(md.digest()), "ASCII"));
+            sf.getEntries().put(entry.getKey(), sfAttr);
+        }
+        CountOutputStream cout = new CountOutputStream(out);
+        sf.write(cout);
+        // A bug in the java.util.jar implementation of Android platforms
+        // up to version 1.6 will cause a spurious IOException to be thrown
+        // if the length of the signature file is a multiple of 1024 bytes.
+        // As a workaround, add an extra CRLF in this case.
+        if ((cout.size() % 1024) == 0) {
+            cout.write('\r');
+            cout.write('\n');
+        }
+    }
+    /** Sign data and write the digital signature to 'out'. */
+    private static void writeSignatureBlock(
+            CMSTypedData data, X509Certificate publicKey, PrivateKey privateKey,
+            OutputStream out)
+            throws IOException,
+            CertificateEncodingException,
+            OperatorCreationException,
+            CMSException {
+        ArrayList<X509Certificate> certList = new ArrayList<>(1);
+        certList.add(publicKey);
+        JcaCertStore certs = new JcaCertStore(certList);
+        CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
+        ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
+                .setProvider(sBouncyCastleProvider)
+                .build(privateKey);
+        gen.addSignerInfoGenerator(
+                new JcaSignerInfoGeneratorBuilder(
+                        new JcaDigestCalculatorProviderBuilder()
+                                .setProvider(sBouncyCastleProvider)
+                                .build())
+                        .setDirectSignature(true)
+                        .build(signer, publicKey));
+        gen.addCertificates(certs);
+        CMSSignedData sigData = gen.generate(data, false);
+        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
+        DEROutputStream dos = new DEROutputStream(out);
+        dos.writeObject(asn1.readObject());
+    }
+    /**
+     * Copy all the files in a manifest from input to output.  We set
+     * the modification times in the output to a fixed time, so as to
+     * reduce variation in the output file and make incremental OTAs
+     * more efficient.
+     */
+    private static void copyFiles(Manifest manifest, JarMap in, JarOutputStream out,
+                                  long timestamp, int alignment) throws IOException {
+        byte[] buffer = new byte[4096];
+        int num;
+        Map<String, Attributes> entries = manifest.getEntries();
+        ArrayList<String> names = new ArrayList<>(entries.keySet());
+        Collections.sort(names);
+        boolean firstEntry = true;
+        long offset = 0L;
+        // We do the copy in two passes -- first copying all the
+        // entries that are STORED, then copying all the entries that
+        // have any other compression flag (which in practice means
+        // DEFLATED).  This groups all the stored entries together at
+        // the start of the file and makes it easier to do alignment
+        // on them (since only stored entries are aligned).
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() != JarEntry.STORED) continue;
+            // Preserve the STORED method of the input entry.
+            outEntry = new JarEntry(inEntry);
+            outEntry.setTime(timestamp);
+            // 'offset' is the offset into the file at which we expect
+            // the file data to begin.  This is the value we need to
+            // make a multiple of 'alignement'.
+            offset += JarFile.LOCHDR + outEntry.getName().length();
+            if (firstEntry) {
+                // The first entry in a jar file has an extra field of
+                // four bytes that you can't get rid of; any extra
+                // data you specify in the JarEntry is appended to
+                // these forced four bytes.  This is JAR_MAGIC in
+                // JarOutputStream; the bytes are 0xfeca0000.
+                offset += 4;
+                firstEntry = false;
+            }
+            if (alignment > 0 && (offset % alignment != 0)) {
+                // Set the "extra data" of the entry to between 1 and
+                // alignment-1 bytes, to make the file data begin at
+                // an aligned offset.
+                int needed = alignment - (int)(offset % alignment);
+                outEntry.setExtra(new byte[needed]);
+                offset += needed;
+            }
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+                offset += num;
+            }
+            out.flush();
+        }
+        // Copy all the non-STORED entries.  We don't attempt to
+        // maintain the 'offset' variable past this point; we don't do
+        // alignment on these entries.
+        for (String name : names) {
+            JarEntry inEntry = in.getJarEntry(name);
+            JarEntry outEntry = null;
+            if (inEntry.getMethod() == JarEntry.STORED) continue;
+            // Create a new entry so that the compressed len is recomputed.
+            outEntry = new JarEntry(name);
+            outEntry.setTime(timestamp);
+            out.putNextEntry(outEntry);
+            InputStream data = in.getInputStream(inEntry);
+            while ((num = data.read(buffer)) > 0) {
+                out.write(buffer, 0, num);
+            }
+            out.flush();
+        }
+    }
+
+    // This class is to provide a file's content, but trimming out the last two bytes
+    // Used for signWholeFile
+    private static class CMSProcessableFile implements CMSTypedData {
+
+        private ASN1ObjectIdentifier type;
+        private RandomAccessFile file;
+
+        CMSProcessableFile(File file) throws FileNotFoundException {
+            this.file = new RandomAccessFile(file, "r");
+            type = new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId());
+        }
+
+        @Override
+        public ASN1ObjectIdentifier getContentType() {
+            return type;
+        }
+
+        @Override
+        public void write(OutputStream out) throws IOException, CMSException {
+            file.seek(0);
+            int read;
+            byte buffer[] = new byte[4096];
+            int len = (int) file.length() - 2;
+            while ((read = file.read(buffer, 0, len < buffer.length ? len : buffer.length)) > 0) {
+                out.write(buffer, 0, read);
+                len -= read;
+            }
+        }
+
+        @Override
+        public Object getContent() {
+            return file;
+        }
+
+        byte[] getTail() throws IOException {
+            byte tail[] = new byte[22];
+            file.seek(file.length() - 22);
+            file.readFully(tail);
+            return tail;
+        }
+    }
+
+    private static void signWholeFile(File input, X509Certificate publicKey,
+                                      PrivateKey privateKey, OutputStream outputStream)
+            throws Exception {
+        ByteArrayOutputStream temp = new ByteArrayOutputStream();
+        // put a readable message and a null char at the start of the
+        // archive comment, so that tools that display the comment
+        // (hopefully) show something sensible.
+        // TODO: anything more useful we can put in this message?
+        byte[] message = "signed by SignApk".getBytes("UTF-8");
+        temp.write(message);
+        temp.write(0);
+
+        CMSProcessableFile cmsFile = new CMSProcessableFile(input);
+        writeSignatureBlock(cmsFile, publicKey, privateKey, temp);
+
+        // For a zip with no archive comment, the
+        // end-of-central-directory record will be 22 bytes long, so
+        // we expect to find the EOCD marker 22 bytes from the end.
+        byte[] zipData = cmsFile.getTail();
+        if (zipData[zipData.length-22] != 0x50 ||
+                zipData[zipData.length-21] != 0x4b ||
+                zipData[zipData.length-20] != 0x05 ||
+                zipData[zipData.length-19] != 0x06) {
+            throw new IllegalArgumentException("zip data already has an archive comment");
+        }
+        int total_size = temp.size() + 6;
+        if (total_size > 0xffff) {
+            throw new IllegalArgumentException("signature is too big for ZIP file comment");
+        }
+        // signature starts this many bytes from the end of the file
+        int signature_start = total_size - message.length - 1;
+        temp.write(signature_start & 0xff);
+        temp.write((signature_start >> 8) & 0xff);
+        // Why the 0xff bytes?  In a zip file with no archive comment,
+        // bytes [-6:-2] of the file are the little-endian offset from
+        // the start of the file to the central directory.  So for the
+        // two high bytes to be 0xff 0xff, the archive would have to
+        // be nearly 4GB in size.  So it's unlikely that a real
+        // commentless archive would have 0xffs here, and lets us tell
+        // an old signed archive from a new one.
+        temp.write(0xff);
+        temp.write(0xff);
+        temp.write(total_size & 0xff);
+        temp.write((total_size >> 8) & 0xff);
+        temp.flush();
+        // Signature verification checks that the EOCD header is the
+        // last such sequence in the file (to avoid minzip finding a
+        // fake EOCD appended after the signature in its scan).  The
+        // odds of producing this sequence by chance are very low, but
+        // let's catch it here if it does.
+        byte[] b = temp.toByteArray();
+        for (int i = 0; i < b.length-3; ++i) {
+            if (b[i] == 0x50 && b[i+1] == 0x4b && b[i+2] == 0x05 && b[i+3] == 0x06) {
+                throw new IllegalArgumentException("found spurious EOCD header at " + i);
+            }
+        }
+        cmsFile.write(outputStream);
+        outputStream.write(total_size & 0xff);
+        outputStream.write((total_size >> 8) & 0xff);
+        temp.writeTo(outputStream);
+    }
+    private static void signFile(Manifest manifest, JarMap inputJar,
+                                 X509Certificate publicKey, PrivateKey privateKey,
+                                 JarOutputStream outputJar)
+            throws Exception {
+        // Assume the certificate is valid for at least an hour.
+        long timestamp = publicKey.getNotBefore().getTime() + 3600L * 1000;
+        // MANIFEST.MF
+        JarEntry je = new JarEntry(JarFile.MANIFEST_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        manifest.write(outputJar);
+        je = new JarEntry(CERT_SF_NAME);
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        writeSignatureFile(manifest, baos, getDigestAlgorithm(publicKey));
+        byte[] signedData = baos.toByteArray();
+        outputJar.write(signedData);
+        // CERT.{EC,RSA} / CERT#.{EC,RSA}
+        final String keyType = publicKey.getPublicKey().getAlgorithm();
+        je = new JarEntry(String.format(CERT_SIG_NAME, keyType));
+        je.setTime(timestamp);
+        outputJar.putNextEntry(je);
+        writeSignatureBlock(new CMSProcessableByteArray(signedData),
+                publicKey, privateKey, outputJar);
+    }
+}

utils/src/main/java/com/topjohnwu/utils/SignBoot.java

@@ -0,0 +1,236 @@
+package com.topjohnwu.utils;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERPrintableString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+
+public class SignBoot {
+
+    static {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    public static boolean doSignature(String target, InputStream imgIn, OutputStream imgOut,
+                                      InputStream cert, InputStream key) {
+        try {
+            ByteArrayStream bas = new ByteArrayStream();
+            bas.readFrom(imgIn);
+            byte[] image = bas.toByteArray();
+            bas.close();
+            int signableSize = getSignableImageSize(image);
+            if (signableSize < image.length) {
+                System.err.println("NOTE: truncating input from " +
+                        image.length + " to " + signableSize + " bytes");
+                image = Arrays.copyOf(image, signableSize);
+            } else if (signableSize > image.length) {
+                throw new IllegalArgumentException("Invalid image: too short, expected " +
+                        signableSize + " bytes");
+            }
+            BootSignature bootsig = new BootSignature(target, image.length);
+            if (cert == null) {
+                cert = SignBoot.class.getResourceAsStream("/keys/testkey.x509.pem");
+            }
+            X509Certificate certificate = CryptoUtils.readCertificate(cert);
+            bootsig.setCertificate(certificate);
+            if (key == null) {
+                key = SignBoot.class.getResourceAsStream("/keys/testkey.pk8");
+            }
+            PrivateKey privateKey = CryptoUtils.readPrivateKey(key);
+            bootsig.setSignature(bootsig.sign(image, privateKey),
+                    CryptoUtils.getSignatureAlgorithmIdentifier(privateKey));
+            byte[] encoded_bootsig = bootsig.getEncoded();
+            imgOut.write(image);
+            imgOut.write(encoded_bootsig);
+            imgOut.flush();
+            return true;
+        } catch (Exception e) {
+            e.printStackTrace();
+            return false;
+        }
+    }
+
+    public static boolean verifySignature(InputStream imgIn, InputStream certIn) {
+        try {
+            ByteArrayStream bas = new ByteArrayStream();
+            bas.readFrom(imgIn);
+            byte[] image = bas.toByteArray();
+            bas.close();
+            int signableSize = getSignableImageSize(image);
+            if (signableSize >= image.length) {
+                System.err.println("Invalid image: not signed");
+                return false;
+            }
+            byte[] signature = Arrays.copyOfRange(image, signableSize, image.length);
+            BootSignature bootsig = new BootSignature(signature);
+            if (certIn != null) {
+                bootsig.setCertificate(CryptoUtils.readCertificate(certIn));
+            }
+            if (bootsig.verify(Arrays.copyOf(image, signableSize))) {
+                System.err.println("Signature is VALID");
+                return true;
+            } else {
+                System.err.println("Signature is INVALID");
+            }
+        } catch (Exception e) {
+            System.err.println("Invalid image: not signed");
+        }
+        return false;
+    }
+
+    public static int getSignableImageSize(byte[] data) throws Exception {
+        if (!Arrays.equals(Arrays.copyOfRange(data, 0, 8),
+                "ANDROID!".getBytes("US-ASCII"))) {
+            throw new IllegalArgumentException("Invalid image header: missing magic");
+        }
+        ByteBuffer image = ByteBuffer.wrap(data);
+        image.order(ByteOrder.LITTLE_ENDIAN);
+        image.getLong(); // magic
+        int kernelSize = image.getInt();
+        image.getInt(); // kernel_addr
+        int ramdskSize = image.getInt();
+        image.getInt(); // ramdisk_addr
+        int secondSize = image.getInt();
+        image.getLong(); // second_addr + tags_addr
+        int pageSize = image.getInt();
+        int length = pageSize // include the page aligned image header
+                + ((kernelSize + pageSize - 1) / pageSize) * pageSize
+                + ((ramdskSize + pageSize - 1) / pageSize) * pageSize
+                + ((secondSize + pageSize - 1) / pageSize) * pageSize;
+        length = ((length + pageSize - 1) / pageSize) * pageSize;
+        if (length <= 0) {
+            throw new IllegalArgumentException("Invalid image header: invalid length");
+        }
+        return length;
+    }
+
+    static class BootSignature extends ASN1Object {
+        private ASN1Integer formatVersion;
+        private ASN1Encodable certificate;
+        private AlgorithmIdentifier algorithmIdentifier;
+        private DERPrintableString target;
+        private ASN1Integer length;
+        private DEROctetString signature;
+        private PublicKey publicKey;
+        private static final int FORMAT_VERSION = 1;
+
+        /**
+         * Initializes the object for signing an image file
+         * @param target Target name, included in the signed data
+         * @param length Length of the image, included in the signed data
+         */
+        public BootSignature(String target, int length) {
+            this.formatVersion = new ASN1Integer(FORMAT_VERSION);
+            this.target = new DERPrintableString(target);
+            this.length = new ASN1Integer(length);
+        }
+
+        /**
+         * Initializes the object for verifying a signed image file
+         * @param signature Signature footer
+         */
+        public BootSignature(byte[] signature)
+                throws Exception {
+            ASN1InputStream stream = new ASN1InputStream(signature);
+            ASN1Sequence sequence = (ASN1Sequence) stream.readObject();
+            formatVersion = (ASN1Integer) sequence.getObjectAt(0);
+            if (formatVersion.getValue().intValue() != FORMAT_VERSION) {
+                throw new IllegalArgumentException("Unsupported format version");
+            }
+            certificate = sequence.getObjectAt(1);
+            byte[] encoded = ((ASN1Object) certificate).getEncoded();
+            ByteArrayInputStream bis = new ByteArrayInputStream(encoded);
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            X509Certificate c = (X509Certificate) cf.generateCertificate(bis);
+            publicKey = c.getPublicKey();
+            ASN1Sequence algId = (ASN1Sequence) sequence.getObjectAt(2);
+            algorithmIdentifier = new AlgorithmIdentifier(
+                    (ASN1ObjectIdentifier) algId.getObjectAt(0));
+            ASN1Sequence attrs = (ASN1Sequence) sequence.getObjectAt(3);
+            target = (DERPrintableString) attrs.getObjectAt(0);
+            length = (ASN1Integer) attrs.getObjectAt(1);
+            this.signature = (DEROctetString) sequence.getObjectAt(4);
+        }
+
+        public ASN1Object getAuthenticatedAttributes() {
+            ASN1EncodableVector attrs = new ASN1EncodableVector();
+            attrs.add(target);
+            attrs.add(length);
+            return new DERSequence(attrs);
+        }
+
+        public byte[] getEncodedAuthenticatedAttributes() throws IOException {
+            return getAuthenticatedAttributes().getEncoded();
+        }
+
+        public void setSignature(byte[] sig, AlgorithmIdentifier algId) {
+            algorithmIdentifier = algId;
+            signature = new DEROctetString(sig);
+        }
+
+        public void setCertificate(X509Certificate cert)
+                throws Exception, IOException, CertificateEncodingException {
+            ASN1InputStream s = new ASN1InputStream(cert.getEncoded());
+            certificate = s.readObject();
+            publicKey = cert.getPublicKey();
+        }
+
+        public byte[] generateSignableImage(byte[] image) throws IOException {
+            byte[] attrs = getEncodedAuthenticatedAttributes();
+            byte[] signable = Arrays.copyOf(image, image.length + attrs.length);
+            for (int i=0; i < attrs.length; i++) {
+                signable[i+image.length] = attrs[i];
+            }
+            return signable;
+        }
+
+        public byte[] sign(byte[] image, PrivateKey key) throws Exception {
+            byte[] signable = generateSignableImage(image);
+            return CryptoUtils.sign(key, signable);
+        }
+
+        public boolean verify(byte[] image) throws Exception {
+            if (length.getValue().intValue() != image.length) {
+                throw new IllegalArgumentException("Invalid image length");
+            }
+            byte[] signable = generateSignableImage(image);
+            return CryptoUtils.verify(publicKey, signable, signature.getOctets(),
+                    algorithmIdentifier);
+        }
+
+        @Override
+        public ASN1Primitive toASN1Primitive() {
+            ASN1EncodableVector v = new ASN1EncodableVector();
+            v.add(formatVersion);
+            v.add(certificate);
+            v.add(algorithmIdentifier);
+            v.add(getAuthenticatedAttributes());
+            v.add(signature);
+            return new DERSequence(v);
+        }
+
+    }
+}

utils/src/main/java/com/topjohnwu/utils/ZipAdjust.java

@@ -0,0 +1,277 @@
+package com.topjohnwu.utils;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.io.RandomAccessFile;
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+
+public class ZipAdjust {
+
+    public static void adjust(File input, File output) throws IOException {
+        try (
+            RandomAccessFile in = new RandomAccessFile(input, "r");
+            FileOutputStream out = new FileOutputStream(output)
+        ) {
+            adjust(in, out);
+        }
+    }
+
+    public static void adjust(RandomAccessFile in, OutputStream out) throws IOException {
+
+        CentralFooter footer = new CentralFooter(in);
+        int outOff = 0;
+        long centralOff = unsigned(footer.centralDirectoryOffset);
+        CentralHeader[] centralHeaders = new CentralHeader[unsigned(footer.numEntries)];
+
+        // Loop through central directory entries
+        for (int i = 0; i < centralHeaders.length; ++i) {
+            // Read central header
+            in.seek(centralOff);
+            centralHeaders[i] = new CentralHeader(in);
+            centralOff = in.getFilePointer();
+
+            // Read local header
+            in.seek(unsigned(centralHeaders[i].localHeaderOffset));
+            LocalHeader localHeader = new LocalHeader(in);
+
+            // Make sure local and central headers matches, and strip out data descriptor flag
+            centralHeaders[i].localHeaderOffset = outOff;
+            centralHeaders[i].flags &= ~(1 << 3);
+            localHeader.flags = centralHeaders[i].flags;
+            localHeader.crc32 = centralHeaders[i].crc32;
+            localHeader.compressedSize = centralHeaders[i].compressedSize;
+            localHeader.uncompressedSize = centralHeaders[i].uncompressedSize;
+            localHeader.fileNameLength = centralHeaders[i].fileNameLength;
+            localHeader.filename = centralHeaders[i].filename;
+
+            // Write local header
+            outOff += localHeader.write(out);
+
+            // Copy data
+            int read;
+            long len = unsigned(localHeader.compressedSize);
+            outOff += len;
+            byte data[] = new byte[4096];
+            while ((read = in.read(data, 0,
+                    len < data.length ? (int) len : data.length)) > 0) {
+                out.write(data, 0, read);
+                len -= read;
+            }
+        }
+
+        footer.centralDirectoryOffset = outOff;
+
+        // Write central directory
+        outOff = 0;
+        for (CentralHeader header : centralHeaders)
+            outOff += header.write(out);
+
+        // Write central directory record
+        footer.centralDirectorySize = outOff;
+        footer.write(out);
+    }
+
+    public static short unsigned(byte n) {
+        return (short)(n & 0xff);
+    }
+
+    public static int unsigned(short n) {
+        return n & 0xffff;
+    }
+
+    public static long unsigned(int n) {
+        return n & 0xffffffffL;
+    }
+
+    public static class CentralFooter {
+
+        static final int MAGIC =  0x06054b50;
+        
+        int signature;
+        short diskNumber;
+        short centralDirectoryDiskNumber;
+        short numEntriesThisDisk;
+        short numEntries;
+        int centralDirectorySize;
+        int centralDirectoryOffset;
+        short zipCommentLength;
+        // byte[] comments;
+
+        CentralFooter(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[22];
+            for (long i = file.length() - 4; i >= 0; --i) {
+                file.seek(i);
+                file.read(buffer, 0 ,4);
+                ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+                signature = buf.getInt();
+                if (signature != MAGIC) {
+                    continue;
+                }
+                file.read(buffer, 4, buffer.length - 4);
+                diskNumber = buf.getShort();
+                centralDirectoryDiskNumber = buf.getShort();
+                numEntriesThisDisk = buf.getShort();
+                numEntries = buf.getShort();
+                centralDirectorySize = buf.getInt();
+                centralDirectoryOffset = buf.getInt();
+                zipCommentLength = buf.getShort();
+                break;
+            }
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[22];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(diskNumber);
+            buf.putShort(centralDirectoryDiskNumber);
+            buf.putShort(numEntriesThisDisk);
+            buf.putShort(numEntries);
+            buf.putInt(centralDirectorySize);
+            buf.putInt(centralDirectoryOffset);
+            buf.putShort((short) 0);  // zipCommentLength
+            out.write(buffer);
+            return buffer.length;
+        }
+    }
+
+    static class CentralHeader {
+
+        static final int MAGIC =  0x02014b50;
+
+        int signature;
+        short versionMadeBy;
+        short versionNeededToExtract;
+        short flags;
+        short compressionMethod;
+        short lastModFileTime;
+        short lastModFileDate;
+        int crc32;
+        int compressedSize;
+        int uncompressedSize;
+        short fileNameLength;
+        short extraFieldLength;
+        short fileCommentLength;
+        short diskNumberStart;
+        short internalFileAttributes;
+        int externalFileAttributes;
+        int localHeaderOffset;
+        byte[] filename;
+        // byte[] extra;
+        // byte[] comment;
+
+        CentralHeader(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[46];
+            file.read(buffer);
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            signature = buf.getInt();
+            if (signature != MAGIC)
+                throw new IOException();
+            versionMadeBy = buf.getShort();
+            versionNeededToExtract = buf.getShort();
+            flags = buf.getShort();
+            compressionMethod = buf.getShort();
+            lastModFileTime = buf.getShort();
+            lastModFileDate = buf.getShort();
+            crc32 = buf.getInt();
+            compressedSize = buf.getInt();
+            uncompressedSize = buf.getInt();
+            fileNameLength = buf.getShort();
+            extraFieldLength = buf.getShort();
+            fileCommentLength = buf.getShort();
+            diskNumberStart = buf.getShort();
+            internalFileAttributes = buf.getShort();
+            externalFileAttributes = buf.getInt();
+            localHeaderOffset = buf.getInt();
+            filename = new byte[unsigned(fileNameLength)];
+            file.read(filename);
+            file.skipBytes(unsigned(extraFieldLength) + unsigned(fileCommentLength));
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[46];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(versionMadeBy);
+            buf.putShort(versionNeededToExtract);
+            buf.putShort(flags);
+            buf.putShort(compressionMethod);
+            buf.putShort(lastModFileTime);
+            buf.putShort(lastModFileDate);
+            buf.putInt(crc32);
+            buf.putInt(compressedSize);
+            buf.putInt(uncompressedSize);
+            buf.putShort(fileNameLength);
+            buf.putShort((short) 0); // extraFieldLength
+            buf.putShort((short) 0); // fileCommentLength
+            buf.putShort(diskNumberStart);
+            buf.putShort(internalFileAttributes);
+            buf.putInt(externalFileAttributes);
+            buf.putInt(localHeaderOffset);
+            out.write(buffer);
+            out.write(filename);
+            return buffer.length + filename.length;
+        }
+    }
+
+    static class LocalHeader {
+
+        static final int MAGIC = 0x04034b50;
+
+        int signature;
+        short versionNeededToExtract;
+        short flags;
+        short compressionMethod;
+        short lastModFileTime;
+        short lastModFileDate;
+        int crc32;
+        int compressedSize;
+        int uncompressedSize;
+        short fileNameLength;
+        short extraFieldLength;
+        byte[] filename;
+        // byte[] extra;
+
+        LocalHeader(RandomAccessFile file) throws IOException {
+            byte[] buffer = new byte[30];
+            file.read(buffer);
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            signature = buf.getInt();
+            if (signature != MAGIC)
+                throw new IOException();
+            versionNeededToExtract = buf.getShort();
+            flags = buf.getShort();
+            compressionMethod = buf.getShort();
+            lastModFileTime = buf.getShort();
+            lastModFileDate = buf.getShort();
+            crc32 = buf.getInt();
+            compressedSize = buf.getInt();
+            uncompressedSize = buf.getInt();
+            fileNameLength = buf.getShort();
+            extraFieldLength = buf.getShort();
+            file.skipBytes(unsigned(fileNameLength) + unsigned(extraFieldLength));
+        }
+
+        int write(OutputStream out) throws IOException {
+            byte[] buffer = new byte[30];
+            ByteBuffer buf = ByteBuffer.wrap(buffer).order(ByteOrder.LITTLE_ENDIAN);
+            buf.putInt(signature);
+            buf.putShort(versionNeededToExtract);
+            buf.putShort(flags);
+            buf.putShort(compressionMethod);
+            buf.putShort(lastModFileTime);
+            buf.putShort(lastModFileDate);
+            buf.putInt(crc32);
+            buf.putInt(compressedSize);
+            buf.putInt(uncompressedSize);
+            buf.putShort(fileNameLength);
+            buf.putShort((short) 0); // extraFieldLength
+            out.write(buffer);
+            out.write(filename);
+            return buffer.length + filename.length;
+        }
+    }
+}

utils/src/main/java/com/topjohnwu/utils/ZipSigner.java

@@ -0,0 +1,50 @@
+package com.topjohnwu.utils;
+
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+
+import java.io.BufferedInputStream;
+import java.io.BufferedOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.security.Security;
+
+public class ZipSigner {
+
+    public static void usage() {
+        System.err.println("Usage: zipsigner [x509.pem] [pk8] input.jar output.jar");
+        System.err.println("Note: If no certificate/private key pair is specified, it will use the embedded test keys.");
+        System.exit(2);
+    }
+
+    public static void main(String[] args) throws Exception {
+        int argStart = 0;
+
+        if (args.length < 2)
+            usage();
+
+        InputStream cert = null;
+        InputStream key = null;
+
+        if (args.length - argStart == 4) {
+            cert = new BufferedInputStream(new FileInputStream(new File(args[argStart])));
+            key = new BufferedInputStream(new FileInputStream(new File(args[argStart + 1])));
+            argStart += 2;
+        }
+
+        if (args.length - argStart != 2)
+            usage();
+
+        SignAPK.sBouncyCastleProvider = new BouncyCastleProvider();
+        Security.insertProviderAt(SignAPK.sBouncyCastleProvider, 1);
+
+        File input = new File(args[argStart]);
+        File output = new File(args[argStart + 1]);
+
+        try (JarMap jar = new JarMap(input, false);
+             BufferedOutputStream out = new BufferedOutputStream(new FileOutputStream(output))) {
+            SignAPK.signZip(cert, key, jar, out);
+        }
+    }
+}

utils/src/main/resources/keys/testkey.x509.pem

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE-----
+MIIEqDCCA5CgAwIBAgIJAJNurL4H8gHfMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYD
+VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4g
+VmlldzEQMA4GA1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UE
+AxMHQW5kcm9pZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTAe
+Fw0wODAyMjkwMTMzNDZaFw0zNTA3MTcwMTMzNDZaMIGUMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4G
+A1UEChMHQW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9p
+ZDEiMCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTCCASAwDQYJKoZI
+hvcNAQEBBQADggENADCCAQgCggEBANaTGQTexgskse3HYuDZ2CU+Ps1s6x3i/waM
+qOi8qM1r03hupwqnbOYOuw+ZNVn/2T53qUPn6D1LZLjk/qLT5lbx4meoG7+yMLV4
+wgRDvkxyGLhG9SEVhvA4oU6Jwr44f46+z4/Kw9oe4zDJ6pPQp8PcSvNQIg1QCAcy
+4ICXF+5qBTNZ5qaU7Cyz8oSgpGbIepTYOzEJOmc3Li9kEsBubULxWBjf/gOBzAzU
+RNps3cO4JFgZSAGzJWQTT7/emMkod0jb9WdqVA2BVMi7yge54kdVMxHEa5r3b97s
+zI5p58ii0I54JiCUP5lyfTwE/nKZHZnfm644oLIXf6MdW2r+6R8CAQOjgfwwgfkw
+HQYDVR0OBBYEFEhZAFY9JyxGrhGGBaR0GawJyowRMIHJBgNVHSMEgcEwgb6AFEhZ
+AFY9JyxGrhGGBaR0GawJyowRoYGapIGXMIGUMQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEQMA4GA1UEChMH
+QW5kcm9pZDEQMA4GA1UECxMHQW5kcm9pZDEQMA4GA1UEAxMHQW5kcm9pZDEiMCAG
+CSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbYIJAJNurL4H8gHfMAwGA1Ud
+EwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAHqvlozrUMRBBVEY0NqrrwFbinZa
+J6cVosK0TyIUFf/azgMJWr+kLfcHCHJsIGnlw27drgQAvilFLAhLwn62oX6snb4Y
+LCBOsVMR9FXYJLZW2+TcIkCRLXWG/oiVHQGo/rWuWkJgU134NDEFJCJGjDbiLCpe
++ZTWHdcwauTJ9pUbo8EvHRkU3cYfGmLaLfgn9gP+pWA7LFQNvXwBnDa6sppCccEX
+31I828XzgXpJ4O+mDL1/dBd+ek8ZPUP0IgdyZm5MTYPhvVqGCHzzTy3sIeJFymwr
+sBbmg2OAUNLEMO6nwmocSdN2ClirfxqCzJOLSDE4QyS9BAH6EhY6UFcOaE0=
+-----END CERTIFICATE-----