jarsigner: unable to sign jar: java.util.zip.ZipException: invalid entry compressed size (expected 463 but got 465 bytes)

Asked 23/2, 2011 at 9:29 Answered 24/5, 2023 at 8:58

Solved android

when I am signing the apk, I get "jarsigner: unable to sign jar: java.util.zip.ZipException: invalid entry compressed size (expected 463 but got 465 bytes)" this error message. The apk size is almost 1MB. When I reduce the size to 500KB, signing success. Why this so?..Any Idea?

Numerous answered 23/2, 2011 at 9:29 Comment(2)

#3267716 – Langill 18/1, 2016 at 0:7

sometime it happens when you try to sign a debug apk – Rosenblast 3/4, 2016 at 16:33

116

You are trying to sign an already signed .apk. You need to export an unsigned .apk file and then sign it with jarsigner.

Vent answered 23/2, 2011 at 9:44 Comment(5)

Bug in the POM — indeed the file was signed twice. – Salesclerk 21/6, 2013 at 11:58

Or you can just remove the signature from the existing apk with a single command. See: https://mcmap.net/q/217659/-jarsigner-unable-to-sign-jar-java-util-zip-zipexception-invalid-entry-compressed-size-expected-463-but-got-465-bytes – Parkland 9/6, 2015 at 3:30

I'm really disappointed that this is still the accepted answer 2 years after an actual solution was given. – Parkland 6/9, 2017 at 15:0

Had the same. When removing existing signature remember to remove signature entries from MANIFEST.MF file too. – Incomprehensive 19/7, 2018 at 16:4

This answer is still good though because it gives information about why it is happening, which is helpful for troubleshooting different use cases. For example my issue was with AppCenter, which did in fact warn me that I was attempting to resign a signed package, so I had to remove the signingConfig from my build.gradle ... horses for courses and all that! – Docilu 9/2, 2020 at 13:36

114

You definitely are able to sign an already signed APK multiple times using different keys:

Note that you can sign an APK multiple times with different keys.

E.g. I accomplished signing a Debug-Apk with the release key so that I was able to test upgrades of released versions. Also, I was able to sign an already released APK with the debug key for reproducing bugs.

This is what you should do

Rename the .apk file to .zip
Unpack the .zip file and remove the META-INF folder
Zip the folder again and rename it to .apk
Sign the apk:

    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 \
              -keystore my-release-key.keystore my_application.apk alias_name

For the debug key, the alias should be androiddebugkey and the password android. The debug keystore is per default $HOME/.android/debug.keystore. See also Sign your debug build.

Wozniak answered 24/1, 2012 at 19:27 Comment(6)

you save my day, and possibly my apps as well! Eclipse crashes every time I try to export my apps Signed or not, so the only way to go for me was command-line and then I had this error, only solution that worked! thanks again – Cadent 12/6, 2012 at 7:5

@Guillaume, to avoid eclipse crashing - turn off "Build Automatically" (Project->Build automatically) – Nataline 4/8, 2014 at 9:8

The CERT.RSA file which holds the signature is stored in the META-INF folder which you are suggesting to remove. Which in effect is the same as removing the signature. So that's why you are able to sign it with the debug key. So it doesn't mean that you have signed the apk with two different keys. – Basilbasilar 26/12, 2014 at 10:29

I have signed the apk successfully but I am getting below error while installing the app "error - There is a problem parsing the package". What might be the issue please help .. – Aerospace 30/1, 2015 at 13:16

For the record, this method did not work for me, even after deleting the META-INF folder I still get the ZipException – Hopson 2/2, 2015 at 22:4

I have a single command that accomplishes this much easier in my answer below. https://mcmap.net/q/217659/-jarsigner-unable-to-sign-jar-java-util-zip-zipexception-invalid-entry-compressed-size-expected-463-but-got-465-bytes I have confirmed that the inappropriately signed APK that I received from a vendor was able to be resigned after running this single command. – Parkland 9/6, 2015 at 3:32

This is the 1 Liner/1 Step version of @Joerg's answer above:

zip -d foo.apk META-INF/\*

That uses the built in "delete from existing archive" functionality of the zip command. When you run that command you should see:

deleting: META-INF/MANIFEST.MF
deleting: META-INF/CERT.SF
deleting: META-INF/CERT.RSA

...as the output. Those files are the existing signature. Removing them allows you to sign it again.

I would also like to reiterate that you should be sure to pass the -sigalg SHA1withRSA and -digestalg SHA1 arguments to the jarsigner to avoid this issue: https://code.google.com/p/android/issues/detail?id=19567

Parkland answered 9/6, 2015 at 3:29 Comment(5)

Be careful with zip -d foo.apk META-INF/* - it can delete more files than needed. – Wyatan 20/7, 2016 at 9:53

@DannySchoemann Meaning what? I see 3 files in META-INF/gdata/kinds/com.google.schemas.contact.2008 and META-INF/services/com.fasterxml.jackson.core.JsonFactory. So will I be safe if only the manifest and cert files are removed? – Cascio 5/10, 2016 at 8:55

@kaay- That looks right, but I don't know for sure, you may have to experiment which you need to delete. – Wyatan 6/10, 2016 at 11:45

I have a lot of androidx.* in my META-INF so definitely remove those 3 files one by one. – Beryl 25/2, 2021 at 12:10

After trying this I got this error Warning: The signer's certificate is self-signed. Any ideas? – Emogene 4/2, 2022 at 16:38

I encountered this when signing my .aab file. Removing the duplicate signing (once as part of the bundling, once manually) fixed it. This was part of the default react-native app scaffolding.

The app/build.gradle file includes a section android/buildTypes/release which had its signingConfig key set. When generating .apk files it seemed to be ignored but when switching to .aab format it looks like it did apply that signing. When I then did my own signing in CI, it complained because it was already signed.

Antilogism answered 30/12, 2020 at 15:5 Comment(7)

Great observation! I was stuck on this while trying to publish a bundle via CI. Thank you. – Spenser 14/1, 2021 at 9:51

Hats off to your sir! For those following along, you'll want to comment out the line which says "signingConfig signingConfigs.debug" under release or set up your own. – Prima 6/9, 2021 at 11:44

To further compliment this, here is the React Native docs that specify what you need to do. link – Ophite 15/9, 2021 at 20:20

You must be north, cos you're a star! – Carlock 2/11, 2021 at 9:51

Excellent man. I couldn't have guessed in ages – Monosyllabic 29/11, 2021 at 18:34

I had generated my Android project from ReactNative 0.67 last year which seems to have created this problem, now I'm using the new bundle signing. Commenting out the release signing section stopped the gradlew bundleRelease from signing the .aab file with the debug key. Then I can sign it with my release key using jarsigner and it uploads OK. @Ophite points out, I will have to upgrade my RN project. – Greenheart 5/10, 2022 at 8:14

Nice man. Same scenario – Camelopardalis 5/12, 2022 at 12:27

According to googles documents you can sign an apk multiple times http://developer.android.com/guide/publishing/app-signing.html#signapp. If you are unable to get an unsigned build though you can just inflate the apk and then rejar it, you will then be able to sign it.

Artair answered 6/5, 2011 at 19:8 Comment(0)

As far as I faced this error, it occurs when you try to sign a zipaligned .apk file.
Looks like jarsigner can't stand some of the zipalign changes. This doesn't occur often.

Nataline answered 23/10, 2012 at 8:37 Comment(4)

Zipaligning an apk does not prevent it from being signed. You will have to run zipalign again after signing to get it back into an aligned state. – Fanaticism 30/7, 2014 at 19:49

@Fanaticism It doesn't prevent, but it should. Aligning modifies zip. Signing sometimes fails to sign aligned zip with this error. Why downvote? – Nataline 31/7, 2014 at 9:31

You've now changed the meaning of your answer. Your previous answer strongly suggested that it was not possible to sign a zip-aligned file. That was incorrect. – Fanaticism 5/8, 2014 at 10:11

@dmdrummond, No, It didn't. You may reread the preedit version (stackoverflow.com/posts/13026461/revisions) – Nataline 6/8, 2014 at 8:55

Removing signingConfig signingConfigs.debug in release config in build.gradle is worked for me;

release 
  {
     //signingConfig signingConfigs.debug -> removed
  }

Living answered 24/5, 2023 at 8:58 Comment(0)

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags