密钥轮换后，我还需要旧密钥来签署应用程序更新吗？

Question

我在这里 https://source.android.com/docs/security/features/apksigning/v3 和这里 https://www.xda-developers.com/apk-signature-scheme-v3-key-rotation/ 读到，我使用 V3 签名轮换密钥并能够使用另一个密钥对 apk 进行签名。

我还需要旧密钥来签名吗？还是用新密钥签名就足够了？

Answer 1

简而言之，用新密钥签名就足够了。

我在 Android 13 模拟器和 Pixel 5 上执行了以下关键旋转步骤（不适用于 Android 10 模拟器）

以下步骤供您参考

创建 3 个密钥存储 owen1.jks、owen2.jks 和 owen3.jks

keytool -keystore owen1.jks -genkey -alias owen1 -keyalg rsa
keytool -keystore owen2.jks -genkey -alias owen2 -keyalg rsa
keytool -keystore owen3.jks -genkey -alias owen3 -keyalg rsa

创建旋转谱系文件

apksigner rotate --out SigningCertificateLineage.owen1.owen2 --old-signer --ks owen1.jks --new-signer --ks owen2.jks
apksigner rotate --out SigningCertificateLineage.owen2.owen3 --old-signer --ks owen2.jks --new-signer --ks owen3.jks

用每个 jks 签署 serial.apk

apksigner sign --ks owen1.jks --in serial.apk --out serial.SignedOwen1.apk
apksigner sign --ks owen2.jks --in serial.apk --out serial.SignedOwen2.apk
apksigner sign --ks owen3.jks --in serial.apk --out serial.SignedOwen3.apk

使用旋转数据签署 serial.apk

apksigner sign --ks owen1.jks --next-signer --ks owen2.jks --lineage SigningCertificateLineage.owen1.owen2 --in serial.apk --out serial.rotate.owen1.owen2.apk
apksigner sign --ks owen2.jks --next-signer --ks owen3.jks --lineage SigningCertificateLineage.owen2.owen3 --in serial.apk --out serial.rotate.owen2.owen3.apk

然后让我们按照以下步骤尝试旋转

[0] 12/29 15:41:51 owenwen@dell:~/jks$ adb install serial.SignedOwen1.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 931 ms
 
[0] 12/29 15:42:42 owenwen@dell:~/jks$ adb install serial.rotate.owen1.owen2.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 629 ms
 
[0] 12/29 15:42:52 owenwen@dell:~/jks$ adb install serial.SignedOwen2.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 467 ms
 
[0] 12/29 15:42:59 owenwen@dell:~/jks$ adb install serial.rotate.owen2.owen3.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 570 ms
 
[0] 12/29 15:43:05 owenwen@dell:~/jks$ adb install serial.SignedOwen3.apk
Performing Incremental Install
Serving...
All files should be loaded. Notifying the device.
Success
Install command complete in 728 ms
 
[0] 12/29 15:43:10 owenwen@dell:~/jks$ adb install serial.SignedOwen1.apk
Performing Incremental Install
Serving...
Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Existing package com.sample.app signatures do not match newer version; ignoring!]
Performing Streamed Install
adb: failed to install serial.SignedOwen1.apk: Failure [INSTALL_FAILED_UPDATE_INCOMPATIBLE: Existing package com.sample.app signatures do not match newer version; ignoring!]
 
[1] 12/29 15:43:14 owenwen@dell:~/jks$ adb shell getprop | grep fingerprint
[ro.bootimage.build.fingerprint]: [google/redfin/redfin:13/TQ1A.221205.011/9244662:user/release-keys]