jarsigner: unable to sign jar: java.util.zip.ZipException: invalid entry compressed size (expected 463 but got 465 bytes)

Question

when I am signing the apk, I get \"jarsigner: unable to sign jar: java.util.zip.ZipException: invalid entry compressed size (expected 463 but got 465 bytes)\" this error mes

Answer 1

This is the 1 Liner/1 Step version of @Joerg's answer above:

zip -d foo.apk META-INF/\*

That uses the built in "delete from existing archive" functionality of the zip command. When you run that command you should see:

deleting: META-INF/MANIFEST.MF
deleting: META-INF/CERT.SF
deleting: META-INF/CERT.RSA

...as the output. Those files are the existing signature. Removing them allows you to sign it again.

I would also like to reiterate that you should be sure to pass the -sigalg SHA1withRSA and -digestalg SHA1 arguments to the jarsigner to avoid this issue: https://code.google.com/p/android/issues/detail?id=19567

Answer 2

According to googles documents you can sign an apk multiple times http://developer.android.com/guide/publishing/app-signing.html#signapp. If you are unable to get an unsigned build though you can just inflate the apk and then rejar it, you will then be able to sign it.

Answer 3

As far as I faced this error, it occurs when you try to sign a zipaligned .apk file.
Looks like jarsigner can't stand some of the zipalign changes. This doesn't occur often.

Answer 4

You definitely are able to sign an already signed apk multiple times using different keys:

Note that you can sign an APK multiple times with different keys.

E.g. I accomplished to sign a Debug-Apk with the release key so that I was able to test upgrades of released versions. Also, I was able to sign an already released apk with the debug key for reproducing bugs.

This is what you should do

1. Rename the .apk file to .zip
2. Unpack the .zip file and remove the META-INF folder
3. Zip the folder again and rename it to .apk
4. Sign the apk:

    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 \
              -keystore my-release-key.keystore my_application.apk alias_name

For the debug key, the alias should be androiddebugkey and the password android. The debug keystore is per default $HOME/.android/debug.keystore. See also Signing in Debug Mode.

Answer 5

You are trying to sign an already signed .apk. You need to export an unsigned .apk file and then sign it with jarsigner.