Question

I have been developing my Android App on Linux and Eclipse for a year now. Decided to switch to windows for a number of reasons. Jumped through all the hoops, and now have my App building and exporting fine in Windows. ADT accepts and uses my developer certificate – store password and key password work fine.

The resulting App installs fine on real devices, and appears to be signed fine, but Android Market will not accept upload of the App update with the following error:

“The apk must be signed with the same certificate as the previous version”

Going back to Linux, I generate the APK and can upload it fine. Obviously the tool chain is generating a different binary. Verified using diff.

I am using the same version of Java on both platforms. I’m exporting using the same keystores and the same passwords. On running jarsigner -verify I get the following:

Windows:

  X.509, O=VoltUp, C=US
  [certificate is valid from 11/17/10 10:28 AM to 10/24/10 11:28 AM]

Linux:

  X.509, O=BatteryStorm Mobile Inc, C=US
  [certificate is valid from 10/25/10 12:04 AM to 10/17/40 12:04 AM]

So obviously O= has changed. How could this be?

Answer 1

Binary diffs will reveal nothing. Use jarsigner to check the differences in the actual signatures:

jarsigner -verify -verbose -certs app.apk

Most likely the reason for your problem is that the default digest algorithm for jarsigner has been changed to SHA256 in Java 7, if you specify SHA1 explicitly with -digestalg SHA1 you should get the same signature (or just use Java 6). Android, and the Market, compare the signature as a binary blob, and really don’t care about the actual certificate at this point, that is why it complains. Technically, if it is signed with the same key by the same person (certificate), it should be considered a valid signature. Not letting you change the digest algorithm to a more secure one should be considered a bug.

BTW, I don’t think ADT officially supports Java 7 yet.