blocks|key|107646|text|它是Android7.0中引入的一种新的签名机制，具有旨在使APK签名更安全的附加功能。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|107647|这不是强制性的。如果可能，您应该选中这两个复选框，但是如果新的V2签名机制给您带来问题，您可以忽略它。|107648|因此，如果您遇到问题，可以不检查V2，但如果可能的话，应该检查它。|107649|更新:当目标是Android+11时，这是必须的。|107650|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

It is a new signing mechanism introduced in Android 7.0, with additional features designed to make the APK signature more secure.
It is not mandatory. You should check BOTH of those checkboxes if possible, but if the new V2 signing mechanism gives you problems, you can omit it.
So you can just leave V2 unchecked if you encounter problems, but should have it checked if possible.
UPDATED: This is now mandatory when targeting Android 11.

blocks|key|2645878|text|here写道：“默认情况下，Android+Studio2.2和Android+Plugin+for+Gradle+2.2会同时使用APK签名方案v2和使用JAR签名的传统签名方案对您的应用程序进行签名。”|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2645879|这些新的复选框似乎是在Android+2.3中出现的，据我所知，我之前的Android+Studio版本(至少2.2版)确实使用了这两个签名。因此，要像以前一样继续，我认为最好同时选中这两个复选框。|2645880|编辑2017年3月31日:提交了几个应用程序，两个签名=>都没有问题:)|style|BOLD|2645881|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.android.com/about/versions/nougat/android-7.0.html#apk_signature_v2^0|0|4|0|0|0|0|D|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|W|8|@$A|X|B|Y|H|I]]|9|@]|C|$]]|$1|J|3|-4|5|6|7|Z|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]]]

It is written <a href="https://developer.android.com/about/versions/nougat/android-7.0.html#apk_signature_v2" rel="noreferrer">here</a> that "By default, Android Studio 2.2 and the Android Plugin for Gradle 2.2 sign your app using both APK Signature Scheme v2 and the traditional signing scheme, which uses JAR signing." 

As it seems that these new checkboxes appeared with Android 2.3, I understand that my previous versions of Android Studio (at least the 2.2) did sign with both signatures. So, to continue as I did before, I think that it is better to check both checkboxes.

EDIT March 31st, 2017 : submitted several apps with both signatures => no problem :)

blocks|key|2646031|text|我认为this代表了一个很好的答案。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2646032|APK签名方案v2验证|style|BOLD|2646033|2646034|找到APK+Signing+Block并验证：|ordered-list-item|CODE|2646035|+APK+Signing+Block的两个大小字段包含相同的value.|2646036|ZIP+Central+Directory，后面紧跟ZIP+End+of+Central+Directory+record.|2646037|ZIP+End+of+Central+Directory后面没有跟更多data.|2646038|2646039|2646040|​|2646041|2646042|找到APK+Signing+Block中的第一个APK+Signature+Scheme+v2+Block。如果存在v2块，请继续执行步骤3。否则，请回退到使用v1方案验证APK.对于APK+Signature+Scheme+v2+Block：|2646043|中的每个签名者，请从签名中选择最强支持的签名算法ID。强度排序取决于每个实现/平台使用公钥从签名针对签名的数据version.|2646044|Verify相应的签名。(现在可以安全地解析签名data.)|2646045|Verify，即摘要和签名中签名算法in的有序列表是相同的。(这是为了防止使用与签名algorithm.|2646046|Verify所使用的摘要算法相同的摘要算法来对APK内容的摘要进行签名，所计算的摘要与来自digests.|2646047|Verify的对应摘要相同，即第一证书的key.|2646048|2646049|与公共key.相同|2646050|2646051|如果至少找到一个签名者，则|2646052|Verification成功，并且每个找到的签名者的步骤3都成功。|2646053|2646054|注意:如果在第3步或第4步中出现故障，则不能使用v1方案验证APK。|2646055|APK签名的验证(v1方案)|2646056|JAR签名的APK是一个标准的签名JAR，它必须包含META-INF/MANIFEST.MF中列出的条目，并且所有条目都必须由同一组签名者签名。其完整性验证如下：|2646057|2646058|每个签名者都由一个META-INF/<signer>.SF表示，META-INF/<signer>.(RSA%7CDSA%7CEC)+JAR+entry.|2646059|<signer>.(RSA%7CDSA%7CEC)是一个具有SignedData结构的<signer>.SF，它的签名通过<signer>.SF进行验证。JAR文件包含整个文件的META-INF/MANIFEST.MF摘要和META-INF/MANIFEST.MF的每个部分的摘要。验证MANIFEST.MF的整个文件摘要。如果失败，则验证每个MANIFEST.MF部分的摘要对于每个完整性保护的JAR条目，JAR都包含一个对应命名的部分，其中包含条目的未压缩内容的摘要。如果APK包含的JAR条目没有在MANIFEST.MF中列出，并且不是JAR签名的一部分，则所有这些摘要都是verified.|2646060|APK验证失败。因此，保护链是每个完整性保护JAR条目的<signer>.(RSA%7CDSA%7CEC)+<signer>.SF+MANIFEST.MF+|2646061|→contents。|2646062|entityMap|0|LINK|mutability|MUTABLE|url|https://source.android.com/security/apksigning/v2.html^0|3|4|0|0|0|B|0|0|2|H|1|1|H|1|0|L|Q|S|1|0|S|1|0|0|0|0|2|H|O|T|2K|T|1|1|1|1|1|1|0|0|0|0|0|0|0|6|8|0|Q|K|0|0|9|K|W|U|0|0|L|13|B|1L|B|2D|K|30|K|3V|B|4O|B|6W|B|0|S|L|1E|B|1Q|B|0|0^^$0|@$1|2|3|4|5|6|7|25|8|@]|9|@$A|26|B|27|1|28]]|C|$]]|$1|D|3|E|5|6|7|29|8|@$A|2A|B|2B|F|G]]|9|@]|C|$]]|$1|H|3|-4|5|6|7|2C|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|2D|8|@$A|2E|B|2F|F|L]]|9|@]|C|$]]|$1|M|3|N|5|K|7|2G|8|@$A|2H|B|2I|F|L]]|9|@]|C|$]]|$1|O|3|P|5|K|7|2J|8|@$A|2K|B|2L|F|L]|$A|2M|B|2N|F|L]]|9|@]|C|$]]|$1|Q|3|R|5|K|7|2O|8|@$A|2P|B|2Q|F|L]]|9|@]|C|$]]|$1|S|3|-4|5|6|7|2R|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|2S|8|@]|9|@]|C|$]]|$1|U|3|V|5|6|7|2T|8|@]|9|@]|C|$]]|$1|W|3|-4|5|6|7|2U|8|@]|9|@]|C|$]]|$1|X|3|Y|5|K|7|2V|8|@$A|2W|B|2X|F|L]|$A|2Y|B|2Z|F|L]|$A|30|B|31|F|L]]|9|@]|C|$]]|$1|Z|3|10|5|K|7|32|8|@]|9|@]|C|$]]|$1|11|3|12|5|K|7|33|8|@]|9|@]|C|$]]|$1|13|3|14|5|K|7|34|8|@]|9|@]|C|$]]|$1|15|3|16|5|K|7|35|8|@]|9|@]|C|$]]|$1|17|3|18|5|K|7|36|8|@]|9|@]|C|$]]|$1|19|3|-4|5|6|7|37|8|@]|9|@]|C|$]]|$1|1A|3|1B|5|6|7|38|8|@]|9|@]|C|$]]|$1|1C|3|V|5|6|7|39|8|@]|9|@]|C|$]]|$1|1D|3|1E|5|6|7|3A|8|@]|9|@]|C|$]]|$1|1F|3|1G|5|K|7|3B|8|@]|9|@]|C|$]]|$1|1H|3|-4|5|6|7|3C|8|@]|9|@]|C|$]]|$1|1I|3|1J|5|6|7|3D|8|@]|9|@]|C|$]]|$1|1K|3|1L|5|6|7|3E|8|@$A|3F|B|3G|F|G]]|9|@]|C|$]]|$1|1M|3|1N|5|6|7|3H|8|@$A|3I|B|3J|F|L]]|9|@]|C|$]]|$1|1O|3|-4|5|6|7|3K|8|@]|9|@]|C|$]]|$1|1P|3|1Q|5|K|7|3L|8|@$A|3M|B|3N|F|L]|$A|3O|B|3P|F|L]]|9|@]|C|$]]|$1|1R|3|1S|5|K|7|3Q|8|@$A|3R|B|3S|F|L]|$A|3T|B|3U|F|L]|$A|3V|B|3W|F|L]|$A|3X|B|3Y|F|L]|$A|3Z|B|40|F|L]|$A|41|B|42|F|L]|$A|43|B|44|F|L]|$A|45|B|46|F|L]]|9|@]|C|$]]|$1|1T|3|1U|5|K|7|47|8|@$A|48|B|49|F|L]|$A|4A|B|4B|F|L]|$A|4C|B|4D|F|L]]|9|@]|C|$]]|$1|1V|3|1W|5|6|7|4E|8|@]|9|@]|C|$]]|$1|1X|3|-4|5|6|7|4F|8|@]|9|@]|C|$]]]|1Y|$1Z|$5|20|21|22|C|$23|24]]]]

I think <a href="https://source.android.com/security/apksigning/v2.html" rel="noreferrer">this</a> represents a good answer.

APK Signature Scheme v2 verification

<ol>
<li>Locate the <code>APK Signing Block</code> and verify that:

<ol>
<li>Two size fields of <code>APK Signing Block</code> contain the same value.</li>
<li><code>ZIP Central Directory</code> is immediately followed by <code>ZIP End of Central Directory</code> record.</li>
<li><code>ZIP End of Central Directory</code> is not followed by more data.</li>
</ol></li>
<li>Locate the first <code>APK Signature Scheme v2 Block</code> inside the <code>APK Signing Block</code>. If the v2 Block if present, proceed to step 3. Otherwise, fall back to verifying the APK using v1 scheme.</li>
<li>For each signer in the <code>APK Signature Scheme v2 Block</code>:

<ol>
<li>Choose the strongest supported signature algorithm ID from signatures. The strength ordering is up to each implementation/platform version.</li>
<li>Verify the corresponding signature from signatures against signed data using public key. (It is now safe to parse signed data.)</li>
<li>Verify that the ordered list of signature algorithm IDs in digests and signatures is identical. (This is to prevent signature stripping/addition.)</li>
<li>Compute the digest of APK contents using the same digest algorithm as the digest algorithm used by the signature algorithm.</li>
<li>Verify that the computed digest is identical to the corresponding digest from digests.</li>
<li>Verify that <code>SubjectPublicKeyInfo</code> of the first certificate of certificates is identical to public key.</li>
</ol></li>
<li>Verification succeeds if at least one signer was found and step 3 succeeded for each found signer.</li>
</ol>

Note: APK must not be verified using the v1 scheme if a failure occurs in step 3 or 4.

JAR-signed APK verification (v1 scheme)

The JAR-signed APK is a standard signed JAR, which must contain exactly the entries listed in <code>META-INF/MANIFEST.MF</code> and where all entries must be signed by the same set of signers. Its integrity is verified as follows:

<ol>
<li>Each signer is represented by a <code>META-INF/&lt;signer&gt;.SF</code> and <code>META-INF/&lt;signer&gt;.(RSA|DSA|EC)</code> JAR entry.</li>
<li><code>&lt;signer&gt;.(RSA|DSA|EC)</code> is a <code>PKCS #7 CMS ContentInfo</code> with SignedData structure whose signature is verified over the <code>&lt;signer&gt;.SF</code> file.</li>
<li><code>&lt;signer&gt;.SF</code> file contains a whole-file digest of the <code>META-INF/MANIFEST.MF</code> and digests of each section of <code>META-INF/MANIFEST.MF</code>. The whole-file digest of the <code>MANIFEST.MF</code> is verified. If that fails, the digest of each <code>MANIFEST.MF</code> section is verified instead.</li>
<li><code>META-INF/MANIFEST.MF</code> contains, for each integrity-protected JAR entry, a correspondingly named section containing the digest of the entry’s uncompressed contents. All these digests are verified.</li>
<li>APK verification fails if the APK contains JAR entries which are not listed in the <code>MANIFEST.MF</code> and are not part of JAR signature.
The protection chain is thus <code>&lt;signer&gt;.(RSA|DSA|EC)</code> → <code>&lt;signer&gt;.SF</code> → <code>MANIFEST.MF</code> → contents of each integrity-protected JAR entry.</li>
</ol>

blocks|key|2646070|text|我应该使用(或两者都使用)来签署用于play+store发布的apk吗？答案是YES。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2646071|根据https://source.android.com/security/apksigning/v2.html#verification：|2646072|2646073|在Android7.0中，可以根据APK签名方案v2+(v2方案)或JAR签名(v1方案)对APK进行验证。较旧的平台会忽略v2签名，只验证v1签名。|blockquote|2646074|2646075|2646076|我尝试使用checking+V2(Full+Apk+Signature)选项生成构建。然后，当我尝试在低于7.0的设备中安装发布版本时，我无法在设备中安装版本。|2646077|之后，我尝试通过选中version复选框和generate+release+build进行构建。然后就可以安装构建了。|2646078|entityMap|0|LINK|mutability|MUTABLE|url|https://source.android.com/security/apksigning/v2.html#verification^0|13|3|0|2|1V|0|0|0|0|0|0|E|M|1H|4|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|12|8|@]|D|@$9|13|A|14|1|15]]|E|$]]|$1|H|3|-4|5|6|7|16|8|@]|D|@]|E|$]]|$1|I|3|J|5|K|7|17|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|18|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|19|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|1A|8|@$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|6|7|1F|8|@]|D|@]|E|$]]|$1|R|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]]|S|$T|$5|U|V|W|E|$X|Y]]]]

Should I use(or both) for signing apk for play store release?
An answer is YES. 

As per <a href="https://source.android.com/security/apksigning/v2.html#verification" rel="noreferrer">https://source.android.com/security/apksigning/v2.html#verification</a>
:

<blockquote>
 In Android 7.0, APKs can be verified according to the APK Signature Scheme v2 (v2 scheme) or JAR signing (v1 scheme). Older platforms ignore v2 signatures and only verify v1 signatures.
</blockquote>

I tried to generate build with checking V2(Full Apk Signature) option. Then when I tried to install a release build in below 7.0 device and I am unable to install build in the device.

After that I tried to build by checking both version checkbox and generate release build. Then able to install build.

blocks|key|2857481|text|根据此链接：signature+help|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2857482|APK签名方案v2提供：|2857483|2857484|更快的应用程序安装时间|ordered-list-item|2857485|针对未经授权的APK文件更改提供更多保护。|2857486|2857487|2857488|+Android7.0引入了APK签名方案v2，这是一个新的应用程序签名方案，提供了更快的应用程序安装时间和更多的保护，防止对APK文件的未经授权的更改。默认情况下，Android+Studio2.2和Gradle2.2的Android插件使用签名方案v2和使用JAR签名的传统签名方案对您的应用程序进行签名。|blockquote|style|BOLD|2857489|2857490|2857491|建议您使用APK签名方案v2，但不是强制性的。|2857492|2857493|虽然我们建议在您的应用程序中应用APK签名方案v2，但这个新方案并不是必须的。如果您的应用程序在使用APK签名方案v2时无法正确构建，您可以禁用新方案。|2857494|2857495|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.android.com/about/versions/nougat/android-7.0.html#apk_signature_v2^0|6|E|0|0|0|0|0|0|0|0|3E|X|0|0|0|0|M|0|0|0|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@$A|19|B|1A|1|1B]]|C|$]]|$1|D|3|E|5|6|7|1C|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|1D|8|@]|9|@]|C|$]]|$1|G|3|H|5|I|7|1E|8|@]|9|@]|C|$]]|$1|J|3|K|5|I|7|1F|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|1G|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|1H|8|@]|9|@]|C|$]]|$1|N|3|O|5|P|7|1I|8|@$A|1J|B|1K|Q|R]]|9|@]|C|$]]|$1|S|3|-4|5|6|7|1L|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|1M|8|@]|9|@]|C|$]]|$1|U|3|V|5|6|7|1N|8|@$A|1O|B|1P|Q|R]]|9|@]|C|$]]|$1|W|3|-4|5|6|7|1Q|8|@]|9|@]|C|$]]|$1|X|3|Y|5|P|7|1R|8|@]|9|@]|C|$]]|$1|Z|3|-4|5|6|7|1S|8|@]|9|@]|C|$]]|$1|10|3|-4|5|6|7|1T|8|@]|9|@]|C|$]]]|11|$12|$5|13|14|15|C|$16|17]]]]

According to this link: <a href="https://developer.android.com/about/versions/nougat/android-7.0.html#apk_signature_v2" rel="noreferrer">signature help</a>

APK Signature Scheme v2 offers:

<ol>
<li>Faster app install times</li>
<li>More protection against unauthorized alterations to APK files.</li>
</ol>

<blockquote>
 Android 7.0 introduces APK Signature Scheme v2, a new app-signing
 scheme that offers faster app install times and more protection
 against unauthorized alterations to APK files. By default, Android
 Studio 2.2 and the Android Plugin for Gradle 2.2 sign your app using
 both APK Signature Scheme v2 and the traditional signing scheme, which
 uses JAR signing.
</blockquote>

It is recommended to use APK Signature Scheme v2 but is not mandatory.

<blockquote>
 Although we recommend applying APK Signature Scheme v2 to your app,
 this new scheme is not mandatory. If your app doesn't build properly
 when using APK Signature Scheme v2, you can disable the new scheme.
</blockquote>

Please select at least one of the signature versions to use in Android Studio 2.3

Now while generating a signed APK in Android Studio, it's showing two options (CheckBox) namely 1. <code>V1 (Jar Signature)</code> and 2. <code>V2 (Full APK Signature)</code> as Signature Versions in the last step of signed APK generating process.

<a href="https://i.stack.imgur.com/1CPP5.png" rel="noreferrer"><img src="https://i.stack.imgur.com/1CPP5.png" alt="**Signature Versions** options"></a>

So, what is the difference between V1 (Jar Signature) and V2 (Full APK Signature) in the new Android Studio update?

And which should I use (or both) for signing apk for play store release?

Also, I'm getting error Install Parse Failed No Certificates while installing APK when I use the second option.

Difference between signature versions - V1 (Jar Signature) and V2 (Full APK Signature) while generating a signed APK in Android Studio?

Android Studio

Android

请在Android Studio2.3中至少选择一个签名版本现在，当在Android Studio中生成签名的APK时，在签名APK生成过程的最后一步，会显示两个选项(CheckBox)，即1. V1 (Jar Signature)和2. V2 (Full APK Signature)作为签名版本。​​那么，在新的An...

问在Android Studio中生成签名APK时，V1 (Jar签名)和V2 (完整APK签名)的签名版本有什么区别？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Android Studio中生成签名APK时，V1 (Jar签名)和V2 (完整APK签名)的签名版本有什么区别？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Android Studio中生成签名APK时，V1 (Jar签名)和V2 (完整APK签名)的签名版本有什么区别？
EN