enterprise

The signer has the fully qualified class name: org.signserver.module.apk.signer.ApkRotateSigner

Overview

The APK Rotate Signer supports Android Package Kit (APK) key rotation. Key rotation supports signing with a new key by rolling over to the new key using a lineage file. The APK Rotate Signer is used to create the lineage file that allows rolling over from an old signer to a new one. Both signers must be configured in SignServer and have access to their respective key/certificate. 

The APK Rotate Signer requires the OTHER_SIGNERS property to be configured with the old and new signer to include in the lineage. Note that this signer is configured without a crypto token, as no crypto token is used.

For more information on Android signing and how to set it up in SignServer, see Setting up Android Signing.

Available Properties

Property

Description

Required

OTHER_SIGNERS

Signers to include in the lineage. Specify exactly two signers: the old and new signers to include in the lineage.

(bock)

OLD_SET_INSTALLED_DATA

Specifies the installed data capability of the old signer in the updated lineage (true or false), if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


OLD_SET_SHARED_UID

Specifies the shared UID capability of the old signer in the updated lineage (true or false), if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


OLD_SET_PERMISSION

Specifies the permission capability of the old signer in the updated lineage (true or false), if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


OLD_SET_ROLLBACK

Specifies the rollback capability of the old signer in the updated lineage (true or false), if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


OLD_SET_AUTH

Specifies the auth capability of the old signer in the updated lineage (true or false), if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


NEW_SET_INSTALLED_DATA

Specifies the installed data capability of the new signer in the updated lineage (true or false), if set. Default: unset.


NEW_SET_SHARED_UID

Specifies the shared UID capability of the new signer in the updated lineage (true or false), if set. Default: unset.


NEW_SET_PERMISSION

Specifies the permission capability of the new signer in the updated lineage (true or false), if set. Default: unset.


NEW_SET_ROLLBACK

Specifies the rollback capability of the new signer in the updated lineage (true or false), if set. Default: unset.


NEW_SET_AUTH

Specifies the auth capability of the new signer in the updated lineage (true or false), if set. Default: unset.


MIN_SDK_VERSION

Specifies the minimum SDK version, if set. This is only used when creating a new lineage file, not when updating an existing one. Default: unset.


Worker Log Fields

Field

Description

REQUEST_DIGEST 

A message digest (hash) for the request document in HEX encoding.

REQUEST_DIGEST_ALGORITHM 

The name of the message digest (hash) algorithm used for the request digest in the log.

RESPONSE_DIGEST 

A message digest (hash) for the response document in hex encoding.

RESPONSE_DIGEST_ALGORITHM 

The name of the message digest (hash) algorithm used for the response digest in the log.