is there any pure-java or standalone deployable implementation of jarsigner?

Question

I've seen a lot of questions here asking how to deploy an app with jarsigner but without a full JDK. Also some people ask how to programatically do jarsigner tasks.

I was wondering if there is any pure-java implementation of jarsigner or even some standalone and alternate implementation of it, easier to deploy with apps.

(of course, I know that you could just force the user to install a full JDK in the installation process or require an installed JDK)

So my question is if there is such a thing like an alternate jarsigner.

If any good soul could also explain why jarsigner must be always native (because java can be decompiled?), it would be a plus :-)

Answer 1

The executable part of the jarsigner tool is just a thin wrapper over a pure Java implementation. In fact it's the same wrapper that is used for java, javac, javap, etc.

The real problem you have is that the class files used by jarsigner are in tools.jar, which isn't present in a JRE.

Answer 2

There is an alternative tool called SignApk. The procedure is very well explained here How to Sign Android APK or Zip Files

SignApk.jar is a tool included with the Android platform source bundle, you can download it from here. To use SignApk.jar you have to create a private key with it’s corresponding certificate/public key. To create private/public key pair, you can use Openssl