Sign an apk with signature of another signed apk using apksigner

Question

I have an unsigned apk A.apk and an signed apk B.apk

Using apksigner tool is it possible to sign A.apk with same signature of B.apk.

What are the exact commands to do this?

Thanks in advance for any help.

Answer 1

An asymmetric code signature like apksigner creates always requires the private key. But in APKs you will find only the public key and the certificate.

Therefore signing A.APK with the same signature as used on B.APK is not possible as long as you don't have access to the private key that belongs to the certificate and public key of the signature of B.APK.

The only part of the signature of B.APK that you could clone would the values shown contained in the certificate (except for the public key, the certificate signature and the certificate fingerprint). But that would fool only a human who does not compare the fingerprint, Android uses the public key and thus directly recognizes that the signature is different. This means such a cloned certificate would be useless.