Can’t Build for Google with Newer Builds and Old Signing Certificate

Solar2D Android
#1

Hi Corona;

I am worried that I am in a HEAP of trouble with several quite successful apps on Google Play. 

I am worried that I cannot build any of these apps with a Corona Build newer than Build #3176 (last November build). I’ve done a full day of testing. This is as quick a summary of my problem as I can write:

A)  Four successful apps (80,000 or so DAUs) have all used the same signing certificate (keystore) that we created back in about 2012.

B)  Last July, we ran into a Google Play Keystore issue that was well discussed in this thread: https://forums.coronalabs.com/topic/69279-suddenly-unable-to-build-for-android-due-to-keystore-issue/  (see my long post on page 1 of the thread and Rob Miracle’s insights following that).

C)  We solved our Google Play problem (they didn’t like our signature algorithm) at that time by uninstalling Java SDK 1.8 and reverting to the older Java SDK 1.6.

D)  Everything was copacetic with building and submitting Google Play updates and new apps with Corona Builds up through last November. And we continued to build and submit to Google successfully using Build #3174 into this year.

E)  However, we have seen the same significant jump in ANRs and OpenAL errors that others are dealing with. Plus there its the whole GPDR thing and information collected by Corona. So, I was looking forward to doing updates on a pair of the apps this week using the latest Corona build(s). And THIS IS THE PROBLEM. All attempts with newer Corona Builds result in a final message reading “ERROR: Build Failed: Error code: 256”.

F)  My findings are:

— I can build this app for Google Play without error using all builds through #3176 (Nov. 16, 2017)

— The build failed error is consistent beginning with #3177 through 3301. Note — the “changes” listed for #3177 were simply “Maintenance, Maintenance”

— I can successfully build any of your sample apps with my signing certificate (keystore) with builds #3176 and earlier. I get the same failure building sample apps using this certificate with #3177 and forward.

— I can build any of my apps successfully with ANY build (older or newer) using the debug keystore.

— Note that I have copied my keystore file to different directories so that your build tool would re-prompt me for the password. And this didn’t solve anything.

— Also, when I made a spanking new signing certificate today to test – the new certificate builds my apps fine on all Corona Builds.

I “think” that you folks made a change in #3177 that related to either using Java SDK 1.6 and my “old” signing certificate’s security hash or identity . . . or simply related to an older signing certificate such as mine.

As you can see, I am really stuck in time and desperate for some help/guidance. The implications of changing a signing certificate are described (by others) as:

“If you change the certificate an application is signed with, it is now a different application because it comes from a different author. This different application can’t be uploaded to Market as an update to the original application, nor can it be installed onto a device as an update.”

Rob . . . or anyone at Corona . . . can you offer any guidance or suggest a path to a fix? I’ve pasted the last large chunks of build output below in case it can give you insight.

Many thanks!

Steve Bullock

END OF BUILD OUTPUT . . . . can-delete-file: [available] Unable to find /var/folders/rh/64lk69hn4673h16f0tfqk7c00000gn/T/CLtmp8Imwol/MyCoronaActivity-signed.apk delete-file: Skipped because property 'can.delete.file' not set. [antcall] Exiting /Applications/Corona-3306/Corona Simulator.app/Contents/Resources/build.xml. [exec] Current OS is Mac OS X [exec] Executing 'jarsigner' with arguments: [exec] '-signedjar' [exec] 'MyCoronaActivity-signed.apk' [exec] '-keystore' [exec] '/Work Files/Work Files/Corona Files for Mobile/Steve Projects/Android\_Keystore/adveractive\_release.keystore' [exec] '-storepass' [exec] 'l@k3shore' [exec] '-digestalg' [exec] 'SHA1' [exec] 'MyCoronaActivity-unsigned.apk' [exec] 'adverkey' [exec] [exec] The ' characters around the executable and arguments are [exec] not part of the command. May 30 05:38:30.762 [exec] Enter key password for adverkey: jarsigner: you must enter key password May 30 05:38:31.114 [exec] Result: 1 May 30 05:38:31.114 sign-apk: May 30 05:38:31.124 [antcall] Exiting /Applications/Corona-3306/Corona Simulator.app/Contents/Resources/build.xml. May 30 05:38:31.125 BUILD FAILED /Applications/Corona-3306/Corona Simulator.app/Contents/Resources/build.xml:525: The following error occurred while executing this line: /Applications/Corona-3306/Corona Simulator.app/Contents/Resources/build.xml:417: Failed to sign the APK. at org.apache.tools.ant.taskdefs.Exit.execute(Exit.java:164) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291) at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106) at org.apache.tools.ant.Task.perform(Task.java:348) at org.apache.tools.ant.Target.execute(Target.java:390) at org.apache.tools.ant.Target.performTasks(Target.java:411) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1397) at org.apache.tools.ant.helper.SingleCheckExecutor.executeTargets(SingleCheckExecutor.java:38) at org.apache.tools.ant.Project.executeTargets(Project.java:1249) at org.apache.tools.ant.taskdefs.Ant.execute(Ant.java:442) at org.apache.tools.ant.taskdefs.CallTarget.execute(CallTarget.java:105) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:291) at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106) at org.apache.tools.ant.Task.perform(Task.java:348) at org.apache.tools.ant.Target.execute(Target.java:390) at org.apache.tools.ant.Target.performTasks(Target.java:411) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1397) at org.apache.tools.ant.Project.executeTarget(Project.java:1366) at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41) at org.apache.tools.ant.Project.executeTargets(Project.java:1249) at org.apache.tools.ant.Main.runBuild(Main.java:801) at org.apache.tools.ant.Main.startAnt(Main.java:218) at org.apache.tools.ant.launch.Launcher.run(Launcher.java:280) at org.apache.tools.ant.launch.Launcher.main(Launcher.java:109) Total time: 7 seconds May 30 05:38:31.765 Android build failed (256) after 91 seconds May 30 05:38:32.145 ERROR: Build Failed: Error code: 256
#2

Since you are using that vintage certificate and if you don’t find another solution let me tell you how I worked around the issue with a similar old certificate that I had.

1.  Go to your google dashboard, under the app in question click on App Signing.

  1. Sign up for Google Signing.

  2. They’ll ask you to upload your old key. Ask you for your password and key name (if I remember correctly).

  3. Then you’ll generate a new key. This key should work in the newer version of Corona.

From that point on you will upload your app signed with the new key and Google will sign the app with the old key.

#3

Well God Bless you Agramonte. Is it that simple with Google? That would solve “some” of the problem.

The part of the problem that I didn’t even touch in the original post (thought that it would add another whole layer of unnecessary complexity) is the parallel “Amazon Problem”.  All of these apps have also been quite successful on Amazon. A couple of them bring in more money on Amazon than Google Play. All of these apps were built with the same “vintage” signing certificate. Your solution may solve the “Google Problem” . . . but I’ll be stuck using last November’s build forever on Amazon; won’t that be the case?

Thanks so much.

Steve

#4

Actually, Amazon doesn’t care what you sign your apk with. They always strip it and sign it with the one on your control panel so you can sign it with the new one also. Hopefully, the Google thing will work for you.

#5

Can you try following the advice in this forum thread: https://forums.coronalabs.com/topic/71572-build-error/

Modern Java’s want a pkcs12 format keystore instead of a pem based one.  You of course will need to change the names of the files in the command line command to what makes sense for you.

Rob

#6

Thanks Rob. I just read that thread and it looks REALLY promising. Will try it this morning and will report back. 

Steve

#7

Rob and Agramonte (and Ian/KeystageFun from the other thread);

I have really, really good news. Rob’s suggested solution from the other post worked and I now have a “new” keystore of format type “pkcs12”.  This “new” keystore was created using keytool by importing the old keystore and exporting it.

This “new” signing certificate (keystore) no longer throws the “ERROR: Build Failed: Error code: 256” when I build. That’s the problem that began this thread. 

Most important – This “new” signing certificate (keystore) is accepted by Google Play as the same certificate that has signed all of my apps for about 5 years. Hurrah. 

I had to futz a bit with the key tool command and had the similar experience that Ian had with passwords. And I have now returned to using JDK 1.8 (remember, to solve a Google Play signing problem last year – which was clearly related – my solution then was to revert to Java 6 because Google would accept my Corona builds if that was the Java base).

My full key tool command line was this (insert your own keystore file name, alias and passwords):

keytool -importkeystore -srckeystore adveractive_release.keystore -destkeystore adveractive_release.keystore -srcstoretype JKS -deststoretype pkcs12 -srcstorepass PASSWORD -deststorepass PASSWORD -srcalias ALIAS -destalias ALIAS -srckeypass KEYPASSWORD -destkeypass KEYPASSWORD -noprompt

And it executed successfully and returned these two “warnings”:

Warning:  Different store and key passwords not supported for PKCS12 KeyStores. Ignoring user-specified -destkeypass value.

Warning:  Migrated “adveractive_release.keystore” to Non JKS/JCEKS. The JKS keystore is backed up as “adveractive_release.keystore.old”.

I am a very relieved developer. Thank you for the guidance Rob.

Best;

Steve

#8

Since you are using that vintage certificate and if you don’t find another solution let me tell you how I worked around the issue with a similar old certificate that I had.

1.  Go to your google dashboard, under the app in question click on App Signing.

  1. Sign up for Google Signing.

  2. They’ll ask you to upload your old key. Ask you for your password and key name (if I remember correctly).

  3. Then you’ll generate a new key. This key should work in the newer version of Corona.

From that point on you will upload your app signed with the new key and Google will sign the app with the old key.

#9

Well God Bless you Agramonte. Is it that simple with Google? That would solve “some” of the problem.

The part of the problem that I didn’t even touch in the original post (thought that it would add another whole layer of unnecessary complexity) is the parallel “Amazon Problem”.  All of these apps have also been quite successful on Amazon. A couple of them bring in more money on Amazon than Google Play. All of these apps were built with the same “vintage” signing certificate. Your solution may solve the “Google Problem” . . . but I’ll be stuck using last November’s build forever on Amazon; won’t that be the case?

Thanks so much.

Steve

#10

Actually, Amazon doesn’t care what you sign your apk with. They always strip it and sign it with the one on your control panel so you can sign it with the new one also. Hopefully, the Google thing will work for you.

#11

Can you try following the advice in this forum thread: https://forums.coronalabs.com/topic/71572-build-error/

Modern Java’s want a pkcs12 format keystore instead of a pem based one.  You of course will need to change the names of the files in the command line command to what makes sense for you.

Rob

#12

Thanks Rob. I just read that thread and it looks REALLY promising. Will try it this morning and will report back. 

Steve

#13

Rob and Agramonte (and Ian/KeystageFun from the other thread);

I have really, really good news. Rob’s suggested solution from the other post worked and I now have a “new” keystore of format type “pkcs12”.  This “new” keystore was created using keytool by importing the old keystore and exporting it.

This “new” signing certificate (keystore) no longer throws the “ERROR: Build Failed: Error code: 256” when I build. That’s the problem that began this thread. 

Most important – This “new” signing certificate (keystore) is accepted by Google Play as the same certificate that has signed all of my apps for about 5 years. Hurrah. 

I had to futz a bit with the key tool command and had the similar experience that Ian had with passwords. And I have now returned to using JDK 1.8 (remember, to solve a Google Play signing problem last year – which was clearly related – my solution then was to revert to Java 6 because Google would accept my Corona builds if that was the Java base).

My full key tool command line was this (insert your own keystore file name, alias and passwords):

keytool -importkeystore -srckeystore adveractive_release.keystore -destkeystore adveractive_release.keystore -srcstoretype JKS -deststoretype pkcs12 -srcstorepass PASSWORD -deststorepass PASSWORD -srcalias ALIAS -destalias ALIAS -srckeypass KEYPASSWORD -destkeypass KEYPASSWORD -noprompt

And it executed successfully and returned these two “warnings”:

Warning:  Different store and key passwords not supported for PKCS12 KeyStores. Ignoring user-specified -destkeypass value.

Warning:  Migrated “adveractive_release.keystore” to Non JKS/JCEKS. The JKS keystore is backed up as “adveractive_release.keystore.old”.

I am a very relieved developer. Thank you for the guidance Rob.

Best;

Steve