Ionic Cordova Android – does using the Cordova buildConfig to sign also zip align?

Issue

I build and sign the Android version of my Ionic application using a a build.jsonfile`.

So in the build.jsonI have

    {
      "android": {
        "debug": {
          "keystore": "MyApp.keystore",
          "storePassword": "mypassword",
          "alias": "MyApp",
          "password": "mypassword",
          "keystoreType": ""
        },
        "release": {
          "keystore": "MyApp.keystore",
          "storePassword": "mypassword",
          "alias": "MyApp",
          "password": "mypassword",
          "keystoreType": ""
        }
      }
    }

And then I will build using…

ionic cordova build android --prod --release --buildConfig=platform_build_files/android/build.json

This produces my signed file in one command. I have just (alarmingly!) realised I have forgotten all about the zipalign I see mentioned everywhere.

My question is, does the above also zipalign? If not, how can I also include this (can I run it as an npm script so I can easily call it all via npm run?

Solution

I had the same concern as you and cordova docs do not cover this. I have only found, after reading your question, a GH issue which mentions that zipalign seems to be used. https://github.com/apache/cordova-android/issues/1077

Now, if you read the GH issue and the zipalign docs, it says that when you zipalign matters, before or after the signing, depending on how you sign the APK, e.g. jarsigner vs apksigner. However, if you read all the comments, it seems that Android Gradle Plugin seems to be doing all the work and cordova team does not know what happens under the hood and is probably the reason they don’t mention anything in the docs.

The only thing that brought me peace was checking if the resulting signed APK is indeed aligned by running:
zipalign -c -v 4 platforms/android/app/build/outputs/apk/release/app-release.apk

If it succeeds, it will end with Verification successful. If it fails, it will end with Verification FAILED. You can exclude the lines with OK to see which ones fail:
zipalign -c -v 4 platforms/android/app/build/outputs/apk/release/app-release.apk | grep -v OK (or | grep BAD if you prefer)

Here is the interesting part now. I have verified the generated APK by removing the --buildConfig flag (so the output is not signed) and, interestingly, the APK is still passing the zipalign check. Note that I’m using cordova 11.0.0 if that matters. I’ve heard that only cordova 8.0.0+ zipaligns, probably depending the Android Gradle plugin shipped with cordova, but I couldn’t confirm it due to lack of documentation.

Answered By – Silviu Burcea

This Answer collected from stackoverflow, is licensed under cc by-sa 2.5 , cc by-sa 3.0 and cc by-sa 4.0