How do I sign an apk with a private key I made with GPG?

Question

Is this even possible? I have a key-pair that I already made with GPG but I just can't find a way to sign it with that key. I don't really want to make a new key with keytool or whatever just for this; I'd rather use the key I have now. Anybody know how I could do this? Thanks in advance.

Answer 1

I very much doubt that GPG generates keys that could be used by jarsigner. It might be possible to write a converter to do this, but it would be far less work to just bite the bullet and generate a new key. The command to do this is simply

keytool -genkey -alias mynickname -validity 20000 -keystore ~/.android/my-keystore

(p.s. make a backup of the key and make very sure you don't forget either the keystore password or the key password. There are far too many sad stories of people who've put apps on the market and then forgotten or lost the password.)

Answer 2

I just wanna manage the OpenPGP keys only too. So here is my way.

openpgp2ssh

First install it from monkeysphere.

sudo apt install monkeysphere

Note: openpgp2ssh works only if the secret key is not password-protected and RSA keys. So it might be necessary to remove the protection.

Now, export the PGP key and hand it over to openpgp2ssh:

gpg --list-keys # show your keys with keyid.
gpg --export-secret-subkeys your@email | openpgp2ssh $SubKeyId > id_rsa
openssl rsa -in id_rsa -outform pem > key.pem
openssl req -new -key key.pem -out request.pem
openssl x509 -req -days 9999 -in request.pem -signkey key.pem -out certificate.pem
openssl pkcs8 -topk8 -outform DER -in key.pem -inform PEM -out key.pk8 -nocrypt