APK is signed with Signature Scheme V3

[mouse_bear]

Some of you may have encountered this error prompt recently when uploading your APK:

ERROR: APK is signed with Signature Scheme V3, which is not yet supported. Please disable signing with Scheme V3 and upload again.

Our build upload and scanning process in the past has only supported v1 APK signing. However, recent change in the process now fully enforces v1 APK signing, resulting in the message you are seeing now.

As such, if you're using Unity, you should be able to use Gradle to v1 sign. To do so, make sure you generate a custom Gradle template (https://docs.unity3d.com/Manual/android-gradle-overview.html), which should create a file called mainTemplate.gradle. Open this file in your preferred text editor and add in the following line:

v2SigningEnabled false

A perfect example of what the mainTemplate.gradle file should look like can be found here: https://developer.android.com/about/versions/nougat/android-7.0#apk_signature_v2

If you are not using Unity or prefer not to use Gradle (and want to use the regular internal build system instead), you can use jarsigner (found in your JDK bin folder) to sign your built APK with v1. To do so, use the following command (replacing the variables in <> with your app's specific arguments):

jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore <KEYSTORE> -storepass <STOREPWD> -keypass <KEYPWD> <APKFILE> <ALIASNAME>

[KeithMyers]

Hello community, I am having issues trying to get V2 signing turned off despite following the above advice from @NinjaGG and @pld_google

The attempted upload via the OVR Platform tool will not let me upload to my alpha build channel, after I have created a custom gradle template and turned off V2 signing.  Any advice?  

[KeithMyers]

"ERROR: APK is signed with Signature Scheme V2, which is not yet supported. Please disable signing with Scheme V2 and upload again" 😞

[Heaney-555]

ruibalp-oculus said:

@mcc - If we added a feature to allow V2/V3 signatures for Go but prevented the binary from being visible to Gear VR, would something like that work?

Please do this, especially now that Gear VR support is dropped from the SDK!

[quentindecagny]

I just tried everything to add those lines (v1Signing...) in the maintemplate, but none of my dozens (without exaggeration) of attempts seemed to be able force v1 instead of v2 signing. Can someone explain here how to use this maintemplate as if i were new to Unity (which i'm absolutely not) ?
My current work version 2019.3.0

[Anonymous]

This is really something very annoying and weird at the same time. I
spent a whole day trying to fix this signing error. First in my case I
was trying to upload the app through the web portal and everytime it
just hangs in the uploading process without any error. After some
investigation I found the command line tool and only then I was able to
see that there's an issue with the signing. Dashboard web didn't say
anything it just hangs showing a random (1/3) or (2/3) progress.

Using
the command line I got the error "APK was signed with V2 which is not
compatible" .. then I get to this thread. I enabled the "Custom gradle
template" option and inserted the following code in the template
(following the above advice):

**SIGN**
  // Add this block just below **SIGN**
  signingConfigs {
    release {
      v1SigningEnabled true
      v2SigningEnabled false
    }
}

However,
this didn't work and my surprise was when I saw that Unity for whatever
reason, was overwriting the false by a true. So when I check the
template generated during the build (in my case:
Temp/GradleOut/build.gradle) I can see how Unity during the build
overwrote the false with a "true". So the generated template in my case
was something like:

signingConfigs {
    release {
        storeFile file('PATH_TO_MY_KEYSTORE')
        storePassword 'XXX'
        keyAlias 'XXX'
        keyPassword 'XXX'
    v2SigningEnabled true
    }
}
signingConfigs {
  release {
    v1SigningEnabled true
    v2SigningEnabled true
  }
}

So
to skip this weird behaviour what I did is just to keep saving the
"build.gradle" file during the build process (this way I overwrite the
one generated by Unity) and this actually works and I could upload the
app. But this is really, nasty and ugly trick .. I don't even dare to
call it a "workaround" .. it seems that Unity is not respecting what
I'm putting in the template and just put true for the v2SigningEnabled
no matter what I had put in the template.

EDIT: 
I find the the culprit, it's the script OVRGradleGeneration.cs as explained in the following post [1]. To fix the issue in my case I just deleted the whole Oculus OVR asset in Unity since I was not using OVR for anything.

To check that your apk has actually been generated correctly, you can use the apksigner to verify which signatures are included, for example:

apksigner.bat verify --verbose myapp.apk

Verified using v1 scheme (JAR signing): true

Verified using v2 scheme (APK Signature Scheme v2): false

Number of signers: 1

BTW: my Unity version is 2018.4.19f1
[1] forum.unity.com/threads/how-to-modify-build-gradle-in-a-build-script.720656/