How to sign custom OTA update .zip file with release keys - Android Q&A, Help & Troubleshooting

We have a kiosk application that needs to be able to periodically do OTA updates using our self-made OTA update .zip files.
Our custom OTA update .zip file have the following files:
/data/misc/adb/
adb_keys
/system
/priv-app/
MyApp.apk
/vendor/
build.prop
/META-INF/com/google/android/
update-binary
updater-script
We have used many different tablets like Galaxy Tab 3, Galaxy Tab 4 and Yoga 3, the only thing we have had to do is to replace the `mount` command arguments inside `updater-script` with the right ones for each tablet.
Of couse, since we do not have the release keys of each of these tablets, we have had to replace every Recovery with its own TWRP Recovery replacement, in order to be able to flash our custom OTA update file. All this worked like a charm every time.
Now we bought new tablets from a chinese manufacturer and when we tried to flash our OTA update package we got the following error:
Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.
From that message is clear that error occurred because the OTA update .zip file was not signed. So, I asked from the manufacturer the release keys and the instructions in order to sign our OTA update .zip file and being able to flash it.
The problem is that the manufacturer's engineers have no clue of how to do this (signing OTA update files so they don't get rejected by their Recovery), which seems like a very common problem because we asked in multiple manufacturers and nobody knows how to do this.
So, I would like to ask for your help since I cannot find the instructions on how to sign it. Anybody knows how to do it?

---

sebastiantoro84 said:
We have a kiosk application that needs to be able to periodically do OTA updates using our self-made OTA update .zip files.
Our custom OTA update .zip file have the following files:
/data/misc/adb/
adb_keys
/system
/priv-app/
MyApp.apk
/vendor/
build.prop
/META-INF/com/google/android/
update-binary
updater-script
We have used many different tablets like Galaxy Tab 3, Galaxy Tab 4 and Yoga 3, the only thing we have had to do is to replace the `mount` command arguments inside `updater-script` with the right ones for each tablet.
Of couse, since we do not have the release keys of each of these tablets, we have had to replace every Recovery with its own TWRP Recovery replacement, in order to be able to flash our custom OTA update file. All this worked like a charm every time.
Now we bought new tablets from a chinese manufacturer and when we tried to flash our OTA update package we got the following error:
Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.
From that message is clear that error occurred because the OTA update .zip file was not signed. So, I asked from the manufacturer the release keys and the instructions in order to sign our OTA update .zip file and being able to flash it.
The problem is that the manufacturer's engineers have no clue of how to do this (signing OTA update files so they don't get rejected by their Recovery), which seems like a very common problem because we asked in multiple manufacturers and nobody knows how to do this.
So, I would like to ask for your help since I cannot find the instructions on how to sign it. Anybody knows how to do it?
Click to expand...
Click to collapse
Got any answers?

---

Skrappy187 said:
Got any answers?
Click to expand...
Click to collapse
The answer is simple:
If you want to provide self-made OTA update you also have to use your own custom ROM. Then you are able to sign OS and OTA update using the same key.

---

To use testkeys at least the keys file must be changed in the recovery...