AAB-files get signed, but not APK-files

Description

When I publish a specific project to Android I get two AAB-files, one unsigned and one signed, and an APK-file that should be signed but isn’t. I verify this with the keytool command. If I do the same on a new MAUI application the APK will be signed.

I suspect this is a bug. I get same result both in .NET 6 and .NET 7.

Steps to Reproduce

Run this to get code and publish:

git clone https://github.com/pekspro/RadioStorm.git

cd .\RadioStorm\Source\Pekspro.RadioStorm.MAUI\

keytool -genkey -v -keystore signtest.keystore -alias signtest -keyalg RSA -keysize 2048 -validity 10000
(Enter stuff, use password 1234568)

dotnet publish Pekspro.RadioStorm.MAUI.csproj --framework:net6.0-android --configuration:Release /p:AndroidSigningKeyStore=./signtest.keystore /p:AndroidKeyStore=True  /p:AndroidSigningKeyAlias=signtest /p:PublishTrimmed=False /p:AndroidSigningKeyPass=12345678 /p:AndroidSigningStorePass=12345678  /p:RunAOTCompilation=False --verbosity normal

Run this to verify output:

keytool -printcert -jarfile .\bin\Release\net6.0-android\com.pekspro.radiostorm-Signed.aab

This outputs the signature.

keytool -printcert -jarfile .\bin\Release\net6.0-android\com.pekspro.radiostorm-Signed.apk

This says: “Not a signed jar-file”

Link to public reproduction project repository

https://github.com/pekspro/RadioStorm

Version with bug

7.0 Release Candidate 2

Last version that worked well

Unknown/Other

Affected platforms

Android

Affected platform versions

Windows 10.0.17763.0, Android 11

Did you find any workaround?

No response

Relevant log output

It’s a lot of logs 😃 This is the best I found:

_Sign:
         C:\Program Files\Microsoft\jdk-11.0.12.7-hotspot\bin\jarsigner.exe -keystore ./signtest.keystore -storepass 12
         345678 -keypass 12345678 -digestalg SHA-256 -sigalg SHA256withRSA -signedjar bin\Release\net6.0-android\com.pe
         kspro.radiostorm-Signed.aab obj\Release\net6.0-android\android\bin\com.pekspro.radiostorm.aab  signtest
         jar signed.
         The signer's certificate is self-signed.
         Signed android package ''
       _CreateUniversalApkFromBundle:
         Deleting file "obj\Release\net6.0-android\android\bin\com.pekspro.radiostorm-Universal.apks".
         C:\Program Files\Microsoft\jdk-11.0.12.7-hotspot\bin\java.exe -Xmx1G -jar "C:\Program Files\dotnet\packs\Micro
         soft.Android.Sdk.Windows\32.0.476\tools\bundletool.jar" build-apks --mode universal --bundle obj\Release\net6.
         0-android\android\bin\com.pekspro.radiostorm.aab --output obj\Release\net6.0-android\android\bin\com.pekspro.r
         adiostorm-Universal.apks --aapt2 "C:\Program Files\dotnet\packs\Microsoft.Android.Sdk.Windows\32.0.476\tools\a
         apt2.exe" --ks ./signtest.keystore --ks-key-alias signtest --key-pass pass:12345678 --ks-pass pass:12345678
       PrepareForPublish:
         Creating directory "bin\Release\net6.0-android\publish\".

[jonathanpeppers]

If you have a repro that is command-line, can you file an issue here:

https://github.com/google/bundletool/issues

If you can give them an .aab file and an example command showing it’s broken, maybe Google will fix it? If they can see the issue without building a C#/.NET app, they might know what is going on.

[jonathanpeppers]

@pekspro when you reproduce the issue with dotnet build, can you add -bl to your command? This will put an msbuild.binlog in the current directory. Can you share it here?