APK (Android Package Kit) signing

[kgareis]

My customer (SR 695760353) had vmware create a custom APK for their Cisco model 860 IP phones, and vmware is saying that they need Cisco to sign the APK file. Is this something the Cisco IP phone developer team helps customers with?

[dstaudt]

Reading the SR notes, doing some reading, and based on past experience supporting Cisco Android device developers, a few thoughts:

• The customer should be able to install the unsigned APK via side-loading, if they enable installation of apps from unknown sources.  This can be enabled from the individual phone UI, or via EMM (i.e. Airwatch).  However, this is usually not a great idea...
• So, to be able to install from a 'known' source, the app must be registered with and installed from the Google Play Store.  Cisco could assume this role/responsibility (e.g. perhaps to publish it under the Cisco Google Play brand and make APK available for all mutual customers), however that would involve business negotiations/dev&support commitments/contracts/etc.  For this situation, probably the customer would act as if they developed the app themselves (essentially they commissioned it from VMWare) and publish it - for an enterprise org via a managed Play store
• To be able to publish the APK to an org's private/managed store, an org user would register as a Google Developer, generate a signing key, sign the app using Android SDK tools (i.e. apksigner), and upload it to their managed Play store.
• Once the app is in the org's Play store, it can be pushed via EMM/Airwatch.
• I don't know anything about Airwatch, but I assume the APK signature is not a requirement of Airwatch itself..?

[kigtogone]

That sounds like a complex process with the custom APK and signing requirements. It reminds me of how private servers like Null's Brawl provide modified APKs for games like Brawl Stars. While those APKs don’t require signing from the original developers, the process of creating and distributing APKs still needs attention to compatibility and security. Hopefully, the Cisco team can assist with the signing and make things smoother for your customer!

[brooksadam]

Thanks for reaching out. Cisco does not typically sign third-party or custom APK files, even if they’re intended for Cisco IP phones. If your customer is using a customized APK, it’s usually expected that the developer (in this case, VMware) signs it with their own certificate.

That said, you can contact your Cisco account team or open a TAC case to check if an exception can be made or if there's an alternative deployment method supported for the 860 series phones.