NeoApk: pure Kotlin engine for ZIP, 16KB alignment and APK signing

⚡ The gist in 5 seconds - The point: NeoApk is a pure Kotlin/JVM library (package top.nkbe.nza) for building, aligning and signing Android APKs. One tool combines a ZIP engine, a 16KB page-alignment packager and a V2/V3 signer. - Where available: sources on GitHub (HSSkyBoy/NeoApk), coordinates top.nkbe:NeoApk:1.0.1, connected via mavenLocal() or composite build. - Limitation: requires JDK 21; building from sources requires Kotlin 2.1.x. Reading BKS keystores requires the BouncyCastle provider on the JVM. ### 🔍 What was found NeoApk is a pure Kotlin library with no runtime dependencies and no native binaries; it runs on desktop JVMs and on Android. The project replaces three separate parts of the APK toolchain: a resilient ZIP reader/writer instead of apkzlib, ABI-aware alignment instead of zipalign, and APK Signature Scheme v2/v3 signing instead of apksigner. NeoApk is the packaging engine of NPatch, which is cited as an example of real-world usage. The ZIP engine can read archives with malformed/truncated/non-standard headers, write entries sequentially through a 128KB buffer, copy compressed bytes without re-inflating/deflating, embed whole APKs as STORED host entries, and create virtual entries for files inside them. ZIP64 is supported for archives larger than 4GB and with more than 65,535 entries. Alignment: STORED entries are aligned automatically — for host entries and lib/arm64-v8a, lib/x86_64 it is 16384 bytes, for other .so files 4096, and for resources.arsc and the rest 4. Virtual entries inherit the host's alignment. The V2V3SchemeSigner signs APKs in place under v2/v3, with v3 declaring an SDK range of 28..Int.MAX_VALUE. For APKs up to 2GB an APK Verity Merkle tree is added; above 2GB the verity algorithms are disabled to avoid integer overflow on Android 15. When signing, the existing APK Signing Block is replaced, and META-INF/ is left untouched. ### 💡 Why it matters NeoApk covers three typical APK repacking tasks with a single tool in pure Kotlin with no external dependencies. For Android developers this simplifies building or modifying packages: instead of the zipalign + apksigner + separate ZIP library combo, you need one API with 16KB alignment support, resilient reading and signing. The absence of native components and runtime dependencies makes integration into JVM and Android projects easier, and the built-in host/virtual entries allow compact and fast packaging of nested APKs. ### 🧩 Context The project is published on GitHub. The top.nkbe.nza library is available as top.nkbe:NeoApk:1.0.1; installation is possible via local Maven (./gradlew publishToMavenLocal) or composite build, as NPatch does. The public API is annotated with @JvmStatic/@Throws, so consumers can use it from plain Java. RSA keys (PSS and PKCS#1 v1.5), ECDSA and DSA are supported, as well as BKS, JKS, PKCS12 keystores or in-memory keys.

🔗 Read on github.com