zipalign Before Signing: Verify Alignment Without Invalidating an APK

Understand what alignment changes

zipalign adjusts the positions of uncompressed data inside the ZIP container so Android can access it efficiently. Native libraries can require page alignment appropriate to the supported environment. This is a packaging concern, not Java bytecode optimization. zipalign documentation.

A smaller APK is not the purpose of this operation. Do not describe alignment as a general compressor or a fix for incompatible native code.

Use the correct order

A local illustrative sequence is:

zipalign -P 16 -f -v 4 unsigned.apk aligned.apk
apksigner sign --ks release.jks --out signed.apk aligned.apk
apksigner verify --verbose --print-certs signed.apk
zipalign -c -P 16 -v 4 signed.apk

Enter signing credentials securely. Check every command's exit status. The final -c operation verifies alignment without modifying the signed output. apksigner.

Let the standard build pipeline do its job

Normal Android Gradle release builds coordinate packaging, alignment and signing. Manual commands are useful for controlled diagnostics or specialized pipelines, but should not be added randomly after every Gradle build.

If a post-processing tool changes the APK, understand exactly where it sits in the pipeline. A valid signature report from before post-processing does not apply to the modified file.

Separate 16 KB packaging from native compatibility

Using -P 16 does not recompile a native library or fix its ELF load-segment alignment. Android's 16 KB page-size guidance also covers toolchain and runtime requirements. Check the actual .so files and execute relevant native paths on the intended environment.

This distinction matters for games and SDK-heavy apps: a neatly aligned archive can still contain an incompatible vendor binary.

Keep final-artifact evidence

Archive only the intended signed output as the release artifact, along with its hash, version and verification logs. Clearly label intermediate unsigned or aligned files so they cannot be accidentally uploaded or distributed.

APKLint's signing metadata view can help identify the output certificate, but it does not replace alignment or cryptographic verification. A production release should be traced to the exact final file, not merely to a successful earlier build step.