Flashing update.zip signed with OEM keys return "failed to verify whole-file signature" I have an update.zip which include an APK in the system/priv-app/ folder, a boot and shutdown animations and an SSH server among other things. I have the private and public keys of the OEM who sold me tablet so I used sigapk.jar to sign the update.zip file. The command I used is the following:

java -jar signapk.jar -w certificate.x509.pem key.pk8 update.zip update-signed.zip


Then after trying to flash this file via stock recovery using sideload (adb sideload update-signed.zip) I get the following error:

Verifying update package...
E:failed to verify whole-file signature
E:signature verification failed
Restarting adbd...
Installation aborted.


Previously, I was trying to flash the update.zip without signing it and the result was the following:

Verifying update package...
E:footer is wrong
E:signature verification failed
Restarting adbd...
Installation aborted.


Actually I do not know if the difference in the error (footer is wrong --> failed to verify whole-file signature) is because the keys are working or not, or maybe because the file didn't have any signature at all. Can someone help me with this and tell my why is it not working if I am using the OEM's .pem and .pk8 keys?

EDIT:

I also tried adding the certificate.x509.pem file inside the META-INF/com/android/otacert folder inside the update.zip file and then sign it, but that also didn't work.
You are on the right track.
The message &quot;failed to verify whole-file signature&quot;, means that the file could not be deemed valid for the provided certificate.
The missing error message indicates that this is the case as the signature could not be matched to the trusted certificate store:
https://android.googlesource.com/platform/bootable/recovery/+/2c6c23f651abb3d215134dfba463eb72a5e9f8eb/verifier.cpp#258
The Android application which runs while sideloading uses a different certificate store than the recovery:
https://source.android.com/devices/tech/ota/sign_builds#signatures-sideloading
Assuming the keys you have are valid for the recovery, you might get away with directly booting into recovery using fastboot, then selecting your signed ZIP from there.