代码之家 › 专栏 › 技术社区 › Fuzzical Logic

有没有办法检查应用程序签名是调试还是发布的?

license-key certificate security android

9

Fuzzical Logic · 技术社区 · 14 年前

这样做的目的是能够告诉他们的应用程序何时处于开发或发布状态,因为我需要能够告诉他们应该访问我的开发服务器还是生产服务器。

2 回复 | 直到 10 年前

1

4

Jens 13 年前

默认情况下,Eclipse使用的androiddebugkey(例如)具有 notAfter 日期和时间,在未来最多1年-这么短的价值是不被Android市场接受-你可以用它来区分开发人员签署的版本?或者。。你可以检查应用程序使用的公钥-让他们用应用程序的android.content.pm.Signature签署RPC请求?

PackageInfo pkgInfo = getPackageManager().getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);

for (Signature appSignature : pkgInfo.signatures) {
    // javax.security - NOT java.security!
    X509Certificate appCertificate = X509Certificate.getInstance(appSignature.toByteArray());
    // appCertificate.getNotAfter() can give you the date & time the cert expires
    // appCertificate.getPublicKey() can give you the public key you sign the RPC requests with.
    // appCertificate.getSubjectDN() will give you a Principal named "CN=Android Debug,O=Android,C=US" for any debug certificate that hasn't been handcrafted by the developer.
}

2

4

xtr 13 年前

static final String DEBUGKEY = 
      " key ";    


public static boolean signedWithDebugKey(Context context, Class<?> cls) 
{
    boolean result = false;
    try {
        PackageInfo pinfo = context.getPackageManager().getPackageInfo("your package name",PackageManager.GET_SIGNATURES);
        Signature sigs[] = pinfo.signatures;

        Log.d(TAG,sigs[0].toCharsString());

        if (DEBUGKEY.equals(sigs[0].toCharsString())) {
            result = true;
            Log.d(TAG,"package has been signed with the debug key");
        } else {
            Log.d(TAG,"package signed with a key other than the debug key");
        }

    } catch (android.content.pm.PackageManager.NameNotFoundException e) {
        return false;
    }

    return result;

}

复制编码的密钥,并替换DEBUGKEY的值“key”,它将正常工作。