Android project Signature Details

In Android
All installations in the system
To
Each application of the system must have a digital certificate that identifies the author of the application and establishes a trust relationship between the application.
The protectionlevel of permission is signature, so only those programs with this permission have the same digital certificate
To obtain the permission. Android uses Java's digital certificate-Related Mechanism
Come
To understand Android digital certificates, you must first understand the concept of digital certificates and the Java digital certificate mechanism. Android system requires every installation in the system
All applications are signed by a digital certificate, and the private key of the digital certificate is stored in the hands of the program developer. Android uses a digital certificate to identify the author of an application and create a token between applications.
It is not used to determine which applications the end user can install. This digital certificate does not need to be authenticated by an authoritative Digital Certificate Signing Authority. It is only used to authenticate the application package.

I. Multiple programs of the same developer should use the same digital certificate whenever possible
, Which can bring the following benefits.

(1) It is conducive to program upgrade. When the digital certificates of the New and Old programs are the same, the android system considers the two programs as different versions of the same program. If the digital certificates of the New and Old programs are different, the android system considers them different programs and conflicts with each other, and requires the new program to change the package name.

(2) facilitates modular design and development of programs. The Android system allows a program with the same digital signature to run in a process. The Android program regards them as the same program. Therefore, developers can develop their programs into modules, and users only need to download the appropriate modules as needed.

(3)

Data and code can be shared among multiple programs through permission. Android provides a digital certificate-based permission granting mechanism for applications to work with other programs.
To those programs that have the same digital certificate as their own. If the protectionlevel of a permission (permission) is signature,
Then, this permission can only be granted to programs with the same digital certificate as the package where the permission is located.

When signing a signature, consider numbers.Certificate validity period
:

(1) The validity period of the digital certificate must include the expected life cycle of the program. Once the digital certificate expires, the program holding the certificate cannot be upgraded normally.

(2) If multiple programs use the same digital certificate, the validity period of the digital certificate should include the estimated life cycle of all programs.

(3) Android Market requires that the digital certificates of all applications be valid until January 1, October 22, 2033.

II. The Android digital certificate contains the following key points:

(1)All applications must have digital certificates.
Android does not install an application without a digital certificate.

(2) the digital certificate used by the android package can be self-Signed and does not require signature authentication by an authoritative Digital Certificate Authority.

(3)To be officially released
An android system must use a digital certificate generated by a suitable private key to sign the program.
But cannot use the ADT plug-in.
Or ant Tool
The generated debugging certificate to publish.

(4) digital certificates all haveValidity Period
Android only checks the validity period of the certificate when the application is installed. If the program has been installed in the system, the normal functions of the program will not be affected even if the certificate expires.

(5) Android uses standard Java toolsKeytool and jarsigner
To generate a digital certificate and sign the application package.

(6) UseZipalign
Optimization
Program.

Android

The system will not install and run any unsigned APK program, either on the simulator or on the actual physical device. Both Android development tools (ADT plug-in and ant) can work together
Developers can sign the APK program in two modes: debug mode and release mode ).

In the debugging mode, the android development tool uses the digital certificate used for debugging to sign the program at each compilation. Developers do not need to worry about it.

To publish a program, developers need to use their own digital certificates to sign the APK package. There are two methods.

(1) Use JDK and keytool (used to generate digital certificates) and jarsigner (used to sign digital certificates) in the command line to sign the APK package.

(2) Use ADT export wizard for signature (if there is no digital certificate, you may need to generate a digital certificate ).

 

3. Two signature methods

 

 

The first signature method,
Use keytool and jarsigner to sign the program (
For versions earlier than 1.5

)

Command:Keytool-genkey-v-keystore Android. keystore-alias Android-keyalg RSA-validity 20000

The
In the command,-keystore ophone. keystore indicates the generated certificate. You can add the path (in the user's main directory by default);-alias ophone
Indicates that the certificate alias is ophone;-keyalg RSA indicates the RSA algorithm used;-validity 20000 indicates that the certificate is valid for 20000 days.

At this point, we will see ophone. keystore in the mutual use home directory, that is, the certificate we just created.

 

 

 

 

 

Method 2: Introduce the APK signature method for Android 1.5 and later versions.

 

 

1. Open eclipse-> select the project you want to sign-> right-click-> Android tools-> export signed application package...

2. Exit the window.

 

 

3. If the project checks check item name is correct, click Next.
Then, jump out of the keystore selection. If there is an existing keystore file, select and enter the keystore password next to sign it.
If not, select create new keystore and then select the location where the keystore is saved, set the keystore password, and click Next.

 

4. Fill in the basic information of the keystore, such as, alias, password, validity period, name, organization, organization name, city, province, and country. Click Next

5. Select the Save location of the signed APK. Click Finish.

 

6. You can find the corresponding signed APK file in your saved location.

 

 

 

From: http://yangguangfu.iteye.com/blog/723182