android-包签名
应用能在Android 系统上安装必须是经过有私有key的证书数据签名。Android系统通过证书确定应用的作者，和与应用建立信任关系。证书不会用于控制应用的安装。证书不需要权威机构签名：它是非常完美和标准。
关于签名的一些重要点：
· 所有的应用必须签名(android有默认签名)。
· 测试和调试应用，构建工具用指定的调试密钥(android sdk构建工具创建的)签名你的应用。
· 在发布给终端用户之前要用合适的密钥签名应用，不能用调试密钥签名将要发布的应用。
· 可以用自己签名的证书签名自己的应用。
· Android系统仅仅会在应用安装的时候检查证书的有效期。如果应用在安装之后过期，那么应用还会正常运行。
· 我们可以用标准的工具-Keytool和 Jarsigner - 生成密钥和签名应用。
· 在完成签名之后，发布之前，需要使用zipalign工具优化最终的apk 包。
Android 系统不能安装和运行没有正确签名的包。
签名过程
Android 签名应用与构建方式有关，不同构建方式会导致签名过程的不同。这里有两个构建方式：调试模式和发布模式。调试模式在开发和测试的情况下使用，发布模式是在将要发布应用给用户的时候才会使用的(比如发布到Google Play)。
When you build in debug mode the Android SDK buildtools use the Keytool utility (included in the JDK) to create a debug key.Because the SDK build tools created the debug key, they know the debug key'salias and password. Each time you compile your application in debug mode, thebuild tools use the debug key along with the Jarsigner utility (also includedin the JDK) to sign your application's .apk file. Because the alias andpassword are known to the SDK build tools, the tools don't need to prompt youfor the debug key's alias and password each time you compile.
When you build in release mode you use your own privatekey to sign your application. If you don't have a private key, you can use theKeytool utility to create one for you. When you compile your application inrelease mode, the build tools use your private key along with the Jarsignerutility to sign your application's .apk file. Because the certificate andprivate key you use are your own, you must provide the password for thekeystore and key alias.
The debug signing process happensautomatically when you run or debug your application using Eclipse with the ADTplugin. Debug signing also happens automatically when you use the Ant buildscript with the debug option. You can automate the release signing process byusing the Eclipse Export Wizard or by modifying the Ant build script andbuilding with the release option.
签名策略
签名应用的方式会影响开发应用的方法。特别是在需要发布多个应用的时候。
一般，对于所有的开发者比较推荐的策略是所有的应用用同一个证书签名(在有效期之内)，这样做的原因是:
· 应用更新-当发布更新应用的时候，需要用相同的证书签名应用，这样可以保证用户很好的更新到新版本。当应用安装更新时，系统会把新版本中的证书与旧版本比较。如果证书匹配，包括证书数据和命令，系统才会允许安装更新，如果新版本的证书与旧版本的不匹配，那么必须改变应用的包名-这种情况，安装的是一个全新的应用。
· 应用模块化– Android系统允许拥有同样证书的应用运行在同一个线程中，如果应用需要，那么系统会认为他们是同一个应用。用这种方式你可以模块化部署应用，用户可以独立的更新它们。
· 代码/数据可以共享-Android 系统基于权限机制提供签名，以便一个应用可以暴露方法给其他的应用。
另外一个决定签名方式的重要因素是如何设置密钥的有效期。
· 如果计划支持单个应用的更新，我们必须保证密钥的有效期超过应用的有效期。有效时间最好是25年或者更长。当密钥的有效期失效，用将不能无缝地更新应用
· 如果用同一个证书签名多个应用，我们必须保证密钥的有效期足够长，设置密钥有效期的时候，要考虑应用依赖的应用的有效期。
· 如果我们计划发布应用到google play。密钥的有效期必须是在2033.10.22之后。google play 强制这些是为了保证用户能够无缝的更新应用到新的版本。
当我们再设计应用的时候， 要考虑这些要点。
签名基本设置
在开始之前，要保证Keytool和Jarsigner 工具都已经就绪，两个工具都在JDK中。通常，通过在PATH 中设置JAVA_HOME的方式以便SDK构建工具能找到。
如果在linux系统上开发，要保证系统用的是JDK的工具， 而不是gcj版本的。
调试模式签名
为了更加方便开发和调试应用，Android系统构建工具提供调试模式签名. 用调试模式构建应用的时候，SDK工具用Keytool自动创建调试密钥库和 密钥。这个密钥在构建应用的时候自动的签名应用，因此不需要手动的签名应用。
SDK 工具提供预定义的name/password创建keystore/key:
· Keystorename: "debug.keystore"
· Keystorepassword: "android"
· Keyalias: "androiddebugkey"
· Keypassword: "android"
· CN:"CN=Android Debug,O=Android,C=US"
如果需要改变keystore/key的位置和名字或者用自定义的keystore/key，都是做到的。 任何自定义的调试密钥都需要保证同一个密钥库和密钥。(To do so in Eclipse/ADT, go to Windows > Preferences > Android > Build.)
Caution: 应用不能用调试密钥签名去发布.
Eclipse Users
If you are developing in Eclipse/ADT(and have set up Keytool and Jarsigner as described above in Basic Setup for Signing), signing in debug modeis enabled by default. When you run or debug your application, ADT signs the.apk file with the debug certificate, runs zipalign on the package, theninstalls it on the selected emulator or connected device. No specific action onyour part is needed, provided ADT has access to Keytool.
Ant Users
If you are using Ant to build your.apk file, debug signing mode is enabled by using the debug option with theantcommand (assuming that you are using a build.xml file generated by theandroid tool). When you run ant debug to compile your app, the build scriptgenerates a keystore/key and signs the APK for you. The script then also alignsthe APK with the zipalign tool. No other action on your part is needed. ReadBuilding and Running Apps on the Command Line for more information.
调试证书期满
自签名证书在调试模式的时候签名应用，证书的有效期只有365天。
当证书过期，那么在构建的时候会发生错误。在ant构建中，错误内容：
debug:[echo Packaging bin/samples-debug.apk, and signing it with a debug key...[exec Debug Certificateexpired on 8/4/08 3:43 PM
In Eclipse/ADT, 相似的错误会出现在 Androidconsole.
为了解决这个问题, 简单的方法是删除 debug.keystore 文件. 文件的地址在 ~/.android/ on OS X and Linux, in C:\Documents andSettings\<user>\.android\ on Windows XP, and inC:\Users\<user>\.android\ on Windows Vista and Windows 7.
下次构建的时候， 构建工具会自动生成keystore和 调试密钥。
Note that, if your development machineis using a non-Gregorian locale, the build tools may erroneously generate analready-expired debug certificate, so that you get an error when trying to compileyour application. For workaround information, see the troubleshooting topic I can't compile my app because the build toolsgenerated an expired debug certificate.
发布密钥签名应用
发布应用给其他用户的时候，必须:
1. 生成一个合适的密钥
2. 用发布模式编译应用
3. 用私有密钥签名应用
4. Align the final APK package(压缩最后的包)
如果是用eclipse ADT开发，可以用导出向导编译，签名，对其应用。这个向导甚至可以帮助我们生成私有的密钥。可以参考Compile and sign with Eclipse ADT.
1. 生成私有密钥
在签名应用之前，保证有一个应用，私有密钥有以下特点：
· 自己拥有
· 能够说明个人，公司，或者机构拥有应用
· 有一个有效周期，这个周期要超过应用的周期。A validity period of more than 25 years is recommended.
If you plan to publish your application(s)on Google Play, note that a validity period ending after 22 October 2033 is arequirement. You can not upload an application if it is signed with a key whosevalidity expires before that date.
· 必须是android SDK tools生成的.
The key may be self-signed. If you donot have a suitable key, you must generate one using Keytool. Make sure thatyou have Keytool available, as described in Basic Setup.
To generate a self-signed key withKeytool, use the keytool command and pass any of the options listed below (andany others, as needed).
Warning: Keep your private key secure. Beforeyou run Keytool, make sure to read Securing Your Private Keyfor a discussion of howto keep your key secure and why doing so is critically important to you and tousers. In particular, when you are generating your key, you should selectstrong passwords for both the keystore and key.
Warning: Keep the keystore file you generatewith Keytool in a safe, secure place. You must use the same key to sign futureversions of your application. If you republish your app with a new key, GooglePlay will consider it a new app. For more information on settings that mustremain constant over the life of your app, see the Android Developer Blog post Things That Cannot Change.
| Keytool Option | Description |
| -genkey | Generate a key pair (public and private keys)： 生成密钥对(共有的和私有的) |
| -v | Enable verbose output.：允许输出 |
| -alias <alias_name> | An alias for the key. Only the first 8 characters of the alias are used. ：密钥的别名，仅仅前面八个字符会被使用 |
| -keyalg <alg> | The encryption algorithm to use when generating the key. Both DSA and RSA are supported. |
| -keysize <size> | The size of each generated key (bits). If not supplied, Keytool uses a default key size of 1024 bits. In general, we recommend using a key size of 2048 bits or higher. |
| -dname <name> | A Distinguished Name that describes who created the key. The value is used as the issuer and subject fields in the self-signed certificate. Note that you do not need to specify this option in the command line. If not supplied, Jarsigner prompts you to enter each of the Distinguished Name fields (CN, OU, and so on). ：这个名字说明谁创建了这个密钥。 |
| -keypass <password> | The password for the key. As a security precaution, do not include this option in your command line. If not supplied, Keytool prompts you to enter the password. In this way, your password is not stored in your shell history. ：密钥的密码 |
| -validity <valdays> | The validity period for the key, in days. Note: A value of 10000 or greater is recommended. ：密钥的有效期 |
| -keystore <keystore-name>.keystore | A name for the keystore containing the private key. |
| -storepass <password> | A password for the keystore. As a security precaution, do not include this option in your command line. If not supplied, Keytool prompts you to enter the password. In this way, your password is not stored in your shell history. ： keystore的密码 |
Here's an example of a Keytool commandthat generates a private key:
$ keytool -genkey -v -keystore my-release-key.keystore-alias alias_name -keyalg RSA -keysize 2048 -validity10000
Running the example command above,Keytool prompts you to provide passwords for the keystore and key, and toprovide the Distinguished Name fields for your key. It then generates thekeystore as a file called my-release-key.keystore. The keystore and key areprotected by the passwords you entered. The keystore contains a single key,valid for 10000 days. The alias is a name that you — will use later, to referto this keystore when signing your application.
For more information about Keytool,see the documentation athttp://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html
2. Compile theapplication in release mode
In order to release your applicationto users, you must compile it in release mode. In release mode, the compiledapplication is not signed by default and you will need to sign it with yourprivate key.
Caution: You can not release your applicationunsigned, or signed with the debug key.
With Eclipse
To export an unsigned APK from Eclipse, right-click theproject in the Package Explorer and select Android Tools > ExportUnsigned Application Package. Then specify the file location for the unsigned APK.(Alternatively, open yourAndroidManifest.xml file in Eclipse, select the Manifest tab, and click Exportan unsigned APK.)
Note that you can combine thecompiling and signing steps with the Export Wizard. See Compiling and signing with Eclipse ADT.
With Ant
If you are using Ant, you can enablerelease mode by using the release option with the ant command. For example, ifyou are running Ant from the directory containing your build.xml file, thecommand would look like this:
$ ant release
By default, the build script compilesthe application APK without signing it. The output file in your project bin/will be<your_project_name>-unsigned.apk. Because the applicationAPK is still unsigned, you must manually sign it with your private key and thenalign it using zipalign.
However, the Ant build script can alsoperform the signing and aligning for you, if you have provided the path to yourkeystore and the name of your key alias in the project's ant.properties file.With this information provided, the build script will prompt you for yourkeystore and alias password when you perform ant release, it will sign thepackage and then align it. The final output file in bin/ will instead be<your_project_name>-release.apk.With these steps automated for you, you're able to skip the manual proceduresbelow (steps 3 and 4). To learn how to specify your keystore and alias in theant.properties file, see Building and Running Apps on the Command Line.
3. Sign yourapplication with your private key
应用签名需要用到Jarsigner工具。确保Jarsigner和密钥都是可用状态。
To sign your application, you runJarsigner, referencing both the application's APK and the keystore containingthe private key with which to sign the APK. The table below shows the optionsyou could use.
| Jarsigner Option | Description |
| -keystore <keystore-name>.keystore | The name of the keystore containing your private key. |
| -verbose | Enable verbose output. |
| -sigalg | The name of the signature algorithim to use in signing the APK. Use the value SHA1withRSA. |
| -digestalg | The message digest algorithim to use in processing the entries of an APK. Use the value SHA1. |
| -storepass <password> | The password for the keystore. As a security precaution, do not include this option in your command line unless you are working at a secure computer. If not supplied, Jarsigner prompts you to enter the password. In this way, your password is not stored in your shell history. |
| -keypass <password> | The password for the private key. As a security precaution, do not include this option in your command line unless you are working at a secure computer. If not supplied, Jarsigner prompts you to enter the password. In this way, your password is not stored in your shell history. |
Here's how you would use Jarsigner tosign an application package called my_application.apk, using the examplekeystore created above.
$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystoremy_application.apkalias_name
Running the example command above,Jarsigner prompts you to provide passwords for the keystore and key. It thenmodifies the APK in-place, meaning the APK is now signed. Note that you cansign an APK multiple times with different keys.
Caution: As of JDK 7, the default signingalgorithim has changed, requiring you to specify the signature and digestalgorithims (-sigalg and -digestalg) when you sign an APK.
To verify that your APK is signed, youcan use a command like this:
$ jarsigner -verify my_signed.apk
If the APK is signed properly,Jarsigner prints "jar verified". If you want more details, you cantry one of these commands:
$ jarsigner -verify -verbosemy_application.apk
or
$ jarsigner -verify -verbose -certs my_application.apk
The command above, with the -certsoption added, will show you the "CN=" line that describes who createdthe key.
Note: If you see "CN=AndroidDebug", this means the APK was signed with the debug key generated by theAndroid SDK. If you intend to release your application, you must sign it withyour private key instead of the debug key.
For more information about Jarsigner,see the documentation athttp://docs.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html
4. Align thefinal APK package
Once you have signed the APK with yourprivate key, run zipalign on the file. This tool ensures that all uncompresseddata starts with a particular byte alignment, relative to the start of thefile. Ensuring alignment at 4-byte boundaries provides a performanceoptimization when installed on a device. When aligned, the Android system isable to read files with mmap(), even if they contain binary data with alignmentrestrictions, rather than copying all of the data from the package. The benefitis a reduction in the amount of RAM consumed by the running application.
The zipalign tool is provided with theAndroid SDK, inside the tools/ directory. To align your signed APK, execute:
$ zipalign -v 4 your_project_name-unaligned.apk your_project_name.apk
The -v flag turns on verbose output(optional). 4 is the byte-alignment (don't use anything other than 4). Thefirst file argument is your signed .apk file (the input) and the second file isthe destination .apk file (the output). If you're overriding an existing APK,add the -f flag.
Caution: Your input APK must be signed withyour private key before you optimize the package with zipalign. If you sign itafter using zipalign, it will undo the alignment.
For more information, read about the zipalign tool.
Compile andsign with Eclipse ADT
If you are using Eclipse with the ADTplugin, you can use the Export Wizard to export a signed APK (and even create a new keystore,if necessary). The Export Wizard performs all the interaction with the Keytooland Jarsigner for you, which allows you to sign the package using a GUI insteadof performing the manual procedures to compile, sign, and align, as discussedabove. Once the wizard has compiled and signed your package, it will alsoperfom package alignment withzipalign. Because the Export Wizard uses bothKeytool and Jarsigner, you should ensure that they are accessible on yourcomputer, as described above in the Basic Setup for Signing.
To create a signed and aligned APK inEclipse:
1. Selectthe project in the Package Explorer and select File > Export.
2. Openthe Android folder, select Export Android Application, and click Next.
The Export Android Application wizard nowstarts, which will guide you through the process of signing your application,including steps for selecting the private key with which to sign the APK (orcreating a new keystore and private key).
3. Completethe Export Wizard and your application will be compiled, signed, aligned, andready for distribution.
保护私有密钥
维护私有密钥对自己和对用户都是最重要的。如果私有密钥不被好好的保护，那么很有可能会被其他人盗用。
如果第三方在没有经过授权和允许的情况下管理你的密钥，那个人可以很容易的签名并且发布应用，达到替换你的应用和入侵你的应用。应用的数据将不会在安全。
私有的密钥在将来签名包的时候都有用。如果密钥丢失，那么将不能发布更新应用。你不能重新生成和之前一样的密钥。
Your reputation as a developer entitydepends on your securing your private key properly, at all times, until the keyis expired. Here are some tips for keeping your key secure:
· 选择非常强健的keystore和 key.
· 用Keytool生成密钥的时候，命令行不需要提供-storepass 和 -keypass 参数。如果提供了，那么密钥将会保存到shell 记录里面，那么其他的用户通过你的计算机可以访问。
· 相似的，当用Jarsigner签名应用的时候，在命令行里面不需要提供 -storepass和-keypass.
· 不要把密钥借给或者给予他人，不要让其他人知道你的keystore和key passwords.
· Keepthe keystore file containing your private key that you generate with the Keytool in a safe, secure place.
扫一扫
323
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
