android-包签名
应用能在Android 系统上安装必须是经过有私有key的证书数据签名。Android系统通过证书确定应用的作者，和与应用建立信任关系。证书不会用于控制应用的安装。证书不需要权威机构签名：它是非常完美和标准。
关于签名的一些重要点：
- 所有的应用必须签名(android 有默认签名)。
- 测试和调试应用，构建工具用指定的调试密钥(android sdk 构建工具创建的)签名你的应用。
- 在发布给终端用户之前要用合适的密钥签名应用，不能用调试密钥签名将要发布的应用。
- 可以用自己签名的证书签名自己的应用。
- Android 系统仅仅会在应用安装的时候检查证书的有效期。如果应用在安装之后过期，那么应用还会正常运行。
- 我们可以用标准的工具-Keytool 和 Jarsigner - 生成密钥和签名应用。
- 在完成签名之后，发布之前，需要使用zipalign 工具优化最终的apk 包。
Android 系统不能安装和运行没有正确签名的包。
签名过程
Android 签名应用与构建方式有关，不同构建方式会导致签名过程的不同。这里有两个构建方式：调试模式和发布模式。调试模式在开发和测试的情况下使用，发布模式是在将要发布应用给用户的时候才会使用的(比如发布到Google Play)。
When you build in debug mode the Android SDK build tools use the Keytool utility (included in the JDK) to create a debug key. Because the SDK build tools created the debug key, they know the debug key's alias and password. Each time you compile your application in debug mode, the build tools use the debug key along with the Jarsigner utility (also included in the JDK) to sign your application's .apk file. Because the alias and password are known to the SDK build tools, the tools don't need to prompt you for the debug key's alias and password each time you compile.
When you build in release mode you use your own private key to sign your application. If you don't have a private key, you can use the Keytool utility to create one for you. When you compile your application in release mode, the build tools use your private key along with the Jarsigner utility to sign your application's .apk file. Because the certificate and private key you use are your own, you must provide the password for the keystore and key alias.
The debug signing process happens automatically when you run or debug your application using Eclipse with the ADT plugin. Debug signing also happens automatically when you use the Ant build script with the debug option. You can automate the release signing process by using the Eclipse Export Wizard or by modifying the Ant build script and building with the release option.
签名策略
签名应用的方式会影响开发应用的方法。特别是在需要发布多个应用的时候。
一般，对于所有的开发者比较推荐的策略是所有的应用用同一个证书签名(在有效期之内)，这样做的原因是:
- 应用更新-当发布更新应用的时候，需要用相同的证书签名应用，这样可以保证用户很好的更新到新版本。当应用安装更新时，系统会把新版本中的证书与旧版本比较。如果证书匹配，包括证书数据和命令，系统才会允许安装更新，如果新版本的证书与旧版本的不匹配，那么必须改变应用的包名-这种情况，安装的是一个全新的应用。
- 应用模块化– Android 系统允许拥有同样证书的应用运行在同一个线程中，如果应用需要，那么系统会认为他们是同一个应用。用这种方式你可以模块化部署应用，用户可以独立的更新它们。
- 代码/数据可以共享-Android 系统基于权限机制提供签名，以便一个应用可以暴露方法给其他的应用。
另外一个决定签名方式的重要因素是如何设置密钥的有效期。
- 如果计划支持单个应用的更新，我们必须保证密钥的有效期超过应用的有效期。有效时间最好是25年或者更长。当密钥的有效期失效，用将不能无缝地更新应用
- 如果用同一个证书签名多个应用，我们必须保证密钥的有效期足够长，设置密钥有效期的时候，要考虑应用依赖的应用的有效期。
- 如果我们计划发布应用到google play。密钥的有效期必须是在2033.10.22之后。google play 强制这些是为了保证用户能够无缝的更新应用到新的版本。
当我们再设计应用的时候， 要考虑这些要点。
签名基本设置
在开始之前，要保证Keytool和Jarsigner 工具都已经就绪，两个工具都在JDK中。通常，通过在PATH 中设置JAVA_HOME的方式以便SDK构建工具能找到。
如果在linux系统上开发，要保证系统用的是JDK的工具， 而不是gcj版本的。
调试模式签名
为了更加方便开发和调试应用，Android 系统构建工具提供调试模式签名. 用调试模式构建应用的时候，SDK工具用Keytool自动创建调试密钥库和 密钥。这个密钥在构建应用的时候自动的签名应用，因此不需要手动的签名应用。
SDK 工具提供预定义的name/password创建keystore/key:
- Keystore name: "debug.keystore"
- Keystore password: "android"
- Key alias: "androiddebugkey"
- Key password: "android"
- CN: "CN=Android Debug,O=Android,C=US"
如果需要改变keystore/key的位置和名字或者用自定义的keystore/key，都是做到的。 任何自定义的调试密钥都需要保证同一个密钥库和密钥。(To do so in Eclipse/ADT, go to Windows > Preferences > Android > Build.)
Caution: 应用不能用调试密钥签名去发布.
Eclipse Users
If you are developing in Eclipse/ADT (and have set up Keytool and Jarsigner as described above in Basic Setup for Signing), signing in debug mode is enabled by default. When you run or debug your application, ADT signs the .apk file with the debug certificate, runs zipalign on the package, then installs it on the selected emulator or connected device. No specific action on your part is needed, provided ADT has access to Keytool.
Ant Users
If you are using Ant to build your .apk file, debug signing mode is enabled by using the debug option with the antcommand (assuming that you are using a build.xml file generated by the android tool). When you run ant debug to compile your app, the build script generates a keystore/key and signs the APK for you. The script then also aligns the APK with the zipalign tool. No other action on your part is needed. Read Building and Running Apps on the Command Line for more information.
调试证书期满
自签名证书在调试模式的时候签名应用，证书的有效期只有365天。
当证书过期，那么在构建的时候会发生错误。在ant 构建中，错误内容：
debug:[echo]Packaging bin/samples-debug.apk,and signing it with a debug key...[exec]DebugCertificate expired on 8/4/083:43 PM
In Eclipse/ADT, 相似的错误会出现在 Android console.
为了解决这个问题, 简单的方法是删除 debug.keystore 文件. 文件的地址在 ~/.android/ on OS X and Linux, in C:\Documents and Settings\<user>\.android\ on Windows XP, and in C:\Users\<user>\.android\ on Windows Vista and Windows 7.
下次构建的时候， 构建工具会自动生成keystore 和 调试密钥。
Note that, if your development machine is using a non-Gregorian locale, the build tools may erroneously generate an already-expired debug certificate, so that you get an error when trying to compile your application. For workaround information, see the troubleshooting topic I can't compile my app because the build tools generated an expired debug certificate.
发布密钥签名应用
发布应用给其他用户的时候，必须:
- 生成一个合适的密钥
- 用发布模式编译应用
- 用私有密钥签名应用
- Align the final APK package(压缩最后的包)
如果是用eclipse ADT开发，可以用导出向导编译，签名，对其应用。这个向导甚至可以帮助我们生成私有的密钥。可以参考 Compile and sign with Eclipse ADT.
1. 生成私有密钥
在签名应用之前，保证有一个应用，私有密钥有以下特点：
- 自己拥有
- 能够说明个人，公司，或者机构拥有应用
- 有一个有效周期，这个周期要超过应用的周期。A validity period of more than 25 years is recommended.
If you plan to publish your application(s) on Google Play, note that a validity period ending after 22 October 2033 is a requirement. You can not upload an application if it is signed with a key whose validity expires before that date.
- 必须是android SDK tools 生成的.
The key may be self-signed. If you do not have a suitable key, you must generate one using Keytool. Make sure that you have Keytool available, as described in Basic Setup.
To generate a self-signed key with Keytool, use the keytool command and pass any of the options listed below (and any others, as needed).
Warning: Keep your private key secure. Before you run Keytool, make sure to read Securing Your Private Key for a discussion of how to keep your key secure and why doing so is critically important to you and to users. In particular, when you are generating your key, you should select strong passwords for both the keystore and key.
Warning: Keep the keystore file you generate with Keytool in a safe, secure place. You must use the same key to sign future versions of your application. If you republish your app with a new key, Google Play will consider it a new app. For more information on settings that must remain constant over the life of your app, see the Android Developer Blog post Things That Cannot Change.
| Keytool Option | Description |
|---|---|
-genkey |
Generate a key pair (public and private keys)： 生成密钥对(共有的和私有的) |
-v |
Enable verbose output.：允许输出 |
-alias <alias_name> |
An alias for the key. Only the first 8 characters of the alias are used. ：密钥的别名，仅仅前面八个字符会被使用 |
-keyalg <alg> |
The encryption algorithm to use when generating the key. Both DSA and RSA are supported. ：生成密钥的加密算法。支持：DSA 和 RSA |
-keysize <size>
|
The size of each generated key (bits). If not supplied, Keytool uses a default key size of 1024 bits. In general, we recommend using a key size of 2048 bits or higher. ：生成密钥的大小。如果支持，Keytool 使用默认的大小(1024位)。一般来讲，使用2048位 或者更大 |
-dname <name>
|
A Distinguished Name that describes who created the key. The value is used as the issuer and subject fields in the self-signed certificate. Note that you do not need to specify this option in the command line. If not supplied, Jarsigner prompts you to enter each of the Distinguished Name fields (CN, OU, and so on). ：这个名字说明谁创建了这个密钥。 |
-keypass <password>
|
The password for the key. As a security precaution, do not include this option in your command line. If not supplied, Keytool prompts you to enter the password. In this way, your password is not stored in your shell history. ：密钥的密码 |
-validity <valdays>
|
The validity period for the key, in days. Note: A value of 10000 or greater is recommended. ：密钥的有效期 |
-keystore <keystore-name>.keystore
|
A name for the keystore containing the private key. ：keystore 的名字 |
-storepass <password>
|
A password for the keystore. As a security precaution, do not include this option in your command line. If not supplied, Keytool prompts you to enter the password. In this way, your password is not stored in your shell history. ： keystore的密码 |
Here's an example of a Keytool command that generates a private key:
$ keytool -genkey -v -keystore my-release-key.keystore
-alias alias_name -keyalg RSA -keysize 2048-validity 10000
Running the example command above, Keytool prompts you to provide passwords for the keystore and key, and to provide the Distinguished Name fields for your key. It then generates the keystore as a file called my-release-key.keystore. The keystore and key are protected by the passwords you entered. The keystore contains a single key, valid for 10000 days. The alias is a name that you — will use later, to refer to this keystore when signing your application.
For more information about Keytool, see the documentation athttp://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html
2. Compile the application in release mode
In order to release your application to users, you must compile it in release mode. In release mode, the compiled application is not signed by default and you will need to sign it with your private key.
Caution: You can not release your application unsigned, or signed with the debug key.
With Eclipse
To export an unsigned APK from Eclipse, right-click the project in the Package Explorer and select Android Tools > Export Unsigned Application Package. Then specify the file location for the unsigned APK. (Alternatively, open yourAndroidManifest.xml file in Eclipse, select the Manifest tab, and click Export an unsigned APK.)
Note that you can combine the compiling and signing steps with the Export Wizard. See Compiling and signing with Eclipse ADT.
With Ant
If you are using Ant, you can enable release mode by using the release option with the ant command. For example, if you are running Ant from the directory containing your build.xml file, the command would look like this:
$ ant release
By default, the build script compiles the application APK without signing it. The output file in your project bin/ will be<your_project_name>-unsigned.apk. Because the application APK is still unsigned, you must manually sign it with your private key and then align it using zipalign.
However, the Ant build script can also perform the signing and aligning for you, if you have provided the path to your keystore and the name of your key alias in the project's ant.properties file. With this information provided, the build script will prompt you for your keystore and alias password when you perform ant release, it will sign the package and then align it. The final output file in bin/ will instead be <your_project_name>-release.apk. With these steps automated for you, you're able to skip the manual procedures below (steps 3 and 4). To learn how to specify your keystore and alias in the ant.properties file, see Building and Running Apps on the Command Line.
3. Sign your application with your private key
应用签名需要用到Jarsigner工具。确保Jarsigner和密钥都是可用状态。
To sign your application, you run Jarsigner, referencing both the application's APK and the keystore containing the private key with which to sign the APK. The table below shows the options you could use.
| Jarsigner Option | Description |
|---|---|
-keystore <keystore-name>.keystore |
The name of the keystore containing your private key. ：keystore的名字 |
-verbose
|
Enable verbose output. ：输出详细内容 |
-sigalg
|
The name of the signature algorithim to use in signing the APK. Use the value SHA1withRSA.：签名应用的加密算法。值是SHA1withRSA |
-digestalg
|
The message digest algorithim to use in processing the entries of an APK. Use the value SHA1. |
-storepass <password>
|
The password for the keystore. As a security precaution, do not include this option in your command line unless you are working at a secure computer. If not supplied, Jarsigner prompts you to enter the password. In this way, your password is not stored in your shell history. |
-keypass <password>
|
The password for the private key. As a security precaution, do not include this option in your command line unless you are working at a secure computer. If not supplied, Jarsigner prompts you to enter the password. In this way, your password is not stored in your shell history. |
Here's how you would use Jarsigner to sign an application package called my_application.apk, using the example keystore created above.
$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore
my_application.apk alias_name
Running the example command above, Jarsigner prompts you to provide passwords for the keystore and key. It then modifies the APK in-place, meaning the APK is now signed. Note that you can sign an APK multiple times with different keys.
Caution: As of JDK 7, the default signing algorithim has changed, requiring you to specify the signature and digest algorithims (-sigalg and -digestalg) when you sign an APK.
To verify that your APK is signed, you can use a command like this:
$ jarsigner -verify my_signed.apk
If the APK is signed properly, Jarsigner prints "jar verified". If you want more details, you can try one of these commands:
$ jarsigner -verify -verbose my_application.apk
or
$ jarsigner -verify -verbose -certs my_application.apk
The command above, with the -certs option added, will show you the "CN=" line that describes who created the key.
Note: If you see "CN=Android Debug", this means the APK was signed with the debug key generated by the Android SDK. If you intend to release your application, you must sign it with your private key instead of the debug key.
For more information about Jarsigner, see the documentation athttp://docs.oracle.com/javase/6/docs/technotes/tools/windows/jarsigner.html
4. Align the final APK package
Once you have signed the APK with your private key, run zipalign on the file. This tool ensures that all uncompressed data starts with a particular byte alignment, relative to the start of the file. Ensuring alignment at 4-byte boundaries provides a performance optimization when installed on a device. When aligned, the Android system is able to read files with mmap(), even if they contain binary data with alignment restrictions, rather than copying all of the data from the package. The benefit is a reduction in the amount of RAM consumed by the running application.
The zipalign tool is provided with the Android SDK, inside the tools/ directory. To align your signed APK, execute:
$ zipalign -v 4your_project_name-unaligned.apk your_project_name.apk
The -v flag turns on verbose output (optional). 4 is the byte-alignment (don't use anything other than 4). The first file argument is your signed .apk file (the input) and the second file is the destination .apk file (the output). If you're overriding an existing APK, add the -f flag.
Caution: Your input APK must be signed with your private key before you optimize the package with zipalign. If you sign it after using zipalign, it will undo the alignment.
For more information, read about the zipalign tool.
Compile and sign with Eclipse ADT
If you are using Eclipse with the ADT plugin, you can use the Export Wizard to export a signed APK (and even create a new keystore, if necessary). The Export Wizard performs all the interaction with the Keytool and Jarsigner for you, which allows you to sign the package using a GUI instead of performing the manual procedures to compile, sign, and align, as discussed above. Once the wizard has compiled and signed your package, it will also perfom package alignment withzipalign. Because the Export Wizard uses both Keytool and Jarsigner, you should ensure that they are accessible on your computer, as described above in the Basic Setup for Signing.
To create a signed and aligned APK in Eclipse:
- Select the project in the Package Explorer and select File > Export.
- Open the Android folder, select Export Android Application, and click Next.
The Export Android Application wizard now starts, which will guide you through the process of signing your application, including steps for selecting the private key with which to sign the APK (or creating a new keystore and private key).
- Complete the Export Wizard and your application will be compiled, signed, aligned, and ready for distribution.
保护私有密钥
维护私有密钥对自己和对用户都是最重要的。如果私有密钥不被好好的保护，那么很有可能会被其他人盗用。
如果第三方在没有经过授权和允许的情况下管理你的密钥，那个人可以很容易的签名并且发布应用，达到替换你的应用和入侵你的应用。应用的数据将不会在安全。
私有的密钥在将来签名包的时候都有用。如果密钥丢失，那么将不能发布更新应用。你不能重新生成和之前一样的密钥。
Your reputation as a developer entity depends on your securing your private key properly, at all times, until the key is expired. Here are some tips for keeping your key secure:
- 选择非常强健的keystore 和 key.
- 用Keytool生成密钥的时候，命令行不需要提供-storepass 和 -keypass 参数。如果提供了，那么密钥将会保存到shell 记录里面，那么其他的用户通过你的计算机可以访问。
- 相似的，当用Jarsigner签名应用的时候，在命令行里面不需要提供 -storepass和-keypass.
- 不要把密钥借给或者给予他人，不要让其他人知道你的keystore和key passwords.
- Keep the keystore file containing your private key that you generate with the Keytool in a safe, secure place.
一般来讲，依照注意事项生成，使用和存储密钥，都可以保证它的安全性。