Android 安装过程一 界面跳转

安装Apk的代码

  应用安装Apk的代码如下：

			val intent = Intent(Intent.ACTION_VIEW)
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
            val apk = File(filesDir,"ff/ss.apk")
            val uri = FileProvider.getUriForFile(this, "$packageName.fileProvider", apk)
            intent.setDataAndType(uri, "application/vnd.android.package-archive")
            startActivity(intent)

  AndroidManifest中provider配置路径的xml文件如下：

<?xml version="1.0" encoding="UTF-8" ?>
<paths>
    <external-path
        name="path1"
        path="/data/dir1"/>
    <files-path
        name="path2"
        path="/ff" />
</paths>

  这里uri的String为content://com.example.testapplication.fileProvider/path2/ss.apk。

进入包安装进程

进入InstallStart

  下面它会跳入另外一个进程"com.android.packageinstaller"（这里叫它包安装进程）中，首先会进入InstallStart。它是包安装进程中的一个Activity，它在AndroidManifest.xml指那个的配置 action为"android.intent.action.VIEW"，所以能通过该action找到它。首先进入InstallStart的onCreate()生命周期方法：

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        mPackageManager = getPackageManager();
        mUserManager = getSystemService(UserManager.class);
        Intent intent = getIntent();
        String callingPackage = getCallingPackage();
        String callingAttributionTag = null;

        final boolean isSessionInstall =
                PackageInstaller.ACTION_CONFIRM_INSTALL.equals(intent.getAction());

        // If the activity was started via a PackageInstaller session, we retrieve the calling
        // package from that session
        final int sessionId = (isSessionInstall
                ? intent.getIntExtra(PackageInstaller.EXTRA_SESSION_ID, -1)
                : -1);
        if (callingPackage == null && sessionId != -1) {
            PackageInstaller packageInstaller = getPackageManager().getPackageInstaller();
            PackageInstaller.SessionInfo sessionInfo = packageInstaller.getSessionInfo(sessionId);
            callingPackage = (sessionInfo != null) ? sessionInfo.getInstallerPackageName() : null;
            callingAttributionTag =
                    (sessionInfo != null) ? sessionInfo.getInstallerAttributionTag() : null;
        }

        final ApplicationInfo sourceInfo = getSourceInfo(callingPackage);
        final int originatingUid = getOriginatingUid(sourceInfo);
        boolean isTrustedSource = false;
        if (sourceInfo != null
                && (sourceInfo.privateFlags & ApplicationInfo.PRIVATE_FLAG_PRIVILEGED) != 0) {
            isTrustedSource = intent.getBooleanExtra(Intent.EXTRA_NOT_UNKNOWN_SOURCE, false);
        }

        if (!isTrustedSource && originatingUid != PackageInstaller.SessionParams.UID_UNKNOWN) {
            final int targetSdkVersion = getMaxTargetSdkVersionForUid(this, originatingUid);
            if (targetSdkVersion < 0) {
                Log.w(LOG_TAG, "Cannot get target sdk version for uid " + originatingUid);
                // Invalid originating uid supplied. Abort install.
                mAbortInstall = true;
            } else if (targetSdkVersion >= Build.VERSION_CODES.O && !isUidRequestingPermission(
                    originatingUid, Manifest.permission.REQUEST_INSTALL_PACKAGES)) {
                Log.e(LOG_TAG, "Requesting uid " + originatingUid + " needs to declare permission "
                        + Manifest.permission.REQUEST_INSTALL_PACKAGES);
                mAbortInstall = true;
            }
        }
        if (mAbortInstall) {
            setResult(RESULT_CANCELED);
            finish();
            return;
        }

        Intent nextActivity = new Intent(intent);
        nextActivity.setFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT
                | Intent.FLAG_GRANT_READ_URI_PERMISSION);

        // The the installation source as the nextActivity thinks this activity is the source, hence
        // set the originating UID and sourceInfo explicitly
        nextActivity.putExtra(PackageInstallerActivity.EXTRA_CALLING_PACKAGE, callingPackage);
        nextActivity.putExtra(PackageInstallerActivity.EXTRA_CALLING_ATTRIBUTION_TAG,
                callingAttributionTag);
        nextActivity.putExtra(PackageInstallerActivity.EXTRA_ORIGINAL_SOURCE_INFO, sourceInfo);
        nextActivity.putExtra(Intent.EXTRA_ORIGINATING_UID, originatingUid);

        if (isSessionInstall) {
            nextActivity.setClass(this, PackageInstallerActivity.class);
        } else {
            Uri packageUri = intent.getData();

            if (packageUri != null && packageUri.getScheme().equals(
                    ContentResolver.SCHEME_CONTENT)) {
                // [IMPORTANT] This path is deprecated, but should still work. Only necessary
                // features should be added.

                // Copy file to prevent it from being changed underneath this process
                nextActivity.setClass(this, InstallStaging.class);
            } else if (packageUri != null && packageUri.getScheme().equals(
                    PackageInstallerActivity.SCHEME_PACKAGE)) {
                nextActivity.setClass(this, PackageInstallerActivity.class);
            } else {
                Intent result = new Intent();
                result.putExtra(Intent.EXTRA_INSTALL_RESULT,
                        PackageManager.INSTALL_FAILED_INVALID_URI);
                setResult(RESULT_FIRST_USER, result);

                nextActivity = null;
            }
        }

        if (nextActivity != null) {
            startActivity(nextActivity);
        }
        finish();
    }

  首先通过getCallingPackage()得到调用方的包名，放到变量callingPackage中。
  接着通过intent的action是否等于PackageInstaller.ACTION_CONFIRM_INSTALL来判断是否是PackageInstaller session安装，如果是，会去intent中取出SESSION_ID，并且得到SessionInfo信息，并从中得到callingPackage、callingAttributionTag。
  接着再通过getSourceInfo(callingPackage)得到调用方的ApplicationInfo，getOriginatingUid(sourceInfo)得到调用方的uid。
  接着判断是否是信任的安装源，在sourceInfo.privateFlags存在ApplicationInfo.PRIVATE_FLAG_PRIVILEGED时，如果传过来的intent中有Intent.EXTRA_NOT_UNKNOWN_SOURCE的值为true时，就是信任的。
  如果是信任的，就不用去检查Manifest.permission.REQUEST_INSTALL_PACKAGES权限，如果是不信任的，需要检查应用是否有Manifest.permission.REQUEST_INSTALL_PACKAGES权限，这个权限是要在安装APP的应用中声明的。
  Manifest.permission.REQUEST_INSTALL_PACKAGES权限是在Build.VERSION_CODES.O版本及之后才有的，所以需要先找到安装应用的目标Sdk，如果没有也会报错；如果目标Sdk版本比Build.VERSION_CODES.O版本之后，就需要检查Manifest.permission.REQUEST_INSTALL_PACKAGES权限。
  如果没得到目标sdk版本及没声明Manifest.permission.REQUEST_INSTALL_PACKAGES权限都会报错返回。
  接着会复制intent，得到nextActivity，然后给nextActivity设置Intent.FLAG_ACTIVITY_FORWARD_RESULT|Intent.FLAG_GRANT_READ_URI_PERMISSION标签。
  接着向新生成的Intent对象里面添加数据，包括调用者包名callingPackage、调用者AttributionTag、调用者的应用信息、调用者的uid。
  若是是PackageInstaller session安装，直接就跳转到PackageInstallerActivity中去；如果得到的URI的getScheme()是ContentResolver.SCHEME_CONTENT，则会跳转到InstallStaging中，我们的例子就是属于这种；如果得到的URI的getScheme()是PackageInstallerActivity.SCHEME_PACKAGE，则会跳转到PackageInstallerActivity中；如果不是以上情况，则返回PackageManager.INSTALL_FAILED_INVALID_URI给调用者Activity。
  最后就是跳转，并且关闭InstallStart。

进入InstallStaging

  InstallStaging 在InstallStart 中根据Uri的scheme是Content，跳转到该Activity中。 该Activity是用来缓存APK文件的。
  它是继承AlertActivity，界面是以对框的形式展示的。看下它的onCreate()方法：

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        mAlert.setIcon(R.drawable.ic_file_download);
        mAlert.setTitle(getString(R.string.app_name_unknown));
        mAlert.setView(R.layout.install_content_view);
        mAlert.setButton(DialogInterface.BUTTON_NEGATIVE, getString(R.string.cancel),
                (ignored, ignored2) -> {
                    if (mStagingTask != null) {
                        mStagingTask.cancel(true);
                    }
                    setResult(RESULT_CANCELED);
                    finish();
                }, null);
        setupAlert();
        requireViewById(R.id.staging).setVisibility(View.VISIBLE);

        if (savedInstanceState != null) {
            mStagedFile = new File(savedInstanceState.getString(STAGED_FILE));

            if (!mStagedFile.exists()) {
                mStagedFile = null;
            }
        }
    }

  对话框的布局是install_content_view。这里是显示的id为staging的控件，它是LinearLayout控件，里面有个文本，文本下面是水平进度条。文本内容显示为“Staging app…”。在复制APK文件完成之前，跳转到DeleteStagedFileOnResult之前，一直显示这个界面。

创建临时文件

  它有一个成员变量StagingAsyncTask，它继承自AsyncTask，用来执行异步任务。在异步任务过程中，它会将安装的APK文件重新保存一份，保存的文件位于成员变量File 类型mStagedFile中。
  看一下文件的生成代码，它是由TemporaryFileManager.getStagedFile(this)生成的文件：

    @NonNull
    public static File getStagedFile(@NonNull Context context) throws IOException {
        return File.createTempFile("package", ".apk", context.getNoBackupFilesDir());
    }

  这时创建临时文件以package作为开头，".apk"作为结尾的文件，目录为context.getNoBackupFilesDir()。
  这里context为Activity，它是通过代理模式最终会调用到ContextImpl类的getNoBackupFilesDir()，如下代码：

    @Override
    public File getNoBackupFilesDir() {
        synchronized (mSync) {
            if (mNoBackupFilesDir == null) {
                mNoBackupFilesDir = new File(getDataDir(), "no_backup");
            }
            return ensurePrivateDirExists(mNoBackupFilesDir);
        }
    }

  这里如果mNoBackupFilesDir不存在，会给他声明。并且ensurePrivateDirExists(mNoBackupFilesDir)确保该目录存在。
  再看一下getDataDir()的实现：

    @Override
    public File getDataDir() {
        if (mPackageInfo != null) {
            File res = null;
            if (isCredentialProtectedStorage()) {
                res = mPackageInfo.getCredentialProtectedDataDirFile();
            } else if (isDeviceProtectedStorage()) {
                res = mPackageInfo.getDeviceProtectedDataDirFile();
            } else {
                res = mPackageInfo.getDataDirFile();
            }

            if (res != null) {
                if (!res.exists() && android.os.Process.myUid() == android.os.Process.SYSTEM_UID) {
                    Log.wtf(TAG, "Data directory doesn't exist for package " + getPackageName(),
                            new Throwable());
                }
                return res;
            } else {
                throw new RuntimeException(
                        "No data directory found for package " + getPackageName());
            }
        } else {
            throw new RuntimeException(
                    "No package details found for package " + getPackageName());
        }
    }

  可以看到分了好几种情况，并且它的值是来自成员变量mPackageInfo。
  isCredentialProtectedStorage()、isDeviceProtectedStorage()是和当前ContextImpl类的flags（Context.CONTEXT_CREDENTIAL_PROTECTED_STORAGE、Context.CONTEXT_DEVICE_PROTECTED_STORAGE）有关，而这两个flag又和mPackageInfo的值相关。
  mPackageInfo是LoadedApk类，它用来描述目前加载apk的本地状态。它的生成是在ActivityThread的performLaunchActivity()中。
  在哪里生成的ApplicationInfo，在PackageInfoUtils的generateApplicationInfo（）中。  PackageInfoWithoutStateUtils.generateApplicationInfoUnchecked()里会调用assignUserFields()，assignUserFields(ParsingPackageRead pkg, ApplicationInfo info, int userId)有为ApplicationInfo中的dataDir赋值。

    private static void assignUserFields(ParsingPackageRead pkg, ApplicationInfo info, int userId) {
        // This behavior is undefined for no-state ApplicationInfos when called by a public API,
        // since the uid is never assigned by the system. It will always effectively be appId 0.
        info.uid = UserHandle.getUid(userId, UserHandle.getAppId(info.uid));

        String pkgName = pkg.getPackageName();
        if ("android".equals(pkgName)) {
            info.dataDir = SYSTEM_DATA_PATH;
            return;
        }

        // For performance reasons, all these paths are built as strings
        String baseDataDirPrefix =
                Environment.getDataDirectoryPath(pkg.getVolumeUuid()) + File.separator;
        String userIdPkgSuffix = File.separator + userId + File.separator + pkgName;
        info.credentialProtectedDataDir = baseDataDirPrefix + Environment.DIR_USER_CE
                + userIdPkgSuffix;
        info.deviceProtectedDataDir = baseDataDirPrefix + Environment.DIR_USER_DE + userIdPkgSuffix;

        if (pkg.isDefaultToDeviceProtectedStorage()
                && PackageManager.APPLY_DEFAULT_TO_DEVICE_PROTECTED_STORAGE) {
            info.dataDir = info.deviceProtectedDataDir;
        } else {
            info.dataDir = info.credentialProtectedDataDir;
        }
    }

  这里baseDataDirPrefix 的值为"/data"或者"/mnt/expand/" + volumeUuid，如果是系统用户，则userId 为0。并且如果是内部存储，则info.credentialProtectedDataDir=“/data/user/0/” + 包名，info.deviceProtectedDataDir=“/data/user_de/0/” + 包名。
  接着为info.dataDir赋值，pkg.isDefaultToDeviceProtectedStorage()是由Manifest文件中的标签defaultToDeviceProtectedStorage来控制的。如果没配置则默认为false。
  TemporaryFileManager.getStagedFile(this)得到的文件名字还会有随机数，因为当前安装应用是配置了android:defaultToDeviceProtectedStorage=“true”，所以TemporaryFileManager.getStagedFile(this)得到的文件的生成名字为"/data/user_de/0/com.android.packageinstaller/no_backup/package" + 随机数 + “.apk”。package7515820555458262274.apk就是一个例子。

异步任务复制APK文件

  这里实现的异步任务为AsyncTask，代码如下：

    private final class StagingAsyncTask extends AsyncTask<Uri, Void, Boolean> {
        @Override
        protected Boolean doInBackground(Uri... params) {
            if (params == null || params.length <= 0) {
                return false;
            }
            Uri packageUri = params[0];
            try (InputStream in = getContentResolver().openInputStream(packageUri)) {
                // Despite the comments in ContentResolver#openInputStream the returned stream can
                // be null.
                if (in == null) {
                    return false;
                }

                try (OutputStream out = new FileOutputStream(mStagedFile)) {
                    byte[] buffer = new byte[1024 * 1024];
                    int bytesRead;
                    while ((bytesRead = in.read(buffer)) >= 0) {
                        // Be nice and respond to a cancellation
                        if (isCancelled()) {
                            return false;
                        }
                        out.write(buffer, 0, bytesRead);
                    }
                }
            } catch (IOException | SecurityException | IllegalStateException e) {
                Log.w(LOG_TAG, "Error staging apk from content URI", e);
                return false;
            }
            return true;
        }

        @Override
        protected void onPostExecute(Boolean success) {
            if (success) {
                // Now start the installation again from a file
                Intent installIntent = new Intent(getIntent());
                installIntent.setClass(InstallStaging.this, DeleteStagedFileOnResult.class);
                installIntent.setData(Uri.fromFile(mStagedFile));

                if (installIntent.getBooleanExtra(Intent.EXTRA_RETURN_RESULT, false)) {
                    installIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT);
                }

                installIntent.addFlags(Intent.FLAG_ACTIVITY_NO_ANIMATION);
                startActivity(installIntent);

                InstallStaging.this.finish();
            } else {
                showError();
            }
        }
    }

  这里可以看到在doInBackground(Uri… params)中实现了，文件的复制。
  在onPostExecute(Boolean success)中，根据复制结果来做下一步。如果复制成功，会跳入DeleteStagedFileOnResult这个Activity中。在这里会设置跳转Intent的mData成员变量

进入DeleteStagedFileOnResult

  这个Activity是为了跳入PackageInstallerActivity，然后等待返回结果，收到返回结果之后，然后删除前面生成的安装文件。

进入PackageInstallerActivity提醒用户是否允许安装

  首先进入它的onCreate()里面看：

…………
        final Intent intent = getIntent();

        mCallingPackage = intent.getStringExtra(EXTRA_CALLING_PACKAGE);
        mCallingAttributionTag = intent.getStringExtra(EXTRA_CALLING_ATTRIBUTION_TAG);
        mSourceInfo = intent.getParcelableExtra(EXTRA_ORIGINAL_SOURCE_INFO);
        mOriginatingUid = intent.getIntExtra(Intent.EXTRA_ORIGINATING_UID,
                PackageInstaller.SessionParams.UID_UNKNOWN);
        mOriginatingPackage = (mOriginatingUid != PackageInstaller.SessionParams.UID_UNKNOWN)
                ? getPackageNameForUid(mOriginatingUid) : null;

        final Uri packageUri;
        if (PackageInstaller.ACTION_CONFIRM_INSTALL.equals(intent.getAction())) {
        …………
        } else {
            mSessionId = -1;
            packageUri = intent.getData();
            mOriginatingURI = intent.getParcelableExtra(Intent.EXTRA_ORIGINATING_URI);
            mReferrerURI = intent.getParcelableExtra(Intent.EXTRA_REFERRER);
        }     
        …………
        boolean wasSetUp = processPackageUri(packageUri);
        ……           

  取到Intent里面传递过来的相对应的数据，这里的数据对应InstallStart这个Activity里面赋的对应的值。mOriginatingUid 、mOriginatingPackage都是调用安装APP应用的uid和包名。
  接着就取得intent里面的mData的值，然后进入processPackageUri(packageUri)里处理。
  看下processPackageUri(packageUri)方法：

    private boolean processPackageUri(final Uri packageUri) {
        mPackageURI = packageUri;

        final String scheme = packageUri.getScheme();
        if (mLocalLOGV) Log.i(TAG, "processPackageUri(): uri=" + packageUri + ", scheme=" + scheme);

        switch (scheme) {
            case SCHEME_PACKAGE: {
            …………
            } break;

            case ContentResolver.SCHEME_FILE: {
                File sourceFile = new File(packageUri.getPath());
                mPkgInfo = PackageUtil.getPackageInfo(this, sourceFile,
                        PackageManager.GET_PERMISSIONS);

                // Check for parse errors
                if (mPkgInfo == null) {
                    Log.w(TAG, "Parse error when parsing manifest. Discontinuing installation");
                    showDialogInner(DLG_PACKAGE_ERROR);
                    setPmResult(PackageManager.INSTALL_FAILED_INVALID_APK);
                    return false;
                }
                if (mLocalLOGV) Log.i(TAG, "creating snippet for local file " + sourceFile);
                mAppSnippet = PackageUtil.getAppSnippet(this, mPkgInfo.applicationInfo, sourceFile);
            } break;
			…………
        }

        return true;
    }            

  在前面InstallStaging中，我们知道，intent的mData是File的。所以这里代码会走ContentResolver.SCHEME_FILE分支。
  这里得到的文件sourceFile 就是我们在InstallStaging中生成的APK文件。
  接着会调用PackageUtil.getPackageInfo()方法得到成员变量mPkgInfo。再通过它的applicationInfo，调用PackageUtil.getAppSnippet()得到mAppSnippet 。
  mPkgInfo是PackageInfo类型，它是关于一个安装包的所有的信息，对应着从AndroidManifest.xml文件里收集到的所有信息。mAppSnippet 是AppSnippet类型，它包括应用的标签名和icon标识。
  得到安装包的所有的信息，可以参考下Android 得到安装包的信息。
  接着进入PackageInstallerActivity的onResume()方法里面看看，

    @Override
    protected void onResume() {
        super.onResume();

        if (mLocalLOGV) Log.i(TAG, "onResume(): mAppSnippet=" + mAppSnippet);

        if (mAppSnippet != null) {
            // load dummy layout with OK button disabled until we override this layout in
            // startInstallConfirm
            bindUi();
            checkIfAllowedAndInitiateInstall();
        }

        if (mOk != null) {
            mOk.setEnabled(mEnableOk);
        }
    }

  mAppSnippet 不为null，代表前面解析的APK文件信息存在，接着调用bindUi()和checkIfAllowedAndInitiateInstall()来处理提示对话框。mOk则是提示对话框中的确定按钮，mEnableOk为true代表可以安装，则按钮可以点击。
  在用户自己安装APK的时候，系统不知道安装源的安全、受信任情况。所以需要用户自己确认安装源之后，才能安装。在用户确认安装源之后，mEnableOk即设置为true。之后安装按钮就能点击了。
  先看一下bindUi()的代码：

    private void bindUi() {
        mAlert.setIcon(mAppSnippet.icon);
        mAlert.setTitle(mAppSnippet.label);
        mAlert.setView(R.layout.install_content_view);
        mAlert.setButton(DialogInterface.BUTTON_POSITIVE, getString(R.string.install),
                (ignored, ignored2) -> {
                    if (mOk.isEnabled()) {
                        if (mSessionId != -1) {
                            mInstaller.setPermissionsResult(mSessionId, true);
                            finish();
                        } else {
                            startInstall();
                        }
                    }
                }, null);
        mAlert.setButton(DialogInterface.BUTTON_NEGATIVE, getString(R.string.cancel),
                (ignored, ignored2) -> {
                    // Cancel and finish
                    setResult(RESULT_CANCELED);
                    if (mSessionId != -1) {
                        mInstaller.setPermissionsResult(mSessionId, false);
                    }
                    finish();
                }, null);
        setupAlert();

        mOk = mAlert.getButton(DialogInterface.BUTTON_POSITIVE);
        mOk.setEnabled(false);

        if (!mOk.isInTouchMode()) {
            mAlert.getButton(DialogInterface.BUTTON_NEGATIVE).requestFocus();
        }
    }

  这里是主要设置对话框界面，将mAppSnippet.icon和mAppSnippet.label设置给对话框的icon和标题。然后将内容设置成布局文件install_content_view，然后设置安装按钮和取消按钮，现在安装按钮是不能点击，所以将它的enabled设置为false。
  接着看看checkIfAllowedAndInitiateInstall()：

    private void checkIfAllowedAndInitiateInstall() {
        // Check for install apps user restriction first.
        final int installAppsRestrictionSource = mUserManager.getUserRestrictionSource(
                UserManager.DISALLOW_INSTALL_APPS, Process.myUserHandle());
        if ((installAppsRestrictionSource & UserManager.RESTRICTION_SOURCE_SYSTEM) != 0) {
            if (mLocalLOGV) Log.i(TAG, "install not allowed: " + UserManager.DISALLOW_INSTALL_APPS);
            showDialogInner(DLG_INSTALL_APPS_RESTRICTED_FOR_USER);
            return;
        } else if (installAppsRestrictionSource != UserManager.RESTRICTION_NOT_SET) {
            if (mLocalLOGV) {
                Log.i(TAG, "install not allowed by admin; showing "
                        + Settings.ACTION_SHOW_ADMIN_SUPPORT_DETAILS);
            }
            startActivity(new Intent(Settings.ACTION_SHOW_ADMIN_SUPPORT_DETAILS));
            finish();
            return;
        }

        if (mAllowUnknownSources || !isInstallRequestFromUnknownSource(getIntent())) {
            if (mLocalLOGV) Log.i(TAG, "install allowed");
            initiateInstall();
        } else {
            // Check for unknown sources restrictions.
            final int unknownSourcesRestrictionSource = mUserManager.getUserRestrictionSource(
                    UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES, Process.myUserHandle());
            final int unknownSourcesGlobalRestrictionSource = mUserManager.getUserRestrictionSource(
                    UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES_GLOBALLY, Process.myUserHandle());
            final int systemRestriction = UserManager.RESTRICTION_SOURCE_SYSTEM
                    & (unknownSourcesRestrictionSource | unknownSourcesGlobalRestrictionSource);
            if (systemRestriction != 0) {
                if (mLocalLOGV) Log.i(TAG, "Showing DLG_UNKNOWN_SOURCES_RESTRICTED_FOR_USER");
                showDialogInner(DLG_UNKNOWN_SOURCES_RESTRICTED_FOR_USER);
            } else if (unknownSourcesRestrictionSource != UserManager.RESTRICTION_NOT_SET) {
                startAdminSupportDetailsActivity(UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES);
            } else if (unknownSourcesGlobalRestrictionSource != UserManager.RESTRICTION_NOT_SET) {
                startAdminSupportDetailsActivity(
                        UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES_GLOBALLY);
            } else {
                handleUnknownSources();
            }
        }
    }

  Process.myUserHandle()是得到用户标识，当前用户是一般是UserHandle.USER_SYSTEM，关于用户的相关，可以参考一下Android UserManagerService初始化，首先调用mUserManager.getUserRestrictionSource()检查用户安装APP的限制标识。如果得到的结果有UserManager.RESTRICTION_SOURCE_SYSTEM标识，说明不允许该用户安装APP，接着会调用showDialogInner(DLG_INSTALL_APPS_RESTRICTED_FOR_USER)，显示“This user is not allowed to install apps”对话框。
  如果结果不为UserManager.RESTRICTION_NOT_SET，则会跳到设置界面，并且关闭当前界面。
  USER_SYSTEM用户是不属于这两种情况，所以它会继续向下执行，下面是处理未知来源的APP的情况。mAllowUnknownSources为true是允许安装未知来源的APP，刚进入该界面时是为false。isInstallRequestFromUnknownSource(getIntent())是通过传递过来的intent，来判断是否是未知安装源。看一下它的代码：

    private boolean isInstallRequestFromUnknownSource(Intent intent) {
        if (mCallingPackage != null && intent.getBooleanExtra(
                Intent.EXTRA_NOT_UNKNOWN_SOURCE, false)) {
            if (mSourceInfo != null) {
                if ((mSourceInfo.privateFlags & ApplicationInfo.PRIVATE_FLAG_PRIVILEGED)
                        != 0) {
                    // Privileged apps can bypass unknown sources check if they want.
                    return false;
                }
            }
        }
        return true;
    }

  可以看到，不仅要设置Intent.EXTRA_NOT_UNKNOWN_SOURCE的值为true，并且安装源得是特权APP。
  所以checkIfAllowedAndInitiateInstall()会接着检查对于用户UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES和UserManager.DISALLOW_INSTALL_UNKNOWN_SOURCES_GLOBALLY的限制。
  对于UserHandle.USER_SYSTEM，这些限制都不存在，所以会走最后的else分支，进行handleUnknownSources()处理。看一下它的代码：

    private void handleUnknownSources() {
        if (mOriginatingPackage == null) {
            Log.i(TAG, "No source found for package " + mPkgInfo.packageName);
            showDialogInner(DLG_ANONYMOUS_SOURCE);
            return;
        }
        // Shouldn't use static constant directly, see b/65534401.
        final int appOpCode =
                AppOpsManager.permissionToOpCode(Manifest.permission.REQUEST_INSTALL_PACKAGES);
        final int appOpMode = mAppOpsManager.noteOpNoThrow(appOpCode, mOriginatingUid,
                mOriginatingPackage, mCallingAttributionTag,
                "Started package installation activity");
        if (mLocalLOGV) Log.i(TAG, "handleUnknownSources(): appMode=" + appOpMode);
        switch (appOpMode) {
            case AppOpsManager.MODE_DEFAULT:
                mAppOpsManager.setMode(appOpCode, mOriginatingUid,
                        mOriginatingPackage, AppOpsManager.MODE_ERRORED);
                // fall through
            case AppOpsManager.MODE_ERRORED:
                showDialogInner(DLG_EXTERNAL_SOURCE_BLOCKED);
                break;
            case AppOpsManager.MODE_ALLOWED:
                initiateInstall();
                break;
            default:
                Log.e(TAG, "Invalid app op mode " + appOpMode
                        + " for OP_REQUEST_INSTALL_PACKAGES found for uid " + mOriginatingUid);
                finish();
                break;
        }
    }

  mOriginatingPackage是调用安装APP的应用包名，所以不为null。
  这里接下来会走到switch的AppOpsManager.MODE_ALLOWED case。接着调用initiateInstall()。

    private void initiateInstall() {
        String pkgName = mPkgInfo.packageName;
        // Check if there is already a package on the device with this name
        // but it has been renamed to something else.
        String[] oldName = mPm.canonicalToCurrentPackageNames(new String[] { pkgName });
        if (oldName != null && oldName.length > 0 && oldName[0] != null) {
            pkgName = oldName[0];
            mPkgInfo.packageName = pkgName;
            mPkgInfo.applicationInfo.packageName = pkgName;
        }
        // Check if package is already installed. display confirmation dialog if replacing pkg
        try {
            // This is a little convoluted because we want to get all uninstalled
            // apps, but this may include apps with just data, and if it is just
            // data we still want to count it as "installed".
            mAppInfo = mPm.getApplicationInfo(pkgName,
                    PackageManager.MATCH_UNINSTALLED_PACKAGES);
            if ((mAppInfo.flags&ApplicationInfo.FLAG_INSTALLED) == 0) {
                mAppInfo = null;
            }
        } catch (NameNotFoundException e) {
            mAppInfo = null;
        }

        startInstallConfirm();
    }

  在这里由于pkgName包还未安装，所以mAppInfo 为null。

    private void startInstallConfirm() {
        View viewToEnable;

        if (mAppInfo != null) {
            viewToEnable = requireViewById(R.id.install_confirm_question_update);
            mOk.setText(R.string.update);
        } else {
            // This is a new application with no permissions.
            viewToEnable = requireViewById(R.id.install_confirm_question);
        }

        viewToEnable.setVisibility(View.VISIBLE);

        mEnableOk = true;
        mOk.setEnabled(true);
        mOk.setFilterTouchesWhenObscured(true);
    }

  在这里会走else分支，viewToEnable 显示的内容“Do you want to install this app?”，来询问用户是否安装。这个时候，安装按钮就可以点击了。用户如果同意，就会走安装按钮点击的逻辑，看一下。
  它的点击事件逻辑在bindUi()方法中：

        mAlert.setButton(DialogInterface.BUTTON_POSITIVE, getString(R.string.install),
                (ignored, ignored2) -> {
                    if (mOk.isEnabled()) {
                        if (mSessionId != -1) {
                            mInstaller.setPermissionsResult(mSessionId, true);
                            finish();
                        } else {
                            startInstall();
                        }
                    }
                }, null);

  这里会走到startInstall()，看它的代码：

    private void startInstall() {
        // Start subactivity to actually install the application
        Intent newIntent = new Intent();
        newIntent.putExtra(PackageUtil.INTENT_ATTR_APPLICATION_INFO,
                mPkgInfo.applicationInfo);
        newIntent.setData(mPackageURI);
        newIntent.setClass(this, InstallInstalling.class);
        String installerPackageName = getIntent().getStringExtra(
                Intent.EXTRA_INSTALLER_PACKAGE_NAME);
        if (mOriginatingURI != null) {
            newIntent.putExtra(Intent.EXTRA_ORIGINATING_URI, mOriginatingURI);
        }
        if (mReferrerURI != null) {
            newIntent.putExtra(Intent.EXTRA_REFERRER, mReferrerURI);
        }
        if (mOriginatingUid != PackageInstaller.SessionParams.UID_UNKNOWN) {
            newIntent.putExtra(Intent.EXTRA_ORIGINATING_UID, mOriginatingUid);
        }
        if (installerPackageName != null) {
            newIntent.putExtra(Intent.EXTRA_INSTALLER_PACKAGE_NAME,
                    installerPackageName);
        }
        if (getIntent().getBooleanExtra(Intent.EXTRA_RETURN_RESULT, false)) {
            newIntent.putExtra(Intent.EXTRA_RETURN_RESULT, true);
        }
        newIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT);
        if (mLocalLOGV) Log.i(TAG, "downloaded app uri=" + mPackageURI);
        startActivity(newIntent);
        finish();
    }

  这是为了要跳到InstallInstalling中做的一些设置。在目前的安装例子中，installerPackageName、mOriginatingURI、mReferrerURI都为null。intent中Intent.EXTRA_RETURN_RESULT的值也为false，这里会加上Intent.FLAG_ACTIVITY_FORWARD_RESULT标识。接下来就是跳入InstallInstalling中，关闭当前界面。

进入InstallInstalling执行安装

  先看看它的onCreate()方法：

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        ApplicationInfo appInfo = getIntent()
                .getParcelableExtra(PackageUtil.INTENT_ATTR_APPLICATION_INFO);
        mPackageURI = getIntent().getData();

        if ("package".equals(mPackageURI.getScheme())) {
            …………
        } else {
            final File sourceFile = new File(mPackageURI.getPath());
            PackageUtil.AppSnippet as = PackageUtil.getAppSnippet(this, appInfo, sourceFile);

            mAlert.setIcon(as.icon);
            mAlert.setTitle(as.label);
            mAlert.setView(R.layout.install_content_view);
            mAlert.setButton(DialogInterface.BUTTON_NEGATIVE, getString(R.string.cancel),
                    (ignored, ignored2) -> {
                        if (mInstallingTask != null) {
                            mInstallingTask.cancel(true);
                        }

                        if (mSessionId > 0) {
                            getPackageManager().getPackageInstaller().abandonSession(mSessionId);
                            mSessionId = 0;
                        }

                        setResult(RESULT_CANCELED);
                        finish();
                    }, null);
            setupAlert();
            requireViewById(R.id.installing).setVisibility(View.VISIBLE);

            if (savedInstanceState != null) {
               …………
            } else {
                PackageInstaller.SessionParams params = new PackageInstaller.SessionParams(
                        PackageInstaller.SessionParams.MODE_FULL_INSTALL);
                params.setInstallAsInstantApp(false);
                params.setReferrerUri(getIntent().getParcelableExtra(Intent.EXTRA_REFERRER));
                params.setOriginatingUri(getIntent()
                        .getParcelableExtra(Intent.EXTRA_ORIGINATING_URI));
                params.setOriginatingUid(getIntent().getIntExtra(Intent.EXTRA_ORIGINATING_UID,
                        UID_UNKNOWN));
                params.setInstallerPackageName(getIntent().getStringExtra(
                        Intent.EXTRA_INSTALLER_PACKAGE_NAME));
                params.setInstallReason(PackageManager.INSTALL_REASON_USER);

                File file = new File(mPackageURI.getPath());
                try {
                    final ParseTypeImpl input = ParseTypeImpl.forDefaultParsing();
                    final ParseResult<PackageLite> result = ApkLiteParseUtils.parsePackageLite(
                            input.reset(), file, /* flags */ 0);
                    if (result.isError()) {
                        Log.e(LOG_TAG, "Cannot parse package " + file + ". Assuming defaults.");
                        Log.e(LOG_TAG,
                                "Cannot calculate installed size " + file + ". Try only apk size.");
                        params.setSize(file.length());
                    } else {
                        final PackageLite pkg = result.getResult();
                        params.setAppPackageName(pkg.getPackageName());
                        params.setInstallLocation(pkg.getInstallLocation());
                        params.setSize(
                                PackageHelper.calculateInstalledSize(pkg, params.abiOverride));
                    }
                } catch (IOException e) {
                    Log.e(LOG_TAG,
                            "Cannot calculate installed size " + file + ". Try only apk size.");
                    params.setSize(file.length());
                }

                try {
                    mInstallId = InstallEventReceiver
                            .addObserver(this, EventResultPersister.GENERATE_NEW_ID,
                                    this::launchFinishBasedOnResult);
                } catch (EventResultPersister.OutOfIdsException e) {
                    launchFailure(PackageInstaller.STATUS_FAILURE,
                            PackageManager.INSTALL_FAILED_INTERNAL_ERROR, null);
                }

                try {
                    mSessionId = getPackageManager().getPackageInstaller().createSession(params);
                } catch (IOException e) {
                    launchFailure(PackageInstaller.STATUS_FAILURE,
                            PackageManager.INSTALL_FAILED_INTERNAL_ERROR, null);
                }
            }

            mCancelButton = mAlert.getButton(DialogInterface.BUTTON_NEGATIVE);
        }
    }

  这里先得到安装文件的ApplicationInfo对象appInfo，mPackageURI。接着就得到安装文件sourceFile、还有AppSnippet对象。
  再往下就是设置对话框的显示内容。这个对话框采用的布局和PackageInstallerActivity界面采用的布局文件是同一个install_content_view。不过显示内容是不同，这里直接让id为installing的控件显示出来。它是一个LinearLayout控件，看一下它的布局结构：

    <LinearLayout
        android:id="@+id/installing"
        android:layout_width="match_parent"
        android:layout_height="wrap_content"
        android:orientation="vertical"
        android:visibility="invisible">

        <TextView
            android:layout_width="wrap_content"
            android:layout_height="wrap_content"
            style="@android:style/TextAppearance.Material.Subhead"
            android:text="@string/installing" />

        <ProgressBar
            android:id="@+id/progress"
            android:layout_width="match_parent"
            android:layout_height="wrap_content"
            android:paddingTop="8dp"
            style="?android:attr/progressBarStyleHorizontal"
            android:indeterminate="true" />

    </LinearLayout>

  一个文本提示安装中，一个水平进度条提示进度。
  接着会生成一个SessionParams对象。将intent中的值取出来，设置给SessionParams对象。然后调用ApkLiteParseUtils.parsePackageLite( input.reset(), file, /* flags */ 0)得到安装包的轻量级对象PackageLite对象。接着用PackageLite对象的信息设置到SessionParams对象的AppPackageName、InstallLocation、Size。
  再接着就是生成一个安装id，一个SessionId。
  生成安装id是通过InstallEventReceiver的静态方法addObserver()方法实现，其中第二个参数EventResultPersister.GENERATE_NEW_ID代表生成一个新的、而this::launchFinishBasedOnResult则是一个回调。安装结果出来之后，就是通过这个回调通知的。
  在这里getPackageManager()得到的是ApplicationPackageManager对象，它的类成员mContext是ContextImpl实例，mPM是 PackageManagerService 在应用进程中的代理对象。ApplicationPackageManager的getPackageInstaller()代码为：

    @Override
    public PackageInstaller getPackageInstaller() {
        synchronized (mLock) {
            if (mInstaller == null) {
                try {
                    mInstaller = new PackageInstaller(mPM.getPackageInstaller(),
                            mContext.getPackageName(), mContext.getAttributionTag(), getUserId());
                } catch (RemoteException e) {
                    throw e.rethrowFromSystemServer();
                }
            }
            return mInstaller;
        }
    }

  mPM.getPackageInstaller()得到的是系统进程中的PackageInstallerService对象（它是Binder对象）的Binder代理对象，现在将它封装到PackageInstaller对象中。
  接着会调用PackageInstaller对象的createSession(params)方法，它会在系统进程中创建一个PackageInstallerSession对象。在创建过程中会生成PackageInstallerSession唯一id返回到应用进程，这里mSessionId就是。在系统进程创建PackageInstallerSession对象时，还会生成一个目录，如果是APK安装在内部，则为“/data/app/” + “/vmdl” + sessionId + “.tmp”或者指定volumeUuid时，则为"/mnt/expand/" + volumeUuid + “/app” + “/vmdl” + sessionId + “.tmp”。
  接着看一下onResume()方法：

    @Override
    protected void onResume() {
        super.onResume();

        // This is the first onResume in a single life of the activity
        if (mInstallingTask == null) {
            PackageInstaller installer = getPackageManager().getPackageInstaller();
            PackageInstaller.SessionInfo sessionInfo = installer.getSessionInfo(mSessionId);

            if (sessionInfo != null && !sessionInfo.isActive()) {
                mInstallingTask = new InstallingAsyncTask();
                mInstallingTask.execute();
            } else {
                // we will receive a broadcast when the install is finished
                mCancelButton.setEnabled(false);
                setFinishOnTouchOutside(false);
            }
        }
    }

  这里在异步任务未创建的情况下，调用PackageInstaller对象的getSessionInfo(mSessionId)，这个主要是为了生成SessionInfo。然后开始调用执行异步任务mInstallingTask 。
  看一下异步任务mInstallingTask 的doInBackground()方法：

        @Override
        protected PackageInstaller.Session doInBackground(Void... params) {
            PackageInstaller.Session session;
            try {
                session = getPackageManager().getPackageInstaller().openSession(mSessionId);
            } catch (IOException e) {
                synchronized (this) {
                    isDone = true;
                    notifyAll();
                }
                return null;
            }

            session.setStagingProgress(0);

            try {
                File file = new File(mPackageURI.getPath());

                try (InputStream in = new FileInputStream(file)) {
                    long sizeBytes = file.length();
                    try (OutputStream out = session
                            .openWrite("PackageInstaller", 0, sizeBytes)) {
                        byte[] buffer = new byte[1024 * 1024];
                        while (true) {
                            int numRead = in.read(buffer);

                            if (numRead == -1) {
                                session.fsync(out);
                                break;
                            }

                            if (isCancelled()) {
                                session.close();
                                break;
                            }

                            out.write(buffer, 0, numRead);
                            if (sizeBytes > 0) {
                                float fraction = ((float) numRead / (float) sizeBytes);
                                session.addProgress(fraction);
                            }
                        }
                    }
                }

                return session;
            } catch (IOException | SecurityException e) {
                Log.e(LOG_TAG, "Could not write package", e);

                session.close();

                return null;
            } finally {
                synchronized (this) {
                    isDone = true;
                    notifyAll();
                }
            }
        }

  这里主要调用PackageInstaller对象的openSession(mSessionId)来打开系统进程中的PackageInstallerSession，这个步骤主要是为了创建上面说的的目录。因为下面马上要复制APK文件了。
  下面就是接着就调用session.openWrite(“PackageInstaller”, 0, sizeBytes)打开之前创建目录下的"PackageInstaller"文件，然后将APK文件拷贝到这个文件中。还是以上面的目录为例子，未指定volumeUuid时，最后生成的文件则为“/data/app/” + “/vmdl” + sessionId + “.tmp/PackageInstaller”。
  拷贝完毕之后，会走异步任务mInstallingTask 的onPostExecute()方法，看一下它的代码：

        @Override
        protected void onPostExecute(PackageInstaller.Session session) {
            if (session != null) {
                Intent broadcastIntent = new Intent(BROADCAST_ACTION);
                broadcastIntent.setFlags(Intent.FLAG_RECEIVER_FOREGROUND);
                broadcastIntent.setPackage(getPackageName());
                broadcastIntent.putExtra(EventResultPersister.EXTRA_ID, mInstallId);

                PendingIntent pendingIntent = PendingIntent.getBroadcast(
                        InstallInstalling.this,
                        mInstallId,
                        broadcastIntent,
                        PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE);

                session.commit(pendingIntent.getIntentSender());
                mCancelButton.setEnabled(false);
                setFinishOnTouchOutside(false);
            } else {
                getPackageManager().getPackageInstaller().abandonSession(mSessionId);

                if (!isCancelled()) {
                    launchFailure(PackageInstaller.STATUS_FAILURE,
                            PackageManager.INSTALL_FAILED_INVALID_APK, null);
                }
            }
        }

  这里将接受安装结果的通知Intent和mInstallId封装到PendingIntent 中，接着调用session.commit(pendingIntent.getIntentSender())去系统进程中封装PackageInstallerSession对象，然后系统进程开始执行安装操作。
  之后界面会一直在进度条走动那儿等待安装结果。
  在安装成功之后，会回调InstallEventReceiver.addObserver(this, EventResultPersister.GENERATE_NEW_ID, this::launchFinishBasedOnResult)注册的launchFinishBasedOnResult()方法，看一下它：

    private void launchFinishBasedOnResult(int statusCode, int legacyStatus, String statusMessage) {
        if (statusCode == PackageInstaller.STATUS_SUCCESS) {
            launchSuccess();
        } else {
            launchFailure(statusCode, legacyStatus, statusMessage);
        }
    }
    private void launchSuccess() {
        Intent successIntent = new Intent(getIntent());
        successIntent.setClass(this, InstallSuccess.class);
        successIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT);

        startActivity(successIntent);
        finish();
    }    

  成功之后，会走launchSuccess()，它会继续跳转到InstallSuccess这个Activity中，并且添加FLAG_ACTIVITY_FORWARD_RESULT标识，跳转之后，会将自己关闭。

InstallSuccess提示成功结果

  InstallSuccess主要用来提示用户安装成功了，后续是否运行安装的应用。看一下它的onCreate()方法：

    @Override
    protected void onCreate(@Nullable Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        if (getIntent().getBooleanExtra(Intent.EXTRA_RETURN_RESULT, false)) {
            // Return result if requested
            Intent result = new Intent();
            result.putExtra(Intent.EXTRA_INSTALL_RESULT, PackageManager.INSTALL_SUCCEEDED);
            setResult(Activity.RESULT_OK, result);
            finish();
        } else {
            Intent intent = getIntent();
            ApplicationInfo appInfo =
                    intent.getParcelableExtra(PackageUtil.INTENT_ATTR_APPLICATION_INFO);
            mAppPackageName = appInfo.packageName;
            Uri packageURI = intent.getData();

            // Set header icon and title
            PackageManager pm = getPackageManager();

            if ("package".equals(packageURI.getScheme())) {
                mAppSnippet = new PackageUtil.AppSnippet(pm.getApplicationLabel(appInfo),
                        pm.getApplicationIcon(appInfo));
            } else {
                File sourceFile = new File(packageURI.getPath());
                mAppSnippet = PackageUtil.getAppSnippet(this, appInfo, sourceFile);
            }

            mLaunchIntent = getPackageManager().getLaunchIntentForPackage(mAppPackageName);

            bindUi();
        }
    }

  如果intent中设置了Intent.EXTRA_RETURN_RESULT，会直接返回了，不会提示安装成功界面。
  如果没有设置该值，会得到ApplicationInfo对象，包名、还有安装文件，接着查询安装应用中的主Activity 所需要的mLaunchIntent。
  接着调用bindUi()，看一下它的界面提示：

    private void bindUi() {
        if (mAppSnippet == null) {
            return;
        }

        mAlert.setIcon(mAppSnippet.icon);
        mAlert.setTitle(mAppSnippet.label);
        mAlert.setView(R.layout.install_content_view);
        mAlert.setButton(DialogInterface.BUTTON_POSITIVE, getString(R.string.launch), null,
                null);
        mAlert.setButton(DialogInterface.BUTTON_NEGATIVE, getString(R.string.done),
                (ignored, ignored2) -> {
                    if (mAppPackageName != null) {
                        Log.i(LOG_TAG, "Finished installing " + mAppPackageName);
                    }
                    finish();
                }, null);
        setupAlert();
        requireViewById(R.id.install_success).setVisibility(View.VISIBLE);
        // Enable or disable "launch" button
        boolean enabled = false;
        if (mLaunchIntent != null) {
            List<ResolveInfo> list = getPackageManager().queryIntentActivities(mLaunchIntent,
                    0);
            if (list != null && list.size() > 0) {
                enabled = true;
            }
        }

        Button launchButton = mAlert.getButton(DialogInterface.BUTTON_POSITIVE);
        if (enabled) {
            launchButton.setOnClickListener(view -> {
                try {
                    startActivity(mLaunchIntent);
                } catch (ActivityNotFoundException | SecurityException e) {
                    Log.e(LOG_TAG, "Could not start activity", e);
                }
                finish();
            });
        } else {
            launchButton.setEnabled(false);
        }
    }

  这个对话框两个按钮一个是“Open”，一个是“Done”。“Done”按钮点击之后，直接关闭该界面，主要起到提示用户安装完成的作用。“Open”按钮则是跳转到安装的应用中，关闭该界面。
  install_content_view布局中显示的控件为id为install_success的，它是一个文本控件，内容为“App installed.”。

总结

  该篇文章说了安装应用时，相关界面的显示，以及涉及到的Activity的跳转和其作用。
  现在进行了两次APK的复制，第一次将它复制到包安装进程的私有存储空间中，第二次拷贝到的则是在系统进程中创建的安装APK文件。包安装进程中的APK文件会在DeleteStagedFileOnResult收到应答之后，执行删除，系统进程中的会在之后进行安装的时候，继续处理。
  现在我们知道了大概在APK安装过程中的界面显示，实际的安装工作都是在系统进程中进行，后续我们继续分析系统进程进行的安装行为。