Android签名验证简介
本文博客原文
Android
原生自带了个安装器（packages\apps\PackageInstaller），
通过其中的源码
PackageParser.java
(frameworks\base\core\java\android\content\pm)
我们大概就能知道其签名验证机制的验证过程。
其中主要涉及2个函数：
函数1
public
boolean
collectCertificates
(
Package
pkg
,
int
flags
)
{
pkg
.
mSignatures
=
null
;
WeakReference
<
byte
[]>
readBufferRef
;
byte
[]
readBuffer
=
null
;
synchronized
(
mSync
)
{
readBufferRef
=
mReadBuffer
;
if
(
readBufferRef
!=
null
)
{
mReadBuffer
=
null
;
readBuffer
=
readBufferRef
.
get
();
}
if
(
readBuffer
==
null
)
{
readBuffer
=
new
byte
[
8192
];
readBufferRef
=
new
WeakReference
<
byte
[]>(
readBuffer
);
}
}
try
{
JarFile
jarFile
=
new
JarFile
(
mArchiveSourcePath
);
Certificate
[]
certs
=
null
;
if
((
flags
&
PARSE_IS_SYSTEM
)
!=
0
)
{
// If this package comes from the system image, then we
// can trust it... we'll just use the AndroidManifest.xml
// to retrieve its signatures, not validating all of the
// files.
JarEntry jarEntry = jarFile.getJarEntry(ANDROID_MANIFEST_FILENAME);
certs = loadCertificates(jarFile, jarEntry, readBuffer);
if (certs == null) {
Slog.e(TAG, "Package " + pkg.packageName
+ " has no certificates at entry "
+ jarEntry.getName() + "; ignoring!");
jarFile.close();
mParseError = PackageManager.INSTALL_PARSE_FAILED_NO_CERTIFICATES;
return false;
}
if (DEBUG_JAR) {
Slog.i(TAG, "File " + mArchiveSourcePath + ": entry=" + jarEntry
+ " certs=" + (certs != null ? certs.length : 0));
if (certs != null) {
final int N = certs.length;
for (int i=0; i<N; i++) {
Slog.i(TAG, " Public key: "
+ certs[i].getPublicKey().getEncoded()
+ " " + certs[i].getPublicKey());
}
}
}
} else {
Enumeration<JarEntry> entries = jarFile.entries();
final Manifest manifest = jarFile.getManifest();
while (entries.hasMoreElements()) {
final JarEntry je = entries.nextElement();
if (je.isDirectory()) continue;
final
String
name
=
je
.
getName
();
if
(
name
.
startsWith
(
"META-INF/"
))
continue
;
if
(
ANDROID_MANIFEST_FILENAME
.
equals
(
name
))
{
final
Attributes
attributes
=
manifest
.
getAttributes
(
name
);
pkg
.
manifestDigest
=
ManifestDigest
.
fromAttributes
(
attributes
);
}
final
Certificate
[]
localCerts
=
loadCertificates
(
jarFile
,
je
,
readBuffer
);
if
(
DEBUG_JAR
)
{
Slog
.
i
(
TAG
,
"File "
+
mArchiveSourcePath
+
" entry "
+
je
.
getName
()
+
": certs="
+
certs
+
" ("
+
(
certs
!=
null
?
certs
.
length
:
0
)
+
")"
);
}
if
(
localCerts
==
null
)
{
Slog
.
e
(
TAG
,
"Package "
+
pkg
.
packageName
+
" has no certificates at entry "
+
je
.
getName
()
+
"; ignoring!"
);
jarFile
.
close
();
mParseError
=
PackageManager
.
INSTALL_PARSE_FAILED_NO_CERTIFICATES
;
return
false
;
}
else
if
(
certs
==
null
)
{
certs
=
localCerts
;
}
else
{
// Ensure all certificates match.
for (int i=0; i<certs.length; i++) {
boolean found = false;
for (int j=0; j<localCerts.length; j++) {
if (certs[i] != null &&
certs[i].equals(localCerts[j])) {
found = true;
break;
}
}
if (!found || certs.length != localCerts.length) {
Slog.e(TAG, "Package " + pkg.packageName
+ " has mismatched certificates at entry "
+ je.getName() + "; ignoring!");
jarFile.close();
mParseError = PackageManager.INSTALL_PARSE_FAILED_INCONSISTENT_CERTIFICATES;
return false;
}
}
}
}
}
jarFile.close();
synchronized
(
mSync
)
{
mReadBuffer
=
readBufferRef
;
}
if
(
certs
!=
null
&&
certs
.
length
>
0
)
{
final
int
N
=
certs
.
length
;
pkg
.
mSignatures
=
new
Signature
[
certs
.
length
];
for
(
int
i
=
0
;
i
<
N
;
i
++)
{
pkg
.
mSignatures
[
i
]
=
new
Signature
(
certs
[
i
].
getEncoded
());
}
}
else
{
Slog
.
e
(
TAG
,
"Package "
+
pkg
.
packageName
+
" has no certificates; ignoring!"
);
mParseError
=
PackageManager
.
INSTALL_PARSE_FAILED_NO_CERTIFICATES
;
return
false
;
}
}
catch
(
CertificateEncodingException
e
)
{
Slog
.
w
(
TAG
,
"Exception reading "
+
mArchiveSourcePath
,
e
);
mParseError
=
PackageManager
.
INSTALL_PARSE_FAILED_CERTIFICATE_ENCODING
;
return
false
;
}
catch
(
IOException
e
)
{
Slog
.
w
(
TAG
,
"Exception reading "
+
mArchiveSourcePath
,
e
);
mParseError
=
PackageManager
.
INSTALL_PARSE_FAILED_CERTIFICATE_ENCODING
;
return
false
;
}
catch
(
RuntimeException
e
)
{
Slog
.
w
(
TAG
,
"Exception reading "
+
mArchiveSourcePath
,
e
);
mParseError
=
PackageManager
.
INSTALL_PARSE_FAILED_UNEXPECTED_EXCEPTION
;
return
false
;
}
return
true
;
}
函数2
private
Certificate
[]
loadCertificates
(
JarFile
jarFile
,
JarEntry
je
,
byte
[]
readBuffer
)
{
try
{
// We must read the stream for the JarEntry to retrieve
// its certificates.
InputStream is = new BufferedInputStream(jarFile.getInputStream(je));
while (is.read(readBuffer, 0, readBuffer.length) != -1) {
// not using
}
is.close();
return je != null ? je.getCertificates() : null;
} catch (IOException e) {
Slog.w(TAG, "Exception reading " + je.getName() + " in "
+ jarFile.getName(), e);
} catch (RuntimeException e) {
Slog.w(TAG, "Exception reading " + je.getName() + " in "
+ jarFile.getName(), e);
}
return null;
}
通过上面的代码，我们已经能够得到了签名的证书，通过证书我们就得到PublicKey，通过比较PublicKey我们就能比较签名是否一致，当然这里假设的是只有一个签名。
实例1
package
edu
.
edut
.
robin
.
utils
;
import
java
.
io
.
ByteArrayInputStream
;
import
java
.
io
.
IOException
;
import
java
.
io
.
InputStream
;
import
java
.
security
.
PublicKey
;
import
java
.
security
.
cert
.
Certificate
;
import
java
.
security
.
cert
.
CertificateFactory
;
import
java
.
security
.
cert
.
X509Certificate
;
import
java
.
util
.
jar
.
JarEntry
;
import
java
.
util
.
jar
.
JarFile
;
import
android
.
content
.
Context
;
import
android
.
content
.
pm
.
PackageInfo
;
import
android
.
content
.
pm
.
PackageManager
;
import
android
.
content
.
pm
.
PackageManager
.
NameNotFoundException
;
import
android
.
util
.
Base64
;
public
class
SigntureUtil
{
final
static
String
TAG
=
"Signture"
;
public
static
String
[]
getPublicKeyString
(
PackageInfo
pi
)
{
PublicKey
pubKeys
[]
=
getPublicKey
(
pi
);
if
(
pubKeys
==
null
||
pubKeys
.
length
==
0
)
{
return
null
;
}
String
[]
strPubKeys
=
new
String
[
pubKeys
.
length
];
for
(
int
i
=
0
;
i
<
pubKeys
.
length
;
i
++)
strPubKeys
[
i
]
=
Base64
.
encodeToString
(
pubKeys
[
i
].
getEncoded
(),
Base64
.
DEFAULT
);
return
strPubKeys
;
}
private
static
PublicKey
[]
getPublicKey
(
PackageInfo
pi
)
{
try
{
if
(
pi
.
signatures
==
null
||
pi
.
signatures
.
length
==
0
)
{
return
null
;
}
PublicKey
[]
publicKeys
=
new
PublicKey
[
pi
.
signatures
.
length
];
for
(
int
i
=
0
;
i
<
publicKeys
.
length
;
i
++)
{
byte
[]
signature
=
pi
.
signatures
[
i
].
toByteArray
();
CertificateFactory
certFactory
=
CertificateFactory
.
getInstance
(
"X.509"
);
InputStream
is
=
new
ByteArrayInputStream
(
signature
);
X509Certificate cert
=
(
X509Certificate
)
certFactory
.
generateCertificate
(
is
);
publicKeys
[
i
]
=
cert
.
getPublicKey
();
}
}
catch
(
Exception
ex
)
{
}
return
null
;
}
private
static
PublicKey
[]
getInstalledAppPublicKey
(
Context
context
,
String
packageName
)
{
PackageManager
pm
=
context
.
getPackageManager
();
PackageInfo
pi
;
try
{
pi
=
pm
.
getPackageInfo
(
packageName
,
PackageManager
.
GET_SIGNATURES
);
if
(
pi
!=
null
&&
pi
.
versionName
!=
null
)
{
return
getPublicKey
(
pi
);
}
}
catch
(
NameNotFoundException
e
)
{
// not installed
return
null
;
}
catch
(
Exception
e
)
{
e
.
printStackTrace
();
}
return
null
;
}
private
static
Certificate
[]
loadCertificates
(
JarFile
jarFile
,
JarEntry
je
)
{
try
{
// We must read the stream for the JarEntry to retrieve
// its certificates.
byte
[]
readBuffer
=
new
byte
[
1024
];
InputStream
is
=
jarFile
.
getInputStream
(
je
);
while
(
is
.
read
(
readBuffer
,
0
,
readBuffer
.
length
)
!=
-
1
)
;
is
.
close
();
return
(
je
!=
null
)
?
je
.
getCertificates
()
:
null
;
}
catch
(
IOException
e
)
{
e
.
printStackTrace
();
}
return
null
;
}
public
static
boolean
verifySignature
(
Context
context
,
String
packageName
,
String
filePath
)
{
boolean
verifyed
=
true
;
try
{
PublicKey
[]
installedAppPubKeys
=
getInstalledAppPublicKey
(
context
,
packageName
);
if
(
installedAppPubKeys
==
null
||
installedAppPubKeys
.
length
==
0
)
{
// package not installed
return
true
;
}
JarFile
jarFile
=
new
JarFile
(
filePath
);
verifyed
=
false
;
JarEntry
je
=
jarFile
.
getJarEntry
(
"classes.dex"
);
Certificate
[]
certs
=
loadCertificates
(
jarFile
,
je
);
if
(
certs
!=
null
&&
certs
.
length
>
0
)
{
for
(
int
i
=
0
;
i
<
certs
.
length
;
i
++)
{
PublicKey
pubKey
=
certs
[
i
].
getPublicKey
();
for
(
int
j
=
0
;
j
<
installedAppPubKeys
.
length
;
j
++)
{
if
(
pubKey
.
equals
(
installedAppPubKeys
[
j
]))
{
verifyed
=
true
;
break
;
}
}
if
(
verifyed
)
break
;
}
}
else
{
verifyed
=
true
;
}
jarFile
.
close
();
}
catch
(
Exception
e
)
{
verifyed
=
true
;
}
return
verifyed
;
}
}
关于数字签名的更多内容请阅读《 数字签名简介
》
关于java本身的数字签名和数字证书请参考《
Java中的数字签名和数字证书
》和
《 Jar文件的数字签名
》
结束