android防止二次打包，校驗簽名signature時，校驗公鑰有什麽用

有必須的哦，通過公鑰的對比可以發現這個apk是否是被二次打包，壹般會把公鑰的md5或者是sha1值計算出來放在程序中，然後程序運行的時候計算當前程序的md5，然後進行比較。

上段代碼：

public static int checkAppSignature(Context context) {

String SIGNATURE = "478yYkKAQF+KST8y4ATKvHkYibo=";//需要固定寫在程序的某個位置的簽名

try {

PackageInfo packageInfo = context.getPackageManager().getPackageInfo(context.getPackageName(), PackageManager.GET_SIGNATURES);

Signature[] signatures = packageInfo.signatures;

Signature sign = signatures[0];

MessageDigest md = MessageDigest.getInstance("SHA");

md.update(sign.toByteArray());

Log.e("proyx", bytesToHexString(md.digest()));

final String currentSignature = Base64.encodeToString(md.digest(), Base64.DEFAULT);

Log.e("proyx", "Include this string as a value for SIGNATURE:" + currentSignature);

if (SIGNATURE.equals(currentSignature)) {

return 0;

}

} catch (Exception e) {

//assumes an issue in checking signature., but we let the caller decide on what to do.

e.printStackTrace();

}

return 1;

}