Why is the PackageInfo.signatures field an array, and when will there be something other than one?

Question

I check the packet signatures against each other to determine if they are incompatible (compiled for different keystores). I noticed that PackageInfo.signatures is almost always a collection containing a single entry that makes sense to me. I create my application using a debug or production database, and this determines the package signature (this is my simplified understanding of the apk signing process at this stage). I know that it will be null unless I specifically request this information (passing the PackageManager.GET_SIGNATURES flag), but I do not quite understand in which case there would be more than one.

I wrote a debug code and ran it on my personal Android phone. Of the 300+ packages installed on my phone, everyone had exactly one signature, with the exception of several packages that my service provider seemed to have (com.verizon. * Namespaces).

I feel that it is acceptable for my use (package management) to consider that application packages will have one signature, but I want to make sure that I am missing something that could lead to an error on the edge.

Answer 1

For your purposes, it seems quite acceptable to assume that the Android application has one signature. The Android APK can be compiled with several signatures, but it is not recommended or tested. (Why is Verizon doing this? Who knows.)

I found this archive from Dianne Hackborn , an Android development lady:

Q : I know that a subscriber subscriber supports multiple signatures in a single jar file. If the APK file has two valid signatures, does this mean that the APK can access the subscription level permission granted by both signers?

A. Theoretically, something is being done with several signatures, but no one has ever used this, so it probably doesn't work. It also has a side effect (if it does the job) of overlaying two signatures on the same thing, since they are supposedly from the same owner, which is most likely not what you want.

Another bit from Dianne (note the use of "it", not "they" and "certificate" instead of "certificates"):

Q : PackageInfo.signatures: What does it return?

A. This is the certificate that was used to sign the .apk.

But. It is noteworthy that I found a test link for several signatures in the Android Git source: Test for checking package signatures (error 4596332) . In addition, the Android BackupManagerService code (and other Android source code ) ensures that it checks for multiple signatures.

So, here is my conclusion: you don’t need to worry about a few signatures unless you are coding in a situation where security and compilation of certain packages are important. (However, it also seems that you would not have a big problem posting multiple signatures, if necessary.)

I hope this is at least somewhat satisfactory.