안드로이드 APK서명 검증하기 (빌드 유효성 체크)

 

// YOUR_DEBUG_KEY is like 'ab7VJWcdefghiVFqLIz2gKgehKk='
fun isSignatureValid(context: Context): Boolean {
    var result = false
    context.runCatching {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
            val sig = this.packageManager.getPackageInfo(this.packageName, PackageManager.GET_SIGNING_CERTIFICATES).signingInfo
            if (sig.hasMultipleSigners()) {
                sig.apkContentsSigners.map {
                    val certificate = getCertificateSHA1(generateX509CertificateFromSignature(it))
                    if (YOUR_DEBUG_KEY == certificate || YOUR_SIGN_KEY == certificate) {
                        result = true
                    }

                }
            } else {
                sig.signingCertificateHistory.map {
                    val certificate = getCertificateSHA1(generateX509CertificateFromSignature(it))
                    if (YOUR_DEBUG_KEY == certificate || YOUR_SIGN_KEY == certificate) {
                        result = true
                    }
                }
            }
        } else {
            val sig = this.packageManager.getPackageInfo(packageName, PackageManager.GET_SIGNATURES).signatures
            sig.map {
                val certificate = getCertificateSHA1(generateX509CertificateFromSignature(it))
                if (YOUR_DEBUG_KEY == certificate || YOUR_SIGN_KEY == certificate) {
                    result = true
                }
            }
        }
    }.onFailure {
        // 실패시 true 로 반환
        result = true
    }
    return result
}

private fun getCertificateSHA1(certificate: X509Certificate): String? {
    val messageDigest: MessageDigest = MessageDigest.getInstance("SHA")
    val der = certificate.encoded
    messageDigest.update(der)
    val digest: ByteArray = messageDigest.digest()
    return Base64.encodeToString(digest, Base64.DEFAULT).trim()
}

private fun generateX509CertificateFromSignature(signature: Signature): X509Certificate {
    val certificateFactory: CertificateFactory = CertificateFactory.getInstance("X.509")
    val inputStream = ByteArrayInputStream(signature.toByteArray())
    return certificateFactory.generateCertificate(inputStream) as X509Certificate
}

안드로이드 빌드 유효성 검증하는 방법...

내가 빌드한 apk파일을 다른 키스토어 파일로 빌드하는지 판단할 때 사용하면 된다...