Android requires all applications to be digitally signed with a certificate before being installed on a device or updated.
Application signing allows you to identify the author of the application and ensures that one application cannot access any other application except through well-defined IPC. The signed application certificate defines which user ID is associated with each application; different applications run under different user IDs. When two applications are signed with the same certificate, they can share the user ID they run with, allowing data to be shared.
Applications can be signed by a third party or self-signed. Android provides the required tools to generate self-signed certificates.
|
Applications do not have to be signed by a central authority. Android currently does not perform CA verification for application certificates. For more information, see Certificates and Keystores |
You can sign your Android applications in two ways:
-
From the Android sources.
-
From Android Studio.
Sign your application from Android sources
This mechanism is preferred when you plan to bundle your application with your Android distribution or when you want your application to be part of the system.
The application is automatically signed with the key used to sign the entire system when performing a full build of the Android sources. The advantage of signing your application with the system key is that it can be granted signature privileges to perform high-security tasks, such as system reboot.
The only requirement for this mechanism is that your application is part of the Android system. See Add a default application or library.
When generating your images, the build system signs all applications with test keys, which is not secure. Digi recommends you generate a release key pair and sign your entire system with that pair. See Sign for release.
Sign your application from Android Studio
Use this mechanism when developing applications from Android Studio or when you want to sign your application externally.
When Android Studio runs or debugs an application, it signs it with a debug certificate generated by the Android SDK tools. This debug certificate is not valid for release and most app stores automatically reject it, as it is insecure by design.
To sign your application from Android Studio, follow these steps:
| For more information on application signing, see the official Android documentation topics Sign your app and Application Signing. |
