Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Android: how to share code between projects signed with the same certificate

In Android documentation concerning code signing we can read: "By signing multiple applications with the same certificate and using signature-based permissions checks, your applications can share code and data in a secure manner."

How exactly such code sharing can be done? Is it possible to release main application and multiple exchangeable plugins then discover them at runtime? What does source code looks like and what are advantages over "standard" intents calls from/to different APK packages?

like image 736
tomash Avatar asked Apr 27 '10 13:04

tomash


People also ask

Can two applications be signed with the same signing certificate?

There is no limit. It is worth noting that in most cases, the purpose of a signing certificate is not to certify the contents itself (in this case, the app), but its origins. Multiple apps signed with the same certificate would point to the fact that they're originating from the same source.

Can I use same keystore for multiple apps?

So yes, you can use the same keystore to sign multiple apks, without a problem. You can also use the same alias (each alias is a certificate) to sign multiple apks, and it will work.

How can two Android applications share same Linux user ID and share same VM?

It's possible to arrange for two apps to share the same Linux user ID, in which case they are able to access each other's files. To conserve system resources, apps with the same user ID can also arrange to run in the same Linux process and share the same VM. The apps must also be signed with the same certificate.

What is JKS file in Android?

A Java KeyStore (JKS) is a repository of security certificates. It is required when building mobile apps for Android and for web security encryption. To create a keystore, you need a third-party tool such as keytool , a command line utility included with the Java JDK.


1 Answers

Use Context.createPackageContext() to instantiate a package for another .apk you are interested in. If it is signed with the same cert as yours, AND you are both using the same shared user ID, then you can use the flag to load its code into your process, allowing you to get the ClassLoader from the context and instantiate whatever classes you want.

Otherwise, if they are not signed the same and explicitly using the same shared used ID, you can only load its resources.

Please note that you can not change the shared user ID for an application (to something else or moving between having and not having a shared user ID) once that application is on market.

like image 148
hackbod Avatar answered Oct 18 '22 18:10

hackbod