Android OrderedBroadcast Not Working In Release Build

Question

Why would an OrderedBroadcast work in the debug build of the app but not in release? I am sending the following OrderedBroadcast:

context.sendOrderedBroadcast(sendInt, "xxx.xxxx.permission.API", new BroadcastReceiver() {
        @SuppressLint("NewApi")
        @Override
        public void onReceive(Context receivercontext, Intent intent) {
               Bundle results = getResultExtras(true);
               if (results.getInt("Result", Activity.RESULT_CANCELED) == Activity.RESULT_OK) {
                   Log.d("DEBUG", "OK");
               } else {
                   Log.e("DEBUG", "Failed");
               }
         }
}, null, Activity.RESULT_OK, null, null);

Both apps have the appropriate permission in the AndroidManifest.xml file and the receiver is declared as follows:

<receiver android:name="xxx.xxxx.xxxx.Receiver1"
            android:enabled="true"
            android:exported="true"
            android:permission="xxx.xxxx.permission.API">
            <intent-filter>
                <action android:name="xxx.xxxx.permission.API.1" />
            </intent-filter>
</receiver>

As I mentioned if I have both the sender and receiver apps running in debug builds then everything works perfectly however if I run the receiver app in release mode (no proguard or anything) the the sender app just gets the RESULT_CANCELLED result?

This has bugged me for days so any ideas would be greatly appreciated.

Answer 1

It sounds like when you declare the permission, you are using android:protectionLevel="signature". If you are running the sender in debug, it is signed with your debug key. The receiver will be signed with the release key. Thus, the signatures won't match and the receiver will not be granted the permission.

You need to run both in release mode so they are both signed with the same key.

Answer 2

Ok so after much searching and trials it turns out it is a relatively simple yet annoying security feature of Android causing this error:

An app that is installed can only receive and act on a broadcast (either normal or ordered broadcast) if it is first opened on the device. In my case the debug build was automatically opened when run but the release build was not and it had no app icon acting solely as an extension to the main app thus was never opened.

The fix therefore was to have an app icon for the receiving app too and ensure that it is run on the device. The odd part of this is that no security errors are generated in logcat so unless you know about this kind of thing it is very hard to debug!