[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-27。"],[],[],null,["# App signing\n\n| **Note:** If you are using [Android App Links](https://developer.android.com/training/app-links#android-app-links) make sure to update the SHA256 fingerprints of your keys in the corresponding [Digital\n| Asset Links JSON file](https://developer.android.com/training/app-links/verify-site-associations#web-assoc) on your website.\n\n\nApp signing allows developers to identify the author of the app\nand to update their app without creating complicated interfaces and\npermissions. Every app that is run on the Android platform must be\n[signed by the developer](https://developer.android.com/studio/publish/app-signing).\nApps that attempt to install without being signed\nare rejected by either Google Play or the package installer on the Android\ndevice.\n\n\nOn Google Play, app signing bridges the trust Google has with the\ndeveloper and the trust the developer has with their app. Developers\nknow their app is provided, unmodified, to the Android device; and\ndevelopers can be held accountable for behavior of their app.\n\n\nOn Android, app signing is the first step to placing an app in\nits Application Sandbox. The signed app certificate defines which user\nID is associated with which app; different apps run under\ndifferent user IDs. App signing ensures that one app can't\naccess any other app except through well-defined IPC.\n\n\nWhen an app (APK file) is installed onto an Android device, the Package\nManager verifies that the APK has been properly signed with the certificate\nincluded in that APK. If the certificate (or, more accurately, the public key in\nthe certificate) matches the key used to sign any other APK on the device, the\nnew APK has the option to specify in the manifest that it shares a UID with\nthe other similarly signed APKs.\n\n\nApps can be signed by a third-party (OEM, operator, alternative market)\nor self-signed. Android provides code signing using self-signed certificates\nthat developers can generate without external assistance or permission.\nApps don't have to be signed by a central authority. Android currently\ndoesn't perform CA verification for app certificates.\n\n\nApps are also able to declare security permissions at the Signature\nprotection level, restricting access only to apps signed with the same\nkey while maintaining distinct UIDs and Application Sandboxes. A closer\nrelationship with a shared Application Sandbox is allowed using the\n[shared UID feature](https://developer.android.com/guide/topics/manifest/manifest-element#uid) where two or more apps signed with same\ndeveloper key can declare a shared UID in their manifest.\n| **Note:** As of Android 13, shared UIDs are deprecated. Users of Android 13 or higher should put the line `android:sharedUserMaxSdkVersion=\"32\"` in their manifest. This entry prevents new users from getting a shared UID.\n\nAPK signing schemes\n-------------------\n\n\nAndroid supports three app signing schemes:\n\n- v1 scheme: based on JAR signing\n- v2 scheme: [APK Signature Scheme v2](/docs/security/features/apksigning/v2), which was introduced in Android 7.0.\n- v3 scheme: [APK Signature Scheme v3](/docs/security/features/apksigning/v3), which was introduced in Android 9.\n\n\nFor maximum compatibility, sign apps with all\nschemes, first with v1, then v2, and then v3. Android 7.0+ and newer devices\ninstall apps signed with v2+ schemes more quickly than those signed only with\nv1 scheme. Older Android platforms ignore v2+ signatures and thus need apps to\ncontain v1 signatures.\n\n### JAR signing (v1 scheme)\n\n\nAPK signing has been a part of Android from the beginning. It is based on [signed JAR](https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html#Signed_JAR_File). For details on using this scheme, see the Android Studio\ndocumentation on\n[Signing your app](https://developer.android.com/studio/publish/app-signing).\n\n\nv1 signatures don't protect some parts of the APK, such as ZIP metadata. The\nAPK verifier needs to process lots of untrusted (not yet verified) data\nstructures and then discard data not covered by the signatures. This offers a\nsizeable attack surface. Moreover, the APK verifier must uncompress all\ncompressed entries, consuming more time and memory. To address these issues,\nAndroid 7.0 introduced APK Signature Scheme v2.\n\n### APK signature scheme v2 and v3 (v2+ scheme)\n\n\nDevices running Android 7.0 and later support APK signature scheme v2 (v2\nscheme) and later. (v2 scheme was updated to v3 in\nAndroid 9 to include\nadditional information in the signing block, but otherwise works the same.) The\ncontents of the APK are hashed and signed, then the resulting APK signing block\nis inserted into the APK. For details on applying the v2+ scheme to an app, see\n[APK Signature Scheme v2](https://developer.android.com/about/versions/nougat/android-7.0#apk_signature_v2).\n\n\nDuring validation, v2+ scheme treats the APK file as a blob and performs signature\nchecking across the entire file. Any modification to the APK, including ZIP metadata\nmodifications, invalidates the APK signature. This form of APK verification is\nsubstantially faster and enables detection of more classes of unauthorized\nmodifications.\n\n\nThe new format is backwards compatible, so APKs signed with the new signature\nformat can be installed on older Android devices (which simply ignore the extra\ndata added to the APK), as long as these APKs are also v1-signed.\n\n\n**Figure 1.** APK signature verification\nprocess\n\n\nWhole-file hash of the APK is verified against the v2+ signature stored in the\nAPK signing block. The hash covers everything except the APK signing block,\nwhich contains the v2+ signature. Any modification to the APK outside of the APK\nsigning block invalidates the APK's v2+ signature. APKs with stripped v2+\nsignature are rejected as well, because their v1 signature specifies that the\nAPK was v2-signed, which makes Android 7.0 and newer refuse to verify APKs\nusing their v1 signatures.\n\nFor details on the APK signature verification process, see the [Verification section](/docs/security/features/apksigning/v2#verification) of APK Signature Scheme v2."]]
