On Fri, Aug 12, 2011 at 11:05 AM, RLScott <[email protected]> wrote: > Since apps are self-signed, anyone can re-sign an app after they have > modified it. How can I provide info to the user who is questioning > whether the app actually came from me? Can I provide my public key to > them by email for them to use in checking the signature? If it makes > any difference, my app will not be published in the Google marketplace > but will be distributed directly by me as a APK file. >
Send them the SHA-1 hash of your binaries by a separate channel, they can simply sha1sum to verify. They can also use jarsigner to verify and display certificates, but that may be overkill and hard to understand. # jarsigner -verify -certs -verbose your.apk BTW, your signing certificate does not have to be self signed. You can have your own CA, and use it issue signing certificates. -- You received this message because you are subscribed to the Google Groups "Android Developers" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/android-developers?hl=en
