Can I check if two Android applications are signed with the same key?

Question

I want to check if the signatures of App A and App B match.

I want to do a check in Appendix A and call a method based on the result of this comparison.

public boolean compareAppSignatures() {
    Signature[] sigA = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNATURES).signatures;
    Signature[] sigB = getPackageManager().getPackageInfo("<App B package name>",PackageManager.GET_SIGNATURES).signatures;
    return Arrays.equals(sigA, sigB);
}

Is this a good way to do this? Also, is there a way to check if they are signed with the same key? Can one Android application get a list of signatures of any other application installed on the device?

Answer 1

This is not guaranteed. An APK can be signed with multiple signatures. I need to verify that application B contains a signature certificate that both applications trust.

Answer 2

,

PackageInfo pi = getPackageManager().getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);
Log.i("test", pi.signatures[0].toCharsString());

, , yo

Signature[] sigA = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNATURES).signatures;
    Signature[] sigB = getPackageManager().getPackageInfo("<App B package name>",PackageManager.GET_SIGNATURES).signatures;

public boolean compareAppSignatures() {
    Signature[] sigA = getPackageManager().getPackageInfo(getPackageName(),PackageManager.GET_SIGNATURES).signatures;
    Signature[] sigB = getPackageManager().getPackageInfo("<App B package name>",PackageManager.GET_SIGNATURES).signatures;
    return Arrays.equals(sigA, sigB);
}

Answer 3

I do not think that this can be achieved that way.