Is there a way to check if an app signature is debug or published?

Question

I am currently developing RPC services for developers to use, but would like to make sure that I can distinguish between another app\'s debug key and their public key. Is there

Answer 1

By default the androiddebugkey used by Eclipse (for instance) has a notAfter date & time that is at most 1 year in the future - such a short value is not accepted by the Android Market - you could use that to differentiate between developer signed builds? Or .. you could just check the publickey that the app uses - have them sign the RPC requests with the android.content.pm.Signature of their app?

PackageInfo pkgInfo = getPackageManager().getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);

for (Signature appSignature : pkgInfo.signatures) {
    // javax.security - NOT java.security!
    X509Certificate appCertificate = X509Certificate.getInstance(appSignature.toByteArray());
    // appCertificate.getNotAfter() can give you the date & time the cert expires
    // appCertificate.getPublicKey() can give you the public key you sign the RPC requests with.
    // appCertificate.getSubjectDN() will give you a Principal named "CN=Android Debug,O=Android,C=US" for any debug certificate that hasn't been handcrafted by the developer.
}