Question

i have an Android open source application published here https://github.com/evilsocket/dsploit … as you can see in the Downloads section, i distribute precompiled apk packages for my users.

The app implements a very simple auto update engine:

1. At startup it checks the file VERSION in the github repository which contains the string of the latest version available and compares it with the running version name.
2. If the remote version > local version, then the app downloads the new apk from the repo.

The problem is that when the install process starts:

Intent intent = new Intent( Intent.ACTION_VIEW );
intent.setDataAndType( Uri.fromFile( file ), "application/vnd.android.package-archive" );
intent.setFlags( Intent.FLAG_ACTIVITY_NEW_TASK );

mContext.startActivity(intent);

The user gets the error message:

An existing package by the same name with a conflicting signature is already installed.

To create the apk in eclipse, i export a signed apk and create a new keystore for each version … do i have to use always the same keystore ?

thanks

Answer 1

Yes! You always have to use the same keystore. In fact, if you were using the Google Play Store it won’t let you post the update if it was signed with a different keystore. If you no longer have the same keystore that you used to sign the first apk then you’ll need your users to uninstall the app and install the new version. From now on, if you use the same keystore, the process should go smoothly.