Question

I want to publish a donation stab application (as Minimalistic Text does). As I understand I can check in my main free application that this donation application is installed through PackageManager:

try
{
   ApplicationInfo info = getPackageManager()
                         .getApplicationInfo("com.myproject", 0 );
   //-- application exists
} catch(PackageManager.NameNotFoundException e) {
   //-- application doesn't exist
}

But in fact anyone can provide their own free application with the same package name. How can I receive evidence that this application is truly mine?

Answer 1

If you sign both apps with the same key/certificate, you can check for a signature match. Assuming only you have access to the private key, if they match, it is your own app. Something like:

String myPackageName = application.getPackageName();
PackageManager pm = context.getPackageManager();
PackageInfo pi = pm.getPackageInfo("com.myproject", 0);
boolean isMine = pm.checkSignatures(myPackageName, pi.packageName) == PackageManager.SIGNATURE_MATCH;