对比APK的数字签名是否一致

目前在做一个应用商店的项目，有一个场景：比如手机上已经安装了一个被篡改过的QQ应用，通过本应用商店下载了一个官方版的QQ应用，在替换安装时提示签名不一致，安装失败，那么这时需要卸载掉已安装的QQ，再安装官方版QQ。所以需要验证一下已安装QQ的数字签名和待安装的QQ的数字签名是否一致。

获取已安装QQ的数字签名:

	public static String getSignatureByPackname(Context context, String packName){
		PackageManager pm = context.getPackageManager();
		List<PackageInfo> apps = pm.getInstalledPackages(PackageManager.GET_SIGNATURES);
		Iterator<PackageInfo> it = apps.iterator();
		while(it.hasNext()){
			PackageInfo info = it.next();
			if(info.packageName.equals(packName)){
				return info.signatures[0].toCharsString();
			}
		}
		return null;
	}

获取待安装官方QQ.apk的数字签名:

public static String getUninstalledApkSignature(String apkPath) { 
        String PATH_PackageParser = "android.content.pm.PackageParser"; 
        try { 
            Class pkgParserCls = Class.forName(PATH_PackageParser); 
            Class[] typeArgs = new Class[1]; 
            typeArgs[0] = String.class; 
            Constructor pkgParserCt = pkgParserCls.getConstructor(typeArgs); 
            Object[] valueArgs = new Object[1]; 
            valueArgs[0] = apkPath; 
            Object pkgParser = pkgParserCt.newInstance(valueArgs); 
            DisplayMetrics metrics = new DisplayMetrics(); 
            metrics.setToDefaults(); 
            typeArgs = new Class[4]; 
            typeArgs[0] = File.class; 
            typeArgs[1] = String.class; 
            typeArgs[2] = DisplayMetrics.class; 
            typeArgs[3] = Integer.TYPE; 
            Method pkgParser_parsePackageMtd = pkgParserCls.getDeclaredMethod("parsePackage", typeArgs); 
            valueArgs = new Object[4]; 
            valueArgs[0] = new File(apkPath); 
            valueArgs[1] = apkPath; 
            valueArgs[2] = metrics; 
            valueArgs[3] = PackageManager.GET_SIGNATURES; 
            Object pkgParserPkg = pkgParser_parsePackageMtd.invoke(pkgParser, valueArgs); 
            
            typeArgs = new Class[2]; 
            typeArgs[0] = pkgParserPkg.getClass(); 
            typeArgs[1] = Integer.TYPE; 
            Method pkgParser_collectCertificatesMtd = pkgParserCls.getDeclaredMethod("collectCertificates",  typeArgs); 
            valueArgs = new Object[2]; 
            valueArgs[0] = pkgParserPkg; 
            valueArgs[1] = PackageManager.GET_SIGNATURES; 
            pkgParser_collectCertificatesMtd.invoke(pkgParser, valueArgs); 
            Field packageInfoFld = pkgParserPkg.getClass().getDeclaredField("mSignatures"); 
            Signature[] info = (Signature[]) packageInfoFld.get(pkgParserPkg); 
            return info[0].toCharsString(); 
        } catch (Exception e) { 
            e.printStackTrace(); 
        } 
        return null; 
    }

通过对比以上两个方法的返回值是否相互equals来判断签名是否一致，over