Android - 密钥库、应用内购买和外包开发
我目前有一个由外部第三方开发的 Android 应用程序。我们已准备好实施/测试应用内购买，但为了继续进行，我们必须首先将应用程序上传到市场（以便我们可以制作应用内购买 ID）。为了上传到市场，您必须使用非调试密钥对应用程序进行签名。
我的问题是：
- 解决此问题并维护密钥库隐私的最佳方法是什么？
- 以后可以更改密钥库而不影响应用程序的功能吗？
- 假设我不会自己编写应用程序内购买的代码，那么什么是一个好的来回流程可以使这项工作成功呢？
I am currently having an Android application developed by an outside third party. We are at the point where we are ready to implement/test In-App purchasing, but in order to proceed with that we must upload the application to the market first (so we can make the In-App Purchase ID's). In order to upload to the Market, you must sign the application with a non-debug key.
My questions are:
- What is the best way to go about this and maintain the privacy of my keystore?
- Can the keystore be changed later without affecting functionality of the app?
- What is a good back-and-forth process that would make this work, assuming I will not be coding the In-App purchasing myself?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
测试应用程序的最佳方法似乎是让供应商以不同的包名称将其上传到市场，并使用您和该供应商共享的证书。这将是该应用程序的调试版本，不会公开。
测试和调试完成并且您准备好发布生产版本后，您可以让供应商向您提供未签名的 APK 以及最终的包名称，您可以使用您的证书将其上传到 Android Market，您可以使用该证书将其上传到 Android Market。切勿与供应商共享。
It seems the best way to test the app is to have the vendor upload it to Market under a different package name and using a certificate that you and this vendor share. This would be the debug version of the app, which would not be advertised.
After testing and debugging are complete and you're ready to release the production version, you'd have your vendor deliver you the unsigned APK to you with the final package name, and you would upload it to Android Market using your certificate, which you never share with the vendor.
用于签名的密钥对必须保持不变，否则无法更新市场中现有的应用程序。因此，正确的做法是开发者为您提供未签名的 APK，您在本地对其进行签名，然后提交到 Market。
正如 Bruno Oliveira 在另一个答案中建议的那样，出于调试目的，您可以创建一个应用程序并使用您和开发人员之间共享的密钥对其进行签名。但在这种情况下，出于我上面提到的原因，请准备好创建并提交全新的发布申请。
The keypair used for signing must remain unchanged, otherwise you can't update existing application in Market. Consequently right approach is that the developer gives you an unsigned APK and you sign it locally, then submit to Market.
As Bruno Oliveira suggested in another answer, for debug purposes you can create an application and sign it with the key shared between you and developer. But in this case be ready to create and submit a brand new application for release for the reason I mentioned above.