eclipse 密钥库和别名 - 是否可以使用多个别名？

Keystore and Aliases - is there a use to multiple aliases?

提问by Steve Haley

When exporting a signed Android application using Eclipse, is there a purpose to using multiple aliases?

使用 Eclipse 导出已签名的 Android 应用程序时，是否有使用多个别名的目的？

According to the official guide about signing, it's recommended that you sign all applications with the same certificate to allow your applications to share data, code and be updated in modular fashion.

根据关于签名的官方指南，建议您使用相同的证书对所有应用程序进行签名，以允许您的应用程序以模块化方式共享数据、代码和更新。

Assuming that "alias", "key" and "certificate" are essentially interchangeable in this context, is there a reason why someone would wantto use different aliases for all their applications? The only reason I can think of is that it adds more security to your applications, in the sense that a compromised key/password doesn't compromise everything. Are there other reasons?

假设“别名”，“键”和“证书”，本质上是可以互换在这种情况下，是有一个原因为什么会有人想使用不同的别名所有的应用程序？我能想到的唯一原因是它为您的应用程序增加了更多安全性，从某种意义上说，泄露的密钥/密码不会危及一切。还有其他原因吗？

Also, is the generated key dependent on the name of the alias? In other words, if you change the name of the alias but not the password, would the generated certificate be different?

另外，生成的密钥是否取决于别名的名称？换句话说，如果你改了别名而不是密码，生成的证书会不会不一样？

采纳答案by Tony Chan

Correct me if I'm wrong but if you'll see this answerto a similar question you see that the certificate does indeed depend on the particular "alias" (within your keystore) that you choose to sign with.

如果我错了，请纠正我，但如果您看到类似问题的这个答案，您会发现证书确实取决于您选择签名的特定“别名”（在您的密钥库中）。

Read the answer carefully and you see that the "keystore" contains "alias"s (which are actually private+public key pairs). When you sign your apk it is the "public key" that is the actual certificate being embedded.

仔细阅读答案，您会看到“密钥库”包含“别名”（实际上是私钥+公钥对）。当您签署您的 apk 时，它是“公钥”，即嵌入的实际证书。

Therefore when updating your app you should always use the same "alias", not just the same "keystore". As for why devs would have multiple "alias"s in their keystore, I'm uncertain of the benefit other than what you and others have stated.

因此，在更新您的应用程序时，您应该始终使用相同的“别名”，而不仅仅是相同的“密钥库”。至于为什么开发人员的密钥库中有多个“别名”，除了您和其他人所说的之外，我不确定其他好处。

And the only way you can sign with a different alias would be to clone the previous one as the answer also suggests.

您可以使用不同别名进行签名的唯一方法是克隆前一个别名，正如答案所暗示的那样。

I have also confirmed that signing an APK with different alias's (from the same Keystore) will generate different APK signing signatureswhich should be proof that different "alias"s = different certificate. How to get your signing sig(<- note: I don't know what the Trace.i method they refer to is, I used Log.i instead)

我还确认使用不同别名（来自同一密钥库）签署APK 将生成不同的 APK签名签名，这应该证明不同的“别名”= 不同的证书。如何获得您的签名（<-注意：我不知道他们所指的 Trace.i 方法是什么，我使用的是 Log.i）

回答by Bruno Bronosky

Do be aware that by signing the apps with different keys you are sacrificing "signature-based permissions" interoperability between your apps.

请注意，通过使用不同的密钥对应用程序进行签名，您将牺牲应用程序之间的“基于签名的权限”互操作性。

Excerpt from Android - Signing Your Applications - Signing Strategies

摘自Android - 签署您的应用程序 - 签署策略

The Android system provides signature-based permissions enforcement, so that an application can expose functionality to another application that is signed with a specified certificate. By signing multiple applications with the same certificate and using signature-based permissions checks, your applications can share code and data in a secure manner.

Android 系统提供基于签名的权限实施，以便应用程序可以向使用指定证书签名的另一个应用程序公开功能。通过使用相同的证书对多个应用程序进行签名并使用基于签名的权限检查，您的应用程序可以以安全的方式共享代码和数据。

回答by Bryan

I was doing some testing, and although it seems to matter which key you use in the keystore, changing the alias on the key and the name of the keystore file doesn't really seem to matter to the handset. If you're curious, I changed the alias with keytool-iui that I got from here: http://code.google.com/p/keytool-iui/

我正在做一些测试，虽然您在密钥库中使用哪个密钥似乎很重要，但更改密钥上的别名和密钥库文件的名称对手机来说似乎并不重要。如果你很好奇，我用我从这里得到的 keytool-iui 更改了别名：http: //code.google.com/p/keytool-iui/

To answer the OP, I would say that it is useful if you work in a large company with multiple divisions writing their own apps. So Wilson's Widgets could have a keystore of wilsonwidgets.keystore, and there could be an internal department with a "widgetmakers" key, and a department with a "widgetdelivery" key, and another department with an "hrdepartment" key. Each department could prevent the other department from updating their app, but the company itself has all of the keys stored in one keystore that can be backed up to one location.

为了回答 OP，我会说如果您在一家拥有多个部门编写自己的应用程序的大公司工作，这很有用。因此，Wilson 的小部件可以有一个 wilsonwidgets.keystore 的密钥库，并且可以有一个带有“widgetmakers”键的内部部门，一个带有“widgetdelivery”键的部门，以及带有“hrdepartment”键的另一个部门。每个部门都可以阻止其他部门更新他们的应用程序，但公司本身将所有密钥存储在一个可以备份到一个位置的密钥库中。

Personally, I sign each app with a different key store them all in the same keystore. I do that so if Google decides to buy one of my apps from me I can break off that one key and give it to them without having to sell them the whole lot or regenerate keys for the other apps. Realistically... I'm just wasting time and effort... sigh

就个人而言，我使用不同的密钥对每个应用程序进行签名，将它们全部存储在同一个密钥库中。我这样做是为了如果 Google 决定从我这里购买我的一个应用程序，我可以断开那个密钥并将其交给他们，而不必将它们全部出售或为其他应用程序重新生成密钥。现实...我只是在浪费时间和精力...叹息