android in_app billing Signature verification failed.

今天测试in_app billing 时，发现Security.java总是会出现 ‘Signature verification failed’ 的提示错误：

/**

* Verifies that the signature from the server matches the computed

* signature on the data. Returns true if the data is correctly signed.

*

* @param publicKey public key associated with the developer account

* @param signedData signed data from server

* @param signature server signature

* @return true if the data and signature match

*/

public static boolean verify(PublicKey publicKey, String signedData, String signature) {

if (Consts.DEBUG) {

Log.i(TAG, "signature: " + signature);

}

Signature sig;

try {

sig = Signature.getInstance(SIGNATURE_ALGORITHM);

sig.initVerify(publicKey);

sig.update(signedData.getBytes());

if (!sig.verify(Base64.decode(signature))) { // 这里总是返回 false ，难证不成功

Log.e(TAG, "Signature verification failed.");

return false; // 可以暂时设为 return true;

}

return true;

} catch (NoSuchAlgorithmException e) {

Log.e(TAG, "NoSuchAlgorithmException.");

} catch (InvalidKeyException e) {

Log.e(TAG, "Invalid key specification.");

} catch (SignatureException e) {

Log.e(TAG, "Signature exception.");

} catch (Base64DecoderException e) {

Log.e(TAG, "Base64 decoding failed.");

}

return false;

}

因为 Signature verification failed ，所以总是返回 false, 所有些方法永远无法执行，如

DungeonsPurchaseObserver类中的

@Override

public void onPurchaseStateChange(PurchaseState purchaseState, String itemId,

int quantity, long purchaseTime, String developerPayload) { .....

//这个方法会因为 签名论证失败，而永远无法执行，所以你可以让签名验证部分的代码总是返回true来进行一般测试工作。

}

问题出现的原因： app 没有sign

That signature verification error can be caused by:

1.- A wrong public key. Maybe you've forgotten to copy some character. It happens :)

2.- The
.apk must be signed. You can't use the debug.keystore, if you do your signature string will be empty.

And remember, for testing In-app billing:

Add Android Market public key to Security.java (

String
base64EncodedPublicKey = "your public key here"

)

Build in release mode and sign it (If you are using Eclipse, you can use the Export Wizard).

Upload the release version to Android Market, do not publish it, and create the product list.

Install the application onto your device ( adb -d install myapp.apk ) and make a test account primary on your device.

参考资料：

http://stackoverflow.com/questions/7070573/android-in-app-billing-security-java-says-signature-verification-failed