Why will my signed apk not install?

Question

I have been developing my app for a while and runing on a real device through Eclipse using Run As -> * Android Application * . Now I am trying to distibute it to some beta users for the first time. I used Eclipse to create a signed app, using a new keystore that I generated through the wizard. This appeared to work fine and when I check with Jarsign I get the message "Jar Verified", although there are a couple of warnings too. These are "This Jar contains entries whose certificate chain is not validated" and "Ths Jar contains signatures that do no include a timestamp".

I then copied the resulting apk onto the device and opened it. But got a message "This app was not installed". And in log cat I can see: "Package has no certificates at entry ; Ignoring!"

I found some people had suggested going back to JDK 6 (I did have 7 previously), but that didn't help. A few people suggested it might be due to duplicate activities in the manifest so I checked the manifest thoroughly.

What I have found is that if I rename the apk so that it is no longer exactly the same name as the last part of the package it suddenly works.

So if the package is com.mydomain.myapp and the apk is myapp.apk I get the error, but if it's myapp_debug.apk it installs just fine.

I find this very confusing and more than a little worrying. I would like to publish this app for real eventually and I'm not sure if I've done something wrong.

Answer 1

Based on your renaming makes it work description, you already have an app with the same package name installed on the device, but signed with a different certificate (probably the debug certificate used for eclipse-launch installs).

You must simply remove the existing installation before you install your release version. You can do that either from the settings menu, or with an ADB command of the form

adb uninstall your.package.name

Note that this removal will wipe out the private data stored by the app - that's part of why you have to do it, to prevent an imposter (naturally having a different certificate) from easily grabbing data left behind by a real app.

Remember also when distributing apps to others in this manner that they will need to allow unknown / non-market sources in their settings menu.