如何区分应用安装来源？getInstallerPackageName()异常排查与替代方案

Great question! Let's break this down step by step.

The getInstallerPackageName() method relies on Android's Package Manager to store the package name of the app that installed your application. When it returns null on HTC devices, here are the most likely causes:

• ROM Customizations: HTC has historically modified their Android ROMs with custom UI layers (like Sense) that can alter how the Package Manager persists installer info. In some cases, these modifications might clear or fail to store the installer package name, especially on older HTC devices.
• Installation/Update Edge Cases: If the app was initially sideloaded (e.g., via APK file) and later updated via the official store, the installer package name might not be updated to reflect the store. Alternatively, some third-party installers (common on certain devices) don't properly set this metadata during installation.
• Deprecation Limitations: While this method works on older Android versions, it's been deprecated since API 30. On newer HTC devices running Android 11+, there might be system-level restrictions that prevent this method from returning valid data unless your app has the necessary permissions.

Since getInstallerPackageName() has reliability issues across devices, here are more robust alternatives:

1. Use getInstallSourceInfo() (API 30+) #

This is the official replacement for the deprecated method. It provides more detailed and reliable installation source data. Here's a quick code snippet:

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
    try {
        InstallSourceInfo sourceInfo = getPackageManager().getInstallSourceInfo(getPackageName());
        String installerPackage = sourceInfo.getInstallingPackageName();
        // Use installerPackage to identify the source
    } catch (PackageManager.NameNotFoundException e) {
        e.printStackTrace();
    }
} else {
    // Fallback to getInstallerPackageName() for older devices
    String installerPackage = getPackageManager().getInstallerPackageName(getPackageName());
}

2. Implement Store-Specific Install Referrer APIs #

For Google Play and Baidu App Store, you can use their dedicated referrer APIs to track installation sources directly from the store's flow:

• Google Play Install Referrer API: This lets you retrieve the referrer URL passed during installation, which will clearly indicate the app came from Google Play. You'll need to add the com.android.installreferrer:installreferrer dependency to your project.
• Baidu App Store Referrer: Check Baidu's developer documentation for their referrer mechanism—they typically provide a similar way to capture installation source data via intent extras or a dedicated API.

3. Verify App Signatures #

Each store signs your app with their own unique certificate when distributing it. You can extract the signature of the installed app and compare it against the public keys of Google Play and Baidu Store's signing certificates. This method is highly reliable, though it requires you to store the public keys of each store in your app.

Once you have the installation source data, here's how to tell the two stores apart:

• Installer Package Names:
  • Google Play Store will return com.android.vending as the installer package name (via either the deprecated method or getInstallSourceInfo()).
  • Baidu App Store typically uses com.baidu.appsearch as its installer package name (confirm this with Baidu's latest docs to avoid discrepancies).
• Referrer Data:
  • For Google Play, the install referrer will contain parameters like utm_source=google-play.
  • Baidu's referrer will include identifiers specific to their store, which you can cross-reference with their documentation.
• Signature Matching: Compare the installed app's signature against the known signatures of Google Play and Baidu Store. This is the most foolproof method if store package names are unreliable.

内容的提问来源于stack exchange，提问作者Anand