14

I've upgraded to Android L and have both a released version of my app in "Google play" and a debug version which we use for development.

They are signed with different keys.

My problem is that I install the "Google play" version and then when I try installing the debug version, which is defined like so:

debug {
        debuggable true
        packageNameSuffix ".debug"
        buildConfigField BOOLEAN, IS_DEV, TRUE
    }

And this is the error I receive:

Failure [INSTALL_FAILED_DUPLICATE_PERMISSION perm=com.app.name.permission.C2D_MESSAGE pkg=com.app.name]

This is the problematic permission:

<permission
    android:name="com.app.name.permission.C2D_MESSAGE"
    android:protectionLevel="signature"/>

<uses-permission android:name="com.app.name.permission.C2D_MESSAGE"/>

I am aware of (http://commonsware.com/blog/2014/08/04/custom-permission-vulnerability-l-developer-preview.html) and of the fact that this was created due to a security issue, but I still need to be able to work with a team each having their own debug signing key.

I've tried uninstalling using adb uninstall (https://stackoverflow.com/a/27090838/2746924) and I've tried clearing all apps cache on device.

Community
  • 1
  • 1
JY2k
  • 2,879
  • 1
  • 31
  • 60
  • Note that `packageNameSuffix` has been deprecated for some time. Use `applicationIdSuffix` instead. With regards to your problem, I would think that GCM should be caring about the `applicationId`, and so the `com.app.name` pieces of your custom permission should be different between your debug and release builds. In terms of your inability to clear the existing permission, I haven't run tests yet (planned for later today, I hope), but I suspect that a factory reset may be required. – CommonsWare Nov 26 '14 at 17:11
  • 1
    True, changing the package names between release and debug would probably work, but that would kill my flavors. – JY2k Nov 26 '14 at 17:30
  • "changing the package names between release and debug would probably work" -- you're already doing that, as evidenced by your `build.gradle` snippet in your question. – CommonsWare Nov 26 '14 at 17:31
  • Then what is causing my actual problem? if it's not the same name its not the same permission which means i shouldn't have a problem regardless of the keys used? – JY2k Nov 26 '14 at 18:01
  • "Then what is causing my actual problem?" -- does your `debug` build, as it is presently written, work on any version of Android (e.g., 4.4)? IOW, is your problem limited to 5.0 and the installation problem, or is your `packageNameSuffix` *also* screwing things up in prior versions of Android? – CommonsWare Nov 26 '14 at 18:06
  • my debug builds. This scenario is only causing problems on 5.0. on the rest i am able to have both versions- release from market and debug. – JY2k Nov 26 '14 at 18:14
  • If you are saying that your `debug` build actually works on 4.4 and not on 5.0, then you're probably screwed -- you're not going to be able to have `debug` and `release` builds of the same GCM-consuming app installed at the same time on the same device, due to the permission collision. And, if Android 5.0 is not removing custom permissions when the app that declared them is uninstalled, that's an Android bug, with the only workaround that I can think of being a factory reset (or "Wipe Disk" for an emulator image). – CommonsWare Nov 26 '14 at 18:19
  • The debug build work on all versions. it only cannot be installed on a device running 5.0 if the Market APK has already been installed. – JY2k Nov 26 '14 at 18:27
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/65713/discussion-between-jy2k-and-commonsware). – JY2k Nov 26 '14 at 18:27

1 Answers1

24

I can successfully have both debug and release editions of a GCM client app installed on the same Android 5.0 Nexus 9 at the same time, by amending the manifest to use placeholders:

<permission
  android:name="${applicationId}.permission.C2D_MESSAGE"
  android:protectionLevel="signature" />
<uses-permission
  android:name="${applicationId}.permission.C2D_MESSAGE" />

Note that you should also use ${applicationId} in your <receiver> for the <category>:

    <receiver
        android:name="GCMBroadcastReceiverCompat"
        android:permission="com.google.android.c2dm.permission.SEND">
        <intent-filter>
            <action android:name="com.google.android.c2dm.intent.RECEIVE"/>

            <category android:name="${applicationId}" />
        </intent-filter>
    </receiver>

(frankly, I am unconvinced that the custom <permission> is even needed anymore, given that I tried removing it and can still receive GCM messages)

If you then define your build.gradle as you have it, with an applicationIdSuffix for one of the build types (e.g., debug), you will wind up with separate custom permissions by build type, and you will be able to have them installed side by side.

CommonsWare
  • 986,068
  • 189
  • 2,389
  • 2,491