渠道包签名后注入元数据为何破坏签名与候选身份

#!/bin/bash
set -euo pipefail
# 检查输入参数数量
if [[ $# -ne 2 ]]; then
  echo "用法：$0 <母包 APK> <渠道包 APK>"
  exit 1
fi
APK_MO="$1"
APK_CH="$2"
# 检查文件是否存在
if [[ ! -f "$APK_MO" ]]; then
  echo "错误：母包文件 '$APK_MO' 不存在"
  exit 2
fi
if [[ ! -f "$APK_CH" ]]; then
  echo "错误：渠道包文件 '$APK_CH' 不存在"
  exit 3
fi
# 检查 apksigner 是否可用
if ! command -v apksigner &> /dev/null; then
  echo "错误：未找到 apksigner 命令，请确保已安装 Android SDK Build-tools"
  exit 4
fi
echo "正在比较签名者数量..."
SIGNER_COUNT_MO=$(apksigner verify --print-certs "$APK_MO" 2>/dev/null | grep -c 'Signer #' || echo "0")
SIGNER_COUNT_CH=$(apksigner verify --print-certs "$APK_CH" 2>/dev/null | grep -c 'Signer #' || echo "0")
if [[ "$SIGNER_COUNT_MO" -ne "$SIGNER_COUNT_CH" ]]; then
  echo "失败：签名者数量不一致 (母包:$SIGNER_COUNT_MO, 渠道包:$SIGNER_COUNT_CH)"
  exit 5
fi
echo "正在提取证书 SHA-256 指纹..."
APKSIGNER_CERT1=$(apksigner verify --print-certs "$APK_MO" 2>/dev/null | awk '/SHA-256 digest/{print $NF}')
APKSIGNER_CERT2=$(apksigner verify --print-certs "$APK_CH" 2>/dev/null | awk '/SHA-256 digest/{print $NF}')
if [[ -z "$APKSIGNER_CERT1" || -z "$APKSIGNER_CERT2" ]]; then
  echo "失败：无法提取证书指纹，可能包未签名或格式错误"
  exit 6
fi
if [[ "$APKSIGNER_CERT1" != "$APKSIGNER_CERT2" ]]; then
  echo "失败：证书指纹不一致"
  echo "母包指纹：${APKSIGNER_CERT1}"
  echo "渠道包指纹：${APKSIGNER_CERT2}"
  exit 7
fi
echo "证书一致，检查签名覆盖方案..."
apksigner verify --verbose "$APK_MO" > /tmp/mother_verify.txt 2>&1 || true
apksigner verify --verbose "$APK_CH" > /tmp/channel_verify.txt 2>&1 || true
# 提取 Verified using 行进行比较
VERIFY_MO=$(grep "Verified using" /tmp/mother_verify.txt | sort)
VERIFY_CH=$(grep "Verified using" /tmp/channel_verify.txt | sort)
if [[ "$VERIFY_MO" != "$VERIFY_CH" ]]; then
  echo "失败：签名方案覆盖不一致"
  echo "母包方案：$VERIFY_MO"
  echo "渠道包方案：$VERIFY_CH"
  exit 8
fi
echo "成功：母包与渠道包签名状态完全一致"
exit 0