{"record":{"id":"e401b15088859246","repo":"Tencent/tinker","slug":"sharesecuritycheck-init-public-key-fail-e401b1","errorCode":null,"errorMessage":"ShareSecurityCheck init public key fail","messagePattern":"ShareSecurityCheck init public key fail","errorType":"exception","errorClass":"TinkerRuntimeException","httpStatus":null,"severity":"critical","filePath":"tinker-android/tinker-android-loader/src/main/java/com/tencent/tinker/loader/shareutil/ShareSecurityCheck.java","lineNumber":173,"sourceCode":"                }\n            }\n        }\n        return false;\n    }\n\n    @SuppressLint(\"PackageManagerGetSignatures\")\n    private void init(Context context) {\n        ByteArrayInputStream stream = null;\n        try {\n            PackageManager pm = context.getPackageManager();\n            String packageName = context.getPackageName();\n            PackageInfo packageInfo = pm.getPackageInfo(packageName, PackageManager.GET_SIGNATURES);\n            mPublicKeyMd5 = SharePatchFileUtil.getMD5(packageInfo.signatures[0].toByteArray());\n            if (mPublicKeyMd5 == null) {\n                throw new TinkerRuntimeException(\"get public key md5 is null\");\n            }\n        } catch (Exception e) {\n            throw new TinkerRuntimeException(\"ShareSecurityCheck init public key fail\", e);\n        } finally {\n            SharePatchFileUtil.closeQuietly(stream);\n        }\n    }\n}\n","sourceCodeStart":155,"sourceCodeEnd":179,"githubUrl":"https://github.com/Tencent/tinker/blob/1b7ea02c239840f563ea64fb5bd286eb98d4011e/tinker-android/tinker-android-loader/src/main/java/com/tencent/tinker/loader/shareutil/ShareSecurityCheck.java#L155-L179","documentation":"ShareSecurityCheck.init catches every exception from PackageManager.getPackageInfo / signature access / md5 computation and rethrows TinkerRuntimeException(\"ShareSecurityCheck init public key fail\", e). The original cause tells the story: NameNotFoundException, null signatures array, or digest failure. Without the app's public key md5, Tinker refuses to verify patches.","triggerScenarios":"new ShareSecurityCheck(context) on devices/contexts where getPackageInfo with GET_SIGNATURES throws or packageInfo.signatures is null/empty — e.g. Android P+ deprecating GET_SIGNATURES without GET_SIGNING_CERTIFICATES handling, or unusual install contexts.","commonSituations":"Targeting newer Android versions where signature APIs changed; shared-user / system apps without standard signing metadata; test environments with unsigned builds; PM returning null signatures on some OEM ROMs.","solutions":["Inspect the cause: NameNotFoundException vs NullPointerException on signatures.","Make sure the APK is release-signed and installed normally.","Update Tinker to a version compatible with the target API level's signing APIs.","Catch TinkerRuntimeException around TinkerInstaller.load / security check usage and report patch-load failure instead of crashing.","Avoid triggering patch load from instrumented or mocked contexts."],"exampleFix":"// before\nTinkerInstaller.load(tinkerApplication);\n// after\ntry {\n    TinkerInstaller.load(tinkerApplication);\n} catch (TinkerRuntimeException e) {\n    ShareTinkerLog.e(TAG, \"tinker init fail, disable patch\", e);\n    TinkerInternals.killTinkerApplicationProcess();\n}","handlingStrategy":"try-catch","validationCode":"try {\n    PackageInfo pi = context.getPackageManager()\n        .getPackageInfo(context.getPackageName(), PackageManager.GET_SIGNATURES);\n    if (pi.signatures == null || pi.signatures.length == 0) {\n        // signatures unavailable on this install: expect init to fail\n    }\n} catch (PackageManager.NameNotFoundException e) {\n    // context/package mismatch: patching cannot be secured\n}","typeGuard":null,"tryCatchPattern":"try {\n    TinkerInstaller.load(application);\n} catch (TinkerRuntimeException e) {\n    Throwable cause = e.getCause(); // PM failure, null signatures, digest error\n    // disable tinker for this session, report to monitoring\n}","preventionTips":["Use matching Tinker versions for the target API level (signature API changes on P+).","Verify the app is signed and installed via normal channels before enabling patching.","Wrap TinkerInstaller.load in a top-level guard so security-check failures never crash startup."],"tags":["android","tinker","security","signature","packagemanager"],"backgroundTag":null,"analyzedSha":"1b7ea02c239840f563ea64fb5bd286eb98d4011e","analyzedAt":"2026-08-14T15:16:52.110Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}