Application package processing method and device, electronic equipment and storage medium

Abstract

The invention provides an application package processing method and device, electronic equipment and a storage medium, and the method comprises the steps that application management equipment obtains a basic application package; analyzing the basic application program package to obtain a signature version type corresponding to the basic application program package; determining offset position information according to the signature version type; the offset position information is sent to the downloading device, so that the downloading device generates target injection address information based on the offset position information, the target injection address information is sent to the content distribution device, and the target injection address information is used for guiding the content distribution device to download the content when the content distribution device receives a user downloading request. And attribution information is injected into the basic application package based on the target injection address information to generate a target application package, and the attribution information is used for representing downloading source information of the target application package. According to the embodiment provided by the scheme, the consumption of storage resources can be reduced, and the operation, maintenance and distribution efficiency of the application package can be improved.

Description

Technical Field

[0001] This application relates to the field of application package processing technology, and in particular to an application package processing method, apparatus, electronic device and storage medium. Background Technology

[0002] Currently, in the distribution and promotion of Android applications, channel attribution typically relies on pre-compiled solutions, which generate separate application packages for different distribution channels and sign them individually. While this method can distinguish the download source of an application, it requires storing a massive number of application packages, potentially wasting storage resources and leading to low operational efficiency. Summary of the Invention

[0003] This application provides a method, apparatus, electronic device, and storage medium for processing application packages, which can reduce storage resource consumption and improve the operation, maintenance, and distribution efficiency of application packages. The above technical solution is as follows: In a first aspect, embodiments of this application provide a method for processing application packages, which is applied to an application management device and includes: Obtain the basic application package, which is a digitally signed application installation package. The above basic application package is parsed to obtain the signature version type corresponding to the above basic application package; The offset position information is determined based on the above signature version type. The offset position information is used to characterize the position information of the location to be injected within the above basic application package. The aforementioned offset position information is sent to the download device so that the download device generates target injection address information based on the aforementioned offset position information, and sends the aforementioned target injection address information to the content distribution device. The aforementioned target injection address information is used to guide the content distribution device to inject attribution information into the aforementioned basic application package based on the aforementioned target injection address information when receiving a user download request, so as to generate a target application package. The aforementioned attribution information is used to characterize the download source information of the aforementioned target application package.

[0004] In one possible implementation, the above-mentioned parsing of the basic application package yields the signature version type corresponding to the basic application package, including: Extract the metadata information of the aforementioned basic application package; Check whether the above metadata information contains a preset identifier; If the above-mentioned metadata information does not contain the above-mentioned preset identifier, the signature version type corresponding to the above-mentioned basic application package is determined to be the first type. The first type is used to characterize the signature mechanism type that places the signature information in the preset metadata directory and signs each file in the above-mentioned basic application package one by one. If the aforementioned metadata information contains the aforementioned preset identifier, the signature version type corresponding to the aforementioned basic application package is determined to be the second type. The aforementioned second type is used to characterize the signature mechanism type that performs integrity verification on the overall content of the aforementioned basic application package based on the signature block.

[0005] In one possible implementation, determining the offset position information based on the aforementioned signature version type includes: When the above signature version type is the first type, the starting offset position and length field of the central directory end record area of ​​the above basic application package are used as offset position information. When the above signature version type is the second type, the starting offset position of the signature block in the above basic application package, the total length of the above signature block, and the ending offset position of the last key-value pair in the above signature block are used as the offset position information.

[0006] In one possible implementation, sending the offset position information to the download device includes: Receive the offset position query request from the download device. The offset position query request includes the application identifier corresponding to the basic application package. Based on the aforementioned offset position query request, the aforementioned offset position information is sent to the aforementioned download device.

[0007] In one possible implementation, the above method also includes: The aforementioned basic application package is sent to the aforementioned content distribution device so that when the aforementioned content distribution device receives a user download request, it injects attribution information into the aforementioned basic application package based on the aforementioned target injection address information.

[0008] Secondly, embodiments of this application provide a method for generating an application package, applied to a content distribution device, comprising: Obtain the basic application package, which is a digitally signed application installation package. The system receives target injection address information sent by the download device. The target injection address information is generated by the download device based on offset position information. The offset position information is sent to the download device by the application management device. The offset position information is used to characterize the position information of the injection location within the basic application package. The offset position information is determined by the application management device based on the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package. In response to a user's download request, attribution information is injected into the basic application package based on the target injection address information to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

[0009] In one possible implementation, in response to a user download request, attribution information is injected into the base application package based on the target injection address information to generate a target application package, including: In response to a user's download request, the user's download request is parsed to obtain attribution information; Based on the above target injection address information and the above attribution information, the injection parameters are determined; Based on the above injection parameters, the above attribution information is injected into the above basic application package.

[0010] In one possible implementation, when the above signature version type is the first type, the above injection parameters include the above offset position information, which includes the starting offset position and length field of the central directory end record area, as well as the sequence of data bytes to be injected. The injection of the attribution information into the base application package based on the injection parameters described above includes: Based on the starting offset position of the central directory end record area and the sequence length of the data byte sequence to be injected, the length field of the central directory end record area is updated, and the data byte sequence to be injected is appended to the end of the basic application package file to generate the target application package.

[0011] In one possible implementation, when the above signature version type is the second type, the above injection parameters include the above offset position information, the sequence of data bytes to be injected, and the central directory offset to be adjusted. The injection of the attribution information into the base application package based on the injection parameters described above includes: Based on the aforementioned offset position information, the key-value pair insertion position in the aforementioned basic application package is determined, and the total length of the signature block is determined. A new key-value pair unit is constructed based on the above injected data byte sequence, and the byte length of the above new key-value pair unit is determined; The total length of the signature block is updated based on the total length of the signature block and the byte length of the new key-value pair unit. The new key-value pair unit is injected based on the key-value pair insertion position. The central directory offset to be adjusted is adjusted based on the byte length of the new key-value pair unit, and the target application package is generated.

[0012] Thirdly, embodiments of this application provide an application package generation system, including an application management device, a content distribution device, and a download device, wherein the application management device is used to execute the steps of the method provided by the first aspect of the embodiments of this application or any possible implementation of the first aspect; and the content distribution device is used to execute the steps of the method provided by the second aspect of the embodiments of this application or any possible implementation of the second aspect.

[0013] Fourthly, embodiments of this application provide an application package processing apparatus, which is applied to an application management device, including: The first acquisition module is used to acquire the basic application package, which is an application installation package that has been digitally signed. The parsing module is used to parse the aforementioned basic application package to obtain the signature version type corresponding to the aforementioned basic application package; The determination module is used to determine the offset position information based on the above signature version type. The offset position information is used to characterize the position information of the location to be injected within the above basic application package. The first sending module is used to send the aforementioned offset position information to the downloading device, so that the downloading device generates target injection address information based on the aforementioned offset position information, and sends the aforementioned target injection address information to the content distribution device. The aforementioned target injection address information is used to guide the content distribution device to inject attribution information into the aforementioned basic application package based on the aforementioned target injection address information when receiving a user download request, so as to generate a target application package. The aforementioned attribution information is used to characterize the download source information of the aforementioned target application package.

[0014] Fifthly, embodiments of this application provide an apparatus for generating an application package, wherein the apparatus is applied to a content distribution device, and includes: The second acquisition module is used to acquire the basic application package, which is an application installation package that has been digitally signed. The receiving module is used to receive target injection address information sent by the downloading device. The target injection address information is information generated by the downloading device based on offset position information. The offset position information is information sent to the downloading device by the application management device. The offset position information is used to characterize the position information of the injection location inside the basic application package. The offset position information is information determined by the application management device according to the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package. The injection module is used to respond to a user's download request by injecting attribution information into the basic application package based on the target injection address information, thereby generating a target application package. The attribution information is used to characterize the download source information of the target application package.

[0015] Sixthly, embodiments of this application provide an electronic device, including: a processor and a memory; The aforementioned memory stores a computer program adapted to be loaded by the aforementioned processor and execute the steps of the method provided by the first aspect of the embodiments of this application or any possible implementation thereof, or the aforementioned computer program adapted to be loaded by the aforementioned processor and execute the steps of the method provided by the second aspect of the embodiments of this application or any possible implementation thereof.

[0016] In a seventh aspect, embodiments of this application provide a computer storage medium storing a plurality of instructions, which are adapted to be loaded by a processor and execute the steps of the method provided by the first aspect of the embodiments of this application or any possible implementation thereof, or the instructions are adapted to be loaded by a processor and execute the steps of the method provided by the second aspect of the embodiments of this application or any possible implementation thereof.

[0017] This application embodiment obtains a digitally signed basic application installation package through an application management device, parses the basic application package to obtain the signature version type corresponding to the basic application package, then determines offset position information based on the signature version type, the offset position information is used to characterize the position information of the to be injected within the basic application package, and sends the offset position information to a download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device, the target injection address information is used to guide the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, so as to generate a target application package, the attribution information is used to characterize the download source information of the target application package. Therefore, by maintaining only a single digitally signed basic application package and dynamically injecting attribution information based on the signature version type and offset position during the download and distribution process, it is not necessary to generate and store corresponding application packages separately for each channel. This significantly reduces the number of application packages and lowers storage resource consumption. At the same time, it avoids the tedious operations of repeated signing and distribution, effectively improving the operation and distribution efficiency of application packages. Furthermore, since the attribution information is dynamically injected, it can flexibly and accurately identify the download source of the application, improving the universality and accuracy of attribution. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram of the structure of an application processing system provided as an exemplary embodiment of this application; Figure 2 A flowchart illustrating an application package processing method provided as an exemplary embodiment of this application; Figure 3 A schematic diagram of a ZIP package format provided for an exemplary embodiment of this application; Figure 4 A schematic diagram of the location of a signature block provided for an exemplary embodiment of this application; Figure 5 A schematic diagram illustrating the specific structure of a signature block provided in an exemplary embodiment of this application; Figure 6 A flowchart illustrating a method for determining a signature version type provided in an exemplary embodiment of this application; Figure 7 A flowchart illustrating an application package generation method provided as an exemplary embodiment of this application; Figure 8 A flowchart illustrating a method for determining a target application package, provided as an exemplary embodiment of this application; Figure 9 A schematic diagram illustrating the specific process of an application package generation method provided for an exemplary embodiment of this application; Figure 10 A schematic diagram of the structure of an application package processing device provided for an exemplary embodiment of this application; Figure 11 A schematic diagram of the structure of an application package generation apparatus provided for an exemplary embodiment of this application; Figure 12 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application. Detailed Implementation

[0020] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0021] The terms "first," "second," "third," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus. The term "at least one" in this application means one or more, and the term "multiple" means two or more; for example, multiple second devices means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0022] Please refer to the following. Figure 1 The example illustrates a schematic diagram of the structure of an application package generation system provided in an embodiment of this application. Figure 1 As shown, the system includes an application management device 110, a content distribution device 120, and a download device 130. The application management device 110, the content distribution device 120, and the download device 130 can communicate with each other via a wired communication network or a wireless communication network.

[0023] In one embodiment, each of the application management device 110, content distribution device 120, and download device 130 can be either hardware or software. When the device is hardware, it can be various electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. When the device is software, it can be installed in the electronic devices listed above, and can be implemented as multiple software programs or software modules (e.g., application management device 110 can provide application management services, content distribution device 120 can provide content distribution services, and download device 130 can provide download services), or it can be implemented as a single software program or software module; no specific limitation is made here.

[0024] Optionally, the application management device 110 can be a server device that provides application packaging, signing, and metadata management, such as an enterprise's internal application management server, a management backend server of a third-party application distribution platform, or a general-purpose computing device running an application management module. The content distribution device 120 can be a server device that provides application distribution and dynamic injection services, such as a Content Delivery Network (CDN) node server, a cloud distribution server, or a load balancer running a distribution module. The download device 130 can be a user-side terminal device used to initiate application download requests and receive target application packages, such as a smartphone, tablet, laptop, desktop computer, or other terminal device running a download client module.

[0025] In some embodiments, the application management device 110 obtains a basic application package, which is a digitally signed application installation package. The device then parses the basic application package to obtain the corresponding signature version type and determines offset position information based on the signature version type. This offset position information represents the location information of the injection point within the basic application package. The application management device 110 then sends the offset position information to the download device 130, causing the download device 130 to generate target injection address information based on the offset position information and send it to the content distribution device 120. This target injection address information guides the content distribution device 120 to inject attribution information into the basic application package upon receiving a user download request, thereby generating a target application package. The attribution information represents the download source information of the target application package.

[0026] An exemplary embodiment of this application provides a method for processing application packages. This application package processing method can be applied to the application management device 110 described above. Please refer to [reference needed] for details. Figure 2The example illustrates a flowchart of an application package processing method provided in an embodiment of this application. Figure 2 As shown, the application package processing method includes the following S201-S204: S201: Obtain the basic application package, which is a digitally signed application installation package.

[0027] The base application package can refer to an Android application package (APK) file that has been compiled by the developer and digitally signed, but has not been written with any channel or attribution metadata.

[0028] Optionally, the basic application package can be compiled by the relevant developers and digitally signed before being uploaded to the application management platform installed on the application management device. The application management platform can perform metadata extraction, version recording and integrity verification on the basic application package, and assign a unique identifier and storage path to the basic application package for subsequent retrieval and distribution.

[0029] It should be noted that digital signature can refer to an encryption and verification mechanism that signs the contents of an APK file to prove the application's origin and ensure the file's integrity.

[0030] In addition, the aforementioned application management platform can also distribute or synchronize basic application packages to the cache or object storage of content distribution devices to improve downstream distribution efficiency.

[0031] S202: Parse the above basic application package to obtain the signature version type corresponding to the above basic application package.

[0032] Understandably, APK files typically use the Zone Information Protocol (ZIP) file format as a container, and their file structure usually includes a file information area, a central directory area, and an end of central directory (EOCD) record area. Figure 3 A schematic diagram of a ZIP package format is provided for an exemplary embodiment of this application, as shown below. Figure 3The file information area stores several file entries sequentially, each representing information about a single file. Each entry includes a local file header, file data, and a data descriptor, used to record and store the actual file content. The central directory area centrally stores the directory records of each file (such as central directory file header 1, central directory file header 2). Each directory record not only contains basic information about the corresponding file but may also contain an offset pointing to the local file header, thus enabling quick location of file information. The central directory end record area is located at the end of the file and is used to store overall information about the central directory, including the central directory end record (such as the size of the central directory, the total number of files, the offset of the central directory's starting position, and optional comments). Decompression tools can locate the central directory section by recognizing this central directory end record.

[0033] In one embodiment, the signature version type can be a category that identifies the APK file signing scheme used. The signature version type corresponding to the aforementioned basic application package can be a first type or a second type. The first type is used to characterize a signing mechanism type that places the signature information in a preset metadata directory and signs each file in the aforementioned basic application package one by one; the second type is used to characterize a signing mechanism type that performs integrity verification on the entire content of the aforementioned basic application package based on the signature block.

[0034] Specifically, the basic application package corresponding to the first type can be an APK file signed using the APK Signature Scheme v1 (the first version of the Android installation package signing scheme) in related technologies. The basic application package corresponding to the second type can be any of the following: an APK file signed using APK Signature Scheme v2 (the second version of the Android installation package signing scheme), an APK file signed using APK Signature Scheme v3 (the third version of the Android installation package signing scheme), an APK file signed using APK Signature Scheme v4 (the fourth version of the Android installation package signing scheme), etc.

[0035] Specifically, the V1 signing scheme is based on the traditional Java Archive (JAR) file signing method, performing integrity verification only on each file within the APK file. Signature data is stored in a preset metadata directory, such as the META-INF directory of the APK file, and the entire ZIP file structure is not verified. The META-INF directory acts as an information packet storing metadata files, which can be used to configure applications, extensions, and class loader files. This packet is automatically generated during packaging. The V2 signing scheme achieves integrity verification of the entire APK file content by introducing an APK Signing Block before the central directory area. The V3 signing scheme adds support for key rotation; the V4 signing scheme adds support for incremental installation. All three signing schemes rely on the APK signing block, which stores information such as the signature, digest, signature algorithm, certificate chain, and extended attributes.

[0036] S203: Determine the offset position information based on the above signature version type. The offset position information is used to characterize the position information of the location to be injected within the above basic application package.

[0037] The offset position information can be a set of data used to locate byte-level positions and related length fields within the base application package that can be injected or modified.

[0038] Optionally, when the signature version type is the first type, the corresponding offset position information may include the starting offset position and length field of the central directory end record area of ​​the underlying application package. The starting offset position of the central directory end record area indicates the byte starting position of the central directory end record area within the entire file; the length field of the central directory end record area can be the "comment area length" field recorded in EOCD, used to describe the size of the central directory end record area.

[0039] Optionally, when the signature version type is the second type, the corresponding offset information may include the starting offset of the signature block in the base application package, the total length of the signature block, and the ending offset of the last key-value pair in the signature block. The signature block is a data structure located before the central directory area, used to store information related to the APK file signing scheme (V2 / V3 / V4); the signature block contains key-value pair information such as the APK file's signature, digest, signing algorithm, certificate chain, and extended attributes. The starting offset of the signature block can be the starting address of the signature block in the APK file's byte sequence. The total length of the signature block can be the length field recorded in the signature block header, used to represent the number of bytes in the entire signature block (containing all key-value pair units). The ending offset of the last key-value pair can be the byte offset address of the end position of the last key-value pair unit within the signature block in the entire APK file.

[0040] Figure 4 A schematic diagram of the location of a signature block is provided for an exemplary embodiment of this application, as shown below. Figure 4 The APK signing schemes in versions V2, V3, and V4 all employ an APKSigning Block inserted before the central directory area of ​​the ZIP file. This signing block does not affect the normal decompression operation of the ZIP file, but during the installation process, the Android system uses it to perform integrity verification on the overall content of the APK file. Specifically, before signing, the APK file structure includes a file information area, a central directory area, and a central directory end record area; after signing, a signing block is added between the file information area and the central directory area, thus achieving security verification of the overall content of the application package without changing the basic compression structure of the ZIP file.

[0041] S204: Send the aforementioned offset position information to the download device so that the download device generates target injection address information based on the aforementioned offset position information, and sends the aforementioned target injection address information to the content distribution device. The aforementioned target injection address information is used to guide the content distribution device to inject attribution information into the aforementioned basic application package based on the aforementioned target injection address information when receiving a user download request, so as to generate a target application package. The aforementioned attribution information is used to characterize the download source information of the aforementioned target application package.

[0042] The download device can be a user-side terminal device used to initiate application download requests and receive target application packages, such as a smartphone, tablet, laptop, desktop computer, or other terminal device running a download client module.

[0043] Optionally, the target injection address information can be used as a description or reference to trigger the injection, specifically a Uniform Resource Locator (URL) address with parameters. The target injection address information may include offset location information, the application identifier (apk_id) corresponding to the underlying application package, channel information, and possible injection strategy indication information, etc.

[0044] In one embodiment, a user download request may be a Hypertext Transfer Protocol (HTTP) request initiated by the downloading device to the content distribution device to obtain the application installation package and install it locally (i.e., on the downloading device). The user download request may include the downloading device's device identifier (e.g., device serial number), network address, application identifier, request timestamp, and optional channel identifier parameters or authentication tokens.

[0045] Optionally, attribution information can be used for attribution statistics and campaign performance analysis. Specific attribution information may include: channel information identifiers, used to identify the distribution channels of the target application package, such as app store identifiers, promotion partner identifiers, advertising platform identifiers, etc.; campaign identifier information, used to characterize the corresponding promotional campaign or campaign plan, such as advertising campaign identifiers, marketing batch numbers, promotion cycle numbers, etc.; creative identifier information, used to identify specific advertising creatives or creative versions, such as advertising creative identifiers, landing page version numbers, etc.; user identifier information, used to associate with downloading devices or user sessions, such as user session identifiers, anonymized user identifiers, referral source codes, etc.; time and location parameters, such as download timestamps, attribution generation time, and geographic location information; and security and verification information, such as data integrity verification values, signature verification codes, and anti-counterfeiting random numbers, etc.

[0046] It is understandable that the target application package can be the final installation package generated and distributed by the content distribution device after injecting attribution information and updating the necessary structural fields based on the base application package during the download request process, which is the file that the user actually downloads and installs.

[0047] In one embodiment, when the base application package uses the V1 signing scheme (i.e., the signature type corresponding to the base application package is Type 1), the signature data can be stored in the META-INF directory of the APK file, which belongs to the file information area of ​​the ZIP file. Since the V1 signing mechanism only performs integrity checks on each file within the APK file and does not check the overall structure of the entire ZIP file, attribution information can be appended to the comment area of ​​the end record section in the central directory of the ZIP file without modifying the signed data content. In this way, attribution information can be written to the APK file as channel information without compromising the validity of the original V1 signature verification, thereby generating a target application package that can characterize the download source.

[0048] In another embodiment, when the base application package adopts the V2 / V3 / V4 signing scheme (i.e., the signing type corresponding to the base application package is the second type), the channel information can be written by injecting attribution information into the padding block in the APK signing block. Figure 5 This is a schematic diagram illustrating the specific structure of a signature block provided for an exemplary embodiment of this application. For example... Figure 5 Specifically, the APK file contains signature-related padding information. This padding information does not participate in signature verification, so custom data can be added to it. The padding information can be stored using a length (L), type (T), and value (V) structure, where L represents the data length of the signature block, T is the signature block identifier (block id), and V is the specific data content. Specifically, a new channel information data block can be inserted into the padding information. This channel information data block can also use an LTV structure, where L represents the length of the channel information data block, T is the channel information identifier (e.g., a fixed value of 0x881155FF), and V is the specific data content of the channel information (e.g., an identifier string representing the application's source channel, with a length not exceeding 100 bytes). After inserting the channel information data block, the length field of the padding information needs to be updated accordingly, making it equal to the original length plus the overall length of the channel data block. Furthermore, the downloading device can determine the injection strategy based on a pre-generated JSON description file, which includes fields such as channel information type (channel_type), offset position information, and injected data length. After receiving a user's download request, the content distribution device can inject the corresponding channel information data block into the padding information of the APK file according to the guidance of the JSON file, thereby obtaining the target application package with attribution information.

[0049] In this embodiment, the application management device obtains a digitally signed basic application installation package and parses it to obtain the signature version type corresponding to the basic application package. Then, it determines offset position information based on the signature version type, which characterizes the position information of the injection point within the basic application package. The device then sends the offset position information to a download device, enabling the download device to generate target injection address information based on the offset position information and send the target injection address information to a content distribution device. The target injection address information guides the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, thereby generating a target application package. The attribution information characterizes the download source information of the target application package. Therefore, by maintaining only a single digitally signed basic application package and dynamically injecting attribution information based on the signature version type and offset position during the download and distribution process, it is not necessary to generate and store corresponding application packages separately for each channel. This significantly reduces the number of application packages and lowers storage resource consumption. At the same time, it avoids the tedious operations of repeated signing and distribution, effectively improving the operation and distribution efficiency of application packages. Furthermore, since the attribution information is dynamically injected, it can flexibly and accurately identify the download source of the application, improving the universality and accuracy of attribution.

[0050] In one embodiment, the process of determining the signature version type in step S202 above can be found in [reference needed]. Figure 6 This is a flowchart illustrating a method for determining a signature version type, as provided in the embodiments of this specification. Figure 6 As shown, the method for determining the signature version type includes the following steps: S601: Extract the metadata information of the above-mentioned basic application package.

[0051] Metadata information refers to structured information appended to the APK file structure that describes the internal organization and signing of the APK. Specifically, it can include the central directory end-of-file section, the manifest file in the META-INF directory, and header information or identifier fields in the APK signing block. Specifically, in the V1 signing scheme, metadata information is mainly stored in the manifest file in the META-INF directory; in the V2 / V3 / V4 signing schemes, metadata information can include fields such as the magic number and signing block length in the signing block.

[0052] S602: Detect whether the above metadata information contains a preset identifier.

[0053] Among them, the preset identifier is a specific marker information used to distinguish different signature scheme types, which can be used as a basis for determining the APK signature version type.

[0054] Optionally, this preset identifier can be a magic number. For V2 / V3 / V4 signature schemes, a fixed magic number can exist in the signature block.

[0055] S603: If the above-mentioned metadata information does not contain the above-mentioned preset identifier, the signature version type corresponding to the above-mentioned basic application package is determined to be the first type. The first type is used to characterize the signature mechanism type that places the signature information in the preset metadata directory and signs each file in the above-mentioned basic application package one by one.

[0056] S604: If the above-mentioned metadata information contains the above-mentioned preset identifier, determine that the signature version type corresponding to the above-mentioned basic application package is the second type. The second type is used to characterize the signature mechanism type that performs integrity verification on the overall content of the above-mentioned basic application package based on the signature block.

[0057] Optionally, the magic number can be searched starting from the metadata information at the end of the APK file. If a match is found, it is determined that the aforementioned preset identifier is detected in the aforementioned metadata information, indicating that the APK file contains a signature block that conforms to the V2 / V3 / V4 specification. If no match is found, it is determined that the aforementioned preset identifier is not detected in the aforementioned metadata information.

[0058] This application's embodiment utilizes a signature version type determination method that effectively distinguishes between V1 and V2 / V3 / V4 signature schemes based on differences in metadata information within the underlying application package. Specifically, by detecting the presence of a preset identifier (such as a magic number), it quickly determines whether the APK file contains a signature block conforming to the V2 / V3 / V4 specification, avoiding the complex process of parsing and comparing every file within the APK file. This not only improves the accuracy and efficiency of signature version identification but also enhances the correctness of subsequent offset position information determination, thus providing a reliable guarantee for injecting attribution information without compromising signature integrity.

[0059] In one embodiment, the process of determining the offset position information in step S203 may include: if the signature version type is the first type, using the starting offset position and length field of the central directory end record area of ​​the basic application package as the offset position information; if the signature version type is the second type, using the starting offset position of the signature block in the basic application package, the total length of the signature block, and the ending offset position of the last key-value pair in the signature block as the offset position information.

[0060] For example, when the parsed signature version type is type 1, the application management device can locate the central directory end record area from the end of the file of the aforementioned basic application package, and read the starting offset position of the central directory end record area and the length field of the comment area, using the starting offset position and the length field as offset position information. In this way, when injecting attribution information subsequently, data can be appended to the comment area of ​​the central directory end record area based on this offset position information, while simultaneously updating the length field of the comment area to ensure the correctness of the file structure.

[0061] When the parsed signature version type is type two, the application management device can locate the APK signature block in the aforementioned basic application package and obtain the starting offset position, total length of the signature block, and ending offset position of the last key-value pair in the signature block, using these as the aforementioned offset position information. In this way, when injecting attribution information subsequently, a new key-value pair unit can be appended to the signature block based on this offset position information, and the total length of the signature block and the offset of the central directory can be updated accordingly, thereby completing the writing of attribution information without compromising signature integrity.

[0062] In this application embodiment, appropriate injection positions are located for different signature version types. Under the first type of signature scheme, by extracting the start offset position and length field of the central directory end record area, attribution information can be flexibly appended to the comment area without destroying the original signature. Under the second type of signature scheme, by obtaining the start offset position, total length, and end offset position of the last key-value pair of the signature block, new key-value pairs can be accurately inserted into the signature block, and the relevant length and directory offset are updated synchronously, thereby improving the overall structure of the basic application package and the correctness of signature verification. Thus, not only can dynamic injection of attribution information be achieved, but file integrity and signature validity can also be taken into account, improving the flexibility and reliability of channel attribution processing.

[0063] In one embodiment, in step S204 above, sending the offset position information to the downloading device may include: receiving an offset position query request from the downloading device, wherein the offset position query request includes the application identifier corresponding to the basic application package; and sending the offset position information to the downloading device based on the offset position query request.

[0064] The offset location query request can be used to obtain the offset location information of a base application package. The offset location query request can be a controlled Application Programming Interface (API) call, carrying the identifier of the application used to locate the base application package and related authentication information. The application identifier is used to uniquely identify a base application package. This identifier is generated and assigned by the application management device when the base application package is uploaded or registered, serving as an index key for subsequent retrieval, injection, and distribution. The application identifier can be a string or other agreed-upon format and is associated with metadata such as the base package storage path, signature version type, and offset location information in the system.

[0065] In one embodiment, the download device sends an offset location query request to the offset information query interface of the application management device. The offset location query request carries information such as the application identifier corresponding to the basic application package and the requester's authentication credentials. After receiving the offset location query request, the application management device first verifies the requester's authentication credentials to confirm the legitimacy of the request. Then, it queries the corresponding offset location information in its own metadata storage using the application identifier as an index. If the offset location information exists in the local cache, it can be read directly from the cache and a response can be constructed. Otherwise, the corresponding metadata is loaded from persistent storage and written back to the cache to improve subsequent access efficiency. Then, the application management device encapsulates the queried offset location information into a structured response and returns it to the download device via an HTTP response. After receiving the response, the download device performs basic verification (such as field integrity and signature / timestamp verification) and generates target injection address information accordingly for the content distribution device to use in subsequent download requests. If the application management device fails to find the corresponding offset location information or authentication fails, it returns an error code and includes the error reason in the response body. In addition, the application management device can also record the audit log of the query event (including the requester identifier, timestamp, query results and processing time) for subsequent operation and maintenance and security audit.

[0066] This application embodiment establishes a controlled offset location information query and distribution mechanism between the application management device and the download device, enabling secure, reliable, and efficient distribution of injection location metadata into the basic application package. The application management device authenticates and caches query requests, ensuring permissions and integrity while rapidly returning offset location information in a structured response. This allows the download device to promptly generate the target injection address and trigger subsequent content distribution injection processes. This caching mechanism and on-demand loading strategy significantly reduce metadata reading latency and backend load, improving the system's concurrent processing capabilities and response speed. Security and traceability measures such as request authentication, response signature / timestamping, and audit log recording prevent the forgery or misuse of offset location information, enhancing the security and compliance of the injection process.

[0067] In one embodiment, the method further includes: sending the basic application package to the content distribution device, so that when the content distribution device receives a user download request, it injects attribution information into the basic application package based on the target injection address information.

[0068] In one embodiment, the application management device can upload or synchronize the basic application package to the object storage or cache node of the content distribution device to facilitate subsequent distribution and real-time injection. When the content distribution device receives a user download request carrying target injection address information, it can first parse the request and verify the authentication credentials and timeliness carried in the request. After successful authentication, it can inject attribution information into the basic application package based on the aforementioned target injection address information.

[0069] In this embodiment, by distributing or synchronizing the signed base application package and its metadata to the content distribution device, and injecting attribution information in real time based on the target injection address information when the content distribution device receives a user download request, channel attribution and application distribution are decoupled and made online. On the one hand, only a single signed base package needs to be maintained, eliminating the need to save independent channel packages for each channel, thereby reducing storage waste caused by the explosion of other channel packages; on the other hand, adding or adjusting channels only requires distributing offset metadata and injection parameters, without the need for full repackaging and re-signing, allowing channel changes to take effect quickly and significantly shortening the deployment cycle.

[0070] An exemplary embodiment of this application also provides a method for generating an application package. This application package processing method can be applied to the above-described... Figure 1 Content distribution device 120. Please refer to [reference needed] for details. Figure 7 The example illustrates a flowchart of an application package generation method provided in an embodiment of this application. Figure 7As shown, the application package processing method includes the following S701-S703: S701: Obtain the basic application package, which is a digitally signed application installation package.

[0071] Optionally, the content distribution device can obtain the basic application package from the aforementioned application management device. Alternatively, it can obtain the basic application package from local storage space, which may be a basic application package pre-received and stored from the application management device.

[0072] S702: Receive target injection address information sent by the download device. The target injection address information is information generated by the download device based on offset position information. The offset position information is information sent by the application management device to the download device. The offset position information is used to characterize the position information of the injection location inside the basic application package. The offset position information is information determined by the application management device according to the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package.

[0073] Optionally, the target injection address information can be used as a description or reference to trigger the injection, specifically a URL address with parameters. The target injection address information may include offset position information, as well as the application identifier apk_id corresponding to the base application package, channel information, and possible injection strategy indication information, etc.

[0074] S703: In response to a user's download request, attribution information is injected into the basic application package based on the target injection address information to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

[0075] In one embodiment, a user download request may be an HTTP request initiated by the downloading device to the content distribution device to obtain the application installation package and install it locally (i.e., on the downloading device). The user download request may include the downloading device's device identifier (e.g., device serial number), network address, application identifier, request timestamp, and optional channel identifier parameters or authentication tokens.

[0076] Optionally, attribution information can be used for attribution statistics and campaign performance analysis. Specific attribution information may include: channel information identifiers, used to identify the distribution channels of the target application package, such as app store identifiers, promotion partner identifiers, advertising platform identifiers, etc.; campaign identifier information, used to characterize the corresponding promotional campaign or campaign plan, such as advertising campaign identifiers, marketing batch numbers, promotion cycle numbers, etc.; creative identifier information, used to identify specific advertising creatives or creative versions, such as advertising creative identifiers, landing page version numbers, etc.; user identifier information, used to associate with downloading devices or user sessions, such as user session identifiers, anonymized user identifiers, referral source codes, etc.; time and location parameters, such as download timestamps, attribution generation time, and geographic location information; and security and verification information, such as data integrity verification values, signature verification codes, and anti-counterfeiting random numbers, etc.

[0077] It is understandable that the target application package can be the final installation package generated and distributed by the content distribution device after injecting attribution information and updating the necessary structural fields based on the base application package during the download request process, which is the file that the user actually downloads and installs.

[0078] In this embodiment, the application management device obtains a digitally signed basic application installation package and parses it to obtain the signature version type corresponding to the basic application package. Then, it determines offset position information based on the signature version type, which characterizes the position information of the injection point within the basic application package. The device then sends the offset position information to a download device, enabling the download device to generate target injection address information based on the offset position information and send the target injection address information to a content distribution device. The target injection address information guides the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, thereby generating a target application package. The attribution information characterizes the download source information of the target application package. Therefore, by maintaining only a single digitally signed basic application package and dynamically injecting attribution information based on the signature version type and offset position during the download and distribution process, it is not necessary to generate and store corresponding application packages separately for each channel. This significantly reduces the number of application packages and lowers storage resource consumption. At the same time, it avoids the tedious operations of repeated signing and distribution, effectively improving the operation and distribution efficiency of application packages. Furthermore, since the attribution information is dynamically injected, it can flexibly and accurately identify the download source of the application, improving the universality and accuracy of attribution.

[0079] In some embodiments, the process of determining the target application package in S703 described above is detailed in [reference needed]. Figure 8This is a flowchart illustrating a method for determining a target application package, as provided in an embodiment of this specification. Figure 8 As shown, the method for determining the target application package includes the following steps: S801: In response to the user's download request, the user's download request is parsed to obtain attribution information.

[0080] In one embodiment, a downloading device can initiate a download request to a content distribution device via a browser, app store, or third-party promotional link. This download request can use protocols such as HTTP and may carry parameters related to the download source. These parameters can be represented as URL query parameters, request header fields, or request body fields. Upon receiving the request, the content distribution device first performs syntax parsing to extract key-value pair parameters and further identifies attribution-related fields. This attribution information may include, but is not limited to: channel information identifiers, activity identifiers, promotion plan identifiers, ad creative identifiers, timestamp parameters, and anonymized device IDs or session identifiers used to identify the downloading device. The parsed attribution information will be used as input for subsequent injection steps to write data representing the download source into the base application package, thereby generating a target application package containing attribution information.

[0081] S802: Based on the above target injection address information and the above attribution information, determine the injection parameters.

[0082] In one embodiment, when the signature version type is the first type, the injection parameters include the offset position information, which includes the starting offset position and length field of the central directory end record area, as well as the sequence of data bytes to be injected.

[0083] In another embodiment, when the above signature version type is the second type, the above injection parameters include the above offset position information, the sequence of data bytes to be injected, and the central directory offset to be adjusted.

[0084] S803: Inject the attribution information into the basic application package based on the above injection parameters.

[0085] In one embodiment, when the signature version type is the first type, in S803, injecting the attribution information into the base application package based on the injection parameters includes: injecting the attribution information into the base application package based on the injection parameters includes: updating the length field of the central directory end record area based on the starting offset position of the central directory end record area and the sequence length of the data byte sequence to be injected, and appending the data byte sequence to be injected to the end of the file of the base application package to generate the target application package.

[0086] In another embodiment, when the signature version type is the second type, in S803, injecting the attribution information into the base application package based on the injection parameters includes: determining the key-value pair insertion position in the base application package based on the offset position information, and determining the total length of the signature block; constructing a new key-value pair unit based on the injected data byte sequence, and determining the byte length of the new key-value pair unit; updating the total length of the signature block according to the total length of the signature block and the byte length of the new key-value pair unit, injecting the new key-value pair unit based on the key-value pair insertion position, and adjusting the central directory offset to be adjusted based on the byte length of the new key-value pair unit to generate the target application package.

[0087] The following section will further explain this application in conjunction with the application package generation system. Figure 9 This is a schematic diagram illustrating a specific process of generating an application package, provided as an exemplary embodiment of this application. For example... Figure 9 The application package generation system includes an application management device, a content distribution device, and a download device. The application management device first obtains the basic application package and parses it to identify its signature version type, then determines the offset location information based on the signature version type. Subsequently, the application management device can upload the basic application package to the content distribution device, simultaneously saving metadata such as the offset location information. When the download device initiates an offset location query request, the request carries the application identifier and channel parameters. The application management device can then feed back the corresponding offset location information to the download device. Upon receiving the feedback information, the download device returns an error response if it detects any anomalies. Under normal circumstances, the download device concatenates the channel parameters and offset location information to generate target injection address information and sends it to the content distribution device. Upon receiving the target injection address information, the content distribution device can inject corresponding attribution information into the byte stream of the basic application package based on the target injection address information, ultimately generating the target application package and returning it to the download device for user installation.

[0088] In this embodiment, the application management device is responsible for signature version parsing and offset location information generation, the download device is responsible for generating target injection address information, and the content distribution device is responsible for dynamically injecting attribution information during distribution. This process eliminates the need to pre-compile and store independent channel packages for each channel; it only requires maintaining a single basic application package and its corresponding offset metadata. Target application packages with attribution information can then be generated on demand during the distribution phase. This significantly reduces storage costs and operational complexity, and allows for rapid changes in channel parameters, improving the flexibility and response efficiency of attribution processing. Furthermore, this method improves the correctness and security of attribution information injection through precise offset location information positioning and anomaly detection during the injection process, thereby achieving efficient, dynamic, and reliable injection of channel attribution information without compromising the integrity of the original signature.

[0089] Please refer to the following. Figure 10 This is a schematic diagram of the structure of an application package processing device provided in an exemplary embodiment of this application. Figure 10 As shown, the above-mentioned application package processing device 1000 is applied to an application management device and includes: The first acquisition module 1001 is used to acquire a basic application package, which is an application installation package that has been digitally signed. The parsing module 1002 is used to parse the above-mentioned basic application package to obtain the signature version type corresponding to the above-mentioned basic application package. The determination module 1003 is used to determine the offset position information according to the above signature version type. The offset position information is used to characterize the position information of the location to be injected inside the above basic application package. The first sending module 1004 is used to send the offset position information to the downloading device so that the downloading device generates target injection address information based on the offset position information and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, so as to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

[0090] In one possible implementation, the parsing module 1002 includes: The extraction unit is used to extract the metadata information of the aforementioned basic application package; The detection unit is used to detect whether the aforementioned metadata information contains a preset identifier; The first determining unit is used to determine the signature version type of the basic application package as the first type when the above-mentioned metadata information does not contain the above-mentioned preset identifier. The first type is used to characterize the signature mechanism type that places the signature information in the preset metadata directory and signs each file in the basic application package one by one. The second determining unit is used to determine the signature version type of the basic application package as a second type when the above-mentioned metadata information contains the above-mentioned preset identifier. The second type is used to characterize the signature mechanism type that performs integrity verification on the overall content of the basic application package based on the signature block.

[0091] In one possible implementation, module 1003 includes: The third determining unit is used to take the starting offset position and length field of the central directory end record area of ​​the basic application package as offset position information when the above signature version type is the above first type. The fourth determining unit is used to, when the above-mentioned signature version type is the second type, take the starting offset position of the signature block in the above-mentioned basic application package, the total length of the above-mentioned signature block, and the ending offset position of the last key-value pair in the above-mentioned signature block as the offset position information.

[0092] In one possible implementation, the first transmitting module 1004 includes: The receiving unit is used to receive the offset position query request from the downloading device, wherein the offset position query request includes the application identifier corresponding to the basic application package. The sending unit is used to send the offset position information to the download device based on the offset position query request.

[0093] In one possible implementation, the device 1000 further includes: The second sending module is used to send the basic application package to the content distribution device, so that when the content distribution device receives a user download request, it injects attribution information into the basic application package based on the target injection address information.

[0094] The division of modules in the application package processing apparatus 1000 described above is for illustrative purposes only. In other embodiments, the application package processing apparatus may be divided into different modules as needed to complete all or part of the functions of the application package processing apparatus described above. The implementation of each module in the application package processing apparatus provided in the embodiments of this specification can be in the form of a computer program. This computer program can run on a terminal or server. The program modules constituted by this computer program can be stored in the memory of the terminal or server. When the computer program is executed by a processor, it implements all or part of the steps of the application package processing method described in the embodiments of this specification.

[0095] Please refer to the following. Figure 11 This is a schematic diagram of the structure of an application package generation apparatus provided in an exemplary embodiment of this application. Figure 11 As shown, the above-mentioned application package generation apparatus 1100 is applied to a content distribution device and includes: The second acquisition module 1101 is used to acquire the basic application package, which is an application installation package that has been digitally signed. The receiving module 1102 is used to receive target injection address information sent by the downloading device. The target injection address information is information generated by the downloading device based on offset position information. The offset position information is information sent to the downloading device by the application management device. The offset position information is used to characterize the position information of the injection location inside the basic application package. The offset position information is information determined by the application management device according to the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package. The injection module 1103 is used to respond to a user's download request by injecting attribution information into the basic application package based on the target injection address information to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

[0096] In one possible implementation, the injection module 1103 includes: The fifth determining unit is used to respond to a user download request, parse the user download request, and obtain attribution information; The sixth determining unit is used to determine the injection parameters based on the aforementioned target injection address information and the aforementioned attribution information; An injection unit is used to inject the attribution information into the basic application package based on the injection parameters.

[0097] In one possible implementation, when the above signature version type is the first type, the above injection parameters include the above offset position information, which includes the starting offset position and length field of the central directory end record area, as well as the sequence of data bytes to be injected. The aforementioned injection unit is used to: update the length field of the aforementioned central directory end record area based on the starting offset position of the aforementioned central directory end record area and the sequence length of the aforementioned data byte sequence to be injected, and append the aforementioned data byte sequence to be injected to the end of the aforementioned basic application package file to generate the target application package.

[0098] In one possible implementation, when the above signature version type is the second type, the above injection parameters include the above offset position information, the sequence of data bytes to be injected, and the central directory offset to be adjusted. The aforementioned injection unit is configured to: determine the key-value pair insertion position in the aforementioned basic application package based on the aforementioned offset position information, and determine the total length of the signature block; construct a new key-value pair unit based on the aforementioned injected data byte sequence, and determine the byte length of the aforementioned new key-value pair unit; update the aforementioned total length of the signature block according to the aforementioned total length of the signature block and the byte length of the aforementioned new key-value pair unit, inject the aforementioned new key-value pair unit based on the aforementioned key-value pair insertion position, and adjust the aforementioned central directory offset to be adjusted based on the byte length of the aforementioned new key-value pair unit, thereby generating the target application package.

[0099] The division of modules in the application package generation apparatus 1100 described above is for illustrative purposes only. In other embodiments, the application package generation apparatus can be divided into different modules as needed to complete all or part of the functions of the application package generation apparatus described above. The implementation of each module in the application package generation apparatus provided in the embodiments of this specification can be in the form of a computer program. This computer program can run on a terminal or server. The program modules constituted by this computer program can be stored in the memory of the terminal or server. When the computer program is executed by a processor, it implements all or part of the steps of the application package generation method described in the embodiments of this specification.

[0100] Please refer to the following. Figure 12 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this application. Figure 12 As shown, the electronic device 1200 may include a processor 1210 and a memory 1220, and may also include a user interface 1230, a network interface 1240 and a communication bus 1250.

[0101] The processor 1210 may include one or more processing cores. The processor 1210 connects to various parts within the electronic device 1200 using various interfaces and lines. It executes various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1220, and by calling data stored in the memory 1220. Optionally, the processor 1210 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 1210 may integrate one or more of the following: a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), and a modem. The CPU primarily handles the operating system and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also be implemented as a separate chip, rather than integrated into the processor 1210.

[0102] The memory 1220 may include random access memory (RAM) or read-only memory. Optionally, the memory 1220 may include a non-transitory computer-readable storage medium. The memory 1220 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 1220 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as receiving functions, control functions, etc.), instructions for implementing the various method embodiments described above, etc.; the data storage area may store data involved in the various method embodiments described above, etc. Optionally, the memory 1220 may also be at least one storage device located remotely from the aforementioned processor 1210. Figure 12 As shown, the memory 1220, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and program instructions.

[0103] Optionally, the communication bus 1250 is used to realize the connection and communication between these components. The user interface 1230 may include a display screen, a camera, and may also include standard wired interfaces and wireless interfaces. The network interface 1240 may optionally include standard wired interfaces and wireless interfaces (such as Wi-Fi interfaces).

[0104] exist Figure 12 In the electronic device 1200 shown, the processor 1210 can be used to call program instructions stored in the memory 1220 and specifically execute the steps of the processing method of the application package provided in any possible implementation of this application or the generation method of the application package provided in any possible implementation.

[0105] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform one or more steps in the above embodiments. If the constituent modules of the above-described application package processing apparatus and application package generation apparatus are implemented as software functional units and sold or used as independent products, they can be stored in the above-described computer-readable storage medium.

[0106] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0107] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0108] The above-described embodiments are merely preferred embodiments of this application and are not intended to limit the scope of this application. Any modifications and improvements made by those skilled in the art to the technical solutions of this application without departing from the spirit of this application should fall within the protection scope defined by the claims of this application.

Claims

1. A method for processing an application package, characterized in that, Applied to application management devices, including: Obtain the base application package, which is a digitally signed application installation package; The basic application package is parsed to obtain the signature version type corresponding to the basic application package; The offset position information is determined based on the signature version type, and the offset position information is used to characterize the position information of the location to be injected within the basic application package; The offset position information is sent to the download device so that the download device generates target injection address information based on the offset position information and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information into the base application package based on the target injection address information when it receives a user download request, so as to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

2. The method as described in claim 1, characterized in that, The step of parsing the basic application package to obtain the signature version type corresponding to the basic application package includes: Extract the metadata information of the underlying application package; Detect whether the metadata information contains a preset identifier; If the preset identifier is not detected in the metadata information, the signature version type corresponding to the basic application package is determined to be the first type. The first type is used to characterize the signature mechanism type that places the signature information in the preset metadata directory and signs each file in the basic application package one by one. If the preset identifier is detected in the metadata information, the signature version type corresponding to the basic application package is determined to be the second type. The second type is used to characterize the signature mechanism type that performs integrity verification on the overall content of the basic application package based on the signature block.

3. The method as described in claim 2, characterized in that, The step of determining the offset position information based on the signature version type includes: When the signature version type is the first type, the starting offset position and length field of the central directory end record area of ​​the base application package are used as offset position information; When the signature version type is the second type, the starting offset position of the signature block in the base application package, the total length of the signature block, and the ending offset position of the last key-value pair in the signature block are used as the offset position information.

4. The method as described in claim 1, characterized in that, Sending the offset position information to the download device includes: Receive an offset position query request from the download device, the offset position query request including the application identifier corresponding to the basic application package; The offset position information is sent to the download device based on the offset position query request.

5. The method as described in claim 1, characterized in that, The method further includes: The basic application package is sent to the content distribution device so that when the content distribution device receives a user download request, it injects attribution information into the basic application package based on the target injection address information.

6. A method for generating an application package, characterized in that, Applied to content distribution devices, including: Obtain the base application package, which is a digitally signed application installation package; The system receives target injection address information sent by a download device. The target injection address information is generated by the download device based on offset position information. The offset position information is sent to the download device by the application management device. The offset position information is used to characterize the position information of the injection location within the basic application package. The offset position information is determined by the application management device based on the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package. In response to a user's download request, attribution information is injected into the base application package based on the target injection address information to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

7. The method as described in claim 6, characterized in that, In response to a user download request, the process of injecting attribution information into the base application package based on the target injection address information to generate a target application package includes: In response to a user download request, the user download request is parsed to obtain attribution information; Based on the target injection address information and the attribution information, the injection parameters are determined; The attribution information is injected into the base application package based on the injection parameters.

8. The method as described in claim 7, characterized in that, When the signature version type is the first type, the injection parameters include the offset position information, which includes the starting offset position and length field of the central directory end record area, as well as the sequence of data bytes to be injected; The process of injecting the attribution information into the base application package based on the injection parameters includes: The length field of the central directory end record area is updated based on the starting offset position of the central directory end record area and the sequence length of the data byte sequence to be injected, and the data byte sequence to be injected is appended to the end of the file of the basic application package to generate the target application package.

9. The method as described in claim 7, characterized in that, When the signature version type is the second type, the injection parameters include the offset position information, the sequence of data bytes to be injected, and the central directory offset to be adjusted; The process of injecting the attribution information into the base application package based on the injection parameters includes: Based on the offset position information, the key-value pair insertion position in the base application package is determined, and the total length of the signature block is determined; A new key-value pair unit is constructed based on the injected data byte sequence, and the byte length of the new key-value pair unit is determined. The total length of the signature block is updated based on the total length of the signature block and the byte length of the new key-value pair unit, and the new key-value pair unit is injected based on the key-value pair insertion position. The central directory offset to be adjusted is adjusted based on the byte length of the new key-value pair unit to generate the target application package.

10. An application package generation system, characterized in that, The method includes an application management device, a content distribution device, and a download device, wherein the application management device is used to perform the steps of the method according to any one of claims 1-5, and the content distribution device is used to perform the steps of the method according to any one of claims 6-9.

11. An application package processing apparatus, characterized in that, Applied to application management devices, including: The first acquisition module is used to acquire a basic application package, which is an application installation package that has been digitally signed. The parsing module is used to parse the basic application package to obtain the signature version type corresponding to the basic application package; The determination module is used to determine offset position information based on the signature version type, wherein the offset position information is used to characterize the position information of the location to be injected within the basic application package; The first sending module is used to send the offset position information to the download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, so as to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

12. An application package generation apparatus, characterized in that, include: The second acquisition module is used to acquire a basic application package, which is an application installation package that has been digitally signed. The receiving module is used to receive target injection address information sent by the downloading device. The target injection address information is information generated by the downloading device based on offset position information. The offset position information is information sent to the downloading device by the application management device. The offset position information is used to characterize the position information of the injection location within the basic application package. The offset position information is information determined by the application management device according to the signature version type of the basic application package. The signature version type is the signature version type corresponding to the basic application package obtained by the application management device after parsing the basic application package. An injection module is used to respond to a user's download request by injecting attribution information into the base application package based on the target injection address information to generate a target application package. The attribution information is used to characterize the download source information of the target application package.

13. An electronic device, characterized in that, include: Processor and memory; The memory stores a computer program adapted to be loaded by the processor and to execute the steps of the method as claimed in any one of claims 1 to 9.

14. A computer storage medium, characterized in that, The computer storage medium stores a plurality of instructions adapted for loading by a processor and executing the steps of the method as described in any one of claims 1 to 9.

Images