Method and apparatus for processing application package, electronic device, and storage medium

Abstract

The application provides a processing method and device of an application package, an electronic device and a storage medium, wherein the method comprises: an application management device acquires a basic application package; the basic application package is parsed to obtain a signature version type corresponding to the basic application package; offset position information is determined according to the signature version type; the offset position information is sent to a download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device; the target injection address information is used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user download request is received, so as to generate a target application package; and the attribution information is used to represent download source information of the target application package. The embodiments provided in the scheme can reduce storage resource consumption and improve operation and maintenance and distribution efficiency of the application package.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of application package processing, and in particular to an application package processing method and device, an electronic device, and a storage medium. BACKGROUND

[0002] At present, in the distribution and promotion process of an Android system application, channel attribution usually relies on a pre-compiled scheme, that is, corresponding application packages are generated for different distribution channels, and are separately signed. Although this method can distinguish the download source of an application, it needs to store a large amount of application packages, which may cause waste of storage resources and low operation and maintenance efficiency. SUMMARY

[0003] The application embodiment provides an application package processing method and device, an electronic device, and a storage medium, which can reduce storage resource consumption and improve operation and maintenance efficiency of application packages. The above technical solution is as follows:

[0004] In a first aspect, the application embodiment provides an application package processing method, which is applied to an application management device and includes the following steps.

[0005] Obtaining a basic application package, the basic application package being an application installation package that has been digitally signed;

[0006] Analyzing the basic application package to obtain a signature version type corresponding to the basic application package;

[0007] Determining offset position information according to the signature version type, the offset position information being used to represent position information of a position to be injected in the basic application package;

[0008] Sending the offset position information to a download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device, the target injection address information being used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user download request is received, so as to generate a target application package, the attribution information being used to represent download source information of the target application package.

[0009] In a possible implementation manner, the analyzing of the basic application package to obtain the signature version type corresponding to the basic application package includes the following steps.

[0010] Extracting metadata information of the basic application package;

[0011] Detecting whether the metadata information contains a preset identifier;

[0012] In a case where it is detected that the metadata information does not contain the preset identifier, it is determined that the signature version type corresponding to the basic application package is a first type, and the first type is used to represent a signature mechanism type in which signature information is placed in a preset metadata directory and each file in the basic application package is individually signed.

[0013] In a case where it is detected that the metadata information contains the preset identifier, it is determined that the signature version type corresponding to the basic application package is a second type, and the second type is used to represent a signature mechanism type in which integrity of the entire content of the basic application package is checked based on a signature block.

[0014] In a possible implementation, the determining of the offset position information according to the signature version type includes:

[0015] In a case where the signature version type is the first type, a start offset position and a length field of a central directory end record area of the basic application package are taken as the offset position information.

[0016] In a case where the signature version type is the second type, a start offset position of a signature block in the basic application package, a total length of the signature block, and an end offset position of a last key-value pair in the signature block are taken as the offset position information.

[0017] In a possible implementation, the sending of the offset position information to the downloading device includes:

[0018] Receiving an offset position query request of the downloading device, the offset position query request including an application program identifier corresponding to the basic application package.

[0019] Sending the offset position information to the downloading device based on the offset position query request.

[0020] In a possible implementation, the method further includes:

[0021] Sending the basic application package to the content distribution device, so that the content distribution device injects attribution information into the basic application package based on the target injection address information when receiving a user download request.

[0022] In a second aspect, an embodiment of the present application provides a method for generating an application package, applied to a content distribution device, and including:

[0023] Obtaining a basic application package, the basic application package being a digitally signed application installation package.

[0024] receive target injection address information sent by the downloading device, the target injection address information being information generated by the downloading device based on offset position information, the offset position information being information sent by the application management device to the downloading device, the offset position information being used to represent position information of a position to be injected in the basic application package, the offset position information being information determined by the application management device according to a signature version type of the basic application package, the signature version type being a signature version type of the basic application package obtained by the application management device by analyzing the basic application package;

[0025] in response to a user download request, inject attribution information in the basic application package based on the target injection address information, and generate a target application package, the attribution information being used to represent download source information of the target application package.

[0026] In a possible implementation, the method further includes:

[0027] in response to the user download request, analyzing the user download request to obtain attribution information;

[0028] determining an injection parameter based on the target injection address information and the attribution information;

[0029] injecting the attribution information in the basic application package based on the injection parameter.

[0030] In a possible implementation, when the signature version type is a first type, the injection parameter includes the offset position information, the offset position information including a start offset position of a central directory end record area and a length field, and a data byte sequence to be injected;

[0031] the injecting the attribution information in the basic application package based on the injection parameter includes:

[0032] updating the length field of the central directory end record area based on the start offset position of the central directory end record area and a sequence length of the data byte sequence to be injected, and appending the data byte sequence to be injected at the end of the basic application package to generate the target application package.

[0033] In a possible implementation, when the signature version type is a second type, the injection parameter includes the offset position information, a data byte sequence to be injected, and a central directory offset to be adjusted;

[0034] The injecting the attribution information in the basic application package based on the injection parameter includes:

[0035] Determining a key-value pair insertion position in the basic application package based on the offset position information, and determining a total length of a signature block;

[0036] Constructing a new key-value pair unit based on the injection data byte sequence, and determining a byte length of the new key-value pair unit;

[0037] Updating the total length of the signature block according to the total length of the signature block and the byte length of the new key-value pair unit, injecting the new key-value pair unit based on the key-value pair insertion position, and adjusting the to-be-adjusted central directory offset based on the byte length of the new key-value pair unit, to generate a target application package.

[0038] In a third aspect, an application package generation system is provided, including an application management device, a content distribution device, and a download device, wherein the application management device is configured to perform the steps of the method provided in the first aspect or any possible implementation manner of the first aspect; and the content distribution device is configured to perform the steps of the method provided in the second aspect or any possible implementation manner of the second aspect.

[0039] In a fourth aspect, an application package processing apparatus is provided, which is applied to an application management device and includes:

[0040] A first obtaining module is configured to obtain a basic application package, the basic application package being a digitally signed application installation package;

[0041] A parsing module is configured to parse the basic application package to obtain a signature version type corresponding to the basic application package;

[0042] A determining module is configured to determine offset position information according to the signature version type, the offset position information being used to represent position information of a to-be-injected position in the basic application package;

[0043] A first sending module is configured to send the offset position information to a download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device, the target injection address information being used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user download request is received, to generate a target application package, the attribution information being used to represent download source information of the target application package.

[0044] In a fifth aspect, an embodiment of the present application provides a generation apparatus of an application package, which is applied to a content distribution device and comprises:

[0045] a second acquisition module configured to acquire a basic application package, the basic application package being an application installation package that has been digitally signed;

[0046] a receiving module configured to receive target injection address information sent by a downloading device, the target injection address information being information generated by the downloading device based on offset position information, the offset position information being information sent by an application management device to the downloading device, the offset position information being used to represent position information of a position to be injected in the basic application package, the offset position information being information determined by the application management device according to a signature version type of the basic application package, the signature version type being a signature version type corresponding to the basic application package and obtained by the application management device by analyzing the basic application package;

[0047] an injection module configured to inject attribution information into the basic application package based on the target injection address information in response to a user downloading request, to generate a target application package, the attribution information being used to represent downloading source information of the target application package.

[0048] In a sixth aspect, an embodiment of the present application provides an electronic device, which comprises a processor and a memory.

[0049] The memory stores a computer program, the computer program being adapted to be loaded by the processor and to execute steps of a method provided by the first aspect or any possible implementation manner of the first aspect of the present application, or the computer program being adapted to be loaded by the processor and to execute steps of a method provided by the second aspect or any possible implementation manner of the second aspect of the present application.

[0050] In a seventh aspect, a computer storage medium is provided, which stores a plurality of instructions, the instructions being adapted to be loaded by a processor and to execute steps of a method provided by the first aspect or any possible implementation manner of the first aspect of the present application, or the instructions being adapted to be loaded by a processor and to execute steps of a method provided by the second aspect or any possible implementation manner of the second aspect of the present application.

[0051] The embodiment of the application obtains the basic application installation package which has been digitally signed through the application management device, analyzes the basic application package to obtain the signature version type corresponding to the basic application package, further determines the offset position information according to the signature version type, the offset position information is used to represent the position information of the position to be injected in the basic application package, and the offset position information is sent to the download device, so that the download device generates target injection address information based on the offset position information, and the target injection address information is sent to the content distribution device, the target injection address information is used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when receiving the user download request, so as to generate a target application package, and the attribution information is used to represent the download source information of the target application package. Therefore, by maintaining only one basic application package which has been digitally signed, and dynamically injecting attribution information according to the signature version type and the offset position information in the download and distribution link, it is not necessary to generate and store a corresponding application package for each channel, thereby significantly reducing the number of application packages and reducing the storage resource consumption; at the same time, the cumbersome operation of repeated signature and distribution is avoided, and the operation and distribution efficiency of the application package is effectively improved; and since the attribution information is dynamically injected, the download source of the application program can also be flexibly and accurately identified, and the universality and accuracy of attribution are improved. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required to be used in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0053] Figure 1 A structural schematic diagram of an application processing system is provided for an exemplary embodiment of the present application.

[0054] Figure 2 A flowchart of a processing method of an application package is provided for an exemplary embodiment of the present application.

[0055] Figure 3 A format schematic diagram of a ZIP package is provided for an exemplary embodiment of the present application.

[0056] Figure 4 A position schematic diagram of a signature block is provided for an exemplary embodiment of the present application.

[0057] Figure 5 A specific structure schematic diagram of a signature block is provided for an exemplary embodiment of the present application.

[0058] Figure 6 A flowchart of a signature version type determination method provided by an exemplary embodiment of the present application is shown in FIG. 1;

[0059] Figure 7 A flowchart of an application package generation method provided by an exemplary embodiment of the present application is shown in FIG. 2;

[0060] Figure 8 A flowchart of a target application package determination method provided by an exemplary embodiment of the present application is shown in FIG. 3;

[0061] Figure 9 A detailed flowchart of an application package generation method provided by an exemplary embodiment of the present application is shown in FIG. 4;

[0062] Figure 10 A structural diagram of an application package processing apparatus provided by an exemplary embodiment of the present application is shown in FIG. 5;

[0063] Figure 11 A structural diagram of an application package generation apparatus provided by an exemplary embodiment of the present application is shown in FIG. 6;

[0064] Figure 12 A structural diagram of an electronic device provided by an exemplary embodiment of the present application is shown in FIG. 7. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0066] The terms "first", "second", "third", etc. in the specification and claims of the present application and in the above drawings are used to distinguish different objects, and are not used to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device. The term "at least one" in the present application means one or more, and the term "multiple" in the present application means two or more, for example, multiple second devices means two or more second devices. The terms "system" and "network" are often used interchangeably in this document.

[0067] Next, please refer to Figure 1 which exemplarily shows a structural diagram of an application package generation system provided by an embodiment of the present application. As shown in FIG. 2, Figure 1As shown, the system includes an application management device 110, a content delivery device 120, and a download device 130. The application management device 110, the content delivery device 120, and the download device 130 can communicate with each other through a wired communication network or a wireless communication network.

[0068] In one embodiment, each of the application management device 110, the content delivery device 120, and the download device 130 can be hardware or software. When the device is hardware, it can be various electronic devices, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like. When the device is software, it can be installed in the above-listed electronic devices, and can be implemented as multiple software or software modules (for example, the application management device 110 can be used to provide an application management service, the content delivery device 120 can be used to provide a content delivery service, and the download device 130 can be used to provide a download service), or as a single software or software module, which is not specifically limited herein.

[0069] Optionally, the application management device 110 can be a server device that provides application packaging, signing, and metadata management, such as an application management server in an enterprise, a management background server of a third-party application distribution platform, or a general-purpose computing device running an application management module. The content delivery device 120 can be a server device that provides application distribution and dynamic injection services, such as a content delivery network (CDN) node server, a cloud distribution server, or a load balancing device running a distribution module. The download device 130 can be a terminal device on the user side that is used to initiate an application download request and receive a target application package, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, or other terminal devices running a download client module.

[0070] In some embodiments, the application management device 110 acquires a basic application package, which is an application installation package that has been digitally signed, and parses the basic application package to obtain a signature version type corresponding to the basic application package, and determines offset position information according to the signature version type, the offset position information representing position information of a position to be injected in the basic application package; and the application management device 110 sends the offset position information to the download device 130, so that the download device 130 generates target injection address information based on the offset position information, and sends the target injection address information to the content distribution device 120, the target injection address information being used to guide the content distribution device 120 to inject attribution information in the basic application package based on the target injection address information when receiving a user download request, to generate a target application package, the attribution information representing download source information of the target application package.

[0071] An example embodiment of the present application provides an application package processing method. The application package processing method can be applied to the application management device 110. For details, please refer to Figure 2 , which exemplarily shows a flowchart of an application package processing method provided by an embodiment of the present application. As shown in Figure 2 , the application package processing method includes the following S201-S204:

[0072] S201: Acquire a basic application package, which is an application installation package that has been digitally signed.

[0073] The basic application package can refer to an Android application package (APK) file that is compiled by a developer and completed with digital signature, but does not write any channel or attribution metadata.

[0074] Optionally, the basic application package can be compiled by a related developer and completed with digital signature, and then uploaded to an application management platform installed in the application management device, the application management platform can perform metadata extraction, version recording and integrity check on the basic application package, and allocate a unique identifier and a storage path for the basic application package for subsequent retrieval and distribution.

[0075] It should be noted that the digital signature can refer to an encryption verification mechanism for signing the content of the APK file to prove the application source and ensure the integrity of the file.

[0076] In addition, the application management platform can also distribute or synchronize the basic application package to the cache or object storage of the content distribution device, so as to improve the downstream distribution efficiency.

[0077] S202: parsing the basic application package to obtain a signature version type corresponding to the basic application package.

[0078] It can be understood that the APK file usually adopts a Zone Information Protocol (ZIP) file format as a container, and the file structure thereof usually includes a file information area, a Central Directory area, and an End of Central Directory (EOCD) record area. Figure 3 A format diagram of a ZIP package provided for an exemplary embodiment of the present application is as shown in Figure 3 The file information area sequentially stores a plurality of file entries, each entry representing information of a single file, each entry including a local file header, file data, and a data descriptor, for recording and storing actual file content; the Central Directory area centrally stores directory records (such as Central Directory File Header 1, Central Directory File Header 2) of each file, each directory record including basic information of the corresponding file and can include an offset pointing to the local file header, thereby being able to quickly locate file information; the Central Directory End record area is located at the end of the file, for storing overall information of the Central Directory, including a Central Directory End record (such as a size of the Central Directory, a total number of files, an offset of a starting position of the Central Directory, and optional annotation content), and a decompression tool can locate the Central Directory part by identifying the Central Directory End record.

[0079] In an embodiment, the signature version type can be a signature scheme category adopted to identify. The signature version type corresponding to the basic application package can be a first type or a second type, the first type being used to represent a signature mechanism type of placing signature information in a preset meta-information directory and signing each file in the basic application package one by one; and the second type being used to represent a signature mechanism type of performing integrity verification on the overall content of the basic application package based on a signature block.

[0080] Specifically, the first type of basic application package corresponds to an APK file signed by APK Signature Scheme v1 (first edition Android installation package signature scheme) in the related art. The second type of basic application package can be any one of the following: an APK file signed by APK Signature Scheme v2 (second edition Android installation package signature scheme), an APK file signed by APK Signature Scheme v3 (third edition Android installation package signature scheme), an APK file signed by APK Signature Scheme v4 (fourth edition Android installation package signature scheme), and the like.

[0081] Specifically, the V1 signature scheme is based on the traditional Java Archive (JAR) file signature method, which only performs integrity verification on each part of the APK file one by one, and the signature data is stored in a preset meta information directory, for example, the preset meta information directory can be the META-INF directory of the APK file, and the structure of the entire ZIP file is not verified. Among them, META-INF is equivalent to an information package used to store some meta information related files, which can be used to configure applications, extensions, class loader files, and the information package is automatically generated when packaging. The V2 signature scheme realizes integrity verification of the entire APK file content by introducing an APK signing block before the central directory area. The V3 signature scheme adds support for key rotation; the V4 signature scheme adds support for incremental installation. The V2, V3, and V4 signature schemes all rely on the APK signing block, and the signing block stores information such as signatures, digests, signature algorithms, certificate chains, and extension attributes.

[0082] S203: Determine the offset position information according to the signature version type, and the offset position information is used to represent the position information of the internal injection position of the basic application package.

[0083] Among them, the offset position information can be a data set used to locate the byte-level position and related length fields in the basic application package that can be used for injection or modification.

[0084] Optionally, in the case that the signature version type is the first type, the corresponding offset position information can include a start offset position of a central directory end record area of the base application package and a length field. The start offset position of the central directory end record area indicates a byte start position of the central directory end record area in the entire file; and the length field of the central directory end record area can be an "annotation area length" field recorded in the EOCD, used to describe the size of the central directory end record area.

[0085] Optionally, in the case that the signature version type is the second type, the corresponding offset position information can include a start offset position of a signature block in the base application package, a total length of the signature block, and an end offset position of the last key-value pair in the signature block. The signature block is a data structure located before the central directory area, used to store the information of the APK file signature scheme (V2 / V3 / V4); the signature block contains the signature, digest, signature algorithm, certificate chain, and extended attribute key-value pair information of the APK file. The start offset position of the signature block can be the start address of the signature block in the byte sequence of the APK file. The total length of the signature block can be a length field recorded in the header of the signature block, used to represent the number of bytes of the entire signature block (including all key-value pair units). The end offset position of the last key-value pair can be the byte offset address of the end position of the last key-value pair unit in the signature block in the entire APK file.

[0086] Figure 4 A position diagram of a signature block provided for an exemplary embodiment of the present application is shown in FIG. 1. Figure 4 The APK signature schemes of V2, V3, and V4 versions all adopt the way of inserting a signature data block (APK Signing Block) before the central directory area of the ZIP file. The signature block does not affect the normal decompression operation of the ZIP file, but will be used by the Android system to perform integrity verification on the overall content of the APK file during the installation process. Specifically, before signing, the APK file structure includes the file information area, the central directory area, and the central directory end record area in sequence; after signing, the signature block is added between the file information area and the central directory area, so that the security verification on the overall content of the application package is realized without changing the basic compression structure of the ZIP file.

[0087] S204: sending the above offset position information to the download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to the content distribution device, the target injection address information being used to guide the content distribution device to inject attribution information into the base application package based on the target injection address information when receiving a user download request, so as to generate a target application package, and the attribution information is used to represent the download source information of the target application package.

[0088] The download device can be a terminal device on the user side for initiating an application download request and receiving a target application package, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, or other terminal devices running a download client module.

[0089] Optionally, the target injection address information can be used to trigger the description or reference information of the injection, which can be a uniform resource locator (URL) address with parameters. The target injection address information can include offset position information, an application program identifier apk_id corresponding to the base application package, channel information, and possible injection policy indication information.

[0090] In an embodiment, the user download request can be a hypertext transfer protocol (HTTP) request initiated by the download device to the content distribution device to obtain an application installation package for installation on the local (i.e., the download device). The user download request can include a device identifier (such as a device serial number, etc.), a network address, an application program identifier, a request timestamp, and optional channel identifier parameters or authentication tokens of the download device.

[0091] Optionally, the attribution information can be used for attribution statistics and delivery effect analysis. The attribution information can specifically include: channel information identifier, used to identify the distribution channel of the target application package, such as an application store identifier, a promotion partner identifier, an advertisement platform identifier, etc.; campaign identifier information, used to represent a corresponding promotion activity or delivery plan, such as an advertisement activity identifier, a marketing batch number, a promotion period number, etc.; creative identifier information, used to identify specific advertisement materials or creative versions, such as an advertisement material identifier, a landing page version number, etc.; user identifier information, used to associate with the download device or user session, such as a user session identifier, an anonymized user identifier, a recommendation source code, etc.; time and location parameters, such as a download timestamp, an attribution generation time, geographic location information; security and verification information, such as a data integrity verification value, a signature verification code, an anti-fake random number, etc.

[0092] It can be understood that the target application package can be a final installation package generated and distributed by the content distribution device after injecting attribution information and updating necessary structure fields based on the basic application package in the download request process, and the file actually downloaded and installed by the user.

[0093] In one embodiment, when the basic application package adopts the V1 signature scheme (i.e., the signature type corresponding to the basic application package is the first type), the signature data can be stored in the META-INF directory of the APK file, which belongs to the file information area of the ZIP file. Since the V1 signature mechanism only performs integrity verification on each file in the APK file one by one, and does not perform verification on the overall structure of the entire ZIP file. Therefore, without modifying the signed data content, attribution information can be written in the comment area of the central directory end record area of the ZIP file. In this way, the attribution information can be written into the APK file as channel information without destroying the effectiveness of the original V1 signature verification, thereby generating a target application package that can represent the source of the download.

[0094] In another embodiment, when the basic application package adopts the V2 / V3 / V4 signature scheme (i.e., the signature type corresponding to the basic application package is the second type), attribution information can be injected in the padding data block (PaddingBlock) in the APK signature block to achieve the writing of channel information. Figure 5 A specific structure diagram of a signature block is provided for an exemplary embodiment of the present application. As shown in FIG. 3, the signature block includes a signature scheme version field, a signature scheme type field, a signature algorithm field, a signature length field, a signature data field, and a signature block length field. Figure 5In particular, the APK file contains padding information related to signature, the padding information does not participate in signature verification, and therefore custom data can be added in the padding information. The padding information can be stored in a length (Length, L), type (Type, T), and value (Value, V) structure, where L is used to represent the data length of the signature block, T is a signature block identifier (block id), and V is the specific data content. In particular, a new channel information data block (channel block) can be inserted in the padding information. The above-mentioned channel information data block can also use the LTV structure, where L represents the length of the channel information data block, T is the channel information identifier (for example, a fixed value 0x881155FF), and V is the specific data content of the channel information (for example, an identifier string used to represent the application source channel, with a length of not more than 100 bytes). After inserting the above-mentioned channel information data block, the length field of the padding information needs to be updated accordingly, so that the length is equal to the original length plus the overall length of the above-mentioned channel data block. Further, the downloading device can determine the injection strategy based on a pre-generated JSON description file, and the above-mentioned JSON file includes fields such as channel information type (channel_type), offset position information, and injection data length. After receiving a user download request, the content distribution device can inject the corresponding channel information data block in the padding information of the APK file according to the JSON file, thereby obtaining a target application package with attribution information.

[0095] In the embodiments of the present application, the application management device acquires a basic application installation package that has been digitally signed, and parses the basic application package to obtain a signature version type corresponding to the basic application package. Then, the offset position information is determined according to the signature version type, the offset position information being used to represent the position information of a position to be injected in the basic application package. The offset position information is sent to the download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user download request is received, so as to generate a target application package. The attribution information is used to represent the download source information of the target application package. In this way, by maintaining only one basic application package that has been digitally signed, and dynamically injecting attribution information according to the signature version type and the offset position information in the download and distribution link, it is not necessary to generate and store a corresponding application package for each channel, thereby significantly reducing the number of application packages and reducing the storage resource consumption. At the same time, the cumbersome operation of repeated signature and distribution is avoided, and the operation and distribution efficiency of the application package is effectively improved. In addition, since the attribution information is dynamically injected, the download source of the application program can also be flexibly and accurately identified, and the universality and accuracy of attribution are improved.

[0096] In one embodiment, in the step S202, the signature version type determination process specifically refers to Figure 6 , which is a flow diagram of a signature version type determination method provided by the embodiments of the present application. As shown in Figure 6 , the signature version type determination method includes the following steps:

[0097] S601: Extracting metadata information of the basic application package.

[0098] The metadata information can refer to structured information attached in the APK file structure, which is used to describe the internal organization and signature of the APK. Specifically, it can include the central directory end record area, the manifest file under the META-INF directory, and can also include the header information or identification field in the APK signature block. Specifically, in the V1 signature scheme, the metadata information is mainly stored in the manifest file under the META-INF directory; in the V2 / V3 / V4 signature scheme, the metadata information can include the magic number and signature block length field in the signature block.

[0099] S602: Detecting whether the metadata information contains a preset identifier.

[0100] The preset identifier is specific mark information used to distinguish different signature scheme types, and can be used as a basis for judging the APK signature version type.

[0101] Optionally, the preset identifier can be a magic number. For the V2 / V3 / V4 signature scheme, a fixed magic number can exist in the signature block.

[0102] S603: In a case where it is detected that the preset identifier is not included in the metadata information, it is determined that the signature version type corresponding to the basic application package is a first type, and the first type is used to represent a signature mechanism type in which signature information is placed in a preset metadata directory and each file in the basic application package is individually signed.

[0103] S604: In a case where it is detected that the preset identifier is included in the metadata information, it is determined that the signature version type corresponding to the basic application package is a second type, and the second type is used to represent a signature mechanism type in which the integrity of the overall content of the basic application package is checked based on a signature block.

[0104] Optionally, the magic number can be searched from the metadata information at the end of the APK file. If the magic number can be matched, it is determined that the preset identifier is included in the metadata information, indicating that the APK file includes a signature block conforming to the V2 / V3 / V4 specification. If the magic number cannot be matched, it is determined that the preset identifier is not included in the metadata information.

[0105] In the embodiment of the application, the signature version type determination method can effectively distinguish the V1 signature scheme from the V2 / V3 / V4 signature scheme based on the difference in the metadata information in the basic application package. By detecting whether the preset identifier (such as the magic number) exists, it can be quickly judged whether the APK file includes a signature block conforming to the V2 / V3 / V4 specification, avoiding the complex process of parsing and comparing all files in the APK file one by one. Not only does this improve the accuracy and efficiency of signature version identification, but also improves the correctness of subsequent offset position information determination, thereby providing reliable protection for subsequent injection of attribution information without destroying the integrity of the signature.

[0106] In one embodiment, in the step S203, the determination process of the offset position information can include: in a case where the signature version type is the first type, taking the starting offset position and the length field of the central directory end record area of the basic application package as the offset position information; and in a case where the signature version type is the second type, taking the starting offset position of the signature block in the basic application package, the total length of the signature block, and the ending offset position of the last key-value pair in the signature block as the offset position information.

[0107] Exemplarily, when the parsed signature version type is the first type, the application management device can locate the central directory end record area from the file tail of the above-mentioned basic application package, and read the central directory end record area start offset position and the length field of the comment area, taking the start offset position and the length field as the offset position information. In this way, when the attribution information is subsequently injected, the offset position information can be used to write data in the comment area of the central directory end record area, while the length field of the comment area is updated to ensure the correctness of the file structure.

[0108] When the parsed signature version type is the second type, the application management device can locate the APK signature block in the above-mentioned basic application package, and obtain the start offset position of the signature block, the total length of the signature block, and the end offset position of the last key-value pair in the signature block, taking them as the above-mentioned offset position information. In this way, when the attribution information is subsequently injected, a new key-value pair unit can be appended in the signature block based on the offset position information, and the total length of the signature block and the offset of the central directory are updated accordingly, so that the writing of the attribution information is completed without destroying the integrity of the signature.

[0109] In the embodiments of the present application, suitable injection positions are located for different signature version types. In the first type of signature scheme, by extracting the start offset position and the length field of the central directory end record area, the attribution information can be flexibly written in the comment area without destroying the original signature; in the second type of signature scheme, by obtaining the start offset position, the total length and the end offset position of the last key-value pair of the signature block, a new key-value pair can be accurately inserted in the signature block, and the related length and the directory offset are updated synchronously, thereby improving the correctness of the overall structure of the basic application package and the signature verification. Therefore, not only the dynamic injection of the attribution information can be realized, but also the file integrity and the signature validity can be considered, and the flexibility and reliability of the channel attribution processing are improved.

[0110] In one embodiment, in the S204, the offset position information is sent to the download device, which can include: receiving an offset position query request of the download device, the offset position query request including an application program identifier corresponding to the above-mentioned basic application package; and sending the offset position information to the download device based on the offset position query request.

[0111] The offset position query request can be used to obtain offset position information of a certain base application package. The offset position query request can be a controlled application programming interface (API) call, carrying an identifier for locating the base application package application and related authentication information. The application identifier is used to uniquely identify an identifier of a certain base application package. The identifier is generated and assigned by the application management device when the base application package is uploaded or registered, as an index key for subsequent retrieval, injection, and distribution. The application identifier can be a string or other agreed format, and is associated with metadata such as base package storage path, signature version type, and offset position information in the system.

[0112] In one embodiment, the download device sends an offset position query request to the offset information query interface of the application management device, the offset position query request carrying the application identifier corresponding to the base application package and the requestor authentication credential and other information; after receiving the offset position query request, the application management device first verifies the requestor authentication credential to confirm the legality of the request, and then queries the corresponding offset position information in the metadata storage with the application identifier as the index; if the offset position information exists in the local cache, it can be directly read from the cache and a response is constructed; otherwise, the corresponding metadata is loaded from the persistent storage and written back to the cache to improve subsequent access efficiency; then, the application management device encapsulates the queried offset position information into a structured response, and returns it to the download device through an HTTP response; after receiving the response, the download device performs basic verification (such as field integrity and signature / timestamp verification), and generates target injection address information for the content distribution device to use in subsequent download requests. If the application management device fails to find the corresponding offset position information or fails to authenticate, it returns an error code and includes the error reason in the response body; in addition, the application management device can also record the audit log of the query event (including the requestor identifier, timestamp, query result, and processing time consumption) for subsequent operation and maintenance and security audit.

[0113] The embodiment of the application can realize the safe, reliable and efficient distribution of the injection position metadata of the basic application package by establishing a controlled offset position information query and delivery mechanism between the application management device and the download device. The application management device authenticates and caches the query request, and can quickly return the offset position information in a structured response under the premise of ensuring the authority and integrity, so that the download device can generate the target injection address in time and trigger the subsequent content distribution end injection process. The cache mechanism and the on-demand loading strategy significantly reduce the metadata reading delay and reduce the backend load, and improve the concurrent processing capacity and response speed of the system. With the security and traceability measures such as request authentication, response signature / timestamp and audit log recording, the offset position information can be prevented from being forged or misused, and the security and compliance of the injection process are enhanced.

[0114] In one embodiment, the above method further comprises: sending the above basic application package to the above content distribution device, so that the content distribution device injects attribution information in the basic application package based on the target injection address information when receiving a user download request.

[0115] In one embodiment, the application management device can upload or synchronize the basic application package to the object storage or cache node of the content distribution device, so as to facilitate subsequent distribution and real-time injection. When the content distribution device receives a user download request carrying target injection address information, it can first parse the request and verify the authentication credentials and timeliness carried in the request. After the authentication is passed, it can inject attribution information in the basic application package based on the target injection address information.

[0116] In the embodiment of the application, by delivering or synchronizing the signed basic application package and its metadata to the content distribution device, and injecting attribution information in real time based on the target injection address information when the content distribution device receives a user download request carrying the target injection address information, the decoupling and online of channel attribution and application distribution are realized. On the one hand, only one signed basic package needs to be maintained without saving independent channel packages for each channel, thereby reducing the storage waste caused by the explosion of the number of additional channel packages. On the other hand, the addition or adjustment of a channel only needs to deliver offset metadata and injection parameters, without full re-packaging and re-signing, and the channel change can take effect quickly, significantly shortening the online period.

[0117] An example embodiment of the application also provides a method for generating an application package. The application package processing method can be applied to the content distribution device 120 in the above Figure 1 . For details, please refer to Figure 7 , which exemplarily shows a flowchart of a method for generating an application package provided by an embodiment of the application. As Figure 7As shown, the application package processing method includes the following S701-S703:

[0118] S701: Obtain a basic application package, the basic application package being an application installation package that has been digitally signed.

[0119] Optionally, the content distribution device can obtain the basic application package from the application management device. In addition, the basic application package can also be obtained from a local storage space. The basic application package in the storage space can be a basic application package that is received from the application management device in advance and stored.

[0120] S702: Receive target injection address information sent by a download device, the target injection address information being information generated by the download device based on offset position information, the offset position information being information sent by the application management device to the download device, the offset position information being position information representing a position to be injected in the basic application package, the offset position information being information determined by the application management device according to a signature version type of the basic application package, the signature version type being a signature version type corresponding to the basic application package obtained by the application management device by analyzing the basic application package.

[0121] Optionally, the target injection address information can be description or reference information for triggering injection, and can be a URL address with parameters. The target injection address information can include the offset position information, and can also include an application program identifier apk_id corresponding to the basic application package, channel information, and possible injection policy indication information.

[0122] S703: In response to a user download request, inject attribution information in the basic application package based on the target injection address information, and generate a target application package, the attribution information representing download source information of the target application package.

[0123] In one embodiment, the user download request can be an HTTP request initiated by the download device to the content distribution device to obtain an application installation package for installation on the local device (i.e., the download device). The user download request can include a device identifier (such as a device serial number, etc.), a network address, an application program identifier, a request timestamp, and optional channel identifier parameters or authentication tokens of the download device.

[0124] Optionally, the attribution information can be used for attribution statistics and delivery effect analysis. The attribution information can specifically include: channel information identifier, used to identify the distribution channel of the target application package, such as an application store identifier, a promotion partner identifier, an advertisement platform identifier, and the like; campaign identifier information, used to represent the corresponding promotion activity or delivery plan, such as an advertisement activity identifier, a marketing batch number, a promotion period number, and the like; creative identifier information, used to identify specific advertisement materials or creative versions, such as an advertisement material identifier, a landing page version number, and the like; user identifier information, used to associate with a download device or a user session, such as a user session identifier, an anonymized user identifier, a recommendation source code, and the like; time and location parameters, such as a download timestamp, an attribution generation time, and geographic location information; security and verification information, such as a data integrity verification value, a signature verification code, and an anti-fraud random number, and the like.

[0125] It can be understood that the target application package can be a final installation package generated and distributed by the content distribution device based on the basic application package after injecting attribution information and updating necessary structure fields in the download request process, which is actually downloaded and installed by the user.

[0126] In the embodiments of the present application, the application management device obtains a basic application installation package that has been digitally signed, and parses the basic application package to obtain a signature version type corresponding to the basic application package. Then, the offset position information is determined according to the signature version type, the offset position information being used to represent the position information of the position to be injected in the basic application package. The offset position information is sent to the download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when receiving a user download request, so as to generate a target application package. The attribution information is used to represent the download source information of the target application package. Therefore, by maintaining only one basic application package that has been digitally signed, and dynamically injecting attribution information according to the signature version type and the offset position information in the download distribution link, it is not necessary to generate and store a corresponding application package for each channel, thereby significantly reducing the number of application packages and reducing the storage resource consumption. At the same time, the cumbersome operations of repeated signature and distribution are avoided, and the operation and distribution efficiency of the application package is effectively improved. In addition, since the attribution information is dynamically injected, the download source of the application program can also be flexibly and accurately identified, and the universality and accuracy of attribution are improved.

[0127] In some embodiments, in the S703, the determination process of the target application package specifically refers to Figure 8As shown in the figure, the target application package determination method comprises the following steps: Figure 8

[0128] S801: In response to a user download request, the user download request is parsed to obtain attribution information.

[0129] In an embodiment, the download device can initiate a download request to the content distribution device through a browser, an application store or a third-party promotion link. The download request can use a protocol such as HTTP, and the download request can carry a parameter related to the download source. The parameter can be embodied in the form of a URL query parameter, a request header field or a request body field. After receiving the request, the content distribution device first performs syntax analysis on the request, extracts the key-value pair parameters therein, and further identifies the attribution-related fields therein. The attribution information can include but is not limited to: channel information identifier, activity identifier, promotion plan identifier, advertisement creative identifier, timestamp parameter, and anonymized device number or session identifier for identifying the download device. The parsed attribution information will be used as the input of the subsequent injection step to write data representing the download source in the base application package, thereby generating a target application package containing attribution information.

[0130] S802: Determine the injection parameter based on the target injection address information and the attribution information.

[0131] In an embodiment, in the case where the signature version type is the first type, the injection parameter includes the offset position information, the offset position information includes the starting offset position and the length field of the central directory end record area, and the data byte sequence to be injected.

[0132] In another embodiment, in the case where the signature version type is the second type, the injection parameter includes the offset position information, the data byte sequence to be injected, and the central directory offset to be adjusted.

[0133] S803: Inject the attribution information into the base application package based on the injection parameter.

[0134] ​In one embodiment, in the case that the signature version type is the first type, in S803, injecting the attribution information into the base application package based on the injection parameter includes: injecting the attribution information into the base application package based on the injection parameter, including: updating a length field of the central directory end record area based on a start offset position of the central directory end record area and a sequence length of the to-be-injected data byte sequence, and appending the to-be-injected data byte sequence to the end of the file of the base application package, to generate the target application package.

[0135] In another embodiment, in the case that the signature version type is the second type, in S803, injecting the attribution information into the base application package based on the injection parameter includes: determining a key-value pair insertion position in the base application package based on the offset position information, and determining a total signature block length; constructing a new key-value pair unit based on the injection data byte sequence, and determining a byte length of the new key-value pair unit; updating the total signature block length according to the total signature block length and the byte length of the new key-value pair unit, and injecting the new key-value pair unit based on the key-value pair insertion position, and adjusting the to-be-adjusted central directory offset based on the byte length of the new key-value pair unit, to generate the target application package.

[0136] Next, the present application will be further described in combination with an application package generation system. Figure 9 A specific flowchart of an application package generation method provided by an exemplary embodiment of the present application is shown in FIG. 2. As shown in FIG. 2, the application package generation method includes the following steps. Figure 9 The application package generation system includes an application management device, a content distribution device, and a download device. The application management device first acquires a base application package, and parses the base application package to identify the signature version type thereof, and then determines offset position information according to the signature version type. Subsequently, the application management device can upload the base application package to the content distribution device, and save the offset position information and other metadata at the same time. When a download device initiates an offset position query request, the offset position query request carries an application program identifier and a channel parameter, and the application management device can feed back the corresponding offset position information to the download device; after receiving the feedback information, if the download device detects that the feedback information is abnormal, it returns an error response. In a normal case, the download device will splice the channel parameter and the offset position information to generate target injection address information, and send the target injection address information to the content distribution device. After receiving the target injection address information, the content distribution device can inject the corresponding attribution information into the byte stream of the base application package based on the target injection address information, and finally generate a target application package and return it to the download device for user installation.

[0137] In the embodiments of the present application, the application management device is responsible for signature version analysis and offset position information generation, the download device is responsible for target injection address information generation, and the content distribution device is responsible for dynamic injection of attribution information during distribution. This process does not need to pre-compile and store independent channel packages for each channel, but only needs to maintain a single basic application package and corresponding offset metadata, so as to generate target application packages with attribution information on demand during the distribution stage. In this way, not only the storage cost and operation and maintenance complexity are significantly reduced, but also the attribution processing flexibility and response efficiency are improved when the channel parameters change. At the same time, the method improves the correctness and security of attribution information injection through precise positioning of offset position information and abnormality detection during the injection process, so as to realize efficient, dynamic and reliable injection of channel attribution information without destroying the original signature integrity.

[0138] Next, please refer to Figure 10 which is a structural schematic diagram of an application package processing apparatus provided by an exemplary embodiment of the present application. As shown in Figure 10 , the application package processing apparatus 1000 applied to an application management device includes:

[0139] A first acquisition module 1001 is configured to acquire a basic application package, wherein the basic application package is a digitally signed application installation package.

[0140] A parsing module 1002 is configured to parse the basic application package to obtain a signature version type corresponding to the basic application package.

[0141] A determination module 1003 is configured to determine offset position information according to the signature version type, wherein the offset position information is used to represent position information of a position to be injected in the basic application package.

[0142] A first sending module 1004 is configured to send the offset position information to a download device, so that the download device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user download request is received, so as to generate a target application package. The attribution information is used to represent download source information of the target application package.

[0143] In a possible implementation manner, the parsing module 1002 includes:

[0144] An extraction unit is configured to extract metadata information of the basic application package.

[0145] The detection unit is configured to detect whether the preset identifier is contained in the metadata information.

[0146] The first determination unit is configured to determine that the signature version type corresponding to the basic application program package is a first type if it is detected that the preset identifier is not contained in the metadata information, the first type being used to represent a signature mechanism type in which signature information is placed in a preset metadata directory and each file in the basic application program package is individually signed.

[0147] The second determination unit is configured to determine that the signature version type corresponding to the basic application program package is a second type if it is detected that the preset identifier is contained in the metadata information, the second type being used to represent a signature mechanism type in which integrity of the entire content of the basic application program package is verified based on a signature block.

[0148] In a possible implementation, the determining module 1003 includes:

[0149] The third determination unit is configured to take, as the offset position information, a start offset position and a length field of a central directory end record area of the basic application program package if the signature version type is the first type.

[0150] The fourth determination unit is configured to take, as the offset position information, a start offset position of a signature block in the basic application program package, a total length of the signature block, and an end offset position of a last key-value pair in the signature block if the signature version type is the second type.

[0151] In a possible implementation, the first sending module 1004 includes:

[0152] The receiving unit is configured to receive an offset position query request of a downloading device, the offset position query request including an application program identifier corresponding to the basic application program package.

[0153] The sending unit is configured to send the offset position information to the downloading device based on the offset position query request.

[0154] In a possible implementation, the apparatus 1000 further includes:

[0155] The second sending module is configured to send the basic application program package to the content distribution device, so that the content distribution device injects attribution information into the basic application program package based on the target injection address information when receiving a user download request.

[0156] The division of the modules in the application package processing apparatus 1000 is merely for illustration, and in other embodiments, the application package processing apparatus can be divided into different modules as needed to complete all or part of the functions of the application package processing apparatus. The implementation of each module in the application package processing apparatus provided in the embodiments of the present specification can be in the form of a computer program. The computer program can run on a terminal or a server. The program modules constituted by the computer program can be stored on the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the application package processing method described in the embodiments of the present specification are implemented.

[0157] Next, please refer to Figure 11 which is a structural schematic diagram of an application package generation apparatus provided by an exemplary embodiment of the present application. As Figure 11 shown, the application package generation apparatus 1100 applied to a content distribution device includes:

[0158] The second acquisition module 1101 is configured to acquire a basic application package, where the basic application package is an application installation package that has been digitally signed.

[0159] The receiving module 1102 is configured to receive target injection address information sent by a downloading device, where the target injection address information is information generated by the downloading device based on offset position information, the offset position information is information sent by an application management device to the downloading device, the offset position information is position information representing a position to be injected in the basic application package, and the offset position information is information determined by the application management device according to a signature version type of the basic application package, where the signature version type is a signature version type corresponding to the basic application package and obtained by the application management device by analyzing the basic application package.

[0160] The injection module 1103 is configured to inject attribution information into the basic application package based on the target injection address information in response to a user download request, to generate a target application package, where the attribution information represents download source information of the target application package.

[0161] In a possible implementation, the injection module 1103 includes:

[0162] The fifth determination unit is configured to analyze the user download request to obtain attribution information in response to the user download request.

[0163] The sixth determination unit is configured to determine an injection parameter based on the target injection address information and the attribution information.

[0164] The injection unit is configured to inject the attribution information into the basic application package based on the injection parameter.

[0165] In a possible implementation, when the signature version type is the first type, the injection parameter includes the offset position information, and the offset position information includes a start offset position of a central directory end record area and a length field, and a data byte sequence to be injected;

[0166] The injection unit is configured to update the length field of the central directory end record area based on the start offset position of the central directory end record area and a sequence length of the data byte sequence to be injected, and append the data byte sequence to be injected at the end of the basic application package to generate the target application package.

[0167] In a possible implementation, when the signature version type is the second type, the injection parameter includes the offset position information, a data byte sequence to be injected, and a central directory offset to be adjusted;

[0168] The injection unit is configured to determine a key-value pair insertion position in the basic application package based on the offset position information, and determine a total length of a signature block; construct a new key-value pair unit based on the data byte sequence to be injected, and determine a byte length of the new key-value pair unit; update the total length of the signature block according to the total length of the signature block and the byte length of the new key-value pair unit, inject the new key-value pair unit based on the key-value pair insertion position, and adjust the central directory offset to be adjusted based on the byte length of the new key-value pair unit, to generate the target application package.

[0169] The division of the modules in the application package generation apparatus 1100 is only for example, and in other embodiments, the application package generation apparatus can be divided into different modules as needed to complete all or part of the functions of the application package generation apparatus. The implementation of each module in the application package generation apparatus provided in the embodiments of the present specification can be in the form of a computer program. The computer program can run on a terminal or a server. The program modules constituted by the computer program can be stored on the memory of the terminal or the server. When the computer program is executed by the processor, all or part of the steps of the application package generation method described in the embodiments of the present specification are implemented.

[0170] Next, please refer to Figure 12 which is a structural schematic diagram of an electronic device provided by an example embodiment of the present application. As shown in Figure 12As shown, the electronic device 1200 can include a processor 1210 and a memory 1220, and can further include a user interface 1230, a network interface 1240, and a communication bus 1250.

[0171] The processor 1210 can include one or more processing cores. The processor 1210 connects various parts in the entire electronic device 1200 through various interfaces and lines, and performs various functions of the electronic device 1200 and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 1220, and calling data stored in the memory 1220. Alternatively, the processor 1210 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 1210 can be integrated with a combination of one or more of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU is mainly used to process operating systems and application programs; the GPU is used to render and draw the content to be displayed on the display screen; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 1210, but can be realized by a separate chip.

[0172] The memory 1220 can include a random access memory (RAM) and a read-only memory (ROM). Alternatively, the memory 1220 includes a non-transitory computer-readable storage medium. The memory 1220 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1220 can include a program storage area and a data storage area, wherein the program storage area can store instructions for implementing an operating system, instructions for at least one function (such as a receiving function, a control function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area can store data involved in the above-mentioned various method embodiments, etc. The memory 1220 can alternatively be at least one storage device located away from the aforementioned processor 1210. For example, Figure 12 As shown, the memory 1220 as a computer storage medium can include an operating system, a network communication module, a user interface module, and program instructions.

[0173] Optionally, the communication bus 1250 is used to realize the connection communication between the components, the user interface 1230 can include a display screen (Display), a camera (Camera), and can also include a standard wired interface, a wireless interface; the network interface 1240 can optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface).

[0174] In Figure 12 In the electronic device 1200 shown, the processor 1210 can be used to invoke program instructions stored in the memory 1220, and specifically execute the steps of the application package processing method provided by any one of the possible implementation manners or the steps of the application package generation method provided by any one of the possible implementation manners.

[0175] The computer readable storage medium stores instructions, when the instructions run on the computer or the processor, make the computer or the processor execute one or more steps in the above embodiments. The constituent modules of the above application package processing device and the application package generation device, if realized in the form of a software function unit and sold or used as an independent product, can be stored in the above computer readable storage medium.

[0176] In the above embodiments, all or part of the methods can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the methods can be implemented in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, all or part of the processes or functions described above according to the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted by the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media sets. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a digital versatile disc (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0177] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by a computer program to instruct the relevant hardware, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium includes ROM, RAM, magnetic or optical disc, and other program code storage media. In the case of no conflict, the technical features in the embodiments and the embodiments can be combined arbitrarily.

[0178] The above-mentioned embodiments are merely described as the preferred embodiments of the present application, and do not limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements of the technical solutions of the present application made by a person of ordinary skill in the art shall fall within the protection scope determined by the claims of the present application.

Claims

1. A processing method of an application package, characterized by, The application is applied to an application management device, comprising: obtaining a basic application package, the basic application package being an application installation package that has been digitally signed; parsing the basic application package to obtain a signature version type corresponding to the basic application package; determining offset position information according to the signature version type, the offset position information being used to represent position information of a position to be injected inside the basic application package; sending the offset position information to a downloading device, so that the downloading device generates target injection address information based on the offset position information, and sends the target injection address information to a content distribution device, the target injection address information being used to guide the content distribution device to inject attribution information in the basic application package based on the target injection address information when a user downloading request is received, so as to generate a target application package, the attribution information being used to represent downloading source information of the target application package; the parsing of the basic application package to obtain the signature version type corresponding to the basic application package comprises: extracting metadata information of the basic application package; detecting whether the metadata information contains a preset identifier; in a case where it is detected that the metadata information does not contain the preset identifier, determining that the signature version type corresponding to the basic application package is a first type, the first type being used to represent a signature mechanism type in which signature information is placed in a preset metadata directory and each file in the basic application package is individually signed; in a case where it is detected that the metadata information contains the preset identifier, determining that the signature version type corresponding to the basic application package is a second type, the second type being used to represent a signature mechanism type in which integrity of overall content of the basic application package is verified based on a signature block; the determination of the offset position information according to the signature version type comprises: in a case where the signature version type is the first type, taking a start offset position and a length field of a central directory end record area of the basic application package as the offset position information; in a case where the signature version type is the second type, taking a start offset position of a signature block in the basic application package, a total length of the signature block, and an end offset position of a last key-value pair in the signature block as the offset position information.

2. The method of claim 1, wherein, the sending of the offset position information to the downloading device comprises: receiving an offset position query request of a downloading device, the offset position query request including an application program identifier corresponding to the basic application package; sending the offset position information to the downloading device based on the offset position query request.

3. The method of claim 1, wherein, The method further comprises: sending the basic application package to the content distribution device, so that the content distribution device injects attribution information in the basic application package based on the target injection address information when a user downloading request is received.

4. A method of generating an application package, characterized by, The application is applied to a content distribution device, comprising: obtaining a basic application package, the basic application package being an application installation package that has been digitally signed; receiving target injection address information sent by the downloading device, the target injection address information being information generated by the downloading device based on offset position information, the offset position information being information sent by the application management device to the downloading device, the offset position information being used to represent position information of a position to be injected inside the base application package, the offset position information being information determined by the application management device according to a signature version type of the base application package, the signature version type being a signature version type of the base application package obtained by the application management device by analyzing the base application package; in response to a user download request, injecting attribution information into the base application package based on the target injection address information to generate a target application package, the attribution information being used to represent download source information of the target application package; the response to the user download request, injecting attribution information into the base application package based on the target injection address information to generate a target application package, comprising: in response to a user download request, analyzing the user download request to obtain attribution information; determining an injection parameter based on the target injection address information and the attribution information; injecting the attribution information into the base application package based on the injection parameter; in the case where the signature version type is a first type, the injection parameter includes the offset position information, the offset position information including a starting offset position of a central directory end record area and a length field, and a data byte sequence to be injected; the injecting the attribution information into the base application package based on the injection parameter comprises: updating the length field of the central directory end record area based on the starting offset position of the central directory end record area and a sequence length of the data byte sequence to be injected, and appending the data byte sequence to be injected at the end of the file of the base application package to generate a target application package; in the case where the signature version type is a second type, the injection parameter includes the offset position information, a data byte sequence to be injected, and a central directory offset to be adjusted; the injecting the attribution information into the base application package based on the injection parameter comprises: determining a key-value pair insertion position in the base application package based on the offset position information, and determining a signature block total length; constructing a new key-value pair unit based on the data byte sequence to be injected, and determining a byte length of the new key-value pair unit; updating the signature block total length according to the signature block total length and the byte length of the new key-value pair unit, injecting the new key-value pair unit based on the key-value pair insertion position, and adjusting the central directory offset to be adjusted based on the byte length of the new key-value pair unit to generate a target application package.

5. A system for generating an application package, characterized by, comprising an application management device, a content distribution device, and a downloading device, wherein the application management device is configured to perform the steps of the method of any one of claims 1-3, and the content distribution device is configured to perform the steps of the method of claim 4.

6. A processing apparatus of an application package, characterized by, Applied to application management devices, including: The first acquisition module is used to acquire a basic application package, which is an application installation package that has been digitally signed. The parsing module is used to parse the basic application package to obtain the signature version type corresponding to the basic application package; The determination module is used to determine offset position information based on the signature version type, wherein the offset position information is used to characterize the position information of the location to be injected within the basic application package; The first sending module is used to send the offset position information to the downloading device so that the downloading device generates target injection address information based on the offset position information and sends the target injection address information to the content distribution device. The target injection address information is used to guide the content distribution device to inject attribution information into the basic application package based on the target injection address information when receiving a user download request, so as to generate a target application package. The attribution information is used to characterize the download source information of the target application package. The parsing module includes: An extraction unit is used to extract metadata information from the basic application package; The detection unit is used to detect whether the metadata information contains a preset identifier; The first determining unit is configured to determine the signature version type of the basic application package as a first type when the metadata information does not contain the preset identifier. The first type is used to characterize the signature mechanism type that places the signature information in a preset metadata directory and signs each file in the basic application package one by one. The second determining unit is used to determine the signature version type of the basic application package as the second type when the preset identifier is detected in the metadata information. The second type is used to characterize the signature mechanism type for performing integrity verification of the overall content of the basic application package based on the signature block. The determining module includes: The third determining unit is used to take the starting offset position and length field of the central directory end record area of ​​the basic application package as offset position information when the signature version type is the first type. The fourth determining unit is used to, when the signature version type is the second type, take the starting offset position of the signature block in the base application package, the total length of the signature block, and the ending offset position of the last key-value pair in the signature block as the offset position information.

7. An application package generation apparatus characterized by comprising: include: The second acquisition module is used to acquire a basic application package, which is an application installation package that has been digitally signed. The receiving module is configured to receive target injection address information sent by a downloading device, the target injection address information being information generated by the downloading device based on offset position information, the offset position information being information sent by an application management device to the downloading device, the offset position information being used to represent position information of a position to be injected in the basic application package, the offset position information being information determined by the application management device according to a signature version type of the basic application package, the signature version type being a signature version type of the basic application package obtained by the application management device by analyzing the basic application package; The injection module is configured to inject attribution information into the basic application package based on the target injection address information in response to a user download request, to generate a target application package, the attribution information being used to represent download source information of the target application package. The injection module includes: The fifth determination unit is configured to analyze the user download request in response to the user download request, to obtain attribution information; The sixth determination unit is configured to determine an injection parameter based on the target injection address information and the attribution information; The injection unit is configured to inject the attribution information into the basic application package based on the injection parameter; In a case where the signature version type is a first type, the injection parameter includes the offset position information, the offset position information including a start offset position of a central directory end record area and a length field, and a data byte sequence to be injected; and the injection unit is configured to update the length field of the central directory end record area based on the start offset position of the central directory end record area and a sequence length of the data byte sequence to be injected, and to append the data byte sequence to be injected at the end of a file of the basic application package, to generate a target application package. In a case where the signature version type is a second type, the injection parameter includes the offset position information, a data byte sequence to be injected, and a central directory offset to be adjusted; and the injection unit is configured to determine a key-value pair insertion position in the basic application package based on the offset position information, and to determine a total length of a signature block; to construct a new key-value pair unit based on the data byte sequence to be injected, and to determine a byte length of the new key-value pair unit; to update the total length of the signature block according to the total length of the signature block and the byte length of the new key-value pair unit, to inject the new key-value pair unit based on the key-value pair insertion position, and to adjust the central directory offset to be adjusted based on the byte length of the new key-value pair unit, to generate a target application package.

8. An electronic device, comprising: The processor and the memory are included. The memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to perform the steps of the method in any one of claims 1 to 4. The computer storage medium stores a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to perform the steps of the method in any one of claims 1 to 4.

9. A computer storage medium, characterized in that ​

Images