OpenIABHelper: Support signature verification outside of IabHelper about openiab

[oorlov]

Available via Options.verifyMode = VERIFY_SKIP

[pflammertsma]

Is there some facility in OpenIAB to handle the signature check through a server, as per Google's recommendations?

[oorlov]

Sure, will work best with following steps:

1. Create OpenIabHelper with "Skip signature verification" option and no publicKeys. If you specify no publicKeys and forget VERIFY_SKIP options IabHelper will throw

Options opts = new OpenIabHelper.Options();
opts.verifyMode = Options.VERIFY_SKIP;
mHelper = new OpenIabHelper(context, opts);

2. Get receipt's data and signature from Purchase object and send it to your server

new IabHelper.OnIabPurchaseFinishedListener() {
    public void onIabPurchaseFinished(IabResult result, Purchase purchase) {
        // … different result checks ...
        String receiptData = purchase.getOriginalJson();
        String receiptSignature = purchase.getSignature();
        String storeName = purchase.getAppstoreName();
        String urlToContent  = requestReceiptVerificationOnServer(receiptData, receiptSignature, storeName);
        // … further code ...

[pflammertsma]

Great, Oleg, thanks for the details!

[oorlov]

BTW: Amazon and SamsungApps doesn't support RSA verification, so if storeName is OpenIABHelper.NAME_AMAZON or OpenIabHelper.NAME_SAMSUNG verification wouldn't work

PS: I'll appreciate if you help other people to know about OpenIAB :)