@Nullable private static String verifySignature(final String pkg, final int signature_hash, final PackageInfo pkg_info) {
		for (final Signature signature : pkg_info.signatures)
			if (signature.hashCode() != signature_hash) return "Package signature mismatch";
		sVerifiedCallers.put(pkg, 0);		// No further signature check for this caller in the lifetime of this process.
		return null;
	}
Verify the qualification of this API invocation, mainly the permission of API caller.

@param pkg the package name of API caller, if known.
@param uid the UID of API caller, not used if caller_pkg is null. (negative if unavailable)
@return null if verified, or error message for debugging purpose (NOT part of the API protocol).
engine/src/main/java/com/oasisfeng/island/api/ApiDispatcher.java