static String verifyCaller(final Context context, final Intent intent, @Nullable String pkg, int uid) {
		if (pkg == null) {
			final PendingIntent id = intent.getParcelableExtra(Api.latest.EXTRA_CALLER_ID);
			if (id == null) return "Missing required PendingIntent extra: " + Api.latest.EXTRA_CALLER_ID;
			pkg = id.getCreatorPackage();
			uid = id.getCreatorUid();
			if (pkg == null) return "No creator information in " + id;
		}
		if (uid > 0 && Users.isSameApp(uid, Process.myUid())) return null;		// From myself (possibly in other user).
		// This log should generally be placed in the caller site, do it after same app check to skip this for internal API caller with component set.
		if (intent.getPackage() == null && intent.getComponent() != null)
			Log.w(TAG, "Never use implicit intent or explicit intent with component name for API request, use Intent.setPackage() instead.");

		Log.d(TAG, "API invoked by " + pkg);
		if (uid >= 0 && verifyRuntimePermission(context, uid, intent.getAction())) return null;

		// Fallback verification for API v1 clients.
		final Integer value = sVerifiedCallers.get(pkg);
		if (value == null) return "Unauthorized client: " + pkg;
		final int signature_hash = value;
		if (signature_hash == 0) return null;	// 0 means already verified (cached)

		// Legacy verification is not supported inside Island without INTERACT_ACROSS_USERS on Android P+, due to MATCH_ANY_USER being restricted.
		try { @SuppressLint("WrongConstant")
			final PackageInfo pkg_info = context.getPackageManager().getPackageInfo(pkg, GET_SIGNATURES
				| (SDK_INT < P || Permissions.has(context, INTERACT_ACROSS_USERS) ? Hacks.GET_ANY_USER_AND_UNINSTALLED : MATCH_UNINSTALLED_PACKAGES));
			return verifySignature(pkg, signature_hash, pkg_info);
		} catch (final PackageManager.NameNotFoundException e) { return "Permission denied or client package not found: " + pkg; }
	}
Verify the qualification of this API invocation, mainly the permission of API caller.

@param pkg the package name of API caller, if known.
@param uid the UID of API caller, not used if caller_pkg is null. (negative if unavailable)
@return null if verified, or error message for debugging purpose (NOT part of the API protocol).
engine/src/main/java/com/oasisfeng/island/api/ApiDispatcher.java