App Signing
Keys and Play App Signing.
Why Apps Must Be Signed
Android will not install an app unless it is digitally signed. The signature proves two things: who published the app, and that the APK has not been tampered with since.
Crucially, signatures tie updates to the original app. An update is only accepted if it is signed with the same key as the installed version. Lose that key and you can no longer update your app — ever.
This lesson covers keystores, signing config, and Google's safer modern approach: Play App Signing.
Keystores and Keys
Your signing identity lives in a keystore file (.jks or .keystore). A keystore can hold multiple keys; each key has an alias and its own password.
- Keystore password — unlocks the file.
- Key alias — names the key inside it.
- Key password — unlocks that specific key.
The debug builds you run daily are signed automatically with a throwaway debug keystore. For release you need your own.