PricingLoginStart free
React Native Academy · 课时

创建密钥库并为 AAB 签名

使用 keytool 生成发布密钥库，使用 gradle.properties 和 build.gradle 配置签名设置，并通过 EAS Build 构建已签名的 Android App Bundle。

第 1 / 4 课13 个步骤

创建密钥库并为 AAB 签名 是 CoddyKit 上的免费 React Native Academy 课时。 这是第 1 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 React Native Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 React Native Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Why Android Signing Matters

Every Android app must be digitally signed with a private key before it can be installed or distributed. The signature is embedded in the APK or AAB file and verifies that all future updates to the app come from the same developer. If you lose your keystore, you can never issue an update to that app — you would have to publish an entirely new app with a different package name. Back up your keystore file securely.

What Is a Keystore File

A keystore is a binary file (typically .jks or .keystore) that stores one or more cryptographic key pairs. It is protected by two passwords: a store password (protects the file) and a key password (protects the individual key alias inside). Think of it like a password-protected vault containing your signing identity. Android uses a key inside this vault to sign your APK or AAB.

APK vs AAB: Which to Use

Google Play now requires Android App Bundles (AAB) for new apps (since August 2021). An AAB is smaller than an APK because it contains resources for all device configurations and lets Google Play build a device-specific APK for each user. This reduces download size by 15–50%. Local testing and side-loading still use APKs. Build AAB for Play Store submissions and APK only for direct installation or internal testing outside Play.

// eas.json — build AAB for production
{
  'build': {
    'production': {
      'android': {
        'buildType': 'app-bundle'  // produces .aab
      }
    },
    'preview': {
      'android': {
        'buildType': 'apk'  // produces .apk for side-loading
      }
    }
  }
}

Generating a Keystore with keytool

Java's keytool utility generates keystores. The key parameters are: -genkeypair to generate a new key pair, -keystore for the output filename, -alias for the key alias (a name for the key inside the keystore), -validity for how many days the certificate is valid (25 years = 9125 days is typical for app signing), and -keyalg RSA -keysize 2048 for the cryptographic algorithm.

# Generate a release keystore
keytool -genkeypair \
  -keystore myapp-release-key.jks \
  -alias myapp-key \
  -keyalg RSA \
  -keysize 2048 \
  -validity 9125 \
  -storepass yourStorePassword \
  -keypass yourKeyPassword

# You'll be prompted for:
# First and last name:
# Organizational unit:
# Organization:
# City or locality:
# State or province:
# Two-letter country code (e.g., US):
# Then type 'yes' to confirm

EAS Auto-Generated Keystore

EAS Build can generate and securely store a keystore for you automatically. When you first run a production Android build, EAS prompts you to generate a new keystore or upload an existing one. If you let EAS generate it, the keystore is stored encrypted in EAS's cloud — you can download it any time via eas credentials --platform android. This is the safest option for teams because no keystore lives on a single developer's laptop.

# Let EAS generate and manage the keystore
eas build --platform android --profile production

# EAS prompts:
# ? Would you like to set up an Android Keystore?
# > Generate new keystore  <- choose this
#
# EAS creates and stores it securely.

# Download your keystore for backup:
eas credentials --platform android
# Select: Download existing keystore

Configuring Manual Signing in build.gradle

If you are using a bare React Native workflow (not managed Expo) and want to sign locally rather than with EAS, configure signing in android/app/build.gradle. Add a signingConfigs block referencing your keystore file and passwords. Store keystore credentials in ~/.gradle/gradle.properties (not in the source code) to keep them out of git history.

// android/app/build.gradle
android {
    signingConfigs {
        release {
            storeFile file(MYAPP_UPLOAD_STORE_FILE)
            storePassword MYAPP_UPLOAD_STORE_PASSWORD
            keyAlias MYAPP_UPLOAD_KEY_ALIAS
            keyPassword MYAPP_UPLOAD_KEY_PASSWORD
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt')
        }
    }
}

// ~/.gradle/gradle.properties (NOT in git)
// MYAPP_UPLOAD_STORE_FILE=myapp-release-key.jks
// MYAPP_UPLOAD_STORE_PASSWORD=yourStorePassword
// MYAPP_UPLOAD_KEY_ALIAS=myapp-key
// MYAPP_UPLOAD_KEY_PASSWORD=yourKeyPassword

Building the Signed AAB with EAS

Once credentials are set up, trigger the production Android build with EAS. The cloud runner checks out your code, applies config plugins, builds the AAB, signs it with your keystore, and makes it available for download or direct upload to Play Console. Monitor progress with eas build:list or the EAS dashboard. The finished AAB is typically 5–20MB depending on app size.

# Build signed AAB for Play Store
eas build --platform android --profile production

# Watch build progress (or use dashboard URL provided)
eas build:list --platform android --limit 5

# Download the .aab when complete
eas build:download --id <build-id>

# Alternatively: build AND auto-submit to Play Console
eas build --platform android --profile production --auto-submit

Play App Signing: Upgrading Security

Google Play App Signing is a program where Google holds a secondary app signing key. You upload the AAB signed with your upload key (a simpler key you generate), and Google re-signs it with the managed app signing key before delivery to users. The benefit: if your upload key is compromised or lost, Google can issue a new one. Once enrolled, you cannot unenroll, but it is strongly recommended for new apps.

// Play App Signing flow:

// You sign with:     Upload Key (your keystore)
//                          |
//                          v
//              [Upload to Play Console]
//                          |
//              Google re-signs with:
//                   App Signing Key
//                          |
//                          v
//     Device receives:  App signed by Google's key

// Enroll when creating app in Play Console:
// Setup > App Signing > Use Google-managed key

Verifying the AAB Signature

Before uploading to Play Console, verify your AAB is correctly signed using bundletool or apksigner. Inspect the signing certificate SHA-256 fingerprint — this fingerprint is what Google Play expects to match. A mismatch between your upload certificate and what Play Console has on record will cause the upload to be rejected with a signing error.

# Verify keystore details
keytool -list -v -keystore myapp-release-key.jks
# Shows: Certificate fingerprint (SHA-256):
#   AB:CD:EF:... (copy this for your records)

# Check what signed an APK/AAB
apksigner verify --verbose myapp.apk

# Bundletool (download from Google)
bundletool dump manifest --bundle=myapp.aab

Backing Up the Keystore

The keystore backup is critical — treat it like a password or private key. Store it in: a password manager that supports file attachments, an encrypted cloud storage location (not the same git repo), and optionally a hardware security device. Record the store password, key alias, and key password alongside it. Losing the keystore means you can never update the app — you would need to publish under a new package name and lose all your existing users and reviews.

# Keystore backup checklist:

# 1. Store the .jks file in encrypted storage
#    - 1Password, Bitwarden, or similar
#    - Do NOT commit to git

# 2. Record credentials alongside it:
#    Store file:     myapp-release-key.jks
#    Store password: [store securely]
#    Key alias:      myapp-key
#    Key password:   [store securely]

# 3. Test restoration:
#    - Copy backup to a new machine
#    - Run: keytool -list -keystore myapp-release-key.jks
#    - Verify you can list the key alias

# 4. Tell your team where the backup lives

Version Code and Version Name

Android uses two version identifiers: versionCode (an integer, must increment with each Play Store upload) and versionName (the string shown to users, e.g., '1.2.3'). Play Console rejects a build if versionCode is not strictly greater than the last uploaded build. In Expo, set android.versionCode in app.json and increment it for every new build uploaded to Play.

// app.json
{
  'expo': {
    'version': '1.2.3',     // versionName shown to users
    'android': {
      'versionCode': 12,     // must be higher than previous upload
      'package': 'com.yourcompany.myapp'
    }
  }
}

// After submitting to Play Console, before next build:
// Increment versionCode: 12 -> 13
// Update version if user-facing: '1.2.3' -> '1.2.4'

// EAS can auto-increment:
// eas.json: 'autoIncrement': true (in android profile)

Quick Check

Test your understanding of React Native Mobile Development concepts from this lesson.

在交互式课程中回答

Lesson Recap

In this lesson you learned: how to generate an Android keystore with keytool or EAS Build, the difference between APK and AAB and why Play Store requires AAB, and how to configure signing in build.gradle for bare workflow projects. You also saw Google Play App Signing and why backing up the keystore is non-negotiable. Next up we set up the Play Console listing.

免费开始

用 AI 导师学习 JavaScript — 免费

在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。

课程
30
课程
120
免费开始学习查看完整课程

常见问题解答

「创建密钥库并为 AAB 签名」课时是免费的吗？

是的 — 「创建密钥库并为 AAB 签名」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 React Native Academy 课程的其余内容，请升级到 CoddyKit PRO。 React Native Academy 课程共包含 4 节课。

「创建密钥库并为 AAB 签名」这节课中我会学到什么？

使用 keytool 生成发布密钥库，使用 gradle.properties 和 build.gradle 配置签名设置，并通过 EAS Build 构建已签名的 Android App Bundle。 你通过在浏览器中直接运行的动手代码来练习 React Native Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 React Native Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 React Native Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 1 节课，共 4 节。

「创建密钥库并为 AAB 签名」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 React Native Academy 课中编写并运行代码吗？

能。每节 React Native Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. 创建密钥库并为 AAB 签名
  2. 设置 Play Console 商店页面
  3. 内容分级、政策与隐私
  4. 内部测试、分阶段发布与正式发布
← 返回 React Native Academy