Repository navigation
feat(mobile): sign Android releases with the operator's key - #763
Merged
Merged
Conversation
Expo's generated app/build.gradle signs the release build type with the template's debug.keystore, whose password is public, and the release script copied the signing properties into the project without Gradle reading them. A release prebuild now signs releases from release-signing.properties, and leaves them unsigned when that file is absent, never falling back to the debug key. Development builds keep Expo's default. The release script gains --apk for a signed APK to install on a test phone, removes a stale signing copy for --unsigned, and finds Gradle's -unsigned APK name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed and why
Release builds of the Android app were signed with the wrong key. Expo's generated
app/build.gradlesigns the release build type with the template'sdebug.keystore, whose password is public, andrelease/build-android.mtscopied the operator's signing properties into the project without Gradle ever reading them. The release docs listed this as an open gap.release-signing.properties, the copy of the operator's mode-0600 file outside the repository. Without that file the release is unsigned; it never falls back to the debug key. A properties file missing a key fails the build and names the key. Development builds keep Expo's default, so contributors can still install a local release variant.pnpm mobile:release:android --apkbuilds a signed APK instead of the AAB, to install directly on a phone.--unsignednow removes a signing copy left by an earlier build, and finds Gradle'sapp-release-unsigned.apk.mobile-release.mddescribes the signing behaviour, the--apkoption and using a separate local test key rather than the upload key.Verification
apps/mobilevitest for the plugin: 40 passed, including 5 new tests for the transform (signs from the properties file, never with the debug key, debug type unchanged, idempotent, refuses an unrecognised build file).tsc, biome.--apkwith a local test key.apksigner verifyshows the test key's certificate; the APK holds the JS bundle and identifies asorg.openmapx.app1.0.0. None of its 1,183 entries contains signing material.Release and upgrade impact
Product impact: ordinary