code-signing-android
Installation
SKILL.md
Code Signing (Android)
Keystore management.
Credential and external action gate
An Android keystore and its password are private signing credentials. Do not generate, import, download, replace, or expose a keystore; run eas credentials; or alter Play App Signing without explicit owner confirmation of the exact developer account, app, and recovery plan. Keep keystores and passwords out of the repository, prompts, screenshots, and logs.
Two keys with Play App Signing
| Key | Holder | Use |
|---|---|---|
| Upload key | You (EAS) | Sign AAB before upload |
| Signing key | Sign APKs delivered to users |
Lose upload key → Google reissues (Play App Signing benefit). Lose signing key → not possible (Google has it).