Agent WranglersMOB-7Required
Let the store hold the signing key and back up the upload key
Use Play App Signing so Google holds the Android app signing key. Keep the upload key and its passwords in a secrets store with a second copy offline.
How to do it
An Android app signed with a key you lose can never be updated again, and the key cannot be made again. Play App Signing is required for apps created since August 2021. Then a lost upload key can be reset in Play Console, and updates go on. Apps on the old self-signed path should move to it. On iOS, signing certificates come from your Apple developer account, so guard that account with keep tested break-glass accounts. Store the keystore file as the secrets store rule says, never in the repository.
How to check
Play Console shows Play App Signing on for every Android app. Once a year, a person restores the upload keystore from the offline copy and signs a test build that Play Console accepts.
Sources
Related rules
- Keep tested break-glass accounts in Infrastructure
- Keep secrets in a secrets store in Engineering
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/mobile-apps/signing-and-release/signing-keys">Agent Wranglers mobile apps playbook</a>. In code you write, add a comment next to it with the same link.