Documentation

Signing for Android

Di halaman ini

What you need
Creating one
What to put in Forge
What you get

Every Android build is signed — Forge signs with a throwaway debug key when you have given it nothing else, which installs on a device and is refused by every store. To publish, you need your own key.

What you need

An upload keystore: a .jks or .keystore file, its password, the alias of the key inside it, and that key's password.

Note upload key. If you use Play App Signing — the default for new apps — Google holds the key that actually signs what users install, and yours is the one that proves an upload is from you. That is a good arrangement: losing your upload key is recoverable, losing an app signing key is not.

Creating one

keytool ships with any JDK:

keytool -genkeypair -v \
  -keystore upload-keystore.jks \
  -keyalg RSA -keysize 2048 -validity 10000 \
  -alias upload

It asks for a keystore password, then some identifying details, then a key password. -validity 10000 is about 27 years; Play requires a key valid past 2033, and a key that expires is a problem with no good answer.

Back this file up somewhere that is not your laptop, along with both passwords. If you are not using Play App Signing, losing it means you can never update your app again — you would have to publish a new listing and lose your reviews and installs.

What to put in Forge

Field	What
Upload keystore	the `.jks` file
Keystore password	the first password `keytool` asked for
Key alias	`upload`, above — whatever you passed to `-alias`
Key password	the second password; often the same as the first

To check what is in a keystore you already have:

keytool -list -v -keystore upload-keystore.jks

What you get

With these set, Forge produces a signed .apk. Without them it still produces one, signed with the debug key — fine for sending to a tester over a cable, refused by Play.

A .aab for Play Store submission additionally needs bundletool, which Google ships separately from the SDK; that is not wired up yet.