Skip to content

release-blocker: release builds are signed with the debug key #130

Description

@0takuc0mrade

Problem

`android/app/build.gradle`:

```groovy
buildTypes { release { signingConfig signingConfigs.debug } }
```

Release-mode APKs/AABs are signed with the debug keystore, so they cannot be uploaded to the Play Store and are insecure. Direct release-readiness blocker.

Scope (low-code)

Add a `signingConfigs.release` block reading from an untracked `key.properties`, and point release at it. Small gradle edit plus a documented `key.properties` template.

Acceptance criteria

  • Release `signingConfig` no longer references `signingConfigs.debug`.
  • Keystore credentials read from an untracked `key.properties` (added to `.gitignore`), with a documented example.
  • `flutter build appbundle --release` produces a non-debug-signed artifact.

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardOfficial Campaign | FWC26Campaign: Official Campaign | FWC26

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions