Field Notes

entity

Play App Signing

StatusStableReviewdue UpdatedStands on1 sourceSupportsnotes

Play App Signing is Google’s program for holding and using the signing keys of apps distributed through the Play Store. Under it, Google “manages and protects your app’s signing key” and uses that key to sign the APK files delivered to devices.1 The developer signs only an upload key, which Google verifies before re-signing the artifact with the app signing key it holds.

Key custody

The custody arrangement is the point of the program. A developer either uploads an existing key or lets Google generate one, and afterwards cannot retrieve a copy: Google’s documentation states that “you cannot retrieve a copy of your app’s signing key” and that Google “may retain a backup copy of the key for disaster recovery purposes.”1 Keys are held on “the same infrastructure that Google uses to store its own keys,” protected by Google Cloud KMS.1

The program is not optional for new publishers. Configuring Play App Signing is required to distribute through Google Play, except for apps created before August 2021, which may continue distributing self-signed APKs.1 That cutoff is what makes the arrangement the majority case: every app added to the store since then has its signing key held by Google rather than its developer.

What it does and does not establish

Play App Signing solves a real operational problem. Developer key loss is common enough to be a recurring failure mode in Android distribution, and a key held in Google’s infrastructure survives the laptop crashes and departed team members that strand independently held keys. It also enables key rotation and the App Bundle delivery model, which a fixed developer-held key cannot support.

It does not establish Source-to-binary correspondence. Google signs a binary the developer uploaded; nothing in the process ties that binary to any source a user can read. The signature proves that the artifact passed through Google’s pipeline, not that it matches published code.

  1. Sign your app, Android Developers documentation. ↩↩↩↩

Built on 1 source (1 external).

Working out connections…