Release builds, signing and the App Bundle

Debug versus release

While developing, you run debug builds: easy to debug, not optimised, signed with an automatic debug key. What you give to users is a release build: optimised, shrunk, and signed with your own key. Never upload a debug build.

R8: shrinking and obfuscation

R8 is the tool that optimises release builds. It removes unused code (shrinking), shortens names (obfuscation, which also makes reverse engineering a little harder) and optimises the remaining code. Resource shrinking removes unused images and layouts. Together they make the app smaller and faster.

android {
    buildTypes {
        release {
            isMinifyEnabled = true
            isShrinkResources = true
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro",
            )
        }
    }
}

Signing and keys

Android only installs apps that are digitally signed. A signature proves who made the app and that it was not changed. Updates must be signed by the same key, or Android refuses to install them over the old version. A keystore is a password-protected file that holds keys.

With Play App Signing (required for new apps), losing your upload key is recoverable: you can ask Google support to reset it. Still, guard it carefully: back up the keystore file and passwords somewhere safe and private, and never commit them to Git or share them in chat.

Building a signed bundle

1. In Android Studio: Build > Generate Signed App Bundle or APK, choose Android App Bundle.
2. Create a new keystore the first time (choose a strong password and remember the key alias), or select your existing one.
3. Choose the release build variant and finish. The .aab file appears in app/release/.

./gradlew bundleRelease

Why an App Bundle?

An APK is the installable package. An Android App Bundle (.aab) is a publishing format that contains all your code and resources. Google Play uses it to generate optimised APKs for each device, with only the screen density, CPU type and languages that phone needs. Users download less, which matters on slow or expensive mobile data. New apps on Google Play must be published as AABs (required since August 2021).

Versioning

versionCode is an integer that must increase for every upload; Play Console rejects a bundle whose versionCode it has already seen. versionName ("1.2.0") is the friendly version users see. A common habit is to bump versionCode by one for each release and follow MAJOR.MINOR.PATCH for versionName.

Common mistakes

• Committing the keystore or its passwords to GitHub. Add them to .gitignore and store them privately.
• Forgetting to increase versionCode: "Version code 3 has already been used".
• Not testing the release build: R8 can remove classes used by reflection, causing crashes only in release.
• Uploading an APK for a new app: Play requires an AAB.