How to sign an Android apk securely without using secrets in github?

Question

https://overflow.buffer.com/2020/05/07/using-github-actions-for-android-continuous-integration-and-delivery/

I read, followed the guide here and managed to setup the Github Action to generate a signed apk. Is it possible to sign an Android apk without using the secrets in Github? If possible I would like to store the keystore jks and the rest of the details eg Alias to a separate cloud server let say Google drive. Will I be able to retrieve the keystore and details and somehow import them into the Github CI script? The ultimate goal that I am trying to achieve is to find the most secure way to sign an apk and I am still looking for a solution.

Alexander Hoffmann Alexander Hoffmann · Accepted Answer · 2020-06-25T08:01:50

If you don't want to use GitHub secrets, you can extract the signing information (passwords and alias) to a separate file as described here.

(All examples are from the link above)

Create file keystore.properties with this content:

storePassword=myStorePassword
keyPassword=mykeyPassword
keyAlias=myKeyAlias
storeFile=myStoreFileLocation

Read the content of the file in your gradle script:

...

// Create a variable called keystorePropertiesFile, and initialize it to your
// keystore.properties file, in the rootProject folder.
def keystorePropertiesFile = rootProject.file("keystore.properties")

// Initialize a new Properties() object called keystoreProperties.
def keystoreProperties = new Properties()

// Load your keystore.properties file into the keystoreProperties object.
keystoreProperties.load(new FileInputStream(keystorePropertiesFile))

android {
    ...
}

Set the signing configuration:

android {
    signingConfigs {
        config {
            keyAlias keystoreProperties['keyAlias']
            keyPassword keystoreProperties['keyPassword']
            storeFile file(keystoreProperties['storeFile'])
            storePassword keystoreProperties['storePassword']
        }
    }
    ...
  }

In your CI job, you have to download the keystore and extracted signing information somehow. For example by using curl.

That said though, this is still not increasing security. If you're hosting your keystore and signing information publicly, everybody can download it. If you make it only accessible with a password / API key, you will have to provide this password / API key to your CI. Ideally through GitHub secrets.

I don't know your usecase but generally speaking I would recommend using GitHub secrets (or any other secrets functionallity if you use a different CI).

How to sign an Android apk securely without using secrets in github?

1 Answers