So far my build process produces an unsigned APK file, which now I want to sign with my keystore. However, every time I repeat this process (on a copy of the original unsigned APK basically), I'm getting a different resulting signed APK, despite using the same keystore.
1dd63064294febffc20a4611b25ad619 machine1/app-release-unsigned.apk
1dd63064294febffc20a4611b25ad619 machine2/app-release-unsigned.apk
57adfd7c2a7240dc9c3ed79a525f71be machine1/app-release-signed.apk
91e9168e5d5242059408b4fdff0e34aa machine2/app-release-signed.apk
I am aware of the issue for reproducible builds when someone else (who does not have access to my keystore) wants to reproduce the build, they would have to resort to techniques like signature copying.
However, I want to reproduce the build and I do have access to the original keystore. Is this still impossible? If yes, why? If not, what changes would I have to make to my build.gradle
?
android {
...
signingConfigs {
release {
storeFile file('../keystore.jks')
storePassword 'secret-store-password'
keyAlias 'release-key'
keyPassword 'secret-key-password'
}
}
buildTypes {
release {
signingConfig signingConfigs.release
}
}
}