如何配置构建文件以获取Android应用的发布密钥和密钥库文件的密码

Question

I would like to upload an Android app for the first time so I am reading the Signing Your Applications guide but one thing is not so clear, therefore I would appreciate if somebody could explain me the below note:

Note: Including the passwords for your release key and keystore inside the build file is not a good security practice. Alternatively, you can configure the build file to obtain these passwords from environment variables or have the build process prompt you for these passwords.

To obtain these passwords from environment variables:

storePassword System.getenv("KSTOREPWD")
keyPassword System.getenv("KEYPWD")

What are environment variables? And what do I need to do exactly with these variables? Or I don't need to care about them if I am signing my app in Android Studio?

Answer 1

You really dont need to care about the environment variables. When you go to build your project from Android Studio you should be prompted for your keystore location and for the password. Just select the correct file and enter the correct password and that is all.

Answer 2

Environmental Variables are variables that the OS exposes to programs it runs to help define the environment. Some examples include PATH , which defines which directories will be searched when a program requests a non-fully qualified path (ie doesn't start with / or C:\\\\ ) after it searches the PWD , or current directory (another environmental variable). What this tutorial is saying is that you can configure your build file to fetch and use the values of KSTOREPWD and KEYPWD to get your key and sign your app. That being said, you don't really need to care about all this if you're signing your app through Android Studio; you would if you were signing from the command line or wanted to batch-sign a bunch of apps. Just make sure you don't put the passwords in your build file