无法在发布模式下构建应用-密钥库被篡改，或者密码不正确

Question

I'm having a problem that I can only build my app on debug mode. When I try building it on release, either with Android Studio or ./gradlew assembleRelease I get the Keystore was tampered with, or password was incorrect error message.

The thing is I can generate a signed, I'm only having problems with building my app on release mode.

Here's how I configured the release build type in my build.gradle:

    gradle.taskGraph.whenReady { taskGraph ->
    if (taskGraph.hasTask(':app:assembleRelase')) {
        def password = ""

        if (System.console() == null) {
            new SwingBuilder().edt {
                dialog(modal: true,
                        title: "Enter password",
                        alwaysOnTop: true,
                        resizable: false,
                        locationRelativeTo: null,
                        pack: true,
                        show: true
                ) {
                    vbox {
                        label(text: "Enter password: ")
                        input = passwordField()
                        button(defaultButton: true, text: 'OK', actionPerformed: {
                            password = input.password
                            dispose()
                        })
                    }
                }
            }
        } else {
            password = System.console().readPassword("\nEnter password: ")
            password = new String(password)
        }

        if (password.size() <= 0) {
            throw new InvalidUserDataException("Empty password")
        }

        android.signingConfigs.release.storePassword = password
        android.signingConfigs.release.keyPassword = password
    }
}

The function above was supposed to ask for the key and store passwords either through a dialogue or command line, but it's being ignored.

android {
...
signingConfigs {
        config {
            keyAlias 'my_alias'
            keyPassword ''
            storeFile file('../my_keystore.jks')
            storePassword ''
        }
    }

buildTypes {
...
release {
            minifyEnabled false
            debuggable false
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
            buildConfigField("String", "DB_NAME", '"database.db"')
            signingConfig signingConfigs.config
        }

Please, I need to know if there's anything I've done wrong or if I forgot anything.

Answer 1

Since Gradle Daemon has been added to Gradle, it's no longer able to use the System.console() function unless you add the --no-daemon flag.

As for the use of Swing features in a Gradle build process, it's not a good practice and at least for this case it doesn't work at all.

So in conclusion, the best thing to do is to create a properties file containing the alias, passwords and the keystore file path, and obviously include that file in .gitignore and make sure the keystore file is located at a directory other than the project's for safety reasons.

The way to set the signing configuration properties from the properties file is shown in the following code:

signingConfigs {
    config {
        def properties = new Properties()
        file("my_properties_file.properties").withInputStream { properties.load(it) }
        keyPassword = properties.getProperty("my.key.password")
        storePassword = properties.getProperty("my.store.password")
        keyAlias = properties.getProperty("my.key.alias")
        storeFile = file(properties.getProperty("my.file.path"))
    }
}