Next: , Previous: , Up: Top   [Contents][Index]


10 Signing

There are two kinds of signing involved in running a repository - the signing of the APK files generated from source builds, and the signing of the repo index itself. The latter is optional, but very strongly recommended.

10.1 Repo Index Signing

When setting up the repository, one of the first steps should be to generate a signing key for the repository index. This will also create a keystore, which is a file that can be used to hold this and all other keys used. Consider the location, security and backup status of this file carefully, then create it as follows:

keytool -genkey -v -keystore my.keystore -alias repokey -keyalg RSA -keysize 2048 -validity 10000

In the above, replace ’my.keystore’ with the name of the keystore file to be created, and ’repokey’ with a name to identify the repo index key by.

You’ll be asked for a password for the keystore, AND a password for the key. They shouldn’t be the same. In between, you’ll be asked for some identifying details which will go in the certificate.

The two passwords entered go into config.py, as keystorepass and keypass respectively. The path to the keystore file, and the alias you chose for the key also go into that file, as keystore and repo_keyalias respectively.

10.2 Package Signing

With the repo index signing configured, all that remains to be done for package signing to work is to set the keydname field in config.py to contain the same identifying details you entered before.

A new key will be generated using these details, for each application that is built. (If a specific key is required for a particular application, this system can be overridden using the keyaliases config settings.


Next: , Previous: , Up: Top   [Contents][Index]