Android build and signing in React Native - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of signing an Android app?

Signing an Android app ensures the app's authenticity and integrity. It confirms the app comes from the developer and has not been tampered with.

beginner

What file format is used for the Android app signing key?

The signing key is stored in a .keystore or .jks file, which contains the private key used to sign the app.

intermediate

What command is used to generate a signing key for Android apps?

You use the keytool command from the Java SDK to generate a signing key, for example: keytool -genkeypair -v -keystore my-release-key.keystore -alias my-key-alias -keyalg RSA -keysize 2048 -validity 10000.

intermediate

In React Native, where do you configure the signing information for Android release builds?

You configure signing info in the android/app/build.gradle file under the signingConfigs section, specifying the keystore path, alias, and passwords.

beginner

What is the difference between a debug build and a release build in Android?

A debug build is unsigned or signed with a debug key and used for testing. A release build is signed with your private key and optimized for publishing to users.

Which file contains the private key used to sign an Android app?

A .keystore

B .apk

C .gradle

D .json

The .keystore file stores the private key used for signing Android apps.

What tool is commonly used to generate a signing key for Android apps?

A keytool

B adb

C npm

D gradle

The keytool command from the Java SDK is used to create signing keys.

Where do you specify signing configs in a React Native Android project?

A package.json

B android/settings.gradle

C index.js

D android/app/build.gradle

Signing configs are set in android/app/build.gradle under signingConfigs.

What is the main reason to sign an Android app before release?

A To add animations

B To verify the app's source and integrity

C To enable debugging

D To reduce app size

Signing confirms the app is from the developer and not altered.

Which build type is optimized and signed for publishing to users?

A Debug build

B Test build

C Release build

D Snapshot build

Release builds are signed with your private key and optimized for users.

Explain the steps to generate and configure a signing key for an Android React Native app.

Think about creating the key, saving it, and telling your app where to find it.

Why is it important to keep your Android app signing key secure and private?

Consider what happens if someone else gets your key.

Practice

1. What is the main purpose of signing an Android app in React Native?

easy

A. To make the app run faster on Android devices

B. To reduce the app's file size before publishing

C. To verify the app's author and ensure it hasn't been tampered with

D. To enable debugging features in the app

Solution

1. Step 1: Understand app signing purpose

   Signing an app proves who created it and ensures it is secure and unchanged.

2. Step 2: Compare options

   Only To verify the app's author and ensure it hasn't been tampered with describes verifying author and app integrity, which is the purpose of signing.

3. Final Answer:

   To verify the app's author and ensure it hasn't been tampered with -> Option C

4. Quick Check:

   App signing = Verify author and integrity [OK]

Hint: Signing proves app identity and security [OK]

Common Mistakes:

• Thinking signing makes app faster
• Confusing signing with debugging
• Believing signing reduces app size

2. Which command is used to generate a new keystore for signing an Android app?

easy

A. adb install my-app.apk

B. gradlew assembleRelease

C. react-native run-android

D. keytool -genkeypair -v -keystore my-release-key.keystore -alias my-key-alias -keyalg RSA -keysize 2048 -validity 10000

Solution

1. Step 1: Identify keystore generation command

   The keytool command with -genkeypair creates a new keystore file for signing.

2. Step 2: Check other commands

   gradlew assembleRelease builds the app, react-native run-android runs debug build, and adb install installs APK; none generate keystore.

3. Final Answer:

   keytool -genkeypair -v -keystore my-release-key.keystore -alias my-key-alias -keyalg RSA -keysize 2048 -validity 10000 -> Option D

4. Quick Check:

   Keystore generation = keytool command [OK]

Hint: Use keytool with -genkeypair to create keystore [OK]

Common Mistakes:

• Using gradlew to generate keystore
• Confusing build commands with keytool
• Trying to generate keystore with adb

3. Given the Gradle signing config snippet below, what will happen if the keystore password is incorrect?

signingConfigs {
  release {
    storeFile file('my-release-key.keystore')
    storePassword 'wrongpassword'
    keyAlias 'my-key-alias'
    keyPassword 'correctpassword'
  }
}

medium

A. The build will fail with a password error during signing

B. The app will build but signing will be skipped

C. The app will build and sign successfully

D. The build will succeed but app crashes on launch

Solution

1. Step 1: Understand password role in signing

   The storePassword must match the keystore password to access the key for signing.

2. Step 2: Effect of wrong password

   If the password is wrong, Gradle cannot access the keystore, causing the build to fail with an error.

3. Final Answer:

   The build will fail with a password error during signing -> Option A

4. Quick Check:

   Wrong keystore password = build failure [OK]

Hint: Wrong keystore password causes build failure [OK]

Common Mistakes:

• Assuming build skips signing on password error
• Thinking app runs despite signing failure
• Believing wrong password causes silent errors

4. You tried to build a signed APK but got this error: Execution failed for task ':app:signRelease'. What is the most likely cause?

medium

A. The keystore file path is incorrect or missing

B. The app's JavaScript code has syntax errors

C. You forgot to run npm install

D. The Android device is not connected

Solution

1. Step 1: Understand signRelease task

   This task signs the APK using the keystore; failure usually means signing config issues.

2. Step 2: Identify common signing errors

   Incorrect or missing keystore file path causes signing to fail; other options relate to unrelated issues.

3. Final Answer:

   The keystore file path is incorrect or missing -> Option A

4. Quick Check:

   signRelease error = keystore path problem [OK]

Hint: Check keystore file path if signing task fails [OK]

Common Mistakes:

• Blaming JavaScript errors for signing failure
• Thinking npm install fixes signing errors
• Assuming device connection affects build signing

5. You want to update your published app but lost your original keystore file. What is the best solution to continue updating your app on Google Play?

hard

A. Generate a new keystore and upload the app as a new app with a different package name

B. Create a new keystore and contact Google Play support to reset your key

C. Build the app without signing and upload it to Google Play

D. Use the debug keystore to sign the update

Solution

1. Step 1: Understand keystore importance for updates

   Google Play requires the same signing key to update an app; losing it blocks updates.

2. Step 2: Best recovery method

   Creating a new keystore and requesting Google Play support to reset your key is the official way to regain update ability.

3. Step 3: Why other options fail

   Uploading as new app changes package name, unsigned builds are rejected, and debug keystore is not allowed for release.

4. Final Answer:

   Create a new keystore and contact Google Play support to reset your key -> Option B

5. Quick Check:

   Lost keystore = new key + Google support [OK]

Hint: Lost keystore? Contact Google Play to reset key [OK]

Common Mistakes:

• Uploading unsigned or debug signed APK
• Publishing as new app instead of updating
• Ignoring Google Play key reset process