search

Triple-T / gradle-play-publisher

GPP is Android's unofficial release automation Gradle Plugin. It can do anything from building, uploading, and then promoting your App Bundle or APK to publishing app listings and other metadata.
MIT License
4.13k stars 341 forks source link

Creating service account key requires selecting roles #751

Closed hovi closed 4 years ago

hovi commented 4 years ago

I've been bashing my head against screen for some time - I followed instructions from your doc, but my service account would just not show up in my google dev console.

Then I started googling and found this stackoveflow question: https://stackoverflow.com/questions/50208046/service-account-doesnt-show-up-in-google-play-console-after-creation I set owner permission (or whatever was required for the access here) and suddenly it appreared.

Why do you explicitly say, that I should not select any roles? Is it outdated or am I missing something? It definitely confused me and needs some clarifications.

hannesa2 commented 4 years ago

This click experience is a nightmare https://github.com/Triple-T/gradle-play-publisher/issues/749

SUPERCILEX commented 4 years ago

@hovi were you not able to publish things before that and are then able to publish after giving it owner permissions?

hovi commented 4 years ago

Not sure if this is same problem. I wasn't able to see anything in "Service Accounts" so there was not even service account linked. This project was brand new so new google, play dev account etc. app is still draft. I haven't tried publishing, but ./gradlew bootsrap was giving me 403. Very likely I'd get it for any other command too.

SUPERCILEX commented 4 years ago

And does bootstrap now work?

SUPERCILEX commented 4 years ago

And if so, can you try removing the permissions and seeing if it still works without owner's permissions? Or giving it just the pubsub viewer permission?

hovi commented 4 years ago

Yes, after I created service account in console, but rather than ignoring selecting roles, I could see it in play console and setup permissions. You mean permissions in Play or Google Console?

SUPERCILEX commented 4 years ago

Yeah, the GCP Console. Normally, the play console just forwards you along to GCP. Here's what I mean about the permissions: https://github.com/Triple-T/gradle-play-publisher/issues/749#issuecomment-563353128

hovi commented 4 years ago

I did set pubsub viewer and I could still bootstrap. I removed all service account permissions and I could still bootstrap. I doublechecked, that I am editing correct service account.

SUPERCILEX commented 4 years ago

Dope, thanks for the info. That's what I don't get: it seems like maybe you need to init the service account with owners perms and then you can nuke it. Doesn't make sense. Anyway, I'm gonna try and repro some stuff.

hovi commented 4 years ago

Happy to help with this annoying issue. Let me know if you guys need any more help reproducing/confirming ;)

hannesa2 commented 4 years ago

Any change to prevent from this ?

Gradle Play Publisher's PKCS12 based authentication is deprecated. This is scheduled to be removed in GPP 3.0. Use JSON based authentication instead. https://github.com/Triple-T/gradle-play-publisher#service-account

and keep this working with GPP 3.0 ?

SUPERCILEX commented 4 years ago

Nope. The issue is that the Google auth library used to talk with the AndroidPublisher API dropped support for PKCS12 creds, so we have to do the same. If you already have a service account and PKCS12 creds, it should be fairly easy to generate new JSON creds from that same service account. Go here, click on the GPP service account, hit "Create key", and pick JSON.