Android export does not use signing keys

[duarteroso]

Godot version

4.2.beta6.mono

System information

macOS

Issue description

When exporting an android package, it seems the signing of it is not being applied to the final output. I've noticed that althought my editor settings are set to use the debug.keystore and my export settings for Android are also set to use a custom keystore, when uploading to the GooglePlay store an error is returns saying that the AAB is not signed.

Steps to reproduce

Steps

1. Create a new project
2. Create a new android keystore or use the debug.keystore provided by google
3. Install the Android Build Template
4. Add the following logs to build.gradle
5. Export AAB

Example

Signin config

First build output It is already strange that the message No custom release keystore is printed altough it is clearly set.

Second build output Sadly the window closes too fast to capture it. But if you added the logs as explained above, you should see the messages: No custom debug keystore and No custom release keystore

Minimal reproduction project

AndroidKeystoreBug.zip

[m4gr3d]

@duarteroso I've added logic in RC1 to print the build output to the console when the verbose flag is enabled. Can you retry on that build and provide the output logs.

[duarteroso]

Sorry, I don't have source built at the moment (never managed to get .NET working actually, if only there was a script available that would build everything...) But managed to get the last popup on camera, this is on RC1

[m4gr3d]

Sorry, I don't have source built at the moment (never managed to get .NET working actually, if only there was a script available that would build everything...) But managed to get the last popup on camera, this is on RC1

@duarteroso You don't need to build the editor from source; simply using the latest RC build should log the build output to the console when the verbose flag is enabled, which you can then copy and paste in this issue.

[duarteroso]

Got it 👍🏽 Hope it helps!

output.txt

[m4gr3d]

@duarteroso Looking at the logs, things seem to behave as expected:

Updating ANDROID_HOME environment to /Users/duarteroso/Library/Android/sdk
Build Android project using gradle command: 
/Users/duarteroso/code/Godot/dreamdevour/DreamDevour/android/build/gradlew clean bundleDebug -p /Users/duarteroso/code/Godot/dreamdevour/DreamDevour/android/build -Pexport_package_name=eu.rookies.dreamdevour -Pexport_version_code=1 -Pexport_version_name=1.0.0 -Pexport_version_min_sdk=24 -Pexport_version_target_sdk=33 -Pexport_enabled_abis=arm64-v8a -Pplugins_local_binaries=/Users/duarteroso/code/Godot/dreamdevour/DreamDevour/addons/rookies/google/playgames/.bin/android/GooglePlayGames.debug.aar -Pplugins_remote_binaries=com.google.android.gms:play-services-games-v2:17.0.0|com.google.android.gms:play-services-auth:20.6.0|org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.4.1 -Pplugins_maven_repos= -Pperform_zipalign=true -Pperform_signing=true -Pgodot_editor_version=4.2.rc2.mono
Thread exit status: 0

> Configure project :
Warning: Please apply google-services plugin at the bottom of the build file.
Has custom debug keystore
No custom release keystore

In this snippet of the logs, we can see you're doing an aab debug build. Doing so cause the debug keystore to be passed along (it's not in the printout for privacy / security reasons), which is why the Has custom debug keystore message is printed. The No custom release keystore is also expected because we're not passing the release keystore info for this build since it's a debug build.

Copying Android binary using gradle command: 
/Users/duarteroso/code/Godot/dreamdevour/DreamDevour/android/build/gradlew copyAndRenameDebugAab -p /Users/duarteroso/code/Godot/dreamdevour/DreamDevour/android/build -Pexport_path=file:/Users/duarteroso/code/Godot/dreamdevour -Pexport_filename=DreamDevour.aab
Thread exit status: 0

> Configure project :
Warning: Please apply google-services plugin at the bottom of the build file.
No custom debug keystore
No custom release keystore

In the second snippet of the log, the export process is performing the copy and rename operation. This step doesn't require the keystore info (the binary is already signed at this point) hence why you're seeing the No custom [debug|release] keystore log given we're not passing the keystore info for this step.

In general if the build is successful, it means that the right keystore info was passed along, otherwise the build would fail with an error message. You can use the keytool tool to validate the signature of the generated aab

[duarteroso]

Exactly, and it says it isn't signed 😅 After doing a release build, I need to sign the aab using jarsigner otherwise google console won't accept it.

I'll try and post something useful later tonight.

[duarteroso]

Hopefully this MRP will show the error.

AndroidDebugSign.zip

Building in release does sign the final package. This only affects debug builds

[m4gr3d]

@duarteroso I was finally able to take a look and this is expected behavior. Our debug build / templates have the debuggable attribute set to true which prevent signing of the aab at build time (see https://stackoverflow.com/a/66622555 for reference). The debug builds are used for Remote Debug operations, and thus having debuggable set to true is required for things to work as expected.

For your scenario, I'd suggest to always perform a release build when you intend to sign the build.

[aitbazi]

i need a help whit that error please

[Alex2782]

Cannot access a file in the destination directory (What is your output path? And OS, Windows 10/11?) https://github.com/godotengine/godot/issues/90033

[duarteroso]

i need a help whit that error please

And make sure it is not opened (by an archiver for example)

[m4gr3d]

i need a help whit that error please

This has already been fixed by https://github.com/godotengine/godot/pull/90802.