Next: GNU Free Documentation License, Previous: Build Server, Up: Top [Contents][Index]
There are two kinds of signing involved in running a repository - the signing of the APK files generated from source builds, and the signing of the repo index itself. The latter is optional, but very strongly recommended.
When setting up the repository, one of the first steps should be to generate a signing key for the repository index. This will also create a keystore, which is a file that can be used to hold this and all other keys used. Consider the location, security and backup status of this file carefully, then create it as follows:
keytool -genkey -v -keystore my.keystore -alias repokey -keyalg RSA -keysize 2048 -validity 10000
In the above, replace ’my.keystore’ with the name of the keystore file to be created, and ’repokey’ with a name to identify the repo index key by.
You’ll be asked for a password for the keystore, AND a password for the key. They shouldn’t be the same. In between, you’ll be asked for some identifying details which will go in the certificate.
The two passwords entered go into config.py
, as keystorepass
and
keypass
respectively. The path to the keystore file, and the alias you
chose for the key also go into that file, as keystore
and
repo_keyalias
respectively.
With the repo index signing configured, all that remains to be done for package
signing to work is to set the keydname
field in config.py
to
contain the same identifying details you entered before.
A new key will be generated using these details, for each application that is
built. (If a specific key is required for a particular application, this system
can be overridden using the keyaliases
config settings.
Next: GNU Free Documentation License, Previous: Build Server, Up: Top [Contents][Index]