Cubicle Crusher · Devlog · Version 0.0.1 Our first Android build almost shipped with a leaked key A signing key that has been committed is not made safe again by deleting the file. English Tiếng Việt 日本語 English Why deleting a keystore does not undo the leak While turning Cubicle Crusher from a Google Playground ZIP into its first signed Android build, we found a file that should never have been in the repository. What a keystore actually is A keystore is not game art, and it is not source code you can replace later without consequences. It is the file that holds the private key used to sign an Android app. That signature is how later updates are recognized as coming from the same developer. If someone else has the key, they may be able to sign a build as if it were yours. A keystore has to stay private for the same reason a password does. What w...
Explore the world, Create with passion, Achieve your goals.