Why can I upgrade my app to a version signed with a different keystore

Question

I have multiple flavours in my app lets call them Flavour_1 & Flavour_2. Each flavour has an unique keystore Flavour_1_Release_Key & Flavour_2_Release_Key.

I generate an apk using Flavour_1 and version '1.0.1' and then install that to my device.

I then generate an apk using Flavour_2 and call this version '1.0.2' I can then go to my device and install Flavour_2 over the top of Flavour_1 even though they are built with different keys.

I was under the impression you could only install an incremented version using the same keystore.

I've provided my build.gradle for reference

apply plugin: 'com.android.application'

android {

    signingConfigs {
        flavour1Release {
            keyAlias 'Flavour_1_alias'
            keyPassword 'password'
            storeFile file('C:/PATH/TO/KEY/Flavour_1_Keystore.jks')
            storePassword 'password'
        }

        flavour2Release {
            keyAlias 'Flavour_2_alias'
            keyPassword 'password'
            storeFile file('C:/PATH/TO/KEY/Flavour_2_Keystore.jks')
            storePassword 'password'
        }

    }

    compileSdkVersion 27

    defaultConfig {
        applicationId "com.my.app"
        vectorDrawables.useSupportLibrary = true
        minSdkVersion 22
        targetSdkVersion 22
        versionCode 101
        versionName "1.0.1"
        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"

        javaCompileOptions {
            annotationProcessorOptions {
                arguments = ["room.schemaLocation": "$projectDir/schemas".toString()]
            }
        }
    }

    flavorDimensions "customer"

    productFlavors {
        // productFlavour attributes override those in defaultConfig
        Flavour_1 {
            dimension "customer"
            signingConfig signingConfigs.flavour1Release 
        }
        Flavour_2  {
            dimension "customer"
            signingConfig signingConfigs.flavour2Release 
        }
    }

    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }

    dataBinding {
        enabled = true
    }

    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }

    defaultConfig {
        multiDexEnabled true
    }

    lintOptions {
        checkReleaseBuilds false
        abortOnError false
    }

}

dependencies {
    implementation fileTree(include: ['*.jar', '*.arr'], dir: 'libs')
}

Side note I am testing this by building a Flavour_1.apk and Flavour_2.apk dropping them onto an emulator and installing there Flavour_1.apk first then Flavour_2.apk without any issue.

score 1 · Answer 1 · answered Mar 13 '19 at 11:24

1

Keys let Android to identify the Author (you) and Android not allows an App to be updated from a "different" Author due to Security reasons. In your case: two Keys = two Authors

answered Mar 13 '19 at 11:24

emandt

1,903
2
10
15

I'm not sure whether you understand or I am misunderstanding you; Are you saying if I set my keys as me the author James Young same address etc. The same as another then I am allowed to update with any key? As both my keys are generated by me though they are separate one for Flavour_1 and Flavour_2. – Muto Mar 13 '19 at 14:45
A Key identifies an Author but even using same Name, Surname, Address, etc will generate a different Key. – emandt Mar 13 '19 at 15:02
Yes, I know this. My question is though why can't i upgrade my app to a new version that is using a totally different key. – Muto Mar 13 '19 at 15:18
I try to explain better: if an "com.example" APK1 is already installed using your Flavour1 it's not possibile to install a "com.example" APK2 that is signed using Flavour2. Instead if APK1 and APK2 have different PackageNames it's possibile to install both APKs. Update/Downgrade version requires SAME signature. If it works even using a different Signature then you have a special Android ROM where that security chek was disabled by Author/XposedModule. – emandt Mar 14 '19 at 14:13

Why can I upgrade my app to a version signed with a different keystore

1 Answers1