App Bundle & Signing

« Prev Next »

RecipeBox has already been built and signed for debugging throughout this course, using the debug keystore Android Studio generates automatically. Publishing it means producing a properly signed release build in the format the Play Store actually expects — which, for years now, has been an Android App Bundle rather than a plain APK.

App Bundle (.aab) vs APK

	APK	App Bundle (.aab)
What it is	A single, installable package	A publishing format — never installed directly on a device
Contains	All code/resources for every device configuration	All code/resources, organized so Play can slice it
Install size	One-size-fits-all, often larger	Play Store generates a smaller, device-specific APK per install
Where it's used	Manual sideloading, direct distribution	Required for new apps published to Google Play

The App Bundle itself is never installed on a phone. Google Play's backend uses it to generate and serve an optimized APK for each requesting device — the mechanics of that slicing are covered in the next lesson, App Size Optimization.

Keystore Recap

The App Signing & Keystore lesson already covered why every release build must be signed and how a keystore holds the private key used to sign it. That same keystore is what generates the signed bundle here — nothing about the keystore itself changes for App Bundles, only the output format does.

Generating a Signed Release Bundle in Android Studio

Go to Build → Generate Signed Bundle / APK...
Choose Android App Bundle (not APK).
Select the existing release keystore, or create a new one, and enter the keystore/key passwords.
Pick the release build variant (and a flavor, e.g. proRelease, if using the flavors from the earlier lesson).
Android Studio builds app-release.aab under app/release/.

// Command-line equivalent, from the project root
./gradlew bundleRelease
// Output: app/build/outputs/bundle/release/app-release.aab

Explanation: bundleRelease runs the full release pipeline first covered back in Gradle Basics — compiling, running R8 shrinking (since minifyEnabled true is set on the release build type), and finally signing — producing one .aab instead of an APK.

Play App Signing (Google-Managed Keys)

Since 2021, new apps on Google Play are required to use Play App Signing. Instead of the developer's own keystore being the one Play distributes to users, Google holds and protects the real signing key on its own infrastructure, and the developer only ever uploads bundles signed with a separate key.

You

Sign RecipeBox's .aab with your upload key

→

Google Play

Verifies upload key, re-signs with the app signing key

→

Users

Download an APK signed by Google's managed key

Upload Key vs App Signing Key

Key	Held by	Purpose
Upload key	You (the developer)	Proves to Google Play that a new bundle upload is legitimately from you
App signing key	Google (managed)	The key that actually signs the APK end users install and receive updates from

Why this matters: if an upload key is ever lost or compromised, Google provides a process to reset it, because Google — not the developer — holds the real app signing key. Under the old model, losing the one-and-only signing key meant permanently losing the ability to publish updates to an existing app listing.

With a signed bundle in hand, the next question is usually "how big is this thing, and can it be smaller?" — the focus of App Size Optimization.

« Prev Next »