Android Signing

Android production builds must be signed with your upload keystore. Venelx keeps this simple: upload the keystore once, and every production build is signed automatically. Configure it in the dashboard under your project → Signing → Android.

Keystore upload

Upload your .jks / .keystore file along with:

• the key alias
• the keystore (store) password
• the key password

The keystore and passwords are stored encrypted (vault protected by the platform's master secret) and decrypted only on the worker at build time.

Production-only gating

The keystore is required only for android-production builds. Preview builds (android-preview) sign with a debug keystore automatically, so you can run internal builds before anything is configured — and a missing keystore never blocks preview work.

When the keystore is missing or incomplete, production builds are refused up front (signing_not_ready) rather than failing deep in the pipeline. The MCP signing_status tool reports Android readiness.

credentials.json — local mode for eas-cli

Workers run eas build --local, which reads signing config from a credentials.json file next to the project instead of EAS servers. For each production build Venelx generates credentials.json on the worker, pointing at the decrypted keystore with its alias and passwords:

{
  "android": {
    "keystore": {
      "keystorePath": "<decrypted-on-worker>.jks",
      "keystorePassword": "…",
      "keyAlias": "…",
      "keyPassword": "…"
    }
  }
}

This keeps eas build --local fully non-interactive — no EAS login or cloud credential sync needed for signing. You never maintain this file yourself; it's written per build into the worker workspace. (An EXPO_TOKEN on the worker may still be needed for other EAS-managed steps such as npm/registry access.)

Play Store submit — service account

Submitting to Google Play (fastlane/supply-style upload) uses a Play service account JSON key, separate from the upload keystore:

1. In Google Play Console → Setup → API access, link a Google Cloud project and create a service account with release permissions.
2. Download the JSON key.
3. Add it to the project (dashboard → project settings/signing), or set ANDROID_SERVICE_ACCOUNT_KEY (path to the JSON) on the worker.

The service account is only used for submit/automation calls to the Play Developer API — day-to-day signing always uses the keystore above.