Um, yeah -- and don't forget to apply the same degree of care to the keystore and alias passwords!
I caused myself a bit of panic the other day, when I changed the passwords prior to automating my builds -- and forgotten I'd done so. Fortunately (sort of), I don't have any apps in the store yet, so I didn't break out into a cold sweat, but visions of utter disaster did tiptoe through my mind.... What I usually do with signing keys is to check the keystore into Subversion (which I now host on an Amazon EC2 instance, and snapshot on Amazon as well as locally). I use strong passwords, which I keep under my control, separately from the keystore -- so if someone gets their hands on my code, they can't fake the signature. I make sure there's redundancy there, too -- my memory, an encrypted password database, and offsite secure storage. This is NOT the ideal security setup. A financial app, for example, should have very tight controls on the keystore as well as the passwords, and bring them together only for the release build. But I find it a reasonable medium-security compromise. The final thing to consider is succession. What if something happens to you? I've been in a situation where the person who set up the Certificate Authority for a company left -- and that CA setup lived on a virtual machine. The physical machine that the virtual machine was on, got recycled. No one person had all the knowledge to avoid disaster, though we were able to pull back from the brink somehow. When I left, an important item of business was to make sure people knew about each encryption key and password and where they came from. So now I've got to make sure my business partner can pass on the passwords, and the knowledge of what to do with them. I may lower my security standards further and check the passwords into Subversion, though the idea makes me cringe. Whatever you do -- don't put all your encryption eggs in one basket -- and keep your eye on those baskets! On Feb 23, 5:01 pm, Mark Murphy <[email protected]> wrote: To others reading this thread: if you have apps on the Market that you > care about, BACK UP YOUR PRODUCTION SIGNING KEY! -- You received this message because you are subscribed to the Google Groups "Android Developers" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/android-developers?hl=en
