Generating a signed release APK or AAB

WHAT THIS TESTS The interviewer wants the concrete release-signing flow and, critically, that you handle the signing key and credentials securely, since mishandling them is a real production risk.

A GOOD ANSWER COVERS First you generate a private signing key into a keystore using keytool, for example keytool -genkeypair into my-release-key.keystore with an alias and validity. You do not commit this keystore. You store the keystore credentials, the store password, key alias, and key password, outside version control, typically in the global ~/.gradle/gradle.properties or the project gradle.properties that is gitignored, or injected from CI secrets. In android/app/build.gradle you define a signingConfigs.release block that reads those properties (storeFile, storePassword, keyAlias, keyPassword) and reference it from buildTypes.release with signingConfig signingConfigs.release. Then you build: ./gradlew assembleRelease produces a signed APK, while ./gradlew bundleRelease produces an AAB, which Google Play requires for new apps. The output APK lands under app/build/outputs/apk/release and the AAB under app/build/outputs/bundle/release. You should back up the keystore securely (and consider Play App Signing) because losing it means you can no longer publish updates to the same app.

COMMON WRONG ANSWERS Committing the keystore or putting passwords directly in build.gradle leaks the signing identity into version control, a serious security failure. Forgetting that Play prefers AAB over APK shows a gap. Assuming you can regenerate a lost key and keep updating the app is wrong; the signature must match. Skipping the signingConfig and shipping a debug-signed build is not publishable to Play.

LIKELY FOLLOW-UPS What is Play App Signing? Google manages the app signing key while you keep an upload key, mitigating key loss. APK vs AAB? AAB lets Play generate optimized per-device APKs and is required for new apps. Where to keep secrets in CI? In the CI secret store, injected at build time.

ONE CONCRETE EXAMPLE You run keytool to create release.keystore, add MYAPP_RELEASE_STORE_PASSWORD and key fields to ~/.gradle/gradle.properties (gitignored), wire signingConfigs.release in app/build.gradle to read them, then run ./gradlew bundleRelease. The signed app-release.aab in build/outputs/bundle/release is uploaded to Play, and the keystore is backed up in a secrets manager.