Purpose of Android app signing and keystore contents

WHAT THIS TESTS: This question checks whether you understand the Android platform trust model beyond surface-level build steps. Interviewers want to see that you know signing is not just an upload requirement but a security primitive that underpins app identity, update integrity, and permission granting.

A GOOD ANSWER COVERS four things in order. First, identity: the digital certificate attached to the APK identifies the author to the Android system. Second, integrity: signing guarantees the APK has not been modified since the author built it because any tampering would invalidate the signature. Third, update policy: Android enforces that an updated APK must be signed with the same private key as the existing installation, preventing malicious downgrades or hijacks. Fourth, keystore contents: a keystore file is a password-protected binary container that holds one or more private keys and their matching public-key certificates; it does not contain the app code itself. You should also mention that Google Play now offers Google-managed signing keys while the upload key lives in your local keystore.

COMMON WRONG ANSWERS include several red flags. One is confusing signing with obfuscation or encryption, claiming it protects source code; signing does not hide code, it only asserts identity. Another is saying the keystore stores the APK, passwords in plain text, or Google Play credentials. A third is omitting the same-key update requirement, which is the primary reason losing your keystore is catastrophic. Finally, some candidates mention debug versus release keystores but fail to explain why the release keystore must be guarded.

LIKELY FOLLOW-UPS: The interviewer may ask what happens if you lose your keystore, how Google Play App Signing changes the trust chain, or the difference between a debug and release certificate. They might also probe whether two different apps can share a signing key and why you would or would not do that.

ONE CONCRETE EXAMPLE: Suppose you publish version 1 of an app signed with your release key. An attacker repackages the APK with malware and tries to install it as an update. Android rejects the install because the signature does not match the original certificate hash stored in the system. Only an APK signed with the identical private key from your keystore will be accepted as version 2, preserving user trust.

Source: developer.android.com