Why Our Android Build Was Signed with the Wrong Key (A Regex Cautionary Tale)

This article was originally published on Jo4 Blog.

"Your Android App Bundle is not signed with the correct key."

That was the Google Play Console rejection after what should have been a routine release. The SHA1 fingerprint on the uploaded AAB didn't match the expected upload key. We'd been deploying to the Play Store for weeks with no issues. What changed?

Nothing, as it turned out. The signing had been broken the whole time -- we just hadn't noticed until Google tightened its fingerprint check.

The Setup

Why Our Android Build Was Signed with the Wrong Key (A Regex Cautionary Tale)

Related reading

From Manual APKs to Automated Play Store Releases: Every Mistake We Made…

Stop Comparing the APK File Hash to the Signing Certificate

Why adi-registration.properties Fails After a Correct Copy-Paste

The Advisory Said It Was Fixed. I Didn't Believe It Until I Broke It Myself.

I Was Manually Managing iOS Certificates — Then I Found Fastlane Match

What I Learned Reading Unity's BuildReport After Building 16 APKs