跪拜 Guibai
← All articles
Android · Android Studio · GitHub

Shipping Tauri Android APKs That Play Nice With the Play Store

By ssshooter ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Any team distributing a Tauri Android app outside Google Play—on their own site or GitHub Releases—will ship APKs that the Play Store refuses to update unless they adopt this Google-signed download step. It turns a recurring support headache into a one-time CI configuration.

Summary

Tauri Android builds hit a wall when the locally signed APK can't overwrite or update a Play Store install. The culprit is Play App Signing: developers hold only an Upload Key, while Google holds the App Signing Key that signs the final APK users receive. The fix is not to match signatures locally, but to let Google do the signing and then download the result.

The workflow uses a service account and the Google Play Android Developer API inside GitHub Actions. Tauri builds the AAB, the action uploads it as a draft, polls for the generated signed Universal APK, and attaches that APK to a GitHub Release or other distribution channel. The locally signed APK stays for development testing only.

This sidesteps the private-key problem entirely. Every APK users get from an official website or GitHub Release carries Google's signature, so the Play Store can update it without friction. The service account JSON lives exclusively in GitHub Secrets, keeping the pipeline secure.

Takeaways
Play App Signing means Google holds the App Signing Key; developers only get an Upload Key, so locally built APKs will never match the store signature.
The correct target is not a locally matching APK, but the Google-signed Universal APK downloadable via the Play Developer API after uploading an AAB.
A service account with the Google Play Android Developer API enabled and at least test-track release permissions is required for automation.
The GitHub Actions pipeline uploads the Tauri-built AAB as a draft, polls for the generated APK, downloads it, and attaches it to a GitHub Release.
Ready-made GitHub Actions (`r0adkll/upload-google-play`) and fastlane actions (`download_universal_apk_from_google_play`) can replace hand-rolled API calls.
The service account JSON key must be stored in GitHub Secrets and never committed to the repository.
For local development and testing, continue using the Upload Key-signed APK after uninstalling the store version.
Conclusions

The signature mismatch is not a Tauri bug but a structural consequence of Play App Signing, and many mobile CI guides gloss over the need to pull the Google-signed artifact back out for external distribution.

Treating the Play Console as a signing service—upload an unsigned or upload-key-signed bundle, download the Google-signed APK—turns a perceived limitation into a reliable distribution step that also future-proofs against Google's key upgrades.

The pipeline's security posture is unusually clean for a mobile CI setup: the only secret is a service account JSON, and the signing material that touches end users never leaves Google's infrastructure.

Concepts & terms
Play App Signing
Google's mechanism where developers upload an AAB signed with an Upload Key, and Google re-signs the final APK with an App Signing Key it manages. This means the APK users download from the Play Store carries a different signature than any APK built locally.
Universal APK
A single APK generated by Google from an uploaded Android App Bundle (AAB) that contains resources for all device configurations, signed with the App Signing Key. It is the artifact suitable for distribution outside the Play Store when using Play App Signing.
Google Play Android Developer API
The REST API that allows automated management of Play Console edits, bundle uploads, track promotions, and downloading of Google-signed generated APKs. It is the programmatic interface behind the CI pipeline described here.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗