Search code examples
androidapkenterprisesigningdevice-owner

Should I sign my Android APKs even though they are only used in an enterprise/private context?


I am building an app that is installed on multiple private enterprise android devices on which I am the device owner.

  • Should I bother signing my apps in this context, as they will only be side loaded, never posted on Google Play?

  • What could or would be the consequences of me not signing my app?

The main reason behind this question, is that I have a homemade Mobile Device Management app on these devices which installs updates of my application, and during installs it gets error from "Google Play Protect" because my application signature is unknown from Google. However If I do not sign my application, I do not get the error.


Solution

  • Should I bother signing my apps in this context, as they will only be side loaded, never posted on Google Play?

    Yes, as Android will not install unsigned APKs.

    What could or would be the consequences of me not signing my app?

    Your app will not be installable.

    However If I do not sign my application, I do not get the error.

    Your app is not being installed. Or, the app is signed, perhaps using the debug keystore.


    So, if your real question is "is it OK to sign my app with my debug keystore for private distribution", the answer is yes, so long as that keystore is being backed up. You can only replace an app with a newer version if it has the same application ID and was signed by the same signing key. If your keystore gets lost, then your apps can never be updated.