App requirements

Every build you publish must meet these requirements. Most are checked automatically on upload and surfaced as findings.

Production signing (required)

Your APK must be signed with a production signing certificate. Debug-signed or unsigned builds are rejected at upload. The platform verifies the signature and records the signing certificate’s SHA-1 fingerprint; a build’s signing certificate is expected to remain stable across versions of the same app.

R8 / ProGuard

Release builds should be minified and optimized with R8 (or ProGuard).

• Enable minification for the release build type.
• Avoid blanket -keep rules. Keep only what reflection or serialization genuinely needs; broad keep rules defeat optimization and bloat the APK.

buildTypes {
    release {
        isMinifyEnabled = true
        proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
    }
}

Permissions and policies

• Declare only the permissions your app uses (see Building for AAOS).
• Dangerous permissions are reviewed more closely; be ready to justify them.
• Disallowed or high-risk permissions are flagged by policy checks during validation.

Size limits

Keep your APK within the platform size limit. Oversized builds are flagged. Use R8, vector assets, and density-split resources to stay lean.

Version-code increment (required)

Each new version of an app must have a strictly higher versionCode than every previous version of that app. Re-uploading the same or a lower versionCode is rejected. Bump versionCode on every release:

defaultConfig {
    versionCode = 2          // must be greater than the previously uploaded version
    versionName = "1.1.0"
}