Add Android release signing config for Play Store

Release builds were signed with the debug key, which Play rejects. Load
an upload keystore from android/key.properties (gitignored) and use it
for the release signing config, falling back to the debug key when the
file is absent so `flutter run --release` still works without a keystore.

Add key.properties.example documenting the keytool setup and a
build_android_release.sh helper that builds the signed AAB and refuses
to run when key.properties is missing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/android/app/build.gradle.kts

@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("kotlin-android")
@@ -5,6 +7,15 @@ plugins {
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+// Load the upload keystore credentials from key.properties (gitignored, never
+// committed). Absent on machines without the keystore (e.g. CI or a fresh
+// clone), in which case release builds fall back to the debug signing key.
+val keystoreProperties = Properties()
+val keystorePropertiesFile = rootProject.file("key.properties")
+if (keystorePropertiesFile.exists()) {
+    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
+}
+
 android {
     namespace = "net.oottsecurity.app"
     compileSdk = flutter.compileSdkVersion
@@ -31,11 +42,30 @@ android {
         versionName = flutter.versionName
     }
 
+    signingConfigs {
+        // Only registered when key.properties is present; otherwise release
+        // builds fall back to the debug key below.
+        if (keystorePropertiesFile.exists()) {
+            create("release") {
+                keyAlias = keystoreProperties["keyAlias"] as String
+                keyPassword = keystoreProperties["keyPassword"] as String
+                storeFile = file(keystoreProperties["storeFile"] as String)
+                storePassword = keystoreProperties["storePassword"] as String
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
+            // Sign with the upload key for Play Store builds. When key.properties
-            // Signing with the debug keys for now, so `flutter run --release` works.
+            // is missing, fall back to the debug key so `flutter run --release`
-            signingConfig = signingConfigs.getByName("debug")
+            // still works locally.
+            signingConfig =
+                if (keystorePropertiesFile.exists()) {
+                    signingConfigs.getByName("release")
+                } else {
+                    signingConfigs.getByName("debug")
+                }
         }
     }
 }

frontend/android/key.properties.example

@@ -0,0 +1,14 @@
+# Template for android/key.properties (which is gitignored — NEVER commit the
+# real file or the keystore it points to).
+#
+# 1. Generate an upload keystore, storing it OUTSIDE the repo:
+#
+#      keytool -genkey -v -keystore ~/oott-upload-keystore.jks \
+#        -keyalg RSA -keysize 2048 -validity 10000 -alias upload
+#
+# 2. Copy this file to android/key.properties and fill in the values below.
+
+storePassword=<password chosen during keytool>
+keyPassword=<password chosen during keytool>
+keyAlias=upload
+storeFile=/absolute/path/to/oott-upload-keystore.jks

frontend/build_android_release.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Build the signed Android App Bundle (.aab) for the Google Play Store.
+#
+# Requires android/key.properties pointing at your upload keystore
+# (see android/key.properties.example). Without it the build falls back to the
+# debug signing key and Play will reject the upload.
+
+set -e
+
+if [ ! -f android/key.properties ]; then
+    echo "error: android/key.properties not found — release would be debug-signed." >&2
+    echo "       See android/key.properties.example to set up the upload keystore." >&2
+    exit 1
+fi
+
+flutter build appbundle --release
+
+echo
+echo "App bundle: build/app/outputs/bundle/release/app-release.aab"