Update android app with apk package from external source

Question

We are developing an Android app and I made an apk available through a web site for our pilot users. The users have Install from unknown sources setting enabled. The app installed and worked fine.

Now I uploaded a newer version of the app. We have changed the version number on the apk package and the new version requires more permissions from the phone, like Prevent phone from sleeping when the first version only needed Full network access.

When I download and open the new version it says "Do you want to install an update to this existing application... Then updated application will get access to:" and then lists the added permissions under a New tab and all permissions under All.

So the installation identifies that this is an update and what has changed in terms of additional permissions.

When I go forward with the installation the installation stops with the message "An existing package by the same name with a conflicting signature is already installed".

What do I have to do/change to be able to upgrade the existing app?

Answer 1

All android apks are signed with a key. Even debug builds. FOr debug builds your IDE will automatically generate a key for you. You cannot update a package that was signed with one key for a package signed by another key. They must use the same key. If you're handing out debug builds not made on the same machine, its likely two keys were used.

The only way to fix this now is to have them uninstall and reinstall. Then make some internal policies about what key to use. To prevent that at my work we all use the same debug key (we have a separate release key so we don't accidently upload a debug build).

Answer 2

The old application had a signing signature A, but the new application got a signing signature B.

Typically, perhaps you create your applications by using the debug keystore. If it is the case, it's not a good thing to do. But as it is a "unknown source", it's not very important.

Secondly, you probably create the new version on another computer than the old, that means a different debug keystore is used.

A keystore is used to check is the producer has not changed between two updates of an application. This is a secure protection.

In your specific case, I suggest you to get the debug keystore that was used for the old version, and use the same when you compile the new version.

The debug keystore is in .android directory in the User directory of your computer (perhaps a hidden folder).

Beware that a specific debug keystore is only usable for 365 days, starting when the keystore is created.

If you want to avoid this problem, please use a release signing key. https://developer.android.com/studio/publish/app-signing.html