React Native：如何在CircleCI中安全存储Android keystore文件及密码

问题背景 #

正在为React Native项目集成CircleCI，首个工作流是Android构建，过程需要keystore文件、别名及密码。已用openssl加密/解密keystore文件，密码存储在CircleCI环境变量中（本地使用react-native-config管理环境变量）。

build.gradle签名配置如下：

signingConfigs {
    debug {
        storeFile file('debug.keystore')
        storePassword 'android'
        keyAlias 'androiddebugkey'
        keyPassword 'android'
    }
     release {
        if (project.hasProperty('MYAPP_UPLOAD_STORE_FILE')) {
            storeFile file(MYAPP_UPLOAD_STORE_FILE)
            storePassword project.env.get('MYAPP_UPLOAD_STORE_PASSWORD')
            keyAlias project.env.get('MYAPP_UPLOAD_KEY_ALIAS')
            keyPassword project.env.get('MYAPP_UPLOAD_KEY_PASSWORD')
        }
    }
}

其中MYAPP_UPLOAD_STORE_FILE存储在gradle.properties中，其余参数存于环境变量。但CircleCI构建时报错：

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:packageRelease'.
> A failure occurred while executing com.android.build.gradle.tasks.PackageAndroidArtifact$IncrementalSplitterRunnable
   > SigningConfig "release" is missing required property "storePassword".

注：本地设备可正常生成Release APK，求其他实现该需求的方案。

可行解决方法 #

方法一：显式向Gradle传递CircleCI环境变量 #

CircleCI环境变量不会自动暴露给Gradle，需在构建步骤中手动传递：

1. 修改.circleci/config.yml的Android构建任务，添加参数传递：

jobs:
  android-build:
    steps:
      - run:
          name: Build Release APK
          command: |
            ./gradlew assembleRelease \
              -PMYAPP_UPLOAD_STORE_PASSWORD=$MYAPP_UPLOAD_STORE_PASSWORD \
              -PMYAPP_UPLOAD_KEY_ALIAS=$MYAPP_UPLOAD_KEY_ALIAS \
              -PMYAPP_UPLOAD_KEY_PASSWORD=$MYAPP_UPLOAD_KEY_PASSWORD

2. 调整build.gradle的release配置，直接读取Gradle属性：

release {
    if (project.hasProperty('MYAPP_UPLOAD_STORE_FILE')) {
        storeFile file(MYAPP_UPLOAD_STORE_FILE)
        storePassword project.property('MYAPP_UPLOAD_STORE_PASSWORD')
        keyAlias project.property('MYAPP_UPLOAD_KEY_ALIAS')
        keyPassword project.property('MYAPP_UPLOAD_KEY_PASSWORD')
    }
}

方法二：解密keystore后写入临时gradle.properties #

通过构建步骤生成包含敏感信息的临时配置，让Gradle自动读取：

1. 在CircleCI中创建上下文，存储keystore解密密码、签名密码等敏感信息。
2. 修改.circleci/config.yml的构建步骤：

steps:
  - run:
      name: Decrypt Keystore and Setup Properties
      command: |
        openssl enc -d -aes-256-cbc -in keystore.jks.enc -out app/keystore.jks -k $KEYSTORE_DECRYPT_PASSWORD
        echo "MYAPP_UPLOAD_STORE_FILE=keystore.jks" >> app/gradle.properties
        echo "MYAPP_UPLOAD_STORE_PASSWORD=$MYAPP_UPLOAD_STORE_PASSWORD" >> app/gradle.properties
        echo "MYAPP_UPLOAD_KEY_ALIAS=$MYAPP_UPLOAD_KEY_ALIAS" >> app/gradle.properties
        echo "MYAPP_UPLOAD_KEY_PASSWORD=$MYAPP_UPLOAD_KEY_PASSWORD" >> app/gradle.properties
  - run: ./gradlew assembleRelease

3. 简化build.gradle的release配置：

release {
    storeFile file(MYAPP_UPLOAD_STORE_FILE)
    storePassword MYAPP_UPLOAD_STORE_PASSWORD
    keyAlias MYAPP_UPLOAD_KEY_ALIAS
    keyPassword MYAPP_UPLOAD_KEY_PASSWORD
}

（本地开发时，可将这些属性放在本地gradle.properties中，并通过.gitignore忽略该文件）

方法三：使用Gradle插件自动映射环境变量 #

借助Gradle插件实现环境变量到Gradle属性的自动映射：

1. 在项目根目录的build.gradle中添加插件：

plugins {
    id 'net.saliman.properties' version '1.5.1'
}

2. 配置插件，让环境变量前缀匹配签名参数：

properties {
    systemPropertiesMode = 'OVERRIDE'
    environmentVariables {
        prefix = 'MYAPP_'
    }
}

3. 保持build.gradle原有的签名配置即可，CircleCI只需确保环境变量正确设置。

内容的提问来源于stack exchange，提问作者Hamza Hmem