keepassgo/APK.md

Android Build

Build the APK with:

make apk

Build the release-signed APK with:

make apk-release

make apk uses a supported local JDK when JAVA_HOME points to Java 21 or Java 25. If the host does not have one of those working JDKs, it falls back to the repo-managed Docker image in packaging/docker/android-apk/, which builds with Java 25.

make apk remains a developer build path and may use Gio's default debug or ephemeral signing behavior if no explicit signing key is provided. make apk-release is the production-signing path and fails unless a dedicated release keystore and password file are present.

Environment:

• ANDROID_SDK_ROOT defaults to /opt/android-sdk.
• ANDROID_NDK_ROOT defaults to /opt/android-ndk.
• JAVA_HOME defaults to /usr/lib/jvm/java-25-openjdk. Local builds support Java 25 and CI builds support Java 21.
• APK_BUILD_IMAGE overrides the Docker image name used by make apk-container.
• APP_ID overrides the Android application id.
• APP_VERSION overrides the version shown inside KeePassGO itself.
• APK_OUT overrides the output path.
• APK_VERSION overrides the packaged app version.
• ANDROID_MIN_SDK overrides the minimum supported Android SDK.
• ANDROID_TARGET_SDK overrides the target Android SDK.
• SIGNPASS_FILE provides the signing password by file instead of a command-line argument.
• RELEASE_SIGNKEY overrides the release keystore path used by make apk-release.
• RELEASE_SIGNPASS_FILE overrides the password file path used by make apk-release.

Default release-signing paths:

• ~/.config/keepassgo/android-release.keystore
• ~/.config/keepassgo/android-release.pass

Installed machine prerequisites expected by this repo:

• android-sdk-cmdline-tools-latest
• android-sdk-build-tools
• android-platform-35
• android-sdk-platform-tools
• a working Java 21 or Java 25 JDK install for make apk-local, or Docker for make apk

The repo tracks gogio as a Go tool, and the local build runs through:

go tool gogio -target android ./cmd/keepassgo ...

The release target wraps make apk and injects explicit signing credentials so local release builds and CI use the same stable key without echoing the release password in build logs.

The Android build uses the branded icon asset at:

• internal/assets/keepassgo-icon.png

Note:

• KeePassGO's documented Android build uses Java 25 locally, while CI uses Java 21.
• If neither supported host setup is available, make apk falls back to the Docker image so the build still runs under Java 25 instead of encoding a newer host JDK as a requirement.
• Android runtime testing on the KeepassGoAPI35 emulator showed a black-screen regression with gioui.org v0.9.0 while a stock Gio example and KeePassGO both rendered correctly with gioui.org v0.8.0 on the same emulator and SDK/JDK pipeline. KeePassGO is pinned to the working Gio line until that regression is understood upstream.