Development and Testing
Development App Signing Certificates
It is possible to add an individual app signing certificate as being used for development, simply by using the -dev option when adding the certificate. If this property is added for a particular certificate then this means that any app that is signed with it will be considered an app under development. This means that it will receive a valid attestation even if the app is being debugged or running on an Android emulator. Moreover, any failures will not be included in the monthly summaries of failures and are shown with a dev prefix in the live attestation metrics.
Typically the signing keys associated with development are those in a keystore on a development machine. Be aware that there is a default limit of 10 app signing certificates per account, so you might want to share development signing credentials across multiple developers to stay within this limit. Please contact Approov support if you need this limit increased. See Enabled Features and Limits for how to view the limit configured in your account.
If you have previously added the same certificate and then want to make it for development, then you will need to add it again with the -dev option. You will receive an error if it is already added, and you must use approov appsigncert -remove to remove it briefly before adding it again.
App Signing Certificate Labels
It is possible to add a label associated with the certificate, simply by using the -label option with a suitable name when adding the certificate. This label is then shown when showing the app signing certificates. This facility can be used to note the reason why the certificate was added if that is not obvious from its other metadata information.
If you have previously added the same certificate and then want to add or change its label, then you will need to add it again with the -label option. You will receive an error if it is already added, and you must use approov appsigncert -remove to remove it briefly before adding it again.
Using a Development Key
Some testing environments might need to resign mobile apps so that they can be run in their testing environment. A popular example of this is Appium Browserstack testing. In this case the attestation will fail because the app signing certificate will not be recognized, and there may be no way of obtaining the certificate from the testing environment. Since the device IDs of the testing devices is not known, there is also no way to force a pass on a particular testing device. Moreover, the global security policy cannot be changed to always-pass as that would affect other production devices.
To deal with this issue an optional development key facility is provided. This is a short base64url encoded string that can be embedded in a development app and set via the specific setDevKey method available in the SDK and quickstarts after initialization. If the correct value is provided then the app build will always pass attestation, even when being debugged. Application of the development key can itself be based on some build or runtime feature flag.
To retrieve the current development key, or create a new one if it doesn't exist, use the following command:
approov forcepass -getDevKey
The short development key value will then be output, something like:
uDW9FuLVpL1_4zo1
This string can then be used as the parameter for the setDevKey call.
The development key should never be included in any builds that are publicly available, and should certainly never be included in any released apps, even if the code path to use the value is not enabled. This is because an attacker could potentially reverse engineer the value of the development key and use this to bypass Approov protections.
If there is any concern that the development key for the account has been leaked, then it is easy to rotate it to a new value. The only impact will be that prior app builds using the old development key will no longer be forced to pass. Use the following command:
approov forcepass -changeDevKey
This will output the following. Note that an admin role and confirmation is required.
WARNING: changing the development key will have an immediate impact on your apps in production
ATTENTION: If you wish to continue then please type YES and return: YES
successfully changed the development key - any apps using the old one will no longer be forced pass
The new development key value can be obtained with approov forcepass -getDevKey.