title: Why is the release build variant always debuggable?
body: <p>Whether I create the "release" APK by:</p>
  
  <ul>
  <li>Using Generate Signed APK in Android Studio</li>
  <li>Select the Release build variant and use Tools -> Build APK</li>
  <li>Run the assembleRelease task</li>
  </ul>
  
  <p>... the APK produced always has debuggable=true which I've confirmed by trying to upload them to Google Play, which says:</p>
  
  <p>"Upload failed. You uploaded a debuggable APK. For security reasons you need to disable debugging before it can be published in Google Play."</p>
  
  <p>The (only) manifest has no debuggable attribute specified. Gradle specifies debuggable=false for release, and true for debug, see below.</p>
  
  <p>What am I missing? Where is the debuggable state coming from, and why is the debuggable=false in the release build type declaration being ignored? I do not want to add debuggable=false to the manifest and to have to keep manually enabling/disabling it.</p>
  
  <p>app/build.gradle:</p>
  
  <pre><code>apply plugin: 'com.android.application'
  
  android {
      compileSdkVersion 26
      buildToolsVersion '26.0.0'
      defaultConfig {
          applicationId "com.myapp.android"
          minSdkVersion 14
          targetSdkVersion 26
          versionCode 5
          versionName 5
          testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
      }
  
      signingConfigs {
          release {
              storeFile rootProject.file("keystore.jks")
              if (storeFile.exists()) {
                  def config = new Properties()
                  config.load(new FileInputStream(rootProject.file("keystore.passwords")))
                  storePassword config.KeystorePassword
                  keyAlias config.KeyAlias
                  keyPassword config.KeyPassword
              }
          }
      }
  
      buildTypes {
          release {
              debuggable false
              minifyEnabled false
              proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
              signingConfig signingConfigs.release
          }
          debug {
              debuggable true
              applicationIdSuffix ".debug"
          }
      }
  
      dataBinding {
          enabled = true
      }
  
      lintOptions {
          disable 'RtlHardcoded'
      }
  
      compileOptions {
          sourceCompatibility JavaVersion.VERSION_1_8
          targetCompatibility JavaVersion.VERSION_1_8
      }
  
      // Copy release APK to project root
      task copyReleaseApk(type: Copy) {
          from 'build/outputs/apk'
          into '..'
          include '**/*release.apk'
      }
  
      afterEvaluate {
          if (tasks.findByPath("packageRelease") == null) {tasks.create("packageRelease")}
          tasks.findByPath("packageRelease").finalizedBy(copyReleaseApk)
      }
  
  }
  
  ext {
      // Single place to specify the support library version
      supportLibraryVersion = '26.0.0-beta2'
  }
  
  dependencies {
      implementation fileTree(dir: 'libs', include: ['*.jar'])
      androidTestImplementation('com.android.support.test.espresso:espresso-core:2.2.2', {
          exclude group: 'com.android.support', module: 'support-annotations'
          exclude group: 'com.google.code.findbugs'
          exclude module: 'espresso-idling-resource'
          exclude group: "javax.inject"
      })
      implementation 'com.android.support.test.espresso:espresso-contrib:2.2.2'
  
      // Dagger dependency injection
      implementation 'com.google.dagger:dagger:2.10'
      annotationProcessor 'com.google.dagger:dagger-compiler:2.10'
      implementation 'com.google.dagger:dagger-android:2.10'
      implementation 'com.google.dagger:dagger-android-support:2.10'
      annotationProcessor 'com.google.dagger:dagger-android-processor:2.10'
  
      implementation "com.android.support:appcompat-v7:$supportLibraryVersion"
      implementation "com.android.support:design:$supportLibraryVersion"
      implementation "com.android.support.constraint:constraint-layout:1.0.2"
  
      implementation "com.jakewharton.timber:timber:4.5.1"
      implementation "com.squareup.phrase:phrase:1.1.0"
      implementation "com.squareup.retrofit2:retrofit:2.2.0"
      implementation "com.squareup.retrofit2:converter-gson:2.2.0"
      implementation "com.squareup.okhttp3:logging-interceptor:3.7.0"
      implementation 'net.danlew:android.joda:2.9.9'
  
      testImplementation 'junit:junit:4.12'
      implementation 'com.google.firebase:firebase-crash:11.0.0'
      androidTestImplementation 'junit:junit:4.12'
  }
  
  apply plugin: 'com.google.gms.google-services'
  </code></pre>
  
  <p>Update 1: I tried adding debuggable=false to the manifest and it makes no difference, the APK produced still cannot be uploaded to Google Play.</p>
  
  <p>Update 2: I loaded the APKs back into Android Studio using the APK Analyzer that makes it easy to see the manifest, and they all include.... debuggable=true. Where is it coming from?</p>
  
  <p>Update 3: assembleRelease produces a debuggable APK on both my local machine AND on the CI server (BuddyBuild).</p>
  
  <p>Update 4: A clean rebuild (including deleting the build folders) and restarting Android Studio with its caches cleared makes no difference.</p>
  
  <p>Update 5: It seems reasonable to assume that the debuggable=true state could be coming from one of the dependencies, but if that is the case which, and how can that be overridden?</p>