MuntashirAkon/AppManager · error · BackupException

Could not verify KeyStore files.\nFile: " + file.getName() +

Error message

Could not verify KeyStore files.\nFile: " + file.getName() + "\nFound: " + checksum + "\nRequired: " + mChecksum.get(file.getName())

What it means

A KeyStore backup file (backed-up credential/key store included when mBackupMetadata.keyStore is true) fails checksum verification: its computed digest differs from the digest in the checksum file. Since KeyStore material is security-sensitive, App Manager refuses to proceed when it doesn't match.

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/backup/VerifyOp.java:167

                throw new BackupException("Could not verify APK files." +
                        "\nFile: " + file.getName() +
                        "\nFound: " + checksum +
                        "\nRequired: " + mChecksum.get(file.getName()));
            }
        }
    }

    private void verifyKeyStore() throws BackupException {
        Path[] keyStoreFiles = mBackupItem.getKeyStoreFiles();
        if (keyStoreFiles.length == 0) {
            // Not having KeyStore backups is fine.
            return;
        }
        String checksum;
        for (Path file : keyStoreFiles) {
            checksum = DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, file);
            if (!checksum.equals(mChecksum.get(file.getName()))) {
                throw new BackupException("Could not verify KeyStore files." +
                        "\nFile: " + file.getName() +
                        "\nFound: " + checksum +
                        "\nRequired: " + mChecksum.get(file.getName()));
            }
        }
    }

    private void verifyData() throws BackupException {
        Path[] dataFiles;
        String checksum;
        for (int i = 0; i < mBackupMetadata.dataDirs.length; ++i) {
            dataFiles = mBackupItem.getDataFiles(i);
            if (dataFiles.length == 0) {
                throw new BackupException("No data files at index " + i + ".");
            }
            for (Path file : dataFiles) {
                checksum = DigestUtils.getHexDigest(mBackupInfo.checksumAlgo, file);
                if (!checksum.equals(mChecksum.get(file.getName()))) {

View on GitHub (pinned to 0152f468fc)

Solutions

Re-copy the KeyStore backup file from the original backup; do not attempt to patch it manually.
Recreate the backup including KeyStore data so files and checksums are regenerated together.
If KeyStore backup is not needed, recreate the backup with the KeyStore option disabled.
Check that the checksum file is from the same backup run as the key store file.

Example fix

// before
//   Could not verify KeyStore files. File: keystore.tar.gz Found: ... Required: ...
// after: restore original keystore backup file or re-run backup with KeyStore enabled

Defensive patterns

Strategy: validation

Validate before calling

// Pre-check KeyStore files when metadata.keyStore is true
if (metadata.keyStore) {
    for (Path ks : backupItem.getKeyStoreFiles()) {
        if (!DigestUtils.getHexDigest(backupInfo.checksumAlgo, ks).equals(checksums.get(ks.getName()))) {
            throw new IllegalStateException("KeyStore backup corrupt: " + ks.getName());
        }
    }
}

Try / catch

try {
    verifyOp.verify();
} catch (BackupException e) {
    if (e.getMessage().startsWith("Could not verify KeyStore files")) {
        // treat as security-relevant: restore from original backup, never patch manually
    }
}

Prevention

Copy KeyStore backup files only via byte-exact methods; never open/resave them.
Recreate the backup instead of merging key store files from different runs.
Disable the KeyStore backup option if the credential data is not needed for restore.
Verify on the source device before wiping or transferring.

When it happens

Trigger: verify() -> verifyKeyStore(), called only when mBackupFlags.backupData() and mBackupMetadata.keyStore are set; any file from mBackupItem.getKeyStoreFiles() whose DigestUtils digest != mChecksum.get(file.getName()); zero KeyStore files is OK (returns early) — only an existing-but-mismatching file throws.

Common situations: KeyStore backup file modified or truncated while moving the backup between devices/storage; merging backups mixed files from different runs; key store bytes differ across devices making hand-copied backup sets inconsistent; checksum file missing the key store entry (null required).

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/31ae8d10dbf083b8. Report an issue: GitHub.