{"record":{"id":"0af4f8967e55fc53","repo":"shwenzhang/AndResGuard","slug":"keystore-ks-or-private-key-file-key-must-be-specified","errorCode":null,"errorMessage":"KeyStore (--ks) or private key file (--key) must be specified","messagePattern":"KeyStore \\(--ks\\) or private key file \\(--key\\) must be specified","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":642,"sourceCode":"             && (keyFile == null)\n             && (certFile == null)\n             && (v1SigFileBasename == null)\n             && (privateKey == null)\n             && (certs == null);\n    }\n\n    private void loadPrivateKeyAndCerts(PasswordRetriever passwordRetriever) throws Exception {\n      if (keystoreFile != null) {\n        if (keyFile != null) {\n          throw new ParameterException(\"--ks and --key may not be specified at the same time\");\n        } else if (certFile != null) {\n          throw new ParameterException(\"--ks and --cert may not be specified at the same time\");\n        }\n        loadPrivateKeyAndCertsFromKeyStore(passwordRetriever);\n      } else if (keyFile != null) {\n        loadPrivateKeyAndCertsFromFiles(passwordRetriever);\n      } else {\n        throw new ParameterException(\"KeyStore (--ks) or private key file (--key) must be specified\");\n      }\n    }\n\n    private void loadPrivateKeyAndCertsFromKeyStore(PasswordRetriever passwordRetriever) throws Exception {\n      if (keystoreFile == null) {\n        throw new ParameterException(\"KeyStore (--ks) must be specified\");\n      }\n\n      // 1. Obtain a KeyStore implementation\n      String ksType = (keystoreType != null) ? keystoreType : KeyStore.getDefaultType();\n      KeyStore ks;\n      if (keystoreProviderName != null) {\n        // Use a named Provider (assumes the provider is already installed)\n        ks = KeyStore.getInstance(ksType, keystoreProviderName);\n      } else if (keystoreProviderClass != null) {\n        // Use a new Provider instance (does not require the provider to be installed)\n        Class<?> ksProviderClass = Class.forName(keystoreProviderClass);\n        if (!Provider.class.isAssignableFrom(ksProviderClass)) {","sourceCodeStart":624,"sourceCodeEnd":660,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L624-L660","documentation":"If neither keystoreFile nor keyFile is set, loadPrivateKeyAndCerts has no credential source and throws this ParameterException. Signing requires credentials, so the tool fails fast at parameter validation rather than producing an unsigned or invalidly signed APK.","triggerScenarios":"Running apksigner sign without any of --ks, --key (and --cert); e.g. only --out and the APK are given.","commonSituations":"Forgetting the signing flags entirely; environment variable or property holding the keystore path is empty so the flag never gets populated; CI secret injection failed silently.","solutions":["Add --ks <keystore path> (with --ks-key-alias and password options) for KeyStore signing.","Or add --key <pk8/pem> --cert <x509.pem> for file-based signing.","Verify the variable/secret that should contain the keystore path is actually set and non-empty."],"exampleFix":"// before\napksigner sign --out app-signed.apk app.apk\n// after\napksigner sign --ks release.jks --ks-key-alias mykey --out app-signed.apk app.apk","handlingStrategy":"validation","validationCode":"// shell pre-check\nif [ -z \"$KS_ARG\" ] && [ -z \"$KEY_ARG\" ]; then\n  echo \"ERROR: signing credentials missing; set --ks or --key/--cert\" >&2; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail the pipeline early when the keystore path variable is empty.","Verify CI secrets (keystore path/passwords) are actually injected before the sign step."],"tags":["cli","apksigner","missing-argument"],"backgroundTag":"missing-required-argument","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}