{"record":{"id":"2fd055eb0fc5e1c7","repo":"shwenzhang/AndResGuard","slug":"no-key-passwords","errorCode":null,"errorMessage":"No key passwords","messagePattern":"No key passwords","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":565,"sourceCode":"      if (lastFailure == null) {\n        throw new RuntimeException(\"No keystore passwords\");\n      } else {\n        throw lastFailure;\n      }\n    }\n\n    private static Key getKeyStoreKey(KeyStore ks, String keyAlias, List<char[]> passwords)\n        throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {\n      UnrecoverableKeyException lastFailure = null;\n      for (char[] password : passwords) {\n        try {\n          return ks.getKey(keyAlias, password);\n        } catch (UnrecoverableKeyException e) {\n          lastFailure = e;\n        }\n      }\n      if (lastFailure == null) {\n        throw new RuntimeException(\"No key passwords\");\n      } else {\n        throw lastFailure;\n      }\n    }\n\n    private static PKCS8EncodedKeySpec decryptPkcs8EncodedKey(\n        EncryptedPrivateKeyInfo encryptedPrivateKeyInfo, List<char[]> passwords)\n        throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException {\n      SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(encryptedPrivateKeyInfo.getAlgName());\n      InvalidKeySpecException lastKeySpecException = null;\n      InvalidKeyException lastKeyException = null;\n      for (char[] password : passwords) {\n        PBEKeySpec decryptionKeySpec = new PBEKeySpec(password);\n        try {\n          SecretKey decryptionKey = keyFactory.generateSecret(decryptionKeySpec);\n          return encryptedPrivateKeyInfo.getKeySpec(decryptionKey);\n        } catch (InvalidKeySpecException e) {\n          lastKeySpecException = e;","sourceCodeStart":547,"sourceCodeEnd":583,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L547-L583","documentation":"getKeyStoreKey retrieves the private key for an alias, trying each candidate key password. If the password list is empty, lastFailure remains null and a RuntimeException \"No key passwords\" is thrown. It means no key password candidates were supplied at all, as opposed to all candidates being wrong (which would rethrow the UnrecoverableKeyException).","triggerScenarios":"Signing with a keystore-based signer where the key password spec (--key-pass) is omitted or expands to an empty list, causing loadPrivateKeyAndCertsFromKeyStore to call getKeyStoreKey with zero passwords.","commonSituations":"Omitting --key-pass when the key password differs from the keystore password; assuming key password defaults are applied; passing an empty value via an env var or password file.","solutions":["Supply the key password with --key-pass pass:<password> when invoking sign.","If the key password equals the keystore password, provide the same spec for --key-pass (many keystore types still require it).","Check the password spec source (env var, file) is non-empty and correctly formatted.","If using the API directly, pass a non-empty passwords list to getKeyStoreKey."],"exampleFix":"// before\napksigner sign --ks release.jks --ks-pass pass:storePw --out app.apk app.apk.idsig\n// after\napksigner sign --ks release.jks --ks-pass pass:storePw --key-pass pass:keyPw --out app.apk app.apk.idsig","handlingStrategy":"validation","validationCode":"java\nif (keyPassword == null || keyPassword.length == 0) {\n    throw new IllegalArgumentException(\"Key password must be provided (--key-pass)\");\n}","typeGuard":null,"tryCatchPattern":"java\ntry {\n    signerBuilder.build().sign(outputFile);\n} catch (RuntimeException e) {\n    if (\"No key passwords\".equals(e.getMessage())) {\n        System.err.println(\"Supply --key-pass pass:<password> for the keystore key.\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Provide --key-pass explicitly whenever signing from a keystore, even if it matches --ks-pass.","Check that env/file password sources are non-empty before running the build.","Document required password flags in your build scripts to prevent omission."],"tags":["java","keystore","missing-password","cli","signing"],"backgroundTag":"missing-credentials","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}