{"record":{"id":"3631c0ec34b82205","repo":"shwenzhang/AndResGuard","slug":"keystore-provider-class-keystoreproviderclass-not-subclass","errorCode":null,"errorMessage":"Keystore Provider class <keystoreProviderClass> not subclass of java.security.Provider","messagePattern":"Keystore Provider class <keystoreProviderClass> not subclass of java\\.security\\.Provider","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":661,"sourceCode":"      }\n    }\n\n    private void loadPrivateKeyAndCertsFromKeyStore(PasswordRetriever passwordRetriever) throws Exception {\n      if (keystoreFile == null) {\n        throw new ParameterException(\"KeyStore (--ks) must be specified\");\n      }\n\n      // 1. Obtain a KeyStore implementation\n      String ksType = (keystoreType != null) ? keystoreType : KeyStore.getDefaultType();\n      KeyStore ks;\n      if (keystoreProviderName != null) {\n        // Use a named Provider (assumes the provider is already installed)\n        ks = KeyStore.getInstance(ksType, keystoreProviderName);\n      } else if (keystoreProviderClass != null) {\n        // Use a new Provider instance (does not require the provider to be installed)\n        Class<?> ksProviderClass = Class.forName(keystoreProviderClass);\n        if (!Provider.class.isAssignableFrom(ksProviderClass)) {\n          throw new ParameterException(\"Keystore Provider class \"\n                                       + keystoreProviderClass\n                                       + \" not subclass of \"\n                                       + Provider.class.getName());\n        }\n        Provider ksProvider;\n        if (keystoreProviderArg != null) {\n          // Single-arg Provider constructor\n          ksProvider = (Provider) ksProviderClass.getConstructor(String.class).newInstance(keystoreProviderArg);\n        } else {\n          // No-arg Provider constructor\n          ksProvider = (Provider) ksProviderClass.getConstructor().newInstance();\n        }\n        ks = KeyStore.getInstance(ksType, ksProvider);\n      } else {\n        // Use the highest-priority Provider which offers the requested KeyStore type\n        ks = KeyStore.getInstance(ksType);\n      }\n","sourceCodeStart":643,"sourceCodeEnd":679,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L643-L679","documentation":"When --ks-provider-class is given, ApkSignerTool loads the class reflectively and verifies it extends java.security.Provider. If the named class is not a Provider subclass it throws this ParameterException, since only a Provider can back KeyStore.getInstance(ksType, provider).","triggerScenarios":"Passing --ks-provider-class pointing to a class that exists but does not extend java.security.Provider (e.g. a JCE provider's factory/helper class, or a typo to a random class in the classpath).","commonSituations":"Using Bouncy Castle or a hardware-security provider and naming the wrong entry class; class loaded from an unrelated jar with the same package name; provider shipped in an old jar whose classes were repackaged.","solutions":["Pass the actual JCE Provider class, e.g. --ks-provider-class org.bouncycastle.jce.provider.BouncyCastleProvider.","Check the provider jar's documentation for the class that extends java.security.Provider.","If the provider is already installed in the JVM, drop --ks-provider-class and use --ks-provider-name instead.","Ensure the provider jar is on the classpath and Class.forName resolves the intended class."],"exampleFix":"// before\n--ks-provider-class org.bouncycastle.jce.BouncyCastle\n// after\n--ks-provider-class org.bouncycastle.jce.provider.BouncyCastleProvider","handlingStrategy":"validation","validationCode":"// Java pre-check\nClass<?> c = Class.forName(providerClassName);\nif (!java.security.Provider.class.isAssignableFrom(c)) {\n    throw new IllegalArgumentException(providerClassName + \" is not a java.security.Provider\");\n}","typeGuard":"boolean isJceProvider(String name) {\n  try { return java.security.Provider.class.isAssignableFrom(Class.forName(name)); }\n  catch (ClassNotFoundException e) { return false; }\n}","tryCatchPattern":null,"preventionTips":["Copy the provider class FQN from the provider jar's docs/services file, not from memory.","Test the sign command once locally with the same provider flags used in CI.","Prefer --ks-provider-name when the provider is already installed in the JVM."],"tags":["cli","apksigner","java-security","provider","class-loading"],"backgroundTag":"invalid-argument-value","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}