{"record":{"id":"5c942dfbe53608cc","repo":"shwenzhang/AndResGuard","slug":"keystorefile-entry-keyalias-does-not-contain-a-key","errorCode":null,"errorMessage":"<keystoreFile> entry \"<keyAlias>\" does not contain a key","messagePattern":"<keystoreFile> entry \"<keyAlias>\" does not contain a key","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":722,"sourceCode":"                if (keystoreKeyAlias != null) {\n                  throw new ParameterException(keystoreFile\n                                               + \" contains multiple key entries\"\n                                               + \". --ks-key-alias option must be used to specify\"\n                                               + \" which entry to use.\");\n                }\n                keystoreKeyAlias = keyAlias;\n              }\n            }\n          }\n          if (keystoreKeyAlias == null) {\n            throw new ParameterException(keystoreFile + \" does not contain key entries\");\n          }\n        }\n\n        // Private key entry alias known. Load that entry's private key.\n        keyAlias = keystoreKeyAlias;\n        if (!ks.isKeyEntry(keyAlias)) {\n          throw new ParameterException(keystoreFile + \" entry \\\"\" + keyAlias + \"\\\" does not contain a key\");\n        }\n\n        Key entryKey;\n        if (keyPasswordSpec != null) {\n          // Key password spec is explicitly specified. Use this spec to obtain the\n          // password and then load the key using that password.\n          List<char[]> keyPasswords = passwordRetriever.getPasswords(keyPasswordSpec,\n              \"Key \\\"\" + keyAlias + \"\\\" password for \" + name\n          );\n          entryKey = getKeyStoreKey(ks, keyAlias, keyPasswords);\n        } else {\n          // Key password spec is not specified. This means we should assume that key\n          // password is the same as the keystore password and that, if this assumption is\n          // wrong, we should prompt for key password and retry loading the key using that\n          // password.\n          try {\n            entryKey = getKeyStoreKey(ks, keyAlias, keystorePasswords);\n          } catch (UnrecoverableKeyException expected) {","sourceCodeStart":704,"sourceCodeEnd":740,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L704-L740","documentation":"The alias named via --ks-key-alias (or auto-selected) exists in the keystore but is not a key entry — isKeyEntry(alias) returned false — so it cannot yield a private key for signing. apksigner throws this ParameterException with the keystore file and alias in the message.","triggerScenarios":"Passing --ks-key-alias that points to a TrustedCertificateEntry or a secret-key entry instead of a PrivateKeyEntry; a typo producing an alias that resolves to a non-key entry; keystore with same-named cert-only entries.","commonSituations":"Developers copy an alias from a certificate listing (keytool -list shows cert entries too) rather than from the PrivateKeyEntry section; build config pins an alias that was later replaced by a cert-only entry;混淆 between the signing alias and a CA/trusted cert alias in the same store.","solutions":["Run keytool -list -v -keystore my.keystore and copy the alias exactly from a 'PrivateKeyEntry' line.","Correct the --ks-key-alias value to the private-key entry's alias.","If the key was lost, re-import it (keytool -importkeystore) under the expected alias.","In code, call KeyStore.isKeyEntry(alias) up front and fail with a clear message."],"exampleFix":"// before\n--ks-key-alias mycert   // TrustedCertificateEntry\n// after\n--ks-key-alias release  // PrivateKeyEntry per keytool -list -v","handlingStrategy":"validation","validationCode":"KeyStore ks = /* loaded keystore */;\nif (keyAlias != null && !ks.isKeyEntry(keyAlias))\n    throw new IllegalArgumentException(\"Alias '\" + keyAlias + \"' is not a key entry in the keystore; check keytool -list -v output for a PrivateKeyEntry alias.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy aliases only from PrivateKeyEntry lines of keytool -list -v","Keep keystore aliases stable; update build config after any keystore change","Distinguish cert aliases from key aliases when sharing configuration"],"tags":["keystore","apksigner","android-signing"],"backgroundTag":"resource-not-found","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}