{"record":{"id":"61a59712581bee87","repo":"apache/hadoop","slug":"can-t-store-key-versionname-in-this","errorCode":null,"errorMessage":"Can't store key ${versionName} in ${this}","messagePattern":"Can't store key (.+?) in (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":501,"sourceCode":"          keyStore.deleteEntry(name);\n        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Problem removing \" + name + \" from \" + this, e);\n      }\n      cache.remove(name);\n      changed = true;\n    } finally {\n      writeLock.unlock();\n    }\n  }\n\n  KeyVersion innerSetKeyVersion(String name, String versionName, byte[] material,\n                                String cipher) throws IOException {\n    try {\n      keyStore.setKeyEntry(versionName, new SecretKeySpec(material, cipher),\n          password, null);\n    } catch (KeyStoreException e) {\n      throw new IOException(\"Can't store key \" + versionName + \" in \" + this,\n          e);\n    }\n    changed = true;\n    return new KeyVersion(name, versionName, material);\n  }\n\n  @Override\n  public KeyVersion rollNewVersion(String name,\n                                    byte[] material) throws IOException {\n    writeLock.lock();\n    try {\n      Metadata meta = getMetadata(name);\n      if (meta == null) {\n        throw new IOException(\"Key \" + name + \" not found\");\n      }\n      if (meta.getBitLength() != 8 * material.length) {\n        throw new IOException(\"Wrong key length. Required \" +\n            meta.getBitLength() + \", but got \" + (8 * material.length));","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L483-L519","documentation":"innerSetKeyVersion is the single path through which createKey and rollNewVersion write a SecretKeySpec into the JCEKS keystore via KeyStore.setKeyEntry; the wrapped KeyStoreException 'Can't store key <name>@N in <uri>' means the keystore refused the entry itself.","triggerScenarios":"Keystore never properly initialized/loaded (constructed against an unreadable or malformed file); a cipher value in Options that the keystore provider cannot map to a secret-key algorithm (e.g. a transformation string 'AES/CBC/PKCS5Padding' instead of bare 'AES'); a null password where the store requires one; an alias with characters the store rejects.","commonSituations":"Missing keystore password (HADOOP_CREDSTORE_PASSWORD or password file not set); passing a cipher transformation instead of an algorithm name; keystores produced by a different provider version.","solutions":["Verify the keystore password is available (HADOOP_CREDSTORE_PASSWORD env or configured password file) and the store loads","Use a bare algorithm name for the cipher ('AES'), not a transformation ('AES/CBC/PKCS5Padding')","Check the key name/alias for characters the keystore rejects; stick to alphanumeric, '-' and '_'","If the store is corrupt, recreate it and re-add the keys"],"exampleFix":"// before\nOptions opts = new Options(conf).setCipher(\"AES/CBC/PKCS5Padding\").setBitLength(128);\n\n// after\nOptions opts = new Options(conf).setCipher(\"AES\").setBitLength(128);","handlingStrategy":"try-catch","validationCode":"if (options.getCipher() != null && options.getCipher().contains(\"/\")) {\n  throw new IllegalArgumentException(\"cipher must be a bare algorithm, e.g. AES\");\n}","typeGuard":null,"tryCatchPattern":"try { provider.createKey(name, material, options); } catch (IOException e) { if (String.valueOf(e.getMessage()).startsWith(\"Can't store key\")) { // check keystore password availability and cipher name, fix, then retry } else { throw e; } }","preventionTips":["Use bare algorithm names for cipher (\"AES\")","Ensure HADOOP_CREDSTORE_PASSWORD or password file is set","Test keystore writability with a canary key at deploy time"],"tags":["java","hadoop","keystore","key-provider","jceks"],"backgroundTag":"keystore-operation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}