{"record":{"id":"6a8c0af501b7a28c","repo":"shwenzhang/AndResGuard","slug":"keystorefile-does-not-contain-key-entries","errorCode":null,"errorMessage":"<keystoreFile> does not contain key entries","messagePattern":"<keystoreFile> does not contain key entries","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":715,"sourceCode":"          // KeyStore. If the KeyStore contains multiple key entries, return an error.\n          Enumeration<String> aliases = ks.aliases();\n          if (aliases != null) {\n            while (aliases.hasMoreElements()) {\n              String entryAlias = aliases.nextElement();\n              if (ks.isKeyEntry(entryAlias)) {\n                keyAlias = entryAlias;\n                if (keystoreKeyAlias != null) {\n                  throw new ParameterException(keystoreFile\n                                               + \" contains multiple key entries\"\n                                               + \". --ks-key-alias option must be used to specify\"\n                                               + \" which entry to use.\");\n                }\n                keystoreKeyAlias = keyAlias;\n              }\n            }\n          }\n          if (keystoreKeyAlias == null) {\n            throw new ParameterException(keystoreFile + \" does not contain key entries\");\n          }\n        }\n\n        // Private key entry alias known. Load that entry's private key.\n        keyAlias = keystoreKeyAlias;\n        if (!ks.isKeyEntry(keyAlias)) {\n          throw new ParameterException(keystoreFile + \" entry \\\"\" + keyAlias + \"\\\" does not contain a key\");\n        }\n\n        Key entryKey;\n        if (keyPasswordSpec != null) {\n          // Key password spec is explicitly specified. Use this spec to obtain the\n          // password and then load the key using that password.\n          List<char[]> keyPasswords = passwordRetriever.getPasswords(keyPasswordSpec,\n              \"Key \\\"\" + keyAlias + \"\\\" password for \" + name\n          );\n          entryKey = getKeyStoreKey(ks, keyAlias, keyPasswords);\n        } else {","sourceCodeStart":697,"sourceCodeEnd":733,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L697-L733","documentation":"After scanning every alias in the loaded KeyStore, no alias passed isKeyEntry(), meaning the keystore holds no private-key entries at all. apksigner cannot obtain a signing key, so it throws this ParameterException naming the keystore file.","triggerScenarios":"Calling loadPrivateKeyAndCerts (-> loadPrivateKeyAndCertsFromKeyStore) with a --ks file that is a trusted-certificate-only keystore, an empty keystore, or a keystore whose password was wrong such that entries were not visible (some keystore types return no aliases on a wrong password), or pointing --ks at a non-keystore/artifact file.","commonSituations":"Pointing --ks at a .cer/.pem certificate file or a truststore instead of the signing keystore; typo in keystore path causing an empty/other file to load; forgetting --ks-type so a PKCS12 file is read with the wrong type; keystore created with keytool -exportcert only (cert-only store).","solutions":["Verify with keytool -list -keystore my.keystore that it actually contains a PrivateKeyEntry; if not, locate the correct signing keystore.","Re-import the key into a new keystore, e.g. keytool -importkeystore -srckeystore old -destkeystore new, and use that file.","Check the --ks-pass/--ks-type options; a wrong password or type can make entries unreadable.","Ensure the file path given to --ks is the real keystore, not a certificate or build artifact."],"exampleFix":"// before (truststore has no private keys)\napksigner sign --ks truststore.jks ...\n// after\napksigner sign --ks release.keystore --ks-key-alias release ...","handlingStrategy":"validation","validationCode":"File f = new File(ksPath);\nif (!f.isFile() || f.length() == 0) throw new IllegalArgumentException(\"Keystore file missing/empty: \" + ksPath);\nKeyStore ks = KeyStore.getInstance(ksType != null ? ksType : KeyStore.getDefaultType());\ntry (FileInputStream in = new FileInputStream(f)) { ks.load(in, storePassword); }\nboolean hasKey = false;\nfor (java.util.Enumeration<String> e = ks.aliases(); e.hasMoreElements();)\n    if (ks.isKeyEntry(e.nextElement())) { hasKey = true; break; }\nif (!hasKey) throw new IllegalArgumentException(\"Keystore contains no key entries: \" + ksPath);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify with keytool -list that the store has a PrivateKeyEntry before wiring it into the build","Don't point --ks at a certificate/truststore file","Always supply --ks-pass; a wrong password can hide entries","Use the correct --ks-type for the file format"],"tags":["keystore","apksigner","android-signing"],"backgroundTag":"resource-not-found","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}