{"record":{"id":"755c54a94b008e38","repo":"shwenzhang/AndResGuard","slug":"ks-and-cert-may-not-be-specified-at-the-same-time","errorCode":null,"errorMessage":"--ks and --cert may not be specified at the same time","messagePattern":"--ks and --cert may not be specified at the same time","errorType":"validation","errorClass":"ParameterException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":636,"sourceCode":"             && (keystorePasswordSpec == null)\n             && (keyPasswordSpec == null)\n             && (keystoreType == null)\n             && (keystoreProviderName == null)\n             && (keystoreProviderClass == null)\n             && (keystoreProviderArg == null)\n             && (keyFile == null)\n             && (certFile == null)\n             && (v1SigFileBasename == null)\n             && (privateKey == null)\n             && (certs == null);\n    }\n\n    private void loadPrivateKeyAndCerts(PasswordRetriever passwordRetriever) throws Exception {\n      if (keystoreFile != null) {\n        if (keyFile != null) {\n          throw new ParameterException(\"--ks and --key may not be specified at the same time\");\n        } else if (certFile != null) {\n          throw new ParameterException(\"--ks and --cert may not be specified at the same time\");\n        }\n        loadPrivateKeyAndCertsFromKeyStore(passwordRetriever);\n      } else if (keyFile != null) {\n        loadPrivateKeyAndCertsFromFiles(passwordRetriever);\n      } else {\n        throw new ParameterException(\"KeyStore (--ks) or private key file (--key) must be specified\");\n      }\n    }\n\n    private void loadPrivateKeyAndCertsFromKeyStore(PasswordRetriever passwordRetriever) throws Exception {\n      if (keystoreFile == null) {\n        throw new ParameterException(\"KeyStore (--ks) must be specified\");\n      }\n\n      // 1. Obtain a KeyStore implementation\n      String ksType = (keystoreType != null) ? keystoreType : KeyStore.getDefaultType();\n      KeyStore ks;\n      if (keystoreProviderName != null) {","sourceCodeStart":618,"sourceCodeEnd":654,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L618-L654","documentation":"loadPrivateKeyAndCerts throws this when both keystoreFile (--ks) and certFile (--cert) are set. A KeyStore already contains the certificate chain, so supplying a separate cert file alongside it is contradictory and the tool refuses the invocation.","triggerScenarios":"Running apksigner sign with both --ks <keystore> and --cert <x509 pem file> specified.","commonSituations":"Converting a signing invocation from file-based (--key/--cert) to keystore-based and deleting only the --key flag; scripted builds that conditionally append --cert while --ks remains.","solutions":["Remove --cert (and --key) and rely on the KeyStore to provide the certificate chain.","Remove --ks to use file-based signing with both --key and --cert.","Audit the build script so only one credential mode is ever assembled."],"exampleFix":"// before\napksigner sign --ks release.jks --cert release.x509.pem app.apk\n// after\napksigner sign --ks release.jks --ks-key-alias mykey app.apk","handlingStrategy":"validation","validationCode":"// shell pre-check\nif [ -n \"$KS_ARG\" ] && [ -n \"$CERT_ARG\" ]; then\n  echo \"ERROR: --cert conflicts with --ks; the KeyStore already holds the cert chain\" >&2; exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When switching to --ks, remove the whole --key/--cert pair, not just one flag.","Review generated signing commands in CI logs before runs."],"tags":["cli","apksigner","conflicting-options"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}