{"record":{"id":"8932c754f61d6d5a","repo":"shwenzhang/AndResGuard","slug":"no-passwords","errorCode":null,"errorMessage":"No passwords","messagePattern":"No passwords","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":589,"sourceCode":"    private static PKCS8EncodedKeySpec decryptPkcs8EncodedKey(\n        EncryptedPrivateKeyInfo encryptedPrivateKeyInfo, List<char[]> passwords)\n        throws NoSuchAlgorithmException, InvalidKeySpecException, InvalidKeyException {\n      SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(encryptedPrivateKeyInfo.getAlgName());\n      InvalidKeySpecException lastKeySpecException = null;\n      InvalidKeyException lastKeyException = null;\n      for (char[] password : passwords) {\n        PBEKeySpec decryptionKeySpec = new PBEKeySpec(password);\n        try {\n          SecretKey decryptionKey = keyFactory.generateSecret(decryptionKeySpec);\n          return encryptedPrivateKeyInfo.getKeySpec(decryptionKey);\n        } catch (InvalidKeySpecException e) {\n          lastKeySpecException = e;\n        } catch (InvalidKeyException e) {\n          lastKeyException = e;\n        }\n      }\n      if ((lastKeyException == null) && (lastKeySpecException == null)) {\n        throw new RuntimeException(\"No passwords\");\n      } else if (lastKeyException != null) {\n        throw lastKeyException;\n      } else {\n        throw lastKeySpecException;\n      }\n    }\n\n    private static PrivateKey loadPkcs8EncodedPrivateKey(PKCS8EncodedKeySpec spec)\n        throws InvalidKeySpecException, NoSuchAlgorithmException {\n      try {\n        return KeyFactory.getInstance(\"RSA\").generatePrivate(spec);\n      } catch (InvalidKeySpecException expected) {\n      }\n      try {\n        return KeyFactory.getInstance(\"EC\").generatePrivate(spec);\n      } catch (InvalidKeySpecException expected) {\n      }\n      try {","sourceCodeStart":571,"sourceCodeEnd":607,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L571-L607","documentation":"decryptPkcs8EncodedKey attempts to decrypt an encrypted PKCS#8 private key with each candidate password. If the password list is empty, no exceptions are recorded and a RuntimeException \"No passwords\" is thrown. This signals that no passwords were provided for decrypting a PEM/PKCS#8 key file, distinct from wrong-password failures which rethrow the underlying exception.","triggerScenarios":"Signing with --key/--cert file-based signing where the PKCS#8 key file is encrypted but no --key-pass spec was given, so loadPrivateKeyAndCertsFromFiles calls decryptPkcs8EncodedKey with an empty passwords list.","commonSituations":"Using an encrypted (password-protected) PEM key without --key-pass; pointing --key-pass at an empty env var or file; forgetting that unencrypted-key workflows still need the spec only when encryption is present.","solutions":["Provide the key password via --key-pass pass:<password> (or env:/file:/stdin form).","Alternatively decrypt the key offline (e.g. openssl pkcs8 -topk8 -nocrypt) and pass an unencrypted PKCS#8 file with --key.","Verify the password source (env var/file) actually contains a value.","If calling the API, ensure the passwords List<char[]> is non-empty."],"exampleFix":"// before\napksigner sign --key encrypted.pk8 --cert cert.x509.pem --out app.apk app-unsigned.apk\n// after\napksigner sign --key encrypted.pk8 --cert cert.x509.pem --key-pass pass:keyPw --out app.apk app-unsigned.apk","handlingStrategy":"validation","validationCode":"java\nif (keyPassword == null || keyPassword.isEmpty()) {\n    throw new IllegalArgumentException(\"Key password required for encrypted PKCS#8 key files (--key-pass)\");\n}","typeGuard":null,"tryCatchPattern":"java\ntry {\n    signerBuilder.build().sign(outputFile);\n} catch (RuntimeException e) {\n    if (\"No passwords\".equals(e.getMessage())) {\n        System.err.println(\"The --key file is encrypted; supply --key-pass pass:<password>.\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Detect encrypted PKCS#8 keys ahead of time (header contains ENCRYPTED PRIVATE KEY) and require a password.","Prefer unencrypted PKCS#8 keys in CI with file-system protections instead of passing passwords.","Verify env/file password sources contain a value before invoking sign."],"tags":["java","pkcs8","missing-password","cli","signing"],"backgroundTag":"missing-credentials","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}