{"record":{"id":"bacbe41a02375625","repo":"shwenzhang/AndResGuard","slug":"no-keystore-passwords","errorCode":null,"errorMessage":"No keystore passwords","messagePattern":"No keystore passwords","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java","lineNumber":548,"sourceCode":"    String v1SigFileBasename;\n\n    PrivateKey privateKey;\n    List<X509Certificate> certs;\n\n    private static void loadKeyStoreFromFile(KeyStore ks, String file, List<char[]> passwords) throws Exception {\n      Exception lastFailure = null;\n      for (char[] password : passwords) {\n        try {\n          try (FileInputStream in = new FileInputStream(file)) {\n            ks.load(in, password);\n          }\n          return;\n        } catch (Exception e) {\n          lastFailure = e;\n        }\n      }\n      if (lastFailure == null) {\n        throw new RuntimeException(\"No keystore passwords\");\n      } else {\n        throw lastFailure;\n      }\n    }\n\n    private static Key getKeyStoreKey(KeyStore ks, String keyAlias, List<char[]> passwords)\n        throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {\n      UnrecoverableKeyException lastFailure = null;\n      for (char[] password : passwords) {\n        try {\n          return ks.getKey(keyAlias, password);\n        } catch (UnrecoverableKeyException e) {\n          lastFailure = e;\n        }\n      }\n      if (lastFailure == null) {\n        throw new RuntimeException(\"No key passwords\");\n      } else {","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/shwenzhang/AndResGuard/blob/e4df245d82f27d9a2d0dd108260a3510cbaba849/AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java#L530-L566","documentation":"loadKeyStoreFromFile tries to open the keystore file with each candidate password in the provided list. If the list is empty (no passwords were supplied after parsing the password specs), lastFailure stays null and a RuntimeException \"No keystore passwords\" is thrown. It indicates the --ks-pass/--ks-key-pass style spec resolved to zero passwords rather than a wrong password.","triggerScenarios":"Calling sign without providing a keystore password spec (or with a spec that expands to an empty password list), so loadPrivateKeyAndCertsFromKeyStore invokes loadKeyStoreFromFile with an empty passwords list.","commonSituations":"Omitting --ks-pass on the command line; passing an empty or malformed password spec (e.g. missing value after --ks-pass:); environment-variable or file password source pointing to an empty file.","solutions":["Provide the keystore password via --ks-pass pass:<password> (or stdin/env/file syntax) when running sign.","Verify the password spec format: it must be pass:<pw>, env:<VAR>, file:<path>, or a single dash for stdin.","If using the library API, ensure the passwords List<char[]> passed to loadKeyStoreFromFile is non-empty.","Confirm the keystore is actually password-protected as expected; adjust the spec accordingly."],"exampleFix":"// before\napksigner sign --ks release.jks --out app.apk app-unsigned.apk\n// after\napksigner sign --ks release.jks --ks-pass pass:storePassword --out app.apk app-unsigned.apk","handlingStrategy":"validation","validationCode":"java\nif (keystorePassword == null || keystorePassword.isEmpty()) {\n    throw new IllegalArgumentException(\"Keystore password must be provided (--ks-pass)\");\n}","typeGuard":null,"tryCatchPattern":"java\ntry {\n    signerBuilder.build().sign(outputFile);\n} catch (RuntimeException e) {\n    if (\"No keystore passwords\".equals(e.getMessage())) {\n        System.err.println(\"Supply --ks-pass pass:<password> for signing.\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Always pass --ks-pass (or its env/file equivalent) when signing with a keystore.","Keep passwords in CI secrets and inject via --ks-pass env:VAR.","Validate password specs resolve to a non-empty value before invoking sign."],"tags":["java","keystore","missing-password","cli","signing"],"backgroundTag":"missing-credentials","analyzedSha":"e4df245d82f27d9a2d0dd108260a3510cbaba849","analyzedAt":"2026-09-12T17:49:07.798Z","contentChangedAt":"2026-09-12T17:49:07.798Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}