{"record":{"id":"cdf62df110d4891a","repo":"apache/hadoop","slug":"can-t-get-key-alias-from-path","errorCode":null,"errorMessage":"Can't get key ${alias} from ${path}","messagePattern":"Can't get key (.+?) from (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java","lineNumber":368,"sourceCode":"  }\n\n  @Override\n  public List<String> getKeys() throws IOException {\n    readLock.lock();\n    try {\n      ArrayList<String> list = new ArrayList<String>();\n      String alias = null;\n      try {\n        Enumeration<String> e = keyStore.aliases();\n        while (e.hasMoreElements()) {\n           alias = e.nextElement();\n           // only include the metadata key names in the list of names\n           if (!alias.contains(\"@\")) {\n               list.add(alias);\n           }\n        }\n      } catch (KeyStoreException e) {\n        throw new IOException(\"Can't get key \" + alias + \" from \" + path, e);\n      }\n      return list;\n    } finally {\n      readLock.unlock();\n    }\n  }\n\n  @Override\n  public List<KeyVersion> getKeyVersions(String name) throws IOException {\n    readLock.lock();\n    try {\n      List<KeyVersion> list = new ArrayList<KeyVersion>();\n      Metadata km = getMetadata(name);\n      if (km != null) {\n        int latestVersion = km.getVersions();\n        KeyVersion v = null;\n        String versionName = null;\n        for (int i = 0; i < latestVersion; i++) {","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/crypto/key/JavaKeyStoreProvider.java#L350-L386","documentation":"While enumerating all aliases for getKeys(), the keystore threw KeyStoreException — the keystore is uninitialized or in a failed state. The message interpolates the alias variable, which is null when aliases() itself throws before any element is returned.","triggerScenarios":"Calling KeyProvider.getKeys() when keyStore.aliases() fails — an uninitialized KeyStore instance or one left in a bad state (e.g. after a failed load that was swallowed). Distinct from a missing-key case; it is a structural keystore failure.","commonSituations":"List-keys (KMS GET /keys) after partial provider initialization; test providers with mock keystores; keystore file deleted/replaced while KMS holds a stale handle","solutions":["Restart KMS to force a clean provider load, then retry the list","Validate the keystore file exists and loads: keytool -list -keystore <path> -storetype jceks","In tests, initialize a real keystore rather than a bare KeyStore mock"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Cheap pre-flight: does the provider load and enumerate at all?\nList<String> names = provider.getKeys(); // fail here in a controlled place\n","typeGuard":null,"tryCatchPattern":"try {\n  List<String> keys = provider.getKeys();\n} catch (IOException e) {\n  if (e.getCause() instanceof KeyStoreException) {\n    // structural keystore failure: reload provider / restart KMS\n  }\n}","preventionTips":["Call getKeys() once at startup as a keystore health probe","Don't delete or move keystore files under a running KMS","Use real keystore files in tests, not bare KeyStore mocks"],"tags":["keystore","kms","crypto","aliases","key-lookup"],"backgroundTag":"keystore-key-lookup-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}