{"record":{"id":"ea240201964dd224","repo":"conductor-oss/conductor","slug":"conductor-file-storage-conductor-signing-keys-is-r","errorCode":null,"errorMessage":"conductor.file-storage.conductor.signing.keys is required when signing is enabled","messagePattern":"conductor\\.file-storage\\.conductor\\.signing\\.keys is required when signing is enabled","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"core/src/main/java/org/conductoross/conductor/core/storage/ConductorFileStorageProperties.java","lineNumber":110,"sourceCode":"            return keys;\n        }\n\n        public void setKeys(List<@Valid Key> keys) {\n            this.keys = keys == null ? new ArrayList<>() : new ArrayList<>(keys);\n        }\n\n        @AssertTrue(message = \"at least one signing key is required when signing is enabled\")\n        public boolean isValid() {\n            return !enabled || (keys != null && !keys.isEmpty());\n        }\n\n        /** Throws a startup-friendly error for unusable key configuration. */\n        public void validate() {\n            if (!enabled) {\n                return;\n            }\n            if (keys == null || keys.isEmpty()) {\n                throw new IllegalStateException(\n                        \"conductor.file-storage.conductor.signing.keys is required when signing is enabled\");\n            }\n            Set<String> ids = new HashSet<>();\n            for (Key key : keys) {\n                if (key == null || isBlank(key.getId()) || isBlank(key.getSecret())) {\n                    throw new IllegalStateException(\n                            \"Each conductor.file-storage.conductor.signing.keys entry requires id and secret\");\n                }\n                if (!ids.add(key.getId())) {\n                    throw new IllegalStateException(\n                            \"conductor.file-storage.conductor.signing.keys contains duplicate id: \"\n                                    + key.getId());\n                }\n            }\n        }\n\n        private boolean isBlank(String value) {\n            return value == null || value.isBlank();","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/core/src/main/java/org/conductoross/conductor/core/storage/ConductorFileStorageProperties.java#L92-L128","documentation":"Thrown by ConductorFileStorageProperties.SigningProperties.validate() at startup when signing is enabled (conductor.file-storage.conductor.signing.enabled=true) but the keys list is null or empty. This is an IllegalStateException raised during bean initialization so the application fails fast rather than running with an un-signable configuration. The matching @AssertTrue isValid() also rejects it via JSR-380 validation.","triggerScenarios":"Setting conductor.file-storage.conductor.signing.enabled=true without providing any conductor.file-storage.conductor.signing.keys entries. Startup of the file-storage module then aborts.","commonSituations":"Copied a config template that enables signing but omits the keys block; YAML indentation places keys under the wrong node so it deserializes to an empty list; environment-specific override sets enabled=true without the corresponding key list.","solutions":["Provide at least one key entry with id and secret under conductor.file-storage.conductor.signing.keys.","If you do not need signing, set conductor.file-storage.conductor.signing.enabled=false (or omit it).","Validate YAML indentation so keys is a child of signing."],"exampleFix":"# before\nconductor:\n  file-storage:\n    conductor:\n      signing:\n        enabled: true\n\n# after\nconductor:\n  file-storage:\n    conductor:\n      signing:\n        enabled: true\n        keys:\n          - id: key-1\n            secret: ${SIGNING_KEY_SECRET}","handlingStrategy":"validation","validationCode":"// In a config sanity check / test\nConductorFileStorageProperties p = bindConfig();\nAssume.assumeFalse(p.getSigning().isEnabled() && p.getSigning().getKeys().isEmpty());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never enable signing without providing keys","Use a config test that calls SigningProperties.validate() at build time","Keep signing keys in a secrets manager referenced by env vars"],"tags":["config","signing","startup","file-storage","conductor","java"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}