conductor-oss/conductor · critical · IllegalStateException

conductor.file-storage.conductor.signing.keys is required wh

Error message

conductor.file-storage.conductor.signing.keys is required when signing is enabled

What it means

Thrown by ConductorFileStorageProperties.SigningProperties.validate() at startup when signing is enabled (conductor.file-storage.conductor.signing.enabled=true) but the keys list is null or empty. This is an IllegalStateException raised during bean initialization so the application fails fast rather than running with an un-signable configuration. The matching @AssertTrue isValid() also rejects it via JSR-380 validation.

Source

Thrown at core/src/main/java/org/conductoross/conductor/core/storage/ConductorFileStorageProperties.java:110

            return keys;
        }

        public void setKeys(List<@Valid Key> keys) {
            this.keys = keys == null ? new ArrayList<>() : new ArrayList<>(keys);
        }

        @AssertTrue(message = "at least one signing key is required when signing is enabled")
        public boolean isValid() {
            return !enabled || (keys != null && !keys.isEmpty());
        }

        /** Throws a startup-friendly error for unusable key configuration. */
        public void validate() {
            if (!enabled) {
                return;
            }
            if (keys == null || keys.isEmpty()) {
                throw new IllegalStateException(
                        "conductor.file-storage.conductor.signing.keys is required when signing is enabled");
            }
            Set<String> ids = new HashSet<>();
            for (Key key : keys) {
                if (key == null || isBlank(key.getId()) || isBlank(key.getSecret())) {
                    throw new IllegalStateException(
                            "Each conductor.file-storage.conductor.signing.keys entry requires id and secret");
                }
                if (!ids.add(key.getId())) {
                    throw new IllegalStateException(
                            "conductor.file-storage.conductor.signing.keys contains duplicate id: "
                                    + key.getId());
                }
            }
        }

        private boolean isBlank(String value) {
            return value == null || value.isBlank();

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Provide at least one key entry with id and secret under conductor.file-storage.conductor.signing.keys.
2. If you do not need signing, set conductor.file-storage.conductor.signing.enabled=false (or omit it).
3. Validate YAML indentation so keys is a child of signing.

Example fix

# before
conductor:
  file-storage:
    conductor:
      signing:
        enabled: true

# after
conductor:
  file-storage:
    conductor:
      signing:
        enabled: true
        keys:
          - id: key-1
            secret: ${SIGNING_KEY_SECRET}

// In a config sanity check / test
ConductorFileStorageProperties p = bindConfig();
Assume.assumeFalse(p.getSigning().isEnabled() && p.getSigning().getKeys().isEmpty());

When it happens

Trigger: Setting conductor.file-storage.conductor.signing.enabled=true without providing any conductor.file-storage.conductor.signing.keys entries. Startup of the file-storage module then aborts.

Common situations: Copied a config template that enables signing but omits the keys block; YAML indentation places keys under the wrong node so it deserializes to an empty list; environment-specific override sets enabled=true without the corresponding key list.

Related errors

• Each conductor.file-storage.conductor.signing.keys entry req
• conductor.file-storage.conductor.signing.keys contains dupli
• Configured file storage does not support content streaming
• workflowId is required
• File already uploaded: {}

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/ea240201964dd224. Report an issue: GitHub.