shwenzhang/AndResGuard · error · ParameterException

does not contain key entries

Error message

<keystoreFile> does not contain key entries

What it means

After scanning every alias in the loaded KeyStore, no alias passed isKeyEntry(), meaning the keystore holds no private-key entries at all. apksigner cannot obtain a signing key, so it throws this ParameterException naming the keystore file.

Solutions

  1. Verify with keytool -list -keystore my.keystore that it actually contains a PrivateKeyEntry; if not, locate the correct signing keystore.
  2. Re-import the key into a new keystore, e.g. keytool -importkeystore -srckeystore old -destkeystore new, and use that file.
  3. Check the --ks-pass/--ks-type options; a wrong password or type can make entries unreadable.
  4. Ensure the file path given to --ks is the real keystore, not a certificate or build artifact.

Example fix

// before (truststore has no private keys)
apksigner sign --ks truststore.jks ...
// after
apksigner sign --ks release.keystore --ks-key-alias release ...
Defensive patterns

Strategy: validation

Validate before calling

File f = new File(ksPath);
if (!f.isFile() || f.length() == 0) throw new IllegalArgumentException("Keystore file missing/empty: " + ksPath);
KeyStore ks = KeyStore.getInstance(ksType != null ? ksType : KeyStore.getDefaultType());
try (FileInputStream in = new FileInputStream(f)) { ks.load(in, storePassword); }
boolean hasKey = false;
for (java.util.Enumeration<String> e = ks.aliases(); e.hasMoreElements();)
    if (ks.isKeyEntry(e.nextElement())) { hasKey = true; break; }
if (!hasKey) throw new IllegalArgumentException("Keystore contains no key entries: " + ksPath);

Prevention

When it happens

Trigger: Calling loadPrivateKeyAndCerts (-> loadPrivateKeyAndCertsFromKeyStore) with a --ks file that is a trusted-certificate-only keystore, an empty keystore, or a keystore whose password was wrong such that entries were not visible (some keystore types return no aliases on a wrong password), or pointing --ks at a non-keystore/artifact file.

Common situations: Pointing --ks at a .cer/.pem certificate file or a truststore instead of the signing keystore; typo in keystore path causing an empty/other file to load; forgetting --ks-type so a PKCS12 file is read with the wrong type; keystore created with keytool -exportcert only (cert-only store).

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/6a8c0af501b7a28c. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:715

          // KeyStore. If the KeyStore contains multiple key entries, return an error.
          Enumeration<String> aliases = ks.aliases();
          if (aliases != null) {
            while (aliases.hasMoreElements()) {
              String entryAlias = aliases.nextElement();
              if (ks.isKeyEntry(entryAlias)) {
                keyAlias = entryAlias;
                if (keystoreKeyAlias != null) {
                  throw new ParameterException(keystoreFile
                                               + " contains multiple key entries"
                                               + ". --ks-key-alias option must be used to specify"
                                               + " which entry to use.");
                }
                keystoreKeyAlias = keyAlias;
              }
            }
          }
          if (keystoreKeyAlias == null) {
            throw new ParameterException(keystoreFile + " does not contain key entries");
          }
        }

        // Private key entry alias known. Load that entry's private key.
        keyAlias = keystoreKeyAlias;
        if (!ks.isKeyEntry(keyAlias)) {
          throw new ParameterException(keystoreFile + " entry \"" + keyAlias + "\" does not contain a key");
        }

        Key entryKey;
        if (keyPasswordSpec != null) {
          // Key password spec is explicitly specified. Use this spec to obtain the
          // password and then load the key using that password.
          List<char[]> keyPasswords = passwordRetriever.getPasswords(keyPasswordSpec,
              "Key \"" + keyAlias + "\" password for " + name
          );
          entryKey = getKeyStoreKey(ks, keyAlias, keyPasswords);
        } else {

View on GitHub (pinned to e4df245d82)