What causes " entry " " does not contain a key" in shwenzhang/AndResGuard?

Run keytool -list -v -keystore my.keystore and copy the alias exactly from a 'PrivateKeyEntry' line.

shwenzhang/AndResGuard · error · ParameterException

entry " " does not contain a key

Error message

<keystoreFile> entry "<keyAlias>" does not contain a key

What it means

The alias named via --ks-key-alias (or auto-selected) exists in the keystore but is not a key entry — isKeyEntry(alias) returned false — so it cannot yield a private key for signing. apksigner throws this ParameterException with the keystore file and alias in the message.

Solutions

Run keytool -list -v -keystore my.keystore and copy the alias exactly from a 'PrivateKeyEntry' line.
Correct the --ks-key-alias value to the private-key entry's alias.
If the key was lost, re-import it (keytool -importkeystore) under the expected alias.
In code, call KeyStore.isKeyEntry(alias) up front and fail with a clear message.

Example fix

// before
--ks-key-alias mycert   // TrustedCertificateEntry
// after
--ks-key-alias release  // PrivateKeyEntry per keytool -list -v

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = /* loaded keystore */;
if (keyAlias != null && !ks.isKeyEntry(keyAlias))
    throw new IllegalArgumentException("Alias '" + keyAlias + "' is not a key entry in the keystore; check keytool -list -v output for a PrivateKeyEntry alias.");

Prevention

Copy aliases only from PrivateKeyEntry lines of keytool -list -v
Keep keystore aliases stable; update build config after any keystore change
Distinguish cert aliases from key aliases when sharing configuration

When it happens

Trigger: Passing --ks-key-alias that points to a TrustedCertificateEntry or a secret-key entry instead of a PrivateKeyEntry; a typo producing an alias that resolves to a non-key entry; keystore with same-named cert-only entries.

Common situations: Developers copy an alias from a certificate listing (keytool -list shows cert entries too) rather than from the PrivateKeyEntry section; build config pins an alias that was later replaced by a cert-only entry;混淆 between the signing alias and a CA/trusted cert alias in the same store.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/5c942dfbe53608cc. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:722

                if (keystoreKeyAlias != null) {
                  throw new ParameterException(keystoreFile
                                               + " contains multiple key entries"
                                               + ". --ks-key-alias option must be used to specify"
                                               + " which entry to use.");
                }
                keystoreKeyAlias = keyAlias;
              }
            }
          }
          if (keystoreKeyAlias == null) {
            throw new ParameterException(keystoreFile + " does not contain key entries");
          }
        }

        // Private key entry alias known. Load that entry's private key.
        keyAlias = keystoreKeyAlias;
        if (!ks.isKeyEntry(keyAlias)) {
          throw new ParameterException(keystoreFile + " entry \"" + keyAlias + "\" does not contain a key");
        }

        Key entryKey;
        if (keyPasswordSpec != null) {
          // Key password spec is explicitly specified. Use this spec to obtain the
          // password and then load the key using that password.
          List<char[]> keyPasswords = passwordRetriever.getPasswords(keyPasswordSpec,
              "Key \"" + keyAlias + "\" password for " + name
          );
          entryKey = getKeyStoreKey(ks, keyAlias, keyPasswords);
        } else {
          // Key password spec is not specified. This means we should assume that key
          // password is the same as the keystore password and that, if this assumption is
          // wrong, we should prompt for key password and retry loading the key using that
          // password.
          try {
            entryKey = getKeyStoreKey(ks, keyAlias, keystorePasswords);
          } catch (UnrecoverableKeyException expected) {

View on GitHub (pinned to e4df245d82)