shwenzhang/AndResGuard · error · ParameterException

--ks and --key may not be specified at the same time

Error message

--ks and --key may not be specified at the same time

What it means

ApkSignerTool's loadPrivateKeyAndCerts accepts signing credentials from either a Java KeyStore (--ks) or raw private key/cert files (--key/--cert), never both. When both keystoreFile and keyFile are set it throws this ParameterException before doing any work, because the two credential sources are mutually exclusive by design.

Solutions

  1. Remove the --ks/--ks-key-id options if you intend file-based signing, keeping only --key and --cert.
  2. Remove --key/--cert if you intend KeyStore-based signing, keeping --ks (plus --ks-key-alias and passwords).
  3. Fix the wrapping script/alias so it only passes one credential source.

Example fix

// before
apksigner sign --ks release.jks --ks-key-alias mykey --key release.pk8 --cert release.x509.pem app.apk
// after (KeyStore mode)
apksigner sign --ks release.jks --ks-key-alias mykey app.apk
Defensive patterns

Strategy: validation

Validate before calling

// shell pre-check before invoking apksigner
if [ -n "$KS_ARG" ] && [ -n "$KEY_ARG" ]; then
  echo "ERROR: use either --ks OR --key/--cert, not both" >&2; exit 1
fi

Prevention

When it happens

Trigger: Running apksigner sign with both --ks <keystore> and --key <pk8/pem file> on the same command line.

Common situations: Copy-pasting a signing command from two different CI templates; migrating from keystore-based to file-based signing but forgetting to remove --ks; an alias or script that appends --key while --ks is already set.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/bb304de3ae1a7f39. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:634

             && (keystoreFile == null)
             && (keystoreKeyAlias == null)
             && (keystorePasswordSpec == null)
             && (keyPasswordSpec == null)
             && (keystoreType == null)
             && (keystoreProviderName == null)
             && (keystoreProviderClass == null)
             && (keystoreProviderArg == null)
             && (keyFile == null)
             && (certFile == null)
             && (v1SigFileBasename == null)
             && (privateKey == null)
             && (certs == null);
    }

    private void loadPrivateKeyAndCerts(PasswordRetriever passwordRetriever) throws Exception {
      if (keystoreFile != null) {
        if (keyFile != null) {
          throw new ParameterException("--ks and --key may not be specified at the same time");
        } else if (certFile != null) {
          throw new ParameterException("--ks and --cert may not be specified at the same time");
        }
        loadPrivateKeyAndCertsFromKeyStore(passwordRetriever);
      } else if (keyFile != null) {
        loadPrivateKeyAndCertsFromFiles(passwordRetriever);
      } else {
        throw new ParameterException("KeyStore (--ks) or private key file (--key) must be specified");
      }
    }

    private void loadPrivateKeyAndCertsFromKeyStore(PasswordRetriever passwordRetriever) throws Exception {
      if (keystoreFile == null) {
        throw new ParameterException("KeyStore (--ks) must be specified");
      }

      // 1. Obtain a KeyStore implementation
      String ksType = (keystoreType != null) ? keystoreType : KeyStore.getDefaultType();

View on GitHub (pinned to e4df245d82)