shwenzhang/AndResGuard · error · RuntimeException

No keystore passwords

Error message

No keystore passwords

What it means

loadKeyStoreFromFile tries to open the keystore file with each candidate password in the provided list. If the list is empty (no passwords were supplied after parsing the password specs), lastFailure stays null and a RuntimeException "No keystore passwords" is thrown. It indicates the --ks-pass/--ks-key-pass style spec resolved to zero passwords rather than a wrong password.

Solutions

1. Provide the keystore password via --ks-pass pass:<password> (or stdin/env/file syntax) when running sign.
2. Verify the password spec format: it must be pass:<pw>, env:<VAR>, file:<path>, or a single dash for stdin.
3. If using the library API, ensure the passwords List<char[]> passed to loadKeyStoreFromFile is non-empty.
4. Confirm the keystore is actually password-protected as expected; adjust the spec accordingly.

Example fix

// before
apksigner sign --ks release.jks --out app.apk app-unsigned.apk
// after
apksigner sign --ks release.jks --ks-pass pass:storePassword --out app.apk app-unsigned.apk

java
if (keystorePassword == null || keystorePassword.isEmpty()) {
    throw new IllegalArgumentException("Keystore password must be provided (--ks-pass)");
}

java
try {
    signerBuilder.build().sign(outputFile);
} catch (RuntimeException e) {
    if ("No keystore passwords".equals(e.getMessage())) {
        System.err.println("Supply --ks-pass pass:<password> for signing.");
    } else {
        throw e;
    }
}

When it happens

Trigger: Calling sign without providing a keystore password spec (or with a spec that expands to an empty password list), so loadPrivateKeyAndCertsFromKeyStore invokes loadKeyStoreFromFile with an empty passwords list.

Common situations: Omitting --ks-pass on the command line; passing an empty or malformed password spec (e.g. missing value after --ks-pass:); environment-variable or file password source pointing to an empty file.

Related errors

• No key passwords
• No passwords
• private key is not a DSA or RSA key
• At least one signer must be specified
• Failed to read resource

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/bacbe41a02375625. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:548

    String v1SigFileBasename;

    PrivateKey privateKey;
    List<X509Certificate> certs;

    private static void loadKeyStoreFromFile(KeyStore ks, String file, List<char[]> passwords) throws Exception {
      Exception lastFailure = null;
      for (char[] password : passwords) {
        try {
          try (FileInputStream in = new FileInputStream(file)) {
            ks.load(in, password);
          }
          return;
        } catch (Exception e) {
          lastFailure = e;
        }
      }
      if (lastFailure == null) {
        throw new RuntimeException("No keystore passwords");
      } else {
        throw lastFailure;
      }
    }

    private static Key getKeyStoreKey(KeyStore ks, String keyAlias, List<char[]> passwords)
        throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {
      UnrecoverableKeyException lastFailure = null;
      for (char[] password : passwords) {
        try {
          return ks.getKey(keyAlias, password);
        } catch (UnrecoverableKeyException e) {
          lastFailure = e;
        }
      }
      if (lastFailure == null) {
        throw new RuntimeException("No key passwords");
      } else {

View on GitHub (pinned to e4df245d82)