apache / apache/cordova-android

Password from keystore password prompt is not used, placeholder "__unset" used as actual keystore password

Open
#761 5 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
3.8k
Forks
1.6k
Avg merge
16h 18m
Merged PRs (30d)
11

Description

# Bug Report

## Problem

### What is expected to happen?

If we don't specify `"storePassword"` or `"password"` in `build.json`, then `cordova build android --release` will prompt for the password. That password should be used to access the keystore.

### What does actually happen?

We get an error, even if the password was typed correctly:

```
> com.android.ide.common.signing.KeytoolException: Failed to read key my_key from store "my.keystore": Keystore was tampered with, or password was incorrect
```

If I change both the store and the key password to `__unset` (which is used in `app/build.gradle` as a temporary placeholder), then the signing step completes successfully, regardless of which password I entered in the prompt. So it seems that the password from the prompt does not successfully replace this placeholder.

## Information

### Command or Code

```sh
$ cordova create my_app
$ cd my_app
$ cordova platform add android
$ echo '{"android": {"release": {"keystore": "my.keystore", "alias": "my_key"}}}' > build.json
$ keytool -genkey -keystore my.keystore -alias my_key -v -keyalg RSA -keysize 2048 -validity 10000 -keypass testtest -storepass testtest
# Press Enter until "[no]" appears, then type "[yes]"
$ cordova build android --release
# Enter "testtest" at both password prompts
...
Execution failed for task ':app:packageRelease'.
> com.android.ide.common.signing.KeytoolException: Failed to read key my_key from store "/tmp/repro/my_app/my.keystore": Keystore was tampered with, or password was incorrect
```

But if the passwords happen to be `__unset`, it's better:

```sh
$ rm my.keystore
$ keytool -genkey -keystore my.keystore -alias my_key -v -keyalg RSA -keysize 2048 -validity 10000 -keypass __unset -storepass __unset
# Press Enter until "[no]" appears, then type "[yes]"
$ cordova build android --release
...
BUILD SUCCESSFUL in 7s
43 actionable tasks: 2 executed, 41 up-to-date
Built the following apk(s):
/.../my_app/platforms/android/app/build/outputs/apk/release/app-release.apk
```

### Environment, Platform, Device

Arch Linux on x86_64

### Version information

* Cordova CLI 9.0.0
* Cordova lib 9.0.1
* Cordova Android 8.0.0
* Android SDK build tools 29.0.0

## Checklist

- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided cordova create, platform add, build.json, keytool, and release-build commands. Start by examining the generated app/build.gradle and the release-signing password flow. Done means passwords entered at both prompts are used for signing, while an incorrect password still fails the build.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, javascript
Domain
build-system, mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.