apache / apache/cordova-android
Password from keystore password prompt is not used, placeholder "__unset" used as actual keystore password
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 1.6k
- Avg merge
- 16h 18m
- Merged PRs (30d)
- 11
Description
# Bug Report
## Problem
### What is expected to happen?
If we don't specify `"storePassword"` or `"password"` in `build.json`, then `cordova build android --release` will prompt for the password. That password should be used to access the keystore.
### What does actually happen?
We get an error, even if the password was typed correctly:
```
> com.android.ide.common.signing.KeytoolException: Failed to read key my_key from store "my.keystore": Keystore was tampered with, or password was incorrect
```
If I change both the store and the key password to `__unset` (which is used in `app/build.gradle` as a temporary placeholder), then the signing step completes successfully, regardless of which password I entered in the prompt. So it seems that the password from the prompt does not successfully replace this placeholder.
## Information
### Command or Code
```sh
$ cordova create my_app
$ cd my_app
$ cordova platform add android
$ echo '{"android": {"release": {"keystore": "my.keystore", "alias": "my_key"}}}' > build.json
$ keytool -genkey -keystore my.keystore -alias my_key -v -keyalg RSA -keysize 2048 -validity 10000 -keypass testtest -storepass testtest
# Press Enter until "[no]" appears, then type "[yes]"
$ cordova build android --release
# Enter "testtest" at both password prompts
...
Execution failed for task ':app:packageRelease'.
> com.android.ide.common.signing.KeytoolException: Failed to read key my_key from store "/tmp/repro/my_app/my.keystore": Keystore was tampered with, or password was incorrect
```
But if the passwords happen to be `__unset`, it's better:
```sh
$ rm my.keystore
$ keytool -genkey -keystore my.keystore -alias my_key -v -keyalg RSA -keysize 2048 -validity 10000 -keypass __unset -storepass __unset
# Press Enter until "[no]" appears, then type "[yes]"
$ cordova build android --release
...
BUILD SUCCESSFUL in 7s
43 actionable tasks: 2 executed, 41 up-to-date
Built the following apk(s):
/.../my_app/platforms/android/app/build/outputs/apk/release/app-release.apk
```
### Environment, Platform, Device
Arch Linux on x86_64
### Version information
* Cordova CLI 9.0.0
* Cordova lib 9.0.1
* Cordova Android 8.0.0
* Android SDK build tools 29.0.0
## Checklist
- [x] I searched for existing GitHub issues
- [x] I updated all Cordova tooling to most recent version
- [x] I included all the necessary information above
Contributor guide
Research direction
Reproduce the issue with the provided cordova create, platform add, build.json, keytool, and release-build commands. Start by examining the generated app/build.gradle and the release-signing password flow. Done means passwords entered at both prompts are used for signing, while an incorrect password still fails the build.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, javascript
- Domain
- build-system, mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100