Special character in keystore password prevents successful build

[gerken-tss]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

1. Create a jks file that contains a special char such as \: keytool -genkey -v -keystore testfile.keystore -alias myalias -storepass "Qn2v\Q5%O.j+" -keypass "abcde" -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug,O=Android,C=US"
2. Head to Teams > Your Team
3. Expand "Code signing identities"
4. Upload the certificate file that was generated beforehand
5. Enter the specified passwords (without quotes)

Afaik this issue only applies to yaml based workflow.

Expected results

A pipeline building an Android app succeeds

Actual results

The pipeline fails with the following error:

FAILURE: Build failed with an exception.

• What went wrong:
  Execution failed for task ':app:signAndroidTestReleaseBundle'.
  A failure occurred while executing com.android.build.gradle.internal.tasks.FinalizeBundleTask$BundleToolRunnable
  Failed to read key android-key from store "/Users/builder/.keystores/android_keystore_752a2k41.jks": Keystore was tampered with, or password was incorrect

I can reproduce the issue locally but there I can just escape the \ sign by prepending another \.
This is not possible, because when I add the escaped store password in the codemagic UI, it also says:

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

Build id (optional)

64f4dfd4dece248697f45d95

[dtrdic]

hey @gerken-ts, special characters, such as backslashes, quotes, or other escape characters, can cause problems when parsing and interpreting the password. These characters might be treated as escape sequences or delimiters, leading to this kind of issues..
Why don't you just use a different character for your store pass?

[gerken-tss]

Hey @dtrdic!
Thank you for your suggestions.

I am unsure about changing the password afterwards. I am not the account owner. We are an app agency that created the app as a service to our customers. It says here that the account owner needs to contact Google in order to upload a new keystore (or the same with a different store password, I guess). I would want to avoid this because the owner has hardly an technical knowledge and is also not easily available.

Regarding keystore password and key password not being the same: This is only the case if the PKCS12 format is used. In case of a different format (which is the case for my keystore), then this is not necessary the case. See this SO post.

For example if I execute this:

keytool -v -list -keystore /Users/marcgerken/Downloads/innotax-keystore.jks

I get this warning:

…
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /Users/marcgerken/Downloads/innotax-keystore.jks -destkeystore /Users/marcgerken/Downloads/innotax-keystore.jks -deststoretype pkcs12".

If I try to build the app locally, I need to provide these credentials:

storePassword=Qn2v\\Q5%O.j+
keyPassword=mjc/<OA1XXFh
keyAlias=testalias
storeFile=keystore.jks

What won't work is:

storePassword=Qn2v\\Q5%O.j+
keyPassword=Qn2v\\Q5%O.j+
keyAlias=testalias
storeFile=keystore.jks

[dtrdic]

hey @gerken-tss, i'm kinda confused.. you are trying to create a new keystore or you already have one? I'm asking because if you are trying to create a new one with these credentials you are mentioning

storePassword=Qn2v\\Q5%O.j+
keyPassword=mjc/<OA1XXFh
keyAlias=testalias
storeFile=keystore.jks

It will result in a different SHA signature, and you won't be able to publish the app (if it has already been published with a different signature) using this new keystore, as it won't match the previous one.
So, if this app hasn't been published yet, then no problem, just create a new keystore (without \\)

[gerken-tss]

Hey @dtrdic. I'm sorry, I guess the information would have helped: this app has already been published. So this keystore ist already known to Google and the Play Console.

[dtrdic]

hmm have you tried changing the keystore using command line? there's a few solutions online like;
keytool -storepasswd -keystore /path/to/security/keystore. jceks -storetype JCEKS -storepass 'changeit' -new 'newPassword
check this as well https://www.ibm.com/docs/en/urbancode-deploy/6.2.4?topic=configuration-changing-passwords-server-keystore

but please before that, don't forget to make a copy of your original keystore

[dtrdic]

This discussion is being closed due to no activity in the last 14 days. You can reopen the discussion at any time if needed.

[gerken-tss]

Oh sorry for not having responded. Actually, I have changed the keystore and key password using these commands:

keytool -storepasswd -keystore my-keystore.jks

keytool -keypasswd  -alias my-alias -keystore my-keystore.jks

I used it to unify both of the passwords. There was nothing else I had to do and it worked! Thanks a lot!

[dtrdic]

Awesome, glad it worked at the end:) cheers!