Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Makefile targets for keystore management #222

Closed
mrsarm opened this issue Oct 6, 2021 · 0 comments
Closed

Fix Makefile targets for keystore management #222

mrsarm opened this issue Oct 6, 2021 · 0 comments
Assignees
Labels
Type: Technical issue Improve something that users won't notice
Milestone

Comments

@mrsarm
Copy link
Contributor

mrsarm commented Oct 6, 2021

Error 1

After build a keystore, compress and encrypt it, it is suggested to clean up the uncompressed files with make org=orgname keyclean. The developer may still working in the creation of the keystore and realize that something was miss-configured and try to recreate it again. In that case, it will execute the same command, e.g. make org=test keygen, but because a keystore already exists , the Java keytool command fails with the following error that gives no clue about the real issue:

Verifing the following executables are in the $PATH: java keytool openssl ...
keytool -genkey -storepass 2b236d7be00e2a0a -v -keystore test.keystore -alias medicmobile -keyalg RSA -keysize 2048 -validity 9125
keytool error: java.io.IOException: keystore password was incorrect
java.io.IOException: keystore password was incorrect
	at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2117)
	at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222)
	at java.base/java.security.KeyStore.load(KeyStore.java:1479)
	at java.base/java.security.KeyStore.getInstance(KeyStore.java:1807)
	at java.base/java.security.KeyStore.getInstance(KeyStore.java:1687)
	at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:924)
	at java.base/sun.security.tools.keytool.Main.run(Main.java:409)
	at java.base/sun.security.tools.keytool.Main.main(Main.java:402)
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
	... 8 more
make: *** [Makefile:170: test.keystore] Error 1

So for this case we need to execute the clean-up first, or fail the execution letting the user know that it needs to delete the keystore created first, and can do it with make org=test keyclean. The last is better in case the user does not realize that is going to overwrite an existing keystore, although the compressed and encrypted version is not deleted in the process.

Error 2 (related)

If the user indeed drops first keystore with make org=xxx keyclean, another error happens after trying to create the same keystore:

Error: Unable to export or encrypt the private key
java.nio.file.FileAlreadyExistsException: test2_private_key.pepk
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:94)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
	at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:219)
	at java.base/java.nio.file.Files.newByteChannel(Files.java:371)
	at java.base/java.nio.file.Files.createFile(Files.java:648)
	at com.google.wireless.android.vending.developer.signing.tools.extern.export.ExportEncryptedPrivateKeyTool.writeToZipFile(ExportEncryptedPrivateKeyTool.java:225)
	at com.google.wireless.android.vending.developer.signing.tools.extern.export.ExportEncryptedPrivateKeyTool.run(ExportEncryptedPrivateKeyTool.java:176)
	at com.google.wireless.android.vending.developer.signing.tools.extern.export.ExportEncryptedPrivateKeyTool.main(ExportEncryptedPrivateKeyTool.java:130)
make: *** [Makefile:178: test2_private_key.pepk] Error 1

This happens because the keyclean target does not delete the ORGNAME_private_key.pepk file , so the fix is to include this file in the keyclean target.

Nice to Have

This is a good opportunity to also add some "shell" tests in CI, so we don't have to test step by step this workflow each time a change is made. Ideally the tests could be executed in a Linux VM and a MacOS VM as well.

@mrsarm mrsarm added Type: Bug Fix something that isn't working as intended Type: Technical issue Improve something that users won't notice labels Oct 6, 2021
@mrsarm mrsarm self-assigned this Oct 6, 2021
@mrsarm mrsarm closed this as completed Oct 22, 2021
@jkuester jkuester added this to the 0.11.0 milestone Dec 10, 2021
@jkuester jkuester removed the Type: Bug Fix something that isn't working as intended label Dec 10, 2021
@jkuester jkuester changed the title Generate keystore fails if previous keystore existed for the same brand Fix Makefile targets for keystore management Dec 10, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Technical issue Improve something that users won't notice
Projects
None yet
Development

No branches or pull requests

2 participants