Cordova Release Build Error: Failed to read key example from store ... Cannot recover key

Question

I'm trying to do a release of an inherited Cordova project that has been updated and is ready to be deployed, but it throws this error when I try and build a release:

Command

cordova build android -- --keystore="D:/keys/example.keystore" --storePassword=******** --alias=example

Error

:transformResourcesWithMergeJavaResForDebug UP-TO-DATE
:validateSigningDebug
:packageDebug FAILED

BUILD FAILED

Total time: 1.836 secs
FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':packageDebug'.
> com.android.ide.common.signing.KeytoolException: Failed to read key example from store "D:\Projects\example\app\src\android\platforms\android\..\..\..\..\..\..\..\keys\example.keystore": Cannot recover key

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.
(node:6552) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): Error: cmd: Command failed with exit code 1 Error output:
FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':packageDebug'.
> com.android.ide.common.signing.KeytoolException: Failed to read key example from store "D:\Projects\example\app\src\android\platforms\android\..\..\..\..\..\..\..\keys\example.keystore": Cannot recover key

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.
(node:6552) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

So I started researching about the error and found what seem to be similar errors on StackOverflow, and they all say Failed to ready <alias> from store the part following seems to be the distinguishing part of the error as far as I can tell this is not a duplicate since the rest all seem to be related to erroneous passwords or key tampering.

What Has Been Attempted

1. Initially, I thought the previous developer had provided an invalid alias so I figured out I can use keytool -list -v -keystore example.keystore to view the cert and there is only a single entry and the keystore alias is correct

2. I tried using flags to get more information on the error, such as: --info, --debug, and --stacktrace; and none of them provided any insights

3. Found out I can use ./gradlew signingReport in the Cordova project, but the output reiterates that it failed because Cannot recover key

4. Google will manage key signing now so I was going to upload the keystore and started following the steps which required creating an app signing private key, which verified that the store password, alias, and key password are correct since I was able to create the private key for uploading. I haven't uploaded the private key yet since I don't know what would happen if there were any issues so I wanted to initally sign a release manually before proceeding

5. Running keytool -list -v -keystore example.keystore to double check the alias out of frustration I noticed a message at the bottom of the output, which I used to create a new keystore in an industry standard format:

   Warning: The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore NAME-mobileapps.keystore -destkeystore NAME-mobileapps.keystore -deststoretype pkcs12

Running the release build again, but using the updated keystore produces a new set of errors at the same point in the build so I'm assuming from this that it was the wrong thing to do:

:validateSigningDebug
:packageDebug FAILED

BUILD FAILED

Total time: 2.224 secs
FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':packageDebug'.
> com.android.ide.common.signing.KeytoolException: Failed to read key example from store "D:\Projects\example\app\src\android\platforms\android\..\..\..\..\..\..\..\downloads\example-new.keystore": Get Key failed: Given final block not properly padded

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.
(node:20144) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): Error: cmd: Command failed with exit code 1 Error output:
FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':packageDebug'.
> com.android.ide.common.signing.KeytoolException: Failed to read key example from store "D:\Projects\example\app\src\android\platforms\android\..\..\..\..\..\..\..\downloads\example-new.keystore": Get Key failed: Given final block not properly padded

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output.
(node:20144) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

6. Currently I'm looking into potential gradle issues based on the Unhandled promise rejection in the original error, but I'm just guessing now since that is likely internal and related to Cannot recover key

Question

I spent all day yesterday trying to figure this out. Can anyone suggest how to get this release built and signed?

Answer 1

I got the same issue today, and finally found the simple solution: add --password="******", even if store and key password are same, and it builds and signs like a charm !

cordova build android --release -- --keystore="example.keystore" --alias=example --storePassword="mystorepassword" --password="mykeyaliaspassword"

Answer 2

@mtpultz

This format works for me on Windows

1. cordova build --release android

2. & 'C:\Program Files\Java\jdk1.8.0_161\bin\jarsigner.exe' -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore 'D:/Projects/Resources/key.jks' './platforms/android/app/build/outputs/apk/release/app-release-unsigned.apk' example-keyalias

3. & 'C:\Users\Machine\AppData\Local\Android\Sdk\build-tools\27.0.3\zipalign.exe' -v 4 './platforms/android/app/build/outputs/apk/release/app-release-unsigned.apk' './platforms/android/app/build/outputs/apk/release/app-release-signed.apk'

Answer 3

I couldn't figure out why this doesn't work using that command, but I did find a way around it by doing a bunch of separate terminal commands:

1. cordova build --release android
2. jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore D:/keystores/example.keystore ./platforms/android/build/outputs/apk/android-release-unsigned.apk example_alias
3. zipalign -v 4 ./platforms/android/build/outputs/apk/android-release-unsigned.apk ./release/example-release-signed.apk