bug: Wrong version of key store.

[XDream8]

Type

Error while running the CLI

Bug description

I can't create a revanced-app with custom keystore

Steps to reproduce

Step 1: create a key store Step 2: supply created key store to revanced-cli using --keystore=\<keystore file>

Relevant log output

INFO: Reading dex files 
INFO: Decoding AndroidManifest.xml only, because resources are not needed 
INFO: Skipping compact-header: Excluded by default 
WARNING: Skipping hide-get-premium: Incompatible with version 5.40.51. This patch is only compatible with version com.google.android.apps.youtube.music: 5.14.53, 5.16.51, 5.17.51, 5.21.52, 5.22.54, 5.23.50, 5.25.51, 5.25.52, 5.26.52, 5.27.51, 5.28.52, 5.29.52, 5.31.50, 5.34.51, 5.36.51, 5.38.53, 5.39.52 
INFO: Skipping predictive-back-gesture: Excluded by default 
INFO: Skipping remove-screenshot-restriction: Excluded by default 
INFO: Skipping spoof-wifi-connection: Excluded by default 
INFO: Deleting existing resource cache directory 
INFO: Decoding resources 
INFO: background-play succeeded 
INFO: codecs-unlock succeeded 
INFO: exclusive-audio-playback succeeded 
INFO: minimized-playback-music succeeded 
INFO: music-microg-support succeeded 
INFO: music-video-ads succeeded 
INFO: tasteBuilder-remover succeeded 
INFO: upgrade-button-remover succeeded 
INFO: Compiling resources 
INFO: Writing modified dex files 
INFO: Aligning YouTube-Music-5.40.51.apk to revanced-music-5.40.51-non-root_aligned.apk 
INFO: Signing revanced-music-5.40.51-non-root_aligned.apk to revanced-music-5.40.51-non-root_signed.apk 
INFO: Found existing keystore: revanced-creator.keystore 
java.io.IOException: Wrong version of key store.
    at org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi.engineLoad(Unknown Source)
    at java.base/java.security.KeyStore.load(KeyStore.java:1473)
    at app.revanced.utils.signing.Signer.signApk(Signer.kt:63)
    at app.revanced.cli.signing.Signing.sign(Signing.kt:10)
    at app.revanced.cli.command.MainCommand.run(MainCommand.kt:163)
    at picocli.CommandLine.executeUserObject(CommandLine.java:2026)
    at picocli.CommandLine.access$1500(CommandLine.java:148)
    at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
    at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
    at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
    at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
    at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
    at picocli.CommandLine.execute(CommandLine.java:2170)
    at app.revanced.cli.main.MainKt.main(Main.kt:7)

Screenshots or videos

No response

Solution

No response

Additional context

No response

Acknowledgements

• [X] I have searched the existing issues and this is a new and no duplicate or related to another open issue.
• [X] I have written a short but informative title.
• [X] I filled out all of the requested information in this issue properly.

[oSumAtrIX]

Please use the correct JRE mentioned in the docs.

[XDream8]

$ java -version
Picked up _JAVA_OPTIONS: -Djava.util.prefs.userRoot=/home/xdream8/.config/java
openjdk version "17.0.6" 2023-01-17
OpenJDK Runtime Environment Temurin-17.0.6+10 (build 17.0.6+10)
OpenJDK 64-Bit Server VM Temurin-17.0.6+10 (build 17.0.6+10, mixed mode, sharing)

[XDream8]

I am pretty sure there is a problem with revanced-cli.

I even tried doing the same process with different key store types(jks, jceks, bks, pkcs12)

[oSumAtrIX]

Upon further inspection, org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi.engineLoad throws here:

            if (version != STORE_VERSION)
            {
                if (version != 0 && version != 1)
                {
                    throw new IOException("Wrong version of key store.");
                }
            }

The first four bytes of the input stream to the keystore file correspond to version: version = dIn.readInt();. The expected version is either 0x0, 0x1 or 0x2. The ReVanced CLI creates the keystore file with the following four bytes:

This is due to the provider:

        public void engineStore(OutputStream stream, char[] password) 
            throws IOException
        {
            Cipher              cipher;
            DataOutputStream    dOut = new DataOutputStream(stream);
            byte[]              salt = new byte[STORE_SALT_SIZE];
            int                 iterationCount = MIN_ITERATIONS + (random.nextInt() & 0x3ff);

            random.nextBytes(salt);

            dOut.writeInt(version);

            // ...
         }

The Spi is instantiated with version STORE_VERSION (0x2):

The only solution is to provide a keystore file with the correct version or include a provider which supports your keystore version. Check which version yours has.

[XDream8]

It seems that the key stores I create are version 3 key stores. the command I used to generate key stores

keytool -genkey -v -keystore revanced.keystore -alias revanced -keyalg RSA -validity 10000

[XDream8]

I can't find a way to create a version 2 keystore file. I also tried creating a keystore using jdk8's keytool but it generates version 3 keystores too.

I think I will just generate a keystore with revanced-cli(using --password and --cn)

ChatGPT response: The keytool command generates a version 3 keystore by default. If you need to specifically create a version 2 keystore, you may have to use a different tool or find a workaround for using keytool. I recommend checking the documentation or forums for the software or platform you are using to see if there are any options for creating a version 2 keystore.

[Luciogi]

Revanced-cli is creating different type of key (bks) and java (zulu) is creating jks

reference:https://code.whatever.social/questions/21169248/android-java-io-ioexception-wrong-version-of-key-store

This article mentions to create custom bks https://9to5answer.com/how-to-create-a-bks-bouncycastle-format-java-keystore-that-contains-a-client-certificate-chain

[Luciogi]

@oSumAtrIX can you not use JKS format? Edit: ops this is proprietary format , plz dont implement

[oSumAtrIX]

You can PR if you like.

[ltsdw]

@Luciogi @oSumAtrIX

I think I'm using the recommended version and also using BKS, but still no luck with it. Using the keystore explorer I can switch to version 1, and in that case the exception is different, instead of "Wrong version of key store" I get a "no match". Maybe it's the bcprov version that I'm using?

openjdk 17.0.7 2023-04-18 LTS
OpenJDK Runtime Environment Zulu17.42+19-CA (build 17.0.7+7-LTS)
OpenJDK 64-Bit Server VM Zulu17.42+19-CA (build 17.0.7+7-LTS, mixed mode, sharing)

keytool -genkey -v -keystore patched-yt.keystore -alias patchedyt -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "/usr/share/java/bcprov/bcprov-jdk18on-172.jar" -storetype BKS -keyalg RSA -keysize 2048 -validity 10000

[oSumAtrIX]

Unsure, have you checked the current Implementation in ReVanced CLI?

[ltsdw]

Yes, I did.

[oSumAtrIX]

Trace back the "no match" exception in the Java library and find out what exactly causes it

[Luciogi]

@ltsdw

keytool -genkey -v -keystore patched-yt.keystore -alias patchedyt -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "/usr/share/java/bcprov/bcprov-jdk18on-172.jar" -storetype BKS -keyalg RSA -keysize 2048 -validity 10000

By using command above , It worked https://github.com/revanced/revanced-cli/issues/200#issuecomment-1527316693 error produced because you are not providing password

use -p "YOUR_KEY_PASSWORD"

[oSumAtrIX]

Can you clarify if this is an issue with ReVanced Manager and suggest a solution?

[Luciogi]

@oSumAtrIX custom keys generated using generated with -storetype PKCS12 (it is default option in keytool) show below error

java.io.IOException: Wrong version of key store.
        at org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi.engineLoad(Unknown Source)
        at java.base/java.security.KeyStore.load(KeyStore.java:1473)
        at app.revanced.utils.signing.Signer.signApk(Signer.kt:63)
        at app.revanced.cli.signing.Signing.sign(Signing.kt:10)
        at app.revanced.cli.command.MainCommand.run(MainCommand.kt:166)
        at picocli.CommandLine.executeUserObject(CommandLine.java:2026)
        at picocli.CommandLine.access$1500(CommandLine.java:148)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
        at picocli.CommandLine.execute(CommandLine.java:2170)
        at app.revanced.cli.main.MainKt.main(Main.kt:7)

Using keytype BKS in revanced-cli without password result in error

java.security.UnrecoverableKeyException: no match
        at org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi$StoreEntry.getObject(Unknown Source)
        at org.bouncycastle.jcajce.provider.keystore.bc.BcKeyStoreSpi.engineGetKey(Unknown Source)
        at java.base/java.security.KeyStore.getKey(KeyStore.java:1050)
        at app.revanced.utils.signing.Signer.signApk(Signer.kt:68)
        at app.revanced.cli.signing.Signing.sign(Signing.kt:10)
        at app.revanced.cli.command.MainCommand.run(MainCommand.kt:166)
        at picocli.CommandLine.executeUserObject(CommandLine.java:2026)
        at picocli.CommandLine.access$1500(CommandLine.java:148)
        at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
        at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
        at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
        at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
        at picocli.CommandLine.execute(CommandLine.java:2170)
        at app.revanced.cli.main.MainKt.main(Main.kt:7)

I guess errors should be clear:

• Password check , if password is provided or not
• And error should mention which keystore is supported by revanced-cli

[XDream8]

@oSumAtrIX revanced-cli supports version 3 keystores now?

[oSumAtrIX]

It never dropped support.