{"record":{"id":"22c1ff4e5dfa9abc","repo":"phacility/phabricator","slug":"public-key-with-id-s-is-already-trusted","errorCode":null,"errorMessage":"Public key with ID %s is already trusted.","messagePattern":"Public key with ID (.+?) is already trusted\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"warning","filePath":"src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php","lineNumber":44,"sourceCode":"        pht('Specify a public key to trust with --id.'));\n    }\n\n    $key = id(new PhabricatorAuthSSHKeyQuery())\n      ->setViewer($this->getViewer())\n      ->withIDs(array($id))\n      ->executeOne();\n    if (!$key) {\n      throw new PhutilArgumentUsageException(\n        pht('No public key exists with ID \"%s\".', $id));\n    }\n\n    if (!$key->getIsActive()) {\n      throw new PhutilArgumentUsageException(\n        pht('Public key \"%s\" is not an active key.', $id));\n    }\n\n    if ($key->getIsTrusted()) {\n      throw new PhutilArgumentUsageException(\n        pht('Public key with ID %s is already trusted.', $id));\n    }\n\n    if (!($key->getObject() instanceof AlmanacDevice)) {\n      throw new PhutilArgumentUsageException(\n        pht('You can only trust keys associated with Almanac devices.'));\n    }\n\n    $handle = id(new PhabricatorHandleQuery())\n      ->setViewer($this->getViewer())\n      ->withPHIDs(array($key->getObject()->getPHID()))\n      ->executeOne();\n\n    $console->writeOut(\n      \"**<bg:red> %s </bg>**\\n\\n%s\\n\\n%s\\n\\n%s\",\n      pht('IMPORTANT!'),\n      phutil_console_wrap(\n        pht(","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php#L26-L62","documentation":"Usage exception from `bin/almanac trust-key`: the addressed key already has isTrusted set, so the command has nothing to do and aborts rather than pretending to change state. This is effectively an idempotency guard; it usually appears when re-running a provisioning script, or when the trust step succeeded earlier and the failure the operator is chasing (e.g. in register) lies elsewhere.","triggerScenarios":"Re-running trust-key after it already succeeded; a runbook that unconditionally trusts before register, executed twice; register still complaining about trust because the trusted key belongs to a DIFFERENT device than the one being registered.","commonSituations":"Non-idempotent provisioning scripts; debugging register's 'not yet trusted' error and firing trust-key at the wrong key ID; key rotation where the old key remains trusted.","solutions":["Treat it as success if this is the key you wanted trusted; proceed to bin/almanac register.","If register still says 'not yet trusted', verify you trusted the key whose ID register is actually using for THAT device (compare IDs on the device's key list).","Make provisioning scripts check state first (or tolerate this specific message) instead of unconditionally calling trust-key."],"exampleFix":"# before (script always trusts)\nbin/almanac trust-key --id 42 || exit 1\n\n# after (tolerate the already-trusted case)\nbin/almanac trust-key --id 42 || \\\n  grep -q 'already trusted' /dev/stdin <<<\"$output\" || exit 1\n# simpler: run trust-key, ignore failure whose message contains 'already trusted'","handlingStrategy":"fallback","validationCode":"// Skip trust when already trusted\nif (!$key->getIsTrusted()) {\n  // proceed: bin/almanac trust-key --id <id>\n} else {\n  // already trusted; nothing to do\n}","typeGuard":null,"tryCatchPattern":"# idempotent shell trust step\nout=$(bin/almanac trust-key --id \"$KEY_ID\" 2>&1) || {\n  echo \"$out\" | grep -q 'already trusted' || { echo \"$out\" >&2; exit 1; }\n  echo \"key $KEY_ID already trusted; continuing\"\n}","preventionTips":["Make trust steps conditional/tolerant of 'already trusted' so scripts are idempotent.","When register still fails after this message, suspect a key/device mismatch, not trust state.","Record desired trusted-key IDs per device and reconcile rather than blindly re-trusting."],"tags":["phabricator","almanac","cli","idempotency","trust-key","no-op"],"backgroundTag":"duplicate-operation","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}