{"record":{"id":"43b6c76e2165af78","repo":"phacility/phabricator","slug":"public-key-with-id-s-is-not-trusted","errorCode":null,"errorMessage":"Public key with ID %s is not trusted.","messagePattern":"Public key with ID (.+?) is not trusted\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"warning","filePath":"src/applications/almanac/management/AlmanacManagementUntrustKeyWorkflow.php","lineNumber":39,"sourceCode":"    $console = PhutilConsole::getConsole();\n\n    $id = $args->getArg('id');\n    if (!$id) {\n      throw new PhutilArgumentUsageException(\n        pht('Specify a public key to revoke trust for with --id.'));\n    }\n\n    $key = id(new PhabricatorAuthSSHKeyQuery())\n      ->setViewer($this->getViewer())\n      ->withIDs(array($id))\n      ->executeOne();\n    if (!$key) {\n      throw new PhutilArgumentUsageException(\n        pht('No public key exists with ID \"%s\".', $id));\n    }\n\n    if (!$key->getIsTrusted()) {\n      throw new PhutilArgumentUsageException(\n        pht('Public key with ID %s is not trusted.', $id));\n    }\n\n    $key->setIsTrusted(0);\n    $key->save();\n\n    PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();\n\n    $console->writeOut(\n      \"**<bg:green> %s </bg>** %s\\n\",\n      pht('TRUST REVOKED'),\n      pht('Trust has been revoked for public key %s.', $id));\n  }\n\n}\n","sourceCodeStart":21,"sourceCodeEnd":55,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementUntrustKeyWorkflow.php#L21-L55","documentation":"The untrust-key workflow refuses to operate because the key exists but its isTrusted flag is already 0. Untrusting is only meaningful for trusted keys, so the workflow fails fast before writing anything.","triggerScenarios":"Running ./bin/almanac untrust-key --id N on a key whose object was never trusted, was already untrusted by a previous run, or whose trust was revoked through the UI.","commonSituations":"Re-running an untrust command from history after it already succeeded; keying in the wrong ID that happens to belong to an untrusted user key.","solutions":["Verify the key's current trust state on its detail page; if already untrusted, no action is needed.","If you meant a different key, find the trusted device key's ID and run untrust-key against that.","Treat this as a no-op guard, not a corruption: nothing was changed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$key = id(new PhabricatorAuthSSHKeyQuery())\n  ->setViewer($viewer)\n  ->withIDs(array($id))\n  ->executeOne();\nif ($key && !$key->getIsTrusted()) {\n  // Already untrusted: skip the workflow instead of triggering its exception.\n  echo \"Key {$id} is not trusted; nothing to do.\\n\";\n  return;\n}","typeGuard":"function isTrustedKey(PhabricatorAuthSSHKey $key) {\n  return (bool)$key->getIsTrusted();\n}","tryCatchPattern":"try {\n  // run untrust-key\n} catch (PhutilArgumentUsageException $ex) {\n  if (preg_match('/is not trusted/', $ex->getMessage())) {\n    // Idempotent success: treat as no-op.\n    exit(0);\n  }\n  throw $ex;\n}","preventionTips":["Make untrust operations idempotent in scripts: check isTrusted first, then act.","After untrusting, record the key ID and state so re-runs skip it.","Expect this exception when replaying historical commands; do not treat it as data loss."],"tags":["almanac","ssh-keys","invalid-state","cli","phabricator"],"backgroundTag":"invalid-state-transition","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}