{"record":{"id":"5a49dff322ca5ce3","repo":"clockworklabs/SpacetimeDB","slug":"aborted-5a49df","errorCode":null,"errorMessage":"Aborted","messagePattern":"Aborted","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"warning","filePath":"crates/cli/src/subcommands/server.rs","lineNumber":275,"sourceCode":"\n            Ok(true)\n        }\n    } else {\n        println!(\"No saved fingerprint for server {nick_or_host}. New fingerprint:\\n{new_fing}\");\n\n        config.set_server_fingerprint(server, new_fing)?;\n\n        Ok(true)\n    }\n}\n\npub async fn exec_fingerprint(mut config: Config, args: &ArgMatches) -> Result<(), anyhow::Error> {\n    let server = args.get_one::<String>(\"server\").unwrap().as_str();\n    let force = args.get_flag(\"force\");\n\n    if update_server_fingerprint(&mut config, Some(server)).await? {\n        if !y_or_n(force, \"Continue?\")? {\n            anyhow::bail!(\"Aborted\");\n        }\n\n        config.save();\n    }\n\n    Ok(())\n}\n\npub async fn exec_ping(config: Config, args: &ArgMatches) -> Result<(), anyhow::Error> {\n    let server = args.get_one::<String>(\"server\").unwrap().as_str();\n    let url = config.get_host_url(Some(server))?;\n\n    let builder = reqwest::Client::new().get(format!(\"{url}/v1/ping\").as_str());\n    let response = builder.send().await?;\n\n    match response.status() {\n        reqwest::StatusCode::OK => {\n            println!(\"Server is online: {url}\");","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/clockworklabs/SpacetimeDB/blob/6dee26c6efc2856793e12b148a59742964f5d783/crates/cli/src/subcommands/server.rs#L257-L293","documentation":"`spacetime server fingerprint <server>` fetches the server's current fingerprint (its long-term public key used to pin TLS), compares it with the one saved in CLI config, and prints old vs new when they differ (or prints the new one when none was saved). It then asks 'Continue?' before persisting; this error means you declined, so the config keeps the previous fingerprint. This is the same trust decision as SSH's 'host key changed' warning.","triggerScenarios":"`spacetime server fingerprint <server>` without --force where the server's keypair changed (reinstall, fresh data dir, new container) or no fingerprint was stored yet, and the user answers 'n' to 'Continue?'.","commonSituations":"Local `spacetime start` recreated with a wiped data dir/keys; testnet or staging infrastructure rotation; the rare genuine man-in-the-middle case -- the one situation where declining is correct.","solutions":["If you know the server legitimately changed (reinstall/dev server), re-run and answer 'y', or pass `--force` to accept non-interactively.","If the change is unexpected, stop and verify the new fingerprint out-of-band before trusting it; do not blindly --force.","Alternatively remove and re-add the server: `spacetime server remove <name>` then `spacetime server add ...`."],"exampleFix":"# before\nspacetime server fingerprint myserver   # answer n -> Aborted\n# after\nspacetime server fingerprint myserver --force","handlingStrategy":"validation","validationCode":"# Non-interactive provisioning: pin the expected fingerprint out-of-band\nEXPECTED=<sha256 of server cert/public key>\nACTUAL=$(spacetime server fingerprint myserver --force 2>/dev/null)\n# compare EXPECTED vs the printed fingerprint in your provisioning logic before trusting","typeGuard":null,"tryCatchPattern":"Wrap `spacetime server fingerprint` and on 'Aborted' exit, surface the old/new fingerprints from stdout for an out-of-band trust decision instead of failing silently","preventionTips":["Record server fingerprints when provisioning servers so changes are detectable and explainable.","Expect this prompt after any server reinstall; pass --force only when the change is explained.","Treat an unexplained fingerprint change as a possible MITM and verify out-of-band first."],"tags":["server","fingerprint","tls","confirmation","trust-on-first-use"],"backgroundTag":"server-fingerprint-changed","analyzedSha":"6dee26c6efc2856793e12b148a59742964f5d783","analyzedAt":"2026-08-20T06:08:37.179Z","contentChangedAt":"2026-08-20T06:08:37.179Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}