{"record":{"id":"69d779b50c80dc6f","repo":"phacility/phabricator","slug":"keyring-configuration-is-invalid-it-describes-mul-69d779","errorCode":null,"errorMessage":"Keyring configuration is invalid: it describes multiple default encryption keys. No more than one key may be the default key. Keys currently configured as defaults: %s.","messagePattern":"Keyring configuration is invalid: it describes multiple default encryption keys\\. No more than one key may be the default key\\. Keys currently configured as defaults: (.+?)\\.","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php","lineNumber":102,"sourceCode":"            throw new Exception(\n              pht(\n                'Keyring specifies an invalid key (\"%s\"): key material '.\n                'should be 32 bytes (256 bits) but has length %s.',\n                $name,\n                new PhutilNumber(strlen($material))));\n          }\n          break;\n        default:\n          throw new Exception(\n            pht(\n              'Keyring configuration is invalid: it describes a key with '.\n              'type \"%s\", but this type is unknown.',\n              $type));\n      }\n    }\n\n    if (count($defaults) > 1) {\n      throw new Exception(\n        pht(\n          'Keyring configuration is invalid: it describes multiple default '.\n          'encryption keys. No more than one key may be the default key. '.\n          'Keys currently configured as defaults: %s.',\n          implode(', ', $defaults)));\n    }\n  }\n\n}\n","sourceCodeStart":84,"sourceCodeEnd":112,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php#L84-L112","documentation":"While walking the keyring list, the validator collects names of entries with \"default\": true; if more than one accumulates, the config is rejected listing the offending names. PhabricatorKeyring::getDefaultKeyName() returns a single default, so an ambiguous default set is a configuration error, not a first-wins situation.","triggerScenarios":"Marking the new rotation key as default without removing the flag from the old one; merging two keyring configs where each had a default.","commonSituations":"Key rotation procedures that add a key and set default:true but forget to clear the previous entry's flag.","solutions":["Keep exactly one default entry — the newest key — and remove \"default\": true (or set false) on all others","The message lists the current default names; use it to find the entries to edit"],"exampleFix":"// before\n[\n  {\"name\": \"prod-2023\", \"type\": \"aes-256-cbc\", \"material.base64\": \"<OLD>\", \"default\": true},\n  {\"name\": \"prod-2024\", \"type\": \"aes-256-cbc\", \"material.base64\": \"<NEW>\", \"default\": true}\n]\n\n// after\n[\n  {\"name\": \"prod-2023\", \"type\": \"aes-256-cbc\", \"material.base64\": \"<OLD>\"},\n  {\"name\": \"prod-2024\", \"type\": \"aes-256-cbc\", \"material.base64\": \"<NEW>\", \"default\": true}\n]","handlingStrategy":"validation","validationCode":"$defaults = array();\nforeach ($value as $spec) {\n  if (idx($spec, 'default')) {\n    $defaults[] = $spec['name'];\n  }\n}\nif (count($defaults) > 1) {\n  // Multiple defaults: \" . implode(', ', $defaults) . \" — keep exactly one.\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Rotation checklist: add new key, set default on it, remove default from the old key — in one change","Assert count(defaults) === 1 in config CI"],"tags":["config","keyring","validation","phabricator"],"backgroundTag":"config-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}