{"record":{"id":"970fcbe497ed91eb","repo":"phacility/phabricator","slug":"the-public-key-corresponding-to-the-given-private-970fcb","errorCode":null,"errorMessage":"The public key corresponding to the given private key is already associated with an object (\"%s\") other than the specified device (\"%s\"). You can not use a single private key to identify multiple devices or users.","messagePattern":"The public key corresponding to the given private key is already associated with an object \\(\"(.+?)\"\\) other than the specified device \\(\"(.+?)\"\\)\\. You can not use a single private key to identify multiple devices or users\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php","lineNumber":160,"sourceCode":"      ->setViewer($this->getViewer())\n      ->withKeys(array($key_object))\n      ->withIsActive(true)\n      ->executeOne();\n\n    if (!$public_key) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is unknown. '.\n          'Associate the public key with an Almanac device in the web '.\n          'interface before registering hosts with it.'));\n    }\n\n    if ($public_key->getObjectPHID() !== $device->getPHID()) {\n      $public_phid = $public_key->getObjectPHID();\n      $public_handles = $viewer->loadHandles(array($public_phid));\n      $public_handle = $public_handles[$public_phid];\n\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is already '.\n          'associated with an object (\"%s\") other than the specified '.\n          'device (\"%s\"). You can not use a single private key to identify '.\n          'multiple devices or users.',\n          $public_handle->getFullName(),\n          $device->getName()));\n    }\n\n    if (!$public_key->getIsTrusted()) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is '.\n          'properly associated with the device, but is not yet trusted. '.\n          'Trust this key before registering devices with it.'));\n    }\n\n    echo tsprintf(","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php#L142-L178","documentation":"Usage exception from `bin/almanac register`: the public key derived from your private key IS known and active, but it is attached to a different object (another device or a user account) than the --device you named. Almanac deliberately forbids one key identifying multiple devices/users, because host identity would become ambiguous. The message names both the current owner and your target device.","triggerScenarios":"Registering host B with the private key whose public key belongs to device A; the key was uploaded to a user (e.g. an admin's account) and you now try to register a device with it; after cloning a host, reusing the original's key for the clone's device.","commonSituations":"Golden-image/clone provisioning that copies SSH keys; admins testing registration with their personal key; moving a device identity without revoking the old association first.","solutions":["Generate a dedicated key pair for this device and upload its public key to the device (device -> Manage -> SSH Keys), then register with that private key.","If the old association is obsolete, remove/deactivate the public key from the other object first, then re-run register.","Never reuse a key between a user account and a device, or between two devices."],"exampleFix":"# before (device.key's public key is attached to user 'alice')\n$ bin/almanac register --device web-001 --private-key alice_key\nUsage Exception: ... already associated with an object (\"alice\") other than the specified device (\"web-001\") ...\n\n# after\n$ ssh-keygen -t ed25519 -f web001.key -N ''\n# upload web001.key.pub to device web-001 via Manage -> SSH Keys\n$ sudo bin/almanac register --force --device web-001 --private-key web001.key","handlingStrategy":"validation","validationCode":"// Ensure the key is attached to THIS device before registering\nif ($match->getObjectPHID() !== $device->getPHID()) {\n  throw new RuntimeException(sprintf(\n    'Key belongs to %s, not %s; generate a dedicated key for this device.',\n    $match->getObjectPHID(), $device->getName()));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mint one key pair per device; never share keys across hosts, users, or clones.","When cloning hosts, generate a fresh identity and register it, rather than copying key files.","Audit periodically: every active trusted key should map to exactly one device."],"tags":["phabricator","almanac","cli","register","ssh-key","identity-conflict"],"backgroundTag":"ssh-key-already-in-use","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}