{"record":{"id":"9baba61c49d01027","repo":"phacility/phabricator","slug":"public-key-s-is-not-an-active-key","errorCode":null,"errorMessage":"Public key \"%s\" is not an active key.","messagePattern":"Public key \"(.+?)\" is not an active key\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php","lineNumber":39,"sourceCode":"    $console = PhutilConsole::getConsole();\n\n    $id = $args->getArg('id');\n    if (!$id) {\n      throw new PhutilArgumentUsageException(\n        pht('Specify a public key to trust with --id.'));\n    }\n\n    $key = id(new PhabricatorAuthSSHKeyQuery())\n      ->setViewer($this->getViewer())\n      ->withIDs(array($id))\n      ->executeOne();\n    if (!$key) {\n      throw new PhutilArgumentUsageException(\n        pht('No public key exists with ID \"%s\".', $id));\n    }\n\n    if (!$key->getIsActive()) {\n      throw new PhutilArgumentUsageException(\n        pht('Public key \"%s\" is not an active key.', $id));\n    }\n\n    if ($key->getIsTrusted()) {\n      throw new PhutilArgumentUsageException(\n        pht('Public key with ID %s is already trusted.', $id));\n    }\n\n    if (!($key->getObject() instanceof AlmanacDevice)) {\n      throw new PhutilArgumentUsageException(\n        pht('You can only trust keys associated with Almanac devices.'));\n    }\n\n    $handle = id(new PhabricatorHandleQuery())\n      ->setViewer($this->getViewer())\n      ->withPHIDs(array($key->getObject()->getPHID()))\n      ->executeOne();\n","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php#L21-L57","documentation":"Usage exception from `bin/almanac trust-key`: the addressed key exists but $key->getIsActive() is false, i.e. the key was deactivated (or never activated) in Phabricator's SSH key store. Trusting an inactive key would grant authority to a credential that cannot authenticate, so the workflow refuses. Deactivation is Phabricator's soft-delete for SSH keys.","triggerScenarios":"Trusting a key an admin deactivated during rotation or compromise response; trusting a key that isStill listed by ID but was disabled on the user/device; automation retrying an old key ID after the key was replaced and deactivated.","commonSituations":"Key-rotation leftovers where old keys are deactivated but scripts still reference them; incident response disabling a leaked key while onboarding its replacement.","solutions":["Reactivate the key from its detail page (or re-upload an active copy) if it should be usable, then rerun trust-key.","If the key was deactivated intentionally, upload and trust the replacement key instead and point register at its private key.","Update automation to discover the current active key's ID rather than pinning an old one."],"exampleFix":"# before\n$ bin/almanac trust-key --id 42\nUsage Exception: Public key \"42\" is not an active key.\n\n# after\n# web UI: reactivate key 42 (auth/sshkey/view/42/) or upload new active key 57\n$ bin/almanac trust-key --id 57","handlingStrategy":"validation","validationCode":"if (!$key->getIsActive()) {\n  throw new RuntimeException(\n    'Key '.$key->getID().' is deactivated; activate it or upload/trust a new key.');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check key active state as part of the trust preflight.","During rotation, point automation at the new key's ID immediately after upload.","Keep deactivated keys out of ID inventories; prune them from scripts."],"tags":["phabricator","almanac","cli","invalid-state","trust-key","ssh-key"],"backgroundTag":"invalid-resource-state","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}