{"record":{"id":"a5e054d36801040f","repo":"phacility/phabricator","slug":"failed-to-convert-public-key-into-pkcs8-format-if","errorCode":null,"errorMessage":"Failed to convert public key into PKCS8 format. If you are developing on OSX, you may be able to use `%s` to work around this issue. %s","messagePattern":"Failed to convert public key into PKCS8 format\\. If you are developing on OSX, you may be able to use `(.+?)` to work around this issue\\. (.+?)","errorType":"exception","errorClass":"PhutilProxyException","httpStatus":null,"severity":"error","filePath":"src/applications/auth/sshkey/PhabricatorAuthSSHPublicKey.php","lineNumber":129,"sourceCode":"  public function toPKCS8() {\n    $entire_key = $this->getEntireKey();\n    $cache_key = $this->getPKCS8CacheKey($entire_key);\n\n    $cache = PhabricatorCaches::getImmutableCache();\n    $pkcs8_key = $cache->getKey($cache_key);\n    if ($pkcs8_key) {\n      return $pkcs8_key;\n    }\n\n    $tmp = new TempFile();\n    Filesystem::writeFile($tmp, $this->getEntireKey());\n    try {\n      list($pkcs8_key) = execx(\n        'ssh-keygen -e -m PKCS8 -f %s',\n        $tmp);\n    } catch (CommandException $ex) {\n      unset($tmp);\n      throw new PhutilProxyException(\n        pht(\n          'Failed to convert public key into PKCS8 format. If you are '.\n          'developing on OSX, you may be able to use `%s` '.\n          'to work around this issue. %s',\n          'bin/auth cache-pkcs8',\n          $ex->getMessage()),\n        $ex);\n    }\n    unset($tmp);\n\n    $cache->setKey($cache_key, $pkcs8_key);\n\n    return $pkcs8_key;\n  }\n\n  public function forcePopulatePKCS8Cache($pkcs8_key) {\n    $entire_key = $this->getEntireKey();\n    $cache_key = $this->getPKCS8CacheKey($entire_key);","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/sshkey/PhabricatorAuthSSHPublicKey.php#L111-L147","documentation":"PhabricatorAuthSSHPublicKey::getPKCS8Key() first tries the cache, then writes the key to a TempFile and runs 'ssh-keygen -e -m PKCS8 -f <tmp>' to re-encode it. If execx() raises a CommandException, it is wrapped in a PhutilProxyException whose message suggests 'bin/auth cache-pkcs8' as an OSX workaround and embeds the underlying ssh-keygen error.","triggerScenarios":"The system ssh-keygen cannot re-encode the stored key into PKCS8 - classically macOS's bundled ssh-keygen (LibreSSL-era) that ignores '-m PKCS8' and emits RFC4716 instead, or a key body that passed storage validation but fails conversion on the host doing the conversion.","commonSituations":"Development installs on OSX hitting this on first PKCS8 conversion before any cache entry exists; hosts where /usr/bin/ssh-keygen is a vendor build with different '-m' behavior; SSH trust/cluster communication setups that need PKCS8 forms.","solutions":["Run the documented workaround: './bin/auth cache-pkcs8' to precompute and store PKCS8 key bodies in the cache","Install a real OpenSSH build earlier in PATH (e.g. brew install openssh on macOS) so system ssh-keygen honors '-m PKCS8'","Inspect the chained CommandException message (getPrevious()) for the exact ssh-keygen stderr to confirm the cause"],"exampleFix":"# before\n$ echo test | ssh-keygen -e -m PKCS8 -f /dev/stdin   # wrong/copy output on OSX ssh-keygen\n\n# after\n$ brew install openssh\n$ /usr/local/opt/openssh/bin/ssh-keygen -e -m PKCS8 -f ./id_ed25519.pub  # valid PKCS8\n$ ./bin/auth cache-pkcs8","handlingStrategy":"try-catch","validationCode":"// Pre-warm the cache so runtime conversion never needs ssh-keygen:\n// run once during deploy on a host with a known-good ssh-keygen:\n//   ./bin/auth cache-pkcs8\n// Then getPKCS8Key() hits the cache and never shells out.","typeGuard":null,"tryCatchPattern":"try {\n  $pkcs8 = $public_key->getPKCS8Key();\n} catch (PhutilProxyException $ex) {\n  $cause = $ex->getPrevious(); // CommandException: real ssh-keygen stderr\n  // Fallback: precompute via './bin/auth cache-pkcs8', or point PATH\n  // at a real OpenSSH ssh-keygen build, then retry.\n}","preventionTips":["Run 'bin/auth cache-pkcs8' after initial setup on OSX hosts - it is the documented workaround","Verify 'ssh-keygen -e -m PKCS8 -f somekey.pub' produces -----BEGIN PUBLIC KEY----- output on hosts doing conversion","Treat conversion failures as environment issues first (vendor ssh-keygen), key issues second"],"tags":["ssh","public-key","pkcs8","ssh-keygen","phabricator","macos"],"backgroundTag":"ssh-key-conversion-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}