{"record":{"id":"b540e18489bd37a6","repo":"phacility/phabricator","slug":"aborted-workflow","errorCode":null,"errorMessage":"Aborted workflow.","messagePattern":"Aborted workflow\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"info","filePath":"src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php","lineNumber":84,"sourceCode":"    $pkcs8_key = Filesystem::readFile($pkcs8_keyfile);\n\n    $warning = pht(\n      'Adding a PKCS8 keyfile to the cache can be very dangerous. If the '.\n      'PKCS8 file really encodes a different public key than the one '.\n      'specified, an attacker could use it to gain unauthorized access.'.\n      \"\\n\\n\".\n      'Generally, you should use this option only in a development '.\n      'environment where ssh-keygen is broken and it is inconvenient to '.\n      'fix it, and only if you are certain you understand the risks. You '.\n      'should never cache a PKCS8 file you did not generate yourself.');\n\n    $console->writeOut(\n      \"%s\\n\",\n      phutil_console_wrap($warning));\n\n    $prompt = pht('Really trust this PKCS8 keyfile?');\n    if (!phutil_console_confirm($prompt)) {\n      throw new PhutilArgumentUsageException(\n        pht('Aborted workflow.'));\n    }\n\n    $key = PhabricatorAuthSSHPublicKey::newFromRawKey($public_key);\n    $key->forcePopulatePKCS8Cache($pkcs8_key);\n\n    $console->writeOut(\n      \"%s\\n\",\n      pht('Cached PKCS8 key for public key.'));\n\n    return 0;\n  }\n\n}\n","sourceCodeStart":66,"sourceCodeEnd":99,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php#L66-L99","documentation":"The workflow prints a security warning (a wrong PKCS8 cache entry can grant an attacker unauthorized access) and asks 'Really trust this PKCS8 keyfile?' via phutil_console_confirm(). Any answer other than 'y' — including EOF when there is no TTY — throws PhutilArgumentUsageException and nothing is written to the cache. This is an intentional abort, not a malfunction.","triggerScenarios":"Answering 'n' at the confirmation prompt; running the command non-interactively (pipelines, cron) where the prompt reads EOF and is treated as a decline.","commonSituations":"Operator reconsiders after reading the danger warning; automation invokes the command without a terminal attached.","solutions":["Re-run the command and answer 'y' only if you generated and verified the PKCS8 file yourself.","When scripting is unavoidable, run it under a real TTY (or expect) so the confirmation is deliberate.","Prefer fixing a broken ssh-keygen in the environment instead of hand-caching PKCS8 files — that is the supported path."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# only attempt interactively; the prompt requires a human 'y'\nif [ -t 0 ] && [ -t 1 ]; then\n  ./bin/auth cache-pkcs8 --public \"$PUB\" --pkcs8 \"$PKCS8\"\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat the confirm prompt as a security gate; only proceed when you generated the PKCS8 file yourself.","Do not automate this command — it is designed to need a human decision.","Prefer repairing ssh-keygen in the environment over hand-caching PKCS8 files."],"tags":["cli","confirmation","cache-pkcs8","phabricator"],"backgroundTag":"cli-confirmation-declined","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}