{"record":{"id":"bcbcf64ca08dea29","repo":"phacility/phabricator","slug":"public-key-type-should-be-one-of-s","errorCode":null,"errorMessage":"Public key type should be one of: %s","messagePattern":"Public key type should be one of: (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/auth/sshkey/PhabricatorAuthSSHPublicKey.php","lineNumber":70,"sourceCode":"        // This is the expected case.\n        break;\n    }\n\n    list($type, $body, $comment) = $parts;\n\n    $recognized_keys = array(\n      'ssh-dsa',\n      'ssh-dss',\n      'ssh-rsa',\n      'ssh-ed25519',\n      'ecdsa-sha2-nistp256',\n      'ecdsa-sha2-nistp384',\n      'ecdsa-sha2-nistp521',\n    );\n\n    if (!in_array($type, $recognized_keys)) {\n      $type_list = implode(', ', $recognized_keys);\n      throw new Exception(\n        pht(\n          'Public key type should be one of: %s',\n          $type_list));\n    }\n\n    $public_key = new PhabricatorAuthSSHPublicKey();\n    $public_key->type = $type;\n    $public_key->body = $body;\n    $public_key->comment = $comment;\n\n    return $public_key;\n  }\n\n  public function getType() {\n    return $this->type;\n  }\n\n  public function getBody() {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/sshkey/PhabricatorAuthSSHPublicKey.php#L52-L88","documentation":"After splitting, newFromRawKey() validates the first field (key type) against a fixed whitelist: ssh-dsa, ssh-dss, ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256/384/521. Anything else - with the allowed list interpolated into the message - is rejected before the PhabricatorAuthSSHPublicKey object is constructed.","triggerScenarios":"Uploading a key whose type token is not whitelisted: hardware-security keys (sk-ssh-ed25519@openssh.com), OpenSSH certificates (*-cert-v01@openssh.com), legacy ssh-rsa1, or a typo in the type prefix.","commonSituations":"Newer OpenSSH client features (FIDO/sk- keys), SSH certificates instead of plain public keys, very old RSA1 keys, or hand-typed key lines with the algorithm misspelled.","solutions":["Upload a key of a supported type - generate one with: ssh-keygen -t ed25519","If you have a certificate or sk- key, generate a separate plain supported key for Phabricator","Check the first word of the pasted line for typos against the allowed list in the error message"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check the type token against the supported set before parsing:\n$supported = array(\n  'ssh-dsa', 'ssh-dss', 'ssh-rsa', 'ssh-ed25519',\n  'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521',\n);\n$type = head(explode(' ', trim($raw)));\nif (!in_array($type, $supported, true)) {\n  return pht('Generate a supported key: ssh-keygen -t ed25519');\n}","typeGuard":null,"tryCatchPattern":"try {\n  $public_key = PhabricatorAuthSSHPublicKey::newFromRawKey($raw);\n} catch (Exception $ex) {\n  // Message lists every allowed type: relay it verbatim to the user.\n  $e_key = $ex->getMessage();\n}","preventionTips":["Standardize on ssh-ed25519 or ecdsa keys when generating credentials for this system","Do not upload OpenSSH certificates or sk-/FIDO keys - generate a plain supported key instead"],"tags":["ssh","public-key","key-type","phabricator","ed25519","ecdsa"],"backgroundTag":"unsupported-ssh-key-type","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}