{"record":{"id":"ed67201042f78555","repo":"phacility/phabricator","slug":"the-public-key-corresponding-to-the-given-private","errorCode":null,"errorMessage":"The public key corresponding to the given private key is unknown. Associate the public key with an Almanac device in the web interface before registering hosts with it.","messagePattern":"The public key corresponding to the given private key is unknown\\. Associate the public key with an Almanac device in the web interface before registering hosts with it\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php","lineNumber":148,"sourceCode":"    // the `--private-key` flag. The file needs to have restrictive permissions\n    // before `ssh-keygen` will willingly operate on it.\n    $tmp_private = new TempFile();\n    Filesystem::changePermissions($tmp_private, 0600);\n    execx('chown %s %s', $phd_user, $tmp_private);\n    Filesystem::writeFile($tmp_private, $raw_private_key);\n\n    list($raw_public_key) = execx('ssh-keygen -y -f %s', $tmp_private);\n\n    $key_object = PhabricatorAuthSSHPublicKey::newFromRawKey($raw_public_key);\n\n    $public_key = id(new PhabricatorAuthSSHKeyQuery())\n      ->setViewer($this->getViewer())\n      ->withKeys(array($key_object))\n      ->withIsActive(true)\n      ->executeOne();\n\n    if (!$public_key) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is unknown. '.\n          'Associate the public key with an Almanac device in the web '.\n          'interface before registering hosts with it.'));\n    }\n\n    if ($public_key->getObjectPHID() !== $device->getPHID()) {\n      $public_phid = $public_key->getObjectPHID();\n      $public_handles = $viewer->loadHandles(array($public_phid));\n      $public_handle = $public_handles[$public_phid];\n\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is already '.\n          'associated with an object (\"%s\") other than the specified '.\n          'device (\"%s\"). You can not use a single private key to identify '.\n          'multiple devices or users.',\n          $public_handle->getFullName(),","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php#L130-L166","documentation":"Usage exception from `bin/almanac register`: the workflow derived the public key from your private key (ssh-keygen -y) and searched PhabricatorAuthSSHKeyQuery with withKeys(...)->withIsActive(true), but found no matching active public key. Registration authenticates the host by key, so the device's public key must already be uploaded and active on an Almanac device before any host can register with the corresponding private key.","triggerScenarios":"Uploading the public key to a user account instead of the Almanac device; uploading it while it was deactivated; passing a freshly generated private key whose public counterpart was never uploaded; uploading the key to the device after register already failed.","commonSituations":"Operators adding the key under Settings -> SSH Public Keys rather than the device's Manage -> SSH Keys page; key order mistakes in provisioning docs; key deactivated by an admin during rotation.","solutions":["In the web UI, open the Almanac device, use Manage -> SSH Keys -> Add Public Key, paste the public key matching your private key, and activate it.","Re-run bin/almanac register afterwards.","If the key exists but is inactive, reactivate it (or upload a new active one) via the device's key management UI."],"exampleFix":"# before\n$ ssh-keygen -y -f device.key > device.pub   # not uploaded anywhere\n$ bin/almanac register --device web-001 --private-key device.key\nUsage Exception: The public key corresponding to the given private key is unknown. ...\n\n# after\n# 1) Web UI: Almanac -> web-001 -> Manage -> SSH Keys -> Add Public Key (paste device.pub)\n# 2) re-run:\n$ sudo bin/almanac register --force --device web-001 --private-key device.key","handlingStrategy":"validation","validationCode":"// Verify the private key's public counterpart is an ACTIVE key on the device\nlist($raw_pub) = execx('ssh-keygen -y -f %s', $private_path);\n$key_obj = PhabricatorAuthSSHPublicKey::newFromRawKey($raw_pub);\n$match = id(new PhabricatorAuthSSHKeyQuery())\n  ->setViewer($viewer)\n  ->withKeys(array($key_obj))\n  ->withIsActive(true)\n  ->executeOne();\nif (!$match) {\n  throw new RuntimeException('Upload this public key to the device first.');\n}","typeGuard":null,"tryCatchPattern":"# shell: pre-upload via API/UI before register\n# (automation) create device key, then:\nbin/almanac register --device \"$D\" --private-key \"$K\" || {\n  echo \"check device key upload (active) in web UI\" >&2; exit 1; }","preventionTips":["Fold 'upload device public key' into the same provisioning script that registers the host.","Upload device keys from the DEVICE's Manage page, never a user's personal SSH settings.","After any key upload, confirm the key shows active before invoking register."],"tags":["phabricator","almanac","cli","register","ssh-key","trust"],"backgroundTag":"ssh-key-not-registered","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}