{"record":{"id":"f7a1d8dcb190c3e9","repo":"phacility/phabricator","slug":"the-public-key-corresponding-to-the-given-private-f7a1d8","errorCode":null,"errorMessage":"The public key corresponding to the given private key is properly associated with the device, but is not yet trusted. Trust this key before registering devices with it.","messagePattern":"The public key corresponding to the given private key is properly associated with the device, but is not yet trusted\\. Trust this key before registering devices with it\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php","lineNumber":171,"sourceCode":"    }\n\n    if ($public_key->getObjectPHID() !== $device->getPHID()) {\n      $public_phid = $public_key->getObjectPHID();\n      $public_handles = $viewer->loadHandles(array($public_phid));\n      $public_handle = $public_handles[$public_phid];\n\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is already '.\n          'associated with an object (\"%s\") other than the specified '.\n          'device (\"%s\"). You can not use a single private key to identify '.\n          'multiple devices or users.',\n          $public_handle->getFullName(),\n          $device->getName()));\n    }\n\n    if (!$public_key->getIsTrusted()) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'The public key corresponding to the given private key is '.\n          'properly associated with the device, but is not yet trusted. '.\n          'Trust this key before registering devices with it.'));\n    }\n\n    echo tsprintf(\n      \"%s\\n\",\n      pht('Installing public key...'));\n\n    $tmp_public = new TempFile();\n    Filesystem::changePermissions($tmp_public, 0600);\n    execx('chown %s %s', $phd_user, $tmp_public);\n    Filesystem::writeFile($tmp_public, $raw_public_key);\n    execx('mv -f %s %s', $tmp_public, $stored_public_path);\n\n    echo tsprintf(\n      \"%s\\n\",","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php#L153-L189","documentation":"Usage exception from `bin/almanac register`: the public key matches the right device and is active, but its trusted flag is false. Almanac distinguishes uploaded keys (untrusted, no host authority) from trusted keys (a human has verified the key really represents the device); only trusted keys can register hosts. Trust is granted out-of-band by an administrator with `bin/almanac trust-key`.","triggerScenarios":"Following the error-34 fix flow (new key uploaded to device) without running the trust step; a freshly rotated key that was never re-trusted; an admin revoked trust during an incident and re-registration is attempted.","commonSituations":"New cluster bring-up where the runbook skips `bin/almanac trust-key`; key rotation procedures that forget re-trusting; CI registering ephemeral drydock hosts with newly minted keys.","solutions":["Find the key ID (device -> Manage -> SSH Keys shows it, or the register error trail), then run: bin/almanac trust-key --id <key-id>.","Re-run bin/almanac register; it should now install the key files.","For rotation, fold trust-key into the same scripted step that uploads the new public key."],"exampleFix":"# before\n$ sudo bin/almanac register --force --device web-001 --private-key web001.key\nUsage Exception: ... is not yet trusted. Trust this key before registering devices with it.\n\n# after\n$ bin/almanac trust-key --id 42\n$ sudo bin/almanac register --force --device web-001 --private-key web001.key","handlingStrategy":"validation","validationCode":"// Automation: upload key, trust it, then register\n// 1) upload via UI or auth SSH key API on the device\n// 2) trust:\n//    bin/almanac trust-key --id <key-id>\n// guard before register:\nif (!$match->getIsTrusted()) {\n  throw new RuntimeException('Trust the device key first: bin/almanac trust-key --id '.$match->getID());\n}","typeGuard":null,"tryCatchPattern":"# scripted trust-then-register\nbin/almanac trust-key --id \"$KEY_ID\" || true\ngrep -q 'already trusted' <(bin/almanac trust-key --id \"$KEY_ID\" 2>&1) || true\nsudo bin/almanac register --force --device \"$D\" --private-key \"$K\"","preventionTips":["Treat 'upload -> trust-key -> register' as one atomic provisioning unit.","Extract the key ID from the device's key list programmatically instead of by hand.","After rotation, remember trust does not transfer: new key needs its own trust-key run."],"tags":["phabricator","almanac","cli","register","ssh-key","trust"],"backgroundTag":"ssh-key-not-trusted","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}