phacility/phabricator · info · PhutilArgumentUsageException

Aborted workflow.

Error message

Aborted workflow.

What it means

The workflow prints a security warning (a wrong PKCS8 cache entry can grant an attacker unauthorized access) and asks 'Really trust this PKCS8 keyfile?' via phutil_console_confirm(). Any answer other than 'y' — including EOF when there is no TTY — throws PhutilArgumentUsageException and nothing is written to the cache. This is an intentional abort, not a malfunction.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php:84

    $pkcs8_key = Filesystem::readFile($pkcs8_keyfile);

    $warning = pht(
      'Adding a PKCS8 keyfile to the cache can be very dangerous. If the '.
      'PKCS8 file really encodes a different public key than the one '.
      'specified, an attacker could use it to gain unauthorized access.'.
      "\n\n".
      'Generally, you should use this option only in a development '.
      'environment where ssh-keygen is broken and it is inconvenient to '.
      'fix it, and only if you are certain you understand the risks. You '.
      'should never cache a PKCS8 file you did not generate yourself.');

    $console->writeOut(
      "%s\n",
      phutil_console_wrap($warning));

    $prompt = pht('Really trust this PKCS8 keyfile?');
    if (!phutil_console_confirm($prompt)) {
      throw new PhutilArgumentUsageException(
        pht('Aborted workflow.'));
    }

    $key = PhabricatorAuthSSHPublicKey::newFromRawKey($public_key);
    $key->forcePopulatePKCS8Cache($pkcs8_key);

    $console->writeOut(
      "%s\n",
      pht('Cached PKCS8 key for public key.'));

    return 0;
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Re-run the command and answer 'y' only if you generated and verified the PKCS8 file yourself.
2. When scripting is unavoidable, run it under a real TTY (or expect) so the confirmation is deliberate.
3. Prefer fixing a broken ssh-keygen in the environment instead of hand-caching PKCS8 files — that is the supported path.

# only attempt interactively; the prompt requires a human 'y'
if [ -t 0 ] && [ -t 1 ]; then
  ./bin/auth cache-pkcs8 --public "$PUB" --pkcs8 "$PKCS8"
fi

When it happens

Trigger: Answering 'n' at the confirmation prompt; running the command non-interactively (pipelines, cron) where the prompt reads EOF and is treated as a decline.

Common situations: Operator reconsiders after reading the danger warning; automation invokes the command without a terminal attached.

Related errors

• You must specify the path to a public keyfile with %s.
• Specified public keyfile "%s" does not exist!
• You must specify the path to a pkcs8 keyfile with %s.
• Specified pkcs8 keyfile "%s" does not exist!
• Declining to invoice.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b540e18489bd37a6. Report an issue: GitHub.