phacility/phabricator · error · Exception

Keyring configuration is not valid: each entry in the list m

Error message

Keyring configuration is not valid: each entry in the list must be a dictionary describing an encryption key, but the value with index "%s" is not a dictionary.

What it means

Each element of the 'keyring' config list must itself be a dictionary describing one encryption key; this variant is thrown when the entry at the printed index is not an array. It is the second check in PhabricatorKeyringConfigOptionType::validateOption(), after the top-level list check. Typically the list contains bare strings instead of objects.

Source

Thrown at src/applications/files/keyring/PhabricatorKeyringConfigOptionType.php:16

<?php

final class PhabricatorKeyringConfigOptionType
  extends PhabricatorConfigJSONOptionType {

  public function validateOption(PhabricatorConfigOption $option, $value) {
    if (!is_array($value)) {
      throw new Exception(
        pht(
          'Keyring configuration is not valid: value must be a '.
          'list of encryption keys.'));
    }

    foreach ($value as $index => $spec) {
      if (!is_array($spec)) {
        throw new Exception(
          pht(
            'Keyring configuration is not valid: each entry in the list must '.
            'be a dictionary describing an encryption key, but the value '.
            'with index "%s" is not a dictionary.',
            $index));
      }
    }


    $map = array();
    $defaults = array();
    foreach ($value as $index => $spec) {
      try {
        PhutilTypeSpec::checkMap(
          $spec,
          array(
            'name' => 'string',
            'type' => 'string',

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Wrap every entry in an object with the required fields: name, type, material.base64 (and optional default)
2. If you wrote a JSON object keyed by key names, convert it to a list where each item has a "name" field

Example fix

// before
["prod-2024", "prod-2023"]

// after
[
  {"name": "prod-2024", "type": "aes-256-cbc", "material.base64": "...", "default": true},
  {"name": "prod-2023", "type": "aes-256-cbc", "material.base64": "..."}
]

foreach ($value as $index => $spec) {
  if (!is_array($spec)) {
    // Entry {$index} must be a dictionary with name/type/material.base64.
  }
}

function isKeyringEntryDict($spec) {
  return is_array($spec);
}

When it happens

Trigger: Setting keyring to ["key1","key2"]; a list where one entry is a dict and another is a scalar; JSON written as an object keyed by name instead of a list of objects with a name field.

Common situations: Hand-writing the keyring JSON for the first time; converting from a name=>material map format into the required list-of-dicts shape.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Keyring configuration is not valid: value must be a list of
• Keyring configuration has an invalid key specification (at i
• Keyring configuration is invalid: it describes multiple keys
• Keyring specifies an invalid key ("%s"): key material should
• Keyring specifies an invalid key ("%s"): key material should

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/772c2c7bf262a203. Report an issue: GitHub.