phacility/phabricator · warning · PhutilArgumentUsageException

Public key with ID is not trusted.

Error message

Public key with ID %s is not trusted.

What it means

The untrust-key workflow refuses to operate because the key exists but its isTrusted flag is already 0. Untrusting is only meaningful for trusted keys, so the workflow fails fast before writing anything.

Solutions

1. Verify the key's current trust state on its detail page; if already untrusted, no action is needed.
2. If you meant a different key, find the trusted device key's ID and run untrust-key against that.
3. Treat this as a no-op guard, not a corruption: nothing was changed.

$key = id(new PhabricatorAuthSSHKeyQuery())
  ->setViewer($viewer)
  ->withIDs(array($id))
  ->executeOne();
if ($key && !$key->getIsTrusted()) {
  // Already untrusted: skip the workflow instead of triggering its exception.
  echo "Key {$id} is not trusted; nothing to do.\n";
  return;
}

function isTrustedKey(PhabricatorAuthSSHKey $key) {
  return (bool)$key->getIsTrusted();
}

try {
  // run untrust-key
} catch (PhutilArgumentUsageException $ex) {
  if (preg_match('/is not trusted/', $ex->getMessage())) {
    // Idempotent success: treat as no-op.
    exit(0);
  }
  throw $ex;
}

When it happens

Trigger: Running ./bin/almanac untrust-key --id N on a key whose object was never trusted, was already untrusted by a previous run, or whose trust was revoked through the UI.

Common situations: Re-running an untrust command from history after it already succeeded; keying in the wrong ID that happens to belong to an untrusted user key.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• No public key exists with ID
• Public key " " is not an active key.
• Specify a public key to revoke trust for with --id.
• User aborted workflow.
• You can only trust keys associated with Almanac devices.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/43b6c76e2165af78. Report an issue: GitHub.

Appendix: source

Thrown at src/applications/almanac/management/AlmanacManagementUntrustKeyWorkflow.php:39

    $console = PhutilConsole::getConsole();

    $id = $args->getArg('id');
    if (!$id) {
      throw new PhutilArgumentUsageException(
        pht('Specify a public key to revoke trust for with --id.'));
    }

    $key = id(new PhabricatorAuthSSHKeyQuery())
      ->setViewer($this->getViewer())
      ->withIDs(array($id))
      ->executeOne();
    if (!$key) {
      throw new PhutilArgumentUsageException(
        pht('No public key exists with ID "%s".', $id));
    }

    if (!$key->getIsTrusted()) {
      throw new PhutilArgumentUsageException(
        pht('Public key with ID %s is not trusted.', $id));
    }

    $key->setIsTrusted(0);
    $key->save();

    PhabricatorAuthSSHKeyQuery::deleteSSHKeyCache();

    $console->writeOut(
      "**<bg:green> %s </bg>** %s\n",
      pht('TRUST REVOKED'),
      pht('Trust has been revoked for public key %s.', $id));
  }

}

View on GitHub (pinned to 5720a38cfe)