phacility/phabricator · error · Exception

Publisher key "%s" is not valid: publisher keys may only con

Error message

Publisher key "%s" is not valid: publisher keys may only contain lowercase latin letters.

What it means

Thrown by PhabricatorPackagesPublisher::assertValidPublisherKey() when the key contains anything other than pure lowercase latin letters (enforced by /^[a-z]+\z/). Because keys are embedded directly in URIs and used as literal match keys, uppercase letters, digits, underscores, hyphens, spaces, and multibyte characters are all rejected.

Source

Thrown at src/applications/packages/storage/PhabricatorPackagesPublisher.php:97

    if (!$length) {
      throw new Exception(
        pht(
          'Publisher key "%s" is not valid: publisher keys are required.',
          $value));
    }

    $max_length = 64;
    if ($length > $max_length) {
      throw new Exception(
        pht(
          'Publisher key "%s" is not valid: publisher keys must not be '.
          'more than %s characters long.',
          $value,
          new PhutilNumber($max_length)));
    }

    if (!preg_match('/^[a-z]+\z/', $value)) {
      throw new Exception(
        pht(
          'Publisher key "%s" is not valid: publisher keys may only contain '.
          'lowercase latin letters.',
          $value));
    }
  }


/* -(  PhabricatorSubscribableInterface  )----------------------------------- */


  public function isAutomaticallySubscribed($phid) {
    return false;
  }


/* -(  Policy Interface  )--------------------------------------------------- */

View on GitHub (pinned to 5720a38cfe)

Solutions

Normalize the key: strtolower() it, then strip everything matching /[^a-z]+/.
If digits or separators are essential to your scheme, move them into the publisher name and keep the key strictly alphabetic.
Validate against ^[a-z]+$ client-side before submitting the form.

Example fix

// before
$key = 'Acme_Corp2020';

// after
$key = preg_replace('/[^a-z]+/', '', strtolower('Acme_Corp2020'));
// $key is now 'acmecorp'
PhabricatorPackagesPublisher::assertValidPublisherKey($key);

Defensive patterns

Strategy: validation

Validate before calling

$key = preg_replace('/[^a-z]+/', '', strtolower($raw_key));
if (!preg_match('/^[a-z]+\z/', $key)) {
  // still invalid (e.g. empty after strip) - reject with a form error
}
PhabricatorPackagesPublisher::assertValidPublisherKey($key);

Type guard

function is_valid_publisher_key($key) {
  return is_string($key) && preg_match('/^[a-z]+\z/', $key) === 1;
}

Try / catch

try {
  PhabricatorPackagesPublisher::assertValidPublisherKey($key);
} catch (Exception $ex) {
  $errors[] = $ex->getMessage();
}

Prevention

Generate keys with strtolower() plus a [^a-z] strip in one normalization step.
Never copy external identifiers (org names, scopes) into keys without normalization.
Add a client-side regex hint ^[a-z]+$ next to the key field.

When it happens

Trigger: Submitting a key such as 'Acme_Corp', 'acme1', 'acme-corp', or 'acme' through the publisher create/edit form or editor transactions; any key that survived a normalization step that only lowercased part of the string.

Common situations: Auto-generating keys from display names without stripping non-letters; copying identifiers from external registries that allow digits and dashes (GitHub org names, npm scopes); i18n names with accented characters.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/6276b01f5ab5f417. Report an issue: GitHub.