What causes "Specified pkcs8 keyfile "%s" does not exist!" in phacility/phabricator?

Verify the file exists: ls -l from the invocation directory.

phacility/phabricator · warning · PhutilArgumentUsageException

Specified pkcs8 keyfile "%s" does not exist!

Error message

Specified pkcs8 keyfile "%s" does not exist!

What it means

--pkcs8 was provided, but Filesystem::pathExists() finds no file at that path, so the workflow aborts before reading the PKCS8 key. Same path-resolution failure as the public-keyfile check, applied to the PKCS8 side.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php:60

    if (!Filesystem::pathExists($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified public keyfile "%s" does not exist!',
          $public_keyfile));
    }

    $public_key = Filesystem::readFile($public_keyfile);

    $pkcs8_keyfile = $args->getArg('pkcs8');
    if (!strlen($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a pkcs8 keyfile with %s.',
          '--pkc8s'));
    }

    if (!Filesystem::pathExists($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified pkcs8 keyfile "%s" does not exist!',
          $pkcs8_keyfile));
    }

    $pkcs8_key = Filesystem::readFile($pkcs8_keyfile);

    $warning = pht(
      'Adding a PKCS8 keyfile to the cache can be very dangerous. If the '.
      'PKCS8 file really encodes a different public key than the one '.
      'specified, an attacker could use it to gain unauthorized access.'.
      "\n\n".
      'Generally, you should use this option only in a development '.
      'environment where ssh-keygen is broken and it is inconvenient to '.
      'fix it, and only if you are certain you understand the risks. You '.
      'should never cache a PKCS8 file you did not generate yourself.');

    $console->writeOut(

View on GitHub (pinned to 5720a38cfe)

Solutions

Verify the file exists: ls -l <path> from the invocation directory.
Generate the PKCS8 file if missing: ssh-keygen -e -m PKCS8 -f /path/id_rsa.pub > /path/id_rsa.pkcs8 (only then cache it).
Use an absolute path.

Example fix

// before: pkcs8 file not generated yet
./bin/auth cache-pkcs8 --public key.pub --pkcs8 key.pkcs8
// after: generate it first, then cache
ssh-keygen -e -m PKCS8 -f key.pub > key.pkcs8
./bin/auth cache-pkcs8 --public key.pub --pkcs8 key.pkcs8

Defensive patterns

Strategy: validation

Validate before calling

# guard: file must exist before invoking
PKCS8=$(readlink -f "$PKCS8")
[ -f "$PKCS8" ] || { echo "pkcs8 keyfile missing: $PKCS8" >&2; exit 2; }
./bin/auth cache-pkcs8 --public "$PUB" --pkcs8 "$PKCS8"

Prevention

Generate the PKCS8 file first: ssh-keygen -e -m PKCS8 -f key.pub > key.pkcs8.
Use absolute paths.
Verify the file exists in the environment running bin/auth.

When it happens

Trigger: Typo in the PKCS8 path; relative path resolved from a different cwd; the .pkcs8 file was never generated (e.g. ssh-keygen -e -m PKCS8 was never run) or lives on another host.

Common situations: Forgetting to generate the PKCS8 wrapper first; running from the wrong directory; container/host path confusion.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/4eb844d85dd99a0e. Report an issue: GitHub.