What causes "Specified public keyfile "%s" does not exist!" in phacility/phabricator?

Run ls -l from the exact directory you invoke bin/auth in.

phacility/phabricator · warning · PhutilArgumentUsageException

Specified public keyfile "%s" does not exist!

Error message

Specified public keyfile "%s" does not exist!

What it means

--public was provided, but Filesystem::pathExists() reports no file at that path, so the workflow aborts before Filesystem::readFile() would fail. A pure path-resolution usage error, not a key-format error.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php:43

            'param' => 'keyfile',
            'help' => pht('Path to corresponding PKCS8 key.'),
          ),
        ));
  }

  public function execute(PhutilArgumentParser $args) {
    $console = PhutilConsole::getConsole();

    $public_keyfile = $args->getArg('public');
    if (!strlen($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a public keyfile with %s.',
          '--public'));
    }

    if (!Filesystem::pathExists($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified public keyfile "%s" does not exist!',
          $public_keyfile));
    }

    $public_key = Filesystem::readFile($public_keyfile);

    $pkcs8_keyfile = $args->getArg('pkcs8');
    if (!strlen($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a pkcs8 keyfile with %s.',
          '--pkc8s'));
    }

    if (!Filesystem::pathExists($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(

View on GitHub (pinned to 5720a38cfe)

Solutions

Run ls -l <path> from the exact directory you invoke bin/auth in.
Switch to an absolute path for --public.
Confirm the file exists on the machine actually running the CLI (inside the container, if that is where bin/auth runs).

Example fix

// before
./bin/auth cache-pkcs8 --public ./id_rsa.pub --pkcs8 ./key.pkcs8
// after (absolute paths)
./bin/auth cache-pkcs8 --public /home/me/.ssh/id_rsa.pub --pkcs8 /tmp/key.pkcs8

Defensive patterns

Strategy: validation

Validate before calling

# guard with absolute, pre-checked paths
PUB=$(readlink -f "$PUB")
[ -f "$PUB" ] || { echo "public keyfile missing: $PUB" >&2; exit 2; }
./bin/auth cache-pkcs8 --public "$PUB" --pkcs8 "$PKCS8"

Prevention

Prefer absolute paths for keyfile arguments.
Run ls on the path from the same cwd as bin/auth before invoking.
In containers, confirm the key is mounted where the CLI runs.

When it happens

Trigger: Typo in the path; relative path resolved from a different working directory than assumed; file lives on another host/container than the one running bin/auth.

Common situations: Running bin/auth from a different cwd; containerized setups where the key exists only on the host; copy-pasting paths written for another machine.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/43669fbccc586410. Report an issue: GitHub.