phacility/phabricator · warning · PhutilArgumentUsageException

Specify a public key to trust with --id.

Error message

Specify a public key to trust with --id.

What it means

Usage exception from `bin/almanac trust-key`: the --id flag is missing, empty, or falsy. The workflow trusts exactly one SSH public key per invocation, addressed by its numeric ID in the PhabricatorAuthSSHKey table, so the ID is mandatory.

Source

Thrown at src/applications/almanac/management/AlmanacManagementTrustKeyWorkflow.php:25

    $this
      ->setName('trust-key')
      ->setSynopsis(pht('Mark a public key as trusted.'))
      ->setArguments(
        array(
          array(
            'name' => 'id',
            'param' => 'id',
            'help' => pht('ID of the key to trust.'),
          ),
        ));
  }

  public function execute(PhutilArgumentParser $args) {
    $console = PhutilConsole::getConsole();

    $id = $args->getArg('id');
    if (!$id) {
      throw new PhutilArgumentUsageException(
        pht('Specify a public key to trust with --id.'));
    }

    $key = id(new PhabricatorAuthSSHKeyQuery())
      ->setViewer($this->getViewer())
      ->withIDs(array($id))
      ->executeOne();
    if (!$key) {
      throw new PhutilArgumentUsageException(
        pht('No public key exists with ID "%s".', $id));
    }

    if (!$key->getIsActive()) {
      throw new PhutilArgumentUsageException(
        pht('Public key "%s" is not an active key.', $id));
    }

    if ($key->getIsTrusted()) {

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Get the key ID from the device's Manage -> SSH Keys panel (or the database/auth.sshkey search) and pass it: bin/almanac trust-key --id <id>.
2. In scripts, abort if the ID variable is empty instead of calling the CLI with a blank --id.
3. Remember the command trusts one key per run; loop over IDs if you have several.

Example fix

# before
$ bin/almanac trust-key
Usage Exception: Specify a public key to trust with --id.

# after
$ bin/almanac trust-key --id 42

: "${TRUST_KEY_ID:?SSH public key ID required (device -> Manage -> SSH Keys)}"
bin/almanac trust-key --id "$TRUST_KEY_ID"

When it happens

Trigger: Running `bin/almanac trust-key` bare; passing --id "" from a script variable that failed to populate; using --key or --phid instead of --id.

Common situations: Scripted key-trust steps where the ID extraction (from the UI or almanac/device search output) silently failed; operators assuming the command is interactive.

Related errors

• Specify a device with --device.
• Specify a private key with --private-key.
• No public key exists with ID "%s".
• Public key "%s" is not an active key.
• Public key with ID %s is already trusted.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/e953040cedf3eb22. Report an issue: GitHub.