phacility/phabricator · error · PhutilArgumentUsageException

The public key corresponding to the given private key is alr

Error message

The public key corresponding to the given private key is already associated with an object ("%s") other than the specified device ("%s"). You can not use a single private key to identify multiple devices or users.

What it means

Usage exception from `bin/almanac register`: the public key derived from your private key IS known and active, but it is attached to a different object (another device or a user account) than the --device you named. Almanac deliberately forbids one key identifying multiple devices/users, because host identity would become ambiguous. The message names both the current owner and your target device.

Source

Thrown at src/applications/almanac/management/AlmanacManagementRegisterWorkflow.php:160

      ->setViewer($this->getViewer())
      ->withKeys(array($key_object))
      ->withIsActive(true)
      ->executeOne();

    if (!$public_key) {
      throw new PhutilArgumentUsageException(
        pht(
          'The public key corresponding to the given private key is unknown. '.
          'Associate the public key with an Almanac device in the web '.
          'interface before registering hosts with it.'));
    }

    if ($public_key->getObjectPHID() !== $device->getPHID()) {
      $public_phid = $public_key->getObjectPHID();
      $public_handles = $viewer->loadHandles(array($public_phid));
      $public_handle = $public_handles[$public_phid];

      throw new PhutilArgumentUsageException(
        pht(
          'The public key corresponding to the given private key is already '.
          'associated with an object ("%s") other than the specified '.
          'device ("%s"). You can not use a single private key to identify '.
          'multiple devices or users.',
          $public_handle->getFullName(),
          $device->getName()));
    }

    if (!$public_key->getIsTrusted()) {
      throw new PhutilArgumentUsageException(
        pht(
          'The public key corresponding to the given private key is '.
          'properly associated with the device, but is not yet trusted. '.
          'Trust this key before registering devices with it.'));
    }

    echo tsprintf(

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Generate a dedicated key pair for this device and upload its public key to the device (device -> Manage -> SSH Keys), then register with that private key.
2. If the old association is obsolete, remove/deactivate the public key from the other object first, then re-run register.
3. Never reuse a key between a user account and a device, or between two devices.

Example fix

# before (device.key's public key is attached to user 'alice')
$ bin/almanac register --device web-001 --private-key alice_key
Usage Exception: ... already associated with an object ("alice") other than the specified device ("web-001") ...

# after
$ ssh-keygen -t ed25519 -f web001.key -N ''
# upload web001.key.pub to device web-001 via Manage -> SSH Keys
$ sudo bin/almanac register --force --device web-001 --private-key web001.key

// Ensure the key is attached to THIS device before registering
if ($match->getObjectPHID() !== $device->getPHID()) {
  throw new RuntimeException(sprintf(
    'Key belongs to %s, not %s; generate a dedicated key for this device.',
    $match->getObjectPHID(), $device->getName()));
}

When it happens

Trigger: Registering host B with the private key whose public key belongs to device A; the key was uploaded to a user (e.g. an admin's account) and you now try to register a device with it; after cloning a host, reusing the original's key for the clone's device.

Common situations: Golden-image/clone provisioning that copies SSH keys; admins testing registration with their personal key; moving a device identity without revoking the old association first.

Related errors

• Specify a private key with --private-key.
• This host already has a registered public key ("%s"). Remove
• This host already has a registered private key ("%s"). Remov
• The public key corresponding to the given private key is unk
• The public key corresponding to the given private key is pro

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/970fcbe497ed91eb. Report an issue: GitHub.