What causes "You must specify the path to a pkcs8 keyfile with %s." in phacility/phabricator?

Pass the flag exactly as --pkcs8 (ignore the --pkc8s typo in the error text).

phacility/phabricator · warning · PhutilArgumentUsageException

You must specify the path to a pkcs8 keyfile with %s.

Error message

You must specify the path to a pkcs8 keyfile with %s.

What it means

The companion mandatory-argument check: the path to the PKCS8 keyfile must be given with --pkcs8, and an empty value aborts with PhutilArgumentUsageException. Note the message itself prints '--pkc8s' (transposed characters) — the actual flag is --pkcs8, as defined by the argument spec shown in --help.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php:53

    if (!strlen($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a public keyfile with %s.',
          '--public'));
    }

    if (!Filesystem::pathExists($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified public keyfile "%s" does not exist!',
          $public_keyfile));
    }

    $public_key = Filesystem::readFile($public_keyfile);

    $pkcs8_keyfile = $args->getArg('pkcs8');
    if (!strlen($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a pkcs8 keyfile with %s.',
          '--pkc8s'));
    }

    if (!Filesystem::pathExists($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified pkcs8 keyfile "%s" does not exist!',
          $pkcs8_keyfile));
    }

    $pkcs8_key = Filesystem::readFile($pkcs8_keyfile);

    $warning = pht(
      'Adding a PKCS8 keyfile to the cache can be very dangerous. If the '.
      'PKCS8 file really encodes a different public key than the one '.
      'specified, an attacker could use it to gain unauthorized access.'.

View on GitHub (pinned to 5720a38cfe)

Solutions

Pass the flag exactly as --pkcs8 <path> (ignore the --pkc8s typo in the error text).
Run ./bin/auth help cache-pkcs8 and use the flag names shown there.

Example fix

// before: flag misspelled as the error text suggests
./bin/auth cache-pkcs8 --public key.pub --pkc8s key.pkcs8
// after: correct flag name
./bin/auth cache-pkcs8 --public key.pub --pkcs8 key.pkcs8

Defensive patterns

Strategy: validation

Validate before calling

# guard: correct flag name is --pkcs8 (the error text has a typo)
case " $* " in *' --pkcs8 '*) ;; *) echo 'missing --pkcs8 <keyfile>' >&2; exit 2;; esac
./bin/auth cache-pkcs8 --public "$PUB" --pkcs8 "$PKCS8"

Prevention

Trust --help for flag names; the thrown message for this check misspells the flag as --pkc8s.
Never copy flag names out of error text without checking help.
Build commands from validated variables.

When it happens

Trigger: Omitting --pkcs8 entirely, passing it with no value, or literally typing the typo'd '--pkc8s' that a previous error message displayed; scripts passing an empty variable.

Common situations: Following the typo in the message literally; building the command from unset variables; copy-paste between shell scripts dropping the flag.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/5568b422d3386aa5. Report an issue: GitHub.