What causes "You must specify the path to a public keyfile with %s." in phacility/phabricator?

Pass both flags: ./bin/auth cache-pkcs8 --public /path/id_rsa.pub --pkcs8 /path/key.pkcs8

phacility/phabricator · warning · PhutilArgumentUsageException

You must specify the path to a public keyfile with %s.

Error message

You must specify the path to a public keyfile with %s.

What it means

The bin/auth cache-pkcs8 management workflow requires the path to an SSH public keyfile via --public. execute() checks strlen() on the argument and throws PhutilArgumentUsageException before touching the filesystem when it is empty.

Source

Thrown at src/applications/auth/management/PhabricatorAuthManagementCachePKCS8Workflow.php:36

          array(
            'name' => 'public',
            'param' => 'keyfile',
            'help' => pht('Path to public keyfile.'),
          ),
          array(
            'name' => 'pkcs8',
            'param' => 'keyfile',
            'help' => pht('Path to corresponding PKCS8 key.'),
          ),
        ));
  }

  public function execute(PhutilArgumentParser $args) {
    $console = PhutilConsole::getConsole();

    $public_keyfile = $args->getArg('public');
    if (!strlen($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'You must specify the path to a public keyfile with %s.',
          '--public'));
    }

    if (!Filesystem::pathExists($public_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(
          'Specified public keyfile "%s" does not exist!',
          $public_keyfile));
    }

    $public_key = Filesystem::readFile($public_keyfile);

    $pkcs8_keyfile = $args->getArg('pkcs8');
    if (!strlen($pkcs8_keyfile)) {
      throw new PhutilArgumentUsageException(
        pht(

View on GitHub (pinned to 5720a38cfe)

Solutions

Pass both flags: ./bin/auth cache-pkcs8 --public /path/id_rsa.pub --pkcs8 /path/key.pkcs8
Run ./bin/auth help cache-pkcs8 to confirm the required arguments.

Example fix

// before
./bin/auth cache-pkcs8 --pkcs8 key.pkcs8
// after
./bin/auth cache-pkcs8 --public key.pub --pkcs8 key.pkcs8

Defensive patterns

Strategy: validation

Validate before calling

# before invoking, verify both flags are set
: "${PUB:?--public required}"; : "${PKCS8:?--pkcs8 required}"
./bin/auth cache-pkcs8 --public "$PUB" --pkcs8 "$PKCS8"

Prevention

Run ./bin/auth help <workflow> before one-shot management commands.
Build CLI invocations from validated, non-empty variables.
Remember both --public and --pkcs8 are mandatory for cache-pkcs8.

When it happens

Trigger: Running the workflow without --public, e.g. './bin/auth cache-pkcs8 --pkcs8 /path/key.pkcs8', or building the command from an unset shell variable.

Common situations: Assuming the tool can infer the public key; copy-pasting an incomplete command from notes; scripts constructing flags from empty variables.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/fca4c4de85cc6a57. Report an issue: GitHub.