rust-lang/cargo · critical · anyhow::Error

error: Key has been revoked for `{hostname}` ***************

Error message

error: Key has been revoked for `{hostname}`
**************************************
* WARNING: REVOKED HOST KEY DETECTED *
**************************************
This may indicate that the key provided by this host has been
compromised and should not be accepted.

The host key {key_type_short_name} {remote_host_key} is revoked
in {location} and has been rejected.

What it means

The `HostKeyRevoked` variant: the host key presented by the remote is explicitly marked as revoked in a known_hosts source (an SSH `@revoked` marker). A revoked key must never be accepted — it signals the key was compromised and withdrawn. Cargo rejects it outright with a high-severity warning.

Source

Thrown at src/sources/git/known_hosts.rs:298

                resolve this error by {old_key_resolution}\n\
                \n\
                The key provided by the remote host is:\n\
                \n\
                {hostname} {key_type_name} {remote_host_key}\n\
                \n\
                See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts \
                for more information.\n\
                "
            )
        }
        Err(KnownHostError::HostKeyRevoked {
            hostname,
            key_type,
            remote_host_key,
            location,
        }) => {
            let key_type_short_name = key_type.short_name();
            anyhow::bail!(
                "error: Key has been revoked for `{hostname}`\n\
                **************************************\n\
                * WARNING: REVOKED HOST KEY DETECTED *\n\
                **************************************\n\
                This may indicate that the key provided by this host has been\n\
                compromised and should not be accepted.
                \n\
                The host key {key_type_short_name} {remote_host_key} is revoked\n\
                in {location} and has been rejected.\n\
                "
            )
        }
        Err(KnownHostError::HostHasOnlyCertAuthority { hostname, location }) => {
            anyhow::bail!("error: Found a `@cert-authority` marker for `{hostname}`\n\
                \n\
                Cargo doesn't support certificate authorities for host key verification. It is\n\
                recommended that the command line Git client is used instead. This can be achieved\n\
                by setting `net.git-fetch-with-cli` to `true` in the Cargo config.\n\

View on GitHub (pinned to 0e07a15537)

Solutions

1. Treat as a security incident: do NOT proceed until the server administrator confirms the server is reconfigured with a fresh, non-revoked key.
2. Have the server administrator replace the host key and publish the new one.
3. Verify the `@revoked` entry is correct (not a false positive matching a legitimate key by accident).
4. After the server is fixed and you've verified the new fingerprint, update known_hosts accordingly.

Example fix

// no code fix — this is a security event requiring server-side remediation
// contact admin, rotate server host key, then update ~/.ssh/known_hosts

# Audit @revoked entries and confirm the server is NOT offering a revoked key:
grep '@revoked' ~/.ssh/known_hosts
ssh-keyscan <host> | ssh-keygen -l -f -   # compare against revoked fingerprints
# Do NOT remove the @revoked marker — fix the server instead.

When it happens

Trigger: A `@revoked` line in `~/.ssh/known_hosts` (or Cargo config known_hosts) matches the remote host, and the key the remote presents equals the revoked key. The server is still offering a known-compromised key.

Common situations: A compromised key was added to `@revoked` but the server wasn't reconfigured to stop offering it; a revoked key left active on a stale/misconfigured server; an attacker replaying a compromised key; misconfigured known_hosts `@revoked` entry matching the wrong key.

Related errors

• error: failed to validate host key: {:#}
• error: unknown SSH host key The SSH host key for `{hostname}
• error: SSH host key has changed for `{hostname}` ***********
• error: Found a `@cert-authority` marker for `{hostname}` Ca
• `{feature}` is unsupported when inferring the crate name, us

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/3a01dd24b1dba097.json. Report an issue: GitHub.