CLI command
skarbiec keyring
Stop the selected keyring's keyboxd, gpg-agent and scdaemon through gpgconf, then end every gpg child another process of this Skarbiec executable started against them, so its caller is answered with the child's failure and its crypto slot is given back. The children are found in the process table before the daemons stop (a parent whose kernel-bound identity runs this Skarbiec executable; this process's own children are left to it), whatever status they stopped at and whichever release their parent runs, and each is ended only when it runs a configured GnuPG executable; each child ended or left alone is said on stderr as 'skarbiec: stranded gpg child: …'. A failed control operation, or a process table that cannot be read, remains a failure; recovery never signals account-wide executable-name matches.
Invocation#
skarbiec keyring recoverPurpose#
Stop the selected keyring's keyboxd, gpg-agent and scdaemon through gpgconf, then end every gpg child another process of this Skarbiec executable started against them, so its caller is answered with the child's failure and its crypto slot is given back. The children are found in the process table before the daemons stop (a parent whose kernel-bound identity runs this Skarbiec executable; this process's own children are left to it), whatever status they stopped at and whichever release their parent runs, and each is ended only when it runs a configured GnuPG executable; each child ended or left alone is said on stderr as 'skarbiec: stranded gpg child: …'. A failed control operation, or a process table that cannot be read, remains a failure; recovery never signals account-wide executable-name matches.
Required inputs and options#
- No positional input or command-specific option. GNUPGHOME selects the keyring whose daemons are replaced. POST /v1/operator/recover-daemons runs it on the vault owner and answers the receipt, or the same refusal when the daemons were not replaced; Desktop's Settings → Policy → GnuPG daemons calls it after a confirmation.
Output and state effects#
- Prints a receipt: recovered, the three daemons it addressed, before (each running daemon's pid and the bytes it held), and limit_bytes, the memory ceiling the readiness pass enforces, so a wedge and a bloat read differently. gpg starts fresh daemons on the next read. No vault item is read or changed.
Refusals#
- When the daemons could not be replaced the receipt is still printed with recovered false and detail naming gpgconf's cause, and the command then fails with 'keyring recover: the GnuPG daemons were not replaced: <cause>' and exit status 1. A gpg process whose parent's kernel-bound identity cannot be read is not taken for 'not Skarbiec': each one is named with its pid, its parent and the reason, and the receipt reports recovered false, so a recovery never answers recovered while runs it could not account for still wait. Automatic recovery classifies GnuPG machine-status codes rather than error wording. Additional codes resolved through gpg-error are accepted only when that command succeeds and its output contains a numeric code; a failed or malformed resolution is reported and cannot authorize recovery. `keyring` with any other words exits 2 with `keyring <words> is not a form of keyring; usage: keyring recover`.