skarbiec keys

Invocation#

skarbiec keys [--expiring-before <iso8601>]
skarbiec keys check

Purpose#

See when each key the vault writes to stops accepting writes, so it is extended before a share, a rotation or a revoke that rewraps saved versions stops at it.

Required inputs and options#

• No positional input. --expiring-before keeps the keys whose end is before a UTC time of the vault's stamp form; expired, revoked and missing keys are always kept. check takes nothing.

Output and state effects#

• Reads each registered recipient's fingerprint and the recovery fingerprint from the vault and asks this keyring about each, then prints ok, checked_at, expiring_before, keys (holder, fingerprint, in_keyring, expires_at or null when it never expires, expired, revoked and, for a key in the keyring, repair: gpg --quick-set-expire to extend it, or recipient rekey for a person and owner rotate for the owner to replace it) and unreadable (holder, fingerprint and gpg's error). ok is false when any key is expired, revoked, missing from the keyring or unreadable. Nothing is decrypted or written. POST /v1/operator/keys takes expiring-before; review reports it under keys_ending_before; Desktop's Settings → Policy shows it as Keys. keys check, its own page, reads whether any key here can still open the vault.

Refusals#

• An --expiring-before of another shape exits 2 with `--expiring-before <value> is not a UTC time of the form <now>`. A key gpg cannot list for another reason than its absence is reported under unreadable with gpg's own error, never as missing.