skarbiec kit

Invocation#

skarbiec kit

Purpose#

Print the emergency kit: the page to keep apart from every machine so the vault can be opened again after the machine holding it is gone.

Required inputs and options#

• No arguments. POST /v1/operator/kit answers the same.

Output and state effects#

• Reads the selected vault and prints ok, vault_path, owner, owner_key_fingerprint, recovery_key_fingerprint, bonds (bond list: where the vault is kept besides this file, and so where a restore pulls from), latest_backup (the at and backup of the newest vault-backed-up journal entry `skarbiec backup` wrote, or null when none was made), missing, steps (install, import the offline recovery secret key, copy the latest backup back or pull the vault, run doctor and owner rotate), page — the same pieces laid out as the printed page, with not recorded for a gap, which `skarbiec kit | jq -r .page | lpr` prints and Desktop shows, saves and prints — and holds_no_secret. Nothing is decrypted or written. A piece the vault does not record is null and named in missing — no owner, an owner key not registered, no recovery key — and ok is false then, because the kit would not get the vault back; a vault never backed up reads Latest backup: not recorded on the page.

Refusals#

• Fails when the vault cannot be opened, or when bond list or the audit journal read fails, with its error.