skarbiec readers

Invocation#

skarbiec readers <id>

Purpose#

Say who can open one item on this host: the keys its current revision is encrypted to and whether this keyring holds the secret half of each.

Required inputs and options#

• One positional item id.

Output and state effects#

• Prints id, encrypted_to (one entry per key id read from the ciphertext's session key packets, with secret_key_here) and openable_here. It runs gpg --list-only --list-packets and asks the keyring for each secret key, so it decrypts nothing. An item with openable_here false fails every read on this host whatever the agent's state; one with openable_here true that still will not open points at gpg-agent or the keyring, which `skarbiec recover-daemons` addresses.

Refusals#

• Refuses an id the vault does not hold and an item with no current ciphertext. A gpg that cannot list the packets, or a keyring that cannot answer whether it holds a secret key, fails the command with gpg's own cause and the keyring lock holders, never reported as a key that is absent.