skarbiec reseal

Invocation#

skarbiec reseal [--apply | --verify]

Purpose#

Move every stored ciphertext gpg wrote (OpenPGP) to Skarbiec's own sealed format, once, on the vault owner, keeping the vault as it was until every ciphertext is proven to open.

Required inputs and options#

• Without a flag it counts the OpenPGP ciphertexts and checks that the key file holds every key an item is sealed to. --apply reseals; --verify repeats the proof of a run already made. Every Skarbiec that opens the vault must run a build that reads the sealed format first.

Output and state effects#

• --apply opens every OpenPGP current value, saved version and staged value and seals it again to the same recipients, copies the vault file owner-only to <vault>.pre-reseal-<stamp>, writes once, records the run in the vault, and opens every ciphertext again from the file on disk; when all open the record is cleared and the answer is proven true with the copy's path. Journals reseal and reseal-proven. The copy is kept until the operator removes it.

Refusals#

• A key the key file lacks is refused naming it before anything is written; a ciphertext that does not open stops the run before anything is written. A run whose proof failed stays recorded, and a second --apply is refused naming the kept copy, `reseal --verify` and `backup restore <copy> --yes`. A replica refuses it, --apply with --verify exits 2, and another flag exits 2 naming it.