CLI command
skarbiec rotate-owner
Replace the vault owner and rewrap every current and historical ciphertext to the new owner while preserving recovery.
Invocation#
skarbiec rotate-owner <new-owner-uid>Purpose#
Replace the vault owner and rewrap every current and historical ciphertext to the new owner while preserving recovery.
Required inputs and options#
- Requires the new owner's uid; its key must already exist in the active keyring.
Output and state effects#
- Re-encrypts all versions to the new owner recipient set, records the operation, and prints the rotation report.
Refusals#
- Refuses an unknown key instead of generating one during rotation, and aborts on any item it cannot safely rewrap.