skarbiec ssh import

Invocation#

skarbiec ssh import <private-key-file> <id> [--name <display name>] [--tags <tag,...>] [--remove]

Purpose#

Move an SSH key that already sits in a file — ~/.ssh/id_ed25519, a deploy key handed over by someone — into the vault, so it is loaded with ssh add, rotated with rotate --with ssh, shared and backed up with the vault instead of living on one disk.

Required inputs and options#

• The private key file (a relative path is taken in the working directory) and a new item id; --name and --tags as ssh new takes them; --remove deletes the file and its .pub once stored. POST /v1/operator/items/ssh-import takes path as an absolute path on the machine it runs on, id, name, tags and remove.

Output and state effects#

• Reads the file, derives its public key with ssh-keygen -y -P "" so the pair stored always matches, stores a key-pair item with private_key and public_key (refusing an id that exists even when written at the same moment), reads the item back and compares the key, then with --remove deletes the file and its .pub. Appends ssh-key-imported with the item, the file and what was removed, and prints ok, item, public_key, from and removed. The private key is never printed. Desktop's Items → New SSH key offers it as Bring an existing key….

Refusals#

• Anything but a file and an id exits 2 with the usage. An id that already exists is refused and nothing is read. A file that cannot be read is named with the system's error, and a file ssh-keygen cannot read — not a key, or a key under a passphrase — is refused with its status and words and the `ssh-keygen -p -f <file>` step that takes a passphrase off. When the stored item does not read the key back, the file is left in place and that is said; a file --remove cannot delete is named after the item was stored.

Examples#

skarbiec ssh import ~/.ssh/id_ed25519 laptop-ssh --tags personal --remove skarbiec ssh add laptop-ssh