A vault opens where its owner's key is.
skarbiec owner key makes or reads the key a vault owner opens the vault with on one host, without touching any vault, so a host can be prepared before the vault moves to it.
Why it is its own verb#
A vault moved to another host is opened there by its owner's secret key in that host's keyring. owner rotate deliberately makes no key, and recipient add registers the key it makes as a recipient of the local vault, so neither can prepare a host that holds no vault yet.
stado credentials vault move --apply runs skarbiec owner key mint <uid> on the destination when its keyring holds no secret key for the new owner, before registering that owner on the vault and rotating to it.
skarbiec owner key mint <uid>#
Makes the owner key for <uid> in this host's keyring with the parameters init uses and nothing else, appends an owner-key mint entry with the uid and fingerprint to the audit journal, and prints uid, fingerprint, secret_key_present and public_key (the armored public key another host encrypts to).
Refuses a uid that already names a key in this keyring, secret half or not: <uid> already names key <fingerprint> in this host's keyring; owner key mint makes a key only for a uid that names none, and `skarbiec owner key show <uid>` reads it. A second key under one uid would leave which one opens the vault to the keyring's order.
skarbiec owner key show <uid>#
Reads the key <uid> names in this host's keyring and prints the same uid, fingerprint, secret_key_present and public_key. It changes nothing.
Refuses a uid that names no key: <uid> names no key in this host's keyring; `skarbiec owner key mint <uid>` makes one.
Other refusals#
owner key with no verb: owner key needs a verb: mint <uid> or show <uid>. Another verb: owner key has no verb <verb>; it has mint and show. Anything but exactly one uid: owner key <verb> takes exactly one <uid>. Any flag: owner key takes no flags; it was given --<flag>.
The operator API and Desktop#
POST /v1/operator/owner/key/show and POST /v1/operator/owner/key/mint take {"uid": <uid>} and answer what the command prints, or its refusal. Both act on the keyring of the machine the app runs on and are never forwarded to a remote vault owner; mint holds the listener's write lock like every other mutation.
Skarbiec Desktop shows them under Settings → Policy as Owner key on this Mac: Show reads the key and Make key mints it, each answering with the fingerprint, whether the secret half is here and the public key, or the refusal in the command's words.