Documentation
¶
Overview ¶
Package keyscli implements the `obsigna keys` subcommands — generate, pubkey, and rotate — that manage the daemon's Ed25519 signing key from the read-side CLI. The heavy lifting lives in the daemon package (daemon.GenerateKey, daemon.RotateKey) and internal/keysource; this package only resolves the key-relevant configuration (defaults < config file < env < flags, mirroring the daemon's own precedence for the fields these verbs touch) and renders the CLI surface. Keeping it here, away from cmd/obsigna/main.go, lets tests drive each verb directly with captured I/O and an injected environment.
The verbs are the obsigna home for what `obsigna-daemon --init` and `--rotate` do today; the daemon binary keeps those flags untouched (ADR-0030, ADR-0015).
Index ¶
Constants ¶
const ( ExitOK = 0 ExitError = 1 ExitUsageError = 2 )
Exit codes are part of the CLI contract — keep them stable and aligned with the other subcommand packages (verifycli, listcli): 0 ok, 2 usage error. 1 is an operational failure (key already exists, store unreadable, rotation refused because a daemon is live, …).
Variables ¶
This section is empty.
Functions ¶
func RunGenerate ¶
RunGenerate implements `obsigna keys generate`: create a fresh Ed25519 signing key pair, refusing to overwrite existing files. Mirrors `obsigna-daemon --init`.
func RunPubkey ¶
RunPubkey implements `obsigna keys pubkey`: print the SPKI public key derived from the signing key at --key. New verb (no legacy equivalent) — useful for distributing the verifier key without exposing the private half or relying on a previously published .pub file.
func RunRotate ¶
RunRotate implements `obsigna keys rotate`: append a key_rotated receipt signed by the current key, archive the current public key, and swap in a new key (ADR-0015). Mirrors `obsigna-daemon --rotate`; the daemon must be stopped first (daemon.RotateKey refuses while the socket is reachable).
Types ¶
This section is empty.
Source Files