key

var Command = cli.Command{
	Name:  "key",
	Usage: "Manage the store key that encrypts names and contents before upload, and the at-rest key",
	Subcommands: []cli.Command{
		{
			Name:      "new",
			Usage:     "Generate a store key file",
			ArgsUsage: "<name>",
			Action:    newAction,
			Flags:     []cli.Flag{outFlag("store.key")},
		},
		{
			Name:   "escrow",
			Usage:  "Encrypt a store key with a passphrase into an armored age file, which `age -d` can also open; print it, or keep it with the store using --upload",
			Action: escrowAction,
			Flags: []cli.Flag{
				cli.StringFlag{Name: "key", Usage: "key file to escrow", Value: "store.key"},
				passphraseFlag,
				cli.BoolFlag{Name: "upload", Usage: "keep the escrowed key with the --storage store instead of printing it"},
			},
		},
		{
			Name:   "id",
			Usage:  "Print a store key's id; the store and the key's escrowed copies refer to the key by this id",
			Action: idAction,
			Flags:  []cli.Flag{cli.StringFlag{Name: "key", Usage: "key file", Value: "store.key"}},
		},
		{
			Name:   "recover",
			Usage:  "Rebuild a key file from an escrowed key and its passphrase",
			Action: recoverAction,
			Flags: []cli.Flag{
				cli.StringFlag{Name: "escrow", Usage: "escrowed key file, as printed by key escrow; - reads standard input", Value: "-"},
				outFlag("store.key"),
				passphraseFlag,
			},
		},
		{
			Name:   "at-rest",
			Usage:  "Generate or rotate the key that seals the archives of a local, gcs:// or s3:// store",
			Action: atRestAction,
			Flags: []cli.Flag{
				outFlag("at-rest.key"),
				cli.BoolFlag{Name: "rotate", Usage: "add a new primary key to the file; the older keys still open the archives they sealed"},
			},
		},
	},
}