goback key

Manage the store key that encrypts names and contents before upload, and the at-rest key

goback [global flags] key <command>

key new

Generate a store key file

goback [global flags] key new [flags] <name>

Flag	Description	Environment	Default
--out value	key file to write		store.key

key escrow

Encrypt a store key with a passphrase into an armored age file, which age -d can also open; print it, or keep it with the store using –upload

goback [global flags] key escrow [flags]

Flag	Description	Environment	Default
--key value	key file to escrow		store.key
--passphrase value	escrow passphrase	GOBACK_PASSPHRASE
--upload	keep the escrowed key with the –storage store instead of printing it

key id

Print a store key’s id; the store and the key’s escrowed copies refer to the key by this id

goback [global flags] key id [flags]

Flag	Description	Environment	Default
--key value	key file		store.key

key recover

Rebuild a key file from an escrowed key and its passphrase

goback [global flags] key recover [flags]

Flag	Description	Environment	Default
--escrow value	escrowed key file, as printed by key escrow; - reads standard input		-
--out value	key file to write		store.key
--passphrase value	escrow passphrase	GOBACK_PASSPHRASE

key at-rest

Generate or rotate the key that seals the archives of a local, gcs:// or s3:// store

goback [global flags] key at-rest [flags]

Flag	Description	Environment	Default
--out value	key file to write		at-rest.key
--rotate	add a new primary key to the file; the older keys still open the archives they sealed