CLEANARCH(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 CLEANARCH(1) 💖

ok so this is cleanarch, a lil script from the User Contributed Perl Documentation section of the manual. she lives in section 1, she's a perl girlie, and she deletes old keys out of your DNSSEC-Tools key archive. that's it, that's the whole job. 🧹✨

🌸 NAME 🌸

cleanarch — clean a DNSSEC-Tools key archive of old keys 💅

basically: spring cleaning but for cryptographic key archives. the girls that get it, get it. iykyk.

✨ SYNOPSIS ✨

cleanarch [options] <keyrec-file | rollrec-file>

one file argument. that's it. she's low maintenance. 🎀

🦋 DESCRIPTION 🦋

ok bestie, so cleanarch deletes old keys from a DNSSEC-Tools key archive. how "old" is old? how do we know which archive? that's what the options and the argument are for. the vibes determine everything. 💀

the command line options and arguments let you pick the archives, pick the keys to delete, and pick how much yapping she does about it. the options are split into three groups:

  1. archive selection
  2. key selection
  3. output format

the full tea on all of them is in the OPTIONS section, keep scrolling. 👑

cleanarch takes a single argument (as distinguished from an option, okay, don't get it twisted). that argument can be either a keyrec file or a rollrec file.

  • if it's a keyrec file → the archive directory for its zone keyrecs gets added to the list of archives to clean. 🗂️
  • if it's a rollrec file → keyrec files for its zones get searched for the zones' archive directory, and those directories get added to the list of archives to clean. 🔍
  • if a zone doesn't have an archive directory explicitly defined → then the DNSSEC-Tools default gets cleaned instead. no zone left behind. 🫶

and fyi, the archives specified by this argument can get modified by the archive-selection options. so the argument is not the final boss, the options can still edit her.

the archive-selection options combine with the keyrec or rollrec file to select a set of archive directories to clean. (and yes, some options can fully take the place of the file argument. she's versatile like that.) ✨

the key-selection options let the set of keys-to-be-deleted contain an entire archive, a particular zone's keys, or literally all the keys prior to a certain date. pick your fighter. 🌈

the output-format options set how much output you get:

  • no options selected at all → the names of keys get printed as they're deleted.
  • -verbose → the directories selected for searching AND the keys selected for deletion get printed.
  • -dirlist → the directories selected for searching get printed, and no other action is taken.
  • -list → the keys selected for deletion get printed, and no other action is taken.
heads up bestie: cleanarch only cleans the archive directories. the keyrec files are left intact. that's on purpose. if you want a consistent environment, the cleankrf command should be used in conjunction with cleanarch. they're a duo. a package deal. 🫶

💅 OPTIONS 💅

🎀 Archive-Selection Options 🎀

these options let you pick which archives get cleaned. choose wisely, queen.

  • -archive directory — this option specifies an archive directory to be cleaned. just point at it. 🎯
  • -defarch — this option indicates that the default archive directory (the one named in the DNSSEC-Tools configuration file) should be cleaned. the default, the OG, the blueprint.
  • -zone zone — this option indicates that zone is the only zone whose archive will be cleaned. ⚠️ but real talk: if the archive directory is shared by other zones, then their keys may also be deleted. sharing is caring, unfortunately. 😭

🧚 Key-Selection Options 🧚

these options let you pick which keys get deleted. the main event. the moment.

  • -all — deletes all keys in the selected archives. 💀 and this option may not be used with any other key-selection options. she's a solo act, no collabs, periodt.
  • -days days — deletes all keys except those whose modification date is within the days full days preceding the current day. so anything fresher than that stays safe. 🍓
  • -onezone zone — only keys with zone in the key's filename are deleted. this is intended for use in cleaning a multi-zone key archive. 🏘️
    • > okay so important: this does not validate that zone is an actual zone. any string can be used here, fr fr. for example, using private will select old private key files for deletion, and using com will select any filename that contains com. it's vibes-based matching, not validation. 💀

🌈 Options for Output Control 🌈

these options let you control cleanarch's output. how much she talks, basically. 🗣️

  • -dirlist — this option lists the selected archive directories. no other action is taken. she's just showing you the receipts.
  • -list — this option lists the selected keys. no other action is taken. look, don't touch. 🙈
  • -quiet — display no output. silent. mysterious. main character energy. 🤫
  • -verbose — display verbose output. she will tell you everything. ✨
  • -Version — displays the version information for cleanarch and the DNSSEC-Tools package. (capital V, bestie, don't forget, it's a whole different flag if you lowercase it 👀)
  • -help — display a usage message and exit. the classic. the icon. 👑

⚠️ WARNINGS ⚠️

okay so listen. please invest a bit of time testing this tool prior to putting it into production use. the user is advised to do this. it's not a suggestion, it's a plea. 🙏

once a key is deleted, it is gone. gone gone. no undo button, no take-backs, no "wait bestie i didn't mean it."

some may find this to be detrimental to the health of their DNSSEC-Tools installation. so like... test first. please. for me. 🥺

Copyright 2007-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details. 🫶

💜 AUTHOR 💜

Wayne Morrison, tewok@tislabs.com

👀 SEE ALSO 👀

  • cleankrf(8), lskrf(8), zonesigner(8)
  • Net::DNS::SEC::Tools::keyrec.pm(3), Net::DNS::SEC::Tools::rollrec.pm(3)
  • dnssec-tools.conf(5), keyrec.pm(5), rollrec.pm(5)

and that's the whole page, babe 💖 this manual was brought to you by perl v5.42.0, dated 2025-07-23, and filed under CLEANARCH(1). go forth and clean responsibly, mwah 🎀✨💅

📦 where this page comes from