PVSECRET-RETRIEVE(1)

💅 pvsecret-retrieve ✨

Okay bestie, welcome to the UV-Secret Manual entry for pvsecret-retrieve — the s390x-only secret-retrieval situation, and she is lowkey iconic. 🫶

---

🌸 NAME 🌸

pvsecret-retrieve — retrieve a secret from the UV secret store (s390x only).

---

🎀 SYNOPSIS 🎀

pvsecret retrieve [OPTIONS] [INPUT] [OUTPUT]
pvsecret retr [OPTIONS] [INPUT] [OUTPUT]

Same energy, shorter spelling with retr. Slay. ✨

---

🦋 DESCRIPTION 🦋

Retrieve a secret from the UV secret store (s390x only). This retrieves a retrievable secret from the UV-storage of the guest by its ID. The ID may be provided as a yaml file or as a 32 byte hex-string. The secret is written as a PEM file. For Plaintext secret, PLAINTEXT SECRET is used as the PEM name, and for protected keys the PEM name IBM PROTECTED KEY is used. 🎀

Bestie, quick vibe check: this is s390x only, not a general-purpose party. 💀

---

✨ OPTIONS ✨

Here’s the whole lineup, every single one, no skipping. 👑

• <INPUT> — specify the secret ID to be retrieved. 👀 Input type depends on --inform. If yaml (default) is specified, it must be a yaml created by the create subcommand of this tool. If hex is specified, it must be a 32 byte handle encodes in hexadecimal. Leading zeros are required. If there are multiple secrets in the store with the same Id, there are no guarantees on which specific secret is retrieved. Use --inform=idx to make sure a specific secret is retrieved.
• <OUTPUT> — specify the output path to place the secret value. 🎁
• -i, --input <ID> — specify the secret ID to be retrieved. Yes, this is the flag version of the same input situation, and the deets are identical: Input type depends on --inform. If yaml (default) is specified, it must be a yaml created by the create subcommand of this tool. If hex is specified, it must be a 32 byte handle encodes in hexadecimal. Leading zeros are required. If there are multiple secrets in the store with the same Id, there are no guarantees on which specific secret is retrieved. Use --inform=idx to make sure a specific secret is retrieved.
• -o, --output <FILE> — specify the output path to place the secret value. 🫶
• --inform <INFORM> — define input type for the Secret ID. [default: 'yaml'] 🌈 Possible values:
  • yaml: Use a yaml file.
  • hex: Use a hex string.
  • name: Use a name-string. Will hash it if no secret with the name found.
  • idx: Use the secret-index (base 10) instead of the secret-ID.
• --outform <OUTFORM> — define the output format for the retrieved secret. [default: 'pem'] 💖 Possible values:
  • pem: Write the secret as PEM.
  • bin: Write the secret in binary.
• -h, --help — print help (see a summary with -h). 🧚

Real talk: if multiple secrets have the same Id, there are no guarantees on which specific secret is retrieved. Use --inform=idx when you need a specific one. No cap. ⭐

---

🔥 SEE ALSO 🔥

pvsecret(1) — go off, bestie. 🦋

---

xoxo, this page is brought to you by s390-tools, dated 2026-08-11 💖✨