PVSECRET(1)

💅 pvsecret(1) — like, the whole UV-Secret manual, but make it make sense

okay bestie, welcome to pvsecret(1) from the UV-Secret Manual — yes that's the manual name, don't @ me — this is your one-stop shop for managing secrets for IBM Secure Execution guests 🫶

---

✨ SYNOPSIS ✨

pvsecret [OPTIONS] <COMMAND>

that's it. that's the whole vibe. options then a command. slay.

---

🌸 DESCRIPTION 🌸

so, pvsecret manages secrets for IBM Secure Execution guests. and here's the thing — pvsecret can create add-secret requests on any architecture. like, any. but on s390x systems specifically, you use pvsecret to actually add the secrets to the ultravisor secret store, list all the secrets in that store, or lock the store down so nobody can touch it in the future. 💅

the ultravisor secret store is where secrets for the IBM Secure Execution guest live. and heads up: the secret store is cleared on guest reboot. bye bye secrets, literally 😭

⚠️ vibe check / important safety moment: create requests only on trusted systems — and specifically not the IBM Secure Execution guest where you want to inject the secrets. doing it this way is what prevents the secrets from ever being in cleartext on the guest. no cap, this matters.

for extra safety, do an attestation with pvattest of your guest beforehand, and include the configuration UID in the secret request using --cuid. go read pvsecret-add(1) for more info on that. 🧚

and for all certificates, revocation lists, and host-key documents — both the PEM and DER input formats are supported. iconic of them tbh 🌈

---

👑 PVSECRET COMMANDS 👑

🦋 pvsecret-create(1)

create a new add-secret request.

creates add-secret requests for IBM Secure Execution guests. only create these requests in a trusted environment, like your workstation (your room, your desk, your whole setup ✨). the pvattest create command creates a randomly generated key to protect the request. then you can add those generated requests on an IBM Secure Execution guest using pvsecret add. and then the guest can use the secrets with whatever use case goes with that secret type. main character behavior honestly.

🦋 pvsecret-add(1)

submit an add-secret request to the Ultravisor (s390x only).

performs an add-secret request using a previously generated add-secret request. only available on s390x.

🦋 pvsecret-lock(1)

lock the secret-store (s390x only).

locks the secret store (s390x only). after this command executes successfully, all subsequent add-secret requests will fail. like, forever. it's giving "no take-backs." only available on s390x.

🦋 pvsecret-list(1)

list all ultravisor secrets (s390x only).

lists the IDs of all non-null secrets currently stored in the ultravisor for the currently running IBM Secure Execution guest. only available on s390x.

🦋 pvsecret-verify(1)

verify that an add-secret request is sane.

verifies that the given request is an add-secret request by testing for some values to be present. if the request contains signed user-data, the signature is verified with the provided key. and it outputs the arbitrary user-data. 🎀

🦋 pvsecret-retrieve(1)

retrieve a secret from the UV secret store (s390x only)

that's the whole pitch. retrieve a secret. from the UV secret store. s390x only. periodt.

---

✨ OPTIONS ✨

• -v, --verbose — provide more detailed output. more words. more info. we love context 💖
• -q, --quiet — provide less output. shhh. minimal girlie behavior 🤫
• --version — print version information and exit. short and sweet.
• -h, --help — print help (see a summary with -h). yes, -h gives you the summary version. iykyk.

---

🌟 EXAMPLES 🌟

💜 create the request on your trusted system

create the add-secret request on a trusted system. the program generates two files: addsecreq.bin contains the add-secret request, and EXAMPLE.yaml contains the non-confidential info about the generated secret — specifically the name and id of the secret.

trusted:~$ pvsecret create -k hkd.crt --cert CA.crt --cert ibmsk.crt --hdr pvimage -o addsecreq.bin association EXAMPLE
Successfully generated the request
Successfully wrote association info to 'EXAMPLE.yaml'

💜 add the secret on the SE-guest

on the SE-guest, add the secret from the request to the secret store.

seguest:~$ pvsecret add addsecreq.bin
Successfully added the secret

💜 list what's in there

on the SE-guest, list the secrets currently stored.

seguest:~$ pvsecret list
Total number of secrets: 1

0 Association:
    94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2

💜 lock it down

on the SE-guest, lock the secret store.

seguest:~$ pvsecret lock
Successfully locked secret store
seguest:~$ pvsecret add addsecreq.bin
error: Ultravisor: 'secret store locked' (0x0102)

see that? locked means locked, bestie. 💀

---

🔥 SEE ALSO 🔥

pvsecret-create(1), pvsecret-add(1), pvsecret-lock(1), pvsecret-list(1), pvsecret-verify(1), pvsecret-retrieve(1)

---

okay that's the whole page, you ate it up fr fr 🍓 this little bundle of joy ships with s390-tools, dated 2026-08-11, and it lives at PVSECRET(1) — go forth and keep your secrets secret 💖✨🎀