TARSNAP-KEYMGMT(1)

💅 TARSNAP-KEYMGMT(1) — the girlies' guide to tarsnap-keymgmt

okay so this is a General Commands Manual page, bestie — tarsnap-keymgmt lives in section 1, and it's here to hand you a subset of a tarsnap(1) key file. like, a little baby key that only does the things you said it could do. obsessed. 🎀

---

✨ NAME ✨

tarsnap-keymgmt — generate subsets of tarsnap(1) key files

---

🦋 SYNOPSIS 🦋

tarsnap-keymgmt --outkeyfile new-key-file [-r] [-w] [-d] [--nuke]
                [--passphrased] [--passphrase-mem maxmem]
                [--passphrase-time maxtime] key-file ...
tarsnap-keymgmt --print-key-id key-file
tarsnap-keymgmt --print-key-permissions key-file
tarsnap-keymgmt --version

---

💖 DESCRIPTION 💖

okay so picture this: tarsnap-keymgmt reads the key files you hand it and writes a new key file — the one you named with --outkeyfile new-key-file — and that new file contains only the keys you actually need for the operations you picked:

• -r — list and extract archives
• -w — write archives
• -d — delete archives
• --nuke

and like, one thing to know: -d implies -r, fr fr, because you literally cannot delete an individual archive without being able to read it. no cap. meanwhile a key file generated with --nuke can be used to delete all the archives stored, but not individual archives. different vibe entirely. 💅

---

🌸 which permissions do you need for which mode 🌸

this is the part where you screenshot and send it to the group chat, bestie — here's which permissions are required for various tarsnap(1) command modes:

• --recover — requires either (1) -d (archive deleting), (2) -w (archive creating), or (3) --nuke keys.
• --fsck — requires either (1) both -w (archive writing) and -r (archive reading) keys, or (2) -d (archive deleting) keys.
• --fsck-prune — requires -d (archive deleting) keys, since it needs to be able to delete corrupted archives.

---

🧚 the passphrase options (lock it up, queen) 🧚

• --passphrased — if you specify this, the user will be prompted to enter a passphrase (twice, yes twice, don't @ me) to be used to encrypt the key file. 🔥
• --passphrase-mem maxmem — if specified, a maximum of maxmem bytes of RAM will be used in the scrypt key derivation function to encrypt the key file. and honestly? it may be necessary to set this option if a key file is being created on a system with far more RAM than the system on which the key file will be used. imagine your beefy server key not sliding into your lil laptop. tragic. 😭
• --passphrase-time maxtime — if specified, a maximum of approximately maxtime seconds will be used in the scrypt key derivation function to encrypt the key file. ⏳

⚠️ okay heads up: if none of -w, -r, -d, or --nuke are specified, a key file will be produced which does not contain any keys. like... an empty vibe. this is probably not very useful. 💀

---

👑 the print-y options 👑

• --print-key-id key-file — displays the 64-bit integer corresponding to the key's machine number. could be useful for scripts or GUIs which manage a user's Tarsnap account, but ngl it's not likely to be helpful for command-line use.
• --print-key-permissions key-file — displays the permissions which the key possesses. periodt.
• --version — prints the version number of tarsnap-keymgmt, then exits. that's it, that's the whole thing. 💅

---

💌 sign-off 💌

this icon was served to you fresh off the Debian press, dated March 20, 2025 — go forth and make only the keys you actually need, bestie. 🫶✨🌈

TARSNAP-KEYMGMT(1) — General Commands Manual — slay responsibly 💜