TARSNAP-RECRYPT(1)

💅 TARSNAP-RECRYPT 💅

okay bestie, welcome to tarsnap-recrypt(1) from the General Commands Manual — she's a little re-encryption icon and she's here to make your data glow up ✨

---

🦋 NAME 🦋

tarsnap-recrypt — re-encrypts data stored using tarsnap(1) 🎀

---

🌸 SYNOPSIS 🌸

tarsnap-recrypt --oldkey old-key-file --oldcachedir old-cache-dir
                --newkey new-key-file --newcachedir new-cache-dir
tarsnap-recrypt --version

---

💖 DESCRIPTION 💖

okay so here's the whole vibe, no cap: tarsnap-recrypt downloads and decrypts your data using old-key-file, then re-encrypts it and uploads it all back using new-key-file. 🫶 Literally a full glow-up for your archives.

After all the data has been re-uploaded, tarsnap-recrypt deletes the data using old-key-file 🗑️ — so that the only remaining copy of the data is encrypted using new-key-file. That's the whole point, bestie: one key to rule them all.

heads up: the key file new-key-file must have been generated by tarsnap-keyregen(1) with old-key-file. Not optional, not vibe-flexible. 👑

tarsnap-recrypt checkpoints its progress after every 1-2 GB of data that it has copied 💾 — so if it gets interrupted (rude) it can be re-run and it will attempt to continue. Resumable queen behavior, honestly. 🌈

⚠️ also like. important. after tarsnap-recrypt completes it will be possible to store more archives using the key old-key-file and the cache directory old-cache-dir, so care should be taken to disable any automatic (e.g., cron(8)) archiving while tarsnap-recrypt is run. Do NOT let cron sneak in and start making new archives mid-operation, that's a main-character-betrayal. 😭

The --version option prints the version number of tarsnap-recrypt, then exits. Short, sweet, iconic. 💅

---

⭐ EXAMPLES ⭐

here's the exact sequence, slay 💜 — this will create new keys and re-encrypt data, assuming that the currently used keys are in /root/tarsnap.key and the current cache directory is /usr/local/tarsnap-cache:

tarsnap-keyregen --keyfile /root/tarsnap.key.new --oldkey
/root/tarsnap.key --user me@example.com --machine myserver

tarsnap-recrypt --oldkey /root/tarsnap.key --oldcachedir
/usr/local/tarsnap-cache --newkey /root/tarsnap.key.new
--newcachedir /usr/local/tarsnap-cache.new

rm -r /usr/local/tarsnap-cache

mv /usr/local/tarsnap-cache.new /usr/local/tarsnap-cache

rm /root/tarsnap.key

mv /root/tarsnap.key.new /root/tarsnap.key

look at that pipeline. immaculate. the way it keyregens, recrypts, swaps the caches, yeets the old key, and renames the new one into place? ate. 🔥👑

---

kisses and good vibes from the Debian girlies 💖 this one's dated March 20, 2025 — go forth and re-encrypt, bestie 🎀✨