YB-FSCK(1)

📦
version 0.5.2 · 2 versions
, in nixpkgs unstable

💅 YB-FSCK(1) — like, the fsck manual page, bestie

okay so real quick — this is page one of the manual, section one, User Commands, and the tool is literally called fsck. yes, that fsck. no cap. let's get into it 🫶

✨ NAME ✨

fsck — filesystem check, aka dump store metadata 💾 (yes, it's giving "the name is scarier than the job")

🌸 SYNOPSIS 🌸

fsck [-v|--verbose] [--nvm] [--check-key] [-h|--help]

🦋 DESCRIPTION 🦋

So what does it actually do? It reports the state of your YubiKey — think PIN and PUK, management key, store slot — and then it reads the store header plus all the PIV objects without decrypting any blob. Then it verifies every single blob's ECDSA signature and prints an integrity summary. Iconic behaviour, honestly. ✨

No PIN is required for any of that… except with --check-key, which checks that the key in the store slot matches its certificate. That one's gonna want the PIN. 🔑

fsck runs on any YubiKey — including a factory-fresh one, or one that doesn't even have a store. Very "works on my machine, and yours too" of it. 💁‍♀️

⚠️ exit status tea: it exits with status 1 when the report shows an error, and 0 otherwise. Warnings (like factory-default credentials) do not change the exit status. Periodt.

What counts as an error, you ask? Glad you did 👀 — it's status 1 for:

  • blocked PIN
  • unsupported management key mode
  • key/certificate mismatch
  • a certificate without an EC P-256 key
  • an unreadable store
  • a CORRUPTED blob

Also, when the YubiKey does not keep its management key, you get a hint telling you how to have it kept (yb rotate-management-key). Thoughtful queen behaviour. 🎀

💀 big caveat, do not skip: fsck does not repair damage. At all. It's a look-don't-touch situation. Use yb remove to clean up corrupt blobs.

💜 OPTIONS 💜

  • -v, --verbose — prints the full per-object dump on top of the summary. Maximum detail, maximum main character energy 🔍
  • --nvm — scans all PIV objects to report NVM usage (store / other / free). Heads up: it issues ~290 read-only APDUs, so it may take a few seconds on real hardware. 🐌✨
  • --check-key — asks for the PIN and checks that the key in the store slot matches its certificate 🔐
  • -h, --help — prints help. the classic. the icon. 💅

🎀 OUTPUT 🎀

the default output (no flags, bestie)

YubiKey <serial> — firmware <version>
  PIN              ok (3/3 tries left)
  PUK              ok (3/3 tries left)
  Management key   3DES, kept on the YubiKey, unlocked by the PIN
  Slot 0x82        EC P-256, generated on card, certificate CN=YBLOB ECCP256
  Key/certificate  not checked (use --check-key)

Store: <n> objects, slot 0x<xx>, age <n>
Blobs: <n> stored, <n> objects free (~<n> bytes used by store)

  blob-name-1          VERIFIED
  blob-name-2          UNVERIFIED
  old-blob             CORRUPTED

Integrity: <n> verified, <n> unverified, <n> corrupted

🍓 possible per-blob verdicts

  • VERIFIED — ECDSA signature is present and cryptographically valid. slay. ✅
  • UNVERIFIED — no signature trailer (that's the older yb0/yb1 format) or the certificate is unreadable. 🥲
  • CORRUPTED — signature present but verification failed, or the payload is truncated. 🚨

with --nvm

An additional NVM breakdown line gets printed right after the integrity summary, showing bytes attributed to the yb store, to other PIV objects, and the estimated free space. Again for the people in the back: this issues approximately 290 read-only APDUs and may take a few seconds on real hardware. ⏳

with --verbose

Structural warnings (orphaned continuation chunks, duplicate blob names — yes those are the two, that's the whole list) get printed after the integrity summary, followed by a raw per-object dump showing all metadata fields. Everything. All of it. 👑

🌈 EXAMPLES 🌈

Integrity audit:

yb fsck

Audit with NVM breakdown:

yb fsck --nvm

Full object dump for debugging:

yb fsck --verbose

Also check the store key against its certificate (asks for the PIN):

yb fsck --check-key

👑 SEE ALSO 👑

yb(1), yb-list(1), yb-format(1), yb-remove(1)

okay and that's the whole page, mwah 💋 — this little masterpiece lives in the yb manual, dated 2026-03, and it's the YB-FSCK(1) entry, so now you know your way around it fr fr 🦋✨

📦 where this page comes from