CLEANARCH(1)

📦 version 2.2.3, in arch rolling

💅 CLEANARCH(1) — like, the manual page, bestie ✨

okay so real quick: this is cleanarch, a User Contributed Perl Documentation page, and it's genuinely the glow-up your DNSSEC-Tools key archive has been waiting for. we're cleaning out old keys. it's giving spring cleaning but for cryptography. 🧹💖

✨ NAME ✨

cleanarch — Clean a DNSSEC-Tools key archive of old keys. that's it. that's the job. 💅

🎀 SYNOPSIS 🎀

cleanarch [options] <keyrec-file | rollrec-file>

one file arg, lots of options. we love a flexible queen. 🦋

🌸 DESCRIPTION 🌸

cleanarch deletes old keys from a DNSSEC-Tools key archive. how does it decide what counts as "old"? the vibe check comes from your options and arguments — key "age" and archives are determined by those. ✨

the command line options and arguments let you pick which archives, which keys to delete, and how much output to provide. the options are divided into three groups: archive selection, key selection, and output format. the full tea on all of them lives in the OPTIONS section, and yes, we get into every single one. 🫶

cleanarch takes a single argument (as distinguished from an option, bestie, do not come for me). that argument may be either a keyrec file or a rollrec file:

  • if the file is a keyrec file, the archive directory for its zone keyrecs gets added to the list of archives to clean. 📂
  • if the file is a rollrec file, keyrec files for its zones are searched for the zones' archive directory, and those directories get added to the list of archives to clean. 🔍
  • if a zone does not have an archive directory explicitly defined, then the DNSSEC-Tools default will be cleaned. defaults, always coming in clutch.

the archives specified by this argument may be modified by archive-selection options. like, the arg shows up, but the options can still rearrange the seating chart.

the archive-selection options combine with the keyrec or rollrec file to select a set of archive directories to clean. (some options can take the place of the file argument entirely — main character energy, honestly.) 👑

the key-selection options let the set of keys to be deleted contain an entire archive, a particular zone's keys, or all the keys prior to a certain date. so many ways to say goodbye. 😭

the output-format options set how much output you'll be given:

  • with no options selected, the names of keys will be printed as they are deleted.
  • with -verbose, the directories selected for searching and the keys selected for deletion will be printed.
  • with -dirlist, the directories selected for searching will be printed, and no other action will be taken.
  • with -list, the keys selected for deletion will be printed, and no other action will be taken.
⚠️ important, no cap: cleanarch only cleans the archive directories. the keyrec files are left intact. the cleankrf command should be used in conjunction with cleanarch in order to have a consistent environment. team work makes the dream work. 🤝

💅 OPTIONS 💅

🗂️ Archive-Selection Options

these let you pick which archives get cleaned. choose your fighters. ✨

  • -archive directory — specifies an archive directory to be cleaned. that's the one, bestie, that's the target. 🎯
  • -defarch — says "hey, clean the default archive directory" — the one named in the DNSSEC-Tools configuration file. the ol' reliable. 🏠
  • -zone zone — says zone is the only zone whose archive will be cleaned. heads up though: if the archive directory is shared by other zones, then their keys may also be deleted. shared custody, shared consequences. 🙈

🔑 Key-Selection Options

these let you pick which keys are getting deleted. be strong. 😭

  • -all — deletes all keys in the selected archives. everything. the whole closet. 🔥 this option may not be used with any other key-selection options — like, it doesn't share the spotlight, periodt.
  • -days days — deletes all keys except those whose modification date is within the days full days preceding the current day. so recent keys stay, old ones go. math is math. 🧮
  • -onezone zone — only keys with zone in the key's filename are deleted. intended for use in cleaning a multi-zone key archive. multitasking icon. 🌈
🫶 real talk: this does not validate that zone is an actual zone. any string can be used here. for example, using "private" will select old private key files for deletion, and using "com" will select any filename that contains "com". it's a vibes-based filter, not a strict one. handle with care.

📢 Options for Output Control

because sometimes you want the play-by-play and sometimes you want silence. both are valid. 💜

  • -dirlist — lists the selected archive directories. no other action is taken. just a lil look, no touching. 👀
  • -list — lists the selected keys. no other action is taken. again: looking only.
  • -quiet — display no output. shhh. 🤫
  • -verbose — display verbose output. tell me everything. 🗣️
  • -Version — displays the version information for cleanarch and the DNSSEC-Tools package. (note the capital V, bestie — it's -Version, not -version.) ⭐
  • -help — display a usage message and exit. the classic escape hatch. 🚪

🚨 WARNINGS 🚨

the user is advised to invest a bit of time testing this tool prior to putting it into production use. please please please test it first. 🙏

once a key is deleted, it is gone. like, gone gone. no undo button, no drafts folder, nothing. 💀

some may find this to be detrimental to the health of their DNSSEC-Tools installation. which is a very polite way of saying "you might genuinely wreck your setup, so maybe don't yolo it." 😭

Copyright 2007-2014 SPARTA, Inc. All rights reserved. see the COPYING file included with the DNSSEC-Tools package for details. legal girlies, this one's for you. 🎀

👑 AUTHOR 👑

Wayne Morrison, tewok@tislabs.com. thank you wayne, icon behaviour. 🫶

🔗 SEE ALSO 🔗

  • cleankrf(8), lskrf(8), zonesigner(8)
  • Net::DNS::SEC::Tools::keyrec.pm(3), Net::DNS::SEC::Tools::rollrec.pm(3)
  • dnssec-tools.conf(5), keyrec.pm(5), rollrec.pm(5)

go read them, iykyk. 📚✨

and that's the whole page, bestie! 💖 this one shipped as perl v5.44.0 and got its timestamp on 2026-10-17 — so like, screenshot it, cite it, love it. mwah. 💅🎀🦋

📦 where this page comes from