CONVERTAR(1)

📦 version 2.2.3, in arch rolling

🎀 CONVERTAR(1) — the convertar page, but make it cute 🎀

okay so bestie, buckle up: this is convertar, and yes she's from the Perl world (user contributed docs, we love to see it). she converts Trust Anchor Repositories from one format to another and she does it flawlessly. 💅

✨ NAME ✨

convertar — converts trust anchor repositories from one format to another. that's the whole vibe. periodt.

💖 DESCRIPTION 💖

okay so here's what's going on: convertar operates on input and output files of different Trust Anchor Repository (TAR) formats. it figures out which file format you're talking about by looking at a "type:filename" spec. main character energy, honestly.

the way options work: you pass them to the convertar module using a / delimited specifier inside the type identifier. like this, bestie:

type/option=value/other=othervalue:filename

scroll down for the list of input and output formats that convertar understands by default and what options each one takes. 👑

also!! if you wanna write new plugins so convertar can understand other TAR formats (slay, we love an expandable queen), go read the Net::DNS::SEC::Tools::TrustAnchor module and its documentation. that's where the lore lives. 📚

🌸 EXAMPLES 🌸

this command reads in an itar.xml file (available from https://itar.iana.org/) and converts it into a file that BIND's named application can read. iconic behavior:

# convertar -i itar:itar.xml -o bind:bind.conf

and this one? this one reads in multiple files, merges them all together, and writes them out to two different output file formats at the same time (the libval format goes to stdout, as a treat):

# convertar -i itar:itar.xml,csv:local.csv -o bind:bind.conf,libval:-

multi-tasking queen fr fr. 🦋

🧚 FILE SPECIFICATION CONVENTIONS 🧚

types and files (e.g. for the -i and -o switches) are specified using this format, bestie:

type:/path/to/file

the type portion of the spec is what tells the internal module which one is gonna attempt to read in the file. the file portion? it may or may not be required (but the ':' always is, no cap) and it may or may not point to a real file, depending on which module is in charge of the content. some modules may, for example, load content from the network. living dangerously, we respect it.

for types that can read and write to a file, you can specify a '-' as the file to print to — or read from — standard output. 🫶

file formats MAY be infered from a trailing suffix, if the trailing suffix. EG, if a referenced file is foo.csv then internally convertar will translate this to "csv:foo.csv". yes, it just knows. iykyk. ✨

💜 FILE FORMATS 💜

the following file formats are known by default to convertar:

  • bind — a BIND name server (named) compatible trust anchor configuration file. you can include this within a master named.conf file using the "include" directive. 🔥

the bind option can also take a /write_expectations=1 flag when writing, which writes out an options {} section that will turn on dnssec and require validation for zones from all the imported data.

E.G. bind/write_expectations=1:named.conf

  • secspider — this is merely an alias that fetches the specspider (http://secspider.cs.ucla.edu/) bind configuration file and then parses it using the bind file format.
⚠️ WARNING: the PGP signature on the downloaded file is NOT checked. not me trusting the internet 😭
  • csv — a comma-separated list format. simple, clean, slays. 🌈
  • dump — a Perl hash dump format. this should be used mostly for debugging of newly developed modules, because it shows the internal hash structure that is passed between modules. peek behind the curtain, bestie. 👀
  • itar — IANA's itar format, which is an XML-based format of trust anchor keys. IANA's file is available from https://itar.iana.org/.

if you specify only a 'itar:' line only (or itar:URL), convertar will attempt to retrieve the current remote ITAR respository file directly. she'll go get it herself. 💅

⚠️ WARNING: the PGP signature on the downloaded file is NOT checked. again!! 😭
📌 NOTE: support for downloading the ITAR repository over the network requires the LWP::UserAgent module to be installed. no module, no download, that's the rule. 🎀
  • libval — the libval format is the configuration file format that DNSSEC-Tool's libval library uses.

the libval option can also take a /write_expectations=1 flag when writing, to specify that the default (:) zone-security-expectation's should be populated to require validation of all the zones with imported data. all other zones will have a policy set to 'ignore.

E.G. libval/write_expectations=1:dnsval.conf

  • mf — the master file (mf) format is also available from the itar web site. 🍓
  • dns — the dns format performs live queries of records attached to a domain name to request either DS or DNSKEY records. by default, DNSKEY records will be queried. the specific type to be queried can be specified by preceeding the zone name with a "ds/" or "dnskey/" prefix. here are example valid 'dns:' type specifications, bestie:
dns:dnssec-tools.org
dns:ds/dnssec-tools.org
dns:dnskey/dnssec-tools.org

also, if you want to read dnskeys from the network but convert them to ds records, you can use the /tods flag:

dns/tods=1:dnssec-tools.org

the DNS type can not output records and is only useful for reading in information. she reads, she doesn't write, we stan a listener. 🙈

⚠️ WARNING: the keys and data being retrieved are not internally validated and thus should not be trusted unless a secured resolver is being used. fr fr, don't trust it blindly. 💀

⭐ OPTIONS ⭐

  • -i STRING, --input-file=STRING — input file(s) to process.

convertar will read in the specified file(s). multiple files can be separated by commas. 🫶

  • -o STRING, --output-file=STRING — output file(s) to write.

convertar will write out these specified file(s) in the requested output formats. multiple files can be separated by commas. yes, plural, go off. 🔥

  • -h, --help, --help-full — displays command line help information. when in doubt, ask for help, bestie. 💖
  • --gui, --no-gui — controls the use of the optional GUI. it's optional, it's a GUI, it's giving choices. 🎀

Copyright 2009-2013 SPARTA, Inc. All rights reserved. see the COPYING file included with the DNSSEC-Tools package for details. legal queen behavior, we respect the paperwork. 📜

🌟 AUTHOR 🌟

Wes Hardaker < hardaker AT users DOT sourceforge DOT net > — the icon, the legend, the moment. 💅

🦋 SEE ALSO 🦋

Net::DNS::SEC::Tools::TrustAnchor(3) — go read it, it's the whole plugin lore iykyk. 📖

aaaand that's the page!! mwah, go convert some trust anchors bestie 💖✨ — this masterpiece was served to you by perl v5.44.0 on 2026-10-17. 🎀

📦 where this page comes from