registry-render keygen command reference
Generate a seal key and the certificate request for its seal certificate.
Contract status
Section titled “Contract status”This page is generated from the public Clap command tree for Registry Stack source version 0.46.0 and catalog SHA-256 d43b1bf418e0b00fac52311fa3a106fa124512dbc88cf511475713af2d73aa47. Hidden implementation commands are omitted.
Description
Section titled “Description”Generate a seal key and the certificate request for its seal certificate. Writes the private JWK owner-only to —key, the file a local-jwk signer’s privateKeyRef names, and a PKCS #10 request to —csr for the certificate authority. With —from-pem, converts an existing unencrypted PKCS #8 key instead of generating one. With —transit-unix-socket-path, the key is a Transit key a transit signer names: it signs the request through the signing proxy, and only —csr is written. No output file may exist, and no key material is printed.
registry-render keygen [OPTIONS] --csr <FILE> --common-name <TEXT>Constraints
Section titled “Constraints”| Condition | Requirement |
|---|---|
--transit-unix-socket-path <PATH> is present | All of --transit-mount <ID>, --transit-key-name <ID>, --transit-key-version <VERSION> are required. |
--transit-mount <ID> is present | All of --transit-key-name <ID>, --transit-key-version <VERSION>, --transit-unix-socket-path <PATH> are required. |
--transit-key-name <ID> is present | All of --transit-mount <ID>, --transit-key-version <VERSION>, --transit-unix-socket-path <PATH> are required. |
| Command invocation | --algorithm <ALGORITHM> and --transit-unix-socket-path <PATH> cannot be used together. |
| Command invocation | --from-pem <FILE> and --transit-unix-socket-path <PATH> cannot be used together. |
| Command invocation | --key <FILE> and --transit-unix-socket-path <PATH> cannot be used together. |
Options
Section titled “Options”| Option | Always required | Default | Values | Environment | Description |
|---|---|---|---|---|---|
--key <FILE> | No | n/a | n/a | n/a | New private JWK file, created with mode 0600 |
--csr <FILE> | Yes | n/a | n/a | n/a | New PEM certificate request file |
--common-name <TEXT> | Yes | n/a | n/a | n/a | The seal’s name, the request’s commonName |
--organization <TEXT> | No | n/a | n/a | n/a | The institution, the request’s organizationName |
--country <CODE> | No | n/a | n/a | n/a | The ISO 3166 two-letter country code, the request’s countryName |
--algorithm <ALGORITHM> | No | n/a | es256, es384, rs256, rs384 | n/a | Seal algorithm. Default: es256 for a generated key; for —from-pem, the one the key’s curve fixes, or rs256 for an RSA key |
--from-pem <FILE> | No | n/a | n/a | n/a | Unencrypted PKCS #8 PEM private key to convert. Encrypted PKCS #8, SEC 1, PKCS #1 and PKCS #12 files are refused with the openssl command that converts them |
--transit-unix-socket-path <PATH> | No | n/a | n/a | n/a | The Transit signing proxy’s Unix socket, as signer.unixSocketPath names it: the seal key is a Transit key, which signs the request, and no key file is written. A production seal’s key is one |
--transit-mount <ID> | No | n/a | n/a | n/a | The Transit mount, as signer.mount names it |
--transit-key-name <ID> | No | n/a | n/a | n/a | The Transit key, an ecdsa-p256 key, as signer.keyName names it |
--transit-key-version <VERSION> | No | n/a | n/a | n/a | The Transit key version the certificate is for, as signer.keyVersion pins it |
-h, --help | No | n/a | n/a | n/a | Print help (see a summary with ‘-h’) |
Generation contract
Section titled “Generation contract”After changing a public command, argument, option, default, environment binding, or help description, run cargo run --locked -p registry-cli-docs -- --write, commit crates/registry-cli-docs/catalog.json, then run npm run generate from docs/site.