Class PublisherSecretsManagerCli

java.lang.Object
zeroecho.pki.cli.PublisherSecretsManagerCli
public final class PublisherSecretsManagerCli extends Object
Operator tool for managing the publisher secrets store.

This is a deployment-only entry point separate from the main PKI CLI. It is not part of the public CLI catalog and has no interactive interface.

Commands

generate-bike-key --pub <path> --priv <path>
Generates a BIKE-256 key pair. Public key is written as X.509 DER; private key is written as PKCS#8 DER. Keep the private key on a secure, access-controlled storage (HSM or restricted filesystem).
write-store --store <path> --secrets <json> --protection CLASSIC|PQC|HYBRID [--password-env VAR] [--bike-pub <path>]
Encrypts a plaintext secrets JSON file into the store. The secrets JSON must be a flat object: {"id": "value", ...}. The plaintext file must be kept on secure storage and deleted after the store is written.
verify-store --store <path> [--password-env VAR] [--bike-priv <path>]
Decrypts the store and prints the secret identifiers (not values) as a verification check.

  • Method Details

    • main

      public static void main(String[] arguments)
      Entry point for the publisher secrets manager.
      Parameters:
      arguments - command name and command-specific options