Class GenSigningKeyCommand

java.lang.Object
org.egothor.methodatlas.evidence.GenSigningKeyCommand
public final class GenSigningKeyCommand extends Object
CLI command handler for the -gen-signing-key mode, which creates (or extends) an encrypted ZeroEcho keyring containing a fresh signing key pair for evidence-pack signing.

The mode is recognised and dispatched by MethodAtlasApp before the normal scan-argument parsing, mirroring how -diff is handled. It is self-contained: it parses its own small set of options and never participates in the scan pipeline.

Usage

methodatlas -gen-signing-key <keyring-file> [-key-alias <alias>] \
            [-key-algo <algorithm>] [-overwrite] \
            [-key-password-file <file> | -key-password-env <VAR>]

The keyring is encrypted with a password resolved by KeyringPasswordSource: a password file, a named environment variable, METHODATLAS_KEYRING_PASSWORD, or an interactive prompt. A password is never accepted as a command-line value. The keyring lives in an owner-only directory together with its .nonce sidecar; keep both out of version control and out of any distributed evidence pack. See SigningKeyGenerator.

Since:
4.0.0
See Also:
  • SigningKeyGenerator
  • ZeroEchoSigner

  • Field Details

    • FLAG_GEN_SIGNING_KEY

      public static final String FLAG_GEN_SIGNING_KEY
      Mode flag that selects this command.
      See Also:

  • Method Details

    • run

      public static int run(String[] args, PrintWriter out) throws IOException
      Parses -gen-signing-key arguments and runs the command.
      Parameters:
      args - full command-line arguments, including the -gen-signing-key flag and its value
      out - writer that receives the success summary
      Returns:
      0 on success, 2 when the arguments are invalid
      Throws:
      IOException - if no password is available, the keyring cannot be written, an alias collides without -overwrite, or key generation fails