tako gen-key¶

Generate a key pair for signing manifests.

Synopsis¶

tako gen-key
tako gen-key -h | --help

Description¶

This command generates an Ed25519 key pair. Both are printed to stdout, base64 encoded. The secret key should be kept in a secure location, for example in a password manager, or in a secret store such as Vault if automated signing is desired. Tako avoids writing the secret key to disk: the secret key is not protected by a passphrase (like SSH keys can be), so if you do want to store the secret key in a plain file, be sure to use full-disk encryption. The public key (the shorter one) should be announced to end users.

The secret key is prefixed with SECRET+, to reduce the risk of mistaking the secret key for public data. The prefix is part of the key, it must always be included.