Next: , Previous: Informative, Up: Command Reference



5.5 Key and Cert

monotone genkey keyid
This command generates an rsa public/private key pair, using a system random number generator, and stores it in your database under the key name keyid. If the the hook non_blocking_rng_ok() returns true, the key generation will use an unlimited random number generator (such as /dev/urandom), otherwise it will use a higher quality random number generator (such as /dev/random) but might run slightly slower.

The private half of the key is stored in an encrypted form, using the symmetric cipher arc4, so that anyone accidentally reading your database cannot extract your private key and use it. You must provide a passphrase for your key when it is generated, which is used to key the arc4 cipher. In the future you will need to enter this passphrase again each time you sign a certificate, which happens every time you commit to your database. You can tell monotone to automatically use a certain passphrase for a given key using the get_passphrase(keypair_id), but this significantly increases the risk of a key compromise on your local computer. Be careful using this hook.

monotone chkeypass id
This command lets you change the passphrase of the private half of the key id.
monotone cert id certname
monotone cert id certname certval
These commands create a new certificate with name certname, for a revision with version id. If certval is provided, it is the value of the certificate. Otherwise the certificate value is read from stdin.
monotone trusted id certname certval signers
This command lets you test your revision trust hook get_revision_cert_trust (see Hook Reference). You pass it a revision id, a certificate name, a certificate value, and one or more key ids, and it will tell you whether, under your current settings, Monotone would trust a cert on that revision with that value signed by those keys.