`maqpna keys generate`

Generate a signing key: ML-DSA, Ed25519, ES256 or RS256

Operate-o json | yaml

Synopsis#

maqpna keys generate --alg ML-DSA-65|ML-DSA-44|ML-DSA-87|Ed25519|ES256|RS256 --out KEY.pem [--pub PUB.pem] [--jwk] [--force]

Description#

From the help of maqpna keys:

Common flags: --dry-run (print the plan only), --timeout (per rollout, default 5m), --gateway URL (used to confirm the result through the admin API when reachable). Deployments default to the chart names (maqpna-identity, maqpna-gateway, maqpna-attest, maqpna-operator); override with --deployment / --operator-deployment. See docs/runbooks/key-rotation.md.

Flags#

Flag	Type	Description	Default
`--alg`	string	algorithm: ML-DSA-65 (default), ML-DSA-44, ML-DSA-87, Ed25519 (EdDSA), ES256 (P-256) or RS256 (RSA 3072)	`ML-DSA-65`
`--force`	switch	overwrite existing files	none
`--jwk`	switch	also print the public JWK (AKP for ML-DSA, RFC 9964)	none
`--out`	string	private key file to write (PKCS#8 PEM, mode 0600)	none
`--pub`	string	public key file (default: OUT with .pub.pem)	none

The global flags (--context, -o, --no-color, ...) work with every command.

What happens when you run it#

--force: overwrite existing files.
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna keys generate