winch secret rekey
encrypt all secrets again
Examples
# encrypt all secrets again for the recipients in winch.yaml
winch secret rekeyUsage
winch secret rekeyRekey encrypts all secrets in winch.yaml, the inventories, and the recipes again for the recipients in winch.yaml. It lists the files it rewrote.
Run it after a change of the recipients.
It writes through a symbolic link to its target. When a secret does not decrypt, rekey changes no file.
winch reads the age key from the stdout of the command in WINCH_AGE_IDENTITY_CMD, which runs through sh -c. Without it, winch reads the file that WINCH_AGE_KEY names, or else ~/.config/winch/age.key. Both variables set is an error.
See
winch doc secrets