# winch secret rekey

encrypt all secrets again

## Examples

```sh
# encrypt all secrets again for the recipients in winch.yaml
winch secret rekey
```

## Usage

```
winch secret rekey
```

Rekey encrypts all secrets in winch.yaml, the inventories, and the recipes again for the recipients in winch.yaml. It lists the files it rewrote.

Run it after a change of the recipients.

It writes through a symbolic link to its target. When a secret does not decrypt, rekey changes no file.

winch reads the age key from the stdout of the command in WINCH\_AGE\_IDENTITY\_CMD, which runs through sh -c. Without it, winch reads the file that WINCH\_AGE\_KEY names, or else \~/.config/winch/age.key. Both variables set is an error.

## See

- `winch doc secrets`