chore(vault): a second human operator's YubiKey decrypts the fabrikk vault

beddari commented

2026-09-20 16:21:41 +00:00

Owner

Adds age1yubikey1qwtamp... to the vault config agePublicKey and the matching .sops.yaml rule, and re-encrypts the vault file through the vault itself: a put rewrites it to every recipient. The recipients/reencrypt key is that write, kept because the sops-age provider cannot delete. The vault decrypts here with the factory soft key after the change; the new YubiKey is for its owner to verify.

beddari added 1 commit

2026-09-20 16:21:42 +00:00

chore(vault): a second human operator's YubiKey decrypts the fabrikk vault

validate-attestation / validate (pull_request) Has been cancelled

Details

d039d2edee

age1yubikey1qwtamp... joins the vault's agePublicKey list and the rule
in .sops.yaml; the file is re-encrypted through the vault itself (a put
rewrites it to every recipient), which is what the recipients/reencrypt
key records, since the provider cannot delete it.

beddari force-pushed second-operator from d039d2edee

validate-attestation / validate (pull_request) Has been cancelled

Details

to 74d252540a

validate-attestation / validate (pull_request) Failing after 2m12s

Details

2026-09-20 16:22:46 +00:00

Compare

beddari merged commit b4e54171aa into main

2026-09-20 16:31:06 +00:00

beddari deleted branch second-operator

2026-09-20 16:31:06 +00:00