Skip to main content

Node Key Provisioning CLI Reference

This guide covers generating and inspecting cryptographic node signing keys using the m crypto CLI commands implemented in libs/framework-m-standard/src/framework_m_standard/cli/crypto.py.

1. Key Providers Overview​

Framework M uses Ed25519 signing keys to seal outbox envelopes before they leave a node:

  • Software Key (SoftwareKeyProvider): Reads an Ed25519 private key from a local PEM file. Requires 0o400 POSIX file permissions. In development mode (FRAMEWORK_M_ENV!=production), it automatically falls back to an ephemeral in-memory key if no file exists.

2. Generating Keys (m crypto keygen)​

Generates a private key file and sets 0400 permissions (read-only by file owner):

m crypto keygen --path /etc/framework-m/node.key

Options:

  • --path, -p: Target path to save the private key file. Defaults to FRAMEWORK_M_NODE_KEY_PATH or /etc/framework-m/node.key.

3. Inspecting Public Keys (m crypto inspect-key)​

Prints the hex-encoded 32-byte Ed25519 public key corresponding to a private key file:

m crypto inspect-key --path /etc/framework-m/node.key

Example Output:

Node Key: /etc/framework-m/node.key
Public Key (Hex): 9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
Status: Valid (chmod 0400)

The printed hex string is registered in the central KeyRegistryRepository to authorize the node.