wotsap - Wotsap archive manipulation


  Usage: wotsap [-v] [-q] [-d] [-h] work-dir COMMAND ...
  option v : be verbose
  option q : be quiet
  option d : show debug info
  option h : show help ; exit
  Usage: make [-g path/to/gpg] [-k key_server] [-r root_key]
  Usage: open
  Usage: info [-v] [key_id]
  Usage: import wotsap-file
  Usage: check
  Usage: reset [-keysum where] [-keybad where]
  Usage: update [-cache days] max [kid]
  Usage: scc
  Usage: export [-v version]
  Usage: xpaths [-j] [-r] [-m max] from to


Program wotsap handles Wotsap archives. A Wotsap archive is a densely packed file containing historic information about the PGP strong set. See for a description of the Wotfile format.

Central to wotsap is the notion of a Wotsap working directory (workdir for short). A workdir is just a directory containing files pertaining to one Wotsap archive.

To decompress, unpack and decode an existing Wotsap archive my-archive into workdir my-workdir use :

  wotsap my-workdir make import my-archive

To create a fresh Wotsap archive prod/export.wot, use :

  wotsap prod make -k some-key-server update -reset 0 scc export

... and to refresh :

  wotsap prod update -reset 0 scc export

Please note :



be verbose


be quiet


show debug info


show help ; exit


command make

  Usage: make [-g path/to/gpg] [-k key-server] [-r root-key]

Command make creates or updates a workdir.

The values of the options are stored in the workdir as meta-information.

-g pgp-path

The path to program gpg(1), default /usr/bin/gpg.

-k key-server

The domain name of a pgp keyserver ; no default.

-r root-key

The start-key used by commands update and scc ; default 8b962943fc243f3c.

command open

  Usage: open

Command open just execs sqlite3(1) on the workdir's sqlite database ; for your convenience.

command info

  Usage: info [-v] [key-id]

Command info shows the meta-data stored in the workdir's database.

If a key-id] is provided, some info about the key is shown ; otherwise the number of keys and signatures is shown.

command import

  Usage: import wotsap-file

command check

  Usage: check

Command check verifies that the keys and signatures in the workdir's sqlite database form a strongly connected graph.

command reset

  Usage: reset [-keydata where]

Command reset resets the update process : the queue is emptied and all keys are set to not visited.

Option -keydata resets meta-data for keys specified with the where-clause.

On subsequent update runs, the keys will be re-fetched from the key-server (or the cache), and re-evaluated.


  reset -keydata "bad = ''"
  reset -keydata "bad = 'expired'"
  reset -keydata "kid = 'some-key-id'"

command update

  Usage: update [-cache days] max [kid]

Command update fetches keys from a keyserver (or the cache), and updates the workdir's database.

At most $max keys are updated ; $max = 0 means no limit.

Starting with some root-key, command update does a search of the PGP graph, updating and marking visited keys.

  queue = [ some-root-key ] # if no keys are marked 'visited'
  while ( queue-is-not-empty )
    { key = shift queue ;
      if ( key.visited == 0 )
        { update key ;
          key.visited = 1 ;
          push queue key.signers ;

Command update remembers the contents of the queue and the state of the keys (visited, not-visited) from one run to the next ; it continues where the previous update-run stopped.

If an optional key_id kid is supplied, that key is deleted, and used as some-root-key ; max is set to 1. This is for debugging :

  % wotsap -d X update 1 kid

With option -cache $days, fetched keys are cached, and cached keys will be used (if not older that $days days), instead of fetched from the key-server.

Keys that were not found on the keyserver in a previous update-run will always be retrieved from the keyserver, because only non-empty key-blocks are cached.

With $days = 0, the cache will be written but not used.

Caching is cheap in cpu-cycles (involving only file link/unlinks), but a cache typically uses 1.2 GB per 100,000 keys.

command scc

  Usage: scc

Command scc computes the SCC of the keys and signatures in the workdir's database, marking keys with a wid-bit : in or not in the strong set.

command export

  Usage: export [version]

Command export creates an export file export.wot.

Optionally specify the export file's Wotsap version : 0.2 or 0.3 ; default is 0.3.

command xpaths

  Usage: xpaths [-j] [-r] [-m max] from to

Command xpaths finds paths from key from to key to.


Print a json identifying from, to and the (interior of the) paths found.


Find reverse paths.

-m max

Return at most max paths ; default 8.

Regarding arguments from and to :


Wotsap is available from

Install with


or, test only with

  cpanm --test-only




Wotsap © 2015 Henk P. Penning - All rights reserved ; Wotsap-0.02.09 - Sun Sep 9 09:08:20 2018

You may distribute under the terms of either the GNU General Public License or the Artistic License, as specified in the Perl 5.10.0 README file.