core-lightning/doc/lightning-hsmtool.8.md
Rusty Russell 3c3f4731bd doc: format markdown correctly.
There are no definition lists in Markdown, and lists get mangled if
they follow immediately: they need a line between them.

So use bullets for options, and use an indent so the text gets in the
line below.

Here's a before-and-after example:

```diff
 --- /tmp/after	2022-07-20 21:55:54.355487769 +0930
 +++ /tmp/after2	2022-07-20 21:58:17.305642576 +0930
 @@ -10,38 +10,71 @@
         lightning-cli sends commands to the lightning daemon.

  OPTIONS
 -       --lightning-dir=DIR Set the directory for the lightning daemon we're talking to; defaults to $HOME/.lightning.
 +       • --lightning-dir=DIR

 -       --conf=PATH Sets configuration file (default: lightning-dir/config ).
 +         Set the directory for the lightning daemon we're talking to; defaults to $HOME/.lightning.

 -       --network=network --mainnet --testnet --signet Sets network explicitly.
 +       • --conf=PATH

 -       --rpc-file=FILE Named pipe to use to talk to lightning daemon: default is lightning-rpc in the lightning directory.
 +         Sets configuration file (default: lightning-dir/config ).

 -       --keywords/-k Use format key=value for parameters in any order
 +       • --network=network

 -       --order/-o Follow strictly the order of parameters for the command
 +       • --mainnet

 -       --json/-J Return result in JSON format (default unless help command, or result contains a format-hint field).
 +       • --testnet

 -       --raw/-R Return raw JSON directly as lightningd replies; this can be faster for large requests.
 +       • --signet

 -       --human-readable/-H Return result in human-readable output.
 +         Sets network explicitly.

 -       --flat/-F  Return  JSON result in flattened one-per-line output, e.g. { "help": [ { "command": "check" } ] } would become
 +       • --rpc-file=FILE
 +
 +         Named pipe to use to talk to lightning daemon: default is lightning-rpc in the lightning directory.
 +
 +       • --keywords/-k
 +
 +         Use format key=value for parameters in any order
 +
 +       • --order/-o
 +
 +         Follow strictly the order of parameters for the command
 +
 +       • --json/-J
 +
 +         Return result in JSON format (default unless help command, or result contains a format-hint field).
 +
 +       • --raw/-R
 +
 +         Return raw JSON directly as lightningd replies; this can be faster for large requests.
 +
 +       • --human-readable/-H
 +
 +         Return result in human-readable output.
 +
 +       • --flat/-F
 +
 +         Return  JSON  result  in  flattened  one-per-line  output,  e.g.  {  "help":  [ { "command": "check" } ] } would become
         help[0].command=check.  This is useful for simple scripts which want to find a  specific  output  field  without  parsing
         JSON.

 -       --notifications/-N=LEVEL  If  LEVEL is 'none', then never print out notifications.  Otherwise, print out notifications of
 -       LEVEL or above (one of io, debug, info (the default), unusual or broken: they are prefixed with # .
 +       • --notifications/-N=LEVEL
 +
 +         If  LEVEL  is 'none', then never print out notifications.  Otherwise, print out notifications of LEVEL or above (one of
 +         io, debug, info (the default), unusual or broken: they are prefixed with # .
 +
 +       • --help/-h
 +
 +         Pretty-print summary of options to standard output and exit.  The format can be changed using -F, -R, -J, -H etc.
 +
 +       • --version/-V

 -       --help/-h Pretty-print summary of options to standard output and exit.  The format can be changed using -F,  -R,  -J,  -H
 -       etc.
 +         Print version number to standard output and exit.

 -       --version/-V Print version number to standard output and exit.
 +       • allow-deprecated-apis=BOOL

 -       allow-deprecated-apis=BOOL Enable deprecated options. It defaults to true, but you should set it to false when testing to
 -       ensure that an upgrade won't break your configuration.
 +         Enable deprecated options. It defaults to true, but you should set it to false when testing to ensure that  an  upgrade
 +         won't break your configuration.

  COMMANDS
         lightning-cli simply uses the JSON RPC interface to talk to lightningd, and prints the results. Thus the commands  avail‐
 @@ -60,13 +93,13 @@
         this is not encouraged.

  EXAMPLES
 -       1.     List commands
 +       1.     List commands:

 -       lightning-cli help
 +              • lightning-cli help

 -       2.     Fund a 10k sat channel using uncomfirmed outputs
 +       2.     Fund a 10k sat channel using uncomfirmed outputs:

 -       lightning-cli --keywords fundchannel id=028f...ae7d amount=10000sat minconf=0
 +              • lightning-cli --keywords fundchannel id=028f...ae7d amount=10000sat minconf=0

  BUGS
         This manpage documents how it should work, not how it does work. The pretty printing of results isn't pretty.
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2022-09-08 00:36:51 +03:00

3.2 KiB

lightning-hsmtool -- Tool for working with software HSM secrets of lightningd

SYNOPSIS

lightning-hsmtool method [ARGUMENTS]...

DESCRIPTION

lightning-hsmtool performs various operations on the hsm_secret file used by the software HSM component of lightningd.

This can be used to encrypt and decrypt the hsm_secret file, as well as derive secrets used in channel commitments.

METHODS

encrypt hsm_secret password

Encrypt the hsm_secret file so that it can only be decrypted at lightningd startup. You must give the option --encrypted-hsm to lightningd. The password of the hsm_secret file will be asked whenever you start lightningd.

decrypt hsm_secret password

Decrypt the hsm_secret file that was encrypted with the encrypt method.

dumpcommitments node_id channel_dbid depth hsm_secret [password]

Show the per-commitment secret and point of up to depth commitments, of the specified channel with the specified peer, identified by the channel database index. Specify password if the hsm_secret is encrypted.

guesstoremote p2wpkh node_id max_channel_dbid hsm_secret [password]

Brute-force the private key to our funds from a remote unilateral close of a channel, in a case where we have lost all database data except for our hsm_secret. The peer must be the one to close the channel (and the funds will remain unrecoverable until the channel is closed). max_channel_dbid is your own guess on what the channel_dbid was, or at least the maximum possible value, and is usually no greater than the number of channels that the node has ever had. Specify password if the hsm_secret is encrypted.

generatehsm hsm_secret_path Generates a new hsm_secret using BIP39.

checkhsm hsm_secret_path Checks that hsm_secret matchs a BIP39 pass phrase.

dumponchaindescriptors hsm_secret [password] [network] Dump output descriptors for our onchain wallet. The descriptors can be used by external services to be able to generate addresses for our onchain wallet. (for example on bitcoind using the importmulti or importdescriptors RPC calls) We need the path to the hsm_secret containing the wallet seed, and an optional (skip using "") password if it was encrypted. To generate descriptors using testnet master keys, you may specify testnet as the last parameter. By default, mainnet-encoded keys are generated.

BUGS

You should report bugs on our github issues page, and maybe submit a fix to gain our eternal gratitude!

AUTHOR

ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote the initial version of this man page, but many others did the hard work of actually implementing lightning-hsmtool.

SEE ALSO

lightningd(8), lightningd-config(5)

RESOURCES

Main web site: https://github.com/ElementsProject/lightning

COPYING

Note: the modules in the ccan/ directory have their own licenses, but the rest of the code is covered by the BSD-style MIT license. Main web site: https://github.com/ElementsProject/lightning