.. task:: GenerateKey

GenerateKey task
----------------

This is a :ref:`signing task <task-type-signing>` that generates a new key
on a signing worker and stores it for later use.

The ``task_data`` for this task may contain the following keys:

* ``purpose`` (required): the purpose of the key to generate: ``uefi``,
  ``openpgp``, or ``openpgp-repository``.
* ``storage`` (optional, defaults to ``nacl``): the kind of storage where
  the new key should be stored.  Options are:

  * ``nacl``: stored directly in the signing database, encrypted using the
    ``DEBUSINE_SIGNING_PRIVATE_KEYS`` Django setting on the signing worker;
    always available

* ``description`` (required): a text string with a human-readable
  description of the new key's intended purpose.
* ``scope`` (optional): the name of the scope for which this key is being
  generated.  Some backends may record this alongside the key.
* ``workspace`` (optional): the name of the workspace for which this key is
  being generated.  Some backends may record this alongside the key.

The output will be provided as a :asset:`debusine:signing-key` asset.
You can find the output asset with the debusine client:

.. code-block:: console

    $ debusine list-assets --work-request $work_request_id

.. todo::

   This will need additional parameters once we start supporting HSMs.
