vault42 42ctl login

Do not 42ctl push the groot secrets from the other machine. Those values are already in the vault, sealed to the key that lives there. The 404 means that key was never escrowed to your email, so this machine has nothing to download.

From the machine that already works, publish the identity (or copy it). Then recover here.

Preferred: escrow, then recover

On the other machine, first confirm it is the real groot identity:

42ctl auth whoami
42ctl pull --project groot

The dry-run should succeed. Then escrow the sealed keystore to the same email you used here:

42ctl keys escrow --email you@example.com

That machine will ask for an OTP sent to that inbox, then upload ciphertext only. The passphrase never leaves the host.

Back on this machine:

42ctl keys recover --email you@example.com

Use the OTP from the new mail, then the original passphrase from the other machine (not the one from keys init --force). After that:

42ctl auth login --password --email you@example.com --tenant <tenant>
42ctl auth whoami
42ctl pull --project groot

whoami should show the same v42:… address as on the other machine, not 1a223940e30dac0f….

Faster: copy the identity directory

Still on the other machine:

scp -r ~/.config/42ctl dlesieur@dlesieur42:~/.config/

That copies keystore.v42 and contract-default.tok together, so you skip escrow/recover. Then on this machine, unlock and pull with the original passphrase.

Do not run keys init --force on the other machine. That would replace the working key the vault already knows.

If you want, paste 42ctl auth whoami from the other machine (principal + address only) and we can check it matches after recover.