These options help you work with transparent data encryption when using pg_verifybackup and pg_rewind on a TDE-encrypted cluster. See Working with encrypted backup files for usage examples.
pg_verifybackup
Option: --key-unwrap-command=<command>
Provides the command to unwrap (decrypt) the data encryption key. It must be the same unwrap command you specified when initializing the cluster.
Supported values
<command> is customizable, but it must contain the placeholder %p, which specifies the file to read the wrapped key from. The command must write the unwrapped key to its standard output. Use the special value - if you don't want to apply any key unwrapping command. See Choosing a key protection mechanism for more information.
If you don't use this option, pg_verifybackup falls back on the environment variable PGDATAKEYUNWRAPCMD. You must specify this option or the environment variable fallback if you're using data encryption.
pg_rewind
Option: --key-unwrap-command=<command>
Works the same way as for pg_verifybackup, earlier on this page.
If you don't use this option, pg_rewind falls back on the environment variable PGDATAKEYUNWRAPCMD. You must specify this option or the environment variable fallback if you're using data encryption.