SQ(1)

📦
version 1.5.0 · 4 versions
, in fedora 43, fedora 44, nixpkgs unstable, opensuse-leap 16.0

💅 SQ(1) — sq cert lint

okay bestie, gather round, we're doing a vibe check on certificates 🔍✨ the manual name is SQ(1) btw, and this one's all about sq cert lint, which is literally the certificate wellness inspection of your dreams.

🌸 NAME 🌸

sq-cert-lint — Check certificates for issues

✨ SYNOPSIS ✨

sq cert lint [OPTIONS]

💖 DESCRIPTION 💖

So like. sq cert lint checks the certificates you hand it for issues. Specifically the SHA-1-related ones, because SHA-1 is giving expired-milk energy and we're not about it 💀

Here's the tea on what it's looking for:

  • Whether a certificate revocation uses SHA-1.
  • Whether the current self signature for a non-revoked User ID uses SHA-1.
  • Whether the current subkey binding signature for a non-revoked, live subkey uses SHA-1.
  • Whether a primary key binding signature ("backsig") for a non-revoked, live subkey uses SHA-1.

Diagnostics get printed to stderr (so not the tidy pretty stdout channel, the other one, keep up 🫶). And at the end, some statistics are shown. This is useful when examining a keyring. And if --fix is specified and at least one issue could be fixed, the fixed certificates are printed to stdout. slay, it healed them 💅

Now, important caveat, no cap: this tool does not currently support smart cards. But (and this is the cute part), if only the subkeys are on a smart card, this tool may still be able to partially repair the certificate. In particular, it will be able to fix any issues with User ID self signatures and subkey binding signatures for encryption-capable subkeys, but it will not be able to generate new primary key binding signatures for any signing-capable subkeys. so like, partial glow-up only, we work with what we got 😭

🎀 OPTIONS 🎀

🌈 Subcommand options

  • --cert=FINGERPRINT|KEYID — Use certificates with the specified fingerprint or key ID
  • --cert-domain=DOMAIN — Use certificates where a user ID includes an email address for the specified domain
  • --cert-email=EMAIL — Use certificates where a user ID includes the specified email address
  • --cert-file=PATH — Read certificates from PATH
  • --cert-grep=PATTERN — Use certificates with a user ID that matches the pattern, case insensitively
  • --cert-userid=USERID — Use certificates with the specified user ID
  • --fix — Attempts to fix certificates, when possible
  • --output=FILE — Write to the specified FILE

If not specified, and the certificate was read from the certificate store, imports the modified certificate into the cert store. If not specified, and the certificate was read from a file, writes the modified certificate to stdout.

🦋 Global options

See sq(1) for a description of the global options. (yes bestie, go read that one too, it's got the whole global-options lore 👑)

🔥 EXAMPLES 🔥

Gather statistics on the certificates in a keyring:

sq cert lint --cert-file certs.pgp

Fix a key with known problems:

sq cert lint --fix --cert \
      EB28F26E2739A4870ECC47726F0073F60FD0CBF0

💜 SEE ALSO 💜

sq(1), sq-cert(1).

For the full documentation see <https://book.sequoia-pgp.org/>.

⭐ VERSION ⭐

1.5.0

and that's the whole page babes 🥰 this was Sequoia PGP version 1.5.0, brought to you with love, and it's SQ(1) forever and always 💖✨ go lint something, you'll feel so much better, fr fr 🫶

📦 where this page comes from