SQ(1)

✨ SQ-CERT-LIST 💖 (that's sq-cert-list, bestie)

okay so this is a page from the SQ(1) manual, and it's literally the sq cert list subcommand. she's an icon, she lists certificates and user IDs, and she's about to become your whole personality. let's go 🎀

---

🌸 NAME 🌸

sq-cert-list — List certificates and user IDs 💅

---

🦋 SYNOPSIS 🦋

sq cert list [OPTIONS] FINGERPRINT|KEYID|PATTERN

---

💜 DESCRIPTION 💜

So, real talk: this command lists certificates and user IDs. that's the vibe, that's the whole thing, slay ✨

More specifically, it lists certificates and user IDs that match a query, are usable, and can be authenticated. normally, bindings (and a "binding" is just a certificate + user ID pair, iykyk) have to be fully authenticated to show up. and heads up: if nothing matches your query — no certs, no bindings — the command bails with a non-zero exit code. not me getting rejected 😭

If you pass no queries at all, girl, she just lists everything that's usable and can be authenticated. and if there's literally nothing like that? she still succeeds. queen of not making it weird 🫶

By default, she skips the unusable stuff — that means certificates that aren't valid according to the policy, are revoked, or are not live. same energy for user ID self signatures and certifications that aren't valid per the policy, plus user IDs that are revoked. all of that gets the silent treatment 🙈

---

🎀 OPTIONS 🎀

Subcommand options (the good stuff ✨)

• --amount=AMOUNT — the required amount of trust, bestie.

120 means full authentication; anything less than 120 means partial authentication. and when you pass --certification-network, this defaults to 1200 — i.e., the command tries to find 10 paths. she's ambitious, we love that 💅

• --cert=FINGERPRINT|KEYID — list certificates with the specified fingerprint or key ID.

note: fingerprints and key IDs are self-authenticating identifiers. so a certificate with the specified fingerprint or key ID is considered authenticated — no user IDs have to be authenticated. no extra work required, it's giving effortless 🔥

• --cert-domain=DOMAIN — list bindings with user IDs that contain an email address in the specified domain.

a user ID's domain gets extracted from the email address, if there even is one, and it's normalized by doing puny-code normalization. cute, normalized, urbanized ✨

• --cert-email=EMAIL — list bindings with user IDs that contain the specified email address.

email addresses get normalized first: puny-code normalization on the domain, and lower casing the local part in the so-called empty locale. lowercase era 💅

• --cert-grep=PATTERN — list bindings with a user ID that contains the pattern.

it does a case-insensitive substring search. case-folding is done in the empty locale. she's searching, she's finding, she's not caring about your capitalization 🌈

• --cert-userid=USERID — list bindings with the specified user ID.

the user ID has to match exactly. no vibes-based matching, no approximation, exact or nothing periodt 💀

• --certification-network — treats the network as a certification network.

normally the authentication machinery treats the Web of Trust network as an authentication network, where a certification only means the binding is correct — not that the target should be treated as a trusted introducer. but in a certification network, the targets of certifications are treated as trusted introducers with infinite depth, and any regular expressions are ignored. note: the trust amount remains unchanged. this is how most so-called PGP path-finding algorithms work. infinite depth, infinite slay 👑

• --gossip — treats all certificates as unreliable trust roots.

this is for figuring out what others think about a certificate (i.e. gossip or hearsay, the classic). in other words, it finds arbitrary paths to a particular certificate. 🫖

gossip is useful for identifying alternative ways to authenticate a certificate. for instance: imagine Ed wants to authenticate Laura's certificate, but asking her directly is inconvenient. Ed discovers that Micah has certified Laura's certificate, but Ed hasn't yet authenticated Micah's certificate. if Ed is willing to rely on Micah as a trusted introducer, and authenticating Micah's certificate is easier than authenticating Laura's certificate, then Ed has learned about an easier way to authenticate Laura's certificate. plot twist, but make it wholesome 💖

stable since 1.1.0. ✨

• --show-paths — show why a binding is authenticated.

by default, only a user ID and certificate binding's degree of authentication (a value between 0 and 120) is shown. this changes the output to also show how that value was computed — by showing the paths from the trust roots to the bindings. receipts! we love receipts 🧾

• --unusable — show bindings that are unusable.

normally, unusable certificates and bindings are not shown. this option considers bindings, even if they are not unusable, because they (or the certificates) are not valid according to the policy, are revoked, or are not live.

this option only makes sense with --gossip, because unusable bindings are still considered unauthenticated. 👀

stable since 1.1.0. ✨

• FINGERPRINT|KEYID|PATTERN — list certs that match the pattern.

if the pattern looks like a fingerprint or key ID, it's treated as if it were passed to --cert, which matches on the certificate's fingerprint. otherwise, it's treated as if it were passed to --cert-grep, which matches on user IDs. dual threat, main character energy 🌟

Global options 🌍

• See sq(1) for a description of the global options. (she's got a whole other page, go read it, it's canon 📖)

---

🌈 EXAMPLES 🌈

List all bindings for user IDs containing an email address from example.org, and that can be authenticated.

sq cert list @example.org

List all authenticated bindings for User IDs containing a specific email address.

sq cert list --cert-email=alice@example.org

List all paths to certificates containing a specific email address.

sq cert list --gossip --show-paths \
       --cert-email=alice@example.org

---

👑 SEE ALSO 👑

• sq(1)
• sq-cert(1)

for the full documentation see <https://book.sequoia-pgp.org/>. go read it, it's giving academic but in a hot way 📚✨

---

⭐ VERSION ⭐

1.5.0

---

and that's the whole page, bestie 🫶 this manual is version 1.5.0, brought to you by Sequoia PGP (also 1.5.0, december... no wait, just 1.5.0), and yes the section header at the top said SQ(1) while the filename said SQ(1) — same energy, different line. mwah, ily, go list some certs 💖🎀🦋