SQ-GIT(1)

💖 sq-git-verify — aka sq-git verify 💖

okay bestie, welcome to the sq-git(1) manual page, the verify edition ✨ this is the part of the Sequoia PGP git tooling that goes "hold up, is this signature actually real" before you trust a tarball with your whole life 🫶

---

🌸 NAME 🌸

sq-git-verify — verifies signatures on archives like release tarballs. yes that's the whole job and she does it flawlessly 💅

---

✨ SYNOPSIS ✨

sq-git verify [OPTIONS]

that's it, that's the vibe. options go in, truth comes out 🔥

---

🦋 DESCRIPTION 🦋

Verifies signatures on archives like release tarballs.

like, you downloaded a .tar.gz off the internet and you're sitting there like "is this actually from who it says it's from" 😭 that's literally what this does. it checks the signature on the archive so you can stop spiraling. no cap. 🎀

---

👑 OPTIONS 👑

🌈 Subcommand options 🌈

• --archive=FILENAME — the archive that the signature protects. this is the file you're like "is you okay??" about 💜
• --policy-file=POLICY — use an alternate policy.

the default policy is the openpgp-policy.toml file in the root of the repository's working tree. so if you don't say anything, that's where she's looking, periodt 📁

• --signature=FILENAME — the signature to verify. the little cryptographic receipt you're checking against the archive 🧚
• --trust-root=COMMIT — read the policy from this commit.

falls back to using the value of the git repository's sequoia.trustRoot configuration key. and heads up: it can be overridden using --policy-file. so like, the priority order is a whole thing, iykyk 💅

⭐ Global options ⭐

• see sq-git(1) for a description of the global options. that's a whole other page bestie, go read it 🌸

---

🔥 SEE ALSO 🔥

• sq-git(1).
• for the full documentation see <https://sequoia-pgp.gitlab.io/sequoia-git>. yes the link wraps in the original, and yes it's the same link, i'm not doing anything shady 🙈

---

🍓 VERSION 🍓

0.6.0

---

okay that's the whole page!! and for the cute lil sign-off at the bottom of the original: this one's from Sequoia PGP, version 0.6.0, dated 0.6.0 — yeah the version and the date are literally the same string, that's not a typo, that's just how the footer rolled 💀

now go verify something and be the main character of your own supply chain security story 💖✨🎀🦋🌸💅🫶👑🌈⭐💜