SQ(1)

📦
version 1.5.0 · 4 versions
, in fedora 43, fedora 44, nixpkgs unstable, opensuse-leap 16.0

💅 SQ(1) — oh you're here for sq key revoke, bestie

Ok so real talk: this is the manual page for sq-key-revoke, a User Command that ships with Sequoia PGP, and it's genuinely one of those "you hope you never need it but when you need it you NEED it" tools. Let's get into it. ✨

🎀 NAME

sq-key-revoke — Revoke a certificate. Yep. That's the whole vibe. You're taking a cert and you're saying "we're done here." 🫶

🌸 SYNOPSIS

sq key revoke [OPTIONS]

🦋 DESCRIPTION

Revoke a certificate. Periodt.

It creates a revocation certificate for a certificate. Like, an actual "this key is over, please stop trusting it" artifact. 💀➡️✨

If --revoker or --revoker-file is provided, then that key is used to create the revocation certificate. And if that key is different from the certificate that is being revoked, congrats, you've made a third-party revocation. Which is normally only useful if the owner of the certificate designated the key to be a designated revoker. So, iykyk. 👑

Heads up: sq key revoke respects the reference time set by the top-level --time argument. When set, it uses the specified time instead of the current time when determining what keys are valid, and it sets the revocation certificate's creation time to the reference time instead of the current time. So basically the whole operation time-travels with you. 🕰️✨

🌈 OPTIONS

Subcommand options 💖

  • --cert=FINGERPRINT|KEYID — Revoke the key with the specified fingerprint or key ID. Point at the victim, I mean, the certificate. 🎯
  • --cert-email=EMAIL — Revoke the key where a user ID includes the specified email address. Matching by email, lowkey convenient.
  • --cert-file=PATH — Revoke the key read from PATH. Slurp it straight off the disk. 📂
  • --cert-userid=USERID — Revoke the key with the specified user ID.
  • --message=MESSAGE — A short, explanatory text.

The text is shown to a viewer of the revocation certificate, and explains why the certificate has been revoked. So it's basically your little note to the future, bestie. For instance, if Alice has created a new key, she would generate a superseded revocation certificate for her old key, and might include the message I've created a new certificate, $FINGERPRINT, please use that in the future. — see, she's being polite about it. 💌

  • --output=FILE — Write to the specified FILE.

If not specified, and the certificate was read from the certificate store, imports the modified certificate into the cert store. If not specified, and the certificate was read from a file, writes the modified certificate to stdout. So like, it just does the reasonable thing depending on where it found the cert. 🪄

  • --reason=REASON — The reason for the revocation.

If the reason happened in the past, you should specify that using the --time argument. Why? Because this allows OpenPGP implementations to more accurately reason about artifacts whose validity depends on the validity of the certificate. Yes, that matters. Fr fr. 🧠

[possible values: compromised, superseded, retired, unspecified]

  • --revoker=FINGERPRINT|KEYID — Use key with the specified fingerprint or key ID to create the revocation certificate.

Sign the revocation certificate using the specified key. By default, the certificate being revoked is used. Using this option, it is possible to create a third-party revocation.

  • --revoker-email=EMAIL — Use key where a user ID includes the specified email address to create the revocation certificate.

Sign the revocation certificate using the specified key. By default, the certificate being revoked is used. Using this option, it is possible to create a third-party revocation.

  • --revoker-file=PATH — Read key from PATH to create the revocation certificate.

Sign the revocation certificate using the specified key. By default, the certificate being revoked is used. Using this option, it is possible to create a third-party revocation.

  • --revoker-userid=USERID — Use key with the specified user ID to create the revocation certificate.

Sign the revocation certificate using the specified key. By default, the certificate being revoked is used. Using this option, it is possible to create a third-party revocation.

  • --signature-notation NAME VALUE — Add a notation to the signature. ✍️

A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. And this is the important part, so listen up: if a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. That's the whole point of "critical." ⚠️ The notation is marked as being human readable.

Global options 🌍

  • See sq(1) for a description of the global options. Go read that one too, bestie, it's got the lore.

🍓 EXAMPLES

Revoke Alice's key, indicating that there is a new certificate:

sq key revoke --cert EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --reason superseded --message \
       "My new cert is C5999E8191BF7B503653BE958B1F7910D01F86E5"

Revoke the key, indicating that the secret key material was compromised:

sq key revoke --cert EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --reason compromised --message \
       "Computer attacked, secret key material compromised"
Not the "computer attacked" example being the realest one in the whole page 😭 stay safe out there.

💜 SEE ALSO

For the full documentation see <https://book.sequoia-pgp.org/>. Go. Read. Learn. Slay. 📚✨

⭐ VERSION

1.5.0

And that's a wrap, bestie 🫶 this was Sequoia PGP, version 1.5.0, and you just read the SQ(1) page — main character energy from start to finish. Now go revoke responsibly, mwah 💅👑

📦 where this page comes from