SEQUOIA-KEYRING-LINTER(1)

✨ SEQUOIA-KEYRING-LINTER ✨

okay bestie, gather round, because this is the sequoia-keyring-linter manual page, and it lives in section 1 (User Commands). she's a lil tool called sq-keyring-linter and she is so good at sniffing out bad vibes in your OpenPGP keyrings. no cap. 💖

---

🌸 NAME 🌸

sequoia-keyring-linter — aka sq-keyring-linter. a linter for keyrings, literally that's the whole job description. 💅

---

🦋 SYNOPSIS 🦋

sq-keyring-linter [OPTIONS] [FILE]...

---

🎀 DESCRIPTION 🎀

A linter for keyrings. yes bestie, that's it, that's the whole thing, and honestly? iconic. 👑

Arguments

• [FILE]... — a list of OpenPGP keyrings to process. if you don't specify any, then the keyring gets read from stdin. so you can absolutely just pipe stuff in, no pressure. 🙈

---

💖 OPTIONS 💖

• -t, --time <TIME> — sets the reference time to TIME.

TIME is interpreted as an ISO 8601 timestamp. so if you wanna set the reference time to July 21, 2013 at midnight UTC, you go:

$ sq-keyring-linter --time 20130721 ...

and if you want to include an actual time, add a T, then the time, and optionally the timezone (default timezone is UTC, because of course it is 💅):

$ sq-keyring-linter --time 20130721T0550+0200 ...

• -q, --quiet — quiet mode. does not output any diagnostics. she's giving silence, she's giving peace. 🤫
• -f, --fix — attempts to fix certificates, when possible. little miss fix-it. 🛠️
• -e, --export-secret-keys — when fixing a certificate, the fixed certificate is exported without any secret key material by default. using this switch causes any secret key material to also be exported. so like, only flip this if you want the secret stuff coming along for the ride. 🔥
• -p, --password <PASSWORD> — a key's password. normally this is not needed: if stdin is connected to a tty, the linter will ask for a password when needed. so it's polite like that. 🥰
• -k, --list-keys — if set, outputs a list of fingerprints, one per line, of certificates that have issues. this output is intended for use by scripts, so it's the ✨machine-readable✨ bestie.

this option implies --quiet. if you also specify --fix, errors will still be printed to stderr, and fixed certificates will still be emitted to stdout. noted, no cap.

• -h, --help — print help information (use -h for a summary). the lil recap version. 🫶
• -V, --version — print version information. show her some love. 🌈

---

sq-keyring-linter checks the supplied certificates for the following SHA-1-related issues, and honestly SHA-1 is giving expired milk at this point:

• whether a certificate revocation uses SHA-1.
• whether the current self signature for a non-revoked User ID uses SHA-1.
• whether the current subkey binding signature for a non-revoked, live subkey uses SHA-1.
• whether a primary key binding signature ("backsig") for a non-revoked, live subkey uses SHA-1.

Diagnostics are printed to stderr. at the end, some statistics are shown. this is useful when examining a keyring. if --fix is specified and at least one issue could be fixed, the fixed certificates are printed to stdout. cute lil before/after moment. ✨

this tool does not currently support smart cards. but, if only the subkeys are on a smart card, this tool may still be able to partially repair the certificate. in particular, it will be able to fix any issues with User ID self signatures and subkey binding signatures for encryption-capable subkeys, but it will not be able to generate new primary key binding signatures for any signing-capable subkeys. so like, partial slay, not a full slay. 💀

---

⭐ EXIT STATUS ⭐

If --fix is not specified:

• 2 — if any issues were found.
• 1 — if no issues were found, but there were errors reading the input.
• 0 — if there were no issues.

If --fix is specified:

• 3 — if any issues could not be fixed.
• 1 — if no issues were found, but there were errors reading the input.
• 0 — if all issues were fixed or there were no issues.

---

💜 EXAMPLES 💜

# To gather statistics, simply run: $ sq-keyring-linter
keyring.pgp

# To fix a key: $ gpg --export-secret-keys FPR |
sq-keyring-linter --fix -p passw0rd -p password123 | gpg --import

# To get a list of keys with issues: $ sq-keyring-linter
--list-keys keyring.pgp | while read FPR; do something; done

---

🔍 SEE ALSO 🔍

sq-keyring-linter's homepage:

<https://gitlab.com/sequoia-pgp/keyring-linter>

---

and that's the whole page, bestie!! 🎀✨💖

this was sequoia-keyring-linter version 1.0.0, from February 2023. go forth and lint those keyrings, you absolute main character. 👑🦋💅 no cap, fr fr.