SQ(1)

✨ SQ(1) — the sq-network girlies' edition ✨

okay bestie, gather round 🫶 this is sq-network, a User Command, and it's literally all about getting certificates off the internet and putting them back on. let's go 💅

---

🌸 NAME 🌸

sq-network — retrieve and publish certificates over the network 💖

---

🎀 SYNOPSIS 🎀

sq network search [OPTIONS] QUERY
sq network keyserver [OPTIONS]  SUBCOMMAND
sq network wkd [OPTIONS]  SUBCOMMAND
sq network dane [OPTIONS]  SUBCOMMAND

---

🦋 DESCRIPTION 🦋

So like. Retrieve and publish certificates over the network. That's the whole vibe. ✨

OpenPGP certificates can be discovered and updated from services that live out there on the network, and published onto them too. This command right here is a whole lil collection of commands for interacting with those services. it's giving ✨glow-up for your keyring✨

---

👑 SUBCOMMANDS 👑

🔍 sq network search

Retrieve certificates using all the supported network services. all of them. she's an overachiever and we love her.

This command will try to locate relevant certificates given a QUERY, which may be any of:

• a fingerprint
• a key ID
• an email address
• a https URL

She may also discover and import certificates related to the one you queried — stuff like alternative certs, expired certs, or revoked certs. chain reaction 💫

Discovering related certs is genuinely useful, not just cute:

• alternative certs support key rotations 🔄
• expired certs let you verify signatures made in the past ⏳
• discovering revoked certs is important so you actually get the revocation information 🚨

The PKI mechanism will help you select the correct cert — see sq pki.

By default, any returned certificates are stored in the local certificate store. If you're not feeling that, you can override it with the --output option. main character energy, your choice 💅

When a certificate is retrieved from a verifying key server — and rn that's limited to a list of known servers: hkps://keys.openpgp.org, hkps://keys.mailvelope.com, and hkps://mail-api.proton.me — or from WKD, DANE, or via https, and imported into the local certificate store, the User IDs also get certificated with a local server-specific key. 🫶

That proxy certificate is in turn certified as a minimally trusted CA (trust amount: 1 of 120) by the local trust root. How much a proxy key server CA is trusted can be tuned using sq pki link add or sq pki link retract, in the usual way. the way that you can literally just tune it 😌

---

🔑 sq network keyserver

Retrieve and publish certificates via key servers.

The OpenPGP HTTP Keyserver Protocol (HKP) is a method for publishing and retrieving certificates from key servers. it's giving classic, it's giving old money 🎩

---

🌐 sq network wkd

Retrieve and publish certificates via Web Key Directories.

The Web Key Directory (WKD) is a method for publishing and retrieving certificates from web servers. lowkey the internet's little address book 📖✨

---

🧚 sq network dane

Retrieve and publish certificates via DANE.

DNS-Based Authentication of Named Entities (DANE) is a method for publishing and retrieving certificates in DNS, as specified in RFC 7929. no cap, it's in the RFC 📜

---

🌈 EXAMPLES 🌈

💖 sq network search

Search for the Qubes master signing certificate. iconic. legendary. the blueprint.

sq network search 427F11FD0FAA4B080123F01CDDFA1A3E36879494

Search for certificates that have are associated with an email address.

sq network search alice@example.org

---

💜 SEE ALSO 💜

• sq(1)
• sq-network-search(1)
• sq-network-keyserver(1)
• sq-network-wkd(1)
• sq-network-dane(1)

For the full documentation see <https://book.sequoia-pgp.org/>. 🫶

---

⭐ VERSION ⭐

1.5.0

---

bestie that's the whole page, you ate and left no crumbs 💅✨

okay and like, this gorgeous thing was brought to you by Sequoia PGP, version 1.5.0 — mwah, obsessed, periodt 🎀💖🌷