SQ(1)

🌸 sq pki link add — bestie edition 💖

okay so real talk, this is SQ(1) territory, but specifically the sq pki link add page. it's a User Commands situation and honestly? it's giving ✨certificate whisperer✨. let's get into it 🫶

---

✨ NAME ✨

sq-pki-link-add — Link a certificate and a user ID 💅

---

🎀 SYNOPSIS 🎀

sq pki link add [OPTIONS]

periodt. that's the whole vibe.

---

💖 DESCRIPTION 💖

So. You're linking a certificate and a user ID. That's the whole thing 🥰

This makes sq go "okay yes, this certificate and this user ID are binding, and that binding is authentic." You'd do this when you're confident that a specific certificate should be associated with, like, Alice. Fr fr. BUT — huge but — this does NOT consider the certificate to be a trusted introducer. It only says the binding is authentic. Nothing more, bestie. If you want to authorize a certificate to be a trusted introducer, that's a different errand: sq pki link authorize.

And if you ever need to take the link back? sq pki link retract has you covered 💅

Now, this command is similar to sq pki vouch add, but here's the tea: the certifications it makes are done using the certificate directory's trust root, not some arbitrary key. And the certificates get marked as non-exportable. Why is that iconic? Two reasons:

• The trust-root thing makes certifications wayyy easier to manage, especially when the user's certification key is offline 🔌
• The non-exportable thing improves the user's privacy, by reducing the chance that parts of the user's social graph leak out when a certificate gets shared 🙈

Also, by default a link never expires. No cap. But you can override that with the --expiration argument if you want to be a little more cautious ✨

And one more thing: sq pki link add respects the reference time set by the top-level --time argument. It sets the link's creation time to that reference time. very demure, very mindful 🧚

---

💅 OPTIONS 💅

🌸 Subcommand options 🌸

• --add-email=EMAIL — Use a user ID with the specified email address. The user ID consists of just the email address. And ngl, the email address does not have to appear in a self-signed user ID. wild, but true 💫
• --add-userid=USERID — Use the specified user ID. The specified user ID does not need to be self signed. Because using a user ID that is not self-signed is often a mistake, you need to use this option to explicitly opt in 👀 (yes, it's a whole consent thing, we love that for us)
• --all — Use all self-signed user IDs 🎀
• --allow-non-canonical-userids — Don't reject new user IDs that are not in canonical form. Canonical user IDs are of the form Name (Comment) <localpart@example.org>. so if yours is a little chaotic, this flag has your back 🦋
• --amount=AMOUNT — Set the amount of trust. Values between 1 and 120 are meaningful. 120 means fully trusted. Values less than 120 indicate the degree of trust. 60 is usually used for partially trusted. [default: full] 🔥
• --cert=FINGERPRINT|KEYID — Use certificates with the specified fingerprint or key ID 👑
• --cert-special=SPECIAL — Use certificates identified by the special name. [possible values: public-directories, keys.openpgp.org, keys.mailvelope.com, proton.me, wkd, dane, autocrypt, web] 🌈
• --email=EMAIL — Use a user ID consisting of just the email address, if the email address occurs in a self-signed user ID. note the if!! conditional queen ✨
• --expiration=EXPIRATION — Sets the expiration time. EXPIRATION is either an ISO 8601 formatted date with an optional time, or a custom duration. A duration takes the form N[ymwds], where the letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword never does not set an expiration time. [default: never] ⏳
• --recreate — Recreate signature even if the parameters did not change. If the link parameters did not change, and thus creating a signature should not be necessary, we omit the operation. This flag can be given to force the signature to be re-created anyway. it's giving "do it again but with feeling" 💅
• --signature-notation NAME VALUE — Add a notation to the signature. A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. If a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable. so make it a good one bestie 📝
• --temporary — Temporarily accepts the binding. Creates a fully trust link between a certificate and one or more User IDs for a week. After that, the link is automatically downgraded to a partially trusted link (trust = 40). a trial run, slay 🧚
• --userid=USERID — Use the specified self-signed user ID. The specified user ID must be self signed. no exceptions 💀
• --userid-by-email=EMAIL — Use the self-signed user ID with the specified email address 💌

🌟 Global options 🌟

• See sq(1) for a description of the global options. go read it, iykyk 📖

---

🔥 EXAMPLES 🔥

Link the certificate EB28F26E2739A4870ECC47726F0073F60FD0CBF0 with the email address alice@example.org.

sq pki link add \
       --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --email=alice@example.org

First, examine the certificate EB28F26E2739A4870ECC47726F0073F60FD0CBF0.

sq inspect --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0

Then, temporarily accept the certificate EB28F26E2739A4870ECC47726F0073F60FD0CBF0 with all of its self-signed user IDs for a week.

sq pki link add --expiration=1w \
       --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --all

Once satisfied, permanently accept the certificate EB28F26E2739A4870ECC47726F0073F60FD0CBF0 with all of its self-signed user IDs.

sq pki link add \
       --cert=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --all

see? look first, trust temporarily, commit when you're comfy. that's the character arc 👑🌸

---

🦋 SEE ALSO 🦋

• sq(1), sq-pki(1), sq-pki-link(1).
• For the full documentation see <https://book.sequoia-pgp.org/>. go off, it's a whole book 📚

---

⭐ VERSION ⭐

1.5.0

---

💜 and that's the whole page bestie! this was Sequoia PGP, version 1.5.0, and it's all yours. now go link some certificates, you absolute icon 🫶✨💅