SQ(1)

💖 SQ(1) — like, the manual, but make it make sense 💖

okay bestie, so this is a page from User Commands territory, and the actual star of the show is a little thing called sq-pki-path. yes, SQ(1) is the manual name, but the command itself? she's sq-pki-path. 💅

---

✨ NAME ✨

sq-pki-path — verify the specified path. that's it. that's the whole vibe. 🦋

---

🌸 SYNOPSIS 🌸

sq pki path [OPTIONS] FINGERPRINT|KEYID

---

💜 DESCRIPTION 💜

so what are we even doing here? we're verifying the specified path. slay. 🎀

and like, what even is a path, you ask? bestie, a path is a sequence of certificates starting at the root, and a User ID. this function checks that every single path segment has a valid certification, and that it also satisfies whatever constraints are in play (trust amount, trust depth, regular expressions — the whole entourage). ✨

now. if a valid path is not found, this subcommand ALSO lints the path, because she's thoughtful like that. specifically, she reports if any certifications are insufficient (for example: not enough trust depth) or invalid (for example: because they use SHA-1, but the use of SHA-1 has been disabled). 💀 it's giving "here's exactly why you're not getting in."

---

👑 OPTIONS 👑

Subcommand options

• --amount=AMOUNT — the required amount of trust. 120 indicates full authentication, and values less than 120 indicate partial authentication. when --certification-network is passed, this defaults to 1200, i.e., this command tries to find 10 paths. girl's ambitious fr fr. 🔥
• --certification-network — treats the network as a certification network. okay so normally, the authentication machinery treats the Web of Trust network as an authentication network, where a certification only means that the binding is correct — not that the target should be treated as a trusted introducer. but in a certification network, the targets of certifications are treated as trusted introducers with infinite depth, and any regular expressions are ignored. note: the trust amount remains unchanged. this is how most so-called PGP path-finding algorithms work. periodt. 💅
• --email=EMAIL — authenticate the specified email address. this checks whether it's possible to authenticate the user ID consisting of just the specified email address. and good news bestie — the user ID does not need to be self signed. 🫶
• --userid=USERID — authenticate the specified user ID. the specified user ID does not need to be self signed. same energy, no selfie required. 🙈
• --userid-by-email=EMAIL — authenticate the self-signed user ID with the specified email address. this checks whether it's possible to authenticate the self-signed user ID with the specified email address.

and here's the lil plot twist: if the certificate is invalid, or there's no self-signed user ID with the specified email address, she uses a user ID with just the email address. graceful fallback, honestly iconic. 💖

• FINGERPRINT|KEYID — the path to authenticate. a path consists of one or more certificates. the first certificate is the root, and the last certificate is the one being authenticated for the specified user ID. she starts at the beginning and she ends at the destination, no detours. 🌈

Global options

see sq(1) for a description of the global options. (iykyk — the global options are a whole other chapter, go read that one. 📖)

---

🎀 EXAMPLES 🎀

verify that Alice certified a particular User ID for Bob's certificate. cute lil love story actually:

sq pki path EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
        511257EBBF077B7AEDAE5D093F68CB84CE537C9A --userid \
        "Bob <bob@example.org>"

---

🦋 SEE ALSO 🦋

sq(1), sq-pki(1).

for the full documentation see <https://book.sequoia-pgp.org/>. ⭐

---

🌟 VERSION 🌟

1.5.0

---

okay that's the whole page, no cap, every flag accounted for 👑

and for the lil sign-off moment: this came to you from Sequoia PGP, version 1.5.0, and the manual page itself is also rockin' 1.5.0. same number, matching fits, main character energy all around. bye bestie, go verify some paths 💜✨🌸