SQ(1)

💖 SQ(1) — sq-pki-vouch-authorize 💖

okay bestie, buckle up, because this is the page for sq-pki-vouch-authorize 💅 and it's the one that marks a certificate as a trusted introducer. yes, that's a lot of power. no, we are not being casual about it. let's go 🦋

---

✨ NAME ✨

sq-pki-vouch-authorize — mark a certificate as a trusted introducer 👑

---

✨ SYNOPSIS ✨

sq pki vouch authorize [OPTIONS]

---

✨ DESCRIPTION ✨

Mark a certificate as a trusted introducer. periodt 💖

So it literally creates a certification that says: hey, the issuer of this thing considers the certificate to be a trusted introducer. And "trusted introducer" is just a fancy little word for certification authority (CA) — same vibe, different name, iykyk.

When a user relies on a trusted introducer, they consider certifications made by that trusted introducer to be valid. And a trusted introducer can also go and designate further trusted introducers. it's giving cascade energy 🔥

Now. ngl, as it stands, a trusted introducer has a lot of power. not me being dramatic, it's just true 😭 so this power can be limited in several ways:

• The ability to specify further introducers can be constrained using the --depth parameter. 🎀
• The degree to which an introducer is trusted can be changed using the --amount parameter.
• The user IDs that an introducer can certify can be constrained by domain using the --domain parameter or a regular expression using the --regex parameter.

These mechanisms are literally how Alice can say she's willing to rely on the CA for example.org, but only for user IDs that have an email address for example.org. iconic, honestly 🌸

By default a delegation expires after 10 years. use the --expiration argument to override this. yes ma'am, 10y is the vibe unless you say otherwise.

This subcommand respects the reference time set by the top-level --time argument. it sets the certification's creation time to the reference time. ⏰

---

✨ OPTIONS ✨

🌈 Subcommand options

• --add-email=EMAIL — Use a user ID with the specified email address. The user ID consists of just the email address. the email address does not have to appear in a self-signed user ID. 🙈
• --add-userid=USERID — Use the specified user ID. The specified user ID does not need to be self signed.

real talk: because using a user ID that is not self-signed is often a mistake, you need to use this option to explicitly opt in. 👀

• --all — Use all self-signed user IDs. all of them. every single one. 💅
• --allow-non-canonical-userids — Don't reject new user IDs that are not in canonical form. Canonical user IDs are of the form Name (Comment) <localpart@example.org>. 💖
• --amount=AMOUNT — Set the amount of trust. Values between 1 and 120 are meaningful. 120 means fully trusted. Values less than 120 indicate the degree of trust. 60 is usually used for partially trusted. [default: full] ✨
• --cert=FINGERPRINT|KEYID — Use certificates with the specified fingerprint or key ID.
• --cert-file=PATH — Read certificates from PATH. 🍓
• --certifier=FINGERPRINT|KEYID — Create the certification using the key with the specified fingerprint or key ID.
• --certifier-email=EMAIL — Create the certification using the key where a user ID includes the specified email address.
• --certifier-file=PATH — Create the certification using the key read from PATH.
• --certifier-self — Create the certification using your default certification key. This uses the certificates set in the configuration file under pki.vouch.certifier-self as certification key.

heads up bestie: currently, there is no default certification key. 💀

• --certifier-userid=USERID — Create the certification using the key with the specified user ID.
• --depth=TRUST_DEPTH — Set the trust depth. This is sometimes referred to as the trust level. 1 means CERTIFICATE is a trusted introducer (default), 2 means CERTIFICATE is a meta-trusted introducer and can authorize another trusted introducer, etc. 🪜 [default: 1]
• --domain=DOMAIN — Add a domain constraint to the introducer. Add a domain to constrain what certifications are respected. A certification made by the certificate is only respected if it is over a user ID with an email address in the specified domain. Multiple domains may be specified. In that case, one must match. 🌐
• --email=EMAIL — Use a user ID consisting of just the email address, if the email address occurs in a self-signed user ID.
• --expiration=EXPIRATION — Sets the expiration time. EXPIRATION is either an ISO 8601 formatted date with an optional time or a custom duration. A duration takes the form N[ymwds], where the letters stand for years, months, weeks, days, and seconds, respectively. Alternatively, the keyword never does not set an expiration time. 🕰️ The default can be changed in the configuration file using the setting pki.vouch.expiration. [default: 10y]
• --local — Make the certification a local certification. Normally, local certifications are not exported. 🤫
• --non-revocable — Mark the certification as being non-revocable. That is, you cannot later revoke this certification. This should normally only be used with an expiration.

fr fr, once it's non-revocable it's non-revocable bestie, be careful. 😭

• --output=FILE — Write to FILE or stdout if omitted. 📝
• --regex=REGEX — Add a regular expression to constrain the introducer. Add a regular expression to constrain what certifications are respected. A certification made by the certificate is only respected if it is over a user ID that matches one of the specified regular expression. Multiple regular expressions may be specified. In that case, at least one must match. 🧚
• --signature-notation NAME VALUE — Add a notation to the signature. A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. If a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable. 📎
• --unconstrained — Don't constrain the introducer. Normally an introducer is constrained so that only certain user IDs are respected, e.g., those that have an email address for a certain domain name. This option authorizes an introducer without constraining it in this way. Because this grants the introducer a lot of power, you have to opt in to this behavior explicitly. 👑

main character energy with main character consequences, okay?

• --userid=USERID — Use the specified self-signed user ID. The specified user ID must be self signed. ⭐
• --userid-by-email=EMAIL — Use the self-signed user ID with the specified email address.

🌸 Global options

See sq(1) for a description of the global options. that's where the big-picture stuff lives 💜

---

✨ EXAMPLES ✨

Certify that E7FC51AD886BBB5C4F44C3D7A9DA14F3E740F63F is a trusted introducer for example.org and example.com. slay 💅

sq pki vouch authorize \
       --certifier=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --cert=E7FC51AD886BBB5C4F44C3D7A9DA14F3E740F63F \
       --domain=example.org --domain=example.com --all

---

✨ SEE ALSO ✨

sq(1), sq-pki(1), sq-pki-vouch(1).

For the full documentation see <https://book.sequoia-pgp.org/>. 📚

---

✨ VERSION ✨

1.5.0

---

and that's the whole page, bestie 🫶 this is Sequoia PGP, version 1.5.0 — no cap, go forth and authorize responsibly 💖✨🎀