userid(1)

💅 NAME ✨

userid — bestie, this is how you revoke a User ID. That's it, that's the whole job. 🫶

This page lives in the Sequoia manual, section 1, so if you ever need to find it again: userid(1).

---

🌸 SYNOPSIS 🌸

userid [--certificate] [--revocation-key] [--private-key-store]
[-t|--time] [--notation] [-B|--binary] [-h|--help] <USERID> <REASON>
<MESSAGE>

---

💖 DESCRIPTION 💖

okay so. This command revokes a User ID. Like, it goes and makes a revocation certificate for a User ID. Slay, but make it official. 🔥

If --revocation-key is provided, then that key is the one used to create the signature. And here's the tea: if that key is different from the certificate being revoked, you've just made a third-party revocation. Normally that's only useful if the owner of the certificate designated that key to be a designated revoker. iykyk. 👑

If --revocation-key is not provided, then the certificate must include a certification-capable key. No key, no revocation, no exceptions bestie. 💀

---

🎀 OPTIONS 🎀

• --certificate=FILE — reads the certificate you wanna revoke from FILE, or from stdin if you just... didn't say. And ngl, it's an error if the file has more than one certificate in it. One certificate only, we don't do bundles here. 🙈
• --revocation-key=KEY — signs the revocation certificate using KEY. If the key is different from the certificate, boom, you get a third-party revocation. And if you don't pass this option but the certificate does include secret key material? Then that key gets used to sign the revocation certificate. Convenient. ✨
• --private-key-store=KEY_STORE — provides parameters for the private key store. 🗝️
• -t, --time=TIME — picks the keys valid at the specified time, and sets the revocation certificate's creation time. Time travel, but legal. 🕰️
• --notation=NAME VALUE — adds a notation to the certification. A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. And heads up: if a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. 😭 The notation is marked as being human readable.
• -B, --binary — emits binary data. Raw bytes, no thoughts. 🧚
• -h, --help — print help information. The classic. 💜
• <USERID> — the User ID to revoke. By default, this must exactly match a self-signed User ID. Use --force to generate a revocation certificate for a User ID which is not self signed. (yes, that's the whole point of --force, iconic behaviour honestly)
• <REASON> — the reason for the revocation. This must be either: retired, or unspecified:
  • retired means that this User ID is no longer valid. This is appropriate when someone leaves an organisation, and the organisation does not have their secret key material. For instance, if someone was part of Debian and retires, they would use this to indicate that a Debian-specific User ID is no longer valid.
  • unspecified means that a different reason applies.

If the reason happened in the past, you should specify that using the --time argument. This allows OpenPGP implementations to more accurately reason about objects whose validity depends on the validity of a User ID. Very main character of you to give them accurate context. ⭐

• <MESSAGE> — a short, explanatory text that is shown to a viewer of the revocation certificate. It explains why the certificate has been revoked. For instance, if Alice has created a new key, she would generate a 'superseded' revocation certificate for her old key, and might include the message "I've created a new certificate, FINGERPRINT, please use that in the future." Communicate bestie, it's free. 💖

---

🦋 SEE ALSO 🦋

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1) sq-inspect(1) sq-key(1) sq-keyring(1) sq-keyserver(1) sq-packet(1) sq-revoke(1) sq-revoke-certificate(1) sq-revoke-subkey(1) sq-sign(1) sq-verify(1) sq-wkd(1)

---

And that's the whole page, bestie!! This one's from sq 0.26.0, dated July 2022 — so if you're reading this, the Sequoia girlies were serving documentation way back then. Go revoke something (responsibly). periodt. 💅✨🌈