SQ(1)

💖 SQ(1) — the one where you verify stuff 💖

okay bestie, so this is the sq verify page from the User Commands manual. it's the vibe check for signatures. let's get into it 🦋

---

✨ NAME ✨

sq-verify — verify signed messages or detached signatures

---

🌸 SYNOPSIS 🌸

sq verify [OPTIONS] FILE

---

💅 DESCRIPTION 💅

Verify signed messages or detached signatures. no cap, that's the whole job.

When you're verifying signed messages, the message gets written to stdout — or to the file you handed to --output. 💌

When a detached message gets verified, no output is produced at all. detached signatures are super common for signing software packages, so this is like, a whole thing. iykyk.

Verification is only successful if there is no bad signature and the number of successfully verified signatures reaches the threshold you configured with the --signatures parameter. if the verification fails, the program terminates with an exit status indicating failure, and the output file is deleted. 😭 and if the output went to stdout? then the last 25 MiB of the message are withheld — which means if the message is smaller than 25 MiB, you get literally no output. wild, i know.

A signature is considered to have been authenticated if the signer can be authenticated. here's the tea:

• If the signer is provided via --signer-file, then the signer is considered authenticated. slay, easy.
• Otherwise, the signer is looked up and authenticated using the Web of Trust. if at least one User ID can be fully authenticated, then the signature is considered to have been authenticated.
• If the signature includes a Signer User ID subpacket, then only that User ID is considered.

ngl, important note: the User ID need not be self signed. 👀

The converse operation is sq sign. 🪞

If you are looking for a standalone program to verify clear text signatures, detached signatures or inline signatures, consider using sequoia-sqv.

sq verify respects the reference time set by the top-level --time argument. when it's set, it verifies the message as of the reference time instead of the current time. time travel but make it cryptographic ⏰✨

---

👑 OPTIONS 👑

🌈 Subcommand options

• --cleartext — Verify a cleartext-signed message
• --message — Verify an inline signed message
• --output=FILE — Write to FILE or stdout if omitted

[default: -]

• --signature-file=SIG — Verify a detached signature file
• --signatures=N — Set the threshold of valid signatures to N

If this threshold is not reached, the message will not be considered verified.

[default: 1]

• --signer=FINGERPRINT|KEYID — Require a signature from a certificate with the specified fingerprint or key ID
• --signer-domain=DOMAIN — Require a signature from a certificate where a user ID includes an email address for the specified domain
• --signer-email=EMAIL — Require a signature from a certificate where a user ID includes the specified email address
• --signer-file=PATH — Require a signature from a certificate read from PATH
• --signer-userid=USERID — Require a signature from a certificate with the specified user ID
• FILE — Read from FILE or stdin if FILE is '-'

[default: -]

🧚 Global options

See sq(1) for a description of the global options. (go read the main character's page, bestie 🫶)

---

⭐ EXAMPLES ⭐

Verify a signed message.

sq verify --message document.pgp

Verify a detached signature.

sq verify --signature-file=document.sig document.txt

Verify a message as of June 19, 2024 at midnight UTC.

sq verify --time 2024-06-19 --message document.pgp

---

🔥 SEE ALSO 🔥

• sq(1).
• For the full documentation see <https://book.sequoia-pgp.org/>.

---

💜 VERSION 💜

1.5.0

---

aaaand that's the page!! ✨ huge shoutout to Sequoia PGP for this 1.5.0 masterpiece, fr fr — the version is 1.5.0, it's dated 1.5.0, and if you need the actual SQ(1) manual name, it's right up there in the title where it belongs. go verify something and feel iconic doing it 💅🎀🦋