path(1)

🌸 path(1) — the vibe check for certificate paths 🌸

ok bestie, sit down, we're doing path verification and honestly? it's giving detective work. this is path, a subcommand from the general commands manual (section 1, iykyk). no cap, let's get into it. 💅

---

✨ NAME ✨

path — Verify the specified path 💖

---

🎀 SYNOPSIS 🎀

path [--email] [-h|--help] [FINGERPRINT|KEYID USERID]

---

🦋 DESCRIPTION 🦋

Verify the specified path. that's it, that's the whole job. 🌈

ok so a path is literally a sequence of certificates starting at the root, plus a User ID. this function checks that each path segment has a valid certification — and that it also satisfies any constraints (trust amount, trust depth, regular expressions). like, every single link in the chain has to be doing its job, periodt. 🔥

If a valid path is not found, then this subcommand also lints the path. and bestie, the linting is the messy part. Specifically, it reports if any certifications are:

• insufficient — e.g., not enough trust depth 😭
• invalid — e.g., because they use SHA-1, but the use of SHA-1 has been disabled 💀

so yeah, if your path fails, you don't just get a "no" — you get a whole breakdown of why. main character energy from a diagnostic tool, honestly.

---

💅 OPTIONS 💅

• --email — Changes the USERID parameter to match User IDs with the specified email address. ✨ Interprets the USERID parameter as an email address, which is then used to select User IDs with that email address. Unlike when comparing User IDs, email addresses are first normalized by the domain to ASCII using IDNA2008 Punycode conversion, and then converting the resulting email address to lowercase using the empty locale. 🧚 (yes, that's a whole lot of normalization, and yes, it matters.) If multiple User IDs match, they are each considered in turn, and this function returns success if at least one of those User IDs can be authenticated. 🫶

Note: The paths to the different User IDs are not combined. so don't go thinking they team up, because they do not. 🙈

• -h, --help — Print help (see a summary with '-h') 🌸
• [FINGERPRINT|KEYID USERID] — A path consists of one or more certificates (designated by their fingerprint or Key ID) and ending in the User ID that is being authenticated. 👑

---

⭐ EXTRA ⭐

EXAMPLES:

# Verify that Neal ceritified Justus's certificate for a particular User
# ID.  $ sq-wot --keyring keyring.pgp \
  path \
    8F17777118A33DDA9BA48E62AACB3243630052D9 \
    CBCD8F030588653EEDD7E2659B7DD433F254904A \
    "Justus Winter <justus@sequoia-pgp.org>"

# The same as above, but output in DOT format and convert it to # an SVG
using Graphviz's DOT compiler.  $ sq-wot --format dot \
    --keyring keyring.pgp \
  path \
    8F17777118A33DDA9BA48E62AACB3243630052D9 \
    CBCD8F030588653EEDD7E2659B7DD433F254904A \
    "Justus Winter <justus@sequoia-pgp.org>" \
  | dot -Tsvg -o neal--justus.svg

---

lowkey the second example is the flex — you pipe the DOT output straight into Graphviz's DOT compiler and boom, you've got an SVG. iconic. 🎀

and that's the whole page bestie, we ate and left no crumbs. this lil legend comes to you from the path manual page, section 1 of the General Commands Manual — same name up top, same name at the bottom, no cap. 💖✨🦋