SQV(1)

💖 SQV(1) — like, the signature verification girlie 💖

okay bestie, welcome to sqv(1), from the Sequoia PGP fam. Pull up a chair, grab a boba, and let's verify some signatures together. 🫶

---

✨ NAME ✨

sqv — An OpenPGP signature verification tool 💅

---

🌸 SYNOPSIS 🌸

sqv [OPTIONS] FILE

---

🦋 DESCRIPTION 🦋

It's an OpenPGP signature verification tool, periodt.

sqv is a simple signature verification tool. It checks that signatures are valid, and correctly issued by one of the certificates in the specified keyring. No drama, no extra lore, just vibes and math. ✨

sqv can verify detached signatures, inline-signed messages, and messages using the Cleartext Signature Framework. Three flavors, all iconic.

---

💜 Detached signatures

To verify detached signatures, use the --signature-file argument followed by the path to the detached signature file, and give the data file as first positional argument:

$ sqv --keyring=... --signature-file=image.iso.sig image.iso

---

💜 Inline-signed messages

To verify an inline-signed message, use the --message argument, and give the path to the inline-signed message as first positional argument. When verifying an inline-signed message, --output has to be given:

$ sqv --keyring=... --output=authenticated.txt \
      --message signed.pgp

---

💜 Cleartext Signature Framework

To verify a message using the Cleartext Signature Framework, use the --cleartext argument, and give the path to the message as first positional argument. When verifying an inline-signed message, --output has to be given:

$ sqv --keyring=... --output=authenticated.txt \
      --cleartext message.txt

---

💜 The legacy route (iykyk)

Finally, there is a legacy way to verify detached signatures, where the path to the signature file and the path to the data file are given as positional arguments. This form is deprecated, prefer the explicit --signature-file form. Like, it still works, but it's giving "2014 tumblr era", y'know? 🙈

---

💜 How many sigs do we need tho

By default, one signature must be valid. This can be changed using the --signatures arguments.

A signature is valid if a signing-capable key can verify the signature. The signing-capable key must be correctly bound to a certificate in the keyring, and it must not be revoked, or expired. The certificate must not be revoked or expired. The signature, the signing-capable key and the certificate must all be valid according to the cryptographic policy. Everybody has to pass the vibe check, no exceptions. 👑

---

💜 Crypto policy stuff

By default, sqv configures the cryptographic policy using /etc/crypto-policies/back-ends/sequoia.config. That can be overwritten by setting the SEQUOIA_CRYPTO_POLICY environment variable to an alternate file. The path must be absolute. The file's format is described here: https://docs.rs/sequoia-policy-config/.

---

💜 Time windows, because timing is everything ⏰

In some cases, the user expects signatures to be made within a certain temporal window. This can be enforced using the --not-before and --not-after arguments. The *TIMESTAMP*s must be given in ISO 8601 format (e.g. 2017-03-04T13:25:35Z, 2017-03-04T13:25, 20170304T1325+0830, 2017-03-04, 2017031, etc.). If no timezone is specified, UTC is assumed.

---

💜 Exit status

Exits with a non-zero status if the specified number of signatures could not be verified. 💀

---

🎀 OPTIONS 🎀

• -V, --version — Print version
• --cleartext — Verify a cleartext-signed message
• -h, --help — Print help (see a summary with '-h')
• --keyring=FILE — A keyring
• --message — Verify an inline signed message
• -n, --signatures=N — The number of valid signatures to return success.

Note: this counts the number of certificates, not signatures. Thus, if two signatures are issued by the same certificate, they only count once. (Not me counting the same person twice 😭)

[default: 1]

• --not-after=TIMESTAMP — Consider signatures created after TIMESTAMP as invalid.

If only a date is given, 23:59:59 is used for the time. [default: now]

• --not-before=TIMESTAMP — Consider signatures created before TIMESTAMP as invalid.

If only a date is given, 00:00:00 is used for the time. [default: no constraint]

• --output=FILE — Write to FILE.

This is required when verifying an inline signed message (using --message) and a cleartext signed message (using --cleartext) and is forbidden when verifying a detached signature (using --signature-file). Pick a lane, bestie. 💅

• --overwrite — Overwrite the output file if it already exists
• --policy-as-of=TIMESTAMP — Select the cryptographic policy as of the specified time

The time is expressed as an ISO 8601 formatted timestamp. The policy determines what cryptographic constructs are allowed.

If you are working with a message that sq rejects, because it is protected by cryptographic constructs that are now considered broken, you can use this option to select a different cryptographic policy. If you are relying on the cryptography, e.g., you are verifying a signature, then you should only do this if you are confident that the message hasn't been tampered with. ⚠️ Like, fr fr, be careful.

TIME is interpreted as an ISO 8601 timestamp. To set the policy time to January 1, 2007 at midnight UTC, you can do:

$ sqv --policy-as-of 20070101 --message msg.pgp

Defaults to the current time.

• --signature-file=SIG — Verify a detached signature file
• --time=TIMESTAMP — Set the reference time as an ISO 8601 formatted timestamp or relative offset.

This sets the reference time for the sqv session. Normally, sqv uses the current time. This argument allows you to use a different time.

This time is also used as the default value for --not-after and --policy-as-of, and it is passed to the signature verifier as the reference time for evaluating whether keys and certificates are valid.

TIME is interpreted as an ISO 8601 timestamp. To set the time to January 1, 2007 at midnight UTC, you can do:

$ sqv --time 20070101 --keyring keyring.pgp --message msg.pgp

An offset can also be used. For instance, to set the time to one year ago, do:

$ sqv --time -1y --keyring keyring.pgp --message msg.pgp

• -v, --verbose — Be verbose
• FILE — The inline-signed message, message using the Cleartext Signature Framework, or data file

---

🌈 EXAMPLES 🌈

Verify a detached signature.

sqv --keyring=trusted.pgp --signature-file=document.sig \
       document.txt

Verify a detached signature, legacy interface.

sqv --keyring=trusted.pgp document.sig document.txt

Verify a signed message.

sqv --keyring trusted.pgp --message document.pgp

Verify a message using the Cleartext Signature Framework.

sqv --keyring trusted.pgp --cleartext document.pgp

---

👑 VERSION 👑

1.5.0

---

aaaand that's the whole page, bestie!! 🥳 you just read an entire manual and honestly? main character energy. this was Sequoia PGP, version 1.5.0, sqv(1) — go forth and verify, slay, and stay cryptographically safe out there 💖✨🎀🦋🌸💅🫶