add(1)

NAME
add - Link a certificate and a User ID

SYNOPSIS
add [-d|--depth] [--ca] [-a|--amount] [-r|--regex] [--notation] [--temporary] [--expires] [--expires-in] [--all] [--userid] [--email] [--petname] [-h|--help] <FINGERPRINT|KEYID> [USERID|EMAIL]

DESCRIPTION
Link a certificate and a User ID. This cause "sq" to considers the certificate and User ID binding to be authentic.

A certificate can also be accepted as a certification authority, which is also known as a trusted introducer, by using the "--ca" or "--depth" option.

A link can be retracted using "sq link retract".

This command is similar to "sq certify", but the certifications it makes are done using the certificate directory's trust root, not an arbitrary key. Further, the certificates are marked as non-exportable. The former makes it easier to manage certifications, especially when the user's certification key is offline. And the latter improves the user's privacy, by reducing the chance that parts of the user's social graph is leaked when a certificate is shared.

OPTIONS

-d, --depth=TRUST_DEPTH
    Sets the trust depth (sometimes referred to as the trust level). 0 means a normal certification of <CERTIFICATE, USERID>. 1 means CERTIFICATE is also a trusted introducer, 2 means CERTIFICATE is a meta-trusted introducer, etc.

--ca=*|DOMAIN
    Marks the certificate as a certification authority for a domain. Use * to make the certificate a certification for any User ID. A certification authority is also referred to as a trusted introducer. This command is equivalent to making the trust depth unconstrained, i.e., setting the depth to 255. See "--depth" for more information.

-a, --amount=TRUST_AMOUNT [default: 120]
    Sets the amount of trust. Values between 1 and 120 are meaningful. 120 means fully trusted. Values less than 120 indicate the degree of trust. 60 is usually used for partially trusted.

-r, --regex=REGEX
    Adds a regular expression to constrain what a trusted introducer can certify. The regular expression must match the certified User ID in all intermediate introducers, and the certified certificate. Multiple regular expressions may be specified. In that case, at least one must match.

--notation=NAME VALUE
    Adds a notation to the certification. A user-defined notation's name must be of the form "name@a.domain.you.control.org". If the notation's name starts with a !, then the notation is marked as being critical. If a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable.

--temporary=TEMPORARY
    Temporarily accepts the binding. Creates a fully
                trust link between a certificate and one or more
                User IDs for a week. After that, the link is
                automatically downgraded to a partially trusted link
                (trust = 40).

--expires=TIME
    Makes the acceptance expire at TIME (as ISO 8601). Use "never" (the default), to indicate the acceptance does not expire.

--expires-in=DURATION
    Makes the certification expire after DURATION. Either "N[ymwds]", for N years, months, weeks, days, seconds, or "never". [default: 5y]

--all=ALL
    Links all valid self-signed User ID to the certificate.

--userid=USERID
    A User ID to link to the certificate. This must match a self-signed User ID. To link a User ID to the certificate that does not have a self-signature, use "--petname".

--email=EMAIL
    An email address to link to the certificate. The email address must match the email address of a self-signed User ID. To link an email address to the certificate that does not appear in a self-signed User ID, use "--petname". If the specified email appears in multiple self-signed User IDs, then all of them are linked.

--petname=PETNAME
    A User ID to link to the certificate. Unlike "--userid", this does not need to match a self-signed User ID. Bare email address are automatically wrapped in angle brackets. That is if "alice@example.org" is provided, it is silently converted to "<alice@example.org>".

-h, --help
    Print help information (use `-h` for a summary)

<FINGERPRINT|KEYID>
    The certificate to accept.

[USERID|EMAIL]
    A User ID or email address to link to the certificate. This must match a self-signed User ID. To link a User ID to the certificate that does not have a self-signature, use "--petname". Scripts should prefer to use "--email" or "--userid", as "sq" does not need to guess if a value is a User ID or an email address.

EXTRA
EXAMPLES: # The user links 0123456789ABCDEF and the User ID # "<romeo@example.org>". $ sq link add 0123456789ABCDEF "<romeo@example.org>" # The user examines 0123456789ABCDEF and then accepts the certificate # 0123456789ABCDEF with its current set of self-signed User IDs. $ sq export --cert 0123456789ABCDEF | sq inspect ... $ sq link add 0123456789ABCDEF # The user links the certificate and its current self-signed User # IDs for a week. $ sq link add --expires-in 1w 0123456789ABCDEF # The user accepts the certificate, and its current self-signed User # IDs as a certification authority. That is, the certificate is # considered a trust root. $ sq link add --ca '*' 0123456789ABCDEF # The user accepts the certificate and its current self-signed User # IDs as a partially trusted certification authority. $ sq link add --ca --amount 60 0123456789ABCDEF # The user retracts their acceptance of 0123456789ABCDEF and any # associated User IDs. This effectively invalidates any links. $ sq link retract 0123456789ABCDEF