SQ(1)

NAME
sq verify - Verifies signed messages or detached signatures

SYNOPSIS
sq [GLOBAL OPTIONS] verify [OPTIONS] FILE

DESCRIPTION
Verifies signed messages or detached signatures.

When verifying signed messages, the message is written to stdout or the file given to --output.

When a detached message is verified, no output is produced. Detached signatures are often used to sign software packages.

Verification is only successful if there is no bad signature, and the number of successfully verified signatures reaches the threshold configured with the "--signatures" parameter. If the verification fails, the program terminates with an exit status indicating failure. In addition to that, the last 25 MiB of the message are withheld, i.e. if the message is smaller than 25 MiB, no output is produced, and if it is larger, then the output will be truncated.

A signature is considered to have been authenticated if the signer can be authenticated. If the signer is provided via "--signer-file", then the signer is considered authenticated. Otherwise, the signer is looked up and authenticated using the web of trust. If at least one User ID can be fully authenticated, then the signature is considered to have been authenticated. If the signature includes a Signer User ID subpacket, then only that User ID is considered. Note: the User ID need not be self signed.

The converse operation is "sq sign".

If you are looking for a standalone program to verify detached signatures, consider using sequoia-sqv.

"sq verify" respects the reference time set by the top-level "--time" argument. When set, it verifies the message as of the reference time instead of the current time.

OPTIONS

  Global options

--cert-store=PATH
    Specifies the location of the certificate store

-f, --force=FORCE
    Overwrites existing files

--keyring=PATH
    Specifies the location of a keyring to use

--known-notation=NOTATION
    Adds NOTATION to the list of known notations

--no-cert-store=NO_CERT_STORE
    Disables the use of a certificate store

--output-format=FORMAT
    Produces output in FORMAT, if possible

--output-version=VERSION
    Produces output variant VERSION.

--pep-cert-store=PATH
    Specifies the location of a pEp certificate store

--time=TIME
    Sets the reference time as ISO 8601 formatted timestamp

--trust-root=FINGERPRINT|KEYID
    Considers the specified certificate to be a trust root

  Subcommand options

--detached=SIG
    Verifies a detached signature

-n, --signatures=N
    Sets the threshold of valid signatures to N

-o, --output=FILE
    Writes to FILE or stdout if omitted

--signer-cert=FINGERPRINT|KEYID
    Verifies signatures using the specified certificate

--signer-file=CERT_FILE
    Verifies signatures using the certificate in CERT_FILE

EXAMPLES

Verify a signed message

    sq verify --signer-file juliet.pgp signed-message.pgp

Verify a detached message

    sq verify --signer-file juliet.pgp --detached message.sig message.txt

Verify a message as of June 9, 2011 at midnight UTC:

    sq verify --time 20130721 msg.pgp

SEE ALSO
sq(1).

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

VERSION
0.31.0 (sequoia-openpgp 1.16.0, using Nettle 3.9 (Cv448: true))