SQ(1)

NAME
sq link add - Link a certificate and a User ID

SYNOPSIS
sq [GLOBAL OPTIONS] link add [OPTIONS] FINGERPRINT|KEYID USERID|EMAIL

DESCRIPTION
Link a certificate and a User ID. This cause "sq" to considers the certificate and User ID binding to be authentic.

A certificate can also be accepted as a certification authority, which is also known as a trusted introducer, by using the "--ca" or "--depth" option.

A link can be retracted using "sq link retract".

This command is similar to "sq certify", but the certifications it makes are done using the certificate directory's trust root, not an arbitrary key. Further, the certificates are marked as non-exportable. The former makes it easier to manage certifications, especially when the user's certification key is offline. And the latter improves the user's privacy, by reducing the chance that parts of the user's social graph is leaked when a certificate is shared.

By default a link never expires. Using the "--expiry=EXPIRY" argument specific validity periods may be defined. It allows for providing a point in time for validity to end or a validity duration.

"sq link" respects the reference time set by the top-level "--time" argument. It sets the link's creation time to the reference time.

OPTIONS

  Global options

--cert-store=PATH
    Specifies the location of the certificate store

-f, --force=FORCE
    Overwrites existing files

--keyring=PATH
    Specifies the location of a keyring to use

--known-notation=NOTATION
    Adds NOTATION to the list of known notations

--no-cert-store=NO_CERT_STORE
    Disables the use of a certificate store

--output-format=FORMAT
    Produces output in FORMAT, if possible

--output-version=VERSION
    Produces output variant VERSION.

--pep-cert-store=PATH
    Specifies the location of a pEp certificate store

--time=TIME
    Sets the reference time as ISO 8601 formatted timestamp

--trust-root=FINGERPRINT|KEYID
    Considers the specified certificate to be a trust root

  Subcommand options

-a, --amount=TRUST_AMOUNT
    Sets the amount of trust

--all=ALL
    Links all valid self-signed User ID to the certificate.

--ca=*|DOMAIN
    Marks the certificate as a certification authority for a domain

-d, --depth=TRUST_DEPTH
    Sets the trust depth

--email=EMAIL
    An email address to link to the certificate.

--expiry=EXPIRY
    Defines EXPIRY for the acceptance as ISO 8601 formatted string or custom duration.

--notation=NAME
    Adds a notation to the certification.

--petname=PETNAME
    A User ID to link to the certificate.

-r, --regex=REGEX
    Adds a regular expression to constrain what a trusted introducer can certify

--temporary=TEMPORARY
    Temporarily accepts the binding

--userid=USERID
    A User ID to link to the certificate.

EXAMPLES

The user links 0123456789ABCDEF and the User ID

"<romeo@example.org>".

    sq link add 0123456789ABCDEF "<romeo@example.org>"

The user examines 0123456789ABCDEF and then accepts the certificate

0123456789ABCDEF with its current set of self-signed User IDs.

    sq export --cert 0123456789ABCDEF | sq inspect

...

    sq link add 0123456789ABCDEF

The user links the certificate and its current self-signed User

IDs for a week.

    sq link add --expires-in 1w 0123456789ABCDEF

The user accepts the certificate, and its current self-signed User

IDs as a certification authority. That is, the certificate is

considered a trust root.

    sq link add --ca '*' 0123456789ABCDEF

The user accepts the certificate and its current self-signed User

IDs as a partially trusted certification authority.

    sq link add --ca --amount 60 0123456789ABCDEF

The user retracts their acceptance of 0123456789ABCDEF and any

associated User IDs. This effectively invalidates any links.

    sq link retract 0123456789ABCDEF

SEE ALSO
sq(1).

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

VERSION
0.31.0 (sequoia-openpgp 1.16.0, using Nettle 3.9 (Cv448: true))