SQ(1)

NAME
sq cert list - List all authenticated bindings (User ID and certificate pairs)

SYNOPSIS
sq cert list [OPTIONS] FINGERPRINT|KEYID|PATTERN

DESCRIPTION
List all authenticated bindings (User ID and certificate pairs).

Only bindings that meet the specified trust amount (by default bindings that are fully authenticated, i.e., have a trust amount of 120), are shown.

Even if no bindings are shown, the exit status is 0.

If `--email` is provided, then a pattern matches if it is a case insensitive substring of the email address as-is or the normalized email address. Note: unlike the email address, the pattern is not normalized. In particular, puny code normalization is not done on the pattern.

OPTIONS

  Subcommand options

--amount=AMOUNT
    The required amount of trust

    120 indicates full authentication; values less than 120 indicate partial authentication. When `--certification-network` is passed, this defaults to 1200, i.e., `sq pki` tries to find 10 paths.

--cert=FINGERPRINT|KEYID
    List certs with the specified fingerprint or key ID

--cert-domain=DOMAIN
    List certs where a user ID includes an email address for the specified domain

--cert-email=EMAIL
    List certs where a user ID includes the specified email address

--cert-grep=PATTERN
    List certs with a user ID that matches the pattern, case insensitively

--cert-userid=USERID
    List certs with the specified user ID

--certification-network
    Treats the network as a certification network

    Normally, `sq pki` treats the Web of Trust network as an authentication network where a certification only means that the binding is correct, not that the target should be treated as a trusted introducer. In a certification network, the targets of certifications are treated as trusted introducers with infinite depth, and any regular expressions are ignored. Note: The trust amount remains unchanged. This is how most so-called PGP path-finding algorithms work.

--gossip
    Treats all certificates as unreliable trust roots

    This option is useful for figuring out what others think about a certificate (i.e., gossip or hearsay). In other words, this finds arbitrary paths to a particular certificate.

    Gossip is useful in helping to identify alternative ways to authenticate a certificate. For instance, imagine Ed wants to authenticate Laura's certificate, but asking her directly is inconvenient. Ed discovers that Micah has certified Laura's certificate, but Ed hasn't yet authenticated Micah's certificate. If Ed is willing to rely on Micah as a trusted introducer, and authenticating Micah's certificate is easier than authenticating Laura's certificate, then Ed has learned about an easier way to authenticate Laura's certificate.

--show-paths
    Show why a binding is authenticated

    By default, only a user ID and certificate binding's degree of authentication (a value between 0 and 120) is shown. This changes the output to also show how that value was computed by showing the paths from the trust roots to the bindings.

FINGERPRINT|KEYID|PATTERN
    A pattern to filter the displayed certificates

    If the pattern appears to be a fingerprint or key ID, it is treated as if it were passed to `--cert`, and matches on the certificate's fingerprint. Otherwise, it is treated as if it were passed via `--cert-grep`, and matches on user IDs.

  Global options
See sq(1) for a description of the global options.

EXAMPLES

List all bindings for user IDs containing an email address from example.org, and that can be authenticated.

    sq cert list @example.org

List all authenticated bindings for User IDs containing a specific email address.

    sq cert list --cert-email=alice@example.org

List all paths to certificates containing a specific email address.

    sq cert list --gossip --show-paths \
        --cert-email=alice@example.org

SEE ALSO
sq(1), sq-cert(1).

For the full documentation see <https://book.sequoia-pgp.org>.

VERSION
1.0.0 (sequoia-openpgp 1.22.0)