sqv(1)

NAME#

sqv - An OpenPGP signature verification tool

SYNOPSIS#

sqv [OPTIONS] FILE

DESCRIPTION#

An OpenPGP signature verification tool.

sqv is a simple signature verification tool. It checks that signatures are valid, and correctly issued by one of the certificates in the specified keyring.

sqv can verify detached signatures, inline-signed messages, and messages using the Cleartext Signature Framework.

To verify detached signatures, use the `--signature-file` argument followed by the path to the detached signature file, and give the data file as first positional argument:

$ sqv --keyring=... --signature-file=image.iso.sig image.iso

To verify an inline-signed message, use the `--message` argument, and give the path to the inline-signed message as first positional argument. When verifying an inline-signed `--output` has to be given:

$ sqv --keyring=... --output=authenticated.txt \ --message signed.pgp

To verify a message using the Cleartext Signature Framework, use the `--cleartext` argument, and give the path to the message as first positional argument. When verifying an inline-signed `--output` has to be given:

$ sqv --keyring=... --output=authenticated.txt \ --cleartext message.txt

Finally, there is a legacy way to verify detached signatures, where the path to the signature file and the path to the data file are given as positional arguments. This form is deprecated, prefer the explicit `--signature-file` form.

By default, one signature must be valid. This can be changed using the `--signatures` arguments.

A signature is valid if a signing-capable key can verify the signature. The signing-capable key must be correctly bound to a certificate in the keyring, and it must not be revoked, or expired. The certificate must not be revoked or expired. The signature, the signing-capable key and the certificate must all be valid according to the cryptographic policy.

By default, sqv configures the cryptographic policy using </etc/crypto-policies/back-ends/sequoia.config>. That can be overwritten by setting the SEQUOIA_CRYPTO_POLICY environment variable to an alternate file. The path must be absolute. The file's format is described here: <https://docs.rs/sequoia-policy-config/>.

In some cases, the user expects signatures to be made within a certain temporal window. This can be enforced using the `--not-before` and `--not-after` arguments. The TIMESTAMPs must be given in ISO 8601 format (e.g. `2017-03-04T13:25:35Z`, `2017-03-04T13:25`, `20170304T1325+0830`, `2017-03-04`, `2017031`, etc.). If no timezone is specified, UTC is assumed.

Exits with a non-zero status if the specified number of signatures could not be verified.

OPTIONS#

-V, --version

Print version

--cleartext

Verify a cleartext-signed message

-h, --help

Print help (see a summary with '-h')

--keyring=FILE

A keyring

--message

Verify an inline signed message

-n, --signatures=N

The number of valid signatures to return success.

Note: this counts the number of certificates, not signatures. Thus, if two signatures are issued by the same certificate, they only count once.

[default: 1]

--not-after=TIMESTAMP

Consider signatures created after TIMESTAMP as invalid.

If only a date is given, 23:59:59 is used for the time. [default: now]

--not-before=TIMESTAMP

Consider signatures created before TIMESTAMP as invalid.

If only a date is given, 00:00:00 is used for the time. [default: no constraint]

--output=FILE

Write to FILE or stdout if omitted

--policy-as-of=TIMESTAMP

Select the cryptographic policy as of the specified time

The time is expressed as an ISO 8601 formatted timestamp. The policy determines what cryptographic constructs are allowed.

If you are working with a message that sq rejects, because it is protected by cryptographic constructs that are now considered broken, you can use this option to select a different cryptographic policy. If you are relying on the cryptography, e.g., you are verifying a signature, then you should only do this if you are confident that the message hasn't been tampered with.

TIME is interpreted as an ISO 8601 timestamp. To set the policy time to January 1, 2007 at midnight UTC, you can do:

$ sqv --policy-as-of 20070101 --message msg.pgp

Defaults to the current time.

--signature-file=SIG

Verify a detached signature file

-v, --verbose

Be verbose

FILE

The inline-signed message, message using the Cleartext Signature Framework, or data file

EXAMPLES#

Verify a detached signature.

sqv --keyring=trusted.certs --signature-file=document.sig \

document.txt

Verify a detached signature, legacy interface.

sqv --keyring=trusted.certs document.sig document.txt

Verify a signed message.

sqv --keyring trusted.certs --message document.pgp

Verify a message using the Cleartext Signature Framework.

sqv --keyring trusted.certs --clearsign document.pgp

VERSION#

1.3.0