sq-pki-link-add - Man Page

-a, --amount=AMOUNT

Set the amount of trust.  Values between 1 and 120 are meaningful. 120 means fully trusted.  Values less than 120 indicate the degree of trust.  60 is usually used for partially trusted.

[default: full]

--all

Link all valid self-signed User ID to the certificate.

--ca=*|DOMAIN

Mark the certificate as a certification authority for a  domain.  Use `*` to make the certificate a certification
            authority for any User ID.

            A certification authority is also referred to as a trusted introducer.  This command is equivalent to making the trust depth unconstrained, i.e., setting the depth to 255.  See `--depth` for more information.

-d, --depth=TRUST_DEPTH

Set the trust depth (sometimes referred to as the trust level).  0 means a normal certification of <CERTIFICATE, USERID>.  1 means CERTIFICATE is also a trusted introducer, 2 means CERTIFICATE is a meta-trusted introducer, etc.

--email=EMAIL

An email address to link to the certificate.  The email address must match the email address of a self-signed User ID.  To link an email address to the certificate that does not appear in a self-signed User ID, use `--petname`.  If the specified email appears in multiple self-signed User IDs, then all of them are linked.

--expiry=EXPIRY

Define EXPIRY for the acceptance as ISO 8601 formatted string or custom duration. If an ISO 8601 formatted string is provided, the validity period reaches from the reference time (may be set using `--time`) to the provided time. Custom durations starting from the reference time may be set using `N[ymwds]`, for N years, months, weeks, days, or seconds. The special keyword `never` sets an unlimited expiry.

[default: never]

--notation NAME VALUE

Add a notation to the certification.  A user-defined notation's name must be of the form `name@a.domain.you.control.org`. If the notation's name starts with a `!`, then the notation is marked as being critical.  If a consumer of a signature doesn't understand a critical notation, then it will ignore the signature.  The notation is marked as being human readable.

--petname=PETNAME

A User ID to link to the certificate.  Unlike `--userid`, this does not need to match a self-signed User ID.  Bare email address are automatically wrapped in angle brackets. That is if `alice@example.org` is provided, it is silently converted to `<alice@example.org>`.

-r, --regex=REGEX

Add a regular expression to constrain what a trusted introducer can certify.  The regular expression must match the certified User ID in all intermediate introducers, and the certified certificate. Multiple regular expressions may be specified.  In that case, at least one must match.

--temporary

Temporarily accepts the binding.  Creates a fully
           trust link between a certificate and one or more
           User IDs for a week.  After that, the link is
           automatically downgraded to a partially trusted link
           (trust = 40).

--userid=USERID

A User ID to link to the certificate.  This must match a self-signed User ID.  To link a User ID to the certificate that does not have a self-signature, use `--petname`.

FINGERPRINT|KEYID

The certificate to accept.

USERID|EMAIL

A User ID or email address to link to the certificate.  This must match a self-signed User ID.  To link a User ID to the certificate that does not have a self-signature, use `--petname`.  Scripts should prefer to use `--email` or `--userid`, as `sq` does not need to guess if a value is a User ID or an email address.

See sq(1) for a description of the global options.