PQC signing service parameters

Command-line parameters and file paths for configuring Post-Quantum Cryptography signing services.

sq key generate parameters

Parameter Description
--cannot-encrypt Create a signing-only key by removing encryption capability
--cannot-authenticate Create a signing-only key by removing authentication capability
--home Directory path for the sequoia keystore
--profile rfc9580 Use OpenPGP v6 standard
--cipher-suite mldsa65-ed25519 Use ML-DSA-65/Ed25519 hybrid cipher suite for quantum resistance. mldsa87-ed448 is also supported.
--own-key Mark the key as trusted in the local keystore
--name User name for the key identity
--email Email address for the key identity
--new-password-file Path to file containing password for key protection

pulpcore-manager add-signing-service parameters

Parameter Description
name Name of the signing service (for example, ansible-sq or container-sq)
script Absolute path to the signing script
fingerprint Key fingerprint to use for signing
--backend sq Use sequoia-pgp as the signing backend
--class container:ManifestSigningService Required for execution environment signing only
--keyring Path to the public key file
--home Path to the sequoia keystore directory

sq verify parameters

Parameter Description
--keyring Path to the public key file for verification
--signer-file Path to the public key file for verification (alternative to --keyring)
--detached Path to the detached signature file
--signature-file Path to the signature file (for non-detached signatures)
file Path to the signed file (positional argument)

Standard file paths

Path Purpose
/var/lib/pulp/certs/sequoia/ sequoia-pgp keystore directory (stores private keys)
/var/lib/pulp/certs/sq_public_key.asc Public key for signature verification (collections and execution environments)
/var/lib/pulp/scripts/collection_sign_sq.sh Ansible collection signing script
/var/lib/pulp/scripts/container_sign_sq.sh Execution environment signing script