Agreed, after the verification succeeds the caller can (and probably will) check the signature notations.

Thank you!

In T4060#190972, @werner wrote:

We need a way to pass --known-notation to gpgme_op_verify

Thank you for considering this addition. This is very much appreciated! 🙇

Solved for gnupg 2.2, 2.4 and 2.6. GPGME support still missing.

Alright, finally supported by gpgme (fot 1.24) For testing you may use

tests/run-verify --known-notations  'foo@bar something, bla@buh.de'  a.sig

Thus you give a list of known notations either space or comma delimited. Each one translates into one --known-notation for gpg.

An open question is what would happen if I mark a notation as recognized but the signature does not contain it.

This is the same as with the predefined critical notation "preferred-email-encoding@pgp.com" : It is ignored. You may use the regular notations functions to check for the existence of a notation.

I've checked and can confirm this is working as intended.

First, I made a signature with a critical notation:

$ echo x | gpg --sign --sig-notation '!target@metacode.biz=node-1' > f.sig

Then I used your command for verification:

$ tests/run-verify --known-notations  'target@metacode.biz'  f.sig
Original file name .: [none]
MIME flag ..........: no
Signature ...: 0
  status ....: Success
  summary ...: valid green
  fingerprint: 0C7C54912FD932BCDF13726A767CE224DB311B3C
  created ...: 1730276976
  expires ...: 0
  validity ..: full
  val.reason : Success
  pubkey algo: 303 (EdDSA)
  digest algo: 10 (SHA512)
  pka address: [none]
  pka trust .: n/a
  other flags:
  notation ..: 'target@metacode.biz'
    flags ...: critical human (0x03)
    value ...: 'node-1'

Just for comparison, if the notation name is not marked as known the output is:

$ tests/run-verify f.sig
Original file name .: [none]
MIME flag ..........: no
Signature ...: 0
  status ....: Bad signature
  summary ...: red
  fingerprint: 767CE224DB311B3C
  created ...: 0
  expires ...: 0
  validity ..: unknown
  val.reason : Bad signature
  pubkey algo: 0 ([none])
  digest algo: 0 ([none])
  pka address: [none]
  pka trust .: n/a
  other flags:

It seems the invocation is done via:

gpgme_set_ctx_flag(ctx, "known-notations", known_notations);

Thanks for implementing this!