Page MenuHome GnuPG
Create Task
Maniphest T5371

Handle invalid compliance settings
Closed, ResolvedPublic
Actions

Description

As we talked about:

In Kleopatra it would be good to figure out if there is a conflict in compliance settings. E.g. the user wants to use the de-vs mode with a non compliant libgcrypt. In that case we should be able to detect that through gpgconf instead of having all operations fail with "Forbidden".

That way we can open a Message box and inform the user that the requested operation mode is in conflict.

When done in GnuPG please assign this back to me that I can write the Kleopatra side. I am thinking of showing a warning like:

"This version $VERSION cannot be operated in the requested compliance mode $compliance.
Most operations will fail with the error "Forbidden" unless you change the compliance mode through the
GnuPG System configuration.

If you have questions regarding the compliance of $VERSION please contact mailto://info@gnupg.com"

Details

Version
master

Related Objects

Event Timeline

• aheinecke created this task.Mar 29 2021, 12:28 PM
• werner added a comment.Apr 6 2021, 9:25 AM

with the next GnuPG version (2.2.28 and 2.3.0) you can do a read

$ gpgconf --list-options gpg | grep ^compliance_de_vs
compliance_de_vs:146:3::1:1::0::

to check whether gnupg is prepared for compliance de-vs and using a suitable libgcrypt. This does not indicate that the selected algorithm is compliant because there are many ways to override this. You need to look closer at GPG_ERR_FORBIDDEN in this case.

Do you need more status message similar to

ERROR random-compliance XXX
• werner reassigned this task from • werner to • aheinecke.Apr 15 2021, 9:02 AM
• werner triaged this task as High priority.
• werner added a subscriber: • werner.
• werner added projects: Restricted Project, Feature Request.Aug 1 2022, 3:15 PM

Has this been implemented?

• ikloecker added a subscriber: • ikloecker.Aug 1 2022, 4:09 PM

I think this was mostly covered with T5362: Kleopatra: Add warning in compliance mode if gnupg version is not compliant and T5653: de-vs and GnuPG 2.3.3 error.

• aheinecke closed this task as Resolved.Aug 2 2022, 9:03 AM

Agreed

• ebo moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.Jul 24 2023, 2:12 PM