I recommend, when making a User ID with only an e-mail address, to populate the User IDs by wrapping it in an angle bracket, rather than just leaving the raw e-mail address. It's not just the regexp matcher -- there are other pieces of OpenPGP software that won't recognize a raw e-mail address in a user ID as an e-mail address. It also makes it easy to distinguish such a User ID from a User ID that is not at all an e-mail address.

If you look at C29F8A0C01F35E34D816AA5CE092EB3A5CA10DBA you can see my user IDs that have only an e-mail address are wrapped in angle brackets.

This doesn't solve your problem with the regexp, of course, but it does indicate that it's a bad idea to form user IDs that contain an e-mail address without putting the e-mail address in angle brackets, even though a reasonably concise description of actual, real-world User ID conventions does acknowledge that this is a common pattern.

It will be hard to fix this. GnuPG supports exactly one class of regular expressions: something bracketed between "<[^>]+[@.]" and ">$" . Even if the next release of gpg supports more regular expressions, gpg will have to wait years before it can start emitting different regular expressions for scoped tsigs by default.

We already detect mail addresses for different purposes and thus it will be easy to enclose them in angle brackets just for comparision.. Almost all trust signatures out there are created by gpg and used to restrict the mail domain. No need for different regexp. See also the comments in the code related to the history.

@werner i'm not sure i understand what "easy to enclose them in angle brackets just for comparison" means.

Currently, with gpg --gen-key in v2.2.40, if the user provides an empty "Real name" and an e-mail address, the emitted User ID is just a raw e-mail address, no angle brackets.

Are you saying that GnuPG will change how such an "e-mail only" User ID will be generated (if the user only provides an e-mail address and no full name), so that it *will* be wrapped in angle brackets?

Or are you saying that when considering whether to rely on a regex-scoped tsig in considering a certification over UID X for the purposes of calculating validity, GnuPG will examine the UTF-8 contents of UID X and potentially prepare an alternate UTF-8 string X' for matching against the tsig's regex?

Or both? or something else?

The latter. Detecting mail addresses with regexp is anyway a kludge and we have more stringent code to detect mail addresses in a user-id.

Fixed for master but not yet tested.