Page MenuHome GnuPG

Kleopatra: Signing with expired signing subkey shouldn't be possible
Closed, ResolvedPublic

Description

Trying to sign with an expired signing subkey shouldn't be possible because it anyway fails with "Unusable secret key".

This is similar to T6742 except that it's about a single certificate and about signing.

Reproduce:

  • You need a valid certificate with certify-only primary (sub)key and expired signing subkey. (Hint: Use gpg --edit-key to add the signing subkey and specify seconds=5 as expiration to add an expired signing subkey.)
  • Set the fingerprint of this certificate as [SignEncryptKeys] SigningKey in kleopatrarc.
  • Start Kleopatra, open the notepad, and select the Recipients tab.
  • Uncheck "Encrypt for me". (This isn't really necessary but it avoids unrelated complications.)

Expected:

  • The signing certificate is marked with the error icon (red icon with X).
  • The Sign Notepad button is disabled.

Actual:

  • The signing certificate is marked with the green "all good" icon. -> Not OK
  • A message below the signing certificate reads "This certificate is expired." -> OK
  • The Sign Notepad button is enabled. -> Not OK
  • Trying to sign fails with Unusable secret key -> OK (but the user should be spared this error)

Event Timeline

ikloecker triaged this task as Normal priority.
ikloecker created this task.
ikloecker moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.
ikloecker changed the task status from Open to Testing.Nov 2 2023, 2:11 PM
ikloecker removed ikloecker as the assignee of this task.

Fixed for Sign/Encrypt Files/Folders and Sign/Encrypt notepad.

  • An invalid signing certificate is now marked with the red error icon.
  • The Sign/Encrypt button is disabled if an invalid signing certificate has been selected.
  • Also works for valid certificates with invalid signing subkeys.
ikloecker mentioned this in Unknown Object (Event).Nov 6 2023, 9:33 AM
aheinecke added a subscriber: aheinecke.

Since this is a bugfix and it was related to 6742 with some commits having overlap i decided to also pick this for the 32 release branch.

ebo claimed this task.
ebo moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.
ebo added a subscriber: ebo.

works as advertised, VS-Desktop-3.1.90.277-Beta

ebo edited projects, added vsd32 (vsd-3.2.0); removed vsd32.