Let us drop the option to select the ADSK and instead take them from the gpg.conf configured ADSK for new keys. Thus a simple dialog with a confirmation will be sufficient. We add some magic to gpgme to allow this with the adsk API. This solves the use-case to add ADSK to alread-existsing keys in the same way as they are added to new keys.

Makes sense. Then default-new-key-adsk needs to be exported by gpgconf, so that gpgme/Kleopatra can use/show it.

Noticed when looking at the MR that there seems to be no error handling for the case that no ADSK is configured (or something is wrong with the configuration). At least I did not see any strings informing the user about an error.

Of course it would be much better to not display the "Add ADSK" action if there is no ADSK configured.
But Ingo said that Kleopatra does not know this, as gpgconf --list-options gpg does not provide this info.

Would it be possible to add this?
In that case we would only need to cover errors if the ADSK was not configured correctly (I assume gpg would return an appropriate error for this) or the configured certificate is not available. And we would not have to explain the action in more depth.

The version check can now be extended to 2.2.45 <= gpg < 2.3.0.

done: https://invent.kde.org/pim/kleopatra/-/merge_requests/285

Backported for VSD 3.3

Tested with 4win-beta-64. In the subkey tab of the details of a secret key there is now an option "Add ADSK" in the burgher menu, iff the option default-new-key-adsk is set.

Choosing this action you get first a warning window, then
-> with a correctly set "default-new-key-adsk" -> works:

But I then changed the config back again to the original correct setting and tried this with another key:
-> Error message…

Cli: gpg> addadsk
Geben Sie den Fingerprint des ADSK an: CC5274CB8072E9778DADD15BCD573B2B0736643A
gpg: Schlüssel "CC5274CB8072E9778DADD15BCD573B2B0736643A!" nicht gefunden: Unbrauchbarer öffentlicher Schlüssel
gpg: Haben Sie den Fingerprint des Unterschlüssels angegeben?
Geben Sie den Fingerprint des ADSK an:

--> this is caused by gpg and will be fixed in the next Testbuild after Beta-70

It works in Gpg4win-Beta-75 to add the ADSK to more than one Key.

But if you want to add the ADSK subkey to the key where it is a normal subkey or which has that ADSK already: you get a success message, but no subkey is added.

I would expect an error message instead, as adding the same key twice will not work (and makes no sense anyway).
Maybe "Failed to add ADSK, this subkey already exists."

On the Cli, gpg does not give an error but an info message informing that the subkey already exists so there is no error message for Kleopatra to act on.

As the incorrect success message "ADSK added successfully." given by Kleopatra is not seriously wrong, we decided to leave it for now.