Page MenuHome GnuPG

Kleopatra / gnupg: Certifier name missing when certifier's certificate is expired
Open, LowPublic

Description

In Kleopatra's list of certifications for a certificate, the name column is empty if the certifier's certificate has expired. This goes back to gpg --with-colons --check-sigs not printing the user id when the key is expired (or otherwise unusable).

Looking at the gnupg code, this seems to be on purpose (is that correct?)

Having the name shown here would be useful to an end-user, since it would make it trivial to figure out for which person they need to get a new/extended certificate.

Event Timeline

ebo added a project: Restricted Project.Jul 11 2024, 1:53 PM
aheinecke added a subscriber: aheinecke.

Wouldn't this usecase be better solved if we could highlight trusted-keys in the keylist better? I mean not trusted-keys as in "this key has full trust" but this key is one of 1-10 (In real life the most we saw was 5) which is configured as a TrustedKey

TrustedKey1
The value specifies a fixed trust root (trusted-key). If more than one trust root is required, the entries TrustedKey2, TrustedKey3, TrustedKey4, TrustedKey5 may also be used. Take care to specify the 40 hex-digit fingerprint of those trusted keys.

That way we would not need modifications to GnuPG. Also the "trusted-key holder" for an organization might have changed in the meantime?

But anyway I wonder if this is really something we should try to address in Kleopatra since it is more of a Workflow thing. One of our initial ideas with the Branded Packages was to add "customized documentation" in these packages, too.

@TobiasFella: This is on purpose: The key might be expired because the user does not have the primary address anymore and thus it makes no sense to show the name. Anyway the listing of the name is more a convenience thing and it might be better if the frontend takes it from its own cache. But it is pretty old code and things and ideas may have changed meanwhile.

In the old days the keyid of the fingerprint could be used to refresh the key from a keyserver, but nowadays having a mail address might indeed be better to do a WKD lookup.

Andre's idea of adding a flag for trusted keys sounds good as well. This goes into the direction of a more flexible sorting/filter feature in Kleo.