On large keyrings with a lot of X.509 certificates the validated key listing is not very fast. It scan's the keyrings far too often. With a certain 37 MiB keyring having about 1200 PGP and 900 X.509 certificates a
gpgsm --disable-dirmngr --with-validation -k >/dev/null
takes about 11 seconds on a i7-1370P and a fast NVME.
| rG GnuPG | |||
| rG9087c1d3637c gpgsm: Implement a cache for the KEYINFO queries. | |||
| rG09d4b8f496dd gpgsm: Use a cache for ISTRUSTED queries. | |||
| rG241971fac0fc gpgsm: Implement a cache for the KEYINFO queries. | |||
| rGef2be95258d2 gpgsm: Use a cache for ISTRUSTED queries. | |||
| rGdcee2db36ba4 gpgsm: Use a cache to speed up parent certificate lookup. | |||
| rGce0580a599ec gpgsm: Use a cache to speed up parent certificate lookup. | |||
| rG9543b3567b04 sm: Optmize clearing of the ephemeral flag. | |||
| rGcb6c506e4e41 sm: Optmize clearing of the ephemeral flag. | |||
Now we are at 4 seconds. Available in master and 2.2.
Note that when using --list-chain instead of k, we actually cache all certificates. This could be improved by modifying the walk_chain function to take an depth arg.
Overall effect of these changes tested on a small Windows VM is only 47 -> 26 seconds. Did also tests with --kbx-buffer-size but that does not make it better than the default, either.
Test on a dedicated Windows box (T 460, i5-6300U@2.40GHz, harddisk):
| VSD Version | gpg version | Load time |
| 3.1.26 | 2.2.41 | 1:59 |
| 3.2.4 beta-2 | 2.2.45 beta 25 | 0:46 |
Load time from the start of the Kleopatra progressbar until the cert list is shown.