While looking into T7790: Kleopatra: "no trusted certification" should have precedence over "expired" in signature verification I noticed that Kleopatra reports good signatures as "invalid" if the signing key is expired or revoked. I don't think that this is done intentionally. gpg reports such signatures as good signatures. See T7790#210769 (for output of gpg) and T7790#211521 (for screenshots of Kleopatra).
Description
Description
Revisions and Commits
Revisions and Commits
| rLIBKLEO Libkleo | |||
| rLIBKLEO5068e461be73 Adapt test to new signature verification texts | |||
| rLIBKLEO9b09f94aed6e Fix and improve handling of good but not fully valid signatures | |||
| rKLEOPATRA Kleopatra | |||
| rKLEOPATRAe93084728e80 Don't show green result for expired signatures | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Open | None | T8095 Kleopatra: parent ticket for improvements of verification result messages | ||
| Testing | • ikloecker | T8035 Kleopatra: Good signatures are reported as invalid signatures if key is expired or revoked |
Event Timeline
Comment Actions
Fixed. Some examples for the improved texts which are based on the texts that gpg prints.
- good signature with expired key
- good signature with revoked key
- good signature with uncertified key
- expired signature with certified key
- expired signature with uncertified key
Hint: Create expired signatures with gpg --default-sig-expire seconds=5 --detach-sign ...
This ticket is mostly about fixing the problem that good signatures were reported as invalid. Unless there are actual errors in the new texts there's T7786: Draft: Kleopatra: improvements of signature verification result messages for improving the messages.
Comment Actions
For "expired signature with certified key" I believe green with check mark is a too positive. Should be a warning, too.
Comment Actions
At least for an expired data signature I would suggest to have an info button to further expliah this. Maybe to a FAQ or KB article. The case is too rare that we should not discuss endlessly the pros and cons of expiring signatures. I hope that Kleo does not provide an option to crerate such a signature.
Comment Actions
Looks good to me on gpg4win-5.0.2-beta2 @ win11.
- good signature with expired key
- good signature with revoked key
- good signature with uncertified key
- expired signature with certified key
- expired signature with uncertified key
