Page MenuHome GnuPG

gpgsm: No error/warning on verification or decryption in case of trusted but not VS-compliant certificate
Open, Needs TriagePublic

Description

For replicating this you need a valid but not VS-compliant S/MIME certificate. (The corresponding Root CA is trusted but it is noch VS-compliant, this is the case if GpgsmCompatibility is not set and the Root CA is missing the de-vs flag.)

Encrypting and signing works for such a certificate as expected, encryption and signing is marked as "not VS-NfD compliant".
But on decryption and verification Kleopatra (and GpgOL) both inform that the action was VS-compliant:

Kleopatra and GpgOL get the false information by the gpgme function decryptionResult.isDeVs() which in turn gets the info from gpgsm.
And Gpgsm on the Command line seems not to know about the non-compliance:

C:\Users\g10code.WIN-TEST3\Documents>gpgsm --status-fd 2 --verify test.txt.p7s test.txt
[GNUPG:] NEWSIG
gpgsm: Signatur erzeugt am 2026-03-24 11:10:12 UTC
gpgsm:                mittels rsa3072-Schlüssel A8363E8C52A262B04E8B2FC772A2E3036291C878
[GNUPG:] VERIFICATION_COMPLIANCE_MODE 23
[GNUPG:] GOODSIG A8363E8C52A262B04E8B2FC772A2E3036291C878 /CN=Berta Boss/OU=demo/O=g10 Code GmbH/C=DE
[GNUPG:] VALIDSIG A8363E8C52A262B04E8B2FC772A2E3036291C878 2026-03-24 20260324T111012 20630405T170000 0 0 1 8 00
gpgsm: Korrekte Signatur von "/CN=Berta Boss/OU=demo/O=g10 Code GmbH/C=DE"
gpgsm:                 alias "berta.boss@demo.gnupg.com"
[GNUPG:] TRUST_FULLY 0 shell

Details

Version
VSD 3.3.6.1