Maniphest T8294

Okular: "Untrusted" or "not certified" certificates are shown as trusted
Testing, HighPublic
Actions

Assigned To
None
Authored By
• ebo
Jun 12 2026, 3:35 PM
Tags
Subscribers
• ebo
svuorela
timegrid

Description

It seems S/MIME Certificates whose Root -CA was set explicitly to "untrusted" are shown as "trusted" in Okular.
Not certified OpenPGP certificates are shown as "trusted", too.
The screenshot shows an S/MIME certificate where the root CA has no trust:

Obviously, the text has to be "not trusted". Same for OpenPGP certificates which are not certified by oneself or another trusted key.

I believe we should also highlight this, as this is very important information and it is hidden in a dropdown view.

Details

Version
4win 5.0.2

Event Timeline

• ebo created this task.Jun 12 2026, 3:35 PM
• ebo added a comment.Jun 12 2026, 4:10 PM

To make matters more confusing: For the same test PDFs I get "The signature could not be verified" and "certificate has not yet been verified" on Linux with the vsd 3.3.7 Appimage…

• ebo mentioned this in Unknown Object (Maniphest Task).Jun 15 2026, 10:24 AM
• ebo renamed this task from Okular: All certificates are shown as trusted to Okular: "Untrusted" or "not certified" certificates are shown as trusted.Jun 15 2026, 11:28 AM
• ebo updated the task description. (Show Details)
svuorela added a comment.EditedJun 19 2026, 10:00 AM

https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2274 and https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2277

• ebo triaged this task as High priority.Jun 19 2026, 1:40 PM
• ebo moved this task from Backlog to WIP on the gpd5x board.
svuorela mentioned this in Unknown Object (Maniphest Task).Jun 22 2026, 6:12 AM
• ebo changed the task status from Open to Testing.Jun 24 2026, 4:07 PM

Was merged in poppler on 2026-06-22

svuorela moved this task from WIP to QA on the gpd5x board.Tue, Jul 7, 3:15 PM
timegrid added a subscriber: timegrid.Wed, Jul 8, 1:01 PM

Looks good to me on gpg4win-5.1.0-beta653 @ win11:

timegrid added a comment.Wed, Jul 8, 1:27 PM

*Still open*

  • This needs to be tested on vsd-3.3.7 @ win. If the behavior is the same, this might need to be backported.
timegrid moved this task from QA to gpd-5.1.0 on the gpd5x board.Wed, Jul 8, 1:27 PM
timegrid edited projects, added gpd5x (gpd-5.1.0); removed gpd5x.