In Kleopatra we would like to print issuer and serial no. of unknown signing certificates (see T7786: Kleopatra: improvements of signature verification result messages, but gpgsm doesn't emit useful status information although the information seems to be available.
Example (created using an Edward Tester certificate):
$ echo "Sign me!" | gpgsm --sign --armor --include-certs 0 --local-user 0xF6FCE189 -----BEGIN SIGNED MESSAGE----- MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0B BwGggCSABAlTaWduIG1lIQoAAAAAAAAxggLmMIIC4gIBATB+MHgxCzAJBgNVBAYT AkRFMRYwFAYDVQQKEw1nMTAgQ29kZSBHbWJIMRAwDgYDVQQLEwdUZXN0bGFiMR4w HAYDVQQDExVnMTAgQ29kZSBURVNUIENBIDIwMTkxHzAdBgkqhkiG9w0BCQEWEGlu Zm9AZzEwY29kZS5jb20CAhoDMA0GCWCGSAFlAwQCAQUAoIG6MBgGCSqGSIb3DQEJ AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI2MDcyMjEyMjMzMlowLwYJ KoZIhvcNAQkEMSIEIKmQZ0JOVOovrhBksV3YI2d7ilQAdZccUJYySVzZ0+tYME8G CSqGSIb3DQEJDzFCMEAwCwYJYIZIAWUDBAEuMAsGCWCGSAFlAwQBBjALBglghkgB ZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA0GCSqGSIb3DQEBAQUABIIB gJ0L7QAD5cOvgW+qETBWZIUwnyFRwUdQuNMC71X1SCRJdIzRPecr38Tt0i2dGXA2 Y7b6SGy9gOmy+DfqQ7GKPAmDyVqA1+sMOMnsF8CCB3DWdYbOWI18WAoPV49XOdra vVTdXzKgz91WgXjiMUaG8Rrq7kP0F5Yw3LStUKZzO6yOof/YnJQWL9kYo/04m5Lj ZkdwGW1o+WmFUcDO1OIEkxNmHWa/6wDlROT4HqH3ptwhXE9rMj8hA53tc7FlyACQ pqe4U/GSTyoCUmPvdiiKc2SlM7JpiBtujUfIrIGyoPamsYodtQspdEeGzJaoSTwd H9OJAmCRYIUrkAyE9XKediKkN7I7goQ0bbEUPMLCBuYGlaLmi6mjsdkXgBYDCfdl Lp5y93zATlDCNfFtFnpaNsdCiGGRiLQKZOGEfsySa3DSMqXy+CUkv51VVkPf2i9D Qx6gF4XphsJU9W0S+vjSCAFQ6e6zdAKduVLaTRrw29s11uNGdFebcMMPxGlGsNOd jQAAAAAAAA== -----END SIGNED MESSAGE-----
Verify the signature with an empty GNUPGHOME:
$ gpgsm --version gpgsm (GnuPG) 2.5.22-beta17 libgcrypt 1.12.2 libksba 1.8.0 [...] $ GNUPGHOME=$(mktemp -d) gpgsm --verify --status-fd 2 [paste the signed message and press Ctrl+D twice *sic*] [GNUPG:] NEWSIG gpgsm: certificate not found [GNUPG:] ERROR verify.findkey 50331657 [GNUPG:] FAILURE gpgsm-exit 50331649 $ gpg-error 50331657 50331657 = (3, 9) = (GPG_ERR_SOURCE_GPGSM, GPG_ERR_NO_PUBKEY) = (GpgSM, No public key) $ gpg-error 50331649 50331649 = (3, 1) = (GPG_ERR_SOURCE_GPGSM, GPG_ERR_GENERAL) = (GpgSM, General error)
The same with GnuPG 2.2 (different ERROR code and no FAILURE):
$ gpgsm --version gpgsm (GnuPG) 2.2.45-beta27 libgcrypt 1.8.12-beta1 libksba 1.6.7 [...] $ gpgsm --verify --status-fd 2 [paste the signed message and press Ctrl+D twice *sic*] [GNUPG:] NEWSIG gpgsm: failed to find the certificate: Not found [GNUPG:] ERROR verify.findkey 50331675 $ gpg-error 50331675 50331675 = (3, 27) = (GPG_ERR_SOURCE_GPGSM, GPG_ERR_NOT_FOUND) = (GpgSM, Not found)
Interestingly the audit log (verify the signed message with Kleopatra's notepad) contains:
* Signature 0 No certificate * (#1A03/1.2.840.113549.1.9.1=#696E666F40673130636F64652E636F6D,CN=g10 Code TEST CA 2019,OU=Testlab,O=g10 Code GmbH,C=DE)
i.e. the signature seems to contain information about the issuer and the signing certificate's serial no.
Would be nice if gpgsm emitted this information as status information. Since S/MIME signatures in general include the signing certificate this is probably low priority.