In Kleopatra we wanted to print the creation time also for bad signatures (see T7786: Kleopatra: improvements of signature verification result messages), but gpg/gpgsm only emit the creation time of a signature with VALIDSIG and with ERRSIG.
gpg does print the creation time also for bad signatures:
gpg: Signature made Mi 22 Jul 2026 16:33:47 CEST gpg: using EDDSA key 117C22E18017CB18A67FC3D699954415471E4A5F gpg: BAD signature from "Second UID <uid_b@example.net>" [ultimate]
I tested with GnuPG master (2.5.21) and 2-2-branch (2.2.54).
gpgsm prints the signature time also for bad signatures:
$ gpgsm --verify test.txt.p7s test.txt gpgsm: Signature made 2026-07-28 07:07:06 UTC gpgsm: using rsa3072 key 08707A434BCB4935A57A1997C9FFC4B265FC73C6 gpgsm: invalid signature: Bad signature
Well, I think that Ingo wants a status output so that gpgme can get this information.
Yes, sorry. I guess I should have also mentioned the status lines that gpg emits.
[GNUPG:] NEWSIG gpg: Signature made Mi 22 Jul 2026 16:33:47 CEST gpg: using EDDSA key 117C22E18017CB18A67FC3D699954415471E4A5F [GNUPG:] KEY_CONSIDERED 117C22E18017CB18A67FC3D699954415471E4A5F 0 [GNUPG:] BADSIG 99954415471E4A5F Second UID <uid_b@example.net> gpg: BAD signature from "Second UID <uid_b@example.net>" [ultimate] [GNUPG:] FAILURE gpg-exit 33554433
-> BADSIG only mentions the key ID and the user ID.
Unfortunately, we cannot simply add the timestamp to BADSIG because user IDs don't have a specific format.
Looks good:
$ gpgsm --verify --status-fd 2 sign-me.txt.p7s sign-me-tampered.txt gpgsm: NOTE: THIS IS A DEVELOPMENT VERSION! gpgsm: It is only intended for test purposes and should NOT be gpgsm: used in a production environment or with production keys! [GNUPG:] NEWSIG gpgsm: Signature made 2024-01-08 08:52:54 UTC gpgsm: using rsa3072 key 8B25A820C8FDF67E3ACACFF710959DB1F6FCE189 gpgsm: invalid signature: message digest attribute does not match computed one [GNUPG:] BADSIG 8B25A820C8FDF67E3ACACFF710959DB1F6FCE189 /CN=Edward.Tester/OU=Testlab/O=g10 Code GmbH/C=DE [GNUPG:] SIGINFO 20240108T085254 [GNUPG:] FAILURE gpgsm-exit 50331649
and
$ gpg --verify --status-fd 2 sign-me.txt.sig sign-me-tampered.txt gpg: NOTE: THIS IS A DEVELOPMENT VERSION! gpg: It is only intended for test purposes and should NOT be gpg: used in a production environment or with production keys! [GNUPG:] NEWSIG gpg: Signature made Di 05 Dez 2023 16:37:06 CET gpg: using RSA key 8EB9CBACA389D28CAA3CA15C1F5C8972CE8BFED7 [GNUPG:] KEY_CONSIDERED 8EB9CBACA389D28CAA3CA15C1F5C8972CE8BFED7 0 [GNUPG:] BADSIG 1F5C8972CE8BFED7 edward.tester@demo.gnupg.com [GNUPG:] SIGINFO 20231205T153706 gpg: BAD signature from "edward.tester@demo.gnupg.com" [ultimate] [GNUPG:] FAILURE gpg-exit 33554433
Setting to resolved. This will implicitly be tested in combination with Kleopatra with T7786: Kleopatra: improvements of signature verification result messages.