Maniphest T8428

Kleopatra: Improve verification feedback of S/MIME signatures for expired certificates
Closed, ResolvedPublic
Actions

Assigned To
• ikloecker
Authored By
timegrid
Mon, Aug 31, 2:59 PM
Tags
Subscribers
• ebo
• ikloecker
pl13
timegrid

Description

This is the current verification feedback of detached and embedded smime signatures with expired certificates:

It should be simliar to the verification feedback for an expired pgp signature:

Logs:

gpgme.log296 KBDownload

Testdata:

ca.pem1 KBDownload

alice-expired.p124 KBDownload

smime.pdf7 KBDownload

smime.pdf.p7s2 KBDownload

Note: To generate new signature files (system time needs to be between the expire date of the user cert and valid from date of the root cert) :

>gpgsm --faked-system-time 1787919771 --default-key alice+expired --detach-sign test.pdf > detached.p7s
gpgsm: WARNING: running with faked system time: 2026-08-28 12:22:51
gpgsm: DBG: adding certificates at level -2
gpgsm: signature created

>gpgsm --status-fd 2 --verify detached.p7s test.pdf
[GNUPG:] NEWSIG
gpgsm: Signature made 2026-08-28 12:22:51 UTC
gpgsm:                using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E
gpgsm: certificate has expired
gpgsm:   (expired at 2026-08-28 12:22:51)
[GNUPG:] EXPKEYSIG F9AAFDC6628657B337097C28486F2CA7E8D37C8E /CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test
[GNUPG:] VALIDSIG F9AAFDC6628657B337097C28486F2CA7E8D37C8E 2026-08-28 20260828T122251 20260828T122251 0 0 1 8 00
gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test"
[GNUPG:] TRUST_FULLY 0 shell

Details

Version
vsd-3.4.0-beta1344 @ win10

Revisions and Commits

rKLEOPATRA Kleopatra
rKLEOPATRA82f6302c5bc1 Don't return "Good signature" for all Green signatures
rKLEOPATRAcf79f5ab6900 Omit verification summary text if no clear summary can be given
rKLEOPATRAa90848eecd93 Use green background only if all signatures are fully valid

Event Timeline

timegrid created this task.Mon, Aug 31, 2:59 PM
timegrid created this object with edit policy "Contributor (Project)".
pl13 added a subscriber: pl13.Mon, Aug 31, 3:35 PM
• ebo triaged this task as Normal priority.Mon, Aug 31, 4:06 PM
• ebo edited projects, added Bug Report; removed Feature Request.
• ikloecker claimed this task.Mon, Aug 31, 5:07 PM
• ikloecker moved this task from Backlog to WIP on the vsd34 board.
• ikloecker added a commit: rKLEOPATRAa90848eecd93: Use green background only if all signatures are fully valid.Mon, Aug 31, 5:08 PM
• ikloecker added a commit: rKLEOPATRAcf79f5ab6900: Omit verification summary text if no clear summary can be given.
• ikloecker added a commit: rKLEOPATRA82f6302c5bc1: Don't return "Good signature" for all Green signatures.
• ikloecker changed the task status from Open to Testing.Tue, Sep 1, 9:45 AM
• ikloecker mentioned this in Unknown Object (Maniphest Task).Mon, Sep 7, 9:46 AM
timegrid closed this task as Resolved.Tue, Sep 8, 2:00 PM

Looks good to me on vsd-3.4.0-beta1356bis, gpg-2.2.56-beta5 @ win10:

Notes:

  • The signature is VS-NfD Compliant is still displayed
  • The data could not be verified is not displayed

Both is fine for now and new tickets should be created, if this should be changed, too.

timegrid moved this task from WIP to vsd-3.4.0 on the vsd34 board.Tue, Sep 8, 2:00 PM
timegrid edited projects, added vsd34 (vsd-3.4.0); removed vsd34.