Looks good to me on gpg4win-5.1.0-beta658 @ win11:

In case it matters, those are the files i used above (signed by ted, created via kleopatra)

Without keyboxd, in both versions gpg4win-5.0.2 @ win11 and gpg4win-5.1.0-beta658 / gpg 2.5.21 @ win11, the import works (without the autoimport issue on search).

In T8347#220668, @werner wrote:

Which gnupg version is used by the gpg4win-5.1.0-beta658 Build. Please always mention the gnupg version if you use a gnupg26 tag.

Debugview output for gpg4win-5.0.2 (with auto import bug):

Which gnupg version is used by the gpg4win-5.1.0-beta658 Build. Please always mention the gnupg version if you use a gnupg26 tag.

Issue found on gpg4win-5.1.0-beta658 @ win11:

In short, it looks like the icon change was only applied to separate mail windows, not to mails in the preview pane

We explicitly don't want potentially disastrous low-level card operations like a factory reset to be possible from within Kleopatra.

Instead of disallowing the creation of S/MIME signed archives Kleopatra disallows problematic combinations of the creation of signed and encrypted archives. Reasoning: If one tries to create an OpenPGP-signed and S/MIME-only encrypted archive then one also ends up with an opaquely signed unencrypted archive.

But I wonder anyway if we could a) sometime in the future implement a heuristic to insert a break before an error message if there is not enough space for it or b) only give the filename in these kinds of messages. The path is not important in this case, at least. I'm not sure if the path is important in other cases, too, though.

yes, it is not worth the bother to test it

Allright, set to Wontfix.

@ebo already tested this and the automatic import seems to suppress the import certificate dialog.
All other cases are fine, I'm quite sure the smartcard case would also work as intended.
I'll consider this resolved.

I don't expect it, but it should still be decided, if (some of) the changes should be backported, so I'll leave this issue open.

Summary of this ticket

I suggest to close this ticket. There will always be situations where the layout is suboptimal.

I don't think that Kleopatra can influence that gpg/gpgsm/gpg-agent shows a second pinentry if on the first try a wrong passphrase was entered. Therefore I think the "retry" has to be implemented in GnuPG.

In T7446#220582, @ebo wrote:

When are the "Detailed results of import from smart card" supposed to occur?

@ikloecker I guess, this issue is not specific to smartcard errors?

In T8344#220548, @werner wrote:

Restoring an encryption subkey is now easy if you have an sk_KEYID.gpg backup:

1. Get a fresh card or factory-reset a card.
2. gpg --card-edit, then "admin", then "generate primary"
3. gpg --edit-key NEWKEYID, use "bkuptocard sk_KEYID.gpg"
4. Optionally use gpg --edit-key to add a new authentication (ssh) key to the card.

• text displayed on import from smart card:

Restoring an encryption subkey is now easy if you have an sk_KEYID.gpg backup:

Please see the rGf103eaee63f702278824967365de16b9757ecc83 for detailed comment on the (solved) problem.

In T6425#220542, @ikloecker wrote:

That this error has the blocking of the card as side effect is not the reason for the failure.

In T6425#220540, @timegrid wrote:

In T6425#220532, @gniibe wrote:

It could be changed like: scdaemon also checks after "Bad Pin" and inform a user when it is blocked.

From user perspective it would be best to know, that a device is blocked the moment it happens, because it requires (preferably immediate) user action to resolve the situation. If a user happens to stop after the 3rd try, it will break the next workflow, which could be a critical situation, and the error might not be associated with the cause, if enough time has passed.

If there's no objection to give direct feedback about the blockage, it would be nice, if you could try to implement it.

In T6425#220532, @gniibe wrote:

It could be changed like: scdaemon also checks after "Bad Pin" and inform a user when it is blocked.

Thank you for testing.

Issues found

1. Signing
   • Pinentry is still not handling bad pins (no retry possible, "Bad PIN" feedback shown in Kleopatra)
   • The bad pin error looks still a bit misformatted (error message is displayed inline):
     
   • The 3rd try, which triggers the block, will still result in "Bad PIN", not in "PIN blocked" (4th try will display "PIN blocked")
     
2. Change PIN: -
3. Unblock Card
   • On wrong PUK one still needs to enter 2 x new PINs, before the error is shown:
     
     
     
     
4. No attempts left (PIN: 0, PUK: 0, Admin PIN: 0)
   • All options but "Generate New Keys" could be disabled

test with gpg4win-5.1.0-beta658 and gpgol-2.7.3-beta11_dd853c7.dll on WIN 10

Note that all highlighting (i.e. grey background) of the icon in the following screenshots is due to opening the settings, before i did that, they were not highlighted if it was not sign+encrypt chosen but only one of them.