Mmh no. This needs to go into the resolver. If autoresolve is disabled we also want to have that functionality. Having the ca config in libkleo would also help to use the same values in Kleopatra for a CSR.

This should resolve it.

Well there is nothing specially pythonic about it, it just includes the dirs and not the files:

Argh, that Python specific stuff Ben used is weird and does not fit into the autotools model. Someone(tm) need to have a closer look at it.

The digest algorithm used is computed based on the preferences in the key if encryption is also used. Thus this should always work and any decent key has sha256 in its preferences. In case sha1 has a higher precedence, as seen on old keys, --personal-digest-preferences can be used to prefer sha256. However, it is way better to fix the key. The easisies way to do that is to change the expiration date - then the new standard preferences will be used.

Merged. Thanks again for your work on this.

Thanks for the explanation. That addresses my concerns.

I agree that this is a minor API shift, but i *don't* think it's a security problem, because i was particularly careful to maintain the invariant that decrypt(verify=True) will only ever return valid signatures.

Thanks for the prompt action here. Some build environments (e.g. distro builds) might ask for additional compiler warnings in the user-supplied CFLAGS, but i suppose those build environments that enable the warnings deserve what they get.

That makes sense to me. So I've now moved the -Wno flags out of the maintainer mode conditional but left the parts adding warnings in the maintainer mode conditional.

Good to hear this request from someone else, this gives it more priority :-).

The thing is that that I accidentally added the -Wno-* flags only in maintainer-mode as they were -Wmore-strict-warning-flags. One reason for using more strict warnings in maintainer mode is to allow building with older gcc versions without having to test for the availability of the warning flags.

Thanks for the report. This is annoying me, too when doing release builds.

I'm for merging this as I understand the rationale. In Kleo / GpgOL I also only need one valid signature.

I've just published a branch dkg/fix-T4276 (with commit 4100794e305ba22241ea5a4f7b42bb5189fbd948) which i think resolves this issue.

Fixing this is technically an API change, but i can find no evidence that this has ever been used by any consumer of the gpg module. (e.g. i searched in debian and on the public web)

This is obviously correct. Why has it not been merged?

Users keep showing up in our support, confused by this inconsistency. This problem continues in 2020. What's holding this back?

@JW-D Sorry but that is a Wontfix. We had a similar task: T4115

On think should be mentioned. Both accounts are IMAP, but the Posteo account has one particular feature. All inbound traffic from their server to my client (receiving e-mails) is encrypted with my own public S/MIME certificate (they call it "Eingangsverschlüsselung") so all non-encrypted e-mail will be treated between Posteo server and my client as S/MIME end-to -end encrypted e-mails. This is not the case with the t-online account (there it is just TLS encrypted). However, I believe a PGP signature verification should happen after S/MIME decryption on the client.

Ah! I see it now. I've looked at the screenshots again and noticed that Enigmail writes for the posteo message. "Part of the messaage is signed" and shows it as encrypted, while for t-online it is the full message that is signed and not encrypted.

This account is IMAP, nothing special, I´ll send a screenshot from the add-ins by e-mail.

Well, I deinstalled gpg 3.1.7 and reinstalled it. For some reason my two gnupg smart cards work fine, but my two Yubikeys cannot be detected anymore (no such device). But in the last weeks, they were deteced, only the switching between Yubikey and Smart Card made some trouble. That they cannot be recognized is new and makes real trouble. If you think it would maybe helpful, I can submit a scdaemon.log file by e-mail.

According to the log GpgOL is not notified by Outlook that a mail is read. So it does nothing.

The debug file will be sent by e-mail to you immediately. THANKS