So, I smashed this all together. The icon subset and the cross compile patch, and my time for first startup was 5 seconds then once with procmon enabled 7 seconds and now with a reduced set of icons I am down to Kleopatra to 1.7seconds. The icon subset is just 1.4mb. With all the icons we would have installed for Okular and Kleopatra. I don't have enough time to clean this up today to push it but this looks very good.
Although I am thinking to add a way to kicontheme maybe as a global variable to provide the name for the resource file so that we can properly switch between breeze-dark and breeze.

In T6702#176858, @aheinecke wrote:

We should probably also check KMail though. There might be a similar fix needed although there I am unsure if the old keyresolver does not do a crl check when a certificate is selected.

Fixed.

The error message in Kleo is now (with VS-Desktop-3.1.90.246-Beta) "Broken pipe". But in the linked error protocol you can find the gpg error message "no space left on device". So I would find this message acceptable.

As what I see is similar as what Andre saw, I'll describe it here. Please check if this is relevant.
After the above mentioned Ticket was resolved, I tried the exact same encryption in Kleopatra on the same Test-VM.

Ok. Both notepad and file encryption now again produce errors as expected. So the new override would just be a new feature and no longer a regression.

And yes in gpgsm.conf both the extensions are also marked with ignore-cert-extension.

While remembering this I added to our standard.conf (and for testing first to my local conf):

The issue should be fixed, i.e.

• groups containing only encryption-capable certificates (i.e. they have an encryption subkey) are expanded
• certificates which cannot be used for encryption because they (or just the encryption subkeys) are revoked or expired or otherwise invalid are marked with the error marker
• the OK button is disabled if any invalid encryption certificate is selected

works!

For testing with file encryption and notepad you can use this chain which is valid but does not provide a valid CRL for us

We just realized that similar to what we had in GpgOL ( https://dev.gnupg.org/T6701 ) that AlwaysTrust is used by default. And this will now result in the behavior which I also mentioned in our meeting that without question it encrypts to any S/MIME certificate. Without any warning that it is not VS-NfD compliant to do so.
This must be fixed because otherwise we show an operation as VS-NfD compliant, e.g. to encrypt to a certificate with a broken CRL. Which is not VS-NfD compliant because the CRL check was not done.

Since I tested this both with valid and invalid filenames on linux and on windows I set this to resolved.

The URL was just wrong for Windows. I added debug output and the results are different:

Yes and I get the same result with PNG files. But calling shell execute with such an url looks strange to me, I will try QUrl::fromLocalFile as we use in Kleopatra.

Is executing a zip file really supposed to work on Windows?

Moving the definition and changing it to the name of the po file worked.

Pretty sure its the translation domain. Thanks! Will try to fix that tomorrow

Or is it an order problem in src/CMakeLists.txt?

add_subdirectory(core)
add_definitions(-DTRANSLATION_DOMAIN=\"libmimetreeparser5\")

Other possible reason: https://api.kde.org/frameworks/ki18n/html/prg_guide.html#before_qapp
Are the action texts initialized statically?

I'm wondering whether this could be caused by a wrong translation domain. We have mimetreeparser.{pot,po,mo}, but in src/CMakeLists.txt we have

add_definitions(-DTRANSLATION_DOMAIN=\"libmimetreeparser5\")

Our own internal function signatures is not necessarily a good refernce. The main objection to all what you list above is the lack of explicit length information. For each uint8_t* there should also be a size_t ...len in my opinion. Otherwise the API will be highly prone to memory access errors.

@fse Thank you for your comment (quick ! :-).