In T6117#205277, @timegrid wrote:

Notes (probably as intended):

• [$i]mmutable does not work for CN or EMAIL

In T6117#205277, @timegrid wrote:

• All fields (signing only, rsa4096)

Certificate Request:

[...]

X509v3 Key Usage: critical
    Key Encipherment, Data Encipherment

Updated the task description after talking with @ikloecker

In T7758#205218, @timegrid wrote:

Note: If i set an invalid path in "Software\\GnuPG:Install Directory"

• the gpgconf -X output does not change
• the self-test Config File 'libkleopatrarc' fails with Error in archive definition tar: 'pack-command-openpgp' empty or not found

In T7758#205217, @timegrid wrote:

This probably can only be tested with signed releases?

I don't see how this could happen unless you have canceled an export. In this case Kleopatra saved an empty path as last location and then on the next export Kleopatra proposed Documents. The latest changes prevent Kleopatra from saving an empty path as last location and they ensure that Kleopatra immediately writes [Export]LastDirectory to disk.

Sorry, I just found out, that windows caps the filename earlier than max length, so my former tests were invalid.

All mails touched by gpgol should already have a GPGOL_UID_DASL. So to replicate:

1. Send a new encrypted mail (e.g. Edward -> Ted)
2. Don't open that mail, but open the context menu: Move -> Other Folder ...
3. Select a subfolder of INBOX and click OK -> the mail is not moved

fix tested and confirmed with GnuPG 2.5.12 on windows 10

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Still the same behavior as described in https://dev.gnupg.org/T7240#202915 on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

Note: If i set an invalid path in "Software\\GnuPG:Install Directory"

• the gpgconf -X output does not change
• the self-test Config File 'libkleopatrarc' fails with Error in archive definition tar: 'pack-command-openpgp' empty or not found

This probably can only be tested with signed releases?

Current state in gpg4win-5.0.0-beta369 @ win10:

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

Notepad  window
Text to process  edit  Either enter a text you want to sign or encrypt, or an encrypted or signed text you want to decrypt or verify. You can also enter certificates in text form to import them.  blank
t
e
s
t
Signing and encrypting notepad...
Successfully encrypted and signed the notepad

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10 (no lines omitted or duplicate readings):

pinentry-qt  dialog  Enter passphrase
Passphrase:  edit  protected  blank
[...]
does not match - try again  dialog
OK  button  Enter

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

PGP
GPG
P7M
P7S

Tested on gpg4win-5.0.0-beta369 @ win10.

Current state in gpg4win-5.0.0-beta369 @ win10:

Looks good to me on gpg4win-5.0.0-beta369 @ win10.
Can't reproduce it anymore, message is S/MIME decrypted instantly:

Looks good to me on gpg4win-5.0.0-beta369 @ win10: The dialog with the progress bar is showing up instantly now.

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

Uses gpgme-2.0.0 with the above mentioned patches. I have seen no problems in my quick tests.

Key Approval dialog used by GpgOL (VSD only) looks good to me on gpg4win-5.0.0-beta357, Outlook LTSC Standard 2024 @ win10 (compliance mode):

How to test this? The follwing happens for an attachment of an encrypted mail on gpg4win-5.0.0-beta357, Outlook LTSC Standard 2024 @ win10:

Moving an encrypted message on Gpg4win-5.0.0-beta357, Outlook LTSC Standard 2024 @ win10 into an inbox subfolder of Ted.Tester and back works for me, too. Does this confirm, that it's working now?

i've included logfiles for gpg-agent and scdaemon with debug-level 10. the files include

Notes for testing (and maybe documentation update):

• A few features (?) of the old CSR creation have been removed:
  • The different choices offered after CSR creation (e.g. save to file, send to CA, create signing/encryption CSR with same settings, etc.) have been removed; now a file save dialog pops up when the CSR has been generated
  • Custom labels for the RSA key sizes ([CertificateCreationWizard]RSAKeySizeLabels); we use GnuPG's algorithm IDs as labels (items in the drop down box)
  • Custom key type ([CertificateCreationWizard]CMSKeyType); CSR creation supported (and still supports) only RSA as "key type"; by marking the config key as immutable one could force the creation of signing+encryption CSRs which makes little sense for S/MIME and might have been "copied" from OpenPGP key creation where forcing the generation of keys for signing & encryption does make some sense.
  • Specification of the CA's email address ([CertificateCreationWizard]CAEmailAddress); the generated CSRs are now always written to disk; the users will have to create an email themselves

We will do a new gpg4win beta soon.

@m.eik Could you please enable debug option for gpg-agent and get the log output for the crash?

I fixed the problem (which I identified above) in gniibe/t7759 branch. There might be other causes/problems for the particular symptom, so, I don't know the fix resolves the symptom or not, though. Anyhow, I believe that this is an improvement.

tooltip suggestion for d, not trusted and expired:
Ask the sender for an updated certificate and when you receive it, follow the procedure to establish trust and certify it.
or:
Ask the sender for an updated certificate. When you receive it, you need to establish trust and certify it.

Similar situation could happen with gpgsm + gpg-agent, when gpg-agent is invoked by gpgsm.
(1) No gpg-agent.
(2) In gpgme, by engine-gpgsm, gpgsm is invoked with --logger.
(3) In gpgsm_keylist, it makes sure gpg-agent is available by GETINFO agent-check, using gpgsm_assuan_simple_command.
(4) In the server side, it tries to connect gpg-agent, invokes gpg-agent, and connect to the agent again.
(5) On Windows, it may takes time to invoke gpg-agent. And it may try to connect multiple times. Each trial may generate debug messages.
(6) When it takes too much time, the debug messages are too much. It may fill the pipe.
(7) And it blocks at log_string in my_libassuan_log_handler.
(8) ... it hangs.

Hypothetical scenario (gpgsm --server + dirmngr):
(0) It may hang when much debug messages are generated by libassuan to the pipe of --logger (diag_cb).
(1) In gpgme, by engine-gpgsm, gpgsm is invoked with --logger.
(2) If it's the case of standard gpgme interactions which uses gpgsm_io_event, no problem. Because the data on diag_cb is consumed well.
(3) In case of gpgsm_encrypt (or other commands), it uses gpgsm_assuan_simple_command which does not consume the data on diag_cb pipe at all.
(4) In particular, in set_recipients, gpgsm_assuan_simple_command is called by the number of recipients times.
(5) IIUC, in the server side, to handle RECIPIENT command, dirmngr is used by the call chain of:

• cmd_recipient
• gpgsm_add_to_certlist
• gpgsm_validate_chain...
• gpgsm_dirmngr_isvalid

(6) In gpgsm_dirmngr_isvalid function, libassuan is used as client side, it generates debug messages.
(7) When there are many recipients, the debug message may be big enough to fill the pipe.
(8) When pipe is filled, it blocks at log_string in my_libassuan_log_handler, waiting the data in pipe is consumed.
(9) ... it hangs.

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4