Upstream MR: https://codereview.qt-project.org/c/qt/qtbase/+/676173

I found and fixed a bug (likely a regression in the new code): When CN_prefill or EMAIL_prefill is configured as true and no fixed CN or EMAIL is configured then Kleopatra should prefill Name and Email with values taken from CONFIGDIR/emaildefaults (used by KDE apps on Linux), from the Windows user or from the EMAIL environment variable. This didn't work anymore.

In T6117#205277, @timegrid wrote:

Notes (probably as intended):

• [$i]mmutable does not work for CN or EMAIL

In T6117#205277, @timegrid wrote:

• All fields (signing only, rsa4096)

Certificate Request:

[...]

X509v3 Key Usage: critical
    Key Encipherment, Data Encipherment

In T7758#205218, @timegrid wrote:

Note: If i set an invalid path in "Software\\GnuPG:Install Directory"

• the gpgconf -X output does not change
• the self-test Config File 'libkleopatrarc' fails with Error in archive definition tar: 'pack-command-openpgp' empty or not found

In T7758#205217, @timegrid wrote:

This probably can only be tested with signed releases?

I don't see how this could happen unless you have canceled an export. In this case Kleopatra saved an empty path as last location and then on the next export Kleopatra proposed Documents. The latest changes prevent Kleopatra from saving an empty path as last location and they ensure that Kleopatra immediately writes [Export]LastDirectory to disk.

Notes for testing (and maybe documentation update):

• A few features (?) of the old CSR creation have been removed:
  • The different choices offered after CSR creation (e.g. save to file, send to CA, create signing/encryption CSR with same settings, etc.) have been removed; now a file save dialog pops up when the CSR has been generated
  • Custom labels for the RSA key sizes ([CertificateCreationWizard]RSAKeySizeLabels); we use GnuPG's algorithm IDs as labels (items in the drop down box)
  • Custom key type ([CertificateCreationWizard]CMSKeyType); CSR creation supported (and still supports) only RSA as "key type"; by marking the config key as immutable one could force the creation of signing+encryption CSRs which makes little sense for S/MIME and might have been "copied" from OpenPGP key creation where forcing the generation of keys for signing & encryption does make some sense.
  • Specification of the CA's email address ([CertificateCreationWizard]CAEmailAddress); the generated CSRs are now always written to disk; the users will have to create an email themselves

I don't see the problem. The pattern "Kyber768" is ambiguous because it matches the user IDs of both keys. The match is a simple substring match. There's no logic for "exact match" and no heuristic for "better match". If you want to ensure that a specific key is chosen then you must use a unique identifier for the key. Best use the fingerprint.

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

In the meantime pinentry has been updated also for VSD 3.4.

Backported for VSD 3.4