Setting to resolved, as I think it should be

This is ready for testing and available in 5.0.0-betaX since about a year.

Thanks Eva and Ingo. It seems 2.5.17 is not too far away.

I can reproduce this on the command line:

C:\Users\g10code>"c:\Program Files\GnuPG\bin\gpgsm.exe" --export --armor 579BAF3DF16AD462457BCC0897ADBC143D76EA7B 5A2B80F98F518D50891B1F0C7C6131AD107F9938 DB625D2BBBB5A3FD985C0233249B03090E85D402
Issuer ...: /CN=CA IVBB Deutsche Telekom AG 20/OU=Bund/O=PKI-1-Verwaltung/C=DE
Serial ...: 02195D190EBE34
Subject ..: /CN=iOS Test-Smartcard iostest01.sc/OU=BSI/O=Bund/C=DE/SerialNumber=2
    aka ..: iostest01.sc@bsi.bund.de
Keygrip ..: 527CE32FD0552D18479442EF90DD5E434C036329

I can reproduce the issue only (!!!) with keyboxd (on Windows).

testing with 2.5/2.6 will wait for special build

I am using that version and key daily. No problems seen.

with Gpg4win-5.0.0-beta479 the listing after creating the new key with ADSK looks ok now:

That was also fixed in gnupg 2.2.50 and thus vsd 3.3.3

That was fixed with 2.2.52 which fixed a bug in the fix done in 2.2.50 (see rG31fef13df1). Note that 2.2.48 to 2.2.50 had only internal releases.

Okay, let's backport this.

Note that for exploiting this bug a second preimage attack for SHA-1 is required. This kind of attack on SHA1 is not yet possible.

In Gpg4win-5.0.0-beta479 the dialog no longer exists. Problem solved ;-)

works, with Gpg4win-5.0.0-beta479 on Win11.
Now after hitting "save" a dialog is shown asking under which name the file shall be saved. Saving works with both options.

It looks similar if the key is in a WKD: First search fails without error, only "no certificates found" is shown. Clicking "Search" again results then in the expected key being found and shown.

Looks good to me on gpg4win-5.0.0-beta479 @ win11.
I can't reproduce ebo's nor pl13's issue.

That'd be great if possible, thank you!

Thanks, I'll use even-numbered minor checks against the tags "gnupgXX_ver" in https://versions.gnupg.org/swdb.lst

Please use the the swdb.lst which has all the version info. The website is actually build using this info. Well, except for the README file in the FTP section. I will update that too.

new export option keep-expired?

Thanks for reporting. Will be fixed in a few minutes.

You mean ask ldv to renew it? Sure, can do, but we often want to check sigs that were valid at the time but are now expired (sometimes upstreams are not reachable anymore).

Fixed in 2.5.16

What about prolonging the expired key?

Also fixed in the other active branches.

The int-truncation change breaks other things. I noticed this by chance in the interactive mode due to warning noticed. Before we ever do such things again we need to have regression tests for setting preferences. Or manually check everything. Need to do a 2.5.16 tomorrow :-(

We need to explain and debunk this attack after its publication,