With the release of libgpg-error 1.50 I now get the following error:

I'm setting this back to Testing. In the meantime GpgME has been updated to a 1.24.0 beta version and includes the needed functionality.

I backported this trivial fix for VSD 3.3. Support for drag&drop of certificates from Kleopatra to other applications or the desktop was added for VSD 3.3 (T6893) and it shouldn't confuse the users.

Ready for testing. Backported for VSD 3.3.

A minimal fix would be:

Backported for VSD 3.3

I checked who eats the second valid signature after the first invalid one. It's gpg in batch mode.

In reply to Ingo:
Ok, I can live with that but I still would like this message to be improved.
Looking at it some more I noticed some other details which bother me:

It is trivial append a bogus signature and would thuns inhibit to check the expected signature.

The part after the colon in "The signature is invalid: Invalid Signature" is the error returned by gpg that's responsible for the invalid signature. It could potentially be some other reason. Of course, we can simply not show the error anymore. Obviously, this would remove some details, but maybe that's okay. People could still look at the audit protocol for further information.

sorry, imprecise phrasing … we want this to be used in practice, which includes making the creation of a combined signature file easier.

In T6867#187289, @ebo wrote:

After discussion we concluded that showing all signatures in one detached signature file is something we want soon.

I verified that I can still build libkleo and kleopatra for gpg4win/24.05 (Qt 5) and master (Qt 6).

After discussion we concluded that showing all signatures in one detached signature file is something we want soon.

After talking with Werner, I edited T7155 to include displaying the protocol column, too, because this is useful in combination with his wishes regarding the origin keyword which are: