Shall we merge this with T2196 ? BTW, I have some unpushed commit and a test installer.

related to T7843: GpgOL: Empty OpenPGP mails with "Read as plain" activated

Here are places where I found problems.

The regression that the Welcome screen didn't go away after generating the very first key has been fixed. The fix has been backported for VSD 3.4 and VSD 3.3.

If a high-contrast mode is enabled then Gpg4win 4.4 (and VSD 3.4) will use the Fusion style which works much better with high contrast than the Windows XP/Vista style with animations that was used previously.

(auto resolved due to the keyword "resolved" in the commit message)

The window was not reenabled on failure see 8d174d5

That is on purpose. With a signed mail you have at least a way to tell who sent the mail. An unsigned but encrypted mail can be send by anyone and you netter don't use HTML links there.

(removed: wrong statement)

Note: I also activated Sign/Encrypt by default, if that matters

see also https://dev.gnupg.org/T7609

I had a look at Qt 5. All of Qt's Windows styles are broken with regards to button or menu item styling. They change the background color of the hovered and/or selected button, but they use the default foreground color of the common base style class for the text. I don't think that fixing the (obsolete) Windows styles is worth the effort. As workaround we should use the Fusion style if high-contrast is active.

Fixed and backported for VSD 3.4 and VSD 3.3.

I see no workaround.
The attachments in the original mail are not gone, yes.
But the mail can't be forwarded with them.

In T6117#205379, @ikloecker wrote:

I guess this is a typo because the CSR looks like an encryption-only certificate.

Upstream MR: https://codereview.qt-project.org/c/qt/qtbase/+/676173

I found and fixed a bug (likely a regression in the new code): When CN_prefill or EMAIL_prefill is configured as true and no fixed CN or EMAIL is configured then Kleopatra should prefill Name and Email with values taken from CONFIGDIR/emaildefaults (used by KDE apps on Linux), from the Windows user or from the EMAIL environment variable. This didn't work anymore.

In T6117#205277, @timegrid wrote:

Notes (probably as intended):

• [$i]mmutable does not work for CN or EMAIL

In T6117#205277, @timegrid wrote:

• All fields (signing only, rsa4096)

Certificate Request:

[...]

X509v3 Key Usage: critical
    Key Encipherment, Data Encipherment

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10:

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10 (no lines omitted or duplicate readings):

pinentry-qt  dialog  Enter passphrase
Passphrase:  edit  protected  blank
[...]
does not match - try again  dialog
OK  button  Enter

Notes for testing (and maybe documentation update):

• A few features (?) of the old CSR creation have been removed:
  • The different choices offered after CSR creation (e.g. save to file, send to CA, create signing/encryption CSR with same settings, etc.) have been removed; now a file save dialog pops up when the CSR has been generated
  • Custom labels for the RSA key sizes ([CertificateCreationWizard]RSAKeySizeLabels); we use GnuPG's algorithm IDs as labels (items in the drop down box)
  • Custom key type ([CertificateCreationWizard]CMSKeyType); CSR creation supported (and still supports) only RSA as "key type"; by marking the config key as immutable one could force the creation of signing+encryption CSRs which makes little sense for S/MIME and might have been "copied" from OpenPGP key creation where forcing the generation of keys for signing & encryption does make some sense.
  • Specification of the CA's email address ([CertificateCreationWizard]CAEmailAddress); the generated CSRs are now always written to disk; the users will have to create an email themselves

Especially when an LDAP is configured, keys should be automatically refreshed in short intervals (5 days? Configurable?) to notify users about revoked keys or signatures from a trusted key.
Keys that are close to their expiration dates should be prioritized.
Maybe users want to configure for what mail domains a lookup on a configured LDAP should be done.

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4

Backported for VSD 3.4