@werner: Is this resolved?

I also tested to add the qual flag to the root cert in the global trusted.txt, as using qualified.txt is considered legacy, but still the same behavior

The first time Okular was included is gpg4win-4.2.0:

See here for how it should look like:

• https://invent.kde.org/graphics/okular/-/merge_requests/1120
• https://invent.kde.org/graphics/okular/-/merge_requests/1121

I see. I added the root cert to C:\ProgramData\GNU\etc\gnupg\qualified.txt and the usage of the signing certs does include a qualified signature in Kleopatra now. Still I don't see any highlight/filter in Okular:

None of these certificates are for qualified signatures.

Try compare with a gpg4win 3.latest.

I created a bunch of smime certs (via OpenSSL) and imported them in gpg4win-5.0.0 @ win11:

• For each keyusage
  • keyEncipherment, dataEncipherment
  • digitalSignature
  • nonRepudiation
  • digitalSignature, nonRepudiation
• Alice's certs with different names, Bob's certs with same name for each key

Was anything changed? What to test here?

Thanks, looks good to me:

• Saving to c:\
  
• Saving with removed signing key
  

A way to trigger some errors could be trying to save to c:\windows or some other place you can't do.
Or while you have the key list open in okular, remove the key underneath everything and then continue.

We now have a filter for qualified signatures if there is any in the list

Fixed upstream with https://invent.kde.org/graphics/okular/-/merge_requests/1301 - not yet in our packaging

That was also fixed in gnupg 2.2.50 and thus vsd 3.3.3

Looks good to me on gpg4win-5.0.0-beta479 @ win11.

How does gpgsm react if you try to sign with the certificate?

Maybe it would be better to just not offer S/MIME certs with distrusted root cert?

Note: It does not seem to be possible to open a pdf from an URL, at least not via CLI okular.exe <URL> (it says Unknown protocol 'https').

I tried to get any error response but found those issues instead:

• T8017: Okular: Hang on signature with smime cert and distrusted root
• T8018: Okular: No error on signature with wrong passphrase

If all processes are killed before okular is opened, i get an error on "finish signing":

gpgsm.log (debug-all, whole process of signing)

Looks good to me on gpg4win-5.0.0-beta479 @ win11. The default path is now the same as the path of the opened file:

Yes, Kleopatra quits again with the beta from yesterday:

Fixed in gpg4win-5.0.0-beta476

Fixed by applying a patch to our version of MinGW. This affected all Qt programs build with Qt 6.10.

Yes, this is obsolete with T7717: Location of qt-application config files. Closing as Wontfix because we use product-specific folders outside of GNUPGHOME.

In T7285#209655, @ebo wrote:

@svuorela Isn't this done already for KF6?

@svuorela Isn't this done already for KF6?

Is this ticket obsolete with T7717: Location of qt-application config files?

This should better be fixed in the v5 release

With the product-specific standard locations implemented for T7717: Location of qt-application config files it's now longer necessary to customize the application name of Okular. Closing as wontfix.

The new approach has been implemented and backported for VSD 3.4.

New new plan (after discussion on 2025-12-08):