works:

Sorry to bump a discussion a few months after it has already died down, but with the deprecation and removal of init-based supervised launching of gpg-agent, what's the recommended approach now to auto-start it?

Calling assuan_release before kbx_client_data_release is the best (and we join the thread).

works

The current date should be avoided even if explicitly chosen, on the command line the earliest allowed date is tomorrow.

To align the default expiration time with the BSI approval and other related software we change this now to 3 years.

Would work better if every attention craving window would refer to the file resp certificate it addresses but that is covered by T6152

Works in kleopatra; tested with gpg4win-4.2.0-beta339.

Gpg4win doesn't include libexpat anymore (since it doesn't include gpa and pinentry-gtk anymore).

Gpg4win doesn't include libexpat anymore (since it doesn't include gpa and pinentry-gtk anymore).

I had a brief look at this. I don't think there's a way currently to convey "CRL Error" via a keylist result to gpgme. The --with-colons format would probably need to be extended.

I just thought, that we should still show "not certified" if the primary user ID is not certified because Kleopatra always displays the primary user ID (except in the Certificate Details).

tests/openpgp/import.scm hangs with 4096*4.

https://invent.kde.org/pim/messagelib/-/commit/f8373bc09b228cc88577ec88b285c58a06122575

Test with Wine (i686) emulation, I encountered another hang at: Checking armored_key_8192

It looks like having the datastream_thread may be not worth.
One possibility is to implement synchronous read from pipe in kbx_client_data_wait, instead of datastream_thread.

Notes for testing:

• First certificates and groups are sorted by their "display name" (i.e. the part of the displayed text before the parenthesis with the other properties).
• Groups are sorted before certificates if both have the same "display name".
• Groups with identical name are sorted by their internal ID. (Probably doesn't make much sense to test this.)
• Certificates with identical "display name" are sorted by validity, then by creation of newest valid subkey, and finally by fingerprint.

Works good enough for me

I agree, but can't give this priority because it is more work then it sounds since we need to start from the bottom with dirmngr feedback and then pass this all the way through our layers to kleo.

As ingo pointed out in the main issue, just using an "inactive" color for the validity might be confusing / inacessible.

When testing please note that the last changes (i.e. "Ignore expired subkeys when looking for newest subkey" and ""Sort by fingerprint as last resort for deterministic sort order") have not been merged to the gpg4win/3.1.27 branch.