PIPE_REJECT_REMOTE_CLIENTS is from windows vista and onwards. I guess that's good enough for us.

I do think that switching from our own copied-around-code to a wider shared component for single-application setups does make very much sense rather than try to battle-harden our own code against scenarios of various likeliness.

GpgOL/Web is likely also affected.

I came from it with stuffing the vector into a QByteArrayView - and then comparing it with the same string being roundtripped thru a copy/paste operation by the user.

I don't think the trailing zero-byte should survive the conversion to c++ datastructures.

Yeah. It's a gpgmepp bug.

None of these certificates are for qualified signatures.

Try compare with a gpg4win 3.latest.

A way to trigger some errors could be trying to save to c:\windows or some other place you can't do.
Or while you have the key list open in okular, remove the key underneath everything and then continue.

We now have a filter for qualified signatures if there is any in the list

Fixed upstream with https://invent.kde.org/graphics/okular/-/merge_requests/1301 - not yet in our packaging

How does gpgsm react if you try to sign with the certificate?

Note: It does not seem to be possible to open a pdf from an URL, at least not via CLI okular.exe <URL> (it says Unknown protocol 'https').

In T7285#209655, @ebo wrote:

@svuorela Isn't this done already for KF6?