The [KDE Action Restrictions][$i] in XDG_SYSTEM_DIRS/kleopatrarc prevents any changes within the whole group afterwards.
I guess, this is intended by defining an "immutable group", but i doubt that we want to prevent admins to change those settings?

So, regarding the minor version change: the change of order seems not critical (as there was no settings file before), but the introduction of the settings file might be.

I verified, that both in vsd 3.3.2 and vsd 3.3.3 beta90.29 the current implementation is

The configuration readout order still needs to be specified/fixed.

Looks good to me on vsd-3.3.3-beta90.29 @ win11

In gpg4win-4.4.1 it works too.

Note: In the current vsd beta (29) it works (pinentry for the next key is opened):

Note: It works with gpg-card url --clear.

Right, gpg CLI output depends on it, too.

ZeitControl OpenPGP v3.4 card

Windows Language Settings:

• ISO: EnglishInternational
• Windows Language: English (United Kingdom) - note: i installed English (United States), but can't select it
• Country or Region: German
• Regional Format: German

The screenshots were made with

• ISO: EnglishInternational
• Windows Language: English (United Kingdom) - note: i installed English (United States), but can't select it
• Country or Region: German
• Regional Format: German

• I might want to know the fingerprints of those unknown recipients to search for them (in the audit log I can't see, which of those fingerprints are unknown immediately)

Note that currently Kleopatra (gpg4win 5 beta) fails to delete the key, which might impact other operations. I'm currently trying to figure out, if some other bugs/quirks are a subsequent error or not.

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Not sure, if my test covers all cases (especially regarding cache): encrypted for alice with several ADSKs (local/card, v4/v5, several algos, 1 unknown = not in keyring).

• If the cert associated with the adsk is in keyring, the userid of this cert is shown.
• The number of unknown recipients (cert not in keyring) is shown at the end.

Makes sense to me. Possible optimizations:

• I might want to know the fingerprints of those unknown recipients to search for them (in the audit log I can't see, which of those fingerprints are unknown immediately)
• The cert used for decryption could be listed first

The option is still displayed on gpg4win-5.0.0-beta395 @ win11, probably the fix is not included yet.

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks mostly good to me on gpg4win-5.0.0-beta395 @ win11.

nvda speech viewer output:

Related Addresses  tab control
Related Addresses  tab  Alt+  R
Related addresses  list
edward.tester@demo.gnupg.com  not selected

speech viewer:

Search missing keys when verifying a signature  check box  not checked  Alt+  S
X.509 Directory Services  grouping
Directory services  list  This is a list of all directory services that are configured for use with X.509.

Right, it's the same with gpgol disabled. I set it to invalid.

Sounds good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Tested on gpg4win-5.0.0-beta395 @ win10/win11

Mostly looks good to me on gpg4win-5.0.0-beta395 @ win11.

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Issue is still present in gpg4win-5.0.0-beta395 @ win11:

gpgol logs:

Maybe related to https://dev.gnupg.org/T7813

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11 (gpg 2.5.13).

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11 (tested with/without keyboxd, 20 keygen rsa3072 each, with/without password)

Looks good to me on gpg4win-5.0.0-beta395 @ win11

Looks good to me on gpg4win-5.0.0-beta395 @ win11

I can't reproduce this in vsd-3.3.90.19 @ win10 anymore.
Probably the fixes in https://dev.gnupg.org/T7827 or https://dev.gnupg.org/T7855 solved this, too.

(removed: wrong statement)

Note: I also activated Sign/Encrypt by default, if that matters

Same behavior (on vsd-3.3.3-beta90.12 @ win10) for smime encrypted mails:

Looks good to me on vsd-3.3.3-beta90.12 @ win10:

Looks good to me on vsd-3.3.3-beta90.12 @ win10 (temporary filename is now attachment.odt or e.g. attachment (002).odt)

Debug log for vsd:

Also still present on vsd-3.3.3-beta90.12 @ win10 (mail is not moved)

Using gpg4win-5.0.0-beta369 @ win10 I can't reproduce it with use-keyboxd, but without use-keyboxd:

Current logs for a forever hang:

still reproducible on gpg4win-5.0.0-beta369 @ win10

In T6117#205379, @ikloecker wrote:

I guess this is a typo because the CSR looks like an encryption-only certificate.

Sorry, I just found out, that windows caps the filename earlier than max length, so my former tests were invalid.

All mails touched by gpgol should already have a GPGOL_UID_DASL. So to replicate:

1. Send a new encrypted mail (e.g. Edward -> Ted)
2. Don't open that mail, but open the context menu: Move -> Other Folder ...
3. Select a subfolder of INBOX and click OK -> the mail is not moved

Looks good to me on gpg4win-5.0.0-beta369 @ win10

Looks good to me on gpg4win-5.0.0-beta369 @ win10