That is actually more complicated than I initially though. The reason is that expired is used like a trust level:

Applied to master.

Applied to master.

I created a branch https://dev.gnupg.org/source/gnupg/history/gniibe%252Ft8048 and pushed all changes (including keyboxd-patch-2026-04-23).

Enhance keyboxd to have new command for what keybox_set_flags does.

gpgsm does not support OAEP. Actually it does not make much sense to use this padding scheme at all. It has not advantage over PKCS#1. Thus I change this to a feature request to allow decryption using OAEP

Looks good to me on vsd-3.3.7-beta90.9 @ win10:

Looks good to me on vsd-3.3.7-beta90.9 @ win10.

I applied the keyboxd part for SETEPHEMERAL command, as it doesn't break anything.

Here is an attempt to fix the client side:

I have added the fix as patch for VSD 3.3 because the commits that introduced this regression were also added as patches for VSD 3.3.

This is a regression that was introduced with T7759: Kleopatra: Notepad encryption with S/MIME fails.

Fixed. For VSD 3.4 this will also be fixed if gpgme is updated.

This is a bug in gpgme. gpgsm_assuan_simple_command only reads a single line before waiting for more data although there is a second line (ERR ...) ready to be read. gpgsm never sends more data because it has already sent its full answer. So gpgme waits forever.

I looked at sm/keydb.c:keydb_set_ephemeral function. It says:

Looks good to me on gpg4win-5.0.2-beta2 @ win11:

It seemed that the reporter (also) claimed that a git repo could be weak/vulnerable when X.509 signature (with a relevant curve key) is used to validate the commit.

For the record (to show we don't hide a problem), I add some information.

Backported for VSD 3.4

Done.

ok, lets do this. I'll update the description

I'm fine with just dropping it.

Do we agree to drop bolt font for QES certificates?
Will we change this for VSD 3.4?