Maniphest T8282

gpgsm: Verifying a signature with an expired certificate does not show information about the signature
Closed, ResolvedPublic
Actions

Assigned To
timegrid
Authored By
pl13
Jun 1 2026, 5:02 PM
Tags
Subscribers
• ebo
pl13
timegrid

Description

When verifying a file with a detached signature information about the signature is not shown if the certificate of the signer is expired.

Output:

gpgsm --verify test.sig test.data 

gpgsm: Signature made [date not given]
gpgsm:                using nistp256 key 60ECCA6D9073C8F8164318AADF3634E266A25385
gpgsm: certificate has expired
gpgsm:   (expired at 2025-12-31 00:00:00)
gpgsm: invalid certification chain: Certificate expired

Expected output:

gpgsm --verify test.sig test.data 

gpgsm: Signature made [date not given]
gpgsm:                using nistp256 key 60ECCA6D9073C8F8164318AADF3634E266A25385
gpgsm: certificate has expired
gpgsm:   (expired at 2025-12-31 00:00:00)
gpgsm: Good signature from "/CN=Koch, Werner/C=DE/SerialNumber=4/GN=Werner/SN=Koch"
gpgsm:                 aka "werner.koch@g10code.com"

This regression was introduced by rGfa1ac5c23d16: gpgsm: add a certificate chain check for de-vs compliance in GnuPG 2.5.19 and 2.2.54. (T8188)

Details

Version
2.2.54 / 2.5.19

Revisions and Commits

rG GnuPG
rG56a1e5f3dda3 gpgsm: Add a certificate chain check for de-vs compliance
rG32f56a2732f0 gpgsm: Fix regression in gpgsm_verify with expired certificates.

Related Objects
Search...

Event Timeline

pl13 triaged this task as Normal priority.Jun 1 2026, 5:02 PM
pl13 created this task.
pl13 added commits: rG32f56a2732f0: gpgsm: Fix regression in gpgsm_verify with expired certificates., rG56a1e5f3dda3: gpgsm: Add a certificate chain check for de-vs compliance.Jun 1 2026, 5:07 PM
pl13 changed the task status from Open to Testing.Jun 2 2026, 11:48 AM
pl13 updated the task description. (Show Details)
pl13 changed the edit policy from "All Users" to "Contributor (Project)".
pl13 edited projects, added vsd34, gnupg22; removed gnupg22 (gnupg-2.2.54), vsd33 (vsd-3.3.7), vsd.
pl13 set Version to 2.2.54 / 2.5.19.
pl13 moved this task from Backlog to WIP on the gnupg26 board.
timegrid moved this task from Backlog to QA on the vsd34 board.Jun 26 2026, 9:59 AM
timegrid moved this task from QA to Backlog on the vsd34 board.Jun 26 2026, 11:52 AM
pl13 mentioned this in Unknown Object (Maniphest Task).Jul 6 2026, 9:01 AM
pl13 moved this task from Backlog to QA on the gnupg22 board.Fri, Aug 28, 1:19 PM
• ebo moved this task from Backlog to QA on the vsd34 board.Fri, Aug 28, 1:19 PM
timegrid added a subscriber: timegrid.Fri, Aug 28, 2:38 PM

Looks good to me on vsd-3.4.0-beta1344, gpg 2.2.55 @ win10:

>gpgsm --verify test.pdf.detached.sig test.pdf
gpgsm: Signature made 2026-08-28 12:22:51 UTC
gpgsm:                using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E
gpgsm: certificate has expired
gpgsm:   (expired at 2026-08-28 12:22:51)
gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test"

>gpgsm --verify test.pdf.embedded.sig
gpgsm: Signature made 2026-08-28 12:22:51 UTC
gpgsm:                using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E
gpgsm: certificate has expired
gpgsm:   (expired at 2026-08-28 12:22:51)
gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test"
timegrid moved this task from QA to vsd-3.4.0 on the vsd34 board.Fri, Aug 28, 2:38 PM
timegrid edited projects, added vsd34 (vsd-3.4.0); removed vsd34.
timegrid moved this task from QA to gnupg-2.2.55 on the gnupg22 board.
timegrid edited projects, added gnupg22 (gnupg-2.2.55); removed gnupg22.
timegrid added a comment.Fri, Aug 28, 2:46 PM

Looks good to me on gpg4win-5.1.0, gpg 2.5.21 @ win11:

>gpgsm --verify test.pdf.detached.sig test.pdf
gpgsm: Signature made 2026-08-28 12:22:51 UTC
gpgsm:                using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E
gpgsm: certificate has expired
gpgsm:   (expired at 2026-08-28 12:22:51)
gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test"

>gpgsm --verify test.pdf.embedded.sig
gpgsm: Signature made 2026-08-28 12:22:51 UTC
gpgsm:                using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E
gpgsm: certificate has expired
gpgsm:   (expired at 2026-08-28 12:22:51)
gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test"
timegrid closed this task as Resolved.Fri, Aug 28, 2:53 PM
timegrid claimed this task.
timegrid moved this task from WIP to Done on the gnupg26 board.