GpgSM: Verification of detached signature via pipe fails
Testing, HighPublic
Actions

Assigned To

None

Authored By

	timegrid
	Jul 14 2026, 2:41 PM

Description

Since at least gpg4win-5.0.2 piping into gpgsm for verification of detached signatures fails, e.g. tested on gpg4win-5.1.0-beta658 / gpg 2.5.21 @ win11:

c:\Users\g10>type smime.signed-only.txt | gpgsm -v --debug-all --status-fd=2 --verify smime.signed-only.txt.p7s -
gpgsm: reading options from '[cmdline]'
gpgsm: reading options from 'C:/Users/g10/AppData/Roaming/gnupg/common.conf'
gpgsm: enabled debug flags: x509 mpi crypto memory cache memstat hashing ipc clock lookup
gpgsm: enabled compatibility flags:
gpgsm: can't open '-': No such file or directory
[GNUPG:] FAILURE gpgsm-exit 50331649
gpgsm: cert_chain_cache: cached=0
gpgsm: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpgsm: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpgsm: secmem usage: 0/16384 bytes in 0 blocks

This used to work in e.g. vsd-3.3.7 / gpgsm 2.2.54, and also in the gpgsm 2.4.9 provided by git for windows:

c:\Users\g10>type smime.signed-only.txt | gpgsm -v --status-fd=2 --verify smime.signed-only.txt.p7s -
gpgsm: enabled compatibility flags: de-vs-trustlist
gpgsm: detached signature
[GNUPG:] NEWSIG
gpgsm: Signature made 2026-07-06 13:16:47 UTC
gpgsm:                using rsa3072 key 7C6A4442C88AA009D1B82BD267F99891C2311DD2
gpgsm: algorithm: RSA + SHA256
gpgsm: certificate is good
gpgsm: validation model used: shell
[GNUPG:] VERIFICATION_COMPLIANCE_MODE 23
[GNUPG:] GOODSIG 7C6A4442C88AA009D1B82BD267F99891C2311DD2 /CN=Test Tester/OU=demo/O=g10 Code GmbH/C=DE
[GNUPG:] VALIDSIG 7C6A4442C88AA009D1B82BD267F99891C2311DD2 2026-07-06 20260706T131647 20630405T170000 0 0 1 8 00
gpgsm: Good signature from "/CN=Test Tester/OU=demo/O=g10 Code GmbH/C=DE"
gpgsm:                 aka "ted.tester@demo.gnupg.com"
[GNUPG:] TRUST_FULLY 0 shell

Piping of embedded signatures (without -) still works on gpg4win-5.1.0-beta658 @ win11:

C:\Users\g10>echo test | gpgsm --sign --local-user Ted | gpgsm --verify
[...]
gpgsm: Good signature from "/CN=Test Tester/OU=demo/O=g10 Code GmbH/C=DE"
gpgsm:                 aka "ted.tester@demo.gnupg.com"

Details

External Link: https://forum.gnupg.org/t/gpgsm-verify-in-powershell-fails-as-of-gpg4win-v5-x/7392
Version: gpg4win-5.1.0-beta658 / gpg 2.5.21 @ win11

Revisions and Commits

rG GnuPG
	rG2efb4a6242e2 gpgsm: Check args for special file names and dashes.

Related Objects

Mentioned In: T8320: Release GnuPG 2.5.22

Event Timeline

timegrid created this task.Jul 14 2026, 2:41 PM

timegrid created this object with edit policy "Contributor (Project)".

timegrid updated the task description. (Show Details)Jul 14 2026, 3:25 PM

pl13 added a subscriber: pl13.Jul 14 2026, 3:56 PM

pl13 moved this task from Backlog to WIP on the gnupg26 board.Jul 15 2026, 11:23 AM

Which gnupg version is used by the gpg4win-5.1.0-beta658 Build. Please always mention the gnupg version if you use a gnupg26 tag.

In T8347#220668, @werner wrote:

Which gnupg version is used by the gpg4win-5.1.0-beta658 Build. Please always mention the gnupg version if you use a gnupg26 tag.

C:\Users\g10>gpg --version
gpg (GnuPG) 2.5.21
libgcrypt 1.12.2

timegrid updated the task description. (Show Details)Jul 15 2026, 5:21 PM

timegrid changed Version from gpg4win-5.1.0-beta658 @ win11 to gpg4win-5.1.0-beta658 / gpg 2.5.21 @ win11.

In case it matters, those are the files i used above (signed by ted, created via kleopatra)

smime.signed-only.txt5 BDownload

smime.signed-only.txt.p7s1 KBDownload

pl13 mentioned this in Unknown Object (Maniphest Task).Jul 20 2026, 7:57 AM

pl13 added a commit: rG2efb4a6242e2: gpgsm: Check args for special file names and dashes..Jul 20 2026, 7:59 AM

pl13 changed the task status from Open to Testing.Jul 28 2026, 10:37 AM

• werner triaged this task as High priority.Thu, Aug 6, 9:28 AM

• werner mentioned this in T8320: Release GnuPG 2.5.22.Mon, Aug 31, 2:28 PM