Bug 1215890

Summary:	okular does not find any certificate for digital signing
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Episteme PROMENEUR <epistemepromeneur>
Component:	KDE Applications	Assignee:	E-Mail List <opensuse-kde-bugs>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None
Version:	Current
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://bugs.kde.org/show_bug.cgi?id=469705
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	no certificate Signing dialog signing with LibreOffice

Description Episteme PROMENEUR 2023-10-03 08:28:24 UTC

We can't digital sign with OKULAR.

We can digital sign mails with kmail or a document with LibreOffice.

Kleopatra, Kmail, LibreOffice find my certificates, not Okular.

According to what I understand from this report

https://bugs.kde.org/show_bug.cgi?id=469705

We need:
- okular default certificate folder is ~.gnupg
- gpg 2.4.1 or later
- poppler built with gpgme support.


Thanks

Operating System: openSUSE Tumbleweed 20230929
KDE Plasma Version: 5.27.8
KDE Frameworks Version: 5.110.0
Qt Version: 5.15.10
KDE Gears 23.08.1

Comment 1 Christophe Marin 2023-10-03 09:18:02 UTC

Unless https://bugzilla.opensuse.org/1211444 / https://bugzilla.opensuse.org/1211456 get addressed, factory can't have gpg 2.4.1 and okular can't have signing support.

Comment 2 Christophe Marin 2023-10-13 06:40:08 UTC

gpg2 2.4.3 is now available in Tumbleweed. There's nothing else to do for this report.

Also see https://bugzilla.opensuse.org/show_bug.cgi?id=1215632 which was fixed last month.

Comment 3 Episteme PROMENEUR 2023-10-13 07:30:13 UTC

Created attachment 870141 [details]
no certificate

The problem is not fixed.

Okular does not find any gpg certificate.

Comment 4 Episteme PROMENEUR 2023-10-13 07:34:48 UTC

i forgot to reopen the report

Comment 5 Christophe Marin 2023-10-16 08:07:41 UTC

Just tested with a x509 certificate, it appears in the backends dialog and signing works as expected.

Comment 6 Episteme PROMENEUR 2023-10-16 08:30:02 UTC

Did you see the capture? It's about GPG certificates, not NSS.

Okular does not find the GPG certificates in ~/gnupg folder in the contrary of kmail, LibreOffice, kleopatra.

Comment 7 Christophe Marin 2023-10-16 08:38:27 UTC

Created attachment 870212 [details]
Signing dialog

Comment 8 Christophe Marin 2023-10-16 08:39:20 UTC

Don't reopen unless you tried creating a x509 certificate to sign a pdf.

There's no issue left, now that gpg has the correct version.

Comment 9 Christophe Marin 2023-10-16 08:53:25 UTC

The dialog and the feature is not about signing with a gpg key, it needs an actual certificate to sign PDF files.

Comment 10 Episteme PROMENEUR 2023-10-16 09:27:56 UTC

From the very beginning, see the description, I speak about gpg certificates found and used by kmail, libreOffice, Kleopatra for digital signing, not the x509 certificates.

I am happy that now we can digital sign with a x509 certificate, but this is not the problem defined in "description".

Comment 11 Christophe Marin 2023-10-16 09:44:41 UTC

(In reply to Episteme PROMENEUR from comment #10)
> From the very beginning, see the description, I speak about gpg certificates
> found and used by kmail, libreOffice, Kleopatra for digital signing, not the
> x509 certificates.
> 
> I am happy that now we can digital sign with a x509 certificate, but this is
> not the problem defined in "description".

the x509 certificate was created using `gpgsm --gen-key > test.pem` then imported to gpg.

What kind of gpg certificate do you have in mind? how can they be generated?

Comment 12 Episteme PROMENEUR 2023-10-16 10:16:45 UTC

Created attachment 870222 [details]
signing with LibreOffice

see the capture.

you see the certificates used by LibreOffice or kmail and managed by kleopatra

Comment 13 Christophe Marin 2023-10-16 10:49:04 UTC

(In reply to Episteme PROMENEUR from comment #12)
> Created attachment 870222 [details]
> signing with LibreOffice
> 
> see the capture.
> 
> you see the certificates used by LibreOffice or kmail and managed by
> kleopatra

This type of signature is not supported by the pdf standard, okular doesn't support it.

Comment 14 Episteme PROMENEUR 2023-10-16 10:53:31 UTC

OK thanks

At least openSUSE okular get some improvements