GnuPG VS-Desktop - Version 3.4.0 (en)

GnuPG VS-Desktop 3.4.0

GnuPG VS-Desktop^® version 3.4.0.0 has been available since 2026-09-16. The previous version was 3.3.7.

Notes to Admins

This version fixes the issue from 3.3.7 where decryption of S/MIME mails failed if the certificate had expired. (T8282)

Change of Defaults

The GnuPG Registry key GpgsmCompatibility is now unset; previously it was set to de-vs-trustlist. The consequences are that only S/MIME certificates that have Root-CAs which are marked with de-vs in the global trustlist.txt are shown as VS-NfD compliant. In case no VS-compatibility is shown for an X.509 certificate which should be VS-NfD compliant, check the corresponding CA entry in %ALLUSERSPROFILE%\GNU\etc\gnupg\trustlist.txt or in your custom global trustlist file, e.g. mytrustlist.txt.

The location of the Kleopatra configuration file kleopatrarc has changed from %LOCALAPPDATA% to the better-suited location %APPDATA%\GnuPG VS-Desktop. (T7717)

New Settings

The following Registry values for Kleopatra are new in GnuPG VS-Desktop^® 3.4:

Subkey: Welcome, value: welcome-text[$i]: With this the text can be changed, which is shown if the certificate list is empty. (T7967)
Subkey: Export, value: AllowPublicKeyUpload: If set to false, Kleopatra will allow only the upload of a user's own OpenPGP certificates, i.e. the secret key needs to be available. Default: true. (T7772)
Subkey: CertificateCreationWizard, several new values regarding the CSR dialog: There are now additional values for all attributes in the overhauled certificate signing request dialog. See the Kleopatra (registry) settings page for more details. The old value CN_placeholder is now deprecated and will fall back to doing the same as the new value CN_hint: The given text will be shown as information above the common name (CN) field of S/MIME CSRs. (T6117)

Linux AppImage

Starting from version 3.4 the AppImage has an install option. When you now install it or update to a new version, after you've made the downloaded AppImage executable, you run it with --install:

./gnupg-vs-desktop-3.4.0.0-x86_64.AppImage --install

Root privileges are needed for this. If you are not root already, you will be asked for the sudo password.

Notes to Users

Different appearance of S/MIME root certificates

S/MIME root certificates are no longer by default displayed in blue and with bold font. Now bold font is used only to indicate that the private key of a certificate is available. Additionally the contrast for root certificates is much improved. (T8275)

New Help Document

GnuPG VS-Desktop^® now includes a user handbook which can be found in the Help menu of Kleopatra. It replaces most of the previous help documents and will be further expanded and improved.

GpgOL Workaround for attached encrypted mails

We introduced changes in the handling of attachments in GpgOL to improve display of contents of attached crypto mails (T7806). However, a workaround is currently necessary: Save encrypted mail attachments in the filesystem (e.g. drag them to the desktop) and then open them from there (e.g. by double-click).

New Features

Engine (GnuPG)

gpg: New options --show-session-hash and --show-only-session-hash. (rGfaa571fbff)
gpgconf,w32: Show more registry keys of GpgOL. (rGa570827330)
gpgconf: Print the content of versioninfo.txt with -vV. (rGa1f08f40d7)

Kleopatra

Prevent execution of Kleopatra as administrator. (T8210)
The text on the welcome page is now configurable. (T7967)
New option --standalone to start Kleopatra as an additional process. (T7704)
Offer retry of S/MIME encryption with lower security setting, if encryption failed with "not trusted". (T6702)
Overhaul of the S/MIME CSR generation dialog. It is now similar to the OpenPGP key generation dialog and accessible. (T6117)
Extract a single folder tar.gpg archive in unambiguous cases directly into a given directory. (T8022), (T8154)
Add filter for valid certificates. (T7950)
Qualified signature certificates are no longer shown in bold. (T8077)
S/MIME root certificates are no longer shown in bold and with blue background color. (T8275)
Show vsd compliance note only in case of successful verification. (T8413)
Add expired/revoked information to LDAP search results. (T8042)
Improved success message on keyserver upload. (T7495)
New config option to only allow upload of own certificates to an LDAP keyserver. (T7772)
Improved question on import of secret key. (T7637)
Omit question about own key when importing a secret team key. (T8098)
Add new default shortcut for certificate details. (T7752)
Add search function to "configuration overview". (T7552)
Remove white space and special characters from suggested export filename. (T7848)
Display keys in the same way in different contexts. (T7474)
Improved UX of "subkey expiry change" window. (T7215)
Smart card creation workflow: The .gpgsk backup was removed. (T8327)

Solved Bugs

Engine (GnuPG)

gpg: Remove local secret key file after bkuptocard. (T8312)
gpg: Fix TOFU trust models to actually check UTK signatures. (T8404)
gpgsm: Fix possible double free in the CMS parser. (T8240)
gpgsm: Fix regression in gpgsm_verify with expired certificates. (T8282), (T8188)
gpgsm, gpgme: Only output de-vs compliance status in de-vs compliance mode. (T8333)
gpgsm: Require a minimum tag length for GCM decryption. (rGab2395daeb)
dirmngr: Fix issue with LDAP upload flags. (T7866)
gpg: Fix issue with the LDAP AKL mechanism. (T7133)

GUI (Kleopatra)

Fix display of S/MIME certificate expiration dates after 2038. (T8088)
Make sure to refresh the certificate list after deletion of secret keys. (T7863)
Make new tabs in certificate list use same column layout as current tab. (T7008), (T8415)
Improve error message when choosing an expired certificate for encryption. (T7789)
Show a certificate's comment field in the certification dialog. (T7558)
Show the algorithm name in the certificate list for RSA-1024 and Kyber keys. (T7394)
Move Qt application configuration files from %LOCALAPPDATA% to %APPDATA%. (Kleopatra + Okular) (T7717)
Disable subkey backup action in key details for primary keys. (T8321)
Fix issue with displayed (VS-NfD) Compliant status. (T8245)
Add red background to status "Corrupt installation". (T8310)
Fix resetting to default appearance. (T7212)
Fix display order of filters with custom id in settings dialog. (T8079)
Fix application order of certificate categories styling. (T8279)
Prevent group configuration reset when certificate details window is opened. (T7963)
Remove obsolete check box for AllowMarkTrusted from config menu. (T7868)
Make completion of commands in the GnuPG Configuration Overview dialog case-sensitive. (T7615)
Make all filter names follow the same language settings. (T7612)
Fix wrapping of "Add ADSK" tooltip. (T7602)
Use new code also for verifying detached OpenPGP signatures. (T8337)
Notepad no longer shows "signed" text if the signature is invalid. (T8020)
Improve readability of the verification feedback. (T8332)
Format fingerprints everywhere. (T7707)

Accessibility

Return focus to certificate list after the details dialog is closed. (T8410)
Fix tab order in decryption result for email files. (T8125)
Fix tab order in smart card table. (T8051)
Fix focus/tab order in directory services configuration. (T7846)
Add accessible name to icon sidebar in the configuration dialog. (T7890)
Make a few lists and tables more accessible. (T7859)
Notepad: Change links to buttons in result list widget and fix tab order. (T7784)
Notepad: Fix for keyboard navigation inside the text editor. (T7355)
Make 'Show Audit Log' in signature verification open on first click. (T7644)
Add label/accessible name to text field of notepad. (T7751)
Fix hiding of hidden tabs. (T8422)
Fix color for some button texts in "high contrast white" setting. (T7585)
Make table column headings accessible. (T6568)
File operation resultlistwidget accessibility (contrast). (T5846)
Make server lookup feedback "no certificates found" available for screen readers. (T7862)
Make screen readers announce empty directory service list. (T7860)
Fix double reading by screen readers of several items. (T7854), (T7850), (T7739)

Outlook Add-In (GpgOL)

The Ribbon Icon and Tooltip now reflect the selected security settings of a new mail. (T7098)
Content of HTML-only OpenPGP mails is now shown with "Read as plain" activated. (T7843)
Improved handling of encrypted attached mails. (T7806, rO06e35e5)
Fix multipart attachment type in case of no cid. (T8161)
p7m attachments no longer break attachment parsing. (T8113)
Fix an Outlook freeze when saving S/MIME encrypted draft. (T7837)
Fix for a case where the overlay did stay open after sending. (rO0d36b54)
gpg4win-tools: Fix encoding for status information. (T8362)
Gpgolconfig: Fix display of immutable settings. (T8254)
Fix memory leaks. (rO5b52c25, rOc18e33a, rO4330c1736f)
Show certain mime attachments (csv files) as attachments instead of inline despite missing Content-Disposition. (T8411)
The number of calls needed for processing when changing mails was reduced. (T8418)
No empty mail is saved in the inbox any more when closing an S/MIME msg file. (T8438)

Okular

Updated poppler version fixes an issue with certificates where the expiration date is 2038 or later. (T8274)

Versions of the Components

Component	Version	Remarks
GnuPG	2.2.56	T8450
Kleopatra	3.4.0
GpgOL	2.7.6
GpgEX	1.0.11
Libgcrypt	1.8.14	T8225
Libksba	1.8.0	T8253

This page as PDF.