gpg 2.5.x returns one fewer signature result than 2.4.x for expired/revoked keys (ostree test regression)

[Pritam Srichandan Sahoo]

Hello,

This was found while running the ostree package test suite (ptest) on a
Yocto Project master-branch build (the current development series).
ostree uses GPGME -> gpg, and its signature-verification test fails only
when gpg comes from the 2.5.x branch.  gpg 2.4.x passes.  I reproduced
this natively, outside the build system, by building each gpg from source.

Environment note: my build host and workstation are Ubuntu with gpg 2.4.4
(too old to reproduce), and no Ubuntu release ships a 2.5.x gpg, so I used
a Fedora 43 container and built the gpg versions under test from source.
The distro is irrelevant here -- this is pure userspace (ostree -> GPGME
-> gpg); only the gpg version changes the result.

Reproduction
------------
- Build ostree (v2026.3) and run tests/test-gpg-verify-result.
- Note: GPGME resolves which gpg to use via gpgconf, not $PATH.  I made
  sure "gpgconf --list-components | grep '^gpg:'" pointed at the gpg under
  test before each run (otherwise the system gpg is silently used and the
  test falsely passes).

Result matrix (identical test/data/keyring; only the gpg version changed)
-------------------------------------------------------------------------
  gpg 2.4.9   (last 2.4.x stable)  -> PASS
  gpg 2.5.0   (first 2.5.x)        -> FAIL
  gpg 2.5.4                        -> FAIL
  gpg 2.5.21                       -> FAIL

Failure
-------
In tests/test-gpg-verify-result.c, function test_check_counts:

    g_assert_cmpint (count_all, ==, 5);   <- fails: count_all == 4

The test signs data with 5 keys and expects 5 signature results
(valid / expired-key / revoked-key / missing-key / expired-signature).
With gpg 2.5.x one result is missing, so count_all is 4 instead of 5.
It appears an expired or revoked key is no longer returned during
signature verification on the 2.5 branch.

Narrowing it down
-----------------
Comparing the two release tags (git diff gnupg-2.4.9..gnupg-2.5.0):

- Divergence merge-base: 5355d0885 (2024-05-16).
- The "verify_mode" handling in g10/getkey.c -- in finish_lookup() and
  get_pubkey_for_sig() -- present in 2.4.9 is not present in 2.5.0.

  In 2.4.x, when req_usage indicates signature verification, expired and
  revoked keys are still returned (the checks are guarded by
  "!verify_mode"), e.g.:

      if (!verify_mode && pk->flags.revoked) ...
      if (!verify_mode && pk->has_expired && !opt.ignore_expiration) ...

  On the 2.5 branch these guards are gone, so such keys are skipped
  (counted as n_revoked_or_expired) and one fewer result reaches
  GPGME/ostree.

I understand a form of the verify_mode logic (T7583) was later re-added on
the 2.5 branch, but the count==4 behavior persists through 2.5.21, so the
2.5 branch still differs from 2.4.x here.

Question
--------
Is this an intentional behavior change on the 2.5 branch, or a regression?

Also, per the bug-tracker guidelines I would like to file this as a Task on
dev.gnupg.org -- could I please be granted a bug-tracker account?

Thanks,
Pritam Srichandan Sahoo