Bug 501820 - Missing digital signature for GPGOL Outlook Add-in in GPG4Win 4.4.0
Summary: Missing digital signature for GPGOL Outlook Add-in in GPG4Win 4.4.0
Status: RESOLVED DOWNSTREAM
Alias: None
Product: kleopatra
Classification: Applications
Component: general (show other bugs)
Version: gpg4win 4.4.0
Platform: Other Microsoft Windows
: NOR normal
Target Milestone: ---
Assignee: Ingo Klöcker
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-21 07:53 UTC by j.Schmitz
Modified: 2025-03-26 07:09 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description j.Schmitz 2025-03-21 07:53:01 UTC
SUMMARY
We have upgraded approximately 80 clients with GPG4win from version 4.3.1 to 4.4.0, and the Outlook add-in doesn’t work anymore because the new version 4.4.0 uses an unsigned "gpgol.dll" for the Outlook add-in. In version 4.3.1, the "gpgol.dll" is still signed. This issue impacts us because we need to configure our Office 365 according to the BSI (GER: „Bundesamt für Sicherheit in der IT“, EN: „Federal Office for IT Security”) standards for Office products. The Federal Office for IT Security regulations state that no unsigned add-ins or macros can be executed. 

STEPS TO REPRODUCE
Addin File:
1. "C:\Program Files\Gpg4win\bin\gpgol.dll"
2. "Properties" > "Digitial Signatures" tab is missing.

Outlook Setup:
1. Open "Option" > "Trust Center"  > "Trust Center Settings" > "Macro Settings"
2. Check Option "Notification for digitally signed macros, all other macros disabled
3. Check Option "Apply macro security setting to installed add-ins"

Alternative Approach (Registry Editor) -> we use GPO's
HKEY_CURRENT_USER\Software\Policies\Microsoft\office\16.0\outlook\security
(DWORD) LEVEL = 3
(DWORD) donttrustinstalledfiles = 1

SOFTWARE/OS VERSIONS
Windows: Wondows 11 Version 2009(x86_64)
Software: GPG4Win 4.4.0
Comment 1 Ingo Klöcker 2025-03-21 20:51:28 UTC
Gpg4win is not released by KDE but by g10 Code GmbH. Additionally, the Outlook add-in isn't even developed by KDE. You need to submit your bug report at dev.gnupg.org.
Comment 2 j.Schmitz 2025-03-26 07:09:19 UTC
OK, thank you for your reply. I will report it on dev.gnupg.org.

best regards.