qt: Extend SignKeyJob to create trust signatures

* lang/qt/src/signkeyjob.h (SignKeyJob::setTrustSignature): New.
* lang/qt/src/qgpgmesignkeyjob.h, lang/qt/src/qgpgmesignkeyjob.cpp
(QGpgMESignKeyJob::setTrustSignature): New.
* lang/qt/src/qgpgmesignkeyjob.cpp (sign_key): Handle trust signatures.
(QGpgMESignKeyJob::start): Pass trust signature attributes to sign_key.
(QGpgMESignKeyJob::setTrustSignature): New.
--

This allows Kleopatra to create trust signatures for trusted
introducers.

GnuPG-bug-id: 5245, 5421

2 files changed, 570 insertions, 3 deletions

diff --git a/lang/qt/tests/Makefile.am b/lang/qt/tests/Makefile.am
index ace5082c..41ea8087 100644
--- a/lang/qt/tests/Makefile.am
+++ b/lang/qt/tests/Makefile.am
@@ -27,11 +27,11 @@ TESTS_ENVIRONMENT = GNUPGHOME=$(GNUPGHOME)
 EXTRA_DIST = initial.test
 
 TESTS = initial.test t-keylist t-keylocate t-ownertrust t-tofuinfo \
-        t-encrypt t-verify t-various t-config t-remarks
+        t-encrypt t-verify t-various t-config t-remarks t-trustsignatures
 
 moc_files = t-keylist.moc t-keylocate.moc t-ownertrust.moc t-tofuinfo.moc \
             t-encrypt.moc t-support.hmoc t-wkspublish.moc t-verify.moc \
-            t-various.moc t-config.moc t-remarks.moc
+            t-various.moc t-config.moc t-remarks.moc t-trustsignatures.moc
 
 AM_LDFLAGS = -no-install
 
@@ -57,6 +57,7 @@ t_verify_SOURCES = t-verify.cpp $(support_src)
 t_various_SOURCES = t-various.cpp $(support_src)
 t_config_SOURCES = t-config.cpp $(support_src)
 t_remarks_SOURCES = t-remarks.cpp $(support_src)
+t_trustsignatures_SOURCES = t-trustsignatures.cpp $(support_src)
 run_keyformailboxjob_SOURCES = run-keyformailboxjob.cpp
 
 nodist_t_keylist_SOURCES = $(moc_files)
@@ -64,7 +65,8 @@ nodist_t_keylist_SOURCES = $(moc_files)
 BUILT_SOURCES = $(moc_files) pubring-stamp
 
 noinst_PROGRAMS = t-keylist t-keylocate t-ownertrust t-tofuinfo t-encrypt \
-    run-keyformailboxjob t-wkspublish t-verify t-various t-config t-remarks
+    run-keyformailboxjob t-wkspublish t-verify t-various t-config t-remarks \
+    t-trustsignatures
 
 CLEANFILES = secring.gpg pubring.gpg pubring.kbx trustdb.gpg dirmngr.conf \
 	gpg-agent.conf pubring.kbx~ S.gpg-agent gpg.conf pubring.gpg~ \
diff --git a/lang/qt/tests/t-trustsignatures.cpp b/lang/qt/tests/t-trustsignatures.cpp
new file mode 100644
index 00000000..d392b2fb
--- /dev/null
+++ b/lang/qt/tests/t-trustsignatures.cpp
@@ -0,0 +1,565 @@
+/* t-remarks.cpp
+
+    This file is part of qgpgme, the Qt API binding for gpgme
+    Copyright (c) 2021 g10 Code GmbH
+    Software engineering by Ingo Klöcker <[email protected]>
+
+    QGpgME is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as
+    published by the Free Software Foundation; either version 2 of the
+    License, or (at your option) any later version.
+
+    QGpgME is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+    In addition, as a special exception, the copyright holders give
+    permission to link the code of this program with any edition of
+    the Qt library by Trolltech AS, Norway (or with modified versions
+    of Qt that use the same license as Qt), and distribute linked
+    combinations including the two.  You must obey the GNU General
+    Public License in all respects for all of the code used other than
+    Qt.  If you modify this file, you may extend this exception to
+    your version of the file, but you are not obligated to do so.  If
+    you do not wish to do so, delete this exception statement from
+    your version.
+*/
+
+#ifdef HAVE_CONFIG_H
+ #include "config.h"
+#endif
+
+#include "t-support.h"
+
+#include "context.h"
+#include "engineinfo.h"
+#include "protocol.h"
+#include "signkeyjob.h"
+
+#include <QSignalSpy>
+#include <QTemporaryDir>
+#include <QTest>
+
+using namespace QGpgME;
+using namespace GpgME;
+
+class TestTrustSignatures: public QGpgMETest
+{
+    Q_OBJECT
+
+Q_SIGNALS:
+    void asyncDone();
+
+private Q_SLOTS:
+    void test_tsign_single_uid_key_and_then_tsign_it_again()
+    {
+        Error err;
+
+        if (!loopbackSupported()) {
+            return;
+        }
+
+        auto ctx = Context::create(OpenPGP);
+        QVERIFY(ctx);
+
+        // Get the signing key ([email protected])
+        auto seckey = ctx->key("A0FF4590BB6122EDEF6E3C542D727CC768697734", err, true);
+        QVERIFY(!err);
+        QVERIFY(!seckey.isNull());
+
+        // Get the target key ([email protected])
+        auto target = ctx->key("E8143C489C8D41124DC40D0B47AF4B6961F04784", err, false);
+        QVERIFY(!err);
+        QVERIFY(!target.isNull());
+        QVERIFY(target.numUserIDs() > 0);
+
+        // Create first trust signature
+        {
+            // Create the job
+            auto job = std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job.get());
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setTrustSignature(TrustSignatureTrust::Complete, 1, QStringLiteral("example.org"));
+
+            connect(job.get(), &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            job->start(target);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 1u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Complete);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+
+        // Create second trust signature
+        {
+            // Create the job
+            auto job = std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job.get());
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setDupeOk(true);
+            job->setTrustSignature(TrustSignatureTrust::Partial, 2, QStringLiteral("example.net"));
+
+            connect(job.get(), &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            err = job->start(target);
+            QVERIFY(!err);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 2u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Partial);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+    }
+
+    void test_tsign_multi_uid_key_and_then_tsign_it_again()
+    {
+        Error err;
+
+        if (!loopbackSupported()) {
+            return;
+        }
+
+        auto ctx = Context::create(OpenPGP);
+        QVERIFY(ctx);
+
+        // Get the signing key ([email protected])
+        auto seckey = ctx->key("A0FF4590BB6122EDEF6E3C542D727CC768697734", err, true);
+        QVERIFY(!err);
+        QVERIFY(!seckey.isNull());
+
+        // Get the target key (Bob / Bravo Test)
+        auto target = ctx->key("D695676BDCEDCC2CDD6152BCFE180B1DA9E3B0B2", err, false);
+        QVERIFY(!err);
+        QVERIFY(!target.isNull());
+        QVERIFY(target.numUserIDs() > 0);
+
+        // Create first trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+             TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setTrustSignature(TrustSignatureTrust::Complete, 1, QStringLiteral("example.org"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            job->start(target);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 1u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Complete);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+
+        // Create second trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setDupeOk(true);
+            job->setTrustSignature(TrustSignatureTrust::Partial, 2, QStringLiteral("example.net"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            err = job->start(target);
+            QVERIFY(!err);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 2u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Partial);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+    }
+
+    void test_tsign_first_uid_and_then_tsign_both_uids()
+    {
+        Error err;
+
+        if (!loopbackSupported()) {
+            return;
+        }
+
+        auto ctx = Context::create(OpenPGP);
+        QVERIFY(ctx);
+
+        // Get the signing key ([email protected])
+        auto seckey = ctx->key("A0FF4590BB6122EDEF6E3C542D727CC768697734", err, true);
+        QVERIFY(!err);
+        QVERIFY(!seckey.isNull());
+
+        // Get the target key (Mallory / Mike Test)
+        auto target = ctx->key("2686AA191A278013992C72EBBE794852BE5CF886", err, false);
+        QVERIFY(!err);
+        QVERIFY(!target.isNull());
+        QVERIFY(target.numUserIDs() > 0);
+
+        // Create first trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setUserIDsToSign({0});
+            job->setTrustSignature(TrustSignatureTrust::Complete, 1, QStringLiteral("example.org"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            job->start(target);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 1u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Complete);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+
+        // Create second trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setDupeOk(true);
+            job->setTrustSignature(TrustSignatureTrust::Partial, 2, QStringLiteral("example.net"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            err = job->start(target);
+            QVERIFY(!err);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 2u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Partial);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+    }
+
+    void test_tsign_all_uids_and_then_tsign_first_uid()
+    {
+        Error err;
+
+        if (!loopbackSupported()) {
+            return;
+        }
+
+        auto ctx = Context::create(OpenPGP);
+        QVERIFY(ctx);
+
+        // Get the signing key ([email protected])
+        auto seckey = ctx->key("A0FF4590BB6122EDEF6E3C542D727CC768697734", err, true);
+        QVERIFY(!err);
+        QVERIFY(!seckey.isNull());
+
+        // Get the target key (Echelon / Echo Test / Eve)
+        auto target = ctx->key("3531152DE293E26A07F504BC318C1FAEFAEF6D1B", err, false);
+        QVERIFY(!err);
+        QVERIFY(!target.isNull());
+        QVERIFY(target.numUserIDs() > 0);
+
+        // Create first trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setTrustSignature(TrustSignatureTrust::Complete, 1, QStringLiteral("example.org"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            job->start(target);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 1u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Complete);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+
+        // Create second trust signature
+        {
+            // Create the job
+            auto job = openpgp()->signKeyJob();//std::unique_ptr<SignKeyJob>{openpgp()->signKeyJob()};
+            QVERIFY(job);
+
+            // Hack in the passphrase provider
+            auto jobCtx = Job::context(job);
+            TestPassphraseProvider provider;
+            jobCtx->setPassphraseProvider(&provider);
+            jobCtx->setPinentryMode(Context::PinentryLoopback);
+
+            // Setup the job
+            job->setExportable(true);
+            job->setSigningKey(seckey);
+            job->setUserIDsToSign({0});
+            job->setDupeOk(true);
+            job->setTrustSignature(TrustSignatureTrust::Partial, 2, QStringLiteral("example.net"));
+
+            connect(job, &SignKeyJob::result,
+                    this, [this] (const GpgME::Error &err2, const QString &, const GpgME::Error &) {
+                        Q_EMIT asyncDone();
+                        if (err2) {
+                            if (err2.code() == GPG_ERR_GENERAL) {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.\n"
+                                    "Hint: Run with GPGMEPP_INTERACTOR_DEBUG=stderr to debug the edit interaction.").arg(err2.asString())));
+                            } else {
+                                QFAIL(qPrintable(QString("The SignKeyJob failed with '%1'.").arg(err2.asString())));
+                            }
+                        }
+                    });
+
+            err = job->start(target);
+            QVERIFY(!err);
+            QSignalSpy spy (this, SIGNAL(asyncDone()));
+            QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
+
+            // At this point the trust signature should have been added.
+            target.update();
+            const auto trustSignature = target.userID(0).signature(target.userID(0).numSignatures() - 1);
+            QVERIFY(trustSignature.isTrustSignature());
+            QCOMPARE(trustSignature.trustDepth(), 2u);
+            QCOMPARE(trustSignature.trustValue(), TrustSignatureTrust::Partial);
+            QVERIFY(trustSignature.trustScope());
+            const auto trustScope = QString::fromUtf8(trustSignature.trustScope());
+            QVERIFY(!trustScope.isEmpty());
+            const QRegExp regex{trustScope};
+            QVERIFY(regex.isValid());
+            QVERIFY(regex.indexIn(QStringLiteral("Foo <[email protected]>")) != -1);
+        }
+    }
+
+    void initTestCase()
+    {
+        QGpgMETest::initTestCase();
+        const QString gpgHome = qgetenv("GNUPGHOME");
+        QVERIFY(copyKeyrings(gpgHome, mDir.path()));
+        qputenv("GNUPGHOME", mDir.path().toUtf8());
+        QFile conf(mDir.path() + QStringLiteral("/gpg.conf"));
+        QVERIFY(conf.open(QIODevice::WriteOnly));
+        if (GpgME::engineInfo(GpgME::GpgEngine).engineVersion() >= "2.2.18") {
+            conf.write("allow-weak-key-signatures");
+        }
+        conf.close();
+    }
+
+private:
+    QTemporaryDir mDir;
+};
+
+QTEST_MAIN(TestTrustSignatures)
+
+#include "t-trustsignatures.moc"