Add flag fields is_de_vs and beta_compliance to encryption results

* src/encrypt.c (_gpgme_encrypt_status_handler): Handle the compliance
status line.
* src/gpgme.h.in (struct _gpgme_op_encrypt_result): Add fields is_de_vs
and beta_compliance.
(gpgme_status_code_t): Add status code for the encryption compliance
status line.
* src/status-table.c (status_table): Add encryption compliance status
line.

* tests/run-encrypt.c (print_encrypt_result): Print compliance.
--

This allows checking whether the encrypt operation is in compliance with
the VS-NfD criteria.

GnuPG-bug-id: 6702

6 files changed, 35 insertions, 2 deletions

diff --git a/NEWS b/NEWS
index 055c5e16..36bbed9a 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 Noteworthy changes in version 2.0.2 (unreleased)   [C45/A0/R)]
 ------------------------------------------------
 
+ * New flags "is_de_vs" and "beta_compliance" for encryption results.
+   [T6702]
+
  * New context flag "export-filter".  [T8033]
 
  * Extend the internal gpgsm_assuan_simple_command to consume all
@@ -9,7 +12,8 @@ Noteworthy changes in version 2.0.2 (unreleased)   [C45/A0/R)]
 
  * Interface changes relative to the 2.0.1 release:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- gpgme_set_ctx_flag                    EXTENDED: New flag 'export-filter'.
+ gpgme_set_ctx_flag                    EXT: New flag 'export-filter'.
+ gpgme_decrypt_result_t        EXT: New fields is_de_vs and beta_compliance.
 
 Noteworthy changes in version 2.0.1 (2025-09-23)   [C45/A0/R1]
 ------------------------------------------------
diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index f9bcb7d6..5acefe24 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -7065,6 +7065,16 @@ members:
 @item gpgme_invalid_key_t invalid_recipients
 A linked list with information about all invalid keys for which
 the data could not be encrypted.
+
+@item unsigned int is_de_vs : 1;
+@since{2.1.0}
+The message was encrypted in a VS-NfD compliant way.  This is a
+specification in Germany for a restricted communication level.
+
+@item unsigned int beta_compliance : 1;
+@since{2.1.0}
+The compliance flags (e.g. is_de_vs) are set but the software has not
+yet been approved or is in a beta state.
 @end table
 @end deftp
 
diff --git a/src/encrypt.c b/src/encrypt.c
index 24132fda..ad8d4054 100644
--- a/src/encrypt.c
+++ b/src/encrypt.c
@@ -30,6 +30,7 @@
 #include "debug.h"
 #include "context.h"
 #include "ops.h"
+#include "util.h"
 
 
 typedef struct
@@ -173,6 +174,10 @@ _gpgme_encrypt_status_handler (void *priv, gpgme_status_code_t code,
       opd->success_seen = 1;
       break;
 
+    case GPGME_STATUS_ENCRYPTION_COMPLIANCE_MODE:
+      PARSE_COMPLIANCE_FLAGS (args, &opd->result);
+      break;
+
     default:
       break;
     }
diff --git a/src/gpgme.h.in b/src/gpgme.h.in
index d5f65caa..063948f2 100644
--- a/src/gpgme.h.in
+++ b/src/gpgme.h.in
@@ -1379,6 +1379,16 @@ struct _gpgme_op_encrypt_result
 {
   /* The list of invalid recipients.  */
   gpgme_invalid_key_t invalid_recipients;
+
+  /* True if the message was encrypted in compliance to the de-vs
+   * mode.  */
+  unsigned int is_de_vs : 1;
+
+  /* The compliance mode (is_de_vs) has not yet been approved.  */
+  unsigned int beta_compliance : 1;
+
+  /* Internal to GPGME, do not use.  */
+  int _unused : 30;
 };
 typedef struct _gpgme_op_encrypt_result *gpgme_encrypt_result_t;
 
@@ -2716,7 +2726,8 @@ typedef enum
     GPGME_STATUS_NOTATION_FLAGS = 98,
     GPGME_STATUS_DECRYPTION_COMPLIANCE_MODE = 99,
     GPGME_STATUS_VERIFICATION_COMPLIANCE_MODE = 100,
-    GPGME_STATUS_CANCELED_BY_USER = 101
+    GPGME_STATUS_CANCELED_BY_USER = 101,
+    GPGME_STATUS_ENCRYPTION_COMPLIANCE_MODE = 102
   }
 gpgme_status_code_t;
 
diff --git a/src/status-table.c b/src/status-table.c
index 6ec73ab1..6b2e3396 100644
--- a/src/status-table.c
+++ b/src/status-table.c
@@ -58,6 +58,7 @@ static struct status_table_s status_table[] =
   { "DECRYPTION_OKAY", GPGME_STATUS_DECRYPTION_OKAY },
   { "DELETE_PROBLEM", GPGME_STATUS_DELETE_PROBLEM },
   { "DECRYPTION_COMPLIANCE_MODE", GPGME_STATUS_DECRYPTION_COMPLIANCE_MODE },
+  { "ENCRYPTION_COMPLIANCE_MODE", GPGME_STATUS_ENCRYPTION_COMPLIANCE_MODE },
   { "ENC_TO", GPGME_STATUS_ENC_TO },
   { "END_DECRYPTION", GPGME_STATUS_END_DECRYPTION },
   { "END_ENCRYPTION", GPGME_STATUS_END_ENCRYPTION },
diff --git a/tests/run-encrypt.c b/tests/run-encrypt.c
index 5a10e593..a6c21d00 100644
--- a/tests/run-encrypt.c
+++ b/tests/run-encrypt.c
@@ -99,6 +99,8 @@ print_encrypt_result (gpgme_encrypt_result_t result)
   gpgme_invalid_key_t invkey;
 
   printf ("\nEncryption results\n");
+  printf ("Compliance de-vs ...: %s%s\n", result->is_de_vs? "yes":"no",
+          result->is_de_vs && result->beta_compliance? "(beta)":"");
   for (invkey = result->invalid_recipients; invkey; invkey = invkey->next)
     printf ("Encryption key `%s' not used: %s <%s>\n",
             nonnull (invkey->fpr),