gpgsm chain validation not working when gnome-keyring is running

Hi everybody,

on a fresh user account (Ubuntu 11.10 x86_64), gpgsm fails to validate certificates because gnome-keyring overwrites the GPG_AGENT_INFO initially set by gpg-agent (started through /etc/X11/Xsession.d/90gpg-agent with patch from https://bugs.launchpad.net/ubuntu/+source/gnupg2/+bug/743268 already applied by hand).

test@nic-desktop:~$ echo $GPG_AGENT_INFO
/tmp/keyring-EhHy5E/gpg:0:1
test@nic-desktop:~$ sudo lsof /tmp/keyring-EhHy5E/gpg
Password:
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/test/.gvfs
      Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
gnome-key 11834 test 15u unix 0xffff88007c276080 0t0 27229833 /tmp/keyring-EhHy5E/gpg
test@nic-desktop:~$ LC_ALL=C gpgsm -k --with-validation > gpgsm_gnome-keyring.out 2>&1
test@nic-desktop:~$ . .gnupg/gpg-agent-info-nic-desktop
test@nic-desktop:~$ echo $GPG_AGENT_INFO/tmp/gpg-OqCLX5/S.gpg-agent:11883:1
test@nic-desktop:~$ sudo lsof /tmp/gpg-OqCLX5/S.gpg-agent
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/test/.gvfs
      Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
gpg-agent 11883 test 5u unix 0xffff8800b8534d00 0t0 27228418 /tmp/gpg-OqCLX5/S.gpg-agent
test@nic-desktop:~$ LC_ALL=C gpgsm -k --with-validation > gpgsm_gpg-agent.out 2>&1
test@nic-desktop:~$
(see attached tar for the output files)

Unfortunately, the agent built into the gnome-keyring doesn't seem to support all the certificate types/operations/whatever needed by gpgsm cert validation.
I verfified this (actually tracked it down) with a debugger:
gnupg-2.0.18/sm/certchain.c:1308
istrusted_rc = gpgsm_agent_istrusted (ctrl, subject_cert, NULL, rootca_flags);
always returns GPG_ERR_UNSUPPORTED_CERT

I don't know if it is possible to disable gnome-keyring's gpg-agent part.
I chose to assign this bugreport to gpgsm instead of to gnome-keyring since gnome-keyring is kind of default on an Ubuntu system and I believe that an 'apt-get install gpgsm' should just work.

[nic] ~ % lsb_release -rd
Description: Ubuntu 11.10
Release: 11.10
[nic] ~ % LC_ALL=C apt-cache policy gpgsm
gpgsm:
  Installed: 2.0.17-2ubuntu2
  Candidate: 2.0.17-2ubuntu2
  Version table:
 *** 2.0.17-2ubuntu2 0
        500 http://de.archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status
[nic] ~ % LC_ALL=C apt-cache policy gnupg2
gnupg2:
  Installed: 2.0.17-2ubuntu2
  Candidate: 2.0.17-2ubuntu2
  Version table:
 *** 2.0.17-2ubuntu2 0
        500 http://de.archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status
[nic] ~ % LC_ALL=C apt-cache policy gnupg-agent
gnupg-agent:
  Installed: 2.0.17-2ubuntu2
  Candidate: 2.0.17-2ubuntu2
  Version table:
 *** 2.0.17-2ubuntu2 0
        500 http://de.archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status
[nic] ~ % LC_ALL=C apt-cache policy gnupg
gnupg:
  Installed: 1.4.11-3ubuntu1
  Candidate: 1.4.11-3ubuntu1
  Version table:
 *** 1.4.11-3ubuntu1 0
        500 http://de.archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status
[nic] ~ %
This system had been upgraded to oneiric from natty once. Let me know if you need some more information.

Best,

Nicolai