No OneTemporary
Actions

Size

4 MB

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/agent/call-scd.c b/agent/call-scd.c
	index 71e0f581c..33a08a995 100644
	--- a/agent/call-scd.c
	+++ b/agent/call-scd.c
	@@ -1,1342 +1,1342 @@
	/* call-scd.c - fork of the scdaemon to do SC operations
	* Copyright (C) 2001, 2002, 2005, 2007, 2010,
	* 2011 Free Software Foundation, Inc.
	* Copyright (C) 2013 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <assert.h>
	#include <unistd.h>
	#ifdef HAVE_SIGNAL_H
	# include <signal.h>
	#endif
	#include <sys/stat.h>
	#include <sys/types.h>
	#ifndef HAVE_W32_SYSTEM
	#include <sys/wait.h>
	#endif
	#include <npth.h>

	#include "agent.h"
	#include <assuan.h>
	#include "strlist.h"

	#ifdef _POSIX_OPEN_MAX
	#define MAX_OPEN_FDS _POSIX_OPEN_MAX
	#else
	#define MAX_OPEN_FDS 20
	#endif

	/* Definition of module local data of the CTRL structure. */
	struct scd_local_s
	{
	- /* We keep a list of all allocated context with a an achnor at
	+ /* We keep a list of all allocated context with an achnor at
	SCD_LOCAL_LIST (see below). */
	struct scd_local_s *next_local;

	/* We need to get back to the ctrl object actually referencing this
	structure. This is really an awkward way of enumerint the lcoal
	contects. A much cleaner way would be to keep a global list of
	ctrl objects to enumerate them. */
	ctrl_t ctrl_backlink;

	assuan_context_t ctx; /* NULL or session context for the SCdaemon
	used with this connection. */
	int locked; /* This flag is used to assert proper use of
	start_scd and unlock_scd. */

	};


	/* Callback parameter for learn card */
	struct learn_parm_s
	{
	void (kpinfo_cb)(void, const char *);
	void *kpinfo_cb_arg;
	void (certinfo_cb)(void, const char *);
	void *certinfo_cb_arg;
	void (sinfo_cb)(void, const char , size_t, const char );
	void *sinfo_cb_arg;
	};

	struct inq_needpin_s
	{
	assuan_context_t ctx;
	int (getpin_cb)(void , const char , char, size_t);
	void *getpin_cb_arg;
	assuan_context_t passthru; /* If not NULL, pass unknown inquiries
	up to the caller. */
	int any_inq_seen;
	};


	/* To keep track of all active SCD contexts, we keep a linked list
	anchored at this variable. */
	static struct scd_local_s *scd_local_list;

	/* A Mutex used inside the start_scd function. */
	static npth_mutex_t start_scd_lock;

	/* A malloced string with the name of the socket to be used for
	additional connections. May be NULL if not provided by
	SCdaemon. */
	static char *socket_name;

	/* The context of the primary connection. This is also used as a flag
	to indicate whether the scdaemon has been started. */
	static assuan_context_t primary_scd_ctx;

	/* To allow reuse of the primary connection, the following flag is set
	to true if the primary context has been reset and is not in use by
	any connection. */
	static int primary_scd_ctx_reusable;



	/* Local prototypes. */




	/* This function must be called once to initialize this module. This
	has to be done before a second thread is spawned. We can't do the
	static initialization because NPth emulation code might not be able
	to do a static init; in particular, it is not possible for W32. */
	void
	initialize_module_call_scd (void)
	{
	static int initialized;
	int err;

	if (!initialized)
	{
	err = npth_mutex_init (&start_scd_lock, NULL);
	if (err)
	log_fatal ("error initializing mutex: %s\n", strerror (err));
	initialized = 1;
	}
	}


	/* This function may be called to print infromation pertaining to the
	current state of this module to the log. */
	void
	agent_scd_dump_state (void)
	{
	log_info ("agent_scd_dump_state: primary_scd_ctx=%p pid=%ld reusable=%d\n",
	primary_scd_ctx,
	(long)assuan_get_pid (primary_scd_ctx),
	primary_scd_ctx_reusable);
	if (socket_name)
	log_info ("agent_scd_dump_state: socket='%s'\n", socket_name);
	}


	/* The unlock_scd function shall be called after having accessed the
	SCD. It is currently not very useful but gives an opportunity to
	keep track of connections currently calling SCD. Note that the
	"lock" operation is done by the start_scd() function which must be
	called and error checked before any SCD operation. CTRL is the
	usual connection context and RC the error code to be passed trhough
	the function. */
	static int
	unlock_scd (ctrl_t ctrl, int rc)
	{
	if (ctrl->scd_local->locked != 1)
	{
	log_error ("unlock_scd: invalid lock count (%d)\n",
	ctrl->scd_local->locked);
	if (!rc)
	rc = gpg_error (GPG_ERR_INTERNAL);
	}
	ctrl->scd_local->locked = 0;
	return rc;
	}

	/* To make sure we leave no secrets in our image after forking of the
	scdaemon, we use this callback. */
	static void
	atfork_cb (void *opaque, int where)
	{
	(void)opaque;

	if (!where)
	gcry_control (GCRYCTL_TERM_SECMEM);
	}


	/* Fork off the SCdaemon if this has not already been done. Lock the
	daemon and make sure that a proper context has been setup in CTRL.
	This function might also lock the daemon, which means that the
	caller must call unlock_scd after this function has returned
	success and the actual Assuan transaction been done. */
	static int
	start_scd (ctrl_t ctrl)
	{
	gpg_error_t err = 0;
	const char *pgmname;
	assuan_context_t ctx = NULL;
	const char *argv[5];
	assuan_fd_t no_close_list[3];
	int i;
	int rc;
	char *abs_homedir = NULL;

	if (opt.disable_scdaemon)
	return gpg_error (GPG_ERR_NOT_SUPPORTED);

	/* If this is the first call for this session, setup the local data
	structure. */
	if (!ctrl->scd_local)
	{
	ctrl->scd_local = xtrycalloc (1, sizeof *ctrl->scd_local);
	if (!ctrl->scd_local)
	return gpg_error_from_syserror ();
	ctrl->scd_local->ctrl_backlink = ctrl;
	ctrl->scd_local->next_local = scd_local_list;
	scd_local_list = ctrl->scd_local;
	}


	/* Assert that the lock count is as expected. */
	if (ctrl->scd_local->locked)
	{
	log_error ("start_scd: invalid lock count (%d)\n",
	ctrl->scd_local->locked);
	return gpg_error (GPG_ERR_INTERNAL);
	}
	ctrl->scd_local->locked++;

	if (ctrl->scd_local->ctx)
	return 0; /* Okay, the context is fine. We used to test for an
	alive context here and do an disconnect. Now that we
	have a ticker function to check for it, it is easier
	not to check here but to let the connection run on an
	error instead. */


	/* We need to protect the following code. */
	rc = npth_mutex_lock (&start_scd_lock);
	if (rc)
	{
	log_error ("failed to acquire the start_scd lock: %s\n",
	strerror (rc));
	return gpg_error (GPG_ERR_INTERNAL);
	}

	/* Check whether the pipe server has already been started and in
	this case either reuse a lingering pipe connection or establish a
	new socket based one. */
	if (primary_scd_ctx && primary_scd_ctx_reusable)
	{
	ctx = primary_scd_ctx;
	primary_scd_ctx_reusable = 0;
	if (opt.verbose)
	log_info ("new connection to SCdaemon established (reusing)\n");
	goto leave;
	}

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("can't allocate assuan context: %s\n", gpg_strerror (rc));
	err = rc;
	goto leave;
	}

	if (socket_name)
	{
	rc = assuan_socket_connect (ctx, socket_name, 0, 0);
	if (rc)
	{
	log_error ("can't connect to socket '%s': %s\n",
	socket_name, gpg_strerror (rc));
	err = gpg_error (GPG_ERR_NO_SCDAEMON);
	goto leave;
	}

	if (opt.verbose)
	log_info ("new connection to SCdaemon established\n");
	goto leave;
	}

	if (primary_scd_ctx)
	{
	log_info ("SCdaemon is running but won't accept further connections\n");
	err = gpg_error (GPG_ERR_NO_SCDAEMON);
	goto leave;
	}

	/* Nope, it has not been started. Fire it up now. */
	if (opt.verbose)
	log_info ("no running SCdaemon - starting it\n");

	if (fflush (NULL))
	{
	#ifndef HAVE_W32_SYSTEM
	err = gpg_error_from_syserror ();
	#endif
	log_error ("error flushing pending output: %s\n", strerror (errno));
	/* At least Windows XP fails here with EBADF. According to docs
	and Wine an fflush(NULL) is the same as _flushall. However
	the Wime implementaion does not flush stdin,stdout and stderr
	- see above. Lets try to ignore the error. */
	#ifndef HAVE_W32_SYSTEM
	goto leave;
	#endif
	}

	if (!opt.scdaemon_program \|\| !*opt.scdaemon_program)
	opt.scdaemon_program = gnupg_module_name (GNUPG_MODULE_NAME_SCDAEMON);
	if ( !(pgmname = strrchr (opt.scdaemon_program, '/')))
	pgmname = opt.scdaemon_program;
	else
	pgmname++;

	argv[0] = pgmname;
	argv[1] = "--multi-server";
	if (gnupg_default_homedir_p ())
	argv[2] = NULL;
	else
	{
	abs_homedir = make_absfilename_try (gnupg_homedir (), NULL);
	if (!abs_homedir)
	{
	log_error ("error building filename: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	goto leave;
	}

	argv[2] = "--homedir";
	argv[3] = abs_homedir;
	argv[4] = NULL;
	}

	i=0;
	if (!opt.running_detached)
	{
	if (log_get_fd () != -1)
	no_close_list[i++] = assuan_fd_from_posix_fd (log_get_fd ());
	no_close_list[i++] = assuan_fd_from_posix_fd (fileno (stderr));
	}
	no_close_list[i] = ASSUAN_INVALID_FD;

	/* Connect to the scdaemon and perform initial handshaking. Use
	detached flag so that under Windows SCDAEMON does not show up a
	new window. */
	rc = assuan_pipe_connect (ctx, opt.scdaemon_program, argv,
	no_close_list, atfork_cb, NULL,
	ASSUAN_PIPE_CONNECT_DETACHED);
	if (rc)
	{
	log_error ("can't connect to the SCdaemon: %s\n",
	gpg_strerror (rc));
	err = gpg_error (GPG_ERR_NO_SCDAEMON);
	goto leave;
	}

	if (opt.verbose)
	log_debug ("first connection to SCdaemon established\n");


	/* Get the name of the additional socket opened by scdaemon. */
	{
	membuf_t data;
	unsigned char *databuf;
	size_t datalen;

	xfree (socket_name);
	socket_name = NULL;
	init_membuf (&data, 256);
	assuan_transact (ctx, "GETINFO socket_name",
	put_membuf_cb, &data, NULL, NULL, NULL, NULL);

	databuf = get_membuf (&data, &datalen);
	if (databuf && datalen)
	{
	socket_name = xtrymalloc (datalen + 1);
	if (!socket_name)
	log_error ("warning: can't store socket name: %s\n",
	strerror (errno));
	else
	{
	memcpy (socket_name, databuf, datalen);
	socket_name[datalen] = 0;
	if (DBG_IPC)
	log_debug ("additional connections at '%s'\n", socket_name);
	}
	}
	xfree (databuf);
	}

	/* Tell the scdaemon we want him to send us an event signal. We
	don't support this for W32CE. */
	#ifndef HAVE_W32CE_SYSTEM
	if (opt.sigusr2_enabled)
	{
	char buf[100];

	#ifdef HAVE_W32_SYSTEM
	snprintf (buf, sizeof buf, "OPTION event-signal=%lx",
	(unsigned long)get_agent_scd_notify_event ());
	#else
	snprintf (buf, sizeof buf, "OPTION event-signal=%d", SIGUSR2);
	#endif
	assuan_transact (ctx, buf, NULL, NULL, NULL, NULL, NULL, NULL);
	}
	#endif /HAVE_W32CE_SYSTEM/

	primary_scd_ctx = ctx;
	primary_scd_ctx_reusable = 0;

	leave:
	xfree (abs_homedir);
	if (err)
	{
	unlock_scd (ctrl, err);
	if (ctx)
	assuan_release (ctx);
	}
	else
	{
	ctrl->scd_local->ctx = ctx;
	}
	rc = npth_mutex_unlock (&start_scd_lock);
	if (rc)
	log_error ("failed to release the start_scd lock: %s\n", strerror (rc));
	return err;
	}


	/* Check whether the SCdaemon is active. This is a fast check without
	any locking and might give a wrong result if another thread is about
	to start the daemon or the daemon is about to be stopped.. */
	int
	agent_scd_check_running (void)
	{
	return !!primary_scd_ctx;
	}


	/* Check whether the Scdaemon is still alive and clean it up if not. */
	void
	agent_scd_check_aliveness (void)
	{
	pid_t pid;
	#ifdef HAVE_W32_SYSTEM
	DWORD rc;
	#else
	int rc;
	#endif
	struct timespec abstime;
	int err;

	if (!primary_scd_ctx)
	return; /* No scdaemon running. */

	/* This is not a critical function so we use a short timeout while
	acquiring the lock. */
	npth_clock_gettime (&abstime);
	abstime.tv_sec += 1;
	err = npth_mutex_timedlock (&start_scd_lock, &abstime);
	if (err)
	{
	if (err == ETIMEDOUT)
	{
	if (opt.verbose > 1)
	log_info ("failed to acquire the start_scd lock while"
	" doing an aliveness check: %s\n", strerror (err));
	}
	else
	log_error ("failed to acquire the start_scd lock while"
	" doing an aliveness check: %s\n", strerror (err));
	return;
	}

	if (primary_scd_ctx)
	{
	pid = assuan_get_pid (primary_scd_ctx);
	#ifdef HAVE_W32_SYSTEM
	/* If we have a PID we disconnect if either GetExitProcessCode
	fails or if ir returns the exit code of the scdaemon. 259 is
	the error code for STILL_ALIVE. */
	if (pid != (pid_t)(void*)(-1) && pid
	&& (!GetExitCodeProcess ((HANDLE)pid, &rc) \|\| rc != 259))
	#else
	if (pid != (pid_t)(-1) && pid
	&& ((rc=waitpid (pid, NULL, WNOHANG))==-1 \|\| (rc == pid)) )
	#endif
	{
	/* Okay, scdaemon died. Disconnect the primary connection
	now but take care that it won't do another wait. Also
	cleanup all other connections and release their
	resources. The next use will start a new daemon then.
	Due to the use of the START_SCD_LOCAL we are sure that
	none of these context are actually in use. */
	struct scd_local_s *sl;

	assuan_set_flag (primary_scd_ctx, ASSUAN_NO_WAITPID, 1);
	assuan_release (primary_scd_ctx);

	for (sl=scd_local_list; sl; sl = sl->next_local)
	{
	if (sl->ctx)
	{
	if (sl->ctx != primary_scd_ctx)
	assuan_release (sl->ctx);
	sl->ctx = NULL;
	}
	}

	primary_scd_ctx = NULL;
	primary_scd_ctx_reusable = 0;

	xfree (socket_name);
	socket_name = NULL;
	}
	}

	err = npth_mutex_unlock (&start_scd_lock);
	if (err)
	log_error ("failed to release the start_scd lock while"
	" doing the aliveness check: %s\n", strerror (err));
	}



	/* Reset the SCD if it has been used. Actually it is not a reset but
	a cleanup of resources used by the current connection. */
	int
	agent_reset_scd (ctrl_t ctrl)
	{
	if (ctrl->scd_local)
	{
	if (ctrl->scd_local->ctx)
	{
	/* We can't disconnect the primary context because libassuan
	does a waitpid on it and thus the system would hang.
	Instead we send a reset and keep that connection for
	reuse. */
	if (ctrl->scd_local->ctx == primary_scd_ctx)
	{
	/* Send a RESTART to the SCD. This is required for the
	primary connection as a kind of virtual EOF; we don't
	have another way to tell it that the next command
	should be viewed as if a new connection has been
	made. For the non-primary connections this is not
	needed as we simply close the socket. We don't check
	for an error here because the RESTART may fail for
	example if the scdaemon has already been terminated.
	Anyway, we need to set the reusable flag to make sure
	that the aliveness check can clean it up. */
	assuan_transact (primary_scd_ctx, "RESTART",
	NULL, NULL, NULL, NULL, NULL, NULL);
	primary_scd_ctx_reusable = 1;
	}
	else
	assuan_release (ctrl->scd_local->ctx);
	ctrl->scd_local->ctx = NULL;
	}

	/* Remove the local context from our list and release it. */
	if (!scd_local_list)
	BUG ();
	else if (scd_local_list == ctrl->scd_local)
	scd_local_list = ctrl->scd_local->next_local;
	else
	{
	struct scd_local_s *sl;

	for (sl=scd_local_list; sl->next_local; sl = sl->next_local)
	if (sl->next_local == ctrl->scd_local)
	break;
	if (!sl->next_local)
	BUG ();
	sl->next_local = ctrl->scd_local->next_local;
	}
	xfree (ctrl->scd_local);
	ctrl->scd_local = NULL;
	}

	return 0;
	}



	static gpg_error_t
	learn_status_cb (void opaque, const char line)
	{
	struct learn_parm_s *parm = opaque;
	const char *keyword = line;
	int keywordlen;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;
	if (keywordlen == 8 && !memcmp (keyword, "CERTINFO", keywordlen))
	{
	parm->certinfo_cb (parm->certinfo_cb_arg, line);
	}
	else if (keywordlen == 11 && !memcmp (keyword, "KEYPAIRINFO", keywordlen))
	{
	parm->kpinfo_cb (parm->kpinfo_cb_arg, line);
	}
	else if (keywordlen && *line)
	{
	parm->sinfo_cb (parm->sinfo_cb_arg, keyword, keywordlen, line);
	}

	return 0;
	}

	/* Perform the LEARN command and return a list of all private keys
	stored on the card. */
	int
	agent_card_learn (ctrl_t ctrl,
	void (kpinfo_cb)(void, const char *),
	void *kpinfo_cb_arg,
	void (certinfo_cb)(void, const char *),
	void *certinfo_cb_arg,
	void (sinfo_cb)(void, const char , size_t, const char ),
	void *sinfo_cb_arg)
	{
	int rc;
	struct learn_parm_s parm;

	rc = start_scd (ctrl);
	if (rc)
	return rc;

	memset (&parm, 0, sizeof parm);
	parm.kpinfo_cb = kpinfo_cb;
	parm.kpinfo_cb_arg = kpinfo_cb_arg;
	parm.certinfo_cb = certinfo_cb;
	parm.certinfo_cb_arg = certinfo_cb_arg;
	parm.sinfo_cb = sinfo_cb;
	parm.sinfo_cb_arg = sinfo_cb_arg;
	rc = assuan_transact (ctrl->scd_local->ctx, "LEARN --force",
	NULL, NULL, NULL, NULL,
	learn_status_cb, &parm);
	if (rc)
	return unlock_scd (ctrl, rc);

	return unlock_scd (ctrl, 0);
	}



	static gpg_error_t
	get_serialno_cb (void opaque, const char line)
	{
	char **serialno = opaque;
	const char *keyword = line;
	const char *s;
	int keywordlen, n;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == 8 && !memcmp (keyword, "SERIALNO", keywordlen))
	{
	if (*serialno)
	return gpg_error (GPG_ERR_CONFLICT); /* Unexpected status line. */
	for (n=0,s=line; hexdigitp (s); s++, n++)
	;
	if (!n \|\| (n&1)\|\| !(spacep (s) \|\| !*s) )
	return gpg_error (GPG_ERR_ASS_PARAMETER);
	*serialno = xtrymalloc (n+1);
	if (!*serialno)
	return out_of_core ();
	memcpy (*serialno, line, n);
	(*serialno)[n] = 0;
	}

	return 0;
	}

	/* Return the serial number of the card or an appropriate error. The
	serial number is returned as a hexstring. */
	int
	agent_card_serialno (ctrl_t ctrl, char *r_serialno, const char demand)
	{
	int rc;
	char *serialno = NULL;
	char line[ASSUAN_LINELENGTH];

	rc = start_scd (ctrl);
	if (rc)
	return rc;

	if (!demand)
	strcpy (line, "SERIALNO");
	else
	snprintf (line, DIM(line), "SERIALNO --demand=%s", demand);

	rc = assuan_transact (ctrl->scd_local->ctx, line,
	NULL, NULL, NULL, NULL,
	get_serialno_cb, &serialno);
	if (rc)
	{
	xfree (serialno);
	return unlock_scd (ctrl, rc);
	}
	*r_serialno = serialno;
	return unlock_scd (ctrl, 0);
	}




	/* Handle the NEEDPIN inquiry. */
	static gpg_error_t
	inq_needpin (void opaque, const char line)
	{
	struct inq_needpin_s *parm = opaque;
	const char *s;
	char *pin;
	size_t pinlen;
	int rc;

	parm->any_inq_seen = 1;
	if ((s = has_leading_keyword (line, "NEEDPIN")))
	{
	line = s;
	pinlen = 90;
	pin = gcry_malloc_secure (pinlen);
	if (!pin)
	return out_of_core ();

	rc = parm->getpin_cb (parm->getpin_cb_arg, line, pin, pinlen);
	if (!rc)
	rc = assuan_send_data (parm->ctx, pin, pinlen);
	xfree (pin);
	}
	else if ((s = has_leading_keyword (line, "POPUPPINPADPROMPT")))
	{
	rc = parm->getpin_cb (parm->getpin_cb_arg, s, NULL, 1);
	}
	else if ((s = has_leading_keyword (line, "DISMISSPINPADPROMPT")))
	{
	rc = parm->getpin_cb (parm->getpin_cb_arg, "", NULL, 0);
	}
	else if (parm->passthru)
	{
	unsigned char *value;
	size_t valuelen;
	int rest;
	int needrest = !strncmp (line, "KEYDATA", 8);

	/* Pass the inquiry up to our caller. We limit the maximum
	amount to an arbitrary value. As we know that the KEYDATA
	enquiry is pretty sensitive we disable logging then */
	if ((rest = (needrest
	&& !assuan_get_flag (parm->passthru, ASSUAN_CONFIDENTIAL))))
	assuan_begin_confidential (parm->passthru);
	rc = assuan_inquire (parm->passthru, line, &value, &valuelen, 8096);
	if (rest)
	assuan_end_confidential (parm->passthru);
	if (!rc)
	{
	if ((rest = (needrest
	&& !assuan_get_flag (parm->ctx, ASSUAN_CONFIDENTIAL))))
	assuan_begin_confidential (parm->ctx);
	rc = assuan_send_data (parm->ctx, value, valuelen);
	if (rest)
	assuan_end_confidential (parm->ctx);
	xfree (value);
	}
	else
	log_error ("error forwarding inquiry '%s': %s\n",
	line, gpg_strerror (rc));
	}
	else
	{
	log_error ("unsupported inquiry '%s'\n", line);
	rc = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
	}

	return rc;
	}


	/* Helper returning a command option to describe the used hash
	algorithm. See scd/command.c:cmd_pksign. */
	static const char *
	hash_algo_option (int algo)
	{
	switch (algo)
	{
	case GCRY_MD_MD5 : return "--hash=md5";
	case GCRY_MD_RMD160: return "--hash=rmd160";
	case GCRY_MD_SHA1 : return "--hash=sha1";
	case GCRY_MD_SHA224: return "--hash=sha224";
	case GCRY_MD_SHA256: return "--hash=sha256";
	case GCRY_MD_SHA384: return "--hash=sha384";
	case GCRY_MD_SHA512: return "--hash=sha512";
	default: return "";
	}
	}


	static gpg_error_t
	cancel_inquire (ctrl_t ctrl, gpg_error_t rc)
	{
	gpg_error_t oldrc = rc;

	/* The inquire callback was called and transact returned a
	cancel error. We assume that the inquired process sent a
	CANCEL. The passthrough code is not able to pass on the
	CANCEL and thus scdaemon would stuck on this. As a
	workaround we send a CANCEL now. */
	rc = assuan_write_line (ctrl->scd_local->ctx, "CAN");
	if (!rc) {
	char *line;
	size_t len;

	rc = assuan_read_line (ctrl->scd_local->ctx, &line, &len);
	if (!rc)
	rc = oldrc;
	}

	return rc;
	}

	/* Create a signature using the current card. MDALGO is either 0 or
	gives the digest algorithm. */
	int
	agent_card_pksign (ctrl_t ctrl,
	const char *keyid,
	int (getpin_cb)(void , const char , char, size_t),
	void *getpin_cb_arg,
	int mdalgo,
	const unsigned char *indata, size_t indatalen,
	unsigned char *r_buf, size_t r_buflen)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	struct inq_needpin_s inqparm;

	*r_buf = NULL;
	rc = start_scd (ctrl);
	if (rc)
	return rc;

	if (indatalen*2 + 50 > DIM(line))
	return unlock_scd (ctrl, gpg_error (GPG_ERR_GENERAL));

	bin2hex (indata, indatalen, stpcpy (line, "SETDATA "));

	rc = assuan_transact (ctrl->scd_local->ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (rc)
	return unlock_scd (ctrl, rc);

	init_membuf (&data, 1024);
	inqparm.ctx = ctrl->scd_local->ctx;
	inqparm.getpin_cb = getpin_cb;
	inqparm.getpin_cb_arg = getpin_cb_arg;
	inqparm.passthru = 0;
	inqparm.any_inq_seen = 0;
	if (ctrl->use_auth_call)
	snprintf (line, sizeof line, "PKAUTH %s", keyid);
	else
	snprintf (line, sizeof line, "PKSIGN %s %s",
	hash_algo_option (mdalgo), keyid);
	rc = assuan_transact (ctrl->scd_local->ctx, line,
	put_membuf_cb, &data,
	inq_needpin, &inqparm,
	NULL, NULL);
	if (inqparm.any_inq_seen && (gpg_err_code(rc) == GPG_ERR_CANCELED \|\|
	gpg_err_code(rc) == GPG_ERR_ASS_CANCELED))
	rc = cancel_inquire (ctrl, rc);

	if (rc)
	{
	size_t len;

	xfree (get_membuf (&data, &len));
	return unlock_scd (ctrl, rc);
	}

	*r_buf = get_membuf (&data, r_buflen);
	return unlock_scd (ctrl, 0);
	}




	/* Check whether there is any padding info from scdaemon. */
	static gpg_error_t
	padding_info_cb (void opaque, const char line)
	{
	int *r_padding = opaque;
	const char *s;

	if ((s=has_leading_keyword (line, "PADDING")))
	{
	*r_padding = atoi (s);
	}

	return 0;
	}


	/* Decipher INDATA using the current card. Note that the returned
	value is not an s-expression but the raw data as returned by
	scdaemon. The padding information is stored at R_PADDING with -1
	for not known. */
	int
	agent_card_pkdecrypt (ctrl_t ctrl,
	const char *keyid,
	int (getpin_cb)(void , const char , char, size_t),
	void *getpin_cb_arg,
	const unsigned char *indata, size_t indatalen,
	char *r_buf, size_t r_buflen, int *r_padding)
	{
	int rc, i;
	char *p, line[ASSUAN_LINELENGTH];
	membuf_t data;
	struct inq_needpin_s inqparm;
	size_t len;

	*r_buf = NULL;
	r_padding = -1; / Unknown. */
	rc = start_scd (ctrl);
	if (rc)
	return rc;

	/* FIXME: use secure memory where appropriate */

	for (len = 0; len < indatalen;)
	{
	p = stpcpy (line, "SETDATA ");
	if (len)
	p = stpcpy (p, "--append ");
	for (i=0; len < indatalen && (i*2 < DIM(line)-50); i++, len++)
	{
	sprintf (p, "%02X", indata[len]);
	p += 2;
	}
	rc = assuan_transact (ctrl->scd_local->ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (rc)
	return unlock_scd (ctrl, rc);
	}

	init_membuf (&data, 1024);
	inqparm.ctx = ctrl->scd_local->ctx;
	inqparm.getpin_cb = getpin_cb;
	inqparm.getpin_cb_arg = getpin_cb_arg;
	inqparm.passthru = 0;
	inqparm.any_inq_seen = 0;
	snprintf (line, DIM(line), "PKDECRYPT %s", keyid);
	rc = assuan_transact (ctrl->scd_local->ctx, line,
	put_membuf_cb, &data,
	inq_needpin, &inqparm,
	padding_info_cb, r_padding);
	if (inqparm.any_inq_seen && (gpg_err_code(rc) == GPG_ERR_CANCELED \|\|
	gpg_err_code(rc) == GPG_ERR_ASS_CANCELED))
	rc = cancel_inquire (ctrl, rc);

	if (rc)
	{
	xfree (get_membuf (&data, &len));
	return unlock_scd (ctrl, rc);
	}
	*r_buf = get_membuf (&data, r_buflen);
	if (!*r_buf)
	return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));

	return unlock_scd (ctrl, 0);
	}



	/* Read a certificate with ID into R_BUF and R_BUFLEN. */
	int
	agent_card_readcert (ctrl_t ctrl,
	const char id, char r_buf, size_t r_buflen)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	size_t len;

	*r_buf = NULL;
	rc = start_scd (ctrl);
	if (rc)
	return rc;

	init_membuf (&data, 1024);
	snprintf (line, DIM(line), "READCERT %s", id);
	rc = assuan_transact (ctrl->scd_local->ctx, line,
	put_membuf_cb, &data,
	NULL, NULL,
	NULL, NULL);
	if (rc)
	{
	xfree (get_membuf (&data, &len));
	return unlock_scd (ctrl, rc);
	}
	*r_buf = get_membuf (&data, r_buflen);
	if (!*r_buf)
	return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));

	return unlock_scd (ctrl, 0);
	}



	/* Read a key with ID and return it in an allocate buffer pointed to
	by r_BUF as a valid S-expression. */
	int
	agent_card_readkey (ctrl_t ctrl, const char id, unsigned char *r_buf)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	size_t len, buflen;

	*r_buf = NULL;
	rc = start_scd (ctrl);
	if (rc)
	return rc;

	init_membuf (&data, 1024);
	snprintf (line, DIM(line), "READKEY %s", id);
	rc = assuan_transact (ctrl->scd_local->ctx, line,
	put_membuf_cb, &data,
	NULL, NULL,
	NULL, NULL);
	if (rc)
	{
	xfree (get_membuf (&data, &len));
	return unlock_scd (ctrl, rc);
	}
	*r_buf = get_membuf (&data, &buflen);
	if (!*r_buf)
	return unlock_scd (ctrl, gpg_error (GPG_ERR_ENOMEM));

	if (!gcry_sexp_canon_len (*r_buf, buflen, NULL, NULL))
	{
	xfree (r_buf); r_buf = NULL;
	return unlock_scd (ctrl, gpg_error (GPG_ERR_INV_VALUE));
	}

	return unlock_scd (ctrl, 0);
	}


	struct writekey_parm_s
	{
	assuan_context_t ctx;
	int (getpin_cb)(void , const char , char, size_t);
	void *getpin_cb_arg;
	assuan_context_t passthru;
	int any_inq_seen;
	/**/
	const unsigned char *keydata;
	size_t keydatalen;
	};

	/* Handle a KEYDATA inquiry. Note, we only send the data,
	assuan_transact takes care of flushing and writing the end */
	static gpg_error_t
	inq_writekey_parms (void opaque, const char line)
	{
	struct writekey_parm_s *parm = opaque;

	if (has_leading_keyword (line, "KEYDATA"))
	return assuan_send_data (parm->ctx, parm->keydata, parm->keydatalen);
	else
	return inq_needpin (opaque, line);
	}


	int
	agent_card_writekey (ctrl_t ctrl, int force, const char *serialno,
	const char id, const char keydata, size_t keydatalen,
	int (getpin_cb)(void , const char , char, size_t),
	void *getpin_cb_arg)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct writekey_parm_s parms;

	(void)serialno;
	rc = start_scd (ctrl);
	if (rc)
	return rc;

	snprintf (line, DIM(line), "WRITEKEY %s%s", force ? "--force " : "", id);
	parms.ctx = ctrl->scd_local->ctx;
	parms.getpin_cb = getpin_cb;
	parms.getpin_cb_arg = getpin_cb_arg;
	parms.passthru = 0;
	parms.any_inq_seen = 0;
	parms.keydata = keydata;
	parms.keydatalen = keydatalen;

	rc = assuan_transact (ctrl->scd_local->ctx, line, NULL, NULL,
	inq_writekey_parms, &parms, NULL, NULL);
	if (parms.any_inq_seen && (gpg_err_code(rc) == GPG_ERR_CANCELED \|\|
	gpg_err_code(rc) == GPG_ERR_ASS_CANCELED))
	rc = cancel_inquire (ctrl, rc);
	return unlock_scd (ctrl, rc);
	}

	/* Type used with the card_getattr_cb. */
	struct card_getattr_parm_s {
	const char keyword; / Keyword to look for. */
	size_t keywordlen; /* strlen of KEYWORD. */
	char data; / Malloced and unescaped data. */
	int error; /* ERRNO value or 0 on success. */
	};

	/* Callback function for agent_card_getattr. */
	static gpg_error_t
	card_getattr_cb (void opaque, const char line)
	{
	struct card_getattr_parm_s *parm = opaque;
	const char *keyword = line;
	int keywordlen;

	if (parm->data)
	return 0; /* We want only the first occurrence. */

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == parm->keywordlen
	&& !memcmp (keyword, parm->keyword, keywordlen))
	{
	parm->data = percent_plus_unescape ((const unsigned char*)line, 0xff);
	if (!parm->data)
	parm->error = errno;
	}

	return 0;
	}


	/* Call the agent to retrieve a single line data object. On success
	the object is malloced and stored at RESULT; it is guaranteed that
	NULL is never stored in this case. On error an error code is
	returned and NULL stored at RESULT. */
	gpg_error_t
	agent_card_getattr (ctrl_t ctrl, const char name, char *result)
	{
	int err;
	struct card_getattr_parm_s parm;
	char line[ASSUAN_LINELENGTH];

	*result = NULL;

	if (!*name)
	return gpg_error (GPG_ERR_INV_VALUE);

	memset (&parm, 0, sizeof parm);
	parm.keyword = name;
	parm.keywordlen = strlen (name);

	/* We assume that NAME does not need escaping. */
	if (8 + strlen (name) > DIM(line)-1)
	return gpg_error (GPG_ERR_TOO_LARGE);
	stpcpy (stpcpy (line, "GETATTR "), name);

	err = start_scd (ctrl);
	if (err)
	return err;

	err = assuan_transact (ctrl->scd_local->ctx, line,
	NULL, NULL, NULL, NULL,
	card_getattr_cb, &parm);
	if (!err && parm.error)
	err = gpg_error_from_errno (parm.error);

	if (!err && !parm.data)
	err = gpg_error (GPG_ERR_NO_DATA);

	if (!err)
	*result = parm.data;
	else
	xfree (parm.data);

	return unlock_scd (ctrl, err);
	}

	struct card_cardlist_parm_s {
	int error;
	strlist_t list;
	};

	/* Callback function for agent_card_cardlist. */
	static gpg_error_t
	card_cardlist_cb (void opaque, const char line)
	{
	struct card_cardlist_parm_s *parm = opaque;
	const char *keyword = line;
	int keywordlen;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == 8 && !memcmp (keyword, "SERIALNO", keywordlen))
	{
	const char *s;
	int n;

	for (n=0,s=line; hexdigitp (s); s++, n++)
	;

	if (!n \|\| (n&1) \|\| *s)
	parm->error = gpg_error (GPG_ERR_ASS_PARAMETER);
	else
	add_to_strlist (&parm->list, line);
	}

	return 0;
	}

	/* Call the scdaemon to retrieve list of available cards. On success
	the allocated strlist is stored at RESULT. On error an error code is
	returned and NULL stored at RESULT. */
	gpg_error_t
	agent_card_cardlist (ctrl_t ctrl, strlist_t *result)
	{
	int err;
	struct card_cardlist_parm_s parm;
	char line[ASSUAN_LINELENGTH];

	*result = NULL;

	memset (&parm, 0, sizeof parm);
	strcpy (line, "GETINFO card_list");

	err = start_scd (ctrl);
	if (err)
	return err;

	err = assuan_transact (ctrl->scd_local->ctx, line,
	NULL, NULL, NULL, NULL,
	card_cardlist_cb, &parm);
	if (!err && parm.error)
	err = parm.error;

	if (!err)
	*result = parm.list;
	else
	free_strlist (parm.list);

	return unlock_scd (ctrl, err);
	}

	static gpg_error_t
	pass_status_thru (void opaque, const char line)
	{
	assuan_context_t ctx = opaque;
	char keyword[200];
	int i;

	if (line[0] == '#' && (!line[1] \|\| spacep (line+1)))
	{
	/* We are called in convey comments mode. Now, if we see a
	comment marker as keyword we forward the line verbatim to the
	the caller. This way the comment lines from scdaemon won't
	appear as status lines with keyword '#'. */
	assuan_write_line (ctx, line);
	}
	else
	{
	for (i=0; *line && !spacep (line) && i < DIM(keyword)-1; line++, i++)
	keyword[i] = *line;
	keyword[i] = 0;

	/* Truncate any remaining keyword stuff. */
	for (; *line && !spacep (line); line++)
	;
	while (spacep (line))
	line++;

	assuan_write_status (ctx, keyword, line);
	}
	return 0;
	}

	static gpg_error_t
	pass_data_thru (void opaque, const void buffer, size_t length)
	{
	assuan_context_t ctx = opaque;

	assuan_send_data (ctx, buffer, length);
	return 0;
	}


	/* Send the line CMDLINE with command for the SCDdaemon to it and send
	all status messages back. This command is used as a general quoting
	mechanism to pass everything verbatim to SCDAEMON. The PIN
	inquiry is handled inside gpg-agent. */
	int
	agent_card_scd (ctrl_t ctrl, const char *cmdline,
	int (getpin_cb)(void , const char , char, size_t),
	void getpin_cb_arg, void assuan_context)
	{
	int rc;
	struct inq_needpin_s inqparm;
	int saveflag;

	rc = start_scd (ctrl);
	if (rc)
	return rc;

	inqparm.ctx = ctrl->scd_local->ctx;
	inqparm.getpin_cb = getpin_cb;
	inqparm.getpin_cb_arg = getpin_cb_arg;
	inqparm.passthru = assuan_context;
	inqparm.any_inq_seen = 0;
	saveflag = assuan_get_flag (ctrl->scd_local->ctx, ASSUAN_CONVEY_COMMENTS);
	assuan_set_flag (ctrl->scd_local->ctx, ASSUAN_CONVEY_COMMENTS, 1);
	rc = assuan_transact (ctrl->scd_local->ctx, cmdline,
	pass_data_thru, assuan_context,
	inq_needpin, &inqparm,
	pass_status_thru, assuan_context);
	if (inqparm.any_inq_seen && gpg_err_code(rc) == GPG_ERR_ASS_CANCELED)
	rc = cancel_inquire (ctrl, rc);

	assuan_set_flag (ctrl->scd_local->ctx, ASSUAN_CONVEY_COMMENTS, saveflag);
	if (rc)
	{
	return unlock_scd (ctrl, rc);
	}

	return unlock_scd (ctrl, 0);
	}
	diff --git a/agent/command-ssh.c b/agent/command-ssh.c
	index 729870045..79b8f859e 100644
	--- a/agent/command-ssh.c
	+++ b/agent/command-ssh.c
	@@ -1,3798 +1,3798 @@
	/* command-ssh.c - gpg-agent's implementation of the ssh-agent protocol.
	* Copyright (C) 2004-2006, 2009, 2012 Free Software Foundation, Inc.
	* Copyright (C) 2004-2006, 2009, 2012-2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* Only v2 of the ssh-agent protocol is implemented. Relevant RFCs
	are:

	RFC-4250 - Protocol Assigned Numbers
	RFC-4251 - Protocol Architecture
	RFC-4252 - Authentication Protocol
	RFC-4253 - Transport Layer Protocol
	RFC-5656 - ECC support

	The protocol for the agent is defined in OpenSSH's PROTOCL.agent
	file.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <assert.h>

	#include "agent.h"

	#include "i18n.h"
	#include "util.h"
	#include "ssh-utils.h"




	/* Request types. */
	#define SSH_REQUEST_REQUEST_IDENTITIES 11
	#define SSH_REQUEST_SIGN_REQUEST 13
	#define SSH_REQUEST_ADD_IDENTITY 17
	#define SSH_REQUEST_REMOVE_IDENTITY 18
	#define SSH_REQUEST_REMOVE_ALL_IDENTITIES 19
	#define SSH_REQUEST_LOCK 22
	#define SSH_REQUEST_UNLOCK 23
	#define SSH_REQUEST_ADD_ID_CONSTRAINED 25

	/* Options. */
	#define SSH_OPT_CONSTRAIN_LIFETIME 1
	#define SSH_OPT_CONSTRAIN_CONFIRM 2

	/* Response types. */
	#define SSH_RESPONSE_SUCCESS 6
	#define SSH_RESPONSE_FAILURE 5
	#define SSH_RESPONSE_IDENTITIES_ANSWER 12
	#define SSH_RESPONSE_SIGN_RESPONSE 14

	/* Other constants. */
	#define SSH_DSA_SIGNATURE_PADDING 20
	#define SSH_DSA_SIGNATURE_ELEMS 2
	#define SPEC_FLAG_USE_PKCS1V2 (1 << 0)
	#define SPEC_FLAG_IS_ECDSA (1 << 1)
	#define SPEC_FLAG_IS_EdDSA (1 << 2) /(lowercase 'd' on purpose.)/
	#define SPEC_FLAG_WITH_CERT (1 << 7)

	/* The name of the control file. */
	#define SSH_CONTROL_FILE_NAME "sshcontrol"

	/* The blurb we put into the header of a newly created control file. */
	static const char sshcontrolblurb[] =
	"# List of allowed ssh keys. Only keys present in this file are used\n"
	"# in the SSH protocol. The ssh-add tool may add new entries to this\n"
	"# file to enable them; you may also add them manually. Comment\n"
	"# lines, like this one, as well as empty lines are ignored. Lines do\n"
	"# have a certain length limit but this is not serious limitation as\n"
	"# the format of the entries is fixed and checked by gpg-agent. A\n"
	"# non-comment line starts with optional white spaces, followed by the\n"
	"# keygrip of the key given as 40 hex digits, optionally followed by a\n"
	"# caching TTL in seconds, and another optional field for arbitrary\n"
	"# flags. Prepend the keygrip with an '!' mark to disable it.\n"
	"\n";


	/* Macros. */

	/* Return a new uint32 with b0 being the most significant byte and b3
	being the least significant byte. */
	#define uint32_construct(b0, b1, b2, b3) \
	((b0 << 24) \| (b1 << 16) \| (b2 << 8) \| b3)




	/*
	* Basic types.
	*/

	/* Type for a request handler. */
	typedef gpg_error_t (*ssh_request_handler_t) (ctrl_t ctrl,
	estream_t request,
	estream_t response);


	struct ssh_key_type_spec;
	typedef struct ssh_key_type_spec ssh_key_type_spec_t;

	/* Type, which is used for associating request handlers with the
	appropriate request IDs. */
	typedef struct ssh_request_spec
	{
	unsigned char type;
	ssh_request_handler_t handler;
	const char *identifier;
	unsigned int secret_input;
	} ssh_request_spec_t;

	/* Type for "key modifier functions", which are necessary since
	OpenSSH and GnuPG treat key material slightly different. A key
	modifier is called right after a new key identity has been received
	in order to "sanitize" the material. */
	typedef gpg_error_t (ssh_key_modifier_t) (const char elems,
	gcry_mpi_t *mpis);

	/* The encoding of a generated signature is dependent on the
	algorithm; therefore algorithm specific signature encoding
	functions are necessary. */
	typedef gpg_error_t (ssh_signature_encoder_t) (ssh_key_type_spec_t spec,
	estream_t signature_blob,
	gcry_sexp_t sig);

	/* Type, which is used for boundling all the algorithm specific
	information together in a single object. */
	struct ssh_key_type_spec
	{
	/* Algorithm identifier as used by OpenSSH. */
	const char *ssh_identifier;

	/* Human readable name of the algorithm. */
	const char *name;

	/* Algorithm identifier as used by GnuPG. */
	int algo;

	/* List of MPI names for secret keys; order matches the one of the
	agent protocol. */
	const char *elems_key_secret;

	/* List of MPI names for public keys; order matches the one of the
	agent protocol. */
	const char *elems_key_public;

	/* List of MPI names for signature data. */
	const char *elems_signature;

	/* List of MPI names for secret keys; order matches the one, which
	is required by gpg-agent's key access layer. */
	const char *elems_sexp_order;

	/* Key modifier function. Key modifier functions are necessary in
	order to fix any inconsistencies between the representation of
	keys on the SSH and on the GnuPG side. */
	ssh_key_modifier_t key_modifier;

	/* Signature encoder function. Signature encoder functions are
	necessary since the encoding of signatures depends on the used
	algorithm. */
	ssh_signature_encoder_t signature_encoder;

	/* The name of the ECC curve or NULL. */
	const char *curve_name;

	/* The hash algorithm to be used with this key. 0 for using the
	default. */
	int hash_algo;

	/* Misc flags. */
	unsigned int flags;
	};


	/* Definition of an object to access the sshcontrol file. */
	struct ssh_control_file_s
	{
	char fname; / Name of the file. */
	FILE fp; / This is never NULL. */
	int lnr; /* The current line number. */
	struct {
	int valid; /* True if the data of this structure is valid. */
	int disabled; /* The item is disabled. */
	int ttl; /* The TTL of the item. */
	int confirm; /* The confirm flag is set. */
	char hexgrip[40+1]; /* The hexgrip of the item (uppercase). */
	} item;
	};


	/* Prototypes. */
	static gpg_error_t ssh_handler_request_identities (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_sign_request (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_add_identity (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_remove_identity (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_remove_all_identities (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_lock (ctrl_t ctrl,
	estream_t request,
	estream_t response);
	static gpg_error_t ssh_handler_unlock (ctrl_t ctrl,
	estream_t request,
	estream_t response);

	static gpg_error_t ssh_key_modifier_rsa (const char elems, gcry_mpi_t mpis);
	static gpg_error_t ssh_signature_encoder_rsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t signature);
	static gpg_error_t ssh_signature_encoder_dsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t signature);
	static gpg_error_t ssh_signature_encoder_ecdsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t signature);
	static gpg_error_t ssh_signature_encoder_eddsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t signature);
	static gpg_error_t ssh_key_extract_comment (gcry_sexp_t key, char **comment);



	/* Global variables. */


	/* Associating request types with the corresponding request
	handlers. */

	static ssh_request_spec_t request_specs[] =
	{
	#define REQUEST_SPEC_DEFINE(id, name, secret_input) \
	{ SSH_REQUEST_##id, ssh_handler_##name, #name, secret_input }

	REQUEST_SPEC_DEFINE (REQUEST_IDENTITIES, request_identities, 1),
	REQUEST_SPEC_DEFINE (SIGN_REQUEST, sign_request, 0),
	REQUEST_SPEC_DEFINE (ADD_IDENTITY, add_identity, 1),
	REQUEST_SPEC_DEFINE (ADD_ID_CONSTRAINED, add_identity, 1),
	REQUEST_SPEC_DEFINE (REMOVE_IDENTITY, remove_identity, 0),
	REQUEST_SPEC_DEFINE (REMOVE_ALL_IDENTITIES, remove_all_identities, 0),
	REQUEST_SPEC_DEFINE (LOCK, lock, 0),
	REQUEST_SPEC_DEFINE (UNLOCK, unlock, 0)
	#undef REQUEST_SPEC_DEFINE
	};


	/* Table holding key type specifications. */
	static ssh_key_type_spec_t ssh_key_types[] =
	{
	{
	"ssh-ed25519", "Ed25519", GCRY_PK_EDDSA, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_eddsa,
	"Ed25519", 0, SPEC_FLAG_IS_EdDSA
	},
	{
	"ssh-rsa", "RSA", GCRY_PK_RSA, "nedupq", "en", "s", "nedpqu",
	ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
	NULL, 0, SPEC_FLAG_USE_PKCS1V2
	},
	{
	"ssh-dss", "DSA", GCRY_PK_DSA, "pqgyx", "pqgy", "rs", "pqgyx",
	NULL, ssh_signature_encoder_dsa,
	NULL, 0, 0
	},
	{
	"ecdsa-sha2-nistp256", "ECDSA", GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA
	},
	{
	"ecdsa-sha2-nistp384", "ECDSA", GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA
	},
	{
	"ecdsa-sha2-nistp521", "ECDSA", GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA
	},
	{
	"ssh-ed25519-cert-v01@openssh.com", "Ed25519",
	GCRY_PK_EDDSA, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_eddsa,
	"Ed25519", 0, SPEC_FLAG_IS_EdDSA \| SPEC_FLAG_WITH_CERT
	},
	{
	"ssh-rsa-cert-v01@openssh.com", "RSA",
	GCRY_PK_RSA, "nedupq", "en", "s", "nedpqu",
	ssh_key_modifier_rsa, ssh_signature_encoder_rsa,
	NULL, 0, SPEC_FLAG_USE_PKCS1V2 \| SPEC_FLAG_WITH_CERT
	},
	{
	"ssh-dss-cert-v01@openssh.com", "DSA",
	GCRY_PK_DSA, "pqgyx", "pqgy", "rs", "pqgyx",
	NULL, ssh_signature_encoder_dsa,
	NULL, 0, SPEC_FLAG_WITH_CERT \| SPEC_FLAG_WITH_CERT
	},
	{
	"ecdsa-sha2-nistp256-cert-v01@openssh.com", "ECDSA",
	GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp256", GCRY_MD_SHA256, SPEC_FLAG_IS_ECDSA \| SPEC_FLAG_WITH_CERT
	},
	{
	"ecdsa-sha2-nistp384-cert-v01@openssh.com", "ECDSA",
	GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp384", GCRY_MD_SHA384, SPEC_FLAG_IS_ECDSA \| SPEC_FLAG_WITH_CERT
	},
	{
	"ecdsa-sha2-nistp521-cert-v01@openssh.com", "ECDSA",
	GCRY_PK_ECC, "qd", "q", "rs", "qd",
	NULL, ssh_signature_encoder_ecdsa,
	"nistp521", GCRY_MD_SHA512, SPEC_FLAG_IS_ECDSA \| SPEC_FLAG_WITH_CERT
	}
	};





	/*
	General utility functions.
	*/

	/* A secure realloc, i.e. it makes sure to allocate secure memory if A
	is NULL. This is required because the standard gcry_realloc does
	not know whether to allocate secure or normal if NULL is passed as
	existing buffer. */
	static void *
	realloc_secure (void *a, size_t n)
	{
	void *p;

	if (a)
	p = gcry_realloc (a, n);
	else
	p = gcry_malloc_secure (n);

	return p;
	}


	/* Lookup the ssh-identifier for the ECC curve CURVE_NAME. Returns
	NULL if not found. */
	static const char *
	ssh_identifier_from_curve_name (const char *curve_name)
	{
	int i;

	for (i = 0; i < DIM (ssh_key_types); i++)
	if (ssh_key_types[i].curve_name
	&& !strcmp (ssh_key_types[i].curve_name, curve_name))
	return ssh_key_types[i].ssh_identifier;

	return NULL;
	}


	/*
	Primitive I/O functions.
	*/


	/* Read a byte from STREAM, store it in B. */
	static gpg_error_t
	stream_read_byte (estream_t stream, unsigned char *b)
	{
	gpg_error_t err;
	int ret;

	ret = es_fgetc (stream);
	if (ret == EOF)
	{
	if (es_ferror (stream))
	err = gpg_error_from_syserror ();
	else
	err = gpg_error (GPG_ERR_EOF);
	*b = 0;
	}
	else
	{
	*b = ret & 0xFF;
	err = 0;
	}

	return err;
	}

	/* Write the byte contained in B to STREAM. */
	static gpg_error_t
	stream_write_byte (estream_t stream, unsigned char b)
	{
	gpg_error_t err;
	int ret;

	ret = es_fputc (b, stream);
	if (ret == EOF)
	err = gpg_error_from_syserror ();
	else
	err = 0;

	return err;
	}


	/* Read a uint32 from STREAM, store it in UINT32. */
	static gpg_error_t
	stream_read_uint32 (estream_t stream, u32 *uint32)
	{
	unsigned char buffer[4];
	size_t bytes_read;
	gpg_error_t err;
	int ret;

	ret = es_read (stream, buffer, sizeof (buffer), &bytes_read);
	if (ret)
	err = gpg_error_from_syserror ();
	else
	{
	if (bytes_read != sizeof (buffer))
	err = gpg_error (GPG_ERR_EOF);
	else
	{
	u32 n;

	n = uint32_construct (buffer[0], buffer[1], buffer[2], buffer[3]);
	*uint32 = n;
	err = 0;
	}
	}

	return err;
	}

	/* Write the uint32 contained in UINT32 to STREAM. */
	static gpg_error_t
	stream_write_uint32 (estream_t stream, u32 uint32)
	{
	unsigned char buffer[4];
	gpg_error_t err;
	int ret;

	buffer[0] = uint32 >> 24;
	buffer[1] = uint32 >> 16;
	buffer[2] = uint32 >> 8;
	buffer[3] = uint32 >> 0;

	ret = es_write (stream, buffer, sizeof (buffer), NULL);
	if (ret)
	err = gpg_error_from_syserror ();
	else
	err = 0;

	return err;
	}

	/* Read SIZE bytes from STREAM into BUFFER. */
	static gpg_error_t
	stream_read_data (estream_t stream, unsigned char *buffer, size_t size)
	{
	gpg_error_t err;
	size_t bytes_read;
	int ret;

	ret = es_read (stream, buffer, size, &bytes_read);
	if (ret)
	err = gpg_error_from_syserror ();
	else
	{
	if (bytes_read != size)
	err = gpg_error (GPG_ERR_EOF);
	else
	err = 0;
	}

	return err;
	}

	/* Skip over SIZE bytes from STREAM. */
	static gpg_error_t
	stream_read_skip (estream_t stream, size_t size)
	{
	char buffer[128];
	size_t bytes_to_read, bytes_read;
	int ret;

	do
	{
	bytes_to_read = size;
	if (bytes_to_read > sizeof buffer)
	bytes_to_read = sizeof buffer;

	ret = es_read (stream, buffer, bytes_to_read, &bytes_read);
	if (ret)
	return gpg_error_from_syserror ();
	else if (bytes_read != bytes_to_read)
	return gpg_error (GPG_ERR_EOF);
	else
	size -= bytes_to_read;
	}
	while (size);

	return 0;
	}


	/* Write SIZE bytes from BUFFER to STREAM. */
	static gpg_error_t
	stream_write_data (estream_t stream, const unsigned char *buffer, size_t size)
	{
	gpg_error_t err;
	int ret;

	ret = es_write (stream, buffer, size, NULL);
	if (ret)
	err = gpg_error_from_syserror ();
	else
	err = 0;

	return err;
	}

	/* Read a binary string from STREAM into STRING, store size of string
	in STRING_SIZE. Append a hidden nul so that the result may
	directly be used as a C string. Depending on SECURE use secure
	memory for STRING. If STRING is NULL do only a dummy read. */
	static gpg_error_t
	stream_read_string (estream_t stream, unsigned int secure,
	unsigned char *string, u32 string_size)
	{
	gpg_error_t err;
	unsigned char *buffer = NULL;
	u32 length = 0;

	if (string_size)
	*string_size = 0;

	/* Read string length. */
	err = stream_read_uint32 (stream, &length);
	if (err)
	goto out;

	if (string)
	{
	/* Allocate space. */
	if (secure)
	buffer = xtrymalloc_secure (length + 1);
	else
	buffer = xtrymalloc (length + 1);
	if (! buffer)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	/* Read data. */
	err = stream_read_data (stream, buffer, length);
	if (err)
	goto out;

	/* Finalize string object. */
	buffer[length] = 0;
	*string = buffer;
	}
	else /* Dummy read requested. */
	{
	err = stream_read_skip (stream, length);
	if (err)
	goto out;
	}

	if (string_size)
	*string_size = length;

	out:

	if (err)
	xfree (buffer);

	return err;
	}


	/* Read a binary string from STREAM and store it as an opaque MPI at
	R_MPI, adding 0x40 (this is the prefix for EdDSA key in OpenPGP).
	Depending on SECURE use secure memory. If the string is too large
	for key material return an error. */
	static gpg_error_t
	stream_read_blob (estream_t stream, unsigned int secure, gcry_mpi_t *r_mpi)
	{
	gpg_error_t err;
	unsigned char *buffer = NULL;
	u32 length = 0;

	*r_mpi = NULL;

	/* Read string length. */
	err = stream_read_uint32 (stream, &length);
	if (err)
	goto leave;

	/* To avoid excessive use of secure memory we check that an MPI is
	not too large. */
	if (length > (4096/8) + 8)
	{
	log_error (_("ssh keys greater than %d bits are not supported\n"), 4096);
	err = GPG_ERR_TOO_LARGE;
	goto leave;
	}

	/* Allocate space. */
	if (secure)
	buffer = xtrymalloc_secure (length+1);
	else
	buffer = xtrymalloc (length+1);
	if (!buffer)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Read data. */
	err = stream_read_data (stream, buffer + 1, length);
	if (err)
	goto leave;

	buffer[0] = 0x40;
	r_mpi = gcry_mpi_set_opaque (NULL, buffer, 8(length+1));
	buffer = NULL;

	leave:
	xfree (buffer);
	return err;
	}


	/* Read a C-string from STREAM, store copy in STRING. */
	static gpg_error_t
	stream_read_cstring (estream_t stream, char **string)
	{
	gpg_error_t err;
	unsigned char *buffer;

	err = stream_read_string (stream, 0, &buffer, NULL);
	if (!err)
	string = (char )buffer;
	return err;
	}


	/* Write a binary string from STRING of size STRING_N to STREAM. */
	static gpg_error_t
	stream_write_string (estream_t stream,
	const unsigned char *string, u32 string_n)
	{
	gpg_error_t err;

	err = stream_write_uint32 (stream, string_n);
	if (err)
	goto out;

	err = stream_write_data (stream, string, string_n);

	out:

	return err;
	}

	/* Write a C-string from STRING to STREAM. */
	static gpg_error_t
	stream_write_cstring (estream_t stream, const char *string)
	{
	gpg_error_t err;

	err = stream_write_string (stream,
	(const unsigned char *) string, strlen (string));

	return err;
	}

	/* Read an MPI from STREAM, store it in MPINT. Depending on SECURE
	use secure memory. */
	static gpg_error_t
	stream_read_mpi (estream_t stream, unsigned int secure, gcry_mpi_t *mpint)
	{
	unsigned char *mpi_data;
	u32 mpi_data_size;
	gpg_error_t err;
	gcry_mpi_t mpi;

	mpi_data = NULL;

	err = stream_read_string (stream, secure, &mpi_data, &mpi_data_size);
	if (err)
	goto out;

	/* To avoid excessive use of secure memory we check that an MPI is
	not too large. */
	if (mpi_data_size > 520)
	{
	log_error (_("ssh keys greater than %d bits are not supported\n"), 4096);
	err = GPG_ERR_TOO_LARGE;
	goto out;
	}

	err = gcry_mpi_scan (&mpi, GCRYMPI_FMT_STD, mpi_data, mpi_data_size, NULL);
	if (err)
	goto out;

	*mpint = mpi;

	out:

	xfree (mpi_data);

	return err;
	}

	/* Write the MPI contained in MPINT to STREAM. */
	static gpg_error_t
	stream_write_mpi (estream_t stream, gcry_mpi_t mpint)
	{
	unsigned char *mpi_buffer;
	size_t mpi_buffer_n;
	gpg_error_t err;

	mpi_buffer = NULL;

	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &mpi_buffer, &mpi_buffer_n, mpint);
	if (err)
	goto out;

	err = stream_write_string (stream, mpi_buffer, mpi_buffer_n);

	out:

	xfree (mpi_buffer);

	return err;
	}


	/* Copy data from SRC to DST until EOF is reached. */
	static gpg_error_t
	stream_copy (estream_t dst, estream_t src)
	{
	char buffer[BUFSIZ];
	size_t bytes_read;
	gpg_error_t err;
	int ret;

	err = 0;
	while (1)
	{
	ret = es_read (src, buffer, sizeof (buffer), &bytes_read);
	if (ret \|\| (! bytes_read))
	{
	if (ret)
	err = gpg_error_from_syserror ();
	break;
	}
	ret = es_write (dst, buffer, bytes_read, NULL);
	if (ret)
	{
	err = gpg_error_from_syserror ();
	break;
	}
	}

	return err;
	}

	/* Open the ssh control file and create it if not available. With
	APPEND passed as true the file will be opened in append mode,
	otherwise in read only mode. On success 0 is returned and a new
	control file object stored at R_CF. On error an error code is
	returned and NULL is stored at R_CF. */
	static gpg_error_t
	open_control_file (ssh_control_file_t *r_cf, int append)
	{
	gpg_error_t err;
	ssh_control_file_t cf;

	cf = xtrycalloc (1, sizeof *cf);
	if (!cf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Note: As soon as we start to use non blocking functions here
	(i.e. where Pth might switch threads) we need to employ a
	mutex. */
	cf->fname = make_filename_try (gnupg_homedir (), SSH_CONTROL_FILE_NAME, NULL);
	if (!cf->fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* FIXME: With "a+" we are not able to check whether this will
	be created and thus the blurb needs to be written first. */
	cf->fp = fopen (cf->fname, append? "a+":"r");
	if (!cf->fp && errno == ENOENT)
	{
	estream_t stream = es_fopen (cf->fname, "wx,mode=-rw-r");
	if (!stream)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't create '%s': %s\n"),
	cf->fname, gpg_strerror (err));
	goto leave;
	}
	es_fputs (sshcontrolblurb, stream);
	es_fclose (stream);
	cf->fp = fopen (cf->fname, append? "a+":"r");
	}

	if (!cf->fp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't open '%s': %s\n"),
	cf->fname, gpg_strerror (err));
	goto leave;
	}

	err = 0;

	leave:
	if (err && cf)
	{
	if (cf->fp)
	fclose (cf->fp);
	xfree (cf->fname);
	xfree (cf);
	}
	else
	*r_cf = cf;

	return err;
	}


	static void
	rewind_control_file (ssh_control_file_t cf)
	{
	fseek (cf->fp, 0, SEEK_SET);
	cf->lnr = 0;
	clearerr (cf->fp);
	}


	static void
	close_control_file (ssh_control_file_t cf)
	{
	if (!cf)
	return;
	fclose (cf->fp);
	xfree (cf->fname);
	xfree (cf);
	}



	/* Read the next line from the control file and store the data in CF.
	Returns 0 on success, GPG_ERR_EOF on EOF, or other error codes. */
	static gpg_error_t
	read_control_file_item (ssh_control_file_t cf)
	{
	int c, i, n;
	char p, pend, line[256];
	long ttl = 0;

	cf->item.valid = 0;
	clearerr (cf->fp);

	do
	{
	if (!fgets (line, DIM(line)-1, cf->fp) )
	{
	if (feof (cf->fp))
	return gpg_error (GPG_ERR_EOF);
	return gpg_error_from_syserror ();
	}
	cf->lnr++;

	if (!*line \|\| line[strlen(line)-1] != '\n')
	{
	/* Eat until end of line */
	while ( (c=getc (cf->fp)) != EOF && c != '\n')
	;
	return gpg_error (*line? GPG_ERR_LINE_TOO_LONG
	: GPG_ERR_INCOMPLETE_LINE);
	}

	/* Allow for empty lines and spaces */
	for (p=line; spacep (p); p++)
	;
	}
	while (!p \|\| p == '\n' \|\| *p == '#');

	cf->item.disabled = 0;
	if (*p == '!')
	{
	cf->item.disabled = 1;
	for (p++; spacep (p); p++)
	;
	}

	for (i=0; hexdigitp (p) && i < 40; p++, i++)
	cf->item.hexgrip[i] = (p >= 'a'? (p & 0xdf): *p);
	cf->item.hexgrip[i] = 0;
	if (i != 40 \|\| !(spacep (p) \|\| *p == '\n'))
	{
	log_error ("%s:%d: invalid formatted line\n", cf->fname, cf->lnr);
	return gpg_error (GPG_ERR_BAD_DATA);
	}

	ttl = strtol (p, &pend, 10);
	p = pend;
	if (!(spacep (p) \|\| *p == '\n') \|\| (int)ttl < -1)
	{
	log_error ("%s:%d: invalid TTL value; assuming 0\n", cf->fname, cf->lnr);
	cf->item.ttl = 0;
	}
	cf->item.ttl = ttl;

	/* Now check for key-value pairs of the form NAME[=VALUE]. */
	cf->item.confirm = 0;
	while (*p)
	{
	for (; spacep (p) && *p != '\n'; p++)
	;
	if (!p \|\| p == '\n')
	break;
	n = strcspn (p, "= \t\n");
	if (p[n] == '=')
	{
	log_error ("%s:%d: assigning a value to a flag is not yet supported; "
	"flag ignored\n", cf->fname, cf->lnr);
	p++;
	}
	else if (n == 7 && !memcmp (p, "confirm", 7))
	{
	cf->item.confirm = 1;
	}
	else
	log_error ("%s:%d: invalid flag '%.*s'; ignored\n",
	cf->fname, cf->lnr, n, p);
	p += n;
	}

	/* log_debug ("%s:%d: grip=%s ttl=%d%s%s\n", */
	/* cf->fname, cf->lnr, */
	/* cf->item.hexgrip, cf->item.ttl, */
	/* cf->item.disabled? " disabled":"", */
	/* cf->item.confirm? " confirm":""); */

	cf->item.valid = 1;
	return 0; /* Okay: valid entry found. */
	}



	/* Search the control file CF from the beginning until a matching
	HEXGRIP is found; return success in this case and store true at
	DISABLED if the found key has been disabled. If R_TTL is not NULL
	a specified TTL for that key is stored there. If R_CONFIRM is not
	NULL it is set to 1 if the key has the confirm flag set. */
	static gpg_error_t
	search_control_file (ssh_control_file_t cf, const char *hexgrip,
	int r_disabled, int r_ttl, int *r_confirm)
	{
	gpg_error_t err;

	assert (strlen (hexgrip) == 40 );

	if (r_disabled)
	*r_disabled = 0;
	if (r_ttl)
	*r_ttl = 0;
	if (r_confirm)
	*r_confirm = 0;

	rewind_control_file (cf);
	while (!(err=read_control_file_item (cf)))
	{
	if (!cf->item.valid)
	continue; /* Should not happen. */
	if (!strcmp (hexgrip, cf->item.hexgrip))
	break;
	}
	if (!err)
	{
	if (r_disabled)
	*r_disabled = cf->item.disabled;
	if (r_ttl)
	*r_ttl = cf->item.ttl;
	if (r_confirm)
	*r_confirm = cf->item.confirm;
	}
	return err;
	}



	/* Add an entry to the control file to mark the key with the keygrip
	HEXGRIP as usable for SSH; i.e. it will be returned when ssh asks
	for it. FMTFPR is the fingerprint string. This function is in
	general used to add a key received through the ssh-add function.
	We can assume that the user wants to allow ssh using this key. */
	static gpg_error_t
	add_control_entry (ctrl_t ctrl, ssh_key_type_spec_t *spec,
	const char hexgrip, const char fmtfpr,
	int ttl, int confirm)
	{
	gpg_error_t err;
	ssh_control_file_t cf;
	int disabled;

	(void)ctrl;

	err = open_control_file (&cf, 1);
	if (err)
	return err;

	err = search_control_file (cf, hexgrip, &disabled, NULL, NULL);
	if (err && gpg_err_code(err) == GPG_ERR_EOF)
	{
	struct tm *tp;
	time_t atime = time (NULL);

	/* Not yet in the file - add it. Because the file has been
	opened in append mode, we simply need to write to it. */
	tp = localtime (&atime);
	fprintf (cf->fp,
	("# %s key added on: %04d-%02d-%02d %02d:%02d:%02d\n"
	"# MD5 Fingerprint: %s\n"
	"%s %d%s\n"),
	spec->name,
	1900+tp->tm_year, tp->tm_mon+1, tp->tm_mday,
	tp->tm_hour, tp->tm_min, tp->tm_sec,
	fmtfpr, hexgrip, ttl, confirm? " confirm":"");

	}
	close_control_file (cf);
	return 0;
	}


	/* Scan the sshcontrol file and return the TTL. */
	static int
	ttl_from_sshcontrol (const char *hexgrip)
	{
	ssh_control_file_t cf;
	int disabled, ttl;

	if (!hexgrip \|\| strlen (hexgrip) != 40)
	return 0; /* Wrong input: Use global default. */

	if (open_control_file (&cf, 0))
	return 0; /* Error: Use the global default TTL. */

	if (search_control_file (cf, hexgrip, &disabled, &ttl, NULL)
	\|\| disabled)
	ttl = 0; /* Use the global default if not found or disabled. */

	close_control_file (cf);

	return ttl;
	}


	/* Scan the sshcontrol file and return the confirm flag. */
	static int
	confirm_flag_from_sshcontrol (const char *hexgrip)
	{
	ssh_control_file_t cf;
	int disabled, confirm;

	if (!hexgrip \|\| strlen (hexgrip) != 40)
	return 1; /* Wrong input: Better ask for confirmation. */

	if (open_control_file (&cf, 0))
	return 1; /* Error: Better ask for confirmation. */

	if (search_control_file (cf, hexgrip, &disabled, NULL, &confirm)
	\|\| disabled)
	confirm = 0; /* If not found or disabled, there is no reason to
	ask for confirmation. */

	close_control_file (cf);

	return confirm;
	}




	/* Open the ssh control file for reading. This is a public version of
	open_control_file. The caller must use ssh_close_control_file to
	release the returned handle. */
	ssh_control_file_t
	ssh_open_control_file (void)
	{
	ssh_control_file_t cf;

	/* Then look at all the registered and non-disabled keys. */
	if (open_control_file (&cf, 0))
	return NULL;
	return cf;
	}

	/* Close an ssh control file handle. This is the public version of
	close_control_file. CF may be NULL. */
	void
	ssh_close_control_file (ssh_control_file_t cf)
	{
	close_control_file (cf);
	}

	/* Read the next item from the ssh control file. The function returns
	0 if a item was read, GPG_ERR_EOF on eof or another error value.
	R_HEXGRIP shall either be null or a BUFFER of at least 41 byte.
	R_DISABLED, R_TTLm and R_CONFIRM return flags from the control
	file; they are only set on success. */
	gpg_error_t
	ssh_read_control_file (ssh_control_file_t cf,
	char *r_hexgrip,
	int r_disabled, int r_ttl, int *r_confirm)
	{
	gpg_error_t err;

	do
	err = read_control_file_item (cf);
	while (!err && !cf->item.valid);
	if (!err)
	{
	if (r_hexgrip)
	strcpy (r_hexgrip, cf->item.hexgrip);
	if (r_disabled)
	*r_disabled = cf->item.disabled;
	if (r_ttl)
	*r_ttl = cf->item.ttl;
	if (r_confirm)
	*r_confirm = cf->item.confirm;
	}
	return err;
	}


	/* Search for a key with HEXGRIP in sshcontrol and return all
	info. */
	gpg_error_t
	ssh_search_control_file (ssh_control_file_t cf,
	const char *hexgrip,
	int r_disabled, int r_ttl, int *r_confirm)
	{
	gpg_error_t err;
	int i;
	const char *s;
	char uphexgrip[41];

	/* We need to make sure that HEXGRIP is all uppercase. The easiest
	way to do this and also check its length is by copying to a
	second buffer. */
	for (i=0, s=hexgrip; i < 40 && *s; s++, i++)
	uphexgrip[i] = s >= 'a'? (s & 0xdf): *s;
	uphexgrip[i] = 0;
	if (i != 40)
	err = gpg_error (GPG_ERR_INV_LENGTH);
	else
	err = search_control_file (cf, uphexgrip, r_disabled, r_ttl, r_confirm);
	if (gpg_err_code (err) == GPG_ERR_EOF)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	return err;
	}




	/*

	MPI lists.

	*/

	/* Free the list of MPIs MPI_LIST. */
	static void
	mpint_list_free (gcry_mpi_t *mpi_list)
	{
	if (mpi_list)
	{
	unsigned int i;

	for (i = 0; mpi_list[i]; i++)
	gcry_mpi_release (mpi_list[i]);
	xfree (mpi_list);
	}
	}

	/* Receive key material MPIs from STREAM according to KEY_SPEC;
	depending on SECRET expect a public key or secret key. CERT is the
	certificate blob used if KEY_SPEC indicates the certificate format;
	it needs to be positioned to the end of the nonce. The newly
	allocated list of MPIs is stored in MPI_LIST. Returns usual error
	code. */
	static gpg_error_t
	ssh_receive_mpint_list (estream_t stream, int secret,
	ssh_key_type_spec_t *spec, estream_t cert,
	gcry_mpi_t **mpi_list)
	{
	const char *elems_public;
	unsigned int elems_n;
	const char *elems;
	int elem_is_secret;
	gcry_mpi_t *mpis = NULL;
	gpg_error_t err = 0;
	unsigned int i;

	if (secret)
	elems = spec->elems_key_secret;
	else
	elems = spec->elems_key_public;
	elems_n = strlen (elems);
	elems_public = spec->elems_key_public;

	/* Check that either both, CERT and the WITH_CERT flag, are given or
	none of them. */
	if (!(!!(spec->flags & SPEC_FLAG_WITH_CERT) ^ !cert))
	{
	err = gpg_error (GPG_ERR_INV_CERT_OBJ);
	goto out;
	}

	mpis = xtrycalloc (elems_n + 1, sizeof *mpis );
	if (!mpis)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	elem_is_secret = 0;
	for (i = 0; i < elems_n; i++)
	{
	if (secret)
	elem_is_secret = !strchr (elems_public, elems[i]);

	if (cert && !elem_is_secret)
	err = stream_read_mpi (cert, elem_is_secret, &mpis[i]);
	else
	err = stream_read_mpi (stream, elem_is_secret, &mpis[i]);
	if (err)
	goto out;
	}

	*mpi_list = mpis;
	mpis = NULL;

	out:
	if (err)
	mpint_list_free (mpis);

	return err;
	}



	/* Key modifier function for RSA. */
	static gpg_error_t
	ssh_key_modifier_rsa (const char elems, gcry_mpi_t mpis)
	{
	gcry_mpi_t p;
	gcry_mpi_t q;
	gcry_mpi_t u;

	if (strcmp (elems, "nedupq"))
	/* Modifying only necessary for secret keys. */
	goto out;

	u = mpis[3];
	p = mpis[4];
	q = mpis[5];

	if (gcry_mpi_cmp (p, q) > 0)
	{
	/* P shall be smaller then Q! Swap primes. iqmp becomes u. */
	gcry_mpi_t tmp;

	tmp = mpis[4];
	mpis[4] = mpis[5];
	mpis[5] = tmp;
	}
	else
	/* U needs to be recomputed. */
	gcry_mpi_invm (u, p, q);

	out:

	return 0;
	}

	/* Signature encoder function for RSA. */
	static gpg_error_t
	ssh_signature_encoder_rsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t s_signature)
	{
	gpg_error_t err = 0;
	gcry_sexp_t valuelist = NULL;
	gcry_sexp_t sublist = NULL;
	gcry_mpi_t sig_value = NULL;
	gcry_mpi_t *mpis = NULL;
	const char *elems;
	size_t elems_n;
	int i;

	unsigned char *data;
	size_t data_n;
	gcry_mpi_t s;

	valuelist = gcry_sexp_nth (s_signature, 1);
	if (!valuelist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	elems = spec->elems_signature;
	elems_n = strlen (elems);

	mpis = xtrycalloc (elems_n + 1, sizeof *mpis);
	if (!mpis)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	for (i = 0; i < elems_n; i++)
	{
	sublist = gcry_sexp_find_token (valuelist, spec->elems_signature + i, 1);
	if (!sublist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	break;
	}

	sig_value = gcry_sexp_nth_mpi (sublist, 1, GCRYMPI_FMT_USG);
	if (!sig_value)
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* FIXME? */
	break;
	}
	gcry_sexp_release (sublist);
	sublist = NULL;

	mpis[i] = sig_value;
	}
	if (err)
	goto out;

	/* RSA specific */
	s = mpis[0];

	err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &data, &data_n, s);
	if (err)
	goto out;

	err = stream_write_string (signature_blob, data, data_n);
	xfree (data);

	out:
	gcry_sexp_release (valuelist);
	gcry_sexp_release (sublist);
	mpint_list_free (mpis);
	return err;
	}


	/* Signature encoder function for DSA. */
	static gpg_error_t
	ssh_signature_encoder_dsa (ssh_key_type_spec_t *spec,
	estream_t signature_blob,
	gcry_sexp_t s_signature)
	{
	gpg_error_t err = 0;
	gcry_sexp_t valuelist = NULL;
	gcry_sexp_t sublist = NULL;
	gcry_mpi_t sig_value = NULL;
	gcry_mpi_t *mpis = NULL;
	const char *elems;
	size_t elems_n;
	int i;

	unsigned char buffer[SSH_DSA_SIGNATURE_PADDING * SSH_DSA_SIGNATURE_ELEMS];
	unsigned char *data = NULL;
	size_t data_n;

	valuelist = gcry_sexp_nth (s_signature, 1);
	if (!valuelist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	elems = spec->elems_signature;
	elems_n = strlen (elems);

	mpis = xtrycalloc (elems_n + 1, sizeof *mpis);
	if (!mpis)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	for (i = 0; i < elems_n; i++)
	{
	sublist = gcry_sexp_find_token (valuelist, spec->elems_signature + i, 1);
	if (!sublist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	break;
	}

	sig_value = gcry_sexp_nth_mpi (sublist, 1, GCRYMPI_FMT_USG);
	if (!sig_value)
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* FIXME? */
	break;
	}
	gcry_sexp_release (sublist);
	sublist = NULL;

	mpis[i] = sig_value;
	}
	if (err)
	goto out;

	/* DSA specific code. */

	/* FIXME: Why this complicated code? Why collecting boths mpis in a
	buffer instead of writing them out one after the other? */
	for (i = 0; i < 2; i++)
	{
	err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &data, &data_n, mpis[i]);
	if (err)
	break;

	if (data_n > SSH_DSA_SIGNATURE_PADDING)
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* FIXME? */
	break;
	}

	memset (buffer + (i * SSH_DSA_SIGNATURE_PADDING), 0,
	SSH_DSA_SIGNATURE_PADDING - data_n);
	memcpy (buffer + (i * SSH_DSA_SIGNATURE_PADDING)
	+ (SSH_DSA_SIGNATURE_PADDING - data_n), data, data_n);

	xfree (data);
	data = NULL;
	}
	if (err)
	goto out;

	err = stream_write_string (signature_blob, buffer, sizeof (buffer));

	out:
	xfree (data);
	gcry_sexp_release (valuelist);
	gcry_sexp_release (sublist);
	mpint_list_free (mpis);
	return err;
	}


	/* Signature encoder function for ECDSA. */
	static gpg_error_t
	ssh_signature_encoder_ecdsa (ssh_key_type_spec_t *spec,
	estream_t stream, gcry_sexp_t s_signature)
	{
	gpg_error_t err = 0;
	gcry_sexp_t valuelist = NULL;
	gcry_sexp_t sublist = NULL;
	gcry_mpi_t sig_value = NULL;
	gcry_mpi_t *mpis = NULL;
	const char *elems;
	size_t elems_n;
	int i;

	unsigned char *data[2] = {NULL, NULL};
	size_t data_n[2];
	size_t innerlen;

	valuelist = gcry_sexp_nth (s_signature, 1);
	if (!valuelist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	elems = spec->elems_signature;
	elems_n = strlen (elems);

	mpis = xtrycalloc (elems_n + 1, sizeof *mpis);
	if (!mpis)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	for (i = 0; i < elems_n; i++)
	{
	sublist = gcry_sexp_find_token (valuelist, spec->elems_signature + i, 1);
	if (!sublist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	break;
	}

	sig_value = gcry_sexp_nth_mpi (sublist, 1, GCRYMPI_FMT_USG);
	if (!sig_value)
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* FIXME? */
	break;
	}
	gcry_sexp_release (sublist);
	sublist = NULL;

	mpis[i] = sig_value;
	}
	if (err)
	goto out;

	/* ECDSA specific */

	innerlen = 0;
	for (i = 0; i < DIM(data); i++)
	{
	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &data[i], &data_n[i], mpis[i]);
	if (err)
	goto out;
	innerlen += 4 + data_n[i];
	}

	err = stream_write_uint32 (stream, innerlen);
	if (err)
	goto out;

	for (i = 0; i < DIM(data); i++)
	{
	err = stream_write_string (stream, data[i], data_n[i]);
	if (err)
	goto out;
	}

	out:
	for (i = 0; i < DIM(data); i++)
	xfree (data[i]);
	gcry_sexp_release (valuelist);
	gcry_sexp_release (sublist);
	mpint_list_free (mpis);
	return err;
	}


	/* Signature encoder function for EdDSA. */
	static gpg_error_t
	ssh_signature_encoder_eddsa (ssh_key_type_spec_t *spec,
	estream_t stream, gcry_sexp_t s_signature)
	{
	gpg_error_t err = 0;
	gcry_sexp_t valuelist = NULL;
	gcry_sexp_t sublist = NULL;
	const char *elems;
	size_t elems_n;
	int i;

	unsigned char *data[2] = {NULL, NULL};
	size_t data_n[2];
	size_t totallen = 0;

	valuelist = gcry_sexp_nth (s_signature, 1);
	if (!valuelist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	elems = spec->elems_signature;
	elems_n = strlen (elems);

	if (elems_n != DIM(data))
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	for (i = 0; i < DIM(data); i++)
	{
	sublist = gcry_sexp_find_token (valuelist, spec->elems_signature + i, 1);
	if (!sublist)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	break;
	}

	data[i] = gcry_sexp_nth_buffer (sublist, 1, &data_n[i]);
	if (!data[i])
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* FIXME? */
	break;
	}
	totallen += data_n[i];
	gcry_sexp_release (sublist);
	sublist = NULL;
	}
	if (err)
	goto out;

	err = stream_write_uint32 (stream, totallen);
	if (err)
	goto out;

	for (i = 0; i < DIM(data); i++)
	{
	err = stream_write_data (stream, data[i], data_n[i]);
	if (err)
	goto out;
	}

	out:
	for (i = 0; i < DIM(data); i++)
	xfree (data[i]);
	gcry_sexp_release (valuelist);
	gcry_sexp_release (sublist);
	return err;
	}


	/*
	S-Expressions.
	*/


	/* This function constructs a new S-Expression for the key identified
	by the KEY_SPEC, SECRET, CURVE_NAME, MPIS, and COMMENT, which is to
	be stored at R_SEXP. Returns an error code. */
	static gpg_error_t
	sexp_key_construct (gcry_sexp_t *r_sexp,
	ssh_key_type_spec_t key_spec, int secret,
	const char curve_name, gcry_mpi_t mpis,
	const char *comment)
	{
	gpg_error_t err;
	gcry_sexp_t sexp_new = NULL;
	void *formatbuf = NULL;
	void **arg_list = NULL;
	estream_t format = NULL;
	char *algo_name = NULL;

	if ((key_spec.flags & SPEC_FLAG_IS_EdDSA))
	{
	/* It is much easier and more readable to use a separate code
	path for EdDSA. */
	if (!curve_name)
	err = gpg_error (GPG_ERR_INV_CURVE);
	else if (!mpis[0] \|\| !gcry_mpi_get_flag (mpis[0], GCRYMPI_FLAG_OPAQUE))
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	else if (secret
	&& (!mpis[1]
	\|\| !gcry_mpi_get_flag (mpis[1], GCRYMPI_FLAG_OPAQUE)))
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	else if (secret)
	err = gcry_sexp_build (&sexp_new, NULL,
	"(private-key(ecc(curve %s)"
	"(flags eddsa)(q %m)(d %m))"
	"(comment%s))",
	curve_name,
	mpis[0], mpis[1],
	comment? comment:"");
	else
	err = gcry_sexp_build (&sexp_new, NULL,
	"(public-key(ecc(curve %s)"
	"(flags eddsa)(q %m))"
	"(comment%s))",
	curve_name,
	mpis[0],
	comment? comment:"");
	}
	else
	{
	const char *key_identifier[] = { "public-key", "private-key" };
	int arg_idx;
	const char *elems;
	size_t elems_n;
	unsigned int i, j;

	if (secret)
	elems = key_spec.elems_sexp_order;
	else
	elems = key_spec.elems_key_public;
	elems_n = strlen (elems);

	format = es_fopenmem (0, "a+b");
	if (!format)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	/* Key identifier, algorithm identifier, mpis, comment, and a NULL
	as a safeguard. */
	arg_list = xtrymalloc (sizeof (arg_list) (2 + 1 + elems_n + 1 + 1));
	if (!arg_list)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	arg_idx = 0;

	es_fputs ("(%s(%s", format);
	arg_list[arg_idx++] = &key_identifier[secret];
	algo_name = xtrystrdup (gcry_pk_algo_name (key_spec.algo));
	if (!algo_name)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	strlwr (algo_name);
	arg_list[arg_idx++] = &algo_name;
	if (curve_name)
	{
	es_fputs ("(curve%s)", format);
	arg_list[arg_idx++] = &curve_name;
	}

	for (i = 0; i < elems_n; i++)
	{
	es_fprintf (format, "(%c%%m)", elems[i]);
	if (secret)
	{
	for (j = 0; j < elems_n; j++)
	if (key_spec.elems_key_secret[j] == elems[i])
	break;
	}
	else
	j = i;
	arg_list[arg_idx++] = &mpis[j];
	}
	es_fputs (")(comment%s))", format);
	arg_list[arg_idx++] = &comment;
	arg_list[arg_idx] = NULL;

	es_putc (0, format);
	if (es_ferror (format))
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	if (es_fclose_snatch (format, &formatbuf, NULL))
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	format = NULL;

	err = gcry_sexp_build_array (&sexp_new, NULL, formatbuf, arg_list);
	}

	if (!err)
	*r_sexp = sexp_new;

	out:
	es_fclose (format);
	xfree (arg_list);
	xfree (formatbuf);
	xfree (algo_name);

	return err;
	}


	/* This function extracts the key from the s-expression SEXP according
	to KEY_SPEC and stores it in ssh format at (R_BLOB, R_BLOBLEN). If
	WITH_SECRET is true, the secret key parts are also extracted if
	possible. Returns 0 on success or an error code. Note that data
	stored at R_BLOB must be freed using es_free! */
	static gpg_error_t
	ssh_key_to_blob (gcry_sexp_t sexp, int with_secret,
	ssh_key_type_spec_t key_spec,
	void *r_blob, size_t r_blob_size)
	{
	gpg_error_t err = 0;
	gcry_sexp_t value_list = NULL;
	gcry_sexp_t value_pair = NULL;
	char *curve_name = NULL;
	estream_t stream = NULL;
	void *blob = NULL;
	size_t blob_size;
	const char elems, p_elems;
	const char *data;
	size_t datalen;

	*r_blob = NULL;
	*r_blob_size = 0;

	stream = es_fopenmem (0, "r+b");
	if (!stream)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	/* Get the type of the key extpression. */
	data = gcry_sexp_nth_data (sexp, 0, &datalen);
	if (!data)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	if ((datalen == 10 && !strncmp (data, "public-key", 10))
	\|\| (datalen == 21 && !strncmp (data, "protected-private-key", 21))
	\|\| (datalen == 20 && !strncmp (data, "shadowed-private-key", 20)))
	elems = key_spec.elems_key_public;
	else if (datalen == 11 && !strncmp (data, "private-key", 11))
	elems = with_secret? key_spec.elems_key_secret : key_spec.elems_key_public;
	else
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	/* Get key value list. */
	value_list = gcry_sexp_cadr (sexp);
	if (!value_list)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}

	/* Write the ssh algorithm identifier. */
	if ((key_spec.flags & SPEC_FLAG_IS_ECDSA))
	{
	/* Parse the "curve" parameter. We currently expect the curve
	name for ECC and not the parameters of the curve. This can
	easily be changed but then we need to find the curve name
	from the parameters using gcry_pk_get_curve. */
	const char *mapped;
	const char *sshname;

	gcry_sexp_release (value_pair);
	value_pair = gcry_sexp_find_token (value_list, "curve", 5);
	if (!value_pair)
	{
	err = gpg_error (GPG_ERR_INV_CURVE);
	goto out;
	}
	curve_name = gcry_sexp_nth_string (value_pair, 1);
	if (!curve_name)
	{
	err = gpg_error (GPG_ERR_INV_CURVE); /* (Or out of core.) */
	goto out;
	}

	/* Fixme: The mapping should be done by using gcry_pk_get_curve
	et al to iterate over all name aliases. */
	if (!strcmp (curve_name, "NIST P-256"))
	mapped = "nistp256";
	else if (!strcmp (curve_name, "NIST P-384"))
	mapped = "nistp384";
	else if (!strcmp (curve_name, "NIST P-521"))
	mapped = "nistp521";
	else
	mapped = NULL;
	if (mapped)
	{
	xfree (curve_name);
	curve_name = xtrystrdup (mapped);
	if (!curve_name)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	}

	sshname = ssh_identifier_from_curve_name (curve_name);
	if (!sshname)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
	goto out;
	}
	err = stream_write_cstring (stream, sshname);
	if (err)
	goto out;
	err = stream_write_cstring (stream, curve_name);
	if (err)
	goto out;
	}
	else
	{
	/* Note: This is also used for EdDSA. */
	err = stream_write_cstring (stream, key_spec.ssh_identifier);
	if (err)
	goto out;
	}

	/* Write the parameters. */
	for (p_elems = elems; *p_elems; p_elems++)
	{
	gcry_sexp_release (value_pair);
	value_pair = gcry_sexp_find_token (value_list, p_elems, 1);
	if (!value_pair)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}
	if ((key_spec.flags & SPEC_FLAG_IS_EdDSA))
	{

	data = gcry_sexp_nth_data (value_pair, 1, &datalen);
	if (!data)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}
	if (*p_elems == 'q' && datalen)
	{ /* Remove the prefix 0x40. */
	data++;
	datalen--;
	}
	err = stream_write_string (stream, data, datalen);
	if (err)
	goto out;
	}
	else
	{
	gcry_mpi_t mpi;

	/* Note that we need to use STD format; i.e. prepend a 0x00
	to indicate a positive number if the high bit is set. */
	mpi = gcry_sexp_nth_mpi (value_pair, 1, GCRYMPI_FMT_STD);
	if (!mpi)
	{
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto out;
	}
	err = stream_write_mpi (stream, mpi);
	gcry_mpi_release (mpi);
	if (err)
	goto out;
	}
	}

	if (es_fclose_snatch (stream, &blob, &blob_size))
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	stream = NULL;

	*r_blob = blob;
	blob = NULL;
	*r_blob_size = blob_size;

	out:
	gcry_sexp_release (value_list);
	gcry_sexp_release (value_pair);
	xfree (curve_name);
	es_fclose (stream);
	es_free (blob);

	return err;
	}


	/*

	Key I/O.

	*/

	/* Search for a key specification entry. If SSH_NAME is not NULL,
	search for an entry whose "ssh_name" is equal to SSH_NAME;
	otherwise, search for an entry whose algorithm is equal to ALGO.
	Store found entry in SPEC on success, return error otherwise. */
	static gpg_error_t
	ssh_key_type_lookup (const char *ssh_name, int algo,
	ssh_key_type_spec_t *spec)
	{
	gpg_error_t err;
	unsigned int i;

	for (i = 0; i < DIM (ssh_key_types); i++)
	if ((ssh_name && (! strcmp (ssh_name, ssh_key_types[i].ssh_identifier)))
	\|\| algo == ssh_key_types[i].algo)
	break;

	if (i == DIM (ssh_key_types))
	err = gpg_error (GPG_ERR_NOT_FOUND);
	else
	{
	*spec = ssh_key_types[i];
	err = 0;
	}

	return err;
	}


	/* Receive a key from STREAM, according to the key specification given
	as KEY_SPEC. Depending on SECRET, receive a secret or a public
	key. If READ_COMMENT is true, receive a comment string as well.
	Constructs a new S-Expression from received data and stores it in
	KEY_NEW. Returns zero on success or an error code. */
	static gpg_error_t
	ssh_receive_key (estream_t stream, gcry_sexp_t *key_new, int secret,
	int read_comment, ssh_key_type_spec_t *key_spec)
	{
	gpg_error_t err;
	char *key_type = NULL;
	char *comment = NULL;
	estream_t cert = NULL;
	gcry_sexp_t key = NULL;
	ssh_key_type_spec_t spec;
	gcry_mpi_t *mpi_list = NULL;
	const char *elems;
	char *curve_name = NULL;


	err = stream_read_cstring (stream, &key_type);
	if (err)
	goto out;

	err = ssh_key_type_lookup (key_type, 0, &spec);
	if (err)
	goto out;

	if ((spec.flags & SPEC_FLAG_WITH_CERT))
	{
	/* This is an OpenSSH certificate+private key. The certificate
	is an SSH string and which we store in an estream object. */
	unsigned char *buffer;
	u32 buflen;
	char *cert_key_type;

	err = stream_read_string (stream, 0, &buffer, &buflen);
	if (err)
	goto out;
	cert = es_fopenmem_init (0, "rb", buffer, buflen);
	xfree (buffer);
	if (!cert)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	/* Check that the key type matches. */
	err = stream_read_cstring (cert, &cert_key_type);
	if (err)
	goto out;
	if (strcmp (cert_key_type, key_type) )
	{
	xfree (cert_key_type);
	log_error ("key types in received ssh certificate do not match\n");
	err = gpg_error (GPG_ERR_INV_CERT_OBJ);
	goto out;
	}
	xfree (cert_key_type);

	/* Skip the nonce. */
	err = stream_read_string (cert, 0, NULL, NULL);
	if (err)
	goto out;
	}

	if ((spec.flags & SPEC_FLAG_IS_EdDSA))
	{
	/* The format of an EdDSA key is:
	* string key_type ("ssh-ed25519")
	* string public_key
	* string private_key
	*
	* Note that the private key is the concatenation of the private
	* key with the public key. Thus theres are 64 bytes; however
	* we only want the real 32 byte private key - Libgcrypt expects
	* this.
	*/
	mpi_list = xtrycalloc (3, sizeof *mpi_list);
	if (!mpi_list)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	err = stream_read_blob (cert? cert : stream, 0, &mpi_list[0]);
	if (err)
	goto out;
	if (secret)
	{
	u32 len = 0;
	unsigned char *buffer;

	/* Read string length. */
	err = stream_read_uint32 (stream, &len);
	if (err)
	goto out;
	if (len != 32 && len != 64)
	{
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto out;
	}
	buffer = xtrymalloc_secure (32);
	if (!buffer)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	err = stream_read_data (stream, buffer, 32);
	if (err)
	{
	xfree (buffer);
	goto out;
	}
	mpi_list[1] = gcry_mpi_set_opaque (NULL, buffer, 8*32);
	buffer = NULL;
	if (len == 64)
	{
	err = stream_read_skip (stream, 32);
	if (err)
	goto out;
	}
	}
	}
	else if ((spec.flags & SPEC_FLAG_IS_ECDSA))
	{
	/* The format of an ECDSA key is:
	* string key_type ("ecdsa-sha2-nistp256" \|
	* "ecdsa-sha2-nistp384" \|
	* "ecdsa-sha2-nistp521" )
	* string ecdsa_curve_name
	* string ecdsa_public_key
	* mpint ecdsa_private
	*
	* Note that we use the mpint reader instead of the string
	* reader for ecsa_public_key. For the certificate variante
	* ecdsa_curve_name+ecdsa_public_key are replaced by the
	* certificate.
	*/
	unsigned char *buffer;
	const char *mapped;

	err = stream_read_string (cert? cert : stream, 0, &buffer, NULL);
	if (err)
	goto out;
	curve_name = buffer;
	/* Fixme: Check that curve_name matches the keytype. */
	/* Because Libgcrypt < 1.6 has no support for the "nistpNNN"
	curve names, we need to translate them here to Libgcrypt's
	native names. */
	if (!strcmp (curve_name, "nistp256"))
	mapped = "NIST P-256";
	else if (!strcmp (curve_name, "nistp384"))
	mapped = "NIST P-384";
	else if (!strcmp (curve_name, "nistp521"))
	mapped = "NIST P-521";
	else
	mapped = NULL;
	if (mapped)
	{
	xfree (curve_name);
	curve_name = xtrystrdup (mapped);
	if (!curve_name)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	}

	err = ssh_receive_mpint_list (stream, secret, &spec, cert, &mpi_list);
	if (err)
	goto out;
	}
	else
	{
	err = ssh_receive_mpint_list (stream, secret, &spec, cert, &mpi_list);
	if (err)
	goto out;
	}

	if (read_comment)
	{
	err = stream_read_cstring (stream, &comment);
	if (err)
	goto out;
	}

	if (secret)
	elems = spec.elems_key_secret;
	else
	elems = spec.elems_key_public;

	if (spec.key_modifier)
	{
	err = (*spec.key_modifier) (elems, mpi_list);
	if (err)
	goto out;
	}

	if ((spec.flags & SPEC_FLAG_IS_EdDSA))
	{
	if (secret)
	{
	err = gcry_sexp_build (&key, NULL,
	"(private-key(ecc(curve \"Ed25519\")"
	"(flags eddsa)(q %m)(d %m))"
	"(comment%s))",
	mpi_list[0], mpi_list[1],
	comment? comment:"");
	}
	else
	{
	err = gcry_sexp_build (&key, NULL,
	"(public-key(ecc(curve \"Ed25519\")"
	"(flags eddsa)(q %m))"
	"(comment%s))",
	mpi_list[0],
	comment? comment:"");
	}
	}
	else
	{
	err = sexp_key_construct (&key, spec, secret, curve_name, mpi_list,
	comment? comment:"");
	if (err)
	goto out;
	}

	if (key_spec)
	*key_spec = spec;
	*key_new = key;

	out:
	es_fclose (cert);
	mpint_list_free (mpi_list);
	xfree (curve_name);
	xfree (key_type);
	xfree (comment);

	return err;
	}


	/* Write the public key from KEY to STREAM in SSH key format. If
	OVERRIDE_COMMENT is not NULL, it will be used instead of the
	comment stored in the key. */
	static gpg_error_t
	ssh_send_key_public (estream_t stream, gcry_sexp_t key,
	const char *override_comment)
	{
	ssh_key_type_spec_t spec;
	int algo;
	char *comment = NULL;
	void *blob = NULL;
	size_t bloblen;
	gpg_error_t err = 0;

	algo = get_pk_algo_from_key (key);
	if (algo == 0)
	goto out;

	err = ssh_key_type_lookup (NULL, algo, &spec);
	if (err)
	goto out;

	err = ssh_key_to_blob (key, 0, spec, &blob, &bloblen);
	if (err)
	goto out;

	err = stream_write_string (stream, blob, bloblen);
	if (err)
	goto out;

	if (override_comment)
	err = stream_write_cstring (stream, override_comment);
	else
	{
	err = ssh_key_extract_comment (key, &comment);
	if (err)
	err = stream_write_cstring (stream, "(none)");
	else
	err = stream_write_cstring (stream, comment);
	}
	if (err)
	goto out;

	out:
	xfree (comment);
	es_free (blob);

	return err;
	}


	/* Read a public key out of BLOB/BLOB_SIZE according to the key
	specification given as KEY_SPEC, storing the new key in KEY_PUBLIC.
	Returns zero on success or an error code. */
	static gpg_error_t
	ssh_read_key_public_from_blob (unsigned char *blob, size_t blob_size,
	gcry_sexp_t *key_public,
	ssh_key_type_spec_t *key_spec)
	{
	gpg_error_t err;
	estream_t blob_stream;

	blob_stream = es_fopenmem (0, "r+b");
	if (!blob_stream)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	err = stream_write_data (blob_stream, blob, blob_size);
	if (err)
	goto out;

	err = es_fseek (blob_stream, 0, SEEK_SET);
	if (err)
	goto out;

	err = ssh_receive_key (blob_stream, key_public, 0, 0, key_spec);

	out:
	es_fclose (blob_stream);
	return err;
	}



	/* This function calculates the key grip for the key contained in the
	S-Expression KEY and writes it to BUFFER, which must be large
	enough to hold it. Returns usual error code. */
	static gpg_error_t
	ssh_key_grip (gcry_sexp_t key, unsigned char *buffer)
	{
	if (!gcry_pk_get_keygrip (key, buffer))
	{
	gpg_error_t err = gcry_pk_testkey (key);
	return err? err : gpg_error (GPG_ERR_INTERNAL);
	}

	return 0;
	}


	static gpg_error_t
	card_key_list (ctrl_t ctrl, char *r_serialno, strlist_t result)
	{
	gpg_error_t err;

	*r_serialno = NULL;
	*result = NULL;

	err = agent_card_serialno (ctrl, r_serialno, NULL);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_ENODEV)
	return 0; /* Nothing available. */

	if (opt.verbose)
	log_info (_("error getting serial number of card: %s\n"),
	gpg_strerror (err));
	return err;
	}

	err = agent_card_cardlist (ctrl, result);
	if (err)
	{
	xfree (*r_serialno);
	*r_serialno = NULL;
	}
	return err;
	}

	/* Check whether a smartcard is available and whether it has a usable
	key. Store a copy of that key at R_PK and return 0. If no key is
	available store NULL at R_PK and return an error code. If CARDSN
	is not NULL, a string with the serial number of the card will be
	a malloced and stored there. */
	static gpg_error_t
	card_key_available (ctrl_t ctrl, gcry_sexp_t r_pk, char *cardsn)
	{
	gpg_error_t err;
	char *authkeyid;
	char *serialno = NULL;
	unsigned char *pkbuf;
	size_t pkbuflen;
	gcry_sexp_t s_pk;
	unsigned char grip[20];

	*r_pk = NULL;
	if (cardsn)
	*cardsn = NULL;

	/* First see whether a card is available and whether the application
	is supported. */
	err = agent_card_getattr (ctrl, "$AUTHKEYID", &authkeyid);
	if ( gpg_err_code (err) == GPG_ERR_CARD_REMOVED )
	{
	/* Ask for the serial number to reset the card. */
	err = agent_card_serialno (ctrl, &serialno, NULL);
	if (err)
	{
	if (opt.verbose)
	log_info (_("error getting serial number of card: %s\n"),
	gpg_strerror (err));
	return err;
	}
	log_info (_("detected card with S/N: %s\n"), serialno);
	err = agent_card_getattr (ctrl, "$AUTHKEYID", &authkeyid);
	}
	if (err)
	{
	log_error (_("no authentication key for ssh on card: %s\n"),
	gpg_strerror (err));
	xfree (serialno);
	return err;
	}

	/* Get the S/N if we don't have it yet. Use the fast getattr method. */
	if (!serialno && (err = agent_card_getattr (ctrl, "SERIALNO", &serialno)) )
	{
	log_error (_("error getting serial number of card: %s\n"),
	gpg_strerror (err));
	xfree (authkeyid);
	return err;
	}

	/* Read the public key. */
	err = agent_card_readkey (ctrl, authkeyid, &pkbuf);
	if (err)
	{
	if (opt.verbose)
	log_info (_("no suitable card key found: %s\n"), gpg_strerror (err));
	xfree (serialno);
	xfree (authkeyid);
	return err;
	}

	pkbuflen = gcry_sexp_canon_len (pkbuf, 0, NULL, NULL);
	err = gcry_sexp_sscan (&s_pk, NULL, (char*)pkbuf, pkbuflen);
	if (err)
	{
	log_error ("failed to build S-Exp from received card key: %s\n",
	gpg_strerror (err));
	xfree (pkbuf);
	xfree (serialno);
	xfree (authkeyid);
	return err;
	}

	err = ssh_key_grip (s_pk, grip);
	if (err)
	{
	log_debug ("error computing keygrip from received card key: %s\n",
	gcry_strerror (err));
	xfree (pkbuf);
	gcry_sexp_release (s_pk);
	xfree (serialno);
	xfree (authkeyid);
	return err;
	}

	if ( agent_key_available (grip) )
	{
	/* (Shadow)-key is not available in our key storage. */
	err = agent_write_shadow_key (grip, serialno, authkeyid, pkbuf, 0);
	if (err)
	{
	xfree (pkbuf);
	gcry_sexp_release (s_pk);
	xfree (serialno);
	xfree (authkeyid);
	return err;
	}
	}

	if (cardsn)
	{
	char *dispsn;

	/* If the card handler is able to return a short serialnumber,
	use that one, else use the complete serialno. */
	if (!agent_card_getattr (ctrl, "$DISPSERIALNO", &dispsn))
	{
	*cardsn = xtryasprintf ("cardno:%s", dispsn);
	xfree (dispsn);
	}
	else
	*cardsn = xtryasprintf ("cardno:%s", serialno);
	if (!*cardsn)
	{
	err = gpg_error_from_syserror ();
	xfree (pkbuf);
	gcry_sexp_release (s_pk);
	xfree (serialno);
	xfree (authkeyid);
	return err;
	}
	}

	xfree (pkbuf);
	xfree (serialno);
	xfree (authkeyid);
	*r_pk = s_pk;
	return 0;
	}




	/*

	Request handler. Each handler is provided with a CTRL context, a
	REQUEST object and a RESPONSE object. The actual request is to be
	read from REQUEST, the response needs to be written to RESPONSE.

	*/


	/* Handler for the "request_identities" command. */
	static gpg_error_t
	ssh_handler_request_identities (ctrl_t ctrl,
	estream_t request, estream_t response)
	{
	u32 key_counter;
	estream_t key_blobs;
	gcry_sexp_t key_public;
	gpg_error_t err;
	int ret;
	ssh_control_file_t cf = NULL;
	char *cardsn;
	gpg_error_t ret_err;

	(void)request;

	/* Prepare buffer stream. */

	key_public = NULL;
	key_counter = 0;
	err = 0;

	key_blobs = es_fopenmem (0, "r+b");
	if (! key_blobs)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	/* First check whether a key is currently available in the card
	reader - this should be allowed even without being listed in
	sshcontrol. */

	if (!opt.disable_scdaemon)
	{
	char *serialno;
	strlist_t card_list, sl;

	err = card_key_list (ctrl, &serialno, &card_list);
	if (err)
	{
	if (opt.verbose)
	log_info (_("error getting list of cards: %s\n"),
	gpg_strerror (err));
	goto out;
	}

	for (sl = card_list; sl; sl = sl->next)
	{
	char *serialno0;
	err = agent_card_serialno (ctrl, &serialno0, sl->d);
	if (err)
	{
	if (opt.verbose)
	log_info (_("error getting serial number of card: %s\n"),
	gpg_strerror (err));
	xfree (serialno);
	free_strlist (card_list);
	goto out;
	}

	xfree (serialno0);
	if (card_key_available (ctrl, &key_public, &cardsn))
	continue;

	err = ssh_send_key_public (key_blobs, key_public, cardsn);
	gcry_sexp_release (key_public);
	key_public = NULL;
	xfree (cardsn);
	if (err)
	{
	xfree (serialno);
	free_strlist (card_list);
	goto out;
	}

	key_counter++;
	}

	xfree (serialno);
	free_strlist (card_list);
	}

	/* Then look at all the registered and non-disabled keys. */
	err = open_control_file (&cf, 0);
	if (err)
	goto out;

	while (!read_control_file_item (cf))
	{
	unsigned char grip[20];

	if (!cf->item.valid)
	continue; /* Should not happen. */
	if (cf->item.disabled)
	continue;
	assert (strlen (cf->item.hexgrip) == 40);
	hex2bin (cf->item.hexgrip, grip, sizeof (grip));

	err = agent_public_key_from_file (ctrl, grip, &key_public);
	if (err)
	{
	log_error ("%s:%d: key '%s' skipped: %s\n",
	cf->fname, cf->lnr, cf->item.hexgrip,
	gpg_strerror (err));
	continue;
	}

	err = ssh_send_key_public (key_blobs, key_public, NULL);
	if (err)
	goto out;
	gcry_sexp_release (key_public);
	key_public = NULL;

	key_counter++;
	}
	err = 0;

	ret = es_fseek (key_blobs, 0, SEEK_SET);
	if (ret)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	out:
	/* Send response. */

	gcry_sexp_release (key_public);

	if (!err)
	{
	ret_err = stream_write_byte (response, SSH_RESPONSE_IDENTITIES_ANSWER);
	if (!ret_err)
	ret_err = stream_write_uint32 (response, key_counter);
	if (!ret_err)
	ret_err = stream_copy (response, key_blobs);
	}
	else
	{
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
	}

	es_fclose (key_blobs);
	close_control_file (cf);

	return ret_err;
	}


	/* This function hashes the data contained in DATA of size DATA_N
	according to the message digest algorithm specified by MD_ALGORITHM
	and writes the message digest to HASH, which needs to large enough
	for the digest. */
	static gpg_error_t
	data_hash (unsigned char *data, size_t data_n,
	int md_algorithm, unsigned char *hash)
	{
	gcry_md_hash_buffer (md_algorithm, hash, data, data_n);

	return 0;
	}


	-/* This function signs the data described by CTRL. If HASH is is not
	+/* This function signs the data described by CTRL. If HASH is not
	NULL, (HASH,HASHLEN) overrides the hash stored in CTRL. This is to
	allow the use of signature algorithms that implement the hashing
	internally (e.g. Ed25519). On success the created signature is
	stored in ssh format at R_SIG and it's size at R_SIGLEN; the caller
	must use es_free to releaase this memory. */
	static gpg_error_t
	data_sign (ctrl_t ctrl, ssh_key_type_spec_t *spec,
	const void *hash, size_t hashlen,
	unsigned char *r_sig, size_t r_siglen)
	{
	gpg_error_t err;
	gcry_sexp_t signature_sexp = NULL;
	estream_t stream = NULL;
	void *blob = NULL;
	size_t bloblen;
	char hexgrip[40+1];

	*r_sig = NULL;
	*r_siglen = 0;

	/* Quick check to see whether we have a valid keygrip and convert it
	to hex. */
	if (!ctrl->have_keygrip)
	{
	err = gpg_error (GPG_ERR_NO_SECKEY);
	goto out;
	}
	bin2hex (ctrl->keygrip, 20, hexgrip);

	/* Ask for confirmation if needed. */
	if (confirm_flag_from_sshcontrol (hexgrip))
	{
	gcry_sexp_t key;
	char fpr, prompt;
	char *comment = NULL;

	err = agent_raw_key_from_file (ctrl, ctrl->keygrip, &key);
	if (err)
	goto out;
	err = ssh_get_fingerprint_string (key, &fpr);
	if (!err)
	{
	gcry_sexp_t tmpsxp = gcry_sexp_find_token (key, "comment", 0);
	if (tmpsxp)
	comment = gcry_sexp_nth_string (tmpsxp, 1);
	gcry_sexp_release (tmpsxp);
	}
	gcry_sexp_release (key);
	if (err)
	goto out;
	prompt = xtryasprintf (L_("An ssh process requested the use of key%%0A"
	" %s%%0A"
	" (%s)%%0A"
	"Do you want to allow this?"),
	fpr, comment? comment:"");
	xfree (fpr);
	gcry_free (comment);
	err = agent_get_confirmation (ctrl, prompt, L_("Allow"), L_("Deny"), 0);
	xfree (prompt);
	if (err)
	goto out;
	}

	/* Create signature. */
	ctrl->use_auth_call = 1;
	err = agent_pksign_do (ctrl, NULL,
	L_("Please enter the passphrase "
	"for the ssh key%%0A %F%%0A (%c)"),
	&signature_sexp,
	CACHE_MODE_SSH, ttl_from_sshcontrol,
	hash, hashlen);
	ctrl->use_auth_call = 0;
	if (err)
	goto out;

	stream = es_fopenmem (0, "r+b");
	if (!stream)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	err = stream_write_cstring (stream, spec->ssh_identifier);
	if (err)
	goto out;

	err = spec->signature_encoder (spec, stream, signature_sexp);
	if (err)
	goto out;

	err = es_fclose_snatch (stream, &blob, &bloblen);
	if (err)
	goto out;
	stream = NULL;

	*r_sig = blob; blob = NULL;
	*r_siglen = bloblen;

	out:
	xfree (blob);
	es_fclose (stream);
	gcry_sexp_release (signature_sexp);

	return err;
	}


	/* Handler for the "sign_request" command. */
	static gpg_error_t
	ssh_handler_sign_request (ctrl_t ctrl, estream_t request, estream_t response)
	{
	gcry_sexp_t key = NULL;
	ssh_key_type_spec_t spec;
	unsigned char hash[MAX_DIGEST_LEN];
	unsigned int hash_n;
	unsigned char key_grip[20];
	unsigned char *key_blob = NULL;
	u32 key_blob_size;
	unsigned char *data = NULL;
	unsigned char *sig = NULL;
	size_t sig_n;
	u32 data_size;
	u32 flags;
	gpg_error_t err;
	gpg_error_t ret_err;
	int hash_algo;

	/* Receive key. */

	err = stream_read_string (request, 0, &key_blob, &key_blob_size);
	if (err)
	goto out;

	err = ssh_read_key_public_from_blob (key_blob, key_blob_size, &key, &spec);
	if (err)
	goto out;

	/* Receive data to sign. */
	err = stream_read_string (request, 0, &data, &data_size);
	if (err)
	goto out;

	/* FIXME? */
	err = stream_read_uint32 (request, &flags);
	if (err)
	goto out;

	hash_algo = spec.hash_algo;
	if (!hash_algo)
	hash_algo = GCRY_MD_SHA1; /* Use the default. */
	ctrl->digest.algo = hash_algo;
	if ((spec.flags & SPEC_FLAG_USE_PKCS1V2))
	ctrl->digest.raw_value = 0;
	else
	ctrl->digest.raw_value = 1;

	/* Calculate key grip. */
	err = ssh_key_grip (key, key_grip);
	if (err)
	goto out;
	ctrl->have_keygrip = 1;
	memcpy (ctrl->keygrip, key_grip, 20);

	/* Hash data unless we use EdDSA. */
	if ((spec.flags & SPEC_FLAG_IS_EdDSA))
	{
	ctrl->digest.valuelen = 0;
	}
	else
	{
	hash_n = gcry_md_get_algo_dlen (hash_algo);
	if (!hash_n)
	{
	err = gpg_error (GPG_ERR_INTERNAL);
	goto out;
	}
	err = data_hash (data, data_size, hash_algo, hash);
	if (err)
	goto out;
	memcpy (ctrl->digest.value, hash, hash_n);
	ctrl->digest.valuelen = hash_n;
	}

	/* Sign data. */
	if ((spec.flags & SPEC_FLAG_IS_EdDSA))
	err = data_sign (ctrl, &spec, data, data_size, &sig, &sig_n);
	else
	err = data_sign (ctrl, &spec, NULL, 0, &sig, &sig_n);

	out:
	/* Done. */
	if (!err)
	{
	ret_err = stream_write_byte (response, SSH_RESPONSE_SIGN_RESPONSE);
	if (ret_err)
	goto leave;
	ret_err = stream_write_string (response, sig, sig_n);
	if (ret_err)
	goto leave;
	}
	else
	{
	log_error ("ssh sign request failed: %s <%s>\n",
	gpg_strerror (err), gpg_strsource (err));
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
	if (ret_err)
	goto leave;
	}

	leave:

	gcry_sexp_release (key);
	xfree (key_blob);
	xfree (data);
	es_free (sig);

	return ret_err;
	}


	/* This function extracts the comment contained in the key
	s-expression KEY and stores a copy in COMMENT. Returns usual error
	code. */
	static gpg_error_t
	ssh_key_extract_comment (gcry_sexp_t key, char **r_comment)
	{
	gcry_sexp_t comment_list;

	*r_comment = NULL;

	comment_list = gcry_sexp_find_token (key, "comment", 0);
	if (!comment_list)
	return gpg_error (GPG_ERR_INV_SEXP);

	*r_comment = gcry_sexp_nth_string (comment_list, 1);
	gcry_sexp_release (comment_list);
	if (!*r_comment)
	return gpg_error (GPG_ERR_INV_SEXP);

	return 0;
	}


	/* This function converts the key contained in the S-Expression KEY
	into a buffer, which is protected by the passphrase PASSPHRASE.
	Returns usual error code. */
	static gpg_error_t
	ssh_key_to_protected_buffer (gcry_sexp_t key, const char *passphrase,
	unsigned char *buffer, size_t buffer_n)
	{
	unsigned char *buffer_new;
	unsigned int buffer_new_n;
	gpg_error_t err;

	err = 0;
	buffer_new_n = gcry_sexp_sprint (key, GCRYSEXP_FMT_CANON, NULL, 0);
	buffer_new = xtrymalloc_secure (buffer_new_n);
	if (! buffer_new)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	gcry_sexp_sprint (key, GCRYSEXP_FMT_CANON, buffer_new, buffer_new_n);
	/* FIXME: guarantee? */

	err = agent_protect (buffer_new, passphrase, buffer, buffer_n, 0, -1);

	out:

	xfree (buffer_new);

	return err;
	}



	/* Callback function to compare the first entered PIN with the one
	currently being entered. */
	static gpg_error_t
	reenter_compare_cb (struct pin_entry_info_s *pi)
	{
	const char *pin1 = pi->check_cb_arg;

	if (!strcmp (pin1, pi->pin))
	return 0; /* okay */
	return gpg_error (GPG_ERR_BAD_PASSPHRASE);
	}


	/* Store the ssh KEY into our local key storage and protect it after
	asking for a passphrase. Cache that passphrase. TTL is the
	maximum caching time for that key. If the key already exists in
	our key storage, don't do anything. When entering a key also add
	an entry to the sshcontrol file. */
	static gpg_error_t
	ssh_identity_register (ctrl_t ctrl, ssh_key_type_spec_t *spec,
	gcry_sexp_t key, int ttl, int confirm)
	{
	gpg_error_t err;
	unsigned char key_grip_raw[20];
	char key_grip[41];
	unsigned char *buffer = NULL;
	size_t buffer_n;
	char *description = NULL;
	const char *description2 = L_("Please re-enter this passphrase");
	char *comment = NULL;
	char *key_fpr = NULL;
	const char *initial_errtext = NULL;
	struct pin_entry_info_s *pi = NULL;
	struct pin_entry_info_s *pi2 = NULL;

	err = ssh_key_grip (key, key_grip_raw);
	if (err)
	goto out;

	bin2hex (key_grip_raw, 20, key_grip);

	err = ssh_get_fingerprint_string (key, &key_fpr);
	if (err)
	goto out;

	/* Check whether the key is already in our key storage. Don't do
	anything then besides (re-)adding it to sshcontrol. */
	if ( !agent_key_available (key_grip_raw) )
	goto key_exists; /* Yes, key is available. */

	err = ssh_key_extract_comment (key, &comment);
	if (err)
	goto out;

	if ( asprintf (&description,
	L_("Please enter a passphrase to protect"
	" the received secret key%%0A"
	" %s%%0A"
	" %s%%0A"
	"within gpg-agent's key storage"),
	key_fpr, comment ? comment : "") < 0)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	pi = gcry_calloc_secure (1, sizeof (*pi) + MAX_PASSPHRASE_LEN + 1);
	if (!pi)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	pi2 = gcry_calloc_secure (1, sizeof (*pi2) + MAX_PASSPHRASE_LEN + 1);
	if (!pi2)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	pi->max_length = MAX_PASSPHRASE_LEN + 1;
	pi->max_tries = 1;
	pi->with_repeat = 1;
	pi2->max_length = MAX_PASSPHRASE_LEN + 1;
	pi2->max_tries = 1;
	pi2->check_cb = reenter_compare_cb;
	pi2->check_cb_arg = pi->pin;

	next_try:
	err = agent_askpin (ctrl, description, NULL, initial_errtext, pi, NULL, 0);
	initial_errtext = NULL;
	if (err)
	goto out;

	/* Unless the passphrase is empty or the pinentry told us that
	it already did the repetition check, ask to confirm it. */
	if (*pi->pin && !pi->repeat_okay)
	{
	err = agent_askpin (ctrl, description2, NULL, NULL, pi2, NULL, 0);
	if (gpg_err_code (err) == GPG_ERR_BAD_PASSPHRASE)
	{ /* The re-entered one did not match and the user did not
	hit cancel. */
	initial_errtext = L_("does not match - try again");
	goto next_try;
	}
	}

	err = ssh_key_to_protected_buffer (key, pi->pin, &buffer, &buffer_n);
	if (err)
	goto out;

	/* Store this key to our key storage. */
	err = agent_write_private_key (key_grip_raw, buffer, buffer_n, 0);
	if (err)
	goto out;

	/* Cache this passphrase. */
	err = agent_put_cache (key_grip, CACHE_MODE_SSH, pi->pin, ttl);
	if (err)
	goto out;

	key_exists:
	/* And add an entry to the sshcontrol file. */
	err = add_control_entry (ctrl, spec, key_grip, key_fpr, ttl, confirm);


	out:
	if (pi2 && pi2->max_length)
	wipememory (pi2->pin, pi2->max_length);
	xfree (pi2);
	if (pi && pi->max_length)
	wipememory (pi->pin, pi->max_length);
	xfree (pi);
	xfree (buffer);
	xfree (comment);
	xfree (key_fpr);
	xfree (description);

	return err;
	}


	/* This function removes the key contained in the S-Expression KEY
	from the local key storage, in case it exists there. Returns usual
	error code. FIXME: this function is a stub. */
	static gpg_error_t
	ssh_identity_drop (gcry_sexp_t key)
	{
	unsigned char key_grip[21] = { 0 };
	gpg_error_t err;

	err = ssh_key_grip (key, key_grip);
	if (err)
	goto out;

	key_grip[sizeof (key_grip) - 1] = 0;

	/* FIXME: What to do here - forgetting the passphrase or deleting
	the key from key cache? */

	out:

	return err;
	}

	/* Handler for the "add_identity" command. */
	static gpg_error_t
	ssh_handler_add_identity (ctrl_t ctrl, estream_t request, estream_t response)
	{
	gpg_error_t ret_err;
	ssh_key_type_spec_t spec;
	gpg_error_t err;
	gcry_sexp_t key;
	unsigned char b;
	int confirm;
	int ttl;

	confirm = 0;
	key = NULL;
	ttl = 0;

	/* FIXME? */
	err = ssh_receive_key (request, &key, 1, 1, &spec);
	if (err)
	goto out;

	while (1)
	{
	err = stream_read_byte (request, &b);
	if (gpg_err_code (err) == GPG_ERR_EOF)
	{
	err = 0;
	break;
	}

	switch (b)
	{
	case SSH_OPT_CONSTRAIN_LIFETIME:
	{
	u32 n = 0;

	err = stream_read_uint32 (request, &n);
	if (! err)
	ttl = n;
	break;
	}

	case SSH_OPT_CONSTRAIN_CONFIRM:
	{
	confirm = 1;
	break;
	}

	default:
	/* FIXME: log/bad? */
	break;
	}
	}
	if (err)
	goto out;

	err = ssh_identity_register (ctrl, &spec, key, ttl, confirm);

	out:

	gcry_sexp_release (key);

	if (! err)
	ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
	else
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);

	return ret_err;
	}

	/* Handler for the "remove_identity" command. */
	static gpg_error_t
	ssh_handler_remove_identity (ctrl_t ctrl,
	estream_t request, estream_t response)
	{
	unsigned char *key_blob;
	u32 key_blob_size;
	gcry_sexp_t key;
	gpg_error_t ret_err;
	gpg_error_t err;

	(void)ctrl;

	/* Receive key. */

	key_blob = NULL;
	key = NULL;

	err = stream_read_string (request, 0, &key_blob, &key_blob_size);
	if (err)
	goto out;

	err = ssh_read_key_public_from_blob (key_blob, key_blob_size, &key, NULL);
	if (err)
	goto out;

	err = ssh_identity_drop (key);

	out:

	xfree (key_blob);
	gcry_sexp_release (key);

	if (! err)
	ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
	else
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);

	return ret_err;
	}

	/* FIXME: stub function. Actually useful? */
	static gpg_error_t
	ssh_identities_remove_all (void)
	{
	gpg_error_t err;

	err = 0;

	/* FIXME: shall we remove _all_ cache entries or only those
	registered through the ssh-agent protocol? */

	return err;
	}

	/* Handler for the "remove_all_identities" command. */
	static gpg_error_t
	ssh_handler_remove_all_identities (ctrl_t ctrl,
	estream_t request, estream_t response)
	{
	gpg_error_t ret_err;
	gpg_error_t err;

	(void)ctrl;
	(void)request;

	err = ssh_identities_remove_all ();

	if (! err)
	ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
	else
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);

	return ret_err;
	}

	/* Lock agent? FIXME: stub function. */
	static gpg_error_t
	ssh_lock (void)
	{
	gpg_error_t err;

	/* FIXME */
	log_error ("ssh-agent's lock command is not implemented\n");
	err = 0;

	return err;
	}

	/* Unock agent? FIXME: stub function. */
	static gpg_error_t
	ssh_unlock (void)
	{
	gpg_error_t err;

	log_error ("ssh-agent's unlock command is not implemented\n");
	err = 0;

	return err;
	}

	/* Handler for the "lock" command. */
	static gpg_error_t
	ssh_handler_lock (ctrl_t ctrl, estream_t request, estream_t response)
	{
	gpg_error_t ret_err;
	gpg_error_t err;

	(void)ctrl;
	(void)request;

	err = ssh_lock ();

	if (! err)
	ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
	else
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);

	return ret_err;
	}

	/* Handler for the "unlock" command. */
	static gpg_error_t
	ssh_handler_unlock (ctrl_t ctrl, estream_t request, estream_t response)
	{
	gpg_error_t ret_err;
	gpg_error_t err;

	(void)ctrl;
	(void)request;

	err = ssh_unlock ();

	if (! err)
	ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
	else
	ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);

	return ret_err;
	}



	/* Return the request specification for the request identified by TYPE
	or NULL in case the requested request specification could not be
	found. */
	static ssh_request_spec_t *
	request_spec_lookup (int type)
	{
	ssh_request_spec_t *spec;
	unsigned int i;

	for (i = 0; i < DIM (request_specs); i++)
	if (request_specs[i].type == type)
	break;
	if (i == DIM (request_specs))
	{
	if (opt.verbose)
	log_info ("ssh request %u is not supported\n", type);
	spec = NULL;
	}
	else
	spec = request_specs + i;

	return spec;
	}

	/* Process a single request. The request is read from and the
	response is written to STREAM_SOCK. Uses CTRL as context. Returns
	zero in case of success, non zero in case of failure. */
	static int
	ssh_request_process (ctrl_t ctrl, estream_t stream_sock)
	{
	ssh_request_spec_t *spec;
	estream_t response = NULL;
	estream_t request = NULL;
	unsigned char request_type;
	gpg_error_t err;
	int send_err = 0;
	int ret;
	unsigned char *request_data = NULL;
	u32 request_data_size;
	u32 response_size;

	/* Create memory streams for request/response data. The entire
	request will be stored in secure memory, since it might contain
	secret key material. The response does not have to be stored in
	secure memory, since we never give out secret keys.

	Note: we only have little secure memory, but there is NO
	possibility of DoS here; only trusted clients are allowed to
	connect to the agent. What could happen is that the agent
	returns out-of-secure-memory errors on requests in case the
	agent's owner floods his own agent with many large messages.
	-moritz */

	/* Retrieve request. */
	err = stream_read_string (stream_sock, 1, &request_data, &request_data_size);
	if (err)
	goto out;

	if (opt.verbose > 1)
	log_info ("received ssh request of length %u\n",
	(unsigned int)request_data_size);

	if (! request_data_size)
	{
	send_err = 1;
	goto out;
	/* Broken request; FIXME. */
	}

	request_type = request_data[0];
	spec = request_spec_lookup (request_type);
	if (! spec)
	{
	send_err = 1;
	goto out;
	/* Unknown request; FIXME. */
	}

	if (spec->secret_input)
	request = es_mopen (NULL, 0, 0, 1, realloc_secure, gcry_free, "r+b");
	else
	request = es_mopen (NULL, 0, 0, 1, gcry_realloc, gcry_free, "r+b");
	if (! request)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	ret = es_setvbuf (request, NULL, _IONBF, 0);
	if (ret)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}
	err = stream_write_data (request, request_data + 1, request_data_size - 1);
	if (err)
	goto out;
	es_rewind (request);

	response = es_fopenmem (0, "r+b");
	if (! response)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	if (opt.verbose)
	log_info ("ssh request handler for %s (%u) started\n",
	spec->identifier, spec->type);

	err = (*spec->handler) (ctrl, request, response);

	if (opt.verbose)
	{
	if (err)
	log_info ("ssh request handler for %s (%u) failed: %s\n",
	spec->identifier, spec->type, gpg_strerror (err));
	else
	log_info ("ssh request handler for %s (%u) ready\n",
	spec->identifier, spec->type);
	}

	if (err)
	{
	send_err = 1;
	goto out;
	}

	response_size = es_ftell (response);
	if (opt.verbose > 1)
	log_info ("sending ssh response of length %u\n",
	(unsigned int)response_size);

	err = es_fseek (response, 0, SEEK_SET);
	if (err)
	{
	send_err = 1;
	goto out;
	}

	err = stream_write_uint32 (stream_sock, response_size);
	if (err)
	{
	send_err = 1;
	goto out;
	}

	err = stream_copy (stream_sock, response);
	if (err)
	goto out;

	err = es_fflush (stream_sock);
	if (err)
	goto out;

	out:

	if (err && es_feof (stream_sock))
	log_error ("error occurred while processing request: %s\n",
	gpg_strerror (err));

	if (send_err)
	{
	if (opt.verbose > 1)
	log_info ("sending ssh error response\n");
	err = stream_write_uint32 (stream_sock, 1);
	if (err)
	goto leave;
	err = stream_write_byte (stream_sock, SSH_RESPONSE_FAILURE);
	if (err)
	goto leave;
	}

	leave:

	es_fclose (request);
	es_fclose (response);
	xfree (request_data);

	return !!err;
	}


	/* Return the peer's pid. Stripped down code from libassuan. */
	static unsigned long
	get_client_pid (int fd)
	{
	pid_t client_pid = (pid_t)(-1);

	#ifdef HAVE_SO_PEERCRED
	{
	struct ucred cr;
	socklen_t cl = sizeof cr;

	if ( !getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cl))
	client_pid = cr.pid;
	}
	#elif defined (HAVE_GETPEERUCRED)
	{
	ucred_t *ucred = NULL;

	if (getpeerucred (fd, &ucred) != -1)
	{
	client_pid= ucred_getpid (ucred);
	ucred_free (ucred);
	}
	}
	#elif defined (HAVE_LOCAL_PEEREID)
	{
	struct unpcbid unp;
	socklen_t unpl = sizeof unp;

	if (getsockopt (fd, 0, LOCAL_PEEREID, &unp, &unpl) != -1)
	client_pid = unp.unp_pid;
	}
	#endif

	return client_pid == (pid_t)(-1)? 0 : (unsigned long)client_pid;
	}


	/* Start serving client on SOCK_CLIENT. */
	void
	start_command_handler_ssh (ctrl_t ctrl, gnupg_fd_t sock_client)
	{
	estream_t stream_sock = NULL;
	gpg_error_t err;
	int ret;

	err = agent_copy_startup_env (ctrl);
	if (err)
	goto out;

	ctrl->client_pid = get_client_pid (FD2INT(sock_client));

	/* Create stream from socket. */
	stream_sock = es_fdopen (FD2INT(sock_client), "r+");
	if (!stream_sock)
	{
	err = gpg_error_from_syserror ();
	log_error (_("failed to create stream from socket: %s\n"),
	gpg_strerror (err));
	goto out;
	}
	/* We have to disable the estream buffering, because the estream
	core doesn't know about secure memory. */
	ret = es_setvbuf (stream_sock, NULL, _IONBF, 0);
	if (ret)
	{
	err = gpg_error_from_syserror ();
	log_error ("failed to disable buffering "
	"on socket stream: %s\n", gpg_strerror (err));
	goto out;
	}

	/* Main processing loop. */
	while ( !ssh_request_process (ctrl, stream_sock) )
	{
	/* Check wether we have reached EOF before trying to read
	another request. */
	int c;

	c = es_fgetc (stream_sock);
	if (c == EOF)
	break;
	es_ungetc (c, stream_sock);
	}

	/* Reset the SCD in case it has been used. */
	agent_reset_scd (ctrl);


	out:
	if (stream_sock)
	es_fclose (stream_sock);
	}


	#ifdef HAVE_W32_SYSTEM
	/* Serve one ssh-agent request. This is used for the Putty support.
	- REQUEST is the the mmapped memory which may be accessed up to a
	+ REQUEST is the mmapped memory which may be accessed up to a
	length of MAXREQLEN. Returns 0 on success which also indicates
	that a valid SSH response message is now in REQUEST. */
	int
	serve_mmapped_ssh_request (ctrl_t ctrl,
	unsigned char *request, size_t maxreqlen)
	{
	gpg_error_t err;
	int send_err = 0;
	int valid_response = 0;
	ssh_request_spec_t *spec;
	u32 msglen;
	estream_t request_stream, response_stream;

	if (agent_copy_startup_env (ctrl))
	goto leave; /* Error setting up the environment. */

	if (maxreqlen < 5)
	goto leave; /* Caller error. */

	msglen = uint32_construct (request[0], request[1], request[2], request[3]);
	if (msglen < 1 \|\| msglen > maxreqlen - 4)
	{
	log_error ("ssh message len (%u) out of range", (unsigned int)msglen);
	goto leave;
	}

	spec = request_spec_lookup (request[4]);
	if (!spec)
	{
	send_err = 1; /* Unknown request type. */
	goto leave;
	}

	/* Create a stream object with the data part of the request. */
	if (spec->secret_input)
	request_stream = es_mopen (NULL, 0, 0, 1, realloc_secure, gcry_free, "r+");
	else
	request_stream = es_mopen (NULL, 0, 0, 1, gcry_realloc, gcry_free, "r+");
	if (!request_stream)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* We have to disable the estream buffering, because the estream
	core doesn't know about secure memory. */
	if (es_setvbuf (request_stream, NULL, _IONBF, 0))
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Copy the request to the stream but omit the request type. */
	err = stream_write_data (request_stream, request + 5, msglen - 1);
	if (err)
	goto leave;
	es_rewind (request_stream);

	response_stream = es_fopenmem (0, "r+b");
	if (!response_stream)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if (opt.verbose)
	log_info ("ssh request handler for %s (%u) started\n",
	spec->identifier, spec->type);

	err = (*spec->handler) (ctrl, request_stream, response_stream);

	if (opt.verbose)
	{
	if (err)
	log_info ("ssh request handler for %s (%u) failed: %s\n",
	spec->identifier, spec->type, gpg_strerror (err));
	else
	log_info ("ssh request handler for %s (%u) ready\n",
	spec->identifier, spec->type);
	}

	es_fclose (request_stream);
	request_stream = NULL;

	if (err)
	{
	send_err = 1;
	goto leave;
	}

	/* Put the response back into the mmapped buffer. */
	{
	void *response_data;
	size_t response_size;

	/* NB: In contrast to the request-stream, the response stream
	- includes the the message type byte. */
	+ includes the message type byte. */
	if (es_fclose_snatch (response_stream, &response_data, &response_size))
	{
	log_error ("snatching ssh response failed: %s",
	gpg_strerror (gpg_error_from_syserror ()));
	send_err = 1; /* Ooops. */
	goto leave;
	}

	if (opt.verbose > 1)
	log_info ("sending ssh response of length %u\n",
	(unsigned int)response_size);
	if (response_size > maxreqlen - 4)
	{
	log_error ("invalid length of the ssh response: %s",
	gpg_strerror (GPG_ERR_INTERNAL));
	es_free (response_data);
	send_err = 1;
	goto leave;
	}

	request[0] = response_size >> 24;
	request[1] = response_size >> 16;
	request[2] = response_size >> 8;
	request[3] = response_size >> 0;
	memcpy (request+4, response_data, response_size);
	es_free (response_data);
	valid_response = 1;
	}

	leave:
	if (send_err)
	{
	request[0] = 0;
	request[1] = 0;
	request[2] = 0;
	request[3] = 1;
	request[4] = SSH_RESPONSE_FAILURE;
	valid_response = 1;
	}

	/* Reset the SCD in case it has been used. */
	agent_reset_scd (ctrl);

	return valid_response? 0 : -1;
	}
	#endif /HAVE_W32_SYSTEM/
	diff --git a/agent/command.c b/agent/command.c
	index c8b34e988..ec38649fb 100644
	--- a/agent/command.c
	+++ b/agent/command.c
	@@ -1,3358 +1,3358 @@
	/* command.c - gpg-agent command handler
	* Copyright (C) 2001-2011 Free Software Foundation, Inc.
	* Copyright (C) 2001-2013 Werner Koch
	* Copyright (C) 2015 g10 Code GmbH.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* FIXME: we should not use the default assuan buffering but setup
	some buffering in secure mempory to protect session keys etc. */

	#include <config.h>

	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <unistd.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <dirent.h>

	#include "agent.h"
	#include <assuan.h>
	#include "i18n.h"
	#include "cvt-openpgp.h"
	#include "../common/ssh-utils.h"
	#include "../common/asshelp.h"
	#include "../common/server-help.h"


	/* Maximum allowed size of the inquired ciphertext. */
	#define MAXLEN_CIPHERTEXT 4096
	/* Maximum allowed size of the key parameters. */
	#define MAXLEN_KEYPARAM 1024
	/* Maximum allowed size of key data as used in inquiries (bytes). */
	#define MAXLEN_KEYDATA 8192
	/* The size of the import/export KEK key (in bytes). */
	#define KEYWRAP_KEYSIZE (128/8)

	/* A shortcut to call assuan_set_error using an gpg_err_code_t and a
	text string. */
	#define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))

	/* Check that the maximum digest length we support has at least the
	length of the keygrip. */
	#if MAX_DIGEST_LEN < 20
	#error MAX_DIGEST_LEN shorter than keygrip
	#endif

	/* Data used to associate an Assuan context with local server data.
	This is this modules local part of the server_control_s struct. */
	struct server_local_s
	{
	/* Our Assuan context. */
	assuan_context_t assuan_ctx;

	/* If this flag is true, the passphrase cache is used for signing
	operations. It defaults to true but may be set on a per
	connection base. The global option opt.ignore_cache_for_signing
	takes precedence over this flag. */
	unsigned int use_cache_for_signing : 1;

	/* Flag to suppress I/O logging during a command. */
	unsigned int pause_io_logging : 1;

	/* Flag indicating that the connection is from ourselves. */
	unsigned int connect_from_self : 1;

	/* Helper flag for io_monitor to allow suppressing of our own
	* greeting in some cases. See io_monitor for details. */
	unsigned int greeting_seen : 1;

	/* If this flag is set to true the agent will be terminated after
	the end of the current session. */
	unsigned int stopme : 1;

	/* Flag indicating whether pinentry notifications shall be done. */
	unsigned int allow_pinentry_notify : 1;

	/* An allocated description for the next key operation. This is
	used if a pinnetry needs to be popped up. */
	char *keydesc;

	/* Malloced KEK (Key-Encryption-Key) for the import_key command. */
	void *import_key;

	/* Malloced KEK for the export_key command. */
	void *export_key;

	/* Client is aware of the error code GPG_ERR_FULLY_CANCELED. */
	int allow_fully_canceled;

	/* Last CACHE_NONCE sent as status (malloced). */
	char *last_cache_nonce;

	/* Last PASSWD_NONCE sent as status (malloced). */
	char *last_passwd_nonce;
	};


	/* An entry for the getval/putval commands. */
	struct putval_item_s
	{
	struct putval_item_s *next;
	size_t off; /* Offset to the value into DATA. */
	size_t len; /* Length of the value. */
	char d[1]; /* Key \| Nul \| value. */
	};


	/* A list of key value pairs fpr the getval/putval commands. */
	static struct putval_item_s *putval_list;



	/* To help polling clients, we keep track of the number of certain
	events. This structure keeps those counters. The counters are
	integers and there should be no problem if they are overflowing as
	callers need to check only whether a counter changed. The actual
	values are not meaningful. */
	struct
	{
	/* Incremented if any of the other counters below changed. */
	unsigned int any;

	/* Incremented if a key is added or removed from the internal privat
	key database. */
	unsigned int key;

	/* Incremented if a change of the card readers stati has been
	detected. */
	unsigned int card;

	} eventcounter;



	/* Local prototypes. */
	static int command_has_option (const char cmd, const char cmdopt);




	/* Release the memory buffer MB but first wipe out the used memory. */
	static void
	clear_outbuf (membuf_t *mb)
	{
	void *p;
	size_t n;

	p = get_membuf (mb, &n);
	if (p)
	{
	wipememory (p, n);
	xfree (p);
	}
	}


	/* Write the content of memory buffer MB as assuan data to CTX and
	wipe the buffer out afterwards. */
	static gpg_error_t
	write_and_clear_outbuf (assuan_context_t ctx, membuf_t *mb)
	{
	gpg_error_t ae;
	void *p;
	size_t n;

	p = get_membuf (mb, &n);
	if (!p)
	return out_of_core ();
	ae = assuan_send_data (ctx, p, n);
	memset (p, 0, n);
	xfree (p);
	return ae;
	}


	/* Clear the nonces used to enable the passphrase cache for certain
	multi-command command sequences. */
	static void
	clear_nonce_cache (ctrl_t ctrl)
	{
	if (ctrl->server_local->last_cache_nonce)
	{
	agent_put_cache (ctrl->server_local->last_cache_nonce,
	CACHE_MODE_NONCE, NULL, 0);
	xfree (ctrl->server_local->last_cache_nonce);
	ctrl->server_local->last_cache_nonce = NULL;
	}
	if (ctrl->server_local->last_passwd_nonce)
	{
	agent_put_cache (ctrl->server_local->last_passwd_nonce,
	CACHE_MODE_NONCE, NULL, 0);
	xfree (ctrl->server_local->last_passwd_nonce);
	ctrl->server_local->last_passwd_nonce = NULL;
	}
	}


	/* This function is called by Libassuan whenever the client sends a
	reset. It has been registered similar to the other Assuan
	commands. */
	static gpg_error_t
	reset_notify (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void) line;

	memset (ctrl->keygrip, 0, 20);
	ctrl->have_keygrip = 0;
	ctrl->digest.valuelen = 0;

	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;

	clear_nonce_cache (ctrl);

	return 0;
	}


	/* Replace all '+' by a blank in the string S. */
	static void
	plus_to_blank (char *s)
	{
	for (; *s; s++)
	{
	if (*s == '+')
	*s = ' ';
	}
	}


	/* Parse a hex string. Return an Assuan error code or 0 on success and the
	length of the parsed string in LEN. */
	static int
	parse_hexstring (assuan_context_t ctx, const char string, size_t len)
	{
	const char *p;
	size_t n;

	/* parse the hash value */
	for (p=string, n=0; hexdigitp (p); p++, n++)
	;
	if (p != ' ' && p != '\t' && *p)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring");
	if ((n&1))
	return set_error (GPG_ERR_ASS_PARAMETER, "odd number of digits");
	*len = n;
	return 0;
	}


	/* Parse the keygrip in STRING into the provided buffer BUF. BUF must
	provide space for 20 bytes. BUF is not changed if the function
	returns an error. */
	static int
	parse_keygrip (assuan_context_t ctx, const char string, unsigned char buf)
	{
	int rc;
	size_t n = 0;

	rc = parse_hexstring (ctx, string, &n);
	if (rc)
	return rc;
	n /= 2;
	if (n != 20)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of keygrip");

	if (hex2bin (string, buf, 20) < 0)
	return set_error (GPG_ERR_BUG, "hex2bin");

	return 0;
	}


	/* Write an Assuan status line. KEYWORD is the first item on the
	status line. The following arguments are all separated by a space
	in the output. The last argument must be a NULL. Linefeeds and
	carriage returns characters (which are not allowed in an Assuan
	status line) are silently quoted in C-style. */
	gpg_error_t
	agent_write_status (ctrl_t ctrl, const char *keyword, ...)
	{
	gpg_error_t err = 0;
	va_list arg_ptr;
	const char *text;
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;
	char buf[950], *p;
	size_t n;

	va_start (arg_ptr, keyword);

	p = buf;
	n = 0;
	while ( (text = va_arg (arg_ptr, const char *)) )
	{
	if (n)
	{
	*p++ = ' ';
	n++;
	}
	for ( ; *text && n < DIM (buf)-3; n++, text++)
	{
	if (*text == '\n')
	{
	*p++ = '\\';
	*p++ = 'n';
	}
	else if (*text == '\r')
	{
	*p++ = '\\';
	*p++ = 'r';
	}
	else
	p++ = text;
	}
	}
	*p = 0;
	err = assuan_write_status (ctx, keyword, buf);

	va_end (arg_ptr);
	return err;
	}


	/* This function is similar to print_assuan_status but takes a CTRL
	arg instead of an assuan context as first argument. */
	gpg_error_t
	agent_print_status (ctrl_t ctrl, const char keyword, const char format, ...)
	{
	gpg_error_t err;
	va_list arg_ptr;
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;

	va_start (arg_ptr, format);
	err = vprint_assuan_status (ctx, keyword, format, arg_ptr);
	va_end (arg_ptr);
	return err;
	}


	/* Helper to notify the client about a launched Pinentry. Because
	that might disturb some older clients, this is only done if enabled
	via an option. Returns an gpg error code. */
	gpg_error_t
	agent_inq_pinentry_launched (ctrl_t ctrl, unsigned long pid, const char *extra)
	{
	char line[256];

	if (!ctrl \|\| !ctrl->server_local
	\|\| !ctrl->server_local->allow_pinentry_notify)
	return 0;
	snprintf (line, DIM(line), "PINENTRY_LAUNCHED %lu%s%s",
	pid, extra?" ":"", extra? extra:"");
	return assuan_inquire (ctrl->server_local->assuan_ctx, line, NULL, NULL, 0);
	}


	/* An agent progress callback for Libgcrypt. This has been registered
	* to be called via the progress dispatcher mechanism from
	* gpg-agent.c */
	static void
	progress_cb (ctrl_t ctrl, const char *what, int printchar,
	int current, int total)
	{
	if (!ctrl \|\| !ctrl->server_local \|\| !ctrl->server_local->assuan_ctx)
	;
	else if (printchar == '\n' && what && !strcmp (what, "primegen"))
	agent_print_status (ctrl, "PROGRESS", "%.20s X 100 100", what);
	else
	agent_print_status (ctrl, "PROGRESS", "%.20s %c %d %d",
	what, printchar=='\n'?'X':printchar, current, total);
	}


	/* Helper to print a message while leaving a command. Note that this
	* function does not call assuan_set_error; the caller may do this
	* prior to calling us. */
	static gpg_error_t
	leave_cmd (assuan_context_t ctx, gpg_error_t err)
	{
	if (err)
	{
	const char *name = assuan_get_command_name (ctx);
	if (!name)
	name = "?";

	/* Not all users of gpg-agent know about the fully canceled
	error code; map it back if needed. */
	if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	if (!ctrl->server_local->allow_fully_canceled)
	err = gpg_err_make (gpg_err_source (err), GPG_ERR_CANCELED);
	}

	/* Most code from common/ does not know the error source, thus
	we fix this here. */
	if (gpg_err_source (err) == GPG_ERR_SOURCE_UNKNOWN)
	err = gpg_err_make (GPG_ERR_SOURCE_DEFAULT, gpg_err_code (err));

	if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
	log_error ("command '%s' failed: %s\n", name,
	gpg_strerror (err));
	else
	log_error ("command '%s' failed: %s <%s>\n", name,
	gpg_strerror (err), gpg_strsource (err));
	}
	return err;
	}



	static const char hlp_geteventcounter[] =
	"GETEVENTCOUNTER\n"
	"\n"
	- "Return a a status line named EVENTCOUNTER with the current values\n"
	+ "Return a status line named EVENTCOUNTER with the current values\n"
	"of all event counters. The values are decimal numbers in the range\n"
	"0 to UINT_MAX and wrapping around to 0. The actual values should\n"
	"not be relied upon, they shall only be used to detect a change.\n"
	"\n"
	"The currently defined counters are:\n"
	"\n"
	"ANY - Incremented with any change of any of the other counters.\n"
	"KEY - Incremented for added or removed private keys.\n"
	"CARD - Incremented for changes of the card readers stati.";
	static gpg_error_t
	cmd_geteventcounter (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	return agent_print_status (ctrl, "EVENTCOUNTER", "%u %u %u",
	eventcounter.any,
	eventcounter.key,
	eventcounter.card);
	}


	/* This function should be called once for all key removals or
	additions. This function is assured not to do any context
	switches. */
	void
	bump_key_eventcounter (void)
	{
	eventcounter.key++;
	eventcounter.any++;
	}


	/* This function should be called for all card reader status
	changes. This function is assured not to do any context
	switches. */
	void
	bump_card_eventcounter (void)
	{
	eventcounter.card++;
	eventcounter.any++;
	}




	static const char hlp_istrusted[] =
	"ISTRUSTED <hexstring_with_fingerprint>\n"
	"\n"
	"Return OK when we have an entry with this fingerprint in our\n"
	"trustlist";
	static gpg_error_t
	cmd_istrusted (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc, n, i;
	char *p;
	char fpr[41];

	/* Parse the fingerprint value. */
	for (p=line,n=0; hexdigitp (p); p++, n++)
	;
	if (*p \|\| !(n == 40 \|\| n == 32))
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid fingerprint");
	i = 0;
	if (n==32)
	{
	strcpy (fpr, "00000000");
	i += 8;
	}
	for (p=line; i < 40; p++, i++)
	fpr[i] = p >= 'a'? (p & 0xdf): *p;
	fpr[i] = 0;
	rc = agent_istrusted (ctrl, fpr, NULL);
	if (!rc \|\| gpg_err_code (rc) == GPG_ERR_NOT_TRUSTED)
	return rc;
	else if (rc == -1 \|\| gpg_err_code (rc) == GPG_ERR_EOF )
	return gpg_error (GPG_ERR_NOT_TRUSTED);
	else
	return leave_cmd (ctx, rc);
	}


	static const char hlp_listtrusted[] =
	"LISTTRUSTED\n"
	"\n"
	"List all entries from the trustlist.";
	static gpg_error_t
	cmd_listtrusted (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;

	(void)line;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	rc = agent_listtrusted (ctx);
	return leave_cmd (ctx, rc);
	}


	static const char hlp_martrusted[] =
	"MARKTRUSTED <hexstring_with_fingerprint> <flag> <display_name>\n"
	"\n"
	"Store a new key in into the trustlist.";
	static gpg_error_t
	cmd_marktrusted (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc, n, i;
	char *p;
	char fpr[41];
	int flag;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	/* parse the fingerprint value */
	for (p=line,n=0; hexdigitp (p); p++, n++)
	;
	if (!spacep (p) \|\| !(n == 40 \|\| n == 32))
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid fingerprint");
	i = 0;
	if (n==32)
	{
	strcpy (fpr, "00000000");
	i += 8;
	}
	for (p=line; i < 40; p++, i++)
	fpr[i] = p >= 'a'? (p & 0xdf): *p;
	fpr[i] = 0;

	while (spacep (p))
	p++;
	flag = *p++;
	if ( (flag != 'S' && flag != 'P') \|\| !spacep (p) )
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid flag - must be P or S");
	while (spacep (p))
	p++;

	rc = agent_marktrusted (ctrl, p, fpr, flag);
	return leave_cmd (ctx, rc);
	}




	static const char hlp_havekey[] =
	"HAVEKEY <hexstrings_with_keygrips>\n"
	"\n"
	"Return success if at least one of the secret keys with the given\n"
	"keygrips is available.";
	static gpg_error_t
	cmd_havekey (assuan_context_t ctx, char *line)
	{
	gpg_error_t err;
	unsigned char buf[20];

	do
	{
	err = parse_keygrip (ctx, line, buf);
	if (err)
	return err;

	if (!agent_key_available (buf))
	return 0; /* Found. */

	while (line && line != ' ' && *line != '\t')
	line++;
	while (line == ' ' \|\| line == '\t')
	line++;
	}
	while (*line);

	/* No leave_cmd() here because errors are expected and would clutter
	the log. */
	return gpg_error (GPG_ERR_NO_SECKEY);
	}


	static const char hlp_sigkey[] =
	"SIGKEY <hexstring_with_keygrip>\n"
	"SETKEY <hexstring_with_keygrip>\n"
	"\n"
	"Set the key used for a sign or decrypt operation.";
	static gpg_error_t
	cmd_sigkey (assuan_context_t ctx, char *line)
	{
	int rc;
	ctrl_t ctrl = assuan_get_pointer (ctx);

	rc = parse_keygrip (ctx, line, ctrl->keygrip);
	if (rc)
	return rc;
	ctrl->have_keygrip = 1;
	return 0;
	}


	static const char hlp_setkeydesc[] =
	"SETKEYDESC plus_percent_escaped_string\n"
	"\n"
	"Set a description to be used for the next PKSIGN, PKDECRYPT, IMPORT_KEY\n"
	"or EXPORT_KEY operation if this operation requires a passphrase. If\n"
	"this command is not used a default text will be used. Note, that\n"
	"this description implictly selects the label used for the entry\n"
	"box; if the string contains the string PIN (which in general will\n"
	"not be translated), \"PIN\" is used, otherwise the translation of\n"
	"\"passphrase\" is used. The description string should not contain\n"
	"blanks unless they are percent or '+' escaped.\n"
	"\n"
	"The description is only valid for the next PKSIGN, PKDECRYPT,\n"
	"IMPORT_KEY, EXPORT_KEY, or DELETE_KEY operation.";
	static gpg_error_t
	cmd_setkeydesc (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	char desc, p;

	for (p=line; *p == ' '; p++)
	;
	desc = p;
	p = strchr (desc, ' ');
	if (p)
	p = 0; / We ignore any garbage; we might late use it for other args. */

	if (!*desc)
	return set_error (GPG_ERR_ASS_PARAMETER, "no description given");

	/* Note, that we only need to replace the + characters and should
	leave the other escaping in place because the escaped string is
	send verbatim to the pinentry which does the unescaping (but not
	the + replacing) */
	plus_to_blank (desc);

	xfree (ctrl->server_local->keydesc);

	if (ctrl->restricted)
	{
	ctrl->server_local->keydesc = strconcat
	((ctrl->restricted == 2
	? _("Note: Request from the web browser.")
	: _("Note: Request from a remote site.") ), "%0A%0A", desc, NULL);
	}
	else
	ctrl->server_local->keydesc = xtrystrdup (desc);
	if (!ctrl->server_local->keydesc)
	return out_of_core ();
	return 0;
	}


	static const char hlp_sethash[] =
	"SETHASH (--hash=<name>)\|(<algonumber>) <hexstring>\n"
	"\n"
	"The client can use this command to tell the server about the data\n"
	"(which usually is a hash) to be signed.";
	static gpg_error_t
	cmd_sethash (assuan_context_t ctx, char *line)
	{
	int rc;
	size_t n;
	char *p;
	ctrl_t ctrl = assuan_get_pointer (ctx);
	unsigned char *buf;
	char *endp;
	int algo;

	/* Parse the alternative hash options which may be used instead of
	the algo number. */
	if (has_option_name (line, "--hash"))
	{
	if (has_option (line, "--hash=sha1"))
	algo = GCRY_MD_SHA1;
	else if (has_option (line, "--hash=sha224"))
	algo = GCRY_MD_SHA224;
	else if (has_option (line, "--hash=sha256"))
	algo = GCRY_MD_SHA256;
	else if (has_option (line, "--hash=sha384"))
	algo = GCRY_MD_SHA384;
	else if (has_option (line, "--hash=sha512"))
	algo = GCRY_MD_SHA512;
	else if (has_option (line, "--hash=rmd160"))
	algo = GCRY_MD_RMD160;
	else if (has_option (line, "--hash=md5"))
	algo = GCRY_MD_MD5;
	else if (has_option (line, "--hash=tls-md5sha1"))
	algo = MD_USER_TLS_MD5SHA1;
	else
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid hash algorithm");
	}
	else
	algo = 0;

	line = skip_options (line);

	if (!algo)
	{
	/* No hash option has been given: require an algo number instead */
	algo = (int)strtoul (line, &endp, 10);
	for (line = endp; line == ' ' \|\| line == '\t'; line++)
	;
	if (!algo \|\| gcry_md_test_algo (algo))
	return set_error (GPG_ERR_UNSUPPORTED_ALGORITHM, NULL);
	}
	ctrl->digest.algo = algo;
	ctrl->digest.raw_value = 0;

	/* Parse the hash value. */
	n = 0;
	rc = parse_hexstring (ctx, line, &n);
	if (rc)
	return rc;
	n /= 2;
	if (algo == MD_USER_TLS_MD5SHA1 && n == 36)
	;
	else if (n != 16 && n != 20 && n != 24
	&& n != 28 && n != 32 && n != 48 && n != 64)
	return set_error (GPG_ERR_ASS_PARAMETER, "unsupported length of hash");

	if (n > MAX_DIGEST_LEN)
	return set_error (GPG_ERR_ASS_PARAMETER, "hash value to long");

	buf = ctrl->digest.value;
	ctrl->digest.valuelen = n;
	for (p=line, n=0; n < ctrl->digest.valuelen; p += 2, n++)
	buf[n] = xtoi_2 (p);
	for (; n < ctrl->digest.valuelen; n++)
	buf[n] = 0;
	return 0;
	}


	static const char hlp_pksign[] =
	"PKSIGN [<options>] [<cache_nonce>]\n"
	"\n"
	"Perform the actual sign operation. Neither input nor output are\n"
	"sensitive to eavesdropping.";
	static gpg_error_t
	cmd_pksign (assuan_context_t ctx, char *line)
	{
	int rc;
	cache_mode_t cache_mode = CACHE_MODE_NORMAL;
	ctrl_t ctrl = assuan_get_pointer (ctx);
	membuf_t outbuf;
	char *cache_nonce = NULL;
	char *p;

	line = skip_options (line);

	p = line;
	for (p=line; p && p != ' ' && *p != '\t'; p++)
	;
	*p = '\0';
	if (*line)
	cache_nonce = xtrystrdup (line);

	if (opt.ignore_cache_for_signing)
	cache_mode = CACHE_MODE_IGNORE;
	else if (!ctrl->server_local->use_cache_for_signing)
	cache_mode = CACHE_MODE_IGNORE;

	init_membuf (&outbuf, 512);

	rc = agent_pksign (ctrl, cache_nonce, ctrl->server_local->keydesc,
	&outbuf, cache_mode);
	if (rc)
	clear_outbuf (&outbuf);
	else
	rc = write_and_clear_outbuf (ctx, &outbuf);

	xfree (cache_nonce);
	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;
	return leave_cmd (ctx, rc);
	}


	static const char hlp_pkdecrypt[] =
	"PKDECRYPT [<options>]\n"
	"\n"
	"Perform the actual decrypt operation. Input is not\n"
	"sensitive to eavesdropping.";
	static gpg_error_t
	cmd_pkdecrypt (assuan_context_t ctx, char *line)
	{
	int rc;
	ctrl_t ctrl = assuan_get_pointer (ctx);
	unsigned char *value;
	size_t valuelen;
	membuf_t outbuf;
	int padding;

	(void)line;

	/* First inquire the data to decrypt */
	rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%u", MAXLEN_CIPHERTEXT);
	if (!rc)
	rc = assuan_inquire (ctx, "CIPHERTEXT",
	&value, &valuelen, MAXLEN_CIPHERTEXT);
	if (rc)
	return rc;

	init_membuf (&outbuf, 512);

	rc = agent_pkdecrypt (ctrl, ctrl->server_local->keydesc,
	value, valuelen, &outbuf, &padding);
	xfree (value);
	if (rc)
	clear_outbuf (&outbuf);
	else
	{
	if (padding != -1)
	rc = print_assuan_status (ctx, "PADDING", "%d", padding);
	else
	rc = 0;
	if (!rc)
	rc = write_and_clear_outbuf (ctx, &outbuf);
	}
	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;
	return leave_cmd (ctx, rc);
	}


	static const char hlp_genkey[] =
	"GENKEY [--no-protection] [--preset] [--inq-passwd]\n"
	" [--passwd-nonce=<s>] [<cache_nonce>]\n"
	"\n"
	"Generate a new key, store the secret part and return the public\n"
	"part. Here is an example transaction:\n"
	"\n"
	" C: GENKEY\n"
	" S: INQUIRE KEYPARAM\n"
	" C: D (genkey (rsa (nbits 2048)))\n"
	" C: END\n"
	" S: D (public-key\n"
	" S: D (rsa (n 326487324683264) (e 10001)))\n"
	" S: OK key created\n"
	"\n"
	"When the --preset option is used the passphrase for the generated\n"
	"key will be added to the cache. When --inq-passwd is used an inquire\n"
	"with the keyword NEWPASSWD is used to request the passphrase for the\n"
	"new key. When a --passwd-nonce is used, the corresponding cached\n"
	"passphrase is used to protect the new key.";
	static gpg_error_t
	cmd_genkey (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	int no_protection;
	unsigned char *value;
	size_t valuelen;
	unsigned char *newpasswd = NULL;
	membuf_t outbuf;
	char *cache_nonce = NULL;
	char *passwd_nonce = NULL;
	int opt_preset;
	int opt_inq_passwd;
	size_t n;
	char p, pend;
	int c;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	no_protection = has_option (line, "--no-protection");
	opt_preset = has_option (line, "--preset");
	opt_inq_passwd = has_option (line, "--inq-passwd");
	passwd_nonce = option_value (line, "--passwd-nonce");
	if (passwd_nonce)
	{
	for (pend = passwd_nonce; *pend && !spacep (pend); pend++)
	;
	c = *pend;
	*pend = '\0';
	passwd_nonce = xtrystrdup (passwd_nonce);
	*pend = c;
	if (!passwd_nonce)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	}
	line = skip_options (line);

	p = line;
	for (p=line; p && p != ' ' && *p != '\t'; p++)
	;
	*p = '\0';
	if (*line)
	cache_nonce = xtrystrdup (line);

	/* First inquire the parameters */
	rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%u", MAXLEN_KEYPARAM);
	if (!rc)
	rc = assuan_inquire (ctx, "KEYPARAM", &value, &valuelen, MAXLEN_KEYPARAM);
	if (rc)
	return rc;

	init_membuf (&outbuf, 512);

	/* If requested, ask for the password to be used for the key. If
	this is not used the regular Pinentry mechanism is used. */
	if (opt_inq_passwd && !no_protection)
	{
	/* (N is used as a dummy) */
	assuan_begin_confidential (ctx);
	rc = assuan_inquire (ctx, "NEWPASSWD", &newpasswd, &n, 256);
	assuan_end_confidential (ctx);
	if (rc)
	goto leave;
	if (!*newpasswd)
	{
	/* Empty password given - switch to no-protection mode. */
	xfree (newpasswd);
	newpasswd = NULL;
	no_protection = 1;
	}

	}
	else if (passwd_nonce)
	newpasswd = agent_get_cache (passwd_nonce, CACHE_MODE_NONCE);

	rc = agent_genkey (ctrl, cache_nonce, (char*)value, valuelen, no_protection,
	newpasswd, opt_preset, &outbuf);

	leave:
	if (newpasswd)
	{
	/* Assuan_inquire does not allow us to read into secure memory
	thus we need to wipe it ourself. */
	wipememory (newpasswd, strlen (newpasswd));
	xfree (newpasswd);
	}
	xfree (value);
	if (rc)
	clear_outbuf (&outbuf);
	else
	rc = write_and_clear_outbuf (ctx, &outbuf);
	xfree (cache_nonce);
	xfree (passwd_nonce);
	return leave_cmd (ctx, rc);
	}




	static const char hlp_readkey[] =
	"READKEY <hexstring_with_keygrip>\n"
	" --card <keyid>\n"
	"\n"
	"Return the public key for the given keygrip or keyid.\n"
	"With --card, private key file with card information will be created.";
	static gpg_error_t
	cmd_readkey (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	unsigned char grip[20];
	gcry_sexp_t s_pkey = NULL;
	unsigned char *pkbuf = NULL;
	char *serialno = NULL;
	size_t pkbuflen;
	const char *opt_card;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	opt_card = has_option_name (line, "--card");
	line = skip_options (line);

	if (opt_card)
	{
	const char *keyid = opt_card;

	rc = agent_card_getattr (ctrl, "SERIALNO", &serialno);
	if (rc)
	{
	log_error (_("error getting serial number of card: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}

	rc = agent_card_readkey (ctrl, keyid, &pkbuf);
	if (rc)
	goto leave;
	pkbuflen = gcry_sexp_canon_len (pkbuf, 0, NULL, NULL);
	rc = gcry_sexp_sscan (&s_pkey, NULL, (char*)pkbuf, pkbuflen);
	if (rc)
	goto leave;

	if (!gcry_pk_get_keygrip (s_pkey, grip))
	{
	rc = gcry_pk_testkey (s_pkey);
	if (rc == 0)
	rc = gpg_error (GPG_ERR_INTERNAL);

	goto leave;
	}

	rc = agent_write_shadow_key (grip, serialno, keyid, pkbuf, 0);
	if (rc)
	goto leave;

	rc = assuan_send_data (ctx, pkbuf, pkbuflen);
	}
	else
	{
	rc = parse_keygrip (ctx, line, grip);
	if (rc)
	goto leave;

	rc = agent_public_key_from_file (ctrl, grip, &s_pkey);
	if (!rc)
	{
	pkbuflen = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0);
	log_assert (pkbuflen);
	pkbuf = xtrymalloc (pkbuflen);
	if (!pkbuf)
	rc = gpg_error_from_syserror ();
	else
	{
	gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, pkbuf, pkbuflen);
	rc = assuan_send_data (ctx, pkbuf, pkbuflen);
	}
	}
	}

	leave:
	xfree (serialno);
	xfree (pkbuf);
	gcry_sexp_release (s_pkey);
	return leave_cmd (ctx, rc);
	}



	static const char hlp_keyinfo[] =
	"KEYINFO [--[ssh-]list] [--data] [--ssh-fpr] [--with-ssh] <keygrip>\n"
	"\n"
	"Return information about the key specified by the KEYGRIP. If the\n"
	"key is not available GPG_ERR_NOT_FOUND is returned. If the option\n"
	"--list is given the keygrip is ignored and information about all\n"
	"available keys are returned. If --ssh-list is given information\n"
	"about all keys listed in the sshcontrol are returned. With --with-ssh\n"
	"information from sshcontrol is always added to the info. Unless --data\n"
	"is given, the information is returned as a status line using the format:\n"
	"\n"
	" KEYINFO <keygrip> <type> <serialno> <idstr> <cached> <protection> <fpr>\n"
	"\n"
	"KEYGRIP is the keygrip.\n"
	"\n"
	"TYPE is describes the type of the key:\n"
	" 'D' - Regular key stored on disk,\n"
	" 'T' - Key is stored on a smartcard (token),\n"
	" 'X' - Unknown type,\n"
	" '-' - Key is missing.\n"
	"\n"
	"SERIALNO is an ASCII string with the serial number of the\n"
	" smartcard. If the serial number is not known a single\n"
	" dash '-' is used instead.\n"
	"\n"
	"IDSTR is the IDSTR used to distinguish keys on a smartcard. If it\n"
	" is not known a dash is used instead.\n"
	"\n"
	"CACHED is 1 if the passphrase for the key was found in the key cache.\n"
	" If not, a '-' is used instead.\n"
	"\n"
	"PROTECTION describes the key protection type:\n"
	" 'P' - The key is protected with a passphrase,\n"
	" 'C' - The key is not protected,\n"
	" '-' - Unknown protection.\n"
	"\n"
	"FPR returns the formatted ssh-style fingerprint of the key. It is only\n"
	" printed if the option --ssh-fpr has been used. It defaults to '-'.\n"
	"\n"
	"TTL is the TTL in seconds for that key or '-' if n/a.\n"
	"\n"
	"FLAGS is a word consisting of one-letter flags:\n"
	" 'D' - The key has been disabled,\n"
	" 'S' - The key is listed in sshcontrol (requires --with-ssh),\n"
	" 'c' - Use of the key needs to be confirmed,\n"
	" '-' - No flags given.\n"
	"\n"
	"More information may be added in the future.";
	static gpg_error_t
	do_one_keyinfo (ctrl_t ctrl, const unsigned char *grip, assuan_context_t ctx,
	int data, int with_ssh_fpr, int in_ssh,
	int ttl, int disabled, int confirm)
	{
	gpg_error_t err;
	char hexgrip[40+1];
	char *fpr = NULL;
	int keytype;
	unsigned char *shadow_info = NULL;
	char *serialno = NULL;
	char *idstr = NULL;
	const char *keytypestr;
	const char *cached;
	const char *protectionstr;
	char *pw;
	int missing_key = 0;
	char ttlbuf[20];
	char flagsbuf[5];

	err = agent_key_info_from_file (ctrl, grip, &keytype, &shadow_info);
	if (err)
	{
	if (in_ssh && gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	missing_key = 1;
	else
	goto leave;
	}

	/* Reformat the grip so that we use uppercase as good style. */
	bin2hex (grip, 20, hexgrip);

	if (ttl > 0)
	snprintf (ttlbuf, sizeof ttlbuf, "%d", ttl);
	else
	strcpy (ttlbuf, "-");

	*flagsbuf = 0;
	if (disabled)
	strcat (flagsbuf, "D");
	if (in_ssh)
	strcat (flagsbuf, "S");
	if (confirm)
	strcat (flagsbuf, "c");
	if (!*flagsbuf)
	strcpy (flagsbuf, "-");


	if (missing_key)
	{
	protectionstr = "-"; keytypestr = "-";
	}
	else
	{
	switch (keytype)
	{
	case PRIVATE_KEY_CLEAR:
	case PRIVATE_KEY_OPENPGP_NONE:
	protectionstr = "C"; keytypestr = "D";
	break;
	case PRIVATE_KEY_PROTECTED: protectionstr = "P"; keytypestr = "D";
	break;
	case PRIVATE_KEY_SHADOWED: protectionstr = "-"; keytypestr = "T";
	break;
	default: protectionstr = "-"; keytypestr = "X";
	break;
	}
	}

	/* Compute the ssh fingerprint if requested. */
	if (with_ssh_fpr)
	{
	gcry_sexp_t key;

	if (!agent_raw_key_from_file (ctrl, grip, &key))
	{
	ssh_get_fingerprint_string (key, &fpr);
	gcry_sexp_release (key);
	}
	}

	/* Here we have a little race by doing the cache check separately
	from the retrieval function. Given that the cache flag is only a
	hint, it should not really matter. */
	pw = agent_get_cache (hexgrip, CACHE_MODE_NORMAL);
	cached = pw ? "1" : "-";
	xfree (pw);

	if (shadow_info)
	{
	err = parse_shadow_info (shadow_info, &serialno, &idstr, NULL);
	if (err)
	goto leave;
	}

	if (!data)
	err = agent_write_status (ctrl, "KEYINFO",
	hexgrip,
	keytypestr,
	serialno? serialno : "-",
	idstr? idstr : "-",
	cached,
	protectionstr,
	fpr? fpr : "-",
	ttlbuf,
	flagsbuf,
	NULL);
	else
	{
	char *string;

	string = xtryasprintf ("%s %s %s %s %s %s %s %s %s\n",
	hexgrip, keytypestr,
	serialno? serialno : "-",
	idstr? idstr : "-", cached, protectionstr,
	fpr? fpr : "-",
	ttlbuf,
	flagsbuf);
	if (!string)
	err = gpg_error_from_syserror ();
	else
	err = assuan_send_data (ctx, string, strlen(string));
	xfree (string);
	}

	leave:
	xfree (fpr);
	xfree (shadow_info);
	xfree (serialno);
	xfree (idstr);
	return err;
	}


	/* Entry int for the command KEYINFO. This function handles the
	command option processing. For details see hlp_keyinfo above. */
	static gpg_error_t
	cmd_keyinfo (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int err;
	unsigned char grip[20];
	DIR *dir = NULL;
	int list_mode;
	int opt_data, opt_ssh_fpr, opt_with_ssh;
	ssh_control_file_t cf = NULL;
	char hexgrip[41];
	int disabled, ttl, confirm, is_ssh;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	if (has_option (line, "--ssh-list"))
	list_mode = 2;
	else
	list_mode = has_option (line, "--list");
	opt_data = has_option (line, "--data");
	opt_ssh_fpr = has_option (line, "--ssh-fpr");
	opt_with_ssh = has_option (line, "--with-ssh");
	line = skip_options (line);

	if (opt_with_ssh \|\| list_mode == 2)
	cf = ssh_open_control_file ();

	if (list_mode == 2)
	{
	if (cf)
	{
	while (!ssh_read_control_file (cf, hexgrip,
	&disabled, &ttl, &confirm))
	{
	if (hex2bin (hexgrip, grip, 20) < 0 )
	continue; /* Bad hex string. */
	err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, 1,
	ttl, disabled, confirm);
	if (err)
	goto leave;
	}
	}
	err = 0;
	}
	else if (list_mode)
	{
	char *dirname;
	struct dirent *dir_entry;

	dirname = make_filename_try (gnupg_homedir (),
	GNUPG_PRIVATE_KEYS_DIR, NULL);
	if (!dirname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	dir = opendir (dirname);
	if (!dir)
	{
	err = gpg_error_from_syserror ();
	xfree (dirname);
	goto leave;
	}
	xfree (dirname);

	while ( (dir_entry = readdir (dir)) )
	{
	if (strlen (dir_entry->d_name) != 44
	\|\| strcmp (dir_entry->d_name + 40, ".key"))
	continue;
	strncpy (hexgrip, dir_entry->d_name, 40);
	hexgrip[40] = 0;

	if ( hex2bin (hexgrip, grip, 20) < 0 )
	continue; /* Bad hex string. */

	disabled = ttl = confirm = is_ssh = 0;
	if (opt_with_ssh)
	{
	err = ssh_search_control_file (cf, hexgrip,
	&disabled, &ttl, &confirm);
	if (!err)
	is_ssh = 1;
	else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	goto leave;
	}

	err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, is_ssh,
	ttl, disabled, confirm);
	if (err)
	goto leave;
	}
	err = 0;
	}
	else
	{
	err = parse_keygrip (ctx, line, grip);
	if (err)
	goto leave;
	disabled = ttl = confirm = is_ssh = 0;
	if (opt_with_ssh)
	{
	err = ssh_search_control_file (cf, line,
	&disabled, &ttl, &confirm);
	if (!err)
	is_ssh = 1;
	else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	goto leave;
	}

	err = do_one_keyinfo (ctrl, grip, ctx, opt_data, opt_ssh_fpr, is_ssh,
	ttl, disabled, confirm);
	}

	leave:
	ssh_close_control_file (cf);
	if (dir)
	closedir (dir);
	if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	leave_cmd (ctx, err);
	return err;
	}



	/* Helper for cmd_get_passphrase. */
	static int
	send_back_passphrase (assuan_context_t ctx, int via_data, const char *pw)
	{
	size_t n;
	int rc;

	assuan_begin_confidential (ctx);
	n = strlen (pw);
	if (via_data)
	rc = assuan_send_data (ctx, pw, n);
	else
	{
	char p = xtrymalloc_secure (n2+1);
	if (!p)
	rc = gpg_error_from_syserror ();
	else
	{
	bin2hex (pw, n, p);
	rc = assuan_set_okay_line (ctx, p);
	xfree (p);
	}
	}
	return rc;
	}


	static const char hlp_get_passphrase[] =
	"GET_PASSPHRASE [--data] [--check] [--no-ask] [--repeat[=N]]\n"
	" [--qualitybar] <cache_id>\n"
	" [<error_message> <prompt> <description>]\n"
	"\n"
	"This function is usually used to ask for a passphrase to be used\n"
	"for conventional encryption, but may also be used by programs which\n"
	"need specal handling of passphrases. This command uses a syntax\n"
	"which helps clients to use the agent with minimum effort. The\n"
	"agent either returns with an error or with a OK followed by the hex\n"
	"encoded passphrase. Note that the length of the strings is\n"
	"implicitly limited by the maximum length of a command.\n"
	"\n"
	"If the option \"--data\" is used the passphrase is returned by usual\n"
	"data lines and not on the okay line.\n"
	"\n"
	"If the option \"--check\" is used the passphrase constraints checks as\n"
	"implemented by gpg-agent are applied. A check is not done if the\n"
	"passphrase has been found in the cache.\n"
	"\n"
	"If the option \"--no-ask\" is used and the passphrase is not in the\n"
	"cache the user will not be asked to enter a passphrase but the error\n"
	"code GPG_ERR_NO_DATA is returned. \n"
	"\n"
	"If the option \"--qualitybar\" is used a visual indication of the\n"
	"entered passphrase quality is shown. (Unless no minimum passphrase\n"
	"length has been configured.)";
	static gpg_error_t
	cmd_get_passphrase (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *pw;
	char *response;
	char cacheid = NULL, desc = NULL, prompt = NULL, errtext = NULL;
	const char *desc2 = _("Please re-enter this passphrase");
	char *p;
	int opt_data, opt_check, opt_no_ask, opt_qualbar;
	int opt_repeat = 0;
	char *entry_errtext = NULL;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	opt_data = has_option (line, "--data");
	opt_check = has_option (line, "--check");
	opt_no_ask = has_option (line, "--no-ask");
	if (has_option_name (line, "--repeat"))
	{
	p = option_value (line, "--repeat");
	if (p)
	opt_repeat = atoi (p);
	else
	opt_repeat = 1;
	}
	opt_qualbar = has_option (line, "--qualitybar");
	line = skip_options (line);

	cacheid = line;
	p = strchr (cacheid, ' ');
	if (p)
	{
	*p++ = 0;
	while (*p == ' ')
	p++;
	errtext = p;
	p = strchr (errtext, ' ');
	if (p)
	{
	*p++ = 0;
	while (*p == ' ')
	p++;
	prompt = p;
	p = strchr (prompt, ' ');
	if (p)
	{
	*p++ = 0;
	while (*p == ' ')
	p++;
	desc = p;
	p = strchr (desc, ' ');
	if (p)
	p = 0; / Ignore trailing garbage. */
	}
	}
	}
	if (!*cacheid \|\| strlen (cacheid) > 50)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of cacheID");
	if (!desc)
	return set_error (GPG_ERR_ASS_PARAMETER, "no description given");

	if (!strcmp (cacheid, "X"))
	cacheid = NULL;
	if (!strcmp (errtext, "X"))
	errtext = NULL;
	if (!strcmp (prompt, "X"))
	prompt = NULL;
	if (!strcmp (desc, "X"))
	desc = NULL;

	pw = cacheid ? agent_get_cache (cacheid, CACHE_MODE_USER) : NULL;
	if (pw)
	{
	rc = send_back_passphrase (ctx, opt_data, pw);
	xfree (pw);
	}
	else if (opt_no_ask)
	rc = gpg_error (GPG_ERR_NO_DATA);
	else
	{
	/* Note, that we only need to replace the + characters and
	should leave the other escaping in place because the escaped
	string is send verbatim to the pinentry which does the
	unescaping (but not the + replacing) */
	if (errtext)
	plus_to_blank (errtext);
	if (prompt)
	plus_to_blank (prompt);
	if (desc)
	plus_to_blank (desc);

	next_try:
	rc = agent_get_passphrase (ctrl, &response, desc, prompt,
	entry_errtext? entry_errtext:errtext,
	opt_qualbar, cacheid, CACHE_MODE_USER);
	xfree (entry_errtext);
	entry_errtext = NULL;
	if (!rc)
	{
	int i;

	if (opt_check
	&& check_passphrase_constraints (ctrl, response, &entry_errtext))
	{
	xfree (response);
	goto next_try;
	}
	for (i = 0; i < opt_repeat; i++)
	{
	char *response2;

	if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK)
	break;

	rc = agent_get_passphrase (ctrl, &response2, desc2, prompt,
	errtext, 0,
	cacheid, CACHE_MODE_USER);
	if (rc)
	break;
	if (strcmp (response2, response))
	{
	xfree (response2);
	xfree (response);
	entry_errtext = try_percent_escape
	(_("does not match - try again"), NULL);
	if (!entry_errtext)
	{
	rc = gpg_error_from_syserror ();
	break;
	}
	goto next_try;
	}
	xfree (response2);
	}
	if (!rc)
	{
	if (cacheid)
	agent_put_cache (cacheid, CACHE_MODE_USER, response, 0);
	rc = send_back_passphrase (ctx, opt_data, response);
	}
	xfree (response);
	}
	}

	return leave_cmd (ctx, rc);
	}


	static const char hlp_clear_passphrase[] =
	"CLEAR_PASSPHRASE [--mode=normal] <cache_id>\n"
	"\n"
	"may be used to invalidate the cache entry for a passphrase. The\n"
	"function returns with OK even when there is no cached passphrase.\n"
	"The --mode=normal option is used to clear an entry for a cacheid\n"
	"added by the agent.\n";
	static gpg_error_t
	cmd_clear_passphrase (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	char *cacheid = NULL;
	char *p;
	int opt_normal;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	opt_normal = has_option (line, "--mode=normal");
	line = skip_options (line);

	/* parse the stuff */
	for (p=line; *p == ' '; p++)
	;
	cacheid = p;
	p = strchr (cacheid, ' ');
	if (p)
	p = 0; / ignore garbage */
	if (!*cacheid \|\| strlen (cacheid) > 50)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid length of cacheID");

	agent_put_cache (cacheid, opt_normal ? CACHE_MODE_NORMAL : CACHE_MODE_USER,
	NULL, 0);

	agent_clear_passphrase (ctrl, cacheid,
	opt_normal ? CACHE_MODE_NORMAL : CACHE_MODE_USER);

	return 0;
	}


	static const char hlp_get_confirmation[] =
	"GET_CONFIRMATION <description>\n"
	"\n"
	"This command may be used to ask for a simple confirmation.\n"
	"DESCRIPTION is displayed along with a Okay and Cancel button. This\n"
	"command uses a syntax which helps clients to use the agent with\n"
	"minimum effort. The agent either returns with an error or with a\n"
	"OK. Note, that the length of DESCRIPTION is implicitly limited by\n"
	"the maximum length of a command. DESCRIPTION should not contain\n"
	"any spaces, those must be encoded either percent escaped or simply\n"
	"as '+'.";
	static gpg_error_t
	cmd_get_confirmation (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *desc = NULL;
	char *p;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	/* parse the stuff */
	for (p=line; *p == ' '; p++)
	;
	desc = p;
	p = strchr (desc, ' ');
	if (p)
	p = 0; / We ignore any garbage -may be later used for other args. */

	if (!*desc)
	return set_error (GPG_ERR_ASS_PARAMETER, "no description given");

	if (!strcmp (desc, "X"))
	desc = NULL;

	/* Note, that we only need to replace the + characters and should
	leave the other escaping in place because the escaped string is
	send verbatim to the pinentry which does the unescaping (but not
	the + replacing) */
	if (desc)
	plus_to_blank (desc);

	rc = agent_get_confirmation (ctrl, desc, NULL, NULL, 0);
	return leave_cmd (ctx, rc);
	}



	static const char hlp_learn[] =
	"LEARN [--send] [--sendinfo] [--force]\n"
	"\n"
	"Learn something about the currently inserted smartcard. With\n"
	"--sendinfo information about the card is returned; with --send\n"
	"the available certificates are returned as D lines; with --force\n"
	"private key storage will be updated by the result.";
	static gpg_error_t
	cmd_learn (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	int send, sendinfo, force;

	send = has_option (line, "--send");
	sendinfo = send? 1 : has_option (line, "--sendinfo");
	force = has_option (line, "--force");

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	err = agent_handle_learn (ctrl, send, sendinfo? ctx : NULL, force);
	return leave_cmd (ctx, err);
	}



	static const char hlp_passwd[] =
	"PASSWD [--cache-nonce=<c>] [--passwd-nonce=<s>] [--preset]\n"
	" [--verify] <hexkeygrip>\n"
	"\n"
	"Change the passphrase/PIN for the key identified by keygrip in LINE. If\n"
	"--preset is used then the new passphrase will be added to the cache.\n"
	"If --verify is used the command asks for the passphrase and verifies\n"
	"that the passphrase valid.\n";
	static gpg_error_t
	cmd_passwd (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	int c;
	char *cache_nonce = NULL;
	char *passwd_nonce = NULL;
	unsigned char grip[20];
	gcry_sexp_t s_skey = NULL;
	unsigned char *shadow_info = NULL;
	char *passphrase = NULL;
	char *pend;
	int opt_preset, opt_verify;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	opt_preset = has_option (line, "--preset");
	cache_nonce = option_value (line, "--cache-nonce");
	opt_verify = has_option (line, "--verify");
	if (cache_nonce)
	{
	for (pend = cache_nonce; *pend && !spacep (pend); pend++)
	;
	c = *pend;
	*pend = '\0';
	cache_nonce = xtrystrdup (cache_nonce);
	*pend = c;
	if (!cache_nonce)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	passwd_nonce = option_value (line, "--passwd-nonce");
	if (passwd_nonce)
	{
	for (pend = passwd_nonce; *pend && !spacep (pend); pend++)
	;
	c = *pend;
	*pend = '\0';
	passwd_nonce = xtrystrdup (passwd_nonce);
	*pend = c;
	if (!passwd_nonce)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	line = skip_options (line);

	err = parse_keygrip (ctx, line, grip);
	if (err)
	goto leave;

	ctrl->in_passwd++;
	err = agent_key_from_file (ctrl,
	opt_verify? NULL : cache_nonce,
	ctrl->server_local->keydesc,
	grip, &shadow_info, CACHE_MODE_IGNORE, NULL,
	&s_skey, &passphrase);
	if (err)
	;
	else if (shadow_info)
	{
	log_error ("changing a smartcard PIN is not yet supported\n");
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	}
	else if (opt_verify)
	{
	/* All done. */
	if (passphrase)
	{
	if (!passwd_nonce)
	{
	char buf[12];
	gcry_create_nonce (buf, 12);
	passwd_nonce = bin2hex (buf, 12, NULL);
	}
	if (passwd_nonce
	&& !agent_put_cache (passwd_nonce, CACHE_MODE_NONCE,
	passphrase, CACHE_TTL_NONCE))
	{
	assuan_write_status (ctx, "PASSWD_NONCE", passwd_nonce);
	xfree (ctrl->server_local->last_passwd_nonce);
	ctrl->server_local->last_passwd_nonce = passwd_nonce;
	passwd_nonce = NULL;
	}
	}
	}
	else
	{
	char *newpass = NULL;

	if (passwd_nonce)
	newpass = agent_get_cache (passwd_nonce, CACHE_MODE_NONCE);
	err = agent_protect_and_store (ctrl, s_skey, &newpass);
	if (!err && passphrase)
	{
	/* A passphrase existed on the old key and the change was
	successful. Return a nonce for that old passphrase to
	let the caller try to unprotect the other subkeys with
	the same key. */
	if (!cache_nonce)
	{
	char buf[12];
	gcry_create_nonce (buf, 12);
	cache_nonce = bin2hex (buf, 12, NULL);
	}
	if (cache_nonce
	&& !agent_put_cache (cache_nonce, CACHE_MODE_NONCE,
	passphrase, CACHE_TTL_NONCE))
	{
	assuan_write_status (ctx, "CACHE_NONCE", cache_nonce);
	xfree (ctrl->server_local->last_cache_nonce);
	ctrl->server_local->last_cache_nonce = cache_nonce;
	cache_nonce = NULL;
	}
	if (newpass)
	{
	/* If we have a new passphrase (which might be empty) we
	store it under a passwd nonce so that the caller may
	send that nonce again to use it for another key. */
	if (!passwd_nonce)
	{
	char buf[12];
	gcry_create_nonce (buf, 12);
	passwd_nonce = bin2hex (buf, 12, NULL);
	}
	if (passwd_nonce
	&& !agent_put_cache (passwd_nonce, CACHE_MODE_NONCE,
	newpass, CACHE_TTL_NONCE))
	{
	assuan_write_status (ctx, "PASSWD_NONCE", passwd_nonce);
	xfree (ctrl->server_local->last_passwd_nonce);
	ctrl->server_local->last_passwd_nonce = passwd_nonce;
	passwd_nonce = NULL;
	}
	}
	}
	if (!err && opt_preset)
	{
	char hexgrip[40+1];
	bin2hex(grip, 20, hexgrip);
	err = agent_put_cache (hexgrip, CACHE_MODE_ANY, newpass,
	ctrl->cache_ttl_opt_preset);
	}
	xfree (newpass);
	}
	ctrl->in_passwd--;

	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;

	leave:
	xfree (passphrase);
	gcry_sexp_release (s_skey);
	xfree (shadow_info);
	xfree (cache_nonce);
	xfree (passwd_nonce);
	return leave_cmd (ctx, err);
	}


	static const char hlp_preset_passphrase[] =
	"PRESET_PASSPHRASE [--inquire] <string_or_keygrip> <timeout> [<hexstring>]\n"
	"\n"
	"Set the cached passphrase/PIN for the key identified by the keygrip\n"
	"to passwd for the given time, where -1 means infinite and 0 means\n"
	"the default (currently only a timeout of -1 is allowed, which means\n"
	"to never expire it). If passwd is not provided, ask for it via the\n"
	"pinentry module unless --inquire is passed in which case the passphrase\n"
	"is retrieved from the client via a server inquire.\n";
	static gpg_error_t
	cmd_preset_passphrase (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *grip_clear = NULL;
	unsigned char *passphrase = NULL;
	int ttl;
	size_t len;
	int opt_inquire;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	if (!opt.allow_preset_passphrase)
	return set_error (GPG_ERR_NOT_SUPPORTED, "no --allow-preset-passphrase");

	opt_inquire = has_option (line, "--inquire");
	line = skip_options (line);
	grip_clear = line;
	while (line && (line != ' ' && *line != '\t'))
	line++;
	if (!*line)
	return gpg_error (GPG_ERR_MISSING_VALUE);
	*line = '\0';
	line++;
	while (line && (line == ' ' \|\| *line == '\t'))
	line++;

	/* Currently, only infinite timeouts are allowed. */
	ttl = -1;
	if (line[0] != '-' \|\| line[1] != '1')
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	line++;
	line++;
	while (!(line != ' ' && line != '\t'))
	line++;

	/* Syntax check the hexstring. */
	len = 0;
	rc = parse_hexstring (ctx, line, &len);
	if (rc)
	return rc;
	line[len] = '\0';

	/* If there is a passphrase, use it. Currently, a passphrase is
	required. */
	if (*line)
	{
	if (opt_inquire)
	{
	rc = set_error (GPG_ERR_ASS_PARAMETER,
	"both --inquire and passphrase specified");
	goto leave;
	}

	/* Do in-place conversion. */
	passphrase = line;
	if (!hex2str (passphrase, passphrase, strlen (passphrase)+1, NULL))
	rc = set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring");
	}
	else if (opt_inquire)
	{
	/* Note that the passphrase will be truncated at any null byte and the
	* limit is 480 characters. */
	size_t maxlen = 480;

	rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%zu", maxlen);
	if (!rc)
	rc = assuan_inquire (ctx, "PASSPHRASE", &passphrase, &len, maxlen);
	}
	else
	rc = set_error (GPG_ERR_NOT_IMPLEMENTED, "passphrase is required");

	if (!rc)
	{
	rc = agent_put_cache (grip_clear, CACHE_MODE_ANY, passphrase, ttl);
	if (opt_inquire)
	xfree (passphrase);
	}

	leave:
	return leave_cmd (ctx, rc);
	}



	static const char hlp_scd[] =
	"SCD <commands to pass to the scdaemon>\n"
	" \n"
	"This is a general quote command to redirect everything to the\n"
	"SCdaemon.";
	static gpg_error_t
	cmd_scd (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	rc = divert_generic_cmd (ctrl, line, ctx);

	return rc;
	}



	static const char hlp_keywrap_key[] =
	"KEYWRAP_KEY [--clear] <mode>\n"
	"\n"
	"Return a key to wrap another key. For now the key is returned\n"
	- "verbatim and and thus makes not much sense because an eavesdropper on\n"
	+ "verbatim and thus makes not much sense because an eavesdropper on\n"
	"the gpg-agent connection will see the key as well as the wrapped key.\n"
	"However, this function may either be equipped with a public key\n"
	"mechanism or not used at all if the key is a pre-shared key. In any\n"
	"case wrapping the import and export of keys is a requirement for\n"
	"certain cryptographic validations and thus useful. The key persists\n"
	"until a RESET command but may be cleared using the option --clear.\n"
	"\n"
	"Supported modes are:\n"
	" --import - Return a key to import a key into gpg-agent\n"
	" --export - Return a key to export a key from gpg-agent";
	static gpg_error_t
	cmd_keywrap_key (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	int clearopt = has_option (line, "--clear");

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	assuan_begin_confidential (ctx);
	if (has_option (line, "--import"))
	{
	xfree (ctrl->server_local->import_key);
	if (clearopt)
	ctrl->server_local->import_key = NULL;
	else if (!(ctrl->server_local->import_key =
	gcry_random_bytes (KEYWRAP_KEYSIZE, GCRY_STRONG_RANDOM)))
	err = gpg_error_from_syserror ();
	else
	err = assuan_send_data (ctx, ctrl->server_local->import_key,
	KEYWRAP_KEYSIZE);
	}
	else if (has_option (line, "--export"))
	{
	xfree (ctrl->server_local->export_key);
	if (clearopt)
	ctrl->server_local->export_key = NULL;
	else if (!(ctrl->server_local->export_key =
	gcry_random_bytes (KEYWRAP_KEYSIZE, GCRY_STRONG_RANDOM)))
	err = gpg_error_from_syserror ();
	else
	err = assuan_send_data (ctx, ctrl->server_local->export_key,
	KEYWRAP_KEYSIZE);
	}
	else
	err = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for MODE");
	assuan_end_confidential (ctx);

	return leave_cmd (ctx, err);
	}



	static const char hlp_import_key[] =
	"IMPORT_KEY [--unattended] [--force] [<cache_nonce>]\n"
	"\n"
	"Import a secret key into the key store. The key is expected to be\n"
	"encrypted using the current session's key wrapping key (cf. command\n"
	"KEYWRAP_KEY) using the AESWRAP-128 algorithm. This function takes\n"
	"no arguments but uses the inquiry \"KEYDATA\" to ask for the actual\n"
	"key data. The unwrapped key must be a canonical S-expression. The\n"
	"option --unattended tries to import the key as-is without any\n"
	"re-encryption. Existing key can be overwritten with --force.";
	static gpg_error_t
	cmd_import_key (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	int opt_unattended;
	int force;
	unsigned char *wrappedkey = NULL;
	size_t wrappedkeylen;
	gcry_cipher_hd_t cipherhd = NULL;
	unsigned char *key = NULL;
	size_t keylen, realkeylen;
	char *passphrase = NULL;
	unsigned char *finalkey = NULL;
	size_t finalkeylen;
	unsigned char grip[20];
	gcry_sexp_t openpgp_sexp = NULL;
	char *cache_nonce = NULL;
	char *p;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	if (!ctrl->server_local->import_key)
	{
	err = gpg_error (GPG_ERR_MISSING_KEY);
	goto leave;
	}

	opt_unattended = has_option (line, "--unattended");
	force = has_option (line, "--force");
	line = skip_options (line);

	p = line;
	for (p=line; p && p != ' ' && *p != '\t'; p++)
	;
	*p = '\0';
	if (*line)
	cache_nonce = xtrystrdup (line);

	assuan_begin_confidential (ctx);
	err = assuan_inquire (ctx, "KEYDATA",
	&wrappedkey, &wrappedkeylen, MAXLEN_KEYDATA);
	assuan_end_confidential (ctx);
	if (err)
	goto leave;
	if (wrappedkeylen < 24)
	{
	err = gpg_error (GPG_ERR_INV_LENGTH);
	goto leave;
	}
	keylen = wrappedkeylen - 8;
	key = xtrymalloc_secure (keylen);
	if (!key)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (err)
	goto leave;
	err = gcry_cipher_setkey (cipherhd,
	ctrl->server_local->import_key, KEYWRAP_KEYSIZE);
	if (err)
	goto leave;
	err = gcry_cipher_decrypt (cipherhd, key, keylen, wrappedkey, wrappedkeylen);
	if (err)
	goto leave;
	gcry_cipher_close (cipherhd);
	cipherhd = NULL;
	xfree (wrappedkey);
	wrappedkey = NULL;

	realkeylen = gcry_sexp_canon_len (key, keylen, NULL, &err);
	if (!realkeylen)
	goto leave; /* Invalid canonical encoded S-expression. */

	err = keygrip_from_canon_sexp (key, realkeylen, grip);
	if (err)
	{
	/* This might be due to an unsupported S-expression format.
	Check whether this is openpgp-private-key and trigger that
	import code. */
	if (!gcry_sexp_sscan (&openpgp_sexp, NULL, key, realkeylen))
	{
	const char *tag;
	size_t taglen;

	tag = gcry_sexp_nth_data (openpgp_sexp, 0, &taglen);
	if (tag && taglen == 19 && !memcmp (tag, "openpgp-private-key", 19))
	;
	else
	{
	gcry_sexp_release (openpgp_sexp);
	openpgp_sexp = NULL;
	}
	}
	if (!openpgp_sexp)
	goto leave; /* Note that ERR is still set. */
	}


	if (openpgp_sexp)
	{
	/* In most cases the key is encrypted and thus the conversion
	function from the OpenPGP format to our internal format will
	ask for a passphrase. That passphrase will be returned and
	used to protect the key using the same code as for regular
	key import. */

	xfree (key);
	key = NULL;
	err = convert_from_openpgp (ctrl, openpgp_sexp, force, grip,
	ctrl->server_local->keydesc, cache_nonce,
	&key, opt_unattended? NULL : &passphrase);
	if (err)
	goto leave;
	realkeylen = gcry_sexp_canon_len (key, 0, NULL, &err);
	if (!realkeylen)
	goto leave; /* Invalid canonical encoded S-expression. */
	if (passphrase)
	{
	assert (!opt_unattended);
	if (!cache_nonce)
	{
	char buf[12];
	gcry_create_nonce (buf, 12);
	cache_nonce = bin2hex (buf, 12, NULL);
	}
	if (cache_nonce
	&& !agent_put_cache (cache_nonce, CACHE_MODE_NONCE,
	passphrase, CACHE_TTL_NONCE))
	assuan_write_status (ctx, "CACHE_NONCE", cache_nonce);
	}
	}
	else if (opt_unattended)
	{
	err = set_error (GPG_ERR_ASS_PARAMETER,
	"\"--unattended\" may only be used with OpenPGP keys");
	goto leave;
	}
	else
	{
	if (!force && !agent_key_available (grip))
	err = gpg_error (GPG_ERR_EEXIST);
	else
	{
	char *prompt = xtryasprintf
	(_("Please enter the passphrase to protect the "
	"imported object within the %s system."), GNUPG_NAME);
	if (!prompt)
	err = gpg_error_from_syserror ();
	else
	err = agent_ask_new_passphrase (ctrl, prompt, &passphrase);
	xfree (prompt);
	}
	if (err)
	goto leave;
	}

	if (passphrase)
	{
	err = agent_protect (key, passphrase, &finalkey, &finalkeylen,
	ctrl->s2k_count, -1);
	if (!err)
	err = agent_write_private_key (grip, finalkey, finalkeylen, force);
	}
	else
	err = agent_write_private_key (grip, key, realkeylen, force);

	leave:
	gcry_sexp_release (openpgp_sexp);
	xfree (finalkey);
	xfree (passphrase);
	xfree (key);
	gcry_cipher_close (cipherhd);
	xfree (wrappedkey);
	xfree (cache_nonce);
	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;
	return leave_cmd (ctx, err);
	}



	static const char hlp_export_key[] =
	"EXPORT_KEY [--cache-nonce=<nonce>] [--openpgp] <hexstring_with_keygrip>\n"
	"\n"
	"Export a secret key from the key store. The key will be encrypted\n"
	"using the current session's key wrapping key (cf. command KEYWRAP_KEY)\n"
	"using the AESWRAP-128 algorithm. The caller needs to retrieve that key\n"
	"prior to using this command. The function takes the keygrip as argument.\n"
	"\n"
	"If --openpgp is used, the secret key material will be exported in RFC 4880\n"
	"compatible passphrase-protected form. Without --openpgp, the secret key\n"
	"material will be exported in the clear (after prompting the user to unlock\n"
	"it, if needed).\n";
	static gpg_error_t
	cmd_export_key (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	unsigned char grip[20];
	gcry_sexp_t s_skey = NULL;
	unsigned char *key = NULL;
	size_t keylen;
	gcry_cipher_hd_t cipherhd = NULL;
	unsigned char *wrappedkey = NULL;
	size_t wrappedkeylen;
	int openpgp;
	char *cache_nonce;
	char *passphrase = NULL;
	unsigned char *shadow_info = NULL;
	char *pend;
	int c;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	openpgp = has_option (line, "--openpgp");
	cache_nonce = option_value (line, "--cache-nonce");
	if (cache_nonce)
	{
	for (pend = cache_nonce; *pend && !spacep (pend); pend++)
	;
	c = *pend;
	*pend = '\0';
	cache_nonce = xtrystrdup (cache_nonce);
	*pend = c;
	if (!cache_nonce)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}
	line = skip_options (line);

	if (!ctrl->server_local->export_key)
	{
	err = set_error (GPG_ERR_MISSING_KEY, "did you run KEYWRAP_KEY ?");
	goto leave;
	}

	err = parse_keygrip (ctx, line, grip);
	if (err)
	goto leave;

	if (agent_key_available (grip))
	{
	err = gpg_error (GPG_ERR_NO_SECKEY);
	goto leave;
	}

	/* Get the key from the file. With the openpgp flag we also ask for
	the passphrase so that we can use it to re-encrypt it. */
	err = agent_key_from_file (ctrl, cache_nonce,
	ctrl->server_local->keydesc, grip,
	&shadow_info, CACHE_MODE_IGNORE, NULL, &s_skey,
	openpgp ? &passphrase : NULL);
	if (err)
	goto leave;
	if (shadow_info)
	{
	/* Key is on a smartcard. */
	err = gpg_error (GPG_ERR_UNUSABLE_SECKEY);
	goto leave;
	}

	if (openpgp)
	{
	/* The openpgp option changes the key format into the OpenPGP
	key transfer format. The result is already a padded
	canonical S-expression. */
	if (!passphrase)
	{
	err = agent_ask_new_passphrase
	(ctrl, _("This key (or subkey) is not protected with a passphrase."
	" Please enter a new passphrase to export it."),
	&passphrase);
	if (err)
	goto leave;
	}
	err = convert_to_openpgp (ctrl, s_skey, passphrase, &key, &keylen);
	if (!err && passphrase)
	{
	if (!cache_nonce)
	{
	char buf[12];
	gcry_create_nonce (buf, 12);
	cache_nonce = bin2hex (buf, 12, NULL);
	}
	if (cache_nonce
	&& !agent_put_cache (cache_nonce, CACHE_MODE_NONCE,
	passphrase, CACHE_TTL_NONCE))
	{
	assuan_write_status (ctx, "CACHE_NONCE", cache_nonce);
	xfree (ctrl->server_local->last_cache_nonce);
	ctrl->server_local->last_cache_nonce = cache_nonce;
	cache_nonce = NULL;
	}
	}
	}
	else
	{
	/* Convert into a canonical S-expression and wrap that. */
	err = make_canon_sexp_pad (s_skey, 1, &key, &keylen);
	}
	if (err)
	goto leave;
	gcry_sexp_release (s_skey);
	s_skey = NULL;

	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (err)
	goto leave;
	err = gcry_cipher_setkey (cipherhd,
	ctrl->server_local->export_key, KEYWRAP_KEYSIZE);
	if (err)
	goto leave;

	wrappedkeylen = keylen + 8;
	wrappedkey = xtrymalloc (wrappedkeylen);
	if (!wrappedkey)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	err = gcry_cipher_encrypt (cipherhd, wrappedkey, wrappedkeylen, key, keylen);
	if (err)
	goto leave;
	xfree (key);
	key = NULL;
	gcry_cipher_close (cipherhd);
	cipherhd = NULL;

	assuan_begin_confidential (ctx);
	err = assuan_send_data (ctx, wrappedkey, wrappedkeylen);
	assuan_end_confidential (ctx);


	leave:
	xfree (cache_nonce);
	xfree (passphrase);
	xfree (wrappedkey);
	gcry_cipher_close (cipherhd);
	xfree (key);
	gcry_sexp_release (s_skey);
	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;
	xfree (shadow_info);

	return leave_cmd (ctx, err);
	}



	static const char hlp_delete_key[] =
	"DELETE_KEY [--force] <hexstring_with_keygrip>\n"
	"\n"
	"Delete a secret key from the key store. If --force is used\n"
	"and a loopback pinentry is allowed, the agent will not ask\n"
	"the user for confirmation.";
	static gpg_error_t
	cmd_delete_key (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	int force;
	unsigned char grip[20];

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	force = has_option (line, "--force");
	line = skip_options (line);

	/* If the use of a loopback pinentry has been disabled, we assume
	* that a silent deletion of keys shall also not be allowed. */
	if (!opt.allow_loopback_pinentry)
	force = 0;

	err = parse_keygrip (ctx, line, grip);
	if (err)
	goto leave;

	err = agent_delete_key (ctrl, ctrl->server_local->keydesc, grip, force );
	if (err)
	goto leave;

	leave:
	xfree (ctrl->server_local->keydesc);
	ctrl->server_local->keydesc = NULL;

	return leave_cmd (ctx, err);
	}



	static const char hlp_keytocard[] =
	"KEYTOCARD [--force] <hexstring_with_keygrip> <serialno> <id> <timestamp>\n"
	"\n";
	static gpg_error_t
	cmd_keytocard (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int force;
	gpg_error_t err = 0;
	unsigned char grip[20];
	gcry_sexp_t s_skey = NULL;
	unsigned char *keydata;
	size_t keydatalen, timestamplen;
	const char serialno, timestamp_str, *id;
	unsigned char *shadow_info = NULL;
	time_t timestamp;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	force = has_option (line, "--force");
	line = skip_options (line);

	err = parse_keygrip (ctx, line, grip);
	if (err)
	return err;

	if (agent_key_available (grip))
	return gpg_error (GPG_ERR_NO_SECKEY);

	line += 40;
	while (line && (line == ' ' \|\| *line == '\t'))
	line++;
	serialno = line;
	while (line && (line != ' ' && *line != '\t'))
	line++;
	if (!*line)
	return gpg_error (GPG_ERR_MISSING_VALUE);
	*line = '\0';
	line++;
	while (line && (line == ' ' \|\| *line == '\t'))
	line++;
	id = line;
	while (line && (line != ' ' && *line != '\t'))
	line++;
	if (!*line)
	return gpg_error (GPG_ERR_MISSING_VALUE);
	*line = '\0';
	line++;
	while (line && (line == ' ' \|\| *line == '\t'))
	line++;
	timestamp_str = line;
	while (line && (line != ' ' && *line != '\t'))
	line++;
	if (*line)
	*line = '\0';
	timestamplen = line - timestamp_str;
	if (timestamplen != 15)
	return gpg_error (GPG_ERR_INV_VALUE);

	err = agent_key_from_file (ctrl, NULL, ctrl->server_local->keydesc, grip,
	&shadow_info, CACHE_MODE_IGNORE, NULL,
	&s_skey, NULL);
	if (err)
	{
	xfree (shadow_info);
	return err;
	}
	if (shadow_info)
	{
	/* Key is on a smartcard already. */
	xfree (shadow_info);
	gcry_sexp_release (s_skey);
	return gpg_error (GPG_ERR_UNUSABLE_SECKEY);
	}

	keydatalen = gcry_sexp_sprint (s_skey, GCRYSEXP_FMT_CANON, NULL, 0);
	keydata = xtrymalloc_secure (keydatalen + 30);
	if (keydata == NULL)
	{
	gcry_sexp_release (s_skey);
	return gpg_error_from_syserror ();
	}

	gcry_sexp_sprint (s_skey, GCRYSEXP_FMT_CANON, keydata, keydatalen);
	gcry_sexp_release (s_skey);
	keydatalen--; /* Decrement for last '\0'. */
	/* Add timestamp "created-at" in the private key */
	timestamp = isotime2epoch (timestamp_str);
	snprintf (keydata+keydatalen-1, 30, "(10:created-at10:%010lu))", timestamp);
	keydatalen += 10 + 19 - 1;
	err = divert_writekey (ctrl, force, serialno, id, keydata, keydatalen);
	xfree (keydata);

	return leave_cmd (ctx, err);
	}



	static const char hlp_getval[] =
	"GETVAL <key>\n"
	"\n"
	"Return the value for KEY from the special environment as created by\n"
	"PUTVAL.";
	static gpg_error_t
	cmd_getval (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;
	char *key = NULL;
	char *p;
	struct putval_item_s *vl;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	for (p=line; *p == ' '; p++)
	;
	key = p;
	p = strchr (key, ' ');
	if (p)
	{
	*p++ = 0;
	for (; *p == ' '; p++)
	;
	if (*p)
	return set_error (GPG_ERR_ASS_PARAMETER, "too many arguments");
	}
	if (!*key)
	return set_error (GPG_ERR_ASS_PARAMETER, "no key given");


	for (vl=putval_list; vl; vl = vl->next)
	if ( !strcmp (vl->d, key) )
	break;

	if (vl) /* Got an entry. */
	rc = assuan_send_data (ctx, vl->d+vl->off, vl->len);
	else
	return gpg_error (GPG_ERR_NO_DATA);

	return leave_cmd (ctx, rc);
	}


	static const char hlp_putval[] =
	"PUTVAL <key> [<percent_escaped_value>]\n"
	"\n"
	"The gpg-agent maintains a kind of environment which may be used to\n"
	"store key/value pairs in it, so that they can be retrieved later.\n"
	"This may be used by helper daemons to daemonize themself on\n"
	"invocation and register them with gpg-agent. Callers of the\n"
	"daemon's service may now first try connect to get the information\n"
	"for that service from gpg-agent through the GETVAL command and then\n"
	"try to connect to that daemon. Only if that fails they may start\n"
	"an own instance of the service daemon. \n"
	"\n"
	- "KEY is an an arbitrary symbol with the same syntax rules as keys\n"
	+ "KEY is an arbitrary symbol with the same syntax rules as keys\n"
	"for shell environment variables. PERCENT_ESCAPED_VALUE is the\n"
	"corresponding value; they should be similar to the values of\n"
	"envronment variables but gpg-agent does not enforce any\n"
	"restrictions. If that value is not given any value under that KEY\n"
	"is removed from this special environment.";
	static gpg_error_t
	cmd_putval (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;
	char *key = NULL;
	char *value = NULL;
	size_t valuelen = 0;
	char *p;
	struct putval_item_s vl, vlprev;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	for (p=line; *p == ' '; p++)
	;
	key = p;
	p = strchr (key, ' ');
	if (p)
	{
	*p++ = 0;
	for (; *p == ' '; p++)
	;
	if (*p)
	{
	value = p;
	p = strchr (value, ' ');
	if (p)
	*p = 0;
	valuelen = percent_plus_unescape_inplace (value, 0);
	}
	}
	if (!*key)
	return set_error (GPG_ERR_ASS_PARAMETER, "no key given");


	for (vl=putval_list,vlprev=NULL; vl; vlprev=vl, vl = vl->next)
	if ( !strcmp (vl->d, key) )
	break;

	if (vl) /* Delete old entry. */
	{
	if (vlprev)
	vlprev->next = vl->next;
	else
	putval_list = vl->next;
	xfree (vl);
	}

	if (valuelen) /* Add entry. */
	{
	vl = xtrymalloc (sizeof *vl + strlen (key) + valuelen);
	if (!vl)
	rc = gpg_error_from_syserror ();
	else
	{
	vl->len = valuelen;
	vl->off = strlen (key) + 1;
	strcpy (vl->d, key);
	memcpy (vl->d + vl->off, value, valuelen);
	vl->next = putval_list;
	putval_list = vl;
	}
	}

	return leave_cmd (ctx, rc);
	}




	static const char hlp_updatestartuptty[] =
	"UPDATESTARTUPTTY\n"
	"\n"
	"Set startup TTY and X11 DISPLAY variables to the values of this\n"
	"session. This command is useful to pull future pinentries to\n"
	"another screen. It is only required because there is no way in the\n"
	"ssh-agent protocol to convey this information.";
	static gpg_error_t
	cmd_updatestartuptty (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	session_env_t se;
	char *lc_ctype = NULL;
	char *lc_messages = NULL;
	int iterator;
	const char *name;

	(void)line;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	se = session_env_new ();
	if (!se)
	err = gpg_error_from_syserror ();

	iterator = 0;
	while (!err && (name = session_env_list_stdenvnames (&iterator, NULL)))
	{
	const char *value = session_env_getenv (ctrl->session_env, name);
	if (value)
	err = session_env_setenv (se, name, value);
	}

	if (!err && ctrl->lc_ctype)
	if (!(lc_ctype = xtrystrdup (ctrl->lc_ctype)))
	err = gpg_error_from_syserror ();

	if (!err && ctrl->lc_messages)
	if (!(lc_messages = xtrystrdup (ctrl->lc_messages)))
	err = gpg_error_from_syserror ();

	if (err)
	{
	session_env_release (se);
	xfree (lc_ctype);
	xfree (lc_messages);
	}
	else
	{
	session_env_release (opt.startup_env);
	opt.startup_env = se;
	xfree (opt.startup_lc_ctype);
	opt.startup_lc_ctype = lc_ctype;
	xfree (opt.startup_lc_messages);
	opt.startup_lc_messages = lc_messages;
	}

	return err;
	}



	static const char hlp_killagent[] =
	"KILLAGENT\n"
	"\n"
	"Stop the agent.";
	static gpg_error_t
	cmd_killagent (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	ctrl->server_local->stopme = 1;
	assuan_set_flag (ctx, ASSUAN_FORCE_CLOSE, 1);
	return 0;
	}


	static const char hlp_reloadagent[] =
	"RELOADAGENT\n"
	"\n"
	"This command is an alternative to SIGHUP\n"
	"to reload the configuration.";
	static gpg_error_t
	cmd_reloadagent (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	if (ctrl->restricted)
	return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));

	agent_sighup_action ();
	return 0;
	}



	static const char hlp_getinfo[] =
	"GETINFO <what>\n"
	"\n"
	"Multipurpose function to return a variety of information.\n"
	"Supported values for WHAT are:\n"
	"\n"
	" version - Return the version of the program.\n"
	" pid - Return the process id of the server.\n"
	" socket_name - Return the name of the socket.\n"
	" ssh_socket_name - Return the name of the ssh socket.\n"
	" scd_running - Return OK if the SCdaemon is already running.\n"
	" s2k_count - Return the calibrated S2K count.\n"
	" std_env_names - List the names of the standard environment.\n"
	" std_session_env - List the standard session environment.\n"
	" std_startup_env - List the standard startup environment.\n"
	" cmd_has_option\n"
	" - Returns OK if the command CMD implements the option OPT.\n"
	" connections - Return number of active connections.\n"
	" restricted - Returns OK if the connection is in restricted mode.\n";
	static gpg_error_t
	cmd_getinfo (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;

	if (!strcmp (line, "version"))
	{
	const char *s = VERSION;
	rc = assuan_send_data (ctx, s, strlen (s));
	}
	else if (!strncmp (line, "cmd_has_option", 14)
	&& (line[14] == ' ' \|\| line[14] == '\t' \|\| !line[14]))
	{
	char cmd, cmdopt;
	line += 14;
	while (line == ' ' \|\| line == '\t')
	line++;
	if (!*line)
	rc = gpg_error (GPG_ERR_MISSING_VALUE);
	else
	{
	cmd = line;
	while (line && (line != ' ' && *line != '\t'))
	line++;
	if (!*line)
	rc = gpg_error (GPG_ERR_MISSING_VALUE);
	else
	{
	*line++ = 0;
	while (line == ' ' \|\| line == '\t')
	line++;
	if (!*line)
	rc = gpg_error (GPG_ERR_MISSING_VALUE);
	else
	{
	cmdopt = line;
	if (!command_has_option (cmd, cmdopt))
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	}
	}
	}
	else if (!strcmp (line, "s2k_count"))
	{
	char numbuf[50];

	snprintf (numbuf, sizeof numbuf, "%lu", get_standard_s2k_count ());
	rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else if (!strcmp (line, "restricted"))
	{
	rc = ctrl->restricted? 0 : gpg_error (GPG_ERR_GENERAL);
	}
	else if (ctrl->restricted)
	{
	rc = gpg_error (GPG_ERR_FORBIDDEN);
	}
	/* All sub-commands below are not allowed in restricted mode. */
	else if (!strcmp (line, "pid"))
	{
	char numbuf[50];

	snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
	rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else if (!strcmp (line, "socket_name"))
	{
	const char *s = get_agent_socket_name ();

	if (s)
	rc = assuan_send_data (ctx, s, strlen (s));
	else
	rc = gpg_error (GPG_ERR_NO_DATA);
	}
	else if (!strcmp (line, "ssh_socket_name"))
	{
	const char *s = get_agent_ssh_socket_name ();

	if (s)
	rc = assuan_send_data (ctx, s, strlen (s));
	else
	rc = gpg_error (GPG_ERR_NO_DATA);
	}
	else if (!strcmp (line, "scd_running"))
	{
	rc = agent_scd_check_running ()? 0 : gpg_error (GPG_ERR_GENERAL);
	}
	else if (!strcmp (line, "std_env_names"))
	{
	int iterator;
	const char *name;

	iterator = 0;
	while ((name = session_env_list_stdenvnames (&iterator, NULL)))
	{
	rc = assuan_send_data (ctx, name, strlen (name)+1);
	if (!rc)
	rc = assuan_send_data (ctx, NULL, 0);
	if (rc)
	break;
	}
	}
	else if (!strcmp (line, "std_session_env")
	\|\| !strcmp (line, "std_startup_env"))
	{
	int iterator;
	const char name, value;
	char *string;

	iterator = 0;
	while ((name = session_env_list_stdenvnames (&iterator, NULL)))
	{
	value = session_env_getenv_or_default
	(line[5] == 't'? opt.startup_env:ctrl->session_env, name, NULL);
	if (value)
	{
	string = xtryasprintf ("%s=%s", name, value);
	if (!string)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = assuan_send_data (ctx, string, strlen (string)+1);
	if (!rc)
	rc = assuan_send_data (ctx, NULL, 0);
	}
	if (rc)
	break;
	}
	}
	}
	else if (!strcmp (line, "connections"))
	{
	char numbuf[20];

	snprintf (numbuf, sizeof numbuf, "%d",
	get_agent_active_connection_count ());
	rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else
	rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
	return rc;
	}



	/* This function is called by Libassuan to parse the OPTION command.
	It has been registered similar to the other Assuan commands. */
	static gpg_error_t
	option_handler (assuan_context_t ctx, const char key, const char value)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;

	if (!strcmp (key, "agent-awareness"))
	{
	/* The value is a version string telling us of which agent
	version the caller is aware of. */
	ctrl->server_local->allow_fully_canceled =
	gnupg_compare_version (value, "2.1.0");
	}
	else if (ctrl->restricted)
	{
	err = gpg_error (GPG_ERR_FORBIDDEN);
	}
	/* All options below are not allowed in restricted mode. */
	else if (!strcmp (key, "putenv"))
	{
	/* Change the session's environment to be used for the
	Pinentry. Valid values are:
	<NAME> Delete envvar NAME
	<KEY>= Set envvar NAME to the empty string
	<KEY>=<VALUE> Set envvar NAME to VALUE
	*/
	err = session_env_putenv (ctrl->session_env, value);
	}
	else if (!strcmp (key, "display"))
	{
	err = session_env_setenv (ctrl->session_env, "DISPLAY", value);
	}
	else if (!strcmp (key, "ttyname"))
	{
	if (!opt.keep_tty)
	err = session_env_setenv (ctrl->session_env, "GPG_TTY", value);
	}
	else if (!strcmp (key, "ttytype"))
	{
	if (!opt.keep_tty)
	err = session_env_setenv (ctrl->session_env, "TERM", value);
	}
	else if (!strcmp (key, "lc-ctype"))
	{
	if (ctrl->lc_ctype)
	xfree (ctrl->lc_ctype);
	ctrl->lc_ctype = xtrystrdup (value);
	if (!ctrl->lc_ctype)
	return out_of_core ();
	}
	else if (!strcmp (key, "lc-messages"))
	{
	if (ctrl->lc_messages)
	xfree (ctrl->lc_messages);
	ctrl->lc_messages = xtrystrdup (value);
	if (!ctrl->lc_messages)
	return out_of_core ();
	}
	else if (!strcmp (key, "xauthority"))
	{
	err = session_env_setenv (ctrl->session_env, "XAUTHORITY", value);
	}
	else if (!strcmp (key, "pinentry-user-data"))
	{
	err = session_env_setenv (ctrl->session_env, "PINENTRY_USER_DATA", value);
	}
	else if (!strcmp (key, "use-cache-for-signing"))
	ctrl->server_local->use_cache_for_signing = *value? !!atoi (value) : 0;
	else if (!strcmp (key, "allow-pinentry-notify"))
	ctrl->server_local->allow_pinentry_notify = 1;
	else if (!strcmp (key, "pinentry-mode"))
	{
	int tmp = parse_pinentry_mode (value);
	if (tmp == -1)
	err = gpg_error (GPG_ERR_INV_VALUE);
	else if (tmp == PINENTRY_MODE_LOOPBACK && !opt.allow_loopback_pinentry)
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	else
	ctrl->pinentry_mode = tmp;
	}
	else if (!strcmp (key, "cache-ttl-opt-preset"))
	{
	ctrl->cache_ttl_opt_preset = *value? atoi (value) : 0;
	}
	else if (!strcmp (key, "s2k-count"))
	{
	ctrl->s2k_count = *value? strtoul(value, NULL, 10) : 0;
	if (ctrl->s2k_count && ctrl->s2k_count < 65536)
	{
	ctrl->s2k_count = 0;
	}
	}
	else
	err = gpg_error (GPG_ERR_UNKNOWN_OPTION);

	return err;
	}




	/* Called by libassuan after all commands. ERR is the error from the
	last assuan operation and not the one returned from the command. */
	static void
	post_cmd_notify (assuan_context_t ctx, gpg_error_t err)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)err;

	/* Switch off any I/O monitor controlled logging pausing. */
	ctrl->server_local->pause_io_logging = 0;
	}


	/* This function is called by libassuan for all I/O. We use it here
	to disable logging for the GETEVENTCOUNTER commands. This is so
	that the debug output won't get cluttered by this primitive
	command. */
	static unsigned int
	io_monitor (assuan_context_t ctx, void *hook, int direction,
	const char *line, size_t linelen)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void) hook;

	/* We want to suppress all Assuan log messages for connections from
	* self. However, assuan_get_pid works only after
	* assuan_accept. Now, assuan_accept already logs a line ending with
	* the process id. We use this hack here to get the peers pid so
	* that we can compare it to our pid. We should add an assuan
	* function to return the pid for a file descriptor and use that to
	* detect connections to self. */
	if (ctx && !ctrl->server_local->greeting_seen
	&& direction == ASSUAN_IO_TO_PEER)
	{
	ctrl->server_local->greeting_seen = 1;
	if (linelen > 32
	&& !strncmp (line, "OK Pleased to meet you, process ", 32)
	&& strtoul (line+32, NULL, 10) == getpid ())
	return ASSUAN_IO_MONITOR_NOLOG;
	}


	/* Do not log self-connections. This makes the log cleaner because
	* we won't see the check-our-own-socket calls. */
	if (ctx && ctrl->server_local->connect_from_self)
	return ASSUAN_IO_MONITOR_NOLOG;

	/* Note that we only check for the uppercase name. This allows the user to
	see the logging for debugging if using a non-upercase command
	name. */
	if (ctx && direction == ASSUAN_IO_FROM_PEER
	&& linelen >= 15
	&& !strncmp (line, "GETEVENTCOUNTER", 15)
	&& (linelen == 15 \|\| spacep (line+15)))
	{
	ctrl->server_local->pause_io_logging = 1;
	}

	return ctrl->server_local->pause_io_logging? ASSUAN_IO_MONITOR_NOLOG : 0;
	}


	/* Return true if the command CMD implements the option OPT. */
	static int
	command_has_option (const char cmd, const char cmdopt)
	{
	if (!strcmp (cmd, "GET_PASSPHRASE"))
	{
	if (!strcmp (cmdopt, "repeat"))
	return 1;
	}

	return 0;
	}


	/* Tell Libassuan about our commands. Also register the other Assuan
	handlers. */
	static int
	register_commands (assuan_context_t ctx)
	{
	static struct {
	const char *name;
	assuan_handler_t handler;
	const char * const help;
	} table[] = {
	{ "GETEVENTCOUNTER",cmd_geteventcounter, hlp_geteventcounter },
	{ "ISTRUSTED", cmd_istrusted, hlp_istrusted },
	{ "HAVEKEY", cmd_havekey, hlp_havekey },
	{ "KEYINFO", cmd_keyinfo, hlp_keyinfo },
	{ "SIGKEY", cmd_sigkey, hlp_sigkey },
	{ "SETKEY", cmd_sigkey, hlp_sigkey },
	{ "SETKEYDESC", cmd_setkeydesc,hlp_setkeydesc },
	{ "SETHASH", cmd_sethash, hlp_sethash },
	{ "PKSIGN", cmd_pksign, hlp_pksign },
	{ "PKDECRYPT", cmd_pkdecrypt, hlp_pkdecrypt },
	{ "GENKEY", cmd_genkey, hlp_genkey },
	{ "READKEY", cmd_readkey, hlp_readkey },
	{ "GET_PASSPHRASE", cmd_get_passphrase, hlp_get_passphrase },
	{ "PRESET_PASSPHRASE", cmd_preset_passphrase, hlp_preset_passphrase },
	{ "CLEAR_PASSPHRASE", cmd_clear_passphrase, hlp_clear_passphrase },
	{ "GET_CONFIRMATION", cmd_get_confirmation, hlp_get_confirmation },
	{ "LISTTRUSTED", cmd_listtrusted, hlp_listtrusted },
	{ "MARKTRUSTED", cmd_marktrusted, hlp_martrusted },
	{ "LEARN", cmd_learn, hlp_learn },
	{ "PASSWD", cmd_passwd, hlp_passwd },
	{ "INPUT", NULL },
	{ "OUTPUT", NULL },
	{ "SCD", cmd_scd, hlp_scd },
	{ "KEYWRAP_KEY", cmd_keywrap_key, hlp_keywrap_key },
	{ "IMPORT_KEY", cmd_import_key, hlp_import_key },
	{ "EXPORT_KEY", cmd_export_key, hlp_export_key },
	{ "DELETE_KEY", cmd_delete_key, hlp_delete_key },
	{ "GETVAL", cmd_getval, hlp_getval },
	{ "PUTVAL", cmd_putval, hlp_putval },
	{ "UPDATESTARTUPTTY", cmd_updatestartuptty, hlp_updatestartuptty },
	{ "KILLAGENT", cmd_killagent, hlp_killagent },
	{ "RELOADAGENT", cmd_reloadagent,hlp_reloadagent },
	{ "GETINFO", cmd_getinfo, hlp_getinfo },
	{ "KEYTOCARD", cmd_keytocard, hlp_keytocard },
	{ NULL }
	};
	int i, rc;

	for (i=0; table[i].name; i++)
	{
	rc = assuan_register_command (ctx, table[i].name, table[i].handler,
	table[i].help);
	if (rc)
	return rc;
	}
	assuan_register_post_cmd_notify (ctx, post_cmd_notify);
	assuan_register_reset_notify (ctx, reset_notify);
	assuan_register_option_handler (ctx, option_handler);
	return 0;
	}


	/* Startup the server. If LISTEN_FD and FD is given as -1, this is a
	simple piper server, otherwise it is a regular server. CTRL is the
	control structure for this connection; it has only the basic
	initialization. */
	void
	start_command_handler (ctrl_t ctrl, gnupg_fd_t listen_fd, gnupg_fd_t fd)
	{
	int rc;
	assuan_context_t ctx = NULL;

	if (ctrl->restricted)
	{
	if (agent_copy_startup_env (ctrl))
	return;
	}

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("failed to allocate assuan context: %s\n", gpg_strerror (rc));
	agent_exit (2);
	}

	if (listen_fd == GNUPG_INVALID_FD && fd == GNUPG_INVALID_FD)
	{
	assuan_fd_t filedes[2];

	filedes[0] = assuan_fdopen (0);
	filedes[1] = assuan_fdopen (1);
	rc = assuan_init_pipe_server (ctx, filedes);
	}
	else if (listen_fd != GNUPG_INVALID_FD)
	{
	rc = assuan_init_socket_server (ctx, listen_fd, 0);
	/* FIXME: Need to call assuan_sock_set_nonce for Windows. But
	this branch is currently not used. */
	}
	else
	{
	rc = assuan_init_socket_server (ctx, fd, ASSUAN_SOCKET_SERVER_ACCEPTED);
	}
	if (rc)
	{
	log_error ("failed to initialize the server: %s\n",
	gpg_strerror(rc));
	agent_exit (2);
	}
	rc = register_commands (ctx);
	if (rc)
	{
	log_error ("failed to register commands with Assuan: %s\n",
	gpg_strerror(rc));
	agent_exit (2);
	}

	assuan_set_pointer (ctx, ctrl);
	ctrl->server_local = xcalloc (1, sizeof *ctrl->server_local);
	ctrl->server_local->assuan_ctx = ctx;
	ctrl->server_local->use_cache_for_signing = 1;

	ctrl->digest.raw_value = 0;

	assuan_set_io_monitor (ctx, io_monitor, NULL);
	agent_set_progress_cb (progress_cb, ctrl);

	for (;;)
	{
	pid_t client_pid;

	rc = assuan_accept (ctx);
	if (gpg_err_code (rc) == GPG_ERR_EOF \|\| rc == -1)
	{
	break;
	}
	else if (rc)
	{
	log_info ("Assuan accept problem: %s\n", gpg_strerror (rc));
	break;
	}

	client_pid = assuan_get_pid (ctx);
	ctrl->server_local->connect_from_self = (client_pid == getpid ());
	if (client_pid != ASSUAN_INVALID_PID)
	ctrl->client_pid = (unsigned long)client_pid;
	else
	ctrl->client_pid = 0;

	rc = assuan_process (ctx);
	if (rc)
	{
	log_info ("Assuan processing failed: %s\n", gpg_strerror (rc));
	continue;
	}
	}

	/* Reset the nonce caches. */
	clear_nonce_cache (ctrl);

	/* Reset the SCD if needed. */
	agent_reset_scd (ctrl);

	/* Reset the pinentry (in case of popup messages). */
	agent_reset_query (ctrl);

	/* Cleanup. */
	assuan_release (ctx);
	xfree (ctrl->server_local->keydesc);
	xfree (ctrl->server_local->import_key);
	xfree (ctrl->server_local->export_key);
	if (ctrl->server_local->stopme)
	agent_exit (0);
	xfree (ctrl->server_local);
	ctrl->server_local = NULL;
	}


	/* Helper for the pinentry loopback mode. It merely passes the
	parameters on to the client. */
	gpg_error_t
	pinentry_loopback(ctrl_t ctrl, const char *keyword,
	unsigned char *buffer, size_t size,
	size_t max_length)
	{
	gpg_error_t rc;
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;

	rc = print_assuan_status (ctx, "INQUIRE_MAXLEN", "%zu", max_length);
	if (rc)
	return rc;

	assuan_begin_confidential (ctx);
	rc = assuan_inquire (ctx, keyword, buffer, size, max_length);
	assuan_end_confidential (ctx);
	return rc;
	}
	diff --git a/agent/divert-scd.c b/agent/divert-scd.c
	index 7331f5823..c23c67335 100644
	--- a/agent/divert-scd.c
	+++ b/agent/divert-scd.c
	@@ -1,498 +1,498 @@
	/* divert-scd.c - divert operations to the scdaemon
	* Copyright (C) 2002, 2003, 2009 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <assert.h>
	#include <unistd.h>
	#include <sys/stat.h>

	#include "agent.h"
	#include "i18n.h"
	#include "sexp-parse.h"


	static int
	ask_for_card (ctrl_t ctrl, const unsigned char shadow_info, char *r_kid)
	{
	int rc, i;
	char *serialno;
	int no_card = 0;
	char *desc;
	char want_sn, want_kid;
	int want_sn_displen;

	*r_kid = NULL;

	rc = parse_shadow_info (shadow_info, &want_sn, &want_kid, NULL);
	if (rc)
	return rc;

	/* We assume that a 20 byte serial number is a standard one which
	has the property to have a zero in the last nibble (Due to BCD
	representation). We don't display this '0' because it may
	confuse the user. */
	want_sn_displen = strlen (want_sn);
	if (want_sn_displen == 20 && want_sn[19] == '0')
	want_sn_displen--;

	for (;;)
	{
	rc = agent_card_serialno (ctrl, &serialno, want_sn);
	if (!rc)
	{
	log_debug ("detected card with S/N %s\n", serialno);
	i = strcmp (serialno, want_sn);
	xfree (serialno);
	serialno = NULL;
	if (!i)
	{
	xfree (want_sn);
	*r_kid = want_kid;
	return 0; /* yes, we have the correct card */
	}
	}
	else if (gpg_err_code (rc) == GPG_ERR_ENODEV)
	{
	log_debug ("no device present\n");
	rc = 0;
	no_card = 1;
	}
	else if (gpg_err_code (rc) == GPG_ERR_CARD_NOT_PRESENT)
	{
	log_debug ("no card present\n");
	rc = 0;
	no_card = 2;
	}
	else
	{
	log_error ("error accessing card: %s\n", gpg_strerror (rc));
	}

	if (!rc)
	{
	if (asprintf (&desc,
	"%s:%%0A%%0A"
	" \"%.*s\"",
	no_card
	? L_("Please insert the card with serial number")
	: L_("Please remove the current card and "
	"insert the one with serial number"),
	want_sn_displen, want_sn) < 0)
	{
	rc = out_of_core ();
	}
	else
	{
	rc = agent_get_confirmation (ctrl, desc, NULL, NULL, 0);
	if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK &&
	gpg_err_code (rc) == GPG_ERR_NO_PIN_ENTRY)
	rc = gpg_error (GPG_ERR_CARD_NOT_PRESENT);

	xfree (desc);
	}
	}
	if (rc)
	{
	xfree (want_sn);
	xfree (want_kid);
	return rc;
	}
	}
	}


	/* Put the DIGEST into an DER encoded container and return it in R_VAL. */
	static int
	encode_md_for_card (const unsigned char *digest, size_t digestlen, int algo,
	unsigned char *r_val, size_t r_len)
	{
	unsigned char *frame;
	unsigned char asn[100];
	size_t asnlen;

	*r_val = NULL;
	*r_len = 0;

	asnlen = DIM(asn);
	if (!algo \|\| gcry_md_test_algo (algo))
	return gpg_error (GPG_ERR_DIGEST_ALGO);
	if (gcry_md_algo_info (algo, GCRYCTL_GET_ASNOID, asn, &asnlen))
	{
	log_error ("no object identifier for algo %d\n", algo);
	return gpg_error (GPG_ERR_INTERNAL);
	}

	frame = xtrymalloc (asnlen + digestlen);
	if (!frame)
	return out_of_core ();
	memcpy (frame, asn, asnlen);
	memcpy (frame+asnlen, digest, digestlen);
	if (DBG_CRYPTO)
	log_printhex ("encoded hash:", frame, asnlen+digestlen);

	*r_val = frame;
	*r_len = asnlen+digestlen;
	return 0;
	}


	/* Callback used to ask for the PIN which should be set into BUF. The
	buf has been allocated by the caller and is of size MAXBUF which
	includes the terminating null. The function should return an UTF-8
	string with the passphrase, the buffer may optionally be padded
	with arbitrary characters.

	INFO gets displayed as part of a generic string. However if the
	first character of INFO is a vertical bar all up to the next
	verical bar are considered flags and only everything after the
	second vertical bar gets displayed as the full prompt.

	Flags:

	'N' = New PIN, this requests a second prompt to repeat the
	PIN. If the PIN is not correctly repeated it starts from
	all over.
	'A' = The PIN is an Admin PIN, SO-PIN or alike.
	'P' = The PIN is a PUK (Personal Unblocking Key).
	'R' = The PIN is a Reset Code.

	Example:

	"\|AN\|Please enter the new security officer's PIN"

	The text "Please ..." will get displayed and the flags 'A' and 'N'
	are considered.
	*/
	static int
	getpin_cb (void opaque, const char info, char *buf, size_t maxbuf)
	{
	struct pin_entry_info_s *pi;
	int rc;
	ctrl_t ctrl = opaque;
	const char ends, s;
	int any_flags = 0;
	int newpin = 0;
	int resetcode = 0;
	int is_puk = 0;
	const char *again_text = NULL;
	const char *prompt = "PIN";

	if (buf && maxbuf < 2)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Parse the flags. */
	if (info && *info =='\|' && (ends=strchr (info+1, '\|')))
	{
	for (s=info+1; s < ends; s++)
	{
	if (*s == 'A')
	prompt = L_("Admin PIN");
	else if (*s == 'P')
	{
	/* TRANSLATORS: A PUK is the Personal Unblocking Code
	used to unblock a PIN. */
	prompt = L_("PUK");
	is_puk = 1;
	}
	else if (*s == 'N')
	newpin = 1;
	else if (*s == 'R')
	{
	prompt = L_("Reset Code");
	resetcode = 1;
	}
	}
	info = ends+1;
	any_flags = 1;
	}
	else if (info && *info == '\|')
	log_debug ("pin_cb called without proper PIN info hack\n");

	/* If BUF has been passed as NULL, we are in pinpad mode: The
	callback opens the popup and immediately returns. */
	if (!buf)
	{
	if (maxbuf == 0) /* Close the pinentry. */
	{
	agent_popup_message_stop (ctrl);
	rc = 0;
	}
	else if (maxbuf == 1) /* Open the pinentry. */
	{
	if (info)
	{
	char *desc;

	if ( asprintf (&desc,
	L_("%s%%0A%%0AUse the reader's pinpad for input."),
	info) < 0 )
	rc = gpg_error_from_syserror ();
	else
	{
	rc = agent_popup_message_start (ctrl, desc, NULL);
	xfree (desc);
	}
	}
	else
	rc = agent_popup_message_start (ctrl, NULL, NULL);
	}
	else
	rc = gpg_error (GPG_ERR_INV_VALUE);
	return rc;
	}

	/* FIXME: keep PI and TRIES in OPAQUE. Frankly this is a whole
	mess because we should call the card's verify function from the
	pinentry check pin CB. */
	again:
	pi = gcry_calloc_secure (1, sizeof (*pi) + maxbuf + 10);
	if (!pi)
	return gpg_error_from_syserror ();
	pi->max_length = maxbuf-1;
	pi->min_digits = 0; /* we want a real passphrase */
	pi->max_digits = 16;
	pi->max_tries = 3;

	if (any_flags)
	{
	rc = agent_askpin (ctrl, info, prompt, again_text, pi, NULL, 0);
	again_text = NULL;
	if (!rc && newpin)
	{
	struct pin_entry_info_s *pi2;
	pi2 = gcry_calloc_secure (1, sizeof (*pi) + maxbuf + 10);
	if (!pi2)
	{
	rc = gpg_error_from_syserror ();
	xfree (pi);
	return rc;
	}
	pi2->max_length = maxbuf-1;
	pi2->min_digits = 0;
	pi2->max_digits = 16;
	pi2->max_tries = 1;
	rc = agent_askpin (ctrl,
	(resetcode?
	L_("Repeat this Reset Code"):
	is_puk?
	L_("Repeat this PUK"):
	L_("Repeat this PIN")),
	prompt, NULL, pi2, NULL, 0);
	if (!rc && strcmp (pi->pin, pi2->pin))
	{
	again_text = (resetcode?
	L_("Reset Code not correctly repeated; try again"):
	is_puk?
	L_("PUK not correctly repeated; try again"):
	L_("PIN not correctly repeated; try again"));
	xfree (pi2);
	xfree (pi);
	goto again;
	}
	xfree (pi2);
	}
	}
	else
	{
	char *desc;
	if ( asprintf (&desc,
	L_("Please enter the PIN%s%s%s to unlock the card"),
	info? " (":"",
	info? info:"",
	info? ")":"") < 0)
	desc = NULL;
	rc = agent_askpin (ctrl, desc?desc:info, prompt, NULL, pi, NULL, 0);
	xfree (desc);
	}

	if (!rc)
	{
	strncpy (buf, pi->pin, maxbuf-1);
	buf[maxbuf-1] = 0;
	}
	xfree (pi);
	return rc;
	}




	int
	divert_pksign (ctrl_t ctrl,
	const unsigned char *digest, size_t digestlen, int algo,
	const unsigned char shadow_info, unsigned char *r_sig,
	size_t *r_siglen)
	{
	int rc;
	char *kid;
	size_t siglen;
	unsigned char *sigval = NULL;

	rc = ask_for_card (ctrl, shadow_info, &kid);
	if (rc)
	return rc;

	if (algo == MD_USER_TLS_MD5SHA1)
	{
	int save = ctrl->use_auth_call;
	ctrl->use_auth_call = 1;
	rc = agent_card_pksign (ctrl, kid, getpin_cb, ctrl,
	algo, digest, digestlen, &sigval, &siglen);
	ctrl->use_auth_call = save;
	}
	else
	{
	unsigned char *data;
	size_t ndata;

	rc = encode_md_for_card (digest, digestlen, algo, &data, &ndata);
	if (!rc)
	{
	rc = agent_card_pksign (ctrl, kid, getpin_cb, ctrl,
	algo, data, ndata, &sigval, &siglen);
	xfree (data);
	}
	}

	if (!rc)
	{
	*r_sig = sigval;
	*r_siglen = siglen;
	}

	xfree (kid);

	return rc;
	}


	-/* Decrypt the the value given asn an S-expression in CIPHER using the
	+/* Decrypt the value given asn an S-expression in CIPHER using the
	key identified by SHADOW_INFO and return the plaintext in an
	allocated buffer in R_BUF. The padding information is stored at
	R_PADDING with -1 for not known. */
	int
	divert_pkdecrypt (ctrl_t ctrl,
	const unsigned char *cipher,
	const unsigned char *shadow_info,
	char *r_buf, size_t r_len, int *r_padding)
	{
	int rc;
	char *kid;
	const unsigned char *s;
	size_t n;
	const unsigned char *ciphertext;
	size_t ciphertextlen;
	char *plaintext;
	size_t plaintextlen;

	*r_padding = -1;

	s = cipher;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "enc-val"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "rsa"))
	{
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "a"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	n = snext (&s);
	}
	else if (smatch (&s, n, "ecdh"))
	{
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "s"))
	{
	n = snext (&s);
	s += n;
	if (*s++ != ')')
	return gpg_error (GPG_ERR_INV_SEXP);
	if (*s++ != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	}
	if (!smatch (&s, n, "e"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	n = snext (&s);
	}
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);

	if (!n)
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	ciphertext = s;
	ciphertextlen = n;

	rc = ask_for_card (ctrl, shadow_info, &kid);
	if (rc)
	return rc;

	rc = agent_card_pkdecrypt (ctrl, kid, getpin_cb, ctrl,
	ciphertext, ciphertextlen,
	&plaintext, &plaintextlen, r_padding);
	if (!rc)
	{
	*r_buf = plaintext;
	*r_len = plaintextlen;
	}
	xfree (kid);
	return rc;
	}

	int
	divert_writekey (ctrl_t ctrl, int force, const char *serialno,
	const char id, const char keydata, size_t keydatalen)
	{
	return agent_card_writekey (ctrl, force, serialno, id, keydata, keydatalen,
	getpin_cb, ctrl);
	}

	int
	divert_generic_cmd (ctrl_t ctrl, const char cmdline, void assuan_context)
	{
	return agent_card_scd (ctrl, cmdline, getpin_cb, ctrl, assuan_context);
	}
	diff --git a/agent/findkey.c b/agent/findkey.c
	index 1b187ba9a..698f765cb 100644
	--- a/agent/findkey.c
	+++ b/agent/findkey.c
	@@ -1,1539 +1,1539 @@
	/* findkey.c - Locate the secret key
	* Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007,
	* 2010, 2011 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <fcntl.h>
	#include <assert.h>
	#include <unistd.h>
	#include <sys/stat.h>
	#include <assert.h>
	#include <npth.h> /* (we use pth_sleep) */

	#include "agent.h"
	#include "i18n.h"
	#include "../common/ssh-utils.h"
	#include "../common/name-value.h"

	#ifndef O_BINARY
	#define O_BINARY 0
	#endif

	/* Helper to pass data to the check callback of the unprotect function. */
	struct try_unprotect_arg_s
	{
	ctrl_t ctrl;
	const unsigned char *protected_key;
	unsigned char *unprotected_key;
	int change_required; /* Set by the callback to indicate that the
	user should change the passphrase. */
	};


	static gpg_error_t
	write_extended_private_key (char *fname, estream_t fp,
	const void *buf, size_t len)
	{
	gpg_error_t err;
	nvc_t pk = NULL;
	gcry_sexp_t key = NULL;
	int remove = 0;
	int line;

	err = nvc_parse_private_key (&pk, &line, fp);
	if (err)
	{
	log_error ("error parsing '%s' line %d: %s\n",
	fname, line, gpg_strerror (err));
	goto leave;
	}

	err = gcry_sexp_sscan (&key, NULL, buf, len);
	if (err)
	goto leave;

	err = nvc_set_private_key (pk, key);
	if (err)
	goto leave;

	err = es_fseek (fp, 0, SEEK_SET);
	if (err)
	goto leave;

	err = nvc_write (pk, fp);
	if (err)
	{
	log_error ("error writing '%s': %s\n", fname, gpg_strerror (err));
	remove = 1;
	goto leave;
	}

	if (ftruncate (es_fileno (fp), es_ftello (fp)))
	{
	err = gpg_error_from_syserror ();
	log_error ("error truncating '%s': %s\n", fname, gpg_strerror (err));
	remove = 1;
	goto leave;
	}

	if (es_fclose (fp))
	{
	err = gpg_error_from_syserror ();
	log_error ("error closing '%s': %s\n", fname, gpg_strerror (err));
	remove = 1;
	goto leave;
	}
	else
	fp = NULL;

	bump_key_eventcounter ();

	leave:
	if (fp)
	es_fclose (fp);
	if (remove)
	gnupg_remove (fname);
	xfree (fname);
	gcry_sexp_release (key);
	nvc_release (pk);
	return err;
	}

	/* Write an S-expression formatted key to our key storage. With FORCE
	passed as true an existing key with the given GRIP will get
	overwritten. */
	int
	agent_write_private_key (const unsigned char *grip,
	const void *buffer, size_t length, int force)
	{
	char *fname;
	estream_t fp;
	char hexgrip[40+4+1];

	bin2hex (grip, 20, hexgrip);
	strcpy (hexgrip+40, ".key");

	fname = make_filename (gnupg_homedir (), GNUPG_PRIVATE_KEYS_DIR,
	hexgrip, NULL);

	/* FIXME: Write to a temp file first so that write failures during
	key updates won't lead to a key loss. */

	if (!force && !access (fname, F_OK))
	{
	log_error ("secret key file '%s' already exists\n", fname);
	xfree (fname);
	return gpg_error (GPG_ERR_EEXIST);
	}

	fp = es_fopen (fname, force? "rb+,mode=-rw" : "wbx,mode=-rw");
	if (!fp)
	{
	gpg_error_t tmperr = gpg_error_from_syserror ();

	if (force && gpg_err_code (tmperr) == GPG_ERR_ENOENT)
	{
	fp = es_fopen (fname, "wbx,mode=-rw");
	if (!fp)
	tmperr = gpg_error_from_syserror ();
	}
	if (!fp)
	{
	log_error ("can't create '%s': %s\n", fname, gpg_strerror (tmperr));
	xfree (fname);
	return tmperr;
	}
	}
	else if (force)
	{
	gpg_error_t rc;
	char first;

	/* See if an existing key is in extended format. */
	if (es_fread (&first, 1, 1, fp) != 1)
	{
	rc = gpg_error_from_syserror ();
	log_error ("error reading first byte from '%s': %s\n",
	fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	return rc;
	}

	rc = es_fseek (fp, 0, SEEK_SET);
	if (rc)
	{
	log_error ("error seeking in '%s': %s\n", fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	return rc;
	}

	if (first != '(')
	{
	/* Key is in extended format. */
	return write_extended_private_key (fname, fp, buffer, length);
	}
	}

	if (es_fwrite (buffer, length, 1, fp) != 1)
	{
	gpg_error_t tmperr = gpg_error_from_syserror ();
	log_error ("error writing '%s': %s\n", fname, gpg_strerror (tmperr));
	es_fclose (fp);
	gnupg_remove (fname);
	xfree (fname);
	return tmperr;
	}

	/* When force is given, the file might have to be truncated. */
	if (force && ftruncate (es_fileno (fp), es_ftello (fp)))
	{
	gpg_error_t tmperr = gpg_error_from_syserror ();
	log_error ("error truncating '%s': %s\n", fname, gpg_strerror (tmperr));
	es_fclose (fp);
	gnupg_remove (fname);
	xfree (fname);
	return tmperr;
	}

	if (es_fclose (fp))
	{
	gpg_error_t tmperr = gpg_error_from_syserror ();
	log_error ("error closing '%s': %s\n", fname, gpg_strerror (tmperr));
	gnupg_remove (fname);
	xfree (fname);
	return tmperr;
	}
	bump_key_eventcounter ();
	xfree (fname);
	return 0;
	}


	/* Callback function to try the unprotection from the passphrase query
	code. */
	static gpg_error_t
	try_unprotect_cb (struct pin_entry_info_s *pi)
	{
	struct try_unprotect_arg_s *arg = pi->check_cb_arg;
	ctrl_t ctrl = arg->ctrl;
	size_t dummy;
	gpg_error_t err;
	gnupg_isotime_t now, protected_at, tmptime;
	char *desc = NULL;

	assert (!arg->unprotected_key);

	arg->change_required = 0;
	err = agent_unprotect (ctrl, arg->protected_key, pi->pin, protected_at,
	&arg->unprotected_key, &dummy);
	if (err)
	return err;
	if (!opt.max_passphrase_days \|\| ctrl->in_passwd)
	return 0; /* No regular passphrase change required. */

	if (!*protected_at)
	{
	/* No protection date known - must force passphrase change. */
	desc = xtrystrdup (L_("Note: This passphrase has never been changed.%0A"
	"Please change it now."));
	if (!desc)
	return gpg_error_from_syserror ();
	}
	else
	{
	gnupg_get_isotime (now);
	gnupg_copy_time (tmptime, protected_at);
	err = add_days_to_isotime (tmptime, opt.max_passphrase_days);
	if (err)
	return err;
	if (strcmp (now, tmptime) > 0 )
	{
	/* Passphrase "expired". */
	desc = xtryasprintf
	(L_("This passphrase has not been changed%%0A"
	"since %.4s-%.2s-%.2s. Please change it now."),
	protected_at, protected_at+4, protected_at+6);
	if (!desc)
	return gpg_error_from_syserror ();
	}
	}

	if (desc)
	{
	/* Change required. */
	if (opt.enforce_passphrase_constraints)
	{
	err = agent_get_confirmation (ctrl, desc,
	L_("Change passphrase"), NULL, 0);
	if (!err)
	arg->change_required = 1;
	}
	else
	{
	err = agent_get_confirmation (ctrl, desc,
	L_("Change passphrase"),
	L_("I'll change it later"), 0);
	if (!err)
	arg->change_required = 1;
	else if (gpg_err_code (err) == GPG_ERR_CANCELED
	\|\| gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	err = 0;
	}
	xfree (desc);
	}

	return 0;
	}


	/* Modify a Key description, replacing certain special format
	characters. List of currently supported replacements:

	%% - Replaced by a single %
	%c - Replaced by the content of COMMENT.
	%C - Same as %c but put into parentheses.
	%F - Replaced by an ssh style fingerprint computed from KEY.

	The functions returns 0 on success or an error code. On success a
	newly allocated string is stored at the address of RESULT.
	*/
	static gpg_error_t
	modify_description (const char in, const char comment, const gcry_sexp_t key,
	char **result)
	{
	size_t comment_length;
	size_t in_len;
	size_t out_len;
	char *out;
	size_t i;
	int special, pass;
	char *ssh_fpr = NULL;

	comment_length = strlen (comment);
	in_len = strlen (in);

	/* First pass calculates the length, second pass does the actual
	copying. */
	out = NULL;
	out_len = 0;
	for (pass=0; pass < 2; pass++)
	{
	special = 0;
	for (i = 0; i < in_len; i++)
	{
	if (special)
	{
	special = 0;
	switch (in[i])
	{
	case '%':
	if (out)
	*out++ = '%';
	else
	out_len++;
	break;

	case 'c': /* Comment. */
	if (out)
	{
	memcpy (out, comment, comment_length);
	out += comment_length;
	}
	else
	out_len += comment_length;
	break;

	case 'C': /* Comment. */
	if (!comment_length)
	;
	else if (out)
	{
	*out++ = '(';
	memcpy (out, comment, comment_length);
	out += comment_length;
	*out++ = ')';
	}
	else
	out_len += comment_length + 2;
	break;

	case 'F': /* SSH style fingerprint. */
	if (!ssh_fpr && key)
	ssh_get_fingerprint_string (key, &ssh_fpr);
	if (ssh_fpr)
	{
	if (out)
	out = stpcpy (out, ssh_fpr);
	else
	out_len += strlen (ssh_fpr);
	}
	break;

	default: /* Invalid special sequences are kept as they are. */
	if (out)
	{
	*out++ = '%';
	*out++ = in[i];
	}
	else
	out_len+=2;
	break;
	}
	}
	else if (in[i] == '%')
	special = 1;
	else
	{
	if (out)
	*out++ = in[i];
	else
	out_len++;
	}
	}

	if (!pass)
	{
	*result = out = xtrymalloc (out_len + 1);
	if (!out)
	{
	xfree (ssh_fpr);
	return gpg_error_from_syserror ();
	}
	}
	}

	*out = 0;
	assert (*result + out_len == out);
	xfree (ssh_fpr);
	return 0;
	}



	/* Unprotect the canconical encoded S-expression key in KEYBUF. GRIP
	should be the hex encoded keygrip of that key to be used with the
	caching mechanism. DESC_TEXT may be set to override the default
	description used for the pinentry. If LOOKUP_TTL is given this
	function is used to lookup the default ttl. If R_PASSPHRASE is not
	NULL, the function succeeded and the key was protected the used
	passphrase (entered or from the cache) is stored there; if not NULL
	will be stored. The caller needs to free the returned
	passphrase. */
	static int
	unprotect (ctrl_t ctrl, const char cache_nonce, const char desc_text,
	unsigned char *keybuf, const unsigned char grip,
	cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
	char **r_passphrase)
	{
	struct pin_entry_info_s *pi;
	struct try_unprotect_arg_s arg;
	int rc;
	unsigned char *result;
	size_t resultlen;
	char hexgrip[40+1];

	if (r_passphrase)
	*r_passphrase = NULL;

	bin2hex (grip, 20, hexgrip);

	/* Initially try to get it using a cache nonce. */
	if (cache_nonce)
	{
	char *pw;

	pw = agent_get_cache (cache_nonce, CACHE_MODE_NONCE);
	if (pw)
	{
	rc = agent_unprotect (ctrl, *keybuf, pw, NULL, &result, &resultlen);
	if (!rc)
	{
	if (r_passphrase)
	*r_passphrase = pw;
	else
	xfree (pw);
	xfree (*keybuf);
	*keybuf = result;
	return 0;
	}
	xfree (pw);
	}
	}

	/* First try to get it from the cache - if there is none or we can't
	unprotect it, we fall back to ask the user */
	if (cache_mode != CACHE_MODE_IGNORE)
	{
	char *pw;

	retry:
	pw = agent_get_cache (hexgrip, cache_mode);
	if (pw)
	{
	rc = agent_unprotect (ctrl, *keybuf, pw, NULL, &result, &resultlen);
	if (!rc)
	{
	if (cache_mode == CACHE_MODE_NORMAL)
	agent_store_cache_hit (hexgrip);
	if (r_passphrase)
	*r_passphrase = pw;
	else
	xfree (pw);
	xfree (*keybuf);
	*keybuf = result;
	return 0;
	}
	xfree (pw);
	rc = 0;
	}
	else if (cache_mode == CACHE_MODE_NORMAL)
	{
	/* The standard use of GPG keys is to have a signing and an
	encryption subkey. Commonly both use the same
	passphrase. We try to help the user to enter the
	passphrase only once by silently trying the last
	correctly entered passphrase. Checking one additional
	passphrase should be acceptable; despite the S2K
	introduced delays. The assumed workflow is:

	1. Read encrypted message in a MUA and thus enter a
	passphrase for the encryption subkey.

	2. Reply to that mail with an encrypted and signed
	mail, thus entering the passphrase for the signing
	subkey.

	We can often avoid the passphrase entry in the second
	step. We do this only in normal mode, so not to
	interfere with unrelated cache entries. */
	pw = agent_get_cache (NULL, cache_mode);
	if (pw)
	{
	rc = agent_unprotect (ctrl, *keybuf, pw, NULL,
	&result, &resultlen);
	if (!rc)
	{
	if (r_passphrase)
	*r_passphrase = pw;
	else
	xfree (pw);
	xfree (*keybuf);
	*keybuf = result;
	return 0;
	}
	xfree (pw);
	rc = 0;
	}
	}

	/* If the pinentry is currently in use, we wait up to 60 seconds
	for it to close and check the cache again. This solves a common
	situation where several requests for unprotecting a key have
	been made but the user is still entering the passphrase for
	the first request. Because all requests to agent_askpin are
	serialized they would then pop up one after the other to
	request the passphrase - despite that the user has already
	entered it and is then available in the cache. This
	implementation is not race free but in the worst case the
	user has to enter the passphrase only once more. */
	if (pinentry_active_p (ctrl, 0))
	{
	/* Active - wait */
	if (!pinentry_active_p (ctrl, 60))
	{
	/* We need to give the other thread a chance to actually put
	it into the cache. */
	npth_sleep (1);
	goto retry;
	}
	/* Timeout - better call pinentry now the plain way. */
	}
	}

	pi = gcry_calloc_secure (1, sizeof (*pi) + MAX_PASSPHRASE_LEN + 1);
	if (!pi)
	return gpg_error_from_syserror ();
	pi->max_length = MAX_PASSPHRASE_LEN + 1;
	pi->min_digits = 0; /* we want a real passphrase */
	pi->max_digits = 16;
	pi->max_tries = 3;
	pi->check_cb = try_unprotect_cb;
	arg.ctrl = ctrl;
	arg.protected_key = *keybuf;
	arg.unprotected_key = NULL;
	arg.change_required = 0;
	pi->check_cb_arg = &arg;

	rc = agent_askpin (ctrl, desc_text, NULL, NULL, pi, hexgrip, cache_mode);
	if (!rc)
	{
	assert (arg.unprotected_key);
	if (arg.change_required)
	{
	/* The callback told as that the user should change their
	passphrase. Present the dialog to do. */
	size_t canlen, erroff;
	gcry_sexp_t s_skey;

	assert (arg.unprotected_key);
	canlen = gcry_sexp_canon_len (arg.unprotected_key, 0, NULL, NULL);
	rc = gcry_sexp_sscan (&s_skey, &erroff,
	(char*)arg.unprotected_key, canlen);
	if (rc)
	{
	log_error ("failed to build S-Exp (off=%u): %s\n",
	(unsigned int)erroff, gpg_strerror (rc));
	wipememory (arg.unprotected_key, canlen);
	xfree (arg.unprotected_key);
	xfree (pi);
	return rc;
	}
	rc = agent_protect_and_store (ctrl, s_skey, NULL);
	gcry_sexp_release (s_skey);
	if (rc)
	{
	log_error ("changing the passphrase failed: %s\n",
	gpg_strerror (rc));
	wipememory (arg.unprotected_key, canlen);
	xfree (arg.unprotected_key);
	xfree (pi);
	return rc;
	}
	}
	else
	{
	/* Passphrase is fine. */
	agent_put_cache (hexgrip, cache_mode, pi->pin,
	lookup_ttl? lookup_ttl (hexgrip) : 0);
	agent_store_cache_hit (hexgrip);
	if (r_passphrase && *pi->pin)
	*r_passphrase = xtrystrdup (pi->pin);
	}
	xfree (*keybuf);
	*keybuf = arg.unprotected_key;
	}
	xfree (pi);
	return rc;
	}


	/* Read the key identified by GRIP from the private key directory and
	return it as an gcrypt S-expression object in RESULT. On failure
	returns an error code and stores NULL at RESULT. */
	static gpg_error_t
	read_key_file (const unsigned char grip, gcry_sexp_t result)
	{
	int rc;
	char *fname;
	estream_t fp;
	struct stat st;
	unsigned char *buf;
	size_t buflen, erroff;
	gcry_sexp_t s_skey;
	char hexgrip[40+4+1];
	char first;

	*result = NULL;

	bin2hex (grip, 20, hexgrip);
	strcpy (hexgrip+40, ".key");

	fname = make_filename (gnupg_homedir (), GNUPG_PRIVATE_KEYS_DIR,
	hexgrip, NULL);
	fp = es_fopen (fname, "rb");
	if (!fp)
	{
	rc = gpg_error_from_syserror ();
	if (gpg_err_code (rc) != GPG_ERR_ENOENT)
	log_error ("can't open '%s': %s\n", fname, strerror (errno));
	xfree (fname);
	return rc;
	}

	if (es_fread (&first, 1, 1, fp) != 1)
	{
	rc = gpg_error_from_syserror ();
	log_error ("error reading first byte from '%s': %s\n",
	fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	return rc;
	}

	rc = es_fseek (fp, 0, SEEK_SET);
	if (rc)
	{
	log_error ("error seeking in '%s': %s\n", fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	return rc;
	}

	if (first != '(')
	{
	/* Key is in extended format. */
	nvc_t pk;
	int line;

	rc = nvc_parse_private_key (&pk, &line, fp);
	es_fclose (fp);

	if (rc)
	log_error ("error parsing '%s' line %d: %s\n",
	fname, line, gpg_strerror (rc));
	else
	{
	rc = nvc_get_private_key (pk, result);
	nvc_release (pk);
	if (rc)
	log_error ("error getting private key from '%s': %s\n",
	fname, gpg_strerror (rc));
	}

	xfree (fname);
	return rc;
	}

	if (fstat (es_fileno (fp), &st))
	{
	rc = gpg_error_from_syserror ();
	log_error ("can't stat '%s': %s\n", fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	return rc;
	}

	buflen = st.st_size;
	buf = xtrymalloc (buflen+1);
	if (!buf)
	{
	rc = gpg_error_from_syserror ();
	log_error ("error allocating %zu bytes for '%s': %s\n",
	buflen, fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	xfree (buf);
	return rc;

	}

	if (es_fread (buf, buflen, 1, fp) != 1)
	{
	rc = gpg_error_from_syserror ();
	log_error ("error reading %zu bytes from '%s': %s\n",
	buflen, fname, strerror (errno));
	xfree (fname);
	es_fclose (fp);
	xfree (buf);
	return rc;
	}

	/* Convert the file into a gcrypt S-expression object. */
	rc = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
	xfree (fname);
	es_fclose (fp);
	xfree (buf);
	if (rc)
	{
	log_error ("failed to build S-Exp (off=%u): %s\n",
	(unsigned int)erroff, gpg_strerror (rc));
	return rc;
	}
	*result = s_skey;
	return 0;
	}


	/* Remove the key identified by GRIP from the private key directory. */
	static gpg_error_t
	remove_key_file (const unsigned char *grip)
	{
	gpg_error_t err = 0;
	char *fname;
	char hexgrip[40+4+1];

	bin2hex (grip, 20, hexgrip);
	strcpy (hexgrip+40, ".key");
	fname = make_filename (gnupg_homedir (), GNUPG_PRIVATE_KEYS_DIR,
	hexgrip, NULL);
	if (gnupg_remove (fname))
	err = gpg_error_from_syserror ();
	xfree (fname);
	return err;
	}


	/* Return the secret key as an S-Exp in RESULT after locating it using
	the GRIP. If the operation shall be diverted to a token, an
	allocated S-expression with the shadow_info part from the file is
	stored at SHADOW_INFO; if not NULL will be stored at SHADOW_INFO.
	CACHE_MODE defines now the cache shall be used. DESC_TEXT may be
	set to present a custom description for the pinentry. LOOKUP_TTL
	is an optional function to convey a TTL to the cache manager; we do
	not simply pass the TTL value because the value is only needed if
	an unprotect action was needed and looking up the TTL may have some
	overhead (e.g. scanning the sshcontrol file). If a CACHE_NONCE is
	given that cache item is first tried to get a passphrase. If
	R_PASSPHRASE is not NULL, the function succeeded and the key was
	protected the used passphrase (entered or from the cache) is stored
	there; if not NULL will be stored. The caller needs to free the
	returned passphrase. */
	gpg_error_t
	agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
	const char *desc_text,
	const unsigned char grip, unsigned char *shadow_info,
	cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
	gcry_sexp_t result, char *r_passphrase)
	{
	int rc;
	unsigned char *buf;
	size_t len, buflen, erroff;
	gcry_sexp_t s_skey;

	*result = NULL;
	if (shadow_info)
	*shadow_info = NULL;
	if (r_passphrase)
	*r_passphrase = NULL;

	rc = read_key_file (grip, &s_skey);
	if (rc)
	{
	if (gpg_err_code (rc) == GPG_ERR_ENOENT)
	rc = gpg_error (GPG_ERR_NO_SECKEY);
	return rc;
	}

	/* For use with the protection functions we also need the key as an
	canonical encoded S-expression in a buffer. Create this buffer
	now. */
	rc = make_canon_sexp (s_skey, &buf, &len);
	if (rc)
	return rc;

	switch (agent_private_key_type (buf))
	{
	case PRIVATE_KEY_CLEAR:
	break; /* no unprotection needed */
	case PRIVATE_KEY_OPENPGP_NONE:
	{
	unsigned char *buf_new;
	size_t buf_newlen;

	rc = agent_unprotect (ctrl, buf, "", NULL, &buf_new, &buf_newlen);
	if (rc)
	log_error ("failed to convert unprotected openpgp key: %s\n",
	gpg_strerror (rc));
	else
	{
	xfree (buf);
	buf = buf_new;
	}
	}
	break;
	case PRIVATE_KEY_PROTECTED:
	{
	char *desc_text_final;
	char *comment = NULL;

	/* Note, that we will take the comment as a C string for
	display purposes; i.e. all stuff beyond a Nul character is
	ignored. */
	{
	gcry_sexp_t comment_sexp;

	comment_sexp = gcry_sexp_find_token (s_skey, "comment", 0);
	if (comment_sexp)
	comment = gcry_sexp_nth_string (comment_sexp, 1);
	gcry_sexp_release (comment_sexp);
	}

	desc_text_final = NULL;
	if (desc_text)
	rc = modify_description (desc_text, comment? comment:"", s_skey,
	&desc_text_final);
	gcry_free (comment);

	if (!rc)
	{
	rc = unprotect (ctrl, cache_nonce, desc_text_final, &buf, grip,
	cache_mode, lookup_ttl, r_passphrase);
	if (rc)
	log_error ("failed to unprotect the secret key: %s\n",
	gpg_strerror (rc));
	}

	xfree (desc_text_final);
	}
	break;
	case PRIVATE_KEY_SHADOWED:
	if (shadow_info)
	{
	const unsigned char *s;
	size_t n;

	rc = agent_get_shadow_info (buf, &s);
	if (!rc)
	{
	n = gcry_sexp_canon_len (s, 0, NULL,NULL);
	assert (n);
	*shadow_info = xtrymalloc (n);
	if (!*shadow_info)
	rc = out_of_core ();
	else
	{
	memcpy (*shadow_info, s, n);
	rc = 0;
	}
	}
	if (rc)
	log_error ("get_shadow_info failed: %s\n", gpg_strerror (rc));
	}
	else
	rc = gpg_error (GPG_ERR_UNUSABLE_SECKEY);
	break;
	default:
	log_error ("invalid private key format\n");
	rc = gpg_error (GPG_ERR_BAD_SECKEY);
	break;
	}
	gcry_sexp_release (s_skey);
	s_skey = NULL;
	if (rc)
	{
	xfree (buf);
	if (r_passphrase)
	{
	xfree (*r_passphrase);
	*r_passphrase = NULL;
	}
	return rc;
	}

	buflen = gcry_sexp_canon_len (buf, 0, NULL, NULL);
	rc = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
	wipememory (buf, buflen);
	xfree (buf);
	if (rc)
	{
	log_error ("failed to build S-Exp (off=%u): %s\n",
	(unsigned int)erroff, gpg_strerror (rc));
	if (r_passphrase)
	{
	xfree (*r_passphrase);
	*r_passphrase = NULL;
	}
	return rc;
	}

	*result = s_skey;
	return 0;
	}


	/* Return the string name from the S-expression S_KEY as well as a
	string describing the names of the parameters. ALGONAMESIZE and
	ELEMSSIZE give the allocated size of the provided buffers. The
	buffers may be NULL if not required. If R_LIST is not NULL the top
	level list will be stored there; the caller needs to release it in
	this case. */
	static gpg_error_t
	key_parms_from_sexp (gcry_sexp_t s_key, gcry_sexp_t *r_list,
	char *r_algoname, size_t algonamesize,
	char *r_elems, size_t elemssize)
	{
	gcry_sexp_t list, l2;
	const char name, algoname, *elems;
	size_t n;

	if (r_list)
	*r_list = NULL;

	list = gcry_sexp_find_token (s_key, "shadowed-private-key", 0 );
	if (!list)
	list = gcry_sexp_find_token (s_key, "protected-private-key", 0 );
	if (!list)
	list = gcry_sexp_find_token (s_key, "private-key", 0 );
	if (!list)
	{
	log_error ("invalid private key format\n");
	return gpg_error (GPG_ERR_BAD_SECKEY);
	}

	l2 = gcry_sexp_cadr (list);
	gcry_sexp_release (list);
	list = l2;
	name = gcry_sexp_nth_data (list, 0, &n);
	if (n==3 && !memcmp (name, "rsa", 3))
	{
	algoname = "rsa";
	elems = "ne";
	}
	else if (n==3 && !memcmp (name, "dsa", 3))
	{
	algoname = "dsa";
	elems = "pqgy";
	}
	else if (n==3 && !memcmp (name, "ecc", 3))
	{
	algoname = "ecc";
	elems = "pabgnq";
	}
	else if (n==5 && !memcmp (name, "ecdsa", 5))
	{
	algoname = "ecdsa";
	elems = "pabgnq";
	}
	else if (n==4 && !memcmp (name, "ecdh", 4))
	{
	algoname = "ecdh";
	elems = "pabgnq";
	}
	else if (n==3 && !memcmp (name, "elg", 3))
	{
	algoname = "elg";
	elems = "pgy";
	}
	else
	{
	log_error ("unknown private key algorithm\n");
	gcry_sexp_release (list);
	return gpg_error (GPG_ERR_BAD_SECKEY);
	}

	if (r_algoname)
	{
	if (strlen (algoname) >= algonamesize)
	return gpg_error (GPG_ERR_BUFFER_TOO_SHORT);
	strcpy (r_algoname, algoname);
	}
	if (r_elems)
	{
	if (strlen (elems) >= elemssize)
	return gpg_error (GPG_ERR_BUFFER_TOO_SHORT);
	strcpy (r_elems, elems);
	}

	if (r_list)
	*r_list = list;
	else
	gcry_sexp_release (list);

	return 0;
	}


	/* Return true if KEYPARMS holds an EdDSA key. */
	static int
	is_eddsa (gcry_sexp_t keyparms)
	{
	int result = 0;
	gcry_sexp_t list;
	const char *s;
	size_t n;
	int i;

	list = gcry_sexp_find_token (keyparms, "flags", 0);
	for (i = list ? gcry_sexp_length (list)-1 : 0; i > 0; i--)
	{
	s = gcry_sexp_nth_data (list, i, &n);
	if (!s)
	continue; /* Not a data element. */

	if (n == 5 && !memcmp (s, "eddsa", 5))
	{
	result = 1;
	break;
	}
	}
	gcry_sexp_release (list);
	return result;
	}


	/* Return the public key algorithm number if S_KEY is a DSA style key.
	If it is not a DSA style key, return 0. */
	int
	agent_is_dsa_key (gcry_sexp_t s_key)
	{
	int result;
	gcry_sexp_t list;
	char algoname[6];

	if (!s_key)
	return 0;

	if (key_parms_from_sexp (s_key, &list, algoname, sizeof algoname, NULL, 0))
	return 0; /* Error - assume it is not an DSA key. */

	if (!strcmp (algoname, "dsa"))
	result = GCRY_PK_DSA;
	else if (!strcmp (algoname, "ecc"))
	{
	if (is_eddsa (list))
	result = 0;
	else
	result = GCRY_PK_ECDSA;
	}
	else if (!strcmp (algoname, "ecdsa"))
	result = GCRY_PK_ECDSA;
	else
	result = 0;

	gcry_sexp_release (list);
	return result;
	}


	/* Return true if S_KEY is an EdDSA key as used with curve Ed25519. */
	int
	agent_is_eddsa_key (gcry_sexp_t s_key)
	{
	int result;
	gcry_sexp_t list;
	char algoname[6];

	if (!s_key)
	return 0;

	if (key_parms_from_sexp (s_key, &list, algoname, sizeof algoname, NULL, 0))
	return 0; /* Error - assume it is not an EdDSA key. */

	if (!strcmp (algoname, "ecc") && is_eddsa (list))
	result = 1;
	else if (!strcmp (algoname, "eddsa")) /* backward compatibility. */
	result = 1;
	else
	result = 0;

	gcry_sexp_release (list);
	return result;
	}


	/* Return the key for the keygrip GRIP. The result is stored at
	RESULT. This function extracts the key from the private key
	database and returns it as an S-expression object as it is. On
	failure an error code is returned and NULL stored at RESULT. */
	gpg_error_t
	agent_raw_key_from_file (ctrl_t ctrl, const unsigned char *grip,
	gcry_sexp_t *result)
	{
	gpg_error_t err;
	gcry_sexp_t s_skey;

	(void)ctrl;

	*result = NULL;

	err = read_key_file (grip, &s_skey);
	if (!err)
	*result = s_skey;
	return err;
	}


	/* Return the public key for the keygrip GRIP. The result is stored
	at RESULT. This function extracts the public key from the private
	key database. On failure an error code is returned and NULL stored
	at RESULT. */
	gpg_error_t
	agent_public_key_from_file (ctrl_t ctrl,
	const unsigned char *grip,
	gcry_sexp_t *result)
	{
	gpg_error_t err;
	int i, idx;
	gcry_sexp_t s_skey;
	const char algoname, elems;
	int npkey;
	gcry_mpi_t array[10];
	gcry_sexp_t curve = NULL;
	gcry_sexp_t flags = NULL;
	gcry_sexp_t uri_sexp, comment_sexp;
	const char uri, comment;
	size_t uri_length, comment_length;
	char format, p;
	void args[2+7+2+2+1]; / Size is 2 + max. # of elements + 2 for uri + 2
	for comment + end-of-list. */
	int argidx;
	gcry_sexp_t list = NULL;
	const char *s;

	(void)ctrl;

	*result = NULL;

	err = read_key_file (grip, &s_skey);
	if (err)
	return err;

	for (i=0; i < DIM (array); i++)
	array[i] = NULL;

	err = extract_private_key (s_skey, 0, &algoname, &npkey, NULL, &elems,
	array, DIM (array), &curve, &flags);
	if (err)
	{
	gcry_sexp_release (s_skey);
	return err;
	}

	uri = NULL;
	uri_length = 0;
	uri_sexp = gcry_sexp_find_token (s_skey, "uri", 0);
	if (uri_sexp)
	uri = gcry_sexp_nth_data (uri_sexp, 1, &uri_length);

	comment = NULL;
	comment_length = 0;
	comment_sexp = gcry_sexp_find_token (s_skey, "comment", 0);
	if (comment_sexp)
	comment = gcry_sexp_nth_data (comment_sexp, 1, &comment_length);

	gcry_sexp_release (s_skey);
	s_skey = NULL;


	/* FIXME: The following thing is pretty ugly code; we should
	investigate how to make it cleaner. Probably code to handle
	canonical S-expressions in a memory buffer is better suited for
	such a task. After all that is what we do in protect.c. Neeed
	to find common patterns and write a straightformward API to use
	them. */
	assert (sizeof (size_t) <= sizeof (void*));

	format = xtrymalloc (15+4+7*npkey+10+15+1+1);
	if (!format)
	{
	err = gpg_error_from_syserror ();
	for (i=0; array[i]; i++)
	gcry_mpi_release (array[i]);
	gcry_sexp_release (curve);
	gcry_sexp_release (flags);
	gcry_sexp_release (uri_sexp);
	gcry_sexp_release (comment_sexp);
	return err;
	}

	argidx = 0;
	p = stpcpy (stpcpy (format, "(public-key("), algoname);
	p = stpcpy (p, "%S%S"); /* curve name and flags. */
	args[argidx++] = &curve;
	args[argidx++] = &flags;
	for (idx=0, s=elems; idx < npkey; idx++)
	{
	*p++ = '(';
	p++ = s++;
	p = stpcpy (p, " %m)");
	assert (argidx < DIM (args));
	args[argidx++] = &array[idx];
	}
	*p++ = ')';
	if (uri)
	{
	p = stpcpy (p, "(uri %b)");
	assert (argidx+1 < DIM (args));
	args[argidx++] = (void *)&uri_length;
	args[argidx++] = (void *)&uri;
	}
	if (comment)
	{
	p = stpcpy (p, "(comment %b)");
	assert (argidx+1 < DIM (args));
	args[argidx++] = (void *)&comment_length;
	args[argidx++] = (void*)&comment;
	}
	*p++ = ')';
	*p = 0;
	assert (argidx < DIM (args));
	args[argidx] = NULL;

	err = gcry_sexp_build_array (&list, NULL, format, args);
	xfree (format);
	for (i=0; array[i]; i++)
	gcry_mpi_release (array[i]);
	gcry_sexp_release (curve);
	gcry_sexp_release (flags);
	gcry_sexp_release (uri_sexp);
	gcry_sexp_release (comment_sexp);

	if (!err)
	*result = list;
	return err;
	}



	-/* Check whether the the secret key identified by GRIP is available.
	+/* Check whether the secret key identified by GRIP is available.
	Returns 0 is the key is available. */
	int
	agent_key_available (const unsigned char *grip)
	{
	int result;
	char *fname;
	char hexgrip[40+4+1];

	bin2hex (grip, 20, hexgrip);
	strcpy (hexgrip+40, ".key");

	fname = make_filename (gnupg_homedir (), GNUPG_PRIVATE_KEYS_DIR,
	hexgrip, NULL);
	result = !access (fname, R_OK)? 0 : -1;
	xfree (fname);
	return result;
	}



	/* Return the information about the secret key specified by the binary
	keygrip GRIP. If the key is a shadowed one the shadow information
	will be stored at the address R_SHADOW_INFO as an allocated
	S-expression. */
	gpg_error_t
	agent_key_info_from_file (ctrl_t ctrl, const unsigned char *grip,
	int r_keytype, unsigned char *r_shadow_info)
	{
	gpg_error_t err;
	unsigned char *buf;
	size_t len;
	int keytype;

	(void)ctrl;

	if (r_keytype)
	*r_keytype = PRIVATE_KEY_UNKNOWN;
	if (r_shadow_info)
	*r_shadow_info = NULL;

	{
	gcry_sexp_t sexp;

	err = read_key_file (grip, &sexp);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	return gpg_error (GPG_ERR_NOT_FOUND);
	else
	return err;
	}
	err = make_canon_sexp (sexp, &buf, &len);
	gcry_sexp_release (sexp);
	if (err)
	return err;
	}

	keytype = agent_private_key_type (buf);
	switch (keytype)
	{
	case PRIVATE_KEY_CLEAR:
	case PRIVATE_KEY_OPENPGP_NONE:
	break;
	case PRIVATE_KEY_PROTECTED:
	/* If we ever require it we could retrieve the comment fields
	from such a key. */
	break;
	case PRIVATE_KEY_SHADOWED:
	if (r_shadow_info)
	{
	const unsigned char *s;
	size_t n;

	err = agent_get_shadow_info (buf, &s);
	if (!err)
	{
	n = gcry_sexp_canon_len (s, 0, NULL, NULL);
	assert (n);
	*r_shadow_info = xtrymalloc (n);
	if (!*r_shadow_info)
	err = gpg_error_from_syserror ();
	else
	memcpy (*r_shadow_info, s, n);
	}
	}
	break;
	default:
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	break;
	}

	if (!err && r_keytype)
	*r_keytype = keytype;

	xfree (buf);
	return err;
	}



	/* Delete the key with GRIP from the disk after having asked for
	confirmation using DESC_TEXT. If FORCE is set the function won't
	require a confirmation via Pinentry or warns if the key is also
	used by ssh.

	Common error codes are:
	GPG_ERR_NO_SECKEY
	GPG_ERR_KEY_ON_CARD
	GPG_ERR_NOT_CONFIRMED
	*/
	gpg_error_t
	agent_delete_key (ctrl_t ctrl, const char *desc_text,
	const unsigned char *grip, int force)
	{
	gpg_error_t err;
	gcry_sexp_t s_skey = NULL;
	unsigned char *buf = NULL;
	size_t len;
	char *desc_text_final = NULL;
	char *comment = NULL;
	ssh_control_file_t cf = NULL;
	char hexgrip[40+4+1];
	char *default_desc = NULL;

	err = read_key_file (grip, &s_skey);
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	err = gpg_error (GPG_ERR_NO_SECKEY);
	if (err)
	goto leave;

	err = make_canon_sexp (s_skey, &buf, &len);
	if (err)
	goto leave;

	switch (agent_private_key_type (buf))
	{
	case PRIVATE_KEY_CLEAR:
	case PRIVATE_KEY_OPENPGP_NONE:
	case PRIVATE_KEY_PROTECTED:
	bin2hex (grip, 20, hexgrip);
	if (!force)
	{
	if (!desc_text)
	{
	default_desc = xtryasprintf
	(L_("Do you really want to delete the key identified by keygrip%%0A"
	" %s%%0A %%C%%0A?"), hexgrip);
	desc_text = default_desc;
	}

	/* Note, that we will take the comment as a C string for
	display purposes; i.e. all stuff beyond a Nul character is
	ignored. */
	{
	gcry_sexp_t comment_sexp;

	comment_sexp = gcry_sexp_find_token (s_skey, "comment", 0);
	if (comment_sexp)
	comment = gcry_sexp_nth_string (comment_sexp, 1);
	gcry_sexp_release (comment_sexp);
	}

	if (desc_text)
	err = modify_description (desc_text, comment? comment:"", s_skey,
	&desc_text_final);
	if (err)
	goto leave;

	err = agent_get_confirmation (ctrl, desc_text_final,
	L_("Delete key"), L_("No"), 0);
	if (err)
	goto leave;

	cf = ssh_open_control_file ();
	if (cf)
	{
	if (!ssh_search_control_file (cf, hexgrip, NULL, NULL, NULL))
	{
	err = agent_get_confirmation
	(ctrl,
	L_("Warning: This key is also listed for use with SSH!\n"
	"Deleting the key might remove your ability to "
	"access remote machines."),
	L_("Delete key"), L_("No"), 0);
	if (err)
	goto leave;
	}
	}
	}
	err = remove_key_file (grip);
	break;

	case PRIVATE_KEY_SHADOWED:
	err = remove_key_file (grip);
	break;

	default:
	log_error ("invalid private key format\n");
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	break;
	}

	leave:
	ssh_close_control_file (cf);
	gcry_free (comment);
	xfree (desc_text_final);
	xfree (default_desc);
	xfree (buf);
	gcry_sexp_release (s_skey);
	return err;
	}


	/* Write an S-expression formatted shadow key to our key storage.
	Shadow key is created by an S-expression public key in PKBUF and
	card's SERIALNO and the IDSTRING. With FORCE passed as true an
	existing key with the given GRIP will get overwritten. */
	gpg_error_t
	agent_write_shadow_key (const unsigned char *grip,
	const char serialno, const char keyid,
	const unsigned char *pkbuf, int force)
	{
	gpg_error_t err;
	unsigned char *shadow_info;
	unsigned char *shdkey;
	size_t len;

	shadow_info = make_shadow_info (serialno, keyid);
	if (!shadow_info)
	return gpg_error_from_syserror ();

	err = agent_shadow_key (pkbuf, shadow_info, &shdkey);
	xfree (shadow_info);
	if (err)
	{
	log_error ("shadowing the key failed: %s\n", gpg_strerror (err));
	return err;
	}

	len = gcry_sexp_canon_len (shdkey, 0, NULL, NULL);
	err = agent_write_private_key (grip, shdkey, len, force);
	xfree (shdkey);
	if (err)
	log_error ("error writing key: %s\n", gpg_strerror (err));

	return err;
	}
	diff --git a/agent/genkey.c b/agent/genkey.c
	index 8a43d8944..7fb0139a4 100644
	--- a/agent/genkey.c
	+++ b/agent/genkey.c
	@@ -1,617 +1,617 @@
	/* genkey.c - Generate a keypair
	* Copyright (C) 2002, 2003, 2004, 2007, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <assert.h>

	#include "agent.h"
	#include "i18n.h"
	#include "exechelp.h"
	#include "sysutils.h"

	static int
	store_key (gcry_sexp_t private, const char *passphrase, int force,
	unsigned long s2k_count)
	{
	int rc;
	unsigned char *buf;
	size_t len;
	unsigned char grip[20];

	if ( !gcry_pk_get_keygrip (private, grip) )
	{
	log_error ("can't calculate keygrip\n");
	return gpg_error (GPG_ERR_GENERAL);
	}

	len = gcry_sexp_sprint (private, GCRYSEXP_FMT_CANON, NULL, 0);
	assert (len);
	buf = gcry_malloc_secure (len);
	if (!buf)
	return out_of_core ();
	len = gcry_sexp_sprint (private, GCRYSEXP_FMT_CANON, buf, len);
	assert (len);

	if (passphrase)
	{
	unsigned char *p;

	rc = agent_protect (buf, passphrase, &p, &len, s2k_count, -1);
	if (rc)
	{
	xfree (buf);
	return rc;
	}
	xfree (buf);
	buf = p;
	}

	rc = agent_write_private_key (grip, buf, len, force);
	xfree (buf);
	return rc;
	}


	/* Count the number of non-alpha characters in S. Control characters
	and non-ascii characters are not considered. */
	static size_t
	nonalpha_count (const char *s)
	{
	size_t n;

	for (n=0; *s; s++)
	if (isascii (s) && ( isdigit (s) \|\| ispunct (*s) ))
	n++;

	return n;
	}


	/* Check PW against a list of pattern. Return 0 if PW does not match
	these pattern. */
	static int
	check_passphrase_pattern (ctrl_t ctrl, const char *pw)
	{
	gpg_error_t err = 0;
	const char *pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CHECK_PATTERN);
	FILE *infp;
	const char *argv[10];
	pid_t pid;
	int result, i;

	(void)ctrl;

	infp = gnupg_tmpfile ();
	if (!infp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("error creating temporary file: %s\n"), gpg_strerror (err));
	return 1; /* Error - assume password should not be used. */
	}

	if (fwrite (pw, strlen (pw), 1, infp) != 1)
	{
	err = gpg_error_from_syserror ();
	log_error (_("error writing to temporary file: %s\n"),
	gpg_strerror (err));
	fclose (infp);
	return 1; /* Error - assume password should not be used. */
	}
	fseek (infp, 0, SEEK_SET);
	clearerr (infp);

	i = 0;
	argv[i++] = "--null";
	argv[i++] = "--",
	argv[i++] = opt.check_passphrase_pattern,
	argv[i] = NULL;
	assert (i < sizeof argv);

	if (gnupg_spawn_process_fd (pgmname, argv, fileno (infp), -1, -1, &pid))
	result = 1; /* Execute error - assume password should no be used. */
	else if (gnupg_wait_process (pgmname, pid, 1, NULL))
	result = 1; /* Helper returned an error - probably a match. */
	else
	result = 0; /* Success; i.e. no match. */
	gnupg_release_process (pid);

	/* Overwrite our temporary file. */
	fseek (infp, 0, SEEK_SET);
	clearerr (infp);
	for (i=((strlen (pw)+99)/100)*100; i > 0; i--)
	putc ('\xff', infp);
	fflush (infp);
	fclose (infp);
	return result;
	}


	static int
	take_this_one_anyway2 (ctrl_t ctrl, const char desc, const char anyway_btn)
	{
	gpg_error_t err;

	if (opt.enforce_passphrase_constraints)
	{
	err = agent_show_message (ctrl, desc, L_("Enter new passphrase"));
	if (!err)
	err = gpg_error (GPG_ERR_CANCELED);
	}
	else
	err = agent_get_confirmation (ctrl, desc,
	anyway_btn, L_("Enter new passphrase"), 0);
	return err;
	}


	static int
	take_this_one_anyway (ctrl_t ctrl, const char *desc)
	{
	return take_this_one_anyway2 (ctrl, desc, L_("Take this one anyway"));
	}


	/* Check whether the passphrase PW is suitable. Returns 0 if the
	passphrase is suitable and true if it is not and the user should be
	asked to provide a different one. If FAILED_CONSTRAINT is set, a
	message describing the problem is returned in
	FAILED_CONSTRAINT. /
	int
	check_passphrase_constraints (ctrl_t ctrl, const char *pw,
	char **failed_constraint)
	{
	gpg_error_t err = 0;
	unsigned int minlen = opt.min_passphrase_len;
	unsigned int minnonalpha = opt.min_passphrase_nonalpha;
	char *msg1 = NULL;
	char *msg2 = NULL;
	char *msg3 = NULL;

	if (ctrl && ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK)
	return 0;

	if (!pw)
	pw = "";

	/* The first check is to warn about an empty passphrase. */
	if (!*pw)
	{
	const char *desc = (opt.enforce_passphrase_constraints?
	L_("You have not entered a passphrase!%0A"
	"An empty passphrase is not allowed.") :
	L_("You have not entered a passphrase - "
	"this is in general a bad idea!%0A"
	"Please confirm that you do not want to "
	"have any protection on your key."));

	err = 1;
	if (failed_constraint)
	{
	if (opt.enforce_passphrase_constraints)
	*failed_constraint = xstrdup (desc);
	else
	err = take_this_one_anyway2 (ctrl, desc,
	L_("Yes, protection is not needed"));
	}

	goto leave;
	}

	/* Now check the constraints and collect the error messages unless
	- in in silent mode which returns immediately. */
	+ in silent mode which returns immediately. */
	if (utf8_charcount (pw, -1) < minlen )
	{
	if (!failed_constraint)
	{
	err = gpg_error (GPG_ERR_INV_PASSPHRASE);
	goto leave;
	}

	msg1 = xtryasprintf
	( ngettext ("A passphrase should be at least %u character long.",
	"A passphrase should be at least %u characters long.",
	minlen), minlen );
	if (!msg1)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	if (nonalpha_count (pw) < minnonalpha )
	{
	if (!failed_constraint)
	{
	err = gpg_error (GPG_ERR_INV_PASSPHRASE);
	goto leave;
	}

	msg2 = xtryasprintf
	( ngettext ("A passphrase should contain at least %u digit or%%0A"
	"special character.",
	"A passphrase should contain at least %u digits or%%0A"
	"special characters.",
	minnonalpha), minnonalpha );
	if (!msg2)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	/* If configured check the passphrase against a list of known words
	and pattern. The actual test is done by an external program.
	The warning message is generic to give the user no hint on how to
	circumvent this list. */
	if (*pw && opt.check_passphrase_pattern &&
	check_passphrase_pattern (ctrl, pw))
	{
	if (!failed_constraint)
	{
	err = gpg_error (GPG_ERR_INV_PASSPHRASE);
	goto leave;
	}

	msg3 = xtryasprintf
	(L_("A passphrase may not be a known term or match%%0A"
	"certain pattern."));
	if (!msg3)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	if (failed_constraint && (msg1 \|\| msg2 \|\| msg3))
	{
	char *msg;
	size_t n;

	msg = strconcat
	(L_("Warning: You have entered an insecure passphrase."),
	"%0A%0A",
	msg1? msg1 : "", msg1? "%0A" : "",
	msg2? msg2 : "", msg2? "%0A" : "",
	msg3? msg3 : "", msg3? "%0A" : "",
	NULL);
	if (!msg)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Strip a trailing "%0A". */
	n = strlen (msg);
	if (n > 3 && !strcmp (msg + n - 3, "%0A"))
	msg[n-3] = 0;

	err = 1;
	if (opt.enforce_passphrase_constraints)
	*failed_constraint = msg;
	else
	{
	err = take_this_one_anyway (ctrl, msg);
	xfree (msg);
	}
	}

	leave:
	xfree (msg1);
	xfree (msg2);
	xfree (msg3);
	return err;
	}


	/* Callback function to compare the first entered PIN with the one
	currently being entered. */
	static gpg_error_t
	reenter_compare_cb (struct pin_entry_info_s *pi)
	{
	const char *pin1 = pi->check_cb_arg;

	if (!strcmp (pin1, pi->pin))
	return 0; /* okay */
	return gpg_error (GPG_ERR_BAD_PASSPHRASE);
	}


	/* Ask the user for a new passphrase using PROMPT. On success the
	function returns 0 and store the passphrase at R_PASSPHRASE; if the
	user opted not to use a passphrase NULL will be stored there. The
	user needs to free the returned string. In case of an error and
	error code is returned and NULL stored at R_PASSPHRASE. */
	gpg_error_t
	agent_ask_new_passphrase (ctrl_t ctrl, const char *prompt,
	char **r_passphrase)
	{
	gpg_error_t err;
	const char *text1 = prompt;
	const char *text2 = L_("Please re-enter this passphrase");
	char *initial_errtext = NULL;
	struct pin_entry_info_s pi, pi2;

	*r_passphrase = NULL;

	if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK)
	{
	size_t size;
	size_t len = 100;
	unsigned char *buffer;

	err = pinentry_loopback(ctrl, "NEW_PASSPHRASE", &buffer, &size, len);
	if (!err)
	{
	if (size)
	{
	buffer[size] = 0;
	*r_passphrase = buffer;
	}
	else
	*r_passphrase = NULL;
	}
	return err;
	}

	pi = gcry_calloc_secure (1, sizeof (*pi) + MAX_PASSPHRASE_LEN + 1);
	if (!pi)
	return gpg_error_from_syserror ();
	pi2 = gcry_calloc_secure (1, sizeof (*pi2) + MAX_PASSPHRASE_LEN + 1);
	if (!pi2)
	{
	err = gpg_error_from_syserror ();
	xfree (pi2);
	return err;
	}
	pi->max_length = MAX_PASSPHRASE_LEN + 1;
	pi->max_tries = 3;
	pi->with_qualitybar = 1;
	pi->with_repeat = 1;
	pi2->max_length = MAX_PASSPHRASE_LEN + 1;
	pi2->max_tries = 3;
	pi2->check_cb = reenter_compare_cb;
	pi2->check_cb_arg = pi->pin;

	next_try:
	err = agent_askpin (ctrl, text1, NULL, initial_errtext, pi, NULL, 0);
	xfree (initial_errtext);
	initial_errtext = NULL;
	if (!err)
	{
	if (check_passphrase_constraints (ctrl, pi->pin, &initial_errtext))
	{
	pi->failed_tries = 0;
	pi2->failed_tries = 0;
	goto next_try;
	}
	/* Unless the passphrase is empty or the pinentry told us that
	it already did the repetition check, ask to confirm it. */
	if (*pi->pin && !pi->repeat_okay)
	{
	err = agent_askpin (ctrl, text2, NULL, NULL, pi2, NULL, 0);
	if (gpg_err_code (err) == GPG_ERR_BAD_PASSPHRASE)
	{ /* The re-entered one did not match and the user did not
	hit cancel. */
	initial_errtext = xtrystrdup (L_("does not match - try again"));
	if (initial_errtext)
	goto next_try;
	err = gpg_error_from_syserror ();
	}
	}
	}

	if (!err && *pi->pin)
	{
	/* User wants a passphrase. */
	*r_passphrase = xtrystrdup (pi->pin);
	if (!*r_passphrase)
	err = gpg_error_from_syserror ();
	}

	xfree (initial_errtext);
	xfree (pi2);
	xfree (pi);
	return err;
	}



	/* Generate a new keypair according to the parameters given in
	KEYPARAM. If CACHE_NONCE is given first try to lookup a passphrase
	using the cache nonce. If NO_PROTECTION is true the key will not
	be protected by a passphrase. If OVERRIDE_PASSPHRASE is true that
	passphrase will be used for the new key. */
	int
	agent_genkey (ctrl_t ctrl, const char *cache_nonce,
	const char *keyparam, size_t keyparamlen, int no_protection,
	const char override_passphrase, int preset, membuf_t outbuf)
	{
	gcry_sexp_t s_keyparam, s_key, s_private, s_public;
	char *passphrase_buffer = NULL;
	const char *passphrase;
	int rc;
	size_t len;
	char *buf;

	rc = gcry_sexp_sscan (&s_keyparam, NULL, keyparam, keyparamlen);
	if (rc)
	{
	log_error ("failed to convert keyparam: %s\n", gpg_strerror (rc));
	return gpg_error (GPG_ERR_INV_DATA);
	}

	/* Get the passphrase now, cause key generation may take a while. */
	if (override_passphrase)
	passphrase = override_passphrase;
	else if (no_protection \|\| !cache_nonce)
	passphrase = NULL;
	else
	{
	passphrase_buffer = agent_get_cache (cache_nonce, CACHE_MODE_NONCE);
	passphrase = passphrase_buffer;
	}

	if (passphrase \|\| no_protection)
	;
	else
	{
	rc = agent_ask_new_passphrase (ctrl,
	L_("Please enter the passphrase to%0A"
	"protect your new key"),
	&passphrase_buffer);
	if (rc)
	return rc;
	passphrase = passphrase_buffer;
	}

	rc = gcry_pk_genkey (&s_key, s_keyparam );
	gcry_sexp_release (s_keyparam);
	if (rc)
	{
	log_error ("key generation failed: %s\n", gpg_strerror (rc));
	xfree (passphrase_buffer);
	return rc;
	}

	/* break out the parts */
	s_private = gcry_sexp_find_token (s_key, "private-key", 0);
	if (!s_private)
	{
	log_error ("key generation failed: invalid return value\n");
	gcry_sexp_release (s_key);
	xfree (passphrase_buffer);
	return gpg_error (GPG_ERR_INV_DATA);
	}
	s_public = gcry_sexp_find_token (s_key, "public-key", 0);
	if (!s_public)
	{
	log_error ("key generation failed: invalid return value\n");
	gcry_sexp_release (s_private);
	gcry_sexp_release (s_key);
	xfree (passphrase_buffer);
	return gpg_error (GPG_ERR_INV_DATA);
	}
	gcry_sexp_release (s_key); s_key = NULL;

	/* store the secret key */
	if (DBG_CRYPTO)
	log_debug ("storing private key\n");
	rc = store_key (s_private, passphrase, 0, ctrl->s2k_count);
	if (!rc)
	{
	if (!cache_nonce)
	{
	char tmpbuf[12];
	gcry_create_nonce (tmpbuf, 12);
	cache_nonce = bin2hex (tmpbuf, 12, NULL);
	}
	if (cache_nonce
	&& !no_protection
	&& !agent_put_cache (cache_nonce, CACHE_MODE_NONCE,
	passphrase, ctrl->cache_ttl_opt_preset))
	agent_write_status (ctrl, "CACHE_NONCE", cache_nonce, NULL);
	if (preset && !no_protection)
	{
	unsigned char grip[20];
	char hexgrip[40+1];
	if (gcry_pk_get_keygrip (s_private, grip))
	{
	bin2hex(grip, 20, hexgrip);
	rc = agent_put_cache (hexgrip, CACHE_MODE_ANY, passphrase,
	ctrl->cache_ttl_opt_preset);
	}
	}
	}
	xfree (passphrase_buffer);
	passphrase_buffer = NULL;
	passphrase = NULL;
	gcry_sexp_release (s_private);
	if (rc)
	{
	gcry_sexp_release (s_public);
	return rc;
	}

	/* return the public key */
	if (DBG_CRYPTO)
	log_debug ("returning public key\n");
	len = gcry_sexp_sprint (s_public, GCRYSEXP_FMT_CANON, NULL, 0);
	assert (len);
	buf = xtrymalloc (len);
	if (!buf)
	{
	gpg_error_t tmperr = out_of_core ();
	gcry_sexp_release (s_private);
	gcry_sexp_release (s_public);
	return tmperr;
	}
	len = gcry_sexp_sprint (s_public, GCRYSEXP_FMT_CANON, buf, len);
	assert (len);
	put_membuf (outbuf, buf, len);
	gcry_sexp_release (s_public);
	xfree (buf);

	return 0;
	}



	/* Apply a new passphrase to the key S_SKEY and store it. If
	PASSPHRASE_ADDR and *PASSPHRASE_ADDR are not NULL, use that
	passphrase. If PASSPHRASE_ADDR is not NULL store a newly entered
	passphrase at that address. */
	gpg_error_t
	agent_protect_and_store (ctrl_t ctrl, gcry_sexp_t s_skey,
	char **passphrase_addr)
	{
	gpg_error_t err;

	if (passphrase_addr && *passphrase_addr)
	{
	/* Take an empty string as request not to protect the key. */
	err = store_key (s_skey, *passphrase_addr? passphrase_addr:NULL, 1,
	ctrl->s2k_count);
	}
	else
	{
	char *pass = NULL;

	if (passphrase_addr)
	{
	xfree (*passphrase_addr);
	*passphrase_addr = NULL;
	}
	err = agent_ask_new_passphrase (ctrl,
	L_("Please enter the new passphrase"),
	&pass);
	if (!err)
	err = store_key (s_skey, pass, 1, ctrl->s2k_count);
	if (!err && passphrase_addr)
	*passphrase_addr = pass;
	else
	xfree (pass);
	}

	return err;
	}
	diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
	index c0208cc88..5a5b55b62 100644
	--- a/agent/gpg-agent.c
	+++ b/agent/gpg-agent.c
	@@ -1,3116 +1,3116 @@
	/* gpg-agent.c - The GnuPG Agent
	* Copyright (C) 2000-2007, 2009-2010 Free Software Foundation, Inc.
	* Copyright (C) 2000-2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <stddef.h>
	#include <stdarg.h>
	#include <string.h>
	#include <errno.h>
	#include <assert.h>
	#include <time.h>
	#include <fcntl.h>
	#include <sys/stat.h>
	#ifdef HAVE_W32_SYSTEM
	# ifndef WINVER
	# define WINVER 0x0500 /* Same as in common/sysutils.c */
	# endif
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <aclapi.h>
	# include <sddl.h>
	#else /!HAVE_W32_SYSTEM/
	# include <sys/socket.h>
	# include <sys/un.h>
	#endif /!HAVE_W32_SYSTEM/
	#include <unistd.h>
	#ifdef HAVE_SIGNAL_H
	# include <signal.h>
	#endif
	#include <npth.h>

	#define GNUPG_COMMON_NEED_AFLOCAL
	#include "agent.h"
	#include <assuan.h> /* Malloc hooks and socket wrappers. */

	#include "i18n.h"
	#include "sysutils.h"
	#include "gc-opt-flags.h"
	#include "exechelp.h"
	#include "asshelp.h"
	#include "../common/init.h"


	enum cmd_and_opt_values
	{ aNull = 0,
	oCsh = 'c',
	oQuiet = 'q',
	oSh = 's',
	oVerbose = 'v',

	oNoVerbose = 500,
	aGPGConfList,
	aGPGConfTest,
	aUseStandardSocketP,
	oOptions,
	oDebug,
	oDebugAll,
	oDebugLevel,
	oDebugWait,
	oDebugQuickRandom,
	oDebugPinentry,
	oNoGreeting,
	oNoOptions,
	oHomedir,
	oNoDetach,
	oNoGrab,
	oLogFile,
	oServer,
	oDaemon,
	oSupervised,
	oBatch,

	oPinentryProgram,
	oPinentryTouchFile,
	oPinentryInvisibleChar,
	oPinentryTimeout,
	oDisplay,
	oTTYname,
	oTTYtype,
	oLCctype,
	oLCmessages,
	oXauthority,
	oScdaemonProgram,
	oDefCacheTTL,
	oDefCacheTTLSSH,
	oMaxCacheTTL,
	oMaxCacheTTLSSH,
	oEnforcePassphraseConstraints,
	oMinPassphraseLen,
	oMinPassphraseNonalpha,
	oCheckPassphrasePattern,
	oMaxPassphraseDays,
	oEnablePassphraseHistory,
	oUseStandardSocket,
	oNoUseStandardSocket,
	oExtraSocket,
	oBrowserSocket,
	oFakedSystemTime,

	oIgnoreCacheForSigning,
	oAllowMarkTrusted,
	oNoAllowMarkTrusted,
	oAllowPresetPassphrase,
	oAllowLoopbackPinentry,
	oNoAllowLoopbackPinentry,
	oNoAllowExternalCache,
	oAllowEmacsPinentry,
	oKeepTTY,
	oKeepDISPLAY,
	oSSHSupport,
	oPuttySupport,
	oDisableScdaemon,
	oDisableCheckOwnSocket,
	oWriteEnvFile
	};


	#ifndef ENAMETOOLONG
	# define ENAMETOOLONG EINVAL
	#endif


	static ARGPARSE_OPTS opts[] = {

	ARGPARSE_c (aGPGConfList, "gpgconf-list", "@"),
	ARGPARSE_c (aGPGConfTest, "gpgconf-test", "@"),
	ARGPARSE_c (aUseStandardSocketP, "use-standard-socket-p", "@"),

	ARGPARSE_group (301, N_("@Options:\n ")),

	ARGPARSE_s_n (oDaemon, "daemon", N_("run in daemon mode (background)")),
	ARGPARSE_s_n (oServer, "server", N_("run in server mode (foreground)")),
	#ifndef HAVE_W32_SYSTEM
	ARGPARSE_s_n (oSupervised, "supervised", N_("run in supervised mode")),
	#endif
	ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", N_("be somewhat more quiet")),
	ARGPARSE_s_n (oSh, "sh", N_("sh-style command output")),
	ARGPARSE_s_n (oCsh, "csh", N_("csh-style command output")),
	ARGPARSE_s_s (oOptions, "options", N_("\|FILE\|read options from FILE")),

	ARGPARSE_s_s (oDebug, "debug", "@"),
	ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
	ARGPARSE_s_s (oDebugLevel, "debug-level", "@"),
	ARGPARSE_s_i (oDebugWait," debug-wait", "@"),
	ARGPARSE_s_n (oDebugQuickRandom, "debug-quick-random", "@"),
	ARGPARSE_s_n (oDebugPinentry, "debug-pinentry", "@"),

	ARGPARSE_s_n (oNoDetach, "no-detach", N_("do not detach from the console")),
	ARGPARSE_s_n (oNoGrab, "no-grab", N_("do not grab keyboard and mouse")),
	ARGPARSE_s_s (oLogFile, "log-file", N_("use a log file for the server")),
	ARGPARSE_s_s (oPinentryProgram, "pinentry-program",
	/* */ N_("\|PGM\|use PGM as the PIN-Entry program")),
	ARGPARSE_s_s (oPinentryTouchFile, "pinentry-touch-file", "@"),
	ARGPARSE_s_s (oPinentryInvisibleChar, "pinentry-invisible-char", "@"),
	ARGPARSE_s_u (oPinentryTimeout, "pinentry-timeout", "@"),
	ARGPARSE_s_s (oScdaemonProgram, "scdaemon-program",
	/* */ N_("\|PGM\|use PGM as the SCdaemon program") ),
	ARGPARSE_s_n (oDisableScdaemon, "disable-scdaemon",
	/* */ N_("do not use the SCdaemon") ),
	ARGPARSE_s_n (oDisableCheckOwnSocket, "disable-check-own-socket", "@"),

	ARGPARSE_s_s (oExtraSocket, "extra-socket",
	/* */ N_("\|NAME\|accept some commands via NAME")),

	ARGPARSE_s_s (oBrowserSocket, "browser-socket", "@"),

	ARGPARSE_s_s (oFakedSystemTime, "faked-system-time", "@"),

	ARGPARSE_s_n (oBatch, "batch", "@"),
	ARGPARSE_s_s (oHomedir, "homedir", "@"),

	ARGPARSE_s_s (oDisplay, "display", "@"),
	ARGPARSE_s_s (oTTYname, "ttyname", "@"),
	ARGPARSE_s_s (oTTYtype, "ttytype", "@"),
	ARGPARSE_s_s (oLCctype, "lc-ctype", "@"),
	ARGPARSE_s_s (oLCmessages, "lc-messages", "@"),
	ARGPARSE_s_s (oXauthority, "xauthority", "@"),
	ARGPARSE_s_n (oKeepTTY, "keep-tty",
	/* */ N_("ignore requests to change the TTY")),
	ARGPARSE_s_n (oKeepDISPLAY, "keep-display",
	/* */ N_("ignore requests to change the X display")),

	ARGPARSE_s_u (oDefCacheTTL, "default-cache-ttl",
	N_("\|N\|expire cached PINs after N seconds")),
	ARGPARSE_s_u (oDefCacheTTLSSH, "default-cache-ttl-ssh", "@" ),
	ARGPARSE_s_u (oMaxCacheTTL, "max-cache-ttl", "@" ),
	ARGPARSE_s_u (oMaxCacheTTLSSH, "max-cache-ttl-ssh", "@" ),

	ARGPARSE_s_n (oEnforcePassphraseConstraints, "enforce-passphrase-constraints",
	/* */ "@"),
	ARGPARSE_s_u (oMinPassphraseLen, "min-passphrase-len", "@"),
	ARGPARSE_s_u (oMinPassphraseNonalpha, "min-passphrase-nonalpha", "@"),
	ARGPARSE_s_s (oCheckPassphrasePattern, "check-passphrase-pattern", "@"),
	ARGPARSE_s_u (oMaxPassphraseDays, "max-passphrase-days", "@"),
	ARGPARSE_s_n (oEnablePassphraseHistory, "enable-passphrase-history", "@"),

	ARGPARSE_s_n (oIgnoreCacheForSigning, "ignore-cache-for-signing",
	/* */ N_("do not use the PIN cache when signing")),
	ARGPARSE_s_n (oNoAllowExternalCache, "no-allow-external-cache",
	/* */ N_("disallow the use of an external password cache")),
	ARGPARSE_s_n (oNoAllowMarkTrusted, "no-allow-mark-trusted",
	/* */ N_("disallow clients to mark keys as \"trusted\"")),
	ARGPARSE_s_n (oAllowMarkTrusted, "allow-mark-trusted", "@"),
	ARGPARSE_s_n (oAllowPresetPassphrase, "allow-preset-passphrase",
	/* */ N_("allow presetting passphrase")),
	ARGPARSE_s_n (oNoAllowLoopbackPinentry, "no-allow-loopback-pinentry",
	N_("disallow caller to override the pinentry")),
	ARGPARSE_s_n (oAllowLoopbackPinentry, "allow-loopback-pinentry", "@"),
	ARGPARSE_s_n (oAllowEmacsPinentry, "allow-emacs-pinentry",
	/* */ N_("allow passphrase to be prompted through Emacs")),

	ARGPARSE_s_n (oSSHSupport, "enable-ssh-support", N_("enable ssh support")),
	ARGPARSE_s_n (oPuttySupport, "enable-putty-support",
	#ifdef HAVE_W32_SYSTEM
	/* */ N_("enable putty support")
	#else
	/* */ "@"
	#endif
	),

	/* Dummy options for backward compatibility. */
	ARGPARSE_o_s (oWriteEnvFile, "write-env-file", "@"),
	ARGPARSE_s_n (oUseStandardSocket, "use-standard-socket", "@"),
	ARGPARSE_s_n (oNoUseStandardSocket, "no-use-standard-socket", "@"),

	{0} /* End of list */
	};


	/* The list of supported debug flags. */
	static struct debug_flags_s debug_flags [] =
	{
	{ DBG_MPI_VALUE , "mpi" },
	{ DBG_CRYPTO_VALUE , "crypto" },
	{ DBG_MEMORY_VALUE , "memory" },
	{ DBG_CACHE_VALUE , "cache" },
	{ DBG_MEMSTAT_VALUE, "memstat" },
	{ DBG_HASHING_VALUE, "hashing" },
	{ DBG_IPC_VALUE , "ipc" },
	{ 77, NULL } /* 77 := Do not exit on "help" or "?". */
	};



	#define DEFAULT_CACHE_TTL (1060) / 10 minutes */
	#define DEFAULT_CACHE_TTL_SSH (3060) / 30 minutes */
	#define MAX_CACHE_TTL (12060) / 2 hours */
	#define MAX_CACHE_TTL_SSH (12060) / 2 hours */
	#define MIN_PASSPHRASE_LEN (8)
	#define MIN_PASSPHRASE_NONALPHA (1)
	#define MAX_PASSPHRASE_DAYS (0)

	/* The timer tick used for housekeeping stuff. For Windows we use a
	longer period as the SetWaitableTimer seems to signal earlier than
	the 2 seconds. CHECK_OWN_SOCKET_INTERVAL defines how often we
	check our own socket in standard socket mode. If that value is 0
	we don't check at all. All values are in seconds. */
	#if defined(HAVE_W32CE_SYSTEM)
	# define TIMERTICK_INTERVAL (60)
	# define CHECK_OWN_SOCKET_INTERVAL (0) /* Never */
	#elif defined(HAVE_W32_SYSTEM)
	# define TIMERTICK_INTERVAL (4)
	# define CHECK_OWN_SOCKET_INTERVAL (60)
	#else
	# define TIMERTICK_INTERVAL (2)
	# define CHECK_OWN_SOCKET_INTERVAL (60)
	#endif


	/* Flag indicating that the ssh-agent subsystem has been enabled. */
	static int ssh_support;

	#ifdef HAVE_W32_SYSTEM
	/* Flag indicating that support for Putty has been enabled. */
	static int putty_support;
	/* A magic value used with WM_COPYDATA. */
	#define PUTTY_IPC_MAGIC 0x804e50ba
	/* To avoid surprises we limit the size of the mapped IPC file to this
	value. Putty currently (0.62) uses 8k, thus 16k should be enough
	for the foreseeable future. */
	#define PUTTY_IPC_MAXLEN 16384
	#endif /HAVE_W32_SYSTEM/

	/* The list of open file descriptors at startup. Note that this list
	* has been allocated using the standard malloc. */
	#ifndef HAVE_W32_SYSTEM
	static int *startup_fd_list;
	#endif

	/* The signal mask at startup and a flag telling whether it is valid. */
	#ifdef HAVE_SIGPROCMASK
	static sigset_t startup_signal_mask;
	static int startup_signal_mask_valid;
	#endif

	/* Flag to indicate that a shutdown was requested. */
	static int shutdown_pending;

	/* Counter for the currently running own socket checks. */
	static int check_own_socket_running;

	/* Flags to indicate that check_own_socket shall not be called. */
	static int disable_check_own_socket;

	/* Flag indicating that we are in supervised mode. */
	static int is_supervised;

	/* Flag to inhibit socket removal in cleanup. */
	static int inhibit_socket_removal;

	/* It is possible that we are currently running under setuid permissions */
	static int maybe_setuid = 1;

	/* Name of the communication socket used for native gpg-agent
	requests. The second variable is either NULL or a malloced string
	with the real socket name in case it has been redirected. */
	static char *socket_name;
	static char *redir_socket_name;

	/* Name of the optional extra socket used for native gpg-agent requests. */
	static char *socket_name_extra;
	static char *redir_socket_name_extra;

	/* Name of the optional browser socket used for native gpg-agent requests. */
	static char *socket_name_browser;
	static char *redir_socket_name_browser;

	/* Name of the communication socket used for ssh-agent protocol. */
	static char *socket_name_ssh;
	static char *redir_socket_name_ssh;

	/* We need to keep track of the server's nonces (these are dummies for
	POSIX systems). */
	static assuan_sock_nonce_t socket_nonce;
	static assuan_sock_nonce_t socket_nonce_extra;
	static assuan_sock_nonce_t socket_nonce_browser;
	static assuan_sock_nonce_t socket_nonce_ssh;


	/* Default values for options passed to the pinentry. */
	static char *default_display;
	static char *default_ttyname;
	static char *default_ttytype;
	static char *default_lc_ctype;
	static char *default_lc_messages;
	static char *default_xauthority;

	/* Name of a config file, which will be reread on a HUP if it is not NULL. */
	static char *config_filename;

	/* Helper to implement --debug-level */
	static const char *debug_level;

	/* Keep track of the current log file so that we can avoid updating
	the log file after a SIGHUP if it didn't changed. Malloced. */
	static char *current_logfile;

	/* The handle_tick() function may test whether a parent is still
	running. We record the PID of the parent here or -1 if it should be
	watched. */
	static pid_t parent_pid = (pid_t)(-1);

	/* Number of active connections. */
	static int active_connections;

	/* This object is used to dispatch progress messages from Libgcrypt to
	* the right thread. Given that we will have at max only a few dozen
	* connections at a time, using a linked list is the easiest way to
	* handle this. */
	struct progress_dispatch_s
	{
	struct progress_dispatch_s *next;
	/* The control object of the connection. If this is NULL no
	* connection is associated with this item and it is free for reuse
	* by new connections. */
	ctrl_t ctrl;

	/* The thread id of (npth_self) of the connection. */
	npth_t tid;

	/* The callback set by the connection. This is similar to the
	* Libgcrypt callback but with the control object passed as the
	* first argument. */
	void (*cb)(ctrl_t ctrl,
	const char *what, int printchar,
	int current, int total);
	};
	struct progress_dispatch_s *progress_dispatch_list;




	/*
	Local prototypes.
	*/

	static char create_socket_name (char standard_name, int with_homedir);
	static gnupg_fd_t create_server_socket (char *name, int primary, int cygwin,
	char **r_redir_name,
	assuan_sock_nonce_t *nonce);
	static void create_directories (void);

	static void agent_libgcrypt_progress_cb (void data, const char what,
	int printchar,
	int current, int total);
	static void agent_init_default_ctrl (ctrl_t ctrl);
	static void agent_deinit_default_ctrl (ctrl_t ctrl);

	static void handle_connections (gnupg_fd_t listen_fd,
	gnupg_fd_t listen_fd_extra,
	gnupg_fd_t listen_fd_browser,
	gnupg_fd_t listen_fd_ssh);
	static void check_own_socket (void);
	static int check_for_running_agent (int silent);

	/* Pth wrapper function definitions. */
	ASSUAN_SYSTEM_NPTH_IMPL;


	/*
	Functions.
	*/

	/* Allocate a string describing a library version by calling a GETFNC.
	This function is expected to be called only once. GETFNC is
	expected to have a semantic like gcry_check_version (). */
	static char *
	make_libversion (const char libname, const char (getfnc)(const char))
	{
	const char *s;
	char *result;

	if (maybe_setuid)
	{
	gcry_control (GCRYCTL_INIT_SECMEM, 0, 0); /* Drop setuid. */
	maybe_setuid = 0;
	}
	s = getfnc (NULL);
	result = xmalloc (strlen (libname) + 1 + strlen (s) + 1);
	strcpy (stpcpy (stpcpy (result, libname), " "), s);
	return result;
	}

	/* Return strings describing this program. The case values are
	described in common/argparse.c:strusage. The values here override
	the default values given by strusage. */
	static const char *
	my_strusage (int level)
	{
	static char *ver_gcry;
	const char *p;

	switch (level)
	{
	case 11: p = "@GPG_AGENT@ (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	/* TRANSLATORS: @EMAIL@ will get replaced by the actual bug
	reporting address. This is so that we can change the
	reporting address without breaking the translations. */
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 20:
	if (!ver_gcry)
	ver_gcry = make_libversion ("libgcrypt", gcry_check_version);
	p = ver_gcry;
	break;

	case 1:
	case 40: p = _("Usage: @GPG_AGENT@ [options] (-h for help)");
	break;
	case 41: p = _("Syntax: @GPG_AGENT@ [options] [command [args]]\n"
	"Secret key management for @GNUPG@\n");
	break;

	default: p = NULL;
	}
	return p;
	}



	/* Setup the debugging. With the global variable DEBUG_LEVEL set to NULL
	only the active debug flags are propagated to the subsystems. With
	DEBUG_LEVEL set, a specific set of debug flags is set; thus overriding
	all flags already set. Note that we don't fail here, because it is
	important to keep gpg-agent running even after re-reading the
	options due to a SIGHUP. */
	static void
	set_debug (void)
	{
	int numok = (debug_level && digitp (debug_level));
	int numlvl = numok? atoi (debug_level) : 0;

	if (!debug_level)
	;
	else if (!strcmp (debug_level, "none") \|\| (numok && numlvl < 1))
	opt.debug = 0;
	else if (!strcmp (debug_level, "basic") \|\| (numok && numlvl <= 2))
	opt.debug = DBG_IPC_VALUE;
	else if (!strcmp (debug_level, "advanced") \|\| (numok && numlvl <= 5))
	opt.debug = DBG_IPC_VALUE;
	else if (!strcmp (debug_level, "expert") \|\| (numok && numlvl <= 8))
	opt.debug = (DBG_IPC_VALUE \| DBG_CACHE_VALUE);
	else if (!strcmp (debug_level, "guru") \|\| numok)
	{
	opt.debug = ~0;
	/* Unless the "guru" string has been used we don't want to allow
	hashing debugging. The rationale is that people tend to
	select the highest debug value and would then clutter their
	disk with debug files which may reveal confidential data. */
	if (numok)
	opt.debug &= ~(DBG_HASHING_VALUE);
	}
	else
	{
	log_error (_("invalid debug-level '%s' given\n"), debug_level);
	opt.debug = 0; /* Reset debugging, so that prior debug
	statements won't have an undesired effect. */
	}

	if (opt.debug && !opt.verbose)
	opt.verbose = 1;
	if (opt.debug && opt.quiet)
	opt.quiet = 0;

	if (opt.debug & DBG_MPI_VALUE)
	gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 2);
	if (opt.debug & DBG_CRYPTO_VALUE )
	gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
	gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);

	if (opt.debug)
	parse_debug_flag (NULL, &opt.debug, debug_flags);
	}


	/* Helper for cleanup to remove one socket with NAME. REDIR_NAME is
	the corresponding real name if the socket has been redirected. */
	static void
	remove_socket (char name, char redir_name)
	{
	if (name && *name)
	{
	if (redir_name)
	name = redir_name;

	gnupg_remove (name);
	*name = 0;
	}
	}


	/* Discover which inherited file descriptors correspond to which
	* services/sockets offered by gpg-agent, using the LISTEN_FDS and
	* LISTEN_FDNAMES convention. The understood labels are "ssh",
	* "extra", and "browser". "std" or other labels will be interpreted
	* as the standard socket.
	*
	* This function is designed to log errors when the expected file
	* descriptors don't make sense, but to do its best to continue to
	* work even in the face of minor misconfigurations.
	*
	* For more information on the LISTEN_FDS convention, see
	* sd_listen_fds(3) on certain Linux distributions.
	*/
	#ifndef HAVE_W32_SYSTEM
	static void
	map_supervised_sockets (gnupg_fd_t *r_fd,
	gnupg_fd_t *r_fd_extra,
	gnupg_fd_t *r_fd_browser,
	gnupg_fd_t *r_fd_ssh)
	{
	struct {
	const char *label;
	int **fdaddr;
	char **nameaddr;
	} tbl[] = {
	{ "ssh", &r_fd_ssh, &socket_name_ssh },
	{ "browser", &r_fd_browser, &socket_name_browser },
	{ "extra", &r_fd_extra, &socket_name_extra },
	{ "std", &r_fd, &socket_name } /* (Must be the last item.) */
	};
	const char *envvar;
	char **fdnames;
	int nfdnames;
	int fd_count;

	r_fd = r_fd_extra = r_fd_browser = r_fd_ssh = -1;

	/* Print a warning if LISTEN_PID does not match outr pid. */
	envvar = getenv ("LISTEN_PID");
	if (!envvar)
	log_error ("no LISTEN_PID environment variable found in "
	"--supervised mode (ignoring)\n");
	else if (strtoul (envvar, NULL, 10) != (unsigned long)getpid ())
	log_error ("environment variable LISTEN_PID (%lu) does not match"
	" our pid (%lu) in --supervised mode (ignoring)\n",
	(unsigned long)strtoul (envvar, NULL, 10),
	(unsigned long)getpid ());

	/* Parse LISTEN_FDNAMES into the array FDNAMES. */
	envvar = getenv ("LISTEN_FDNAMES");
	if (envvar)
	{
	fdnames = strtokenize (envvar, ":");
	if (!fdnames)
	{
	log_error ("strtokenize failed: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	agent_exit (1);
	}
	for (nfdnames=0; fdnames[nfdnames]; nfdnames++)
	;
	}
	else
	{
	fdnames = NULL;
	nfdnames = 0;
	}

	/* Parse LISTEN_FDS into fd_count or provide a replacement. */
	envvar = getenv ("LISTEN_FDS");
	if (envvar)
	fd_count = atoi (envvar);
	else if (fdnames)
	{
	log_error ("no LISTEN_FDS environment variable found in --supervised"
	" mode (relying on LISTEN_FDNAMES instead)\n");
	fd_count = nfdnames;
	}
	else
	{
	log_error ("no LISTEN_FDS or LISTEN_FDNAMES environment variables "
	"found in --supervised mode"
	" (assuming 1 active descriptor)\n");
	fd_count = 1;
	}

	if (fd_count < 1)
	{
	log_error ("--supervised mode expects at least one file descriptor"
	" (was told %d, carrying on as though it were 1)\n",
	fd_count);
	fd_count = 1;
	}

	/* Assign the descriptors to the return values. */
	if (!fdnames)
	{
	struct stat statbuf;

	if (fd_count != 1)
	log_error ("no LISTEN_FDNAMES and LISTEN_FDS (%d) != 1"
	" in --supervised mode."
	" (ignoring all sockets but the first one)\n",
	fd_count);
	if (fstat (3, &statbuf) == -1 && errno ==EBADF)
	log_fatal ("file descriptor 3 must be valid in --supervised mode"
	" if LISTEN_FDNAMES is not set\n");
	*r_fd = 3;
	socket_name = gnupg_get_socket_name (3);
	}
	else if (fd_count != nfdnames)
	{
	log_fatal ("number of items in LISTEN_FDNAMES (%d) does not match "
	"LISTEN_FDS (%d) in --supervised mode\n",
	nfdnames, fd_count);
	}
	else
	{
	int i, j, fd;
	char *name;

	for (i = 0; i < nfdnames; i++)
	{
	for (j = 0; j < DIM (tbl); j++)
	{
	if (!strcmp (fdnames[i], tbl[j].label) \|\| j == DIM(tbl)-1)
	{
	fd = 3 + i;
	if (**tbl[j].fdaddr == -1)
	{
	name = gnupg_get_socket_name (fd);
	if (name)
	{
	**tbl[j].fdaddr = fd;
	*tbl[j].nameaddr = name;
	log_info ("using fd %d for %s socket (%s)\n",
	fd, tbl[j].label, name);
	}
	else
	{
	log_error ("cannot listen on fd %d for %s socket\n",
	fd, tbl[j].label);
	close (fd);
	}
	}
	else
	{
	log_error ("cannot listen on more than one %s socket\n",
	tbl[j].label);
	close (fd);
	}
	break;
	}
	}
	}
	}

	xfree (fdnames);
	}
	#endif /!HAVE_W32_SYSTEM/


	/* Cleanup code for this program. This is either called has an atexit
	handler or directly. */
	static void
	cleanup (void)
	{
	static int done;

	if (done)
	return;
	done = 1;
	deinitialize_module_cache ();
	if (!is_supervised && !inhibit_socket_removal)
	{
	remove_socket (socket_name, redir_socket_name);
	if (opt.extra_socket > 1)
	remove_socket (socket_name_extra, redir_socket_name_extra);
	if (opt.browser_socket > 1)
	remove_socket (socket_name_browser, redir_socket_name_browser);
	remove_socket (socket_name_ssh, redir_socket_name_ssh);
	}
	}



	/* Handle options which are allowed to be reset after program start.
	Return true when the current option in PARGS could be handled and
	false if not. As a special feature, passing a value of NULL for
	PARGS, resets the options to the default. REREAD should be set
	true if it is not the initial option parsing. */
	static int
	parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
	{
	if (!pargs)
	{ /* reset mode */
	opt.quiet = 0;
	opt.verbose = 0;
	opt.debug = 0;
	opt.no_grab = 0;
	opt.debug_pinentry = 0;
	opt.pinentry_program = NULL;
	opt.pinentry_touch_file = NULL;
	xfree (opt.pinentry_invisible_char);
	opt.pinentry_invisible_char = NULL;
	opt.pinentry_timeout = 0;
	opt.scdaemon_program = NULL;
	opt.def_cache_ttl = DEFAULT_CACHE_TTL;
	opt.def_cache_ttl_ssh = DEFAULT_CACHE_TTL_SSH;
	opt.max_cache_ttl = MAX_CACHE_TTL;
	opt.max_cache_ttl_ssh = MAX_CACHE_TTL_SSH;
	opt.enforce_passphrase_constraints = 0;
	opt.min_passphrase_len = MIN_PASSPHRASE_LEN;
	opt.min_passphrase_nonalpha = MIN_PASSPHRASE_NONALPHA;
	opt.check_passphrase_pattern = NULL;
	opt.max_passphrase_days = MAX_PASSPHRASE_DAYS;
	opt.enable_passphrase_history = 0;
	opt.ignore_cache_for_signing = 0;
	opt.allow_mark_trusted = 1;
	opt.allow_external_cache = 1;
	opt.allow_loopback_pinentry = 1;
	opt.allow_emacs_pinentry = 0;
	opt.disable_scdaemon = 0;
	disable_check_own_socket = 0;
	return 1;
	}

	switch (pargs->r_opt)
	{
	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;

	case oDebug:
	parse_debug_flag (pargs->r.ret_str, &opt.debug, debug_flags);
	break;
	case oDebugAll: opt.debug = ~0; break;
	case oDebugLevel: debug_level = pargs->r.ret_str; break;
	case oDebugPinentry: opt.debug_pinentry = 1; break;

	case oLogFile:
	if (!reread)
	return 0; /* not handeld */
	if (!current_logfile \|\| !pargs->r.ret_str
	\|\| strcmp (current_logfile, pargs->r.ret_str))
	{
	log_set_file (pargs->r.ret_str);
	xfree (current_logfile);
	current_logfile = xtrystrdup (pargs->r.ret_str);
	}
	break;

	case oNoGrab: opt.no_grab = 1; break;

	case oPinentryProgram: opt.pinentry_program = pargs->r.ret_str; break;
	case oPinentryTouchFile: opt.pinentry_touch_file = pargs->r.ret_str; break;
	case oPinentryInvisibleChar:
	xfree (opt.pinentry_invisible_char);
	opt.pinentry_invisible_char = xtrystrdup (pargs->r.ret_str); break;
	break;
	case oPinentryTimeout: opt.pinentry_timeout = pargs->r.ret_ulong; break;
	case oScdaemonProgram: opt.scdaemon_program = pargs->r.ret_str; break;
	case oDisableScdaemon: opt.disable_scdaemon = 1; break;
	case oDisableCheckOwnSocket: disable_check_own_socket = 1; break;

	case oDefCacheTTL: opt.def_cache_ttl = pargs->r.ret_ulong; break;
	case oDefCacheTTLSSH: opt.def_cache_ttl_ssh = pargs->r.ret_ulong; break;
	case oMaxCacheTTL: opt.max_cache_ttl = pargs->r.ret_ulong; break;
	case oMaxCacheTTLSSH: opt.max_cache_ttl_ssh = pargs->r.ret_ulong; break;

	case oEnforcePassphraseConstraints:
	opt.enforce_passphrase_constraints=1;
	break;
	case oMinPassphraseLen: opt.min_passphrase_len = pargs->r.ret_ulong; break;
	case oMinPassphraseNonalpha:
	opt.min_passphrase_nonalpha = pargs->r.ret_ulong;
	break;
	case oCheckPassphrasePattern:
	opt.check_passphrase_pattern = pargs->r.ret_str;
	break;
	case oMaxPassphraseDays:
	opt.max_passphrase_days = pargs->r.ret_ulong;
	break;
	case oEnablePassphraseHistory:
	opt.enable_passphrase_history = 1;
	break;

	case oIgnoreCacheForSigning: opt.ignore_cache_for_signing = 1; break;

	case oAllowMarkTrusted: opt.allow_mark_trusted = 1; break;
	case oNoAllowMarkTrusted: opt.allow_mark_trusted = 0; break;

	case oAllowPresetPassphrase: opt.allow_preset_passphrase = 1; break;

	case oAllowLoopbackPinentry: opt.allow_loopback_pinentry = 1; break;
	case oNoAllowLoopbackPinentry: opt.allow_loopback_pinentry = 0; break;

	case oNoAllowExternalCache: opt.allow_external_cache = 0;
	break;

	case oAllowEmacsPinentry: opt.allow_emacs_pinentry = 1;
	break;

	default:
	return 0; /* not handled */
	}

	return 1; /* handled */
	}


	/* Fixup some options after all have been processed. */
	static void
	finalize_rereadable_options (void)
	{
	}


	static void
	thread_init_once (void)
	{
	static int npth_initialized = 0;

	if (!npth_initialized)
	{
	npth_initialized++;
	npth_init ();
	}
	gpgrt_set_syscall_clamp (npth_unprotect, npth_protect);
	/* Now that we have set the syscall clamp we need to tell Libgcrypt
	* that it should get them from libgpg-error. Note that Libgcrypt
	* has already been initialized but at that point nPth was not
	* initialized and thus Libgcrypt could not set its system call
	* clamp. */
	#if GCRYPT_VERSION_NUMBER >= 0x010800 /* 1.8.0 */
	gcry_control (GCRYCTL_REINIT_SYSCALL_CLAMP, 0, 0);
	#endif
	}


	static void
	initialize_modules (void)
	{
	thread_init_once ();
	assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);
	initialize_module_cache ();
	initialize_module_call_pinentry ();
	initialize_module_call_scd ();
	initialize_module_trustlist ();
	}


	/* The main entry point. */
	int
	main (int argc, char **argv )
	{
	ARGPARSE_ARGS pargs;
	int orig_argc;
	char **orig_argv;
	FILE *configfp = NULL;
	char *configname = NULL;
	const char *shell;
	unsigned configlineno;
	int parse_debug = 0;
	int default_config =1;
	int pipe_server = 0;
	int is_daemon = 0;
	int nodetach = 0;
	int csh_style = 0;
	char *logfile = NULL;
	int debug_wait = 0;
	int gpgconf_list = 0;
	gpg_error_t err;
	struct assuan_malloc_hooks malloc_hooks;

	early_system_init ();

	/* Before we do anything else we save the list of currently open
	file descriptors and the signal mask. This info is required to
	do the exec call properly. We don't need it on Windows. */
	#ifndef HAVE_W32_SYSTEM
	startup_fd_list = get_all_open_fds ();
	#endif /!HAVE_W32_SYSTEM/
	#ifdef HAVE_SIGPROCMASK
	if (!sigprocmask (SIG_UNBLOCK, NULL, &startup_signal_mask))
	startup_signal_mask_valid = 1;
	#endif /HAVE_SIGPROCMASK/

	/* Set program name etc. */
	set_strusage (my_strusage);
	gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
	/* Please note that we may running SUID(ROOT), so be very CAREFUL
	when adding any stuff between here and the call to INIT_SECMEM()
	somewhere after the option parsing */
	log_set_prefix (GPG_AGENT_NAME, GPGRT_LOG_WITH_PREFIX\|GPGRT_LOG_WITH_PID);

	/* Make sure that our subsystems are ready. */
	i18n_init ();
	init_common_subsystems (&argc, &argv);

	malloc_hooks.malloc = gcry_malloc;
	malloc_hooks.realloc = gcry_realloc;
	malloc_hooks.free = gcry_free;
	assuan_set_malloc_hooks (&malloc_hooks);
	assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
	assuan_sock_init ();
	setup_libassuan_logging (&opt.debug, NULL);

	setup_libgcrypt_logging ();
	gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
	gcry_set_progress_handler (agent_libgcrypt_progress_cb, NULL);

	disable_core_dumps ();

	/* Set default options. */
	parse_rereadable_options (NULL, 0); /* Reset them to default values. */

	shell = getenv ("SHELL");
	if (shell && strlen (shell) >= 3 && !strcmp (shell+strlen (shell)-3, "csh") )
	csh_style = 1;

	/* Record some of the original environment strings. */
	{
	const char *s;
	int idx;
	static const char *names[] =
	{ "DISPLAY", "TERM", "XAUTHORITY", "PINENTRY_USER_DATA", NULL };

	err = 0;
	opt.startup_env = session_env_new ();
	if (!opt.startup_env)
	err = gpg_error_from_syserror ();
	for (idx=0; !err && names[idx]; idx++)
	{
	s = getenv (names[idx]);
	if (s)
	err = session_env_setenv (opt.startup_env, names[idx], s);
	}
	if (!err)
	{
	s = gnupg_ttyname (0);
	if (s)
	err = session_env_setenv (opt.startup_env, "GPG_TTY", s);
	}
	if (err)
	log_fatal ("error recording startup environment: %s\n",
	gpg_strerror (err));

	/* Fixme: Better use the locale function here. */
	opt.startup_lc_ctype = getenv ("LC_CTYPE");
	if (opt.startup_lc_ctype)
	opt.startup_lc_ctype = xstrdup (opt.startup_lc_ctype);
	opt.startup_lc_messages = getenv ("LC_MESSAGES");
	if (opt.startup_lc_messages)
	opt.startup_lc_messages = xstrdup (opt.startup_lc_messages);
	}

	/* Check whether we have a config file on the commandline */
	orig_argc = argc;
	orig_argv = argv;
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= 1\|(1<<6); /* do not remove the args, ignore version */
	while (arg_parse( &pargs, opts))
	{
	if (pargs.r_opt == oDebug \|\| pargs.r_opt == oDebugAll)
	parse_debug++;
	else if (pargs.r_opt == oOptions)
	{ /* yes there is one, so we do not try the default one, but
	read the option file when it is encountered at the
	commandline */
	default_config = 0;
	}
	else if (pargs.r_opt == oNoOptions)
	default_config = 0; /* --no-options */
	else if (pargs.r_opt == oHomedir)
	gnupg_set_homedir (pargs.r.ret_str);
	else if (pargs.r_opt == oDebugQuickRandom)
	{
	gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
	}

	}

	/* Initialize the secure memory. */
	gcry_control (GCRYCTL_INIT_SECMEM, SECMEM_BUFFER_SIZE, 0);
	maybe_setuid = 0;

	/*
	Now we are now working under our real uid
	*/

	if (default_config)
	configname = make_filename (gnupg_homedir (),
	GPG_AGENT_NAME EXTSEP_S "conf", NULL);

	argc = orig_argc;
	argv = orig_argv;
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= 1; /* do not remove the args */
	next_pass:
	if (configname)
	{
	configlineno = 0;
	configfp = fopen (configname, "r");
	if (!configfp)
	{
	if (default_config)
	{
	if( parse_debug )
	log_info (_("Note: no default option file '%s'\n"),
	configname );
	/* Save the default conf file name so that
	reread_configuration is able to test whether the
	config file has been created in the meantime. */
	xfree (config_filename);
	config_filename = configname;
	configname = NULL;
	}
	else
	{
	log_error (_("option file '%s': %s\n"),
	configname, strerror(errno) );
	exit(2);
	}
	xfree (configname);
	configname = NULL;
	}
	if (parse_debug && configname )
	log_info (_("reading options from '%s'\n"), configname );
	default_config = 0;
	}

	while (optfile_parse( configfp, configname, &configlineno, &pargs, opts) )
	{
	if (parse_rereadable_options (&pargs, 0))
	continue; /* Already handled */
	switch (pargs.r_opt)
	{
	case aGPGConfList: gpgconf_list = 1; break;
	case aGPGConfTest: gpgconf_list = 2; break;
	case aUseStandardSocketP: gpgconf_list = 3; break;
	case oBatch: opt.batch=1; break;

	case oDebugWait: debug_wait = pargs.r.ret_int; break;

	case oOptions:
	/* config files may not be nested (silently ignore them) */
	if (!configfp)
	{
	xfree(configname);
	configname = xstrdup(pargs.r.ret_str);
	goto next_pass;
	}
	break;
	case oNoGreeting: /* Dummy option. */ break;
	case oNoVerbose: opt.verbose = 0; break;
	case oNoOptions: break; /* no-options */
	case oHomedir: gnupg_set_homedir (pargs.r.ret_str); break;
	case oNoDetach: nodetach = 1; break;
	case oLogFile: logfile = pargs.r.ret_str; break;
	case oCsh: csh_style = 1; break;
	case oSh: csh_style = 0; break;
	case oServer: pipe_server = 1; break;
	case oDaemon: is_daemon = 1; break;
	case oSupervised: is_supervised = 1; break;

	case oDisplay: default_display = xstrdup (pargs.r.ret_str); break;
	case oTTYname: default_ttyname = xstrdup (pargs.r.ret_str); break;
	case oTTYtype: default_ttytype = xstrdup (pargs.r.ret_str); break;
	case oLCctype: default_lc_ctype = xstrdup (pargs.r.ret_str); break;
	case oLCmessages: default_lc_messages = xstrdup (pargs.r.ret_str);
	break;
	case oXauthority: default_xauthority = xstrdup (pargs.r.ret_str);
	break;

	case oUseStandardSocket:
	case oNoUseStandardSocket:
	obsolete_option (configname, configlineno, "use-standard-socket");
	break;

	case oFakedSystemTime:
	{
	time_t faked_time = isotime2epoch (pargs.r.ret_str);
	if (faked_time == (time_t)(-1))
	faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
	gnupg_set_time (faked_time, 0);
	}
	break;

	case oKeepTTY: opt.keep_tty = 1; break;
	case oKeepDISPLAY: opt.keep_display = 1; break;

	case oSSHSupport:
	ssh_support = 1;
	break;
	case oPuttySupport:
	# ifdef HAVE_W32_SYSTEM
	putty_support = 1;
	# endif
	break;

	case oExtraSocket:
	opt.extra_socket = 1; /* (1 = points into argv) */
	socket_name_extra = pargs.r.ret_str;
	break;

	case oBrowserSocket:
	opt.browser_socket = 1; /* (1 = points into argv) */
	socket_name_browser = pargs.r.ret_str;
	break;

	case oDebugQuickRandom:
	/* Only used by the first stage command line parser. */
	break;

	case oWriteEnvFile:
	obsolete_option (configname, configlineno, "write-env-file");
	break;

	default : pargs.err = configfp? 1:2; break;
	}
	}
	if (configfp)
	{
	fclose( configfp );
	configfp = NULL;
	/* Keep a copy of the name so that it can be read on SIGHUP. */
	if (config_filename != configname)
	{
	xfree (config_filename);
	config_filename = configname;
	}
	configname = NULL;
	goto next_pass;
	}

	xfree (configname);
	configname = NULL;
	if (log_get_errorcount(0))
	exit(2);

	finalize_rereadable_options ();

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (_("Note: '%s' is not considered an option\n"), argv[i]);
	}

	#ifdef ENABLE_NLS
	/* gpg-agent usually does not output any messages because it runs in
	the background. For log files it is acceptable to have messages
	always encoded in utf-8. We switch here to utf-8, so that
	commands like --help still give native messages. It is far
	easier to switch only once instead of for every message and it
	actually helps when more then one thread is active (avoids an
	extra copy step). */
	bind_textdomain_codeset (PACKAGE_GT, "UTF-8");
	#endif

	if (!pipe_server && !is_daemon && !gpgconf_list && !is_supervised)
	{
	/* We have been called without any command and thus we merely
	check whether an agent is already running. We do this right
	here so that we don't clobber a logfile with this check but
	print the status directly to stderr. */
	opt.debug = 0;
	set_debug ();
	check_for_running_agent (0);
	agent_exit (0);
	}

	if (is_supervised)
	;
	else if (!opt.extra_socket)
	opt.extra_socket = 1;
	else if (socket_name_extra
	&& (!strcmp (socket_name_extra, "none")
	\|\| !strcmp (socket_name_extra, "/dev/null")))
	{
	/* User requested not to create this socket. */
	opt.extra_socket = 0;
	socket_name_extra = NULL;
	}

	if (is_supervised)
	;
	else if (!opt.browser_socket)
	opt.browser_socket = 1;
	else if (socket_name_browser
	&& (!strcmp (socket_name_browser, "none")
	\|\| !strcmp (socket_name_browser, "/dev/null")))
	{
	/* User requested not to create this socket. */
	opt.browser_socket = 0;
	socket_name_browser = NULL;
	}

	set_debug ();

	if (atexit (cleanup))
	{
	log_error ("atexit failed\n");
	cleanup ();
	exit (1);
	}

	/* Try to create missing directories. */
	create_directories ();

	if (debug_wait && pipe_server)
	{
	thread_init_once ();
	log_debug ("waiting for debugger - my pid is %u .....\n",
	(unsigned int)getpid());
	gnupg_sleep (debug_wait);
	log_debug ("... okay\n");
	}

	if (gpgconf_list == 3)
	{
	/* We now use the standard socket always - return true for
	backward compatibility. */
	agent_exit (0);
	}
	else if (gpgconf_list == 2)
	agent_exit (0);
	else if (gpgconf_list)
	{
	char *filename;
	char *filename_esc;

	/* List options and default values in the GPG Conf format. */
	filename = make_filename (gnupg_homedir (),
	GPG_AGENT_NAME EXTSEP_S "conf", NULL);
	filename_esc = percent_escape (filename, NULL);

	es_printf ("%s-%s.conf:%lu:\"%s\n",
	GPGCONF_NAME, GPG_AGENT_NAME,
	GC_OPT_FLAG_DEFAULT, filename_esc);
	xfree (filename);
	xfree (filename_esc);

	es_printf ("verbose:%lu:\n"
	"quiet:%lu:\n"
	"debug-level:%lu:\"none:\n"
	"log-file:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME,
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME,
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME,
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME );
	es_printf ("default-cache-ttl:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME, DEFAULT_CACHE_TTL );
	es_printf ("default-cache-ttl-ssh:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME, DEFAULT_CACHE_TTL_SSH );
	es_printf ("max-cache-ttl:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME, MAX_CACHE_TTL );
	es_printf ("max-cache-ttl-ssh:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME, MAX_CACHE_TTL_SSH );
	es_printf ("enforce-passphrase-constraints:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("min-passphrase-len:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME, MIN_PASSPHRASE_LEN );
	es_printf ("min-passphrase-nonalpha:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME,
	MIN_PASSPHRASE_NONALPHA);
	es_printf ("check-passphrase-pattern:%lu:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME);
	es_printf ("max-passphrase-days:%lu:%d:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME,
	MAX_PASSPHRASE_DAYS);
	es_printf ("enable-passphrase-history:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("no-grab:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("ignore-cache-for-signing:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("no-allow-external-cache:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("no-allow-mark-trusted:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("disable-scdaemon:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("enable-ssh-support:%lu:\n", GC_OPT_FLAG_NONE);
	#ifdef HAVE_W32_SYSTEM
	es_printf ("enable-putty-support:%lu:\n", GC_OPT_FLAG_NONE);
	#endif
	es_printf ("no-allow-loopback-pinentry:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("allow-emacs-pinentry:%lu:\n",
	GC_OPT_FLAG_NONE\|GC_OPT_FLAG_RUNTIME);
	es_printf ("pinentry-timeout:%lu:0:\n",
	GC_OPT_FLAG_DEFAULT\|GC_OPT_FLAG_RUNTIME);

	agent_exit (0);
	}

	/* Now start with logging to a file if this is desired. */
	if (logfile)
	{
	log_set_file (logfile);
	log_set_prefix (NULL, (GPGRT_LOG_WITH_PREFIX
	\| GPGRT_LOG_WITH_TIME
	\| GPGRT_LOG_WITH_PID));
	current_logfile = xstrdup (logfile);
	}

	/* Make sure that we have a default ttyname. */
	if (!default_ttyname && gnupg_ttyname (1))
	default_ttyname = xstrdup (gnupg_ttyname (1));
	if (!default_ttytype && getenv ("TERM"))
	default_ttytype = xstrdup (getenv ("TERM"));


	if (pipe_server)
	{
	/* This is the simple pipe based server */
	ctrl_t ctrl;

	initialize_modules ();

	ctrl = xtrycalloc (1, sizeof *ctrl);
	if (!ctrl)
	{
	log_error ("error allocating connection control data: %s\n",
	strerror (errno) );
	agent_exit (1);
	}
	ctrl->session_env = session_env_new ();
	if (!ctrl->session_env)
	{
	log_error ("error allocating session environment block: %s\n",
	strerror (errno) );
	xfree (ctrl);
	agent_exit (1);
	}
	agent_init_default_ctrl (ctrl);
	start_command_handler (ctrl, GNUPG_INVALID_FD, GNUPG_INVALID_FD);
	agent_deinit_default_ctrl (ctrl);
	xfree (ctrl);
	}
	else if (is_supervised)
	{
	#ifndef HAVE_W32_SYSTEM
	gnupg_fd_t fd, fd_extra, fd_browser, fd_ssh;

	initialize_modules ();

	/* when supervised and sending logs to stderr, the process
	supervisor should handle log entry metadata (pid, name,
	timestamp) */
	if (!logfile)
	log_set_prefix (NULL, 0);

	log_info ("%s %s starting in supervised mode.\n",
	strusage(11), strusage(13) );

	/* See below in "regular server mode" on why we remove certain
	* envvars. */
	if (!opt.keep_display)
	gnupg_unsetenv ("DISPLAY");
	gnupg_unsetenv ("INSIDE_EMACS");

	/* Virtually create the sockets. Note that we use -1 here
	* because the whole thing works only on Unix. */
	map_supervised_sockets (&fd, &fd_extra, &fd_browser, &fd_ssh);
	if (fd == -1)
	log_fatal ("no standard socket provided\n");

	#ifdef HAVE_SIGPROCMASK
	if (startup_signal_mask_valid)
	{
	if (sigprocmask (SIG_SETMASK, &startup_signal_mask, NULL))
	log_error ("error restoring signal mask: %s\n",
	strerror (errno));
	}
	else
	log_info ("no saved signal mask\n");
	#endif /HAVE_SIGPROCMASK/

	log_info ("listening on: std=%d extra=%d browser=%d ssh=%d\n",
	fd, fd_extra, fd_browser, fd_ssh);
	handle_connections (fd, fd_extra, fd_browser, fd_ssh);
	#endif /!HAVE_W32_SYSTEM/
	}
	else if (!is_daemon)
	; /* NOTREACHED */
	else
	{ /* Regular server mode */
	gnupg_fd_t fd;
	gnupg_fd_t fd_extra = GNUPG_INVALID_FD;
	gnupg_fd_t fd_browser = GNUPG_INVALID_FD;
	gnupg_fd_t fd_ssh = GNUPG_INVALID_FD;
	#ifndef HAVE_W32_SYSTEM
	pid_t pid;
	#endif

	/* Remove the DISPLAY variable so that a pinentry does not
	default to a specific display. There is still a default
	display when gpg-agent was started using --display or a
	client requested this using an OPTION command. Note, that we
	don't do this when running in reverse daemon mode (i.e. when
	exec the program given as arguments). */
	#ifndef HAVE_W32_SYSTEM
	if (!opt.keep_display && !argc)
	gnupg_unsetenv ("DISPLAY");
	#endif

	/* Remove the INSIDE_EMACS variable so that a pinentry does not
	always try to interact with Emacs. The variable is set when
	a client requested this using an OPTION command. */
	gnupg_unsetenv ("INSIDE_EMACS");

	/* Create the sockets. */
	socket_name = create_socket_name (GPG_AGENT_SOCK_NAME, 1);
	fd = create_server_socket (socket_name, 1, 0,
	&redir_socket_name, &socket_nonce);

	if (opt.extra_socket)
	{
	if (socket_name_extra)
	socket_name_extra = create_socket_name (socket_name_extra, 0);
	else
	socket_name_extra = create_socket_name
	/**/ (GPG_AGENT_EXTRA_SOCK_NAME, 1);
	opt.extra_socket = 2; /* Indicate that it has been malloced. */
	fd_extra = create_server_socket (socket_name_extra, 0, 0,
	&redir_socket_name_extra,
	&socket_nonce_extra);
	}

	if (opt.browser_socket)
	{
	if (socket_name_browser)
	socket_name_browser = create_socket_name (socket_name_browser, 0);
	else
	socket_name_browser= create_socket_name
	/**/ (GPG_AGENT_BROWSER_SOCK_NAME, 1);
	opt.browser_socket = 2; /* Indicate that it has been malloced. */
	fd_browser = create_server_socket (socket_name_browser, 0, 0,
	&redir_socket_name_browser,
	&socket_nonce_browser);
	}

	socket_name_ssh = create_socket_name (GPG_AGENT_SSH_SOCK_NAME, 1);
	fd_ssh = create_server_socket (socket_name_ssh, 0, 1,
	&redir_socket_name_ssh,
	&socket_nonce_ssh);

	/* If we are going to exec a program in the parent, we record
	the PID, so that the child may check whether the program is
	still alive. */
	if (argc)
	parent_pid = getpid ();

	fflush (NULL);

	#ifdef HAVE_W32_SYSTEM

	(void)csh_style;
	(void)nodetach;
	initialize_modules ();

	#else /!HAVE_W32_SYSTEM/

	pid = fork ();
	if (pid == (pid_t)-1)
	{
	log_fatal ("fork failed: %s\n", strerror (errno) );
	exit (1);
	}
	else if (pid)
	{ /* We are the parent */
	char infostr_ssh_sock, infostr_ssh_valid;

	/* Close the socket FD. */
	close (fd);

	/* The signal mask might not be correct right now and thus
	we restore it. That is not strictly necessary but some
	programs falsely assume a cleared signal mask. */

	#ifdef HAVE_SIGPROCMASK
	if (startup_signal_mask_valid)
	{
	if (sigprocmask (SIG_SETMASK, &startup_signal_mask, NULL))
	log_error ("error restoring signal mask: %s\n",
	strerror (errno));
	}
	else
	log_info ("no saved signal mask\n");
	#endif /HAVE_SIGPROCMASK/

	/* Create the SSH info string if enabled. */
	if (ssh_support)
	{
	if (asprintf (&infostr_ssh_sock, "SSH_AUTH_SOCK=%s",
	socket_name_ssh) < 0)
	{
	log_error ("out of core\n");
	kill (pid, SIGTERM);
	exit (1);
	}
	if (asprintf (&infostr_ssh_valid, "gnupg_SSH_AUTH_SOCK_by=%lu",
	(unsigned long)getpid()) < 0)
	{
	log_error ("out of core\n");
	kill (pid, SIGTERM);
	exit (1);
	}
	}

	socket_name = 0; / Don't let cleanup() remove the socket -
	the child should do this from now on */
	if (opt.extra_socket)
	*socket_name_extra = 0;
	if (opt.browser_socket)
	*socket_name_browser = 0;
	*socket_name_ssh = 0;

	if (argc)
	{ /* Run the program given on the commandline. */
	if (ssh_support && (putenv (infostr_ssh_sock)
	\|\| putenv (infostr_ssh_valid)))
	{
	log_error ("failed to set environment: %s\n",
	strerror (errno) );
	kill (pid, SIGTERM );
	exit (1);
	}

	/* Close all the file descriptors except the standard
	ones and those open at startup. We explicitly don't
	close 0,1,2 in case something went wrong collecting
	them at startup. */
	close_all_fds (3, startup_fd_list);

	/* Run the command. */
	execvp (argv[0], argv);
	log_error ("failed to run the command: %s\n", strerror (errno));
	kill (pid, SIGTERM);
	exit (1);
	}
	else
	{
	/* Print the environment string, so that the caller can use
	shell's eval to set it */
	if (csh_style)
	{
	if (ssh_support)
	{
	*strchr (infostr_ssh_sock, '=') = ' ';
	es_printf ("setenv %s;\n", infostr_ssh_sock);
	}
	}
	else
	{
	if (ssh_support)
	{
	es_printf ("%s; export SSH_AUTH_SOCK;\n",
	infostr_ssh_sock);
	}
	}
	if (ssh_support)
	{
	xfree (infostr_ssh_sock);
	xfree (infostr_ssh_valid);
	}
	exit (0);
	}
	/NOTREACHED/
	} /* End parent */

	/*
	This is the child
	*/

	initialize_modules ();

	/* Detach from tty and put process into a new session */
	if (!nodetach )
	{
	int i;
	unsigned int oldflags;

	/* Close stdin, stdout and stderr unless it is the log stream */
	for (i=0; i <= 2; i++)
	{
	if (!log_test_fd (i) && i != fd )
	{
	if ( ! close (i)
	&& open ("/dev/null", i? O_WRONLY : O_RDONLY) == -1)
	{
	log_error ("failed to open '%s': %s\n",
	"/dev/null", strerror (errno));
	cleanup ();
	exit (1);
	}
	}
	}
	if (setsid() == -1)
	{
	log_error ("setsid() failed: %s\n", strerror(errno) );
	cleanup ();
	exit (1);
	}

	log_get_prefix (&oldflags);
	log_set_prefix (NULL, oldflags \| GPGRT_LOG_RUN_DETACHED);
	opt.running_detached = 1;
	}

	if (chdir("/"))
	{
	log_error ("chdir to / failed: %s\n", strerror (errno));
	exit (1);
	}

	{
	struct sigaction sa;

	sa.sa_handler = SIG_IGN;
	sigemptyset (&sa.sa_mask);
	sa.sa_flags = 0;
	sigaction (SIGPIPE, &sa, NULL);
	}
	#endif /!HAVE_W32_SYSTEM/

	log_info ("%s %s started\n", strusage(11), strusage(13) );
	handle_connections (fd, fd_extra, fd_browser, fd_ssh);
	assuan_sock_close (fd);
	}

	return 0;
	}


	/* Exit entry point. This function should be called instead of a
	plain exit. */
	void
	agent_exit (int rc)
	{
	/FIXME: update_random_seed_file();/

	/* We run our cleanup handler because that may close cipher contexts
	stored in secure memory and thus this needs to be done before we
	explicitly terminate secure memory. */
	cleanup ();

	#if 1
	/* at this time a bit annoying */
	if (opt.debug & DBG_MEMSTAT_VALUE)
	{
	gcry_control( GCRYCTL_DUMP_MEMORY_STATS );
	gcry_control( GCRYCTL_DUMP_RANDOM_STATS );
	}
	if (opt.debug)
	gcry_control (GCRYCTL_DUMP_SECMEM_STATS );
	#endif
	gcry_control (GCRYCTL_TERM_SECMEM );
	rc = rc? rc : log_get_errorcount(0)? 2 : 0;
	exit (rc);
	}


	/* This is our callback function for gcrypt progress messages. It is
	set once at startup and dispatches progress messages to the
	corresponding threads of the agent. */
	static void
	agent_libgcrypt_progress_cb (void data, const char what, int printchar,
	int current, int total)
	{
	struct progress_dispatch_s *dispatch;
	npth_t mytid = npth_self ();

	(void)data;

	for (dispatch = progress_dispatch_list; dispatch; dispatch = dispatch->next)
	if (dispatch->ctrl && dispatch->tid == mytid)
	break;
	if (dispatch && dispatch->cb)
	dispatch->cb (dispatch->ctrl, what, printchar, current, total);

	/* Libgcrypt < 1.8 does not know about nPth and thus when it reads
	* from /dev/random this will block the process. To mitigate this
	* problem we yield the thread when Libgcrypt tells us that it needs
	* more entropy. This way other threads have chance to run. */
	#if GCRYPT_VERSION_NUMBER < 0x010800 /* 1.8.0 */
	if (what && !strcmp (what, "need_entropy"))
	{
	#if GPGRT_VERSION_NUMBER < 0x011900 /* 1.25 */
	/* In older gpg-error versions gpgrt_yield is buggy for use with
	* nPth and thus we need to resort to a sleep call. */
	npth_usleep (1000); /* 1ms */
	#else
	gpgrt_yield ();
	#endif
	}
	#endif
	}


	/* If a progress dispatcher callback has been associated with the
	* current connection unregister it. */
	static void
	unregister_progress_cb (void)
	{
	struct progress_dispatch_s *dispatch;
	npth_t mytid = npth_self ();

	for (dispatch = progress_dispatch_list; dispatch; dispatch = dispatch->next)
	if (dispatch->ctrl && dispatch->tid == mytid)
	break;
	if (dispatch)
	{
	dispatch->ctrl = NULL;
	dispatch->cb = NULL;
	}
	}


	/* Setup a progress callback CB for the current connection. Using a
	* CB of NULL disables the callback. */
	void
	agent_set_progress_cb (void (cb)(ctrl_t ctrl, const char what,
	int printchar, int current, int total),
	ctrl_t ctrl)
	{
	struct progress_dispatch_s dispatch, firstfree;
	npth_t mytid = npth_self ();

	firstfree = NULL;
	for (dispatch = progress_dispatch_list; dispatch; dispatch = dispatch->next)
	{
	if (dispatch->ctrl && dispatch->tid == mytid)
	break;
	if (!dispatch->ctrl && !firstfree)
	firstfree = dispatch;
	}
	if (!dispatch) /* None allocated: Reuse or allocate a new one. */
	{
	if (firstfree)
	{
	dispatch = firstfree;
	}
	else if ((dispatch = xtrycalloc (1, sizeof *dispatch)))
	{
	dispatch->next = progress_dispatch_list;
	progress_dispatch_list = dispatch;
	}
	else
	{
	log_error ("error allocating new progress dispatcher slot: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	return;
	}
	dispatch->ctrl = ctrl;
	dispatch->tid = mytid;
	}

	dispatch->cb = cb;
	}


	/* Each thread has its own local variables conveyed by a control
	structure usually identified by an argument named CTRL. This
	function is called immediately after allocating the control
	structure. Its purpose is to setup the default values for that
	structure. Note that some values may have already been set. */
	static void
	agent_init_default_ctrl (ctrl_t ctrl)
	{
	assert (ctrl->session_env);

	/* Note we ignore malloc errors because we can't do much about it
	and the request will fail anyway shortly after this
	initialization. */
	session_env_setenv (ctrl->session_env, "DISPLAY", default_display);
	session_env_setenv (ctrl->session_env, "GPG_TTY", default_ttyname);
	session_env_setenv (ctrl->session_env, "TERM", default_ttytype);
	session_env_setenv (ctrl->session_env, "XAUTHORITY", default_xauthority);
	session_env_setenv (ctrl->session_env, "PINENTRY_USER_DATA", NULL);

	if (ctrl->lc_ctype)
	xfree (ctrl->lc_ctype);
	ctrl->lc_ctype = default_lc_ctype? xtrystrdup (default_lc_ctype) : NULL;

	if (ctrl->lc_messages)
	xfree (ctrl->lc_messages);
	ctrl->lc_messages = default_lc_messages? xtrystrdup (default_lc_messages)
	/**/ : NULL;
	ctrl->cache_ttl_opt_preset = CACHE_TTL_OPT_PRESET;
	}


	/* Release all resources allocated by default in the control
	structure. This is the counterpart to agent_init_default_ctrl. */
	static void
	agent_deinit_default_ctrl (ctrl_t ctrl)
	{
	unregister_progress_cb ();
	session_env_release (ctrl->session_env);

	if (ctrl->lc_ctype)
	xfree (ctrl->lc_ctype);
	if (ctrl->lc_messages)
	xfree (ctrl->lc_messages);
	}


	/* Because the ssh protocol does not send us information about the
	current TTY setting, we use this function to use those from startup
	or those explicitly set. This is also used for the restricted mode
	where we ignore requests to change the environment. */
	gpg_error_t
	agent_copy_startup_env (ctrl_t ctrl)
	{
	static const char *names[] =
	{"GPG_TTY", "DISPLAY", "TERM", "XAUTHORITY", "PINENTRY_USER_DATA", NULL};
	gpg_error_t err = 0;
	int idx;
	const char *value;

	for (idx=0; !err && names[idx]; idx++)
	if ((value = session_env_getenv (opt.startup_env, names[idx])))
	err = session_env_setenv (ctrl->session_env, names[idx], value);

	if (!err && !ctrl->lc_ctype && opt.startup_lc_ctype)
	if (!(ctrl->lc_ctype = xtrystrdup (opt.startup_lc_ctype)))
	err = gpg_error_from_syserror ();

	if (!err && !ctrl->lc_messages && opt.startup_lc_messages)
	if (!(ctrl->lc_messages = xtrystrdup (opt.startup_lc_messages)))
	err = gpg_error_from_syserror ();

	if (err)
	log_error ("error setting default session environment: %s\n",
	gpg_strerror (err));

	return err;
	}


	/* Reread parts of the configuration. Note, that this function is
	obviously not thread-safe and should only be called from the PTH
	signal handler.

	Fixme: Due to the way the argument parsing works, we create a
	memory leak here for all string type arguments. There is currently
	no clean way to tell whether the memory for the argument has been
	allocated or points into the process' original arguments. Unless
	we have a mechanism to tell this, we need to live on with this. */
	static void
	reread_configuration (void)
	{
	ARGPARSE_ARGS pargs;
	FILE *fp;
	unsigned int configlineno = 0;
	int dummy;

	if (!config_filename)
	return; /* No config file. */

	fp = fopen (config_filename, "r");
	if (!fp)
	{
	log_info (_("option file '%s': %s\n"),
	config_filename, strerror(errno) );
	return;
	}

	parse_rereadable_options (NULL, 1); /* Start from the default values. */

	memset (&pargs, 0, sizeof pargs);
	dummy = 0;
	pargs.argc = &dummy;
	pargs.flags = 1; /* do not remove the args */
	while (optfile_parse (fp, config_filename, &configlineno, &pargs, opts) )
	{
	if (pargs.r_opt < -1)
	pargs.err = 1; /* Print a warning. */
	else /* Try to parse this option - ignore unchangeable ones. */
	parse_rereadable_options (&pargs, 1);
	}
	fclose (fp);
	finalize_rereadable_options ();
	set_debug ();
	}


	/* Return the file name of the socket we are using for native
	requests. */
	const char *
	get_agent_socket_name (void)
	{
	const char *s = socket_name;

	return (s && *s)? s : NULL;
	}

	/* Return the file name of the socket we are using for SSH
	requests. */
	const char *
	get_agent_ssh_socket_name (void)
	{
	const char *s = socket_name_ssh;

	return (s && *s)? s : NULL;
	}


	/* Return the number of active connections. */
	int
	get_agent_active_connection_count (void)
	{
	return active_connections;
	}


	/* Under W32, this function returns the handle of the scdaemon
	notification event. Calling it the first time creates that
	event. */
	#if defined(HAVE_W32_SYSTEM) && !defined(HAVE_W32CE_SYSTEM)
	void *
	get_agent_scd_notify_event (void)
	{
	static HANDLE the_event = INVALID_HANDLE_VALUE;

	if (the_event == INVALID_HANDLE_VALUE)
	{
	HANDLE h, h2;
	SECURITY_ATTRIBUTES sa = { sizeof (SECURITY_ATTRIBUTES), NULL, TRUE};

	/* We need to use a manual reset event object due to the way our
	w32-pth wait function works: If we would use an automatic
	reset event we are not able to figure out which handle has
	been signaled because at the time we single out the signaled
	handles using WFSO the event has already been reset due to
	the WFMO. */
	h = CreateEvent (&sa, TRUE, FALSE, NULL);
	if (!h)
	log_error ("can't create scd notify event: %s\n", w32_strerror (-1) );
	else if (!DuplicateHandle (GetCurrentProcess(), h,
	GetCurrentProcess(), &h2,
	EVENT_MODIFY_STATE\|SYNCHRONIZE, TRUE, 0))
	{
	log_error ("setting syncronize for scd notify event failed: %s\n",
	w32_strerror (-1) );
	CloseHandle (h);
	}
	else
	{
	CloseHandle (h);
	the_event = h2;
	}
	}

	return the_event;
	}
	#endif /HAVE_W32_SYSTEM && !HAVE_W32CE_SYSTEM/



	/* Create a name for the socket in the home directory as using
	STANDARD_NAME. We also check for valid characters as well as
	against a maximum allowed length for a unix domain socket is done.
	The function terminates the process in case of an error. Returns:
	Pointer to an allocated string with the absolute name of the socket
	used. */
	static char *
	create_socket_name (char *standard_name, int with_homedir)
	{
	char *name;

	if (with_homedir)
	name = make_filename (gnupg_socketdir (), standard_name, NULL);
	else
	name = make_filename (standard_name, NULL);
	if (strchr (name, PATHSEP_C))
	{
	log_error (("'%s' are not allowed in the socket name\n"), PATHSEP_S);
	agent_exit (2);
	}
	return name;
	}



	/* Create a Unix domain socket with NAME. Returns the file descriptor
	or terminates the process in case of an error. Note that this
	function needs to be used for the regular socket first (indicated
	by PRIMARY) and only then for the extra and the ssh sockets. If
	the socket has been redirected the name of the real socket is
	stored as a malloced string at R_REDIR_NAME. If CYGWIN is set a
	Cygwin compatible socket is created (Windows only). */
	static gnupg_fd_t
	create_server_socket (char *name, int primary, int cygwin,
	char *r_redir_name, assuan_sock_nonce_t nonce)
	{
	struct sockaddr *addr;
	struct sockaddr_un *unaddr;
	socklen_t len;
	gnupg_fd_t fd;
	int rc;

	xfree (*r_redir_name);
	*r_redir_name = NULL;

	fd = assuan_sock_new (AF_UNIX, SOCK_STREAM, 0);
	if (fd == ASSUAN_INVALID_FD)
	{
	log_error (_("can't create socket: %s\n"), strerror (errno));
	name = 0; / Inhibit removal of the socket by cleanup(). */
	agent_exit (2);
	}

	if (cygwin)
	assuan_sock_set_flag (fd, "cygwin", 1);

	unaddr = xmalloc (sizeof *unaddr);
	addr = (struct sockaddr*)unaddr;

	{
	int redirected;

	if (assuan_sock_set_sockaddr_un (name, addr, &redirected))
	{
	if (errno == ENAMETOOLONG)
	log_error (_("socket name '%s' is too long\n"), name);
	else
	log_error ("error preparing socket '%s': %s\n",
	name, gpg_strerror (gpg_error_from_syserror ()));
	name = 0; / Inhibit removal of the socket by cleanup(). */
	agent_exit (2);
	}
	if (redirected)
	{
	*r_redir_name = xstrdup (unaddr->sun_path);
	if (opt.verbose)
	log_info ("redirecting socket '%s' to '%s'\n", name, *r_redir_name);
	}
	}

	len = SUN_LEN (unaddr);
	rc = assuan_sock_bind (fd, addr, len);

	/* Our error code mapping on W32CE returns EEXIST thus we also test
	for this. */
	if (rc == -1
	&& (errno == EADDRINUSE
	#ifdef HAVE_W32_SYSTEM
	\|\| errno == EEXIST
	#endif
	))
	{
	/* Check whether a gpg-agent is already running. We do this
	test only if this is the primary socket. For secondary
	sockets we assume that a test for gpg-agent has already been
	done and reuse the requested socket. Testing the ssh-socket
	is not possible because at this point, though we know the new
	Assuan socket, the Assuan server and thus the ssh-agent
	server is not yet operational; this would lead to a hang. */
	if (primary && !check_for_running_agent (1))
	{
	log_set_prefix (NULL, GPGRT_LOG_WITH_PREFIX);
	log_set_file (NULL);
	log_error (_("a gpg-agent is already running - "
	"not starting a new one\n"));
	name = 0; / Inhibit removal of the socket by cleanup(). */
	assuan_sock_close (fd);
	agent_exit (2);
	}
	gnupg_remove (unaddr->sun_path);
	rc = assuan_sock_bind (fd, addr, len);
	}
	if (rc != -1 && (rc=assuan_sock_get_nonce (addr, len, nonce)))
	log_error (_("error getting nonce for the socket\n"));
	if (rc == -1)
	{
	/* We use gpg_strerror here because it allows us to get strings
	for some W32 socket error codes. */
	log_error (_("error binding socket to '%s': %s\n"),
	unaddr->sun_path,
	gpg_strerror (gpg_error_from_syserror ()));

	assuan_sock_close (fd);
	name = 0; / Inhibit removal of the socket by cleanup(). */
	agent_exit (2);
	}

	if (gnupg_chmod (unaddr->sun_path, "-rwx"))
	log_error (_("can't set permissions of '%s': %s\n"),
	unaddr->sun_path, strerror (errno));

	if (listen (FD2INT(fd), 5 ) == -1)
	{
	log_error (_("listen() failed: %s\n"), strerror (errno));
	name = 0; / Inhibit removal of the socket by cleanup(). */
	assuan_sock_close (fd);
	agent_exit (2);
	}

	if (opt.verbose)
	log_info (_("listening on socket '%s'\n"), unaddr->sun_path);

	return fd;
	}


	/* Check that the directory for storing the private keys exists and
	create it if not. This function won't fail as it is only a
	convenience function and not strictly necessary. */
	static void
	create_private_keys_directory (const char *home)
	{
	char *fname;
	struct stat statbuf;

	fname = make_filename (home, GNUPG_PRIVATE_KEYS_DIR, NULL);
	if (stat (fname, &statbuf) && errno == ENOENT)
	{
	if (gnupg_mkdir (fname, "-rwx"))
	log_error (_("can't create directory '%s': %s\n"),
	fname, strerror (errno) );
	else if (!opt.quiet)
	log_info (_("directory '%s' created\n"), fname);
	}
	if (gnupg_chmod (fname, "-rwx"))
	log_error (_("can't set permissions of '%s': %s\n"),
	fname, strerror (errno));
	xfree (fname);
	}


	/* Create the directory only if the supplied directory name is the
	same as the default one. This way we avoid to create arbitrary
	directories when a non-default home directory is used. To cope
	with HOME, we compare only the suffix if we see that the default
	homedir does start with a tilde. We don't stop here in case of
	problems because other functions will throw an error anyway.*/
	static void
	create_directories (void)
	{
	struct stat statbuf;
	const char *defhome = standard_homedir ();
	char *home;

	home = make_filename (gnupg_homedir (), NULL);
	if ( stat (home, &statbuf) )
	{
	if (errno == ENOENT)
	{
	if (
	#ifdef HAVE_W32_SYSTEM
	( !compare_filenames (home, defhome) )
	#else
	(*defhome == '~'
	&& (strlen (home) >= strlen (defhome+1)
	&& !strcmp (home + strlen(home)
	- strlen (defhome+1), defhome+1)))
	\|\| (*defhome != '~' && !strcmp (home, defhome) )
	#endif
	)
	{
	if (gnupg_mkdir (home, "-rwx"))
	log_error (_("can't create directory '%s': %s\n"),
	home, strerror (errno) );
	else
	{
	if (!opt.quiet)
	log_info (_("directory '%s' created\n"), home);
	create_private_keys_directory (home);
	}
	}
	}
	else
	log_error (_("stat() failed for '%s': %s\n"), home, strerror (errno));
	}
	else if ( !S_ISDIR(statbuf.st_mode))
	{
	log_error (_("can't use '%s' as home directory\n"), home);
	}
	else /* exists and is a directory. */
	{
	create_private_keys_directory (home);
	}
	xfree (home);
	}



	/* This is the worker for the ticker. It is called every few seconds
	and may only do fast operations. */
	static void
	handle_tick (void)
	{
	static time_t last_minute;

	if (!last_minute)
	last_minute = time (NULL);

	/* Check whether the scdaemon has died and cleanup in this case. */
	agent_scd_check_aliveness ();

	/* If we are running as a child of another process, check whether
	the parent is still alive and shutdown if not. */
	#ifndef HAVE_W32_SYSTEM
	if (parent_pid != (pid_t)(-1))
	{
	if (kill (parent_pid, 0))
	{
	shutdown_pending = 2;
	log_info ("parent process died - shutting down\n");
	log_info ("%s %s stopped\n", strusage(11), strusage(13) );
	cleanup ();
	agent_exit (0);
	}
	}
	#endif /HAVE_W32_SYSTEM/

	/* Code to be run from time to time. */
	#if CHECK_OWN_SOCKET_INTERVAL > 0
	if (last_minute + CHECK_OWN_SOCKET_INTERVAL <= time (NULL))
	{
	check_own_socket ();
	last_minute = time (NULL);
	}
	#endif

	}


	/* A global function which allows us to call the reload stuff from
	other places too. This is only used when build for W32. */
	void
	agent_sighup_action (void)
	{
	log_info ("SIGHUP received - "
	"re-reading configuration and flushing cache\n");

	agent_flush_cache ();
	reread_configuration ();
	agent_reload_trustlist ();
	/* We flush the module name cache so that after installing a
	"pinentry" binary that one can be used in case the
	"pinentry-basic" fallback was in use. */
	gnupg_module_name_flush_some ();
	}


	/* A helper function to handle SIGUSR2. */
	static void
	agent_sigusr2_action (void)
	{
	if (opt.verbose)
	log_info ("SIGUSR2 received - updating card event counter\n");
	/* Nothing to check right now. We only increment a counter. */
	bump_card_eventcounter ();
	}


	#ifndef HAVE_W32_SYSTEM
	/* The signal handler for this program. It is expected to be run in
	its own trhead and not in the context of a signal handler. */
	static void
	handle_signal (int signo)
	{
	switch (signo)
	{
	#ifndef HAVE_W32_SYSTEM
	case SIGHUP:
	agent_sighup_action ();
	break;

	case SIGUSR1:
	log_info ("SIGUSR1 received - printing internal information:\n");
	/* Fixme: We need to see how to integrate pth dumping into our
	logging system. */
	/* pth_ctrl (PTH_CTRL_DUMPSTATE, log_get_stream ()); */
	agent_query_dump_state ();
	agent_scd_dump_state ();
	break;

	case SIGUSR2:
	agent_sigusr2_action ();
	break;

	case SIGTERM:
	if (!shutdown_pending)
	log_info ("SIGTERM received - shutting down ...\n");
	else
	log_info ("SIGTERM received - still %i open connections\n",
	active_connections);
	shutdown_pending++;
	if (shutdown_pending > 2)
	{
	log_info ("shutdown forced\n");
	log_info ("%s %s stopped\n", strusage(11), strusage(13) );
	cleanup ();
	agent_exit (0);
	}
	break;

	case SIGINT:
	log_info ("SIGINT received - immediate shutdown\n");
	log_info( "%s %s stopped\n", strusage(11), strusage(13));
	cleanup ();
	agent_exit (0);
	break;
	#endif
	default:
	log_info ("signal %d received - no action defined\n", signo);
	}
	}
	#endif

	-/* Check the nonce on a new connection. This is a NOP unless we we
	+/* Check the nonce on a new connection. This is a NOP unless we
	are using our Unix domain socket emulation under Windows. */
	static int
	check_nonce (ctrl_t ctrl, assuan_sock_nonce_t *nonce)
	{
	if (assuan_sock_check_nonce (ctrl->thread_startup.fd, nonce))
	{
	log_info (_("error reading nonce on fd %d: %s\n"),
	FD2INT(ctrl->thread_startup.fd), strerror (errno));
	assuan_sock_close (ctrl->thread_startup.fd);
	xfree (ctrl);
	return -1;
	}
	else
	return 0;
	}


	#ifdef HAVE_W32_SYSTEM
	/* The window message processing function for Putty. Warning: This
	code runs as a native Windows thread. Use of our own functions
	needs to be bracket with pth_leave/pth_enter. */
	static LRESULT CALLBACK
	putty_message_proc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam)
	{
	int ret = 0;
	int w32rc;
	COPYDATASTRUCT *cds;
	const char *mapfile;
	HANDLE maphd;
	PSID mysid = NULL;
	PSID mapsid = NULL;
	void *data = NULL;
	PSECURITY_DESCRIPTOR psd = NULL;
	ctrl_t ctrl = NULL;

	if (msg != WM_COPYDATA)
	{
	return DefWindowProc (hwnd, msg, wparam, lparam);
	}

	cds = (COPYDATASTRUCT*)lparam;
	if (cds->dwData != PUTTY_IPC_MAGIC)
	return 0; /* Ignore data with the wrong magic. */
	mapfile = cds->lpData;
	if (!cds->cbData \|\| mapfile[cds->cbData - 1])
	return 0; /* Ignore empty and non-properly terminated strings. */

	if (DBG_IPC)
	{
	npth_protect ();
	log_debug ("ssh map file '%s'", mapfile);
	npth_unprotect ();
	}

	maphd = OpenFileMapping (FILE_MAP_ALL_ACCESS, FALSE, mapfile);
	if (DBG_IPC)
	{
	npth_protect ();
	log_debug ("ssh map handle %p\n", maphd);
	npth_unprotect ();
	}

	if (!maphd \|\| maphd == INVALID_HANDLE_VALUE)
	return 0;

	npth_protect ();

	mysid = w32_get_user_sid ();
	if (!mysid)
	{
	log_error ("error getting my sid\n");
	goto leave;
	}

	w32rc = GetSecurityInfo (maphd, SE_KERNEL_OBJECT,
	OWNER_SECURITY_INFORMATION,
	&mapsid, NULL, NULL, NULL,
	&psd);
	if (w32rc)
	{
	log_error ("error getting sid of ssh map file: rc=%d", w32rc);
	goto leave;
	}

	if (DBG_IPC)
	{
	char *sidstr;

	if (!ConvertSidToStringSid (mysid, &sidstr))
	sidstr = NULL;
	log_debug (" my sid: '%s'", sidstr? sidstr: "[error]");
	LocalFree (sidstr);
	if (!ConvertSidToStringSid (mapsid, &sidstr))
	sidstr = NULL;
	log_debug ("ssh map file sid: '%s'", sidstr? sidstr: "[error]");
	LocalFree (sidstr);
	}

	if (!EqualSid (mysid, mapsid))
	{
	log_error ("ssh map file has a non-matching sid\n");
	goto leave;
	}

	data = MapViewOfFile (maphd, FILE_MAP_ALL_ACCESS, 0, 0, 0);
	if (DBG_IPC)
	log_debug ("ssh IPC buffer at %p\n", data);
	if (!data)
	goto leave;

	/* log_printhex ("request:", data, 20); */

	ctrl = xtrycalloc (1, sizeof *ctrl);
	if (!ctrl)
	{
	log_error ("error allocating connection control data: %s\n",
	strerror (errno) );
	goto leave;
	}
	ctrl->session_env = session_env_new ();
	if (!ctrl->session_env)
	{
	log_error ("error allocating session environment block: %s\n",
	strerror (errno) );
	goto leave;
	}

	agent_init_default_ctrl (ctrl);
	if (!serve_mmapped_ssh_request (ctrl, data, PUTTY_IPC_MAXLEN))
	ret = 1; /* Valid ssh message has been constructed. */
	agent_deinit_default_ctrl (ctrl);
	/* log_printhex (" reply:", data, 20); */

	leave:
	xfree (ctrl);
	if (data)
	UnmapViewOfFile (data);
	xfree (mapsid);
	if (psd)
	LocalFree (psd);
	xfree (mysid);
	CloseHandle (maphd);

	npth_unprotect ();

	return ret;
	}
	#endif /HAVE_W32_SYSTEM/


	#ifdef HAVE_W32_SYSTEM
	/* The thread handling Putty's IPC requests. */
	static void *
	putty_message_thread (void *arg)
	{
	WNDCLASS wndwclass = {0, putty_message_proc, 0, 0,
	NULL, NULL, NULL, NULL, NULL, "Pageant"};
	HWND hwnd;
	MSG msg;

	(void)arg;

	if (opt.verbose)
	log_info ("putty message loop thread started\n");

	/* The message loop runs as thread independent from our nPth system.
	This also means that we need to make sure that we switch back to
	our system before calling any no-windows function. */
	npth_unprotect ();

	/* First create a window to make sure that a message queue exists
	for this thread. */
	if (!RegisterClass (&wndwclass))
	{
	npth_protect ();
	log_error ("error registering Pageant window class");
	return NULL;
	}
	hwnd = CreateWindowEx (0, "Pageant", "Pageant", 0,
	0, 0, 0, 0,
	HWND_MESSAGE, /* hWndParent */
	NULL, /* hWndMenu */
	NULL, /* hInstance */
	NULL); /* lpParm */
	if (!hwnd)
	{
	npth_protect ();
	log_error ("error creating Pageant window");
	return NULL;
	}

	while (GetMessage(&msg, NULL, 0, 0))
	{
	TranslateMessage(&msg);
	DispatchMessage(&msg);
	}

	/* Back to nPth. */
	npth_protect ();

	if (opt.verbose)
	log_info ("putty message loop thread stopped\n");
	return NULL;
	}
	#endif /HAVE_W32_SYSTEM/


	static void *
	do_start_connection_thread (ctrl_t ctrl)
	{
	active_connections++;
	agent_init_default_ctrl (ctrl);
	if (opt.verbose && !DBG_IPC)
	log_info (_("handler 0x%lx for fd %d started\n"),
	(unsigned long) npth_self(), FD2INT(ctrl->thread_startup.fd));

	start_command_handler (ctrl, GNUPG_INVALID_FD, ctrl->thread_startup.fd);
	if (opt.verbose && !DBG_IPC)
	log_info (_("handler 0x%lx for fd %d terminated\n"),
	(unsigned long) npth_self(), FD2INT(ctrl->thread_startup.fd));

	agent_deinit_default_ctrl (ctrl);
	xfree (ctrl);
	active_connections--;
	return NULL;
	}


	/* This is the standard connection thread's main function. */
	static void *
	start_connection_thread_std (void *arg)
	{
	ctrl_t ctrl = arg;

	if (check_nonce (ctrl, &socket_nonce))
	{
	log_error ("handler 0x%lx nonce check FAILED\n",
	(unsigned long) npth_self());
	return NULL;
	}

	return do_start_connection_thread (ctrl);
	}


	/* This is the extra socket connection thread's main function. */
	static void *
	start_connection_thread_extra (void *arg)
	{
	ctrl_t ctrl = arg;

	if (check_nonce (ctrl, &socket_nonce_extra))
	{
	log_error ("handler 0x%lx nonce check FAILED\n",
	(unsigned long) npth_self());
	return NULL;
	}

	ctrl->restricted = 1;
	return do_start_connection_thread (ctrl);
	}


	/* This is the browser socket connection thread's main function. */
	static void *
	start_connection_thread_browser (void *arg)
	{
	ctrl_t ctrl = arg;

	if (check_nonce (ctrl, &socket_nonce_browser))
	{
	log_error ("handler 0x%lx nonce check FAILED\n",
	(unsigned long) npth_self());
	return NULL;
	}

	ctrl->restricted = 2;
	return do_start_connection_thread (ctrl);
	}


	/* This is the ssh connection thread's main function. */
	static void *
	start_connection_thread_ssh (void *arg)
	{
	ctrl_t ctrl = arg;

	if (check_nonce (ctrl, &socket_nonce_ssh))
	return NULL;

	active_connections++;
	agent_init_default_ctrl (ctrl);
	if (opt.verbose)
	log_info (_("ssh handler 0x%lx for fd %d started\n"),
	(unsigned long) npth_self(), FD2INT(ctrl->thread_startup.fd));

	start_command_handler_ssh (ctrl, ctrl->thread_startup.fd);
	if (opt.verbose)
	log_info (_("ssh handler 0x%lx for fd %d terminated\n"),
	(unsigned long) npth_self(), FD2INT(ctrl->thread_startup.fd));

	agent_deinit_default_ctrl (ctrl);
	xfree (ctrl);
	active_connections--;
	return NULL;
	}


	/* Connection handler loop. Wait for connection requests and spawn a
	thread after accepting a connection. */
	static void
	handle_connections (gnupg_fd_t listen_fd,
	gnupg_fd_t listen_fd_extra,
	gnupg_fd_t listen_fd_browser,
	gnupg_fd_t listen_fd_ssh)
	{
	gpg_error_t err;
	npth_attr_t tattr;
	struct sockaddr_un paddr;
	socklen_t plen;
	fd_set fdset, read_fdset;
	int ret;
	gnupg_fd_t fd;
	int nfd;
	int saved_errno;
	struct timespec abstime;
	struct timespec curtime;
	struct timespec timeout;
	#ifdef HAVE_W32_SYSTEM
	HANDLE events[2];
	unsigned int events_set;
	#endif
	int my_inotify_fd = -1;
	struct {
	const char *name;
	void (func) (void *arg);
	gnupg_fd_t l_fd;
	} listentbl[] = {
	{ "std", start_connection_thread_std },
	{ "extra", start_connection_thread_extra },
	{ "browser", start_connection_thread_browser },
	{ "ssh", start_connection_thread_ssh }
	};


	ret = npth_attr_init(&tattr);
	if (ret)
	log_fatal ("error allocating thread attributes: %s\n",
	strerror (ret));
	npth_attr_setdetachstate (&tattr, NPTH_CREATE_DETACHED);

	#ifndef HAVE_W32_SYSTEM
	npth_sigev_init ();
	npth_sigev_add (SIGHUP);
	npth_sigev_add (SIGUSR1);
	npth_sigev_add (SIGUSR2);
	npth_sigev_add (SIGINT);
	npth_sigev_add (SIGTERM);
	npth_sigev_fini ();
	#else
	# ifdef HAVE_W32CE_SYSTEM
	/* Use a dummy event. */
	sigs = 0;
	ev = pth_event (PTH_EVENT_SIGS, &sigs, &signo);
	# else
	events[0] = get_agent_scd_notify_event ();
	events[1] = INVALID_HANDLE_VALUE;
	# endif
	#endif

	if (disable_check_own_socket)
	my_inotify_fd = -1;
	else if ((err = gnupg_inotify_watch_socket (&my_inotify_fd, socket_name)))
	{
	if (gpg_err_code (err) != GPG_ERR_NOT_SUPPORTED)
	log_info ("error enabling fast daemon termination: %s\n",
	gpg_strerror (err));
	}

	/* On Windows we need to fire up a separate thread to listen for
	requests from Putty (an SSH client), so we can replace Putty's
	Pageant (its ssh-agent implementation). */
	#ifdef HAVE_W32_SYSTEM
	if (putty_support)
	{
	npth_t thread;

	ret = npth_create (&thread, &tattr, putty_message_thread, NULL);
	if (ret)
	{
	log_error ("error spawning putty message loop: %s\n", strerror (ret));
	}
	}
	#endif /HAVE_W32_SYSTEM/

	/* Set a flag to tell call-scd.c that it may enable event
	notifications. */
	opt.sigusr2_enabled = 1;

	FD_ZERO (&fdset);
	FD_SET (FD2INT (listen_fd), &fdset);
	nfd = FD2INT (listen_fd);
	if (listen_fd_extra != GNUPG_INVALID_FD)
	{
	FD_SET ( FD2INT(listen_fd_extra), &fdset);
	if (FD2INT (listen_fd_extra) > nfd)
	nfd = FD2INT (listen_fd_extra);
	}
	if (listen_fd_browser != GNUPG_INVALID_FD)
	{
	FD_SET ( FD2INT(listen_fd_browser), &fdset);
	if (FD2INT (listen_fd_browser) > nfd)
	nfd = FD2INT (listen_fd_browser);
	}
	if (listen_fd_ssh != GNUPG_INVALID_FD)
	{
	FD_SET ( FD2INT(listen_fd_ssh), &fdset);
	if (FD2INT (listen_fd_ssh) > nfd)
	nfd = FD2INT (listen_fd_ssh);
	}
	if (my_inotify_fd != -1)
	{
	FD_SET (my_inotify_fd, &fdset);
	if (my_inotify_fd > nfd)
	nfd = my_inotify_fd;
	}

	listentbl[0].l_fd = listen_fd;
	listentbl[1].l_fd = listen_fd_extra;
	listentbl[2].l_fd = listen_fd_browser;
	listentbl[3].l_fd = listen_fd_ssh;

	npth_clock_gettime (&abstime);
	abstime.tv_sec += TIMERTICK_INTERVAL;

	for (;;)
	{
	/* Shutdown test. */
	if (shutdown_pending)
	{
	if (active_connections == 0)
	break; /* ready */

	/* Do not accept new connections but keep on running the
	* loop to cope with the timer events.
	*
	* Note that we do not close the listening socket because a
	* client trying to connect to that socket would instead
	* restart a new dirmngr instance - which is unlikely the
	* intention of a shutdown. */
	FD_ZERO (&fdset);
	nfd = -1;
	if (my_inotify_fd != -1)
	{
	FD_SET (my_inotify_fd, &fdset);
	nfd = my_inotify_fd;
	}
	}

	/* POSIX says that fd_set should be implemented as a structure,
	thus a simple assignment is fine to copy the entire set. */
	read_fdset = fdset;

	npth_clock_gettime (&curtime);
	if (!(npth_timercmp (&curtime, &abstime, <)))
	{
	/* Timeout. */
	handle_tick ();
	npth_clock_gettime (&abstime);
	abstime.tv_sec += TIMERTICK_INTERVAL;
	}
	npth_timersub (&abstime, &curtime, &timeout);

	#ifndef HAVE_W32_SYSTEM
	ret = npth_pselect (nfd+1, &read_fdset, NULL, NULL, &timeout,
	npth_sigev_sigmask ());
	saved_errno = errno;

	{
	int signo;
	while (npth_sigev_get_pending (&signo))
	handle_signal (signo);
	}
	#else
	ret = npth_eselect (nfd+1, &read_fdset, NULL, NULL, &timeout,
	events, &events_set);
	saved_errno = errno;

	/* This is valid even if npth_eselect returns an error. */
	if (events_set & 1)
	agent_sigusr2_action ();
	#endif

	if (ret == -1 && saved_errno != EINTR)
	{
	log_error (_("npth_pselect failed: %s - waiting 1s\n"),
	strerror (saved_errno));
	npth_sleep (1);
	continue;
	}
	if (ret <= 0)
	/* Interrupt or timeout. Will be handled when calculating the
	next timeout. */
	continue;

	if (!shutdown_pending)
	{
	int idx;
	ctrl_t ctrl;
	npth_t thread;

	if (my_inotify_fd != -1
	&& FD_ISSET (my_inotify_fd, &read_fdset)
	&& gnupg_inotify_has_name (my_inotify_fd, GPG_AGENT_SOCK_NAME))
	{
	shutdown_pending = 1;
	log_info ("socket file has been removed - shutting down\n");
	}

	for (idx=0; idx < DIM(listentbl); idx++)
	{
	if (listentbl[idx].l_fd == GNUPG_INVALID_FD)
	continue;
	if (!FD_ISSET (FD2INT (listentbl[idx].l_fd), &read_fdset))
	continue;

	plen = sizeof paddr;
	fd = INT2FD (npth_accept (FD2INT(listentbl[idx].l_fd),
	(struct sockaddr *)&paddr, &plen));
	if (fd == GNUPG_INVALID_FD)
	{
	log_error ("accept failed for %s: %s\n",
	listentbl[idx].name, strerror (errno));
	}
	else if ( !(ctrl = xtrycalloc (1, sizeof *ctrl)))
	{
	log_error ("error allocating connection data for %s: %s\n",
	listentbl[idx].name, strerror (errno) );
	assuan_sock_close (fd);
	}
	else if ( !(ctrl->session_env = session_env_new ()))
	{
	log_error ("error allocating session env block for %s: %s\n",
	listentbl[idx].name, strerror (errno) );
	xfree (ctrl);
	assuan_sock_close (fd);
	}
	else
	{
	ctrl->thread_startup.fd = fd;
	ret = npth_create (&thread, &tattr,
	listentbl[idx].func, ctrl);
	if (ret)
	{
	log_error ("error spawning connection handler for %s:"
	" %s\n", listentbl[idx].name, strerror (ret));
	assuan_sock_close (fd);
	xfree (ctrl);
	}
	}
	fd = GNUPG_INVALID_FD;
	}
	}
	}

	if (my_inotify_fd != -1)
	close (my_inotify_fd);
	cleanup ();
	log_info (_("%s %s stopped\n"), strusage(11), strusage(13));
	npth_attr_destroy (&tattr);
	}



	/* Helper for check_own_socket. */
	static gpg_error_t
	check_own_socket_pid_cb (void opaque, const void buffer, size_t length)
	{
	membuf_t *mb = opaque;
	put_membuf (mb, buffer, length);
	return 0;
	}


	/* The thread running the actual check. We need to run this in a
	separate thread so that check_own_thread can be called from the
	timer tick. */
	static void *
	check_own_socket_thread (void *arg)
	{
	int rc;
	char *sockname = arg;
	assuan_context_t ctx = NULL;
	membuf_t mb;
	char *buffer;

	check_own_socket_running++;

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("can't allocate assuan context: %s\n", gpg_strerror (rc));
	goto leave;
	}
	assuan_set_flag (ctx, ASSUAN_NO_LOGGING, 1);

	rc = assuan_socket_connect (ctx, sockname, (pid_t)(-1), 0);
	if (rc)
	{
	log_error ("can't connect my own socket: %s\n", gpg_strerror (rc));
	goto leave;
	}

	init_membuf (&mb, 100);
	rc = assuan_transact (ctx, "GETINFO pid", check_own_socket_pid_cb, &mb,
	NULL, NULL, NULL, NULL);
	put_membuf (&mb, "", 1);
	buffer = get_membuf (&mb, NULL);
	if (rc \|\| !buffer)
	{
	log_error ("sending command \"%s\" to my own socket failed: %s\n",
	"GETINFO pid", gpg_strerror (rc));
	rc = 1;
	}
	else if ( (pid_t)strtoul (buffer, NULL, 10) != getpid ())
	{
	log_error ("socket is now serviced by another server\n");
	rc = 1;
	}
	else if (opt.verbose > 1)
	log_error ("socket is still served by this server\n");

	xfree (buffer);

	leave:
	xfree (sockname);
	if (ctx)
	assuan_release (ctx);
	if (rc)
	{
	/* We may not remove the socket as it is now in use by another
	server. */
	inhibit_socket_removal = 1;
	shutdown_pending = 2;
	log_info ("this process is useless - shutting down\n");
	}
	check_own_socket_running--;
	return NULL;
	}


	/* Check whether we are still listening on our own socket. In case
	another gpg-agent process started after us has taken ownership of
	our socket, we would linger around without any real task. Thus we
	better check once in a while whether we are really needed. */
	static void
	check_own_socket (void)
	{
	char *sockname;
	npth_t thread;
	npth_attr_t tattr;
	int err;

	if (disable_check_own_socket)
	return;

	if (check_own_socket_running \|\| shutdown_pending)
	return; /* Still running or already shutting down. */

	sockname = make_filename_try (gnupg_socketdir (), GPG_AGENT_SOCK_NAME, NULL);
	if (!sockname)
	return; /* Out of memory. */

	err = npth_attr_init (&tattr);
	if (err)
	return;
	npth_attr_setdetachstate (&tattr, NPTH_CREATE_DETACHED);
	err = npth_create (&thread, &tattr, check_own_socket_thread, sockname);
	if (err)
	log_error ("error spawning check_own_socket_thread: %s\n", strerror (err));
	npth_attr_destroy (&tattr);
	}



	/* Figure out whether an agent is available and running. Prints an
	error if not. If SILENT is true, no messages are printed.
	Returns 0 if the agent is running. */
	static int
	check_for_running_agent (int silent)
	{
	gpg_error_t err;
	char *sockname;
	assuan_context_t ctx = NULL;

	sockname = make_filename_try (gnupg_socketdir (), GPG_AGENT_SOCK_NAME, NULL);
	if (!sockname)
	return gpg_error_from_syserror ();

	err = assuan_new (&ctx);
	if (!err)
	err = assuan_socket_connect (ctx, sockname, (pid_t)(-1), 0);
	xfree (sockname);
	if (err)
	{
	if (!silent)
	log_error (_("no gpg-agent running in this session\n"));

	if (ctx)
	assuan_release (ctx);
	return -1;
	}

	if (!opt.quiet && !silent)
	log_info ("gpg-agent running and available\n");

	assuan_release (ctx);
	return 0;
	}
	diff --git a/agent/keyformat.txt b/agent/keyformat.txt
	index e80496e1c..68fbdbc65 100644
	--- a/agent/keyformat.txt
	+++ b/agent/keyformat.txt
	@@ -1,425 +1,425 @@
	keyformat.txt emacs, please switch to -- org -- mode
	-------------


	Some notes on the format of the secret keys used with gpg-agent.

	* Location of keys

	The secret keys[1] are stored on a per file basis in a directory below
	the ~/.gnupg home directory. This directory is named

	private-keys-v1.d

	and should have permissions 700.

	The secret keys are stored in files with a name matching the
	hexadecimal representation of the keygrip[2] and suffixed with ".key".

	* Extended Private Key Format

	GnuPG 2.3+ will use a new format to store private keys that is both
	more flexible and easier to read and edit by human beings. The new
	format stores name,value-pairs using the common mail and http header
	convention. Example (here indented with two spaces):

	Description: Key to sign all GnuPG released tarballs.
	The key is actually stored on a smart card.
	Use-for-ssh: yes
	OpenSSH-cert: long base64 encoded string wrapped so that this
	key file can be easily edited with a standard editor.
	Key: (shadowed-private-key
	(rsa
	(n #00AA1AD2A55FD8C8FDE9E1941772D9CC903FA43B268CB1B5A1BAFDC900
	2961D8AEA153424DC851EF13B83AC64FBE365C59DC1BD3E83017C90D4365B4
	83E02859FC13DB5842A00E969480DB96CE6F7D1C03600392B8E08EF0C01FC7
	19F9F9086B25AD39B4F1C2A2DF3E2BE317110CFFF21D4A11455508FE407997
	601260816C8422297C0637BB291C3A079B9CB38A92CE9E551F80AA0EBF4F0E
	72C3F250461E4D31F23A7087857FC8438324A013634563D34EFDDCBF2EA80D
	F9662C9CCD4BEF2522D8BDFED24CEF78DC6B309317407EAC576D889F88ADA0
	8C4FFB480981FB68C5C6CA27503381D41018E6CDC52AAAE46B166BDC10637A
	E186A02BA2497FDC5D1221#)
	(e #00010001#)
	(shadowed t1-v1
	(#D2760001240102000005000011730000# OPENPGP.1)
	)))

	GnuPG 2.2 is able to read and update keys using the new format, but
	will not create new files using the new format. Furthermore, it only
	makes use of the value stored under the name 'Key:'.

	Keys in the extended format can be recognized by looking at the first
	byte of the file. If it starts with a '(' it is a naked S-expression,
	otherwise it is a key in extended format.

	** Names

	A name must start with a letter and end with a colon. Valid
	characters are all ASCII letters, numbers and the hyphen. Comparison
	of names is done case insensitively. Names may be used several times
	to represent an array of values.

	The name "Key:" is special in that it may occur only once and the
	associated value holds the actual S-expression with the cryptographic
	key. The S-expression is formatted using the 'Advanced Format'
	(GCRYSEXP_FMT_ADVANCED) that avoids non-printable characters so that
	the file can be easily inspected and edited. See section 'Private Key
	Format' below for details.

	** Values

	Values are UTF-8 encoded strings. Values can be wrapped at any point,
	and continued in the next line indicated by leading whitespace. A
	continuation line with one leading space does not introduce a blank so
	that the lines can be effectively concatenated. A blank line as part
	of a continuation line encodes a newline.

	** Comments

	Lines containing only whitespace, and lines starting with whitespace
	followed by '#' are considered to be comments and are ignored.

	* Private Key Format
	** Unprotected Private Key Format

	The content of the file is an S-Expression like the ones used with
	Libgcrypt. Here is an example of an unprotected file:

	(private-key
	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(d #046129F..[some bytes not shown]..81#)
	(p #00e861b..[some bytes not shown]..f1#)
	(q #00f7a7c..[some bytes not shown]..61#)
	(u #304559a..[some bytes not shown]..9b#)
	)
	(created-at timestamp)
	(uri http://foo.bar x-foo:whatever_you_want)
	(comment whatever)
	)

	"comment", "created-at" and "uri" are optional. "comment" is
	currently used to keep track of ssh key comments. "created-at" is used
	to keep track of the creation time stamp used with OpenPGP keys; it is
	optional but required for some operations to calculate the fingerprint
	of the key. This timestamp should be a string with the number of
	seconds since Epoch or an ISO time string (yyyymmddThhmmss).

	** Protected Private Key Format

	A protected key is like this:

	(protected-private-key
	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(protected mode (parms) encrypted_octet_string)
	(protected-at <isotimestamp>)
	)
	(uri http://foo.bar x-foo:whatever_you_want)
	(comment whatever)
	)


	In this scheme the encrypted_octet_string is encrypted according to
	the algorithm described after the keyword protected; most protection
	algorithms need some parameters, which are given in a list before the
	encrypted_octet_string. The result of the decryption process is a
	list of the secret key parameters. The protected-at expression is
	optional; the isotimestamp is 15 bytes long (e.g. "19610711T172000").

	The currently defined protection modes are:

	*** openpgp-s2k3-sha1-aes-cbc

	- This describes an algorithm using using AES in CBC mode for
	+ This describes an algorithm using AES in CBC mode for
	encryption, SHA-1 for integrity protection and the String to Key
	algorithm 3 from OpenPGP (rfc4880).

	Example:

	(protected openpgp-s2k3-sha1-aes-cbc
	((sha1 16byte_salt no_of_iterations) 16byte_iv)
	encrypted_octet_string
	)

	The encrypted_octet string should yield this S-Exp (in canonical
	representation) after decryption:

	(
	(
	(d #046129F..[some bytes not shown]..81#)
	(p #00e861b..[some bytes not shown]..f1#)
	(q #00f7a7c..[some bytes not shown]..61#)
	(u #304559a..[some bytes not shown]..9b#)
	)
	(hash sha1 #...[hashvalue]...#)
	)

	For padding reasons, random bytes are appended to this list - they can
	easily be stripped by looking for the end of the list.

	The hash is calculated on the concatenation of the public key and
	secret key parameter lists: i.e. it is required to hash the
	concatenation of these 6 canonical encoded lists for RSA, including
	the parenthesis, the algorithm keyword and (if used) the protected-at
	list.

	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(d #046129F..[some bytes not shown]..81#)
	(p #00e861b..[some bytes not shown]..f1#)
	(q #00f7a7c..[some bytes not shown]..61#)
	(u #304559a..[some bytes not shown]..9b#)
	(protected-at "18950523T000000")
	)

	After decryption the hash must be recalculated and compared against
	the stored one - If they don't match the integrity of the key is not
	given.

	*** openpgp-s2k3-ocb-aes

	- This describes an algorithm using using AES-128 in OCB mode, a nonce
	+ This describes an algorithm using AES-128 in OCB mode, a nonce
	of 96 bit, a taglen of 128 bit, and the String to Key algorithm 3
	from OpenPGP (rfc4880).

	Example:

	(protected openpgp-s2k3-ocb-aes
	((sha1 16byte_salt no_of_iterations) 12byte_nonce)
	encrypted_octet_string
	)

	The encrypted_octet string should yield this S-Exp (in canonical
	representation) after decryption:

	(
	(
	(d #046129F..[some bytes not shown]..81#)
	(p #00e861b..[some bytes not shown]..f1#)
	(q #00f7a7c..[some bytes not shown]..61#)
	(u #304559a..[some bytes not shown]..9b#)
	)
	)

	For padding reasons, random bytes may be appended to this list -
	they can easily be stripped by looking for the end of the list.

	The associated data required for this protection mode is the list
	formiing the public key parameters. For the above example this is
	is this canonical encoded S-expression:

	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(protected-at "18950523T000000")
	)

	*** openpgp-native

	This is a wrapper around the OpenPGP Private Key Transport format
	which resembles the standard OpenPGP format and allows the use of an
	existing key without re-encrypting to the default protection format.

	Example:

	(protected openpgp-native
	(openpgp-private-key
	(version V)
	(algo PUBKEYALGO)
	(skey _ P1 _ P2 _ P3 ... e PN)
	(csum n)
	(protection PROTTYPE PROTALGO IV S2KMODE S2KHASH S2KSALT S2KCOUNT)))

	Note that the public key paramaters in SKEY are duplicated and
	should be identical to their copies in the standard parameter
	elements. Here is an example of an entire protected private key
	using this format:

	(protected-private-key
	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(protected openpgp-native
	(openpgp-private-key
	(version 4)
	(algo rsa)
	(skey _ #00e0ce9..[some bytes not shown]..51#
	_ #010001#
	e #.........................#)
	(protection sha1 aes #aabbccddeeff00112233445566778899#
	3 sha1 #2596f93e85f41e53# 3:190))))
	(uri http://foo.bar x-foo:whatever_you_want)
	(comment whatever))

	** Shadowed Private Key Format

	To keep track of keys stored on IC cards we use a third format for
	private kyes which are called shadow keys as they are only a reference
	to keys stored on a token:

	(shadowed-private-key
	(rsa
	(n #00e0ce9..[some bytes not shown]..51#)
	(e #010001#)
	(shadowed protocol (info))
	)
	(uri http://foo.bar x-foo:whatever_you_want)
	(comment whatever)
	)

	The currently used protocol is "ti-v1" (token info version 1). The
	second list with the information has this layout:

	(card_serial_number id_string_of_key fixed_pin_length)

	FIXED_PIN_LENGTH is optional. It can be used to store the length of
	the PIN; a value of 0 indicates that this information is not
	available. The rationale for this field is that some pinpad equipped
	readers don't allow passing a variable length PIN.

	More items may be added to the list.

	** OpenPGP Private Key Transfer Format

	This format is used to transfer keys between gpg and gpg-agent.

	(openpgp-private-key
	(version V)
	(algo PUBKEYALGO)
	(curve CURVENAME)
	(skey _ P1 _ P2 _ P3 ... e PN)
	(csum n)
	(protection PROTTYPE PROTALGO IV S2KMODE S2KHASH S2KSALT S2KCOUNT))


	* V is the packet version number (3 or 4).
	* PUBKEYALGO is a Libgcrypt algo name
	* CURVENAME is the name of the curve - only used with ECC.
	* P1 .. PN are the parameters; the public parameters are never encrypted
	the secrect key parameters are encrypted if the "protection" list is
	given. To make this more explicit each parameter is preceded by a
	flag "_" for cleartext or "e" for encrypted text.
	* CSUM is the deprecated 16 bit checksum as defined by OpenPGP. This
	is an optional element.
	* If PROTTYPE is "sha1" the new style SHA1 checksum is used if it is "sum"
	the old 16 bit checksum (above) is used and if it is "none" no
	protection at all is used.
	* PROTALGO is a Libgcrypt style cipher algorithm name
	* IV is the initialization verctor.
	* S2KMODE is the value from RFC-4880.
	- * S2KHASH is a a libgcrypt style hash algorithm identifier.
	+ * S2KHASH is a libgcrypt style hash algorithm identifier.
	* S2KSALT is the 8 byte salt
	* S2KCOUNT is the count value from RFC-4880.

	** Persistent Passphrase Format

	Note: That this has not yet been implemented.

	To allow persistent storage of cached passphrases we use a scheme
	similar to the private-key storage format. This is a master
	passphrase format where each file may protect several secrets under
	one master passphrase. It is possible to have several of those files
	each protected by a dedicated master passphrase. Clear text keywords
	allow listing the available protected passphrases.

	The name of the files with these protected secrets have this form:
	pw-<string>.dat. STRING may be an arbitrary string, as a default name
	for the passphrase storage the name "pw-default.dat" is suggested.


	(protected-shared-secret
	((desc descriptive_text)
	(key [key_1] (keyword_1 keyword_2 keyword_n))
	(key [key_2] (keyword_21 keyword_22 keyword_2n))
	(key [key_n] (keyword_n1 keyword_n2 keyword_nn))
	(protected mode (parms) encrypted_octet_string)
	(protected-at <isotimestamp>)
	)
	)

	After decryption the encrypted_octet_string yields this S-expression:

	(
	(
	(value key_1 value_1)
	(value key_2 value_2)
	(value key_n value_n)
	)
	(hash sha1 #...[hashvalue]...#)
	)

	The "descriptive_text" is displayed with the prompt to enter the
	unprotection passphrase.

	KEY_1 to KEY_N are unique identifiers for the shared secret, for
	example an URI. In case this information should be kept confidential
	as well, they may not appear in the unprotected part; however they are
	mandatory in the encrypted_octet_string. The list of keywords is
	optional. The oder of the "key" lists and the order of the "value"
	lists mut match, that is the first "key"-list is associated with the
	first "value" list in the encrypted_octet_string.

	The protection mode etc. is identical to the protection mode as
	described for the private key format.

	list of the secret key parameters. The protected-at expression is
	optional; the isotimestamp is 15 bytes long (e.g. "19610711T172000").

	The "hash" in the encrypted_octet_string is calculated on the
	concatenation of the key list and value lists: i.e it is required to
	hash the concatenation of all these lists, including the
	parenthesis and (if used) the protected-at list.

	Example:

	(protected-shared-secret
	((desc "List of system passphrases")
	(key "uid-1002" ("Knuth" "Donald Ervin Knuth"))
	(key "uid-1001" ("Dijkstra" "Edsgar Wybe Dijkstra"))
	(key)
	(protected mode (parms) encrypted_octet_string)
	(protected-at "20100915T111722")
	)
	)

	with "encrypted_octet_string" decoding to:

	(
	(
	(value 4:1002 "signal flags at the lock")
	(value 4:1001 "taocp")
	(value 1:0 "premature optimization is the root of all evil")
	)
	(hash sha1 #0102030405060708091011121314151617181920#)
	)

	To compute the hash this S-expression (in canoncical format) was
	hashed:

	((desc "List of system passphrases")
	(key "uid-1002" ("Knuth" "Donald Ervin Knuth"))
	(key "uid-1001" ("Dijkstra" "Edsgar Wybe Dijkstra"))
	(key)
	(value 4:1002 "signal flags at the lock")
	(value 4:1001 "taocp")
	(value 1:0 "premature optimization is the root of all evil")
	(protected-at "20100915T111722")
	)

	* Notes

	[1] I usually use the terms private and secret key exchangeable but prefer the
	term secret key because it can be visually be better distinguished
	from the term public key.

	[2] The keygrip is a unique identifier for a key pair, it is
	independent of any protocol, so that the same key can be used with
	different protocols. PKCS-15 calls this a subjectKeyHash; it can be
	calculated using Libgcrypt's gcry_pk_get_keygrip ().

	[3] Even when canonical representation are required we will show the
	S-expression here in a more readable representation.
	diff --git a/agent/preset-passphrase.c b/agent/preset-passphrase.c
	index ae6f0ce53..b8d2aaa00 100644
	--- a/agent/preset-passphrase.c
	+++ b/agent/preset-passphrase.c
	@@ -1,266 +1,266 @@
	/* preset-passphrase.c - A tool to preset a passphrase.
	* Copyright (C) 2004 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <stddef.h>
	#include <stdarg.h>
	#include <string.h>
	#include <errno.h>
	#include <assert.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif
	#ifdef HAVE_LANGINFO_CODESET
	#include <langinfo.h>
	#endif
	#ifdef HAVE_DOSISH_SYSTEM
	#include <fcntl.h> /* for setmode() */
	#endif
	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h> /* To initialize the sockets. fixme */
	#endif

	#include "agent.h"
	#include "simple-pwquery.h"
	#include "i18n.h"
	#include "sysutils.h"
	#include "../common/init.h"


	enum cmd_and_opt_values
	{ aNull = 0,
	oVerbose = 'v',
	oPassphrase = 'P',

	oPreset = 'c',
	oForget = 'f',

	oNoVerbose = 500,

	oHomedir,

	aTest };


	static const char *opt_passphrase;

	static ARGPARSE_OPTS opts[] = {

	{ 301, NULL, 0, N_("@Options:\n ") },

	{ oVerbose, "verbose", 0, "verbose" },
	{ oPassphrase, "passphrase", 2, "\|STRING\|use passphrase STRING" },
	{ oPreset, "preset", 256, "preset passphrase"},
	{ oForget, "forget", 256, "forget passphrase"},

	{ oHomedir, "homedir", 2, "@" },
	{0}
	};


	static const char *
	my_strusage (int level)
	{
	const char *p;
	switch (level)
	{
	case 11: p = "gpg-preset-passphrase (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40:
	p = _("Usage: gpg-preset-passphrase [options] KEYGRIP (-h for help)\n");
	break;
	case 41:
	p = _("Syntax: gpg-preset-passphrase [options] KEYGRIP\n"
	"Password cache maintenance\n");
	break;

	default: p = NULL;
	}
	return p;
	}




	static void
	preset_passphrase (const char *keygrip)
	{
	int rc;
	char *line;
	/* FIXME: Use secure memory. */
	char passphrase[500];
	char *passphrase_esc;

	if (!opt_passphrase)
	{
	rc = read (0, passphrase, sizeof (passphrase) - 1);
	if (rc < 0)
	{
	log_error ("reading passphrase failed: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	return;
	}
	passphrase[rc] = '\0';
	line = strchr (passphrase, '\n');
	if (line)
	{
	if (line > passphrase && line[-1] == '\r')
	line--;
	*line = '\0';
	}

	/* FIXME: How to handle empty passwords? */
	}

	{
	const char *s = opt_passphrase ? opt_passphrase : passphrase;
	passphrase_esc = bin2hex (s, strlen (s), NULL);
	}
	if (!passphrase_esc)
	{
	log_error ("can not escape string: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	return;
	}

	rc = asprintf (&line, "PRESET_PASSPHRASE %s -1 %s\n", keygrip,
	passphrase_esc);
	wipememory (passphrase_esc, strlen (passphrase_esc));
	xfree (passphrase_esc);

	if (rc < 0)
	{
	log_error ("caching passphrase failed: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));
	return;
	}
	if (!opt_passphrase)
	wipememory (passphrase, sizeof (passphrase));

	rc = simple_query (line);
	if (rc)
	{
	log_error ("caching passphrase failed: %s\n", gpg_strerror (rc));
	return;
	}

	wipememory (line, strlen (line));
	xfree (line);
	}


	static void
	forget_passphrase (const char *keygrip)
	{
	int rc;
	char *line;

	rc = asprintf (&line, "CLEAR_PASSPHRASE %s\n", keygrip);
	if (rc < 0)
	rc = gpg_error_from_syserror ();
	else
	rc = simple_query (line);
	if (rc)
	{
	log_error ("clearing passphrase failed: %s\n", gpg_strerror (rc));
	return;
	}

	xfree (line);
	}


	int
	main (int argc, char **argv)
	{
	ARGPARSE_ARGS pargs;
	int cmd = 0;
	const char *keygrip = NULL;

	early_system_init ();
	set_strusage (my_strusage);
	log_set_prefix ("gpg-preset-passphrase", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init ();
	init_common_subsystems (&argc, &argv);

	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= 1; /* (do not remove the args) */
	while (arg_parse (&pargs, opts) )
	{
	switch (pargs.r_opt)
	{
	case oVerbose: opt.verbose++; break;
	case oHomedir: gnupg_set_homedir (pargs.r.ret_str); break;

	case oPreset: cmd = oPreset; break;
	case oForget: cmd = oForget; break;
	case oPassphrase: opt_passphrase = pargs.r.ret_str; break;

	default : pargs.err = 2; break;
	}
	}
	if (log_get_errorcount(0))
	exit(2);

	if (argc == 1)
	keygrip = *argv;
	else
	usage (1);

	- /* Tell simple-pwquery about the the standard socket name. */
	+ /* Tell simple-pwquery about the standard socket name. */
	{
	char *tmp = make_filename (gnupg_socketdir (), GPG_AGENT_SOCK_NAME, NULL);
	simple_pw_set_socket (tmp);
	xfree (tmp);
	}

	if (cmd == oPreset)
	preset_passphrase (keygrip);
	else if (cmd == oForget)
	forget_passphrase (keygrip);
	else
	log_error ("one of the options --preset or --forget must be given\n");

	agent_exit (0);
	return 8; /NOTREACHED/
	}


	void
	agent_exit (int rc)
	{
	rc = rc? rc : log_get_errorcount(0)? 2 : 0;
	exit (rc);
	}
	diff --git a/agent/protect.c b/agent/protect.c
	index e20586970..7ae7e64b7 100644
	--- a/agent/protect.c
	+++ b/agent/protect.c
	@@ -1,1709 +1,1709 @@
	/* protect.c - Un/Protect a secret key
	* Copyright (C) 1998-2003, 2007, 2009, 2011 Free Software Foundation, Inc.
	* Copyright (C) 1998-2003, 2007, 2009, 2011, 2013-2015 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <assert.h>
	#include <unistd.h>
	#include <sys/stat.h>
	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h>
	#else
	# include <sys/times.h>
	#endif

	#include "agent.h"

	#include "cvt-openpgp.h"
	#include "sexp-parse.h"


	/* To use the openpgp-s2k3-ocb-aes scheme by default set the value of
	* this macro to 1. Note that the caller of agent_protect may
	* override this default. */
	#define PROT_DEFAULT_TO_OCB 0

	/* The protection mode for encryption. The supported modes for
	decryption are listed in agent_unprotect(). */
	#define PROT_CIPHER GCRY_CIPHER_AES128
	#define PROT_CIPHER_STRING "aes"
	#define PROT_CIPHER_KEYLEN (128/8)

	/* Decode an rfc4880 encoded S2K count. */
	#define S2K_DECODE_COUNT(_val) ((16ul + ((_val) & 15)) << (((_val) >> 4) + 6))


	/* A table containing the information needed to create a protected
	private key. */
	static struct {
	const char *algo;
	const char *parmlist;
	int prot_from, prot_to;
	int ecc_hack;
	} protect_info[] = {
	{ "rsa", "nedpqu", 2, 5 },
	{ "dsa", "pqgyx", 4, 4 },
	{ "elg", "pgyx", 3, 3 },
	{ "ecdsa","pabgnqd", 6, 6, 1 },
	{ "ecdh", "pabgnqd", 6, 6, 1 },
	{ "ecc", "pabgnqd", 6, 6, 1 },
	{ NULL }
	};


	/* A helper object for time measurement. */
	struct calibrate_time_s
	{
	#ifdef HAVE_W32_SYSTEM
	FILETIME creation_time, exit_time, kernel_time, user_time;
	#else
	clock_t ticks;
	#endif
	};


	static int
	hash_passphrase (const char *passphrase, int hashalgo,
	int s2kmode,
	const unsigned char *s2ksalt, unsigned long s2kcount,
	unsigned char *key, size_t keylen);




	/* Get the process time and store it in DATA. */
	static void
	calibrate_get_time (struct calibrate_time_s *data)
	{
	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_W32CE_SYSTEM
	GetThreadTimes (GetCurrentThread (),
	&data->creation_time, &data->exit_time,
	&data->kernel_time, &data->user_time);
	# else
	GetProcessTimes (GetCurrentProcess (),
	&data->creation_time, &data->exit_time,
	&data->kernel_time, &data->user_time);
	# endif
	#else
	struct tms tmp;

	times (&tmp);
	data->ticks = tmp.tms_utime;
	#endif
	}


	static unsigned long
	calibrate_elapsed_time (struct calibrate_time_s *starttime)
	{
	struct calibrate_time_s stoptime;

	calibrate_get_time (&stoptime);
	#ifdef HAVE_W32_SYSTEM
	{
	unsigned long long t1, t2;

	t1 = (((unsigned long long)starttime->kernel_time.dwHighDateTime << 32)
	+ starttime->kernel_time.dwLowDateTime);
	t1 += (((unsigned long long)starttime->user_time.dwHighDateTime << 32)
	+ starttime->user_time.dwLowDateTime);
	t2 = (((unsigned long long)stoptime.kernel_time.dwHighDateTime << 32)
	+ stoptime.kernel_time.dwLowDateTime);
	t2 += (((unsigned long long)stoptime.user_time.dwHighDateTime << 32)
	+ stoptime.user_time.dwLowDateTime);
	return (unsigned long)((t2 - t1)/10000);
	}
	#else
	return (unsigned long)((((double) (stoptime.ticks - starttime->ticks))
	/CLOCKS_PER_SEC)*10000000);
	#endif
	}


	/* Run a test hashing for COUNT and return the time required in
	milliseconds. */
	static unsigned long
	calibrate_s2k_count_one (unsigned long count)
	{
	int rc;
	char keybuf[PROT_CIPHER_KEYLEN];
	struct calibrate_time_s starttime;

	calibrate_get_time (&starttime);
	rc = hash_passphrase ("123456789abcdef0", GCRY_MD_SHA1,
	3, "saltsalt", count, keybuf, sizeof keybuf);
	if (rc)
	BUG ();
	return calibrate_elapsed_time (&starttime);
	}


	/* Measure the time we need to do the hash operations and deduce an
	S2K count which requires about 100ms of time. */
	static unsigned long
	calibrate_s2k_count (void)
	{
	unsigned long count;
	unsigned long ms;

	for (count = 65536; count; count *= 2)
	{
	ms = calibrate_s2k_count_one (count);
	if (opt.verbose > 1)
	log_info ("S2K calibration: %lu -> %lums\n", count, ms);
	if (ms > 100)
	break;
	}

	count = (unsigned long)(((double)count / ms) * 100);
	count /= 1024;
	count *= 1024;
	if (count < 65536)
	count = 65536;

	if (opt.verbose)
	{
	ms = calibrate_s2k_count_one (count);
	log_info ("S2K calibration: %lu -> %lums\n", count, ms);
	}

	return count;
	}



	/* Return the standard S2K count. */
	unsigned long
	get_standard_s2k_count (void)
	{
	static unsigned long count;

	if (!count)
	count = calibrate_s2k_count ();

	/* Enforce a lower limit. */
	return count < 65536 ? 65536 : count;
	}


	/* Same as get_standard_s2k_count but return the count in the encoding
	as described by rfc4880. */
	unsigned char
	get_standard_s2k_count_rfc4880 (void)
	{
	unsigned long iterations;
	unsigned int count;
	unsigned char result;
	unsigned char c=0;

	iterations = get_standard_s2k_count ();
	if (iterations >= 65011712)
	return 255;

	/* Need count to be in the range 16-31 */
	for (count=iterations>>6; count>=32; count>>=1)
	c++;

	result = (c<<4)\|(count-16);

	if (S2K_DECODE_COUNT(result) < iterations)
	result++;

	return result;

	}



	/* Calculate the MIC for a private key or shared secret S-expression.
	SHA1HASH should point to a 20 byte buffer. This function is
	suitable for all algorithms. */
	static int
	calculate_mic (const unsigned char plainkey, unsigned char sha1hash)
	{
	const unsigned char hash_begin, hash_end;
	const unsigned char *s;
	size_t n;
	int is_shared_secret;

	s = plainkey;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "private-key"))
	is_shared_secret = 0;
	else if (smatch (&s, n, "shared-secret"))
	is_shared_secret = 1;
	else
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	hash_begin = s;
	if (!is_shared_secret)
	{
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n; /* Skip the algorithm name. */
	}

	while (*s == '(')
	{
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n;
	if ( *s != ')' )
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	}
	if (*s != ')')
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	hash_end = s;

	gcry_md_hash_buffer (GCRY_MD_SHA1, sha1hash,
	hash_begin, hash_end - hash_begin);

	return 0;
	}



	/* Encrypt the parameter block starting at PROTBEGIN with length
	PROTLEN using the utf8 encoded key PASSPHRASE and return the entire
	encrypted block in RESULT or return with an error code. SHA1HASH
	is the 20 byte SHA-1 hash required for the integrity code.

	The parameter block is expected to be an incomplete canonical
	encoded S-Expression of the form (example in advanced format):

	(d #046129F..[some bytes not shown]..81#)
	(p #00e861b..[some bytes not shown]..f1#)
	(q #00f7a7c..[some bytes not shown]..61#)
	(u #304559a..[some bytes not shown]..9b#)

	the returned block is the S-Expression:

	(protected mode (parms) encrypted_octet_string)

	*/
	static int
	do_encryption (const unsigned char *hashbegin, size_t hashlen,
	const unsigned char *protbegin, size_t protlen,
	const char *passphrase,
	const char *timestamp_exp, size_t timestamp_exp_len,
	unsigned char *result, size_t resultlen,
	unsigned long s2k_count, int use_ocb)
	{
	gcry_cipher_hd_t hd;
	const char *modestr;
	unsigned char hashvalue[20];
	int blklen, enclen, outlen;
	unsigned char *iv = NULL;
	unsigned int ivsize; /* Size of the buffer allocated for IV. */
	const unsigned char s2ksalt; / Points into IV. */
	int rc;
	char *outbuf = NULL;
	char *p;
	int saltpos, ivpos, encpos;

	s2ksalt = iv; /* Silence compiler warning. */

	*resultlen = 0;
	*result = NULL;

	modestr = (use_ocb? "openpgp-s2k3-ocb-aes"
	/* */: "openpgp-s2k3-sha1-" PROT_CIPHER_STRING "-cbc");

	rc = gcry_cipher_open (&hd, PROT_CIPHER,
	use_ocb? GCRY_CIPHER_MODE_OCB :
	GCRY_CIPHER_MODE_CBC,
	GCRY_CIPHER_SECURE);
	if (rc)
	return rc;

	/* We need to work on a copy of the data because this makes it
	* easier to add the trailer and the padding and more important we
	* have to prefix the text with 2 parenthesis. In CBC mode we
	* have to allocate enough space for:
	*
	* ((<parameter_list>)(4:hash4:sha120:<hashvalue>)) + padding
	*
	* we always append a full block of random bytes as padding but
	* encrypt only what is needed for a full blocksize. In OCB mode we
	* have to allocate enough space for just:
	*
	* ((<parameter_list>))
	*/
	blklen = gcry_cipher_get_algo_blklen (PROT_CIPHER);
	if (use_ocb)
	{
	/* (( )) */
	outlen = 2 + protlen + 2 ;
	enclen = outlen + 16 /* taglen */;
	outbuf = gcry_malloc_secure (enclen);
	}
	else
	{
	/* (( )( 4:hash 4:sha1 20:<hash> )) <padding> */
	outlen = 2 + protlen + 2 + 6 + 6 + 23 + 2 + blklen;
	enclen = outlen/blklen * blklen;
	outbuf = gcry_malloc_secure (outlen);
	}
	if (!outbuf)
	rc = out_of_core ();

	/* Allocate a buffer for the nonce and the salt. */
	if (!rc)
	{
	/* Allocate random bytes to be used as IV, padding and s2k salt
	* or in OCB mode for a nonce and the s2k salt. The IV/nonce is
	* set later because for OCB we need to set the key first. */
	ivsize = (use_ocb? 12 : (blklen*2)) + 8;
	iv = xtrymalloc (ivsize);
	if (!iv)
	rc = gpg_error_from_syserror ();
	else
	{
	gcry_create_nonce (iv, ivsize);
	s2ksalt = iv + ivsize - 8;
	}
	}

	/* Hash the passphrase and set the key. */
	if (!rc)
	{
	unsigned char *key;
	size_t keylen = PROT_CIPHER_KEYLEN;

	key = gcry_malloc_secure (keylen);
	if (!key)
	rc = out_of_core ();
	else
	{
	rc = hash_passphrase (passphrase, GCRY_MD_SHA1,
	3, s2ksalt,
	s2k_count? s2k_count:get_standard_s2k_count(),
	key, keylen);
	if (!rc)
	rc = gcry_cipher_setkey (hd, key, keylen);
	xfree (key);
	}
	}

	/* Set the IV/nonce. */
	if (!rc)
	{
	rc = gcry_cipher_setiv (hd, iv, use_ocb? 12 : blklen);
	}

	if (use_ocb)
	{
	/* In OCB Mode we use only the public key parameters as AAD. */
	rc = gcry_cipher_authenticate (hd, hashbegin, protbegin - hashbegin);
	if (!rc)
	rc = gcry_cipher_authenticate (hd, timestamp_exp, timestamp_exp_len);
	if (!rc)
	rc = gcry_cipher_authenticate
	(hd, protbegin+protlen, hashlen - (protbegin+protlen - hashbegin));

	}
	else
	{
	/* Hash the entire expression for CBC mode. Because
	* TIMESTAMP_EXP won't get protected, we can't simply hash a
	* continuous buffer but need to call md_write several times. */
	gcry_md_hd_t md;

	rc = gcry_md_open (&md, GCRY_MD_SHA1, 0 );
	if (!rc)
	{
	gcry_md_write (md, hashbegin, protbegin - hashbegin);
	gcry_md_write (md, protbegin, protlen);
	gcry_md_write (md, timestamp_exp, timestamp_exp_len);
	gcry_md_write (md, protbegin+protlen,
	hashlen - (protbegin+protlen - hashbegin));
	memcpy (hashvalue, gcry_md_read (md, GCRY_MD_SHA1), 20);
	gcry_md_close (md);
	}
	}


	/* Encrypt. */
	if (!rc)
	{
	p = outbuf;
	*p++ = '(';
	*p++ = '(';
	memcpy (p, protbegin, protlen);
	p += protlen;
	if (use_ocb)
	{
	*p++ = ')';
	*p++ = ')';
	}
	else
	{
	memcpy (p, ")(4:hash4:sha120:", 17);
	p += 17;
	memcpy (p, hashvalue, 20);
	p += 20;
	*p++ = ')';
	*p++ = ')';
	memcpy (p, iv+blklen, blklen); /* Add padding. */
	p += blklen;
	}
	assert ( p - outbuf == outlen);
	if (use_ocb)
	{
	gcry_cipher_final (hd);
	rc = gcry_cipher_encrypt (hd, outbuf, outlen, NULL, 0);
	if (!rc)
	{
	log_assert (outlen + 16 == enclen);
	rc = gcry_cipher_gettag (hd, outbuf + outlen, 16);
	}
	}
	else
	{
	rc = gcry_cipher_encrypt (hd, outbuf, enclen, NULL, 0);
	}
	}

	/* Release cipher handle and check for errors. */
	gcry_cipher_close (hd);
	if (rc)
	{
	xfree (iv);
	xfree (outbuf);
	return rc;
	}

	/* Now allocate the buffer we want to return. This is

	(protected openpgp-s2k3-sha1-aes-cbc
	((sha1 salt no_of_iterations) 16byte_iv)
	encrypted_octet_string)

	in canoncical format of course. We use asprintf and %n modifier
	and dummy values as placeholders. */
	{
	char countbuf[35];

	snprintf (countbuf, sizeof countbuf, "%lu",
	s2k_count ? s2k_count : get_standard_s2k_count ());
	p = xtryasprintf
	("(9:protected%d:%s((4:sha18:%n_8bytes_%u:%s)%d:%n%s)%d:%n%s)",
	(int)strlen (modestr), modestr,
	&saltpos,
	(unsigned int)strlen (countbuf), countbuf,
	use_ocb? 12 : blklen, &ivpos, use_ocb? 12 : blklen, "",
	enclen, &encpos, enclen, "");
	if (!p)
	{
	gpg_error_t tmperr = out_of_core ();
	xfree (iv);
	xfree (outbuf);
	return tmperr;
	}

	}
	*resultlen = strlen (p);
	result = (unsigned char)p;
	memcpy (p+saltpos, s2ksalt, 8);
	memcpy (p+ivpos, iv, use_ocb? 12 : blklen);
	memcpy (p+encpos, outbuf, enclen);
	xfree (iv);
	xfree (outbuf);
	return 0;
	}



	/* Protect the key encoded in canonical format in PLAINKEY. We assume
	a valid S-Exp here. With USE_UCB set to -1 the default scheme is
	used (ie. either CBC or OCB), set to 0 the old CBC mode is used,
	and set to 1 OCB is used. */
	int
	agent_protect (const unsigned char plainkey, const char passphrase,
	unsigned char *result, size_t resultlen,
	unsigned long s2k_count, int use_ocb)
	{
	int rc;
	const char *parmlist;
	int prot_from_idx, prot_to_idx;
	const unsigned char *s;
	const unsigned char hash_begin, hash_end;
	const unsigned char prot_begin, prot_end, *real_end;
	size_t n;
	int c, infidx, i;
	char timestamp_exp[35];
	unsigned char *protected;
	size_t protectedlen;
	int depth = 0;
	unsigned char *p;
	int have_curve = 0;

	if (use_ocb == -1)
	use_ocb = PROT_DEFAULT_TO_OCB;

	/* Create an S-expression with the protected-at timestamp. */
	memcpy (timestamp_exp, "(12:protected-at15:", 19);
	gnupg_get_isotime (timestamp_exp+19);
	timestamp_exp[19+15] = ')';

	/* Parse original key. */
	s = plainkey;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "private-key"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	depth++;
	hash_begin = s;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);

	for (infidx=0; protect_info[infidx].algo
	&& !smatch (&s, n, protect_info[infidx].algo); infidx++)
	;
	if (!protect_info[infidx].algo)
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);

	/* The parser below is a complete mess: To make it robust for ECC
	use we should reorder the s-expression to include only what we
	really need and thus guarantee the right order for saving stuff.
	This should be done before calling this function and maybe with
	the help of the new gcry_sexp_extract_param. */
	parmlist = protect_info[infidx].parmlist;
	prot_from_idx = protect_info[infidx].prot_from;
	prot_to_idx = protect_info[infidx].prot_to;
	prot_begin = prot_end = NULL;
	for (i=0; (c=parmlist[i]); i++)
	{
	if (i == prot_from_idx)
	prot_begin = s;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (n != 1 \|\| c != *s)
	{
	if (n == 5 && !memcmp (s, "curve", 5)
	&& !i && protect_info[infidx].ecc_hack)
	{
	/* This is a private ECC key but the first parameter is
	the name of the curve. We change the parameter list
	here to the one we expect in this case. */
	have_curve = 1;
	parmlist = "?qd";
	prot_from_idx = 2;
	prot_to_idx = 2;
	}
	else if (n == 5 && !memcmp (s, "flags", 5)
	&& i == 1 && have_curve)
	{
	/* "curve" followed by "flags": Change again. */
	parmlist = "??qd";
	prot_from_idx = 3;
	prot_to_idx = 3;
	}
	else
	return gpg_error (GPG_ERR_INV_SEXP);
	}
	s += n;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s +=n; /* skip value */
	if (*s != ')')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth--;
	if (i == prot_to_idx)
	prot_end = s;
	s++;
	}
	if (*s != ')' \|\| !prot_begin \|\| !prot_end )
	return gpg_error (GPG_ERR_INV_SEXP);
	depth--;
	hash_end = s;
	s++;
	/* Skip to the end of the S-expression. */
	assert (depth == 1);
	rc = sskip (&s, &depth);
	if (rc)
	return rc;
	assert (!depth);
	real_end = s-1;

	rc = do_encryption (hash_begin, hash_end - hash_begin + 1,
	prot_begin, prot_end - prot_begin + 1,
	passphrase, timestamp_exp, sizeof (timestamp_exp),
	&protected, &protectedlen, s2k_count, use_ocb);
	if (rc)
	return rc;

	/* Now create the protected version of the key. Note that the 10
	- extra bytes are for for the inserted "protected-" string (the
	+ extra bytes are for the inserted "protected-" string (the
	beginning of the plaintext reads: "((11:private-key(" ). The 35
	term is the space for (12:protected-at15:<timestamp>). */
	*resultlen = (10
	+ (prot_begin-plainkey)
	+ protectedlen
	+ 35
	+ (real_end-prot_end));
	result = p = xtrymalloc (resultlen);
	if (!p)
	{
	gpg_error_t tmperr = out_of_core ();
	xfree (protected);
	return tmperr;
	}
	memcpy (p, "(21:protected-", 14);
	p += 14;
	memcpy (p, plainkey+4, prot_begin - plainkey - 4);
	p += prot_begin - plainkey - 4;
	memcpy (p, protected, protectedlen);
	p += protectedlen;

	memcpy (p, timestamp_exp, 35);
	p += 35;

	memcpy (p, prot_end+1, real_end - prot_end);
	p += real_end - prot_end;
	assert ( p - result == resultlen);
	xfree (protected);

	return 0;
	}



	/* Do the actual decryption and check the return list for consistency. */
	static int
	do_decryption (const unsigned char *aad_begin, size_t aad_len,
	const unsigned char *aadhole_begin, size_t aadhole_len,
	const unsigned char *protected, size_t protectedlen,
	const char *passphrase,
	const unsigned char *s2ksalt, unsigned long s2kcount,
	const unsigned char *iv, size_t ivlen,
	int prot_cipher, int prot_cipher_keylen, int is_ocb,
	unsigned char **result)
	{
	int rc = 0;
	int blklen;
	gcry_cipher_hd_t hd;
	unsigned char *outbuf;
	size_t reallen;

	blklen = gcry_cipher_get_algo_blklen (prot_cipher);
	if (is_ocb)
	{
	/* OCB does not require a multiple of the block length but we
	* check that it is long enough for the 128 bit tag and that we
	* have the 96 bit nonce. */
	if (protectedlen < (4 + 16) \|\| ivlen != 12)
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	}
	else
	{
	if (protectedlen < 4 \|\| (protectedlen%blklen))
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	}

	rc = gcry_cipher_open (&hd, prot_cipher,
	is_ocb? GCRY_CIPHER_MODE_OCB :
	GCRY_CIPHER_MODE_CBC,
	GCRY_CIPHER_SECURE);
	if (rc)
	return rc;

	outbuf = gcry_malloc_secure (protectedlen);
	if (!outbuf)
	rc = out_of_core ();

	/* Hash the passphrase and set the key. */
	if (!rc)
	{
	unsigned char *key;

	key = gcry_malloc_secure (prot_cipher_keylen);
	if (!key)
	rc = out_of_core ();
	else
	{
	rc = hash_passphrase (passphrase, GCRY_MD_SHA1,
	3, s2ksalt, s2kcount, key, prot_cipher_keylen);
	if (!rc)
	rc = gcry_cipher_setkey (hd, key, prot_cipher_keylen);
	xfree (key);
	}
	}

	/* Set the IV/nonce. */
	if (!rc)
	{
	rc = gcry_cipher_setiv (hd, iv, ivlen);
	}

	/* Decrypt. */
	if (!rc)
	{
	if (is_ocb)
	{
	rc = gcry_cipher_authenticate (hd, aad_begin,
	aadhole_begin - aad_begin);
	if (!rc)
	rc = gcry_cipher_authenticate
	(hd, aadhole_begin + aadhole_len,
	aad_len - (aadhole_begin+aadhole_len - aad_begin));

	if (!rc)
	{
	gcry_cipher_final (hd);
	rc = gcry_cipher_decrypt (hd, outbuf, protectedlen - 16,
	protected, protectedlen - 16);
	}
	if (!rc)
	rc = gcry_cipher_checktag (hd, protected + protectedlen - 16, 16);
	}
	else
	{
	rc = gcry_cipher_decrypt (hd, outbuf, protectedlen,
	protected, protectedlen);
	}
	}

	/* Release cipher handle and check for errors. */
	gcry_cipher_close (hd);
	if (rc)
	{
	xfree (outbuf);
	return rc;
	}

	/* Do a quick check on the data structure. */
	if (*outbuf != '(' && outbuf[1] != '(')
	{
	/* Note that in OCB mode this is actually invalid _encrypted_
	* data and not a bad passphrase. */
	xfree (outbuf);
	return gpg_error (GPG_ERR_BAD_PASSPHRASE);
	}

	/* Check that we have a consistent S-Exp. */
	reallen = gcry_sexp_canon_len (outbuf, protectedlen, NULL, NULL);
	if (!reallen \|\| (reallen + blklen < protectedlen) )
	{
	xfree (outbuf);
	return gpg_error (GPG_ERR_BAD_PASSPHRASE);
	}
	*result = outbuf;
	return 0;
	}


	/* Merge the parameter list contained in CLEARTEXT with the original
	* protect lists PROTECTEDKEY by replacing the list at REPLACEPOS.
	* Return the new list in RESULT and the MIC value in the 20 byte
	* buffer SHA1HASH; if SHA1HASH is NULL no MIC will be computed.
	* CUTOFF and CUTLEN will receive the offset and the length of the
	* resulting list which should go into the MIC calculation but then be
	* removed. */
	static int
	merge_lists (const unsigned char *protectedkey,
	size_t replacepos,
	const unsigned char *cleartext,
	unsigned char *sha1hash,
	unsigned char *result, size_t resultlen,
	size_t cutoff, size_t cutlen)
	{
	size_t n, newlistlen;
	unsigned char newlist, p;
	const unsigned char *s;
	const unsigned char startpos, endpos;
	int i, rc;

	*result = NULL;
	*resultlen = 0;
	*cutoff = 0;
	*cutlen = 0;

	if (replacepos < 26)
	return gpg_error (GPG_ERR_BUG);

	/* Estimate the required size of the resulting list. We have a large
	safety margin of >20 bytes (FIXME: MIC hash from CLEARTEXT and the
	removed "protected-" */
	newlistlen = gcry_sexp_canon_len (protectedkey, 0, NULL, NULL);
	if (!newlistlen)
	return gpg_error (GPG_ERR_BUG);
	n = gcry_sexp_canon_len (cleartext, 0, NULL, NULL);
	if (!n)
	return gpg_error (GPG_ERR_BUG);
	newlistlen += n;
	newlist = gcry_malloc_secure (newlistlen);
	if (!newlist)
	return out_of_core ();

	/* Copy the initial segment */
	strcpy ((char*)newlist, "(11:private-key");
	p = newlist + 15;
	memcpy (p, protectedkey+15+10, replacepos-15-10);
	p += replacepos-15-10;

	/* Copy the cleartext. */
	s = cleartext;
	if (*s != '(' && s[1] != '(')
	return gpg_error (GPG_ERR_BUG); /we already checked this /
	s += 2;
	startpos = s;
	while ( *s == '(' )
	{
	s++;
	n = snext (&s);
	if (!n)
	goto invalid_sexp;
	s += n;
	n = snext (&s);
	if (!n)
	goto invalid_sexp;
	s += n;
	if ( *s != ')' )
	goto invalid_sexp;
	s++;
	}
	if ( *s != ')' )
	goto invalid_sexp;
	endpos = s;
	s++;

	/* Intermezzo: Get the MIC if requested. */
	if (sha1hash)
	{
	if (*s != '(')
	goto invalid_sexp;
	s++;
	n = snext (&s);
	if (!smatch (&s, n, "hash"))
	goto invalid_sexp;
	n = snext (&s);
	if (!smatch (&s, n, "sha1"))
	goto invalid_sexp;
	n = snext (&s);
	if (n != 20)
	goto invalid_sexp;
	memcpy (sha1hash, s, 20);
	s += n;
	if (*s != ')')
	goto invalid_sexp;
	}

	/* Append the parameter list. */
	memcpy (p, startpos, endpos - startpos);
	p += endpos - startpos;

	/* Skip over the protected list element in the original list. */
	s = protectedkey + replacepos;
	assert (*s == '(');
	s++;
	i = 1;
	rc = sskip (&s, &i);
	if (rc)
	goto failure;
	/* Record the position of the optional protected-at expression. */
	if (*s == '(')
	{
	const unsigned char *save_s = s;
	s++;
	n = snext (&s);
	if (smatch (&s, n, "protected-at"))
	{
	i = 1;
	rc = sskip (&s, &i);
	if (rc)
	goto failure;
	*cutlen = s - save_s;
	}
	s = save_s;
	}
	startpos = s;
	i = 2; /* we are inside this level */
	rc = sskip (&s, &i);
	if (rc)
	goto failure;
	assert (s[-1] == ')');
	endpos = s; /* one behind the end of the list */

	/* Append the rest. */
	if (*cutlen)
	*cutoff = p - newlist;
	memcpy (p, startpos, endpos - startpos);
	p += endpos - startpos;


	/* ready */
	*result = newlist;
	*resultlen = newlistlen;
	return 0;

	failure:
	wipememory (newlist, newlistlen);
	xfree (newlist);
	return rc;

	invalid_sexp:
	wipememory (newlist, newlistlen);
	xfree (newlist);
	return gpg_error (GPG_ERR_INV_SEXP);
	}



	/* Unprotect the key encoded in canonical format. We assume a valid
	S-Exp here. If a protected-at item is available, its value will
	be stored at protected_at unless this is NULL. */
	int
	agent_unprotect (ctrl_t ctrl,
	const unsigned char protectedkey, const char passphrase,
	gnupg_isotime_t protected_at,
	unsigned char *result, size_t resultlen)
	{
	static struct {
	const char name; / Name of the protection method. */
	int algo; /* (A zero indicates the "openpgp-native" hack.) */
	int keylen; /* Used key length in bytes. */
	unsigned int is_ocb:1;
	} algotable[] = {
	{ "openpgp-s2k3-sha1-aes-cbc", GCRY_CIPHER_AES128, (128/8)},
	{ "openpgp-s2k3-sha1-aes256-cbc", GCRY_CIPHER_AES256, (256/8)},
	{ "openpgp-s2k3-ocb-aes", GCRY_CIPHER_AES128, (128/8), 1},
	{ "openpgp-native", 0, 0 }
	};
	int rc;
	const unsigned char *s;
	const unsigned char *protect_list;
	size_t n;
	int infidx, i;
	unsigned char sha1hash[20], sha1hash2[20];
	const unsigned char *s2ksalt;
	unsigned long s2kcount;
	const unsigned char *iv;
	int prot_cipher, prot_cipher_keylen;
	int is_ocb;
	const unsigned char aad_begin, aad_end, aadhole_begin, aadhole_end;
	const unsigned char *prot_begin;
	unsigned char *cleartext;
	unsigned char *final;
	size_t finallen;
	size_t cutoff, cutlen;

	if (protected_at)
	*protected_at = 0;

	s = protectedkey;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "protected-private-key"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	{
	aad_begin = aad_end = s;
	aad_end++;
	i = 1;
	rc = sskip (&aad_end, &i);
	if (rc)
	return rc;
	}

	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);

	for (infidx=0; protect_info[infidx].algo
	&& !smatch (&s, n, protect_info[infidx].algo); infidx++)
	;
	if (!protect_info[infidx].algo)
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);

	/* See wether we have a protected-at timestamp. */
	protect_list = s; /* Save for later. */
	if (protected_at)
	{
	while (*s == '(')
	{
	prot_begin = s;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "protected-at"))
	{
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (n != 15)
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	memcpy (protected_at, s, 15);
	protected_at[15] = 0;
	break;
	}
	s += n;
	i = 1;
	rc = sskip (&s, &i);
	if (rc)
	return rc;
	}
	}

	/* Now find the list with the protected information. Here is an
	example for such a list:
	(protected openpgp-s2k3-sha1-aes-cbc
	((sha1 <salt> <count>) <Initialization_Vector>)
	<encrypted_data>)
	*/
	s = protect_list;
	for (;;)
	{
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	prot_begin = s;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "protected"))
	break;
	s += n;
	i = 1;
	rc = sskip (&s, &i);
	if (rc)
	return rc;
	}
	/* found */
	{
	aadhole_begin = aadhole_end = prot_begin;
	aadhole_end++;
	i = 1;
	rc = sskip (&aadhole_end, &i);
	if (rc)
	return rc;
	}
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);

	/* Lookup the protection algo. */
	prot_cipher = 0; /* (avoid gcc warning) */
	prot_cipher_keylen = 0; /* (avoid gcc warning) */
	is_ocb = 0;
	for (i=0; i < DIM (algotable); i++)
	if (smatch (&s, n, algotable[i].name))
	{
	prot_cipher = algotable[i].algo;
	prot_cipher_keylen = algotable[i].keylen;
	is_ocb = algotable[i].is_ocb;
	break;
	}
	if (i == DIM (algotable))
	return gpg_error (GPG_ERR_UNSUPPORTED_PROTECTION);

	if (!prot_cipher) /* This is "openpgp-native". */
	{
	gcry_sexp_t s_prot_begin;

	rc = gcry_sexp_sscan (&s_prot_begin, NULL,
	prot_begin,
	gcry_sexp_canon_len (prot_begin, 0,NULL,NULL));
	if (rc)
	return rc;

	rc = convert_from_openpgp_native (ctrl, s_prot_begin, passphrase, &final);
	gcry_sexp_release (s_prot_begin);
	if (!rc)
	{
	*result = final;
	*resultlen = gcry_sexp_canon_len (final, 0, NULL, NULL);
	}
	return rc;
	}

	if (*s != '(' \|\| s[1] != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	s += 2;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "sha1"))
	return gpg_error (GPG_ERR_UNSUPPORTED_PROTECTION);
	n = snext (&s);
	if (n != 8)
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	s2ksalt = s;
	s += n;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	/* We expect a list close as next, so we can simply use strtoul()
	here. We might want to check that we only have digits - but this
	is nothing we should worry about */
	if (s[n] != ')' )
	return gpg_error (GPG_ERR_INV_SEXP);

	/* Old versions of gpg-agent used the funny floating point number in
	a byte encoding as specified by OpenPGP. However this is not
	needed and thus we now store it as a plain unsigned integer. We
	can easily distinguish the old format by looking at its value:
	Less than 256 is an old-style encoded number; other values are
	plain integers. In any case we check that they are at least
	65536 because we never used a lower value in the past and we
	should have a lower limit. */
	s2kcount = strtoul ((const char*)s, NULL, 10);
	if (!s2kcount)
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	if (s2kcount < 256)
	s2kcount = (16ul + (s2kcount & 15)) << ((s2kcount >> 4) + 6);
	if (s2kcount < 65536)
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);

	s += n;
	s++; /* skip list end */

	n = snext (&s);
	if (is_ocb)
	{
	if (n != 12) /* Wrong size of the nonce. */
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	}
	else
	{
	if (n != 16) /* Wrong blocksize for IV (we support only 128 bit). */
	return gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	}
	iv = s;
	s += n;
	if (*s != ')' )
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);

	cleartext = NULL; /* Avoid cc warning. */
	rc = do_decryption (aad_begin, aad_end - aad_begin,
	aadhole_begin, aadhole_end - aadhole_begin,
	s, n,
	passphrase, s2ksalt, s2kcount,
	iv, is_ocb? 12:16,
	prot_cipher, prot_cipher_keylen, is_ocb,
	&cleartext);
	if (rc)
	return rc;

	rc = merge_lists (protectedkey, prot_begin-protectedkey, cleartext,
	is_ocb? NULL : sha1hash,
	&final, &finallen, &cutoff, &cutlen);
	/* Albeit cleartext has been allocated in secure memory and thus
	xfree will wipe it out, we do an extra wipe just in case
	somethings goes badly wrong. */
	wipememory (cleartext, n);
	xfree (cleartext);
	if (rc)
	return rc;

	if (!is_ocb)
	{
	rc = calculate_mic (final, sha1hash2);
	if (!rc && memcmp (sha1hash, sha1hash2, 20))
	rc = gpg_error (GPG_ERR_CORRUPTED_PROTECTION);
	if (rc)
	{
	wipememory (final, finallen);
	xfree (final);
	return rc;
	}
	}

	/* Now remove the part which is included in the MIC but should not
	go into the final thing. */
	if (cutlen)
	{
	memmove (final+cutoff, final+cutoff+cutlen, finallen-cutoff-cutlen);
	finallen -= cutlen;
	}

	*result = final;
	*resultlen = gcry_sexp_canon_len (final, 0, NULL, NULL);
	return 0;
	}

	/* Check the type of the private key, this is one of the constants:
	PRIVATE_KEY_UNKNOWN if we can't figure out the type (this is the
	value 0), PRIVATE_KEY_CLEAR for an unprotected private key.
	PRIVATE_KEY_PROTECTED for an protected private key or
	PRIVATE_KEY_SHADOWED for a sub key where the secret parts are
	stored elsewhere. Finally PRIVATE_KEY_OPENPGP_NONE may be returned
	is the key is still in the openpgp-native format but without
	protection. */
	int
	agent_private_key_type (const unsigned char *privatekey)
	{
	const unsigned char *s;
	size_t n;
	int i;

	s = privatekey;
	if (*s != '(')
	return PRIVATE_KEY_UNKNOWN;
	s++;
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN;
	if (smatch (&s, n, "protected-private-key"))
	{
	/* We need to check whether this is openpgp-native protected
	with the protection method "none". In that case we return a
	different key type so that the caller knows that there is no
	need to ask for a passphrase. */
	if (*s != '(')
	return PRIVATE_KEY_PROTECTED; /* Unknown sexp - assume protected. */
	s++;
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	s += n; /* Skip over the algo */

	/* Find the (protected ...) list. */
	for (;;)
	{
	if (*s != '(')
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	s++;
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	if (smatch (&s, n, "protected"))
	break;
	s += n;
	i = 1;
	if (sskip (&s, &i))
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	}
	/* Found - Is this openpgp-native? */
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	if (smatch (&s, n, "openpgp-native")) /* Yes. */
	{
	if (*s != '(')
	return PRIVATE_KEY_UNKNOWN; /* Unknown sexp. */
	s++;
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	s += n; /* Skip over "openpgp-private-key". */
	/* Find the (protection ...) list. */
	for (;;)
	{
	if (*s != '(')
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	s++;
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	if (smatch (&s, n, "protection"))
	break;
	s += n;
	i = 1;
	if (sskip (&s, &i))
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	}
	/* Found - Is the mode "none"? */
	n = snext (&s);
	if (!n)
	return PRIVATE_KEY_UNKNOWN; /* Invalid sexp. */
	if (smatch (&s, n, "none"))
	return PRIVATE_KEY_OPENPGP_NONE; /* Yes. */
	}

	return PRIVATE_KEY_PROTECTED;
	}
	if (smatch (&s, n, "shadowed-private-key"))
	return PRIVATE_KEY_SHADOWED;
	if (smatch (&s, n, "private-key"))
	return PRIVATE_KEY_CLEAR;
	return PRIVATE_KEY_UNKNOWN;
	}



	/* Transform a passphrase into a suitable key of length KEYLEN and
	store this key in the caller provided buffer KEY. The caller must
	provide an HASHALGO, a valid S2KMODE (see rfc-2440) and depending on
	that mode an S2KSALT of 8 random bytes and an S2KCOUNT.

	Returns an error code on failure. */
	static int
	hash_passphrase (const char *passphrase, int hashalgo,
	int s2kmode,
	const unsigned char *s2ksalt,
	unsigned long s2kcount,
	unsigned char *key, size_t keylen)
	{
	/* The key derive function does not support a zero length string for
	the passphrase in the S2K modes. Return a better suited error
	code than GPG_ERR_INV_DATA. */
	if (!passphrase \|\| !*passphrase)
	return gpg_error (GPG_ERR_NO_PASSPHRASE);
	return gcry_kdf_derive (passphrase, strlen (passphrase),
	s2kmode == 3? GCRY_KDF_ITERSALTED_S2K :
	s2kmode == 1? GCRY_KDF_SALTED_S2K :
	s2kmode == 0? GCRY_KDF_SIMPLE_S2K : GCRY_KDF_NONE,
	hashalgo, s2ksalt, 8, s2kcount,
	keylen, key);
	}


	gpg_error_t
	s2k_hash_passphrase (const char *passphrase, int hashalgo,
	int s2kmode,
	const unsigned char *s2ksalt,
	unsigned int s2kcount,
	unsigned char *key, size_t keylen)
	{
	return hash_passphrase (passphrase, hashalgo, s2kmode, s2ksalt,
	S2K_DECODE_COUNT (s2kcount),
	key, keylen);
	}




	/* Create an canonical encoded S-expression with the shadow info from
	a card's SERIALNO and the IDSTRING. */
	unsigned char *
	make_shadow_info (const char serialno, const char idstring)
	{
	const char *s;
	char info, p;
	char numbuf[20];
	size_t n;

	for (s=serialno, n=0; *s && s[1]; s += 2)
	n++;

	info = p = xtrymalloc (1 + sizeof numbuf + n
	+ sizeof numbuf + strlen (idstring) + 1 + 1);
	if (!info)
	return NULL;
	*p++ = '(';
	p = stpcpy (p, smklen (numbuf, sizeof numbuf, n, NULL));
	for (s=serialno; *s && s[1]; s += 2)
	(unsigned char )p++ = xtoi_2 (s);
	p = stpcpy (p, smklen (numbuf, sizeof numbuf, strlen (idstring), NULL));
	p = stpcpy (p, idstring);
	*p++ = ')';
	*p = 0;
	return (unsigned char *)info;
	}



	/* Create a shadow key from a public key. We use the shadow protocol
	"ti-v1" and insert the S-expressionn SHADOW_INFO. The resulting
	S-expression is returned in an allocated buffer RESULT will point
	to. The input parameters are expected to be valid canonicalized
	S-expressions */
	int
	agent_shadow_key (const unsigned char *pubkey,
	const unsigned char *shadow_info,
	unsigned char **result)
	{
	const unsigned char *s;
	const unsigned char *point;
	size_t n;
	int depth = 0;
	char *p;
	size_t pubkey_len = gcry_sexp_canon_len (pubkey, 0, NULL,NULL);
	size_t shadow_info_len = gcry_sexp_canon_len (shadow_info, 0, NULL,NULL);

	if (!pubkey_len \|\| !shadow_info_len)
	return gpg_error (GPG_ERR_INV_VALUE);
	s = pubkey;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "public-key"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n; /* skip over the algorithm name */

	while (*s != ')')
	{
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s +=n; /* skip value */
	if (*s != ')')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth--;
	s++;
	}
	point = s; /* insert right before the point */
	depth--;
	s++;
	assert (depth == 1);

	/* Calculate required length by taking in account: the "shadowed-"
	prefix, the "shadowed", "t1-v1" as well as some parenthesis */
	n = 12 + pubkey_len + 1 + 3+8 + 2+5 + shadow_info_len + 1;
	*result = xtrymalloc (n);
	p = (char)result;
	if (!p)
	return out_of_core ();
	p = stpcpy (p, "(20:shadowed-private-key");
	/* (10:public-key ...)*/
	memcpy (p, pubkey+14, point - (pubkey+14));
	p += point - (pubkey+14);
	p = stpcpy (p, "(8:shadowed5:t1-v1");
	memcpy (p, shadow_info, shadow_info_len);
	p += shadow_info_len;
	*p++ = ')';
	memcpy (p, point, pubkey_len - (point - pubkey));
	p += pubkey_len - (point - pubkey);

	return 0;
	}

	/* Parse a canonical encoded shadowed key and return a pointer to the
	inner list with the shadow_info */
	int
	agent_get_shadow_info (const unsigned char *shadowkey,
	unsigned char const **shadow_info)
	{
	const unsigned char *s;
	size_t n;
	int depth = 0;

	s = shadowkey;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (!smatch (&s, n, "shadowed-private-key"))
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n; /* skip over the algorithm name */

	for (;;)
	{
	if (*s == ')')
	return gpg_error (GPG_ERR_UNKNOWN_SEXP);
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth++;
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "shadowed"))
	break;
	s += n;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s +=n; /* skip value */
	if (*s != ')')
	return gpg_error (GPG_ERR_INV_SEXP);
	depth--;
	s++;
	}
	/* Found the shadowed list, S points to the protocol */
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	if (smatch (&s, n, "t1-v1"))
	{
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	*shadow_info = s;
	}
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_PROTOCOL);
	return 0;
	}


	/* Parse the canonical encoded SHADOW_INFO S-expression. On success
	the hex encoded serial number is returned as a malloced strings at
	R_HEXSN and the Id string as a malloced string at R_IDSTR. On
	error an error code is returned and NULL is stored at the result
	parameters addresses. If the serial number or the ID string is not
	required, NULL may be passed for them. */
	gpg_error_t
	parse_shadow_info (const unsigned char *shadow_info,
	char r_hexsn, char r_idstr, int *r_pinlen)
	{
	const unsigned char *s;
	size_t n;

	if (r_hexsn)
	*r_hexsn = NULL;
	if (r_idstr)
	*r_idstr = NULL;
	if (r_pinlen)
	*r_pinlen = 0;

	s = shadow_info;
	if (*s != '(')
	return gpg_error (GPG_ERR_INV_SEXP);
	s++;
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);

	if (r_hexsn)
	{
	*r_hexsn = bin2hex (s, n, NULL);
	if (!*r_hexsn)
	return gpg_error_from_syserror ();
	}
	s += n;

	n = snext (&s);
	if (!n)
	{
	if (r_hexsn)
	{
	xfree (*r_hexsn);
	*r_hexsn = NULL;
	}
	return gpg_error (GPG_ERR_INV_SEXP);
	}

	if (r_idstr)
	{
	*r_idstr = xtrymalloc (n+1);
	if (!*r_idstr)
	{
	if (r_hexsn)
	{
	xfree (*r_hexsn);
	*r_hexsn = NULL;
	}
	return gpg_error_from_syserror ();
	}
	memcpy (*r_idstr, s, n);
	(*r_idstr)[n] = 0;
	}

	/* Parse the optional PINLEN. */
	n = snext (&s);
	if (!n)
	return 0;

	if (r_pinlen)
	{
	char *tmpstr = xtrymalloc (n+1);
	if (!tmpstr)
	{
	if (r_hexsn)
	{
	xfree (*r_hexsn);
	*r_hexsn = NULL;
	}
	if (r_idstr)
	{
	xfree (*r_idstr);
	*r_idstr = NULL;
	}
	return gpg_error_from_syserror ();
	}
	memcpy (tmpstr, s, n);
	tmpstr[n] = 0;

	*r_pinlen = (int)strtol (tmpstr, NULL, 10);
	xfree (tmpstr);
	}

	return 0;
	}
	diff --git a/common/argparse.c b/common/argparse.c
	index b53efcebf..fbe8a37ff 100644
	--- a/common/argparse.c
	+++ b/common/argparse.c
	@@ -1,1631 +1,1631 @@
	/* [argparse.c wk 17.06.97] Argument Parser for option handling
	* Copyright (C) 1998-2001, 2006-2008, 2012 Free Software Foundation, Inc.
	* Copyright (C) 1997-2001, 2006-2008, 2013-2017 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify it
	* under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* GnuPG is distributed in the hope that it will be useful, but
	* WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	* General Public License for more details.
	*
	* You should have received a copies of the GNU General Public License
	* and the GNU Lesser General Public License along with this program;
	* if not, see <https://gnu.org/licenses/>.
	*/

	/* This file may be used as part of GnuPG or standalone. A GnuPG
	build is detected by the presence of the macro GNUPG_MAJOR_VERSION.
	Some feature are only availalbe in the GnuPG build mode.
	*/

	#ifdef HAVE_CONFIG_H
	#include <config.h>
	#endif

	#include <stdio.h>
	#include <stdlib.h>
	#include <ctype.h>
	#include <string.h>
	#include <stdarg.h>
	#include <limits.h>
	#include <errno.h>

	#ifdef GNUPG_MAJOR_VERSION
	# include "util.h"
	# include "common-defs.h"
	# include "i18n.h"
	# include "mischelp.h"
	# include "stringhelp.h"
	# include "logging.h"
	# include "utf8conv.h"
	#endif /GNUPG_MAJOR_VERSION/

	#include "argparse.h"

	/* GnuPG uses GPLv3+ but a standalone version of this defaults to
	GPLv2+ because that is the license of this file. Change this if
	you include it in a program which uses GPLv3. If you don't want to
	- set a a copyright string for your usage() you may also hardcode it
	+ set a copyright string for your usage() you may also hardcode it
	here. */
	#ifndef GNUPG_MAJOR_VERSION

	# define ARGPARSE_GPL_VERSION 2
	# define ARGPARSE_CRIGHT_STR "Copyright (C) YEAR NAME"

	#else /* Used by GnuPG */

	# define ARGPARSE_GPL_VERSION 3
	# define ARGPARSE_CRIGHT_STR "Copyright (C) 2017 Free Software Foundation, Inc."

	#endif /GNUPG_MAJOR_VERSION/

	/* Replacements for standalone builds. */
	#ifndef GNUPG_MAJOR_VERSION
	# ifndef _
	# define _(a) (a)
	# endif
	# ifndef DIM
	# define DIM(v) (sizeof(v)/sizeof((v)[0]))
	# endif
	# define xtrymalloc(a) malloc ((a))
	# define xtryrealloc(a,b) realloc ((a), (b))
	# define xtrystrdup(a) strdup ((a))
	# define xfree(a) free ((a))
	# define log_error my_log_error
	# define log_bug my_log_bug
	# define trim_spaces(a) my_trim_spaces ((a))
	# define map_static_macro_string(a) (a)
	#endif /!GNUPG_MAJOR_VERSION/


	#define ARGPARSE_STR(v) #v
	#define ARGPARSE_STR2(v) ARGPARSE_STR(v)


	/* Replacements for standalone builds. */
	#ifndef GNUPG_MAJOR_VERSION
	static void
	my_log_error (const char *fmt, ...)
	{
	va_list arg_ptr ;

	va_start (arg_ptr, fmt);
	fprintf (stderr, "%s: ", strusage (11));
	vfprintf (stderr, fmt, arg_ptr);
	va_end (arg_ptr);
	}

	static void
	my_log_bug (const char *fmt, ...)
	{
	va_list arg_ptr ;

	va_start (arg_ptr, fmt);
	fprintf (stderr, "%s: Ohhhh jeeee: ", strusage (11));
	vfprintf (stderr, fmt, arg_ptr);
	va_end (arg_ptr);
	abort ();
	}

	/* Return true if the native charset is utf-8. */
	static int
	is_native_utf8 (void)
	{
	return 1;
	}

	static char *
	my_trim_spaces (char *str)
	{
	char string, p, *mark;

	string = str;
	/* Find first non space character. */
	for (p=string; p && isspace ((unsigned char*)p) ; p++)
	;
	/* Move characters. */
	for ((mark = NULL); (string = p); string++, p++)
	if (isspace ((unsigned char)p))
	{
	if (!mark)
	mark = string;
	}
	else
	mark = NULL;
	if (mark)
	mark = '\0' ; / Remove trailing spaces. */

	return str ;
	}

	#endif /!GNUPG_MAJOR_VERSION/



	/*********************************
	* @Summary arg_parse
	* #include "argparse.h"
	*
	* typedef struct {
	* char *argc; pointer to argc (value subject to change)
	* char ***argv; pointer to argv (value subject to change)
	* unsigned flags; Global flags (DO NOT CHANGE)
	* int err; print error about last option
	* 1 = warning, 2 = abort
	* int r_opt; return option
	* int r_type; type of return value (0 = no argument found)
	* union {
	* int ret_int;
	* long ret_long
	* ulong ret_ulong;
	* char *ret_str;
	* } r; Return values
	* struct {
	* int idx;
	* const char *last;
	* void *aliases;
	* } internal; DO NOT CHANGE
	* } ARGPARSE_ARGS;
	*
	* typedef struct {
	* int short_opt;
	* const char *long_opt;
	* unsigned flags;
	* } ARGPARSE_OPTS;
	*
	* int arg_parse( ARGPARSE_ARGS arg, ARGPARSE_OPTS opts );
	*
	* @Description
	* This is my replacement for getopt(). See the example for a typical usage.
	* Global flags are:
	* Bit 0 : Do not remove options form argv
	* Bit 1 : Do not stop at last option but return other args
	* with r_opt set to -1.
	* Bit 2 : Assume options and real args are mixed.
	* Bit 3 : Do not use -- to stop option processing.
	* Bit 4 : Do not skip the first arg.
	* Bit 5 : allow usage of long option with only one dash
	* Bit 6 : ignore --version
	* all other bits must be set to zero, this value is modified by the
	* function, so assume this is write only.
	* Local flags (for each option):
	* Bit 2-0 : 0 = does not take an argument
	* 1 = takes int argument
	* 2 = takes string argument
	* 3 = takes long argument
	* 4 = takes ulong argument
	* Bit 3 : argument is optional (r_type will the be set to 0)
	* Bit 4 : allow 0x etc. prefixed values.
	* Bit 6 : Ignore this option
	* Bit 7 : This is a command and not an option
	* You stop the option processing by setting opts to NULL, the function will
	* then return 0.
	* @Return Value
	* Returns the args.r_opt or 0 if ready
	* r_opt may be -2/-7 to indicate an unknown option/command.
	* @See Also
	* ArgExpand
	* @Notes
	* You do not need to process the options 'h', '--help' or '--version'
	* because this function includes standard help processing; but if you
	* specify '-h', '--help' or '--version' you have to do it yourself.
	* The option '--' stops argument processing; if bit 1 is set the function
	* continues to return normal arguments.
	* To process float args or unsigned args you must use a string args and do
	* the conversion yourself.
	* @Example
	*
	* ARGPARSE_OPTS opts[] = {
	* { 'v', "verbose", 0 },
	* { 'd', "debug", 0 },
	* { 'o', "output", 2 },
	* { 'c', "cross-ref", 2\|8 },
	* { 'm', "my-option", 1\|8 },
	* { 300, "ignored-long-option, ARGPARSE_OP_IGNORE},
	* { 500, "have-no-short-option-for-this-long-option", 0 },
	* {0} };
	* ARGPARSE_ARGS pargs = { &argc, &argv, 0 }
	*
	* while( ArgParse( &pargs, &opts) ) {
	* switch( pargs.r_opt ) {
	* case 'v': opt.verbose++; break;
	* case 'd': opt.debug++; break;
	* case 'o': opt.outfile = pargs.r.ret_str; break;
	* case 'c': opt.crf = pargs.r_type? pargs.r.ret_str:"a.crf"; break;
	* case 'm': opt.myopt = pargs.r_type? pargs.r.ret_int : 1; break;
	* case 500: opt.a_long_one++; break
	* default : pargs.err = 1; break; -- force warning output --
	* }
	* }
	* if( argc > 1 )
	* log_fatal( "Too many args");
	*
	*/

	typedef struct alias_def_s *ALIAS_DEF;
	struct alias_def_s {
	ALIAS_DEF next;
	char name; / malloced buffer with name, \0, value */
	const char value; / ptr into name */
	};


	/* Object to store the names for the --ignore-invalid-option option.
	This is a simple linked list. */
	typedef struct iio_item_def_s *IIO_ITEM_DEF;
	struct iio_item_def_s
	{
	IIO_ITEM_DEF next;
	char name[1]; /* String with the long option name. */
	};

	static const char (strusage_handler)( int ) = NULL;
	static int (custom_outfnc) (int, const char );

	static int set_opt_arg(ARGPARSE_ARGS arg, unsigned flags, char s);
	static void show_help(ARGPARSE_OPTS *opts, unsigned flags);
	static void show_version(void);
	static int writestrings (int is_error, const char *string, ...)
	#if __GNUC__ >= 4
	__attribute__ ((sentinel(0)))
	#endif
	;


	void
	argparse_register_outfnc (int (fnc)(int, const char ))
	{
	custom_outfnc = fnc;
	}


	/* Write STRING and all following const char * arguments either to
	stdout or, if IS_ERROR is set, to stderr. The list of strings must
	be terminated by a NULL. */
	static int
	writestrings (int is_error, const char *string, ...)
	{
	va_list arg_ptr;
	const char *s;
	int count = 0;

	if (string)
	{
	s = string;
	va_start (arg_ptr, string);
	do
	{
	if (custom_outfnc)
	custom_outfnc (is_error? 2:1, s);
	else
	fputs (s, is_error? stderr : stdout);
	count += strlen (s);
	}
	while ((s = va_arg (arg_ptr, const char *)));
	va_end (arg_ptr);
	}
	return count;
	}


	static void
	flushstrings (int is_error)
	{
	if (custom_outfnc)
	custom_outfnc (is_error? 2:1, NULL);
	else
	fflush (is_error? stderr : stdout);
	}


	static void
	initialize( ARGPARSE_ARGS arg, const char filename, unsigned *lineno )
	{
	if( !(arg->flags & (1<<15)) )
	{
	/* Initialize this instance. */
	arg->internal.idx = 0;
	arg->internal.last = NULL;
	arg->internal.inarg = 0;
	arg->internal.stopped = 0;
	arg->internal.aliases = NULL;
	arg->internal.cur_alias = NULL;
	arg->internal.iio_list = NULL;
	arg->err = 0;
	arg->flags \|= 1<<15; /* Mark as initialized. */
	if ( *arg->argc < 0 )
	log_bug ("invalid argument for arg_parse\n");
	}


	if (arg->err)
	{
	/* Last option was erroneous. */
	const char *s;

	if (filename)
	{
	if ( arg->r_opt == ARGPARSE_UNEXPECTED_ARG )
	s = _("argument not expected");
	else if ( arg->r_opt == ARGPARSE_READ_ERROR )
	s = _("read error");
	else if ( arg->r_opt == ARGPARSE_KEYWORD_TOO_LONG )
	s = _("keyword too long");
	else if ( arg->r_opt == ARGPARSE_MISSING_ARG )
	s = _("missing argument");
	else if ( arg->r_opt == ARGPARSE_INVALID_ARG )
	s = _("invalid argument");
	else if ( arg->r_opt == ARGPARSE_INVALID_COMMAND )
	s = _("invalid command");
	else if ( arg->r_opt == ARGPARSE_INVALID_ALIAS )
	s = _("invalid alias definition");
	else if ( arg->r_opt == ARGPARSE_OUT_OF_CORE )
	s = _("out of core");
	else
	s = _("invalid option");
	log_error ("%s:%u: %s\n", filename, *lineno, s);
	}
	else
	{
	s = arg->internal.last? arg->internal.last:"[??]";

	if ( arg->r_opt == ARGPARSE_MISSING_ARG )
	log_error (_("missing argument for option \"%.50s\"\n"), s);
	else if ( arg->r_opt == ARGPARSE_INVALID_ARG )
	log_error (_("invalid argument for option \"%.50s\"\n"), s);
	else if ( arg->r_opt == ARGPARSE_UNEXPECTED_ARG )
	log_error (_("option \"%.50s\" does not expect an argument\n"), s);
	else if ( arg->r_opt == ARGPARSE_INVALID_COMMAND )
	log_error (_("invalid command \"%.50s\"\n"), s);
	else if ( arg->r_opt == ARGPARSE_AMBIGUOUS_OPTION )
	log_error (_("option \"%.50s\" is ambiguous\n"), s);
	else if ( arg->r_opt == ARGPARSE_AMBIGUOUS_COMMAND )
	log_error (_("command \"%.50s\" is ambiguous\n"),s );
	else if ( arg->r_opt == ARGPARSE_OUT_OF_CORE )
	log_error ("%s\n", _("out of core\n"));
	else
	log_error (_("invalid option \"%.50s\"\n"), s);
	}
	if (arg->err != ARGPARSE_PRINT_WARNING)
	exit (2);
	arg->err = 0;
	}

	/* Zero out the return value union. */
	arg->r.ret_str = NULL;
	arg->r.ret_long = 0;
	}


	static void
	store_alias( ARGPARSE_ARGS arg, char name, char *value )
	{
	/* TODO: replace this dummy function with a rea one
	* and fix the probelms IRIX has with (ALIAS_DEV)arg..
	* used as lvalue
	*/
	(void)arg;
	(void)name;
	(void)value;
	#if 0
	ALIAS_DEF a = xmalloc( sizeof *a );
	a->name = name;
	a->value = value;
	a->next = (ALIAS_DEF)arg->internal.aliases;
	(ALIAS_DEF)arg->internal.aliases = a;
	#endif
	}


	/* Return true if KEYWORD is in the ignore-invalid-option list. */
	static int
	ignore_invalid_option_p (ARGPARSE_ARGS arg, const char keyword)
	{
	IIO_ITEM_DEF item = arg->internal.iio_list;

	for (; item; item = item->next)
	if (!strcmp (item->name, keyword))
	return 1;
	return 0;
	}


	/* Add the keywords up to the next LF to the list of to be ignored
	options. After returning FP will either be at EOF or the next
	character read wll be the first of a new line. The function
	returns 0 on success or true on malloc failure. */
	static int
	ignore_invalid_option_add (ARGPARSE_ARGS arg, FILE fp)
	{
	IIO_ITEM_DEF item;
	int c;
	char name[100];
	int namelen = 0;
	int ready = 0;
	enum { skipWS, collectNAME, skipNAME, addNAME} state = skipWS;

	while (!ready)
	{
	c = getc (fp);
	if (c == '\n')
	ready = 1;
	else if (c == EOF)
	{
	c = '\n';
	ready = 1;
	}
	again:
	switch (state)
	{
	case skipWS:
	if (!isascii (c) \|\| !isspace(c))
	{
	namelen = 0;
	state = collectNAME;
	goto again;
	}
	break;

	case collectNAME:
	if (isspace (c))
	{
	state = addNAME;
	goto again;
	}
	else if (namelen < DIM(name)-1)
	name[namelen++] = c;
	else /* Too long. */
	state = skipNAME;
	break;

	case skipNAME:
	if (isspace (c))
	{
	state = skipWS;
	goto again;
	}
	break;

	case addNAME:
	name[namelen] = 0;
	if (!ignore_invalid_option_p (arg, name))
	{
	item = xtrymalloc (sizeof *item + namelen);
	if (!item)
	return 1;
	strcpy (item->name, name);
	item->next = (IIO_ITEM_DEF)arg->internal.iio_list;
	arg->internal.iio_list = item;
	}
	state = skipWS;
	goto again;
	}
	}
	return 0;
	}


	/* Clear the entire ignore-invalid-option list. */
	static void
	ignore_invalid_option_clear (ARGPARSE_ARGS *arg)
	{
	IIO_ITEM_DEF item, tmpitem;

	for (item = arg->internal.iio_list; item; item = tmpitem)
	{
	tmpitem = item->next;
	xfree (item);
	}
	arg->internal.iio_list = NULL;
	}



	/****************
	* Get options from a file.
	* Lines starting with '#' are comment lines.
	* Syntax is simply a keyword and the argument.
	* Valid keywords are all keywords from the long_opt list without
	* the leading dashes. The special keywords "help", "warranty" and "version"
	* are not valid here.
	* The special keyword "alias" may be used to store alias definitions,
	* which are later expanded like long options.
	* The option
	* ignore-invalid-option OPTIONNAMEs
	* is recognized and updates a list of option which should be ignored if they
	* are not defined.
	* Caller must free returned strings.
	* If called with FP set to NULL command line args are parse instead.
	*
	* Q: Should we allow the syntax
	* keyword = value
	* and accept for boolean options a value of 1/0, yes/no or true/false?
	* Note: Abbreviation of options is here not allowed.
	*/
	int
	optfile_parse (FILE fp, const char filename, unsigned *lineno,
	ARGPARSE_ARGS arg, ARGPARSE_OPTS opts)
	{
	int state, i, c;
	int idx=0;
	char keyword[100];
	char *buffer = NULL;
	size_t buflen = 0;
	int in_alias=0;
	int unread_buf[3]; /* We use an int so that we can store EOF. */
	int unread_buf_count = 0;

	- if (!fp) /* Divert to to arg_parse() in this case. */
	+ if (!fp) /* Divert to arg_parse() in this case. */
	return arg_parse (arg, opts);

	initialize (arg, filename, lineno);

	/* If the LINENO is zero we assume that we are at the start of a
	* file and we skip over a possible Byte Order Mark. */
	if (!*lineno)
	{
	unread_buf[0] = getc (fp);
	unread_buf[1] = getc (fp);
	unread_buf[2] = getc (fp);
	if (unread_buf[0] != 0xef
	\|\| unread_buf[1] != 0xbb
	\|\| unread_buf[2] != 0xbf)
	unread_buf_count = 3;
	}

	/* Find the next keyword. */
	state = i = 0;
	for (;;)
	{
	if (unread_buf_count)
	c = unread_buf[3 - unread_buf_count--];
	else
	c = getc (fp);
	if (c == '\n' \|\| c== EOF )
	{
	if ( c != EOF )
	++*lineno;
	if (state == -1)
	break;
	else if (state == 2)
	{
	keyword[i] = 0;
	for (i=0; opts[i].short_opt; i++ )
	{
	if (opts[i].long_opt && !strcmp (opts[i].long_opt, keyword))
	break;
	}
	idx = i;
	arg->r_opt = opts[idx].short_opt;
	if ((opts[idx].flags & ARGPARSE_OPT_IGNORE))
	{
	state = i = 0;
	continue;
	}
	else if (!opts[idx].short_opt )
	{
	if (!strcmp (keyword, "ignore-invalid-option"))
	{
	/* No argument - ignore this meta option. */
	state = i = 0;
	continue;
	}
	else if (ignore_invalid_option_p (arg, keyword))
	{
	/* This invalid option is in the iio list. */
	state = i = 0;
	continue;
	}
	arg->r_opt = ((opts[idx].flags & ARGPARSE_OPT_COMMAND)
	? ARGPARSE_INVALID_COMMAND
	: ARGPARSE_INVALID_OPTION);
	}
	else if (!(opts[idx].flags & ARGPARSE_TYPE_MASK))
	arg->r_type = 0; /* Does not take an arg. */
	else if ((opts[idx].flags & ARGPARSE_OPT_OPTIONAL) )
	arg->r_type = 0; /* Arg is optional. */
	else
	arg->r_opt = ARGPARSE_MISSING_ARG;

	break;
	}
	else if (state == 3)
	{
	/* No argument found. */
	if (in_alias)
	arg->r_opt = ARGPARSE_MISSING_ARG;
	else if (!(opts[idx].flags & ARGPARSE_TYPE_MASK))
	arg->r_type = 0; /* Does not take an arg. */
	else if ((opts[idx].flags & ARGPARSE_OPT_OPTIONAL))
	arg->r_type = 0; /* No optional argument. */
	else
	arg->r_opt = ARGPARSE_MISSING_ARG;

	break;
	}
	else if (state == 4)
	{
	/* Has an argument. */
	if (in_alias)
	{
	if (!buffer)
	arg->r_opt = ARGPARSE_UNEXPECTED_ARG;
	else
	{
	char *p;

	buffer[i] = 0;
	p = strpbrk (buffer, " \t");
	if (p)
	{
	*p++ = 0;
	trim_spaces (p);
	}
	if (!p \|\| !*p)
	{
	xfree (buffer);
	arg->r_opt = ARGPARSE_INVALID_ALIAS;
	}
	else
	{
	store_alias (arg, buffer, p);
	}
	}
	}
	else if (!(opts[idx].flags & ARGPARSE_TYPE_MASK))
	arg->r_opt = ARGPARSE_UNEXPECTED_ARG;
	else
	{
	char *p;

	if (!buffer)
	{
	keyword[i] = 0;
	buffer = xtrystrdup (keyword);
	if (!buffer)
	arg->r_opt = ARGPARSE_OUT_OF_CORE;
	}
	else
	buffer[i] = 0;

	if (buffer)
	{
	trim_spaces (buffer);
	p = buffer;
	if (*p == '"')
	{
	/* Remove quotes. */
	p++;
	if (*p && p[strlen(p)-1] == '\"' )
	p[strlen(p)-1] = 0;
	}
	if (!set_opt_arg (arg, opts[idx].flags, p))
	xfree (buffer);
	else
	gpgrt_annotate_leaked_object (buffer);
	}
	}
	break;
	}
	else if (c == EOF)
	{
	ignore_invalid_option_clear (arg);
	if (ferror (fp))
	arg->r_opt = ARGPARSE_READ_ERROR;
	else
	arg->r_opt = 0; /* EOF. */
	break;
	}
	state = 0;
	i = 0;
	}
	else if (state == -1)
	; /* Skip. */
	else if (state == 0 && isascii (c) && isspace(c))
	; /* Skip leading white space. */
	else if (state == 0 && c == '#' )
	state = 1; /* Start of a comment. */
	else if (state == 1)
	; /* Skip comments. */
	else if (state == 2 && isascii (c) && isspace(c))
	{
	/* Check keyword. */
	keyword[i] = 0;
	for (i=0; opts[i].short_opt; i++ )
	if (opts[i].long_opt && !strcmp (opts[i].long_opt, keyword))
	break;
	idx = i;
	arg->r_opt = opts[idx].short_opt;
	if ((opts[idx].flags & ARGPARSE_OPT_IGNORE))
	{
	state = 1; /* Process like a comment. */
	}
	else if (!opts[idx].short_opt)
	{
	if (!strcmp (keyword, "alias"))
	{
	in_alias = 1;
	state = 3;
	}
	else if (!strcmp (keyword, "ignore-invalid-option"))
	{
	if (ignore_invalid_option_add (arg, fp))
	{
	arg->r_opt = ARGPARSE_OUT_OF_CORE;
	break;
	}
	state = i = 0;
	++*lineno;
	}
	else if (ignore_invalid_option_p (arg, keyword))
	state = 1; /* Process like a comment. */
	else
	{
	arg->r_opt = ((opts[idx].flags & ARGPARSE_OPT_COMMAND)
	? ARGPARSE_INVALID_COMMAND
	: ARGPARSE_INVALID_OPTION);
	state = -1; /* Skip rest of line and leave. */
	}
	}
	else
	state = 3;
	}
	else if (state == 3)
	{
	/* Skip leading spaces of the argument. */
	if (!isascii (c) \|\| !isspace(c))
	{
	i = 0;
	keyword[i++] = c;
	state = 4;
	}
	}
	else if (state == 4)
	{
	/* Collect the argument. */
	if (buffer)
	{
	if (i < buflen-1)
	buffer[i++] = c;
	else
	{
	char *tmp;
	size_t tmplen = buflen + 50;

	tmp = xtryrealloc (buffer, tmplen);
	if (tmp)
	{
	buflen = tmplen;
	buffer = tmp;
	buffer[i++] = c;
	}
	else
	{
	xfree (buffer);
	arg->r_opt = ARGPARSE_OUT_OF_CORE;
	break;
	}
	}
	}
	else if (i < DIM(keyword)-1)
	keyword[i++] = c;
	else
	{
	size_t tmplen = DIM(keyword) + 50;
	buffer = xtrymalloc (tmplen);
	if (buffer)
	{
	buflen = tmplen;
	memcpy(buffer, keyword, i);
	buffer[i++] = c;
	}
	else
	{
	arg->r_opt = ARGPARSE_OUT_OF_CORE;
	break;
	}
	}
	}
	else if (i >= DIM(keyword)-1)
	{
	arg->r_opt = ARGPARSE_KEYWORD_TOO_LONG;
	state = -1; /* Skip rest of line and leave. */
	}
	else
	{
	keyword[i++] = c;
	state = 2;
	}
	}

	return arg->r_opt;
	}



	static int
	find_long_option( ARGPARSE_ARGS *arg,
	ARGPARSE_OPTS opts, const char keyword )
	{
	int i;
	size_t n;

	(void)arg;

	/* Would be better if we can do a binary search, but it is not
	possible to reorder our option table because we would mess
	up our help strings - What we can do is: Build a nice option
	lookup table when this function is first invoked */
	if( !*keyword )
	return -1;
	for(i=0; opts[i].short_opt; i++ )
	if( opts[i].long_opt && !strcmp( opts[i].long_opt, keyword) )
	return i;
	#if 0
	{
	ALIAS_DEF a;
	/* see whether it is an alias */
	for( a = args->internal.aliases; a; a = a->next ) {
	if( !strcmp( a->name, keyword) ) {
	/* todo: must parse the alias here */
	args->internal.cur_alias = a;
	return -3; /* alias available */
	}
	}
	}
	#endif
	/* not found, see whether it is an abbreviation */
	/* aliases may not be abbreviated */
	n = strlen( keyword );
	for(i=0; opts[i].short_opt; i++ ) {
	if( opts[i].long_opt && !strncmp( opts[i].long_opt, keyword, n ) ) {
	int j;
	for(j=i+1; opts[j].short_opt; j++ ) {
	if( opts[j].long_opt
	&& !strncmp( opts[j].long_opt, keyword, n )
	&& !(opts[j].short_opt == opts[i].short_opt
	&& opts[j].flags == opts[i].flags ) )
	return -2; /* abbreviation is ambiguous */
	}
	return i;
	}
	}
	return -1; /* Not found. */
	}

	int
	arg_parse( ARGPARSE_ARGS arg, ARGPARSE_OPTS opts)
	{
	int idx;
	int argc;
	char **argv;
	char s, s2;
	int i;

	initialize( arg, NULL, NULL );
	argc = *arg->argc;
	argv = *arg->argv;
	idx = arg->internal.idx;

	if (!idx && argc && !(arg->flags & ARGPARSE_FLAG_ARG0))
	{
	/* Skip the first argument. */
	argc--; argv++; idx++;
	}

	next_one:
	if (!argc)
	{
	/* No more args. */
	arg->r_opt = 0;
	goto leave; /* Ready. */
	}

	s = *argv;
	arg->internal.last = s;

	if (arg->internal.stopped && (arg->flags & ARGPARSE_FLAG_ALL))
	{
	arg->r_opt = ARGPARSE_IS_ARG; /* Not an option but an argument. */
	arg->r_type = 2;
	arg->r.ret_str = s;
	argc--; argv++; idx++; /* set to next one */
	}
	else if( arg->internal.stopped )
	{
	arg->r_opt = 0;
	goto leave; /* Ready. */
	}
	else if ( *s == '-' && s[1] == '-' )
	{
	/* Long option. */
	char *argpos;

	arg->internal.inarg = 0;
	if (!s[2] && !(arg->flags & ARGPARSE_FLAG_NOSTOP))
	{
	/* Stop option processing. */
	arg->internal.stopped = 1;
	arg->flags \|= ARGPARSE_FLAG_STOP_SEEN;
	argc--; argv++; idx++;
	goto next_one;
	}

	argpos = strchr( s+2, '=' );
	if ( argpos )
	*argpos = 0;
	i = find_long_option ( arg, opts, s+2 );
	if ( argpos )
	*argpos = '=';

	if ( i < 0 && !strcmp ( "help", s+2) )
	show_help (opts, arg->flags);
	else if ( i < 0 && !strcmp ( "version", s+2) )
	{
	if (!(arg->flags & ARGPARSE_FLAG_NOVERSION))
	{
	show_version ();
	exit(0);
	}
	}
	else if ( i < 0 && !strcmp( "warranty", s+2))
	{
	writestrings (0, strusage (16), "\n", NULL);
	exit (0);
	}
	else if ( i < 0 && !strcmp( "dump-options", s+2) )
	{
	for (i=0; opts[i].short_opt; i++ )
	{
	if (opts[i].long_opt && !(opts[i].flags & ARGPARSE_OPT_IGNORE))
	writestrings (0, "--", opts[i].long_opt, "\n", NULL);
	}
	writestrings (0, "--dump-options\n--help\n--version\n--warranty\n",
	NULL);
	exit (0);
	}

	if ( i == -2 )
	arg->r_opt = ARGPARSE_AMBIGUOUS_OPTION;
	else if ( i == -1 )
	{
	arg->r_opt = ARGPARSE_INVALID_OPTION;
	arg->r.ret_str = s+2;
	}
	else
	arg->r_opt = opts[i].short_opt;
	if ( i < 0 )
	;
	else if ( (opts[i].flags & ARGPARSE_TYPE_MASK) )
	{
	if ( argpos )
	{
	s2 = argpos+1;
	if ( !*s2 )
	s2 = NULL;
	}
	else
	s2 = argv[1];
	if ( !s2 && (opts[i].flags & ARGPARSE_OPT_OPTIONAL) )
	{
	arg->r_type = ARGPARSE_TYPE_NONE; /* Argument is optional. */
	}
	else if ( !s2 )
	{
	arg->r_opt = ARGPARSE_MISSING_ARG;
	}
	else if ( !argpos && *s2 == '-'
	&& (opts[i].flags & ARGPARSE_OPT_OPTIONAL) )
	{
	/* The argument is optional and the next seems to be an
	option. We do not check this possible option but
	assume no argument */
	arg->r_type = ARGPARSE_TYPE_NONE;
	}
	else
	{
	set_opt_arg (arg, opts[i].flags, s2);
	if ( !argpos )
	{
	argc--; argv++; idx++; /* Skip one. */
	}
	}
	}
	else
	{
	/* Does not take an argument. */
	if ( argpos )
	arg->r_type = ARGPARSE_UNEXPECTED_ARG;
	else
	arg->r_type = 0;
	}
	argc--; argv++; idx++; /* Set to next one. */
	}
	else if ( (*s == '-' && s[1]) \|\| arg->internal.inarg )
	{
	/* Short option. */
	int dash_kludge = 0;

	i = 0;
	if ( !arg->internal.inarg )
	{
	arg->internal.inarg++;
	if ( (arg->flags & ARGPARSE_FLAG_ONEDASH) )
	{
	for (i=0; opts[i].short_opt; i++ )
	if ( opts[i].long_opt && !strcmp (opts[i].long_opt, s+1))
	{
	dash_kludge = 1;
	break;
	}
	}
	}
	s += arg->internal.inarg;

	if (!dash_kludge )
	{
	for (i=0; opts[i].short_opt; i++ )
	if ( opts[i].short_opt == *s )
	break;
	}

	if ( !opts[i].short_opt && ( s == 'h' \|\| s == '?' ) )
	show_help (opts, arg->flags);

	arg->r_opt = opts[i].short_opt;
	if (!opts[i].short_opt )
	{
	arg->r_opt = (opts[i].flags & ARGPARSE_OPT_COMMAND)?
	ARGPARSE_INVALID_COMMAND:ARGPARSE_INVALID_OPTION;
	arg->internal.inarg++; /* Point to the next arg. */
	arg->r.ret_str = s;
	}
	else if ( (opts[i].flags & ARGPARSE_TYPE_MASK) )
	{
	if ( s[1] && !dash_kludge )
	{
	s2 = s+1;
	set_opt_arg (arg, opts[i].flags, s2);
	}
	else
	{
	s2 = argv[1];
	if ( !s2 && (opts[i].flags & ARGPARSE_OPT_OPTIONAL) )
	{
	arg->r_type = ARGPARSE_TYPE_NONE;
	}
	else if ( !s2 )
	{
	arg->r_opt = ARGPARSE_MISSING_ARG;
	}
	else if ( *s2 == '-' && s2[1]
	&& (opts[i].flags & ARGPARSE_OPT_OPTIONAL) )
	{
	/* The argument is optional and the next seems to
	be an option. We do not check this possible
	option but assume no argument. */
	arg->r_type = ARGPARSE_TYPE_NONE;
	}
	else
	{
	set_opt_arg (arg, opts[i].flags, s2);
	argc--; argv++; idx++; /* Skip one. */
	}
	}
	s = "x"; /* This is so that !s[1] yields false. */
	}
	else
	{
	/* Does not take an argument. */
	arg->r_type = ARGPARSE_TYPE_NONE;
	arg->internal.inarg++; /* Point to the next arg. */
	}
	if ( !s[1] \|\| dash_kludge )
	{
	/* No more concatenated short options. */
	arg->internal.inarg = 0;
	argc--; argv++; idx++;
	}
	}
	else if ( arg->flags & ARGPARSE_FLAG_MIXED )
	{
	arg->r_opt = ARGPARSE_IS_ARG;
	arg->r_type = 2;
	arg->r.ret_str = s;
	argc--; argv++; idx++; /* Set to next one. */
	}
	else
	{
	arg->internal.stopped = 1; /* Stop option processing. */
	goto next_one;
	}

	leave:
	*arg->argc = argc;
	*arg->argv = argv;
	arg->internal.idx = idx;
	return arg->r_opt;
	}


	/* Returns: -1 on error, 0 for an integer type and 1 for a non integer
	type argument. */
	static int
	set_opt_arg (ARGPARSE_ARGS arg, unsigned flags, char s)
	{
	int base = (flags & ARGPARSE_OPT_PREFIX)? 0 : 10;
	long l;

	switch ( (arg->r_type = (flags & ARGPARSE_TYPE_MASK)) )
	{
	case ARGPARSE_TYPE_LONG:
	case ARGPARSE_TYPE_INT:
	errno = 0;
	l = strtol (s, NULL, base);
	if ((l == LONG_MIN \|\| l == LONG_MAX) && errno == ERANGE)
	{
	arg->r_opt = ARGPARSE_INVALID_ARG;
	return -1;
	}
	if (arg->r_type == ARGPARSE_TYPE_LONG)
	arg->r.ret_long = l;
	else if ( (l < 0 && l < INT_MIN) \|\| l > INT_MAX )
	{
	arg->r_opt = ARGPARSE_INVALID_ARG;
	return -1;
	}
	else
	arg->r.ret_int = (int)l;
	return 0;

	case ARGPARSE_TYPE_ULONG:
	while (isascii (s) && isspace(s))
	s++;
	if (*s == '-')
	{
	arg->r.ret_ulong = 0;
	arg->r_opt = ARGPARSE_INVALID_ARG;
	return -1;
	}
	errno = 0;
	arg->r.ret_ulong = strtoul (s, NULL, base);
	if (arg->r.ret_ulong == ULONG_MAX && errno == ERANGE)
	{
	arg->r_opt = ARGPARSE_INVALID_ARG;
	return -1;
	}
	return 0;

	case ARGPARSE_TYPE_STRING:
	default:
	arg->r.ret_str = s;
	return 1;
	}
	}


	static size_t
	long_opt_strlen( ARGPARSE_OPTS *o )
	{
	size_t n = strlen (o->long_opt);

	if ( o->description && *o->description == '\|' )
	{
	const char *s;
	int is_utf8 = is_native_utf8 ();

	s=o->description+1;
	if ( *s != '=' )
	n++;
	/* For a (mostly) correct length calculation we exclude
	continuation bytes (10xxxxxx) if we are on a native utf8
	terminal. */
	for (; s && s != '\|'; s++ )
	if ( is_utf8 && (*s&0xc0) != 0x80 )
	n++;
	}
	return n;
	}


	/****************
	* Print formatted help. The description string has some special
	* meanings:
	* - A description string which is "@" suppresses help output for
	* this option
	* - a description,ine which starts with a '@' and is followed by
	* any other characters is printed as is; this may be used for examples
	* ans such.
	* - A description which starts with a '\|' outputs the string between this
	* bar and the next one as arguments of the long option.
	*/
	static void
	show_help (ARGPARSE_OPTS *opts, unsigned int flags)
	{
	const char *s;
	char tmp[2];

	show_version ();
	writestrings (0, "\n", NULL);
	s = strusage (42);
	if (s && *s == '1')
	{
	s = strusage (40);
	writestrings (1, s, NULL);
	if (*s && s[strlen(s)] != '\n')
	writestrings (1, "\n", NULL);
	}
	s = strusage(41);
	writestrings (0, s, "\n", NULL);
	if ( opts[0].description )
	{
	/* Auto format the option description. */
	int i,j, indent;

	/* Get max. length of long options. */
	for (i=indent=0; opts[i].short_opt; i++ )
	{
	if ( opts[i].long_opt )
	if ( !opts[i].description \|\| *opts[i].description != '@' )
	if ( (j=long_opt_strlen(opts+i)) > indent && j < 35 )
	indent = j;
	}

	/* Example: " -v, --verbose Viele Sachen ausgeben" */
	indent += 10;
	if ( *opts[0].description != '@' )
	writestrings (0, "Options:", "\n", NULL);
	for (i=0; opts[i].short_opt; i++ )
	{
	s = map_static_macro_string (_( opts[i].description ));
	if ( s && s== '@' && !s[1] ) / Hide this line. */
	continue;
	if ( s && s == '@' ) / Unindented comment only line. */
	{
	for (s++; *s; s++ )
	{
	if ( *s == '\n' )
	{
	if( s[1] )
	writestrings (0, "\n", NULL);
	}
	else
	{
	tmp[0] = *s;
	tmp[1] = 0;
	writestrings (0, tmp, NULL);
	}
	}
	writestrings (0, "\n", NULL);
	continue;
	}

	j = 3;
	if ( opts[i].short_opt < 256 )
	{
	tmp[0] = opts[i].short_opt;
	tmp[1] = 0;
	writestrings (0, " -", tmp, NULL );
	if ( !opts[i].long_opt )
	{
	if (s && *s == '\|' )
	{
	writestrings (0, " ", NULL); j++;
	for (s++ ; s && s != '\|'; s++, j++ )
	{
	tmp[0] = *s;
	tmp[1] = 0;
	writestrings (0, tmp, NULL);
	}
	if ( *s )
	s++;
	}
	}
	}
	else
	writestrings (0, " ", NULL);
	if ( opts[i].long_opt )
	{
	tmp[0] = opts[i].short_opt < 256?',':' ';
	tmp[1] = 0;
	j += writestrings (0, tmp, " --", opts[i].long_opt, NULL);
	if (s && *s == '\|' )
	{
	if ( *++s != '=' )
	{
	writestrings (0, " ", NULL);
	j++;
	}
	for ( ; s && s != '\|'; s++, j++ )
	{
	tmp[0] = *s;
	tmp[1] = 0;
	writestrings (0, tmp, NULL);
	}
	if ( *s )
	s++;
	}
	writestrings (0, " ", NULL);
	j += 3;
	}
	for (;j < indent; j++ )
	writestrings (0, " ", NULL);
	if ( s )
	{
	if ( *s && j > indent )
	{
	writestrings (0, "\n", NULL);
	for (j=0;j < indent; j++ )
	writestrings (0, " ", NULL);
	}
	for (; *s; s++ )
	{
	if ( *s == '\n' )
	{
	if ( s[1] )
	{
	writestrings (0, "\n", NULL);
	for (j=0; j < indent; j++ )
	writestrings (0, " ", NULL);
	}
	}
	else
	{
	tmp[0] = *s;
	tmp[1] = 0;
	writestrings (0, tmp, NULL);
	}
	}
	}
	writestrings (0, "\n", NULL);
	}
	if ( (flags & ARGPARSE_FLAG_ONEDASH) )
	writestrings (0, "\n(A single dash may be used "
	"instead of the double ones)\n", NULL);
	}
	if ( (s=strusage(19)) )
	{
	writestrings (0, "\n", NULL);
	writestrings (0, s, NULL);
	}
	flushstrings (0);
	exit(0);
	}

	static void
	show_version ()
	{
	const char *s;
	int i;

	/* Version line. */
	writestrings (0, strusage (11), NULL);
	if ((s=strusage (12)))
	writestrings (0, " (", s, ")", NULL);
	writestrings (0, " ", strusage (13), "\n", NULL);
	/* Additional version lines. */
	for (i=20; i < 30; i++)
	if ((s=strusage (i)))
	writestrings (0, s, "\n", NULL);
	/* Copyright string. */
	if ((s=strusage (14)))
	writestrings (0, s, "\n", NULL);
	/* Licence string. */
	if( (s=strusage (10)) )
	writestrings (0, s, "\n", NULL);
	/* Copying conditions. */
	if ( (s=strusage(15)) )
	writestrings (0, s, NULL);
	/* Thanks. */
	if ((s=strusage(18)))
	writestrings (0, s, NULL);
	/* Additional program info. */
	for (i=30; i < 40; i++ )
	if ( (s=strusage (i)) )
	writestrings (0, s, NULL);
	flushstrings (0);
	}


	void
	usage (int level)
	{
	const char *p;

	if (!level)
	{
	writestrings (1, strusage(11), " ", strusage(13), "; ",
	strusage (14), "\n", NULL);
	flushstrings (1);
	}
	else if (level == 1)
	{
	p = strusage (40);
	writestrings (1, p, NULL);
	if (*p && p[strlen(p)] != '\n')
	writestrings (1, "\n", NULL);
	exit (2);
	}
	else if (level == 2)
	{
	p = strusage (42);
	if (p && *p == '1')
	{
	p = strusage (40);
	writestrings (1, p, NULL);
	if (*p && p[strlen(p)] != '\n')
	writestrings (1, "\n", NULL);
	}
	writestrings (0, strusage(41), "\n", NULL);
	exit (0);
	}
	}

	/* Level
	* 0: Print copyright string to stderr
	* 1: Print a short usage hint to stderr and terminate
	* 2: Print a long usage hint to stdout and terminate
	* 10: Return license info string
	* 11: Return the name of the program
	* 12: Return optional name of package which includes this program.
	* 13: version string
	* 14: copyright string
	* 15: Short copying conditions (with LFs)
	* 16: Long copying conditions (with LFs)
	* 17: Optional printable OS name
	* 18: Optional thanks list (with LFs)
	* 19: Bug report info
	*20..29: Additional lib version strings.
	*30..39: Additional program info (with LFs)
	* 40: short usage note (with LF)
	* 41: long usage note (with LF)
	* 42: Flag string:
	* First char is '1':
	* The short usage notes needs to be printed
	* before the long usage note.
	*/
	const char *
	strusage( int level )
	{
	const char *p = strusage_handler? strusage_handler(level) : NULL;

	if ( p )
	return map_static_macro_string (p);

	switch ( level )
	{

	case 10:
	#if ARGPARSE_GPL_VERSION == 3
	p = ("License GPLv3+: GNU GPL version 3 or later "
	"<https://gnu.org/licenses/gpl.html>");
	#else
	p = ("License GPLv2+: GNU GPL version 2 or later "
	"<https://gnu.org/licenses/>");
	#endif
	break;
	case 11: p = "foo"; break;
	case 13: p = "0.0"; break;
	case 14: p = ARGPARSE_CRIGHT_STR; break;
	case 15: p =
	"This is free software: you are free to change and redistribute it.\n"
	"There is NO WARRANTY, to the extent permitted by law.\n";
	break;
	case 16: p =
	"This is free software; you can redistribute it and/or modify\n"
	"it under the terms of the GNU General Public License as published by\n"
	"the Free Software Foundation; either version "
	ARGPARSE_STR2(ARGPARSE_GPL_VERSION)
	" of the License, or\n"
	"(at your option) any later version.\n\n"
	"It is distributed in the hope that it will be useful,\n"
	"but WITHOUT ANY WARRANTY; without even the implied warranty of\n"
	"MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n"
	"GNU General Public License for more details.\n\n"
	"You should have received a copy of the GNU General Public License\n"
	"along with this software. If not, see <https://gnu.org/licenses/>.\n";
	break;
	case 40: /* short and long usage */
	case 41: p = ""; break;
	}

	return p;
	}


	/* Set the usage handler. This function is basically a constructor. */
	void
	set_strusage ( const char (f)( int ) )
	{
	strusage_handler = f;
	}


	#ifdef TEST
	static struct {
	int verbose;
	int debug;
	char *outfile;
	char *crf;
	int myopt;
	int echo;
	int a_long_one;
	} opt;

	int
	main(int argc, char **argv)
	{
	ARGPARSE_OPTS opts[] = {
	ARGPARSE_x('v', "verbose", NONE, 0, "Laut sein"),
	ARGPARSE_s_n('e', "echo" , ("Zeile ausgeben, damit wir sehen, "
	"was wir eingegeben haben")),
	ARGPARSE_s_n('d', "debug", "Debug\nfalls mal etwas\nschief geht"),
	ARGPARSE_s_s('o', "output", 0 ),
	ARGPARSE_o_s('c', "cross-ref", "cross-reference erzeugen\n" ),
	/* Note that on a non-utf8 terminal the ß might garble the output. */
	ARGPARSE_s_n('s', "street","\|Straße\|set the name of the street to Straße"),
	ARGPARSE_o_i('m', "my-option", 0),
	ARGPARSE_s_n(500, "a-long-option", 0 ),
	ARGPARSE_end()
	};
	ARGPARSE_ARGS pargs = { &argc, &argv, (ARGPARSE_FLAG_ALL
	\| ARGPARSE_FLAG_MIXED
	\| ARGPARSE_FLAG_ONEDASH) };
	int i;

	while (arg_parse (&pargs, opts))
	{
	switch (pargs.r_opt)
	{
	case ARGPARSE_IS_ARG :
	printf ("arg='%s'\n", pargs.r.ret_str);
	break;
	case 'v': opt.verbose++; break;
	case 'e': opt.echo++; break;
	case 'd': opt.debug++; break;
	case 'o': opt.outfile = pargs.r.ret_str; break;
	case 'c': opt.crf = pargs.r_type? pargs.r.ret_str:"a.crf"; break;
	case 'm': opt.myopt = pargs.r_type? pargs.r.ret_int : 1; break;
	case 500: opt.a_long_one++; break;
	default : pargs.err = ARGPARSE_PRINT_WARNING; break;
	}
	}
	for (i=0; i < argc; i++ )
	printf ("%3d -> (%s)\n", i, argv[i] );
	puts ("Options:");
	if (opt.verbose)
	printf (" verbose=%d\n", opt.verbose );
	if (opt.debug)
	printf (" debug=%d\n", opt.debug );
	if (opt.outfile)
	printf (" outfile='%s'\n", opt.outfile );
	if (opt.crf)
	printf (" crffile='%s'\n", opt.crf );
	if (opt.myopt)
	printf (" myopt=%d\n", opt.myopt );
	if (opt.a_long_one)
	printf (" a-long-one=%d\n", opt.a_long_one );
	if (opt.echo)
	printf (" echo=%d\n", opt.echo );

	return 0;
	}
	#endif /TEST/

	/** bottom of file **/
	diff --git a/common/asshelp.c b/common/asshelp.c
	index 2cab3101b..f3a92f9e5 100644
	--- a/common/asshelp.c
	+++ b/common/asshelp.c
	@@ -1,673 +1,673 @@
	/* asshelp.c - Helper functions for Assuan
	* Copyright (C) 2002, 2004, 2007, 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif

	#include "i18n.h"
	#include "util.h"
	#include "exechelp.h"
	#include "sysutils.h"
	#include "status.h"
	#include "membuf.h"
	#include "asshelp.h"

	/* The type we use for lock_agent_spawning. */
	#ifdef HAVE_W32_SYSTEM
	# define lock_spawn_t HANDLE
	#else
	# define lock_spawn_t dotlock_t
	#endif

	/* The time we wait until the agent or the dirmngr are ready for
	operation after we started them before giving up. */
	#ifdef HAVE_W32CE_SYSTEM
	# define SECS_TO_WAIT_FOR_AGENT 30
	# define SECS_TO_WAIT_FOR_DIRMNGR 30
	#else
	# define SECS_TO_WAIT_FOR_AGENT 5
	# define SECS_TO_WAIT_FOR_DIRMNGR 5
	#endif

	/* A bitfield that specifies the assuan categories to log. This is
	identical to the default log handler of libassuan. We need to do
	it ourselves because we use a custom log handler and want to use
	the same assuan variables to select the categories to log. */
	static int log_cats;
	#define TEST_LOG_CAT(x) (!! (log_cats & (1 << (x - 1))))

	/* The assuan log monitor used to temporary inhibit log messages from
	* assuan. */
	static int (*my_log_monitor) (assuan_context_t ctx,
	unsigned int cat,
	const char *msg);


	static int
	my_libassuan_log_handler (assuan_context_t ctx, void *hook,
	unsigned int cat, const char *msg)
	{
	unsigned int dbgval;

	if (! TEST_LOG_CAT (cat))
	return 0;

	dbgval = hook? (unsigned int)hook : 0;
	if (!(dbgval & 1024))
	return 0; /* Assuan debugging is not enabled. */

	if (ctx && my_log_monitor && !my_log_monitor (ctx, cat, msg))
	return 0; /* Temporary disabled. */

	if (msg)
	log_string (GPGRT_LOG_DEBUG, msg);

	return 1;
	}


	/* Setup libassuan to use our own logging functions. Should be used
	early at startup. */
	void
	setup_libassuan_logging (unsigned int *debug_var_address,
	int (*log_monitor)(assuan_context_t ctx,
	unsigned int cat,
	const char *msg))
	{
	char *flagstr;

	flagstr = getenv ("ASSUAN_DEBUG");
	if (flagstr)
	log_cats = atoi (flagstr);
	else /* Default to log the control channel. */
	log_cats = (1 << (ASSUAN_LOG_CONTROL - 1));
	my_log_monitor = log_monitor;
	assuan_set_log_cb (my_libassuan_log_handler, debug_var_address);
	}


	/* Change the Libassuan log categories to those given by NEWCATS.
	NEWCATS is 0 the default category of ASSUAN_LOG_CONTROL is
	selected. Note, that setup_libassuan_logging overrides the values
	given here. */
	void
	set_libassuan_log_cats (unsigned int newcats)
	{
	if (newcats)
	log_cats = newcats;
	else /* Default to log the control channel. */
	log_cats = (1 << (ASSUAN_LOG_CONTROL - 1));
	}



	static gpg_error_t
	send_one_option (assuan_context_t ctx, gpg_err_source_t errsource,
	const char name, const char value, int use_putenv)
	{
	gpg_error_t err;
	char *optstr;

	(void)errsource;

	if (!value \|\| !*value)
	err = 0; /* Avoid sending empty strings. */
	else if (asprintf (&optstr, "OPTION %s%s=%s",
	use_putenv? "putenv=":"", name, value) < 0)
	err = gpg_error_from_syserror ();
	else
	{
	err = assuan_transact (ctx, optstr, NULL, NULL, NULL, NULL, NULL, NULL);
	xfree (optstr);
	}

	return err;
	}


	/* Send the assuan commands pertaining to the pinentry environment. The
	OPT_* arguments are optional and may be used to override the
	defaults taken from the current locale. */
	gpg_error_t
	send_pinentry_environment (assuan_context_t ctx,
	gpg_err_source_t errsource,
	const char *opt_lc_ctype,
	const char *opt_lc_messages,
	session_env_t session_env)

	{
	gpg_error_t err = 0;
	#if defined(HAVE_SETLOCALE)
	char *old_lc = NULL;
	#endif
	char *dft_lc = NULL;
	const char *dft_ttyname;
	int iterator;
	const char name, assname, *value;
	int is_default;

	iterator = 0;
	while ((name = session_env_list_stdenvnames (&iterator, &assname)))
	{
	value = session_env_getenv_or_default (session_env, name, NULL);
	if (!value)
	continue;

	if (assname)
	err = send_one_option (ctx, errsource, assname, value, 0);
	else
	{
	err = send_one_option (ctx, errsource, name, value, 1);
	if (gpg_err_code (err) == GPG_ERR_UNKNOWN_OPTION)
	err = 0; /* Server too old; can't pass the new envvars. */
	}
	if (err)
	return err;
	}


	dft_ttyname = session_env_getenv_or_default (session_env, "GPG_TTY",
	&is_default);
	if (dft_ttyname && !is_default)
	dft_ttyname = NULL; /* We need the default value. */

	/* Send the value for LC_CTYPE. */
	#if defined(HAVE_SETLOCALE) && defined(LC_CTYPE)
	old_lc = setlocale (LC_CTYPE, NULL);
	if (old_lc)
	{
	old_lc = xtrystrdup (old_lc);
	if (!old_lc)
	return gpg_error_from_syserror ();
	}
	dft_lc = setlocale (LC_CTYPE, "");
	#endif
	if (opt_lc_ctype \|\| (dft_ttyname && dft_lc))
	{
	err = send_one_option (ctx, errsource, "lc-ctype",
	opt_lc_ctype ? opt_lc_ctype : dft_lc, 0);
	}
	#if defined(HAVE_SETLOCALE) && defined(LC_CTYPE)
	if (old_lc)
	{
	setlocale (LC_CTYPE, old_lc);
	xfree (old_lc);
	}
	#endif
	if (err)
	return err;

	/* Send the value for LC_MESSAGES. */
	#if defined(HAVE_SETLOCALE) && defined(LC_MESSAGES)
	old_lc = setlocale (LC_MESSAGES, NULL);
	if (old_lc)
	{
	old_lc = xtrystrdup (old_lc);
	if (!old_lc)
	return gpg_error_from_syserror ();
	}
	dft_lc = setlocale (LC_MESSAGES, "");
	#endif
	if (opt_lc_messages \|\| (dft_ttyname && dft_lc))
	{
	err = send_one_option (ctx, errsource, "lc-messages",
	opt_lc_messages ? opt_lc_messages : dft_lc, 0);
	}
	#if defined(HAVE_SETLOCALE) && defined(LC_MESSAGES)
	if (old_lc)
	{
	setlocale (LC_MESSAGES, old_lc);
	xfree (old_lc);
	}
	#endif
	if (err)
	return err;

	return 0;
	}


	/* Lock a spawning process. The caller needs to provide the address
	of a variable to store the lock information and the name or the
	process. */
	static gpg_error_t
	lock_spawning (lock_spawn_t lock, const char homedir, const char *name,
	int verbose)
	{
	char *fname;
	(void)verbose;

	*lock = NULL;

	fname = make_absfilename_try
	(homedir,
	!strcmp (name, "agent")? "gnupg_spawn_agent_sentinel":
	!strcmp (name, "dirmngr")? "gnupg_spawn_dirmngr_sentinel":
	/* */ "gnupg_spawn_unknown_sentinel",
	NULL);
	if (!fname)
	return gpg_error_from_syserror ();

	*lock = dotlock_create (fname, 0);
	xfree (fname);
	if (!*lock)
	return gpg_error_from_syserror ();

	/* FIXME: We should use a timeout of 5000 here - however
	make_dotlock does not yet support values other than -1 and 0. */
	if (dotlock_take (*lock, -1))
	return gpg_error_from_syserror ();

	return 0;
	}


	/* Unlock the spawning process. */
	static void
	unlock_spawning (lock_spawn_t lock, const char name)
	{
	if (*lock)
	{
	(void)name;
	dotlock_destroy (*lock);
	*lock = NULL;
	}
	}

	/* Try to connect to the agent via socket or start it if it is not
	running and AUTOSTART is set. Handle the server's initial
	greeting. Returns a new assuan context at R_CTX or an error
	code. */
	gpg_error_t
	start_new_gpg_agent (assuan_context_t *r_ctx,
	gpg_err_source_t errsource,
	const char *agent_program,
	const char *opt_lc_ctype,
	const char *opt_lc_messages,
	session_env_t session_env,
	int autostart, int verbose, int debug,
	gpg_error_t (*status_cb)(ctrl_t, int, ...),
	ctrl_t status_cb_arg)
	{
	gpg_error_t err;
	assuan_context_t ctx;
	int did_success_msg = 0;
	char *sockname;
	const char *argv[6];

	*r_ctx = NULL;

	err = assuan_new (&ctx);
	if (err)
	{
	log_error ("error allocating assuan context: %s\n", gpg_strerror (err));
	return err;
	}

	sockname = make_filename_try (gnupg_socketdir (), GPG_AGENT_SOCK_NAME, NULL);
	if (!sockname)
	{
	err = gpg_err_make (errsource, gpg_err_code_from_syserror ());
	assuan_release (ctx);
	return err;
	}

	err = assuan_socket_connect (ctx, sockname, 0, 0);
	if (err && autostart)
	{
	char *abs_homedir;
	lock_spawn_t lock;
	char *program = NULL;
	const char *program_arg = NULL;
	char *p;
	const char *s;
	int i;

	/* With no success start a new server. */
	if (!agent_program \|\| !*agent_program)
	agent_program = gnupg_module_name (GNUPG_MODULE_NAME_AGENT);
	else if ((s=strchr (agent_program, '\|')) && s[1] == '-' && s[2]=='-')
	{
	/* Hack to insert an additional option on the command line. */
	program = xtrystrdup (agent_program);
	if (!program)
	{
	gpg_error_t tmperr = gpg_err_make (errsource,
	gpg_err_code_from_syserror ());
	xfree (sockname);
	assuan_release (ctx);
	return tmperr;
	}
	p = strchr (program, '\|');
	*p++ = 0;
	program_arg = p;
	}

	if (verbose)
	log_info (_("no running gpg-agent - starting '%s'\n"),
	agent_program);

	if (status_cb)
	status_cb (status_cb_arg, STATUS_PROGRESS,
	"starting_agent ? 0 0", NULL);

	/* We better pass an absolute home directory to the agent just
	in case gpg-agent does not convert the passed name to an
	absolute one (which it should do). */
	abs_homedir = make_absfilename_try (gnupg_homedir (), NULL);
	if (!abs_homedir)
	{
	gpg_error_t tmperr = gpg_err_make (errsource,
	gpg_err_code_from_syserror ());
	log_error ("error building filename: %s\n",gpg_strerror (tmperr));
	xfree (sockname);
	assuan_release (ctx);
	xfree (program);
	return tmperr;
	}

	if (fflush (NULL))
	{
	gpg_error_t tmperr = gpg_err_make (errsource,
	gpg_err_code_from_syserror ());
	log_error ("error flushing pending output: %s\n",
	strerror (errno));
	xfree (sockname);
	assuan_release (ctx);
	xfree (abs_homedir);
	xfree (program);
	return tmperr;
	}

	/* If the agent has been configured for use with a standard
	socket, an environment variable is not required and thus
	- we we can savely start the agent here. */
	+ we can safely start the agent here. */
	i = 0;
	argv[i++] = "--homedir";
	argv[i++] = abs_homedir;
	argv[i++] = "--use-standard-socket";
	if (program_arg)
	argv[i++] = program_arg;
	argv[i++] = "--daemon";
	argv[i++] = NULL;

	if (!(err = lock_spawning (&lock, gnupg_homedir (), "agent", verbose))
	&& assuan_socket_connect (ctx, sockname, 0, 0))
	{
	err = gnupg_spawn_process_detached (program? program : agent_program,
	argv, NULL);
	if (err)
	log_error ("failed to start agent '%s': %s\n",
	agent_program, gpg_strerror (err));
	else
	{
	for (i=0; i < SECS_TO_WAIT_FOR_AGENT; i++)
	{
	if (verbose)
	log_info (_("waiting for the agent to come up ... (%ds)\n"),
	SECS_TO_WAIT_FOR_AGENT - i);
	gnupg_sleep (1);
	err = assuan_socket_connect (ctx, sockname, 0, 0);
	if (!err)
	{
	if (verbose)
	{
	log_info (_("connection to agent established\n"));
	did_success_msg = 1;
	}
	break;
	}
	}
	}
	}

	unlock_spawning (&lock, "agent");
	xfree (abs_homedir);
	xfree (program);
	}
	xfree (sockname);
	if (err)
	{
	if (autostart \|\| gpg_err_code (err) != GPG_ERR_ASS_CONNECT_FAILED)
	log_error ("can't connect to the agent: %s\n", gpg_strerror (err));
	assuan_release (ctx);
	return gpg_err_make (errsource, GPG_ERR_NO_AGENT);
	}

	if (debug && !did_success_msg)
	log_debug ("connection to agent established\n");

	err = assuan_transact (ctx, "RESET",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (!err)
	{
	err = send_pinentry_environment (ctx, errsource,
	opt_lc_ctype, opt_lc_messages,
	session_env);
	if (gpg_err_code (err) == GPG_ERR_FORBIDDEN
	&& gpg_err_source (err) == GPG_ERR_SOURCE_GPGAGENT)
	{
	/* Check whether we are in restricted mode. */
	if (!assuan_transact (ctx, "GETINFO restricted",
	NULL, NULL, NULL, NULL, NULL, NULL))
	{
	if (verbose)
	log_info (_("connection to agent is in restricted mode\n"));
	err = 0;
	}
	}
	}
	if (err)
	{
	assuan_release (ctx);
	return err;
	}

	*r_ctx = ctx;
	return 0;
	}


	/* Try to connect to the dirmngr via a socket. On platforms
	supporting it, start it up if needed and if AUTOSTART is true.
	Returns a new assuan context at R_CTX or an error code. */
	gpg_error_t
	start_new_dirmngr (assuan_context_t *r_ctx,
	gpg_err_source_t errsource,
	const char *dirmngr_program,
	int autostart,
	int verbose, int debug,
	gpg_error_t (*status_cb)(ctrl_t, int, ...),
	ctrl_t status_cb_arg)
	{
	gpg_error_t err;
	assuan_context_t ctx;
	const char *sockname;
	int did_success_msg = 0;

	*r_ctx = NULL;

	err = assuan_new (&ctx);
	if (err)
	{
	log_error ("error allocating assuan context: %s\n", gpg_strerror (err));
	return err;
	}

	sockname = dirmngr_socket_name ();
	err = assuan_socket_connect (ctx, sockname, 0, 0);

	#ifdef USE_DIRMNGR_AUTO_START
	if (err && autostart)
	{
	lock_spawn_t lock;
	const char *argv[4];
	char *abs_homedir;

	/* No connection: Try start a new Dirmngr. */
	if (!dirmngr_program \|\| !*dirmngr_program)
	dirmngr_program = gnupg_module_name (GNUPG_MODULE_NAME_DIRMNGR);

	if (verbose)
	log_info (_("no running Dirmngr - starting '%s'\n"),
	dirmngr_program);

	if (status_cb)
	status_cb (status_cb_arg, STATUS_PROGRESS,
	"starting_dirmngr ? 0 0", NULL);

	abs_homedir = make_absfilename (gnupg_homedir (), NULL);
	if (!abs_homedir)
	{
	gpg_error_t tmperr = gpg_err_make (errsource,
	gpg_err_code_from_syserror ());
	log_error ("error building filename: %s\n",gpg_strerror (tmperr));
	assuan_release (ctx);
	return tmperr;
	}

	if (fflush (NULL))
	{
	gpg_error_t tmperr = gpg_err_make (errsource,
	gpg_err_code_from_syserror ());
	log_error ("error flushing pending output: %s\n",
	strerror (errno));
	assuan_release (ctx);
	return tmperr;
	}

	argv[0] = "--daemon";
	/* Try starting the daemon. Versions of dirmngr < 2.1.15 do
	* this only if the home directory is given on the command line. */
	argv[1] = "--homedir";
	argv[2] = abs_homedir;
	argv[3] = NULL;

	if (!(err = lock_spawning (&lock, gnupg_homedir (), "dirmngr", verbose))
	&& assuan_socket_connect (ctx, sockname, 0, 0))
	{
	err = gnupg_spawn_process_detached (dirmngr_program, argv, NULL);
	if (err)
	log_error ("failed to start the dirmngr '%s': %s\n",
	dirmngr_program, gpg_strerror (err));
	else
	{
	int i;

	for (i=0; i < SECS_TO_WAIT_FOR_DIRMNGR; i++)
	{
	if (verbose)
	log_info (_("waiting for the dirmngr "
	"to come up ... (%ds)\n"),
	SECS_TO_WAIT_FOR_DIRMNGR - i);
	gnupg_sleep (1);
	err = assuan_socket_connect (ctx, sockname, 0, 0);
	if (!err)
	{
	if (verbose)
	{
	log_info (_("connection to the dirmngr"
	" established\n"));
	did_success_msg = 1;
	}
	break;
	}
	}
	}
	}

	unlock_spawning (&lock, "dirmngr");
	xfree (abs_homedir);
	}
	#else
	(void)dirmngr_program;
	(void)verbose;
	(void)status_cb;
	(void)status_cb_arg;
	#endif /USE_DIRMNGR_AUTO_START/

	if (err)
	{
	if (autostart \|\| gpg_err_code (err) != GPG_ERR_ASS_CONNECT_FAILED)
	log_error ("connecting dirmngr at '%s' failed: %s\n",
	sockname, gpg_strerror (err));
	assuan_release (ctx);
	return gpg_err_make (errsource, GPG_ERR_NO_DIRMNGR);
	}

	if (debug && !did_success_msg)
	log_debug ("connection to the dirmngr established\n");

	*r_ctx = ctx;
	return 0;
	}


	/* Return the version of a server using "GETINFO version". On success
	0 is returned and R_VERSION receives a malloced string with the
	version which must be freed by the caller. On error NULL is stored
	at R_VERSION and an error code returned. Mode is in general 0 but
	certain values may be used to modify the used version command:

	MODE == 0 = Use "GETINFO version"
	MODE == 2 - Use "SCD GETINFO version"
	*/
	gpg_error_t
	get_assuan_server_version (assuan_context_t ctx, int mode, char **r_version)
	{
	gpg_error_t err;
	membuf_t data;

	init_membuf (&data, 64);
	err = assuan_transact (ctx,
	mode == 2? "SCD GETINFO version"
	/**/ : "GETINFO version",
	put_membuf_cb, &data,
	NULL, NULL, NULL, NULL);
	if (err)
	{
	xfree (get_membuf (&data, NULL));
	*r_version = NULL;
	}
	else
	{
	put_membuf (&data, "", 1);
	*r_version = get_membuf (&data, NULL);
	if (!*r_version)
	err = gpg_error_from_syserror ();
	}
	return err;
	}
	diff --git a/common/dotlock.c b/common/dotlock.c
	index 7ebd5231c..5fe652ec0 100644
	--- a/common/dotlock.c
	+++ b/common/dotlock.c
	@@ -1,1379 +1,1379 @@
	/* dotlock.c - dotfile locking
	* Copyright (C) 1998, 2000, 2001, 2003, 2004,
	* 2005, 2006, 2008, 2010, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify it
	* under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* GnuPG is distributed in the hope that it will be useful, but
	* WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	* General Public License for more details.
	*
	* You should have received a copies of the GNU General Public License
	* and the GNU Lesser General Public License along with this program;
	* if not, see <https://www.gnu.org/licenses/>.
	*
	* ALTERNATIVELY, this file may be distributed under the terms of the
	* following license, in which case the provisions of this license are
	* required INSTEAD OF the GNU Lesser General License or the GNU
	* General Public License. If you wish to allow use of your version of
	* this file only under the terms of the GNU Lesser General License or
	* the GNU General Public License, and not to allow others to use your
	* version of this file under the terms of the following license,
	* indicate your decision by deleting this paragraph and the license
	* below.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	*
	* 1. Redistributions of source code must retain the above copyright
	* notice, and the entire permission notice in its entirety,
	* including the disclaimer of warranties.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	* 3. The name of the author may not be used to endorse or promote
	* products derived from this software without specific prior
	* written permission.
	*
	* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
	* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	* OF THE POSSIBILITY OF SUCH DAMAGE.
	*/

	/*
	Overview:
	=========

	This module implements advisory file locking in a portable way.
	Due to the problems with POSIX fcntl locking a separate lock file
	is used. It would be possible to use fcntl locking on this lock
	file and thus avoid the weird auto unlock bug of POSIX while still
	having an unproved better performance of fcntl locking. However
	there are still problems left, thus we resort to use a hardlink
	which has the well defined property that a link call will fail if
	the target file already exists.

	Given that hardlinks are also available on NTFS file systems since
	Windows XP; it will be possible to enhance this module to use
	hardlinks even on Windows and thus allow Windows and Posix clients
	to use locking on the same directory. This is not yet implemented;
	instead we use a lockfile on Windows along with W32 style file
	locking.

	On FAT file systems hardlinks are not supported. Thus this method
	does not work. Our solution is to use a O_EXCL locking instead.
	Querying the type of the file system is not easy to do in a
	portable way (e.g. Linux has a statfs, BSDs have a the same call
	but using different structures and constants). What we do instead
	is to check at runtime whether link(2) works for a specific lock
	file.


	How to use:
	===========

	At program initialization time, the module should be explicitly
	initialized:

	dotlock_create (NULL, 0);

	This installs an atexit handler and may also initialize mutex etc.
	It is optional for non-threaded applications. Only the first call
	has an effect. This needs to be done before any extra threads are
	started.

	To create a lock file (which prepares it but does not take the
	lock) you do:

	dotlock_t h

	h = dotlock_create (fname, 0);
	if (!h)
	error ("error creating lock file: %s\n", strerror (errno));

	It is important to handle the error. For example on a read-only
	file system a lock can't be created (but is usually not needed).
	FNAME is the file you want to lock; the actual lockfile is that
	name with the suffix ".lock" appended. On success a handle to be
	used with the other functions is returned or NULL on error. Note
	that the handle shall only be used by one thread at a time. This
	function creates a unique file temporary file (".#lk*") in the same
	directory as FNAME and returns a handle for further operations.
	The module keeps track of theses unique files so that they will be
	unlinked using the atexit handler. If you don't need the lock file
	anymore, you may also explicitly remove it with a call to:

	dotlock_destroy (h);

	To actually lock the file, you use:

	if (dotlock_take (h, -1))
	error ("error taking lock: %s\n", strerror (errno));

	This function will wait until the lock is acquired. If an
	unexpected error occurs if will return non-zero and set ERRNO. If
	you pass (0) instead of (-1) the function does not wait in case the
	file is already locked but returns -1 and sets ERRNO to EACCES.
	Any other positive value for the second parameter is considered a
	timeout valuie in milliseconds.

	To release the lock you call:

	if (dotlock_release (h))
	error ("error releasing lock: %s\n", strerror (errno));

	or, if the lock file is not anymore needed, you may just call
	dotlock_destroy. However dotlock_release does some extra checks
	before releasing the lock and prints diagnostics to help detecting
	bugs.

	If you want to explicitly destroy all lock files you may call

	dotlock_remove_lockfiles ();

	which is the core of the installed atexit handler. In case your
	application wants to disable locking completely it may call

	disable_locking ()

	before any locks are created.

	There are two convenience functions to store an integer (e.g. a
	file descriptor) value with the handle:

	void dotlock_set_fd (dotlock_t h, int fd);
	int dotlock_get_fd (dotlock_t h);

	If nothing has been stored dotlock_get_fd returns -1.



	How to build:
	=============

	This module was originally developed for GnuPG but later changed to
	allow its use without any GnuPG dependency. If you want to use it
	with you application you may simply use it and it should figure out
	most things automagically.

	You may use the common config.h file to pass macros, but take care
	to pass -DHAVE_CONFIG_H to the compiler. Macros used by this
	module are:

	DOTLOCK_USE_PTHREAD - Define if POSIX threads are in use.

	DOTLOCK_GLIB_LOGGING - Define this to use Glib logging functions.

	DOTLOCK_EXT_SYM_PREFIX - Prefix all external symbols with the
	string to which this macro evaluates.

	GNUPG_MAJOR_VERSION - Defined when used by GnuPG.

	HAVE_DOSISH_SYSTEM - Defined for Windows etc. Will be
	automatically defined if a the target is
	Windows.

	HAVE_POSIX_SYSTEM - Internally defined to !HAVE_DOSISH_SYSTEM.

	HAVE_SIGNAL_H - Should be defined on Posix systems. If config.h
	is not used defaults to defined.

	DIRSEP_C - Separation character for file name parts.
	Usually not redefined.

	EXTSEP_S - Separation string for file name suffixes.
	Usually not redefined.

	HAVE_W32CE_SYSTEM - Currently only used by GnuPG.

	Note that there is a test program t-dotlock which has compile
	instructions at its end. At least for SMBFS and CIFS it is
	important that 64 bit versions of stat are used; most programming
	environments do this these days, just in case you want to compile
	it on the command line, remember to pass -D_FILE_OFFSET_BITS=64


	Bugs:
	=====

	On Windows this module is not yet thread-safe.


	Miscellaneous notes:
	====================

	On hardlinks:
	- Hardlinks are supported under Windows with NTFS since XP/Server2003.
	- In Linux 2.6.33 both SMBFS and CIFS seem to support hardlinks.
	- NFS supports hard links. But there are solvable problems.
	- FAT does not support links

	On the file locking API:
	- CIFS on Linux 2.6.33 supports several locking methods.
	SMBFS seems not to support locking. No closer checks done.
	- NFS supports Posix locks. flock is emulated in the server.
	However there are a couple of problems; see below.
	- FAT does not support locks.
	- An advantage of fcntl locking is that R/W locks can be
	implemented which is not easy with a straight lock file.

	On O_EXCL:
	- Does not work reliable on NFS
	- Should work on CIFS and SMBFS but how can we delete lockfiles?

	On NFS problems:
	- Locks vanish if the server crashes and reboots.
	- Client crashes keep the lock in the server until the client
	re-connects.
	- Communication problems may return unreliable error codes. The
	MUA Postfix's workaround is to compare the link count after
	seeing an error for link. However that gives a race. If using a
	unique file to link to a lockfile and using stat to check the
	link count instead of looking at the error return of link(2) is
	the best solution.
	- O_EXCL seems to have a race and may re-create a file anyway.

	*/

	#ifdef HAVE_CONFIG_H
	# include <config.h>
	#endif

	/* Some quick replacements for stuff we usually expect to be defined
	in config.h. Define HAVE_POSIX_SYSTEM for better readability. */
	#if !defined (HAVE_DOSISH_SYSTEM) && defined(_WIN32)
	# define HAVE_DOSISH_SYSTEM 1
	#endif
	#if !defined (HAVE_DOSISH_SYSTEM) && !defined (HAVE_POSIX_SYSTEM)
	# define HAVE_POSIX_SYSTEM 1
	#endif

	/* With no config.h assume that we have sitgnal.h. */
	#if !defined (HAVE_CONFIG_H) && defined (HAVE_POSIX_SYSTEM)
	# define HAVE_SIGNAL_H 1
	#endif

	/* Standard headers. */
	#include <stdlib.h>
	#include <stdio.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>
	#include <errno.h>
	#include <unistd.h>
	#ifdef HAVE_DOSISH_SYSTEM
	# define WIN32_LEAN_AND_MEAN /* We only need the OS core stuff. */
	# include <windows.h>
	#else
	# include <sys/types.h>
	# include <sys/stat.h>
	# include <sys/utsname.h>
	#endif
	#include <sys/types.h>
	#include <sys/time.h>
	#include <sys/stat.h>
	#include <fcntl.h>
	#ifdef HAVE_SIGNAL_H
	# include <signal.h>
	#endif
	#ifdef DOTLOCK_USE_PTHREAD
	# include <pthread.h>
	#endif

	#ifdef DOTLOCK_GLIB_LOGGING
	# include <glib.h>
	#endif

	#ifdef GNUPG_MAJOR_VERSION
	# include "util.h"
	# include "common-defs.h"
	# include "stringhelp.h" /* For stpcpy and w32_strerror. */
	#endif
	#ifdef HAVE_W32CE_SYSTEM
	# include "utf8conv.h" /* WindowsCE requires filename conversion. */
	#endif

	#include "dotlock.h"


	/* Define constants for file name construction. */
	#if !defined(DIRSEP_C) && !defined(EXTSEP_S)
	# ifdef HAVE_DOSISH_SYSTEM
	# define DIRSEP_C '\\'
	# define EXTSEP_S "."
	#else
	# define DIRSEP_C '/'
	# define EXTSEP_S "."
	# endif
	#endif

	/* In GnuPG we use wrappers around the malloc fucntions. If they are
	not defined we assume that this code is used outside of GnuPG and
	fall back to the regular malloc functions. */
	#ifndef xtrymalloc
	# define xtrymalloc(a) malloc ((a))
	# define xtrycalloc(a,b) calloc ((a), (b))
	# define xfree(a) free ((a))
	#endif

	/* Wrapper to set ERRNO (required for W32CE). */
	#ifdef GPG_ERROR_VERSION
	# define my_set_errno(e) gpg_err_set_errno ((e))
	#else
	# define my_set_errno(e) do { errno = (e); } while (0)
	#endif

	/* Gettext macro replacement. */
	#ifndef _
	# define _(a) (a)
	#endif

	#ifdef GNUPG_MAJOR_VERSION
	# define my_info_0(a) log_info ((a))
	# define my_info_1(a,b) log_info ((a), (b))
	# define my_info_2(a,b,c) log_info ((a), (b), (c))
	# define my_info_3(a,b,c,d) log_info ((a), (b), (c), (d))
	# define my_error_0(a) log_error ((a))
	# define my_error_1(a,b) log_error ((a), (b))
	# define my_error_2(a,b,c) log_error ((a), (b), (c))
	# define my_debug_1(a,b) log_debug ((a), (b))
	# define my_fatal_0(a) log_fatal ((a))
	#elif defined (DOTLOCK_GLIB_LOGGING)
	# define my_info_0(a) g_message ((a))
	# define my_info_1(a,b) g_message ((a), (b))
	# define my_info_2(a,b,c) g_message ((a), (b), (c))
	# define my_info_3(a,b,c,d) g_message ((a), (b), (c), (d))
	# define my_error_0(a) g_warning ((a))
	# define my_error_1(a,b) g_warning ((a), (b))
	# define my_error_2(a,b,c) g_warning ((a), (b), (c))
	# define my_debug_1(a,b) g_debug ((a), (b))
	# define my_fatal_0(a) g_error ((a))
	#else
	# define my_info_0(a) fprintf (stderr, (a))
	# define my_info_1(a,b) fprintf (stderr, (a), (b))
	# define my_info_2(a,b,c) fprintf (stderr, (a), (b), (c))
	# define my_info_3(a,b,c,d) fprintf (stderr, (a), (b), (c), (d))
	# define my_error_0(a) fprintf (stderr, (a))
	# define my_error_1(a,b) fprintf (stderr, (a), (b))
	# define my_error_2(a,b,c) fprintf (stderr, (a), (b), (c))
	# define my_debug_1(a,b) fprintf (stderr, (a), (b))
	# define my_fatal_0(a) do { fprintf (stderr,(a)); fflush (stderr); \
	abort (); } while (0)
	#endif





	/* The object describing a lock. */
	struct dotlock_handle
	{
	struct dotlock_handle *next;
	char lockname; / Name of the actual lockfile. */
	unsigned int locked:1; /* Lock status. */
	unsigned int disable:1; /* If true, locking is disabled. */
	unsigned int use_o_excl:1; /* Use open (O_EXCL) for locking. */

	int extra_fd; /* A place for the caller to store an FD. */

	#ifdef HAVE_DOSISH_SYSTEM
	HANDLE lockhd; /* The W32 handle of the lock file. */
	#else /!HAVE_DOSISH_SYSTEM /
	char tname; / Name of the lockfile template. */
	size_t nodename_off; /* Offset in TNAME of the nodename part. */
	size_t nodename_len; /* Length of the nodename part. */
	#endif /!HAVE_DOSISH_SYSTEM /
	};


	-/* A list of of all lock handles. The volatile attribute might help
	+/* A list of all lock handles. The volatile attribute might help
	if used in an atexit handler. Note that [UN]LOCK_all_lockfiles
	must not change ERRNO. */
	static volatile dotlock_t all_lockfiles;
	#ifdef DOTLOCK_USE_PTHREAD
	static pthread_mutex_t all_lockfiles_mutex = PTHREAD_MUTEX_INITIALIZER;
	# define LOCK_all_lockfiles() do { \
	if (pthread_mutex_lock (&all_lockfiles_mutex)) \
	my_fatal_0 ("locking all_lockfiles_mutex failed\n"); \
	} while (0)
	# define UNLOCK_all_lockfiles() do { \
	if (pthread_mutex_unlock (&all_lockfiles_mutex)) \
	my_fatal_0 ("unlocking all_lockfiles_mutex failed\n"); \
	} while (0)
	#else /!DOTLOCK_USE_PTHREAD/
	# define LOCK_all_lockfiles() do { } while (0)
	# define UNLOCK_all_lockfiles() do { } while (0)
	#endif /!DOTLOCK_USE_PTHREAD/

	/* If this has the value true all locking is disabled. */
	static int never_lock;




	#ifdef HAVE_DOSISH_SYSTEM
	static int
	map_w32_to_errno (DWORD w32_err)
	{
	switch (w32_err)
	{
	case 0:
	return 0;

	case ERROR_FILE_NOT_FOUND:
	return ENOENT;

	case ERROR_PATH_NOT_FOUND:
	return ENOENT;

	case ERROR_ACCESS_DENIED:
	return EPERM;

	case ERROR_INVALID_HANDLE:
	case ERROR_INVALID_BLOCK:
	return EINVAL;

	case ERROR_NOT_ENOUGH_MEMORY:
	return ENOMEM;

	case ERROR_NO_DATA:
	case ERROR_BROKEN_PIPE:
	return EPIPE;

	default:
	return EIO;
	}
	}
	#endif /HAVE_DOSISH_SYSTEM/


	/* Entirely disable all locking. This function should be called
	before any locking is done. It may be called right at startup of
	the process as it only sets a global value. */
	void
	dotlock_disable (void)
	{
	never_lock = 1;
	}


	#ifdef HAVE_POSIX_SYSTEM
	static int
	maybe_deadlock (dotlock_t h)
	{
	dotlock_t r;
	int res = 0;

	LOCK_all_lockfiles ();
	for (r=all_lockfiles; r; r = r->next)
	{
	if ( r != h && r->locked )
	{
	res = 1;
	break;
	}
	}
	UNLOCK_all_lockfiles ();
	return res;
	}
	#endif /HAVE_POSIX_SYSTEM/


	/* Read the lock file and return the pid, returns -1 on error. True
	will be stored in the integer at address SAME_NODE if the lock file
	has been created on the same node. */
	#ifdef HAVE_POSIX_SYSTEM
	static int
	read_lockfile (dotlock_t h, int *same_node )
	{
	char buffer_space[10+1+70+1]; /* 70 is just an estimated value; node
	names are usually shorter. */
	int fd;
	int pid = -1;
	char buffer, p;
	size_t expected_len;
	int res, nread;

	*same_node = 0;
	expected_len = 10 + 1 + h->nodename_len + 1;
	if ( expected_len >= sizeof buffer_space)
	{
	buffer = xtrymalloc (expected_len);
	if (!buffer)
	return -1;
	}
	else
	buffer = buffer_space;

	if ( (fd = open (h->lockname, O_RDONLY)) == -1 )
	{
	int e = errno;
	my_info_2 ("error opening lockfile '%s': %s\n",
	h->lockname, strerror(errno) );
	if (buffer != buffer_space)
	xfree (buffer);
	my_set_errno (e); /* Need to return ERRNO here. */
	return -1;
	}

	p = buffer;
	nread = 0;
	do
	{
	res = read (fd, p, expected_len - nread);
	if (res == -1 && errno == EINTR)
	continue;
	if (res < 0)
	{
	int e = errno;
	my_info_1 ("error reading lockfile '%s'\n", h->lockname );
	close (fd);
	if (buffer != buffer_space)
	xfree (buffer);
	my_set_errno (e);
	return -1;
	}
	p += res;
	nread += res;
	}
	while (res && nread != expected_len);
	close(fd);

	if (nread < 11)
	{
	my_info_1 ("invalid size of lockfile '%s'\n", h->lockname);
	if (buffer != buffer_space)
	xfree (buffer);
	my_set_errno (EINVAL);
	return -1;
	}

	if (buffer[10] != '\n'
	\|\| (buffer[10] = 0, pid = atoi (buffer)) == -1
	\|\| !pid )
	{
	my_error_2 ("invalid pid %d in lockfile '%s'\n", pid, h->lockname);
	if (buffer != buffer_space)
	xfree (buffer);
	my_set_errno (EINVAL);
	return -1;
	}

	if (nread == expected_len
	&& !memcmp (h->tname+h->nodename_off, buffer+11, h->nodename_len)
	&& buffer[11+h->nodename_len] == '\n')
	*same_node = 1;

	if (buffer != buffer_space)
	xfree (buffer);
	return pid;
	}
	#endif /HAVE_POSIX_SYSTEM /


	/* Check whether the file system which stores TNAME supports
	hardlinks. Instead of using the non-portable statsfs call which
	differs between various Unix versions, we do a runtime test.
	Returns: 0 supports hardlinks; 1 no hardlink support, -1 unknown
	(test error). */
	#ifdef HAVE_POSIX_SYSTEM
	static int
	use_hardlinks_p (const char *tname)
	{
	char *lname;
	struct stat sb;
	unsigned int nlink;
	int res;

	if (stat (tname, &sb))
	return -1;
	nlink = (unsigned int)sb.st_nlink;

	lname = xtrymalloc (strlen (tname) + 1 + 1);
	if (!lname)
	return -1;
	strcpy (lname, tname);
	strcat (lname, "x");

	/* We ignore the return value of link() because it is unreliable. */
	(void) link (tname, lname);

	if (stat (tname, &sb))
	res = -1; /* Ooops. */
	else if (sb.st_nlink == nlink + 1)
	res = 0; /* Yeah, hardlinks are supported. */
	else
	res = 1; /* No hardlink support. */

	unlink (lname);
	xfree (lname);
	return res;
	}
	#endif /HAVE_POSIX_SYSTEM /



	#ifdef HAVE_POSIX_SYSTEM
	/* Locking core for Unix. It used a temporary file and the link
	system call to make locking an atomic operation. */
	static dotlock_t
	dotlock_create_unix (dotlock_t h, const char *file_to_lock)
	{
	int fd = -1;
	char pidstr[16];
	const char *nodename;
	const char *dirpart;
	int dirpartlen;
	struct utsname utsbuf;
	size_t tnamelen;

	snprintf (pidstr, sizeof pidstr, "%10d\n", (int)getpid() );

	/* Create a temporary file. */
	if ( uname ( &utsbuf ) )
	nodename = "unknown";
	else
	nodename = utsbuf.nodename;

	if ( !(dirpart = strrchr (file_to_lock, DIRSEP_C)) )
	{
	dirpart = EXTSEP_S;
	dirpartlen = 1;
	}
	else
	{
	dirpartlen = dirpart - file_to_lock;
	dirpart = file_to_lock;
	}

	LOCK_all_lockfiles ();
	h->next = all_lockfiles;
	all_lockfiles = h;

	tnamelen = dirpartlen + 6 + 30 + strlen(nodename) + 10 + 1;
	h->tname = xtrymalloc (tnamelen + 1);
	if (!h->tname)
	{
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	xfree (h);
	return NULL;
	}
	h->nodename_len = strlen (nodename);

	snprintf (h->tname, tnamelen, "%.*s/.#lk%p.", dirpartlen, dirpart, h );
	h->nodename_off = strlen (h->tname);
	snprintf (h->tname+h->nodename_off, tnamelen - h->nodename_off,
	"%s.%d", nodename, (int)getpid ());

	do
	{
	my_set_errno (0);
	fd = open (h->tname, O_WRONLY\|O_CREAT\|O_EXCL,
	S_IRUSR\|S_IRGRP\|S_IROTH\|S_IWUSR );
	}
	while (fd == -1 && errno == EINTR);

	if ( fd == -1 )
	{
	int saveerrno = errno;
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	my_error_2 (_("failed to create temporary file '%s': %s\n"),
	h->tname, strerror (errno));
	xfree (h->tname);
	xfree (h);
	my_set_errno (saveerrno);
	return NULL;
	}
	if ( write (fd, pidstr, 11 ) != 11 )
	goto write_failed;
	if ( write (fd, nodename, strlen (nodename) ) != strlen (nodename) )
	goto write_failed;
	if ( write (fd, "\n", 1 ) != 1 )
	goto write_failed;
	if ( close (fd) )
	{
	if ( errno == EINTR )
	fd = -1;
	goto write_failed;
	}
	fd = -1;

	/* Check whether we support hard links. */
	switch (use_hardlinks_p (h->tname))
	{
	case 0: /* Yes. */
	break;
	case 1: /* No. */
	unlink (h->tname);
	h->use_o_excl = 1;
	break;
	default:
	{
	int saveerrno = errno;
	my_error_2 ("can't check whether hardlinks are supported for '%s': %s\n"
	, h->tname, strerror (saveerrno));
	my_set_errno (saveerrno);
	}
	goto write_failed;
	}

	h->lockname = xtrymalloc (strlen (file_to_lock) + 6 );
	if (!h->lockname)
	{
	int saveerrno = errno;
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	unlink (h->tname);
	xfree (h->tname);
	xfree (h);
	my_set_errno (saveerrno);
	return NULL;
	}
	strcpy (stpcpy (h->lockname, file_to_lock), EXTSEP_S "lock");
	UNLOCK_all_lockfiles ();
	if (h->use_o_excl)
	my_debug_1 ("locking for '%s' done via O_EXCL\n", h->lockname);

	return h;

	write_failed:
	{
	int saveerrno = errno;
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	my_error_2 (_("error writing to '%s': %s\n"), h->tname, strerror (errno));
	if ( fd != -1 )
	close (fd);
	unlink (h->tname);
	xfree (h->tname);
	xfree (h);
	my_set_errno (saveerrno);
	}
	return NULL;
	}
	#endif /HAVE_POSIX_SYSTEM/


	#ifdef HAVE_DOSISH_SYSTEM
	/* Locking core for Windows. This version does not need a temporary
	file but uses the plain lock file along with record locking. We
	create this file here so that we later only need to do the file
	locking. For error reporting it is useful to keep the name of the
	file in the handle. */
	static dotlock_t
	dotlock_create_w32 (dotlock_t h, const char *file_to_lock)
	{
	LOCK_all_lockfiles ();
	h->next = all_lockfiles;
	all_lockfiles = h;

	h->lockname = xtrymalloc ( strlen (file_to_lock) + 6 );
	if (!h->lockname)
	{
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	xfree (h);
	return NULL;
	}
	strcpy (stpcpy(h->lockname, file_to_lock), EXTSEP_S "lock");

	/* If would be nice if we would use the FILE_FLAG_DELETE_ON_CLOSE
	along with FILE_SHARE_DELETE but that does not work due to a race
	condition: Despite the OPEN_ALWAYS flag CreateFile may return an
	error and we can't reliable create/open the lock file unless we
	would wait here until it works - however there are other valid
	reasons why a lock file can't be created and thus the process
	would not stop as expected but spin until Windows crashes. Our
	solution is to keep the lock file open; that does not harm. */
	{
	#ifdef HAVE_W32CE_SYSTEM
	wchar_t *wname = utf8_to_wchar (h->lockname);

	if (wname)
	h->lockhd = CreateFile (wname,
	GENERIC_READ\|GENERIC_WRITE,
	FILE_SHARE_READ\|FILE_SHARE_WRITE,
	NULL, OPEN_ALWAYS, 0, NULL);
	else
	h->lockhd = INVALID_HANDLE_VALUE;
	xfree (wname);
	#else
	h->lockhd = CreateFile (h->lockname,
	GENERIC_READ\|GENERIC_WRITE,
	FILE_SHARE_READ\|FILE_SHARE_WRITE,
	NULL, OPEN_ALWAYS, 0, NULL);
	#endif
	}
	if (h->lockhd == INVALID_HANDLE_VALUE)
	{
	int saveerrno = map_w32_to_errno (GetLastError ());
	all_lockfiles = h->next;
	UNLOCK_all_lockfiles ();
	my_error_2 (_("can't create '%s': %s\n"), h->lockname, w32_strerror (-1));
	xfree (h->lockname);
	xfree (h);
	my_set_errno (saveerrno);
	return NULL;
	}
	return h;
	}
	#endif /HAVE_DOSISH_SYSTEM/


	/* Create a lockfile for a file name FILE_TO_LOCK and returns an
	object of type dotlock_t which may be used later to actually acquire
	the lock. A cleanup routine gets installed to cleanup left over
	locks or other files used internally by the lock mechanism.

	Calling this function with NULL does only install the atexit
	handler and may thus be used to assure that the cleanup is called
	after all other atexit handlers.

	This function creates a lock file in the same directory as
	FILE_TO_LOCK using that name and a suffix of ".lock". Note that on
	POSIX systems a temporary file ".#lk.<hostname>.pid[.threadid] is
	used.

	FLAGS must be 0.

	The function returns an new handle which needs to be released using
	destroy_dotlock but gets also released at the termination of the
	process. On error NULL is returned.
	*/

	dotlock_t
	dotlock_create (const char *file_to_lock, unsigned int flags)
	{
	static int initialized;
	dotlock_t h;

	if ( !initialized )
	{
	atexit (dotlock_remove_lockfiles);
	initialized = 1;
	}

	if ( !file_to_lock )
	return NULL; /* Only initialization was requested. */

	if (flags)
	{
	my_set_errno (EINVAL);
	return NULL;
	}

	h = xtrycalloc (1, sizeof *h);
	if (!h)
	return NULL;
	h->extra_fd = -1;

	if (never_lock)
	{
	h->disable = 1;
	LOCK_all_lockfiles ();
	h->next = all_lockfiles;
	all_lockfiles = h;
	UNLOCK_all_lockfiles ();
	return h;
	}

	#ifdef HAVE_DOSISH_SYSTEM
	return dotlock_create_w32 (h, file_to_lock);
	#else /!HAVE_DOSISH_SYSTEM /
	return dotlock_create_unix (h, file_to_lock);
	#endif /!HAVE_DOSISH_SYSTEM/
	}



	-/* Convenience function to store a file descriptor (or any any other
	+/* Convenience function to store a file descriptor (or any other
	integer value) in the context of handle H. */
	void
	dotlock_set_fd (dotlock_t h, int fd)
	{
	h->extra_fd = fd;
	}

	-/* Convenience function to retrieve a file descriptor (or any any other
	+/* Convenience function to retrieve a file descriptor (or any other
	integer value) stored in the context of handle H. */
	int
	dotlock_get_fd (dotlock_t h)
	{
	return h->extra_fd;
	}



	#ifdef HAVE_POSIX_SYSTEM
	/* Unix specific code of destroy_dotlock. */
	static void
	dotlock_destroy_unix (dotlock_t h)
	{
	if (h->locked && h->lockname)
	unlink (h->lockname);
	if (h->tname && !h->use_o_excl)
	unlink (h->tname);
	xfree (h->tname);
	}
	#endif /HAVE_POSIX_SYSTEM/


	#ifdef HAVE_DOSISH_SYSTEM
	/* Windows specific code of destroy_dotlock. */
	static void
	dotlock_destroy_w32 (dotlock_t h)
	{
	if (h->locked)
	{
	OVERLAPPED ovl;

	memset (&ovl, 0, sizeof ovl);
	UnlockFileEx (h->lockhd, 0, 1, 0, &ovl);
	}
	CloseHandle (h->lockhd);
	}
	#endif /HAVE_DOSISH_SYSTEM/


	/* Destroy the lock handle H and release the lock. */
	void
	dotlock_destroy (dotlock_t h)
	{
	dotlock_t hprev, htmp;

	if ( !h )
	return;

	/* First remove the handle from our global list of all locks. */
	LOCK_all_lockfiles ();
	for (hprev=NULL, htmp=all_lockfiles; htmp; hprev=htmp, htmp=htmp->next)
	if (htmp == h)
	{
	if (hprev)
	hprev->next = htmp->next;
	else
	all_lockfiles = htmp->next;
	h->next = NULL;
	break;
	}
	UNLOCK_all_lockfiles ();

	/* Then destroy the lock. */
	if (!h->disable)
	{
	#ifdef HAVE_DOSISH_SYSTEM
	dotlock_destroy_w32 (h);
	#else /* !HAVE_DOSISH_SYSTEM */
	dotlock_destroy_unix (h);
	#endif /* HAVE_DOSISH_SYSTEM */
	xfree (h->lockname);
	}
	xfree(h);
	}



	#ifdef HAVE_POSIX_SYSTEM
	/* Unix specific code of make_dotlock. Returns 0 on success and -1 on
	error. */
	static int
	dotlock_take_unix (dotlock_t h, long timeout)
	{
	int wtime = 0;
	int sumtime = 0;
	int pid;
	int lastpid = -1;
	int ownerchanged;
	const char *maybe_dead="";
	int same_node;
	int saveerrno;

	again:
	if (h->use_o_excl)
	{
	/* No hardlink support - use open(O_EXCL). */
	int fd;

	do
	{
	my_set_errno (0);
	fd = open (h->lockname, O_WRONLY\|O_CREAT\|O_EXCL,
	S_IRUSR\|S_IRGRP\|S_IROTH\|S_IWUSR );
	}
	while (fd == -1 && errno == EINTR);

	if (fd == -1 && errno == EEXIST)
	; /* Lock held by another process. */
	else if (fd == -1)
	{
	saveerrno = errno;
	my_error_2 ("lock not made: open(O_EXCL) of '%s' failed: %s\n",
	h->lockname, strerror (saveerrno));
	my_set_errno (saveerrno);
	return -1;
	}
	else
	{
	char pidstr[16];

	snprintf (pidstr, sizeof pidstr, "%10d\n", (int)getpid());
	if (write (fd, pidstr, 11 ) == 11
	&& write (fd, h->tname + h->nodename_off,h->nodename_len)
	== h->nodename_len
	&& write (fd, "\n", 1) == 1
	&& !close (fd))
	{
	h->locked = 1;
	return 0;
	}
	/* Write error. */
	saveerrno = errno;
	my_error_2 ("lock not made: writing to '%s' failed: %s\n",
	h->lockname, strerror (errno));
	close (fd);
	unlink (h->lockname);
	my_set_errno (saveerrno);
	return -1;
	}
	}
	else /* Standard method: Use hardlinks. */
	{
	struct stat sb;

	/* We ignore the return value of link() because it is unreliable. */
	(void) link (h->tname, h->lockname);

	if (stat (h->tname, &sb))
	{
	saveerrno = errno;
	my_error_1 ("lock not made: Oops: stat of tmp file failed: %s\n",
	strerror (errno));
	/* In theory this might be a severe error: It is possible
	that link succeeded but stat failed due to changed
	permissions. We can't do anything about it, though. */
	my_set_errno (saveerrno);
	return -1;
	}

	if (sb.st_nlink == 2)
	{
	h->locked = 1;
	return 0; /* Okay. */
	}
	}

	/* Check for stale lock files. */
	if ( (pid = read_lockfile (h, &same_node)) == -1 )
	{
	if ( errno != ENOENT )
	{
	saveerrno = errno;
	my_info_0 ("cannot read lockfile\n");
	my_set_errno (saveerrno);
	return -1;
	}
	my_info_0 ("lockfile disappeared\n");
	goto again;
	}
	else if ( pid == getpid() && same_node )
	{
	my_info_0 ("Oops: lock already held by us\n");
	h->locked = 1;
	return 0; /* okay */
	}
	else if ( same_node && kill (pid, 0) && errno == ESRCH )
	{
	/* Note: It is unlikley that we get a race here unless a pid is
	reused too fast or a new process with the same pid as the one
	of the stale file tries to lock right at the same time as we. */
	my_info_1 (_("removing stale lockfile (created by %d)\n"), pid);
	unlink (h->lockname);
	goto again;
	}

	if (lastpid == -1)
	lastpid = pid;
	ownerchanged = (pid != lastpid);

	if (timeout)
	{
	struct timeval tv;

	/* Wait until lock has been released. We use increasing retry
	intervals of 50ms, 100ms, 200ms, 400ms, 800ms, 2s, 4s and 8s
	but reset it if the lock owner meanwhile changed. */
	if (!wtime \|\| ownerchanged)
	wtime = 50;
	else if (wtime < 800)
	wtime *= 2;
	else if (wtime == 800)
	wtime = 2000;
	else if (wtime < 8000)
	wtime *= 2;

	if (timeout > 0)
	{
	if (wtime > timeout)
	wtime = timeout;
	timeout -= wtime;
	}

	sumtime += wtime;
	if (sumtime >= 1500)
	{
	sumtime = 0;
	my_info_3 (_("waiting for lock (held by %d%s) %s...\n"),
	pid, maybe_dead, maybe_deadlock(h)? _("(deadlock?) "):"");
	}


	tv.tv_sec = wtime / 1000;
	tv.tv_usec = (wtime % 1000) * 1000;
	select (0, NULL, NULL, NULL, &tv);
	goto again;
	}

	my_set_errno (EACCES);
	return -1;
	}
	#endif /HAVE_POSIX_SYSTEM/


	#ifdef HAVE_DOSISH_SYSTEM
	/* Windows specific code of make_dotlock. Returns 0 on success and -1 on
	error. */
	static int
	dotlock_take_w32 (dotlock_t h, long timeout)
	{
	int wtime = 0;
	int w32err;
	OVERLAPPED ovl;

	again:
	/* Lock one byte at offset 0. The offset is given by OVL. */
	memset (&ovl, 0, sizeof ovl);
	if (LockFileEx (h->lockhd, (LOCKFILE_EXCLUSIVE_LOCK
	\| LOCKFILE_FAIL_IMMEDIATELY), 0, 1, 0, &ovl))
	{
	h->locked = 1;
	return 0; /* okay */
	}

	w32err = GetLastError ();
	if (w32err != ERROR_LOCK_VIOLATION)
	{
	my_error_2 (_("lock '%s' not made: %s\n"),
	h->lockname, w32_strerror (w32err));
	my_set_errno (map_w32_to_errno (w32err));
	return -1;
	}

	if (timeout)
	{
	/* Wait until lock has been released. We use retry intervals of
	50ms, 100ms, 200ms, 400ms, 800ms, 2s, 4s and 8s. */
	if (!wtime)
	wtime = 50;
	else if (wtime < 800)
	wtime *= 2;
	else if (wtime == 800)
	wtime = 2000;
	else if (wtime < 8000)
	wtime *= 2;

	if (timeout > 0)
	{
	if (wtime > timeout)
	wtime = timeout;
	timeout -= wtime;
	}

	if (wtime >= 800)
	my_info_1 (_("waiting for lock %s...\n"), h->lockname);

	Sleep (wtime);
	goto again;
	}

	my_set_errno (EACCES);
	return -1;
	}
	#endif /HAVE_DOSISH_SYSTEM/


	/* Take a lock on H. A value of 0 for TIMEOUT returns immediately if
	the lock can't be taked, -1 waits forever (hopefully not), other
	values wait for TIMEOUT milliseconds. Returns: 0 on success */
	int
	dotlock_take (dotlock_t h, long timeout)
	{
	int ret;

	if ( h->disable )
	return 0; /* Locks are completely disabled. Return success. */

	if ( h->locked )
	{
	my_debug_1 ("Oops, '%s' is already locked\n", h->lockname);
	return 0;
	}

	#ifdef HAVE_DOSISH_SYSTEM
	ret = dotlock_take_w32 (h, timeout);
	#else /!HAVE_DOSISH_SYSTEM/
	ret = dotlock_take_unix (h, timeout);
	#endif /!HAVE_DOSISH_SYSTEM/

	return ret;
	}



	#ifdef HAVE_POSIX_SYSTEM
	/* Unix specific code of release_dotlock. */
	static int
	dotlock_release_unix (dotlock_t h)
	{
	int pid, same_node;
	int saveerrno;

	pid = read_lockfile (h, &same_node);
	if ( pid == -1 )
	{
	saveerrno = errno;
	my_error_0 ("release_dotlock: lockfile error\n");
	my_set_errno (saveerrno);
	return -1;
	}
	if ( pid != getpid() \|\| !same_node )
	{
	my_error_1 ("release_dotlock: not our lock (pid=%d)\n", pid);
	my_set_errno (EACCES);
	return -1;
	}

	if ( unlink( h->lockname ) )
	{
	saveerrno = errno;
	my_error_1 ("release_dotlock: error removing lockfile '%s'\n",
	h->lockname);
	my_set_errno (saveerrno);
	return -1;
	}
	/* Fixme: As an extra check we could check whether the link count is
	now really at 1. */
	return 0;
	}
	#endif /HAVE_POSIX_SYSTEM /


	#ifdef HAVE_DOSISH_SYSTEM
	/* Windows specific code of release_dotlock. */
	static int
	dotlock_release_w32 (dotlock_t h)
	{
	OVERLAPPED ovl;

	memset (&ovl, 0, sizeof ovl);
	if (!UnlockFileEx (h->lockhd, 0, 1, 0, &ovl))
	{
	int saveerrno = map_w32_to_errno (GetLastError ());
	my_error_2 ("release_dotlock: error removing lockfile '%s': %s\n",
	h->lockname, w32_strerror (-1));
	my_set_errno (saveerrno);
	return -1;
	}

	return 0;
	}
	#endif /HAVE_DOSISH_SYSTEM /


	/* Release a lock. Returns 0 on success. */
	int
	dotlock_release (dotlock_t h)
	{
	int ret;

	/* To avoid atexit race conditions we first check whether there are
	any locks left. It might happen that another atexit handler
	tries to release the lock while the atexit handler of this module
	already ran and thus H is undefined. */
	LOCK_all_lockfiles ();
	ret = !all_lockfiles;
	UNLOCK_all_lockfiles ();
	if (ret)
	return 0;

	if ( h->disable )
	return 0;

	if ( !h->locked )
	{
	my_debug_1 ("Oops, '%s' is not locked\n", h->lockname);
	return 0;
	}

	#ifdef HAVE_DOSISH_SYSTEM
	ret = dotlock_release_w32 (h);
	#else
	ret = dotlock_release_unix (h);
	#endif

	if (!ret)
	h->locked = 0;
	return ret;
	}



	/* Remove all lockfiles. This is called by the atexit handler
	installed by this module but may also be called by other
	termination handlers. */
	void
	dotlock_remove_lockfiles (void)
	{
	dotlock_t h, h2;

	/* First set the lockfiles list to NULL so that for example
	dotlock_release is aware that this function is currently
	running. */
	LOCK_all_lockfiles ();
	h = all_lockfiles;
	all_lockfiles = NULL;
	UNLOCK_all_lockfiles ();

	while ( h )
	{
	h2 = h->next;
	dotlock_destroy (h);
	h = h2;
	}
	}
	diff --git a/common/iobuf.c b/common/iobuf.c
	index d346027e4..db66a7f17 100644
	--- a/common/iobuf.c
	+++ b/common/iobuf.c
	@@ -1,2698 +1,2698 @@
	/* iobuf.c - File Handling for OpenPGP.
	* Copyright (C) 1998, 1999, 2000, 2001, 2003, 2004, 2006, 2007, 2008,
	* 2009, 2010, 2011 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <fcntl.h>
	#include <unistd.h>
	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h>
	#endif
	#ifdef __riscos__
	# include <kernel.h>
	# include <swis.h>
	#endif /* __riscos__ */

	#include <assuan.h>

	#include "util.h"
	#include "sysutils.h"
	#include "iobuf.h"

	/-- Begin configurable part. --/

	/* The size of the internal buffers.
	NOTE: If you change this value you MUST also adjust the regression
	test "armored_key_8192" in armor.test! */
	#define IOBUF_BUFFER_SIZE 8192

	/* To avoid a potential DoS with compression packets we better limit
	the number of filters in a chain. */
	#define MAX_NESTING_FILTER 64

	/-- End configurable part. --/


	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_W32CE_SYSTEM
	# define FD_FOR_STDIN (es_fileno (es_stdin))
	# define FD_FOR_STDOUT (es_fileno (es_stdout))
	# else
	# define FD_FOR_STDIN (GetStdHandle (STD_INPUT_HANDLE))
	# define FD_FOR_STDOUT (GetStdHandle (STD_OUTPUT_HANDLE))
	# endif
	#else /!HAVE_W32_SYSTEM/
	# define FD_FOR_STDIN (0)
	# define FD_FOR_STDOUT (1)
	#endif /!HAVE_W32_SYSTEM/


	/* The context used by the file filter. */
	typedef struct
	{
	gnupg_fd_t fp; /* Open file pointer or handle. */
	int keep_open;
	int no_cache;
	int eof_seen;
	int print_only_name; /* Flags indicating that fname is not a real file. */
	char fname[1]; /* Name of the file. */
	} file_filter_ctx_t;

	/* The context used by the estream filter. */
	typedef struct
	{
	estream_t fp; /* Open estream handle. */
	int keep_open;
	int no_cache;
	int eof_seen;
	int print_only_name; /* Flags indicating that fname is not a real file. */
	char fname[1]; /* Name of the file. */
	} file_es_filter_ctx_t;


	/* Object to control the "close cache". */
	struct close_cache_s
	{
	struct close_cache_s *next;
	gnupg_fd_t fp;
	char fname[1];
	};
	typedef struct close_cache_s *close_cache_t;
	static close_cache_t close_cache;



	#ifdef HAVE_W32_SYSTEM
	typedef struct
	{
	int sock;
	int keep_open;
	int no_cache;
	int eof_seen;
	int print_only_name; /* Flag indicating that fname is not a real file. */
	char fname[1]; /* Name of the file */

	} sock_filter_ctx_t;
	#endif /HAVE_W32_SYSTEM/

	/* The first partial length header block must be of size 512 to make
	* it easier (and more efficient) we use a min. block size of 512 for
	* all chunks (but the last one) */
	#define OP_MIN_PARTIAL_CHUNK 512
	#define OP_MIN_PARTIAL_CHUNK_2POW 9

	/* The context we use for the block filter (used to handle OpenPGP
	length information header). */
	typedef struct
	{
	int use;
	size_t size;
	size_t count;
	int partial; /* 1 = partial header, 2 in last partial packet. */
	char buffer; / Used for partial header. */
	size_t buflen; /* Used size of buffer. */
	int first_c; /* First character of a partial header (which is > 0). */
	int eof;
	}
	block_filter_ctx_t;


	/* Local prototypes. */
	static int underflow (iobuf_t a, int clear_pending_eof);
	static int underflow_target (iobuf_t a, int clear_pending_eof, size_t target);
	static int translate_file_handle (int fd, int for_write);

	/* Sends any pending data to the filter's FILTER function. Note: this
	works on the filter and not on the whole pipeline. That is,
	iobuf_flush doesn't necessarily cause data to be written to any
	underlying file; it just causes any data buffered at the filter A
	to be sent to A's filter function.

	If A is a IOBUF_OUTPUT_TEMP filter, then this also enlarges the
	buffer by IOBUF_BUFFER_SIZE.

	May only be called on an IOBUF_OUTPUT or IOBUF_OUTPUT_TEMP filters. */
	static int filter_flush (iobuf_t a);



	/* This is a replacement for strcmp. Under W32 it does not
	distinguish between backslash and slash. */
	static int
	fd_cache_strcmp (const char a, const char b)
	{
	#ifdef HAVE_DOSISH_SYSTEM
	for (; a && b; a++, b++)
	{
	if (a != b && !((a == '/' && b == '\\')
	\|\| (a == '\\' && b == '/')) )
	break;
	}
	return (const unsigned char )a - (const unsigned char )b;
	#else
	return strcmp (a, b);
	#endif
	}

	/*
	* Invalidate (i.e. close) a cached iobuf
	*/
	static int
	fd_cache_invalidate (const char *fname)
	{
	close_cache_t cc;
	int rc = 0;

	assert (fname);
	if (DBG_IOBUF)
	log_debug ("fd_cache_invalidate (%s)\n", fname);

	for (cc = close_cache; cc; cc = cc->next)
	{
	if (cc->fp != GNUPG_INVALID_FD && !fd_cache_strcmp (cc->fname, fname))
	{
	if (DBG_IOBUF)
	log_debug (" did (%s)\n", cc->fname);
	#ifdef HAVE_W32_SYSTEM
	if (!CloseHandle (cc->fp))
	rc = -1;
	#else
	rc = close (cc->fp);
	#endif
	cc->fp = GNUPG_INVALID_FD;
	}
	}
	return rc;
	}


	/* Try to sync changes to the disk. This is to avoid data loss during
	a system crash in write/close/rename cycle on some file
	systems. */
	static int
	fd_cache_synchronize (const char *fname)
	{
	int err = 0;

	#ifdef HAVE_FSYNC
	close_cache_t cc;

	if (DBG_IOBUF)
	log_debug ("fd_cache_synchronize (%s)\n", fname);

	for (cc=close_cache; cc; cc = cc->next )
	{
	if (cc->fp != GNUPG_INVALID_FD && !fd_cache_strcmp (cc->fname, fname))
	{
	if (DBG_IOBUF)
	log_debug (" did (%s)\n", cc->fname);

	err = fsync (cc->fp);
	}
	}
	#else
	(void)fname;
	#endif /HAVE_FSYNC/

	return err;
	}


	static gnupg_fd_t
	direct_open (const char fname, const char mode, int mode700)
	{
	#ifdef HAVE_W32_SYSTEM
	unsigned long da, cd, sm;
	HANDLE hfile;

	(void)mode700;
	/* Note, that we do not handle all mode combinations */

	/* According to the ReactOS source it seems that open() of the
	* standard MSW32 crt does open the file in shared mode which is
	* something new for MS applications ;-)
	*/
	if (strchr (mode, '+'))
	{
	if (fd_cache_invalidate (fname))
	return GNUPG_INVALID_FD;
	da = GENERIC_READ \| GENERIC_WRITE;
	cd = OPEN_EXISTING;
	sm = FILE_SHARE_READ \| FILE_SHARE_WRITE;
	}
	else if (strchr (mode, 'w'))
	{
	if (fd_cache_invalidate (fname))
	return GNUPG_INVALID_FD;
	da = GENERIC_WRITE;
	cd = CREATE_ALWAYS;
	sm = FILE_SHARE_WRITE;
	}
	else
	{
	da = GENERIC_READ;
	cd = OPEN_EXISTING;
	sm = FILE_SHARE_READ;
	}

	#ifdef HAVE_W32CE_SYSTEM
	{
	wchar_t *wfname = utf8_to_wchar (fname);
	if (wfname)
	{
	hfile = CreateFile (wfname, da, sm, NULL, cd,
	FILE_ATTRIBUTE_NORMAL, NULL);
	xfree (wfname);
	}
	else
	hfile = INVALID_HANDLE_VALUE;
	}
	#else
	hfile = CreateFile (fname, da, sm, NULL, cd, FILE_ATTRIBUTE_NORMAL, NULL);
	#endif
	return hfile;

	#else /!HAVE_W32_SYSTEM/

	int oflag;
	int cflag = S_IRUSR \| S_IWUSR;

	if (!mode700)
	cflag \|= S_IRGRP \| S_IWGRP \| S_IROTH \| S_IWOTH;

	/* Note, that we do not handle all mode combinations */
	if (strchr (mode, '+'))
	{
	if (fd_cache_invalidate (fname))
	return GNUPG_INVALID_FD;
	oflag = O_RDWR;
	}
	else if (strchr (mode, 'w'))
	{
	if (fd_cache_invalidate (fname))
	return GNUPG_INVALID_FD;
	oflag = O_WRONLY \| O_CREAT \| O_TRUNC;
	}
	else
	{
	oflag = O_RDONLY;
	}
	#ifdef O_BINARY
	if (strchr (mode, 'b'))
	oflag \|= O_BINARY;
	#endif

	#ifdef __riscos__
	{
	struct stat buf;

	/* Don't allow iobufs on directories */
	if (!stat (fname, &buf) && S_ISDIR (buf.st_mode) && !S_ISREG (buf.st_mode))
	return __set_errno (EISDIR);
	}
	#endif
	return open (fname, oflag, cflag);

	#endif /!HAVE_W32_SYSTEM/
	}


	/*
	* Instead of closing an FD we keep it open and cache it for later reuse
	* Note that this caching strategy only works if the process does not chdir.
	*/
	static void
	fd_cache_close (const char *fname, gnupg_fd_t fp)
	{
	close_cache_t cc;

	assert (fp);
	if (!fname \|\| !*fname)
	{
	#ifdef HAVE_W32_SYSTEM
	CloseHandle (fp);
	#else
	close (fp);
	#endif
	if (DBG_IOBUF)
	log_debug ("fd_cache_close (%d) real\n", (int)fp);
	return;
	}
	/* try to reuse a slot */
	for (cc = close_cache; cc; cc = cc->next)
	{
	if (cc->fp == GNUPG_INVALID_FD && !fd_cache_strcmp (cc->fname, fname))
	{
	cc->fp = fp;
	if (DBG_IOBUF)
	log_debug ("fd_cache_close (%s) used existing slot\n", fname);
	return;
	}
	}
	/* add a new one */
	if (DBG_IOBUF)
	log_debug ("fd_cache_close (%s) new slot created\n", fname);
	cc = xcalloc (1, sizeof *cc + strlen (fname));
	strcpy (cc->fname, fname);
	cc->fp = fp;
	cc->next = close_cache;
	close_cache = cc;
	}

	/*
	* Do a direct_open on FNAME but first try to reuse one from the fd_cache
	*/
	static gnupg_fd_t
	fd_cache_open (const char fname, const char mode)
	{
	close_cache_t cc;

	assert (fname);
	for (cc = close_cache; cc; cc = cc->next)
	{
	if (cc->fp != GNUPG_INVALID_FD && !fd_cache_strcmp (cc->fname, fname))
	{
	gnupg_fd_t fp = cc->fp;
	cc->fp = GNUPG_INVALID_FD;
	if (DBG_IOBUF)
	log_debug ("fd_cache_open (%s) using cached fp\n", fname);
	#ifdef HAVE_W32_SYSTEM
	if (SetFilePointer (fp, 0, NULL, FILE_BEGIN) == 0xffffffff)
	{
	log_error ("rewind file failed on handle %p: ec=%d\n",
	fp, (int) GetLastError ());
	fp = GNUPG_INVALID_FD;
	}
	#else
	if (lseek (fp, 0, SEEK_SET) == (off_t) - 1)
	{
	log_error ("can't rewind fd %d: %s\n", fp, strerror (errno));
	fp = GNUPG_INVALID_FD;
	}
	#endif
	return fp;
	}
	}
	if (DBG_IOBUF)
	log_debug ("fd_cache_open (%s) not cached\n", fname);
	return direct_open (fname, mode, 0);
	}


	static int
	file_filter (void opaque, int control, iobuf_t chain, byte buf,
	size_t * ret_len)
	{
	file_filter_ctx_t *a = opaque;
	gnupg_fd_t f = a->fp;
	size_t size = *ret_len;
	size_t nbytes = 0;
	int rc = 0;

	(void)chain; /* Not used. */

	if (control == IOBUFCTRL_UNDERFLOW)
	{
	assert (size); /* We need a buffer. */
	if (a->eof_seen)
	{
	rc = -1;
	*ret_len = 0;
	}
	else
	{
	#ifdef HAVE_W32_SYSTEM
	unsigned long nread;

	nbytes = 0;
	if (!ReadFile (f, buf, size, &nread, NULL))
	{
	int ec = (int) GetLastError ();
	if (ec != ERROR_BROKEN_PIPE)
	{
	rc = gpg_error_from_errno (ec);
	log_error ("%s: read error: ec=%d\n", a->fname, ec);
	}
	}
	else if (!nread)
	{
	a->eof_seen = 1;
	rc = -1;
	}
	else
	{
	nbytes = nread;
	}

	#else

	int n;

	nbytes = 0;
	do
	{
	n = read (f, buf, size);
	}
	while (n == -1 && errno == EINTR);
	if (n == -1)
	{ /* error */
	if (errno != EPIPE)
	{
	rc = gpg_error_from_syserror ();
	log_error ("%s: read error: %s\n",
	a->fname, strerror (errno));
	}
	}
	else if (!n)
	{ /* eof */
	a->eof_seen = 1;
	rc = -1;
	}
	else
	{
	nbytes = n;
	}
	#endif
	*ret_len = nbytes;
	}
	}
	else if (control == IOBUFCTRL_FLUSH)
	{
	if (size)
	{
	#ifdef HAVE_W32_SYSTEM
	byte *p = buf;
	unsigned long n;

	nbytes = size;
	do
	{
	if (size && !WriteFile (f, p, nbytes, &n, NULL))
	{
	int ec = (int) GetLastError ();
	rc = gpg_error_from_errno (ec);
	log_error ("%s: write error: ec=%d\n", a->fname, ec);
	break;
	}
	p += n;
	nbytes -= n;
	}
	while (nbytes);
	nbytes = p - buf;
	#else
	byte *p = buf;
	int n;

	nbytes = size;
	do
	{
	do
	{
	n = write (f, p, nbytes);
	}
	while (n == -1 && errno == EINTR);
	if (n > 0)
	{
	p += n;
	nbytes -= n;
	}
	}
	while (n != -1 && nbytes);
	if (n == -1)
	{
	rc = gpg_error_from_syserror ();
	log_error ("%s: write error: %s\n", a->fname, strerror (errno));
	}
	nbytes = p - buf;
	#endif
	}
	*ret_len = nbytes;
	}
	else if (control == IOBUFCTRL_INIT)
	{
	a->eof_seen = 0;
	a->keep_open = 0;
	a->no_cache = 0;
	}
	else if (control == IOBUFCTRL_DESC)
	{
	mem2str (buf, "file_filter(fd)", *ret_len);
	}
	else if (control == IOBUFCTRL_FREE)
	{
	if (f != FD_FOR_STDIN && f != FD_FOR_STDOUT)
	{
	if (DBG_IOBUF)
	log_debug ("%s: close fd/handle %d\n", a->fname, FD2INT (f));
	if (!a->keep_open)
	fd_cache_close (a->no_cache ? NULL : a->fname, f);
	}
	xfree (a); /* We can free our context now. */
	}

	return rc;
	}


	/* Similar to file_filter but using the estream system. */
	static int
	file_es_filter (void opaque, int control, iobuf_t chain, byte buf,
	size_t * ret_len)
	{
	file_es_filter_ctx_t *a = opaque;
	estream_t f = a->fp;
	size_t size = *ret_len;
	size_t nbytes = 0;
	int rc = 0;

	(void)chain; /* Not used. */

	if (control == IOBUFCTRL_UNDERFLOW)
	{
	assert (size); /* We need a buffer. */
	if (a->eof_seen)
	{
	rc = -1;
	*ret_len = 0;
	}
	else
	{
	nbytes = 0;
	rc = es_read (f, buf, size, &nbytes);
	if (rc == -1)
	{ /* error */
	rc = gpg_error_from_syserror ();
	log_error ("%s: read error: %s\n", a->fname, strerror (errno));
	}
	else if (!nbytes)
	{ /* eof */
	a->eof_seen = 1;
	rc = -1;
	}
	*ret_len = nbytes;
	}
	}
	else if (control == IOBUFCTRL_FLUSH)
	{
	if (size)
	{
	byte *p = buf;
	size_t nwritten;

	nbytes = size;
	do
	{
	nwritten = 0;
	if (es_write (f, p, nbytes, &nwritten))
	{
	rc = gpg_error_from_syserror ();
	log_error ("%s: write error: %s\n",
	a->fname, strerror (errno));
	break;
	}
	p += nwritten;
	nbytes -= nwritten;
	}
	while (nbytes);
	nbytes = p - buf;
	}
	*ret_len = nbytes;
	}
	else if (control == IOBUFCTRL_INIT)
	{
	a->eof_seen = 0;
	a->no_cache = 0;
	}
	else if (control == IOBUFCTRL_DESC)
	{
	mem2str (buf, "estream_filter", *ret_len);
	}
	else if (control == IOBUFCTRL_FREE)
	{
	if (f != es_stdin && f != es_stdout)
	{
	if (DBG_IOBUF)
	log_debug ("%s: es_fclose %p\n", a->fname, f);
	if (!a->keep_open)
	es_fclose (f);
	}
	f = NULL;
	xfree (a); /* We can free our context now. */
	}

	return rc;
	}


	#ifdef HAVE_W32_SYSTEM
	/* Because network sockets are special objects under Lose32 we have to
	use a dedicated filter for them. */
	static int
	sock_filter (void opaque, int control, iobuf_t chain, byte buf,
	size_t * ret_len)
	{
	sock_filter_ctx_t *a = opaque;
	size_t size = *ret_len;
	size_t nbytes = 0;
	int rc = 0;

	(void)chain;

	if (control == IOBUFCTRL_UNDERFLOW)
	{
	assert (size); /* need a buffer */
	if (a->eof_seen)
	{
	rc = -1;
	*ret_len = 0;
	}
	else
	{
	int nread;

	nread = recv (a->sock, buf, size, 0);
	if (nread == SOCKET_ERROR)
	{
	int ec = (int) WSAGetLastError ();
	rc = gpg_error_from_errno (ec);
	log_error ("socket read error: ec=%d\n", ec);
	}
	else if (!nread)
	{
	a->eof_seen = 1;
	rc = -1;
	}
	else
	{
	nbytes = nread;
	}
	*ret_len = nbytes;
	}
	}
	else if (control == IOBUFCTRL_FLUSH)
	{
	if (size)
	{
	byte *p = buf;
	int n;

	nbytes = size;
	do
	{
	n = send (a->sock, p, nbytes, 0);
	if (n == SOCKET_ERROR)
	{
	int ec = (int) WSAGetLastError ();
	rc = gpg_error_from_errno (ec);
	log_error ("socket write error: ec=%d\n", ec);
	break;
	}
	p += n;
	nbytes -= n;
	}
	while (nbytes);
	nbytes = p - buf;
	}
	*ret_len = nbytes;
	}
	else if (control == IOBUFCTRL_INIT)
	{
	a->eof_seen = 0;
	a->keep_open = 0;
	a->no_cache = 0;
	}
	else if (control == IOBUFCTRL_DESC)
	{
	mem2str (buf, "sock_filter", *ret_len);
	}
	else if (control == IOBUFCTRL_FREE)
	{
	if (!a->keep_open)
	closesocket (a->sock);
	xfree (a); /* we can free our context now */
	}
	return rc;
	}
	#endif /HAVE_W32_SYSTEM/

	/****************
	* This is used to implement the block write mode.
	* Block reading is done on a byte by byte basis in readbyte(),
	* without a filter
	*/
	static int
	block_filter (void opaque, int control, iobuf_t chain, byte buffer,
	size_t * ret_len)
	{
	block_filter_ctx_t *a = opaque;
	char buf = (char )buffer;
	size_t size = *ret_len;
	int c, needed, rc = 0;
	char *p;

	if (control == IOBUFCTRL_UNDERFLOW)
	{
	size_t n = 0;

	p = buf;
	assert (size); /* need a buffer */
	if (a->eof) /* don't read any further */
	rc = -1;
	while (!rc && size)
	{
	if (!a->size)
	{ /* get the length bytes */
	if (a->partial == 2)
	{
	a->eof = 1;
	if (!n)
	rc = -1;
	break;
	}
	else if (a->partial)
	{
	/* These OpenPGP introduced huffman like encoded length
	* bytes are really a mess :-( */
	if (a->first_c)
	{
	c = a->first_c;
	a->first_c = 0;
	}
	else if ((c = iobuf_get (chain)) == -1)
	{
	log_error ("block_filter: 1st length byte missing\n");
	rc = GPG_ERR_BAD_DATA;
	break;
	}
	if (c < 192)
	{
	a->size = c;
	a->partial = 2;
	if (!a->size)
	{
	a->eof = 1;
	if (!n)
	rc = -1;
	break;
	}
	}
	else if (c < 224)
	{
	a->size = (c - 192) * 256;
	if ((c = iobuf_get (chain)) == -1)
	{
	log_error
	("block_filter: 2nd length byte missing\n");
	rc = GPG_ERR_BAD_DATA;
	break;
	}
	a->size += c + 192;
	a->partial = 2;
	if (!a->size)
	{
	a->eof = 1;
	if (!n)
	rc = -1;
	break;
	}
	}
	else if (c == 255)
	{
	a->size = (size_t)iobuf_get (chain) << 24;
	a->size \|= iobuf_get (chain) << 16;
	a->size \|= iobuf_get (chain) << 8;
	if ((c = iobuf_get (chain)) == -1)
	{
	log_error ("block_filter: invalid 4 byte length\n");
	rc = GPG_ERR_BAD_DATA;
	break;
	}
	a->size \|= c;
	a->partial = 2;
	if (!a->size)
	{
	a->eof = 1;
	if (!n)
	rc = -1;
	break;
	}
	}
	else
	{ /* Next partial body length. */
	a->size = 1 << (c & 0x1f);
	}
	/* log_debug("partial: ctx=%p c=%02x size=%u\n", a, c, a->size); */
	}
	else
	BUG ();
	}

	while (!rc && size && a->size)
	{
	needed = size < a->size ? size : a->size;
	c = iobuf_read (chain, p, needed);
	if (c < needed)
	{
	if (c == -1)
	c = 0;
	log_error
	("block_filter %p: read error (size=%lu,a->size=%lu)\n",
	a, (ulong) size + c, (ulong) a->size + c);
	rc = GPG_ERR_BAD_DATA;
	}
	else
	{
	size -= c;
	a->size -= c;
	p += c;
	n += c;
	}
	}
	}
	*ret_len = n;
	}
	else if (control == IOBUFCTRL_FLUSH)
	{
	if (a->partial)
	{ /* the complicated openpgp scheme */
	size_t blen, n, nbytes = size + a->buflen;

	assert (a->buflen <= OP_MIN_PARTIAL_CHUNK);
	if (nbytes < OP_MIN_PARTIAL_CHUNK)
	{
	/* not enough to write a partial block out; so we store it */
	if (!a->buffer)
	a->buffer = xmalloc (OP_MIN_PARTIAL_CHUNK);
	memcpy (a->buffer + a->buflen, buf, size);
	a->buflen += size;
	}
	else
	{ /* okay, we can write out something */
	/* do this in a loop to use the most efficient block lengths */
	p = buf;
	do
	{
	/* find the best matching block length - this is limited
	* by the size of the internal buffering */
	for (blen = OP_MIN_PARTIAL_CHUNK * 2,
	c = OP_MIN_PARTIAL_CHUNK_2POW + 1; blen <= nbytes;
	blen *= 2, c++)
	;
	blen /= 2;
	c--;
	/* write the partial length header */
	assert (c <= 0x1f); /;-) /
	c \|= 0xe0;
	iobuf_put (chain, c);
	if ((n = a->buflen))
	{ /* write stuff from the buffer */
	assert (n == OP_MIN_PARTIAL_CHUNK);
	if (iobuf_write (chain, a->buffer, n))
	rc = gpg_error_from_syserror ();
	a->buflen = 0;
	nbytes -= n;
	}
	if ((n = nbytes) > blen)
	n = blen;
	if (n && iobuf_write (chain, p, n))
	rc = gpg_error_from_syserror ();
	p += n;
	nbytes -= n;
	}
	while (!rc && nbytes >= OP_MIN_PARTIAL_CHUNK);
	/* store the rest in the buffer */
	if (!rc && nbytes)
	{
	assert (!a->buflen);
	assert (nbytes < OP_MIN_PARTIAL_CHUNK);
	if (!a->buffer)
	a->buffer = xmalloc (OP_MIN_PARTIAL_CHUNK);
	memcpy (a->buffer, p, nbytes);
	a->buflen = nbytes;
	}
	}
	}
	else
	BUG ();
	}
	else if (control == IOBUFCTRL_INIT)
	{
	if (DBG_IOBUF)
	log_debug ("init block_filter %p\n", a);
	if (a->partial)
	a->count = 0;
	else if (a->use == IOBUF_INPUT)
	a->count = a->size = 0;
	else
	a->count = a->size; /* force first length bytes */
	a->eof = 0;
	a->buffer = NULL;
	a->buflen = 0;
	}
	else if (control == IOBUFCTRL_DESC)
	{
	mem2str (buf, "block_filter", *ret_len);
	}
	else if (control == IOBUFCTRL_FREE)
	{
	if (a->use == IOBUF_OUTPUT)
	{ /* write the end markers */
	if (a->partial)
	{
	u32 len;
	/* write out the remaining bytes without a partial header
	* the length of this header may be 0 - but if it is
	* the first block we are not allowed to use a partial header
	* and frankly we can't do so, because this length must be
	* a power of 2. This is _really_ complicated because we
	* have to check the possible length of a packet prior
	* to it's creation: a chain of filters becomes complicated
	* and we need a lot of code to handle compressed packets etc.
	* :-(((((((
	*/
	/* construct header */
	len = a->buflen;
	/log_debug("partial: remaining length=%u\n", len ); /
	if (len < 192)
	rc = iobuf_put (chain, len);
	else if (len < 8384)
	{
	if (!(rc = iobuf_put (chain, ((len - 192) / 256) + 192)))
	rc = iobuf_put (chain, ((len - 192) % 256));
	}
	else
	{ /* use a 4 byte header */
	if (!(rc = iobuf_put (chain, 0xff)))
	if (!(rc = iobuf_put (chain, (len >> 24) & 0xff)))
	if (!(rc = iobuf_put (chain, (len >> 16) & 0xff)))
	if (!(rc = iobuf_put (chain, (len >> 8) & 0xff)))
	rc = iobuf_put (chain, len & 0xff);
	}
	if (!rc && len)
	rc = iobuf_write (chain, a->buffer, len);
	if (rc)
	{
	log_error ("block_filter: write error: %s\n",
	strerror (errno));
	rc = gpg_error_from_syserror ();
	}
	xfree (a->buffer);
	a->buffer = NULL;
	a->buflen = 0;
	}
	else
	BUG ();
	}
	else if (a->size)
	{
	log_error ("block_filter: pending bytes!\n");
	}
	if (DBG_IOBUF)
	log_debug ("free block_filter %p\n", a);
	xfree (a); /* we can free our context now */
	}

	return rc;
	}

	#define MAX_IOBUF_DESC 32
	/*
	* Fill the buffer by the description of iobuf A.
	* The buffer size should be MAX_IOBUF_DESC (or larger).
	* Returns BUF as (const char *).
	*/
	static const char *
	iobuf_desc (iobuf_t a, byte *buf)
	{
	size_t len = MAX_IOBUF_DESC;

	if (! a \|\| ! a->filter)
	memcpy (buf, "?", 2);
	else
	a->filter (a->filter_ov, IOBUFCTRL_DESC, NULL, buf, &len);

	return buf;
	}

	static void
	print_chain (iobuf_t a)
	{
	if (!DBG_IOBUF)
	return;
	for (; a; a = a->chain)
	{
	byte desc[MAX_IOBUF_DESC];

	log_debug ("iobuf chain: %d.%d '%s' filter_eof=%d start=%d len=%d\n",
	a->no, a->subno, iobuf_desc (a, desc), a->filter_eof,
	(int) a->d.start, (int) a->d.len);
	}
	}

	int
	iobuf_print_chain (iobuf_t a)
	{
	print_chain (a);
	return 0;
	}

	iobuf_t
	iobuf_alloc (int use, size_t bufsize)
	{
	iobuf_t a;
	static int number = 0;

	assert (use == IOBUF_INPUT \|\| use == IOBUF_INPUT_TEMP
	\|\| use == IOBUF_OUTPUT \|\| use == IOBUF_OUTPUT_TEMP);
	if (bufsize == 0)
	{
	log_bug ("iobuf_alloc() passed a bufsize of 0!\n");
	bufsize = IOBUF_BUFFER_SIZE;
	}

	a = xcalloc (1, sizeof *a);
	a->use = use;
	a->d.buf = xmalloc (bufsize);
	a->d.size = bufsize;
	a->no = ++number;
	a->subno = 0;
	a->real_fname = NULL;
	return a;
	}

	int
	iobuf_close (iobuf_t a)
	{
	iobuf_t a_chain;
	size_t dummy_len = 0;
	int rc = 0;

	for (; a; a = a_chain)
	{
	byte desc[MAX_IOBUF_DESC];
	int rc2 = 0;

	a_chain = a->chain;

	if (a->use == IOBUF_OUTPUT && (rc = filter_flush (a)))
	log_error ("filter_flush failed on close: %s\n", gpg_strerror (rc));

	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: close '%s'\n",
	a->no, a->subno, iobuf_desc (a, desc));

	if (a->filter && (rc2 = a->filter (a->filter_ov, IOBUFCTRL_FREE,
	a->chain, NULL, &dummy_len)))
	log_error ("IOBUFCTRL_FREE failed on close: %s\n", gpg_strerror (rc));
	if (! rc && rc2)
	/* Whoops! An error occurred. Save it in RC if we haven't
	already recorded an error. */
	rc = rc2;

	xfree (a->real_fname);
	if (a->d.buf)
	{
	memset (a->d.buf, 0, a->d.size); /* erase the buffer */
	xfree (a->d.buf);
	}
	xfree (a);
	}
	return rc;
	}

	int
	iobuf_cancel (iobuf_t a)
	{
	const char *s;
	iobuf_t a2;
	int rc;
	#if defined(HAVE_W32_SYSTEM) \|\| defined(__riscos__)
	char *remove_name = NULL;
	#endif

	if (a && a->use == IOBUF_OUTPUT)
	{
	s = iobuf_get_real_fname (a);
	if (s && *s)
	{
	#if defined(HAVE_W32_SYSTEM) \|\| defined(__riscos__)
	remove_name = xstrdup (s);
	#else
	remove (s);
	#endif
	}
	}

	/* send a cancel message to all filters */
	for (a2 = a; a2; a2 = a2->chain)
	{
	size_t dummy;
	if (a2->filter)
	a2->filter (a2->filter_ov, IOBUFCTRL_CANCEL, a2->chain, NULL, &dummy);
	}

	rc = iobuf_close (a);
	#if defined(HAVE_W32_SYSTEM) \|\| defined(__riscos__)
	if (remove_name)
	{
	/* Argg, MSDOS does not allow removing open files. So
	* we have to do it here */
	#ifdef HAVE_W32CE_SYSTEM
	wchar_t *wtmp = utf8_to_wchar (remove_name);
	if (wtmp)
	DeleteFile (wtmp);
	xfree (wtmp);
	#else
	remove (remove_name);
	#endif
	xfree (remove_name);
	}
	#endif
	return rc;
	}


	iobuf_t
	iobuf_temp (void)
	{
	return iobuf_alloc (IOBUF_OUTPUT_TEMP, IOBUF_BUFFER_SIZE);
	}

	iobuf_t
	iobuf_temp_with_content (const char *buffer, size_t length)
	{
	iobuf_t a;
	int i;

	a = iobuf_alloc (IOBUF_INPUT_TEMP, length);
	assert (length == a->d.size);
	/* memcpy (a->d.buf, buffer, length); */
	for (i=0; i < length; i++)
	a->d.buf[i] = buffer[i];
	a->d.len = length;

	return a;
	}


	int
	iobuf_is_pipe_filename (const char *fname)
	{
	if (!fname \|\| (*fname=='-' && !fname[1]) )
	return 1;
	return check_special_filename (fname, 0, 1) != -1;
	}


	static iobuf_t
	do_open (const char *fname, int special_filenames,
	int use, const char *opentype, int mode700)
	{
	iobuf_t a;
	gnupg_fd_t fp;
	file_filter_ctx_t *fcx;
	size_t len = 0;
	int print_only = 0;
	int fd;
	byte desc[MAX_IOBUF_DESC];

	assert (use == IOBUF_INPUT \|\| use == IOBUF_OUTPUT);

	if (special_filenames
	/* NULL or '-'. */
	&& (!fname \|\| (*fname == '-' && !fname[1])))
	{
	if (use == IOBUF_INPUT)
	{
	fp = FD_FOR_STDIN;
	fname = "[stdin]";
	}
	else
	{
	fp = FD_FOR_STDOUT;
	fname = "[stdout]";
	}
	print_only = 1;
	}
	else if (!fname)
	return NULL;
	else if (special_filenames
	&& (fd = check_special_filename (fname, 0, 1)) != -1)
	return iobuf_fdopen (translate_file_handle (fd, use == IOBUF_INPUT ? 0 : 1),
	opentype);
	else
	{
	if (use == IOBUF_INPUT)
	fp = fd_cache_open (fname, opentype);
	else
	fp = direct_open (fname, opentype, mode700);
	if (fp == GNUPG_INVALID_FD)
	return NULL;
	}

	a = iobuf_alloc (use, IOBUF_BUFFER_SIZE);
	fcx = xmalloc (sizeof *fcx + strlen (fname));
	fcx->fp = fp;
	fcx->print_only_name = print_only;
	strcpy (fcx->fname, fname);
	if (!print_only)
	a->real_fname = xstrdup (fname);
	a->filter = file_filter;
	a->filter_ov = fcx;
	file_filter (fcx, IOBUFCTRL_INIT, NULL, NULL, &len);
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: open '%s' desc=%s fd=%d\n",
	a->no, a->subno, fname, iobuf_desc (a, desc), FD2INT (fcx->fp));

	return a;
	}

	iobuf_t
	iobuf_open (const char *fname)
	{
	return do_open (fname, 1, IOBUF_INPUT, "rb", 0);
	}

	iobuf_t
	iobuf_create (const char *fname, int mode700)
	{
	return do_open (fname, 1, IOBUF_OUTPUT, "wb", mode700);
	}

	iobuf_t
	iobuf_openrw (const char *fname)
	{
	return do_open (fname, 0, IOBUF_OUTPUT, "r+b", 0);
	}


	static iobuf_t
	do_iobuf_fdopen (int fd, const char *mode, int keep_open)
	{
	iobuf_t a;
	gnupg_fd_t fp;
	file_filter_ctx_t *fcx;
	size_t len;

	fp = INT2FD (fd);

	a = iobuf_alloc (strchr (mode, 'w') ? IOBUF_OUTPUT : IOBUF_INPUT,
	IOBUF_BUFFER_SIZE);
	fcx = xmalloc (sizeof *fcx + 20);
	fcx->fp = fp;
	fcx->print_only_name = 1;
	fcx->keep_open = keep_open;
	sprintf (fcx->fname, "[fd %d]", fd);
	a->filter = file_filter;
	a->filter_ov = fcx;
	file_filter (fcx, IOBUFCTRL_INIT, NULL, NULL, &len);
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: fdopen%s '%s'\n",
	a->no, a->subno, keep_open? "_nc":"", fcx->fname);
	iobuf_ioctl (a, IOBUF_IOCTL_NO_CACHE, 1, NULL);
	return a;
	}


	iobuf_t
	iobuf_fdopen (int fd, const char *mode)
	{
	return do_iobuf_fdopen (fd, mode, 0);
	}

	iobuf_t
	iobuf_fdopen_nc (int fd, const char *mode)
	{
	return do_iobuf_fdopen (fd, mode, 1);
	}


	iobuf_t
	iobuf_esopen (estream_t estream, const char *mode, int keep_open)
	{
	iobuf_t a;
	file_es_filter_ctx_t *fcx;
	size_t len = 0;

	a = iobuf_alloc (strchr (mode, 'w') ? IOBUF_OUTPUT : IOBUF_INPUT,
	IOBUF_BUFFER_SIZE);
	fcx = xtrymalloc (sizeof *fcx + 30);
	fcx->fp = estream;
	fcx->print_only_name = 1;
	fcx->keep_open = keep_open;
	sprintf (fcx->fname, "[fd %p]", estream);
	a->filter = file_es_filter;
	a->filter_ov = fcx;
	file_es_filter (fcx, IOBUFCTRL_INIT, NULL, NULL, &len);
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: esopen%s '%s'\n",
	a->no, a->subno, keep_open? "_nc":"", fcx->fname);
	return a;
	}


	iobuf_t
	iobuf_sockopen (int fd, const char *mode)
	{
	iobuf_t a;
	#ifdef HAVE_W32_SYSTEM
	sock_filter_ctx_t *scx;
	size_t len;

	a = iobuf_alloc (strchr (mode, 'w') ? IOBUF_OUTPUT : IOBUF_INPUT,
	IOBUF_BUFFER_SIZE);
	scx = xmalloc (sizeof *scx + 25);
	scx->sock = fd;
	scx->print_only_name = 1;
	sprintf (scx->fname, "[sock %d]", fd);
	a->filter = sock_filter;
	a->filter_ov = scx;
	sock_filter (scx, IOBUFCTRL_INIT, NULL, NULL, &len);
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: sockopen '%s'\n", a->no, a->subno, scx->fname);
	iobuf_ioctl (a, IOBUF_IOCTL_NO_CACHE, 1, NULL);
	#else
	a = iobuf_fdopen (fd, mode);
	#endif
	return a;
	}

	int
	iobuf_ioctl (iobuf_t a, iobuf_ioctl_t cmd, int intval, void *ptrval)
	{
	byte desc[MAX_IOBUF_DESC];

	if (cmd == IOBUF_IOCTL_KEEP_OPEN)
	{
	/* Keep system filepointer/descriptor open. This was used in
	the past by http.c; this ioctl is not directly used
	anymore. */
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: ioctl '%s' keep_open=%d\n",
	a ? a->no : -1, a ? a->subno : -1, iobuf_desc (a, desc),
	intval);
	for (; a; a = a->chain)
	if (!a->chain && a->filter == file_filter)
	{
	file_filter_ctx_t *b = a->filter_ov;
	b->keep_open = intval;
	return 0;
	}
	#ifdef HAVE_W32_SYSTEM
	else if (!a->chain && a->filter == sock_filter)
	{
	sock_filter_ctx_t *b = a->filter_ov;
	b->keep_open = intval;
	return 0;
	}
	#endif
	}
	else if (cmd == IOBUF_IOCTL_INVALIDATE_CACHE)
	{
	if (DBG_IOBUF)
	log_debug ("iobuf-.: ioctl '%s' invalidate\n",
	ptrval ? (char *) ptrval : "?");
	if (!a && !intval && ptrval)
	{
	if (fd_cache_invalidate (ptrval))
	return -1;
	return 0;
	}
	}
	else if (cmd == IOBUF_IOCTL_NO_CACHE)
	{
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: ioctl '%s' no_cache=%d\n",
	a ? a->no : -1, a ? a->subno : -1, iobuf_desc (a, desc),
	intval);
	for (; a; a = a->chain)
	if (!a->chain && a->filter == file_filter)
	{
	file_filter_ctx_t *b = a->filter_ov;
	b->no_cache = intval;
	return 0;
	}
	#ifdef HAVE_W32_SYSTEM
	else if (!a->chain && a->filter == sock_filter)
	{
	sock_filter_ctx_t *b = a->filter_ov;
	b->no_cache = intval;
	return 0;
	}
	#endif
	}
	else if (cmd == IOBUF_IOCTL_FSYNC)
	{
	/* Do a fsync on the open fd and return any errors to the caller
	of iobuf_ioctl. Note that we work on a file name here. */
	if (DBG_IOBUF)
	log_debug ("iobuf-.: ioctl '%s' fsync\n",
	ptrval? (const char*)ptrval:"<null>");

	if (!a && !intval && ptrval)
	{
	return fd_cache_synchronize (ptrval);
	}
	}


	return -1;
	}


	/****************
	* Register an i/o filter.
	*/
	int
	iobuf_push_filter (iobuf_t a,
	int (f) (void opaque, int control,
	iobuf_t chain, byte * buf, size_t * len),
	void *ov)
	{
	return iobuf_push_filter2 (a, f, ov, 0);
	}

	int
	iobuf_push_filter2 (iobuf_t a,
	int (f) (void opaque, int control,
	iobuf_t chain, byte * buf, size_t * len),
	void *ov, int rel_ov)
	{
	iobuf_t b;
	size_t dummy_len = 0;
	int rc = 0;

	if (a->use == IOBUF_OUTPUT && (rc = filter_flush (a)))
	return rc;

	if (a->subno >= MAX_NESTING_FILTER)
	{
	log_error ("i/o filter too deeply nested - corrupted data?\n");
	return GPG_ERR_BAD_DATA;
	}

	/* We want to create a new filter and put it in front of A. A
	simple implementation would do:

	b = iobuf_alloc (...);
	b->chain = a;
	return a;

	This is a bit problematic: A is the head of the pipeline and
	there are potentially many pointers to it. Requiring the caller
	to update all of these pointers is a burden.

	An alternative implementation would add a level of indirection.
	For instance, we could use a pipeline object, which contains a
	pointer to the first filter in the pipeline. This is not what we
	do either.

	Instead, we allocate a new buffer (B) and copy the first filter's
	state into that and use the initial buffer (A) for the new
	filter. One limitation of this approach is that it is not
	practical to maintain a pointer to a specific filter's state.

	Before:

	A
	\|
	v 0x100 0x200
	+----------+ +----------+
	\| filter x \|--------->\| filter y \|---->....
	+----------+ +----------+

	After: B
	\|
	v 0x300
	+----------+
	A \| filter x \|
	\| +----------+
	v 0x100 ^ v 0x200
	+----------+ +----------+
	\| filter w \| \| filter y \|---->....
	+----------+ +----------+

	Note: filter x's address changed from 0x100 to 0x300, but A still
	points to the head of the pipeline.
	*/

	b = xmalloc (sizeof *b);
	memcpy (b, a, sizeof *b);
	/* fixme: it is stupid to keep a copy of the name at every level
	* but we need the name somewhere because the name known by file_filter
	* may have been released when we need the name of the file */
	b->real_fname = a->real_fname ? xstrdup (a->real_fname) : NULL;
	/* remove the filter stuff from the new stream */
	a->filter = NULL;
	a->filter_ov = NULL;
	a->filter_ov_owner = 0;
	a->filter_eof = 0;
	if (a->use == IOBUF_OUTPUT_TEMP)
	/* A TEMP filter buffers any data sent to it; it does not forward
	any data down the pipeline. If we add a new filter to the
	pipeline, it shouldn't also buffer data. It should send it
	downstream to be buffered. Thus, the correct type for a filter
	added in front of an IOBUF_OUTPUT_TEMP filter is IOBUF_OUPUT, not
	IOBUF_OUTPUT_TEMP. */
	{
	a->use = IOBUF_OUTPUT;

	/* When pipeline is written to, the temp buffer's size is
	increased accordingly. We don't need to allocate a 10 MB
	buffer for a non-terminal filter. Just use the default
	size. */
	a->d.size = IOBUF_BUFFER_SIZE;
	}
	else if (a->use == IOBUF_INPUT_TEMP)
	/* Same idea as above. */
	{
	a->use = IOBUF_INPUT;
	a->d.size = IOBUF_BUFFER_SIZE;
	}

	/* The new filter (A) gets a new buffer.

	If the pipeline is an output or temp pipeline, then giving the
	buffer to the new filter means that data that was written before
	the filter was pushed gets sent to the filter. That's clearly
	wrong.

	If the pipeline is an input pipeline, then giving the buffer to
	the new filter (A) means that data that has read from (B), but
	not yet read from the pipeline won't be processed by the new
	filter (A)! That's certainly not what we want. */
	a->d.buf = xmalloc (a->d.size);
	a->d.len = 0;
	a->d.start = 0;

	/* disable nlimit for the new stream */
	a->ntotal = b->ntotal + b->nbytes;
	a->nlimit = a->nbytes = 0;
	a->nofast = 0;
	/* make a link from the new stream to the original stream */
	a->chain = b;

	/* setup the function on the new stream */
	a->filter = f;
	a->filter_ov = ov;
	a->filter_ov_owner = rel_ov;

	a->subno = b->subno + 1;

	if (DBG_IOBUF)
	{
	byte desc[MAX_IOBUF_DESC];
	log_debug ("iobuf-%d.%d: push '%s'\n",
	a->no, a->subno, iobuf_desc (a, desc));
	print_chain (a);
	}

	/* now we can initialize the new function if we have one */
	if (a->filter && (rc = a->filter (a->filter_ov, IOBUFCTRL_INIT, a->chain,
	NULL, &dummy_len)))
	log_error ("IOBUFCTRL_INIT failed: %s\n", gpg_strerror (rc));
	return rc;
	}

	/****************
	* Remove an i/o filter.
	*/
	int
	iobuf_pop_filter (iobuf_t a, int (f) (void opaque, int control,
	iobuf_t chain, byte * buf, size_t * len),
	void *ov)
	{
	iobuf_t b;
	size_t dummy_len = 0;
	int rc = 0;
	byte desc[MAX_IOBUF_DESC];

	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: pop '%s'\n",
	a->no, a->subno, iobuf_desc (a, desc));
	if (a->use == IOBUF_INPUT_TEMP \|\| a->use == IOBUF_OUTPUT_TEMP)
	{
	/* This should be the last filter in the pipeline. */
	assert (! a->chain);
	return 0;
	}
	if (!a->filter)
	{ /* this is simple */
	b = a->chain;
	assert (b);
	xfree (a->d.buf);
	xfree (a->real_fname);
	memcpy (a, b, sizeof *a);
	xfree (b);
	return 0;
	}
	for (b = a; b; b = b->chain)
	if (b->filter == f && (!ov \|\| b->filter_ov == ov))
	break;
	if (!b)
	log_bug ("iobuf_pop_filter(): filter function not found\n");

	/* flush this stream if it is an output stream */
	if (a->use == IOBUF_OUTPUT && (rc = filter_flush (b)))
	{
	log_error ("filter_flush failed in iobuf_pop_filter: %s\n",
	gpg_strerror (rc));
	return rc;
	}
	/* and tell the filter to free it self */
	if (b->filter && (rc = b->filter (b->filter_ov, IOBUFCTRL_FREE, b->chain,
	NULL, &dummy_len)))
	{
	log_error ("IOBUFCTRL_FREE failed: %s\n", gpg_strerror (rc));
	return rc;
	}
	if (b->filter_ov && b->filter_ov_owner)
	{
	xfree (b->filter_ov);
	b->filter_ov = NULL;
	}


	/* and see how to remove it */
	if (a == b && !b->chain)
	log_bug ("can't remove the last filter from the chain\n");
	else if (a == b)
	{ /* remove the first iobuf from the chain */
	/* everything from b is copied to a. This is save because
	* a flush has been done on the to be removed entry
	*/
	b = a->chain;
	xfree (a->d.buf);
	xfree (a->real_fname);
	memcpy (a, b, sizeof *a);
	xfree (b);
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: popped filter\n", a->no, a->subno);
	}
	else if (!b->chain)
	{ /* remove the last iobuf from the chain */
	log_bug ("Ohh jeee, trying to remove a head filter\n");
	}
	else
	{ /* remove an intermediate iobuf from the chain */
	log_bug ("Ohh jeee, trying to remove an intermediate filter\n");
	}

	return rc;
	}


	/****************
	* read underflow: read at least one byte into the buffer and return
	* the first byte or -1 on EOF.
	*/
	static int
	underflow (iobuf_t a, int clear_pending_eof)
	{
	return underflow_target (a, clear_pending_eof, 1);
	}


	/****************
	* read underflow: read TARGET bytes into the buffer and return
	* the first byte or -1 on EOF.
	*/
	static int
	underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
	{
	size_t len;
	int rc;

	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: underflow: buffer size: %d; still buffered: %d => space for %d bytes\n",
	a->no, a->subno,
	(int) a->d.size, (int) (a->d.len - a->d.start),
	(int) (a->d.size - (a->d.len - a->d.start)));

	if (a->use == IOBUF_INPUT_TEMP)
	/* By definition, there isn't more data to read into the
	buffer. */
	return -1;

	assert (a->use == IOBUF_INPUT);

	/* If there is still some buffered data, then move it to the start
	of the buffer and try to fill the end of the buffer. (This is
	useful if we are called from iobuf_peek().) */
	assert (a->d.start <= a->d.len);
	a->d.len -= a->d.start;
	memmove (a->d.buf, &a->d.buf[a->d.start], a->d.len);
	a->d.start = 0;

	if (a->d.len < target && a->filter_eof)
	/* The last time we tried to read from this filter, we got an EOF.
	We couldn't return the EOF, because there was buffered data.
	Since there is no longer any buffered data, return the
	error. */
	{
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: underflow: eof (pending eof)\n",
	a->no, a->subno);
	if (! clear_pending_eof)
	return -1;

	if (a->chain)
	/* A filter follows this one. Free this filter. */
	{
	iobuf_t b = a->chain;
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: filter popped (pending EOF returned)\n",
	a->no, a->subno);
	xfree (a->d.buf);
	xfree (a->real_fname);
	memcpy (a, b, sizeof *a);
	xfree (b);
	print_chain (a);
	}
	else
	a->filter_eof = 0; /* for the top level filter */
	return -1; /* return one(!) EOF */
	}

	if (a->d.len == 0 && a->error)
	/* The last time we tried to read from this filter, we got an
	error. We couldn't return the error, because there was
	buffered data. Since there is no longer any buffered data,
	return the error. */
	{
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: pending error (%s) returned\n",
	a->no, a->subno, gpg_strerror (a->error));
	return -1;
	}

	if (a->filter && ! a->filter_eof && ! a->error)
	/* We have a filter function and the last time we tried to read we
	didn't get an EOF or an error. Try to fill the buffer. */
	{
	/* Be careful to account for any buffered data. */
	len = a->d.size - a->d.len;
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: underflow: A->FILTER (%lu bytes)\n",
	a->no, a->subno, (ulong) len);
	if (len == 0)
	/* There is no space for more data. Don't bother calling
	A->FILTER. */
	rc = 0;
	else
	rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
	&a->d.buf[a->d.len], &len);
	a->d.len += len;

	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: A->FILTER() returned rc=%d (%s), read %lu bytes\n",
	a->no, a->subno,
	rc, rc == 0 ? "ok" : rc == -1 ? "EOF" : gpg_strerror (rc),
	(ulong) len);
	/* if( a->no == 1 ) */
	/* log_hexdump (" data:", a->d.buf, len); */

	if (rc == -1)
	/* EOF. */
	{
	size_t dummy_len = 0;

	/* Tell the filter to free itself */
	if ((rc = a->filter (a->filter_ov, IOBUFCTRL_FREE, a->chain,
	NULL, &dummy_len)))
	log_error ("IOBUFCTRL_FREE failed: %s\n", gpg_strerror (rc));

	/* Free everything except for the internal buffer. */
	if (a->filter_ov && a->filter_ov_owner)
	xfree (a->filter_ov);
	a->filter_ov = NULL;
	a->filter = NULL;
	a->filter_eof = 1;

	if (clear_pending_eof && a->d.len == 0 && a->chain)
	/* We don't need to keep this filter around at all:

	- we got an EOF
	- we have no buffered data
	- a filter follows this one.

	Unlink this filter. */
	{
	iobuf_t b = a->chain;
	if (DBG_IOBUF)
	log_debug ("iobuf-%d.%d: pop in underflow (nothing buffered, got EOF)\n",
	a->no, a->subno);
	xfree (a->d.buf);
	xfree (a->real_fname);
	memcpy (a, b, sizeof *a);
	xfree (b);

	print_chain (a);

	return -1;
	}
	else if (a->d.len == 0)
	/* We can't unlink this filter (it is the only one in the
	pipeline), but we can immediately return EOF. */
	return -1;
	}
	else if (rc)
	/* Record the error. */
	{
	a->error = rc;

	if (a->d.len == 0)
	/* There is no buffered data. Immediately return EOF. */
	return -1;
	}
	}

	assert (a->d.start <= a->d.len);
	if (a->d.start < a->d.len)
	return a->d.buf[a->d.start++];

	/* EOF. */
	return -1;
	}


	static int
	filter_flush (iobuf_t a)
	{
	size_t len;
	int rc;

	if (a->use == IOBUF_OUTPUT_TEMP)
	{ /* increase the temp buffer */
	size_t newsize = a->d.size + IOBUF_BUFFER_SIZE;

	if (DBG_IOBUF)
	log_debug ("increasing temp iobuf from %lu to %lu\n",
	(ulong) a->d.size, (ulong) newsize);

	a->d.buf = xrealloc (a->d.buf, newsize);
	a->d.size = newsize;
	return 0;
	}
	else if (a->use != IOBUF_OUTPUT)
	log_bug ("flush on non-output iobuf\n");
	else if (!a->filter)
	log_bug ("filter_flush: no filter\n");
	len = a->d.len;
	rc = a->filter (a->filter_ov, IOBUFCTRL_FLUSH, a->chain, a->d.buf, &len);
	if (!rc && len != a->d.len)
	{
	log_info ("filter_flush did not write all!\n");
	rc = GPG_ERR_INTERNAL;
	}
	else if (rc)
	a->error = rc;
	a->d.len = 0;

	return rc;
	}


	int
	iobuf_readbyte (iobuf_t a)
	{
	int c;

	if (a->use == IOBUF_OUTPUT \|\| a->use == IOBUF_OUTPUT_TEMP)
	{
	log_bug ("iobuf_readbyte called on a non-INPUT pipeline!\n");
	return -1;
	}

	assert (a->d.start <= a->d.len);

	if (a->nlimit && a->nbytes >= a->nlimit)
	return -1; /* forced EOF */

	if (a->d.start < a->d.len)
	{
	c = a->d.buf[a->d.start++];
	}
	else if ((c = underflow (a, 1)) == -1)
	return -1; /* EOF */

	assert (a->d.start <= a->d.len);

	/* Note: if underflow doesn't return EOF, then it returns the first
	byte that was read and advances a->d.start appropriately. */

	a->nbytes++;
	return c;
	}


	int
	iobuf_read (iobuf_t a, void *buffer, unsigned int buflen)
	{
	unsigned char buf = (unsigned char )buffer;
	int c, n;

	if (a->use == IOBUF_OUTPUT \|\| a->use == IOBUF_OUTPUT_TEMP)
	{
	log_bug ("iobuf_read called on a non-INPUT pipeline!\n");
	return -1;
	}

	if (a->nlimit)
	{
	/* Handle special cases. */
	for (n = 0; n < buflen; n++)
	{
	if ((c = iobuf_readbyte (a)) == -1)
	{
	if (!n)
	return -1; /* eof */
	break;
	}

	if (buf)
	{
	*buf = c;
	buf++;
	}
	}
	return n;
	}

	n = 0;
	do
	{
	if (n < buflen && a->d.start < a->d.len)
	/* Drain the buffer. */
	{
	unsigned size = a->d.len - a->d.start;
	if (size > buflen - n)
	size = buflen - n;
	if (buf)
	memcpy (buf, a->d.buf + a->d.start, size);
	n += size;
	a->d.start += size;
	if (buf)
	buf += size;
	}
	if (n < buflen)
	/* Draining the internal buffer didn't fill BUFFER. Call
	underflow to read more data into the filter's internal
	buffer. */
	{
	if ((c = underflow (a, 1)) == -1)
	/* EOF. If we managed to read something, don't return EOF
	now. */
	{
	a->nbytes += n;
	return n ? n : -1 /EOF/;
	}
	if (buf)
	*buf++ = c;
	n++;
	}
	}
	while (n < buflen);
	a->nbytes += n;
	return n;
	}



	int
	iobuf_peek (iobuf_t a, byte * buf, unsigned buflen)
	{
	int n = 0;

	assert (buflen > 0);
	assert (a->use == IOBUF_INPUT \|\| a->use == IOBUF_INPUT_TEMP);

	if (buflen > a->d.size)
	/* We can't peek more than we can buffer. */
	buflen = a->d.size;

	/* Try to fill the internal buffer with enough data to satisfy the
	request. */
	while (buflen > a->d.len - a->d.start)
	{
	if (underflow_target (a, 0, buflen) == -1)
	/* EOF. We can't read any more. */
	break;

	/* Underflow consumes the first character (it's the return
	value). unget() it by resetting the "file position". */
	assert (a->d.start == 1);
	a->d.start = 0;
	}

	n = a->d.len - a->d.start;
	if (n > buflen)
	n = buflen;

	if (n == 0)
	/* EOF. */
	return -1;

	memcpy (buf, &a->d.buf[a->d.start], n);

	return n;
	}




	int
	iobuf_writebyte (iobuf_t a, unsigned int c)
	{
	int rc;

	if (a->use == IOBUF_INPUT \|\| a->use == IOBUF_INPUT_TEMP)
	{
	log_bug ("iobuf_writebyte called on an input pipeline!\n");
	return -1;
	}

	if (a->d.len == a->d.size)
	if ((rc=filter_flush (a)))
	return rc;

	assert (a->d.len < a->d.size);
	a->d.buf[a->d.len++] = c;
	return 0;
	}


	int
	iobuf_write (iobuf_t a, const void *buffer, unsigned int buflen)
	{
	const unsigned char buf = (const unsigned char )buffer;
	int rc;

	if (a->use == IOBUF_INPUT \|\| a->use == IOBUF_INPUT_TEMP)
	{
	log_bug ("iobuf_write called on an input pipeline!\n");
	return -1;
	}

	do
	{
	if (buflen && a->d.len < a->d.size)
	{
	unsigned size = a->d.size - a->d.len;
	if (size > buflen)
	size = buflen;
	memcpy (a->d.buf + a->d.len, buf, size);
	buflen -= size;
	buf += size;
	a->d.len += size;
	}
	if (buflen)
	{
	rc = filter_flush (a);
	if (rc)
	return rc;
	}
	}
	while (buflen);
	return 0;
	}


	int
	iobuf_writestr (iobuf_t a, const char *buf)
	{
	if (a->use == IOBUF_INPUT \|\| a->use == IOBUF_INPUT_TEMP)
	{
	log_bug ("iobuf_writestr called on an input pipeline!\n");
	return -1;
	}

	return iobuf_write (a, buf, strlen (buf));
	}



	int
	iobuf_write_temp (iobuf_t dest, iobuf_t source)
	{
	assert (source->use == IOBUF_OUTPUT \|\| source->use == IOBUF_OUTPUT_TEMP);
	assert (dest->use == IOBUF_OUTPUT \|\| dest->use == IOBUF_OUTPUT_TEMP);

	iobuf_flush_temp (source);
	return iobuf_write (dest, source->d.buf, source->d.len);
	}

	size_t
	iobuf_temp_to_buffer (iobuf_t a, byte * buffer, size_t buflen)
	{
	byte desc[MAX_IOBUF_DESC];
	size_t n;

	while (1)
	{
	int rc = filter_flush (a);
	if (rc)
	log_bug ("Flushing iobuf %d.%d (%s) from iobuf_temp_to_buffer failed. Ignoring.\n",
	a->no, a->subno, iobuf_desc (a, desc));
	if (! a->chain)
	break;
	a = a->chain;
	}

	n = a->d.len;
	if (n > buflen)
	n = buflen;
	memcpy (buffer, a->d.buf, n);
	return n;
	}

	/* Copies the data from the input iobuf SOURCE to the output iobuf
	DEST until either an error is encountered or EOF is reached.
	Returns the number of bytes copies. */
	size_t
	iobuf_copy (iobuf_t dest, iobuf_t source)
	{
	char *temp;
	/* Use a 32 KB buffer. */
	const size_t temp_size = 32 * 1024;

	size_t nread;
	size_t nwrote = 0;
	int err;

	assert (source->use == IOBUF_INPUT \|\| source->use == IOBUF_INPUT_TEMP);
	assert (dest->use == IOBUF_OUTPUT \|\| source->use == IOBUF_OUTPUT_TEMP);

	if (iobuf_error (dest))
	return -1;

	temp = xmalloc (temp_size);
	while (1)
	{
	nread = iobuf_read (source, temp, temp_size);
	if (nread == -1)
	/* EOF. */
	break;

	err = iobuf_write (dest, temp, nread);
	if (err)
	break;
	nwrote += nread;
	}

	/* Burn the buffer. */
	wipememory (temp, sizeof (temp));
	xfree (temp);

	return nwrote;
	}


	void
	iobuf_flush_temp (iobuf_t temp)
	{
	if (temp->use == IOBUF_INPUT \|\| temp->use == IOBUF_INPUT_TEMP)
	log_bug ("iobuf_flush_temp called on an input pipeline!\n");
	while (temp->chain)
	iobuf_pop_filter (temp, temp->filter, NULL);
	}


	void
	iobuf_set_limit (iobuf_t a, off_t nlimit)
	{
	if (nlimit)
	a->nofast = 1;
	else
	a->nofast = 0;
	a->nlimit = nlimit;
	a->ntotal += a->nbytes;
	a->nbytes = 0;
	}



	off_t
	iobuf_get_filelength (iobuf_t a, int *overflow)
	{
	if (overflow)
	*overflow = 0;

	/* Hmmm: file_filter may have already been removed */
	for ( ; a->chain; a = a->chain )
	;

	if (a->filter != file_filter)
	return 0;

	{
	file_filter_ctx_t *b = a->filter_ov;
	gnupg_fd_t fp = b->fp;

	#if defined(HAVE_W32_SYSTEM)
	ulong size;
	static int (* __stdcall get_file_size_ex) (void *handle,
	LARGE_INTEGER *r_size);
	static int get_file_size_ex_initialized;

	if (!get_file_size_ex_initialized)
	{
	void *handle;

	handle = dlopen ("kernel32.dll", RTLD_LAZY);
	if (handle)
	{
	get_file_size_ex = dlsym (handle, "GetFileSizeEx");
	if (!get_file_size_ex)
	dlclose (handle);
	}
	get_file_size_ex_initialized = 1;
	}

	if (get_file_size_ex)
	{
	/* This is a newer system with GetFileSizeEx; we use this
	then because it seem that GetFileSize won't return a
	proper error in case a file is larger than 4GB. */
	LARGE_INTEGER exsize;

	if (get_file_size_ex (fp, &exsize))
	{
	if (!exsize.u.HighPart)
	return exsize.u.LowPart;
	if (overflow)
	*overflow = 1;
	return 0;
	}
	}
	else
	{
	if ((size=GetFileSize (fp, NULL)) != 0xffffffff)
	return size;
	}
	log_error ("GetFileSize for handle %p failed: %s\n",
	fp, w32_strerror (0));
	#else /!HAVE_W32_SYSTEM/
	{
	struct stat st;

	if ( !fstat (FD2INT (fp), &st) )
	return st.st_size;
	log_error("fstat() failed: %s\n", strerror(errno) );
	}
	#endif /!HAVE_W32_SYSTEM/
	}

	return 0;
	}


	int
	iobuf_get_fd (iobuf_t a)
	{
	for (; a->chain; a = a->chain)
	;

	if (a->filter != file_filter)
	return -1;

	{
	file_filter_ctx_t *b = a->filter_ov;
	gnupg_fd_t fp = b->fp;

	return FD2INT (fp);
	}
	}


	off_t
	iobuf_tell (iobuf_t a)
	{
	return a->ntotal + a->nbytes;
	}


	#if !defined(HAVE_FSEEKO) && !defined(fseeko)

	#ifdef HAVE_LIMITS_H
	# include <limits.h>
	#endif
	#ifndef LONG_MAX
	# define LONG_MAX ((long) ((unsigned long) -1 >> 1))
	#endif
	#ifndef LONG_MIN
	# define LONG_MIN (-1 - LONG_MAX)
	#endif

	/****************
	* A substitute for fseeko, for hosts that don't have it.
	*/
	static int
	fseeko (FILE * stream, off_t newpos, int whence)
	{
	while (newpos != (long) newpos)
	{
	long pos = newpos < 0 ? LONG_MIN : LONG_MAX;
	if (fseek (stream, pos, whence) != 0)
	return -1;
	newpos -= pos;
	whence = SEEK_CUR;
	}
	return fseek (stream, (long) newpos, whence);
	}
	#endif

	int
	iobuf_seek (iobuf_t a, off_t newpos)
	{
	file_filter_ctx_t *b = NULL;

	if (a->use == IOBUF_OUTPUT \|\| a->use == IOBUF_INPUT)
	{
	/* Find the last filter in the pipeline. */
	for (; a->chain; a = a->chain)
	;

	if (a->filter != file_filter)
	return -1;

	b = a->filter_ov;

	#ifdef HAVE_W32_SYSTEM
	if (SetFilePointer (b->fp, newpos, NULL, FILE_BEGIN) == 0xffffffff)
	{
	log_error ("SetFilePointer failed on handle %p: ec=%d\n",
	b->fp, (int) GetLastError ());
	return -1;
	}
	#else
	if (lseek (b->fp, newpos, SEEK_SET) == (off_t) - 1)
	{
	log_error ("can't lseek: %s\n", strerror (errno));
	return -1;
	}
	#endif
	/* Discard the buffer it is not a temp stream. */
	a->d.len = 0;
	}
	a->d.start = 0;
	a->nbytes = 0;
	a->nlimit = 0;
	a->nofast = 0;
	a->ntotal = newpos;
	a->error = 0;

	/* It is impossible for A->CHAIN to be non-NULL. If A is an INPUT
	or OUTPUT buffer, then we find the last filter, which is defined
	as A->CHAIN being NULL. If A is a TEMP filter, then A must be
	the only filter in the pipe: when iobuf_push_filter adds a filter
	to the front of a pipeline, it sets the new filter to be an
	OUTPUT filter if the pipeline is an OUTPUT or TEMP pipeline and
	to be an INPUT filter if the pipeline is an INPUT pipeline.
	Thus, only the last filter in a TEMP pipeline can be a */

	/* remove filters, but the last */
	if (a->chain)
	log_debug ("iobuf_pop_filter called in iobuf_seek - please report\n");
	while (a->chain)
	iobuf_pop_filter (a, a->filter, NULL);

	return 0;
	}


	const char *
	iobuf_get_real_fname (iobuf_t a)
	{
	if (a->real_fname)
	return a->real_fname;

	/* the old solution */
	for (; a; a = a->chain)
	if (!a->chain && a->filter == file_filter)
	{
	file_filter_ctx_t *b = a->filter_ov;
	return b->print_only_name ? NULL : b->fname;
	}

	return NULL;
	}

	const char *
	iobuf_get_fname (iobuf_t a)
	{
	for (; a; a = a->chain)
	if (!a->chain && a->filter == file_filter)
	{
	file_filter_ctx_t *b = a->filter_ov;
	return b->fname;
	}
	return NULL;
	}

	const char *
	iobuf_get_fname_nonnull (iobuf_t a)
	{
	const char *fname;

	fname = iobuf_get_fname (a);
	return fname? fname : "[?]";
	}


	/****************
	* Enable or disable partial body length mode (RFC 4880 4.2.2.4).
	*
	* If LEN is 0, this disables partial block mode by popping the
	- * partial body length filter, which which must be the most recently
	+ * partial body length filter, which must be the most recently
	* added filter.
	*
	* If LEN is non-zero, it pushes a partial body length filter. If
	* this is a read filter, LEN must be the length byte from the first
	* chunk and A should be position just after this first partial body
	* length header.
	*/
	void
	iobuf_set_partial_body_length_mode (iobuf_t a, size_t len)
	{
	if (!len)
	/* Disable partial body length mode. */
	{
	if (a->use == IOBUF_INPUT)
	log_debug ("iobuf_pop_filter called in set_partial_block_mode"
	" - please report\n");

	log_assert (a->filter == block_filter);
	iobuf_pop_filter (a, block_filter, NULL);
	}
	else
	/* Enabled partial body length mode. */
	{
	block_filter_ctx_t ctx = xcalloc (1, sizeof ctx);
	ctx->use = a->use;
	ctx->partial = 1;
	ctx->size = 0;
	ctx->first_c = len;
	iobuf_push_filter (a, block_filter, ctx);
	}
	}



	unsigned int
	iobuf_read_line (iobuf_t a, byte ** addr_of_buffer,
	unsigned length_of_buffer, unsigned max_length)
	{
	int c;
	char buffer = (char )*addr_of_buffer;
	unsigned length = *length_of_buffer;
	unsigned nbytes = 0;
	unsigned maxlen = *max_length;
	char *p;

	/* The code assumes that we have space for at least a newline and a
	NUL character in the buffer. This requires at least 2 bytes. We
	don't complicate the code by handling the stupid corner case, but
	simply assert that it can't happen. */
	assert (length >= 2 \|\| maxlen >= 2);

	if (!buffer \|\| length <= 1)
	/* must allocate a new buffer */
	{
	length = 256 <= maxlen ? 256 : maxlen;
	buffer = xrealloc (buffer, length);
	addr_of_buffer = (unsigned char )buffer;
	*length_of_buffer = length;
	}

	p = buffer;
	while ((c = iobuf_get (a)) != -1)
	{
	*p++ = c;
	nbytes++;
	if (c == '\n')
	break;

	if (nbytes == length - 1)
	/* We don't have enough space to add a \n and a \0. Increase
	the buffer size. */
	{
	if (length == maxlen)
	/* We reached the buffer's size limit! */
	{
	/* Skip the rest of the line. */
	while (c != '\n' && (c = iobuf_get (a)) != -1)
	;

	/* p is pointing at the last byte in the buffer. We
	always terminate the line with "\n\0" so overwrite
	the previous byte with a \n. */
	assert (p > buffer);
	p[-1] = '\n';

	/* Indicate truncation. */
	*max_length = 0;
	break;
	}

	length += length < 1024 ? 256 : 1024;
	if (length > maxlen)
	length = maxlen;

	buffer = xrealloc (buffer, length);
	addr_of_buffer = (unsigned char )buffer;
	*length_of_buffer = length;
	p = buffer + nbytes;
	}
	}
	/* Add the terminating NUL. */
	*p = 0;

	/* Return the number of characters written to the buffer including
	the newline, but not including the terminating NUL. */
	return nbytes;
	}

	static int
	translate_file_handle (int fd, int for_write)
	{
	#if defined(HAVE_W32CE_SYSTEM)
	/* This is called only with one of the special filenames. Under
	W32CE the FD here is not a file descriptor but a rendezvous id,
	thus we need to finish the pipe first. */
	fd = _assuan_w32ce_finish_pipe (fd, for_write);
	#elif defined(HAVE_W32_SYSTEM)
	{
	int x;

	(void)for_write;

	if (fd == 0)
	x = (int) GetStdHandle (STD_INPUT_HANDLE);
	else if (fd == 1)
	x = (int) GetStdHandle (STD_OUTPUT_HANDLE);
	else if (fd == 2)
	x = (int) GetStdHandle (STD_ERROR_HANDLE);
	else
	x = fd;

	if (x == -1)
	log_debug ("GetStdHandle(%d) failed: ec=%d\n",
	fd, (int) GetLastError ());

	fd = x;
	}
	#else
	(void)for_write;
	#endif
	return fd;
	}


	void
	iobuf_skip_rest (iobuf_t a, unsigned long n, int partial)
	{
	if ( partial )
	{
	for (;;)
	{
	if (a->nofast \|\| a->d.start >= a->d.len)
	{
	if (iobuf_readbyte (a) == -1)
	{
	break;
	}
	}
	else
	{
	unsigned long count = a->d.len - a->d.start;
	a->nbytes += count;
	a->d.start = a->d.len;
	}
	}
	}
	else
	{
	unsigned long remaining = n;
	while (remaining > 0)
	{
	if (a->nofast \|\| a->d.start >= a->d.len)
	{
	if (iobuf_readbyte (a) == -1)
	{
	break;
	}
	--remaining;
	}
	else
	{
	unsigned long count = a->d.len - a->d.start;
	if (count > remaining)
	{
	count = remaining;
	}
	a->nbytes += count;
	a->d.start += count;
	remaining -= count;
	}
	}
	}
	}
	diff --git a/common/membuf.c b/common/membuf.c
	index 4c1a844d1..18a971d54 100644
	--- a/common/membuf.c
	+++ b/common/membuf.c
	@@ -1,230 +1,230 @@
	/* membuf.c - A simple implementation of a dynamic buffer.
	* Copyright (C) 2001, 2003, 2009, 2011 Free Software Foundation, Inc.
	* Copyright (C) 2013 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdlib.h>
	#include <errno.h>
	#include <stdarg.h>

	#include "util.h"
	#include "membuf.h"


	/* A simple implementation of a dynamic buffer. Use init_membuf() to
	create a buffer, put_membuf to append bytes and get_membuf to
	release and return the buffer. Allocation errors are detected but
	only returned at the final get_membuf(), this helps not to clutter
	the code with out of core checks. */

	void
	init_membuf (membuf_t *mb, int initiallen)
	{
	mb->len = 0;
	mb->size = initiallen;
	mb->out_of_core = 0;
	mb->buf = xtrymalloc (initiallen);
	if (!mb->buf)
	mb->out_of_core = errno;
	}

	/* Same as init_membuf but allocates the buffer in secure memory. */
	void
	init_membuf_secure (membuf_t *mb, int initiallen)
	{
	mb->len = 0;
	mb->size = initiallen;
	mb->out_of_core = 0;
	mb->buf = xtrymalloc_secure (initiallen);
	if (!mb->buf)
	mb->out_of_core = errno;
	}


	-/* Shift the the content of the membuf MB by AMOUNT bytes. The next
	+/* Shift the content of the membuf MB by AMOUNT bytes. The next
	operation will then behave as if AMOUNT bytes had not been put into
	the buffer. If AMOUNT is greater than the actual accumulated
	bytes, the membuf is basically reset to its initial state. */
	void
	clear_membuf (membuf_t *mb, size_t amount)
	{
	/* No need to clear if we are already out of core. */
	if (mb->out_of_core)
	return;
	if (amount >= mb->len)
	mb->len = 0;
	else
	{
	mb->len -= amount;
	memmove (mb->buf, mb->buf+amount, mb->len);
	}
	}


	void
	put_membuf (membuf_t mb, const void buf, size_t len)
	{
	if (mb->out_of_core \|\| !len)
	return;

	if (mb->len + len >= mb->size)
	{
	char *p;

	mb->size += len + 1024;
	p = xtryrealloc (mb->buf, mb->size);
	if (!p)
	{
	mb->out_of_core = errno ? errno : ENOMEM;
	/* Wipe out what we already accumulated. This is required
	in case we are storing sensitive data here. The membuf
	API does not provide another way to cleanup after an
	error. */
	wipememory (mb->buf, mb->len);
	return;
	}
	mb->buf = p;
	}
	memcpy (mb->buf + mb->len, buf, len);
	mb->len += len;
	}


	/* A variant of put_membuf accepting a void * and returning a
	gpg_error_t (which will always return 0) to be used as a generic
	callback handler. This function also allows buffer to be NULL. */
	gpg_error_t
	put_membuf_cb (void opaque, const void buf, size_t len)
	{
	membuf_t *data = opaque;

	if (buf)
	put_membuf (data, buf, len);
	return 0;
	}


	void
	put_membuf_str (membuf_t mb, const char string)
	{
	put_membuf (mb, string, strlen (string));
	}


	void
	put_membuf_printf (membuf_t mb, const char format, ...)
	{
	int rc;
	va_list arg_ptr;
	char *buf;

	va_start (arg_ptr, format);
	rc = gpgrt_vasprintf (&buf, format, arg_ptr);
	if (rc < 0)
	mb->out_of_core = errno ? errno : ENOMEM;
	va_end (arg_ptr);
	if (rc >= 0)
	{
	put_membuf (mb, buf, strlen (buf));
	xfree (buf);
	}
	}


	void *
	get_membuf (membuf_t mb, size_t len)
	{
	char *p;

	if (mb->out_of_core)
	{
	if (mb->buf)
	{
	wipememory (mb->buf, mb->len);
	xfree (mb->buf);
	mb->buf = NULL;
	}
	gpg_err_set_errno (mb->out_of_core);
	return NULL;
	}

	p = mb->buf;
	if (len)
	*len = mb->len;
	mb->buf = NULL;
	mb->out_of_core = ENOMEM; /* hack to make sure it won't get reused. */
	return p;
	}


	/* Same as get_membuf but shrinks the reallocated space to the
	required size. */
	void *
	get_membuf_shrink (membuf_t mb, size_t len)
	{
	void p, pp;
	size_t dummylen;

	if (!len)
	len = &dummylen;

	p = get_membuf (mb, len);
	if (!p)
	return NULL;
	if (*len)
	{
	pp = xtryrealloc (p, *len);
	if (pp)
	p = pp;
	}

	return p;
	}


	/* Peek at the membuf MB. On success a pointer to the buffer is
	returned which is valid until the next operation on MB. If LEN is
	not NULL the current LEN of the buffer is stored there. On error
	NULL is returned and ERRNO is set. */
	const void *
	peek_membuf (membuf_t mb, size_t len)
	{
	const char *p;

	if (mb->out_of_core)
	{
	gpg_err_set_errno (mb->out_of_core);
	return NULL;
	}

	p = mb->buf;
	if (len)
	*len = mb->len;
	return p;
	}
	diff --git a/common/name-value.c b/common/name-value.c
	index 10186683f..5094acd03 100644
	--- a/common/name-value.c
	+++ b/common/name-value.c
	@@ -1,806 +1,806 @@
	/* name-value.c - Parser and writer for a name-value format.
	* Copyright (C) 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/*
	* This module aso provides features for the extended private key
	* format of gpg-agent.
	*/

	#include <config.h>
	#include <assert.h>
	#include <gcrypt.h>
	#include <gpg-error.h>
	#include <string.h>

	#include "mischelp.h"
	#include "strlist.h"
	#include "util.h"
	#include "name-value.h"

	struct name_value_container
	{
	struct name_value_entry *first;
	struct name_value_entry *last;
	unsigned int private_key_mode:1;
	};


	struct name_value_entry
	{
	struct name_value_entry *prev;
	struct name_value_entry *next;

	/* The name. Comments and blank lines have NAME set to NULL. */
	char *name;

	- /* The value as stored in the file. We store it when when we parse
	+ /* The value as stored in the file. We store it when we parse
	a file so that we can reproduce it. */
	strlist_t raw_value;

	/* The decoded value. */
	char *value;
	};


	/* Helper */
	static inline gpg_error_t
	my_error_from_syserror (void)
	{
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	}


	static inline gpg_error_t
	my_error (gpg_err_code_t ec)
	{
	return gpg_err_make (default_errsource, ec);
	}




	/* Allocation and deallocation. */

	/* Allocate a private key container structure. */
	nvc_t
	nvc_new (void)
	{
	return xtrycalloc (1, sizeof (struct name_value_container));
	}


	/* Allocate a private key container structure for use with private keys. */
	nvc_t
	nvc_new_private_key (void)
	{
	nvc_t nvc = nvc_new ();
	if (nvc)
	nvc->private_key_mode = 1;
	return nvc;
	}


	static void
	nve_release (nve_t entry, int private_key_mode)
	{
	if (entry == NULL)
	return;

	xfree (entry->name);
	if (entry->value && private_key_mode)
	wipememory (entry->value, strlen (entry->value));
	xfree (entry->value);
	if (private_key_mode)
	free_strlist_wipe (entry->raw_value);
	else
	free_strlist (entry->raw_value);
	xfree (entry);
	}


	/* Release a private key container structure. */
	void
	nvc_release (nvc_t pk)
	{
	nve_t e, next;

	if (pk == NULL)
	return;

	for (e = pk->first; e; e = next)
	{
	next = e->next;
	nve_release (e, pk->private_key_mode);
	}

	xfree (pk);
	}



	/* Dealing with names and values. */

	/* Check whether the given name is valid. Valid names start with a
	letter, end with a colon, and contain only alphanumeric characters
	and the hyphen. */
	static int
	valid_name (const char *name)
	{
	size_t i, len = strlen (name);

	if (! alphap (name) \|\| len == 0 \|\| name[len - 1] != ':')
	return 0;

	for (i = 1; i < len - 1; i++)
	if (! alnump (&name[i]) && name[i] != '-')
	return 0;

	return 1;
	}


	/* Makes sure that ENTRY has a RAW_VALUE. */
	static gpg_error_t
	assert_raw_value (nve_t entry)
	{
	gpg_error_t err = 0;
	size_t len, offset;
	#define LINELEN 70
	char buf[LINELEN+3];

	if (entry->raw_value)
	return 0;

	len = strlen (entry->value);
	offset = 0;
	while (len)
	{
	size_t amount, linelen = LINELEN;

	/* On the first line we need to subtract space for the name. */
	if (entry->raw_value == NULL && strlen (entry->name) < linelen)
	linelen -= strlen (entry->name);

	/* See if the rest of the value fits in this line. */
	if (len <= linelen)
	amount = len;
	else
	{
	size_t i;

	/* Find a suitable space to break on. */
	for (i = linelen - 1; linelen - i < 30 && linelen - i > offset; i--)
	if (ascii_isspace (entry->value[i]))
	break;

	if (ascii_isspace (entry->value[i]))
	{
	/* Found one. */
	amount = i;
	}
	else
	{
	/* Just induce a hard break. */
	amount = linelen;
	}
	}

	snprintf (buf, sizeof buf, " %.*s\n", (int) amount,
	&entry->value[offset]);
	if (append_to_strlist_try (&entry->raw_value, buf) == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}

	offset += amount;
	len -= amount;
	}

	leave:
	if (err)
	{
	free_strlist_wipe (entry->raw_value);
	entry->raw_value = NULL;
	}

	return err;
	#undef LINELEN
	}


	/* Computes the length of the value encoded as continuation. If
	*SWALLOW_WS is set, all whitespace at the beginning of S is
	swallowed. If START is given, a pointer to the beginning of the
	value is stored there. */
	static size_t
	continuation_length (const char s, int swallow_ws, const char **start)
	{
	size_t len;

	if (*swallow_ws)
	{
	/* The previous line was a blank line and we inserted a newline.
	Swallow all whitespace at the beginning of this line. */
	while (ascii_isspace (*s))
	s++;
	}
	else
	{
	/* Iff a continuation starts with more than one space, it
	encodes a space. */
	if (ascii_isspace (*s))
	s++;
	}

	/* Strip whitespace at the end. */
	len = strlen (s);
	while (len > 0 && ascii_isspace (s[len-1]))
	len--;

	if (len == 0)
	{
	/* Blank lines encode newlines. */
	len = 1;
	s = "\n";
	*swallow_ws = 1;
	}
	else
	*swallow_ws = 0;

	if (start)
	*start = s;

	return len;
	}


	/* Makes sure that ENTRY has a VALUE. */
	static gpg_error_t
	assert_value (nve_t entry)
	{
	size_t len;
	int swallow_ws;
	strlist_t s;
	char *p;

	if (entry->value)
	return 0;

	len = 0;
	swallow_ws = 0;
	for (s = entry->raw_value; s; s = s->next)
	len += continuation_length (s->d, &swallow_ws, NULL);

	/* Add one for the terminating zero. */
	len += 1;

	entry->value = p = xtrymalloc (len);
	if (entry->value == NULL)
	return my_error_from_syserror ();

	swallow_ws = 0;
	for (s = entry->raw_value; s; s = s->next)
	{
	const char *start;
	size_t l = continuation_length (s->d, &swallow_ws, &start);

	memcpy (p, start, l);
	p += l;
	}

	*p++ = 0;
	assert (p - entry->value == len);

	return 0;
	}


	/* Get the name. */
	char *
	nve_name (nve_t pke)
	{
	return pke->name;
	}


	/* Get the value. */
	char *
	nve_value (nve_t pke)
	{
	if (assert_value (pke))
	return NULL;
	return pke->value;
	}



	/* Adding and modifying values. */

	/* Add (NAME, VALUE, RAW_VALUE) to PK. NAME may be NULL for comments
	and blank lines. At least one of VALUE and RAW_VALUE must be
	given. If PRESERVE_ORDER is not given, entries with the same name
	are grouped. NAME, VALUE and RAW_VALUE is consumed. */
	static gpg_error_t
	_nvc_add (nvc_t pk, char name, char value, strlist_t raw_value,
	int preserve_order)
	{
	gpg_error_t err = 0;
	nve_t e;

	assert (value \|\| raw_value);

	if (name && ! valid_name (name))
	{
	err = my_error (GPG_ERR_INV_NAME);
	goto leave;
	}

	if (name
	&& pk->private_key_mode
	&& !ascii_strcasecmp (name, "Key:")
	&& nvc_lookup (pk, "Key:"))
	{
	err = my_error (GPG_ERR_INV_NAME);
	goto leave;
	}

	e = xtrycalloc (1, sizeof *e);
	if (e == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}

	e->name = name;
	e->value = value;
	e->raw_value = raw_value;

	if (pk->first)
	{
	nve_t last;

	if (preserve_order \|\| name == NULL)
	last = pk->last;
	else
	{
	/* See if there is already an entry with NAME. */
	last = nvc_lookup (pk, name);

	/* If so, find the last in that block. */
	if (last)
	{
	while (last->next)
	{
	nve_t next = last->next;

	if (next->name && ascii_strcasecmp (next->name, name) == 0)
	last = next;
	else
	break;
	}
	}
	else /* Otherwise, just find the last entry. */
	last = pk->last;
	}

	if (last->next)
	{
	e->prev = last;
	e->next = last->next;
	last->next = e;
	e->next->prev = e;
	}
	else
	{
	e->prev = last;
	last->next = e;
	pk->last = e;
	}
	}
	else
	pk->first = pk->last = e;

	leave:
	if (err)
	{
	xfree (name);
	if (value)
	wipememory (value, strlen (value));
	xfree (value);
	free_strlist_wipe (raw_value);
	}

	return err;
	}


	/* Add (NAME, VALUE) to PK. If an entry with NAME already exists, it
	is not updated but the new entry is appended. */
	gpg_error_t
	nvc_add (nvc_t pk, const char name, const char value)
	{
	char k, v;

	k = xtrystrdup (name);
	if (k == NULL)
	return my_error_from_syserror ();

	v = xtrystrdup (value);
	if (v == NULL)
	{
	xfree (k);
	return my_error_from_syserror ();
	}

	return _nvc_add (pk, k, v, NULL, 0);
	}


	/* Add (NAME, VALUE) to PK. If an entry with NAME already exists, it
	is updated with VALUE. If multiple entries with NAME exist, the
	first entry is updated. */
	gpg_error_t
	nvc_set (nvc_t pk, const char name, const char value)
	{
	nve_t e;

	if (! valid_name (name))
	return GPG_ERR_INV_NAME;

	e = nvc_lookup (pk, name);
	if (e)
	{
	char *v;

	v = xtrystrdup (value);
	if (v == NULL)
	return my_error_from_syserror ();

	free_strlist_wipe (e->raw_value);
	e->raw_value = NULL;
	if (e->value)
	wipememory (e->value, strlen (e->value));
	xfree (e->value);
	e->value = v;

	return 0;
	}
	else
	return nvc_add (pk, name, value);
	}


	/* Delete the given entry from PK. */
	void
	nvc_delete (nvc_t pk, nve_t entry)
	{
	if (entry->prev)
	entry->prev->next = entry->next;
	else
	pk->first = entry->next;

	if (entry->next)
	entry->next->prev = entry->prev;
	else
	pk->last = entry->prev;

	nve_release (entry, pk->private_key_mode);
	}



	/* Lookup and iteration. */

	/* Get the first non-comment entry. */
	nve_t
	nvc_first (nvc_t pk)
	{
	nve_t entry;
	for (entry = pk->first; entry; entry = entry->next)
	if (entry->name)
	return entry;
	return NULL;
	}


	/* Get the first entry with the given name. */
	nve_t
	nvc_lookup (nvc_t pk, const char *name)
	{
	nve_t entry;
	for (entry = pk->first; entry; entry = entry->next)
	if (entry->name && ascii_strcasecmp (entry->name, name) == 0)
	return entry;
	return NULL;
	}


	/* Get the next non-comment entry. */
	nve_t
	nve_next (nve_t entry)
	{
	for (entry = entry->next; entry; entry = entry->next)
	if (entry->name)
	return entry;
	return NULL;
	}


	/* Get the next entry with the given name. */
	nve_t
	nve_next_value (nve_t entry, const char *name)
	{
	for (entry = entry->next; entry; entry = entry->next)
	if (entry->name && ascii_strcasecmp (entry->name, name) == 0)
	return entry;
	return NULL;
	}



	/* Private key handling. */

	/* Get the private key. */
	gpg_error_t
	nvc_get_private_key (nvc_t pk, gcry_sexp_t *retsexp)
	{
	gpg_error_t err;
	nve_t e;

	e = pk->private_key_mode? nvc_lookup (pk, "Key:") : NULL;
	if (e == NULL)
	return my_error (GPG_ERR_MISSING_KEY);

	err = assert_value (e);
	if (err)
	return err;

	return gcry_sexp_sscan (retsexp, NULL, e->value, strlen (e->value));
	}


	/* Set the private key. */
	gpg_error_t
	nvc_set_private_key (nvc_t pk, gcry_sexp_t sexp)
	{
	gpg_error_t err;
	char raw, clean, *p;
	size_t len, i;

	if (!pk->private_key_mode)
	return my_error (GPG_ERR_MISSING_KEY);

	len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, NULL, 0);

	raw = xtrymalloc (len);
	if (raw == NULL)
	return my_error_from_syserror ();

	clean = xtrymalloc (len);
	if (clean == NULL)
	{
	xfree (raw);
	return my_error_from_syserror ();
	}

	gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, raw, len);

	/* Strip any whitespace at the end. */
	i = strlen (raw) - 1;
	while (i && ascii_isspace (raw[i]))
	{
	raw[i] = 0;
	i--;
	}

	/* Replace any newlines with spaces, remove superfluous whitespace. */
	len = strlen (raw);
	for (p = clean, i = 0; i < len; i++)
	{
	char c = raw[i];

	/* Collapse contiguous and superfluous spaces. */
	if (ascii_isspace (c) && i > 0
	&& (ascii_isspace (raw[i-1]) \|\| raw[i-1] == '(' \|\| raw[i-1] == ')'))
	continue;

	if (c == '\n')
	c = ' ';

	*p++ = c;
	}
	*p = 0;

	err = nvc_set (pk, "Key:", clean);
	xfree (raw);
	xfree (clean);
	return err;
	}



	/* Parsing and serialization. */

	static gpg_error_t
	do_nvc_parse (nvc_t result, int errlinep, estream_t stream,
	int for_private_key)
	{
	gpg_error_t err = 0;
	gpgrt_ssize_t len;
	char *buf = NULL;
	size_t buf_len = 0;
	char *name = NULL;
	strlist_t raw_value = NULL;

	*result = for_private_key? nvc_new_private_key () : nvc_new ();
	if (*result == NULL)
	return my_error_from_syserror ();

	if (errlinep)
	*errlinep = 0;
	while ((len = es_read_line (stream, &buf, &buf_len, NULL)) > 0)
	{
	char *p;
	if (errlinep)
	*errlinep += 1;

	/* Skip any whitespace. */
	for (p = buf; p && ascii_isspace (p); p++)
	/* Do nothing. */;

	if (name && (spacep (buf) \|\| *p == 0))
	{
	/* A continuation. */
	if (append_to_strlist_try (&raw_value, buf) == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}
	continue;
	}

	/* No continuation. Add the current entry if any. */
	if (raw_value)
	{
	err = _nvc_add (*result, name, NULL, raw_value, 1);
	if (err)
	goto leave;
	}

	/* And prepare for the next one. */
	name = NULL;
	raw_value = NULL;

	if (p != 0 && p != '#')
	{
	char colon, value, tmp;

	colon = strchr (buf, ':');
	if (colon == NULL)
	{
	err = my_error (GPG_ERR_INV_VALUE);
	goto leave;
	}

	value = colon + 1;
	tmp = *value;
	*value = 0;
	name = xtrystrdup (p);
	*value = tmp;

	if (name == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}

	if (append_to_strlist_try (&raw_value, value) == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}
	continue;
	}

	if (append_to_strlist_try (&raw_value, buf) == NULL)
	{
	err = my_error_from_syserror ();
	goto leave;
	}
	}
	if (len < 0)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Add the final entry. */
	if (raw_value)
	err = _nvc_add (*result, name, NULL, raw_value, 1);

	leave:
	gpgrt_free (buf);
	if (err)
	{
	nvc_release (*result);
	*result = NULL;
	}

	return err;
	}


	/* Parse STREAM and return a newly allocated name value container
	structure in RESULT. If ERRLINEP is given, the line number the
	parser was last considering is stored there. */
	gpg_error_t
	nvc_parse (nvc_t result, int errlinep, estream_t stream)
	{
	return do_nvc_parse (result, errlinep, stream, 0);
	}


	/* Parse STREAM and return a newly allocated name value container
	structure in RESULT - assuming the extended private key format. If
	ERRLINEP is given, the line number the parser was last considering
	is stored there. */
	gpg_error_t
	nvc_parse_private_key (nvc_t result, int errlinep, estream_t stream)
	{
	return do_nvc_parse (result, errlinep, stream, 1);
	}


	/* Write a representation of PK to STREAM. */
	gpg_error_t
	nvc_write (nvc_t pk, estream_t stream)
	{
	gpg_error_t err;
	nve_t entry;
	strlist_t s;

	for (entry = pk->first; entry; entry = entry->next)
	{
	if (entry->name)
	es_fputs (entry->name, stream);

	err = assert_raw_value (entry);
	if (err)
	return err;

	for (s = entry->raw_value; s; s = s->next)
	es_fputs (s->d, stream);

	if (es_ferror (stream))
	return my_error_from_syserror ();
	}

	return 0;
	}
	diff --git a/common/session-env.c b/common/session-env.c
	index 1bc3a2bc9..c1eb1d959 100644
	--- a/common/session-env.c
	+++ b/common/session-env.c
	@@ -1,400 +1,400 @@
	/* session-env.c - Session environment helper functions.
	* Copyright (C) 2009 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdlib.h>
	#include <errno.h>
	#include <ctype.h>
	#include <assert.h>
	#include <unistd.h>

	#include "util.h"
	#include "session-env.h"


	struct variable_s
	{
	char value; / Pointer into NAME to the Nul terminated value. */
	int is_default; /* The value is a default one. */
	char name[1]; /* Nul terminated Name and space for the value. */
	};



	/* The session environment object. */
	struct session_environment_s
	{
	size_t arraysize; /* Allocated size or ARRAY. */
	size_t arrayused; /* Used size of ARRAY. */
	struct variable_s *array; / Array of variables. NULL slots are unused. */
	};


	/* A list of environment variables we pass from the actual user
	(e.g. gpgme) down to the pinentry. We do not handle the locale
	settings because they do not only depend on envvars. */
	static struct
	{
	const char *name;
	const char assname; / Name used by Assuan or NULL. */
	} stdenvnames[] = {
	{ "GPG_TTY", "ttyname" }, /* GnuPG specific envvar. */
	{ "TERM", "ttytype" }, /* Used to set ttytype. */
	{ "DISPLAY", "display" }, /* The X-Display. */
	{ "XAUTHORITY","xauthority"}, /* Xlib Authentication. */
	{ "XMODIFIERS" }, /* Used by Xlib to select X input
	modules (eg "@im=SCIM"). */
	{ "GTK_IM_MODULE" }, /* Used by gtk to select gtk input
	modules (eg "scim-bridge"). */
	{ "DBUS_SESSION_BUS_ADDRESS" },/* Used by GNOME3 to talk to gcr over
	dbus */
	{ "QT_IM_MODULE" }, /* Used by Qt to select qt input
	modules (eg "xim"). */
	{ "INSIDE_EMACS" }, /* Set by Emacs before running a
	process. */
	{ "PINENTRY_USER_DATA", "pinentry-user-data"}
	/* Used for communication with
	non-standard Pinentries. */
	};


	/* Track last allocated arraysize of all objects ever created. If
	nothing has ever been allocated we use INITIAL_ARRAYSIZE and we
	will never use more than MAXDEFAULT_ARRAYSIZE for initial
	allocation. Note that this is not reentrant if used with a
	preemptive thread model. */
	static size_t lastallocatedarraysize;
	#define INITIAL_ARRAYSIZE 8 /* Let's use the number of stdenvnames. */
	#define CHUNK_ARRAYSIZE 10
	#define MAXDEFAULT_ARRAYSIZE (INITIAL_ARRAYSIZE + CHUNK_ARRAYSIZE * 5)


	/* Return the names of standard environment variables one after the
	other. The caller needs to set the value at the address of
	ITERATOR initially to 0 and then call this function until it returns
	NULL. */
	const char *
	session_env_list_stdenvnames (int iterator, const char *r_assname)
	{
	int idx = *iterator;

	if (idx < 0 \|\| idx >= DIM (stdenvnames))
	return NULL;
	*iterator = idx + 1;
	if (r_assname)
	*r_assname = stdenvnames[idx].assname;
	return stdenvnames[idx].name;
	}


	/* Create a new session environment object. Return NULL and sets
	ERRNO on failure. */
	session_env_t
	session_env_new (void)
	{
	session_env_t se;

	se = xtrycalloc (1, sizeof *se);
	if (se)
	{
	se->arraysize = (lastallocatedarraysize?
	lastallocatedarraysize : INITIAL_ARRAYSIZE);
	se->array = xtrycalloc (se->arraysize, sizeof *se->array);
	if (!se->array)
	{
	xfree (se);
	se = NULL;
	}
	}

	return se;
	}


	/* Release a session environment object. */
	void
	session_env_release (session_env_t se)
	{
	int idx;

	if (!se)
	return;

	if (se->arraysize > INITIAL_ARRAYSIZE
	&& se->arraysize <= MAXDEFAULT_ARRAYSIZE
	&& se->arraysize > lastallocatedarraysize)
	lastallocatedarraysize = se->arraysize;

	for (idx=0; idx < se->arrayused; idx++)
	if (se->array[idx])
	xfree (se->array[idx]);
	xfree (se->array);
	xfree (se);
	}


	static gpg_error_t
	delete_var (session_env_t se, const char *name)
	{
	int idx;

	for (idx=0; idx < se->arrayused; idx++)
	if (se->array[idx] && !strcmp (se->array[idx]->name, name))
	{
	xfree (se->array[idx]);
	se->array[idx] = NULL;
	}
	return 0;
	}


	static gpg_error_t
	update_var (session_env_t se, const char *string, size_t namelen,
	const char *explicit_value, int set_default)
	{
	int idx;
	int freeidx = -1;
	const char *value;
	size_t valuelen;
	struct variable_s *var;

	if (explicit_value)
	value = explicit_value;
	else
	value = string + namelen + 1;
	valuelen = strlen (value);

	for (idx=0; idx < se->arrayused; idx++)
	{
	if (!se->array[idx])
	freeidx = idx;
	else if (!strncmp (se->array[idx]->name, string, namelen)
	&& strlen (se->array[idx]->name) == namelen)
	{
	if (strlen (se->array[idx]->value) == valuelen)
	{
	/* The new value has the same length. We can update it
	in-place. */
	memcpy (se->array[idx]->value, value, valuelen);
	se->array[idx]->is_default = !!set_default;
	return 0;
	}
	/* Prepare for update. */
	freeidx = idx;
	}
	}

	if (freeidx == -1)
	{
	if (se->arrayused == se->arraysize)
	{
	/* Reallocate the array. */
	size_t newsize;
	struct variable_s **newarray;

	newsize = se->arraysize + CHUNK_ARRAYSIZE;
	newarray = xtrycalloc (newsize, sizeof *newarray);
	if (!newarray)
	return gpg_error_from_syserror ();
	for (idx=0; idx < se->arrayused; idx++)
	newarray[idx] = se->array[idx];
	se->arraysize = newsize;
	xfree (se->array);
	se->array = newarray;
	}
	freeidx = se->arrayused++;
	}

	/* Allocate new memory and return an error if that didn't worked.
	Allocating it first allows us to keep the old value; it doesn't
	matter that arrayused has already been incremented in case of a
	new entry - it will then pint to a NULL slot. */
	var = xtrymalloc (sizeof *var + namelen + 1 + valuelen);
	if (!var)
	return gpg_error_from_syserror ();
	var->is_default = !!set_default;
	memcpy (var->name, string, namelen);
	var->name[namelen] = '\0';
	var->value = var->name + namelen + 1;
	strcpy (var->value, value);

	xfree (se->array[freeidx]);
	se->array[freeidx] = var;
	return 0;
	}


	/* Set or update an environment variable of the session environment.
	String is similar to the putval(3) function but it is reentrant and
	takes a copy. In particular it exhibits this behaviour:

	<NAME> Delete envvar NAME
	<KEY>= Set envvar NAME to the empty string
	<KEY>=<VALUE> Set envvar NAME to VALUE

	On success 0 is returned; on error an gpg-error code. */
	gpg_error_t
	session_env_putenv (session_env_t se, const char *string)
	{
	const char *s;

	if (!string \|\| !*string)
	return gpg_error (GPG_ERR_INV_VALUE);
	s = strchr (string, '=');
	if (s == string)
	return gpg_error (GPG_ERR_INV_VALUE);
	if (!s)
	return delete_var (se, string);
	else
	return update_var (se, string, s - string, NULL, 0);
	}


	/* Same as session_env_putenv but with name and value given as distict
	values. */
	gpg_error_t
	session_env_setenv (session_env_t se, const char name, const char value)
	{
	if (!name \|\| !*name)
	return gpg_error (GPG_ERR_INV_VALUE);
	if (!value)
	return delete_var (se, name);
	else
	return update_var (se, name, strlen (name), value, 0);
	}




	/* Return the value of the environment variable NAME from the SE
	object. If the variable does not exist, NULL is returned. The
	returned value is valid as long as SE is valid and as long it has
	not been removed or updated by a call to session_env_putenv. The
	caller MUST not change the returned value. */
	char *
	session_env_getenv (session_env_t se, const char *name)
	{
	int idx;

	if (!se \|\| !name \|\| !*name)
	return NULL;

	for (idx=0; idx < se->arrayused; idx++)
	if (se->array[idx] && !strcmp (se->array[idx]->name, name))
	return se->array[idx]->is_default? NULL : se->array[idx]->value;
	return NULL;
	}


	/* Return the value of the environment variable NAME from the SE
	object. The returned value is valid as long as SE is valid and as
	long it has not been removed or updated by a call to
	session_env_putenv. If the variable does not exist, the function
	tries to return the value trough a call to getenv; if that returns
	- a value, this value is recorded and and used. If no value could be
	+ a value, this value is recorded and used. If no value could be
	found, returns NULL. The caller must not change the returned
	value. */
	char *
	session_env_getenv_or_default (session_env_t se, const char *name,
	int *r_default)
	{
	int idx;
	char *defvalue;

	if (r_default)
	*r_default = 0;
	if (!se \|\| !name \|\| !*name)
	return NULL;

	for (idx=0; idx < se->arrayused; idx++)
	if (se->array[idx] && !strcmp (se->array[idx]->name, name))
	{
	if (r_default && se->array[idx]->is_default)
	*r_default = 1;
	return se->array[idx]->value;
	}

	/* Get the default value with an additional fallback for GPG_TTY. */
	defvalue = getenv (name);
	if ((!defvalue \|\| !*defvalue) && !strcmp (name, "GPG_TTY")
	&& gnupg_ttyname (0))
	{
	defvalue = gnupg_ttyname (0);
	}
	if (defvalue)
	{
	/* Record the default value for later use so that we are safe
	from later modifications of the environment. We need to take
	a copy to better cope with the rules of putenv(3). We ignore
	the error of the update function because we can't return an
	explicit error anyway and the following scan would then fail
	anyway. */
	update_var (se, name, strlen (name), defvalue, 1);

	for (idx=0; idx < se->arrayused; idx++)
	if (se->array[idx] && !strcmp (se->array[idx]->name, name))
	{
	if (r_default && se->array[idx]->is_default)
	*r_default = 1;
	return se->array[idx]->value;
	}
	}

	return NULL;
	}


	/* List the entire environment stored in SE. The caller initially
	needs to set the value of ITERATOR to 0 and then call this function
	until it returns NULL. The value is returned at R_VALUE. If
	R_DEFAULT is not NULL, the default flag is stored on return. The
	default flag indicates that the value has been taken from the
	process' environment. The caller must not change the returned
	name or value. */
	char *
	session_env_listenv (session_env_t se, int *iterator,
	const char *r_value, int r_default)
	{
	int idx = *iterator;

	if (!se \|\| idx < 0)
	return NULL;

	for (; idx < se->arrayused; idx++)
	if (se->array[idx])
	{
	*iterator = idx+1;
	if (r_default)
	*r_default = se->array[idx]->is_default;
	if (r_value)
	*r_value = se->array[idx]->value;
	return se->array[idx]->name;
	}
	return NULL;
	}
	diff --git a/common/sexp-parse.h b/common/sexp-parse.h
	index 9b14f77d7..4f77f1430 100644
	--- a/common/sexp-parse.h
	+++ b/common/sexp-parse.h
	@@ -1,137 +1,137 @@
	/* sexp-parse.h - S-expression helper functions
	* Copyright (C) 2002, 2003, 2007 Free Software Foundation, Inc.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef SEXP_PARSE_H
	#define SEXP_PARSE_H

	#include <gpg-error.h>


	/* Return the length of the next S-Exp part and update the pointer to
	the first data byte. 0 is returned on error */
	static inline size_t
	snext (unsigned char const **buf)
	{
	const unsigned char *s;
	int n;

	s = *buf;
	for (n=0; s && s != ':' && (s >= '0' && s <= '9'); s++)
	n = n10 + (s - '0');
	if (!n \|\| *s != ':')
	return 0; /* we don't allow empty lengths */
	*buf = s+1;
	return n;
	}

	/* Skip over the S-Expression BUF points to and update BUF to point to
	the character right behind. DEPTH gives the initial number of open
	lists and may be passed as a positive number to skip over the
	remainder of an S-Expression if the current position is somewhere
	in an S-Expression. The function may return an error code if it
	encounters an impossible condition. */
	static inline gpg_error_t
	sskip (unsigned char const *buf, int depth)
	{
	const unsigned char s = buf;
	size_t n;
	int d = *depth;

	while (d > 0)
	{
	if (*s == '(')
	{
	d++;
	s++;
	}
	else if (*s == ')')
	{
	d--;
	s++;
	}
	else
	{
	if (!d)
	return gpg_error (GPG_ERR_INV_SEXP);
	n = snext (&s);
	if (!n)
	return gpg_error (GPG_ERR_INV_SEXP);
	s += n;
	}
	}
	*buf = s;
	*depth = d;
	return 0;
	}


	-/* Check whether the the string at the address BUF points to matches
	+/* Check whether the string at the address BUF points to matches
	the token. Return true on match and update BUF to point behind the
	token. Return false and do not update the buffer if it does not
	match. */
	static inline int
	smatch (unsigned char const *buf, size_t buflen, const char token)
	{
	size_t toklen = strlen (token);

	if (buflen != toklen \|\| memcmp (*buf, token, toklen))
	return 0;
	*buf += toklen;
	return 1;
	}

	/* Format VALUE for use as the length indicatior of an S-expression.
	The caller needs to provide a buffer HELP_BUFFER wth a length of
	HELP_BUFLEN. The return value is a pointer into HELP_BUFFER with
	the formatted length string. The colon and a trailing nul are
	appended. HELP_BUFLEN must be at least 3 - a more useful value is
	15. If LENGTH is not NULL, the LENGTH of the resulting string
	(excluding the terminating nul) is stored at that address. */
	static inline char *
	smklen (char help_buffer, size_t help_buflen, size_t value, size_t length)
	{
	char *p = help_buffer + help_buflen;

	if (help_buflen >= 3)
	{
	*--p = 0;
	*--p = ':';
	do
	{
	*--p = '0' + (value % 10);
	value /= 10;
	}
	while (value && p > help_buffer);
	}

	if (length)
	*length = (help_buffer + help_buflen) - p;
	return p;
	}


	#endif /SEXP_PARSE_H/
	diff --git a/common/simple-pwquery.c b/common/simple-pwquery.c
	index c74317f1a..e7f4af341 100644
	--- a/common/simple-pwquery.c
	+++ b/common/simple-pwquery.c
	@@ -1,494 +1,494 @@
	/* simple-pwquery.c - A simple password query client for gpg-agent
	* Copyright (C) 2002, 2004, 2007 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* This module is intended as a simple client implementation to
	gpg-agent's GET_PASSPHRASE command. It can only cope with an
	already running gpg-agent. Some stuff is configurable in the
	header file. */

	#ifdef HAVE_CONFIG_H
	#include <config.h>
	#endif
	#include <stdlib.h>
	#include <stddef.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <assuan.h>
	#ifdef HAVE_W32_SYSTEM
	#include <winsock2.h>
	#else
	#include <sys/socket.h>
	#include <sys/un.h>
	#endif
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif

	#define GNUPG_COMMON_NEED_AFLOCAL
	#include "../common/mischelp.h"
	#include "sysutils.h"
	#include "membuf.h"


	#define SIMPLE_PWQUERY_IMPLEMENTATION 1
	#include "simple-pwquery.h"

	#define SPWQ_OUT_OF_CORE gpg_error_from_errno (ENOMEM)
	#define SPWQ_IO_ERROR gpg_error_from_errno (EIO)
	#define SPWQ_PROTOCOL_ERROR gpg_error (GPG_ERR_PROTOCOL_VIOLATION)
	#define SPWQ_ERR_RESPONSE gpg_error (GPG_ERR_INV_RESPONSE)
	#define SPWQ_NO_AGENT gpg_error (GPG_ERR_NO_AGENT)
	#define SPWQ_SYS_ERROR gpg_error_from_syserror ()
	#define SPWQ_GENERAL_ERROR gpg_error (GPG_ERR_GENERAL)
	#define SPWQ_NO_PIN_ENTRY gpg_error (GPG_ERR_NO_PIN_ENTRY)

	#ifndef _
	#define _(a) (a)
	#endif

	#if !defined (hexdigitp) && !defined (xtoi_2)
	#define digitp(p) ((p) >= '0' && (p) <= '9')
	#define hexdigitp(a) (digitp (a) \
	\|\| ((a) >= 'A' && (a) <= 'F') \
	\|\| ((a) >= 'a' && (a) <= 'f'))
	#define xtoi_1(p) ((p) <= '9'? ((p)- '0'): \
	(p) <= 'F'? ((p)-'A'+10):(*(p)-'a'+10))
	#define xtoi_2(p) ((xtoi_1(p) * 16) + xtoi_1((p)+1))
	#endif


	/* Name of the socket to be used. This is a kludge to keep on using
	the existsing code despite that we only support a standard socket. */
	static char *default_gpg_agent_info;





	#ifndef HAVE_STPCPY
	static char *
	my_stpcpy(char a,const char b)
	{
	while( *b )
	a++ = b++;
	*a = 0;

	return (char*)a;
	}
	#define stpcpy(a,b) my_stpcpy((a), (b))
	#endif


	/* Send an option to the agent */
	static int
	agent_send_option (assuan_context_t ctx, const char name, const char value)
	{
	int err;
	char *line;

	line = spwq_malloc (7 + strlen (name) + 1 + strlen (value) + 2);
	if (!line)
	return SPWQ_OUT_OF_CORE;
	strcpy (stpcpy (stpcpy (stpcpy (
	stpcpy (line, "OPTION "), name), "="), value), "\n");

	err = assuan_transact (ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);

	spwq_free (line);
	return err;
	}


	/* Send all available options to the agent. */
	static int
	agent_send_all_options (assuan_context_t ctx)
	{
	char *dft_display = NULL;
	char *dft_ttyname = NULL;
	char *dft_ttytype = NULL;
	char *dft_xauthority = NULL;
	char *dft_pinentry_user_data = NULL;
	int rc = 0;

	dft_display = getenv ("DISPLAY");
	if (dft_display)
	{
	if ((rc = agent_send_option (ctx, "display", dft_display)))
	return rc;
	}

	dft_ttyname = getenv ("GPG_TTY");
	#if !defined(HAVE_W32_SYSTEM) && !defined(HAVE_BROKEN_TTYNAME)
	if ((!dft_ttyname \|\| !*dft_ttyname) && ttyname (0))
	dft_ttyname = ttyname (0);
	#endif
	if (dft_ttyname && *dft_ttyname)
	{
	if ((rc=agent_send_option (ctx, "ttyname", dft_ttyname)))
	return rc;
	}

	dft_ttytype = getenv ("TERM");
	if (dft_ttyname && dft_ttytype)
	{
	if ((rc = agent_send_option (ctx, "ttytype", dft_ttytype)))
	return rc;
	}

	#if defined(HAVE_SETLOCALE)
	{
	char *old_lc = NULL;
	char *dft_lc = NULL;

	#if defined(LC_CTYPE)
	old_lc = setlocale (LC_CTYPE, NULL);
	if (old_lc)
	{
	char *p = spwq_malloc (strlen (old_lc)+1);
	if (!p)
	return SPWQ_OUT_OF_CORE;
	strcpy (p, old_lc);
	old_lc = p;
	}
	dft_lc = setlocale (LC_CTYPE, "");
	if (dft_ttyname && dft_lc)
	rc = agent_send_option (ctx, "lc-ctype", dft_lc);
	if (old_lc)
	{
	setlocale (LC_CTYPE, old_lc);
	spwq_free (old_lc);
	}
	if (rc)
	return rc;
	#endif

	#if defined(LC_MESSAGES)
	old_lc = setlocale (LC_MESSAGES, NULL);
	if (old_lc)
	{
	char *p = spwq_malloc (strlen (old_lc)+1);
	if (!p)
	return SPWQ_OUT_OF_CORE;
	strcpy (p, old_lc);
	old_lc = p;
	}
	dft_lc = setlocale (LC_MESSAGES, "");
	if (dft_ttyname && dft_lc)
	rc = agent_send_option (ctx, "lc-messages", dft_lc);
	if (old_lc)
	{
	setlocale (LC_MESSAGES, old_lc);
	spwq_free (old_lc);
	}
	if (rc)
	return rc;
	#endif
	}
	#endif /HAVE_SETLOCALE/

	/* Send the XAUTHORITY variable. */
	dft_xauthority = getenv ("XAUTHORITY");
	if (dft_xauthority)
	{
	/* We ignore errors here because older gpg-agents don't support
	this option. */
	agent_send_option (ctx, "xauthority", dft_xauthority);
	}

	/* Send the PINENTRY_USER_DATA variable. */
	dft_pinentry_user_data = getenv ("PINENTRY_USER_DATA");
	if (dft_pinentry_user_data)
	{
	/* We ignore errors here because older gpg-agents don't support
	this option. */
	agent_send_option (ctx, "pinentry-user-data", dft_pinentry_user_data);
	}

	/* Tell the agent that we support Pinentry notifications. No
	error checking so that it will work with older agents. */
	assuan_transact (ctx, "OPTION allow-pinentry-notify",
	NULL, NULL, NULL, NULL, NULL, NULL);

	return 0;
	}



	/* Try to open a connection to the agent, send all options and return
	the file descriptor for the connection. Return -1 in case of
	error. */
	static int
	agent_open (assuan_context_t *ctx)
	{
	int rc;
	char *infostr;

	infostr = default_gpg_agent_info;
	if ( !infostr \|\| !*infostr )
	{
	#ifdef SPWQ_USE_LOGGING
	log_error (_("no gpg-agent running in this session\n"));
	#endif
	return SPWQ_NO_AGENT;
	}

	rc = assuan_new (ctx);
	if (rc)
	return rc;

	rc = assuan_socket_connect (*ctx, infostr, 0, 0);
	if (rc)
	{
	#ifdef SPWQ_USE_LOGGING
	log_error (_("can't connect to '%s': %s\n"),
	infostr, gpg_strerror (rc));
	#endif
	goto errout;
	}

	rc = agent_send_all_options (*ctx);
	if (rc)
	{
	#ifdef SPWQ_USE_LOGGING
	log_error (_("problem setting the gpg-agent options\n"));
	#endif
	goto errout;
	}

	return 0;

	errout:
	assuan_release (*ctx);
	*ctx = NULL;
	return rc;
	}


	/* Copy text to BUFFER and escape as required. Return a pointer to
	the end of the new buffer. Note that BUFFER must be large enough
	to keep the entire text; allocataing it 3 times the size of TEXT
	is sufficient. */
	static char *
	copy_and_escape (char buffer, const char text)
	{
	int i;
	const unsigned char s = (unsigned char )text;
	char *p = buffer;


	for (i=0; s[i]; i++)
	{
	if (s[i] < ' ' \|\| s[i] == '+')
	{
	sprintf (p, "%%%02X", s[i]);
	p += 3;
	}
	else if (s[i] == ' ')
	*p++ = '+';
	else
	*p++ = s[i];
	}
	return p;
	}


	/* Set the name of the default socket to NAME. */
	int
	simple_pw_set_socket (const char *name)
	{
	spwq_free (default_gpg_agent_info);
	default_gpg_agent_info = NULL;
	if (name)
	{
	default_gpg_agent_info = spwq_malloc (strlen (name) + 1);
	if (!default_gpg_agent_info)
	return SPWQ_OUT_OF_CORE;
	strcpy (default_gpg_agent_info, name);
	}

	return 0;
	}


	/* This is the default inquiry callback. It merely handles the
	Pinentry notification. */
	static gpg_error_t
	default_inq_cb (void opaque, const char line)
	{
	(void)opaque;

	if (!strncmp (line, "PINENTRY_LAUNCHED", 17) && (line[17]==' '\|\|!line[17]))
	{
	gnupg_allow_set_foregound_window ((pid_t)strtoul (line+17, NULL, 10));
	/* We do not return errors to avoid breaking other code. */
	}
	else
	{
	#ifdef SPWQ_USE_LOGGING
	log_debug ("ignoring gpg-agent inquiry '%s'\n", line);
	#endif
	}

	return 0;
	}


	/* Ask the gpg-agent for a passphrase and present the user with a
	DESCRIPTION, a PROMPT and optionally with a TRYAGAIN extra text.
	- If a CACHEID is not NULL it is used to locate the passphrase in in
	+ If a CACHEID is not NULL it is used to locate the passphrase in
	the cache and store it under this ID. If OPT_CHECK is true
	gpg-agent is asked to apply some checks on the passphrase security.
	If ERRORCODE is not NULL it should point a variable receiving an
	errorcode; this error code might be 0 if the user canceled the
	operation. The function returns NULL to indicate an error. */
	char *
	simple_pwquery (const char *cacheid,
	const char *tryagain,
	const char *prompt,
	const char *description,
	int opt_check,
	int *errorcode)
	{
	int rc;
	assuan_context_t ctx;
	membuf_t data;
	char *result = NULL;
	char *pw = NULL;
	char *p;
	size_t n;


	rc = agent_open (&ctx);
	if (rc)
	goto leave;

	if (!cacheid)
	cacheid = "X";
	if (!tryagain)
	tryagain = "X";
	if (!prompt)
	prompt = "X";
	if (!description)
	description = "X";

	{
	char *line;
	/* We allocate 3 times the needed space so that there is enough
	space for escaping. */
	line = spwq_malloc (15 + 10
	+ 3*strlen (cacheid) + 1
	+ 3*strlen (tryagain) + 1
	+ 3*strlen (prompt) + 1
	+ 3*strlen (description) + 1
	+ 2);
	if (!line)
	{
	rc = SPWQ_OUT_OF_CORE;
	goto leave;
	}
	strcpy (line, "GET_PASSPHRASE ");
	p = line+15;
	if (opt_check)
	p = stpcpy (p, "--check ");
	p = copy_and_escape (p, cacheid);
	*p++ = ' ';
	p = copy_and_escape (p, tryagain);
	*p++ = ' ';
	p = copy_and_escape (p, prompt);
	*p++ = ' ';
	p = copy_and_escape (p, description);
	*p++ = '\n';

	init_membuf_secure (&data, 64);

	rc = assuan_transact (ctx, line, put_membuf_cb, &data,
	default_inq_cb, NULL, NULL, NULL);
	spwq_free (line);

	/* Older Pinentries return the old assuan error code for canceled
	which gets translated by libassuan to GPG_ERR_ASS_CANCELED and
	not to the code for a user cancel. Fix this here. */
	if (rc && gpg_err_source (rc)
	&& gpg_err_code (rc) == GPG_ERR_ASS_CANCELED)
	rc = gpg_err_make (gpg_err_source (rc), GPG_ERR_CANCELED);

	if (rc)
	{
	p = get_membuf (&data, &n);
	if (p)
	wipememory (p, n);
	spwq_free (p);
	}
	else
	{
	put_membuf (&data, "", 1);
	result = get_membuf (&data, NULL);
	if (pw == NULL)
	rc = gpg_error_from_syserror ();
	}
	}

	leave:
	if (errorcode)
	*errorcode = rc;
	assuan_release (ctx);
	return result;
	}


	/* Ask the gpg-agent to clear the passphrase for the cache ID CACHEID. */
	int
	simple_pwclear (const char *cacheid)
	{
	char line[500];
	char *p;

	/* We need not more than 50 characters for the command and the
	terminating nul. */
	if (strlen (cacheid) * 3 > sizeof (line) - 50)
	return SPWQ_PROTOCOL_ERROR;

	strcpy (line, "CLEAR_PASSPHRASE ");
	p = line + 17;
	p = copy_and_escape (p, cacheid);
	*p++ = '\n';
	*p++ = '\0';

	return simple_query (line);
	}


	/* Perform the simple query QUERY (which must be new-line and 0
	terminated) and return the error code. */
	int
	simple_query (const char *query)
	{
	assuan_context_t ctx;
	int rc;

	rc = agent_open (&ctx);
	if (rc)
	return rc;

	rc = assuan_transact (ctx, query, NULL, NULL, NULL, NULL, NULL, NULL);

	assuan_release (ctx);
	return rc;
	}
	diff --git a/common/simple-pwquery.h b/common/simple-pwquery.h
	index f98a396a5..772aa398c 100644
	--- a/common/simple-pwquery.h
	+++ b/common/simple-pwquery.h
	@@ -1,70 +1,70 @@
	/* simple-pwquery.c - A simple password query cleint for gpg-agent
	* Copyright (C) 2002 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef SIMPLE_PWQUERY_H
	#define SIMPLE_PWQUERY_H

	#ifdef SIMPLE_PWQUERY_IMPLEMENTATION /* Begin configuration stuff. */

	/* Include whatever files you need. */
	#include <gcrypt.h>
	#include "../common/logging.h"

	/* Try to write error message using the standard gnupg log mechanism. */
	#define SPWQ_USE_LOGGING 1

	/* Memory allocation functions used by the implementation. Note, that
	the returned value is expected to be freed with
	spwq_secure_free. */
	#define spwq_malloc(a) gcry_malloc (a)
	#define spwq_free(a) gcry_free (a)
	#define spwq_secure_malloc(a) gcry_malloc_secure (a)
	#define spwq_secure_free(a) gcry_free (a)

	#endif /SIMPLE_PWQUERY_IMPLEMENTATION/ /* End configuration stuff. */


	/* Ask the gpg-agent for a passphrase and present the user with a
	DESCRIPTION, a PROMPT and optiaonlly with a TRYAGAIN extra text.
	- If a CACHEID is not NULL it is used to locate the passphrase in in
	+ If a CACHEID is not NULL it is used to locate the passphrase in
	the cache and store it under this ID. If OPT_CHECK is true
	gpg-agent is asked to apply some checks on the passphrase security.
	If ERRORCODE is not NULL it should point a variable receiving an
	errorcode; this errocode might be 0 if the user canceled the
	operation. The function returns NULL to indicate an error. */
	char simple_pwquery (const char cacheid,
	const char *tryagain,
	const char *prompt,
	const char *description,
	int opt_check,
	int *errorcode);

	/* Ask the gpg-agent to clear the passphrase for the cache ID CACHEID. */
	int simple_pwclear (const char *cacheid);

	/* Perform the simple query QUERY (which must be new-line and 0
	terminated) and return the error code. */
	int simple_query (const char *query);

	/* Set the name of the standard socket to be used if GPG_AGENT_INFO is
	not defined. The use of this function is optional but if it needs
	to be called before any other function. Returns 0 on success. */
	int simple_pw_set_socket (const char *name);

	#endif /SIMPLE_PWQUERY_H/
	diff --git a/common/ttyio.c b/common/ttyio.c
	index 29af1b3ff..c7c9d85ab 100644
	--- a/common/ttyio.c
	+++ b/common/ttyio.c
	@@ -1,730 +1,730 @@
	/* ttyio.c - tty i/O functions
	* Copyright (C) 1998,1999,2000,2001,2002,2003,2004,2006,2007,
	* 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <stdarg.h>
	#include <unistd.h>

	#if defined(HAVE_W32_SYSTEM) && !defined(HAVE_W32CE_SYSTEM)
	# define USE_W32_CONSOLE 1
	#endif

	#ifdef HAVE_TCGETATTR
	#include <termios.h>
	#else
	#ifdef HAVE_TERMIO_H
	/* simulate termios with termio */
	#include <termio.h>
	#define termios termio
	#define tcsetattr ioctl
	#define TCSAFLUSH TCSETAF
	#define tcgetattr(A,B) ioctl(A,TCGETA,B)
	#define HAVE_TCGETATTR
	#endif
	#endif
	#ifdef USE_W32_CONSOLE
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h>
	# ifdef HAVE_TCGETATTR
	# error mingw32 and termios
	# endif
	#endif
	#include <errno.h>
	#include <ctype.h>

	#include "util.h"
	#include "ttyio.h"
	#include "common-defs.h"

	#define CONTROL_D ('D' - 'A' + 1)


	#ifdef USE_W32_CONSOLE
	static struct {
	HANDLE in, out;
	} con;
	#define DEF_INPMODE (ENABLE_LINE_INPUT\|ENABLE_ECHO_INPUT \
	\|ENABLE_PROCESSED_INPUT )
	#define HID_INPMODE (ENABLE_LINE_INPUT\|ENABLE_PROCESSED_INPUT )
	#define DEF_OUTMODE (ENABLE_WRAP_AT_EOL_OUTPUT\|ENABLE_PROCESSED_OUTPUT)

	#else /* yeah, we have a real OS */
	static FILE *ttyfp = NULL;
	#endif

	static int initialized;
	static int last_prompt_len;
	static int batchmode;
	static int no_terminal;

	#ifdef HAVE_TCGETATTR
	static struct termios termsave;
	static int restore_termios;
	#endif

	/* Hooks set by gpgrlhelp.c if required. */
	static void (my_rl_set_completer) (rl_completion_func_t );
	static void (*my_rl_inhibit_completion) (int);
	static void (*my_rl_cleanup_after_signal) (void);
	static void (my_rl_init_stream) (FILE );
	static char (my_rl_readline) (const char*);
	static void (my_rl_add_history) (const char);


	/* This is a wrapper around ttyname so that we can use it even when
	the standard streams are redirected. It figures the name out the
	first time and returns it in a statically allocated buffer. */
	const char *
	tty_get_ttyname (void)
	{
	static char *name;

	/* On a GNU system ctermid() always return /dev/tty, so this does
	not make much sense - however if it is ever changed we do the
	Right Thing now. */
	#ifdef HAVE_CTERMID
	static int got_name;

	if (!got_name)
	{
	const char *s;
	/* Note that despite our checks for these macros the function is
	not necessarily thread save. We mainly do this for
	portability reasons, in case L_ctermid is not defined. */
	# if defined(_POSIX_THREAD_SAFE_FUNCTIONS) \|\| defined(_POSIX_TRHEADS)
	char buffer[L_ctermid];
	s = ctermid (buffer);
	# else
	s = ctermid (NULL);
	# endif
	if (s)
	name = strdup (s);
	got_name = 1;
	}
	#endif /HAVE_CTERMID/
	/* Assume the standard tty on memory error or when there is no
	ctermid. */
	return name? name : "/dev/tty";
	}



	#ifdef HAVE_TCGETATTR
	static void
	cleanup(void)
	{
	if( restore_termios ) {
	restore_termios = 0; /* do it prios in case it is interrupted again */
	if( tcsetattr(fileno(ttyfp), TCSAFLUSH, &termsave) )
	log_error("tcsetattr() failed: %s\n", strerror(errno) );
	}
	}
	#endif

	static void
	init_ttyfp(void)
	{
	if( initialized )
	return;

	#if defined(USE_W32_CONSOLE)
	{
	SECURITY_ATTRIBUTES sa;

	memset(&sa, 0, sizeof(sa));
	sa.nLength = sizeof(sa);
	sa.bInheritHandle = TRUE;
	con.out = CreateFileA( "CONOUT$", GENERIC_READ\|GENERIC_WRITE,
	FILE_SHARE_READ\|FILE_SHARE_WRITE,
	&sa, OPEN_EXISTING, 0, 0 );
	if( con.out == INVALID_HANDLE_VALUE )
	log_fatal("open(CONOUT$) failed: rc=%d", (int)GetLastError() );
	memset(&sa, 0, sizeof(sa));
	sa.nLength = sizeof(sa);
	sa.bInheritHandle = TRUE;
	con.in = CreateFileA( "CONIN$", GENERIC_READ\|GENERIC_WRITE,
	FILE_SHARE_READ\|FILE_SHARE_WRITE,
	&sa, OPEN_EXISTING, 0, 0 );
	if( con.in == INVALID_HANDLE_VALUE )
	log_fatal("open(CONIN$) failed: rc=%d", (int)GetLastError() );
	}
	SetConsoleMode(con.in, DEF_INPMODE );
	SetConsoleMode(con.out, DEF_OUTMODE );

	#elif defined(__EMX__)
	ttyfp = stdout; /* Fixme: replace by the real functions: see wklib */
	if (my_rl_init_stream)
	my_rl_init_stream (ttyfp);
	#elif defined (HAVE_W32CE_SYSTEM)
	ttyfp = stderr;
	#else
	ttyfp = batchmode? stderr : fopen (tty_get_ttyname (), "r+");
	if( !ttyfp ) {
	log_error("cannot open '%s': %s\n", tty_get_ttyname (),
	strerror(errno) );
	exit(2);
	}
	if (my_rl_init_stream)
	my_rl_init_stream (ttyfp);
	#endif


	#ifdef HAVE_TCGETATTR
	atexit( cleanup );
	#endif
	initialized = 1;
	}


	int
	tty_batchmode( int onoff )
	{
	int old = batchmode;
	if( onoff != -1 )
	batchmode = onoff;
	return old;
	}

	int
	tty_no_terminal(int onoff)
	{
	int old = no_terminal;
	no_terminal = onoff ? 1 : 0;
	return old;
	}

	void
	tty_printf( const char *fmt, ... )
	{
	va_list arg_ptr;

	if (no_terminal)
	return;

	if( !initialized )
	init_ttyfp();

	va_start( arg_ptr, fmt ) ;
	#ifdef USE_W32_CONSOLE
	{
	char *buf = NULL;
	int n;
	DWORD nwritten;

	n = vasprintf(&buf, fmt, arg_ptr);
	if( !buf )
	log_bug("vasprintf() failed\n");

	if( !WriteConsoleA( con.out, buf, n, &nwritten, NULL ) )
	log_fatal("WriteConsole failed: rc=%d", (int)GetLastError() );
	if( n != nwritten )
	log_fatal("WriteConsole failed: %d != %d\n", n, (int)nwritten );
	last_prompt_len += n;
	xfree (buf);
	}
	#else
	last_prompt_len += vfprintf(ttyfp,fmt,arg_ptr) ;
	fflush(ttyfp);
	#endif
	va_end(arg_ptr);
	}


	/* Same as tty_printf but if FP is not NULL, behave like a regular
	fprintf. */
	void
	tty_fprintf (estream_t fp, const char *fmt, ... )
	{
	va_list arg_ptr;

	if (fp)
	{
	va_start (arg_ptr, fmt) ;
	es_vfprintf (fp, fmt, arg_ptr );
	va_end (arg_ptr);
	return;
	}

	if (no_terminal)
	return;

	if (!initialized)
	init_ttyfp ();

	va_start (arg_ptr, fmt);
	#ifdef USE_W32_CONSOLE
	{
	char *buf = NULL;
	int n;
	DWORD nwritten;

	n = vasprintf(&buf, fmt, arg_ptr);
	if (!buf)
	log_bug("vasprintf() failed\n");

	if (!WriteConsoleA( con.out, buf, n, &nwritten, NULL ))
	log_fatal("WriteConsole failed: rc=%d", (int)GetLastError() );
	if (n != nwritten)
	log_fatal("WriteConsole failed: %d != %d\n", n, (int)nwritten );
	last_prompt_len += n;
	xfree (buf);
	}
	#else
	last_prompt_len += vfprintf(ttyfp,fmt,arg_ptr) ;
	fflush(ttyfp);
	#endif
	va_end(arg_ptr);
	}


	/* Print a string, but filter all control characters out. If FP is
	* not NULL print to that stream instead to the tty. */
	static void
	do_print_string (estream_t fp, const byte *p, size_t n )
	{
	if (no_terminal && !fp)
	return;

	if (!initialized && !fp)
	init_ttyfp();

	if (fp)
	{
	print_utf8_buffer (fp, p, n);
	return;
	}

	#ifdef USE_W32_CONSOLE
	/* Not so effective, change it if you want */
	for (; n; n--, p++)
	{
	if (iscntrl (*p))
	{
	if( *p == '\n' )
	tty_printf ("\\n");
	else if( !*p )
	tty_printf ("\\0");
	else
	tty_printf ("\\x%02x", *p);
	}
	else
	tty_printf ("%c", *p);
	}
	#else
	for (; n; n--, p++)
	{
	if (iscntrl (*p))
	{
	putc ('\\', ttyfp);
	if ( *p == '\n' )
	putc ('n', ttyfp);
	else if ( !*p )
	putc ('0', ttyfp);
	else
	fprintf (ttyfp, "x%02x", *p );
	}
	else
	putc (*p, ttyfp);
	}
	#endif
	}


	void
	tty_print_utf8_string2 (estream_t fp, const byte *p, size_t n, size_t max_n)
	{
	size_t i;
	char *buf;

	if (no_terminal && !fp)
	return;

	/* we can handle plain ascii simpler, so check for it first */
	for(i=0; i < n; i++ ) {
	if( p[i] & 0x80 )
	break;
	}
	if( i < n ) {
	buf = utf8_to_native( (const char *)p, n, 0 );
	if( max_n && (strlen( buf ) > max_n )) {
	buf[max_n] = 0;
	}
	/(utf8 conversion already does the control character quoting)/
	tty_fprintf (fp, "%s", buf);
	xfree (buf);
	}
	else {
	if( max_n && (n > max_n) ) {
	n = max_n;
	}
	do_print_string (fp, p, n );
	}
	}


	void
	tty_print_utf8_string( const byte *p, size_t n )
	{
	tty_print_utf8_string2 (NULL, p, n, 0);
	}


	static char *
	do_get( const char *prompt, int hidden )
	{
	char *buf;
	#ifndef __riscos__
	byte cbuf[1];
	#endif
	int c, n, i;

	if( batchmode ) {
	log_error("Sorry, we are in batchmode - can't get input\n");
	exit(2);
	}

	if (no_terminal) {
	log_error("Sorry, no terminal at all requested - can't get input\n");
	exit(2);
	}

	if( !initialized )
	init_ttyfp();

	last_prompt_len = 0;
	tty_printf( "%s", prompt );
	buf = xmalloc((n=50));
	i = 0;

	#ifdef USE_W32_CONSOLE
	if( hidden )
	SetConsoleMode(con.in, HID_INPMODE );

	for(;;) {
	DWORD nread;

	if( !ReadConsoleA( con.in, cbuf, 1, &nread, NULL ) )
	log_fatal("ReadConsole failed: rc=%d", (int)GetLastError() );
	if( !nread )
	continue;
	if( *cbuf == '\n' )
	break;

	if( !hidden )
	last_prompt_len++;
	c = *cbuf;
	if( c == '\t' )
	c = ' ';
	else if( c > 0xa0 )
	; /* we don't allow 0xa0, as this is a protected blank which may
	* confuse the user */
	else if( iscntrl(c) )
	continue;
	if( !(i < n-1) ) {
	n += 50;
	buf = xrealloc (buf, n);
	}
	buf[i++] = c;
	}

	if( hidden )
	SetConsoleMode(con.in, DEF_INPMODE );

	#elif defined(__riscos__) \|\| defined(HAVE_W32CE_SYSTEM)
	do {
	#ifdef HAVE_W32CE_SYSTEM
	/* Using getchar is not a correct solution but for now it
	doesn't matter because we have no real console at all. We
	should rework this as soon as we have switched this entire
	module to estream. */
	c = getchar();
	#else
	c = riscos_getchar();
	#endif
	if (c == 0xa \|\| c == 0xd) { /* Return \|\| Enter */
	c = (int) '\n';
	} else if (c == 0x8 \|\| c == 0x7f) { /* Backspace \|\| Delete */
	if (i>0) {
	i--;
	if (!hidden) {
	last_prompt_len--;
	fputc(8, ttyfp);
	fputc(32, ttyfp);
	fputc(8, ttyfp);
	fflush(ttyfp);
	}
	} else {
	fputc(7, ttyfp);
	fflush(ttyfp);
	}
	continue;
	} else if (c == (int) '\t') { /* Tab */
	c = ' ';
	} else if (c > 0xa0) {
	; /* we don't allow 0xa0, as this is a protected blank which may
	* confuse the user */
	} else if (iscntrl(c)) {
	continue;
	}
	if(!(i < n-1)) {
	n += 50;
	buf = xrealloc (buf, n);
	}
	buf[i++] = c;
	if (!hidden) {
	last_prompt_len++;
	fputc(c, ttyfp);
	fflush(ttyfp);
	}
	} while (c != '\n');
	i = (i>0) ? i-1 : 0;
	#else /* Other systems. */
	if( hidden ) {
	#ifdef HAVE_TCGETATTR
	struct termios term;

	if( tcgetattr(fileno(ttyfp), &termsave) )
	log_fatal("tcgetattr() failed: %s\n", strerror(errno) );
	restore_termios = 1;
	term = termsave;
	term.c_lflag &= ~(ECHO \| ECHOE \| ECHOK \| ECHONL);
	if( tcsetattr( fileno(ttyfp), TCSAFLUSH, &term ) )
	log_fatal("tcsetattr() failed: %s\n", strerror(errno) );
	#endif
	}

	/* fixme: How can we avoid that the \n is echoed w/o disabling
	* canonical mode - w/o this kill_prompt can't work */
	while( read(fileno(ttyfp), cbuf, 1) == 1 && *cbuf != '\n' ) {
	if( !hidden )
	last_prompt_len++;
	c = *cbuf;
	if( c == CONTROL_D )
	log_info("control d found\n");
	if( c == '\t' )
	c = ' ';
	else if( c > 0xa0 )
	; /* we don't allow 0xa0, as this is a protected blank which may
	* confuse the user */
	else if( iscntrl(c) )
	continue;
	if( !(i < n-1) ) {
	n += 50;
	buf = xrealloc (buf, n );
	}
	buf[i++] = c;
	}
	if( *cbuf != '\n' ) {
	buf[0] = CONTROL_D;
	i = 1;
	}

	if( hidden ) {
	#ifdef HAVE_TCGETATTR
	if( tcsetattr(fileno(ttyfp), TCSAFLUSH, &termsave) )
	log_error("tcsetattr() failed: %s\n", strerror(errno) );
	restore_termios = 0;
	#endif
	}
	#endif /* end unix version */
	buf[i] = 0;
	return buf;
	}


	char *
	tty_get( const char *prompt )
	{
	if (!batchmode && !no_terminal && my_rl_readline && my_rl_add_history)
	{
	char *line;
	char *buf;

	if (!initialized)
	init_ttyfp();

	last_prompt_len = 0;

	line = my_rl_readline (prompt?prompt:"");

	/* We need to copy it to memory controlled by our malloc
	implementations; further we need to convert an EOF to our
	convention. */
	buf = xmalloc(line? strlen(line)+1:2);
	if (line)
	{
	strcpy (buf, line);
	trim_spaces (buf);
	if (strlen (buf) > 2 )
	my_rl_add_history (line); /* Note that we test BUF but add LINE. */
	free (line);
	}
	else
	{
	buf[0] = CONTROL_D;
	buf[1] = 0;
	}
	return buf;
	}
	else
	return do_get ( prompt, 0 );
	}

	-/* Variable argument version of tty_get. The prompt is is actually a
	+/* Variable argument version of tty_get. The prompt is actually a
	format string with arguments. */
	char *
	tty_getf (const char *promptfmt, ... )
	{
	va_list arg_ptr;
	char *prompt;
	char *answer;

	va_start (arg_ptr, promptfmt);
	if (gpgrt_vasprintf (&prompt, promptfmt, arg_ptr) < 0)
	log_fatal ("estream_vasprintf failed: %s\n", strerror (errno));
	va_end (arg_ptr);
	answer = tty_get (prompt);
	xfree (prompt);
	return answer;
	}



	char *
	tty_get_hidden( const char *prompt )
	{
	return do_get( prompt, 1 );
	}


	void
	tty_kill_prompt()
	{
	if ( no_terminal )
	return;

	if( !initialized )
	init_ttyfp();

	if( batchmode )
	last_prompt_len = 0;
	if( !last_prompt_len )
	return;
	#ifdef USE_W32_CONSOLE
	tty_printf("\r%*s\r", last_prompt_len, "");
	#else
	{
	int i;
	putc('\r', ttyfp);
	for(i=0; i < last_prompt_len; i ++ )
	putc(' ', ttyfp);
	putc('\r', ttyfp);
	fflush(ttyfp);
	}
	#endif
	last_prompt_len = 0;
	}


	int
	tty_get_answer_is_yes( const char *prompt )
	{
	int yes;
	char *p = tty_get( prompt );
	tty_kill_prompt();
	yes = answer_is_yes(p);
	xfree(p);
	return yes;
	}


	/* Called by gnupg_rl_initialize to setup the readline support. */
	void
	tty_private_set_rl_hooks (void (init_stream) (FILE ),
	void (set_completer) (rl_completion_func_t),
	void (*inhibit_completion) (int),
	void (*cleanup_after_signal) (void),
	char (readline_fun) (const char*),
	void (add_history_fun) (const char))
	{
	my_rl_init_stream = init_stream;
	my_rl_set_completer = set_completer;
	my_rl_inhibit_completion = inhibit_completion;
	my_rl_cleanup_after_signal = cleanup_after_signal;
	my_rl_readline = readline_fun;
	my_rl_add_history = add_history_fun;
	}


	#ifdef HAVE_LIBREADLINE
	void
	tty_enable_completion (rl_completion_func_t *completer)
	{
	if (no_terminal \|\| !my_rl_set_completer )
	return;

	if (!initialized)
	init_ttyfp();

	my_rl_set_completer (completer);
	}

	void
	tty_disable_completion (void)
	{
	if (no_terminal \|\| !my_rl_inhibit_completion)
	return;

	if (!initialized)
	init_ttyfp();

	my_rl_inhibit_completion (1);
	}
	#endif

	void
	tty_cleanup_after_signal (void)
	{
	#ifdef HAVE_TCGETATTR
	cleanup ();
	#endif
	}

	void
	tty_cleanup_rl_after_signal (void)
	{
	if (my_rl_cleanup_after_signal)
	my_rl_cleanup_after_signal ();
	}
	diff --git a/common/utf8conv.c b/common/utf8conv.c
	index bce9e3ac6..d26eff005 100644
	--- a/common/utf8conv.c
	+++ b/common/utf8conv.c
	@@ -1,838 +1,838 @@
	/* utf8conf.c - UTF8 character set conversion
	* Copyright (C) 1994, 1998, 1999, 2000, 2001, 2003, 2006,
	* 2008, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify it
	* under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* GnuPG is distributed in the hope that it will be useful, but
	* WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
	* General Public License for more details.
	*
	* You should have received a copies of the GNU General Public License
	* and the GNU Lesser General Public License along with this program;
	* if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdlib.h>
	#include <string.h>
	#include <stdarg.h>
	#include <ctype.h>
	#ifdef HAVE_LANGINFO_CODESET
	#include <langinfo.h>
	#endif
	#include <errno.h>

	#if HAVE_W32_SYSTEM
	# /* Tell libgpg-error to provide the iconv macros. */
	# define GPGRT_ENABLE_W32_ICONV_MACROS 1
	#elif HAVE_ANDROID_SYSTEM
	# /* No iconv support. */
	#else
	# include <iconv.h>
	#endif


	#include "util.h"
	#include "common-defs.h"
	#include "i18n.h"
	#include "stringhelp.h"
	#include "utf8conv.h"

	#ifndef MB_LEN_MAX
	#define MB_LEN_MAX 16
	#endif

	static const char *active_charset_name = "iso-8859-1";
	static int no_translation; /* Set to true if we let simply pass through. */
	static int use_iconv; /* iconv conversion functions required. */


	#ifdef HAVE_ANDROID_SYSTEM
	/* Fake stuff to get things building. */
	typedef void *iconv_t;
	#define ICONV_CONST

	static iconv_t
	iconv_open (const char tocode, const char fromcode)
	{
	(void)tocode;
	(void)fromcode;
	return (iconv_t)(-1);
	}

	static size_t
	iconv (iconv_t cd, char *inbuf, size_t inbytesleft,
	char *outbuf, size_t outbytesleft)
	{
	(void)cd;
	(void)inbuf;
	(void)inbytesleft;
	(void)outbuf;
	(void)outbytesleft;
	return (size_t)(0);
	}

	static int
	iconv_close (iconv_t cd)
	{
	(void)cd;
	return 0;
	}
	#endif /HAVE_ANDROID_SYSTEM/


	/* Error handler for iconv failures. This is needed to not clutter the
	output with repeated diagnostics about a missing conversion. */
	static void
	handle_iconv_error (const char to, const char from, int use_fallback)
	{
	if (errno == EINVAL)
	{
	static int shown1, shown2;
	int x;

	if (to && !strcmp (to, "utf-8"))
	{
	x = shown1;
	shown1 = 1;
	}
	else
	{
	x = shown2;
	shown2 = 1;
	}

	if (!x)
	log_info (_("conversion from '%s' to '%s' not available\n"),
	from, to);
	}
	else
	{
	static int shown;

	if (!shown)
	log_info (_("iconv_open failed: %s\n"), strerror (errno));
	shown = 1;
	}

	if (use_fallback)
	{
	/* To avoid further error messages we fallback to UTF-8 for the
	native encoding. Nowadays this seems to be the best bet in
	case of errors from iconv or nl_langinfo. */
	active_charset_name = "utf-8";
	no_translation = 0;
	use_iconv = 0;
	}
	}



	int
	set_native_charset (const char *newset)
	{
	const char *full_newset;

	if (!newset)
	{
	#ifdef HAVE_ANDROID_SYSTEM
	newset = "utf-8";
	#elif defined HAVE_W32_SYSTEM
	static char codepage[30];
	unsigned int cpno;
	const char *aliases;

	/* We are a console program thus we need to use the
	- GetConsoleOutputCP function and not the the GetACP which
	+ GetConsoleOutputCP function and not the GetACP which
	would give the codepage for a GUI program. Note this is not
	a bulletproof detection because GetConsoleCP might return a
	different one for console input. Not sure how to cope with
	that. If the console Code page is not known we fall back to
	the system code page. */
	#ifndef HAVE_W32CE_SYSTEM
	cpno = GetConsoleOutputCP ();
	if (!cpno)
	#endif
	cpno = GetACP ();
	sprintf (codepage, "CP%u", cpno );
	/* Resolve alias. We use a long string string and not the usual
	array to optimize if the code is taken to a DSO. Taken from
	libiconv 1.9.2. */
	newset = codepage;
	for (aliases = ("CP936" "\0" "GBK" "\0"
	"CP1361" "\0" "JOHAB" "\0"
	"CP20127" "\0" "ASCII" "\0"
	"CP20866" "\0" "KOI8-R" "\0"
	"CP21866" "\0" "KOI8-RU" "\0"
	"CP28591" "\0" "ISO-8859-1" "\0"
	"CP28592" "\0" "ISO-8859-2" "\0"
	"CP28593" "\0" "ISO-8859-3" "\0"
	"CP28594" "\0" "ISO-8859-4" "\0"
	"CP28595" "\0" "ISO-8859-5" "\0"
	"CP28596" "\0" "ISO-8859-6" "\0"
	"CP28597" "\0" "ISO-8859-7" "\0"
	"CP28598" "\0" "ISO-8859-8" "\0"
	"CP28599" "\0" "ISO-8859-9" "\0"
	"CP28605" "\0" "ISO-8859-15" "\0"
	"CP65001" "\0" "UTF-8" "\0");
	*aliases;
	aliases += strlen (aliases) + 1, aliases += strlen (aliases) + 1)
	{
	if (!strcmp (codepage, aliases) \|\|(aliases == '' && !aliases[1]))
	{
	newset = aliases + strlen (aliases) + 1;
	break;
	}
	}

	#else /!HAVE_W32_SYSTEM && !HAVE_ANDROID_SYSTEM/

	#ifdef HAVE_LANGINFO_CODESET
	newset = nl_langinfo (CODESET);
	#else /!HAVE_LANGINFO_CODESET/
	/* Try to get the used charset from environment variables. */
	static char codepage[30];
	const char lc, dot, *mod;

	strcpy (codepage, "iso-8859-1");
	lc = getenv ("LC_ALL");
	if (!lc \|\| !*lc)
	{
	lc = getenv ("LC_CTYPE");
	if (!lc \|\| !*lc)
	lc = getenv ("LANG");
	}
	if (lc && *lc)
	{
	dot = strchr (lc, '.');
	if (dot)
	{
	mod = strchr (++dot, '@');
	if (!mod)
	mod = dot + strlen (dot);
	if (mod - dot < sizeof codepage && dot != mod)
	{
	memcpy (codepage, dot, mod - dot);
	codepage [mod - dot] = 0;
	}
	}
	}
	newset = codepage;
	#endif /!HAVE_LANGINFO_CODESET/
	#endif /!HAVE_W32_SYSTEM && !HAVE_ANDROID_SYSTEM/
	}

	full_newset = newset;
	if (strlen (newset) > 3 && !ascii_memcasecmp (newset, "iso", 3))
	{
	newset += 3;
	if (newset == '-' \|\| newset == '_')
	newset++;
	}

	/* Note that we silently assume that plain ASCII is actually meant
	as Latin-1. This makes sense because many Unix system don't have
	their locale set up properly and thus would get annoying error
	messages and we have to handle all the "bug" reports. Latin-1 has
	traditionally been the character set used for 8 bit characters on
	Unix systems. */
	if ( !*newset
	\|\| !ascii_strcasecmp (newset, "8859-1" )
	\|\| !ascii_strcasecmp (newset, "646" )
	\|\| !ascii_strcasecmp (newset, "ASCII" )
	\|\| !ascii_strcasecmp (newset, "ANSI_X3.4-1968" )
	)
	{
	active_charset_name = "iso-8859-1";
	no_translation = 0;
	use_iconv = 0;
	}
	else if ( !ascii_strcasecmp (newset, "utf8" )
	\|\| !ascii_strcasecmp(newset, "utf-8") )
	{
	active_charset_name = "utf-8";
	no_translation = 1;
	use_iconv = 0;
	}
	else
	{
	iconv_t cd;

	cd = iconv_open (full_newset, "utf-8");
	if (cd == (iconv_t)-1)
	{
	handle_iconv_error (full_newset, "utf-8", 0);
	return -1;
	}
	iconv_close (cd);
	cd = iconv_open ("utf-8", full_newset);
	if (cd == (iconv_t)-1)
	{
	handle_iconv_error ("utf-8", full_newset, 0);
	return -1;
	}
	iconv_close (cd);
	active_charset_name = full_newset;
	no_translation = 0;
	use_iconv = 1;
	}
	return 0;
	}

	const char *
	get_native_charset ()
	{
	return active_charset_name;
	}

	/* Return true if the native charset is utf-8. */
	int
	is_native_utf8 (void)
	{
	return no_translation;
	}


	/* Convert string, which is in native encoding to UTF8 and return a
	new allocated UTF-8 string. This function terminates the process
	on memory shortage. */
	char *
	native_to_utf8 (const char *orig_string)
	{
	const unsigned char string = (const unsigned char )orig_string;
	const unsigned char *s;
	char *buffer;
	unsigned char *p;
	size_t length = 0;

	if (no_translation)
	{
	/* Already utf-8 encoded. */
	buffer = xstrdup (orig_string);
	}
	else if (!use_iconv)
	{
	/* For Latin-1 we can avoid the iconv overhead. */
	for (s = string; *s; s++)
	{
	length++;
	if (*s & 0x80)
	length++;
	}
	buffer = xmalloc (length + 1);
	for (p = (unsigned char )buffer, s = string; s; s++)
	{
	if ( (*s & 0x80 ))
	{
	p++ = 0xc0 \| ((s >> 6) & 3);
	p++ = 0x80 \| (s & 0x3f);
	}
	else
	p++ = s;
	}
	*p = 0;
	}
	else
	{
	/* Need to use iconv. */
	iconv_t cd;
	const char *inptr;
	char *outptr;
	size_t inbytes, outbytes;

	cd = iconv_open ("utf-8", active_charset_name);
	if (cd == (iconv_t)-1)
	{
	handle_iconv_error ("utf-8", active_charset_name, 1);
	return native_to_utf8 (string);
	}

	for (s=string; *s; s++ )
	{
	length++;
	if ((*s & 0x80))
	length += 5; /* We may need up to 6 bytes for the utf8 output. */
	}
	buffer = xmalloc (length + 1);

	inptr = string;
	inbytes = strlen (string);
	outptr = buffer;
	outbytes = length;
	if ( iconv (cd, (ICONV_CONST char **)&inptr, &inbytes,
	&outptr, &outbytes) == (size_t)-1)
	{
	static int shown;

	if (!shown)
	log_info (_("conversion from '%s' to '%s' failed: %s\n"),
	active_charset_name, "utf-8", strerror (errno));
	shown = 1;
	/* We don't do any conversion at all but use the strings as is. */
	strcpy (buffer, string);
	}
	else /* Success. */
	{
	*outptr = 0;
	/* We could realloc the buffer now but I doubt that it makes
	much sense given that it will get freed anyway soon
	after. */
	}
	iconv_close (cd);
	}
	return buffer;
	}



	static char *
	do_utf8_to_native (const char *string, size_t length, int delim,
	int with_iconv)
	{
	int nleft;
	int i;
	unsigned char encbuf[8];
	int encidx;
	const unsigned char *s;
	size_t n;
	char *buffer = NULL;
	char *p = NULL;
	unsigned long val = 0;
	size_t slen;
	int resync = 0;

	/* First pass (p==NULL): count the extended utf-8 characters. */
	/* Second pass (p!=NULL): create string. */
	for (;;)
	{
	for (slen = length, nleft = encidx = 0, n = 0,
	s = (const unsigned char *)string;
	slen;
	s++, slen--)
	{
	if (resync)
	{
	if (!(s < 128 \|\| (s >= 0xc0 && *s <= 0xfd)))
	{
	/* Still invalid. */
	if (p)
	{
	sprintf (p, "\\x%02x", *s);
	p += 4;
	}
	n += 4;
	continue;
	}
	resync = 0;
	}
	if (!nleft)
	{
	if (!(*s & 0x80))
	{
	/* Plain ascii. */
	if ( delim != -1
	&& (s < 0x20 \|\| s == 0x7f \|\| *s == delim
	\|\| (delim && *s == '\\')))
	{
	n++;
	if (p)
	*p++ = '\\';
	switch (*s)
	{
	case '\n': n++; if ( p ) *p++ = 'n'; break;
	case '\r': n++; if ( p ) *p++ = 'r'; break;
	case '\f': n++; if ( p ) *p++ = 'f'; break;
	case '\v': n++; if ( p ) *p++ = 'v'; break;
	case '\b': n++; if ( p ) *p++ = 'b'; break;
	case 0: n++; if ( p ) *p++ = '0'; break;
	default:
	n += 3;
	if (p)
	{
	sprintf (p, "x%02x", *s);
	p += 3;
	}
	break;
	}
	}
	else
	{
	if (p)
	p++ = s;
	n++;
	}
	}
	else if ((s & 0xe0) == 0xc0) / 110x xxxx */
	{
	val = *s & 0x1f;
	nleft = 1;
	encidx = 0;
	encbuf[encidx++] = *s;
	}
	else if ((s & 0xf0) == 0xe0) / 1110 xxxx */
	{
	val = *s & 0x0f;
	nleft = 2;
	encidx = 0;
	encbuf[encidx++] = *s;
	}
	else if ((s & 0xf8) == 0xf0) / 1111 0xxx */
	{
	val = *s & 0x07;
	nleft = 3;
	encidx = 0;
	encbuf[encidx++] = *s;
	}
	else if ((s & 0xfc) == 0xf8) / 1111 10xx */
	{
	val = *s & 0x03;
	nleft = 4;
	encidx = 0;
	encbuf[encidx++] = *s;
	}
	else if ((s & 0xfe) == 0xfc) / 1111 110x */
	{
	val = *s & 0x01;
	nleft = 5;
	encidx = 0;
	encbuf[encidx++] = *s;
	}
	else /* Invalid encoding: print as \xNN. */
	{
	if (p)
	{
	sprintf (p, "\\x%02x", *s);
	p += 4;
	}
	n += 4;
	resync = 1;
	}
	}
	else if (s < 0x80 \|\| s >= 0xc0) /* Invalid utf-8 */
	{
	if (p)
	{
	for (i = 0; i < encidx; i++)
	{
	sprintf (p, "\\x%02x", encbuf[i]);
	p += 4;
	}
	sprintf (p, "\\x%02x", *s);
	p += 4;
	}
	n += 4 + 4 * encidx;
	nleft = 0;
	encidx = 0;
	resync = 1;
	}
	else
	{
	encbuf[encidx++] = *s;
	val <<= 6;
	val \|= *s & 0x3f;
	if (!--nleft) /* Ready. */
	{
	if (no_translation)
	{
	if (p)
	{
	for (i = 0; i < encidx; i++)
	*p++ = encbuf[i];
	}
	n += encidx;
	encidx = 0;
	}
	else if (with_iconv)
	{
	/* Our strategy for using iconv is a bit strange
	but it better keeps compatibility with
	previous versions in regard to how invalid
	encodings are displayed. What we do is to
	keep the utf-8 as is and have the real
	translation step then at the end. Yes, I
	know that this is ugly. However we are short
	of the 1.4 release and for this branch we
	should not mess too much around with iconv
	things. One reason for this is that we don't
	know enough about non-GNU iconv
	implementation and want to minimize the risk
	of breaking the code on too many platforms. */
	if ( p )
	{
	for (i=0; i < encidx; i++ )
	*p++ = encbuf[i];
	}
	n += encidx;
	encidx = 0;
	}
	else /* Latin-1 case. */
	{
	if (val >= 0x80 && val < 256)
	{
	/* We can simply print this character */
	n++;
	if (p)
	*p++ = val;
	}
	else
	{
	/* We do not have a translation: print utf8. */
	if (p)
	{
	for (i = 0; i < encidx; i++)
	{
	sprintf (p, "\\x%02x", encbuf[i]);
	p += 4;
	}
	}
	n += encidx * 4;
	encidx = 0;
	}
	}
	}

	}
	}
	if (!buffer)
	{
	/* Allocate the buffer after the first pass. */
	buffer = p = xmalloc (n + 1);
	}
	else if (with_iconv)
	{
	/* Note: See above for comments. */
	iconv_t cd;
	const char *inptr;
	char outbuf, outptr;
	size_t inbytes, outbytes;

	p = 0; / Terminate the buffer. */

	cd = iconv_open (active_charset_name, "utf-8");
	if (cd == (iconv_t)-1)
	{
	handle_iconv_error (active_charset_name, "utf-8", 1);
	xfree (buffer);
	return utf8_to_native (string, length, delim);
	}

	/* Allocate a new buffer large enough to hold all possible
	encodings. */
	n = p - buffer + 1;
	inbytes = n - 1;;
	inptr = buffer;
	outbytes = n * MB_LEN_MAX;
	if (outbytes / MB_LEN_MAX != n)
	BUG (); /* Actually an overflow. */
	outbuf = outptr = xmalloc (outbytes);
	if ( iconv (cd, (ICONV_CONST char **)&inptr, &inbytes,
	&outptr, &outbytes) == (size_t)-1)
	{
	static int shown;

	if (!shown)
	log_info (_("conversion from '%s' to '%s' failed: %s\n"),
	"utf-8", active_charset_name, strerror (errno));
	shown = 1;
	/* Didn't worked out. Try again but without iconv. */
	xfree (buffer);
	buffer = NULL;
	xfree (outbuf);
	outbuf = do_utf8_to_native (string, length, delim, 0);
	}
	else /* Success. */
	{
	outptr = 0; / Make sure it is a string. */
	/* We could realloc the buffer now but I doubt that it
	makes much sense given that it will get freed
	anyway soon after. */
	xfree (buffer);
	}
	iconv_close (cd);
	return outbuf;
	}
	else /* Not using iconv. */
	{
	p = 0; / Make sure it is a string. */
	return buffer;
	}
	}
	}

	/* Convert string, which is in UTF-8 to native encoding. Replace
	illegal encodings by some "\xnn" and quote all control
	characters. A character with value DELIM will always be quoted, it
	must be a vanilla ASCII character. A DELIM value of -1 is special:
	it disables all quoting of control characters. This function
	terminates the process on memory shortage. */
	char *
	utf8_to_native (const char *string, size_t length, int delim)
	{
	return do_utf8_to_native (string, length, delim, use_iconv);
	}




	/* Wrapper function for iconv_open, required for W32 as we dlopen that
	library on that system. */
	jnlib_iconv_t
	jnlib_iconv_open (const char tocode, const char fromcode)
	{
	return (jnlib_iconv_t)iconv_open (tocode, fromcode);
	}


	/* Wrapper function for iconv, required for W32 as we dlopen that
	library on that system. */
	size_t
	jnlib_iconv (jnlib_iconv_t cd,
	const char *inbuf, size_t inbytesleft,
	char *outbuf, size_t outbytesleft)
	{
	return iconv ((iconv_t)cd, (ICONV_CONST char**)inbuf, inbytesleft,
	outbuf, outbytesleft);
	}

	/* Wrapper function for iconv_close, required for W32 as we dlopen that
	library on that system. */
	int
	jnlib_iconv_close (jnlib_iconv_t cd)
	{
	return iconv_close ((iconv_t)cd);
	}


	#ifdef HAVE_W32_SYSTEM
	/* Return a malloced string encoded for CODEPAGE from the wide char input
	string STRING. Caller must free this value. Returns NULL and sets
	ERRNO on failure. Calling this function with STRING set to NULL is
	not defined. */
	static char *
	wchar_to_cp (const wchar_t *string, unsigned int codepage)
	{
	int n;
	char *result;

	n = WideCharToMultiByte (codepage, 0, string, -1, NULL, 0, NULL, NULL);
	if (n < 0)
	{
	gpg_err_set_errno (EINVAL);
	return NULL;
	}

	result = xtrymalloc (n+1);
	if (!result)
	return NULL;

	n = WideCharToMultiByte (codepage, 0, string, -1, result, n, NULL, NULL);
	if (n < 0)
	{
	xfree (result);
	gpg_err_set_errno (EINVAL);
	result = NULL;
	}
	return result;
	}


	/* Return a malloced wide char string from a CODEPAGE encoded input
	string STRING. Caller must free this value. Returns NULL and sets
	ERRNO on failure. Calling this function with STRING set to NULL is
	not defined. */
	static wchar_t *
	cp_to_wchar (const char *string, unsigned int codepage)
	{
	int n;
	size_t nbytes;
	wchar_t *result;

	n = MultiByteToWideChar (codepage, 0, string, -1, NULL, 0);
	if (n < 0)
	{
	gpg_err_set_errno (EINVAL);
	return NULL;
	}

	nbytes = (size_t)(n+1) * sizeof(*result);
	if (nbytes / sizeof(*result) != (n+1))
	{
	gpg_err_set_errno (ENOMEM);
	return NULL;
	}
	result = xtrymalloc (nbytes);
	if (!result)
	return NULL;

	n = MultiByteToWideChar (codepage, 0, string, -1, result, n);
	if (n < 0)
	{
	xfree (result);
	gpg_err_set_errno (EINVAL);
	result = NULL;
	}
	return result;
	}


	/* Return a malloced string encoded in the active code page from the
	* wide char input string STRING. Caller must free this value.
	* Returns NULL and sets ERRNO on failure. Calling this function with
	* STRING set to NULL is not defined. */
	char *
	wchar_to_native (const wchar_t *string)
	{
	return wchar_to_cp (string, CP_ACP);
	}


	/* Return a malloced wide char string from an UTF-8 encoded input
	* string STRING. Caller must free this value. Returns NULL and sets
	* ERRNO on failure. Calling this function with STRING set to NULL is
	* not defined. */
	wchar_t *
	native_to_wchar (const char *string)
	{
	return cp_to_wchar (string, CP_ACP);
	}


	/* Return a malloced string encoded in UTF-8 from the wide char input
	* string STRING. Caller must free this value. Returns NULL and sets
	* ERRNO on failure. Calling this function with STRING set to NULL is
	* not defined. */
	char *
	wchar_to_utf8 (const wchar_t *string)
	{
	return wchar_to_cp (string, CP_UTF8);
	}


	/* Return a malloced wide char string from an UTF-8 encoded input
	* string STRING. Caller must free this value. Returns NULL and sets
	* ERRNO on failure. Calling this function with STRING set to NULL is
	* not defined. */
	wchar_t *
	utf8_to_wchar (const char *string)
	{
	return cp_to_wchar (string, CP_UTF8);
	}

	#endif /HAVE_W32_SYSTEM/
	diff --git a/common/yesno.c b/common/yesno.c
	index 58de63ddf..ebe8d8257 100644
	--- a/common/yesno.c
	+++ b/common/yesno.c
	@@ -1,150 +1,150 @@
	/* yesno.c - Yes/No questions
	* Copyright (C) 1998, 1999, 2000, 2001, 2003 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdlib.h>
	#include <errno.h>

	#include "i18n.h"
	#include "util.h"


	/* Check the string S for a YES or NO answer and take care of
	localization. If no valid string is given the value of DEF_ANSWER
	is returned. Returns 1 for yes and 0 for no. */
	int
	answer_is_yes_no_default (const char *s, int def_answer)
	{
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_yes = _("yes");
	const char *short_yes = _("yY");
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_no = _("no");
	const char *short_no = _("nN");

	/* Note: we have to use the local dependent compare here. */
	if ( match_multistr(long_yes,s) )
	return 1;
	if ( s && strchr( short_yes, s ) && !s[1] )
	return 1;
	/* Test for "no" strings to catch ambiguities for the next test. */
	if ( match_multistr(long_no,s) )
	return 0;
	if ( s && strchr( short_no, s ) && !s[1] )
	return 0;
	/* Test for the english version (for those who are used to type yes). */
	if ( !ascii_strcasecmp(s, "yes" ) )
	return 1;
	if ( s && strchr( "yY", s ) && !s[1] )
	return 1;
	return def_answer;
	}

	int
	answer_is_yes ( const char *s )
	{
	return answer_is_yes_no_default(s,0);
	}

	/****************
	* Return 1 for yes, -1 for quit, or 0 for no
	*/
	int
	answer_is_yes_no_quit ( const char *s )
	{
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_yes = _("yes");
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_no = _("no");
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_quit = _("quit");
	const char *short_yes = _("yY");
	const char *short_no = _("nN");
	const char *short_quit = _("qQ");

	/* Note: we have to use a local dependent compare here. */
	if ( match_multistr(long_no,s) )
	return 0;
	if ( match_multistr(long_yes,s) )
	return 1;
	if ( match_multistr(long_quit,s) )
	return -1;
	if ( s && strchr( short_no, s ) && !s[1] )
	return 0;
	if ( s && strchr( short_yes, s ) && !s[1] )
	return 1;
	if ( s && strchr( short_quit, s ) && !s[1] )
	return -1;
	/* but not here. */
	if ( !ascii_strcasecmp(s, "yes" ) )
	return 1;
	if ( !ascii_strcasecmp(s, "quit" ) )
	return -1;
	if ( s && strchr( "yY", s ) && !s[1] )
	return 1;
	if ( s && strchr( "qQ", s ) && !s[1] )
	return -1;
	return 0;
	}

	/*
	- Return 1 for okay, 0 for for cancel or DEF_ANSWER for default.
	+ Return 1 for okay, 0 for cancel or DEF_ANSWER for default.
	*/
	int
	answer_is_okay_cancel (const char *s, int def_answer)
	{
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_okay = _("okay\|okay");
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	const char *long_cancel = _("cancel\|cancel");
	const char *short_okay = _("oO");
	const char *short_cancel = _("cC");

	/* Note: We have to use the locale dependent compare. */
	if ( match_multistr(long_okay,s) )
	return 1;
	if ( match_multistr(long_cancel,s) )
	return 0;
	if ( s && strchr( short_okay, s ) && !s[1] )
	return 1;
	if ( s && strchr( short_cancel, s ) && !s[1] )
	return 0;
	/* Always test for the English values (not locale here). */
	if ( !ascii_strcasecmp(s, "okay" ) )
	return 1;
	if ( !ascii_strcasecmp(s, "ok" ) )
	return 1;
	if ( !ascii_strcasecmp(s, "cancel" ) )
	return 0;
	if ( s && strchr( "oO", s ) && !s[1] )
	return 1;
	if ( s && strchr( "cC", s ) && !s[1] )
	return 0;
	return def_answer;
	}
	diff --git a/dirmngr/certcache.c b/dirmngr/certcache.c
	index c83b00e88..3284ff2c0 100644
	--- a/dirmngr/certcache.c
	+++ b/dirmngr/certcache.c
	@@ -1,1800 +1,1800 @@
	/* certcache.c - Certificate caching
	* Copyright (C) 2004, 2005, 2007, 2008, 2017 g10 Code GmbH
	*
	* This file is part of DirMngr.
	*
	* DirMngr is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 2 of the License, or
	* (at your option) any later version.
	*
	* DirMngr is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <errno.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <dirent.h>
	#include <npth.h>

	#include "dirmngr.h"
	#include "misc.h"
	#include "../common/ksba-io-support.h"
	#include "crlfetch.h"
	#include "certcache.h"

	#define MAX_NONPERM_CACHED_CERTS 1000

	/* Constants used to classify search patterns. */
	enum pattern_class
	{
	PATTERN_UNKNOWN = 0,
	PATTERN_EMAIL,
	PATTERN_EMAIL_SUBSTR,
	PATTERN_FINGERPRINT16,
	PATTERN_FINGERPRINT20,
	PATTERN_SHORT_KEYID,
	PATTERN_LONG_KEYID,
	PATTERN_SUBJECT,
	PATTERN_SERIALNO,
	PATTERN_SERIALNO_ISSUER,
	PATTERN_ISSUER,
	PATTERN_SUBSTR
	};


	/* A certificate cache item. This consists of a the KSBA cert object
	and some meta data for easier lookup. We use a hash table to keep
	track of all items and use the (randomly distributed) first byte of
	the fingerprint directly as the hash which makes it pretty easy. */
	struct cert_item_s
	{
	struct cert_item_s next; / Next item with the same hash value. */
	ksba_cert_t cert; /* The KSBA cert object or NULL is this is
	not a valid item. */
	unsigned char fpr[20]; /* The fingerprint of this object. */
	char issuer_dn; / The malloced issuer DN. */
	ksba_sexp_t sn; /* The malloced serial number */
	char subject_dn; / The malloced subject DN - maybe NULL. */

	/* If this field is set the certificate has been taken from some
	* configuration and shall not be flushed from the cache. */
	unsigned int permanent:1;

	/* If this field is set the certificate is trusted. The actual
	* value is a (possible) combination of CERTTRUST_CLASS values. */
	unsigned int trustclasses:4;
	};
	typedef struct cert_item_s *cert_item_t;

	/* The actual cert cache consisting of 256 slots for items indexed by
	the first byte of the fingerprint. */
	static cert_item_t cert_cache[256];

	/* This is the global cache_lock variable. In general locking is not
	needed but it would take extra efforts to make sure that no
	indirect use of npth functions is done, so we simply lock it
	always. Note: We can't use static initialization, as that is not
	available through w32-pth. */
	static npth_rwlock_t cert_cache_lock;

	/* Flag to track whether the cache has been initialized. */
	static int initialization_done;

	/* Total number of non-permanent certificates. */
	static unsigned int total_nonperm_certificates;


	#ifdef HAVE_W32_SYSTEM
	/* We load some functions dynamically. Provide typedefs for tehse
	* fucntions. */
	typedef HCERTSTORE (WINAPI *CERTOPENSYSTEMSTORE)
	(HCRYPTPROV hProv, LPCSTR szSubsystemProtocol);
	typedef PCCERT_CONTEXT (WINAPI *CERTENUMCERTIFICATESINSTORE)
	(HCERTSTORE hCertStore, PCCERT_CONTEXT pPrevCertContext);
	typedef WINBOOL (WINAPI *CERTCLOSESTORE)
	(HCERTSTORE hCertStore,DWORD dwFlags);
	#endif /HAVE_W32_SYSTEM/




	/* Helper to do the cache locking. */
	static void
	init_cache_lock (void)
	{
	int err;

	err = npth_rwlock_init (&cert_cache_lock, NULL);
	if (err)
	log_fatal (_("can't initialize certificate cache lock: %s\n"),
	strerror (err));
	}

	static void
	acquire_cache_read_lock (void)
	{
	int err;

	err = npth_rwlock_rdlock (&cert_cache_lock);
	if (err)
	log_fatal (_("can't acquire read lock on the certificate cache: %s\n"),
	strerror (err));
	}

	static void
	acquire_cache_write_lock (void)
	{
	int err;

	err = npth_rwlock_wrlock (&cert_cache_lock);
	if (err)
	log_fatal (_("can't acquire write lock on the certificate cache: %s\n"),
	strerror (err));
	}

	static void
	release_cache_lock (void)
	{
	int err;

	err = npth_rwlock_unlock (&cert_cache_lock);
	if (err)
	log_fatal (_("can't release lock on the certificate cache: %s\n"),
	strerror (err));
	}


	/* Return false if both serial numbers match. Can't be used for
	sorting. */
	static int
	compare_serialno (ksba_sexp_t serial1, ksba_sexp_t serial2 )
	{
	unsigned char *a = serial1;
	unsigned char *b = serial2;
	return cmp_simple_canon_sexp (a, b);
	}



	/* Return a malloced canonical S-Expression with the serial number
	* converted from the hex string HEXSN. Return NULL on memory
	* error. */
	ksba_sexp_t
	hexsn_to_sexp (const char *hexsn)
	{
	char buffer, p;
	size_t len;
	char numbuf[40];

	len = unhexify (NULL, hexsn);
	snprintf (numbuf, sizeof numbuf, "(%u:", (unsigned int)len);
	buffer = xtrymalloc (strlen (numbuf) + len + 2 );
	if (!buffer)
	return NULL;
	p = stpcpy (buffer, numbuf);
	len = unhexify (p, hexsn);
	p[len] = ')';
	p[len+1] = 0;

	return buffer;
	}


	/* Compute the fingerprint of the certificate CERT and put it into
	the 20 bytes large buffer DIGEST. Return address of this buffer. */
	unsigned char *
	cert_compute_fpr (ksba_cert_t cert, unsigned char *digest)
	{
	gpg_error_t err;
	gcry_md_hd_t md;

	err = gcry_md_open (&md, GCRY_MD_SHA1, 0);
	if (err)
	log_fatal ("gcry_md_open failed: %s\n", gpg_strerror (err));

	err = ksba_cert_hash (cert, 0, HASH_FNC, md);
	if (err)
	{
	log_error ("oops: ksba_cert_hash failed: %s\n", gpg_strerror (err));
	memset (digest, 0xff, 20); /* Use a dummy value. */
	}
	else
	{
	gcry_md_final (md);
	memcpy (digest, gcry_md_read (md, GCRY_MD_SHA1), 20);
	}
	gcry_md_close (md);
	return digest;
	}



	/* Cleanup one slot. This releases all resourses but keeps the actual
	slot in the cache marked for reuse. */
	static void
	clean_cache_slot (cert_item_t ci)
	{
	ksba_cert_t cert;

	if (!ci->cert)
	return; /* Already cleaned. */

	ksba_free (ci->sn);
	ci->sn = NULL;
	ksba_free (ci->issuer_dn);
	ci->issuer_dn = NULL;
	ksba_free (ci->subject_dn);
	ci->subject_dn = NULL;
	cert = ci->cert;
	ci->cert = NULL;

	ci->permanent = 0;
	ci->trustclasses = 0;

	ksba_cert_release (cert);
	}


	/* Put the certificate CERT into the cache. It is assumed that the
	* cache is locked while this function is called.
	*
	* FROM_CONFIG indicates that CERT is a permanent certificate and
	* should stay in the cache. IS_TRUSTED requests that the trusted
	- * flag is set for the certificate; a value of 1 indicates the the
	+ * flag is set for the certificate; a value of 1 indicates the
	* cert is trusted due to GnuPG mechanisms, a value of 2 indicates
	* that it is trusted because it has been taken from the system's
	* store of trusted certificates. If FPR_BUFFER is not NULL the
	* fingerprint of the certificate will be stored there. FPR_BUFFER
	* needs to point to a buffer of at least 20 bytes. The fingerprint
	* will be stored on success or when the function returns
	* GPG_ERR_DUP_VALUE. */
	static gpg_error_t
	put_cert (ksba_cert_t cert, int permanent, unsigned int trustclass,
	void *fpr_buffer)
	{
	unsigned char help_fpr_buffer[20], *fpr;
	cert_item_t ci;

	fpr = fpr_buffer? fpr_buffer : &help_fpr_buffer;

	/* If we already reached the caching limit, drop a couple of certs
	* from the cache. Our dropping strategy is simple: We keep a
	* static index counter and use this to start looking for
	* certificates, then we drop 5 percent of the oldest certificates
	* starting at that index. For a large cache this is a fair way of
	* removing items. An LRU strategy would be better of course.
	* Because we append new entries to the head of the list and we want
	* to remove old ones first, we need to do this from the tail. The
	* implementation is not very efficient but compared to the long
	* time it takes to retrieve a certificate from an external resource
	* it seems to be reasonable. */
	if (!permanent && total_nonperm_certificates >= MAX_NONPERM_CACHED_CERTS)
	{
	static int idx;
	cert_item_t ci_mark;
	int i;
	unsigned int drop_count;

	drop_count = MAX_NONPERM_CACHED_CERTS / 20;
	if (drop_count < 2)
	drop_count = 2;

	log_info (_("dropping %u certificates from the cache\n"), drop_count);
	assert (idx < 256);
	for (i=idx; drop_count; i = ((i+1)%256))
	{
	ci_mark = NULL;
	for (ci = cert_cache[i]; ci; ci = ci->next)
	if (ci->cert && !ci->permanent)
	ci_mark = ci;
	if (ci_mark)
	{
	clean_cache_slot (ci_mark);
	drop_count--;
	total_nonperm_certificates--;
	}
	}
	if (i==idx)
	idx++;
	else
	idx = i;
	idx %= 256;
	}

	cert_compute_fpr (cert, fpr);
	for (ci=cert_cache[*fpr]; ci; ci = ci->next)
	if (ci->cert && !memcmp (ci->fpr, fpr, 20))
	return gpg_error (GPG_ERR_DUP_VALUE);
	/* Try to reuse an existing entry. */
	for (ci=cert_cache[*fpr]; ci; ci = ci->next)
	if (!ci->cert)
	break;
	if (!ci)
	{ /* No: Create a new entry. */
	ci = xtrycalloc (1, sizeof *ci);
	if (!ci)
	return gpg_error_from_errno (errno);
	ci->next = cert_cache[*fpr];
	cert_cache[*fpr] = ci;
	}

	ksba_cert_ref (cert);
	ci->cert = cert;
	memcpy (ci->fpr, fpr, 20);
	ci->sn = ksba_cert_get_serial (cert);
	ci->issuer_dn = ksba_cert_get_issuer (cert, 0);
	if (!ci->issuer_dn \|\| !ci->sn)
	{
	clean_cache_slot (ci);
	return gpg_error (GPG_ERR_INV_CERT_OBJ);
	}
	ci->subject_dn = ksba_cert_get_subject (cert, 0);
	ci->permanent = !!permanent;
	ci->trustclasses = trustclass;

	if (!permanent)
	total_nonperm_certificates++;

	return 0;
	}


	/* Load certificates from the directory DIRNAME. All certificates
	matching the pattern ".crt" or ".der" are loaded. We assume that
	certificates are DER encoded and not PEM encapsulated. The cache
	should be in a locked state when calling this function. */
	static gpg_error_t
	load_certs_from_dir (const char *dirname, unsigned int trustclass)
	{
	gpg_error_t err;
	DIR *dir;
	struct dirent *ep;
	char *p;
	size_t n;
	estream_t fp;
	ksba_reader_t reader;
	ksba_cert_t cert;
	char *fname = NULL;

	dir = opendir (dirname);
	if (!dir)
	{
	return 0; /* We do not consider this a severe error. */
	}

	while ( (ep=readdir (dir)) )
	{
	p = ep->d_name;
	if (p == '.' \|\| !p)
	continue; /* Skip any hidden files and invalid entries. */
	n = strlen (p);
	if ( n < 5 \|\| (strcmp (p+n-4,".crt") && strcmp (p+n-4,".der")))
	continue; /* Not the desired ".crt" or ".der" pattern. */

	xfree (fname);
	fname = make_filename (dirname, p, NULL);
	fp = es_fopen (fname, "rb");
	if (!fp)
	{
	log_error (_("can't open '%s': %s\n"),
	fname, strerror (errno));
	continue;
	}

	err = create_estream_ksba_reader (&reader, fp);
	if (err)
	{
	es_fclose (fp);
	continue;
	}

	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_read_der (cert, reader);
	ksba_reader_release (reader);
	es_fclose (fp);
	if (err)
	{
	log_error (_("can't parse certificate '%s': %s\n"),
	fname, gpg_strerror (err));
	ksba_cert_release (cert);
	continue;
	}

	err = put_cert (cert, 1, trustclass, NULL);
	if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
	log_info (_("certificate '%s' already cached\n"), fname);
	else if (!err)
	{
	if (trustclass)
	log_info (_("trusted certificate '%s' loaded\n"), fname);
	else
	log_info (_("certificate '%s' loaded\n"), fname);
	if (opt.verbose)
	{
	p = get_fingerprint_hexstring_colon (cert);
	log_info (_(" SHA1 fingerprint = %s\n"), p);
	xfree (p);

	cert_log_name (_(" issuer ="), cert);
	cert_log_subject (_(" subject ="), cert);
	}
	}
	else
	log_error (_("error loading certificate '%s': %s\n"),
	fname, gpg_strerror (err));
	ksba_cert_release (cert);
	}

	xfree (fname);
	closedir (dir);
	return 0;
	}


	/* Load certificates from FILE. The certificates are expected to be
	* PEM encoded so that it is possible to load several certificates.
	* TRUSTCLASSES is used to mark the certificates as trusted. The
	* cache should be in a locked state when calling this function.
	* NO_ERROR repalces an error message when FNAME was not found by an
	* information message. */
	static gpg_error_t
	load_certs_from_file (const char *fname, unsigned int trustclasses,
	int no_error)
	{
	gpg_error_t err;
	estream_t fp = NULL;
	gnupg_ksba_io_t ioctx = NULL;
	ksba_reader_t reader;
	ksba_cert_t cert = NULL;

	fp = es_fopen (fname, "rb");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENONET && no_error)
	log_info (_("can't open '%s': %s\n"), fname, gpg_strerror (err));
	else
	log_error (_("can't open '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}

	err = gnupg_ksba_create_reader (&ioctx,
	(GNUPG_KSBA_IO_AUTODETECT
	\| GNUPG_KSBA_IO_MULTIPEM),
	fp, &reader);
	if (err)
	{
	log_error ("can't create reader: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Loop to read all certificates from the file. */
	do
	{
	ksba_cert_release (cert);
	cert = NULL;
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_read_der (cert, reader);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_EOF)
	err = 0;
	else
	log_error (_("can't parse certificate '%s': %s\n"),
	fname, gpg_strerror (err));
	goto leave;
	}

	err = put_cert (cert, 1, trustclasses, NULL);
	if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
	log_info (_("certificate '%s' already cached\n"), fname);
	else if (err)
	log_error (_("error loading certificate '%s': %s\n"),
	fname, gpg_strerror (err));
	else if (opt.verbose > 1)
	{
	char *p;

	log_info (_("trusted certificate '%s' loaded\n"), fname);
	p = get_fingerprint_hexstring_colon (cert);
	log_info (_(" SHA1 fingerprint = %s\n"), p);
	xfree (p);

	cert_log_name (_(" issuer ="), cert);
	cert_log_subject (_(" subject ="), cert);
	}

	ksba_reader_clear (reader, NULL, NULL);
	}
	while (!gnupg_ksba_reader_eof_seen (ioctx));

	leave:
	ksba_cert_release (cert);
	gnupg_ksba_destroy_reader (ioctx);
	es_fclose (fp);

	return err;
	}


	#ifdef HAVE_W32_SYSTEM
	/* Load all certificates from the Windows store named STORENAME. All
	* certificates are considered to be system provided trusted
	* certificates. The cache should be in a locked state when calling
	* this function. */
	static void
	load_certs_from_w32_store (const char *storename)
	{
	static int init_done;
	static CERTOPENSYSTEMSTORE pCertOpenSystemStore;
	static CERTENUMCERTIFICATESINSTORE pCertEnumCertificatesInStore;
	static CERTCLOSESTORE pCertCloseStore;
	gpg_error_t err;
	HCERTSTORE w32store;
	const CERT_CONTEXT *w32cert;
	ksba_cert_t cert = NULL;
	unsigned int count = 0;

	/* Initialize on the first use. */
	if (!init_done)
	{
	static HANDLE hCrypt32;

	init_done = 1;

	hCrypt32 = LoadLibrary ("Crypt32.dll");
	if (!hCrypt32)
	{
	log_error ("can't load Crypt32.dll: %s\n", w32_strerror (-1));
	return;
	}

	pCertOpenSystemStore = (CERTOPENSYSTEMSTORE)
	GetProcAddress (hCrypt32, "CertOpenSystemStoreA");
	pCertEnumCertificatesInStore = (CERTENUMCERTIFICATESINSTORE)
	GetProcAddress (hCrypt32, "CertEnumCertificatesInStore");
	pCertCloseStore = (CERTCLOSESTORE)
	GetProcAddress (hCrypt32, "CertCloseStore");
	if ( !pCertOpenSystemStore
	\|\| !pCertEnumCertificatesInStore
	\|\| !pCertCloseStore)
	{
	log_error ("can't load crypt32.dll: %s\n", "missing function");
	pCertOpenSystemStore = NULL;
	}
	}

	if (!pCertOpenSystemStore)
	return; /* Not initialized. */


	w32store = pCertOpenSystemStore (0, storename);
	if (!w32store)
	{
	log_error ("can't open certificate store '%s': %s\n",
	storename, w32_strerror (-1));
	return;
	}

	w32cert = NULL;
	while ((w32cert = pCertEnumCertificatesInStore (w32store, w32cert)))
	{
	if (w32cert->dwCertEncodingType == X509_ASN_ENCODING)
	{
	ksba_cert_release (cert);
	cert = NULL;
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_init_from_mem (cert,
	w32cert->pbCertEncoded,
	w32cert->cbCertEncoded);
	if (err)
	{
	log_error (_("can't parse certificate '%s': %s\n"),
	storename, gpg_strerror (err));
	break;
	}

	err = put_cert (cert, 1, CERTTRUST_CLASS_SYSTEM, NULL);
	if (!err)
	count++;
	if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
	log_info (_("certificate '%s' already cached\n"), storename);
	else if (err)
	log_error (_("error loading certificate '%s': %s\n"),
	storename, gpg_strerror (err));
	else if (opt.verbose > 1)
	{
	char *p;

	log_info (_("trusted certificate '%s' loaded\n"), storename);
	p = get_fingerprint_hexstring_colon (cert);
	log_info (_(" SHA1 fingerprint = %s\n"), p);
	xfree (p);

	cert_log_name (_(" issuer ="), cert);
	cert_log_subject (_(" subject ="), cert);
	}
	}
	}

	ksba_cert_release (cert);
	pCertCloseStore (w32store, 0);

	if (DBG_X509)
	log_debug ("number of certs loaded from store '%s': %u\n",
	storename, count);

	}
	#endif /HAVE_W32_SYSTEM/


	/* Load the trusted certificates provided by the system. */
	static gpg_error_t
	load_certs_from_system (void)
	{
	#ifdef HAVE_W32_SYSTEM

	load_certs_from_w32_store ("ROOT");
	load_certs_from_w32_store ("CA");

	return 0;

	#else /!HAVE_W32_SYSTEM/

	/* A list of certificate bundles to try. */
	static struct {
	const char *name;
	} table[] = {
	#ifdef DEFAULT_TRUST_STORE_FILE
	{ DEFAULT_TRUST_STORE_FILE }
	#else
	{ "/etc/ssl/ca-bundle.pem" },
	{ "/etc/ssl/certs/ca-certificates.crt" },
	{ "/etc/pki/tls/cert.pem" },
	{ "/usr/local/share/certs/ca-root-nss.crt" },
	{ "/etc/ssl/cert.pem" }
	#endif /!DEFAULT_TRUST_STORE_FILE/
	};
	int idx;
	gpg_error_t err = 0;

	for (idx=0; idx < DIM (table); idx++)
	if (!access (table[idx].name, F_OK))
	{
	/* Take the first available bundle. */
	err = load_certs_from_file (table[idx].name, CERTTRUST_CLASS_SYSTEM, 0);
	break;
	}

	return err;
	#endif /!HAVE_W32_SYSTEM/
	}


	/* Initialize the certificate cache if not yet done. */
	void
	cert_cache_init (strlist_t hkp_cacerts)
	{
	char *fname;
	strlist_t sl;

	if (initialization_done)
	return;
	init_cache_lock ();
	acquire_cache_write_lock ();

	load_certs_from_system ();

	fname = make_filename_try (gnupg_sysconfdir (), "trusted-certs", NULL);
	if (fname)
	load_certs_from_dir (fname, CERTTRUST_CLASS_CONFIG);
	xfree (fname);

	fname = make_filename_try (gnupg_sysconfdir (), "extra-certs", NULL);
	if (fname)
	load_certs_from_dir (fname, 0);
	xfree (fname);

	fname = make_filename_try (gnupg_datadir (),
	"sks-keyservers.netCA.pem", NULL);
	if (fname)
	load_certs_from_file (fname, CERTTRUST_CLASS_HKPSPOOL, 1);
	xfree (fname);

	for (sl = hkp_cacerts; sl; sl = sl->next)
	load_certs_from_file (sl->d, CERTTRUST_CLASS_HKP, 0);

	initialization_done = 1;
	release_cache_lock ();

	cert_cache_print_stats ();
	}

	/* Deinitialize the certificate cache. With FULL set to true even the
	unused certificate slots are released. */
	void
	cert_cache_deinit (int full)
	{
	cert_item_t ci, ci2;
	int i;

	if (!initialization_done)
	return;

	acquire_cache_write_lock ();

	for (i=0; i < 256; i++)
	for (ci=cert_cache[i]; ci; ci = ci->next)
	clean_cache_slot (ci);

	if (full)
	{
	for (i=0; i < 256; i++)
	{
	for (ci=cert_cache[i]; ci; ci = ci2)
	{
	ci2 = ci->next;
	xfree (ci);
	}
	cert_cache[i] = NULL;
	}
	}

	total_nonperm_certificates = 0;
	initialization_done = 0;
	release_cache_lock ();
	}

	/* Print some statistics to the log file. */
	void
	cert_cache_print_stats (void)
	{
	cert_item_t ci;
	int idx;
	unsigned int n_nonperm = 0;
	unsigned int n_permanent = 0;
	unsigned int n_trusted = 0;
	unsigned int n_trustclass_system = 0;
	unsigned int n_trustclass_config = 0;
	unsigned int n_trustclass_hkp = 0;
	unsigned int n_trustclass_hkpspool = 0;

	acquire_cache_read_lock ();
	for (idx = 0; idx < 256; idx++)
	for (ci=cert_cache[idx]; ci; ci = ci->next)
	if (ci->cert)
	{
	if (ci->permanent)
	n_permanent++;
	else
	n_nonperm++;
	if (ci->trustclasses)
	{
	n_trusted++;
	if ((ci->trustclasses & CERTTRUST_CLASS_SYSTEM))
	n_trustclass_system++;
	if ((ci->trustclasses & CERTTRUST_CLASS_CONFIG))
	n_trustclass_config++;
	if ((ci->trustclasses & CERTTRUST_CLASS_HKP))
	n_trustclass_hkp++;
	if ((ci->trustclasses & CERTTRUST_CLASS_HKPSPOOL))
	n_trustclass_hkpspool++;
	}
	}

	release_cache_lock ();

	log_info (_("permanently loaded certificates: %u\n"),
	n_permanent);
	log_info (_(" runtime cached certificates: %u\n"),
	n_nonperm);
	log_info (_(" trusted certificates: %u (%u,%u,%u,%u)\n"),
	n_trusted,
	n_trustclass_system,
	n_trustclass_config,
	n_trustclass_hkp,
	n_trustclass_hkpspool);
	}


	/* Put CERT into the certificate cache. */
	gpg_error_t
	cache_cert (ksba_cert_t cert)
	{
	gpg_error_t err;

	acquire_cache_write_lock ();
	err = put_cert (cert, 0, 0, NULL);
	release_cache_lock ();
	if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
	log_info (_("certificate already cached\n"));
	else if (!err)
	log_info (_("certificate cached\n"));
	else
	log_error (_("error caching certificate: %s\n"), gpg_strerror (err));
	return err;
	}


	/* Put CERT into the certificate cache and store the fingerprint of
	the certificate into FPR_BUFFER. If the certificate is already in
	the cache do not print a warning; just store the
	fingerprint. FPR_BUFFER needs to be at least 20 bytes. */
	gpg_error_t
	cache_cert_silent (ksba_cert_t cert, void *fpr_buffer)
	{
	gpg_error_t err;

	acquire_cache_write_lock ();
	err = put_cert (cert, 0, 0, fpr_buffer);
	release_cache_lock ();
	if (gpg_err_code (err) == GPG_ERR_DUP_VALUE)
	err = 0;
	if (err)
	log_error (_("error caching certificate: %s\n"), gpg_strerror (err));
	return err;
	}



	/* Return a certificate object for the given fingerprint. FPR is
	expected to be a 20 byte binary SHA-1 fingerprint. If no matching
	certificate is available in the cache NULL is returned. The caller
	must release a returned certificate. Note that although we are
	using reference counting the caller should not just compare the
	pointers to check for identical certificates. */
	ksba_cert_t
	get_cert_byfpr (const unsigned char *fpr)
	{
	cert_item_t ci;

	acquire_cache_read_lock ();
	for (ci=cert_cache[*fpr]; ci; ci = ci->next)
	if (ci->cert && !memcmp (ci->fpr, fpr, 20))
	{
	ksba_cert_ref (ci->cert);
	release_cache_lock ();
	return ci->cert;
	}

	release_cache_lock ();
	return NULL;
	}

	/* Return a certificate object for the given fingerprint. STRING is
	expected to be a SHA-1 fingerprint in standard hex notation with or
	without colons. If no matching certificate is available in the
	cache NULL is returned. The caller must release a returned
	certificate. Note that although we are using reference counting
	the caller should not just compare the pointers to check for
	identical certificates. */
	ksba_cert_t
	get_cert_byhexfpr (const char *string)
	{
	unsigned char fpr[20];
	const char *s;
	int i;

	if (strchr (string, ':'))
	{
	for (s=string,i=0; i < 20 && hexdigitp (s) && hexdigitp(s+1);)
	{
	if (s[2] && s[2] != ':')
	break; /* Invalid string. */
	fpr[i++] = xtoi_2 (s);
	s += 2;
	if (i!= 20 && *s == ':')
	s++;
	}
	}
	else
	{
	for (s=string,i=0; i < 20 && hexdigitp (s) && hexdigitp(s+1); s+=2 )
	fpr[i++] = xtoi_2 (s);
	}
	if (i!=20 \|\| *s)
	{
	log_error (_("invalid SHA1 fingerprint string '%s'\n"), string);
	return NULL;
	}

	return get_cert_byfpr (fpr);
	}



	/* Return the certificate matching ISSUER_DN and SERIALNO. */
	ksba_cert_t
	get_cert_bysn (const char *issuer_dn, ksba_sexp_t serialno)
	{
	/* Simple and inefficient implementation. fixme! */
	cert_item_t ci;
	int i;

	acquire_cache_read_lock ();
	for (i=0; i < 256; i++)
	{
	for (ci=cert_cache[i]; ci; ci = ci->next)
	if (ci->cert && !strcmp (ci->issuer_dn, issuer_dn)
	&& !compare_serialno (ci->sn, serialno))
	{
	ksba_cert_ref (ci->cert);
	release_cache_lock ();
	return ci->cert;
	}
	}

	release_cache_lock ();
	return NULL;
	}


	/* Return the certificate matching ISSUER_DN. SEQ should initially be
	set to 0 and bumped up to get the next issuer with that DN. */
	ksba_cert_t
	get_cert_byissuer (const char *issuer_dn, unsigned int seq)
	{
	/* Simple and very inefficient implementation and API. fixme! */
	cert_item_t ci;
	int i;

	acquire_cache_read_lock ();
	for (i=0; i < 256; i++)
	{
	for (ci=cert_cache[i]; ci; ci = ci->next)
	if (ci->cert && !strcmp (ci->issuer_dn, issuer_dn))
	if (!seq--)
	{
	ksba_cert_ref (ci->cert);
	release_cache_lock ();
	return ci->cert;
	}
	}

	release_cache_lock ();
	return NULL;
	}


	/* Return the certificate matching SUBJECT_DN. SEQ should initially be
	set to 0 and bumped up to get the next subject with that DN. */
	ksba_cert_t
	get_cert_bysubject (const char *subject_dn, unsigned int seq)
	{
	/* Simple and very inefficient implementation and API. fixme! */
	cert_item_t ci;
	int i;

	if (!subject_dn)
	return NULL;

	acquire_cache_read_lock ();
	for (i=0; i < 256; i++)
	{
	for (ci=cert_cache[i]; ci; ci = ci->next)
	if (ci->cert && ci->subject_dn
	&& !strcmp (ci->subject_dn, subject_dn))
	if (!seq--)
	{
	ksba_cert_ref (ci->cert);
	release_cache_lock ();
	return ci->cert;
	}
	}

	release_cache_lock ();
	return NULL;
	}



	-/* Return a value describing the the class of PATTERN. The offset of
	+/* Return a value describing the class of PATTERN. The offset of
	the actual string to be used for the comparison is stored at
	R_OFFSET. The offset of the serialnumer is stored at R_SN_OFFSET. */
	static enum pattern_class
	classify_pattern (const char pattern, size_t r_offset, size_t *r_sn_offset)
	{
	enum pattern_class result;
	const char *s;
	int hexprefix = 0;
	int hexlength;

	r_offset = r_sn_offset = 0;

	/* Skip leading spaces. */
	for(s = pattern; *s && spacep (s); s++ )
	;

	switch (*s)
	{
	case 0: /* Empty string is an error. */
	result = PATTERN_UNKNOWN;
	break;

	case '.': /* An email address, compare from end. */
	result = PATTERN_UNKNOWN; /* Not implemented. */
	break;

	case '<': /* An email address. */
	result = PATTERN_EMAIL;
	s++;
	break;

	case '@': /* Part of an email address. */
	result = PATTERN_EMAIL_SUBSTR;
	s++;
	break;

	case '=': /* Exact compare. */
	result = PATTERN_UNKNOWN; /* Does not make sense for X.509. */
	break;

	case '': / Case insensitive substring search. */
	result = PATTERN_SUBSTR;
	s++;
	break;

	case '+': /* Compare individual words. */
	result = PATTERN_UNKNOWN; /* Not implemented. */
	break;

	case '/': /* Subject's DN. */
	s++;
	if (!*s \|\| spacep (s))
	result = PATTERN_UNKNOWN; /* No DN or prefixed with a space. */
	else
	result = PATTERN_SUBJECT;
	break;

	case '#': /* Serial number or issuer DN. */
	{
	const char *si;

	s++;
	if ( *s == '/')
	{
	/* An issuer's DN is indicated by "#/" */
	s++;
	if (!*s \|\| spacep (s))
	result = PATTERN_UNKNOWN; /* No DN or prefixed with a space. */
	else
	result = PATTERN_ISSUER;
	}
	else
	{ /* Serialnumber + optional issuer ID. */
	for (si=s; si && si != '/'; si++)
	if (!strchr("01234567890abcdefABCDEF", *si))
	break;
	if (si && si != '/')
	result = PATTERN_UNKNOWN; /* Invalid digit in serial number. */
	else
	{
	*r_sn_offset = s - pattern;
	if (!*si)
	result = PATTERN_SERIALNO;
	else
	{
	s = si+1;
	if (!*s \|\| spacep (s))
	result = PATTERN_UNKNOWN; /* No DN or prefixed
	with a space. */
	else
	result = PATTERN_SERIALNO_ISSUER;
	}
	}
	}
	}
	break;

	case ':': /* Unified fingerprint. */
	{
	const char se, si;
	int i;

	se = strchr (++s, ':');
	if (!se)
	result = PATTERN_UNKNOWN;
	else
	{
	for (i=0, si=s; si < se; si++, i++ )
	if (!strchr("01234567890abcdefABCDEF", *si))
	break;
	if ( si < se )
	result = PATTERN_UNKNOWN; /* Invalid digit. */
	else if (i == 32)
	result = PATTERN_FINGERPRINT16;
	else if (i == 40)
	result = PATTERN_FINGERPRINT20;
	else
	result = PATTERN_UNKNOWN; /* Invalid length for a fingerprint. */
	}
	}
	break;

	case '&': /* Keygrip. */
	result = PATTERN_UNKNOWN; /* Not implemented. */
	break;

	default:
	if (s[0] == '0' && s[1] == 'x')
	{
	hexprefix = 1;
	s += 2;
	}

	hexlength = strspn(s, "0123456789abcdefABCDEF");

	/* Check if a hexadecimal number is terminated by EOS or blank. */
	if (hexlength && s[hexlength] && !spacep (s+hexlength))
	{
	/* If the "0x" prefix is used a correct termination is required. */
	if (hexprefix)
	{
	result = PATTERN_UNKNOWN;
	break; /* switch */
	}
	hexlength = 0; /* Not a hex number. */
	}

	if (hexlength == 8 \|\| (!hexprefix && hexlength == 9 && *s == '0'))
	{
	if (hexlength == 9)
	s++;
	result = PATTERN_SHORT_KEYID;
	}
	else if (hexlength == 16 \|\| (!hexprefix && hexlength == 17 && *s == '0'))
	{
	if (hexlength == 17)
	s++;
	result = PATTERN_LONG_KEYID;
	}
	else if (hexlength == 32 \|\| (!hexprefix && hexlength == 33 && *s == '0'))
	{
	if (hexlength == 33)
	s++;
	result = PATTERN_FINGERPRINT16;
	}
	else if (hexlength == 40 \|\| (!hexprefix && hexlength == 41 && *s == '0'))
	{
	if (hexlength == 41)
	s++;
	result = PATTERN_FINGERPRINT20;
	}
	else if (!hexprefix)
	{
	/* The fingerprints used with X.509 are often delimited by
	colons, so we try to single this case out. */
	result = PATTERN_UNKNOWN;
	hexlength = strspn (s, ":0123456789abcdefABCDEF");
	if (hexlength == 59 && (!s[hexlength] \|\| spacep (s+hexlength)))
	{
	int i, c;

	for (i=0; i < 20; i++, s += 3)
	{
	c = hextobyte(s);
	if (c == -1 \|\| (i < 19 && s[2] != ':'))
	break;
	}
	if (i == 20)
	result = PATTERN_FINGERPRINT20;
	}
	if (result == PATTERN_UNKNOWN) /* Default to substring match. */
	{
	result = PATTERN_SUBSTR;
	}
	}
	else /* A hex number with a prefix but with a wrong length. */
	result = PATTERN_UNKNOWN;
	}

	if (result != PATTERN_UNKNOWN)
	*r_offset = s - pattern;
	return result;
	}



	/* Given PATTERN, which is a string as used by GnuPG to specify a
	certificate, return all matching certificates by calling the
	supplied function RETFNC. */
	gpg_error_t
	get_certs_bypattern (const char *pattern,
	gpg_error_t (retfnc)(void,ksba_cert_t),
	void *retfnc_data)
	{
	gpg_error_t err = GPG_ERR_BUG;
	enum pattern_class class;
	size_t offset, sn_offset;
	const char *hexserialno;
	ksba_sexp_t serialno = NULL;
	ksba_cert_t cert = NULL;
	unsigned int seq;

	if (!pattern \|\| !retfnc)
	return gpg_error (GPG_ERR_INV_ARG);

	class = classify_pattern (pattern, &offset, &sn_offset);
	hexserialno = pattern + sn_offset;
	pattern += offset;
	switch (class)
	{
	case PATTERN_UNKNOWN:
	err = gpg_error (GPG_ERR_INV_NAME);
	break;

	case PATTERN_FINGERPRINT20:
	cert = get_cert_byhexfpr (pattern);
	err = cert? 0 : gpg_error (GPG_ERR_NOT_FOUND);
	break;

	case PATTERN_SERIALNO_ISSUER:
	serialno = hexsn_to_sexp (hexserialno);
	if (!serialno)
	err = gpg_error_from_syserror ();
	else
	{
	cert = get_cert_bysn (pattern, serialno);
	err = cert? 0 : gpg_error (GPG_ERR_NOT_FOUND);
	}
	break;

	case PATTERN_ISSUER:
	for (seq=0,err=0; !err && (cert = get_cert_byissuer (pattern, seq)); seq++)
	{
	err = retfnc (retfnc_data, cert);
	ksba_cert_release (cert);
	cert = NULL;
	}
	if (!err && !seq)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	break;

	case PATTERN_SUBJECT:
	for (seq=0,err=0; !err && (cert = get_cert_bysubject (pattern, seq));seq++)
	{
	err = retfnc (retfnc_data, cert);
	ksba_cert_release (cert);
	cert = NULL;
	}
	if (!err && !seq)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	break;

	case PATTERN_EMAIL:
	case PATTERN_EMAIL_SUBSTR:
	case PATTERN_FINGERPRINT16:
	case PATTERN_SHORT_KEYID:
	case PATTERN_LONG_KEYID:
	case PATTERN_SUBSTR:
	case PATTERN_SERIALNO:
	/* Not supported. */
	err = gpg_error (GPG_ERR_INV_NAME);
	}


	if (!err && cert)
	err = retfnc (retfnc_data, cert);
	ksba_cert_release (cert);
	xfree (serialno);
	return err;
	}





	/* Return the certificate matching ISSUER_DN and SERIALNO; if it is
	* not already in the cache, try to find it from other resources. */
	ksba_cert_t
	find_cert_bysn (ctrl_t ctrl, const char *issuer_dn, ksba_sexp_t serialno)
	{
	gpg_error_t err;
	ksba_cert_t cert;
	cert_fetch_context_t context = NULL;
	char hexsn, buf;

	/* First check whether it has already been cached. */
	cert = get_cert_bysn (issuer_dn, serialno);
	if (cert)
	return cert;

	/* Ask back to the service requester to return the certificate.
	* This is because we can assume that he already used the
	* certificate while checking for the CRL. */
	hexsn = serial_hex (serialno);
	if (!hexsn)
	{
	log_error ("serial_hex() failed\n");
	return NULL;
	}
	buf = strconcat ("#", hexsn, "/", issuer_dn, NULL);
	if (!buf)
	{
	log_error ("can't allocate enough memory: %s\n", strerror (errno));
	xfree (hexsn);
	return NULL;
	}
	xfree (hexsn);

	cert = get_cert_local (ctrl, buf);
	xfree (buf);
	if (cert)
	{
	cache_cert (cert);
	return cert; /* Done. */
	}

	if (DBG_LOOKUP)
	log_debug ("find_cert_bysn: certificate not returned by caller"
	" - doing lookup\n");

	/* Retrieve the certificate from external resources. */
	while (!cert)
	{
	ksba_sexp_t sn;
	char *issdn;

	if (!context)
	{
	err = ca_cert_fetch (ctrl, &context, issuer_dn);
	if (err)
	{
	log_error (_("error fetching certificate by S/N: %s\n"),
	gpg_strerror (err));
	break;
	}
	}

	err = fetch_next_ksba_cert (context, &cert);
	if (err)
	{
	log_error (_("error fetching certificate by S/N: %s\n"),
	gpg_strerror (err) );
	break;
	}

	issdn = ksba_cert_get_issuer (cert, 0);
	if (strcmp (issuer_dn, issdn))
	{
	log_debug ("find_cert_bysn: Ooops: issuer DN does not match\n");
	ksba_cert_release (cert);
	cert = NULL;
	ksba_free (issdn);
	break;
	}

	sn = ksba_cert_get_serial (cert);

	if (DBG_LOOKUP)
	{
	log_debug (" considering certificate (#");
	dump_serial (sn);
	log_printf ("/");
	dump_string (issdn);
	log_printf (")\n");
	}

	if (!compare_serialno (serialno, sn))
	{
	ksba_free (sn);
	ksba_free (issdn);
	cache_cert (cert);
	if (DBG_LOOKUP)
	log_debug (" found\n");
	break; /* Ready. */
	}

	ksba_free (sn);
	ksba_free (issdn);
	ksba_cert_release (cert);
	cert = NULL;
	}

	end_cert_fetch (context);
	return cert;
	}


	/* Return the certificate matching SUBJECT_DN and (if not NULL)
	* KEYID. If it is not already in the cache, try to find it from other
	* resources. Note, that the external search does not work for user
	* certificates because the LDAP lookup is on the caCertificate
	* attribute. For our purposes this is just fine. */
	ksba_cert_t
	find_cert_bysubject (ctrl_t ctrl, const char *subject_dn, ksba_sexp_t keyid)
	{
	gpg_error_t err;
	int seq;
	ksba_cert_t cert = NULL;
	cert_fetch_context_t context = NULL;
	ksba_sexp_t subj;

	/* If we have certificates from an OCSP request we first try to use
	* them. This is because these certificates will really be the
	* required ones and thus even in the case that they can't be
	* uniquely located by the following code we can use them. This is
	* for example required by Telesec certificates where a keyId is
	* used but the issuer certificate comes without a subject keyId! */
	if (ctrl->ocsp_certs && subject_dn)
	{
	cert_item_t ci;
	cert_ref_t cr;
	int i;

	/* For efficiency reasons we won't use get_cert_bysubject here. */
	acquire_cache_read_lock ();
	for (i=0; i < 256; i++)
	for (ci=cert_cache[i]; ci; ci = ci->next)
	if (ci->cert && ci->subject_dn
	&& !strcmp (ci->subject_dn, subject_dn))
	for (cr=ctrl->ocsp_certs; cr; cr = cr->next)
	if (!memcmp (ci->fpr, cr->fpr, 20))
	{
	ksba_cert_ref (ci->cert);
	release_cache_lock ();
	return ci->cert; /* We use this certificate. */
	}
	release_cache_lock ();
	if (DBG_LOOKUP)
	log_debug ("find_cert_bysubject: certificate not in ocsp_certs\n");
	}

	/* No check whether the certificate is cached. */
	for (seq=0; (cert = get_cert_bysubject (subject_dn, seq)); seq++)
	{
	if (!keyid)
	break; /* No keyid requested, so return the first one found. */
	if (!ksba_cert_get_subj_key_id (cert, NULL, &subj)
	&& !cmp_simple_canon_sexp (keyid, subj))
	{
	xfree (subj);
	break; /* Found matching cert. */
	}
	xfree (subj);
	ksba_cert_release (cert);
	}
	if (cert)
	return cert; /* Done. */

	if (DBG_LOOKUP)
	log_debug ("find_cert_bysubject: certificate not in cache\n");

	/* Ask back to the service requester to return the certificate.
	* This is because we can assume that he already used the
	* certificate while checking for the CRL. */
	if (keyid)
	cert = get_cert_local_ski (ctrl, subject_dn, keyid);
	else
	{
	/* In contrast to get_cert_local_ski, get_cert_local uses any
	* passed pattern, so we need to make sure that an exact subject
	* search is done. */
	char *buf;

	buf = strconcat ("/", subject_dn, NULL);
	if (!buf)
	{
	log_error ("can't allocate enough memory: %s\n", strerror (errno));
	return NULL;
	}
	cert = get_cert_local (ctrl, buf);
	xfree (buf);
	}
	if (cert)
	{
	cache_cert (cert);
	return cert; /* Done. */
	}

	if (DBG_LOOKUP)
	log_debug ("find_cert_bysubject: certificate not returned by caller"
	" - doing lookup\n");

	/* Locate the certificate using external resources. */
	while (!cert)
	{
	char *subjdn;

	if (!context)
	{
	err = ca_cert_fetch (ctrl, &context, subject_dn);
	if (err)
	{
	log_error (_("error fetching certificate by subject: %s\n"),
	gpg_strerror (err));
	break;
	}
	}

	err = fetch_next_ksba_cert (context, &cert);
	if (err)
	{
	log_error (_("error fetching certificate by subject: %s\n"),
	gpg_strerror (err) );
	break;
	}

	subjdn = ksba_cert_get_subject (cert, 0);
	if (strcmp (subject_dn, subjdn))
	{
	log_info ("find_cert_bysubject: subject DN does not match\n");
	ksba_cert_release (cert);
	cert = NULL;
	ksba_free (subjdn);
	continue;
	}


	if (DBG_LOOKUP)
	{
	log_debug (" considering certificate (/");
	dump_string (subjdn);
	log_printf (")\n");
	}
	ksba_free (subjdn);

	/* If no key ID has been provided, we return the first match. */
	if (!keyid)
	{
	cache_cert (cert);
	if (DBG_LOOKUP)
	log_debug (" found\n");
	break; /* Ready. */
	}

	/* With the key ID given we need to compare it. */
	if (!ksba_cert_get_subj_key_id (cert, NULL, &subj))
	{
	if (!cmp_simple_canon_sexp (keyid, subj))
	{
	ksba_free (subj);
	cache_cert (cert);
	if (DBG_LOOKUP)
	log_debug (" found\n");
	break; /* Ready. */
	}
	}

	ksba_free (subj);
	ksba_cert_release (cert);
	cert = NULL;
	}

	end_cert_fetch (context);
	return cert;
	}


	/* Return 0 if the certificate is a trusted certificate. Returns
	* GPG_ERR_NOT_TRUSTED if it is not trusted or other error codes in
	* case of systems errors. TRUSTCLASSES are the bitwise ORed
	* CERTTRUST_CLASS values to use for the check. */
	gpg_error_t
	is_trusted_cert (ksba_cert_t cert, unsigned int trustclasses)
	{
	unsigned char fpr[20];
	cert_item_t ci;

	cert_compute_fpr (cert, fpr);

	acquire_cache_read_lock ();
	for (ci=cert_cache[*fpr]; ci; ci = ci->next)
	if (ci->cert && !memcmp (ci->fpr, fpr, 20))
	{
	if ((ci->trustclasses & trustclasses))
	{
	/* The certificate is trusted in one of the given
	* TRUSTCLASSES. */
	release_cache_lock ();
	return 0; /* Yes, it is trusted. */
	}
	break;
	}

	release_cache_lock ();
	return gpg_error (GPG_ERR_NOT_TRUSTED);
	}



	/* Given the certificate CERT locate the issuer for this certificate
	* and return it at R_CERT. Returns 0 on success or
	* GPG_ERR_NOT_FOUND. */
	gpg_error_t
	find_issuing_cert (ctrl_t ctrl, ksba_cert_t cert, ksba_cert_t *r_cert)
	{
	gpg_error_t err;
	char *issuer_dn;
	ksba_cert_t issuer_cert = NULL;
	ksba_name_t authid;
	ksba_sexp_t authidno;
	ksba_sexp_t keyid;

	*r_cert = NULL;

	issuer_dn = ksba_cert_get_issuer (cert, 0);
	if (!issuer_dn)
	{
	log_error (_("no issuer found in certificate\n"));
	err = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}

	/* First we need to check whether we can return that certificate
	using the authorithyKeyIdentifier. */
	err = ksba_cert_get_auth_key_id (cert, &keyid, &authid, &authidno);
	if (err)
	{
	log_info (_("error getting authorityKeyIdentifier: %s\n"),
	gpg_strerror (err));
	}
	else
	{
	const char *s = ksba_name_enum (authid, 0);
	if (s && *authidno)
	{
	issuer_cert = find_cert_bysn (ctrl, s, authidno);
	}

	if (!issuer_cert && keyid)
	{
	/* Not found by issuer+s/n. Now that we have an AKI
	* keyIdentifier look for a certificate with a matching
	* SKI. */
	issuer_cert = find_cert_bysubject (ctrl, issuer_dn, keyid);
	}

	/* Print a note so that the user does not feel too helpless when
	* an issuer certificate was found and gpgsm prints BAD
	* signature because it is not the correct one. */
	if (!issuer_cert)
	{
	log_info ("issuer certificate ");
	if (keyid)
	{
	log_printf ("{");
	dump_serial (keyid);
	log_printf ("} ");
	}
	if (authidno)
	{
	log_printf ("(#");
	dump_serial (authidno);
	log_printf ("/");
	dump_string (s);
	log_printf (") ");
	}
	log_printf ("not found using authorityKeyIdentifier\n");
	}
	ksba_name_release (authid);
	xfree (authidno);
	xfree (keyid);
	}

	/* If this did not work, try just with the issuer's name and assume
	* that there is only one such certificate. We only look into our
	* cache then. */
	if (err \|\| !issuer_cert)
	{
	issuer_cert = get_cert_bysubject (issuer_dn, 0);
	if (issuer_cert)
	err = 0;
	}

	leave:
	if (!err && !issuer_cert)
	err = gpg_error (GPG_ERR_NOT_FOUND);

	xfree (issuer_dn);

	if (err)
	ksba_cert_release (issuer_cert);
	else
	*r_cert = issuer_cert;

	return err;
	}



	/* Read a list of certificates in PEM format from stream FP and store
	* them on success at R_CERTLIST. On error NULL is stored at R_CERT
	* list and an error code returned. Note that even on success an
	* empty list of certificates can be returned (i.e. NULL stored at
	* R_CERTLIST) iff the input stream has no certificates. */
	gpg_error_t
	read_certlist_from_stream (certlist_t *r_certlist, estream_t fp)
	{
	gpg_error_t err;
	gnupg_ksba_io_t ioctx = NULL;
	ksba_reader_t reader;
	ksba_cert_t cert = NULL;
	certlist_t certlist = NULL;
	certlist_t cl, *cltail;

	*r_certlist = NULL;

	err = gnupg_ksba_create_reader (&ioctx,
	(GNUPG_KSBA_IO_PEM \| GNUPG_KSBA_IO_MULTIPEM),
	fp, &reader);
	if (err)
	goto leave;

	/* Loop to read all certificates from the stream. */
	cltail = &certlist;
	do
	{
	ksba_cert_release (cert);
	cert = NULL;
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_read_der (cert, reader);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_EOF)
	err = 0;
	goto leave;
	}

	/* Append the certificate to the list. We also store the
	* fingerprint and check whether we have a cached certificate;
	* in that case the cached certificate is put into the list to
	* take advantage of a validation result which might be stored
	* in the cached certificate. */
	cl = xtrycalloc (1, sizeof *cl);
	if (!cl)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	cert_compute_fpr (cert, cl->fpr);
	cl->cert = get_cert_byfpr (cl->fpr);
	if (!cl->cert)
	{
	cl->cert = cert;
	cert = NULL;
	}
	*cltail = cl;
	cltail = &cl->next;
	ksba_reader_clear (reader, NULL, NULL);
	}
	while (!gnupg_ksba_reader_eof_seen (ioctx));

	leave:
	ksba_cert_release (cert);
	gnupg_ksba_destroy_reader (ioctx);
	if (err)
	release_certlist (certlist);
	else
	*r_certlist = certlist;

	return err;
	}


	/* Release the certificate list CL. */
	void
	release_certlist (certlist_t cl)
	{
	while (cl)
	{
	certlist_t next = cl->next;
	ksba_cert_release (cl->cert);
	cl = next;
	}
	}
	diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c
	index c60d3fb06..248ad9ad4 100644
	--- a/dirmngr/crlcache.c
	+++ b/dirmngr/crlcache.c
	@@ -1,2586 +1,2586 @@
	/* crlcache.c - LDAP access
	* Copyright (C) 2002 Klarälvdalens Datakonsult AB
	* Copyright (C) 2003, 2004, 2005, 2008 g10 Code GmbH
	*
	* This file is part of DirMngr.
	*
	* DirMngr is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 2 of the License, or
	* (at your option) any later version.
	*
	* DirMngr is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/*

	1. To keep track of the CRLs actually cached and to store the meta
	information of the CRLs a simple record oriented text file is
	used. Fields in the file are colon (':') separated and values
	containing colons or linefeeds are percent escaped (e.g. a colon
	itself is represented as "%3A").

	The first field is a record type identifier, so that the file is
	useful to keep track of other meta data too.

	The name of the file is "DIR.txt".


	1.1. Comment record

	Field 1: Constant beginning with "#".

	Other fields are not defined and such a record is simply
	skipped during processing.

	1.2. Version record

	Field 1: Constant "v"
	Field 2: Version number of this file. Must be 1.

	- This record must be the first non-comment record record and
	+ This record must be the first non-comment record and
	there shall only exist one record of this type.

	1.3. CRL cache record

	Field 1: Constant "c", "u" or "i".
	A "c" or "u" indicate a valid cache entry, however
	"u" requires that a user root certificate check needs
	to be done.
	An "i" indicates an invalid cache entry which should
	not be used but still exists so that it can be
	updated at NEXT_UPDATE.
	Field 2: Hexadecimal encoded SHA-1 hash of the issuer DN using
	uppercase letters.
	Field 3: Issuer DN in RFC-2253 notation.
	Field 4: URL used to retrieve the corresponding CRL.
	Field 5: 15 character ISO timestamp with THIS_UPDATE.
	Field 6: 15 character ISO timestamp with NEXT_UPDATE.
	Field 7: Hexadecimal encoded MD-5 hash of the DB file to detect
	accidental modified (i.e. deleted and created) cache files.
	Field 8: optional CRL number as a hex string.
	Field 9: AuthorityKeyID.issuer, each Name separated by 0x01
	Field 10: AuthorityKeyID.serial
	Field 11: Hex fingerprint of trust anchor if field 1 is 'u'.

	2. Layout of the standard CRL Cache DB file:

	We use records of variable length with this structure

	n bytes Serialnumber (binary) used as key
	thus there is no need to store the length explicitly with DB2.
	1 byte Reason for revocation
	(currently the KSBA reason flags are used)
	15 bytes ISO date of revocation (e.g. 19980815T142000)
	Note that there is no terminating 0 stored.

	The filename used is the hexadecimal (using uppercase letters)
	SHA-1 hash value of the issuer DN prefixed with a "crl-" and
	suffixed with a ".db". Thus the length of the filename is 47.


	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <errno.h>
	#include <string.h>
	#include <sys/stat.h>
	#include <assert.h>
	#include <dirent.h>
	#include <fcntl.h>
	#include <unistd.h>
	#ifndef HAVE_W32_SYSTEM
	#include <sys/utsname.h>
	#endif
	#ifdef MKDIR_TAKES_ONE_ARG
	#undef mkdir
	#define mkdir(a,b) mkdir(a)
	#endif

	#include "dirmngr.h"
	#include "validate.h"
	#include "certcache.h"
	#include "crlcache.h"
	#include "crlfetch.h"
	#include "misc.h"
	#include "cdb.h"

	/* Change this whenever the format changes */
	#define DBDIR_D "crls.d"
	#define DBDIRFILE "DIR.txt"
	#define DBDIRVERSION 1

	/* The number of DB files we may have open at one time. We need to
	limit this because there is no guarantee that the number of issuers
	has a upper limit. We are currently using mmap, so it is a good
	idea anyway to limit the number of opened cache files. */
	#define MAX_OPEN_DB_FILES 5


	static const char oidstr_crlNumber[] = "2.5.29.20";
	/* static const char oidstr_issuingDistributionPoint[] = "2.5.29.28"; */
	static const char oidstr_authorityKeyIdentifier[] = "2.5.29.35";


	/* Definition of one cached item. */
	struct crl_cache_entry_s
	{
	struct crl_cache_entry_s *next;
	int deleted; /* True if marked for deletion. */
	int mark; /* Internally used by update_dir. */
	unsigned int lineno;/* A 0 indicates a new entry. */
	char release_ptr; / The actual allocated memory. */
	char url; / Points into RELEASE_PTR. */
	char issuer; / Ditto. */
	char issuer_hash; / Ditto. */
	char dbfile_hash; / MD5 sum of the cache file, points into RELEASE_PTR.*/
	int invalid; /* Can't use this CRL. */
	int user_trust_req; /* User supplied root certificate required. */
	char check_trust_anchor; / Malloced fingerprint. */
	ksba_isotime_t this_update;
	ksba_isotime_t next_update;
	ksba_isotime_t last_refresh; /* Use for the force_crl_refresh feature. */
	char *crl_number;
	char *authority_issuer;
	char *authority_serialno;

	struct cdb cdb; / The cache file handle or NULL if not open. */

	unsigned int cdb_use_count; /* Current use count. */
	unsigned int cdb_lru_count; /* Used for LRU purposes. */
	int dbfile_checked; /* Set to true if the dbfile_hash value has
	been checked one. */
	};


	/* Definition of the entire cache object. */
	struct crl_cache_s
	{
	crl_cache_entry_t entries;
	};

	typedef struct crl_cache_s *crl_cache_t;


	/* Prototypes. */
	static crl_cache_entry_t find_entry (crl_cache_entry_t first,
	const char *issuer_hash);



	/* The currently loaded cache object. This is usually initialized
	right at startup. */
	static crl_cache_t current_cache;





	/* Return the current cache object or bail out if it is has not yet
	been initialized. */
	static crl_cache_t
	get_current_cache (void)
	{
	if (!current_cache)
	log_fatal ("CRL cache has not yet been initialized\n");
	return current_cache;
	}


	/*
	Create ae directory if it does not yet exists. Returns on
	success, or -1 on error.
	*/
	static int
	create_directory_if_needed (const char *name)
	{
	DIR *dir;
	char *fname;

	fname = make_filename (opt.homedir_cache, name, NULL);
	dir = opendir (fname);
	if (!dir)
	{
	log_info (_("creating directory '%s'\n"), fname);
	if (mkdir (fname, S_IRUSR\|S_IWUSR\|S_IXUSR) )
	{
	int save_errno = errno;
	log_error (_("error creating directory '%s': %s\n"),
	fname, strerror (errno));
	xfree (fname);
	gpg_err_set_errno (save_errno);
	return -1;
	}
	}
	else
	closedir (dir);
	xfree (fname);
	return 0;
	}

	/* Remove all files from the cache directory. If FORCE is not true,
	some sanity checks on the filenames are done. Return 0 if
	everything went fine. */
	static int
	cleanup_cache_dir (int force)
	{
	char *dname = make_filename (opt.homedir_cache, DBDIR_D, NULL);
	DIR *dir;
	struct dirent *de;
	int problem = 0;

	if (!force)
	{ /* Very minor sanity checks. */
	if (!strcmp (dname, "~/") \|\| !strcmp (dname, "/" ))
	{
	log_error (_("ignoring database dir '%s'\n"), dname);
	xfree (dname);
	return -1;
	}
	}

	dir = opendir (dname);
	if (!dir)
	{
	log_error (_("error reading directory '%s': %s\n"),
	dname, strerror (errno));
	xfree (dname);
	return -1;
	}

	while ((de = readdir (dir)))
	{
	if (strcmp (de->d_name, "." ) && strcmp (de->d_name, ".."))
	{
	char *cdbname = make_filename (dname, de->d_name, NULL);
	int okay;
	struct stat sbuf;

	if (force)
	okay = 1;
	else
	okay = (!stat (cdbname, &sbuf) && S_ISREG (sbuf.st_mode));

	if (okay)
	{
	log_info (_("removing cache file '%s'\n"), cdbname);
	if (gnupg_remove (cdbname))
	{
	log_error ("failed to remove '%s': %s\n",
	cdbname, strerror (errno));
	problem = -1;
	}
	}
	else
	log_info (_("not removing file '%s'\n"), cdbname);
	xfree (cdbname);
	}
	}
	xfree (dname);
	closedir (dir);
	return problem;
	}


	/* Read the next line from the file FP and return the line in an
	malloced buffer. Return NULL on error or EOF. There is no
	limitation os the line length. The trailing linefeed has been
	removed, the function will read the last line of a file, even if
	that is not terminated by a LF. */
	static char *
	next_line_from_file (estream_t fp, gpg_error_t *r_err)
	{
	char buf[300];
	char *largebuf = NULL;
	size_t buflen;
	size_t len = 0;
	unsigned char *p;
	int c;
	char *tmpbuf;

	*r_err = 0;
	p = buf;
	buflen = sizeof buf - 1;
	while ((c=es_getc (fp)) != EOF && c != '\n')
	{
	if (len >= buflen)
	{
	if (!largebuf)
	{
	buflen += 1024;
	largebuf = xtrymalloc ( buflen + 1 );
	if (!largebuf)
	{
	*r_err = gpg_error_from_syserror ();
	return NULL;
	}
	memcpy (largebuf, buf, len);
	}
	else
	{
	buflen += 1024;
	tmpbuf = xtryrealloc (largebuf, buflen + 1);
	if (!tmpbuf)
	{
	*r_err = gpg_error_from_syserror ();
	xfree (largebuf);
	return NULL;
	}
	largebuf = tmpbuf;
	}
	p = largebuf;
	}
	p[len++] = c;
	}
	if (c == EOF && !len)
	return NULL;
	p[len] = 0;

	if (largebuf)
	tmpbuf = xtryrealloc (largebuf, len+1);
	else
	tmpbuf = xtrystrdup (buf);
	if (!tmpbuf)
	{
	*r_err = gpg_error_from_syserror ();
	xfree (largebuf);
	}
	return tmpbuf;
	}


	/* Release one cache entry. */
	static void
	release_one_cache_entry (crl_cache_entry_t entry)
	{
	if (entry)
	{
	if (entry->cdb)
	{
	int fd = cdb_fileno (entry->cdb);
	cdb_free (entry->cdb);
	xfree (entry->cdb);
	if (close (fd))
	log_error (_("error closing cache file: %s\n"), strerror(errno));
	}
	xfree (entry->release_ptr);
	xfree (entry->check_trust_anchor);
	xfree (entry);
	}
	}


	/* Release the CACHE object. */
	static void
	release_cache (crl_cache_t cache)
	{
	crl_cache_entry_t entry, entry2;

	if (!cache)
	return;

	for (entry = cache->entries; entry; entry = entry2)
	{
	entry2 = entry->next;
	release_one_cache_entry (entry);
	}
	cache->entries = NULL;
	xfree (cache);
	}


	/* Open the dir file FNAME or create a new one if it does not yet
	exist. */
	static estream_t
	open_dir_file (const char *fname)
	{
	estream_t fp;

	fp = es_fopen (fname, "r");
	if (!fp)
	{
	log_error (_("failed to open cache dir file '%s': %s\n"),
	fname, strerror (errno));

	/* Make sure that the directory exists, try to create if otherwise. */
	if (create_directory_if_needed (NULL)
	\|\| create_directory_if_needed (DBDIR_D))
	return NULL;
	fp = es_fopen (fname, "w");
	if (!fp)
	{
	log_error (_("error creating new cache dir file '%s': %s\n"),
	fname, strerror (errno));
	return NULL;
	}
	es_fprintf (fp, "v:%d:\n", DBDIRVERSION);
	if (es_ferror (fp))
	{
	log_error (_("error writing new cache dir file '%s': %s\n"),
	fname, strerror (errno));
	es_fclose (fp);
	return NULL;
	}
	if (es_fclose (fp))
	{
	log_error (_("error closing new cache dir file '%s': %s\n"),
	fname, strerror (errno));
	return NULL;
	}

	log_info (_("new cache dir file '%s' created\n"), fname);

	fp = es_fopen (fname, "r");
	if (!fp)
	{
	log_error (_("failed to re-open cache dir file '%s': %s\n"),
	fname, strerror (errno));
	return NULL;
	}
	}

	return fp;
	}

	/* Helper for open_dir. */
	static gpg_error_t
	check_dir_version (estream_t fpadr, const char fname,
	unsigned int *lineno,
	int cleanup_on_mismatch)
	{
	char *line;
	gpg_error_t lineerr = 0;
	estream_t fp = *fpadr;
	int created = 0;

	retry:
	while ((line = next_line_from_file (fp, &lineerr)))
	{
	++*lineno;
	if (*line == 'v' && line[1] == ':')
	break;
	else if (*line != '#')
	{
	log_error (_("first record of '%s' is not the version\n"), fname);
	xfree (line);
	return gpg_error (GPG_ERR_CONFIGURATION);
	}
	xfree (line);
	}
	if (lineerr)
	return lineerr;

	/* The !line catches the case of an empty DIR file. We handle this
	the same as a non-matching version. */
	if (!line \|\| strtol (line+2, NULL, 10) != DBDIRVERSION)
	{
	if (!created && cleanup_on_mismatch)
	{
	log_error (_("old version of cache directory - cleaning up\n"));
	es_fclose (fp);
	*fpadr = NULL;
	if (!cleanup_cache_dir (1))
	{
	*lineno = 0;
	fp = *fpadr = open_dir_file (fname);
	if (!fp)
	{
	xfree (line);
	return gpg_error (GPG_ERR_CONFIGURATION);
	}
	created = 1;
	goto retry;
	}
	}
	log_error (_("old version of cache directory - giving up\n"));
	xfree (line);
	return gpg_error (GPG_ERR_CONFIGURATION);
	}
	xfree (line);
	return 0;
	}


	/* Open the dir file and read in all available information. Store
	that in a newly allocated cache object and return that if
	everything worked out fine. Create the cache directory and the dir
	if it does not yet exist. Remove all files in that directory if
	the version does not match. */
	static gpg_error_t
	open_dir (crl_cache_t *r_cache)
	{
	crl_cache_t cache;
	char *fname;
	char *line = NULL;
	gpg_error_t lineerr = 0;
	estream_t fp;
	crl_cache_entry_t entry, *entrytail;
	unsigned int lineno;
	gpg_error_t err = 0;
	int anyerr = 0;

	cache = xtrycalloc (1, sizeof *cache);
	if (!cache)
	return gpg_error_from_syserror ();

	fname = make_filename (opt.homedir_cache, DBDIR_D, DBDIRFILE, NULL);

	lineno = 0;
	fp = open_dir_file (fname);
	if (!fp)
	{
	err = gpg_error (GPG_ERR_CONFIGURATION);
	goto leave;
	}

	err = check_dir_version (&fp, fname, &lineno, 1);
	if (err)
	goto leave;


	/* Read in all supported entries from the dir file. */
	cache->entries = NULL;
	entrytail = &cache->entries;
	xfree (line);
	while ((line = next_line_from_file (fp, &lineerr)))
	{
	int fieldno;
	char p, endp;

	lineno++;
	if ( line == 'c' \|\| line == 'u' \|\| *line == 'i' )
	{
	entry = xtrycalloc (1, sizeof *entry);
	if (!entry)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	entry->lineno = lineno;
	entry->release_ptr = line;
	if (*line == 'i')
	{
	entry->invalid = atoi (line+1);
	if (entry->invalid < 1)
	entry->invalid = 1;
	}
	else if (*line == 'u')
	entry->user_trust_req = 1;

	for (fieldno=1, p = line; p; p = endp, fieldno++)
	{
	endp = strchr (p, ':');
	if (endp)
	*endp++ = '\0';

	switch (fieldno)
	{
	case 1: /* record type */ break;
	case 2: entry->issuer_hash = p; break;
	case 3: entry->issuer = unpercent_string (p); break;
	case 4: entry->url = unpercent_string (p); break;
	case 5:
	strncpy (entry->this_update, p, 15);
	entry->this_update[15] = 0;
	break;
	case 6:
	strncpy (entry->next_update, p, 15);
	entry->next_update[15] = 0;
	break;
	case 7: entry->dbfile_hash = p; break;
	case 8: if (*p) entry->crl_number = p; break;
	case 9:
	if (*p)
	entry->authority_issuer = unpercent_string (p);
	break;
	case 10:
	if (*p)
	entry->authority_serialno = unpercent_string (p);
	break;
	case 11:
	if (*p)
	entry->check_trust_anchor = xtrystrdup (p);
	break;
	default:
	if (*p)
	log_info (_("extra field detected in crl record of "
	"'%s' line %u\n"), fname, lineno);
	break;
	}
	}

	if (!entry->issuer_hash)
	{
	log_info (_("invalid line detected in '%s' line %u\n"),
	fname, lineno);
	xfree (entry);
	entry = NULL;
	}
	else if (find_entry (cache->entries, entry->issuer_hash))
	{
	/* Fixme: The duplicate checking used is not very
	effective for large numbers of issuers. */
	log_info (_("duplicate entry detected in '%s' line %u\n"),
	fname, lineno);
	xfree (entry);
	entry = NULL;
	}
	else
	{
	line = NULL;
	*entrytail = entry;
	entrytail = &entry->next;
	}
	}
	else if (*line == '#')
	;
	else
	log_info (_("unsupported record type in '%s' line %u skipped\n"),
	fname, lineno);

	if (line)
	xfree (line);
	}
	if (lineerr)
	{
	err = lineerr;
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}
	if (es_ferror (fp))
	{
	log_error (_("error reading '%s': %s\n"), fname, strerror (errno));
	err = gpg_error (GPG_ERR_CONFIGURATION);
	goto leave;
	}

	/* Now do some basic checks on the data. */
	for (entry = cache->entries; entry; entry = entry->next)
	{
	assert (entry->lineno);
	if (strlen (entry->issuer_hash) != 40)
	{
	anyerr++;
	log_error (_("invalid issuer hash in '%s' line %u\n"),
	fname, entry->lineno);
	}
	else if ( !*entry->issuer )
	{
	anyerr++;
	log_error (_("no issuer DN in '%s' line %u\n"),
	fname, entry->lineno);
	}
	else if ( check_isotime (entry->this_update)
	\|\| check_isotime (entry->next_update))
	{
	anyerr++;
	log_error (_("invalid timestamp in '%s' line %u\n"),
	fname, entry->lineno);
	}

	/* Checks not leading to an immediate fail. */
	if (strlen (entry->dbfile_hash) != 32)
	log_info (_("WARNING: invalid cache file hash in '%s' line %u\n"),
	fname, entry->lineno);
	}

	if (anyerr)
	{
	log_error (_("detected errors in cache dir file\n"));
	log_info (_("please check the reason and manually delete that file\n"));
	err = gpg_error (GPG_ERR_CONFIGURATION);
	}


	leave:
	es_fclose (fp);
	xfree (line);
	xfree (fname);
	if (err)
	{
	release_cache (cache);
	cache = NULL;
	}
	*r_cache = cache;
	return err;
	}

	static void
	write_percented_string (const char *s, estream_t fp)
	{
	for (; *s; s++)
	if (*s == ':')
	es_fputs ("%3A", fp);
	else if (*s == '\n')
	es_fputs ("%0A", fp);
	else if (*s == '\r')
	es_fputs ("%0D", fp);
	else
	es_putc (*s, fp);
	}


	static void
	write_dir_line_crl (estream_t fp, crl_cache_entry_t e)
	{
	if (e->invalid)
	es_fprintf (fp, "i%d", e->invalid);
	else if (e->user_trust_req)
	es_putc ('u', fp);
	else
	es_putc ('c', fp);
	es_putc (':', fp);
	es_fputs (e->issuer_hash, fp);
	es_putc (':', fp);
	write_percented_string (e->issuer, fp);
	es_putc (':', fp);
	write_percented_string (e->url, fp);
	es_putc (':', fp);
	es_fwrite (e->this_update, 15, 1, fp);
	es_putc (':', fp);
	es_fwrite (e->next_update, 15, 1, fp);
	es_putc (':', fp);
	es_fputs (e->dbfile_hash, fp);
	es_putc (':', fp);
	if (e->crl_number)
	es_fputs (e->crl_number, fp);
	es_putc (':', fp);
	if (e->authority_issuer)
	write_percented_string (e->authority_issuer, fp);
	es_putc (':', fp);
	if (e->authority_serialno)
	es_fputs (e->authority_serialno, fp);
	es_putc (':', fp);
	if (e->check_trust_anchor && e->user_trust_req)
	es_fputs (e->check_trust_anchor, fp);
	es_putc ('\n', fp);
	}


	/* Update the current dir file using the cache. */
	static gpg_error_t
	update_dir (crl_cache_t cache)
	{
	char *fname = NULL;
	char *tmpfname = NULL;
	char *line = NULL;
	gpg_error_t lineerr = 0;
	estream_t fp;
	estream_t fpout = NULL;
	crl_cache_entry_t e;
	unsigned int lineno;
	gpg_error_t err = 0;

	fname = make_filename (opt.homedir_cache, DBDIR_D, DBDIRFILE, NULL);

	/* Fixme: Take an update file lock here. */

	for (e= cache->entries; e; e = e->next)
	e->mark = 1;

	lineno = 0;
	fp = es_fopen (fname, "r");
	if (!fp)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("failed to open cache dir file '%s': %s\n"),
	fname, strerror (errno));
	goto leave;
	}
	err = check_dir_version (&fp, fname, &lineno, 0);
	if (err)
	goto leave;
	es_rewind (fp);
	lineno = 0;

	/* Create a temporary DIR file. */
	{
	char tmpbuf, p;
	const char *nodename;
	#ifndef HAVE_W32_SYSTEM
	struct utsname utsbuf;
	#endif

	#ifdef HAVE_W32_SYSTEM
	nodename = "unknown";
	#else
	if (uname (&utsbuf))
	nodename = "unknown";
	else
	nodename = utsbuf.nodename;
	#endif

	gpgrt_asprintf (&tmpbuf, "DIR-tmp-%s-%u-%p.txt.tmp",
	nodename, (unsigned int)getpid (), &tmpbuf);
	if (!tmpbuf)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("failed to create temporary cache dir file '%s': %s\n"),
	tmpfname, strerror (errno));
	goto leave;
	}
	for (p=tmpbuf; *p; p++)
	if (*p == '/')
	*p = '.';
	tmpfname = make_filename (opt.homedir_cache, DBDIR_D, tmpbuf, NULL);
	xfree (tmpbuf);
	}
	fpout = es_fopen (tmpfname, "w");
	if (!fpout)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("failed to create temporary cache dir file '%s': %s\n"),
	tmpfname, strerror (errno));
	goto leave;
	}

	while ((line = next_line_from_file (fp, &lineerr)))
	{
	lineno++;
	if (line == 'c' \|\| line == 'u' \|\| *line == 'i')
	{
	/* Extract the issuer hash field. */
	char fieldp, endp;

	fieldp = strchr (line, ':');
	endp = fieldp? strchr (++fieldp, ':') : NULL;
	if (endp)
	{
	/* There should be no percent within the issuer hash
	field, thus we can compare it pretty easily. */
	*endp = 0;
	e = find_entry ( cache->entries, fieldp);
	endp = ':'; / Restore original line. */
	if (e && e->deleted)
	{
	/* Marked for deletion, so don't write it. */
	e->mark = 0;
	}
	else if (e)
	{
	/* Yep, this is valid entry we know about; write it out */
	write_dir_line_crl (fpout, e);
	e->mark = 0;
	}
	else
	{ /* We ignore entries we don't have in our cache
	because they may have been added in the meantime
	by other instances of dirmngr. */
	es_fprintf (fpout, "# Next line added by "
	"another process; our pid is %lu\n",
	(unsigned long)getpid ());
	es_fputs (line, fpout);
	es_putc ('\n', fpout);
	}
	}
	else
	{
	es_fputs ("# Invalid line detected: ", fpout);
	es_fputs (line, fpout);
	es_putc ('\n', fpout);
	}
	}
	else
	{
	/* Write out all non CRL lines as they are. */
	es_fputs (line, fpout);
	es_putc ('\n', fpout);
	}

	xfree (line);
	}
	if (!es_ferror (fp) && !es_ferror (fpout) && !lineerr)
	{
	/* Write out the remaining entries. */
	for (e= cache->entries; e; e = e->next)
	if (e->mark)
	{
	if (!e->deleted)
	write_dir_line_crl (fpout, e);
	e->mark = 0;
	}
	}
	if (lineerr)
	{
	err = lineerr;
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}
	if (es_ferror (fp))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error reading '%s': %s\n"), fname, strerror (errno));
	}
	if (es_ferror (fpout))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error writing '%s': %s\n"), tmpfname, strerror (errno));
	}
	if (err)
	goto leave;

	/* Rename the files. */
	es_fclose (fp);
	fp = NULL;
	if (es_fclose (fpout))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error closing '%s': %s\n"), tmpfname, strerror (errno));
	goto leave;
	}
	fpout = NULL;

	#ifdef HAVE_W32_SYSTEM
	/* No atomic mv on W32 systems. */
	gnupg_remove (fname);
	#endif
	if (rename (tmpfname, fname))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error renaming '%s' to '%s': %s\n"),
	tmpfname, fname, strerror (errno));
	goto leave;
	}

	leave:
	/* Fixme: Relinquish update lock. */
	xfree (line);
	es_fclose (fp);
	xfree (fname);
	if (fpout)
	{
	es_fclose (fpout);
	if (err && tmpfname)
	gnupg_remove (tmpfname);
	}
	xfree (tmpfname);
	return err;
	}




	/* Create the filename for the cache file from the 40 byte ISSUER_HASH
	string. Caller must release the return string. */
	static char *
	make_db_file_name (const char *issuer_hash)
	{
	char bname[50];

	assert (strlen (issuer_hash) == 40);
	memcpy (bname, "crl-", 4);
	memcpy (bname + 4, issuer_hash, 40);
	strcpy (bname + 44, ".db");
	return make_filename (opt.homedir_cache, DBDIR_D, bname, NULL);
	}


	/* Hash the file FNAME and return the MD5 digest in MD5BUFFER. The
	caller must allocate MD%buffer wityh at least 16 bytes. Returns 0
	on success. */
	static int
	hash_dbfile (const char fname, unsigned char md5buffer)
	{
	estream_t fp;
	char *buffer;
	size_t n;
	gcry_md_hd_t md5;
	gpg_error_t err;

	buffer = xtrymalloc (65536);
	fp = buffer? es_fopen (fname, "rb") : NULL;
	if (!fp)
	{
	log_error (_("can't hash '%s': %s\n"), fname, strerror (errno));
	xfree (buffer);
	return -1;
	}

	err = gcry_md_open (&md5, GCRY_MD_MD5, 0);
	if (err)
	{
	log_error (_("error setting up MD5 hash context: %s\n"),
	gpg_strerror (err));
	xfree (buffer);
	es_fclose (fp);
	return -1;
	}

	/* We better hash some information about the cache file layout in. */
	sprintf (buffer, "%.100s/%.100s:%d", DBDIR_D, DBDIRFILE, DBDIRVERSION);
	gcry_md_write (md5, buffer, strlen (buffer));

	for (;;)
	{
	n = es_fread (buffer, 1, 65536, fp);
	if (n < 65536 && es_ferror (fp))
	{
	log_error (_("error hashing '%s': %s\n"), fname, strerror (errno));
	xfree (buffer);
	es_fclose (fp);
	gcry_md_close (md5);
	return -1;
	}
	if (!n)
	break;
	gcry_md_write (md5, buffer, n);
	}
	es_fclose (fp);
	xfree (buffer);
	gcry_md_final (md5);

	memcpy (md5buffer, gcry_md_read (md5, GCRY_MD_MD5), 16);
	gcry_md_close (md5);
	return 0;
	}

	/* Compare the file FNAME against the dexified MD5 hash MD5HASH and
	return 0 if they match. */
	static int
	check_dbfile (const char fname, const char md5hexvalue)
	{
	unsigned char buffer1[16], buffer2[16];

	if (strlen (md5hexvalue) != 32)
	{
	log_error (_("invalid formatted checksum for '%s'\n"), fname);
	return -1;
	}
	unhexify (buffer1, md5hexvalue);

	if (hash_dbfile (fname, buffer2))
	return -1;

	return memcmp (buffer1, buffer2, 16);
	}


	/* Open the cache file for ENTRY. This function implements a caching
	strategy and might close unused cache files. It is required to use
	unlock_db_file after using the file. */
	static struct cdb *
	lock_db_file (crl_cache_t cache, crl_cache_entry_t entry)
	{
	char *fname;
	int fd;
	int open_count;
	crl_cache_entry_t e;

	if (entry->cdb)
	{
	entry->cdb_use_count++;
	return entry->cdb;
	}

	for (open_count = 0, e = cache->entries; e; e = e->next)
	{
	if (e->cdb)
	open_count++;
	/* log_debug ("CACHE: cdb=%p use_count=%u lru_count=%u\n", */
	/* e->cdb,e->cdb_use_count,e->cdb_lru_count); */
	}

	/* If there are too many file open, find the least recent used DB
	file and close it. Note that for Pth thread safeness we need to
	use a loop here. */
	while (open_count >= MAX_OPEN_DB_FILES )
	{
	crl_cache_entry_t last_e = NULL;
	unsigned int last_lru = (unsigned int)(-1);

	for (e = cache->entries; e; e = e->next)
	if (e->cdb && !e->cdb_use_count && e->cdb_lru_count < last_lru)
	{
	last_lru = e->cdb_lru_count;
	last_e = e;
	}
	if (!last_e)
	{
	log_error (_("too many open cache files; can't open anymore\n"));
	return NULL;
	}

	/* log_debug ("CACHE: closing file at cdb=%p\n", last_e->cdb); */

	fd = cdb_fileno (last_e->cdb);
	cdb_free (last_e->cdb);
	xfree (last_e->cdb);
	last_e->cdb = NULL;
	if (close (fd))
	log_error (_("error closing cache file: %s\n"), strerror(errno));
	open_count--;
	}


	fname = make_db_file_name (entry->issuer_hash);
	if (opt.verbose)
	log_info (_("opening cache file '%s'\n"), fname );

	if (!entry->dbfile_checked)
	{
	if (!check_dbfile (fname, entry->dbfile_hash))
	entry->dbfile_checked = 1;
	/* Note, in case of an error we don't print an error here but
	let require the caller to do that check. */
	}

	entry->cdb = xtrycalloc (1, sizeof *entry->cdb);
	if (!entry->cdb)
	{
	xfree (fname);
	return NULL;
	}
	fd = open (fname, O_RDONLY);
	if (fd == -1)
	{
	log_error (_("error opening cache file '%s': %s\n"),
	fname, strerror (errno));
	xfree (entry->cdb);
	entry->cdb = NULL;
	xfree (fname);
	return NULL;
	}
	if (cdb_init (entry->cdb, fd))
	{
	log_error (_("error initializing cache file '%s' for reading: %s\n"),
	fname, strerror (errno));
	xfree (entry->cdb);
	entry->cdb = NULL;
	close (fd);
	xfree (fname);
	return NULL;
	}
	xfree (fname);

	entry->cdb_use_count = 1;
	entry->cdb_lru_count = 0;

	return entry->cdb;
	}

	/* Unlock a cache file, so that it can be reused. */
	static void
	unlock_db_file (crl_cache_t cache, crl_cache_entry_t entry)
	{
	if (!entry->cdb)
	log_error (_("calling unlock_db_file on a closed file\n"));
	else if (!entry->cdb_use_count)
	log_error (_("calling unlock_db_file on an unlocked file\n"));
	else
	{
	entry->cdb_use_count--;
	entry->cdb_lru_count++;
	}

	/* If the entry was marked for deletion in the meantime do it now.
	We do this for the sake of Pth thread safeness. */
	if (!entry->cdb_use_count && entry->deleted)
	{
	crl_cache_entry_t eprev, enext;

	enext = entry->next;
	for (eprev = cache->entries;
	eprev && eprev->next != entry; eprev = eprev->next)
	;
	assert (eprev);
	if (eprev == cache->entries)
	cache->entries = enext;
	else
	eprev->next = enext;
	/* FIXME: Do we leak ENTRY? */
	}
	}


	/* Find ISSUER_HASH in our cache FIRST. This may be used to enumerate
	the linked list we use to keep the CRLs of an issuer. */
	static crl_cache_entry_t
	find_entry (crl_cache_entry_t first, const char *issuer_hash)
	{
	while (first && (first->deleted \|\| strcmp (issuer_hash, first->issuer_hash)))
	first = first->next;
	return first;
	}


	/* Create a new CRL cache. This function is usually called only once.
	never fail. */
	void
	crl_cache_init(void)
	{
	crl_cache_t cache = NULL;
	gpg_error_t err;

	if (current_cache)
	{
	log_error ("crl cache has already been initialized - not doing twice\n");
	return;
	}

	err = open_dir (&cache);
	if (err)
	log_fatal (_("failed to create a new cache object: %s\n"),
	gpg_strerror (err));
	current_cache = cache;
	}


	/* Remove the cache information and all its resources. Note that we
	still keep the cache on disk. */
	void
	crl_cache_deinit (void)
	{
	if (current_cache)
	{
	release_cache (current_cache);
	current_cache = NULL;
	}
	}


	/* Delete the cache from disk. Return 0 on success.*/
	int
	crl_cache_flush (void)
	{
	int rc;

	rc = cleanup_cache_dir (0)? -1 : 0;

	return rc;
	}


	/* Check whether the certificate identified by ISSUER_HASH and
	SN/SNLEN is valid; i.e. not listed in our cache. With
	FORCE_REFRESH set to true, a new CRL will be retrieved even if the
	cache has not yet expired. We use a 30 minutes threshold here so
	that invoking this function several times won't load the CRL over
	and over. */
	static crl_cache_result_t
	cache_isvalid (ctrl_t ctrl, const char *issuer_hash,
	const unsigned char *sn, size_t snlen,
	int force_refresh)
	{
	crl_cache_t cache = get_current_cache ();
	crl_cache_result_t retval;
	struct cdb *cdb;
	int rc;
	crl_cache_entry_t entry;
	gnupg_isotime_t current_time;
	size_t n;

	(void)ctrl;

	entry = find_entry (cache->entries, issuer_hash);
	if (!entry)
	{
	log_info (_("no CRL available for issuer id %s\n"), issuer_hash );
	return CRL_CACHE_DONTKNOW;
	}

	gnupg_get_isotime (current_time);
	if (strcmp (entry->next_update, current_time) < 0 )
	{
	log_info (_("cached CRL for issuer id %s too old; update required\n"),
	issuer_hash);
	return CRL_CACHE_DONTKNOW;
	}
	if (force_refresh)
	{
	gnupg_isotime_t tmptime;

	if (*entry->last_refresh)
	{
	gnupg_copy_time (tmptime, entry->last_refresh);
	add_seconds_to_isotime (tmptime, 30 * 60);
	if (strcmp (tmptime, current_time) < 0 )
	{
	log_info (_("force-crl-refresh active and %d minutes passed for"
	" issuer id %s; update required\n"),
	30, issuer_hash);
	return CRL_CACHE_DONTKNOW;
	}
	}
	else
	{
	log_info (_("force-crl-refresh active for"
	" issuer id %s; update required\n"),
	issuer_hash);
	return CRL_CACHE_DONTKNOW;
	}
	}

	if (entry->invalid)
	{
	log_info (_("available CRL for issuer ID %s can't be used\n"),
	issuer_hash);
	return CRL_CACHE_CANTUSE;
	}

	cdb = lock_db_file (cache, entry);
	if (!cdb)
	return CRL_CACHE_DONTKNOW; /* Hmmm, not the best error code. */

	if (!entry->dbfile_checked)
	{
	log_error (_("cached CRL for issuer id %s tampered; we need to update\n")
	, issuer_hash);
	unlock_db_file (cache, entry);
	return CRL_CACHE_DONTKNOW;
	}

	rc = cdb_find (cdb, sn, snlen);
	if (rc == 1)
	{
	n = cdb_datalen (cdb);
	if (n != 16)
	{
	log_error (_("WARNING: invalid cache record length for S/N "));
	log_printf ("0x");
	log_printhex ("", sn, snlen);
	}
	else if (opt.verbose)
	{
	unsigned char record[16];
	char *tmp = hexify_data (sn, snlen, 1);

	if (cdb_read (cdb, record, n, cdb_datapos (cdb)))
	log_error (_("problem reading cache record for S/N %s: %s\n"),
	tmp, strerror (errno));
	else
	log_info (_("S/N %s is not valid; reason=%02X date=%.15s\n"),
	tmp, *record, record+1);
	xfree (tmp);
	}
	retval = CRL_CACHE_INVALID;
	}
	else if (!rc)
	{
	if (opt.verbose)
	{
	char *serialno = hexify_data (sn, snlen, 1);
	log_info (_("S/N %s is valid, it is not listed in the CRL\n"),
	serialno );
	xfree (serialno);
	}
	retval = CRL_CACHE_VALID;
	}
	else
	{
	log_error (_("error getting data from cache file: %s\n"),
	strerror (errno));
	retval = CRL_CACHE_DONTKNOW;
	}


	if (entry->user_trust_req
	&& (retval == CRL_CACHE_VALID \|\| retval == CRL_CACHE_INVALID))
	{
	if (!entry->check_trust_anchor)
	{
	log_error ("inconsistent data on user trust check\n");
	retval = CRL_CACHE_CANTUSE;
	}
	else if (get_istrusted_from_client (ctrl, entry->check_trust_anchor))
	{
	if (opt.verbose)
	log_info ("no system trust and client does not trust either\n");
	retval = CRL_CACHE_CANTUSE;
	}
	else
	{
	/* Okay, the CRL is considered valid by the client and thus
	we can return the result as is. */
	}
	}

	unlock_db_file (cache, entry);

	return retval;
	}


	/* Check whether the certificate identified by ISSUER_HASH and
	SERIALNO is valid; i.e. not listed in our cache. With
	FORCE_REFRESH set to true, a new CRL will be retrieved even if the
	cache has not yet expired. We use a 30 minutes threshold here so
	that invoking this function several times won't load the CRL over
	and over. */
	crl_cache_result_t
	crl_cache_isvalid (ctrl_t ctrl, const char issuer_hash, const char serialno,
	int force_refresh)
	{
	crl_cache_result_t result;
	unsigned char snbuf_buffer[50];
	unsigned char *snbuf;
	size_t n;

	n = strlen (serialno)/2+1;
	if (n < sizeof snbuf_buffer - 1)
	snbuf = snbuf_buffer;
	else
	{
	snbuf = xtrymalloc (n);
	if (!snbuf)
	return CRL_CACHE_DONTKNOW;
	}

	n = unhexify (snbuf, serialno);

	result = cache_isvalid (ctrl, issuer_hash, snbuf, n, force_refresh);

	if (snbuf != snbuf_buffer)
	xfree (snbuf);

	return result;
	}


	/* Check whether the certificate CERT is valid; i.e. not listed in our
	cache. With FORCE_REFRESH set to true, a new CRL will be retrieved
	even if the cache has not yet expired. We use a 30 minutes
	threshold here so that invoking this function several times won't
	load the CRL over and over. */
	gpg_error_t
	crl_cache_cert_isvalid (ctrl_t ctrl, ksba_cert_t cert,
	int force_refresh)
	{
	gpg_error_t err;
	crl_cache_result_t result;
	unsigned char issuerhash[20];
	char issuerhash_hex[41];
	ksba_sexp_t serial;
	unsigned char *sn;
	size_t snlen;
	char endp, tmp;
	int i;

	/* Compute the hash value of the issuer name. */
	tmp = ksba_cert_get_issuer (cert, 0);
	if (!tmp)
	{
	log_error ("oops: issuer missing in certificate\n");
	return gpg_error (GPG_ERR_INV_CERT_OBJ);
	}
	gcry_md_hash_buffer (GCRY_MD_SHA1, issuerhash, tmp, strlen (tmp));
	xfree (tmp);
	for (i=0,tmp=issuerhash_hex; i < 20; i++, tmp += 2)
	sprintf (tmp, "%02X", issuerhash[i]);

	/* Get the serial number. */
	serial = ksba_cert_get_serial (cert);
	if (!serial)
	{
	log_error ("oops: S/N missing in certificate\n");
	return gpg_error (GPG_ERR_INV_CERT_OBJ);
	}
	sn = serial;
	if (*sn != '(')
	{
	log_error ("oops: invalid S/N\n");
	xfree (serial);
	return gpg_error (GPG_ERR_INV_CERT_OBJ);
	}
	sn++;
	snlen = strtoul (sn, &endp, 10);
	sn = endp;
	if (*sn != ':')
	{
	log_error ("oops: invalid S/N\n");
	xfree (serial);
	return gpg_error (GPG_ERR_INV_CERT_OBJ);
	}
	sn++;

	/* Check the cache. */
	result = cache_isvalid (ctrl, issuerhash_hex, sn, snlen, force_refresh);
	switch (result)
	{
	case CRL_CACHE_VALID:
	err = 0;
	break;
	case CRL_CACHE_INVALID:
	err = gpg_error (GPG_ERR_CERT_REVOKED);
	break;
	case CRL_CACHE_DONTKNOW:
	err = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	break;
	case CRL_CACHE_CANTUSE:
	err = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	break;
	default:
	log_fatal ("cache_isvalid returned invalid status code %d\n", result);
	}

	xfree (serial);
	return err;
	}


	/* Prepare a hash context for the signature verification. Input is
	the CRL and the output is the hash context MD as well as the uses
	algorithm identifier ALGO. */
	static gpg_error_t
	start_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo)
	{
	gpg_error_t err;
	const char *algoid;

	algoid = ksba_crl_get_digest_algo (crl);
	*algo = gcry_md_map_name (algoid);
	if (!*algo)
	{
	log_error (_("unknown hash algorithm '%s'\n"), algoid? algoid:"?");
	return gpg_error (GPG_ERR_DIGEST_ALGO);
	}

	err = gcry_md_open (md, *algo, 0);
	if (err)
	{
	log_error (_("gcry_md_open for algorithm %d failed: %s\n"),
	*algo, gcry_strerror (err));
	return err;
	}
	if (DBG_HASHING)
	gcry_md_debug (*md, "hash.cert");

	ksba_crl_set_hash_function (crl, HASH_FNC, *md);
	return 0;
	}


	/* Finish a hash context and verify the signature. This function
	should return 0 on a good signature, GPG_ERR_BAD_SIGNATURE if the
	signature does not verify or any other error code. CRL is the CRL
	object we are working on, MD the hash context and ISSUER_CERT the
	certificate of the CRL issuer. This function closes MD. */
	static gpg_error_t
	finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo,
	ksba_cert_t issuer_cert)
	{
	gpg_error_t err;
	ksba_sexp_t sigval = NULL, pubkey = NULL;
	const char *s;
	char algoname[50];
	size_t n;
	gcry_sexp_t s_sig = NULL, s_hash = NULL, s_pkey = NULL;
	unsigned int i;

	/* This also stops debugging on the MD. */
	gcry_md_final (md);

	/* Get and convert the signature value. */
	sigval = ksba_crl_get_sig_val (crl);
	n = gcry_sexp_canon_len (sigval, 0, NULL, NULL);
	if (!n)
	{
	log_error (_("got an invalid S-expression from libksba\n"));
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto leave;
	}
	err = gcry_sexp_sscan (&s_sig, NULL, sigval, n);
	if (err)
	{
	log_error (_("converting S-expression failed: %s\n"),
	gcry_strerror (err));
	goto leave;
	}

	/* Get and convert the public key for the issuer certificate. */
	if (DBG_X509)
	dump_cert ("crl_issuer_cert", issuer_cert);
	pubkey = ksba_cert_get_public_key (issuer_cert);
	n = gcry_sexp_canon_len (pubkey, 0, NULL, NULL);
	if (!n)
	{
	log_error (_("got an invalid S-expression from libksba\n"));
	err = gpg_error (GPG_ERR_INV_SEXP);
	goto leave;
	}
	err = gcry_sexp_sscan (&s_pkey, NULL, pubkey, n);
	if (err)
	{
	log_error (_("converting S-expression failed: %s\n"),
	gcry_strerror (err));
	goto leave;
	}

	/* Create an S-expression with the actual hash value. */
	s = gcry_md_algo_name (algo);
	for (i = 0; *s && i < sizeof(algoname) - 1; s++, i++)
	algoname[i] = ascii_tolower (*s);
	algoname[i] = 0;
	err = gcry_sexp_build (&s_hash, NULL, "(data(flags pkcs1)(hash %s %b))",
	algoname,
	gcry_md_get_algo_dlen (algo), gcry_md_read (md, algo));
	if (err)
	{
	log_error (_("creating S-expression failed: %s\n"), gcry_strerror (err));
	goto leave;
	}

	/* Pass this on to the signature verification. */
	err = gcry_pk_verify (s_sig, s_hash, s_pkey);
	if (DBG_X509)
	log_debug ("gcry_pk_verify: %s\n", gpg_strerror (err));

	leave:
	xfree (sigval);
	xfree (pubkey);
	gcry_sexp_release (s_sig);
	gcry_sexp_release (s_hash);
	gcry_sexp_release (s_pkey);
	gcry_md_close (md);

	return err;
	}


	/* Call this to match a start_sig_check that can not be completed
	normally. */
	static void
	abort_sig_check (ksba_crl_t crl, gcry_md_hd_t md)
	{
	(void)crl;
	gcry_md_close (md);
	}


	/* Workhorse of the CRL loading machinery. The CRL is read using the
	CRL object and stored in the data base file DB with the name FNAME
	(only used for printing error messages). That DB should be a
	temporary one and not the actual one. If the function fails the
	caller should delete this temporary database file. CTRL is
	required to retrieve certificates using the general dirmngr
	callback service. R_CRLISSUER returns an allocated string with the
	crl-issuer DN, THIS_UPDATE and NEXT_UPDATE are filled with the
	corresponding data from the CRL. Note that these values might get
	set even if the CRL processing fails at a later step; thus the
	caller should free *R_ISSUER even if the function returns with an
	error. R_TRUST_ANCHOR is set on exit to NULL or a string with the
	hexified fingerprint of the root certificate, if checking this
	certificate for trustiness is required.
	*/
	static int
	crl_parse_insert (ctrl_t ctrl, ksba_crl_t crl,
	struct cdb_make cdb, const char fname,
	char **r_crlissuer,
	ksba_isotime_t thisupdate, ksba_isotime_t nextupdate,
	char **r_trust_anchor)
	{
	gpg_error_t err;
	ksba_stop_reason_t stopreason;
	ksba_cert_t crlissuer_cert = NULL;
	gcry_md_hd_t md = NULL;
	int algo = 0;
	size_t n;

	(void)fname;

	*r_crlissuer = NULL;
	thisupdate = nextupdate = 0;
	*r_trust_anchor = NULL;

	/* Start of the KSBA parser loop. */
	do
	{
	err = ksba_crl_parse (crl, &stopreason);
	if (err)
	{
	log_error (_("ksba_crl_parse failed: %s\n"), gpg_strerror (err) );
	goto failure;
	}

	switch (stopreason)
	{
	case KSBA_SR_BEGIN_ITEMS:
	{
	err = start_sig_check (crl, &md, &algo);
	if (err)
	goto failure;

	err = ksba_crl_get_update_times (crl, thisupdate, nextupdate);
	if (err)
	{
	log_error (_("error getting update times of CRL: %s\n"),
	gpg_strerror (err));
	err = gpg_error (GPG_ERR_INV_CRL);
	goto failure;
	}

	if (opt.verbose \|\| !*nextupdate)
	log_info (_("update times of this CRL: this=%s next=%s\n"),
	thisupdate, nextupdate);
	if (!*nextupdate)
	{
	log_info (_("nextUpdate not given; "
	"assuming a validity period of one day\n"));
	gnupg_copy_time (nextupdate, thisupdate);
	add_seconds_to_isotime (nextupdate, 86400);
	}
	}
	break;

	case KSBA_SR_GOT_ITEM:
	{
	ksba_sexp_t serial;
	const unsigned char *p;
	ksba_isotime_t rdate;
	ksba_crl_reason_t reason;
	int rc;
	unsigned char record[1+15];

	err = ksba_crl_get_item (crl, &serial, rdate, &reason);
	if (err)
	{
	log_error (_("error getting CRL item: %s\n"),
	gpg_strerror (err));
	err = gpg_error (GPG_ERR_INV_CRL);
	ksba_free (serial);
	goto failure;
	}
	p = serial_to_buffer (serial, &n);
	if (!p)
	BUG ();
	record[0] = (reason & 0xff);
	memcpy (record+1, rdate, 15);
	rc = cdb_make_add (cdb, p, n, record, 1+15);
	if (rc)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error inserting item into "
	"temporary cache file: %s\n"),
	strerror (errno));
	goto failure;
	}

	ksba_free (serial);
	}
	break;

	case KSBA_SR_END_ITEMS:
	break;

	case KSBA_SR_READY:
	{
	char *crlissuer;
	ksba_name_t authid;
	ksba_sexp_t authidsn;
	ksba_sexp_t keyid;

	/* We need to look for the issuer only after having read
	all items. The issuer itselfs comes before the items
	but the optional authorityKeyIdentifier comes after the
	items. */
	err = ksba_crl_get_issuer (crl, &crlissuer);
	if( err )
	{
	log_error (_("no CRL issuer found in CRL: %s\n"),
	gpg_strerror (err) );
	err = gpg_error (GPG_ERR_INV_CRL);
	goto failure;
	}
	/* Note: This should be released by ksba_free, not xfree.
	May need a memory reallocation dance. */
	r_crlissuer = crlissuer; / (Do it here so we don't need
	to free it later) */

	if (!ksba_crl_get_auth_key_id (crl, &keyid, &authid, &authidsn))
	{
	const char *s;

	if (opt.verbose)
	log_info (_("locating CRL issuer certificate by "
	"authorityKeyIdentifier\n"));

	s = ksba_name_enum (authid, 0);
	if (s && *authidsn)
	crlissuer_cert = find_cert_bysn (ctrl, s, authidsn);
	if (!crlissuer_cert && keyid)
	crlissuer_cert = find_cert_bysubject (ctrl,
	crlissuer, keyid);

	if (!crlissuer_cert)
	{
	log_info ("CRL issuer certificate ");
	if (keyid)
	{
	log_printf ("{");
	dump_serial (keyid);
	log_printf ("} ");
	}
	if (authidsn)
	{
	log_printf ("(#");
	dump_serial (authidsn);
	log_printf ("/");
	dump_string (s);
	log_printf (") ");
	}
	log_printf ("not found\n");
	}
	ksba_name_release (authid);
	xfree (authidsn);
	xfree (keyid);
	}
	else
	crlissuer_cert = find_cert_bysubject (ctrl, crlissuer, NULL);
	err = 0;
	if (!crlissuer_cert)
	{
	err = gpg_error (GPG_ERR_MISSING_CERT);
	goto failure;
	}

	err = finish_sig_check (crl, md, algo, crlissuer_cert);
	if (err)
	{
	log_error (_("CRL signature verification failed: %s\n"),
	gpg_strerror (err));
	goto failure;
	}
	md = NULL;

	err = validate_cert_chain (ctrl, crlissuer_cert, NULL,
	(VALIDATE_FLAG_TRUST_CONFIG
	\| VALIDATE_FLAG_CRL
	\| VALIDATE_FLAG_RECURSIVE),
	r_trust_anchor);
	if (err)
	{
	log_error (_("error checking validity of CRL "
	"issuer certificate: %s\n"),
	gpg_strerror (err));
	goto failure;
	}

	}
	break;

	default:
	log_debug ("crl_parse_insert: unknown stop reason\n");
	err = gpg_error (GPG_ERR_BUG);
	goto failure;
	}
	}
	while (stopreason != KSBA_SR_READY);
	assert (!err);


	failure:
	if (md)
	abort_sig_check (crl, md);
	ksba_cert_release (crlissuer_cert);
	return err;
	}



	/* Return the crlNumber extension as an allocated hex string or NULL
	if there is none. */
	static char *
	get_crl_number (ksba_crl_t crl)
	{
	gpg_error_t err;
	ksba_sexp_t number;
	char *string;

	err = ksba_crl_get_crl_number (crl, &number);
	if (err)
	return NULL;
	string = serial_hex (number);
	ksba_free (number);
	return string;
	}


	/* Return the authorityKeyIdentifier or NULL if it is not available.
	The issuer name may consists of several parts - they are delimted by
	0x01. */
	static char *
	get_auth_key_id (ksba_crl_t crl, char **serialno)
	{
	gpg_error_t err;
	ksba_name_t name;
	ksba_sexp_t sn;
	int idx;
	const char *s;
	char *string;
	size_t length;

	*serialno = NULL;
	err = ksba_crl_get_auth_key_id (crl, NULL, &name, &sn);
	if (err)
	return NULL;
	*serialno = serial_hex (sn);
	ksba_free (sn);

	if (!name)
	return xstrdup ("");

	length = 0;
	for (idx=0; (s = ksba_name_enum (name, idx)); idx++)
	{
	char *p = ksba_name_get_uri (name, idx);
	length += strlen (p?p:s) + 1;
	xfree (p);
	}
	string = xtrymalloc (length+1);
	if (string)
	{
	*string = 0;
	for (idx=0; (s = ksba_name_enum (name, idx)); idx++)
	{
	char *p = ksba_name_get_uri (name, idx);
	if (*string)
	strcat (string, "\x01");
	strcat (string, p?p:s);
	xfree (p);
	}
	}
	ksba_name_release (name);
	return string;
	}



	/* Insert the CRL retrieved using URL into the cache specified by
	CACHE. The CRL itself will be read from the stream FP and is
	expected in binary format.

	Called by:
	crl_cache_load
	cmd_loadcrl
	--load-crl
	crl_cache_reload_crl
	cmd_isvalid
	cmd_checkcrl
	cmd_loadcrl
	--fetch-crl

	*/
	gpg_error_t
	crl_cache_insert (ctrl_t ctrl, const char *url, ksba_reader_t reader)
	{
	crl_cache_t cache = get_current_cache ();
	gpg_error_t err, err2;
	ksba_crl_t crl;
	char *fname = NULL;
	char *newfname = NULL;
	struct cdb_make cdb;
	int fd_cdb = -1;
	char *issuer = NULL;
	char *issuer_hash = NULL;
	ksba_isotime_t thisupdate, nextupdate;
	crl_cache_entry_t entry = NULL;
	crl_cache_entry_t e;
	gnupg_isotime_t current_time;
	char *checksum = NULL;
	int invalidate_crl = 0;
	int idx;
	const char *oid;
	int critical;
	char *trust_anchor = NULL;

	/* FIXME: We should acquire a mutex for the URL, so that we don't
	simultaneously enter the same CRL twice. However this needs to be
	interweaved with the checking function.*/

	err2 = 0;

	err = ksba_crl_new (&crl);
	if (err)
	{
	log_error (_("ksba_crl_new failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	err = ksba_crl_set_reader (crl, reader);
	if ( err )
	{
	log_error (_("ksba_crl_set_reader failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	/* Create a temporary cache file to load the CRL into. */
	{
	char tmpfname, p;
	const char *nodename;
	#ifndef HAVE_W32_SYSTEM
	struct utsname utsbuf;
	#endif

	#ifdef HAVE_W32_SYSTEM
	nodename = "unknown";
	#else
	if (uname (&utsbuf))
	nodename = "unknown";
	else
	nodename = utsbuf.nodename;
	#endif

	gpgrt_asprintf (&tmpfname, "crl-tmp-%s-%u-%p.db.tmp",
	nodename, (unsigned int)getpid (), &tmpfname);
	if (!tmpfname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	for (p=tmpfname; *p; p++)
	if (*p == '/')
	*p = '.';
	fname = make_filename (opt.homedir_cache, DBDIR_D, tmpfname, NULL);
	xfree (tmpfname);
	if (!gnupg_remove (fname))
	log_info (_("removed stale temporary cache file '%s'\n"), fname);
	else if (errno != ENOENT)
	{
	err = gpg_error_from_syserror ();
	log_error (_("problem removing stale temporary cache file '%s': %s\n"),
	fname, gpg_strerror (err));
	goto leave;
	}
	}

	fd_cdb = open (fname, O_WRONLY \| O_CREAT \| O_TRUNC, 0644);
	if (fd_cdb == -1)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error creating temporary cache file '%s': %s\n"),
	fname, strerror (errno));
	goto leave;
	}
	cdb_make_start(&cdb, fd_cdb);

	err = crl_parse_insert (ctrl, crl, &cdb, fname,
	&issuer, thisupdate, nextupdate, &trust_anchor);
	if (err)
	{
	log_error (_("crl_parse_insert failed: %s\n"), gpg_strerror (err));
	/* Error in cleanup ignored. */
	cdb_make_finish (&cdb);
	goto leave;
	}

	/* Finish the database. */
	if (cdb_make_finish (&cdb))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error finishing temporary cache file '%s': %s\n"),
	fname, strerror (errno));
	goto leave;
	}
	if (close (fd_cdb))
	{
	err = gpg_error_from_errno (errno);
	log_error (_("error closing temporary cache file '%s': %s\n"),
	fname, strerror (errno));
	goto leave;
	}
	fd_cdb = -1;


	/* Create a checksum. */
	{
	unsigned char md5buf[16];

	if (hash_dbfile (fname, md5buf))
	{
	err = gpg_error (GPG_ERR_CHECKSUM);
	goto leave;
	}
	checksum = hexify_data (md5buf, 16, 0);
	}


	/* Check whether that new CRL is still not expired. */
	gnupg_get_isotime (current_time);
	if (strcmp (nextupdate, current_time) < 0 )
	{
	if (opt.force)
	log_info (_("WARNING: new CRL still too old; it expired on %s "
	"- loading anyway\n"), nextupdate);
	else
	{
	log_error (_("new CRL still too old; it expired on %s\n"),
	nextupdate);
	if (!err2)
	err2 = gpg_error (GPG_ERR_CRL_TOO_OLD);
	invalidate_crl \|= 1;
	}
	}

	/* Check for unknown critical extensions. */
	for (idx=0; !(err=ksba_crl_get_extension (crl, idx, &oid, &critical,
	NULL, NULL)); idx++)
	{
	if (!critical
	\|\| !strcmp (oid, oidstr_authorityKeyIdentifier)
	\|\| !strcmp (oid, oidstr_crlNumber) )
	continue;
	log_error (_("unknown critical CRL extension %s\n"), oid);
	if (!err2)
	err2 = gpg_error (GPG_ERR_INV_CRL);
	invalidate_crl \|= 2;
	}
	if (gpg_err_code (err) == GPG_ERR_EOF
	\|\| gpg_err_code (err) == GPG_ERR_NO_DATA )
	err = 0;
	if (err)
	{
	log_error (_("error reading CRL extensions: %s\n"), gpg_strerror (err));
	err = gpg_error (GPG_ERR_INV_CRL);
	}


	/* Create an hex encoded SHA-1 hash of the issuer DN to be
	used as the key for the cache. */
	issuer_hash = hashify_data (issuer, strlen (issuer));

	/* Create an ENTRY. */
	entry = xtrycalloc (1, sizeof *entry);
	if (!entry)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	entry->release_ptr = xtrymalloc (strlen (issuer_hash) + 1
	+ strlen (issuer) + 1
	+ strlen (url) + 1
	+ strlen (checksum) + 1);
	if (!entry->release_ptr)
	{
	err = gpg_error_from_syserror ();
	xfree (entry);
	entry = NULL;
	goto leave;
	}
	entry->issuer_hash = entry->release_ptr;
	entry->issuer = stpcpy (entry->issuer_hash, issuer_hash) + 1;
	entry->url = stpcpy (entry->issuer, issuer) + 1;
	entry->dbfile_hash = stpcpy (entry->url, url) + 1;
	strcpy (entry->dbfile_hash, checksum);
	gnupg_copy_time (entry->this_update, thisupdate);
	gnupg_copy_time (entry->next_update, nextupdate);
	gnupg_copy_time (entry->last_refresh, current_time);
	entry->crl_number = get_crl_number (crl);
	entry->authority_issuer = get_auth_key_id (crl, &entry->authority_serialno);
	entry->invalid = invalidate_crl;
	entry->user_trust_req = !!trust_anchor;
	entry->check_trust_anchor = trust_anchor;
	trust_anchor = NULL;

	/* Check whether we already have an entry for this issuer and mark
	it as deleted. We better use a loop, just in case duplicates got
	somehow into the list. */
	for (e = cache->entries; (e=find_entry (e, entry->issuer_hash)); e = e->next)
	e->deleted = 1;

	/* Rename the temporary DB to the real name. */
	newfname = make_db_file_name (entry->issuer_hash);
	if (opt.verbose)
	log_info (_("creating cache file '%s'\n"), newfname);

	/* Just in case close unused matching files. Actually we need this
	only under Windows but saving file descriptors is never bad. */
	{
	int any;
	do
	{
	any = 0;
	for (e = cache->entries; e; e = e->next)
	if (!e->cdb_use_count && e->cdb
	&& !strcmp (e->issuer_hash, entry->issuer_hash))
	{
	int fd = cdb_fileno (e->cdb);
	cdb_free (e->cdb);
	xfree (e->cdb);
	e->cdb = NULL;
	if (close (fd))
	log_error (_("error closing cache file: %s\n"),
	strerror(errno));
	any = 1;
	break;
	}
	}
	while (any);
	}
	#ifdef HAVE_W32_SYSTEM
	gnupg_remove (newfname);
	#endif
	if (rename (fname, newfname))
	{
	err = gpg_error_from_syserror ();
	log_error (_("problem renaming '%s' to '%s': %s\n"),
	fname, newfname, gpg_strerror (err));
	goto leave;
	}
	xfree (fname); fname = NULL; /(let the cleanup code not try to remove it)/

	/* Link the new entry in. */
	entry->next = cache->entries;
	cache->entries = entry;
	entry = NULL;

	err = update_dir (cache);
	if (err)
	{
	log_error (_("updating the DIR file failed - "
	"cache entry will get lost with the next program start\n"));
	err = 0; /* Keep on running. */
	}


	leave:
	release_one_cache_entry (entry);
	if (fd_cdb != -1)
	close (fd_cdb);
	if (fname)
	{
	gnupg_remove (fname);
	xfree (fname);
	}
	xfree (newfname);
	ksba_crl_release (crl);
	xfree (issuer);
	xfree (issuer_hash);
	xfree (checksum);
	xfree (trust_anchor);
	return err ? err : err2;
	}


	/* Print one cached entry E in a human readable format to stream
	FP. Return 0 on success. */
	static gpg_error_t
	list_one_crl_entry (crl_cache_t cache, crl_cache_entry_t e, estream_t fp)
	{
	struct cdb_find cdbfp;
	struct cdb *cdb;
	int rc;
	int warn = 0;
	const unsigned char *s;

	es_fputs ("--------------------------------------------------------\n", fp );
	es_fprintf (fp, _("Begin CRL dump (retrieved via %s)\n"), e->url );
	es_fprintf (fp, " Issuer:\t%s\n", e->issuer );
	es_fprintf (fp, " Issuer Hash:\t%s\n", e->issuer_hash );
	es_fprintf (fp, " This Update:\t%s\n", e->this_update );
	es_fprintf (fp, " Next Update:\t%s\n", e->next_update );
	es_fprintf (fp, " CRL Number :\t%s\n", e->crl_number? e->crl_number: "none");
	es_fprintf (fp, " AuthKeyId :\t%s\n",
	e->authority_serialno? e->authority_serialno:"none");
	if (e->authority_serialno && e->authority_issuer)
	{
	es_fputs (" \t", fp);
	for (s=e->authority_issuer; *s; s++)
	if (*s == '\x01')
	es_fputs ("\n \t", fp);
	else
	es_putc (*s, fp);
	es_putc ('\n', fp);
	}
	es_fprintf (fp, " Trust Check:\t%s\n",
	!e->user_trust_req? "[system]" :
	e->check_trust_anchor? e->check_trust_anchor:"[missing]");

	if ((e->invalid & 1))
	es_fprintf (fp, _(" ERROR: The CRL will not be used "
	"because it was still too old after an update!\n"));
	if ((e->invalid & 2))
	es_fprintf (fp, _(" ERROR: The CRL will not be used "
	"due to an unknown critical extension!\n"));
	if ((e->invalid & ~3))
	es_fprintf (fp, _(" ERROR: The CRL will not be used\n"));

	cdb = lock_db_file (cache, e);
	if (!cdb)
	return gpg_error (GPG_ERR_GENERAL);

	if (!e->dbfile_checked)
	es_fprintf (fp, _(" ERROR: This cached CRL may have been tampered with!\n"));

	es_putc ('\n', fp);

	rc = cdb_findinit (&cdbfp, cdb, NULL, 0);
	while (!rc && (rc=cdb_findnext (&cdbfp)) > 0 )
	{
	unsigned char keyrecord[256];
	unsigned char record[16];
	int reason;
	int any = 0;
	cdbi_t n;
	cdbi_t i;

	rc = 0;
	n = cdb_datalen (cdb);
	if (n != 16)
	{
	log_error (_(" WARNING: invalid cache record length\n"));
	warn = 1;
	continue;
	}

	if (cdb_read (cdb, record, n, cdb_datapos (cdb)))
	{
	log_error (_("problem reading cache record: %s\n"),
	strerror (errno));
	warn = 1;
	continue;
	}

	n = cdb_keylen (cdb);
	if (n > sizeof keyrecord)
	n = sizeof keyrecord;
	if (cdb_read (cdb, keyrecord, n, cdb_keypos (cdb)))
	{
	log_error (_("problem reading cache key: %s\n"), strerror (errno));
	warn = 1;
	continue;
	}

	reason = *record;
	es_fputs (" ", fp);
	for (i = 0; i < n; i++)
	es_fprintf (fp, "%02X", keyrecord[i]);
	es_fputs (":\t reasons( ", fp);

	if (reason & KSBA_CRLREASON_UNSPECIFIED)
	es_fputs( "unspecified ", fp ), any = 1;
	if (reason & KSBA_CRLREASON_KEY_COMPROMISE )
	es_fputs( "key_compromise ", fp ), any = 1;
	if (reason & KSBA_CRLREASON_CA_COMPROMISE )
	es_fputs( "ca_compromise ", fp ), any = 1;
	if (reason & KSBA_CRLREASON_AFFILIATION_CHANGED )
	es_fputs( "affiliation_changed ", fp ), any = 1;
	if (reason & KSBA_CRLREASON_SUPERSEDED )
	es_fputs( "superseded", fp ), any = 1;
	if (reason & KSBA_CRLREASON_CESSATION_OF_OPERATION )
	es_fputs( "cessation_of_operation", fp ), any = 1;
	if (reason & KSBA_CRLREASON_CERTIFICATE_HOLD )
	es_fputs( "certificate_hold", fp ), any = 1;
	if (reason && !any)
	es_fputs( "other", fp );

	es_fprintf (fp, ") rdate: %.15s\n", record+1);
	}
	if (rc)
	log_error (_("error reading cache entry from db: %s\n"), strerror (rc));

	unlock_db_file (cache, e);
	es_fprintf (fp, _("End CRL dump\n") );
	es_putc ('\n', fp);

	return (rc\|\|warn)? gpg_error (GPG_ERR_GENERAL) : 0;
	}


	/* Print the contents of the CRL CACHE in a human readable format to
	stream FP. */
	gpg_error_t
	crl_cache_list (estream_t fp)
	{
	crl_cache_t cache = get_current_cache ();
	crl_cache_entry_t entry;
	gpg_error_t err = 0;

	for (entry = cache->entries;
	entry && !entry->deleted && !err;
	entry = entry->next )
	err = list_one_crl_entry (cache, entry, fp);

	return err;
	}


	/* Load the CRL containing the file named FILENAME into our CRL cache. */
	gpg_error_t
	crl_cache_load (ctrl_t ctrl, const char *filename)
	{
	gpg_error_t err;
	estream_t fp;
	ksba_reader_t reader;

	fp = es_fopen (filename, "rb");
	if (!fp)
	{
	err = gpg_error_from_errno (errno);
	log_error (_("can't open '%s': %s\n"), filename, strerror (errno));
	return err;
	}

	err = create_estream_ksba_reader (&reader, fp);
	if (!err)
	{
	err = crl_cache_insert (ctrl, filename, reader);
	ksba_reader_release (reader);
	}
	es_fclose (fp);
	return err;
	}


	/* Locate the corresponding CRL for the certificate CERT, read and
	verify the CRL and store it in the cache. */
	gpg_error_t
	crl_cache_reload_crl (ctrl_t ctrl, ksba_cert_t cert)
	{
	gpg_error_t err;
	ksba_reader_t reader = NULL;
	char *issuer = NULL;
	ksba_name_t distpoint = NULL;
	ksba_name_t issuername = NULL;
	char *distpoint_uri = NULL;
	char *issuername_uri = NULL;
	int any_dist_point = 0;
	int seq;

	/* Loop over all distribution points, get the CRLs and put them into
	the cache. */
	if (opt.verbose)
	log_info ("checking distribution points\n");
	seq = 0;
	while ( !(err = ksba_cert_get_crl_dist_point (cert, seq++,
	&distpoint,
	&issuername, NULL )))
	{
	int name_seq;
	gpg_error_t last_err = 0;

	if (!distpoint && !issuername)
	{
	if (opt.verbose)
	log_info ("no issuer name and no distribution point\n");
	break; /* Not allowed; i.e. an invalid certificate. We give
	up here and hope that the default method returns a
	suitable CRL. */
	}

	xfree (issuername_uri); issuername_uri = NULL;

	/* Get the URIs. We do this in a loop to iterate over all names
	in the crlDP. */
	for (name_seq=0; ksba_name_enum (distpoint, name_seq); name_seq++)
	{
	xfree (distpoint_uri); distpoint_uri = NULL;
	distpoint_uri = ksba_name_get_uri (distpoint, name_seq);
	if (!distpoint_uri)
	continue;

	if (!strncmp (distpoint_uri, "ldap:", 5)
	\|\| !strncmp (distpoint_uri, "ldaps:", 6))
	{
	if (opt.ignore_ldap_dp)
	continue;
	}
	else if (!strncmp (distpoint_uri, "http:", 5)
	\|\| !strncmp (distpoint_uri, "https:", 6))
	{
	if (opt.ignore_http_dp)
	continue;
	}
	else
	continue; /* Skip unknown schemes. */

	any_dist_point = 1;

	if (opt.verbose)
	log_info ("fetching CRL from '%s'\n", distpoint_uri);
	err = crl_fetch (ctrl, distpoint_uri, &reader);
	if (err)
	{
	log_error (_("crl_fetch via DP failed: %s\n"),
	gpg_strerror (err));
	last_err = err;
	continue; /* with the next name. */
	}

	if (opt.verbose)
	log_info ("inserting CRL (reader %p)\n", reader);
	err = crl_cache_insert (ctrl, distpoint_uri, reader);
	if (err)
	{
	log_error (_("crl_cache_insert via DP failed: %s\n"),
	gpg_strerror (err));
	last_err = err;
	continue; /* with the next name. */
	}
	last_err = 0;
	break; /* Ready. */
	}
	if (last_err)
	{
	err = last_err;
	goto leave;
	}

	ksba_name_release (distpoint); distpoint = NULL;

	/* We don't do anything with issuername_uri yet but we keep the
	code for documentation. */
	issuername_uri = ksba_name_get_uri (issuername, 0);
	ksba_name_release (issuername); issuername = NULL;

	/* Close the reader. */
	crl_close_reader (reader);
	reader = NULL;
	}
	if (gpg_err_code (err) == GPG_ERR_EOF)
	err = 0;

	/* If we did not found any distpoint, try something reasonable. */
	if (!any_dist_point )
	{
	if (opt.verbose)
	log_info ("no distribution point - trying issuer name\n");

	crl_close_reader (reader);
	reader = NULL;

	issuer = ksba_cert_get_issuer (cert, 0);
	if (!issuer)
	{
	log_error ("oops: issuer missing in certificate\n");
	err = gpg_error (GPG_ERR_INV_CERT_OBJ);
	goto leave;
	}

	if (opt.verbose)
	log_info ("fetching CRL from default location\n");
	err = crl_fetch_default (ctrl, issuer, &reader);
	if (err)
	{
	log_error ("crl_fetch via issuer failed: %s\n",
	gpg_strerror (err));
	goto leave;
	}

	if (opt.verbose)
	log_info ("inserting CRL (reader %p)\n", reader);
	err = crl_cache_insert (ctrl, "default location(s)", reader);
	if (err)
	{
	log_error (_("crl_cache_insert via issuer failed: %s\n"),
	gpg_strerror (err));
	goto leave;
	}
	}

	leave:
	crl_close_reader (reader);
	xfree (distpoint_uri);
	xfree (issuername_uri);
	ksba_name_release (distpoint);
	ksba_name_release (issuername);
	ksba_free (issuer);
	return err;
	}
	diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
	index 074e0128f..d72d1c7c5 100644
	--- a/dirmngr/dns-stuff.c
	+++ b/dirmngr/dns-stuff.c
	@@ -1,2283 +1,2283 @@
	/* dns-stuff.c - DNS related code including CERT RR (rfc-4398)
	* Copyright (C) 2003, 2005, 2006, 2009 Free Software Foundation, Inc.
	* Copyright (C) 2005, 2006, 2009, 2015. 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <sys/types.h>
	#ifdef HAVE_W32_SYSTEM
	# define WIN32_LEAN_AND_MEAN
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h>
	# include <iphlpapi.h>
	#else
	# if HAVE_SYSTEM_RESOLVER
	# include <netinet/in.h>
	# include <arpa/nameser.h>
	# include <resolv.h>
	# endif
	# include <netdb.h>
	#endif
	#include <string.h>
	#include <unistd.h>


	/* William Ahern's DNS library, included as a source copy. */
	#ifdef USE_LIBDNS
	# include "dns.h"
	#endif

	/* dns.c has a dns_p_free but it is not exported. We use our own
	* wrapper here so that we do not accidentally use xfree which would
	* be wrong for dns.c allocated data. */
	#define dns_free(a) free ((a))


	#ifdef WITHOUT_NPTH /* Give the Makefile a chance to build without Pth. */
	# undef USE_NPTH
	#endif
	#ifdef USE_NPTH
	# include <npth.h>
	#endif

	#include "./dirmngr-err.h"
	#include "util.h"
	#include "host2net.h"
	#include "dns-stuff.h"

	#ifdef USE_NPTH
	# define my_unprotect() npth_unprotect ()
	# define my_protect() npth_protect ()
	#else
	# define my_unprotect() do { } while(0)
	# define my_protect() do { } while(0)
	#endif

	/* We allow the use of 0 instead of AF_UNSPEC - check this assumption. */
	#if AF_UNSPEC != 0
	# error AF_UNSPEC does not have the value 0
	#endif

	/* Windows does not support the AI_ADDRCONFIG flag - use zero instead. */
	#ifndef AI_ADDRCONFIG
	# define AI_ADDRCONFIG 0
	#endif

	/* Not every installation has gotten around to supporting SRVs or
	CERTs yet... */
	#ifndef T_SRV
	#define T_SRV 33
	#endif
	#ifndef T_CERT
	# define T_CERT 37
	#endif

	/* The standard SOCKS and TOR ports. */
	#define SOCKS_PORT 1080
	#define TOR_PORT 9050
	#define TOR_PORT2 9150 /* (Used by the Tor browser) */


	/* The default nameserver used in Tor mode. */
	#define DEFAULT_NAMESERVER "8.8.8.8"

	/* The default timeout in seconds for libdns requests. */
	#define DEFAULT_TIMEOUT 30


	/* Two flags to enable verbose and debug mode. */
	static int opt_verbose;
	static int opt_debug;

	/* The timeout in seconds for libdns requests. */
	static int opt_timeout;

	/* The flag to disable IPv4 access - right now this only skips
	* returned A records. */
	static int opt_disable_ipv4;

	/* If set force the use of the standard resolver. */
	static int standard_resolver;

	/* If set use recursive resolver when available. */
	static int recursive_resolver;

	/* If set Tor mode shall be used. */
	static int tor_mode;

	/* A string with the nameserver IP address used with Tor.
	(40 should be sufficient for v6 but we add some extra for a scope.) */
	static char tor_nameserver[40+20];

	/* Two strings to hold the credentials presented to Tor. */
	static char tor_socks_user[30];
	static char tor_socks_password[20];


	#ifdef USE_LIBDNS
	/* Libdns gobal data. */
	struct libdns_s
	{
	struct dns_resolv_conf *resolv_conf;
	struct dns_hosts *hosts;
	struct dns_hints *hints;

	struct sockaddr_storage socks_host;
	} libdns;

	/* If this flag is set, libdns shall be reinited for the next use. */
	static int libdns_reinit_pending;

	/* The Tor port to be used. */
	static int libdns_tor_port;

	#endif /USE_LIBDNS/


	/* Calling this function with YES set to True forces the use of the
	* standard resolver even if dirmngr has been built with support for
	* an alternative resolver. */
	void
	enable_standard_resolver (int yes)
	{
	standard_resolver = yes;
	}


	/* Return true if the standard resolver is used. */
	int
	standard_resolver_p (void)
	{
	return standard_resolver;
	}


	/* Calling this function with YES switches libdns into recursive mode.
	* It has no effect on the standard resolver. */
	void
	enable_recursive_resolver (int yes)
	{
	recursive_resolver = yes;
	#ifdef USE_LIBDNS
	libdns_reinit_pending = 1;
	#endif
	}


	/* Return true iff the recursive resolver is used. */
	int
	recursive_resolver_p (void)
	{
	#if USE_LIBDNS
	return !standard_resolver && recursive_resolver;
	#else
	return 0;
	#endif
	}


	/* Puts this module eternally into Tor mode. When called agained with
	* NEW_CIRCUIT request a new TOR circuit for the next DNS query. */
	void
	enable_dns_tormode (int new_circuit)
	{
	if (!*tor_socks_user \|\| new_circuit)
	{
	static unsigned int counter;

	gpgrt_snprintf (tor_socks_user, sizeof tor_socks_user,
	"dirmngr-%lu", (unsigned long)getpid ());
	gpgrt_snprintf (tor_socks_password, sizeof tor_socks_password,
	"p%u", counter);
	counter++;
	}
	tor_mode = 1;
	}


	/* Disable tor mode. */
	void
	disable_dns_tormode (void)
	{
	tor_mode = 0;
	}


	/* Set verbosity and debug mode for this module. */
	void
	set_dns_verbose (int verbose, int debug)
	{
	opt_verbose = verbose;
	opt_debug = debug;
	}


	/* Set the Disable-IPv4 flag so that the name resolver does not return
	* A addresses. */
	void
	set_dns_disable_ipv4 (int yes)
	{
	opt_disable_ipv4 = !!yes;
	}


	/* Set the timeout for libdns requests to SECONDS. A value of 0 sets
	* the default timeout and values are capped at 10 minutes. */
	void
	set_dns_timeout (int seconds)
	{
	if (!seconds)
	seconds = DEFAULT_TIMEOUT;
	else if (seconds < 1)
	seconds = 1;
	else if (seconds > 600)
	seconds = 600;

	opt_timeout = seconds;
	}


	/* Change the default IP address of the nameserver to IPADDR. The
	address needs to be a numerical IP address and will be used for the
	next DNS query. Note that this is only used in Tor mode. */
	void
	set_dns_nameserver (const char *ipaddr)
	{
	strncpy (tor_nameserver, ipaddr? ipaddr : DEFAULT_NAMESERVER,
	sizeof tor_nameserver -1);
	tor_nameserver[sizeof tor_nameserver -1] = 0;
	#ifdef USE_LIBDNS
	libdns_reinit_pending = 1;
	libdns_tor_port = 0; /* Start again with the default port. */
	#endif
	}


	/* Free an addressinfo linked list as returned by resolve_dns_name. */
	void
	free_dns_addrinfo (dns_addrinfo_t ai)
	{
	while (ai)
	{
	dns_addrinfo_t next = ai->next;
	xfree (ai);
	ai = next;
	}
	}


	#ifndef HAVE_W32_SYSTEM
	/* Return H_ERRNO mapped to a gpg-error code. Will never return 0. */
	static gpg_error_t
	get_h_errno_as_gpg_error (void)
	{
	gpg_err_code_t ec;

	switch (h_errno)
	{
	case HOST_NOT_FOUND: ec = GPG_ERR_NO_NAME; break;
	case TRY_AGAIN: ec = GPG_ERR_TRY_LATER; break;
	case NO_RECOVERY: ec = GPG_ERR_SERVER_FAILED; break;
	case NO_DATA: ec = GPG_ERR_NO_DATA; break;
	default: ec = GPG_ERR_UNKNOWN_ERRNO; break;
	}
	return gpg_error (ec);
	}
	#endif /!HAVE_W32_SYSTEM/

	static gpg_error_t
	map_eai_to_gpg_error (int ec)
	{
	gpg_error_t err;

	switch (ec)
	{
	case EAI_AGAIN: err = gpg_error (GPG_ERR_EAGAIN); break;
	case EAI_BADFLAGS: err = gpg_error (GPG_ERR_INV_FLAG); break;
	case EAI_FAIL: err = gpg_error (GPG_ERR_SERVER_FAILED); break;
	case EAI_MEMORY: err = gpg_error (GPG_ERR_ENOMEM); break;
	#ifdef EAI_NODATA
	case EAI_NODATA: err = gpg_error (GPG_ERR_NO_DATA); break;
	#endif
	case EAI_NONAME: err = gpg_error (GPG_ERR_NO_NAME); break;
	case EAI_SERVICE: err = gpg_error (GPG_ERR_NOT_SUPPORTED); break;
	case EAI_FAMILY: err = gpg_error (GPG_ERR_EAFNOSUPPORT); break;
	case EAI_SOCKTYPE: err = gpg_error (GPG_ERR_ESOCKTNOSUPPORT); break;
	#ifndef HAVE_W32_SYSTEM
	# ifdef EAI_ADDRFAMILY
	case EAI_ADDRFAMILY:err = gpg_error (GPG_ERR_EADDRNOTAVAIL); break;
	# endif
	case EAI_SYSTEM: err = gpg_error_from_syserror (); break;
	#endif
	default: err = gpg_error (GPG_ERR_UNKNOWN_ERRNO); break;
	}
	return err;
	}


	#ifdef USE_LIBDNS
	static gpg_error_t
	libdns_error_to_gpg_error (int serr)
	{
	gpg_err_code_t ec;

	switch (serr)
	{
	case 0: ec = 0; break;

	case DNS_ENOBUFS: ec = GPG_ERR_BUFFER_TOO_SHORT; break;
	case DNS_EILLEGAL: ec = GPG_ERR_INV_OBJ; break;
	case DNS_EORDER: ec = GPG_ERR_INV_ORDER; break;
	case DNS_ESECTION: ec = GPG_ERR_DNS_SECTION; break;
	case DNS_EUNKNOWN: ec = GPG_ERR_DNS_UNKNOWN; break;
	case DNS_EADDRESS: ec = GPG_ERR_DNS_ADDRESS; break;
	case DNS_ENOQUERY: ec = GPG_ERR_DNS_NO_QUERY; break;
	case DNS_ENOANSWER:ec = GPG_ERR_DNS_NO_ANSWER; break;
	case DNS_EFETCHED: ec = GPG_ERR_ALREADY_FETCHED; break;
	case DNS_ESERVICE: ec = GPG_ERR_NOT_SUPPORTED; break;
	case DNS_ENONAME: ec = GPG_ERR_NO_NAME; break;
	case DNS_EFAIL: ec = GPG_ERR_SERVER_FAILED; break;
	case DNS_ECONNFIN: ec = GPG_ERR_DNS_CLOSED; break;
	case DNS_EVERIFY: ec = GPG_ERR_DNS_VERIFY; break;

	default:
	if (serr >= 0)
	ec = gpg_err_code_from_errno (serr);
	else
	ec = GPG_ERR_DNS_UNKNOWN;
	break;
	}
	return gpg_error (ec);
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	/* Initialize libdns. Returns 0 on success; prints a diagnostic and
	* returns an error code on failure. */
	static gpg_error_t
	libdns_init (void)
	{
	gpg_error_t err;
	struct libdns_s ld;
	int derr;
	char *cfgstr = NULL;

	if (libdns.resolv_conf)
	return 0; /* Already initialized. */

	memset (&ld, 0, sizeof ld);

	ld.resolv_conf = dns_resconf_open (&derr);
	if (!ld.resolv_conf)
	{
	err = libdns_error_to_gpg_error (derr);
	log_error ("failed to allocate DNS resconf object: %s\n",
	gpg_strerror (err));
	goto leave;
	}

	if (tor_mode)
	{
	if (!*tor_nameserver)
	set_dns_nameserver (NULL);

	if (!libdns_tor_port)
	libdns_tor_port = TOR_PORT;

	cfgstr = xtryasprintf ("[%s]:53", tor_nameserver);
	if (!cfgstr)
	err = gpg_error_from_syserror ();
	else
	err = libdns_error_to_gpg_error
	(dns_resconf_pton (&ld.resolv_conf->nameserver[0], cfgstr));
	if (err)
	log_error ("failed to set nameserver '%s': %s\n",
	cfgstr, gpg_strerror (err));
	if (err)
	goto leave;

	ld.resolv_conf->options.tcp = DNS_RESCONF_TCP_SOCKS;

	xfree (cfgstr);
	cfgstr = xtryasprintf ("[%s]:%d", "127.0.0.1", libdns_tor_port);
	if (!cfgstr)
	err = gpg_error_from_syserror ();
	else
	err = libdns_error_to_gpg_error
	(dns_resconf_pton (&ld.socks_host, cfgstr));
	if (err)
	{
	log_error ("failed to set socks server '%s': %s\n",
	cfgstr, gpg_strerror (err));
	goto leave;
	}
	}
	else
	{
	#ifdef HAVE_W32_SYSTEM
	ULONG ninfo_len;
	PFIXED_INFO ninfo;
	PIP_ADDR_STRING pip;
	int idx;

	ninfo_len = 2048;
	ninfo = xtrymalloc (ninfo_len);
	if (!ninfo)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if (GetNetworkParams (ninfo, &ninfo_len))
	{
	log_error ("GetNetworkParms failed: %s\n", w32_strerror (-1));
	err = gpg_error (GPG_ERR_GENERAL);
	xfree (ninfo);
	goto leave;
	}

	for (idx=0, pip = &(ninfo->DnsServerList);
	pip && idx < DIM (ld.resolv_conf->nameserver);
	pip = pip->Next)
	{
	if (opt_debug)
	log_debug ("dns: dnsserver[%d] '%s'\n", idx, pip->IpAddress.String);
	err = libdns_error_to_gpg_error
	(dns_resconf_pton (&ld.resolv_conf->nameserver[idx],
	pip->IpAddress.String));
	if (err)
	log_error ("failed to set nameserver[%d] '%s': %s\n",
	idx, pip->IpAddress.String, gpg_strerror (err));
	else
	idx++;
	}
	xfree (ninfo);

	#else /* Unix */
	const char *fname;

	fname = "/etc/resolv.conf";
	err = libdns_error_to_gpg_error
	(dns_resconf_loadpath (ld.resolv_conf, fname));
	if (err)
	{
	log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
	goto leave;
	}

	fname = "/etc/nsswitch.conf";
	err = libdns_error_to_gpg_error
	(dns_nssconf_loadpath (ld.resolv_conf, fname));
	if (err)
	{
	/* This is not a fatal error: nsswitch.conf is not used on
	* all systems; assume classic behavior instead. */
	if (gpg_err_code (err) != GPG_ERR_ENOENT)
	log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
	if (opt_debug)
	log_debug ("dns: fallback resolution order, files then DNS\n");
	ld.resolv_conf->lookup[0] = 'f';
	ld.resolv_conf->lookup[1] = 'b';
	ld.resolv_conf->lookup[2] = '\0';
	err = GPG_ERR_NO_ERROR;
	}
	else if (!strchr (ld.resolv_conf->lookup, 'b'))
	{
	/* No DNS resulution type found in the list. This might be
	* due to systemd based systems which allow for custom
	* keywords which are not known to us and thus we do not
	* know whether DNS is wanted or not. Becuase DNS is
	* important for our infrastructure, we forcefully append
	* DNS to the end of the list. */
	if (strlen (ld.resolv_conf->lookup)+2 < sizeof ld.resolv_conf->lookup)
	{
	if (opt_debug)
	log_debug ("dns: appending DNS to resolution order\n");
	strcat (ld.resolv_conf->lookup, "b");
	}
	else
	log_error ("failed to append DNS to resolution order\n");
	}

	#endif /* Unix */
	}

	ld.hosts = dns_hosts_open (&derr);
	if (!ld.hosts)
	{
	log_error ("failed to load hosts file: %s\n", gpg_strerror (err));
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* dns_hints_local for stub mode, dns_hints_root for recursive. */
	ld.hints = (recursive_resolver
	? dns_hints_root (ld.resolv_conf, &derr)
	: dns_hints_local (ld.resolv_conf, &derr));
	if (!ld.hints)
	{
	log_error ("failed to load DNS hints: %s\n", gpg_strerror (err));
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* All fine. Make the data global. */
	libdns = ld;

	if (opt_debug)
	log_debug ("dns: libdns initialized%s\n", tor_mode?" (tor mode)":"");

	leave:
	xfree (cfgstr);
	return err;
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	/* Deinitialize libdns. */
	static void
	libdns_deinit (void)
	{
	struct libdns_s ld;

	if (!libdns.resolv_conf)
	return; /* Not initialized. */

	ld = libdns;
	memset (&libdns, 0, sizeof libdns);
	dns_hints_close (ld.hints);
	dns_hosts_close (ld.hosts);
	dns_resconf_close (ld.resolv_conf);
	}
	#endif /USE_LIBDNS/


	/* SIGHUP action handler for this module. With FORCE set objects are
	* all immediately released. */
	void
	reload_dns_stuff (int force)
	{
	#ifdef USE_LIBDNS
	if (force)
	{
	libdns_deinit ();
	libdns_reinit_pending = 0;
	}
	else
	{
	libdns_reinit_pending = 1;
	libdns_tor_port = 0; /* Start again with the default port. */
	}
	#else
	(void)force;
	#endif
	}


	#ifdef USE_LIBDNS
	/*
	* Initialize libdns if needed and open a dns_resolver context.
	* Returns 0 on success and stores the new context at R_RES. On
	* failure an error code is returned and NULL stored at R_RES.
	*/
	static gpg_error_t
	libdns_res_open (struct dns_resolver **r_res)
	{
	gpg_error_t err;
	struct dns_resolver *res;
	int derr;

	*r_res = NULL;

	if (libdns_reinit_pending)
	{
	libdns_reinit_pending = 0;
	libdns_deinit ();
	}

	err = libdns_init ();
	if (err)
	return err;

	if (!opt_timeout)
	set_dns_timeout (0);

	res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
	dns_opts (.socks_host = &libdns.socks_host,
	.socks_user = tor_socks_user,
	.socks_password = tor_socks_password ),
	&derr);
	if (!res)
	return libdns_error_to_gpg_error (derr);

	*r_res = res;
	return 0;
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	/* Helper to test whether we need to try again after having switched
	* the Tor port. */
	static int
	libdns_switch_port_p (gpg_error_t err)
	{
	if (tor_mode && gpg_err_code (err) == GPG_ERR_ECONNREFUSED
	&& libdns_tor_port == TOR_PORT)
	{
	/* Switch port and try again. */
	if (opt_debug)
	log_debug ("dns: switching from SOCKS port %d to %d\n",
	TOR_PORT, TOR_PORT2);
	libdns_tor_port = TOR_PORT2;
	libdns_reinit_pending = 1;
	return 1;
	}
	return 0;
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	/* Wrapper around dns_res_submit. */
	static gpg_error_t
	libdns_res_submit (struct dns_resolver res, const char qname,
	enum dns_type qtype, enum dns_class qclass)
	{
	return libdns_error_to_gpg_error (dns_res_submit (res, qname, qtype, qclass));
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	/* Standard event handling loop. */
	gpg_error_t
	libdns_res_wait (struct dns_resolver *res)
	{
	gpg_error_t err;

	while ((err = libdns_error_to_gpg_error (dns_res_check (res)))
	&& gpg_err_code (err) == GPG_ERR_EAGAIN)
	{
	if (dns_res_elapsed (res) > opt_timeout)
	{
	err = gpg_error (GPG_ERR_DNS_TIMEOUT);
	break;
	}

	my_unprotect ();
	dns_res_poll (res, 1);
	my_protect ();
	}

	return err;
	}
	#endif /USE_LIBDNS/


	#ifdef USE_LIBDNS
	static gpg_error_t
	resolve_name_libdns (const char *name, unsigned short port,
	int want_family, int want_socktype,
	dns_addrinfo_t r_dai, char *r_canonname)
	{
	gpg_error_t err;
	dns_addrinfo_t daihead = NULL;
	dns_addrinfo_t dai;
	struct dns_resolver *res = NULL;
	struct dns_addrinfo *ai = NULL;
	struct addrinfo hints;
	struct addrinfo *ent;
	char portstr_[21];
	char *portstr = NULL;
	char *namebuf = NULL;
	int derr;

	*r_dai = NULL;
	if (r_canonname)
	*r_canonname = NULL;

	memset (&hints, 0, sizeof hints);
	hints.ai_family = want_family;
	hints.ai_socktype = want_socktype;
	hints.ai_flags = AI_ADDRCONFIG;
	if (r_canonname)
	hints.ai_flags \|= AI_CANONNAME;

	if (port)
	{
	snprintf (portstr_, sizeof portstr_, "%hu", port);
	portstr = portstr_;
	}

	err = libdns_res_open (&res);
	if (err)
	goto leave;


	if (is_ip_address (name))
	{
	hints.ai_flags \|= AI_NUMERICHOST;
	/* libdns does not grok brackets - remove them. */
	if (*name == '[' && name[strlen(name)-1] == ']')
	{
	namebuf = xtrymalloc (strlen (name));
	if (!namebuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	strcpy (namebuf, name+1);
	namebuf[strlen (namebuf)-1] = 0;
	name = namebuf;
	}
	}

	ai = dns_ai_open (name, portstr, 0, &hints, res, &derr);
	if (!ai)
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Loop over all records. */
	for (;;)
	{
	err = libdns_error_to_gpg_error (dns_ai_nextent (&ent, ai));
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	{
	if (daihead)
	err = 0; /* We got some results, we're good. */
	break; /* Ready. */
	}
	if (gpg_err_code (err) == GPG_ERR_EAGAIN)
	{
	if (dns_ai_elapsed (ai) > opt_timeout)
	{
	err = gpg_error (GPG_ERR_DNS_TIMEOUT);
	goto leave;
	}

	my_unprotect ();
	dns_ai_poll (ai, 1);
	my_protect ();
	continue;
	}
	if (err)
	goto leave;

	if (r_canonname && ! *r_canonname && ent && ent->ai_canonname)
	{
	*r_canonname = xtrystrdup (ent->ai_canonname);
	if (!*r_canonname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Libdns appends the root zone part which is problematic
	* for most other functions - strip it. */
	if (*r_canonname && (r_canonname)[strlen (*r_canonname)-1] == '.')
	(r_canonname)[strlen (r_canonname)-1] = 0;
	}

	dai = xtrymalloc (sizeof *dai + ent->ai_addrlen -1);
	if (dai == NULL)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	dai->family = ent->ai_family;
	dai->socktype = ent->ai_socktype;
	dai->protocol = ent->ai_protocol;
	dai->addrlen = ent->ai_addrlen;
	memcpy (dai->addr, ent->ai_addr, ent->ai_addrlen);
	dai->next = daihead;
	daihead = dai;

	xfree (ent);
	}

	leave:
	dns_ai_close (ai);
	dns_res_close (res);

	if (err)
	{
	if (r_canonname)
	{
	xfree (*r_canonname);
	*r_canonname = NULL;
	}
	free_dns_addrinfo (daihead);
	}
	else
	*r_dai = daihead;

	xfree (namebuf);
	return err;
	}
	#endif /USE_LIBDNS/


	/* Resolve a name using the standard system function. */
	static gpg_error_t
	resolve_name_standard (const char *name, unsigned short port,
	int want_family, int want_socktype,
	dns_addrinfo_t r_dai, char *r_canonname)
	{
	gpg_error_t err = 0;
	dns_addrinfo_t daihead = NULL;
	dns_addrinfo_t dai;
	struct addrinfo *aibuf = NULL;
	struct addrinfo hints, *ai;
	char portstr[21];
	int ret;

	*r_dai = NULL;
	if (r_canonname)
	*r_canonname = NULL;

	memset (&hints, 0, sizeof hints);
	hints.ai_family = want_family;
	hints.ai_socktype = want_socktype;
	hints.ai_flags = AI_ADDRCONFIG;
	if (r_canonname)
	hints.ai_flags \|= AI_CANONNAME;
	if (is_ip_address (name))
	hints.ai_flags \|= AI_NUMERICHOST;

	if (port)
	snprintf (portstr, sizeof portstr, "%hu", port);
	else
	*portstr = 0;

	- /* We can't use the the AI_IDN flag because that does the conversion
	+ /* We can't use the AI_IDN flag because that does the conversion
	using the current locale. However, GnuPG always used UTF-8. To
	support IDN we would need to make use of the libidn API. */
	ret = getaddrinfo (name, *portstr? portstr : NULL, &hints, &aibuf);
	if (ret)
	{
	aibuf = NULL;
	err = map_eai_to_gpg_error (ret);
	if (gpg_err_code (err) == GPG_ERR_NO_NAME)
	{
	/* There seems to be a bug in the glibc getaddrinfo function
	if the CNAME points to a long list of A and AAAA records
	in which case the function return NO_NAME. Let's do the
	CNAME redirection again. */
	char *cname;

	if (get_dns_cname (name, &cname))
	goto leave; /* Still no success. */

	ret = getaddrinfo (cname, *portstr? portstr : NULL, &hints, &aibuf);
	xfree (cname);
	if (ret)
	{
	aibuf = NULL;
	err = map_eai_to_gpg_error (ret);
	goto leave;
	}
	err = 0; /* Yep, now it worked. */
	}
	else
	goto leave;
	}

	if (r_canonname && aibuf && aibuf->ai_canonname)
	{
	*r_canonname = xtrystrdup (aibuf->ai_canonname);
	if (!*r_canonname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	for (ai = aibuf; ai; ai = ai->ai_next)
	{
	if (ai->ai_family != AF_INET6 && ai->ai_family != AF_INET)
	continue;
	if (opt_disable_ipv4 && ai->ai_family == AF_INET)
	continue;

	dai = xtrymalloc (sizeof *dai + ai->ai_addrlen - 1);
	dai->family = ai->ai_family;
	dai->socktype = ai->ai_socktype;
	dai->protocol = ai->ai_protocol;
	dai->addrlen = ai->ai_addrlen;
	memcpy (dai->addr, ai->ai_addr, ai->ai_addrlen);
	dai->next = daihead;
	daihead = dai;
	}

	leave:
	if (aibuf)
	freeaddrinfo (aibuf);
	if (err)
	{
	if (r_canonname)
	{
	xfree (*r_canonname);
	*r_canonname = NULL;
	}
	free_dns_addrinfo (daihead);
	}
	else
	*r_dai = daihead;
	return err;
	}


	/* This a wrapper around getaddrinfo with slightly different semantics.
	NAME is the name to resolve.
	PORT is the requested port or 0.
	WANT_FAMILY is either 0 (AF_UNSPEC), AF_INET6, or AF_INET4.
	WANT_SOCKETTYPE is either SOCK_STREAM or SOCK_DGRAM.

	On success the result is stored in a linked list with the head
	stored at the address R_AI; the caller must call gpg_addrinfo_free
	on this. If R_CANONNAME is not NULL the official name of the host
	is stored there as a malloced string; if that name is not available
	NULL is stored. */
	gpg_error_t
	resolve_dns_name (const char *name, unsigned short port,
	int want_family, int want_socktype,
	dns_addrinfo_t r_ai, char *r_canonname)
	{
	gpg_error_t err;

	#ifdef USE_LIBDNS
	if (!standard_resolver)
	{
	err = resolve_name_libdns (name, port, want_family, want_socktype,
	r_ai, r_canonname);
	if (err && libdns_switch_port_p (err))
	err = resolve_name_libdns (name, port, want_family, want_socktype,
	r_ai, r_canonname);
	}
	else
	#endif /USE_LIBDNS/
	err = resolve_name_standard (name, port, want_family, want_socktype,
	r_ai, r_canonname);
	if (opt_debug)
	log_debug ("dns: resolve_dns_name(%s): %s\n", name, gpg_strerror (err));
	return err;
	}


	#ifdef USE_LIBDNS
	/* Resolve an address using libdns. */
	static gpg_error_t
	resolve_addr_libdns (const struct sockaddr *addr, int addrlen,
	unsigned int flags, char **r_name)
	{
	gpg_error_t err;
	char host[DNS_D_MAXNAME + 1];
	struct dns_resolver *res = NULL;
	struct dns_packet *ans = NULL;
	struct dns_ptr ptr;
	int derr;

	*r_name = NULL;

	/* First we turn ADDR into a DNS name (with ".arpa" suffix). */
	err = 0;
	if (addr->sa_family == AF_INET6)
	{
	const struct sockaddr_in6 a6 = (const struct sockaddr_in6 )addr;
	if (!dns_aaaa_arpa (host, sizeof host, (void*)&a6->sin6_addr))
	err = gpg_error (GPG_ERR_INV_OBJ);
	}
	else if (addr->sa_family == AF_INET)
	{
	const struct sockaddr_in a4 = (const struct sockaddr_in )addr;
	if (!dns_a_arpa (host, sizeof host, (void*)&a4->sin_addr))
	err = gpg_error (GPG_ERR_INV_OBJ);
	}
	else
	err = gpg_error (GPG_ERR_EAFNOSUPPORT);
	if (err)
	goto leave;


	err = libdns_res_open (&res);
	if (err)
	goto leave;

	err = libdns_res_submit (res, host, DNS_T_PTR, DNS_C_IN);
	if (err)
	goto leave;

	err = libdns_res_wait (res);
	if (err)
	goto leave;

	ans = dns_res_fetch (res, &derr);
	if (!ans)
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Check the rcode. */
	switch (dns_p_rcode (ans))
	{
	case DNS_RC_NOERROR:
	break;
	case DNS_RC_NXDOMAIN:
	err = gpg_error (GPG_ERR_NO_NAME);
	break;
	default:
	err = GPG_ERR_SERVER_FAILED;
	goto leave;
	}

	/* Parse the result. */
	if (!err)
	{
	struct dns_rr rr;
	struct dns_rr_i rri;

	memset (&rri, 0, sizeof rri);
	dns_rr_i_init (&rri, ans);
	rri.section = DNS_S_ALL & ~DNS_S_QD;
	rri.name = host;
	rri.type = DNS_T_PTR;

	if (!dns_rr_grep (&rr, 1, &rri, ans, &derr))
	{
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave;
	}

	err = libdns_error_to_gpg_error (dns_ptr_parse (&ptr, &rr, ans));
	if (err)
	goto leave;

	/* Copy result. */
	*r_name = xtrystrdup (ptr.host);
	if (!*r_name)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Libdns appends the root zone part which is problematic
	* for most other functions - strip it. */
	if (*r_name && (r_name)[strlen (*r_name)-1] == '.')
	(r_name)[strlen (r_name)-1] = 0;
	}
	else /* GPG_ERR_NO_NAME */
	{
	char buffer, p;
	int buflen;
	int ec;

	buffer = ptr.host;
	buflen = sizeof ptr.host;

	p = buffer;
	if (addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
	{
	*p++ = '[';
	buflen -= 2;
	}
	ec = getnameinfo (addr, addrlen, p, buflen, NULL, 0, NI_NUMERICHOST);
	if (ec)
	{
	err = map_eai_to_gpg_error (ec);
	goto leave;
	}
	if (addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
	strcat (buffer, "]");
	}

	leave:
	dns_free (ans);
	dns_res_close (res);
	return err;
	}
	#endif /USE_LIBDNS/


	/* Resolve an address using the standard system function. */
	static gpg_error_t
	resolve_addr_standard (const struct sockaddr *addr, int addrlen,
	unsigned int flags, char **r_name)
	{
	gpg_error_t err;
	int ec;
	char buffer, p;
	int buflen;

	*r_name = NULL;

	buflen = NI_MAXHOST;
	buffer = xtrymalloc (buflen + 2 + 1);
	if (!buffer)
	return gpg_error_from_syserror ();

	if ((flags & DNS_NUMERICHOST) \|\| tor_mode)
	ec = EAI_NONAME;
	else
	ec = getnameinfo (addr, addrlen, buffer, buflen, NULL, 0, NI_NAMEREQD);

	if (!ec && *buffer == '[')
	ec = EAI_FAIL; /* A name may never start with a bracket. */
	else if (ec == EAI_NONAME)
	{
	p = buffer;
	if (addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
	{
	*p++ = '[';
	buflen -= 2;
	}
	ec = getnameinfo (addr, addrlen, p, buflen, NULL, 0, NI_NUMERICHOST);
	if (!ec && addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
	strcat (buffer, "]");
	}

	if (ec)
	err = map_eai_to_gpg_error (ec);
	else
	{
	p = xtryrealloc (buffer, strlen (buffer)+1);
	if (!p)
	err = gpg_error_from_syserror ();
	else
	{
	buffer = p;
	err = 0;
	}
	}

	if (err)
	xfree (buffer);
	else
	*r_name = buffer;

	return err;
	}


	/* A wrapper around getnameinfo. */
	gpg_error_t
	resolve_dns_addr (const struct sockaddr *addr, int addrlen,
	unsigned int flags, char **r_name)
	{
	gpg_error_t err;

	#ifdef USE_LIBDNS
	/* Note that we divert to the standard resolver for NUMERICHOST. */
	if (!standard_resolver && !(flags & DNS_NUMERICHOST))
	{
	err = resolve_addr_libdns (addr, addrlen, flags, r_name);
	if (err && libdns_switch_port_p (err))
	err = resolve_addr_libdns (addr, addrlen, flags, r_name);
	}
	else
	#endif /USE_LIBDNS/
	err = resolve_addr_standard (addr, addrlen, flags, r_name);

	if (opt_debug)
	log_debug ("dns: resolve_dns_addr(): %s\n", gpg_strerror (err));
	return err;
	}


	/* Check whether NAME is an IP address. Returns a true if it is
	* either an IPv6 or a IPv4 numerical address. The actual return
	* values can also be used to identify whether it is v4 or v6: The
	* true value will surprisingly be 4 for IPv4 and 6 for IPv6. */
	int
	is_ip_address (const char *name)
	{
	const char *s;
	int ndots, dblcol, n;

	if (*name == '[')
	return 6; /* yes: A legal DNS name may not contain this character;
	this must be bracketed v6 address. */
	if (*name == '.')
	return 0; /* No. A leading dot is not a valid IP address. */

	/* Check whether this is a v6 address. */
	ndots = n = dblcol = 0;
	for (s=name; *s; s++)
	{
	if (*s == ':')
	{
	ndots++;
	if (s[1] == ':')
	{
	ndots++;
	if (dblcol)
	return 0; /* No: Only one "::" allowed. */
	dblcol++;
	if (s[1])
	s++;
	}
	n = 0;
	}
	else if (*s == '.')
	goto legacy;
	else if (!strchr ("0123456789abcdefABCDEF", *s))
	return 0; /* No: Not a hex digit. */
	else if (++n > 4)
	return 0; /* To many digits in a group. */
	}
	if (ndots > 7)
	return 0; /* No: Too many colons. */
	else if (ndots > 1)
	return 6; /* Yes: At least 2 colons indicate an v6 address. */

	legacy:
	/* Check whether it is legacy IP address. */
	ndots = n = 0;
	for (s=name; *s; s++)
	{
	if (*s == '.')
	{
	if (s[1] == '.')
	return 0; /* No: Double dot. */
	if (atoi (s+1) > 255)
	return 0; /* No: Ipv4 byte value too large. */
	ndots++;
	n = 0;
	}
	else if (!strchr ("0123456789", *s))
	return 0; /* No: Not a digit. */
	else if (++n > 3)
	return 0; /* No: More than 3 digits. */
	}
	return (ndots == 3)? 4 : 0;
	}


	/* Return true if NAME is an onion address. */
	int
	is_onion_address (const char *name)
	{
	size_t len;

	len = name? strlen (name) : 0;
	if (len < 8 \|\| strcmp (name + len - 6, ".onion"))
	return 0;
	/* Note that we require at least 2 characters before the suffix. */
	return 1; /* Yes. */
	}


	/* libdns version of get_dns_cert. */
	#ifdef USE_LIBDNS
	static gpg_error_t
	get_dns_cert_libdns (const char *name, int want_certtype,
	void *r_key, size_t r_keylen,
	unsigned char *r_fpr, size_t r_fprlen, char **r_url)
	{
	gpg_error_t err;
	struct dns_resolver *res = NULL;
	struct dns_packet *ans = NULL;
	struct dns_rr rr;
	struct dns_rr_i rri;
	char host[DNS_D_MAXNAME + 1];
	int derr;
	int qtype;

	/* Get the query type from WANT_CERTTYPE (which in general indicates
	* the subtype we want). */
	qtype = (want_certtype < DNS_CERTTYPE_RRBASE
	? T_CERT
	: (want_certtype - DNS_CERTTYPE_RRBASE));


	err = libdns_res_open (&res);
	if (err)
	goto leave;

	if (dns_d_anchor (host, sizeof host, name, strlen (name)) >= sizeof host)
	{
	err = gpg_error (GPG_ERR_ENAMETOOLONG);
	goto leave;
	}

	err = libdns_res_submit (res, name, qtype, DNS_C_IN);
	if (err)
	goto leave;

	err = libdns_res_wait (res);
	if (err)
	goto leave;

	ans = dns_res_fetch (res, &derr);
	if (!ans)
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Check the rcode. */
	switch (dns_p_rcode (ans))
	{
	case DNS_RC_NOERROR: break;
	case DNS_RC_NXDOMAIN: err = gpg_error (GPG_ERR_NO_NAME); break;
	default: err = GPG_ERR_SERVER_FAILED; break;
	}
	if (err)
	goto leave;

	memset (&rri, 0, sizeof rri);
	dns_rr_i_init (&rri, ans);
	rri.section = DNS_S_ALL & ~DNS_S_QD;
	rri.name = host;
	rri.type = qtype;

	err = gpg_error (GPG_ERR_NOT_FOUND);
	while (dns_rr_grep (&rr, 1, &rri, ans, &derr))
	{
	unsigned char *rp = ans->data + rr.rd.p;
	unsigned short len = rr.rd.len;
	u16 subtype;

	if (!len)
	{
	/* Definitely too short - skip. */
	}
	else if (want_certtype >= DNS_CERTTYPE_RRBASE
	&& rr.type == (want_certtype - DNS_CERTTYPE_RRBASE)
	&& r_key)
	{
	*r_key = xtrymalloc (len);
	if (!*r_key)
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*r_key, rp, len);
	*r_keylen = len;
	err = 0;
	}
	goto leave;
	}
	else if (want_certtype >= DNS_CERTTYPE_RRBASE)
	{
	/* We did not found the requested RR - skip. */
	}
	else if (rr.type == T_CERT && len > 5)
	{
	/* We got a CERT type. */
	subtype = buf16_to_u16 (rp);
	rp += 2; len -= 2;

	/* Skip the CERT key tag and algo which we don't need. */
	rp += 3; len -= 3;

	if (want_certtype && want_certtype != subtype)
	; /* Not the requested subtype - skip. */
	else if (subtype == DNS_CERTTYPE_PGP && len && r_key && r_keylen)
	{
	/* PGP subtype */
	*r_key = xtrymalloc (len);
	if (!*r_key)
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*r_key, rp, len);
	*r_keylen = len;
	err = 0;
	}
	goto leave;
	}
	else if (subtype == DNS_CERTTYPE_IPGP
	&& len && len < 1023 && len >= rp[0] + 1)
	{
	/* IPGP type */
	*r_fprlen = rp[0];
	if (*r_fprlen)
	{
	r_fpr = xtrymalloc (r_fprlen);
	if (!*r_fpr)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	memcpy (r_fpr, rp+1, r_fprlen);
	}
	else
	*r_fpr = NULL;

	if (len > *r_fprlen + 1)
	{
	r_url = xtrymalloc (len - (r_fprlen + 1) + 1);
	if (!*r_url)
	{
	err = gpg_error_from_syserror ();
	xfree (*r_fpr);
	*r_fpr = NULL;
	goto leave;
	}
	memcpy (r_url, rp + r_fprlen + 1, len - (*r_fprlen + 1));
	(r_url)[len - (r_fprlen + 1)] = 0;
	}
	else
	*r_url = NULL;

	err = 0;
	goto leave;
	}
	else
	{
	/* Unknown subtype or record too short - skip. */
	}
	}
	else
	{
	/* Not a requested type - skip. */
	}
	}

	leave:
	dns_free (ans);
	dns_res_close (res);
	return err;
	}
	#endif /USE_LIBDNS/


	/* Standard resolver version of get_dns_cert. */
	static gpg_error_t
	get_dns_cert_standard (const char *name, int want_certtype,
	void *r_key, size_t r_keylen,
	unsigned char *r_fpr, size_t r_fprlen, char **r_url)
	{
	#ifdef HAVE_SYSTEM_RESOLVER
	gpg_error_t err;
	unsigned char *answer;
	int r;
	u16 count;

	/* Allocate a 64k buffer which is the limit for an DNS response. */
	answer = xtrymalloc (65536);
	if (!answer)
	return gpg_error_from_syserror ();

	err = gpg_error (GPG_ERR_NOT_FOUND);
	r = res_query (name, C_IN,
	(want_certtype < DNS_CERTTYPE_RRBASE
	? T_CERT
	: (want_certtype - DNS_CERTTYPE_RRBASE)),
	answer, 65536);
	/* Not too big, not too small, no errors and at least 1 answer. */
	if (r >= sizeof (HEADER) && r <= 65536
	&& (((HEADER )(void ) answer)->rcode) == NOERROR
	&& (count = ntohs (((HEADER )(void ) answer)->ancount)))
	{
	int rc;
	unsigned char pt, emsg;

	emsg = &answer[r];

	pt = &answer[sizeof (HEADER)];

	/* Skip over the query */

	rc = dn_skipname (pt, emsg);
	if (rc == -1)
	{
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}
	pt += rc + QFIXEDSZ;

	/* There are several possible response types for a CERT request.
	We're interested in the PGP (a key) and IPGP (a URI) types.
	Skip all others. TODO: A key is better than a URI since
	we've gone through all this bother to fetch it, so favor that
	if we have both PGP and IPGP? */

	while (count-- > 0 && pt < emsg)
	{
	u16 type, class, dlen, ctype;

	rc = dn_skipname (pt, emsg); /* the name we just queried for */
	if (rc == -1)
	{
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}

	pt += rc;

	/* Truncated message? 15 bytes takes us to the point where
	we start looking at the ctype. */
	if ((emsg - pt) < 15)
	break;

	type = buf16_to_u16 (pt);
	pt += 2;

	class = buf16_to_u16 (pt);
	pt += 2;

	if (class != C_IN)
	break;

	/* ttl */
	pt += 4;

	/* data length */
	dlen = buf16_to_u16 (pt);
	pt += 2;

	/* Check the type and parse. */
	if (want_certtype >= DNS_CERTTYPE_RRBASE
	&& type == (want_certtype - DNS_CERTTYPE_RRBASE)
	&& r_key)
	{
	*r_key = xtrymalloc (dlen);
	if (!*r_key)
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*r_key, pt, dlen);
	*r_keylen = dlen;
	err = 0;
	}
	goto leave;
	}
	else if (want_certtype >= DNS_CERTTYPE_RRBASE)
	{
	/* We did not found the requested RR. */
	pt += dlen;
	}
	else if (type == T_CERT)
	{
	/* We got a CERT type. */
	ctype = buf16_to_u16 (pt);
	pt += 2;

	/* Skip the CERT key tag and algo which we don't need. */
	pt += 3;

	dlen -= 5;

	/* 15 bytes takes us to here */
	if (want_certtype && want_certtype != ctype)
	; /* Not of the requested certtype. */
	else if (ctype == DNS_CERTTYPE_PGP && dlen && r_key && r_keylen)
	{
	/* PGP type */
	*r_key = xtrymalloc (dlen);
	if (!*r_key)
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*r_key, pt, dlen);
	*r_keylen = dlen;
	err = 0;
	}
	goto leave;
	}
	else if (ctype == DNS_CERTTYPE_IPGP
	&& dlen && dlen < 1023 && dlen >= pt[0] + 1)
	{
	/* IPGP type */
	*r_fprlen = pt[0];
	if (*r_fprlen)
	{
	r_fpr = xtrymalloc (r_fprlen);
	if (!*r_fpr)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	memcpy (r_fpr, &pt[1], r_fprlen);
	}
	else
	*r_fpr = NULL;

	if (dlen > *r_fprlen + 1)
	{
	r_url = xtrymalloc (dlen - (r_fprlen + 1) + 1);
	if (!*r_url)
	{
	err = gpg_error_from_syserror ();
	xfree (*r_fpr);
	*r_fpr = NULL;
	goto leave;
	}
	memcpy (r_url, &pt[r_fprlen + 1],
	dlen - (*r_fprlen + 1));
	(r_url)[dlen - (r_fprlen + 1)] = '\0';
	}
	else
	*r_url = NULL;

	err = 0;
	goto leave;
	}

	/* No subtype matches, so continue with the next answer. */
	pt += dlen;
	}
	else
	{
	/* Not a requested type - might be a CNAME. Try next item. */
	pt += dlen;
	}
	}
	}

	leave:
	xfree (answer);
	return err;

	#else /!HAVE_SYSTEM_RESOLVER/

	(void)name;
	(void)want_certtype;
	(void)r_key;
	(void)r_keylen;
	(void)r_fpr;
	(void)r_fprlen;
	(void)r_url;
	return gpg_error (GPG_ERR_NOT_SUPPORTED);

	#endif /!HAVE_SYSTEM_RESOLVER/
	}


	/* Returns 0 on success or an error code. If a PGP CERT record was
	found, the malloced data is returned at (R_KEY, R_KEYLEN) and
	the other return parameters are set to NULL/0. If an IPGP CERT
	record was found the fingerprint is stored as an allocated block at
	- R_FPR and its length at R_FPRLEN; an URL is is allocated as a
	+ R_FPR and its length at R_FPRLEN; an URL is allocated as a
	string and returned at R_URL. If WANT_CERTTYPE is 0 this function
	returns the first CERT found with a supported type; it is expected
	that only one CERT record is used. If WANT_CERTTYPE is one of the
	supported certtypes only records with this certtype are considered
	and the first found is returned. (R_KEY,R_KEYLEN) are optional. */
	gpg_error_t
	get_dns_cert (const char *name, int want_certtype,
	void *r_key, size_t r_keylen,
	unsigned char *r_fpr, size_t r_fprlen, char **r_url)
	{
	gpg_error_t err;

	if (r_key)
	*r_key = NULL;
	if (r_keylen)
	*r_keylen = 0;
	*r_fpr = NULL;
	*r_fprlen = 0;
	*r_url = NULL;

	#ifdef USE_LIBDNS
	if (!standard_resolver)
	{
	err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
	r_fpr, r_fprlen, r_url);
	if (err && libdns_switch_port_p (err))
	err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
	r_fpr, r_fprlen, r_url);
	}
	else
	#endif /USE_LIBDNS/
	err = get_dns_cert_standard (name, want_certtype, r_key, r_keylen,
	r_fpr, r_fprlen, r_url);

	if (opt_debug)
	log_debug ("dns: get_dns_cert(%s): %s\n", name, gpg_strerror (err));
	return err;
	}


	static int
	priosort(const void a,const void b)
	{
	const struct srventry sa=a,sb=b;
	if(sa->priority>sb->priority)
	return 1;
	else if(sa->priority<sb->priority)
	return -1;
	else
	return 0;
	}


	/* Libdns based helper for getsrv. Note that it is expected that NULL
	* is stored at the address of LIST and 0 is stored at the address of
	* R_COUNT. */
	#ifdef USE_LIBDNS
	static gpg_error_t
	getsrv_libdns (const char name, struct srventry list, unsigned int r_count)
	{
	gpg_error_t err;
	struct dns_resolver *res = NULL;
	struct dns_packet *ans = NULL;
	struct dns_rr rr;
	struct dns_rr_i rri;
	char host[DNS_D_MAXNAME + 1];
	int derr;
	unsigned int srvcount = 0;

	err = libdns_res_open (&res);
	if (err)
	goto leave;

	if (dns_d_anchor (host, sizeof host, name, strlen (name)) >= sizeof host)
	{
	err = gpg_error (GPG_ERR_ENAMETOOLONG);
	goto leave;
	}

	err = libdns_res_submit (res, name, DNS_T_SRV, DNS_C_IN);
	if (err)
	goto leave;

	err = libdns_res_wait (res);
	if (err)
	goto leave;

	ans = dns_res_fetch (res, &derr);
	if (!ans)
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Check the rcode. */
	switch (dns_p_rcode (ans))
	{
	case DNS_RC_NOERROR: break;
	case DNS_RC_NXDOMAIN: err = gpg_error (GPG_ERR_NO_NAME); break;
	default: err = GPG_ERR_SERVER_FAILED; break;
	}
	if (err)
	goto leave;

	memset (&rri, 0, sizeof rri);
	dns_rr_i_init (&rri, ans);
	rri.section = DNS_S_ALL & ~DNS_S_QD;
	rri.name = host;
	rri.type = DNS_T_SRV;

	while (dns_rr_grep (&rr, 1, &rri, ans, &derr))
	{
	struct dns_srv dsrv;
	struct srventry *srv;
	struct srventry *newlist;

	err = libdns_error_to_gpg_error (dns_srv_parse(&dsrv, &rr, ans));
	if (err)
	goto leave;

	newlist = xtryrealloc (list, (srvcount+1)sizeof(struct srventry));
	if (!newlist)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	*list = newlist;
	memset (&(*list)[srvcount], 0, sizeof(struct srventry));
	srv = &(*list)[srvcount];
	srvcount++;
	srv->priority = dsrv.priority;
	srv->weight = dsrv.weight;
	srv->port = dsrv.port;
	mem2str (srv->target, dsrv.target, sizeof srv->target);
	/* Libdns appends the root zone part which is problematic for
	* most other functions - strip it. */
	if (*srv->target && (srv->target)[strlen (srv->target)-1] == '.')
	(srv->target)[strlen (srv->target)-1] = 0;
	}

	*r_count = srvcount;

	leave:
	if (err)
	{
	xfree (*list);
	*list = NULL;
	}
	dns_free (ans);
	dns_res_close (res);
	return err;
	}
	#endif /USE_LIBDNS/


	/* Standard resolver based helper for getsrv. Note that it is
	* expected that NULL is stored at the address of LIST and 0 is stored
	* at the address of R_COUNT. */
	static gpg_error_t
	getsrv_standard (const char *name,
	struct srventry *list, unsigned int r_count)
	{
	#ifdef HAVE_SYSTEM_RESOLVER
	union {
	unsigned char ans[2048];
	HEADER header[1];
	} res;
	unsigned char *answer = res.ans;
	HEADER *header = res.header;
	unsigned char pt, emsg;
	int r, rc;
	u16 dlen;
	unsigned int srvcount = 0;
	u16 count;

	/* Do not allow a query using the standard resolver in Tor mode. */
	if (tor_mode)
	return gpg_error (GPG_ERR_NOT_ENABLED);

	my_unprotect ();
	r = res_query (name, C_IN, T_SRV, answer, sizeof res.ans);
	my_protect ();
	if (r < 0)
	return get_h_errno_as_gpg_error ();
	if (r < sizeof (HEADER))
	return gpg_error (GPG_ERR_SERVER_FAILED);
	if (r > sizeof res.ans)
	return gpg_error (GPG_ERR_SYSTEM_BUG);
	if (header->rcode != NOERROR \|\| !(count=ntohs (header->ancount)))
	return gpg_error (GPG_ERR_NO_NAME); /* Error or no record found. */

	emsg = &answer[r];
	pt = &answer[sizeof(HEADER)];

	/* Skip over the query */
	rc = dn_skipname (pt, emsg);
	if (rc == -1)
	goto fail;

	pt += rc + QFIXEDSZ;

	while (count-- > 0 && pt < emsg)
	{
	struct srventry *srv;
	u16 type, class;
	struct srventry *newlist;

	newlist = xtryrealloc (list, (srvcount+1)sizeof(struct srventry));
	if (!newlist)
	goto fail;
	*list = newlist;
	memset (&(*list)[srvcount], 0, sizeof(struct srventry));
	srv = &(*list)[srvcount];
	srvcount++;

	rc = dn_skipname (pt, emsg); /* The name we just queried for. */
	if (rc == -1)
	goto fail;
	pt += rc;

	/* Truncated message? */
	if ((emsg-pt) < 16)
	goto fail;

	type = buf16_to_u16 (pt);
	pt += 2;
	/* We asked for SRV and got something else !? */
	if (type != T_SRV)
	goto fail;

	class = buf16_to_u16 (pt);
	pt += 2;
	/* We asked for IN and got something else !? */
	if (class != C_IN)
	goto fail;

	pt += 4; /* ttl */
	dlen = buf16_to_u16 (pt);
	pt += 2;

	srv->priority = buf16_to_ushort (pt);
	pt += 2;
	srv->weight = buf16_to_ushort (pt);
	pt += 2;
	srv->port = buf16_to_ushort (pt);
	pt += 2;

	/* Get the name. 2782 doesn't allow name compression, but
	* dn_expand still works to pull the name out of the packet. */
	rc = dn_expand (answer, emsg, pt, srv->target, sizeof srv->target);
	if (rc == 1 && srv->target[0] == 0) /* "." */
	{
	xfree(*list);
	*list = NULL;
	return 0;
	}
	if (rc == -1)
	goto fail;
	pt += rc;
	/* Corrupt packet? */
	if (dlen != rc+6)
	goto fail;
	}

	*r_count = srvcount;
	return 0;

	fail:
	xfree (*list);
	*list = NULL;
	return gpg_error (GPG_ERR_GENERAL);

	#else /!HAVE_SYSTEM_RESOLVER/

	(void)name;
	(void)list;
	(void)r_count;
	return gpg_error (GPG_ERR_NOT_SUPPORTED);

	#endif /!HAVE_SYSTEM_RESOLVER/
	}


	/* Query a SRV record for SERVICE and PROTO for NAME. If SERVICE is
	* NULL, NAME is expected to contain the full query name. Note that
	* we do not return NONAME but simply store 0 at R_COUNT. On error an
	* error code is returned and 0 stored at R_COUNT. */
	gpg_error_t
	get_dns_srv (const char name, const char service, const char *proto,
	struct srventry *list, unsigned int r_count)
	{
	gpg_error_t err;
	char *namebuffer = NULL;
	unsigned int srvcount;
	int i;

	*list = NULL;
	*r_count = 0;
	srvcount = 0;

	/* If SERVICE is given construct the query from it and PROTO. */
	if (service)
	{
	namebuffer = xtryasprintf ("_%s._%s.%s",
	service, proto? proto:"tcp", name);
	if (!namebuffer)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	name = namebuffer;
	}


	#ifdef USE_LIBDNS
	if (!standard_resolver)
	{
	err = getsrv_libdns (name, list, &srvcount);
	if (err && libdns_switch_port_p (err))
	err = getsrv_libdns (name, list, &srvcount);
	}
	else
	#endif /USE_LIBDNS/
	err = getsrv_standard (name, list, &srvcount);

	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_NAME)
	err = 0;
	goto leave;
	}

	/* Now we have an array of all the srv records. */

	/* Order by priority */
	qsort(*list,srvcount,sizeof(struct srventry),priosort);

	/* For each priority, move the zero-weighted items first. */
	for (i=0; i < srvcount; i++)
	{
	int j;

	for (j=i;j < srvcount && (list)[i].priority == (list)[j].priority; j++)
	{
	if((*list)[j].weight==0)
	{
	/* Swap j with i */
	if(j!=i)
	{
	struct srventry temp;

	memcpy (&temp,&(*list)[j],sizeof(struct srventry));
	memcpy (&(list)[j],&(list)[i],sizeof(struct srventry));
	memcpy (&(*list)[i],&temp,sizeof(struct srventry));
	}

	break;
	}
	}
	}

	/* Run the RFC-2782 weighting algorithm. We don't need very high
	quality randomness for this, so regular libc srand/rand is
	sufficient. */

	{
	static int done;
	if (!done)
	{
	done = 1;
	srand (time (NULL)*getpid());
	}
	}

	for (i=0; i < srvcount; i++)
	{
	int j;
	float prio_count=0,chose;

	for (j=i; j < srvcount && (list)[i].priority == (list)[j].priority; j++)
	{
	prio_count+=(*list)[j].weight;
	(*list)[j].run_count=prio_count;
	}

	chose=prio_count*rand()/RAND_MAX;

	for (j=i;j<srvcount && (list)[i].priority==(list)[j].priority;j++)
	{
	if (chose<=(*list)[j].run_count)
	{
	/* Swap j with i */
	if(j!=i)
	{
	struct srventry temp;

	memcpy(&temp,&(*list)[j],sizeof(struct srventry));
	memcpy(&(list)[j],&(list)[i],sizeof(struct srventry));
	memcpy(&(*list)[i],&temp,sizeof(struct srventry));
	}
	break;
	}
	}
	}

	leave:
	if (opt_debug)
	{
	if (err)
	log_debug ("dns: getsrv(%s): %s\n", name, gpg_strerror (err));
	else
	log_debug ("dns: getsrv(%s) -> %u records\n", name, srvcount);
	}
	if (!err)
	*r_count = srvcount;
	xfree (namebuffer);
	return err;
	}



	#ifdef USE_LIBDNS
	/* libdns version of get_dns_cname. */
	gpg_error_t
	get_dns_cname_libdns (const char name, char *r_cname)
	{
	gpg_error_t err;
	struct dns_resolver *res;
	struct dns_packet *ans = NULL;
	struct dns_cname cname;
	int derr;

	err = libdns_res_open (&res);
	if (err)
	goto leave;

	err = libdns_res_submit (res, name, DNS_T_CNAME, DNS_C_IN);
	if (err)
	goto leave;

	err = libdns_res_wait (res);
	if (err)
	goto leave;

	ans = dns_res_fetch (res, &derr);
	if (!ans)
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Check the rcode. */
	switch (dns_p_rcode (ans))
	{
	case DNS_RC_NOERROR: break;
	case DNS_RC_NXDOMAIN: err = gpg_error (GPG_ERR_NO_NAME); break;
	default: err = GPG_ERR_SERVER_FAILED; break;
	}
	if (err)
	goto leave;

	/* Parse the result into CNAME. */
	err = libdns_error_to_gpg_error (dns_p_study (ans));
	if (err)
	goto leave;

	if (!dns_d_cname (&cname, sizeof cname, name, strlen (name), ans, &derr))
	{
	err = libdns_error_to_gpg_error (derr);
	goto leave;
	}

	/* Copy result. */
	*r_cname = xtrystrdup (cname.host);
	if (!*r_cname)
	err = gpg_error_from_syserror ();
	else
	{
	/* Libdns appends the root zone part which is problematic
	* for most other functions - strip it. */
	if (*r_cname && (r_cname)[strlen (*r_cname)-1] == '.')
	(r_cname)[strlen (r_cname)-1] = 0;
	}

	leave:
	dns_free (ans);
	dns_res_close (res);
	return err;
	}
	#endif /USE_LIBDNS/


	/* Standard resolver version of get_dns_cname. */
	gpg_error_t
	get_dns_cname_standard (const char name, char *r_cname)
	{
	#ifdef HAVE_SYSTEM_RESOLVER
	gpg_error_t err;
	int rc;
	union {
	unsigned char ans[2048];
	HEADER header[1];
	} res;
	unsigned char *answer = res.ans;
	HEADER *header = res.header;
	unsigned char pt, emsg;
	int r;
	char *cname;
	int cnamesize = 1025;
	u16 count;

	/* Do not allow a query using the standard resolver in Tor mode. */
	if (tor_mode)
	return -1;

	my_unprotect ();
	r = res_query (name, C_IN, T_CERT, answer, sizeof res.ans);
	my_protect ();
	if (r < 0)
	return get_h_errno_as_gpg_error ();
	if (r < sizeof (HEADER))
	return gpg_error (GPG_ERR_SERVER_FAILED);
	if (r > sizeof res.ans)
	return gpg_error (GPG_ERR_SYSTEM_BUG);
	if (header->rcode != NOERROR \|\| !(count=ntohs (header->ancount)))
	return gpg_error (GPG_ERR_NO_NAME); /* Error or no record found. */
	if (count != 1)
	return gpg_error (GPG_ERR_SERVER_FAILED);

	emsg = &answer[r];
	pt = &answer[sizeof(HEADER)];
	rc = dn_skipname (pt, emsg);
	if (rc == -1)
	return gpg_error (GPG_ERR_SERVER_FAILED);

	pt += rc + QFIXEDSZ;
	if (pt >= emsg)
	return gpg_error (GPG_ERR_SERVER_FAILED);

	rc = dn_skipname (pt, emsg);
	if (rc == -1)
	return gpg_error (GPG_ERR_SERVER_FAILED);
	pt += rc + 2 + 2 + 4;
	if (pt+2 >= emsg)
	return gpg_error (GPG_ERR_SERVER_FAILED);
	pt += 2; /* Skip rdlen */

	cname = xtrymalloc (cnamesize);
	if (!cname)
	return gpg_error_from_syserror ();

	rc = dn_expand (answer, emsg, pt, cname, cnamesize -1);
	if (rc == -1)
	{
	xfree (cname);
	return gpg_error (GPG_ERR_SERVER_FAILED);
	}
	*r_cname = xtryrealloc (cname, strlen (cname)+1);
	if (!*r_cname)
	{
	err = gpg_error_from_syserror ();
	xfree (cname);
	return err;
	}
	return 0;

	#else /!HAVE_SYSTEM_RESOLVER/

	(void)name;
	(void)r_cname;
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);

	#endif /!HAVE_SYSTEM_RESOLVER/
	}


	gpg_error_t
	get_dns_cname (const char name, char *r_cname)
	{
	gpg_error_t err;

	*r_cname = NULL;

	#ifdef USE_LIBDNS
	if (!standard_resolver)
	{
	err = get_dns_cname_libdns (name, r_cname);
	if (err && libdns_switch_port_p (err))
	err = get_dns_cname_libdns (name, r_cname);
	return err;
	}
	#endif /USE_LIBDNS/

	err = get_dns_cname_standard (name, r_cname);
	if (opt_debug)
	log_debug ("get_dns_cname(%s)%s%s\n", name,
	err ? ": " : " -> ",
	err ? gpg_strerror (err) : *r_cname);
	return err;
	}
	diff --git a/dirmngr/http.c b/dirmngr/http.c
	index 733018de5..f4b40a8bc 100644
	--- a/dirmngr/http.c
	+++ b/dirmngr/http.c
	@@ -1,3070 +1,3070 @@
	/* http.c - HTTP protocol handler
	* Copyright (C) 1999, 2001, 2002, 2003, 2004, 2006, 2009, 2010,
	* 2011 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	* Copyright (C) 2015-2017 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* This file is free software; you can redistribute it and/or modify
	* it under the terms of either
	*
	* - the GNU Lesser General Public License as published by the Free
	* Software Foundation; either version 3 of the License, or (at
	* your option) any later version.
	*
	* or
	*
	* - the GNU General Public License as published by the Free
	* Software Foundation; either version 2 of the License, or (at
	* your option) any later version.
	*
	* or both in parallel, as here.
	*
	* This file is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* Simple HTTP client implementation. We try to keep the code as
	self-contained as possible. There are some contraints however:

	- estream is required. We now require estream because it provides a
	very useful and portable asprintf implementation and the fopencookie
	function.
	- stpcpy is required
	- fixme: list other requirements.


	- With HTTP_USE_NTBTLS or HTTP_USE_GNUTLS support for https is
	provided (this also requires estream).

	- With HTTP_NO_WSASTARTUP the socket initialization is not done
	under Windows. This is useful if the socket layer has already
	been initialized elsewhere. This also avoids the installation of
	an exit handler to cleanup the socket layer.
	*/

	#ifdef HAVE_CONFIG_H
	# include <config.h>
	#endif
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <string.h>
	#include <ctype.h>
	#include <errno.h>
	#include <unistd.h>

	#ifdef HAVE_W32_SYSTEM
	# ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	# endif
	# include <windows.h>
	#else /!HAVE_W32_SYSTEM/
	# include <sys/types.h>
	# include <sys/socket.h>
	# include <sys/time.h>
	# include <time.h>
	# include <netinet/in.h>
	# include <arpa/inet.h>
	# include <netdb.h>
	#endif /!HAVE_W32_SYSTEM/

	#ifdef WITHOUT_NPTH /* Give the Makefile a chance to build without Pth. */
	# undef USE_NPTH
	#endif

	#ifdef USE_NPTH
	# include <npth.h>
	#endif

	#if defined (HTTP_USE_GNUTLS) && defined (HTTP_USE_NTBTLS)
	# error Both, HTTP_USE_GNUTLS and HTTP_USE_NTBTLS, are defined.
	#endif

	#ifdef HTTP_USE_NTBTLS
	# include <ntbtls.h>
	#elif HTTP_USE_GNUTLS
	# include <gnutls/gnutls.h>
	# include <gnutls/x509.h>
	#endif /HTTP_USE_GNUTLS/

	#include <assuan.h> /* We need the socket wrapper. */

	#include "util.h"
	#include "i18n.h"
	#include "dns-stuff.h"
	#include "http.h"


	#ifdef USE_NPTH
	# define my_select(a,b,c,d,e) npth_select ((a), (b), (c), (d), (e))
	# define my_accept(a,b,c) npth_accept ((a), (b), (c))
	#else
	# define my_select(a,b,c,d,e) select ((a), (b), (c), (d), (e))
	# define my_accept(a,b,c) accept ((a), (b), (c))
	#endif

	#ifdef HAVE_W32_SYSTEM
	#define sock_close(a) closesocket(a)
	#else
	#define sock_close(a) close(a)
	#endif

	#ifndef EAGAIN
	#define EAGAIN EWOULDBLOCK
	#endif
	#ifndef INADDR_NONE /* Slowaris is missing that. */
	#define INADDR_NONE ((unsigned long)(-1))
	#endif /INADDR_NONE/

	#define HTTP_PROXY_ENV "http_proxy"
	#define MAX_LINELEN 20000 /* Max. length of a HTTP header line. */
	#define VALID_URI_CHARS "abcdefghijklmnopqrstuvwxyz" \
	"ABCDEFGHIJKLMNOPQRSTUVWXYZ" \
	"01234567890@" \
	"!\"#$%&'()*+,-./:;<=>?[\\]^_{\|}~"

	#if HTTP_USE_NTBTLS
	typedef ntbtls_t tls_session_t;
	# define USE_TLS 1
	#elif HTTP_USE_GNUTLS
	typedef gnutls_session_t tls_session_t;
	# define USE_TLS 1
	#else
	typedef void *tls_session_t;
	# undef USE_TLS
	#endif

	static gpg_err_code_t do_parse_uri (parsed_uri_t uri, int only_local_part,
	int no_scheme_check, int force_tls);
	static gpg_error_t parse_uri (parsed_uri_t ret_uri, const char uri,
	int no_scheme_check, int force_tls);
	static int remove_escapes (char *string);
	static int insert_escapes (char buffer, const char string,
	const char *special);
	static uri_tuple_t parse_tuple (char *string);
	static gpg_error_t send_request (http_t hd, const char *httphost,
	const char auth,const char proxy,
	const char *srvtag,strlist_t headers);
	static char *build_rel_path (parsed_uri_t uri);
	static gpg_error_t parse_response (http_t hd);

	static gpg_error_t connect_server (const char *server, unsigned short port,
	unsigned int flags, const char *srvtag,
	assuan_fd_t *r_sock);
	static gpg_error_t write_server (int sock, const char *data, size_t length);

	static gpgrt_ssize_t cookie_read (void cookie, void buffer, size_t size);
	static gpgrt_ssize_t cookie_write (void *cookie,
	const void *buffer, size_t size);
	static int cookie_close (void *cookie);


	/* A socket object used to a allow ref counting of sockets. */
	struct my_socket_s
	{
	assuan_fd_t fd; /* The actual socket - shall never be ASSUAN_INVALID_FD. */
	int refcount; /* Number of references to this socket. */
	};
	typedef struct my_socket_s *my_socket_t;


	/* Cookie function structure and cookie object. */
	static es_cookie_io_functions_t cookie_functions =
	{
	cookie_read,
	cookie_write,
	NULL,
	cookie_close
	};

	struct cookie_s
	{
	/* Socket object or NULL if already closed. */
	my_socket_t sock;

	/* The session object or NULL if not used. */
	http_session_t session;

	/* True if TLS is to be used. */
	int use_tls;

	/* The remaining content length and a flag telling whether to use
	the content length. */
	uint64_t content_length;
	unsigned int content_length_valid:1;
	};
	typedef struct cookie_s *cookie_t;


	#if SIZEOF_UNSIGNED_LONG == 8
	# define HTTP_SESSION_MAGIC 0x0068545470534553 /* "hTTpSES" */
	#else
	# define HTTP_SESSION_MAGIC 0x68547365 /* "hTse" */
	#endif

	/* The session object. */
	struct http_session_s
	{
	unsigned long magic;

	int refcount; /* Number of references to this object. */
	#ifdef HTTP_USE_GNUTLS
	gnutls_certificate_credentials_t certcred;
	#endif /HTTP_USE_GNUTLS/
	#ifdef USE_TLS
	tls_session_t tls_session;
	struct {
	int done; /* Verifciation has been done. */
	int rc; /* TLS verification return code. */
	unsigned int status; /* Verification status. */
	} verify;
	char servername; / Malloced server name. */
	#endif /USE_TLS/
	/* A callback function to log details of TLS certifciates. */
	void (cert_log_cb) (http_session_t, gpg_error_t, const char ,
	const void *, size_t );

	/* The flags passed to the session object. */
	unsigned int flags;

	/* A per-session TLS verification callback. */
	http_verify_cb_t verify_cb;
	void *verify_cb_value;
	};


	/* An object to save header lines. */
	struct header_s
	{
	struct header_s *next;
	char value; / The value of the header (malloced). */
	char name[1]; /* The name of the header (canonicalized). */
	};
	typedef struct header_s *header_t;


	#if SIZEOF_UNSIGNED_LONG == 8
	# define HTTP_CONTEXT_MAGIC 0x0068545470435458 /* "hTTpCTX" */
	#else
	# define HTTP_CONTEXT_MAGIC 0x68546378 /* "hTcx" */
	#endif


	/* Our handle context. */
	struct http_context_s
	{
	unsigned long magic;
	unsigned int status_code;
	my_socket_t sock;
	unsigned int in_data:1;
	unsigned int is_http_0_9:1;
	estream_t fp_read;
	estream_t fp_write;
	void *write_cookie;
	void *read_cookie;
	http_session_t session;
	parsed_uri_t uri;
	http_req_t req_type;
	char buffer; / Line buffer. */
	size_t buffer_size;
	unsigned int flags;
	header_t headers; /* Received headers. */
	};


	/* Two flags to enable verbose and debug mode. Although currently not
	* set-able a value > 1 for OPT_DEBUG enables debugging of the session
	* reference counting. */
	static int opt_verbose;
	static int opt_debug;

	/* The global callback for the verification function. */
	static gpg_error_t (*tls_callback) (http_t, http_session_t, int);

	/* The list of files with trusted CA certificates. */
	static strlist_t tls_ca_certlist;

	/* The global callback for net activity. */
	static void (*netactivity_cb)(void);



	#if defined(HAVE_W32_SYSTEM) && !defined(HTTP_NO_WSASTARTUP)

	#if GNUPG_MAJOR_VERSION == 1
	#define REQ_WINSOCK_MAJOR 1
	#define REQ_WINSOCK_MINOR 1
	#else
	#define REQ_WINSOCK_MAJOR 2
	#define REQ_WINSOCK_MINOR 2
	#endif


	static void
	deinit_sockets (void)
	{
	WSACleanup();
	}

	static void
	init_sockets (void)
	{
	static int initialized;
	static WSADATA wsdata;

	if (initialized)
	return;

	if ( WSAStartup( MAKEWORD (REQ_WINSOCK_MINOR, REQ_WINSOCK_MAJOR), &wsdata ) )
	{
	log_error ("error initializing socket library: ec=%d\n",
	(int)WSAGetLastError () );
	return;
	}
	if ( LOBYTE(wsdata.wVersion) != REQ_WINSOCK_MAJOR
	\|\| HIBYTE(wsdata.wVersion) != REQ_WINSOCK_MINOR )
	{
	log_error ("socket library version is %x.%x - but %d.%d needed\n",
	LOBYTE(wsdata.wVersion), HIBYTE(wsdata.wVersion),
	REQ_WINSOCK_MAJOR, REQ_WINSOCK_MINOR);
	WSACleanup();
	return;
	}
	atexit ( deinit_sockets );
	initialized = 1;
	}
	#endif /HAVE_W32_SYSTEM && !HTTP_NO_WSASTARTUP/


	/* Create a new socket object. Returns NULL and closes FD if not
	enough memory is available. */
	static my_socket_t
	_my_socket_new (int lnr, assuan_fd_t fd)
	{
	my_socket_t so;

	so = xtrymalloc (sizeof *so);
	if (!so)
	{
	int save_errno = errno;
	assuan_sock_close (fd);
	gpg_err_set_errno (save_errno);
	return NULL;
	}
	so->fd = fd;
	so->refcount = 1;
	if (opt_debug)
	log_debug ("http.c:%d:socket_new: object %p for fd %d created\n",
	lnr, so, so->fd);
	return so;
	}
	#define my_socket_new(a) _my_socket_new (__LINE__, (a))

	/* Bump up the reference counter for the socket object SO. */
	static my_socket_t
	_my_socket_ref (int lnr, my_socket_t so)
	{
	so->refcount++;
	if (opt_debug > 1)
	log_debug ("http.c:%d:socket_ref: object %p for fd %d refcount now %d\n",
	lnr, so, so->fd, so->refcount);
	return so;
	}
	#define my_socket_ref(a) _my_socket_ref (__LINE__,(a))


	/* Bump down the reference counter for the socket object SO. If SO
	has no more references, close the socket and release the
	object. */
	static void
	_my_socket_unref (int lnr, my_socket_t so,
	void (preclose)(void), void *preclosearg)
	{
	if (so)
	{
	so->refcount--;
	if (opt_debug > 1)
	log_debug ("http.c:%d:socket_unref: object %p for fd %d ref now %d\n",
	lnr, so, so->fd, so->refcount);

	if (!so->refcount)
	{
	if (preclose)
	preclose (preclosearg);
	assuan_sock_close (so->fd);
	xfree (so);
	}
	}
	}
	#define my_socket_unref(a,b,c) _my_socket_unref (__LINE__,(a),(b),(c))


	#ifdef HTTP_USE_GNUTLS
	static ssize_t
	my_gnutls_read (gnutls_transport_ptr_t ptr, void *buffer, size_t size)
	{
	my_socket_t sock = ptr;
	#if USE_NPTH
	return npth_read (sock->fd, buffer, size);
	#else
	return read (sock->fd, buffer, size);
	#endif
	}
	static ssize_t
	my_gnutls_write (gnutls_transport_ptr_t ptr, const void *buffer, size_t size)
	{
	my_socket_t sock = ptr;
	#if USE_NPTH
	return npth_write (sock->fd, buffer, size);
	#else
	return write (sock->fd, buffer, size);
	#endif
	}
	#endif /HTTP_USE_GNUTLS/


	#ifdef HTTP_USE_NTBTLS
	/* Connect the ntbls callback to our generic callback. */
	static gpg_error_t
	my_ntbtls_verify_cb (void *opaque, ntbtls_t tls, unsigned int verify_flags)
	{
	http_t hd = opaque;

	(void)verify_flags;

	log_assert (hd && hd->session && hd->session->verify_cb);
	log_assert (hd->magic == HTTP_CONTEXT_MAGIC);
	log_assert (hd->session->magic == HTTP_SESSION_MAGIC);

	return hd->session->verify_cb (hd->session->verify_cb_value,
	hd, hd->session,
	(hd->flags \| hd->session->flags),
	tls);
	}
	#endif /HTTP_USE_NTBTLS/




	/* This notification function is called by estream whenever stream is
	closed. Its purpose is to mark the closing in the handle so
	that a http_close won't accidentally close the estream. The function
	http_close removes this notification so that it won't be called if
	http_close was used before an es_fclose. */
	static void
	fp_onclose_notification (estream_t stream, void *opaque)
	{
	http_t hd = opaque;

	log_assert (hd->magic == HTTP_CONTEXT_MAGIC);
	if (hd->fp_read && hd->fp_read == stream)
	hd->fp_read = NULL;
	else if (hd->fp_write && hd->fp_write == stream)
	hd->fp_write = NULL;
	}


	/*
	* Helper function to create an HTTP header with hex encoded data. A
	* new buffer is returned. This buffer is the concatenation of the
	* string PREFIX, the hex-encoded DATA of length LEN and the string
	* SUFFIX. On error NULL is returned and ERRNO set.
	*/
	static char *
	make_header_line (const char prefix, const char suffix,
	const void *data, size_t len )
	{
	static unsigned char bintoasc[] =
	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"
	"0123456789+/";
	const unsigned char *s = data;
	char buffer, p;

	buffer = xtrymalloc (strlen (prefix) + (len+2)/3*4 + strlen (suffix) + 1);
	if (!buffer)
	return NULL;
	p = stpcpy (buffer, prefix);
	for ( ; len >= 3 ; len -= 3, s += 3 )
	{
	*p++ = bintoasc[(s[0] >> 2) & 077];
	*p++ = bintoasc[(((s[0] <<4)&060)\|((s[1] >> 4)&017))&077];
	*p++ = bintoasc[(((s[1]<<2)&074)\|((s[2]>>6)&03))&077];
	*p++ = bintoasc[s[2]&077];
	*p = 0;
	}
	if ( len == 2 )
	{
	*p++ = bintoasc[(s[0] >> 2) & 077];
	*p++ = bintoasc[(((s[0] <<4)&060)\|((s[1] >> 4)&017))&077];
	*p++ = bintoasc[((s[1]<<2)&074)];
	*p++ = '=';
	}
	else if ( len == 1 )
	{
	*p++ = bintoasc[(s[0] >> 2) & 077];
	*p++ = bintoasc[(s[0] <<4)&060];
	*p++ = '=';
	*p++ = '=';
	}
	*p = 0;
	strcpy (p, suffix);
	return buffer;
	}




	/* Set verbosity and debug mode for this module. */
	void
	http_set_verbose (int verbose, int debug)
	{
	opt_verbose = verbose;
	opt_debug = debug;
	}


	/* Register a non-standard global TLS callback function. If no
	verification is desired a callback needs to be registered which
	always returns NULL. */
	void
	http_register_tls_callback (gpg_error_t (*cb)(http_t, http_session_t, int))
	{
	tls_callback = cb;
	}


	/* Register a CA certificate for future use. The certificate is
	expected to be in FNAME. PEM format is assume if FNAME has a
	suffix of ".pem". If FNAME is NULL the list of CA files is
	removed. */
	void
	http_register_tls_ca (const char *fname)
	{
	strlist_t sl;

	if (!fname)
	{
	free_strlist (tls_ca_certlist);
	tls_ca_certlist = NULL;
	}
	else
	{
	/* Warn if we can't access right now, but register it anyway in
	case it becomes accessible later */
	if (access (fname, F_OK))
	log_info (_("can't access '%s': %s\n"), fname,
	gpg_strerror (gpg_error_from_syserror()));
	sl = add_to_strlist (&tls_ca_certlist, fname);
	if (*sl->d && !strcmp (sl->d + strlen (sl->d) - 4, ".pem"))
	sl->flags = 1;
	}
	}


	/* Register a callback which is called every time the HTTP mode has
	* made a successful connection to some server. */
	void
	http_register_netactivity_cb (void (*cb)(void))
	{
	netactivity_cb = cb;
	}


	/* Call the netactivity callback if any. */
	static void
	notify_netactivity (void)
	{
	if (netactivity_cb)
	netactivity_cb ();
	}



	#ifdef USE_TLS
	/* Free the TLS session associated with SESS, if any. */
	static void
	close_tls_session (http_session_t sess)
	{
	if (sess->tls_session)
	{
	# if HTTP_USE_NTBTLS
	/* FIXME!!
	Possibly, ntbtls_get_transport and close those streams.
	Somehow get SOCK to call my_socket_unref.
	*/
	ntbtls_release (sess->tls_session);
	# elif HTTP_USE_GNUTLS
	my_socket_t sock = gnutls_transport_get_ptr (sess->tls_session);
	my_socket_unref (sock, NULL, NULL);
	gnutls_deinit (sess->tls_session);
	if (sess->certcred)
	gnutls_certificate_free_credentials (sess->certcred);
	# endif /HTTP_USE_GNUTLS/
	xfree (sess->servername);
	sess->tls_session = NULL;
	}
	}
	#endif /USE_TLS/


	/* Release a session. Take care not to release it while it is being
	used by a http context object. */
	static void
	session_unref (int lnr, http_session_t sess)
	{
	if (!sess)
	return;

	log_assert (sess->magic == HTTP_SESSION_MAGIC);

	sess->refcount--;
	if (opt_debug > 1)
	log_debug ("http.c:%d:session_unref: sess %p ref now %d\n",
	lnr, sess, sess->refcount);
	if (sess->refcount)
	return;

	#ifdef USE_TLS
	close_tls_session (sess);
	#endif /USE_TLS/

	sess->magic = 0xdeadbeef;
	xfree (sess);
	}
	#define http_session_unref(a) session_unref (__LINE__, (a))

	void
	http_session_release (http_session_t sess)
	{
	http_session_unref (sess);
	}


	/* Create a new session object which is currently used to enable TLS
	* support. It may eventually allow reusing existing connections.
	* Valid values for FLAGS are:
	* HTTP_FLAG_TRUST_DEF - Use the CAs set with http_register_tls_ca
	* HTTP_FLAG_TRUST_SYS - Also use the CAs defined by the system
	* HTTP_FLAG_NO_CRL - Do not consult CRLs for https.
	*/
	gpg_error_t
	http_session_new (http_session_t *r_session,
	const char *intended_hostname, unsigned int flags,
	http_verify_cb_t verify_cb, void *verify_cb_value)
	{
	gpg_error_t err;
	http_session_t sess;

	*r_session = NULL;

	sess = xtrycalloc (1, sizeof *sess);
	if (!sess)
	return gpg_error_from_syserror ();
	sess->magic = HTTP_SESSION_MAGIC;
	sess->refcount = 1;
	sess->flags = flags;
	sess->verify_cb = verify_cb;
	sess->verify_cb_value = verify_cb_value;

	#if HTTP_USE_NTBTLS
	{
	(void)intended_hostname; /* Not needed because we do not preload
	* certificates. */

	err = ntbtls_new (&sess->tls_session, NTBTLS_CLIENT);
	if (err)
	{
	log_error ("ntbtls_new failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	}
	#elif HTTP_USE_GNUTLS
	{
	const char *errpos;
	int rc;
	strlist_t sl;
	int add_system_cas = !!(flags & HTTP_FLAG_TRUST_SYS);
	int is_hkps_pool;

	rc = gnutls_certificate_allocate_credentials (&sess->certcred);
	if (rc < 0)
	{
	log_error ("gnutls_certificate_allocate_credentials failed: %s\n",
	gnutls_strerror (rc));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	is_hkps_pool = (intended_hostname
	&& !ascii_strcasecmp (intended_hostname,
	"hkps.pool.sks-keyservers.net"));

	/* If the user has not specified a CA list, and they are looking
	* for the hkps pool from sks-keyservers.net, then default to
	* Kristian's certificate authority: */
	if (!tls_ca_certlist && is_hkps_pool)
	{
	char *pemname = make_filename_try (gnupg_datadir (),
	"sks-keyservers.netCA.pem", NULL);
	if (!pemname)
	{
	err = gpg_error_from_syserror ();
	log_error ("setting CA from file '%s' failed: %s\n",
	pemname, gpg_strerror (err));
	}
	else
	{
	rc = gnutls_certificate_set_x509_trust_file
	(sess->certcred, pemname, GNUTLS_X509_FMT_PEM);
	if (rc < 0)
	log_info ("setting CA from file '%s' failed: %s\n",
	pemname, gnutls_strerror (rc));
	xfree (pemname);
	}
	}

	/* Add configured certificates to the session. */
	if ((flags & HTTP_FLAG_TRUST_DEF))
	{
	for (sl = tls_ca_certlist; sl; sl = sl->next)
	{
	rc = gnutls_certificate_set_x509_trust_file
	(sess->certcred, sl->d,
	(sl->flags & 1)? GNUTLS_X509_FMT_PEM : GNUTLS_X509_FMT_DER);
	if (rc < 0)
	log_info ("setting CA from file '%s' failed: %s\n",
	sl->d, gnutls_strerror (rc));
	}
	if (!tls_ca_certlist && !is_hkps_pool)
	add_system_cas = 1;
	}

	/* Add system certificates to the session. */
	if (add_system_cas)
	{
	#if GNUTLS_VERSION_NUMBER >= 0x030014
	static int shown;

	rc = gnutls_certificate_set_x509_system_trust (sess->certcred);
	if (rc < 0)
	log_info ("setting system CAs failed: %s\n", gnutls_strerror (rc));
	else if (!shown)
	{
	shown = 1;
	log_info ("number of system provided CAs: %d\n", rc);
	}
	#endif /* gnutls >= 3.0.20 */
	}

	rc = gnutls_init (&sess->tls_session, GNUTLS_CLIENT);
	if (rc < 0)
	{
	log_error ("gnutls_init failed: %s\n", gnutls_strerror (rc));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	/* A new session has the transport ptr set to (void*(-1), we need
	it to be NULL. */
	gnutls_transport_set_ptr (sess->tls_session, NULL);

	rc = gnutls_priority_set_direct (sess->tls_session,
	"NORMAL",
	&errpos);
	if (rc < 0)
	{
	log_error ("gnutls_priority_set_direct failed at '%s': %s\n",
	errpos, gnutls_strerror (rc));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	rc = gnutls_credentials_set (sess->tls_session,
	GNUTLS_CRD_CERTIFICATE, sess->certcred);
	if (rc < 0)
	{
	log_error ("gnutls_credentials_set failed: %s\n", gnutls_strerror (rc));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	}
	#else /!HTTP_USE_GNUTLS && !HTTP_USE_NTBTLS/
	{
	(void)intended_hostname;
	(void)flags;
	}
	#endif /!HTTP_USE_GNUTLS && !HTTP_USE_NTBTLS/

	if (opt_debug > 1)
	log_debug ("http.c:session_new: sess %p created\n", sess);
	err = 0;

	#if USE_TLS
	leave:
	#endif /USE_TLS/
	if (err)
	http_session_unref (sess);
	else
	*r_session = sess;

	return err;
	}


	/* Increment the reference count for session SESS. Passing NULL for
	SESS is allowed. */
	http_session_t
	http_session_ref (http_session_t sess)
	{
	if (sess)
	{
	sess->refcount++;
	if (opt_debug > 1)
	log_debug ("http.c:session_ref: sess %p ref now %d\n",
	sess, sess->refcount);
	}
	return sess;
	}


	void
	http_session_set_log_cb (http_session_t sess,
	void (*cb)(http_session_t, gpg_error_t,
	const char *hostname,
	const void *certs, size_t certlens))
	{
	sess->cert_log_cb = cb;
	}




	/* Start a HTTP retrieval and on success store at R_HD a context
	pointer for completing the request and to wait for the response.
	If HTTPHOST is not NULL it is used for the Host header instead of a
	Host header derived from the URL. */
	gpg_error_t
	http_open (http_t r_hd, http_req_t reqtype, const char url,
	const char *httphost,
	const char auth, unsigned int flags, const char proxy,
	http_session_t session, const char *srvtag, strlist_t headers)
	{
	gpg_error_t err;
	http_t hd;

	*r_hd = NULL;

	if (!(reqtype == HTTP_REQ_GET \|\| reqtype == HTTP_REQ_POST))
	return gpg_err_make (default_errsource, GPG_ERR_INV_ARG);

	/* Create the handle. */
	hd = xtrycalloc (1, sizeof *hd);
	if (!hd)
	return gpg_error_from_syserror ();
	hd->magic = HTTP_CONTEXT_MAGIC;
	hd->req_type = reqtype;
	hd->flags = flags;
	hd->session = http_session_ref (session);

	err = parse_uri (&hd->uri, url, 0, !!(flags & HTTP_FLAG_FORCE_TLS));
	if (!err)
	err = send_request (hd, httphost, auth, proxy, srvtag, headers);

	if (err)
	{
	my_socket_unref (hd->sock, NULL, NULL);
	if (hd->fp_read)
	es_fclose (hd->fp_read);
	if (hd->fp_write)
	es_fclose (hd->fp_write);
	http_session_unref (hd->session);
	xfree (hd);
	}
	else
	*r_hd = hd;
	return err;
	}


	/* This function is useful to connect to a generic TCP service using
	this http abstraction layer. This has the advantage of providing
	service tags and an estream interface. */
	gpg_error_t
	http_raw_connect (http_t r_hd, const char server, unsigned short port,
	unsigned int flags, const char *srvtag)
	{
	gpg_error_t err = 0;
	http_t hd;
	cookie_t cookie;

	*r_hd = NULL;

	if ((flags & HTTP_FLAG_FORCE_TOR))
	{
	int mode;

	if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) \|\| !mode)
	{
	log_error ("Tor support is not available\n");
	return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
	}
	}

	/* Create the handle. */
	hd = xtrycalloc (1, sizeof *hd);
	if (!hd)
	return gpg_error_from_syserror ();
	hd->magic = HTTP_CONTEXT_MAGIC;
	hd->req_type = HTTP_REQ_OPAQUE;
	hd->flags = flags;

	/* Connect. */
	{
	assuan_fd_t sock;

	err = connect_server (server, port, hd->flags, srvtag, &sock);
	if (err)
	{
	xfree (hd);
	return err;
	}
	hd->sock = my_socket_new (sock);
	if (!hd->sock)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	xfree (hd);
	return err;
	}
	}

	/* Setup estreams for reading and writing. */
	cookie = xtrycalloc (1, sizeof *cookie);
	if (!cookie)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	goto leave;
	}
	cookie->sock = my_socket_ref (hd->sock);
	hd->fp_write = es_fopencookie (cookie, "w", cookie_functions);
	if (!hd->fp_write)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	my_socket_unref (cookie->sock, NULL, NULL);
	xfree (cookie);
	goto leave;
	}
	hd->write_cookie = cookie; /* Cookie now owned by FP_WRITE. */

	cookie = xtrycalloc (1, sizeof *cookie);
	if (!cookie)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	goto leave;
	}
	cookie->sock = my_socket_ref (hd->sock);
	hd->fp_read = es_fopencookie (cookie, "r", cookie_functions);
	if (!hd->fp_read)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	my_socket_unref (cookie->sock, NULL, NULL);
	xfree (cookie);
	goto leave;
	}
	hd->read_cookie = cookie; /* Cookie now owned by FP_READ. */

	/* Register close notification to interlock the use of es_fclose in
	http_close and in user code. */
	err = es_onclose (hd->fp_write, 1, fp_onclose_notification, hd);
	if (!err)
	err = es_onclose (hd->fp_read, 1, fp_onclose_notification, hd);

	leave:
	if (err)
	{
	if (hd->fp_read)
	es_fclose (hd->fp_read);
	if (hd->fp_write)
	es_fclose (hd->fp_write);
	my_socket_unref (hd->sock, NULL, NULL);
	xfree (hd);
	}
	else
	*r_hd = hd;
	return err;
	}




	void
	http_start_data (http_t hd)
	{
	if (!hd->in_data)
	{
	if (opt_debug \|\| (hd->flags & HTTP_FLAG_LOG_RESP))
	log_debug_with_string ("\r\n", "http.c:request-header:");
	es_fputs ("\r\n", hd->fp_write);
	es_fflush (hd->fp_write);
	hd->in_data = 1;
	}
	else
	es_fflush (hd->fp_write);
	}


	gpg_error_t
	http_wait_response (http_t hd)
	{
	gpg_error_t err;
	cookie_t cookie;

	/* Make sure that we are in the data. */
	http_start_data (hd);

	/* Close the write stream. Note that the reference counted socket
	object keeps the actual system socket open. */
	cookie = hd->write_cookie;
	if (!cookie)
	return gpg_err_make (default_errsource, GPG_ERR_INTERNAL);

	es_fclose (hd->fp_write);
	hd->fp_write = NULL;
	/* The close has released the cookie and thus we better set it to NULL. */
	hd->write_cookie = NULL;

	/* Shutdown one end of the socket is desired. As per HTTP/1.0 this
	is not required but some very old servers (e.g. the original pksd
	keyserver didn't worked without it. */
	if ((hd->flags & HTTP_FLAG_SHUTDOWN))
	shutdown (hd->sock->fd, 1);
	hd->in_data = 0;

	/* Create a new cookie and a stream for reading. */
	cookie = xtrycalloc (1, sizeof *cookie);
	if (!cookie)
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	cookie->sock = my_socket_ref (hd->sock);
	cookie->session = http_session_ref (hd->session);
	cookie->use_tls = hd->uri->use_tls;

	hd->read_cookie = cookie;
	hd->fp_read = es_fopencookie (cookie, "r", cookie_functions);
	if (!hd->fp_read)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	my_socket_unref (cookie->sock, NULL, NULL);
	http_session_unref (cookie->session);
	xfree (cookie);
	hd->read_cookie = NULL;
	return err;
	}

	err = parse_response (hd);

	if (!err)
	err = es_onclose (hd->fp_read, 1, fp_onclose_notification, hd);

	return err;
	}


	/* Convenience function to send a request and wait for the response.
	Closes the handle on error. If PROXY is not NULL, this value will
	be used as an HTTP proxy and any enabled $http_proxy gets
	ignored. */
	gpg_error_t
	http_open_document (http_t r_hd, const char document,
	const char auth, unsigned int flags, const char proxy,
	http_session_t session,
	const char *srvtag, strlist_t headers)
	{
	gpg_error_t err;

	err = http_open (r_hd, HTTP_REQ_GET, document, NULL, auth, flags,
	proxy, session, srvtag, headers);
	if (err)
	return err;

	err = http_wait_response (*r_hd);
	if (err)
	http_close (*r_hd, 0);

	return err;
	}


	void
	http_close (http_t hd, int keep_read_stream)
	{
	if (!hd)
	return;

	log_assert (hd->magic == HTTP_CONTEXT_MAGIC);

	/* First remove the close notifications for the streams. */
	if (hd->fp_read)
	es_onclose (hd->fp_read, 0, fp_onclose_notification, hd);
	if (hd->fp_write)
	es_onclose (hd->fp_write, 0, fp_onclose_notification, hd);

	/* Now we can close the streams. */
	my_socket_unref (hd->sock, NULL, NULL);
	if (hd->fp_read && !keep_read_stream)
	es_fclose (hd->fp_read);
	if (hd->fp_write)
	es_fclose (hd->fp_write);
	http_session_unref (hd->session);
	hd->magic = 0xdeadbeef;
	http_release_parsed_uri (hd->uri);
	while (hd->headers)
	{
	header_t tmp = hd->headers->next;
	xfree (hd->headers->value);
	xfree (hd->headers);
	hd->headers = tmp;
	}
	xfree (hd->buffer);
	xfree (hd);
	}


	estream_t
	http_get_read_ptr (http_t hd)
	{
	return hd?hd->fp_read:NULL;
	}

	estream_t
	http_get_write_ptr (http_t hd)
	{
	return hd?hd->fp_write:NULL;
	}

	unsigned int
	http_get_status_code (http_t hd)
	{
	return hd?hd->status_code:0;
	}

	/* Return information pertaining to TLS. If TLS is not in use for HD,
	NULL is returned. WHAT is used ask for specific information:

	- (NULL) := Only check whether TLS is is use. Returns an
	+ (NULL) := Only check whether TLS is in use. Returns an
	unspecified string if TLS is in use. That string may
	even be the empty string.
	*/
	const char *
	http_get_tls_info (http_t hd, const char *what)
	{
	(void)what;

	if (!hd)
	return NULL;

	return hd->uri->use_tls? "":NULL;
	}



	static gpg_error_t
	parse_uri (parsed_uri_t ret_uri, const char uri,
	int no_scheme_check, int force_tls)
	{
	gpg_err_code_t ec;

	ret_uri = xtrycalloc (1, sizeof *ret_uri + strlen (uri));
	if (!*ret_uri)
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	strcpy ((*ret_uri)->buffer, uri);
	ec = do_parse_uri (*ret_uri, 0, no_scheme_check, force_tls);
	if (ec)
	{
	xfree (*ret_uri);
	*ret_uri = NULL;
	}
	return gpg_err_make (default_errsource, ec);
	}


	/*
	* Parse an URI and put the result into the newly allocated RET_URI.
	* On success the caller must use http_release_parsed_uri() to
	* releases the resources. If NO_SCHEME_CHECK is set, the function
	* tries to parse the URL in the same way it would do for an HTTP
	* style URI.
	*/
	gpg_error_t
	http_parse_uri (parsed_uri_t ret_uri, const char uri,
	int no_scheme_check)
	{
	return parse_uri (ret_uri, uri, no_scheme_check, 0);
	}


	void
	http_release_parsed_uri (parsed_uri_t uri)
	{
	if (uri)
	{
	uri_tuple_t r, r2;

	for (r = uri->query; r; r = r2)
	{
	r2 = r->next;
	xfree (r);
	}
	xfree (uri);
	}
	}


	static gpg_err_code_t
	do_parse_uri (parsed_uri_t uri, int only_local_part,
	int no_scheme_check, int force_tls)
	{
	uri_tuple_t *tail;
	char p, p2, p3, pp;
	int n;

	p = uri->buffer;
	n = strlen (uri->buffer);

	/* Initialize all fields to an empty string or an empty list. */
	uri->scheme = uri->host = uri->path = p + n;
	uri->port = 0;
	uri->params = uri->query = NULL;
	uri->use_tls = 0;
	uri->is_http = 0;
	uri->opaque = 0;
	uri->v6lit = 0;
	uri->onion = 0;
	uri->explicit_port = 0;

	/* A quick validity check. */
	if (strspn (p, VALID_URI_CHARS) != n)
	return GPG_ERR_BAD_URI; /* Invalid characters found. */

	if (!only_local_part)
	{
	/* Find the scheme. */
	if (!(p2 = strchr (p, ':')) \|\| p2 == p)
	return GPG_ERR_BAD_URI; /* No scheme. */
	*p2++ = 0;
	for (pp=p; *pp; pp++)
	pp = tolower ((unsigned char*)pp);
	uri->scheme = p;
	if (!strcmp (uri->scheme, "http") && !force_tls)
	{
	uri->port = 80;
	uri->is_http = 1;
	}
	else if (!strcmp (uri->scheme, "hkp") && !force_tls)
	{
	uri->port = 11371;
	uri->is_http = 1;
	}
	#ifdef USE_TLS
	else if (!strcmp (uri->scheme, "https") \|\| !strcmp (uri->scheme,"hkps")
	\|\| (force_tls && (!strcmp (uri->scheme, "http")
	\|\| !strcmp (uri->scheme,"hkp"))))
	{
	uri->port = 443;
	uri->is_http = 1;
	uri->use_tls = 1;
	}
	#endif /USE_TLS/
	else if (!no_scheme_check)
	return GPG_ERR_INV_URI; /* Unsupported scheme */

	p = p2;

	if (p == '/' && p[1] == '/' ) / There seems to be a hostname. */
	{
	p += 2;
	if ((p2 = strchr (p, '/')))
	*p2++ = 0;

	/* Check for username/password encoding */
	if ((p3 = strchr (p, '@')))
	{
	uri->auth = p;
	*p3++ = '\0';
	p = p3;
	}

	for (pp=p; *pp; pp++)
	pp = tolower ((unsigned char*)pp);

	/* Handle an IPv6 literal */
	if( *p == '[' && (p3=strchr( p, ']' )) )
	{
	*p3++ = '\0';
	/* worst case, uri->host should have length 0, points to \0 */
	uri->host = p + 1;
	uri->v6lit = 1;
	p = p3;
	}
	else
	uri->host = p;

	if ((p3 = strchr (p, ':')))
	{
	*p3++ = '\0';
	uri->port = atoi (p3);
	uri->explicit_port = 1;
	}

	if ((n = remove_escapes (uri->host)) < 0)
	return GPG_ERR_BAD_URI;
	if (n != strlen (uri->host))
	return GPG_ERR_BAD_URI; /* Hostname incudes a Nul. */
	p = p2 ? p2 : NULL;
	}
	else if (uri->is_http)
	return GPG_ERR_INV_URI; /* No Leading double slash for HTTP. */
	else
	{
	uri->opaque = 1;
	uri->path = p;
	if (is_onion_address (uri->path))
	uri->onion = 1;
	return 0;
	}

	} /* End global URI part. */

	/* Parse the pathname part if any. */
	if (p && *p)
	{
	/* TODO: Here we have to check params. */

	/* Do we have a query part? */
	if ((p2 = strchr (p, '?')))
	*p2++ = 0;

	uri->path = p;
	if ((n = remove_escapes (p)) < 0)
	return GPG_ERR_BAD_URI;
	if (n != strlen (p))
	return GPG_ERR_BAD_URI; /* Path includes a Nul. */
	p = p2 ? p2 : NULL;

	/* Parse a query string if any. */
	if (p && *p)
	{
	tail = &uri->query;
	for (;;)
	{
	uri_tuple_t elem;

	if ((p2 = strchr (p, '&')))
	*p2++ = 0;
	if (!(elem = parse_tuple (p)))
	return GPG_ERR_BAD_URI;
	*tail = elem;
	tail = &elem->next;

	if (!p2)
	break; /* Ready. */
	p = p2;
	}
	}
	}

	if (is_onion_address (uri->host))
	uri->onion = 1;

	return 0;
	}


	/*
	* Remove all %xx escapes; this is done in-place. Returns: New length
	* of the string.
	*/
	static int
	remove_escapes (char *string)
	{
	int n = 0;
	unsigned char p, s;

	for (p = s = (unsigned char)string; s; s++)
	{
	if (*s == '%')
	{
	if (s[1] && s[2] && isxdigit (s[1]) && isxdigit (s[2]))
	{
	s++;
	p = s >= '0' && s <= '9' ? s - '0' :
	s >= 'A' && s <= 'F' ? s - 'A' + 10 : s - 'a' + 10;
	*p <<= 4;
	s++;
	p \|= s >= '0' && s <= '9' ? s - '0' :
	s >= 'A' && s <= 'F' ? s - 'A' + 10 : s - 'a' + 10;
	p++;
	n++;
	}
	else
	{
	p++ = s++;
	if (*s)
	p++ = s++;
	if (*s)
	p++ = s++;
	if (*s)
	*p = 0;
	return -1; /* Bad URI. */
	}
	}
	else
	{
	p++ = s;
	n++;
	}
	}
	p = 0; / Make sure to keep a string terminator. */
	return n;
	}


	/* If SPECIAL is NULL this function escapes in forms mode. */
	static size_t
	escape_data (char buffer, const void data, size_t datalen,
	const char *special)
	{
	int forms = !special;
	const unsigned char *s;
	size_t n = 0;

	if (forms)
	special = "%;?&=";

	for (s = data; datalen; s++, datalen--)
	{
	if (forms && *s == ' ')
	{
	if (buffer)
	*buffer++ = '+';
	n++;
	}
	else if (forms && *s == '\n')
	{
	if (buffer)
	memcpy (buffer, "%0D%0A", 6);
	n += 6;
	}
	else if (forms && *s == '\r' && datalen > 1 && s[1] == '\n')
	{
	if (buffer)
	memcpy (buffer, "%0D%0A", 6);
	n += 6;
	s++;
	datalen--;
	}
	else if (strchr (VALID_URI_CHARS, s) && !strchr (special, s))
	{
	if (buffer)
	(unsigned char)buffer++ = *s;
	n++;
	}
	else
	{
	if (buffer)
	{
	snprintf (buffer, 4, "%%%02X", *s);
	buffer += 3;
	}
	n += 3;
	}
	}
	return n;
	}


	static int
	insert_escapes (char buffer, const char string,
	const char *special)
	{
	return escape_data (buffer, string, strlen (string), special);
	}


	/* Allocate a new string from STRING using standard HTTP escaping as
	well as escaping of characters given in SPECIALS. A common pattern
	for SPECIALS is "%;?&=". However it depends on the needs, for
	example "+" and "/: often needs to be escaped too. Returns NULL on
	failure and sets ERRNO. If SPECIAL is NULL a dedicated forms
	encoding mode is used. */
	char *
	http_escape_string (const char string, const char specials)
	{
	int n;
	char *buf;

	n = insert_escapes (NULL, string, specials);
	buf = xtrymalloc (n+1);
	if (buf)
	{
	insert_escapes (buf, string, specials);
	buf[n] = 0;
	}
	return buf;
	}

	/* Allocate a new string from {DATA,DATALEN} using standard HTTP
	escaping as well as escaping of characters given in SPECIALS. A
	common pattern for SPECIALS is "%;?&=". However it depends on the
	needs, for example "+" and "/: often needs to be escaped too.
	Returns NULL on failure and sets ERRNO. If SPECIAL is NULL a
	dedicated forms encoding mode is used. */
	char *
	http_escape_data (const void data, size_t datalen, const char specials)
	{
	int n;
	char *buf;

	n = escape_data (NULL, data, datalen, specials);
	buf = xtrymalloc (n+1);
	if (buf)
	{
	escape_data (buf, data, datalen, specials);
	buf[n] = 0;
	}
	return buf;
	}


	static uri_tuple_t
	parse_tuple (char *string)
	{
	char *p = string;
	char *p2;
	int n;
	uri_tuple_t tuple;

	if ((p2 = strchr (p, '=')))
	*p2++ = 0;
	if ((n = remove_escapes (p)) < 0)
	return NULL; /* Bad URI. */
	if (n != strlen (p))
	return NULL; /* Name with a Nul in it. */
	tuple = xtrycalloc (1, sizeof *tuple);
	if (!tuple)
	return NULL; /* Out of core. */
	tuple->name = p;
	if (!p2) /* We have only the name, so we assume an empty value string. */
	{
	tuple->value = p + strlen (p);
	tuple->valuelen = 0;
	tuple->no_value = 1; /* Explicitly mark that we have seen no '='. */
	}
	else /* Name and value. */
	{
	if ((n = remove_escapes (p2)) < 0)
	{
	xfree (tuple);
	return NULL; /* Bad URI. */
	}
	tuple->value = p2;
	tuple->valuelen = n;
	}
	return tuple;
	}


	/* Return true if STRING is likely "hostname:port" or only "hostname". */
	static int
	is_hostname_port (const char *string)
	{
	int colons = 0;

	if (!string \|\| !*string)
	return 0;
	for (; *string; string++)
	{
	if (*string == ':')
	{
	if (colons)
	return 0;
	if (!string[1])
	return 0;
	colons++;
	}
	else if (!colons && strchr (" \t\f\n\v_@[]/", *string))
	return 0; /* Invalid characters in hostname. */
	else if (colons && !digitp (string))
	return 0; /* Not a digit in the port. */
	}
	return 1;
	}


	/*
	* Send a HTTP request to the server
	* Returns 0 if the request was successful
	*/
	static gpg_error_t
	send_request (http_t hd, const char httphost, const char auth,
	const char proxy, const char srvtag, strlist_t headers)
	{
	gpg_error_t err;
	const char *server;
	char request, p;
	unsigned short port;
	const char *http_proxy = NULL;
	char *proxy_authstr = NULL;
	char *authstr = NULL;
	int sock;

	if (hd->uri->use_tls && !hd->session)
	{
	log_error ("TLS requested but no session object provided\n");
	return gpg_err_make (default_errsource, GPG_ERR_INTERNAL);
	}
	#ifdef USE_TLS
	if (hd->uri->use_tls && !hd->session->tls_session)
	{
	log_error ("TLS requested but no GNUTLS context available\n");
	return gpg_err_make (default_errsource, GPG_ERR_INTERNAL);
	}
	#endif /USE_TLS/

	if ((hd->flags & HTTP_FLAG_FORCE_TOR))
	{
	int mode;

	if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) \|\| !mode)
	{
	log_error ("Tor support is not available\n");
	return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
	}
	}

	server = *hd->uri->host ? hd->uri->host : "localhost";
	port = hd->uri->port ? hd->uri->port : 80;

	/* Try to use SNI. */
	#ifdef USE_TLS
	if (hd->uri->use_tls)
	{
	# if HTTP_USE_GNUTLS
	int rc;
	# endif

	xfree (hd->session->servername);
	hd->session->servername = xtrystrdup (httphost? httphost : server);
	if (!hd->session->servername)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	return err;
	}

	# if HTTP_USE_NTBTLS
	err = ntbtls_set_hostname (hd->session->tls_session,
	hd->session->servername);
	if (err)
	{
	log_info ("ntbtls_set_hostname failed: %s\n", gpg_strerror (err));
	return err;
	}
	# elif HTTP_USE_GNUTLS
	rc = gnutls_server_name_set (hd->session->tls_session,
	GNUTLS_NAME_DNS,
	hd->session->servername,
	strlen (hd->session->servername));
	if (rc < 0)
	log_info ("gnutls_server_name_set failed: %s\n", gnutls_strerror (rc));
	# endif /HTTP_USE_GNUTLS/
	}
	#endif /USE_TLS/

	if ( (proxy && *proxy)
	\|\| ( (hd->flags & HTTP_FLAG_TRY_PROXY)
	&& (http_proxy = getenv (HTTP_PROXY_ENV))
	&& *http_proxy ))
	{
	parsed_uri_t uri;

	if (proxy)
	http_proxy = proxy;

	err = parse_uri (&uri, http_proxy, 0, 0);
	if (gpg_err_code (err) == GPG_ERR_INV_URI
	&& is_hostname_port (http_proxy))
	{
	/* Retry assuming a "hostname:port" string. */
	char *tmpname = strconcat ("http://", http_proxy, NULL);
	if (tmpname && !parse_uri (&uri, tmpname, 0, 0))
	err = 0;
	xfree (tmpname);
	}

	if (err)
	;
	else if (!strcmp (uri->scheme, "http") \|\| !strcmp (uri->scheme, "socks4"))
	;
	else if (!strcmp (uri->scheme, "socks5h"))
	err = gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
	else
	err = gpg_err_make (default_errsource, GPG_ERR_INV_URI);

	if (err)
	{
	log_error ("invalid HTTP proxy (%s): %s\n",
	http_proxy, gpg_strerror (err));
	return gpg_err_make (default_errsource, GPG_ERR_CONFIGURATION);
	}

	if (uri->auth)
	{
	remove_escapes (uri->auth);
	proxy_authstr = make_header_line ("Proxy-Authorization: Basic ",
	"\r\n",
	uri->auth, strlen(uri->auth));
	if (!proxy_authstr)
	{
	err = gpg_err_make (default_errsource,
	gpg_err_code_from_syserror ());
	http_release_parsed_uri (uri);
	return err;
	}
	}

	err = connect_server (*uri->host ? uri->host : "localhost",
	uri->port ? uri->port : 80,
	hd->flags, srvtag, &sock);
	http_release_parsed_uri (uri);
	}
	else
	{
	err = connect_server (server, port, hd->flags, srvtag, &sock);
	}

	if (err)
	{
	xfree (proxy_authstr);
	return err;
	}
	hd->sock = my_socket_new (sock);
	if (!hd->sock)
	{
	xfree (proxy_authstr);
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	}


	#if HTTP_USE_NTBTLS
	if (hd->uri->use_tls)
	{
	estream_t in, out;

	my_socket_ref (hd->sock);

	in = es_fdopen_nc (hd->sock->fd, "rb");
	if (!in)
	{
	err = gpg_error_from_syserror ();
	xfree (proxy_authstr);
	return err;
	}

	out = es_fdopen_nc (hd->sock->fd, "wb");
	if (!out)
	{
	err = gpg_error_from_syserror ();
	es_fclose (in);
	xfree (proxy_authstr);
	return err;
	}

	err = ntbtls_set_transport (hd->session->tls_session, in, out);
	if (err)
	{
	log_info ("TLS set_transport failed: %s <%s>\n",
	gpg_strerror (err), gpg_strsource (err));
	xfree (proxy_authstr);
	return err;
	}

	#ifdef HTTP_USE_NTBTLS
	if (hd->session->verify_cb)
	{
	err = ntbtls_set_verify_cb (hd->session->tls_session,
	my_ntbtls_verify_cb, hd);
	if (err)
	{
	log_error ("ntbtls_set_verify_cb failed: %s\n",
	gpg_strerror (err));
	xfree (proxy_authstr);
	return err;
	}
	}
	#endif /HTTP_USE_NTBTLS/

	while ((err = ntbtls_handshake (hd->session->tls_session)))
	{
	switch (err)
	{
	default:
	log_info ("TLS handshake failed: %s <%s>\n",
	gpg_strerror (err), gpg_strsource (err));
	xfree (proxy_authstr);
	return err;
	}
	}

	hd->session->verify.done = 0;

	/* Try the available verify callbacks until one returns success
	* or a real error. Note that NTBTLS does the verification
	* during the handshake via */
	#ifdef HTTP_USE_NTBTLS
	err = 0; /* Fixme check that the CB has been called. */
	#else
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif

	if (hd->session->verify_cb
	&& gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR
	&& gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED)
	err = hd->session->verify_cb (hd->session->verify_cb_value,
	hd, hd->session,
	(hd->flags \| hd->session->flags),
	hd->session->tls_session);

	if (tls_callback
	&& gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR
	&& gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED)
	err = tls_callback (hd, hd->session, 0);

	if (gpg_err_source (err) == GPG_ERR_SOURCE_DIRMNGR
	&& gpg_err_code (err) == GPG_ERR_NOT_IMPLEMENTED)
	err = http_verify_server_credentials (hd->session);

	if (err)
	{
	log_info ("TLS connection authentication failed: %s <%s>\n",
	gpg_strerror (err), gpg_strsource (err));
	xfree (proxy_authstr);
	return err;
	}

	}
	#elif HTTP_USE_GNUTLS
	if (hd->uri->use_tls)
	{
	int rc;

	my_socket_ref (hd->sock);
	gnutls_transport_set_ptr (hd->session->tls_session, hd->sock);
	gnutls_transport_set_pull_function (hd->session->tls_session,
	my_gnutls_read);
	gnutls_transport_set_push_function (hd->session->tls_session,
	my_gnutls_write);

	do
	{
	rc = gnutls_handshake (hd->session->tls_session);
	}
	while (rc == GNUTLS_E_INTERRUPTED \|\| rc == GNUTLS_E_AGAIN);
	if (rc < 0)
	{
	if (rc == GNUTLS_E_WARNING_ALERT_RECEIVED
	\|\| rc == GNUTLS_E_FATAL_ALERT_RECEIVED)
	{
	gnutls_alert_description_t alertno;
	const char *alertstr;

	alertno = gnutls_alert_get (hd->session->tls_session);
	alertstr = gnutls_alert_get_name (alertno);
	log_info ("TLS handshake failed: %s (alert %d)\n",
	alertstr, (int)alertno);
	if (alertno == GNUTLS_A_UNRECOGNIZED_NAME && server)
	log_info (" (sent server name '%s')\n", server);
	}
	else
	log_info ("TLS handshake failed: %s\n", gnutls_strerror (rc));
	xfree (proxy_authstr);
	return gpg_err_make (default_errsource, GPG_ERR_NETWORK);
	}

	hd->session->verify.done = 0;
	if (tls_callback)
	err = tls_callback (hd, hd->session, 0);
	else
	err = http_verify_server_credentials (hd->session);
	if (err)
	{
	log_info ("TLS connection authentication failed: %s\n",
	gpg_strerror (err));
	xfree (proxy_authstr);
	return err;
	}
	}
	#endif /HTTP_USE_GNUTLS/

	if (auth \|\| hd->uri->auth)
	{
	char *myauth;

	if (auth)
	{
	myauth = xtrystrdup (auth);
	if (!myauth)
	{
	xfree (proxy_authstr);
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	}
	remove_escapes (myauth);
	}
	else
	{
	remove_escapes (hd->uri->auth);
	myauth = hd->uri->auth;
	}

	authstr = make_header_line ("Authorization: Basic ", "\r\n",
	myauth, strlen (myauth));
	if (auth)
	xfree (myauth);

	if (!authstr)
	{
	xfree (proxy_authstr);
	return gpg_err_make (default_errsource,
	gpg_err_code_from_syserror ());
	}
	}

	p = build_rel_path (hd->uri);
	if (!p)
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());

	if (http_proxy && *http_proxy)
	{
	request = es_bsprintf
	("%s %s://%s:%hu%s%s HTTP/1.0\r\n%s%s",
	hd->req_type == HTTP_REQ_GET ? "GET" :
	hd->req_type == HTTP_REQ_HEAD ? "HEAD" :
	hd->req_type == HTTP_REQ_POST ? "POST" : "OOPS",
	hd->uri->use_tls? "https" : "http",
	httphost? httphost : server,
	port, *p == '/' ? "" : "/", p,
	authstr ? authstr : "",
	proxy_authstr ? proxy_authstr : "");
	}
	else
	{
	char portstr[35];

	if (port == (hd->uri->use_tls? 443 : 80))
	*portstr = 0;
	else
	snprintf (portstr, sizeof portstr, ":%u", port);

	request = es_bsprintf
	("%s %s%s HTTP/1.0\r\nHost: %s%s\r\n%s",
	hd->req_type == HTTP_REQ_GET ? "GET" :
	hd->req_type == HTTP_REQ_HEAD ? "HEAD" :
	hd->req_type == HTTP_REQ_POST ? "POST" : "OOPS",
	*p == '/' ? "" : "/", p,
	httphost? httphost : server,
	portstr,
	authstr? authstr:"");
	}
	xfree (p);
	if (!request)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	xfree (authstr);
	xfree (proxy_authstr);
	return err;
	}

	if (opt_debug \|\| (hd->flags & HTTP_FLAG_LOG_RESP))
	log_debug_with_string (request, "http.c:request:");

	/* First setup estream so that we can write even the first line
	using estream. This is also required for the sake of gnutls. */
	{
	cookie_t cookie;

	cookie = xtrycalloc (1, sizeof *cookie);
	if (!cookie)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	goto leave;
	}
	cookie->sock = my_socket_ref (hd->sock);
	hd->write_cookie = cookie;
	cookie->use_tls = hd->uri->use_tls;
	cookie->session = http_session_ref (hd->session);

	hd->fp_write = es_fopencookie (cookie, "w", cookie_functions);
	if (!hd->fp_write)
	{
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	my_socket_unref (cookie->sock, NULL, NULL);
	xfree (cookie);
	hd->write_cookie = NULL;
	}
	else if (es_fputs (request, hd->fp_write) \|\| es_fflush (hd->fp_write))
	err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
	else
	err = 0;

	if (!err)
	{
	for (;headers; headers=headers->next)
	{
	if (opt_debug \|\| (hd->flags & HTTP_FLAG_LOG_RESP))
	log_debug_with_string (headers->d, "http.c:request-header:");
	if ((es_fputs (headers->d, hd->fp_write) \|\| es_fflush (hd->fp_write))
	\|\| (es_fputs("\r\n",hd->fp_write) \|\| es_fflush(hd->fp_write)))
	{
	err = gpg_err_make (default_errsource,
	gpg_err_code_from_syserror ());
	break;
	}
	}
	}
	}

	leave:
	es_free (request);
	xfree (authstr);
	xfree (proxy_authstr);

	return err;
	}


	/*
	* Build the relative path from the parsed URI. Minimal
	* implementation. May return NULL in case of memory failure; errno
	* is then set accordingly.
	*/
	static char *
	build_rel_path (parsed_uri_t uri)
	{
	uri_tuple_t r;
	char rel_path, p;
	int n;

	/* Count the needed space. */
	n = insert_escapes (NULL, uri->path, "%;?&");
	/* TODO: build params. */
	for (r = uri->query; r; r = r->next)
	{
	n++; /* '?'/'&' */
	n += insert_escapes (NULL, r->name, "%;?&=");
	if (!r->no_value)
	{
	n++; /* '=' */
	n += insert_escapes (NULL, r->value, "%;?&=");
	}
	}
	n++;

	/* Now allocate and copy. */
	p = rel_path = xtrymalloc (n);
	if (!p)
	return NULL;
	n = insert_escapes (p, uri->path, "%;?&");
	p += n;
	/* TODO: add params. */
	for (r = uri->query; r; r = r->next)
	{
	*p++ = r == uri->query ? '?' : '&';
	n = insert_escapes (p, r->name, "%;?&=");
	p += n;
	if (!r->no_value)
	{
	*p++ = '=';
	/* TODO: Use valuelen. */
	n = insert_escapes (p, r->value, "%;?&=");
	p += n;
	}
	}
	*p = 0;
	return rel_path;
	}


	/* Transform a header name into a standard capitalized format; e.g.
	"Content-Type". Conversion stops at the colon. As usual we don't
	use the localized versions of ctype.h. */
	static void
	capitalize_header_name (char *name)
	{
	int first = 1;

	for (; name && name != ':'; name++)
	{
	if (*name == '-')
	first = 1;
	else if (first)
	{
	if (name >= 'a' && name <= 'z')
	name = name - 'a' + 'A';
	first = 0;
	}
	else if (name >= 'A' && name <= 'Z')
	name = name - 'A' + 'a';
	}
	}


	/* Store an HTTP header line in LINE away. Line continuation is
	supported as well as merging of headers with the same name. This
	function may modify LINE. */
	static gpg_err_code_t
	store_header (http_t hd, char *line)
	{
	size_t n;
	char p, value;
	header_t h;

	n = strlen (line);
	if (n && line[n-1] == '\n')
	{
	line[--n] = 0;
	if (n && line[n-1] == '\r')
	line[--n] = 0;
	}
	if (!n) /* we are never called to hit this. */
	return GPG_ERR_BUG;
	if (line == ' ' \|\| line == '\t')
	{
	/* Continuation. This won't happen too often as it is not
	recommended. We use a straightforward implementaion. */
	if (!hd->headers)
	return GPG_ERR_PROTOCOL_VIOLATION;
	n += strlen (hd->headers->value);
	p = xtrymalloc (n+1);
	if (!p)
	return gpg_err_code_from_syserror ();
	strcpy (stpcpy (p, hd->headers->value), line);
	xfree (hd->headers->value);
	hd->headers->value = p;
	return 0;
	}

	capitalize_header_name (line);
	p = strchr (line, ':');
	if (!p)
	return GPG_ERR_PROTOCOL_VIOLATION;
	*p++ = 0;
	while (p == ' ' \|\| p == '\t')
	p++;
	value = p;

	for (h=hd->headers; h; h = h->next)
	if ( !strcmp (h->name, line) )
	break;
	if (h)
	{
	/* We have already seen a line with that name. Thus we assume
	* it is a comma separated list and merge them. */
	p = strconcat (h->value, ",", value, NULL);
	if (!p)
	return gpg_err_code_from_syserror ();
	xfree (h->value);
	h->value = p;
	return 0;
	}

	/* Append a new header. */
	h = xtrymalloc (sizeof *h + strlen (line));
	if (!h)
	return gpg_err_code_from_syserror ();
	strcpy (h->name, line);
	h->value = xtrymalloc (strlen (value)+1);
	if (!h->value)
	{
	xfree (h);
	return gpg_err_code_from_syserror ();
	}
	strcpy (h->value, value);
	h->next = hd->headers;
	hd->headers = h;

	return 0;
	}


	/* Return the header NAME from the last response. The returned value
	is valid as along as HD has not been closed and no other request
	has been send. If the header was not found, NULL is returned. NAME
	must be canonicalized, that is the first letter of each dash
	delimited part must be uppercase and all other letters lowercase. */
	const char *
	http_get_header (http_t hd, const char *name)
	{
	header_t h;

	for (h=hd->headers; h; h = h->next)
	if ( !strcmp (h->name, name) )
	return h->value;
	return NULL;
	}


	/* Return a newly allocated and NULL terminated array with pointers to
	header names. The array must be released with xfree() and its
	content is only values as long as no other request has been
	send. */
	const char **
	http_get_header_names (http_t hd)
	{
	const char **array;
	size_t n;
	header_t h;

	for (n=0, h = hd->headers; h; h = h->next)
	n++;
	array = xtrycalloc (n+1, sizeof *array);
	if (array)
	{
	for (n=0, h = hd->headers; h; h = h->next)
	array[n++] = h->name;
	}

	return array;
	}


	/*
	* Parse the response from a server.
	* Returns: Errorcode and sets some files in the handle
	*/
	static gpg_err_code_t
	parse_response (http_t hd)
	{
	char line, p, *p2;
	size_t maxlen, len;
	cookie_t cookie = hd->read_cookie;
	const char *s;

	/* Delete old header lines. */
	while (hd->headers)
	{
	header_t tmp = hd->headers->next;
	xfree (hd->headers->value);
	xfree (hd->headers);
	hd->headers = tmp;
	}

	/* Wait for the status line. */
	do
	{
	maxlen = MAX_LINELEN;
	len = es_read_line (hd->fp_read, &hd->buffer, &hd->buffer_size, &maxlen);
	line = hd->buffer;
	if (!line)
	return gpg_err_code_from_syserror (); /* Out of core. */
	if (!maxlen)
	return GPG_ERR_TRUNCATED; /* Line has been truncated. */
	if (!len)
	return GPG_ERR_EOF;

	if ((hd->flags & HTTP_FLAG_LOG_RESP))
	log_debug_with_string (line, "http.c:response:\n");
	}
	while (!*line);

	if ((p = strchr (line, '/')))
	*p++ = 0;
	if (!p \|\| strcmp (line, "HTTP"))
	return 0; /* Assume http 0.9. */

	if ((p2 = strpbrk (p, " \t")))
	{
	*p2++ = 0;
	p2 += strspn (p2, " \t");
	}
	if (!p2)
	return 0; /* Also assume http 0.9. */
	p = p2;
	/* TODO: Add HTTP version number check. */
	if ((p2 = strpbrk (p, " \t")))
	*p2++ = 0;
	if (!isdigit ((unsigned int)p[0]) \|\| !isdigit ((unsigned int)p[1])
	\|\| !isdigit ((unsigned int)p[2]) \|\| p[3])
	{
	/* Malformed HTTP status code - assume http 0.9. */
	hd->is_http_0_9 = 1;
	hd->status_code = 200;
	return 0;
	}
	hd->status_code = atoi (p);

	/* Skip all the header lines and wait for the empty line. */
	do
	{
	maxlen = MAX_LINELEN;
	len = es_read_line (hd->fp_read, &hd->buffer, &hd->buffer_size, &maxlen);
	line = hd->buffer;
	if (!line)
	return gpg_err_code_from_syserror (); /* Out of core. */
	/* Note, that we can silently ignore truncated lines. */
	if (!len)
	return GPG_ERR_EOF;
	/* Trim line endings of empty lines. */
	if ((line == '\r' && line[1] == '\n') \|\| line == '\n')
	*line = 0;
	if ((hd->flags & HTTP_FLAG_LOG_RESP))
	log_info ("http.c:RESP: '%.*s'\n",
	(int)strlen(line)-(*line&&line[1]?2:0),line);
	if (*line)
	{
	gpg_err_code_t ec = store_header (hd, line);
	if (ec)
	return ec;
	}
	}
	while (len && *line);

	cookie->content_length_valid = 0;
	if (!(hd->flags & HTTP_FLAG_IGNORE_CL))
	{
	s = http_get_header (hd, "Content-Length");
	if (s)
	{
	cookie->content_length_valid = 1;
	cookie->content_length = string_to_u64 (s);
	}
	}

	return 0;
	}

	#if 0
	static int
	start_server ()
	{
	struct sockaddr_in mya;
	struct sockaddr_in peer;
	int fd, client;
	fd_set rfds;
	int addrlen;
	int i;

	if ((fd = socket (AF_INET, SOCK_STREAM, 0)) == -1)
	{
	log_error ("socket() failed: %s\n", strerror (errno));
	return -1;
	}
	i = 1;
	if (setsockopt (fd, SOL_SOCKET, SO_REUSEADDR, (byte *) & i, sizeof (i)))
	log_info ("setsockopt(SO_REUSEADDR) failed: %s\n", strerror (errno));

	mya.sin_family = AF_INET;
	memset (&mya.sin_addr, 0, sizeof (mya.sin_addr));
	mya.sin_port = htons (11371);

	if (bind (fd, (struct sockaddr *) &mya, sizeof (mya)))
	{
	log_error ("bind to port 11371 failed: %s\n", strerror (errno));
	sock_close (fd);
	return -1;
	}

	if (listen (fd, 5))
	{
	log_error ("listen failed: %s\n", strerror (errno));
	sock_close (fd);
	return -1;
	}

	for (;;)
	{
	FD_ZERO (&rfds);
	FD_SET (fd, &rfds);

	if (my_select (fd + 1, &rfds, NULL, NULL, NULL) <= 0)
	continue; /* ignore any errors */

	if (!FD_ISSET (fd, &rfds))
	continue;

	addrlen = sizeof peer;
	client = my_accept (fd, (struct sockaddr *) &peer, &addrlen);
	if (client == -1)
	continue; /* oops */

	log_info ("connect from %s\n", inet_ntoa (peer.sin_addr));

	fflush (stdout);
	fflush (stderr);
	if (!fork ())
	{
	int c;
	FILE *fp;

	fp = fdopen (client, "r");
	while ((c = getc (fp)) != EOF)
	putchar (c);
	fclose (fp);
	exit (0);
	}
	sock_close (client);
	}


	return 0;
	}
	#endif



	/* Return true if SOCKS shall be used. This is the case if tor_mode
	* is enabled and the desired address is not the loopback address.
	* This function is basically a copy of the same internal fucntion in
	* Libassuan. */
	static int
	use_socks (struct sockaddr *addr)
	{
	int mode;

	if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) \|\| !mode)
	return 0; /* Not in Tor mode. */
	else if (addr->sa_family == AF_INET6)
	{
	struct sockaddr_in6 addr_in6 = (struct sockaddr_in6 )addr;
	const unsigned char *s;
	int i;

	s = (unsigned char *)&addr_in6->sin6_addr.s6_addr;
	if (s[15] != 1)
	return 1; /* Last octet is not 1 - not the loopback address. */
	for (i=0; i < 15; i++, s++)
	if (*s)
	return 1; /* Non-zero octet found - not the loopback address. */

	return 0; /* This is the loopback address. */
	}
	else if (addr->sa_family == AF_INET)
	{
	struct sockaddr_in addr_in = (struct sockaddr_in )addr;

	if ((unsigned char)&addr_in->sin_addr.s_addr == 127)
	return 0; /* Loopback (127.0.0.0/8) */

	return 1;
	}
	else
	return 0;
	}


	/* Wrapper around assuan_sock_new which takes the domain from an
	* address parameter. */
	static assuan_fd_t
	my_sock_new_for_addr (struct sockaddr *addr, int type, int proto)
	{
	int domain;

	if (use_socks (addr))
	{
	/* Libassaun always uses 127.0.0.1 to connect to the socks
	* server (i.e. the Tor daemon). */
	domain = AF_INET;
	}
	else
	domain = addr->sa_family;

	return assuan_sock_new (domain, type, proto);
	}


	/* Actually connect to a server. On success 0 is returned and the
	* file descriptor for the socket is stored at R_SOCK; on error an
	* error code is returned and ASSUAN_INVALID_FD is stored at
	* R_SOCK. */
	static gpg_error_t
	connect_server (const char *server, unsigned short port,
	unsigned int flags, const char srvtag, assuan_fd_t r_sock)
	{
	gpg_error_t err;
	assuan_fd_t sock = ASSUAN_INVALID_FD;
	unsigned int srvcount = 0;
	int hostfound = 0;
	int anyhostaddr = 0;
	int srv, connected;
	gpg_error_t last_err = 0;
	struct srventry *serverlist = NULL;

	*r_sock = ASSUAN_INVALID_FD;

	#if defined(HAVE_W32_SYSTEM) && !defined(HTTP_NO_WSASTARTUP)
	init_sockets ();
	#endif /Windows/

	/* Onion addresses require special treatment. */
	if (is_onion_address (server))
	{
	#ifdef ASSUAN_SOCK_TOR

	if (opt_debug)
	log_debug ("http.c:connect_server:onion: name='%s' port=%hu\n",
	server, port);
	sock = assuan_sock_connect_byname (server, port, 0, NULL,
	ASSUAN_SOCK_TOR);
	if (sock == ASSUAN_INVALID_FD)
	{
	err = gpg_err_make (default_errsource,
	(errno == EHOSTUNREACH)? GPG_ERR_UNKNOWN_HOST
	: gpg_err_code_from_syserror ());
	log_error ("can't connect to '%s': %s\n", server, gpg_strerror (err));
	return err;
	}

	notify_netactivity ();
	*r_sock = sock;
	return 0;

	#else /!ASSUAN_SOCK_TOR/

	err = gpg_err_make (default_errsource, GPG_ERR_ENETUNREACH);
	return ASSUAN_INVALID_FD;

	#endif /!HASSUAN_SOCK_TOR/
	}

	/* Do the SRV thing */
	if (srvtag)
	{
	err = get_dns_srv (server, srvtag, NULL, &serverlist, &srvcount);
	if (err)
	log_info ("getting '%s' SRV for '%s' failed: %s\n",
	srvtag, server, gpg_strerror (err));
	/* Note that on error SRVCOUNT is zero. */
	err = 0;
	}

	if (!serverlist)
	{
	/* Either we're not using SRV, or the SRV lookup failed. Make
	up a fake SRV record. */
	serverlist = xtrycalloc (1, sizeof *serverlist);
	if (!serverlist)
	return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());

	serverlist->port = port;
	strncpy (serverlist->target, server, DIMof (struct srventry, target));
	serverlist->target[DIMof (struct srventry, target)-1] = '\0';
	srvcount = 1;
	}

	connected = 0;
	for (srv=0; srv < srvcount && !connected; srv++)
	{
	dns_addrinfo_t aibuf, ai;

	if (opt_debug)
	log_debug ("http.c:connect_server: trying name='%s' port=%hu\n",
	serverlist[srv].target, port);
	err = resolve_dns_name (serverlist[srv].target, port, 0, SOCK_STREAM,
	&aibuf, NULL);
	if (err)
	{
	log_info ("resolving '%s' failed: %s\n",
	serverlist[srv].target, gpg_strerror (err));
	last_err = err;
	continue; /* Not found - try next one. */
	}
	hostfound = 1;

	for (ai = aibuf; ai && !connected; ai = ai->next)
	{
	if (ai->family == AF_INET && (flags & HTTP_FLAG_IGNORE_IPv4))
	continue;
	if (ai->family == AF_INET6 && (flags & HTTP_FLAG_IGNORE_IPv6))
	continue;

	if (sock != ASSUAN_INVALID_FD)
	assuan_sock_close (sock);
	sock = my_sock_new_for_addr (ai->addr, ai->socktype, ai->protocol);
	if (sock == ASSUAN_INVALID_FD)
	{
	err = gpg_err_make (default_errsource,
	gpg_err_code_from_syserror ());
	log_error ("error creating socket: %s\n", gpg_strerror (err));
	free_dns_addrinfo (aibuf);
	xfree (serverlist);
	return err;
	}

	anyhostaddr = 1;
	if (assuan_sock_connect (sock, ai->addr, ai->addrlen))
	{
	last_err = gpg_err_make (default_errsource,
	gpg_err_code_from_syserror ());
	}
	else
	{
	connected = 1;
	notify_netactivity ();
	}
	}
	free_dns_addrinfo (aibuf);
	}

	xfree (serverlist);

	if (!connected)
	{
	if (!hostfound)
	log_error ("can't connect to '%s': %s\n",
	server, "host not found");
	else if (!anyhostaddr)
	log_error ("can't connect to '%s': %s\n",
	server, "no IP address for host");
	else
	{
	#ifdef HAVE_W32_SYSTEM
	log_error ("can't connect to '%s': ec=%d\n",
	server, (int)WSAGetLastError());
	#else
	log_error ("can't connect to '%s': %s\n",
	server, gpg_strerror (last_err));
	#endif
	}
	err = last_err? last_err : gpg_err_make (default_errsource,
	GPG_ERR_UNKNOWN_HOST);
	if (sock != ASSUAN_INVALID_FD)
	assuan_sock_close (sock);
	return err;
	}

	*r_sock = sock;
	return 0;
	}


	static gpg_error_t
	write_server (int sock, const char *data, size_t length)
	{
	int nleft;
	int nwritten;

	nleft = length;
	while (nleft > 0)
	{
	#if defined(HAVE_W32_SYSTEM)
	# if defined(USE_NPTH)
	npth_unprotect ();
	# endif
	nwritten = send (sock, data, nleft, 0);
	# if defined(USE_NPTH)
	npth_protect ();
	# endif
	if ( nwritten == SOCKET_ERROR )
	{
	log_info ("network write failed: ec=%d\n", (int)WSAGetLastError ());
	return gpg_error (GPG_ERR_NETWORK);
	}
	#else /!HAVE_W32_SYSTEM/
	# ifdef USE_NPTH
	nwritten = npth_write (sock, data, nleft);
	# else
	nwritten = write (sock, data, nleft);
	# endif
	if (nwritten == -1)
	{
	if (errno == EINTR)
	continue;
	if (errno == EAGAIN)
	{
	struct timeval tv;

	tv.tv_sec = 0;
	tv.tv_usec = 50000;
	my_select (0, NULL, NULL, NULL, &tv);
	continue;
	}
	log_info ("network write failed: %s\n", strerror (errno));
	return gpg_error_from_syserror ();
	}
	#endif /!HAVE_W32_SYSTEM/
	nleft -= nwritten;
	data += nwritten;
	}

	return 0;
	}



	/* Read handler for estream. */
	static gpgrt_ssize_t
	cookie_read (void cookie, void buffer, size_t size)
	{
	cookie_t c = cookie;
	int nread;

	if (c->content_length_valid)
	{
	if (!c->content_length)
	return 0; /* EOF */
	if (c->content_length < size)
	size = c->content_length;
	}

	#if HTTP_USE_NTBTLS
	if (c->use_tls && c->session && c->session->tls_session)
	{
	estream_t in, out;

	ntbtls_get_stream (c->session->tls_session, &in, &out);
	nread = es_fread (buffer, 1, size, in);
	if (opt_debug)
	log_debug ("TLS network read: %d/%zu\n", nread, size);
	}
	else
	#elif HTTP_USE_GNUTLS
	if (c->use_tls && c->session && c->session->tls_session)
	{
	again:
	nread = gnutls_record_recv (c->session->tls_session, buffer, size);
	if (nread < 0)
	{
	if (nread == GNUTLS_E_INTERRUPTED)
	goto again;
	if (nread == GNUTLS_E_AGAIN)
	{
	struct timeval tv;

	tv.tv_sec = 0;
	tv.tv_usec = 50000;
	my_select (0, NULL, NULL, NULL, &tv);
	goto again;
	}
	if (nread == GNUTLS_E_REHANDSHAKE)
	goto again; /* A client is allowed to just ignore this request. */
	if (nread == GNUTLS_E_PREMATURE_TERMINATION)
	{
	/* The server terminated the connection. Close the TLS
	session, and indicate EOF using a short read. */
	close_tls_session (c->session);
	return 0;
	}
	log_info ("TLS network read failed: %s\n", gnutls_strerror (nread));
	gpg_err_set_errno (EIO);
	return -1;
	}
	}
	else
	#endif /HTTP_USE_GNUTLS/
	{
	do
	{
	#ifdef HAVE_W32_SYSTEM
	/* Under Windows we need to use recv for a socket. */
	# if defined(USE_NPTH)
	npth_unprotect ();
	# endif
	nread = recv (c->sock->fd, buffer, size, 0);
	# if defined(USE_NPTH)
	npth_protect ();
	# endif

	#else /!HAVE_W32_SYSTEM/

	# ifdef USE_NPTH
	nread = npth_read (c->sock->fd, buffer, size);
	# else
	nread = read (c->sock->fd, buffer, size);
	# endif

	#endif /!HAVE_W32_SYSTEM/
	}
	while (nread == -1 && errno == EINTR);
	}

	if (c->content_length_valid && nread > 0)
	{
	if (nread < c->content_length)
	c->content_length -= nread;
	else
	c->content_length = 0;
	}

	return (gpgrt_ssize_t)nread;
	}

	/* Write handler for estream. */
	static gpgrt_ssize_t
	cookie_write (void cookie, const void buffer_arg, size_t size)
	{
	const char *buffer = buffer_arg;
	cookie_t c = cookie;
	int nwritten = 0;

	#if HTTP_USE_NTBTLS
	if (c->use_tls && c->session && c->session->tls_session)
	{
	estream_t in, out;

	ntbtls_get_stream (c->session->tls_session, &in, &out);
	if (size == 0)
	es_fflush (out);
	else
	nwritten = es_fwrite (buffer, 1, size, out);
	if (opt_debug)
	log_debug ("TLS network write: %d/%zu\n", nwritten, size);
	}
	else
	#elif HTTP_USE_GNUTLS
	if (c->use_tls && c->session && c->session->tls_session)
	{
	int nleft = size;
	while (nleft > 0)
	{
	nwritten = gnutls_record_send (c->session->tls_session,
	buffer, nleft);
	if (nwritten <= 0)
	{
	if (nwritten == GNUTLS_E_INTERRUPTED)
	continue;
	if (nwritten == GNUTLS_E_AGAIN)
	{
	struct timeval tv;

	tv.tv_sec = 0;
	tv.tv_usec = 50000;
	my_select (0, NULL, NULL, NULL, &tv);
	continue;
	}
	log_info ("TLS network write failed: %s\n",
	gnutls_strerror (nwritten));
	gpg_err_set_errno (EIO);
	return -1;
	}
	nleft -= nwritten;
	buffer += nwritten;
	}
	}
	else
	#endif /HTTP_USE_GNUTLS/
	{
	if ( write_server (c->sock->fd, buffer, size) )
	{
	gpg_err_set_errno (EIO);
	nwritten = -1;
	}
	else
	nwritten = size;
	}

	return (gpgrt_ssize_t)nwritten;
	}


	#ifdef HTTP_USE_GNUTLS
	/* Wrapper for gnutls_bye used by my_socket_unref. */
	static void
	send_gnutls_bye (void *opaque)
	{
	tls_session_t tls_session = opaque;
	int ret;

	again:
	do
	ret = gnutls_bye (tls_session, GNUTLS_SHUT_RDWR);
	while (ret == GNUTLS_E_INTERRUPTED);
	if (ret == GNUTLS_E_AGAIN)
	{
	struct timeval tv;

	tv.tv_sec = 0;
	tv.tv_usec = 50000;
	my_select (0, NULL, NULL, NULL, &tv);
	goto again;
	}
	}
	#endif /HTTP_USE_GNUTLS/

	/* Close handler for estream. */
	static int
	cookie_close (void *cookie)
	{
	cookie_t c = cookie;

	if (!c)
	return 0;

	#if HTTP_USE_NTBTLS
	if (c->use_tls && c->session && c->session->tls_session)
	{
	/* FIXME!! Possibly call ntbtls_close_notify for close
	of write stream. */
	my_socket_unref (c->sock, NULL, NULL);
	}
	else
	#elif HTTP_USE_GNUTLS
	if (c->use_tls && c->session && c->session->tls_session)
	my_socket_unref (c->sock, send_gnutls_bye, c->session->tls_session);
	else
	#endif /HTTP_USE_GNUTLS/
	if (c->sock)
	my_socket_unref (c->sock, NULL, NULL);

	if (c->session)
	http_session_unref (c->session);
	xfree (c);
	return 0;
	}




	/* Verify the credentials of the server. Returns 0 on success and
	store the result in the session object. */
	gpg_error_t
	http_verify_server_credentials (http_session_t sess)
	{
	#if HTTP_USE_GNUTLS
	static const char const errprefix[] = "TLS verification of peer failed";
	int rc;
	unsigned int status;
	const char *hostname;
	const gnutls_datum_t *certlist;
	unsigned int certlistlen;
	gnutls_x509_crt_t cert;
	gpg_error_t err = 0;

	sess->verify.done = 1;
	sess->verify.status = 0;
	sess->verify.rc = GNUTLS_E_CERTIFICATE_ERROR;

	if (gnutls_certificate_type_get (sess->tls_session) != GNUTLS_CRT_X509)
	{
	log_error ("%s: %s\n", errprefix, "not an X.509 certificate");
	sess->verify.rc = GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
	return gpg_error (GPG_ERR_GENERAL);
	}

	rc = gnutls_certificate_verify_peers2 (sess->tls_session, &status);
	if (rc)
	{
	log_error ("%s: %s\n", errprefix, gnutls_strerror (rc));
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	}
	else if (status)
	{
	log_error ("%s: status=0x%04x\n", errprefix, status);
	#if GNUTLS_VERSION_NUMBER >= 0x030104
	{
	gnutls_datum_t statusdat;

	if (!gnutls_certificate_verification_status_print
	(status, GNUTLS_CRT_X509, &statusdat, 0))
	{
	log_info ("%s: %s\n", errprefix, statusdat.data);
	gnutls_free (statusdat.data);
	}
	}
	#endif /gnutls >= 3.1.4/

	sess->verify.status = status;
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	}

	hostname = sess->servername;
	if (!hostname \|\| !strchr (hostname, '.'))
	{
	log_error ("%s: %s\n", errprefix, "hostname missing");
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	}

	certlist = gnutls_certificate_get_peers (sess->tls_session, &certlistlen);
	if (!certlistlen)
	{
	log_error ("%s: %s\n", errprefix, "server did not send a certificate");
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);

	/* Need to stop here. */
	if (err)
	return err;
	}

	rc = gnutls_x509_crt_init (&cert);
	if (rc < 0)
	{
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	if (err)
	return err;
	}

	rc = gnutls_x509_crt_import (cert, &certlist[0], GNUTLS_X509_FMT_DER);
	if (rc < 0)
	{
	log_error ("%s: %s: %s\n", errprefix, "error importing certificate",
	gnutls_strerror (rc));
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	}

	if (!gnutls_x509_crt_check_hostname (cert, hostname))
	{
	log_error ("%s: %s\n", errprefix, "hostname does not match");
	if (!err)
	err = gpg_error (GPG_ERR_GENERAL);
	}

	gnutls_x509_crt_deinit (cert);

	if (!err)
	sess->verify.rc = 0;

	if (sess->cert_log_cb)
	{
	const void *bufarr[10];
	size_t buflenarr[10];
	size_t n;

	for (n = 0; n < certlistlen && n < DIM (bufarr)-1; n++)
	{
	bufarr[n] = certlist[n].data;
	buflenarr[n] = certlist[n].size;
	}
	bufarr[n] = NULL;
	buflenarr[n] = 0;
	sess->cert_log_cb (sess, err, hostname, bufarr, buflenarr);
	}

	return err;
	#else /!HTTP_USE_GNUTLS/
	(void)sess;
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}

	/* Return the first query variable with the specified key. If there
	is no such variable, return NULL. */
	struct uri_tuple_s *
	uri_query_lookup (parsed_uri_t uri, const char *key)
	{
	struct uri_tuple_s *t;

	for (t = uri->query; t; t = t->next)
	if (strcmp (t->name, key) == 0)
	return t;

	return NULL;
	}
	diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c
	index b7aa7cc65..f664655b3 100644
	--- a/dirmngr/ks-engine-ldap.c
	+++ b/dirmngr/ks-engine-ldap.c
	@@ -1,2101 +1,2101 @@
	/* ks-engine-ldap.c - talk to a LDAP keyserver
	* Copyright (C) 2001, 2002, 2004, 2005, 2006
	* 2007 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <string.h>
	#include <time.h>
	#include <unistd.h>
	#ifdef HAVE_GETOPT_H
	# include <getopt.h>
	#endif
	#include <stdlib.h>
	#include <errno.h>
	#include <assert.h>

	#ifdef _WIN32
	# include <winsock2.h>
	# include <winldap.h>
	#else
	# ifdef NEED_LBER_H
	# include <lber.h>
	# endif
	/* For OpenLDAP, to enable the API that we're using. */
	# define LDAP_DEPRECATED 1
	# include <ldap.h>
	#endif

	#include "dirmngr.h"
	#include "misc.h"
	#include "userids.h"
	#include "ks-engine.h"
	#include "ldap-parse-uri.h"

	#ifndef HAVE_TIMEGM
	time_t timegm(struct tm *tm);
	#endif

	/* Convert an LDAP error to a GPG error. */
	static int
	ldap_err_to_gpg_err (int code)
	{
	gpg_err_code_t ec;

	switch (code)
	{
	#ifdef LDAP_X_CONNECTING
	case LDAP_X_CONNECTING: ec = GPG_ERR_LDAP_X_CONNECTING; break;
	#endif

	case LDAP_REFERRAL_LIMIT_EXCEEDED: ec = GPG_ERR_LDAP_REFERRAL_LIMIT; break;
	case LDAP_CLIENT_LOOP: ec = GPG_ERR_LDAP_CLIENT_LOOP; break;
	case LDAP_NO_RESULTS_RETURNED: ec = GPG_ERR_LDAP_NO_RESULTS; break;
	case LDAP_CONTROL_NOT_FOUND: ec = GPG_ERR_LDAP_CONTROL_NOT_FOUND; break;
	case LDAP_NOT_SUPPORTED: ec = GPG_ERR_LDAP_NOT_SUPPORTED; break;
	case LDAP_CONNECT_ERROR: ec = GPG_ERR_LDAP_CONNECT; break;
	case LDAP_NO_MEMORY: ec = GPG_ERR_LDAP_NO_MEMORY; break;
	case LDAP_PARAM_ERROR: ec = GPG_ERR_LDAP_PARAM; break;
	case LDAP_USER_CANCELLED: ec = GPG_ERR_LDAP_USER_CANCELLED; break;
	case LDAP_FILTER_ERROR: ec = GPG_ERR_LDAP_FILTER; break;
	case LDAP_AUTH_UNKNOWN: ec = GPG_ERR_LDAP_AUTH_UNKNOWN; break;
	case LDAP_TIMEOUT: ec = GPG_ERR_LDAP_TIMEOUT; break;
	case LDAP_DECODING_ERROR: ec = GPG_ERR_LDAP_DECODING; break;
	case LDAP_ENCODING_ERROR: ec = GPG_ERR_LDAP_ENCODING; break;
	case LDAP_LOCAL_ERROR: ec = GPG_ERR_LDAP_LOCAL; break;
	case LDAP_SERVER_DOWN: ec = GPG_ERR_LDAP_SERVER_DOWN; break;

	case LDAP_SUCCESS: ec = GPG_ERR_LDAP_SUCCESS; break;

	case LDAP_OPERATIONS_ERROR: ec = GPG_ERR_LDAP_OPERATIONS; break;
	case LDAP_PROTOCOL_ERROR: ec = GPG_ERR_LDAP_PROTOCOL; break;
	case LDAP_TIMELIMIT_EXCEEDED: ec = GPG_ERR_LDAP_TIMELIMIT; break;
	case LDAP_SIZELIMIT_EXCEEDED: ec = GPG_ERR_LDAP_SIZELIMIT; break;
	case LDAP_COMPARE_FALSE: ec = GPG_ERR_LDAP_COMPARE_FALSE; break;
	case LDAP_COMPARE_TRUE: ec = GPG_ERR_LDAP_COMPARE_TRUE; break;
	case LDAP_AUTH_METHOD_NOT_SUPPORTED: ec=GPG_ERR_LDAP_UNSUPPORTED_AUTH;break;
	case LDAP_STRONG_AUTH_REQUIRED: ec = GPG_ERR_LDAP_STRONG_AUTH_RQRD; break;
	case LDAP_PARTIAL_RESULTS: ec = GPG_ERR_LDAP_PARTIAL_RESULTS; break;
	case LDAP_REFERRAL: ec = GPG_ERR_LDAP_REFERRAL; break;

	#ifdef LDAP_ADMINLIMIT_EXCEEDED
	case LDAP_ADMINLIMIT_EXCEEDED: ec = GPG_ERR_LDAP_ADMINLIMIT; break;
	#endif

	#ifdef LDAP_UNAVAILABLE_CRITICAL_EXTENSION
	case LDAP_UNAVAILABLE_CRITICAL_EXTENSION:
	ec = GPG_ERR_LDAP_UNAVAIL_CRIT_EXTN; break;
	#endif

	case LDAP_CONFIDENTIALITY_REQUIRED: ec = GPG_ERR_LDAP_CONFIDENT_RQRD; break;
	case LDAP_SASL_BIND_IN_PROGRESS: ec = GPG_ERR_LDAP_SASL_BIND_INPROG; break;
	case LDAP_NO_SUCH_ATTRIBUTE: ec = GPG_ERR_LDAP_NO_SUCH_ATTRIBUTE; break;
	case LDAP_UNDEFINED_TYPE: ec = GPG_ERR_LDAP_UNDEFINED_TYPE; break;
	case LDAP_INAPPROPRIATE_MATCHING: ec = GPG_ERR_LDAP_BAD_MATCHING; break;
	case LDAP_CONSTRAINT_VIOLATION: ec = GPG_ERR_LDAP_CONST_VIOLATION; break;

	#ifdef LDAP_TYPE_OR_VALUE_EXISTS
	case LDAP_TYPE_OR_VALUE_EXISTS: ec = GPG_ERR_LDAP_TYPE_VALUE_EXISTS; break;
	#endif

	case LDAP_INVALID_SYNTAX: ec = GPG_ERR_LDAP_INV_SYNTAX; break;
	case LDAP_NO_SUCH_OBJECT: ec = GPG_ERR_LDAP_NO_SUCH_OBJ; break;
	case LDAP_ALIAS_PROBLEM: ec = GPG_ERR_LDAP_ALIAS_PROBLEM; break;
	case LDAP_INVALID_DN_SYNTAX: ec = GPG_ERR_LDAP_INV_DN_SYNTAX; break;
	case LDAP_IS_LEAF: ec = GPG_ERR_LDAP_IS_LEAF; break;
	case LDAP_ALIAS_DEREF_PROBLEM: ec = GPG_ERR_LDAP_ALIAS_DEREF; break;

	#ifdef LDAP_X_PROXY_AUTHZ_FAILURE
	case LDAP_X_PROXY_AUTHZ_FAILURE: ec = GPG_ERR_LDAP_X_PROXY_AUTH_FAIL; break;
	#endif

	case LDAP_INAPPROPRIATE_AUTH: ec = GPG_ERR_LDAP_BAD_AUTH; break;
	case LDAP_INVALID_CREDENTIALS: ec = GPG_ERR_LDAP_INV_CREDENTIALS; break;

	#ifdef LDAP_INSUFFICIENT_ACCESS
	case LDAP_INSUFFICIENT_ACCESS: ec = GPG_ERR_LDAP_INSUFFICIENT_ACC; break;
	#endif

	case LDAP_BUSY: ec = GPG_ERR_LDAP_BUSY; break;
	case LDAP_UNAVAILABLE: ec = GPG_ERR_LDAP_UNAVAILABLE; break;
	case LDAP_UNWILLING_TO_PERFORM: ec = GPG_ERR_LDAP_UNWILL_TO_PERFORM; break;
	case LDAP_LOOP_DETECT: ec = GPG_ERR_LDAP_LOOP_DETECT; break;
	case LDAP_NAMING_VIOLATION: ec = GPG_ERR_LDAP_NAMING_VIOLATION; break;
	case LDAP_OBJECT_CLASS_VIOLATION: ec = GPG_ERR_LDAP_OBJ_CLS_VIOLATION; break;
	case LDAP_NOT_ALLOWED_ON_NONLEAF: ec=GPG_ERR_LDAP_NOT_ALLOW_NONLEAF;break;
	case LDAP_NOT_ALLOWED_ON_RDN: ec = GPG_ERR_LDAP_NOT_ALLOW_ON_RDN; break;
	case LDAP_ALREADY_EXISTS: ec = GPG_ERR_LDAP_ALREADY_EXISTS; break;
	case LDAP_NO_OBJECT_CLASS_MODS: ec = GPG_ERR_LDAP_NO_OBJ_CLASS_MODS; break;
	case LDAP_RESULTS_TOO_LARGE: ec = GPG_ERR_LDAP_RESULTS_TOO_LARGE; break;
	case LDAP_AFFECTS_MULTIPLE_DSAS: ec = GPG_ERR_LDAP_AFFECTS_MULT_DSAS; break;

	#ifdef LDAP_VLV_ERROR
	case LDAP_VLV_ERROR: ec = GPG_ERR_LDAP_VLV; break;
	#endif

	case LDAP_OTHER: ec = GPG_ERR_LDAP_OTHER; break;

	#ifdef LDAP_CUP_RESOURCES_EXHAUSTED
	case LDAP_CUP_RESOURCES_EXHAUSTED: ec=GPG_ERR_LDAP_CUP_RESOURCE_LIMIT;break;
	case LDAP_CUP_SECURITY_VIOLATION: ec=GPG_ERR_LDAP_CUP_SEC_VIOLATION; break;
	case LDAP_CUP_INVALID_DATA: ec = GPG_ERR_LDAP_CUP_INV_DATA; break;
	case LDAP_CUP_UNSUPPORTED_SCHEME: ec = GPG_ERR_LDAP_CUP_UNSUP_SCHEME; break;
	case LDAP_CUP_RELOAD_REQUIRED: ec = GPG_ERR_LDAP_CUP_RELOAD; break;
	#endif

	#ifdef LDAP_CANCELLED
	case LDAP_CANCELLED: ec = GPG_ERR_LDAP_CANCELLED; break;
	#endif

	#ifdef LDAP_NO_SUCH_OPERATION
	case LDAP_NO_SUCH_OPERATION: ec = GPG_ERR_LDAP_NO_SUCH_OPERATION; break;
	#endif

	#ifdef LDAP_TOO_LATE
	case LDAP_TOO_LATE: ec = GPG_ERR_LDAP_TOO_LATE; break;
	#endif

	#ifdef LDAP_CANNOT_CANCEL
	case LDAP_CANNOT_CANCEL: ec = GPG_ERR_LDAP_CANNOT_CANCEL; break;
	#endif

	#ifdef LDAP_ASSERTION_FAILED
	case LDAP_ASSERTION_FAILED: ec = GPG_ERR_LDAP_ASSERTION_FAILED; break;
	#endif

	#ifdef LDAP_PROXIED_AUTHORIZATION_DENIED
	case LDAP_PROXIED_AUTHORIZATION_DENIED:
	ec = GPG_ERR_LDAP_PROX_AUTH_DENIED; break;
	#endif

	default:
	#if defined(LDAP_E_ERROR) && defined(LDAP_X_ERROR)
	if (LDAP_E_ERROR (code))
	ec = GPG_ERR_LDAP_E_GENERAL;
	else if (LDAP_X_ERROR (code))
	ec = GPG_ERR_LDAP_X_GENERAL;
	else
	#endif
	ec = GPG_ERR_LDAP_GENERAL;
	break;
	}

	return ec;
	}

	/* Retrieve an LDAP error and return it's GPG equivalent. */
	static int
	ldap_to_gpg_err (LDAP *ld)
	{
	#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
	int err;

	if (ldap_get_option (ld, LDAP_OPT_ERROR_NUMBER, &err) == 0)
	return ldap_err_to_gpg_err (err);
	else
	return GPG_ERR_GENERAL;
	#elif defined(HAVE_LDAP_LD_ERRNO)
	return ldap_err_to_gpg_err (ld->ld_errno);
	#else
	/* We should never get here since the LDAP library should always
	have either ldap_get_option or ld_errno, but just in case... */
	return GPG_ERR_INTERNAL;
	#endif
	}

	static time_t
	ldap2epochtime (const char *timestr)
	{
	struct tm pgptime;
	time_t answer;

	memset (&pgptime, 0, sizeof(pgptime));

	/* YYYYMMDDHHmmssZ */

	sscanf (timestr, "%4d%2d%2d%2d%2d%2d",
	&pgptime.tm_year,
	&pgptime.tm_mon,
	&pgptime.tm_mday,
	&pgptime.tm_hour,
	&pgptime.tm_min,
	&pgptime.tm_sec);

	pgptime.tm_year -= 1900;
	pgptime.tm_isdst = -1;
	pgptime.tm_mon--;

	/* mktime() takes the timezone into account, so we use timegm() */

	answer = timegm (&pgptime);

	return answer;
	}

	/* Caller must free the result. */
	static char *
	tm2ldaptime (struct tm *tm)
	{
	struct tm tmp = *tm;
	char buf[16];

	/* YYYYMMDDHHmmssZ */

	tmp.tm_year += 1900;
	tmp.tm_mon ++;

	snprintf (buf, sizeof buf, "%04d%02d%02d%02d%02d%02dZ",
	tmp.tm_year,
	tmp.tm_mon,
	tmp.tm_mday,
	tmp.tm_hour,
	tmp.tm_min,
	tmp.tm_sec);

	return xstrdup (buf);
	}

	#if 0
	/* Caller must free */
	static char *
	epoch2ldaptime (time_t stamp)
	{
	struct tm tm;
	if (gmtime_r (&stamp, &tm))
	return tm2ldaptime (&tm);
	else
	return xstrdup ("INVALID TIME");
	}
	#endif

	/* Print a help output for the schemata supported by this module. */
	gpg_error_t
	ks_ldap_help (ctrl_t ctrl, parsed_uri_t uri)
	{
	const char data[] =
	"Handler for LDAP URLs:\n"
	" ldap://host:port/[BASEDN]???[bindname=BINDNAME,password=PASSWORD]\n"
	"\n"
	"Note: basedn, bindname and password need to be percent escaped. In\n"
	"particular, spaces need to be replaced with %20 and commas with %2c.\n"
	"bindname will typically be of the form:\n"
	"\n"
	" uid=user%2cou=PGP%20Users%2cdc=EXAMPLE%2cdc=ORG\n"
	"\n"
	"The ldaps:// and ldapi:// schemes are also supported. If ldaps is used\n"
	"then the server's certificate will be checked. If it is not valid, any\n"
	"operation will be aborted.\n"
	"\n"
	"Supported methods: search, get, put\n";
	gpg_error_t err;

	if(!uri)
	err = ks_print_help (ctrl, " ldap");
	else if (strcmp (uri->scheme, "ldap") == 0
	\|\| strcmp (uri->scheme, "ldaps") == 0
	\|\| strcmp (uri->scheme, "ldapi") == 0)
	err = ks_print_help (ctrl, data);
	else
	err = 0;

	return err;
	}

	/* Convert a keyspec to a filter. Return an error if the keyspec is
	bad or is not supported. The filter is escaped and returned in
	filter. It is the caller's responsibility to free filter.
	filter is only set if this function returns success (i.e., 0). /
	static gpg_error_t
	keyspec_to_ldap_filter (const char keyspec, char *filter, int only_exact)
	{
	/* Remove search type indicator and adjust PATTERN accordingly.
	Note: don't include a preceding 0x when searching by keyid. */

	/* XXX: Should we include disabled / revoke options? */
	KEYDB_SEARCH_DESC desc;
	char *f = NULL;
	char *freeme = NULL;

	gpg_error_t err = classify_user_id (keyspec, &desc, 1);
	if (err)
	return err;

	switch (desc.mode)
	{
	case KEYDB_SEARCH_MODE_EXACT:
	f = xasprintf ("(pgpUserID=%s)",
	(freeme = ldap_escape_filter (desc.u.name)));
	break;

	case KEYDB_SEARCH_MODE_SUBSTR:
	if (! only_exact)
	f = xasprintf ("(pgpUserID=%s)",
	(freeme = ldap_escape_filter (desc.u.name)));
	break;

	case KEYDB_SEARCH_MODE_MAIL:
	if (! only_exact)
	f = xasprintf ("(pgpUserID=<%s>)",
	(freeme = ldap_escape_filter (desc.u.name)));
	break;

	case KEYDB_SEARCH_MODE_MAILSUB:
	if (! only_exact)
	f = xasprintf ("(pgpUserID=<%s>)",
	(freeme = ldap_escape_filter (desc.u.name)));
	break;

	case KEYDB_SEARCH_MODE_MAILEND:
	if (! only_exact)
	f = xasprintf ("(pgpUserID=<%s>*)",
	(freeme = ldap_escape_filter (desc.u.name)));
	break;

	case KEYDB_SEARCH_MODE_SHORT_KID:
	f = xasprintf ("(pgpKeyID=%08lX)", (ulong) desc.u.kid[1]);
	break;
	case KEYDB_SEARCH_MODE_LONG_KID:
	f = xasprintf ("(pgpCertID=%08lX%08lX)",
	(ulong) desc.u.kid[0], (ulong) desc.u.kid[1]);
	break;

	case KEYDB_SEARCH_MODE_FPR16:
	case KEYDB_SEARCH_MODE_FPR20:
	case KEYDB_SEARCH_MODE_FPR:
	case KEYDB_SEARCH_MODE_ISSUER:
	case KEYDB_SEARCH_MODE_ISSUER_SN:
	case KEYDB_SEARCH_MODE_SN:
	case KEYDB_SEARCH_MODE_SUBJECT:
	case KEYDB_SEARCH_MODE_KEYGRIP:
	case KEYDB_SEARCH_MODE_WORDS:
	case KEYDB_SEARCH_MODE_FIRST:
	case KEYDB_SEARCH_MODE_NEXT:
	default:
	break;
	}

	xfree (freeme);

	if (! f)
	{
	log_error ("Unsupported search mode.\n");
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	}

	*filter = f;

	return 0;
	}



	/* Connect to an LDAP server and interrogate it.

	- uri describes the server to connect to and various options
	including whether to use TLS and the username and password (see
	ldap_parse_uri for a description of the various fields).

	This function returns:

	- The ldap connection handle in *LDAP_CONNP.

	- The base DN for the PGP key space by querying the
	pgpBaseKeySpaceDN attribute (This is normally
	'ou=PGP Keys,dc=EXAMPLE,dc=ORG').

	- The attribute to lookup to find the pgp key. This is either
	'pgpKey' or 'pgpKeyV2'.

	- Whether this is a real ldap server. (It's unclear what this
	exactly means.)

	The values are returned in the passed variables. If you pass NULL,
	then the value won't be returned. It is the caller's
	responsibility to release *LDAP_CONNP with ldap_unbind and xfree
	BASEDNP and PGPKEYATTRP.

	If this function successfully interrogated the server, it returns
	0. If there was an LDAP error, it returns the LDAP error code. If
	an error occurred, *basednp, etc., are undefined (and don't need to
	be freed.)

	If no LDAP error occurred, you still need to check that *basednp is
	valid. If it is NULL, then the server does not appear to be an
	OpenPGP Keyserver. In this case, you also do not need to xfree
	pgpkeyattrp. /
	static int
	my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp,
	char basednp, char pgpkeyattrp, int *real_ldapp)
	{
	int err = 0;

	LDAP *ldap_conn = NULL;

	char *user = uri->auth;
	struct uri_tuple_s *password_param = uri_query_lookup (uri, "password");
	char *password = password_param ? password_param->value : NULL;

	char *basedn = NULL;
	/* Whether to look for the pgpKey or pgpKeyv2 attribute. */
	char *pgpkeyattr = "pgpKey";
	int real_ldap = 0;

	log_debug ("my_ldap_connect(%s:%d/%s????%s%s%s%s%s)\n",
	uri->host, uri->port,
	uri->path ?: "",
	uri->auth ? "bindname=" : "", uri->auth ?: "",
	uri->auth && password ? "," : "",
	password ? "password=" : "", password ?: "");

	/* If the uri specifies a secure connection and we don't support
	TLS, then fail; don't silently revert to an insecure
	connection. */
	if (uri->use_tls)
	{
	#ifndef HAVE_LDAP_START_TLS_S
	log_error ("Can't use LDAP to connect to the server: no TLS support.");
	err = GPG_ERR_LDAP_NOT_SUPPORTED;
	goto out;
	#endif
	}

	ldap_conn = ldap_init (uri->host, uri->port);
	if (! ldap_conn)
	{
	err = gpg_err_code_from_syserror ();
	log_error ("Failed to open connection to LDAP server (%s://%s:%d)\n",
	uri->scheme, uri->host, uri->port);
	goto out;
	}

	#ifdef HAVE_LDAP_SET_OPTION
	{
	int ver = LDAP_VERSION3;

	err = ldap_set_option (ldap_conn, LDAP_OPT_PROTOCOL_VERSION, &ver);
	if (err != LDAP_SUCCESS)
	{
	log_error ("gpgkeys: unable to go to LDAP 3: %s\n",
	ldap_err2string (err));
	goto out;
	}
	}
	#endif

	/* XXX: It would be nice to have an option to provide the server's
	certificate. */
	#if 0
	#if defined(LDAP_OPT_X_TLS_CACERTFILE) && defined(HAVE_LDAP_SET_OPTION)
	err = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE, ca_cert_file);
	if (err)
	{
	log_error ("unable to set ca-cert-file to '%s': %s\n",
	ca_cert_file, ldap_err2string (err));
	goto out;
	}
	#endif /* LDAP_OPT_X_TLS_CACERTFILE && HAVE_LDAP_SET_OPTION */
	#endif

	#ifdef HAVE_LDAP_START_TLS_S
	if (uri->use_tls)
	{
	/* XXX: We need an option to determine whether to abort if the
	certificate is bad or not. Right now we conservatively
	default to checking the certificate and aborting. */
	#ifndef HAVE_W32_SYSTEM
	int check_cert = LDAP_OPT_X_TLS_HARD; /* LDAP_OPT_X_TLS_NEVER */

	err = ldap_set_option (ldap_conn,
	LDAP_OPT_X_TLS_REQUIRE_CERT, &check_cert);
	if (err)
	{
	log_error ("Failed to set TLS option on LDAP connection.\n");
	goto out;
	}
	#else
	/* On Windows, the certificates are checked by default. If the
	option to disable checking mentioned above is ever
	implemented, the way to do that on Windows is to install a
	callback routine using ldap_set_option (..,
	LDAP_OPT_SERVER_CERTIFICATE, ..); */
	#endif

	err = ldap_start_tls_s (ldap_conn,
	#ifdef HAVE_W32_SYSTEM
	/* ServerReturnValue, result */
	NULL, NULL,
	#endif
	/* ServerControls, ClientControls */
	NULL, NULL);
	if (err)
	{
	log_error ("Failed to connect to LDAP server with TLS.\n");
	goto out;
	}
	}
	#endif

	/* By default we don't bind as there is usually no need to. */
	if (uri->auth)
	{
	log_debug ("LDAP bind to %s, password %s\n",
	user, password ? ">not shown<" : ">none<");

	err = ldap_simple_bind_s (ldap_conn, user, password);
	if (err != LDAP_SUCCESS)
	{
	log_error ("Internal LDAP bind error: %s\n",
	ldap_err2string (err));
	goto out;
	}
	}

	if (uri->path && *uri->path)
	/* User specified base DN. */
	{
	basedn = xstrdup (uri->path);

	/* If the user specifies a base DN, then we know the server is a
	real LDAP server. */
	real_ldap = 1;
	}
	else
	{
	LDAPMessage *res = NULL;
	/* Look for namingContexts. */
	char *attr[] = { "namingContexts", NULL };

	err = ldap_search_s (ldap_conn, "", LDAP_SCOPE_BASE,
	"(objectClass=*)", attr, 0, &res);
	if (err == LDAP_SUCCESS)
	{
	char **context = ldap_get_values (ldap_conn, res, "namingContexts");
	if (context)
	/* We found some, so try each namingContext as the search
	base and look for pgpBaseKeySpaceDN. Because we found
	this, we know we're talking to a regular-ish LDAP
	server and not an LDAP keyserver. */
	{
	int i;
	char *attr2[] =
	{ "pgpBaseKeySpaceDN", "pgpVersion", "pgpSoftware", NULL };

	real_ldap = 1;

	for (i = 0; context[i] && ! basedn; i++)
	{
	char **vals;
	LDAPMessage *si_res;

	{
	char *object = xasprintf ("cn=pgpServerInfo,%s",
	context[i]);
	err = ldap_search_s (ldap_conn, object, LDAP_SCOPE_BASE,
	"(objectClass=*)", attr2, 0, &si_res);
	xfree (object);
	}

	if (err == LDAP_SUCCESS)
	{
	vals = ldap_get_values (ldap_conn, si_res,
	"pgpBaseKeySpaceDN");
	if (vals)
	{
	basedn = xtrystrdup (vals[0]);
	ldap_value_free (vals);
	}

	vals = ldap_get_values (ldap_conn, si_res,
	"pgpSoftware");
	if (vals)
	{
	log_debug ("Server: \t%s\n", vals[0]);
	ldap_value_free (vals);
	}

	vals = ldap_get_values (ldap_conn, si_res,
	"pgpVersion");
	if (vals)
	{
	log_debug ("Version:\t%s\n", vals[0]);
	ldap_value_free (vals);
	}
	}

	/* From man ldap_search_s: "res parameter of
	ldap_search_ext_s() and ldap_search_s() should be
	freed with ldap_msgfree() regardless of return
	value of these functions. */
	ldap_msgfree (si_res);
	}

	ldap_value_free (context);
	}
	}
	else
	{
	/* We don't have an answer yet, which means the server might
	be an LDAP keyserver. */
	char **vals;
	LDAPMessage *si_res = NULL;

	char *attr2[] = { "pgpBaseKeySpaceDN", "version", "software", NULL };

	err = ldap_search_s (ldap_conn, "cn=pgpServerInfo", LDAP_SCOPE_BASE,
	"(objectClass=*)", attr2, 0, &si_res);
	if (err == LDAP_SUCCESS)
	{
	/* For the LDAP keyserver, this is always
	"OU=ACTIVE,O=PGP KEYSPACE,C=US", but it might not be
	in the future. */

	vals = ldap_get_values (ldap_conn, si_res, "baseKeySpaceDN");
	if (vals)
	{
	basedn = xtrystrdup (vals[0]);
	ldap_value_free (vals);
	}

	vals = ldap_get_values (ldap_conn, si_res, "software");
	if (vals)
	{
	log_debug ("ldap: Server: \t%s\n", vals[0]);
	ldap_value_free (vals);
	}

	vals = ldap_get_values (ldap_conn, si_res, "version");
	if (vals)
	{
	log_debug ("ldap: Version:\t%s\n", vals[0]);

	/* If the version is high enough, use the new
	pgpKeyV2 attribute. This design is iffy at best,
	but it matches how PGP does it. I figure the NAI
	folks assumed that there would never be an LDAP
	keyserver vendor with a different numbering
	scheme. */
	if (atoi (vals[0]) > 1)
	pgpkeyattr = "pgpKeyV2";

	ldap_value_free (vals);
	}
	}

	ldap_msgfree (si_res);
	}

	/* From man ldap_search_s: "res parameter of ldap_search_ext_s()
	and ldap_search_s() should be freed with ldap_msgfree()
	regardless of return value of these functions. */
	ldap_msgfree (res);
	}

	out:
	if (! err)
	{
	log_debug ("ldap_conn: %p\n", ldap_conn);
	log_debug ("real_ldap: %d\n", real_ldap);
	log_debug ("basedn: %s\n", basedn);
	log_debug ("pgpkeyattr: %s\n", pgpkeyattr);
	}

	if (! err && real_ldapp)
	*real_ldapp = real_ldap;

	if (err)
	xfree (basedn);
	else
	{
	if (pgpkeyattrp)
	{
	if (basedn)
	*pgpkeyattrp = xstrdup (pgpkeyattr);
	else
	*pgpkeyattrp = NULL;
	}

	if (basednp)
	*basednp = basedn;
	else
	xfree (basedn);
	}

	if (err)
	{
	if (ldap_conn)
	ldap_unbind (ldap_conn);
	}
	else
	*ldap_connp = ldap_conn;

	return err;
	}

	/* Extract keys from an LDAP reply and write them out to the output
	stream OUTPUT in a format GnuPG can import (either the OpenPGP
	binary format or armored format). */
	static void
	extract_keys (estream_t output,
	LDAP ldap_conn, const char certid, LDAPMessage *message)
	{
	char **vals;

	es_fprintf (output, "INFO %s BEGIN\n", certid);
	es_fprintf (output, "pub:%s:", certid);

	/* Note: ldap_get_values returns a NULL terminates array of
	strings. */
	vals = ldap_get_values (ldap_conn, message, "pgpkeytype");
	if (vals && vals[0])
	{
	if (strcmp (vals[0], "RSA") == 0)
	es_fprintf (output, "1");
	else if (strcmp (vals[0],"DSS/DH") == 0)
	es_fprintf (output, "17");
	ldap_value_free (vals);
	}

	es_fprintf (output, ":");

	vals = ldap_get_values (ldap_conn, message, "pgpkeysize");
	if (vals && vals[0])
	{
	int v = atoi (vals[0]);
	if (v > 0)
	es_fprintf (output, "%d", v);
	ldap_value_free (vals);
	}

	es_fprintf (output, ":");

	vals = ldap_get_values (ldap_conn, message, "pgpkeycreatetime");
	if (vals && vals[0])
	{
	if (strlen (vals[0]) == 15)
	es_fprintf (output, "%u", (unsigned int) ldap2epochtime (vals[0]));
	ldap_value_free (vals);
	}

	es_fprintf (output, ":");

	vals = ldap_get_values (ldap_conn, message, "pgpkeyexpiretime");
	if (vals && vals[0])
	{
	if (strlen (vals[0]) == 15)
	es_fprintf (output, "%u", (unsigned int) ldap2epochtime (vals[0]));
	ldap_value_free (vals);
	}

	es_fprintf (output, ":");

	vals = ldap_get_values (ldap_conn, message, "pgprevoked");
	if (vals && vals[0])
	{
	if (atoi (vals[0]) == 1)
	es_fprintf (output, "r");
	ldap_value_free (vals);
	}

	es_fprintf (output, "\n");

	vals = ldap_get_values (ldap_conn, message, "pgpuserid");
	if (vals && vals[0])
	{
	int i;
	for (i = 0; vals[i]; i++)
	es_fprintf (output, "uid:%s\n", vals[i]);
	ldap_value_free (vals);
	}

	es_fprintf (output, "INFO %s END\n", certid);
	}

	/* Get the key described key the KEYSPEC string from the keyserver
	identified by URI. On success R_FP has an open stream to read the
	data. */
	gpg_error_t
	ks_ldap_get (ctrl_t ctrl, parsed_uri_t uri, const char *keyspec,
	estream_t *r_fp)
	{
	gpg_error_t err = 0;
	int ldap_err;

	char *filter = NULL;

	LDAP *ldap_conn = NULL;

	char *basedn = NULL;
	char *pgpkeyattr = NULL;

	estream_t fp = NULL;

	LDAPMessage *message = NULL;

	(void) ctrl;

	if (dirmngr_use_tor ())
	{
	/* For now we do not support LDAP over Tor. */
	log_error (_("LDAP access not possible due to Tor mode\n"));
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	}

	/* Before connecting to the server, make sure we have a sane
	keyspec. If not, there is no need to establish a network
	connection. */
	err = keyspec_to_ldap_filter (keyspec, &filter, 1);
	if (err)
	return (err);

	/* Make sure we are talking to an OpenPGP LDAP server. */
	ldap_err = my_ldap_connect (uri, &ldap_conn, &basedn, &pgpkeyattr, NULL);
	if (ldap_err \|\| !basedn)
	{
	if (ldap_err)
	err = ldap_err_to_gpg_err (ldap_err);
	else
	err = GPG_ERR_GENERAL;
	goto out;
	}

	{
	/* The ordering is significant. Specifically, "pgpcertid" needs
	to be the second item in the list, since everything after it
	may be discarded we aren't in verbose mode. */
	char *attrs[] =
	{
	pgpkeyattr,
	"pgpcertid", "pgpuserid", "pgpkeyid", "pgprevoked", "pgpdisabled",
	"pgpkeycreatetime", "modifytimestamp", "pgpkeysize", "pgpkeytype",
	NULL
	};
	/* 1 if we want just attribute types; 0 if we want both attribute
	types and values. */
	int attrsonly = 0;

	int count;

	ldap_err = ldap_search_s (ldap_conn, basedn, LDAP_SCOPE_SUBTREE,
	filter, attrs, attrsonly, &message);
	if (ldap_err)
	{
	err = ldap_err_to_gpg_err (ldap_err);

	log_error ("gpgkeys: LDAP search error: %s\n",
	ldap_err2string (ldap_err));
	goto out;
	}

	count = ldap_count_entries (ldap_conn, message);
	if (count < 1)
	{
	log_error ("gpgkeys: key %s not found on keyserver\n", keyspec);

	if (count == -1)
	err = ldap_to_gpg_err (ldap_conn);
	else
	err = gpg_error (GPG_ERR_NO_DATA);

	goto out;
	}

	{
	/* There may be more than one unique result for a given keyID,
	so we should fetch them all (test this by fetching short key
	id 0xDEADBEEF). */

	/* The set of entries that we've seen. */
	strlist_t seen = NULL;
	LDAPMessage *each;

	for (each = ldap_first_entry (ldap_conn, message);
	each;
	each = ldap_next_entry (ldap_conn, each))
	{
	char **vals;
	char **certid;

	/* Use the long keyid to remove duplicates. The LDAP
	server returns the same keyid more than once if there
	are multiple user IDs on the key. Note that this does
	NOT mean that a keyid that exists multiple times on the
	keyserver will not be fetched. It means that each KEY,
	no matter how many user IDs share its keyid, will be
	fetched only once. If a keyid that belongs to more
	than one key is fetched, the server quite properly
	responds with all matching keys. -ds */

	certid = ldap_get_values (ldap_conn, each, "pgpcertid");
	if (certid && certid[0])
	{
	if (! strlist_find (seen, certid[0]))
	{
	/* It's not a duplicate, add it */

	add_to_strlist (&seen, certid[0]);

	if (! fp)
	fp = es_fopenmem(0, "rw");

	extract_keys (fp, ldap_conn, certid[0], each);

	vals = ldap_get_values (ldap_conn, each, pgpkeyattr);
	if (! vals)
	{
	err = ldap_to_gpg_err (ldap_conn);
	log_error("gpgkeys: unable to retrieve key %s "
	"from keyserver\n", certid[0]);
	goto out;
	}
	else
	{
	/* We should strip the new lines. */
	es_fprintf (fp, "KEY 0x%s BEGIN\n", certid[0]);
	es_fputs (vals[0], fp);
	es_fprintf (fp, "\nKEY 0x%s END\n", certid[0]);

	ldap_value_free (vals);
	}
	}
	}

	ldap_value_free (certid);
	}

	free_strlist (seen);

	if (! fp)
	err = gpg_error (GPG_ERR_NO_DATA);
	}
	}

	out:
	if (message)
	ldap_msgfree (message);

	if (err)
	{
	if (fp)
	es_fclose (fp);
	}
	else
	{
	if (fp)
	es_fseek (fp, 0, SEEK_SET);

	*r_fp = fp;
	}

	xfree (pgpkeyattr);
	xfree (basedn);

	if (ldap_conn)
	ldap_unbind (ldap_conn);

	xfree (filter);

	return err;
	}

	/* Search the keyserver identified by URI for keys matching PATTERN.
	On success R_FP has an open stream to read the data. */
	gpg_error_t
	ks_ldap_search (ctrl_t ctrl, parsed_uri_t uri, const char *pattern,
	estream_t *r_fp)
	{
	gpg_error_t err;
	int ldap_err;

	char *filter = NULL;

	LDAP *ldap_conn = NULL;

	char *basedn = NULL;

	estream_t fp = NULL;

	(void) ctrl;

	if (dirmngr_use_tor ())
	{
	/* For now we do not support LDAP over Tor. */
	log_error (_("LDAP access not possible due to Tor mode\n"));
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	}

	/* Before connecting to the server, make sure we have a sane
	keyspec. If not, there is no need to establish a network
	connection. */
	err = keyspec_to_ldap_filter (pattern, &filter, 0);
	if (err)
	{
	log_error ("Bad search pattern: '%s'\n", pattern);
	return (err);
	}

	/* Make sure we are talking to an OpenPGP LDAP server. */
	ldap_err = my_ldap_connect (uri, &ldap_conn, &basedn, NULL, NULL);
	if (ldap_err \|\| !basedn)
	{
	if (ldap_err)
	err = ldap_err_to_gpg_err (ldap_err);
	else
	err = GPG_ERR_GENERAL;
	goto out;
	}

	/* Even if we have no results, we want to return a stream. */
	fp = es_fopenmem(0, "rw");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	goto out;
	}

	{
	char **vals;
	LDAPMessage res, each;
	int count = 0;
	strlist_t dupelist = NULL;

	/* The maximum size of the search, including the optional stuff
	and the trailing \0 */
	char *attrs[] =
	{
	"pgpcertid", "pgpuserid", "pgprevoked", "pgpdisabled",
	"pgpkeycreatetime", "pgpkeyexpiretime", "modifytimestamp",
	"pgpkeysize", "pgpkeytype", NULL
	};

	log_debug ("SEARCH '%s' => '%s' BEGIN\n", pattern, filter);

	ldap_err = ldap_search_s (ldap_conn, basedn,
	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &res);

	xfree (filter);
	filter = NULL;

	if (ldap_err != LDAP_SUCCESS && ldap_err != LDAP_SIZELIMIT_EXCEEDED)
	{
	err = ldap_err_to_gpg_err (ldap_err);

	log_error ("SEARCH %s FAILED %d\n", pattern, err);
	log_error ("gpgkeys: LDAP search error: %s\n",
	ldap_err2string (err));
	goto out;
	}

	/* The LDAP server doesn't return a real count of unique keys, so we
	can't use ldap_count_entries here. */
	for (each = ldap_first_entry (ldap_conn, res);
	each;
	each = ldap_next_entry (ldap_conn, each))
	{
	char **certid = ldap_get_values (ldap_conn, each, "pgpcertid");
	if (certid && certid[0] && ! strlist_find (dupelist, certid[0]))
	{
	add_to_strlist (&dupelist, certid[0]);
	count++;
	}
	}

	if (ldap_err == LDAP_SIZELIMIT_EXCEEDED)
	{
	if (count == 1)
	log_error ("gpgkeys: search results exceeded server limit."
	" First 1 result shown.\n");
	else
	log_error ("gpgkeys: search results exceeded server limit."
	" First %d results shown.\n", count);
	}

	free_strlist (dupelist);
	dupelist = NULL;

	if (count < 1)
	es_fputs ("info:1:0\n", fp);
	else
	{
	es_fprintf (fp, "info:1:%d\n", count);

	for (each = ldap_first_entry (ldap_conn, res);
	each;
	each = ldap_next_entry (ldap_conn, each))
	{
	char **certid;
	LDAPMessage *uids;

	certid = ldap_get_values (ldap_conn, each, "pgpcertid");
	if (! certid \|\| ! certid[0])
	continue;

	/* Have we seen this certid before? */
	if (! strlist_find (dupelist, certid[0]))
	{
	add_to_strlist (&dupelist, certid[0]);

	es_fprintf (fp, "pub:%s:",certid[0]);

	vals = ldap_get_values (ldap_conn, each, "pgpkeytype");
	if (vals)
	{
	/* The LDAP server doesn't exactly handle this
	well. */
	if (strcasecmp (vals[0], "RSA") == 0)
	es_fputs ("1", fp);
	else if (strcasecmp (vals[0], "DSS/DH") == 0)
	es_fputs ("17", fp);
	ldap_value_free (vals);
	}

	es_fputc (':', fp);

	vals = ldap_get_values (ldap_conn, each, "pgpkeysize");
	if (vals)
	{
	/* Not sure why, but some keys are listed with a
	key size of 0. Treat that like an unknown. */
	if (atoi (vals[0]) > 0)
	es_fprintf (fp, "%d", atoi (vals[0]));
	ldap_value_free (vals);
	}

	es_fputc (':', fp);

	/* YYYYMMDDHHmmssZ */

	vals = ldap_get_values (ldap_conn, each, "pgpkeycreatetime");
	if(vals && strlen (vals[0]) == 15)
	{
	es_fprintf (fp, "%u",
	(unsigned int) ldap2epochtime(vals[0]));
	ldap_value_free (vals);
	}

	es_fputc (':', fp);

	vals = ldap_get_values (ldap_conn, each, "pgpkeyexpiretime");
	if (vals && strlen (vals[0]) == 15)
	{
	es_fprintf (fp, "%u",
	(unsigned int) ldap2epochtime (vals[0]));
	ldap_value_free (vals);
	}

	es_fputc (':', fp);

	vals = ldap_get_values (ldap_conn, each, "pgprevoked");
	if (vals)
	{
	if (atoi (vals[0]) == 1)
	es_fprintf (fp, "r");
	ldap_value_free (vals);
	}

	vals = ldap_get_values (ldap_conn, each, "pgpdisabled");
	if (vals)
	{
	if (atoi (vals[0]) ==1)
	es_fprintf (fp, "d");
	ldap_value_free (vals);
	}

	#if 0
	/* This is not yet specified in the keyserver
	protocol, but may be someday. */
	es_fputc (':', fp);

	vals = ldap_get_values (ldap_conn, each, "modifytimestamp");
	if(vals && strlen (vals[0]) == 15)
	{
	es_fprintf (fp, "%u",
	(unsigned int) ldap2epochtime (vals[0]));
	ldap_value_free (vals);
	}
	#endif

	es_fprintf (fp, "\n");

	/* Now print all the uids that have this certid */
	for (uids = ldap_first_entry (ldap_conn, res);
	uids;
	uids = ldap_next_entry (ldap_conn, uids))
	{
	vals = ldap_get_values (ldap_conn, uids, "pgpcertid");
	if (! vals)
	continue;

	if (strcasecmp (certid[0], vals[0]) == 0)
	{
	char **uidvals;

	es_fprintf (fp, "uid:");

	uidvals = ldap_get_values (ldap_conn,
	uids, "pgpuserid");
	if (uidvals)
	{
	/* Need to escape any colons */
	char *quoted = percent_escape (uidvals[0], NULL);
	es_fputs (quoted, fp);
	xfree (quoted);
	ldap_value_free (uidvals);
	}

	es_fprintf (fp, "\n");
	}

	ldap_value_free(vals);
	}
	}

	ldap_value_free (certid);
	}
	}

	ldap_msgfree (res);
	free_strlist (dupelist);
	}

	log_debug ("SEARCH %s END\n", pattern);

	out:
	if (err)
	{
	if (fp)
	es_fclose (fp);
	}
	else
	{
	/* Return the read stream. */
	if (fp)
	es_fseek (fp, 0, SEEK_SET);

	*r_fp = fp;
	}

	xfree (basedn);

	if (ldap_conn)
	ldap_unbind (ldap_conn);

	xfree (filter);

	return err;
	}



	/* A modlist describes a set of changes to an LDAP entry. (An entry
	consists of 1 or more attributes. Attributes are <name, value>
	pairs. Note: an attribute may be multi-valued in which case
	multiple values are associated with a single name.)

	A modlist is a NULL terminated array of struct LDAPMod's.

	Thus, if we have:

	LDAPMod **modlist;

	Then:

	modlist[i]

	Is the ith modification.

	Each LDAPMod describes a change to a single attribute. Further,
	there is one modification for each attribute that we want to
	change. The attribute's new value is stored in LDAPMod.mod_values.
	If the attribute is multi-valued, we still only use a single
	LDAPMod structure: mod_values is a NULL-terminated array of
	strings. To delete an attribute from an entry, we set mod_values
	to NULL.

	Thus, if:

	modlist[i]->mod_values == NULL

	then we remove the attribute.

	(Using LDAP_MOD_DELETE doesn't work here as we don't know if the
	attribute in question exists or not.)

	Note: this function does NOT copy or free ATTR. It does copy
	VALUE. */
	static void
	modlist_add (LDAPMod **modlistp, char attr, const char *value)
	{
	LDAPMod *modlist = modlistp;

	LDAPMod **m;
	int nummods = 0;

	/* Search modlist for the attribute we're playing with. If modlist
	is NULL, then the list is empty. Recall: modlist is a NULL
	terminated array. */
	for (m = modlist; m && *m; m++, nummods ++)
	{
	/* The attribute is already on the list. */
	char **ptr;
	int numvalues = 0;

	if (strcasecmp ((*m)->mod_type, attr) != 0)
	continue;

	/* We have this attribute already, so when the REPLACE happens,
	the server attributes will be replaced anyway. */
	if (! value)
	return;

	/* Attributes can be multi-valued. See if the value is already
	present. mod_values is a NULL terminated array of pointers.
	Note: mod_values can be NULL. */
	for (ptr = (m)->mod_values; ptr && ptr; ptr++)
	{
	if (strcmp (*ptr, value) == 0)
	/* Duplicate value, we're done. */
	return;
	numvalues ++;
	}

	/* Append the value. */
	ptr = xrealloc ((m)->mod_values, sizeof (char ) * (numvalues + 2));

	(*m)->mod_values = ptr;
	ptr[numvalues] = xstrdup (value);

	ptr[numvalues + 1] = NULL;

	return;
	}

	/* We didn't find the attr, so make one and add it to the end */

	/* Like attribute values, the list of attributes is NULL terminated
	array of pointers. */
	modlist = xrealloc (modlist, sizeof (LDAPMod ) (nummods + 2));

	*modlistp = modlist;
	modlist[nummods] = xmalloc (sizeof (LDAPMod));

	modlist[nummods]->mod_op = LDAP_MOD_REPLACE;
	modlist[nummods]->mod_type = attr;
	if (value)
	{
	modlist[nummods]->mod_values = xmalloc (sizeof(char ) 2);

	modlist[nummods]->mod_values[0] = xstrdup (value);
	modlist[nummods]->mod_values[1] = NULL;
	}
	else
	modlist[nummods]->mod_values = NULL;

	modlist[nummods + 1] = NULL;

	return;
	}

	/* Look up the value of an attribute in the specified modlist. If the
	attribute is not on the mod list, returns NULL. The result is a
	NULL-terminated array of strings. Don't change it. */
	static char **
	modlist_lookup (LDAPMod *modlist, const char attr)
	{
	LDAPMod **m;
	for (m = modlist; m && *m; m++)
	{
	if (strcasecmp ((*m)->mod_type, attr) != 0)
	continue;

	return (*m)->mod_values;
	}

	return NULL;
	}

	/* Dump a modlist to a file. This is useful for debugging. */
	static estream_t modlist_dump (LDAPMod **modlist, estream_t output)
	GPGRT_ATTR_USED;

	static estream_t
	modlist_dump (LDAPMod **modlist, estream_t output)
	{
	LDAPMod **m;

	int opened = 0;

	if (! output)
	{
	output = es_fopenmem (0, "rw");
	if (!output)
	return NULL;
	opened = 1;
	}

	for (m = modlist; m && *m; m++)
	{
	es_fprintf (output, " %s:", (*m)->mod_type);

	if (! (*m)->mod_values)
	es_fprintf(output, " delete.\n");
	else
	{
	char **ptr;
	int i;

	int multi = 0;
	if ((m)->mod_values[0] && (m)->mod_values[1])
	/* Have at least 2. */
	multi = 1;

	if (multi)
	es_fprintf (output, "\n");

	for ((ptr = (m)->mod_values), (i = 1); ptr && ptr; ptr++, i ++)
	{
	/* Assuming terminals are about 80 characters wide,
	- display at most most about 10 lines of debugging
	+ display at most about 10 lines of debugging
	output. If we do trim the buffer, append '...' to
	the end. */
	const int max_len = 10 * 70;
	size_t value_len = strlen (*ptr);
	int elide = value_len > max_len;

	if (multi)
	es_fprintf (output, " %d. ", i);
	es_fprintf (output, "`%.s", max_len, ptr);
	if (elide)
	es_fprintf (output, "...' (%zd bytes elided)",
	value_len - max_len);
	else
	es_fprintf (output, "'");
	es_fprintf (output, "\n");
	}
	}
	}

	if (opened)
	es_fseek (output, 0, SEEK_SET);

	return output;
	}

	/* Free all of the memory allocated by the mod list. This assumes
	that the attribute names don't have to be freed, but the attributes
	values do. (Which is what modlist_add does.) */
	static void
	modlist_free (LDAPMod **modlist)
	{
	LDAPMod **ml;

	if (! modlist)
	return;

	/* Unwind and free the whole modlist structure */

	/* The modlist is a NULL terminated array of pointers. */
	for (ml = modlist; *ml; ml++)
	{
	LDAPMod mod = ml;
	char **ptr;

	/* The list of values is a NULL termianted array of pointers.
	If the list is NULL, there are no values. */

	if (mod->mod_values)
	{
	for (ptr = mod->mod_values; *ptr; ptr++)
	xfree (*ptr);

	xfree (mod->mod_values);
	}

	xfree (mod);
	}
	xfree (modlist);
	}

	/* Append two onto the end of one. Two is not freed, but its pointers
	are now part of one. Make sure you don't free them both!

	As long as you don't add anything to ONE, TWO is still valid.
	After that all bets are off. */
	static void
	modlists_join (LDAPMod *one, LDAPMod two)
	{
	int i, one_count = 0, two_count = 0;
	LDAPMod **grow;

	if (!*two)
	/* two is empty. Nothing to do. */
	return;

	if (!*one)
	/* one is empty. Just set it equal to two. /
	{
	*one = two;
	return;
	}

	for (grow = one; grow; grow++)
	one_count ++;

	for (grow = two; *grow; grow++)
	two_count ++;

	grow = xrealloc (one, sizeof(LDAPMod ) * (one_count + two_count + 1));

	for (i = 0; i < two_count; i++)
	grow[one_count + i] = two[i];

	grow[one_count + i] = NULL;

	*one = grow;
	}

	/* Given a string, unescape C escapes. In particular, \xXX. This
	modifies the string in place. */
	static void
	uncescape (char *str)
	{
	size_t r = 0;
	size_t w = 0;

	char *first = strchr (str, '\\');
	if (! first)
	/* No backslashes => no escaping. We're done. */
	return;

	/* Start at the first '\\'. */
	r = w = (uintptr_t) first - (uintptr_t) str;

	while (str[r])
	{
	/* XXX: What to do about bad escapes?
	XXX: hextobyte already checks the string thus the hexdigitp
	could be removed. */
	if (str[r] == '\\' && str[r + 1] == 'x'
	&& str[r+2] && str[r+3]
	&& hexdigitp (str + r + 2)
	&& hexdigitp (str + r + 3))
	{
	int x = hextobyte (&str[r + 2]);
	assert (0 <= x && x <= 0xff);

	str[w] = x;

	/* We consumed 4 characters and wrote 1. */
	r += 4;
	w ++;
	}
	else
	str[w ++] = str[r ++];
	}

	str[w] = '\0';
	}

	/* Given one line from an info block (`gpg --list-{keys,sigs}
	--with-colons KEYID'), pull it apart and fill in the modlist with
	the relevant (for the LDAP schema) attributes. */
	static void
	extract_attributes (LDAPMod **modlist, char line)
	{
	int field_count;
	char **fields;

	char *keyid;

	int is_pub, is_sub, is_uid, is_sig;

	/* Remove trailing whitespace */
	trim_trailing_spaces (line);

	fields = strsplit (line, ':', '\0', &field_count);
	if (field_count == 1)
	/* We only have a single field. There is definitely nothing to
	do. */
	goto out;

	if (field_count < 7)
	goto out;

	is_pub = strcasecmp ("pub", fields[0]) == 0;
	is_sub = strcasecmp ("sub", fields[0]) == 0;
	is_uid = strcasecmp ("uid", fields[0]) == 0;
	is_sig = strcasecmp ("sig", fields[0]) == 0;

	if (!is_pub && !is_sub && !is_uid && !is_sig)
	/* Not a relevant line. */
	goto out;

	keyid = fields[4];

	if (is_uid && strlen (keyid) == 0)
	/* The uid record type can have an empty keyid. */
	;
	else if (strlen (keyid) == 16
	&& strspn (keyid, "0123456789aAbBcCdDeEfF") == 16)
	/* Otherwise, we expect exactly 16 hex characters. */
	;
	else
	{
	log_error ("malformed record!\n");
	goto out;
	}

	if (is_pub)
	{
	int disabled = 0;
	int revoked = 0;
	char *flags;
	for (flags = fields[1]; *flags; flags ++)
	switch (*flags)
	{
	case 'r':
	case 'R':
	revoked = 1;
	break;

	case 'd':
	case 'D':
	disabled = 1;
	break;
	}

	/* Note: we always create the pgpDisabled and pgpRevoked
	attributes, regardless of whether the key is disabled/revoked
	or not. This is because a very common search is like
	"(&(pgpUserID=isabella)(pgpDisabled=0))" */

	if (is_pub)
	{
	modlist_add (modlist,"pgpDisabled", disabled ? "1" : "0");
	modlist_add (modlist,"pgpRevoked", revoked ? "1" : "0");
	}
	}

	if (is_pub \|\| is_sub)
	{
	char *size = fields[2];
	int val = atoi (size);
	size = NULL;

	if (val > 0)
	{
	/* We zero pad this on the left to make PGP happy. */
	char padded[6];
	if (val < 99999 && val > 0)
	{
	snprintf (padded, sizeof padded, "%05u", val);
	size = padded;
	}
	}

	if (size)
	{
	if (is_pub \|\| is_sub)
	modlist_add (modlist, "pgpKeySize", size);
	}
	}

	if (is_pub)
	{
	char *algo = fields[3];
	int val = atoi (algo);
	switch (val)
	{
	case 1:
	algo = "RSA";
	break;

	case 17:
	algo = "DSS/DH";
	break;

	default:
	algo = NULL;
	break;
	}

	if (algo)
	{
	if (is_pub)
	modlist_add (modlist, "pgpKeyType", algo);
	}
	}

	if (is_pub \|\| is_sub \|\| is_sig)
	{
	if (is_pub)
	{
	modlist_add (modlist, "pgpCertID", keyid);
	modlist_add (modlist, "pgpKeyID", &keyid[8]);
	}

	if (is_sub)
	modlist_add (modlist, "pgpSubKeyID", keyid);

	if (is_sig)
	modlist_add (modlist, "pgpSignerID", keyid);
	}

	if (is_pub)
	{
	char *create_time = fields[5];

	if (strlen (create_time) == 0)
	create_time = NULL;
	else
	{
	char *create_time_orig = create_time;
	struct tm tm;
	time_t t;
	char *end;

	memset (&tm, 0, sizeof (tm));

	/* parse_timestamp handles both seconds fromt he epoch and
	ISO 8601 format. We also need to handle YYYY-MM-DD
	format (as generated by gpg1 --with-colons --list-key).
	Check that first and then if it fails, then try
	parse_timestamp. */

	if (!isodate_human_to_tm (create_time, &tm))
	create_time = tm2ldaptime (&tm);
	else if ((t = parse_timestamp (create_time, &end)) != (time_t) -1
	&& *end == '\0')
	{

	if (!gnupg_gmtime (&t, &tm))
	create_time = NULL;
	else
	create_time = tm2ldaptime (&tm);
	}
	else
	create_time = NULL;

	if (! create_time)
	/* Failed to parse string. */
	log_error ("Failed to parse creation time ('%s')",
	create_time_orig);
	}

	if (create_time)
	{
	modlist_add (modlist, "pgpKeyCreateTime", create_time);
	xfree (create_time);
	}
	}

	if (is_pub)
	{
	char *expire_time = fields[6];

	if (strlen (expire_time) == 0)
	expire_time = NULL;
	else
	{
	char *expire_time_orig = expire_time;
	struct tm tm;
	time_t t;
	char *end;

	memset (&tm, 0, sizeof (tm));

	/* parse_timestamp handles both seconds fromt he epoch and
	ISO 8601 format. We also need to handle YYYY-MM-DD
	format (as generated by gpg1 --with-colons --list-key).
	Check that first and then if it fails, then try
	parse_timestamp. */

	if (!isodate_human_to_tm (expire_time, &tm))
	expire_time = tm2ldaptime (&tm);
	else if ((t = parse_timestamp (expire_time, &end)) != (time_t) -1
	&& *end == '\0')
	{
	if (!gnupg_gmtime (&t, &tm))
	expire_time = NULL;
	else
	expire_time = tm2ldaptime (&tm);
	}
	else
	expire_time = NULL;

	if (! expire_time)
	/* Failed to parse string. */
	log_error ("Failed to parse creation time ('%s')",
	expire_time_orig);
	}

	if (expire_time)
	{
	modlist_add (modlist, "pgpKeyExpireTime", expire_time);
	xfree (expire_time);
	}
	}

	if ((is_uid \|\| is_pub) && field_count >= 10)
	{
	char *uid = fields[9];

	if (is_pub && strlen (uid) == 0)
	/* When using gpg --list-keys, the uid is included. When
	passed via gpg, it is not. It is important to process it
	when it is present, because gpg 1 won't print a UID record
	if there is only one key. */
	;
	else
	{
	uncescape (uid);
	modlist_add (modlist, "pgpUserID", uid);
	}
	}

	out:
	free (fields);
	}

	/* Send the key in {KEY,KEYLEN} with the metadata {INFO,INFOLEN} to
	the keyserver identified by URI. See server.c:cmd_ks_put for the
	format of the data and metadata. */
	gpg_error_t
	ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri,
	void *data, size_t datalen,
	void *info, size_t infolen)
	{
	gpg_error_t err = 0;
	int ldap_err;

	LDAP *ldap_conn = NULL;
	char *basedn = NULL;
	char *pgpkeyattr = NULL;
	int real_ldap;

	LDAPMod **modlist = NULL;
	LDAPMod **addlist = NULL;

	char *data_armored = NULL;

	/* The last byte of the info block. */
	const char infoend = (const char ) info + infolen - 1;

	/* Enable this code to dump the modlist to /tmp/modlist.txt. */
	#if 0
	# warning Disable debug code before checking in.
	const int dump_modlist = 1;
	#else
	const int dump_modlist = 0;
	#endif
	estream_t dump = NULL;

	/* Elide a warning. */
	(void) ctrl;

	if (dirmngr_use_tor ())
	{
	/* For now we do not support LDAP over Tor. */
	log_error (_("LDAP access not possible due to Tor mode\n"));
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	}

	ldap_err = my_ldap_connect (uri,
	&ldap_conn, &basedn, &pgpkeyattr, &real_ldap);
	if (ldap_err \|\| !basedn)
	{
	if (ldap_err)
	err = ldap_err_to_gpg_err (ldap_err);
	else
	err = GPG_ERR_GENERAL;
	goto out;
	}

	if (! real_ldap)
	/* We appear to have an OpenPGP Keyserver, which can unpack the key
	on its own (not just a dumb LDAP server). */
	{
	LDAPMod mod, *attrs[2];
	char *key[] = { data, NULL };
	char *dn;

	memset (&mod, 0, sizeof (mod));
	mod.mod_op = LDAP_MOD_ADD;
	mod.mod_type = pgpkeyattr;
	mod.mod_values = key;
	attrs[0] = &mod;
	attrs[1] = NULL;

	dn = xasprintf ("pgpCertid=virtual,%s", basedn);
	ldap_err = ldap_add_s (ldap_conn, dn, attrs);
	xfree (dn);

	if (ldap_err != LDAP_SUCCESS)
	{
	err = ldap_err_to_gpg_err (err);
	goto out;
	}

	goto out;
	}

	modlist = xmalloc (sizeof (LDAPMod *));
	*modlist = NULL;

	if (dump_modlist)
	{
	dump = es_fopen("/tmp/modlist.txt", "w");
	if (! dump)
	log_error ("Failed to open /tmp/modlist.txt: %s\n",
	strerror (errno));

	if (dump)
	{
	es_fprintf(dump, "data (%zd bytes)\n", datalen);
	es_fprintf(dump, "info (%zd bytes): '\n", infolen);
	es_fwrite(info, infolen, 1, dump);
	es_fprintf(dump, "'\n");
	}
	}

	/* Start by nulling out all attributes. We try and do a modify
	operation first, so this ensures that we don't leave old
	attributes lying around. */
	modlist_add (&modlist, "pgpDisabled", NULL);
	modlist_add (&modlist, "pgpKeyID", NULL);
	modlist_add (&modlist, "pgpKeyType", NULL);
	modlist_add (&modlist, "pgpUserID", NULL);
	modlist_add (&modlist, "pgpKeyCreateTime", NULL);
	modlist_add (&modlist, "pgpSignerID", NULL);
	modlist_add (&modlist, "pgpRevoked", NULL);
	modlist_add (&modlist, "pgpSubKeyID", NULL);
	modlist_add (&modlist, "pgpKeySize", NULL);
	modlist_add (&modlist, "pgpKeyExpireTime", NULL);
	modlist_add (&modlist, "pgpCertID", NULL);

	/* Assemble the INFO stuff into LDAP attributes */

	while (infolen > 0)
	{
	char *temp = NULL;

	char *newline = memchr (info, '\n', infolen);
	if (! newline)
	/* The last line is not \n terminated! Make a copy so we can
	add a NUL terminator. */
	{
	temp = xmalloc (infolen + 1);
	memcpy (temp, info, infolen);
	info = temp;
	newline = (char *) info + infolen;
	}

	*newline = '\0';

	extract_attributes (&modlist, info);

	infolen = infolen - ((uintptr_t) newline - (uintptr_t) info + 1);
	info = newline + 1;

	/* Sanity check. */
	if (! temp)
	assert ((char *) info + infolen - 1 == infoend);
	else
	{
	assert (infolen == -1);
	xfree (temp);
	}
	}

	modlist_add (&addlist, "objectClass", "pgpKeyInfo");

	err = armor_data (&data_armored, data, datalen);
	if (err)
	goto out;

	modlist_add (&addlist, pgpkeyattr, data_armored);

	/* Now append addlist onto modlist. */
	modlists_join (&modlist, addlist);

	if (dump)
	{
	estream_t input = modlist_dump (modlist, NULL);
	if (input)
	{
	copy_stream (input, dump);
	es_fclose (input);
	}
	}

	/* Going on the assumption that modify operations are more frequent
	than adds, we try a modify first. If it's not there, we just
	turn around and send an add command for the same key. Otherwise,
	the modify brings the server copy into compliance with our copy.
	Note that unlike the LDAP keyserver (and really, any other
	keyserver) this does NOT merge signatures, but replaces the whole
	key. This should make some people very happy. */
	{
	char **certid;
	char *dn;

	certid = modlist_lookup (modlist, "pgpCertID");
	if (/* We should have a value. */
	! certid
	/* Exactly one. */
	\|\| !(certid[0] && !certid[1]))
	{
	log_error ("Bad certid.\n");
	err = GPG_ERR_GENERAL;
	goto out;
	}

	dn = xasprintf ("pgpCertID=%s,%s", certid[0], basedn);

	err = ldap_modify_s (ldap_conn, dn, modlist);
	if (err == LDAP_NO_SUCH_OBJECT)
	err = ldap_add_s (ldap_conn, dn, addlist);

	xfree (dn);

	if (err != LDAP_SUCCESS)
	{
	log_error ("gpgkeys: error adding key to keyserver: %s\n",
	ldap_err2string (err));
	err = ldap_err_to_gpg_err (err);
	}
	}

	out:
	if (dump)
	es_fclose (dump);

	if (ldap_conn)
	ldap_unbind (ldap_conn);

	xfree (basedn);
	xfree (pgpkeyattr);

	modlist_free (modlist);
	xfree (addlist);

	xfree (data_armored);

	return err;
	}
	diff --git a/dirmngr/server.c b/dirmngr/server.c
	index 961bba07d..9fa8229ef 100644
	--- a/dirmngr/server.c
	+++ b/dirmngr/server.c
	@@ -1,2802 +1,2802 @@
	/* server.c - LDAP and Keyserver access server
	* Copyright (C) 2002 Klarälvdalens Datakonsult AB
	* Copyright (C) 2003, 2004, 2005, 2007, 2008, 2009, 2011, 2015 g10 Code GmbH
	* Copyright (C) 2014, 2015, 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <stddef.h>
	#include <string.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <unistd.h>
	#include <errno.h>

	#include "dirmngr.h"
	#include <assuan.h>

	#include "crlcache.h"
	#include "crlfetch.h"
	#if USE_LDAP
	# include "ldapserver.h"
	#endif
	#include "ocsp.h"
	#include "certcache.h"
	#include "validate.h"
	#include "misc.h"
	#if USE_LDAP
	# include "ldap-wrapper.h"
	#endif
	#include "ks-action.h"
	#include "ks-engine.h" /* (ks_hkp_print_hosttable) */
	#if USE_LDAP
	# include "ldap-parse-uri.h"
	#endif
	#include "dns-stuff.h"
	#include "mbox-util.h"
	#include "zb32.h"
	#include "server-help.h"

	/* To avoid DoS attacks we limit the size of a certificate to
	something reasonable. The DoS was actually only an issue back when
	Dirmngr was a system service and not a user service. */
	#define MAX_CERT_LENGTH (16*1024)

	/* The limit for the CERTLIST inquiry. We allow for up to 20
	* certificates but also take PEM encoding into account. */
	#define MAX_CERTLIST_LENGTH ((MAX_CERT_LENGTH * 20 * 4)/3)

	/* The same goes for OpenPGP keyblocks, but here we need to allow for
	much longer blocks; a 200k keyblock is not too unusual for keys
	with a lot of signatures (e.g. 0x5b0358a2). 9C31503C6D866396 even
	has 770 KiB as of 2015-08-23. To avoid adding a runtime option we
	now use 20MiB which should really be enough. Well, a key with
	several pictures could be larger (the parser as a 18MiB limit for
	attribute packets) but it won't be nice to the keyservers to send
	them such large blobs. */
	#define MAX_KEYBLOCK_LENGTH (2010241024)


	#define PARM_ERROR(t) assuan_set_error (ctx, \
	gpg_error (GPG_ERR_ASS_PARAMETER), (t))
	#define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))



	/* Control structure per connection. */
	struct server_local_s
	{
	/* Data used to associate an Assuan context with local server data */
	assuan_context_t assuan_ctx;

	/* Per-session LDAP servers. */
	ldap_server_t ldapservers;

	/* Per-session list of keyservers. */
	uri_item_t keyservers;

	/* If this flag is set to true this dirmngr process will be
	terminated after the end of this session. */
	int stopme;

	/* State variable private to is_tor_running. */
	int tor_state;

	/* If the first both flags are set the assuan logging of data lines
	* is suppressed. The count variable is used to show the number of
	* non-logged bytes. */
	size_t inhibit_data_logging_count;
	unsigned int inhibit_data_logging : 1;
	unsigned int inhibit_data_logging_now : 1;
	};


	/* Cookie definition for assuan data line output. */
	static gpgrt_ssize_t data_line_cookie_write (void *cookie,
	const void *buffer, size_t size);
	static int data_line_cookie_close (void *cookie);
	static es_cookie_io_functions_t data_line_cookie_functions =
	{
	NULL,
	data_line_cookie_write,
	NULL,
	data_line_cookie_close
	};





	/* Accessor for the local ldapservers variable. */
	ldap_server_t
	get_ldapservers_from_ctrl (ctrl_t ctrl)
	{
	if (ctrl && ctrl->server_local)
	return ctrl->server_local->ldapservers;
	else
	return NULL;
	}

	/* Release an uri_item_t list. */
	static void
	release_uri_item_list (uri_item_t list)
	{
	while (list)
	{
	uri_item_t tmp = list->next;
	http_release_parsed_uri (list->parsed_uri);
	xfree (list);
	list = tmp;
	}
	}

	/* Release all configured keyserver info from CTRL. */
	void
	release_ctrl_keyservers (ctrl_t ctrl)
	{
	if (! ctrl->server_local)
	return;

	release_uri_item_list (ctrl->server_local->keyservers);
	ctrl->server_local->keyservers = NULL;
	}



	/* Helper to print a message while leaving a command. */
	static gpg_error_t
	leave_cmd (assuan_context_t ctx, gpg_error_t err)
	{
	if (err)
	{
	const char *name = assuan_get_command_name (ctx);
	if (!name)
	name = "?";
	if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
	log_error ("command '%s' failed: %s\n", name,
	gpg_strerror (err));
	else
	log_error ("command '%s' failed: %s <%s>\n", name,
	gpg_strerror (err), gpg_strsource (err));
	}
	return err;
	}


	/* This is a wrapper around assuan_send_data which makes debugging the
	output in verbose mode easier. */
	static gpg_error_t
	data_line_write (assuan_context_t ctx, const void *buffer_arg, size_t size)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	const char *buffer = buffer_arg;
	gpg_error_t err;

	- /* If we do not want logging, enable it it here. */
	+ /* If we do not want logging, enable it here. */
	if (ctrl && ctrl->server_local && ctrl->server_local->inhibit_data_logging)
	ctrl->server_local->inhibit_data_logging_now = 1;

	if (opt.verbose && buffer && size)
	{
	/* Ease reading of output by sending a physical line at each LF. */
	const char *p;
	size_t n, nbytes;

	nbytes = size;
	do
	{
	p = memchr (buffer, '\n', nbytes);
	n = p ? (p - buffer) + 1 : nbytes;
	err = assuan_send_data (ctx, buffer, n);
	if (err)
	{
	gpg_err_set_errno (EIO);
	goto leave;
	}
	buffer += n;
	nbytes -= n;
	if (nbytes && (err=assuan_send_data (ctx, NULL, 0))) /* Flush line. */
	{
	gpg_err_set_errno (EIO);
	goto leave;
	}
	}
	while (nbytes);
	}
	else
	{
	err = assuan_send_data (ctx, buffer, size);
	if (err)
	{
	gpg_err_set_errno (EIO); /* For use by data_line_cookie_write. */
	goto leave;
	}
	}

	leave:
	if (ctrl && ctrl->server_local && ctrl->server_local->inhibit_data_logging)
	{
	ctrl->server_local->inhibit_data_logging_now = 0;
	ctrl->server_local->inhibit_data_logging_count += size;
	}

	return err;
	}


	/* A write handler used by es_fopencookie to write assuan data
	lines. */
	static gpgrt_ssize_t
	data_line_cookie_write (void cookie, const void buffer, size_t size)
	{
	assuan_context_t ctx = cookie;

	if (data_line_write (ctx, buffer, size))
	return -1;
	return (gpgrt_ssize_t)size;
	}


	static int
	data_line_cookie_close (void *cookie)
	{
	assuan_context_t ctx = cookie;

	if (DBG_IPC)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	if (ctrl && ctrl->server_local
	&& ctrl->server_local->inhibit_data_logging
	&& ctrl->server_local->inhibit_data_logging_count)
	log_debug ("(%zu bytes sent via D lines not shown)\n",
	ctrl->server_local->inhibit_data_logging_count);
	}
	if (assuan_send_data (ctx, NULL, 0))
	{
	gpg_err_set_errno (EIO);
	return -1;
	}

	return 0;
	}


	/* Copy the % and + escaped string S into the buffer D and replace the
	escape sequences. Note, that it is sufficient to allocate the
	target string D as long as the source string S, i.e.: strlen(s)+1.
	Note further that if S contains an escaped binary Nul the resulting
	string D will contain the 0 as well as all other characters but it
	will be impossible to know whether this is the original EOS or a
	copied Nul. */
	static void
	strcpy_escaped_plus (char d, const unsigned char s)
	{
	while (*s)
	{
	if (*s == '%' && s[1] && s[2])
	{
	s++;
	*d++ = xtoi_2 ( s);
	s += 2;
	}
	else if (*s == '+')
	*d++ = ' ', s++;
	else
	d++ = s++;
	}
	*d = 0;
	}


	/* This function returns true if a Tor server is running. The sattus
	is cached for the current connection. */
	static int
	is_tor_running (ctrl_t ctrl)
	{
	/* Check whether we can connect to the proxy. */

	if (!ctrl \|\| !ctrl->server_local)
	return 0; /* Ooops. */

	if (!ctrl->server_local->tor_state)
	{
	assuan_fd_t sock;

	sock = assuan_sock_connect_byname (NULL, 0, 0, NULL, ASSUAN_SOCK_TOR);
	if (sock == ASSUAN_INVALID_FD)
	ctrl->server_local->tor_state = -1; /* Not running. */
	else
	{
	assuan_sock_close (sock);
	ctrl->server_local->tor_state = 1; /* Running. */
	}
	}
	return (ctrl->server_local->tor_state > 0);
	}


	/* Return an error if the assuan context does not belong to the owner
	of the process or to root. On error FAILTEXT is set as Assuan
	error string. */
	static gpg_error_t
	check_owner_permission (assuan_context_t ctx, const char *failtext)
	{
	#ifdef HAVE_W32_SYSTEM
	/* Under Windows the dirmngr is always run under the control of the
	user. */
	(void)ctx;
	(void)failtext;
	#else
	gpg_err_code_t ec;
	assuan_peercred_t cred;

	ec = gpg_err_code (assuan_get_peercred (ctx, &cred));
	if (!ec && cred->uid && cred->uid != getuid ())
	ec = GPG_ERR_EPERM;
	if (ec)
	return set_error (ec, failtext);
	#endif
	return 0;
	}



	/* Common code for get_cert_local and get_issuer_cert_local. */
	static ksba_cert_t
	do_get_cert_local (ctrl_t ctrl, const char name, const char command)
	{
	unsigned char *value;
	size_t valuelen;
	int rc;
	char *buf;
	ksba_cert_t cert;

	buf = name? strconcat (command, " ", name, NULL) : xtrystrdup (command);
	if (!buf)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = assuan_inquire (ctrl->server_local->assuan_ctx, buf,
	&value, &valuelen, MAX_CERT_LENGTH);
	xfree (buf);
	}
	if (rc)
	{
	log_error (_("assuan_inquire(%s) failed: %s\n"),
	command, gpg_strerror (rc));
	return NULL;
	}

	if (!valuelen)
	{
	xfree (value);
	return NULL;
	}

	rc = ksba_cert_new (&cert);
	if (!rc)
	{
	rc = ksba_cert_init_from_mem (cert, value, valuelen);
	if (rc)
	{
	ksba_cert_release (cert);
	cert = NULL;
	}
	}
	xfree (value);
	return cert;
	}



	/* Ask back to return a certificate for NAME, given as a regular gpgsm
	* certificate identifier (e.g. fingerprint or one of the other
	* methods). Alternatively, NULL may be used for NAME to return the
	* current target certificate. Either return the certificate in a
	* KSBA object or NULL if it is not available. */
	ksba_cert_t
	get_cert_local (ctrl_t ctrl, const char *name)
	{
	if (!ctrl \|\| !ctrl->server_local \|\| !ctrl->server_local->assuan_ctx)
	{
	if (opt.debug)
	log_debug ("get_cert_local called w/o context\n");
	return NULL;
	}
	return do_get_cert_local (ctrl, name, "SENDCERT");

	}


	/* Ask back to return the issuing certificate for NAME, given as a
	* regular gpgsm certificate identifier (e.g. fingerprint or one
	* of the other methods). Alternatively, NULL may be used for NAME to
	* return the current target certificate. Either return the certificate
	* in a KSBA object or NULL if it is not available. */
	ksba_cert_t
	get_issuing_cert_local (ctrl_t ctrl, const char *name)
	{
	if (!ctrl \|\| !ctrl->server_local \|\| !ctrl->server_local->assuan_ctx)
	{
	if (opt.debug)
	log_debug ("get_issuing_cert_local called w/o context\n");
	return NULL;
	}
	return do_get_cert_local (ctrl, name, "SENDISSUERCERT");
	}


	/* Ask back to return a certificate with subject NAME and a
	* subjectKeyIdentifier of KEYID. */
	ksba_cert_t
	get_cert_local_ski (ctrl_t ctrl, const char *name, ksba_sexp_t keyid)
	{
	unsigned char *value;
	size_t valuelen;
	int rc;
	char *buf;
	ksba_cert_t cert;
	char *hexkeyid;

	if (!ctrl \|\| !ctrl->server_local \|\| !ctrl->server_local->assuan_ctx)
	{
	if (opt.debug)
	log_debug ("get_cert_local_ski called w/o context\n");
	return NULL;
	}
	if (!name \|\| !keyid)
	{
	log_debug ("get_cert_local_ski called with insufficient arguments\n");
	return NULL;
	}

	hexkeyid = serial_hex (keyid);
	if (!hexkeyid)
	{
	log_debug ("serial_hex() failed\n");
	return NULL;
	}

	buf = strconcat ("SENDCERT_SKI ", hexkeyid, " /", name, NULL);
	if (!buf)
	{
	log_error ("can't allocate enough memory: %s\n", strerror (errno));
	xfree (hexkeyid);
	return NULL;
	}
	xfree (hexkeyid);

	rc = assuan_inquire (ctrl->server_local->assuan_ctx, buf,
	&value, &valuelen, MAX_CERT_LENGTH);
	xfree (buf);
	if (rc)
	{
	log_error (_("assuan_inquire(%s) failed: %s\n"), "SENDCERT_SKI",
	gpg_strerror (rc));
	return NULL;
	}

	if (!valuelen)
	{
	xfree (value);
	return NULL;
	}

	rc = ksba_cert_new (&cert);
	if (!rc)
	{
	rc = ksba_cert_init_from_mem (cert, value, valuelen);
	if (rc)
	{
	ksba_cert_release (cert);
	cert = NULL;
	}
	}
	xfree (value);
	return cert;
	}


	/* Ask the client via an inquiry to check the istrusted status of the
	certificate specified by the hexified fingerprint HEXFPR. Returns
	0 if the certificate is trusted by the client or an error code. */
	gpg_error_t
	get_istrusted_from_client (ctrl_t ctrl, const char *hexfpr)
	{
	unsigned char *value;
	size_t valuelen;
	int rc;
	char request[100];

	if (!ctrl \|\| !ctrl->server_local \|\| !ctrl->server_local->assuan_ctx
	\|\| !hexfpr)
	return gpg_error (GPG_ERR_INV_ARG);

	snprintf (request, sizeof request, "ISTRUSTED %s", hexfpr);
	rc = assuan_inquire (ctrl->server_local->assuan_ctx, request,
	&value, &valuelen, 100);
	if (rc)
	{
	log_error (_("assuan_inquire(%s) failed: %s\n"),
	request, gpg_strerror (rc));
	return rc;
	}
	/* The expected data is: "1" or "1 cruft" (not a C-string). */
	if (valuelen && *value == '1' && (valuelen == 1 \|\| spacep (value+1)))
	rc = 0;
	else
	rc = gpg_error (GPG_ERR_NOT_TRUSTED);
	xfree (value);
	return rc;
	}




	/* Ask the client to return the certificate associated with the
	current command. This is sometimes needed because the client usually
	sends us just the cert ID, assuming that the request can be
	satisfied from the cache, where the cert ID is used as key. */
	static int
	inquire_cert_and_load_crl (assuan_context_t ctx)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	unsigned char *value = NULL;
	size_t valuelen;
	ksba_cert_t cert = NULL;

	err = assuan_inquire( ctx, "SENDCERT", &value, &valuelen, 0);
	if (err)
	return err;

	/* { */
	/* FILE fp = fopen ("foo.der", "r"); /
	/* value = xmalloc (2000); */
	/* valuelen = fread (value, 1, 2000, fp); */
	/* fclose (fp); */
	/* } */

	if (!valuelen) /* No data returned; return a comprehensible error. */
	return gpg_error (GPG_ERR_MISSING_CERT);

	err = ksba_cert_new (&cert);
	if (err)
	goto leave;
	err = ksba_cert_init_from_mem (cert, value, valuelen);
	if(err)
	goto leave;
	xfree (value); value = NULL;

	err = crl_cache_reload_crl (ctrl, cert);

	leave:
	ksba_cert_release (cert);
	xfree (value);
	return err;
	}


	/* Handle OPTION commands. */
	static gpg_error_t
	option_handler (assuan_context_t ctx, const char key, const char value)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;

	if (!strcmp (key, "force-crl-refresh"))
	{
	int i = *value? atoi (value) : 0;
	ctrl->force_crl_refresh = i;
	}
	else if (!strcmp (key, "audit-events"))
	{
	int i = *value? atoi (value) : 0;
	ctrl->audit_events = i;
	}
	else if (!strcmp (key, "http-proxy"))
	{
	xfree (ctrl->http_proxy);
	if (!*value \|\| !strcmp (value, "none"))
	ctrl->http_proxy = NULL;
	else if (!(ctrl->http_proxy = xtrystrdup (value)))
	err = gpg_error_from_syserror ();
	}
	else if (!strcmp (key, "honor-keyserver-url-used"))
	{
	/* Return an error if we are running in Tor mode. */
	if (dirmngr_use_tor ())
	err = gpg_error (GPG_ERR_FORBIDDEN);
	}
	else if (!strcmp (key, "http-crl"))
	{
	int i = *value? atoi (value) : 0;
	ctrl->http_no_crl = !i;
	}
	else
	err = gpg_error (GPG_ERR_UNKNOWN_OPTION);

	return err;
	}



	static const char hlp_dns_cert[] =
	"DNS_CERT <subtype> <name>\n"
	"DNS_CERT --pka <user_id>\n"
	"DNS_CERT --dane <user_id>\n"
	"\n"
	"Return the CERT record for <name>. <subtype> is one of\n"
	" * Return the first record of any supported subtype\n"
	" PGP Return the first record of subtype PGP (3)\n"
	" IPGP Return the first record of subtype IPGP (6)\n"
	"If the content of a certificate is available (PGP) it is returned\n"
	"by data lines. Fingerprints and URLs are returned via status lines.\n"
	"In --pka mode the fingerprint and if available an URL is returned.\n"
	"In --dane mode the key is returned from RR type 61";
	static gpg_error_t
	cmd_dns_cert (assuan_context_t ctx, char *line)
	{
	/* ctrl_t ctrl = assuan_get_pointer (ctx); */
	gpg_error_t err = 0;
	int pka_mode, dane_mode;
	char *mbox = NULL;
	char *namebuf = NULL;
	char *encodedhash = NULL;
	const char *name;
	int certtype;
	char *p;
	void *key = NULL;
	size_t keylen;
	unsigned char *fpr = NULL;
	size_t fprlen;
	char *url = NULL;

	pka_mode = has_option (line, "--pka");
	dane_mode = has_option (line, "--dane");
	line = skip_options (line);

	if (pka_mode && dane_mode)
	{
	err = PARM_ERROR ("either --pka or --dane may be given");
	goto leave;
	}

	if (pka_mode \|\| dane_mode)
	; /* No need to parse here - we do this later. */
	else
	{
	p = strchr (line, ' ');
	if (!p)
	{
	err = PARM_ERROR ("missing arguments");
	goto leave;
	}
	*p++ = 0;
	if (!strcmp (line, "*"))
	certtype = DNS_CERTTYPE_ANY;
	else if (!strcmp (line, "IPGP"))
	certtype = DNS_CERTTYPE_IPGP;
	else if (!strcmp (line, "PGP"))
	certtype = DNS_CERTTYPE_PGP;
	else
	{
	err = PARM_ERROR ("unknown subtype");
	goto leave;
	}
	while (spacep (p))
	p++;
	line = p;
	if (!*line)
	{
	err = PARM_ERROR ("name missing");
	goto leave;
	}
	}

	if (pka_mode \|\| dane_mode)
	{
	char domain; / Points to mbox. */
	char hashbuf[32]; /* For SHA-1 and SHA-256. */

	/* We lowercase ascii characters but the DANE I-D does not allow
	this. FIXME: Check after the release of the RFC whether to
	change this. */
	mbox = mailbox_from_userid (line);
	if (!mbox \|\| !(domain = strchr (mbox, '@')))
	{
	err = set_error (GPG_ERR_INV_USER_ID, "no mailbox in user id");
	goto leave;
	}
	*domain++ = 0;

	if (pka_mode)
	{
	gcry_md_hash_buffer (GCRY_MD_SHA1, hashbuf, mbox, strlen (mbox));
	encodedhash = zb32_encode (hashbuf, 8*20);
	if (!encodedhash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	namebuf = strconcat (encodedhash, "._pka.", domain, NULL);
	if (!namebuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	name = namebuf;
	certtype = DNS_CERTTYPE_IPGP;
	}
	else
	{
	/* Note: The hash is truncated to 28 bytes and we lowercase
	the result only for aesthetic reasons. */
	gcry_md_hash_buffer (GCRY_MD_SHA256, hashbuf, mbox, strlen (mbox));
	encodedhash = bin2hex (hashbuf, 28, NULL);
	if (!encodedhash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	ascii_strlwr (encodedhash);
	namebuf = strconcat (encodedhash, "._openpgpkey.", domain, NULL);
	if (!namebuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	name = namebuf;
	certtype = DNS_CERTTYPE_RR61;
	}
	}
	else
	name = line;

	err = get_dns_cert (name, certtype, &key, &keylen, &fpr, &fprlen, &url);
	if (err)
	goto leave;

	if (key)
	{
	err = data_line_write (ctx, key, keylen);
	if (err)
	goto leave;
	}

	if (fpr)
	{
	char *tmpstr;

	tmpstr = bin2hex (fpr, fprlen, NULL);
	if (!tmpstr)
	err = gpg_error_from_syserror ();
	else
	{
	err = assuan_write_status (ctx, "FPR", tmpstr);
	xfree (tmpstr);
	}
	if (err)
	goto leave;
	}

	if (url)
	{
	err = assuan_write_status (ctx, "URL", url);
	if (err)
	goto leave;
	}


	leave:
	xfree (key);
	xfree (fpr);
	xfree (url);
	xfree (mbox);
	xfree (namebuf);
	xfree (encodedhash);
	return leave_cmd (ctx, err);
	}



	static const char hlp_wkd_get[] =
	"WKD_GET [--submission-address\|--policy-flags] <user_id>\n"
	"\n"
	"Return the key or other info for <user_id>\n"
	"from the Web Key Directory.";
	static gpg_error_t
	cmd_wkd_get (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	char *mbox = NULL;
	char *domainbuf = NULL;
	char domain; / Points to mbox or domainbuf. */
	char sha1buf[20];
	char *uri = NULL;
	char *encodedhash = NULL;
	int opt_submission_addr;
	int opt_policy_flags;
	int no_log = 0;
	char portstr[20] = { 0 };

	opt_submission_addr = has_option (line, "--submission-address");
	opt_policy_flags = has_option (line, "--policy-flags");
	line = skip_options (line);

	mbox = mailbox_from_userid (line);
	if (!mbox \|\| !(domain = strchr (mbox, '@')))
	{
	err = set_error (GPG_ERR_INV_USER_ID, "no mailbox in user id");
	goto leave;
	}
	*domain++ = 0;

	/* Check for SRV records. */
	if (1)
	{
	struct srventry *srvs;
	unsigned int srvscount;
	size_t domainlen, targetlen;
	int i;

	err = get_dns_srv (domain, "openpgpkey", NULL, &srvs, &srvscount);
	if (err)
	goto leave;

	/* Find the first target which also ends in DOMAIN or is equal
	* to DOMAIN. */
	domainlen = strlen (domain);
	for (i = 0; i < srvscount; i++)
	{
	log_debug ("srv: trying '%s:%hu'\n", srvs[i].target, srvs[i].port);
	targetlen = strlen (srvs[i].target);
	if ((targetlen > domainlen + 1
	&& srvs[i].target[targetlen - domainlen - 1] == '.'
	&& !ascii_strcasecmp (srvs[i].target + targetlen - domainlen,
	domain))
	\|\| (targetlen == domainlen
	&& !ascii_strcasecmp (srvs[i].target, domain)))
	{
	/* found. */
	domainbuf = xtrystrdup (srvs[i].target);
	if (!domainbuf)
	{
	err = gpg_error_from_syserror ();
	xfree (srvs);
	goto leave;
	}
	domain = domainbuf;
	if (srvs[i].port)
	snprintf (portstr, sizeof portstr, ":%hu", srvs[i].port);
	break;
	}
	}
	xfree (srvs);
	log_debug ("srv: got '%s%s'\n", domain, portstr);
	}

	gcry_md_hash_buffer (GCRY_MD_SHA1, sha1buf, mbox, strlen (mbox));
	encodedhash = zb32_encode (sha1buf, 8*20);
	if (!encodedhash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if (opt_submission_addr)
	{
	uri = strconcat ("https://",
	domain,
	portstr,
	"/.well-known/openpgpkey/submission-address",
	NULL);
	}
	else if (opt_policy_flags)
	{
	uri = strconcat ("https://",
	domain,
	portstr,
	"/.well-known/openpgpkey/policy",
	NULL);
	}
	else
	{
	uri = strconcat ("https://",
	domain,
	portstr,
	"/.well-known/openpgpkey/hu/",
	encodedhash,
	NULL);
	no_log = 1;
	}
	if (!uri)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Setup an output stream and perform the get. */
	{
	estream_t outfp;

	outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
	if (!outfp)
	err = set_error (GPG_ERR_ASS_GENERAL,
	"error setting up a data stream");
	else
	{
	if (no_log)
	ctrl->server_local->inhibit_data_logging = 1;
	ctrl->server_local->inhibit_data_logging_now = 0;
	ctrl->server_local->inhibit_data_logging_count = 0;
	err = ks_action_fetch (ctrl, uri, outfp);
	es_fclose (outfp);
	ctrl->server_local->inhibit_data_logging = 0;
	}
	}

	leave:
	xfree (uri);
	xfree (encodedhash);
	xfree (mbox);
	xfree (domainbuf);
	return leave_cmd (ctx, err);
	}



	static const char hlp_ldapserver[] =
	"LDAPSERVER <data>\n"
	"\n"
	"Add a new LDAP server to the list of configured LDAP servers.\n"
	"DATA is in the same format as expected in the configure file.";
	static gpg_error_t
	cmd_ldapserver (assuan_context_t ctx, char *line)
	{
	#if USE_LDAP
	ctrl_t ctrl = assuan_get_pointer (ctx);
	ldap_server_t server;
	ldap_server_t *last_next_p;

	while (spacep (line))
	line++;
	if (*line == '\0')
	return leave_cmd (ctx, PARM_ERROR (_("ldapserver missing")));

	server = ldapserver_parse_one (line, "", 0);
	if (! server)
	return leave_cmd (ctx, gpg_error (GPG_ERR_INV_ARG));

	last_next_p = &ctrl->server_local->ldapservers;
	while (*last_next_p)
	last_next_p = &(*last_next_p)->next;
	*last_next_p = server;
	return leave_cmd (ctx, 0);
	#else
	(void)line;
	return leave_cmd (ctx, gpg_error (GPG_ERR_NOT_IMPLEMENTED));
	#endif
	}


	static const char hlp_isvalid[] =
	"ISVALID [--only-ocsp] [--force-default-responder]"
	" <certificate_id>\|<certificate_fpr>\n"
	"\n"
	"This command checks whether the certificate identified by the\n"
	"certificate_id is valid. This is done by consulting CRLs or\n"
	"whatever has been configured. Note, that the returned error codes\n"
	"are from gpg-error.h. The command may callback using the inquire\n"
	"function. See the manual for details.\n"
	"\n"
	"The CERTIFICATE_ID is a hex encoded string consisting of two parts,\n"
	"delimited by a single dot. The first part is the SHA-1 hash of the\n"
	"issuer name and the second part the serial number.\n"
	"\n"
	"Alternatively the certificate's fingerprint may be given in which\n"
	"case an OCSP request is done before consulting the CRL.\n"
	"\n"
	"If the option --only-ocsp is given, no fallback to a CRL check will\n"
	"be used.\n"
	"\n"
	"If the option --force-default-responder is given, only the default\n"
	"OCSP responder will be used and any other methods of obtaining an\n"
	"OCSP responder URL won't be used.";
	static gpg_error_t
	cmd_isvalid (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	char issuerhash, serialno;
	gpg_error_t err;
	int did_inquire = 0;
	int ocsp_mode = 0;
	int only_ocsp;
	int force_default_responder;

	only_ocsp = has_option (line, "--only-ocsp");
	force_default_responder = has_option (line, "--force-default-responder");
	line = skip_options (line);

	issuerhash = xstrdup (line); /* We need to work on a copy of the
	line because that same Assuan
	context may be used for an inquiry.
	That is because Assuan reuses its
	line buffer.
	*/

	serialno = strchr (issuerhash, '.');
	if (serialno)
	*serialno++ = 0;
	else
	{
	char *endp = strchr (issuerhash, ' ');
	if (endp)
	*endp = 0;
	if (strlen (issuerhash) != 40)
	{
	xfree (issuerhash);
	return leave_cmd (ctx, PARM_ERROR (_("serialno missing in cert ID")));
	}
	ocsp_mode = 1;
	}


	again:
	if (ocsp_mode)
	{
	/* Note, that we ignore the given issuer hash and instead rely
	on the current certificate semantics used with this
	command. */
	if (!opt.allow_ocsp)
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	else
	err = ocsp_isvalid (ctrl, NULL, NULL, force_default_responder);
	/* Fixme: If we got no ocsp response and --only-ocsp is not used
	we should fall back to CRL mode. Thus we need to clear
	OCSP_MODE, get the issuerhash and the serialno from the
	current certificate and jump to again. */
	}
	else if (only_ocsp)
	err = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	else
	{
	switch (crl_cache_isvalid (ctrl,
	issuerhash, serialno,
	ctrl->force_crl_refresh))
	{
	case CRL_CACHE_VALID:
	err = 0;
	break;
	case CRL_CACHE_INVALID:
	err = gpg_error (GPG_ERR_CERT_REVOKED);
	break;
	case CRL_CACHE_DONTKNOW:
	if (did_inquire)
	err = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	else if (!(err = inquire_cert_and_load_crl (ctx)))
	{
	did_inquire = 1;
	goto again;
	}
	break;
	case CRL_CACHE_CANTUSE:
	err = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	break;
	default:
	log_fatal ("crl_cache_isvalid returned invalid code\n");
	}
	}

	xfree (issuerhash);
	return leave_cmd (ctx, err);
	}


	/* If the line contains a SHA-1 fingerprint as the first argument,
	return the FPR vuffer on success. The function checks that the
	fingerprint consists of valid characters and prints and error
	message if it does not and returns NULL. Fingerprints are
	considered optional and thus no explicit error is returned. NULL is
	also returned if there is no fingerprint at all available.
	FPR must be a caller provided buffer of at least 20 bytes.

	Note that colons within the fingerprint are allowed to separate 2
	hex digits; this allows for easier cutting and pasting using the
	usual fingerprint rendering.
	*/
	static unsigned char *
	get_fingerprint_from_line (const char line, unsigned char fpr)
	{
	const char *s;
	int i;

	for (s=line, i=0; s && s != ' '; s++ )
	{
	if ( hexdigitp (s) && hexdigitp (s+1) )
	{
	if ( i >= 20 )
	return NULL; /* Fingerprint too long. */
	fpr[i++] = xtoi_2 (s);
	s++;
	}
	else if ( *s != ':' )
	return NULL; /* Invalid. */
	}
	if ( i != 20 )
	return NULL; /* Fingerprint to short. */
	return fpr;
	}



	static const char hlp_checkcrl[] =
	"CHECKCRL [<fingerprint>]\n"
	"\n"
	"Check whether the certificate with FINGERPRINT (SHA-1 hash of the\n"
	"entire X.509 certificate blob) is valid or not by consulting the\n"
	"CRL responsible for this certificate. If the fingerprint has not\n"
	"been given or the certificate is not known, the function \n"
	"inquires the certificate using an\n"
	"\n"
	" INQUIRE TARGETCERT\n"
	"\n"
	"and the caller is expected to return the certificate for the\n"
	"request (which should match FINGERPRINT) as a binary blob.\n"
	"Processing then takes place without further interaction; in\n"
	"particular dirmngr tries to locate other required certificate by\n"
	"its own mechanism which includes a local certificate store as well\n"
	"as a list of trusted root certificates.\n"
	"\n"
	"The return value is the usual gpg-error code or 0 for ducesss;\n"
	"i.e. the certificate validity has been confirmed by a valid CRL.";
	static gpg_error_t
	cmd_checkcrl (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	unsigned char fprbuffer[20], *fpr;
	ksba_cert_t cert;

	fpr = get_fingerprint_from_line (line, fprbuffer);
	cert = fpr? get_cert_byfpr (fpr) : NULL;

	if (!cert)
	{
	/* We do not have this certificate yet or the fingerprint has
	not been given. Inquire it from the client. */
	unsigned char *value = NULL;
	size_t valuelen;

	err = assuan_inquire (ctrl->server_local->assuan_ctx, "TARGETCERT",
	&value, &valuelen, MAX_CERT_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (!valuelen) /* No data returned; return a comprehensible error. */
	err = gpg_error (GPG_ERR_MISSING_CERT);
	else
	{
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_init_from_mem (cert, value, valuelen);
	}
	xfree (value);
	if(err)
	goto leave;
	}

	assert (cert);

	err = crl_cache_cert_isvalid (ctrl, cert, ctrl->force_crl_refresh);
	if (gpg_err_code (err) == GPG_ERR_NO_CRL_KNOWN)
	{
	err = crl_cache_reload_crl (ctrl, cert);
	if (!err)
	err = crl_cache_cert_isvalid (ctrl, cert, 0);
	}

	leave:
	ksba_cert_release (cert);
	return leave_cmd (ctx, err);
	}


	static const char hlp_checkocsp[] =
	"CHECKOCSP [--force-default-responder] [<fingerprint>]\n"
	"\n"
	"Check whether the certificate with FINGERPRINT (SHA-1 hash of the\n"
	"entire X.509 certificate blob) is valid or not by asking an OCSP\n"
	"responder responsible for this certificate. The optional\n"
	"fingerprint may be used for a quick check in case an OCSP check has\n"
	"been done for this certificate recently (we always cache OCSP\n"
	"responses for a couple of minutes). If the fingerprint has not been\n"
	"given or there is no cached result, the function inquires the\n"
	"certificate using an\n"
	"\n"
	" INQUIRE TARGETCERT\n"
	"\n"
	"and the caller is expected to return the certificate for the\n"
	"request (which should match FINGERPRINT) as a binary blob.\n"
	"Processing then takes place without further interaction; in\n"
	"particular dirmngr tries to locate other required certificates by\n"
	"its own mechanism which includes a local certificate store as well\n"
	"as a list of trusted root certificates.\n"
	"\n"
	"If the option --force-default-responder is given, only the default\n"
	"OCSP responder will be used and any other methods of obtaining an\n"
	"OCSP responder URL won't be used.\n"
	"\n"
	"The return value is the usual gpg-error code or 0 for ducesss;\n"
	"i.e. the certificate validity has been confirmed by a valid CRL.";
	static gpg_error_t
	cmd_checkocsp (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	unsigned char fprbuffer[20], *fpr;
	ksba_cert_t cert;
	int force_default_responder;

	force_default_responder = has_option (line, "--force-default-responder");
	line = skip_options (line);

	fpr = get_fingerprint_from_line (line, fprbuffer);
	cert = fpr? get_cert_byfpr (fpr) : NULL;

	if (!cert)
	{
	/* We do not have this certificate yet or the fingerprint has
	not been given. Inquire it from the client. */
	unsigned char *value = NULL;
	size_t valuelen;

	err = assuan_inquire (ctrl->server_local->assuan_ctx, "TARGETCERT",
	&value, &valuelen, MAX_CERT_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (!valuelen) /* No data returned; return a comprehensible error. */
	err = gpg_error (GPG_ERR_MISSING_CERT);
	else
	{
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_init_from_mem (cert, value, valuelen);
	}
	xfree (value);
	if(err)
	goto leave;
	}

	assert (cert);

	if (!opt.allow_ocsp)
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	else
	err = ocsp_isvalid (ctrl, cert, NULL, force_default_responder);

	leave:
	ksba_cert_release (cert);
	return leave_cmd (ctx, err);
	}



	static int
	lookup_cert_by_url (assuan_context_t ctx, const char *url)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	unsigned char *value = NULL;
	size_t valuelen;

	/* Fetch single certificate given it's URL. */
	err = fetch_cert_by_url (ctrl, url, &value, &valuelen);
	if (err)
	{
	log_error (_("fetch_cert_by_url failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	/* Send the data, flush the buffer and then send an END. */
	err = assuan_send_data (ctx, value, valuelen);
	if (!err)
	err = assuan_send_data (ctx, NULL, 0);
	if (!err)
	err = assuan_write_line (ctx, "END");
	if (err)
	{
	log_error (_("error sending data: %s\n"), gpg_strerror (err));
	goto leave;
	}

	leave:

	return err;
	}


	/* Send the certificate, flush the buffer and then send an END. */
	static gpg_error_t
	return_one_cert (void *opaque, ksba_cert_t cert)
	{
	assuan_context_t ctx = opaque;
	gpg_error_t err;
	const unsigned char *der;
	size_t derlen;

	der = ksba_cert_get_image (cert, &derlen);
	if (!der)
	err = gpg_error (GPG_ERR_INV_CERT_OBJ);
	else
	{
	err = assuan_send_data (ctx, der, derlen);
	if (!err)
	err = assuan_send_data (ctx, NULL, 0);
	if (!err)
	err = assuan_write_line (ctx, "END");
	}
	if (err)
	log_error (_("error sending data: %s\n"), gpg_strerror (err));
	return err;
	}


	/* Lookup certificates from the internal cache or using the ldap
	servers. */
	static int
	lookup_cert_by_pattern (assuan_context_t ctx, char *line,
	int single, int cache_only)
	{
	gpg_error_t err = 0;
	char *p;
	strlist_t sl, list = NULL;
	int truncated = 0, truncation_forced = 0;
	int count = 0;
	int local_count = 0;
	#if USE_LDAP
	ctrl_t ctrl = assuan_get_pointer (ctx);
	unsigned char *value = NULL;
	size_t valuelen;
	struct ldapserver_iter ldapserver_iter;
	cert_fetch_context_t fetch_context;
	#endif /USE_LDAP/
	int any_no_data = 0;

	/* Break the line down into an STRLIST */
	for (p=line; *p; line = p)
	{
	while (p && p != ' ')
	p++;
	if (*p)
	*p++ = 0;

	if (*line)
	{
	sl = xtrymalloc (sizeof *sl + strlen (line));
	if (!sl)
	{
	err = gpg_error_from_errno (errno);
	goto leave;
	}
	memset (sl, 0, sizeof *sl);
	strcpy_escaped_plus (sl->d, line);
	sl->next = list;
	list = sl;
	}
	}

	/* First look through the internal cache. The certifcates returned
	here are not counted towards the truncation limit. */
	if (single && !cache_only)
	; /* Do not read from the local cache in this case. */
	else
	{
	for (sl=list; sl; sl = sl->next)
	{
	err = get_certs_bypattern (sl->d, return_one_cert, ctx);
	if (!err)
	local_count++;
	if (!err && single)
	goto ready;

	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	{
	err = 0;
	if (cache_only)
	any_no_data = 1;
	}
	else if (gpg_err_code (err) == GPG_ERR_INV_NAME && !cache_only)
	{
	/* No real fault because the internal pattern lookup
	can't yet cope with all types of pattern. */
	err = 0;
	}
	if (err)
	goto ready;
	}
	}

	/* Loop over all configured servers unless we want only the
	certificates from the cache. */
	#if USE_LDAP
	for (ldapserver_iter_begin (&ldapserver_iter, ctrl);
	!cache_only && !ldapserver_iter_end_p (&ldapserver_iter)
	&& ldapserver_iter.server->host && !truncation_forced;
	ldapserver_iter_next (&ldapserver_iter))
	{
	ldap_server_t ldapserver = ldapserver_iter.server;

	if (DBG_LOOKUP)
	log_debug ("cmd_lookup: trying %s:%d base=%s\n",
	ldapserver->host, ldapserver->port,
	ldapserver->base?ldapserver->base : "[default]");

	/* Fetch certificates matching pattern */
	err = start_cert_fetch (ctrl, &fetch_context, list, ldapserver);
	if ( gpg_err_code (err) == GPG_ERR_NO_DATA )
	{
	if (DBG_LOOKUP)
	log_debug ("cmd_lookup: no data\n");
	err = 0;
	any_no_data = 1;
	continue;
	}
	if (err)
	{
	log_error (_("start_cert_fetch failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	/* Fetch the certificates for this query. */
	while (!truncation_forced)
	{
	xfree (value); value = NULL;
	err = fetch_next_cert (fetch_context, &value, &valuelen);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA )
	{
	err = 0;
	any_no_data = 1;
	break; /* Ready. */
	}
	if (gpg_err_code (err) == GPG_ERR_TRUNCATED)
	{
	truncated = 1;
	err = 0;
	break; /* Ready. */
	}
	if (gpg_err_code (err) == GPG_ERR_EOF)
	{
	err = 0;
	break; /* Ready. */
	}
	if (!err && !value)
	{
	err = gpg_error (GPG_ERR_BUG);
	goto leave;
	}
	if (err)
	{
	log_error (_("fetch_next_cert failed: %s\n"),
	gpg_strerror (err));
	end_cert_fetch (fetch_context);
	goto leave;
	}

	if (DBG_LOOKUP)
	log_debug ("cmd_lookup: returning one cert%s\n",
	truncated? " (truncated)":"");

	/* Send the data, flush the buffer and then send an END line
	as a certificate delimiter. */
	err = assuan_send_data (ctx, value, valuelen);
	if (!err)
	err = assuan_send_data (ctx, NULL, 0);
	if (!err)
	err = assuan_write_line (ctx, "END");
	if (err)
	{
	log_error (_("error sending data: %s\n"), gpg_strerror (err));
	end_cert_fetch (fetch_context);
	goto leave;
	}

	if (++count >= opt.max_replies )
	{
	truncation_forced = 1;
	log_info (_("max_replies %d exceeded\n"), opt.max_replies );
	}
	if (single)
	break;
	}

	end_cert_fetch (fetch_context);
	}
	#endif /USE_LDAP/

	ready:
	if (truncated \|\| truncation_forced)
	{
	char str[50];

	sprintf (str, "%d", count);
	assuan_write_status (ctx, "TRUNCATED", str);
	}

	if (!err && !count && !local_count && any_no_data)
	err = gpg_error (GPG_ERR_NO_DATA);

	leave:
	free_strlist (list);
	return err;
	}


	static const char hlp_lookup[] =
	"LOOKUP [--url] [--single] [--cache-only] <pattern>\n"
	"\n"
	"Lookup certificates matching PATTERN. With --url the pattern is\n"
	"expected to be one URL.\n"
	"\n"
	"If --url is not given: To allow for multiple patterns (which are ORed)\n"
	"quoting is required: Spaces are translated to \"+\" or \"%20\";\n"
	"obviously this requires that the usual escape quoting rules are applied.\n"
	"\n"
	"If --url is given no special escaping is required because URLs are\n"
	"already escaped this way.\n"
	"\n"
	"If --single is given the first and only the first match will be\n"
	"returned. If --cache-only is _not_ given, no local query will be\n"
	"done.\n"
	"\n"
	"If --cache-only is given no external lookup is done so that only\n"
	"certificates from the cache may get returned.";
	static gpg_error_t
	cmd_lookup (assuan_context_t ctx, char *line)
	{
	gpg_error_t err;
	int lookup_url, single, cache_only;

	lookup_url = has_leading_option (line, "--url");
	single = has_leading_option (line, "--single");
	cache_only = has_leading_option (line, "--cache-only");
	line = skip_options (line);

	if (lookup_url && cache_only)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	else if (lookup_url && single)
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	else if (lookup_url)
	err = lookup_cert_by_url (ctx, line);
	else
	err = lookup_cert_by_pattern (ctx, line, single, cache_only);

	return leave_cmd (ctx, err);
	}


	static const char hlp_loadcrl[] =
	"LOADCRL [--url] <filename\|url>\n"
	"\n"
	"Load the CRL in the file with name FILENAME into our cache. Note\n"
	"that FILENAME should be given with an absolute path because\n"
	"Dirmngrs cwd is not known. With --url the CRL is directly loaded\n"
	"from the given URL.\n"
	"\n"
	"This command is usually used by gpgsm using the invocation \"gpgsm\n"
	"--call-dirmngr loadcrl <filename>\". A direct invocation of Dirmngr\n"
	"is not useful because gpgsm might need to callback gpgsm to ask for\n"
	"the CA's certificate.";
	static gpg_error_t
	cmd_loadcrl (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	int use_url = has_leading_option (line, "--url");

	line = skip_options (line);

	if (use_url)
	{
	ksba_reader_t reader;

	err = crl_fetch (ctrl, line, &reader);
	if (err)
	log_error (_("fetching CRL from '%s' failed: %s\n"),
	line, gpg_strerror (err));
	else
	{
	err = crl_cache_insert (ctrl, line, reader);
	if (err)
	log_error (_("processing CRL from '%s' failed: %s\n"),
	line, gpg_strerror (err));
	crl_close_reader (reader);
	}
	}
	else
	{
	char *buf;

	buf = xtrymalloc (strlen (line)+1);
	if (!buf)
	err = gpg_error_from_syserror ();
	else
	{
	strcpy_escaped_plus (buf, line);
	err = crl_cache_load (ctrl, buf);
	xfree (buf);
	}
	}

	return leave_cmd (ctx, err);
	}


	static const char hlp_listcrls[] =
	"LISTCRLS\n"
	"\n"
	"List the content of all CRLs in a readable format. This command is\n"
	"usually used by gpgsm using the invocation \"gpgsm --call-dirmngr\n"
	"listcrls\". It may also be used directly using \"dirmngr\n"
	"--list-crls\".";
	static gpg_error_t
	cmd_listcrls (assuan_context_t ctx, char *line)
	{
	gpg_error_t err;
	estream_t fp;

	(void)line;

	fp = es_fopencookie (ctx, "w", data_line_cookie_functions);
	if (!fp)
	err = set_error (GPG_ERR_ASS_GENERAL, "error setting up a data stream");
	else
	{
	err = crl_cache_list (fp);
	es_fclose (fp);
	}
	return leave_cmd (ctx, err);
	}


	static const char hlp_cachecert[] =
	"CACHECERT\n"
	"\n"
	"Put a certificate into the internal cache. This command might be\n"
	"useful if a client knows in advance certificates required for a\n"
	"test and wants to make sure they get added to the internal cache.\n"
	"It is also helpful for debugging. To get the actual certificate,\n"
	"this command immediately inquires it using\n"
	"\n"
	" INQUIRE TARGETCERT\n"
	"\n"
	"and the caller is expected to return the certificate for the\n"
	"request as a binary blob.";
	static gpg_error_t
	cmd_cachecert (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	ksba_cert_t cert = NULL;
	unsigned char *value = NULL;
	size_t valuelen;

	(void)line;

	err = assuan_inquire (ctrl->server_local->assuan_ctx, "TARGETCERT",
	&value, &valuelen, MAX_CERT_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (!valuelen) /* No data returned; return a comprehensible error. */
	err = gpg_error (GPG_ERR_MISSING_CERT);
	else
	{
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_init_from_mem (cert, value, valuelen);
	}
	xfree (value);
	if(err)
	goto leave;

	err = cache_cert (cert);

	leave:
	ksba_cert_release (cert);
	return leave_cmd (ctx, err);
	}


	static const char hlp_validate[] =
	"VALIDATE [--systrust] [--tls] [--no-crl]\n"
	"\n"
	"Validate a certificate using the certificate validation function\n"
	"used internally by dirmngr. This command is only useful for\n"
	"debugging. To get the actual certificate, this command immediately\n"
	"inquires it using\n"
	"\n"
	" INQUIRE TARGETCERT\n"
	"\n"
	"and the caller is expected to return the certificate for the\n"
	"request as a binary blob. The option --tls modifies this by asking\n"
	"for list of certificates with\n"
	"\n"
	" INQUIRE CERTLIST\n"
	"\n"
	"Here the first certificate is the target certificate, the remaining\n"
	"certificates are suggested intermediary certificates. All certifciates\n"
	"need to be PEM encoded.\n"
	"\n"
	"The option --systrust changes the behaviour to include the system\n"
	"provided root certificates as trust anchors. The option --no-crl\n"
	"skips CRL checks";
	static gpg_error_t
	cmd_validate (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	ksba_cert_t cert = NULL;
	certlist_t certlist = NULL;
	unsigned char *value = NULL;
	size_t valuelen;
	int systrust_mode, tls_mode, no_crl;

	systrust_mode = has_option (line, "--systrust");
	tls_mode = has_option (line, "--tls");
	no_crl = has_option (line, "--no-crl");
	line = skip_options (line);

	if (tls_mode)
	err = assuan_inquire (ctrl->server_local->assuan_ctx, "CERTLIST",
	&value, &valuelen, MAX_CERTLIST_LENGTH);
	else
	err = assuan_inquire (ctrl->server_local->assuan_ctx, "TARGETCERT",
	&value, &valuelen, MAX_CERT_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (!valuelen) /* No data returned; return a comprehensible error. */
	err = gpg_error (GPG_ERR_MISSING_CERT);
	else if (tls_mode)
	{
	estream_t fp;

	fp = es_fopenmem_init (0, "rb", value, valuelen);
	if (!fp)
	err = gpg_error_from_syserror ();
	else
	{
	err = read_certlist_from_stream (&certlist, fp);
	es_fclose (fp);
	if (!err && !certlist)
	err = gpg_error (GPG_ERR_MISSING_CERT);
	if (!err)
	{
	/* Extraxt the first certificate from the list. */
	cert = certlist->cert;
	ksba_cert_ref (cert);
	}
	}
	}
	else
	{
	err = ksba_cert_new (&cert);
	if (!err)
	err = ksba_cert_init_from_mem (cert, value, valuelen);
	}
	xfree (value);
	if(err)
	goto leave;

	if (!tls_mode)
	{
	/* If we have this certificate already in our cache, use the
	* cached version for validation because this will take care of
	* any cached results. We don't need to do this in tls mode
	* because this has already been done for certificate in a
	* certlist_t. */
	unsigned char fpr[20];
	ksba_cert_t tmpcert;

	cert_compute_fpr (cert, fpr);
	tmpcert = get_cert_byfpr (fpr);
	if (tmpcert)
	{
	ksba_cert_release (cert);
	cert = tmpcert;
	}
	}

	/* Quick hack to make verification work by inserting the supplied
	* certs into the cache. */
	if (tls_mode && certlist)
	{
	certlist_t cl;

	for (cl = certlist->next; cl; cl = cl->next)
	cache_cert (cl->cert);
	}

	err = validate_cert_chain (ctrl, cert, NULL,
	(VALIDATE_FLAG_TRUST_CONFIG
	\| (tls_mode ? VALIDATE_FLAG_TLS : 0)
	\| (systrust_mode ? VALIDATE_FLAG_TRUST_SYSTEM : 0)
	\| (no_crl ? VALIDATE_FLAG_NOCRLCHECK : 0)),
	NULL);

	leave:
	ksba_cert_release (cert);
	release_certlist (certlist);
	return leave_cmd (ctx, err);
	}



	/* Parse an keyserver URI and store it in a new uri item which is
	returned at R_ITEM. On error return an error code. */
	static gpg_error_t
	make_keyserver_item (const char uri, uri_item_t r_item)
	{
	gpg_error_t err;
	uri_item_t item;

	*r_item = NULL;
	item = xtrymalloc (sizeof *item + strlen (uri));
	if (!item)
	return gpg_error_from_syserror ();

	item->next = NULL;
	item->parsed_uri = NULL;
	strcpy (item->uri, uri);

	#if USE_LDAP
	if (ldap_uri_p (item->uri))
	err = ldap_parse_uri (&item->parsed_uri, uri);
	else
	#endif
	{
	err = http_parse_uri (&item->parsed_uri, uri, 1);
	}

	if (err)
	xfree (item);
	else
	*r_item = item;
	return err;
	}


	/* If no keyserver is stored in CTRL but a global keyserver has been
	set, put that global keyserver into CTRL. We need use this
	function to help migrate from the old gpg based keyserver
	configuration to the new dirmngr based configuration. */
	static gpg_error_t
	ensure_keyserver (ctrl_t ctrl)
	{
	gpg_error_t err;
	uri_item_t item;
	uri_item_t onion_items = NULL;
	uri_item_t plain_items = NULL;
	uri_item_t ui;
	strlist_t sl;

	if (ctrl->server_local->keyservers)
	return 0; /* Already set for this session. */
	if (!opt.keyserver)
	{
	/* No global option set. Fall back to default: */
	return make_keyserver_item (DIRMNGR_DEFAULT_KEYSERVER,
	&ctrl->server_local->keyservers);
	}

	for (sl = opt.keyserver; sl; sl = sl->next)
	{
	err = make_keyserver_item (sl->d, &item);
	if (err)
	goto leave;
	if (item->parsed_uri->onion)
	{
	item->next = onion_items;
	onion_items = item;
	}
	else
	{
	item->next = plain_items;
	plain_items = item;
	}
	}

	/* Decide which to use. Note that the sesssion has no keyservers
	yet set. */
	if (onion_items && !onion_items->next && plain_items && !plain_items->next)
	{
	/* If there is just one onion and one plain keyserver given, we take
	only one depending on whether Tor is running or not. */
	if (is_tor_running (ctrl))
	{
	ctrl->server_local->keyservers = onion_items;
	onion_items = NULL;
	}
	else
	{
	ctrl->server_local->keyservers = plain_items;
	plain_items = NULL;
	}
	}
	else if (!is_tor_running (ctrl))
	{
	/* Tor is not running. It does not make sense to add Onion
	addresses. */
	ctrl->server_local->keyservers = plain_items;
	plain_items = NULL;
	}
	else
	{
	/* In all other cases add all keyservers. */
	ctrl->server_local->keyservers = onion_items;
	onion_items = NULL;
	for (ui = ctrl->server_local->keyservers; ui && ui->next; ui = ui->next)
	;
	if (ui)
	ui->next = plain_items;
	else
	ctrl->server_local->keyservers = plain_items;
	plain_items = NULL;
	}

	leave:
	release_uri_item_list (onion_items);
	release_uri_item_list (plain_items);

	return err;
	}


	static const char hlp_keyserver[] =
	"KEYSERVER [<options>] [<uri>\|<host>]\n"
	"Options are:\n"
	" --help\n"
	" --clear Remove all configured keyservers\n"
	" --resolve Resolve HKP host names and rotate\n"
	" --hosttable Print table of known hosts and pools\n"
	" --dead Mark <host> as dead\n"
	" --alive Mark <host> as alive\n"
	"\n"
	"If called without arguments list all configured keyserver URLs.\n"
	"If called with an URI add this as keyserver. Note that keyservers\n"
	"are configured on a per-session base. A default keyserver may already be\n"
	"present, thus the \"--clear\" option must be used to get full control.\n"
	"If \"--clear\" and an URI are used together the clear command is\n"
	"obviously executed first. A RESET command does not change the list\n"
	"of configured keyservers.";
	static gpg_error_t
	cmd_keyserver (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err = 0;
	int clear_flag, add_flag, help_flag, host_flag, resolve_flag;
	int dead_flag, alive_flag;
	uri_item_t item = NULL; /* gcc 4.4.5 is not able to detect that it
	is always initialized. */

	clear_flag = has_option (line, "--clear");
	help_flag = has_option (line, "--help");
	resolve_flag = has_option (line, "--resolve");
	host_flag = has_option (line, "--hosttable");
	dead_flag = has_option (line, "--dead");
	alive_flag = has_option (line, "--alive");
	line = skip_options (line);
	add_flag = !!*line;

	if (help_flag)
	{
	err = ks_action_help (ctrl, line);
	goto leave;
	}

	if (resolve_flag)
	{
	err = ensure_keyserver (ctrl);
	if (!err)
	err = ks_action_resolve (ctrl, ctrl->server_local->keyservers);
	if (err)
	goto leave;
	}

	if (alive_flag && dead_flag)
	{
	err = set_error (GPG_ERR_ASS_PARAMETER, "no support for zombies");
	goto leave;
	}
	if (dead_flag)
	{
	err = check_owner_permission (ctx, "no permission to use --dead");
	if (err)
	goto leave;
	}
	if (alive_flag \|\| dead_flag)
	{
	if (!*line)
	{
	err = set_error (GPG_ERR_ASS_PARAMETER, "name of host missing");
	goto leave;
	}

	err = ks_hkp_mark_host (ctrl, line, alive_flag);
	if (err)
	goto leave;
	}

	if (host_flag)
	{
	err = ks_hkp_print_hosttable (ctrl);
	if (err)
	goto leave;
	}
	if (resolve_flag \|\| host_flag \|\| alive_flag \|\| dead_flag)
	goto leave;

	if (add_flag)
	{
	err = make_keyserver_item (line, &item);
	if (err)
	goto leave;
	}
	if (clear_flag)
	release_ctrl_keyservers (ctrl);
	if (add_flag)
	{
	item->next = ctrl->server_local->keyservers;
	ctrl->server_local->keyservers = item;
	}

	if (!add_flag && !clear_flag && !help_flag)
	{
	/* List configured keyservers. However, we first add a global
	keyserver. */
	uri_item_t u;

	err = ensure_keyserver (ctrl);
	if (err)
	{
	assuan_set_error (ctx, err,
	"Bad keyserver configuration in dirmngr.conf");
	goto leave;
	}

	for (u=ctrl->server_local->keyservers; u; u = u->next)
	dirmngr_status (ctrl, "KEYSERVER", u->uri, NULL);
	}
	err = 0;

	leave:
	return leave_cmd (ctx, err);
	}



	static const char hlp_ks_search[] =
	"KS_SEARCH {<pattern>}\n"
	"\n"
	"Search the configured OpenPGP keyservers (see command KEYSERVER)\n"
	"for keys matching PATTERN";
	static gpg_error_t
	cmd_ks_search (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	strlist_t list, sl;
	char *p;
	estream_t outfp;

	/* No options for now. */
	line = skip_options (line);

	/* Break the line down into an strlist. Each pattern is
	percent-plus escaped. */
	list = NULL;
	for (p=line; *p; line = p)
	{
	while (p && p != ' ')
	p++;
	if (*p)
	*p++ = 0;
	if (*line)
	{
	sl = xtrymalloc (sizeof *sl + strlen (line));
	if (!sl)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	sl->flags = 0;
	strcpy_escaped_plus (sl->d, line);
	sl->next = list;
	list = sl;
	}
	}

	err = ensure_keyserver (ctrl);
	if (err)
	goto leave;

	/* Setup an output stream and perform the search. */
	outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
	if (!outfp)
	err = set_error (GPG_ERR_ASS_GENERAL, "error setting up a data stream");
	else
	{
	err = ks_action_search (ctrl, ctrl->server_local->keyservers,
	list, outfp);
	es_fclose (outfp);
	}

	leave:
	free_strlist (list);
	return leave_cmd (ctx, err);
	}



	static const char hlp_ks_get[] =
	"KS_GET {<pattern>}\n"
	"\n"
	"Get the keys matching PATTERN from the configured OpenPGP keyservers\n"
	"(see command KEYSERVER). Each pattern should be a keyid, a fingerprint,\n"
	"or an exact name indicated by the '=' prefix.";
	static gpg_error_t
	cmd_ks_get (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	strlist_t list, sl;
	char *p;
	estream_t outfp;

	/* No options for now. */
	line = skip_options (line);

	/* Break the line into a strlist. Each pattern is by
	definition percent-plus escaped. However we only support keyids
	and fingerprints and thus the client has no need to apply the
	escaping. */
	list = NULL;
	for (p=line; *p; line = p)
	{
	while (p && p != ' ')
	p++;
	if (*p)
	*p++ = 0;
	if (*line)
	{
	sl = xtrymalloc (sizeof *sl + strlen (line));
	if (!sl)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	sl->flags = 0;
	strcpy_escaped_plus (sl->d, line);
	sl->next = list;
	list = sl;
	}
	}

	err = ensure_keyserver (ctrl);
	if (err)
	goto leave;

	/* Setup an output stream and perform the get. */
	outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
	if (!outfp)
	err = set_error (GPG_ERR_ASS_GENERAL, "error setting up a data stream");
	else
	{
	ctrl->server_local->inhibit_data_logging = 1;
	ctrl->server_local->inhibit_data_logging_now = 0;
	ctrl->server_local->inhibit_data_logging_count = 0;
	err = ks_action_get (ctrl, ctrl->server_local->keyservers, list, outfp);
	es_fclose (outfp);
	ctrl->server_local->inhibit_data_logging = 0;
	}

	leave:
	free_strlist (list);
	return leave_cmd (ctx, err);
	}


	static const char hlp_ks_fetch[] =
	"KS_FETCH <URL>\n"
	"\n"
	"Get the key(s) from URL.";
	static gpg_error_t
	cmd_ks_fetch (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	estream_t outfp;

	/* No options for now. */
	line = skip_options (line);

	err = ensure_keyserver (ctrl); /* FIXME: Why do we needs this here? */
	if (err)
	goto leave;

	/* Setup an output stream and perform the get. */
	outfp = es_fopencookie (ctx, "w", data_line_cookie_functions);
	if (!outfp)
	err = set_error (GPG_ERR_ASS_GENERAL, "error setting up a data stream");
	else
	{
	ctrl->server_local->inhibit_data_logging = 1;
	ctrl->server_local->inhibit_data_logging_now = 0;
	ctrl->server_local->inhibit_data_logging_count = 0;
	err = ks_action_fetch (ctrl, line, outfp);
	es_fclose (outfp);
	ctrl->server_local->inhibit_data_logging = 0;
	}

	leave:
	return leave_cmd (ctx, err);
	}



	static const char hlp_ks_put[] =
	"KS_PUT\n"
	"\n"
	"Send a key to the configured OpenPGP keyservers. The actual key material\n"
	"is then requested by Dirmngr using\n"
	"\n"
	" INQUIRE KEYBLOCK\n"
	"\n"
	"The client shall respond with a binary version of the keyblock (e.g.,\n"
	"the output of `gpg --export KEYID'). For LDAP\n"
	"keyservers Dirmngr may ask for meta information of the provided keyblock\n"
	"using:\n"
	"\n"
	" INQUIRE KEYBLOCK_INFO\n"
	"\n"
	"The client shall respond with a colon delimited info lines (the output\n"
	"of 'for x in keys sigs; do gpg --list-$x --with-colons KEYID; done').\n";
	static gpg_error_t
	cmd_ks_put (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;
	unsigned char *value = NULL;
	size_t valuelen;
	unsigned char *info = NULL;
	size_t infolen;

	/* No options for now. */
	line = skip_options (line);

	err = ensure_keyserver (ctrl);
	if (err)
	goto leave;

	/* Ask for the key material. */
	err = assuan_inquire (ctx, "KEYBLOCK",
	&value, &valuelen, MAX_KEYBLOCK_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (!valuelen) /* No data returned; return a comprehensible error. */
	{
	err = gpg_error (GPG_ERR_MISSING_CERT);
	goto leave;
	}

	/* Ask for the key meta data. Not actually needed for HKP servers
	but we do it anyway to test the client implementaion. */
	err = assuan_inquire (ctx, "KEYBLOCK_INFO",
	&info, &infolen, MAX_KEYBLOCK_LENGTH);
	if (err)
	{
	log_error (_("assuan_inquire failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	/* Send the key. */
	err = ks_action_put (ctrl, ctrl->server_local->keyservers,
	value, valuelen, info, infolen);

	leave:
	xfree (info);
	xfree (value);
	return leave_cmd (ctx, err);
	}



	static const char hlp_loadswdb[] =
	"LOADSWDB [--force]\n"
	"\n"
	"Load and verify the swdb.lst from the Net.";
	static gpg_error_t
	cmd_loadswdb (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;

	err = dirmngr_load_swdb (ctrl, has_option (line, "--force"));

	return leave_cmd (ctx, err);
	}



	static const char hlp_getinfo[] =
	"GETINFO <what>\n"
	"\n"
	"Multi purpose command to return certain information. \n"
	"Supported values of WHAT are:\n"
	"\n"
	"version - Return the version of the program.\n"
	"pid - Return the process id of the server.\n"
	"tor - Return OK if running in Tor mode\n"
	"dnsinfo - Return info about the DNS resolver\n"
	"socket_name - Return the name of the socket.\n";
	static gpg_error_t
	cmd_getinfo (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	gpg_error_t err;

	if (!strcmp (line, "version"))
	{
	const char *s = VERSION;
	err = assuan_send_data (ctx, s, strlen (s));
	}
	else if (!strcmp (line, "pid"))
	{
	char numbuf[50];

	snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
	err = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else if (!strcmp (line, "socket_name"))
	{
	const char *s = dirmngr_get_current_socket_name ();
	err = assuan_send_data (ctx, s, strlen (s));
	}
	else if (!strcmp (line, "tor"))
	{
	int use_tor;

	use_tor = dirmngr_use_tor ();
	if (use_tor)
	{
	if (!is_tor_running (ctrl))
	err = assuan_write_status (ctx, "NO_TOR", "Tor not running");
	else
	err = 0;
	if (!err)
	assuan_set_okay_line (ctx, use_tor == 1 ? "- Tor mode is enabled"
	/**/ : "- Tor mode is enforced");
	}
	else
	err = set_error (GPG_ERR_FALSE, "Tor mode is NOT enabled");
	}
	else if (!strcmp (line, "dnsinfo"))
	{
	if (standard_resolver_p ())
	assuan_set_okay_line
	(ctx, "- Forced use of System resolver (w/o Tor support)");
	else
	{
	#ifdef USE_LIBDNS
	assuan_set_okay_line (ctx, (recursive_resolver_p ()
	? "- Libdns recursive resolver"
	: "- Libdns stub resolver"));
	#else
	assuan_set_okay_line (ctx, "- System resolver (w/o Tor support)");
	#endif
	}
	err = 0;
	}
	else
	err = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");

	return leave_cmd (ctx, err);
	}



	static const char hlp_killdirmngr[] =
	"KILLDIRMNGR\n"
	"\n"
	"This command allows a user - given sufficient permissions -\n"
	"to kill this dirmngr process.\n";
	static gpg_error_t
	cmd_killdirmngr (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	ctrl->server_local->stopme = 1;
	assuan_set_flag (ctx, ASSUAN_FORCE_CLOSE, 1);
	return gpg_error (GPG_ERR_EOF);
	}


	static const char hlp_reloaddirmngr[] =
	"RELOADDIRMNGR\n"
	"\n"
	"This command is an alternative to SIGHUP\n"
	"to reload the configuration.";
	static gpg_error_t
	cmd_reloaddirmngr (assuan_context_t ctx, char *line)
	{
	(void)ctx;
	(void)line;

	dirmngr_sighup_action ();
	return 0;
	}



	/* Tell the assuan library about our commands. */
	static int
	register_commands (assuan_context_t ctx)
	{
	static struct {
	const char *name;
	assuan_handler_t handler;
	const char * const help;
	} table[] = {
	{ "DNS_CERT", cmd_dns_cert, hlp_dns_cert },
	{ "WKD_GET", cmd_wkd_get, hlp_wkd_get },
	{ "LDAPSERVER", cmd_ldapserver, hlp_ldapserver },
	{ "ISVALID", cmd_isvalid, hlp_isvalid },
	{ "CHECKCRL", cmd_checkcrl, hlp_checkcrl },
	{ "CHECKOCSP", cmd_checkocsp, hlp_checkocsp },
	{ "LOOKUP", cmd_lookup, hlp_lookup },
	{ "LOADCRL", cmd_loadcrl, hlp_loadcrl },
	{ "LISTCRLS", cmd_listcrls, hlp_listcrls },
	{ "CACHECERT", cmd_cachecert, hlp_cachecert },
	{ "VALIDATE", cmd_validate, hlp_validate },
	{ "KEYSERVER", cmd_keyserver, hlp_keyserver },
	{ "KS_SEARCH", cmd_ks_search, hlp_ks_search },
	{ "KS_GET", cmd_ks_get, hlp_ks_get },
	{ "KS_FETCH", cmd_ks_fetch, hlp_ks_fetch },
	{ "KS_PUT", cmd_ks_put, hlp_ks_put },
	{ "GETINFO", cmd_getinfo, hlp_getinfo },
	{ "LOADSWDB", cmd_loadswdb, hlp_loadswdb },
	{ "KILLDIRMNGR",cmd_killdirmngr,hlp_killdirmngr },
	{ "RELOADDIRMNGR",cmd_reloaddirmngr,hlp_reloaddirmngr },
	{ NULL, NULL }
	};
	int i, j, rc;

	for (i=j=0; table[i].name; i++)
	{
	rc = assuan_register_command (ctx, table[i].name, table[i].handler,
	table[i].help);
	if (rc)
	return rc;
	}
	return 0;
	}


	/* Note that we do not reset the list of configured keyservers. */
	static gpg_error_t
	reset_notify (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	(void)line;

	#if USE_LDAP
	ldapserver_list_free (ctrl->server_local->ldapservers);
	#endif /USE_LDAP/
	ctrl->server_local->ldapservers = NULL;
	return 0;
	}


	/* This function is called by our assuan log handler to test whether a
	* log message shall really be printed. The function must return
	* false to inhibit the logging of MSG. CAT gives the requested log
	* category. MSG might be NULL. */
	int
	dirmngr_assuan_log_monitor (assuan_context_t ctx, unsigned int cat,
	const char *msg)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)cat;
	(void)msg;

	if (!ctrl \|\| !ctrl->server_local)
	return 1; /* Can't decide - allow logging. */

	if (!ctrl->server_local->inhibit_data_logging)
	return 1; /* Not requested - allow logging. */

	/* Disallow logging if _now is true. /
	return !ctrl->server_local->inhibit_data_logging_now;
	}


	/* Startup the server and run the main command loop. With FD = -1,
	use stdin/stdout. */
	void
	start_command_handler (assuan_fd_t fd)
	{
	static const char hello[] = "Dirmngr " VERSION " at your service";
	static char *hello_line;
	int rc;
	assuan_context_t ctx;
	ctrl_t ctrl;

	ctrl = xtrycalloc (1, sizeof *ctrl);
	if (ctrl)
	ctrl->server_local = xtrycalloc (1, sizeof *ctrl->server_local);
	if (!ctrl \|\| !ctrl->server_local)
	{
	log_error (_("can't allocate control structure: %s\n"),
	strerror (errno));
	xfree (ctrl);
	return;
	}

	dirmngr_init_default_ctrl (ctrl);

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error (_("failed to allocate assuan context: %s\n"),
	gpg_strerror (rc));
	dirmngr_exit (2);
	}

	if (fd == ASSUAN_INVALID_FD)
	{
	assuan_fd_t filedes[2];

	filedes[0] = assuan_fdopen (0);
	filedes[1] = assuan_fdopen (1);
	rc = assuan_init_pipe_server (ctx, filedes);
	}
	else
	{
	rc = assuan_init_socket_server (ctx, fd, ASSUAN_SOCKET_SERVER_ACCEPTED);
	}

	if (rc)
	{
	assuan_release (ctx);
	log_error (_("failed to initialize the server: %s\n"),
	gpg_strerror(rc));
	dirmngr_exit (2);
	}

	rc = register_commands (ctx);
	if (rc)
	{
	log_error (_("failed to the register commands with Assuan: %s\n"),
	gpg_strerror(rc));
	dirmngr_exit (2);
	}


	if (!hello_line)
	{
	hello_line = xtryasprintf
	("Home: %s\n"
	"Config: %s\n"
	"%s",
	gnupg_homedir (),
	opt.config_filename? opt.config_filename : "[none]",
	hello);
	}

	ctrl->server_local->assuan_ctx = ctx;
	assuan_set_pointer (ctx, ctrl);

	assuan_set_hello_line (ctx, hello_line);
	assuan_register_option_handler (ctx, option_handler);
	assuan_register_reset_notify (ctx, reset_notify);

	for (;;)
	{
	rc = assuan_accept (ctx);
	if (rc == -1)
	break;
	if (rc)
	{
	log_info (_("Assuan accept problem: %s\n"), gpg_strerror (rc));
	break;
	}

	#ifndef HAVE_W32_SYSTEM
	if (opt.verbose)
	{
	assuan_peercred_t peercred;

	if (!assuan_get_peercred (ctx, &peercred))
	log_info ("connection from process %ld (%ld:%ld)\n",
	(long)peercred->pid, (long)peercred->uid,
	(long)peercred->gid);
	}
	#endif

	rc = assuan_process (ctx);
	if (rc)
	{
	log_info (_("Assuan processing failed: %s\n"), gpg_strerror (rc));
	continue;
	}
	}


	#if USE_LDAP
	ldap_wrapper_connection_cleanup (ctrl);

	ldapserver_list_free (ctrl->server_local->ldapservers);
	#endif /USE_LDAP/
	ctrl->server_local->ldapservers = NULL;

	release_ctrl_keyservers (ctrl);

	ctrl->server_local->assuan_ctx = NULL;
	assuan_release (ctx);

	if (ctrl->server_local->stopme)
	dirmngr_exit (0);

	if (ctrl->refcount)
	log_error ("oops: connection control structure still referenced (%d)\n",
	ctrl->refcount);
	else
	{
	release_ctrl_ocsp_certs (ctrl);
	xfree (ctrl->server_local);
	dirmngr_deinit_default_ctrl (ctrl);
	xfree (ctrl);
	}
	}


	/* Send a status line back to the client. KEYWORD is the status
	keyword, the optional string arguments are blank separated added to
	the line, the last argument must be a NULL. */
	gpg_error_t
	dirmngr_status (ctrl_t ctrl, const char *keyword, ...)
	{
	gpg_error_t err = 0;
	va_list arg_ptr;
	const char *text;

	va_start (arg_ptr, keyword);

	if (ctrl->server_local)
	{
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;
	char buf[950], *p;
	size_t n;

	p = buf;
	n = 0;
	while ( (text = va_arg (arg_ptr, const char *)) )
	{
	if (n)
	{
	*p++ = ' ';
	n++;
	}
	for ( ; *text && n < DIM (buf)-2; n++)
	p++ = text++;
	}
	*p = 0;
	err = assuan_write_status (ctx, keyword, buf);
	}

	va_end (arg_ptr);
	return err;
	}


	/* Print a help status line. TEXTLEN gives the length of the text
	from TEXT to be printed. The function splits text at LFs. */
	gpg_error_t
	dirmngr_status_help (ctrl_t ctrl, const char *text)
	{
	gpg_error_t err = 0;

	if (ctrl->server_local)
	{
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;
	char buf[950], *p;
	size_t n;

	do
	{
	p = buf;
	n = 0;
	for ( ; text && text != '\n' && n < DIM (buf)-2; n++)
	p++ = text++;
	if (*text == '\n')
	text++;
	*p = 0;
	err = assuan_write_status (ctx, "#", buf);
	}
	while (!err && *text);
	}

	return err;
	}

	/* Send a tick progress indicator back. Fixme: This is only done for
	the currently active channel. */
	gpg_error_t
	dirmngr_tick (ctrl_t ctrl)
	{
	static time_t next_tick = 0;
	gpg_error_t err = 0;
	time_t now = time (NULL);

	if (!next_tick)
	{
	next_tick = now + 1;
	}
	else if ( now > next_tick )
	{
	if (ctrl)
	{
	err = dirmngr_status (ctrl, "PROGRESS", "tick", "? 0 0", NULL);
	if (err)
	{
	/* Take this as in indication for a cancel request. */
	err = gpg_error (GPG_ERR_CANCELED);
	}
	now = time (NULL);
	}

	next_tick = now + 1;
	}
	return err;
	}
	diff --git a/doc/DETAILS b/doc/DETAILS
	index ac599fc62..d9b1fa673 100644
	--- a/doc/DETAILS
	+++ b/doc/DETAILS
	@@ -1,1455 +1,1455 @@
	# doc/DETAILS -- org --
	#+TITLE: GnuPG Details
	# Globally disable superscripts and subscripts:
	#+OPTIONS: ^:{}
	#

	# Note: This file uses org-mode; it should be easy to read as plain
	# text but be aware of some markup peculiarities: Verbatim code is
	# enclosed in #+begin-example, #+end-example blocks or marked by a
	# colon as the first non-white-space character, words bracketed with
	# equal signs indicate a monospace font, and the usual /italics/,
	# bold, and _underline_ conventions are recognized.

	This is the DETAILS file for GnuPG which specifies some internals and
	parts of the external API for GPG and GPGSM.

	* Format of the colon listings

	The format is a based on colon separated record, each recods starts
	with a tag string and extends to the end of the line. Here is an
	example:
	#+begin_example
	$ gpg --with-colons --list-keys \
	--with-fingerprint --with-fingerprint wk@gnupg.org
	pub:f:1024:17:6C7EE1B8621CC013:899817715:1055898235::m:::scESC:
	fpr:::::::::ECAF7590EB3443B5C7CF3ACB6C7EE1B8621CC013:
	uid:f::::::::Werner Koch <wk@g10code.com>:
	uid:f::::::::Werner Koch <wk@gnupg.org>:
	sub:f:1536:16:06AD222CADF6A6E1:919537416:1036177416:::::e:
	fpr:::::::::CF8BCC4B18DE08FCD8A1615906AD222CADF6A6E1:
	sub:r:1536:20:5CE086B5B5A18FF4:899817788:1025961788:::::esc:
	fpr:::::::::AB059359A3B81F410FCFF97F5CE086B5B5A18FF4:
	#+end_example

	Note that new version of GnuPG or the use of certain options may add
	new fields to the output. Parsers should not assume a limit on the
	number of fields per line. Some fields are not yet used or only used
	with certain record types; parsers should ignore fields they are not
	aware of. New versions of GnuPG or the use of certain options may add
	new types of records as well. Parsers should ignore any record whose
	type they do not recognize for forward-compatibility.

	The double =--with-fingerprint= prints the fingerprint for the subkeys
	too. Old versions of gpg used a slightly different format and required
	the use of the option =--fixed-list-mode= to conform to the format
	described here.


	** Description of the fields
	*** Field 1 - Type of record

	- pub :: Public key
	- crt :: X.509 certificate
	- crs :: X.509 certificate and private key available
	- sub :: Subkey (secondary key)
	- sec :: Secret key
	- ssb :: Secret subkey (secondary key)
	- uid :: User id
	- uat :: User attribute (same as user id except for field 10).
	- sig :: Signature
	- rev :: Revocation signature
	- fpr :: Fingerprint (fingerprint is in field 10)
	- pkd :: Public key data [*]
	- grp :: Keygrip
	- rvk :: Revocation key
	- tfs :: TOFU statistics [*]
	- tru :: Trust database information [*]
	- spk :: Signature subpacket [*]
	- cfg :: Configuration data [*]

	Records marked with an asterisk are described at [[Special%20field%20formats][Special fields]].

	*** Field 2 - Validity

	This is a letter describing the computed validity of a key.
	Currently this is a single letter, but be prepared that additional
	information may follow in some future versions. Note that GnuPG <
	2.1 does not set this field for secret key listings.

	- o :: Unknown (this key is new to the system)
	- i :: The key is invalid (e.g. due to a missing self-signature)
	- d :: The key has been disabled
	(deprecated - use the 'D' in field 12 instead)
	- r :: The key has been revoked
	- e :: The key has expired
	- - :: Unknown validity (i.e. no value assigned)
	- q :: Undefined validity. '-' and 'q' may safely be treated as
	the same value for most purposes
	- n :: The key is not valid
	- m :: The key is marginal valid.
	- f :: The key is fully valid
	- u :: The key is ultimately valid. This often means that the
	secret key is available, but any key may be marked as
	ultimately valid.
	- w :: The key has a well known private part.
	- s :: The key has special validity. This means that it might be
	self-signed and expected to be used in the STEED system.

	If the validity information is given for a UID or UAT record, it
	describes the validity calculated based on this user ID. If given
	for a key record it describes the validity taken from the best
	rated user ID.

	For X.509 certificates a 'u' is used for a trusted root
	certificate (i.e. for the trust anchor) and an 'f' for all other
	valid certificates.

	*** Field 3 - Key length

	The length of key in bits.

	*** Field 4 - Public key algorithm

	The values here are those from the OpenPGP specs or if they are
	greather than 255 the algorithm ids as used by Libgcrypt.

	*** Field 5 - KeyID

	This is the 64 bit keyid as specified by OpenPGP and the last 64
	bit of the SHA-1 fingerprint of an X.509 certifciate.

	*** Field 6 - Creation date

	The creation date of the key is given in UTC. For UID and UAT
	records, this is used for the self-signature date. Note that the
	date is usually printed in seconds since epoch, however, we are
	migrating to an ISO 8601 format (e.g. "19660205T091500"). This is
	currently only relevant for X.509. A simple way to detect the new
	format is to scan for the 'T'. Note that old versions of gpg
	without using the =--fixed-list-mode= option used a "yyyy-mm-tt"
	format.

	*** Field 7 - Expiration date

	Key or UID/UAT expiration date or empty if it does not expire.

	*** Field 8 - Certificate S/N, UID hash, trust signature info

	Used for serial number in crt records. For UID and UAT records,
	this is a hash of the user ID contents used to represent that
	exact user ID. For trust signatures, this is the trust depth
	separated by the trust value by a space.

	*** Field 9 - Ownertrust

	This is only used on primary keys. This is a single letter, but
	be prepared that additional information may follow in future
	versions. For trust signatures with a regular expression, this is
	the regular expression value, quoted as in field 10.

	*** Field 10 - User-ID
	The value is quoted like a C string to avoid control characters
	(the colon is quoted =\x3a=). For a "pub" record this field is
	not used on --fixed-list-mode. A UAT record puts the attribute
	subpacket count here, a space, and then the total attribute
	subpacket size. In gpgsm the issuer name comes here. A FPR
	record stores the fingerprint here. The fingerprint of a
	revocation key is stored here.
	*** Field 11 - Signature class

	Signature class as per RFC-4880. This is a 2 digit hexnumber
	followed by either the letter 'x' for an exportable signature or
	the letter 'l' for a local-only signature. The class byte of an
	revocation key is also given here, 'x' and 'l' is used the same
	way. This field if not used for X.509.

	*** Field 12 - Key capabilities

	The defined capabilities are:

	- e :: Encrypt
	- s :: Sign
	- c :: Certify
	- a :: Authentication
	- ? :: Unknown capability

	A key may have any combination of them in any order. In addition
	to these letters, the primary key has uppercase versions of the
	letters to denote the _usable_ capabilities of the entire key, and
	a potential letter 'D' to indicate a disabled key.

	*** Field 13 - Issuer certificate fingerprint or other info

	Used in FPR records for S/MIME keys to store the fingerprint of
	the issuer certificate. This is useful to build the certificate
	path based on certificates stored in the local key database it is
	only filled if the issuer certificate is available. The root has
	been reached if this is the same string as the fingerprint. The
	advantage of using this value is that it is guaranteed to have
	- been been build by the same lookup algorithm as gpgsm uses.
	+ been built by the same lookup algorithm as gpgsm uses.

	For "uid" records this field lists the preferences in the same way
	gpg's --edit-key menu does.

	For "sig" records, this is the fingerprint of the key that issued
	the signature. Note that this is only filled in if the signature
	verified correctly. Note also that for various technical reasons,
	this fingerprint is only available if --no-sig-cache is used.

	*** Field 14 - Flag field

	Flag field used in the --edit menu output

	*** Field 15 - S/N of a token

	Used in sec/ssb to print the serial number of a token (internal
	protect mode 1002) or a '#' if that key is a simple stub (internal
	protect mode 1001). If the option --with-secret is used and a
	secret key is available for the public key, a '+' indicates this.

	*** Field 16 - Hash algorithm

	For sig records, this is the used hash algorithm. For example:
	2 = SHA-1, 8 = SHA-256.

	*** Field 17 - Curve name

	For pub, sub, sec, and ssb records this field is used for the ECC
	curve name.

	** Special fields

	*** PKD - Public key data

	If field 1 has the tag "pkd", a listing looks like this:
	#+begin_example
	pkd:0:1024:B665B1435F4C2 .... FF26ABB:
	! ! !-- the value
	! !------ for information number of bits in the value
	!--------- index (eg. DSA goes from 0 to 3: p,q,g,y)
	#+end_example

	*** TFS - TOFU statistics

	This field may follows a UID record to convey information about
	the TOFU database. The information is similar to a TOFU_STATS
	status line.

	- Field 2 :: tfs record version (must be 1)
	- Field 3 :: validity - A number with validity code.
	- Field 4 :: signcount - The number of signatures seen.
	- Field 5 :: encrcount - The number of encryptions done.
	- Field 6 :: policy - A string with the policy
	- Field 7 :: signture-first-seen - a timestamp or 0 if not known.
	- Field 8 :: signature-most-recent-seen - a timestamp or 0 if not known.
	- Field 9 :: encryption-first-done - a timestamp or 0 if not known.
	- Field 10 :: encryption-most-recent-done - a timestamp or 0 if not known.

	*** TRU - Trust database information
	Example for a "tru" trust base record:
	#+begin_example
	tru:o:0:1166697654:1:3:1:5
	#+end_example

	- Field 2 :: Reason for staleness of trust. If this field is
	empty, then the trustdb is not stale. This field may
	have multiple flags in it:

	- o :: Trustdb is old
	- t :: Trustdb was built with a different trust model
	than the one we are using now.

	- Field 3 :: Trust model

	- 0 :: Classic trust model, as used in PGP 2.x.
	- 1 :: PGP trust model, as used in PGP 6 and later.
	This is the same as the classic trust model,
	except for the addition of trust signatures.

	GnuPG before version 1.4 used the classic trust model
	by default. GnuPG 1.4 and later uses the PGP trust
	model by default.

	- Field 4 :: Date trustdb was created in seconds since Epoch.
	- Field 5 :: Date trustdb will expire in seconds since Epoch.
	- Field 6 :: Number of marginally trusted users to introduce a new
	key signer (gpg's option --marginals-needed).
	- Field 7 :: Number of completely trusted users to introduce a new
	key signer. (gpg's option --completes-needed)

	- Field 8 :: Maximum depth of a certification chain. (gpg's option
	--max-cert-depth)

	*** SPK - Signature subpacket records

	- Field 2 :: Subpacket number as per RFC-4880 and later.
	- Field 3 :: Flags in hex. Currently the only two bits assigned
	are 1, to indicate that the subpacket came from the
	hashed part of the signature, and 2, to indicate the
	subpacket was marked critical.
	- Field 4 :: Length of the subpacket. Note that this is the
	length of the subpacket, and not the length of field
	5 below. Due to the need for %-encoding, the length
	of field 5 may be up to 3x this value.
	- Field 5 :: The subpacket data. Printable ASCII is shown as
	ASCII, but other values are rendered as %XX where XX
	is the hex value for the byte.

	*** CFG - Configuration data

	--list-config outputs information about the GnuPG configuration
	for the benefit of frontends or other programs that call GnuPG.
	There are several list-config items, all colon delimited like the
	rest of the --with-colons output. The first field is always "cfg"
	to indicate configuration information. The second field is one of
	(with examples):

	- version :: The third field contains the version of GnuPG.

	: cfg:version:1.3.5

	- pubkey :: The third field contains the public key algorithms
	this version of GnuPG supports, separated by
	semicolons. The algorithm numbers are as specified in
	RFC-4880. Note that in contrast to the --status-fd
	interface these are _not_ the Libgcrypt identifiers.
	Using =pubkeyname= prints names instead of numbers.

	: cfg:pubkey:1;2;3;16;17

	- cipher :: The third field contains the symmetric ciphers this
	version of GnuPG supports, separated by semicolons.
	The cipher numbers are as specified in RFC-4880.
	Using =ciphername= prints names instead of numbers.

	: cfg:cipher:2;3;4;7;8;9;10

	- digest :: The third field contains the digest (hash) algorithms
	this version of GnuPG supports, separated by
	semicolons. The digest numbers are as specified in
	RFC-4880. Using =digestname= prints names instead of
	numbers.

	: cfg:digest:1;2;3;8;9;10

	- compress :: The third field contains the compression algorithms
	this version of GnuPG supports, separated by
	semicolons. The algorithm numbers are as specified
	in RFC-4880.

	: cfg:compress:0;1;2;3

	- group :: The third field contains the name of the group, and the
	fourth field contains the values that the group expands
	to, separated by semicolons.

	For example, a group of:
	: group mynames = paige 0x12345678 joe patti
	would result in:
	: cfg:group:mynames:patti;joe;0x12345678;paige

	- curve :: The third field contains the curve names this version
	of GnuPG supports, separated by semicolons. Using
	=curveoid= prints OIDs instead of numbers.

	: cfg:curve:ed25519;nistp256;nistp384;nistp521


	* Format of the --status-fd output

	Every line is prefixed with "[GNUPG:] ", followed by a keyword with
	the type of the status line and some arguments depending on the type
	(maybe none); an application should always be willing to ignore
	unknown keywords that may be emitted by future versions of GnuPG.
	Also, new versions of GnuPG may add arguments to existing keywords.
	Any additional arguments should be ignored for forward-compatibility.

	** General status codes
	*** NEWSIG [<signers_uid>]
	Is issued right before a signature verification starts. This is
	useful to define a context for parsing ERROR status messages.
	arguments are currently defined. If SIGNERS_UID is given and is
	not "-" this is the percent escape value of the OpenPGP Signer's
	User ID signature sub-packet.

	*** GOODSIG <long_keyid_or_fpr> <username>
	The signature with the keyid is good. For each signature only one
	of the codes GOODSIG, BADSIG, EXPSIG, EXPKEYSIG, REVKEYSIG or
	ERRSIG will be emitted. In the past they were used as a marker
	for a new signature; new code should use the NEWSIG status
	instead. The username is the primary one encoded in UTF-8 and %XX
	escaped. The fingerprint may be used instead of the long keyid if
	it is available. This is the case with CMS and might eventually
	also be available for OpenPGP.

	*** EXPSIG <long_keyid_or_fpr> <username>
	The signature with the keyid is good, but the signature is
	expired. The username is the primary one encoded in UTF-8 and %XX
	escaped. The fingerprint may be used instead of the long keyid if
	it is available. This is the case with CMS and might eventually
	also be available for OpenPGP.

	*** EXPKEYSIG <long_keyid_or_fpr> <username>
	The signature with the keyid is good, but the signature was made
	by an expired key. The username is the primary one encoded in
	UTF-8 and %XX escaped. The fingerprint may be used instead of the
	long keyid if it is available. This is the case with CMS and
	might eventually also be available for OpenPGP.

	*** REVKEYSIG <long_keyid_or_fpr> <username>
	The signature with the keyid is good, but the signature was made
	by a revoked key. The username is the primary one encoded in UTF-8
	and %XX escaped. The fingerprint may be used instead of the long
	keyid if it is available. This is the case with CMS and might
	eventually also beñ available for OpenPGP.

	*** BADSIG <long_keyid_or_fpr> <username>
	The signature with the keyid has not been verified okay. The
	username is the primary one encoded in UTF-8 and %XX escaped. The
	fingerprint may be used instead of the long keyid if it is
	available. This is the case with CMS and might eventually also be
	available for OpenPGP.

	*** ERRSIG <keyid> <pkalgo> <hashalgo> <sig_class> <time> <rc>
	It was not possible to check the signature. This may be caused by
	a missing public key or an unsupported algorithm. A RC of 4
	indicates unknown algorithm, a 9 indicates a missing public
	key. The other fields give more information about this signature.
	sig_class is a 2 byte hex-value. The fingerprint may be used
	instead of the keyid if it is available. This is the case with
	gpgsm and might eventually also be available for OpenPGP.

	Note, that TIME may either be the number of seconds since Epoch or
	an ISO 8601 string. The latter can be detected by the presence of
	the letter 'T'.

	*** VALIDSIG <args>

	The args are:

	- <fingerprint_in_hex>
	- <sig_creation_date>
	- <sig-timestamp>
	- <expire-timestamp>
	- <sig-version>
	- <reserved>
	- <pubkey-algo>
	- <hash-algo>
	- <sig-class>
	- [ <primary-key-fpr> ]

	This status indicates that the signature is cryptographically
	valid. This is similar to GOODSIG, EXPSIG, EXPKEYSIG, or REVKEYSIG
	(depending on the date and the state of the signature and signing
	key) but has the fingerprint as the argument. Multiple status
	lines (VALIDSIG and the other appropriate *SIG status) are emitted
	for a valid signature. All arguments here are on one long line.
	sig-timestamp is the signature creation time in seconds after the
	epoch. expire-timestamp is the signature expiration time in
	seconds after the epoch (zero means "does not
	expire"). sig-version, pubkey-algo, hash-algo, and sig-class (a
	2-byte hex value) are all straight from the signature packet.
	PRIMARY-KEY-FPR is the fingerprint of the primary key or identical
	to the first argument. This is useful to get back to the primary
	key without running gpg again for this purpose.

	The primary-key-fpr parameter is used for OpenPGP and not
	available for CMS signatures. The sig-version as well as the sig
	class is not defined for CMS and currently set to 0 and 00.

	Note, that *-TIMESTAMP may either be a number of seconds since
	Epoch or an ISO 8601 string which can be detected by the presence
	of the letter 'T'.

	*** SIG_ID <radix64_string> <sig_creation_date> <sig-timestamp>
	This is emitted only for signatures of class 0 or 1 which have
	been verified okay. The string is a signature id and may be used
	in applications to detect replay attacks of signed messages. Note
	that only DLP algorithms give unique ids - others may yield
	duplicated ones when they have been created in the same second.

	Note, that SIG-TIMESTAMP may either be a number of seconds since
	Epoch or an ISO 8601 string which can be detected by the presence
	of the letter 'T'.

	*** ENC_TO <long_keyid> <keytype> <keylength>
	The message is encrypted to this LONG_KEYID. KEYTYPE is the
	numerical value of the public key algorithm or 0 if it is not
	known, KEYLENGTH is the length of the key or 0 if it is not known
	(which is currently always the case). Gpg prints this line
	always; Gpgsm only if it knows the certificate.

	*** BEGIN_DECRYPTION
	Mark the start of the actual decryption process. This is also
	emitted when in --list-only mode.
	*** END_DECRYPTION
	Mark the end of the actual decryption process. This are also
	emitted when in --list-only mode.
	*** DECRYPTION_INFO <mdc_method> <sym_algo>
	Print information about the symmetric encryption algorithm and the
	MDC method. This will be emitted even if the decryption fails.

	*** DECRYPTION_FAILED
	The symmetric decryption failed - one reason could be a wrong
	passphrase for a symmetrical encrypted message.

	*** DECRYPTION_OKAY
	The decryption process succeeded. This means, that either the
	correct secret key has been used or the correct passphrase for a
	symmetric encrypted message was given. The program itself may
	return an errorcode because it may not be possible to verify a
	signature for some reasons.

	*** SESSION_KEY <algo>:<hexdigits>
	The session key used to decrypt the message. This message will
	only be emitted if the option --show-session-key is used. The
	format is suitable to be passed as value for the option
	--override-session-key. It is not an indication that the
	decryption will or has succeeded.

	*** BEGIN_ENCRYPTION <mdc_method> <sym_algo>
	Mark the start of the actual encryption process.

	*** END_ENCRYPTION
	Mark the end of the actual encryption process.

	*** FILE_START <what> <filename>
	Start processing a file <filename>. <what> indicates the performed
	operation:
	- 1 :: verify
	- 2 :: encrypt
	- 3 :: decrypt

	*** FILE_DONE
	Marks the end of a file processing which has been started
	by FILE_START.

	*** BEGIN_SIGNING
	Mark the start of the actual signing process. This may be used as
	an indication that all requested secret keys are ready for use.

	*** ALREADY_SIGNED <long-keyid>
	Warning: This is experimental and might be removed at any time.

	*** SIG_CREATED <type> <pk_algo> <hash_algo> <class> <timestamp> <keyfpr>
	A signature has been created using these parameters.
	Values for type <type> are:
	- D :: detached
	- C :: cleartext
	- S :: standard
	(only the first character should be checked)

	<class> are 2 hex digits with the OpenPGP signature class.

	Note, that TIMESTAMP may either be a number of seconds since Epoch
	or an ISO 8601 string which can be detected by the presence of the
	letter 'T'.

	*** NOTATION_
	There are actually three related status codes to convey notation
	data:

	- NOTATION_NAME <name>
	- NOTATION_FLAGS <critical> <human_readable>
	- NOTATION_DATA <string>

	<name> and <string> are %XX escaped. The data may be split among
	several NOTATION_DATA lines. NOTATION_FLAGS is emitted after
	NOTATION_NAME and gives the critical and human readable flags;
	the flag values are either 0 or 1.

	*** POLICY_URL <string>
	Note that URL in <string> is %XX escaped.

	*** PLAINTEXT <format> <timestamp> <filename>
	This indicates the format of the plaintext that is about to be
	written. The format is a 1 byte hex code that shows the format of
	the plaintext: 62 ('b') is binary data, 74 ('t') is text data with
	no character set specified, and 75 ('u') is text data encoded in
	the UTF-8 character set. The timestamp is in seconds since the
	epoch. If a filename is available it gets printed as the third
	argument, percent-escaped as usual.

	*** PLAINTEXT_LENGTH <length>
	This indicates the length of the plaintext that is about to be
	written. Note that if the plaintext packet has partial length
	encoding it is not possible to know the length ahead of time. In
	that case, this status tag does not appear.

	*** ATTRIBUTE <arguments>
	The list or arguments are:
	- <fpr>
	- <octets>
	- <type>
	- <index>
	- <count>
	- <timestamp>
	- <expiredate>
	- <flags>

	This is one long line issued for each attribute subpacket when an
	attribute packet is seen during key listing. <fpr> is the
	fingerprint of the key. <octets> is the length of the attribute
	subpacket. <type> is the attribute type (e.g. 1 for an image).
	<index> and <count> indicate that this is the N-th indexed
	subpacket of count total subpackets in this attribute packet.
	<timestamp> and <expiredate> are from the self-signature on the
	attribute packet. If the attribute packet does not have a valid
	self-signature, then the timestamp is 0. <flags> are a bitwise OR
	of:
	- 0x01 :: this attribute packet is a primary uid
	- 0x02 :: this attribute packet is revoked
	- 0x04 :: this attribute packet is expired

	*** SIG_SUBPACKET <type> <flags> <len> <data>
	This indicates that a signature subpacket was seen. The format is
	the same as the "spk" record above.

	** Key related
	*** INV_RECP, INV_SGNR
	The two similar status codes:

	- INV_RECP <reason> <requested_recipient>
	- INV_SGNR <reason> <requested_sender>

	are issued for each unusable recipient/sender. The reasons codes
	currently in use are:

	- 0 :: No specific reason given
	- 1 :: Not Found
	- 2 :: Ambigious specification
	- 3 :: Wrong key usage
	- 4 :: Key revoked
	- 5 :: Key expired
	- 6 :: No CRL known
	- 7 :: CRL too old
	- 8 :: Policy mismatch
	- 9 :: Not a secret key
	- 10 :: Key not trusted
	- 11 :: Missing certificate
	- 12 :: Missing issuer certificate
	- 13 :: Key disabled
	- 14 :: Syntax error in specification

	If no specific reason was given a previously emitted status code
	KEY_CONSIDERED may be used to analyzed the problem.

	Note that for historical reasons the INV_RECP status is also used
	for gpgsm's SIGNER command where it relates to signer's of course.
	Newer GnuPG versions are using INV_SGNR; applications should
	ignore the INV_RECP during the sender's command processing once
	they have seen an INV_SGNR. Different codes are used so that they
	can be distinguish while doing an encrypt+sign operation.

	*** NO_RECP <reserved>
	Issued if no recipients are usable.

	*** NO_SGNR <reserved>
	Issued if no senders are usable.

	*** KEY_CONSIDERED <fpr> <flags>
	Issued to explian the lookup of a key. FPR is the hexified
	fingerprint of the primary key. The bit values for FLAGS are:

	- 1 :: The key has not been selected.
	- 2 :: All subkeys of the key are expired or have been revoked.

	*** KEYEXPIRED <expire-timestamp>
	The key has expired. expire-timestamp is the expiration time in
	seconds since Epoch. This status line is not very useful because
	it will also be emitted for expired subkeys even if this subkey is
	not used. To check whether a key used to sign a message has
	expired, the EXPKEYSIG status line is to be used.

	Note, that the TIMESTAMP may either be a number of seconds since
	Epoch or an ISO 8601 string which can be detected by the presence
	of the letter 'T'.

	*** KEYREVOKED
	The used key has been revoked by its owner. No arguments yet.

	*** NO_PUBKEY <long keyid>
	The public key is not available

	*** NO_SECKEY <long keyid>
	The secret key is not available

	*** KEY_CREATED <type> <fingerprint> [<handle>]
	A key has been created. Values for <type> are:
	- B :: primary and subkey
	- P :: primary
	- S :: subkey
	The fingerprint is one of the primary key for type B and P and the
	one of the subkey for S. Handle is an arbitrary non-whitespace
	string used to match key parameters from batch key creation run.

	*** KEY_NOT_CREATED [<handle>]
	The key from batch run has not been created due to errors.

	*** TRUST_
	These are several similar status codes:

	- TRUST_UNDEFINED <error_token>
	- TRUST_NEVER <error_token>
	- TRUST_MARGINAL [0 [<validation_model>]]
	- TRUST_FULLY [0 [<validation_model>]]
	- TRUST_ULTIMATE [0 [<validation_model>]]

	For good signatures one of these status lines are emitted to
	indicate the validity of the key used to create the signature.
	The error token values are currently only emitted by gpgsm.

	VALIDATION_MODEL describes the algorithm used to check the
	validity of the key. The defaults are the standard Web of Trust
	- model for gpg and the the standard X.509 model for gpgsm. The
	+ model for gpg and the standard X.509 model for gpgsm. The
	defined values are

	- pgp :: The standard PGP WoT.
	- shell :: The standard X.509 model.
	- chain :: The chain model.
	- steed :: The STEED model.
	- tofu :: The TOFU model

	Note that the term =TRUST_= in the status names is used for
	historic reasons; we now speak of validity.

	*** TOFU_USER <fingerprint_in_hex> <mbox>

	This status identifies the key and the userid for all following
	Tofu information. The fingerprint is the fingerprint of the
	primary key and the mbox is in general the addr-spec part of the
	userid encoded in UTF-8 and percent escaped. The fingerprint is
	identical for all TOFU_USER lines up to a NEWSIG line.

	*** TOFU_STATS <MANY_ARGS>

	Statistics for the current user id.

	The <MANY_ARGS> are the usual space delimited arguments. Here we
	have too many of them to fit on one printed line and thus they are
	given on 3 printed lines:

	: <summary> <sign-count> <encryption-count>
	: [<policy> [<tm1> <tm2> <tm3> <tm4>
	: [<validity> [<sign-days> <encrypt-days>]]]]

	Values for SUMMARY are:
	- 0 :: attention, an interaction with the user is required (conflict)
	- 1 :: key with no verification/encryption history
	- 2 :: key with little history
	- 3 :: key with enough history for basic trust
	- 4 :: key with a lot of history

	Values for POLICY are:
	- none :: No Policy set
	- auto :: Policy is "auto"
	- good :: Policy is "good"
	- bad :: Policy is "bad"
	- ask :: Policy is "ask"
	- unknown :: Policy is "unknown" (TOFU information does not
	contribute to the key's validity)

	TM1 is the time the first message was verified. TM2 is the time
	the most recent message was verified. TM3 is the time the first
	message was encrypted. TM4 is the most recent encryption. All may
	either be seconds since Epoch or an ISO time string
	(yyyymmddThhmmss).

	VALIDITY is the same as SUMMARY with the exception that VALIDITY
	doesn't reflect whether the key needs attention. That is it never
	takes on value 0. Instead, if there is a conflict, VALIDITY still
	reflects the key's validity (values: 1-4).

	SUMMARY values use the euclidean distance (m = sqrt(a² + b²)) rather
	then the sum of the magnitudes (m = a + b) to ensure a balance between
	verified signatures and encrypted messages.

	Values are calculated based on the number of days where a key was used
	for verifying a signature or to encrypt to it.
	The ranges for the values are:

	- 1 :: signature_days + encryption_days == 0
	- 2 :: 1 <= sqrt(signature_days² + encryption_days²) < 8
	- 3 :: 8 <= sqrt(signature_days² + encryption_days²) < 42
	- 4 :: sqrt(signature_days² + encryption_days²) >= 42

	SIGN-COUNT and ENCRYPTION-COUNT are the number of messages that we
	have seen that have been signed by this key / encryption to this
	key.

	SIGN-DAYS and ENCRYPTION-DAYS are similar, but the number of days
	(in UTC) on which we have seen messages signed by this key /
	encrypted to this key.

	*** TOFU_STATS_SHORT <long_string>

	Information about the TOFU binding for the signature.
	Example: "15 signatures verified. 10 messages encrypted"

	*** TOFU_STATS_LONG <long_string>

	Information about the TOFU binding for the signature in verbose
	format. The LONG_STRING is percent escaped.
	Example: 'Verified 9 messages signed by "Werner Koch
	(dist sig)" in the past 3 minutes, 40 seconds. The most
	recent message was verified 4 seconds ago.'

	*** PKA_TRUST_
	- This is is one:
	+ This is one of:

	- PKA_TRUST_GOOD <addr-spec>
	- PKA_TRUST_BAD <addr-spec>

	Depending on the outcome of the PKA check one of the above status
	codes is emitted in addition to a =TRUST_*= status.

	** Remote control
	*** GET_BOOL, GET_LINE, GET_HIDDEN, GOT_IT

	These status line are used with --command-fd for interactive
	control of the process.

	*** USERID_HINT <long main keyid> <string>
	Give a hint about the user ID for a certain keyID.

	*** NEED_PASSPHRASE <long keyid> <long main keyid> <keytype> <keylength>
	Issued whenever a passphrase is needed. KEYTYPE is the numerical
	value of the public key algorithm or 0 if this is not applicable,
	KEYLENGTH is the length of the key or 0 if it is not known (this
	is currently always the case).

	*** NEED_PASSPHRASE_SYM <cipher_algo> <s2k_mode> <s2k_hash>
	Issued whenever a passphrase for symmetric encryption is needed.

	*** NEED_PASSPHRASE_PIN <card_type> <chvno> [<serialno>]
	Issued whenever a PIN is requested to unlock a card.

	*** MISSING_PASSPHRASE
	No passphrase was supplied. An application which encounters this
	message may want to stop parsing immediately because the next
	message will probably be a BAD_PASSPHRASE. However, if the
	application is a wrapper around the key edit menu functionality it
	might not make sense to stop parsing but simply ignoring the
	following BAD_PASSPHRASE.

	*** BAD_PASSPHRASE <long keyid>
	The supplied passphrase was wrong or not given. In the latter
	case you may have seen a MISSING_PASSPHRASE.

	*** GOOD_PASSPHRASE
	The supplied passphrase was good and the secret key material
	is therefore usable.

	** Import/Export
	*** IMPORT_CHECK <long keyid> <fingerprint> <user ID>
	This status is emitted in interactive mode right before
	the "import.okay" prompt.

	*** IMPORTED <long keyid> <username>
	The keyid and name of the signature just imported

	*** IMPORT_OK <reason> [<fingerprint>]
	The key with the primary key's FINGERPRINT has been imported.
	REASON flags are:

	- 0 :: Not actually changed
	- 1 :: Entirely new key.
	- 2 :: New user IDs
	- 4 :: New signatures
	- 8 :: New subkeys
	- 16 :: Contains private key.

	The flags may be ORed.

	*** IMPORT_PROBLEM <reason> [<fingerprint>]
	Issued for each import failure. Reason codes are:

	- 0 :: No specific reason given.
	- 1 :: Invalid Certificate.
	- 2 :: Issuer Certificate missing.
	- 3 :: Certificate Chain too long.
	- 4 :: Error storing certificate.

	*** IMPORT_RES <args>
	Final statistics on import process (this is one long line). The
	args are a list of unsigned numbers separated by white space:

	- <count>
	- <no_user_id>
	- <imported>
	- always 0 (formerly used for the number of RSA keys)
	- <unchanged>
	- <n_uids>
	- <n_subk>
	- <n_sigs>
	- <n_revoc>
	- <sec_read>
	- <sec_imported>
	- <sec_dups>
	- <skipped_new_keys>
	- <not_imported>
	- <skipped_v3_keys>

	*** EXPORTED <fingerprint>
	The key with <fingerprint> has been exported. The fingerprint is
	the fingerprint of the primary key even if the primary key has
	been replaced by a stub key during secret key export.

	*** EXPORT_RES <args>

	Final statistics on export process (this is one long line). The
	args are a list of unsigned numbers separated by white space:

	- <count>
	- <secret_count>
	- <exported>


	** Smartcard related
	*** CARDCTRL <what> [<serialno>]
	This is used to control smartcard operations. Defined values for
	WHAT are:

	- 1 :: Request insertion of a card. Serialnumber may be given
	to request a specific card. Used by gpg 1.4 w/o
	scdaemon
	- 2 :: Request removal of a card. Used by gpg 1.4 w/o scdaemon.
	- 3 :: Card with serialnumber detected
	- 4 :: No card available
	- 5 :: No card reader available
	- 6 :: No card support available
	- 7 :: Card is in termination state

	*** SC_OP_FAILURE [<code>]
	An operation on a smartcard definitely failed. Currently there is
	no indication of the actual error code, but application should be
	prepared to later accept more arguments. Defined values for
	<code> are:

	- 0 :: unspecified error (identically to a missing CODE)
	- 1 :: canceled
	- 2 :: bad PIN

	*** SC_OP_SUCCESS
	A smart card operaion succeeded. This status is only printed for
	certain operation and is mostly useful to check whether a PIN
	change really worked.

	** Miscellaneous status codes
	*** NODATA <what>
	No data has been found. Codes for WHAT are:

	- 1 :: No armored data.
	- 2 :: Expected a packet but did not found one.
	- 3 :: Invalid packet found, this may indicate a non OpenPGP
	message.
	- 4 :: Signature expected but not found

	You may see more than one of these status lines.

	*** UNEXPECTED <what>
	Unexpected data has been encountered. Codes for WHAT are:
	- 0 :: Not further specified
	- 1 :: Corrupted message structure

	*** TRUNCATED <maxno>
	The output was truncated to MAXNO items. This status code is
	issued for certain external requests.

	*** ERROR <error location> <error code> [<more>]
	This is a generic error status message, it might be followed by
	error location specific data. <error code> and <error_location>
	should not contain spaces. The error code is a either a string
	commencing with a letter or such a string prefixed with a
	numerical error code and an underscore; e.g.: "151011327_EOF".
	*** WARNING <location> <error code> [<text>]
	This is a generic warning status message, it might be followed by
	error location specific data. <error code> and <location>
	should not contain spaces. The error code is a either a string
	commencing with a letter or such a string prefixed with a
	numerical error code and an underscore; e.g.: "151011327_EOF".
	*** SUCCESS [<location>]
	Positive confirmation that an operation succeeded. It is used
	similar to ISO-C's EXIT_SUCCESS. <location> is optional but if
	given should not contain spaces. Used only with a few commands.

	*** FAILURE <location> <error_code>
	This is the counterpart to SUCCESS and used to indicate a program
	failure. It is used similar to ISO-C's EXIT_FAILURE but allows
	conveying more information, in particular a gpg-error error code.
	That numerical error code may optionally have a suffix made of an
	underscore and a string with an error symbol like "151011327_EOF".
	A dash may be used instead of <location>.

	*** BADARMOR
	The ASCII armor is corrupted. No arguments yet.

	*** DELETE_PROBLEM <reason_code>
	Deleting a key failed. Reason codes are:
	- 1 :: No such key
	- 2 :: Must delete secret key first
	- 3 :: Ambigious specification
	- 4 :: Key is stored on a smartcard.

	*** PROGRESS <what> <char> <cur> <total> [<units>]
	Used by the primegen and Public key functions to indicate
	progress. <char> is the character displayed with no --status-fd
	enabled, with the linefeed replaced by an 'X'. <cur> is the
	current amount done and <total> is amount to be done; a <total> of
	0 indicates that the total amount is not known. The condition
	: TOTAL && CUR == TOTAL
	may be used to detect the end of an operation.

	Well known values for WHAT are:

	- pk_dsa :: DSA key generation
	- pk_elg :: Elgamal key generation
	- primegen :: Prime generation
	- need_entropy :: Waiting for new entropy in the RNG
	- tick :: Generic tick without any special meaning - useful
	for letting clients know that the server is still
	working.
	- starting_agent :: A gpg-agent was started because it is not
	running as a daemon.
	- learncard :: Send by the agent and gpgsm while learing
	the data of a smartcard.
	- card_busy :: A smartcard is still working

	<units> is sometines used to describe the units for <current> and
	<total>. For example "B", "KiB", or "MiB".

	*** BACKUP_KEY_CREATED <fingerprint> <fname>
	A backup of a key identified by <fingerprint> has been writte to
	the file <fname>; <fname> is percent-escaped.

	*** MOUNTPOINT <name>
	<name> is a percent-plus escaped filename describing the
	mountpoint for the current operation (e.g. used by "g13 --mount").
	This may either be the specified mountpoint or one randomly
	chosen by g13.

	*** PINENTRY_LAUNCHED <pid>[:<extra>]
	This status line is emitted by gpg to notify a client that a
	Pinentry has been launched. <pid> is the PID of the Pinentry. It
	may be used to display a hint to the user but can't be used to
	synchronize with Pinentry. Note that there is also an Assuan
	inquiry line with the same name used internally or, if enabled,
	send to the client instead of this status line. Such an inquiry
	may be used to sync with Pinentry

	** Obsolete status codes
	*** SIGEXPIRED
	Removed on 2011-02-04. This is deprecated in favor of KEYEXPIRED.
	*** RSA_OR_IDEA
	Obsolete. This status message used to be emitted for requests to
	use the IDEA or RSA algorithms. It has been dropped from GnuPG
	2.1 after the respective patents expired.
	*** SHM_INFO, SHM_GET, SHM_GET_BOOL, SHM_GET_HIDDEN
	These were used for the ancient shared memory based co-processing.
	*** BEGIN_STREAM, END_STREAM
	Used to issued by the experimental pipemode.


	* Format of the --attribute-fd output

	When --attribute-fd is set, during key listings (--list-keys,
	--list-secret-keys) GnuPG dumps each attribute packet to the file
	descriptor specified. --attribute-fd is intended for use with
	--status-fd as part of the required information is carried on the
	ATTRIBUTE status tag (see above).

	The contents of the attribute data is specified by RFC 4880. For
	convenience, here is the Photo ID format, as it is currently the
	only attribute defined:

	- Byte 0-1 :: The length of the image header. Due to a historical
	accident (i.e. oops!) back in the NAI PGP days, this
	is a little-endian number. Currently 16 (0x10 0x00).

	- Byte 2 :: The image header version. Currently 0x01.

	- Byte 3 :: Encoding format. 0x01 == JPEG.

	- Byte 4-15 :: Reserved, and currently unused.

	All other data after this header is raw image (JPEG) data.


	* Layout of the TrustDB

	The TrustDB is built from fixed length records, where the first byte
	describes the record type. All numeric values are stored in network
	byte order. The length of each record is 40 bytes. The first
	record of the DB is always of type 1 and this is the only record of
	this type.

	The record types: directory(2), key(3), uid(4), pref(5), sigrec(6),
	and shadow directory(8) are not anymore used by version 2 of the
	TrustDB.

	** Record type 0

	Unused record or deleted, can be reused for any purpose. Such
	records should in general not exist because deleted records are of
	type 254 and kept in a linked list.

	** Version info (RECTYPE_VER, 1)

	Version information for this TrustDB. This is always the first
	record of the DB and the only one of this type.

	- 1 u8 :: Record type (value: 1).
	- 3 byte :: Magic value ("gpg")
	- 1 u8 :: TrustDB version (value: 2).
	- 1 u8 :: =marginals=. How many marginal trusted keys are required.
	- 1 u8 :: =completes=. How many completely trusted keys are
	required.
	- 1 u8 :: =max_cert_depth=. How deep is the WoT evaluated. Along
	with =marginals= and =completes=, this value is used to
	check whether the cached validity value from a [FIXME
	dir] record can be used.
	- 1 u8 :: =trust_model=
	- 1 u8 :: =min_cert_level=
	- 2 byte :: Not used
	- 1 u32 :: =created=. Timestamp of trustdb creation.
	- 1 u32 :: =nextcheck=. Timestamp of last modification which may
	affect the validity of keys in the trustdb. This value
	is checked against the validity timestamp in the dir
	records.
	- 1 u32 :: =reserved=. Not used.
	- 1 u32 :: =reserved2=. Not used.
	- 1 u32 :: =firstfree=. Number of the record with the head record
	of the RECTYPE_FREE linked list.
	- 1 u32 :: =reserved3=. Not used.
	- 1 u32 :: =trusthashtbl=. Record number of the trusthashtable.


	** Hash table (RECTYPE_HTBL, 10)

	Due to the fact that we use fingerprints to lookup keys, we can
	implement quick access by some simple hash methods, and avoid the
	overhead of gdbm. A property of fingerprints is that they can be
	used directly as hash values. What we use is a dynamic multilevel
	architecture, which combines hash tables, record lists, and linked
	lists.

	This record is a hash table of 256 entries with the property that
	all these records are stored consecutively to make one big
	table. The hash value is simple the 1st, 2nd, ... byte of the
	fingerprint (depending on the indirection level).

	- 1 u8 :: Record type (value: 10).
	- 1 u8 :: Reserved
	- n u32 :: =recnum=. A table with the hash table items fitting into
	this record. =n= depends on the record length:
	$n=(reclen-2)/4$ which yields 9 for oure current record
	length of 40 bytes.

	The total number of hash table records to form the table is:
	$m=(256+n-1)/n$. This is 29 for our record length of 40.

	To look up a key we use the first byte of the fingerprint to get
	the recnum from this hash table and then look up the addressed
	record:

	- If that record is another hash table, we use 2nd byte to index
	that hash table and so on;
	- if that record is a hash list, we walk all entries until we find
	a matching one; or
	- if that record is a key record, we compare the fingerprint to
	decide whether it is the requested key;


	** Hash list (RECTYPE_HLST, 11)

	See hash table above on how it is used. It may also be used for
	other purposes.

	- 1 u8 :: Record type (value: 11).
	- 1 u8 :: Reserved.
	- 1 u32 :: =next=. Record number of the next hash list record or 0
	if none.
	- n u32 :: =rnum=. Array with record numbers to values. With
	$n=(reclen-5)/5$ and our record length of 40, n is 7.

	** Trust record (RECTYPE_TRUST, 12)

	- 1 u8 :: Record type (value: 12).
	- 1 u8 :: Reserved.
	- 20 byte :: =fingerprint=.
	- 1 u8 :: =ownertrust=.
	- 1 u8 :: =depth=.
	- 1 u8 :: =min_ownertrust=.
	- 1 byte :: Not used.
	- 1 u32 :: =validlist=.
	- 10 byte :: Not used.

	** Validity record (RECTYPE_VALID, 13)

	- 1 u8 :: Record type (value: 13).
	- 1 u8 :: Reserved.
	- 20 byte :: =namehash=.
	- 1 u8 :: =validity=
	- 1 u32 :: =next=.
	- 1 u8 :: =full_count=.
	- 1 u8 :: =marginal_count=.
	- 11 byte :: Not used.

	** Free record (RECTYPE_FREE, 254)

	All these records form a linked list of unused records in the TrustDB.

	- 1 u8 :: Record type (value: 254)
	- 1 u8 :: Reserved.
	- 1 u32 :: =next=. Record number of the next rcord of this type.
	The record number to the head of this linked list is
	stored in the version info record.


	* Database scheme for the TOFU info

	#+begin_src sql
	--
	-- The VERSION table holds the version of our TOFU data structures.
	--
	CREATE TABLE version (
	version integer -- As of now this is always 1
	);

	--
	-- The BINDINGS table associates mail addresses with keys.
	--
	CREATE TABLE bindings (
	oid integer primary key autoincrement,
	fingerprint text, -- The key's fingerprint in hex
	email text, -- The normalized mail address destilled from user_id
	user_id text, -- The unmodified user id
	time integer, -- The time this binding was first observed.
	policy boolean check
	(policy in (1, 2, 3, 4, 5)), -- The trust policy with the values:
	-- 1 := Auto
	-- 2 := Good
	-- 3 := Unknown
	-- 4 := Bad
	-- 5 := Ask
	conflict string, -- NULL or a hex formatted fingerprint.
	unique (fingerprint, email)
	);

	CREATE INDEX bindings_fingerprint_email on bindings (fingerprint, email);
	CREATE INDEX bindings_email on bindings (email);

	--
	-- The SIGNATURES table records all data signatures we verified
	--
	CREATE TABLE signatures (
	binding integer not null, -- Link to bindings table,
	-- references bindings.oid.
	sig_digest text, -- The digest of the signed message.
	origin text, -- String describing who initially fed
	-- the signature to gpg (e.g. "email:claws").
	sig_time integer, -- Timestamp from the signature.
	time integer, -- Time this record was created.
	primary key (binding, sig_digest, origin)
	);
	#+end_src


	* GNU extensions to the S2K algorithm

	1 octet - S2K Usage: either 254 or 255.
	1 octet - S2K Cipher Algo: 0
	1 octet - S2K Specifier: 101
	3 octets - "GNU"
	1 octet - GNU S2K Extension Number.

	If such a GNU extension is used neither an IV nor any kind of
	checksum is used. The defined GNU S2K Extension Numbers are:

	- 1 :: Do not store the secret part at all. No specific data
	follows.

	- 2 :: A stub to access smartcards. This data follows:
	- One octet with the length of the following serial number.
	- The serial number. Regardless of what the length octet
	indicates no more than 16 octets are stored.

	Note that gpg stores the GNU S2K Extension Number internally as an
	S2K Specifier with an offset of 1000.


	* Keyserver helper message format

	This information is obsolete
	(Keyserver helpers have been replaced by dirmngr)

	The keyserver may be contacted by a Unix Domain socket or via TCP.

	The format of a request is:
	#+begin_example
	command-tag
	"Content-length:" digits
	CRLF
	#+end_example

	Where command-tag is

	#+begin_example
	NOOP
	GET <user-name>
	PUT
	DELETE <user-name>
	#+end_example

	The format of a response is:

	#+begin_example
	"GNUPG/1.0" status-code status-text
	"Content-length:" digits
	CRLF
	#+end_example
	followed by <digits> bytes of data

	Status codes are:

	- 1xx :: Informational - Request received, continuing process

	- 2xx :: Success - The action was successfully received, understood,
	and accepted

	- 4xx :: Client Error - The request contains bad syntax or cannot be
	fulfilled

	- 5xx :: Server Error - The server failed to fulfill an apparently
	valid request


	* Object identifiers

	OIDs below the GnuPG arc:

	#+begin_example
	1.3.6.1.4.1.11591.2 GnuPG
	1.3.6.1.4.1.11591.2.1 notation
	1.3.6.1.4.1.11591.2.1.1 pkaAddress
	1.3.6.1.4.1.11591.2.2 X.509 extensions
	1.3.6.1.4.1.11591.2.2.1 standaloneCertificate
	1.3.6.1.4.1.11591.2.2.2 wellKnownPrivateKey
	1.3.6.1.4.1.11591.2.12242973 invalid encoded OID
	#+end_example



	* Debug flags

	This tables gives the flag values for the --debug option along with
	the alternative names used by the components.

	\| \| gpg \| gpgsm \| agent \| scd \| dirmngr \| g13 \| wks \|
	\|-------+---------+---------+---------+---------+---------+---------+---------\|
	\| 1 \| packet \| x509 \| \| \| x509 \| mount \| mime \|
	\| 2 \| mpi \| mpi \| mpi \| mpi \| \| \| parser \|
	\| 4 \| crypto \| crypto \| crypto \| crypto \| crypto \| crypto \| crypto \|
	\| 8 \| filter \| \| \| \| \| \| \|
	\| 16 \| iobuf \| \| \| \| dns \| \| \|
	\| 32 \| memory \| memory \| memory \| memory \| memory \| memory \| memory \|
	\| 64 \| cache \| cache \| cache \| cache \| cache \| \| \|
	\| 128 \| memstat \| memstat \| memstat \| memstat \| memstat \| memstat \| memstat \|
	\| 256 \| trust \| \| \| \| \| \| \|
	\| 512 \| hashing \| hashing \| hashing \| hashing \| hashing \| \| \|
	\| 1024 \| ipc \| ipc \| ipc \| ipc \| ipc \| ipc \| ipc \|
	\| 2048 \| \| \| \| cardio \| network \| \| \|
	\| 4096 \| clock \| \| \| reader \| \| \| \|
	\| 8192 \| lookup \| \| \| \| lookup \| \| \|
	\| 16384 \| extprog \| \| \| \| \| \| extprog \|

	Description of some debug flags:

	- cardio :: Used by scdaemon to trace the APDUs exchange with the
	card.
	- clock :: Show execution times of certain functions.
	- crypto :: Trace crypto operations.
	- hashing :: Create files with the hashed data.
	- ipc :: Trace the Assuan commands.
	- mpi :: Show the values of the MPIs.
	- reader :: Used by scdaemon to trace card reader related code. For
	example: Open and close reader.



	* Miscellaneous notes

	** v3 fingerprints
	For packet version 3 we calculate the keyids this way:
	- RSA :: Low 64 bits of n
	- ELGAMAL :: Build a v3 pubkey packet (with CTB 0x99) and
	calculate a RMD160 hash value from it. This is used
	as the fingerprint and the low 64 bits are the keyid.

	** Simplified revocation certificates
	Revocation certificates consist only of the signature packet;
	"--import" knows how to handle this. The rationale behind it is to
	keep them small.

	** Documentation on HKP (the http keyserver protocol):

	A minimalistic HTTP server on port 11371 recognizes a GET for
	/pks/lookup. The standard http URL encoded query parameters are
	this (always key=value):

	- op=index (like pgp -kv), op=vindex (like pgp -kvv) and op=get (like
	pgp -kxa)

	- search=<stringlist>. This is a list of words that must occur in the key.
	The words are delimited with space, points, @ and so on. The delimiters
	are not searched for and the order of the words doesn't matter (but see
	next option).

	- exact=on. This switch tells the hkp server to only report exact matching
	keys back. In this case the order and the "delimiters" are important.

	- fingerprint=on. Also reports the fingerprints when used with 'index' or
	'vindex'

	The keyserver also recognizes http-POSTs to /pks/add. Use this to upload
	keys.


	A better way to do this would be a request like:

	/pks/lookup/<gnupg_formatierte_user_id>?op=<operation>

	This can be implemented using Hurd's translator mechanism.
	However, I think the whole keyserver stuff has to be re-thought;
	I have some ideas and probably create a white paper.
	** Algorithm names for the "keygen.algo" prompt

	When using a --command-fd controlled key generation or "addkey"
	there is way to know the number to enter on the "keygen.algo"
	prompt. The displayed numbers are for human reception and may
	change with releases. To provide a stable way to enter a desired
	algorithm choice the prompt also accepts predefined names for the
	algorithms, which will not change.

	\| Name \| No \| Description \|
	\|---------+----+---------------------------------\|
	\| rsa+rsa \| 1 \| RSA and RSA (default) \|
	\| dsa+elg \| 2 \| DSA and Elgamal \|
	\| dsa \| 3 \| DSA (sign only) \|
	\| rsa/s \| 4 \| RSA (sign only) \|
	\| elg \| 5 \| Elgamal (encrypt only) \|
	\| rsa/e \| 6 \| RSA (encrypt only) \|
	\| dsa/* \| 7 \| DSA (set your own capabilities) \|
	\| rsa/* \| 8 \| RSA (set your own capabilities) \|
	\| ecc+ecc \| 9 \| ECC and ECC \|
	\| ecc/s \| 10 \| ECC (sign only) \|
	\| ecc/* \| 11 \| ECC (set your own capabilities) \|
	\| ecc/e \| 12 \| ECC (encrypt only) \|
	\| keygrip \| 13 \| Existing key \|

	If one of the "foo/*" names are used a "keygen.flags" prompt needs
	to be answered as well. Instead of toggling the predefined flags,
	it is also possible to set them direct: Use a "=" character
	directly followed by a comination of "a" (for authentication), "s"
	(for signing), or "c" (for certification).
	diff --git a/doc/TRANSLATE b/doc/TRANSLATE
	index 7c3e54468..9bd9b089c 100644
	--- a/doc/TRANSLATE
	+++ b/doc/TRANSLATE
	@@ -1,61 +1,61 @@
	$Id$

	Note for translators
	--------------------

	Some strings in GnuPG are for matching user input against. These
	strings can accept multiple values that mean essentially the same
	thing.

	For example, the string "yes" in English is "sí" in Spanish. However,
	some users will type "si" (without the accent). To accommodate both
	users, you can translate the string "yes" as "sí\|si". You can have
	any number of alternate matches separated by the \| character like
	"sí\|si\|seguro".

	The strings that can be handled in this way are of the form "yes\|yes",
	(or "no\|no", etc.) There should also be a comment in the .po file
	directing you to this file.


	Help files
	----------

	GnuPG provides a little help feature (entering a ? on a prompt). This
	help used to be translated the usual way with gettext but it turned
	out that this is too inflexible and does for example not allow
	correcting little mistakes in the English text. For some newer features
	we require editable help files anyway and thus the existing help
	strings have been moved to plain text files names "help.LL.txt". We
	distribute these files and allow overriding them by files of that name
	in /etc/gnupg. The syntax of these files is documented in
	doc/help.txt. This is also the original we use to describe new
	possible online help keys. The source files are located in doc/ and
	need to be in encoded in UTF-8. Strings which require a translation
	are disabled like this

	.#gpgsm.some.help-item
	This string is not translated.

	-After translation you should remove the the hash mark so that the
	+After translation you should remove the hash mark so that the
	entry looks like.

	.gpgsm.some.help-item
	This string has been translated.

	The percent sign is not a special character and if there is something
	to watch out there will be a remark.



	Sending new or updated translations
	-----------------------------------

	Please note that we do not use the TP Robot but require that
	translations are to be send by mail to translations@gnupg.org. We
	also strongly advise to get subscribed to i18n@gnupg.org and request
	assistance if it is not clear on how to translate certain strings. A
	wrongly translated string may lead to a security problem.

	A copyright disclaimer to the FSF is not anymore required since
	December 2012.
	diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
	index 7fc11a2aa..7a6ba47b4 100644
	--- a/doc/dirmngr.texi
	+++ b/doc/dirmngr.texi
	@@ -1,1157 +1,1157 @@
	@c Copyright (C) 2002 Klar"alvdalens Datakonsult AB
	@c Copyright (C) 2004, 2005, 2006, 2007 g10 Code GmbH
	@c This is part of the GnuPG manual.
	@c For copying conditions, see the file gnupg.texi.

	@include defs.inc

	@node Invoking DIRMNGR
	@chapter Invoking DIRMNGR
	@cindex DIRMNGR command options
	@cindex command options
	@cindex options, DIRMNGR command

	@manpage dirmngr.8
	@ifset manverb
	.B dirmngr
	\- CRL and OCSP daemon
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B dirmngr
	.RI [ options ]
	.I command
	.RI [ args ]
	@end ifset

	@mansect description
	Since version 2.1 of GnuPG, @command{dirmngr} takes care of accessing
	the OpenPGP keyservers. As with previous versions it is also used as
	a server for managing and downloading certificate revocation lists
	(CRLs) for X.509 certificates, downloading X.509 certificates, and
	providing access to OCSP providers. Dirmngr is invoked internally by
	@command{gpg}, @command{gpgsm}, or via the @command{gpg-connect-agent}
	tool.

	@manpause
	@noindent
	@xref{Option Index},for an index to @command{DIRMNGR}'s commands and
	options.
	@mancont

	@menu
	* Dirmngr Commands:: List of all commands.
	* Dirmngr Options:: List of all options.
	* Dirmngr Configuration:: Configuration files.
	* Dirmngr Signals:: Use of signals.
	* Dirmngr Examples:: Some usage examples.
	* Dirmngr Protocol:: The protocol dirmngr uses.
	@end menu


	@node Dirmngr Commands
	@section Commands
	@mansect commands

	Commands are not distinguished from options except for the fact that
	only one command is allowed.

	@table @gnupgtabopt
	@item --version
	@opindex version
	Print the program version and licensing information. Note that you cannot
	abbreviate this command.

	@item --help, -h
	@opindex help
	Print a usage message summarizing the most useful command-line options.
	Note that you cannot abbreviate this command.

	@item --dump-options
	@opindex dump-options
	Print a list of all available options and commands. Note that you cannot
	abbreviate this command.

	@item --server
	@opindex server
	Run in server mode and wait for commands on the @code{stdin}. The
	default mode is to create a socket and listen for commands there.
	This is only used for testing.

	@item --daemon
	@opindex daemon
	Run in background daemon mode and listen for commands on a socket.
	This is the way @command{dirmngr} is started on demand by the other
	GnuPG components. To force starting @command{dirmngr} it is in
	general best to use @code{gpgconf --launch dirmngr}.

	@item --supervised
	@opindex supervised
	Run in the foreground, sending logs to stderr, and listening on file
	descriptor 3, which must already be bound to a listening socket. This
	is useful when running under systemd or other similar process
	supervision schemes. This option is not supported on Windows.

	@item --list-crls
	@opindex list-crls
	List the contents of the CRL cache on @code{stdout}. This is probably
	only useful for debugging purposes.

	@item --load-crl @var{file}
	@opindex load-crl
	This command requires a filename as additional argument, and it will
	make Dirmngr try to import the CRL in @var{file} into it's cache.
	Note, that this is only possible if Dirmngr is able to retrieve the
	CA's certificate directly by its own means. In general it is better
	to use @code{gpgsm}'s @code{--call-dirmngr loadcrl filename} command
	so that @code{gpgsm} can help dirmngr.

	@item --fetch-crl @var{url}
	@opindex fetch-crl
	This command requires an URL as additional argument, and it will make
	dirmngr try to retrieve and import the CRL from that @var{url} into
	it's cache. This is mainly useful for debugging purposes. The
	@command{dirmngr-client} provides the same feature for a running dirmngr.

	@item --shutdown
	@opindex shutdown
	This commands shuts down an running instance of Dirmngr. This command
	has currently no effect.

	@item --flush
	@opindex flush
	This command removes all CRLs from Dirmngr's cache. Client requests
	will thus trigger reading of fresh CRLs.

	@end table


	@mansect options
	@node Dirmngr Options
	@section Option Summary

	Note that all long options with the exception of @option{--options}
	and @option{--homedir} may also be given in the configuration file
	after stripping off the two leading dashes.

	@table @gnupgtabopt

	@item --options @var{file}
	@opindex options
	Reads configuration from @var{file} instead of from the default
	per-user configuration file. The default configuration file is named
	@file{dirmngr.conf} and expected in the home directory.

	@item --homedir @var{dir}
	@opindex options
	Set the name of the home directory to @var{dir}. This option is only
	effective when used on the command line. The default is
	the directory named @file{.gnupg} directly below the home directory
	of the user unless the environment variable @code{GNUPGHOME} has been set
	in which case its value will be used. Many kinds of data are stored within
	this directory.


	@item -v
	@item --verbose
	@opindex v
	@opindex verbose
	Outputs additional information while running.
	You can increase the verbosity by giving several
	verbose commands to @sc{dirmngr}, such as @option{-vv}.


	@item --log-file @var{file}
	@opindex log-file
	Append all logging output to @var{file}. This is very helpful in
	seeing what the agent actually does. Use @file{socket://} to log to
	socket.

	@item --debug-level @var{level}
	@opindex debug-level
	Select the debug level for investigating problems. @var{level} may be a
	numeric value or by a keyword:

	@table @code
	@item none
	No debugging at all. A value of less than 1 may be used instead of
	the keyword.
	@item basic
	Some basic debug messages. A value between 1 and 2 may be used
	instead of the keyword.
	@item advanced
	More verbose debug messages. A value between 3 and 5 may be used
	instead of the keyword.
	@item expert
	Even more detailed messages. A value between 6 and 8 may be used
	instead of the keyword.
	@item guru
	All of the debug messages you can get. A value greater than 8 may be
	used instead of the keyword. The creation of hash tracing files is
	only enabled if the keyword is used.
	@end table

	How these messages are mapped to the actual debugging flags is not
	specified and may change with newer releases of this program. They are
	however carefully selected to best aid in debugging.

	@item --debug @var{flags}
	@opindex debug
	Set debugging flags. This option is only useful for debugging and its
	behavior may change with a new release. All flags are or-ed and may
	be given in C syntax (e.g. 0x0042) or as a comma separated list of
	flag names. To get a list of all supported flags the single word
	"help" can be used.

	@item --debug-all
	@opindex debug-all
	Same as @code{--debug=0xffffffff}

	@item --gnutls-debug @var{level}
	@opindex gnutls-debug
	Enable debugging of GNUTLS at @var{level}.

	@item --debug-wait @var{n}
	@opindex debug-wait
	When running in server mode, wait @var{n} seconds before entering the
	actual processing loop and print the pid. This gives time to attach a
	debugger.

	@item --disable-check-own-socket
	@opindex disable-check-own-socket
	On some platforms @command{dirmngr} is able to detect the removal of
	its socket file and shutdown itself. This option disable this
	self-test for debugging purposes.

	@item -s
	@itemx --sh
	@itemx -c
	@itemx --csh
	@opindex s
	@opindex sh
	@opindex c
	@opindex csh
	Format the info output in daemon mode for use with the standard Bourne
	shell respective the C-shell. The default is to guess it based on the
	environment variable @code{SHELL} which is in almost all cases
	sufficient.

	@item --force
	@opindex force
	Enabling this option forces loading of expired CRLs; this is only
	useful for debugging.

	@item --use-tor
	@opindex use-tor
	This option switches Dirmngr and thus GnuPG into ``Tor mode'' to route
	all network access via Tor (an anonymity network). Certain other
	features are disabled if this mode is active.

	@item --standard-resolver
	@opindex standard-resolver
	This option forces the use of the system's standard DNS resolver code.
	This is mainly used for debugging. Note that on Windows a standard
	resolver is not used and all DNS access will return the error ``Not
	Implemented'' if this function is used.

	@item --recursive-resolver
	@opindex recursive-resolver
	When possible use a recursive resolver instead of a stub resolver.

	@item --resolver-timeout @var{n}
	Set the timeout for the DNS resolver to N seconds. The default are 30
	seconds.

	@item --allow-version-check
	@opindex allow-version-check
	Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get
	the list of current software versions. If this option is enabled
	the list is retrieved in case the local
	copy does not exist or is older than 5 to 7 days. See the option
	@option{--query-swdb} of the command @command{gpgconf} for more
	details. Note, that regardless of this option a version check can
	always be triggered using this command:

	@example
	gpg-connect-agent --dirmngr 'loadswdb --force' /bye
	@end example


	@item --keyserver @var{name}
	@opindex keyserver
	Use @var{name} as your keyserver. This is the server that @command{gpg}
	communicates with to receive keys, send keys, and search for
	keys. The format of the @var{name} is a URI:
	`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
	"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
	keyservers, or "mailto" for the Graff email keyserver. Note that your
	particular installation of GnuPG may have other keyserver types
	available as well. Keyserver schemes are case-insensitive. After the
	keyserver name, optional keyserver configuration options may be
	provided. These are the same as the @option{--keyserver-options} of
	@command{gpg}, but apply only to this particular keyserver.

	Most keyservers synchronize with each other, so there is generally no
	need to send keys to more than one server. The keyserver
	@code{hkp://keys.gnupg.net} uses round robin DNS to give a different
	keyserver each time you use it.

	If exactly two keyservers are configured and only one is a Tor hidden
	service (.onion), Dirmngr selects the keyserver to use depending on
	whether Tor is locally running or not. The check for a running Tor is
	done for each new connection.

	If no keyserver is explicitly configured, dirmngr will use the
	built-in default of hkps://hkps.pool.sks-keyservers.net.

	@item --nameserver @var{ipaddr}
	@opindex nameserver
	In ``Tor mode'' Dirmngr uses a public resolver via Tor to resolve DNS
	names. If the default public resolver, which is @code{8.8.8.8}, shall
	not be used a different one can be given using this option. Note that
	a numerical IP address must be given (IPv6 or IPv4) and that no error
	checking is done for @var{ipaddr}.

	@item --disable-ipv4
	@opindex disable-ipv4
	Disable the use of all IPv4 addresses. This option is mainly useful
	for debugging.

	@item --disable-ldap
	@opindex disable-ldap
	Entirely disables the use of LDAP.

	@item --disable-http
	@opindex disable-http
	Entirely disables the use of HTTP.

	@item --ignore-http-dp
	@opindex ignore-http-dp
	When looking for the location of a CRL, the to be tested certificate
	usually contains so called @dfn{CRL Distribution Point} (DP) entries
	which are URLs describing the way to access the CRL. The first found DP
	entry is used. With this option all entries using the @acronym{HTTP}
	scheme are ignored when looking for a suitable DP.

	@item --ignore-ldap-dp
	@opindex ignore-ldap-dp
	This is similar to @option{--ignore-http-dp} but ignores entries using
	the @acronym{LDAP} scheme. Both options may be combined resulting in
	ignoring DPs entirely.

	@item --ignore-ocsp-service-url
	@opindex ignore-ocsp-service-url
	Ignore all OCSP URLs contained in the certificate. The effect is to
	force the use of the default responder.

	@item --honor-http-proxy
	@opindex honor-http-proxy
	If the environment variable @env{http_proxy} has been set, use its
	value to access HTTP servers.

	@item --http-proxy @var{host}[:@var{port}]
	@opindex http-proxy
	@efindex http_proxy
	Use @var{host} and @var{port} to access HTTP servers. The use of this
	option overrides the environment variable @env{http_proxy} regardless
	whether @option{--honor-http-proxy} has been set.


	@item --ldap-proxy @var{host}[:@var{port}]
	@opindex ldap-proxy
	Use @var{host} and @var{port} to connect to LDAP servers. If @var{port}
	is omitted, port 389 (standard LDAP port) is used. This overrides any
	specified host and port part in a LDAP URL and will also be used if host
	and port have been omitted from the URL.

	@item --only-ldap-proxy
	@opindex only-ldap-proxy
	Never use anything else but the LDAP "proxy" as configured with
	@option{--ldap-proxy}. Usually @command{dirmngr} tries to use other
	configured LDAP server if the connection using the "proxy" failed.


	@item --ldapserverlist-file @var{file}
	@opindex ldapserverlist-file
	Read the list of LDAP servers to consult for CRLs and certificates from
	file instead of the default per-user ldap server list file. The default
	value for @var{file} is @file{dirmngr_ldapservers.conf}.

	This server list file contains one LDAP server per line in the format

	@sc{hostname:port:username:password:base_dn}

	Lines starting with a @samp{#} are comments.

	Note that as usual all strings entered are expected to be UTF-8 encoded.
	Obviously this will lead to problems if the password has originally been
	encoded as Latin-1. There is no other solution here than to put such a
	password in the binary encoding into the file (i.e. non-ascii characters
	won't show up readable).@footnote{The @command{gpgconf} tool might be
	helpful for frontends as it enables editing this configuration file using
	percent-escaped strings.}


	@item --ldaptimeout @var{secs}
	@opindex ldaptimeout
	Specify the number of seconds to wait for an LDAP query before timing
	out. The default is currently 100 seconds. 0 will never timeout.


	@item --add-servers
	@opindex add-servers
	This option makes dirmngr add any servers it discovers when validating
	certificates against CRLs to the internal list of servers to consult for
	certificates and CRLs.

	This option is useful when trying to validate a certificate that has
	a CRL distribution point that points to a server that is not already
	listed in the ldapserverlist. Dirmngr will always go to this server and
	try to download the CRL, but chances are high that the certificate used
	to sign the CRL is located on the same server. So if dirmngr doesn't add
	that new server to list, it will often not be able to verify the
	signature of the CRL unless the @code{--add-servers} option is used.

	Note: The current version of dirmngr has this option disabled by default.


	@item --allow-ocsp
	@opindex allow-ocsp
	This option enables OCSP support if requested by the client.

	OCSP requests are rejected by default because they may violate the
	privacy of the user; for example it is possible to track the time when
	a user is reading a mail.


	@item --ocsp-responder @var{url}
	@opindex ocsp-responder
	Use @var{url} as the default OCSP Responder if the certificate does
	not contain information about an assigned responder. Note, that
	@code{--ocsp-signer} must also be set to a valid certificate.

	@item --ocsp-signer @var{fpr}\|@var{file}
	@opindex ocsp-signer
	Use the certificate with the fingerprint @var{fpr} to check the
	responses of the default OCSP Responder. Alternatively a filename can be
	given in which case the response is expected to be signed by one of the
	certificates described in that file. Any argument which contains a
	slash, dot or tilde is considered a filename. Usual filename expansion
	takes place: A tilde at the start followed by a slash is replaced by the
	content of @env{HOME}, no slash at start describes a relative filename
	which will be searched at the home directory. To make sure that the
	@var{file} is searched in the home directory, either prepend the name
	with "./" or use a name which contains a dot.

	If a response has been signed by a certificate described by these
	fingerprints no further check upon the validity of this certificate is
	done.

	The format of the @var{FILE} is a list of SHA-1 fingerprint, one per
	line with optional colons between the bytes. Empty lines and lines
	prefix with a hash mark are ignored.


	@item --ocsp-max-clock-skew @var{n}
	@opindex ocsp-max-clock-skew
	The number of seconds a skew between the OCSP responder and them local
	clock is accepted. Default is 600 (10 minutes).

	@item --ocsp-max-period @var{n}
	@opindex ocsp-max-period
	Seconds a response is at maximum considered valid after the time given
	in the thisUpdate field. Default is 7776000 (90 days).

	@item --ocsp-current-period @var{n}
	@opindex ocsp-current-period
	The number of seconds an OCSP response is considered valid after the
	time given in the NEXT_UPDATE datum. Default is 10800 (3 hours).


	@item --max-replies @var{n}
	@opindex max-replies
	Do not return more that @var{n} items in one query. The default is
	10.

	@item --ignore-cert-extension @var{oid}
	@opindex ignore-cert-extension
	Add @var{oid} to the list of ignored certificate extensions. The
	@var{oid} is expected to be in dotted decimal form, like
	@code{2.5.29.3}. This option may be used more than once. Critical
	flagged certificate extensions matching one of the OIDs in the list
	are treated as if they are actually handled and thus the certificate
	won't be rejected due to an unknown critical extension. Use this
	option with care because extensions are usually flagged as critical
	for a reason.

	@item --hkp-cacert @var{file}
	Use the root certificates in @var{file} for verification of the TLS
	certificates used with @code{hkps} (keyserver access over TLS). If
	the file is in PEM format a suffix of @code{.pem} is expected for
	@var{file}. This option may be given multiple times to add more
	root certificates. Tilde expansion is supported.

	If no @code{hkp-cacert} directive is present, dirmngr will make a
	reasonable choice: if the keyserver in question is the special pool
	@code{hkps.pool.sks-keyservers.net}, it will use the bundled root
	certificate for that pool. Otherwise, it will use the system CAs.

	@end table


	@c
	@c Dirmngr Configuration
	@c
	@mansect files
	@node Dirmngr Configuration
	@section Configuration

	Dirmngr makes use of several directories when running in daemon mode:
	There are a few configuration files whih control the operation of
	dirmngr. By default they may all be found in the current home
	directory (@pxref{option --homedir}).

	@table @file

	@item dirmngr.conf
	@efindex dirmngr.conf
	This is the standard configuration file read by @command{dirmngr} on
	startup. It may contain any valid long option; the leading two dashes
	may not be entered and the option may not be abbreviated. This file
	is also read after a @code{SIGHUP} however not all options will
	actually have an effect. This default name may be changed on the
	command line (@pxref{option --options}). You should backup this file.

	@item /etc/gnupg/trusted-certs
	This directory should be filled with certificates of Root CAs you
	are trusting in checking the CRLs and signing OCSP Responses.

	Usually these are the same certificates you use with the applications
	making use of dirmngr. It is expected that each of these certificate
	files contain exactly one @acronym{DER} encoded certificate in a file
	with the suffix @file{.crt} or @file{.der}. @command{dirmngr} reads
	those certificates on startup and when given a SIGHUP. Certificates
	which are not readable or do not make up a proper X.509 certificate
	are ignored; see the log file for details.

	Applications using dirmngr (e.g. gpgsm) can request these
	certificates to complete a trust chain in the same way as with the
	extra-certs directory (see below).

	Note that for OCSP responses the certificate specified using the option
	@option{--ocsp-signer} is always considered valid to sign OCSP requests.

	@item /etc/gnupg/extra-certs
	This directory may contain extra certificates which are preloaded
	into the internal cache on startup. Applications using dirmngr (e.g. gpgsm)
	can request cached certificates to complete a trust chain.
	This is convenient in cases you have a couple intermediate CA certificates
	or certificates usually used to sign OCSP responses.
	These certificates are first tried before going
	out to the net to look for them. These certificates must also be
	@acronym{DER} encoded and suffixed with @file{.crt} or @file{.der}.

	@item ~/.gnupg/crls.d
	This directory is used to store cached CRLs. The @file{crls.d}
	part will be created by dirmngr if it does not exists but you need to
	make sure that the upper directory exists.

	@end table
	@manpause

	To be able to see what's going on you should create the configure file
	@file{~/gnupg/dirmngr.conf} with at least one line:

	@example
	log-file ~/dirmngr.log
	@end example

	To be able to perform OCSP requests you probably want to add the line:

	@example
	allow-ocsp
	@end example

	To make sure that new options are read and that after the installation
	of a new GnuPG versions the installed dirmngr is running, you may want
	to kill an existing dirmngr first:

	@example
	gpgconf --kill dirmngr
	@end example

	You may check the log file to see whether all desired root
	certificates have been loaded correctly.


	@c
	@c Dirmngr Signals
	@c
	@mansect signals
	@node Dirmngr Signals
	@section Use of signals

	A running @command{dirmngr} may be controlled by signals, i.e. using
	the @command{kill} command to send a signal to the process.

	Here is a list of supported signals:

	@table @gnupgtabopt

	@item SIGHUP
	@cpindex SIGHUP
	This signal flushes all internally cached CRLs as well as any cached
	certificates. Then the certificate cache is reinitialized as on
	startup. Options are re-read from the configuration file. Instead of
	sending this signal it is better to use
	@example
	gpgconf --reload dirmngr
	@end example

	@item SIGTERM
	@cpindex SIGTERM
	Shuts down the process but waits until all current requests are
	fulfilled. If the process has received 3 of these signals and requests
	are still pending, a shutdown is forced. You may also use
	@example
	gpgconf --kill dirmngr
	@end example
	instead of this signal

	@item SIGINT
	@cpindex SIGINT
	Shuts down the process immediately.


	@item SIGUSR1
	@cpindex SIGUSR1
	This prints some caching statistics to the log file.

	@end table



	@c
	@c Examples
	@c
	@mansect examples
	@node Dirmngr Examples
	@section Examples

	Here is an example on how to show dirmngr's internal table of OpenPGP
	keyserver addresses. The output is intended for debugging purposes
	and not part of a defined API.

	@example
	gpg-connect-agent --dirmngr 'keyserver --hosttable' /bye
	@end example

	To inhibit the use of a particular host you have noticed in one of the
	keyserver pools, you may use

	@example
	gpg-connect-agent --dirmngr 'keyserver --dead pgpkeys.bnd.de' /bye
	@end example

	The description of the @code{keyserver} command can be printed using

	@example
	gpg-connect-agent --dirmngr 'help keyserver' /bye
	@end example



	@c
	@c Assuan Protocol
	@c
	@manpause
	@node Dirmngr Protocol
	@section Dirmngr's Assuan Protocol

	Assuan is the IPC protocol used to access dirmngr. This is a
	description of the commands implemented by dirmngr.

	@menu
	* Dirmngr LOOKUP:: Look up a certificate via LDAP
	* Dirmngr ISVALID:: Validate a certificate using a CRL or OCSP.
	* Dirmngr CHECKCRL:: Validate a certificate using a CRL.
	* Dirmngr CHECKOCSP:: Validate a certificate using OCSP.
	* Dirmngr CACHECERT:: Put a certificate into the internal cache.
	* Dirmngr VALIDATE:: Validate a certificate for debugging.
	@end menu

	@node Dirmngr LOOKUP
	@subsection Return the certificate(s) found

	Lookup certificate. To allow multiple patterns (which are ORed)
	quoting is required: Spaces are to be translated into "+" or into
	"%20"; obviously this requires that the usual escape quoting rules
	are applied. The server responds with:

	@example
	S: D <DER encoded certificate>
	S: END
	S: D <second DER encoded certificate>
	S: END
	S: OK
	@end example

	In this example 2 certificates are returned. The server may return
	any number of certificates; OK will also be returned when no
	certificates were found. The dirmngr might return a status line

	@example
	S: S TRUNCATED <n>
	@end example


	To indicate that the output was truncated to N items due to a
	limitation of the server or by an arbitrary set limit.

	The option @option{--url} may be used if instead of a search pattern a
	complete URL to the certificate is known:

	@example
	C: LOOKUP --url CN%3DWerner%20Koch,o%3DIntevation%20GmbH,c%3DDE?userCertificate
	@end example

	If the option @option{--cache-only} is given, no external lookup is done
	so that only certificates from the cache are returned.

	With the option @option{--single}, the first and only the first match
	will be returned. Unless option @option{--cache-only} is also used, no
	local lookup will be done in this case.



	@node Dirmngr ISVALID
	@subsection Validate a certificate using a CRL or OCSP

	@example
	ISVALID [--only-ocsp] [--force-default-responder] @var{certid}\|@var{certfpr}
	@end example

	Check whether the certificate described by the @var{certid} has been
	revoked. Due to caching, the Dirmngr is able to answer immediately in
	most cases.

	The @var{certid} is a hex encoded string consisting of two parts,
	delimited by a single dot. The first part is the SHA-1 hash of the
	issuer name and the second part the serial number.

	Alternatively the certificate's SHA-1 fingerprint @var{certfpr} may be
	given in which case an OCSP request is done before consulting the CRL.
	If the option @option{--only-ocsp} is given, no fallback to a CRL check
	will be used. If the option @option{--force-default-responder} is
	given, only the default OCSP responder will be used and any other
	methods of obtaining an OCSP responder URL won't be used.

	@noindent
	Common return values are:

	@table @code
	@item GPG_ERR_NO_ERROR (0)
	This is the positive answer: The certificate is not revoked and we have
	an up-to-date revocation list for that certificate. If OCSP was used
	the responder confirmed that the certificate has not been revoked.

	@item GPG_ERR_CERT_REVOKED
	This is the negative answer: The certificate has been revoked. Either
	it is in a CRL and that list is up to date or an OCSP responder informed
	us that it has been revoked.

	@item GPG_ERR_NO_CRL_KNOWN
	No CRL is known for this certificate or the CRL is not valid or out of
	date.

	@item GPG_ERR_NO_DATA
	The OCSP responder returned an ``unknown'' status. This means that it
	is not aware of the certificate's status.

	@item GPG_ERR_NOT_SUPPORTED
	This is commonly seen if OCSP support has not been enabled in the
	configuration.
	@end table

	If DirMngr has not enough information about the given certificate (which
	-is the case for not yet cached certificates), it will will inquire the
	+is the case for not yet cached certificates), it will inquire the
	missing data:

	@example
	S: INQUIRE SENDCERT <CertID>
	C: D <DER encoded certificate>
	C: END
	@end example

	A client should be aware that DirMngr may ask for more than one
	certificate.

	If Dirmngr has a certificate but the signature of the certificate
	could not been validated because the root certificate is not known to
	dirmngr as trusted, it may ask back to see whether the client trusts
	this the root certificate:

	@example
	S: INQUIRE ISTRUSTED <CertHexfpr>
	C: D 1
	C: END
	@end example

	Only this answer will let Dirmngr consider the certificate as valid.


	@node Dirmngr CHECKCRL
	@subsection Validate a certificate using a CRL

	Check whether the certificate with FINGERPRINT (SHA-1 hash of the
	entire X.509 certificate blob) is valid or not by consulting the CRL
	responsible for this certificate. If the fingerprint has not been
	given or the certificate is not known, the function inquires the
	certificate using:

	@example
	S: INQUIRE TARGETCERT
	C: D <DER encoded certificate>
	C: END
	@end example

	Thus the caller is expected to return the certificate for the request
	(which should match FINGERPRINT) as a binary blob. Processing then
	takes place without further interaction; in particular dirmngr tries
	to locate other required certificate by its own mechanism which
	includes a local certificate store as well as a list of trusted root
	certificates.

	@noindent
	The return code is 0 for success; i.e. the certificate has not been
	revoked or one of the usual error codes from libgpg-error.

	@node Dirmngr CHECKOCSP
	@subsection Validate a certificate using OCSP

	@example
	CHECKOCSP [--force-default-responder] [@var{fingerprint}]
	@end example

	Check whether the certificate with @var{fingerprint} (the SHA-1 hash of
	the entire X.509 certificate blob) is valid by consulting the appropriate
	OCSP responder. If the fingerprint has not been given or the
	certificate is not known by Dirmngr, the function inquires the
	certificate using:

	@example
	S: INQUIRE TARGETCERT
	C: D <DER encoded certificate>
	C: END
	@end example

	Thus the caller is expected to return the certificate for the request
	(which should match @var{fingerprint}) as a binary blob. Processing
	then takes place without further interaction; in particular dirmngr
	tries to locate other required certificates by its own mechanism which
	includes a local certificate store as well as a list of trusted root
	certificates.

	If the option @option{--force-default-responder} is given, only the
	default OCSP responder is used. This option is the per-command variant
	of the global option @option{--ignore-ocsp-service-url}.


	@noindent
	The return code is 0 for success; i.e. the certificate has not been
	revoked or one of the usual error codes from libgpg-error.

	@node Dirmngr CACHECERT
	@subsection Put a certificate into the internal cache

	Put a certificate into the internal cache. This command might be
	useful if a client knows in advance certificates required for a test and
	wants to make sure they get added to the internal cache. It is also
	helpful for debugging. To get the actual certificate, this command
	immediately inquires it using

	@example
	S: INQUIRE TARGETCERT
	C: D <DER encoded certificate>
	C: END
	@end example

	Thus the caller is expected to return the certificate for the request
	as a binary blob.

	@noindent
	The return code is 0 for success; i.e. the certificate has not been
	successfully cached or one of the usual error codes from libgpg-error.

	@node Dirmngr VALIDATE
	@subsection Validate a certificate for debugging

	Validate a certificate using the certificate validation function used
	internally by dirmngr. This command is only useful for debugging. To
	get the actual certificate, this command immediately inquires it using

	@example
	S: INQUIRE TARGETCERT
	C: D <DER encoded certificate>
	C: END
	@end example

	Thus the caller is expected to return the certificate for the request
	as a binary blob.


	@mansect see also
	@ifset isman
	@command{gpgsm}(1),
	@command{dirmngr-client}(1)
	@end ifset
	@include see-also-note.texi

	@c
	@c !!! UNDER CONSTRUCTION !!!
	@c
	@c
	@c @section Verifying a Certificate
	@c
	@c There are several ways to request services from Dirmngr. Almost all of
	@c them are done using the Assuan protocol. What we describe here is the
	@c Assuan command CHECKCRL as used for example by the dirmnr-client tool if
	@c invoked as
	@c
	@c @example
	@c dirmngr-client foo.crt
	@c @end example
	@c
	@c This command will send an Assuan request to an already running Dirmngr
	@c instance. foo.crt is expected to be a standard X.509 certificate and
	@c dirmngr will receive the Assuan command
	@c
	@c @example
	@c CHECKCRL @var [{fingerprint}]
	@c @end example
	@c
	@c @var{fingerprint} is optional and expected to be the SHA-1 has of the
	@c DER encoding of the certificate under question. It is to be HEX
	@c encoded. The rationale for sending the fingerprint is that it allows
	@c dirmngr to reply immediately if it has already cached such a request. If
	@c this is not the case and no certificate has been found in dirmngr's
	@c internal certificate storage, dirmngr will request the certificate using
	@c the Assuan inquiry
	@c
	@c @example
	@c INQUIRE TARGETCERT
	@c @end example
	@c
	@c The caller (in our example dirmngr-client) is then expected to return
	@c the certificate for the request (which should match @var{fingerprint})
	@c as a binary blob.
	@c
	@c Dirmngr now passes control to @code{crl_cache_cert_isvalid}. This
	@c function checks whether a CRL item exists for target certificate. These
	@c CRL items are kept in a database of already loaded and verified CRLs.
	@c This mechanism is called the CRL cache. Obviously timestamps are kept
	@c there with each item to cope with the expiration date of the CRL. The
	@c possible return values are: @code{0} to indicate that a valid CRL is
	@c available for the certificate and the certificate itself is not listed
	@c in this CRL, @code{GPG_ERR_CERT_REVOKED} to indicate that the certificate is
	@c listed in the CRL or @code{GPG_ERR_NO_CRL_KNOWN} in cases where no CRL or no
	@c information is available. The first two codes are immediately returned to
	@c the caller and the processing of this request has been done.
	@c
	@c Only the @code{GPG_ERR_NO_CRL_KNOWN} needs more attention: Dirmngr now
	@c calls @code{clr_cache_reload_crl} and if this succeeds calls
	@c @code{crl_cache_cert_isvald) once more. All further errors are
	@c immediately returned to the caller.
	@c
	@c @code{crl_cache_reload_crl} is the actual heart of the CRL management.
	@c It locates the corresponding CRL for the target certificate, reads and
	@c verifies this CRL and stores it in the CRL cache. It works like this:
	@c
	@c * Loop over all crlDPs in the target certificate.
	@c * If the crlDP is invalid immediately terminate the loop.
	@c * Loop over all names in the current crlDP.
	@c * If the URL scheme is unknown or not enabled
	@c (--ignore-http-dp, --ignore-ldap-dp) continues with
	@c the next name.
	@c * @code{crl_fetch} is called to actually retrieve the CRL.
	@c In case of problems this name is ignore and we continue with
	@c the next name. Note that @code{crl_fetch} does only return
	@c a descriptor for the CRL for further reading so does the CRL
	@c does not yet end up in memory.
	@c * @code{crl_cache_insert} is called with that descriptor to
	@c actually read the CRL into the cache. See below for a
	@c description of this function. If there is any error (e.g. read
	@c problem, CRL not correctly signed or verification of signature
	@c not possible), this descriptor is rejected and we continue
	@c with the next name. If the CRL has been successfully loaded,
	@c the loop is terminated.
	@c * If no crlDP has been found in the previous loop use a default CRL.
	@c Note, that if any crlDP has been found but loading of the CRL failed,
	@c this condition is not true.
	@c * Try to load a CRL from all configured servers (ldapservers.conf)
	@c in turn. The first server returning a CRL is used.
	@c * @code(crl_cache_insert) is then used to actually insert the CRL
	@c into the cache. If this failed we give up immediately without
	@c checking the rest of the servers from the first step.
	@c * Ready.
	@c
	@c
	@c The @code{crl_cache_insert} function takes care of reading the bulk of
	@c the CRL, parsing it and checking the signature. It works like this: A
	@c new database file is created using a temporary file name. The CRL
	@c parsing machinery is started and all items of the CRL are put into
	@c this database file. At the end the issuer certificate of the CRL
	@c needs to be retrieved. Three cases are to be distinguished:
	@c
	@c a) An authorityKeyIdentifier with an issuer and serialno exits: The
	@c certificate is retrieved using @code{find_cert_bysn}. If
	@c the certificate is in the certificate cache, it is directly
	@c returned. Then the requester (i.e. the client who requested the
	@c CRL check) is asked via the Assuan inquiry ``SENDCERT'' whether
	@c he can provide this certificate. If this succeed the returned
	@c certificate gets cached and returned. Note, that dirmngr does not
	@c verify in any way whether the expected certificate is returned.
	@c It is in the interest of the client to return a useful certificate
	@c as otherwise the service request will fail due to a bad signature.
	@c The last way to get the certificate is by looking it up at
	@c external resources. This is done using the @code{ca_cert_fetch}
	@c and @code{fetch_next_ksba_cert} and comparing the returned
	@c certificate to match the requested issuer and seriano (This is
	@c needed because the LDAP layer may return several certificates as
	@c LDAP as no standard way to retrieve by serial number).
	@c
	@c b) An authorityKeyIdentifier with a key ID exists: The certificate is
	@c retrieved using @code{find_cert_bysubject}. If the certificate is
	@c in the certificate cache, it is directly returned. Then the
	@c requester is asked via the Assuan inquiry ``SENDCERT_SKI'' whether
	@c he can provide this certificate. If this succeed the returned
	@c certificate gets cached and returned. Note, that dirmngr does not
	@c verify in any way whether the expected certificate is returned.
	@c It is in the interest of the client to return a useful certificate
	@c as otherwise the service request will fail due to a bad signature.
	@c The last way to get the certificate is by looking it up at
	@c external resources. This is done using the @code{ca_cert_fetch}
	@c and @code{fetch_next_ksba_cert} and comparing the returned
	@c certificate to match the requested subject and key ID.
	@c
	@c c) No authorityKeyIdentifier exits: The certificate is retrieved
	@c using @code{find_cert_bysubject} without the key ID argument. If
	@c the certificate is in the certificate cache the first one with a
	-@c matching subject is is directly returned. Then the requester is
	+@c matching subject is directly returned. Then the requester is
	@c asked via the Assuan inquiry ``SENDCERT'' and an exact
	@c specification of the subject whether he can
	@c provide this certificate. If this succeed the returned
	@c certificate gets cached and returned. Note, that dirmngr does not
	@c verify in any way whether the expected certificate is returned.
	@c It is in the interest of the client to return a useful certificate
	@c as otherwise the service request will fail due to a bad signature.
	@c The last way to get the certificate is by looking it up at
	@c external resources. This is done using the @code{ca_cert_fetch}
	@c and @code{fetch_next_ksba_cert} and comparing the returned
	@c certificate to match the requested subject; the first certificate
	@c with a matching subject is then returned.
	@c
	@c If no certificate was found, the function returns with the error
	@c GPG_ERR_MISSING_CERT. Now the signature is verified. If this fails,
	@c the erro is returned. On success the @code{validate_cert_chain} is
	@c used to verify that the certificate is actually valid.
	@c
	@c Here we may encounter a recursive situation:
	@c @code{validate_cert_chain} needs to look at other certificates and
	@c also at CRLs to check whether these other certificates and well, the
	@c CRL issuer certificate itself are not revoked. FIXME: We need to make
	@c sure that @code{validate_cert_chain} does not try to lookup the CRL we
	@c are currently processing. This would be a catch-22 and may indicate a
	@c broken PKI. However, due to overlapping expiring times and imprecise
	@c clocks this may actually happen.
	@c
	@c For historical reasons the Assuan command ISVALID is a bit different
	@c to CHECKCRL but this is mainly due to different calling conventions.
	@c In the end the same fucntionality is used, albeit hidden by a couple
	@c of indirection and argument and result code mangling. It furthere
	@c ingetrages OCSP checking depending on options are the way it is
	@c called. GPGSM still uses this command but might eventuall switch over
	@c to CHECKCRL and CHECKOCSP so that ISVALID can be retired.
	@c
	@c
	@c @section Validating a certificate
	@c
	@c We describe here how the internal function @code{validate_cert_chain}
	@c works. Note that mainly testing purposes this functionality may be
	@c called directly using @cmd{dirmngr-client --validate @file{foo.crt}}.
	@c
	@c The function takes the target certificate and a mode argument as
	@c parameters and returns an error code and optionally the closes
	@c expiration time of all certificates in the chain.
	@c
	@c We first check that the certificate may be used for the requested
	@c purpose (i.e. OCSP or CRL signing). If this is not the case
	@c GPG_ERR_WRONG_KEY_USAGE is returned.
	@c
	@c The next step is to find the trust anchor (root certificate) and to
	@c assemble the chain in memory: Starting with the target certificate,
	@c the expiration time is checked against the current date, unknown
	@c critical extensions are detected and certificate policies are matched
	@c (We only allow 2.289.9.9 but I have no clue about that OID and from
	@c where I got it - it does not even seem to be assigned - debug cruft?).
	@c
	@c Now if this certificate is a self-signed one, we have reached the
	@c trust anchor. In this case we check that the signature is good, the
	@c certificate is allowed to act as a CA, that it is a trusted one (by
	@c checking whether it is has been put into the trusted-certs
	@c configuration directory) and finally prepend into to our list
	@c representing the certificate chain. This steps ends then.
	@c
	@c If it is not a self-signed certificate, we check that the chain won't
	@c get too long (current limit is 100), if this is the case we terminate
	@c with the error GPG_ERR_BAD_CERT_CHAIN.
	@c
	@c Now the issuer's certificate is looked up: If an
	@c authorityKeyIdentifier is available, this one is used to locate the
	@c certificate either using issuer and serialnumber or subject DN
	@c (i.e. the issuer's DN) and the keyID. The functions
	@c @code{find_cert_bysn) and @code{find_cert_bysubject} are used
	@c respectively. The have already been described above under the
	@c description of @code{crl_cache_insert}. If no certificate was found
	@c or with no authorityKeyIdentifier, only the cache is consulted using
	-@c @code{get_cert_bysubject}. The latter is is done under the assumption
	+@c @code{get_cert_bysubject}. The latter is done under the assumption
	@c that a matching certificate has explicitly been put into the
	@c certificate cache. If the issuer's certificate could not be found,
	@c the validation terminates with the error code @code{GPG_ERR_MISSING_CERT}.
	@c
	@c If the issuer's certificate has been found, the signature of the
	@c actual certificate is checked and in case this fails the error
	@c #code{GPG_ERR_BAD_CERT_CHAIN} is returned. If the signature checks out, the
	@c maximum chain length of the issuing certificate is checked as well as
	@c the capability of the certificate (i.e. whether he may be used for
	@c certificate signing). Then the certificate is prepended to our list
	@c representing the certificate chain. Finally the loop is continued now
	@c with the issuer's certificate as the current certificate.
	@c
	@c After the end of the loop and if no error as been encountered
	@c (i.e. the certificate chain has been assempled correctly), a check is
	@c done whether any certificate expired or a critical policy has not been
	@c met. In any of these cases the validation terminates with an
	@c appropriate error.
	@c
	@c Finally the function @code{check_revocations} is called to verify no
	@c certificate in the assempled chain has been revoked: This is an
	@c recursive process because a CRL has to be checked for each certificate
	@c in the chain except for the root certificate, of which we already know
	@c that it is trusted and we avoid checking a CRL here due to common
	@c setup problems and the assumption that a revoked root certifcate has
	@c been removed from the list of trusted certificates.
	@c
	@c
	@c
	@c
	@c @section Looking up certificates through LDAP.
	@c
	@c This describes the LDAP layer to retrieve certificates.
	@c the functions @code{ca_cert_fetch} and @code{fetch_next_ksba_cert} are
	@c used for this. The first one starts a search and the second one is
	@c used to retrieve certificate after certificate.
	@c


	diff --git a/doc/faq.org b/doc/faq.org
	index 8fc3775bb..f03850804 100644
	--- a/doc/faq.org
	+++ b/doc/faq.org
	@@ -1,1558 +1,1558 @@
	# faq.org -- coding: utf-8; --
	#+STARTUP: overview
	#+OPTIONS: H:2 num:t toc:t \n:nil @:t ::t \|:t ^:t *:t TeX:t
	#+EMAIL: wk@gnupg.org
	#+AUTHOR: GnuPG users
	#+LANGUAGE: en
	#+TITLE: GnuPG Frequently Asked Questions
	#+OPTIONS: H:3 num:nil toc:t \n:nil @:t ::t \|:t ^:{} -:t f:t *:t TeX:t LaTeX:t skip:nil d:(HIDE) tags:not-in-toc
	#+LINK: gnupgweb http://www.gnupg.org/
	#+LINK: roundup https://bugs.g10code.com/gnupg/issue
	#+STYLE: <link rel="stylesheet" type="text/css" href="http://www.gnupg.org/share/site.css" />

	# FIXME: This FAQ needs a heavy cleanup. For now I only switched to
	# org-mode format for easier maintenance.

	#+begin_html
	<a href="/"><img src="https://gnupg.org/share/logo-gnupg-light-purple-bg.png" class="logo-link" /></a>
	#+end_html

	WARNING: This FAQ is heavily outdated. Mentioned versions of GnuPG
	have reached end of life many years ago. Almost all bugs and problems
	have been fixed in the now current versions of GnuPG. We will try to
	update this FAQ in the next month. See the section "Changes" for recent updates.


	* Welcome
	:PROPERTIES:
	:CUSTOM_ID: welcome
	:END:

	Welcome to the GnuPG FAQ. The latest HTML version is available at\\
	[[http://www.gnupg.org/faq/GnuPG-FAQ.html]]; \\
	a plain text Gversion at \\
	ftp://ftp.gnupg.org/gcrypt/gnupg/GnuPG-FAQ.txt.

	See the end of this file for the release date.

	The index is generated automatically, so there may be errors. Not
	all questions may be in the section they belong to. Suggestions
	about how to improve the structure of this FAQ are welcome.

	Please send additions and corrections to the gnupg-users mailing
	list. It would be most convenient if you could provide the answer to
	be included here as well. Your help is very much appreciated!

	Please, don't send message like "This should be a FAQ - what's the
	answer?". If it hasn't been asked before, it isn't a FAQ. In that
	case you could search in the mailing list archive.

	** What conventions are used in this FAQ?
	:PROPERTIES:
	:CUSTOM_ID: what-conventions-are-used-in-this-faq
	:END:

	Although GnuPG is being developed for several operating systems
	(often in parallel), the conventions used in this FAQ reflect a
	UNIX shell environment. For Win32 users, references to a shell
	prompt (=$=) should be interpreted as a command prompt (=>=),
	directory names separated by a forward slash (=/=) may need to be
	converted to a back slash (=\=), and a tilde (=~=) represents a
	user's "home" directory (reference question [[id:how-do-i-put-my-keyring-in-a-different-directory][How do I put my keyring in a different directory?]] for an example).

	Some command-lines presented in this FAQ are too long to properly
	display in some browsers for the web page version of this file, and
	have been split into two or more lines. For these commands please
	remember to enter the entire command-string on one line or the
	command will error, or at minimum not give the desired results.

	Please keep in mind that this FAQ contains information that may not
	apply to your particular version, as new features and bug fixes are
	added on a continuing basis (reference the NEWS file included with
	the source or package for noteworthy changes between versions). One
	item to note is that starting with GnuPG version 1.1.92 the file
	containing user options and settings has been renamed from "options"
	to "gpg.conf". Information in the FAQ that relates to the options
	file may be interchangeable with the newer gpg.conf file in many
	instances. See question
	[[#gnupg-no-longer-installs-a-options-file-is-it-missing][GnuPG no longer installs a ~/.gnupg/options file. Is it missing?]]
	for details.

	* General Questions

	** What is GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: what-is-gnupg
	:END:

	[[gnupgweb][GnuPG]] stands for GNU Privacy Guard and is GNU's tool for secure
	communication and data storage. It can be used to encrypt data and
	to create digital signatures. It includes an advanced key
	management facility and is compliant with the proposed OpenPGP
	Internet standard as described in [[http://www.rfc-editor.org/rfc/rfc4880.txt][RFC-4880]]. As such, it is aimed
	to be compatible with PGP from PGP Corp. and other OpenPGP tools

	** Is GnuPG compatible with PGP?
	:PROPERTIES:
	:CUSTOM_ID: is-gnupg-compatible-with-pgp
	:END:

	In general, yes. GnuPG and newer PGP releases should be implementing
	the OpenPGP standard. But there are some interoperability problems.
	See question
	[[#how-can-i-encrypt-a-message-so-that-pgp-is-able-to-decrypt-it][How can I encrypt a message with GnuPG so that PGP is able to decrypt it?]]
	for details.

	** Is GnuPG free to use for personal or commercial use?
	:PROPERTIES:
	:CUSTOM_ID: is-gnupg-free-to-use
	:END:

	Yes. GnuPG is part of the GNU family of tools and applications built
	and provided in accordance with the Free Software Foundation (FSF)
	General Public License (GPL). Therefore the software is free to copy,
	use, modify and distribute in accordance with that license. Please
	read the file titled COPYING that accompanies the application for
	more information.


	* Sources of Information

	** Where can I find more information on GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: more-information-on-gnupg
	:END:

	On-line resources:

	- The documentation page is located at [[gnupgweb:documentation/]].
	Also, have a look at the HOWTOs and the GNU Privacy Handbook
	(GPH, available in English, Spanish and Russian). The latter
	provides a detailed user's guide to GnuPG. You'll also find a
	document about how to convert from PGP 2.x to GnuPG.

	- At [[gnupgweb:documentation/mailing-lists.html]] you'll find an
	online archive of the GnuPG mailing lists. Most interesting
	should be gnupg-users for all user-related issues and gnupg-devel
	if you want to get in touch with the developers.

	In addition, searchable archives can be found on MARC, e.g.:\\
	For gnupg-users : [[http://marc.theaimsgroup.com/?l=gnupg-users&r=1&w=2]]\\
	For gnupg-devel : [[http://marc.theaimsgroup.com/?l=gnupg-devel&r=1&w=2]]

	Please: Before posting to a list, read this FAQ and the
	available documentation. In addition, search the list archive
	--- maybe your question has already been discussed. This way you
	help people focus on topics that have not yet been resolved.

	- The GnuPG source distribution contains a subdirectory:

	: ./doc

	where some additional documentation is located (mainly
	interesting for hackers, not the casual user).


	** Where do I get GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: where-do-i-get-gnupg
	:END:

	You can download the GNU Privacy Guard from its primary FTP server
	[[ftp://ftp.gnupg.org/gcrypt/gnupg/][ftp.gnupg.org]] or from one of its [[gnupgweb:download/mirrors.html][mirrors]].

	The current stable version is FIXME. Please upgrade to this
	version as it includes additional features, functions and security
	fixes that may not have existed in prior versions.

	* Installation

	** Which OSes does GnuPG run on?
	:PROPERTIES:
	:CUSTOM_ID: which-oses-does-gnupg-run-on
	:END:

	It should run on most Unices as well as Windows versions
	(including Windows NT/2000) and Macintosh OS/X. A list of OSes
	reported to be OK is presented at:

	[[gnupgweb:download/supported_systems.html]]

	** Which random data gatherer should I use?
	:PROPERTIES:
	:CUSTOM_ID: which-random-data-gatherer-should-i-use
	:END:

	"Good" random numbers are crucial for the security of your encryption.
	Different operating systems provide a variety of more or less quality
	random data. Linux and *BSD provide kernel generated random data
	through /dev/random - this should be the preferred choice on these
	systems. Also Solaris users with the SUNWski package installed have
	a /dev/random. In these cases, use the configure option:

	: --enable-static-rnd=linux

	In addition, there's also the kernel random device by Andi Maier
	[[http://www.cosy.sbg.ac.at/~andi/SUNrand/]], but it's still beta. Use
	at your own risk!

	On other systems, the Entropy Gathering Daemon (EGD) is a good choice.
	It is a perl-daemon that monitors system activity and hashes it into
	random data. See the download page [[gnupgweb:download/]]
	to obtain EGD. Use:

	: --enable-static-rnd=egd

	here.

	If the above options do not work, you can use the random number
	generator "unix". This is very slow and should be avoided. The
	random quality isn't very good so don't use it on sensitive data.

	** How do I include support for RSA and IDEA?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-include-support-for-rsa-and-idea
	:END:

	RSA is included as of GnuPG version 1.0.3.

	The official GnuPG distribution does not contain IDEA due to a patent
	restriction. The patent does not expire before 2007 so don't expect
	official support before then.

	However, there is an unofficial module to include it even in earlier
	versions of GnuPG. It's available from
	[[ftp://ftp.gnupg.dk/pub/contrib-dk/]]. Look for:

	: idea.c.gz (c module)
	: idea.c.gz.sig (signature file)

	: ideadll.zip (c module and win32 dll)
	: ideadll.zip.sig (signature file)

	Compilation directives are in the headers of these files. You will
	then need to add the following line to your =~/.gnupg/gpg.conf= or
	=~/.gnupg/options= file:

	: load-extension idea


	* Usage

	** What is the recommended key size?
	:PROPERTIES:
	:CUSTOM_ID: what-is-the-recommended-key-size
	:END:

	1024 bit for DSA signatures; even for plain Elgamal signatures.
	This is sufficient as the size of the hash is probably the weakest
	link if the key size is larger than 1024 bits. Encryption keys may
	have greater sizes, but you should then check the fingerprint of
	this key:

	: $ gpg --fingerprint <user ID>

	As for the key algorithms, you should stick with the default (i.e.,
	DSA signature and Elgamal encryption). An Elgamal signing key has
	the following disadvantages: the signature is larger, it is hard
	to create such a key useful for signatures which can withstand some
	real world attacks, you don't get any extra security compared to
	DSA, and there might be compatibility problems with certain PGP
	versions. It has only been introduced because at the time it was
	not clear whether there was a patent on DSA.

	** Why does it sometimes take so long to create keys?
	:PROPERTIES:
	:CUSTOM_ID: why-does-it-sometimes-take-so-long-to-create-keys
	:END:

	The problem here is that we need a lot of random bytes and for that
	we (on Linux the /dev/random device) must collect some random data.
	It is really not easy to fill the Linux internal entropy buffer; I
	talked to Ted Ts'o and he commented that the best way to fill the
	buffer is to play with your keyboard. Good security has its price.
	What I do is to hit several times on the shift, control, alternate,
	and caps lock keys, because these keys do not produce output to the
	screen. This way you get your keys really fast (it's the same thing
	PGP2 does).

	Another problem might be another program which eats up your random
	bytes (a program (look at your daemons) that reads from /dev/random).

	** And it really takes long when I work on a remote system. Why?
	:PROPERTIES:
	:CUSTOM_ID: it-really-takes-long-when-i-work-on-a-remote-system
	:END:

	Don't do this at all! You should never create keys or even use GnuPG
	on a remote system because you normally have no physical control
	over your secret key ring (which is in most cases vulnerable to
	advanced dictionary attacks) - I strongly encourage everyone to only
	create keys on a local computer (a disconnected laptop is probably
	the best choice) and if you need it on your connected box (I know,
	we all do this) be sure to have a strong password for both your
	account and for your secret key, and that you can trust your system
	administrator.

	When I check GnuPG on a remote system via ssh (I have no Alpha here)
	;-) I have the same problem. It takes a very long time to create
	the keys, so I use a special option, --quick-random, to generate
	insecure keys which are only good for some tests.

	** What is the difference between options and commands?
	:PROPERTIES:
	:CUSTOM_ID: difference-between-options-and-commands
	:END:

	If you do a 'gpg --help', you will get two separate lists. The first
	is a list of commands. The second is a list of options. Whenever you
	run GPG, you must pick exactly one command (with one exception,
	see below). You may pick one or more options. The command should,
	just by convention, come at the end of the argument list, after all
	the options. If the command takes a file (all the basic ones do),
	the filename comes at the very end. So the basic way to run gpg is:

	: $ gpg [--option something] [--option2] [--option3 something] --command file

	Some options take arguments. For example, the --output option (which
	can be abbreviated as -o) is an option that takes a filename. The
	option's argument must follow immediately after the option itself,
	otherwise gpg doesn't know which option the argument is supposed to
	paired with. As an option, --output and its filename must come before
	the command. The --recipient (-r) option takes a name or keyID to
	encrypt the message to, which must come right after the -r option.
	The --encrypt (or -e) command comes after all the options and is
	followed by the file you wish to encrypt. Therefore in this example
	the command-line issued would be:

	: $ gpg -r alice -o secret.txt -e test.txt

	If you write the options out in full, it is easier to read:

	: $ gpg --recipient alice --output secret.txt --encrypt test.txt

	If you're encrypting to a file with the extension ".txt", then you'd
	probably expect to see ASCII-armored text in the file (not binary),
	so you need to add the --armor (-a) option, which doesn't take any
	arguments:

	: $ gpg --armor --recipient alice --output secret.txt --encrypt test.txt

	If you imagine square brackets around the optional parts, it becomes
	a bit clearer:

	: $ gpg [--armor] [--recipient alice] [--output secret.txt] --encrypt test.txt

	The optional parts can be rearranged any way you want:

	: $ gpg --output secret.txt --recipient alice --armor --encrypt test.txt

	If your filename begins with a hyphen (e.g. "-a.txt"), GnuPG assumes
	this is an option and may complain. To avoid this you have to either
	use =./-a.txt=, or stop the option and command processing with two
	hyphens: =-- -a.txt=.

	The exception to using only one command: signing and encrypting
	at the same time. For this you can combine both commands, such as in:

	: $ gpg [--options] --sign --encrypt foo.txt

	** I can't delete a user ID on my secret keyring because it has already been deleted on my public keyring. What can I do?
	:PROPERTIES:
	:CUSTOM_ID: delete-user-id-from-secring-if-already-deleted-from-pubring
	:END:

	Because you can only select from the public key ring, there is no
	direct way to do this. However it is not very complicated to do
	anyway. Create a new user ID with exactly the same name and you
	will see that there are now two identical user IDs on the secret
	ring. Now select this user ID and delete it. Both user IDs will be
	removed from the secret ring.

	** I can't delete my secret key because the public key disappeared. What can I do?
	:PROPERTIES:
	:CUSTOM_ID: delete-my-secret-key-because-the-public-key-disappeared
	:END:

	To select a key a search is always done on the public keyring,
	therefore it is not possible to select a secret key without
	having the public key. Normally it should never happen that the
	public key got lost but the secret key is still available. The
	reality is different, so GnuPG implements a special way to deal
	with it: Simply use the long keyID to specify the key to delete,
	which can be obtained by using the --with-colons options (it is
	the fifth field in the lines beginning with "sec").

	If you've lost your public key and need to recreate it instead
	for continued use with your secret key, you may be able to use
	gpgsplit as detailed in question
	[[#i-still-have-my-secret-key-but-lost-my-public-key][I still have my secret key, but lost my public key. What can I do?]].



	** What are trust, validity and ownertrust?
	:PROPERTIES:
	:CUSTOM_ID: what-are-trust-validity-and-ownertrust
	:END:

	With GnuPG, the term "ownertrust" is used instead of "trust" to
	help clarify that this is the value you have assigned to a key
	to express how much you trust the owner of this key to correctly
	sign (and thereby introduce) other keys. The "validity", or
	calculated trust, is a value which indicates how much GnuPG
	considers a key as being valid (that it really belongs to the
	one who claims to be the owner of the key). For more information
	on trust values see the chapter "The Web of Trust" in The GNU
	Privacy Handbook.

	** How do I sign a patch file?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-sign-a-patch-file
	:END:

	Use "gpg --clearsign --not-dash-escaped ...". The problem with
	--clearsign is that all lines starting with a dash are quoted with
	"- "; obviously diff produces many lines starting with a dash and
	these are then quoted and that is not good for a patch ;-). To use
	a patch file without removing the cleartext signature, the special
	option --not-dash-escaped may be used to suppress generation of
	these escape sequences. You should not mail such a patch because
	spaces and line endings are also subject to the signature and a
	mailer may not preserve these. If you want to mail a file you can
	simply sign it using your MUA (Mail User Agent).

	** Where is the "encrypt-to-self" option?
	:PROPERTIES:
	:CUSTOM_ID: where-is-the-encrypt-to-self-option
	:END:

	Use "--encrypt-to your_keyID". You can use more than one of these
	options. To temporarily override the use of this additional key,
	you can use the option "--no-encrypt-to".

	** How can I get rid of the Version and Comment headers in armored messages?
	:PROPERTIES:
	:CUSTOM_ID: get-rid-of-the-version-and-comment-headers-in-armored-messages
	:END:

	Use

	: --no-version --comment ''

	Note that the left over blank line
	is required by the protocol.

	** What does the "You are using the xxxx character set." mean?
	:PROPERTIES:
	:CUSTOM_ID: what-does-the-you-are-using-the-xxx-character-set-mean
	:END:

	This note is printed when UTF-8 mapping has to be done. Make sure
	that the displayed character set is the one you have activated on
	your system. Since "iso-8859-1" is the character set most used,
	this is the default. You can change the charset with the option
	=--charset=. It is important that your active character set matches
	the one displayed --- if not, restrict yourself to plain 7 bit
	ASCII and no mapping has to be done.

	** How can I get list of key IDs used to encrypt a message?
	:PROPERTIES:
	:CUSTOM_ID: how-can-i-get-list-of-key-ids-used-to-encrypt-a-message
	:END:

	: $ gpg --batch --decrypt --list-only --status-fd 1 2>/dev/null \| \
	: awk '/^\[GNUPG:\] ENC_TO / { print $3 }'

	** Why can't I decrypt files encrypted as symmetrical-only (-c) with a version of GnuPG prior to 1.0.1.
	:PROPERTIES:
	:CUSTOM_ID: why-cant-i-decrypt-symmetrical-only-with-gnupg-prior-to-1.0.1
	:END:

	There was a bug in GnuPG versions prior to 1.0.1 which affected files
	only if 3DES or Twofish was used for symmetric-only encryption (this has
	never been the default). The bug has been fixed, but to enable decryption
	of old files you should run gpg with the option =--emulate-3des-s2k-bug=,
	decrypt the file and encrypt it again without this option.

	NOTE: This option was removed in GnuPG development version 1.1.0 and later
	updates, so you will need to use a version between 1.0.1 and 1.0.7 to
	re-encrypt any affected files.

	** How can I use GnuPG in an automated environment?
	:PROPERTIES:
	:CUSTOM_ID: how-can-i-use-gnupg-in-an-automated-environment
	:END:

	You should use the option =--batch= and don't use passphrases as
	there is usually no way to store it more securely than on the
	secret keyring itself. The suggested way to create keys for an
	automated environment is:

	On a secure machine:

	1. If you want to do automatic signing, create a signing subkey for
	your key. Use the interactive key editing menu by issuing the
	command
	: gpg --edit-key keyID
	enter "addkey" and select the DSA key type).

	1. Make sure that you use a passphrase (needed by the current
	implementation).

	1.
	: gpg --export-secret-subkeys --no-comment foo >secring.auto

	1. Copy secring.auto and the public keyring to a test directory.

	1. Change to this directory.

	1. Run the command
	: gpg --homedir . --edit foo

	and use the sub-command =passwd= to remove the passphrase from the
	subkeys. You may also want to remove all unused subkeys.

	1. Copy secring.auto to a floppy and carry it to the target box.

	On the target machine:

	1. Install secring.auto as the secret keyring.
	1. Now you can start your new service. It's also a good idea to
	install an intrusion detection system so that you hopefully get
	a notice of an successful intrusion, so that you in turn can
	revoke all the subkeys installed on that machine and install new
	subkeys.

	** Which email-client can I use with GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: which-email-client-can-i-use-with-gnupg
	:END:

	Using GnuPG to encrypt email is one of the most popular uses.
	Several mail clients or mail user agents (MUAs) support GnuPG to
	varying degrees. Simplifying a bit, there are two ways mail can be
	encrypted with GnuPG: the "old style" ASCII armor (i.e. cleartext
	encryption), and RFC 2015 style (previously PGP/MIME, now OpenPGP).
	The latter has full MIME support. Some MUAs support only one of
	them, so whichever you actually use depends on your needs as well
	as the capabilities of your addressee. As well, support may be
	native to the MUA, or provided via "plug-ins" or external tools.

	The following list is not exhaustive:

	\| MUA \| OpenPGP \| ASCII \| How? (N,P,T) \|
	\|-----------------+---------+-------+----------------------\|
	\| Calypso \| N \| Y \| P (Unixmail) \|
	\| Elm \| N \| Y \| T (mailpgp,morepgp) \|
	\| Elm ME+ \| N \| Y \| N \|
	\| Emacs/Gnus \| Y \| Y \| T (Mailcrypt,gpg.el) \|
	\| Emacs/Mew \| Y \| Y \| N \|
	\| Emacs/VM \| N \| Y \| T (Mailcrypt) \|
	\| Evolution \| Y \| Y \| N \|
	\| Exmh \| Y \| Y \| N \|
	\| GNUMail.app \| Y \| Y \| P (PGPBundle) \|
	\| GPGMail \| Y \| Y \| N \|
	\| KMail (<=1.4.x) \| N \| Y \| N \|
	\| KMail (1.5.x) \| Y(P) \| Y(N) \| P/N \|
	\| Mozilla \| Y \| Y \| P (Enigmail) \|
	\| Mulberry \| Y \| Y \| P \|
	\| Mutt \| Y \| Y \| N \|
	\| Sylpheed \| Y \| Y \| N \|
	\| Claws-mail \| Y \| Y \| N \|
	\| TkRat \| Y \| Y \| N \|
	\| XEmacs/Gnus \| Y \| Y \| T (Mailcrypt) \|
	\| XEmacs/Mew \| Y \| Y \| N \|
	\| XEmacs/VM \| N \| Y \| T (Mailcrypt) \|
	\| XFmail \| Y \| Y \| N \|

	( N - Native, P - Plug-in, T - External Tool)

	The following table lists proprietary MUAs. The GNU Project
	suggests against the use of these programs, but they are listed
	for interoperability reasons for your convenience.

	\| MUA \| OpenPGP \| ASCII \| How? (N,P,T) \|
	\|------------------+---------+-------+--------------------------\|
	\| Apple Mail \| Y \| Y \| P (GPGMail) \|
	\| Becky2 \| Y \| Y \| P (BkGnuPG) \|
	\| Eudora \| Y \| Y \| P (EuroraGPG) \|
	\| Eudora Pro \| Y \| Y \| P (EudoraGPG) \|
	\| Lotus Notes \| N \| Y \| P \|
	\| Netscape 4.x \| N \| Y \| P \|
	\| Netscape 7.x \| Y \| Y \| P (Enigmail) \|
	\| Novell Groupwise \| N \| Y \| P \|
	\| Outlook \| N \| Y \| P (G-Data) \|
	\| Outlook Express \| N \| Y \| P (GPGOE) \|
	\| Pegasus \| N \| Y \| P (QDPGP,PM-PGP) \|
	\| Pine \| N \| Y \| T (pgpenvelope,gpg4pine) \|
	\| Postme \| N \| Y \| P (GPGPPL) \|
	\| The Bat! \| N \| Y \| P (Ritlabs) \|

	Good overviews of OpenPGP-support can be found at:\\
	[[http://www.openpgp.fr.st/courrier_en.html]] \\
	http://www.bretschneidernet.de/tips/secmua.html

	Users of Win32 MUAs that lack OpenPGP support may look into using
	GPGrelay http://gpgrelay.sourceforge.net, a small email-relaying
	server that uses GnuPG to enable many email clients to send and
	receive emails that conform to PGP-MIME (RFC 2015).

	** Can't we have a gpg library?
	:PROPERTIES:
	:CUSTOM_ID: cant-we-have-a-gpg-library
	:END:

	This has been frequently requested. However, the current viewpoint
	of the GnuPG maintainers is that this would lead to several security
	issues and will therefore not be implemented in the foreseeable
	future. However, for some areas of application gpgme could do the
	trick. You'll find it at [[gnupgweb:related_software/gpgme]].

	** I have successfully generated a revocation certificate, but I don't understand how to send it to the key servers.
	:PROPERTIES:
	:CUSTOM_ID: how-to-send-a-revocation-to-the-keyservers
	:END:

	Most keyservers don't accept a 'bare' revocation certificate. You
	have to import the certificate into gpg first:

	: $ gpg --import my-revocation.asc

	then send the revoked key to the keyservers:

	: $ gpg --keyserver certserver.pgp.com --send-keys mykeyid

	(or use a keyserver web interface for this).

	** How do I put my keyring in a different directory?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-put-my-keyring-in-a-different-directory
	:END:

	GnuPG keeps several files in a special homedir directory. These
	include the options file, pubring.gpg, secring.gpg, trustdb.gpg,
	and others. GnuPG will always create and use these files. On
	unices, the homedir is usually ~/.gnupg; on Windows it is name
	"gnupg" and found below the user's application directory. Run the
	gpg and pass the option --version to see the name of that
	directory.

	If you want to put your keyrings somewhere else, use the option:

	: --homedir /my/path/

	to make GnuPG create all its files in that directory. Your keyring
	will be "/my/path/pubring.gpg". This way you can store your secrets
	on a floppy disk. Don't use "--keyring" as its purpose is to specify
	additional keyring files.

	** How do I verify signed packages?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-verify-signed-packages
	:END:

	must first have the vendor, organisation, or issuing person's key
	Before you can verify the signature that accompanies a package, you
	imported into your public keyring. To prevent GnuPG warning
	messages the key should also be validated (or locally signed).

	You will also need to download the detached signature file along
	with the package. These files will usually have the same name as
	the package, with either a binary (.sig) or ASCII armor (.asc)
	extension.

	Once their key has been imported, and the package and accompanying
	signature files have been downloaded, use:

	: $ gpg --verify sigfile signed-file

	If the signature file has the same base name as the package file,
	the package can also be verified by specifying just the signature
	file, as GnuPG will derive the package's file name from the name
	given (less the .sig or .asc extension). For example, to verify a
	package named foobar.tar.gz against its detached binary signature
	file, use:

	: $ gpg --verify foobar.tar.gz.sig

	** How do I export a keyring with only selected signatures (keys)?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-export-a-keyring-with-only-selected-signatures
	:END:

	If you're wanting to create a keyring with only a subset of keys
	selected from a master keyring (for a club, user group, or company
	department for example), simply specify the keys you want to export:

	: $ gpg --armor --export key1 key2 key3 key4 > keys1-4.asc

	** I still have my secret key, but lost my public key. What can I do?
	:PROPERTIES:
	:CUSTOM_ID: i-still-have-my-secret-key-but-lost-my-public-key
	:END:

	All OpenPGP secret keys have a copy of the public key inside them,
	and in a worst-case scenario, you can create yourself a new public
	key using the secret key.

	A tool to convert a secret key into a public one has been included
	(it's actually a new option for gpgsplit) and is available with GnuPG
	versions 1.2.1 or later (or can be found in CVS). It works like this:

	: $ gpgsplit --no-split --secret-to-public secret.gpg >publickey.gpg

	One should first try to export the secret key and convert just this
	one. Using the entire secret keyring should work too. After this has
	been done, the publickey.gpg file can be imported into GnuPG as usual.

	** Clearsigned messages sent from my web-mail account have an invalid signature. Why?
	:PROPERTIES:
	:CUSTOM_ID: clearsig-sent-from-webmail-have-an-invalid-signature
	:END:

	Check to make sure the settings for your web-based email account
	do not use HTML formatting for the pasted clearsigned message. This can
	alter the message with embedded HTML markup tags or spaces, resulting
	in an invalid signature. The recipient may be able to copy the signed
	message block to a text file for verification, or the web email
	service may allow you to attach the clearsigned message as a file
	if plaintext messages are not an option.


	* Compatibility Issues

	** How can I encrypt a message with GnuPG so that PGP is able to decrypt it?
	:PROPERTIES:
	:CUSTOM_ID: how-can-i-encrypt-a-message-so-that-pgp-is-able-to-decrypt-it
	:END:

	It depends on the PGP version.

	- PGP 2.x ::

	You can't do that because PGP 2.x normally uses IDEA which is
	not supported by GnuPG as it is patented (see [[#how-do-i-include-support-for-rsa-and-idea][How do I include
	support for RSA and IDEA?]]), but if you have a modified version
	of PGP you can try this:

	: $ gpg --rfc1991 --cipher-algo 3des ...

	Please don't pipe the data to encrypt to gpg but provide it
	using a filename; otherwise, PGP 2 will not be able to handle
	it.

	As for conventional encryption, you can't do this for PGP 2.

	- PGP 5.x and higher ::

	You need to provide two additional options:

	: --compress-algo 1 --cipher-algo cast5

	You may also use "3des" instead of "cast5", and "blowfish" does
	not work with all versions of PGP 5. You may also want to put:

	: compress-algo 1

	into your =~/.gnupg/options= file --- this does not affect
	normal GnuPG operation.

	This applies to conventional encryption as well.

	** How do I migrate from PGP 2.x to GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-migrate-from-pgp2-to-gnupg
	:END:

	PGP 2 uses the RSA and IDEA encryption algorithms. Whereas the RSA
	patent has expired and RSA is included as of GnuPG 1.0.3, the IDEA
	algorithm is still patented until 2007. Under certain conditions you
	may use IDEA even today. In that case, you may refer to Question
	[[*How%20do%20I%20include%20support%20for%20RSA%20and%20IDEA][How do I include support for RSA and IDEA?]] about how to add
	IDEA support to GnuPG and read
	[[gnupgweb:gph/en/pgp2x.html]] to perform the migration.

	** Why is PGP 5.x not able to encrypt messages with some keys?
	:PROPERTIES:
	:CUSTOM_ID: why-is-pgp5-not-able-to-encrypt-messages-with-some-keys
	:END:

	PGP, Inc. refuses to accept Elgamal keys of type 20 even for
	encryption. They only support type 16 (which is identical at least
	for decryption). To be more inter-operable, GnuPG (starting with
	version 0.3.3) now also uses type 16 for the Elgamal subkey which is
	created if the default key algorithm is chosen. You may add a type
	16 Elgamal key to your public key, which is easy as your key
	signatures are still valid.

	** Why is PGP 5.x not able to verify my messages?
	:PROPERTIES:
	:CUSTOM_ID: why-is-pgp5-not-able-to-verify-my-messages
	:END:

	PGP 5.x does not accept v4 signatures for data material but OpenPGP
	requests generation of v4 signatures for all kind of data, that's why
	GnuPG defaults to them. Use the option "--force-v3-sigs" to generate
	v3 signatures for data.

	** How do I transfer owner trust values from PGP to GnuPG?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-transfer-owner-trust-values-from-pgp-to-gnupg
	:END:

	There is a script in the tools directory to help you. After you have
	imported the PGP keyring you can give this command:

	: $ lspgpot pgpkeyring \| gpg --import-ownertrust

	where pgpkeyring is the original keyring and not the GnuPG keyring
	you might have created in the first step.

	** PGP does not like my secret key.
	:PROPERTIES:
	:CUSTOM_ID: pgp-does-not-like-my-secret-key
	:END:

	Older PGPs probably bail out on some private comment packets used by
	GnuPG. These packets are fully in compliance with OpenPGP; however
	PGP is not really OpenPGP aware. A workaround is to export the
	secret keys with this command:

	: $ gpg --export-secret-keys --no-comment -a your-KeyID

	Another possibility is this: by default, GnuPG encrypts your secret
	key using the Blowfish symmetric algorithm. Older PGPs will only
	understand 3DES, CAST5, or IDEA symmetric algorithms. Using the
	following method you can re-encrypt your secret gpg key with a
	different algo:

	: $ gpg --s2k-cipher-algo=CAST5 --s2k-digest-algo=SHA1 \
	: --compress-algo=1 --edit-key <username>

	Then use passwd to change the password (just change it to the same
	thing, but it will encrypt the key with CAST5 this time).

	Now you can export it and PGP should be able to handle it.

	For PGP 6.x the following options work to export a key:

	: $ gpg --s2k-cipher-algo 3des --compress-algo 1 --rfc1991 \
	: --export-secret-keys <KeyID>

	** GnuPG no longer installs a ~/.gnupg/options file. Is it missing?
	:PROPERTIES:
	:CUSTOM_ID: gnupg-no-longer-installs-a-options-file-is-it-missing
	:END:

	No. The ~/.gnupg/options file has been renamed to
	~/.gnupg/gpg.conf for new installs as of version 1.1.92. If an
	existing ~/.gnupg/options file is found during an upgrade it will
	still be used, but this change was required to have a more
	consistent naming scheme with forthcoming tools. An existing
	options file can be renamed to gpg.conf for users upgrading, or
	receiving the message that the "old default options file" is
	ignored (occurs if both a gpg.conf and an options file are found).

	** How do you export GnuPG keys for use with PGP?
	:PROPERTIES:
	:CUSTOM_ID: how-do-you-export-gnupg-keys-for-use-with-pgp
	:END:

	This has come up fairly often, so here's the HOWTO:

	PGP can (for most key types) use secret keys generated by GnuPG. The
	problems that come up occasionally are generally because GnuPG
	supports a few more features from the OpenPGP standard than PGP does.
	If your secret key has any of those features in use, then PGP will
	reject the key or you will have problems communicating later. Note
	that PGP doesn't do Elgamal signing keys at all, so they are not
	usable with any version.

	These instructions should work for GnuPG 1.0.7 and later, and PGP
	7.0.3 and later.

	Start by editing the key. Most of this line is not really necessary
	as the default values are correct, but it does not hurt to repeat the
	values, as this will override them in case you have something else set
	in your options file.

	: $ gpg --s2k-cipher-algo cast5 --s2k-digest-algo sha1 --s2k-mode 3 \
	: --simple-sk-checksum --edit KeyID

	Turn off some features. Set the list of preferred ciphers, hashes,
	and compression algorithms to things that PGP can handle. (Yes, I
	know this is an odd list of ciphers, but this is what PGP itself uses,
	minus IDEA).

	: > setpref S9 S8 S7 S3 S2 S10 H2 H3 Z1 Z0

	Now put the list of preferences onto the key.

	: > updpref

	Finally we must decrypt and re-encrypt the key, making sure that we
	encrypt with a cipher that PGP likes. We set this up in the --edit
	line above, so now we just need to change the passphrase to make it
	take effect. You can use the same passphrase if you like, or take
	this opportunity to actually change it.

	: > passwd

	Save our work.

	: > save

	Now we can do the usual export:

	: $ gpg --export KeyID > mypublickey.pgp[H br]
	: $ gpg --export-secret-key KeyID > mysecretkey.pgp

	Thanks to David Shaw for this information!

	** What are DH/DSS keys?
	:PROPERTIES:
	:CUSTOM_ID: what-are-dh-dss-keys
	:END:

	PGP uses a different name for the former default encryption
	algorithm Elgamal: They name it DH, which usually stands for the
	Diffie-Hellman key exchange algorithm. It has been said that this
	had historic patent and business reasons. It is however exactly
	the same thing as the Elgamal algorithm.

	They also use the acronym DSS (Digital Signature Standard) instead
	of the DSA (Digital Signature Algorithm). The difference is that
	DSS requires the use of certain hash algorithms; however OpenPGP
	allows the use of more than those hash algorithms, thus GPG usually
	uses the term DSA.

	* Problems and Error Messages

	** Why do I get "gpg: Warning: using insecure memory!"
	:PROPERTIES:
	:CUSTOM_ID: why-do-i-get-gpg_warning_using_insecure_memory
	:END:

	You see this warning if GPG is not able to lock pages against being
	swapped out to disk.

	However, on most modern system you should not see this message
	anymore because these systems allow any process to prevent a small
	number of memory pages from being swapped out to disk (using the
	mlock system call). Other (mostly older) systems don't allow this
	unless you install GPG as setuid(root).

	Locking pages against being swapped out is not necessary if your
	system uses an encrypted swap partition. In fact that is the best
	way to protect sensitive data from ending up on a disk. If your
	system allows for encrypted swap partitions, please make use of
	that feature. Note that GPG does not know about encrypted swap
	partitions and might print the warning; thus you should disabled
	the warning if your swap partition is encrypted. You may also want
	to disable this warning if you can't or don't want to install GnuPG
	setuid(root). To disable the warning you put a line

	: no-secmem-warning

	into your ~/.gnupg/gpg.conf file.

	What follows is a short description on how to install GPG
	setuid(root); for those who need this.

	On some systems this program should be installed as setuid(root).
	This is necessary to lock memory pages. Locking memory pages
	prevents the operating system from writing them to disk and thereby
	keeping your secret keys really secret. If you get no warning
	message about insecure memory your operating system supports
	locking without being root. The program drops root privileges as
	soon as locked memory is allocated.

	To setuid(root) permissions on the gpg binary you can either use:

	: $ chmod u+s /path/to/gpg

	or

	: $ chmod 4755 /path/to/gpg

	Some refrain from using setuid(root) unless absolutely required for
	security reasons. Please check with your system administrator if
	you are not able to make these determinations yourself.

	On UnixWare 2.x and 7.x you should install GnuPG with the 'plock'
	privilege to get the same effect:

	: $ filepriv -f plock /path/to/gpg

	On some systems (e.g., Windows) GnuPG does not lock memory pages
	and older GnuPG versions (<=1.0.4) issue the warning:

	: gpg: Please note that you don't have secure memory

	This warning can't be switched off by the above option because it
	was thought to be too serious an issue. However, it confused users
	too much, so the warning was eventually removed.

	** Large File Support doesn't work
	:PROPERTIES:
	:CUSTOM_ID: large-file-support-does-not-work
	:END:

	LFS works correctly in post-1.0.4 versions. If configure doesn't
	detect it, try a different (i.e., better) compiler. egcs 1.1.2
	works fine, other gccs sometimes don't. BTW, several compilation
	problems of GnuPG 1.0.3 and 1.0.4 on HP-UX and Solaris were due to
	broken LFS support.

	** In the edit menu the trust values are not displayed correctly after signing uids. Why?
	:PROPERTIES:
	:CUSTOM_ID: edit-menu-trust-not-show-correctly-after-signing-uids
	:END:

	This happens because some information is stored immediately in
	the trustdb, but the actual trust calculation can be done after the
	save command. This is a "not easy to fix" design bug which will be
	addressed in some future release.

	** What does "skipping pubkey 1: already loaded" mean?
	:PROPERTIES:
	:CUSTOM_ID: what-does-skipping_pubkey_1_already_loaded-mean
	:END:

	As of GnuPG 1.0.3, the RSA algorithm is included. If you still have
	a "load-extension rsa" in your options file, the above message
	occurs. Just remove the load command from the options file.

	** GnuPG 1.0.4 doesn't create ~/.gnupg ...
	:PROPERTIES:
	:CUSTOM_ID: gnupg-1.0.4-does-not-create-.gnupg
	:END:

	That's a known bug, already fixed in newer versions.

	** An Elgamal signature does not verify anymore since version 1.0.2
	:PROPERTIES:
	:CUSTOM_ID: an-elgamal-signature-does-not-verify-anymore-since-version-1.0.2
	:END:

	Use the option --emulate-md-encode-bug.

	** Old versions of GnuPG can't verify Elgamal signatures
	:PROPERTIES:
	:CUSTOM_ID: old-versions-of-gnupg-cant-verify-elgamal-signatures
	:END:

	Update to GnuPG 1.0.2 or newer.

	** When I use --clearsign, the plain text has sometimes extra dashes in it - why?
	:PROPERTIES:
	:CUSTOM_ID: extra-dashes-in-clearsign-messages
	:END:

	This is called dash-escaped text and is required by OpenPGP.
	It always happens when a line starts with a dash ("-") and is
	needed to make the lines that structure signature and text
	(i.e., "-----BEGIN PGP SIGNATURE-----") to be the only lines
	that start with two dashes.

	If you use GnuPG to process those messages, the extra dashes
	are removed. Good mail clients remove those extra dashes when
	displaying such a message.

	** What is the thing with "can't handle multiple signatures"?
	:PROPERTIES:
	:CUSTOM_ID: what-is-the-thing-with-cant_handle_multiple_signatures
	:END:

	Due to different message formats GnuPG is not always able to split
	a file with multiple signatures unambiguously into its parts. This
	error message informs you that there is something wrong with the input.

	The only way to have multiple signatures in a file is by using the
	OpenPGP format with one-pass-signature packets (which is GnuPG's
	default) or the cleartext signed format.

	** If I submit a key to a keyserver, nothing happens
	:PROPERTIES:
	:CUSTOM_ID: if-i-submit-a-key-to-a-keyserver-nothing-happens
	:END:

	You are most likely using GnuPG 1.0.2 or older on Windows. That's
	feature isn't yet implemented, but it's a bug not to say it. Newer
	versions issue a warning. Upgrade to 1.4.5 or newer.

	** I get "gpg: waiting for lock ..."
	:PROPERTIES:
	:CUSTOM_ID: i-get-gpg_waiting_for_lock
	:END:

	A previous instance of gpg has most likely exited abnormally and left
	a lock file. Go to ~/.gnupg and look for .*.lock files and remove them.

	** Older gpg binaries (e.g., 1.0) have problems with keys from newer gpg binaries
	:PROPERTIES:
	:CUSTOM_ID: gpg-1.0-has-problems-with-keys-from-newer-gpg-versions
	:END:

	As of 1.0.3, keys generated with gpg are created with preferences to
	TWOFISH (and AES since 1.0.4) and that also means that they have the
	capability to use the new MDC encryption method. This will go into
	OpenPGP soon, and is also suppoted by PGP 7. This new method avoids
	a (not so new) attack on all email encryption systems.

	This in turn means that pre-1.0.3 gpg binaries have problems with
	newer keys. Because of security and bug fixes, you should keep your
	GnuPG installation in a recent state anyway. As a workaround, you can
	force gpg to use a previous default cipher algo by putting:

	: cipher-algo cast5

	into your options file.

	** With 1.0.4, I get "this cipher algorithm is deprecated ..."
	:PROPERTIES:
	:CUSTOM_ID: with-1.0.4-i-get-this_cipher_algorithm_is_deprecated
	:END:

	If you just generated a new key and get this message while
	encrypting, you've witnessed a bug in 1.0.4. It uses the new AES
	cipher Rijndael that is incorrectly being referred as "deprecated".
	Ignore this warning, more recent versions of gpg are corrected.

	** Some dates are displayed as ????-??-??. Why?
	:PROPERTIES:
	:CUSTOM_ID: some-dates-are-displayed-as-question-marks
	:END:

	Due to constraints in most libc implementations, dates beyond
	2038-01-19 can't be displayed correctly. 64-bit OSes are not
	affected by this problem. To avoid printing wrong dates, GnuPG
	instead prints some question marks. To see the correct value, you
	can use the options --with-colons and --fixed-list-mode.

	** I still have a problem. How do I report a bug?
	:PROPERTIES:
	:CUSTOM_ID: i-still-have-a-problem-how-do-i-report-a-bug
	:END:

	Are you sure that it's not been mentioned somewhere on the mailing
	lists? Did you have a look at the bug list (you'll find a link to
	the list of reported bugs on the documentation page). If you're
	not sure about it being a bug, you can send mail to the
	gnupg-devel list. Otherwise, use the bug tracking system
	[[http://bugs.gnupg.org][bugs.gnupg.org]].

	** Why doesn't GnuPG support X.509 certificates?
	:PROPERTIES:
	:CUSTOM_ID: why-doesnt-gnupg-support-x509-certificates
	:END:

	That is only the case for GnuPG version 1.x. GnuPG 2.x fully
	supports X.509 and S/MIME using the gpgsm tool.

	** Why do national characters in my user ID look funny?
	:PROPERTIES:
	:CUSTOM_ID: why-do-national-characters-in-my-user-id-look-funny
	:END:

	According to OpenPGP, GnuPG encodes user ID strings (and other
	things) using UTF-8. In this encoding of Unicode, most national
	characters get encoded as two- or three-byte sequences. For
	example, å (0xE5 in ISO-8859-1) becomes Ã¥ (0xC3,
	0xA5). This might also be the reason why keyservers can't find
	your key.

	** I get 'sed' errors when running ./configure on Mac OS X ...
	:PROPERTIES:
	:CUSTOM_ID: i-get-sed-errors-when-running-configure-on-mac-os-x
	:END:

	This problem has been fixed for all modern GnuPG versions.
	(By using an autoconf 2.50 generated configure script).

	** Why does GnuPG 1.0.6 bail out on keyrings used with 1.0.7?
	:PROPERTIES:
	:CUSTOM_ID: why-does-gnupg-1.0.6-bail-out-on-keyrings-used-with-1.0.7
	:END:

	There is a small bug in 1.0.6 which didn't parse trust packets
	correctly. You may want to apply this patch if you can't upgrade:
	[[http://www.gnupg.org/developer/gpg-woody-fix.txt]].

	** I upgraded to GnuPG version 1.0.7 and now it takes longer to load my keyrings. What can I do?
	:PROPERTIES:
	:CUSTOM_ID: with-gpg-1.0.7-it-takes-longer-to-load-my-keyrings
	:END:

	The way signature states are stored has changed so that v3 signatures
	can be supported. You can use the new --rebuild-keydb-caches migration
	command, which was built into this release and increases the speed of
	many operations for existing keyrings.

	** Doesn't a fully trusted user ID on a key prevent warning messages when encrypting to other IDs on the key?
	:PROPERTIES:
	:CUSTOM_ID: key-validation-bug-in-gpg-1.2.1
	:END:

	No. That was actually a key validity bug in GnuPG 1.2.1 and earlier
	versions. As part of the development of GnuPG 1.2.2, a bug was
	discovered in the key validation code. This bug causes keys with
	more than one user ID to give all user IDs on the key the amount of
	validity given to the most-valid key. The bug has been fixed in GnuPG
	release 1.2.2, and upgrading is the recommended fix for this problem.
	More information and a patch for a some pre-1.2.2 versions of GnuPG
	can be found at:

	[[http://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000268.html]].

	** I just compiled GnuPG from source on my GNU/Linux RPM-based system and it's not working. Why?
	:PROPERTIES:
	:CUSTOM_ID: compiled-on-gnu-linux-rpm-based-system-and-not-working
	:END:

	Many GNU/Linux distributions that are RPM-based will install a
	version of GnuPG as part of its standard installation, placing the
	binaries in the /usr/bin directory. Later, compiling and installing
	GnuPG from source other than from a source RPM won't normally
	overwrite these files, as the default location for placement of
	GnuPG binaries is in /usr/local/bin unless the '--prefix' switch
	is used during compile to specify an alternate location. Since the
	/usr/bin directory more than likely appears in your path before
	/usr/local/bin, the older RPM-version binaries will continue to
	be used when called since they were not replaced.

	To resolve this, uninstall the RPM-based version with 'rpm -e gnupg'
	before installing the binaries compiled from source. If dependency
	errors are displayed when attempting to uninstall the RPM (such as
	when Red Hat's up2date is also installed, which uses GnuPG), uninstall
	the RPM with 'rpm -e gnupg --nodeps' to force the uninstall. Any
	dependent files should be automatically replaced during the install
	of the compiled version. If the default /usr/local/bin directory is
	used, some packages such as SuSE's Yast Online Update may need to be
	configured to look for GnuPG binaries in the /usr/local/bin directory,
	or symlinks can be created in /usr/bin that point to the binaries
	located in /usr/local/bin.


	* Advanced Topics

	** How does this whole thing work?
	:PROPERTIES:
	:CUSTOM_ID: how-does-this-whole-thing-work
	:END:

	To generate a secret/public keypair, run:

	: $ gpg --generate-key

	and choose the default values.

	Data that is encrypted with a public key can only be decrypted by
	the matching secret key. The secret key is protected by a password,
	the public key is not.

	So to send your friend a message, you would encrypt your message
	with his public key, and he would only be able to decrypt it by
	having the secret key and putting in the password to use his secret
	key.

	GnuPG is also useful for signing things. Files that are encrypted
	with the secret key can be decrypted with the public key. To sign
	something, a hash is taken of the data, and then the hash is in some
	form encoded with the secret key. If someone has your public key, they
	can verify that it is from you and that it hasn't changed by checking
	the encoded form of the hash with the public key.

	A keyring is just a large file that stores keys. You have a public
	keyring where you store yours and your friend's public keys. You have
	a secret keyring that you keep your secret key on, and should be very
	careful with. Never ever give anyone else access to it and use a good
	passphrase to protect the data in it.

	You can 'conventionally' encrypt something by using the option 'gpg -c'.
	It is encrypted using a passphrase, and does not use public and secret
	keys. If the person you send the data to knows that passphrase, they
	can decrypt it. This is usually most useful for encrypting things to
	yourself, although you can encrypt things to your own public key in the
	same way. It should be used for communication with partners you know
	and where it is easy to exchange the passphrases (e.g. with your boy
	friend or your wife). The advantage is that you can change the
	passphrase from time to time and decrease the risk, that many old
	messages may be decrypted by people who accidentally got your passphrase.

	You can add and copy keys to and from your keyring with the 'gpg
	--import' and 'gpg --export' command. 'gpg --export-secret-keys' will
	export secret keys. This is normally not useful, but you can generate
	the key on one machine then move it to another machine.

	Keys can be signed under the 'gpg --edit-key' option. When you sign a
	key, you are saying that you are certain that the key belongs to the
	person it says it comes from. You should be very sure that is really
	that person: You should verify the key fingerprint with:

	: $ gpg --fingerprint KeyID

	over the phone (if you really know the voice of the other person), at
	a key signing party (which are often held at computer conferences),
	or at a meeting of your local GNU/Linux User Group.

	Hmm, what else. You may use the option '-o filename' to force output
	to this filename (use '-' to force output to stdout). '-r' just lets
	you specify the recipient (which public key you encrypt with) on the
	command line instead of typing it interactively.

	Oh yeah, this is important. By default all data is encrypted in some
	weird binary format. If you want to have things appear in ASCII text
	that is readable, just add the '-a' option. But the preferred method
	is to use a MIME aware mail reader (Mutt, Pine and many more).

	There is a small security glitch in the OpenPGP (and therefore GnuPG)
	system; to avoid this you should always sign and encrypt a message
	instead of only encrypting it.

	** Why are some signatures with an ELG-E key valid?
	:PROPERTIES:
	:CUSTOM_ID: why-are-some-signatures-with-an-elg-e-key-valid
	:END:

	These are Elgamal keys generated by GnuPG in v3 (RFC 1991) packets.
	The OpenPGP draft later changed the algorithm identifier for Elgamal
	keys which are usable for signatures and encryption from 16 to 20.
	GnuPG now uses 20 when it generates new Elgamal keys but still
	accepts 16 (which is according to OpenPGP "encryption only") if this
	key is in a v3 packet. GnuPG is the only program which had used
	these v3 Elgamal keys - so this assumption is quite safe.

	** How does the whole trust thing work?
	:PROPERTIES:
	:CUSTOM_ID: how-does-the-whole-trust-thing-work
	:END:

	It works more or less like PGP. The difference is that the trust is
	computed at the time it is needed. This is one of the reasons for
	the trustdb which holds a list of valid key signatures. If you are
	not running in batch mode you will be asked to assign a trust
	parameter (ownertrust) to a key.

	You can see the validity (calculated trust value) using this
	command.

	: $ gpg --list-keys --with-colons

	If the first field is "pub" or "uid", the second field shows you the
	trust:

	: o = Unknown (this key is new to the system)
	: e = The key has expired
	: q = Undefined (no value assigned)
	: n = Don't trust this key at all
	: m = There is marginal trust in this key
	: f = The key is full trusted
	: u = The key is ultimately trusted; this is only used
	: for keys for which the secret key is also available.
	: r = The key has been revoked
	: d = The key has been disabled

	The value in the "pub" record is the best one of all "uid" records.
	You can get a list of the assigned trust values (how much you trust
	the owner to correctly sign another person's key) with:

	: $ gpg --export-ownertrust

	The first field is the fingerprint of the primary key, the second
	field is the assigned value:

	: - = No ownertrust value yet assigned or calculated.
	: n = Never trust this keyholder to correctly verify others signatures.
	: m = Have marginal trust in the keyholders capability to sign other
	: keys.
	: f = Assume that the key holder really knows how to sign keys.
	: u = No need to trust ourself because we have the secret key.

	Keep these values confidential because they express your opinions
	about others. PGP stores this information with the keyring thus it
	is not a good idea to publish a PGP keyring instead of exporting
	the keyring. GnuPG stores the trust in the trustdb.gpg file so it
	is okay to give a gpg keyring away (but we have a --export command
	too).

	** What kind of output is this: "key C26EE891.298, uid 09FB: ...."?
	:PROPERTIES:
	:CUSTOM_ID: trustb-diagnostics-output-key-uid
	:END:

	This is the internal representation of a user ID in the trustdb.
	"C26EE891" is the keyid, "298" is the local ID (a record number in
	the trustdb) and "09FB" is the last two bytes of a ripe-md-160 hash
	of the user ID for this key.

	** How do I interpret some of the informational outputs?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-interpret-some-of-the-informational-outputs
	:END:

	While checking the validity of a key, GnuPG sometimes prints some
	information which is prefixed with information about the checked
	item.

	: "key 12345678.3456"

	This is about the key with key ID 12345678 and the internal number
	3456, which is the record number of the so called directory record
	in the trustdb.

	: "uid 12345678.3456/ACDE"

	This is about the user ID for the same key. To identify the user ID
	the last two bytes of a ripe-md-160 over the user ID ring is printed.

	: "sig 12345678.3456/ACDE/9A8B7C6D"

	This is about the signature with key ID 9A8B7C6D for the above key
	and user ID, if it is a signature which is direct on a key, the user
	ID part is empty (..//..).

	** Are the header lines of a cleartext signature part of the signed material?
	:PROPERTIES:
	:CUSTOM_ID: are-header-lines-of-cleartext-sigs-part-of-the-signed-material
	:END:

	No. For example you can add or remove "Comment:" lines. They have
	a purpose like the mail header lines. However a "Hash:" line is
	needed for OpenPGP signatures to tell the parser which hash
	algorithm to use.

	** What is the list of preferred algorithms?
	:PROPERTIES:
	:CUSTOM_ID: what-is-the-list-of-preferred-algorithms
	:END:

	The list of preferred algorithms is a list of cipher, hash and
	compression algorithms stored in the self-signature of a key during
	key generation. When you encrypt a document, GnuPG uses this list
	(which is then part of a public key) to determine which algorithms
	to use. Basically it tells other people what algorithms the
	recipient is able to handle and provides an order of preference.

	** How do I change the list of preferred algorithms?
	:PROPERTIES:
	:CUSTOM_ID: how-do-i-change-the-list-of-preferred-algorithms
	:END:

	In version 1.0.7 or later, you can use the edit menu and set the
	new list of preference using the command "setpref"; the format of
	this command resembles the output of the command "pref". The
	preference is not changed immediately but the set preference will
	be used when a new user ID is created. If you want to update the
	preferences for existing user IDs, select those user IDs (or select
	none to update all) and enter the command "updpref". Note that the
	timestamp of the self-signature is increased by one second when
	running this command.

	** How can I import all the missing signer keys?
	:PROPERTIES:
	:CUSTOM_ID: how-can-i-import-all-the-missing-signer-keys
	:END:

	If you imported a key and you want to also import all the signer's
	keys, you can do this with this command:

	: gpg --check-sigs --with-colon KEYID \
	: \| awk -F: '$1 == "sig" && $2 == "?" { print $5 }' \
	: \| sort \| uniq \| xargs echo gpg --recv-keys

	Note that the invocation of sort is also required to wait for the
	- of the listing before before starting the import.
	+ of the listing before starting the import.


	* Bug reporting and hacking
	:PROPERTIES:
	:CUSTOM_ID: bugreports-et-al
	:END:

	** Copyright assignments
	:PROPERTIES:
	:CUSTOM_ID: copyright-assignments
	:END:

	Like most core GNU projects, GnuPG requires the signing of a copyright
	assignment to the FSF. Without such an assignment we may only accept
	trivial patches. As a rule of thumb the sum of all changed lines by
	one contributor may not exceed about 15 lines. Exceptions are typo
	corrections and translations. See
	http://www.gnu.org/prep/maintain/html_node/Copyright-Papers.html for
	details.

	** U.S. export restrictions
	:PROPERTIES:
	:CUSTOM_ID: us-export-restrictions
	:END:

	GnuPG has originally been developed in Germany because we have been
	able to do that without being affected by the US export restrictions.
	We had to reject any contributions from US citizens or from people
	-living the the US. That changed by end of 2000 when the export
	+living in the US. That changed by end of 2000 when the export
	restrictions were basically dropped for all kind of freely available
	software. However there are still some requirements in the US.
	Quoting David Shaw: mail
	#+begin_quote
	For each release of GPG that I contributed to, I sent an email
	containing a pointer to the new source code to the Commerce
	Department. The rules changed slightly in 2004, so that you could
	send a single email and then be done until the information in that
	email changed, so I just sent "www.gnupg.org" and haven't bothered
	with the email since.
	#+end_quote

	The rules: http://www.bis.doc.gov/encryption/pubavailencsourcecodenofify.html
	The 2004 rule change: http://edocket.access.gpo.gov/2004/04-26992.htm


	* Acknowledgements
	:PROPERTIES:
	:CUSTOM_ID: acknowledgements
	:END:

	Many thanks to Nils Ellmenreich for maintaining this FAQ file for
	such a long time, David D. Scribner for continuing maintenance,
	Werner Koch for the original FAQ file, and to all posters to
	gnupg-users and gnupg-devel. They all provided most of the answers.
	Converted to org-mode and removed from the tarballs in October 2010.

	Copyright (C) 2000, 2001, 2002, 2003, 2010 Free Software Foundation,
	Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02111, USA

	This file is free software; as a special exception the author gives
	unlimited permission to copy and/or distribute it, with or without
	modifications, as long as this notice is preserved.

	* Changes

	- 2010-11-14: Update "gpg: Warning: using insecure memory!"




	* COMMENT HTML style specifications

	#+begin_src emacs-lisp
	(defun org-faq-make-target ()
	"Make hard target for current headline."
	(interactive)
	(if (not (org-on-heading-p))
	(error "Not on a headline"))
	(let ((h (org-trim (org-get-heading 'no-tags))))
	(if (string-match "[ \t]*\\?\\'" h)
	(setq h (replace-match "" t t h)))
	(while (string-match "[ \t]+" h)
	(setq h (replace-match "-" t t h)))
	(setq h (downcase h))
	(org-entry-put nil "CUSTOM_ID" h)))
	#+end_src



	# Local Variables:
	# org-export-html-style-include-default: nil
	# org-export-html-style-include-scripts: nil
	# End:
	diff --git a/doc/gpg-agent.texi b/doc/gpg-agent.texi
	index 3177af46d..b72892c2a 100644
	--- a/doc/gpg-agent.texi
	+++ b/doc/gpg-agent.texi
	@@ -1,1533 +1,1533 @@
	@c Copyright (C) 2002 Free Software Foundation, Inc.
	@c This is part of the GnuPG manual.
	@c For copying conditions, see the file gnupg.texi.

	@include defs.inc

	@node Invoking GPG-AGENT
	@chapter Invoking GPG-AGENT
	@cindex GPG-AGENT command options
	@cindex command options
	@cindex options, GPG-AGENT command

	@manpage gpg-agent.1
	@ifset manverb
	.B gpg-agent
	\- Secret key management for GnuPG
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B gpg-agent
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.br
	.B gpg-agent
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.B \-\-server
	.br
	.B gpg-agent
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.B \-\-daemon
	.RI [ command_line ]
	@end ifset

	@mansect description
	@command{gpg-agent} is a daemon to manage secret (private) keys
	independently from any protocol. It is used as a backend for
	@command{gpg} and @command{gpgsm} as well as for a couple of other
	utilities.

	The agent is automatically started on demand by @command{gpg},
	@command{gpgsm}, @command{gpgconf}, or @command{gpg-connect-agent}.
	Thus there is no reason to start it manually. In case you want to use
	the included Secure Shell Agent you may start the agent using:

	@c From dkg on gnupg-devel on 2016-04-21:
	@c
	@c Here's an attempt at writing a short description of the goals of an
	@c isolated cryptographic agent:
	@c
	@c A cryptographic agent should control access to secret key material.
	@c The agent permits use of the secret key material by a supplicant
	@c without providing a copy of the secret key material to the supplicant.
	@c
	@c An isolated cryptographic agent separates the request for use of
	@c secret key material from permission for use of secret key material.
	@c That is, the system or process requesting use of the key (the
	@c "supplicant") can be denied use of the key by the owner/operator of
	@c the agent (the "owner"), which the supplicant has no control over.
	@c
	@c One way of enforcing this split is a per-key or per-session
	@c passphrase, known only by the owner, which must be supplied to the
	@c agent to permit the use of the secret key material. Another way is
	@c with an out-of-band permission mechanism (e.g. a button or GUI
	@c interface that the owner has access to, but the supplicant does not).
	@c
	@c The rationale for this separation is that it allows access to the
	@c secret key to be tightly controlled and audited, and it doesn't permit
	-@c the the supplicant to either copy the key or to override the owner's
	+@c the supplicant to either copy the key or to override the owner's
	@c intentions.

	@example
	gpg-connect-agent /bye
	@end example

	@noindent
	If you want to manually terminate the currently-running agent, you can
	safely do so with:

	@example
	gpgconf --kill gpg-agent
	@end example

	@noindent
	@efindex GPG_TTY
	You should always add the following lines to your @code{.bashrc} or
	whatever initialization file is used for all shell invocations:

	@smallexample
	GPG_TTY=$(tty)
	export GPG_TTY
	@end smallexample

	@noindent
	It is important that this environment variable always reflects the
	output of the @code{tty} command. For W32 systems this option is not
	required.

	Please make sure that a proper pinentry program has been installed
	under the default filename (which is system dependent) or use the
	option @option{pinentry-program} to specify the full name of that program.
	It is often useful to install a symbolic link from the actual used
	pinentry (e.g. @file{@value{BINDIR}/pinentry-gtk}) to the expected
	one (e.g. @file{@value{BINDIR}/pinentry}).

	@manpause
	@noindent
	@xref{Option Index}, for an index to @command{GPG-AGENT}'s commands and options.
	@mancont

	@menu
	* Agent Commands:: List of all commands.
	* Agent Options:: List of all options.
	* Agent Configuration:: Configuration files.
	* Agent Signals:: Use of some signals.
	* Agent Examples:: Some usage examples.
	* Agent Protocol:: The protocol the agent uses.
	@end menu

	@mansect commands
	@node Agent Commands
	@section Commands

	Commands are not distinguished from options except for the fact that
	only one command is allowed.

	@table @gnupgtabopt
	@item --version
	@opindex version
	Print the program version and licensing information. Note that you cannot
	abbreviate this command.

	@item --help
	@itemx -h
	@opindex help
	Print a usage message summarizing the most useful command-line options.
	Note that you cannot abbreviate this command.

	@item --dump-options
	@opindex dump-options
	Print a list of all available options and commands. Note that you cannot
	abbreviate this command.

	@item --server
	@opindex server
	Run in server mode and wait for commands on the @code{stdin}. The
	default mode is to create a socket and listen for commands there.

	@item --daemon [@var{command line}]
	@opindex daemon
	Start the gpg-agent as a daemon; that is, detach it from the console
	and run it in the background.

	As an alternative you may create a new process as a child of
	gpg-agent: @code{gpg-agent --daemon /bin/sh}. This way you get a new
	shell with the environment setup properly; after you exit from this
	shell, gpg-agent terminates within a few seconds.

	@item --supervised
	@opindex supervised
	Run in the foreground, sending logs by default to stderr, and
	listening on provided file descriptors, which must already be bound to
	listening sockets. This command is useful when running under systemd
	or other similar process supervision schemes. This option is not
	supported on Windows.

	In --supervised mode, different file descriptors can be provided for
	use as different socket types (e.g. ssh, extra) as long as they are
	identified in the environment variable @code{LISTEN_FDNAMES} (see
	sd_listen_fds(3) on some Linux distributions for more information on
	this convention).
	@end table

	@mansect options
	@node Agent Options
	@section Option Summary

	@table @gnupgtabopt

	@anchor{option --options}
	@item --options @var{file}
	@opindex options
	Reads configuration from @var{file} instead of from the default
	per-user configuration file. The default configuration file is named
	@file{gpg-agent.conf} and expected in the @file{.gnupg} directory directly
	below the home directory of the user.

	@anchor{option --homedir}
	@include opt-homedir.texi


	@item -v
	@item --verbose
	@opindex verbose
	Outputs additional information while running.
	You can increase the verbosity by giving several
	verbose commands to @command{gpgsm}, such as @samp{-vv}.

	@item -q
	@item --quiet
	@opindex quiet
	Try to be as quiet as possible.

	@item --batch
	@opindex batch
	Don't invoke a pinentry or do any other thing requiring human interaction.

	@item --faked-system-time @var{epoch}
	@opindex faked-system-time
	This option is only useful for testing; it sets the system time back or
	forth to @var{epoch} which is the number of seconds elapsed since the year
	1970.

	@item --debug-level @var{level}
	@opindex debug-level
	Select the debug level for investigating problems. @var{level} may be
	a numeric value or a keyword:

	@table @code
	@item none
	No debugging at all. A value of less than 1 may be used instead of
	the keyword.
	@item basic
	Some basic debug messages. A value between 1 and 2 may be used
	instead of the keyword.
	@item advanced
	More verbose debug messages. A value between 3 and 5 may be used
	instead of the keyword.
	@item expert
	Even more detailed messages. A value between 6 and 8 may be used
	instead of the keyword.
	@item guru
	All of the debug messages you can get. A value greater than 8 may be
	used instead of the keyword. The creation of hash tracing files is
	only enabled if the keyword is used.
	@end table

	How these messages are mapped to the actual debugging flags is not
	specified and may change with newer releases of this program. They are
	however carefully selected to best aid in debugging.

	@item --debug @var{flags}
	@opindex debug
	This option is only useful for debugging and the behavior may change at
	any time without notice. FLAGS are bit encoded and may be given in
	usual C-Syntax. The currently defined bits are:

	@table @code
	@item 0 (1)
	X.509 or OpenPGP protocol related data
	@item 1 (2)
	values of big number integers
	@item 2 (4)
	low level crypto operations
	@item 5 (32)
	memory allocation
	@item 6 (64)
	caching
	@item 7 (128)
	show memory statistics
	@item 9 (512)
	write hashed data to files named @code{dbgmd-000*}
	@item 10 (1024)
	trace Assuan protocol
	@item 12 (4096)
	bypass all certificate validation
	@end table

	@item --debug-all
	@opindex debug-all
	Same as @code{--debug=0xffffffff}

	@item --debug-wait @var{n}
	@opindex debug-wait
	When running in server mode, wait @var{n} seconds before entering the
	actual processing loop and print the pid. This gives time to attach a
	debugger.

	@item --debug-quick-random
	@opindex debug-quick-random
	This option inhibits the use of the very secure random quality level
	(Libgcrypt’s @code{GCRY_VERY_STRONG_RANDOM}) and degrades all request
	down to standard random quality. It is only used for testing and
	should not be used for any production quality keys. This option is
	only effective when given on the command line.

	On GNU/Linux, another way to quickly generate insecure keys is to use
	@command{rngd} to fill the kernel's entropy pool with lower quality
	random data. @command{rngd} is typically provided by the
	@command{rng-tools} package. It can be run as follows: @samp{sudo
	rngd -f -r /dev/urandom}.

	@item --debug-pinentry
	@opindex debug-pinentry
	This option enables extra debug information pertaining to the
	Pinentry. As of now it is only useful when used along with
	@code{--debug 1024}.

	@item --no-detach
	@opindex no-detach
	Don't detach the process from the console. This is mainly useful for
	debugging.

	@item -s
	@itemx --sh
	@itemx -c
	@itemx --csh
	@opindex sh
	@opindex csh
	@efindex SHELL
	Format the info output in daemon mode for use with the standard Bourne
	shell or the C-shell respectively. The default is to guess it based on
	the environment variable @code{SHELL} which is correct in almost all
	cases.


	@item --no-grab
	@opindex no-grab
	Tell the pinentry not to grab the keyboard and mouse. This option
	should in general not be used to avoid X-sniffing attacks.

	@anchor{option --log-file}
	@item --log-file @var{file}
	@opindex log-file
	@efindex HKCU\Software\GNU\GnuPG:DefaultLogFile
	Append all logging output to @var{file}. This is very helpful in
	seeing what the agent actually does. Use @file{socket://} to log to
	socket. If neither a log file nor a log file descriptor has been set
	on a Windows platform, the Registry entry
	@code{HKCU\Software\GNU\GnuPG:DefaultLogFile}, if set, is used to
	specify the logging output.


	@anchor{option --no-allow-mark-trusted}
	@item --no-allow-mark-trusted
	@opindex no-allow-mark-trusted
	Do not allow clients to mark keys as trusted, i.e. put them into the
	@file{trustlist.txt} file. This makes it harder for users to inadvertently
	accept Root-CA keys.

	@anchor{option --allow-preset-passphrase}
	@item --allow-preset-passphrase
	@opindex allow-preset-passphrase
	This option allows the use of @command{gpg-preset-passphrase} to seed the
	internal cache of @command{gpg-agent} with passphrases.

	@anchor{option --no-allow-loopback-pinentry}
	@item --no-allow-loopback-pinentry
	@item --allow-loopback-pinentry
	@opindex no-allow-loopback-pinentry
	@opindex allow-loopback-pinentry
	Disallow or allow clients to use the loopback pinentry features; see
	the option @option{pinentry-mode} for details. Allow is the default.

	The @option{--force} option of the Assuan command @command{DELETE_KEY}
	is also controlled by this option: The option is ignored if a loopback
	pinentry is disallowed.

	@item --no-allow-external-cache
	@opindex no-allow-external-cache
	Tell Pinentry not to enable features which use an external cache for
	passphrases.

	Some desktop environments prefer to unlock all
	credentials with one master password and may have installed a Pinentry
	which employs an additional external cache to implement such a policy.
	By using this option the Pinentry is advised not to make use of such a
	cache and instead always ask the user for the requested passphrase.

	@item --allow-emacs-pinentry
	@opindex allow-emacs-pinentry
	Tell Pinentry to allow features to divert the passphrase entry to a
	running Emacs instance. How this is exactly handled depends on the
	version of the used Pinentry.

	@item --ignore-cache-for-signing
	@opindex ignore-cache-for-signing
	This option will let @command{gpg-agent} bypass the passphrase cache for all
	signing operation. Note that there is also a per-session option to
	control this behavior but this command line option takes precedence.

	@item --default-cache-ttl @var{n}
	@opindex default-cache-ttl
	Set the time a cache entry is valid to @var{n} seconds. The default
	is 600 seconds. Each time a cache entry is accessed, the entry's
	timer is reset. To set an entry's maximum lifetime, use
	@command{max-cache-ttl}.

	@item --default-cache-ttl-ssh @var{n}
	@opindex default-cache-ttl
	Set the time a cache entry used for SSH keys is valid to @var{n}
	seconds. The default is 1800 seconds. Each time a cache entry is
	accessed, the entry's timer is reset. To set an entry's maximum
	lifetime, use @command{max-cache-ttl-ssh}.

	@item --max-cache-ttl @var{n}
	@opindex max-cache-ttl
	Set the maximum time a cache entry is valid to @var{n} seconds. After
	this time a cache entry will be expired even if it has been accessed
	recently or has been set using @command{gpg-preset-passphrase}. The
	default is 2 hours (7200 seconds).

	@item --max-cache-ttl-ssh @var{n}
	@opindex max-cache-ttl-ssh
	Set the maximum time a cache entry used for SSH keys is valid to
	@var{n} seconds. After this time a cache entry will be expired even
	if it has been accessed recently or has been set using
	@command{gpg-preset-passphrase}. The default is 2 hours (7200
	seconds).

	@item --enforce-passphrase-constraints
	@opindex enforce-passphrase-constraints
	Enforce the passphrase constraints by not allowing the user to bypass
	them using the ``Take it anyway'' button.

	@item --min-passphrase-len @var{n}
	@opindex min-passphrase-len
	Set the minimal length of a passphrase. When entering a new passphrase
	shorter than this value a warning will be displayed. Defaults to 8.

	@item --min-passphrase-nonalpha @var{n}
	@opindex min-passphrase-nonalpha
	Set the minimal number of digits or special characters required in a
	passphrase. When entering a new passphrase with less than this number
	of digits or special characters a warning will be displayed. Defaults
	to 1.

	@item --check-passphrase-pattern @var{file}
	@opindex check-passphrase-pattern
	Check the passphrase against the pattern given in @var{file}. When
	entering a new passphrase matching one of these pattern a warning will
	be displayed. @var{file} should be an absolute filename. The default is
	not to use any pattern file.

	Security note: It is known that checking a passphrase against a list of
	pattern or even against a complete dictionary is not very effective to
	enforce good passphrases. Users will soon figure up ways to bypass such
	a policy. A better policy is to educate users on good security
	behavior and optionally to run a passphrase cracker regularly on all
	users passphrases to catch the very simple ones.

	@item --max-passphrase-days @var{n}
	@opindex max-passphrase-days
	Ask the user to change the passphrase if @var{n} days have passed since
	the last change. With @option{--enforce-passphrase-constraints} set the
	user may not bypass this check.

	@item --enable-passphrase-history
	@opindex enable-passphrase-history
	This option does nothing yet.

	@item --pinentry-invisible-char @var{char}
	@opindex pinentry-invisible-char
	This option asks the Pinentry to use @var{char} for displaying hidden
	characters. @var{char} must be one character UTF-8 string. A
	Pinentry may or may not honor this request.

	@item --pinentry-timeout @var{n}
	@opindex pinentry-timeout
	This option asks the Pinentry to timeout after @var{n} seconds with no
	user input. The default value of 0 does not ask the pinentry to
	timeout, however a Pinentry may use its own default timeout value in
	this case. A Pinentry may or may not honor this request.

	@item --pinentry-program @var{filename}
	@opindex pinentry-program
	Use program @var{filename} as the PIN entry. The default is
	installation dependent. With the default configuration the name of
	the default pinentry is @file{pinentry}; if that file does not exist
	but a @file{pinentry-basic} exist the latter is used.

	On a Windows platform the default is to use the first existing program
	from this list:
	@file{bin\pinentry.exe},
	@file{..\Gpg4win\bin\pinentry.exe},
	@file{..\Gpg4win\pinentry.exe},
	@file{..\GNU\GnuPG\pinentry.exe},
	@file{..\GNU\bin\pinentry.exe},
	@file{bin\pinentry-basic.exe}
	where the file names are relative to the GnuPG installation directory.


	@item --pinentry-touch-file @var{filename}
	@opindex pinentry-touch-file
	By default the filename of the socket gpg-agent is listening for
	requests is passed to Pinentry, so that it can touch that file before
	exiting (it does this only in curses mode). This option changes the
	file passed to Pinentry to @var{filename}. The special name
	@code{/dev/null} may be used to completely disable this feature. Note
	that Pinentry will not create that file, it will only change the
	modification and access time.


	@item --scdaemon-program @var{filename}
	@opindex scdaemon-program
	Use program @var{filename} as the Smartcard daemon. The default is
	installation dependent and can be shown with the @command{gpgconf}
	command.

	@item --disable-scdaemon
	@opindex disable-scdaemon
	Do not make use of the scdaemon tool. This option has the effect of
	disabling the ability to do smartcard operations. Note, that enabling
	this option at runtime does not kill an already forked scdaemon.

	@item --disable-check-own-socket
	@opindex disable-check-own-socket
	@command{gpg-agent} employs a periodic self-test to detect a stolen
	socket. This usually means a second instance of @command{gpg-agent}
	has taken over the socket and @command{gpg-agent} will then terminate
	itself. This option may be used to disable this self-test for
	debugging purposes.

	@item --use-standard-socket
	@itemx --no-use-standard-socket
	@itemx --use-standard-socket-p
	@opindex use-standard-socket
	@opindex no-use-standard-socket
	@opindex use-standard-socket-p
	Since GnuPG 2.1 the standard socket is always used. These options
	have no more effect. The command @code{gpg-agent
	--use-standard-socket-p} will thus always return success.

	@item --display @var{string}
	@itemx --ttyname @var{string}
	@itemx --ttytype @var{string}
	@itemx --lc-ctype @var{string}
	@itemx --lc-messages @var{string}
	@itemx --xauthority @var{string}
	@opindex display
	@opindex ttyname
	@opindex ttytype
	@opindex lc-ctype
	@opindex lc-messages
	@opindex xauthority
	These options are used with the server mode to pass localization
	information.

	@item --keep-tty
	@itemx --keep-display
	@opindex keep-tty
	@opindex keep-display
	Ignore requests to change the current @code{tty} or X window system's
	@code{DISPLAY} variable respectively. This is useful to lock the
	pinentry to pop up at the @code{tty} or display you started the agent.


	@anchor{option --extra-socket}
	@item --extra-socket @var{name}
	@opindex extra-socket
	The extra socket is created by default, you may use this option to
	change the name of the socket. To disable the creation of the socket
	use ``none'' or ``/dev/null'' for @var{name}.

	Also listen on native gpg-agent connections on the given socket. The
	intended use for this extra socket is to setup a Unix domain socket
	forwarding from a remote machine to this socket on the local machine.
	A @command{gpg} running on the remote machine may then connect to the
	local gpg-agent and use its private keys. This enables decrypting or
	signing data on a remote machine without exposing the private keys to the
	remote machine.


	@anchor{option --enable-ssh-support}
	@item --enable-ssh-support
	@itemx --enable-putty-support
	@opindex enable-ssh-support
	@opindex enable-putty-support

	The OpenSSH Agent protocol is always enabled, but @command{gpg-agent}
	will only set the @code{SSH_AUTH_SOCK} variable if this flag is given.

	In this mode of operation, the agent does not only implement the
	gpg-agent protocol, but also the agent protocol used by OpenSSH
	(through a separate socket). Consequently, it should be possible to use
	the gpg-agent as a drop-in replacement for the well known ssh-agent.

	SSH Keys, which are to be used through the agent, need to be added to
	the gpg-agent initially through the ssh-add utility. When a key is
	added, ssh-add will ask for the password of the provided key file and
	send the unprotected key material to the agent; this causes the
	gpg-agent to ask for a passphrase, which is to be used for encrypting
	the newly received key and storing it in a gpg-agent specific
	directory.

	Once a key has been added to the gpg-agent this way, the gpg-agent
	will be ready to use the key.

	Note: in case the gpg-agent receives a signature request, the user might
	need to be prompted for a passphrase, which is necessary for decrypting
	the stored key. Since the ssh-agent protocol does not contain a
	mechanism for telling the agent on which display/terminal it is running,
	gpg-agent's ssh-support will use the TTY or X display where gpg-agent
	has been started. To switch this display to the current one, the
	following command may be used:

	@smallexample
	gpg-connect-agent updatestartuptty /bye
	@end smallexample

	Although all GnuPG components try to start the gpg-agent as needed, this
	is not possible for the ssh support because ssh does not know about it.
	Thus if no GnuPG tool which accesses the agent has been run, there is no
	guarantee that ssh is able to use gpg-agent for authentication. To fix
	this you may start gpg-agent if needed using this simple command:

	@smallexample
	gpg-connect-agent /bye
	@end smallexample

	Adding the @option{--verbose} shows the progress of starting the agent.

	The @option{--enable-putty-support} is only available under Windows
	and allows the use of gpg-agent with the ssh implementation
	@command{putty}. This is similar to the regular ssh-agent support but
	makes use of Windows message queue as required by @command{putty}.


	@end table

	All the long options may also be given in the configuration file after
	stripping off the two leading dashes.


	@mansect files
	@node Agent Configuration
	@section Configuration

	There are a few configuration files needed for the operation of the
	agent. By default they may all be found in the current home directory
	(@pxref{option --homedir}).

	@table @file

	@item gpg-agent.conf
	@efindex gpg-agent.conf
	This is the standard configuration file read by @command{gpg-agent} on
	startup. It may contain any valid long option; the leading
	two dashes may not be entered and the option may not be abbreviated.
	This file is also read after a @code{SIGHUP} however only a few
	options will actually have an effect. This default name may be
	changed on the command line (@pxref{option --options}).
	You should backup this file.

	@item trustlist.txt
	@efindex trustlist.txt
	This is the list of trusted keys. You should backup this file.

	Comment lines, indicated by a leading hash mark, as well as empty
	lines are ignored. To mark a key as trusted you need to enter its
	fingerprint followed by a space and a capital letter @code{S}. Colons
	may optionally be used to separate the bytes of a fingerprint; this
	enables cutting and pasting the fingerprint from a key listing output. If
	the line is prefixed with a @code{!} the key is explicitly marked as
	not trusted.

	Here is an example where two keys are marked as ultimately trusted
	and one as not trusted:

	@cartouche
	@smallexample
	# CN=Wurzel ZS 3,O=Intevation GmbH,C=DE
	A6935DD34EF3087973C706FC311AA2CCF733765B S

	# CN=PCA-1-Verwaltung-02/O=PKI-1-Verwaltung/C=DE
	DC:BD:69:25:48:BD:BB:7E:31:6E:BB:80:D3:00:80:35:D4:F8:A6:CD S

	# CN=Root-CA/O=Schlapphuete/L=Pullach/C=DE
	!14:56:98:D3:FE:9C:CA:5A:31:6E:BC:81:D3:11:4E:00:90:A3:44:C2 S
	@end smallexample
	@end cartouche

	Before entering a key into this file, you need to ensure its
	authenticity. How to do this depends on your organisation; your
	administrator might have already entered those keys which are deemed
	trustworthy enough into this file. Places where to look for the
	fingerprint of a root certificate are letters received from the CA or
	the website of the CA (after making 100% sure that this is indeed the
	website of that CA). You may want to consider disallowing interactive
	updates of this file by using the @ref{option --no-allow-mark-trusted}.
	It might even be advisable to change the permissions to read-only so
	that this file can't be changed inadvertently.

	As a special feature a line @code{include-default} will include a global
	list of trusted certificates (e.g. @file{@value{SYSCONFDIR}/trustlist.txt}).
	This global list is also used if the local list is not available.

	It is possible to add further flags after the @code{S} for use by the
	caller:

	@table @code

	@item relax
	@cindex relax
	Relax checking of some root certificate requirements. As of now this
	flag allows the use of root certificates with a missing basicConstraints
	attribute (despite that it is a MUST for CA certificates) and disables
	CRL checking for the root certificate.

	@item cm
	If validation of a certificate finally issued by a CA with this flag set
	fails, try again using the chain validation model.

	@end table


	@item sshcontrol
	@efindex sshcontrol
	This file is used when support for the secure shell agent protocol has
	been enabled (@pxref{option --enable-ssh-support}). Only keys present in
	this file are used in the SSH protocol. You should backup this file.

	The @command{ssh-add} tool may be used to add new entries to this file;
	you may also add them manually. Comment lines, indicated by a leading
	hash mark, as well as empty lines are ignored. An entry starts with
	optional whitespace, followed by the keygrip of the key given as 40 hex
	digits, optionally followed by the caching TTL in seconds and another
	optional field for arbitrary flags. A non-zero TTL overrides the global
	default as set by @option{--default-cache-ttl-ssh}.

	The only flag support is @code{confirm}. If this flag is found for a
	key, each use of the key will pop up a pinentry to confirm the use of
	that key. The flag is automatically set if a new key was loaded into
	@code{gpg-agent} using the option @option{-c} of the @code{ssh-add}
	command.

	The keygrip may be prefixed with a @code{!} to disable an entry.

	The following example lists exactly one key. Note that keys available
	through a OpenPGP smartcard in the active smartcard reader are
	implicitly added to this list; i.e. there is no need to list them.

	@cartouche
	@smallexample
	# Key added on: 2011-07-20 20:38:46
	# Fingerprint: 5e:8d:c4:ad:e7:af:6e:27:8a:d6:13:e4:79:ad:0b:81
	34B62F25E277CF13D3C6BCEBFD3F85D08F0A864B 0 confirm
	@end smallexample
	@end cartouche

	@item private-keys-v1.d/
	@efindex private-keys-v1.d

	This is the directory where gpg-agent stores the private keys. Each
	key is stored in a file with the name made up of the keygrip and the
	suffix @file{key}. You should backup all files in this directory
	and take great care to keep this backup closed away.


	@end table

	Note that on larger installations, it is useful to put predefined
	files into the directory @file{@value{SYSCONFSKELDIR}} so that newly created
	users start up with a working configuration. For existing users the
	a small helper script is provided to create these files (@pxref{addgnupghome}).



	@c
	@c Agent Signals
	@c
	@mansect signals
	@node Agent Signals
	@section Use of some signals
	A running @command{gpg-agent} may be controlled by signals, i.e. using
	the @command{kill} command to send a signal to the process.

	Here is a list of supported signals:

	@table @gnupgtabopt

	@item SIGHUP
	@cpindex SIGHUP
	This signal flushes all cached passphrases and if the program has been
	started with a configuration file, the configuration file is read
	again. Only certain options are honored: @code{quiet},
	@code{verbose}, @code{debug}, @code{debug-all}, @code{debug-level},
	@code{debug-pinentry},
	@code{no-grab},
	@code{pinentry-program},
	@code{pinentry-invisible-char},
	@code{default-cache-ttl},
	@code{max-cache-ttl}, @code{ignore-cache-for-signing},
	@code{no-allow-external-cache}, @code{allow-emacs-pinentry},
	@code{no-allow-mark-trusted}, @code{disable-scdaemon}, and
	@code{disable-check-own-socket}. @code{scdaemon-program} is also
	supported but due to the current implementation, which calls the
	scdaemon only once, it is not of much use unless you manually kill the
	scdaemon.


	@item SIGTERM
	@cpindex SIGTERM
	Shuts down the process but waits until all current requests are
	fulfilled. If the process has received 3 of these signals and requests
	are still pending, a shutdown is forced.

	@item SIGINT
	@cpindex SIGINT
	Shuts down the process immediately.

	@item SIGUSR1
	@cpindex SIGUSR1
	Dump internal information to the log file.

	@item SIGUSR2
	@cpindex SIGUSR2
	This signal is used for internal purposes.

	@end table

	@c
	@c Examples
	@c
	@mansect examples
	@node Agent Examples
	@section Examples

	It is important to set the environment variable @code{GPG_TTY} in
	your login shell, for example in the @file{~/.bashrc} init script:

	@cartouche
	@example
	export GPG_TTY=$(tty)
	@end example
	@end cartouche

	If you enabled the Ssh Agent Support, you also need to tell ssh about
	it by adding this to your init script:

	@cartouche
	@example
	unset SSH_AGENT_PID
	if [ "$@{gnupg_SSH_AUTH_SOCK_by:-0@}" -ne $$ ]; then
	export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
	fi
	@end example
	@end cartouche


	@c
	@c Assuan Protocol
	@c
	@manpause
	@node Agent Protocol
	@section Agent's Assuan Protocol

	Note: this section does only document the protocol, which is used by
	GnuPG components; it does not deal with the ssh-agent protocol. To
	see the full specification of each command, use

	@example
	gpg-connect-agent 'help COMMAND' /bye
	@end example

	@noindent
	or just 'help' to list all available commands.

	@noindent
	The @command{gpg-agent} daemon is started on demand by the GnuPG
	components.

	To identify a key we use a thing called keygrip which is the SHA-1 hash
	of an canonical encoded S-Expression of the public key as used in
	Libgcrypt. For the purpose of this interface the keygrip is given as a
	hex string. The advantage of using this and not the hash of a
	certificate is that it will be possible to use the same keypair for
	different protocols, thereby saving space on the token used to keep the
	secret keys.

	The @command{gpg-agent} may send status messages during a command or when
	returning from a command to inform a client about the progress or result of an
	operation. For example, the @var{INQUIRE_MAXLEN} status message may be sent
	during a server inquire to inform the client of the maximum usable length of
	the inquired data (which should not be exceeded).

	@menu
	* Agent PKDECRYPT:: Decrypting a session key
	* Agent PKSIGN:: Signing a Hash
	* Agent GENKEY:: Generating a Key
	* Agent IMPORT:: Importing a Secret Key
	* Agent EXPORT:: Exporting a Secret Key
	* Agent ISTRUSTED:: Importing a Root Certificate
	* Agent GET_PASSPHRASE:: Ask for a passphrase
	* Agent CLEAR_PASSPHRASE:: Expire a cached passphrase
	* Agent PRESET_PASSPHRASE:: Set a passphrase for a keygrip
	* Agent GET_CONFIRMATION:: Ask for confirmation
	* Agent HAVEKEY:: Check whether a key is available
	* Agent LEARN:: Register a smartcard
	* Agent PASSWD:: Change a Passphrase
	* Agent UPDATESTARTUPTTY:: Change the Standard Display
	* Agent GETEVENTCOUNTER:: Get the Event Counters
	* Agent GETINFO:: Return information about the process
	* Agent OPTION:: Set options for the session
	@end menu

	@node Agent PKDECRYPT
	@subsection Decrypting a session key

	The client asks the server to decrypt a session key. The encrypted
	session key should have all information needed to select the
	appropriate secret key or to delegate it to a smartcard.

	@example
	SETKEY <keyGrip>
	@end example

	Tell the server about the key to be used for decryption. If this is
	not used, @command{gpg-agent} may try to figure out the key by trying to
	decrypt the message with each key available.

	@example
	PKDECRYPT
	@end example

	The agent checks whether this command is allowed and then does an
	INQUIRY to get the ciphertext the client should then send the cipher
	text.

	@example
	S: INQUIRE CIPHERTEXT
	C: D (xxxxxx
	C: D xxxx)
	C: END
	@end example

	Please note that the server may send status info lines while reading the
	data lines from the client. The data send is a SPKI like S-Exp with
	this structure:

	@example
	(enc-val
	(<algo>
	(<param_name1> <mpi>)
	...
	(<param_namen> <mpi>)))
	@end example

	Where algo is a string with the name of the algorithm; see the libgcrypt
	documentation for a list of valid algorithms. The number and names of
	the parameters depend on the algorithm. The agent does return an error
	if there is an inconsistency.

	If the decryption was successful the decrypted data is returned by
	means of "D" lines.

	Here is an example session:
	@cartouche
	@smallexample
	C: PKDECRYPT
	S: INQUIRE CIPHERTEXT
	C: D (enc-val elg (a 349324324)
	C: D (b 3F444677CA)))
	C: END
	S: # session key follows
	S: S PADDING 0
	S: D (value 1234567890ABCDEF0)
	S: OK decryption successful
	@end smallexample
	@end cartouche

	The “PADDING” status line is only send if gpg-agent can tell what kind
	of padding is used. As of now only the value 0 is used to indicate
	that the padding has been removed.


	@node Agent PKSIGN
	@subsection Signing a Hash

	The client asks the agent to sign a given hash value. A default key
	will be chosen if no key has been set. To set a key a client first
	uses:

	@example
	SIGKEY <keyGrip>
	@end example

	This can be used multiple times to create multiple signature, the list
	of keys is reset with the next PKSIGN command or a RESET. The server
	tests whether the key is a valid key to sign something and responds with
	okay.

	@example
	SETHASH --hash=<name>\|<algo> <hexstring>
	@end example

	The client can use this command to tell the server about the data <hexstring>
	(which usually is a hash) to be signed. <algo> is the decimal encoded hash
	algorithm number as used by Libgcrypt. Either <algo> or --hash=<name>
	must be given. Valid names for <name> are:

	@table @code
	@item sha1
	The SHA-1 hash algorithm
	@item sha256
	The SHA-256 hash algorithm
	@item rmd160
	The RIPE-MD160 hash algorithm
	@item md5
	The old and broken MD5 hash algorithm
	@item tls-md5sha1
	A combined hash algorithm as used by the TLS protocol.
	@end table

	@noindent
	The actual signing is done using

	@example
	PKSIGN <options>
	@end example

	Options are not yet defined, but may later be used to choose among
	different algorithms. The agent does then some checks, asks for the
	passphrase and as a result the server returns the signature as an SPKI
	like S-expression in "D" lines:

	@example
	(sig-val
	(<algo>
	(<param_name1> <mpi>)
	...
	(<param_namen> <mpi>)))
	@end example


	The operation is affected by the option

	@example
	OPTION use-cache-for-signing=0\|1
	@end example

	The default of @code{1} uses the cache. Setting this option to @code{0}
	will lead @command{gpg-agent} to ignore the passphrase cache. Note, that there is
	also a global command line option for @command{gpg-agent} to globally disable the
	caching.


	Here is an example session:
	@cartouche
	@smallexample
	C: SIGKEY <keyGrip>
	S: OK key available
	C: SIGKEY <keyGrip>
	S: OK key available
	C: PKSIGN
	S: # I did ask the user whether he really wants to sign
	S: # I did ask the user for the passphrase
	S: INQUIRE HASHVAL
	C: D ABCDEF012345678901234
	C: END
	S: # signature follows
	S: D (sig-val rsa (s 45435453654612121212))
	S: OK
	@end smallexample
	@end cartouche

	@node Agent GENKEY
	@subsection Generating a Key

	This is used to create a new keypair and store the secret key inside the
	active PSE --- which is in most cases a Soft-PSE. A not-yet-defined
	option allows choosing the storage location. To get the secret key out
	of the PSE, a special export tool has to be used.

	@example
	GENKEY [--no-protection] [--preset] [<cache_nonce>]
	@end example

	Invokes the key generation process and the server will then inquire
	on the generation parameters, like:

	@example
	S: INQUIRE KEYPARM
	C: D (genkey (rsa (nbits 1024)))
	C: END
	@end example

	The format of the key parameters which depends on the algorithm is of
	the form:

	@example
	(genkey
	(algo
	(parameter_name_1 ....)
	....
	(parameter_name_n ....)))
	@end example

	If everything succeeds, the server returns the public key in a SPKI
	like S-Expression like this:

	@example
	(public-key
	(rsa
	(n <mpi>)
	(e <mpi>)))
	@end example

	Here is an example session:
	@cartouche
	@smallexample
	C: GENKEY
	S: INQUIRE KEYPARM
	C: D (genkey (rsa (nbits 1024)))
	C: END
	S: D (public-key
	S: D (rsa (n 326487324683264) (e 10001)))
	S OK key created
	@end smallexample
	@end cartouche

	The @option{--no-protection} option may be used to prevent prompting for a
	passphrase to protect the secret key while leaving the secret key unprotected.
	The @option{--preset} option may be used to add the passphrase to the cache
	using the default cache parameters.

	The @option{--inq-passwd} option may be used to create the key with a
	supplied passphrase. When used the agent does an inquiry with the
	keyword @code{NEWPASSWD} to retrieve that passphrase. This option
	takes precedence over @option{--no-protection}; however if the client
	sends a empty (zero-length) passphrase, this is identical to
	@option{--no-protection}.

	@node Agent IMPORT
	@subsection Importing a Secret Key

	This operation is not yet supported by GpgAgent. Specialized tools
	are to be used for this.

	There is no actual need because we can expect that secret keys
	created by a 3rd party are stored on a smartcard. If we have
	generated the key ourselves, we do not need to import it.

	@node Agent EXPORT
	@subsection Export a Secret Key

	Not implemented.

	Should be done by an extra tool.

	@node Agent ISTRUSTED
	@subsection Importing a Root Certificate

	Actually we do not import a Root Cert but provide a way to validate
	any piece of data by storing its Hash along with a description and
	an identifier in the PSE. Here is the interface description:

	@example
	ISTRUSTED <fingerprint>
	@end example

	Check whether the OpenPGP primary key or the X.509 certificate with the
	given fingerprint is an ultimately trusted key or a trusted Root CA
	certificate. The fingerprint should be given as a hexstring (without
	any blanks or colons or whatever in between) and may be left padded with
	00 in case of an MD5 fingerprint. GPGAgent will answer with:

	@example
	OK
	@end example

	The key is in the table of trusted keys.

	@example
	ERR 304 (Not Trusted)
	@end example

	The key is not in this table.

	Gpg needs the entire list of trusted keys to maintain the web of
	trust; the following command is therefore quite helpful:

	@example
	LISTTRUSTED
	@end example

	GpgAgent returns a list of trusted keys line by line:

	@example
	S: D 000000001234454556565656677878AF2F1ECCFF P
	S: D 340387563485634856435645634856438576457A P
	S: D FEDC6532453745367FD83474357495743757435D S
	S: OK
	@end example

	The first item on a line is the hexified fingerprint where MD5
	fingerprints are @code{00} padded to the left and the second item is a
	flag to indicate the type of key (so that gpg is able to only take care
	of PGP keys). P = OpenPGP, S = S/MIME. A client should ignore the rest
	of the line, so that we can extend the format in the future.

	Finally a client should be able to mark a key as trusted:

	@example
	MARKTRUSTED @var{fingerprint} "P"\|"S"
	@end example

	The server will then pop up a window to ask the user whether she
	really trusts this key. For this it will probably ask for a text to
	be displayed like this:

	@example
	S: INQUIRE TRUSTDESC
	C: D Do you trust the key with the fingerprint @@FPR@@
	C: D bla fasel blurb.
	C: END
	S: OK
	@end example

	Known sequences with the pattern @@foo@@ are replaced according to this
	table:

	@table @code
	@item @@FPR16@@
	Format the fingerprint according to gpg rules for a v3 keys.
	@item @@FPR20@@
	Format the fingerprint according to gpg rules for a v4 keys.
	@item @@FPR@@
	Choose an appropriate format to format the fingerprint.
	@item @@@@
	Replaced by a single @code{@@}.
	@end table

	@node Agent GET_PASSPHRASE
	@subsection Ask for a passphrase

	This function is usually used to ask for a passphrase to be used for
	symmetric encryption, but may also be used by programs which need
	special handling of passphrases. This command uses a syntax which helps
	clients to use the agent with minimum effort.

	@example
	GET_PASSPHRASE [--data] [--check] [--no-ask] [--repeat[=N]] \
	[--qualitybar] @var{cache_id} \
	[@var{error_message} @var{prompt} @var{description}]
	@end example

	@var{cache_id} is expected to be a string used to identify a cached
	passphrase. Use a @code{X} to bypass the cache. With no other
	arguments the agent returns a cached passphrase or an error. By
	convention either the hexified fingerprint of the key shall be used for
	@var{cache_id} or an arbitrary string prefixed with the name of the
	calling application and a colon: Like @code{gpg:somestring}.

	@var{error_message} is either a single @code{X} for no error message or
	a string to be shown as an error message like (e.g. "invalid
	passphrase"). Blanks must be percent escaped or replaced by @code{+}'.

	@var{prompt} is either a single @code{X} for a default prompt or the
	text to be shown as the prompt. Blanks must be percent escaped or
	replaced by @code{+}.

	@var{description} is a text shown above the entry field. Blanks must be
	percent escaped or replaced by @code{+}.

	The agent either returns with an error or with a OK followed by the hex
	encoded passphrase. Note that the length of the strings is implicitly
	limited by the maximum length of a command. If the option
	@option{--data} is used, the passphrase is not returned on the OK line
	but by regular data lines; this is the preferred method.

	If the option @option{--check} is used, the standard passphrase
	constraints checks are applied. A check is not done if the passphrase
	has been found in the cache.

	If the option @option{--no-ask} is used and the passphrase is not in the
	cache the user will not be asked to enter a passphrase but the error
	code @code{GPG_ERR_NO_DATA} is returned.

	If the option @option{--qualitybar} is used and a minimum passphrase
	length has been configured, a visual indication of the entered
	passphrase quality is shown.

	@example
	CLEAR_PASSPHRASE @var{cache_id}
	@end example

	may be used to invalidate the cache entry for a passphrase. The
	function returns with OK even when there is no cached passphrase.



	@node Agent CLEAR_PASSPHRASE
	@subsection Remove a cached passphrase

	Use this command to remove a cached passphrase.

	@example
	CLEAR_PASSPHRASE [--mode=normal] <cache_id>
	@end example

	The @option{--mode=normal} option can be used to clear a @var{cache_id} that
	was set by gpg-agent.


	@node Agent PRESET_PASSPHRASE
	@subsection Set a passphrase for a keygrip

	This command adds a passphrase to the cache for the specified @var{keygrip}.

	@example
	PRESET_PASSPHRASE [--inquire] <string_or_keygrip> <timeout> [<hexstring>]
	@end example

	The passphrase is a hexidecimal string when specified. When not specified, the
	passphrase will be retrieved from the pinentry module unless the
	@option{--inquire} option was specified in which case the passphrase will be
	retrieved from the client.

	The @var{timeout} parameter keeps the passphrase cached for the specified
	number of seconds. A value of @code{-1} means infinite while @code{0} means
	the default (currently only a timeout of -1 is allowed, which means to never
	expire it).


	@node Agent GET_CONFIRMATION
	@subsection Ask for confirmation

	This command may be used to ask for a simple confirmation by
	presenting a text and 2 buttons: Okay and Cancel.

	@example
	GET_CONFIRMATION @var{description}
	@end example

	@var{description}is displayed along with a Okay and Cancel
	button. Blanks must be percent escaped or replaced by @code{+}. A
	@code{X} may be used to display confirmation dialog with a default
	text.

	The agent either returns with an error or with a OK. Note, that the
	length of @var{description} is implicitly limited by the maximum
	length of a command.



	@node Agent HAVEKEY
	@subsection Check whether a key is available

	This can be used to see whether a secret key is available. It does
	not return any information on whether the key is somehow protected.

	@example
	HAVEKEY @var{keygrips}
	@end example

	The agent answers either with OK or @code{No_Secret_Key} (208). The
	caller may want to check for other error codes as well. More than one
	keygrip may be given. In this case the command returns success if at
	least one of the keygrips corresponds to an available secret key.


	@node Agent LEARN
	@subsection Register a smartcard

	@example
	LEARN [--send]
	@end example

	This command is used to register a smartcard. With the @option{--send}
	option given the certificates are sent back.


	@node Agent PASSWD
	@subsection Change a Passphrase

	@example
	PASSWD [--cache-nonce=<c>] [--passwd-nonce=<s>] [--preset] @var{keygrip}
	@end example

	This command is used to interactively change the passphrase of the key
	identified by the hex string @var{keygrip}. The @option{--preset}
	option may be used to add the new passphrase to the cache using the
	default cache parameters.


	@node Agent UPDATESTARTUPTTY
	@subsection Change the standard display

	@example
	UPDATESTARTUPTTY
	@end example

	Set the startup TTY and X-DISPLAY variables to the values of this
	session. This command is useful to direct future pinentry invocations
	to another screen. It is only required because there is no way in the
	ssh-agent protocol to convey this information.


	@node Agent GETEVENTCOUNTER
	@subsection Get the Event Counters

	@example
	GETEVENTCOUNTER
	@end example

	This function return one status line with the current values of the
	event counters. The event counters are useful to avoid polling by
	delaying a poll until something has changed. The values are decimal
	numbers in the range @code{0} to @code{UINT_MAX} and wrapping around to
	0. The actual values should not be relied upon; they shall only be used
	to detect a change.

	-The currently defined counters are are:
	+The currently defined counters are:
	@table @code
	@item ANY
	Incremented with any change of any of the other counters.
	@item KEY
	Incremented for added or removed private keys.
	@item CARD
	Incremented for changes of the card readers stati.
	@end table

	@node Agent GETINFO
	@subsection Return information about the process

	This is a multipurpose function to return a variety of information.

	@example
	GETINFO @var{what}
	@end example

	The value of @var{what} specifies the kind of information returned:
	@table @code
	@item version
	Return the version of the program.
	@item pid
	Return the process id of the process.
	@item socket_name
	Return the name of the socket used to connect the agent.
	@item ssh_socket_name
	Return the name of the socket used for SSH connections. If SSH support
	has not been enabled the error @code{GPG_ERR_NO_DATA} will be returned.
	@end table

	@node Agent OPTION
	@subsection Set options for the session

	Here is a list of session options which are not yet described with
	other commands. The general syntax for an Assuan option is:

	@smallexample
	OPTION @var{key}=@var{value}
	@end smallexample

	@noindent
	Supported @var{key}s are:

	@table @code
	@item agent-awareness
	This may be used to tell gpg-agent of which gpg-agent version the
	client is aware of. gpg-agent uses this information to enable
	features which might break older clients.

	@item putenv
	Change the session's environment to be used for the
	Pinentry. Valid values are:

	@table @code
	@item @var{name}
	Delete envvar @var{name}
	@item @var{name}=
	Set envvar @var{name} to the empty string
	@item @var{name}=@var{value}
	Set envvar @var{name} to the string @var{value}.
	@end table

	@item use-cache-for-signing
	See Assuan command @code{PKSIGN}.

	@item allow-pinentry-notify
	This does not need any value. It is used to enable the
	PINENTRY_LAUNCHED inquiry.

	@item pinentry-mode
	This option is used to change the operation mode of the pinentry. The
	following values are defined:

	@table @code
	@item ask
	This is the default mode which pops up a pinentry as needed.

	@item cancel
	Instead of popping up a pinentry, return the error code
	@code{GPG_ERR_CANCELED}.

	@item error
	Instead of popping up a pinentry, return the error code
	@code{GPG_ERR_NO_PIN_ENTRY}.

	@item loopback
	Use a loopback pinentry. This fakes a pinentry by using inquiries
	back to the caller to ask for a passphrase. This option may only be
	set if the agent has been configured for that.
	To disable this feature use @ref{option --no-allow-loopback-pinentry}.
	@end table

	@item cache-ttl-opt-preset
	This option sets the cache TTL for new entries created by GENKEY and
	-PASSWD commands when using the @option{--preset} option. It it is not
	+PASSWD commands when using the @option{--preset} option. It is not
	used a default value is used.

	@item s2k-count
	Instead of using the standard S2K count (which is computed on the
	fly), the given S2K count is used for new keys or when changing the
	passphrase of a key. Values below 65536 are considered to be 0. This
	option is valid for the entire session or until reset to 0. This
	option is useful if the key is later used on boxes which are either
	much slower or faster than the actual box.

	@end table


	@mansect see also
	@ifset isman
	@command{@gpgname}(1),
	@command{gpgsm}(1),
	@command{gpgconf}(1),
	@command{gpg-connect-agent}(1),
	@command{scdaemon}(1)
	@end ifset
	@include see-also-note.texi
	diff --git a/doc/gpg.texi b/doc/gpg.texi
	index 16c9674c5..78dd6516c 100644
	--- a/doc/gpg.texi
	+++ b/doc/gpg.texi
	@@ -1,4064 +1,4064 @@
	@c Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	@c 2008, 2009, 2010 Free Software Foundation, Inc.
	@c This is part of the GnuPG manual.
	@c For copying conditions, see the file gnupg.texi.

	@include defs.inc

	@node Invoking GPG
	@chapter Invoking GPG
	@cindex GPG command options
	@cindex command options
	@cindex options, GPG command


	@c Begin standard stuff
	@ifclear gpgtwohack
	@manpage gpg.1
	@ifset manverb
	.B gpg
	\- OpenPGP encryption and signing tool
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B gpg
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.I command
	.RI [ args ]
	@end ifset
	@end ifclear
	@c End standard stuff

	@c Begin gpg2 hack stuff
	@ifset gpgtwohack
	@manpage gpg2.1
	@ifset manverb
	.B gpg2
	\- OpenPGP encryption and signing tool
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B gpg2
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.I command
	.RI [ args ]
	@end ifset
	@end ifset
	@c End gpg2 hack stuff


	@mansect description
	@command{@gpgname} is the OpenPGP part of the GNU Privacy Guard (GnuPG). It
	is a tool to provide digital encryption and signing services using the
	OpenPGP standard. @command{@gpgname} features complete key management and
	all the bells and whistles you would expect from a full OpenPGP
	implementation.

	There are two main versions of GnuPG: GnuPG 1.x and GnuPG 2.x. GnuPG
	2.x supports modern encryption algorithms and thus should be preferred
	over GnuPG 1.x. You only need to use GnuPG 1.x if your platform
	doesn't support GnuPG 2.x, or you need support for some features that
	GnuPG 2.x has deprecated, e.g., decrypting data created with PGP-2
	keys.

	@ifclear gpgtwohack
	If you are looking for version 1 of GnuPG, you may find that version
	installed under the name @command{gpg1}.
	@end ifclear
	@ifset gpgtwohack
	In contrast to the standalone command @command{gpg} from GnuPG 1.x,
	the 2.x version is commonly installed under the name
	@command{@gpgname}.
	@end ifset

	@manpause

	@xref{Option Index}, for an index to @command{@gpgname}'s commands and options.
	@mancont

	@menu
	* GPG Commands:: List of all commands.
	* GPG Options:: List of all options.
	* GPG Configuration:: Configuration files.
	* GPG Examples:: Some usage examples.

	Developer information:
	* Unattended Usage of GPG:: Using @command{gpg} from other programs.
	@end menu

	@c * GPG Protocol:: The protocol the server mode uses.


	@c *******************************************
	@c ************* **************
	@c ************* COMMANDS **************
	@c ************* **************
	@c *******************************************
	@mansect commands
	@node GPG Commands
	@section Commands

	Commands are not distinguished from options except for the fact that
	only one command is allowed. Generally speaking, irrelevant options
	are silently ignored, and may not be checked for correctness.

	@command{@gpgname} may be run with no commands. In this case it will
	perform a reasonable action depending on the type of file it is given
	as input (an encrypted message is decrypted, a signature is verified,
	a file containing keys is listed, etc.).


	@menu
	* General GPG Commands:: Commands not specific to the functionality.
	* Operational GPG Commands:: Commands to select the type of operation.
	* OpenPGP Key Management:: How to manage your keys.
	@end menu


	@c *******************************************
	@c ******** GENERAL COMMANDS ***********
	@c *******************************************
	@node General GPG Commands
	@subsection Commands not specific to the function

	@table @gnupgtabopt
	@item --version
	@opindex version
	Print the program version and licensing information. Note that you
	cannot abbreviate this command.

	@item --help
	@itemx -h
	@opindex help
	Print a usage message summarizing the most useful command-line options.
	Note that you cannot arbitrarily abbreviate this command
	(though you can use its short form @option{-h}).

	@item --warranty
	@opindex warranty
	Print warranty information.

	@item --dump-options
	@opindex dump-options
	Print a list of all available options and commands. Note that you cannot
	abbreviate this command.
	@end table


	@c *******************************************
	@c ****** OPERATIONAL COMMANDS *********
	@c *******************************************
	@node Operational GPG Commands
	@subsection Commands to select the type of operation


	@table @gnupgtabopt

	@item --sign
	@itemx -s
	@opindex sign
	Sign a message. This command may be combined with @option{--encrypt}
	(to sign and encrypt a message), @option{--symmetric} (to sign and
	symmetrically encrypt a message), or both @option{--encrypt} and
	@option{--symmetric} (to sign and encrypt a message that can be
	decrypted using a secret key or a passphrase). The signing key is
	chosen by default or can be set explicitly using the
	@option{--local-user} and @option{--default-key} options.

	@item --clear-sign
	@opindex clear-sign
	@itemx --clearsign
	@opindex clearsign
	Make a cleartext signature. The content in a cleartext signature is
	readable without any special software. OpenPGP software is only needed
	to verify the signature. cleartext signatures may modify end-of-line
	whitespace for platform independence and are not intended to be
	reversible. The signing key is chosen by default or can be set
	explicitly using the @option{--local-user} and @option{--default-key}
	options.


	@item --detach-sign
	@itemx -b
	@opindex detach-sign
	Make a detached signature.

	@item --encrypt
	@itemx -e
	@opindex encrypt
	Encrypt data. This command may be combined with @option{--sign} (to
	sign and encrypt a message), @option{--symmetric} (to encrypt a
	message that can decrypted using a secret key or a passphrase), or
	@option{--sign} and @option{--symmetric} together (for a signed
	message that can be decrypted using a secret key or a passphrase).

	@item --symmetric
	@itemx -c
	@opindex symmetric
	Encrypt with a symmetric cipher using a passphrase. The default
	symmetric cipher used is @value{GPGSYMENCALGO}, but may be chosen with the
	@option{--cipher-algo} option. This command may be combined with
	@option{--sign} (for a signed and symmetrically encrypted message),
	@option{--encrypt} (for a message that may be decrypted via a secret key
	or a passphrase), or @option{--sign} and @option{--encrypt} together
	(for a signed message that may be decrypted via a secret key or a
	passphrase).

	@item --store
	@opindex store
	Store only (make a simple literal data packet).

	@item --decrypt
	@itemx -d
	@opindex decrypt
	Decrypt the file given on the command line (or STDIN if no file
	is specified) and write it to STDOUT (or the file specified with
	@option{--output}). If the decrypted file is signed, the signature is also
	verified. This command differs from the default operation, as it never
	writes to the filename which is included in the file and it rejects
	files that don't begin with an encrypted message.

	@item --verify
	@opindex verify
	Assume that the first argument is a signed file and verify it without
	generating any output. With no arguments, the signature packet is
	read from STDIN. If only one argument is given, the specified file is
	expected to include a complete signature.

	With more than one argument, the first argument should specify a file
	with a detached signature and the remaining files should contain the
	signed data. To read the signed data from STDIN, use @samp{-} as the
	second filename. For security reasons, a detached signature will not
	read the signed material from STDIN if not explicitly specified.

	Note: If the option @option{--batch} is not used, @command{@gpgname}
	may assume that a single argument is a file with a detached signature,
	and it will try to find a matching data file by stripping certain
	suffixes. Using this historical feature to verify a detached
	signature is strongly discouraged; you should always specify the data file
	explicitly.

	Note: When verifying a cleartext signature, @command{@gpgname} verifies
	only what makes up the cleartext signed data and not any extra data
	outside of the cleartext signature or the header lines directly following
	the dash marker line. The option @code{--output} may be used to write
	out the actual signed data, but there are other pitfalls with this
	format as well. It is suggested to avoid cleartext signatures in
	favor of detached signatures.

	Note: Sometimes the use of the @command{gpgv} tool is easier than
	using the full-fledged @command{gpg} with this option. @command{gpgv}
	is designed to compare signed data against a list of trusted keys and
	returns with success only for a good signature. It has its own manual
	page.


	@item --multifile
	@opindex multifile
	This modifies certain other commands to accept multiple files for
	processing on the command line or read from STDIN with each filename on
	a separate line. This allows for many files to be processed at
	once. @option{--multifile} may currently be used along with
	@option{--verify}, @option{--encrypt}, and @option{--decrypt}. Note that
	@option{--multifile --verify} may not be used with detached signatures.

	@item --verify-files
	@opindex verify-files
	Identical to @option{--multifile --verify}.

	@item --encrypt-files
	@opindex encrypt-files
	Identical to @option{--multifile --encrypt}.

	@item --decrypt-files
	@opindex decrypt-files
	Identical to @option{--multifile --decrypt}.

	@item --list-keys
	@itemx -k
	@itemx --list-public-keys
	@opindex list-keys
	List the specified keys. If no keys are specified, then all keys from
	the configured public keyrings are listed.

	Never use the output of this command in scripts or other programs.
	The output is intended only for humans and its format is likely to
	change. The @option{--with-colons} option emits the output in a
	stable, machine-parseable format, which is intended for use by scripts
	and other programs.

	@item --list-secret-keys
	@itemx -K
	@opindex list-secret-keys
	List the specified secret keys. If no keys are specified, then all
	known secret keys are listed. A @code{#} after the letters @code{sec}
	means that the secret key is not usable (for example, if it was
	exported using @option{--export-secret-subkeys}). See also
	@option{--list-keys}.

	@item --list-signatures
	@opindex list-signatures
	@itemx --list-sigs
	@opindex list-sigs
	Same as @option{--list-keys}, but the signatures are listed too.
	This command has the same effect as
	using @option{--list-keys} with @option{--with-sig-list}.

	For each signature listed, there are several flags in between the "sig"
	tag and keyid. These flags give additional information about each
	signature. From left to right, they are the numbers 1-3 for certificate
	check level (see @option{--ask-cert-level}), "L" for a local or
	non-exportable signature (see @option{--lsign-key}), "R" for a
	nonRevocable signature (see the @option{--edit-key} command "nrsign"),
	"P" for a signature that contains a policy URL (see
	@option{--cert-policy-url}), "N" for a signature that contains a
	notation (see @option{--cert-notation}), "X" for an eXpired signature
	(see @option{--ask-cert-expire}), and the numbers 1-9 or "T" for 10 and
	above to indicate trust signature levels (see the @option{--edit-key}
	command "tsign").

	@item --check-signatures
	@opindex check-signatures
	@itemx --check-sigs
	@opindex check-sigs
	Same as @option{--list-signatures}, but the signatures are verified. Note
	that for performance reasons the revocation status of a signing key is
	not shown.
	This command has the same effect as
	using @option{--list-keys} with @option{--with-sig-check}.

	The status of the verification is indicated by a flag directly following
	the "sig" tag (and thus before the flags described above for
	@option{--list-signatures}). A "!" indicates that the signature has been
	successfully verified, a "-" denotes a bad signature and a "%" is used
	if an error occurred while checking the signature (e.g. a non supported
	algorithm).

	@item --locate-keys
	@opindex locate-keys
	Locate the keys given as arguments. This command basically uses the
	same algorithm as used when locating keys for encryption or signing and
	may thus be used to see what keys @command{@gpgname} might use. In
	particular external methods as defined by @option{--auto-key-locate} may
	be used to locate a key. Only public keys are listed.

	@item --fingerprint
	@opindex fingerprint
	List all keys (or the specified ones) along with their
	fingerprints. This is the same output as @option{--list-keys} but with
	the additional output of a line with the fingerprint. May also be
	combined with @option{--list-signatures} or @option{--check-signatures}. If this
	command is given twice, the fingerprints of all secondary keys are
	listed too. This command also forces pretty printing of fingerprints
	if the keyid format has been set to "none".

	@item --list-packets
	@opindex list-packets
	List only the sequence of packets. This command is only useful for
	debugging. When used with option @option{--verbose} the actual MPI
	values are dumped and not only their lengths. Note that the output of
	this command may change with new releases.


	@item --edit-card
	@opindex edit-card
	@itemx --card-edit
	@opindex card-edit
	Present a menu to work with a smartcard. The subcommand "help" provides
	an overview on available commands. For a detailed description, please
	see the Card HOWTO at
	https://gnupg.org/documentation/howtos.html#GnuPG-cardHOWTO .

	@item --card-status
	@opindex card-status
	Show the content of the smart card.

	@item --change-pin
	@opindex change-pin
	Present a menu to allow changing the PIN of a smartcard. This
	functionality is also available as the subcommand "passwd" with the
	@option{--edit-card} command.

	@item --delete-keys @code{name}
	@itemx --delete-keys @code{name}
	Remove key from the public keyring. In batch mode either @option{--yes} is
	required or the key must be specified by fingerprint. This is a
	safeguard against accidental deletion of multiple keys.

	@item --delete-secret-keys @code{name}
	@opindex delete-secret-keys
	Remove key from the secret keyring. In batch mode the key must be
	specified by fingerprint. The option @option{--yes} can be used to
	advice gpg-agent not to request a confirmation. This extra
	pre-caution is done because @command{@gpgname} can't be sure that the
	secret key (as controlled by gpg-agent) is only used for the given
	OpenPGP public key.


	@item --delete-secret-and-public-key @code{name}
	@opindex delete-secret-and-public-key
	Same as @option{--delete-key}, but if a secret key exists, it will be
	removed first. In batch mode the key must be specified by fingerprint.
	The option @option{--yes} can be used to advice gpg-agent not to
	request a confirmation.

	@item --export
	@opindex export
	Either export all keys from all keyrings (default keyrings and those
	registered via option @option{--keyring}), or if at least one name is given,
	those of the given name. The exported keys are written to STDOUT or to the
	file given with option @option{--output}. Use together with
	@option{--armor} to mail those keys.

	@item --send-keys @code{key IDs}
	@opindex send-keys
	Similar to @option{--export} but sends the keys to a keyserver.
	Fingerprints may be used instead of key IDs. Option @option{--keyserver}
	must be used to give the name of this keyserver. Don't send your
	complete keyring to a keyserver --- select only those keys which are new
	or changed by you. If no key IDs are given, @command{@gpgname} does nothing.

	@item --export-secret-keys
	@itemx --export-secret-subkeys
	@opindex export-secret-keys
	@opindex export-secret-subkeys
	Same as @option{--export}, but exports the secret keys instead. The
	exported keys are written to STDOUT or to the file given with option
	@option{--output}. This command is often used along with the option
	@option{--armor} to allow for easy printing of the key for paper backup;
	however the external tool @command{paperkey} does a better job of
	creating backups on paper. Note that exporting a secret key can be a
	security risk if the exported keys are sent over an insecure channel.

	The second form of the command has the special property to render the
	secret part of the primary key useless; this is a GNU extension to
	OpenPGP and other implementations can not be expected to successfully
	import such a key. Its intended use is in generating a full key with
	an additional signing subkey on a dedicated machine. This command
	then exports the key without the primary key to the main machine.

	GnuPG may ask you to enter the passphrase for the key. This is
	required, because the internal protection method of the secret key is
	different from the one specified by the OpenPGP protocol.

	@item --export-ssh-key
	@opindex export-ssh-key
	This command is used to export a key in the OpenSSH public key format.
	It requires the specification of one key by the usual means and
	exports the latest valid subkey which has an authentication capability
	to STDOUT or to the file given with option @option{--output}. That
	output can directly be added to ssh's @file{authorized_key} file.

	By specifying the key to export using a key ID or a fingerprint
	suffixed with an exclamation mark (!), a specific subkey or the
	primary key can be exported. This does not even require that the key
	has the authentication capability flag set.

	@item --import
	@itemx --fast-import
	@opindex import
	Import/merge keys. This adds the given keys to the
	keyring. The fast version is currently just a synonym.

	There are a few other options which control how this command works.
	Most notable here is the @option{--import-options merge-only} option
	which does not insert new keys but does only the merging of new
	signatures, user-IDs and subkeys.

	@item --receive-keys @code{key IDs}
	@opindex receive-keys
	@itemx --recv-keys @code{key IDs}
	@opindex recv-keys
	Import the keys with the given key IDs from a keyserver. Option
	@option{--keyserver} must be used to give the name of this keyserver.

	@item --refresh-keys
	@opindex refresh-keys
	Request updates from a keyserver for keys that already exist on the
	local keyring. This is useful for updating a key with the latest
	signatures, user IDs, etc. Calling this with no arguments will refresh
	the entire keyring. Option @option{--keyserver} must be used to give the
	name of the keyserver for all keys that do not have preferred keyservers
	set (see @option{--keyserver-options honor-keyserver-url}).

	@item --search-keys @code{names}
	@opindex search-keys
	Search the keyserver for the given names. Multiple names given here will
	be joined together to create the search string for the keyserver.
	Option @option{--keyserver} must be used to give the name of this
	keyserver. Keyservers that support different search methods allow using
	the syntax specified in "How to specify a user ID" below. Note that
	different keyserver types support different search methods. Currently
	only LDAP supports them all.

	@item --fetch-keys @code{URIs}
	@opindex fetch-keys
	Retrieve keys located at the specified URIs. Note that different
	installations of GnuPG may support different protocols (HTTP, FTP,
	LDAP, etc.). When using HTTPS the system provided root certificates
	are used by this command.

	@item --update-trustdb
	@opindex update-trustdb
	Do trust database maintenance. This command iterates over all keys and
	builds the Web of Trust. This is an interactive command because it may
	have to ask for the "ownertrust" values for keys. The user has to give
	an estimation of how far she trusts the owner of the displayed key to
	correctly certify (sign) other keys. GnuPG only asks for the ownertrust
	value if it has not yet been assigned to a key. Using the
	@option{--edit-key} menu, the assigned value can be changed at any time.

	@item --check-trustdb
	@opindex check-trustdb
	Do trust database maintenance without user interaction. From time to
	time the trust database must be updated so that expired keys or
	signatures and the resulting changes in the Web of Trust can be
	tracked. Normally, GnuPG will calculate when this is required and do it
	automatically unless @option{--no-auto-check-trustdb} is set. This
	command can be used to force a trust database check at any time. The
	processing is identical to that of @option{--update-trustdb} but it
	skips keys with a not yet defined "ownertrust".

	For use with cron jobs, this command can be used together with
	@option{--batch} in which case the trust database check is done only if
	a check is needed. To force a run even in batch mode add the option
	@option{--yes}.

	@anchor{option --export-ownertrust}
	@item --export-ownertrust
	@opindex export-ownertrust
	Send the ownertrust values to STDOUT. This is useful for backup purposes
	as these values are the only ones which can't be re-created from a
	corrupted trustdb. Example:
	@c man:.RS
	@example
	@gpgname{} --export-ownertrust > otrust.txt
	@end example
	@c man:.RE


	@item --import-ownertrust
	@opindex import-ownertrust
	Update the trustdb with the ownertrust values stored in @code{files} (or
	STDIN if not given); existing values will be overwritten. In case of a
	severely damaged trustdb and if you have a recent backup of the
	ownertrust values (e.g. in the file @file{otrust.txt}), you may re-create
	the trustdb using these commands:
	@c man:.RS
	@example
	cd ~/.gnupg
	rm trustdb.gpg
	@gpgname{} --import-ownertrust < otrust.txt
	@end example
	@c man:.RE


	@item --rebuild-keydb-caches
	@opindex rebuild-keydb-caches
	When updating from version 1.0.6 to 1.0.7 this command should be used
	to create signature caches in the keyring. It might be handy in other
	situations too.

	@item --print-md @code{algo}
	@itemx --print-mds
	@opindex print-md
	Print message digest of algorithm ALGO for all given files or STDIN.
	With the second form (or a deprecated "*" as algo) digests for all
	available algorithms are printed.

	@item --gen-random @code{0\|1\|2} @code{count}
	@opindex gen-random
	Emit @var{count} random bytes of the given quality level 0, 1 or 2. If
	@var{count} is not given or zero, an endless sequence of random bytes
	will be emitted. If used with @option{--armor} the output will be
	base64 encoded. PLEASE, don't use this command unless you know what
	you are doing; it may remove precious entropy from the system!

	@item --gen-prime @code{mode} @code{bits}
	@opindex gen-prime
	Use the source, Luke :-). The output format is still subject to change.


	@item --enarmor
	@itemx --dearmor
	@opindex enarmor
	@opindex dearmor
	Pack or unpack an arbitrary input into/from an OpenPGP ASCII armor.
	This is a GnuPG extension to OpenPGP and in general not very useful.

	@item --tofu-policy @code{auto\|good\|unknown\|bad\|ask} @code{key...}
	@opindex tofu-policy
	Set the TOFU policy for all the bindings associated with the specified
	keys. For more information about the meaning of the policies,
	@pxref{trust-model-tofu}. The keys may be specified either by their
	fingerprint (preferred) or their keyid.

	@c @item --server
	@c @opindex server
	@c Run gpg in server mode. This feature is not yet ready for use and
	@c thus not documented.

	@end table


	@c *******************************************
	@c ***** KEY MANGEMENT COMMANDS ********
	@c *******************************************
	@node OpenPGP Key Management
	@subsection How to manage your keys

	This section explains the main commands for key management.

	@table @gnupgtabopt

	@item --quick-generate-key @code{user-id} [@code{algo} [@code{usage} [@code{expire}]]]
	@opindex quick-generate-key
	This is a simple command to generate a standard key with one user id.
	In contrast to @option{--generate-key} the key is generated directly
	without the need to answer a bunch of prompts. Unless the option
	@option{--yes} is given, the key creation will be canceled if the
	given user id already exists in the keyring.

	If invoked directly on the console without any special options an
	answer to a ``Continue?'' style confirmation prompt is required. In
	case the user id already exists in the keyring a second prompt to
	force the creation of the key will show up.

	If @code{algo} or @code{usage} are given, only the primary key is
	created and no prompts are shown. To specify an expiration date but
	still create a primary and subkey use ``default'' or
	``future-default'' for @code{algo} and ``default'' for @code{usage}.
	For a description of these optional arguments see the command
	@code{--quick-add-key}. The @code{usage} accepts also the value
	``cert'' which can be used to create a certification only primary key;
	the default is to a create certification and signing key.

	The @code{expire} argument can be used to specify an expiration date
	for the key. Several formats are supported; commonly the ISO formats
	``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used. To make the key
	expire in N seconds, N days, N weeks, N months, or N years use
	``seconds=N'', ``Nd'', ``Nw'', ``Nm'', or ``Ny'' respectively. Not
	specifying a value, or using ``-'' results in a key expiring in a
	reasonable default interval. The values ``never'', ``none'' can be
	used for no expiration date.

	If this command is used with @option{--batch},
	@option{--pinentry-mode} has been set to @code{loopback}, and one of
	the passphrase options (@option{--passphrase},
	@option{--passphrase-fd}, or @option{passphrase-file}) is used, the
	supplied passphrase is used for the new key and the agent does not ask
	for it. To create a key without any protection @code{--passphrase ''}
	may be used.

	@item --quick-set-expire @code{fpr} @code{expire}
	@opindex quick-set-expire
	Directly set the expiration time of the primary key to @code{expire}.
	To remove the expiration time @code{0} can be used.


	@item --quick-add-key @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
	@opindex quick-add-key
	Directly add a subkey to the key identified by the fingerprint
	@code{fpr}. Without the optional arguments an encryption subkey is
	added. If any of the arguments are given a more specific subkey is
	added.

	@code{algo} may be any of the supported algorithms or curve names
	given in the format as used by key listings. To use the default
	algorithm the string ``default'' or ``-'' can be used. Supported
	algorithms are ``rsa'', ``dsa'', ``elg'', ``ed25519'', ``cv25519'',
	and other ECC curves. For example the string ``rsa'' adds an RSA key
	with the default key length; a string ``rsa4096'' requests that the
	key length is 4096 bits. The string ``future-default'' is an alias
	for the algorithm which will likely be used as default algorithm in
	future versions of gpg.

	Depending on the given @code{algo} the subkey may either be an
	encryption subkey or a signing subkey. If an algorithm is capable of
	signing and encryption and such a subkey is desired, a @code{usage}
	string must be given. This string is either ``default'' or ``-'' to
	keep the default or a comma delimited list (or space delimited list)
	of keywords: ``sign'' for a signing subkey, ``auth'' for an
	authentication subkey, and ``encr'' for an encryption subkey
	(``encrypt'' can be used as alias for ``encr''). The valid
	combinations depend on the algorithm.

	The @code{expire} argument can be used to specify an expiration date
	for the key. Several formats are supported; commonly the ISO formats
	``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used. To make the key
	expire in N seconds, N days, N weeks, N months, or N years use
	``seconds=N'', ``Nd'', ``Nw'', ``Nm'', or ``Ny'' respectively. Not
	specifying a value, or using ``-'' results in a key expiring in a
	reasonable default interval. The values ``never'', ``none'' can be
	used for no expiration date.

	@item --generate-key
	@opindex generate-key
	@itemx --gen-key
	@opindex gen-key
	Generate a new key pair using the current default parameters. This is
	the standard command to create a new key. In addition to the key a
	revocation certificate is created and stored in the
	@file{openpgp-revocs.d} directory below the GnuPG home directory.

	@item --full-generate-key
	@opindex full-generate-key
	@itemx --full-gen-key
	@opindex full-gen-key
	Generate a new key pair with dialogs for all options. This is an
	extended version of @option{--generate-key}.

	There is also a feature which allows you to create keys in batch
	mode. See the manual section ``Unattended key generation'' on how
	to use this.


	@item --generate-revocation @code{name}
	@opindex generate-revocation
	@itemx --gen-revoke @code{name}
	@opindex gen-revoke
	Generate a revocation certificate for the complete key. To only revoke
	a subkey or a key signature, use the @option{--edit} command.

	This command merely creates the revocation certificate so that it can
	be used to revoke the key if that is ever needed. To actually revoke
	a key the created revocation certificate needs to be merged with the
	key to revoke. This is done by importing the revocation certificate
	using the @option{--import} command. Then the revoked key needs to be
	published, which is best done by sending the key to a keyserver
	(command @option{--send-key}) and by exporting (@option{--export}) it
	to a file which is then send to frequent communication partners.


	@item --generate-designated-revocation @code{name}
	@opindex generate-designated-revocation
	@itemx --desig-revoke @code{name}
	@opindex desig-revoke
	Generate a designated revocation certificate for a key. This allows a
	user (with the permission of the keyholder) to revoke someone else's
	key.


	@item --edit-key
	@opindex edit-key
	Present a menu which enables you to do most of the key management
	related tasks. It expects the specification of a key on the command
	line.

	@c ****** Begin Edit-key Options ********
	@table @asis

	@item uid @code{n}
	@opindex keyedit:uid
	Toggle selection of user ID or photographic user ID with index @code{n}.
	Use @code{*} to select all and @code{0} to deselect all.

	@item key @code{n}
	@opindex keyedit:key
	Toggle selection of subkey with index @code{n} or key ID @code{n}.
	Use @code{*} to select all and @code{0} to deselect all.

	@item sign
	@opindex keyedit:sign
	Make a signature on key of user @code{name}. If the key is not yet
	signed by the default user (or the users given with @option{-u}), the program
	displays the information of the key again, together with its
	fingerprint and asks whether it should be signed. This question is
	repeated for all users specified with
	@option{-u}.

	@item lsign
	@opindex keyedit:lsign
	Same as "sign" but the signature is marked as non-exportable and will
	therefore never be used by others. This may be used to make keys
	valid only in the local environment.

	@item nrsign
	@opindex keyedit:nrsign
	Same as "sign" but the signature is marked as non-revocable and can
	therefore never be revoked.

	@item tsign
	@opindex keyedit:tsign
	Make a trust signature. This is a signature that combines the notions
	of certification (like a regular signature), and trust (like the
	"trust" command). It is generally only useful in distinct communities
	or groups. For more information please read the sections
	``Trust Signature'' and ``Regular Expression'' in RFC-4880.
	@end table

	@c man:.RS
	Note that "l" (for local / non-exportable), "nr" (for non-revocable,
	and "t" (for trust) may be freely mixed and prefixed to "sign" to
	create a signature of any type desired.
	@c man:.RE

	If the option @option{--only-sign-text-ids} is specified, then any
	non-text based user ids (e.g., photo IDs) will not be selected for
	signing.

	@table @asis

	@item delsig
	@opindex keyedit:delsig
	Delete a signature. Note that it is not possible to retract a signature,
	once it has been send to the public (i.e. to a keyserver). In that case
	you better use @code{revsig}.

	@item revsig
	@opindex keyedit:revsig
	Revoke a signature. For every signature which has been generated by
	one of the secret keys, GnuPG asks whether a revocation certificate
	should be generated.

	@item check
	@opindex keyedit:check
	Check the signatures on all selected user IDs. With the extra
	option @code{selfsig} only self-signatures are shown.

	@item adduid
	@opindex keyedit:adduid
	Create an additional user ID.

	@item addphoto
	@opindex keyedit:addphoto
	Create a photographic user ID. This will prompt for a JPEG file that
	will be embedded into the user ID. Note that a very large JPEG will make
	for a very large key. Also note that some programs will display your
	JPEG unchanged (GnuPG), and some programs will scale it to fit in a
	dialog box (PGP).

	@item showphoto
	@opindex keyedit:showphoto
	Display the selected photographic user ID.

	@item deluid
	@opindex keyedit:deluid
	Delete a user ID or photographic user ID. Note that it is not
	possible to retract a user id, once it has been send to the public
	(i.e. to a keyserver). In that case you better use @code{revuid}.

	@item revuid
	@opindex keyedit:revuid
	Revoke a user ID or photographic user ID.

	@item primary
	@opindex keyedit:primary
	Flag the current user id as the primary one, removes the primary user
	id flag from all other user ids and sets the timestamp of all affected
	self-signatures one second ahead. Note that setting a photo user ID
	as primary makes it primary over other photo user IDs, and setting a
	regular user ID as primary makes it primary over other regular user
	IDs.

	@item keyserver
	@opindex keyedit:keyserver
	Set a preferred keyserver for the specified user ID(s). This allows
	other users to know where you prefer they get your key from. See
	@option{--keyserver-options honor-keyserver-url} for more on how this
	works. Setting a value of "none" removes an existing preferred
	keyserver.

	@item notation
	@opindex keyedit:notation
	Set a name=value notation for the specified user ID(s). See
	@option{--cert-notation} for more on how this works. Setting a value of
	"none" removes all notations, setting a notation prefixed with a minus
	sign (-) removes that notation, and setting a notation name (without the
	=value) prefixed with a minus sign removes all notations with that name.

	@item pref
	@opindex keyedit:pref
	List preferences from the selected user ID. This shows the actual
	preferences, without including any implied preferences.

	@item showpref
	@opindex keyedit:showpref
	More verbose preferences listing for the selected user ID. This shows
	the preferences in effect by including the implied preferences of 3DES
	(cipher), SHA-1 (digest), and Uncompressed (compression) if they are
	not already included in the preference list. In addition, the
	preferred keyserver and signature notations (if any) are shown.

	@item setpref @code{string}
	@opindex keyedit:setpref
	Set the list of user ID preferences to @code{string} for all (or just
	the selected) user IDs. Calling setpref with no arguments sets the
	preference list to the default (either built-in or set via
	@option{--default-preference-list}), and calling setpref with "none"
	as the argument sets an empty preference list. Use @command{@gpgname
	--version} to get a list of available algorithms. Note that while you
	can change the preferences on an attribute user ID (aka "photo ID"),
	GnuPG does not select keys via attribute user IDs so these preferences
	will not be used by GnuPG.

	When setting preferences, you should list the algorithms in the order
	which you'd like to see them used by someone else when encrypting a
	message to your key. If you don't include 3DES, it will be
	automatically added at the end. Note that there are many factors that
	go into choosing an algorithm (for example, your key may not be the
	only recipient), and so the remote OpenPGP application being used to
	send to you may or may not follow your exact chosen order for a given
	message. It will, however, only choose an algorithm that is present
	on the preference list of every recipient key. See also the
	INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS section below.

	@item addkey
	@opindex keyedit:addkey
	Add a subkey to this key.

	@item addcardkey
	@opindex keyedit:addcardkey
	Generate a subkey on a card and add it to this key.

	@item keytocard
	@opindex keyedit:keytocard
	Transfer the selected secret subkey (or the primary key if no subkey
	has been selected) to a smartcard. The secret key in the keyring will
	be replaced by a stub if the key could be stored successfully on the
	card and you use the save command later. Only certain key types may be
	transferred to the card. A sub menu allows you to select on what card
	to store the key. Note that it is not possible to get that key back
	from the card - if the card gets broken your secret key will be lost
	unless you have a backup somewhere.

	@item bkuptocard @code{file}
	@opindex keyedit:bkuptocard
	Restore the given file to a card. This command may be used to restore a
	backup key (as generated during card initialization) to a new card. In
	almost all cases this will be the encryption key. You should use this
	command only with the corresponding public key and make sure that the
	file given as argument is indeed the backup to restore. You should then
	select 2 to restore as encryption key. You will first be asked to enter
	the passphrase of the backup key and then for the Admin PIN of the card.

	@item delkey
	@opindex keyedit:delkey
	Remove a subkey (secondary key). Note that it is not possible to retract
	a subkey, once it has been send to the public (i.e. to a keyserver). In
	that case you better use @code{revkey}. Also note that this only
	deletes the public part of a key.

	@item revkey
	@opindex keyedit:revkey
	Revoke a subkey.

	@item expire
	@opindex keyedit:expire
	Change the key or subkey expiration time. If a subkey is selected, the
	expiration time of this subkey will be changed. With no selection, the
	key expiration of the primary key is changed.

	@item trust
	@opindex keyedit:trust
	Change the owner trust value for the key. This updates the trust-db
	immediately and no save is required.

	@item disable
	@itemx enable
	@opindex keyedit:disable
	@opindex keyedit:enable
	Disable or enable an entire key. A disabled key can not normally be
	used for encryption.

	@item addrevoker
	@opindex keyedit:addrevoker
	Add a designated revoker to the key. This takes one optional argument:
	"sensitive". If a designated revoker is marked as sensitive, it will
	not be exported by default (see export-options).

	@item passwd
	@opindex keyedit:passwd
	Change the passphrase of the secret key.

	@item toggle
	@opindex keyedit:toggle
	This is dummy command which exists only for backward compatibility.

	@item clean
	@opindex keyedit:clean
	Compact (by removing all signatures except the selfsig) any user ID
	that is no longer usable (e.g. revoked, or expired). Then, remove any
	signatures that are not usable by the trust calculations.
	Specifically, this removes any signature that does not validate, any
	signature that is superseded by a later signature, revoked signatures,
	and signatures issued by keys that are not present on the keyring.

	@item minimize
	@opindex keyedit:minimize
	Make the key as small as possible. This removes all signatures from
	each user ID except for the most recent self-signature.

	@item cross-certify
	@opindex keyedit:cross-certify
	Add cross-certification signatures to signing subkeys that may not
	currently have them. Cross-certification signatures protect against a
	subtle attack against signing subkeys. See
	@option{--require-cross-certification}. All new keys generated have
	this signature by default, so this command is only useful to bring
	older keys up to date.

	@item save
	@opindex keyedit:save
	Save all changes to the keyrings and quit.

	@item quit
	@opindex keyedit:quit
	Quit the program without updating the
	keyrings.
	@end table

	@c man:.RS
	The listing shows you the key with its secondary keys and all user
	ids. The primary user id is indicated by a dot, and selected keys or
	user ids are indicated by an asterisk. The trust
	value is displayed with the primary key: the first is the assigned owner
	trust and the second is the calculated trust value. Letters are used for
	the values:
	@c man:.RE

	@table @asis

	@item -
	No ownertrust assigned / not yet calculated.

	@item e
	Trust
	calculation has failed; probably due to an expired key.

	@item q
	Not enough information for calculation.

	@item n
	Never trust this key.

	@item m
	Marginally trusted.

	@item f
	Fully trusted.

	@item u
	Ultimately trusted.

	@end table
	@c ****** End Edit-key Options ********

	@item --sign-key @code{name}
	@opindex sign-key
	Signs a public key with your secret key. This is a shortcut version of
	the subcommand "sign" from @option{--edit}.

	@item --lsign-key @code{name}
	@opindex lsign-key
	Signs a public key with your secret key but marks it as
	non-exportable. This is a shortcut version of the subcommand "lsign"
	from @option{--edit-key}.

	@item --quick-sign-key @code{fpr} [@code{names}]
	@itemx --quick-lsign-key @code{fpr} [@code{names}]
	@opindex quick-sign-key
	@opindex quick-lsign-key
	Directly sign a key from the passphrase without any further user
	interaction. The @code{fpr} must be the verified primary fingerprint
	of a key in the local keyring. If no @code{names} are given, all
	useful user ids are signed; with given [@code{names}] only useful user
	ids matching one of theses names are signed. By default, or if a name
	is prefixed with a '*', a case insensitive substring match is used.
	If a name is prefixed with a '=' a case sensitive exact match is done.

	The command @option{--quick-lsign-key} marks the signatures as
	non-exportable. If such a non-exportable signature already exists the
	@option{--quick-sign-key} turns it into a exportable signature.

	This command uses reasonable defaults and thus does not provide the
	full flexibility of the "sign" subcommand from @option{--edit-key}.
	Its intended use is to help unattended key signing by utilizing a list
	of verified fingerprints.

	@item --quick-add-uid @var{user-id} @var{new-user-id}
	@opindex quick-add-uid
	This command adds a new user id to an existing key. In contrast to
	the interactive sub-command @code{adduid} of @option{--edit-key} the
	@var{new-user-id} is added verbatim with only leading and trailing
	white space removed, it is expected to be UTF-8 encoded, and no checks
	on its form are applied.

	@item --quick-revoke-uid @var{user-id} @var{user-id-to-revoke}
	@opindex quick-revoke-uid
	This command revokes a User ID on an existing key. It cannot be used
	to revoke the last User ID on key (some non-revoked User ID must
	remain), with revocation reason ``User ID is no longer valid''. If
	you want to specify a different revocation reason, or to supply
	supplementary revocation text, you should use the interactive
	sub-command @code{revuid} of @option{--edit-key}.

	@item --change-passphrase @var{user_id}
	@opindex change-passphrase
	@itemx --passwd @var{user_id}
	@opindex passwd
	Change the passphrase of the secret key belonging to the certificate
	specified as @var{user_id}. This is a shortcut for the sub-command
	@code{passwd} of the edit key menu.

	@end table


	@c *******************************************
	@c ************* **************
	@c ************* OPTIONS **************
	@c ************* **************
	@c *******************************************
	@mansect options
	@node GPG Options
	@section Option Summary

	@command{@gpgname} features a bunch of options to control the exact
	behaviour and to change the default configuration.

	@menu
	* GPG Configuration Options:: How to change the configuration.
	* GPG Key related Options:: Key related options.
	* GPG Input and Output:: Input and Output.
	* OpenPGP Options:: OpenPGP protocol specific options.
	* Compliance Options:: Compliance options.
	* GPG Esoteric Options:: Doing things one usually doesn't want to do.
	* Deprecated Options:: Deprecated options.
	@end menu

	Long options can be put in an options file (default
	"~/.gnupg/gpg.conf"). Short option names will not work - for example,
	"armor" is a valid option for the options file, while "a" is not. Do not
	write the 2 dashes, but simply the name of the option and any required
	arguments. Lines with a hash ('#') as the first non-white-space
	character are ignored. Commands may be put in this file too, but that is
	not generally useful as the command will execute automatically with
	every execution of gpg.

	Please remember that option parsing stops as soon as a non-option is
	encountered, you can explicitly stop parsing by using the special option
	@option{--}.

	@c *******************************************
	@c ****** CONFIGURATION OPTIONS ********
	@c *******************************************
	@node GPG Configuration Options
	@subsection How to change the configuration

	These options are used to change the configuration and are usually found
	in the option file.

	@table @gnupgtabopt

	@item --default-key @var{name}
	@opindex default-key
	Use @var{name} as the default key to sign with. If this option is not
	used, the default key is the first key found in the secret keyring.
	Note that @option{-u} or @option{--local-user} overrides this option.
	This option may be given multiple times. In this case, the last key
	for which a secret key is available is used. If there is no secret
	key available for any of the specified values, GnuPG will not emit an
	error message but continue as if this option wasn't given.

	@item --default-recipient @var{name}
	@opindex default-recipient
	Use @var{name} as default recipient if option @option{--recipient} is
	not used and don't ask if this is a valid one. @var{name} must be
	non-empty.

	@item --default-recipient-self
	@opindex default-recipient-self
	Use the default key as default recipient if option @option{--recipient} is not
	used and don't ask if this is a valid one. The default key is the first
	one from the secret keyring or the one set with @option{--default-key}.

	@item --no-default-recipient
	@opindex no-default-recipient
	Reset @option{--default-recipient} and @option{--default-recipient-self}.

	@item -v, --verbose
	@opindex verbose
	Give more information during processing. If used
	twice, the input data is listed in detail.

	@item --no-verbose
	@opindex no-verbose
	Reset verbose level to 0.

	@item -q, --quiet
	@opindex quiet
	Try to be as quiet as possible.

	@item --batch
	@itemx --no-batch
	@opindex batch
	@opindex no-batch
	Use batch mode. Never ask, do not allow interactive commands.
	@option{--no-batch} disables this option. Note that even with a
	filename given on the command line, gpg might still need to read from
	STDIN (in particular if gpg figures that the input is a
	detached signature and no data file has been specified). Thus if you
	do not want to feed data via STDIN, you should connect STDIN to
	g@file{/dev/null}.

	It is highly recommended to use this option along with the options
	@option{--status-fd} and @option{--with-colons} for any unattended of
	@command{gpg}.

	@item --no-tty
	@opindex no-tty
	Make sure that the TTY (terminal) is never used for any output.
	This option is needed in some cases because GnuPG sometimes prints
	warnings to the TTY even if @option{--batch} is used.

	@item --yes
	@opindex yes
	Assume "yes" on most questions.

	@item --no
	@opindex no
	Assume "no" on most questions.


	@item --list-options @code{parameters}
	@opindex list-options
	This is a space or comma delimited string that gives options used when
	listing keys and signatures (that is, @option{--list-keys},
	@option{--list-signatures}, @option{--list-public-keys},
	@option{--list-secret-keys}, and the @option{--edit-key} functions).
	Options can be prepended with a @option{no-} (after the two dashes) to
	give the opposite meaning. The options are:

	@table @asis

	@item show-photos
	@opindex list-options:show-photos
	Causes @option{--list-keys}, @option{--list-signatures},
	@option{--list-public-keys}, and @option{--list-secret-keys} to
	display any photo IDs attached to the key. Defaults to no. See also
	@option{--photo-viewer}. Does not work with @option{--with-colons}:
	see @option{--attribute-fd} for the appropriate way to get photo data
	for scripts and other frontends.

	@item show-usage
	@opindex list-options:show-usage
	Show usage information for keys and subkeys in the standard key
	listing. This is a list of letters indicating the allowed usage for a
	key (@code{E}=encryption, @code{S}=signing, @code{C}=certification,
	@code{A}=authentication). Defaults to yes.

	@item show-policy-urls
	@opindex list-options:show-policy-urls
	Show policy URLs in the @option{--list-signatures} or @option{--check-signatures}
	listings. Defaults to no.

	@item show-notations
	@itemx show-std-notations
	@itemx show-user-notations
	@opindex list-options:show-notations
	@opindex list-options:show-std-notations
	@opindex list-options:show-user-notations
	Show all, IETF standard, or user-defined signature notations in the
	@option{--list-signatures} or @option{--check-signatures} listings. Defaults to no.

	@item show-keyserver-urls
	@opindex list-options:show-keyserver-urls
	Show any preferred keyserver URL in the @option{--list-signatures} or
	@option{--check-signatures} listings. Defaults to no.

	@item show-uid-validity
	@opindex list-options:show-uid-validity
	Display the calculated validity of user IDs during key listings.
	Defaults to yes.

	@item show-unusable-uids
	@opindex list-options:show-unusable-uids
	Show revoked and expired user IDs in key listings. Defaults to no.

	@item show-unusable-subkeys
	@opindex list-options:show-unusable-subkeys
	Show revoked and expired subkeys in key listings. Defaults to no.

	@item show-keyring
	@opindex list-options:show-keyring
	Display the keyring name at the head of key listings to show which
	keyring a given key resides on. Defaults to no.

	@item show-sig-expire
	@opindex list-options:show-sig-expire
	Show signature expiration dates (if any) during @option{--list-signatures} or
	@option{--check-signatures} listings. Defaults to no.

	@item show-sig-subpackets
	@opindex list-options:show-sig-subpackets
	Include signature subpackets in the key listing. This option can take an
	optional argument list of the subpackets to list. If no argument is
	passed, list all subpackets. Defaults to no. This option is only
	meaningful when using @option{--with-colons} along with
	@option{--list-signatures} or @option{--check-signatures}.

	@end table

	@item --verify-options @code{parameters}
	@opindex verify-options
	This is a space or comma delimited string that gives options used when
	verifying signatures. Options can be prepended with a `no-' to give
	the opposite meaning. The options are:

	@table @asis

	@item show-photos
	@opindex verify-options:show-photos
	Display any photo IDs present on the key that issued the signature.
	Defaults to no. See also @option{--photo-viewer}.

	@item show-policy-urls
	@opindex verify-options:show-policy-urls
	Show policy URLs in the signature being verified. Defaults to yes.

	@item show-notations
	@itemx show-std-notations
	@itemx show-user-notations
	@opindex verify-options:show-notations
	@opindex verify-options:show-std-notations
	@opindex verify-options:show-user-notations
	Show all, IETF standard, or user-defined signature notations in the
	signature being verified. Defaults to IETF standard.

	@item show-keyserver-urls
	@opindex verify-options:show-keyserver-urls
	Show any preferred keyserver URL in the signature being verified.
	Defaults to yes.

	@item show-uid-validity
	@opindex verify-options:show-uid-validity
	Display the calculated validity of the user IDs on the key that issued
	the signature. Defaults to yes.

	@item show-unusable-uids
	@opindex verify-options:show-unusable-uids
	Show revoked and expired user IDs during signature verification.
	Defaults to no.

	@item show-primary-uid-only
	@opindex verify-options:show-primary-uid-only
	Show only the primary user ID during signature verification. That is
	all the AKA lines as well as photo Ids are not shown with the signature
	verification status.

	@item pka-lookups
	@opindex verify-options:pka-lookups
	Enable PKA lookups to verify sender addresses. Note that PKA is based
	on DNS, and so enabling this option may disclose information on when
	and what signatures are verified or to whom data is encrypted. This
	is similar to the "web bug" described for the @option{--auto-key-retrieve}
	option.

	@item pka-trust-increase
	@opindex verify-options:pka-trust-increase
	Raise the trust in a signature to full if the signature passes PKA
	validation. This option is only meaningful if pka-lookups is set.
	@end table

	@item --enable-large-rsa
	@itemx --disable-large-rsa
	@opindex enable-large-rsa
	@opindex disable-large-rsa
	With --generate-key and --batch, enable the creation of RSA secret keys as
	large as 8192 bit. Note: 8192 bit is more than is generally
	recommended. These large keys don't significantly improve security,
	but they are more expensive to use, and their signatures and
	certifications are larger. This option is only available if the
	binary was build with large-secmem support.

	@item --enable-dsa2
	@itemx --disable-dsa2
	@opindex enable-dsa2
	@opindex disable-dsa2
	Enable hash truncation for all DSA keys even for old DSA Keys up to
	1024 bit. This is also the default with @option{--openpgp}. Note
	that older versions of GnuPG also required this flag to allow the
	generation of DSA larger than 1024 bit.

	@item --photo-viewer @code{string}
	@opindex photo-viewer
	This is the command line that should be run to view a photo ID. "%i"
	will be expanded to a filename containing the photo. "%I" does the
	same, except the file will not be deleted once the viewer exits.
	Other flags are "%k" for the key ID, "%K" for the long key ID, "%f"
	for the key fingerprint, "%t" for the extension of the image type
	(e.g. "jpg"), "%T" for the MIME type of the image (e.g. "image/jpeg"),
	"%v" for the single-character calculated validity of the image being
	viewed (e.g. "f"), "%V" for the calculated validity as a string (e.g.
	"full"), "%U" for a base32 encoded hash of the user ID,
	and "%%" for an actual percent sign. If neither %i or %I are present,
	then the photo will be supplied to the viewer on standard input.

	The default viewer is "xloadimage -fork -quiet -title 'KeyID 0x%k'
	STDIN". Note that if your image viewer program is not secure, then
	executing it from GnuPG does not make it secure.

	@item --exec-path @code{string}
	@opindex exec-path
	@efindex PATH
	Sets a list of directories to search for photo viewers and keyserver
	helpers. If not provided, keyserver helpers use the compiled-in
	default directory, and photo viewers use the @code{PATH} environment
	variable.
	Note, that on W32 system this value is ignored when searching for
	keyserver helpers.

	@item --keyring @code{file}
	@opindex keyring
	Add @code{file} to the current list of keyrings. If @code{file} begins
	with a tilde and a slash, these are replaced by the $HOME directory. If
	the filename does not contain a slash, it is assumed to be in the GnuPG
	home directory ("~/.gnupg" if @option{--homedir} or $GNUPGHOME is not
	used).

	Note that this adds a keyring to the current list. If the intent is to
	use the specified keyring alone, use @option{--keyring} along with
	@option{--no-default-keyring}.

	-If the the option @option{--no-keyring} has been used no keyrings will
	+If the option @option{--no-keyring} has been used no keyrings will
	be used at all.


	@item --secret-keyring @code{file}
	@opindex secret-keyring
	This is an obsolete option and ignored. All secret keys are stored in
	the @file{private-keys-v1.d} directory below the GnuPG home directory.

	@item --primary-keyring @code{file}
	@opindex primary-keyring
	Designate @code{file} as the primary public keyring. This means that
	newly imported keys (via @option{--import} or keyserver
	@option{--recv-from}) will go to this keyring.

	@item --trustdb-name @code{file}
	@opindex trustdb-name
	Use @code{file} instead of the default trustdb. If @code{file} begins
	with a tilde and a slash, these are replaced by the $HOME directory. If
	the filename does not contain a slash, it is assumed to be in the GnuPG
	home directory (@file{~/.gnupg} if @option{--homedir} or $GNUPGHOME is
	not used).

	@include opt-homedir.texi


	@item --display-charset @code{name}
	@opindex display-charset
	Set the name of the native character set. This is used to convert
	some informational strings like user IDs to the proper UTF-8 encoding.
	Note that this has nothing to do with the character set of data to be
	encrypted or signed; GnuPG does not recode user-supplied data. If
	this option is not used, the default character set is determined from
	the current locale. A verbosity level of 3 shows the chosen set.
	Valid values for @code{name} are:

	@table @asis

	@item iso-8859-1
	@opindex display-charset:iso-8859-1
	This is the Latin 1 set.

	@item iso-8859-2
	@opindex display-charset:iso-8859-2
	The Latin 2 set.

	@item iso-8859-15
	@opindex display-charset:iso-8859-15
	This is currently an alias for
	the Latin 1 set.

	@item koi8-r
	@opindex display-charset:koi8-r
	The usual Russian set (RFC-1489).

	@item utf-8
	@opindex display-charset:utf-8
	Bypass all translations and assume
	that the OS uses native UTF-8 encoding.
	@end table

	@item --utf8-strings
	@itemx --no-utf8-strings
	@opindex utf8-strings
	Assume that command line arguments are given as UTF-8 strings. The
	default (@option{--no-utf8-strings}) is to assume that arguments are
	encoded in the character set as specified by
	@option{--display-charset}. These options affect all following
	arguments. Both options may be used multiple times.

	@anchor{gpg-option --options}
	@item --options @code{file}
	@opindex options
	Read options from @code{file} and do not try to read them from the
	default options file in the homedir (see @option{--homedir}). This
	option is ignored if used in an options file.

	@item --no-options
	@opindex no-options
	Shortcut for @option{--options /dev/null}. This option is detected
	before an attempt to open an option file. Using this option will also
	prevent the creation of a @file{~/.gnupg} homedir.

	@item -z @code{n}
	@itemx --compress-level @code{n}
	@itemx --bzip2-compress-level @code{n}
	@opindex compress-level
	@opindex bzip2-compress-level
	Set compression level to @code{n} for the ZIP and ZLIB compression
	algorithms. The default is to use the default compression level of zlib
	(normally 6). @option{--bzip2-compress-level} sets the compression level
	for the BZIP2 compression algorithm (defaulting to 6 as well). This is a
	different option from @option{--compress-level} since BZIP2 uses a
	significant amount of memory for each additional compression level.
	@option{-z} sets both. A value of 0 for @code{n} disables compression.

	@item --bzip2-decompress-lowmem
	@opindex bzip2-decompress-lowmem
	Use a different decompression method for BZIP2 compressed files. This
	alternate method uses a bit more than half the memory, but also runs
	at half the speed. This is useful under extreme low memory
	circumstances when the file was originally compressed at a high
	@option{--bzip2-compress-level}.


	@item --mangle-dos-filenames
	@itemx --no-mangle-dos-filenames
	@opindex mangle-dos-filenames
	@opindex no-mangle-dos-filenames
	Older version of Windows cannot handle filenames with more than one
	dot. @option{--mangle-dos-filenames} causes GnuPG to replace (rather
	than add to) the extension of an output filename to avoid this
	problem. This option is off by default and has no effect on non-Windows
	platforms.

	@item --ask-cert-level
	@itemx --no-ask-cert-level
	@opindex ask-cert-level
	When making a key signature, prompt for a certification level. If this
	option is not specified, the certification level used is set via
	@option{--default-cert-level}. See @option{--default-cert-level} for
	information on the specific levels and how they are
	used. @option{--no-ask-cert-level} disables this option. This option
	defaults to no.

	@item --default-cert-level @code{n}
	@opindex default-cert-level
	The default to use for the check level when signing a key.

	0 means you make no particular claim as to how carefully you verified
	the key.

	1 means you believe the key is owned by the person who claims to own
	it but you could not, or did not verify the key at all. This is
	useful for a "persona" verification, where you sign the key of a
	pseudonymous user.

	2 means you did casual verification of the key. For example, this
	could mean that you verified the key fingerprint and checked the
	user ID on the key against a photo ID.

	3 means you did extensive verification of the key. For example, this
	could mean that you verified the key fingerprint with the owner of the
	key in person, and that you checked, by means of a hard to forge
	document with a photo ID (such as a passport) that the name of the key
	owner matches the name in the user ID on the key, and finally that you
	verified (by exchange of email) that the email address on the key
	belongs to the key owner.

	Note that the examples given above for levels 2 and 3 are just that:
	examples. In the end, it is up to you to decide just what "casual"
	and "extensive" mean to you.

	This option defaults to 0 (no particular claim).

	@item --min-cert-level
	@opindex min-cert-level
	When building the trust database, treat any signatures with a
	certification level below this as invalid. Defaults to 2, which
	disregards level 1 signatures. Note that level 0 "no particular
	claim" signatures are always accepted.

	@item --trusted-key @code{long key ID}
	@opindex trusted-key
	Assume that the specified key (which must be given
	as a full 8 byte key ID) is as trustworthy as one of
	your own secret keys. This option is useful if you
	don't want to keep your secret keys (or one of them)
	online but still want to be able to check the validity of a given
	recipient's or signator's key.

	@item --trust-model @code{pgp\|classic\|tofu\|tofu+pgp\|direct\|always\|auto}
	@opindex trust-model
	Set what trust model GnuPG should follow. The models are:

	@table @asis

	@item pgp
	@opindex trust-mode:pgp
	This is the Web of Trust combined with trust signatures as used in PGP
	5.x and later. This is the default trust model when creating a new
	trust database.

	@item classic
	@opindex trust-mode:classic
	This is the standard Web of Trust as introduced by PGP 2.

	@item tofu
	@opindex trust-mode:tofu
	@anchor{trust-model-tofu}
	TOFU stands for Trust On First Use. In this trust model, the first
	time a key is seen, it is memorized. If later another key is seen
	with a user id with the same email address, a warning is displayed
	indicating that there is a conflict and that the key might be a
	forgery and an attempt at a man-in-the-middle attack.

	Because a potential attacker is able to control the email address
	and thereby circumvent the conflict detection algorithm by using an
	email address that is similar in appearance to a trusted email
	address, whenever a message is verified, statistics about the number
	of messages signed with the key are shown. In this way, a user can
	easily identify attacks using fake keys for regular correspondents.

	When compared with the Web of Trust, TOFU offers significantly
	weaker security guarantees. In particular, TOFU only helps ensure
	consistency (that is, that the binding between a key and email
	address doesn't change). A major advantage of TOFU is that it
	requires little maintenance to use correctly. To use the web of
	trust properly, you need to actively sign keys and mark users as
	trusted introducers. This is a time-consuming process and anecdotal
	evidence suggests that even security-conscious users rarely take the
	time to do this thoroughly and instead rely on an ad-hoc TOFU
	process.

	In the TOFU model, policies are associated with bindings between
	keys and email addresses (which are extracted from user ids and
	normalized). There are five policies, which can be set manually
	using the @option{--tofu-policy} option. The default policy can be
	set using the @option{--tofu-default-policy} option.

	The TOFU policies are: @code{auto}, @code{good}, @code{unknown},
	@code{bad} and @code{ask}. The @code{auto} policy is used by
	default (unless overridden by @option{--tofu-default-policy}) and
	marks a binding as marginally trusted. The @code{good},
	@code{unknown} and @code{bad} policies mark a binding as fully
	trusted, as having unknown trust or as having trust never,
	respectively. The @code{unknown} policy is useful for just using
	TOFU to detect conflicts, but to never assign positive trust to a
	binding. The final policy, @code{ask} prompts the user to indicate
	the binding's trust. If batch mode is enabled (or input is
	inappropriate in the context), then the user is not prompted and the
	@code{undefined} trust level is returned.

	@item tofu+pgp
	@opindex trust-mode:tofu+pgp
	This trust model combines TOFU with the Web of Trust. This is done
	by computing the trust level for each model and then taking the
	maximum trust level where the trust levels are ordered as follows:
	@code{unknown < undefined < marginal < fully < ultimate < expired <
	never}.

	By setting @option{--tofu-default-policy=unknown}, this model can be
	used to implement the web of trust with TOFU's conflict detection
	algorithm, but without its assignment of positive trust values,
	which some security-conscious users don't like.

	@item direct
	@opindex trust-mode:direct
	Key validity is set directly by the user and not calculated via the
	Web of Trust.

	@item always
	@opindex trust-mode:always
	Skip key validation and assume that used keys are always fully
	valid. You generally won't use this unless you are using some
	external validation scheme. This option also suppresses the
	"[uncertain]" tag printed with signature checks when there is no
	evidence that the user ID is bound to the key. Note that this
	trust model still does not allow the use of expired, revoked, or
	disabled keys.

	@item auto
	@opindex trust-mode:auto
	Select the trust model depending on whatever the internal trust
	database says. This is the default model if such a database already
	exists.
	@end table

	@item --auto-key-locate @code{parameters}
	@itemx --no-auto-key-locate
	@opindex auto-key-locate
	GnuPG can automatically locate and retrieve keys as needed using this
	option. This happens when encrypting to an email address (in the
	"user@@example.com" form), and there are no user@@example.com keys on
	the local keyring. This option takes any number of the following
	mechanisms, in the order they are to be tried:

	@table @asis

	@item cert
	Locate a key using DNS CERT, as specified in RFC-4398.

	@item pka
	Locate a key using DNS PKA.

	@item dane
	Locate a key using DANE, as specified
	in draft-ietf-dane-openpgpkey-05.txt.

	@item wkd
	Locate a key using the Web Key Directory protocol.
	This is an experimental method and semantics may change.

	@item ldap
	Using DNS Service Discovery, check the domain in question for any LDAP
	keyservers to use. If this fails, attempt to locate the key using the
	PGP Universal method of checking @samp{ldap://keys.(thedomain)}.

	@item keyserver
	Locate a key using whatever keyserver is defined using the
	@option{--keyserver} option.

	@item keyserver-URL
	In addition, a keyserver URL as used in the @option{--keyserver} option
	may be used here to query that particular keyserver.

	@item local
	Locate the key using the local keyrings. This mechanism allows the user to
	select the order a local key lookup is done. Thus using
	@samp{--auto-key-locate local} is identical to
	@option{--no-auto-key-locate}.

	@item nodefault
	This flag disables the standard local key lookup, done before any of the
	mechanisms defined by the @option{--auto-key-locate} are tried. The
	position of this mechanism in the list does not matter. It is not
	required if @code{local} is also used.

	@item clear
	Clear all defined mechanisms. This is useful to override
	mechanisms given in a config file.

	@end table

	@item --auto-key-retrieve
	@itemx --no-auto-key-retrieve
	@opindex auto-key-retrieve
	@opindex no-auto-key-retrieve
	This option enables the automatic retrieving of keys from a keyserver
	when verifying signatures made by keys that are not on the local
	keyring.

	If the method "wkd" is included in the list of methods given to
	@option{auto-key-locate}, the Signer's User ID is part of the
	signature, and the option @option{--disable-signer-uid} is not used,
	the "wkd" method may also be used to retrieve a key.

	Note that this option makes a "web bug" like behavior possible.
	Keyserver or Web Key Directory operators can see which keys you
	request, so by sending you a message signed by a brand new key (which
	you naturally will not have on your local keyring), the operator can
	tell both your IP address and the time when you verified the
	signature.

	@item --keyid-format @code{none\|short\|0xshort\|long\|0xlong}
	@opindex keyid-format
	Select how to display key IDs. "none" does not show the key ID at all
	but shows the fingerprint in a separate line. "short" is the
	traditional 8-character key ID. "long" is the more accurate (but less
	convenient) 16-character key ID. Add an "0x" to either to include an
	"0x" at the beginning of the key ID, as in 0x99242560. Note that this
	option is ignored if the option @option{--with-colons} is used.

	@item --keyserver @code{name}
	@opindex keyserver
	This option is deprecated - please use the @option{--keyserver} in
	@file{dirmngr.conf} instead.

	Use @code{name} as your keyserver. This is the server that
	@option{--receive-keys}, @option{--send-keys}, and @option{--search-keys}
	will communicate with to receive keys from, send keys to, and search for
	keys on. The format of the @code{name} is a URI:
	`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
	"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
	keyservers, or "mailto" for the Graff email keyserver. Note that your
	particular installation of GnuPG may have other keyserver types
	available as well. Keyserver schemes are case-insensitive. After the
	keyserver name, optional keyserver configuration options may be
	provided. These are the same as the global @option{--keyserver-options}
	from below, but apply only to this particular keyserver.

	Most keyservers synchronize with each other, so there is generally no
	need to send keys to more than one server. The keyserver
	@code{hkp://keys.gnupg.net} uses round robin DNS to give a different
	keyserver each time you use it.

	@item --keyserver-options @code{name=value}
	@opindex keyserver-options
	This is a space or comma delimited string that gives options for the
	keyserver. Options can be prefixed with a `no-' to give the opposite
	meaning. Valid import-options or export-options may be used here as
	well to apply to importing (@option{--recv-key}) or exporting
	(@option{--send-key}) a key from a keyserver. While not all options
	are available for all keyserver types, some common options are:

	@table @asis

	@item include-revoked
	When searching for a key with @option{--search-keys}, include keys that
	are marked on the keyserver as revoked. Note that not all keyservers
	differentiate between revoked and unrevoked keys, and for such
	keyservers this option is meaningless. Note also that most keyservers do
	not have cryptographic verification of key revocations, and so turning
	this option off may result in skipping keys that are incorrectly marked
	as revoked.

	@item include-disabled
	When searching for a key with @option{--search-keys}, include keys that
	are marked on the keyserver as disabled. Note that this option is not
	used with HKP keyservers.

	@item auto-key-retrieve
	This is the same as the option @option{auto-key-retrieve}.

	@item honor-keyserver-url
	When using @option{--refresh-keys}, if the key in question has a preferred
	keyserver URL, then use that preferred keyserver to refresh the key
	from. In addition, if auto-key-retrieve is set, and the signature
	being verified has a preferred keyserver URL, then use that preferred
	keyserver to fetch the key from. Note that this option introduces a
	"web bug": The creator of the key can see when the keys is
	refreshed. Thus this option is not enabled by default.

	@item honor-pka-record
	If @option{--auto-key-retrieve} is used, and the signature being
	verified has a PKA record, then use the PKA information to fetch
	the key. Defaults to "yes".

	@item include-subkeys
	When receiving a key, include subkeys as potential targets. Note that
	this option is not used with HKP keyservers, as they do not support
	retrieving keys by subkey id.

	@item timeout
	Tell the keyserver helper program how long (in seconds) to try and
	perform a keyserver action before giving up. Note that performing
	multiple actions at the same time uses this timeout value per action.
	For example, when retrieving multiple keys via @option{--receive-keys}, the
	timeout applies separately to each key retrieval, and not to the
	@option{--receive-keys} command as a whole. Defaults to 30 seconds.

	@item http-proxy=@code{value}
	This option is deprecated.
	Set the proxy to use for HTTP and HKP keyservers.
	This overrides any proxy defined in @file{dirmngr.conf}.

	@item verbose
	This option has no more function since GnuPG 2.1. Use the
	@code{dirmngr} configuration options instead.

	@item debug
	This option has no more function since GnuPG 2.1. Use the
	@code{dirmngr} configuration options instead.

	@item check-cert
	This option has no more function since GnuPG 2.1. Use the
	@code{dirmngr} configuration options instead.

	@item ca-cert-file
	This option has no more function since GnuPG 2.1. Use the
	@code{dirmngr} configuration options instead.

	@end table

	@item --completes-needed @code{n}
	@opindex compliant-needed
	Number of completely trusted users to introduce a new
	key signer (defaults to 1).

	@item --marginals-needed @code{n}
	@opindex marginals-needed
	Number of marginally trusted users to introduce a new
	key signer (defaults to 3)

	@item --tofu-default-policy @code{auto\|good\|unknown\|bad\|ask}
	@opindex tofu-default-policy
	The default TOFU policy (defaults to @code{auto}). For more
	information about the meaning of this option, @pxref{trust-model-tofu}.

	@item --max-cert-depth @code{n}
	@opindex max-cert-depth
	Maximum depth of a certification chain (default is 5).

	@item --no-sig-cache
	@opindex no-sig-cache
	Do not cache the verification status of key signatures.
	Caching gives a much better performance in key listings. However, if
	you suspect that your public keyring is not safe against write
	modifications, you can use this option to disable the caching. It
	probably does not make sense to disable it because all kind of damage
	can be done if someone else has write access to your public keyring.

	@item --auto-check-trustdb
	@itemx --no-auto-check-trustdb
	@opindex auto-check-trustdb
	If GnuPG feels that its information about the Web of Trust has to be
	updated, it automatically runs the @option{--check-trustdb} command
	internally. This may be a time consuming
	process. @option{--no-auto-check-trustdb} disables this option.

	@item --use-agent
	@itemx --no-use-agent
	@opindex use-agent
	This is dummy option. @command{@gpgname} always requires the agent.

	@item --gpg-agent-info
	@opindex gpg-agent-info
	This is dummy option. It has no effect when used with @command{@gpgname}.


	@item --agent-program @var{file}
	@opindex agent-program
	Specify an agent program to be used for secret key operations. The
	default value is determined by running @command{gpgconf} with the
	option @option{--list-dirs}. Note that the pipe symbol (@code{\|}) is
	used for a regression test suite hack and may thus not be used in the
	file name.

	@item --dirmngr-program @var{file}
	@opindex dirmngr-program
	Specify a dirmngr program to be used for keyserver access. The
	default value is @file{@value{BINDIR}/dirmngr}.

	@item --no-autostart
	@opindex no-autostart
	Do not start the gpg-agent or the dirmngr if it has not yet been
	started and its service is required. This option is mostly useful on
	machines where the connection to gpg-agent has been redirected to
	another machines. If dirmngr is required on the remote machine, it
	may be started manually using @command{gpgconf --launch dirmngr}.

	@item --lock-once
	@opindex lock-once
	Lock the databases the first time a lock is requested
	and do not release the lock until the process
	terminates.

	@item --lock-multiple
	@opindex lock-multiple
	Release the locks every time a lock is no longer
	needed. Use this to override a previous @option{--lock-once}
	from a config file.

	@item --lock-never
	@opindex lock-never
	Disable locking entirely. This option should be used only in very
	special environments, where it can be assured that only one process
	is accessing those files. A bootable floppy with a stand-alone
	encryption system will probably use this. Improper usage of this
	option may lead to data and key corruption.

	@item --exit-on-status-write-error
	@opindex exit-on-status-write-error
	This option will cause write errors on the status FD to immediately
	terminate the process. That should in fact be the default but it never
	worked this way and thus we need an option to enable this, so that the
	change won't break applications which close their end of a status fd
	connected pipe too early. Using this option along with
	@option{--enable-progress-filter} may be used to cleanly cancel long
	running gpg operations.

	@item --limit-card-insert-tries @code{n}
	@opindex limit-card-insert-tries
	With @code{n} greater than 0 the number of prompts asking to insert a
	smartcard gets limited to N-1. Thus with a value of 1 gpg won't at
	all ask to insert a card if none has been inserted at startup. This
	option is useful in the configuration file in case an application does
	not know about the smartcard support and waits ad infinitum for an
	inserted card.

	@item --no-random-seed-file
	@opindex no-random-seed-file
	GnuPG uses a file to store its internal random pool over invocations.
	This makes random generation faster; however sometimes write operations
	are not desired. This option can be used to achieve that with the cost of
	slower random generation.

	@item --no-greeting
	@opindex no-greeting
	Suppress the initial copyright message.

	@item --no-secmem-warning
	@opindex no-secmem-warning
	Suppress the warning about "using insecure memory".

	@item --no-permission-warning
	@opindex permission-warning
	Suppress the warning about unsafe file and home directory (@option{--homedir})
	permissions. Note that the permission checks that GnuPG performs are
	not intended to be authoritative, but rather they simply warn about
	certain common permission problems. Do not assume that the lack of a
	warning means that your system is secure.

	Note that the warning for unsafe @option{--homedir} permissions cannot be
	suppressed in the gpg.conf file, as this would allow an attacker to
	place an unsafe gpg.conf file in place, and use this file to suppress
	warnings about itself. The @option{--homedir} permissions warning may only be
	suppressed on the command line.

	@item --no-mdc-warning
	@opindex no-mdc-warning
	Suppress the warning about missing MDC integrity protection.

	@item --require-secmem
	@itemx --no-require-secmem
	@opindex require-secmem
	Refuse to run if GnuPG cannot get secure memory. Defaults to no
	(i.e. run, but give a warning).


	@item --require-cross-certification
	@itemx --no-require-cross-certification
	@opindex require-cross-certification
	When verifying a signature made from a subkey, ensure that the cross
	certification "back signature" on the subkey is present and valid. This
	protects against a subtle attack against subkeys that can sign.
	Defaults to @option{--require-cross-certification} for
	@command{@gpgname}.

	@item --expert
	@itemx --no-expert
	@opindex expert
	Allow the user to do certain nonsensical or "silly" things like
	signing an expired or revoked key, or certain potentially incompatible
	things like generating unusual key types. This also disables certain
	warning messages about potentially incompatible actions. As the name
	implies, this option is for experts only. If you don't fully
	understand the implications of what it allows you to do, leave this
	off. @option{--no-expert} disables this option.

	@end table


	@c *******************************************
	@c ****** KEY RELATED OPTIONS **********
	@c *******************************************
	@node GPG Key related Options
	@subsection Key related options

	@table @gnupgtabopt

	@item --recipient @var{name}
	@itemx -r
	@opindex recipient
	Encrypt for user id @var{name}. If this option or
	@option{--hidden-recipient} is not specified, GnuPG asks for the user-id
	unless @option{--default-recipient} is given.

	@item --hidden-recipient @var{name}
	@itemx -R
	@opindex hidden-recipient
	Encrypt for user ID @var{name}, but hide the key ID of this user's
	key. This option helps to hide the receiver of the message and is a
	limited countermeasure against traffic analysis. If this option or
	@option{--recipient} is not specified, GnuPG asks for the user ID unless
	@option{--default-recipient} is given.

	@item --recipient-file @var{file}
	@itemx -f
	@opindex recipient-file
	This option is similar to @option{--recipient} except that it
	encrypts to a key stored in the given file. @var{file} must be the
	name of a file containing exactly one key. @command{@gpgname} assumes that
	the key in this file is fully valid.

	@item --hidden-recipient-file @var{file}
	@itemx -F
	@opindex hidden-recipient-file
	This option is similar to @option{--hidden-recipient} except that it
	encrypts to a key stored in the given file. @var{file} must be the
	name of a file containing exactly one key. @command{@gpgname} assumes that
	the key in this file is fully valid.

	@item --encrypt-to @code{name}
	@opindex encrypt-to
	Same as @option{--recipient} but this one is intended for use in the
	options file and may be used with your own user-id as an
	"encrypt-to-self". These keys are only used when there are other
	recipients given either by use of @option{--recipient} or by the asked
	user id. No trust checking is performed for these user ids and even
	disabled keys can be used.

	@item --hidden-encrypt-to @code{name}
	@opindex hidden-encrypt-to
	Same as @option{--hidden-recipient} but this one is intended for use in the
	options file and may be used with your own user-id as a hidden
	"encrypt-to-self". These keys are only used when there are other
	recipients given either by use of @option{--recipient} or by the asked user id.
	No trust checking is performed for these user ids and even disabled
	keys can be used.

	@item --no-encrypt-to
	@opindex no-encrypt-to
	Disable the use of all @option{--encrypt-to} and
	@option{--hidden-encrypt-to} keys.

	@item --group @code{name=value}
	@opindex group
	Sets up a named group, which is similar to aliases in email programs.
	Any time the group name is a recipient (@option{-r} or
	@option{--recipient}), it will be expanded to the values
	specified. Multiple groups with the same name are automatically merged
	into a single group.

	The values are @code{key IDs} or fingerprints, but any key description
	is accepted. Note that a value with spaces in it will be treated as
	two different values. Note also there is only one level of expansion
	--- you cannot make an group that points to another group. When used
	from the command line, it may be necessary to quote the argument to
	this option to prevent the shell from treating it as multiple
	arguments.

	@item --ungroup @code{name}
	@opindex ungroup
	Remove a given entry from the @option{--group} list.

	@item --no-groups
	@opindex no-groups
	Remove all entries from the @option{--group} list.

	@item --local-user @var{name}
	@itemx -u
	@opindex local-user
	Use @var{name} as the key to sign with. Note that this option overrides
	@option{--default-key}.

	@item --sender @var{mbox}
	@opindex sender
	This option has two purposes. @var{mbox} must either be a complete
	user id with a proper mail address or just a mail address. When
	creating a signature this option tells gpg the user id of a key used
	to make a signature if the key was not directly specified by a user
	id. When verifying a signature the @var{mbox} is used to restrict the
	information printed by the TOFU code to matching user ids.

	@item --try-secret-key @var{name}
	@opindex try-secret-key
	For hidden recipients GPG needs to know the keys to use for trial
	decryption. The key set with @option{--default-key} is always tried
	first, but this is often not sufficient. This option allows setting more
	keys to be used for trial decryption. Although any valid user-id
	specification may be used for @var{name} it makes sense to use at least
	the long keyid to avoid ambiguities. Note that gpg-agent might pop up a
	pinentry for a lot keys to do the trial decryption. If you want to stop
	all further trial decryption you may use close-window button instead of
	the cancel button.

	@item --try-all-secrets
	@opindex try-all-secrets
	Don't look at the key ID as stored in the message but try all secret
	keys in turn to find the right decryption key. This option forces the
	behaviour as used by anonymous recipients (created by using
	@option{--throw-keyids} or @option{--hidden-recipient}) and might come
	handy in case where an encrypted message contains a bogus key ID.

	@item --skip-hidden-recipients
	@itemx --no-skip-hidden-recipients
	@opindex skip-hidden-recipients
	@opindex no-skip-hidden-recipients
	During decryption skip all anonymous recipients. This option helps in
	the case that people use the hidden recipients feature to hide there
	own encrypt-to key from others. If oneself has many secret keys this
	may lead to a major annoyance because all keys are tried in turn to
	decrypt something which was not really intended for it. The drawback
	of this option is that it is currently not possible to decrypt a
	message which includes real anonymous recipients.


	@end table

	@c *******************************************
	@c ****** INPUT AND OUTPUT *************
	@c *******************************************
	@node GPG Input and Output
	@subsection Input and Output

	@table @gnupgtabopt

	@item --armor
	@itemx -a
	@opindex armor
	Create ASCII armored output. The default is to create the binary
	OpenPGP format.

	@item --no-armor
	@opindex no-armor
	Assume the input data is not in ASCII armored format.

	@item --output @var{file}
	@itemx -o @var{file}
	@opindex output
	Write output to @var{file}. To write to stdout use @code{-} as the
	filename.

	@item --max-output @code{n}
	@opindex max-output
	This option sets a limit on the number of bytes that will be generated
	when processing a file. Since OpenPGP supports various levels of
	compression, it is possible that the plaintext of a given message may be
	significantly larger than the original OpenPGP message. While GnuPG
	works properly with such messages, there is often a desire to set a
	maximum file size that will be generated before processing is forced to
	stop by the OS limits. Defaults to 0, which means "no limit".

	@item --input-size-hint @var{n}
	@opindex input-size-hint
	This option can be used to tell GPG the size of the input data in
	bytes. @var{n} must be a positive base-10 number. This option is
	only useful if the input is not taken from a file. GPG may use this
	hint to optimize its buffer allocation strategy. It is also used by
	the @option{--status-fd} line ``PROGRESS'' to provide a value for
	``total'' if that is not available by other means.

	@item --import-options @code{parameters}
	@opindex import-options
	This is a space or comma delimited string that gives options for
	importing keys. Options can be prepended with a `no-' to give the
	opposite meaning. The options are:

	@table @asis

	@item import-local-sigs
	Allow importing key signatures marked as "local". This is not
	generally useful unless a shared keyring scheme is being used.
	Defaults to no.

	@item keep-ownertrust
	Normally possible still existing ownertrust values of a key are
	cleared if a key is imported. This is in general desirable so that
	a formerly deleted key does not automatically gain an ownertrust
	values merely due to import. On the other hand it is sometimes
	necessary to re-import a trusted set of keys again but keeping
	already assigned ownertrust values. This can be achieved by using
	this option.

	@item repair-pks-subkey-bug
	During import, attempt to repair the damage caused by the PKS keyserver
	bug (pre version 0.9.6) that mangles keys with multiple subkeys. Note
	that this cannot completely repair the damaged key as some crucial data
	is removed by the keyserver, but it does at least give you back one
	subkey. Defaults to no for regular @option{--import} and to yes for
	keyserver @option{--receive-keys}.

	@item import-show
	Show a listing of the key as imported right before it is stored.
	This can be combined with the option @option{--dry-run} to only look
	at keys.

	@item import-export
	Run the entire import code but instead of storing the key to the
	local keyring write it to the output. The export options
	@option{export-pka} and @option{export-dane} affect the output. This
	option can be used to remove all invalid parts from a key without the
	need to store it.

	@item merge-only
	During import, allow key updates to existing keys, but do not allow
	any new keys to be imported. Defaults to no.

	@item import-clean
	After import, compact (remove all signatures except the
	self-signature) any user IDs from the new key that are not usable.
	Then, remove any signatures from the new key that are not usable.
	This includes signatures that were issued by keys that are not present
	on the keyring. This option is the same as running the @option{--edit-key}
	command "clean" after import. Defaults to no.

	@item import-minimal
	Import the smallest key possible. This removes all signatures except
	the most recent self-signature on each user ID. This option is the
	same as running the @option{--edit-key} command "minimize" after import.
	Defaults to no.

	@item restore
	@itemx import-restore
	Import in key restore mode. This imports all data which is usually
	skipped during import; including all GnuPG specific data. All other
	contradicting options are overridden.
	@end table

	@item --import-filter @code{@var{name}=@var{expr}}
	@itemx --export-filter @code{@var{name}=@var{expr}}
	@opindex import-filter
	@opindex export-filter
	These options define an import/export filter which are applied to the
	imported/exported keyblock right before it will be stored/written.
	@var{name} defines the type of filter to use, @var{expr} the
	expression to evaluate. The option can be used several times which
	then appends more expression to the same @var{name}.

	@noindent
	The available filter types are:

	@table @asis

	@item keep-uid
	This filter will keep a user id packet and its dependent packets in
	the keyblock if the expression evaluates to true.

	@item drop-subkey
	This filter drops the selected subkeys.
	Currently only implemented for --export-filter.

	@item drop-sig
	This filter drops the selected key signatures on user ids.
	Self-signatures are not considered.
	Currently only implemented for --import-filter.

	@end table

	For the syntax of the expression see the chapter "FILTER EXPRESSIONS".
	The property names for the expressions depend on the actual filter
	type and are indicated in the following table.

	The available properties are:

	@table @asis

	@item uid
	A string with the user id. (keep-uid)

	@item mbox
	The addr-spec part of a user id with mailbox or the empty string.
	(keep-uid)

	@item key_algo
	A number with the public key algorithm of a key or subkey packet.
	(drop-subkey)

	@item key_created
	@itemx key_created_d
	The first is the timestamp a public key or subkey packet was
	created. The second is the same but given as an ISO string,
	e.g. "2016-08-17". (drop-subkey)

	@item primary
	Boolean indicating whether the user id is the primary one. (keep-uid)

	@item secret
	Boolean indicating whether a key or subkey is a secret one.
	drop-subkey)

	@item sig_created
	@itemx sig_created_d
	The first is the timestamp a signature packet was created. The
	second is the same but given as an ISO string,
	e.g. "2016-08-17". (drop-sig)

	@item sig_algo
	A number with the public key algorithm of a signature packet. (drop-sig)

	@item sig_digest_algo
	A number with the digest algorithm of a signature packet. (drop-sig)

	@end table

	@item --export-options @code{parameters}
	@opindex export-options
	This is a space or comma delimited string that gives options for
	exporting keys. Options can be prepended with a `no-' to give the
	opposite meaning. The options are:

	@table @asis

	@item export-local-sigs
	Allow exporting key signatures marked as "local". This is not
	generally useful unless a shared keyring scheme is being used.
	Defaults to no.

	@item export-attributes
	Include attribute user IDs (photo IDs) while exporting. This is
	useful to export keys if they are going to be used by an OpenPGP
	program that does not accept attribute user IDs. Defaults to yes.

	@item export-sensitive-revkeys
	Include designated revoker information that was marked as
	"sensitive". Defaults to no.

	@c Since GnuPG 2.1 gpg-agent manages the secret key and thus the
	@c export-reset-subkey-passwd hack is not anymore justified. Such use
	@c cases may be implemented using a specialized secret key export
	@c tool.
	@c @item export-reset-subkey-passwd
	@c When using the @option{--export-secret-subkeys} command, this option resets
	@c the passphrases for all exported subkeys to empty. This is useful
	@c when the exported subkey is to be used on an unattended machine where
	@c a passphrase doesn't necessarily make sense. Defaults to no.

	@item backup
	@itemx export-backup
	Export for use as a backup. The exported data includes all data
	which is needed to restore the key or keys later with GnuPG. The
	format is basically the OpenPGP format but enhanced with GnuPG
	specific data. All other contradicting options are overridden.

	@item export-clean
	Compact (remove all signatures from) user IDs on the key being
	exported if the user IDs are not usable. Also, do not export any
	signatures that are not usable. This includes signatures that were
	issued by keys that are not present on the keyring. This option is
	the same as running the @option{--edit-key} command "clean" before export
	except that the local copy of the key is not modified. Defaults to
	no.

	@item export-minimal
	Export the smallest key possible. This removes all signatures except the
	most recent self-signature on each user ID. This option is the same as
	running the @option{--edit-key} command "minimize" before export except
	that the local copy of the key is not modified. Defaults to no.

	@item export-pka
	Instead of outputting the key material output PKA records suitable
	to put into DNS zone files. An ORIGIN line is printed before each
	record to allow diverting the records to the corresponding zone file.

	@item export-dane
	Instead of outputting the key material output OpenPGP DANE records
	suitable to put into DNS zone files. An ORIGIN line is printed before
	each record to allow diverting the records to the corresponding zone
	file.

	@end table

	@item --with-colons
	@opindex with-colons
	Print key listings delimited by colons. Note that the output will be
	encoded in UTF-8 regardless of any @option{--display-charset} setting. This
	format is useful when GnuPG is called from scripts and other programs
	as it is easily machine parsed. The details of this format are
	documented in the file @file{doc/DETAILS}, which is included in the GnuPG
	source distribution.

	@item --fixed-list-mode
	@opindex fixed-list-mode
	Do not merge primary user ID and primary key in @option{--with-colon}
	listing mode and print all timestamps as seconds since 1970-01-01.
	Since GnuPG 2.0.10, this mode is always used and thus this option is
	obsolete; it does not harm to use it though.

	@item --legacy-list-mode
	@opindex legacy-list-mode
	Revert to the pre-2.1 public key list mode. This only affects the
	human readable output and not the machine interface
	(i.e. @code{--with-colons}). Note that the legacy format does not
	convey suitable information for elliptic curves.

	@item --with-fingerprint
	@opindex with-fingerprint
	Same as the command @option{--fingerprint} but changes only the format
	of the output and may be used together with another command.

	@item --with-subkey-fingerprint
	@opindex with-subkey-fingerprint
	If a fingerprint is printed for the primary key, this option forces
	printing of the fingerprint for all subkeys. This could also be
	achieved by using the @option{--with-fingerprint} twice but by using
	this option along with keyid-format "none" a compact fingerprint is
	printed.

	@item --with-icao-spelling
	@opindex with-icao-spelling
	Print the ICAO spelling of the fingerprint in addition to the hex digits.

	@item --with-keygrip
	@opindex with-keygrip
	Include the keygrip in the key listings. In @code{--with-colons} mode
	this is implicitly enable for secret keys.

	@item --with-wkd-hash
	@opindex with-wkd-hash
	Print a Web Key Directory identifier along with each user ID in key
	listings. This is an experimental feature and semantics may change.

	@item --with-secret
	@opindex with-secret
	Include info about the presence of a secret key in public key listings
	done with @code{--with-colons}.

	@end table

	@c *******************************************
	@c ****** OPENPGP OPTIONS **************
	@c *******************************************
	@node OpenPGP Options
	@subsection OpenPGP protocol specific options

	@table @gnupgtabopt

	@item -t, --textmode
	@itemx --no-textmode
	@opindex textmode
	Treat input files as text and store them in the OpenPGP canonical text
	form with standard "CRLF" line endings. This also sets the necessary
	flags to inform the recipient that the encrypted or signed data is text
	and may need its line endings converted back to whatever the local
	system uses. This option is useful when communicating between two
	platforms that have different line ending conventions (UNIX-like to Mac,
	Mac to Windows, etc). @option{--no-textmode} disables this option, and
	is the default.

	@item --force-v3-sigs
	@itemx --no-force-v3-sigs
	@item --force-v4-certs
	@itemx --no-force-v4-certs
	These options are obsolete and have no effect since GnuPG 2.1.

	@item --force-mdc
	@opindex force-mdc
	Force the use of encryption with a modification detection code. This
	is always used with the newer ciphers (those with a blocksize greater
	than 64 bits), or if all of the recipient keys indicate MDC support in
	their feature flags.

	@item --disable-mdc
	@opindex disable-mdc
	Disable the use of the modification detection code. Note that by
	using this option, the encrypted message becomes vulnerable to a
	message modification attack.

	@item --disable-signer-uid
	@opindex disable-signer-uid
	By default the user ID of the signing key is embedded in the data
	signature. As of now this is only done if the signing key has been
	specified with @option{local-user} using a mail address. This
	information can be helpful for verifier to locate the key; see
	option @option{--auto-key-retrieve}.

	@item --personal-cipher-preferences @code{string}
	@opindex personal-cipher-preferences
	Set the list of personal cipher preferences to @code{string}. Use
	@command{@gpgname --version} to get a list of available algorithms,
	and use @code{none} to set no preference at all. This allows the user
	to safely override the algorithm chosen by the recipient key
	preferences, as GPG will only select an algorithm that is usable by
	all recipients. The most highly ranked cipher in this list is also
	used for the @option{--symmetric} encryption command.

	@item --personal-digest-preferences @code{string}
	@opindex personal-digest-preferences
	Set the list of personal digest preferences to @code{string}. Use
	@command{@gpgname --version} to get a list of available algorithms,
	and use @code{none} to set no preference at all. This allows the user
	to safely override the algorithm chosen by the recipient key
	preferences, as GPG will only select an algorithm that is usable by
	all recipients. The most highly ranked digest algorithm in this list
	is also used when signing without encryption
	(e.g. @option{--clear-sign} or @option{--sign}).

	@item --personal-compress-preferences @code{string}
	@opindex personal-compress-preferences
	Set the list of personal compression preferences to @code{string}.
	Use @command{@gpgname --version} to get a list of available
	algorithms, and use @code{none} to set no preference at all. This
	allows the user to safely override the algorithm chosen by the
	recipient key preferences, as GPG will only select an algorithm that
	is usable by all recipients. The most highly ranked compression
	algorithm in this list is also used when there are no recipient keys
	to consider (e.g. @option{--symmetric}).

	@item --s2k-cipher-algo @code{name}
	@opindex s2k-cipher-algo
	Use @code{name} as the cipher algorithm for symmetric encryption with
	a passphrase if @option{--personal-cipher-preferences} and
	@option{--cipher-algo} are not given. The default is @value{GPGSYMENCALGO}.

	@item --s2k-digest-algo @code{name}
	@opindex s2k-digest-algo
	Use @code{name} as the digest algorithm used to mangle the passphrases
	for symmetric encryption. The default is SHA-1.

	@item --s2k-mode @code{n}
	@opindex s2k-mode
	Selects how passphrases for symmetric encryption are mangled. If
	@code{n} is 0 a plain passphrase (which is in general not recommended)
	will be used, a 1 adds a salt (which should not be used) to the
	passphrase and a 3 (the default) iterates the whole process a number
	of times (see @option{--s2k-count}).

	@item --s2k-count @code{n}
	@opindex s2k-count
	Specify how many times the passphrases mangling for symmetric
	encryption is repeated. This value may range between 1024 and
	65011712 inclusive. The default is inquired from gpg-agent. Note
	that not all values in the 1024-65011712 range are legal and if an
	illegal value is selected, GnuPG will round up to the nearest legal
	value. This option is only meaningful if @option{--s2k-mode} is set
	to the default of 3.


	@end table

	@c ***************************
	@c ***** Compliance ******
	@c ***************************
	@node Compliance Options
	@subsection Compliance options

	These options control what GnuPG is compliant to. Only one of these
	options may be active at a time. Note that the default setting of
	this is nearly always the correct one. See the INTEROPERABILITY WITH
	OTHER OPENPGP PROGRAMS section below before using one of these
	options.

	@table @gnupgtabopt

	@item --gnupg
	@opindex gnupg
	Use standard GnuPG behavior. This is essentially OpenPGP behavior
	(see @option{--openpgp}), but with some additional workarounds for common
	compatibility problems in different versions of PGP. This is the
	default option, so it is not generally needed, but it may be useful to
	override a different compliance option in the gpg.conf file.

	@item --openpgp
	@opindex openpgp
	Reset all packet, cipher and digest options to strict OpenPGP
	behavior. Use this option to reset all previous options like
	@option{--s2k-*}, @option{--cipher-algo}, @option{--digest-algo} and
	@option{--compress-algo} to OpenPGP compliant values. All PGP
	workarounds are disabled.

	@item --rfc4880
	@opindex rfc4880
	Reset all packet, cipher and digest options to strict RFC-4880
	behavior. Note that this is currently the same thing as
	@option{--openpgp}.

	@item --rfc4880bis
	@opindex rfc4880bis
	Enable experimental features from proposed updates to RFC-4880. This
	option can be used in addition to the other compliance options.
	Warning: The behavior may change with any GnuPG release and created
	keys or data may not be usable with future GnuPG versions.

	@item --rfc2440
	@opindex rfc2440
	Reset all packet, cipher and digest options to strict RFC-2440
	behavior.

	@item --pgp6
	@opindex pgp6
	Set up all options to be as PGP 6 compliant as possible. This
	restricts you to the ciphers IDEA (if the IDEA plugin is installed),
	3DES, and CAST5, the hashes MD5, SHA1 and RIPEMD160, and the
	compression algorithms none and ZIP. This also disables
	@option{--throw-keyids}, and making signatures with signing subkeys as PGP 6
	does not understand signatures made by signing subkeys.

	This option implies @option{--disable-mdc --escape-from-lines}.

	@item --pgp7
	@opindex pgp7
	Set up all options to be as PGP 7 compliant as possible. This is
	identical to @option{--pgp6} except that MDCs are not disabled, and the
	list of allowable ciphers is expanded to add AES128, AES192, AES256, and
	TWOFISH.

	@item --pgp8
	@opindex pgp8
	Set up all options to be as PGP 8 compliant as possible. PGP 8 is a lot
	closer to the OpenPGP standard than previous versions of PGP, so all
	this does is disable @option{--throw-keyids} and set
	@option{--escape-from-lines}. All algorithms are allowed except for the
	SHA224, SHA384, and SHA512 digests.

	@item --compliance @var{string}
	@opindex compliance
	This option can be used instead of one of the options above. Valid
	values for @var{string} are the above option names (without the double
	dash) and possibly others as shown when using "help" for @var{value}.

	@end table


	@c *******************************************
	@c ****** ESOTERIC OPTIONS *************
	@c *******************************************
	@node GPG Esoteric Options
	@subsection Doing things one usually doesn't want to do

	@table @gnupgtabopt

	@item -n
	@itemx --dry-run
	@opindex dry-run
	Don't make any changes (this is not completely implemented).

	@item --list-only
	@opindex list-only
	Changes the behaviour of some commands. This is like @option{--dry-run} but
	different in some cases. The semantic of this option may be extended in
	the future. Currently it only skips the actual decryption pass and
	therefore enables a fast listing of the encryption keys.

	@item -i
	@itemx --interactive
	@opindex interactive
	Prompt before overwriting any files.

	@item --debug-level @var{level}
	@opindex debug-level
	Select the debug level for investigating problems. @var{level} may be
	a numeric value or by a keyword:

	@table @code
	@item none
	No debugging at all. A value of less than 1 may be used instead of
	the keyword.
	@item basic
	Some basic debug messages. A value between 1 and 2 may be used
	instead of the keyword.
	@item advanced
	More verbose debug messages. A value between 3 and 5 may be used
	instead of the keyword.
	@item expert
	Even more detailed messages. A value between 6 and 8 may be used
	instead of the keyword.
	@item guru
	All of the debug messages you can get. A value greater than 8 may be
	used instead of the keyword. The creation of hash tracing files is
	only enabled if the keyword is used.
	@end table

	How these messages are mapped to the actual debugging flags is not
	specified and may change with newer releases of this program. They are
	however carefully selected to best aid in debugging.

	@item --debug @var{flags}
	@opindex debug
	Set debugging flags. All flags are or-ed and @var{flags} may be given
	in C syntax (e.g. 0x0042) or as a comma separated list of flag names.
	To get a list of all supported flags the single word "help" can be
	used.

	@item --debug-all
	@opindex debug-all
	Set all useful debugging flags.

	@item --debug-iolbf
	@opindex debug-iolbf
	Set stdout into line buffered mode. This option is only honored when
	given on the command line.

	@item --faked-system-time @var{epoch}
	@opindex faked-system-time
	This option is only useful for testing; it sets the system time back or
	forth to @var{epoch} which is the number of seconds elapsed since the year
	1970. Alternatively @var{epoch} may be given as a full ISO time string
	(e.g. "20070924T154812").

	If you suffix @var{epoch} with an exclamation mark (!), the system time
	will appear to be frozen at the specified time.

	@item --enable-progress-filter
	@opindex enable-progress-filter
	Enable certain PROGRESS status outputs. This option allows frontends
	to display a progress indicator while gpg is processing larger files.
	There is a slight performance overhead using it.

	@item --status-fd @code{n}
	@opindex status-fd
	Write special status strings to the file descriptor @code{n}.
	See the file DETAILS in the documentation for a listing of them.

	@item --status-file @code{file}
	@opindex status-file
	Same as @option{--status-fd}, except the status data is written to file
	@code{file}.

	@item --logger-fd @code{n}
	@opindex logger-fd
	Write log output to file descriptor @code{n} and not to STDERR.

	@item --log-file @code{file}
	@itemx --logger-file @code{file}
	@opindex log-file
	Same as @option{--logger-fd}, except the logger data is written to
	file @code{file}. Use @file{socket://} to log to socket.

	@item --attribute-fd @code{n}
	@opindex attribute-fd
	Write attribute subpackets to the file descriptor @code{n}. This is most
	useful for use with @option{--status-fd}, since the status messages are
	needed to separate out the various subpackets from the stream delivered
	to the file descriptor.

	@item --attribute-file @code{file}
	@opindex attribute-file
	Same as @option{--attribute-fd}, except the attribute data is written to
	file @code{file}.

	@item --comment @code{string}
	@itemx --no-comments
	@opindex comment
	Use @code{string} as a comment string in cleartext signatures and ASCII
	armored messages or keys (see @option{--armor}). The default behavior is
	not to use a comment string. @option{--comment} may be repeated multiple
	times to get multiple comment strings. @option{--no-comments} removes
	all comments. It is a good idea to keep the length of a single comment
	below 60 characters to avoid problems with mail programs wrapping such
	lines. Note that comment lines, like all other header lines, are not
	protected by the signature.

	@item --emit-version
	@itemx --no-emit-version
	@opindex emit-version
	Force inclusion of the version string in ASCII armored output. If
	given once only the name of the program and the major number is
	emitted, given twice the minor is also emitted, given thrice
	the micro is added, and given four times an operating system identification
	is also emitted. @option{--no-emit-version} (default) disables the version
	line.

	@item --sig-notation @code{name=value}
	@itemx --cert-notation @code{name=value}
	@itemx -N, --set-notation @code{name=value}
	@opindex sig-notation
	@opindex cert-notation
	@opindex set-notation
	Put the name value pair into the signature as notation data.
	@code{name} must consist only of printable characters or spaces, and
	must contain a '@@' character in the form keyname@@domain.example.com
	(substituting the appropriate keyname and domain name, of course). This
	is to help prevent pollution of the IETF reserved notation
	namespace. The @option{--expert} flag overrides the '@@'
	check. @code{value} may be any printable string; it will be encoded in
	UTF-8, so you should check that your @option{--display-charset} is set
	correctly. If you prefix @code{name} with an exclamation mark (!), the
	notation data will be flagged as critical
	(rfc4880:5.2.3.16). @option{--sig-notation} sets a notation for data
	signatures. @option{--cert-notation} sets a notation for key signatures
	(certifications). @option{--set-notation} sets both.

	There are special codes that may be used in notation names. "%k" will
	be expanded into the key ID of the key being signed, "%K" into the
	long key ID of the key being signed, "%f" into the fingerprint of the
	key being signed, "%s" into the key ID of the key making the
	signature, "%S" into the long key ID of the key making the signature,
	"%g" into the fingerprint of the key making the signature (which might
	be a subkey), "%p" into the fingerprint of the primary key of the key
	making the signature, "%c" into the signature count from the OpenPGP
	smartcard, and "%%" results in a single "%". %k, %K, and %f are only
	meaningful when making a key signature (certification), and %c is only
	meaningful when using the OpenPGP smartcard.

	@item --sig-policy-url @code{string}
	@itemx --cert-policy-url @code{string}
	@itemx --set-policy-url @code{string}
	@opindex sig-policy-url
	@opindex cert-policy-url
	@opindex set-policy-url
	Use @code{string} as a Policy URL for signatures (rfc4880:5.2.3.20). If
	you prefix it with an exclamation mark (!), the policy URL packet will
	be flagged as critical. @option{--sig-policy-url} sets a policy url for
	data signatures. @option{--cert-policy-url} sets a policy url for key
	signatures (certifications). @option{--set-policy-url} sets both.

	The same %-expandos used for notation data are available here as well.

	@item --sig-keyserver-url @code{string}
	@opindex sig-keyserver-url
	Use @code{string} as a preferred keyserver URL for data signatures. If
	you prefix it with an exclamation mark (!), the keyserver URL packet
	will be flagged as critical.

	The same %-expandos used for notation data are available here as well.

	@item --set-filename @code{string}
	@opindex set-filename
	Use @code{string} as the filename which is stored inside messages.
	This overrides the default, which is to use the actual filename of the
	file being encrypted. Using the empty string for @code{string}
	effectively removes the filename from the output.

	@item --for-your-eyes-only
	@itemx --no-for-your-eyes-only
	@opindex for-your-eyes-only
	Set the `for your eyes only' flag in the message. This causes GnuPG to
	refuse to save the file unless the @option{--output} option is given,
	and PGP to use a "secure viewer" with a claimed Tempest-resistant font
	to display the message. This option overrides @option{--set-filename}.
	@option{--no-for-your-eyes-only} disables this option.

	@item --use-embedded-filename
	@itemx --no-use-embedded-filename
	@opindex use-embedded-filename
	Try to create a file with a name as embedded in the data. This can be
	a dangerous option as it enables overwriting files. Defaults to no.

	@item --cipher-algo @code{name}
	@opindex cipher-algo
	Use @code{name} as cipher algorithm. Running the program with the
	command @option{--version} yields a list of supported algorithms. If
	this is not used the cipher algorithm is selected from the preferences
	stored with the key. In general, you do not want to use this option as
	it allows you to violate the OpenPGP standard.
	@option{--personal-cipher-preferences} is the safe way to accomplish the
	same thing.

	@item --digest-algo @code{name}
	@opindex digest-algo
	Use @code{name} as the message digest algorithm. Running the program
	with the command @option{--version} yields a list of supported algorithms. In
	general, you do not want to use this option as it allows you to
	violate the OpenPGP standard. @option{--personal-digest-preferences} is the
	safe way to accomplish the same thing.

	@item --compress-algo @code{name}
	@opindex compress-algo
	Use compression algorithm @code{name}. "zlib" is RFC-1950 ZLIB
	compression. "zip" is RFC-1951 ZIP compression which is used by PGP.
	"bzip2" is a more modern compression scheme that can compress some
	things better than zip or zlib, but at the cost of more memory used
	during compression and decompression. "uncompressed" or "none"
	disables compression. If this option is not used, the default
	behavior is to examine the recipient key preferences to see which
	algorithms the recipient supports. If all else fails, ZIP is used for
	maximum compatibility.

	ZLIB may give better compression results than ZIP, as the compression
	window size is not limited to 8k. BZIP2 may give even better
	compression results than that, but will use a significantly larger
	amount of memory while compressing and decompressing. This may be
	significant in low memory situations. Note, however, that PGP (all
	versions) only supports ZIP compression. Using any algorithm other
	than ZIP or "none" will make the message unreadable with PGP. In
	general, you do not want to use this option as it allows you to
	violate the OpenPGP standard. @option{--personal-compress-preferences} is the
	safe way to accomplish the same thing.

	@item --cert-digest-algo @code{name}
	@opindex cert-digest-algo
	Use @code{name} as the message digest algorithm used when signing a
	key. Running the program with the command @option{--version} yields a
	list of supported algorithms. Be aware that if you choose an algorithm
	that GnuPG supports but other OpenPGP implementations do not, then some
	users will not be able to use the key signatures you make, or quite
	possibly your entire key.

	@item --disable-cipher-algo @code{name}
	@opindex disable-cipher-algo
	Never allow the use of @code{name} as cipher algorithm.
	The given name will not be checked so that a later loaded algorithm
	will still get disabled.

	@item --disable-pubkey-algo @code{name}
	@opindex disable-pubkey-algo
	Never allow the use of @code{name} as public key algorithm.
	The given name will not be checked so that a later loaded algorithm
	will still get disabled.

	@item --throw-keyids
	@itemx --no-throw-keyids
	@opindex throw-keyids
	Do not put the recipient key IDs into encrypted messages. This helps to
	hide the receivers of the message and is a limited countermeasure
	against traffic analysis.@footnote{Using a little social engineering
	anyone who is able to decrypt the message can check whether one of the
	other recipients is the one he suspects.} On the receiving side, it may
	slow down the decryption process because all available secret keys must
	be tried. @option{--no-throw-keyids} disables this option. This option
	is essentially the same as using @option{--hidden-recipient} for all
	recipients.

	@item --not-dash-escaped
	@opindex not-dash-escaped
	This option changes the behavior of cleartext signatures
	so that they can be used for patch files. You should not
	send such an armored file via email because all spaces
	and line endings are hashed too. You can not use this
	option for data which has 5 dashes at the beginning of a
	line, patch files don't have this. A special armor header
	line tells GnuPG about this cleartext signature option.

	@item --escape-from-lines
	@itemx --no-escape-from-lines
	@opindex escape-from-lines
	Because some mailers change lines starting with "From " to ">From " it
	is good to handle such lines in a special way when creating cleartext
	signatures to prevent the mail system from breaking the signature. Note
	that all other PGP versions do it this way too. Enabled by
	default. @option{--no-escape-from-lines} disables this option.

	@item --passphrase-repeat @code{n}
	@opindex passphrase-repeat
	Specify how many times @command{@gpgname} will request a new
	passphrase be repeated. This is useful for helping memorize a
	passphrase. Defaults to 1 repetition.

	@item --passphrase-fd @code{n}
	@opindex passphrase-fd
	Read the passphrase from file descriptor @code{n}. Only the first line
	will be read from file descriptor @code{n}. If you use 0 for @code{n},
	the passphrase will be read from STDIN. This can only be used if only
	one passphrase is supplied.

	Note that this passphrase is only used if the option @option{--batch}
	has also been given. This is different from GnuPG version 1.x.

	@item --passphrase-file @code{file}
	@opindex passphrase-file
	Read the passphrase from file @code{file}. Only the first line will
	be read from file @code{file}. This can only be used if only one
	passphrase is supplied. Obviously, a passphrase stored in a file is
	of questionable security if other users can read this file. Don't use
	this option if you can avoid it.
	Note that this passphrase is only used if the option @option{--batch}
	has also been given. This is different from GnuPG version 1.x.

	@item --passphrase @code{string}
	@opindex passphrase
	Use @code{string} as the passphrase. This can only be used if only one
	passphrase is supplied. Obviously, this is of very questionable
	security on a multi-user system. Don't use this option if you can
	avoid it.
	Note that this passphrase is only used if the option @option{--batch}
	has also been given. This is different from GnuPG version 1.x.

	@item --pinentry-mode @code{mode}
	@opindex pinentry-mode
	Set the pinentry mode to @code{mode}. Allowed values for @code{mode}
	are:
	@table @asis
	@item default
	Use the default of the agent, which is @code{ask}.
	@item ask
	Force the use of the Pinentry.
	@item cancel
	Emulate use of Pinentry's cancel button.
	@item error
	Return a Pinentry error (``No Pinentry'').
	@item loopback
	Redirect Pinentry queries to the caller. Note that in contrast to
	Pinentry the user is not prompted again if he enters a bad password.
	@end table

	@item --command-fd @code{n}
	@opindex command-fd
	This is a replacement for the deprecated shared-memory IPC mode.
	If this option is enabled, user input on questions is not expected
	from the TTY but from the given file descriptor. It should be used
	together with @option{--status-fd}. See the file doc/DETAILS in the source
	distribution for details on how to use it.

	@item --command-file @code{file}
	@opindex command-file
	Same as @option{--command-fd}, except the commands are read out of file
	@code{file}

	@item --allow-non-selfsigned-uid
	@itemx --no-allow-non-selfsigned-uid
	@opindex allow-non-selfsigned-uid
	Allow the import and use of keys with user IDs which are not
	self-signed. This is not recommended, as a non self-signed user ID is
	trivial to forge. @option{--no-allow-non-selfsigned-uid} disables.

	@item --allow-freeform-uid
	@opindex allow-freeform-uid
	Disable all checks on the form of the user ID while generating a new
	one. This option should only be used in very special environments as
	it does not ensure the de-facto standard format of user IDs.

	@item --ignore-time-conflict
	@opindex ignore-time-conflict
	GnuPG normally checks that the timestamps associated with keys and
	signatures have plausible values. However, sometimes a signature
	seems to be older than the key due to clock problems. This option
	makes these checks just a warning. See also @option{--ignore-valid-from} for
	timestamp issues on subkeys.

	@item --ignore-valid-from
	@opindex ignore-valid-from
	GnuPG normally does not select and use subkeys created in the future.
	This option allows the use of such keys and thus exhibits the
	pre-1.0.7 behaviour. You should not use this option unless there
	is some clock problem. See also @option{--ignore-time-conflict} for timestamp
	issues with signatures.

	@item --ignore-crc-error
	@opindex ignore-crc-error
	The ASCII armor used by OpenPGP is protected by a CRC checksum against
	transmission errors. Occasionally the CRC gets mangled somewhere on
	the transmission channel but the actual content (which is protected by
	the OpenPGP protocol anyway) is still okay. This option allows GnuPG
	to ignore CRC errors.

	@item --ignore-mdc-error
	@opindex ignore-mdc-error
	This option changes a MDC integrity protection failure into a warning.
	This can be useful if a message is partially corrupt, but it is
	necessary to get as much data as possible out of the corrupt message.
	However, be aware that a MDC protection failure may also mean that the
	message was tampered with intentionally by an attacker.

	@item --allow-weak-digest-algos
	@opindex allow-weak-digest-algos
	Signatures made with known-weak digest algorithms are normally
	rejected with an ``invalid digest algorithm'' message. This option
	allows the verification of signatures made with such weak algorithms.
	MD5 is the only digest algorithm considered weak by default. See also
	@option{--weak-digest} to reject other digest algorithms.

	@item --weak-digest @code{name}
	@opindex weak-digest
	Treat the specified digest algorithm as weak. Signatures made over
	weak digests algorithms are normally rejected. This option can be
	supplied multiple times if multiple algorithms should be considered
	weak. See also @option{--allow-weak-digest-algos} to disable
	rejection of weak digests. MD5 is always considered weak, and does
	not need to be listed explicitly.

	@item --no-default-keyring
	@opindex no-default-keyring
	Do not add the default keyrings to the list of keyrings. Note that
	GnuPG will not operate without any keyrings, so if you use this option
	and do not provide alternate keyrings via @option{--keyring} or
	@option{--secret-keyring}, then GnuPG will still use the default public or
	secret keyrings.

	@item --no-keyring
	@opindex no-keyring
	Do not add use any keyrings even if specified as options.

	@item --skip-verify
	@opindex skip-verify
	Skip the signature verification step. This may be
	used to make the decryption faster if the signature
	verification is not needed.

	@item --with-key-data
	@opindex with-key-data
	Print key listings delimited by colons (like @option{--with-colons}) and
	print the public key data.

	@item --fast-list-mode
	@opindex fast-list-mode
	Changes the output of the list commands to work faster; this is achieved
	by leaving some parts empty. Some applications don't need the user ID
	and the trust information given in the listings. By using this options
	they can get a faster listing. The exact behaviour of this option may
	change in future versions. If you are missing some information, don't
	use this option.

	@item --no-literal
	@opindex no-literal
	This is not for normal use. Use the source to see for what it might be useful.

	@item --set-filesize
	@opindex set-filesize
	This is not for normal use. Use the source to see for what it might be useful.

	@item --show-session-key
	@opindex show-session-key
	Display the session key used for one message. See
	@option{--override-session-key} for the counterpart of this option.

	We think that Key Escrow is a Bad Thing; however the user should have
	the freedom to decide whether to go to prison or to reveal the content
	of one specific message without compromising all messages ever
	encrypted for one secret key.

	You can also use this option if you receive an encrypted message which
	is abusive or offensive, to prove to the administrators of the
	messaging system that the ciphertext transmitted corresponds to an
	inappropriate plaintext so they can take action against the offending
	user.

	@item --override-session-key @code{string}
	@itemx --override-session-key-fd @code{fd}
	@opindex override-session-key
	Don't use the public key but the session key @code{string} respective
	the session key taken from the first line read from file descriptor
	@code{fd}. The format of this string is the same as the one printed
	by @option{--show-session-key}. This option is normally not used but
	comes handy in case someone forces you to reveal the content of an
	encrypted message; using this option you can do this without handing
	out the secret key. Note that using @option{--override-session-key}
	may reveal the session key to all local users via the global process
	table.

	@item --ask-sig-expire
	@itemx --no-ask-sig-expire
	@opindex ask-sig-expire
	When making a data signature, prompt for an expiration time. If this
	option is not specified, the expiration time set via
	@option{--default-sig-expire} is used. @option{--no-ask-sig-expire}
	disables this option.

	@item --default-sig-expire
	@opindex default-sig-expire
	The default expiration time to use for signature expiration. Valid
	values are "0" for no expiration, a number followed by the letter d
	(for days), w (for weeks), m (for months), or y (for years) (for
	example "2m" for two months, or "5y" for five years), or an absolute
	date in the form YYYY-MM-DD. Defaults to "0".

	@item --ask-cert-expire
	@itemx --no-ask-cert-expire
	@opindex ask-cert-expire
	When making a key signature, prompt for an expiration time. If this
	option is not specified, the expiration time set via
	@option{--default-cert-expire} is used. @option{--no-ask-cert-expire}
	disables this option.

	@item --default-cert-expire
	@opindex default-cert-expire
	The default expiration time to use for key signature expiration.
	Valid values are "0" for no expiration, a number followed by the
	letter d (for days), w (for weeks), m (for months), or y (for years)
	(for example "2m" for two months, or "5y" for five years), or an
	absolute date in the form YYYY-MM-DD. Defaults to "0".

	@item --default-new-key-algo @var{string}
	@opindex default-new-key-algo @var{string}
	This option can be used to change the default algorithms for key
	generation. Note that the advanced key generation commands can always
	be used to specify a key algorithm directly. Please consult the
	source code to learn the syntax of @var{string}.

	@item --allow-secret-key-import
	@opindex allow-secret-key-import
	This is an obsolete option and is not used anywhere.

	@item --allow-multiple-messages
	@item --no-allow-multiple-messages
	@opindex allow-multiple-messages
	Allow processing of multiple OpenPGP messages contained in a single file
	or stream. Some programs that call GPG are not prepared to deal with
	multiple messages being processed together, so this option defaults to
	no. Note that versions of GPG prior to 1.4.7 always allowed multiple
	messages.

	Warning: Do not use this option unless you need it as a temporary
	workaround!


	@item --enable-special-filenames
	@opindex enable-special-filenames
	This option enables a mode in which filenames of the form
	@file{-&n}, where n is a non-negative decimal number,
	refer to the file descriptor n and not to a file with that name.

	@item --no-expensive-trust-checks
	@opindex no-expensive-trust-checks
	Experimental use only.

	@item --preserve-permissions
	@opindex preserve-permissions
	Don't change the permissions of a secret keyring back to user
	read/write only. Use this option only if you really know what you are doing.

	@item --default-preference-list @code{string}
	@opindex default-preference-list
	Set the list of default preferences to @code{string}. This preference
	list is used for new keys and becomes the default for "setpref" in the
	edit menu.

	@item --default-keyserver-url @code{name}
	@opindex default-keyserver-url
	Set the default keyserver URL to @code{name}. This keyserver will be
	used as the keyserver URL when writing a new self-signature on a key,
	which includes key generation and changing preferences.

	@item --list-config
	@opindex list-config
	Display various internal configuration parameters of GnuPG. This option
	is intended for external programs that call GnuPG to perform tasks, and
	is thus not generally useful. See the file @file{doc/DETAILS} in the
	source distribution for the details of which configuration items may be
	listed. @option{--list-config} is only usable with
	@option{--with-colons} set.

	@item --list-gcrypt-config
	@opindex list-gcrypt-config
	Display various internal configuration parameters of Libgcrypt.

	@item --gpgconf-list
	@opindex gpgconf-list
	This command is similar to @option{--list-config} but in general only
	internally used by the @command{gpgconf} tool.

	@item --gpgconf-test
	@opindex gpgconf-test
	This is more or less dummy action. However it parses the configuration
	file and returns with failure if the configuration file would prevent
	@command{@gpgname} from startup. Thus it may be used to run a syntax check
	on the configuration file.

	@end table

	@c *******************************
	@c ***** Deprecated **********
	@c *******************************
	@node Deprecated Options
	@subsection Deprecated options

	@table @gnupgtabopt

	@item --show-photos
	@itemx --no-show-photos
	@opindex show-photos
	Causes @option{--list-keys}, @option{--list-signatures},
	@option{--list-public-keys}, @option{--list-secret-keys}, and verifying
	a signature to also display the photo ID attached to the key, if
	any. See also @option{--photo-viewer}. These options are deprecated. Use
	@option{--list-options [no-]show-photos} and/or @option{--verify-options
	[no-]show-photos} instead.

	@item --show-keyring
	@opindex show-keyring
	Display the keyring name at the head of key listings to show which
	keyring a given key resides on. This option is deprecated: use
	@option{--list-options [no-]show-keyring} instead.

	@item --always-trust
	@opindex always-trust
	Identical to @option{--trust-model always}. This option is deprecated.

	@item --show-notation
	@itemx --no-show-notation
	@opindex show-notation
	Show signature notations in the @option{--list-signatures} or @option{--check-signatures} listings
	as well as when verifying a signature with a notation in it. These
	options are deprecated. Use @option{--list-options [no-]show-notation}
	and/or @option{--verify-options [no-]show-notation} instead.

	@item --show-policy-url
	@itemx --no-show-policy-url
	@opindex show-policy-url
	Show policy URLs in the @option{--list-signatures} or @option{--check-signatures}
	listings as well as when verifying a signature with a policy URL in
	it. These options are deprecated. Use @option{--list-options
	[no-]show-policy-url} and/or @option{--verify-options
	[no-]show-policy-url} instead.


	@end table


	@c *******************************************
	@c ************* **************
	@c ************* FILES **************
	@c ************* **************
	@c *******************************************
	@mansect files
	@node GPG Configuration
	@section Configuration files

	There are a few configuration files to control certain aspects of
	@command{@gpgname}'s operation. Unless noted, they are expected in the
	current home directory (@pxref{option --homedir}).

	@table @file

	@item gpg.conf
	@efindex gpg.conf
	This is the standard configuration file read by @command{@gpgname} on
	startup. It may contain any valid long option; the leading two dashes
	may not be entered and the option may not be abbreviated. This default
	name may be changed on the command line (@pxref{gpg-option --options}).
	You should backup this file.

	@end table

	Note that on larger installations, it is useful to put predefined files
	into the directory @file{@value{SYSCONFSKELDIR}} so that
	newly created users start up with a working configuration.
	For existing users a small
	helper script is provided to create these files (@pxref{addgnupghome}).

	For internal purposes @command{@gpgname} creates and maintains a few other
	-files; They all live in in the current home directory (@pxref{option
	+files; They all live in the current home directory (@pxref{option
	--homedir}). Only the @command{@gpgname} program may modify these files.


	@table @file
	@item ~/.gnupg
	@efindex ~/.gnupg
	This is the default home directory which is used if neither the
	environment variable @code{GNUPGHOME} nor the option
	@option{--homedir} is given.

	@item ~/.gnupg/pubring.gpg
	@efindex pubring.gpg
	The public keyring. You should backup this file.

	@item ~/.gnupg/pubring.gpg.lock
	The lock file for the public keyring.

	@item ~/.gnupg/pubring.kbx
	@efindex pubring.kbx
	The public keyring using a different format. This file is shared
	with @command{gpgsm}. You should backup this file.

	@item ~/.gnupg/pubring.kbx.lock
	The lock file for @file{pubring.kbx}.

	@item ~/.gnupg/secring.gpg
	@efindex secring.gpg
	A secret keyring as used by GnuPG versions before 2.1. It is not
	used by GnuPG 2.1 and later.

	@item ~/.gnupg/secring.gpg.lock
	The lock file for the secret keyring.

	@item ~/.gnupg/.gpg-v21-migrated
	@efindex .gpg-v21-migrated
	File indicating that a migration to GnuPG 2.1 has been done.

	@item ~/.gnupg/trustdb.gpg
	@efindex trustdb.gpg
	The trust database. There is no need to backup this file; it is better
	to backup the ownertrust values (@pxref{option --export-ownertrust}).

	@item ~/.gnupg/trustdb.gpg.lock
	The lock file for the trust database.

	@item ~/.gnupg/random_seed
	@efindex random_seed
	A file used to preserve the state of the internal random pool.

	@item ~/.gnupg/openpgp-revocs.d/
	@efindex openpgp-revocs.d
	This is the directory where gpg stores pre-generated revocation
	certificates. The file name corresponds to the OpenPGP fingerprint of
	the respective key. It is suggested to backup those certificates and
	if the primary private key is not stored on the disk to move them to
	an external storage device. Anyone who can access theses files is
	able to revoke the corresponding key. You may want to print them out.
	You should backup all files in this directory and take care to keep
	this backup closed away.

	@item @value{DATADIR}/options.skel
	@efindex options.skel
	The skeleton options file.

	@end table

	Operation is further controlled by a few environment variables:

	@table @asis

	@item HOME
	@efindex HOME
	Used to locate the default home directory.

	@item GNUPGHOME
	@efindex GNUPGHOME
	If set directory used instead of "~/.gnupg".

	@item GPG_AGENT_INFO
	This variable is obsolete; it was used by GnuPG versions before 2.1.

	@item PINENTRY_USER_DATA
	@efindex PINENTRY_USER_DATA
	This value is passed via gpg-agent to pinentry. It is useful to convey
	extra information to a custom pinentry.

	@item COLUMNS
	@itemx LINES
	@efindex COLUMNS
	@efindex LINES
	Used to size some displays to the full size of the screen.

	@item LANGUAGE
	@efindex LANGUAGE
	Apart from its use by GNU, it is used in the W32 version to override the
	language selection done through the Registry. If used and set to a
	valid and available language name (@var{langid}), the file with the
	translation is loaded from
	@code{@var{gpgdir}/gnupg.nls/@var{langid}.mo}. Here @var{gpgdir} is the
	directory out of which the gpg binary has been loaded. If it can't be
	loaded the Registry is tried and as last resort the native Windows
	locale system is used.

	@end table


	@c *******************************************
	@c ************* **************
	@c ************* EXAMPLES **************
	@c ************* **************
	@c *******************************************
	@mansect examples
	@node GPG Examples
	@section Examples

	@table @asis

	@item gpg -se -r @code{Bob} @code{file}
	sign and encrypt for user Bob

	@item gpg --clear-sign @code{file}
	make a cleartext signature

	@item gpg -sb @code{file}
	make a detached signature

	@item gpg -u 0x12345678 -sb @code{file}
	make a detached signature with the key 0x12345678

	@item gpg --list-keys @code{user_ID}
	show keys

	@item gpg --fingerprint @code{user_ID}
	show fingerprint

	@item gpg --verify @code{pgpfile}
	@itemx gpg --verify @code{sigfile} [@code{datafile}]
	Verify the signature of the file but do not output the data unless
	requested. The second form is used for detached signatures, where
	@code{sigfile} is the detached signature (either ASCII armored or
	binary) and @code{datafile} are the signed data; if this is not given, the name of the
	file holding the signed data is constructed by cutting off the
	extension (".asc" or ".sig") of @code{sigfile} or by asking the user
	for the filename. If the option @option{--output} is also used the
	signed data is written to the file specified by that option; use
	@code{-} to write the signed data to stdout.
	@end table


	@c *******************************************
	@c ************* **************
	@c ************* USER ID **************
	@c ************* **************
	@c *******************************************
	@mansect how to specify a user id
	@ifset isman
	@include specify-user-id.texi
	@end ifset

	@mansect filter expressions
	@chapheading FILTER EXPRESSIONS

	The options @option{--import-filter} and @option{--export-filter} use
	expressions with this syntax (square brackets indicate an optional
	part and curly braces a repetition, white space between the elements
	are allowed):

	@c man:.RS
	@example
	[lc] @{[@{flag@}] PROPNAME op VALUE [lc]@}
	@end example
	@c man:.RE

	The name of a property (@var{PROPNAME}) may only consist of letters,
	digits and underscores. The description for the filter type
	describes which properties are defined. If an undefined property is
	used it evaluates to the empty string. Unless otherwise noted, the
	@var{VALUE} must always be given and may not be the empty string. No
	quoting is defined for the value, thus the value may not contain the
	strings @code{&&} or @code{\|\|}, which are used as logical connection
	operators. The flag @code{--} can be used to remove this restriction.

	Numerical values are computed as long int; standard C notation
	applies. @var{lc} is the logical connection operator; either
	@code{&&} for a conjunction or @code{\|\|} for a disjunction. A
	conjunction is assumed at the begin of an expression. Conjunctions
	have higher precedence than disjunctions. If @var{VALUE} starts with
	one of the characters used in any @var{op} a space after the
	@var{op} is required.

	@noindent
	The supported operators (@var{op}) are:

	@table @asis

	@item =~
	Substring must match.

	@item !~
	Substring must not match.

	@item =
	The full string must match.

	@item <>
	The full string must not match.

	@item ==
	The numerical value must match.

	@item !=
	The numerical value must not match.

	@item <=
	The numerical value of the field must be LE than the value.

	@item <
	The numerical value of the field must be LT than the value.

	@item >
	The numerical value of the field must be GT than the value.

	@item >=
	The numerical value of the field must be GE than the value.

	@item -le
	The string value of the field must be less or equal than the value.

	@item -lt
	The string value of the field must be less than the value.

	@item -gt
	The string value of the field must be greater than the value.

	@item -ge
	The string value of the field must be greater or equal than the value.

	@item -n
	True if value is not empty (no value allowed).

	@item -z
	True if value is empty (no value allowed).

	@item -t
	Alias for "PROPNAME != 0" (no value allowed).

	@item -f
	Alias for "PROPNAME == 0" (no value allowed).

	@end table

	@noindent
	Values for @var{flag} must be space separated. The supported flags
	are:

	@table @asis
	@item --
	@var{VALUE} spans to the end of the expression.
	@item -c
	The string match in this part is done case-sensitive.
	@end table

	The filter options concatenate several specifications for a filter of
	the same type. For example the four options in this example:

	@c man:.RS
	@example
	--import-option keep-uid="uid =~ Alfa"
	--import-option keep-uid="&& uid !~ Test"
	--import-option keep-uid="\|\| uid =~ Alpha"
	--import-option keep-uid="uid !~ Test"
	@end example
	@c man:.RE

	@noindent
	which is equivalent to

	@c man:.RS
	@example
	--import-option \
	keep-uid="uid =~ Alfa" && uid !~ Test" \|\| uid =~ Alpha" && "uid !~ Test"
	@end example
	@c man:.RE

	imports only the user ids of a key containing the strings "Alfa"
	or "Alpha" but not the string "test".


	@mansect return value
	@chapheading RETURN VALUE

	The program returns 0 if everything was fine, 1 if at least
	a signature was bad, and other error codes for fatal errors.

	@mansect warnings
	@chapheading WARNINGS

	Use a good password for your user account and a good passphrase
	to protect your secret key. This passphrase is the weakest part of the
	whole system. Programs to do dictionary attacks on your secret keyring
	are very easy to write and so you should protect your "~/.gnupg/"
	directory very well.

	Keep in mind that, if this program is used over a network (telnet), it
	is very easy to spy out your passphrase!

	If you are going to verify detached signatures, make sure that the
	program knows about it; either give both filenames on the command line
	or use @samp{-} to specify STDIN.

	@mansect interoperability
	@chapheading INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS

	GnuPG tries to be a very flexible implementation of the OpenPGP
	standard. In particular, GnuPG implements many of the optional parts
	of the standard, such as the SHA-512 hash, and the ZLIB and BZIP2
	compression algorithms. It is important to be aware that not all
	OpenPGP programs implement these optional algorithms and that by
	forcing their use via the @option{--cipher-algo},
	@option{--digest-algo}, @option{--cert-digest-algo}, or
	@option{--compress-algo} options in GnuPG, it is possible to create a
	perfectly valid OpenPGP message, but one that cannot be read by the
	intended recipient.

	There are dozens of variations of OpenPGP programs available, and each
	supports a slightly different subset of these optional algorithms.
	For example, until recently, no (unhacked) version of PGP supported
	the BLOWFISH cipher algorithm. A message using BLOWFISH simply could
	not be read by a PGP user. By default, GnuPG uses the standard
	OpenPGP preferences system that will always do the right thing and
	create messages that are usable by all recipients, regardless of which
	OpenPGP program they use. Only override this safe default if you
	really know what you are doing.

	If you absolutely must override the safe default, or if the preferences
	on a given key are invalid for some reason, you are far better off using
	the @option{--pgp6}, @option{--pgp7}, or @option{--pgp8} options. These
	options are safe as they do not force any particular algorithms in
	violation of OpenPGP, but rather reduce the available algorithms to a
	"PGP-safe" list.

	@mansect bugs
	@chapheading BUGS

	On older systems this program should be installed as setuid(root). This
	is necessary to lock memory pages. Locking memory pages prevents the
	operating system from writing memory pages (which may contain
	passphrases or other sensitive material) to disk. If you get no
	warning message about insecure memory your operating system supports
	locking without being root. The program drops root privileges as soon
	as locked memory is allocated.

	Note also that some systems (especially laptops) have the ability to
	``suspend to disk'' (also known as ``safe sleep'' or ``hibernate'').
	This writes all memory to disk before going into a low power or even
	powered off mode. Unless measures are taken in the operating system
	to protect the saved memory, passphrases or other sensitive material
	may be recoverable from it later.

	Before you report a bug you should first search the mailing list
	archives for similar problems and second check whether such a bug has
	already been reported to our bug tracker at http://bugs.gnupg.org .

	@c *******************************************
	@c ************* ************
	@c ************* UNATTENDED ************
	@c ************* ************
	@c *******************************************
	@manpause
	@node Unattended Usage of GPG
	@section Unattended Usage

	@command{@gpgname} is often used as a backend engine by other software. To help
	with this a machine interface has been defined to have an unambiguous
	way to do this. The options @option{--status-fd} and @option{--batch}
	are almost always required for this.

	@menu
	* Programmatic use of GnuPG:: Programmatic use of GnuPG
	* Ephemeral home directories:: Ephemeral home directories
	* The quick key manipulation interface:: The quick key manipulation interface
	* Unattended GPG key generation:: Unattended key generation
	@end menu


	@node Programmatic use of GnuPG
	@subsection Programmatic use of GnuPG

	Please consider using GPGME instead of calling @command{@gpgname}
	directly. GPGME offers a stable, backend-independent interface for
	many cryptographic operations. It supports OpenPGP and S/MIME, and
	also allows interaction with various GnuPG components.

	GPGME provides a C-API, and comes with bindings for C++, Qt, and
	Python. Bindings for other languages are available.

	@node Ephemeral home directories
	@subsection Ephemeral home directories

	Sometimes you want to contain effects of some operation, for example
	you want to import a key to inspect it, but you do not want this key
	to be added to your keyring. In earlier versions of GnuPG, it was
	possible to specify alternate keyring files for both public and secret
	keys. In modern GnuPG versions, however, we changed how secret keys
	are stored in order to better protect secret key material, and it was
	not possible to preserve this interface.

	The preferred way to do this is to use ephemeral home directories.
	This technique works across all versions of GnuPG.

	Create a temporary directory, create (or copy) a configuration that
	meets your needs, make @command{@gpgname} use this directory either
	using the environment variable @var{GNUPGHOME}, or the option
	@option{--homedir}. GPGME supports this too on a per-context basis,
	by modifying the engine info of contexts. Now execute whatever
	operation you like, import and export key material as necessary. Once
	finished, you can delete the directory. All GnuPG backend services
	that were started will detect this and shut down.

	@node The quick key manipulation interface
	@subsection The quick key manipulation interface

	Recent versions of GnuPG have an interface to manipulate keys without
	using the interactive command @option{--edit-key}. This interface was
	added mainly for the benefit of GPGME (please consider using GPGME,
	see the manual subsection ``Programmatic use of GnuPG''). This
	interface is described in the subsection ``How to manage your keys''.

	@node Unattended GPG key generation
	@subsection Unattended key generation

	The command @option{--generate-key} may be used along with the option
	@option{--batch} for unattended key generation. This is the most
	flexible way of generating keys, but it is also the most complex one.
	Consider using the quick key manipulation interface described in the
	previous subsection ``The quick key manipulation interface''.

	The parameters for the key are either read from stdin or given as a
	file on the command line. The format of the parameter file is as
	follows:

	@itemize @bullet
	@item Text only, line length is limited to about 1000 characters.
	@item UTF-8 encoding must be used to specify non-ASCII characters.
	@item Empty lines are ignored.
	@item Leading and trailing while space is ignored.
	@item A hash sign as the first non white space character indicates
	a comment line.
	@item Control statements are indicated by a leading percent sign, the
	arguments are separated by white space from the keyword.
	@item Parameters are specified by a keyword, followed by a colon. Arguments
	are separated by white space.
	@item
	The first parameter must be @samp{Key-Type}; control statements may be
	placed anywhere.
	@item
	The order of the parameters does not matter except for @samp{Key-Type}
	which must be the first parameter. The parameters are only used for
	the generated keyblock (primary and subkeys); parameters from previous
	sets are not used. Some syntactically checks may be performed.
	@item
	Key generation takes place when either the end of the parameter file
	is reached, the next @samp{Key-Type} parameter is encountered or at the
	control statement @samp{%commit} is encountered.
	@end itemize

	@noindent
	Control statements:

	@table @asis

	@item %echo @var{text}
	Print @var{text} as diagnostic.

	@item %dry-run
	Suppress actual key generation (useful for syntax checking).

	@item %commit
	Perform the key generation. Note that an implicit commit is done at
	the next @asis{Key-Type} parameter.

	@item %pubring @var{filename}
	Do not write the key to the default or commandline given keyring but
	to @var{filename}. This must be given before the first commit to take
	place, duplicate specification of the same filename is ignored, the
	last filename before a commit is used. The filename is used until a
	new filename is used (at commit points) and all keys are written to
	that file. If a new filename is given, this file is created (and
	overwrites an existing one).

	See the previous subsection ``Ephemeral home directories'' for a more
	robust way to contain side-effects.

	@item %secring @var{filename}
	This option is a no-op for GnuPG 2.1 and later.

	See the previous subsection ``Ephemeral home directories''.

	@item %ask-passphrase
	@itemx %no-ask-passphrase
	This option is a no-op for GnuPG 2.1 and later.

	@item %no-protection
	Using this option allows the creation of keys without any passphrase
	protection. This option is mainly intended for regression tests.

	@item %transient-key
	If given the keys are created using a faster and a somewhat less
	secure random number generator. This option may be used for keys
	which are only used for a short time and do not require full
	cryptographic strength. It takes only effect if used together with
	the control statement @samp{%no-protection}.

	@end table

	@noindent
	General Parameters:

	@table @asis

	@item Key-Type: @var{algo}
	Starts a new parameter block by giving the type of the primary
	key. The algorithm must be capable of signing. This is a required
	parameter. @var{algo} may either be an OpenPGP algorithm number or a
	string with the algorithm name. The special value @samp{default} may
	be used for @var{algo} to create the default key type; in this case a
	@samp{Key-Usage} shall not be given and @samp{default} also be used
	for @samp{Subkey-Type}.

	@item Key-Length: @var{nbits}
	The requested length of the generated key in bits. The default is
	returned by running the command @samp{@gpgname --gpgconf-list}.

	@item Key-Grip: @var{hexstring}
	This is optional and used to generate a CSR or certificate for an
	already existing key. Key-Length will be ignored when given.

	@item Key-Usage: @var{usage-list}
	Space or comma delimited list of key usages. Allowed values are
	@samp{encrypt}, @samp{sign}, and @samp{auth}. This is used to
	generate the key flags. Please make sure that the algorithm is
	capable of this usage. Note that OpenPGP requires that all primary
	keys are capable of certification, so no matter what usage is given
	here, the @samp{cert} flag will be on. If no @samp{Key-Usage} is
	specified and the @samp{Key-Type} is not @samp{default}, all allowed
	usages for that particular algorithm are used; if it is not given but
	@samp{default} is used the usage will be @samp{sign}.

	@item Subkey-Type: @var{algo}
	This generates a secondary key (subkey). Currently only one subkey
	can be handled. See also @samp{Key-Type} above.

	@item Subkey-Length: @var{nbits}
	Length of the secondary key (subkey) in bits. The default is returned
	by running the command @samp{@gpgname --gpgconf-list}.

	@item Subkey-Usage: @var{usage-list}
	Key usage lists for a subkey; similar to @samp{Key-Usage}.

	@item Passphrase: @var{string}
	If you want to specify a passphrase for the secret key, enter it here.
	Default is to use the Pinentry dialog to ask for a passphrase.

	@item Name-Real: @var{name}
	@itemx Name-Comment: @var{comment}
	@itemx Name-Email: @var{email}
	The three parts of a user name. Remember to use UTF-8 encoding here.
	If you don't give any of them, no user ID is created.

	@item Expire-Date: @var{iso-date}\|(@var{number}[d\|w\|m\|y])
	Set the expiration date for the key (and the subkey). It may either
	be entered in ISO date format (e.g. "20000815T145012") or as number of
	days, weeks, month or years after the creation date. The special
	notation "seconds=N" is also allowed to specify a number of seconds
	since creation. Without a letter days are assumed. Note that there
	is no check done on the overflow of the type used by OpenPGP for
	timestamps. Thus you better make sure that the given value make
	sense. Although OpenPGP works with time intervals, GnuPG uses an
	absolute value internally and thus the last year we can represent is
	2105.

	@item Creation-Date: @var{iso-date}
	Set the creation date of the key as stored in the key information and
	which is also part of the fingerprint calculation. Either a date like
	"1986-04-26" or a full timestamp like "19860426T042640" may be used.
	The time is considered to be UTC. The special notation "seconds=N"
	may be used to directly specify a the number of seconds since Epoch
	(Unix time). If it is not given the current time is used.

	@item Preferences: @var{string}
	Set the cipher, hash, and compression preference values for this key.
	This expects the same type of string as the sub-command @samp{setpref}
	in the @option{--edit-key} menu.

	@item Revoker: @var{algo}:@var{fpr} [sensitive]
	Add a designated revoker to the generated key. Algo is the public key
	algorithm of the designated revoker (i.e. RSA=1, DSA=17, etc.)
	@var{fpr} is the fingerprint of the designated revoker. The optional
	@samp{sensitive} flag marks the designated revoker as sensitive
	information. Only v4 keys may be designated revokers.

	@item Keyserver: @var{string}
	This is an optional parameter that specifies the preferred keyserver
	URL for the key.

	@item Handle: @var{string}
	This is an optional parameter only used with the status lines
	KEY_CREATED and KEY_NOT_CREATED. @var{string} may be up to 100
	characters and should not contain spaces. It is useful for batch key
	generation to associate a key parameter block with a status line.

	@end table

	@noindent
	Here is an example on how to create a key in an ephemeral home directory:
	@smallexample
	$ export GNUPGHOME="$(mktemp -d)"
	$ cat >foo <<EOF
	%echo Generating a basic OpenPGP key
	Key-Type: DSA
	Key-Length: 1024
	Subkey-Type: ELG-E
	Subkey-Length: 1024
	Name-Real: Joe Tester
	Name-Comment: with stupid passphrase
	Name-Email: joe@@foo.bar
	Expire-Date: 0
	Passphrase: abc
	# Do a commit here, so that we can later print "done" :-)
	%commit
	%echo done
	EOF
	$ @gpgname --batch --generate-key foo
	[...]
	$ @gpgname --list-secret-keys
	/tmp/tmp.0NQxB74PEf/pubring.kbx
	-------------------------------
	sec dsa1024 2016-12-16 [SCA]
	768E895903FC1C44045C8CB95EEBDB71E9E849D0
	uid [ultimate] Joe Tester (with stupid passphrase) <joe@@foo.bar>
	ssb elg1024 2016-12-16 [E]
	@end smallexample

	@noindent
	If you want to create a key with the default algorithms you would use
	these parameters:
	@smallexample
	%echo Generating a default key
	Key-Type: default
	Subkey-Type: default
	Name-Real: Joe Tester
	Name-Comment: with stupid passphrase
	Name-Email: joe@@foo.bar
	Expire-Date: 0
	Passphrase: abc
	# Do a commit here, so that we can later print "done" :-)
	%commit
	%echo done
	@end smallexample




	@mansect see also
	@ifset isman
	@command{gpgv}(1),
	@command{gpgsm}(1),
	@command{gpg-agent}(1)
	@end ifset
	@include see-also-note.texi
	diff --git a/doc/gpgsm.texi b/doc/gpgsm.texi
	index b92eaea43..1d0083976 100644
	--- a/doc/gpgsm.texi
	+++ b/doc/gpgsm.texi
	@@ -1,1629 +1,1629 @@
	@c Copyright (C) 2002 Free Software Foundation, Inc.
	@c This is part of the GnuPG manual.
	@c For copying conditions, see the file gnupg.texi.

	@include defs.inc

	@node Invoking GPGSM
	@chapter Invoking GPGSM
	@cindex GPGSM command options
	@cindex command options
	@cindex options, GPGSM command

	@manpage gpgsm.1
	@ifset manverb
	.B gpgsm
	\- CMS encryption and signing tool
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B gpgsm
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.I command
	.RI [ args ]
	@end ifset


	@mansect description
	@command{gpgsm} is a tool similar to @command{gpg} to provide digital
	encryption and signing services on X.509 certificates and the CMS
	protocol. It is mainly used as a backend for S/MIME mail processing.
	@command{gpgsm} includes a full featured certificate management and
	complies with all rules defined for the German Sphinx project.

	@manpause
	@xref{Option Index}, for an index to @command{GPGSM}'s commands and options.
	@mancont

	@menu
	* GPGSM Commands:: List of all commands.
	* GPGSM Options:: List of all options.
	* GPGSM Configuration:: Configuration files.
	* GPGSM Examples:: Some usage examples.

	Developer information:
	* Unattended Usage:: Using @command{gpgsm} from other programs.
	* GPGSM Protocol:: The protocol the server mode uses.
	@end menu

	@c *******************************************
	@c ************* **************
	@c ************* COMMANDS **************
	@c ************* **************
	@c *******************************************
	@mansect commands
	@node GPGSM Commands
	@section Commands

	Commands are not distinguished from options except for the fact that
	only one command is allowed.

	@menu
	* General GPGSM Commands:: Commands not specific to the functionality.
	* Operational GPGSM Commands:: Commands to select the type of operation.
	* Certificate Management:: How to manage certificates.
	@end menu


	@c *******************************************
	@c ******** GENERAL COMMANDS ***********
	@c *******************************************
	@node General GPGSM Commands
	@subsection Commands not specific to the function

	@table @gnupgtabopt
	@item --version
	@opindex version
	Print the program version and licensing information. Note that you
	cannot abbreviate this command.

	@item --help, -h
	@opindex help
	Print a usage message summarizing the most useful command-line options.
	Note that you cannot abbreviate this command.

	@item --warranty
	@opindex warranty
	Print warranty information. Note that you cannot abbreviate this
	command.

	@item --dump-options
	@opindex dump-options
	Print a list of all available options and commands. Note that you cannot
	abbreviate this command.
	@end table


	@c *******************************************
	@c ****** OPERATIONAL COMMANDS *********
	@c *******************************************
	@node Operational GPGSM Commands
	@subsection Commands to select the type of operation

	@table @gnupgtabopt
	@item --encrypt
	@opindex encrypt
	Perform an encryption. The keys the data is encrypted to must be set
	using the option @option{--recipient}.

	@item --decrypt
	@opindex decrypt
	Perform a decryption; the type of input is automatically determined. It
	may either be in binary form or PEM encoded; automatic determination of
	base-64 encoding is not done.

	@item --sign
	@opindex sign
	Create a digital signature. The key used is either the fist one found
	in the keybox or those set with the @option{--local-user} option.

	@item --verify
	@opindex verify
	Check a signature file for validity. Depending on the arguments a
	detached signature may also be checked.

	@item --server
	@opindex server
	Run in server mode and wait for commands on the @code{stdin}.

	@item --call-dirmngr @var{command} [@var{args}]
	@opindex call-dirmngr
	Behave as a Dirmngr client issuing the request @var{command} with the
	optional list of @var{args}. The output of the Dirmngr is printed
	stdout. Please note that file names given as arguments should have an
	absolute file name (i.e. commencing with @code{/}) because they are
	passed verbatim to the Dirmngr and the working directory of the
	Dirmngr might not be the same as the one of this client. Currently it
	is not possible to pass data via stdin to the Dirmngr. @var{command}
	should not contain spaces.

	This is command is required for certain maintaining tasks of the dirmngr
	where a dirmngr must be able to call back to @command{gpgsm}. See the Dirmngr
	manual for details.

	@item --call-protect-tool @var{arguments}
	@opindex call-protect-tool
	Certain maintenance operations are done by an external program call
	@command{gpg-protect-tool}; this is usually not installed in a directory
	listed in the PATH variable. This command provides a simple wrapper to
	access this tool. @var{arguments} are passed verbatim to this command;
	use @samp{--help} to get a list of supported operations.


	@end table


	@c *******************************************
	@c ***** CERTIFICATE MANAGEMENT ********
	@c *******************************************
	@node Certificate Management
	@subsection How to manage the certificates and keys

	@table @gnupgtabopt
	@item --generate-key
	@opindex generate-key
	@itemx --gen-key
	@opindex gen-key
	This command allows the creation of a certificate signing request or a
	self-signed certificate. It is commonly used along with the
	@option{--output} option to save the created CSR or certificate into a
	file. If used with the @option{--batch} a parameter file is used to
	create the CSR or certificate and it is further possible to create
	non-self-signed certificates.

	@item --list-keys
	@itemx -k
	@opindex list-keys
	List all available certificates stored in the local key database.
	Note that the displayed data might be reformatted for better human
	readability and illegal characters are replaced by safe substitutes.

	@item --list-secret-keys
	@itemx -K
	@opindex list-secret-keys
	List all available certificates for which a corresponding a secret key
	is available.

	@item --list-external-keys @var{pattern}
	@opindex list-keys
	List certificates matching @var{pattern} using an external server. This
	utilizes the @code{dirmngr} service.

	@item --list-chain
	@opindex list-chain
	Same as @option{--list-keys} but also prints all keys making up the chain.


	@item --dump-cert
	@itemx --dump-keys
	@opindex dump-cert
	@opindex dump-keys
	List all available certificates stored in the local key database using a
	format useful mainly for debugging.

	@item --dump-chain
	@opindex dump-chain
	Same as @option{--dump-keys} but also prints all keys making up the chain.

	@item --dump-secret-keys
	@opindex dump-secret-keys
	List all available certificates for which a corresponding a secret key
	is available using a format useful mainly for debugging.

	@item --dump-external-keys @var{pattern}
	@opindex dump-external-keys
	List certificates matching @var{pattern} using an external server.
	This utilizes the @code{dirmngr} service. It uses a format useful
	mainly for debugging.

	@item --keydb-clear-some-cert-flags
	@opindex keydb-clear-some-cert-flags
	This is a debugging aid to reset certain flags in the key database
	which are used to cache certain certificate stati. It is especially
	useful if a bad CRL or a weird running OCSP responder did accidentally
	revoke certificate. There is no security issue with this command
	because @command{gpgsm} always make sure that the validity of a certificate is
	checked right before it is used.

	@item --delete-keys @var{pattern}
	@opindex delete-keys
	Delete the keys matching @var{pattern}. Note that there is no command
	to delete the secret part of the key directly. In case you need to do
	this, you should run the command @code{gpgsm --dump-secret-keys KEYID}
	before you delete the key, copy the string of hex-digits in the
	``keygrip'' line and delete the file consisting of these hex-digits
	and the suffix @code{.key} from the @file{private-keys-v1.d} directory
	below our GnuPG home directory (usually @file{~/.gnupg}).

	@item --export [@var{pattern}]
	@opindex export
	Export all certificates stored in the Keybox or those specified by the
	optional @var{pattern}. Those pattern consist of a list of user ids
	(@pxref{how-to-specify-a-user-id}). When used along with the
	@option{--armor} option a few informational lines are prepended before
	each block. There is one limitation: As there is no commonly agreed
	upon way to pack more than one certificate into an ASN.1 structure,
	the binary export (i.e. without using @option{armor}) works only for
	the export of one certificate. Thus it is required to specify a
	@var{pattern} which yields exactly one certificate. Ephemeral
	certificate are only exported if all @var{pattern} are given as
	fingerprints or keygrips.

	@item --export-secret-key-p12 @var{key-id}
	@opindex export-secret-key-p12
	Export the private key and the certificate identified by @var{key-id} in
	a PKCS#12 format. When used with the @code{--armor} option a few
	informational lines are prepended to the output. Note, that the PKCS#12
	format is not very secure and this command is only provided if there is
	no other way to exchange the private key. (@xref{option --p12-charset}.)

	@item --export-secret-key-p8 @var{key-id}
	@itemx --export-secret-key-raw @var{key-id}
	@opindex export-secret-key-p8
	@opindex export-secret-key-raw
	Export the private key of the certificate identified by @var{key-id}
	with any encryption stripped. The @code{...-raw} command exports in
	PKCS#1 format; the @code{...-p8} command exports in PKCS#8 format.
	When used with the @code{--armor} option a few informational lines are
	prepended to the output. These commands are useful to prepare a key
	for use on a TLS server.

	@item --import [@var{files}]
	@opindex import
	Import the certificates from the PEM or binary encoded files as well as
	from signed-only messages. This command may also be used to import a
	secret key from a PKCS#12 file.

	@item --learn-card
	@opindex learn-card
	Read information about the private keys from the smartcard and import
	the certificates from there. This command utilizes the @command{gpg-agent}
	and in turn the @command{scdaemon}.

	@item --change-passphrase @var{user_id}
	@opindex change-passphrase
	@itemx --passwd @var{user_id}
	@opindex passwd
	Change the passphrase of the private key belonging to the certificate
	specified as @var{user_id}. Note, that changing the passphrase/PIN of a
	smartcard is not yet supported.

	@end table


	@c *******************************************
	@c ************* **************
	@c ************* OPTIONS **************
	@c ************* **************
	@c *******************************************
	@mansect options
	@node GPGSM Options
	@section Option Summary

	@command{GPGSM} features a bunch of options to control the exact behaviour
	and to change the default configuration.

	@menu
	* Configuration Options:: How to change the configuration.
	* Certificate Options:: Certificate related options.
	* Input and Output:: Input and Output.
	* CMS Options:: How to change how the CMS is created.
	* Esoteric Options:: Doing things one usually do not want to do.
	@end menu


	@c *******************************************
	@c ****** CONFIGURATION OPTIONS ********
	@c *******************************************
	@node Configuration Options
	@subsection How to change the configuration

	These options are used to change the configuration and are usually found
	in the option file.

	@table @gnupgtabopt

	@anchor{gpgsm-option --options}
	@item --options @var{file}
	@opindex options
	Reads configuration from @var{file} instead of from the default
	per-user configuration file. The default configuration file is named
	@file{gpgsm.conf} and expected in the @file{.gnupg} directory directly
	below the home directory of the user.

	@include opt-homedir.texi


	@item -v
	@item --verbose
	@opindex v
	@opindex verbose
	Outputs additional information while running.
	You can increase the verbosity by giving several
	verbose commands to @command{gpgsm}, such as @samp{-vv}.

	@item --policy-file @var{filename}
	@opindex policy-file
	Change the default name of the policy file to @var{filename}.

	@item --agent-program @var{file}
	@opindex agent-program
	Specify an agent program to be used for secret key operations. The
	default value is determined by running the command @command{gpgconf}.
	Note that the pipe symbol (@code{\|}) is used for a regression test
	suite hack and may thus not be used in the file name.

	@item --dirmngr-program @var{file}
	@opindex dirmngr-program
	Specify a dirmngr program to be used for @acronym{CRL} checks. The
	default value is @file{@value{BINDIR}/dirmngr}.

	@item --prefer-system-dirmngr
	@opindex prefer-system-dirmngr
	If a system wide @command{dirmngr} is running in daemon mode, first try
	to connect to this one. Fallback to a pipe based server if this does
	not work. Under Windows this option is ignored because the system dirmngr is
	always used.

	@item --disable-dirmngr
	Entirely disable the use of the Dirmngr.

	@item --no-autostart
	@opindex no-autostart
	Do not start the gpg-agent or the dirmngr if it has not yet been
	started and its service is required. This option is mostly useful on
	machines where the connection to gpg-agent has been redirected to
	another machines. If dirmngr is required on the remote machine, it
	may be started manually using @command{gpgconf --launch dirmngr}.

	@item --no-secmem-warning
	@opindex no-secmem-warning
	Do not print a warning when the so called "secure memory" cannot be used.

	@item --log-file @var{file}
	@opindex log-file
	When running in server mode, append all logging output to @var{file}.
	Use @file{socket://} to log to socket.

	@end table


	@c *******************************************
	@c ****** CERTIFICATE OPTIONS **********
	@c *******************************************
	@node Certificate Options
	@subsection Certificate related options

	@table @gnupgtabopt

	@item --enable-policy-checks
	@itemx --disable-policy-checks
	@opindex enable-policy-checks
	@opindex disable-policy-checks
	By default policy checks are enabled. These options may be used to
	change it.

	@item --enable-crl-checks
	@itemx --disable-crl-checks
	@opindex enable-crl-checks
	@opindex disable-crl-checks
	By default the @acronym{CRL} checks are enabled and the DirMngr is used
	to check for revoked certificates. The disable option is most useful
	with an off-line network connection to suppress this check.

	@item --enable-trusted-cert-crl-check
	@itemx --disable-trusted-cert-crl-check
	@opindex enable-trusted-cert-crl-check
	@opindex disable-trusted-cert-crl-check
	By default the @acronym{CRL} for trusted root certificates are checked
	like for any other certificates. This allows a CA to revoke its own
	certificates voluntary without the need of putting all ever issued
	certificates into a CRL. The disable option may be used to switch this
	extra check off. Due to the caching done by the Dirmngr, there will not be
	any noticeable performance gain. Note, that this also disables possible
	OCSP checks for trusted root certificates. A more specific way of
	disabling this check is by adding the ``relax'' keyword to the root CA
	line of the @file{trustlist.txt}


	@item --force-crl-refresh
	@opindex force-crl-refresh
	Tell the dirmngr to reload the CRL for each request. For better
	performance, the dirmngr will actually optimize this by suppressing
	the loading for short time intervals (e.g. 30 minutes). This option
	is useful to make sure that a fresh CRL is available for certificates
	hold in the keybox. The suggested way of doing this is by using it
	along with the option @option{--with-validation} for a key listing
	command. This option should not be used in a configuration file.

	@item --enable-ocsp
	@itemx --disable-ocsp
	@opindex enable-ocsp
	@opindex disable-ocsp
	By default @acronym{OCSP} checks are disabled. The enable option may
	be used to enable OCSP checks via Dirmngr. If @acronym{CRL} checks
	are also enabled, CRLs will be used as a fallback if for some reason an
	OCSP request will not succeed. Note, that you have to allow OCSP
	requests in Dirmngr's configuration too (option
	@option{--allow-ocsp}) and configure Dirmngr properly. If you do not do
	so you will get the error code @samp{Not supported}.

	@item --auto-issuer-key-retrieve
	@opindex auto-issuer-key-retrieve
	If a required certificate is missing while validating the chain of
	certificates, try to load that certificate from an external location.
	This usually means that Dirmngr is employed to search for the
	certificate. Note that this option makes a "web bug" like behavior
	possible. LDAP server operators can see which keys you request, so by
	sending you a message signed by a brand new key (which you naturally
	will not have on your local keybox), the operator can tell both your IP
	address and the time when you verified the signature.


	@anchor{gpgsm-option --validation-model}
	@item --validation-model @var{name}
	@opindex validation-model
	This option changes the default validation model. The only possible
	values are "shell" (which is the default), "chain" which forces the
	use of the chain model and "steed" for a new simplified model. The
	chain model is also used if an option in the @file{trustlist.txt} or
	an attribute of the certificate requests it. However the standard
	model (shell) is in that case always tried first.

	@item --ignore-cert-extension @var{oid}
	@opindex ignore-cert-extension
	Add @var{oid} to the list of ignored certificate extensions. The
	@var{oid} is expected to be in dotted decimal form, like
	@code{2.5.29.3}. This option may be used more than once. Critical
	flagged certificate extensions matching one of the OIDs in the list
	are treated as if they are actually handled and thus the certificate
	will not be rejected due to an unknown critical extension. Use this
	option with care because extensions are usually flagged as critical
	for a reason.

	@end table

	@c *******************************************
	@c ********* INPUT AND OUTPUT **********
	@c *******************************************
	@node Input and Output
	@subsection Input and Output

	@table @gnupgtabopt
	@item --armor
	@itemx -a
	@opindex armor
	Create PEM encoded output. Default is binary output.

	@item --base64
	@opindex base64
	Create Base-64 encoded output; i.e. PEM without the header lines.

	@item --assume-armor
	@opindex assume-armor
	Assume the input data is PEM encoded. Default is to autodetect the
	encoding but this is may fail.

	@item --assume-base64
	@opindex assume-base64
	Assume the input data is plain base-64 encoded.

	@item --assume-binary
	@opindex assume-binary
	Assume the input data is binary encoded.

	@anchor{option --p12-charset}
	@item --p12-charset @var{name}
	@opindex p12-charset
	@command{gpgsm} uses the UTF-8 encoding when encoding passphrases for
	PKCS#12 files. This option may be used to force the passphrase to be
	encoded in the specified encoding @var{name}. This is useful if the
	application used to import the key uses a different encoding and thus
	will not be able to import a file generated by @command{gpgsm}. Commonly
	used values for @var{name} are @code{Latin1} and @code{CP850}. Note
	that @command{gpgsm} itself automagically imports any file with a
	passphrase encoded to the most commonly used encodings.


	@item --default-key @var{user_id}
	@opindex default-key
	Use @var{user_id} as the standard key for signing. This key is used if
	no other key has been defined as a signing key. Note, that the first
	@option{--local-users} option also sets this key if it has not yet been
	set; however @option{--default-key} always overrides this.


	@item --local-user @var{user_id}
	@item -u @var{user_id}
	@opindex local-user
	Set the user(s) to be used for signing. The default is the first
	secret key found in the database.


	@item --recipient @var{name}
	@itemx -r
	@opindex recipient
	Encrypt to the user id @var{name}. There are several ways a user id
	may be given (@pxref{how-to-specify-a-user-id}).


	@item --output @var{file}
	@itemx -o @var{file}
	@opindex output
	Write output to @var{file}. The default is to write it to stdout.


	@anchor{gpgsm-option --with-key-data}
	@item --with-key-data
	@opindex with-key-data
	Displays extra information with the @code{--list-keys} commands. Especially
	a line tagged @code{grp} is printed which tells you the keygrip of a
	key. This string is for example used as the file name of the
	secret key.

	@anchor{gpgsm-option --with-validation}
	@item --with-validation
	@opindex with-validation
	When doing a key listing, do a full validation check for each key and
	print the result. This is usually a slow operation because it
	requires a CRL lookup and other operations.

	When used along with @option{--import}, a validation of the certificate to
	import is done and only imported if it succeeds the test. Note that
	this does not affect an already available certificate in the DB.
	This option is therefore useful to simply verify a certificate.


	@item --with-md5-fingerprint
	For standard key listings, also print the MD5 fingerprint of the
	certificate.

	@item --with-keygrip
	Include the keygrip in standard key listings. Note that the keygrip is
	always listed in @option{--with-colons} mode.

	@item --with-secret
	@opindex with-secret
	Include info about the presence of a secret key in public key listings
	done with @code{--with-colons}.

	@end table

	@c *******************************************
	@c *********** CMS OPTIONS *************
	@c *******************************************
	@node CMS Options
	@subsection How to change how the CMS is created

	@table @gnupgtabopt
	@item --include-certs @var{n}
	@opindex include-certs
	Using @var{n} of -2 includes all certificate except for the root cert,
	-1 includes all certs, 0 does not include any certs, 1 includes only the
	signers cert and all other positive values include up to @var{n}
	certificates starting with the signer cert. The default is -2.

	@item --cipher-algo @var{oid}
	@opindex cipher-algo
	Use the cipher algorithm with the ASN.1 object identifier @var{oid} for
	encryption. For convenience the strings @code{3DES}, @code{AES} and
	@code{AES256} may be used instead of their OIDs. The default is
	@code{AES} (2.16.840.1.101.3.4.1.2).

	@item --digest-algo @code{name}
	Use @code{name} as the message digest algorithm. Usually this
	algorithm is deduced from the respective signing certificate. This
	option forces the use of the given algorithm and may lead to severe
	interoperability problems.

	@end table



	@c *******************************************
	@c ****** ESOTERIC OPTIONS *************
	@c *******************************************
	@node Esoteric Options
	@subsection Doing things one usually do not want to do


	@table @gnupgtabopt

	@item --extra-digest-algo @var{name}
	@opindex extra-digest-algo
	Sometimes signatures are broken in that they announce a different digest
	algorithm than actually used. @command{gpgsm} uses a one-pass data
	processing model and thus needs to rely on the announced digest
	algorithms to properly hash the data. As a workaround this option may
	be used to tell @command{gpgsm} to also hash the data using the algorithm
	@var{name}; this slows processing down a little bit but allows verification of
	such broken signatures. If @command{gpgsm} prints an error like
	``digest algo 8 has not been enabled'' you may want to try this option,
	with @samp{SHA256} for @var{name}.


	@item --faked-system-time @var{epoch}
	@opindex faked-system-time
	This option is only useful for testing; it sets the system time back or
	forth to @var{epoch} which is the number of seconds elapsed since the year
	1970. Alternatively @var{epoch} may be given as a full ISO time string
	(e.g. "20070924T154812").

	@item --with-ephemeral-keys
	@opindex with-ephemeral-keys
	Include ephemeral flagged keys in the output of key listings. Note
	that they are included anyway if the key specification for a listing
	is given as fingerprint or keygrip.

	@item --debug-level @var{level}
	@opindex debug-level
	Select the debug level for investigating problems. @var{level} may be
	a numeric value or by a keyword:

	@table @code
	@item none
	No debugging at all. A value of less than 1 may be used instead of
	the keyword.
	@item basic
	Some basic debug messages. A value between 1 and 2 may be used
	instead of the keyword.
	@item advanced
	More verbose debug messages. A value between 3 and 5 may be used
	instead of the keyword.
	@item expert
	Even more detailed messages. A value between 6 and 8 may be used
	instead of the keyword.
	@item guru
	All of the debug messages you can get. A value greater than 8 may be
	used instead of the keyword. The creation of hash tracing files is
	only enabled if the keyword is used.
	@end table

	How these messages are mapped to the actual debugging flags is not
	specified and may change with newer releases of this program. They are
	however carefully selected to best aid in debugging.

	@item --debug @var{flags}
	@opindex debug
	This option is only useful for debugging and the behaviour may change
	at any time without notice; using @code{--debug-levels} is the
	preferred method to select the debug verbosity. FLAGS are bit encoded
	and may be given in usual C-Syntax. The currently defined bits are:

	@table @code
	@item 0 (1)
	X.509 or OpenPGP protocol related data
	@item 1 (2)
	values of big number integers
	@item 2 (4)
	low level crypto operations
	@item 5 (32)
	memory allocation
	@item 6 (64)
	caching
	@item 7 (128)
	show memory statistics
	@item 9 (512)
	write hashed data to files named @code{dbgmd-000*}
	@item 10 (1024)
	trace Assuan protocol
	@end table

	Note, that all flags set using this option may get overridden by
	@code{--debug-level}.

	@item --debug-all
	@opindex debug-all
	Same as @code{--debug=0xffffffff}

	@item --debug-allow-core-dump
	@opindex debug-allow-core-dump
	Usually @command{gpgsm} tries to avoid dumping core by well written code and by
	disabling core dumps for security reasons. However, bugs are pretty
	durable beasts and to squash them it is sometimes useful to have a core
	dump. This option enables core dumps unless the Bad Thing happened
	before the option parsing.

	@item --debug-no-chain-validation
	@opindex debug-no-chain-validation
	This is actually not a debugging option but only useful as such. It
	lets @command{gpgsm} bypass all certificate chain validation checks.

	@item --debug-ignore-expiration
	@opindex debug-ignore-expiration
	This is actually not a debugging option but only useful as such. It
	lets @command{gpgsm} ignore all notAfter dates, this is used by the regression
	tests.

	@item --passphrase-fd @code{n}
	@opindex passphrase-fd
	Read the passphrase from file descriptor @code{n}. Only the first line
	will be read from file descriptor @code{n}. If you use 0 for @code{n},
	the passphrase will be read from STDIN. This can only be used if only
	one passphrase is supplied.

	Note that this passphrase is only used if the option @option{--batch}
	has also been given.

	@item --pinentry-mode @code{mode}
	@opindex pinentry-mode
	Set the pinentry mode to @code{mode}. Allowed values for @code{mode}
	are:
	@table @asis
	@item default
	Use the default of the agent, which is @code{ask}.
	@item ask
	Force the use of the Pinentry.
	@item cancel
	Emulate use of Pinentry's cancel button.
	@item error
	Return a Pinentry error (``No Pinentry'').
	@item loopback
	Redirect Pinentry queries to the caller. Note that in contrast to
	Pinentry the user is not prompted again if he enters a bad password.
	@end table

	@item --no-common-certs-import
	@opindex no-common-certs-import
	Suppress the import of common certificates on keybox creation.

	@end table

	All the long options may also be given in the configuration file after
	stripping off the two leading dashes.

	@c *******************************************
	@c ************* **************
	@c ************* USER ID **************
	@c ************* **************
	@c *******************************************
	@mansect how to specify a user id
	@ifset isman
	@include specify-user-id.texi
	@end ifset

	@c *******************************************
	@c ************* **************
	@c ************* FILES **************
	@c ************* **************
	@c *******************************************
	@mansect files
	@node GPGSM Configuration
	@section Configuration files

	There are a few configuration files to control certain aspects of
	@command{gpgsm}'s operation. Unless noted, they are expected in the
	current home directory (@pxref{option --homedir}).

	@table @file

	@item gpgsm.conf
	@efindex gpgsm.conf
	This is the standard configuration file read by @command{gpgsm} on
	startup. It may contain any valid long option; the leading two dashes
	may not be entered and the option may not be abbreviated. This default
	name may be changed on the command line (@pxref{gpgsm-option --options}).
	You should backup this file.


	@item policies.txt
	@efindex policies.txt
	This is a list of allowed CA policies. This file should list the
	object identifiers of the policies line by line. Empty lines and
	lines starting with a hash mark are ignored. Policies missing in this
	file and not marked as critical in the certificate will print only a
	warning; certificates with policies marked as critical and not listed
	in this file will fail the signature verification. You should backup
	this file.

	For example, to allow only the policy 2.289.9.9, the file should look
	like this:

	@c man:.RS
	@example
	# Allowed policies
	2.289.9.9
	@end example
	@c man:.RE

	@item qualified.txt
	@efindex qualified.txt
	This is the list of root certificates used for qualified certificates.
	They are defined as certificates capable of creating legally binding
	signatures in the same way as handwritten signatures are. Comments
	start with a hash mark and empty lines are ignored. Lines do have a
	length limit but this is not a serious limitation as the format of the
	entries is fixed and checked by @command{gpgsm}: A non-comment line starts with
	optional whitespace, followed by exactly 40 hex characters, white space
	and a lowercased 2 letter country code. Additional data delimited with
	by a white space is current ignored but might late be used for other
	purposes.

	Note that even if a certificate is listed in this file, this does not
	mean that the certificate is trusted; in general the certificates listed
	in this file need to be listed also in @file{trustlist.txt}.

	This is a global file an installed in the data directory
	(e.g. @file{@value{DATADIR}/qualified.txt}). GnuPG installs a suitable
	file with root certificates as used in Germany. As new Root-CA
	certificates may be issued over time, these entries may need to be
	updated; new distributions of this software should come with an updated
	list but it is still the responsibility of the Administrator to check
	that this list is correct.

	Every time @command{gpgsm} uses a certificate for signing or verification
	this file will be consulted to check whether the certificate under
	question has ultimately been issued by one of these CAs. If this is the
	case the user will be informed that the verified signature represents a
	legally binding (``qualified'') signature. When creating a signature
	using such a certificate an extra prompt will be issued to let the user
	confirm that such a legally binding signature shall really be created.

	Because this software has not yet been approved for use with such
	certificates, appropriate notices will be shown to indicate this fact.

	@item help.txt
	@efindex help.txt
	This is plain text file with a few help entries used with
	@command{pinentry} as well as a large list of help items for
	@command{gpg} and @command{gpgsm}. The standard file has English help
	texts; to install localized versions use filenames like @file{help.LL.txt}
	with LL denoting the locale. GnuPG comes with a set of predefined help
	files in the data directory (e.g. @file{@value{DATADIR}/gnupg/help.de.txt})
	and allows overriding of any help item by help files stored in the
	system configuration directory (e.g. @file{@value{SYSCONFDIR}/help.de.txt}).
	For a reference of the help file's syntax, please see the installed
	@file{help.txt} file.


	@item com-certs.pem
	@efindex com-certs.pem
	This file is a collection of common certificates used to populated a
	newly created @file{pubring.kbx}. An administrator may replace this
	file with a custom one. The format is a concatenation of PEM encoded
	X.509 certificates. This global file is installed in the data directory
	(e.g. @file{@value{DATADIR}/com-certs.pem}).

	@end table

	@c man:.RE
	Note that on larger installations, it is useful to put predefined files
	into the directory @file{/etc/skel/.gnupg/} so that newly created users
	start up with a working configuration. For existing users a small
	helper script is provided to create these files (@pxref{addgnupghome}).

	For internal purposes @command{gpgsm} creates and maintains a few other files;
	-they all live in in the current home directory (@pxref{option
	+they all live in the current home directory (@pxref{option
	--homedir}). Only @command{gpgsm} may modify these files.


	@table @file
	@item pubring.kbx
	@efindex pubring.kbx
	This a database file storing the certificates as well as meta
	information. For debugging purposes the tool @command{kbxutil} may be
	used to show the internal structure of this file. You should backup
	this file.

	@item random_seed
	@efindex random_seed
	This content of this file is used to maintain the internal state of the
	random number generator across invocations. The same file is used by
	other programs of this software too.

	@item S.gpg-agent
	@efindex S.gpg-agent
	If this file exists
	@command{gpgsm} will first try to connect to this socket for
	accessing @command{gpg-agent} before starting a new @command{gpg-agent}
	instance. Under Windows this socket (which in reality be a plain file
	describing a regular TCP listening port) is the standard way of
	connecting the @command{gpg-agent}.

	@end table


	@c *******************************************
	@c ************* **************
	@c ************* EXAMPLES **************
	@c ************* **************
	@c *******************************************
	@mansect examples
	@node GPGSM Examples
	@section Examples

	@example
	$ gpgsm -er goo@@bar.net <plaintext >ciphertext
	@end example


	@c *******************************************
	@c ************* ************
	@c ************* UNATTENDED ************
	@c ************* ************
	@c *******************************************
	@manpause
	@node Unattended Usage
	@section Unattended Usage

	@command{gpgsm} is often used as a backend engine by other software. To help
	with this a machine interface has been defined to have an unambiguous
	way to do this. This is most likely used with the @code{--server} command
	but may also be used in the standard operation mode by using the
	@code{--status-fd} option.

	@menu
	* Automated signature checking:: Automated signature checking.
	* CSR and certificate creation:: CSR and certificate creation.
	@end menu

	@node Automated signature checking
	@subsection Automated signature checking

	It is very important to understand the semantics used with signature
	verification. Checking a signature is not as simple as it may sound and
	so the operation is a bit complicated. In most cases it is required
	to look at several status lines. Here is a table of all cases a signed
	message may have:

	@table @asis
	@item The signature is valid
	This does mean that the signature has been successfully verified, the
	certificates are all sane. However there are two subcases with
	important information: One of the certificates may have expired or a
	signature of a message itself as expired. It is a sound practise to
	consider such a signature still as valid but additional information
	should be displayed. Depending on the subcase @command{gpgsm} will issue
	these status codes:
	@table @asis
	@item signature valid and nothing did expire
	@code{GOODSIG}, @code{VALIDSIG}, @code{TRUST_FULLY}
	@item signature valid but at least one certificate has expired
	@code{EXPKEYSIG}, @code{VALIDSIG}, @code{TRUST_FULLY}
	@item signature valid but expired
	@code{EXPSIG}, @code{VALIDSIG}, @code{TRUST_FULLY}
	Note, that this case is currently not implemented.
	@end table

	@item The signature is invalid
	This means that the signature verification failed (this is an indication
	of a transfer error, a program error or tampering with the message).
	@command{gpgsm} issues one of these status codes sequences:
	@table @code
	@item @code{BADSIG}
	@item @code{GOODSIG}, @code{VALIDSIG} @code{TRUST_NEVER}
	@end table

	@item Error verifying a signature
	For some reason the signature could not be verified, i.e. it cannot be
	decided whether the signature is valid or invalid. A common reason for
	this is a missing certificate.

	@end table

	@node CSR and certificate creation
	@subsection CSR and certificate creation

	The command @option{--generate-key} may be used along with the option
	@option{--batch} to either create a certificate signing request (CSR)
	or an X.509 certificate. This is controlled by a parameter file; the
	format of this file is as follows:

	@itemize @bullet
	@item Text only, line length is limited to about 1000 characters.
	@item UTF-8 encoding must be used to specify non-ASCII characters.
	@item Empty lines are ignored.
	@item Leading and trailing while space is ignored.
	@item A hash sign as the first non white space character indicates
	a comment line.
	@item Control statements are indicated by a leading percent sign, the
	arguments are separated by white space from the keyword.
	@item Parameters are specified by a keyword, followed by a colon. Arguments
	are separated by white space.
	@item The first parameter must be @samp{Key-Type}, control statements
	may be placed anywhere.
	@item
	The order of the parameters does not matter except for @samp{Key-Type}
	which must be the first parameter. The parameters are only used for
	the generated CSR/certificate; parameters from previous sets are not
	used. Some syntactically checks may be performed.
	@item
	Key generation takes place when either the end of the parameter file
	is reached, the next @samp{Key-Type} parameter is encountered or at the
	control statement @samp{%commit} is encountered.
	@end itemize

	@noindent
	Control statements:

	@table @asis

	@item %echo @var{text}
	Print @var{text} as diagnostic.

	@item %dry-run
	Suppress actual key generation (useful for syntax checking).

	@item %commit
	Perform the key generation. Note that an implicit commit is done at
	the next @asis{Key-Type} parameter.

	@c %certfile <filename>
	@c [Not yet implemented!]
	@c Do not write the certificate to the keyDB but to <filename>.
	@c This must be given before the first
	@c commit to take place, duplicate specification of the same filename
	@c is ignored, the last filename before a commit is used.
	@c The filename is used until a new filename is used (at commit points)
	@c and all keys are written to that file. If a new filename is given,
	@c this file is created (and overwrites an existing one).
	@c Both control statements must be given.
	@end table

	@noindent
	General Parameters:

	@table @asis

	@item Key-Type: @var{algo}
	Starts a new parameter block by giving the type of the primary
	key. The algorithm must be capable of signing. This is a required
	parameter. The only supported value for @var{algo} is @samp{rsa}.

	@item Key-Length: @var{nbits}
	The requested length of a generated key in bits. Defaults to 2048.

	@item Key-Grip: @var{hexstring}
	This is optional and used to generate a CSR or certificate for an
	already existing key. Key-Length will be ignored when given.

	@item Key-Usage: @var{usage-list}
	Space or comma delimited list of key usage, allowed values are
	@samp{encrypt}, @samp{sign} and @samp{cert}. This is used to generate
	the keyUsage extension. Please make sure that the algorithm is
	capable of this usage. Default is to allow encrypt and sign.

	@item Name-DN: @var{subject-name}
	This is the Distinguished Name (DN) of the subject in RFC-2253 format.

	@item Name-Email: @var{string}
	This is an email address for the altSubjectName. This parameter is
	optional but may occur several times to add several email addresses to
	a certificate.

	@item Name-DNS: @var{string}
	The is an DNS name for the altSubjectName. This parameter is optional
	but may occur several times to add several DNS names to a certificate.

	@item Name-URI: @var{string}
	This is an URI for the altSubjectName. This parameter is optional but
	may occur several times to add several URIs to a certificate.
	@end table

	@noindent
	Additional parameters used to create a certificate (in contrast to a
	certificate signing request):

	@table @asis

	@item Serial: @var{sn}
	If this parameter is given an X.509 certificate will be generated.
	@var{sn} is expected to be a hex string representing an unsigned
	integer of arbitrary length. The special value @samp{random} can be
	used to create a 64 bit random serial number.

	@item Issuer-DN: @var{issuer-name}
	This is the DN name of the issuer in RFC-2253 format. If it is not set
	it will default to the subject DN and a special GnuPG extension will
	be included in the certificate to mark it as a standalone certificate.

	@item Creation-Date: @var{iso-date}
	@itemx Not-Before: @var{iso-date}
	Set the notBefore date of the certificate. Either a date like
	@samp{1986-04-26} or @samp{1986-04-26 12:00} or a standard ISO
	timestamp like @samp{19860426T042640} may be used. The time is
	considered to be UTC. If it is not given the current date is used.

	@item Expire-Date: @var{iso-date}
	@itemx Not-After: @var{iso-date}
	Set the notAfter date of the certificate. Either a date like
	@samp{2063-04-05} or @samp{2063-04-05 17:00} or a standard ISO
	timestamp like @samp{20630405T170000} may be used. The time is
	considered to be UTC. If it is not given a default value in the not
	too far future is used.

	@item Signing-Key: @var{keygrip}
	This gives the keygrip of the key used to sign the certificate. If it
	is not given a self-signed certificate will be created. For
	compatibility with future versions, it is suggested to prefix the
	keygrip with a @samp{&}.

	@item Hash-Algo: @var{hash-algo}
	Use @var{hash-algo} for this CSR or certificate. The supported hash
	algorithms are: @samp{sha1}, @samp{sha256}, @samp{sha384} and
	@samp{sha512}; they may also be specified with uppercase letters. The
	default is @samp{sha256}.

	@end table

	@c *******************************************
	@c ************* ***************
	@c ************* ASSSUAN ***************
	@c ************* ***************
	@c *******************************************
	@node GPGSM Protocol
	@section The Protocol the Server Mode Uses

	Description of the protocol used to access @command{GPGSM}.
	@command{GPGSM} does implement the Assuan protocol and in addition
	provides a regular command line interface which exhibits a full client
	to this protocol (but uses internal linking). To start
	@command{gpgsm} as a server the command line the option
	@code{--server} must be used. Additional options are provided to
	select the communication method (i.e. the name of the socket).

	We assume that the connection has already been established; see the
	Assuan manual for details.

	@menu
	* GPGSM ENCRYPT:: Encrypting a message.
	* GPGSM DECRYPT:: Decrypting a message.
	* GPGSM SIGN:: Signing a message.
	* GPGSM VERIFY:: Verifying a message.
	* GPGSM GENKEY:: Generating a key.
	* GPGSM LISTKEYS:: List available keys.
	* GPGSM EXPORT:: Export certificates.
	* GPGSM IMPORT:: Import certificates.
	* GPGSM DELETE:: Delete certificates.
	* GPGSM GETAUDITLOG:: Retrieve an audit log.
	* GPGSM GETINFO:: Information about the process
	* GPGSM OPTION:: Session options.
	@end menu


	@node GPGSM ENCRYPT
	@subsection Encrypting a Message

	Before encryption can be done the recipient must be set using the
	command:

	@example
	RECIPIENT @var{userID}
	@end example

	Set the recipient for the encryption. @var{userID} should be the
	internal representation of the key; the server may accept any other way
	of specification. If this is a valid and trusted recipient the server
	does respond with OK, otherwise the return is an ERR with the reason why
	the recipient cannot be used, the encryption will then not be done for
	this recipient. If the policy is not to encrypt at all if not all
	recipients are valid, the client has to take care of this. All
	@code{RECIPIENT} commands are cumulative until a @code{RESET} or an
	successful @code{ENCRYPT} command.

	@example
	INPUT FD[=@var{n}] [--armor\|--base64\|--binary]
	@end example

	Set the file descriptor for the message to be encrypted to @var{n}.
	Obviously the pipe must be open at that point, the server establishes
	its own end. If the server returns an error the client should consider
	this session failed. If @var{n} is not given, this commands uses the
	last file descriptor passed to the application.
	@xref{fun-assuan_sendfd, ,the assuan_sendfd function,assuan,the Libassuan
	manual}, on how to do descriptor passing.

	The @code{--armor} option may be used to advice the server that the
	input data is in @acronym{PEM} format, @code{--base64} advices that a
	raw base-64 encoding is used, @code{--binary} advices of raw binary
	input (@acronym{BER}). If none of these options is used, the server
	tries to figure out the used encoding, but this may not always be
	correct.

	@example
	OUTPUT FD[=@var{n}] [--armor\|--base64]
	@end example

	Set the file descriptor to be used for the output (i.e. the encrypted
	message). Obviously the pipe must be open at that point, the server
	establishes its own end. If the server returns an error the client
	should consider this session failed.

	The option @option{--armor} encodes the output in @acronym{PEM} format, the
	@option{--base64} option applies just a base-64 encoding. No option
	creates binary output (@acronym{BER}).

	The actual encryption is done using the command

	@example
	ENCRYPT
	@end example

	It takes the plaintext from the @code{INPUT} command, writes to the
	ciphertext to the file descriptor set with the @code{OUTPUT} command,
	take the recipients from all the recipients set so far. If this command
	fails the clients should try to delete all output currently done or
	otherwise mark it as invalid. @command{GPGSM} does ensure that there
	will not be any
	security problem with leftover data on the output in this case.

	This command should in general not fail, as all necessary checks have
	been done while setting the recipients. The input and output pipes are
	closed.


	@node GPGSM DECRYPT
	@subsection Decrypting a message

	Input and output FDs are set the same way as in encryption, but
	@code{INPUT} refers to the ciphertext and @code{OUTPUT} to the plaintext. There
	is no need to set recipients. @command{GPGSM} automatically strips any
	@acronym{S/MIME} headers from the input, so it is valid to pass an
	entire MIME part to the INPUT pipe.

	The decryption is done by using the command

	@example
	DECRYPT
	@end example

	It performs the decrypt operation after doing some check on the internal
	state (e.g. that all needed data has been set). Because it utilizes
	the GPG-Agent for the session key decryption, there is no need to ask
	the client for a protecting passphrase - GpgAgent takes care of this by
	requesting this from the user.


	@node GPGSM SIGN
	@subsection Signing a Message

	Signing is usually done with these commands:

	@example
	INPUT FD[=@var{n}] [--armor\|--base64\|--binary]
	@end example

	This tells @command{GPGSM} to read the data to sign from file descriptor @var{n}.

	@example
	OUTPUT FD[=@var{m}] [--armor\|--base64]
	@end example

	Write the output to file descriptor @var{m}. If a detached signature is
	requested, only the signature is written.

	@example
	SIGN [--detached]
	@end example

	Sign the data set with the @code{INPUT} command and write it to the sink set by
	@code{OUTPUT}. With @code{--detached}, a detached signature is created
	(surprise).

	The key used for signing is the default one or the one specified in
	the configuration file. To get finer control over the keys, it is
	possible to use the command

	@example
	SIGNER @var{userID}
	@end example

	to set the signer's key. @var{userID} should be the
	internal representation of the key; the server may accept any other way
	of specification. If this is a valid and trusted recipient the server
	does respond with OK, otherwise the return is an ERR with the reason why
	the key cannot be used, the signature will then not be created using
	this key. If the policy is not to sign at all if not all
	keys are valid, the client has to take care of this. All
	@code{SIGNER} commands are cumulative until a @code{RESET} is done.
	Note that a @code{SIGN} does not reset this list of signers which is in
	contrast to the @code{RECIPIENT} command.


	@node GPGSM VERIFY
	@subsection Verifying a Message

	To verify a message the command:

	@example
	VERIFY
	@end example

	is used. It does a verify operation on the message send to the input FD.
	The result is written out using status lines. If an output FD was
	given, the signed text will be written to that. If the signature is a
	detached one, the server will inquire about the signed material and the
	client must provide it.

	@node GPGSM GENKEY
	@subsection Generating a Key

	This is used to generate a new keypair, store the secret part in the
	@acronym{PSE} and the public key in the key database. We will probably
	add optional commands to allow the client to select whether a hardware
	token is used to store the key. Configuration options to
	@command{GPGSM} can be used to restrict the use of this command.

	@example
	GENKEY
	@end example

	@command{GPGSM} checks whether this command is allowed and then does an
	INQUIRY to get the key parameters, the client should then send the
	key parameters in the native format:

	@example
	S: INQUIRE KEY_PARAM native
	C: D foo:fgfgfg
	C: D bar
	C: END
	@end example

	Please note that the server may send Status info lines while reading the
	data lines from the client. After this the key generation takes place
	and the server eventually does send an ERR or OK response. Status lines
	may be issued as a progress indicator.


	@node GPGSM LISTKEYS
	@subsection List available keys
	@anchor{gpgsm-cmd listkeys}

	To list the keys in the internal database or using an external key
	provider, the command:

	@example
	LISTKEYS @var{pattern}
	@end example

	is used. To allow multiple patterns (which are ORed during the search)
	quoting is required: Spaces are to be translated into "+" or into "%20";
	in turn this requires that the usual escape quoting rules are done.

	@example
	LISTSECRETKEYS @var{pattern}
	@end example

	Lists only the keys where a secret key is available.

	The list commands are affected by the option

	@example
	OPTION list-mode=@var{mode}
	@end example

	where mode may be:
	@table @code
	@item 0
	Use default (which is usually the same as 1).
	@item 1
	List only the internal keys.
	@item 2
	List only the external keys.
	@item 3
	List internal and external keys.
	@end table

	Note that options are valid for the entire session.


	@node GPGSM EXPORT
	@subsection Export certificates

	To export certificate from the internal key database the command:

	@example
	EXPORT [--data [--armor] [--base64]] [--] @var{pattern}
	@end example

	is used. To allow multiple patterns (which are ORed) quoting is
	required: Spaces are to be translated into "+" or into "%20"; in turn
	this requires that the usual escape quoting rules are done.

	If the @option{--data} option has not been given, the format of the
	output depends on what was set with the @code{OUTPUT} command. When using
	@acronym{PEM} encoding a few informational lines are prepended.

	If the @option{--data} has been given, a target set via @code{OUTPUT} is
	ignored and the data is returned inline using standard
	@code{D}-lines. This avoids the need for an extra file descriptor. In
	this case the options @option{--armor} and @option{--base64} may be used
	in the same way as with the @code{OUTPUT} command.


	@node GPGSM IMPORT
	@subsection Import certificates

	To import certificates into the internal key database, the command

	@example
	IMPORT [--re-import]
	@end example

	is used. The data is expected on the file descriptor set with the
	@code{INPUT} command. Certain checks are performed on the
	certificate. Note that the code will also handle PKCS#12 files and
	import private keys; a helper program is used for that.

	With the option @option{--re-import} the input data is expected to a be
	a linefeed separated list of fingerprints. The command will re-import
	the corresponding certificates; that is they are made permanent by
	removing their ephemeral flag.


	@node GPGSM DELETE
	@subsection Delete certificates

	To delete a certificate the command

	@example
	DELKEYS @var{pattern}
	@end example

	is used. To allow multiple patterns (which are ORed) quoting is
	required: Spaces are to be translated into "+" or into "%20"; in turn
	this requires that the usual escape quoting rules are done.

	The certificates must be specified unambiguously otherwise an error is
	returned.

	@node GPGSM GETAUDITLOG
	@subsection Retrieve an audit log
	@anchor{gpgsm-cmd getauditlog}

	This command is used to retrieve an audit log.

	@example
	GETAUDITLOG [--data] [--html]
	@end example

	If @option{--data} is used, the audit log is send using D-lines
	instead of being sent to the file descriptor given by an @code{OUTPUT}
	command. If @option{--html} is used, the output is formatted as an
	XHTML block. This is designed to be incorporated into a HTML
	document.


	@node GPGSM GETINFO
	@subsection Return information about the process

	This is a multipurpose function to return a variety of information.

	@example
	GETINFO @var{what}
	@end example

	The value of @var{what} specifies the kind of information returned:
	@table @code
	@item version
	Return the version of the program.
	@item pid
	Return the process id of the process.
	@item agent-check
	Return OK if the agent is running.
	@item cmd_has_option @var{cmd} @var{opt}
	Return OK if the command @var{cmd} implements the option @var{opt}.
	The leading two dashes usually used with @var{opt} shall not be given.
	@item offline
	Return OK if the connection is in offline mode. This may be either
	due to a @code{OPTION offline=1} or due to @command{gpgsm} being
	started with option @option{--disable-dirmngr}.
	@end table

	@node GPGSM OPTION
	@subsection Session options

	The standard Assuan option handler supports these options.

	@example
	OPTION @var{name}[=@var{value}]
	@end example

	These @var{name}s are recognized:

	@table @code

	@item putenv
	Change the session's environment to be passed via gpg-agent to
	Pinentry. @var{value} is a string of the form
	@code{<KEY>[=[<STRING>]]}. If only @code{<KEY>} is given the
	environment variable @code{<KEY>} is removed from the session
	environment, if @code{<KEY>=} is given that environment variable is
	set to the empty string, and if @code{<STRING>} is given it is set to
	that string.

	@item display
	@efindex DISPLAY
	Set the session environment variable @code{DISPLAY} is set to @var{value}.
	@item ttyname
	@efindex GPG_TTY
	Set the session environment variable @code{GPG_TTY} is set to @var{value}.
	@item ttytype
	@efindex TERM
	Set the session environment variable @code{TERM} is set to @var{value}.
	@item lc-ctype
	@efindex LC_CTYPE
	Set the session environment variable @code{LC_CTYPE} is set to @var{value}.
	@item lc-messages
	@efindex LC_MESSAGES
	Set the session environment variable @code{LC_MESSAGES} is set to @var{value}.
	@item xauthority
	@efindex XAUTHORITY
	Set the session environment variable @code{XAUTHORITY} is set to @var{value}.
	@item pinentry-user-data
	@efindex PINENTRY_USER_DATA
	Set the session environment variable @code{PINENTRY_USER_DATA} is set
	to @var{value}.

	@item include-certs
	This option overrides the command line option
	@option{--include-certs}. A @var{value} of -2 includes all
	certificates except for the root certificate, -1 includes all
	certicates, 0 does not include any certicates, 1 includes only the
	signers certicate and all other positive values include up to
	@var{value} certificates starting with the signer cert.

	@item list-mode
	@xref{gpgsm-cmd listkeys}.

	@item list-to-output
	If @var{value} is true the output of the list commands
	(@pxref{gpgsm-cmd listkeys}) is written to the file descriptor set
	with the last @code{OUTPUT} command. If @var{value} is false the output is
	written via data lines; this is the default.

	@item with-validation
	If @var{value} is true for each listed certificate the validation
	status is printed. This may result in the download of a CRL or the
	user being asked about the trustworthiness of a root certificate. The
	default is given by a command line option (@pxref{gpgsm-option
	--with-validation}).


	@item with-secret
	If @var{value} is true certificates with a corresponding private key
	are marked by the list commands.

	@item validation-model
	This option overrides the command line option
	@option{validation-model} for the session.
	(@xref{gpgsm-option --validation-model}.)

	@item with-key-data
	This option globally enables the command line option
	@option{--with-key-data}. (@xref{gpgsm-option --with-key-data}.)

	@item enable-audit-log
	If @var{value} is true data to write an audit log is gathered.
	(@xref{gpgsm-cmd getauditlog}.)

	@item allow-pinentry-notify
	If this option is used notifications about the launch of a Pinentry
	are passed back to the client.

	@item with-ephemeral-keys
	If @var{value} is true ephemeral certificates are included in the
	output of the list commands.

	@item no-encrypt-to
	If this option is used all keys set by the command line option
	@option{--encrypt-to} are ignored.

	@item offline
	If @var{value} is true or @var{value} is not given all network access
	is disabled for this session. This is the same as the command line
	option @option{--disable-dirmngr}.

	@end table

	@mansect see also
	@ifset isman
	@command{gpg2}(1),
	@command{gpg-agent}(1)
	@end ifset
	@include see-also-note.texi
	diff --git a/doc/scdaemon.texi b/doc/scdaemon.texi
	index 161780178..4c6bb93b6 100644
	--- a/doc/scdaemon.texi
	+++ b/doc/scdaemon.texi
	@@ -1,764 +1,764 @@
	@c Copyright (C) 2002 Free Software Foundation, Inc.
	@c This is part of the GnuPG manual.
	@c For copying conditions, see the file gnupg.texi.

	@include defs.inc

	@node Invoking SCDAEMON
	@chapter Invoking the SCDAEMON
	@cindex SCDAEMON command options
	@cindex command options
	@cindex options, SCDAEMON command

	@manpage scdaemon.1
	@ifset manverb
	.B scdaemon
	\- Smartcard daemon for the GnuPG system
	@end ifset

	@mansect synopsis
	@ifset manverb
	.B scdaemon
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.B \-\-server
	.br
	.B scdaemon
	.RB [ \-\-homedir
	.IR dir ]
	.RB [ \-\-options
	.IR file ]
	.RI [ options ]
	.B \-\-daemon
	.RI [ command_line ]
	@end ifset


	@mansect description
	The @command{scdaemon} is a daemon to manage smartcards. It is usually
	invoked by @command{gpg-agent} and in general not used directly.

	@manpause
	@xref{Option Index}, for an index to @command{scdaemon}'s commands and
	options.
	@mancont

	@menu
	* Scdaemon Commands:: List of all commands.
	* Scdaemon Options:: List of all options.
	* Card applications:: Description of card applications.
	* Scdaemon Configuration:: Configuration files.
	* Scdaemon Examples:: Some usage examples.
	* Scdaemon Protocol:: The protocol the daemon uses.
	@end menu

	@mansect commands

	@node Scdaemon Commands
	@section Commands

	Commands are not distinguished from options except for the fact that
	only one command is allowed.

	@table @gnupgtabopt
	@item --version
	@opindex version
	Print the program version and licensing information. Note that you cannot
	abbreviate this command.

	@item --help, -h
	@opindex help
	Print a usage message summarizing the most useful command-line options.
	Note that you cannot abbreviate this command.

	@item --dump-options
	@opindex dump-options
	Print a list of all available options and commands. Note that you cannot
	abbreviate this command.

	@item --server
	@opindex server
	Run in server mode and wait for commands on the @code{stdin}. The
	default mode is to create a socket and listen for commands there.

	@item --multi-server
	@opindex multi-server
	Run in server mode and wait for commands on the @code{stdin} as well as
	on an additional Unix Domain socket. The server command @code{GETINFO}
	may be used to get the name of that extra socket.

	@item --daemon
	@opindex daemon
	Run the program in the background. This option is required to prevent
	it from being accidentally running in the background.

	@end table


	@mansect options

	@node Scdaemon Options
	@section Option Summary

	@table @gnupgtabopt

	@item --options @var{file}
	@opindex options
	Reads configuration from @var{file} instead of from the default
	per-user configuration file. The default configuration file is named
	@file{scdaemon.conf} and expected in the @file{.gnupg} directory directly
	below the home directory of the user.

	@include opt-homedir.texi


	@item -v
	@item --verbose
	@opindex v
	@opindex verbose
	Outputs additional information while running.
	You can increase the verbosity by giving several
	verbose commands to @command{gpgsm}, such as @samp{-vv}.

	@item --debug-level @var{level}
	@opindex debug-level
	Select the debug level for investigating problems. @var{level} may be
	a numeric value or a keyword:

	@table @code
	@item none
	No debugging at all. A value of less than 1 may be used instead of
	the keyword.
	@item basic
	Some basic debug messages. A value between 1 and 2 may be used
	instead of the keyword.
	@item advanced
	More verbose debug messages. A value between 3 and 5 may be used
	instead of the keyword.
	@item expert
	Even more detailed messages. A value between 6 and 8 may be used
	instead of the keyword.
	@item guru
	All of the debug messages you can get. A value greater than 8 may be
	used instead of the keyword. The creation of hash tracing files is
	only enabled if the keyword is used.
	@end table

	How these messages are mapped to the actual debugging flags is not
	specified and may change with newer releases of this program. They are
	however carefully selected to best aid in debugging.

	@quotation Note
	All debugging options are subject to change and thus should not be used
	by any application program. As the name says, they are only used as
	helpers to debug problems.
	@end quotation


	@item --debug @var{flags}
	@opindex debug
	This option is only useful for debugging and the behavior may change at
	any time without notice. FLAGS are bit encoded and may be given in
	usual C-Syntax. The currently defined bits are:

	@table @code
	@item 0 (1)
	command I/O
	@item 1 (2)
	values of big number integers
	@item 2 (4)
	low level crypto operations
	@item 5 (32)
	memory allocation
	@item 6 (64)
	caching
	@item 7 (128)
	show memory statistics
	@item 9 (512)
	write hashed data to files named @code{dbgmd-000*}
	@item 10 (1024)
	trace Assuan protocol.
	See also option @option{--debug-assuan-log-cats}.
	@item 11 (2048)
	trace APDU I/O to the card. This may reveal sensitive data.
	@item 12 (4096)
	trace some card reader related function calls.
	@end table

	@item --debug-all
	@opindex debug-all
	Same as @code{--debug=0xffffffff}

	@item --debug-wait @var{n}
	@opindex debug-wait
	When running in server mode, wait @var{n} seconds before entering the
	actual processing loop and print the pid. This gives time to attach a
	debugger.

	@item --debug-ccid-driver
	@opindex debug-wait
	Enable debug output from the included CCID driver for smartcards.
	Using this option twice will also enable some tracing of the T=1
	protocol. Note that this option may reveal sensitive data.

	@item --debug-disable-ticker
	@opindex debug-disable-ticker
	This option disables all ticker functions like checking for card
	insertions.

	@item --debug-allow-core-dump
	@opindex debug-allow-core-dump
	For security reasons we won't create a core dump when the process
	aborts. For debugging purposes it is sometimes better to allow core
	dump. This option enables it and also changes the working directory to
	@file{/tmp} when running in @option{--server} mode.

	@item --debug-log-tid
	@opindex debug-log-tid
	This option appends a thread ID to the PID in the log output.

	@item --debug-assuan-log-cats @var{cats}
	@opindex debug-assuan-log-cats
	@efindex ASSUAN_DEBUG
	Changes the active Libassuan logging categories to @var{cats}. The
	value for @var{cats} is an unsigned integer given in usual C-Syntax.
	-A value of of 0 switches to a default category. If this option is not
	+A value of 0 switches to a default category. If this option is not
	used the categories are taken from the environment variable
	@code{ASSUAN_DEBUG}. Note that this option has only an effect if the
	Assuan debug flag has also been with the option @option{--debug}. For
	a list of categories see the Libassuan manual.

	@item --no-detach
	@opindex no-detach
	Don't detach the process from the console. This is mainly useful for
	debugging.

	@item --log-file @var{file}
	@opindex log-file
	Append all logging output to @var{file}. This is very helpful in
	seeing what the agent actually does. Use @file{socket://} to log to
	socket.


	@item --pcsc-driver @var{library}
	@opindex pcsc-driver
	Use @var{library} to access the smartcard reader. The current default
	is @file{libpcsclite.so}. Instead of using this option you might also
	want to install a symbolic link to the default file name
	(e.g. from @file{libpcsclite.so.1}).

	@item --ctapi-driver @var{library}
	@opindex ctapi-driver
	Use @var{library} to access the smartcard reader. The current default
	is @file{libtowitoko.so}. Note that the use of this interface is
	deprecated; it may be removed in future releases.

	@item --disable-ccid
	@opindex disable-ccid
	Disable the integrated support for CCID compliant readers. This
	allows falling back to one of the other drivers even if the internal
	CCID driver can handle the reader. Note, that CCID support is only
	available if libusb was available at build time.

	@item --reader-port @var{number_or_string}
	@opindex reader-port
	This option may be used to specify the port of the card terminal. A
	value of 0 refers to the first serial device; add 32768 to access USB
	devices. The default is 32768 (first USB device). PC/SC or CCID
	readers might need a string here; run the program in verbose mode to get
	a list of available readers. The default is then the first reader
	found.

	To get a list of available CCID readers you may use this command:
	@cartouche
	@smallexample
	echo scd getinfo reader_list \
	\| gpg-connect-agent --decode \| awk '/^D/ @{print $2@}'
	@end smallexample
	@end cartouche

	@item --card-timeout @var{n}
	@opindex card-timeout
	If @var{n} is not 0 and no client is actively using the card, the card
	will be powered down after @var{n} seconds. Powering down the card
	avoids a potential risk of damaging a card when used with certain
	cheap readers. This also allows applications that are not aware of
	Scdaemon to access the card. The disadvantage of using a card timeout
	is that accessing the card takes longer and that the user needs to
	enter the PIN again after the next power up.

	Note that with the current version of Scdaemon the card is powered
	down immediately at the next timer tick for any value of @var{n} other
	than 0.

	@item --enable-pinpad-varlen
	@opindex enable-pinpad-varlen
	Please specify this option when the card reader supports variable
	length input for pinpad (default is no). For known readers (listed in
	ccid-driver.c and apdu.c), this option is not needed. Note that if
	your card reader doesn't supports variable length input but you want
	to use it, you need to specify your pinpad request on your card.


	@item --disable-pinpad
	@opindex disable-pinpad
	Even if a card reader features a pinpad, do not try to use it.


	@item --deny-admin
	@opindex deny-admin
	@opindex allow-admin
	This option disables the use of admin class commands for card
	applications where this is supported. Currently we support it for the
	OpenPGP card. This option is useful to inhibit accidental access to
	admin class command which could ultimately lock the card through wrong
	PIN numbers. Note that GnuPG versions older than 2.0.11 featured an
	@option{--allow-admin} option which was required to use such admin
	commands. This option has no more effect today because the default is
	now to allow admin commands.

	@item --disable-application @var{name}
	@opindex disable-application
	This option disables the use of the card application named
	@var{name}. This is mainly useful for debugging or if a application
	with lower priority should be used by default.

	@end table

	All the long options may also be given in the configuration file after
	stripping off the two leading dashes.


	@mansect card applications
	@node Card applications
	@section Description of card applications

	@command{scdaemon} supports the card applications as described below.

	@menu
	* OpenPGP Card:: The OpenPGP card application
	* NKS Card:: The Telesec NetKey card application
	* DINSIG Card:: The DINSIG card application
	* PKCS#15 Card:: The PKCS#15 card application
	* Geldkarte Card:: The Geldkarte application
	* SmartCard-HSM:: The SmartCard-HSM application
	* Undefined Card:: The Undefined stub application
	@end menu

	@node OpenPGP Card
	@subsection The OpenPGP card application ``openpgp''

	This application is currently only used by @command{gpg} but may in
	future also be useful with @command{gpgsm}. Version 1 and version 2 of
	the card is supported.

	@noindent
	The specifications for these cards are available at@*
	@uref{http://g10code.com/docs/openpgp-card-1.0.pdf} and@*
	@uref{http://g10code.com/docs/openpgp-card-2.0.pdf}.

	@node NKS Card
	@subsection The Telesec NetKey card ``nks''

	This is the main application of the Telesec cards as available in
	Germany. It is a superset of the German DINSIG card. The card is
	used by @command{gpgsm}.

	@node DINSIG Card
	@subsection The DINSIG card application ``dinsig''

	This is an application as described in the German draft standard
	@emph{DIN V 66291-1}. It is intended to be used by cards supporting
	the German signature law and its bylaws (SigG and SigV).

	@node PKCS#15 Card
	@subsection The PKCS#15 card application ``p15''

	This is common framework for smart card applications. It is used by
	@command{gpgsm}.

	@node Geldkarte Card
	@subsection The Geldkarte card application ``geldkarte''

	This is a simple application to display information of a German
	Geldkarte. The Geldkarte is a small amount debit card application which
	comes with almost all German banking cards.

	@node SmartCard-HSM
	@subsection The SmartCard-HSM card application ``sc-hsm''

	This application adds read-only support for keys and certificates
	stored on a @uref{http://www.smartcard-hsm.com, SmartCard-HSM}.

	To generate keys and store certifiates you may use
	@uref{https://github.com/OpenSC/OpenSC/wiki/SmartCardHSM, OpenSC} or
	the tools from @uref{http://www.openscdp.org, OpenSCDP}.

	The SmartCard-HSM cards requires a card reader that supports Extended
	Length APDUs.

	@node Undefined Card
	@subsection The Undefined card application ``undefined''

	This is a stub application to allow the use of the APDU command even
	if no supported application is found on the card. This application is
	not used automatically but must be explicitly requested using the
	SERIALNO command.


	@c *******************************************
	@c ************* **************
	@c ************* FILES **************
	@c ************* **************
	@c *******************************************
	@mansect files
	@node Scdaemon Configuration
	@section Configuration files

	There are a few configuration files to control certain aspects of
	@command{scdaemons}'s operation. Unless noted, they are expected in the
	current home directory (@pxref{option --homedir}).

	@table @file

	@item scdaemon.conf
	@cindex scdaemon.conf
	This is the standard configuration file read by @command{scdaemon} on
	startup. It may contain any valid long option; the leading two dashes
	may not be entered and the option may not be abbreviated. This default
	name may be changed on the command line (@pxref{option --options}).

	@item scd-event
	@cindex scd-event
	If this file is present and executable, it will be called on every card
	reader's status change. An example of this script is provided with the
	distribution

	@item reader_@var{n}.status
	This file is created by @command{scdaemon} to let other applications now
	about reader status changes. Its use is now deprecated in favor of
	@file{scd-event}.

	@end table


	@c
	@c Examples
	@c
	@mansect examples
	@node Scdaemon Examples
	@section Examples

	@c man begin EXAMPLES

	@example
	$ scdaemon --server -v
	@end example

	@c man end

	@c
	@c Assuan Protocol
	@c
	@manpause
	@node Scdaemon Protocol
	@section Scdaemon's Assuan Protocol

	The SC-Daemon should be started by the system to provide access to
	external tokens. Using Smartcards on a multi-user system does not
	make much sense except for system services, but in this case no
	regular user accounts are hosted on the machine.

	A client connects to the SC-Daemon by connecting to the socket named
	@file{@value{LOCALRUNDIR}/scdaemon/socket}, configuration information
	is read from @var{@value{SYSCONFDIR}/scdaemon.conf}

	Each connection acts as one session, SC-Daemon takes care of
	synchronizing access to a token between sessions.

	@menu
	* Scdaemon SERIALNO:: Return the serial number.
	* Scdaemon LEARN:: Read all useful information from the card.
	* Scdaemon READCERT:: Return a certificate.
	* Scdaemon READKEY:: Return a public key.
	* Scdaemon PKSIGN:: Signing data with a Smartcard.
	* Scdaemon PKDECRYPT:: Decrypting data with a Smartcard.
	* Scdaemon GETATTR:: Read an attribute's value.
	* Scdaemon SETATTR:: Update an attribute's value.
	* Scdaemon WRITEKEY:: Write a key to a card.
	* Scdaemon GENKEY:: Generate a new key on-card.
	* Scdaemon RANDOM:: Return random bytes generated on-card.
	* Scdaemon PASSWD:: Change PINs.
	* Scdaemon CHECKPIN:: Perform a VERIFY operation.
	* Scdaemon RESTART:: Restart connection
	* Scdaemon APDU:: Send a verbatim APDU to the card
	@end menu

	@node Scdaemon SERIALNO
	@subsection Return the serial number

	This command should be used to check for the presence of a card. It is
	special in that it can be used to reset the card. Most other commands
	will return an error when a card change has been detected and the use of
	this function is therefore required.

	Background: We want to keep the client clear of handling card changes
	between operations; i.e. the client can assume that all operations are
	done on the same card unless he call this function.

	@example
	SERIALNO
	@end example

	Return the serial number of the card using a status response like:

	@example
	S SERIALNO D27600000000000000000000
	@end example

	The serial number is the hex encoded value identified by
	the @code{0x5A} tag in the GDO file (FIX=0x2F02).



	@node Scdaemon LEARN
	@subsection Read all useful information from the card

	@example
	LEARN [--force]
	@end example

	Learn all useful information of the currently inserted card. When
	used without the @option{--force} option, the command might do an INQUIRE
	like this:

	@example
	INQUIRE KNOWNCARDP <hexstring_with_serialNumber>
	@end example

	The client should just send an @code{END} if the processing should go on
	or a @code{CANCEL} to force the function to terminate with a cancel
	error message. The response of this command is a list of status lines
	formatted as this:

	@example
	S KEYPAIRINFO @var{hexstring_with_keygrip} @var{hexstring_with_id}
	@end example

	If there is no certificate yet stored on the card a single "X" is
	returned in @var{hexstring_with_keygrip}.

	@node Scdaemon READCERT
	@subsection Return a certificate

	@example
	READCERT @var{hexified_certid}\|@var{keyid}
	@end example

	This function is used to read a certificate identified by
	@var{hexified_certid} from the card. With OpenPGP cards the keyid
	@code{OpenPGP.3} may be used to read the certificate of version 2 cards.


	@node Scdaemon READKEY
	@subsection Return a public key

	@example
	READKEY @var{hexified_certid}
	@end example

	Return the public key for the given cert or key ID as an standard
	S-Expression.



	@node Scdaemon PKSIGN
	@subsection Signing data with a Smartcard

	To sign some data the caller should use the command

	@example
	SETDATA @var{hexstring}
	@end example

	to tell @command{scdaemon} about the data to be signed. The data must be given in
	hex notation. The actual signing is done using the command

	@example
	PKSIGN @var{keyid}
	@end example

	where @var{keyid} is the hexified ID of the key to be used. The key id
	may have been retrieved using the command @code{LEARN}. If another
	hash algorithm than SHA-1 is used, that algorithm may be given like:

	@example
	PKSIGN --hash=@var{algoname} @var{keyid}
	@end example

	With @var{algoname} are one of @code{sha1}, @code{rmd160} or @code{md5}.


	@node Scdaemon PKDECRYPT
	@subsection Decrypting data with a Smartcard

	To decrypt some data the caller should use the command

	@example
	SETDATA @var{hexstring}
	@end example

	to tell @command{scdaemon} about the data to be decrypted. The data
	must be given in hex notation. The actual decryption is then done
	using the command

	@example
	PKDECRYPT @var{keyid}
	@end example

	where @var{keyid} is the hexified ID of the key to be used.

	If the card is aware of the apdding format a status line with padding
	information is send before the plaintext data. The key for this
	status line is @code{PADDING} with the only defined value being 0 and
	meaning padding has been removed.

	@node Scdaemon GETATTR
	@subsection Read an attribute's value

	TO BE WRITTEN.

	@node Scdaemon SETATTR
	@subsection Update an attribute's value

	TO BE WRITTEN.

	@node Scdaemon WRITEKEY
	@subsection Write a key to a card

	@example
	WRITEKEY [--force] @var{keyid}
	@end example

	This command is used to store a secret key on a smartcard. The
	allowed keyids depend on the currently selected smartcard
	application. The actual keydata is requested using the inquiry
	@code{KEYDATA} and need to be provided without any protection. With
	@option{--force} set an existing key under this @var{keyid} will get
	overwritten. The key data is expected to be the usual canonical encoded
	S-expression.

	A PIN will be requested in most cases. This however depends on the
	actual card application.


	@node Scdaemon GENKEY
	@subsection Generate a new key on-card

	TO BE WRITTEN.

	@node Scdaemon RANDOM
	@subsection Return random bytes generated on-card

	TO BE WRITTEN.


	@node Scdaemon PASSWD
	@subsection Change PINs

	@example
	PASSWD [--reset] [--nullpin] @var{chvno}
	@end example

	Change the PIN or reset the retry counter of the card holder
	verification vector number @var{chvno}. The option @option{--nullpin}
	is used to initialize the PIN of TCOS cards (6 byte NullPIN only).


	@node Scdaemon CHECKPIN
	@subsection Perform a VERIFY operation

	@example
	CHECKPIN @var{idstr}
	@end example

	Perform a VERIFY operation without doing anything else. This may be
	used to initialize a the PIN cache earlier to long lasting
	operations. Its use is highly application dependent:

	@table @strong
	@item OpenPGP

	Perform a simple verify operation for CHV1 and CHV2, so that further
	operations won't ask for CHV2 and it is possible to do a cheap check on
	the PIN: If there is something wrong with the PIN entry system, only the
	regular CHV will get blocked and not the dangerous CHV3. @var{idstr} is
	the usual card's serial number in hex notation; an optional fingerprint
	part will get ignored.

	There is however a special mode if @var{idstr} is suffixed with the
	literal string @code{[CHV3]}: In this case the Admin PIN is checked if
	and only if the retry counter is still at 3.

	@end table



	@node Scdaemon RESTART
	@subsection Perform a RESTART operation

	@example
	RESTART
	@end example

	Restart the current connection; this is a kind of warm reset. It
	deletes the context used by this connection but does not actually
	reset the card.

	This is used by gpg-agent to reuse a primary pipe connection and
	may be used by clients to backup from a conflict in the serial
	command; i.e. to select another application.




	@node Scdaemon APDU
	@subsection Send a verbatim APDU to the card

	@example
	APDU [--atr] [--more] [--exlen[=@var{n}]] [@var{hexstring}]
	@end example


	Send an APDU to the current reader. This command bypasses the high
	level functions and sends the data directly to the card.
	@var{hexstring} is expected to be a proper APDU. If @var{hexstring} is
	not given no commands are send to the card; However the command will
	implicitly check whether the card is ready for use.

	Using the option @code{--atr} returns the ATR of the card as a status
	message before any data like this:
	@example
	S CARD-ATR 3BFA1300FF813180450031C173C00100009000B1
	@end example

	Using the option @code{--more} handles the card status word MORE_DATA
	(61xx) and concatenate all responses to one block.

	Using the option @code{--exlen} the returned APDU may use extended
	length up to N bytes. If N is not given a default value is used
	(currently 4096).



	@mansect see also
	@ifset isman
	@command{gpg-agent}(1),
	@command{gpgsm}(1),
	@command{gpg2}(1)
	@end ifset
	@include see-also-note.texi

	diff --git a/doc/vuln-announce-2007-multiple-message.txt b/doc/vuln-announce-2007-multiple-message.txt
	index 16c08d422..154b27403 100644
	--- a/doc/vuln-announce-2007-multiple-message.txt
	+++ b/doc/vuln-announce-2007-multiple-message.txt
	@@ -1,145 +1,145 @@
	Multiple Messages Problem in GnuPG and GPGME
	==============================================
	2007-03-05 [CVE-2007-1263]


	Summary
	=======

	Gerardo Richarte from Core Security Technologies identified a problem
	when using GnuPG in streaming mode.

	The problem is actually a variant of a well known problem in the way
	signed material is presented in a MUA. It is possible to insert
	additional text before or after a signed (or signed and encrypted)
	OpenPGP message and make the user believe that this additional text is
	also covered by the signature. The Core Security advisory describes
	several variants of the attack; they all boil down to the fact that it
	might not be possible to identify which part of a message is actually
	signed if gpg is not used correctly.

	[ Please do not send private mail in response to this message. The
	mailing list gnupg-devel is the best place to discuss this problem
	(please subscribe first so you don't need moderator approval [1]). ]


	Impact
	======

	All applications using GnuPG without properly using the status
	interface to verify signed or signed and encrypted messages.

	All GPGME versions up to and including 1.1.3.

	Starting with version 1.4.7 and 2.0.3, GnuPG implements an additional
	and sufficient protection against this common usage problem.

	Detached signatures are in no way affected by this problem.


	Description
	===========

	When using gpg (or gpg2) in a pipeline or with redirected input and
	output additional data may be inserted into a message. This allows to
	forge a signed message by prefixing it with arbitrary material. A way
	to create such a message is:

	echo "This is my sneaky plaintext message" > foobar.txt
	gpg -z0 --output prefix.gpg --store foobar.txt
	cat prefix.gpg original-signed-message.gpg > forged.gpg

	Using gpg naively this results in:

	$ gpg <forged.gpg
	This is my sneaky plaintext message
	Either I'm dead or my watch has stopped.
	-- Groucho Marx's last words
	gpg: Signature made Mon Feb 26 09:57:04 2007 CET using DSA key ID 68697734
	gpg: Good signature from "Alfa Test (demo key) <alfa@example.net>"
	[...]

	and thus gives the impression that the sneaky message is part of the
	signed Groucho quote. The correct way to use gpg with redirection is
	by taking care of the status interface:

	$ gpg --status-fd 1 <forged.gpg
	[GNUPG:] PLAINTEXT 62 1172479053 foobar.txt
	[GNUPG:] PLAINTEXT_LENGTH 36
	This is my sneaky plaintext message
	[GNUPG:] PLAINTEXT 62 1172480224 original-signed-message
	[GNUPG:] PLAINTEXT_LENGTH 86
	Either I'm dead or my watch has stopped.
	-- Groucho Marx's last words
	gpg: Signature made Mon Feb 26 09:57:04 2007 CET using DSA key ID 68697734
	[GNUPG:] SIG_ID UncMPBJYgbG/uszJVNKoCAz+hvY 2007-02-26 1172480224
	[GNUPG:] GOODSIG 2D727CC768697734 Alfa Test (demo key) <alfa@example.net>
	gpg: Good signature from "Alfa Test (demo key) <alfa@example.net>"
	[...]

	Here the PLAINTEXT status lines clearly identify the start of a new
	message.

	Note, that using gpg on the command line is in almost all cases not
	-done with redirection but by letting gpg save the the signed message.
	+done with redirection but by letting gpg save the signed message.
	In this case gpg will save the message to different files or in case
	the file names are identical, prompt the over to overwrite the first
	one again.

	Because the problem of identifying the actual signed content when
	mixing the signed data and the signature is very common, the long
	standing suggestion for all digital signatures is to use a detached
	signature. A detached signature allows to clearly identify what is
	signed and what is the signature. This is also the reason why
	PGP/MIME signed messages are in general to be preferred over the old
	style clear signed messages.


	Solution
	========

	Given that there are many applications in use which are subject to the
	described problem, we have decided to change GnuPG so that such forged
	OpenPGP messages are detected and the signature verification will
	fail. GnuPG 1.4.7 has been released today and is available from the
	usual places [2]. If you don't want to update, a minimal patch
	against GnuPG 1.4.6 is available at

	ftp://ftp.gnupg.org/gcrypt/gnupg/patches/gnupg-1.4.6-multiple-message.patch

	Many applications are using the library GPGME which implements an easy
	way to process OpenPGP messages using gpg. We have updated GPGME to
	make it immune against this problem even if an old version of gpg is
	being used. GPGME 1.1.4 is available from the usual places [2]. A
	patch (against version 1.1.3 or 1.1.2) is available at

	ftp://ftp.gnupg.org/gcrypt/gpgme/patches/gpgme-1.1.3-multiple-message.patch

	Please note that - after applying one of these patches - some
	vulnerable applications (mainly MUAs) may fail to handle certain
	messages which are composed of several OpenPGP messages. To continue
	the support of such messages fixing the application is required as
	there is no way for GnuPG to do it.


	Support
	=======

	g10 Code GmbH [3], a Duesseldorf based company owned and headed by
	GnuPG's principal author, is currently funding GnuPG development.
	Support contracts or other financial backing will greatly help us to
	improve the quality of GnuPG.


	Thanks
	======

	Gerardo Richarte found this problem. David Shaw greatly helped to
	analyse and describe the core of the problem.




	[1] See http://lists.gnupg.org/mailman/listinfo/gnupg-devel
	[2] See http://www.gnupg.org/download/
	[3] See http://www.gnupg.org/service.html
	diff --git a/doc/whats-new-in-2.1.txt b/doc/whats-new-in-2.1.txt
	index 19ed8b9fc..4b7349ada 100644
	--- a/doc/whats-new-in-2.1.txt
	+++ b/doc/whats-new-in-2.1.txt
	@@ -1,850 +1,850 @@
	━━━━━━━━━━━━━━━━━━━━━━━━━━━
	GNUPG - WHAT’S NEW IN 2.1


	Werner Koch
	━━━━━━━━━━━━━━━━━━━━━━━━━━━


	2016-07-14


	Table of Contents
	─────────────────

	1 What’s new in GnuPG 2.1
	.. 1.1 Removal of the secret keyring
	.. 1.2 Removal of PGP-2 support
	.. 1.3 Leaner key generation interface
	.. 1.4 Support for ECC
	.. 1.5 Quick generate and sign commands
	.. 1.6 Improved Pinentry support
	.. 1.7 Auto-start of the gpg-agent
	.. 1.8 Duplicate long key id fixes
	.. 1.9 Enhanced Dirmngr
	.. 1.10 Better keyserver pool support
	.. 1.11 Faster keyring format
	.. 1.12 Auto-generated revocation certificates
	.. 1.13 Improved card support
	.. 1.14 New format for key listings
	.. 1.15 Recipient key from file
	.. 1.16 Using gpg as a filter
	.. 1.17 Support for Putty
	.. 1.18 Export of SSH public keys
	.. 1.19 Improved X.509 certificate creation
	.. 1.20 Scripts to create a Windows installer


	A possibly revised version of this article can be found at:
	https://gnupg.org/faq/whats-new-in-2.1.html


	1 What’s new in GnuPG 2.1
	═════════════════════════

	GnuPG version 2.1 comes with a bag of new features which changes some
	things old-timers are used to. This page explains the more important
	ones. It expects that the reader is familiar with GnuPG version 2.0
	and aware that GnuPG consists of /gpg/, /gpgsm/, and /gpg-agent/ as
	its main components.

	• The file /secring.gpg/ is not anymore used to store the secret keys.
	Merging of secret keys is now supported.

	• All support for /PGP-2 keys/ has been removed for security reasons.

	• The standard key generation interface is now much leaner. This will
	help a new user to quickly generate a suitable key.

	• Support for /Elliptic Curve Cryptography/ (ECC) is now available.

	• Commands to create and sign keys from the command line without any
	extra prompts are now available.

	• The Pinentry may now show the new passphrase entry and the
	passphrase confirmation entry in one dialog.

	• There is no more need to manually start the gpg-agent. It is now
	started by any part of GnuPG as needed.

	• Problems with importing keys with the same long key id have been
	addressed.

	• The /dirmngr/ is now part of GnuPG proper and also takes care of
	accessing keyserver.

	• Keyserver pools are now handled in a smarter way.

	• A new format for locally storing the public keys is now used. This
	considerable speeds up operations on large keyrings.

	• /Revocation certificates/ are now created by default.

	• Card support has been updated, new readers and token types are
	supported.

	• The format of the key listing has been changed to better identify
	the properties of a key.

	• A file with the recipient’s key may now be used directly.

	• Gpg can be used to filter out parts of a key.

	• The gpg-agent may now be used on Windows as /pageant/ replacement
	for /putty/ in the same way it is used for years on Unix as
	/ssh-agent/ replacement.

	• Creation of X.509 certificates has been improved. It is now also
	possible to export them directly in PKCS#8 and PEM format for use on
	TLS servers.

	• Export of /ssh/ keys has been integrated.

	• The scripts to create a Windows installer are now part of GnuPG.

	Now for the detailed description of these new features. Note that the
	- examples assume that that /gpg/ is installed as /gpg/. Your
	+ examples assume that /gpg/ is installed as /gpg/. Your
	installation may have it installed under the name /gpg2/.


	1.1 Removal of the secret keyring
	─────────────────────────────────

	gpg used to keep the public key pairs in two files: `pubring.gpg' and
	`secring.gpg'. The only difference is that secring stored in addition
	to the public part also the private part of the key pair. The secret
	keyring thus contained only the keys for which a private key is
	available, that is the user’s key. It required a lot of code to keep
	both versions of the key in sync and led to sometimes surprising
	inconsistencies.

	The design of GnuPG-2 demands that only the gpg-agent has control over
	the private parts of the keys and the actual encryption engine (gpg or
	gpgsm) does not know about the private key but care only about session
	keys and keys for symmetric encryption. This has been implemented
	about 10 years ago for /gpgsm/ (the S/MIME part of GnuPG). However,
	/gpg/ (the OpenPGP part) used the gpg-agent only as passphrase entry
	and cache device but handles the private key itself.

	With GnuPG 2.1 this changed and /gpg/ now also delegates all private
	key operations to the gpg-agent. Thus there is no more code in the
	/gpg/ binary for handling private keys. En passant this allows the
	long time requested “merging of secret keys” and several other
	advanced key management techniques.

	To ease the migration to the no-secring method, /gpg/ detects the
	presence of a `secring.gpg' and converts the keys on-the-fly to the
	the key store of /gpg-agent/ (this is the `private-keys-v1.d'
	directory below the GnuPG home directory (`~/.gnupg')). This is done
	only once and an existing `secring.gpg' is then not anymore touched by
	/gpg/. This allows co-existence of older GnuPG versions with GnuPG
	2.1. However, any change to the private keys using the new /gpg/ will
	not show up when using pre-2.1 versions of GnuPG and vice versa.

	Note that the command `--export-secret-keys' still creates an OpenPGP
	compliant file with the secret keys. This is achieved by asking
	/gpg-agent/ to convert a key and return it in the OpenPGP protected
	format. The export operation requires that the passphrase for the key
	is entered so that /gpg-agent/ is able to change the protection from
	its internal format to the OpenPGP required format.


	1.2 Removal of PGP-2 support
	────────────────────────────

	Some algorithms and parts of the protocols as used by the 20 years old
	[PGP-2] software are meanwhile considered unsafe. In particular the
	baked in use of the [MD5] hash algorithm limits the security of PGP-2
	keys to non-acceptable rate. Technically those PGP-2 keys are called
	version 3 keys (v3) and are easily identified by a shorter fingerprint
	which is commonly presented as 16 separate double hex digits.

	With GnuPG 2.1 all support for those keys has gone. If they are in an
	existing keyring they will eventually be removed. If GnuPG encounters
	such a key on import it will not be imported due to the not anymore
	implemented v3 key format. Removing the v3 key support also reduces
	complexity of the code and is thus better than to keep on handling
	them with a specific error message.

	There is one use case where PGP-2 keys may still be required: For
	existing encrypted data. We suggest to keep a version of GnuPG 1.4
	around which still has support for these keys (it might be required to
	use the `--allow-weak-digest-algos' option). A better solution is to
	re-encrypt the data using a modern key.


	[PGP-2] https://en.wikipedia.org/wiki/Pretty_Good_Privacy

	[MD5] https://en.wikipedia.org/wiki/MD5


	1.3 Leaner key generation interface
	───────────────────────────────────

	This is best shown with an example:

	┌────
	│ $ gpg --gen-key
	│ gpg (GnuPG) 2.1.0; Copyright (C) 2014 Free Software Foundation, Inc.
	│ This is free software: you are free to change and redistribute it.
	│ There is NO WARRANTY, to the extent permitted by law.
	│
	│ gpg: keybox '/home/foo/.gnupg/pubring.kbx' created
	│ Note: Use "gpg --full-gen-key" for a full featured key generation dialog.
	│
	│ GnuPG needs to construct a user ID to identify your key.
	│
	│ Real name: Glenn Greenwald
	│ Email address: glenn@example.org
	│ You selected this USER-ID:
	│ "Glenn Greenwald <glenn@example.org>"
	│
	│ Change (N)ame, (E)mail, or (O)kay/(Q)uit? o
	│ [...]
	│ pub rsa2048/68FD0088 2014-11-03
	│ Key fingerprint = 0290 5ABF 17C7 81FB C390 9B00 636A 1BBD 68FD 0088
	│ uid [ultimate] Glenn Greenwald <glenn@example.org>
	│ sub rsa2048/84439DCD 2014-11-03
	└────

	Thus only the name and the mail address are required. For all other
	parameters the default values are used. Many graphical frontends
	works in the same way. Note that /gpg/ prints a hint for the old time
	gpg users on how to get the full option menu.


	1.4 Support for ECC
	───────────────────

	GnuPG now support Elliptic Curve keys for public key encryption. This
	is defined in [RFC-6637]. Because there is no other mainstream
	OpenPGP implementation yet available which supports ECC, the use of
	such keys is still very limited. Thus GnuPG 2.1 currently hides the
	options to create an ECC key.

	For those who want to experiment with ECC or already want to prepare a
	key for future use, the command `--full-gen-key' along with the option
	`--expert' is the enabler:

	┌────
	│ $ gpg --expert --full-gen-key
	│ gpg (GnuPG) 2.1.0; Copyright (C) 2014 Free Software Foundation, Inc.
	│ This is free software: you are free to change and redistribute it.
	│ There is NO WARRANTY, to the extent permitted by law.
	│
	│ Please select what kind of key you want:
	│ (1) RSA and RSA (default)
	│ (2) DSA and Elgamal
	│ (3) DSA (sign only)
	│ (4) RSA (sign only)
	│ (7) DSA (set your own capabilities)
	│ (8) RSA (set your own capabilities)
	│ (9) ECC and ECC
	│ (10) ECC (sign only)
	│ (11) ECC (set your own capabilities)
	│ Your selection? 9
	│ Please select which elliptic curve you want:
	│ (2) NIST P-256
	│ (3) NIST P-384
	│ (4) NIST P-521
	│ (5) Brainpool P-256
	│ (6) Brainpool P-384
	│ (7) Brainpool P-512
	│ Your selection? 2
	│ Please specify how long the key should be valid.
	│ 0 = key does not expire
	│ <n> = key expires in n days
	│ <n>w = key expires in n weeks
	│ <n>m = key expires in n months
	│ <n>y = key expires in n years
	│ Key is valid for? (0)
	│ Key does not expire at all
	│ Is this correct? (y/N) y
	│
	│ GnuPG needs to construct a user ID to identify your key.
	│
	│ Real name: Edward Snowden
	│ Email address: edward@example.org
	│ Comment:
	│ You selected this USER-ID:
	│ "Edward Snowden <edward@example.org>"
	│
	│ Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
	│ [...]
	│ pub nistp256/382660E3 2014-11-03
	│ Key fingerprint = E630 27CF 3D68 22A7 6FF2 093E D179 9E72 3826 60E3
	│ uid [ultimate] Edward Snowden <edward@example.org>
	│ sub nistp256/48C9A997 2014-11-03 nistp256
	└────

	In this example we created a primary ECC key for signing and an subkey
	for encryption. For both we use the NIST P-256 curve. The key may
	now be used in the same way as any other key. It is possible to add
	an RSA subkey or one can create an RSA or DSA main key and add an ECC
	subkey for signing or encryption. Note that the list of offered
	curves depends on the installed Libgcrypt version.

	For many people the NIST and also the Brainpool curves have an
	doubtful origin and thus the plan for GnuPG is to use Bernstein’s
	[Curve 25519] as default. GnuPG 2.1.0 already comes with support for
	signing keys using the [Ed25519] variant of this curve. This has not
	yet been standardized by the IETF (i.e. there is no RFC) but we won’t
	wait any longer and go ahead using the proposed format for this
	signing algorithm. The format for an encryption key has not yet been
	finalized and will be added to GnuPG in one of the next point
	releases. Recall that an encryption subkey can be added to a key at
	any time. If you want to create a signing key you may do it this way:

	┌────
	│ $ gpg --expert --full-gen-key
	│ gpg (GnuPG) 2.1.0; Copyright (C) 2014 Free Software Foundation, Inc.
	│ This is free software: you are free to change and redistribute it.
	│ There is NO WARRANTY, to the extent permitted by law.
	│
	│ Please select what kind of key you want:
	│ (1) RSA and RSA (default)
	│ (2) DSA and Elgamal
	│ (3) DSA (sign only)
	│ (4) RSA (sign only)
	│ (7) DSA (set your own capabilities)
	│ (8) RSA (set your own capabilities)
	│ (9) ECC and ECC
	│ (10) ECC (sign only)
	│ (11) ECC (set your own capabilities)
	│ Your selection? 10
	│ Please select which elliptic curve you want:
	│ (1) Curve 25519
	│ (2) NIST P-256
	│ (3) NIST P-384
	│ (4) NIST P-521
	│ (5) Brainpool P-256
	│ (6) Brainpool P-384
	│ (7) Brainpool P-512
	│ Your selection? 1
	│ gpg: WARNING: Curve25519 is not yet part of the OpenPGP standard.
	│ Use this curve anyway? (y/N) y
	│ Please specify how long the key should be valid.
	│ 0 = key does not expire
	│ <n> = key expires in n days
	│ <n>w = key expires in n weeks
	│ <n>m = key expires in n months
	│ <n>y = key expires in n years
	│ Key is valid for? (0)
	│ Key does not expire at all
	│ Is this correct? (y/N) y
	│
	│ GnuPG needs to construct a user ID to identify your key.
	│
	│ Real name: Laura Poitras
	│ Email address: laura@example.org
	│ Comment:
	│ You selected this USER-ID:
	│ "Laura Poitras <laura@example.org>"
	│
	│ Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
	│ [...]
	│ pub ed25519/5C1AFC2A 2014-11-03
	│ Key fingerprint = ED85 4D98 5D8F 502F C6C5 FFB2 AA81 319E 5C1A FC2A
	│ uid [ultimate] Laura Poitras <laura@example.org>
	└────

	Support for ECC keys is available only on some keyservers but it is
	expected that this will be fixed over the next few months.


	[RFC-6637] https://rfc-editor.org/info/rfc6637

	[Curve 25519] http://cr.yp.to/ecdh/curve25519-20060209.pdf

	[Ed25519] http://dx.doi.org/10.1007/s13389-012-0027-1


	1.5 Quick generate and sign commands
	────────────────────────────────────

	Sometimes it is useful to use only command line options without any
	parameter file or interactive prompts for generating a key or to sign
	a key. This can now be accomplished with a few new commands:

	┌────
	│ $ gpg --batch --quick-gen-key 'Daniel Ellsberg <ellsberg@example.org>'
	│ gpg: key 911B90A9 marked as ultimately trusted
	└────

	If a key with that user id already exists, gpg bails out with an error
	message. You can force creation using the option `--yes'. If you
	want some more control, you may not use `--batch' and gpg will ask for
	confirmation and show the resulting key:

	┌────
	│ $ gpg --quick-gen-key 'Daniel Ellsberg <ellsberg@example.org>'
	│ About to create a key for:
	│ "Daniel Ellsberg <ellsberg@example.org>"
	│
	│ Continue? (Y/n) y
	│ gpg: A key for "Daniel Ellsberg <ellsberg@example.org>" already exists
	│ Create anyway? (y/N) y
	│ gpg: creating anyway
	│ [...]
	│ pub rsa2048/BD19AC1C 2014-11-04
	│ Key fingerprint = 15CB 723E 2000 A1A8 2505 F3B7 CC00 B501 BD19 AC1C
	│ uid [ultimate] Daniel Ellsberg <ellsberg@example.org>
	│ sub rsa2048/72A4D018 2014-11-04
	└────

	Another common operation is to sign a key. /gpg/ can do this directly
	from the command line by giving the fingerprint of the to-be-signed
	key:

	┌────
	│ $ gpg --quick-sign-key '15CB 723E 2000 A1A8 2505 F3B7 CC00 B501 BD19 AC1C'
	│
	│ pub rsa2048/BD19AC1C
	│ created: 2014-11-04 expires: never usage: SC
	│ trust: ultimate validity: ultimate
	│ Primary key fingerprint: 15CB 723E 2000 A1A8 2505 F3B7 CC00 B501 BD19 AC1C
	│
	│ Daniel Ellsberg <ellsberg@example.org>
	└────

	In case the key has already been signed, the command prints a note and
	exits with success. In case you want to check that it really worked,
	use `--check-sigs' as usual:

	┌────
	│ $ gpg --check-sigs '15CB 723E 2000 A1A8 2505 F3B7 CC00 B501 BD19 AC1C'
	│ gpg: checking the trustdb
	│ gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
	│ gpg: depth: 0 valid: 6 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 6u
	│ pub rsa2048/BD19AC1C 2014-11-04
	│ uid [ full ] Daniel Ellsberg <ellsberg@example.org>
	│ sig!3 BD19AC1C 2014-11-04 Daniel Ellsberg <ellsberg@example.org>
	│ sig! 68FD0088 2014-11-04 Glenn Greenwald <glenn@example.org>
	│ sub rsa2048/72A4D018 2014-11-04
	│ sig! BD19AC1C 2014-11-04 Daniel Ellsberg <ellsberg@example.org>
	└────


	The fingerprint may also be given without the spaces in which case
	there is no need for the quotes. If you want to sign only certain
	user ids of a key, list those user id verbatim after the fingerprint.
	To create a non-exportable key signature, use the command
	`--quick-lsign-key' instead.

	Since version 2.1.4 it possible to directly add another user id to an
	existing key:

	┌────
	│ $ gpg -k 8CFDE12197965A9A
	│ pub ed25519/8CFDE12197965A9A 2014-08-19
	│ uid [ unknown] EdDSA sample key 1
	│ $ gpg --quick-adduid 8CFDE12197965A9A 'Sample 2 <me@example.org>'
	│ $ gpg -k 8CFDE12197965A9A
	│ pub ed25519/8CFDE12197965A9A 2014-08-19
	│ uid [ unknown] Sample 2 <me@example.org>
	│ uid [ unknown] EdDSA sample key 1
	└────

	Since version 2.1.13 another subkey can directly be added to an
	existing key:

	┌────
	│ $ gpg --quick-addkey 15CB723E2000A1A82505F3B7CC00B501BD19AC1C - - 2016-12-31
	│ $ gpg -k 15CB723E2000A1A82505F3B7CC00B501BD19AC1C
	│ pub rsa2048 2014-11-04 [SC]
	│ 15CB723E2000A1A82505F3B7CC00B501BD19AC1C
	│ uid [ unknown] Daniel Ellsberg <ellsberg@example.org>
	│ sub rsa2048 2014-11-04 [E]
	│ sub rsa2048 2016-06-06 [E] [expires: 2016-12-31]
	└────

	Here we created another encryption subkey with an expiration date.
	The key listing also shows the default key listing format introduced
	with 2.1.13. There are a lot of other options to the `--quick-addkey'
	command which are described in the manual.

	Since version 2.1.14 it possible to revoke a user id on an existing
	key:

	┌────
	│ $ gpg -k 8CFDE12197965A9A
	│ pub ed25519/8CFDE12197965A9A 2014-08-19
	│ uid [ unknown] Sample 2 <me@example.org>
	│ uid [ unknown] EdDSA sample key 1
	│ $ gpg --quick-revuid 8CFDE12197965A9A 'EdDSA sample key 1'
	│ $ gpg -k 8CFDE12197965A9A
	│ pub ed25519/8CFDE12197965A9A 2014-08-19
	│ uid [ unknown] Sample 2 <me@example.org>
	└────


	1.6 Improved Pinentry support
	─────────────────────────────

	When using a recent Pinentry module (0.90, GTK+ variant), the
	gpg-agent will not anymore show two separate Pinentry dialogs to enter
	a new passphrase and later to confirm the new passphrase. Instead the
	first dialog also has the confirm/repeat entry and internally checks
	whether they match.

	With any Pinentry version the several separate dialogs to inform and
	ask for confirmation about questionable properties of a new passphrase
	(e.g. length, only alpha letters) have been combined into one dialog
	to show all non-asserted constraints at once.

	The GTK+ Pinentry does now allow pasting of values into the entries.
	Copying them from the entries is still inhibited on purpose.
	Depending on the system, the option `no-grab' may be required for in
	the `gpg-agent.conf' file to actually make use of the paste feature.


	1.7 Auto-start of the gpg-agent
	───────────────────────────────

	The /gpg-agent/ is the central part of the GnuPG system. It takes
	care of all private (secret) keys and if required diverts operations
	to a smartcard or other token. It also provides support for the
	Secure Shell by implementing the ssh-agent protocol.

	The classic way to run /gpg-agent/ on Unix systems is by launching it
	at login time and use an environment variable (`GPG_AGENT_INFO') to
	tell the other GnuPG modules how to connect to the agent. However,
	correctly managing the start up and this environment variable is
	- cumbersome so that that an easier method is required. Since GnuPG
	+ cumbersome so that an easier method is required. Since GnuPG
	2.0.16 the `--use-standard-socket' option already allowed to start the
	agent on the fly; however the environment variable was still required.

	With GnuPG 2.1 the need of `GPG_AGENT_INFO' has been completely
	removed and the variable is ignored. Instead a fixed Unix domain
	socket named `S.gpg-agent' in the GnuPG home directory (by default
	`~/.gnupg') is used. The agent is also started on demand by all tools
	requiring services from the agent.

	If the option `--enable-ssh-support' is used the auto-start mechanism
	does not work because /ssh/ does not know about this mechanism.
	Instead it is required that the environment variable `SSH_AUTH_SOCK'
	is set to the `S.gpg-agent.ssh' socket in the GnuPG home directory.
	Further /gpg-agent/ must be started: Either by using a GnuPG command
	which implicitly starts /gpg-agent/ or by using `gpgconf --launch
	gpg-agent' to explicitly start it if not yet done.


	1.8 Duplicate long key id fixes
	───────────────────────────────

	A deficit of the OpenPGP protocol is that signatures carry only a
	limited indication on which public key has been used to create a
	signature. Thus a verification engine may only use this “long key id”
	- to look up the the key in its own store or from a public keyserver.
	+ to look up the key in its own store or from a public keyserver.
	Unfortunately it has now become possible to create a key with a long
	key id matching the key id of another key. Importing a key with a
	long key id already used by another key in gpg’s local key store was
	not possible due to checks done on import. Now, if the “wrong” key
	has been imported first /gpg/ would not allow later import of the
	second “correct” key. This problem has been fixed in 2.1 by allowing
	the import and by doing trial verification against all matching keys.


	1.9 Enhanced Dirmngr
	────────────────────

	Before version 2.1, /gpg/ used so-called keyserver helpers to access
	the OpenPGP keyservers. A problem with that is that they are short
	living processes which are not able to keep a state. With 2.1, the
	formerly separate package Dirmngr (which was separate due to copyright
	assignment reasons) has been integrated into GnuPG.

	In the past /dirmngr/ was only used by /gpgsm/ for X.509 (S/MIME) CRL
	and OCSP handling. Being a proper part of GnuPG /dirmngr/ does now
	also care about accessing OpenPGP keyservers. This make its easier to
	debug problems with the keyservers and to exchange additional
	information about the keyserver between /gpg/ and /dirmngr/. It will
	eventually also be possible to run background tasks to refresh keys.

	Although the ability to start /dirmngr/ as a system service is still
	available, this is not anymore recommended and instead /dirmngr/ is
	now by default started on-demand, very similar to /gpg-agent/.


	1.10 Better keyserver pool support
	──────────────────────────────────

	For load balancing reasons, keyservers are organized in pools to
	enable instant round-robin DNS assignment of random keyservers. A
	problem with that approach is that the DNS resolver is not aware of
	the state of the keyserver. If a keyserver has gone down or a routing
	problems occurs, /gpg/ and its keyserver helpers were not aware of it
	and would try over and over to use the same, dead, keyserver up until
	the DNS information expires and a the DNS resolver assigned a new
	server from the pool.

	The new /dirmngr/ in GnuPG does not use the implicit round-robin of
	the DNS resolver but uses its own DNS lookup and keeps an internal
	table of all hosts from the pool along with the encountered aliveness
	state. Thus after a failure (timeout) of a request, /dirmngr/ flags a
	host as dead and randomly selects another one from the pool. After a
	few hours the flag is removed so that the host will be tried again.
	It is also possible to mark a specific host from a pool explicitly as
	dead so that it won’t be used in the future. To interact with the
	/dirmngr/ the `gpg-connect-agent' tool is used:

	┌────
	│ $ gpg-connect-agent --dirmngr 'help keyserver' /bye
	│ $ gpg-connect-agent --dirmngr 'keyserver --hosttable' /bye
	└────

	The first command prints a help screen for the keyserver command and
	the second command prints the current host table.


	1.11 Faster keyring format
	──────────────────────────

	The format GnuPG has always used for the public keyring is actually a
	slightly extended version of the on-the-wire format for OpenPGP key
	exchange. This format is quite inflexible to work with when random
	access to keys in the keyring is required. In fact /gpg/ always
	parsed all keys in the keyring until it encountered the desired one.
	With a large keyring (more than a few thousand keys) this could be
	quite slow.

	From its very beginning /gpgsm/ has used a different format to store
	public keys (certificates) which we call a /keybox/. That file format
	carries meta information about the stored keys and thus allows
	searching without actually parsing the key and computing fingerprints
	and such. The /keybox/ format has been designed to be protocol
	independent and with 2.1 support for OpenPGP keys has been added.
	Random access to the keys is now really fast and keyrings with 30000
	keys and more are now easily possible. That change also enables us to
	easily introduce other storage methods

	If no `pubring.gpg' is found, /gpg/ defaults to the new /keybox/
	format and creates a `pubring.kbx' keybox file. If such a keybox file
	already exists, for example due to the use of /gpgsm/, it will also be
	used for OpenPGP keys. However, if a `pubring.gpg' is found and no
	keybox file with OpenPGP keys exists, the old `pubring.gpg' will be
	used. Take care: GnuPG versions before 2.1 will always use the
	`pubring.gpg' file and not know anything about keys stored in the
	keybox file.

	To convert an existing `pubring.gpg' file to the keybox format, you
	first backup the ownertrust values, then rename the file to (for
	example) `publickeys', so it won’t be recognized by any GnuPG version,
	then run import, and finally restore the ownertrust values:

	┌────
	│ $ cd ~/.gnupg
	│ $ gpg --export-ownertrust >otrust.lst
	│ $ mv pubring.gpg publickeys
	│ $ gpg --import-options import-local-sigs --import publickeys
	│ $ gpg --import-ownertrust otrust.lst
	└────

	You may then rename the `publickeys' file back so that it can be used
	by older GnuPG versions. Remember that in this case you have two
	independent copies of the public keys. The ownertrust values are kept
	by all gpg versions in the file `trustdb.gpg' but the above
	precautions need to be taken to keep them over an import.


	1.12 Auto-generated revocation certificates
	───────────────────────────────────────────

	This version creates an ASCII armored revocation certificate for each
	generated keypair and stores that certificate in a file named after
	the fingerprint of the key in the `openpgp-revocs.d' directory below
	the GnuPG home directory. Brief instructions on how to use this
	revocation certificate are put at the top of the file.


	1.13 Improved card support
	──────────────────────────

	The /scdaemon/, which is responsible for accessing smardcards and
	other tokens, has received many updates. In particular pluggable USB
	readers with a fixed card now work smoothless and similar to standard
	readers. The latest features of the [gnuk] token are supported. Code
	for the SmartCard-HSM has been added. More card readers with a PIN
	pad are supported. The internal CCID driver does now also work with
	certain non-auto-configuration equipped readers.


	[gnuk] http://www.fsij.org/doc-gnuk/


	1.14 New format for key listings
	────────────────────────────────

	Due to the introduction of ECC keys the old format to list keys was
	not anymore suitable. In particular, the length of an ECC key is
	defined but its expressiveness is limited without the other parameters
	of the curve. The common way to describe an ECC key is by using the
	assigned name of its curve. To allow for a common description we now
	either use the algorithm name with appended key length or use the name
	of the curve:

	┌────
	│ pub 2048D/1E42B367 2007-12-31 [expires: 2018-12-31]
	│
	│ pub dsa2048 2007-12-31 [SC] [expires: 2018-12-31]
	│ 80615870F5BAD690333686D0F2AD85AC1E42B367
	│
	│ pub ed25519 2014-10-18 [SC]
	│ 0B7F0C1D690BC440D5AFF9B56902F00A0AA914C9
	└────

	The first two "pub"-items show the same key in the old format and in
	the new format. The third "pub"-item shows an example of an ECC key
	using an ed25519 curve. Note that since version 2.1.13 the key id is
	not anymore shown. Instead the full fingerprint is shown in a compact
	format; by using the option `--with-fingerprint' the non-compact
	format is used. The `--keyid-format' option can be used to switch
	back to the discouraged format which prints only the key id.

	As a further change the validity of a key is now shown by default;
	that is `show-uid-validity' is implicitly used for the
	`--list-options'.

	The annotated key listing produced by the `--with-colons' options did
	not change. However a couple of new fields have been added, for
	example if the new option `--with-secret' is used the “S/N of a token
	field” indicates the presence of a secret key even in a public key
	listing. This option is supported by recent [GPGME] versions and
	makes writing of key manager software easier.


	[GPGME] https://gnupg.org/related_software/gpgme/


	1.15 Recipient key from file
	────────────────────────────

	Since version 2.1.14 it is possible to specify the recipient’s key by
	providing a file with that key. This done with the new options
	`--recipient-file' (or short `-f') and `--hidden-recipient-file' (or
	short `-F'). The file must containing exactly one key in binary or
	armored format. All keys specified with those options are always
	considered fully valid. These option may be mixed with the regular
	options to specify a key. Along with the new convenience option
	`--no-keyring' it is now possible to encrypt data without maintaining
	a local keyring.


	1.16 Using gpg as a filter
	──────────────────────────

	Since version 2.1.14 the export and import options have been enhanced
	to allow the use of /gpg/ to modify a key without first stroing it in
	the keyring. For example:

	┌────
	│ $ gpg --import-options import-minimal,import-export \
	│ --output smallkey.gpg --import key.gpg
	└────

	copies the keys in `keys.gpg' to `smallkey.gpg' while also removing
	all key signatures except for the latest self-signatures. This can
	even be further restricted to copy only a specific user ID to the
	output file:

	┌────
	│ $ gpg --import-options import-minimal,import-export \
	│ --import-filter keepuid='mbox = foo@example.org' \
	│ --output smallkey.gpg --import key.gpg
	└────

	Here the new `--import-filter' option is used to remove all user IDs
	except for those which have the mail address “foo@example.org”. The
	same is also possible while exporting a key:

	┌────
	│ $ gpg --export-filter keepuid='mbox = me@example.org' \
	│ --armor --export 8CFDE12197965A9A >smallkey.asc
	└────


	1.17 Support for Putty
	──────────────────────

	On Windows the new option `--enable-putty-support' allows gpg-agent to
	act as a replacement for [Putty]’s authentication agent /Pageant/. It
	is the Windows counterpart for the `--enable-ssh-support' option as
	used on Unix.


	[Putty] http://www.chiark.greenend.org.uk/~sgtatham/putty/


	1.18 Export of SSH public keys
	──────────────────────────────

	The new command `--export-ssh-key' makes it easy to export an /ssh/
	public key in the format used for ssh’s `authorized_keys' file. By
	default the command exports the newest subkey with an authorization
	usage flags. A special syntax can be used to export other subkeys.
	This command is available since 2.1.11 and replaces the former debug
	utility /gpgkey2ssh/.


	1.19 Improved X.509 certificate creation
	────────────────────────────────────────

	In addition to an improved certificate signing request menu, it is now
	possible to create a self-signed certificate using the interactive
	menu of /gpgsm/.

	In batch mode the certificate creation dialog can now be controlled by
	a parameter file with several new keywords. Such a parameter file
	allows the creation of arbitrary X.509 certificates similar to what
	can be done with /openssl/. It may thus be used as the base for a CA
	software. For details see the “CSR and certificate creation” section
	in the manual.

	The new commands `--export-secret-key-p8' and –export-secret-key-raw=
	may be used to export a secret key directly in PKCS#8 or PKCS#1
	format. Thus X.509 certificates for TLS use may be managed by /gpgsm/
	and directly exported in a format suitable for OpenSSL based servers.


	1.20 Scripts to create a Windows installer
	──────────────────────────────────────────

	GnuPG now comes with the /speedo/ build system which may be used to
	quickly download and build GnuPG and all its direct dependencies on a
	decent Unix system. See the README file for more instructions.

	The very same script may also be used to build a complete NSIS based
	installer for Windows using the mingw-w64 cross-compiler toolchain.
	That installer will feature GnuPG proper, GPA as graphical frontend,
	and GpgEX as a Windows Explorer extension. GnuPG needs to be unpacked
	and from the top source directory you run this command

	┌────
	│ make -f build-aux/speedo.mk w32-installer
	└────

	This command downloads all direct dependencies, checks the signatures
	using the GnuPG version from the build system (all Linux distros
	feature a suitable GnuPG tool), builds everything from source, and
	uses NSIS to create the installer. Although this sounds easy, some
	experience in setting up a development machine is still required.
	Some versions of the toolchain exhibit bugs and thus your mileage may
	vary. See the [Wiki] for more info.

	Support for keyserver access over TLS is currently not available but
	will be added with one of the next point releases.



	# Copyright 2014--2016 The GnuPG Project.
	# This work is licensed under the Creative Commons
	# Attribution-ShareAlike 4.0 International License. To view a copy of
	# this license, visit http://creativecommons.org/licenses/by-sa/4.0/
	# or send a letter to Creative Commons, PO Box 1866, Mountain View, CA
	# 94042, USA.
	#
	# The canonical source for this article can be found in the gnupg-doc
	# git repository as web/faq/whats-new-in-2.1.org.


	[Wiki] https://wiki.gnupg.org/Build2.1_Windows
	diff --git a/g10/armor.c b/g10/armor.c
	index 58d8e01b1..6b7c3f7ab 100644
	--- a/g10/armor.c
	+++ b/g10/armor.c
	@@ -1,1571 +1,1571 @@
	/* armor.c - Armor flter
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "status.h"
	#include "iobuf.h"
	#include "util.h"
	#include "filter.h"
	#include "packet.h"
	#include "options.h"
	#include "main.h"
	#include "status.h"
	#include "i18n.h"

	#define MAX_LINELEN 20000

	#define CRCINIT 0xB704CE
	#define CRCPOLY 0X864CFB
	#define CRCUPDATE(a,c) do { \
	a = ((a) << 8) ^ crc_table[((a)&0xff >> 16) ^ (c)]; \
	a &= 0x00ffffff; \
	} while(0)
	static u32 crc_table[256];
	static byte bintoasc[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"
	"0123456789+/";
	static byte asctobin[256]; /* runtime initialized */
	static int is_initialized;


	typedef enum {
	fhdrHASArmor = 0,
	fhdrNOArmor,
	fhdrINIT,
	fhdrINITCont,
	fhdrINITSkip,
	fhdrCHECKBegin,
	fhdrWAITHeader,
	fhdrWAITClearsig,
	fhdrSKIPHeader,
	fhdrCLEARSIG,
	fhdrREADClearsig,
	fhdrNullClearsig,
	fhdrEMPTYClearsig,
	fhdrCHECKClearsig,
	fhdrCHECKClearsig2,
	fhdrCHECKDashEscaped,
	fhdrCHECKDashEscaped2,
	fhdrCHECKDashEscaped3,
	fhdrREADClearsigNext,
	fhdrENDClearsig,
	fhdrENDClearsigHelp,
	fhdrTESTSpaces,
	fhdrCLEARSIGSimple,
	fhdrCLEARSIGSimpleNext,
	fhdrTEXT,
	fhdrTEXTSimple,
	fhdrERROR,
	fhdrERRORShow,
	fhdrEOF
	} fhdr_state_t;


	/* if we encounter this armor string with this index, go
	* into a mode which fakes packets and wait for the next armor */
	#define BEGIN_SIGNATURE 2
	#define BEGIN_SIGNED_MSG_IDX 3
	static char *head_strings[] = {
	"BEGIN PGP MESSAGE",
	"BEGIN PGP PUBLIC KEY BLOCK",
	"BEGIN PGP SIGNATURE",
	"BEGIN PGP SIGNED MESSAGE",
	"BEGIN PGP ARMORED FILE", /* gnupg extension */
	"BEGIN PGP PRIVATE KEY BLOCK",
	"BEGIN PGP SECRET KEY BLOCK", /* only used by pgp2 */
	NULL
	};
	static char *tail_strings[] = {
	"END PGP MESSAGE",
	"END PGP PUBLIC KEY BLOCK",
	"END PGP SIGNATURE",
	"END dummy",
	"END PGP ARMORED FILE",
	"END PGP PRIVATE KEY BLOCK",
	"END PGP SECRET KEY BLOCK",
	NULL
	};


	static int armor_filter ( void *opaque, int control,
	iobuf_t chain, byte buf, size_t ret_len);




	/* Create a new context for armor filters. */
	armor_filter_context_t *
	new_armor_context (void)
	{
	armor_filter_context_t *afx;

	afx = xcalloc (1, sizeof *afx);
	afx->refcount = 1;

	return afx;
	}

	/* Release an armor filter context. Passing NULL is explicitly
	allowed and a no-op. */
	void
	release_armor_context (armor_filter_context_t *afx)
	{
	if (!afx)
	return;
	log_assert (afx->refcount);
	if ( --afx->refcount )
	return;
	xfree (afx);
	}

	/* Push the armor filter onto the iobuf stream IOBUF. */
	int
	push_armor_filter (armor_filter_context_t *afx, iobuf_t iobuf)
	{
	int rc;

	afx->refcount++;
	rc = iobuf_push_filter (iobuf, armor_filter, afx);
	if (rc)
	afx->refcount--;
	return rc;
	}





	static void
	initialize(void)
	{
	int i, j;
	u32 t;
	byte *s;

	/* init the crc lookup table */
	crc_table[0] = 0;
	for(i=j=0; j < 128; j++ ) {
	t = crc_table[j];
	if( t & 0x00800000 ) {
	t <<= 1;
	crc_table[i++] = t ^ CRCPOLY;
	crc_table[i++] = t;
	}
	else {
	t <<= 1;
	crc_table[i++] = t;
	crc_table[i++] = t ^ CRCPOLY;
	}
	}
	/* build the helptable for radix64 to bin conversion */
	for(i=0; i < 256; i++ )
	asctobin[i] = 255; /* used to detect invalid characters */
	for(s=bintoasc,i=0; *s; s++,i++ )
	asctobin[*s] = i;

	is_initialized=1;
	}


	/*
	* Check whether this is an armored file. See also
	* parse-packet.c for details on this code.
	*
	* Note that the buffer BUF needs to be at least 2 bytes long. If in
	* doubt that the second byte to 0.
	*
	* Returns: True if it seems to be armored
	*/
	static int
	is_armored (const byte *buf)
	{
	int ctb, pkttype;
	int indeterminate_length_allowed;

	ctb = *buf;
	if( !(ctb & 0x80) )
	/* The most significant bit of the CTB must be set. Since it is
	cleared, this is not a binary OpenPGP message. Assume it is
	armored. */
	return 1;

	pkttype = ctb & 0x40 ? (ctb & 0x3f) : ((ctb>>2)&0xf);
	switch( pkttype ) {
	case PKT_PUBKEY_ENC:
	case PKT_SIGNATURE:
	case PKT_SYMKEY_ENC:
	case PKT_ONEPASS_SIG:
	case PKT_SECRET_KEY:
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_MARKER:
	case PKT_RING_TRUST:
	case PKT_USER_ID:
	case PKT_PUBLIC_SUBKEY:
	case PKT_ATTRIBUTE:
	case PKT_MDC:
	indeterminate_length_allowed = 0;
	break;

	case PKT_COMPRESSED:
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_PLAINTEXT:
	case PKT_OLD_COMMENT:
	case PKT_COMMENT:
	case PKT_GPG_CONTROL:
	indeterminate_length_allowed = 1;
	break;

	default:
	/* Invalid packet type. */
	return 1;
	}

	if (! indeterminate_length_allowed)
	/* It is only legal to use an indeterminate length with a few
	packet types. If a packet uses an indeterminate length, but
	that is not allowed, then the data is not valid binary
	OpenPGP data. */
	{
	int new_format;
	int indeterminate_length;

	new_format = !! (ctb & (1 << 6));
	if (new_format)
	indeterminate_length = (buf[1] >= 224 && buf[1] < 255);
	else
	indeterminate_length = (ctb & 3) == 3;

	if (indeterminate_length)
	return 1;
	}

	/* The first CTB seems legit. It is probably not armored
	data. */
	return 0;
	}


	/****************
	* Try to check whether the iobuf is armored
	* Returns true if this may be the case; the caller should use the
	* filter to do further processing.
	*/
	int
	use_armor_filter( IOBUF a )
	{
	byte buf[2];
	int n;

	/* fixme: there might be a problem with iobuf_peek */
	n = iobuf_peek (a, buf, 2);
	if( n == -1 )
	return 0; /* EOF, doesn't matter whether armored or not */
	if( !n )
	return 1; /* can't check it: try armored */
	if (n != 2)
	return 0; /* short buffer */
	return is_armored(buf);
	}




	static void
	invalid_armor(void)
	{
	write_status(STATUS_BADARMOR);
	g10_exit(1); /* stop here */
	}


	/****************
	* check whether the armor header is valid on a signed message.
	* this is for security reasons: the header lines are not included in the
	* hash and by using some creative formatting rules, Mallory could fake
	* any text at the beginning of a document; assuming it is read with
	* a simple viewer. We only allow the Hash Header.
	*/
	static int
	parse_hash_header( const char *line )
	{
	const char s, s2;
	unsigned found = 0;

	if( strlen(line) < 6 \|\| strlen(line) > 60 )
	return 0; /* too short or too long */
	if( memcmp( line, "Hash:", 5 ) )
	return 0; /* invalid header */

	for(s=line+5;;s=s2) {
	for(; s && (s==' ' \|\| *s == '\t'); s++ )
	;
	if( !*s )
	break;
	for(s2=s+1; s2 && s2!=' ' && s2 != '\t' && s2 != ','; s2++ )
	;
	if( !strncmp( s, "RIPEMD160", s2-s ) )
	found \|= 1;
	else if( !strncmp( s, "SHA1", s2-s ) )
	found \|= 2;
	else if( !strncmp( s, "SHA224", s2-s ) )
	found \|= 8;
	else if( !strncmp( s, "SHA256", s2-s ) )
	found \|= 16;
	else if( !strncmp( s, "SHA384", s2-s ) )
	found \|= 32;
	else if( !strncmp( s, "SHA512", s2-s ) )
	found \|= 64;
	else
	return 0;
	for(; s2 && (s2==' ' \|\| *s2 == '\t'); s2++ )
	;
	if( s2 && s2 != ',' )
	return 0;
	if( *s2 )
	s2++;
	}
	return found;
	}

	/* Returns true if this is a valid armor tag as per RFC-2440bis-21. */
	static int
	is_armor_tag(const char *line)
	{
	if(strncmp(line,"Version",7)==0
	\|\| strncmp(line,"Comment",7)==0
	\|\| strncmp(line,"MessageID",9)==0
	\|\| strncmp(line,"Hash",4)==0
	\|\| strncmp(line,"Charset",7)==0)
	return 1;

	return 0;
	}

	/****************
	* Check whether this is a armor line.
	* returns: -1 if it is not a armor header or the index number of the
	* armor header.
	*/
	static int
	is_armor_header( byte *line, unsigned len )
	{
	const char *s;
	byte save_p, p;
	int save_c;
	int i;

	if( len < 15 )
	return -1; /* too short */
	if( memcmp( line, "-----", 5 ) )
	return -1; /* no */
	p = strstr( line+5, "-----");
	if( !p )
	return -1;
	save_p = p;
	p += 5;

	/* Some Windows environments seem to add whitespace to the end of
	the line, so we strip it here. This becomes strict if
	--rfc2440 is set since 2440 reads "The header lines, therefore,
	MUST start at the beginning of a line, and MUST NOT have text
	following them on the same line." It is unclear whether "text"
	refers to all text or just non-whitespace text. 4880 clarified
	this was only non-whitespace text. */

	if(RFC2440)
	{
	if( *p == '\r' )
	p++;
	if( *p == '\n' )
	p++;
	}
	else
	while(p==' ' \|\| p=='\r' \|\| p=='\n' \|\| p=='\t')
	p++;

	if( *p )
	return -1; /* garbage after dashes */
	save_c = save_p; save_p = 0;
	p = line+5;
	for(i=0; (s=head_strings[i]); i++ )
	if( !strcmp(s, p) )
	break;
	*save_p = save_c;
	if( !s )
	return -1; /* unknown armor line */

	if( opt.verbose > 1 )
	log_info(_("armor: %s\n"), head_strings[i]);
	return i;
	}



	/****************
	* Parse a header lines
	* Return 0: Empty line (end of header lines)
	* -1: invalid header line
	* >0: Good header line
	*/
	static int
	parse_header_line( armor_filter_context_t afx, byte line, unsigned int len )
	{
	byte *p;
	int hashes=0;
	unsigned int len2;

	len2 = length_sans_trailing_ws ( line, len );
	if( !len2 ) {
	afx->buffer_pos = len2; /* (it is not the fine way to do it here) */
	return 0; /* WS only: same as empty line */
	}

	/*
	This is fussy. The spec says that a header line is delimited
	with a colon-space pair. This means that a line such as
	"Comment: " (with nothing else) is actually legal as an empty
	string comment. However, email and cut-and-paste being what it
	is, that trailing space may go away. Therefore, we accept empty
	headers delimited with only a colon. --rfc2440, as always,
	makes this strict and enforces the colon-space pair. -dms
	*/

	p = strchr( line, ':');
	if( !p \|\| (RFC2440 && p[1]!=' ')
	\|\| (!RFC2440 && p[1]!=' ' && p[1]!='\n' && p[1]!='\r'))
	{
	log_error (_("invalid armor header: "));
	es_write_sanitized (log_get_stream (), line, len, NULL, NULL);
	log_printf ("\n");
	return -1;
	}

	/* Chop off the whitespace we detected before */
	len=len2;
	line[len2]='\0';

	if( opt.verbose ) {
	log_info(_("armor header: "));
	es_write_sanitized (log_get_stream (), line, len, NULL, NULL);
	log_printf ("\n");
	}

	if( afx->in_cleartext )
	{
	if( (hashes=parse_hash_header( line )) )
	afx->hashes \|= hashes;
	else if( strlen(line) > 15 && !memcmp( line, "NotDashEscaped:", 15 ) )
	afx->not_dash_escaped = 1;
	else
	{
	log_error(_("invalid clearsig header\n"));
	return -1;
	}
	}
	else if(!is_armor_tag(line))
	{
	/* Section 6.2: "Unknown keys should be reported to the user,
	but OpenPGP should continue to process the message." Note
	that in a clearsigned message this applies to the signature
	part (i.e. "BEGIN PGP SIGNATURE") and not the signed data
	("BEGIN PGP SIGNED MESSAGE"). The only key allowed in the
	signed data section is "Hash". */

	log_info(_("unknown armor header: "));
	es_write_sanitized (log_get_stream (), line, len, NULL, NULL);
	log_printf ("\n");
	}

	return 1;
	}



	/* figure out whether the data is armored or not */
	static int
	check_input( armor_filter_context_t *afx, IOBUF a )
	{
	int rc = 0;
	int i;
	byte *line;
	unsigned len;
	unsigned maxlen;
	int hdr_line = -1;

	/* read the first line to see whether this is armored data */
	maxlen = MAX_LINELEN;
	len = afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	line = afx->buffer;
	if( !maxlen ) {
	/* line has been truncated: assume not armored */
	afx->inp_checked = 1;
	afx->inp_bypass = 1;
	return 0;
	}

	if( !len ) {
	return -1; /* eof */
	}

	/* (the line is always a C string but maybe longer) */
	if( line == '\n' \|\| ( len && (line == '\r' && line[1]=='\n') ) )
	;
	else if (len >= 2 && !is_armored (line)) {
	afx->inp_checked = 1;
	afx->inp_bypass = 1;
	return 0;
	}

	/* find the armor header */
	while(len) {
	i = is_armor_header( line, len );
	if( i >= 0 && !(afx->only_keyblocks && i != 1 && i != 5 && i != 6 )) {
	hdr_line = i;
	if( hdr_line == BEGIN_SIGNED_MSG_IDX ) {
	if( afx->in_cleartext ) {
	log_error(_("nested clear text signatures\n"));
	rc = gpg_error (GPG_ERR_INV_ARMOR);
	}
	afx->in_cleartext = 1;
	}
	break;
	}
	/* read the next line (skip all truncated lines) */
	do {
	maxlen = MAX_LINELEN;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	line = afx->buffer;
	len = afx->buffer_len;
	} while( !maxlen );
	}

	/* Parse the header lines. */
	while(len) {
	/* Read the next line (skip all truncated lines). */
	do {
	maxlen = MAX_LINELEN;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	line = afx->buffer;
	len = afx->buffer_len;
	} while( !maxlen );

	i = parse_header_line( afx, line, len );
	if( i <= 0 ) {
	if (i && RFC2440)
	rc = GPG_ERR_INV_ARMOR;
	break;
	}
	}


	if( rc )
	invalid_armor();
	else if( afx->in_cleartext )
	afx->faked = 1;
	else {
	afx->inp_checked = 1;
	afx->crc = CRCINIT;
	afx->idx = 0;
	afx->radbuf[0] = 0;
	}

	return rc;
	}

	#define PARTIAL_CHUNK 512
	#define PARTIAL_POW 9

	/****************
	* Fake a literal data packet and wait for the next armor line
	* fixme: empty line handling and null length clear text signature are
	* not implemented/checked.
	*/
	static int
	fake_packet( armor_filter_context_t *afx, IOBUF a,
	size_t retn, byte buf, size_t size )
	{
	int rc = 0;
	size_t len = 0;
	int lastline = 0;
	unsigned maxlen, n;
	byte *p;
	byte tempbuf[PARTIAL_CHUNK];
	size_t tempbuf_len=0;

	while( !rc && size-len>=(PARTIAL_CHUNK+1)) {
	/* copy what we have in the line buffer */
	if( afx->faked == 1 )
	afx->faked++; /* skip the first (empty) line */
	else
	{
	/* It's full, so write this partial chunk */
	if(tempbuf_len==PARTIAL_CHUNK)
	{
	buf[len++]=0xE0+PARTIAL_POW;
	memcpy(&buf[len],tempbuf,PARTIAL_CHUNK);
	len+=PARTIAL_CHUNK;
	tempbuf_len=0;
	continue;
	}

	while( tempbuf_len < PARTIAL_CHUNK
	&& afx->buffer_pos < afx->buffer_len )
	tempbuf[tempbuf_len++] = afx->buffer[afx->buffer_pos++];
	if( tempbuf_len==PARTIAL_CHUNK )
	continue;
	}

	/* read the next line */
	maxlen = MAX_LINELEN;
	afx->buffer_pos = 0;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	if( !afx->buffer_len ) {
	rc = -1; /* eof (should not happen) */
	continue;
	}
	if( !maxlen )
	afx->truncated++;

	p = afx->buffer;
	n = afx->buffer_len;

	/* Armor header or dash-escaped line? */
	if(p[0]=='-')
	{
	/* 2440bis-10: When reversing dash-escaping, an
	implementation MUST strip the string "- " if it occurs
	at the beginning of a line, and SHOULD warn on "-" and
	any character other than a space at the beginning of a
	line. */

	if(p[1]==' ' && !afx->not_dash_escaped)
	{
	/* It's a dash-escaped line, so skip over the
	escape. */
	afx->buffer_pos = 2;
	}
	else if(p[1]=='-' && p[2]=='-' && p[3]=='-' && p[4]=='-')
	{
	/* Five dashes in a row mean it's probably armor
	header. */
	int type = is_armor_header( p, n );
	if( afx->not_dash_escaped && type != BEGIN_SIGNATURE )
	; /* this is okay */
	else
	{
	if( type != BEGIN_SIGNATURE )
	{
	log_info(_("unexpected armor: "));
	es_write_sanitized (log_get_stream (), p, n,
	NULL, NULL);
	log_printf ("\n");
	}

	lastline = 1;
	rc = -1;
	}
	}
	else if(!afx->not_dash_escaped)
	{
	/* Bad dash-escaping. */
	log_info (_("invalid dash escaped line: "));
	es_write_sanitized (log_get_stream (), p, n, NULL, NULL);
	log_printf ("\n");
	}
	}

	/* Now handle the end-of-line canonicalization */
	if( !afx->not_dash_escaped )
	{
	int crlf = n > 1 && p[n-2] == '\r' && p[n-1]=='\n';

	afx->buffer_len=
	trim_trailing_chars( &p[afx->buffer_pos], n-afx->buffer_pos,
	" \t\r\n");
	afx->buffer_len+=afx->buffer_pos;
	/* the buffer is always allocated with enough space to append
	* the removed [CR], LF and a Nul
	* The reason for this complicated procedure is to keep at least
	* the original type of lineending - handling of the removed
	* trailing spaces seems to be impossible in our method
	* of faking a packet; either we have to use a temporary file
	* or calculate the hash here in this module and somehow find
	* a way to send the hash down the processing line (well, a special
	* faked packet could do the job).
	*/
	if( crlf )
	afx->buffer[afx->buffer_len++] = '\r';
	afx->buffer[afx->buffer_len++] = '\n';
	afx->buffer[afx->buffer_len] = '\0';
	}
	}

	if( lastline ) { /* write last (ending) length header */
	if(tempbuf_len<192)
	buf[len++]=tempbuf_len;
	else
	{
	buf[len++]=((tempbuf_len-192)/256) + 192;
	buf[len++]=(tempbuf_len-192) % 256;
	}
	memcpy(&buf[len],tempbuf,tempbuf_len);
	len+=tempbuf_len;

	rc = 0;
	afx->faked = 0;
	afx->in_cleartext = 0;
	/* and now read the header lines */
	afx->buffer_pos = 0;
	for(;;) {
	int i;

	/* read the next line (skip all truncated lines) */
	do {
	maxlen = MAX_LINELEN;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	} while( !maxlen );
	p = afx->buffer;
	n = afx->buffer_len;
	if( !n ) {
	rc = -1;
	break; /* eof */
	}
	i = parse_header_line( afx, p , n );
	if( i <= 0 ) {
	if( i )
	invalid_armor();
	break;
	}
	}
	afx->inp_checked = 1;
	afx->crc = CRCINIT;
	afx->idx = 0;
	afx->radbuf[0] = 0;
	}

	*retn = len;
	return rc;
	}


	static int
	invalid_crc(void)
	{
	if ( opt.ignore_crc_error )
	return 0;
	log_inc_errorcount();
	return gpg_error (GPG_ERR_INV_ARMOR);
	}


	static int
	radix64_read( armor_filter_context_t afx, IOBUF a, size_t retn,
	byte *buf, size_t size )
	{
	byte val;
	int c=0, c2; /init c because gcc is not clever enough for the continue/
	int checkcrc=0;
	int rc = 0;
	size_t n = 0;
	int idx, i, onlypad=0;
	u32 crc;

	crc = afx->crc;
	idx = afx->idx;
	val = afx->radbuf[0];
	for( n=0; n < size; ) {

	if( afx->buffer_pos < afx->buffer_len )
	c = afx->buffer[afx->buffer_pos++];
	else { /* read the next line */
	unsigned maxlen = MAX_LINELEN;
	afx->buffer_pos = 0;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	if( !maxlen )
	afx->truncated++;
	if( !afx->buffer_len )
	break; /* eof */
	continue;
	}

	again:
	if( c == '\n' \|\| c == ' ' \|\| c == '\r' \|\| c == '\t' )
	continue;
	else if( c == '=' ) { /* pad character: stop */
	/* some mailers leave quoted-printable encoded characters
	* so we try to workaround this */
	if( afx->buffer_pos+2 < afx->buffer_len ) {
	int cc1, cc2, cc3;
	cc1 = afx->buffer[afx->buffer_pos];
	cc2 = afx->buffer[afx->buffer_pos+1];
	cc3 = afx->buffer[afx->buffer_pos+2];
	if( isxdigit(cc1) && isxdigit(cc2)
	&& strchr( "=\n\r\t ", cc3 )) {
	/* well it seems to be the case - adjust */
	c = isdigit(cc1)? (cc1 - '0'): (ascii_toupper(cc1)-'A'+10);
	c <<= 4;
	c \|= isdigit(cc2)? (cc2 - '0'): (ascii_toupper(cc2)-'A'+10);
	afx->buffer_pos += 2;
	afx->qp_detected = 1;
	goto again;
	}
	}

	/* Occasionally a bug MTA will leave the = escaped as
	=3D. If the 4 characters following that are valid
	Radix64 characters and they are following by a new
	line, assume that this is the case and skip the
	3D. */
	if (afx->buffer_pos + 6 < afx->buffer_len
	&& afx->buffer[afx->buffer_pos + 0] == '3'
	&& afx->buffer[afx->buffer_pos + 1] == 'D'
	&& asctobin[afx->buffer[afx->buffer_pos + 2]] != 255
	&& asctobin[afx->buffer[afx->buffer_pos + 3]] != 255
	&& asctobin[afx->buffer[afx->buffer_pos + 4]] != 255
	&& asctobin[afx->buffer[afx->buffer_pos + 5]] != 255
	&& afx->buffer[afx->buffer_pos + 6] == '\n')
	{
	afx->buffer_pos += 2;
	afx->qp_detected = 1;
	}

	if (!n)
	onlypad = 1;

	if( idx == 1 )
	buf[n++] = val;
	checkcrc++;
	break;
	}
	else if( (c = asctobin[(c2=c)]) == 255 ) {
	log_error(_("invalid radix64 character %02X skipped\n"), c2);
	continue;
	}
	switch(idx) {
	case 0: val = c << 2; break;
	case 1: val \|= (c>>4)&3; buf[n++]=val;val=(c<<4)&0xf0;break;
	case 2: val \|= (c>>2)&15; buf[n++]=val;val=(c<<6)&0xc0;break;
	case 3: val \|= c&0x3f; buf[n++] = val; break;
	}
	idx = (idx+1) % 4;
	}

	for(i=0; i < n; i++ )
	crc = (crc << 8) ^ crc_table[((crc >> 16)&0xff) ^ buf[i]];
	crc &= 0x00ffffff;
	afx->crc = crc;
	afx->idx = idx;
	afx->radbuf[0] = val;

	if( checkcrc ) {
	afx->any_data = 1;
	afx->inp_checked=0;
	afx->faked = 0;
	for(;;) { /* skip lf and pad characters */
	if( afx->buffer_pos < afx->buffer_len )
	c = afx->buffer[afx->buffer_pos++];
	else { /* read the next line */
	unsigned maxlen = MAX_LINELEN;
	afx->buffer_pos = 0;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size, &maxlen );
	if( !maxlen )
	afx->truncated++;
	if( !afx->buffer_len )
	break; /* eof */
	continue;
	}
	if( c == '\n' \|\| c == ' ' \|\| c == '\r'
	\|\| c == '\t' \|\| c == '=' )
	continue;
	break;
	}
	if( c == -1 )
	log_error(_("premature eof (no CRC)\n"));
	else {
	u32 mycrc = 0;
	idx = 0;
	do {
	if( (c = asctobin[c]) == 255 )
	break;
	switch(idx) {
	case 0: val = c << 2; break;
	case 1: val \|= (c>>4)&3; mycrc \|= val << 16;val=(c<<4)&0xf0;break;
	case 2: val \|= (c>>2)&15; mycrc \|= val << 8;val=(c<<6)&0xc0;break;
	case 3: val \|= c&0x3f; mycrc \|= val; break;
	}
	for(;;) {
	if( afx->buffer_pos < afx->buffer_len )
	c = afx->buffer[afx->buffer_pos++];
	else { /* read the next line */
	unsigned maxlen = MAX_LINELEN;
	afx->buffer_pos = 0;
	afx->buffer_len = iobuf_read_line( a, &afx->buffer,
	&afx->buffer_size,
	&maxlen );
	if( !maxlen )
	afx->truncated++;
	if( !afx->buffer_len )
	break; /* eof */
	continue;
	}
	break;
	}
	if( !afx->buffer_len )
	break; /* eof */
	} while( ++idx < 4 );
	if( c == -1 ) {
	log_info(_("premature eof (in CRC)\n"));
	rc = invalid_crc();
	}
	else if( idx == 0 ) {
	/* No CRC at all is legal ("MAY") */
	rc=0;
	}
	else if( idx != 4 ) {
	log_info(_("malformed CRC\n"));
	rc = invalid_crc();
	}
	else if( mycrc != afx->crc ) {
	log_info (_("CRC error; %06lX - %06lX\n"),
	(ulong)afx->crc, (ulong)mycrc);
	rc = invalid_crc();
	}
	else {
	rc = 0;
	/* FIXME: Here we should emit another control packet,
	* so that we know in mainproc that we are processing
	* a clearsign message */
	#if 0
	for(rc=0;!rc;) {
	rc = 0 /check_trailer( &fhdr, c )/;
	if( !rc ) {
	if( (c=iobuf_get(a)) == -1 )
	rc = 2;
	}
	}
	if( rc == -1 )
	rc = 0;
	else if( rc == 2 ) {
	log_error(_("premature eof (in trailer)\n"));
	rc = GPG_ERR_INVALID_ARMOR;
	}
	else {
	log_error(_("error in trailer line\n"));
	rc = GPG_ERR_INVALID_ARMOR;
	}
	#endif
	}
	}
	}

	if( !n && !onlypad )
	rc = -1;

	*retn = n;
	return rc;
	}

	/****************
	* This filter is used to handle the armor stuff
	*/
	static int
	armor_filter( void *opaque, int control,
	IOBUF a, byte buf, size_t ret_len)
	{
	size_t size = *ret_len;
	armor_filter_context_t *afx = opaque;
	int rc=0, i, c;
	byte radbuf[3];
	int idx, idx2;
	size_t n=0;
	u32 crc;
	#if 0
	static FILE *fp ;

	if( !fp ) {
	fp = fopen("armor.out", "w");
	assert(fp);
	}
	#endif

	if( DBG_FILTER )
	log_debug("armor-filter: control: %d\n", control );
	if( control == IOBUFCTRL_UNDERFLOW && afx->inp_bypass ) {
	n = 0;
	if( afx->buffer_len ) {
	/* Copy the data from AFX->BUFFER to BUF. */
	for(; n < size && afx->buffer_pos < afx->buffer_len; n++ )
	buf[n++] = afx->buffer[afx->buffer_pos++];
	if( afx->buffer_pos >= afx->buffer_len )
	afx->buffer_len = 0;
	}
	/* If there is still space in BUF, read directly into it. */
	for(; n < size; n++ ) {
	if( (c=iobuf_get(a)) == -1 )
	break;
	buf[n] = c & 0xff;
	}
	if( !n )
	/* We didn't get any data. EOF. */
	rc = -1;
	*ret_len = n;
	}
	else if( control == IOBUFCTRL_UNDERFLOW ) {
	/* We need some space for the faked packet. The minmum
	* required size is the PARTIAL_CHUNK size plus a byte for the
	* length itself */
	if( size < PARTIAL_CHUNK+1 )
	BUG(); /* supplied buffer too short */

	if( afx->faked )
	rc = fake_packet( afx, a, &n, buf, size );
	else if( !afx->inp_checked ) {
	rc = check_input( afx, a );
	if( afx->inp_bypass ) {
	for(n=0; n < size && afx->buffer_pos < afx->buffer_len; )
	buf[n++] = afx->buffer[afx->buffer_pos++];
	if( afx->buffer_pos >= afx->buffer_len )
	afx->buffer_len = 0;
	if( !n )
	rc = -1;
	}
	else if( afx->faked ) {
	unsigned int hashes = afx->hashes;
	const byte *sesmark;
	size_t sesmarklen;

	sesmark = get_session_marker( &sesmarklen );
	if ( sesmarklen > 20 )
	BUG();

	/* the buffer is at least 15+n*15 bytes long, so it
	* is easy to construct the packets */

	hashes &= 1\|2\|8\|16\|32\|64;
	if( !hashes ) {
	hashes \|= 2; /* Default to SHA-1. */
	}
	n=0;
	/* First a gpg control packet... */
	buf[n++] = 0xff; /* new format, type 63, 1 length byte */
	n++; /* see below */
	memcpy(buf+n, sesmark, sesmarklen ); n+= sesmarklen;
	buf[n++] = CTRLPKT_CLEARSIGN_START;
	buf[n++] = afx->not_dash_escaped? 0:1; /* sigclass */
	if( hashes & 1 )
	buf[n++] = DIGEST_ALGO_RMD160;
	if( hashes & 2 )
	buf[n++] = DIGEST_ALGO_SHA1;
	if( hashes & 8 )
	buf[n++] = DIGEST_ALGO_SHA224;
	if( hashes & 16 )
	buf[n++] = DIGEST_ALGO_SHA256;
	if( hashes & 32 )
	buf[n++] = DIGEST_ALGO_SHA384;
	if( hashes & 64 )
	buf[n++] = DIGEST_ALGO_SHA512;
	buf[1] = n - 2;

	/* ...followed by an invented plaintext packet.
	Amusingly enough, this packet is not compliant with
	2440 as the initial partial length is less than 512
	bytes. Of course, we'll accept it anyway ;) */

	buf[n++] = 0xCB; /* new packet format, type 11 */
	buf[n++] = 0xE1; /* 2^1 == 2 bytes */
	buf[n++] = 't'; /* canonical text mode */
	buf[n++] = 0; /* namelength */
	buf[n++] = 0xE2; /* 2^2 == 4 more bytes */
	memset(buf+n, 0, 4); /* timestamp */
	n += 4;
	}
	else if( !rc )
	rc = radix64_read( afx, a, &n, buf, size );
	}
	else
	rc = radix64_read( afx, a, &n, buf, size );
	#if 0
	if( n )
	if( fwrite(buf, n, 1, fp ) != 1 )
	BUG();
	#endif
	*ret_len = n;
	}
	else if( control == IOBUFCTRL_FLUSH && !afx->cancel ) {
	if( !afx->status ) { /* write the header line */
	const char *s;
	strlist_t comment=opt.comments;

	if( afx->what >= DIM(head_strings) )
	log_bug("afx->what=%d", afx->what);
	iobuf_writestr(a, "-----");
	iobuf_writestr(a, head_strings[afx->what] );
	iobuf_writestr(a, "-----" );
	iobuf_writestr(a,afx->eol);
	if (opt.emit_version)
	{
	iobuf_writestr (a, "Version: "GNUPG_NAME" v");
	for (s=VERSION; s && s != '.'; s++)
	iobuf_writebyte (a, *s);
	if (opt.emit_version > 1 && *s)
	{
	iobuf_writebyte (a, *s++);
	for (; s && s != '.'; s++)
	iobuf_writebyte (a, *s);
	if (opt.emit_version > 2)
	{
	for (; s && s != '-' && !spacep (s); s++)
	iobuf_writebyte (a, *s);
	if (opt.emit_version > 3)
	iobuf_writestr (a, " (" PRINTABLE_OS_NAME ")");
	}
	}
	iobuf_writestr(a,afx->eol);
	}

	/* write the comment strings */
	for(s=comment->d;comment;comment=comment->next,s=comment->d)
	{
	iobuf_writestr(a, "Comment: " );
	for( ; *s; s++ )
	{
	if( *s == '\n' )
	iobuf_writestr(a, "\\n" );
	else if( *s == '\r' )
	iobuf_writestr(a, "\\r" );
	else if( *s == '\v' )
	iobuf_writestr(a, "\\v" );
	else
	iobuf_put(a, *s );
	}

	iobuf_writestr(a,afx->eol);
	}

	if ( afx->hdrlines ) {
	for ( s = afx->hdrlines; *s; s++ ) {
	#ifdef HAVE_DOSISH_SYSTEM
	if ( *s == '\n' )
	iobuf_put( a, '\r');
	#endif
	iobuf_put(a, *s );
	}
	}

	iobuf_writestr(a,afx->eol);
	afx->status++;
	afx->idx = 0;
	afx->idx2 = 0;
	afx->crc = CRCINIT;

	}
	crc = afx->crc;
	idx = afx->idx;
	idx2 = afx->idx2;
	for(i=0; i < idx; i++ )
	radbuf[i] = afx->radbuf[i];

	for(i=0; i < size; i++ )
	crc = (crc << 8) ^ crc_table[((crc >> 16)&0xff) ^ buf[i]];
	crc &= 0x00ffffff;

	for( ; size; buf++, size-- ) {
	radbuf[idx++] = *buf;
	if( idx > 2 ) {
	idx = 0;
	c = bintoasc[(*radbuf >> 2) & 077];
	iobuf_put(a, c);
	c = bintoasc[(((*radbuf<<4)&060)\|((radbuf[1] >> 4)&017))&077];
	iobuf_put(a, c);
	c = bintoasc[(((radbuf[1]<<2)&074)\|((radbuf[2]>>6)&03))&077];
	iobuf_put(a, c);
	c = bintoasc[radbuf[2]&077];
	iobuf_put(a, c);
	if( ++idx2 >= (64/4) )
	{ /* pgp doesn't like 72 here */
	iobuf_writestr(a,afx->eol);
	idx2=0;
	}
	}
	}
	for(i=0; i < idx; i++ )
	afx->radbuf[i] = radbuf[i];
	afx->idx = idx;
	afx->idx2 = idx2;
	afx->crc = crc;
	}
	else if( control == IOBUFCTRL_INIT )
	{
	if( !is_initialized )
	initialize();

	/* Figure out what we're using for line endings if the caller
	didn't specify. */
	if(afx->eol[0]==0)
	{
	#ifdef HAVE_DOSISH_SYSTEM
	afx->eol[0]='\r';
	afx->eol[1]='\n';
	#else
	afx->eol[0]='\n';
	#endif
	}
	}
	else if( control == IOBUFCTRL_CANCEL ) {
	afx->cancel = 1;
	}
	else if( control == IOBUFCTRL_FREE ) {
	if( afx->cancel )
	;
	else if( afx->status ) { /* pad, write cecksum, and bottom line */
	crc = afx->crc;
	idx = afx->idx;
	idx2 = afx->idx2;
	if( idx ) {
	c = bintoasc[(afx->radbuf[0]>>2)&077];
	iobuf_put(a, c);
	if( idx == 1 ) {
	c = bintoasc[((afx->radbuf[0] << 4) & 060) & 077];
	iobuf_put(a, c);
	iobuf_put(a, '=');
	iobuf_put(a, '=');
	}
	else { /* 2 */
	c = bintoasc[(((afx->radbuf[0]<<4)&060)
	\|((afx->radbuf[1]>>4)&017))&077];
	iobuf_put(a, c);
	c = bintoasc[((afx->radbuf[1] << 2) & 074) & 077];
	iobuf_put(a, c);
	iobuf_put(a, '=');
	}
	if( ++idx2 >= (64/4) )
	{ /* pgp doesn't like 72 here */
	iobuf_writestr(a,afx->eol);
	idx2=0;
	}
	}
	/* may need a linefeed */
	if( idx2 )
	iobuf_writestr(a,afx->eol);
	/* write the CRC */
	iobuf_put(a, '=');
	radbuf[0] = crc >>16;
	radbuf[1] = crc >> 8;
	radbuf[2] = crc;
	c = bintoasc[(*radbuf >> 2) & 077];
	iobuf_put(a, c);
	c = bintoasc[(((*radbuf<<4)&060)\|((radbuf[1] >> 4)&017))&077];
	iobuf_put(a, c);
	c = bintoasc[(((radbuf[1]<<2)&074)\|((radbuf[2]>>6)&03))&077];
	iobuf_put(a, c);
	c = bintoasc[radbuf[2]&077];
	iobuf_put(a, c);
	iobuf_writestr(a,afx->eol);
	- /* and the the trailer */
	+ /* and the trailer */
	if( afx->what >= DIM(tail_strings) )
	log_bug("afx->what=%d", afx->what);
	iobuf_writestr(a, "-----");
	iobuf_writestr(a, tail_strings[afx->what] );
	iobuf_writestr(a, "-----" );
	iobuf_writestr(a,afx->eol);
	}
	else if( !afx->any_data && !afx->inp_bypass ) {
	log_error(_("no valid OpenPGP data found.\n"));
	afx->no_openpgp_data = 1;
	write_status_text( STATUS_NODATA, "1" );
	}
	if( afx->truncated )
	log_info(_("invalid armor: line longer than %d characters\n"),
	MAX_LINELEN );
	/* issue an error to enforce dissemination of correct software */
	if( afx->qp_detected )
	log_error(_("quoted printable character in armor - "
	"probably a buggy MTA has been used\n") );
	xfree( afx->buffer );
	afx->buffer = NULL;
	release_armor_context (afx);
	}
	else if( control == IOBUFCTRL_DESC )
	mem2str (buf, "armor_filter", *ret_len);
	return rc;
	}


	/****************
	* create a radix64 encoded string.
	*/
	char *
	make_radix64_string( const byte *data, size_t len )
	{
	char buffer, p;

	buffer = p = xmalloc( (len+2)/3*4 + 1 );
	for( ; len >= 3 ; len -= 3, data += 3 ) {
	*p++ = bintoasc[(data[0] >> 2) & 077];
	*p++ = bintoasc[(((data[0] <<4)&060)\|((data[1] >> 4)&017))&077];
	*p++ = bintoasc[(((data[1]<<2)&074)\|((data[2]>>6)&03))&077];
	*p++ = bintoasc[data[2]&077];
	}
	if( len == 2 ) {
	*p++ = bintoasc[(data[0] >> 2) & 077];
	*p++ = bintoasc[(((data[0] <<4)&060)\|((data[1] >> 4)&017))&077];
	*p++ = bintoasc[((data[1]<<2)&074)];
	}
	else if( len == 1 ) {
	*p++ = bintoasc[(data[0] >> 2) & 077];
	*p++ = bintoasc[(data[0] <<4)&060];
	}
	*p = 0;
	return buffer;
	}


	/***********************************************
	* For the pipemode command we can't use the armor filter for various
	* reasons, so we use this new unarmor_pump stuff to remove the armor
	*/

	enum unarmor_state_e {
	STA_init = 0,
	STA_bypass,
	STA_wait_newline,
	STA_wait_dash,
	STA_first_dash,
	STA_compare_header,
	STA_found_header_wait_newline,
	STA_skip_header_lines,
	STA_skip_header_lines_non_ws,
	STA_read_data,
	STA_wait_crc,
	STA_read_crc,
	STA_ready
	};

	struct unarmor_pump_s {
	enum unarmor_state_e state;
	byte val;
	int checkcrc;
	int pos; /* counts from 0..3 */
	u32 crc;
	u32 mycrc; /* the one store in the data */
	};



	UnarmorPump
	unarmor_pump_new (void)
	{
	UnarmorPump x;

	if( !is_initialized )
	initialize();
	x = xmalloc_clear (sizeof *x);
	return x;
	}

	void
	unarmor_pump_release (UnarmorPump x)
	{
	xfree (x);
	}

	/*
	* Get the next character from the ascii armor taken from the IOBUF
	* created earlier by unarmor_pump_new().
	* Return: c = Character
	* 256 = ignore this value
	* -1 = End of current armor
	* -2 = Premature EOF (not used)
	* -3 = Invalid armor
	*/
	int
	unarmor_pump (UnarmorPump x, int c)
	{
	int rval = 256; /* default is to ignore the return value */

	switch (x->state) {
	case STA_init:
	{
	byte tmp[2];
	tmp[0] = c;
	tmp[1] = 0;
	if ( is_armored (tmp) )
	x->state = c == '-'? STA_first_dash : STA_wait_newline;
	else {
	x->state = STA_bypass;
	return c;
	}
	}
	break;
	case STA_bypass:
	return c; /* return here to avoid crc calculation */
	case STA_wait_newline:
	if (c == '\n')
	x->state = STA_wait_dash;
	break;
	case STA_wait_dash:
	x->state = c == '-'? STA_first_dash : STA_wait_newline;
	break;
	case STA_first_dash: /* just need for initialization */
	x->pos = 0;
	x->state = STA_compare_header;
	case STA_compare_header:
	if ( "-----BEGIN PGP SIGNATURE-----"[++x->pos] == c ) {
	if ( x->pos == 28 )
	x->state = STA_found_header_wait_newline;
	}
	else
	x->state = c == '\n'? STA_wait_dash : STA_wait_newline;
	break;
	case STA_found_header_wait_newline:
	/* to make CR,LF issues easier we simply allow for white space
	behind the 5 dashes */
	if ( c == '\n' )
	x->state = STA_skip_header_lines;
	else if ( c != '\r' && c != ' ' && c != '\t' )
	x->state = STA_wait_dash; /* garbage after the header line */
	break;
	case STA_skip_header_lines:
	/* i.e. wait for one empty line */
	if ( c == '\n' ) {
	x->state = STA_read_data;
	x->crc = CRCINIT;
	x->val = 0;
	x->pos = 0;
	}
	else if ( c != '\r' && c != ' ' && c != '\t' )
	x->state = STA_skip_header_lines_non_ws;
	break;
	case STA_skip_header_lines_non_ws:
	/* like above but we already encountered non white space */
	if ( c == '\n' )
	x->state = STA_skip_header_lines;
	break;
	case STA_read_data:
	/* fixme: we don't check for the trailing dash lines but rely
	* on the armor stop characters */
	if( c == '\n' \|\| c == ' ' \|\| c == '\r' \|\| c == '\t' )
	break; /* skip all kind of white space */

	if( c == '=' ) { /* pad character: stop */
	if( x->pos == 1 ) /* in this case val has some value */
	rval = x->val;
	x->state = STA_wait_crc;
	break;
	}

	{
	int c2;
	if( (c = asctobin[(c2=c)]) == 255 ) {
	log_error(_("invalid radix64 character %02X skipped\n"), c2);
	break;
	}
	}

	switch(x->pos) {
	case 0:
	x->val = c << 2;
	break;
	case 1:
	x->val \|= (c>>4)&3;
	rval = x->val;
	x->val = (c<<4)&0xf0;
	break;
	case 2:
	x->val \|= (c>>2)&15;
	rval = x->val;
	x->val = (c<<6)&0xc0;
	break;
	case 3:
	x->val \|= c&0x3f;
	rval = x->val;
	break;
	}
	x->pos = (x->pos+1) % 4;
	break;
	case STA_wait_crc:
	if( c == '\n' \|\| c == ' ' \|\| c == '\r' \|\| c == '\t' \|\| c == '=' )
	break; /* skip ws and pad characters */
	/* assume that we are at the next line */
	x->state = STA_read_crc;
	x->pos = 0;
	x->mycrc = 0;
	case STA_read_crc:
	if( (c = asctobin[c]) == 255 ) {
	rval = -1; /* ready */
	if( x->crc != x->mycrc ) {
	log_info (_("CRC error; %06lX - %06lX\n"),
	(ulong)x->crc, (ulong)x->mycrc);
	if ( invalid_crc() )
	rval = -3;
	}
	x->state = STA_ready; /* not sure whether this is correct */
	break;
	}

	switch(x->pos) {
	case 0:
	x->val = c << 2;
	break;
	case 1:
	x->val \|= (c>>4)&3;
	x->mycrc \|= x->val << 16;
	x->val = (c<<4)&0xf0;
	break;
	case 2:
	x->val \|= (c>>2)&15;
	x->mycrc \|= x->val << 8;
	x->val = (c<<6)&0xc0;
	break;
	case 3:
	x->val \|= c&0x3f;
	x->mycrc \|= x->val;
	break;
	}
	x->pos = (x->pos+1) % 4;
	break;
	case STA_ready:
	rval = -1;
	break;
	}

	if ( !(rval & ~255) ) { /* compute the CRC */
	x->crc = (x->crc << 8) ^ crc_table[((x->crc >> 16)&0xff) ^ rval];
	x->crc &= 0x00ffffff;
	}

	return rval;
	}
	diff --git a/g10/build-packet.c b/g10/build-packet.c
	index ad46a0270..489fadd85 100644
	--- a/g10/build-packet.c
	+++ b/g10/build-packet.c
	@@ -1,1696 +1,1696 @@
	/* build-packet.c - assemble packets and write them
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
	* 2006, 2010, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "status.h"
	#include "iobuf.h"
	#include "i18n.h"
	#include "options.h"
	#include "host2net.h"

	static int do_user_id( IOBUF out, int ctb, PKT_user_id *uid );
	static int do_key (iobuf_t out, int ctb, PKT_public_key *pk);
	static int do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc );
	static int do_pubkey_enc( IOBUF out, int ctb, PKT_pubkey_enc *enc );
	static u32 calc_plaintext( PKT_plaintext *pt );
	static int do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt );
	static int do_encrypted( IOBUF out, int ctb, PKT_encrypted *ed );
	static int do_encrypted_mdc( IOBUF out, int ctb, PKT_encrypted *ed );
	static int do_compressed( IOBUF out, int ctb, PKT_compressed *cd );
	static int do_signature( IOBUF out, int ctb, PKT_signature *sig );
	static int do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops );

	static int calc_header_length( u32 len, int new_ctb );
	static int write_16(IOBUF inp, u16 a);
	static int write_32(IOBUF inp, u32 a);
	static int write_header( IOBUF out, int ctb, u32 len );
	static int write_sign_packet_header( IOBUF out, int ctb, u32 len );
	static int write_header2( IOBUF out, int ctb, u32 len, int hdrlen );
	static int write_new_header( IOBUF out, int ctb, u32 len, int hdrlen );

	/* Returns 1 if CTB is a new format ctb and 0 if CTB is an old format
	ctb. */
	static int
	ctb_new_format_p (int ctb)
	{
	/* Bit 7 must always be set. */
	log_assert ((ctb & (1 << 7)));
	/* Bit 6 indicates whether the packet is a new format packet. */
	return (ctb & (1 << 6));
	}

	/* Extract the packet type from a CTB. */
	static int
	ctb_pkttype (int ctb)
	{
	if (ctb_new_format_p (ctb))
	/* Bits 0 through 5 are the packet type. */
	return (ctb & ((1 << 6) - 1));
	else
	/* Bits 2 through 5 are the packet type. */
	return (ctb & ((1 << 6) - 1)) >> 2;
	}

	/****************
	* Build a packet and write it to INP
	* Returns: 0 := okay
	* >0 := error
	* Note: Caller must free the packet
	*/
	int
	build_packet( IOBUF out, PACKET *pkt )
	{
	int new_ctb=0, rc=0, ctb;
	int pkttype;

	if( DBG_PACKET )
	log_debug("build_packet() type=%d\n", pkt->pkttype );
	log_assert( pkt->pkt.generic );

	switch ((pkttype = pkt->pkttype))
	{
	case PKT_PUBLIC_KEY:
	if (pkt->pkt.public_key->seckey_info)
	pkttype = PKT_SECRET_KEY;
	break;
	case PKT_PUBLIC_SUBKEY:
	if (pkt->pkt.public_key->seckey_info)
	pkttype = PKT_SECRET_SUBKEY;
	break;
	case PKT_PLAINTEXT: new_ctb = pkt->pkt.plaintext->new_ctb; break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: new_ctb = pkt->pkt.encrypted->new_ctb; break;
	case PKT_COMPRESSED:new_ctb = pkt->pkt.compressed->new_ctb; break;
	case PKT_USER_ID:
	if( pkt->pkt.user_id->attrib_data )
	pkttype = PKT_ATTRIBUTE;
	break;
	default: break;
	}

	if( new_ctb \|\| pkttype > 15 ) /* new format */
	ctb = 0xc0 \| (pkttype & 0x3f);
	else
	ctb = 0x80 \| ((pkttype & 15)<<2);
	switch( pkttype )
	{
	case PKT_ATTRIBUTE:
	case PKT_USER_ID:
	rc = do_user_id( out, ctb, pkt->pkt.user_id );
	break;
	case PKT_OLD_COMMENT:
	case PKT_COMMENT:
	/*
	Ignore these. Theoretically, this will never be called as
	we have no way to output comment packets any longer, but
	just in case there is some code path that would end up
	outputting a comment that was written before comments were
	dropped (in the public key?) this is a no-op.
	*/
	break;
	case PKT_PUBLIC_SUBKEY:
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_SECRET_KEY:
	rc = do_key (out, ctb, pkt->pkt.public_key);
	break;
	case PKT_SYMKEY_ENC:
	rc = do_symkey_enc( out, ctb, pkt->pkt.symkey_enc );
	break;
	case PKT_PUBKEY_ENC:
	rc = do_pubkey_enc( out, ctb, pkt->pkt.pubkey_enc );
	break;
	case PKT_PLAINTEXT:
	rc = do_plaintext( out, ctb, pkt->pkt.plaintext );
	break;
	case PKT_ENCRYPTED:
	rc = do_encrypted( out, ctb, pkt->pkt.encrypted );
	break;
	case PKT_ENCRYPTED_MDC:
	rc = do_encrypted_mdc( out, ctb, pkt->pkt.encrypted );
	break;
	case PKT_COMPRESSED:
	rc = do_compressed( out, ctb, pkt->pkt.compressed );
	break;
	case PKT_SIGNATURE:
	rc = do_signature( out, ctb, pkt->pkt.signature );
	break;
	case PKT_ONEPASS_SIG:
	rc = do_onepass_sig( out, ctb, pkt->pkt.onepass_sig );
	break;
	case PKT_RING_TRUST:
	break; /* ignore it (keyring.c does write it directly)*/
	case PKT_MDC: /* we write it directly, so we should never see it here. */
	default:
	log_bug("invalid packet type in build_packet()\n");
	break;
	}

	return rc;
	}


	/*
	* Write the mpi A to OUT.
	*/
	gpg_error_t
	gpg_mpi_write (iobuf_t out, gcry_mpi_t a)
	{
	int rc;

	if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
	{
	unsigned int nbits;
	const unsigned char *p;
	unsigned char lenhdr[2];

	/* gcry_log_debugmpi ("a", a); */
	p = gcry_mpi_get_opaque (a, &nbits);
	if (p)
	{
	/* Strip leading zero bits. */
	for (; nbits >= 8 && !*p; p++, nbits -= 8)
	;
	if (nbits >= 8 && !(*p & 0x80))
	if (--nbits >= 7 && !(*p & 0x40))
	if (--nbits >= 6 && !(*p & 0x20))
	if (--nbits >= 5 && !(*p & 0x10))
	if (--nbits >= 4 && !(*p & 0x08))
	if (--nbits >= 3 && !(*p & 0x04))
	if (--nbits >= 2 && !(*p & 0x02))
	if (--nbits >= 1 && !(*p & 0x01))
	--nbits;
	}
	/* gcry_log_debug (" [%u bit]\n", nbits); */
	/* gcry_log_debughex (" ", p, (nbits+7)/8); */
	lenhdr[0] = nbits >> 8;
	lenhdr[1] = nbits;
	rc = iobuf_write (out, lenhdr, 2);
	if (!rc && p)
	rc = iobuf_write (out, p, (nbits+7)/8);
	}
	else
	{
	char buffer[(MAX_EXTERN_MPI_BITS+7)/8+2]; /* 2 is for the mpi length. */
	size_t nbytes;

	nbytes = DIM(buffer);
	rc = gcry_mpi_print (GCRYMPI_FMT_PGP, buffer, nbytes, &nbytes, a );
	if( !rc )
	rc = iobuf_write( out, buffer, nbytes );
	else if (gpg_err_code(rc) == GPG_ERR_TOO_SHORT )
	{
	log_info ("mpi too large (%u bits)\n", gcry_mpi_get_nbits (a));
	/* The buffer was too small. We better tell the user about the MPI. */
	rc = gpg_error (GPG_ERR_TOO_LARGE);
	}
	}

	return rc;
	}


	/*
	* Write an opaque MPI to the output stream without length info.
	*/
	gpg_error_t
	gpg_mpi_write_nohdr (iobuf_t out, gcry_mpi_t a)
	{
	int rc;

	if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
	{
	unsigned int nbits;
	const void *p;

	p = gcry_mpi_get_opaque (a, &nbits);
	rc = p ? iobuf_write (out, p, (nbits+7)/8) : 0;
	}
	else
	rc = gpg_error (GPG_ERR_BAD_MPI);

	return rc;
	}


	/* Calculate the length of a packet described by PKT. */
	u32
	calc_packet_length( PACKET *pkt )
	{
	u32 n=0;
	int new_ctb = 0;

	log_assert (pkt->pkt.generic);
	switch( pkt->pkttype ) {
	case PKT_PLAINTEXT:
	n = calc_plaintext( pkt->pkt.plaintext );
	new_ctb = pkt->pkt.plaintext->new_ctb;
	break;
	case PKT_ATTRIBUTE:
	case PKT_USER_ID:
	case PKT_COMMENT:
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_SYMKEY_ENC:
	case PKT_PUBKEY_ENC:
	case PKT_ENCRYPTED:
	case PKT_SIGNATURE:
	case PKT_ONEPASS_SIG:
	case PKT_RING_TRUST:
	case PKT_COMPRESSED:
	default:
	log_bug("invalid packet type in calc_packet_length()");
	break;
	}

	n += calc_header_length(n, new_ctb);
	return n;
	}


	static gpg_error_t
	write_fake_data (IOBUF out, gcry_mpi_t a)
	{
	unsigned int n;
	void *p;

	if (!a)
	return 0;
	if (!gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
	return 0; /* e.g. due to generating a key with wrong usage. */
	p = gcry_mpi_get_opaque ( a, &n);
	if (!p)
	return 0; /* For example due to a read error in
	parse-packet.c:read_rest. */
	return iobuf_write (out, p, (n+7)/8 );
	}


	/* Serialize the user id (RFC 4880, Section 5.11) or the user
	attribute UID (Section 5.12) and write it to OUT.

	CTB is the serialization's CTB. It specifies the header format and
	the packet's type. The header length must not be set. */
	static int
	do_user_id( IOBUF out, int ctb, PKT_user_id *uid )
	{
	int rc;

	log_assert (ctb_pkttype (ctb) == PKT_USER_ID
	\|\| ctb_pkttype (ctb) == PKT_ATTRIBUTE);

	if (uid->attrib_data)
	{
	write_header(out, ctb, uid->attrib_len);
	rc = iobuf_write( out, uid->attrib_data, uid->attrib_len );
	}
	else
	{
	write_header2( out, ctb, uid->len, 0 );
	rc = iobuf_write( out, uid->name, uid->len );
	}
	return rc;
	}


	/* Serialize the key (RFC 4880, Section 5.5) described by PK and write
	it to OUT.

	This function serializes both primary keys and subkeys with or
	without a secret part.

	CTB is the serialization's CTB. It specifies the header format and
	the packet's type. The header length must not be set.

	PK->VERSION specifies the serialization format. A value of 0 means
	to use the default version. Currently, only version 4 packets are
	supported.
	*/
	static int
	do_key (iobuf_t out, int ctb, PKT_public_key *pk)
	{
	gpg_error_t err = 0;
	/* The length of the body is stored in the packet's header, which
	occurs before the body. Unfortunately, we don't know the length
	of the packet's body until we've written all of the data! To
	work around this, we first write the data into this temporary
	buffer, then generate the header, and finally copy the contents
	of this buffer to OUT. */
	iobuf_t a = iobuf_temp();
	int i, nskey, npkey;

	log_assert (pk->version == 0 \|\| pk->version == 4);
	log_assert (ctb_pkttype (ctb) == PKT_PUBLIC_KEY
	\|\| ctb_pkttype (ctb) == PKT_PUBLIC_SUBKEY
	\|\| ctb_pkttype (ctb) == PKT_SECRET_KEY
	\|\| ctb_pkttype (ctb) == PKT_SECRET_SUBKEY);

	/* Write the version number - if none is specified, use 4 */
	if ( !pk->version )
	iobuf_put ( a, 4 );
	else
	iobuf_put ( a, pk->version );
	write_32 (a, pk->timestamp );

	iobuf_put (a, pk->pubkey_algo );

	/* Get number of secret and public parameters. They are held in one
	array: the public ones followed by the secret ones. */
	nskey = pubkey_get_nskey (pk->pubkey_algo);
	npkey = pubkey_get_npkey (pk->pubkey_algo);

	/* If we don't have any public parameters - which is for example the
	case if we don't know the algorithm used - the parameters are
	stored as one blob in a faked (opaque) MPI. */
	if (!npkey)
	{
	write_fake_data (a, pk->pkey[0]);
	goto leave;
	}
	log_assert (npkey < nskey);

	for (i=0; i < npkey; i++ )
	{
	if ( (pk->pubkey_algo == PUBKEY_ALGO_ECDSA && (i == 0))
	\|\| (pk->pubkey_algo == PUBKEY_ALGO_EDDSA && (i == 0))
	\|\| (pk->pubkey_algo == PUBKEY_ALGO_ECDH && (i == 0 \|\| i == 2)))
	err = gpg_mpi_write_nohdr (a, pk->pkey[i]);
	else
	err = gpg_mpi_write (a, pk->pkey[i]);
	if (err)
	goto leave;
	}


	if (pk->seckey_info)
	{
	/* This is a secret key packet. */
	struct seckey_info *ski = pk->seckey_info;

	/* Build the header for protected (encrypted) secret parameters. */
	if (ski->is_protected)
	{
	/* OpenPGP protection according to rfc2440. */
	iobuf_put (a, ski->sha1chk? 0xfe : 0xff);
	iobuf_put (a, ski->algo);
	if (ski->s2k.mode >= 1000)
	{
	/* These modes are not possible in OpenPGP, we use them
	to implement our extensions, 101 can be viewed as a
	private/experimental extension (this is not specified
	in rfc2440 but the same scheme is used for all other
	algorithm identifiers). */
	iobuf_put (a, 101);
	iobuf_put (a, ski->s2k.hash_algo);
	iobuf_write (a, "GNU", 3 );
	iobuf_put (a, ski->s2k.mode - 1000);
	}
	else
	{
	iobuf_put (a, ski->s2k.mode);
	iobuf_put (a, ski->s2k.hash_algo);
	}

	if (ski->s2k.mode == 1 \|\| ski->s2k.mode == 3)
	iobuf_write (a, ski->s2k.salt, 8);

	if (ski->s2k.mode == 3)
	iobuf_put (a, ski->s2k.count);

	/* For our special modes 1001, 1002 we do not need an IV. */
	if (ski->s2k.mode != 1001 && ski->s2k.mode != 1002)
	iobuf_write (a, ski->iv, ski->ivlen);

	}
	else /* Not protected. */
	iobuf_put (a, 0 );

	if (ski->s2k.mode == 1001)
	; /* GnuPG extension - don't write a secret key at all. */
	else if (ski->s2k.mode == 1002)
	{
	/* GnuPG extension - divert to OpenPGP smartcard. */
	/* Length of the serial number or 0 for no serial number. */
	iobuf_put (a, ski->ivlen );
	/* The serial number gets stored in the IV field. */
	iobuf_write (a, ski->iv, ski->ivlen);
	}
	else if (ski->is_protected)
	{
	/* The secret key is protected - write it out as it is. */
	byte *p;
	unsigned int ndatabits;

	log_assert (gcry_mpi_get_flag (pk->pkey[npkey], GCRYMPI_FLAG_OPAQUE));
	p = gcry_mpi_get_opaque (pk->pkey[npkey], &ndatabits);
	if (p)
	iobuf_write (a, p, (ndatabits+7)/8 );
	}
	else
	{
	/* Non-protected key. */
	for ( ; i < nskey; i++ )
	if ( (err = gpg_mpi_write (a, pk->pkey[i])))
	goto leave;
	write_16 (a, ski->csum );
	}
	}

	leave:
	if (!err)
	{
	/* Build the header of the packet - which we must do after
	writing all the other stuff, so that we know the length of
	the packet */
	write_header2 (out, ctb, iobuf_get_temp_length(a), 0);
	/* And finally write it out to the real stream. */
	err = iobuf_write_temp (out, a);
	}

	iobuf_close (a); /* Close the temporary buffer */
	return err;
	}

	/* Serialize the symmetric-key encrypted session key packet (RFC 4880,
	5.3) described by ENC and write it to OUT.

	CTB is the serialization's CTB. It specifies the header format and
	the packet's type. The header length must not be set. */
	static int
	do_symkey_enc( IOBUF out, int ctb, PKT_symkey_enc *enc )
	{
	int rc = 0;
	IOBUF a = iobuf_temp();

	log_assert (ctb_pkttype (ctb) == PKT_SYMKEY_ENC);

	/* The only acceptable version. */
	log_assert( enc->version == 4 );

	/* RFC 4880, Section 3.7. */
	switch( enc->s2k.mode )
	{
	/* Simple S2K. */
	case 0:
	/* Salted S2K. */
	case 1:
	/* Iterated and salted S2K. */
	case 3:
	/* Reasonable values. */
	break;

	default:
	log_bug("do_symkey_enc: s2k=%d\n", enc->s2k.mode );
	}
	iobuf_put( a, enc->version );
	iobuf_put( a, enc->cipher_algo );
	iobuf_put( a, enc->s2k.mode );
	iobuf_put( a, enc->s2k.hash_algo );
	if( enc->s2k.mode == 1 \|\| enc->s2k.mode == 3 ) {
	iobuf_write(a, enc->s2k.salt, 8 );
	if( enc->s2k.mode == 3 )
	iobuf_put(a, enc->s2k.count);
	}
	if( enc->seskeylen )
	iobuf_write(a, enc->seskey, enc->seskeylen );

	write_header(out, ctb, iobuf_get_temp_length(a) );
	rc = iobuf_write_temp( out, a );

	iobuf_close(a);
	return rc;
	}


	/* Serialize the public-key encrypted session key packet (RFC 4880,
	5.1) described by ENC and write it to OUT.

	CTB is the serialization's CTB. It specifies the header format and
	the packet's type. The header length must not be set. */
	static int
	do_pubkey_enc( IOBUF out, int ctb, PKT_pubkey_enc *enc )
	{
	int rc = 0;
	int n, i;
	IOBUF a = iobuf_temp();

	log_assert (ctb_pkttype (ctb) == PKT_PUBKEY_ENC);

	iobuf_put (a, 3); /* Version. */

	if ( enc->throw_keyid )
	{
	write_32(a, 0 ); /* Don't tell Eve who can decrypt the message. */
	write_32(a, 0 );
	}
	else
	{
	write_32(a, enc->keyid[0] );
	write_32(a, enc->keyid[1] );
	}
	iobuf_put(a,enc->pubkey_algo );
	n = pubkey_get_nenc( enc->pubkey_algo );
	if ( !n )
	write_fake_data( a, enc->data[0] );

	for (i=0; i < n && !rc ; i++ )
	{
	if (enc->pubkey_algo == PUBKEY_ALGO_ECDH && i == 1)
	rc = gpg_mpi_write_nohdr (a, enc->data[i]);
	else
	rc = gpg_mpi_write (a, enc->data[i]);
	}

	if (!rc)
	{
	write_header (out, ctb, iobuf_get_temp_length(a) );
	rc = iobuf_write_temp (out, a);
	}
	iobuf_close(a);
	return rc;
	}


	/* Calculate the length of the serialized plaintext packet PT (RFC
	4480, Section 5.9). */
	static u32
	calc_plaintext( PKT_plaintext *pt )
	{
	/* Truncate namelen to the maximum 255 characters. Note this means
	that a function that calls build_packet with an illegal literal
	packet will get it back legalized. */

	if(pt->namelen>255)
	pt->namelen=255;

	return pt->len? (1 + 1 + pt->namelen + 4 + pt->len) : 0;
	}

	/* Serialize the plaintext packet (RFC 4880, 5.9) described by PT and
	write it to OUT.

	The body of the message is stored in PT->BUF. The amount of data
	to write is PT->LEN. (PT->BUF should be configured to return EOF
	after this much data has been read.) If PT->LEN is 0 and CTB
	indicates that this is a new format packet, then partial block mode
	is assumed to have been enabled on OUT. On success, partial block
	mode is disabled.

	- If PT->BUF is NULL, the the caller must write out the data. In
	+ If PT->BUF is NULL, the caller must write out the data. In
	this case, if PT->LEN was 0, then partial body length mode was
	enabled and the caller must disable it by calling
	iobuf_set_partial_body_length_mode (out, 0). */
	static int
	do_plaintext( IOBUF out, int ctb, PKT_plaintext *pt )
	{
	int rc = 0;
	size_t nbytes;

	log_assert (ctb_pkttype (ctb) == PKT_PLAINTEXT);

	write_header(out, ctb, calc_plaintext( pt ) );
	log_assert (pt->mode == 'b' \|\| pt->mode == 't' \|\| pt->mode == 'u'
	\|\| pt->mode == 'm'
	\|\| pt->mode == 'l' \|\| pt->mode == '1');
	iobuf_put(out, pt->mode );
	iobuf_put(out, pt->namelen );
	iobuf_write (out, pt->name, pt->namelen);
	rc = write_32(out, pt->timestamp );
	if (rc)
	return rc;

	if (pt->buf)
	{
	nbytes = iobuf_copy (out, pt->buf);
	if(ctb_new_format_p (ctb) && !pt->len)
	/* Turn off partial body length mode. */
	iobuf_set_partial_body_length_mode (out, 0);
	if( pt->len && nbytes != pt->len )
	log_error("do_plaintext(): wrote %lu bytes but expected %lu bytes\n",
	(ulong)nbytes, (ulong)pt->len );
	}

	return rc;
	}



	/* Serialize the symmetrically encrypted data packet (RFC 4880,
	Section 5.7) described by ED and write it to OUT.

	Note: this only writes the packets header! The call must then
	follow up and write the initial random data and the body to OUT.
	(If you use the encryption iobuf filter (cipher_filter), then this
	is done automatically.) */
	static int
	do_encrypted( IOBUF out, int ctb, PKT_encrypted *ed )
	{
	int rc = 0;
	u32 n;

	log_assert (! ed->mdc_method);
	log_assert (ctb_pkttype (ctb) == PKT_ENCRYPTED);

	n = ed->len ? (ed->len + ed->extralen) : 0;
	write_header(out, ctb, n );

	/* This is all. The caller has to write the real data */

	return rc;
	}

	/* Serialize the symmetrically encrypted integrity protected data
	packet (RFC 4880, Section 5.13) described by ED and write it to
	OUT.

	Note: this only writes the packet's header! The caller must then
	follow up and write the initial random data, the body and the MDC
	packet to OUT. (If you use the encryption iobuf filter
	(cipher_filter), then this is done automatically.) */
	static int
	do_encrypted_mdc( IOBUF out, int ctb, PKT_encrypted *ed )
	{
	int rc = 0;
	u32 n;

	log_assert (ed->mdc_method);
	log_assert (ctb_pkttype (ctb) == PKT_ENCRYPTED_MDC);

	/* Take version number and the following MDC packet in account. */
	n = ed->len ? (ed->len + ed->extralen + 1 + 22) : 0;
	write_header(out, ctb, n );
	iobuf_put(out, 1 ); /* version */

	/* This is all. The caller has to write the real data */

	return rc;
	}


	/* Serialize the compressed packet (RFC 4880, Section 5.6) described
	by CD and write it to OUT.

	Note: this only writes the packet's header! The caller must then
	follow up and write the body to OUT. */
	static int
	do_compressed( IOBUF out, int ctb, PKT_compressed *cd )
	{
	int rc = 0;

	log_assert (ctb_pkttype (ctb) == PKT_COMPRESSED);

	/* We must use the old convention and don't use blockmode for the
	sake of PGP 2 compatibility. However if the new_ctb flag was
	set, CTB is already formatted as new style and write_header2
	does create a partial length encoding using new the new
	style. */
	write_header2(out, ctb, 0, 0);
	iobuf_put(out, cd->algorithm );

	/* This is all. The caller has to write the real data */

	return rc;
	}


	/****************
	* Delete all subpackets of type REQTYPE and return a bool whether a packet
	* was deleted.
	*/
	int
	delete_sig_subpkt (subpktarea_t *area, sigsubpkttype_t reqtype )
	{
	int buflen;
	sigsubpkttype_t type;
	byte buffer, bufstart;
	size_t n;
	size_t unused = 0;
	int okay = 0;

	if( !area )
	return 0;
	buflen = area->len;
	buffer = area->data;
	for(;;) {
	if( !buflen ) {
	okay = 1;
	break;
	}
	bufstart = buffer;
	n = *buffer++; buflen--;
	if( n == 255 ) {
	if( buflen < 4 )
	break;
	n = buf32_to_size_t (buffer);
	buffer += 4;
	buflen -= 4;
	}
	else if( n >= 192 ) {
	if( buflen < 2 )
	break;
	n = (( n - 192 ) << 8) + *buffer + 192;
	buffer++;
	buflen--;
	}
	if( buflen < n )
	break;

	type = *buffer & 0x7f;
	if( type == reqtype ) {
	buffer++;
	buflen--;
	n--;
	if( n > buflen )
	break;
	buffer += n; /* point to next subpkt */
	buflen -= n;
	memmove (bufstart, buffer, buflen); /* shift */
	unused += buffer - bufstart;
	buffer = bufstart;
	}
	else {
	buffer += n; buflen -=n;
	}
	}

	if (!okay)
	log_error ("delete_subpkt: buffer shorter than subpacket\n");
	log_assert (unused <= area->len);
	area->len -= unused;
	return !!unused;
	}


	/****************
	* Create or update a signature subpacket for SIG of TYPE. This
	* functions knows where to put the data (hashed or unhashed). The
	* function may move data from the unhashed part to the hashed one.
	* Note: All pointers into sig->[un]hashed (e.g. returned by
	* parse_sig_subpkt) are not valid after a call to this function. The
	* data to put into the subpaket should be in a buffer with a length
	* of buflen.
	*/
	void
	build_sig_subpkt (PKT_signature *sig, sigsubpkttype_t type,
	const byte *buffer, size_t buflen )
	{
	byte *p;
	int critical, hashed;
	subpktarea_t oldarea, newarea;
	size_t nlen, n, n0;

	critical = (type & SIGSUBPKT_FLAG_CRITICAL);
	type &= ~SIGSUBPKT_FLAG_CRITICAL;

	/* Sanity check buffer sizes */
	if(parse_one_sig_subpkt(buffer,buflen,type)<0)
	BUG();

	switch(type)
	{
	case SIGSUBPKT_NOTATION:
	case SIGSUBPKT_POLICY:
	case SIGSUBPKT_REV_KEY:
	case SIGSUBPKT_SIGNATURE:
	/* we do allow multiple subpackets */
	break;

	default:
	/* we don't allow multiple subpackets */
	delete_sig_subpkt(sig->hashed,type);
	delete_sig_subpkt(sig->unhashed,type);
	break;
	}

	/* Any special magic that needs to be done for this type so the
	packet doesn't need to be reparsed? */
	switch(type)
	{
	case SIGSUBPKT_NOTATION:
	sig->flags.notation=1;
	break;

	case SIGSUBPKT_POLICY:
	sig->flags.policy_url=1;
	break;

	case SIGSUBPKT_PREF_KS:
	sig->flags.pref_ks=1;
	break;

	case SIGSUBPKT_EXPORTABLE:
	if(buffer[0])
	sig->flags.exportable=1;
	else
	sig->flags.exportable=0;
	break;

	case SIGSUBPKT_REVOCABLE:
	if(buffer[0])
	sig->flags.revocable=1;
	else
	sig->flags.revocable=0;
	break;

	case SIGSUBPKT_TRUST:
	sig->trust_depth=buffer[0];
	sig->trust_value=buffer[1];
	break;

	case SIGSUBPKT_REGEXP:
	sig->trust_regexp=buffer;
	break;

	/* This should never happen since we don't currently allow
	creating such a subpacket, but just in case... */
	case SIGSUBPKT_SIG_EXPIRE:
	if(buf32_to_u32(buffer)+sig->timestamp<=make_timestamp())
	sig->flags.expired=1;
	else
	sig->flags.expired=0;
	break;

	default:
	break;
	}

	if( (buflen+1) >= 8384 )
	nlen = 5; /* write 5 byte length header */
	else if( (buflen+1) >= 192 )
	nlen = 2; /* write 2 byte length header */
	else
	nlen = 1; /* just a 1 byte length header */

	switch( type )
	{
	/* The issuer being unhashed is a historical oddity. It
	should work equally as well hashed. Of course, if even an
	unhashed issuer is tampered with, it makes it awfully hard
	to verify the sig... */
	case SIGSUBPKT_ISSUER:
	case SIGSUBPKT_SIGNATURE:
	hashed = 0;
	break;
	default:
	hashed = 1;
	break;
	}

	if( critical )
	type \|= SIGSUBPKT_FLAG_CRITICAL;

	oldarea = hashed? sig->hashed : sig->unhashed;

	/* Calculate new size of the area and allocate */
	n0 = oldarea? oldarea->len : 0;
	n = n0 + nlen + 1 + buflen; /* length, type, buffer */
	if (oldarea && n <= oldarea->size) { /* fits into the unused space */
	newarea = oldarea;
	/log_debug ("updating area for type %d\n", type );/
	}
	else if (oldarea) {
	newarea = xrealloc (oldarea, sizeof (*newarea) + n - 1);
	newarea->size = n;
	/log_debug ("reallocating area for type %d\n", type );/
	}
	else {
	newarea = xmalloc (sizeof (*newarea) + n - 1);
	newarea->size = n;
	/log_debug ("allocating area for type %d\n", type );/
	}
	newarea->len = n;

	p = newarea->data + n0;
	if (nlen == 5) {
	*p++ = 255;
	*p++ = (buflen+1) >> 24;
	*p++ = (buflen+1) >> 16;
	*p++ = (buflen+1) >> 8;
	*p++ = (buflen+1);
	*p++ = type;
	memcpy (p, buffer, buflen);
	}
	else if (nlen == 2) {
	*p++ = (buflen+1-192) / 256 + 192;
	*p++ = (buflen+1-192) % 256;
	*p++ = type;
	memcpy (p, buffer, buflen);
	}
	else {
	*p++ = buflen+1;
	*p++ = type;
	memcpy (p, buffer, buflen);
	}

	if (hashed)
	sig->hashed = newarea;
	else
	sig->unhashed = newarea;
	}

	/*
	* Put all the required stuff from SIG into subpackets of sig.
	* PKSK is the signing key.
	* Hmmm, should we delete those subpackets which are in a wrong area?
	*/
	void
	build_sig_subpkt_from_sig (PKT_signature sig, PKT_public_key pksk)
	{
	u32 u;
	byte buf[1+MAX_FINGERPRINT_LEN];
	size_t fprlen;

	/* For v4 keys we need to write the ISSUER subpacket. We do not
	* want that for a future v5 format. */
	if (pksk->version < 5)
	{
	u = sig->keyid[0];
	buf[0] = (u >> 24) & 0xff;
	buf[1] = (u >> 16) & 0xff;
	buf[2] = (u >> 8) & 0xff;
	buf[3] = u & 0xff;
	u = sig->keyid[1];
	buf[4] = (u >> 24) & 0xff;
	buf[5] = (u >> 16) & 0xff;
	buf[6] = (u >> 8) & 0xff;
	buf[7] = u & 0xff;
	build_sig_subpkt (sig, SIGSUBPKT_ISSUER, buf, 8);
	}

	/* Write the new ISSUER_FPR subpacket. */
	fingerprint_from_pk (pksk, buf+1, &fprlen);
	if (fprlen == 20)
	{
	buf[0] = pksk->version;
	build_sig_subpkt (sig, SIGSUBPKT_ISSUER_FPR, buf, 21);
	}

	/* Write the timestamp. */
	u = sig->timestamp;
	buf[0] = (u >> 24) & 0xff;
	buf[1] = (u >> 16) & 0xff;
	buf[2] = (u >> 8) & 0xff;
	buf[3] = u & 0xff;
	build_sig_subpkt( sig, SIGSUBPKT_SIG_CREATED, buf, 4 );

	if(sig->expiredate)
	{
	if(sig->expiredate>sig->timestamp)
	u=sig->expiredate-sig->timestamp;
	else
	u=1; /* A 1-second expiration time is the shortest one
	OpenPGP has */

	buf[0] = (u >> 24) & 0xff;
	buf[1] = (u >> 16) & 0xff;
	buf[2] = (u >> 8) & 0xff;
	buf[3] = u & 0xff;

	/* Mark this CRITICAL, so if any implementation doesn't
	understand sigs that can expire, it'll just disregard this
	sig altogether. */

	build_sig_subpkt( sig, SIGSUBPKT_SIG_EXPIRE \| SIGSUBPKT_FLAG_CRITICAL,
	buf, 4 );
	}
	}

	void
	build_attribute_subpkt(PKT_user_id *uid,byte type,
	const void *buf,u32 buflen,
	const void *header,u32 headerlen)
	{
	byte *attrib;
	int idx;

	if(1+headerlen+buflen>8383)
	idx=5;
	else if(1+headerlen+buflen>191)
	idx=2;
	else
	idx=1;

	/* realloc uid->attrib_data to the right size */

	uid->attrib_data=xrealloc(uid->attrib_data,
	uid->attrib_len+idx+1+headerlen+buflen);

	attrib=&uid->attrib_data[uid->attrib_len];

	if(idx==5)
	{
	attrib[0]=255;
	attrib[1]=(1+headerlen+buflen) >> 24;
	attrib[2]=(1+headerlen+buflen) >> 16;
	attrib[3]=(1+headerlen+buflen) >> 8;
	attrib[4]=1+headerlen+buflen;
	}
	else if(idx==2)
	{
	attrib[0]=(1+headerlen+buflen-192) / 256 + 192;
	attrib[1]=(1+headerlen+buflen-192) % 256;
	}
	else
	attrib[0]=1+headerlen+buflen; /* Good luck finding a JPEG this small! */

	attrib[idx++]=type;

	/* Tack on our data at the end */

	if(headerlen>0)
	memcpy(&attrib[idx],header,headerlen);
	memcpy(&attrib[idx+headerlen],buf,buflen);
	uid->attrib_len+=idx+headerlen+buflen;
	}

	/* Returns a human-readable string corresponding to the notation.
	This ignores notation->value. The caller must free the result. */
	static char *
	notation_value_to_human_readable_string (struct notation *notation)
	{
	if(notation->bdat)
	/* Binary data. */
	{
	size_t len = notation->blen;
	int i;
	char preview[20];

	for (i = 0; i < len && i < sizeof (preview) - 1; i ++)
	if (isprint (notation->bdat[i]))
	preview[i] = notation->bdat[i];
	else
	preview[i] = '?';
	preview[i] = 0;

	return xasprintf (_("[ not human readable (%zu bytes: %s%s) ]"),
	len, preview, i < len ? "..." : "");
	}
	else
	/* The value is human-readable. */
	return xstrdup (notation->value);
	}

	/* Turn the notation described by the string STRING into a notation.

	STRING has the form:

	- -name - Delete the notation.
	- name@domain.name=value - Normal notation
	- !name@domain.name=value - Notation with critical bit set.

	The caller must free the result using free_notation(). */
	struct notation *
	string_to_notation(const char *string,int is_utf8)
	{
	const char *s;
	int saw_at=0;
	struct notation *notation;

	notation=xmalloc_clear(sizeof(*notation));

	if(*string=='-')
	{
	notation->flags.ignore=1;
	string++;
	}

	if(*string=='!')
	{
	notation->flags.critical=1;
	string++;
	}

	/* If and when the IETF assigns some official name tags, we'll have
	to add them here. */

	for( s=string ; *s != '='; s++ )
	{
	if( *s=='@')
	saw_at++;

	/* -notationname is legal without an = sign */
	if(!*s && notation->flags.ignore)
	break;

	if( !s \|\| !isascii (s) \|\| (!isgraph(s) && !isspace(s)) )
	{
	log_error(_("a notation name must have only printable characters"
	" or spaces, and end with an '='\n") );
	goto fail;
	}
	}

	notation->name=xmalloc((s-string)+1);
	strncpy(notation->name,string,s-string);
	notation->name[s-string]='\0';

	if(!saw_at && !opt.expert)
	{
	log_error(_("a user notation name must contain the '@' character\n"));
	goto fail;
	}

	if (saw_at > 1)
	{
	log_error(_("a notation name must not contain more than"
	" one '@' character\n"));
	goto fail;
	}

	if(*s)
	{
	const char *i=s+1;
	int highbit=0;

	/* we only support printable text - therefore we enforce the use
	of only printable characters (an empty value is valid) */
	for(s++; *s ; s++ )
	{
	if ( !isascii (*s) )
	highbit=1;
	else if (iscntrl(*s))
	{
	log_error(_("a notation value must not use any"
	" control characters\n"));
	goto fail;
	}
	}

	if(!highbit \|\| is_utf8)
	notation->value=xstrdup(i);
	else
	notation->value=native_to_utf8(i);
	}

	return notation;

	fail:
	free_notation(notation);
	return NULL;
	}

	/* Like string_to_notation, but store opaque data rather than human
	readable data. */
	struct notation *
	blob_to_notation(const char name, const char data, size_t len)
	{
	const char *s;
	int saw_at=0;
	struct notation *notation;

	notation=xmalloc_clear(sizeof(*notation));

	if(*name=='-')
	{
	notation->flags.ignore=1;
	name++;
	}

	if(*name=='!')
	{
	notation->flags.critical=1;
	name++;
	}

	/* If and when the IETF assigns some official name tags, we'll have
	to add them here. */

	for( s=name ; *s; s++ )
	{
	if( *s=='@')
	saw_at++;

	/* -notationname is legal without an = sign */
	if(!*s && notation->flags.ignore)
	break;

	if (*s == '=')
	{
	log_error(_("a notation name may not contain an '=' character\n"));
	goto fail;
	}

	if (!isascii (s) \|\| (!isgraph(s) && !isspace(*s)))
	{
	log_error(_("a notation name must have only printable characters"
	" or spaces\n") );
	goto fail;
	}
	}

	notation->name=xstrdup (name);

	if(!saw_at && !opt.expert)
	{
	log_error(_("a user notation name must contain the '@' character\n"));
	goto fail;
	}

	if (saw_at > 1)
	{
	log_error(_("a notation name must not contain more than"
	" one '@' character\n"));
	goto fail;
	}

	notation->bdat = xmalloc (len);
	memcpy (notation->bdat, data, len);
	notation->blen = len;

	notation->value = notation_value_to_human_readable_string (notation);

	return notation;

	fail:
	free_notation(notation);
	return NULL;
	}

	struct notation *
	sig_to_notation(PKT_signature *sig)
	{
	const byte *p;
	size_t len;
	int seq = 0;
	int crit;
	notation_t list = NULL;

	/* See RFC 4880, 5.2.3.16 for the format of notation data. In
	short, a notation has:

	- 4 bytes of flags
	- 2 byte name length (n1)
	- 2 byte value length (n2)
	- n1 bytes of name data
	- n2 bytes of value data
	*/
	while((p=enum_sig_subpkt(sig->hashed,SIGSUBPKT_NOTATION,&len,&seq,&crit)))
	{
	int n1,n2;
	struct notation *n=NULL;

	if(len<8)
	{
	log_info(_("WARNING: invalid notation data found\n"));
	continue;
	}

	/* name length. */
	n1=(p[4]<<8)\|p[5];
	/* value length. */
	n2=(p[6]<<8)\|p[7];

	if(8+n1+n2!=len)
	{
	log_info(_("WARNING: invalid notation data found\n"));
	continue;
	}

	n=xmalloc_clear(sizeof(*n));
	n->name=xmalloc(n1+1);

	memcpy(n->name,&p[8],n1);
	n->name[n1]='\0';

	if(p[0]&0x80)
	/* The value is human-readable. */
	{
	n->value=xmalloc(n2+1);
	memcpy(n->value,&p[8+n1],n2);
	n->value[n2]='\0';
	n->flags.human = 1;
	}
	else
	/* Binary data. */
	{
	n->bdat=xmalloc(n2);
	n->blen=n2;
	memcpy(n->bdat,&p[8+n1],n2);

	n->value = notation_value_to_human_readable_string (n);
	}

	n->flags.critical=crit;

	n->next=list;
	list=n;
	}

	return list;
	}

	/* Release the resources associated with the list of notations. To
	release a single notation, make sure that notation->next is
	NULL. */
	void
	free_notation(struct notation *notation)
	{
	while(notation)
	{
	struct notation *n=notation;

	xfree(n->name);
	xfree(n->value);
	xfree(n->altvalue);
	xfree(n->bdat);
	notation=n->next;
	xfree(n);
	}
	}

	/* Serialize the signature packet (RFC 4880, Section 5.2) described by
	SIG and write it to OUT. */
	static int
	do_signature( IOBUF out, int ctb, PKT_signature *sig )
	{
	int rc = 0;
	int n, i;
	IOBUF a = iobuf_temp();

	log_assert (ctb_pkttype (ctb) == PKT_SIGNATURE);

	if ( !sig->version \|\| sig->version == 3)
	{
	iobuf_put( a, 3 );

	/* Version 3 packets don't support subpackets. */
	log_assert (! sig->hashed);
	log_assert (! sig->unhashed);
	}
	else
	iobuf_put( a, sig->version );
	if ( sig->version < 4 )
	iobuf_put (a, 5 ); /* Constant */
	iobuf_put (a, sig->sig_class );
	if ( sig->version < 4 )
	{
	write_32(a, sig->timestamp );
	write_32(a, sig->keyid[0] );
	write_32(a, sig->keyid[1] );
	}
	iobuf_put(a, sig->pubkey_algo );
	iobuf_put(a, sig->digest_algo );
	if ( sig->version >= 4 )
	{
	size_t nn;
	/* Timestamp and keyid must have been packed into the subpackets
	prior to the call of this function, because these subpackets
	are hashed. */
	nn = sig->hashed? sig->hashed->len : 0;
	write_16(a, nn);
	if (nn)
	iobuf_write( a, sig->hashed->data, nn );
	nn = sig->unhashed? sig->unhashed->len : 0;
	write_16(a, nn);
	if (nn)
	iobuf_write( a, sig->unhashed->data, nn );
	}
	iobuf_put(a, sig->digest_start[0] );
	iobuf_put(a, sig->digest_start[1] );
	n = pubkey_get_nsig( sig->pubkey_algo );
	if ( !n )
	write_fake_data( a, sig->data[0] );
	for (i=0; i < n && !rc ; i++ )
	rc = gpg_mpi_write (a, sig->data[i] );

	if (!rc)
	{
	if ( is_RSA(sig->pubkey_algo) && sig->version < 4 )
	write_sign_packet_header(out, ctb, iobuf_get_temp_length(a) );
	else
	write_header(out, ctb, iobuf_get_temp_length(a) );
	rc = iobuf_write_temp( out, a );
	}

	iobuf_close(a);
	return rc;
	}


	/* Serialize the one-pass signature packet (RFC 4880, Section 5.4)
	described by OPS and write it to OUT. */
	static int
	do_onepass_sig( IOBUF out, int ctb, PKT_onepass_sig *ops )
	{
	log_assert (ctb_pkttype (ctb) == PKT_ONEPASS_SIG);

	write_header(out, ctb, 4 + 8 + 1);

	iobuf_put (out, 3); /* Version. */
	iobuf_put(out, ops->sig_class );
	iobuf_put(out, ops->digest_algo );
	iobuf_put(out, ops->pubkey_algo );
	write_32(out, ops->keyid[0] );
	write_32(out, ops->keyid[1] );
	iobuf_put(out, ops->last );

	return 0;
	}


	/* Write a 16-bit quantity to OUT in big endian order. */
	static int
	write_16(IOBUF out, u16 a)
	{
	iobuf_put(out, a>>8);
	if( iobuf_put(out,a) )
	return -1;
	return 0;
	}

	/* Write a 32-bit quantity to OUT in big endian order. */
	static int
	write_32(IOBUF out, u32 a)
	{
	iobuf_put(out, a>> 24);
	iobuf_put(out, a>> 16);
	iobuf_put(out, a>> 8);
	return iobuf_put(out, a);
	}


	/****************
	* calculate the length of a header.
	*
	* LEN is the length of the packet's body. NEW_CTB is whether we are
	* using a new or old format packet.
	*
	* This function does not handle indeterminate lengths or partial body
	* lengths. (If you pass LEN as 0, then this function assumes you
	* really mean an empty body.)
	*/
	static int
	calc_header_length( u32 len, int new_ctb )
	{
	if( new_ctb ) {
	if( len < 192 )
	return 2;
	if( len < 8384 )
	return 3;
	else
	return 6;
	}
	if( len < 256 )
	return 2;
	if( len < 65536 )
	return 3;

	return 5;
	}

	/****************
	* Write the CTB and the packet length
	*/
	static int
	write_header( IOBUF out, int ctb, u32 len )
	{
	return write_header2( out, ctb, len, 0 );
	}


	static int
	write_sign_packet_header (IOBUF out, int ctb, u32 len)
	{
	(void)ctb;

	/* Work around a bug in the pgp read function for signature packets,
	which are not correctly coded and silently assume at some point 2
	byte length headers.*/
	iobuf_put (out, 0x89 );
	iobuf_put (out, len >> 8 );
	return iobuf_put (out, len) == -1 ? -1:0;
	}

	/****************
	* Write a packet header to OUT.
	*
	* CTB is the ctb. It determines whether a new or old format packet
	* header should be written. The length field is adjusted, but the
	* CTB is otherwise written out as is.
	*
	* LEN is the length of the packet's body.
	*
	* If HDRLEN is set, then we don't necessarily use the most efficient
	* encoding to store LEN, but the specified length. (If this is not
	* possible, this is a bug.) In this case, LEN=0 means a 0 length
	* packet. Note: setting HDRLEN is only supported for old format
	* packets!
	*
	* If HDRLEN is not set, then the shortest encoding is used. In this
	* case, LEN=0 means the body has an indeterminate length and a
	* partial body length header (if a new format packet) or an
	* indeterminate length header (if an old format packet) is written
	* out. Further, if using partial body lengths, this enables partial
	* body length mode on OUT.
	*/
	static int
	write_header2( IOBUF out, int ctb, u32 len, int hdrlen )
	{
	if (ctb_new_format_p (ctb))
	return write_new_header( out, ctb, len, hdrlen );

	/* An old format packet. Refer to RFC 4880, Section 4.2.1 to
	understand how lengths are encoded in this case. */

	/* The length encoding is stored in the two least significant bits.
	Make sure they are cleared. */
	log_assert ((ctb & 3) == 0);

	log_assert (hdrlen == 0 \|\| hdrlen == 2 \|\| hdrlen == 3 \|\| hdrlen == 5);

	if (hdrlen)
	/* Header length is given. */
	{
	if( hdrlen == 2 && len < 256 )
	/* 00 => 1 byte length. */
	;
	else if( hdrlen == 3 && len < 65536 )
	/* 01 => 2 byte length. If len < 256, this is not the most
	compact encoding, but it is a correct encoding. */
	ctb \|= 1;
	else if (hdrlen == 5)
	/* 10 => 4 byte length. If len < 65536, this is not the most
	compact encoding, but it is a correct encoding. */
	ctb \|= 2;
	else
	log_bug ("Can't encode length=%d in a %d byte header!\n",
	len, hdrlen);
	}
	else
	{
	if( !len )
	/* 11 => Indeterminate length. */
	ctb \|= 3;
	else if( len < 256 )
	/* 00 => 1 byte length. */
	;
	else if( len < 65536 )
	/* 01 => 2 byte length. */
	ctb \|= 1;
	else
	/* 10 => 4 byte length. */
	ctb \|= 2;
	}

	if( iobuf_put(out, ctb ) )
	return -1;

	if( len \|\| hdrlen )
	{
	if( ctb & 2 )
	{
	if(iobuf_put(out, len >> 24 ))
	return -1;
	if(iobuf_put(out, len >> 16 ))
	return -1;
	}

	if( ctb & 3 )
	if(iobuf_put(out, len >> 8 ))
	return -1;

	if( iobuf_put(out, len ) )
	return -1;
	}

	return 0;
	}


	/* Write a new format header to OUT.

	CTB is the ctb.

	LEN is the length of the packet's body. If LEN is 0, then enables
	partial body length mode (i.e., the body is of an indeterminant
	length) on OUT. Note: this function cannot be used to generate a
	header for a zero length packet.

	HDRLEN is the length of the packet's header. If HDRLEN is 0, the
	shortest encoding is chosen based on the length of the packet's
	body. Currently, values other than 0 are not supported.

	Returns 0 on success. */
	static int
	write_new_header( IOBUF out, int ctb, u32 len, int hdrlen )
	{
	if( hdrlen )
	log_bug("can't cope with hdrlen yet\n");

	if( iobuf_put(out, ctb ) )
	return -1;
	if( !len ) {
	iobuf_set_partial_body_length_mode(out, 512 );
	}
	else {
	if( len < 192 ) {
	if( iobuf_put(out, len ) )
	return -1;
	}
	else if( len < 8384 ) {
	len -= 192;
	if( iobuf_put( out, (len / 256) + 192) )
	return -1;
	if( iobuf_put( out, (len % 256) ) )
	return -1;
	}
	else {
	if( iobuf_put( out, 0xff ) )
	return -1;
	if( iobuf_put( out, (len >> 24)&0xff ) )
	return -1;
	if( iobuf_put( out, (len >> 16)&0xff ) )
	return -1;
	if( iobuf_put( out, (len >> 8)&0xff ) )
	return -1;
	if( iobuf_put( out, len & 0xff ) )
	return -1;
	}
	}
	return 0;
	}
	diff --git a/g10/call-agent.c b/g10/call-agent.c
	index 335e12a01..7c30bdbff 100644
	--- a/g10/call-agent.c
	+++ b/g10/call-agent.c
	@@ -1,2310 +1,2310 @@
	/* call-agent.c - Divert GPG operations to the agent.
	* Copyright (C) 2001-2003, 2006-2011, 2013 Free Software Foundation, Inc.
	* Copyright (C) 2013-2015 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif

	#include "gpg.h"
	#include <assuan.h>
	#include "util.h"
	#include "membuf.h"
	#include "options.h"
	#include "i18n.h"
	#include "asshelp.h"
	#include "sysutils.h"
	#include "call-agent.h"
	#include "status.h"
	#include "../common/shareddefs.h"
	#include "host2net.h"

	#define CONTROL_D ('D' - 'A' + 1)


	static assuan_context_t agent_ctx = NULL;
	static int did_early_card_test;

	struct default_inq_parm_s
	{
	ctrl_t ctrl;
	assuan_context_t ctx;
	struct {
	u32 *keyid;
	u32 *mainkeyid;
	int pubkey_algo;
	} keyinfo;
	};

	struct cipher_parm_s
	{
	struct default_inq_parm_s *dflt;
	assuan_context_t ctx;
	unsigned char *ciphertext;
	size_t ciphertextlen;
	};

	struct writecert_parm_s
	{
	struct default_inq_parm_s *dflt;
	const unsigned char *certdata;
	size_t certdatalen;
	};

	struct writekey_parm_s
	{
	struct default_inq_parm_s *dflt;
	const unsigned char *keydata;
	size_t keydatalen;
	};

	struct genkey_parm_s
	{
	struct default_inq_parm_s *dflt;
	const char *keyparms;
	const char *passphrase;
	};

	struct import_key_parm_s
	{
	struct default_inq_parm_s *dflt;
	const void *key;
	size_t keylen;
	};


	struct cache_nonce_parm_s
	{
	char **cache_nonce_addr;
	char **passwd_nonce_addr;
	};


	static gpg_error_t learn_status_cb (void opaque, const char line);



	/* If RC is not 0, write an appropriate status message. */
	static void
	status_sc_op_failure (int rc)
	{
	switch (gpg_err_code (rc))
	{
	case 0:
	break;
	case GPG_ERR_CANCELED:
	case GPG_ERR_FULLY_CANCELED:
	write_status_text (STATUS_SC_OP_FAILURE, "1");
	break;
	case GPG_ERR_BAD_PIN:
	write_status_text (STATUS_SC_OP_FAILURE, "2");
	break;
	default:
	write_status (STATUS_SC_OP_FAILURE);
	break;
	}
	}


	/* This is the default inquiry callback. It mainly handles the
	Pinentry notifications. */
	static gpg_error_t
	default_inq_cb (void opaque, const char line)
	{
	gpg_error_t err = 0;
	struct default_inq_parm_s *parm = opaque;

	if (has_leading_keyword (line, "PINENTRY_LAUNCHED"))
	{
	err = gpg_proxy_pinentry_notify (parm->ctrl, line);
	if (err)
	log_error (_("failed to proxy %s inquiry to client\n"),
	"PINENTRY_LAUNCHED");
	/* We do not pass errors to avoid breaking other code. */
	}
	else if ((has_leading_keyword (line, "PASSPHRASE")
	\|\| has_leading_keyword (line, "NEW_PASSPHRASE"))
	&& opt.pinentry_mode == PINENTRY_MODE_LOOPBACK)
	{
	if (have_static_passphrase ())
	{
	const char *s = get_static_passphrase ();
	err = assuan_send_data (parm->ctx, s, strlen (s));
	}
	else
	{
	char *pw;
	char buf[32];

	if (parm->keyinfo.keyid)
	emit_status_need_passphrase (parm->keyinfo.keyid,
	parm->keyinfo.mainkeyid,
	parm->keyinfo.pubkey_algo);

	snprintf (buf, sizeof (buf), "%u", 100);
	write_status_text (STATUS_INQUIRE_MAXLEN, buf);
	pw = cpr_get_hidden ("passphrase.enter", _("Enter passphrase: "));
	cpr_kill_prompt ();
	if (*pw == CONTROL_D && !pw[1])
	err = gpg_error (GPG_ERR_CANCELED);
	else
	err = assuan_send_data (parm->ctx, pw, strlen (pw));
	xfree (pw);
	}
	}
	else
	log_debug ("ignoring gpg-agent inquiry '%s'\n", line);

	return err;
	}


	/* Print a warning if the server's version number is less than our
	version number. Returns an error code on a connection problem. */
	static gpg_error_t
	warn_version_mismatch (assuan_context_t ctx, const char *servername, int mode)
	{
	gpg_error_t err;
	char *serverversion;
	const char *myversion = strusage (13);

	err = get_assuan_server_version (ctx, mode, &serverversion);
	if (err)
	log_error (_("error getting version from '%s': %s\n"),
	servername, gpg_strerror (err));
	else if (compare_version_strings (serverversion, myversion) < 0)
	{
	char *warn;

	warn = xtryasprintf (_("server '%s' is older than us (%s < %s)"),
	servername, serverversion, myversion);
	if (!warn)
	err = gpg_error_from_syserror ();
	else
	{
	log_info (_("WARNING: %s\n"), warn);
	write_status_strings (STATUS_WARNING, "server_version_mismatch 0",
	" ", warn, NULL);
	xfree (warn);
	}
	}
	xfree (serverversion);
	return err;
	}


	/* Try to connect to the agent via socket or fork it off and work by
	pipes. Handle the server's initial greeting */
	static int
	start_agent (ctrl_t ctrl, int for_card)
	{
	int rc;

	(void)ctrl; /* Not yet used. */

	/* Fixme: We need a context for each thread or serialize the access
	to the agent. */
	if (agent_ctx)
	rc = 0;
	else
	{
	rc = start_new_gpg_agent (&agent_ctx,
	GPG_ERR_SOURCE_DEFAULT,
	opt.agent_program,
	opt.lc_ctype, opt.lc_messages,
	opt.session_env,
	opt.autostart, opt.verbose, DBG_IPC,
	NULL, NULL);
	if (!opt.autostart && gpg_err_code (rc) == GPG_ERR_NO_AGENT)
	{
	static int shown;

	if (!shown)
	{
	shown = 1;
	log_info (_("no gpg-agent running in this session\n"));
	}
	}
	else if (!rc
	&& !(rc = warn_version_mismatch (agent_ctx, GPG_AGENT_NAME, 0)))
	{
	/* Tell the agent that we support Pinentry notifications.
	No error checking so that it will work also with older
	agents. */
	assuan_transact (agent_ctx, "OPTION allow-pinentry-notify",
	NULL, NULL, NULL, NULL, NULL, NULL);
	/* Tell the agent about what version we are aware. This is
	here used to indirectly enable GPG_ERR_FULLY_CANCELED. */
	assuan_transact (agent_ctx, "OPTION agent-awareness=2.1.0",
	NULL, NULL, NULL, NULL, NULL, NULL);
	/* Pass on the pinentry mode. */
	if (opt.pinentry_mode)
	{
	char *tmp = xasprintf ("OPTION pinentry-mode=%s",
	str_pinentry_mode (opt.pinentry_mode));
	rc = assuan_transact (agent_ctx, tmp,
	NULL, NULL, NULL, NULL, NULL, NULL);
	xfree (tmp);
	if (rc)
	{
	log_error ("setting pinentry mode '%s' failed: %s\n",
	str_pinentry_mode (opt.pinentry_mode),
	gpg_strerror (rc));
	write_status_error ("set_pinentry_mode", rc);
	}
	}
	}
	}

	if (!rc && for_card && !did_early_card_test)
	{
	/* Request the serial number of the card for an early test. */
	struct agent_card_info_s info;

	memset (&info, 0, sizeof info);

	rc = warn_version_mismatch (agent_ctx, SCDAEMON_NAME, 2);
	if (!rc)
	rc = assuan_transact (agent_ctx, "SCD SERIALNO openpgp",
	NULL, NULL, NULL, NULL,
	learn_status_cb, &info);
	if (rc)
	{
	switch (gpg_err_code (rc))
	{
	case GPG_ERR_NOT_SUPPORTED:
	case GPG_ERR_NO_SCDAEMON:
	write_status_text (STATUS_CARDCTRL, "6");
	break;
	case GPG_ERR_OBJ_TERM_STATE:
	write_status_text (STATUS_CARDCTRL, "7");
	break;
	default:
	write_status_text (STATUS_CARDCTRL, "4");
	log_info ("selecting openpgp failed: %s\n", gpg_strerror (rc));
	break;
	}
	}

	if (!rc && is_status_enabled () && info.serialno)
	{
	char *buf;

	buf = xasprintf ("3 %s", info.serialno);
	write_status_text (STATUS_CARDCTRL, buf);
	xfree (buf);
	}

	agent_release_card_info (&info);

	if (!rc)
	did_early_card_test = 1;
	}


	return rc;
	}


	/* Return a new malloced string by unescaping the string S. Escaping
	is percent escaping and '+'/space mapping. A binary nul will
	silently be replaced by a 0xFF. Function returns NULL to indicate
	an out of memory status. */
	static char *
	unescape_status_string (const unsigned char *s)
	{
	return percent_plus_unescape (s, 0xff);
	}


	-/* Take a 20 byte hexencoded string and put it into the the provided
	+/* Take a 20 byte hexencoded string and put it into the provided
	20 byte buffer FPR in binary format. */
	static int
	unhexify_fpr (const char hexstr, unsigned char fpr)
	{
	const char *s;
	int n;

	for (s=hexstr, n=0; hexdigitp (s); s++, n++)
	;
	if (*s \|\| (n != 40))
	return 0; /* no fingerprint (invalid or wrong length). */
	for (s=hexstr, n=0; *s; s += 2, n++)
	fpr[n] = xtoi_2 (s);
	return 1; /* okay */
	}

	/* Take the serial number from LINE and return it verbatim in a newly
	allocated string. We make sure that only hex characters are
	returned. */
	static char *
	store_serialno (const char *line)
	{
	const char *s;
	char *p;

	for (s=line; hexdigitp (s); s++)
	;
	p = xtrymalloc (s + 1 - line);
	if (p)
	{
	memcpy (p, line, s-line);
	p[s-line] = 0;
	}
	return p;
	}



	/* This is a dummy data line callback. */
	static gpg_error_t
	dummy_data_cb (void opaque, const void buffer, size_t length)
	{
	(void)opaque;
	(void)buffer;
	(void)length;
	return 0;
	}

	/* A simple callback used to return the serialnumber of a card. */
	static gpg_error_t
	get_serialno_cb (void opaque, const char line)
	{
	char **serialno = opaque;
	const char *keyword = line;
	const char *s;
	int keywordlen, n;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == 8 && !memcmp (keyword, "SERIALNO", keywordlen))
	{
	if (*serialno)
	return gpg_error (GPG_ERR_CONFLICT); /* Unexpected status line. */
	for (n=0,s=line; hexdigitp (s); s++, n++)
	;
	if (!n \|\| (n&1)\|\| !(spacep (s) \|\| !*s) )
	return gpg_error (GPG_ERR_ASS_PARAMETER);
	*serialno = xtrymalloc (n+1);
	if (!*serialno)
	return out_of_core ();
	memcpy (*serialno, line, n);
	(*serialno)[n] = 0;
	}

	return 0;
	}



	/* Release the card info structure INFO. */
	void
	agent_release_card_info (struct agent_card_info_s *info)
	{
	int i;

	if (!info)
	return;

	xfree (info->reader); info->reader = NULL;
	xfree (info->serialno); info->serialno = NULL;
	xfree (info->apptype); info->apptype = NULL;
	xfree (info->disp_name); info->disp_name = NULL;
	xfree (info->disp_lang); info->disp_lang = NULL;
	xfree (info->pubkey_url); info->pubkey_url = NULL;
	xfree (info->login_data); info->login_data = NULL;
	info->cafpr1valid = info->cafpr2valid = info->cafpr3valid = 0;
	info->fpr1valid = info->fpr2valid = info->fpr3valid = 0;
	for (i=0; i < DIM(info->private_do); i++)
	{
	xfree (info->private_do[i]);
	info->private_do[i] = NULL;
	}
	}


	static gpg_error_t
	learn_status_cb (void opaque, const char line)
	{
	struct agent_card_info_s *parm = opaque;
	const char *keyword = line;
	int keywordlen;
	int i;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == 6 && !memcmp (keyword, "READER", keywordlen))
	{
	xfree (parm->reader);
	parm->reader = unescape_status_string (line);
	}
	else if (keywordlen == 8 && !memcmp (keyword, "SERIALNO", keywordlen))
	{
	xfree (parm->serialno);
	parm->serialno = store_serialno (line);
	parm->is_v2 = (strlen (parm->serialno) >= 16
	&& xtoi_2 (parm->serialno+12) >= 2 );
	}
	else if (keywordlen == 7 && !memcmp (keyword, "APPTYPE", keywordlen))
	{
	xfree (parm->apptype);
	parm->apptype = unescape_status_string (line);
	}
	else if (keywordlen == 9 && !memcmp (keyword, "DISP-NAME", keywordlen))
	{
	xfree (parm->disp_name);
	parm->disp_name = unescape_status_string (line);
	}
	else if (keywordlen == 9 && !memcmp (keyword, "DISP-LANG", keywordlen))
	{
	xfree (parm->disp_lang);
	parm->disp_lang = unescape_status_string (line);
	}
	else if (keywordlen == 8 && !memcmp (keyword, "DISP-SEX", keywordlen))
	{
	parm->disp_sex = line == '1'? 1 : line == '2' ? 2: 0;
	}
	else if (keywordlen == 10 && !memcmp (keyword, "PUBKEY-URL", keywordlen))
	{
	xfree (parm->pubkey_url);
	parm->pubkey_url = unescape_status_string (line);
	}
	else if (keywordlen == 10 && !memcmp (keyword, "LOGIN-DATA", keywordlen))
	{
	xfree (parm->login_data);
	parm->login_data = unescape_status_string (line);
	}
	else if (keywordlen == 11 && !memcmp (keyword, "SIG-COUNTER", keywordlen))
	{
	parm->sig_counter = strtoul (line, NULL, 0);
	}
	else if (keywordlen == 10 && !memcmp (keyword, "CHV-STATUS", keywordlen))
	{
	char p, buf;

	buf = p = unescape_status_string (line);
	if (buf)
	{
	while (spacep (p))
	p++;
	parm->chv1_cached = atoi (p);
	while (*p && !spacep (p))
	p++;
	while (spacep (p))
	p++;
	for (i=0; *p && i < 3; i++)
	{
	parm->chvmaxlen[i] = atoi (p);
	while (*p && !spacep (p))
	p++;
	while (spacep (p))
	p++;
	}
	for (i=0; *p && i < 3; i++)
	{
	parm->chvretry[i] = atoi (p);
	while (*p && !spacep (p))
	p++;
	while (spacep (p))
	p++;
	}
	xfree (buf);
	}
	}
	else if (keywordlen == 6 && !memcmp (keyword, "EXTCAP", keywordlen))
	{
	char p, p2, *buf;
	int abool;

	buf = p = unescape_status_string (line);
	if (buf)
	{
	for (p = strtok (buf, " "); p; p = strtok (NULL, " "))
	{
	p2 = strchr (p, '=');
	if (p2)
	{
	*p2++ = 0;
	abool = (*p2 == '1');
	if (!strcmp (p, "ki"))
	parm->extcap.ki = abool;
	else if (!strcmp (p, "aac"))
	parm->extcap.aac = abool;
	else if (!strcmp (p, "si"))
	parm->status_indicator = strtoul (p2, NULL, 10);
	}
	}
	xfree (buf);
	}
	}
	else if (keywordlen == 7 && !memcmp (keyword, "KEY-FPR", keywordlen))
	{
	int no = atoi (line);
	while (*line && !spacep (line))
	line++;
	while (spacep (line))
	line++;
	if (no == 1)
	parm->fpr1valid = unhexify_fpr (line, parm->fpr1);
	else if (no == 2)
	parm->fpr2valid = unhexify_fpr (line, parm->fpr2);
	else if (no == 3)
	parm->fpr3valid = unhexify_fpr (line, parm->fpr3);
	}
	else if (keywordlen == 8 && !memcmp (keyword, "KEY-TIME", keywordlen))
	{
	int no = atoi (line);
	while (* line && !spacep (line))
	line++;
	while (spacep (line))
	line++;
	if (no == 1)
	parm->fpr1time = strtoul (line, NULL, 10);
	else if (no == 2)
	parm->fpr2time = strtoul (line, NULL, 10);
	else if (no == 3)
	parm->fpr3time = strtoul (line, NULL, 10);
	}
	else if (keywordlen == 6 && !memcmp (keyword, "CA-FPR", keywordlen))
	{
	int no = atoi (line);
	while (*line && !spacep (line))
	line++;
	while (spacep (line))
	line++;
	if (no == 1)
	parm->cafpr1valid = unhexify_fpr (line, parm->cafpr1);
	else if (no == 2)
	parm->cafpr2valid = unhexify_fpr (line, parm->cafpr2);
	else if (no == 3)
	parm->cafpr3valid = unhexify_fpr (line, parm->cafpr3);
	}
	else if (keywordlen == 8 && !memcmp (keyword, "KEY-ATTR", keywordlen))
	{
	int keyno = 0;
	int algo = PUBKEY_ALGO_RSA;
	int n = 0;

	sscanf (line, "%d %d %n", &keyno, &algo, &n);
	keyno--;
	if (keyno < 0 \|\| keyno >= DIM (parm->key_attr))
	return 0;

	parm->key_attr[keyno].algo = algo;
	if (algo == PUBKEY_ALGO_RSA)
	parm->key_attr[keyno].nbits = strtoul (line+n+3, NULL, 10);
	else if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA)
	parm->key_attr[keyno].curve = openpgp_is_curve_supported (line + n,
	NULL, NULL);
	}
	else if (keywordlen == 12 && !memcmp (keyword, "PRIVATE-DO-", 11)
	&& strchr("1234", keyword[11]))
	{
	int no = keyword[11] - '1';
	log_assert (no >= 0 && no <= 3);
	xfree (parm->private_do[no]);
	parm->private_do[no] = unescape_status_string (line);
	}

	return 0;
	}

	/* Call the scdaemon to learn about a smartcard */
	int
	agent_scd_learn (struct agent_card_info_s *info, int force)
	{
	int rc;
	struct default_inq_parm_s parm;
	struct agent_card_info_s dummyinfo;

	if (!info)
	info = &dummyinfo;
	memset (info, 0, sizeof *info);
	memset (&parm, 0, sizeof parm);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	/* Send the serialno command to initialize the connection. We don't
	care about the data returned. If the card has already been
	initialized, this is a very fast command. The main reason we
	need to do this here is to handle a card removed case so that an
	"l" command in --edit-card can be used to show ta newly inserted
	card. We request the openpgp card because that is what we
	expect. */
	rc = assuan_transact (agent_ctx, "SCD SERIALNO openpgp",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (rc)
	return rc;

	parm.ctx = agent_ctx;
	rc = assuan_transact (agent_ctx,
	force ? "LEARN --sendinfo --force" : "LEARN --sendinfo",
	dummy_data_cb, NULL, default_inq_cb, &parm,
	learn_status_cb, info);
	/* Also try to get the key attributes. */
	if (!rc)
	agent_scd_getattr ("KEY-ATTR", info);

	if (info == &dummyinfo)
	agent_release_card_info (info);

	return rc;
	}


	/* Send an APDU to the current card. On success the status word is
	stored at R_SW. With HEXAPDU being NULL only a RESET command is
	send to scd. With HEXAPDU being the string "undefined" the command
	"SERIALNO undefined" is send to scd. */
	gpg_error_t
	agent_scd_apdu (const char hexapdu, unsigned int r_sw)
	{
	gpg_error_t err;

	/* Start the agent but not with the card flag so that we do not
	autoselect the openpgp application. */
	err = start_agent (NULL, 0);
	if (err)
	return err;

	if (!hexapdu)
	{
	err = assuan_transact (agent_ctx, "SCD RESET",
	NULL, NULL, NULL, NULL, NULL, NULL);

	}
	else if (!strcmp (hexapdu, "undefined"))
	{
	err = assuan_transact (agent_ctx, "SCD SERIALNO undefined",
	NULL, NULL, NULL, NULL, NULL, NULL);
	}
	else
	{
	char line[ASSUAN_LINELENGTH];
	membuf_t mb;
	unsigned char *data;
	size_t datalen;

	init_membuf (&mb, 256);

	snprintf (line, DIM(line), "SCD APDU %s", hexapdu);
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &mb, NULL, NULL, NULL, NULL);
	if (!err)
	{
	data = get_membuf (&mb, &datalen);
	if (!data)
	err = gpg_error_from_syserror ();
	else if (datalen < 2) /* Ooops */
	err = gpg_error (GPG_ERR_CARD);
	else
	{
	*r_sw = buf16_to_uint (data+datalen-2);
	}
	xfree (data);
	}
	}

	return err;
	}


	int
	agent_keytocard (const char *hexgrip, int keyno, int force,
	const char serialno, const char timestamp)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s parm;

	memset (&parm, 0, sizeof parm);

	snprintf (line, DIM(line), "KEYTOCARD %s%s %s OPENPGP.%d %s",
	force?"--force ": "", hexgrip, serialno, keyno, timestamp);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;
	parm.ctx = agent_ctx;

	rc = assuan_transact (agent_ctx, line, NULL, NULL, default_inq_cb, &parm,
	NULL, NULL);
	if (rc)
	return rc;

	return rc;
	}

	/* Call the agent to retrieve a data object. This function returns
	the data in the same structure as used by the learn command. It is
	allowed to update such a structure using this commmand. */
	int
	agent_scd_getattr (const char name, struct agent_card_info_s info)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s parm;

	memset (&parm, 0, sizeof parm);

	if (!*name)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* We assume that NAME does not need escaping. */
	if (12 + strlen (name) > DIM(line)-1)
	return gpg_error (GPG_ERR_TOO_LARGE);
	stpcpy (stpcpy (line, "SCD GETATTR "), name);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	parm.ctx = agent_ctx;
	rc = assuan_transact (agent_ctx, line, NULL, NULL, default_inq_cb, &parm,
	learn_status_cb, info);

	return rc;
	}


	/* Send an setattr command to the SCdaemon. SERIALNO is not actually
	used here but required by gpg 1.4's implementation of this code in
	cardglue.c. */
	int
	agent_scd_setattr (const char *name,
	const unsigned char *value, size_t valuelen,
	const char *serialno)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	char *p;
	struct default_inq_parm_s parm;

	memset (&parm, 0, sizeof parm);

	(void)serialno;

	if (!*name \|\| !valuelen)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* We assume that NAME does not need escaping. */
	if (12 + strlen (name) > DIM(line)-1)
	return gpg_error (GPG_ERR_TOO_LARGE);

	p = stpcpy (stpcpy (line, "SCD SETATTR "), name);
	*p++ = ' ';
	for (; valuelen; value++, valuelen--)
	{
	if (p >= line + DIM(line)-5 )
	return gpg_error (GPG_ERR_TOO_LARGE);
	if (value < ' ' \|\| value == '+' \|\| *value == '%')
	{
	sprintf (p, "%%%02X", *value);
	p += 3;
	}
	else if (*value == ' ')
	*p++ = '+';
	else
	p++ = value;
	}
	*p = 0;

	rc = start_agent (NULL, 1);
	if (!rc)
	{
	parm.ctx = agent_ctx;
	rc = assuan_transact (agent_ctx, line, NULL, NULL,
	default_inq_cb, &parm, NULL, NULL);
	}

	status_sc_op_failure (rc);
	return rc;
	}



	/* Handle a CERTDATA inquiry. Note, we only send the data,
	assuan_transact takes care of flushing and writing the END
	command. */
	static gpg_error_t
	inq_writecert_parms (void opaque, const char line)
	{
	int rc;
	struct writecert_parm_s *parm = opaque;

	if (has_leading_keyword (line, "CERTDATA"))
	{
	rc = assuan_send_data (parm->dflt->ctx,
	parm->certdata, parm->certdatalen);
	}
	else
	rc = default_inq_cb (parm->dflt, line);

	return rc;
	}


	/* Send a WRITECERT command to the SCdaemon. */
	int
	agent_scd_writecert (const char *certidstr,
	const unsigned char *certdata, size_t certdatalen)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct writecert_parm_s parms;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	memset (&parms, 0, sizeof parms);

	snprintf (line, DIM(line), "SCD WRITECERT %s", certidstr);
	dfltparm.ctx = agent_ctx;
	parms.dflt = &dfltparm;
	parms.certdata = certdata;
	parms.certdatalen = certdatalen;

	rc = assuan_transact (agent_ctx, line, NULL, NULL,
	inq_writecert_parms, &parms, NULL, NULL);

	return rc;
	}



	/* Handle a KEYDATA inquiry. Note, we only send the data,
	assuan_transact takes care of flushing and writing the end */
	static gpg_error_t
	inq_writekey_parms (void opaque, const char line)
	{
	int rc;
	struct writekey_parm_s *parm = opaque;

	if (has_leading_keyword (line, "KEYDATA"))
	{
	rc = assuan_send_data (parm->dflt->ctx, parm->keydata, parm->keydatalen);
	}
	else
	rc = default_inq_cb (parm->dflt, line);

	return rc;
	}


	/* Send a WRITEKEY command to the SCdaemon. */
	int
	agent_scd_writekey (int keyno, const char *serialno,
	const unsigned char *keydata, size_t keydatalen)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct writekey_parm_s parms;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	(void)serialno;

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	memset (&parms, 0, sizeof parms);

	snprintf (line, DIM(line), "SCD WRITEKEY --force OPENPGP.%d", keyno);
	dfltparm.ctx = agent_ctx;
	parms.dflt = &dfltparm;
	parms.keydata = keydata;
	parms.keydatalen = keydatalen;

	rc = assuan_transact (agent_ctx, line, NULL, NULL,
	inq_writekey_parms, &parms, NULL, NULL);

	status_sc_op_failure (rc);
	return rc;
	}



	/* Status callback for the SCD GENKEY command. */
	static gpg_error_t
	scd_genkey_cb (void opaque, const char line)
	{
	u32 *createtime = opaque;
	const char *keyword = line;
	int keywordlen;

	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	while (spacep (line))
	line++;

	if (keywordlen == 14 && !memcmp (keyword,"KEY-CREATED-AT", keywordlen))
	{
	*createtime = (u32)strtoul (line, NULL, 10);
	}
	else if (keywordlen == 8 && !memcmp (keyword, "PROGRESS", keywordlen))
	{
	write_status_text (STATUS_PROGRESS, line);
	}

	return 0;
	}

	/* Send a GENKEY command to the SCdaemon. If *CREATETIME is not 0,
	the value will be passed to SCDAEMON with --timestamp option so that
	the key is created with this. Otherwise, timestamp was generated by
	SCDEAMON. On success, creation time is stored back to
	CREATETIME. */
	int
	agent_scd_genkey (int keyno, int force, u32 *createtime)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	gnupg_isotime_t tbuf;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	if (*createtime)
	epoch2isotime (tbuf, *createtime);
	else
	*tbuf = 0;

	snprintf (line, DIM(line), "SCD GENKEY %s%s %s %d",
	*tbuf? "--timestamp=":"", tbuf,
	force? "--force":"",
	keyno);

	dfltparm.ctx = agent_ctx;
	rc = assuan_transact (agent_ctx, line,
	NULL, NULL, default_inq_cb, &dfltparm,
	scd_genkey_cb, createtime);

	status_sc_op_failure (rc);
	return rc;
	}




	/* Issue an SCD SERIALNO openpgp command and if SERIALNO is not NULL
	ask the user to insert the requested card. */
	gpg_error_t
	select_openpgp (const char *serialno)
	{
	gpg_error_t err;

	/* Send the serialno command to initialize the connection. Without
	a given S/N we don't care about the data returned. If the card
	has already been initialized, this is a very fast command. We
	request the openpgp card because that is what we expect.

	Note that an opt.limit_card_insert_tries of 1 means: No tries at
	all whereas 0 means do not limit the number of tries. Due to the
	sue of a pinentry prompt with a cancel option we use it here in a
	boolean sense. */
	if (!serialno \|\| opt.limit_card_insert_tries == 1)
	err = assuan_transact (agent_ctx, "SCD SERIALNO openpgp",
	NULL, NULL, NULL, NULL, NULL, NULL);
	else
	{
	char *this_sn = NULL;
	char *desc;
	int ask;
	char *want_sn;
	char *p;

	want_sn = xtrystrdup (serialno);
	if (!want_sn)
	return gpg_error_from_syserror ();
	p = strchr (want_sn, '/');
	if (p)
	*p = 0;

	do
	{
	ask = 0;
	err = assuan_transact (agent_ctx, "SCD SERIALNO openpgp",
	NULL, NULL, NULL, NULL,
	get_serialno_cb, &this_sn);
	if (gpg_err_code (err) == GPG_ERR_CARD_NOT_PRESENT)
	ask = 1;
	else if (gpg_err_code (err) == GPG_ERR_NOT_SUPPORTED)
	ask = 2;
	else if (err)
	;
	else if (this_sn)
	{
	if (strcmp (want_sn, this_sn))
	ask = 2;
	}

	xfree (this_sn);
	this_sn = NULL;

	if (ask)
	{
	char *formatted = NULL;
	char *ocodeset = i18n_switchto_utf8 ();

	if (!strncmp (want_sn, "D27600012401", 12)
	&& strlen (want_sn) == 32 )
	formatted = xtryasprintf ("(%.4s) %.8s",
	want_sn + 16, want_sn + 20);

	err = 0;
	desc = xtryasprintf
	("%s:\n\n"
	" \"%s\"",
	ask == 1
	? _("Please insert the card with serial number")
	: _("Please remove the current card and "
	"insert the one with serial number"),
	formatted? formatted : want_sn);
	if (!desc)
	err = gpg_error_from_syserror ();
	xfree (formatted);
	i18n_switchback (ocodeset);
	if (!err)
	err = gpg_agent_get_confirmation (desc);
	xfree (desc);
	}
	}
	while (ask && !err);
	xfree (want_sn);
	}

	return err;
	}



	/* Send a READCERT command to the SCdaemon. */
	int
	agent_scd_readcert (const char *certidstr,
	void *r_buf, size_t r_buflen)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	size_t len;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	*r_buf = NULL;
	rc = start_agent (NULL, 1);
	if (rc)
	return rc;

	dfltparm.ctx = agent_ctx;

	init_membuf (&data, 2048);

	snprintf (line, DIM(line), "SCD READCERT %s", certidstr);
	rc = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	if (rc)
	{
	xfree (get_membuf (&data, &len));
	return rc;
	}
	*r_buf = get_membuf (&data, r_buflen);
	if (!*r_buf)
	return gpg_error (GPG_ERR_ENOMEM);

	return 0;
	}



	/* Change the PIN of an OpenPGP card or reset the retry counter.
	CHVNO 1: Change the PIN
	2: For v1 cards: Same as 1.
	For v2 cards: Reset the PIN using the Reset Code.
	3: Change the admin PIN
	101: Set a new PIN and reset the retry counter
	102: For v1 cars: Same as 101.
	For v2 cards: Set a new Reset Code.
	SERIALNO is not used.
	*/
	int
	agent_scd_change_pin (int chvno, const char *serialno)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	const char *reset = "";
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	(void)serialno;

	if (chvno >= 100)
	reset = "--reset";
	chvno %= 100;

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;
	dfltparm.ctx = agent_ctx;

	snprintf (line, DIM(line), "SCD PASSWD %s %d", reset, chvno);
	rc = assuan_transact (agent_ctx, line,
	NULL, NULL,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	status_sc_op_failure (rc);
	return rc;
	}


	/* Perform a CHECKPIN operation. SERIALNO should be the serial
	number of the card - optionally followed by the fingerprint;
	however the fingerprint is ignored here. */
	int
	agent_scd_checkpin (const char *serialno)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	rc = start_agent (NULL, 1);
	if (rc)
	return rc;
	dfltparm.ctx = agent_ctx;

	snprintf (line, DIM(line), "SCD CHECKPIN %s", serialno);
	rc = assuan_transact (agent_ctx, line,
	NULL, NULL,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	status_sc_op_failure (rc);
	return rc;
	}


	/* Dummy function, only used by the gpg 1.4 implementation. */
	void
	agent_clear_pin_cache (const char *sn)
	{
	(void)sn;
	}




	/* Note: All strings shall be UTF-8. On success the caller needs to
	free the string stored at R_PASSPHRASE. On error NULL will be
	stored at R_PASSPHRASE and an appropriate fpf error code
	returned. */
	gpg_error_t
	agent_get_passphrase (const char *cache_id,
	const char *err_msg,
	const char *prompt,
	const char *desc_msg,
	int repeat,
	int check,
	char **r_passphrase)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	char *arg1 = NULL;
	char *arg2 = NULL;
	char *arg3 = NULL;
	char *arg4 = NULL;
	membuf_t data;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	*r_passphrase = NULL;

	rc = start_agent (NULL, 0);
	if (rc)
	return rc;
	dfltparm.ctx = agent_ctx;

	/* Check that the gpg-agent understands the repeat option. */
	if (assuan_transact (agent_ctx,
	"GETINFO cmd_has_option GET_PASSPHRASE repeat",
	NULL, NULL, NULL, NULL, NULL, NULL))
	return gpg_error (GPG_ERR_NOT_SUPPORTED);

	if (cache_id && *cache_id)
	if (!(arg1 = percent_plus_escape (cache_id)))
	goto no_mem;
	if (err_msg && *err_msg)
	if (!(arg2 = percent_plus_escape (err_msg)))
	goto no_mem;
	if (prompt && *prompt)
	if (!(arg3 = percent_plus_escape (prompt)))
	goto no_mem;
	if (desc_msg && *desc_msg)
	if (!(arg4 = percent_plus_escape (desc_msg)))
	goto no_mem;

	snprintf (line, DIM(line),
	"GET_PASSPHRASE --data --repeat=%d%s -- %s %s %s %s",
	repeat,
	check? " --check --qualitybar":"",
	arg1? arg1:"X",
	arg2? arg2:"X",
	arg3? arg3:"X",
	arg4? arg4:"X");
	xfree (arg1);
	xfree (arg2);
	xfree (arg3);
	xfree (arg4);

	init_membuf_secure (&data, 64);
	rc = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	NULL, NULL);

	if (rc)
	xfree (get_membuf (&data, NULL));
	else
	{
	put_membuf (&data, "", 1);
	*r_passphrase = get_membuf (&data, NULL);
	if (!*r_passphrase)
	rc = gpg_error_from_syserror ();
	}
	return rc;
	no_mem:
	rc = gpg_error_from_syserror ();
	xfree (arg1);
	xfree (arg2);
	xfree (arg3);
	xfree (arg4);
	return rc;
	}


	gpg_error_t
	agent_clear_passphrase (const char *cache_id)
	{
	int rc;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	if (!cache_id \|\| !*cache_id)
	return 0;

	rc = start_agent (NULL, 0);
	if (rc)
	return rc;
	dfltparm.ctx = agent_ctx;

	snprintf (line, DIM(line), "CLEAR_PASSPHRASE %s", cache_id);
	return assuan_transact (agent_ctx, line,
	NULL, NULL,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	}


	/* Ask the agent to pop up a confirmation dialog with the text DESC
	and an okay and cancel button. */
	gpg_error_t
	gpg_agent_get_confirmation (const char *desc)
	{
	int rc;
	char *tmp;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);

	rc = start_agent (NULL, 0);
	if (rc)
	return rc;
	dfltparm.ctx = agent_ctx;

	tmp = percent_plus_escape (desc);
	if (!tmp)
	return gpg_error_from_syserror ();
	snprintf (line, DIM(line), "GET_CONFIRMATION %s", tmp);
	xfree (tmp);

	rc = assuan_transact (agent_ctx, line,
	NULL, NULL,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	return rc;
	}


	/* Return the S2K iteration count as computed by gpg-agent. */
	gpg_error_t
	agent_get_s2k_count (unsigned long *r_count)
	{
	gpg_error_t err;
	membuf_t data;
	char *buf;

	*r_count = 0;

	err = start_agent (NULL, 0);
	if (err)
	return err;

	init_membuf (&data, 32);
	err = assuan_transact (agent_ctx, "GETINFO s2k_count",
	put_membuf_cb, &data,
	NULL, NULL, NULL, NULL);
	if (err)
	xfree (get_membuf (&data, NULL));
	else
	{
	put_membuf (&data, "", 1);
	buf = get_membuf (&data, NULL);
	if (!buf)
	err = gpg_error_from_syserror ();
	else
	{
	*r_count = strtoul (buf, NULL, 10);
	xfree (buf);
	}
	}
	return err;
	}



	/* Ask the agent whether a secret key for the given public key is
	available. Returns 0 if available. */
	gpg_error_t
	agent_probe_secret_key (ctrl_t ctrl, PKT_public_key *pk)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	char *hexgrip;

	err = start_agent (ctrl, 0);
	if (err)
	return err;

	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	return err;

	snprintf (line, sizeof line, "HAVEKEY %s", hexgrip);
	xfree (hexgrip);

	err = assuan_transact (agent_ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
	return err;
	}

	/* Ask the agent whether a secret key is available for any of the
	keys (primary or sub) in KEYBLOCK. Returns 0 if available. */
	gpg_error_t
	agent_probe_any_secret_key (ctrl_t ctrl, kbnode_t keyblock)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	char *p;
	kbnode_t kbctx, node;
	int nkeys;
	unsigned char grip[20];

	err = start_agent (ctrl, 0);
	if (err)
	return err;

	err = gpg_error (GPG_ERR_NO_SECKEY); /* Just in case no key was
	found in KEYBLOCK. */
	p = stpcpy (line, "HAVEKEY");
	for (kbctx=NULL, nkeys=0; (node = walk_kbnode (keyblock, &kbctx, 0)); )
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	if (nkeys && ((p - line) + 41) > (ASSUAN_LINELENGTH - 2))
	{
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err != gpg_err_code (GPG_ERR_NO_SECKEY))
	break; /* Seckey available or unexpected error - ready. */
	p = stpcpy (line, "HAVEKEY");
	nkeys = 0;
	}

	err = keygrip_from_pk (node->pkt->pkt.public_key, grip);
	if (err)
	return err;
	*p++ = ' ';
	bin2hex (grip, 20, p);
	p += 40;
	nkeys++;
	}

	if (!err && nkeys)
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);

	return err;
	}



	struct keyinfo_data_parm_s
	{
	char *serialno;
	int cleartext;
	};


	static gpg_error_t
	keyinfo_status_cb (void opaque, const char line)
	{
	struct keyinfo_data_parm_s *data = opaque;
	int is_smartcard;
	char *s;

	if ((s = has_leading_keyword (line, "KEYINFO")) && data)
	{
	/* Parse the arguments:
	* 0 1 2 3 4 5
	* <keygrip> <type> <serialno> <idstr> <cached> <protection>
	*/
	char *fields[6];

	if (split_fields (s, fields, DIM (fields)) == 6)
	{
	is_smartcard = (fields[1][0] == 'T');
	if (is_smartcard && !data->serialno && strcmp (fields[2], "-"))
	data->serialno = xtrystrdup (fields[2]);
	/* 'P' for protected, 'C' for clear */
	data->cleartext = (fields[5][0] == 'C');
	}
	}
	return 0;
	}


	/* Return the serial number for a secret key. If the returned serial
	number is NULL, the key is not stored on a smartcard. Caller needs
	to free R_SERIALNO.

	if r_cleartext is not NULL, the referenced int will be set to 1 if
	the agent's copy of the key is stored in the clear, or 0 otherwise
	*/
	gpg_error_t
	agent_get_keyinfo (ctrl_t ctrl, const char *hexkeygrip,
	char *r_serialno, int r_cleartext)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	struct keyinfo_data_parm_s keyinfo;

	memset (&keyinfo, 0,sizeof keyinfo);

	*r_serialno = NULL;

	err = start_agent (ctrl, 0);
	if (err)
	return err;

	if (!hexkeygrip \|\| strlen (hexkeygrip) != 40)
	return gpg_error (GPG_ERR_INV_VALUE);

	snprintf (line, DIM(line), "KEYINFO %s", hexkeygrip);

	err = assuan_transact (agent_ctx, line, NULL, NULL, NULL, NULL,
	keyinfo_status_cb, &keyinfo);
	if (!err && keyinfo.serialno)
	{
	/* Sanity check for bad characters. */
	if (strpbrk (keyinfo.serialno, ":\n\r"))
	err = GPG_ERR_INV_VALUE;
	}
	if (err)
	xfree (keyinfo.serialno);
	else
	{
	*r_serialno = keyinfo.serialno;
	if (r_cleartext)
	*r_cleartext = keyinfo.cleartext;
	}
	return err;
	}


	/* Status callback for agent_import_key, agent_export_key and
	agent_genkey. */
	static gpg_error_t
	cache_nonce_status_cb (void opaque, const char line)
	{
	struct cache_nonce_parm_s *parm = opaque;
	const char *s;

	if ((s = has_leading_keyword (line, "CACHE_NONCE")))
	{
	if (parm->cache_nonce_addr)
	{
	xfree (*parm->cache_nonce_addr);
	*parm->cache_nonce_addr = xtrystrdup (s);
	}
	}
	else if ((s = has_leading_keyword (line, "PASSWD_NONCE")))
	{
	if (parm->passwd_nonce_addr)
	{
	xfree (*parm->passwd_nonce_addr);
	*parm->passwd_nonce_addr = xtrystrdup (s);
	}
	}
	else if ((s = has_leading_keyword (line, "PROGRESS")))
	{
	if (opt.enable_progress_filter)
	write_status_text (STATUS_PROGRESS, s);
	}

	return 0;
	}



	/* Handle a KEYPARMS inquiry. Note, we only send the data,
	assuan_transact takes care of flushing and writing the end */
	static gpg_error_t
	inq_genkey_parms (void opaque, const char line)
	{
	struct genkey_parm_s *parm = opaque;
	gpg_error_t err;

	if (has_leading_keyword (line, "KEYPARAM"))
	{
	err = assuan_send_data (parm->dflt->ctx,
	parm->keyparms, strlen (parm->keyparms));
	}
	else if (has_leading_keyword (line, "NEWPASSWD") && parm->passphrase)
	{
	err = assuan_send_data (parm->dflt->ctx,
	parm->passphrase, strlen (parm->passphrase));
	}
	else
	err = default_inq_cb (parm->dflt, line);

	return err;
	}


	/* Call the agent to generate a new key. KEYPARMS is the usual
	S-expression giving the parameters of the key. gpg-agent passes it
	gcry_pk_genkey. If NO_PROTECTION is true the agent is advised not
	to protect the generated key. If NO_PROTECTION is not set and
	PASSPHRASE is not NULL the agent is requested to protect the key
	with that passphrase instead of asking for one. */
	gpg_error_t
	agent_genkey (ctrl_t ctrl, char cache_nonce_addr, char passwd_nonce_addr,
	const char *keyparms, int no_protection,
	const char passphrase, gcry_sexp_t r_pubkey)
	{
	gpg_error_t err;
	struct genkey_parm_s gk_parm;
	struct cache_nonce_parm_s cn_parm;
	struct default_inq_parm_s dfltparm;
	membuf_t data;
	size_t len;
	unsigned char *buf;
	char line[ASSUAN_LINELENGTH];

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	*r_pubkey = NULL;
	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	if (passwd_nonce_addr && *passwd_nonce_addr)
	; /* A RESET would flush the passwd nonce cache. */
	else
	{
	err = assuan_transact (agent_ctx, "RESET",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	init_membuf (&data, 1024);
	gk_parm.dflt = &dfltparm;
	gk_parm.keyparms = keyparms;
	gk_parm.passphrase = passphrase;
	snprintf (line, sizeof line, "GENKEY%s%s%s%s%s",
	no_protection? " --no-protection" :
	passphrase ? " --inq-passwd" :
	/* */ "",
	passwd_nonce_addr && *passwd_nonce_addr? " --passwd-nonce=":"",
	passwd_nonce_addr && passwd_nonce_addr? passwd_nonce_addr:"",
	cache_nonce_addr && *cache_nonce_addr? " ":"",
	cache_nonce_addr && cache_nonce_addr? cache_nonce_addr:"");
	cn_parm.cache_nonce_addr = cache_nonce_addr;
	cn_parm.passwd_nonce_addr = NULL;
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	inq_genkey_parms, &gk_parm,
	cache_nonce_status_cb, &cn_parm);
	if (err)
	{
	xfree (get_membuf (&data, &len));
	return err;
	}

	buf = get_membuf (&data, &len);
	if (!buf)
	err = gpg_error_from_syserror ();
	else
	{
	err = gcry_sexp_sscan (r_pubkey, NULL, buf, len);
	xfree (buf);
	}
	return err;
	}



	/* Call the agent to read the public key part for a given keygrip. If
	FROMCARD is true, the key is directly read from the current
	smartcard. In this case HEXKEYGRIP should be the keyID
	(e.g. OPENPGP.3). */
	gpg_error_t
	agent_readkey (ctrl_t ctrl, int fromcard, const char *hexkeygrip,
	unsigned char **r_pubkey)
	{
	gpg_error_t err;
	membuf_t data;
	size_t len;
	unsigned char *buf;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	*r_pubkey = NULL;
	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	err = assuan_transact (agent_ctx, "RESET",NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	snprintf (line, DIM(line), "READKEY %s%s", fromcard? "--card ":"",
	hexkeygrip);

	init_membuf (&data, 1024);
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	if (err)
	{
	xfree (get_membuf (&data, &len));
	return err;
	}
	buf = get_membuf (&data, &len);
	if (!buf)
	return gpg_error_from_syserror ();
	if (!gcry_sexp_canon_len (buf, len, NULL, NULL))
	{
	xfree (buf);
	return gpg_error (GPG_ERR_INV_SEXP);
	}
	*r_pubkey = buf;
	return 0;
	}



	/* Call the agent to do a sign operation using the key identified by
	the hex string KEYGRIP. DESC is a description of the key to be
	displayed if the agent needs to ask for the PIN. DIGEST and
	DIGESTLEN is the hash value to sign and DIGESTALGO the algorithm id
	used to compute the digest. If CACHE_NONCE is used the agent is
	advised to first try a passphrase associated with that nonce. */
	gpg_error_t
	agent_pksign (ctrl_t ctrl, const char *cache_nonce,
	const char keygrip, const char desc,
	u32 keyid, u32 mainkeyid, int pubkey_algo,
	unsigned char *digest, size_t digestlen, int digestalgo,
	gcry_sexp_t *r_sigval)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;
	dfltparm.keyinfo.keyid = keyid;
	dfltparm.keyinfo.mainkeyid = mainkeyid;
	dfltparm.keyinfo.pubkey_algo = pubkey_algo;

	*r_sigval = NULL;
	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	if (digestlen*2 + 50 > DIM(line))
	return gpg_error (GPG_ERR_GENERAL);

	err = assuan_transact (agent_ctx, "RESET",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	snprintf (line, DIM(line), "SIGKEY %s", keygrip);
	err = assuan_transact (agent_ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	snprintf (line, sizeof line, "SETHASH %d ", digestalgo);
	bin2hex (digest, digestlen, line + strlen (line));
	err = assuan_transact (agent_ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	init_membuf (&data, 1024);

	snprintf (line, sizeof line, "PKSIGN%s%s",
	cache_nonce? " -- ":"",
	cache_nonce? cache_nonce:"");
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	if (err)
	xfree (get_membuf (&data, NULL));
	else
	{
	unsigned char *buf;
	size_t len;

	buf = get_membuf (&data, &len);
	if (!buf)
	err = gpg_error_from_syserror ();
	else
	{
	err = gcry_sexp_sscan (r_sigval, NULL, buf, len);
	xfree (buf);
	}
	}
	return err;
	}



	/* Handle a CIPHERTEXT inquiry. Note, we only send the data,
	assuan_transact takes care of flushing and writing the END. */
	static gpg_error_t
	inq_ciphertext_cb (void opaque, const char line)
	{
	struct cipher_parm_s *parm = opaque;
	int rc;

	if (has_leading_keyword (line, "CIPHERTEXT"))
	{
	assuan_begin_confidential (parm->ctx);
	rc = assuan_send_data (parm->dflt->ctx,
	parm->ciphertext, parm->ciphertextlen);
	assuan_end_confidential (parm->ctx);
	}
	else
	rc = default_inq_cb (parm->dflt, line);

	return rc;
	}


	/* Check whether there is any padding info from the agent. */
	static gpg_error_t
	padding_info_cb (void opaque, const char line)
	{
	int *r_padding = opaque;
	const char *s;

	if ((s=has_leading_keyword (line, "PADDING")))
	{
	*r_padding = atoi (s);
	}

	return 0;
	}


	/* Call the agent to do a decrypt operation using the key identified
	by the hex string KEYGRIP and the input data S_CIPHERTEXT. On the
	success the decoded value is stored verbatim at R_BUF and its
	length at R_BUF; the callers needs to release it. KEYID, MAINKEYID
	and PUBKEY_ALGO are used to construct additional promots or status
	messages. The padding information is stored at R_PADDING with -1
	for not known. */
	gpg_error_t
	agent_pkdecrypt (ctrl_t ctrl, const char keygrip, const char desc,
	u32 keyid, u32 mainkeyid, int pubkey_algo,
	gcry_sexp_t s_ciphertext,
	unsigned char *r_buf, size_t r_buflen, int *r_padding)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	membuf_t data;
	size_t n, len;
	char p, buf, *endp;
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;
	dfltparm.keyinfo.keyid = keyid;
	dfltparm.keyinfo.mainkeyid = mainkeyid;
	dfltparm.keyinfo.pubkey_algo = pubkey_algo;

	if (!keygrip \|\| strlen(keygrip) != 40
	\|\| !s_ciphertext \|\| !r_buf \|\| !r_buflen \|\| !r_padding)
	return gpg_error (GPG_ERR_INV_VALUE);

	*r_buf = NULL;
	*r_padding = -1;

	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	err = assuan_transact (agent_ctx, "RESET",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	snprintf (line, sizeof line, "SETKEY %s", keygrip);
	err = assuan_transact (agent_ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	init_membuf_secure (&data, 1024);
	{
	struct cipher_parm_s parm;

	parm.dflt = &dfltparm;
	parm.ctx = agent_ctx;
	err = make_canon_sexp (s_ciphertext, &parm.ciphertext, &parm.ciphertextlen);
	if (err)
	return err;
	err = assuan_transact (agent_ctx, "PKDECRYPT",
	put_membuf_cb, &data,
	inq_ciphertext_cb, &parm,
	padding_info_cb, r_padding);
	xfree (parm.ciphertext);
	}
	if (err)
	{
	xfree (get_membuf (&data, &len));
	return err;
	}

	put_membuf (&data, "", 1); /* Make sure it is 0 terminated. */
	buf = get_membuf (&data, &len);
	if (!buf)
	return gpg_error_from_syserror ();
	log_assert (len); /* (we forced Nul termination.) */

	if (*buf != '(')
	{
	xfree (buf);
	return gpg_error (GPG_ERR_INV_SEXP);
	}

	if (len < 13 \|\| memcmp (buf, "(5:value", 8) ) /* "(5:valueN:D)\0" */
	{
	xfree (buf);
	return gpg_error (GPG_ERR_INV_SEXP);
	}
	len -= 10; /* Count only the data of the second part. */
	p = buf + 8; /* Skip leading parenthesis and the value tag. */

	n = strtoul (p, &endp, 10);
	if (!n \|\| *endp != ':')
	{
	xfree (buf);
	return gpg_error (GPG_ERR_INV_SEXP);
	}
	endp++;
	if (endp-p+n > len)
	{
	xfree (buf);
	return gpg_error (GPG_ERR_INV_SEXP); /* Oops: Inconsistent S-Exp. */
	}

	memmove (buf, endp, n);

	*r_buflen = n;
	*r_buf = buf;
	return 0;
	}



	/* Retrieve a key encryption key from the agent. With FOREXPORT true
	the key shall be used for export, with false for import. On success
	the new key is stored at R_KEY and its length at R_KEKLEN. */
	gpg_error_t
	agent_keywrap_key (ctrl_t ctrl, int forexport, void *r_kek, size_t r_keklen)
	{
	gpg_error_t err;
	membuf_t data;
	size_t len;
	unsigned char *buf;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	*r_kek = NULL;
	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	snprintf (line, DIM(line), "KEYWRAP_KEY %s",
	forexport? "--export":"--import");

	init_membuf_secure (&data, 64);
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	if (err)
	{
	xfree (get_membuf (&data, &len));
	return err;
	}
	buf = get_membuf (&data, &len);
	if (!buf)
	return gpg_error_from_syserror ();
	*r_kek = buf;
	*r_keklen = len;
	return 0;
	}



	/* Handle the inquiry for an IMPORT_KEY command. */
	static gpg_error_t
	inq_import_key_parms (void opaque, const char line)
	{
	struct import_key_parm_s *parm = opaque;
	gpg_error_t err;

	if (has_leading_keyword (line, "KEYDATA"))
	{
	err = assuan_send_data (parm->dflt->ctx, parm->key, parm->keylen);
	}
	else
	err = default_inq_cb (parm->dflt, line);

	return err;
	}


	/* Call the agent to import a key into the agent. */
	gpg_error_t
	agent_import_key (ctrl_t ctrl, const char desc, char *cache_nonce_addr,
	const void *key, size_t keylen, int unattended, int force)
	{
	gpg_error_t err;
	struct import_key_parm_s parm;
	struct cache_nonce_parm_s cn_parm;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	parm.dflt = &dfltparm;
	parm.key = key;
	parm.keylen = keylen;

	snprintf (line, sizeof line, "IMPORT_KEY%s%s%s%s",
	unattended? " --unattended":"",
	force? " --force":"",
	cache_nonce_addr && *cache_nonce_addr? " ":"",
	cache_nonce_addr && cache_nonce_addr? cache_nonce_addr:"");
	cn_parm.cache_nonce_addr = cache_nonce_addr;
	cn_parm.passwd_nonce_addr = NULL;
	err = assuan_transact (agent_ctx, line,
	NULL, NULL,
	inq_import_key_parms, &parm,
	cache_nonce_status_cb, &cn_parm);
	return err;
	}



	/* Receive a secret key from the agent. HEXKEYGRIP is the hexified
	keygrip, DESC a prompt to be displayed with the agent's passphrase
	question (needs to be plus+percent escaped). if OPENPGP_PROTECTED
	is not zero, ensure that the key material is returned in RFC
	4880-compatible passphrased-protected form. If CACHE_NONCE_ADDR is
	not NULL the agent is advised to first try a passphrase associated
	with that nonce. On success the key is stored as a canonical
	S-expression at R_RESULT and R_RESULTLEN. */
	gpg_error_t
	agent_export_key (ctrl_t ctrl, const char hexkeygrip, const char desc,
	int openpgp_protected, char **cache_nonce_addr,
	unsigned char *r_result, size_t r_resultlen)
	{
	gpg_error_t err;
	struct cache_nonce_parm_s cn_parm;
	membuf_t data;
	size_t len;
	unsigned char *buf;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	*r_result = NULL;

	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	snprintf (line, DIM(line), "EXPORT_KEY %s%s%s %s",
	openpgp_protected ? "--openpgp ":"",
	cache_nonce_addr && *cache_nonce_addr? "--cache-nonce=":"",
	cache_nonce_addr && cache_nonce_addr? cache_nonce_addr:"",
	hexkeygrip);

	init_membuf_secure (&data, 1024);
	cn_parm.cache_nonce_addr = cache_nonce_addr;
	cn_parm.passwd_nonce_addr = NULL;
	err = assuan_transact (agent_ctx, line,
	put_membuf_cb, &data,
	default_inq_cb, &dfltparm,
	cache_nonce_status_cb, &cn_parm);
	if (err)
	{
	xfree (get_membuf (&data, &len));
	return err;
	}
	buf = get_membuf (&data, &len);
	if (!buf)
	return gpg_error_from_syserror ();
	*r_result = buf;
	*r_resultlen = len;
	return 0;
	}



	/* Ask the agent to delete the key identified by HEXKEYGRIP. If DESC
	is not NULL, display DESC instead of the default description
	message. If FORCE is true the agent is advised not to ask for
	confirmation. */
	gpg_error_t
	agent_delete_key (ctrl_t ctrl, const char hexkeygrip, const char desc,
	int force)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	err = start_agent (ctrl, 0);
	if (err)
	return err;

	if (!hexkeygrip \|\| strlen (hexkeygrip) != 40)
	return gpg_error (GPG_ERR_INV_VALUE);

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	snprintf (line, DIM(line), "DELETE_KEY%s %s",
	force? " --force":"", hexkeygrip);
	err = assuan_transact (agent_ctx, line, NULL, NULL,
	default_inq_cb, &dfltparm,
	NULL, NULL);
	return err;
	}



	/* Ask the agent to change the passphrase of the key identified by
	* HEXKEYGRIP. If DESC is not NULL, display DESC instead of the
	* default description message. If CACHE_NONCE_ADDR is not NULL the
	* agent is advised to first try a passphrase associated with that
	* nonce. If PASSWD_NONCE_ADDR is not NULL the agent will try to use
	* the passphrase associated with that nonce for the new passphrase.
	* If VERIFY is true the passphrase is only verified. */
	gpg_error_t
	agent_passwd (ctrl_t ctrl, const char hexkeygrip, const char desc, int verify,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	gpg_error_t err;
	struct cache_nonce_parm_s cn_parm;
	char line[ASSUAN_LINELENGTH];
	struct default_inq_parm_s dfltparm;

	memset (&dfltparm, 0, sizeof dfltparm);
	dfltparm.ctrl = ctrl;

	err = start_agent (ctrl, 0);
	if (err)
	return err;
	dfltparm.ctx = agent_ctx;

	if (!hexkeygrip \|\| strlen (hexkeygrip) != 40)
	return gpg_error (GPG_ERR_INV_VALUE);

	if (desc)
	{
	snprintf (line, DIM(line), "SETKEYDESC %s", desc);
	err = assuan_transact (agent_ctx, line,
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (err)
	return err;
	}

	if (verify)
	snprintf (line, DIM(line), "PASSWD %s%s --verify %s",
	cache_nonce_addr && *cache_nonce_addr? "--cache-nonce=":"",
	cache_nonce_addr && cache_nonce_addr? cache_nonce_addr:"",
	hexkeygrip);
	else
	snprintf (line, DIM(line), "PASSWD %s%s %s%s %s",
	cache_nonce_addr && *cache_nonce_addr? "--cache-nonce=":"",
	cache_nonce_addr && cache_nonce_addr? cache_nonce_addr:"",
	passwd_nonce_addr && *passwd_nonce_addr? "--passwd-nonce=":"",
	passwd_nonce_addr && passwd_nonce_addr? passwd_nonce_addr:"",
	hexkeygrip);
	cn_parm.cache_nonce_addr = cache_nonce_addr;
	cn_parm.passwd_nonce_addr = passwd_nonce_addr;
	err = assuan_transact (agent_ctx, line, NULL, NULL,
	default_inq_cb, &dfltparm,
	cache_nonce_status_cb, &cn_parm);
	return err;
	}


	/* Return the version reported by gpg-agent. */
	gpg_error_t
	agent_get_version (ctrl_t ctrl, char **r_version)
	{
	gpg_error_t err;

	err = start_agent (ctrl, 0);
	if (err)
	return err;

	err = get_assuan_server_version (agent_ctx, 0, r_version);
	return err;
	}
	diff --git a/g10/card-util.c b/g10/card-util.c
	index e35857220..969f6c919 100644
	--- a/g10/card-util.c
	+++ b/g10/card-util.c
	@@ -1,2134 +1,2134 @@
	/* card-util.c - Utility functions for the OpenPGP card.
	* Copyright (C) 2003-2005, 2009 Free Software Foundation, Inc.
	* Copyright (C) 2003-2005, 2009 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#ifdef HAVE_LIBREADLINE
	# define GNUPG_LIBREADLINE_H_INCLUDED
	# include <readline/readline.h>
	#endif /HAVE_LIBREADLINE/

	#if GNUPG_MAJOR_VERSION != 1
	# include "gpg.h"
	#endif /GNUPG_MAJOR_VERSION != 1/
	#include "util.h"
	#include "i18n.h"
	#include "ttyio.h"
	#include "status.h"
	#include "options.h"
	#include "main.h"
	#include "keyserver-internal.h"

	#if GNUPG_MAJOR_VERSION == 1
	# include "cardglue.h"
	#else /GNUPG_MAJOR_VERSION!=1/
	# include "call-agent.h"
	#endif /GNUPG_MAJOR_VERSION!=1/

	#define CONTROL_D ('D' - 'A' + 1)


	static void
	write_sc_op_status (gpg_error_t err)
	{
	switch (gpg_err_code (err))
	{
	case 0:
	write_status (STATUS_SC_OP_SUCCESS);
	break;
	#if GNUPG_MAJOR_VERSION != 1
	case GPG_ERR_CANCELED:
	case GPG_ERR_FULLY_CANCELED:
	write_status_text (STATUS_SC_OP_FAILURE, "1");
	break;
	case GPG_ERR_BAD_PIN:
	write_status_text (STATUS_SC_OP_FAILURE, "2");
	break;
	default:
	write_status (STATUS_SC_OP_FAILURE);
	break;
	#endif /* GNUPG_MAJOR_VERSION != 1 */
	}
	}


	-/* Change the PIN of a an OpenPGP card. This is an interactive
	+/* Change the PIN of an OpenPGP card. This is an interactive
	function. */
	void
	change_pin (int unblock_v2, int allow_admin)
	{
	struct agent_card_info_s info;
	int rc;

	rc = agent_scd_learn (&info, 0);
	if (rc)
	{
	log_error (_("OpenPGP card not available: %s\n"),
	gpg_strerror (rc));
	return;
	}

	log_info (_("OpenPGP card no. %s detected\n"),
	info.serialno? info.serialno : "[none]");

	agent_clear_pin_cache (info.serialno);

	if (opt.batch)
	{
	agent_release_card_info (&info);
	log_error (_("can't do this in batch mode\n"));
	return;
	}


	if (unblock_v2)
	{
	if (!info.is_v2)
	log_error (_("This command is only available for version 2 cards\n"));
	else if (!info.chvretry[1])
	log_error (_("Reset Code not or not anymore available\n"));
	else
	{
	rc = agent_scd_change_pin (2, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error changing the PIN: %s\n", gpg_strerror (rc));
	else
	tty_printf ("PIN changed.\n");
	}
	}
	else if (!allow_admin)
	{
	rc = agent_scd_change_pin (1, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error changing the PIN: %s\n", gpg_strerror (rc));
	else
	tty_printf ("PIN changed.\n");
	}
	else
	for (;;)
	{
	char *answer;

	tty_printf ("\n");
	tty_printf ("1 - change PIN\n"
	"2 - unblock PIN\n"
	"3 - change Admin PIN\n"
	"4 - set the Reset Code\n"
	"Q - quit\n");
	tty_printf ("\n");

	answer = cpr_get("cardutil.change_pin.menu",_("Your selection? "));
	cpr_kill_prompt();
	if (strlen (answer) != 1)
	continue;

	if (*answer == '1')
	{
	/* Change PIN. */
	rc = agent_scd_change_pin (1, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error changing the PIN: %s\n", gpg_strerror (rc));
	else
	tty_printf ("PIN changed.\n");
	}
	else if (*answer == '2')
	{
	/* Unblock PIN. */
	rc = agent_scd_change_pin (101, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error unblocking the PIN: %s\n", gpg_strerror (rc));
	else
	tty_printf ("PIN unblocked and new PIN set.\n");
	}
	else if (*answer == '3')
	{
	/* Change Admin PIN. */
	rc = agent_scd_change_pin (3, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error changing the PIN: %s\n", gpg_strerror (rc));
	else
	tty_printf ("PIN changed.\n");
	}
	else if (*answer == '4')
	{
	/* Set a new Reset Code. */
	rc = agent_scd_change_pin (102, info.serialno);
	write_sc_op_status (rc);
	if (rc)
	tty_printf ("Error setting the Reset Code: %s\n",
	gpg_strerror (rc));
	else
	tty_printf ("Reset Code set.\n");
	}
	else if (answer == 'q' \|\| answer == 'Q')
	{
	break;
	}
	}

	agent_release_card_info (&info);
	}

	static const char *
	get_manufacturer (unsigned int no)
	{
	/* Note: Make sure that there is no colon or linefeed in the string. */
	switch (no)
	{
	case 0x0001: return "PPC Card Systems";
	case 0x0002: return "Prism";
	case 0x0003: return "OpenFortress";
	case 0x0004: return "Wewid";
	case 0x0005: return "ZeitControl";
	case 0x0006: return "Yubico";
	case 0x0007: return "OpenKMS";
	case 0x0008: return "LogoEmail";
	case 0x0009: return "Fidesmo";
	case 0x000A: return "Dangerous Things";

	case 0x002A: return "Magrathea";

	case 0x1337: return "Warsaw Hackerspace";
	case 0x2342: return "warpzone"; /* hackerspace Muenster. */
	case 0xF517: return "FSIJ";

	/* 0x0000 and 0xFFFF are defined as test cards per spec,
	0xFF00 to 0xFFFE are assigned for use with randomly created
	serial numbers. */
	case 0x0000:
	case 0xffff: return "test card";
	default: return (no & 0xff00) == 0xff00? "unmanaged S/N range":"unknown";
	}
	}


	static void
	print_sha1_fpr (estream_t fp, const unsigned char *fpr)
	{
	int i;

	if (fpr)
	{
	for (i=0; i < 20 ; i+=2, fpr += 2 )
	{
	if (i == 10 )
	tty_fprintf (fp, " ");
	tty_fprintf (fp, " %02X%02X", *fpr, fpr[1]);
	}
	}
	else
	tty_fprintf (fp, " [none]");
	tty_fprintf (fp, "\n");
	}


	static void
	print_sha1_fpr_colon (estream_t fp, const unsigned char *fpr)
	{
	int i;

	if (fpr)
	{
	for (i=0; i < 20 ; i++, fpr++)
	es_fprintf (fp, "%02X", *fpr);
	}
	es_putc (':', fp);
	}


	static void
	print_name (estream_t fp, const char text, const char name)
	{
	tty_fprintf (fp, "%s", text);

	/* FIXME: tty_printf_utf8_string2 eats everything after and
	including an @ - e.g. when printing an url. */
	if (name && *name)
	{
	if (fp)
	print_utf8_buffer2 (fp, name, strlen (name), '\n');
	else
	tty_print_utf8_string2 (NULL, name, strlen (name), 0);
	}
	else
	tty_fprintf (fp, _("[not set]"));
	tty_fprintf (fp, "\n");
	}

	static void
	print_isoname (estream_t fp, const char *text,
	const char tag, const char name)
	{
	if (opt.with_colons)
	es_fprintf (fp, "%s:", tag);
	else
	tty_fprintf (fp, "%s", text);

	if (name && *name)
	{
	char p, given, *buf = xstrdup (name);

	given = strstr (buf, "<<");
	for (p=buf; *p; p++)
	if (*p == '<')
	*p = ' ';
	if (given && given[2])
	{
	*given = 0;
	given += 2;
	if (opt.with_colons)
	es_write_sanitized (fp, given, strlen (given), ":", NULL);
	else if (fp)
	print_utf8_buffer2 (fp, given, strlen (given), '\n');
	else
	tty_print_utf8_string2 (NULL, given, strlen (given), 0);

	if (opt.with_colons)
	es_putc (':', fp);
	else if (*buf)
	tty_fprintf (fp, " ");
	}

	if (opt.with_colons)
	es_write_sanitized (fp, buf, strlen (buf), ":", NULL);
	else if (fp)
	print_utf8_buffer2 (fp, buf, strlen (buf), '\n');
	else
	tty_print_utf8_string2 (NULL, buf, strlen (buf), 0);
	xfree (buf);
	}
	else
	{
	if (opt.with_colons)
	es_putc (':', fp);
	else
	tty_fprintf (fp, _("[not set]"));
	}

	if (opt.with_colons)
	es_fputs (":\n", fp);
	else
	tty_fprintf (fp, "\n");
	}

	/* Return true if the SHA1 fingerprint FPR consists only of zeroes. */
	static int
	fpr_is_zero (const char *fpr)
	{
	int i;

	for (i=0; i < 20 && !fpr[i]; i++)
	;
	return (i == 20);
	}


	/* Return true if the SHA1 fingerprint FPR consists only of 0xFF. */
	static int
	fpr_is_ff (const char *fpr)
	{
	int i;

	for (i=0; i < 20 && fpr[i] == '\xff'; i++)
	;
	return (i == 20);
	}


	/* Print all available information about the current card. */
	void
	card_status (estream_t fp, char *serialno, size_t serialnobuflen)
	{
	struct agent_card_info_s info;
	PKT_public_key pk = xcalloc (1, sizeof pk);
	kbnode_t keyblock = NULL;
	int rc;
	unsigned int uval;
	const unsigned char *thefpr;
	int i;

	if (serialno && serialnobuflen)
	*serialno = 0;

	rc = agent_scd_learn (&info, 0);
	if (rc)
	{
	if (opt.with_colons)
	es_fputs ("AID:::\n", fp);
	log_error (_("OpenPGP card not available: %s\n"), gpg_strerror (rc));
	xfree (pk);
	return;
	}

	if (opt.with_colons)
	es_fprintf (fp, "Reader:%s:", info.reader? info.reader : "");
	else
	tty_fprintf (fp, "Reader ...........: %s\n",
	info.reader? info.reader : "[none]");
	if (opt.with_colons)
	es_fprintf (fp, "AID:%s:", info.serialno? info.serialno : "");
	else
	tty_fprintf (fp, "Application ID ...: %s\n",
	info.serialno? info.serialno : "[none]");
	if (!info.serialno \|\| strncmp (info.serialno, "D27600012401", 12)
	\|\| strlen (info.serialno) != 32 )
	{
	if (info.apptype && !strcmp (info.apptype, "NKS"))
	{
	if (opt.with_colons)
	es_fputs ("netkey-card:\n", fp);
	log_info ("this is a NetKey card\n");
	}
	else if (info.apptype && !strcmp (info.apptype, "DINSIG"))
	{
	if (opt.with_colons)
	es_fputs ("dinsig-card:\n", fp);
	log_info ("this is a DINSIG compliant card\n");
	}
	else if (info.apptype && !strcmp (info.apptype, "P15"))
	{
	if (opt.with_colons)
	es_fputs ("pkcs15-card:\n", fp);
	log_info ("this is a PKCS#15 compliant card\n");
	}
	else if (info.apptype && !strcmp (info.apptype, "GELDKARTE"))
	{
	if (opt.with_colons)
	es_fputs ("geldkarte-card:\n", fp);
	log_info ("this is a Geldkarte compliant card\n");
	}
	else
	{
	if (opt.with_colons)
	es_fputs ("unknown:\n", fp);
	}
	log_info ("not an OpenPGP card\n");
	agent_release_card_info (&info);
	xfree (pk);
	return;
	}

	if (!serialno)
	;
	else if (strlen (serialno)+1 > serialnobuflen)
	log_error ("serial number longer than expected\n");
	else
	strcpy (serialno, info.serialno);

	if (opt.with_colons)
	es_fputs ("openpgp-card:\n", fp);


	if (opt.with_colons)
	{
	es_fprintf (fp, "version:%.4s:\n", info.serialno+12);
	uval = xtoi_2(info.serialno+16)*256 + xtoi_2 (info.serialno+18);
	es_fprintf (fp, "vendor:%04x:%s:\n", uval, get_manufacturer (uval));
	es_fprintf (fp, "serial:%.8s:\n", info.serialno+20);

	print_isoname (fp, "Name of cardholder: ", "name", info.disp_name);

	es_fputs ("lang:", fp);
	if (info.disp_lang)
	es_write_sanitized (fp, info.disp_lang, strlen (info.disp_lang),
	":", NULL);
	es_fputs (":\n", fp);

	es_fprintf (fp, "sex:%c:\n", (info.disp_sex == 1? 'm':
	info.disp_sex == 2? 'f' : 'u'));

	es_fputs ("url:", fp);
	if (info.pubkey_url)
	es_write_sanitized (fp, info.pubkey_url, strlen (info.pubkey_url),
	":", NULL);
	es_fputs (":\n", fp);

	es_fputs ("login:", fp);
	if (info.login_data)
	es_write_sanitized (fp, info.login_data, strlen (info.login_data),
	":", NULL);
	es_fputs (":\n", fp);

	es_fprintf (fp, "forcepin:%d:::\n", !info.chv1_cached);
	for (i=0; i < DIM (info.key_attr); i++)
	if (info.key_attr[i].algo == PUBKEY_ALGO_RSA)
	es_fprintf (fp, "keyattr:%d:%d:%u:\n", i+1,
	info.key_attr[i].algo, info.key_attr[i].nbits);
	else if (info.key_attr[i].algo == PUBKEY_ALGO_ECDH
	\|\| info.key_attr[i].algo == PUBKEY_ALGO_ECDSA
	\|\| info.key_attr[i].algo == PUBKEY_ALGO_EDDSA)
	es_fprintf (fp, "keyattr:%d:%d:%s:\n", i+1,
	info.key_attr[i].algo, info.key_attr[i].curve);
	es_fprintf (fp, "maxpinlen:%d:%d:%d:\n",
	info.chvmaxlen[0], info.chvmaxlen[1], info.chvmaxlen[2]);
	es_fprintf (fp, "pinretry:%d:%d:%d:\n",
	info.chvretry[0], info.chvretry[1], info.chvretry[2]);
	es_fprintf (fp, "sigcount:%lu:::\n", info.sig_counter);

	for (i=0; i < 4; i++)
	{
	if (info.private_do[i])
	{
	es_fprintf (fp, "private_do:%d:", i+1);
	es_write_sanitized (fp, info.private_do[i],
	strlen (info.private_do[i]), ":", NULL);
	es_fputs (":\n", fp);
	}
	}

	es_fputs ("cafpr:", fp);
	print_sha1_fpr_colon (fp, info.cafpr1valid? info.cafpr1:NULL);
	print_sha1_fpr_colon (fp, info.cafpr2valid? info.cafpr2:NULL);
	print_sha1_fpr_colon (fp, info.cafpr3valid? info.cafpr3:NULL);
	es_putc ('\n', fp);
	es_fputs ("fpr:", fp);
	print_sha1_fpr_colon (fp, info.fpr1valid? info.fpr1:NULL);
	print_sha1_fpr_colon (fp, info.fpr2valid? info.fpr2:NULL);
	print_sha1_fpr_colon (fp, info.fpr3valid? info.fpr3:NULL);
	es_putc ('\n', fp);
	es_fprintf (fp, "fprtime:%lu:%lu:%lu:\n",
	(unsigned long)info.fpr1time, (unsigned long)info.fpr2time,
	(unsigned long)info.fpr3time);
	}
	else
	{
	tty_fprintf (fp, "Version ..........: %.1s%c.%.1s%c\n",
	info.serialno[12] == '0'?"":info.serialno+12,
	info.serialno[13],
	info.serialno[14] == '0'?"":info.serialno+14,
	info.serialno[15]);
	tty_fprintf (fp, "Manufacturer .....: %s\n",
	get_manufacturer (xtoi_2(info.serialno+16)*256
	+ xtoi_2 (info.serialno+18)));
	tty_fprintf (fp, "Serial number ....: %.8s\n", info.serialno+20);

	print_isoname (fp, "Name of cardholder: ", "name", info.disp_name);
	print_name (fp, "Language prefs ...: ", info.disp_lang);
	tty_fprintf (fp, "Sex ..............: %s\n",
	info.disp_sex == 1? _("male"):
	info.disp_sex == 2? _("female") : _("unspecified"));
	print_name (fp, "URL of public key : ", info.pubkey_url);
	print_name (fp, "Login data .......: ", info.login_data);
	if (info.private_do[0])
	print_name (fp, "Private DO 1 .....: ", info.private_do[0]);
	if (info.private_do[1])
	print_name (fp, "Private DO 2 .....: ", info.private_do[1]);
	if (info.private_do[2])
	print_name (fp, "Private DO 3 .....: ", info.private_do[2]);
	if (info.private_do[3])
	print_name (fp, "Private DO 4 .....: ", info.private_do[3]);
	if (info.cafpr1valid)
	{
	tty_fprintf (fp, "CA fingerprint %d .:", 1);
	print_sha1_fpr (fp, info.cafpr1);
	}
	if (info.cafpr2valid)
	{
	tty_fprintf (fp, "CA fingerprint %d .:", 2);
	print_sha1_fpr (fp, info.cafpr2);
	}
	if (info.cafpr3valid)
	{
	tty_fprintf (fp, "CA fingerprint %d .:", 3);
	print_sha1_fpr (fp, info.cafpr3);
	}
	tty_fprintf (fp, "Signature PIN ....: %s\n",
	info.chv1_cached? _("not forced"): _("forced"));
	if (info.key_attr[0].algo)
	{
	tty_fprintf (fp, "Key attributes ...:");
	for (i=0; i < DIM (info.key_attr); i++)
	if (info.key_attr[i].algo == PUBKEY_ALGO_RSA)
	tty_fprintf (fp, " rsa%u", info.key_attr[i].nbits);
	else if (info.key_attr[i].algo == PUBKEY_ALGO_ECDH
	\|\| info.key_attr[i].algo == PUBKEY_ALGO_ECDSA
	\|\| info.key_attr[i].algo == PUBKEY_ALGO_EDDSA)
	{
	const char *curve_for_print = "?";

	if (info.key_attr[i].curve)
	{
	const char *oid;
	oid = openpgp_curve_to_oid (info.key_attr[i].curve, NULL);
	if (oid)
	curve_for_print = openpgp_oid_to_curve (oid, 0);
	}
	tty_fprintf (fp, " %s", curve_for_print);
	}
	tty_fprintf (fp, "\n");
	}
	tty_fprintf (fp, "Max. PIN lengths .: %d %d %d\n",
	info.chvmaxlen[0], info.chvmaxlen[1], info.chvmaxlen[2]);
	tty_fprintf (fp, "PIN retry counter : %d %d %d\n",
	info.chvretry[0], info.chvretry[1], info.chvretry[2]);
	tty_fprintf (fp, "Signature counter : %lu\n", info.sig_counter);
	tty_fprintf (fp, "Signature key ....:");
	print_sha1_fpr (fp, info.fpr1valid? info.fpr1:NULL);
	if (info.fpr1valid && info.fpr1time)
	tty_fprintf (fp, " created ....: %s\n",
	isotimestamp (info.fpr1time));
	tty_fprintf (fp, "Encryption key....:");
	print_sha1_fpr (fp, info.fpr2valid? info.fpr2:NULL);
	if (info.fpr2valid && info.fpr2time)
	tty_fprintf (fp, " created ....: %s\n",
	isotimestamp (info.fpr2time));
	tty_fprintf (fp, "Authentication key:");
	print_sha1_fpr (fp, info.fpr3valid? info.fpr3:NULL);
	if (info.fpr3valid && info.fpr3time)
	tty_fprintf (fp, " created ....: %s\n",
	isotimestamp (info.fpr3time));
	tty_fprintf (fp, "General key info..: ");

	thefpr = (info.fpr1valid? info.fpr1 : info.fpr2valid? info.fpr2 :
	info.fpr3valid? info.fpr3 : NULL);
	/* If the fingerprint is all 0xff, the key has no asssociated
	OpenPGP certificate. */
	if ( thefpr && !fpr_is_ff (thefpr)
	&& !get_pubkey_byfprint (pk, &keyblock, thefpr, 20))
	{
	print_pubkey_info (fp, pk);
	if (keyblock)
	print_card_key_info (fp, keyblock);
	}
	else
	tty_fprintf (fp, "[none]\n");
	}

	release_kbnode (keyblock);
	free_public_key (pk);
	agent_release_card_info (&info);
	}


	static char *
	get_one_name (const char prompt1, const char prompt2)
	{
	char *name;
	int i;

	for (;;)
	{
	name = cpr_get (prompt1, prompt2);
	if (!name)
	return NULL;
	trim_spaces (name);
	cpr_kill_prompt ();
	for (i=0; name[i] && name[i] >= ' ' && name[i] <= 126; i++)
	;

	/* The name must be in Latin-1 and not UTF-8 - lacking the code
	to ensure this we restrict it to ASCII. */
	if (name[i])
	tty_printf (_("Error: Only plain ASCII is currently allowed.\n"));
	else if (strchr (name, '<'))
	tty_printf (_("Error: The \"<\" character may not be used.\n"));
	else if (strstr (name, " "))
	tty_printf (_("Error: Double spaces are not allowed.\n"));
	else
	return name;
	xfree (name);
	}
	}



	static int
	change_name (void)
	{
	char surname = NULL, givenname = NULL;
	char isoname, p;
	int rc;

	surname = get_one_name ("keygen.smartcard.surname",
	_("Cardholder's surname: "));
	givenname = get_one_name ("keygen.smartcard.givenname",
	_("Cardholder's given name: "));
	if (!surname \|\| !givenname \|\| (!surname && !givenname))
	{
	xfree (surname);
	xfree (givenname);
	return -1; /canceled/
	}

	isoname = xmalloc ( strlen (surname) + 2 + strlen (givenname) + 1);
	strcpy (stpcpy (stpcpy (isoname, surname), "<<"), givenname);
	xfree (surname);
	xfree (givenname);
	for (p=isoname; *p; p++)
	if (*p == ' ')
	*p = '<';

	if (strlen (isoname) > 39 )
	{
	tty_printf (_("Error: Combined name too long "
	"(limit is %d characters).\n"), 39);
	xfree (isoname);
	return -1;
	}

	rc = agent_scd_setattr ("DISP-NAME", isoname, strlen (isoname), NULL );
	if (rc)
	log_error ("error setting Name: %s\n", gpg_strerror (rc));

	xfree (isoname);
	return rc;
	}


	static int
	change_url (void)
	{
	char *url;
	int rc;

	url = cpr_get ("cardedit.change_url", _("URL to retrieve public key: "));
	if (!url)
	return -1;
	trim_spaces (url);
	cpr_kill_prompt ();

	if (strlen (url) > 254 )
	{
	tty_printf (_("Error: URL too long "
	"(limit is %d characters).\n"), 254);
	xfree (url);
	return -1;
	}

	rc = agent_scd_setattr ("PUBKEY-URL", url, strlen (url), NULL );
	if (rc)
	log_error ("error setting URL: %s\n", gpg_strerror (rc));
	xfree (url);
	write_sc_op_status (rc);
	return rc;
	}


	/* Fetch the key from the URL given on the card or try to get it from
	the default keyserver. */
	static int
	fetch_url (ctrl_t ctrl)
	{
	int rc;
	struct agent_card_info_s info;

	memset(&info,0,sizeof(info));

	rc=agent_scd_getattr("PUBKEY-URL",&info);
	if(rc)
	log_error("error retrieving URL from card: %s\n",gpg_strerror(rc));
	else
	{
	rc=agent_scd_getattr("KEY-FPR",&info);
	if(rc)
	log_error("error retrieving key fingerprint from card: %s\n",
	gpg_strerror(rc));
	else if (info.pubkey_url && *info.pubkey_url)
	{
	strlist_t sl = NULL;

	add_to_strlist (&sl, info.pubkey_url);
	rc = keyserver_fetch (ctrl, sl);
	free_strlist (sl);
	}
	else if (info.fpr1valid)
	{
	rc = keyserver_import_fprint (ctrl, info.fpr1, 20, opt.keyserver, 0);
	}
	}

	return rc;
	}


	/* Read data from file FNAME up to MAXLEN characters. On error return
	-1 and store NULL at R_BUFFER; on success return the number of
	bytes read and store the address of a newly allocated buffer at
	R_BUFFER. */
	static int
	get_data_from_file (const char fname, size_t maxlen, char *r_buffer)
	{
	estream_t fp;
	char *data;
	int n;

	*r_buffer = NULL;

	fp = es_fopen (fname, "rb");
	#if GNUPG_MAJOR_VERSION == 1
	if (fp && is_secured_file (fileno (fp)))
	{
	fclose (fp);
	fp = NULL;
	errno = EPERM;
	}
	#endif
	if (!fp)
	{
	tty_printf (_("can't open '%s': %s\n"), fname, strerror (errno));
	return -1;
	}

	data = xtrymalloc (maxlen? maxlen:1);
	if (!data)
	{
	tty_printf (_("error allocating enough memory: %s\n"), strerror (errno));
	es_fclose (fp);
	return -1;
	}

	if (maxlen)
	n = es_fread (data, 1, maxlen, fp);
	else
	n = 0;
	es_fclose (fp);
	if (n < 0)
	{
	tty_printf (_("error reading '%s': %s\n"), fname, strerror (errno));
	xfree (data);
	return -1;
	}
	*r_buffer = data;
	return n;
	}


	/* Write LENGTH bytes from BUFFER to file FNAME. Return 0 on
	success. */
	static int
	put_data_to_file (const char fname, const void buffer, size_t length)
	{
	estream_t fp;

	fp = es_fopen (fname, "wb");
	#if GNUPG_MAJOR_VERSION == 1
	if (fp && is_secured_file (fileno (fp)))
	{
	fclose (fp);
	fp = NULL;
	errno = EPERM;
	}
	#endif
	if (!fp)
	{
	tty_printf (_("can't create '%s': %s\n"), fname, strerror (errno));
	return -1;
	}

	if (length && es_fwrite (buffer, length, 1, fp) != 1)
	{
	tty_printf (_("error writing '%s': %s\n"), fname, strerror (errno));
	es_fclose (fp);
	return -1;
	}
	es_fclose (fp);
	return 0;
	}


	static int
	change_login (const char *args)
	{
	char *data;
	int n;
	int rc;

	if (args && args == '<') / Read it from a file */
	{
	for (args++; spacep (args); args++)
	;
	n = get_data_from_file (args, 254, &data);
	if (n < 0)
	return -1;
	}
	else
	{
	data = cpr_get ("cardedit.change_login",
	_("Login data (account name): "));
	if (!data)
	return -1;
	trim_spaces (data);
	cpr_kill_prompt ();
	n = strlen (data);
	}

	if (n > 254 )
	{
	tty_printf (_("Error: Login data too long "
	"(limit is %d characters).\n"), 254);
	xfree (data);
	return -1;
	}

	rc = agent_scd_setattr ("LOGIN-DATA", data, n, NULL );
	if (rc)
	log_error ("error setting login data: %s\n", gpg_strerror (rc));
	xfree (data);
	write_sc_op_status (rc);
	return rc;
	}

	static int
	change_private_do (const char *args, int nr)
	{
	char do_name[] = "PRIVATE-DO-X";
	char *data;
	int n;
	int rc;

	log_assert (nr >= 1 && nr <= 4);
	do_name[11] = '0' + nr;

	if (args && (args = strchr (args, '<'))) /* Read it from a file */
	{
	for (args++; spacep (args); args++)
	;
	n = get_data_from_file (args, 254, &data);
	if (n < 0)
	return -1;
	}
	else
	{
	data = cpr_get ("cardedit.change_private_do",
	_("Private DO data: "));
	if (!data)
	return -1;
	trim_spaces (data);
	cpr_kill_prompt ();
	n = strlen (data);
	}

	if (n > 254 )
	{
	tty_printf (_("Error: Private DO too long "
	"(limit is %d characters).\n"), 254);
	xfree (data);
	return -1;
	}

	rc = agent_scd_setattr (do_name, data, n, NULL );
	if (rc)
	log_error ("error setting private DO: %s\n", gpg_strerror (rc));
	xfree (data);
	write_sc_op_status (rc);
	return rc;
	}


	static int
	change_cert (const char *args)
	{
	char *data;
	int n;
	int rc;

	if (args && args == '<') / Read it from a file */
	{
	for (args++; spacep (args); args++)
	;
	n = get_data_from_file (args, 16384, &data);
	if (n < 0)
	return -1;
	}
	else
	{
	tty_printf ("usage error: redirection to file required\n");
	return -1;
	}

	rc = agent_scd_writecert ("OPENPGP.3", data, n);
	if (rc)
	log_error ("error writing certificate to card: %s\n", gpg_strerror (rc));
	xfree (data);
	write_sc_op_status (rc);
	return rc;
	}


	static int
	read_cert (const char *args)
	{
	const char *fname;
	void *buffer;
	size_t length;
	int rc;

	if (args && args == '>') / Write it to a file */
	{
	for (args++; spacep (args); args++)
	;
	fname = args;
	}
	else
	{
	tty_printf ("usage error: redirection to file required\n");
	return -1;
	}

	rc = agent_scd_readcert ("OPENPGP.3", &buffer, &length);
	if (rc)
	log_error ("error reading certificate from card: %s\n", gpg_strerror (rc));
	else
	rc = put_data_to_file (fname, buffer, length);
	xfree (buffer);
	write_sc_op_status (rc);
	return rc;
	}


	static int
	change_lang (void)
	{
	char data, p;
	int rc;

	data = cpr_get ("cardedit.change_lang",
	_("Language preferences: "));
	if (!data)
	return -1;
	trim_spaces (data);
	cpr_kill_prompt ();

	if (strlen (data) > 8 \|\| (strlen (data) & 1))
	{
	tty_printf (_("Error: invalid length of preference string.\n"));
	xfree (data);
	return -1;
	}

	for (p=data; p && p >= 'a' && *p <= 'z'; p++)
	;
	if (*p)
	{
	tty_printf (_("Error: invalid characters in preference string.\n"));
	xfree (data);
	return -1;
	}

	rc = agent_scd_setattr ("DISP-LANG", data, strlen (data), NULL );
	if (rc)
	log_error ("error setting lang: %s\n", gpg_strerror (rc));
	xfree (data);
	write_sc_op_status (rc);
	return rc;
	}


	static int
	change_sex (void)
	{
	char *data;
	const char *str;
	int rc;

	data = cpr_get ("cardedit.change_sex",
	_("Sex ((M)ale, (F)emale or space): "));
	if (!data)
	return -1;
	trim_spaces (data);
	cpr_kill_prompt ();

	if (!*data)
	str = "9";
	else if ((data == 'M' \|\| data == 'm') && !data[1])
	str = "1";
	else if ((data == 'F' \|\| data == 'f') && !data[1])
	str = "2";
	else
	{
	tty_printf (_("Error: invalid response.\n"));
	xfree (data);
	return -1;
	}

	rc = agent_scd_setattr ("DISP-SEX", str, 1, NULL );
	if (rc)
	log_error ("error setting sex: %s\n", gpg_strerror (rc));
	xfree (data);
	write_sc_op_status (rc);
	return rc;
	}


	static int
	change_cafpr (int fprno)
	{
	char *data;
	const char *s;
	int i, c, rc;
	unsigned char fpr[20];

	data = cpr_get ("cardedit.change_cafpr", _("CA fingerprint: "));
	if (!data)
	return -1;
	trim_spaces (data);
	cpr_kill_prompt ();

	for (i=0, s=data; i < 20 && *s; )
	{
	while (spacep(s))
	s++;
	if (*s == ':')
	s++;
	while (spacep(s))
	s++;
	c = hextobyte (s);
	if (c == -1)
	break;
	fpr[i++] = c;
	s += 2;
	}
	xfree (data);
	if (i != 20 \|\| *s)
	{
	tty_printf (_("Error: invalid formatted fingerprint.\n"));
	return -1;
	}

	rc = agent_scd_setattr (fprno==1?"CA-FPR-1":
	fprno==2?"CA-FPR-2":
	fprno==3?"CA-FPR-3":"x", fpr, 20, NULL );
	if (rc)
	log_error ("error setting cafpr: %s\n", gpg_strerror (rc));
	write_sc_op_status (rc);
	return rc;
	}



	static void
	toggle_forcesig (void)
	{
	struct agent_card_info_s info;
	int rc;
	int newstate;

	memset (&info, 0, sizeof info);
	rc = agent_scd_getattr ("CHV-STATUS", &info);
	if (rc)
	{
	log_error ("error getting current status: %s\n", gpg_strerror (rc));
	return;
	}
	newstate = !info.chv1_cached;
	agent_release_card_info (&info);

	rc = agent_scd_setattr ("CHV-STATUS-1", newstate? "\x01":"", 1, NULL);
	if (rc)
	log_error ("error toggling signature PIN flag: %s\n", gpg_strerror (rc));
	write_sc_op_status (rc);
	}


	/* Helper for the key generation/edit functions. */
	static int
	get_info_for_key_operation (struct agent_card_info_s *info)
	{
	int rc;

	memset (info, 0, sizeof *info);
	rc = agent_scd_getattr ("SERIALNO", info);
	if (rc \|\| !info->serialno \|\| strncmp (info->serialno, "D27600012401", 12)
	\|\| strlen (info->serialno) != 32 )
	{
	log_error (_("key operation not possible: %s\n"),
	rc ? gpg_strerror (rc) : _("not an OpenPGP card"));
	return rc? rc: -1;
	}
	rc = agent_scd_getattr ("KEY-FPR", info);
	if (!rc)
	rc = agent_scd_getattr ("CHV-STATUS", info);
	if (!rc)
	rc = agent_scd_getattr ("DISP-NAME", info);
	if (!rc)
	rc = agent_scd_getattr ("EXTCAP", info);
	if (!rc)
	rc = agent_scd_getattr ("KEY-ATTR", info);
	if (rc)
	log_error (_("error getting current key info: %s\n"), gpg_strerror (rc));
	return rc;
	}


	/* Helper for the key generation/edit functions. */
	static int
	check_pin_for_key_operation (struct agent_card_info_s info, int forced_chv1)
	{
	int rc = 0;

	agent_clear_pin_cache (info->serialno);

	*forced_chv1 = !info->chv1_cached;
	if (*forced_chv1)
	{ /* Switch off the forced mode so that during key generation we
	don't get bothered with PIN queries for each
	self-signature. */
	rc = agent_scd_setattr ("CHV-STATUS-1", "\x01", 1, info->serialno);
	if (rc)
	{
	log_error ("error clearing forced signature PIN flag: %s\n",
	gpg_strerror (rc));
	*forced_chv1 = 0;
	}
	}

	if (!rc)
	{
	/* Check the PIN now, so that we won't get asked later for each
	binding signature. */
	rc = agent_scd_checkpin (info->serialno);
	if (rc)
	{
	log_error ("error checking the PIN: %s\n", gpg_strerror (rc));
	write_sc_op_status (rc);
	}
	}
	return rc;
	}

	/* Helper for the key generation/edit functions. */
	static void
	restore_forced_chv1 (int *forced_chv1)
	{
	int rc;

	if (*forced_chv1)
	{ /* Switch back to forced state. */
	rc = agent_scd_setattr ("CHV-STATUS-1", "", 1, NULL);
	if (rc)
	{
	log_error ("error setting forced signature PIN flag: %s\n",
	gpg_strerror (rc));
	}
	}
	}


	/* Helper for the key generation/edit functions. */
	static void
	show_card_key_info (struct agent_card_info_s *info)
	{
	tty_fprintf (NULL, "Signature key ....:");
	print_sha1_fpr (NULL, info->fpr1valid? info->fpr1:NULL);
	tty_fprintf (NULL, "Encryption key....:");
	print_sha1_fpr (NULL, info->fpr2valid? info->fpr2:NULL);
	tty_fprintf (NULL, "Authentication key:");
	print_sha1_fpr (NULL, info->fpr3valid? info->fpr3:NULL);
	tty_printf ("\n");
	}


	/* Helper for the key generation/edit functions. */
	static int
	replace_existing_key_p (struct agent_card_info_s *info, int keyno)
	{
	log_assert (keyno >= 0 && keyno <= 3);

	if ((keyno == 1 && info->fpr1valid)
	\|\| (keyno == 2 && info->fpr2valid)
	\|\| (keyno == 3 && info->fpr3valid))
	{
	tty_printf ("\n");
	log_info ("WARNING: such a key has already been stored on the card!\n");
	tty_printf ("\n");
	if ( !cpr_get_answer_is_yes( "cardedit.genkeys.replace_key",
	_("Replace existing key? (y/N) ")))
	return -1;
	return 1;
	}
	return 0;
	}


	static void
	show_keysize_warning (void)
	{
	static int shown;

	if (shown)
	return;
	shown = 1;
	tty_printf
	(_("Note: There is no guarantee that the card "
	"supports the requested size.\n"
	" If the key generation does not succeed, "
	"please check the\n"
	" documentation of your card to see what "
	"sizes are allowed.\n"));
	}


	/* Ask for the size of a card key. NBITS is the current size
	configured for the card. KEYNO is the number of the key used to
	select the prompt. Returns 0 to use the default size (i.e. NBITS)
	or the selected size. */
	static unsigned int
	ask_card_rsa_keysize (int keyno, unsigned int nbits)
	{
	unsigned int min_nbits = 1024;
	unsigned int max_nbits = 4096;
	char prompt, answer;
	unsigned int req_nbits;

	for (;;)
	{
	prompt = xasprintf
	(keyno == 0?
	_("What keysize do you want for the Signature key? (%u) "):
	keyno == 1?
	_("What keysize do you want for the Encryption key? (%u) "):
	_("What keysize do you want for the Authentication key? (%u) "),
	nbits);
	answer = cpr_get ("cardedit.genkeys.size", prompt);
	cpr_kill_prompt ();
	req_nbits = *answer? atoi (answer): nbits;
	xfree (prompt);
	xfree (answer);

	if (req_nbits != nbits && (req_nbits % 32) )
	{
	req_nbits = ((req_nbits + 31) / 32) * 32;
	tty_printf (_("rounded up to %u bits\n"), req_nbits);
	}

	if (req_nbits == nbits)
	return 0; /* Use default. */

	if (req_nbits < min_nbits \|\| req_nbits > max_nbits)
	{
	tty_printf (_("%s keysizes must be in the range %u-%u\n"),
	"RSA", min_nbits, max_nbits);
	}
	else
	{
	tty_printf (_("The card will now be re-configured "
	"to generate a key of %u bits\n"), req_nbits);
	show_keysize_warning ();
	return req_nbits;
	}
	}
	}


	/* Change the size of key KEYNO (0..2) to NBITS and show an error
	message if that fails. */
	static gpg_error_t
	do_change_rsa_keysize (int keyno, unsigned int nbits)
	{
	gpg_error_t err;
	char args[100];

	snprintf (args, sizeof args, "--force %d 1 rsa%u", keyno+1, nbits);
	err = agent_scd_setattr ("KEY-ATTR", args, strlen (args), NULL);
	if (err)
	log_error (_("error changing size of key %d to %u bits: %s\n"),
	keyno+1, nbits, gpg_strerror (err));
	return err;
	}


	static void
	generate_card_keys (ctrl_t ctrl)
	{
	struct agent_card_info_s info;
	int forced_chv1;
	int want_backup;
	int keyno;

	if (get_info_for_key_operation (&info))
	return;

	if (info.extcap.ki)
	{
	char *answer;

	/* FIXME: Should be something like cpr_get_bool so that a status
	GET_BOOL will be emitted. */
	answer = cpr_get ("cardedit.genkeys.backup_enc",
	_("Make off-card backup of encryption key? (Y/n) "));

	want_backup = answer_is_yes_no_default (answer, 1/(default to Yes)/);
	cpr_kill_prompt ();
	xfree (answer);
	}
	else
	want_backup = 0;

	if ( (info.fpr1valid && !fpr_is_zero (info.fpr1))
	\|\| (info.fpr2valid && !fpr_is_zero (info.fpr2))
	\|\| (info.fpr3valid && !fpr_is_zero (info.fpr3)))
	{
	tty_printf ("\n");
	log_info (_("Note: keys are already stored on the card!\n"));
	tty_printf ("\n");
	if ( !cpr_get_answer_is_yes ("cardedit.genkeys.replace_keys",
	_("Replace existing keys? (y/N) ")))
	{
	agent_release_card_info (&info);
	return;
	}
	}

	/* If no displayed name has been set, we assume that this is a fresh
	card and print a hint about the default PINs. */
	if (!info.disp_name \|\| !*info.disp_name)
	{
	tty_printf ("\n");
	tty_printf (_("Please note that the factory settings of the PINs are\n"
	" PIN = '%s' Admin PIN = '%s'\n"
	"You should change them using the command --change-pin\n"),
	"123456", "12345678");
	tty_printf ("\n");
	}

	if (check_pin_for_key_operation (&info, &forced_chv1))
	goto leave;

	/* If the cards features changeable key attributes, we ask for the
	key size. */
	if (info.is_v2 && info.extcap.aac)
	{
	unsigned int nbits;

	for (keyno = 0; keyno < DIM (info.key_attr); keyno++)
	{
	if (info.key_attr[keyno].algo == PUBKEY_ALGO_RSA)
	{
	nbits = ask_card_rsa_keysize (keyno, info.key_attr[keyno].nbits);
	if (nbits && do_change_rsa_keysize (keyno, nbits))
	{
	/* Error: Better read the default key size again. */
	agent_release_card_info (&info);
	if (get_info_for_key_operation (&info))
	goto leave;
	/* Ask again for this key size. */
	keyno--;
	}
	}
	}
	/* Note that INFO has not be synced. However we will only use
	the serialnumber and thus it won't harm. */
	}

	generate_keypair (ctrl, 1, NULL, info.serialno, want_backup);

	leave:
	agent_release_card_info (&info);
	restore_forced_chv1 (&forced_chv1);
	}


	/* This function is used by the key edit menu to generate an arbitrary
	subkey. */
	gpg_error_t
	card_generate_subkey (KBNODE pub_keyblock)
	{
	gpg_error_t err;
	struct agent_card_info_s info;
	int forced_chv1 = 0;
	int keyno;

	err = get_info_for_key_operation (&info);
	if (err)
	return err;

	show_card_key_info (&info);

	tty_printf (_("Please select the type of key to generate:\n"));

	tty_printf (_(" (1) Signature key\n"));
	tty_printf (_(" (2) Encryption key\n"));
	tty_printf (_(" (3) Authentication key\n"));

	for (;;)
	{
	char *answer = cpr_get ("cardedit.genkeys.subkeytype",
	_("Your selection? "));
	cpr_kill_prompt();
	if (*answer == CONTROL_D)
	{
	xfree (answer);
	err = gpg_error (GPG_ERR_CANCELED);
	goto leave;
	}
	keyno = *answer? atoi(answer): 0;
	xfree(answer);
	if (keyno >= 1 && keyno <= 3)
	break; /* Okay. */
	tty_printf(_("Invalid selection.\n"));
	}

	if (replace_existing_key_p (&info, keyno) < 0)
	{
	err = gpg_error (GPG_ERR_CANCELED);
	goto leave;
	}

	err = check_pin_for_key_operation (&info, &forced_chv1);
	if (err)
	goto leave;

	/* If the cards features changeable key attributes, we ask for the
	key size. */
	if (info.is_v2 && info.extcap.aac)
	{
	if (info.key_attr[keyno-1].algo == PUBKEY_ALGO_RSA)
	{
	unsigned int nbits;

	ask_again:
	nbits = ask_card_rsa_keysize (keyno-1, info.key_attr[keyno-1].nbits);
	if (nbits && do_change_rsa_keysize (keyno-1, nbits))
	{
	/* Error: Better read the default key size again. */
	agent_release_card_info (&info);
	err = get_info_for_key_operation (&info);
	if (err)
	goto leave;
	goto ask_again;
	}
	}
	/* Note that INFO has not be synced. However we will only use
	the serialnumber and thus it won't harm. */
	}

	err = generate_card_subkeypair (pub_keyblock, keyno, info.serialno);

	leave:
	agent_release_card_info (&info);
	restore_forced_chv1 (&forced_chv1);
	return err;
	}


	/* Store the key at NODE into the smartcard and modify NODE to
	carry the serialno stuff instead of the actual secret key
	parameters. USE is the usage for that key; 0 means any
	usage. */
	int
	card_store_subkey (KBNODE node, int use)
	{
	struct agent_card_info_s info;
	int okay = 0;
	unsigned int nbits;
	int allow_keyno[3];
	int keyno;
	PKT_public_key *pk;
	gpg_error_t err;
	char *hexgrip;
	int rc;
	gnupg_isotime_t timebuf;

	log_assert (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	pk = node->pkt->pkt.public_key;

	if (get_info_for_key_operation (&info))
	return 0;

	if (!info.extcap.ki)
	{
	tty_printf ("The card does not support the import of keys\n");
	tty_printf ("\n");
	goto leave;
	}

	nbits = nbits_from_pk (pk);

	if (!info.is_v2 && nbits != 1024)
	{
	tty_printf ("You may only store a 1024 bit RSA key on the card\n");
	tty_printf ("\n");
	goto leave;
	}

	allow_keyno[0] = (!use \|\| (use & (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_CERT)));
	allow_keyno[1] = (!use \|\| (use & (PUBKEY_USAGE_ENC)));
	allow_keyno[2] = (!use \|\| (use & (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_AUTH)));

	tty_printf (_("Please select where to store the key:\n"));

	if (allow_keyno[0])
	tty_printf (_(" (1) Signature key\n"));
	if (allow_keyno[1])
	tty_printf (_(" (2) Encryption key\n"));
	if (allow_keyno[2])
	tty_printf (_(" (3) Authentication key\n"));

	for (;;)
	{
	char *answer = cpr_get ("cardedit.genkeys.storekeytype",
	_("Your selection? "));
	cpr_kill_prompt();
	if (answer == CONTROL_D \|\| !answer)
	{
	xfree (answer);
	goto leave;
	}
	keyno = *answer? atoi(answer): 0;
	xfree(answer);
	if (keyno >= 1 && keyno <= 3 && allow_keyno[keyno-1])
	{
	if (info.is_v2 && !info.extcap.aac
	&& info.key_attr[keyno-1].nbits != nbits)
	{
	tty_printf ("Key does not match the card's capability.\n");
	}
	else
	break; /* Okay. */
	}
	else
	tty_printf(_("Invalid selection.\n"));
	}

	if ((rc = replace_existing_key_p (&info, keyno)) < 0)
	goto leave;

	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	goto leave;

	epoch2isotime (timebuf, (time_t)pk->timestamp);
	rc = agent_keytocard (hexgrip, keyno, rc, info.serialno, timebuf);

	if (rc)
	log_error (_("KEYTOCARD failed: %s\n"), gpg_strerror (rc));
	else
	okay = 1;
	xfree (hexgrip);

	leave:
	agent_release_card_info (&info);
	return okay;
	}



	/* Direct sending of an hex encoded APDU with error printing. */
	static gpg_error_t
	send_apdu (const char hexapdu, const char desc, unsigned int ignore)
	{
	gpg_error_t err;
	unsigned int sw;

	err = agent_scd_apdu (hexapdu, &sw);
	if (err)
	tty_printf ("sending card command %s failed: %s\n", desc,
	gpg_strerror (err));
	else if (!hexapdu \|\| !strcmp (hexapdu, "undefined"))
	;
	else if (ignore == 0xffff)
	; /* Ignore all status words. */
	else if (sw != 0x9000)
	{
	switch (sw)
	{
	case 0x6285: err = gpg_error (GPG_ERR_OBJ_TERM_STATE); break;
	case 0x6982: err = gpg_error (GPG_ERR_BAD_PIN); break;
	case 0x6985: err = gpg_error (GPG_ERR_USE_CONDITIONS); break;
	default: err = gpg_error (GPG_ERR_CARD);
	}
	if (!(ignore && ignore == sw))
	tty_printf ("card command %s failed: %s (0x%04x)\n", desc,
	gpg_strerror (err), sw);
	}
	return err;
	}


	/* Do a factory reset after confirmation. */
	static void
	factory_reset (void)
	{
	struct agent_card_info_s info;
	gpg_error_t err;
	char *answer = NULL;
	int termstate = 0;
	int i;

	/* The code below basically does the same what this
	gpg-connect-agent script does:

	scd reset
	scd serialno undefined
	scd apdu 00 A4 04 00 06 D2 76 00 01 24 01
	scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
	scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40
	scd apdu 00 e6 00 00
	scd reset
	scd serialno undefined
	scd apdu 00 A4 04 00 06 D2 76 00 01 24 01
	scd apdu 00 44 00 00
	/echo Card has been reset to factory defaults

	but tries to find out something about the card first.
	*/

	err = agent_scd_learn (&info, 0);
	if (gpg_err_code (err) == GPG_ERR_OBJ_TERM_STATE
	&& gpg_err_source (err) == GPG_ERR_SOURCE_SCD)
	termstate = 1;
	else if (err)
	{
	log_error (_("OpenPGP card not available: %s\n"), gpg_strerror (err));
	return;
	}

	if (!termstate)
	{
	log_info (_("OpenPGP card no. %s detected\n"),
	info.serialno? info.serialno : "[none]");
	if (!(info.status_indicator == 3 \|\| info.status_indicator == 5))
	{
	/* Note: We won't see status-indicator 3 here because it is not
	possible to select a card application in termination state. */
	log_error (_("This command is not supported by this card\n"));
	goto leave;
	}

	tty_printf ("\n");
	log_info (_("Note: This command destroys all keys stored on the card!\n"));
	tty_printf ("\n");
	if (!cpr_get_answer_is_yes ("cardedit.factory-reset.proceed",
	_("Continue? (y/N) ")))
	goto leave;


	answer = cpr_get ("cardedit.factory-reset.really",
	_("Really do a factory reset? (enter \"yes\") "));
	cpr_kill_prompt ();
	trim_spaces (answer);
	if (strcmp (answer, "yes"))
	goto leave;

	/* We need to select a card application before we can send APDUs
	to the card without scdaemon doing anything on its own. */
	err = send_apdu (NULL, "RESET", 0);
	if (err)
	goto leave;
	err = send_apdu ("undefined", "dummy select ", 0);
	if (err)
	goto leave;

	/* Select the OpenPGP application. */
	err = send_apdu ("00A4040006D27600012401", "SELECT AID", 0);
	if (err)
	goto leave;

	/* Do some dummy verifies with wrong PINs to set the retry
	counter to zero. We can't easily use the card version 2.1
	feature of presenting the admin PIN to allow the terminate
	command because there is no machinery in scdaemon to catch
	the verify command and ask for the PIN when the "APDU"
	command is used. */
	for (i=0; i < 4; i++)
	send_apdu ("00200081084040404040404040", "VERIFY", 0xffff);
	for (i=0; i < 4; i++)
	send_apdu ("00200083084040404040404040", "VERIFY", 0xffff);

	/* Send terminate datafile command. */
	err = send_apdu ("00e60000", "TERMINATE DF", 0x6985);
	if (err)
	goto leave;
	}

	/* The card is in termination state - reset and select again. */
	err = send_apdu (NULL, "RESET", 0);
	if (err)
	goto leave;
	err = send_apdu ("undefined", "dummy select", 0);
	if (err)
	goto leave;

	/* Select the OpenPGP application. (no error checking here). */
	send_apdu ("00A4040006D27600012401", "SELECT AID", 0xffff);

	/* Send activate datafile command. This is used without
	confirmation if the card is already in termination state. */
	err = send_apdu ("00440000", "ACTIVATE DF", 0);
	if (err)
	goto leave;

	/* Finally we reset the card reader once more. */
	err = send_apdu (NULL, "RESET", 0);
	if (err)
	goto leave;

	leave:
	xfree (answer);
	agent_release_card_info (&info);
	}



	/* Data used by the command parser. This needs to be outside of the
	function scope to allow readline based command completion. */
	enum cmdids
	{
	cmdNOP = 0,
	cmdQUIT, cmdADMIN, cmdHELP, cmdLIST, cmdDEBUG, cmdVERIFY,
	cmdNAME, cmdURL, cmdFETCH, cmdLOGIN, cmdLANG, cmdSEX, cmdCAFPR,
	cmdFORCESIG, cmdGENERATE, cmdPASSWD, cmdPRIVATEDO, cmdWRITECERT,
	cmdREADCERT, cmdUNBLOCK, cmdFACTORYRESET,
	cmdINVCMD
	};

	static struct
	{
	const char *name;
	enum cmdids id;
	int admin_only;
	const char *desc;
	} cmds[] =
	{
	{ "quit" , cmdQUIT , 0, N_("quit this menu")},
	{ "q" , cmdQUIT , 0, NULL },
	{ "admin" , cmdADMIN , 0, N_("show admin commands")},
	{ "help" , cmdHELP , 0, N_("show this help")},
	{ "?" , cmdHELP , 0, NULL },
	{ "list" , cmdLIST , 0, N_("list all available data")},
	{ "l" , cmdLIST , 0, NULL },
	{ "debug" , cmdDEBUG , 0, NULL },
	{ "name" , cmdNAME , 1, N_("change card holder's name")},
	{ "url" , cmdURL , 1, N_("change URL to retrieve key")},
	{ "fetch" , cmdFETCH , 0, N_("fetch the key specified in the card URL")},
	{ "login" , cmdLOGIN , 1, N_("change the login name")},
	{ "lang" , cmdLANG , 1, N_("change the language preferences")},
	{ "sex" , cmdSEX , 1, N_("change card holder's sex")},
	{ "cafpr" , cmdCAFPR , 1, N_("change a CA fingerprint")},
	{ "forcesig", cmdFORCESIG, 1, N_("toggle the signature force PIN flag")},
	{ "generate", cmdGENERATE, 1, N_("generate new keys")},
	{ "passwd" , cmdPASSWD, 0, N_("menu to change or unblock the PIN")},
	{ "verify" , cmdVERIFY, 0, N_("verify the PIN and list all data")},
	{ "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code") },
	{ "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")},
	/* Note, that we do not announce these command yet. */
	{ "privatedo", cmdPRIVATEDO, 0, NULL },
	{ "readcert", cmdREADCERT, 0, NULL },
	{ "writecert", cmdWRITECERT, 1, NULL },
	{ NULL, cmdINVCMD, 0, NULL }
	};


	#ifdef HAVE_LIBREADLINE

	/* These two functions are used by readline for command completion. */

	static char *
	command_generator(const char *text,int state)
	{
	static int list_index,len;
	const char *name;

	/* If this is a new word to complete, initialize now. This includes
	saving the length of TEXT for efficiency, and initializing the
	index variable to 0. */
	if(!state)
	{
	list_index=0;
	len=strlen(text);
	}

	/* Return the next partial match */
	while((name=cmds[list_index].name))
	{
	/* Only complete commands that have help text */
	if(cmds[list_index++].desc && strncmp(name,text,len)==0)
	return strdup(name);
	}

	return NULL;
	}

	static char **
	card_edit_completion(const char *text, int start, int end)
	{
	(void)end;
	/* If we are at the start of a line, we try and command-complete.
	If not, just do nothing for now. */

	if(start==0)
	return rl_completion_matches(text,command_generator);

	rl_attempted_completion_over=1;

	return NULL;
	}
	#endif /HAVE_LIBREADLINE/

	/* Menu to edit all user changeable values on an OpenPGP card. Only
	Key creation is not handled here. */
	void
	card_edit (ctrl_t ctrl, strlist_t commands)
	{
	enum cmdids cmd = cmdNOP;
	int have_commands = !!commands;
	int redisplay = 1;
	char *answer = NULL;
	int allow_admin=0;
	char serialnobuf[50];


	if (opt.command_fd != -1)
	;
	else if (opt.batch && !have_commands)
	{
	log_error(_("can't do this in batch mode\n"));
	goto leave;
	}

	for (;;)
	{
	int arg_number;
	const char *arg_string = "";
	const char *arg_rest = "";
	char *p;
	int i;
	int cmd_admin_only;

	tty_printf("\n");
	if (redisplay )
	{
	if (opt.with_colons)
	{
	card_status (es_stdout, serialnobuf, DIM (serialnobuf));
	fflush (stdout);
	}
	else
	{
	card_status (NULL, serialnobuf, DIM (serialnobuf));
	tty_printf("\n");
	}
	redisplay = 0;
	}

	do
	{
	xfree (answer);
	if (have_commands)
	{
	if (commands)
	{
	answer = xstrdup (commands->d);
	commands = commands->next;
	}
	else if (opt.batch)
	{
	answer = xstrdup ("quit");
	}
	else
	have_commands = 0;
	}

	if (!have_commands)
	{
	tty_enable_completion (card_edit_completion);
	answer = cpr_get_no_help("cardedit.prompt", _("gpg/card> "));
	cpr_kill_prompt();
	tty_disable_completion ();
	}
	trim_spaces(answer);
	}
	while ( *answer == '#' );

	arg_number = 0; /* Yes, here is the init which egcc complains about */
	cmd_admin_only = 0;
	if (!*answer)
	cmd = cmdLIST; /* Default to the list command */
	else if (*answer == CONTROL_D)
	cmd = cmdQUIT;
	else
	{
	if ((p=strchr (answer,' ')))
	{
	*p++ = 0;
	trim_spaces (answer);
	trim_spaces (p);
	arg_number = atoi(p);
	arg_string = p;
	arg_rest = p;
	while (digitp (arg_rest))
	arg_rest++;
	while (spacep (arg_rest))
	arg_rest++;
	}

	for (i=0; cmds[i].name; i++ )
	if (!ascii_strcasecmp (answer, cmds[i].name ))
	break;

	cmd = cmds[i].id;
	cmd_admin_only = cmds[i].admin_only;
	}

	if (!allow_admin && cmd_admin_only)
	{
	tty_printf ("\n");
	tty_printf (_("Admin-only command\n"));
	continue;
	}

	switch (cmd)
	{
	case cmdHELP:
	for (i=0; cmds[i].name; i++ )
	if(cmds[i].desc
	&& (!cmds[i].admin_only \|\| (cmds[i].admin_only && allow_admin)))
	tty_printf("%-14s %s\n", cmds[i].name, _(cmds[i].desc) );
	break;

	case cmdADMIN:
	if ( !strcmp (arg_string, "on") )
	allow_admin = 1;
	else if ( !strcmp (arg_string, "off") )
	allow_admin = 0;
	else if ( !strcmp (arg_string, "verify") )
	{
	/* Force verification of the Admin Command. However,
	this is only done if the retry counter is at initial
	state. */
	char *tmp = xmalloc (strlen (serialnobuf) + 6 + 1);
	strcpy (stpcpy (tmp, serialnobuf), "[CHV3]");
	allow_admin = !agent_scd_checkpin (tmp);
	xfree (tmp);
	}
	else /* Toggle. */
	allow_admin=!allow_admin;
	if(allow_admin)
	tty_printf(_("Admin commands are allowed\n"));
	else
	tty_printf(_("Admin commands are not allowed\n"));
	break;

	case cmdVERIFY:
	agent_scd_checkpin (serialnobuf);
	redisplay = 1;
	break;

	case cmdLIST:
	redisplay = 1;
	break;

	case cmdNAME:
	change_name ();
	break;

	case cmdURL:
	change_url ();
	break;

	case cmdFETCH:
	fetch_url (ctrl);
	break;

	case cmdLOGIN:
	change_login (arg_string);
	break;

	case cmdLANG:
	change_lang ();
	break;

	case cmdSEX:
	change_sex ();
	break;

	case cmdCAFPR:
	if ( arg_number < 1 \|\| arg_number > 3 )
	tty_printf ("usage: cafpr N\n"
	" 1 <= N <= 3\n");
	else
	change_cafpr (arg_number);
	break;

	case cmdPRIVATEDO:
	if ( arg_number < 1 \|\| arg_number > 4 )
	tty_printf ("usage: privatedo N\n"
	" 1 <= N <= 4\n");
	else
	change_private_do (arg_string, arg_number);
	break;

	case cmdWRITECERT:
	if ( arg_number != 3 )
	tty_printf ("usage: writecert 3 < FILE\n");
	else
	change_cert (arg_rest);
	break;

	case cmdREADCERT:
	if ( arg_number != 3 )
	tty_printf ("usage: readcert 3 > FILE\n");
	else
	read_cert (arg_rest);
	break;

	case cmdFORCESIG:
	toggle_forcesig ();
	break;

	case cmdGENERATE:
	generate_card_keys (ctrl);
	break;

	case cmdPASSWD:
	change_pin (0, allow_admin);
	break;

	case cmdUNBLOCK:
	change_pin (1, allow_admin);
	break;

	case cmdFACTORYRESET:
	factory_reset ();
	break;

	case cmdQUIT:
	goto leave;

	case cmdNOP:
	break;

	case cmdINVCMD:
	default:
	tty_printf ("\n");
	tty_printf (_("Invalid command (try \"help\")\n"));
	break;
	} /* End command switch. */
	} /* End of main menu loop. */

	leave:
	xfree (answer);
	}
	diff --git a/g10/compress.c b/g10/compress.c
	index fbc8097d7..a14d107ed 100644
	--- a/g10/compress.c
	+++ b/g10/compress.c
	@@ -1,365 +1,365 @@
	/* compress.c - compress filter
	* Copyright (C) 1998, 1999, 2000, 2001, 2002,
	* 2003, 2006, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* Note that the code in compress-bz2.c is nearly identical to the
	code here, so if you fix a bug here, look there to see if a
	matching bug needs to be fixed. I tried to have one set of
	functions that could do ZIP, ZLIB, and BZIP2, but it became
	dangerously unreadable with #ifdefs and if(algo) -dshaw */

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#ifdef HAVE_ZIP
	# include <zlib.h>
	# if defined(__riscos__) && defined(USE_ZLIBRISCOS)
	# include "zlib-riscos.h"
	# endif
	#endif

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "filter.h"
	#include "main.h"
	#include "options.h"


	#ifdef __riscos__
	#define BYTEF_CAST(a) ((Bytef *)(a))
	#else
	#define BYTEF_CAST(a) (a)
	#endif



	int compress_filter_bz2( void *opaque, int control,
	IOBUF a, byte buf, size_t ret_len);

	#ifdef HAVE_ZIP
	static void
	init_compress( compress_filter_context_t zfx, z_stream zs )
	{
	int rc;
	int level;

	#if defined(__riscos__) && defined(USE_ZLIBRISCOS)
	static int zlib_initialized = 0;

	if (!zlib_initialized)
	zlib_initialized = riscos_load_module("ZLib", zlib_path, 1);
	#endif

	if( opt.compress_level >= 1 && opt.compress_level <= 9 )
	level = opt.compress_level;
	else if( opt.compress_level == -1 )
	level = Z_DEFAULT_COMPRESSION;
	else {
	log_error("invalid compression level; using default level\n");
	level = Z_DEFAULT_COMPRESSION;
	}

	if( (rc = zfx->algo == 1? deflateInit2( zs, level, Z_DEFLATED,
	-13, 8, Z_DEFAULT_STRATEGY)
	: deflateInit( zs, level )
	) != Z_OK ) {
	log_fatal("zlib problem: %s\n", zs->msg? zs->msg :
	rc == Z_MEM_ERROR ? "out of core" :
	rc == Z_VERSION_ERROR ? "invalid lib version" :
	"unknown error" );
	}

	zfx->outbufsize = 8192;
	zfx->outbuf = xmalloc( zfx->outbufsize );
	}

	static int
	do_compress( compress_filter_context_t zfx, z_stream zs, int flush, IOBUF a )
	{
	int rc;
	int zrc;
	unsigned n;

	do {
	zs->next_out = BYTEF_CAST (zfx->outbuf);
	zs->avail_out = zfx->outbufsize;
	if( DBG_FILTER )
	log_debug("enter deflate: avail_in=%u, avail_out=%u, flush=%d\n",
	(unsigned)zs->avail_in, (unsigned)zs->avail_out, flush );
	zrc = deflate( zs, flush );
	if( zrc == Z_STREAM_END && flush == Z_FINISH )
	;
	else if( zrc != Z_OK ) {
	if( zs->msg )
	log_fatal("zlib deflate problem: %s\n", zs->msg );
	else
	log_fatal("zlib deflate problem: rc=%d\n", zrc );
	}
	n = zfx->outbufsize - zs->avail_out;
	if( DBG_FILTER )
	log_debug("leave deflate: "
	"avail_in=%u, avail_out=%u, n=%u, zrc=%d\n",
	(unsigned)zs->avail_in, (unsigned)zs->avail_out,
	(unsigned)n, zrc );

	if( (rc=iobuf_write( a, zfx->outbuf, n )) ) {
	log_debug("deflate: iobuf_write failed\n");
	return rc;
	}
	} while( zs->avail_in \|\| (flush == Z_FINISH && zrc != Z_STREAM_END) );
	return 0;
	}

	static void
	init_uncompress( compress_filter_context_t zfx, z_stream zs )
	{
	int rc;

	/****************
	* PGP uses a windowsize of 13 bits. Using a negative value for
	* it forces zlib not to expect a zlib header. This is a
	* undocumented feature Peter Gutmann told me about.
	*
	* We must use 15 bits for the inflator because CryptoEx uses 15
	* bits thus the output would get scrambled w/o error indication
	* if we would use 13 bits. For the uncompressing this does not
	* matter at all.
	*/
	if( (rc = zfx->algo == 1? inflateInit2( zs, -15)
	: inflateInit( zs )) != Z_OK ) {
	log_fatal("zlib problem: %s\n", zs->msg? zs->msg :
	rc == Z_MEM_ERROR ? "out of core" :
	rc == Z_VERSION_ERROR ? "invalid lib version" :
	"unknown error" );
	}

	zfx->inbufsize = 2048;
	zfx->inbuf = xmalloc( zfx->inbufsize );
	zs->avail_in = 0;
	}

	static int
	do_uncompress( compress_filter_context_t zfx, z_stream zs,
	IOBUF a, size_t *ret_len )
	{
	int zrc;
	int rc = 0;
	int leave = 0;
	size_t n;
	int nread, count;
	int refill = !zs->avail_in;

	if( DBG_FILTER )
	log_debug("begin inflate: avail_in=%u, avail_out=%u, inbuf=%u\n",
	(unsigned)zs->avail_in, (unsigned)zs->avail_out,
	(unsigned)zfx->inbufsize );
	do {
	if( zs->avail_in < zfx->inbufsize && refill ) {
	n = zs->avail_in;
	if( !n )
	zs->next_in = BYTEF_CAST (zfx->inbuf);
	count = zfx->inbufsize - n;
	nread = iobuf_read( a, zfx->inbuf + n, count );
	if( nread == -1 ) nread = 0;
	n += nread;
	- /* Algo 1 has no zlib header which requires us to to give
	+ /* Algo 1 has no zlib header which requires us to give
	* inflate an extra dummy byte to read. To be on the safe
	* side we allow for up to 4 ff bytes. */
	if( nread < count && zfx->algo == 1 && zfx->algo1hack < 4) {
	*(zfx->inbuf + n) = 0xFF;
	zfx->algo1hack++;
	n++;
	leave = 1;
	}
	zs->avail_in = n;
	}
	refill = 1;
	if( DBG_FILTER )
	log_debug("enter inflate: avail_in=%u, avail_out=%u\n",
	(unsigned)zs->avail_in, (unsigned)zs->avail_out);
	zrc = inflate ( zs, Z_SYNC_FLUSH );
	if( DBG_FILTER )
	log_debug("leave inflate: avail_in=%u, avail_out=%u, zrc=%d\n",
	(unsigned)zs->avail_in, (unsigned)zs->avail_out, zrc);
	if( zrc == Z_STREAM_END )
	rc = -1; /* eof */
	else if( zrc != Z_OK && zrc != Z_BUF_ERROR ) {
	if( zs->msg )
	log_fatal("zlib inflate problem: %s\n", zs->msg );
	else
	log_fatal("zlib inflate problem: rc=%d\n", zrc );
	}
	} while (zs->avail_out && zrc != Z_STREAM_END && zrc != Z_BUF_ERROR
	&& !leave);

	*ret_len = zfx->outbufsize - zs->avail_out;
	if( DBG_FILTER )
	log_debug("do_uncompress: returning %u bytes (%u ignored)\n",
	(unsigned int)*ret_len, (unsigned int)zs->avail_in );
	return rc;
	}

	static int
	compress_filter( void *opaque, int control,
	IOBUF a, byte buf, size_t ret_len)
	{
	size_t size = *ret_len;
	compress_filter_context_t *zfx = opaque;
	z_stream *zs = zfx->opaque;
	int rc=0;

	if( control == IOBUFCTRL_UNDERFLOW ) {
	if( !zfx->status ) {
	zs = zfx->opaque = xmalloc_clear( sizeof *zs );
	init_uncompress( zfx, zs );
	zfx->status = 1;
	}

	zs->next_out = BYTEF_CAST (buf);
	zs->avail_out = size;
	zfx->outbufsize = size; /* needed only for calculation */
	rc = do_uncompress( zfx, zs, a, ret_len );
	}
	else if( control == IOBUFCTRL_FLUSH ) {
	if( !zfx->status ) {
	PACKET pkt;
	PKT_compressed cd;
	if(zfx->algo != COMPRESS_ALGO_ZIP
	&& zfx->algo != COMPRESS_ALGO_ZLIB)
	BUG();
	memset( &cd, 0, sizeof cd );
	cd.len = 0;
	cd.algorithm = zfx->algo;
	/* Fixme: We should force a new CTB here:
	cd.new_ctb = zfx->new_ctb;
	*/
	init_packet( &pkt );
	pkt.pkttype = PKT_COMPRESSED;
	pkt.pkt.compressed = &cd;
	if( build_packet( a, &pkt ))
	log_bug("build_packet(PKT_COMPRESSED) failed\n");
	zs = zfx->opaque = xmalloc_clear( sizeof *zs );
	init_compress( zfx, zs );
	zfx->status = 2;
	}

	zs->next_in = BYTEF_CAST (buf);
	zs->avail_in = size;
	rc = do_compress( zfx, zs, Z_NO_FLUSH, a );
	}
	else if( control == IOBUFCTRL_FREE ) {
	if( zfx->status == 1 ) {
	inflateEnd(zs);
	xfree(zs);
	zfx->opaque = NULL;
	xfree(zfx->outbuf); zfx->outbuf = NULL;
	}
	else if( zfx->status == 2 ) {
	zs->next_in = BYTEF_CAST (buf);
	zs->avail_in = 0;
	do_compress( zfx, zs, Z_FINISH, a );
	deflateEnd(zs);
	xfree(zs);
	zfx->opaque = NULL;
	xfree(zfx->outbuf); zfx->outbuf = NULL;
	}
	if (zfx->release)
	zfx->release (zfx);
	}
	else if( control == IOBUFCTRL_DESC )
	mem2str (buf, "compress_filter", *ret_len);
	return rc;
	}
	#endif /HAVE_ZIP/

	static void
	release_context (compress_filter_context_t *ctx)
	{
	xfree(ctx->inbuf);
	ctx->inbuf = NULL;
	xfree(ctx->outbuf);
	ctx->outbuf = NULL;
	xfree (ctx);
	}

	/****************
	* Handle a compressed packet
	*/
	int
	handle_compressed (ctrl_t ctrl, void procctx, PKT_compressed cd,
	int (callback)(IOBUF, void ), void *passthru )
	{
	compress_filter_context_t *cfx;
	int rc;

	if(check_compress_algo(cd->algorithm))
	return GPG_ERR_COMPR_ALGO;
	cfx = xmalloc_clear (sizeof *cfx);
	cfx->release = release_context;
	cfx->algo = cd->algorithm;
	push_compress_filter(cd->buf,cfx,cd->algorithm);
	if( callback )
	rc = callback(cd->buf, passthru );
	else
	rc = proc_packets (ctrl,procctx, cd->buf);
	cd->buf = NULL;
	return rc;
	}

	void
	push_compress_filter(IOBUF out,compress_filter_context_t *zfx,int algo)
	{
	push_compress_filter2(out,zfx,algo,0);
	}

	void
	push_compress_filter2(IOBUF out,compress_filter_context_t *zfx,
	int algo,int rel)
	{
	if(algo>=0)
	zfx->algo=algo;
	else
	zfx->algo=DEFAULT_COMPRESS_ALGO;

	switch(zfx->algo)
	{
	case COMPRESS_ALGO_NONE:
	break;

	#ifdef HAVE_ZIP
	case COMPRESS_ALGO_ZIP:
	case COMPRESS_ALGO_ZLIB:
	iobuf_push_filter2(out,compress_filter,zfx,rel);
	break;
	#endif

	#ifdef HAVE_BZIP2
	case COMPRESS_ALGO_BZIP2:
	iobuf_push_filter2(out,compress_filter_bz2,zfx,rel);
	break;
	#endif

	default:
	BUG();
	}
	}
	diff --git a/g10/encrypt.c b/g10/encrypt.c
	index 5268946c3..6130ba013 100644
	--- a/g10/encrypt.c
	+++ b/g10/encrypt.c
	@@ -1,992 +1,992 @@
	/* encrypt.c - Main encryption driver
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
	* 2006, 2009 Free Software Foundation, Inc.
	* Copyright (C) 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "iobuf.h"
	#include "keydb.h"
	#include "util.h"
	#include "main.h"
	#include "filter.h"
	#include "trustdb.h"
	#include "i18n.h"
	#include "status.h"
	#include "pkglue.h"


	static int encrypt_simple( const char *filename, int mode, int use_seskey );
	static int write_pubkey_enc_from_list( PK_LIST pk_list, DEK *dek, iobuf_t out );

	/****************
	* Encrypt FILENAME with only the symmetric cipher. Take input from
	* stdin if FILENAME is NULL.
	*/
	int
	encrypt_symmetric (const char *filename)
	{
	return encrypt_simple( filename, 1, 0 );
	}


	/****************
	* Encrypt FILENAME as a literal data packet only. Take input from
	* stdin if FILENAME is NULL.
	*/
	int
	encrypt_store (const char *filename)
	{
	return encrypt_simple( filename, 0, 0 );
	}


	/* SESKEY contains the unencrypted session key ((SESKEY)->KEY) and
	the algorithm that will be used to encrypt the contents of the SED
	packet ((SESKEY)->ALGO). If SESKEY is NULL, then a random
	session key that is appropriate for DEK->ALGO is generated and
	stored there.

	Encrypt that session key using DEK and store the result in ENCKEY,
	which must be large enough to hold (SESKEY)->KEYLEN + 1 bytes. /
	void
	encrypt_seskey (DEK dek, DEK seskey, byte enckey)
	{
	gcry_cipher_hd_t hd;
	byte buf[33];

	log_assert ( dek->keylen <= 32 );
	if (!*seskey)
	{
	*seskey=xmalloc_clear(sizeof(DEK));
	(*seskey)->algo=dek->algo;
	make_session_key(*seskey);
	/log_hexdump( "thekey", c->key, c->keylen );/
	}

	/* The encrypted session key is prefixed with a one-octet algorithm id. */
	buf[0] = (*seskey)->algo;
	memcpy( buf + 1, (seskey)->key, (seskey)->keylen );

	/* We only pass already checked values to the following function,
	thus we consider any failure as fatal. */
	if (openpgp_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1))
	BUG ();
	if (gcry_cipher_setkey (hd, dek->key, dek->keylen))
	BUG ();
	gcry_cipher_setiv (hd, NULL, 0);
	gcry_cipher_encrypt (hd, buf, (*seskey)->keylen + 1, NULL, 0);
	gcry_cipher_close (hd);

	memcpy( enckey, buf, (*seskey)->keylen + 1 );
	wipememory( buf, sizeof buf ); /* burn key */
	}


	/* We try very hard to use a MDC */
	int
	use_mdc (pk_list_t pk_list,int algo)
	{
	/* RFC-2440 don't has MDC */
	if (RFC2440)
	return 0;

	/* --force-mdc overrides --disable-mdc */
	if(opt.force_mdc)
	return 1;

	if(opt.disable_mdc)
	return 0;

	/* Do the keys really support MDC? */

	if(select_mdc_from_pklist(pk_list))
	return 1;

	/* The keys don't support MDC, so now we do a bit of a hack - if any
	of the AESes or TWOFISH are in the prefs, we assume that the user
	can handle a MDC. This is valid for PGP 7, which can handle MDCs
	though it will not generate them. 2440bis allows this, by the
	way. */

	if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
	CIPHER_ALGO_AES,NULL)==CIPHER_ALGO_AES)
	return 1;

	if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
	CIPHER_ALGO_AES192,NULL)==CIPHER_ALGO_AES192)
	return 1;

	if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
	CIPHER_ALGO_AES256,NULL)==CIPHER_ALGO_AES256)
	return 1;

	if(select_algo_from_prefs(pk_list,PREFTYPE_SYM,
	CIPHER_ALGO_TWOFISH,NULL)==CIPHER_ALGO_TWOFISH)
	return 1;

	/* Last try. Use MDC for the modern ciphers. */

	if (openpgp_cipher_get_algo_blklen (algo) != 8)
	return 1;

	if (opt.verbose)
	warn_missing_mdc_from_pklist (pk_list);

	return 0; /* No MDC */
	}


	/* We don't want to use use_seskey yet because older gnupg versions
	can't handle it, and there isn't really any point unless we're
	making a message that can be decrypted by a public key or
	passphrase. */
	static int
	encrypt_simple (const char *filename, int mode, int use_seskey)
	{
	iobuf_t inp, out;
	PACKET pkt;
	PKT_plaintext *pt = NULL;
	STRING2KEY *s2k = NULL;
	byte enckey[33];
	int rc = 0;
	int seskeylen = 0;
	u32 filesize;
	cipher_filter_context_t cfx;
	armor_filter_context_t *afx = NULL;
	compress_filter_context_t zfx;
	text_filter_context_t tfx;
	progress_filter_context_t *pfx;
	int do_compress = !!default_compress_algo();

	pfx = new_progress_context ();
	memset( &cfx, 0, sizeof cfx);
	memset( &zfx, 0, sizeof zfx);
	memset( &tfx, 0, sizeof tfx);
	init_packet(&pkt);

	/* Prepare iobufs. */
	inp = iobuf_open(filename);
	if (inp)
	iobuf_ioctl (inp, IOBUF_IOCTL_NO_CACHE, 1, NULL);
	if (inp && is_secured_file (iobuf_get_fd (inp)))
	{
	iobuf_close (inp);
	inp = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp)
	{
	rc = gpg_error_from_syserror ();
	log_error(_("can't open '%s': %s\n"), filename? filename: "[stdin]",
	strerror(errno) );
	release_progress_context (pfx);
	return rc;
	}

	handle_progress (pfx, inp, filename);

	if (opt.textmode)
	iobuf_push_filter( inp, text_filter, &tfx );

	cfx.dek = NULL;
	if ( mode )
	{
	int canceled;

	s2k = xmalloc_clear( sizeof *s2k );
	s2k->mode = opt.s2k_mode;
	s2k->hash_algo = S2K_DIGEST_ALGO;
	cfx.dek = passphrase_to_dek (default_cipher_algo (), s2k, 1, 0,
	NULL, &canceled);
	if ( !cfx.dek \|\| !cfx.dek->keylen )
	{
	rc = gpg_error (canceled? GPG_ERR_CANCELED:GPG_ERR_INV_PASSPHRASE);
	xfree (cfx.dek);
	xfree (s2k);
	iobuf_close (inp);
	log_error (_("error creating passphrase: %s\n"), gpg_strerror (rc));
	release_progress_context (pfx);
	return rc;
	}
	if (use_seskey && s2k->mode != 1 && s2k->mode != 3)
	{
	use_seskey = 0;
	log_info (_("can't use a symmetric ESK packet "
	"due to the S2K mode\n"));
	}

	if ( use_seskey )
	{
	DEK *dek = NULL;

	seskeylen = openpgp_cipher_get_algo_keylen (default_cipher_algo ());
	encrypt_seskey( cfx.dek, &dek, enckey );
	xfree( cfx.dek ); cfx.dek = dek;
	}

	if (opt.verbose)
	log_info(_("using cipher %s\n"),
	openpgp_cipher_algo_name (cfx.dek->algo));

	cfx.dek->use_mdc=use_mdc(NULL,cfx.dek->algo);
	}

	if (do_compress && cfx.dek && cfx.dek->use_mdc
	&& is_file_compressed(filename, &rc))
	{
	if (opt.verbose)
	log_info(_("'%s' already compressed\n"), filename);
	do_compress = 0;
	}

	if ( rc \|\| (rc = open_outfile (-1, filename, opt.armor? 1:0, 0, &out )))
	{
	iobuf_cancel (inp);
	xfree (cfx.dek);
	xfree (s2k);
	release_progress_context (pfx);
	return rc;
	}

	if ( opt.armor )
	{
	afx = new_armor_context ();
	push_armor_filter (afx, out);
	}

	if ( s2k )
	{
	PKT_symkey_enc enc = xmalloc_clear( sizeof enc + seskeylen + 1 );
	enc->version = 4;
	enc->cipher_algo = cfx.dek->algo;
	enc->s2k = *s2k;
	if ( use_seskey && seskeylen )
	{
	enc->seskeylen = seskeylen + 1; /* algo id */
	memcpy (enc->seskey, enckey, seskeylen + 1 );
	}
	pkt.pkttype = PKT_SYMKEY_ENC;
	pkt.pkt.symkey_enc = enc;
	if ((rc = build_packet( out, &pkt )))
	log_error("build symkey packet failed: %s\n", gpg_strerror (rc) );
	xfree (enc);
	}

	if (!opt.no_literal)
	pt = setup_plaintext_name (filename, inp);

	/* Note that PGP 5 has problems decrypting symmetrically encrypted
	data if the file length is in the inner packet. It works when
	only partial length headers are use. In the past, we always used
	partial body length here, but since PGP 2, PGP 6, and PGP 7 need
	the file length, and nobody should be using PGP 5 nowadays
	anyway, this is now set to the file length. Note also that this
	only applies to the RFC-1991 style symmetric messages, and not
	the RFC-2440 style. PGP 6 and 7 work with either partial length
	or fixed length with the new style messages. */

	if ( !iobuf_is_pipe_filename (filename) && *filename && !opt.textmode )
	{
	off_t tmpsize;
	int overflow;

	if ( !(tmpsize = iobuf_get_filelength(inp, &overflow))
	&& !overflow && opt.verbose)
	log_info(_("WARNING: '%s' is an empty file\n"), filename );
	/* We can't encode the length of very large files because
	- OpenPGP uses only 32 bit for file sizes. So if the the
	+ OpenPGP uses only 32 bit for file sizes. So if the
	size of a file is larger than 2^32 minus some bytes for
	packet headers, we switch to partial length encoding. */
	if ( tmpsize < (IOBUF_FILELENGTH_LIMIT - 65536) )
	filesize = tmpsize;
	else
	filesize = 0;
	}
	else
	filesize = opt.set_filesize ? opt.set_filesize : 0; /* stdin */

	if (!opt.no_literal)
	{
	/* Note that PT has been initialized above in !no_literal mode. */
	pt->timestamp = make_timestamp();
	pt->mode = opt.mimemode? 'm' : opt.textmode? 't' : 'b';
	pt->len = filesize;
	pt->new_ctb = !pt->len;
	pt->buf = inp;
	pkt.pkttype = PKT_PLAINTEXT;
	pkt.pkt.plaintext = pt;
	cfx.datalen = filesize && !do_compress ? calc_packet_length( &pkt ) : 0;
	}
	else
	{
	cfx.datalen = filesize && !do_compress ? filesize : 0;
	pkt.pkttype = 0;
	pkt.pkt.generic = NULL;
	}

	/* Register the cipher filter. */
	if (mode)
	iobuf_push_filter ( out, cipher_filter, &cfx );

	/* Register the compress filter. */
	if ( do_compress )
	{
	if (cfx.dek && cfx.dek->use_mdc)
	zfx.new_ctb = 1;
	push_compress_filter (out, &zfx, default_compress_algo());
	}

	/* Do the work. */
	if (!opt.no_literal)
	{
	if ( (rc = build_packet( out, &pkt )) )
	log_error("build_packet failed: %s\n", gpg_strerror (rc) );
	}
	else
	{
	/* User requested not to create a literal packet, so we copy the
	plain data. */
	byte copy_buffer[4096];
	int bytes_copied;
	while ((bytes_copied = iobuf_read(inp, copy_buffer, 4096)) != -1)
	if ( (rc=iobuf_write(out, copy_buffer, bytes_copied)) ) {
	log_error ("copying input to output failed: %s\n",
	gpg_strerror (rc) );
	break;
	}
	wipememory (copy_buffer, 4096); /* burn buffer */
	}

	/* Finish the stuff. */
	iobuf_close (inp);
	if (rc)
	iobuf_cancel(out);
	else
	{
	iobuf_close (out); /* fixme: check returncode */
	if (mode)
	write_status ( STATUS_END_ENCRYPTION );
	}
	if (pt)
	pt->buf = NULL;
	free_packet (&pkt);
	xfree (cfx.dek);
	xfree (s2k);
	release_armor_context (afx);
	release_progress_context (pfx);
	return rc;
	}


	int
	setup_symkey (STRING2KEY symkey_s2k,DEK symkey_dek)
	{
	int canceled;

	*symkey_s2k=xmalloc_clear(sizeof(STRING2KEY));
	(*symkey_s2k)->mode = opt.s2k_mode;
	(*symkey_s2k)->hash_algo = S2K_DIGEST_ALGO;

	*symkey_dek = passphrase_to_dek (opt.s2k_cipher_algo,
	*symkey_s2k, 1, 0, NULL, &canceled);
	if(!symkey_dek \|\| !(symkey_dek)->keylen)
	{
	xfree(*symkey_dek);
	xfree(*symkey_s2k);
	return gpg_error (canceled?GPG_ERR_CANCELED:GPG_ERR_BAD_PASSPHRASE);
	}

	return 0;
	}


	static int
	write_symkey_enc (STRING2KEY symkey_s2k, DEK symkey_dek, DEK *dek,
	iobuf_t out)
	{
	int rc, seskeylen = openpgp_cipher_get_algo_keylen (dek->algo);

	PKT_symkey_enc *enc;
	byte enckey[33];
	PACKET pkt;

	enc=xmalloc_clear(sizeof(PKT_symkey_enc)+seskeylen+1);
	encrypt_seskey(symkey_dek,&dek,enckey);

	enc->version = 4;
	enc->cipher_algo = opt.s2k_cipher_algo;
	enc->s2k = *symkey_s2k;
	enc->seskeylen = seskeylen + 1; /* algo id */
	memcpy( enc->seskey, enckey, seskeylen + 1 );

	pkt.pkttype = PKT_SYMKEY_ENC;
	pkt.pkt.symkey_enc = enc;

	if ((rc=build_packet(out,&pkt)))
	log_error("build symkey_enc packet failed: %s\n",gpg_strerror (rc));

	xfree(enc);
	return rc;
	}


	/*
	* Encrypt the file with the given userids (or ask if none is
	* supplied). Either FILENAME or FILEFD must be given, but not both.
	* The caller may provide a checked list of public keys in
	* PROVIDED_PKS; if not the function builds a list of keys on its own.
	*
	- * Note that FILEFD is currently only used by cmd_encrypt in the the
	+ * Note that FILEFD is currently only used by cmd_encrypt in the
	* not yet finished server.c.
	*/
	int
	encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
	strlist_t remusr, int use_symkey, pk_list_t provided_keys,
	int outputfd)
	{
	iobuf_t inp = NULL;
	iobuf_t out = NULL;
	PACKET pkt;
	PKT_plaintext *pt = NULL;
	DEK *symkey_dek = NULL;
	STRING2KEY *symkey_s2k = NULL;
	int rc = 0, rc2 = 0;
	u32 filesize;
	cipher_filter_context_t cfx;
	armor_filter_context_t *afx = NULL;
	compress_filter_context_t zfx;
	text_filter_context_t tfx;
	progress_filter_context_t *pfx;
	PK_LIST pk_list;
	int do_compress;

	if (filefd != -1 && filename)
	return gpg_error (GPG_ERR_INV_ARG); /* Both given. */

	do_compress = !!opt.compress_algo;

	pfx = new_progress_context ();
	memset( &cfx, 0, sizeof cfx);
	memset( &zfx, 0, sizeof zfx);
	memset( &tfx, 0, sizeof tfx);
	init_packet(&pkt);

	if (use_symkey
	&& (rc=setup_symkey(&symkey_s2k,&symkey_dek)))
	{
	release_progress_context (pfx);
	return rc;
	}

	if (provided_keys)
	pk_list = provided_keys;
	else
	{
	if ((rc = build_pk_list (ctrl, remusr, &pk_list)))
	{
	release_progress_context (pfx);
	return rc;
	}
	}

	/* Prepare iobufs. */
	#ifdef HAVE_W32_SYSTEM
	if (filefd == -1)
	inp = iobuf_open (filename);
	else
	{
	inp = NULL;
	gpg_err_set_errno (ENOSYS);
	}
	#else
	if (filefd == GNUPG_INVALID_FD)
	inp = iobuf_open (filename);
	else
	inp = iobuf_fdopen_nc (FD2INT(filefd), "rb");
	#endif
	if (inp)
	iobuf_ioctl (inp, IOBUF_IOCTL_NO_CACHE, 1, NULL);
	if (inp && is_secured_file (iobuf_get_fd (inp)))
	{
	iobuf_close (inp);
	inp = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp)
	{
	char xname[64];

	rc = gpg_error_from_syserror ();
	if (filefd != -1)
	snprintf (xname, sizeof xname, "[fd %d]", filefd);
	else if (!filename)
	strcpy (xname, "[stdin]");
	else
	*xname = 0;
	log_error (_("can't open '%s': %s\n"),
	*xname? xname : filename, gpg_strerror (rc) );
	goto leave;
	}

	if (opt.verbose)
	log_info (_("reading from '%s'\n"), iobuf_get_fname_nonnull (inp));

	handle_progress (pfx, inp, filename);

	if (opt.textmode)
	iobuf_push_filter (inp, text_filter, &tfx);

	rc = open_outfile (outputfd, filename, opt.armor? 1:0, 0, &out);
	if (rc)
	goto leave;

	if (opt.armor)
	{
	afx = new_armor_context ();
	push_armor_filter (afx, out);
	}

	/* Create a session key. */
	cfx.dek = xmalloc_secure_clear (sizeof *cfx.dek);
	if (!opt.def_cipher_algo)
	{
	/* Try to get it from the prefs. */
	cfx.dek->algo = select_algo_from_prefs (pk_list, PREFTYPE_SYM, -1, NULL);
	/* The only way select_algo_from_prefs can fail here is when
	mixing v3 and v4 keys, as v4 keys have an implicit preference
	entry for 3DES, and the pk_list cannot be empty. In this
	case, use 3DES anyway as it's the safest choice - perhaps the
	v3 key is being used in an OpenPGP implementation and we know
	that the implementation behind any v4 key can handle 3DES. */
	if (cfx.dek->algo == -1)
	{
	cfx.dek->algo = CIPHER_ALGO_3DES;
	}

	/* In case 3DES has been selected, print a warning if any key
	does not have a preference for AES. This should help to
	indentify why encrypting to several recipients falls back to
	3DES. */
	if (opt.verbose && cfx.dek->algo == CIPHER_ALGO_3DES)
	warn_missing_aes_from_pklist (pk_list);
	}
	else
	{
	if (!opt.expert
	&& (select_algo_from_prefs (pk_list, PREFTYPE_SYM,
	opt.def_cipher_algo, NULL)
	!= opt.def_cipher_algo))
	{
	log_info(_("WARNING: forcing symmetric cipher %s (%d)"
	" violates recipient preferences\n"),
	openpgp_cipher_algo_name (opt.def_cipher_algo),
	opt.def_cipher_algo);
	}

	cfx.dek->algo = opt.def_cipher_algo;
	}

	cfx.dek->use_mdc = use_mdc (pk_list,cfx.dek->algo);

	/* Only do the is-file-already-compressed check if we are using a
	MDC. This forces compressed files to be re-compressed if we do
	not have a MDC to give some protection against chosen ciphertext
	attacks. */

	if (do_compress && cfx.dek->use_mdc && is_file_compressed(filename, &rc2))
	{
	if (opt.verbose)
	log_info(_("'%s' already compressed\n"), filename);
	do_compress = 0;
	}
	if (rc2)
	{
	rc = rc2;
	goto leave;
	}

	make_session_key (cfx.dek);
	if (DBG_CRYPTO)
	log_printhex ("DEK is: ", cfx.dek->key, cfx.dek->keylen );

	rc = write_pubkey_enc_from_list (pk_list, cfx.dek, out);
	if (rc)
	goto leave;

	/* We put the passphrase (if any) after any public keys as this
	seems to be the most useful on the recipient side - there is no
	point in prompting a user for a passphrase if they have the
	secret key needed to decrypt. */
	if(use_symkey && (rc = write_symkey_enc(symkey_s2k,symkey_dek,cfx.dek,out)))
	goto leave;

	if (!opt.no_literal)
	pt = setup_plaintext_name (filename, inp);

	/* Get the size of the file if possible, i.e., if it is a real file. */
	if (filename && *filename
	&& !iobuf_is_pipe_filename (filename) && !opt.textmode )
	{
	off_t tmpsize;
	int overflow;

	if ( !(tmpsize = iobuf_get_filelength(inp, &overflow))
	&& !overflow && opt.verbose)
	log_info(_("WARNING: '%s' is an empty file\n"), filename );
	/* We can't encode the length of very large files because
	- OpenPGP uses only 32 bit for file sizes. So if the the size
	+ OpenPGP uses only 32 bit for file sizes. So if the size
	of a file is larger than 2^32 minus some bytes for packet
	headers, we switch to partial length encoding. */
	if (tmpsize < (IOBUF_FILELENGTH_LIMIT - 65536) )
	filesize = tmpsize;
	else
	filesize = 0;
	}
	else
	filesize = opt.set_filesize ? opt.set_filesize : 0; /* stdin */

	if (!opt.no_literal)
	{
	pt->timestamp = make_timestamp();
	pt->mode = opt.mimemode? 'm' : opt.textmode ? 't' : 'b';
	pt->len = filesize;
	pt->new_ctb = !pt->len;
	pt->buf = inp;
	pkt.pkttype = PKT_PLAINTEXT;
	pkt.pkt.plaintext = pt;
	cfx.datalen = filesize && !do_compress? calc_packet_length( &pkt ) : 0;
	}
	else
	cfx.datalen = filesize && !do_compress ? filesize : 0;

	/* Register the cipher filter. */
	iobuf_push_filter (out, cipher_filter, &cfx);

	/* Register the compress filter. */
	if (do_compress)
	{
	int compr_algo = opt.compress_algo;

	if (compr_algo == -1)
	{
	compr_algo = select_algo_from_prefs (pk_list, PREFTYPE_ZIP, -1, NULL);
	if (compr_algo == -1)
	compr_algo = DEFAULT_COMPRESS_ALGO;
	/* Theoretically impossible to get here since uncompressed
	is implicit. */
	}
	else if (!opt.expert
	&& select_algo_from_prefs(pk_list, PREFTYPE_ZIP,
	compr_algo, NULL) != compr_algo)
	{
	log_info (_("WARNING: forcing compression algorithm %s (%d)"
	" violates recipient preferences\n"),
	compress_algo_to_string(compr_algo), compr_algo);
	}

	/* Algo 0 means no compression. */
	if (compr_algo)
	{
	if (cfx.dek && cfx.dek->use_mdc)
	zfx.new_ctb = 1;
	push_compress_filter (out,&zfx,compr_algo);
	}
	}

	/* Do the work. */
	if (!opt.no_literal)
	{
	if ((rc = build_packet( out, &pkt )))
	log_error ("build_packet failed: %s\n", gpg_strerror (rc));
	}
	else
	{
	/* User requested not to create a literal packet, so we copy the
	plain data. */
	byte copy_buffer[4096];
	int bytes_copied;
	while ((bytes_copied = iobuf_read (inp, copy_buffer, 4096)) != -1)
	{
	rc = iobuf_write (out, copy_buffer, bytes_copied);
	if (rc)
	{
	log_error ("copying input to output failed: %s\n",
	gpg_strerror (rc));
	break;
	}
	}
	wipememory (copy_buffer, 4096); /* Burn the buffer. */
	}

	/* Finish the stuff. */
	leave:
	iobuf_close (inp);
	if (rc)
	iobuf_cancel (out);
	else
	{
	iobuf_close (out); /* fixme: check returncode */
	write_status (STATUS_END_ENCRYPTION);
	}
	if (pt)
	pt->buf = NULL;
	free_packet (&pkt);
	xfree (cfx.dek);
	xfree (symkey_dek);
	xfree (symkey_s2k);
	if (!provided_keys)
	release_pk_list (pk_list);
	release_armor_context (afx);
	release_progress_context (pfx);
	return rc;
	}


	/*
	* Filter to do a complete public key encryption.
	*/
	int
	encrypt_filter (void *opaque, int control,
	iobuf_t a, byte buf, size_t ret_len)
	{
	size_t size = *ret_len;
	encrypt_filter_context_t *efx = opaque;
	int rc = 0;

	if (control == IOBUFCTRL_UNDERFLOW) /* decrypt */
	{
	BUG(); /* not used */
	}
	else if ( control == IOBUFCTRL_FLUSH ) /* encrypt */
	{
	if ( !efx->header_okay )
	{
	efx->cfx.dek = xmalloc_secure_clear ( sizeof *efx->cfx.dek );
	if ( !opt.def_cipher_algo )
	{
	/* Try to get it from the prefs. */
	efx->cfx.dek->algo =
	select_algo_from_prefs (efx->pk_list, PREFTYPE_SYM, -1, NULL);
	if (efx->cfx.dek->algo == -1 )
	{
	/* Because 3DES is implicitly in the prefs, this can
	only happen if we do not have any public keys in
	the list. */
	efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
	}

	/* In case 3DES has been selected, print a warning if
	any key does not have a preference for AES. This
	should help to indentify why encrypting to several
	recipients falls back to 3DES. */
	if (opt.verbose
	&& efx->cfx.dek->algo == CIPHER_ALGO_3DES)
	warn_missing_aes_from_pklist (efx->pk_list);
	}
	else
	{
	if (!opt.expert
	&& select_algo_from_prefs (efx->pk_list,PREFTYPE_SYM,
	opt.def_cipher_algo,
	NULL) != opt.def_cipher_algo)
	log_info(_("forcing symmetric cipher %s (%d) "
	"violates recipient preferences\n"),
	openpgp_cipher_algo_name (opt.def_cipher_algo),
	opt.def_cipher_algo);

	efx->cfx.dek->algo = opt.def_cipher_algo;
	}

	efx->cfx.dek->use_mdc = use_mdc (efx->pk_list,efx->cfx.dek->algo);

	make_session_key ( efx->cfx.dek );
	if (DBG_CRYPTO)
	log_printhex ("DEK is: ", efx->cfx.dek->key, efx->cfx.dek->keylen);

	rc = write_pubkey_enc_from_list (efx->pk_list, efx->cfx.dek, a);
	if (rc)
	return rc;

	if(efx->symkey_s2k && efx->symkey_dek)
	{
	rc=write_symkey_enc(efx->symkey_s2k,efx->symkey_dek,
	efx->cfx.dek,a);
	if(rc)
	return rc;
	}

	iobuf_push_filter (a, cipher_filter, &efx->cfx);

	efx->header_okay = 1;
	}
	rc = iobuf_write (a, buf, size);

	}
	else if (control == IOBUFCTRL_FREE)
	{
	xfree (efx->symkey_dek);
	xfree (efx->symkey_s2k);
	}
	else if ( control == IOBUFCTRL_DESC )
	{
	mem2str (buf, "encrypt_filter", *ret_len);
	}
	return rc;
	}


	/*
	* Write a pubkey-enc packet for the public key PK to OUT.
	*/
	int
	write_pubkey_enc (PKT_public_key pk, int throw_keyid, DEK dek, iobuf_t out)
	{
	PACKET pkt;
	PKT_pubkey_enc *enc;
	int rc;
	gcry_mpi_t frame;

	print_pubkey_algo_note ( pk->pubkey_algo );
	enc = xmalloc_clear ( sizeof *enc );
	enc->pubkey_algo = pk->pubkey_algo;
	keyid_from_pk( pk, enc->keyid );
	enc->throw_keyid = throw_keyid;

	/* Okay, what's going on: We have the session key somewhere in
	* the structure DEK and want to encode this session key in an
	* integer value of n bits. pubkey_nbits gives us the number of
	* bits we have to use. We then encode the session key in some
	* way and we get it back in the big intger value FRAME. Then
	* we use FRAME, the public key PK->PKEY and the algorithm
	* number PK->PUBKEY_ALGO and pass it to pubkey_encrypt which
	* returns the encrypted value in the array ENC->DATA. This
	* array has a size which depends on the used algorithm (e.g. 2
	* for Elgamal). We don't need frame anymore because we have
	* everything now in enc->data which is the passed to
	* build_packet(). */
	frame = encode_session_key (pk->pubkey_algo, dek,
	pubkey_nbits (pk->pubkey_algo, pk->pkey));
	rc = pk_encrypt (pk->pubkey_algo, enc->data, frame, pk, pk->pkey);
	gcry_mpi_release (frame);
	if (rc)
	log_error ("pubkey_encrypt failed: %s\n", gpg_strerror (rc) );
	else
	{
	if ( opt.verbose )
	{
	char *ustr = get_user_id_string_native (enc->keyid);
	log_info (_("%s/%s encrypted for: \"%s\"\n"),
	openpgp_pk_algo_name (enc->pubkey_algo),
	openpgp_cipher_algo_name (dek->algo),
	ustr );
	xfree (ustr);
	}
	/* And write it. */
	init_packet (&pkt);
	pkt.pkttype = PKT_PUBKEY_ENC;
	pkt.pkt.pubkey_enc = enc;
	rc = build_packet (out, &pkt);
	if (rc)
	log_error ("build_packet(pubkey_enc) failed: %s\n",
	gpg_strerror (rc));
	}
	free_pubkey_enc(enc);
	return rc;
	}


	/*
	* Write pubkey-enc packets from the list of PKs to OUT.
	*/
	static int
	write_pubkey_enc_from_list (PK_LIST pk_list, DEK *dek, iobuf_t out)
	{
	if (opt.throw_keyids && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("you may not use %s while in %s mode\n"),
	"--throw-keyids",compliance_option_string());
	compliance_failure();
	}

	for ( ; pk_list; pk_list = pk_list->next )
	{
	PKT_public_key *pk = pk_list->pk;
	int throw_keyid = (opt.throw_keyids \|\| (pk_list->flags&1));
	int rc = write_pubkey_enc (pk, throw_keyid, dek, out);
	if (rc)
	return rc;
	}

	return 0;
	}

	void
	encrypt_crypt_files (ctrl_t ctrl, int nfiles, char **files, strlist_t remusr)
	{
	int rc = 0;

	if (opt.outfile)
	{
	log_error(_("--output doesn't work for this command\n"));
	return;
	}

	if (!nfiles)
	{
	char line[2048];
	unsigned int lno = 0;
	while ( fgets(line, DIM(line), stdin) )
	{
	lno++;
	if (!*line \|\| line[strlen(line)-1] != '\n')
	{
	log_error("input line %u too long or missing LF\n", lno);
	return;
	}
	line[strlen(line)-1] = '\0';
	print_file_status(STATUS_FILE_START, line, 2);
	rc = encrypt_crypt (ctrl, -1, line, remusr, 0, NULL, -1);
	if (rc)
	log_error ("encryption of '%s' failed: %s\n",
	print_fname_stdin(line), gpg_strerror (rc) );
	write_status( STATUS_FILE_DONE );
	}
	}
	else
	{
	while (nfiles--)
	{
	print_file_status(STATUS_FILE_START, *files, 2);
	if ( (rc = encrypt_crypt (ctrl, -1, *files, remusr, 0, NULL, -1)) )
	log_error("encryption of '%s' failed: %s\n",
	print_fname_stdin(*files), gpg_strerror (rc) );
	write_status( STATUS_FILE_DONE );
	files++;
	}
	}
	}
	diff --git a/g10/export.c b/g10/export.c
	index 86681264d..025b9361a 100644
	--- a/g10/export.c
	+++ b/g10/export.c
	@@ -1,2384 +1,2384 @@
	/* export.c - Export keys in the OpenPGP defined format.
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004,
	* 2005, 2010 Free Software Foundation, Inc.
	* Copyright (C) 1998-2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "keydb.h"
	#include "util.h"
	#include "main.h"
	#include "i18n.h"
	#include "membuf.h"
	#include "host2net.h"
	#include "zb32.h"
	#include "recsel.h"
	#include "mbox-util.h"
	#include "init.h"
	#include "trustdb.h"
	#include "call-agent.h"

	/* An object to keep track of subkeys. */
	struct subkey_list_s
	{
	struct subkey_list_s *next;
	u32 kid[2];
	};
	typedef struct subkey_list_s *subkey_list_t;


	/* An object to track statistics for export operations. */
	struct export_stats_s
	{
	ulong count; /* Number of processed keys. */
	ulong secret_count; /* Number of secret keys seen. */
	ulong exported; /* Number of actual exported keys. */
	};


	/* A global variable to store the selector created from
	* --export-filter keep-uid=EXPR.
	* --export-filter drop-subkey=EXPR.
	*
	* FIXME: We should put this into the CTRL object but that requires a
	* lot more changes right now.
	*/
	static recsel_expr_t export_keep_uid;
	static recsel_expr_t export_drop_subkey;



	/* Local prototypes. */
	static int do_export (ctrl_t ctrl, strlist_t users, int secret,
	unsigned int options, export_stats_t stats);
	static int do_export_stream (ctrl_t ctrl, iobuf_t out,
	strlist_t users, int secret,
	kbnode_t *keyblock_out, unsigned int options,
	export_stats_t stats, int *any);
	static gpg_error_t print_pka_or_dane_records
	/*/ (iobuf_t out, kbnode_t keyblock, PKT_public_key pk,
	const void *data, size_t datalen,
	int print_pka, int print_dane);


	static void
	cleanup_export_globals (void)
	{
	recsel_release (export_keep_uid);
	export_keep_uid = NULL;
	recsel_release (export_drop_subkey);
	export_drop_subkey = NULL;
	}


	/* Option parser for export options. See parse_options fro
	details. */
	int
	parse_export_options(char str,unsigned int options,int noisy)
	{
	struct parse_options export_opts[]=
	{
	{"export-local-sigs",EXPORT_LOCAL_SIGS,NULL,
	N_("export signatures that are marked as local-only")},
	{"export-attributes",EXPORT_ATTRIBUTES,NULL,
	N_("export attribute user IDs (generally photo IDs)")},
	{"export-sensitive-revkeys",EXPORT_SENSITIVE_REVKEYS,NULL,
	N_("export revocation keys marked as \"sensitive\"")},
	{"export-clean",EXPORT_CLEAN,NULL,
	N_("remove unusable parts from key during export")},
	{"export-minimal",EXPORT_MINIMAL\|EXPORT_CLEAN,NULL,
	N_("remove as much as possible from key during export")},

	{"export-pka", EXPORT_PKA_FORMAT, NULL, NULL },
	{"export-dane", EXPORT_DANE_FORMAT, NULL, NULL },

	{"backup", EXPORT_BACKUP, NULL,
	N_("use the GnuPG key backup format")},
	{"export-backup", EXPORT_BACKUP, NULL, NULL },

	/* Aliases for backward compatibility */
	{"include-local-sigs",EXPORT_LOCAL_SIGS,NULL,NULL},
	{"include-attributes",EXPORT_ATTRIBUTES,NULL,NULL},
	{"include-sensitive-revkeys",EXPORT_SENSITIVE_REVKEYS,NULL,NULL},
	/* dummy */
	{"export-unusable-sigs",0,NULL,NULL},
	{"export-clean-sigs",0,NULL,NULL},
	{"export-clean-uids",0,NULL,NULL},
	{NULL,0,NULL,NULL}
	/* add tags for include revoked and disabled? */
	};
	int rc;

	rc = parse_options (str, options, export_opts, noisy);
	if (rc && (*options & EXPORT_BACKUP))
	{
	/* Alter other options we want or don't want for restore. */
	*options \|= (EXPORT_LOCAL_SIGS \| EXPORT_ATTRIBUTES
	\| EXPORT_SENSITIVE_REVKEYS);
	*options &= ~(EXPORT_CLEAN \| EXPORT_MINIMAL
	\| EXPORT_PKA_FORMAT \| EXPORT_DANE_FORMAT);
	}
	return rc;
	}


	/* Parse and set an export filter from string. STRING has the format
	* "NAME=EXPR" with NAME being the name of the filter. Spaces before
	* and after NAME are not allowed. If this function is called several
	* times all expressions for the same NAME are concatenated.
	* Supported filter names are:
	*
	* - keep-uid :: If the expression evaluates to true for a certain
	* user ID packet, that packet and all it dependencies
	* will be exported. The expression may use these
	* variables:
	*
	* - uid :: The entire user ID.
	* - mbox :: The mail box part of the user ID.
	* - primary :: Evaluate to true for the primary user ID.
	*
	* - drop-subkey :: If the expression evaluates to true for a subkey
	* packet that subkey and all it dependencies will be
	* remove from the keyblock. The expression may use these
	* variables:
	*
	* - secret :: 1 for a secret subkey, else 0.
	* - key_algo :: Public key algorithm id
	*/
	gpg_error_t
	parse_and_set_export_filter (const char *string)
	{
	gpg_error_t err;

	/* Auto register the cleanup function. */
	register_mem_cleanup_func (cleanup_export_globals);

	if (!strncmp (string, "keep-uid=", 9))
	err = recsel_parse_expr (&export_keep_uid, string+9);
	else if (!strncmp (string, "drop-subkey=", 12))
	err = recsel_parse_expr (&export_drop_subkey, string+12);
	else
	err = gpg_error (GPG_ERR_INV_NAME);

	return err;
	}


	/* Create a new export stats object initialized to zero. On error
	returns NULL and sets ERRNO. */
	export_stats_t
	export_new_stats (void)
	{
	export_stats_t stats;

	return xtrycalloc (1, sizeof *stats);
	}


	/* Release an export stats object. */
	void
	export_release_stats (export_stats_t stats)
	{
	xfree (stats);
	}


	/* Print export statistics using the status interface. */
	void
	export_print_stats (export_stats_t stats)
	{
	if (!stats)
	return;

	if (is_status_enabled ())
	{
	char buf[15*20];

	snprintf (buf, sizeof buf, "%lu %lu %lu",
	stats->count,
	stats->secret_count,
	stats->exported );
	write_status_text (STATUS_EXPORT_RES, buf);
	}
	}


	/*
	* Export public keys (to stdout or to --output FILE).
	*
	* Depending on opt.armor the output is armored. OPTIONS are defined
	* in main.h. If USERS is NULL, all keys will be exported. STATS is
	* either an export stats object for update or NULL.
	*
	* This function is the core of "gpg --export".
	*/
	int
	export_pubkeys (ctrl_t ctrl, strlist_t users, unsigned int options,
	export_stats_t stats)
	{
	return do_export (ctrl, users, 0, options, stats);
	}


	/*
	* Export secret keys (to stdout or to --output FILE).
	*
	* Depending on opt.armor the output is armored. If USERS is NULL,
	* all secret keys will be exported. STATS is either an export stats
	* object for update or NULL.
	*
	* This function is the core of "gpg --export-secret-keys".
	*/
	int
	export_seckeys (ctrl_t ctrl, strlist_t users, export_stats_t stats)
	{
	return do_export (ctrl, users, 1, 0, stats);
	}


	/*
	* Export secret sub keys (to stdout or to --output FILE).
	*
	* This is the same as export_seckeys but replaces the primary key by
	* a stub key. Depending on opt.armor the output is armored. If
	* USERS is NULL, all secret subkeys will be exported. STATS is
	* either an export stats object for update or NULL.
	*
	* This function is the core of "gpg --export-secret-subkeys".
	*/
	int
	export_secsubkeys (ctrl_t ctrl, strlist_t users, export_stats_t stats)
	{
	return do_export (ctrl, users, 2, 0, stats);
	}


	/*
	* Export a single key into a memory buffer. STATS is either an
	* export stats object for update or NULL.
	*/
	gpg_error_t
	export_pubkey_buffer (ctrl_t ctrl, const char *keyspec, unsigned int options,
	export_stats_t stats,
	kbnode_t r_keyblock, void r_data, size_t r_datalen)
	{
	gpg_error_t err;
	iobuf_t iobuf;
	int any;
	strlist_t helplist;

	*r_keyblock = NULL;
	*r_data = NULL;
	*r_datalen = 0;

	helplist = NULL;
	if (!add_to_strlist_try (&helplist, keyspec))
	return gpg_error_from_syserror ();

	iobuf = iobuf_temp ();
	err = do_export_stream (ctrl, iobuf, helplist, 0, r_keyblock, options,
	stats, &any);
	if (!err && !any)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	if (!err)
	{
	const void *src;
	size_t datalen;

	iobuf_flush_temp (iobuf);
	src = iobuf_get_temp_buffer (iobuf);
	datalen = iobuf_get_temp_length (iobuf);
	if (!datalen)
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	else if (!(*r_data = xtrymalloc (datalen)))
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*r_data, src, datalen);
	*r_datalen = datalen;
	}
	}
	iobuf_close (iobuf);
	free_strlist (helplist);
	if (err && *r_keyblock)
	{
	release_kbnode (*r_keyblock);
	*r_keyblock = NULL;
	}
	return err;
	}


	/* Export the keys identified by the list of strings in USERS. If
	Secret is false public keys will be exported. With secret true
	secret keys will be exported; in this case 1 means the entire
	secret keyblock and 2 only the subkeys. OPTIONS are the export
	options to apply. */
	static int
	do_export (ctrl_t ctrl, strlist_t users, int secret, unsigned int options,
	export_stats_t stats)
	{
	IOBUF out = NULL;
	int any, rc;
	armor_filter_context_t *afx = NULL;
	compress_filter_context_t zfx;

	memset( &zfx, 0, sizeof zfx);

	rc = open_outfile (-1, NULL, 0, !!secret, &out );
	if (rc)
	return rc;

	if ( opt.armor && !(options & (EXPORT_PKA_FORMAT\|EXPORT_DANE_FORMAT)) )
	{
	afx = new_armor_context ();
	afx->what = secret? 5 : 1;
	push_armor_filter (afx, out);
	}

	rc = do_export_stream (ctrl, out, users, secret, NULL, options, stats, &any);

	if ( rc \|\| !any )
	iobuf_cancel (out);
	else
	iobuf_close (out);
	release_armor_context (afx);
	return rc;
	}



	/* Release an entire subkey list. */
	static void
	release_subkey_list (subkey_list_t list)
	{
	while (list)
	{
	subkey_list_t tmp = list->next;;
	xfree (list);
	list = tmp;
	}
	}


	/* Returns true if NODE is a subkey and contained in LIST. */
	static int
	subkey_in_list_p (subkey_list_t list, KBNODE node)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY )
	{
	u32 kid[2];

	keyid_from_pk (node->pkt->pkt.public_key, kid);

	for (; list; list = list->next)
	if (list->kid[0] == kid[0] && list->kid[1] == kid[1])
	return 1;
	}
	return 0;
	}

	/* Allocate a new subkey list item from NODE. */
	static subkey_list_t
	new_subkey_list_item (KBNODE node)
	{
	subkey_list_t list = xcalloc (1, sizeof *list);

	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	keyid_from_pk (node->pkt->pkt.public_key, list->kid);

	return list;
	}


	/* Helper function to check whether the subkey at NODE actually
	matches the description at DESC. The function returns true if the
	key under question has been specified by an exact specification
	(keyID or fingerprint) and does match the one at NODE. It is
	assumed that the packet at NODE is either a public or secret
	subkey. */
	static int
	exact_subkey_match_p (KEYDB_SEARCH_DESC *desc, KBNODE node)
	{
	u32 kid[2];
	byte fpr[MAX_FINGERPRINT_LEN];
	size_t fprlen;
	int result = 0;

	switch(desc->mode)
	{
	case KEYDB_SEARCH_MODE_SHORT_KID:
	case KEYDB_SEARCH_MODE_LONG_KID:
	keyid_from_pk (node->pkt->pkt.public_key, kid);
	break;

	case KEYDB_SEARCH_MODE_FPR16:
	case KEYDB_SEARCH_MODE_FPR20:
	case KEYDB_SEARCH_MODE_FPR:
	fingerprint_from_pk (node->pkt->pkt.public_key, fpr,&fprlen);
	break;

	default:
	break;
	}

	switch(desc->mode)
	{
	case KEYDB_SEARCH_MODE_SHORT_KID:
	if (desc->u.kid[1] == kid[1])
	result = 1;
	break;

	case KEYDB_SEARCH_MODE_LONG_KID:
	if (desc->u.kid[0] == kid[0] && desc->u.kid[1] == kid[1])
	result = 1;
	break;

	case KEYDB_SEARCH_MODE_FPR16:
	if (!memcmp (desc->u.fpr, fpr, 16))
	result = 1;
	break;

	case KEYDB_SEARCH_MODE_FPR20:
	case KEYDB_SEARCH_MODE_FPR:
	if (!memcmp (desc->u.fpr, fpr, 20))
	result = 1;
	break;

	default:
	break;
	}

	return result;
	}


	/* Return an error if the key represented by the S-expression S_KEY
	* and the OpenPGP key represented by PK do not use the same curve. */
	static gpg_error_t
	match_curve_skey_pk (gcry_sexp_t s_key, PKT_public_key *pk)
	{
	gcry_sexp_t curve = NULL;
	gcry_sexp_t flags = NULL;
	char *curve_str = NULL;
	char *flag;
	const char *oidstr = NULL;
	gcry_mpi_t curve_as_mpi = NULL;
	gpg_error_t err;
	int is_eddsa = 0;
	int idx = 0;

	if (!(pk->pubkey_algo==PUBKEY_ALGO_ECDH
	\|\| pk->pubkey_algo==PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo==PUBKEY_ALGO_EDDSA))
	return gpg_error (GPG_ERR_PUBKEY_ALGO);

	curve = gcry_sexp_find_token (s_key, "curve", 0);
	if (!curve)
	{
	log_error ("no reported curve\n");
	return gpg_error (GPG_ERR_UNKNOWN_CURVE);
	}
	curve_str = gcry_sexp_nth_string (curve, 1);
	gcry_sexp_release (curve); curve = NULL;
	if (!curve_str)
	{
	log_error ("no curve name\n");
	return gpg_error (GPG_ERR_UNKNOWN_CURVE);
	}
	oidstr = openpgp_curve_to_oid (curve_str, NULL);
	if (!oidstr)
	{
	log_error ("no OID known for curve '%s'\n", curve_str);
	xfree (curve_str);
	return gpg_error (GPG_ERR_UNKNOWN_CURVE);
	}
	xfree (curve_str);
	err = openpgp_oid_from_str (oidstr, &curve_as_mpi);
	if (err)
	return err;
	if (gcry_mpi_cmp (pk->pkey[0], curve_as_mpi))
	{
	log_error ("curves do not match\n");
	gcry_mpi_release (curve_as_mpi);
	return gpg_error (GPG_ERR_INV_CURVE);
	}
	gcry_mpi_release (curve_as_mpi);
	flags = gcry_sexp_find_token (s_key, "flags", 0);
	if (flags)
	{
	for (idx = 1; idx < gcry_sexp_length (flags); idx++)
	{
	flag = gcry_sexp_nth_string (flags, idx);
	if (flag && (strcmp ("eddsa", flag) == 0))
	is_eddsa = 1;
	gcry_free (flag);
	}
	}
	if (is_eddsa != (pk->pubkey_algo == PUBKEY_ALGO_EDDSA))
	{
	log_error ("disagreement about EdDSA\n");
	err = gpg_error (GPG_ERR_INV_CURVE);
	}

	return err;
	}


	/* Return a canonicalized public key algoithms. This is used to
	compare different flavors of algorithms (e.g. ELG and ELG_E are
	considered the same). */
	static enum gcry_pk_algos
	canon_pk_algo (enum gcry_pk_algos algo)
	{
	switch (algo)
	{
	case GCRY_PK_RSA:
	case GCRY_PK_RSA_E:
	case GCRY_PK_RSA_S: return GCRY_PK_RSA;
	case GCRY_PK_ELG:
	case GCRY_PK_ELG_E: return GCRY_PK_ELG;
	case GCRY_PK_ECC:
	case GCRY_PK_ECDSA:
	case GCRY_PK_ECDH: return GCRY_PK_ECC;
	default: return algo;
	}
	}


	/* Take a cleartext dump of a secret key in PK and change the
	* parameter array in PK to include the secret parameters. */
	static gpg_error_t
	cleartext_secret_key_to_openpgp (gcry_sexp_t s_key, PKT_public_key *pk)
	{
	gpg_error_t err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	gcry_sexp_t top_list;
	gcry_sexp_t key = NULL;
	char *key_type = NULL;
	enum gcry_pk_algos pk_algo;
	struct seckey_info *ski;
	int idx, sec_start;
	gcry_mpi_t pub_params[10] = { NULL };

	/* we look for a private-key, then the first element in it tells us
	the type */
	top_list = gcry_sexp_find_token (s_key, "private-key", 0);
	if (!top_list)
	goto bad_seckey;
	if (gcry_sexp_length(top_list) != 2)
	goto bad_seckey;
	key = gcry_sexp_nth (top_list, 1);
	if (!key)
	goto bad_seckey;
	key_type = gcry_sexp_nth_string(key, 0);
	pk_algo = gcry_pk_map_name (key_type);

	log_assert (!pk->seckey_info);

	pk->seckey_info = ski = xtrycalloc (1, sizeof *ski);
	if (!ski)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	switch (canon_pk_algo (pk_algo))
	{
	case GCRY_PK_RSA:
	if (!is_RSA (pk->pubkey_algo))
	goto bad_pubkey_algo;
	err = gcry_sexp_extract_param (key, NULL, "ne",
	&pub_params[0],
	&pub_params[1],
	NULL);
	for (idx=0; idx < 2 && !err; idx++)
	if (gcry_mpi_cmp(pk->pkey[idx], pub_params[idx]))
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	if (!err)
	{
	for (idx = 2; idx < 6 && !err; idx++)
	{
	gcry_mpi_release (pk->pkey[idx]);
	pk->pkey[idx] = NULL;
	}
	err = gcry_sexp_extract_param (key, NULL, "dpqu",
	&pk->pkey[2],
	&pk->pkey[3],
	&pk->pkey[4],
	&pk->pkey[5],
	NULL);
	}
	if (!err)
	{
	for (idx = 2; idx < 6; idx++)
	ski->csum += checksum_mpi (pk->pkey[idx]);
	}
	break;

	case GCRY_PK_DSA:
	if (!is_DSA (pk->pubkey_algo))
	goto bad_pubkey_algo;
	err = gcry_sexp_extract_param (key, NULL, "pqgy",
	&pub_params[0],
	&pub_params[1],
	&pub_params[2],
	&pub_params[3],
	NULL);
	for (idx=0; idx < 4 && !err; idx++)
	if (gcry_mpi_cmp(pk->pkey[idx], pub_params[idx]))
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	if (!err)
	{
	gcry_mpi_release (pk->pkey[4]);
	pk->pkey[4] = NULL;
	err = gcry_sexp_extract_param (key, NULL, "x",
	&pk->pkey[4],
	NULL);
	}
	if (!err)
	ski->csum += checksum_mpi (pk->pkey[4]);
	break;

	case GCRY_PK_ELG:
	if (!is_ELGAMAL (pk->pubkey_algo))
	goto bad_pubkey_algo;
	err = gcry_sexp_extract_param (key, NULL, "pgy",
	&pub_params[0],
	&pub_params[1],
	&pub_params[2],
	NULL);
	for (idx=0; idx < 3 && !err; idx++)
	if (gcry_mpi_cmp(pk->pkey[idx], pub_params[idx]))
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	if (!err)
	{
	gcry_mpi_release (pk->pkey[3]);
	pk->pkey[3] = NULL;
	err = gcry_sexp_extract_param (key, NULL, "x",
	&pk->pkey[3],
	NULL);
	}
	if (!err)
	ski->csum += checksum_mpi (pk->pkey[3]);
	break;

	case GCRY_PK_ECC:
	err = match_curve_skey_pk (key, pk);
	if (err)
	goto leave;
	if (!err)
	err = gcry_sexp_extract_param (key, NULL, "q",
	&pub_params[0],
	NULL);
	if (!err && (gcry_mpi_cmp(pk->pkey[1], pub_params[0])))
	err = gpg_error (GPG_ERR_BAD_PUBKEY);

	sec_start = 2;
	if (pk->pubkey_algo == PUBKEY_ALGO_ECDH)
	sec_start += 1;
	if (!err)
	{
	gcry_mpi_release (pk->pkey[sec_start]);
	pk->pkey[sec_start] = NULL;
	err = gcry_sexp_extract_param (key, NULL, "d",
	&pk->pkey[sec_start],
	NULL);
	}

	if (!err)
	ski->csum += checksum_mpi (pk->pkey[sec_start]);
	break;

	default:
	pk->seckey_info = NULL;
	xfree (ski);
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	break;
	}

	leave:
	gcry_sexp_release (top_list);
	gcry_sexp_release (key);
	gcry_free (key_type);

	for (idx=0; idx < DIM(pub_params); idx++)
	gcry_mpi_release (pub_params[idx]);
	return err;

	bad_pubkey_algo:
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);
	goto leave;

	bad_seckey:
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}


	/* Use the key transfer format given in S_PGP to create the secinfo
	structure in PK and change the parameter array in PK to include the
	secret parameters. */
	static gpg_error_t
	transfer_format_to_openpgp (gcry_sexp_t s_pgp, PKT_public_key *pk)
	{
	gpg_error_t err;
	gcry_sexp_t top_list;
	gcry_sexp_t list = NULL;
	char *curve = NULL;
	const char *value;
	size_t valuelen;
	char *string;
	int idx;
	int is_v4, is_protected;
	enum gcry_pk_algos pk_algo;
	int protect_algo = 0;
	char iv[16];
	int ivlen = 0;
	int s2k_mode = 0;
	int s2k_algo = 0;
	byte s2k_salt[8];
	u32 s2k_count = 0;
	int is_ecdh = 0;
	size_t npkey, nskey;
	gcry_mpi_t skey[10]; /* We support up to 9 parameters. */
	int skeyidx = 0;
	struct seckey_info *ski;

	/* gcry_log_debugsxp ("transferkey", s_pgp); */
	top_list = gcry_sexp_find_token (s_pgp, "openpgp-private-key", 0);
	if (!top_list)
	goto bad_seckey;

	list = gcry_sexp_find_token (top_list, "version", 0);
	if (!list)
	goto bad_seckey;
	value = gcry_sexp_nth_data (list, 1, &valuelen);
	if (!value \|\| valuelen != 1 \|\| !(value[0] == '3' \|\| value[0] == '4'))
	goto bad_seckey;
	is_v4 = (value[0] == '4');

	gcry_sexp_release (list);
	list = gcry_sexp_find_token (top_list, "protection", 0);
	if (!list)
	goto bad_seckey;
	value = gcry_sexp_nth_data (list, 1, &valuelen);
	if (!value)
	goto bad_seckey;
	if (valuelen == 4 && !memcmp (value, "sha1", 4))
	is_protected = 2;
	else if (valuelen == 3 && !memcmp (value, "sum", 3))
	is_protected = 1;
	else if (valuelen == 4 && !memcmp (value, "none", 4))
	is_protected = 0;
	else
	goto bad_seckey;
	if (is_protected)
	{
	string = gcry_sexp_nth_string (list, 2);
	if (!string)
	goto bad_seckey;
	protect_algo = gcry_cipher_map_name (string);
	xfree (string);

	value = gcry_sexp_nth_data (list, 3, &valuelen);
	if (!value \|\| !valuelen \|\| valuelen > sizeof iv)
	goto bad_seckey;
	memcpy (iv, value, valuelen);
	ivlen = valuelen;

	string = gcry_sexp_nth_string (list, 4);
	if (!string)
	goto bad_seckey;
	s2k_mode = strtol (string, NULL, 10);
	xfree (string);

	string = gcry_sexp_nth_string (list, 5);
	if (!string)
	goto bad_seckey;
	s2k_algo = gcry_md_map_name (string);
	xfree (string);

	value = gcry_sexp_nth_data (list, 6, &valuelen);
	if (!value \|\| !valuelen \|\| valuelen > sizeof s2k_salt)
	goto bad_seckey;
	memcpy (s2k_salt, value, valuelen);

	string = gcry_sexp_nth_string (list, 7);
	if (!string)
	goto bad_seckey;
	s2k_count = strtoul (string, NULL, 10);
	xfree (string);
	}

	/* Parse the gcrypt PK algo and check that it is okay. */
	gcry_sexp_release (list);
	list = gcry_sexp_find_token (top_list, "algo", 0);
	if (!list)
	goto bad_seckey;
	string = gcry_sexp_nth_string (list, 1);
	if (!string)
	goto bad_seckey;
	pk_algo = gcry_pk_map_name (string);
	xfree (string); string = NULL;
	if (gcry_pk_algo_info (pk_algo, GCRYCTL_GET_ALGO_NPKEY, NULL, &npkey)
	\|\| gcry_pk_algo_info (pk_algo, GCRYCTL_GET_ALGO_NSKEY, NULL, &nskey)
	\|\| !npkey \|\| npkey >= nskey)
	goto bad_seckey;

	/* Check that the pubkey algo matches the one from the public key. */
	switch (canon_pk_algo (pk_algo))
	{
	case GCRY_PK_RSA:
	if (!is_RSA (pk->pubkey_algo))
	pk_algo = 0; /* Does not match. */
	break;
	case GCRY_PK_DSA:
	if (!is_DSA (pk->pubkey_algo))
	pk_algo = 0; /* Does not match. */
	break;
	case GCRY_PK_ELG:
	if (!is_ELGAMAL (pk->pubkey_algo))
	pk_algo = 0; /* Does not match. */
	break;
	case GCRY_PK_ECC:
	if (pk->pubkey_algo == PUBKEY_ALGO_ECDSA)
	;
	else if (pk->pubkey_algo == PUBKEY_ALGO_ECDH)
	is_ecdh = 1;
	else if (pk->pubkey_algo == PUBKEY_ALGO_EDDSA)
	;
	else
	pk_algo = 0; /* Does not match. */
	/* For ECC we do not have the domain parameters thus fix our info. */
	npkey = 1;
	nskey = 2;
	break;
	default:
	pk_algo = 0; /* Oops. */
	break;
	}
	if (!pk_algo)
	{
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);
	goto leave;
	}

	/* This check has to go after the ecc adjustments. */
	if (nskey > PUBKEY_MAX_NSKEY)
	goto bad_seckey;

	/* Parse the key parameters. */
	gcry_sexp_release (list);
	list = gcry_sexp_find_token (top_list, "skey", 0);
	if (!list)
	goto bad_seckey;
	for (idx=0;;)
	{
	int is_enc;

	value = gcry_sexp_nth_data (list, ++idx, &valuelen);
	if (!value && skeyidx >= npkey)
	break; /* Ready. */

	/* Check for too many parameters. Note that depending on the
	protection mode and version number we may see less than NSKEY
	(but at least NPKEY+1) parameters. */
	if (idx >= 2*nskey)
	goto bad_seckey;
	if (skeyidx >= DIM (skey)-1)
	goto bad_seckey;

	if (!value \|\| valuelen != 1 \|\| !(value[0] == '_' \|\| value[0] == 'e'))
	goto bad_seckey;
	is_enc = (value[0] == 'e');
	value = gcry_sexp_nth_data (list, ++idx, &valuelen);
	if (!value \|\| !valuelen)
	goto bad_seckey;
	if (is_enc)
	{
	void *p = xtrymalloc (valuelen);
	if (!p)
	goto outofmem;
	memcpy (p, value, valuelen);
	skey[skeyidx] = gcry_mpi_set_opaque (NULL, p, valuelen*8);
	if (!skey[skeyidx])
	goto outofmem;
	}
	else
	{
	if (gcry_mpi_scan (skey + skeyidx, GCRYMPI_FMT_STD,
	value, valuelen, NULL))
	goto bad_seckey;
	}
	skeyidx++;
	}
	skey[skeyidx++] = NULL;

	gcry_sexp_release (list); list = NULL;

	/* We have no need for the CSUM value thus we don't parse it. */
	/* list = gcry_sexp_find_token (top_list, "csum", 0); */
	/* if (list) */
	/* { */
	/* string = gcry_sexp_nth_string (list, 1); */
	/* if (!string) */
	/* goto bad_seckey; */
	/* desired_csum = strtoul (string, NULL, 10); */
	/* xfree (string); */
	/* } */
	/* else */
	/* desired_csum = 0; */
	/* gcry_sexp_release (list); list = NULL; */

	/* Get the curve name if any, */
	list = gcry_sexp_find_token (top_list, "curve", 0);
	if (list)
	{
	curve = gcry_sexp_nth_string (list, 1);
	gcry_sexp_release (list); list = NULL;
	}

	gcry_sexp_release (top_list); top_list = NULL;

	/* log_debug ("XXX is_v4=%d\n", is_v4); */
	/* log_debug ("XXX pubkey_algo=%d\n", pubkey_algo); */
	/* log_debug ("XXX is_protected=%d\n", is_protected); */
	/* log_debug ("XXX protect_algo=%d\n", protect_algo); */
	/* log_printhex ("XXX iv", iv, ivlen); */
	/* log_debug ("XXX ivlen=%d\n", ivlen); */
	/* log_debug ("XXX s2k_mode=%d\n", s2k_mode); */
	/* log_debug ("XXX s2k_algo=%d\n", s2k_algo); */
	/* log_printhex ("XXX s2k_salt", s2k_salt, sizeof s2k_salt); */
	/* log_debug ("XXX s2k_count=%lu\n", (unsigned long)s2k_count); */
	/* for (idx=0; skey[idx]; idx++) */
	/* { */
	/* int is_enc = gcry_mpi_get_flag (skey[idx], GCRYMPI_FLAG_OPAQUE); */
	/* log_info ("XXX skey[%d]%s:", idx, is_enc? " (enc)":""); */
	/* if (is_enc) */
	/* { */
	/* void p; /
	/* unsigned int nbits; */
	/* p = gcry_mpi_get_opaque (skey[idx], &nbits); */
	/* log_printhex (NULL, p, (nbits+7)/8); */
	/* } */
	/* else */
	/* gcry_mpi_dump (skey[idx]); */
	/* log_printf ("\n"); */
	/* } */

	if (!is_v4 \|\| is_protected != 2 )
	{
	/* We only support the v4 format and a SHA-1 checksum. */
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	goto leave;
	}

	/* We need to change the received parameters for ECC algorithms.
	The transfer format has the curve name and the parameters
	separate. We put them all into the SKEY array. */
	if (canon_pk_algo (pk_algo) == GCRY_PK_ECC)
	{
	const char *oidstr;

	/* Assert that all required parameters are available. We also
	check that the array does not contain more parameters than
	needed (this was used by some beta versions of 2.1. */
	if (!curve \|\| !skey[0] \|\| !skey[1] \|\| skey[2])
	{
	err = gpg_error (GPG_ERR_INTERNAL);
	goto leave;
	}

	oidstr = openpgp_curve_to_oid (curve, NULL);
	if (!oidstr)
	{
	log_error ("no OID known for curve '%s'\n", curve);
	err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
	goto leave;
	}
	- /* Put the curve's OID into into the MPI array. This requires
	+ /* Put the curve's OID into the MPI array. This requires
	that we shift Q and D. For ECDH also insert the KDF parms. */
	if (is_ecdh)
	{
	skey[4] = NULL;
	skey[3] = skey[1];
	skey[2] = gcry_mpi_copy (pk->pkey[2]);
	}
	else
	{
	skey[3] = NULL;
	skey[2] = skey[1];
	}
	skey[1] = skey[0];
	skey[0] = NULL;
	err = openpgp_oid_from_str (oidstr, skey + 0);
	if (err)
	goto leave;
	/* Fixup the NPKEY and NSKEY to match OpenPGP reality. */
	npkey = 2 + is_ecdh;
	nskey = 3 + is_ecdh;

	/* for (idx=0; skey[idx]; idx++) */
	/* { */
	/* log_info ("YYY skey[%d]:", idx); */
	/* if (gcry_mpi_get_flag (skey[idx], GCRYMPI_FLAG_OPAQUE)) */
	/* { */
	/* void p; /
	/* unsigned int nbits; */
	/* p = gcry_mpi_get_opaque (skey[idx], &nbits); */
	/* log_printhex (NULL, p, (nbits+7)/8); */
	/* } */
	/* else */
	/* gcry_mpi_dump (skey[idx]); */
	/* log_printf ("\n"); */
	/* } */
	}

	/* Do some sanity checks. */
	if (s2k_count > 255)
	{
	/* We expect an already encoded S2K count. */
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	err = openpgp_cipher_test_algo (protect_algo);
	if (err)
	goto leave;
	err = openpgp_md_test_algo (s2k_algo);
	if (err)
	goto leave;

	/* Check that the public key parameters match. Note that since
	Libgcrypt 1.5 gcry_mpi_cmp handles opaque MPI correctly. */
	for (idx=0; idx < npkey; idx++)
	if (gcry_mpi_cmp (pk->pkey[idx], skey[idx]))
	{
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	goto leave;
	}

	/* Check that the first secret key parameter in SKEY is encrypted
	and that there are no more secret key parameters. The latter is
	guaranteed by the v4 packet format. */
	if (!gcry_mpi_get_flag (skey[npkey], GCRYMPI_FLAG_OPAQUE))
	goto bad_seckey;
	if (npkey+1 < DIM (skey) && skey[npkey+1])
	goto bad_seckey;

	/* Check that the secret key parameters in PK are all set to NULL. */
	for (idx=npkey; idx < nskey; idx++)
	if (pk->pkey[idx])
	goto bad_seckey;

	/* Now build the protection info. */
	pk->seckey_info = ski = xtrycalloc (1, sizeof *ski);
	if (!ski)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	ski->is_protected = 1;
	ski->sha1chk = 1;
	ski->algo = protect_algo;
	ski->s2k.mode = s2k_mode;
	ski->s2k.hash_algo = s2k_algo;
	log_assert (sizeof ski->s2k.salt == sizeof s2k_salt);
	memcpy (ski->s2k.salt, s2k_salt, sizeof s2k_salt);
	ski->s2k.count = s2k_count;
	log_assert (ivlen <= sizeof ski->iv);
	memcpy (ski->iv, iv, ivlen);
	ski->ivlen = ivlen;

	/* Store the protected secret key parameter. */
	pk->pkey[npkey] = skey[npkey];
	skey[npkey] = NULL;

	/* That's it. */

	leave:
	gcry_free (curve);
	gcry_sexp_release (list);
	gcry_sexp_release (top_list);
	for (idx=0; idx < skeyidx; idx++)
	gcry_mpi_release (skey[idx]);
	return err;

	bad_seckey:
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;

	outofmem:
	err = gpg_error (GPG_ERR_ENOMEM);
	goto leave;
	}


	/* Print an "EXPORTED" status line. PK is the primary public key. */
	static void
	print_status_exported (PKT_public_key *pk)
	{
	char *hexfpr;

	if (!is_status_enabled ())
	return;

	hexfpr = hexfingerprint (pk, NULL, 0);
	write_status_text (STATUS_EXPORTED, hexfpr? hexfpr : "[?]");
	xfree (hexfpr);
	}


	/*
	* Receive a secret key from agent specified by HEXGRIP.
	*
	* Since the key data from the agent is encrypted, decrypt it using
	* CIPHERHD context. Then, parse the decrypted key data into transfer
	* format, and put secret parameters into PK.
	*
	* If CLEARTEXT is 0, store the secret key material
	* passphrase-protected. Otherwise, store secret key material in the
	* clear.
	*
	* CACHE_NONCE_ADDR is used to share nonce for multple key retrievals.
	*/
	gpg_error_t
	receive_seckey_from_agent (ctrl_t ctrl, gcry_cipher_hd_t cipherhd,
	int cleartext,
	char *cache_nonce_addr, const char hexgrip,
	PKT_public_key *pk)
	{
	gpg_error_t err = 0;
	unsigned char *wrappedkey = NULL;
	size_t wrappedkeylen;
	unsigned char *key = NULL;
	size_t keylen, realkeylen;
	gcry_sexp_t s_skey;
	char *prompt;

	if (opt.verbose)
	log_info ("key %s: asking agent for the secret parts\n", hexgrip);

	prompt = gpg_format_keydesc (pk, FORMAT_KEYDESC_EXPORT,1);
	err = agent_export_key (ctrl, hexgrip, prompt, !cleartext, cache_nonce_addr,
	&wrappedkey, &wrappedkeylen);
	xfree (prompt);

	if (err)
	goto unwraperror;
	if (wrappedkeylen < 24)
	{
	err = gpg_error (GPG_ERR_INV_LENGTH);
	goto unwraperror;
	}
	keylen = wrappedkeylen - 8;
	key = xtrymalloc_secure (keylen);
	if (!key)
	{
	err = gpg_error_from_syserror ();
	goto unwraperror;
	}
	err = gcry_cipher_decrypt (cipherhd, key, keylen, wrappedkey, wrappedkeylen);
	if (err)
	goto unwraperror;
	realkeylen = gcry_sexp_canon_len (key, keylen, NULL, &err);
	if (!realkeylen)
	goto unwraperror; /* Invalid csexp. */

	err = gcry_sexp_sscan (&s_skey, NULL, key, realkeylen);
	if (!err)
	{
	if (cleartext)
	err = cleartext_secret_key_to_openpgp (s_skey, pk);
	else
	err = transfer_format_to_openpgp (s_skey, pk);
	gcry_sexp_release (s_skey);
	}

	unwraperror:
	xfree (key);
	xfree (wrappedkey);
	if (err)
	{
	log_error ("key %s: error receiving key from agent:"
	" %s%s\n", hexgrip, gpg_strerror (err),
	gpg_err_code (err) == GPG_ERR_FULLY_CANCELED?
	"":_(" - skipped"));
	}
	return err;
	}


	/* Write KEYBLOCK either to stdout or to the file set with the
	* --output option. This is a simplified version of do_export_stream
	* which supports only a few export options. */
	gpg_error_t
	write_keyblock_to_output (kbnode_t keyblock, int with_armor,
	unsigned int options)
	{
	gpg_error_t err;
	const char *fname;
	iobuf_t out;
	kbnode_t node;
	armor_filter_context_t *afx = NULL;
	iobuf_t out_help = NULL;
	PKT_public_key *pk = NULL;

	fname = opt.outfile? opt.outfile : "-";
	if (is_secured_filename (fname) )
	return gpg_error (GPG_ERR_EPERM);

	out = iobuf_create (fname, 0);
	if (!out)
	{
	err = gpg_error_from_syserror ();
	log_error(_("can't create '%s': %s\n"), fname, gpg_strerror (err));
	return err;
	}
	if (opt.verbose)
	log_info (_("writing to '%s'\n"), iobuf_get_fname_nonnull (out));

	if ((options & (EXPORT_PKA_FORMAT\|EXPORT_DANE_FORMAT)))
	{
	with_armor = 0;
	out_help = iobuf_temp ();
	}

	if (with_armor)
	{
	afx = new_armor_context ();
	afx->what = 1;
	push_armor_filter (afx, out);
	}

	for (node = keyblock; node; node = node->next)
	{
	if (is_deleted_kbnode (node) \|\| node->pkt->pkttype == PKT_RING_TRUST)
	continue;
	if (!pk && (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY))
	pk = node->pkt->pkt.public_key;

	err = build_packet (out_help? out_help : out, node->pkt);
	if (err)
	{
	log_error ("build_packet(%d) failed: %s\n",
	node->pkt->pkttype, gpg_strerror (err) );
	goto leave;
	}
	}
	err = 0;

	if (out_help && pk)
	{
	const void *data;
	size_t datalen;

	iobuf_flush_temp (out_help);
	data = iobuf_get_temp_buffer (out_help);
	datalen = iobuf_get_temp_length (out_help);

	err = print_pka_or_dane_records (out,
	keyblock, pk, data, datalen,
	(options & EXPORT_PKA_FORMAT),
	(options & EXPORT_DANE_FORMAT));
	}

	leave:
	if (err)
	iobuf_cancel (out);
	else
	iobuf_close (out);
	iobuf_cancel (out_help);
	release_armor_context (afx);
	return err;
	}


	/*
	* Apply the keep-uid filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_keep_uid_filter (kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;

	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (!recsel_select (selector, impex_filter_getval, node))
	{
	/* log_debug ("keep-uid: deleting '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	/* The UID packet and all following packets up to the
	* next UID or a subkey. */
	delete_kbnode (node);
	for (; node->next
	&& node->next->pkt->pkttype != PKT_USER_ID
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ;
	node = node->next)
	delete_kbnode (node->next);
	}
	/* else */
	/* log_debug ("keep-uid: keeping '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	}
	}
	}


	/*
	* Apply the drop-subkey filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_drop_subkey_filter (kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;

	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	if (recsel_select (selector, impex_filter_getval, node))
	{
	log_debug ("drop-subkey: deleting a key\n");
	/* The subkey packet and all following packets up to the
	* next subkey. */
	delete_kbnode (node);
	for (; node->next
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ;
	node = node->next)
	delete_kbnode (node->next);
	}
	}
	}
	}


	/* Print DANE or PKA records for all user IDs in KEYBLOCK to OUT. The
	* data for the record is taken from (DATA,DATELEN). PK is the public
	* key packet with the primary key. */
	static gpg_error_t
	print_pka_or_dane_records (iobuf_t out, kbnode_t keyblock, PKT_public_key *pk,
	const void *data, size_t datalen,
	int print_pka, int print_dane)
	{
	gpg_error_t err = 0;
	kbnode_t kbctx, node;
	PKT_user_id *uid;
	char *mbox = NULL;
	char hashbuf[32];
	char *hash = NULL;
	char *domain;
	const char *s;
	unsigned int len;
	estream_t fp = NULL;
	char *hexdata = NULL;
	char *hexfpr;

	hexfpr = hexfingerprint (pk, NULL, 0);
	hexdata = bin2hex (data, datalen, NULL);
	if (!hexdata)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	ascii_strlwr (hexdata);
	fp = es_fopenmem (0, "rw,samethread");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	for (kbctx = NULL; (node = walk_kbnode (keyblock, &kbctx, 0));)
	{
	if (node->pkt->pkttype != PKT_USER_ID)
	continue;
	uid = node->pkt->pkt.user_id;

	if (uid->is_expired \|\| uid->is_revoked)
	continue;

	xfree (mbox);
	mbox = mailbox_from_userid (uid->name);
	if (!mbox)
	continue;

	domain = strchr (mbox, '@');
	*domain++ = 0;

	if (print_pka)
	{
	es_fprintf (fp, "$ORIGIN _pka.%s.\n; %s\n; ", domain, hexfpr);
	print_utf8_buffer (fp, uid->name, uid->len);
	es_putc ('\n', fp);
	gcry_md_hash_buffer (GCRY_MD_SHA1, hashbuf, mbox, strlen (mbox));
	xfree (hash);
	hash = zb32_encode (hashbuf, 8*20);
	if (!hash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	len = strlen (hexfpr)/2;
	es_fprintf (fp, "%s TYPE37 \\# %u 0006 0000 00 %02X %s\n\n",
	hash, 6 + len, len, hexfpr);
	}

	if (print_dane && hexdata)
	{
	es_fprintf (fp, "$ORIGIN _openpgpkey.%s.\n; %s\n; ", domain, hexfpr);
	print_utf8_buffer (fp, uid->name, uid->len);
	es_putc ('\n', fp);
	gcry_md_hash_buffer (GCRY_MD_SHA256, hashbuf, mbox, strlen (mbox));
	xfree (hash);
	hash = bin2hex (hashbuf, 28, NULL);
	if (!hash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	ascii_strlwr (hash);
	len = strlen (hexdata)/2;
	es_fprintf (fp, "%s TYPE61 \\# %u (\n", hash, len);
	for (s = hexdata; ;)
	{
	es_fprintf (fp, "\t%.64s\n", s);
	if (strlen (s) < 64)
	break;
	s += 64;
	}
	es_fputs ("\t)\n\n", fp);
	}
	}

	/* Make sure it is a string and write it. */
	es_fputc (0, fp);
	{
	void *vp;

	if (es_fclose_snatch (fp, &vp, NULL))
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	fp = NULL;
	iobuf_writestr (out, vp);
	es_free (vp);
	}
	err = 0;

	leave:
	xfree (hash);
	xfree (mbox);
	es_fclose (fp);
	xfree (hexdata);
	xfree (hexfpr);
	return err;
	}


	/* Helper for do_export_stream which writes one keyblock to OUT. */
	static gpg_error_t
	do_export_one_keyblock (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
	iobuf_t out, int secret, unsigned int options,
	export_stats_t stats, int *any,
	KEYDB_SEARCH_DESC *desc, size_t ndesc,
	size_t descindex, gcry_cipher_hd_t cipherhd)
	{
	gpg_error_t err;
	char *cache_nonce = NULL;
	subkey_list_t subkey_list = NULL; /* Track already processed subkeys. */
	int skip_until_subkey = 0;
	int cleartext = 0;
	char *hexgrip = NULL;
	char *serialno = NULL;
	PKT_public_key *pk;
	u32 subkidbuf[2], *subkid;
	kbnode_t kbctx, node;

	/* NB: walk_kbnode skips packets marked as deleted. */
	for (kbctx=NULL; (node = walk_kbnode (keyblock, &kbctx, 0)); )
	{
	if (skip_until_subkey)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	skip_until_subkey = 0;
	else
	continue;
	}

	/* We used to use comment packets, but not any longer. In
	* case we still have comments on a key, strip them here
	* before we call build_packet(). */
	if (node->pkt->pkttype == PKT_COMMENT)
	continue;

	/* Make sure that ring_trust packets are only exported in backup
	* mode. */
	if (node->pkt->pkttype == PKT_RING_TRUST && !(options & EXPORT_BACKUP))
	continue;

	/* If exact is set, then we only export what was requested
	* (plus the primary key, if the user didn't specifically
	* request it). */
	if (desc[descindex].exact && node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	if (!exact_subkey_match_p (desc+descindex, node))
	{
	/* Before skipping this subkey, check whether any
	* other description wants an exact match on a
	* subkey and include that subkey into the output
	* too. Need to add this subkey to a list so that
	* it won't get processed a second time.
	*
	* So the first step here is to check that list and
	* skip in any case if the key is in that list.
	*
	* We need this whole mess because the import
	* function of GnuPG < 2.1 is not able to merge
	* secret keys and thus it is useless to output them
	* as two separate keys and have import merge them.
	*/
	if (subkey_in_list_p (subkey_list, node))
	skip_until_subkey = 1; /* Already processed this one. */
	else
	{
	size_t j;

	for (j=0; j < ndesc; j++)
	if (j != descindex && desc[j].exact
	&& exact_subkey_match_p (desc+j, node))
	break;
	if (!(j < ndesc))
	skip_until_subkey = 1; /* No other one matching. */
	}
	}

	if (skip_until_subkey)
	continue;

	/* Mark this one as processed. */
	{
	subkey_list_t tmp = new_subkey_list_item (node);
	tmp->next = subkey_list;
	subkey_list = tmp;
	}
	}

	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	/* Do not export packets which are marked as not
	* exportable. */
	if (!(options & EXPORT_LOCAL_SIGS)
	&& !node->pkt->pkt.signature->flags.exportable)
	continue; /* not exportable */

	/* Do not export packets with a "sensitive" revocation key
	* unless the user wants us to. Note that we do export
	* these when issuing the actual revocation (see revoke.c). */
	if (!(options & EXPORT_SENSITIVE_REVKEYS)
	&& node->pkt->pkt.signature->revkey)
	{
	int i;

	for (i = 0; i < node->pkt->pkt.signature->numrevkeys; i++)
	if ((node->pkt->pkt.signature->revkey[i].class & 0x40))
	break;
	if (i < node->pkt->pkt.signature->numrevkeys)
	continue;
	}
	}

	/* Don't export attribs? */
	if (!(options & EXPORT_ATTRIBUTES)
	&& node->pkt->pkttype == PKT_USER_ID
	&& node->pkt->pkt.user_id->attrib_data)
	{
	/* Skip until we get to something that is not an attrib or a
	* signature on an attrib. */
	while (kbctx->next && kbctx->next->pkt->pkttype == PKT_SIGNATURE)
	kbctx = kbctx->next;

	continue;
	}

	if (secret && (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY))
	{
	pk = node->pkt->pkt.public_key;
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	subkid = NULL;
	else
	{
	keyid_from_pk (pk, subkidbuf);
	subkid = subkidbuf;
	}

	if (pk->seckey_info)
	{
	log_error ("key %s: oops: seckey_info already set"
	" - skipped\n", keystr_with_sub (keyid, subkid));
	skip_until_subkey = 1;
	continue;
	}

	xfree (hexgrip);
	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	{
	log_error ("key %s: error computing keygrip: %s"
	" - skipped\n", keystr_with_sub (keyid, subkid),
	gpg_strerror (err));
	skip_until_subkey = 1;
	err = 0;
	continue;
	}

	xfree (serialno);
	serialno = NULL;
	if (secret == 2 && node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	/* We are asked not to export the secret parts of the
	* primary key. Make up an error code to create the
	* stub. */
	err = GPG_ERR_NOT_FOUND;
	}
	else
	err = agent_get_keyinfo (ctrl, hexgrip, &serialno, &cleartext);

	if ((!err && serialno)
	&& secret == 2 && node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	/* It does not make sense to export a key with its
	* primary key on card using a non-key stub. Thus we
	* skip those keys when used with --export-secret-subkeys. */
	log_info (_("key %s: key material on-card - skipped\n"),
	keystr_with_sub (keyid, subkid));
	skip_until_subkey = 1;
	}
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND
	\|\| (!err && serialno))
	{
	/* Create a key stub. */
	struct seckey_info *ski;
	const char *s;

	pk->seckey_info = ski = xtrycalloc (1, sizeof *ski);
	if (!ski)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	ski->is_protected = 1;
	if (err)
	ski->s2k.mode = 1001; /* GNU dummy (no secret key). */
	else
	{
	ski->s2k.mode = 1002; /* GNU-divert-to-card. */
	for (s=serialno; sizeof (ski->ivlen) && *s && s[1];
	ski->ivlen++, s += 2)
	ski->iv[ski->ivlen] = xtoi_2 (s);
	}

	err = build_packet (out, node->pkt);
	if (!err && node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	stats->exported++;
	print_status_exported (node->pkt->pkt.public_key);
	}
	}
	else if (!err)
	{
	err = receive_seckey_from_agent (ctrl, cipherhd,
	cleartext, &cache_nonce,
	hexgrip, pk);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	goto leave;
	skip_until_subkey = 1;
	err = 0;
	}
	else
	{
	err = build_packet (out, node->pkt);
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	stats->exported++;
	print_status_exported (node->pkt->pkt.public_key);
	}
	}
	}
	else
	{
	log_error ("key %s: error getting keyinfo from agent: %s"
	" - skipped\n", keystr_with_sub (keyid, subkid),
	gpg_strerror (err));
	skip_until_subkey = 1;
	err = 0;
	}

	xfree (pk->seckey_info);
	pk->seckey_info = NULL;
	{
	int i;
	for (i = pubkey_get_npkey (pk->pubkey_algo);
	i < pubkey_get_nskey (pk->pubkey_algo); i++)
	{
	gcry_mpi_release (pk->pkey[i]);
	pk->pkey[i] = NULL;
	}
	}
	}
	else /* Not secret or common packets. */
	{
	err = build_packet (out, node->pkt);
	if (!err && node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	stats->exported++;
	print_status_exported (node->pkt->pkt.public_key);
	}
	}

	if (err)
	{
	log_error ("build_packet(%d) failed: %s\n",
	node->pkt->pkttype, gpg_strerror (err));
	goto leave;
	}

	if (!skip_until_subkey)
	*any = 1;
	}

	leave:
	release_subkey_list (subkey_list);
	xfree (serialno);
	xfree (hexgrip);
	xfree (cache_nonce);
	return err;
	}


	/* Export the keys identified by the list of strings in USERS to the
	stream OUT. If SECRET is false public keys will be exported. With
	secret true secret keys will be exported; in this case 1 means the
	entire secret keyblock and 2 only the subkeys. OPTIONS are the
	export options to apply. If KEYBLOCK_OUT is not NULL, AND the exit
	code is zero, a pointer to the first keyblock found and exported
	will be stored at this address; no other keyblocks are exported in
	this case. The caller must free the returned keyblock. If any
	key has been exported true is stored at ANY. */
	static int
	do_export_stream (ctrl_t ctrl, iobuf_t out, strlist_t users, int secret,
	kbnode_t *keyblock_out, unsigned int options,
	export_stats_t stats, int *any)
	{
	gpg_error_t err = 0;
	PACKET pkt;
	kbnode_t keyblock = NULL;
	kbnode_t node;
	size_t ndesc, descindex;
	KEYDB_SEARCH_DESC *desc = NULL;
	KEYDB_HANDLE kdbhd;
	strlist_t sl;
	gcry_cipher_hd_t cipherhd = NULL;
	struct export_stats_s dummystats;
	iobuf_t out_help = NULL;

	if (!stats)
	stats = &dummystats;
	*any = 0;
	init_packet (&pkt);
	kdbhd = keydb_new ();
	if (!kdbhd)
	return gpg_error_from_syserror ();

	/* For the PKA and DANE format open a helper iobuf and for DANE
	* enforce some options. */
	if ((options & (EXPORT_PKA_FORMAT \| EXPORT_DANE_FORMAT)))
	{
	out_help = iobuf_temp ();
	if ((options & EXPORT_DANE_FORMAT))
	options \|= EXPORT_MINIMAL \| EXPORT_CLEAN;
	}

	if (!users)
	{
	ndesc = 1;
	desc = xcalloc (ndesc, sizeof *desc);
	desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
	}
	else
	{
	for (ndesc=0, sl=users; sl; sl = sl->next, ndesc++)
	;
	desc = xmalloc ( ndesc * sizeof *desc);

	for (ndesc=0, sl=users; sl; sl = sl->next)
	{
	if (!(err=classify_user_id (sl->d, desc+ndesc, 1)))
	ndesc++;
	else
	log_error (_("key \"%s\" not found: %s\n"),
	sl->d, gpg_strerror (err));
	}

	keydb_disable_caching (kdbhd); /* We are looping the search. */

	/* It would be nice to see which of the given users did actually
	match one in the keyring. To implement this we need to have
	a found flag for each entry in desc. To set this flag we
	must check all those entries after a match to mark all
	matched one - currently we stop at the first match. To do
	this we need an extra flag to enable this feature. */
	}

	#ifdef ENABLE_SELINUX_HACKS
	if (secret)
	{
	log_error (_("exporting secret keys not allowed\n"));
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	goto leave;
	}
	#endif

	/* For secret key export we need to setup a decryption context. */
	if (secret)
	{
	void *kek = NULL;
	size_t keklen;

	err = agent_keywrap_key (ctrl, 1, &kek, &keklen);
	if (err)
	{
	log_error ("error getting the KEK: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Prepare a cipher context. */
	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (!err)
	err = gcry_cipher_setkey (cipherhd, kek, keklen);
	if (err)
	{
	log_error ("error setting up an encryption context: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	xfree (kek);
	kek = NULL;
	}

	for (;;)
	{
	u32 keyid[2];
	PKT_public_key *pk;

	err = keydb_search (kdbhd, desc, ndesc, &descindex);
	if (!users)
	desc[0].mode = KEYDB_SEARCH_MODE_NEXT;
	if (err)
	break;

	/* Read the keyblock. */
	release_kbnode (keyblock);
	keyblock = NULL;
	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	goto leave;
	}

	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	{
	log_error ("public key packet not found in keyblock - skipped\n");
	continue;
	}
	stats->count++;
	setup_main_keyids (keyblock); /* gpg_format_keydesc needs it. */
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, keyid);

	/* If a secret key export is required we need to check whether
	we have a secret key at all and if so create the seckey_info
	structure. */
	if (secret)
	{
	if (agent_probe_any_secret_key (ctrl, keyblock))
	continue; /* No secret key (neither primary nor subkey). */

	/* No v3 keys with GNU mode 1001. */
	if (secret == 2 && pk->version == 3)
	{
	log_info (_("key %s: PGP 2.x style key - skipped\n"),
	keystr (keyid));
	continue;
	}

	/* The agent does not yet allow export of v3 packets. It is
	actually questionable whether we should allow them at
	all. */
	if (pk->version == 3)
	{
	log_info ("key %s: PGP 2.x style key (v3) export "
	"not yet supported - skipped\n", keystr (keyid));
	continue;
	}
	stats->secret_count++;
	}

	/* Always do the cleaning on the public key part if requested.
	Note that we don't yet set this option if we are exporting
	secret keys. Note that both export-clean and export-minimal
	only apply to UID sigs (0x10, 0x11, 0x12, and 0x13). A
	designated revocation is never stripped, even with
	export-minimal set. */
	if ((options & EXPORT_CLEAN))
	clean_key (keyblock, opt.verbose, (options&EXPORT_MINIMAL), NULL, NULL);

	if (export_keep_uid)
	{
	commit_kbnode (&keyblock);
	apply_keep_uid_filter (keyblock, export_keep_uid);
	commit_kbnode (&keyblock);
	}

	if (export_drop_subkey)
	{
	commit_kbnode (&keyblock);
	apply_drop_subkey_filter (keyblock, export_drop_subkey);
	commit_kbnode (&keyblock);
	}

	/* And write it. */
	err = do_export_one_keyblock (ctrl, keyblock, keyid,
	out_help? out_help : out,
	secret, options, stats, any,
	desc, ndesc, descindex, cipherhd);
	if (err)
	break;

	if (keyblock_out)
	{
	*keyblock_out = keyblock;
	break;
	}

	if (out_help)
	{
	/* We want to write PKA or DANE records. OUT_HELP has the
	* keyblock and we print a record for each uid to OUT. */
	const void *data;
	size_t datalen;

	iobuf_flush_temp (out_help);
	data = iobuf_get_temp_buffer (out_help);
	datalen = iobuf_get_temp_length (out_help);

	err = print_pka_or_dane_records (out,
	keyblock, pk, data, datalen,
	(options & EXPORT_PKA_FORMAT),
	(options & EXPORT_DANE_FORMAT));
	if (err)
	goto leave;

	iobuf_close (out_help);
	out_help = iobuf_temp ();
	}

	}
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	err = 0;

	leave:
	iobuf_cancel (out_help);
	gcry_cipher_close (cipherhd);
	xfree(desc);
	keydb_release (kdbhd);
	if (err \|\| !keyblock_out)
	release_kbnode( keyblock );
	if( !*any )
	log_info(_("WARNING: nothing exported\n"));
	return err;
	}




	static gpg_error_t
	key_to_sshblob (membuf_t mb, const char identifier, ...)
	{
	va_list arg_ptr;
	gpg_error_t err = 0;
	unsigned char nbuf[4];
	unsigned char *buf;
	size_t buflen;
	gcry_mpi_t a;

	ulongtobuf (nbuf, (ulong)strlen (identifier));
	put_membuf (mb, nbuf, 4);
	put_membuf_str (mb, identifier);
	if (!strncmp (identifier, "ecdsa-sha2-", 11))
	{
	ulongtobuf (nbuf, (ulong)strlen (identifier+11));
	put_membuf (mb, nbuf, 4);
	put_membuf_str (mb, identifier+11);
	}
	va_start (arg_ptr, identifier);
	while ((a = va_arg (arg_ptr, gcry_mpi_t)))
	{
	err = gcry_mpi_aprint (GCRYMPI_FMT_SSH, &buf, &buflen, a);
	if (err)
	break;
	if (!strcmp (identifier, "ssh-ed25519")
	&& buflen > 5 && buf[4] == 0x40)
	{
	/* We need to strip our 0x40 prefix. */
	put_membuf (mb, "\x00\x00\x00\x20", 4);
	put_membuf (mb, buf+5, buflen-5);
	}
	else
	put_membuf (mb, buf, buflen);
	gcry_free (buf);
	}
	va_end (arg_ptr);
	return err;
	}

	/* Export the key identified by USERID in the SSH public key format.
	The function exports the latest subkey with Authentication
	capability unless the '!' suffix is used to export a specific
	key. */
	gpg_error_t
	export_ssh_key (ctrl_t ctrl, const char *userid)
	{
	gpg_error_t err;
	kbnode_t keyblock = NULL;
	KEYDB_SEARCH_DESC desc;
	u32 latest_date;
	u32 curtime = make_timestamp ();
	kbnode_t latest_key, node;
	PKT_public_key *pk;
	const char *identifier;
	membuf_t mb;
	estream_t fp = NULL;
	struct b64state b64_state;
	const char *fname = "-";

	init_membuf (&mb, 4096);

	/* We need to know whether the key has been specified using the
	exact syntax ('!' suffix). Thus we need to run a
	classify_user_id on our own. */
	err = classify_user_id (userid, &desc, 1);

	/* Get the public key. */
	if (!err)
	{
	getkey_ctx_t getkeyctx;

	err = get_pubkey_byname (ctrl, &getkeyctx, NULL, userid, &keyblock,
	NULL,
	0 /* Only usable keys or given exact. */,
	1 /* No AKL lookup. */);
	if (!err)
	{
	err = getkey_next (getkeyctx, NULL, NULL);
	if (!err)
	err = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
	else if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY)
	err = 0;
	}
	getkey_end (getkeyctx);
	}
	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), userid, gpg_strerror (err));
	return err;
	}

	/* The finish_lookup code in getkey.c does not handle auth keys,
	thus we have to duplicate the code here to find the latest
	subkey. However, if the key has been found using an exact match
	('!' notation) we use that key without any further checks and
	even allow the use of the primary key. */
	latest_date = 0;
	latest_key = NULL;
	for (node = keyblock; node; node = node->next)
	{
	if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_KEY)
	&& node->pkt->pkt.public_key->flags.exact)
	{
	latest_key = node;
	break;
	}
	}
	if (!latest_key)
	{
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk = node->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tchecking subkey %08lX\n",
	(ulong) keyid_from_pk (pk, NULL));
	if (!(pk->pubkey_usage & PUBKEY_USAGE_AUTH))
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not usable for authentication\n");
	continue;
	}
	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not valid\n");
	continue;
	}
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has been revoked\n");
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has expired\n");
	continue;
	}
	if (pk->timestamp > curtime && !opt.ignore_valid_from)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not yet valid\n");
	continue;
	}
	if (DBG_LOOKUP)
	log_debug ("\tsubkey might be fine\n");
	/* In case a key has a timestamp of 0 set, we make sure that it
	is used. A better change would be to compare ">=" but that
	might also change the selected keys and is as such a more
	intrusive change. */
	if (pk->timestamp > latest_date \|\| (!pk->timestamp && !latest_date))
	{
	latest_date = pk->timestamp;
	latest_key = node;
	}
	}

	/* If no subkey was suitable check the primary key. */
	if (!latest_key
	&& (node = keyblock) && node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	pk = node->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tchecking primary key %08lX\n",
	(ulong) keyid_from_pk (pk, NULL));
	if (!(pk->pubkey_usage & PUBKEY_USAGE_AUTH))
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not usable for authentication\n");
	}
	else if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not valid\n");
	}
	else if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has been revoked\n");
	}
	else if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has expired\n");
	}
	else if (pk->timestamp > curtime && !opt.ignore_valid_from)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not yet valid\n");
	}
	else
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key is fine\n");
	latest_date = pk->timestamp;
	latest_key = node;
	}
	}
	}

	if (!latest_key)
	{
	err = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
	log_error (_("key \"%s\" not found: %s\n"), userid, gpg_strerror (err));
	goto leave;
	}

	pk = latest_key->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tusing key %08lX\n", (ulong) keyid_from_pk (pk, NULL));

	switch (pk->pubkey_algo)
	{
	case PUBKEY_ALGO_DSA:
	identifier = "ssh-dss";
	err = key_to_sshblob (&mb, identifier,
	pk->pkey[0], pk->pkey[1], pk->pkey[2], pk->pkey[3],
	NULL);
	break;

	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_S:
	identifier = "ssh-rsa";
	err = key_to_sshblob (&mb, identifier, pk->pkey[1], pk->pkey[0], NULL);
	break;

	case PUBKEY_ALGO_ECDSA:
	{
	char *curveoid;
	const char *curve;

	curveoid = openpgp_oid_to_str (pk->pkey[0]);
	if (!curveoid)
	err = gpg_error_from_syserror ();
	else if (!(curve = openpgp_oid_to_curve (curveoid, 0)))
	err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
	else
	{
	if (!strcmp (curve, "nistp256"))
	identifier = "ecdsa-sha2-nistp256";
	else if (!strcmp (curve, "nistp384"))
	identifier = "ecdsa-sha2-nistp384";
	else if (!strcmp (curve, "nistp521"))
	identifier = "ecdsa-sha2-nistp521";
	else
	identifier = NULL;

	if (!identifier)
	err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
	else
	err = key_to_sshblob (&mb, identifier, pk->pkey[1], NULL);
	}
	xfree (curveoid);
	}
	break;

	case PUBKEY_ALGO_EDDSA:
	if (!openpgp_oid_is_ed25519 (pk->pkey[0]))
	err = gpg_error (GPG_ERR_UNKNOWN_CURVE);
	else
	{
	identifier = "ssh-ed25519";
	err = key_to_sshblob (&mb, identifier, pk->pkey[1], NULL);
	}
	break;

	case PUBKEY_ALGO_ELGAMAL_E:
	case PUBKEY_ALGO_ELGAMAL:
	err = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
	break;

	default:
	err = GPG_ERR_PUBKEY_ALGO;
	break;
	}

	if (err)
	goto leave;

	if (opt.outfile && *opt.outfile && strcmp (opt.outfile, "-"))
	fp = es_fopen ((fname = opt.outfile), "w");
	else
	fp = es_stdout;
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("error creating '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}

	es_fprintf (fp, "%s ", identifier);
	err = b64enc_start_es (&b64_state, fp, "");
	if (err)
	goto leave;
	{
	void *blob;
	size_t bloblen;

	blob = get_membuf (&mb, &bloblen);
	if (!blob)
	err = gpg_error_from_syserror ();
	else
	err = b64enc_write (&b64_state, blob, bloblen);
	xfree (blob);
	if (err)
	goto leave;
	}
	err = b64enc_finish (&b64_state);
	if (err)
	goto leave;
	es_fprintf (fp, " openpgp:0x%08lX\n", (ulong)keyid_from_pk (pk, NULL));

	if (es_ferror (fp))
	err = gpg_error_from_syserror ();
	else
	{
	if (es_fclose (fp))
	err = gpg_error_from_syserror ();
	fp = NULL;
	}

	if (err)
	log_error (_("error writing '%s': %s\n"), fname, gpg_strerror (err));

	leave:
	es_fclose (fp);
	xfree (get_membuf (&mb, NULL));
	release_kbnode (keyblock);
	return err;
	}
	diff --git a/g10/getkey.c b/g10/getkey.c
	index e39de28ae..163ab8014 100644
	--- a/g10/getkey.c
	+++ b/g10/getkey.c
	@@ -1,4259 +1,4259 @@
	/* getkey.c - Get a key from the database
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007, 2008, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "iobuf.h"
	#include "keydb.h"
	#include "options.h"
	#include "main.h"
	#include "trustdb.h"
	#include "i18n.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "host2net.h"
	#include "mbox-util.h"
	#include "status.h"

	#define MAX_PK_CACHE_ENTRIES PK_UID_CACHE_SIZE
	#define MAX_UID_CACHE_ENTRIES PK_UID_CACHE_SIZE

	#if MAX_PK_CACHE_ENTRIES < 2
	#error We need the cache for key creation
	#endif

	/* Flags values returned by the lookup code. Note that the values are
	* directly used by the KEY_CONSIDERED status line. */
	#define LOOKUP_NOT_SELECTED (1<<0)
	#define LOOKUP_ALL_SUBKEYS_EXPIRED (1<<1) /* or revoked */


	/* A context object used by the lookup functions. */
	struct getkey_ctx_s
	{
	/* Part of the search criteria: whether the search is an exact
	search or not. A search that is exact requires that a key or
	subkey meet all of the specified criteria. A search that is not
	exact allows selecting a different key or subkey from the
	keyblock that matched the critera. Further, an exact search
	returns the key or subkey that matched whereas a non-exact search
	typically returns the primary key. See finish_lookup for
	details. */
	int exact;

	/* Part of the search criteria: Whether the caller only wants keys
	with an available secret key. This is used by getkey_next to get
	the next result with the same initial criteria. */
	int want_secret;

	/* Part of the search criteria: The type of the requested key. A
	mask of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT.
	If non-zero, then for a key to match, it must implement one of
	the required uses. */
	int req_usage;

	/* The database handle. */
	KEYDB_HANDLE kr_handle;

	/* Whether we should call xfree() on the context when the context is
	released using getkey_end()). */
	int not_allocated;

	/* This variable is used as backing store for strings which have
	their address used in ITEMS. */
	strlist_t extra_list;

	/* Part of the search criteria: The low-level search specification
	as passed to keydb_search. */
	int nitems;
	/* This must be the last element in the structure. When we allocate
	the structure, we allocate it so that ITEMS can hold NITEMS. */
	KEYDB_SEARCH_DESC items[1];
	};

	#if 0
	static struct
	{
	int any;
	int okay_count;
	int nokey_count;
	int error_count;
	} lkup_stats[21];
	#endif

	typedef struct keyid_list
	{
	struct keyid_list *next;
	char fpr[MAX_FINGERPRINT_LEN];
	u32 keyid[2];
	} *keyid_list_t;


	#if MAX_PK_CACHE_ENTRIES
	typedef struct pk_cache_entry
	{
	struct pk_cache_entry *next;
	u32 keyid[2];
	PKT_public_key *pk;
	} *pk_cache_entry_t;
	static pk_cache_entry_t pk_cache;
	static int pk_cache_entries; /* Number of entries in pk cache. */
	static int pk_cache_disabled;
	#endif

	#if MAX_UID_CACHE_ENTRIES < 5
	#error we really need the userid cache
	#endif
	typedef struct user_id_db
	{
	struct user_id_db *next;
	keyid_list_t keyids;
	int len;
	char name[1];
	} *user_id_db_t;
	static user_id_db_t user_id_db;
	static int uid_cache_entries; /* Number of entries in uid cache. */

	static void merge_selfsigs (kbnode_t keyblock);
	static int lookup (getkey_ctx_t ctx,
	kbnode_t ret_keyblock, kbnode_t ret_found_key,
	int want_secret);
	static kbnode_t finish_lookup (kbnode_t keyblock,
	unsigned int req_usage, int want_exact,
	unsigned int *r_flags);
	static void print_status_key_considered (kbnode_t keyblock, unsigned int flags);


	#if 0
	static void
	print_stats ()
	{
	int i;
	for (i = 0; i < DIM (lkup_stats); i++)
	{
	if (lkup_stats[i].any)
	es_fprintf (es_stderr,
	"lookup stats: mode=%-2d ok=%-6d nokey=%-6d err=%-6d\n",
	i,
	lkup_stats[i].okay_count,
	lkup_stats[i].nokey_count, lkup_stats[i].error_count);
	}
	}
	#endif


	/* Cache a copy of a public key in the public key cache. PK is not
	* cached if caching is disabled (via getkey_disable_caches), if
	* PK->FLAGS.DONT_CACHE is set, we don't know how to derive a key id
	* from the public key (e.g., unsupported algorithm), or a key with
	* the key id is already in the cache.
	*
	* The public key packet is copied into the cache using
	* copy_public_key. Thus, any secret parts are not copied, for
	* instance.
	*
	* This cache is filled by get_pubkey and is read by get_pubkey and
	* get_pubkey_fast. */
	void
	cache_public_key (PKT_public_key * pk)
	{
	#if MAX_PK_CACHE_ENTRIES
	pk_cache_entry_t ce, ce2;
	u32 keyid[2];

	if (pk_cache_disabled)
	return;

	if (pk->flags.dont_cache)
	return;

	if (is_ELGAMAL (pk->pubkey_algo)
	\|\| pk->pubkey_algo == PUBKEY_ALGO_DSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_EDDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| is_RSA (pk->pubkey_algo))
	{
	keyid_from_pk (pk, keyid);
	}
	else
	return; /* Don't know how to get the keyid. */

	for (ce = pk_cache; ce; ce = ce->next)
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	{
	if (DBG_CACHE)
	log_debug ("cache_public_key: already in cache\n");
	return;
	}

	if (pk_cache_entries >= MAX_PK_CACHE_ENTRIES)
	{
	int n;

	/* Remove the last 50% of the entries. */
	for (ce = pk_cache, n = 0; ce && n < pk_cache_entries/2; n++)
	ce = ce->next;
	if (ce && ce != pk_cache && ce->next)
	{
	ce2 = ce->next;
	ce->next = NULL;
	ce = ce2;
	for (; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	pk_cache_entries--;
	}
	}
	log_assert (pk_cache_entries < MAX_PK_CACHE_ENTRIES);
	}
	pk_cache_entries++;
	ce = xmalloc (sizeof *ce);
	ce->next = pk_cache;
	pk_cache = ce;
	ce->pk = copy_public_key (NULL, pk);
	ce->keyid[0] = keyid[0];
	ce->keyid[1] = keyid[1];
	#endif
	}


	/* Return a const utf-8 string with the text "[User ID not found]".
	This function is required so that we don't need to switch gettext's
	encoding temporary. */
	static const char *
	user_id_not_found_utf8 (void)
	{
	static char *text;

	if (!text)
	text = native_to_utf8 (_("[User ID not found]"));
	return text;
	}



	/* Return the user ID from the given keyblock.
	* We use the primary uid flag which has been set by the merge_selfsigs
	* function. The returned value is only valid as long as the given
	* keyblock is not changed. */
	static const char *
	get_primary_uid (KBNODE keyblock, size_t * uidlen)
	{
	KBNODE k;
	const char *s;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data
	&& k->pkt->pkt.user_id->is_primary)
	{
	*uidlen = k->pkt->pkt.user_id->len;
	return k->pkt->pkt.user_id->name;
	}
	}
	s = user_id_not_found_utf8 ();
	*uidlen = strlen (s);
	return s;
	}


	static void
	release_keyid_list (keyid_list_t k)
	{
	while (k)
	{
	keyid_list_t k2 = k->next;
	xfree (k);
	k = k2;
	}
	}

	/****************
	* Store the association of keyid and userid
	* Feed only public keys to this function.
	*/
	static void
	cache_user_id (KBNODE keyblock)
	{
	user_id_db_t r;
	const char *uid;
	size_t uidlen;
	keyid_list_t keyids = NULL;
	KBNODE k;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	keyid_list_t a = xmalloc_clear (sizeof *a);
	/* Hmmm: For a long list of keyids it might be an advantage
	* to append the keys. */
	fingerprint_from_pk (k->pkt->pkt.public_key, a->fpr, NULL);
	keyid_from_pk (k->pkt->pkt.public_key, a->keyid);
	/* First check for duplicates. */
	for (r = user_id_db; r; r = r->next)
	{
	keyid_list_t b;

	for (b = r->keyids; b; b = b->next)
	{
	if (!memcmp (b->fpr, a->fpr, MAX_FINGERPRINT_LEN))
	{
	if (DBG_CACHE)
	log_debug ("cache_user_id: already in cache\n");
	release_keyid_list (keyids);
	xfree (a);
	return;
	}
	}
	}
	/* Now put it into the cache. */
	a->next = keyids;
	keyids = a;
	}
	}
	if (!keyids)
	BUG (); /* No key no fun. */


	uid = get_primary_uid (keyblock, &uidlen);

	if (uid_cache_entries >= MAX_UID_CACHE_ENTRIES)
	{
	/* fixme: use another algorithm to free some cache slots */
	r = user_id_db;
	user_id_db = r->next;
	release_keyid_list (r->keyids);
	xfree (r);
	uid_cache_entries--;
	}
	r = xmalloc (sizeof *r + uidlen - 1);
	r->keyids = keyids;
	r->len = uidlen;
	memcpy (r->name, uid, r->len);
	r->next = user_id_db;
	user_id_db = r;
	uid_cache_entries++;
	}


	/* Disable and drop the public key cache (which is filled by
	cache_public_key and get_pubkey). Note: there is currently no way
	to reenable this cache. */
	void
	getkey_disable_caches ()
	{
	#if MAX_PK_CACHE_ENTRIES
	{
	pk_cache_entry_t ce, ce2;

	for (ce = pk_cache; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	}
	pk_cache_disabled = 1;
	pk_cache_entries = 0;
	pk_cache = NULL;
	}
	#endif
	/* fixme: disable user id cache ? */
	}


	void
	pubkey_free (pubkey_t key)
	{
	if (key)
	{
	xfree (key->pk);
	release_kbnode (key->keyblock);
	xfree (key);
	}
	}

	void
	pubkeys_free (pubkey_t keys)
	{
	while (keys)
	{
	pubkey_t next = keys->next;
	pubkey_free (keys);
	keys = next;
	}
	}

	/* Returns all keys that match the search specfication SEARCH_TERMS.

	This function also checks for and warns about duplicate entries in
	the keydb, which can occur if the user has configured multiple
	keyrings or keyboxes or if a keyring or keybox was corrupted.

	Note: SEARCH_TERMS will not be expanded (i.e., it may not be a
	group).

	USE is the operation for which the key is required. It must be
	either PUBKEY_USAGE_ENC, PUBKEY_USAGE_SIG, PUBKEY_USAGE_CERT or
	PUBKEY_USAGE_AUTH.

	XXX: Currently, only PUBKEY_USAGE_ENC and PUBKEY_USAGE_SIG are
	implemented.

	INCLUDE_UNUSABLE indicates whether disabled keys are allowed.
	(Recipients specified with --encrypt-to and --hidden-encrypt-to may
	be disabled. It is possible to edit disabled keys.)

	SOURCE is the context in which SEARCH_TERMS was specified, e.g.,
	"--encrypt-to", etc. If this function is called interactively,
	then this should be NULL.

	If WARN_POSSIBLY_AMBIGUOUS is set, then emits a warning if the user
	does not specify a long key id or a fingerprint.

	The results are placed in KEYS. KEYS must be NULL! */
	gpg_error_t
	get_pubkeys (ctrl_t ctrl,
	char search_terms, int use, int include_unusable, char source,
	int warn_possibly_ambiguous,
	pubkey_t *r_keys)
	{
	/* We show a warning when a key appears multiple times in the DB.
	This can happen for two reasons:

	- The user has configured multiple keyrings or keyboxes.

	- The keyring or keybox has been corrupted in some way, e.g., a
	bug or a random process changing them.

	For each duplicate, we only want to show the key once. Hence,
	this list. */
	static strlist_t key_dups;

	/* USE transformed to a string. */
	char *use_str;

	gpg_error_t err;

	KEYDB_SEARCH_DESC desc;

	GETKEY_CTX ctx;
	pubkey_t results = NULL;
	pubkey_t r;

	int count;

	char fingerprint[2 * MAX_FINGERPRINT_LEN + 1];

	if (DBG_LOOKUP)
	{
	log_debug ("\n");
	log_debug ("%s: Checking %s=%s\n",
	__func__, source ? source : "user input", search_terms);
	}

	if (*r_keys)
	log_bug ("%s: KEYS should be NULL!\n", __func__);

	switch (use)
	{
	case PUBKEY_USAGE_ENC: use_str = "encrypt"; break;
	case PUBKEY_USAGE_SIG: use_str = "sign"; break;
	case PUBKEY_USAGE_CERT: use_str = "cetify"; break;
	case PUBKEY_USAGE_AUTH: use_str = "authentication"; break;
	default: log_bug ("%s: Bad value for USE (%d)\n", __func__, use);
	}

	if (use == PUBKEY_USAGE_CERT \|\| use == PUBKEY_USAGE_AUTH)
	log_bug ("%s: use=%s is unimplemented.\n", __func__, use_str);

	err = classify_user_id (search_terms, &desc, 1);
	if (err)
	{
	log_info (_("key \"%s\" not found: %s\n"),
	search_terms, gpg_strerror (err));
	if (!opt.quiet && source)
	log_info (_("(check argument of option '%s')\n"), source);
	goto out;
	}

	if (warn_possibly_ambiguous
	&& ! (desc.mode == KEYDB_SEARCH_MODE_LONG_KID
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR16
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR20
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR))
	{
	log_info (_("Warning: '%s' should be a long key ID or a fingerprint\n"),
	search_terms);
	if (!opt.quiet && source)
	log_info (_("(check argument of option '%s')\n"), source);
	}

	/* Gather all of the results. */
	ctx = NULL;
	count = 0;
	do
	{
	PKT_public_key pk = xmalloc_clear (sizeof pk);
	KBNODE kb;
	pk->req_usage = use;

	if (! ctx)
	err = get_pubkey_byname (ctrl, &ctx, pk, search_terms, &kb, NULL,
	include_unusable, 1);
	else
	err = getkey_next (ctx, pk, &kb);

	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	/* No more results. */
	{
	xfree (pk);
	break;
	}
	else if (err)
	/* An error (other than "not found"). */
	{
	log_error (_("error looking up: %s\n"),
	gpg_strerror (err));
	xfree (pk);
	break;
	}

	/* Another result! */
	count ++;

	r = xmalloc_clear (sizeof (*r));
	r->pk = pk;
	r->keyblock = kb;
	r->next = results;
	results = r;
	}
	while (ctx);
	getkey_end (ctx);

	if (DBG_LOOKUP)
	{
	log_debug ("%s resulted in %d matches.\n", search_terms, count);
	for (r = results; r; r = r->next)
	log_debug (" %s\n",
	hexfingerprint (r->keyblock->pkt->pkt.public_key,
	fingerprint, sizeof (fingerprint)));
	}

	if (! results && gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	/* No match. */
	{
	if (DBG_LOOKUP)
	log_debug ("%s: '%s' not found.\n", __func__, search_terms);

	log_info (_("key \"%s\" not found\n"), search_terms);
	if (!opt.quiet && source)
	log_info (_("(check argument of option '%s')\n"), source);

	goto out;
	}
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	/* No more matches. */
	;
	else if (err)
	/* Some other error. An error message was already printed
	out. Free RESULTS and continue. */
	goto out;

	/* Check for duplicates. */
	if (DBG_LOOKUP)
	log_debug ("%s: Checking results of %s='%s' for dups\n",
	__func__, source ? source : "user input", search_terms);
	count = 0;
	for (r = results; r; r = r->next)
	{
	pubkey_t *prevp;
	pubkey_t next;
	pubkey_t r2;
	int dups = 0;

	prevp = &r->next;
	next = r->next;
	while ((r2 = next))
	{
	if (cmp_public_keys (r->keyblock->pkt->pkt.public_key,
	r2->keyblock->pkt->pkt.public_key) != 0)
	/* Not a dup. */
	{
	prevp = &r2->next;
	next = r2->next;
	continue;
	}

	dups ++;
	count ++;

	/* Remove R2 from the list. */
	*prevp = r2->next;
	release_kbnode (r2->keyblock);
	next = r2->next;
	xfree (r2);
	}

	if (dups)
	{
	hexfingerprint (r->keyblock->pkt->pkt.public_key,
	fingerprint, sizeof fingerprint);
	if (! strlist_find (key_dups, fingerprint))
	{
	char fingerprint_formatted[MAX_FORMATTED_FINGERPRINT_LEN + 1];

	log_info (_("Warning: %s appears in the keyring %d times\n"),
	format_hexfingerprint (fingerprint,
	fingerprint_formatted,
	sizeof fingerprint_formatted),
	1 + dups);
	add_to_strlist (&key_dups, fingerprint);
	}
	}
	}

	if (DBG_LOOKUP && count)
	{
	log_debug ("After removing %d dups:\n", count);
	for (r = results, count = 0; r; r = r->next)
	log_debug (" %d: %s\n",
	count,
	hexfingerprint (r->keyblock->pkt->pkt.public_key,
	fingerprint, sizeof fingerprint));
	}

	out:
	if (err)
	pubkeys_free (results);
	else
	*r_keys = results;

	return err;
	}


	static void
	pk_from_block (PKT_public_key *pk, kbnode_t keyblock, kbnode_t found_key)
	{
	kbnode_t a = found_key ? found_key : keyblock;

	log_assert (a->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| a->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	copy_public_key (pk, a->pkt->pkt.public_key);
	}


	/* Return the public key with the key id KEYID and store it at PK.
	* The resources in *PK should be released using
	* release_public_key_parts(). This function also stores a copy of
	* the public key in the user id cache (see cache_public_key).
	*
	* If PK is NULL, this function just stores the public key in the
	* cache and returns the usual return code.
	*
	* PK->REQ_USAGE (which is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT) is passed through to the
	* lookup function. If this is non-zero, only keys with the specified
	* usage will be returned. As such, it is essential that
	* PK->REQ_USAGE be correctly initialized!
	*
	* Returns 0 on success, GPG_ERR_NO_PUBKEY if there is no public key
	* with the specified key id, or another error code if an error
	* occurs.
	*
	* If the data was not read from the cache, then the self-signed data
	* has definitely been merged into the public key using
	* merge_selfsigs. */
	int
	get_pubkey (PKT_public_key * pk, u32 * keyid)
	{
	int internal = 0;
	int rc = 0;

	#if MAX_PK_CACHE_ENTRIES
	if (pk)
	{
	/* Try to get it from the cache. We don't do this when pk is
	NULL as it does not guarantee that the user IDs are
	cached. */
	pk_cache_entry_t ce;
	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	/* XXX: We don't check PK->REQ_USAGE here, but if we don't
	read from the cache, we do check it! */
	{
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif
	/* More init stuff. */
	if (!pk)
	{
	pk = xmalloc_clear (sizeof *pk);
	internal++;
	}


	/* Do a lookup. */
	{
	struct getkey_ctx_s ctx;
	KBNODE kb = NULL;
	KBNODE found_key = NULL;
	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	rc = lookup (&ctx, &kb, &found_key, 0);
	if (!rc)
	{
	pk_from_block (pk, kb, found_key);
	}
	getkey_end (&ctx);
	release_kbnode (kb);
	}
	if (!rc)
	goto leave;

	rc = GPG_ERR_NO_PUBKEY;

	leave:
	if (!rc)
	cache_public_key (pk);
	if (internal)
	free_public_key (pk);
	return rc;
	}


	/* Similar to get_pubkey, but it does not take PK->REQ_USAGE into
	* account nor does it merge in the self-signed data. This function
	* also only considers primary keys. It is intended to be used as a
	* quick check of the key to avoid recursion. It should only be used
	* in very certain cases. Like get_pubkey and unlike any of the other
	* lookup functions, this function also consults the user id cache
	* (see cache_public_key).
	*
	* Return the public key in PK. The resources in PK should be
	* released using release_public_key_parts(). */
	int
	get_pubkey_fast (PKT_public_key * pk, u32 * keyid)
	{
	int rc = 0;
	KEYDB_HANDLE hd;
	KBNODE keyblock;
	u32 pkid[2];

	log_assert (pk);
	#if MAX_PK_CACHE_ENTRIES
	{
	/* Try to get it from the cache */
	pk_cache_entry_t ce;

	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1]
	/* Only consider primary keys. */
	&& ce->pk->keyid[0] == ce->pk->main_keyid[0]
	&& ce->pk->keyid[1] == ce->pk->main_keyid[1])
	{
	if (pk)
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif

	hd = keydb_new ();
	if (!hd)
	return gpg_error_from_syserror ();
	rc = keydb_search_kid (hd, keyid);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	{
	keydb_release (hd);
	return GPG_ERR_NO_PUBKEY;
	}
	rc = keydb_get_keyblock (hd, &keyblock);
	keydb_release (hd);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	return GPG_ERR_NO_PUBKEY;
	}

	log_assert (keyblock && keyblock->pkt
	&& keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* We return the primary key. If KEYID matched a subkey, then we
	return an error. */
	keyid_from_pk (keyblock->pkt->pkt.public_key, pkid);
	if (keyid[0] == pkid[0] && keyid[1] == pkid[1])
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	else
	rc = GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	return rc;
	}


	/* Return the key block for the key with key id KEYID or NULL, if an
	* error occurs. Use release_kbnode() to release the key block.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	kbnode_t
	get_pubkeyblock (u32 * keyid)
	{
	struct getkey_ctx_s ctx;
	int rc = 0;
	KBNODE keyblock = NULL;

	memset (&ctx, 0, sizeof ctx);
	/* No need to set exact here because we want the entire block. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return NULL;
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	rc = lookup (&ctx, &keyblock, NULL, 0);
	getkey_end (&ctx);

	return rc ? NULL : keyblock;
	}


	/* Return the public key with the key id KEYID iff the secret key is
	* available and store it at PK. The resources should be released
	* using release_public_key_parts().
	*
	* Unlike other lookup functions, PK may not be NULL. PK->REQ_USAGE
	* is passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. Thus, it
	* must be valid! If this is non-zero, only keys with the specified
	* usage will be returned.
	*
	* Returns 0 on success. If a public key with the specified key id is
	* not found or a secret key is not available for that public key, an
	* error code is returned. Note: this function ignores legacy keys.
	* An error code is also return if an error occurs.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	get_seckey (PKT_public_key pk, u32 keyid)
	{
	gpg_error_t err;
	struct getkey_ctx_s ctx;
	kbnode_t keyblock = NULL;
	kbnode_t found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	err = lookup (&ctx, &keyblock, &found_key, 1);
	if (!err)
	{
	pk_from_block (pk, keyblock, found_key);
	}
	getkey_end (&ctx);
	release_kbnode (keyblock);

	if (!err)
	{
	err = agent_probe_secret_key (/ctrl/NULL, pk);
	if (err)
	release_public_key_parts (pk);
	}

	return err;
	}


	/* Skip unusable keys. A key is unusable if it is revoked, expired or
	disabled or if the selected user id is revoked or expired. */
	static int
	skip_unusable (void dummy, u32 keyid, int uid_no)
	{
	int unusable = 0;
	KBNODE keyblock;
	PKT_public_key *pk;

	(void) dummy;

	keyblock = get_pubkeyblock (keyid);
	if (!keyblock)
	{
	log_error ("error checking usability status of %s\n", keystr (keyid));
	goto leave;
	}

	pk = keyblock->pkt->pkt.public_key;

	/* Is the key revoked or expired? */
	if (pk->flags.revoked \|\| pk->has_expired)
	unusable = 1;

	/* Is the user ID in question revoked or expired? */
	if (!unusable && uid_no)
	{
	KBNODE node;
	int uids_seen = 0;

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *user_id = node->pkt->pkt.user_id;

	uids_seen ++;
	if (uids_seen != uid_no)
	continue;

	if (user_id->is_revoked \|\| user_id->is_expired)
	unusable = 1;

	break;
	}
	}

	/* If UID_NO is non-zero, then the keyblock better have at least
	that many UIDs. */
	log_assert (uids_seen == uid_no);
	}

	if (!unusable)
	unusable = pk_is_disabled (pk);

	leave:
	release_kbnode (keyblock);
	return unusable;
	}


	/* Search for keys matching some criteria.

	If RETCTX is not NULL, then the constructed context is returned in
	*RETCTX so that getpubkey_next can be used to get subsequent
	results. In this case, getkey_end() must be used to free the
	search context. If RETCTX is not NULL, then RET_KDBHD must be
	NULL.

	If NAMELIST is not NULL, then a search query is constructed using
	classify_user_id on each of the strings in the list. (Recall: the
	database does an OR of the terms, not an AND.) If NAMELIST is
	NULL, then all results are returned.

	If PK is not NULL, the public key of the first result is returned
	in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	set, it is used to filter the search results. See the
	documentation for finish_lookup to understand exactly how this is
	used. Note: The self-signed data has already been merged into the
	public key using merge_selfsigs. Free *PK by calling
	release_public_key_parts (or, if PK was allocated using xfree, you
	can use free_public_key, which calls release_public_key_parts(PK)
	and then xfree(PK)).

	If WANT_SECRET is set, then only keys with an available secret key
	(either locally or via key registered on a smartcard) are returned.

	If INCLUDE_UNUSABLE is set, then unusable keys (see the
	documentation for skip_unusable for an exact definition) are
	skipped unless they are looked up by key id or by fingerprint.

	If RET_KB is not NULL, the keyblock is returned in *RET_KB. This
	should be freed using release_kbnode().

	If RET_KDBHD is not NULL, then the new database handle used to
	conduct the search is returned in *RET_KDBHD. This can be used to
	get subsequent results using keydb_search_next. Note: in this
	case, no advanced filtering is done for subsequent results (e.g.,
	WANT_SECRET and PK->REQ_USAGE are not respected).

	This function returns 0 on success. Otherwise, an error code is
	returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	(if want_secret is set) is returned if the key is not found. */
	static int
	key_byname (GETKEY_CTX *retctx, strlist_t namelist,
	PKT_public_key *pk,
	int want_secret, int include_unusable,
	KBNODE * ret_kb, KEYDB_HANDLE * ret_kdbhd)
	{
	int rc = 0;
	int n;
	strlist_t r;
	GETKEY_CTX ctx;
	KBNODE help_kb = NULL;
	KBNODE found_key = NULL;

	if (retctx)
	{
	/* Reset the returned context in case of error. */
	log_assert (!ret_kdbhd); /* Not allowed because the handle is stored
	in the context. */
	*retctx = NULL;
	}
	if (ret_kdbhd)
	*ret_kdbhd = NULL;

	if (!namelist)
	/* No search terms: iterate over the whole DB. */
	{
	ctx = xmalloc_clear (sizeof *ctx);
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_FIRST;
	if (!include_unusable)
	ctx->items[0].skipfnc = skip_unusable;
	}
	else
	{
	/* Build the search context. */
	for (n = 0, r = namelist; r; r = r->next)
	n++;

	/* CTX has space for a single search term at the end. Thus, we
	need to allocate sizeof *CTX plus (n - 1) sizeof
	CTX->ITEMS. */
	ctx = xmalloc_clear (sizeof ctx + (n - 1) sizeof ctx->items);
	ctx->nitems = n;

	for (n = 0, r = namelist; r; r = r->next, n++)
	{
	gpg_error_t err;

	err = classify_user_id (r->d, &ctx->items[n], 1);

	if (ctx->items[n].exact)
	ctx->exact = 1;
	if (err)
	{
	xfree (ctx);
	return gpg_err_code (err); /* FIXME: remove gpg_err_code. */
	}
	if (!include_unusable
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_SHORT_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_LONG_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR16
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR20
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR)
	ctx->items[n].skipfnc = skip_unusable;
	}
	}

	ctx->want_secret = want_secret;
	ctx->kr_handle = keydb_new ();
	if (!ctx->kr_handle)
	{
	rc = gpg_error_from_syserror ();
	getkey_end (ctx);
	return rc;
	}

	if (!ret_kb)
	ret_kb = &help_kb;

	if (pk)
	{
	ctx->req_usage = pk->req_usage;
	}

	rc = lookup (ctx, ret_kb, &found_key, want_secret);
	if (!rc && pk)
	{
	pk_from_block (pk, *ret_kb, found_key);
	}

	release_kbnode (help_kb);

	if (retctx) /* Caller wants the context. */
	*retctx = ctx;
	else
	{
	if (ret_kdbhd)
	{
	*ret_kdbhd = ctx->kr_handle;
	ctx->kr_handle = NULL;
	}
	getkey_end (ctx);
	}

	return rc;
	}


	/* Find a public key identified by NAME.
	*
	- * If name appears to be a valid valid RFC822 mailbox (i.e., email
	+ * If name appears to be a valid RFC822 mailbox (i.e., email
	* address) and auto key lookup is enabled (no_akl == 0), then the
	* specified auto key lookup methods (--auto-key-lookup) are used to
	* import the key into the local keyring. Otherwise, just the local
	* keyring is consulted.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! PK->REQ_USAGE is
	* passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this
	* is non-zero, only keys with the specified usage will be returned.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* NAME is a string, which is turned into a search query using
	* classify_user_id.
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* If RET_KDBHD is not NULL, then the new database handle used to
	* conduct the search is returned in *RET_KDBHD. This can be used to
	* get subsequent results using keydb_search_next or to modify the
	* returned record. Note: in this case, no advanced filtering is done
	* for subsequent results (e.g., PK->REQ_USAGE is not respected).
	* Unlike RETCTX, this is always returned.
	*
	* If INCLUDE_UNUSABLE is set, then unusable keys (see the
	* documentation for skip_unusable for an exact definition) are
	* skipped unless they are looked up by key id or by fingerprint.
	*
	* If NO_AKL is set, then the auto key locate functionality is
	* disabled and only the local key ring is considered. Note: the
	* local key ring is consulted even if local is not in the
	* --auto-key-locate option list!
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	int
	get_pubkey_byname (ctrl_t ctrl, GETKEY_CTX * retctx, PKT_public_key * pk,
	const char name, KBNODE ret_keyblock,
	KEYDB_HANDLE * ret_kdbhd, int include_unusable, int no_akl)
	{
	int rc;
	strlist_t namelist = NULL;
	struct akl *akl;
	int is_mbox;
	int nodefault = 0;
	int anylocalfirst = 0;

	/* If RETCTX is not NULL, then RET_KDBHD must be NULL. */
	log_assert (retctx == NULL \|\| ret_kdbhd == NULL);

	if (retctx)
	*retctx = NULL;

	/* Does NAME appear to be a mailbox (mail address)? */
	is_mbox = is_valid_mailbox (name);

	/* The auto-key-locate feature works as follows: there are a number
	* of methods to look up keys. By default, the local keyring is
	* tried first. Then, each method listed in the --auto-key-locate is
	* tried in the order it appears.
	*
	* This can be changed as follows:
	*
	* - if nodefault appears anywhere in the list of options, then
	* the local keyring is not tried first, or,
	*
	* - if local appears anywhere in the list of options, then the
	* local keyring is not tried first, but in the order in which
	* it was listed in the --auto-key-locate option.
	*
	* Note: we only save the search context in RETCTX if the local
	* method is the first method tried (either explicitly or
	* implicitly). */
	if (!no_akl)
	{
	/* auto-key-locate is enabled. */

	/* nodefault is true if "nodefault" or "local" appear. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_NODEFAULT \|\| akl->type == AKL_LOCAL)
	{
	nodefault = 1;
	break;
	}
	/* anylocalfirst is true if "local" appears before any other
	search methods (except "nodefault"). */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type != AKL_NODEFAULT)
	{
	if (akl->type == AKL_LOCAL)
	anylocalfirst = 1;
	break;
	}
	}

	if (!nodefault)
	{
	/* "nodefault" didn't occur. Thus, "local" is implicitly the
	* first method to try. */
	anylocalfirst = 1;
	}

	if (nodefault && is_mbox)
	{
	/* Either "nodefault" or "local" (explicitly) appeared in the
	* auto key locate list and NAME appears to be an email address.
	* Don't try the local keyring. */
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	/* Either "nodefault" and "local" don't appear in the auto key
	* locate list (in which case we try the local keyring first) or
	* NAME does not appear to be an email address (in which case we
	* only try the local keyring). In this case, lookup NAME in
	* the local keyring. */
	add_to_strlist (&namelist, name);
	rc = key_byname (retctx, namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}

	/* If the requested name resembles a valid mailbox and automatic
	retrieval has been enabled, we try to import the key. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY && !no_akl && is_mbox)
	{
	/* NAME wasn't present in the local keyring (or we didn't try
	* the local keyring). Since the auto key locate feature is
	* enabled and NAME appears to be an email address, try the auto
	* locate feature. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	{
	unsigned char *fpr = NULL;
	size_t fpr_len;
	int did_akl_local = 0;
	int no_fingerprint = 0;
	const char *mechanism = "?";

	switch (akl->type)
	{
	case AKL_NODEFAULT:
	/* This is a dummy mechanism. */
	mechanism = "None";
	rc = GPG_ERR_NO_PUBKEY;
	break;

	case AKL_LOCAL:
	mechanism = "Local";
	did_akl_local = 1;
	if (retctx)
	{
	getkey_end (*retctx);
	*retctx = NULL;
	}
	add_to_strlist (&namelist, name);
	rc = key_byname (anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	break;

	case AKL_CERT:
	mechanism = "DNS CERT";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_PKA:
	mechanism = "PKA";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_pka (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_DANE:
	mechanism = "DANE";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 1, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_WKD:
	mechanism = "WKD";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_wkd (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_LDAP:
	mechanism = "LDAP";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_ldap (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_KEYSERVER:
	/* Strictly speaking, we don't need to only use a valid
	* mailbox for the getname search, but it helps cut down
	* on the problem of searching for something like "john"
	* and getting a whole lot of keys back. */
	if (keyserver_any_configured (ctrl))
	{
	mechanism = "keyserver";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_name (ctrl, name, &fpr, &fpr_len,
	opt.keyserver);
	glo_ctrl.in_auto_key_retrieve--;
	}
	else
	{
	mechanism = "Unconfigured keyserver";
	rc = GPG_ERR_NO_PUBKEY;
	}
	break;

	case AKL_SPEC:
	{
	struct keyserver_spec *keyserver;

	mechanism = akl->spec->uri;
	keyserver = keyserver_match (akl->spec);
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_name (ctrl,
	name, &fpr, &fpr_len, keyserver);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;
	}

	/* Use the fingerprint of the key that we actually fetched.
	* This helps prevent problems where the key that we fetched
	* doesn't have the same name that we used to fetch it. In
	* the case of CERT and PKA, this is an actual security
	* requirement as the URL might point to a key put in by an
	* attacker. By forcing the use of the fingerprint, we
	* won't use the attacker's key here. */
	if (!rc && fpr)
	{
	char fpr_string[MAX_FINGERPRINT_LEN * 2 + 1];

	log_assert (fpr_len <= MAX_FINGERPRINT_LEN);

	free_strlist (namelist);
	namelist = NULL;

	bin2hex (fpr, fpr_len, fpr_string);

	if (opt.verbose)
	log_info ("auto-key-locate found fingerprint %s\n",
	fpr_string);

	add_to_strlist (&namelist, fpr_string);
	}
	else if (!rc && !fpr && !did_akl_local)
	{ /* The acquisition method said no failure occurred, but
	* it didn't return a fingerprint. That's a failure. */
	no_fingerprint = 1;
	rc = GPG_ERR_NO_PUBKEY;
	}
	xfree (fpr);
	fpr = NULL;

	if (!rc && !did_akl_local)
	{ /* There was no error and we didn't do a local lookup.
	* This means that we imported a key into the local
	* keyring. Try to read the imported key from the
	* keyring. */
	if (retctx)
	{
	getkey_end (*retctx);
	*retctx = NULL;
	}
	rc = key_byname (anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}
	if (!rc)
	{
	/* Key found. */
	log_info (_("automatically retrieved '%s' via %s\n"),
	name, mechanism);
	break;
	}
	if (gpg_err_code (rc) != GPG_ERR_NO_PUBKEY
	\|\| opt.verbose \|\| no_fingerprint)
	log_info (_("error retrieving '%s' via %s: %s\n"),
	name, mechanism,
	no_fingerprint ? _("No fingerprint") : gpg_strerror (rc));
	}
	}


	if (rc && retctx)
	{
	getkey_end (*retctx);
	*retctx = NULL;
	}

	if (retctx && *retctx)
	{
	log_assert (!(*retctx)->extra_list);
	(*retctx)->extra_list = namelist;
	}
	else
	free_strlist (namelist);

	return rc;
	}




	/* Comparison machinery for get_best_pubkey_byname. */

	/* First we have a struct to cache computed information about the key
	* in question. */
	struct pubkey_cmp_cookie
	{
	int valid; /* Is this cookie valid? */
	PKT_public_key key; /* The key. */
	PKT_user_id uid; / The matching UID packet. */
	unsigned int validity; /* Computed validity of (KEY, UID). */
	u32 creation_time; /* Creation time of the newest subkey
	capable of encryption. */
	};


	/* Then we have a series of helper functions. */
	static int
	key_is_ok (const PKT_public_key *key)
	{
	return (! key->has_expired && ! key->flags.revoked
	&& key->flags.valid && ! key->flags.disabled);
	}


	static int
	uid_is_ok (const PKT_public_key key, const PKT_user_id uid)
	{
	return key_is_ok (key) && ! uid->is_revoked;
	}


	static int
	subkey_is_ok (const PKT_public_key *sub)
	{
	return ! sub->flags.revoked && sub->flags.valid && ! sub->flags.disabled;
	}


	/* Finally this function compares a NEW key to the former candidate
	* OLD. Returns < 0 if the old key is worse, > 0 if the old key is
	* better, == 0 if it is a tie. */
	static int
	pubkey_cmp (ctrl_t ctrl, const char name, struct pubkey_cmp_cookie old,
	struct pubkey_cmp_cookie *new, KBNODE new_keyblock)
	{
	kbnode_t n;

	new->creation_time = 0;
	for (n = find_next_kbnode (new_keyblock, PKT_PUBLIC_SUBKEY);
	n; n = find_next_kbnode (n, PKT_PUBLIC_SUBKEY))
	{
	PKT_public_key *sub = n->pkt->pkt.public_key;

	if ((sub->pubkey_usage & PUBKEY_USAGE_ENC) == 0)
	continue;

	if (! subkey_is_ok (sub))
	continue;

	if (sub->timestamp > new->creation_time)
	new->creation_time = sub->timestamp;
	}

	for (n = find_next_kbnode (new_keyblock, PKT_USER_ID);
	n; n = find_next_kbnode (n, PKT_USER_ID))
	{
	PKT_user_id *uid = n->pkt->pkt.user_id;
	char *mbox = mailbox_from_userid (uid->name);
	int match = mbox ? strcasecmp (name, mbox) == 0 : 0;

	xfree (mbox);
	if (! match)
	continue;

	new->uid = scopy_user_id (uid);
	new->validity =
	get_validity (ctrl, new_keyblock, &new->key, uid, NULL, 0) & TRUST_MASK;
	new->valid = 1;

	if (! old->valid)
	return -1; /* No OLD key. */

	if (! uid_is_ok (&old->key, old->uid) && uid_is_ok (&new->key, uid))
	return -1; /* Validity of the NEW key is better. */

	if (old->validity < new->validity)
	return -1; /* Validity of the NEW key is better. */

	if (old->validity == new->validity && uid_is_ok (&new->key, uid)
	&& old->creation_time < new->creation_time)
	return -1; /* Both keys are of the same validity, but the
	NEW key is newer. */
	}

	/* Stick with the OLD key. */
	return 1;
	}


	/* This function works like get_pubkey_byname, but if the name
	* resembles a mail address, the results are ranked and only the best
	* result is returned. */
	int
	get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX retctx, PKT_public_key pk,
	const char name, KBNODE ret_keyblock,
	int include_unusable, int no_akl)
	{
	int rc;
	struct getkey_ctx_s *ctx = NULL;

	if (retctx)
	*retctx = NULL;

	rc = get_pubkey_byname (ctrl, &ctx, pk, name, ret_keyblock,
	NULL, include_unusable, no_akl);
	if (rc)
	{
	if (ctx)
	getkey_end (ctx);
	return rc;
	}

	if (is_valid_mailbox (name) && ctx)
	{
	/* Rank results and return only the most relevant key. */
	struct pubkey_cmp_cookie best = { 0 }, new;
	KBNODE new_keyblock;
	while (getkey_next (ctx, &new.key, &new_keyblock) == 0)
	{
	int diff = pubkey_cmp (ctrl, name, &best, &new, new_keyblock);
	release_kbnode (new_keyblock);
	if (diff < 0)
	{
	/* New key is better. */
	release_public_key_parts (&best.key);
	free_user_id (best.uid);
	best = new;
	}
	else if (diff > 0)
	{
	/* Old key is better. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	else
	{
	/* A tie. Keep the old key. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	}
	getkey_end (ctx);
	ctx = NULL;
	free_user_id (best.uid);

	if (best.valid)
	{
	if (retctx \|\| ret_keyblock)
	{
	ctx = xtrycalloc (1, sizeof **retctx);
	if (! ctx)
	rc = gpg_error_from_syserror ();
	else
	{
	ctx->kr_handle = keydb_new ();
	if (! ctx->kr_handle)
	{
	xfree (ctx);
	*retctx = NULL;
	rc = gpg_error_from_syserror ();
	}
	else
	{
	u32 *keyid = pk_keyid (&best.key);
	ctx->exact = 1;
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx->items[0].u.kid[0] = keyid[0];
	ctx->items[0].u.kid[1] = keyid[1];

	if (ret_keyblock)
	{
	release_kbnode (*ret_keyblock);
	*ret_keyblock = NULL;
	rc = getkey_next (ctx, NULL, ret_keyblock);
	}
	}
	}
	}

	if (pk)
	*pk = best.key;
	else
	release_public_key_parts (&best.key);
	}
	}

	if (rc && ctx)
	{
	getkey_end (ctx);
	ctx = NULL;
	}

	if (retctx && ctx)
	*retctx = ctx;
	else
	getkey_end (ctx);

	return rc;
	}



	/* Get a public key from a file.
	*
	* PK is the buffer to store the key. The caller needs to make sure
	* that PK->REQ_USAGE is valid. PK->REQ_USAGE is passed through to
	* the lookup function and is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this is non-zero, only
	* keys with the specified usage will be returned.
	*
	* FNAME is the file name. That file should contain exactly one
	* keyblock.
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY is returned if the key
	* is not found.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. The caller must release the content of PK by
	* calling release_public_key_parts (or, if PK was malloced, using
	* free_public_key).
	*/
	gpg_error_t
	get_pubkey_fromfile (ctrl_t ctrl, PKT_public_key pk, const char fname)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	kbnode_t found_key;
	unsigned int infoflags;

	err = read_key_from_file (ctrl, fname, &keyblock);
	if (!err)
	{
	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. FIXME: Check whether this still holds. */
	merge_selfsigs (keyblock);
	found_key = finish_lookup (keyblock, pk->req_usage, 0, &infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	pk_from_block (pk, keyblock, found_key);
	else
	err = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
	}

	release_kbnode (keyblock);
	return err;
	}


	/* Lookup a key with the specified fingerprint.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: this function does an exact search and thus the
	* returned public key may be a subkey rather than the primary key.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If PK->REQ_USAGE is set, it is used to filter the search results.
	* (Thus, if PK is not NULL, PK->REQ_USAGE must be valid!!!) See the
	* documentation for finish_lookup to understand exactly how this is
	* used.
	*
	* If R_KEYBLOCK is not NULL, then the first result's keyblock is
	* returned in *R_KEYBLOCK. This should be freed using
	* release_kbnode().
	*
	* FPRINT is a byte array whose contents is the fingerprint to use as
	* the search term. FPRINT_LEN specifies the length of the
	* fingerprint (in bytes). Currently, only 16 and 20-byte
	* fingerprints are supported.
	*
	* FIXME: We should replace this with the _byname function. This can
	* be done by creating a userID conforming to the unified fingerprint
	* style. */
	int
	get_pubkey_byfprint (PKT_public_key pk, kbnode_t r_keyblock,
	const byte * fprint, size_t fprint_len)
	{
	int rc;

	if (r_keyblock)
	*r_keyblock = NULL;

	if (fprint_len == 20 \|\| fprint_len == 16)
	{
	struct getkey_ctx_s ctx;
	KBNODE kb = NULL;
	KBNODE found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1;
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();

	ctx.nitems = 1;
	ctx.items[0].mode = fprint_len == 16 ? KEYDB_SEARCH_MODE_FPR16
	: KEYDB_SEARCH_MODE_FPR20;
	memcpy (ctx.items[0].u.fpr, fprint, fprint_len);
	rc = lookup (&ctx, &kb, &found_key, 0);
	if (!rc && pk)
	pk_from_block (pk, kb, found_key);
	if (!rc && r_keyblock)
	{
	*r_keyblock = kb;
	kb = NULL;
	}
	release_kbnode (kb);
	getkey_end (&ctx);
	}
	else
	rc = GPG_ERR_GENERAL; /* Oops */
	return rc;
	}


	/* This function is similar to get_pubkey_byfprint, but it doesn't
	* merge the self-signed data into the public key and subkeys or into
	* the user ids. It also doesn't add the key to the user id cache.
	* Further, this function ignores PK->REQ_USAGE.
	*
	* This function is intended to avoid recursion and, as such, should
	* only be used in very specific situations.
	*
	* Like get_pubkey_byfprint, PK may be NULL. In that case, this
	* function effectively just checks for the existence of the key. */
	int
	get_pubkey_byfprint_fast (PKT_public_key * pk,
	const byte * fprint, size_t fprint_len)
	{
	int rc = 0;
	KEYDB_HANDLE hd;
	KBNODE keyblock;
	byte fprbuf[MAX_FINGERPRINT_LEN];
	int i;

	for (i = 0; i < MAX_FINGERPRINT_LEN && i < fprint_len; i++)
	fprbuf[i] = fprint[i];
	while (i < MAX_FINGERPRINT_LEN)
	fprbuf[i++] = 0;

	hd = keydb_new ();
	if (!hd)
	return gpg_error_from_syserror ();

	rc = keydb_search_fpr (hd, fprbuf);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	{
	keydb_release (hd);
	return GPG_ERR_NO_PUBKEY;
	}
	rc = keydb_get_keyblock (hd, &keyblock);
	keydb_release (hd);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	return GPG_ERR_NO_PUBKEY;
	}

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_PUBLIC_SUBKEY);
	if (pk)
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	release_kbnode (keyblock);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	return 0;
	}

	const char *
	parse_def_secret_key (ctrl_t ctrl)
	{
	KEYDB_HANDLE hd = NULL;
	strlist_t t;
	static int warned;

	for (t = opt.def_secret_key; t; t = t->next)
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;
	KBNODE kb;
	KBNODE node;

	err = classify_user_id (t->d, &desc, 1);
	if (err)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	t->d, gpg_strerror (err));
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"), "--default-key");
	continue;
	}

	if (! hd)
	{
	hd = keydb_new ();
	if (!hd)
	return NULL;
	}
	else
	keydb_search_reset (hd);


	err = keydb_search (hd, &desc, 1, NULL);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	continue;

	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), t->d, gpg_strerror (err));
	t = NULL;
	break;
	}

	err = keydb_get_keyblock (hd, &kb);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"),
	gpg_strerror (err));
	continue;
	}

	merge_selfsigs (kb);

	err = gpg_error (GPG_ERR_NO_SECKEY);
	node = kb;
	do
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	/* Check that the key has the signing capability. */
	if (! (pk->pubkey_usage & PUBKEY_USAGE_SIG))
	continue;

	/* Check if the key is valid. */
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "revoked");
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "expired");
	continue;
	}
	if (pk_is_disabled (pk))
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "disabled");
	continue;
	}

	err = agent_probe_secret_key (ctrl, pk);
	if (! err)
	/* This is a valid key. */
	break;
	}
	while ((node = find_next_kbnode (node, PKT_PUBLIC_SUBKEY)));

	release_kbnode (kb);
	if (err)
	{
	if (! warned && ! opt.quiet)
	{
	log_info (_("Warning: not using '%s' as default key: %s\n"),
	t->d, gpg_strerror (GPG_ERR_NO_SECKEY));
	print_reported_error (err, GPG_ERR_NO_SECKEY);
	}
	}
	else
	{
	if (! warned && ! opt.quiet)
	log_info (_("using \"%s\" as default secret key for signing\n"),
	t->d);
	break;
	}
	}

	if (! warned && opt.def_secret_key && ! t)
	log_info (_("all values passed to '%s' ignored\n"),
	"--default-key");

	warned = 1;

	if (hd)
	keydb_release (hd);

	if (t)
	return t->d;
	return NULL;
	}


	/* Look up a secret key.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If --default-key was set, then the specified key is looked up. (In
	* this case, the default key is returned even if it is considered
	* unusable. See the documentation for skip_unusable for exactly what
	* this means.)
	*
	* Otherwise, this initiates a DB scan that returns all keys that are
	* usable (see previous paragraph for exactly what usable means) and
	* for which a secret key is available.
	*
	* This function returns the first match. Additional results can be
	* returned using getkey_next. */
	gpg_error_t
	get_seckey_default (ctrl_t ctrl, PKT_public_key *pk)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int include_unusable = 1;


	const char *def_secret_key = parse_def_secret_key (ctrl);
	if (def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else
	include_unusable = 0;

	err = key_byname (NULL, namelist, pk, 1, include_unusable, NULL, NULL);

	free_strlist (namelist);

	return err;
	}



	/* Search for keys matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAMES is not NULL, then a search query is constructed using
	* classify_user_id on each of the strings in the list. (Recall: the
	* database does an OR of the terms, not an AND.) If NAMES is
	* NULL, then all results are returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	gpg_error_t
	getkey_bynames (getkey_ctx_t retctx, PKT_public_key pk,
	strlist_t names, int want_secret, kbnode_t *ret_keyblock)
	{
	return key_byname (retctx, names, pk, want_secret, 1,
	ret_keyblock, NULL);
	}


	/* Search for one key matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAME is not NULL, then a search query is constructed using
	* classify_user_id on the string. In this case, even unusable keys
	* (see the documentation for skip_unusable for an exact definition of
	* unusable) are returned. Otherwise, if --default-key was set, then
	* that key is returned (even if it is unusable). If neither of these
	* conditions holds, then the first usable key is returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found.
	*
	* FIXME: We also have the get_pubkey_byname function which has a
	* different semantic. Should be merged with this one. */
	gpg_error_t
	getkey_byname (ctrl_t ctrl, getkey_ctx_t retctx, PKT_public_key pk,
	const char name, int want_secret, kbnode_t ret_keyblock)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int with_unusable = 1;
	const char *def_secret_key = NULL;

	if (want_secret && !name)
	def_secret_key = parse_def_secret_key (ctrl);

	if (want_secret && !name && def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else if (name)
	add_to_strlist (&namelist, name);
	else
	with_unusable = 0;

	err = key_byname (retctx, namelist, pk, want_secret, with_unusable,
	ret_keyblock, NULL);

	/* FIXME: Check that we really return GPG_ERR_NO_SECKEY if
	WANT_SECRET has been used. */

	free_strlist (namelist);

	return err;
	}


	/* Return the next search result.
	*
	* If PK is not NULL, the public key of the next result is returned in
	* *PK. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xmalloc, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* RET_KEYBLOCK can be given as NULL; if it is not NULL it the entire
	* found keyblock is returned which must be released with
	* release_kbnode. If the function returns an error NULL is stored at
	* RET_KEYBLOCK.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	getkey_next (getkey_ctx_t ctx, PKT_public_key pk, kbnode_t ret_keyblock)
	{
	int rc; /* Fixme: Make sure this is proper gpg_error */
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;

	/* We need to disable the caching so that for an exact key search we
	won't get the result back from the cache and thus end up in an
	endless loop. The endless loop can occur, because the cache is
	used without respecting the current file pointer! */
	keydb_disable_caching (ctx->kr_handle);

	/* FOUND_KEY is only valid as long as RET_KEYBLOCK is. If the
	* caller wants PK, but not RET_KEYBLOCK, we need hand in our own
	* keyblock. */
	if (pk && ret_keyblock == NULL)
	ret_keyblock = &keyblock;

	rc = lookup (ctx, ret_keyblock, pk ? &found_key : NULL, ctx->want_secret);
	if (!rc && pk)
	{
	log_assert (found_key);
	pk_from_block (pk, NULL, found_key);
	release_kbnode (keyblock);
	}

	return rc;
	}


	/* Release any resources used by a key listing context. This must be
	* called on the context returned by, e.g., getkey_byname. */
	void
	getkey_end (getkey_ctx_t ctx)
	{
	if (ctx)
	{
	keydb_release (ctx->kr_handle);
	free_strlist (ctx->extra_list);
	if (!ctx->not_allocated)
	xfree (ctx);
	}
	}



	/************************************************
	*********** Merging stuff ******************
	************************************************/

	/* Set the mainkey_id fields for all keys in KEYBLOCK. This is
	* usually done by merge_selfsigs but at some places we only need the
	* main_kid not a full merge. The function also guarantees that all
	* pk->keyids are computed. */
	void
	setup_main_keyids (kbnode_t keyblock)
	{
	u32 kid[2], mainkid[2];
	kbnode_t kbctx, node;
	PKT_public_key *pk;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	BUG ();
	pk = keyblock->pkt->pkt.public_key;

	keyid_from_pk (pk, mainkid);
	for (kbctx=NULL; (node = walk_kbnode (keyblock, &kbctx, 0)); )
	{
	if (!(node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY))
	continue;
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, kid); /* Make sure pk->keyid is set. */
	if (!pk->main_keyid[0] && !pk->main_keyid[1])
	{
	pk->main_keyid[0] = mainkid[0];
	pk->main_keyid[1] = mainkid[1];
	}
	}
	}


	/* KEYBLOCK corresponds to a public key block. This function merges
	* much of the information from the self-signed data into the public
	* key, public subkey and user id data structures. If you use the
	* high-level search API (e.g., get_pubkey) for looking up key blocks,
	* then you don't need to call this function. This function is
	* useful, however, if you change the keyblock, e.g., by adding or
	* removing a self-signed data packet. */
	void
	merge_keys_and_selfsig (KBNODE keyblock)
	{
	if (!keyblock)
	;
	else if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	merge_selfsigs (keyblock);
	else
	log_debug ("FIXME: merging secret key blocks is not anymore available\n");
	}


	static int
	parse_key_usage (PKT_signature * sig)
	{
	int key_usage = 0;
	const byte *p;
	size_t n;
	byte flags;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_FLAGS, &n);
	if (p && n)
	{
	/* First octet of the keyflags. */
	flags = *p;

	if (flags & 1)
	{
	key_usage \|= PUBKEY_USAGE_CERT;
	flags &= ~1;
	}

	if (flags & 2)
	{
	key_usage \|= PUBKEY_USAGE_SIG;
	flags &= ~2;
	}

	/* We do not distinguish between encrypting communications and
	encrypting storage. */
	if (flags & (0x04 \| 0x08))
	{
	key_usage \|= PUBKEY_USAGE_ENC;
	flags &= ~(0x04 \| 0x08);
	}

	if (flags & 0x20)
	{
	key_usage \|= PUBKEY_USAGE_AUTH;
	flags &= ~0x20;
	}

	if (flags)
	key_usage \|= PUBKEY_USAGE_UNKNOWN;

	if (!key_usage)
	key_usage \|= PUBKEY_USAGE_NONE;
	}
	else if (p) /* Key flags of length zero. */
	key_usage \|= PUBKEY_USAGE_NONE;

	/* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
	capability that we do not handle. This serves to distinguish
	between a zero key usage which we handle as the default
	capabilities for that algorithm, and a usage that we do not
	handle. Likewise we use PUBKEY_USAGE_NONE to indicate that
	key_flags have been given but they do not specify any usage. */

	return key_usage;
	}


	/* Apply information from SIGNODE (which is the valid self-signature
	* associated with that UID) to the UIDNODE:
	* - weather the UID has been revoked
	* - assumed creation date of the UID
	* - temporary store the keyflags here
	* - temporary store the key expiration time here
	* - mark whether the primary user ID flag hat been set.
	* - store the preferences
	*/
	static void
	fixup_uidnode (KBNODE uidnode, KBNODE signode, u32 keycreated)
	{
	PKT_user_id *uid = uidnode->pkt->pkt.user_id;
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte p, sym, hash, zip;
	size_t n, nsym, nhash, nzip;

	sig->flags.chosen_selfsig = 1;/* We chose this one. */
	uid->created = 0; /* Not created == invalid. */
	if (IS_UID_REV (sig))
	{
	uid->is_revoked = 1;
	return; /* Has been revoked. */
	}
	else
	uid->is_revoked = 0;

	uid->expiredate = sig->expiredate;

	if (sig->flags.expired)
	{
	uid->is_expired = 1;
	return; /* Has expired. */
	}
	else
	uid->is_expired = 0;

	uid->created = sig->timestamp; /* This one is okay. */
	uid->selfsigversion = sig->version;
	/* If we got this far, it's not expired :) */
	uid->is_expired = 0;

	/* Store the key flags in the helper variable for later processing. */
	uid->help_key_usage = parse_key_usage (sig);

	/* Ditto for the key expiration. */
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	uid->help_key_expire = keycreated + buf32_to_u32 (p);
	else
	uid->help_key_expire = 0;

	/* Set the primary user ID flag - we will later wipe out some
	* of them to only have one in our keyblock. */
	uid->is_primary = 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID, NULL);
	if (p && *p)
	uid->is_primary = 2;

	/* We could also query this from the unhashed area if it is not in
	* the hased area and then later try to decide which is the better
	* there should be no security problem with this.
	* For now we only look at the hashed one. */

	/* Now build the preferences list. These must come from the
	hashed section so nobody can modify the ciphers a key is
	willing to accept. */
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_SYM, &n);
	sym = p;
	nsym = p ? n : 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_HASH, &n);
	hash = p;
	nhash = p ? n : 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_COMPR, &n);
	zip = p;
	nzip = p ? n : 0;
	if (uid->prefs)
	xfree (uid->prefs);
	n = nsym + nhash + nzip;
	if (!n)
	uid->prefs = NULL;
	else
	{
	uid->prefs = xmalloc (sizeof (uid->prefs) (n + 1));
	n = 0;
	for (; nsym; nsym--, n++)
	{
	uid->prefs[n].type = PREFTYPE_SYM;
	uid->prefs[n].value = *sym++;
	}
	for (; nhash; nhash--, n++)
	{
	uid->prefs[n].type = PREFTYPE_HASH;
	uid->prefs[n].value = *hash++;
	}
	for (; nzip; nzip--, n++)
	{
	uid->prefs[n].type = PREFTYPE_ZIP;
	uid->prefs[n].value = *zip++;
	}
	uid->prefs[n].type = PREFTYPE_NONE; /* End of list marker */
	uid->prefs[n].value = 0;
	}

	/* See whether we have the MDC feature. */
	uid->flags.mdc = 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_FEATURES, &n);
	if (p && n && (p[0] & 0x01))
	uid->flags.mdc = 1;

	/* And the keyserver modify flag. */
	uid->flags.ks_modify = 1;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KS_FLAGS, &n);
	if (p && n && (p[0] & 0x80))
	uid->flags.ks_modify = 0;
	}

	static void
	sig_to_revoke_info (PKT_signature * sig, struct revoke_info *rinfo)
	{
	rinfo->date = sig->timestamp;
	rinfo->algo = sig->pubkey_algo;
	rinfo->keyid[0] = sig->keyid[0];
	rinfo->keyid[1] = sig->keyid[1];
	}


	/* Given a keyblock, parse the key block and extract various pieces of
	information and save them with the primary key packet and the user
	id packets. For instance, some information is stored in signature
	packets. We find the latest such valid packet (since the user can
	change that information) and copy its contents into the
	PKT_public_key.

	Note that R_REVOKED may be set to 0, 1 or 2.

	This function fills in the following fields in the primary key's
	keyblock:

	main_keyid (computed)
	revkey / numrevkeys (derived from self signed key data)
	flags.valid (whether we have at least 1 self-sig)
	flags.maybe_revoked (whether a designed revoked the key, but
	we are missing the key to check the sig)
	selfsigversion (highest version of any valid self-sig)
	pubkey_usage (derived from most recent self-sig or most
	recent user id)
	has_expired (various sources)
	expiredate (various sources)

	See the documentation for fixup_uidnode for how the user id packets
	are modified. In addition to that the primary user id's is_primary
	field is set to 1 and the other user id's is_primary are set to
	0. */
	static void
	merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
	struct revoke_info *rinfo)
	{
	PKT_public_key *pk = NULL;
	KBNODE k;
	u32 kid[2];
	u32 sigdate, uiddate, uiddate2;
	KBNODE signode, uidnode, uidnode2;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0;
	u32 key_expire = 0;
	int key_expire_seen = 0;
	byte sigversion = 0;

	*r_revoked = 0;
	memset (rinfo, 0, sizeof (*rinfo));

	/* Section 11.1 of RFC 4880 determines the order of packets within a
	message. There are three sections, which must occur in the
	following order: the public key, the user ids and user attributes
	and the subkeys. Within each section, each primary packet (e.g.,
	a user id packet) is followed by one or more signature packets,
	which modify that packet. */

	/* According to Section 11.1 of RFC 4880, the public key must be the
	first packet. */
	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	/* parse_keyblock_image ensures that the first packet is the
	public key. */
	BUG ();
	pk = keyblock->pkt->pkt.public_key;
	keytimestamp = pk->timestamp;

	keyid_from_pk (pk, kid);
	pk->main_keyid[0] = kid[0];
	pk->main_keyid[1] = kid[1];

	if (pk->version < 4)
	{
	/* Before v4 the key packet itself contains the expiration date
	* and there was no way to change it, so we start with the one
	* from the key packet. */
	key_expire = pk->max_expiredate;
	key_expire_seen = 1;
	}

	/* First pass:

	- Find the latest direct key self-signature. We assume that the
	newest one overrides all others.

	- Determine whether the key has been revoked.

	- Gather all revocation keys (unlike other data, we don't just
	take them from the latest self-signed packet).

	- Determine max (sig[...]->version).
	*/

	/* Reset this in case this key was already merged. */
	xfree (pk->revkey);
	pk->revkey = NULL;
	pk->numrevkeys = 0;

	signode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature. */

	/* According to Section 11.1 of RFC 4880, the public key comes first
	and is immediately followed by any signature packets that modify
	it. */
	for (k = keyblock;
	k && k->pkt->pkttype != PKT_USER_ID
	&& k->pkt->pkttype != PKT_ATTRIBUTE
	&& k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	/* Self sig. */
	{
	if (check_key_signature (keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_KEY_REV (sig))
	{
	/* Key has been revoked - there is no way to
	* override such a revocation, so we theoretically
	* can stop now. We should not cope with expiration
	* times for revocations here because we have to
	* assume that an attacker can generate all kinds of
	* signatures. However due to the fact that the key
	* has been revoked it does not harm either and by
	* continuing we gather some more info on that
	* key. */
	*r_revoked = 1;
	sig_to_revoke_info (sig, rinfo);
	}
	else if (IS_KEY_SIG (sig))
	{
	/* Add the indicated revocations keys from all
	signatures not just the latest. We do this
	because you need multiple 1F sigs to properly
	handle revocation keys (PGP does it this way, and
	a revocation key could be sensitive and hence in
	a different signature). */
	if (sig->revkey)
	{
	int i;

	pk->revkey =
	xrealloc (pk->revkey, sizeof (struct revocation_key) *
	(pk->numrevkeys + sig->numrevkeys));

	for (i = 0; i < sig->numrevkeys; i++)
	memcpy (&pk->revkey[pk->numrevkeys++],
	&sig->revkey[i],
	sizeof (struct revocation_key));
	}

	if (sig->timestamp >= sigdate)
	/* This is the latest signature so far. */
	{
	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	if (sig->version > sigversion)
	sigversion = sig->version;

	}
	}
	}
	}
	}
	}

	/* Remove dupes from the revocation keys. */
	if (pk->revkey)
	{
	int i, j, x, changed = 0;

	for (i = 0; i < pk->numrevkeys; i++)
	{
	for (j = i + 1; j < pk->numrevkeys; j++)
	{
	if (memcmp (&pk->revkey[i], &pk->revkey[j],
	sizeof (struct revocation_key)) == 0)
	{
	/* remove j */

	for (x = j; x < pk->numrevkeys - 1; x++)
	pk->revkey[x] = pk->revkey[x + 1];

	pk->numrevkeys--;
	j--;
	changed = 1;
	}
	}
	}

	if (changed)
	pk->revkey = xrealloc (pk->revkey,
	pk->numrevkeys *
	sizeof (struct revocation_key));
	}

	if (signode)
	/* SIGNODE is the 1F signature packet with the latest creation
	time. Extract some information from it. */
	{
	/* Some information from a direct key signature take precedence
	* over the same information given in UID sigs. */
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte *p;

	key_usage = parse_key_usage (sig);

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	{
	key_expire = keytimestamp + buf32_to_u32 (p);
	key_expire_seen = 1;
	}

	/* Mark that key as valid: One direct key signature should
	* render a key as valid. */
	pk->flags.valid = 1;
	}

	/* Pass 1.5: Look for key revocation signatures that were not made
	by the key (i.e. did a revocation key issue a revocation for
	us?). Only bother to do this if there is a revocation key in the
	first place and we're not revoked already. */

	if (!*r_revoked && pk->revkey)
	for (k = keyblock; k && k->pkt->pkttype != PKT_USER_ID; k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (IS_KEY_REV (sig) &&
	(sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1]))
	{
	int rc = check_revocation_keys (pk, sig);
	if (rc == 0)
	{
	*r_revoked = 2;
	sig_to_revoke_info (sig, rinfo);
	/* Don't continue checking since we can't be any
	more revoked than this. */
	break;
	}
	else if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	pk->flags.maybe_revoked = 1;

	/* A failure here means the sig did not verify, was
	not issued by a revocation key, or a revocation
	key loop was broken. If a revocation key isn't
	findable, however, the key might be revoked and
	we don't know it. */

	/* TODO: In the future handle subkey and cert
	revocations? PGP doesn't, but it's in 2440. */
	}
	}
	}

	/* Second pass: Look at the self-signature of all user IDs. */

	/* According to RFC 4880 section 11.1, user id and attribute packets
	are in the second section, after the public key packet and before
	the subkey packets. */
	signode = uidnode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature in one UID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID \|\| k->pkt->pkttype == PKT_ATTRIBUTE)
	/* New user id packet. */
	{
	if (uidnode && signode)
	/* Apply the data from the most recent self-signed packet
	to the preceding user id packet. */
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}
	/* Clear SIGNODE. The only relevant self-signed data for
	UIDNODE follows it. */
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else
	uidnode = NULL;
	signode = NULL;
	sigdate = 0;
	}
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	{
	if (check_key_signature (keyblock, k, NULL))
	; /* signature did not verify */
	else if ((IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	&& sig->timestamp >= sigdate)
	{
	/* Note: we allow invalidation of cert revocations
	* by a newer signature. An attacker can't use this
	* because a key should be revoked with a key revocation.
	* The reason why we have to allow for that is that at
	* one time an email address may become invalid but later
	* the same email address may become valid again (hired,
	* fired, hired again). */

	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	if (sig->version > sigversion)
	sigversion = sig->version;
	}
	}
	}
	}
	if (uidnode && signode)
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}

	/* If the key isn't valid yet, and we have
	--allow-non-selfsigned-uid set, then force it valid. */
	if (!pk->flags.valid && opt.allow_non_selfsigned_uid)
	{
	if (opt.verbose)
	log_info (_("Invalid key %s made valid by"
	" --allow-non-selfsigned-uid\n"), keystr_from_pk (pk));
	pk->flags.valid = 1;
	}

	/* The key STILL isn't valid, so try and find an ultimately
	trusted signature. */
	if (!pk->flags.valid)
	{
	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1])
	{
	PKT_public_key *ultimate_pk;

	ultimate_pk = xmalloc_clear (sizeof (*ultimate_pk));

	/* We don't want to use the full get_pubkey to
	avoid infinite recursion in certain cases.
	There is no reason to check that an ultimately
	trusted key is still valid - if it has been
	revoked the user should also remove the
	ultimate trust flag. */
	if (get_pubkey_fast (ultimate_pk, sig->keyid) == 0
	&& check_key_signature2 (keyblock, k, ultimate_pk,
	NULL, NULL, NULL, NULL) == 0
	&& get_ownertrust (ultimate_pk) == TRUST_ULTIMATE)
	{
	free_public_key (ultimate_pk);
	pk->flags.valid = 1;
	break;
	}

	free_public_key (ultimate_pk);
	}
	}
	}
	}

	/* Record the highest selfsig version so we know if this is a v3
	key through and through, or a v3 key with a v4 selfsig
	somewhere. This is useful in a few places to know if the key
	must be treated as PGP2-style or OpenPGP-style. Note that a
	selfsig revocation with a higher version number will also raise
	this value. This is okay since such a revocation must be
	issued by the user (i.e. it cannot be issued by someone else to
	modify the key behavior.) */

	pk->selfsigversion = sigversion;

	/* Now that we had a look at all user IDs we can now get some information
	* from those user IDs.
	*/

	if (!key_usage)
	{
	/* Find the latest user ID with key flags set. */
	uiddate = 0; /* Helper to find the latest user ID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->help_key_usage && uid->created > uiddate)
	{
	key_usage = uid->help_key_usage;
	uiddate = uid->created;
	}
	}
	}
	}
	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (pk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (pk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	/* Whatever happens, it's a primary key, so it can certify. */
	pk->pubkey_usage = key_usage \| PUBKEY_USAGE_CERT;

	if (!key_expire_seen)
	{
	/* Find the latest valid user ID with a key expiration set
	* Note, that this may be a different one from the above because
	* some user IDs may have no expiration date set. */
	uiddate = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->help_key_expire && uid->created > uiddate)
	{
	key_expire = uid->help_key_expire;
	uiddate = uid->created;
	}
	}
	}
	}

	/* Currently only v3 keys have a maximum expiration date, but I'll
	bet v5 keys get this feature again. */
	if (key_expire == 0
	\|\| (pk->max_expiredate && key_expire > pk->max_expiredate))
	key_expire = pk->max_expiredate;

	pk->has_expired = key_expire >= curtime ? 0 : key_expire;
	pk->expiredate = key_expire;

	/* Fixme: we should see how to get rid of the expiretime fields but
	* this needs changes at other places too. */

	/* And now find the real primary user ID and delete all others. */
	uiddate = uiddate2 = 0;
	uidnode = uidnode2 = NULL;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID && !k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->is_primary)
	{
	if (uid->created > uiddate)
	{
	uiddate = uid->created;
	uidnode = k;
	}
	else if (uid->created == uiddate && uidnode)
	{
	/* The dates are equal, so we need to do a
	different (and arbitrary) comparison. This
	should rarely, if ever, happen. It's good to
	try and guarantee that two different GnuPG
	users with two different keyrings at least pick
	the same primary. */
	if (cmp_user_ids (uid, uidnode->pkt->pkt.user_id) > 0)
	uidnode = k;
	}
	}
	else
	{
	if (uid->created > uiddate2)
	{
	uiddate2 = uid->created;
	uidnode2 = k;
	}
	else if (uid->created == uiddate2 && uidnode2)
	{
	if (cmp_user_ids (uid, uidnode2->pkt->pkt.user_id) > 0)
	uidnode2 = k;
	}
	}
	}
	}
	if (uidnode)
	{
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID &&
	!k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (k != uidnode)
	uid->is_primary = 0;
	}
	}
	}
	else if (uidnode2)
	{
	/* None is flagged primary - use the latest user ID we have,
	and disambiguate with the arbitrary packet comparison. */
	uidnode2->pkt->pkt.user_id->is_primary = 1;
	}
	else
	{
	/* None of our uids were self-signed, so pick the one that
	sorts first to be the primary. This is the best we can do
	here since there are no self sigs to date the uids. */

	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data)
	{
	if (!uidnode)
	{
	uidnode = k;
	uidnode->pkt->pkt.user_id->is_primary = 1;
	continue;
	}
	else
	{
	if (cmp_user_ids (k->pkt->pkt.user_id,
	uidnode->pkt->pkt.user_id) > 0)
	{
	uidnode->pkt->pkt.user_id->is_primary = 0;
	uidnode = k;
	uidnode->pkt->pkt.user_id->is_primary = 1;
	}
	else
	k->pkt->pkt.user_id->is_primary = 0; /* just to be
	safe */
	}
	}
	}
	}
	}

	/* Convert a buffer to a signature. Useful for 0x19 embedded sigs.
	Caller must free the signature when they are done. */
	static PKT_signature *
	buf_to_sig (const byte * buf, size_t len)
	{
	PKT_signature *sig = xmalloc_clear (sizeof (PKT_signature));
	IOBUF iobuf = iobuf_temp_with_content (buf, len);
	int save_mode = set_packet_list_mode (0);

	if (parse_signature (iobuf, PKT_SIGNATURE, len, sig) != 0)
	{
	xfree (sig);
	sig = NULL;
	}

	set_packet_list_mode (save_mode);
	iobuf_close (iobuf);

	return sig;
	}

	/* Use the self-signed data to fill in various fields in subkeys.

	KEYBLOCK is the whole keyblock. SUBNODE is the subkey to fill in.

	Sets the following fields on the subkey:

	main_keyid
	flags.valid if the subkey has a valid self-sig binding
	flags.revoked
	flags.backsig
	pubkey_usage
	has_expired
	expired_date

	On this subkey's most revent valid self-signed packet, the
	following field is set:

	flags.chosen_selfsig
	*/
	static void
	merge_selfsigs_subkey (KBNODE keyblock, KBNODE subnode)
	{
	PKT_public_key mainpk = NULL, subpk = NULL;
	PKT_signature *sig;
	KBNODE k;
	u32 mainkid[2];
	u32 sigdate = 0;
	KBNODE signode;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0;
	u32 key_expire = 0;
	const byte *p;

	if (subnode->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	BUG ();
	mainpk = keyblock->pkt->pkt.public_key;
	if (mainpk->version < 4)
	return;/* (actually this should never happen) */
	keyid_from_pk (mainpk, mainkid);
	subpk = subnode->pkt->pkt.public_key;
	keytimestamp = subpk->timestamp;

	subpk->flags.valid = 0;
	subpk->flags.exact = 0;
	subpk->main_keyid[0] = mainpk->main_keyid[0];
	subpk->main_keyid[1] = mainpk->main_keyid[1];

	/* Find the latest key binding self-signature. */
	signode = NULL;
	sigdate = 0; /* Helper to find the latest signature. */
	for (k = subnode->next; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == mainkid[0] && sig->keyid[1] == mainkid[1])
	{
	if (check_key_signature (keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_SUBKEY_REV (sig))
	{
	/* Note that this means that the date on a
	revocation sig does not matter - even if the
	binding sig is dated after the revocation sig,
	the subkey is still marked as revoked. This
	seems ok, as it is just as easy to make new
	subkeys rather than re-sign old ones as the
	problem is in the distribution. Plus, PGP (7)
	does this the same way. */
	subpk->flags.revoked = 1;
	sig_to_revoke_info (sig, &subpk->revoked);
	/* Although we could stop now, we continue to
	* figure out other information like the old expiration
	* time. */
	}
	else if (IS_SUBKEY_SIG (sig) && sig->timestamp >= sigdate)
	{
	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	}
	}
	}
	}
	}

	/* No valid key binding. */
	if (!signode)
	return;

	sig = signode->pkt->pkt.signature;
	sig->flags.chosen_selfsig = 1; /* So we know which selfsig we chose later. */

	key_usage = parse_key_usage (sig);
	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (subpk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (subpk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	subpk->pubkey_usage = key_usage;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	key_expire = keytimestamp + buf32_to_u32 (p);
	else
	key_expire = 0;
	subpk->has_expired = key_expire >= curtime ? 0 : key_expire;
	subpk->expiredate = key_expire;

	/* Algo doesn't exist. */
	if (openpgp_pk_test_algo (subpk->pubkey_algo))
	return;

	subpk->flags.valid = 1;

	/* Find the most recent 0x19 embedded signature on our self-sig. */
	if (!subpk->flags.backsig)
	{
	int seq = 0;
	size_t n;
	PKT_signature *backsig = NULL;

	sigdate = 0;

	/* We do this while() since there may be other embedded
	signatures in the future. We only want 0x19 here. */

	while ((p = enum_sig_subpkt (sig->hashed,
	SIGSUBPKT_SIGNATURE, &n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	seq = 0;

	/* It is safe to have this in the unhashed area since the 0x19
	is located on the selfsig for convenience, not security. */

	while ((p = enum_sig_subpkt (sig->unhashed, SIGSUBPKT_SIGNATURE,
	&n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	if (backsig)
	{
	/* At this point, backsig contains the most recent 0x19 sig.
	Let's see if it is good. */

	/* 2==valid, 1==invalid, 0==didn't check */
	if (check_backsig (mainpk, subpk, backsig) == 0)
	subpk->flags.backsig = 2;
	else
	subpk->flags.backsig = 1;

	free_seckey_enc (backsig);
	}
	}
	}


	/* Merge information from the self-signatures with the public key,
	subkeys and user ids to make using them more easy.

	See documentation for merge_selfsigs_main, merge_selfsigs_subkey
	and fixup_uidnode for exactly which fields are updated. */
	static void
	merge_selfsigs (KBNODE keyblock)
	{
	KBNODE k;
	int revoked;
	struct revoke_info rinfo;
	PKT_public_key *main_pk;
	prefitem_t *prefs;
	unsigned int mdc_feature;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	log_error ("expected public key but found secret key "
	"- must stop\n");
	/* We better exit here because a public key is expected at
	other places too. FIXME: Figure this out earlier and
	don't get to here at all */
	g10_exit (1);
	}
	BUG ();
	}

	merge_selfsigs_main (keyblock, &revoked, &rinfo);

	/* Now merge in the data from each of the subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_selfsigs_subkey (keyblock, k);
	}
	}

	main_pk = keyblock->pkt->pkt.public_key;
	if (revoked \|\| main_pk->has_expired \|\| !main_pk->flags.valid)
	{
	/* If the primary key is revoked, expired, or invalid we
	* better set the appropriate flags on that key and all
	* subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (!main_pk->flags.valid)
	pk->flags.valid = 0;
	if (revoked && !pk->flags.revoked)
	{
	pk->flags.revoked = revoked;
	memcpy (&pk->revoked, &rinfo, sizeof (rinfo));
	}
	if (main_pk->has_expired)
	pk->has_expired = main_pk->has_expired;
	}
	}
	return;
	}

	/* Set the preference list of all keys to those of the primary real
	* user ID. Note: we use these preferences when we don't know by
	* which user ID the key has been selected.
	* fixme: we should keep atoms of commonly used preferences or
	* use reference counting to optimize the preference lists storage.
	* FIXME: it might be better to use the intersection of
	* all preferences.
	* Do a similar thing for the MDC feature flag. */
	prefs = NULL;
	mdc_feature = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data
	&& k->pkt->pkt.user_id->is_primary)
	{
	prefs = k->pkt->pkt.user_id->prefs;
	mdc_feature = k->pkt->pkt.user_id->flags.mdc;
	break;
	}
	}
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (pk->prefs)
	xfree (pk->prefs);
	pk->prefs = copy_prefs (prefs);
	pk->flags.mdc = mdc_feature;
	}
	}
	}



	/* See whether the key satisfies any additional requirements specified
	* in CTX. If so, return the node of an appropriate key or subkey.
	* Otherwise, return NULL if there was no appropriate key.
	*
	* Note that we do not return a reference, i.e. the result must not be
	* freed using 'release_kbnode'.
	*
	* In case the primary key is not required, select a suitable subkey.
	* We need the primary key if PUBKEY_USAGE_CERT is set in REQ_USAGE or
	* we are in PGP6 or PGP7 mode and PUBKEY_USAGE_SIG is set in
	* REQ_USAGE.
	*
	* If any of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT
	* are set in REQ_USAGE, we filter by the key's function. Concretely,
	* if PUBKEY_USAGE_SIG and PUBKEY_USAGE_CERT are set, then we only
	* return a key if it is (at least) either a signing or a
	* certification key.
	*
	* If REQ_USAGE is set, then we reject any keys that are not good
	* (i.e., valid, not revoked, not expired, etc.). This allows the
	* getkey functions to be used for plain key listings.
	*
	* Sets the matched key's user id field (pk->user_id) to the user id
	* that matched the low-level search criteria or NULL.
	*
	* If R_FLAGS is not NULL set certain flags for more detailed error
	* reporting. Used flags are:
	*
	* - LOOKUP_ALL_SUBKEYS_EXPIRED :: All Subkeys are expired or have
	* been revoked.
	* - LOOKUP_NOT_SELECTED :: No suitable key found
	*
	* This function needs to handle several different cases:
	*
	* 1. No requested usage and no primary key requested
	* Examples for this case are that we have a keyID to be used
	* for decrytion or verification.
	* 2. No usage but primary key requested
	* This is the case for all functions which work on an
	* entire keyblock, e.g. for editing or listing
	* 3. Usage and primary key requested
	* FIXME
	* 4. Usage but no primary key requested
	* FIXME
	*
	*/
	static kbnode_t
	finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
	unsigned int *r_flags)
	{
	kbnode_t k;

	/* If WANT_EXACT is set, the key or subkey that actually matched the
	low-level search criteria. */
	kbnode_t foundk = NULL;
	/* The user id (if any) that matched the low-level search criteria. */
	PKT_user_id *foundu = NULL;

	u32 latest_date;
	kbnode_t latest_key;
	PKT_public_key *pk;
	int req_prim;
	u32 curtime = make_timestamp ();

	if (r_flags)
	*r_flags = 0;

	#define USAGE_MASK (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_ENC\|PUBKEY_USAGE_CERT)
	req_usage &= USAGE_MASK;

	/* Request the primary if we're certifying another key, and also if
	* signing data while --pgp6 or --pgp7 is on since pgp 6 and 7 do
	* not understand signatures made by a signing subkey. PGP 8 does. */
	req_prim = ((req_usage & PUBKEY_USAGE_CERT)
	\|\| ((PGP6 \|\| PGP7) && (req_usage & PUBKEY_USAGE_SIG)));


	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* For an exact match mark the primary or subkey that matched the
	low-level search criteria. */
	if (want_exact)
	{
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 1))
	{
	log_assert (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY);
	foundk = k;
	pk = k->pkt->pkt.public_key;
	pk->flags.exact = 1;
	break;
	}
	}
	}

	/* Get the user id that matched that low-level search criteria. */
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 2))
	{
	log_assert (k->pkt->pkttype == PKT_USER_ID);
	foundu = k->pkt->pkt.user_id;
	break;
	}
	}

	if (DBG_LOOKUP)
	log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
	(ulong) keyid_from_pk (keyblock->pkt->pkt.public_key, NULL),
	foundk ? "one" : "all", req_usage);

	if (!req_usage)
	{
	latest_key = foundk ? foundk : keyblock;
	goto found;
	}

	latest_date = 0;
	latest_key = NULL;
	/* Set LATEST_KEY to the latest (the one with the most recent
	* timestamp) good (valid, not revoked, not expired, etc.) subkey.
	*
	* Don't bother if we are only looking for a primary key or we need
	* an exact match and the exact match is not a subkey. */
	if (req_prim \|\| (foundk && foundk->pkt->pkttype != PKT_PUBLIC_SUBKEY))
	;
	else
	{
	kbnode_t nextk;
	int n_subkeys = 0;
	int n_revoked_or_expired = 0;

	/* Either start a loop or check just this one subkey. */
	for (k = foundk ? foundk : keyblock; k; k = nextk)
	{
	if (foundk)
	{
	/* If FOUNDK is not NULL, then only consider that exact
	key, i.e., don't iterate. */
	nextk = NULL;
	}
	else
	nextk = k->next;

	if (k->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk = k->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tchecking subkey %08lX\n",
	(ulong) keyid_from_pk (pk, NULL));

	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not valid\n");
	continue;
	}
	if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tusage does not match: want=%x have=%x\n",
	req_usage, pk->pubkey_usage);
	continue;
	}

	n_subkeys++;
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has been revoked\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has expired\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->timestamp > curtime && !opt.ignore_valid_from)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not yet valid\n");
	continue;
	}

	if (DBG_LOOKUP)
	log_debug ("\tsubkey might be fine\n");
	/* In case a key has a timestamp of 0 set, we make sure
	that it is used. A better change would be to compare
	">=" but that might also change the selected keys and
	is as such a more intrusive change. */
	if (pk->timestamp > latest_date \|\| (!pk->timestamp && !latest_date))
	{
	latest_date = pk->timestamp;
	latest_key = k;
	}
	}
	if (n_subkeys == n_revoked_or_expired && r_flags)
	*r_flags \|= LOOKUP_ALL_SUBKEYS_EXPIRED;
	}

	/* Check if the primary key is ok (valid, not revoke, not expire,
	* matches requested usage) if:
	*
	* - we didn't find an appropriate subkey and we're not doing an
	* exact search,
	*
	* - we're doing an exact match and the exact match was the
	* primary key, or,
	*
	* - we're just considering the primary key. */
	if ((!latest_key && !want_exact) \|\| foundk == keyblock \|\| req_prim)
	{
	if (DBG_LOOKUP && !foundk && !req_prim)
	log_debug ("\tno suitable subkeys found - trying primary\n");
	pk = keyblock->pkt->pkt.public_key;
	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not valid\n");
	}
	else if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key usage does not match: "
	"want=%x have=%x\n", req_usage, pk->pubkey_usage);
	}
	else if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has been revoked\n");
	}
	else if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has expired\n");
	}
	else /* Okay. */
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key may be used\n");
	latest_key = keyblock;
	}
	}

	if (!latest_key)
	{
	if (DBG_LOOKUP)
	log_debug ("\tno suitable key found - giving up\n");
	if (r_flags)
	*r_flags \|= LOOKUP_NOT_SELECTED;
	return NULL; /* Not found. */
	}

	found:
	if (DBG_LOOKUP)
	log_debug ("\tusing key %08lX\n",
	(ulong) keyid_from_pk (latest_key->pkt->pkt.public_key, NULL));

	if (latest_key)
	{
	pk = latest_key->pkt->pkt.public_key;
	free_user_id (pk->user_id);
	pk->user_id = scopy_user_id (foundu);
	}

	if (latest_key != keyblock && opt.verbose)
	{
	char *tempkeystr =
	xstrdup (keystr_from_pk (latest_key->pkt->pkt.public_key));
	log_info (_("using subkey %s instead of primary key %s\n"),
	tempkeystr, keystr_from_pk (keyblock->pkt->pkt.public_key));
	xfree (tempkeystr);
	}

	cache_user_id (keyblock);

	return latest_key ? latest_key : keyblock; /* Found. */
	}


	/* Print a KEY_CONSIDERED status line. */
	static void
	print_status_key_considered (kbnode_t keyblock, unsigned int flags)
	{
	char hexfpr[2*MAX_FINGERPRINT_LEN + 1];
	kbnode_t node;
	char flagbuf[20];

	if (!is_status_enabled ())
	return;

	for (node=keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY)
	break;
	if (!node)
	{
	log_error ("%s: keyblock w/o primary key\n", __func__);
	return;
	}

	hexfingerprint (node->pkt->pkt.public_key, hexfpr, sizeof hexfpr);
	snprintf (flagbuf, sizeof flagbuf, " %u", flags);
	write_status_strings (STATUS_KEY_CONSIDERED, hexfpr, flagbuf, NULL);
	}



	/* A high-level function to lookup keys.

	This function builds on top of the low-level keydb API. It first
	searches the database using the description stored in CTX->ITEMS,
	then it filters the results using CTX and, finally, if WANT_SECRET
	is set, it ignores any keys for which no secret key is available.

	Unlike the low-level search functions, this function also merges
	all of the self-signed data into the keys, subkeys and user id
	packets (see the merge_selfsigs for details).

	On success the key's keyblock is stored at *RET_KEYBLOCK, and the
	specific subkey is stored at *RET_FOUND_KEY. Note that we do not
	return a reference in *RET_FOUND_KEY, i.e. the result must not be
	freed using 'release_kbnode', and it is only valid until
	*RET_KEYBLOCK is deallocated. Therefore, if RET_FOUND_KEY is not
	NULL, then RET_KEYBLOCK must not be NULL. */
	static int
	lookup (getkey_ctx_t ctx, kbnode_t ret_keyblock, kbnode_t ret_found_key,
	int want_secret)
	{
	int rc;
	int no_suitable_key = 0;
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;
	unsigned int infoflags;

	log_assert (ret_found_key == NULL \|\| ret_keyblock != NULL);
	if (ret_keyblock)
	*ret_keyblock = NULL;

	for (;;)
	{
	rc = keydb_search (ctx->kr_handle, ctx->items, ctx->nitems, NULL);
	if (rc)
	break;

	/* If we are iterating over the entire database, then we need to
	change from KEYDB_SEARCH_MODE_FIRST, which does an implicit
	reset, to KEYDB_SEARCH_MODE_NEXT, which gets the next
	record. */
	if (ctx->nitems && ctx->items->mode == KEYDB_SEARCH_MODE_FIRST)
	ctx->items->mode = KEYDB_SEARCH_MODE_NEXT;

	rc = keydb_get_keyblock (ctx->kr_handle, &keyblock);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	goto skip;
	}

	if (want_secret && agent_probe_any_secret_key (NULL, keyblock))
	goto skip; /* No secret key available. */

	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. */
	merge_selfsigs (keyblock);
	found_key = finish_lookup (keyblock, ctx->req_usage, ctx->exact,
	&infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	{
	no_suitable_key = 0;
	goto found;
	}
	else
	{
	no_suitable_key = 1;
	}

	skip:
	/* Release resources and continue search. */
	release_kbnode (keyblock);
	keyblock = NULL;
	/* The keyblock cache ignores the current "file position".
	Thus, if we request the next result and the cache matches
	(and it will since it is what we just looked for), we'll get
	the same entry back! We can avoid this infinite loop by
	disabling the cache. */
	keydb_disable_caching (ctx->kr_handle);
	}

	found:
	if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND)
	log_error ("keydb_search failed: %s\n", gpg_strerror (rc));

	if (!rc)
	{
	if (ret_keyblock)
	{
	ret_keyblock = keyblock; / Return the keyblock. */
	keyblock = NULL;
	}
	}
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND && no_suitable_key)
	rc = want_secret? GPG_ERR_UNUSABLE_SECKEY : GPG_ERR_UNUSABLE_PUBKEY;
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	rc = want_secret? GPG_ERR_NO_SECKEY : GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	if (ret_found_key)
	{
	if (! rc)
	*ret_found_key = found_key;
	else
	*ret_found_key = NULL;
	}

	return rc;
	}


	/* Enumerate some secret keys (specifically, those specified with
	* --default-key and --try-secret-key). Use the following procedure:
	*
	* 1) Initialize a void pointer to NULL
	* 2) Pass a reference to this pointer to this function (content)
	* and provide space for the secret key (sk)
	* 3) Call this function as long as it does not return an error (or
	* until you are done). The error code GPG_ERR_EOF indicates the
	* end of the listing.
	* 4) Call this function a last time with SK set to NULL,
	* so that can free it's context.
	*
	* In pseudo-code:
	*
	* void *ctx = NULL;
	* PKT_public_key sk = xmalloc_clear (sizeof (sk));
	*
	* while ((err = enum_secret_keys (&ctx, sk)))
	* { // Process SK.
	* if (done)
	* break;
	* free_public_key (sk);
	* sk = xmalloc_clear (sizeof (*sk));
	* }
	*
	* // Release any resources used by CTX.
	* enum_secret_keys (&ctx, NULL);
	* free_public_key (sk);
	*
	* if (gpg_err_code (err) != GPG_ERR_EOF)
	* ; // An error occurred.
	*/
	gpg_error_t
	enum_secret_keys (ctrl_t ctrl, void *context, PKT_public_key sk)
	{
	gpg_error_t err = 0;
	const char *name;
	kbnode_t keyblock;
	struct
	{
	int eof;
	int state;
	strlist_t sl;
	kbnode_t keyblock;
	kbnode_t node;
	getkey_ctx_t ctx;
	} c = context;

	if (!c)
	{
	/* Make a new context. */
	c = xtrycalloc (1, sizeof *c);
	if (!c)
	return gpg_error_from_syserror ();
	*context = c;
	}

	if (!sk)
	{
	/* Free the context. */
	release_kbnode (c->keyblock);
	getkey_end (c->ctx);
	xfree (c);
	*context = NULL;
	return 0;
	}

	if (c->eof)
	return gpg_error (GPG_ERR_EOF);

	for (;;)
	{
	/* Loop until we have a keyblock. */
	while (!c->keyblock)
	{
	/* Loop over the list of secret keys. */
	do
	{
	name = NULL;
	keyblock = NULL;
	switch (c->state)
	{
	case 0: /* First try to use the --default-key. */
	name = parse_def_secret_key (ctrl);
	c->state = 1;
	break;

	case 1: /* Init list of keys to try. */
	c->sl = opt.secret_keys_to_try;
	c->state++;
	break;

	case 2: /* Get next item from list. */
	if (c->sl)
	{
	name = c->sl->d;
	c->sl = c->sl->next;
	}
	else
	c->state++;
	break;

	case 3: /* Init search context to enum all secret keys. */
	err = getkey_bynames (&c->ctx, NULL, NULL, 1, &keyblock);
	if (err)
	{
	release_kbnode (keyblock);
	keyblock = NULL;
	getkey_end (c->ctx);
	c->ctx = NULL;
	}
	c->state++;
	break;

	case 4: /* Get next item from the context. */
	if (c->ctx)
	{
	err = getkey_next (c->ctx, NULL, &keyblock);
	if (err)
	{
	release_kbnode (keyblock);
	keyblock = NULL;
	getkey_end (c->ctx);
	c->ctx = NULL;
	}
	}
	else
	c->state++;
	break;

	default: /* No more names to check - stop. */
	c->eof = 1;
	return gpg_error (GPG_ERR_EOF);
	}
	}
	while ((!name \|\| !*name) && !keyblock);

	if (keyblock)
	c->node = c->keyblock = keyblock;
	else
	{
	err = getkey_byname (ctrl, NULL, NULL, name, 1, &c->keyblock);
	if (err)
	{
	/* getkey_byname might return a keyblock even in the
	error case - I have not checked. Thus better release
	it. */
	release_kbnode (c->keyblock);
	c->keyblock = NULL;
	}
	else
	c->node = c->keyblock;
	}
	}

	/* Get the next key from the current keyblock. */
	for (; c->node; c->node = c->node->next)
	{
	if (c->node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	copy_public_key (sk, c->node->pkt->pkt.public_key);
	c->node = c->node->next;
	return 0; /* Found. */
	}
	}

	/* Dispose the keyblock and continue. */
	release_kbnode (c->keyblock);
	c->keyblock = NULL;
	}
	}


	/*********************************************
	********* User ID printing helpers *****
	*********************************************/

	/* Return a string with a printable representation of the user_id.
	* this string must be freed by xfree. */
	static char *
	get_user_id_string (u32 * keyid, int mode, size_t *r_len)
	{
	user_id_db_t r;
	keyid_list_t a;
	int pass = 0;
	char *p;

	/* Try it two times; second pass reads from the database. */
	do
	{
	for (r = user_id_db; r; r = r->next)
	{
	for (a = r->keyids; a; a = a->next)
	{
	if (a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1])
	{
	if (mode == 2)
	{
	/* An empty string as user id is possible. Make
	sure that the malloc allocates one byte and
	does not bail out. */
	p = xmalloc (r->len? r->len : 1);
	memcpy (p, r->name, r->len);
	if (r_len)
	*r_len = r->len;
	}
	else
	{
	if (mode)
	p = xasprintf ("%08lX%08lX %.*s",
	(ulong) keyid[0], (ulong) keyid[1],
	r->len, r->name);
	else
	p = xasprintf ("%s %.*s", keystr (keyid),
	r->len, r->name);
	if (r_len)
	*r_len = strlen (p);
	}

	return p;
	}
	}
	}
	}
	while (++pass < 2 && !get_pubkey (NULL, keyid));

	if (mode == 2)
	p = xstrdup (user_id_not_found_utf8 ());
	else if (mode)
	p = xasprintf ("%08lX%08lX [?]", (ulong) keyid[0], (ulong) keyid[1]);
	else
	p = xasprintf ("%s [?]", keystr (keyid));

	if (r_len)
	*r_len = strlen (p);
	return p;
	}


	char *
	get_user_id_string_native (u32 * keyid)
	{
	char *p = get_user_id_string (keyid, 0, NULL);
	char *p2 = utf8_to_native (p, strlen (p), 0);
	xfree (p);
	return p2;
	}


	char *
	get_long_user_id_string (u32 * keyid)
	{
	return get_user_id_string (keyid, 1, NULL);
	}


	/* Please try to use get_user_byfpr instead of this one. */
	char *
	get_user_id (u32 * keyid, size_t * rn)
	{
	return get_user_id_string (keyid, 2, rn);
	}


	/* Please try to use get_user_id_byfpr_native instead of this one. */
	char *
	get_user_id_native (u32 * keyid)
	{
	size_t rn;
	char *p = get_user_id (keyid, &rn);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the user id for a key designated by its fingerprint, FPR,
	which must be MAX_FINGERPRINT_LEN bytes in size. Note: the
	returned string, which must be freed using xfree, may not be NUL
	terminated. To determine the length of the string, you must use
	RN. /
	char *
	get_user_id_byfpr (const byte fpr, size_t rn)
	{
	user_id_db_t r;
	char *p;
	int pass = 0;

	/* Try it two times; second pass reads from the database. */
	do
	{
	for (r = user_id_db; r; r = r->next)
	{
	keyid_list_t a;
	for (a = r->keyids; a; a = a->next)
	{
	if (!memcmp (a->fpr, fpr, MAX_FINGERPRINT_LEN))
	{
	/* An empty string as user id is possible. Make
	sure that the malloc allocates one byte and does
	not bail out. */
	p = xmalloc (r->len? r->len : 1);
	memcpy (p, r->name, r->len);
	*rn = r->len;
	return p;
	}
	}
	}
	}
	while (++pass < 2
	&& !get_pubkey_byfprint (NULL, NULL, fpr, MAX_FINGERPRINT_LEN));
	p = xstrdup (user_id_not_found_utf8 ());
	*rn = strlen (p);
	return p;
	}

	/* Like get_user_id_byfpr, but convert the string to the native
	encoding. The returned string needs to be freed. Unlike
	get_user_id_byfpr, the returned string is NUL terminated. */
	char *
	get_user_id_byfpr_native (const byte *fpr)
	{
	size_t rn;
	char *p = get_user_id_byfpr (fpr, &rn);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the database handle used by this context. The context still
	owns the handle. */
	KEYDB_HANDLE
	get_ctx_handle (GETKEY_CTX ctx)
	{
	return ctx->kr_handle;
	}

	static void
	free_akl (struct akl *akl)
	{
	if (! akl)
	return;

	if (akl->spec)
	free_keyserver_spec (akl->spec);

	xfree (akl);
	}

	void
	release_akl (void)
	{
	while (opt.auto_key_locate)
	{
	struct akl *akl2 = opt.auto_key_locate;
	opt.auto_key_locate = opt.auto_key_locate->next;
	free_akl (akl2);
	}
	}

	/* Returns false on error. */
	int
	parse_auto_key_locate (char *options)
	{
	char *tok;

	while ((tok = optsep (&options)))
	{
	struct akl akl, check, *last = NULL;
	int dupe = 0;

	if (tok[0] == '\0')
	continue;

	akl = xmalloc_clear (sizeof (*akl));

	if (ascii_strcasecmp (tok, "clear") == 0)
	{
	xfree (akl);
	free_akl (opt.auto_key_locate);
	opt.auto_key_locate = NULL;
	continue;
	}
	else if (ascii_strcasecmp (tok, "nodefault") == 0)
	akl->type = AKL_NODEFAULT;
	else if (ascii_strcasecmp (tok, "local") == 0)
	akl->type = AKL_LOCAL;
	else if (ascii_strcasecmp (tok, "ldap") == 0)
	akl->type = AKL_LDAP;
	else if (ascii_strcasecmp (tok, "keyserver") == 0)
	akl->type = AKL_KEYSERVER;
	else if (ascii_strcasecmp (tok, "cert") == 0)
	akl->type = AKL_CERT;
	else if (ascii_strcasecmp (tok, "pka") == 0)
	akl->type = AKL_PKA;
	else if (ascii_strcasecmp (tok, "dane") == 0)
	akl->type = AKL_DANE;
	else if (ascii_strcasecmp (tok, "wkd") == 0)
	akl->type = AKL_WKD;
	else if ((akl->spec = parse_keyserver_uri (tok, 1)))
	akl->type = AKL_SPEC;
	else
	{
	free_akl (akl);
	return 0;
	}

	/* We must maintain the order the user gave us */
	for (check = opt.auto_key_locate; check;
	last = check, check = check->next)
	{
	/* Check for duplicates */
	if (check->type == akl->type
	&& (akl->type != AKL_SPEC
	\|\| (akl->type == AKL_SPEC
	&& strcmp (check->spec->uri, akl->spec->uri) == 0)))
	{
	dupe = 1;
	free_akl (akl);
	break;
	}
	}

	if (!dupe)
	{
	if (last)
	last->next = akl;
	else
	opt.auto_key_locate = akl;
	}
	}

	return 1;
	}


	/* Returns true if a secret key is available for the public key with
	key id KEYID; returns false if not. This function ignores legacy
	keys. Note: this is just a fast check and does not tell us whether
	the secret key is valid; this check merely indicates whether there
	is some secret key with the specified key id. */
	int
	have_secret_key_with_kid (u32 *keyid)
	{
	gpg_error_t err;
	KEYDB_HANDLE kdbhd;
	KEYDB_SEARCH_DESC desc;
	kbnode_t keyblock;
	kbnode_t node;
	int result = 0;

	kdbhd = keydb_new ();
	if (!kdbhd)
	return 0;
	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_LONG_KID;
	desc.u.kid[0] = keyid[0];
	desc.u.kid[1] = keyid[1];
	while (!result)
	{
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (err)
	break;

	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	break;
	}

	for (node = keyblock; node; node = node->next)
	{
	/* Bit 0 of the flags is set if the search found the key
	using that key or subkey. Note: a search will only ever
	match a single key or subkey. */
	if ((node->flag & 1))
	{
	log_assert (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	if (!agent_probe_secret_key (NULL, node->pkt->pkt.public_key))
	result = 1; /* Secret key available. */
	else
	result = 0;

	break;
	}
	}
	release_kbnode (keyblock);
	}

	keydb_release (kdbhd);
	return result;
	}
	diff --git a/g10/import.c b/g10/import.c
	index b6c04dcfc..45ec07a49 100644
	--- a/g10/import.c
	+++ b/g10/import.c
	@@ -1,3380 +1,3380 @@
	/* import.c - import a key into our key storage.
	* Copyright (C) 1998-2007, 2010-2011 Free Software Foundation, Inc.
	* Copyright (C) 2014, 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "keydb.h"
	#include "util.h"
	#include "trustdb.h"
	#include "main.h"
	#include "i18n.h"
	#include "ttyio.h"
	#include "status.h"
	#include "recsel.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "../common/membuf.h"
	#include "../common/init.h"
	#include "../common/mbox-util.h"


	struct import_stats_s
	{
	ulong count;
	ulong no_user_id;
	ulong imported;
	ulong n_uids;
	ulong n_sigs;
	ulong n_subk;
	ulong unchanged;
	ulong n_revoc;
	ulong secret_read;
	ulong secret_imported;
	ulong secret_dups;
	ulong skipped_new_keys;
	ulong not_imported;
	ulong n_sigs_cleaned;
	ulong n_uids_cleaned;
	ulong v3keys; /* Number of V3 keys seen. */
	};


	/* Node flag to indicate that a user ID or a subkey has a
	* valid self-signature. */
	#define NODE_GOOD_SELFSIG 1
	/* Node flag to indicate that a user ID or subkey has
	* an invalid self-signature. */
	#define NODE_BAD_SELFSIG 2
	/* Node flag to indicate that the node shall be deleted. */
	#define NODE_DELETION_MARK 4
	/* A node flag used to temporary mark a node. */
	#define NODE_FLAG_A 8


	-/* A an object and a global instance to store selectors created from
	+/* An object and a global instance to store selectors created from
	* --import-filter keep-uid=EXPR.
	* --import-filter drop-sig=EXPR.
	*
	* FIXME: We should put this into the CTRL object but that requires a
	* lot more changes right now. For now we use save and restore
	* function to temporary change them.
	*/
	/* Definition of the import filters. */
	struct import_filter_s
	{
	recsel_expr_t keep_uid;
	recsel_expr_t drop_sig;
	};
	/* The current instance. */
	struct import_filter_s import_filter;


	static int import (ctrl_t ctrl,
	IOBUF inp, const char* fname, struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len, unsigned int options,
	import_screener_t screener, void *screener_arg);
	static int read_block (IOBUF a, PACKET *pending_pkt, kbnode_t ret_root,
	int *r_v3keys);
	static void revocation_present (ctrl_t ctrl, kbnode_t keyblock);
	static int import_one (ctrl_t ctrl,
	kbnode_t keyblock,
	struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options, int from_sk, int silent,
	import_screener_t screener, void *screener_arg);
	static int import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
	struct import_stats_s *stats, int batch,
	unsigned int options, int for_migration,
	import_screener_t screener, void *screener_arg);
	static int import_revoke_cert (ctrl_t ctrl,
	kbnode_t node, struct import_stats_s *stats);
	static int chk_self_sigs (kbnode_t keyblock, u32 keyid, int non_self);
	static int delete_inv_parts (kbnode_t keyblock,
	u32 *keyid, unsigned int options);
	static int any_uid_left (kbnode_t keyblock);
	static int merge_blocks (kbnode_t keyblock_orig,
	kbnode_t keyblock, u32 *keyid,
	int n_uids, int n_sigs, int *n_subk );
	static int append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs);
	static int append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs);
	static int merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs);
	static int merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs);



	static void
	release_import_filter (import_filter_t filt)
	{
	recsel_release (filt->keep_uid);
	filt->keep_uid = NULL;
	recsel_release (filt->drop_sig);
	filt->drop_sig = NULL;
	}

	static void
	cleanup_import_globals (void)
	{
	release_import_filter (&import_filter);
	}


	int
	parse_import_options(char str,unsigned int options,int noisy)
	{
	struct parse_options import_opts[]=
	{
	{"import-local-sigs",IMPORT_LOCAL_SIGS,NULL,
	N_("import signatures that are marked as local-only")},

	{"repair-pks-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,
	N_("repair damage from the pks keyserver during import")},

	{"keep-ownertrust", IMPORT_KEEP_OWNERTTRUST, NULL,
	N_("do not clear the ownertrust values during import")},

	{"fast-import",IMPORT_FAST,NULL,
	N_("do not update the trustdb after import")},

	{"import-show",IMPORT_SHOW,NULL,
	N_("show key during import")},

	{"merge-only",IMPORT_MERGE_ONLY,NULL,
	N_("only accept updates to existing keys")},

	{"import-clean",IMPORT_CLEAN,NULL,
	N_("remove unusable parts from key after import")},

	{"import-minimal",IMPORT_MINIMAL\|IMPORT_CLEAN,NULL,
	N_("remove as much as possible from key after import")},

	{"import-export", IMPORT_EXPORT, NULL,
	N_("run import filters and export key immediately")},

	{"restore", IMPORT_RESTORE, NULL,
	N_("assume the GnuPG key backup format")},
	{"import-restore", IMPORT_RESTORE, NULL, NULL},

	/* Aliases for backward compatibility */
	{"allow-local-sigs",IMPORT_LOCAL_SIGS,NULL,NULL},
	{"repair-hkp-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,NULL},
	/* dummy */
	{"import-unusable-sigs",0,NULL,NULL},
	{"import-clean-sigs",0,NULL,NULL},
	{"import-clean-uids",0,NULL,NULL},
	{"convert-sk-to-pk",0, NULL,NULL}, /* Not anymore needed due to
	the new design. */
	{NULL,0,NULL,NULL}
	};
	int rc;

	rc = parse_options (str, options, import_opts, noisy);
	if (rc && (*options & IMPORT_RESTORE))
	{
	/* Alter other options we want or don't want for restore. */
	*options \|= (IMPORT_LOCAL_SIGS \| IMPORT_KEEP_OWNERTTRUST);
	*options &= ~(IMPORT_MINIMAL \| IMPORT_CLEAN
	\| IMPORT_REPAIR_PKS_SUBKEY_BUG
	\| IMPORT_MERGE_ONLY);
	}
	return rc;
	}


	/* Parse and set an import filter from string. STRING has the format
	* "NAME=EXPR" with NAME being the name of the filter. Spaces before
	* and after NAME are not allowed. If this function is all called
	* several times all expressions for the same NAME are concatenated.
	* Supported filter names are:
	*
	* - keep-uid :: If the expression evaluates to true for a certain
	* user ID packet, that packet and all it dependencies
	* will be imported. The expression may use these
	* variables:
	*
	* - uid :: The entire user ID.
	* - mbox :: The mail box part of the user ID.
	* - primary :: Evaluate to true for the primary user ID.
	*/
	gpg_error_t
	parse_and_set_import_filter (const char *string)
	{
	gpg_error_t err;

	/* Auto register the cleanup function. */
	register_mem_cleanup_func (cleanup_import_globals);

	if (!strncmp (string, "keep-uid=", 9))
	err = recsel_parse_expr (&import_filter.keep_uid, string+9);
	else if (!strncmp (string, "drop-sig=", 9))
	err = recsel_parse_expr (&import_filter.drop_sig, string+9);
	else
	err = gpg_error (GPG_ERR_INV_NAME);

	return err;
	}


	/* Save the current import filters, return them, and clear the current
	* filters. Returns NULL on error and sets ERRNO. */
	import_filter_t
	save_and_clear_import_filter (void)
	{
	import_filter_t filt;

	filt = xtrycalloc (1, sizeof *filt);
	if (!filt)
	return NULL;
	*filt = import_filter;
	memset (&import_filter, 0, sizeof import_filter);

	return filt;
	}


	/* Release the current import filters and restore them from NEWFILT.
	* Ownership of NEWFILT is moved to this function. */
	void
	restore_import_filter (import_filter_t filt)
	{
	if (filt)
	{
	release_import_filter (&import_filter);
	import_filter = *filt;
	xfree (filt);
	}
	}


	import_stats_t
	import_new_stats_handle (void)
	{
	return xmalloc_clear ( sizeof (struct import_stats_s) );
	}


	void
	import_release_stats_handle (import_stats_t p)
	{
	xfree (p);
	}


	/* Read a key from a file. Only the first key in the file is
	* considered and stored at R_KEYBLOCK. FNAME is the name of the
	* file.
	*/
	gpg_error_t
	read_key_from_file (ctrl_t ctrl, const char fname, kbnode_t r_keyblock)
	{
	gpg_error_t err;
	iobuf_t inp;
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL;
	u32 keyid[2];
	int v3keys; /* Dummy */
	int non_self; /* Dummy */

	(void)ctrl;

	*r_keyblock = NULL;

	inp = iobuf_open (fname);
	if (!inp)
	err = gpg_error_from_syserror ();
	else if (is_secured_file (iobuf_get_fd (inp)))
	{
	iobuf_close (inp);
	inp = NULL;
	err = gpg_error (GPG_ERR_EPERM);
	}
	else
	err = 0;
	if (err)
	{
	log_error (_("can't open '%s': %s\n"),
	iobuf_is_pipe_filename (fname)? "[stdin]": fname,
	gpg_strerror (err));
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}

	/* Push the armor filter. */
	{
	armor_filter_context_t *afx;
	afx = new_armor_context ();
	afx->only_keyblocks = 1;
	push_armor_filter (afx, inp);
	release_armor_context (afx);
	}

	/* Read the first non-v3 keyblock. */
	while (!(err = read_block (inp, &pending_pkt, &keyblock, &v3keys)))
	{
	if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	break;
	log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);
	release_kbnode (keyblock);
	keyblock = NULL;
	}
	if (err)
	{
	if (gpg_err_code (err) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"),
	iobuf_is_pipe_filename (fname)? "[stdin]": fname,
	gpg_strerror (err));
	goto leave;
	}

	keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);

	if (!find_next_kbnode (keyblock, PKT_USER_ID))
	{
	err = gpg_error (GPG_ERR_NO_USER_ID);
	goto leave;
	}

	collapse_uids (&keyblock);

	clear_kbnode_flags (keyblock);
	if (chk_self_sigs (keyblock, keyid, &non_self))
	{
	err = gpg_error (GPG_ERR_INV_KEYRING);
	goto leave;
	}

	if (!delete_inv_parts (keyblock, keyid, 0) )
	{
	err = gpg_error (GPG_ERR_NO_USER_ID);
	goto leave;
	}

	*r_keyblock = keyblock;
	keyblock = NULL;

	leave:
	if (inp)
	{
	iobuf_close (inp);
	/* Must invalidate that ugly cache to actually close the file. */
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	}
	release_kbnode (keyblock);
	/* FIXME: Do we need to free PENDING_PKT ? */
	return err;
	}



	/*
	* Import the public keys from the given filename. Input may be armored.
	* This function rejects all keys which are not validly self signed on at
	* least one userid. Only user ids which are self signed will be imported.
	* Other signatures are not checked.
	*
	* Actually this function does a merge. It works like this:
	*
	* - get the keyblock
	* - check self-signatures and remove all userids and their signatures
	* without/invalid self-signatures.
	* - reject the keyblock, if we have no valid userid.
	* - See whether we have this key already in one of our pubrings.
	* If not, simply add it to the default keyring.
	* - Compare the key and the self-signatures of the new and the one in
	* our keyring. If they are different something weird is going on;
	* ask what to do.
	* - See whether we have only non-self-signature on one user id; if not
	* ask the user what to do.
	* - compare the signatures: If we already have this signature, check
	* that they compare okay; if not, issue a warning and ask the user.
	* (consider looking at the timestamp and use the newest?)
	* - Simply add the signature. Can't verify here because we may not have
	* the signature's public key yet; verification is done when putting it
	* into the trustdb, which is done automagically as soon as this pubkey
	* is used.
	* - Proceed with next signature.
	*
	* Key revocation certificates have special handling.
	*/
	static int
	import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
	import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options,
	import_screener_t screener, void *screener_arg)
	{
	int i;
	int rc = 0;
	struct import_stats_s *stats = stats_handle;

	if (!stats)
	stats = import_new_stats_handle ();

	if (inp)
	{
	rc = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options,
	screener, screener_arg);
	}
	else
	{
	if (!fnames && !nnames)
	nnames = 1; /* Ohh what a ugly hack to jump into the loop */

	for (i=0; i < nnames; i++)
	{
	const char *fname = fnames? fnames[i] : NULL;
	IOBUF inp2 = iobuf_open(fname);

	if (!fname)
	fname = "[stdin]";
	if (inp2 && is_secured_file (iobuf_get_fd (inp2)))
	{
	iobuf_close (inp2);
	inp2 = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp2)
	log_error (_("can't open '%s': %s\n"), fname, strerror (errno));
	else
	{
	rc = import (ctrl, inp2, fname, stats, fpr, fpr_len, options,
	screener, screener_arg);
	iobuf_close (inp2);
	/* Must invalidate that ugly cache to actually close it. */
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	if (rc)
	log_error ("import from '%s' failed: %s\n",
	fname, gpg_strerror (rc) );
	}
	if (!fname)
	break;
	}
	}

	if (!stats_handle)
	{
	import_print_stats (stats);
	import_release_stats_handle (stats);
	}

	/* If no fast import and the trustdb is dirty (i.e. we added a key
	or userID that had something other than a selfsig, a signature
	that was other than a selfsig, or any revocation), then
	update/check the trustdb if the user specified by setting
	interactive or by not setting no-auto-check-trustdb */

	if (!(options & IMPORT_FAST))
	check_or_update_trustdb (ctrl);

	return rc;
	}


	void
	import_keys (ctrl_t ctrl, char **fnames, int nnames,
	import_stats_t stats_handle, unsigned int options )
	{
	import_keys_internal (ctrl, NULL, fnames, nnames, stats_handle,
	NULL, NULL, options, NULL, NULL);
	}

	int
	import_keys_stream (ctrl_t ctrl, IOBUF inp, import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len, unsigned int options)
	{
	return import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
	fpr, fpr_len, options, NULL, NULL);
	}


	/* Variant of import_keys_stream reading from an estream_t. */
	int
	import_keys_es_stream (ctrl_t ctrl, estream_t fp,
	import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options,
	import_screener_t screener, void *screener_arg)
	{
	int rc;
	iobuf_t inp;

	inp = iobuf_esopen (fp, "rb", 1);
	if (!inp)
	{
	rc = gpg_error_from_syserror ();
	log_error ("iobuf_esopen failed: %s\n", gpg_strerror (rc));
	return rc;
	}

	rc = import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
	fpr, fpr_len, options,
	screener, screener_arg);

	iobuf_close (inp);
	return rc;
	}


	static int
	import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
	unsigned char *fpr,size_t fpr_len, unsigned int options,
	import_screener_t screener, void *screener_arg)
	{
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL; /* Need to initialize because gcc can't
	grasp the return semantics of
	read_block. */
	int rc = 0;
	int v3keys;

	getkey_disable_caches ();

	if (!opt.no_armor) /* Armored reading is not disabled. */
	{
	armor_filter_context_t *afx;

	afx = new_armor_context ();
	afx->only_keyblocks = 1;
	push_armor_filter (afx, inp);
	release_armor_context (afx);
	}

	while (!(rc = read_block (inp, &pending_pkt, &keyblock, &v3keys)))
	{
	stats->v3keys += v3keys;
	if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	rc = import_one (ctrl, keyblock,
	stats, fpr, fpr_len, options, 0, 0,
	screener, screener_arg);
	else if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	rc = import_secret_one (ctrl, keyblock, stats,
	opt.batch, options, 0,
	screener, screener_arg);
	else if (keyblock->pkt->pkttype == PKT_SIGNATURE
	&& keyblock->pkt->pkt.signature->sig_class == 0x20 )
	rc = import_revoke_cert (ctrl, keyblock, stats);
	else
	{
	log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);
	}
	release_kbnode (keyblock);

	/* fixme: we should increment the not imported counter but
	this does only make sense if we keep on going despite of
	errors. For now we do this only if the imported key is too
	large. */
	if (gpg_err_code (rc) == GPG_ERR_TOO_LARGE
	&& gpg_err_source (rc) == GPG_ERR_SOURCE_KEYBOX)
	{
	stats->not_imported++;
	}
	else if (rc)
	break;

	if (!(++stats->count % 100) && !opt.quiet)
	log_info (_("%lu keys processed so far\n"), stats->count );
	}
	stats->v3keys += v3keys;
	if (rc == -1)
	rc = 0;
	else if (rc && gpg_err_code (rc) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (rc));

	return rc;
	}


	/* Helper to migrate secring.gpg to GnuPG 2.1. */
	gpg_error_t
	import_old_secring (ctrl_t ctrl, const char *fname)
	{
	gpg_error_t err;
	iobuf_t inp;
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL; /* Need to initialize because gcc can't
	grasp the return semantics of
	read_block. */
	struct import_stats_s *stats;
	int v3keys;

	inp = iobuf_open (fname);
	if (inp && is_secured_file (iobuf_get_fd (inp)))
	{
	iobuf_close (inp);
	inp = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't open '%s': %s\n"), fname, gpg_strerror (err));
	return err;
	}

	getkey_disable_caches();
	stats = import_new_stats_handle ();
	while (!(err = read_block (inp, &pending_pkt, &keyblock, &v3keys)))
	{
	if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	err = import_secret_one (ctrl, keyblock, stats, 1, 0, 1,
	NULL, NULL);
	release_kbnode (keyblock);
	if (err)
	break;
	}
	import_release_stats_handle (stats);
	if (err == -1)
	err = 0;
	else if (err && gpg_err_code (err) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	else if (err)
	log_error ("import from '%s' failed: %s\n", fname, gpg_strerror (err));

	iobuf_close (inp);
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);

	return err;
	}


	void
	import_print_stats (import_stats_t stats)
	{
	if (!opt.quiet)
	{
	log_info(_("Total number processed: %lu\n"),
	stats->count + stats->v3keys);
	if (stats->v3keys)
	log_info(_(" skipped PGP-2 keys: %lu\n"), stats->v3keys);
	if (stats->skipped_new_keys )
	log_info(_(" skipped new keys: %lu\n"),
	stats->skipped_new_keys );
	if (stats->no_user_id )
	log_info(_(" w/o user IDs: %lu\n"), stats->no_user_id );
	if (stats->imported)
	{
	log_info(_(" imported: %lu"), stats->imported );
	log_printf ("\n");
	}
	if (stats->unchanged )
	log_info(_(" unchanged: %lu\n"), stats->unchanged );
	if (stats->n_uids )
	log_info(_(" new user IDs: %lu\n"), stats->n_uids );
	if (stats->n_subk )
	log_info(_(" new subkeys: %lu\n"), stats->n_subk );
	if (stats->n_sigs )
	log_info(_(" new signatures: %lu\n"), stats->n_sigs );
	if (stats->n_revoc )
	log_info(_(" new key revocations: %lu\n"), stats->n_revoc );
	if (stats->secret_read )
	log_info(_(" secret keys read: %lu\n"), stats->secret_read );
	if (stats->secret_imported )
	log_info(_(" secret keys imported: %lu\n"), stats->secret_imported );
	if (stats->secret_dups )
	log_info(_(" secret keys unchanged: %lu\n"), stats->secret_dups );
	if (stats->not_imported )
	log_info(_(" not imported: %lu\n"), stats->not_imported );
	if (stats->n_sigs_cleaned)
	log_info(_(" signatures cleaned: %lu\n"),stats->n_sigs_cleaned);
	if (stats->n_uids_cleaned)
	log_info(_(" user IDs cleaned: %lu\n"),stats->n_uids_cleaned);
	}

	if (is_status_enabled ())
	{
	char buf[15*20];

	snprintf (buf, sizeof buf,
	"%lu %lu %lu 0 %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu",
	stats->count + stats->v3keys,
	stats->no_user_id,
	stats->imported,
	stats->unchanged,
	stats->n_uids,
	stats->n_subk,
	stats->n_sigs,
	stats->n_revoc,
	stats->secret_read,
	stats->secret_imported,
	stats->secret_dups,
	stats->skipped_new_keys,
	stats->not_imported,
	stats->v3keys );
	write_status_text (STATUS_IMPORT_RES, buf);
	}
	}


	/* Return true if PKTTYPE is valid in a keyblock. */
	static int
	valid_keyblock_packet (int pkttype)
	{
	switch (pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_SIGNATURE:
	case PKT_USER_ID:
	case PKT_ATTRIBUTE:
	case PKT_RING_TRUST:
	return 1;
	default:
	return 0;
	}
	}


	/****************
	* Read the next keyblock from stream A.
	* PENDING_PKT should be initialzed to NULL
	* and not changed by the caller.
	* Return: 0 = okay, -1 no more blocks or another errorcode.
	* The int at at R_V3KEY counts the number of unsupported v3
	* keyblocks.
	*/
	static int
	read_block( IOBUF a, PACKET *pending_pkt, kbnode_t ret_root, int *r_v3keys)
	{
	int rc;
	PACKET *pkt;
	kbnode_t root = NULL;
	int in_cert, in_v3key;

	*r_v3keys = 0;

	if (*pending_pkt)
	{
	root = new_kbnode( *pending_pkt );
	*pending_pkt = NULL;
	in_cert = 1;
	}
	else
	in_cert = 0;

	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	in_v3key = 0;
	while ((rc=parse_packet(a, pkt)) != -1)
	{
	if (rc && (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY
	&& (pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY)))
	{
	in_v3key = 1;
	++*r_v3keys;
	free_packet (pkt);
	init_packet (pkt);
	continue;
	}
	else if (rc ) /* (ignore errors) */
	{
	if (gpg_err_code (rc) == GPG_ERR_UNKNOWN_PACKET)
	; /* Do not show a diagnostic. */
	else
	{
	log_error("read_block: read error: %s\n", gpg_strerror (rc) );
	rc = GPG_ERR_INV_KEYRING;
	goto ready;
	}
	free_packet( pkt );
	init_packet(pkt);
	continue;
	}

	if (in_v3key && !(pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY))
	{
	free_packet( pkt );
	init_packet(pkt);
	continue;
	}
	in_v3key = 0;

	if (!root && pkt->pkttype == PKT_SIGNATURE
	&& pkt->pkt.signature->sig_class == 0x20 )
	{
	/* This is a revocation certificate which is handled in a
	* special way. */
	root = new_kbnode( pkt );
	pkt = NULL;
	goto ready;
	}

	/* Make a linked list of all packets. */
	switch (pkt->pkttype)
	{
	case PKT_COMPRESSED:
	if (check_compress_algo (pkt->pkt.compressed->algorithm))
	{
	rc = GPG_ERR_COMPR_ALGO;
	goto ready;
	}
	else
	{
	compress_filter_context_t cfx = xmalloc_clear( sizeof cfx );
	pkt->pkt.compressed->buf = NULL;
	push_compress_filter2(a,cfx,pkt->pkt.compressed->algorithm,1);
	}
	free_packet( pkt );
	init_packet(pkt);
	break;

	case PKT_RING_TRUST:
	/* Skip those packets unless we are in restore mode. */
	if ((opt.import_options & IMPORT_RESTORE))
	goto x_default;
	free_packet( pkt );
	init_packet(pkt);
	break;

	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	if (in_cert ) /* Store this packet. */
	{
	*pending_pkt = pkt;
	pkt = NULL;
	goto ready;
	}
	in_cert = 1;
	default:
	x_default:
	if (in_cert && valid_keyblock_packet (pkt->pkttype))
	{
	if (!root )
	root = new_kbnode (pkt);
	else
	add_kbnode (root, new_kbnode (pkt));
	pkt = xmalloc (sizeof *pkt);
	}
	init_packet(pkt);
	break;
	}
	}

	ready:
	if (rc == -1 && root )
	rc = 0;

	if (rc )
	release_kbnode( root );
	else
	*ret_root = root;
	free_packet( pkt );
	xfree( pkt );
	return rc;
	}


	/* Walk through the subkeys on a pk to find if we have the PKS
	disease: multiple subkeys with their binding sigs stripped, and the
	sig for the first subkey placed after the last subkey. That is,
	instead of "pk uid sig sub1 bind1 sub2 bind2 sub3 bind3" we have
	"pk uid sig sub1 sub2 sub3 bind1". We can't do anything about sub2
	and sub3, as they are already lost, but we can try and rescue sub1
	by reordering the keyblock so that it reads "pk uid sig sub1 bind1
	sub2 sub3". Returns TRUE if the keyblock was modified. */
	static int
	fix_pks_corruption (kbnode_t keyblock)
	{
	int changed = 0;
	int keycount = 0;
	kbnode_t node;
	kbnode_t last = NULL;
	kbnode_t sknode=NULL;

	/* First determine if we have the problem at all. Look for 2 or
	more subkeys in a row, followed by a single binding sig. */
	for (node=keyblock; node; last=node, node=node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	keycount++;
	if(!sknode)
	sknode=node;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& node->pkt->pkt.signature->sig_class == 0x18
	&& keycount >= 2
	&& !node->next)
	{
	/* We might have the problem, as this key has two subkeys in
	a row without any intervening packets. */

	/* Sanity check */
	if (!last)
	break;

	/* Temporarily attach node to sknode. */
	node->next = sknode->next;
	sknode->next = node;
	last->next = NULL;

	/* Note we aren't checking whether this binding sig is a
	selfsig. This is not necessary here as the subkey and
	binding sig will be rejected later if that is the
	case. */
	if (check_key_signature (keyblock,node,NULL))
	{
	/* Not a match, so undo the changes. */
	sknode->next = node->next;
	last->next = node;
	node->next = NULL;
	break;
	}
	else
	{
	/* Mark it good so we don't need to check it again */
	sknode->flag \|= NODE_GOOD_SELFSIG;
	changed = 1;
	break;
	}
	}
	else
	keycount = 0;
	}

	return changed;
	}


	/* Versions of GnuPG before 1.4.11 and 2.0.16 allowed to import bogus
	direct key signatures. A side effect of this was that a later
	import of the same good direct key signatures was not possible
	because the cmp_signature check in merge_blocks considered them
	equal. Although direct key signatures are now checked during
	import, there might still be bogus signatures sitting in a keyring.
	We need to detect and delete them before doing a merge. This
	function returns the number of removed sigs. */
	static int
	fix_bad_direct_key_sigs (kbnode_t keyblock, u32 *keyid)
	{
	gpg_error_t err;
	kbnode_t node;
	int count = 0;

	for (node = keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	break;
	if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_SIG (node->pkt->pkt.signature))
	{
	err = check_key_signature (keyblock, node, NULL);
	if (err && gpg_err_code (err) != GPG_ERR_PUBKEY_ALGO )
	{
	/* If we don't know the error, we can't decide; this is
	not a problem because cmp_signature can't compare the
	signature either. */
	log_info ("key %s: invalid direct key signature removed\n",
	keystr (keyid));
	delete_kbnode (node);
	count++;
	}
	}
	}

	return count;
	}


	static void
	print_import_ok (PKT_public_key *pk, unsigned int reason)
	{
	byte array[MAX_FINGERPRINT_LEN], *s;
	char buf[MAX_FINGERPRINT_LEN2+30], p;
	size_t i, n;

	snprintf (buf, sizeof buf, "%u ", reason);
	p = buf + strlen (buf);

	fingerprint_from_pk (pk, array, &n);
	s = array;
	for (i=0; i < n ; i++, s++, p += 2)
	sprintf (p, "%02X", *s);

	write_status_text (STATUS_IMPORT_OK, buf);
	}


	static void
	print_import_check (PKT_public_key * pk, PKT_user_id * id)
	{
	char * buf;
	byte fpr[24];
	u32 keyid[2];
	size_t i, n;
	size_t pos = 0;

	buf = xmalloc (17+41+id->len+32);
	keyid_from_pk (pk, keyid);
	sprintf (buf, "%08X%08X ", keyid[0], keyid[1]);
	pos = 17;
	fingerprint_from_pk (pk, fpr, &n);
	for (i = 0; i < n; i++, pos += 2)
	sprintf (buf+pos, "%02X", fpr[i]);
	strcat (buf, " ");
	strcat (buf, id->name);
	write_status_text (STATUS_IMPORT_CHECK, buf);
	xfree (buf);
	}


	static void
	check_prefs_warning(PKT_public_key *pk)
	{
	log_info(_("WARNING: key %s contains preferences for unavailable\n"
	"algorithms on these user IDs:\n"), keystr_from_pk(pk));
	}


	static void
	check_prefs (ctrl_t ctrl, kbnode_t keyblock)
	{
	kbnode_t node;
	PKT_public_key *pk;
	int problem=0;

	merge_keys_and_selfsig(keyblock);
	pk=keyblock->pkt->pkt.public_key;

	for(node=keyblock;node;node=node->next)
	{
	if(node->pkt->pkttype==PKT_USER_ID
	&& node->pkt->pkt.user_id->created
	&& node->pkt->pkt.user_id->prefs)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	prefitem_t *prefs = uid->prefs;
	char *user = utf8_to_native(uid->name,strlen(uid->name),0);

	for(;prefs->type;prefs++)
	{
	char num[10]; /* prefs->value is a byte, so we're over
	safe here */

	sprintf(num,"%u",prefs->value);

	if(prefs->type==PREFTYPE_SYM)
	{
	if (openpgp_cipher_test_algo (prefs->value))
	{
	const char *algo =
	(openpgp_cipher_test_algo (prefs->value)
	? num
	: openpgp_cipher_algo_name (prefs->value));
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for cipher"
	" algorithm %s\n"), user, algo);
	problem=1;
	}
	}
	else if(prefs->type==PREFTYPE_HASH)
	{
	if(openpgp_md_test_algo(prefs->value))
	{
	const char *algo =
	(gcry_md_test_algo (prefs->value)
	? num
	: gcry_md_algo_name (prefs->value));
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for digest"
	" algorithm %s\n"), user, algo);
	problem=1;
	}
	}
	else if(prefs->type==PREFTYPE_ZIP)
	{
	if(check_compress_algo (prefs->value))
	{
	const char *algo=compress_algo_to_string(prefs->value);
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for compression"
	" algorithm %s\n"),user,algo?algo:num);
	problem=1;
	}
	}
	}

	xfree(user);
	}
	}

	if(problem)
	{
	log_info(_("it is strongly suggested that you update"
	" your preferences and\n"));
	log_info(_("re-distribute this key to avoid potential algorithm"
	" mismatch problems\n"));

	if(!opt.batch)
	{
	strlist_t sl = NULL;
	strlist_t locusr = NULL;
	size_t fprlen=0;
	byte fpr[MAX_FINGERPRINT_LEN], *p;
	char username[(MAX_FINGERPRINT_LEN*2)+1];
	unsigned int i;

	p = fingerprint_from_pk (pk,fpr,&fprlen);
	for(i=0;i<fprlen;i++,p++)
	sprintf(username+2i,"%02X",p);
	add_to_strlist(&locusr,username);

	append_to_strlist(&sl,"updpref");
	append_to_strlist(&sl,"save");

	keyedit_menu (ctrl, username, locusr, sl, 1, 1 );
	free_strlist(sl);
	free_strlist(locusr);
	}
	else if(!opt.quiet)
	log_info(_("you can update your preferences with:"
	" gpg --edit-key %s updpref save\n"),keystr_from_pk(pk));
	}
	}


	/* Helper for apply__filter in im,port.c and export.c. /
	const char *
	impex_filter_getval (void cookie, const char propname)
	{
	/* FIXME: Malloc our static buffers and access them via the cookie. */
	kbnode_t node = cookie;
	static char numbuf[20];
	const char *result;

	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (!strcmp (propname, "uid"))
	result = node->pkt->pkt.user_id->name;
	else if (!strcmp (propname, "mbox"))
	{
	if (!node->pkt->pkt.user_id->mbox)
	{
	node->pkt->pkt.user_id->mbox
	= mailbox_from_userid (node->pkt->pkt.user_id->name);
	}
	result = node->pkt->pkt.user_id->mbox;
	}
	else if (!strcmp (propname, "primary"))
	result = node->pkt->pkt.user_id->is_primary? "1":"0";
	else
	result = NULL;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	\|\| node->pkt->pkttype == PKT_ATTRIBUTE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;

	if (!strcmp (propname, "sig_created"))
	{
	snprintf (numbuf, sizeof numbuf, "%lu", (ulong)sig->timestamp);
	result = numbuf;
	}
	else if (!strcmp (propname, "sig_created_d"))
	{
	result = datestr_from_sig (sig);
	}
	else if (!strcmp (propname, "sig_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", sig->pubkey_algo);
	result = numbuf;
	}
	else if (!strcmp (propname, "sig_digest_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", sig->digest_algo);
	result = numbuf;
	}
	else
	result = NULL;
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	if (!strcmp (propname, "secret"))
	{
	result = (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)? "1":"0";
	}
	else if (!strcmp (propname, "key_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", pk->pubkey_algo);
	result = numbuf;
	}
	if (!strcmp (propname, "key_created"))
	{
	snprintf (numbuf, sizeof numbuf, "%lu", (ulong)pk->timestamp);
	result = numbuf;
	}
	else if (!strcmp (propname, "key_created_d"))
	{
	result = datestr_from_pk (pk);
	}
	else
	result = NULL;
	}
	else
	result = NULL;

	return result;
	}


	/*
	* Apply the keep-uid filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_keep_uid_filter (kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;

	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (!recsel_select (selector, impex_filter_getval, node))
	{

	/* log_debug ("keep-uid: deleting '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	/* The UID packet and all following packets up to the
	* next UID or a subkey. */
	delete_kbnode (node);
	for (; node->next
	&& node->next->pkt->pkttype != PKT_USER_ID
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ;
	node = node->next)
	delete_kbnode (node->next);
	}
	/* else */
	/* log_debug ("keep-uid: keeping '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	}
	}
	}


	/*
	* Apply the drop-sig filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_drop_sig_filter (kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;
	int active = 0;
	u32 main_keyid[2];
	PKT_signature *sig;

	keyid_from_pk (keyblock->pkt->pkt.public_key, main_keyid);

	/* Loop over all signatures for user id and attribute packets which
	* are not self signatures. */
	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	break; /* ready. */
	if (node->pkt->pkttype == PKT_USER_ID)
	active = 1;
	if (!active)
	continue;
	if (node->pkt->pkttype != PKT_SIGNATURE
	&& node->pkt->pkttype != PKT_ATTRIBUTE)
	continue;

	sig = node->pkt->pkt.signature;
	if (main_keyid[0] == sig->keyid[0] \|\| main_keyid[1] == sig->keyid[1])
	continue; /* Skip self-signatures. */

	if (IS_UID_SIG(sig) \|\| IS_UID_REV(sig))
	{
	if (recsel_select (selector, impex_filter_getval, node))
	delete_kbnode (node);
	}
	}
	}


	/*
	* Try to import one keyblock. Return an error only in serious cases,
	* but never for an invalid keyblock. It uses log_error to increase
	* the internal errorcount, so that invalid input can be detected by
	* programs which called gpg. If SILENT is no messages are printed -
	* even most error messages are suppressed.
	*/
	static int
	import_one (ctrl_t ctrl,
	kbnode_t keyblock, struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len, unsigned int options,
	int from_sk, int silent,
	import_screener_t screener, void *screener_arg)
	{
	PKT_public_key *pk;
	PKT_public_key *pk_orig = NULL;
	kbnode_t node, uidnode;
	kbnode_t keyblock_orig = NULL;
	byte fpr2[MAX_FINGERPRINT_LEN];
	size_t fpr2len;
	u32 keyid[2];
	int rc = 0;
	int new_key = 0;
	int mod_key = 0;
	int same_key = 0;
	int non_self = 0;
	size_t an;
	char pkstrbuf[PUBKEY_STRING_SIZE];
	int merge_keys_done = 0;
	int any_filter = 0;

	/* Get the key and print some info about it. */
	node = find_kbnode( keyblock, PKT_PUBLIC_KEY );
	if (!node )
	BUG();

	pk = node->pkt->pkt.public_key;

	fingerprint_from_pk (pk, fpr2, &fpr2len);
	for (an = fpr2len; an < MAX_FINGERPRINT_LEN; an++)
	fpr2[an] = 0;
	keyid_from_pk( pk, keyid );
	uidnode = find_next_kbnode( keyblock, PKT_USER_ID );

	if (opt.verbose && !opt.interactive && !silent)
	{
	log_info( "pub %s/%s %s ",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk(pk), datestr_from_pk(pk) );
	if (uidnode)
	print_utf8_buffer (log_get_stream (),
	uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len );
	log_printf ("\n");
	}


	if (!uidnode )
	{
	if (!silent)
	log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
	return 0;
	}

	if (screener && screener (keyblock, screener_arg))
	{
	log_error (_("key %s: %s\n"), keystr_from_pk (pk),
	_("rejected by import screener"));
	return 0;
	}

	if (opt.interactive && !silent)
	{
	if (is_status_enabled())
	print_import_check (pk, uidnode->pkt->pkt.user_id);
	merge_keys_and_selfsig (keyblock);
	tty_printf ("\n");
	show_basic_key_info (keyblock);
	tty_printf ("\n");
	if (!cpr_get_answer_is_yes ("import.okay",
	"Do you want to import this key? (y/N) "))
	return 0;
	}

	collapse_uids(&keyblock);

	/* Clean the key that we're about to import, to cut down on things
	that we have to clean later. This has no practical impact on the
	end result, but does result in less logging which might confuse
	the user. */
	if (options&IMPORT_CLEAN)
	clean_key (keyblock,opt.verbose,options&IMPORT_MINIMAL,NULL,NULL);

	clear_kbnode_flags( keyblock );

	if ((options&IMPORT_REPAIR_PKS_SUBKEY_BUG) && fix_pks_corruption(keyblock)
	&& opt.verbose)
	log_info (_("key %s: PKS subkey corruption repaired\n"),
	keystr_from_pk(pk));

	if (chk_self_sigs (keyblock, keyid, &non_self))
	return 0; /* Invalid keyblock - error already printed. */

	/* If we allow such a thing, mark unsigned uids as valid */
	if (opt.allow_non_selfsigned_uid)
	{
	for (node=keyblock; node; node = node->next )
	if (node->pkt->pkttype == PKT_USER_ID
	&& !(node->flag & NODE_GOOD_SELFSIG)
	&& !(node->flag & NODE_BAD_SELFSIG) )
	{
	char *user=utf8_to_native(node->pkt->pkt.user_id->name,
	node->pkt->pkt.user_id->len,0);
	/* Fake a good signature status for the user id. */
	node->flag \|= NODE_GOOD_SELFSIG;
	log_info( _("key %s: accepted non self-signed user ID \"%s\"\n"),
	keystr_from_pk(pk),user);
	xfree(user);
	}
	}

	if (!delete_inv_parts (keyblock, keyid, options ) )
	{
	if (!silent)
	{
	log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
	if (!opt.quiet )
	log_info(_("this may be caused by a missing self-signature\n"));
	}
	stats->no_user_id++;
	return 0;
	}

	/* Get rid of deleted nodes. */
	commit_kbnode (&keyblock);

	/* Apply import filter. */
	if (import_filter.keep_uid)
	{
	apply_keep_uid_filter (keyblock, import_filter.keep_uid);
	commit_kbnode (&keyblock);
	any_filter = 1;
	}
	if (import_filter.drop_sig)
	{
	apply_drop_sig_filter (keyblock, import_filter.drop_sig);
	commit_kbnode (&keyblock);
	any_filter = 1;
	}

	/* If we ran any filter we need to check that at least one user id
	* is left in the keyring. Note that we do not use log_error in
	* this case. */
	if (any_filter && !any_uid_left (keyblock))
	{
	if (!opt.quiet )
	log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
	stats->no_user_id++;
	return 0;
	}

	/* Show the key in the form it is merged or inserted. We skip this
	* if "import-export" is also active without --armor or the output
	* file has explicily been given. */
	if ((options & IMPORT_SHOW)
	&& !((options & IMPORT_EXPORT) && !opt.armor && !opt.outfile))
	{
	merge_keys_and_selfsig (keyblock);
	merge_keys_done = 1;
	/* Note that we do not want to show the validity because the key
	* has not yet imported. */
	list_keyblock_direct (ctrl, keyblock, 0, 0, 1, 1);
	es_fflush (es_stdout);
	}

	/* Write the keyblock to the output and do not actually import. */
	if ((options & IMPORT_EXPORT))
	{
	if (!merge_keys_done)
	{
	merge_keys_and_selfsig (keyblock);
	merge_keys_done = 1;
	}
	rc = write_keyblock_to_output (keyblock, opt.armor, opt.export_options);
	goto leave;
	}

	if (opt.dry_run)
	goto leave;

	/* Do we have this key already in one of our pubrings ? */
	pk_orig = xmalloc_clear( sizeof *pk_orig );
	rc = get_pubkey_byfprint_fast (pk_orig, fpr2, fpr2len);
	if (rc && gpg_err_code (rc) != GPG_ERR_NO_PUBKEY
	&& gpg_err_code (rc) != GPG_ERR_UNUSABLE_PUBKEY )
	{
	if (!silent)
	log_error (_("key %s: public key not found: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	}
	else if ( rc && (opt.import_options&IMPORT_MERGE_ONLY) )
	{
	if (opt.verbose && !silent )
	log_info( _("key %s: new key - skipped\n"), keystr(keyid));
	rc = 0;
	stats->skipped_new_keys++;
	}
	else if (rc ) /* Insert this key. */
	{
	KEYDB_HANDLE hd;

	hd = keydb_new ();
	if (!hd)
	return gpg_error_from_syserror ();

	rc = keydb_locate_writable (hd);
	if (rc)
	{
	log_error (_("no writable keyring found: %s\n"), gpg_strerror (rc));
	keydb_release (hd);
	return GPG_ERR_GENERAL;
	}
	if (opt.verbose > 1 )
	log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) );

	rc = keydb_insert_keyblock (hd, keyblock );
	if (rc)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (rc));
	else if (!(opt.import_options & IMPORT_KEEP_OWNERTTRUST))
	{
	/* This should not be possible since we delete the
	ownertrust when a key is deleted, but it can happen if
	the keyring and trustdb are out of sync. It can also
	be made to happen with the trusted-key command and by
	importing and locally exported key. */

	clear_ownertrusts (pk);
	if (non_self)
	revalidation_mark ();
	}
	keydb_release (hd);

	/* We are ready. */
	if (!opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (fpr2);
	log_info (_("key %s: public key \"%s\" imported\n"),
	keystr(keyid), p);
	xfree(p);
	}
	if (is_status_enabled())
	{
	char *us = get_long_user_id_string( keyid );
	write_status_text( STATUS_IMPORTED, us );
	xfree(us);
	print_import_ok (pk, 1);
	}
	stats->imported++;
	new_key = 1;
	}
	else /* merge */
	{
	KEYDB_HANDLE hd;
	int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned;

	/* Compare the original against the new key; just to be sure nothing
	* weird is going on */
	if (cmp_public_keys( pk_orig, pk ) )
	{
	if (!silent)
	log_error( _("key %s: doesn't match our copy\n"),keystr(keyid));
	goto leave;
	}

	/* Now read the original keyblock again so that we can use
	that handle for updating the keyblock. */
	hd = keydb_new ();
	if (!hd)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	keydb_disable_caching (hd);
	rc = keydb_search_fpr (hd, fpr2);
	if (rc )
	{
	log_error (_("key %s: can't locate original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	keydb_release (hd);
	goto leave;
	}
	rc = keydb_get_keyblock (hd, &keyblock_orig);
	if (rc)
	{
	log_error (_("key %s: can't read original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	keydb_release (hd);
	goto leave;
	}

	/* Make sure the original direct key sigs are all sane. */
	n_sigs_cleaned = fix_bad_direct_key_sigs (keyblock_orig, keyid);
	if (n_sigs_cleaned)
	commit_kbnode (&keyblock_orig);

	/* and try to merge the block */
	clear_kbnode_flags( keyblock_orig );
	clear_kbnode_flags( keyblock );
	n_uids = n_sigs = n_subk = n_uids_cleaned = 0;
	rc = merge_blocks (keyblock_orig, keyblock,
	keyid, &n_uids, &n_sigs, &n_subk );
	if (rc )
	{
	keydb_release (hd);
	goto leave;
	}

	if ((options & IMPORT_CLEAN))
	clean_key (keyblock_orig,opt.verbose,options&IMPORT_MINIMAL,
	&n_uids_cleaned,&n_sigs_cleaned);

	if (n_uids \|\| n_sigs \|\| n_subk \|\| n_sigs_cleaned \|\| n_uids_cleaned)
	{
	mod_key = 1;
	/* KEYBLOCK_ORIG has been updated; write */
	rc = keydb_update_keyblock (ctrl, hd, keyblock_orig);
	if (rc)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (rc) );
	else if (non_self)
	revalidation_mark ();

	/* We are ready. */
	if (!opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (fpr2);
	if (n_uids == 1 )
	log_info( _("key %s: \"%s\" 1 new user ID\n"),
	keystr(keyid),p);
	else if (n_uids )
	log_info( _("key %s: \"%s\" %d new user IDs\n"),
	keystr(keyid),p,n_uids);
	if (n_sigs == 1 )
	log_info( _("key %s: \"%s\" 1 new signature\n"),
	keystr(keyid), p);
	else if (n_sigs )
	log_info( _("key %s: \"%s\" %d new signatures\n"),
	keystr(keyid), p, n_sigs );
	if (n_subk == 1 )
	log_info( _("key %s: \"%s\" 1 new subkey\n"),
	keystr(keyid), p);
	else if (n_subk )
	log_info( _("key %s: \"%s\" %d new subkeys\n"),
	keystr(keyid), p, n_subk );
	if (n_sigs_cleaned==1)
	log_info(_("key %s: \"%s\" %d signature cleaned\n"),
	keystr(keyid),p,n_sigs_cleaned);
	else if (n_sigs_cleaned)
	log_info(_("key %s: \"%s\" %d signatures cleaned\n"),
	keystr(keyid),p,n_sigs_cleaned);
	if (n_uids_cleaned==1)
	log_info(_("key %s: \"%s\" %d user ID cleaned\n"),
	keystr(keyid),p,n_uids_cleaned);
	else if (n_uids_cleaned)
	log_info(_("key %s: \"%s\" %d user IDs cleaned\n"),
	keystr(keyid),p,n_uids_cleaned);
	xfree(p);
	}

	stats->n_uids +=n_uids;
	stats->n_sigs +=n_sigs;
	stats->n_subk +=n_subk;
	stats->n_sigs_cleaned +=n_sigs_cleaned;
	stats->n_uids_cleaned +=n_uids_cleaned;

	if (is_status_enabled () && !silent)
	print_import_ok (pk, ((n_uids?2:0)\|(n_sigs?4:0)\|(n_subk?8:0)));
	}
	else
	{
	same_key = 1;
	if (is_status_enabled ())
	print_import_ok (pk, 0);

	if (!opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (fpr2);
	log_info( _("key %s: \"%s\" not changed\n"),keystr(keyid),p);
	xfree(p);
	}

	stats->unchanged++;
	}

	keydb_release (hd); hd = NULL;
	}

	leave:
	if (mod_key \|\| new_key \|\| same_key)
	{
	/* A little explanation for this: we fill in the fingerprint
	when importing keys as it can be useful to know the
	fingerprint in certain keyserver-related cases (a keyserver
	asked for a particular name, but the key doesn't have that
	name). However, in cases where we're importing more than
	one key at a time, we cannot know which key to fingerprint.
	In these cases, rather than guessing, we do not
	fingerprinting at all, and we must hope the user ID on the
	keys are useful. Note that we need to do this for new
	keys, merged keys and even for unchanged keys. This is
	required because for example the --auto-key-locate feature
	may import an already imported key and needs to know the
	fingerprint of the key in all cases. */
	if (fpr)
	{
	xfree (*fpr);
	/* Note that we need to compare against 0 here because
	COUNT gets only incremented after returning from this
	function. */
	if (!stats->count)
	*fpr = fingerprint_from_pk (pk, NULL, fpr_len);
	else
	*fpr = NULL;
	}
	}

	/* Now that the key is definitely incorporated into the keydb, we
	need to check if a designated revocation is present or if the
	prefs are not rational so we can warn the user. */

	if (mod_key)
	{
	revocation_present (ctrl, keyblock_orig);
	if (!from_sk && have_secret_key_with_kid (keyid))
	check_prefs (ctrl, keyblock_orig);
	}
	else if (new_key)
	{
	revocation_present (ctrl, keyblock);
	if (!from_sk && have_secret_key_with_kid (keyid))
	check_prefs (ctrl, keyblock);
	}

	release_kbnode( keyblock_orig );
	free_public_key( pk_orig );

	return rc;
	}


	/* Transfer all the secret keys in SEC_KEYBLOCK to the gpg-agent. The
	function prints diagnostics and returns an error code. If BATCH is
	true the secret keys are stored by gpg-agent in the transfer format
	(i.e. no re-protection and aksing for passphrases). */
	gpg_error_t
	transfer_secret_keys (ctrl_t ctrl, struct import_stats_s *stats,
	kbnode_t sec_keyblock, int batch, int force)
	{
	gpg_error_t err = 0;
	void *kek = NULL;
	size_t keklen;
	kbnode_t ctx = NULL;
	kbnode_t node;
	PKT_public_key main_pk, pk;
	struct seckey_info *ski;
	int nskey;
	membuf_t mbuf;
	int i, j;
	void format_args[2PUBKEY_MAX_NSKEY];
	gcry_sexp_t skey, prot, tmpsexp;
	gcry_sexp_t curve = NULL;
	unsigned char *transferkey = NULL;
	size_t transferkeylen;
	gcry_cipher_hd_t cipherhd = NULL;
	unsigned char *wrappedkey = NULL;
	size_t wrappedkeylen;
	char *cache_nonce = NULL;
	int stub_key_skipped = 0;

	/* Get the current KEK. */
	err = agent_keywrap_key (ctrl, 0, &kek, &keklen);
	if (err)
	{
	log_error ("error getting the KEK: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Prepare a cipher context. */
	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (!err)
	err = gcry_cipher_setkey (cipherhd, kek, keklen);
	if (err)
	goto leave;
	xfree (kek);
	kek = NULL;

	main_pk = NULL;
	while ((node = walk_kbnode (sec_keyblock, &ctx, 0)))
	{
	if (node->pkt->pkttype != PKT_SECRET_KEY
	&& node->pkt->pkttype != PKT_SECRET_SUBKEY)
	continue;
	pk = node->pkt->pkt.public_key;
	if (!main_pk)
	main_pk = pk;

	/* Make sure the keyids are available. */
	keyid_from_pk (pk, NULL);
	if (node->pkt->pkttype == PKT_SECRET_KEY)
	{
	pk->main_keyid[0] = pk->keyid[0];
	pk->main_keyid[1] = pk->keyid[1];
	}
	else
	{
	pk->main_keyid[0] = main_pk->keyid[0];
	pk->main_keyid[1] = main_pk->keyid[1];
	}


	ski = pk->seckey_info;
	if (!ski)
	BUG ();

	if (stats)
	{
	stats->count++;
	stats->secret_read++;
	}

	/* We ignore stub keys. The way we handle them in other parts
	of the code is by asking the agent whether any secret key is
	available for a given keyblock and then concluding that we
	have a secret key; all secret (sub)keys of the keyblock the
	agent does not know of are then stub keys. This works also
	for card stub keys. The learn command or the card-status
	command may be used to check with the agent whether a card
	has been inserted and a stub key is in turn generated by the
	agent. */
	if (ski->s2k.mode == 1001 \|\| ski->s2k.mode == 1002)
	{
	stub_key_skipped = 1;
	continue;
	}

	/* Convert our internal secret key object into an S-expression. */
	nskey = pubkey_get_nskey (pk->pubkey_algo);
	if (!nskey \|\| nskey > PUBKEY_MAX_NSKEY)
	{
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	log_error ("internal error: %s\n", gpg_strerror (err));
	goto leave;
	}

	init_membuf (&mbuf, 50);
	put_membuf_str (&mbuf, "(skey");
	if (pk->pubkey_algo == PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_EDDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	/* The ECC case. */
	char *curvestr = openpgp_oid_to_str (pk->pkey[0]);
	if (!curvestr)
	err = gpg_error_from_syserror ();
	else
	{
	const char *curvename = openpgp_oid_to_curve (curvestr, 1);
	gcry_sexp_release (curve);
	err = gcry_sexp_build (&curve, NULL, "(curve %s)",
	curvename?curvename:curvestr);
	xfree (curvestr);
	if (!err)
	{
	j = 0;
	/* Append the public key element Q. */
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + 1;

	/* Append the secret key element D. For ECDH we
	skip PKEY[2] because this holds the KEK which is
	not needed by gpg-agent. */
	i = pk->pubkey_algo == PUBKEY_ALGO_ECDH? 3 : 2;
	if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_USER1))
	put_membuf_str (&mbuf, " e %m");
	else
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + i;
	}
	}
	}
	else
	{
	/* Standard case for the old (non-ECC) algorithms. */
	for (i=j=0; i < nskey; i++)
	{
	if (!pk->pkey[i])
	continue; /* Protected keys only have NPKEY+1 elements. */

	if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_USER1))
	put_membuf_str (&mbuf, " e %m");
	else
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + i;
	}
	}
	put_membuf_str (&mbuf, ")");
	put_membuf (&mbuf, "", 1);
	if (err)
	xfree (get_membuf (&mbuf, NULL));
	else
	{
	char *format = get_membuf (&mbuf, NULL);
	if (!format)
	err = gpg_error_from_syserror ();
	else
	err = gcry_sexp_build_array (&skey, NULL, format, format_args);
	xfree (format);
	}
	if (err)
	{
	log_error ("error building skey array: %s\n", gpg_strerror (err));
	goto leave;
	}

	if (ski->is_protected)
	{
	char countbuf[35];

	/* Note that the IVLEN may be zero if we are working on a
	dummy key. We can't express that in an S-expression and
	thus we send dummy data for the IV. */
	snprintf (countbuf, sizeof countbuf, "%lu",
	(unsigned long)ski->s2k.count);
	err = gcry_sexp_build
	(&prot, NULL,
	" (protection %s %s %b %d %s %b %s)\n",
	ski->sha1chk? "sha1":"sum",
	openpgp_cipher_algo_name (ski->algo),
	ski->ivlen? (int)ski->ivlen:1,
	ski->ivlen? ski->iv: (const unsigned char*)"X",
	ski->s2k.mode,
	openpgp_md_algo_name (ski->s2k.hash_algo),
	(int)sizeof (ski->s2k.salt), ski->s2k.salt,
	countbuf);
	}
	else
	err = gcry_sexp_build (&prot, NULL, " (protection none)\n");

	tmpsexp = NULL;
	xfree (transferkey);
	transferkey = NULL;
	if (!err)
	err = gcry_sexp_build (&tmpsexp, NULL,
	"(openpgp-private-key\n"
	" (version %d)\n"
	" (algo %s)\n"
	" %S%S\n"
	" (csum %d)\n"
	" %S)\n",
	pk->version,
	openpgp_pk_algo_name (pk->pubkey_algo),
	curve, skey,
	(int)(unsigned long)ski->csum, prot);
	gcry_sexp_release (skey);
	gcry_sexp_release (prot);
	if (!err)
	err = make_canon_sexp_pad (tmpsexp, 1, &transferkey, &transferkeylen);
	gcry_sexp_release (tmpsexp);
	if (err)
	{
	log_error ("error building transfer key: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Wrap the key. */
	wrappedkeylen = transferkeylen + 8;
	xfree (wrappedkey);
	wrappedkey = xtrymalloc (wrappedkeylen);
	if (!wrappedkey)
	err = gpg_error_from_syserror ();
	else
	err = gcry_cipher_encrypt (cipherhd, wrappedkey, wrappedkeylen,
	transferkey, transferkeylen);
	if (err)
	goto leave;
	xfree (transferkey);
	transferkey = NULL;

	/* Send the wrapped key to the agent. */
	{
	char *desc = gpg_format_keydesc (pk, FORMAT_KEYDESC_IMPORT, 1);
	err = agent_import_key (ctrl, desc, &cache_nonce,
	wrappedkey, wrappedkeylen, batch, force);
	xfree (desc);
	}
	if (!err)
	{
	if (opt.verbose)
	log_info (_("key %s: secret key imported\n"),
	keystr_from_pk_with_sub (main_pk, pk));
	if (stats)
	stats->secret_imported++;
	}
	else if ( gpg_err_code (err) == GPG_ERR_EEXIST )
	{
	if (opt.verbose)
	log_info (_("key %s: secret key already exists\n"),
	keystr_from_pk_with_sub (main_pk, pk));
	err = 0;
	if (stats)
	stats->secret_dups++;
	}
	else
	{
	log_error (_("key %s: error sending to agent: %s\n"),
	keystr_from_pk_with_sub (main_pk, pk),
	gpg_strerror (err));
	if (gpg_err_code (err) == GPG_ERR_CANCELED
	\|\| gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	break; /* Don't try the other subkeys. */
	}
	}

	if (!err && stub_key_skipped)
	/* We need to notify user how to migrate stub keys. */
	err = gpg_error (GPG_ERR_NOT_PROCESSED);

	leave:
	gcry_sexp_release (curve);
	xfree (cache_nonce);
	xfree (wrappedkey);
	xfree (transferkey);
	gcry_cipher_close (cipherhd);
	xfree (kek);
	return err;
	}


	/* Walk a secret keyblock and produce a public keyblock out of it.
	Returns a new node or NULL on error. */
	static kbnode_t
	sec_to_pub_keyblock (kbnode_t sec_keyblock)
	{
	kbnode_t pub_keyblock = NULL;
	kbnode_t ctx = NULL;
	kbnode_t secnode, pubnode;

	while ((secnode = walk_kbnode (sec_keyblock, &ctx, 0)))
	{
	if (secnode->pkt->pkttype == PKT_SECRET_KEY
	\|\| secnode->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	/* Make a public key. */
	PACKET *pkt;
	PKT_public_key *pk;

	pkt = xtrycalloc (1, sizeof *pkt);
	pk = pkt? copy_public_key (NULL, secnode->pkt->pkt.public_key): NULL;
	if (!pk)
	{
	xfree (pkt);
	release_kbnode (pub_keyblock);
	return NULL;
	}
	if (secnode->pkt->pkttype == PKT_SECRET_KEY)
	pkt->pkttype = PKT_PUBLIC_KEY;
	else
	pkt->pkttype = PKT_PUBLIC_SUBKEY;
	pkt->pkt.public_key = pk;

	pubnode = new_kbnode (pkt);
	}
	else
	{
	pubnode = clone_kbnode (secnode);
	}

	if (!pub_keyblock)
	pub_keyblock = pubnode;
	else
	add_kbnode (pub_keyblock, pubnode);
	}

	return pub_keyblock;
	}

	/****************
	* Ditto for secret keys. Handling is simpler than for public keys.
	* We allow secret key importing only when allow is true, this is so
	* that a secret key can not be imported accidentally and thereby tampering
	* with the trust calculation.
	*/
	static int
	import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
	struct import_stats_s *stats, int batch, unsigned int options,
	int for_migration,
	import_screener_t screener, void *screener_arg)
	{
	PKT_public_key *pk;
	struct seckey_info *ski;
	kbnode_t node, uidnode;
	u32 keyid[2];
	int rc = 0;
	int nr_prev;
	kbnode_t pub_keyblock;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* Get the key and print some info about it */
	node = find_kbnode (keyblock, PKT_SECRET_KEY);
	if (!node)
	BUG ();

	pk = node->pkt->pkt.public_key;

	keyid_from_pk (pk, keyid);
	uidnode = find_next_kbnode (keyblock, PKT_USER_ID);

	if (screener && screener (keyblock, screener_arg))
	{
	log_error (_("secret key %s: %s\n"), keystr_from_pk (pk),
	_("rejected by import screener"));
	return 0;
	}

	if (opt.verbose && !for_migration)
	{
	log_info ("sec %s/%s %s ",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk (pk), datestr_from_pk (pk));
	if (uidnode)
	print_utf8_buffer (log_get_stream (), uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len);
	log_printf ("\n");
	}
	stats->secret_read++;

	if ((options & IMPORT_NO_SECKEY))
	{
	if (!for_migration)
	log_error (_("importing secret keys not allowed\n"));
	return 0;
	}

	if (!uidnode)
	{
	if (!for_migration)
	log_error( _("key %s: no user ID\n"), keystr_from_pk (pk));
	return 0;
	}

	ski = pk->seckey_info;
	if (!ski)
	{
	/* Actually an internal error. */
	log_error ("key %s: secret key info missing\n", keystr_from_pk (pk));
	return 0;
	}

	/* A quick check to not import keys with an invalid protection
	cipher algorithm (only checks the primary key, though). */
	if (ski->algo > 110)
	{
	if (!for_migration)
	log_error (_("key %s: secret key with invalid cipher %d"
	" - skipped\n"), keystr_from_pk (pk), ski->algo);
	return 0;
	}

	#ifdef ENABLE_SELINUX_HACKS
	if (1)
	{
	/* We don't allow importing secret keys because that may be used
	to put a secret key into the keyring and the user might later
	be tricked into signing stuff with that key. */
	log_error (_("importing secret keys not allowed\n"));
	return 0;
	}
	#endif

	clear_kbnode_flags (keyblock);

	nr_prev = stats->skipped_new_keys;

	/* Make a public key out of the key. */
	pub_keyblock = sec_to_pub_keyblock (keyblock);
	if (!pub_keyblock)
	log_error ("key %s: failed to create public key from secret key\n",
	keystr_from_pk (pk));
	else
	{
	/* Note that this outputs an IMPORT_OK status message for the
	public key block, and below we will output another one for
	the secret keys. FIXME? */
	import_one (ctrl, pub_keyblock, stats,
	NULL, NULL, options, 1, for_migration,
	screener, screener_arg);

	/* Fixme: We should check for an invalid keyblock and
	cancel the secret key import in this case. */
	release_kbnode (pub_keyblock);

	/* At least we cancel the secret key import when the public key
	import was skipped due to MERGE_ONLY option and a new
	key. */
	if (stats->skipped_new_keys <= nr_prev)
	{
	/* Read the keyblock again to get the effects of a merge. */
	/* Fixme: we should do this based on the fingerprint or
	even better let import_one return the merged
	keyblock. */
	node = get_pubkeyblock (keyid);
	if (!node)
	log_error ("key %s: failed to re-lookup public key\n",
	keystr_from_pk (pk));
	else
	{
	gpg_error_t err;

	/* transfer_secret_keys collects subkey stats. */
	struct import_stats_s subkey_stats = {0};

	err = transfer_secret_keys (ctrl, &subkey_stats, keyblock,
	batch, 0);
	if (gpg_err_code (err) == GPG_ERR_NOT_PROCESSED)
	{
	/* TRANSLATORS: For smartcard, each private key on
	host has a reference (stub) to a smartcard and
	actual private key data is stored on the card. A
	single smartcard can have up to three private key
	data. Importing private key stub is always
	skipped in 2.1, and it returns
	GPG_ERR_NOT_PROCESSED. Instead, user should be
	suggested to run 'gpg --card-status', then,
	references to a card will be automatically
	created again. */
	log_info (_("To migrate '%s', with each smartcard, "
	"run: %s\n"), "secring.gpg", "gpg --card-status");
	err = 0;
	}
	if (!err)
	{
	int status = 16;
	if (!opt.quiet)
	log_info (_("key %s: secret key imported\n"),
	keystr_from_pk (pk));
	if (subkey_stats.secret_imported)
	{
	status \|= 1;
	stats->secret_imported += 1;
	}
	if (subkey_stats.secret_dups)
	stats->secret_dups += 1;

	if (is_status_enabled ())
	print_import_ok (pk, status);
	check_prefs (ctrl, node);
	}
	release_kbnode (node);
	}
	}
	}

	return rc;
	}


	/****************
	* Import a revocation certificate; this is a single signature packet.
	*/
	static int
	import_revoke_cert (ctrl_t ctrl, kbnode_t node, struct import_stats_s *stats)
	{
	PKT_public_key *pk = NULL;
	kbnode_t onode;
	kbnode_t keyblock = NULL;
	KEYDB_HANDLE hd = NULL;
	u32 keyid[2];
	int rc = 0;

	log_assert (!node->next );
	log_assert (node->pkt->pkttype == PKT_SIGNATURE );
	log_assert (node->pkt->pkt.signature->sig_class == 0x20 );

	keyid[0] = node->pkt->pkt.signature->keyid[0];
	keyid[1] = node->pkt->pkt.signature->keyid[1];

	pk = xmalloc_clear( sizeof *pk );
	rc = get_pubkey( pk, keyid );
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY )
	{
	log_error(_("key %s: no public key -"
	" can't apply revocation certificate\n"), keystr(keyid));
	rc = 0;
	goto leave;
	}
	else if (rc )
	{
	log_error(_("key %s: public key not found: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* Read the original keyblock. */
	hd = keydb_new ();
	if (!hd)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}

	{
	byte afp[MAX_FINGERPRINT_LEN];
	size_t an;

	fingerprint_from_pk (pk, afp, &an);
	while (an < MAX_FINGERPRINT_LEN)
	afp[an++] = 0;
	rc = keydb_search_fpr (hd, afp);
	}
	if (rc)
	{
	log_error (_("key %s: can't locate original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}
	rc = keydb_get_keyblock (hd, &keyblock );
	if (rc)
	{
	log_error (_("key %s: can't read original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* it is okay, that node is not in keyblock because
	* check_key_signature works fine for sig_class 0x20 in this
	* special case. */
	rc = check_key_signature( keyblock, node, NULL);
	if (rc )
	{
	log_error( _("key %s: invalid revocation certificate"
	": %s - rejected\n"), keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* check whether we already have this */
	for(onode=keyblock->next; onode; onode=onode->next ) {
	if (onode->pkt->pkttype == PKT_USER_ID )
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& !cmp_signatures(node->pkt->pkt.signature,
	onode->pkt->pkt.signature))
	{
	rc = 0;
	goto leave; /* yes, we already know about it */
	}
	}

	/* insert it */
	insert_kbnode( keyblock, clone_kbnode(node), 0 );

	/* and write the keyblock back */
	rc = keydb_update_keyblock (ctrl, hd, keyblock );
	if (rc)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (rc) );
	keydb_release (hd);
	hd = NULL;

	/* we are ready */
	if (!opt.quiet )
	{
	char *p=get_user_id_native (keyid);
	log_info( _("key %s: \"%s\" revocation certificate imported\n"),
	keystr(keyid),p);
	xfree(p);
	}
	stats->n_revoc++;

	/* If the key we just revoked was ultimately trusted, remove its
	ultimate trust. This doesn't stop the user from putting the
	ultimate trust back, but is a reasonable solution for now. */
	if(get_ownertrust(pk)==TRUST_ULTIMATE)
	clear_ownertrusts(pk);

	revalidation_mark ();

	leave:
	keydb_release (hd);
	release_kbnode( keyblock );
	free_public_key( pk );
	return rc;
	}


	/* Loop over the keyblock and check all self signatures. On return
	* the following bis in the node flags are set:
	*
	* - NODE_GOOD_SELFSIG :: User ID or subkey has a self-signature
	* - NODE_BAD_SELFSIG :: Used ID or subkey has an invalid self-signature
	* - NODE_DELETION_MARK :: This node shall be deleted
	*
	* NON_SELF is set to true if there are any sigs other than self-sigs
	* in this keyblock.
	*
	* Returns 0 on success or -1 (but not an error code) if the keyblock
	* is invalid.
	*/
	static int
	chk_self_sigs (kbnode_t keyblock, u32 keyid, int non_self )
	{
	kbnode_t n, knode = NULL;
	PKT_signature *sig;
	int rc;
	u32 bsdate=0, rsdate=0;
	kbnode_t bsnode = NULL, rsnode = NULL;

	for (n=keyblock; (n = find_next_kbnode (n, 0)); )
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	knode = n;
	bsdate = 0;
	rsdate = 0;
	bsnode = NULL;
	rsnode = NULL;
	continue;
	}

	if ( n->pkt->pkttype != PKT_SIGNATURE )
	continue;

	sig = n->pkt->pkt.signature;
	if ( keyid[0] != sig->keyid[0] \|\| keyid[1] != sig->keyid[1] )
	{
	*non_self = 1;
	continue;
	}

	/* This just caches the sigs for later use. That way we
	import a fully-cached key which speeds things up. */
	if (!opt.no_sig_cache)
	check_key_signature (keyblock, n, NULL);

	if ( IS_UID_SIG(sig) \|\| IS_UID_REV(sig) )
	{
	kbnode_t unode = find_prev_kbnode( keyblock, n, PKT_USER_ID );
	if ( !unode )
	{
	log_error( _("key %s: no user ID for signature\n"),
	keystr(keyid));
	return -1; /* The complete keyblock is invalid. */
	}

	/* If it hasn't been marked valid yet, keep trying. */
	if (!(unode->flag & NODE_GOOD_SELFSIG))
	{
	rc = check_key_signature (keyblock, n, NULL);
	if ( rc )
	{
	if ( opt.verbose )
	{
	char *p = utf8_to_native
	(unode->pkt->pkt.user_id->name,
	strlen (unode->pkt->pkt.user_id->name),0);
	log_info (gpg_err_code(rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key "
	"algorithm on user ID \"%s\"\n"):
	_("key %s: invalid self-signature "
	"on user ID \"%s\"\n"),
	keystr (keyid),p);
	xfree (p);
	}
	}
	else
	unode->flag \|= NODE_GOOD_SELFSIG;
	}
	}
	else if (IS_KEY_SIG (sig))
	{
	rc = check_key_signature (keyblock, n, NULL);
	if ( rc )
	{
	if (opt.verbose)
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key algorithm\n"):
	_("key %s: invalid direct key signature\n"),
	keystr (keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	}
	else if ( IS_SUBKEY_SIG (sig) )
	{
	/* Note that this works based solely on the timestamps like
	the rest of gpg. If the standard gets revocation
	targets, this may need to be revised. */

	if ( !knode )
	{
	if (opt.verbose)
	log_info (_("key %s: no subkey for key binding\n"),
	keystr (keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	rc = check_key_signature (keyblock, n, NULL);
	if ( rc )
	{
	if (opt.verbose)
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key"
	" algorithm\n"):
	_("key %s: invalid subkey binding\n"),
	keystr (keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	/* It's valid, so is it newer? */
	if (sig->timestamp >= bsdate)
	{
	knode->flag \|= NODE_GOOD_SELFSIG; /* Subkey is valid. */
	if (bsnode)
	{
	/* Delete the last binding sig since this
	one is newer */
	bsnode->flag \|= NODE_DELETION_MARK;
	if (opt.verbose)
	log_info (_("key %s: removed multiple subkey"
	" binding\n"),keystr(keyid));
	}

	bsnode = n;
	bsdate = sig->timestamp;
	}
	else
	n->flag \|= NODE_DELETION_MARK; /* older */
	}
	}
	}
	else if ( IS_SUBKEY_REV (sig) )
	{
	/* We don't actually mark the subkey as revoked right now,
	so just check that the revocation sig is the most recent
	valid one. Note that we don't care if the binding sig is
	newer than the revocation sig. See the comment in
	getkey.c:merge_selfsigs_subkey for more. */
	if ( !knode )
	{
	if (opt.verbose)
	log_info (_("key %s: no subkey for key revocation\n"),
	keystr(keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	rc = check_key_signature (keyblock, n, NULL);
	if ( rc )
	{
	if(opt.verbose)
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public"
	" key algorithm\n"):
	_("key %s: invalid subkey revocation\n"),
	keystr(keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	/* It's valid, so is it newer? */
	if (sig->timestamp >= rsdate)
	{
	if (rsnode)
	{
	/* Delete the last revocation sig since
	this one is newer. */
	rsnode->flag \|= NODE_DELETION_MARK;
	if (opt.verbose)
	log_info (_("key %s: removed multiple subkey"
	" revocation\n"),keystr(keyid));
	}

	rsnode = n;
	rsdate = sig->timestamp;
	}
	else
	n->flag \|= NODE_DELETION_MARK; /* older */
	}
	}
	}
	}

	return 0;
	}


	/* Delete all parts which are invalid and those signatures whose
	* public key algorithm is not available in this implemenation; but
	* consider RSA as valid, because parse/build_packets knows about it.
	*
	* Returns: True if at least one valid user-id is left over.
	*/
	static int
	delete_inv_parts (kbnode_t keyblock, u32 *keyid, unsigned int options)
	{
	kbnode_t node;
	int nvalid=0, uid_seen=0, subkey_seen=0;

	for (node=keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid_seen = 1;
	if ((node->flag & NODE_BAD_SELFSIG)
	\|\| !(node->flag & NODE_GOOD_SELFSIG))
	{
	if (opt.verbose )
	{
	char *p=utf8_to_native(node->pkt->pkt.user_id->name,
	node->pkt->pkt.user_id->len,0);
	log_info( _("key %s: skipped user ID \"%s\"\n"),
	keystr(keyid),p);
	xfree(p);
	}
	delete_kbnode( node ); /* the user-id */
	/* and all following packets up to the next user-id */
	while (node->next
	&& node->next->pkt->pkttype != PKT_USER_ID
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ){
	delete_kbnode( node->next );
	node = node->next;
	}
	}
	else
	nvalid++;
	}
	else if ( node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY )
	{
	if ((node->flag & NODE_BAD_SELFSIG)
	\|\| !(node->flag & NODE_GOOD_SELFSIG))
	{
	if (opt.verbose )
	log_info( _("key %s: skipped subkey\n"),keystr(keyid));

	delete_kbnode( node ); /* the subkey */
	/* and all following signature packets */
	while (node->next
	&& node->next->pkt->pkttype == PKT_SIGNATURE ) {
	delete_kbnode( node->next );
	node = node->next;
	}
	}
	else
	subkey_seen = 1;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& openpgp_pk_test_algo (node->pkt->pkt.signature->pubkey_algo)
	&& node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA )
	{
	delete_kbnode( node ); /* build_packet() can't handle this */
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& !node->pkt->pkt.signature->flags.exportable
	&& !(options&IMPORT_LOCAL_SIGS)
	&& !have_secret_key_with_kid (node->pkt->pkt.signature->keyid))
	{
	/* here we violate the rfc a bit by still allowing
	* to import non-exportable signature when we have the
	* the secret key used to create this signature - it
	* seems that this makes sense */
	if(opt.verbose)
	log_info( _("key %s: non exportable signature"
	" (class 0x%02X) - skipped\n"),
	keystr(keyid), node->pkt->pkt.signature->sig_class );
	delete_kbnode( node );
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& node->pkt->pkt.signature->sig_class == 0x20)
	{
	if (uid_seen )
	{
	if(opt.verbose)
	log_info( _("key %s: revocation certificate"
	" at wrong place - skipped\n"),keystr(keyid));
	delete_kbnode( node );
	}
	else
	{
	/* If the revocation cert is from a different key than
	the one we're working on don't check it - it's
	probably from a revocation key and won't be
	verifiable with this key anyway. */

	if(node->pkt->pkt.signature->keyid[0]==keyid[0]
	&& node->pkt->pkt.signature->keyid[1]==keyid[1])
	{
	int rc = check_key_signature( keyblock, node, NULL);
	if (rc )
	{
	if(opt.verbose)
	log_info( _("key %s: invalid revocation"
	" certificate: %s - skipped\n"),
	keystr(keyid), gpg_strerror (rc));
	delete_kbnode( node );
	}
	}
	}
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class == 0x18
	\|\| node->pkt->pkt.signature->sig_class == 0x28)
	&& !subkey_seen )
	{
	if(opt.verbose)
	log_info( _("key %s: subkey signature"
	" in wrong place - skipped\n"), keystr(keyid));
	delete_kbnode( node );
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& !IS_CERT(node->pkt->pkt.signature))
	{
	if(opt.verbose)
	log_info(_("key %s: unexpected signature class (0x%02X) -"
	" skipped\n"),keystr(keyid),
	node->pkt->pkt.signature->sig_class);
	delete_kbnode(node);
	}
	else if ((node->flag & NODE_DELETION_MARK))
	delete_kbnode( node );
	}

	/* note: because keyblock is the public key, it is never marked
	* for deletion and so keyblock cannot change */
	commit_kbnode( &keyblock );
	return nvalid;
	}

	/* This function returns true if any UID is left in the keyring. */
	static int
	any_uid_left (kbnode_t keyblock)
	{
	kbnode_t node;

	for (node=keyblock->next; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID)
	return 1;
	return 0;
	}



	/****************
	* It may happen that the imported keyblock has duplicated user IDs.
	* We check this here and collapse those user IDs together with their
	* sigs into one.
	* Returns: True if the keyblock has changed.
	*/
	int
	collapse_uids( kbnode_t *keyblock )
	{
	kbnode_t uid1;
	int any=0;

	for(uid1=*keyblock;uid1;uid1=uid1->next)
	{
	kbnode_t uid2;

	if(is_deleted_kbnode(uid1))
	continue;

	if(uid1->pkt->pkttype!=PKT_USER_ID)
	continue;

	for(uid2=uid1->next;uid2;uid2=uid2->next)
	{
	if(is_deleted_kbnode(uid2))
	continue;

	if(uid2->pkt->pkttype!=PKT_USER_ID)
	continue;

	if(cmp_user_ids(uid1->pkt->pkt.user_id,
	uid2->pkt->pkt.user_id)==0)
	{
	/* We have a duplicated uid */
	kbnode_t sig1,last;

	any=1;

	/* Now take uid2's signatures, and attach them to
	uid1 */
	for(last=uid2;last->next;last=last->next)
	{
	if(is_deleted_kbnode(last))
	continue;

	if(last->next->pkt->pkttype==PKT_USER_ID
	\|\| last->next->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| last->next->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;
	}

	/* Snip out uid2 */
	(find_prev_kbnode(*keyblock,uid2,0))->next=last->next;

	/* Now put uid2 in place as part of uid1 */
	last->next=uid1->next;
	uid1->next=uid2;
	delete_kbnode(uid2);

	/* Now dedupe uid1 */
	for(sig1=uid1->next;sig1;sig1=sig1->next)
	{
	kbnode_t sig2;

	if(is_deleted_kbnode(sig1))
	continue;

	if(sig1->pkt->pkttype==PKT_USER_ID
	\|\| sig1->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| sig1->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;

	if(sig1->pkt->pkttype!=PKT_SIGNATURE)
	continue;

	for(sig2=sig1->next,last=sig1;sig2;last=sig2,sig2=sig2->next)
	{
	if(is_deleted_kbnode(sig2))
	continue;

	if(sig2->pkt->pkttype==PKT_USER_ID
	\|\| sig2->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| sig2->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;

	if(sig2->pkt->pkttype!=PKT_SIGNATURE)
	continue;

	if(cmp_signatures(sig1->pkt->pkt.signature,
	sig2->pkt->pkt.signature)==0)
	{
	/* We have a match, so delete the second
	signature */
	delete_kbnode(sig2);
	sig2=last;
	}
	}
	}
	}
	}
	}

	commit_kbnode(keyblock);

	if(any && !opt.quiet)
	{
	const char *key="???";

	if ((uid1 = find_kbnode (*keyblock, PKT_PUBLIC_KEY)) )
	key = keystr_from_pk (uid1->pkt->pkt.public_key);
	else if ((uid1 = find_kbnode( *keyblock, PKT_SECRET_KEY)) )
	key = keystr_from_pk (uid1->pkt->pkt.public_key);

	log_info (_("key %s: duplicated user ID detected - merged\n"), key);
	}

	return any;
	}


	/* Check for a 0x20 revocation from a revocation key that is not
	present. This may be called without the benefit of merge_xxxx so
	you can't rely on pk->revkey and friends. */
	static void
	revocation_present (ctrl_t ctrl, kbnode_t keyblock)
	{
	kbnode_t onode, inode;
	PKT_public_key *pk = keyblock->pkt->pkt.public_key;

	for(onode=keyblock->next;onode;onode=onode->next)
	{
	/* If we reach user IDs, we're done. */
	if(onode->pkt->pkttype==PKT_USER_ID)
	break;

	if(onode->pkt->pkttype==PKT_SIGNATURE &&
	onode->pkt->pkt.signature->sig_class==0x1F &&
	onode->pkt->pkt.signature->revkey)
	{
	int idx;
	PKT_signature *sig=onode->pkt->pkt.signature;

	for(idx=0;idx<sig->numrevkeys;idx++)
	{
	u32 keyid[2];

	keyid_from_fingerprint(sig->revkey[idx].fpr,
	MAX_FINGERPRINT_LEN,keyid);

	for(inode=keyblock->next;inode;inode=inode->next)
	{
	/* If we reach user IDs, we're done. */
	if(inode->pkt->pkttype==PKT_USER_ID)
	break;

	if(inode->pkt->pkttype==PKT_SIGNATURE &&
	inode->pkt->pkt.signature->sig_class==0x20 &&
	inode->pkt->pkt.signature->keyid[0]==keyid[0] &&
	inode->pkt->pkt.signature->keyid[1]==keyid[1])
	{
	/* Okay, we have a revocation key, and a
	revocation issued by it. Do we have the key
	itself? */
	int rc;

	rc=get_pubkey_byfprint_fast (NULL,sig->revkey[idx].fpr,
	MAX_FINGERPRINT_LEN);
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	\|\| gpg_err_code (rc) == GPG_ERR_UNUSABLE_PUBKEY)
	{
	char *tempkeystr=xstrdup(keystr_from_pk(pk));

	/* No, so try and get it */
	if ((opt.keyserver_options.options
	& KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (ctrl))
	{
	log_info(_("WARNING: key %s may be revoked:"
	" fetching revocation key %s\n"),
	tempkeystr,keystr(keyid));
	keyserver_import_fprint (ctrl,
	sig->revkey[idx].fpr,
	MAX_FINGERPRINT_LEN,
	opt.keyserver, 0);

	/* Do we have it now? */
	rc=get_pubkey_byfprint_fast (NULL,
	sig->revkey[idx].fpr,
	MAX_FINGERPRINT_LEN);
	}

	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	\|\| gpg_err_code (rc) == GPG_ERR_UNUSABLE_PUBKEY)
	log_info(_("WARNING: key %s may be revoked:"
	" revocation key %s not present.\n"),
	tempkeystr,keystr(keyid));

	xfree(tempkeystr);
	}
	}
	}
	}
	}
	}
	}


	/*
	* compare and merge the blocks
	*
	* o compare the signatures: If we already have this signature, check
	* that they compare okay; if not, issue a warning and ask the user.
	* o Simply add the signature. Can't verify here because we may not have
	* the signature's public key yet; verification is done when putting it
	* into the trustdb, which is done automagically as soon as this pubkey
	* is used.
	* Note: We indicate newly inserted packets with NODE_FLAG_A.
	*/
	static int
	merge_blocks (kbnode_t keyblock_orig, kbnode_t keyblock,
	u32 keyid, int n_uids, int n_sigs, int n_subk )
	{
	kbnode_t onode, node;
	int rc, found;

	/* 1st: handle revocation certificates */
	for (node=keyblock->next; node; node=node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID )
	break;
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& node->pkt->pkt.signature->sig_class == 0x20)
	{
	/* check whether we already have this */
	found = 0;
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (onode->pkt->pkttype == PKT_USER_ID )
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& onode->pkt->pkt.signature->sig_class == 0x20
	&& !cmp_signatures(onode->pkt->pkt.signature,
	node->pkt->pkt.signature))
	{
	found = 1;
	break;
	}
	}
	if (!found)
	{
	kbnode_t n2 = clone_kbnode(node);
	insert_kbnode( keyblock_orig, n2, 0 );
	n2->flag \|= NODE_FLAG_A;
	++*n_sigs;
	if(!opt.quiet)
	{
	char *p=get_user_id_native (keyid);
	log_info(_("key %s: \"%s\" revocation"
	" certificate added\n"), keystr(keyid),p);
	xfree(p);
	}
	}
	}
	}

	/* 2nd: merge in any direct key (0x1F) sigs */
	for(node=keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID )
	break;
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& node->pkt->pkt.signature->sig_class == 0x1F)
	{
	/* check whether we already have this */
	found = 0;
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (onode->pkt->pkttype == PKT_USER_ID)
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& onode->pkt->pkt.signature->sig_class == 0x1F
	&& !cmp_signatures(onode->pkt->pkt.signature,
	node->pkt->pkt.signature))
	{
	found = 1;
	break;
	}
	}
	if (!found )
	{
	kbnode_t n2 = clone_kbnode(node);
	insert_kbnode( keyblock_orig, n2, 0 );
	n2->flag \|= NODE_FLAG_A;
	++*n_sigs;
	if(!opt.quiet)
	log_info( _("key %s: direct key signature added\n"),
	keystr(keyid));
	}
	}
	}

	/* 3rd: try to merge new certificates in */
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (!(onode->flag & NODE_FLAG_A) && onode->pkt->pkttype == PKT_USER_ID)
	{
	/* find the user id in the imported keyblock */
	for (node=keyblock->next; node; node=node->next)
	if (node->pkt->pkttype == PKT_USER_ID
	&& !cmp_user_ids( onode->pkt->pkt.user_id,
	node->pkt->pkt.user_id ) )
	break;
	if (node ) /* found: merge */
	{
	rc = merge_sigs (onode, node, n_sigs);
	if (rc )
	return rc;
	}
	}
	}

	/* 4th: add new user-ids */
	for (node=keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	/* do we have this in the original keyblock */
	for (onode=keyblock_orig->next; onode; onode=onode->next )
	if (onode->pkt->pkttype == PKT_USER_ID
	&& !cmp_user_ids( onode->pkt->pkt.user_id,
	node->pkt->pkt.user_id ) )
	break;
	if (!onode ) /* this is a new user id: append */
	{
	rc = append_uid (keyblock_orig, node, n_sigs);
	if (rc )
	return rc;
	++*n_uids;
	}
	}
	}

	/* 5th: add new subkeys */
	for (node=keyblock->next; node; node=node->next)
	{
	onode = NULL;
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	/* do we have this in the original keyblock? */
	for(onode=keyblock_orig->next; onode; onode=onode->next)
	if (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& !cmp_public_keys( onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key))
	break;
	if (!onode ) /* This is a new subkey: append. */
	{
	rc = append_key (keyblock_orig, node, n_sigs);
	if (rc)
	return rc;
	++*n_subk;
	}
	}
	else if (node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	/* do we have this in the original keyblock? */
	for (onode=keyblock_orig->next; onode; onode=onode->next )
	if (onode->pkt->pkttype == PKT_SECRET_SUBKEY
	&& !cmp_public_keys (onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key) )
	break;
	if (!onode ) /* This is a new subkey: append. */
	{
	rc = append_key (keyblock_orig, node, n_sigs);
	if (rc )
	return rc;
	++*n_subk;
	}
	}
	}

	/* 6th: merge subkey certificates */
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (!(onode->flag & NODE_FLAG_A)
	&& (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| onode->pkt->pkttype == PKT_SECRET_SUBKEY))
	{
	/* find the subkey in the imported keyblock */
	for(node=keyblock->next; node; node=node->next)
	{
	if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	&& !cmp_public_keys( onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key ) )
	break;
	}
	if (node) /* Found: merge. */
	{
	rc = merge_keysigs( onode, node, n_sigs);
	if (rc )
	return rc;
	}
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks.
	* Append the userid starting with NODE and all signatures to KEYBLOCK.
	*/
	static int
	append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs)
	{
	kbnode_t n;
	kbnode_t n_where = NULL;

	log_assert (node->pkt->pkttype == PKT_USER_ID );

	/* find the position */
	for (n = keyblock; n; n_where = n, n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n->pkt->pkttype == PKT_SECRET_SUBKEY )
	break;
	}
	if (!n)
	n_where = NULL;

	/* and append/insert */
	while (node)
	{
	/* we add a clone to the original keyblock, because this
	* one is released first */
	n = clone_kbnode(node);
	if (n_where)
	{
	insert_kbnode( n_where, n, 0 );
	n_where = n;
	}
	else
	add_kbnode( keyblock, n );
	n->flag \|= NODE_FLAG_A;
	node->flag \|= NODE_FLAG_A;
	if (n->pkt->pkttype == PKT_SIGNATURE )
	++*n_sigs;

	node = node->next;
	if (node && node->pkt->pkttype != PKT_SIGNATURE )
	break;
	}

	return 0;
	}


	/* Helper function for merge_blocks
	* Merge the sigs from SRC onto DST. SRC and DST are both a PKT_USER_ID.
	* (how should we handle comment packets here?)
	*/
	static int
	merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs)
	{
	kbnode_t n, n2;
	int found = 0;

	log_assert (dst->pkt->pkttype == PKT_USER_ID);
	log_assert (src->pkt->pkttype == PKT_USER_ID);

	for (n=src->next; n && n->pkt->pkttype != PKT_USER_ID; n = n->next)
	{
	if (n->pkt->pkttype != PKT_SIGNATURE )
	continue;
	if (n->pkt->pkt.signature->sig_class == 0x18
	\|\| n->pkt->pkt.signature->sig_class == 0x28 )
	continue; /* skip signatures which are only valid on subkeys */

	found = 0;
	for (n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next)
	if (!cmp_signatures(n->pkt->pkt.signature,n2->pkt->pkt.signature))
	{
	found++;
	break;
	}
	if (!found )
	{
	/* This signature is new or newer, append N to DST.
	* We add a clone to the original keyblock, because this
	* one is released first */
	n2 = clone_kbnode(n);
	insert_kbnode( dst, n2, PKT_SIGNATURE );
	n2->flag \|= NODE_FLAG_A;
	n->flag \|= NODE_FLAG_A;
	++*n_sigs;
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks
	* Merge the sigs from SRC onto DST. SRC and DST are both a PKT_xxx_SUBKEY.
	*/
	static int
	merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs)
	{
	kbnode_t n, n2;
	int found = 0;

	log_assert (dst->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| dst->pkt->pkttype == PKT_SECRET_SUBKEY);

	for (n=src->next; n ; n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n->pkt->pkttype == PKT_PUBLIC_KEY )
	break;
	if (n->pkt->pkttype != PKT_SIGNATURE )
	continue;

	found = 0;
	for (n2=dst->next; n2; n2 = n2->next)
	{
	if (n2->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n2->pkt->pkttype == PKT_PUBLIC_KEY )
	break;
	if (n2->pkt->pkttype == PKT_SIGNATURE
	&& (n->pkt->pkt.signature->keyid[0]
	== n2->pkt->pkt.signature->keyid[0])
	&& (n->pkt->pkt.signature->keyid[1]
	== n2->pkt->pkt.signature->keyid[1])
	&& (n->pkt->pkt.signature->timestamp
	<= n2->pkt->pkt.signature->timestamp)
	&& (n->pkt->pkt.signature->sig_class
	== n2->pkt->pkt.signature->sig_class))
	{
	found++;
	break;
	}
	}
	if (!found )
	{
	/* This signature is new or newer, append N to DST.
	* We add a clone to the original keyblock, because this
	* one is released first */
	n2 = clone_kbnode(n);
	insert_kbnode( dst, n2, PKT_SIGNATURE );
	n2->flag \|= NODE_FLAG_A;
	n->flag \|= NODE_FLAG_A;
	++*n_sigs;
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks.
	* Append the subkey starting with NODE and all signatures to KEYBLOCK.
	* Mark all new and copied packets by setting flag bit 0.
	*/
	static int
	append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs)
	{
	kbnode_t n;

	log_assert (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY);

	while (node)
	{
	/* we add a clone to the original keyblock, because this
	* one is released first */
	n = clone_kbnode(node);
	add_kbnode( keyblock, n );
	n->flag \|= NODE_FLAG_A;
	node->flag \|= NODE_FLAG_A;
	if (n->pkt->pkttype == PKT_SIGNATURE )
	++*n_sigs;

	node = node->next;
	if (node && node->pkt->pkttype != PKT_SIGNATURE )
	break;
	}

	return 0;
	}
	diff --git a/g10/keydb.c b/g10/keydb.c
	index aab90e380..4c5149da2 100644
	--- a/g10/keydb.c
	+++ b/g10/keydb.c
	@@ -1,2097 +1,2097 @@
	/* keydb.c - key database dispatcher
	* Copyright (C) 2001-2013 Free Software Foundation, Inc.
	* Coyrright (C) 2001-2015 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <unistd.h>

	#include "gpg.h"
	#include "util.h"
	#include "options.h"
	#include "main.h" /try_make_homedir ()/
	#include "packet.h"
	#include "keyring.h"
	#include "../kbx/keybox.h"
	#include "keydb.h"
	#include "i18n.h"

	static int active_handles;

	typedef enum
	{
	KEYDB_RESOURCE_TYPE_NONE = 0,
	KEYDB_RESOURCE_TYPE_KEYRING,
	KEYDB_RESOURCE_TYPE_KEYBOX
	} KeydbResourceType;
	#define MAX_KEYDB_RESOURCES 40

	struct resource_item
	{
	KeydbResourceType type;
	union {
	KEYRING_HANDLE kr;
	KEYBOX_HANDLE kb;
	} u;
	void *token;
	};

	static struct resource_item all_resources[MAX_KEYDB_RESOURCES];
	static int used_resources;

	/* A pointer used to check for the primary key database by comparing
	to the struct resource_item's TOKEN. */
	static void *primary_keydb;

	/* Whether we have successfully registered any resource. */
	static int any_registered;

	/* This is a simple cache used to return the last result of a
	successful fingerprint search. This works only for keybox resources
	because (due to lack of a copy_keyblock function) we need to store
	an image of the keyblock which is fortunately instantly available
	for keyboxes. */
	enum keyblock_cache_states {
	KEYBLOCK_CACHE_EMPTY,
	KEYBLOCK_CACHE_PREPARED,
	KEYBLOCK_CACHE_FILLED
	};

	struct keyblock_cache {
	enum keyblock_cache_states state;
	byte fpr[MAX_FINGERPRINT_LEN];
	iobuf_t iobuf; /* Image of the keyblock. */
	u32 *sigstatus;
	int pk_no;
	int uid_no;
	/* Offset of the record in the keybox. */
	int resource;
	off_t offset;
	};


	struct keydb_handle
	{
	/* When we locked all of the resources in ACTIVE (using keyring_lock
	/ keybox_lock, as appropriate). */
	int locked;

	/* The index into ACTIVE of the resources in which the last search
	result was found. Initially -1. */
	int found;

	/* Initially -1 (invalid). This is used to save a search result and
	later restore it as the selected result. */
	int saved_found;

	/* The number of skipped long blobs since the last search
	(keydb_search_reset). */
	unsigned long skipped_long_blobs;

	/* If set, this disables the use of the keyblock cache. */
	int no_caching;

	/* Whether the next search will be from the beginning of the
	database (and thus consider all records). */
	int is_reset;

	/* The "file position." In our case, this is index of the current
	resource in ACTIVE. */
	int current;

	/* The number of resources in ACTIVE. */
	int used;

	/* Cache of the last found and parsed key block (only used for
	keyboxes, not keyrings). */
	struct keyblock_cache keyblock_cache;

	/* Copy of ALL_RESOURCES when keydb_new is called. */
	struct resource_item active[MAX_KEYDB_RESOURCES];
	};

	/* Looking up keys is expensive. To hide the cost, we cache whether
	keys exist in the key database. Then, if we know a key does not
	exist, we don't have to spend time looking it up. This
	particularly helps the --list-sigs and --check-sigs commands.

	The cache stores the results in a hash using separate chaining.
	Concretely: we use the LSB of the keyid to index the hash table and
	each bucket consists of a linked list of entries. An entry
	consists of the 64-bit key id. If a key id is not in the cache,
	then we don't know whether it is in the DB or not.

	To simplify the cache consistency protocol, we simply flush the
	whole cache whenever a key is inserted or updated. */

	#define KID_NOT_FOUND_CACHE_BUCKETS 256
	static struct kid_not_found_cache_bucket *
	kid_not_found_cache[KID_NOT_FOUND_CACHE_BUCKETS];

	/* The total number of entries in the hash table. */
	static unsigned int kid_not_found_cache_count;

	struct kid_not_found_cache_bucket
	{
	struct kid_not_found_cache_bucket *next;
	u32 kid[2];
	};


	static int lock_all (KEYDB_HANDLE hd);
	static void unlock_all (KEYDB_HANDLE hd);


	/* Check whether the keyid KID is in key id is definitely not in the
	database.

	Returns:

	0 - Indeterminate: the key id is not in the cache; we don't know
	whether the key is in the database or not. If you want a
	definitive answer, you'll need to perform a lookup.

	1 - There is definitely no key with this key id in the database.
	We searched for a key with this key id previously, but we
	didn't find it in the database. */
	static int
	kid_not_found_p (u32 *kid)
	{
	struct kid_not_found_cache_bucket *k;

	for (k = kid_not_found_cache[kid[0] % KID_NOT_FOUND_CACHE_BUCKETS]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	{
	if (DBG_CACHE)
	log_debug ("keydb: kid_not_found_p (%08lx%08lx) => not in DB\n",
	(ulong)kid[0], (ulong)kid[1]);
	return 1;
	}

	if (DBG_CACHE)
	log_debug ("keydb: kid_not_found_p (%08lx%08lx) => indeterminate\n",
	(ulong)kid[0], (ulong)kid[1]);
	return 0;
	}


	/* Insert the keyid KID into the kid_not_found_cache. FOUND is whether
	the key is in the key database or not.

	Note this function does not check whether the key id is already in
	the cache. As such, kid_not_found_p() should be called first. */
	static void
	kid_not_found_insert (u32 *kid)
	{
	struct kid_not_found_cache_bucket *k;

	if (DBG_CACHE)
	log_debug ("keydb: kid_not_found_insert (%08lx%08lx)\n",
	(ulong)kid[0], (ulong)kid[1]);
	k = xmalloc (sizeof *k);
	k->kid[0] = kid[0];
	k->kid[1] = kid[1];
	k->next = kid_not_found_cache[kid[0] % KID_NOT_FOUND_CACHE_BUCKETS];
	kid_not_found_cache[kid[0] % KID_NOT_FOUND_CACHE_BUCKETS] = k;
	kid_not_found_cache_count++;
	}


	/* Flush the kid not found cache. */
	static void
	kid_not_found_flush (void)
	{
	struct kid_not_found_cache_bucket k, knext;
	int i;

	if (DBG_CACHE)
	log_debug ("keydb: kid_not_found_flush\n");

	if (!kid_not_found_cache_count)
	return;

	for (i=0; i < DIM(kid_not_found_cache); i++)
	{
	for (k = kid_not_found_cache[i]; k; k = knext)
	{
	knext = k->next;
	xfree (k);
	}
	kid_not_found_cache[i] = NULL;
	}
	kid_not_found_cache_count = 0;
	}


	static void
	keyblock_cache_clear (struct keydb_handle *hd)
	{
	hd->keyblock_cache.state = KEYBLOCK_CACHE_EMPTY;
	xfree (hd->keyblock_cache.sigstatus);
	hd->keyblock_cache.sigstatus = NULL;
	iobuf_close (hd->keyblock_cache.iobuf);
	hd->keyblock_cache.iobuf = NULL;
	hd->keyblock_cache.resource = -1;
	hd->keyblock_cache.offset = -1;
	}


	/* Handle the creation of a keyring or a keybox if it does not yet
	exist. Take into account that other processes might have the
	keyring/keybox already locked. This lock check does not work if
	the directory itself is not yet available. If IS_BOX is true the
	filename is expected to refer to a keybox. If FORCE_CREATE is true
	the keyring or keybox will be created.

	Return 0 if it is okay to access the specified file. */
	static gpg_error_t
	maybe_create_keyring_or_box (char *filename, int is_box, int force_create)
	{
	dotlock_t lockhd = NULL;
	IOBUF iobuf;
	int rc;
	mode_t oldmask;
	char *last_slash_in_filename;
	char *bak_fname = NULL;
	char *tmp_fname = NULL;
	int save_slash;

	/* A quick test whether the filename already exists. */
	if (!access (filename, F_OK))
	return !access (filename, R_OK)? 0 : gpg_error (GPG_ERR_EACCES);

	/* If we don't want to create a new file at all, there is no need to
	go any further - bail out right here. */
	if (!force_create)
	return gpg_error (GPG_ERR_ENOENT);

	/* First of all we try to create the home directory. Note, that we
	don't do any locking here because any sane application of gpg
	would create the home directory by itself and not rely on gpg's
	tricky auto-creation which is anyway only done for certain home
	directory name pattern. */
	last_slash_in_filename = strrchr (filename, DIRSEP_C);
	#if HAVE_W32_SYSTEM
	{
	/* Windows may either have a slash or a backslash. Take care of it. */
	char *p = strrchr (filename, '/');
	if (!last_slash_in_filename \|\| p > last_slash_in_filename)
	last_slash_in_filename = p;
	}
	#endif /HAVE_W32_SYSTEM/
	if (!last_slash_in_filename)
	return gpg_error (GPG_ERR_ENOENT); /* No slash at all - should
	not happen though. */
	save_slash = *last_slash_in_filename;
	*last_slash_in_filename = 0;
	if (access(filename, F_OK))
	{
	static int tried;

	if (!tried)
	{
	tried = 1;
	try_make_homedir (filename);
	}
	if (access (filename, F_OK))
	{
	rc = gpg_error_from_syserror ();
	*last_slash_in_filename = save_slash;
	goto leave;
	}
	}
	*last_slash_in_filename = save_slash;

	/* To avoid races with other instances of gpg trying to create or
	update the keyring (it is removed during an update for a short
	time), we do the next stuff in a locked state. */
	lockhd = dotlock_create (filename, 0);
	if (!lockhd)
	{
	rc = gpg_error_from_syserror ();
	/* A reason for this to fail is that the directory is not
	writable. However, this whole locking stuff does not make
	sense if this is the case. An empty non-writable directory
	with no keyring is not really useful at all. */
	if (opt.verbose)
	log_info ("can't allocate lock for '%s': %s\n",
	filename, gpg_strerror (rc));

	if (!force_create)
	return gpg_error (GPG_ERR_ENOENT); /* Won't happen. */
	else
	return rc;
	}

	if ( dotlock_take (lockhd, -1) )
	{
	rc = gpg_error_from_syserror ();
	/* This is something bad. Probably a stale lockfile. */
	log_info ("can't lock '%s': %s\n", filename, gpg_strerror (rc));
	goto leave;
	}

	/* Now the real test while we are locked. */

	/* Gpg either uses pubring.gpg or pubring.kbx and thus different
	* lock files. Now, when one gpg process is updating a pubring.gpg
	* and thus holding the corresponding lock, a second gpg process may
	* get to here at the time between the two rename operation used by
	* the first process to update pubring.gpg. The lock taken above
	* may not protect the second process if it tries to create a
	* pubring.kbx file which would be protected by a different lock
	* file.
	*
	* We can detect this case by checking that the two temporary files
	* used by the update code exist at the same time. In that case we
	* do not create a new file but act as if FORCE_CREATE has not been
	* given. Obviously there is a race between our two checks but the
	* worst thing is that we won't create a new file, which is better
	* than to accidentally creating one. */
	rc = keybox_tmp_names (filename, is_box, &bak_fname, &tmp_fname);
	if (rc)
	goto leave;

	if (!access (filename, F_OK))
	{
	rc = 0; /* Okay, we may access the file now. */
	goto leave;
	}
	if (!access (bak_fname, F_OK) && !access (tmp_fname, F_OK))
	{
	/* Very likely another process is updating a pubring.gpg and we
	should not create a pubring.kbx. */
	rc = gpg_error (GPG_ERR_ENOENT);
	goto leave;
	}


	/* The file does not yet exist, create it now. */
	oldmask = umask (077);
	if (is_secured_filename (filename))
	{
	iobuf = NULL;
	gpg_err_set_errno (EPERM);
	}
	else
	iobuf = iobuf_create (filename, 0);
	umask (oldmask);
	if (!iobuf)
	{
	rc = gpg_error_from_syserror ();
	if (is_box)
	log_error (_("error creating keybox '%s': %s\n"),
	filename, gpg_strerror (rc));
	else
	log_error (_("error creating keyring '%s': %s\n"),
	filename, gpg_strerror (rc));
	goto leave;
	}

	iobuf_close (iobuf);
	/* Must invalidate that ugly cache */
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, filename);

	/* Make sure that at least one record is in a new keybox file, so
	that the detection magic will work the next time it is used. */
	if (is_box)
	{
	FILE *fp = fopen (filename, "wb");
	if (!fp)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = _keybox_write_header_blob (fp, 1);
	fclose (fp);
	}
	if (rc)
	{
	if (is_box)
	log_error (_("error creating keybox '%s': %s\n"),
	filename, gpg_strerror (rc));
	else
	log_error (_("error creating keyring '%s': %s\n"),
	filename, gpg_strerror (rc));
	goto leave;
	}
	}

	if (!opt.quiet)
	{
	if (is_box)
	log_info (_("keybox '%s' created\n"), filename);
	else
	log_info (_("keyring '%s' created\n"), filename);
	}

	rc = 0;

	leave:
	if (lockhd)
	{
	dotlock_release (lockhd);
	dotlock_destroy (lockhd);
	}
	xfree (bak_fname);
	xfree (tmp_fname);
	return rc;
	}


	/* Helper for keydb_add_resource. Opens FILENAME to figure out the
	resource type.

	Returns the specified file's likely type. If the file does not
	exist, returns KEYDB_RESOURCE_TYPE_NONE and sets *R_FOUND to 0.
	Otherwise, tries to figure out the file's type. This is either
	KEYDB_RESOURCE_TYPE_KEYBOX, KEYDB_RESOURCE_TYPE_KEYRING or
	KEYDB_RESOURCE_TYPE_KEYNONE. If the file is a keybox and it has
	the OpenPGP flag set, then R_OPENPGP is also set. */
	static KeydbResourceType
	rt_from_file (const char filename, int r_found, int *r_openpgp)
	{
	u32 magic;
	unsigned char verbuf[4];
	FILE *fp;
	KeydbResourceType rt = KEYDB_RESOURCE_TYPE_NONE;

	r_found = r_openpgp = 0;
	fp = fopen (filename, "rb");
	if (fp)
	{
	*r_found = 1;

	if (fread (&magic, 4, 1, fp) == 1 )
	{
	if (magic == 0x13579ace \|\| magic == 0xce9a5713)
	; /* GDBM magic - not anymore supported. */
	else if (fread (&verbuf, 4, 1, fp) == 1
	&& verbuf[0] == 1
	&& fread (&magic, 4, 1, fp) == 1
	&& !memcmp (&magic, "KBXf", 4))
	{
	if ((verbuf[3] & 0x02))
	*r_openpgp = 1;
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	}
	else
	rt = KEYDB_RESOURCE_TYPE_KEYRING;
	}
	else /* Maybe empty: assume keyring. */
	rt = KEYDB_RESOURCE_TYPE_KEYRING;

	fclose (fp);
	}

	return rt;
	}

	char *
	keydb_search_desc_dump (struct keydb_search_desc *desc)
	{
	char b[MAX_FORMATTED_FINGERPRINT_LEN + 1];
	char fpr[2 * MAX_FINGERPRINT_LEN + 1];

	switch (desc->mode)
	{
	case KEYDB_SEARCH_MODE_EXACT:
	return xasprintf ("EXACT: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_SUBSTR:
	return xasprintf ("SUBSTR: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_MAIL:
	return xasprintf ("MAIL: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_MAILSUB:
	return xasprintf ("MAILSUB: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_MAILEND:
	return xasprintf ("MAILEND: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_WORDS:
	return xasprintf ("WORDS: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_SHORT_KID:
	return xasprintf ("SHORT_KID: '%s'",
	format_keyid (desc->u.kid, KF_SHORT, b, sizeof (b)));
	case KEYDB_SEARCH_MODE_LONG_KID:
	return xasprintf ("LONG_KID: '%s'",
	format_keyid (desc->u.kid, KF_LONG, b, sizeof (b)));
	case KEYDB_SEARCH_MODE_FPR16:
	bin2hex (desc->u.fpr, 16, fpr);
	return xasprintf ("FPR16: '%s'",
	format_hexfingerprint (fpr, b, sizeof (b)));
	case KEYDB_SEARCH_MODE_FPR20:
	bin2hex (desc->u.fpr, 20, fpr);
	return xasprintf ("FPR20: '%s'",
	format_hexfingerprint (fpr, b, sizeof (b)));
	case KEYDB_SEARCH_MODE_FPR:
	bin2hex (desc->u.fpr, 20, fpr);
	return xasprintf ("FPR: '%s'",
	format_hexfingerprint (fpr, b, sizeof (b)));
	case KEYDB_SEARCH_MODE_ISSUER:
	return xasprintf ("ISSUER: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_ISSUER_SN:
	return xasprintf ("ISSUER_SN: '%*s'",
	(int) (desc->snlen == -1
	? strlen (desc->sn) : desc->snlen),
	desc->sn);
	case KEYDB_SEARCH_MODE_SN:
	return xasprintf ("SN: '%*s'",
	(int) (desc->snlen == -1
	? strlen (desc->sn) : desc->snlen),
	desc->sn);
	case KEYDB_SEARCH_MODE_SUBJECT:
	return xasprintf ("SUBJECT: '%s'", desc->u.name);
	case KEYDB_SEARCH_MODE_KEYGRIP:
	return xasprintf ("KEYGRIP: %s", desc->u.grip);
	case KEYDB_SEARCH_MODE_FIRST:
	return xasprintf ("FIRST");
	case KEYDB_SEARCH_MODE_NEXT:
	return xasprintf ("NEXT");
	default:
	return xasprintf ("Bad search mode (%d)", desc->mode);
	}
	}



	/* Register a resource (keyring or keybox). The first keyring or
	* keybox that is added using this function is created if it does not
	* already exist and the KEYDB_RESOURCE_FLAG_READONLY is not set.
	*
	* FLAGS are a combination of the KEYDB_RESOURCE_FLAG_* constants.
	*
	* URL must have the following form:
	*
	* gnupg-ring:filename = plain keyring
	* gnupg-kbx:filename = keybox file
	* filename = check file's type (create as a plain keyring)
	*
	* Note: on systems with drive letters (Windows) invalid URLs (i.e.,
	* those with an unrecognized part before the ':' such as "c:\...")
	* will silently be treated as bare filenames. On other systems, such
	* URLs will cause this function to return GPG_ERR_GENERAL.
	*
	* If KEYDB_RESOURCE_FLAG_DEFAULT is set, the resource is a keyring
	* and the file ends in ".gpg", then this function also checks if a
	* file with the same name, but the extension ".kbx" exists, is a
	* keybox and the OpenPGP flag is set. If so, this function opens
	* that resource instead.
	*
	* If the file is not found, KEYDB_RESOURCE_FLAG_GPGVDEF is set and
	* the URL ends in ".kbx", then this function will try opening the
	* same URL, but with the extension ".gpg". If that file is a keybox
	* with the OpenPGP flag set or it is a keyring, then we use that
	* instead.
	*
	* If the file is not found, KEYDB_RESOURCE_FLAG_DEFAULT is set, the
	* file should be created and the file's extension is ".gpg" then we
	* replace the extension with ".kbx".
	*
	* If the KEYDB_RESOURCE_FLAG_PRIMARY is set and the resource is a
	* keyring (not a keybox), then this resource is considered the
	* primary resource. This is used by keydb_locate_writable(). If
	* another primary keyring is set, then that keyring is considered the
	* primary.
	*
	* If KEYDB_RESOURCE_FLAG_READONLY is set and the resource is a
	* keyring (not a keybox), then the keyring is marked as read only and
	* operations just as keyring_insert_keyblock will return
	* GPG_ERR_ACCESS. */
	gpg_error_t
	keydb_add_resource (const char *url, unsigned int flags)
	{
	/* The file named by the URL (i.e., without the prototype). */
	const char *resname = url;

	char *filename = NULL;
	int create;
	int read_only = !!(flags&KEYDB_RESOURCE_FLAG_READONLY);
	int is_default = !!(flags&KEYDB_RESOURCE_FLAG_DEFAULT);
	int is_gpgvdef = !!(flags&KEYDB_RESOURCE_FLAG_GPGVDEF);
	gpg_error_t err = 0;
	KeydbResourceType rt = KEYDB_RESOURCE_TYPE_NONE;
	void *token;

	/* Create the resource if it is the first registered one. */
	create = (!read_only && !any_registered);

	if (strlen (resname) > 11 && !strncmp( resname, "gnupg-ring:", 11) )
	{
	rt = KEYDB_RESOURCE_TYPE_KEYRING;
	resname += 11;
	}
	else if (strlen (resname) > 10 && !strncmp (resname, "gnupg-kbx:", 10) )
	{
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	resname += 10;
	}
	#if !defined(HAVE_DRIVE_LETTERS) && !defined(__riscos__)
	else if (strchr (resname, ':'))
	{
	log_error ("invalid key resource URL '%s'\n", url );
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	#endif /* !HAVE_DRIVE_LETTERS && !__riscos__ */

	if (*resname != DIRSEP_C
	#ifdef HAVE_W32_SYSTEM
	&& resname != '/' / Fixme: does not handle drive letters. */
	#endif
	)
	{
	/* Do tilde expansion etc. */
	if (strchr (resname, DIRSEP_C)
	#ifdef HAVE_W32_SYSTEM
	\|\| strchr (resname, '/') /* Windows also accepts this. */
	#endif
	)
	filename = make_filename (resname, NULL);
	else
	filename = make_filename (gnupg_homedir (), resname, NULL);
	}
	else
	filename = xstrdup (resname);

	/* See whether we can determine the filetype. */
	if (rt == KEYDB_RESOURCE_TYPE_NONE)
	{
	int found, openpgp_flag;
	int pass = 0;
	size_t filenamelen;

	check_again:
	filenamelen = strlen (filename);
	rt = rt_from_file (filename, &found, &openpgp_flag);
	if (found)
	{
	/* The file exists and we have the resource type in RT.

	Now let us check whether in addition to the "pubring.gpg"
	a "pubring.kbx with openpgp keys exists. This is so that
	GPG 2.1 will use an existing "pubring.kbx" by default iff
	that file has been created or used by 2.1. This check is
	needed because after creation or use of the kbx file with
	2.1 an older version of gpg may have created a new
	pubring.gpg for its own use. */
	if (!pass && is_default && rt == KEYDB_RESOURCE_TYPE_KEYRING
	&& filenamelen > 4 && !strcmp (filename+filenamelen-4, ".gpg"))
	{
	strcpy (filename+filenamelen-4, ".kbx");
	if ((rt_from_file (filename, &found, &openpgp_flag)
	== KEYDB_RESOURCE_TYPE_KEYBOX) && found && openpgp_flag)
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	else /* Restore filename */
	strcpy (filename+filenamelen-4, ".gpg");
	}
	}
	else if (!pass && is_gpgvdef
	&& filenamelen > 4 && !strcmp (filename+filenamelen-4, ".kbx"))
	{
	/* Not found but gpgv's default "trustedkeys.kbx" file has
	been requested. We did not found it so now check whether
	a "trustedkeys.gpg" file exists and use that instead. */
	KeydbResourceType rttmp;

	strcpy (filename+filenamelen-4, ".gpg");
	rttmp = rt_from_file (filename, &found, &openpgp_flag);
	if (found
	&& ((rttmp == KEYDB_RESOURCE_TYPE_KEYBOX && openpgp_flag)
	\|\| (rttmp == KEYDB_RESOURCE_TYPE_KEYRING)))
	rt = rttmp;
	else /* Restore filename */
	strcpy (filename+filenamelen-4, ".kbx");
	}
	else if (!pass
	&& is_default && create
	&& filenamelen > 4 && !strcmp (filename+filenamelen-4, ".gpg"))
	{
	/* The file does not exist, the default resource has been
	requested, the file shall be created, and the file has a
	".gpg" suffix. Change the suffix to ".kbx" and try once
	more. This way we achieve that we open an existing
	".gpg" keyring, but create a new keybox file with an
	".kbx" suffix. */
	strcpy (filename+filenamelen-4, ".kbx");
	pass++;
	goto check_again;
	}
	else /* No file yet: create keybox. */
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	}

	switch (rt)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	log_error ("unknown type of key resource '%s'\n", url );
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;

	case KEYDB_RESOURCE_TYPE_KEYRING:
	err = maybe_create_keyring_or_box (filename, 0, create);
	if (err)
	goto leave;

	if (keyring_register_filename (filename, read_only, &token))
	{
	if (used_resources >= MAX_KEYDB_RESOURCES)
	err = gpg_error (GPG_ERR_RESOURCE_LIMIT);
	else
	{
	if ((flags & KEYDB_RESOURCE_FLAG_PRIMARY))
	primary_keydb = token;
	all_resources[used_resources].type = rt;
	all_resources[used_resources].u.kr = NULL; /* Not used here */
	all_resources[used_resources].token = token;
	used_resources++;
	}
	}
	else
	{
	/* This keyring was already registered, so ignore it.
	However, we can still mark it as primary even if it was
	already registered. */
	if ((flags & KEYDB_RESOURCE_FLAG_PRIMARY))
	primary_keydb = token;
	}
	break;

	case KEYDB_RESOURCE_TYPE_KEYBOX:
	{
	err = maybe_create_keyring_or_box (filename, 1, create);
	if (err)
	goto leave;

	err = keybox_register_file (filename, 0, &token);
	if (!err)
	{
	if (used_resources >= MAX_KEYDB_RESOURCES)
	err = gpg_error (GPG_ERR_RESOURCE_LIMIT);
	else
	{
	if ((flags & KEYDB_RESOURCE_FLAG_PRIMARY))
	primary_keydb = token;
	all_resources[used_resources].type = rt;
	all_resources[used_resources].u.kb = NULL; /* Not used here */
	all_resources[used_resources].token = token;

	/* FIXME: Do a compress run if needed and no other
	user is currently using the keybox. */

	used_resources++;
	}
	}
	else if (gpg_err_code (err) == GPG_ERR_EEXIST)
	{
	/* Already registered. We will mark it as the primary key
	if requested. */
	if ((flags & KEYDB_RESOURCE_FLAG_PRIMARY))
	primary_keydb = token;
	}
	}
	break;

	default:
	log_error ("resource type of '%s' not supported\n", url);
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	/* fixme: check directory permissions and print a warning */

	leave:
	if (err)
	{
	log_error (_("keyblock resource '%s': %s\n"),
	filename, gpg_strerror (err));
	write_status_error ("add_keyblock_resource", err);
	}
	else
	any_registered = 1;
	xfree (filename);
	return err;
	}


	void
	keydb_dump_stats (void)
	{
	if (kid_not_found_cache_count)
	log_info ("keydb: kid_not_found_cache: total: %u\n",
	kid_not_found_cache_count);
	}


	/* Create a new database handle. A database handle is similar to a
	file handle: it contains a local file position. This is used when
	searching: subsequent searches resume where the previous search
	left off. To rewind the position, use keydb_search_reset(). This
	function returns NULL on error, sets ERRNO, and prints an error
	diagnostic. */
	KEYDB_HANDLE
	keydb_new (void)
	{
	KEYDB_HANDLE hd;
	int i, j;
	int die = 0;
	int reterrno;

	if (DBG_CLOCK)
	log_clock ("keydb_new");

	hd = xtrycalloc (1, sizeof *hd);
	if (!hd)
	goto leave;
	hd->found = -1;
	hd->saved_found = -1;
	hd->is_reset = 1;

	log_assert (used_resources <= MAX_KEYDB_RESOURCES);
	for (i=j=0; ! die && i < used_resources; i++)
	{
	switch (all_resources[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE: /* ignore */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	hd->active[j].type = all_resources[i].type;
	hd->active[j].token = all_resources[i].token;
	hd->active[j].u.kr = keyring_new (all_resources[i].token);
	if (!hd->active[j].u.kr)
	{
	reterrno = errno;
	die = 1;
	}
	j++;
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	hd->active[j].type = all_resources[i].type;
	hd->active[j].token = all_resources[i].token;
	hd->active[j].u.kb = keybox_new_openpgp (all_resources[i].token, 0);
	if (!hd->active[j].u.kb)
	{
	reterrno = errno;
	die = 1;
	}
	j++;
	break;
	}
	}
	hd->used = j;

	active_handles++;

	if (die)
	{
	keydb_release (hd);
	gpg_err_set_errno (reterrno);
	hd = NULL;
	}

	leave:
	if (!hd)
	log_error (_("error opening key DB: %s\n"),
	gpg_strerror (gpg_error_from_syserror()));

	return hd;
	}


	void
	keydb_release (KEYDB_HANDLE hd)
	{
	int i;

	if (!hd)
	return;
	log_assert (active_handles > 0);
	active_handles--;

	unlock_all (hd);
	for (i=0; i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	keyring_release (hd->active[i].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_release (hd->active[i].u.kb);
	break;
	}
	}

	keyblock_cache_clear (hd);
	xfree (hd);
	}


	/* Set a flag on the handle to suppress use of cached results. This
	* is required for updating a keyring and for key listings. Fixme:
	* Using a new parameter for keydb_new might be a better solution. */
	void
	keydb_disable_caching (KEYDB_HANDLE hd)
	{
	if (hd)
	hd->no_caching = 1;
	}


	/* Return the file name of the resource in which the current search
	* result was found or, if there is no search result, the filename of
	* the current resource (i.e., the resource that the file position
	* points to). Note: the filename is not necessarily the URL used to
	* open it!
	*
	* This function only returns NULL if no handle is specified, in all
	* other error cases an empty string is returned. */
	const char *
	keydb_get_resource_name (KEYDB_HANDLE hd)
	{
	int idx;
	const char *s = NULL;

	if (!hd)
	return NULL;

	if ( hd->found >= 0 && hd->found < hd->used)
	idx = hd->found;
	else if ( hd->current >= 0 && hd->current < hd->used)
	idx = hd->current;
	else
	idx = 0;

	switch (hd->active[idx].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	s = NULL;
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	s = keyring_get_resource_name (hd->active[idx].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	s = keybox_get_resource_name (hd->active[idx].u.kb);
	break;
	}

	return s? s: "";
	}



	static int
	lock_all (KEYDB_HANDLE hd)
	{
	int i, rc = 0;

	/* Fixme: This locking scheme may lead to a deadlock if the resources
	are not added in the same order by all processes. We are
	currently only allowing one resource so it is not a problem.
	[Oops: Who claimed the latter]

	To fix this we need to use a lock file to protect lock_all. */

	for (i=0; !rc && i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	rc = keyring_lock (hd->active[i].u.kr, 1);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_lock (hd->active[i].u.kb, 1);
	break;
	}
	}

	if (rc)
	{
	/* Revert the already taken locks. */
	for (i--; i >= 0; i--)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	keyring_lock (hd->active[i].u.kr, 0);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_lock (hd->active[i].u.kb, 0);
	break;
	}
	}
	}
	else
	hd->locked = 1;

	return rc;
	}


	static void
	unlock_all (KEYDB_HANDLE hd)
	{
	int i;

	if (!hd->locked)
	return;

	for (i=hd->used-1; i >= 0; i--)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	keyring_lock (hd->active[i].u.kr, 0);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_lock (hd->active[i].u.kb, 0);
	break;
	}
	}
	hd->locked = 0;
	}



	/* Save the last found state and invalidate the current selection
	* (i.e., the entry selected by keydb_search() is invalidated and
	* something like keydb_get_keyblock() will return an error). This
	* does not change the file position. This makes it possible to do
	* something like:
	*
	* keydb_search (hd, ...); // Result 1.
	* keydb_push_found_state (hd);
	* keydb_search_reset (hd);
	* keydb_search (hd, ...); // Result 2.
	* keydb_pop_found_state (hd);
	* keydb_get_keyblock (hd, ...); // -> Result 1.
	*
	* Note: it is only possible to save a single save state at a time.
	- * In other words, the the save stack only has room for a single
	+ * In other words, the save stack only has room for a single
	* instance of the state. */
	void
	keydb_push_found_state (KEYDB_HANDLE hd)
	{
	if (!hd)
	return;

	if (hd->found < 0 \|\| hd->found >= hd->used)
	{
	hd->saved_found = -1;
	return;
	}

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	keyring_push_found_state (hd->active[hd->found].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_push_found_state (hd->active[hd->found].u.kb);
	break;
	}

	hd->saved_found = hd->found;
	hd->found = -1;
	}


	/* Restore the previous save state. If the saved state is NULL or
	invalid, this is a NOP. */
	void
	keydb_pop_found_state (KEYDB_HANDLE hd)
	{
	if (!hd)
	return;

	hd->found = hd->saved_found;
	hd->saved_found = -1;
	if (hd->found < 0 \|\| hd->found >= hd->used)
	return;

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	keyring_pop_found_state (hd->active[hd->found].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_pop_found_state (hd->active[hd->found].u.kb);
	break;
	}
	}



	static gpg_error_t
	parse_keyblock_image (iobuf_t iobuf, int pk_no, int uid_no,
	const u32 sigstatus, kbnode_t r_keyblock)
	{
	gpg_error_t err;
	PACKET *pkt;
	kbnode_t keyblock = NULL;
	kbnode_t node, *tail;
	int in_cert, save_mode;
	u32 n_sigs;
	int pk_count, uid_count;

	*r_keyblock = NULL;

	pkt = xtrymalloc (sizeof *pkt);
	if (!pkt)
	return gpg_error_from_syserror ();
	init_packet (pkt);
	save_mode = set_packet_list_mode (0);
	in_cert = 0;
	n_sigs = 0;
	tail = NULL;
	pk_count = uid_count = 0;
	while ((err = parse_packet (iobuf, pkt)) != -1)
	{
	if (gpg_err_code (err) == GPG_ERR_UNKNOWN_PACKET)
	{
	free_packet (pkt);
	init_packet (pkt);
	continue;
	}
	if (err)
	{
	log_error ("parse_keyblock_image: read error: %s\n",
	gpg_strerror (err));
	err = gpg_error (GPG_ERR_INV_KEYRING);
	break;
	}

	/* Filter allowed packets. */
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_USER_ID:
	case PKT_ATTRIBUTE:
	case PKT_SIGNATURE:
	break; /* Allowed per RFC. */

	default:
	/* Note that can't allow ring trust packets here and some of
	the other GPG specific packets don't make sense either. */
	log_error ("skipped packet of type %d in keybox\n",
	(int)pkt->pkttype);
	free_packet(pkt);
	init_packet(pkt);
	continue;
	}

	/* Other sanity checks. */
	if (!in_cert && pkt->pkttype != PKT_PUBLIC_KEY)
	{
	log_error ("parse_keyblock_image: first packet in a keybox blob "
	"is not a public key packet\n");
	err = gpg_error (GPG_ERR_INV_KEYRING);
	break;
	}
	if (in_cert && (pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY))
	{
	log_error ("parse_keyblock_image: "
	"multiple keyblocks in a keybox blob\n");
	err = gpg_error (GPG_ERR_INV_KEYRING);
	break;
	}
	in_cert = 1;

	if (pkt->pkttype == PKT_SIGNATURE && sigstatus)
	{
	PKT_signature *sig = pkt->pkt.signature;

	n_sigs++;
	if (n_sigs > sigstatus[0])
	{
	log_error ("parse_keyblock_image: "
	"more signatures than found in the meta data\n");
	err = gpg_error (GPG_ERR_INV_KEYRING);
	break;

	}
	if (sigstatus[n_sigs])
	{
	sig->flags.checked = 1;
	if (sigstatus[n_sigs] == 1 )
	; /* missing key */
	else if (sigstatus[n_sigs] == 2 )
	; /* bad signature */
	else if (sigstatus[n_sigs] < 0x10000000)
	; /* bad flag */
	else
	{
	sig->flags.valid = 1;
	/* Fixme: Shall we set the expired flag here? */
	}
	}
	}

	node = new_kbnode (pkt);

	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	if (++pk_count == pk_no)
	node->flag \|= 1;
	break;

	case PKT_USER_ID:
	if (++uid_count == uid_no)
	node->flag \|= 2;
	break;

	default:
	break;
	}

	if (!keyblock)
	keyblock = node;
	else
	*tail = node;
	tail = &node->next;
	pkt = xtrymalloc (sizeof *pkt);
	if (!pkt)
	{
	err = gpg_error_from_syserror ();
	break;
	}
	init_packet (pkt);
	}
	set_packet_list_mode (save_mode);

	if (err == -1 && keyblock)
	err = 0; /* Got the entire keyblock. */

	if (!err && sigstatus && n_sigs != sigstatus[0])
	{
	log_error ("parse_keyblock_image: signature count does not match\n");
	err = gpg_error (GPG_ERR_INV_KEYRING);
	}

	if (err)
	release_kbnode (keyblock);
	else
	*r_keyblock = keyblock;
	free_packet (pkt);
	xfree (pkt);
	return err;
	}


	/* Return the keyblock last found by keydb_search() in *RET_KB.
	*
	* On success, the function returns 0 and the caller must free *RET_KB
	* using release_kbnode(). Otherwise, the function returns an error
	* code.
	*
	* The returned keyblock has the kbnode flag bit 0 set for the node
	* with the public key used to locate the keyblock or flag bit 1 set
	* for the user ID node. */
	gpg_error_t
	keydb_get_keyblock (KEYDB_HANDLE hd, KBNODE *ret_kb)
	{
	gpg_error_t err = 0;

	*ret_kb = NULL;

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	if (DBG_CLOCK)
	log_clock ("keydb_get_keybock enter");

	if (hd->keyblock_cache.state == KEYBLOCK_CACHE_FILLED)
	{
	err = iobuf_seek (hd->keyblock_cache.iobuf, 0);
	if (err)
	{
	log_error ("keydb_get_keyblock: failed to rewind iobuf for cache\n");
	keyblock_cache_clear (hd);
	}
	else
	{
	err = parse_keyblock_image (hd->keyblock_cache.iobuf,
	hd->keyblock_cache.pk_no,
	hd->keyblock_cache.uid_no,
	hd->keyblock_cache.sigstatus,
	ret_kb);
	if (err)
	keyblock_cache_clear (hd);
	if (DBG_CLOCK)
	log_clock (err? "keydb_get_keyblock leave (cached, failed)"
	: "keydb_get_keyblock leave (cached)");
	return err;
	}
	}

	if (hd->found < 0 \|\| hd->found >= hd->used)
	return gpg_error (GPG_ERR_VALUE_NOT_FOUND);

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	err = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	err = keyring_get_keyblock (hd->active[hd->found].u.kr, ret_kb);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	{
	iobuf_t iobuf;
	u32 *sigstatus;
	int pk_no, uid_no;

	err = keybox_get_keyblock (hd->active[hd->found].u.kb,
	&iobuf, &pk_no, &uid_no, &sigstatus);
	if (!err)
	{
	err = parse_keyblock_image (iobuf, pk_no, uid_no, sigstatus,
	ret_kb);
	if (!err && hd->keyblock_cache.state == KEYBLOCK_CACHE_PREPARED)
	{
	hd->keyblock_cache.state = KEYBLOCK_CACHE_FILLED;
	hd->keyblock_cache.sigstatus = sigstatus;
	hd->keyblock_cache.iobuf = iobuf;
	hd->keyblock_cache.pk_no = pk_no;
	hd->keyblock_cache.uid_no = uid_no;
	}
	else
	{
	xfree (sigstatus);
	iobuf_close (iobuf);
	}
	}
	}
	break;
	}

	if (hd->keyblock_cache.state != KEYBLOCK_CACHE_FILLED)
	keyblock_cache_clear (hd);

	if (DBG_CLOCK)
	log_clock (err? "keydb_get_keyblock leave (failed)"
	: "keydb_get_keyblock leave");
	return err;
	}


	/* Build a keyblock image from KEYBLOCK. Returns 0 on success and
	only then stores a new iobuf object at R_IOBUF and a signature
	status vecotor at R_SIGSTATUS. */
	static gpg_error_t
	build_keyblock_image (kbnode_t keyblock, iobuf_t r_iobuf, u32 *r_sigstatus)
	{
	gpg_error_t err;
	iobuf_t iobuf;
	kbnode_t kbctx, node;
	u32 n_sigs;
	u32 *sigstatus;

	*r_iobuf = NULL;
	if (r_sigstatus)
	*r_sigstatus = NULL;

	/* Allocate a vector for the signature cache. This is an array of
	u32 values with the first value giving the number of elements to
	follow and each element descriping the cache status of the
	signature. */
	if (r_sigstatus)
	{
	for (kbctx=NULL, n_sigs=0; (node = walk_kbnode (keyblock, &kbctx, 0));)
	if (node->pkt->pkttype == PKT_SIGNATURE)
	n_sigs++;
	sigstatus = xtrycalloc (1+n_sigs, sizeof *sigstatus);
	if (!sigstatus)
	return gpg_error_from_syserror ();
	}
	else
	sigstatus = NULL;

	iobuf = iobuf_temp ();
	for (kbctx = NULL, n_sigs = 0; (node = walk_kbnode (keyblock, &kbctx, 0));)
	{
	/* Make sure to use only packets valid on a keyblock. */
	switch (node->pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SIGNATURE:
	case PKT_USER_ID:
	case PKT_ATTRIBUTE:
	/* Note that we don't want the ring trust packets. They are
	not useful. */
	break;
	default:
	continue;
	}

	err = build_packet (iobuf, node->pkt);
	if (err)
	{
	iobuf_close (iobuf);
	return err;
	}

	/* Build signature status vector. */
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;

	n_sigs++;
	/* Fixme: Detect the "missing key" status. */
	if (sig->flags.checked && sigstatus)
	{
	if (sig->flags.valid)
	{
	if (!sig->expiredate)
	sigstatus[n_sigs] = 0xffffffff;
	else if (sig->expiredate < 0x1000000)
	sigstatus[n_sigs] = 0x10000000;
	else
	sigstatus[n_sigs] = sig->expiredate;
	}
	else
	sigstatus[n_sigs] = 0x00000002; /* Bad signature. */
	}
	}
	}
	if (sigstatus)
	sigstatus[0] = n_sigs;

	*r_iobuf = iobuf;
	if (r_sigstatus)
	*r_sigstatus = sigstatus;
	return 0;
	}


	/* Update the keyblock KB (i.e., extract the fingerprint and find the
	* corresponding keyblock in the keyring).
	*
	* This doesn't do anything if --dry-run was specified.
	*
	* Returns 0 on success. Otherwise, it returns an error code. Note:
	* if there isn't a keyblock in the keyring corresponding to KB, then
	* this function returns GPG_ERR_VALUE_NOT_FOUND.
	*
	* This function selects the matching record and modifies the current
	* file position to point to the record just after the selected entry.
	* Thus, if you do a subsequent search using HD, you should first do a
	* keydb_search_reset. Further, if the selected record is important,
	* you should use keydb_push_found_state and keydb_pop_found_state to
	* save and restore it. */
	gpg_error_t
	keydb_update_keyblock (ctrl_t ctrl, KEYDB_HANDLE hd, kbnode_t kb)
	{
	gpg_error_t err;
	PKT_public_key *pk;
	KEYDB_SEARCH_DESC desc;
	size_t len;

	log_assert (kb);
	log_assert (kb->pkt->pkttype == PKT_PUBLIC_KEY);
	pk = kb->pkt->pkt.public_key;

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	kid_not_found_flush ();
	keyblock_cache_clear (hd);

	if (opt.dry_run)
	return 0;

	err = lock_all (hd);
	if (err)
	return err;

	#ifdef USE_TOFU
	tofu_notice_key_changed (ctrl, kb);
	#endif

	memset (&desc, 0, sizeof (desc));
	fingerprint_from_pk (pk, desc.u.fpr, &len);
	if (len == 20)
	desc.mode = KEYDB_SEARCH_MODE_FPR20;
	else
	log_bug ("%s: Unsupported key length: %zu\n", __func__, len);

	keydb_search_reset (hd);
	err = keydb_search (hd, &desc, 1, NULL);
	if (err)
	return gpg_error (GPG_ERR_VALUE_NOT_FOUND);
	log_assert (hd->found >= 0 && hd->found < hd->used);

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	err = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	err = keyring_update_keyblock (hd->active[hd->found].u.kr, kb);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	{
	iobuf_t iobuf;

	err = build_keyblock_image (kb, &iobuf, NULL);
	if (!err)
	{
	err = keybox_update_keyblock (hd->active[hd->found].u.kb,
	iobuf_get_temp_buffer (iobuf),
	iobuf_get_temp_length (iobuf));
	iobuf_close (iobuf);
	}
	}
	break;
	}

	unlock_all (hd);
	return err;
	}


	/* Insert a keyblock into one of the underlying keyrings or keyboxes.
	*
	* Be default, the keyring / keybox from which the last search result
	* came is used. If there was no previous search result (or
	* keydb_search_reset was called), then the keyring / keybox where the
	* next search would start is used (i.e., the current file position).
	*
	* Note: this doesn't do anything if --dry-run was specified.
	*
	* Returns 0 on success. Otherwise, it returns an error code. */
	gpg_error_t
	keydb_insert_keyblock (KEYDB_HANDLE hd, kbnode_t kb)
	{
	gpg_error_t err;
	int idx;

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	kid_not_found_flush ();
	keyblock_cache_clear (hd);

	if (opt.dry_run)
	return 0;

	if (hd->found >= 0 && hd->found < hd->used)
	idx = hd->found;
	else if (hd->current >= 0 && hd->current < hd->used)
	idx = hd->current;
	else
	return gpg_error (GPG_ERR_GENERAL);

	err = lock_all (hd);
	if (err)
	return err;

	switch (hd->active[idx].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	err = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	err = keyring_insert_keyblock (hd->active[idx].u.kr, kb);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	{ /* We need to turn our kbnode_t list of packets into a proper
	keyblock first. This is required by the OpenPGP key parser
	included in the keybox code. Eventually we can change this
	kludge to have the caller pass the image. */
	iobuf_t iobuf;
	u32 *sigstatus;

	err = build_keyblock_image (kb, &iobuf, &sigstatus);
	if (!err)
	{
	err = keybox_insert_keyblock (hd->active[idx].u.kb,
	iobuf_get_temp_buffer (iobuf),
	iobuf_get_temp_length (iobuf),
	sigstatus);
	xfree (sigstatus);
	iobuf_close (iobuf);
	}
	}
	break;
	}

	unlock_all (hd);
	return err;
	}


	/* Delete the currently selected keyblock. If you haven't done a
	* search yet on this database handle (or called keydb_search_reset),
	* then this will return an error.
	*
	* Returns 0 on success or an error code, if an error occurs. */
	gpg_error_t
	keydb_delete_keyblock (KEYDB_HANDLE hd)
	{
	gpg_error_t rc;

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	kid_not_found_flush ();
	keyblock_cache_clear (hd);

	if (hd->found < 0 \|\| hd->found >= hd->used)
	return gpg_error (GPG_ERR_VALUE_NOT_FOUND);

	if (opt.dry_run)
	return 0;

	rc = lock_all (hd);
	if (rc)
	return rc;

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	rc = gpg_error (GPG_ERR_GENERAL);
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	rc = keyring_delete_keyblock (hd->active[hd->found].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_delete (hd->active[hd->found].u.kb);
	break;
	}

	unlock_all (hd);
	return rc;
	}



	/* A database may consists of multiple keyrings / key boxes. This
	* sets the "file position" to the start of the first keyring / key
	* box that is writable (i.e., doesn't have the read-only flag set).
	*
	* This first tries the primary keyring (the last keyring (not
	* keybox!) added using keydb_add_resource() and with
	* KEYDB_RESOURCE_FLAG_PRIMARY set). If that is not writable, then it
	* tries the keyrings / keyboxes in the order in which they were
	* added. */
	gpg_error_t
	keydb_locate_writable (KEYDB_HANDLE hd)
	{
	gpg_error_t rc;

	if (!hd)
	return GPG_ERR_INV_ARG;

	rc = keydb_search_reset (hd); /* this does reset hd->current */
	if (rc)
	return rc;

	/* If we have a primary set, try that one first */
	if (primary_keydb)
	{
	for ( ; hd->current >= 0 && hd->current < hd->used; hd->current++)
	{
	if(hd->active[hd->current].token == primary_keydb)
	{
	if(keyring_is_writable (hd->active[hd->current].token))
	return 0;
	else
	break;
	}
	}

	rc = keydb_search_reset (hd); /* this does reset hd->current */
	if (rc)
	return rc;
	}

	for ( ; hd->current >= 0 && hd->current < hd->used; hd->current++)
	{
	switch (hd->active[hd->current].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	BUG();
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	if (keyring_is_writable (hd->active[hd->current].token))
	return 0; /* found (hd->current is set to it) */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	if (keybox_is_writable (hd->active[hd->current].token))
	return 0; /* found (hd->current is set to it) */
	break;
	}
	}

	return gpg_error (GPG_ERR_NOT_FOUND);
	}


	/* Rebuild the on-disk caches of all key resources. */
	void
	keydb_rebuild_caches (int noisy)
	{
	int i, rc;

	for (i=0; i < used_resources; i++)
	{
	if (!keyring_is_writable (all_resources[i].token))
	continue;
	switch (all_resources[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE: /* ignore */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	rc = keyring_rebuild_cache (all_resources[i].token,noisy);
	if (rc)
	log_error (_("failed to rebuild keyring cache: %s\n"),
	gpg_strerror (rc));
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	/* N/A. */
	break;
	}
	}
	}


	/* Return the number of skipped blocks (because they were to large to
	read from a keybox) since the last search reset. */
	unsigned long
	keydb_get_skipped_counter (KEYDB_HANDLE hd)
	{
	return hd ? hd->skipped_long_blobs : 0;
	}


	/* Clears the current search result and resets the handle's position
	* so that the next search starts at the beginning of the database
	* (the start of the first resource).
	*
	* Returns 0 on success and an error code if an error occurred.
	* (Currently, this function always returns 0 if HD is valid.) */
	gpg_error_t
	keydb_search_reset (KEYDB_HANDLE hd)
	{
	gpg_error_t rc = 0;
	int i;

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	keyblock_cache_clear (hd);

	if (DBG_CLOCK)
	log_clock ("keydb_search_reset");

	if (DBG_CACHE)
	log_debug ("keydb_search: reset (hd=%p)", hd);

	hd->skipped_long_blobs = 0;
	hd->current = 0;
	hd->found = -1;
	/* Now reset all resources. */
	for (i=0; !rc && i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	rc = keyring_search_reset (hd->active[i].u.kr);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_search_reset (hd->active[i].u.kb);
	break;
	}
	}
	hd->is_reset = 1;
	return rc;
	}


	/* Search the database for keys matching the search description. If
	* the DB contains any legacy keys, these are silently ignored.
	*
	* DESC is an array of search terms with NDESC entries. The search
	* terms are or'd together. That is, the next entry in the DB that
	* matches any of the descriptions will be returned.
	*
	* Note: this function resumes searching where the last search left
	* off (i.e., at the current file position). If you want to search
	* from the start of the database, then you need to first call
	* keydb_search_reset().
	*
	* If no key matches the search description, returns
	* GPG_ERR_NOT_FOUND. If there was a match, returns 0. If an error
	* occurred, returns an error code.
	*
	* The returned key is considered to be selected and the raw data can,
	* for instance, be returned by calling keydb_get_keyblock(). */
	gpg_error_t
	keydb_search (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc,
	size_t ndesc, size_t *descindex)
	{
	int i;
	gpg_error_t rc;
	int was_reset = hd->is_reset;
	/* If an entry is already in the cache, then don't add it again. */
	int already_in_cache = 0;

	if (descindex)
	descindex = 0; / Make sure it is always set on return. */

	if (!hd)
	return gpg_error (GPG_ERR_INV_ARG);

	if (!any_registered)
	{
	write_status_error ("keydb_search", gpg_error (GPG_ERR_KEYRING_OPEN));
	return gpg_error (GPG_ERR_NOT_FOUND);
	}

	if (DBG_CLOCK)
	log_clock ("keydb_search enter");

	if (DBG_LOOKUP)
	{
	log_debug ("%s: %zd search descriptions:\n", __func__, ndesc);
	for (i = 0; i < ndesc; i ++)
	{
	char *t = keydb_search_desc_dump (&desc[i]);
	log_debug ("%s %d: %s\n", __func__, i, t);
	xfree (t);
	}
	}


	if (ndesc == 1 && desc[0].mode == KEYDB_SEARCH_MODE_LONG_KID
	&& (already_in_cache = kid_not_found_p (desc[0].u.kid)) == 1 )
	{
	if (DBG_CLOCK)
	log_clock ("keydb_search leave (not found, cached)");
	return gpg_error (GPG_ERR_NOT_FOUND);
	}

	/* NB: If one of the exact search modes below is used in a loop to
	walk over all keys (with the same fingerprint) the caching must
	have been disabled for the handle. */
	if (!hd->no_caching
	&& ndesc == 1
	&& (desc[0].mode == KEYDB_SEARCH_MODE_FPR20
	\|\| desc[0].mode == KEYDB_SEARCH_MODE_FPR)
	&& hd->keyblock_cache.state == KEYBLOCK_CACHE_FILLED
	&& !memcmp (hd->keyblock_cache.fpr, desc[0].u.fpr, 20)
	/* Make sure the current file position occurs before the cached
	result to avoid an infinite loop. */
	&& (hd->current < hd->keyblock_cache.resource
	\|\| (hd->current == hd->keyblock_cache.resource
	&& (keybox_offset (hd->active[hd->current].u.kb)
	<= hd->keyblock_cache.offset))))
	{
	/* (DESCINDEX is already set). */
	if (DBG_CLOCK)
	log_clock ("keydb_search leave (cached)");

	hd->current = hd->keyblock_cache.resource;
	/* HD->KEYBLOCK_CACHE.OFFSET is the last byte in the record.
	Seek just beyond that. */
	keybox_seek (hd->active[hd->current].u.kb,
	hd->keyblock_cache.offset + 1);
	return 0;
	}

	rc = -1;
	while ((rc == -1 \|\| gpg_err_code (rc) == GPG_ERR_EOF)
	&& hd->current >= 0 && hd->current < hd->used)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: searching %s (resource %d of %d)\n",
	__func__,
	hd->active[hd->current].type == KEYDB_RESOURCE_TYPE_KEYRING
	? "keyring"
	: (hd->active[hd->current].type == KEYDB_RESOURCE_TYPE_KEYBOX
	? "keybox" : "unknown type"),
	hd->current, hd->used);

	switch (hd->active[hd->current].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	BUG(); /* we should never see it here */
	break;
	case KEYDB_RESOURCE_TYPE_KEYRING:
	rc = keyring_search (hd->active[hd->current].u.kr, desc,
	ndesc, descindex, 1);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	do
	rc = keybox_search (hd->active[hd->current].u.kb, desc,
	ndesc, KEYBOX_BLOBTYPE_PGP,
	descindex, &hd->skipped_long_blobs);
	while (rc == GPG_ERR_LEGACY_KEY);
	break;
	}

	if (DBG_LOOKUP)
	log_debug ("%s: searched %s (resource %d of %d) => %s\n",
	__func__,
	hd->active[hd->current].type == KEYDB_RESOURCE_TYPE_KEYRING
	? "keyring"
	: (hd->active[hd->current].type == KEYDB_RESOURCE_TYPE_KEYBOX
	? "keybox" : "unknown type"),
	hd->current, hd->used,
	rc == -1 ? "EOF" : gpg_strerror (rc));

	if (rc == -1 \|\| gpg_err_code (rc) == GPG_ERR_EOF)
	{
	/* EOF -> switch to next resource */
	hd->current++;
	}
	else if (!rc)
	hd->found = hd->current;
	}
	hd->is_reset = 0;

	rc = ((rc == -1 \|\| gpg_err_code (rc) == GPG_ERR_EOF)
	? gpg_error (GPG_ERR_NOT_FOUND)
	: rc);

	keyblock_cache_clear (hd);
	if (!hd->no_caching
	&& !rc
	&& ndesc == 1 && (desc[0].mode == KEYDB_SEARCH_MODE_FPR20
	\|\| desc[0].mode == KEYDB_SEARCH_MODE_FPR)
	&& hd->active[hd->current].type == KEYDB_RESOURCE_TYPE_KEYBOX)
	{
	hd->keyblock_cache.state = KEYBLOCK_CACHE_PREPARED;
	hd->keyblock_cache.resource = hd->current;
	/* The current offset is at the start of the next record. Since
	a record is at least 1 byte, we just use offset - 1, which is
	within the record. */
	hd->keyblock_cache.offset
	= keybox_offset (hd->active[hd->current].u.kb) - 1;
	memcpy (hd->keyblock_cache.fpr, desc[0].u.fpr, 20);
	}

	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND
	&& ndesc == 1 && desc[0].mode == KEYDB_SEARCH_MODE_LONG_KID && was_reset
	&& !already_in_cache)
	kid_not_found_insert (desc[0].u.kid);

	if (DBG_CLOCK)
	log_clock (rc? "keydb_search leave (not found)"
	: "keydb_search leave (found)");
	return rc;
	}


	/* Return the first non-legacy key in the database.
	*
	* If you want the very first key in the database, you can directly
	* call keydb_search with the search description
	* KEYDB_SEARCH_MODE_FIRST. */
	gpg_error_t
	keydb_search_first (KEYDB_HANDLE hd)
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;

	err = keydb_search_reset (hd);
	if (err)
	return err;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FIRST;
	return keydb_search (hd, &desc, 1, NULL);
	}


	/* Return the next key (not the next matching key!).
	*
	* Unlike calling keydb_search with KEYDB_SEARCH_MODE_NEXT, this
	* function silently skips legacy keys. */
	gpg_error_t
	keydb_search_next (KEYDB_HANDLE hd)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_NEXT;
	return keydb_search (hd, &desc, 1, NULL);
	}


	/* This is a convenience function for searching for keys with a long
	* key id.
	*
	* Note: this function resumes searching where the last search left
	* off. If you want to search the whole database, then you need to
	* first call keydb_search_reset(). */
	gpg_error_t
	keydb_search_kid (KEYDB_HANDLE hd, u32 *kid)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_LONG_KID;
	desc.u.kid[0] = kid[0];
	desc.u.kid[1] = kid[1];
	return keydb_search (hd, &desc, 1, NULL);
	}


	/* This is a convenience function for searching for keys with a long
	* (20 byte) fingerprint.
	*
	* Note: this function resumes searching where the last search left
	* off. If you want to search the whole database, then you need to
	* first call keydb_search_reset(). */
	gpg_error_t
	keydb_search_fpr (KEYDB_HANDLE hd, const byte *fpr)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FPR;
	memcpy (desc.u.fpr, fpr, MAX_FINGERPRINT_LEN);
	return keydb_search (hd, &desc, 1, NULL);
	}
	diff --git a/g10/keyedit.c b/g10/keyedit.c
	index 1456d2867..ab66d0163 100644
	--- a/g10/keyedit.c
	+++ b/g10/keyedit.c
	@@ -1,6654 +1,6654 @@
	/* keyedit.c - Edit properties of a key
	* Copyright (C) 1998-2010 Free Software Foundation, Inc.
	* Copyright (C) 1998-2016 Werner Koch
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>
	#ifdef HAVE_LIBREADLINE
	# define GNUPG_LIBREADLINE_H_INCLUDED
	# include <readline/readline.h>
	#endif

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "iobuf.h"
	#include "keydb.h"
	#include "photoid.h"
	#include "util.h"
	#include "main.h"
	#include "trustdb.h"
	#include "filter.h"
	#include "ttyio.h"
	#include "status.h"
	#include "i18n.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "host2net.h"
	#include "tofu.h"

	static void show_prefs (PKT_user_id * uid, PKT_signature * selfsig,
	int verbose);
	static void show_names (ctrl_t ctrl, estream_t fp,
	kbnode_t keyblock, PKT_public_key * pk,
	unsigned int flag, int with_prefs);
	static void show_key_with_all_names (ctrl_t ctrl, estream_t fp,
	KBNODE keyblock, int only_marked,
	int with_revoker, int with_fpr,
	int with_subkeys, int with_prefs,
	int nowarn);
	static void show_key_and_fingerprint (kbnode_t keyblock, int with_subkeys);
	static void show_key_and_grip (kbnode_t keyblock);
	static void subkey_expire_warning (kbnode_t keyblock);
	static int menu_adduid (ctrl_t ctrl, kbnode_t keyblock,
	int photo, const char photo_name, const char uidstr);
	static void menu_deluid (KBNODE pub_keyblock);
	static int menu_delsig (KBNODE pub_keyblock);
	static int menu_clean (KBNODE keyblock, int self_only);
	static void menu_delkey (KBNODE pub_keyblock);
	static int menu_addrevoker (ctrl_t ctrl, kbnode_t pub_keyblock, int sensitive);
	static gpg_error_t menu_expire (kbnode_t pub_keyblock,
	int force_mainkey, u32 newexpiration);
	static int menu_changeusage (kbnode_t keyblock);
	static int menu_backsign (KBNODE pub_keyblock);
	static int menu_set_primary_uid (KBNODE pub_keyblock);
	static int menu_set_preferences (KBNODE pub_keyblock);
	static int menu_set_keyserver_url (const char *url, KBNODE pub_keyblock);
	static int menu_set_notation (const char *string, KBNODE pub_keyblock);
	static int menu_select_uid (KBNODE keyblock, int idx);
	static int menu_select_uid_namehash (KBNODE keyblock, const char *namehash);
	static int menu_select_key (KBNODE keyblock, int idx, char *p);
	static int count_uids (KBNODE keyblock);
	static int count_uids_with_flag (KBNODE keyblock, unsigned flag);
	static int count_keys_with_flag (KBNODE keyblock, unsigned flag);
	static int count_selected_uids (KBNODE keyblock);
	static int real_uids_left (KBNODE keyblock);
	static int count_selected_keys (KBNODE keyblock);
	static int menu_revsig (KBNODE keyblock);
	static int menu_revuid (ctrl_t ctrl, kbnode_t keyblock);
	static int core_revuid (ctrl_t ctrl, kbnode_t keyblock, KBNODE node,
	const struct revocation_reason_info *reason,
	int *modified);
	static int menu_revkey (KBNODE pub_keyblock);
	static int menu_revsubkey (KBNODE pub_keyblock);
	#ifndef NO_TRUST_MODELS
	static int enable_disable_key (KBNODE keyblock, int disable);
	#endif /!NO_TRUST_MODELS/
	static void menu_showphoto (ctrl_t ctrl, kbnode_t keyblock);

	static int update_trust = 0;

	#define CONTROL_D ('D' - 'A' + 1)

	#define NODFLG_BADSIG (1<<0) /* Bad signature. */
	#define NODFLG_NOKEY (1<<1) /* No public key. */
	#define NODFLG_SIGERR (1<<2) /* Other sig error. */

	#define NODFLG_MARK_A (1<<4) /* Temporary mark. */
	#define NODFLG_DELSIG (1<<5) /* To be deleted. */

	#define NODFLG_SELUID (1<<8) /* Indicate the selected userid. */
	#define NODFLG_SELKEY (1<<9) /* Indicate the selected key. */
	#define NODFLG_SELSIG (1<<10) /* Indicate a selected signature. */

	struct sign_attrib
	{
	int non_exportable, non_revocable;
	struct revocation_reason_info *reason;
	byte trust_depth, trust_value;
	char *trust_regexp;
	};



	/* TODO: Fix duplicated code between here and the check-sigs/list-sigs
	code in keylist.c. */
	static int
	print_and_check_one_sig_colon (KBNODE keyblock, KBNODE node,
	int inv_sigs, int no_key, int *oth_err,
	int *is_selfsig, int print_without_key)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int rc, sigrc;

	/* TODO: Make sure a cached sig record here still has the pk that
	issued it. See also keylist.c:list_keyblock_print */

	rc = check_key_signature (keyblock, node, is_selfsig);
	switch (gpg_err_code (rc))
	{
	case 0:
	node->flag &= ~(NODFLG_BADSIG \| NODFLG_NOKEY \| NODFLG_SIGERR);
	sigrc = '!';
	break;
	case GPG_ERR_BAD_SIGNATURE:
	node->flag = NODFLG_BADSIG;
	sigrc = '-';
	if (inv_sigs)
	++ * inv_sigs;
	break;
	case GPG_ERR_NO_PUBKEY:
	case GPG_ERR_UNUSABLE_PUBKEY:
	node->flag = NODFLG_NOKEY;
	sigrc = '?';
	if (no_key)
	++ * no_key;
	break;
	default:
	node->flag = NODFLG_SIGERR;
	sigrc = '%';
	if (oth_err)
	++ * oth_err;
	break;
	}

	if (sigrc != '?' \|\| print_without_key)
	{
	es_printf ("sig:%c::%d:%08lX%08lX:%lu:%lu:",
	sigrc, sig->pubkey_algo, (ulong) sig->keyid[0],
	(ulong) sig->keyid[1], (ulong) sig->timestamp,
	(ulong) sig->expiredate);

	if (sig->trust_depth \|\| sig->trust_value)
	es_printf ("%d %d", sig->trust_depth, sig->trust_value);

	es_printf (":");

	if (sig->trust_regexp)
	es_write_sanitized (es_stdout,
	sig->trust_regexp, strlen (sig->trust_regexp),
	":", NULL);

	es_printf ("::%02x%c\n", sig->sig_class,
	sig->flags.exportable ? 'x' : 'l');

	if (opt.show_subpackets)
	print_subpackets_colon (sig);
	}

	return (sigrc == '!');
	}


	/*
	* Print information about a signature (rc is its status), check it
	* and return true if the signature is okay. NODE must be a signature
	* packet. With EXTENDED set all possible signature list options will
	* always be printed.
	*/
	static int
	print_one_sig (int rc, KBNODE keyblock, KBNODE node,
	int inv_sigs, int no_key, int *oth_err,
	int is_selfsig, int print_without_key, int extended)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int sigrc;
	int is_rev = sig->sig_class == 0x30;

	/* TODO: Make sure a cached sig record here still has the pk that
	issued it. See also keylist.c:list_keyblock_print */

	switch (gpg_err_code (rc))
	{
	case 0:
	node->flag &= ~(NODFLG_BADSIG \| NODFLG_NOKEY \| NODFLG_SIGERR);
	sigrc = '!';
	break;
	case GPG_ERR_BAD_SIGNATURE:
	node->flag = NODFLG_BADSIG;
	sigrc = '-';
	if (inv_sigs)
	++ * inv_sigs;
	break;
	case GPG_ERR_NO_PUBKEY:
	case GPG_ERR_UNUSABLE_PUBKEY:
	node->flag = NODFLG_NOKEY;
	sigrc = '?';
	if (no_key)
	++ * no_key;
	break;
	default:
	node->flag = NODFLG_SIGERR;
	sigrc = '%';
	if (oth_err)
	++ * oth_err;
	break;
	}
	if (sigrc != '?' \|\| print_without_key)
	{
	tty_printf ("%s%c%c %c%c%c%c%c%c %s %s",
	is_rev ? "rev" : "sig", sigrc,
	(sig->sig_class - 0x10 > 0 &&
	sig->sig_class - 0x10 <
	4) ? '0' + sig->sig_class - 0x10 : ' ',
	sig->flags.exportable ? ' ' : 'L',
	sig->flags.revocable ? ' ' : 'R',
	sig->flags.policy_url ? 'P' : ' ',
	sig->flags.notation ? 'N' : ' ',
	sig->flags.expired ? 'X' : ' ',
	(sig->trust_depth > 9) ? 'T' : (sig->trust_depth >
	0) ? '0' +
	sig->trust_depth : ' ',
	keystr (sig->keyid),
	datestr_from_sig (sig));
	if ((opt.list_options & LIST_SHOW_SIG_EXPIRE) \|\| extended )
	tty_printf (" %s", expirestr_from_sig (sig));
	tty_printf (" ");
	if (sigrc == '%')
	tty_printf ("[%s] ", gpg_strerror (rc));
	else if (sigrc == '?')
	;
	else if (is_selfsig)
	{
	tty_printf (is_rev ? _("[revocation]") : _("[self-signature]"));
	if (extended && sig->flags.chosen_selfsig)
	tty_printf ("*");
	}
	else
	{
	size_t n;
	char *p = get_user_id (sig->keyid, &n);
	tty_print_utf8_string2 (NULL, p, n,
	opt.screen_columns - keystrlen () - 26 -
	((opt.
	list_options & LIST_SHOW_SIG_EXPIRE) ? 11
	: 0));
	xfree (p);
	}
	tty_printf ("\n");

	if (sig->flags.policy_url
	&& ((opt.list_options & LIST_SHOW_POLICY_URLS) \|\| extended))
	show_policy_url (sig, 3, -1);

	if (sig->flags.notation
	&& ((opt.list_options & LIST_SHOW_NOTATIONS) \|\| extended))
	show_notation (sig, 3, -1,
	((opt.
	list_options & LIST_SHOW_STD_NOTATIONS) ? 1 : 0) +
	((opt.
	list_options & LIST_SHOW_USER_NOTATIONS) ? 2 : 0));

	if (sig->flags.pref_ks
	&& ((opt.list_options & LIST_SHOW_KEYSERVER_URLS) \|\| extended))
	show_keyserver_url (sig, 3, -1);

	if (extended)
	{
	PKT_public_key *pk = keyblock->pkt->pkt.public_key;
	const unsigned char *s;

	s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID, NULL);
	if (s && *s)
	tty_printf (" [primary]\n");

	s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (s && buf32_to_u32 (s))
	tty_printf (" [expires: %s]\n",
	isotimestamp (pk->timestamp + buf32_to_u32 (s)));
	}
	}

	return (sigrc == '!');
	}


	static int
	print_and_check_one_sig (KBNODE keyblock, KBNODE node,
	int inv_sigs, int no_key, int *oth_err,
	int *is_selfsig, int print_without_key, int extended)
	{
	int rc;

	rc = check_key_signature (keyblock, node, is_selfsig);
	return print_one_sig (rc,
	keyblock, node, inv_sigs, no_key, oth_err,
	*is_selfsig, print_without_key, extended);
	}



	/* Order two signatures. The actual ordering isn't important. Our
	goal is to ensure that identical signatures occur together. */
	static int
	sig_comparison (const void av, const void bv)
	{
	const KBNODE an = (const KBNODE ) av;
	const KBNODE bn = (const KBNODE ) bv;
	const PKT_signature *a;
	const PKT_signature *b;
	int ndataa;
	int ndatab;
	int i;

	log_assert (an->pkt->pkttype == PKT_SIGNATURE);
	log_assert (bn->pkt->pkttype == PKT_SIGNATURE);

	a = an->pkt->pkt.signature;
	b = bn->pkt->pkt.signature;

	if (a->digest_algo < b->digest_algo)
	return -1;
	if (a->digest_algo > b->digest_algo)
	return 1;

	ndataa = pubkey_get_nsig (a->pubkey_algo);
	ndatab = pubkey_get_nsig (b->pubkey_algo);
	if (ndataa != ndatab)
	return (ndataa < ndatab)? -1 : 1;

	for (i = 0; i < ndataa; i ++)
	{
	int c = gcry_mpi_cmp (a->data[i], b->data[i]);
	if (c != 0)
	return c;
	}

	/* Okay, they are equal. */
	return 0;
	}

	/* Perform a few sanity checks on a keyblock is okay and possibly
	repair some damage. Concretely:

	- Detect duplicate signatures and remove them.

	- Detect out of order signatures and relocate them (e.g., a sig
	over user id X located under subkey Y).

	Note: this function does not remove signatures that don't belong or
	components that are not signed! (Although it would be trivial to
	do so.)

	If ONLY_SELFSIGS is true, then this function only reorders self
	signatures (it still checks all signatures for duplicates,
	however).

	Returns 1 if the keyblock was modified, 0 otherwise. */
	static int
	check_all_keysigs (KBNODE kb, int only_selected, int only_selfsigs)
	{
	gpg_error_t err;
	PKT_public_key *pk;
	KBNODE n, n_next, *n_prevp, n2;
	char *pending_desc = NULL;
	PKT_public_key *issuer;
	KBNODE last_printed_component;
	KBNODE current_component = NULL;
	int dups = 0;
	int missing_issuer = 0;
	int reordered = 0;
	int bad_signature = 0;
	int missing_selfsig = 0;
	int modified = 0;

	log_assert (kb->pkt->pkttype == PKT_PUBLIC_KEY);
	pk = kb->pkt->pkt.public_key;

	/* First we look for duplicates. */
	{
	int nsigs;
	kbnode_t *sigs;
	int i;
	int last_i;

	/* Count the sigs. */
	for (nsigs = 0, n = kb; n; n = n->next)
	{
	if (is_deleted_kbnode (n))
	continue;
	else if (n->pkt->pkttype == PKT_SIGNATURE)
	nsigs ++;
	}

	if (!nsigs)
	return 0; /* No signatures at all. */

	/* Add them all to the SIGS array. */
	sigs = xtrycalloc (nsigs, sizeof *sigs);
	if (!sigs)
	{
	log_error (_("error allocating memory: %s\n"),
	gpg_strerror (gpg_error_from_syserror ()));
	return 0;
	}

	i = 0;
	for (n = kb; n; n = n->next)
	{
	if (is_deleted_kbnode (n))
	continue;

	if (n->pkt->pkttype != PKT_SIGNATURE)
	continue;

	sigs[i] = n;
	i ++;
	}
	log_assert (i == nsigs);

	qsort (sigs, nsigs, sizeof (sigs[0]), sig_comparison);

	last_i = 0;
	for (i = 1; i < nsigs; i ++)
	{
	log_assert (sigs[last_i]);
	log_assert (sigs[last_i]->pkt->pkttype == PKT_SIGNATURE);
	log_assert (sigs[i]);
	log_assert (sigs[i]->pkt->pkttype == PKT_SIGNATURE);

	if (sig_comparison (&sigs[last_i], &sigs[i]) == 0)
	/* They are the same. Kill the latter. */
	{
	if (DBG_PACKET)
	{
	PKT_signature *sig = sigs[i]->pkt->pkt.signature;

	log_debug ("Signature appears multiple times, "
	"deleting duplicate:\n");
	log_debug (" sig: class 0x%x, issuer: %s,"
	" timestamp: %s (%lld), digest: %02x %02x\n",
	sig->sig_class, keystr (sig->keyid),
	isotimestamp (sig->timestamp),
	(long long) sig->timestamp,
	sig->digest_start[0], sig->digest_start[1]);
	}

	/* Remove sigs[i] from the keyblock. */
	{
	KBNODE z, *prevp;
	int to_kill = last_i;
	last_i = i;

	for (prevp = &kb, z = kb; z; prevp = &z->next, z = z->next)
	if (z == sigs[to_kill])
	break;

	*prevp = sigs[to_kill]->next;

	sigs[to_kill]->next = NULL;
	release_kbnode (sigs[to_kill]);
	sigs[to_kill] = NULL;

	dups ++;
	modified = 1;
	}
	}
	else
	last_i = i;
	}

	xfree (sigs);
	}

	/* Make sure the sigs occur after the component (public key, subkey,
	user id) that they sign. */
	issuer = NULL;
	last_printed_component = NULL;
	for (n_prevp = &kb, n = kb;
	n;
	/* If we moved n, then n_prevp is need valid. */
	n_prevp = (n->next == n_next ? &n->next : n_prevp), n = n_next)
	{
	PACKET *p;
	int processed_current_component;
	PKT_signature *sig;
	int rc;
	int dump_sig_params = 0;

	n_next = n->next;

	if (is_deleted_kbnode (n))
	continue;

	p = n->pkt;

	if (issuer && issuer != pk)
	{
	free_public_key (issuer);
	issuer = NULL;
	}

	xfree (pending_desc);
	pending_desc = NULL;

	switch (p->pkttype)
	{
	case PKT_PUBLIC_KEY:
	log_assert (p->pkt.public_key == pk);
	if (only_selected && ! (n->flag & NODFLG_SELKEY))
	{
	current_component = NULL;
	break;
	}

	if (DBG_PACKET)
	log_debug ("public key %s: timestamp: %s (%lld)\n",
	pk_keyid_str (pk),
	isotimestamp (pk->timestamp),
	(long long) pk->timestamp);
	current_component = n;
	break;
	case PKT_PUBLIC_SUBKEY:
	if (only_selected && ! (n->flag & NODFLG_SELKEY))
	{
	current_component = NULL;
	break;
	}

	if (DBG_PACKET)
	log_debug ("subkey %s: timestamp: %s (%lld)\n",
	pk_keyid_str (p->pkt.public_key),
	isotimestamp (p->pkt.public_key->timestamp),
	(long long) p->pkt.public_key->timestamp);
	current_component = n;
	break;
	case PKT_USER_ID:
	if (only_selected && ! (n->flag & NODFLG_SELUID))
	{
	current_component = NULL;
	break;
	}

	if (DBG_PACKET)
	log_debug ("user id: %s\n",
	p->pkt.user_id->attrib_data
	? "[ photo id ]"
	: p->pkt.user_id->name);
	current_component = n;
	break;
	case PKT_SIGNATURE:
	if (! current_component)
	/* The current component is not selected, don't check the
	sigs under it. */
	break;

	sig = n->pkt->pkt.signature;

	pending_desc = xasprintf (" sig: class: 0x%x, issuer: %s,"
	" timestamp: %s (%lld), digest: %02x %02x",
	sig->sig_class,
	keystr (sig->keyid),
	isotimestamp (sig->timestamp),
	(long long) sig->timestamp,
	sig->digest_start[0], sig->digest_start[1]);


	if (keyid_cmp (pk_keyid (pk), sig->keyid) == 0)
	issuer = pk;
	else
	/* Issuer is a different key. */
	{
	if (only_selfsigs)
	continue;

	issuer = xmalloc (sizeof (*issuer));
	err = get_pubkey (issuer, sig->keyid);
	if (err)
	{
	xfree (issuer);
	issuer = NULL;
	if (DBG_PACKET)
	{
	if (pending_desc)
	log_debug ("%s", pending_desc);
	log_debug (" Can't check signature allegedly"
	" issued by %s: %s\n",
	keystr (sig->keyid), gpg_strerror (err));
	}
	missing_issuer ++;
	break;
	}
	}

	if ((err = openpgp_pk_test_algo (sig->pubkey_algo)))
	{
	if (DBG_PACKET && pending_desc)
	log_debug ("%s", pending_desc);
	tty_printf (_("can't check signature with unsupported"
	" public-key algorithm (%d): %s.\n"),
	sig->pubkey_algo, gpg_strerror (err));
	break;
	}
	if ((err = openpgp_md_test_algo (sig->digest_algo)))
	{
	if (DBG_PACKET && pending_desc)
	log_debug ("%s", pending_desc);
	tty_printf (_("can't check signature with unsupported"
	" message-digest algorithm %d: %s.\n"),
	sig->digest_algo, gpg_strerror (err));
	break;
	}

	/* We iterate over the keyblock. Most likely, the matching
	component is the current component so always try that
	first. */
	processed_current_component = 0;
	for (n2 = current_component;
	n2;
	n2 = (processed_current_component ? n2->next : kb),
	processed_current_component = 1)
	if (is_deleted_kbnode (n2))
	continue;
	else if (processed_current_component && n2 == current_component)
	/* Don't process it twice. */
	continue;
	else
	{
	err = check_signature_over_key_or_uid (issuer, sig, kb, n2->pkt,
	NULL, NULL);
	if (! err)
	break;
	}

	/* n/sig is a signature and n2 is the component (public key,
	subkey or user id) that it signs, if any.
	current_component is that component that it appears to
	apply to (according to the ordering). */

	if (current_component == n2)
	{
	if (DBG_PACKET)
	{
	log_debug ("%s", pending_desc);
	log_debug (" Good signature over last key or uid!\n");
	}

	rc = 0;
	}
	else if (n2)
	{
	log_assert (n2->pkt->pkttype == PKT_USER_ID
	\|\| n2->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| n2->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	if (DBG_PACKET)
	{
	log_debug ("%s", pending_desc);
	log_debug (" Good signature out of order!"
	" (Over %s (%d) '%s')\n",
	n2->pkt->pkttype == PKT_USER_ID
	? "user id"
	: n2->pkt->pkttype == PKT_PUBLIC_SUBKEY
	? "subkey"
	: "primary key",
	n2->pkt->pkttype,
	n2->pkt->pkttype == PKT_USER_ID
	? n2->pkt->pkt.user_id->name
	: pk_keyid_str (n2->pkt->pkt.public_key));
	}

	/* Reorder the packets: move the signature n to be just
	after n2. */

	/* Unlink the signature. */
	log_assert (n_prevp);
	*n_prevp = n->next;

	/* Insert the sig immediately after the component. */
	n->next = n2->next;
	n2->next = n;

	reordered ++;
	modified = 1;

	rc = 0;
	}
	else
	{
	if (DBG_PACKET)
	{
	log_debug ("%s", pending_desc);
	log_debug (" Bad signature.\n");
	}

	if (DBG_PACKET)
	dump_sig_params = 1;

	bad_signature ++;

	rc = GPG_ERR_BAD_SIGNATURE;
	}

	/* We don't cache the result here, because we haven't
	completely checked that the signature is legitimate. For
	instance, if we have a revocation certificate on Alice's
	key signed by Bob, the signature may be good, but we
	haven't checked that Bob is a designated revoker. */
	/* cache_sig_result (sig, rc); */

	{
	int has_selfsig = 0;
	if (! rc && issuer == pk)
	{
	if (n2->pkt->pkttype == PKT_PUBLIC_KEY
	&& (/* Direct key signature. */
	sig->sig_class == 0x1f
	/* Key revocation signature. */
	\|\| sig->sig_class == 0x20))
	has_selfsig = 1;
	if (n2->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& (/* Subkey binding sig. */
	sig->sig_class == 0x18
	/* Subkey revocation sig. */
	\|\| sig->sig_class == 0x28))
	has_selfsig = 1;
	if (n2->pkt->pkttype == PKT_USER_ID
	&& (/* Certification sigs. */
	sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13
	/* Certification revocation sig. */
	\|\| sig->sig_class == 0x30))
	has_selfsig = 1;
	}

	if ((n2 && n2 != last_printed_component)
	\|\| (! n2 && last_printed_component != current_component))
	{
	int is_reordered = n2 && n2 != current_component;
	if (n2)
	last_printed_component = n2;
	else
	last_printed_component = current_component;

	if (!modified)
	;
	else if (last_printed_component->pkt->pkttype == PKT_USER_ID)
	{
	tty_printf ("uid ");
	tty_print_utf8_string (last_printed_component
	->pkt->pkt.user_id->name,
	last_printed_component
	->pkt->pkt.user_id->len);
	}
	else if (last_printed_component->pkt->pkttype
	== PKT_PUBLIC_KEY)
	tty_printf ("pub %s",
	pk_keyid_str (last_printed_component
	->pkt->pkt.public_key));
	else
	tty_printf ("sub %s",
	pk_keyid_str (last_printed_component
	->pkt->pkt.public_key));

	if (modified)
	{
	if (is_reordered)
	tty_printf (_(" (reordered signatures follow)"));
	tty_printf ("\n");
	}
	}

	if (modified)
	print_one_sig (rc, kb, n, NULL, NULL, NULL, has_selfsig,
	0, only_selfsigs);
	}

	if (dump_sig_params)
	{
	int i;

	for (i = 0; i < pubkey_get_nsig (sig->pubkey_algo); i ++)
	{
	char buffer[1024];
	size_t len;
	char *printable;
	gcry_mpi_print (GCRYMPI_FMT_USG,
	buffer, sizeof (buffer), &len,
	sig->data[i]);
	printable = bin2hex (buffer, len, NULL);
	log_info (" %d: %s\n", i, printable);
	xfree (printable);
	}
	}
	break;
	default:
	if (DBG_PACKET)
	log_debug ("unhandled packet: %d\n", p->pkttype);
	break;
	}
	}

	xfree (pending_desc);
	pending_desc = NULL;

	if (issuer != pk)
	free_public_key (issuer);
	issuer = NULL;

	/* Identify keys / uids that don't have a self-sig. */
	{
	int has_selfsig = 0;
	PACKET *p;
	PKT_signature *sig;

	current_component = NULL;
	for (n = kb; n; n = n->next)
	{
	if (is_deleted_kbnode (n))
	continue;

	p = n->pkt;

	switch (p->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_USER_ID:
	if (current_component && ! has_selfsig)
	missing_selfsig ++;
	current_component = n;
	has_selfsig = 0;
	break;

	case PKT_SIGNATURE:
	if (! current_component \|\| has_selfsig)
	break;

	sig = n->pkt->pkt.signature;

	if (! (sig->flags.checked && sig->flags.valid))
	break;

	if (keyid_cmp (pk_keyid (pk), sig->keyid) != 0)
	/* Different issuer, couldn't be a self-sig. */
	break;

	if (current_component->pkt->pkttype == PKT_PUBLIC_KEY
	&& (/* Direct key signature. */
	sig->sig_class == 0x1f
	/* Key revocation signature. */
	\|\| sig->sig_class == 0x20))
	has_selfsig = 1;
	if (current_component->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& (/* Subkey binding sig. */
	sig->sig_class == 0x18
	/* Subkey revocation sig. */
	\|\| sig->sig_class == 0x28))
	has_selfsig = 1;
	if (current_component->pkt->pkttype == PKT_USER_ID
	&& (/* Certification sigs. */
	sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13
	/* Certification revocation sig. */
	\|\| sig->sig_class == 0x30))
	has_selfsig = 1;

	break;

	default:
	if (current_component && ! has_selfsig)
	missing_selfsig ++;
	current_component = NULL;
	}
	}
	}

	if (dups \|\| missing_issuer \|\| bad_signature \|\| reordered)
	tty_printf (_("key %s:\n"), pk_keyid_str (pk));

	if (dups)
	tty_printf (ngettext ("%d duplicate signature removed\n",
	"%d duplicate signatures removed\n", dups), dups);
	if (missing_issuer)
	tty_printf (ngettext ("%d signature not checked due to a missing key\n",
	"%d signatures not checked due to missing keys\n",
	missing_issuer), missing_issuer);
	if (bad_signature)
	tty_printf (ngettext ("%d bad signature\n",
	"%d bad signatures\n",
	bad_signature), bad_signature);
	if (reordered)
	tty_printf (ngettext ("%d signature reordered\n",
	"%d signatures reordered\n",
	reordered), reordered);

	if (only_selfsigs && (bad_signature \|\| reordered))
	tty_printf (_("Warning: errors found and only checked self-signatures,"
	" run '%s' to check all signatures.\n"), "check");

	return modified;
	}


	static int
	sign_mk_attrib (PKT_signature * sig, void *opaque)
	{
	struct sign_attrib *attrib = opaque;
	byte buf[8];

	if (attrib->non_exportable)
	{
	buf[0] = 0; /* not exportable */
	build_sig_subpkt (sig, SIGSUBPKT_EXPORTABLE, buf, 1);
	}

	if (attrib->non_revocable)
	{
	buf[0] = 0; /* not revocable */
	build_sig_subpkt (sig, SIGSUBPKT_REVOCABLE, buf, 1);
	}

	if (attrib->reason)
	revocation_reason_build_cb (sig, attrib->reason);

	if (attrib->trust_depth)
	{
	/* Not critical. If someone doesn't understand trust sigs,
	this can still be a valid regular signature. */
	buf[0] = attrib->trust_depth;
	buf[1] = attrib->trust_value;
	build_sig_subpkt (sig, SIGSUBPKT_TRUST, buf, 2);

	/* Critical. If someone doesn't understands regexps, this
	whole sig should be invalid. Note the +1 for the length -
	regexps are null terminated. */
	if (attrib->trust_regexp)
	build_sig_subpkt (sig, SIGSUBPKT_FLAG_CRITICAL \| SIGSUBPKT_REGEXP,
	attrib->trust_regexp,
	strlen (attrib->trust_regexp) + 1);
	}

	return 0;
	}


	static void
	trustsig_prompt (byte * trust_value, byte * trust_depth, char **regexp)
	{
	char *p;

	*trust_value = 0;
	*trust_depth = 0;
	*regexp = NULL;

	/* Same string as pkclist.c:do_edit_ownertrust */
	tty_printf (_
	("Please decide how far you trust this user to correctly verify"
	" other users' keys\n(by looking at passports, checking"
	" fingerprints from different sources, etc.)\n"));
	tty_printf ("\n");
	tty_printf (_(" %d = I trust marginally\n"), 1);
	tty_printf (_(" %d = I trust fully\n"), 2);
	tty_printf ("\n");

	while (*trust_value == 0)
	{
	p = cpr_get ("trustsig_prompt.trust_value", _("Your selection? "));
	trim_spaces (p);
	cpr_kill_prompt ();
	/* 60 and 120 are as per RFC2440 */
	if (p[0] == '1' && !p[1])
	*trust_value = 60;
	else if (p[0] == '2' && !p[1])
	*trust_value = 120;
	xfree (p);
	}

	tty_printf ("\n");

	tty_printf (_("Please enter the depth of this trust signature.\n"
	"A depth greater than 1 allows the key you are"
	" signing to make\n"
	"trust signatures on your behalf.\n"));
	tty_printf ("\n");

	while (*trust_depth == 0)
	{
	p = cpr_get ("trustsig_prompt.trust_depth", _("Your selection? "));
	trim_spaces (p);
	cpr_kill_prompt ();
	*trust_depth = atoi (p);
	xfree (p);
	}

	tty_printf ("\n");

	tty_printf (_("Please enter a domain to restrict this signature, "
	"or enter for none.\n"));

	tty_printf ("\n");

	p = cpr_get ("trustsig_prompt.trust_regexp", _("Your selection? "));
	trim_spaces (p);
	cpr_kill_prompt ();

	if (strlen (p) > 0)
	{
	char *q = p;
	int regexplen = 100, ind;

	*regexp = xmalloc (regexplen);

	/* Now mangle the domain the user entered into a regexp. To do
	this, \-escape everything that isn't alphanumeric, and attach
	"<[^>]+[@.]" to the front, and ">$" to the end. */

	strcpy (*regexp, "<[^>]+[@.]");
	ind = strlen (*regexp);

	while (*q)
	{
	if (!((q >= 'A' && q <= 'Z')
	\|\| (q >= 'a' && q <= 'z') \|\| (q >= '0' && q <= '9')))
	(*regexp)[ind++] = '\\';

	(regexp)[ind++] = q;

	if ((regexplen - ind) < 3)
	{
	regexplen += 100;
	regexp = xrealloc (regexp, regexplen);
	}

	q++;
	}

	(*regexp)[ind] = '\0';
	strcat (*regexp, ">$");
	}

	xfree (p);
	tty_printf ("\n");
	}


	/*
	- * Loop over all LOCUSR and and sign the uids after asking. If no
	+ * Loop over all LOCUSR and sign the uids after asking. If no
	* user id is marked, all user ids will be signed; if some user_ids
	* are marked only those will be signed. If QUICK is true the
	* function won't ask the user and use sensible defaults.
	*/
	static int
	sign_uids (ctrl_t ctrl, estream_t fp,
	kbnode_t keyblock, strlist_t locusr, int *ret_modified,
	int local, int nonrevocable, int trust, int interactive,
	int quick)
	{
	int rc = 0;
	SK_LIST sk_list = NULL;
	SK_LIST sk_rover = NULL;
	PKT_public_key *pk = NULL;
	KBNODE node, uidnode;
	PKT_public_key *primary_pk = NULL;
	int select_all = !count_selected_uids (keyblock) \|\| interactive;

	/* Build a list of all signators.
	*
	* We use the CERT flag to request the primary which must always
	* be one which is capable of signing keys. I can't see a reason
	* why to sign keys using a subkey. Implementation of USAGE_CERT
	* is just a hack in getkey.c and does not mean that a subkey
	* marked as certification capable will be used. */
	rc = build_sk_list (ctrl, locusr, &sk_list, PUBKEY_USAGE_CERT);
	if (rc)
	goto leave;

	/* Loop over all signators. */
	for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
	{
	u32 sk_keyid[2], pk_keyid[2];
	char p, trust_regexp = NULL;
	int class = 0, selfsig = 0;
	u32 duration = 0, timestamp = 0;
	byte trust_depth = 0, trust_value = 0;

	pk = sk_rover->pk;
	keyid_from_pk (pk, sk_keyid);

	/* Set mark A for all selected user ids. */
	for (node = keyblock; node; node = node->next)
	{
	if (select_all \|\| (node->flag & NODFLG_SELUID))
	node->flag \|= NODFLG_MARK_A;
	else
	node->flag &= ~NODFLG_MARK_A;
	}

	/* Reset mark for uids which are already signed. */
	uidnode = NULL;
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	primary_pk = node->pkt->pkt.public_key;
	keyid_from_pk (primary_pk, pk_keyid);

	/* Is this a self-sig? */
	if (pk_keyid[0] == sk_keyid[0] && pk_keyid[1] == sk_keyid[1])
	selfsig = 1;
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	uidnode = (node->flag & NODFLG_MARK_A) ? node : NULL;
	if (uidnode)
	{
	int yesreally = 0;
	char *user;

	user = utf8_to_native (uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len, 0);

	if (opt.only_sign_text_ids
	&& uidnode->pkt->pkt.user_id->attribs)
	{
	tty_fprintf (fp, _("Skipping user ID \"%s\","
	" which is not a text ID.\n"),
	user);
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	}
	else if (uidnode->pkt->pkt.user_id->is_revoked)
	{
	tty_fprintf (fp, _("User ID \"%s\" is revoked."), user);

	if (selfsig)
	tty_fprintf (fp, "\n");
	else if (opt.expert && !quick)
	{
	tty_fprintf (fp, "\n");
	/* No, so remove the mark and continue */
	if (!cpr_get_answer_is_yes ("sign_uid.revoke_okay",
	_("Are you sure you "
	"still want to sign "
	"it? (y/N) ")))
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	}
	else if (interactive)
	yesreally = 1;
	}
	else
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	tty_fprintf (fp, _(" Unable to sign.\n"));
	}
	}
	else if (uidnode->pkt->pkt.user_id->is_expired)
	{
	tty_fprintf (fp, _("User ID \"%s\" is expired."), user);

	if (selfsig)
	tty_fprintf (fp, "\n");
	else if (opt.expert && !quick)
	{
	tty_fprintf (fp, "\n");
	/* No, so remove the mark and continue */
	if (!cpr_get_answer_is_yes ("sign_uid.expire_okay",
	_("Are you sure you "
	"still want to sign "
	"it? (y/N) ")))
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	}
	else if (interactive)
	yesreally = 1;
	}
	else
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	tty_fprintf (fp, _(" Unable to sign.\n"));
	}
	}
	else if (!uidnode->pkt->pkt.user_id->created && !selfsig)
	{
	tty_fprintf (fp, _("User ID \"%s\" is not self-signed."),
	user);

	if (opt.expert && !quick)
	{
	tty_fprintf (fp, "\n");
	/* No, so remove the mark and continue */
	if (!cpr_get_answer_is_yes ("sign_uid.nosig_okay",
	_("Are you sure you "
	"still want to sign "
	"it? (y/N) ")))
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	}
	else if (interactive)
	yesreally = 1;
	}
	else
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	tty_fprintf (fp, _(" Unable to sign.\n"));
	}
	}

	if (uidnode && interactive && !yesreally && !quick)
	{
	tty_fprintf (fp,
	_("User ID \"%s\" is signable. "), user);
	if (!cpr_get_answer_is_yes ("sign_uid.sign_okay",
	_("Sign it? (y/N) ")))
	{
	uidnode->flag &= ~NODFLG_MARK_A;
	uidnode = NULL;
	}
	}

	xfree (user);
	}
	}
	else if (uidnode && node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class & ~3) == 0x10)
	{
	if (sk_keyid[0] == node->pkt->pkt.signature->keyid[0]
	&& sk_keyid[1] == node->pkt->pkt.signature->keyid[1])
	{
	char buf[50];
	char *user;

	user = utf8_to_native (uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len, 0);

	/* It's a v3 self-sig. Make it into a v4 self-sig? */
	if (node->pkt->pkt.signature->version < 4
	&& selfsig && !quick)
	{
	tty_fprintf (fp,
	_("The self-signature on \"%s\"\n"
	"is a PGP 2.x-style signature.\n"), user);

	/* Note that the regular PGP2 warning below
	still applies if there are no v4 sigs on
	this key at all. */

	if (opt.expert)
	if (cpr_get_answer_is_yes ("sign_uid.v4_promote_okay",
	_("Do you want to promote "
	"it to an OpenPGP self-"
	"signature? (y/N) ")))
	{
	node->flag \|= NODFLG_DELSIG;
	xfree (user);
	continue;
	}
	}

	/* Is the current signature expired? */
	if (node->pkt->pkt.signature->flags.expired)
	{
	tty_fprintf (fp, _("Your current signature on \"%s\"\n"
	"has expired.\n"), user);

	if (quick \|\| cpr_get_answer_is_yes
	("sign_uid.replace_expired_okay",
	_("Do you want to issue a "
	"new signature to replace "
	"the expired one? (y/N) ")))
	{
	/* Mark these for later deletion. We
	don't want to delete them here, just in
	case the replacement signature doesn't
	happen for some reason. We only delete
	these after the replacement is already
	in place. */

	node->flag \|= NODFLG_DELSIG;
	xfree (user);
	continue;
	}
	}

	if (!node->pkt->pkt.signature->flags.exportable && !local)
	{
	/* It's a local sig, and we want to make a
	exportable sig. */
	tty_fprintf (fp, _("Your current signature on \"%s\"\n"
	"is a local signature.\n"), user);

	if (quick \|\| cpr_get_answer_is_yes
	("sign_uid.local_promote_okay",
	_("Do you want to promote "
	"it to a full exportable " "signature? (y/N) ")))
	{
	/* Mark these for later deletion. We
	don't want to delete them here, just in
	case the replacement signature doesn't
	happen for some reason. We only delete
	these after the replacement is already
	in place. */

	node->flag \|= NODFLG_DELSIG;
	xfree (user);
	continue;
	}
	}

	/* Fixme: see whether there is a revocation in which
	* case we should allow signing it again. */
	if (!node->pkt->pkt.signature->flags.exportable && local)
	tty_fprintf ( fp,
	_("\"%s\" was already locally signed by key %s\n"),
	user, keystr_from_pk (pk));
	else
	tty_fprintf (fp,
	_("\"%s\" was already signed by key %s\n"),
	user, keystr_from_pk (pk));

	if (opt.expert && !quick
	&& cpr_get_answer_is_yes ("sign_uid.dupe_okay",
	_("Do you want to sign it "
	"again anyway? (y/N) ")))
	{
	/* Don't delete the old sig here since this is
	an --expert thing. */
	xfree (user);
	continue;
	}

	snprintf (buf, sizeof buf, "%08lX%08lX",
	(ulong) pk->keyid[0], (ulong) pk->keyid[1]);
	write_status_text (STATUS_ALREADY_SIGNED, buf);
	uidnode->flag &= ~NODFLG_MARK_A; /* remove mark */

	xfree (user);
	}
	}
	}

	/* Check whether any uids are left for signing. */
	if (!count_uids_with_flag (keyblock, NODFLG_MARK_A))
	{
	tty_fprintf (fp, _("Nothing to sign with key %s\n"),
	keystr_from_pk (pk));
	continue;
	}

	/* Ask whether we really should sign these user id(s). */
	tty_fprintf (fp, "\n");
	show_key_with_all_names (ctrl, fp, keyblock, 1, 0, 1, 0, 0, 0);
	tty_fprintf (fp, "\n");

	if (primary_pk->expiredate && !selfsig)
	{
	/* Static analyzer note: A claim that PRIMARY_PK might be
	NULL is not correct because it set from the public key
	packet which is always the first packet in a keyblock and
	parsed in the above loop over the keyblock. In case the
	keyblock has no packets at all and thus the loop was not
	entered the above count_uids_with_flag would have
	detected this case. */

	u32 now = make_timestamp ();

	if (primary_pk->expiredate <= now)
	{
	tty_fprintf (fp, _("This key has expired!"));

	if (opt.expert && !quick)
	{
	tty_fprintf (fp, " ");
	if (!cpr_get_answer_is_yes ("sign_uid.expired_okay",
	_("Are you sure you still "
	"want to sign it? (y/N) ")))
	continue;
	}
	else
	{
	tty_fprintf (fp, _(" Unable to sign.\n"));
	continue;
	}
	}
	else
	{
	tty_fprintf (fp, _("This key is due to expire on %s.\n"),
	expirestr_from_pk (primary_pk));

	if (opt.ask_cert_expire && !quick)
	{
	char *answer = cpr_get ("sign_uid.expire",
	_("Do you want your signature to "
	"expire at the same time? (Y/n) "));
	if (answer_is_yes_no_default (answer, 1))
	{
	/* This fixes the signature timestamp we're
	going to make as now. This is so the
	expiration date is exactly correct, and not
	a few seconds off (due to the time it takes
	to answer the questions, enter the
	passphrase, etc). */
	timestamp = now;
	duration = primary_pk->expiredate - now;
	}

	cpr_kill_prompt ();
	xfree (answer);
	}
	}
	}

	/* Only ask for duration if we haven't already set it to match
	the expiration of the pk */
	if (!duration && !selfsig)
	{
	if (opt.ask_cert_expire && !quick)
	duration = ask_expire_interval (1, opt.def_cert_expire);
	else
	duration = parse_expire_string (opt.def_cert_expire);
	}

	if (selfsig)
	;
	else
	{
	if (opt.batch \|\| !opt.ask_cert_level \|\| quick)
	class = 0x10 + opt.def_cert_level;
	else
	{
	char *answer;

	tty_fprintf (fp,
	_("How carefully have you verified the key you are "
	"about to sign actually belongs\nto the person "
	"named above? If you don't know what to "
	"answer, enter \"0\".\n"));
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _(" (0) I will not answer.%s\n"),
	opt.def_cert_level == 0 ? " (default)" : "");
	tty_fprintf (fp, _(" (1) I have not checked at all.%s\n"),
	opt.def_cert_level == 1 ? " (default)" : "");
	tty_fprintf (fp, _(" (2) I have done casual checking.%s\n"),
	opt.def_cert_level == 2 ? " (default)" : "");
	tty_fprintf (fp,
	_(" (3) I have done very careful checking.%s\n"),
	opt.def_cert_level == 3 ? " (default)" : "");
	tty_fprintf (fp, "\n");

	while (class == 0)
	{
	answer = cpr_get ("sign_uid.class",
	_("Your selection? "
	"(enter '?' for more information): "));
	if (answer[0] == '\0')
	class = 0x10 + opt.def_cert_level; /* Default */
	else if (ascii_strcasecmp (answer, "0") == 0)
	class = 0x10; /* Generic */
	else if (ascii_strcasecmp (answer, "1") == 0)
	class = 0x11; /* Persona */
	else if (ascii_strcasecmp (answer, "2") == 0)
	class = 0x12; /* Casual */
	else if (ascii_strcasecmp (answer, "3") == 0)
	class = 0x13; /* Positive */
	else
	tty_fprintf (fp, _("Invalid selection.\n"));

	xfree (answer);
	}
	}

	if (trust && !quick)
	trustsig_prompt (&trust_value, &trust_depth, &trust_regexp);
	}

	if (!quick)
	{
	p = get_user_id_native (sk_keyid);
	tty_fprintf (fp,
	_("Are you sure that you want to sign this key with your\n"
	"key \"%s\" (%s)\n"), p, keystr_from_pk (pk));
	xfree (p);
	}

	if (selfsig)
	{
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("This will be a self-signature.\n"));

	if (local)
	{
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("WARNING: the signature will not be marked "
	"as non-exportable.\n"));
	}

	if (nonrevocable)
	{
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("WARNING: the signature will not be marked "
	"as non-revocable.\n"));
	}
	}
	else
	{
	if (local)
	{
	tty_fprintf (fp, "\n");
	tty_fprintf (fp,
	_("The signature will be marked as non-exportable.\n"));
	}

	if (nonrevocable)
	{
	tty_fprintf (fp, "\n");
	tty_fprintf (fp,
	_("The signature will be marked as non-revocable.\n"));
	}

	switch (class)
	{
	case 0x11:
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("I have not checked this key at all.\n"));
	break;

	case 0x12:
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("I have checked this key casually.\n"));
	break;

	case 0x13:
	tty_fprintf (fp, "\n");
	tty_fprintf (fp, _("I have checked this key very carefully.\n"));
	break;
	}
	}

	tty_fprintf (fp, "\n");

	if (opt.batch && opt.answer_yes)
	;
	else if (quick)
	;
	else if (!cpr_get_answer_is_yes ("sign_uid.okay",
	_("Really sign? (y/N) ")))
	continue;

	/* Now we can sign the user ids. */
	reloop: /* (Must use this, because we are modifing the list.) */
	primary_pk = NULL;
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	primary_pk = node->pkt->pkt.public_key;
	else if (node->pkt->pkttype == PKT_USER_ID
	&& (node->flag & NODFLG_MARK_A))
	{
	PACKET *pkt;
	PKT_signature *sig;
	struct sign_attrib attrib;

	log_assert (primary_pk);
	memset (&attrib, 0, sizeof attrib);
	attrib.non_exportable = local;
	attrib.non_revocable = nonrevocable;
	attrib.trust_depth = trust_depth;
	attrib.trust_value = trust_value;
	attrib.trust_regexp = trust_regexp;
	node->flag &= ~NODFLG_MARK_A;

	/* We force creation of a v4 signature for local
	* signatures, otherwise we would not generate the
	* subpacket with v3 keys and the signature becomes
	* exportable. */

	if (selfsig)
	rc = make_keysig_packet (&sig, primary_pk,
	node->pkt->pkt.user_id,
	NULL,
	pk,
	0x13, 0, 0, 0,
	keygen_add_std_prefs, primary_pk,
	NULL);
	else
	rc = make_keysig_packet (&sig, primary_pk,
	node->pkt->pkt.user_id,
	NULL,
	pk,
	class, 0,
	timestamp, duration,
	sign_mk_attrib, &attrib,
	NULL);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error (_("signing failed: %s\n"), gpg_strerror (rc));
	goto leave;
	}

	ret_modified = 1; / We changed the keyblock. */
	update_trust = 1;

	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (node, new_kbnode (pkt), PKT_SIGNATURE);
	goto reloop;
	}
	}

	/* Delete any sigs that got promoted */
	for (node = keyblock; node; node = node->next)
	if (node->flag & NODFLG_DELSIG)
	delete_kbnode (node);
	} /* End loop over signators. */

	leave:
	release_sk_list (sk_list);
	return rc;
	}


	/*
	* Change the passphrase of the primary and all secondary keys. Note
	* that it is common to use only one passphrase for the primary and
	* all subkeys. However, this is now (since GnuPG 2.1) all up to the
	* gpg-agent. Returns 0 on success or an error code.
	*/
	static gpg_error_t
	change_passphrase (ctrl_t ctrl, kbnode_t keyblock)
	{
	gpg_error_t err;
	kbnode_t node;
	PKT_public_key *pk;
	int any;
	u32 keyid[2], subid[2];
	char *hexgrip = NULL;
	char *cache_nonce = NULL;
	char *passwd_nonce = NULL;

	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	{
	log_error ("Oops; public key missing!\n");
	err = gpg_error (GPG_ERR_INTERNAL);
	goto leave;
	}
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, keyid);

	/* Check whether it is likely that we will be able to change the
	passphrase for any subkey. */
	for (any = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	char *serialno;

	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, subid);

	xfree (hexgrip);
	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	goto leave;
	err = agent_get_keyinfo (ctrl, hexgrip, &serialno, NULL);
	if (!err && serialno)
	; /* Key on card. */
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	; /* Maybe stub key. */
	else if (!err)
	any = 1; /* Key is known. */
	else
	log_error ("key %s: error getting keyinfo from agent: %s\n",
	keystr_with_sub (keyid, subid), gpg_strerror (err));
	xfree (serialno);
	}
	}
	err = 0;
	if (!any)
	{
	tty_printf (_("Key has only stub or on-card key items - "
	"no passphrase to change.\n"));
	goto leave;
	}

	/* Change the passphrase for all keys. */
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	char *desc;

	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, subid);

	xfree (hexgrip);
	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	goto leave;

	desc = gpg_format_keydesc (pk, FORMAT_KEYDESC_NORMAL, 1);
	err = agent_passwd (ctrl, hexgrip, desc, 0,
	&cache_nonce, &passwd_nonce);
	xfree (desc);

	if (err)
	log_log ((gpg_err_code (err) == GPG_ERR_CANCELED
	\|\| gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	? GPGRT_LOG_INFO : GPGRT_LOG_ERROR,
	_("key %s: error changing passphrase: %s\n"),
	keystr_with_sub (keyid, subid),
	gpg_strerror (err));
	if (gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	break;
	}
	}

	leave:
	xfree (hexgrip);
	xfree (cache_nonce);
	xfree (passwd_nonce);
	return err;
	}



	/* Fix various problems in the keyblock. Returns true if the keyblock
	was changed. Note that a pointer to the keyblock must be given and
	the function may change it (i.e. replacing the first node). */
	static int
	fix_keyblock (kbnode_t *keyblockp)
	{
	int changed = 0;

	if (collapse_uids (keyblockp))
	changed++;
	if (check_all_keysigs (*keyblockp, 0, 1))
	changed++;
	reorder_keyblock (*keyblockp);
	/* If we modified the keyblock, make sure the flags are right. */
	if (changed)
	merge_keys_and_selfsig (*keyblockp);

	return changed;
	}


	static int
	parse_sign_type (const char str, int localsig, int *nonrevokesig,
	int *trustsig)
	{
	const char *p = str;

	while (*p)
	{
	if (ascii_strncasecmp (p, "l", 1) == 0)
	{
	*localsig = 1;
	p++;
	}
	else if (ascii_strncasecmp (p, "nr", 2) == 0)
	{
	*nonrevokesig = 1;
	p += 2;
	}
	else if (ascii_strncasecmp (p, "t", 1) == 0)
	{
	*trustsig = 1;
	p++;
	}
	else
	return 0;
	}

	return 1;
	}



	/*
	* Menu driven key editor. If seckey_check is true, then a secret key
	* that matches username will be looked for. If it is false, not all
	* commands will be available.
	*
	* Note: to keep track of certain selections we use node->mark MARKBIT_xxxx.
	*/

	/* Need an SK for this command */
	#define KEYEDIT_NEED_SK 1
	/* Cannot be viewing the SK for this command */
	#define KEYEDIT_NOT_SK 2
	/* Must be viewing the SK for this command */
	#define KEYEDIT_ONLY_SK 4
	/* Match the tail of the string */
	#define KEYEDIT_TAIL_MATCH 8

	enum cmdids
	{
	cmdNONE = 0,
	cmdQUIT, cmdHELP, cmdFPR, cmdLIST, cmdSELUID, cmdCHECK, cmdSIGN,
	cmdREVSIG, cmdREVKEY, cmdREVUID, cmdDELSIG, cmdPRIMARY, cmdDEBUG,
	cmdSAVE, cmdADDUID, cmdADDPHOTO, cmdDELUID, cmdADDKEY, cmdDELKEY,
	cmdADDREVOKER, cmdTOGGLE, cmdSELKEY, cmdPASSWD, cmdTRUST, cmdPREF,
	cmdEXPIRE, cmdCHANGEUSAGE, cmdBACKSIGN,
	#ifndef NO_TRUST_MODELS
	cmdENABLEKEY, cmdDISABLEKEY,
	#endif /!NO_TRUST_MODELS/
	cmdSHOWPREF,
	cmdSETPREF, cmdPREFKS, cmdNOTATION, cmdINVCMD, cmdSHOWPHOTO, cmdUPDTRUST,
	cmdCHKTRUST, cmdADDCARDKEY, cmdKEYTOCARD, cmdBKUPTOCARD,
	cmdCLEAN, cmdMINIMIZE, cmdGRIP, cmdNOP
	};

	static struct
	{
	const char *name;
	enum cmdids id;
	int flags;
	const char *desc;
	} cmds[] =
	{
	{ "quit", cmdQUIT, 0, N_("quit this menu")},
	{ "q", cmdQUIT, 0, NULL},
	{ "save", cmdSAVE, 0, N_("save and quit")},
	{ "help", cmdHELP, 0, N_("show this help")},
	{ "?", cmdHELP, 0, NULL},
	{ "fpr", cmdFPR, 0, N_("show key fingerprint")},
	{ "grip", cmdGRIP, 0, N_("show the keygrip")},
	{ "list", cmdLIST, 0, N_("list key and user IDs")},
	{ "l", cmdLIST, 0, NULL},
	{ "uid", cmdSELUID, 0, N_("select user ID N")},
	{ "key", cmdSELKEY, 0, N_("select subkey N")},
	{ "check", cmdCHECK, 0, N_("check signatures")},
	{ "c", cmdCHECK, 0, NULL},
	{ "change-usage", cmdCHANGEUSAGE, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	{ "cross-certify", cmdBACKSIGN, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	{ "backsign", cmdBACKSIGN, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	{ "sign", cmdSIGN, KEYEDIT_NOT_SK \| KEYEDIT_TAIL_MATCH,
	N_("sign selected user IDs [* see below for related commands]")},
	{ "s", cmdSIGN, KEYEDIT_NOT_SK, NULL},
	/* "lsign" and friends will never match since "sign" comes first
	and it is a tail match. They are just here so they show up in
	the help menu. */
	{ "lsign", cmdNOP, 0, N_("sign selected user IDs locally")},
	{ "tsign", cmdNOP, 0, N_("sign selected user IDs with a trust signature")},
	{ "nrsign", cmdNOP, 0,
	N_("sign selected user IDs with a non-revocable signature")},
	{ "debug", cmdDEBUG, 0, NULL},
	{ "adduid", cmdADDUID, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, N_("add a user ID")},
	{ "addphoto", cmdADDPHOTO, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("add a photo ID")},
	{ "deluid", cmdDELUID, KEYEDIT_NOT_SK, N_("delete selected user IDs")},
	/* delphoto is really deluid in disguise */
	{ "delphoto", cmdDELUID, KEYEDIT_NOT_SK, NULL},
	{ "addkey", cmdADDKEY, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, N_("add a subkey")},
	#ifdef ENABLE_CARD_SUPPORT
	{ "addcardkey", cmdADDCARDKEY, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("add a key to a smartcard")},
	{ "keytocard", cmdKEYTOCARD, KEYEDIT_NEED_SK \| KEYEDIT_ONLY_SK,
	N_("move a key to a smartcard")},
	{ "bkuptocard", cmdBKUPTOCARD, KEYEDIT_NEED_SK \| KEYEDIT_ONLY_SK,
	N_("move a backup key to a smartcard")},
	#endif /ENABLE_CARD_SUPPORT /
	{ "delkey", cmdDELKEY, KEYEDIT_NOT_SK, N_("delete selected subkeys")},
	{ "addrevoker", cmdADDREVOKER, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("add a revocation key")},
	{ "delsig", cmdDELSIG, KEYEDIT_NOT_SK,
	N_("delete signatures from the selected user IDs")},
	{ "expire", cmdEXPIRE, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("change the expiration date for the key or selected subkeys")},
	{ "primary", cmdPRIMARY, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("flag the selected user ID as primary")},
	{ "toggle", cmdTOGGLE, KEYEDIT_NEED_SK, NULL}, /* Dummy command. */
	{ "t", cmdTOGGLE, KEYEDIT_NEED_SK, NULL},
	{ "pref", cmdPREF, KEYEDIT_NOT_SK, N_("list preferences (expert)")},
	{ "showpref", cmdSHOWPREF, KEYEDIT_NOT_SK, N_("list preferences (verbose)")},
	{ "setpref", cmdSETPREF, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("set preference list for the selected user IDs")},
	{ "updpref", cmdSETPREF, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	{ "keyserver", cmdPREFKS, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("set the preferred keyserver URL for the selected user IDs")},
	{ "notation", cmdNOTATION, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("set a notation for the selected user IDs")},
	{ "passwd", cmdPASSWD, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("change the passphrase")},
	{ "password", cmdPASSWD, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	#ifndef NO_TRUST_MODELS
	{ "trust", cmdTRUST, KEYEDIT_NOT_SK, N_("change the ownertrust")},
	#endif /!NO_TRUST_MODELS/
	{ "revsig", cmdREVSIG, KEYEDIT_NOT_SK,
	N_("revoke signatures on the selected user IDs")},
	{ "revuid", cmdREVUID, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("revoke selected user IDs")},
	{ "revphoto", cmdREVUID, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK, NULL},
	{ "revkey", cmdREVKEY, KEYEDIT_NOT_SK \| KEYEDIT_NEED_SK,
	N_("revoke key or selected subkeys")},
	#ifndef NO_TRUST_MODELS
	{ "enable", cmdENABLEKEY, KEYEDIT_NOT_SK, N_("enable key")},
	{ "disable", cmdDISABLEKEY, KEYEDIT_NOT_SK, N_("disable key")},
	#endif /!NO_TRUST_MODELS/
	{ "showphoto", cmdSHOWPHOTO, 0, N_("show selected photo IDs")},
	{ "clean", cmdCLEAN, KEYEDIT_NOT_SK,
	N_("compact unusable user IDs and remove unusable signatures from key")},
	{ "minimize", cmdMINIMIZE, KEYEDIT_NOT_SK,
	N_("compact unusable user IDs and remove all signatures from key")},

	{ NULL, cmdNONE, 0, NULL}
	};



	#ifdef HAVE_LIBREADLINE

	/*
	These two functions are used by readline for command completion.
	*/

	static char *
	command_generator (const char *text, int state)
	{
	static int list_index, len;
	const char *name;

	/* If this is a new word to complete, initialize now. This includes
	saving the length of TEXT for efficiency, and initializing the
	index variable to 0. */
	if (!state)
	{
	list_index = 0;
	len = strlen (text);
	}

	/* Return the next partial match */
	while ((name = cmds[list_index].name))
	{
	/* Only complete commands that have help text */
	if (cmds[list_index++].desc && strncmp (name, text, len) == 0)
	return strdup (name);
	}

	return NULL;
	}

	static char **
	keyedit_completion (const char *text, int start, int end)
	{
	/* If we are at the start of a line, we try and command-complete.
	If not, just do nothing for now. */

	(void) end;

	if (start == 0)
	return rl_completion_matches (text, command_generator);

	rl_attempted_completion_over = 1;

	return NULL;
	}
	#endif /* HAVE_LIBREADLINE */



	/* Main function of the menu driven key editor. */
	void
	keyedit_menu (ctrl_t ctrl, const char *username, strlist_t locusr,
	strlist_t commands, int quiet, int seckey_check)
	{
	enum cmdids cmd = 0;
	gpg_error_t err = 0;
	KBNODE keyblock = NULL;
	KEYDB_HANDLE kdbhd = NULL;
	int have_seckey = 0;
	char *answer = NULL;
	int redisplay = 1;
	int modified = 0;
	int sec_shadowing = 0;
	int run_subkey_warnings = 0;
	int have_commands = !!commands;

	if (opt.command_fd != -1)
	;
	else if (opt.batch && !have_commands)
	{
	log_error (_("can't do this in batch mode\n"));
	goto leave;
	}

	#ifdef HAVE_W32_SYSTEM
	/* Due to Windows peculiarities we need to make sure that the
	trustdb stale check is done before we open another file
	(i.e. by searching for a key). In theory we could make sure
	that the files are closed after use but the open/close caches
	inhibits that and flushing the cache right before the stale
	check is not easy to implement. Thus we take the easy way out
	and run the stale check as early as possible. Note, that for
	non- W32 platforms it is run indirectly trough a call to
	get_validity (). */
	check_trustdb_stale (ctrl);
	#endif

	/* Get the public key */
	err = get_pubkey_byname (ctrl, NULL, NULL, username, &keyblock, &kdbhd, 1, 1);
	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), username, gpg_strerror (err));
	goto leave;
	}

	if (fix_keyblock (&keyblock))
	modified++;

	/* See whether we have a matching secret key. */
	if (seckey_check)
	{
	have_seckey = !agent_probe_any_secret_key (ctrl, keyblock);
	if (have_seckey && !quiet)
	tty_printf (_("Secret key is available.\n"));
	}

	/* Main command loop. */
	for (;;)
	{
	int i, arg_number, photo;
	const char *arg_string = "";
	char *p;
	PKT_public_key *pk = keyblock->pkt->pkt.public_key;

	tty_printf ("\n");

	if (redisplay && !quiet)
	{
	/* Show using flags: with_revoker, with_subkeys. */
	show_key_with_all_names (ctrl, NULL, keyblock, 0, 1, 0, 1, 0, 0);
	tty_printf ("\n");
	redisplay = 0;
	}

	if (run_subkey_warnings)
	{
	run_subkey_warnings = 0;
	if (!count_selected_keys (keyblock))
	subkey_expire_warning (keyblock);
	}

	do
	{
	xfree (answer);
	if (have_commands)
	{
	if (commands)
	{
	answer = xstrdup (commands->d);
	commands = commands->next;
	}
	else if (opt.batch)
	{
	answer = xstrdup ("quit");
	}
	else
	have_commands = 0;
	}
	if (!have_commands)
	{
	#ifdef HAVE_LIBREADLINE
	tty_enable_completion (keyedit_completion);
	#endif
	answer = cpr_get_no_help ("keyedit.prompt", GPG_NAME "> ");
	cpr_kill_prompt ();
	tty_disable_completion ();
	}
	trim_spaces (answer);
	}
	while (*answer == '#');

	arg_number = 0; /* Here is the init which egcc complains about. */
	photo = 0; /* Same here. */
	if (!*answer)
	cmd = cmdLIST;
	else if (*answer == CONTROL_D)
	cmd = cmdQUIT;
	else if (digitp (answer))
	{
	cmd = cmdSELUID;
	arg_number = atoi (answer);
	}
	else
	{
	if ((p = strchr (answer, ' ')))
	{
	*p++ = 0;
	trim_spaces (answer);
	trim_spaces (p);
	arg_number = atoi (p);
	arg_string = p;
	}

	for (i = 0; cmds[i].name; i++)
	{
	if (cmds[i].flags & KEYEDIT_TAIL_MATCH)
	{
	size_t l = strlen (cmds[i].name);
	size_t a = strlen (answer);
	if (a >= l)
	{
	if (!ascii_strcasecmp (&answer[a - l], cmds[i].name))
	{
	answer[a - l] = '\0';
	break;
	}
	}
	}
	else if (!ascii_strcasecmp (answer, cmds[i].name))
	break;
	}
	if ((cmds[i].flags & KEYEDIT_NEED_SK) && !have_seckey)
	{
	tty_printf (_("Need the secret key to do this.\n"));
	cmd = cmdNOP;
	}
	else
	cmd = cmds[i].id;
	}

	/* Dispatch the command. */
	switch (cmd)
	{
	case cmdHELP:
	for (i = 0; cmds[i].name; i++)
	{
	if ((cmds[i].flags & KEYEDIT_NEED_SK) && !have_seckey)
	; /* Skip those item if we do not have the secret key. */
	else if (cmds[i].desc)
	tty_printf ("%-11s %s\n", cmds[i].name, _(cmds[i].desc));
	}

	tty_printf ("\n");
	tty_printf
	(_("* The 'sign' command may be prefixed with an 'l' for local "
	"signatures (lsign),\n"
	" a 't' for trust signatures (tsign), an 'nr' for "
	"non-revocable signatures\n"
	" (nrsign), or any combination thereof (ltsign, "
	"tnrsign, etc.).\n"));
	break;

	case cmdLIST:
	redisplay = 1;
	break;

	case cmdFPR:
	show_key_and_fingerprint
	(keyblock, (arg_string == ''
	&& (!arg_string[1] \|\| spacep (arg_string + 1))));
	break;

	case cmdGRIP:
	show_key_and_grip (keyblock);
	break;

	case cmdSELUID:
	if (strlen (arg_string) == NAMEHASH_LEN * 2)
	redisplay = menu_select_uid_namehash (keyblock, arg_string);
	else
	{
	if (arg_string == ''
	&& (!arg_string[1] \|\| spacep (arg_string + 1)))
	arg_number = -1; /* Select all. */
	redisplay = menu_select_uid (keyblock, arg_number);
	}
	break;

	case cmdSELKEY:
	{
	if (arg_string == ''
	&& (!arg_string[1] \|\| spacep (arg_string + 1)))
	arg_number = -1; /* Select all. */
	if (menu_select_key (keyblock, arg_number, p))
	redisplay = 1;
	}
	break;

	case cmdCHECK:
	if (check_all_keysigs (keyblock, count_selected_uids (keyblock),
	!strcmp (arg_string, "selfsig")))
	modified = 1;
	break;

	case cmdSIGN:
	{
	int localsig = 0, nonrevokesig = 0, trustsig = 0, interactive = 0;

	if (pk->flags.revoked)
	{
	tty_printf (_("Key is revoked."));

	if (opt.expert)
	{
	tty_printf (" ");
	if (!cpr_get_answer_is_yes
	("keyedit.sign_revoked.okay",
	_("Are you sure you still want to sign it? (y/N) ")))
	break;
	}
	else
	{
	tty_printf (_(" Unable to sign.\n"));
	break;
	}
	}

	if (count_uids (keyblock) > 1 && !count_selected_uids (keyblock))
	{
	int result;
	if (opt.only_sign_text_ids)
	result = cpr_get_answer_is_yes
	("keyedit.sign_all.okay",
	_("Really sign all user IDs? (y/N) "));
	else
	result = cpr_get_answer_is_yes
	("keyedit.sign_all.okay",
	_("Really sign all text user IDs? (y/N) "));

	if (! result)
	{
	if (opt.interactive)
	interactive = 1;
	else
	{
	tty_printf (_("Hint: Select the user IDs to sign\n"));
	have_commands = 0;
	break;
	}

	}
	}
	/* What sort of signing are we doing? */
	if (!parse_sign_type
	(answer, &localsig, &nonrevokesig, &trustsig))
	{
	tty_printf (_("Unknown signature type '%s'\n"), answer);
	break;
	}

	sign_uids (ctrl, NULL, keyblock, locusr, &modified,
	localsig, nonrevokesig, trustsig, interactive, 0);
	}
	break;

	case cmdDEBUG:
	dump_kbnode (keyblock);
	break;

	case cmdTOGGLE:
	/* The toggle command is a leftover from old gpg versions
	where we worked with a secret and a public keyring. It
	is not necessary anymore but we keep this command for the
	sake of scripts using it. */
	redisplay = 1;
	break;

	case cmdADDPHOTO:
	if (RFC2440)
	{
	tty_printf (_("This command is not allowed while in %s mode.\n"),
	compliance_option_string ());
	break;
	}
	photo = 1;
	/* fall through */
	case cmdADDUID:
	if (menu_adduid (ctrl, keyblock, photo, arg_string, NULL))
	{
	update_trust = 1;
	redisplay = 1;
	modified = 1;
	merge_keys_and_selfsig (keyblock);
	}
	break;

	case cmdDELUID:
	{
	int n1;

	if (!(n1 = count_selected_uids (keyblock)))
	{
	tty_printf (_("You must select at least one user ID.\n"));
	if (!opt.expert)
	tty_printf (_("(Use the '%s' command.)\n"), "uid");
	}
	else if (real_uids_left (keyblock) < 1)
	tty_printf (_("You can't delete the last user ID!\n"));
	else if (cpr_get_answer_is_yes
	("keyedit.remove.uid.okay",
	n1 > 1 ? _("Really remove all selected user IDs? (y/N) ")
	: _("Really remove this user ID? (y/N) ")))
	{
	menu_deluid (keyblock);
	redisplay = 1;
	modified = 1;
	}
	}
	break;

	case cmdDELSIG:
	{
	int n1;

	if (!(n1 = count_selected_uids (keyblock)))
	{
	tty_printf (_("You must select at least one user ID.\n"));
	if (!opt.expert)
	tty_printf (_("(Use the '%s' command.)\n"), "uid");
	}
	else if (menu_delsig (keyblock))
	{
	/* No redisplay here, because it may scroll away some
	* of the status output of this command. */
	modified = 1;
	}
	}
	break;

	case cmdADDKEY:
	if (!generate_subkeypair (ctrl, keyblock, NULL, NULL, NULL))
	{
	redisplay = 1;
	modified = 1;
	merge_keys_and_selfsig (keyblock);
	}
	break;

	#ifdef ENABLE_CARD_SUPPORT
	case cmdADDCARDKEY:
	if (!card_generate_subkey (keyblock))
	{
	redisplay = 1;
	modified = 1;
	merge_keys_and_selfsig (keyblock);
	}
	break;

	case cmdKEYTOCARD:
	{
	KBNODE node = NULL;
	switch (count_selected_keys (keyblock))
	{
	case 0:
	if (cpr_get_answer_is_yes
	("keyedit.keytocard.use_primary",
	/* TRANSLATORS: Please take care: This is about
	moving the key and not about removing it. */
	_("Really move the primary key? (y/N) ")))
	node = keyblock;
	break;
	case 1:
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& node->flag & NODFLG_SELKEY)
	break;
	}
	break;
	default:
	tty_printf (_("You must select exactly one key.\n"));
	break;
	}
	if (node)
	{
	PKT_public_key *xxpk = node->pkt->pkt.public_key;
	if (card_store_subkey (node, xxpk ? xxpk->pubkey_usage : 0))
	{
	redisplay = 1;
	sec_shadowing = 1;
	}
	}
	}
	break;

	case cmdBKUPTOCARD:
	{
	/* Ask for a filename, check whether this is really a
	backup key as generated by the card generation, parse
	that key and store it on card. */
	KBNODE node;
	char *fname;
	PACKET *pkt;
	IOBUF a;

	if (!*arg_string)
	{
	tty_printf (_("Command expects a filename argument\n"));
	break;
	}

	if (*arg_string == DIRSEP_C)
	fname = xstrdup (arg_string);
	else if (*arg_string == '~')
	fname = make_filename (arg_string, NULL);
	else
	fname = make_filename (gnupg_homedir (), arg_string, NULL);

	/* Open that file. */
	a = iobuf_open (fname);
	if (a && is_secured_file (iobuf_get_fd (a)))
	{
	iobuf_close (a);
	a = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!a)
	{
	tty_printf (_("Can't open '%s': %s\n"),
	fname, strerror (errno));
	xfree (fname);
	break;
	}

	/* Parse and check that file. */
	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	err = parse_packet (a, pkt);
	iobuf_close (a);
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char *) fname);
	if (!err && pkt->pkttype != PKT_SECRET_KEY
	&& pkt->pkttype != PKT_SECRET_SUBKEY)
	err = GPG_ERR_NO_SECKEY;
	if (err)
	{
	tty_printf (_("Error reading backup key from '%s': %s\n"),
	fname, gpg_strerror (err));
	xfree (fname);
	free_packet (pkt);
	xfree (pkt);
	break;
	}

	xfree (fname);
	node = new_kbnode (pkt);

	/* Transfer it to gpg-agent which handles secret keys. */
	err = transfer_secret_keys (ctrl, NULL, node, 1, 1);

	/* Treat the pkt as a public key. */
	pkt->pkttype = PKT_PUBLIC_KEY;

	/* Ask gpg-agent to store the secret key to card. */
	if (card_store_subkey (node, 0))
	{
	redisplay = 1;
	sec_shadowing = 1;
	}
	release_kbnode (node);
	}
	break;

	#endif /* ENABLE_CARD_SUPPORT */

	case cmdDELKEY:
	{
	int n1;

	if (!(n1 = count_selected_keys (keyblock)))
	{
	tty_printf (_("You must select at least one key.\n"));
	if (!opt.expert)
	tty_printf (_("(Use the '%s' command.)\n"), "key");
	}
	else if (!cpr_get_answer_is_yes
	("keyedit.remove.subkey.okay",
	n1 > 1 ? _("Do you really want to delete the "
	"selected keys? (y/N) ")
	: _("Do you really want to delete this key? (y/N) ")))
	;
	else
	{
	menu_delkey (keyblock);
	redisplay = 1;
	modified = 1;
	}
	}
	break;

	case cmdADDREVOKER:
	{
	int sensitive = 0;

	if (ascii_strcasecmp (arg_string, "sensitive") == 0)
	sensitive = 1;
	if (menu_addrevoker (ctrl, keyblock, sensitive))
	{
	redisplay = 1;
	modified = 1;
	merge_keys_and_selfsig (keyblock);
	}
	}
	break;

	case cmdREVUID:
	{
	int n1;

	if (!(n1 = count_selected_uids (keyblock)))
	{
	tty_printf (_("You must select at least one user ID.\n"));
	if (!opt.expert)
	tty_printf (_("(Use the '%s' command.)\n"), "uid");
	}
	else if (cpr_get_answer_is_yes
	("keyedit.revoke.uid.okay",
	n1 > 1 ? _("Really revoke all selected user IDs? (y/N) ")
	: _("Really revoke this user ID? (y/N) ")))
	{
	if (menu_revuid (ctrl, keyblock))
	{
	modified = 1;
	redisplay = 1;
	}
	}
	}
	break;

	case cmdREVKEY:
	{
	int n1;

	if (!(n1 = count_selected_keys (keyblock)))
	{
	if (cpr_get_answer_is_yes ("keyedit.revoke.subkey.okay",
	_("Do you really want to revoke"
	" the entire key? (y/N) ")))
	{
	if (menu_revkey (keyblock))
	modified = 1;

	redisplay = 1;
	}
	}
	else if (cpr_get_answer_is_yes ("keyedit.revoke.subkey.okay",
	n1 > 1 ?
	_("Do you really want to revoke"
	" the selected subkeys? (y/N) ")
	: _("Do you really want to revoke"
	" this subkey? (y/N) ")))
	{
	if (menu_revsubkey (keyblock))
	modified = 1;

	redisplay = 1;
	}

	if (modified)
	merge_keys_and_selfsig (keyblock);
	}
	break;

	case cmdEXPIRE:
	if (gpg_err_code (menu_expire (keyblock, 0, 0)) == GPG_ERR_TRUE)
	{
	merge_keys_and_selfsig (keyblock);
	run_subkey_warnings = 1;
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdCHANGEUSAGE:
	if (menu_changeusage (keyblock))
	{
	merge_keys_and_selfsig (keyblock);
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdBACKSIGN:
	if (menu_backsign (keyblock))
	{
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdPRIMARY:
	if (menu_set_primary_uid (keyblock))
	{
	merge_keys_and_selfsig (keyblock);
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdPASSWD:
	change_passphrase (ctrl, keyblock);
	break;

	#ifndef NO_TRUST_MODELS
	case cmdTRUST:
	if (opt.trust_model == TM_EXTERNAL)
	{
	tty_printf (_("Owner trust may not be set while "
	"using a user provided trust database\n"));
	break;
	}

	show_key_with_all_names (ctrl, NULL, keyblock, 0, 0, 0, 1, 0, 0);
	tty_printf ("\n");
	if (edit_ownertrust (ctrl, find_kbnode (keyblock,
	PKT_PUBLIC_KEY)->pkt->pkt.
	public_key, 1))
	{
	redisplay = 1;
	/* No real need to set update_trust here as
	edit_ownertrust() calls revalidation_mark()
	anyway. */
	update_trust = 1;
	}
	break;
	#endif /!NO_TRUST_MODELS/

	case cmdPREF:
	{
	int count = count_selected_uids (keyblock);
	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
	show_names (ctrl, NULL, keyblock, keyblock->pkt->pkt.public_key,
	count ? NODFLG_SELUID : 0, 1);
	}
	break;

	case cmdSHOWPREF:
	{
	int count = count_selected_uids (keyblock);
	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
	show_names (ctrl, NULL, keyblock, keyblock->pkt->pkt.public_key,
	count ? NODFLG_SELUID : 0, 2);
	}
	break;

	case cmdSETPREF:
	{
	PKT_user_id *tempuid;

	keygen_set_std_prefs (!*arg_string ? "default" : arg_string, 0);

	tempuid = keygen_get_std_prefs ();
	tty_printf (_("Set preference list to:\n"));
	show_prefs (tempuid, NULL, 1);
	free_user_id (tempuid);

	if (cpr_get_answer_is_yes
	("keyedit.setpref.okay",
	count_selected_uids (keyblock) ?
	_("Really update the preferences"
	" for the selected user IDs? (y/N) ")
	: _("Really update the preferences? (y/N) ")))
	{
	if (menu_set_preferences (keyblock))
	{
	merge_keys_and_selfsig (keyblock);
	modified = 1;
	redisplay = 1;
	}
	}
	}
	break;

	case cmdPREFKS:
	if (menu_set_keyserver_url (*arg_string ? arg_string : NULL,
	keyblock))
	{
	merge_keys_and_selfsig (keyblock);
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdNOTATION:
	if (menu_set_notation (*arg_string ? arg_string : NULL,
	keyblock))
	{
	merge_keys_and_selfsig (keyblock);
	modified = 1;
	redisplay = 1;
	}
	break;

	case cmdNOP:
	break;

	case cmdREVSIG:
	if (menu_revsig (keyblock))
	{
	redisplay = 1;
	modified = 1;
	}
	break;

	#ifndef NO_TRUST_MODELS
	case cmdENABLEKEY:
	case cmdDISABLEKEY:
	if (enable_disable_key (keyblock, cmd == cmdDISABLEKEY))
	{
	redisplay = 1;
	modified = 1;
	}
	break;
	#endif /!NO_TRUST_MODELS/

	case cmdSHOWPHOTO:
	menu_showphoto (ctrl, keyblock);
	break;

	case cmdCLEAN:
	if (menu_clean (keyblock, 0))
	redisplay = modified = 1;
	break;

	case cmdMINIMIZE:
	if (menu_clean (keyblock, 1))
	redisplay = modified = 1;
	break;

	case cmdQUIT:
	if (have_commands)
	goto leave;
	if (!modified && !sec_shadowing)
	goto leave;
	if (!cpr_get_answer_is_yes ("keyedit.save.okay",
	_("Save changes? (y/N) ")))
	{
	if (cpr_enabled ()
	\|\| cpr_get_answer_is_yes ("keyedit.cancel.okay",
	_("Quit without saving? (y/N) ")))
	goto leave;
	break;
	}
	/* fall through */
	case cmdSAVE:
	if (modified)
	{
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	break;
	}
	}

	if (sec_shadowing)
	{
	err = agent_scd_learn (NULL, 1);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	break;
	}
	}

	if (!modified && !sec_shadowing)
	tty_printf (_("Key not changed so no update needed.\n"));

	if (update_trust)
	{
	revalidation_mark ();
	update_trust = 0;
	}
	goto leave;

	case cmdINVCMD:
	default:
	tty_printf ("\n");
	tty_printf (_("Invalid command (try \"help\")\n"));
	break;
	}
	} /* End of the main command loop. */

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	xfree (answer);
	}


	/* Change the passphrase of the secret key identified by USERNAME. */
	void
	keyedit_passwd (ctrl_t ctrl, const char *username)
	{
	gpg_error_t err;
	PKT_public_key *pk;
	kbnode_t keyblock = NULL;

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = getkey_byname (ctrl, NULL, pk, username, 1, &keyblock);
	if (err)
	goto leave;

	err = change_passphrase (ctrl, keyblock);

	leave:
	release_kbnode (keyblock);
	free_public_key (pk);
	if (err)
	{
	log_info ("error changing the passphrase for '%s': %s\n",
	username, gpg_strerror (err));
	write_status_error ("keyedit.passwd", err);
	}
	else
	write_status_text (STATUS_SUCCESS, "keyedit.passwd");
	}


	/* Unattended adding of a new keyid. USERNAME specifies the
	key. NEWUID is the new user id to add to the key. */
	void
	keyedit_quick_adduid (ctrl_t ctrl, const char username, const char newuid)
	{
	gpg_error_t err;
	KEYDB_HANDLE kdbhd = NULL;
	KEYDB_SEARCH_DESC desc;
	kbnode_t keyblock = NULL;
	kbnode_t node;
	char *uidstring = NULL;

	uidstring = xstrdup (newuid);
	trim_spaces (uidstring);
	if (!*uidstring)
	{
	log_error ("%s\n", gpg_strerror (GPG_ERR_INV_USER_ID));
	goto leave;
	}

	#ifdef HAVE_W32_SYSTEM
	/* See keyedit_menu for why we need this. */
	check_trustdb_stale (ctrl);
	#endif

	/* Search the key; we don't want the whole getkey stuff here. */
	kdbhd = keydb_new ();
	if (!kdbhd)
	{
	/* Note that keydb_new has already used log_error. */
	goto leave;
	}

	err = classify_user_id (username, &desc, 1);
	if (!err)
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (!err)
	{
	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	goto leave;
	}
	/* Now with the keyblock retrieved, search again to detect an
	ambiguous specification. We need to save the found state so
	that we can do an update later. */
	keydb_push_found_state (kdbhd);
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (!err)
	err = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	err = 0;
	keydb_pop_found_state (kdbhd);

	if (!err)
	{
	/* We require the secret primary key to add a UID. */
	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	BUG ();
	err = agent_probe_secret_key (ctrl, node->pkt->pkt.public_key);
	}
	}
	if (err)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	username, gpg_strerror (err));
	goto leave;
	}

	fix_keyblock (&keyblock);

	merge_keys_and_selfsig (keyblock);

	if (menu_adduid (ctrl, keyblock, 0, NULL, uidstring))
	{
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (update_trust)
	revalidation_mark ();
	}

	leave:
	xfree (uidstring);
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	}

	/* Unattended revocation of a keyid. USERNAME specifies the
	key. UIDTOREV is the user id revoke from the key. */
	void
	keyedit_quick_revuid (ctrl_t ctrl, const char username, const char uidtorev)
	{
	gpg_error_t err;
	KEYDB_HANDLE kdbhd = NULL;
	KEYDB_SEARCH_DESC desc;
	kbnode_t keyblock = NULL;
	kbnode_t node;
	int modified = 0;
	size_t revlen;

	#ifdef HAVE_W32_SYSTEM
	/* See keyedit_menu for why we need this. */
	check_trustdb_stale (ctrl);
	#endif

	/* Search the key; we don't want the whole getkey stuff here. */
	kdbhd = keydb_new ();
	if (!kdbhd)
	{
	/* Note that keydb_new has already used log_error. */
	goto leave;
	}

	err = classify_user_id (username, &desc, 1);
	if (!err)
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (!err)
	{
	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	goto leave;
	}
	/* Now with the keyblock retrieved, search again to detect an
	ambiguous specification. We need to save the found state so
	that we can do an update later. */
	keydb_push_found_state (kdbhd);
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (!err)
	err = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	err = 0;
	keydb_pop_found_state (kdbhd);

	if (!err)
	{
	/* We require the secret primary key to revoke a UID. */
	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	BUG ();
	err = agent_probe_secret_key (ctrl, node->pkt->pkt.public_key);
	}
	}
	if (err)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	username, gpg_strerror (err));
	goto leave;
	}

	fix_keyblock (&keyblock);
	setup_main_keyids (keyblock);

	revlen = strlen (uidtorev);
	/* find the right UID */
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID
	&& revlen == node->pkt->pkt.user_id->len
	&& !memcmp (node->pkt->pkt.user_id->name, uidtorev, revlen))
	{
	struct revocation_reason_info *reason;

	reason = get_default_uid_revocation_reason ();
	err = core_revuid (ctrl, keyblock, node, reason, &modified);
	release_revocation_reason_info (reason);
	if (err)
	{
	log_error (_("User ID revocation failed: %s\n"),
	gpg_strerror (err));
	goto leave;
	}
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	if (update_trust)
	revalidation_mark ();
	goto leave;
	}
	}

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	}


	/* Find a keyblock by fingerprint because only this uniquely
	* identifies a key and may thus be used to select a key for
	* unattended subkey creation os key signing. */
	static gpg_error_t
	find_by_primary_fpr (ctrl_t ctrl, const char *fpr,
	kbnode_t r_keyblock, KEYDB_HANDLE r_kdbhd)
	{
	gpg_error_t err;
	kbnode_t keyblock = NULL;
	KEYDB_HANDLE kdbhd = NULL;
	KEYDB_SEARCH_DESC desc;
	byte fprbin[MAX_FINGERPRINT_LEN];
	size_t fprlen;

	*r_keyblock = NULL;
	*r_kdbhd = NULL;

	if (classify_user_id (fpr, &desc, 1)
	\|\| !(desc.mode == KEYDB_SEARCH_MODE_FPR
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR16
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR20))
	{
	log_error (_("\"%s\" is not a fingerprint\n"), fpr);
	err = gpg_error (GPG_ERR_INV_NAME);
	goto leave;
	}
	err = get_pubkey_byname (ctrl, NULL, NULL, fpr, &keyblock, &kdbhd, 1, 1);
	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), fpr, gpg_strerror (err));
	goto leave;
	}

	/* Check that the primary fingerprint has been given. */
	fingerprint_from_pk (keyblock->pkt->pkt.public_key, fprbin, &fprlen);
	if (fprlen == 16 && desc.mode == KEYDB_SEARCH_MODE_FPR16
	&& !memcmp (fprbin, desc.u.fpr, 16))
	;
	else if (fprlen == 16 && desc.mode == KEYDB_SEARCH_MODE_FPR
	&& !memcmp (fprbin, desc.u.fpr, 16)
	&& !desc.u.fpr[16]
	&& !desc.u.fpr[17]
	&& !desc.u.fpr[18]
	&& !desc.u.fpr[19])
	;
	else if (fprlen == 20 && (desc.mode == KEYDB_SEARCH_MODE_FPR20
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR)
	&& !memcmp (fprbin, desc.u.fpr, 20))
	;
	else
	{
	log_error (_("\"%s\" is not the primary fingerprint\n"), fpr);
	err = gpg_error (GPG_ERR_INV_NAME);
	goto leave;
	}

	*r_keyblock = keyblock;
	keyblock = NULL;
	*r_kdbhd = kdbhd;
	kdbhd = NULL;
	err = 0;

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	return err;
	}


	/* Unattended key signing function. If the key specifified by FPR is
	available and FPR is the primary fingerprint all user ids of the
	key are signed using the default signing key. If UIDS is an empty
	list all usable UIDs are signed, if it is not empty, only those
	user ids matching one of the entries of the list are signed. With
	LOCAL being true the signatures are marked as non-exportable. */
	void
	keyedit_quick_sign (ctrl_t ctrl, const char *fpr, strlist_t uids,
	strlist_t locusr, int local)
	{
	gpg_error_t err;
	kbnode_t keyblock = NULL;
	KEYDB_HANDLE kdbhd = NULL;
	int modified = 0;
	PKT_public_key *pk;
	kbnode_t node;
	strlist_t sl;
	int any;

	#ifdef HAVE_W32_SYSTEM
	/* See keyedit_menu for why we need this. */
	check_trustdb_stale (ctrl);
	#endif

	/* We require a fingerprint because only this uniquely identifies a
	key and may thus be used to select a key for unattended key
	signing. */
	if (find_by_primary_fpr (ctrl, fpr, &keyblock, &kdbhd))
	goto leave;

	if (fix_keyblock (&keyblock))
	modified++;

	/* Give some info in verbose. */
	if (opt.verbose)
	{
	show_key_with_all_names (ctrl, es_stdout, keyblock, 0,
	1/with_revoker/, 1/with_fingerprint/,
	0, 0, 1);
	es_fflush (es_stdout);
	}

	pk = keyblock->pkt->pkt.public_key;
	if (pk->flags.revoked)
	{
	if (!opt.verbose)
	show_key_with_all_names (ctrl, es_stdout, keyblock, 0, 0, 0, 0, 0, 1);
	log_error ("%s%s", _("Key is revoked."), _(" Unable to sign.\n"));
	goto leave;
	}

	/* Set the flags according to the UIDS list. Fixme: We may want to
	use classify_user_id along with dedicated compare functions so
	that we match the same way as in the key lookup. */
	any = 0;
	menu_select_uid (keyblock, 0); /* Better clear the flags first. */
	for (sl=uids; sl; sl = sl->next)
	{
	const char *name = sl->d;
	int count = 0;

	sl->flags &= ~(1\|2); /* Clear flags used for error reporting. */

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;

	if (uid->attrib_data)
	;
	else if (*name == '='
	&& strlen (name+1) == uid->len
	&& !memcmp (uid->name, name + 1, uid->len))
	{ /* Exact match - we don't do a check for ambiguity
	* in this case. */
	node->flag \|= NODFLG_SELUID;
	if (any != -1)
	{
	sl->flags \|= 1; /* Report as found. */
	any = 1;
	}
	}
	else if (ascii_memistr (uid->name, uid->len,
	name == ''? name+1:name))
	{
	node->flag \|= NODFLG_SELUID;
	if (any != -1)
	{
	sl->flags \|= 1; /* Report as found. */
	any = 1;
	}
	count++;
	}
	}
	}

	if (count > 1)
	{
	any = -1; /* Force failure at end. */
	sl->flags \|= 2; /* Report as ambiguous. */
	}
	}

	/* Check whether all given user ids were found. */
	for (sl=uids; sl; sl = sl->next)
	if (!(sl->flags & 1))
	any = -1; /* That user id was not found. */

	/* Print an error if there was a problem with the user ids. */
	if (uids && any < 1)
	{
	if (!opt.verbose)
	show_key_with_all_names (ctrl, es_stdout, keyblock, 0, 0, 0, 0, 0, 1);
	es_fflush (es_stdout);
	for (sl=uids; sl; sl = sl->next)
	{
	if ((sl->flags & 2))
	log_info (_("Invalid user ID '%s': %s\n"),
	sl->d, gpg_strerror (GPG_ERR_AMBIGUOUS_NAME));
	else if (!(sl->flags & 1))
	log_info (_("Invalid user ID '%s': %s\n"),
	sl->d, gpg_strerror (GPG_ERR_NOT_FOUND));
	}
	log_error ("%s %s", _("No matching user IDs."), _("Nothing to sign.\n"));
	goto leave;
	}

	/* Sign. */
	sign_uids (ctrl, es_stdout, keyblock, locusr, &modified, local, 0, 0, 0, 1);
	es_fflush (es_stdout);

	if (modified)
	{
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	goto leave;
	}
	}
	else
	log_info (_("Key not changed so no update needed.\n"));

	if (update_trust)
	revalidation_mark ();


	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	}


	/* Unattended subkey creation function.
	*
	*/
	void
	keyedit_quick_addkey (ctrl_t ctrl, const char fpr, const char algostr,
	const char usagestr, const char expirestr)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	KEYDB_HANDLE kdbhd;
	int modified = 0;
	PKT_public_key *pk;

	#ifdef HAVE_W32_SYSTEM
	/* See keyedit_menu for why we need this. */
	check_trustdb_stale (ctrl);
	#endif

	/* We require a fingerprint because only this uniquely identifies a
	* key and may thus be used to select a key for unattended subkey
	* creation. */
	if (find_by_primary_fpr (ctrl, fpr, &keyblock, &kdbhd))
	goto leave;

	if (fix_keyblock (&keyblock))
	modified++;

	pk = keyblock->pkt->pkt.public_key;
	if (pk->flags.revoked)
	{
	if (!opt.verbose)
	show_key_with_all_names (ctrl, es_stdout, keyblock, 0, 0, 0, 0, 0, 1);
	log_error ("%s%s", _("Key is revoked."), "\n");
	goto leave;
	}

	/* Create the subkey. Note that the called function already prints
	* an error message. */
	if (!generate_subkeypair (ctrl, keyblock, algostr, usagestr, expirestr))
	modified = 1;
	es_fflush (es_stdout);

	/* Store. */
	if (modified)
	{
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	goto leave;
	}
	}
	else
	log_info (_("Key not changed so no update needed.\n"));

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	}


	/* Unattended expiration setting function for the main key.
	*
	*/
	void
	keyedit_quick_set_expire (ctrl_t ctrl, const char fpr, const char expirestr)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	KEYDB_HANDLE kdbhd;
	int modified = 0;
	PKT_public_key *pk;
	u32 expire;

	#ifdef HAVE_W32_SYSTEM
	/* See keyedit_menu for why we need this. */
	check_trustdb_stale (ctrl);
	#endif

	/* We require a fingerprint because only this uniquely identifies a
	* key and may thus be used to select a key for unattended
	* expiration setting. */
	err = find_by_primary_fpr (ctrl, fpr, &keyblock, &kdbhd);
	if (err)
	goto leave;

	if (fix_keyblock (&keyblock))
	modified++;

	pk = keyblock->pkt->pkt.public_key;
	if (pk->flags.revoked)
	{
	if (!opt.verbose)
	show_key_with_all_names (ctrl, es_stdout, keyblock, 0, 0, 0, 0, 0, 1);
	log_error ("%s%s", _("Key is revoked."), "\n");
	err = gpg_error (GPG_ERR_CERT_REVOKED);
	goto leave;
	}


	expire = parse_expire_string (expirestr);
	if (expire == (u32)-1 )
	{
	log_error (_("'%s' is not a valid expiration time\n"), expirestr);
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}
	if (expire)
	expire += make_timestamp ();

	/* Set the new expiration date. */
	err = menu_expire (keyblock, 1, expire);
	if (gpg_err_code (err) == GPG_ERR_TRUE)
	modified = 1;
	else if (err)
	goto leave;
	es_fflush (es_stdout);

	/* Store. */
	if (modified)
	{
	err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
	if (err)
	{
	log_error (_("update failed: %s\n"), gpg_strerror (err));
	goto leave;
	}
	if (update_trust)
	revalidation_mark ();
	}
	else
	log_info (_("Key not changed so no update needed.\n"));

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	if (err)
	write_status_error ("set_expire", err);
	}



	static void
	tty_print_notations (int indent, PKT_signature * sig)
	{
	int first = 1;
	struct notation notation, nd;

	if (indent < 0)
	{
	first = 0;
	indent = -indent;
	}

	notation = sig_to_notation (sig);

	for (nd = notation; nd; nd = nd->next)
	{
	if (!first)
	tty_printf ("%*s", indent, "");
	else
	first = 0;

	tty_print_utf8_string (nd->name, strlen (nd->name));
	tty_printf ("=");
	tty_print_utf8_string (nd->value, strlen (nd->value));
	tty_printf ("\n");
	}

	free_notation (notation);
	}


	/*
	* Show preferences of a public keyblock.
	*/
	static void
	show_prefs (PKT_user_id * uid, PKT_signature * selfsig, int verbose)
	{
	const prefitem_t fake = { 0, 0 };
	const prefitem_t *prefs;
	int i;

	if (!uid)
	return;

	if (uid->prefs)
	prefs = uid->prefs;
	else if (verbose)
	prefs = &fake;
	else
	return;

	if (verbose)
	{
	int any, des_seen = 0, sha1_seen = 0, uncomp_seen = 0;

	tty_printf (" ");
	tty_printf (_("Cipher: "));
	for (i = any = 0; prefs[i].type; i++)
	{
	if (prefs[i].type == PREFTYPE_SYM)
	{
	if (any)
	tty_printf (", ");
	any = 1;
	/* We don't want to display strings for experimental algos */
	if (!openpgp_cipher_test_algo (prefs[i].value)
	&& prefs[i].value < 100)
	tty_printf ("%s", openpgp_cipher_algo_name (prefs[i].value));
	else
	tty_printf ("[%d]", prefs[i].value);
	if (prefs[i].value == CIPHER_ALGO_3DES)
	des_seen = 1;
	}
	}
	if (!des_seen)
	{
	if (any)
	tty_printf (", ");
	tty_printf ("%s", openpgp_cipher_algo_name (CIPHER_ALGO_3DES));
	}
	tty_printf ("\n ");
	tty_printf (_("Digest: "));
	for (i = any = 0; prefs[i].type; i++)
	{
	if (prefs[i].type == PREFTYPE_HASH)
	{
	if (any)
	tty_printf (", ");
	any = 1;
	/* We don't want to display strings for experimental algos */
	if (!gcry_md_test_algo (prefs[i].value) && prefs[i].value < 100)
	tty_printf ("%s", gcry_md_algo_name (prefs[i].value));
	else
	tty_printf ("[%d]", prefs[i].value);
	if (prefs[i].value == DIGEST_ALGO_SHA1)
	sha1_seen = 1;
	}
	}
	if (!sha1_seen)
	{
	if (any)
	tty_printf (", ");
	tty_printf ("%s", gcry_md_algo_name (DIGEST_ALGO_SHA1));
	}
	tty_printf ("\n ");
	tty_printf (_("Compression: "));
	for (i = any = 0; prefs[i].type; i++)
	{
	if (prefs[i].type == PREFTYPE_ZIP)
	{
	const char *s = compress_algo_to_string (prefs[i].value);

	if (any)
	tty_printf (", ");
	any = 1;
	/* We don't want to display strings for experimental algos */
	if (s && prefs[i].value < 100)
	tty_printf ("%s", s);
	else
	tty_printf ("[%d]", prefs[i].value);
	if (prefs[i].value == COMPRESS_ALGO_NONE)
	uncomp_seen = 1;
	}
	}
	if (!uncomp_seen)
	{
	if (any)
	tty_printf (", ");
	else
	{
	tty_printf ("%s", compress_algo_to_string (COMPRESS_ALGO_ZIP));
	tty_printf (", ");
	}
	tty_printf ("%s", compress_algo_to_string (COMPRESS_ALGO_NONE));
	}
	if (uid->flags.mdc \|\| !uid->flags.ks_modify)
	{
	tty_printf ("\n ");
	tty_printf (_("Features: "));
	any = 0;
	if (uid->flags.mdc)
	{
	tty_printf ("MDC");
	any = 1;
	}
	if (!uid->flags.ks_modify)
	{
	if (any)
	tty_printf (", ");
	tty_printf (_("Keyserver no-modify"));
	}
	}
	tty_printf ("\n");

	if (selfsig)
	{
	const byte *pref_ks;
	size_t pref_ks_len;

	pref_ks = parse_sig_subpkt (selfsig->hashed,
	SIGSUBPKT_PREF_KS, &pref_ks_len);
	if (pref_ks && pref_ks_len)
	{
	tty_printf (" ");
	tty_printf (_("Preferred keyserver: "));
	tty_print_utf8_string (pref_ks, pref_ks_len);
	tty_printf ("\n");
	}

	if (selfsig->flags.notation)
	{
	tty_printf (" ");
	tty_printf (_("Notations: "));
	tty_print_notations (5 + strlen (_("Notations: ")), selfsig);
	}
	}
	}
	else
	{
	tty_printf (" ");
	for (i = 0; prefs[i].type; i++)
	{
	tty_printf (" %c%d", prefs[i].type == PREFTYPE_SYM ? 'S' :
	prefs[i].type == PREFTYPE_HASH ? 'H' :
	prefs[i].type == PREFTYPE_ZIP ? 'Z' : '?',
	prefs[i].value);
	}
	if (uid->flags.mdc)
	tty_printf (" [mdc]");
	if (!uid->flags.ks_modify)
	tty_printf (" [no-ks-modify]");
	tty_printf ("\n");
	}
	}


	/* This is the version of show_key_with_all_names used when
	opt.with_colons is used. It prints all available data in a easy to
	parse format and does not translate utf8 */
	static void
	show_key_with_all_names_colon (ctrl_t ctrl, estream_t fp, kbnode_t keyblock)
	{
	KBNODE node;
	int i, j, ulti_hack = 0;
	byte pk_version = 0;
	PKT_public_key *primary = NULL;
	int have_seckey;

	if (!fp)
	fp = es_stdout;

	/* the keys */
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| (node->pkt->pkttype == PKT_PUBLIC_SUBKEY))
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;
	u32 keyid[2];

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	pk_version = pk->version;
	primary = pk;
	}

	keyid_from_pk (pk, keyid);
	have_seckey = !agent_probe_secret_key (ctrl, pk);

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	es_fputs (have_seckey? "sec:" : "pub:", fp);
	else
	es_fputs (have_seckey? "ssb:" : "sub:", fp);

	if (!pk->flags.valid)
	es_putc ('i', fp);
	else if (pk->flags.revoked)
	es_putc ('r', fp);
	else if (pk->has_expired)
	es_putc ('e', fp);
	else if (!(opt.fast_list_mode \|\| opt.no_expensive_trust_checks))
	{
	int trust = get_validity_info (ctrl, keyblock, pk, NULL);
	if (trust == 'u')
	ulti_hack = 1;
	es_putc (trust, fp);
	}

	es_fprintf (fp, ":%u:%d:%08lX%08lX:%lu:%lu::",
	nbits_from_pk (pk),
	pk->pubkey_algo,
	(ulong) keyid[0], (ulong) keyid[1],
	(ulong) pk->timestamp, (ulong) pk->expiredate);
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	&& !(opt.fast_list_mode \|\| opt.no_expensive_trust_checks))
	es_putc (get_ownertrust_info (pk), fp);
	es_putc (':', fp);
	es_putc (':', fp);
	es_putc (':', fp);
	/* Print capabilities. */
	if ((pk->pubkey_usage & PUBKEY_USAGE_ENC))
	es_putc ('e', fp);
	if ((pk->pubkey_usage & PUBKEY_USAGE_SIG))
	es_putc ('s', fp);
	if ((pk->pubkey_usage & PUBKEY_USAGE_CERT))
	es_putc ('c', fp);
	if ((pk->pubkey_usage & PUBKEY_USAGE_AUTH))
	es_putc ('a', fp);
	es_putc ('\n', fp);

	print_fingerprint (fp, pk, 0);
	print_revokers (fp, pk);
	}
	}

	/* the user ids */
	i = 0;
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;

	++i;

	if (uid->attrib_data)
	es_fputs ("uat:", fp);
	else
	es_fputs ("uid:", fp);

	if (uid->is_revoked)
	es_fputs ("r::::::::", fp);
	else if (uid->is_expired)
	es_fputs ("e::::::::", fp);
	else if (opt.fast_list_mode \|\| opt.no_expensive_trust_checks)
	es_fputs ("::::::::", fp);
	else
	{
	int uid_validity;

	if (primary && !ulti_hack)
	uid_validity = get_validity_info (ctrl, keyblock, primary, uid);
	else
	uid_validity = 'u';
	es_fprintf (fp, "%c::::::::", uid_validity);
	}

	if (uid->attrib_data)
	es_fprintf (fp, "%u %lu", uid->numattribs, uid->attrib_len);
	else
	es_write_sanitized (fp, uid->name, uid->len, ":", NULL);

	es_putc (':', fp);
	/* signature class */
	es_putc (':', fp);
	/* capabilities */
	es_putc (':', fp);
	/* preferences */
	if (pk_version > 3 \|\| uid->selfsigversion > 3)
	{
	const prefitem_t *prefs = uid->prefs;

	for (j = 0; prefs && prefs[j].type; j++)
	{
	if (j)
	es_putc (' ', fp);
	es_fprintf (fp,
	"%c%d", prefs[j].type == PREFTYPE_SYM ? 'S' :
	prefs[j].type == PREFTYPE_HASH ? 'H' :
	prefs[j].type == PREFTYPE_ZIP ? 'Z' : '?',
	prefs[j].value);
	}
	if (uid->flags.mdc)
	es_fputs (",mdc", fp);
	if (!uid->flags.ks_modify)
	es_fputs (",no-ks-modify", fp);
	}
	es_putc (':', fp);
	/* flags */
	es_fprintf (fp, "%d,", i);
	if (uid->is_primary)
	es_putc ('p', fp);
	if (uid->is_revoked)
	es_putc ('r', fp);
	if (uid->is_expired)
	es_putc ('e', fp);
	if ((node->flag & NODFLG_SELUID))
	es_putc ('s', fp);
	if ((node->flag & NODFLG_MARK_A))
	es_putc ('m', fp);
	es_putc (':', fp);
	if (opt.trust_model == TM_TOFU \|\| opt.trust_model == TM_TOFU_PGP)
	{
	#ifdef USE_TOFU
	enum tofu_policy policy;
	if (! tofu_get_policy (ctrl, primary, uid, &policy)
	&& policy != TOFU_POLICY_NONE)
	es_fprintf (fp, "%s", tofu_policy_str (policy));
	#endif /USE_TOFU/
	}
	es_putc (':', fp);
	es_putc ('\n', fp);
	}
	}
	}


	static void
	show_names (ctrl_t ctrl, estream_t fp,
	kbnode_t keyblock, PKT_public_key * pk, unsigned int flag,
	int with_prefs)
	{
	KBNODE node;
	int i = 0;

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID && !is_deleted_kbnode (node))
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	++i;
	if (!flag \|\| (flag && (node->flag & flag)))
	{
	if (!(flag & NODFLG_MARK_A) && pk)
	tty_fprintf (fp, "%s ", uid_trust_string_fixed (ctrl, pk, uid));

	if (flag & NODFLG_MARK_A)
	tty_fprintf (fp, " ");
	else if (node->flag & NODFLG_SELUID)
	tty_fprintf (fp, "(%d)* ", i);
	else if (uid->is_primary)
	tty_fprintf (fp, "(%d). ", i);
	else
	tty_fprintf (fp, "(%d) ", i);
	tty_print_utf8_string2 (fp, uid->name, uid->len, 0);
	tty_fprintf (fp, "\n");
	if (with_prefs && pk)
	{
	if (pk->version > 3 \|\| uid->selfsigversion > 3)
	{
	PKT_signature *selfsig = NULL;
	KBNODE signode;

	for (signode = node->next;
	signode && signode->pkt->pkttype == PKT_SIGNATURE;
	signode = signode->next)
	{
	if (signode->pkt->pkt.signature->
	flags.chosen_selfsig)
	{
	selfsig = signode->pkt->pkt.signature;
	break;
	}
	}

	show_prefs (uid, selfsig, with_prefs == 2);
	}
	else
	tty_fprintf (fp, _("There are no preferences on a"
	" PGP 2.x-style user ID.\n"));
	}
	}
	}
	}
	}


	/*
	* Display the key a the user ids, if only_marked is true, do only so
	* for user ids with mark A flag set and do not display the index
	* number. If FP is not NULL print to the given stream and not to the
	* tty (ignored in with-colons mode).
	*/
	static void
	show_key_with_all_names (ctrl_t ctrl, estream_t fp,
	KBNODE keyblock, int only_marked, int with_revoker,
	int with_fpr, int with_subkeys, int with_prefs,
	int nowarn)
	{
	gpg_error_t err;
	kbnode_t node;
	int i;
	int do_warn = 0;
	int have_seckey = 0;
	char *serialno = NULL;
	PKT_public_key *primary = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	if (opt.with_colons)
	{
	show_key_with_all_names_colon (ctrl, fp, keyblock);
	return;
	}

	/* the keys */
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| (with_subkeys && node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& !is_deleted_kbnode (node)))
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;
	const char *otrust = "err";
	const char *trust = "err";

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	/* do it here, so that debug messages don't clutter the
	* output */
	static int did_warn = 0;

	trust = get_validity_string (ctrl, pk, NULL);
	otrust = get_ownertrust_string (pk);

	/* Show a warning once */
	if (!did_warn
	&& (get_validity (ctrl, keyblock, pk, NULL, NULL, 0)
	& TRUST_FLAG_PENDING_CHECK))
	{
	did_warn = 1;
	do_warn = 1;
	}

	primary = pk;
	}

	if (pk->flags.revoked)
	{
	char *user = get_user_id_string_native (pk->revoked.keyid);
	tty_fprintf (fp,
	_("The following key was revoked on"
	" %s by %s key %s\n"),
	revokestr_from_pk (pk),
	gcry_pk_algo_name (pk->revoked.algo), user);
	xfree (user);
	}

	if (with_revoker)
	{
	if (!pk->revkey && pk->numrevkeys)
	BUG ();
	else
	for (i = 0; i < pk->numrevkeys; i++)
	{
	u32 r_keyid[2];
	char *user;
	const char *algo;

	algo = gcry_pk_algo_name (pk->revkey[i].algid);
	keyid_from_fingerprint (pk->revkey[i].fpr,
	MAX_FINGERPRINT_LEN, r_keyid);

	user = get_user_id_string_native (r_keyid);
	tty_fprintf (fp,
	_("This key may be revoked by %s key %s"),
	algo ? algo : "?", user);

	if (pk->revkey[i].class & 0x40)
	{
	tty_fprintf (fp, " ");
	tty_fprintf (fp, _("(sensitive)"));
	}

	tty_fprintf (fp, "\n");
	xfree (user);
	}
	}

	keyid_from_pk (pk, NULL);

	xfree (serialno);
	serialno = NULL;
	{
	char *hexgrip;

	err = hexkeygrip_from_pk (pk, &hexgrip);
	if (err)
	{
	log_error ("error computing a keygrip: %s\n",
	gpg_strerror (err));
	have_seckey = 0;
	}
	else
	have_seckey = !agent_get_keyinfo (ctrl, hexgrip, &serialno, NULL);
	xfree (hexgrip);
	}

	tty_fprintf
	(fp, "%s%c %s/%s",
	node->pkt->pkttype == PKT_PUBLIC_KEY && have_seckey? "sec" :
	node->pkt->pkttype == PKT_PUBLIC_KEY ? "pub" :
	have_seckey ? "ssb" :
	"sub",
	(node->flag & NODFLG_SELKEY) ? '*' : ' ',
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr (pk->keyid));

	if (opt.legacy_list_mode)
	tty_fprintf (fp, " ");
	else
	tty_fprintf (fp, "\n ");

	tty_fprintf (fp, _("created: %s"), datestr_from_pk (pk));
	tty_fprintf (fp, " ");
	if (pk->flags.revoked)
	tty_fprintf (fp, _("revoked: %s"), revokestr_from_pk (pk));
	else if (pk->has_expired)
	tty_fprintf (fp, _("expired: %s"), expirestr_from_pk (pk));
	else
	tty_fprintf (fp, _("expires: %s"), expirestr_from_pk (pk));
	tty_fprintf (fp, " ");
	tty_fprintf (fp, _("usage: %s"), usagestr_from_pk (pk, 1));
	tty_fprintf (fp, "\n");

	if (serialno)
	{
	/* The agent told us that a secret key is available and
	that it has been stored on a card. */
	tty_fprintf (fp, "%*s%s", opt.legacy_list_mode? 21:5, "",
	_("card-no: "));
	if (strlen (serialno) == 32
	&& !strncmp (serialno, "D27600012401", 12))
	{
	/* This is an OpenPGP card. Print the relevant part. */
	/* Example: D2760001240101010001000003470000 */
	/* xxxxyyyyyyyy */
	tty_fprintf (fp, "%.s %.s\n",
	4, serialno+16, 8, serialno+20);
	}
	else
	tty_fprintf (fp, "%s\n", serialno);

	}
	else if (pk->seckey_info
	&& pk->seckey_info->is_protected
	&& pk->seckey_info->s2k.mode == 1002)
	{
	/* FIXME: Check wether this code path is still used. */
	tty_fprintf (fp, "%*s%s", opt.legacy_list_mode? 21:5, "",
	_("card-no: "));
	if (pk->seckey_info->ivlen == 16
	&& !memcmp (pk->seckey_info->iv,
	"\xD2\x76\x00\x01\x24\x01", 6))
	{
	/* This is an OpenPGP card. */
	for (i = 8; i < 14; i++)
	{
	if (i == 10)
	tty_fprintf (fp, " ");
	tty_fprintf (fp, "%02X", pk->seckey_info->iv[i]);
	}
	}
	else
	{
	/* Unknown card: Print all. */
	for (i = 0; i < pk->seckey_info->ivlen; i++)
	tty_fprintf (fp, "%02X", pk->seckey_info->iv[i]);
	}
	tty_fprintf (fp, "\n");
	}

	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY)
	{
	if (opt.trust_model != TM_ALWAYS)
	{
	tty_fprintf (fp, "%*s",
	opt.legacy_list_mode?
	((int) keystrlen () + 13):5, "");
	/* Ownertrust is only meaningful for the PGP or
	classic trust models, or PGP combined with TOFU */
	if (opt.trust_model == TM_PGP
	\|\| opt.trust_model == TM_CLASSIC
	\|\| opt.trust_model == TM_TOFU_PGP)
	{
	int width = 14 - strlen (otrust);
	if (width <= 0)
	width = 1;
	tty_fprintf (fp, _("trust: %s"), otrust);
	tty_fprintf (fp, "%*s", width, "");
	}

	tty_fprintf (fp, _("validity: %s"), trust);
	tty_fprintf (fp, "\n");
	}
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	&& (get_ownertrust (pk) & TRUST_FLAG_DISABLED))
	{
	tty_fprintf (fp, "*** ");
	tty_fprintf (fp, _("This key has been disabled"));
	tty_fprintf (fp, "\n");
	}
	}

	if ((node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY) && with_fpr)
	{
	print_fingerprint (fp, pk, 2);
	tty_fprintf (fp, "\n");
	}
	}
	}

	show_names (ctrl, fp,
	keyblock, primary, only_marked ? NODFLG_MARK_A : 0, with_prefs);

	if (do_warn && !nowarn)
	tty_fprintf (fp, _("Please note that the shown key validity"
	" is not necessarily correct\n"
	"unless you restart the program.\n"));

	xfree (serialno);
	}


	/* Display basic key information. This function is suitable to show
	information on the key without any dependencies on the trustdb or
	any other internal GnuPG stuff. KEYBLOCK may either be a public or
	a secret key. This function may be called with KEYBLOCK containing
	secret keys and thus the printing of "pub" vs. "sec" does only
	depend on the packet type and not by checking with gpg-agent. */
	void
	show_basic_key_info (KBNODE keyblock)
	{
	KBNODE node;
	int i;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* The primary key */
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	/* Note, we use the same format string as in other show
	functions to make the translation job easier. */
	tty_printf ("%s %s/%s ",
	node->pkt->pkttype == PKT_PUBLIC_KEY ? "pub" :
	node->pkt->pkttype == PKT_PUBLIC_SUBKEY ? "sub" :
	node->pkt->pkttype == PKT_SECRET_KEY ? "sec" :"ssb",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk (pk));
	tty_printf (_("created: %s"), datestr_from_pk (pk));
	tty_printf (" ");
	tty_printf (_("expires: %s"), expirestr_from_pk (pk));
	tty_printf ("\n");
	print_fingerprint (NULL, pk, 3);
	tty_printf ("\n");
	}
	}

	/* The user IDs. */
	for (i = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	++i;

	tty_printf (" ");
	if (uid->is_revoked)
	tty_printf ("[%s] ", _("revoked"));
	else if (uid->is_expired)
	tty_printf ("[%s] ", _("expired"));
	tty_print_utf8_string (uid->name, uid->len);
	tty_printf ("\n");
	}
	}
	}


	static void
	show_key_and_fingerprint (kbnode_t keyblock, int with_subkeys)
	{
	kbnode_t node;
	PKT_public_key *pk = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	pk = node->pkt->pkt.public_key;
	tty_printf ("pub %s/%s %s ",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk(pk),
	datestr_from_pk (pk));
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	tty_print_utf8_string (uid->name, uid->len);
	break;
	}
	}
	tty_printf ("\n");
	if (pk)
	print_fingerprint (NULL, pk, 2);
	if (with_subkeys)
	{
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	pk = node->pkt->pkt.public_key;
	tty_printf ("sub %s/%s %s [%s]\n",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk(pk),
	datestr_from_pk (pk),
	usagestr_from_pk (pk, 0));

	print_fingerprint (NULL, pk, 4);
	}
	}
	}
	}


	/* Show a listing of the primary and its subkeys along with their
	keygrips. */
	static void
	show_key_and_grip (kbnode_t keyblock)
	{
	kbnode_t node;
	PKT_public_key *pk = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];
	char *hexgrip;

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	pk = node->pkt->pkt.public_key;
	tty_printf ("%s %s/%s %s [%s]\n",
	node->pkt->pkttype == PKT_PUBLIC_KEY? "pub":"sub",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk(pk),
	datestr_from_pk (pk),
	usagestr_from_pk (pk, 0));

	if (!hexkeygrip_from_pk (pk, &hexgrip))
	{
	tty_printf (" Keygrip: %s\n", hexgrip);
	xfree (hexgrip);
	}
	}
	}
	}


	/* Show a warning if no uids on the key have the primary uid flag
	set. */
	static void
	no_primary_warning (KBNODE keyblock)
	{
	KBNODE node;
	int have_primary = 0, uid_count = 0;

	/* TODO: if we ever start behaving differently with a primary or
	non-primary attribute ID, we will need to check for attributes
	here as well. */

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID
	&& node->pkt->pkt.user_id->attrib_data == NULL)
	{
	uid_count++;

	if (node->pkt->pkt.user_id->is_primary == 2)
	{
	have_primary = 1;
	break;
	}
	}
	}

	if (uid_count > 1 && !have_primary)
	log_info (_
	("WARNING: no user ID has been marked as primary. This command"
	" may\n cause a different user ID to become"
	" the assumed primary.\n"));
	}


	/* Print a warning if the latest encryption subkey expires soon. This
	function is called after the expire data of the primary key has
	been changed. */
	static void
	subkey_expire_warning (kbnode_t keyblock)
	{
	u32 curtime = make_timestamp ();
	kbnode_t node;
	PKT_public_key *pk;
	/* u32 mainexpire = 0; */
	u32 subexpire = 0;
	u32 latest_date = 0;

	for (node = keyblock; node; node = node->next)
	{
	/* if (node->pkt->pkttype == PKT_PUBLIC_KEY) */
	/* { */
	/* pk = node->pkt->pkt.public_key; */
	/* mainexpire = pk->expiredate; */
	/* } */

	if (node->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;
	pk = node->pkt->pkt.public_key;

	if (!pk->flags.valid)
	continue;
	if (pk->flags.revoked)
	continue;
	if (pk->timestamp > curtime)
	continue; /* Ignore future keys. */
	if (!(pk->pubkey_usage & PUBKEY_USAGE_ENC))
	continue; /* Not an encryption key. */

	if (pk->timestamp > latest_date \|\| (!pk->timestamp && !latest_date))
	{
	latest_date = pk->timestamp;
	subexpire = pk->expiredate;
	}
	}

	if (!subexpire)
	return; /* No valid subkey with an expiration time. */

	if (curtime + (10*86400) > subexpire)
	{
	log_info (_("WARNING: Your encryption subkey expires soon.\n"));
	log_info (_("You may want to change its expiration date too.\n"));
	}
	}


	/*
	* Ask for a new user id, add the self-signature, and update the
	* keyblock. If UIDSTRING is not NULL the user ID is generated
	* unattended using that string. UIDSTRING is expected to be utf-8
	* encoded and white space trimmed. Returns true if there is a new
	* user id.
	*/
	static int
	menu_adduid (ctrl_t ctrl, kbnode_t pub_keyblock,
	int photo, const char photo_name, const char uidstring)
	{
	PKT_user_id *uid;
	PKT_public_key *pk = NULL;
	PKT_signature *sig = NULL;
	PACKET *pkt;
	KBNODE node;
	KBNODE pub_where = NULL;
	gpg_error_t err;

	if (photo && uidstring)
	return 0; /* Not allowed. */

	for (node = pub_keyblock; node; pub_where = node, node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	pk = node->pkt->pkt.public_key;
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break;
	}
	if (!node) /* No subkey. */
	pub_where = NULL;
	log_assert (pk);

	if (photo)
	{
	int hasattrib = 0;

	for (node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID &&
	node->pkt->pkt.user_id->attrib_data != NULL)
	{
	hasattrib = 1;
	break;
	}

	/* It is legal but bad for compatibility to add a photo ID to a
	v3 key as it means that PGP2 will not be able to use that key
	anymore. Also, PGP may not expect a photo on a v3 key.
	Don't bother to ask this if the key already has a photo - any
	damage has already been done at that point. -dms */
	if (pk->version == 3 && !hasattrib)
	{
	if (opt.expert)
	{
	tty_printf (_("WARNING: This is a PGP2-style key. "
	"Adding a photo ID may cause some versions\n"
	" of PGP to reject this key.\n"));

	if (!cpr_get_answer_is_yes ("keyedit.v3_photo.okay",
	_("Are you sure you still want "
	"to add it? (y/N) ")))
	return 0;
	}
	else
	{
	tty_printf (_("You may not add a photo ID to "
	"a PGP2-style key.\n"));
	return 0;
	}
	}

	uid = generate_photo_id (ctrl, pk, photo_name);
	}
	else
	uid = generate_user_id (pub_keyblock, uidstring);
	if (!uid)
	{
	if (uidstring)
	{
	write_status_error ("adduid", gpg_error (304));
	log_error ("%s", _("Such a user ID already exists on this key!\n"));
	}
	return 0;
	}

	err = make_keysig_packet (&sig, pk, uid, NULL, pk, 0x13, 0, 0, 0,
	keygen_add_std_prefs, pk, NULL);
	if (err)
	{
	write_status_error ("keysig", err);
	log_error ("signing failed: %s\n", gpg_strerror (err));
	free_user_id (uid);
	return 0;
	}

	/* Insert/append to public keyblock */
	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_USER_ID;
	pkt->pkt.user_id = uid;
	node = new_kbnode (pkt);
	if (pub_where)
	insert_kbnode (pub_where, node, 0);
	else
	add_kbnode (pub_keyblock, node);
	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	if (pub_where)
	insert_kbnode (node, new_kbnode (pkt), 0);
	else
	add_kbnode (pub_keyblock, new_kbnode (pkt));
	return 1;
	}


	/*
	* Remove all selected userids from the keyring
	*/
	static void
	menu_deluid (KBNODE pub_keyblock)
	{
	KBNODE node;
	int selected = 0;

	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	selected = node->flag & NODFLG_SELUID;
	if (selected)
	{
	/* Only cause a trust update if we delete a
	non-revoked user id */
	if (!node->pkt->pkt.user_id->is_revoked)
	update_trust = 1;
	delete_kbnode (node);
	}
	}
	else if (selected && node->pkt->pkttype == PKT_SIGNATURE)
	delete_kbnode (node);
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	selected = 0;
	}
	commit_kbnode (&pub_keyblock);
	}


	static int
	menu_delsig (KBNODE pub_keyblock)
	{
	KBNODE node;
	PKT_user_id *uid = NULL;
	int changed = 0;

	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid = (node->flag & NODFLG_SELUID) ? node->pkt->pkt.user_id : NULL;
	}
	else if (uid && node->pkt->pkttype == PKT_SIGNATURE)
	{
	int okay, valid, selfsig, inv_sig, no_key, other_err;

	tty_printf ("uid ");
	tty_print_utf8_string (uid->name, uid->len);
	tty_printf ("\n");

	okay = inv_sig = no_key = other_err = 0;
	if (opt.with_colons)
	valid = print_and_check_one_sig_colon (pub_keyblock, node,
	&inv_sig, &no_key,
	&other_err, &selfsig, 1);
	else
	valid = print_and_check_one_sig (pub_keyblock, node,
	&inv_sig, &no_key, &other_err,
	&selfsig, 1, 0);

	if (valid)
	{
	okay = cpr_get_answer_yes_no_quit
	("keyedit.delsig.valid",
	_("Delete this good signature? (y/N/q)"));

	/* Only update trust if we delete a good signature.
	The other two cases do not affect trust. */
	if (okay)
	update_trust = 1;
	}
	else if (inv_sig \|\| other_err)
	okay = cpr_get_answer_yes_no_quit
	("keyedit.delsig.invalid",
	_("Delete this invalid signature? (y/N/q)"));
	else if (no_key)
	okay = cpr_get_answer_yes_no_quit
	("keyedit.delsig.unknown",
	_("Delete this unknown signature? (y/N/q)"));

	if (okay == -1)
	break;
	if (okay && selfsig
	&& !cpr_get_answer_is_yes
	("keyedit.delsig.selfsig",
	_("Really delete this self-signature? (y/N)")))
	okay = 0;
	if (okay)
	{
	delete_kbnode (node);
	changed++;
	}

	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	uid = NULL;
	}

	if (changed)
	{
	commit_kbnode (&pub_keyblock);
	tty_printf (ngettext("Deleted %d signature.\n",
	"Deleted %d signatures.\n", changed), changed);
	}
	else
	tty_printf (_("Nothing deleted.\n"));

	return changed;
	}


	static int
	menu_clean (KBNODE keyblock, int self_only)
	{
	KBNODE uidnode;
	int modified = 0, select_all = !count_selected_uids (keyblock);

	for (uidnode = keyblock->next;
	uidnode && uidnode->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	uidnode = uidnode->next)
	{
	if (uidnode->pkt->pkttype == PKT_USER_ID
	&& (uidnode->flag & NODFLG_SELUID \|\| select_all))
	{
	int uids = 0, sigs = 0;
	char *user = utf8_to_native (uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len,
	0);

	clean_one_uid (keyblock, uidnode, opt.verbose, self_only, &uids,
	&sigs);
	if (uids)
	{
	const char *reason;

	if (uidnode->pkt->pkt.user_id->is_revoked)
	reason = _("revoked");
	else if (uidnode->pkt->pkt.user_id->is_expired)
	reason = _("expired");
	else
	reason = _("invalid");

	tty_printf (_("User ID \"%s\" compacted: %s\n"), user, reason);

	modified = 1;
	}
	else if (sigs)
	{
	tty_printf (ngettext("User ID \"%s\": %d signature removed\n",
	"User ID \"%s\": %d signatures removed\n",
	sigs), user, sigs);
	modified = 1;
	}
	else
	{
	tty_printf (self_only == 1 ?
	_("User ID \"%s\": already minimized\n") :
	_("User ID \"%s\": already clean\n"), user);
	}

	xfree (user);
	}
	}

	return modified;
	}


	/*
	* Remove some of the secondary keys
	*/
	static void
	menu_delkey (KBNODE pub_keyblock)
	{
	KBNODE node;
	int selected = 0;

	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	selected = node->flag & NODFLG_SELKEY;
	if (selected)
	delete_kbnode (node);
	}
	else if (selected && node->pkt->pkttype == PKT_SIGNATURE)
	delete_kbnode (node);
	else
	selected = 0;
	}
	commit_kbnode (&pub_keyblock);

	/* No need to set update_trust here since signing keys are no
	longer used to certify other keys, so there is no change in
	trust when revoking/removing them. */
	}


	/*
	* Ask for a new revoker, create the self-signature and put it into
	* the keyblock. Returns true if there is a new revoker.
	*/
	static int
	menu_addrevoker (ctrl_t ctrl, kbnode_t pub_keyblock, int sensitive)
	{
	PKT_public_key *pk = NULL;
	PKT_public_key *revoker_pk = NULL;
	PKT_signature *sig = NULL;
	PACKET *pkt;
	struct revocation_key revkey;
	size_t fprlen;
	int rc;

	log_assert (pub_keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	pk = pub_keyblock->pkt->pkt.public_key;

	if (pk->numrevkeys == 0 && pk->version == 3)
	{
	/* It is legal but bad for compatibility to add a revoker to a
	v3 key as it means that PGP2 will not be able to use that key
	anymore. Also, PGP may not expect a revoker on a v3 key.
	Don't bother to ask this if the key already has a revoker -
	any damage has already been done at that point. -dms */
	if (opt.expert)
	{
	tty_printf (_("WARNING: This is a PGP 2.x-style key. "
	"Adding a designated revoker may cause\n"
	" some versions of PGP to reject this key.\n"));

	if (!cpr_get_answer_is_yes ("keyedit.v3_revoker.okay",
	_("Are you sure you still want "
	"to add it? (y/N) ")))
	return 0;
	}
	else
	{
	tty_printf (_("You may not add a designated revoker to "
	"a PGP 2.x-style key.\n"));
	return 0;
	}
	}

	for (;;)
	{
	char *answer;

	free_public_key (revoker_pk);
	revoker_pk = xmalloc_clear (sizeof (*revoker_pk));

	tty_printf ("\n");

	answer = cpr_get_utf8
	("keyedit.add_revoker",
	_("Enter the user ID of the designated revoker: "));
	if (answer[0] == '\0' \|\| answer[0] == CONTROL_D)
	{
	xfree (answer);
	goto fail;
	}

	/* Note that I'm requesting CERT here, which usually implies
	primary keys only, but some casual testing shows that PGP and
	GnuPG both can handle a designated revocation from a subkey. */
	revoker_pk->req_usage = PUBKEY_USAGE_CERT;
	rc = get_pubkey_byname (ctrl, NULL, revoker_pk, answer, NULL, NULL, 1, 1);
	if (rc)
	{
	log_error (_("key \"%s\" not found: %s\n"), answer,
	gpg_strerror (rc));
	xfree (answer);
	continue;
	}

	xfree (answer);

	fingerprint_from_pk (revoker_pk, revkey.fpr, &fprlen);
	if (fprlen != 20)
	{
	log_error (_("cannot appoint a PGP 2.x style key as a "
	"designated revoker\n"));
	continue;
	}

	revkey.class = 0x80;
	if (sensitive)
	revkey.class \|= 0x40;
	revkey.algid = revoker_pk->pubkey_algo;

	if (cmp_public_keys (revoker_pk, pk) == 0)
	{
	/* This actually causes no harm (after all, a key that
	designates itself as a revoker is the same as a
	regular key), but it's easy enough to check. */
	log_error (_("you cannot appoint a key as its own "
	"designated revoker\n"));

	continue;
	}

	keyid_from_pk (pk, NULL);

	/* Does this revkey already exist? */
	if (!pk->revkey && pk->numrevkeys)
	BUG ();
	else
	{
	int i;

	for (i = 0; i < pk->numrevkeys; i++)
	{
	if (memcmp (&pk->revkey[i], &revkey,
	sizeof (struct revocation_key)) == 0)
	{
	char buf[50];

	log_error (_("this key has already been designated "
	"as a revoker\n"));

	format_keyid (pk_keyid (pk), KF_LONG, buf, sizeof (buf));
	write_status_text (STATUS_ALREADY_SIGNED, buf);

	break;
	}
	}

	if (i < pk->numrevkeys)
	continue;
	}

	print_pubkey_info (NULL, revoker_pk);
	print_fingerprint (NULL, revoker_pk, 2);
	tty_printf ("\n");

	tty_printf (_("WARNING: appointing a key as a designated revoker "
	"cannot be undone!\n"));

	tty_printf ("\n");

	if (!cpr_get_answer_is_yes ("keyedit.add_revoker.okay",
	_("Are you sure you want to appoint this "
	"key as a designated revoker? (y/N) ")))
	continue;

	free_public_key (revoker_pk);
	revoker_pk = NULL;
	break;
	}

	rc = make_keysig_packet (&sig, pk, NULL, NULL, pk, 0x1F, 0, 0, 0,
	keygen_add_revkey, &revkey, NULL);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error ("signing failed: %s\n", gpg_strerror (rc));
	goto fail;
	}

	/* Insert into public keyblock. */
	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (pub_keyblock, new_kbnode (pkt), PKT_SIGNATURE);

	return 1;

	fail:
	if (sig)
	free_seckey_enc (sig);
	free_public_key (revoker_pk);

	return 0;
	}


	/* With FORCE_MAINKEY cleared this function handles the interactive
	* menu option "expire". With FORCE_MAINKEY set this functions only
	* sets the expiration date of the primary key to NEWEXPIRATION and
	* avoid all interactivity. Retirns 0 if nothing was done,
	* GPG_ERR_TRUE if the key was modified, or any other error code. */
	static gpg_error_t
	menu_expire (kbnode_t pub_keyblock, int force_mainkey, u32 newexpiration)
	{
	int signumber, rc;
	u32 expiredate;
	int mainkey = 0;
	PKT_public_key main_pk, sub_pk;
	PKT_user_id *uid;
	kbnode_t node;
	u32 keyid[2];

	if (force_mainkey)
	{
	mainkey = 1;
	expiredate = newexpiration;
	}
	else
	{
	int n1 = count_selected_keys (pub_keyblock);
	if (n1 > 1)
	{
	if (!cpr_get_answer_is_yes
	("keyedit.expire_multiple_subkeys.okay",
	_("Are you sure you want to change the"
	" expiration time for multiple subkeys? (y/N) ")))
	return gpg_error (GPG_ERR_CANCELED);;
	}
	else if (n1)
	tty_printf (_("Changing expiration time for a subkey.\n"));
	else
	{
	tty_printf (_("Changing expiration time for the primary key.\n"));
	mainkey = 1;
	no_primary_warning (pub_keyblock);
	}

	expiredate = ask_expiredate ();
	}


	/* Now we can actually change the self-signature(s) */
	main_pk = sub_pk = NULL;
	uid = NULL;
	signumber = 0;
	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	main_pk->expiredate = expiredate;
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	if ((node->flag & NODFLG_SELKEY) && !force_mainkey)
	{
	sub_pk = node->pkt->pkt.public_key;
	sub_pk->expiredate = expiredate;
	}
	else
	sub_pk = NULL;
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	uid = node->pkt->pkt.user_id;
	else if (main_pk && node->pkt->pkttype == PKT_SIGNATURE
	&& (mainkey \|\| sub_pk))
	{
	PKT_signature *sig = node->pkt->pkt.signature;

	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& ((mainkey && uid
	&& uid->created && (sig->sig_class & ~3) == 0x10)
	\|\| (!mainkey && sig->sig_class == 0x18))
	&& sig->flags.chosen_selfsig)
	{
	/* This is a self-signature which is to be replaced. */
	PKT_signature *newsig;
	PACKET *newpkt;

	signumber++;

	if ((mainkey && main_pk->version < 4)
	\|\| (!mainkey && sub_pk->version < 4))
	{
	log_info
	(_("You can't change the expiration date of a v3 key\n"));
	return gpg_error (GPG_ERR_LEGACY_KEY);
	}

	if (mainkey)
	rc = update_keysig_packet (&newsig, sig, main_pk, uid, NULL,
	main_pk, keygen_add_key_expire,
	main_pk);
	else
	rc =
	update_keysig_packet (&newsig, sig, main_pk, NULL, sub_pk,
	main_pk, keygen_add_key_expire, sub_pk);
	if (rc)
	{
	log_error ("make_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	if (gpg_err_code (rc) == GPG_ERR_TRUE)
	rc = GPG_ERR_GENERAL;
	return rc;
	}

	/* Replace the packet. */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	sub_pk = NULL;
	}
	}
	}

	update_trust = 1;
	return gpg_error (GPG_ERR_TRUE);
	}


	/* Change the capability of a selected key. This command should only
	* be used to rectify badly created keys and as such is not suggested
	* for general use. */
	static int
	menu_changeusage (kbnode_t keyblock)
	{
	int n1, rc;
	int mainkey = 0;
	PKT_public_key main_pk, sub_pk;
	PKT_user_id *uid;
	kbnode_t node;
	u32 keyid[2];

	n1 = count_selected_keys (keyblock);
	if (n1 > 1)
	{
	tty_printf (_("You must select exactly one key.\n"));
	return 0;
	}
	else if (n1)
	tty_printf ("Changing usage of a subkey.\n");
	else
	{
	tty_printf ("Changing usage of the primary key.\n");
	mainkey = 1;
	}

	/* Now we can actually change the self-signature(s) */
	main_pk = sub_pk = NULL;
	uid = NULL;
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	if (node->flag & NODFLG_SELKEY)
	sub_pk = node->pkt->pkt.public_key;
	else
	sub_pk = NULL;
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	uid = node->pkt->pkt.user_id;
	else if (main_pk && node->pkt->pkttype == PKT_SIGNATURE
	&& (mainkey \|\| sub_pk))
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& ((mainkey && uid
	&& uid->created && (sig->sig_class & ~3) == 0x10)
	\|\| (!mainkey && sig->sig_class == 0x18))
	&& sig->flags.chosen_selfsig)
	{
	/* This is the self-signature which is to be replaced. */
	PKT_signature *newsig;
	PACKET *newpkt;

	if ((mainkey && main_pk->version < 4)
	\|\| (!mainkey && sub_pk->version < 4))
	{
	log_info ("You can't change the capabilities of a v3 key\n");
	return 0;
	}

	if (mainkey)
	main_pk->pubkey_usage = ask_key_flags (main_pk->pubkey_algo, 0,
	main_pk->pubkey_usage);
	else
	sub_pk->pubkey_usage = ask_key_flags (sub_pk->pubkey_algo, 1,
	sub_pk->pubkey_usage);

	if (mainkey)
	rc = update_keysig_packet (&newsig, sig, main_pk, uid, NULL,
	main_pk, keygen_add_key_flags,
	main_pk);
	else
	rc =
	update_keysig_packet (&newsig, sig, main_pk, NULL, sub_pk,
	main_pk, keygen_add_key_flags, sub_pk);
	if (rc)
	{
	log_error ("make_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	return 0;
	}

	/* Replace the packet. */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	sub_pk = NULL;
	break;
	}
	}
	}

	return 1;
	}


	static int
	menu_backsign (KBNODE pub_keyblock)
	{
	int rc, modified = 0;
	PKT_public_key *main_pk;
	KBNODE node;
	u32 timestamp;

	log_assert (pub_keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	merge_keys_and_selfsig (pub_keyblock);
	main_pk = pub_keyblock->pkt->pkt.public_key;
	keyid_from_pk (main_pk, NULL);

	/* We use the same timestamp for all backsigs so that we don't
	reveal information about the used machine. */
	timestamp = make_timestamp ();

	for (node = pub_keyblock; node; node = node->next)
	{
	PKT_public_key *sub_pk = NULL;
	KBNODE node2, sig_pk = NULL /,sig_sk = NULL/;
	/* char passphrase; /

	/* Find a signing subkey with no backsig */
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	if (node->pkt->pkt.public_key->pubkey_usage & PUBKEY_USAGE_SIG)
	{
	if (node->pkt->pkt.public_key->flags.backsig)
	tty_printf (_
	("signing subkey %s is already cross-certified\n"),
	keystr_from_pk (node->pkt->pkt.public_key));
	else
	sub_pk = node->pkt->pkt.public_key;
	}
	else
	tty_printf (_("subkey %s does not sign and so does"
	" not need to be cross-certified\n"),
	keystr_from_pk (node->pkt->pkt.public_key));
	}

	if (!sub_pk)
	continue;

	/* Find the selected selfsig on this subkey */
	for (node2 = node->next;
	node2 && node2->pkt->pkttype == PKT_SIGNATURE; node2 = node2->next)
	if (node2->pkt->pkt.signature->version >= 4
	&& node2->pkt->pkt.signature->flags.chosen_selfsig)
	{
	sig_pk = node2;
	break;
	}

	if (!sig_pk)
	continue;

	/* Find the secret subkey that matches the public subkey */
	log_debug ("FIXME: Check whether a secret subkey is available.\n");
	/* if (!sub_sk) */
	/* { */
	/* tty_printf (_("no secret subkey for public subkey %s - ignoring\n"), */
	/* keystr_from_pk (sub_pk)); */
	/* continue; */
	/* } */


	/* Now we can get to work. */

	rc = make_backsig (sig_pk->pkt->pkt.signature, main_pk, sub_pk, sub_pk,
	timestamp, NULL);
	if (!rc)
	{
	PKT_signature *newsig;
	PACKET *newpkt;

	rc = update_keysig_packet (&newsig, sig_pk->pkt->pkt.signature,
	main_pk, NULL, sub_pk, main_pk,
	NULL, NULL);
	if (!rc)
	{
	/* Put the new sig into place on the pubkey */
	newpkt = xmalloc_clear (sizeof (*newpkt));
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (sig_pk->pkt);
	xfree (sig_pk->pkt);
	sig_pk->pkt = newpkt;

	modified = 1;
	}
	else
	{
	log_error ("update_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	break;
	}
	}
	else
	{
	log_error ("make_backsig failed: %s\n", gpg_strerror (rc));
	break;
	}
	}

	return modified;
	}


	static int
	change_primary_uid_cb (PKT_signature * sig, void *opaque)
	{
	byte buf[1];

	/* first clear all primary uid flags so that we are sure none are
	* lingering around */
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID);
	delete_sig_subpkt (sig->unhashed, SIGSUBPKT_PRIMARY_UID);

	/* if opaque is set,we want to set the primary id */
	if (opaque)
	{
	buf[0] = 1;
	build_sig_subpkt (sig, SIGSUBPKT_PRIMARY_UID, buf, 1);
	}

	return 0;
	}


	/*
	* Set the primary uid flag for the selected UID. We will also reset
	* all other primary uid flags. For this to work with have to update
	* all the signature timestamps. If we would do this with the current
	- * time, we lose quite a lot of information, so we use a a kludge to
	+ * time, we lose quite a lot of information, so we use a kludge to
	* do this: Just increment the timestamp by one second which is
	* sufficient to updated a signature during import.
	*/
	static int
	menu_set_primary_uid (KBNODE pub_keyblock)
	{
	PKT_public_key *main_pk;
	PKT_user_id *uid;
	KBNODE node;
	u32 keyid[2];
	int selected;
	int attribute = 0;
	int modified = 0;

	if (count_selected_uids (pub_keyblock) != 1)
	{
	tty_printf (_("Please select exactly one user ID.\n"));
	return 0;
	}

	main_pk = NULL;
	uid = NULL;
	selected = 0;

	/* Is our selected uid an attribute packet? */
	for (node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && node->flag & NODFLG_SELUID)
	attribute = (node->pkt->pkt.user_id->attrib_data != NULL);

	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break; /* No more user ids expected - ready. */

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid = node->pkt->pkt.user_id;
	selected = node->flag & NODFLG_SELUID;
	}
	else if (main_pk && uid && node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& (uid && (sig->sig_class & ~3) == 0x10)
	&& attribute == (uid->attrib_data != NULL)
	&& sig->flags.chosen_selfsig)
	{
	if (sig->version < 4)
	{
	char *user =
	utf8_to_native (uid->name, strlen (uid->name), 0);

	log_info (_("skipping v3 self-signature on user ID \"%s\"\n"),
	user);
	xfree (user);
	}
	else
	{
	/* This is a selfsignature which is to be replaced.
	We can just ignore v3 signatures because they are
	not able to carry the primary ID flag. We also
	ignore self-sigs on user IDs that are not of the
	same type that we are making primary. That is, if
	we are making a user ID primary, we alter user IDs.
	If we are making an attribute packet primary, we
	alter attribute packets. */

	/* FIXME: We must make sure that we only have one
	self-signature per user ID here (not counting
	revocations) */
	PKT_signature *newsig;
	PACKET *newpkt;
	const byte *p;
	int action;

	/* See whether this signature has the primary UID flag. */
	p = parse_sig_subpkt (sig->hashed,
	SIGSUBPKT_PRIMARY_UID, NULL);
	if (!p)
	p = parse_sig_subpkt (sig->unhashed,
	SIGSUBPKT_PRIMARY_UID, NULL);
	if (p && p) / yes */
	action = selected ? 0 : -1;
	else /* no */
	action = selected ? 1 : 0;

	if (action)
	{
	int rc = update_keysig_packet (&newsig, sig,
	main_pk, uid, NULL,
	main_pk,
	change_primary_uid_cb,
	action > 0 ? "x" : NULL);
	if (rc)
	{
	log_error ("update_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	return 0;
	}
	/* replace the packet */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	modified = 1;
	}
	}
	}
	}
	}

	return modified;
	}


	/*
	* Set preferences to new values for the selected user IDs
	*/
	static int
	menu_set_preferences (KBNODE pub_keyblock)
	{
	PKT_public_key *main_pk;
	PKT_user_id *uid;
	KBNODE node;
	u32 keyid[2];
	int selected, select_all;
	int modified = 0;

	no_primary_warning (pub_keyblock);

	select_all = !count_selected_uids (pub_keyblock);

	/* Now we can actually change the self signature(s) */
	main_pk = NULL;
	uid = NULL;
	selected = 0;
	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break; /* No more user-ids expected - ready. */

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid = node->pkt->pkt.user_id;
	selected = select_all \|\| (node->flag & NODFLG_SELUID);
	}
	else if (main_pk && uid && selected
	&& node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& (uid && (sig->sig_class & ~3) == 0x10)
	&& sig->flags.chosen_selfsig)
	{
	if (sig->version < 4)
	{
	char *user =
	utf8_to_native (uid->name, strlen (uid->name), 0);

	log_info (_("skipping v3 self-signature on user ID \"%s\"\n"),
	user);
	xfree (user);
	}
	else
	{
	/* This is a selfsignature which is to be replaced
	* We have to ignore v3 signatures because they are
	* not able to carry the preferences. */
	PKT_signature *newsig;
	PACKET *newpkt;
	int rc;

	rc = update_keysig_packet (&newsig, sig,
	main_pk, uid, NULL, main_pk,
	keygen_upd_std_prefs, NULL);
	if (rc)
	{
	log_error ("update_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	return 0;
	}
	/* replace the packet */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	modified = 1;
	}
	}
	}
	}

	return modified;
	}


	static int
	menu_set_keyserver_url (const char *url, KBNODE pub_keyblock)
	{
	PKT_public_key *main_pk;
	PKT_user_id *uid;
	KBNODE node;
	u32 keyid[2];
	int selected, select_all;
	int modified = 0;
	char answer, uri;

	no_primary_warning (pub_keyblock);

	if (url)
	answer = xstrdup (url);
	else
	{
	answer = cpr_get_utf8 ("keyedit.add_keyserver",
	_("Enter your preferred keyserver URL: "));
	if (answer[0] == '\0' \|\| answer[0] == CONTROL_D)
	{
	xfree (answer);
	return 0;
	}
	}

	if (ascii_strcasecmp (answer, "none") == 0)
	uri = NULL;
	else
	{
	struct keyserver_spec *keyserver = NULL;
	/* Sanity check the format */
	keyserver = parse_keyserver_uri (answer, 1);
	xfree (answer);
	if (!keyserver)
	{
	log_info (_("could not parse keyserver URL\n"));
	return 0;
	}
	uri = xstrdup (keyserver->uri);
	free_keyserver_spec (keyserver);
	}

	select_all = !count_selected_uids (pub_keyblock);

	/* Now we can actually change the self signature(s) */
	main_pk = NULL;
	uid = NULL;
	selected = 0;
	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break; /* ready */

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid = node->pkt->pkt.user_id;
	selected = select_all \|\| (node->flag & NODFLG_SELUID);
	}
	else if (main_pk && uid && selected
	&& node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& (uid && (sig->sig_class & ~3) == 0x10)
	&& sig->flags.chosen_selfsig)
	{
	char *user = utf8_to_native (uid->name, strlen (uid->name), 0);
	if (sig->version < 4)
	log_info (_("skipping v3 self-signature on user ID \"%s\"\n"),
	user);
	else
	{
	/* This is a selfsignature which is to be replaced
	* We have to ignore v3 signatures because they are
	* not able to carry the subpacket. */
	PKT_signature *newsig;
	PACKET *newpkt;
	int rc;
	const byte *p;
	size_t plen;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_KS, &plen);
	if (p && plen)
	{
	tty_printf ("Current preferred keyserver for user"
	" ID \"%s\": ", user);
	tty_print_utf8_string (p, plen);
	tty_printf ("\n");
	if (!cpr_get_answer_is_yes
	("keyedit.confirm_keyserver",
	uri
	? _("Are you sure you want to replace it? (y/N) ")
	: _("Are you sure you want to delete it? (y/N) ")))
	continue;
	}
	else if (uri == NULL)
	{
	/* There is no current keyserver URL, so there
	is no point in trying to un-set it. */
	continue;
	}

	rc = update_keysig_packet (&newsig, sig,
	main_pk, uid, NULL,
	main_pk,
	keygen_add_keyserver_url, uri);
	if (rc)
	{
	log_error ("update_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	xfree (uri);
	return 0;
	}
	/* replace the packet */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	modified = 1;
	}

	xfree (user);
	}
	}
	}

	xfree (uri);
	return modified;
	}

	static int
	menu_set_notation (const char *string, KBNODE pub_keyblock)
	{
	PKT_public_key *main_pk;
	PKT_user_id *uid;
	KBNODE node;
	u32 keyid[2];
	int selected, select_all;
	int modified = 0;
	char *answer;
	struct notation *notation;

	no_primary_warning (pub_keyblock);

	if (string)
	answer = xstrdup (string);
	else
	{
	answer = cpr_get_utf8 ("keyedit.add_notation",
	_("Enter the notation: "));
	if (answer[0] == '\0' \|\| answer[0] == CONTROL_D)
	{
	xfree (answer);
	return 0;
	}
	}

	if (!ascii_strcasecmp (answer, "none")
	\|\| !ascii_strcasecmp (answer, "-"))
	notation = NULL; /* Delete them all. */
	else
	{
	notation = string_to_notation (answer, 0);
	if (!notation)
	{
	xfree (answer);
	return 0;
	}
	}

	xfree (answer);

	select_all = !count_selected_uids (pub_keyblock);

	/* Now we can actually change the self signature(s) */
	main_pk = NULL;
	uid = NULL;
	selected = 0;
	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	break; /* ready */

	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	main_pk = node->pkt->pkt.public_key;
	keyid_from_pk (main_pk, keyid);
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid = node->pkt->pkt.user_id;
	selected = select_all \|\| (node->flag & NODFLG_SELUID);
	}
	else if (main_pk && uid && selected
	&& node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
	&& (uid && (sig->sig_class & ~3) == 0x10)
	&& sig->flags.chosen_selfsig)
	{
	char *user = utf8_to_native (uid->name, strlen (uid->name), 0);
	if (sig->version < 4)
	log_info (_("skipping v3 self-signature on user ID \"%s\"\n"),
	user);
	else
	{
	PKT_signature *newsig;
	PACKET *newpkt;
	int rc, skip = 0, addonly = 1;

	if (sig->flags.notation)
	{
	tty_printf ("Current notations for user ID \"%s\":\n",
	user);
	tty_print_notations (-9, sig);
	}
	else
	{
	tty_printf ("No notations on user ID \"%s\"\n", user);
	if (notation == NULL)
	{
	/* There are no current notations, so there
	is no point in trying to un-set them. */
	continue;
	}
	}

	if (notation)
	{
	struct notation *n;
	int deleting = 0;

	notation->next = sig_to_notation (sig);

	for (n = notation->next; n; n = n->next)
	if (strcmp (n->name, notation->name) == 0)
	{
	if (notation->value)
	{
	if (strcmp (n->value, notation->value) == 0)
	{
	if (notation->flags.ignore)
	{
	/* Value match with a delete
	flag. */
	n->flags.ignore = 1;
	deleting = 1;
	}
	else
	{
	/* Adding the same notation
	twice, so don't add it at
	all. */
	skip = 1;
	tty_printf ("Skipping notation:"
	" %s=%s\n",
	notation->name,
	notation->value);
	break;
	}
	}
	}
	else
	{
	/* No value, so it means delete. */
	n->flags.ignore = 1;
	deleting = 1;
	}

	if (n->flags.ignore)
	{
	tty_printf ("Removing notation: %s=%s\n",
	n->name, n->value);
	addonly = 0;
	}
	}

	if (!notation->flags.ignore && !skip)
	tty_printf ("Adding notation: %s=%s\n",
	notation->name, notation->value);

	/* We tried to delete, but had no matches. */
	if (notation->flags.ignore && !deleting)
	continue;
	}
	else
	{
	tty_printf ("Removing all notations\n");
	addonly = 0;
	}

	if (skip
	\|\| (!addonly
	&&
	!cpr_get_answer_is_yes ("keyedit.confirm_notation",
	_("Proceed? (y/N) "))))
	continue;

	rc = update_keysig_packet (&newsig, sig,
	main_pk, uid, NULL,
	main_pk,
	keygen_add_notations, notation);
	if (rc)
	{
	log_error ("update_keysig_packet failed: %s\n",
	gpg_strerror (rc));
	free_notation (notation);
	xfree (user);
	return 0;
	}

	/* replace the packet */
	newpkt = xmalloc_clear (sizeof *newpkt);
	newpkt->pkttype = PKT_SIGNATURE;
	newpkt->pkt.signature = newsig;
	free_packet (node->pkt);
	xfree (node->pkt);
	node->pkt = newpkt;
	modified = 1;

	if (notation)
	{
	/* Snip off the notation list from the sig */
	free_notation (notation->next);
	notation->next = NULL;
	}

	xfree (user);
	}
	}
	}
	}

	free_notation (notation);
	return modified;
	}


	/*
	* Select one user id or remove all selection if IDX is 0 or select
	* all if IDX is -1. Returns: True if the selection changed.
	*/
	static int
	menu_select_uid (KBNODE keyblock, int idx)
	{
	KBNODE node;
	int i;

	if (idx == -1) /* Select all. */
	{
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID)
	node->flag \|= NODFLG_SELUID;
	return 1;
	}
	else if (idx) /* Toggle. */
	{
	for (i = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	if (++i == idx)
	break;
	}
	if (!node)
	{
	tty_printf (_("No user ID with index %d\n"), idx);
	return 0;
	}

	for (i = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (++i == idx)
	{
	if ((node->flag & NODFLG_SELUID))
	node->flag &= ~NODFLG_SELUID;
	else
	node->flag \|= NODFLG_SELUID;
	}
	}
	}
	}
	else /* Unselect all */
	{
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID)
	node->flag &= ~NODFLG_SELUID;
	}

	return 1;
	}


	/* Search in the keyblock for a uid that matches namehash */
	static int
	menu_select_uid_namehash (KBNODE keyblock, const char *namehash)
	{
	byte hash[NAMEHASH_LEN];
	KBNODE node;
	int i;

	log_assert (strlen (namehash) == NAMEHASH_LEN * 2);

	for (i = 0; i < NAMEHASH_LEN; i++)
	hash[i] = hextobyte (&namehash[i * 2]);

	for (node = keyblock->next; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	namehash_from_uid (node->pkt->pkt.user_id);
	if (memcmp (node->pkt->pkt.user_id->namehash, hash, NAMEHASH_LEN) ==
	0)
	{
	if (node->flag & NODFLG_SELUID)
	node->flag &= ~NODFLG_SELUID;
	else
	node->flag \|= NODFLG_SELUID;

	break;
	}
	}
	}

	if (!node)
	{
	tty_printf (_("No user ID with hash %s\n"), namehash);
	return 0;
	}

	return 1;
	}


	/*
	* Select secondary keys
	* Returns: True if the selection changed.
	*/
	static int
	menu_select_key (KBNODE keyblock, int idx, char *p)
	{
	KBNODE node;
	int i, j;
	int is_hex_digits;

	is_hex_digits = p && strlen (p) >= 8;
	if (is_hex_digits)
	{
	/* Skip initial spaces. */
	while (spacep (p))
	p ++;
	/* If the id starts with 0x accept and ignore it. */
	if (p[0] == '0' && p[1] == 'x')
	p += 2;

	for (i = 0, j = 0; p[i]; i ++)
	if (hexdigitp (&p[i]))
	{
	p[j] = toupper (p[i]);
	j ++;
	}
	else if (spacep (&p[i]))
	/* Skip spaces. */
	{
	}
	else
	{
	is_hex_digits = 0;
	break;
	}
	if (is_hex_digits)
	/* In case we skipped some spaces, add a new NUL terminator. */
	{
	p[j] = 0;
	/* If we skipped some spaces, make sure that we still have
	at least 8 characters. */
	is_hex_digits = (/* Short keyid. */
	strlen (p) == 8
	/* Long keyid. */
	\|\| strlen (p) == 16
	/* Fingerprints are (currently) 32 or 40
	characters. */
	\|\| strlen (p) >= 32);
	}
	}

	if (is_hex_digits)
	{
	int found_one = 0;
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	int match = 0;
	if (strlen (p) == 8 \|\| strlen (p) == 16)
	{
	u32 kid[2];
	char kid_str[17];
	keyid_from_pk (node->pkt->pkt.public_key, kid);
	format_keyid (kid, strlen (p) == 8 ? KF_SHORT : KF_LONG,
	kid_str, sizeof (kid_str));

	if (strcmp (p, kid_str) == 0)
	match = 1;
	}
	else
	{
	char fp[2*MAX_FINGERPRINT_LEN + 1];
	hexfingerprint (node->pkt->pkt.public_key, fp, sizeof (fp));
	if (strcmp (fp, p) == 0)
	match = 1;
	}

	if (match)
	{
	if ((node->flag & NODFLG_SELKEY))
	node->flag &= ~NODFLG_SELKEY;
	else
	node->flag \|= NODFLG_SELKEY;

	found_one = 1;
	}
	}

	if (found_one)
	return 1;

	tty_printf (_("No subkey with key ID '%s'.\n"), p);
	return 0;
	}

	if (idx == -1) /* Select all. */
	{
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	node->flag \|= NODFLG_SELKEY;
	}
	else if (idx) /* Toggle selection. */
	{
	for (i = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	if (++i == idx)
	break;
	}
	if (!node)
	{
	tty_printf (_("No subkey with index %d\n"), idx);
	return 0;
	}

	for (i = 0, node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	if (++i == idx)
	{
	if ((node->flag & NODFLG_SELKEY))
	node->flag &= ~NODFLG_SELKEY;
	else
	node->flag \|= NODFLG_SELKEY;
	}
	}
	}
	else /* Unselect all. */
	{
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	node->flag &= ~NODFLG_SELKEY;
	}

	return 1;
	}


	static int
	count_uids_with_flag (KBNODE keyblock, unsigned flag)
	{
	KBNODE node;
	int i = 0;

	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && (node->flag & flag))
	i++;
	return i;
	}


	static int
	count_keys_with_flag (KBNODE keyblock, unsigned flag)
	{
	KBNODE node;
	int i = 0;

	for (node = keyblock; node; node = node->next)
	if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY) && (node->flag & flag))
	i++;
	return i;
	}


	static int
	count_uids (KBNODE keyblock)
	{
	KBNODE node;
	int i = 0;

	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID)
	i++;
	return i;
	}


	/*
	* Returns true if there is at least one selected user id
	*/
	static int
	count_selected_uids (KBNODE keyblock)
	{
	return count_uids_with_flag (keyblock, NODFLG_SELUID);
	}


	static int
	count_selected_keys (KBNODE keyblock)
	{
	return count_keys_with_flag (keyblock, NODFLG_SELKEY);
	}


	/* Returns how many real (i.e. not attribute) uids are unmarked. */
	static int
	real_uids_left (KBNODE keyblock)
	{
	KBNODE node;
	int real = 0;

	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && !(node->flag & NODFLG_SELUID) &&
	!node->pkt->pkt.user_id->attrib_data)
	real++;

	return real;
	}


	/*
	* Ask whether the signature should be revoked. If the user commits this,
	* flag bit MARK_A is set on the signature and the user ID.
	*/
	static void
	ask_revoke_sig (KBNODE keyblock, KBNODE node)
	{
	int doit = 0;
	PKT_user_id *uid;
	PKT_signature *sig = node->pkt->pkt.signature;
	KBNODE unode = find_prev_kbnode (keyblock, node, PKT_USER_ID);

	if (!unode)
	{
	log_error ("Oops: no user ID for signature\n");
	return;
	}

	uid = unode->pkt->pkt.user_id;

	if (opt.with_colons)
	{
	if (uid->attrib_data)
	printf ("uat:::::::::%u %lu", uid->numattribs, uid->attrib_len);
	else
	{
	es_printf ("uid:::::::::");
	es_write_sanitized (es_stdout, uid->name, uid->len, ":", NULL);
	}

	es_printf ("\n");

	print_and_check_one_sig_colon (keyblock, node, NULL, NULL, NULL, NULL,
	1);
	}
	else
	{
	char *p = utf8_to_native (unode->pkt->pkt.user_id->name,
	unode->pkt->pkt.user_id->len, 0);
	tty_printf (_("user ID: \"%s\"\n"), p);
	xfree (p);

	tty_printf (_("signed by your key %s on %s%s%s\n"),
	keystr (sig->keyid), datestr_from_sig (sig),
	sig->flags.exportable ? "" : _(" (non-exportable)"), "");
	}
	if (sig->flags.expired)
	{
	tty_printf (_("This signature expired on %s.\n"),
	expirestr_from_sig (sig));
	/* Use a different question so we can have different help text */
	doit = cpr_get_answer_is_yes
	("ask_revoke_sig.expired",
	_("Are you sure you still want to revoke it? (y/N) "));
	}
	else
	doit = cpr_get_answer_is_yes
	("ask_revoke_sig.one",
	_("Create a revocation certificate for this signature? (y/N) "));

	if (doit)
	{
	node->flag \|= NODFLG_MARK_A;
	unode->flag \|= NODFLG_MARK_A;
	}
	}


	/*
	* Display all user ids of the current public key together with signatures
	* done by one of our keys. Then walk over all this sigs and ask the user
	* whether he wants to revoke this signature.
	* Return: True when the keyblock has changed.
	*/
	static int
	menu_revsig (KBNODE keyblock)
	{
	PKT_signature *sig;
	PKT_public_key *primary_pk;
	KBNODE node;
	int changed = 0;
	int rc, any, skip = 1, all = !count_selected_uids (keyblock);
	struct revocation_reason_info *reason = NULL;

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* First check whether we have any signatures at all. */
	any = 0;
	for (node = keyblock; node; node = node->next)
	{
	node->flag &= ~(NODFLG_SELSIG \| NODFLG_MARK_A);
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (node->flag & NODFLG_SELUID \|\| all)
	skip = 0;
	else
	skip = 1;
	}
	else if (!skip && node->pkt->pkttype == PKT_SIGNATURE
	&& ((sig = node->pkt->pkt.signature),
	have_secret_key_with_kid (sig->keyid)))
	{
	if ((sig->sig_class & ~3) == 0x10)
	{
	any = 1;
	break;
	}
	}
	}

	if (!any)
	{
	tty_printf (_("Not signed by you.\n"));
	return 0;
	}


	/* FIXME: detect duplicates here */
	tty_printf (_("You have signed these user IDs on key %s:\n"),
	keystr_from_pk (keyblock->pkt->pkt.public_key));
	for (node = keyblock; node; node = node->next)
	{
	node->flag &= ~(NODFLG_SELSIG \| NODFLG_MARK_A);
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (node->flag & NODFLG_SELUID \|\| all)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	/* Hmmm: Should we show only UIDs with a signature? */
	tty_printf (" ");
	tty_print_utf8_string (uid->name, uid->len);
	tty_printf ("\n");
	skip = 0;
	}
	else
	skip = 1;
	}
	else if (!skip && node->pkt->pkttype == PKT_SIGNATURE
	&& ((sig = node->pkt->pkt.signature),
	have_secret_key_with_kid (sig->keyid)))
	{
	if ((sig->sig_class & ~3) == 0x10)
	{
	tty_printf (" ");
	tty_printf (_("signed by your key %s on %s%s%s\n"),
	keystr (sig->keyid), datestr_from_sig (sig),
	sig->flags.exportable ? "" : _(" (non-exportable)"),
	sig->flags.revocable ? "" : _(" (non-revocable)"));
	if (sig->flags.revocable)
	node->flag \|= NODFLG_SELSIG;
	}
	else if (sig->sig_class == 0x30)
	{
	tty_printf (" ");
	tty_printf (_("revoked by your key %s on %s\n"),
	keystr (sig->keyid), datestr_from_sig (sig));
	}
	}
	}

	tty_printf ("\n");

	/* ask */
	for (node = keyblock; node; node = node->next)
	{
	if (!(node->flag & NODFLG_SELSIG))
	continue;
	ask_revoke_sig (keyblock, node);
	}

	/* present selected */
	any = 0;
	for (node = keyblock; node; node = node->next)
	{
	if (!(node->flag & NODFLG_MARK_A))
	continue;
	if (!any)
	{
	any = 1;
	tty_printf (_("You are about to revoke these signatures:\n"));
	}
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	tty_printf (" ");
	tty_print_utf8_string (uid->name, uid->len);
	tty_printf ("\n");
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	sig = node->pkt->pkt.signature;
	tty_printf (" ");
	tty_printf (_("signed by your key %s on %s%s%s\n"),
	keystr (sig->keyid), datestr_from_sig (sig), "",
	sig->flags.exportable ? "" : _(" (non-exportable)"));
	}
	}
	if (!any)
	return 0; /* none selected */

	if (!cpr_get_answer_is_yes
	("ask_revoke_sig.okay",
	_("Really create the revocation certificates? (y/N) ")))
	return 0; /* forget it */

	reason = ask_revocation_reason (0, 1, 0);
	if (!reason)
	{ /* user decided to cancel */
	return 0;
	}

	/* now we can sign the user ids */
	reloop: /* (must use this, because we are modifing the list) */
	primary_pk = keyblock->pkt->pkt.public_key;
	for (node = keyblock; node; node = node->next)
	{
	KBNODE unode;
	PACKET *pkt;
	struct sign_attrib attrib;
	PKT_public_key *signerkey;

	if (!(node->flag & NODFLG_MARK_A)
	\|\| node->pkt->pkttype != PKT_SIGNATURE)
	continue;
	unode = find_prev_kbnode (keyblock, node, PKT_USER_ID);
	log_assert (unode); /* we already checked this */

	memset (&attrib, 0, sizeof attrib);
	attrib.reason = reason;
	attrib.non_exportable = !node->pkt->pkt.signature->flags.exportable;

	node->flag &= ~NODFLG_MARK_A;
	signerkey = xmalloc_secure_clear (sizeof *signerkey);
	if (get_seckey (signerkey, node->pkt->pkt.signature->keyid))
	{
	log_info (_("no secret key\n"));
	free_public_key (signerkey);
	continue;
	}
	rc = make_keysig_packet (&sig, primary_pk,
	unode->pkt->pkt.user_id,
	NULL, signerkey, 0x30, 0, 0, 0,
	sign_mk_attrib, &attrib, NULL);
	free_public_key (signerkey);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error (_("signing failed: %s\n"), gpg_strerror (rc));
	release_revocation_reason_info (reason);
	return changed;
	}
	changed = 1; /* we changed the keyblock */
	update_trust = 1;
	/* Are we revoking our own uid? */
	if (primary_pk->keyid[0] == sig->keyid[0] &&
	primary_pk->keyid[1] == sig->keyid[1])
	unode->pkt->pkt.user_id->is_revoked = 1;
	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (unode, new_kbnode (pkt), 0);
	goto reloop;
	}

	release_revocation_reason_info (reason);
	return changed;
	}


	/* return 0 if revocation of NODE (which must be a User ID) was
	successful, non-zero if there was an error. *modified will be set
	to 1 if a change was made. */
	static int
	core_revuid (ctrl_t ctrl, kbnode_t keyblock, KBNODE node,
	const struct revocation_reason_info reason, int modified)
	{
	PKT_public_key *pk = keyblock->pkt->pkt.public_key;
	gpg_error_t rc;

	if (node->pkt->pkttype != PKT_USER_ID)
	{
	rc = gpg_error (GPG_ERR_NO_USER_ID);
	write_status_error ("keysig", rc);
	log_error (_("tried to revoke a non-user ID: %s\n"), gpg_strerror (rc));
	return 1;
	}
	else
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;

	if (uid->is_revoked)
	{
	char *user = utf8_to_native (uid->name, uid->len, 0);
	log_info (_("user ID \"%s\" is already revoked\n"), user);
	xfree (user);
	}
	else
	{
	PACKET *pkt;
	PKT_signature *sig;
	struct sign_attrib attrib;
	u32 timestamp = make_timestamp ();

	if (uid->created >= timestamp)
	{
	/* Okay, this is a problem. The user ID selfsig was
	created in the future, so we need to warn the user and
	set our revocation timestamp one second after that so
	everything comes out clean. */

	log_info (_("WARNING: a user ID signature is dated %d"
	" seconds in the future\n"),
	uid->created - timestamp);

	timestamp = uid->created + 1;
	}

	memset (&attrib, 0, sizeof attrib);
	/* should not need to cast away const here; but
	revocation_reason_build_cb needs to take a non-const
	void* in order to meet the function signtuare for the
	mksubpkt argument to make_keysig_packet */
	attrib.reason = (struct revocation_reason_info *)reason;

	rc = make_keysig_packet (&sig, pk, uid, NULL, pk, 0x30, 0,
	timestamp, 0,
	sign_mk_attrib, &attrib, NULL);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error (_("signing failed: %s\n"), gpg_strerror (rc));
	return 1;
	}
	else
	{
	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (node, new_kbnode (pkt), 0);

	#ifndef NO_TRUST_MODELS
	/* If the trustdb has an entry for this key+uid then the
	trustdb needs an update. */
	if (!update_trust
	&& ((get_validity (ctrl, keyblock, pk, uid, NULL, 0)
	& TRUST_MASK)
	>= TRUST_UNDEFINED))
	update_trust = 1;
	#endif /!NO_TRUST_MODELS/

	node->pkt->pkt.user_id->is_revoked = 1;
	if (modified)
	*modified = 1;
	}
	}
	return 0;
	}
	}

	/* Revoke a user ID (i.e. revoke a user ID selfsig). Return true if
	keyblock changed. */
	static int
	menu_revuid (ctrl_t ctrl, kbnode_t pub_keyblock)
	{
	PKT_public_key *pk = pub_keyblock->pkt->pkt.public_key;
	KBNODE node;
	int changed = 0;
	int rc;
	struct revocation_reason_info *reason = NULL;

	/* Note that this is correct as per the RFCs, but nevertheless
	somewhat meaningless in the real world. 1991 did define the 0x30
	sig class, but PGP 2.x did not actually implement it, so it would
	probably be safe to use v4 revocations everywhere. -ds */

	for (node = pub_keyblock; node; node = node->next)
	if (pk->version > 3 \|\| (node->pkt->pkttype == PKT_USER_ID &&
	node->pkt->pkt.user_id->selfsigversion > 3))
	{
	if ((reason = ask_revocation_reason (0, 1, 4)))
	break;
	else
	goto leave;
	}

	reloop: /* (better this way because we are modifying the keyring) */
	for (node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && (node->flag & NODFLG_SELUID))
	{
	int modified = 0;
	rc = core_revuid (ctrl, pub_keyblock, node, reason, &modified);
	if (rc)
	goto leave;
	if (modified)
	{
	node->flag &= ~NODFLG_SELUID;
	changed = 1;
	goto reloop;
	}
	}

	if (changed)
	commit_kbnode (&pub_keyblock);

	leave:
	release_revocation_reason_info (reason);
	return changed;
	}


	/*
	* Revoke the whole key.
	*/
	static int
	menu_revkey (KBNODE pub_keyblock)
	{
	PKT_public_key *pk = pub_keyblock->pkt->pkt.public_key;
	int rc, changed = 0;
	struct revocation_reason_info *reason;
	PACKET *pkt;
	PKT_signature *sig;

	if (pk->flags.revoked)
	{
	tty_printf (_("Key %s is already revoked.\n"), keystr_from_pk (pk));
	return 0;
	}

	reason = ask_revocation_reason (1, 0, 0);
	/* user decided to cancel */
	if (!reason)
	return 0;

	rc = make_keysig_packet (&sig, pk, NULL, NULL, pk,
	0x20, 0, 0, 0,
	revocation_reason_build_cb, reason, NULL);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error (_("signing failed: %s\n"), gpg_strerror (rc));
	goto scram;
	}

	changed = 1; /* we changed the keyblock */

	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (pub_keyblock, new_kbnode (pkt), 0);
	commit_kbnode (&pub_keyblock);

	update_trust = 1;

	scram:
	release_revocation_reason_info (reason);
	return changed;
	}


	static int
	menu_revsubkey (KBNODE pub_keyblock)
	{
	PKT_public_key *mainpk;
	KBNODE node;
	int changed = 0;
	int rc;
	struct revocation_reason_info *reason = NULL;

	reason = ask_revocation_reason (1, 0, 0);
	if (!reason)
	return 0; /* User decided to cancel. */

	reloop: /* (better this way because we are modifing the keyring) */
	mainpk = pub_keyblock->pkt->pkt.public_key;
	for (node = pub_keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& (node->flag & NODFLG_SELKEY))
	{
	PACKET *pkt;
	PKT_signature *sig;
	PKT_public_key *subpk = node->pkt->pkt.public_key;
	struct sign_attrib attrib;

	if (subpk->flags.revoked)
	{
	tty_printf (_("Subkey %s is already revoked.\n"),
	keystr_from_pk (subpk));
	continue;
	}

	memset (&attrib, 0, sizeof attrib);
	attrib.reason = reason;

	node->flag &= ~NODFLG_SELKEY;
	rc = make_keysig_packet (&sig, mainpk, NULL, subpk, mainpk,
	0x28, 0, 0, 0, sign_mk_attrib, &attrib,
	NULL);
	if (rc)
	{
	write_status_error ("keysig", rc);
	log_error (_("signing failed: %s\n"), gpg_strerror (rc));
	release_revocation_reason_info (reason);
	return changed;
	}
	changed = 1; /* we changed the keyblock */

	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	insert_kbnode (node, new_kbnode (pkt), 0);
	goto reloop;
	}
	}
	commit_kbnode (&pub_keyblock);

	/* No need to set update_trust here since signing keys no longer
	are used to certify other keys, so there is no change in trust
	when revoking/removing them */

	release_revocation_reason_info (reason);
	return changed;
	}


	/* Note that update_ownertrust is going to mark the trustdb dirty when
	enabling or disabling a key. This is arguably sub-optimal as
	disabled keys are still counted in the web of trust, but perhaps
	not worth adding extra complexity to change. -ds */
	#ifndef NO_TRUST_MODELS
	static int
	enable_disable_key (KBNODE keyblock, int disable)
	{
	PKT_public_key *pk =
	find_kbnode (keyblock, PKT_PUBLIC_KEY)->pkt->pkt.public_key;
	unsigned int trust, newtrust;

	trust = newtrust = get_ownertrust (pk);
	newtrust &= ~TRUST_FLAG_DISABLED;
	if (disable)
	newtrust \|= TRUST_FLAG_DISABLED;
	if (trust == newtrust)
	return 0; /* already in that state */
	update_ownertrust (pk, newtrust);
	return 0;
	}
	#endif /!NO_TRUST_MODELS/


	static void
	menu_showphoto (ctrl_t ctrl, kbnode_t keyblock)
	{
	KBNODE node;
	int select_all = !count_selected_uids (keyblock);
	int count = 0;
	PKT_public_key *pk = NULL;

	/* Look for the public key first. We have to be really, really,
	explicit as to which photo this is, and what key it is a UID on
	since people may want to sign it. */

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	pk = node->pkt->pkt.public_key;
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	count++;

	if ((select_all \|\| (node->flag & NODFLG_SELUID)) &&
	uid->attribs != NULL)
	{
	int i;

	for (i = 0; i < uid->numattribs; i++)
	{
	byte type;
	u32 size;

	if (uid->attribs[i].type == ATTRIB_IMAGE &&
	parse_image_header (&uid->attribs[i], &type, &size))
	{
	tty_printf (_("Displaying %s photo ID of size %ld for "
	"key %s (uid %d)\n"),
	image_type_to_string (type, 1),
	(ulong) size, keystr_from_pk (pk), count);
	show_photos (ctrl, &uid->attribs[i], 1, pk, uid);
	}
	}
	}
	}
	}
	}
	diff --git a/g10/keygen.c b/g10/keygen.c
	index e2bdfc144..844d38d3a 100644
	--- a/g10/keygen.c
	+++ b/g10/keygen.c
	@@ -1,5338 +1,5338 @@
	/* keygen.c - Generate a key pair
	* Copyright (C) 1998-2007, 2009-2011 Free Software Foundation, Inc.
	* Copyright (C) 2014, 2015, 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <errno.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <unistd.h>

	#include "gpg.h"
	#include "util.h"
	#include "main.h"
	#include "packet.h"
	#include "ttyio.h"
	#include "options.h"
	#include "keydb.h"
	#include "trustdb.h"
	#include "status.h"
	#include "i18n.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "pkglue.h"
	#include "../common/shareddefs.h"
	#include "host2net.h"
	#include "mbox-util.h"


	/* The default algorithms. If you change them remember to change them
	also in gpg.c:gpgconf_list. You should also check that the value
	is inside the bounds enforced by ask_keysize and gen_xxx. See also
	get_keysize_range which encodes the allowed ranges. */
	#define DEFAULT_STD_KEY_PARAM "rsa2048/cert,sign+rsa2048/encr"
	#define FUTURE_STD_KEY_PARAM "ed25519/cert,sign+cv25519/encr"

	/* When generating keys using the streamlined key generation dialog,
	use this as a default expiration interval. */
	const char *default_expiration_interval = "2y";

	/* Flag bits used during key generation. */
	#define KEYGEN_FLAG_NO_PROTECTION 1
	#define KEYGEN_FLAG_TRANSIENT_KEY 2

	/* Maximum number of supported algorithm preferences. */
	#define MAX_PREFS 30

	enum para_name {
	pKEYTYPE,
	pKEYLENGTH,
	pKEYCURVE,
	pKEYUSAGE,
	pSUBKEYTYPE,
	pSUBKEYLENGTH,
	pSUBKEYCURVE,
	pSUBKEYUSAGE,
	pAUTHKEYTYPE,
	pNAMEREAL,
	pNAMEEMAIL,
	pNAMECOMMENT,
	pPREFERENCES,
	pREVOKER,
	pUSERID,
	pCREATIONDATE,
	pKEYCREATIONDATE, /* Same in seconds since epoch. */
	pEXPIREDATE,
	pKEYEXPIRE, /* in n seconds */
	pSUBKEYEXPIRE, /* in n seconds */
	pPASSPHRASE,
	pSERIALNO,
	pCARDBACKUPKEY,
	pHANDLE,
	pKEYSERVER,
	pKEYGRIP
	};

	struct para_data_s {
	struct para_data_s *next;
	int lnr;
	enum para_name key;
	union {
	u32 expire;
	u32 creation;
	unsigned int usage;
	struct revocation_key revkey;
	char value[1];
	} u;
	};

	struct output_control_s
	{
	int lnr;
	int dryrun;
	unsigned int keygen_flags;
	int use_files;
	struct {
	char *fname;
	char *newfname;
	IOBUF stream;
	armor_filter_context_t *afx;
	} pub;
	};


	struct opaque_data_usage_and_pk {
	unsigned int usage;
	PKT_public_key *pk;
	};


	static int prefs_initialized = 0;
	static byte sym_prefs[MAX_PREFS];
	static int nsym_prefs;
	static byte hash_prefs[MAX_PREFS];
	static int nhash_prefs;
	static byte zip_prefs[MAX_PREFS];
	static int nzip_prefs;
	static int mdc_available,ks_modify;

	static gpg_error_t parse_algo_usage_expire (ctrl_t ctrl, int for_subkey,
	const char algostr, const char usagestr,
	const char *expirestr,
	int r_algo, unsigned int r_usage,
	u32 *r_expire,
	unsigned int r_nbits, char *r_curve);
	static void do_generate_keypair (ctrl_t ctrl, struct para_data_s *para,
	struct output_control_s *outctrl, int card );
	static int write_keyblock (iobuf_t out, kbnode_t node);
	static gpg_error_t gen_card_key (int keyno, int algo, int is_primary,
	kbnode_t pub_root, u32 *timestamp,
	u32 expireval);
	static unsigned int get_keysize_range (int algo,
	unsigned int min, unsigned int max);



	/* Return the algo string for a default new key. */
	const char *
	get_default_pubkey_algo (void)
	{
	if (opt.def_new_key_algo)
	{
	if (*opt.def_new_key_algo && !strchr (opt.def_new_key_algo, ':'))
	return opt.def_new_key_algo;
	/* To avoid checking that option every time we delay that until
	* here. The only thing we really need to make sure is that
	* there is no colon in the string so that the --gpgconf-list
	* command won't mess up its output. */
	log_info (_("invalid value for option '%s'\n"), "--default-new-key-algo");
	}
	return DEFAULT_STD_KEY_PARAM;
	}


	static void
	print_status_key_created (int letter, PKT_public_key pk, const char handle)
	{
	byte array[MAX_FINGERPRINT_LEN], *s;
	char buf, p;
	size_t i, n;

	if (!handle)
	handle = "";

	buf = xmalloc (MAX_FINGERPRINT_LEN*2+31 + strlen (handle) + 1);

	p = buf;
	if (letter \|\| pk)
	{
	*p++ = letter;
	if (pk)
	{
	*p++ = ' ';
	fingerprint_from_pk (pk, array, &n);
	s = array;
	/* Fixme: Use bin2hex */
	for (i=0; i < n ; i++, s++, p += 2)
	snprintf (p, 3, "%02X", *s);
	}
	}
	if (*handle)
	{
	*p++ = ' ';
	for (i=0; handle[i] && i < 100; i++)
	*p++ = isspace ((unsigned int)handle[i])? '_':handle[i];
	}
	*p = 0;
	write_status_text ((letter \|\| pk)?STATUS_KEY_CREATED:STATUS_KEY_NOT_CREATED,
	buf);
	xfree (buf);
	}

	static void
	print_status_key_not_created (const char *handle)
	{
	print_status_key_created (0, NULL, handle);
	}



	static void
	write_uid( KBNODE root, const char *s )
	{
	PACKET pkt = xmalloc_clear(sizeof pkt );
	size_t n = strlen(s);

	pkt->pkttype = PKT_USER_ID;
	pkt->pkt.user_id = xmalloc_clear (sizeof *pkt->pkt.user_id + n);
	pkt->pkt.user_id->len = n;
	pkt->pkt.user_id->ref = 1;
	strcpy(pkt->pkt.user_id->name, s);
	add_kbnode( root, new_kbnode( pkt ) );
	}

	static void
	do_add_key_flags (PKT_signature *sig, unsigned int use)
	{
	byte buf[1];

	buf[0] = 0;

	/* The spec says that all primary keys MUST be able to certify. */
	if(sig->sig_class!=0x18)
	buf[0] \|= 0x01;

	if (use & PUBKEY_USAGE_SIG)
	buf[0] \|= 0x02;
	if (use & PUBKEY_USAGE_ENC)
	buf[0] \|= 0x04 \| 0x08;
	if (use & PUBKEY_USAGE_AUTH)
	buf[0] \|= 0x20;

	build_sig_subpkt (sig, SIGSUBPKT_KEY_FLAGS, buf, 1);
	}


	int
	keygen_add_key_expire (PKT_signature sig, void opaque)
	{
	PKT_public_key *pk = opaque;
	byte buf[8];
	u32 u;

	if (pk->expiredate)
	{
	if (pk->expiredate > pk->timestamp)
	u = pk->expiredate - pk->timestamp;
	else
	u = 1;

	buf[0] = (u >> 24) & 0xff;
	buf[1] = (u >> 16) & 0xff;
	buf[2] = (u >> 8) & 0xff;
	buf[3] = u & 0xff;
	build_sig_subpkt (sig, SIGSUBPKT_KEY_EXPIRE, buf, 4);
	}
	else
	{
	/* Make sure we don't leave a key expiration subpacket lying
	around */
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE);
	}

	return 0;
	}


	/* Add the key usage (i.e. key flags) in SIG from the public keys
	* pubkey_usage field. OPAQUE has the public key. */
	int
	keygen_add_key_flags (PKT_signature sig, void opaque)
	{
	PKT_public_key *pk = opaque;

	do_add_key_flags (sig, pk->pubkey_usage);
	return 0;
	}


	static int
	keygen_add_key_flags_and_expire (PKT_signature sig, void opaque)
	{
	struct opaque_data_usage_and_pk *oduap = opaque;

	do_add_key_flags (sig, oduap->usage);
	return keygen_add_key_expire (sig, oduap->pk);
	}


	static int
	set_one_pref (int val, int type, const char item, byte buf, int *nbuf)
	{
	int i;

	for (i=0; i < *nbuf; i++ )
	if (buf[i] == val)
	{
	log_info (_("preference '%s' duplicated\n"), item);
	return -1;
	}

	if (*nbuf >= MAX_PREFS)
	{
	if(type==1)
	log_info(_("too many cipher preferences\n"));
	else if(type==2)
	log_info(_("too many digest preferences\n"));
	else if(type==3)
	log_info(_("too many compression preferences\n"));
	else
	BUG();

	return -1;
	}

	buf[(*nbuf)++] = val;
	return 0;
	}

	/*
	* Parse the supplied string and use it to set the standard
	* preferences. The string may be in a form like the one printed by
	* "pref" (something like: "S10 S3 H3 H2 Z2 Z1") or the actual
	* cipher/hash/compress names. Use NULL to set the default
	* preferences. Returns: 0 = okay
	*/
	int
	keygen_set_std_prefs (const char *string,int personal)
	{
	byte sym[MAX_PREFS], hash[MAX_PREFS], zip[MAX_PREFS];
	int nsym=0, nhash=0, nzip=0, val, rc=0;
	int mdc=1, modify=0; /* mdc defaults on, modify defaults off. */
	char dummy_string[204+1]; / Enough for 20 items. */

	if (!string \|\| !ascii_strcasecmp (string, "default"))
	{
	if (opt.def_preference_list)
	string=opt.def_preference_list;
	else
	{
	int any_compress = 0;
	dummy_string[0]='\0';

	/* The rationale why we use the order AES256,192,128 is
	for compatibility reasons with PGP. If gpg would
	define AES128 first, we would get the somewhat
	confusing situation:

	gpg -r pgpkey -r gpgkey ---gives--> AES256
	gpg -r gpgkey -r pgpkey ---gives--> AES

	Note that by using --personal-cipher-preferences it is
	possible to prefer AES128.
	*/

	/* Make sure we do not add more than 15 items here, as we
	could overflow the size of dummy_string. We currently
	have at most 12. */
	if ( !openpgp_cipher_test_algo (CIPHER_ALGO_AES256) )
	strcat(dummy_string,"S9 ");
	if ( !openpgp_cipher_test_algo (CIPHER_ALGO_AES192) )
	strcat(dummy_string,"S8 ");
	if ( !openpgp_cipher_test_algo (CIPHER_ALGO_AES) )
	strcat(dummy_string,"S7 ");
	strcat(dummy_string,"S2 "); /* 3DES */

	/* The default hash algo order is:
	SHA-256, SHA-384, SHA-512, SHA-224, SHA-1.
	*/
	if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
	strcat (dummy_string, "H8 ");

	if (!openpgp_md_test_algo (DIGEST_ALGO_SHA384))
	strcat (dummy_string, "H9 ");

	if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
	strcat (dummy_string, "H10 ");

	if (!openpgp_md_test_algo (DIGEST_ALGO_SHA224))
	strcat (dummy_string, "H11 ");

	strcat (dummy_string, "H2 "); /* SHA-1 */

	if(!check_compress_algo(COMPRESS_ALGO_ZLIB))
	{
	strcat(dummy_string,"Z2 ");
	any_compress = 1;
	}

	if(!check_compress_algo(COMPRESS_ALGO_BZIP2))
	{
	strcat(dummy_string,"Z3 ");
	any_compress = 1;
	}

	if(!check_compress_algo(COMPRESS_ALGO_ZIP))
	{
	strcat(dummy_string,"Z1 ");
	any_compress = 1;
	}

	/* In case we have no compress algo at all, declare that
	we prefer no compresssion. */
	if (!any_compress)
	strcat(dummy_string,"Z0 ");

	/* Remove the trailing space. */
	if (*dummy_string && dummy_string[strlen (dummy_string)-1] == ' ')
	dummy_string[strlen (dummy_string)-1] = 0;

	string=dummy_string;
	}
	}
	else if (!ascii_strcasecmp (string, "none"))
	string = "";

	if(strlen(string))
	{
	char *prefstringbuf;
	char tok, prefstring;

	/* We need a writable string. */
	prefstring = prefstringbuf = xstrdup (string);

	while((tok=strsep(&prefstring," ,")))
	{
	if((val=string_to_cipher_algo (tok)))
	{
	if(set_one_pref(val,1,tok,sym,&nsym))
	rc=-1;
	}
	else if((val=string_to_digest_algo (tok)))
	{
	if(set_one_pref(val,2,tok,hash,&nhash))
	rc=-1;
	}
	else if((val=string_to_compress_algo(tok))>-1)
	{
	if(set_one_pref(val,3,tok,zip,&nzip))
	rc=-1;
	}
	else if (ascii_strcasecmp(tok,"mdc")==0)
	mdc=1;
	else if (ascii_strcasecmp(tok,"no-mdc")==0)
	mdc=0;
	else if (ascii_strcasecmp(tok,"ks-modify")==0)
	modify=1;
	else if (ascii_strcasecmp(tok,"no-ks-modify")==0)
	modify=0;
	else
	{
	log_info (_("invalid item '%s' in preference string\n"),tok);
	rc=-1;
	}
	}

	xfree (prefstringbuf);
	}

	if(!rc)
	{
	if(personal)
	{
	if(personal==PREFTYPE_SYM)
	{
	xfree(opt.personal_cipher_prefs);

	if(nsym==0)
	opt.personal_cipher_prefs=NULL;
	else
	{
	int i;

	opt.personal_cipher_prefs=
	xmalloc(sizeof(prefitem_t )(nsym+1));

	for (i=0; i<nsym; i++)
	{
	opt.personal_cipher_prefs[i].type = PREFTYPE_SYM;
	opt.personal_cipher_prefs[i].value = sym[i];
	}

	opt.personal_cipher_prefs[i].type = PREFTYPE_NONE;
	opt.personal_cipher_prefs[i].value = 0;
	}
	}
	else if(personal==PREFTYPE_HASH)
	{
	xfree(opt.personal_digest_prefs);

	if(nhash==0)
	opt.personal_digest_prefs=NULL;
	else
	{
	int i;

	opt.personal_digest_prefs=
	xmalloc(sizeof(prefitem_t )(nhash+1));

	for (i=0; i<nhash; i++)
	{
	opt.personal_digest_prefs[i].type = PREFTYPE_HASH;
	opt.personal_digest_prefs[i].value = hash[i];
	}

	opt.personal_digest_prefs[i].type = PREFTYPE_NONE;
	opt.personal_digest_prefs[i].value = 0;
	}
	}
	else if(personal==PREFTYPE_ZIP)
	{
	xfree(opt.personal_compress_prefs);

	if(nzip==0)
	opt.personal_compress_prefs=NULL;
	else
	{
	int i;

	opt.personal_compress_prefs=
	xmalloc(sizeof(prefitem_t )(nzip+1));

	for (i=0; i<nzip; i++)
	{
	opt.personal_compress_prefs[i].type = PREFTYPE_ZIP;
	opt.personal_compress_prefs[i].value = zip[i];
	}

	opt.personal_compress_prefs[i].type = PREFTYPE_NONE;
	opt.personal_compress_prefs[i].value = 0;
	}
	}
	}
	else
	{
	memcpy (sym_prefs, sym, (nsym_prefs=nsym));
	memcpy (hash_prefs, hash, (nhash_prefs=nhash));
	memcpy (zip_prefs, zip, (nzip_prefs=nzip));
	mdc_available = mdc;
	ks_modify = modify;
	prefs_initialized = 1;
	}
	}

	return rc;
	}

	/* Return a fake user ID containing the preferences. Caller must
	free. */
	PKT_user_id *
	keygen_get_std_prefs(void)
	{
	int i,j=0;
	PKT_user_id *uid=xmalloc_clear(sizeof(PKT_user_id));

	if(!prefs_initialized)
	keygen_set_std_prefs(NULL,0);

	uid->ref=1;

	uid->prefs=xmalloc((sizeof(prefitem_t )
	(nsym_prefs+nhash_prefs+nzip_prefs+1)));

	for(i=0;i<nsym_prefs;i++,j++)
	{
	uid->prefs[j].type=PREFTYPE_SYM;
	uid->prefs[j].value=sym_prefs[i];
	}

	for(i=0;i<nhash_prefs;i++,j++)
	{
	uid->prefs[j].type=PREFTYPE_HASH;
	uid->prefs[j].value=hash_prefs[i];
	}

	for(i=0;i<nzip_prefs;i++,j++)
	{
	uid->prefs[j].type=PREFTYPE_ZIP;
	uid->prefs[j].value=zip_prefs[i];
	}

	uid->prefs[j].type=PREFTYPE_NONE;
	uid->prefs[j].value=0;

	uid->flags.mdc=mdc_available;
	uid->flags.ks_modify=ks_modify;

	return uid;
	}

	static void
	add_feature_mdc (PKT_signature *sig,int enabled)
	{
	const byte *s;
	size_t n;
	int i;
	char *buf;

	s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_FEATURES, &n );
	/* Already set or cleared */
	if (s && n &&
	((enabled && (s[0] & 0x01)) \|\| (!enabled && !(s[0] & 0x01))))
	return;

	if (!s \|\| !n) { /* create a new one */
	n = 1;
	buf = xmalloc_clear (n);
	}
	else {
	buf = xmalloc (n);
	memcpy (buf, s, n);
	}

	if(enabled)
	buf[0] \|= 0x01; /* MDC feature */
	else
	buf[0] &= ~0x01;

	/* Are there any bits set? */
	for(i=0;i<n;i++)
	if(buf[i]!=0)
	break;

	if(i==n)
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_FEATURES);
	else
	build_sig_subpkt (sig, SIGSUBPKT_FEATURES, buf, n);

	xfree (buf);
	}

	static void
	add_keyserver_modify (PKT_signature *sig,int enabled)
	{
	const byte *s;
	size_t n;
	int i;
	char *buf;

	/* The keyserver modify flag is a negative flag (i.e. no-modify) */
	enabled=!enabled;

	s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KS_FLAGS, &n );
	/* Already set or cleared */
	if (s && n &&
	((enabled && (s[0] & 0x80)) \|\| (!enabled && !(s[0] & 0x80))))
	return;

	if (!s \|\| !n) { /* create a new one */
	n = 1;
	buf = xmalloc_clear (n);
	}
	else {
	buf = xmalloc (n);
	memcpy (buf, s, n);
	}

	if(enabled)
	buf[0] \|= 0x80; /* no-modify flag */
	else
	buf[0] &= ~0x80;

	/* Are there any bits set? */
	for(i=0;i<n;i++)
	if(buf[i]!=0)
	break;

	if(i==n)
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_KS_FLAGS);
	else
	build_sig_subpkt (sig, SIGSUBPKT_KS_FLAGS, buf, n);

	xfree (buf);
	}


	int
	keygen_upd_std_prefs (PKT_signature sig, void opaque)
	{
	(void)opaque;

	if (!prefs_initialized)
	keygen_set_std_prefs (NULL, 0);

	if (nsym_prefs)
	build_sig_subpkt (sig, SIGSUBPKT_PREF_SYM, sym_prefs, nsym_prefs);
	else
	{
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_SYM);
	delete_sig_subpkt (sig->unhashed, SIGSUBPKT_PREF_SYM);
	}

	if (nhash_prefs)
	build_sig_subpkt (sig, SIGSUBPKT_PREF_HASH, hash_prefs, nhash_prefs);
	else
	{
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_HASH);
	delete_sig_subpkt (sig->unhashed, SIGSUBPKT_PREF_HASH);
	}

	if (nzip_prefs)
	build_sig_subpkt (sig, SIGSUBPKT_PREF_COMPR, zip_prefs, nzip_prefs);
	else
	{
	delete_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_COMPR);
	delete_sig_subpkt (sig->unhashed, SIGSUBPKT_PREF_COMPR);
	}

	/* Make sure that the MDC feature flag is set if needed. */
	add_feature_mdc (sig,mdc_available);
	add_keyserver_modify (sig,ks_modify);
	keygen_add_keyserver_url(sig,NULL);

	return 0;
	}


	/****************
	* Add preference to the self signature packet.
	* This is only called for packets with version > 3.
	*/
	int
	keygen_add_std_prefs (PKT_signature sig, void opaque)
	{
	PKT_public_key *pk = opaque;

	do_add_key_flags (sig, pk->pubkey_usage);
	keygen_add_key_expire (sig, opaque );
	keygen_upd_std_prefs (sig, opaque);
	keygen_add_keyserver_url (sig,NULL);

	return 0;
	}

	int
	keygen_add_keyserver_url(PKT_signature sig, void opaque)
	{
	const char *url=opaque;

	if(!url)
	url=opt.def_keyserver_url;

	if(url)
	build_sig_subpkt(sig,SIGSUBPKT_PREF_KS,url,strlen(url));
	else
	delete_sig_subpkt (sig->hashed,SIGSUBPKT_PREF_KS);

	return 0;
	}

	int
	keygen_add_notations(PKT_signature sig,void opaque)
	{
	struct notation *notation;

	/* We always start clean */
	delete_sig_subpkt(sig->hashed,SIGSUBPKT_NOTATION);
	delete_sig_subpkt(sig->unhashed,SIGSUBPKT_NOTATION);
	sig->flags.notation=0;

	for(notation=opaque;notation;notation=notation->next)
	if(!notation->flags.ignore)
	{
	unsigned char *buf;
	unsigned int n1,n2;

	n1=strlen(notation->name);
	if(notation->altvalue)
	n2=strlen(notation->altvalue);
	else if(notation->bdat)
	n2=notation->blen;
	else
	n2=strlen(notation->value);

	buf = xmalloc( 8 + n1 + n2 );

	/* human readable or not */
	buf[0] = notation->bdat?0:0x80;
	buf[1] = buf[2] = buf[3] = 0;
	buf[4] = n1 >> 8;
	buf[5] = n1;
	buf[6] = n2 >> 8;
	buf[7] = n2;
	memcpy(buf+8, notation->name, n1 );
	if(notation->altvalue)
	memcpy(buf+8+n1, notation->altvalue, n2 );
	else if(notation->bdat)
	memcpy(buf+8+n1, notation->bdat, n2 );
	else
	memcpy(buf+8+n1, notation->value, n2 );
	build_sig_subpkt( sig, SIGSUBPKT_NOTATION \|
	(notation->flags.critical?SIGSUBPKT_FLAG_CRITICAL:0),
	buf, 8+n1+n2 );
	xfree(buf);
	}

	return 0;
	}

	int
	keygen_add_revkey (PKT_signature sig, void opaque)
	{
	struct revocation_key *revkey = opaque;
	byte buf[2+MAX_FINGERPRINT_LEN];

	buf[0] = revkey->class;
	buf[1] = revkey->algid;
	memcpy (&buf[2], revkey->fpr, MAX_FINGERPRINT_LEN);

	build_sig_subpkt (sig, SIGSUBPKT_REV_KEY, buf, 2+MAX_FINGERPRINT_LEN);

	/* All sigs with revocation keys set are nonrevocable. */
	sig->flags.revocable = 0;
	buf[0] = 0;
	build_sig_subpkt (sig, SIGSUBPKT_REVOCABLE, buf, 1);

	parse_revkeys (sig);

	return 0;
	}



	/* Create a back-signature. If TIMESTAMP is not NULL, use it for the
	signature creation time. */
	gpg_error_t
	make_backsig (PKT_signature sig, PKT_public_key pk,
	PKT_public_key sub_pk, PKT_public_key sub_psk,
	u32 timestamp, const char *cache_nonce)
	{
	gpg_error_t err;
	PKT_signature *backsig;

	cache_public_key (sub_pk);

	err = make_keysig_packet (&backsig, pk, NULL, sub_pk, sub_psk, 0x19,
	0, timestamp, 0, NULL, NULL, cache_nonce);
	if (err)
	log_error ("make_keysig_packet failed for backsig: %s\n",
	gpg_strerror (err));
	else
	{
	/* Get it into a binary packed form. */
	IOBUF backsig_out = iobuf_temp();
	PACKET backsig_pkt;

	init_packet (&backsig_pkt);
	backsig_pkt.pkttype = PKT_SIGNATURE;
	backsig_pkt.pkt.signature = backsig;
	err = build_packet (backsig_out, &backsig_pkt);
	free_packet (&backsig_pkt);
	if (err)
	log_error ("build_packet failed for backsig: %s\n", gpg_strerror (err));
	else
	{
	size_t pktlen = 0;
	byte *buf = iobuf_get_temp_buffer (backsig_out);

	/* Remove the packet header. */
	if(buf[0]&0x40)
	{
	if (buf[1] < 192)
	{
	pktlen = buf[1];
	buf += 2;
	}
	else if(buf[1] < 224)
	{
	pktlen = (buf[1]-192)*256;
	pktlen += buf[2]+192;
	buf += 3;
	}
	else if (buf[1] == 255)
	{
	pktlen = buf32_to_size_t (buf+2);
	buf += 6;
	}
	else
	BUG ();
	}
	else
	{
	int mark = 1;

	switch (buf[0]&3)
	{
	case 3:
	BUG ();
	break;

	case 2:
	pktlen = (size_t)buf[mark++] << 24;
	pktlen \|= buf[mark++] << 16;

	case 1:
	pktlen \|= buf[mark++] << 8;

	case 0:
	pktlen \|= buf[mark++];
	}

	buf += mark;
	}

	/* Now make the binary blob into a subpacket. */
	build_sig_subpkt (sig, SIGSUBPKT_SIGNATURE, buf, pktlen);

	iobuf_close (backsig_out);
	}
	}

	return err;
	}


	/* Write a direct key signature to the first key in ROOT using the key
	PSK. REVKEY is describes the direct key signature and TIMESTAMP is
	the timestamp to set on the signature. */
	static gpg_error_t
	write_direct_sig (KBNODE root, PKT_public_key *psk,
	struct revocation_key *revkey, u32 timestamp,
	const char *cache_nonce)
	{
	gpg_error_t err;
	PACKET *pkt;
	PKT_signature *sig;
	KBNODE node;
	PKT_public_key *pk;

	if (opt.verbose)
	log_info (_("writing direct signature\n"));

	/* Get the pk packet from the pub_tree. */
	node = find_kbnode (root, PKT_PUBLIC_KEY);
	if (!node)
	BUG ();
	pk = node->pkt->pkt.public_key;

	/* We have to cache the key, so that the verification of the
	signature creation is able to retrieve the public key. */
	cache_public_key (pk);

	/* Make the signature. */
	err = make_keysig_packet (&sig, pk, NULL,NULL, psk, 0x1F,
	0, timestamp, 0,
	keygen_add_revkey, revkey, cache_nonce);
	if (err)
	{
	log_error ("make_keysig_packet failed: %s\n", gpg_strerror (err) );
	return err;
	}

	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	add_kbnode (root, new_kbnode (pkt));
	return err;
	}



	/* Write a self-signature to the first user id in ROOT using the key
	PSK. USE and TIMESTAMP give the extra data we need for the
	signature. */
	static gpg_error_t
	write_selfsigs (KBNODE root, PKT_public_key *psk,
	unsigned int use, u32 timestamp, const char *cache_nonce)
	{
	gpg_error_t err;
	PACKET *pkt;
	PKT_signature *sig;
	PKT_user_id *uid;
	KBNODE node;
	PKT_public_key *pk;

	if (opt.verbose)
	log_info (_("writing self signature\n"));

	/* Get the uid packet from the list. */
	node = find_kbnode (root, PKT_USER_ID);
	if (!node)
	BUG(); /* No user id packet in tree. */
	uid = node->pkt->pkt.user_id;

	/* Get the pk packet from the pub_tree. */
	node = find_kbnode (root, PKT_PUBLIC_KEY);
	if (!node)
	BUG();
	pk = node->pkt->pkt.public_key;

	/* The usage has not yet been set - do it now. */
	pk->pubkey_usage = use;

	/* We have to cache the key, so that the verification of the
	signature creation is able to retrieve the public key. */
	cache_public_key (pk);

	/* Make the signature. */
	err = make_keysig_packet (&sig, pk, uid, NULL, psk, 0x13,
	0, timestamp, 0,
	keygen_add_std_prefs, pk, cache_nonce);
	if (err)
	{
	log_error ("make_keysig_packet failed: %s\n", gpg_strerror (err));
	return err;
	}

	pkt = xmalloc_clear (sizeof *pkt);
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	add_kbnode (root, new_kbnode (pkt));

	return err;
	}


	/* Write the key binding signature. If TIMESTAMP is not NULL use the
	signature creation time. PRI_PSK is the key use for signing.
	SUB_PSK is a key used to create a back-signature; that one is only
	used if USE has the PUBKEY_USAGE_SIG capability. */
	static int
	write_keybinding (KBNODE root, PKT_public_key pri_psk, PKT_public_key sub_psk,
	unsigned int use, u32 timestamp, const char *cache_nonce)
	{
	gpg_error_t err;
	PACKET *pkt;
	PKT_signature *sig;
	KBNODE node;
	PKT_public_key pri_pk, sub_pk;
	struct opaque_data_usage_and_pk oduap;

	if (opt.verbose)
	log_info(_("writing key binding signature\n"));

	/* Get the primary pk packet from the tree. */
	node = find_kbnode (root, PKT_PUBLIC_KEY);
	if (!node)
	BUG();
	pri_pk = node->pkt->pkt.public_key;

	/* We have to cache the key, so that the verification of the
	* signature creation is able to retrieve the public key. */
	cache_public_key (pri_pk);

	/* Find the last subkey. */
	sub_pk = NULL;
	for (node = root; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	sub_pk = node->pkt->pkt.public_key;
	}
	if (!sub_pk)
	BUG();

	/* Make the signature. */
	oduap.usage = use;
	oduap.pk = sub_pk;
	err = make_keysig_packet (&sig, pri_pk, NULL, sub_pk, pri_psk, 0x18,
	0, timestamp, 0,
	keygen_add_key_flags_and_expire, &oduap,
	cache_nonce);
	if (err)
	{
	log_error ("make_keysig_packeto failed: %s\n", gpg_strerror (err));
	return err;
	}

	/* Make a backsig. */
	if (use & PUBKEY_USAGE_SIG)
	{
	err = make_backsig (sig, pri_pk, sub_pk, sub_psk, timestamp, cache_nonce);
	if (err)
	return err;
	}

	pkt = xmalloc_clear ( sizeof *pkt );
	pkt->pkttype = PKT_SIGNATURE;
	pkt->pkt.signature = sig;
	add_kbnode (root, new_kbnode (pkt) );
	return err;
	}


	static gpg_error_t
	ecckey_from_sexp (gcry_mpi_t *array, gcry_sexp_t sexp, int algo)
	{
	gpg_error_t err;
	gcry_sexp_t list, l2;
	char *curve = NULL;
	int i;
	const char *oidstr;
	unsigned int nbits;

	array[0] = NULL;
	array[1] = NULL;
	array[2] = NULL;

	list = gcry_sexp_find_token (sexp, "public-key", 0);
	if (!list)
	return gpg_error (GPG_ERR_INV_OBJ);
	l2 = gcry_sexp_cadr (list);
	gcry_sexp_release (list);
	list = l2;
	if (!list)
	return gpg_error (GPG_ERR_NO_OBJ);

	l2 = gcry_sexp_find_token (list, "curve", 0);
	if (!l2)
	{
	err = gpg_error (GPG_ERR_NO_OBJ);
	goto leave;
	}
	curve = gcry_sexp_nth_string (l2, 1);
	if (!curve)
	{
	err = gpg_error (GPG_ERR_NO_OBJ);
	goto leave;
	}
	gcry_sexp_release (l2);
	oidstr = openpgp_curve_to_oid (curve, &nbits);
	if (!oidstr)
	{
	/* That can't happen because we used one of the curves
	gpg_curve_to_oid knows about. */
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}
	err = openpgp_oid_from_str (oidstr, &array[0]);
	if (err)
	goto leave;

	l2 = gcry_sexp_find_token (list, "q", 0);
	if (!l2)
	{
	err = gpg_error (GPG_ERR_NO_OBJ);
	goto leave;
	}
	array[1] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
	gcry_sexp_release (l2);
	if (!array[1])
	{
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}
	gcry_sexp_release (list);

	if (algo == PUBKEY_ALGO_ECDH)
	{
	array[2] = pk_ecdh_default_params (nbits);
	if (!array[2])
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	leave:
	xfree (curve);
	if (err)
	{
	for (i=0; i < 3; i++)
	{
	gcry_mpi_release (array[i]);
	array[i] = NULL;
	}
	}
	return err;
	}


	/* Extract key parameters from SEXP and store them in ARRAY. ELEMS is
	a string where each character denotes a parameter name. TOPNAME is
	the name of the top element above the elements. */
	static int
	key_from_sexp (gcry_mpi_t *array, gcry_sexp_t sexp,
	const char topname, const char elems)
	{
	gcry_sexp_t list, l2;
	const char *s;
	int i, idx;
	int rc = 0;

	list = gcry_sexp_find_token (sexp, topname, 0);
	if (!list)
	return gpg_error (GPG_ERR_INV_OBJ);
	l2 = gcry_sexp_cadr (list);
	gcry_sexp_release (list);
	list = l2;
	if (!list)
	return gpg_error (GPG_ERR_NO_OBJ);

	for (idx=0,s=elems; *s; s++, idx++)
	{
	l2 = gcry_sexp_find_token (list, s, 1);
	if (!l2)
	{
	rc = gpg_error (GPG_ERR_NO_OBJ); /* required parameter not found */
	goto leave;
	}
	array[idx] = gcry_sexp_nth_mpi (l2, 1, GCRYMPI_FMT_USG);
	gcry_sexp_release (l2);
	if (!array[idx])
	{
	rc = gpg_error (GPG_ERR_INV_OBJ); /* required parameter invalid */
	goto leave;
	}
	}
	gcry_sexp_release (list);

	leave:
	if (rc)
	{
	for (i=0; i<idx; i++)
	{
	gcry_mpi_release (array[i]);
	array[i] = NULL;
	}
	gcry_sexp_release (list);
	}
	return rc;
	}


	/* Create a keyblock using the given KEYGRIP. ALGO is the OpenPGP
	algorithm of that keygrip. */
	static int
	do_create_from_keygrip (ctrl_t ctrl, int algo, const char *hexkeygrip,
	kbnode_t pub_root, u32 timestamp, u32 expireval,
	int is_subkey)
	{
	int err;
	PACKET *pkt;
	PKT_public_key *pk;
	gcry_sexp_t s_key;
	const char *algoelem;

	if (hexkeygrip[0] == '&')
	hexkeygrip++;

	switch (algo)
	{
	case PUBKEY_ALGO_RSA: algoelem = "ne"; break;
	case PUBKEY_ALGO_DSA: algoelem = "pqgy"; break;
	case PUBKEY_ALGO_ELGAMAL_E: algoelem = "pgy"; break;
	case PUBKEY_ALGO_ECDH:
	case PUBKEY_ALGO_ECDSA: algoelem = ""; break;
	case PUBKEY_ALGO_EDDSA: algoelem = ""; break;
	default: return gpg_error (GPG_ERR_INTERNAL);
	}


	/* Ask the agent for the public key matching HEXKEYGRIP. */
	{
	unsigned char *public;

	err = agent_readkey (ctrl, 0, hexkeygrip, &public);
	if (err)
	return err;
	err = gcry_sexp_sscan (&s_key, NULL,
	public, gcry_sexp_canon_len (public, 0, NULL, NULL));
	xfree (public);
	if (err)
	return err;
	}

	/* Build a public key packet. */
	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	{
	err = gpg_error_from_syserror ();
	gcry_sexp_release (s_key);
	return err;
	}

	pk->timestamp = timestamp;
	pk->version = 4;
	if (expireval)
	pk->expiredate = pk->timestamp + expireval;
	pk->pubkey_algo = algo;

	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH )
	err = ecckey_from_sexp (pk->pkey, s_key, algo);
	else
	err = key_from_sexp (pk->pkey, s_key, "public-key", algoelem);
	if (err)
	{
	log_error ("key_from_sexp failed: %s\n", gpg_strerror (err) );
	gcry_sexp_release (s_key);
	free_public_key (pk);
	return err;
	}
	gcry_sexp_release (s_key);

	pkt = xtrycalloc (1, sizeof *pkt);
	if (!pkt)
	{
	err = gpg_error_from_syserror ();
	free_public_key (pk);
	return err;
	}

	pkt->pkttype = is_subkey ? PKT_PUBLIC_SUBKEY : PKT_PUBLIC_KEY;
	pkt->pkt.public_key = pk;
	add_kbnode (pub_root, new_kbnode (pkt));

	return 0;
	}


	/* Common code for the key generation function gen_xxx. */
	static int
	common_gen (const char keyparms, int algo, const char algoelem,
	kbnode_t pub_root, u32 timestamp, u32 expireval, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	int err;
	PACKET *pkt;
	PKT_public_key *pk;
	gcry_sexp_t s_key;

	err = agent_genkey (NULL, cache_nonce_addr, passwd_nonce_addr, keyparms,
	!!(keygen_flags & KEYGEN_FLAG_NO_PROTECTION),
	passphrase,
	&s_key);
	if (err)
	{
	log_error ("agent_genkey failed: %s\n", gpg_strerror (err) );
	return err;
	}

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	{
	err = gpg_error_from_syserror ();
	gcry_sexp_release (s_key);
	return err;
	}

	pk->timestamp = timestamp;
	pk->version = 4;
	if (expireval)
	pk->expiredate = pk->timestamp + expireval;
	pk->pubkey_algo = algo;

	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH )
	err = ecckey_from_sexp (pk->pkey, s_key, algo);
	else
	err = key_from_sexp (pk->pkey, s_key, "public-key", algoelem);
	if (err)
	{
	log_error ("key_from_sexp failed: %s\n", gpg_strerror (err) );
	gcry_sexp_release (s_key);
	free_public_key (pk);
	return err;
	}
	gcry_sexp_release (s_key);

	pkt = xtrycalloc (1, sizeof *pkt);
	if (!pkt)
	{
	err = gpg_error_from_syserror ();
	free_public_key (pk);
	return err;
	}

	pkt->pkttype = is_subkey ? PKT_PUBLIC_SUBKEY : PKT_PUBLIC_KEY;
	pkt->pkt.public_key = pk;
	add_kbnode (pub_root, new_kbnode (pkt));

	return 0;
	}


	/*
	* Generate an Elgamal key.
	*/
	static int
	gen_elg (int algo, unsigned int nbits, KBNODE pub_root,
	u32 timestamp, u32 expireval, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	int err;
	char *keyparms;
	char nbitsstr[35];

	log_assert (is_ELGAMAL (algo));

	if (nbits < 1024)
	{
	nbits = 2048;
	log_info (_("keysize invalid; using %u bits\n"), nbits );
	}
	else if (nbits > 4096)
	{
	nbits = 4096;
	log_info (_("keysize invalid; using %u bits\n"), nbits );
	}

	if ((nbits % 32))
	{
	nbits = ((nbits + 31) / 32) * 32;
	log_info (_("keysize rounded up to %u bits\n"), nbits );
	}

	/* Note that we use transient-key only if no-protection has also
	been enabled. */
	snprintf (nbitsstr, sizeof nbitsstr, "%u", nbits);
	keyparms = xtryasprintf ("(genkey(%s(nbits %zu:%s)%s))",
	algo == GCRY_PK_ELG_E ? "openpgp-elg" :
	algo == GCRY_PK_ELG ? "elg" : "x-oops" ,
	strlen (nbitsstr), nbitsstr,
	((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	"(transient-key)" : "" );
	if (!keyparms)
	err = gpg_error_from_syserror ();
	else
	{
	err = common_gen (keyparms, algo, "pgy",
	pub_root, timestamp, expireval, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	xfree (keyparms);
	}

	return err;
	}


	/*
	* Generate an DSA key
	*/
	static gpg_error_t
	gen_dsa (unsigned int nbits, KBNODE pub_root,
	u32 timestamp, u32 expireval, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	int err;
	unsigned int qbits;
	char *keyparms;
	char nbitsstr[35];
	char qbitsstr[35];

	if (nbits < 768)
	{
	nbits = 2048;
	log_info(_("keysize invalid; using %u bits\n"), nbits );
	}
	else if ( nbits > 3072 )
	{
	nbits = 3072;
	log_info(_("keysize invalid; using %u bits\n"), nbits );
	}

	if( (nbits % 64) )
	{
	nbits = ((nbits + 63) / 64) * 64;
	log_info(_("keysize rounded up to %u bits\n"), nbits );
	}

	/* To comply with FIPS rules we round up to the next value unless in
	expert mode. */
	if (!opt.expert && nbits > 1024 && (nbits % 1024))
	{
	nbits = ((nbits + 1023) / 1024) * 1024;
	log_info(_("keysize rounded up to %u bits\n"), nbits );
	}

	/*
	Figure out a q size based on the key size. FIPS 180-3 says:

	L = 1024, N = 160
	L = 2048, N = 224
	L = 2048, N = 256
	L = 3072, N = 256

	2048/256 is an odd pair since there is also a 2048/224 and
	3072/256. Matching sizes is not a very exact science.

	We'll do 256 qbits for nbits over 2047, 224 for nbits over 1024
	but less than 2048, and 160 for 1024 (DSA1).
	*/

	if (nbits > 2047)
	qbits = 256;
	else if ( nbits > 1024)
	qbits = 224;
	else
	qbits = 160;

	if (qbits != 160 )
	log_info (_("WARNING: some OpenPGP programs can't"
	" handle a DSA key with this digest size\n"));

	snprintf (nbitsstr, sizeof nbitsstr, "%u", nbits);
	snprintf (qbitsstr, sizeof qbitsstr, "%u", qbits);
	keyparms = xtryasprintf ("(genkey(dsa(nbits %zu:%s)(qbits %zu:%s)%s))",
	strlen (nbitsstr), nbitsstr,
	strlen (qbitsstr), qbitsstr,
	((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	"(transient-key)" : "" );
	if (!keyparms)
	err = gpg_error_from_syserror ();
	else
	{
	err = common_gen (keyparms, PUBKEY_ALGO_DSA, "pqgy",
	pub_root, timestamp, expireval, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	xfree (keyparms);
	}

	return err;
	}



	/*
	* Generate an ECC key
	*/
	static gpg_error_t
	gen_ecc (int algo, const char *curve, kbnode_t pub_root,
	u32 timestamp, u32 expireval, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	gpg_error_t err;
	char *keyparms;

	log_assert (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH);

	if (!curve \|\| !*curve)
	return gpg_error (GPG_ERR_UNKNOWN_CURVE);

	/* Note that we use the "comp" flag with EdDSA to request the use of
	a 0x40 compression prefix octet. */
	if (algo == PUBKEY_ALGO_EDDSA)
	keyparms = xtryasprintf
	("(genkey(ecc(curve %zu:%s)(flags eddsa comp%s)))",
	strlen (curve), curve,
	(((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	" transient-key" : ""));
	else if (algo == PUBKEY_ALGO_ECDH && !strcmp (curve, "Curve25519"))
	keyparms = xtryasprintf
	("(genkey(ecc(curve %zu:%s)(flags djb-tweak comp%s)))",
	strlen (curve), curve,
	(((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	" transient-key" : ""));
	else
	keyparms = xtryasprintf
	("(genkey(ecc(curve %zu:%s)(flags nocomp%s)))",
	strlen (curve), curve,
	(((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	" transient-key" : ""));

	if (!keyparms)
	err = gpg_error_from_syserror ();
	else
	{
	err = common_gen (keyparms, algo, "",
	pub_root, timestamp, expireval, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	xfree (keyparms);
	}

	return err;
	}


	/*
	* Generate an RSA key.
	*/
	static int
	gen_rsa (int algo, unsigned int nbits, KBNODE pub_root,
	u32 timestamp, u32 expireval, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	int err;
	char *keyparms;
	char nbitsstr[35];
	const unsigned maxsize = (opt.flags.large_rsa ? 8192 : 4096);

	log_assert (is_RSA(algo));

	if (!nbits)
	nbits = get_keysize_range (algo, NULL, NULL);

	if (nbits < 1024)
	{
	nbits = 2048;
	log_info (_("keysize invalid; using %u bits\n"), nbits );
	}
	else if (nbits > maxsize)
	{
	nbits = maxsize;
	log_info (_("keysize invalid; using %u bits\n"), nbits );
	}

	if ((nbits % 32))
	{
	nbits = ((nbits + 31) / 32) * 32;
	log_info (_("keysize rounded up to %u bits\n"), nbits );
	}

	snprintf (nbitsstr, sizeof nbitsstr, "%u", nbits);
	keyparms = xtryasprintf ("(genkey(rsa(nbits %zu:%s)%s))",
	strlen (nbitsstr), nbitsstr,
	((keygen_flags & KEYGEN_FLAG_TRANSIENT_KEY)
	&& (keygen_flags & KEYGEN_FLAG_NO_PROTECTION))?
	"(transient-key)" : "" );
	if (!keyparms)
	err = gpg_error_from_syserror ();
	else
	{
	err = common_gen (keyparms, algo, "ne",
	pub_root, timestamp, expireval, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	xfree (keyparms);
	}

	return err;
	}


	/****************
	* check valid days:
	* return 0 on error or the multiplier
	*/
	static int
	check_valid_days( const char *s )
	{
	if( !digitp(s) )
	return 0;
	for( s++; *s; s++)
	if( !digitp(s) )
	break;
	if( !*s )
	return 1;
	if( s[1] )
	return 0; /* e.g. "2323wc" */
	if( s == 'd' \|\| s == 'D' )
	return 1;
	if( s == 'w' \|\| s == 'W' )
	return 7;
	if( s == 'm' \|\| s == 'M' )
	return 30;
	if( s == 'y' \|\| s == 'Y' )
	return 365;
	return 0;
	}


	static void
	print_key_flags(int flags)
	{
	if(flags&PUBKEY_USAGE_SIG)
	tty_printf("%s ",_("Sign"));

	if(flags&PUBKEY_USAGE_CERT)
	tty_printf("%s ",_("Certify"));

	if(flags&PUBKEY_USAGE_ENC)
	tty_printf("%s ",_("Encrypt"));

	if(flags&PUBKEY_USAGE_AUTH)
	tty_printf("%s ",_("Authenticate"));
	}


	/* Ask for the key flags and return them. CURRENT gives the current
	* usage which should normally be given as 0. */
	unsigned int
	ask_key_flags (int algo, int subkey, unsigned int current)
	{
	/* TRANSLATORS: Please use only plain ASCII characters for the
	translation. If this is not possible use single digits. The
	string needs to 8 bytes long. Here is a description of the
	functions:

	s = Toggle signing capability
	e = Toggle encryption capability
	a = Toggle authentication capability
	q = Finish
	*/
	const char *togglers = _("SsEeAaQq");
	char *answer = NULL;
	const char *s;
	unsigned int possible = openpgp_pk_algo_usage(algo);

	if ( strlen(togglers) != 8 )
	{
	tty_printf ("NOTE: Bad translation at %s:%d. "
	"Please report.\n", __FILE__, __LINE__);
	togglers = "11223300";
	}

	/* Only primary keys may certify. */
	if(subkey)
	possible&=~PUBKEY_USAGE_CERT;

	/* Preload the current set with the possible set, minus
	authentication if CURRENT has been given as 0. If CURRENT has
	been has non-zero we mask with all possible usages. */
	if (current)
	current &= possible;
	else
	current = (possible&~PUBKEY_USAGE_AUTH);

	for(;;)
	{
	tty_printf("\n");
	tty_printf(_("Possible actions for a %s key: "),
	(algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA)
	? "ECDSA/EdDSA" : openpgp_pk_algo_name (algo));
	print_key_flags(possible);
	tty_printf("\n");
	tty_printf(_("Current allowed actions: "));
	print_key_flags(current);
	tty_printf("\n\n");

	if(possible&PUBKEY_USAGE_SIG)
	tty_printf(_(" (%c) Toggle the sign capability\n"),
	togglers[0]);
	if(possible&PUBKEY_USAGE_ENC)
	tty_printf(_(" (%c) Toggle the encrypt capability\n"),
	togglers[2]);
	if(possible&PUBKEY_USAGE_AUTH)
	tty_printf(_(" (%c) Toggle the authenticate capability\n"),
	togglers[4]);

	tty_printf(_(" (%c) Finished\n"),togglers[6]);
	tty_printf("\n");

	xfree(answer);
	answer = cpr_get("keygen.flags",_("Your selection? "));
	cpr_kill_prompt();

	if (*answer == '=')
	{
	/* Hack to allow direct entry of the capabilities. */
	current = 0;
	for (s=answer+1; *s; s++)
	{
	if ((s == 's' \|\| s == 'S') && (possible&PUBKEY_USAGE_SIG))
	current \|= PUBKEY_USAGE_SIG;
	else if ((s == 'e' \|\| s == 'E') && (possible&PUBKEY_USAGE_ENC))
	current \|= PUBKEY_USAGE_ENC;
	else if ((s == 'a' \|\| s == 'A') && (possible&PUBKEY_USAGE_AUTH))
	current \|= PUBKEY_USAGE_AUTH;
	else if (!subkey && *s == 'c')
	{
	/* Accept 'c' for the primary key because USAGE_CERT
	- will will be set anyway. This is for folks who
	+ will be set anyway. This is for folks who
	want to experiment with a cert-only primary key. */
	current \|= PUBKEY_USAGE_CERT;
	}
	}
	break;
	}
	else if (strlen(answer)>1)
	tty_printf(_("Invalid selection.\n"));
	else if(answer=='\0' \|\| answer==togglers[6] \|\| *answer==togglers[7])
	break;
	else if((answer==togglers[0] \|\| answer==togglers[1])
	&& possible&PUBKEY_USAGE_SIG)
	{
	if(current&PUBKEY_USAGE_SIG)
	current&=~PUBKEY_USAGE_SIG;
	else
	current\|=PUBKEY_USAGE_SIG;
	}
	else if((answer==togglers[2] \|\| answer==togglers[3])
	&& possible&PUBKEY_USAGE_ENC)
	{
	if(current&PUBKEY_USAGE_ENC)
	current&=~PUBKEY_USAGE_ENC;
	else
	current\|=PUBKEY_USAGE_ENC;
	}
	else if((answer==togglers[4] \|\| answer==togglers[5])
	&& possible&PUBKEY_USAGE_AUTH)
	{
	if(current&PUBKEY_USAGE_AUTH)
	current&=~PUBKEY_USAGE_AUTH;
	else
	current\|=PUBKEY_USAGE_AUTH;
	}
	else
	tty_printf(_("Invalid selection.\n"));
	}

	xfree(answer);

	return current;
	}


	/* Check whether we have a key for the key with HEXGRIP. Returns 0 if
	there is no such key or the OpenPGP algo number for the key. */
	static int
	check_keygrip (ctrl_t ctrl, const char *hexgrip)
	{
	gpg_error_t err;
	unsigned char *public;
	size_t publiclen;
	const char *algostr;

	if (hexgrip[0] == '&')
	hexgrip++;

	err = agent_readkey (ctrl, 0, hexgrip, &public);
	if (err)
	return 0;
	publiclen = gcry_sexp_canon_len (public, 0, NULL, NULL);

	get_pk_algo_from_canon_sexp (public, publiclen, &algostr);
	xfree (public);

	/* FIXME: Mapping of ECC algorithms is probably not correct. */
	if (!algostr)
	return 0;
	else if (!strcmp (algostr, "rsa"))
	return PUBKEY_ALGO_RSA;
	else if (!strcmp (algostr, "dsa"))
	return PUBKEY_ALGO_DSA;
	else if (!strcmp (algostr, "elg"))
	return PUBKEY_ALGO_ELGAMAL_E;
	else if (!strcmp (algostr, "ecc"))
	return PUBKEY_ALGO_ECDH;
	else if (!strcmp (algostr, "ecdsa"))
	return PUBKEY_ALGO_ECDSA;
	else if (!strcmp (algostr, "eddsa"))
	return PUBKEY_ALGO_EDDSA;
	else
	return 0;
	}



	/* Ask for an algorithm. The function returns the algorithm id to
	* create. If ADDMODE is false the function won't show an option to
	* create the primary and subkey combined and won't set R_USAGE
	* either. If a combined algorithm has been selected, the subkey
	* algorithm is stored at R_SUBKEY_ALGO. If R_KEYGRIP is given, the
	* user has the choice to enter the keygrip of an existing key. That
	* keygrip is then stored at this address. The caller needs to free
	* it. */
	static int
	ask_algo (ctrl_t ctrl, int addmode, int r_subkey_algo, unsigned int r_usage,
	char **r_keygrip)
	{
	char *keygrip = NULL;
	char *answer = NULL;
	int algo;
	int dummy_algo;

	if (!r_subkey_algo)
	r_subkey_algo = &dummy_algo;

	tty_printf (_("Please select what kind of key you want:\n"));

	#if GPG_USE_RSA
	if (!addmode)
	tty_printf (_(" (%d) RSA and RSA (default)\n"), 1 );
	#endif

	if (!addmode && opt.compliance != CO_DE_VS)
	tty_printf (_(" (%d) DSA and Elgamal\n"), 2 );

	if (opt.compliance != CO_DE_VS)
	tty_printf (_(" (%d) DSA (sign only)\n"), 3 );
	#if GPG_USE_RSA
	tty_printf (_(" (%d) RSA (sign only)\n"), 4 );
	#endif

	if (addmode)
	{
	if (opt.compliance != CO_DE_VS)
	tty_printf (_(" (%d) Elgamal (encrypt only)\n"), 5 );
	#if GPG_USE_RSA
	tty_printf (_(" (%d) RSA (encrypt only)\n"), 6 );
	#endif
	}
	if (opt.expert)
	{
	if (opt.compliance != CO_DE_VS)
	tty_printf (_(" (%d) DSA (set your own capabilities)\n"), 7 );
	#if GPG_USE_RSA
	tty_printf (_(" (%d) RSA (set your own capabilities)\n"), 8 );
	#endif
	}

	#if GPG_USE_ECDSA \|\| GPG_USE_ECDH \|\| GPG_USE_EDDSA
	if (opt.expert && !addmode)
	tty_printf (_(" (%d) ECC and ECC\n"), 9 );
	if (opt.expert)
	tty_printf (_(" (%d) ECC (sign only)\n"), 10 );
	if (opt.expert)
	tty_printf (_(" (%d) ECC (set your own capabilities)\n"), 11 );
	if (opt.expert && addmode)
	tty_printf (_(" (%d) ECC (encrypt only)\n"), 12 );
	#endif

	if (opt.expert && r_keygrip)
	tty_printf (_(" (%d) Existing key\n"), 13 );

	for (;;)
	{
	*r_usage = 0;
	*r_subkey_algo = 0;
	xfree (answer);
	answer = cpr_get ("keygen.algo", _("Your selection? "));
	cpr_kill_prompt ();
	algo = *answer? atoi (answer) : 1;

	if (opt.compliance == CO_DE_VS
	&& (algo == 2 \|\| algo == 3 \|\| algo == 5 \|\| algo == 7))
	{
	tty_printf (_("Invalid selection.\n"));
	}
	else if ((algo == 1 \|\| !strcmp (answer, "rsa+rsa")) && !addmode)
	{
	algo = PUBKEY_ALGO_RSA;
	*r_subkey_algo = PUBKEY_ALGO_RSA;
	break;
	}
	else if ((algo == 2 \|\| !strcmp (answer, "dsa+elg")) && !addmode)
	{
	algo = PUBKEY_ALGO_DSA;
	*r_subkey_algo = PUBKEY_ALGO_ELGAMAL_E;
	break;
	}
	else if (algo == 3 \|\| !strcmp (answer, "dsa"))
	{
	algo = PUBKEY_ALGO_DSA;
	*r_usage = PUBKEY_USAGE_SIG;
	break;
	}
	else if (algo == 4 \|\| !strcmp (answer, "rsa/s"))
	{
	algo = PUBKEY_ALGO_RSA;
	*r_usage = PUBKEY_USAGE_SIG;
	break;
	}
	else if ((algo == 5 \|\| !strcmp (answer, "elg")) && addmode)
	{
	algo = PUBKEY_ALGO_ELGAMAL_E;
	*r_usage = PUBKEY_USAGE_ENC;
	break;
	}
	else if ((algo == 6 \|\| !strcmp (answer, "rsa/e")) && addmode)
	{
	algo = PUBKEY_ALGO_RSA;
	*r_usage = PUBKEY_USAGE_ENC;
	break;
	}
	else if ((algo == 7 \|\| !strcmp (answer, "dsa/*")) && opt.expert)
	{
	algo = PUBKEY_ALGO_DSA;
	*r_usage = ask_key_flags (algo, addmode, 0);
	break;
	}
	else if ((algo == 8 \|\| !strcmp (answer, "rsa/*")) && opt.expert)
	{
	algo = PUBKEY_ALGO_RSA;
	*r_usage = ask_key_flags (algo, addmode, 0);
	break;
	}
	else if ((algo == 9 \|\| !strcmp (answer, "ecc+ecc"))
	&& opt.expert && !addmode)
	{
	algo = PUBKEY_ALGO_ECDSA;
	*r_subkey_algo = PUBKEY_ALGO_ECDH;
	break;
	}
	else if ((algo == 10 \|\| !strcmp (answer, "ecc/s")) && opt.expert)
	{
	algo = PUBKEY_ALGO_ECDSA;
	*r_usage = PUBKEY_USAGE_SIG;
	break;
	}
	else if ((algo == 11 \|\| !strcmp (answer, "ecc/*")) && opt.expert)
	{
	algo = PUBKEY_ALGO_ECDSA;
	*r_usage = ask_key_flags (algo, addmode, 0);
	break;
	}
	else if ((algo == 12 \|\| !strcmp (answer, "ecc/e"))
	&& opt.expert && addmode)
	{
	algo = PUBKEY_ALGO_ECDH;
	*r_usage = PUBKEY_USAGE_ENC;
	break;
	}
	else if ((algo == 13 \|\| !strcmp (answer, "keygrip"))
	&& opt.expert && r_keygrip)
	{
	for (;;)
	{
	xfree (answer);
	answer = tty_get (_("Enter the keygrip: "));
	tty_kill_prompt ();
	trim_spaces (answer);
	if (!*answer)
	{
	xfree (answer);
	answer = NULL;
	continue;
	}

	if (strlen (answer) != 40 &&
	!(answer[0] == '&' && strlen (answer+1) == 40))
	tty_printf
	(_("Not a valid keygrip (expecting 40 hex digits)\n"));
	else if (!(algo = check_keygrip (ctrl, answer)) )
	tty_printf (_("No key with this keygrip\n"));
	else
	break; /* Okay. */
	}
	xfree (keygrip);
	keygrip = answer;
	answer = NULL;
	*r_usage = ask_key_flags (algo, addmode, 0);
	break;
	}
	else
	tty_printf (_("Invalid selection.\n"));

	}

	xfree(answer);
	if (r_keygrip)
	*r_keygrip = keygrip;
	return algo;
	}


	static unsigned int
	get_keysize_range (int algo, unsigned int min, unsigned int max)
	{
	unsigned int def;
	unsigned int dummy1, dummy2;

	if (!min)
	min = &dummy1;
	if (!max)
	max = &dummy2;

	switch(algo)
	{
	case PUBKEY_ALGO_DSA:
	*min = opt.expert? 768 : 1024;
	*max=3072;
	def=2048;
	break;

	case PUBKEY_ALGO_ECDSA:
	case PUBKEY_ALGO_ECDH:
	*min=256;
	*max=521;
	def=256;
	break;

	case PUBKEY_ALGO_EDDSA:
	*min=255;
	*max=441;
	def=255;
	break;

	default:
	*min = opt.compliance == CO_DE_VS ? 2048: 1024;
	*max = 4096;
	def = 2048;
	break;
	}

	return def;
	}


	/* Return a fixed up keysize depending on ALGO. */
	static unsigned int
	fixup_keysize (unsigned int nbits, int algo, int silent)
	{
	if (algo == PUBKEY_ALGO_DSA && (nbits % 64))
	{
	nbits = ((nbits + 63) / 64) * 64;
	if (!silent)
	tty_printf (_("rounded up to %u bits\n"), nbits);
	}
	else if (algo == PUBKEY_ALGO_EDDSA)
	{
	if (nbits != 255 && nbits != 441)
	{
	if (nbits < 256)
	nbits = 255;
	else
	nbits = 441;
	if (!silent)
	tty_printf (_("rounded to %u bits\n"), nbits);
	}
	}
	else if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ECDSA)
	{
	if (nbits != 256 && nbits != 384 && nbits != 521)
	{
	if (nbits < 256)
	nbits = 256;
	else if (nbits < 384)
	nbits = 384;
	else
	nbits = 521;
	if (!silent)
	tty_printf (_("rounded to %u bits\n"), nbits);
	}
	}
	else if ((nbits % 32))
	{
	nbits = ((nbits + 31) / 32) * 32;
	if (!silent)
	tty_printf (_("rounded up to %u bits\n"), nbits );
	}

	return nbits;
	}


	/* Ask for the key size. ALGO is the algorithm. If PRIMARY_KEYSIZE
	is not 0, the function asks for the size of the encryption
	subkey. */
	static unsigned
	ask_keysize (int algo, unsigned int primary_keysize)
	{
	unsigned int nbits;
	unsigned int min, def, max;
	int for_subkey = !!primary_keysize;
	int autocomp = 0;

	def = get_keysize_range (algo, &min, &max);

	if (primary_keysize && !opt.expert)
	{
	/* Deduce the subkey size from the primary key size. */
	if (algo == PUBKEY_ALGO_DSA && primary_keysize > 3072)
	nbits = 3072; /* For performance reasons we don't support more
	than 3072 bit DSA. However we won't see this
	case anyway because DSA can't be used as an
	encryption subkey ;-). */
	else
	nbits = primary_keysize;
	autocomp = 1;
	goto leave;
	}

	tty_printf(_("%s keys may be between %u and %u bits long.\n"),
	openpgp_pk_algo_name (algo), min, max);

	for (;;)
	{
	char prompt, answer;

	if (for_subkey)
	prompt = xasprintf (_("What keysize do you want "
	"for the subkey? (%u) "), def);
	else
	prompt = xasprintf (_("What keysize do you want? (%u) "), def);
	answer = cpr_get ("keygen.size", prompt);
	cpr_kill_prompt ();
	nbits = *answer? atoi (answer): def;
	xfree(prompt);
	xfree(answer);

	if(nbits<min \|\| nbits>max)
	tty_printf(_("%s keysizes must be in the range %u-%u\n"),
	openpgp_pk_algo_name (algo), min, max);
	else
	break;
	}

	tty_printf (_("Requested keysize is %u bits\n"), nbits);

	leave:
	nbits = fixup_keysize (nbits, algo, autocomp);
	return nbits;
	}


	/* Ask for the curve. ALGO is the selected algorithm which this
	function may adjust. Returns a malloced string with the name of
	the curve. BOTH tells that gpg creates a primary and subkey. */
	static char *
	ask_curve (int algo, int subkey_algo)
	{
	/* NB: We always use a complete algo list so that we have stable
	numbers in the menu regardless on how Gpg was configured. */
	struct {
	const char *name;
	const char* eddsa_curve; /* Corresponding EdDSA curve. */
	const char *pretty_name;
	unsigned int supported : 1; /* Supported by gpg. */
	unsigned int de_vs : 1; /* Allowed in CO_DE_VS. */
	unsigned int expert_only : 1; /* Only with --expert */
	unsigned int available : 1; /* Available in Libycrypt (runtime checked) */
	} curves[] = {
	#if GPG_USE_ECDSA \|\| GPG_USE_ECDH
	# define MY_USE_ECDSADH 1
	#else
	# define MY_USE_ECDSADH 0
	#endif
	{ "Curve25519", "Ed25519", "Curve 25519", !!GPG_USE_EDDSA, 0, 0, 0 },
	{ "Curve448", "Ed448", "Curve 448", 0/reserved/ , 0, 1, 0 },
	{ "NIST P-256", NULL, NULL, MY_USE_ECDSADH, 0, 1, 0 },
	{ "NIST P-384", NULL, NULL, MY_USE_ECDSADH, 0, 0, 0 },
	{ "NIST P-521", NULL, NULL, MY_USE_ECDSADH, 0, 1, 0 },
	{ "brainpoolP256r1", NULL, "Brainpool P-256", MY_USE_ECDSADH, 1, 1, 0 },
	{ "brainpoolP384r1", NULL, "Brainpool P-384", MY_USE_ECDSADH, 1, 1, 0 },
	{ "brainpoolP512r1", NULL, "Brainpool P-512", MY_USE_ECDSADH, 1, 1, 0 },
	{ "secp256k1", NULL, NULL, MY_USE_ECDSADH, 0, 1, 0 },
	};
	#undef MY_USE_ECDSADH
	int idx;
	char *answer;
	char *result = NULL;
	gcry_sexp_t keyparms;

	tty_printf (_("Please select which elliptic curve you want:\n"));

	keyparms = NULL;
	for (idx=0; idx < DIM(curves); idx++)
	{
	int rc;

	curves[idx].available = 0;
	if (!curves[idx].supported)
	continue;

	if (opt.compliance==CO_DE_VS)
	{
	if (!curves[idx].de_vs)
	continue; /* Not allowed. */
	}
	else if (!opt.expert && curves[idx].expert_only)
	continue;

	/* We need to switch from the ECDH name of the curve to the
	EDDSA name of the curve if we want a signing key. */
	gcry_sexp_release (keyparms);
	rc = gcry_sexp_build (&keyparms, NULL,
	"(public-key(ecc(curve %s)))",
	curves[idx].eddsa_curve? curves[idx].eddsa_curve
	/**/ : curves[idx].name);
	if (rc)
	continue;
	if (!gcry_pk_get_curve (keyparms, 0, NULL))
	continue;
	if (subkey_algo && curves[idx].eddsa_curve)
	{
	/* Both Curve 25519 (or 448) keys are to be created. Check that
	Libgcrypt also supports the real Curve25519 (or 448). */
	gcry_sexp_release (keyparms);
	rc = gcry_sexp_build (&keyparms, NULL,
	"(public-key(ecc(curve %s)))",
	curves[idx].name);
	if (rc)
	continue;
	if (!gcry_pk_get_curve (keyparms, 0, NULL))
	continue;
	}

	curves[idx].available = 1;
	tty_printf (" (%d) %s\n", idx + 1,
	curves[idx].pretty_name?
	curves[idx].pretty_name:curves[idx].name);
	}
	gcry_sexp_release (keyparms);


	for (;;)
	{
	answer = cpr_get ("keygen.curve", _("Your selection? "));
	cpr_kill_prompt ();
	idx = *answer? atoi (answer) : 1;
	if (*answer && !idx)
	{
	/* See whether the user entered the name of the curve. */
	for (idx=0; idx < DIM(curves); idx++)
	{
	if (!opt.expert && curves[idx].expert_only)
	continue;
	if (!stricmp (curves[idx].name, answer)
	\|\| (curves[idx].pretty_name
	&& !stricmp (curves[idx].pretty_name, answer)))
	break;
	}
	if (idx == DIM(curves))
	idx = -1;
	}
	else
	idx--;
	xfree(answer);
	answer = NULL;
	if (idx < 0 \|\| idx >= DIM (curves) \|\| !curves[idx].available)
	tty_printf (_("Invalid selection.\n"));
	else
	{
	/* If the user selected a signing algorithm and Curve25519
	we need to set the algo to EdDSA and update the curve name. */
	if ((algo == PUBKEY_ALGO_ECDSA \|\| algo == PUBKEY_ALGO_EDDSA)
	&& curves[idx].eddsa_curve)
	{
	if (subkey_algo && *subkey_algo == PUBKEY_ALGO_ECDSA)
	*subkey_algo = PUBKEY_ALGO_EDDSA;
	*algo = PUBKEY_ALGO_EDDSA;
	result = xstrdup (curves[idx].eddsa_curve);
	}
	else
	result = xstrdup (curves[idx].name);
	break;
	}
	}

	if (!result)
	result = xstrdup (curves[0].name);

	return result;
	}


	/****************
	* Parse an expire string and return its value in seconds.
	* Returns (u32)-1 on error.
	* This isn't perfect since scan_isodatestr returns unix time, and
	* OpenPGP actually allows a 32-bit time plus a 32-bit offset.
	* Because of this, we only permit setting expirations up to 2106, but
	* OpenPGP could theoretically allow up to 2242. I think we'll all
	* just cope for the next few years until we get a 64-bit time_t or
	* similar.
	*/
	u32
	parse_expire_string( const char *string )
	{
	int mult;
	u32 seconds;
	u32 abs_date = 0;
	u32 curtime = make_timestamp ();
	time_t tt;

	if (!string \|\| !*string \|\| !strcmp (string, "none")
	\|\| !strcmp (string, "never") \|\| !strcmp (string, "-"))
	seconds = 0;
	else if (!strncmp (string, "seconds=", 8))
	seconds = atoi (string+8);
	else if ((abs_date = scan_isodatestr(string))
	&& (abs_date+86400/2) > curtime)
	seconds = (abs_date+86400/2) - curtime;
	else if ((tt = isotime2epoch (string)) != (time_t)(-1))
	seconds = (u32)tt - curtime;
	else if ((mult = check_valid_days (string)))
	seconds = atoi (string) * 86400L * mult;
	else
	seconds = (u32)(-1);

	return seconds;
	}

	/* Parse a Creation-Date string which is either "1986-04-26" or
	"19860426T042640". Returns 0 on error. */
	static u32
	parse_creation_string (const char *string)
	{
	u32 seconds;

	if (!*string)
	seconds = 0;
	else if ( !strncmp (string, "seconds=", 8) )
	seconds = atoi (string+8);
	else if ( !(seconds = scan_isodatestr (string)))
	{
	time_t tmp = isotime2epoch (string);
	seconds = (tmp == (time_t)(-1))? 0 : tmp;
	}
	return seconds;
	}


	/* object == 0 for a key, and 1 for a sig */
	u32
	ask_expire_interval(int object,const char *def_expire)
	{
	u32 interval;
	char *answer;

	switch(object)
	{
	case 0:
	if(def_expire)
	BUG();
	tty_printf(_("Please specify how long the key should be valid.\n"
	" 0 = key does not expire\n"
	" <n> = key expires in n days\n"
	" <n>w = key expires in n weeks\n"
	" <n>m = key expires in n months\n"
	" <n>y = key expires in n years\n"));
	break;

	case 1:
	if(!def_expire)
	BUG();
	tty_printf(_("Please specify how long the signature should be valid.\n"
	" 0 = signature does not expire\n"
	" <n> = signature expires in n days\n"
	" <n>w = signature expires in n weeks\n"
	" <n>m = signature expires in n months\n"
	" <n>y = signature expires in n years\n"));
	break;

	default:
	BUG();
	}

	/* Note: The elgamal subkey for DSA has no expiration date because
	* it must be signed with the DSA key and this one has the expiration
	* date */

	answer = NULL;
	for(;;)
	{
	u32 curtime;

	xfree(answer);
	if(object==0)
	answer = cpr_get("keygen.valid",_("Key is valid for? (0) "));
	else
	{
	char *prompt;

	prompt = xasprintf (_("Signature is valid for? (%s) "), def_expire);
	answer = cpr_get("siggen.valid",prompt);
	xfree(prompt);

	if(*answer=='\0')
	answer=xstrdup(def_expire);
	}
	cpr_kill_prompt();
	trim_spaces(answer);
	curtime = make_timestamp ();
	interval = parse_expire_string( answer );
	if( interval == (u32)-1 )
	{
	tty_printf(_("invalid value\n"));
	continue;
	}

	if( !interval )
	{
	tty_printf((object==0)
	? _("Key does not expire at all\n")
	: _("Signature does not expire at all\n"));
	}
	else
	{
	tty_printf(object==0
	? _("Key expires at %s\n")
	: _("Signature expires at %s\n"),
	asctimestamp((ulong)(curtime + interval) ) );
	#if SIZEOF_TIME_T <= 4 && !defined (HAVE_UNSIGNED_TIME_T)
	if ( (time_t)((ulong)(curtime+interval)) < 0 )
	tty_printf (_("Your system can't display dates beyond 2038.\n"
	"However, it will be correctly handled up to"
	" 2106.\n"));
	else
	#endif /SIZEOF_TIME_T/
	if ( (time_t)((unsigned long)(curtime+interval)) < curtime )
	{
	tty_printf (_("invalid value\n"));
	continue;
	}
	}

	if( cpr_enabled() \|\| cpr_get_answer_is_yes("keygen.valid.okay",
	_("Is this correct? (y/N) ")) )
	break;
	}

	xfree(answer);
	return interval;
	}

	u32
	ask_expiredate()
	{
	u32 x = ask_expire_interval(0,NULL);
	return x? make_timestamp() + x : 0;
	}



	static PKT_user_id *
	uid_from_string (const char *string)
	{
	size_t n;
	PKT_user_id *uid;

	n = strlen (string);
	uid = xmalloc_clear (sizeof *uid + n);
	uid->len = n;
	strcpy (uid->name, string);
	uid->ref = 1;
	return uid;
	}


	/* Return true if the user id UID already exists in the keyblock. */
	static int
	uid_already_in_keyblock (kbnode_t keyblock, const char *uid)
	{
	PKT_user_id *uidpkt = uid_from_string (uid);
	kbnode_t node;
	int result = 0;

	for (node=keyblock; node && !result; node=node->next)
	if (!is_deleted_kbnode (node)
	&& node->pkt->pkttype == PKT_USER_ID
	&& !cmp_user_ids (uidpkt, node->pkt->pkt.user_id))
	result = 1;
	free_user_id (uidpkt);
	return result;
	}


	/* Ask for a user ID. With a MODE of 1 an extra help prompt is
	printed for use during a new key creation. If KEYBLOCK is not NULL
	the function prevents the creation of an already existing user
	ID. IF FULL is not set some prompts are not shown. */
	static char *
	ask_user_id (int mode, int full, KBNODE keyblock)
	{
	char *answer;
	char aname, acomment, amail, uid;

	if ( !mode )
	{
	/* TRANSLATORS: This is the new string telling the user what
	gpg is now going to do (i.e. ask for the parts of the user
	ID). Note that if you do not translate this string, a
	different string will be used, which might still have
	a correct translation. */
	const char *s1 =
	N_("\n"
	"GnuPG needs to construct a user ID to identify your key.\n"
	"\n");
	const char *s2 = _(s1);

	if (!strcmp (s1, s2))
	{
	/* There is no translation for the string thus we to use
	the old info text. gettext has no way to tell whether
	a translation is actually available, thus we need to
	to compare again. */
	/* TRANSLATORS: This string is in general not anymore used
	but you should keep your existing translation. In case
	the new string is not translated this old string will
	be used. */
	const char *s3 = N_("\n"
	"You need a user ID to identify your key; "
	"the software constructs the user ID\n"
	"from the Real Name, Comment and Email Address in this form:\n"
	" \"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>\"\n\n");
	const char *s4 = _(s3);
	if (strcmp (s3, s4))
	s2 = s3; /* A translation exists - use it. */
	}
	tty_printf ("%s", s2) ;
	}
	uid = aname = acomment = amail = NULL;
	for(;;) {
	char *p;
	int fail=0;

	if( !aname ) {
	for(;;) {
	xfree(aname);
	aname = cpr_get("keygen.name",_("Real name: "));
	trim_spaces(aname);
	cpr_kill_prompt();

	if( opt.allow_freeform_uid )
	break;

	if( strpbrk( aname, "<>" ) )
	{
	tty_printf(_("Invalid character in name\n"));
	tty_printf(_("The characters '%s' and '%s' may not "
	"appear in name\n"), "<", ">");
	}
	else if( digitp(aname) )
	tty_printf(_("Name may not start with a digit\n"));
	else if (*aname && strlen (aname) < 5)
	{
	tty_printf(_("Name must be at least 5 characters long\n"));
	/* However, we allow an empty name. */
	}
	else
	break;
	}
	}
	if( !amail ) {
	for(;;) {
	xfree(amail);
	amail = cpr_get("keygen.email",_("Email address: "));
	trim_spaces(amail);
	cpr_kill_prompt();
	if( !*amail \|\| opt.allow_freeform_uid )
	break; /* no email address is okay */
	else if ( !is_valid_mailbox (amail) )
	tty_printf(_("Not a valid email address\n"));
	else
	break;
	}
	}
	if (!acomment) {
	if (full) {
	for(;;) {
	xfree(acomment);
	acomment = cpr_get("keygen.comment",_("Comment: "));
	trim_spaces(acomment);
	cpr_kill_prompt();
	if( !*acomment )
	break; /* no comment is okay */
	else if( strpbrk( acomment, "()" ) )
	tty_printf(_("Invalid character in comment\n"));
	else
	break;
	}
	}
	else {
	xfree (acomment);
	acomment = xstrdup ("");
	}
	}


	xfree(uid);
	uid = p = xmalloc(strlen(aname)+strlen(amail)+strlen(acomment)+12+10);
	if (!aname && amail && !*acomment && !random_is_faked ())
	{ /* Empty name and comment but with mail address. Use
	simplified form with only the non-angle-bracketed mail
	address. */
	p = stpcpy (p, amail);
	}
	else
	{
	p = stpcpy (p, aname );
	if (*acomment)
	p = stpcpy(stpcpy(stpcpy(p," ("), acomment),")");
	if (*amail)
	p = stpcpy(stpcpy(stpcpy(p," <"), amail),">");
	}

	/* Append a warning if the RNG is switched into fake mode. */
	if ( random_is_faked () )
	strcpy(p, " (insecure!)" );

	/* print a note in case that UTF8 mapping has to be done */
	for(p=uid; *p; p++ ) {
	if( *p & 0x80 ) {
	tty_printf(_("You are using the '%s' character set.\n"),
	get_native_charset() );
	break;
	}
	}

	tty_printf(_("You selected this USER-ID:\n \"%s\"\n\n"), uid);

	if( !*amail && !opt.allow_freeform_uid
	&& (strchr( aname, '@' ) \|\| strchr( acomment, '@'))) {
	fail = 1;
	tty_printf(_("Please don't put the email address "
	"into the real name or the comment\n") );
	}

	if (!fail && keyblock)
	{
	if (uid_already_in_keyblock (keyblock, uid))
	{
	tty_printf (_("Such a user ID already exists on this key!\n"));
	fail = 1;
	}
	}

	for(;;) {
	/* TRANSLATORS: These are the allowed answers in
	lower and uppercase. Below you will find the matching
	string which should be translated accordingly and the
	letter changed to match the one in the answer string.

	n = Change name
	c = Change comment
	e = Change email
	o = Okay (ready, continue)
	q = Quit
	*/
	const char *ansstr = _("NnCcEeOoQq");

	if( strlen(ansstr) != 10 )
	BUG();
	if( cpr_enabled() ) {
	answer = xstrdup (ansstr + (fail?8:6));
	answer[1] = 0;
	}
	else if (full) {
	answer = cpr_get("keygen.userid.cmd", fail?
	_("Change (N)ame, (C)omment, (E)mail or (Q)uit? ") :
	_("Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? "));
	cpr_kill_prompt();
	}
	else {
	answer = cpr_get("keygen.userid.cmd", fail?
	_("Change (N)ame, (E)mail, or (Q)uit? ") :
	_("Change (N)ame, (E)mail, or (O)kay/(Q)uit? "));
	cpr_kill_prompt();
	}
	if( strlen(answer) > 1 )
	;
	else if( answer == ansstr[0] \|\| answer == ansstr[1] ) {
	xfree(aname); aname = NULL;
	break;
	}
	else if( answer == ansstr[2] \|\| answer == ansstr[3] ) {
	xfree(acomment); acomment = NULL;
	break;
	}
	else if( answer == ansstr[4] \|\| answer == ansstr[5] ) {
	xfree(amail); amail = NULL;
	break;
	}
	else if( answer == ansstr[6] \|\| answer == ansstr[7] ) {
	if( fail ) {
	tty_printf(_("Please correct the error first\n"));
	}
	else {
	xfree(aname); aname = NULL;
	xfree(acomment); acomment = NULL;
	xfree(amail); amail = NULL;
	break;
	}
	}
	else if( answer == ansstr[8] \|\| answer == ansstr[9] ) {
	xfree(aname); aname = NULL;
	xfree(acomment); acomment = NULL;
	xfree(amail); amail = NULL;
	xfree(uid); uid = NULL;
	break;
	}
	xfree(answer);
	}
	xfree(answer);
	if (!amail && !acomment)
	break;
	xfree(uid); uid = NULL;
	}
	if( uid ) {
	char *p = native_to_utf8( uid );
	xfree( uid );
	uid = p;
	}
	return uid;
	}


	/* Basic key generation. Here we divert to the actual generation
	routines based on the requested algorithm. */
	static int
	do_create (int algo, unsigned int nbits, const char *curve, KBNODE pub_root,
	u32 timestamp, u32 expiredate, int is_subkey,
	int keygen_flags, const char *passphrase,
	char cache_nonce_addr, char passwd_nonce_addr)
	{
	gpg_error_t err;

	/* Fixme: The entropy collecting message should be moved to a
	libgcrypt progress handler. */
	if (!opt.batch)
	tty_printf (_(
	"We need to generate a lot of random bytes. It is a good idea to perform\n"
	"some other action (type on the keyboard, move the mouse, utilize the\n"
	"disks) during the prime generation; this gives the random number\n"
	"generator a better chance to gain enough entropy.\n") );

	if (algo == PUBKEY_ALGO_ELGAMAL_E)
	err = gen_elg (algo, nbits, pub_root, timestamp, expiredate, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	else if (algo == PUBKEY_ALGO_DSA)
	err = gen_dsa (nbits, pub_root, timestamp, expiredate, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	else if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	err = gen_ecc (algo, curve, pub_root, timestamp, expiredate, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	else if (algo == PUBKEY_ALGO_RSA)
	err = gen_rsa (algo, nbits, pub_root, timestamp, expiredate, is_subkey,
	keygen_flags, passphrase,
	cache_nonce_addr, passwd_nonce_addr);
	else
	BUG();

	return err;
	}


	/* Generate a new user id packet or return NULL if canceled. If
	KEYBLOCK is not NULL the function prevents the creation of an
	already existing user ID. If UIDSTR is not NULL the user is not
	asked but UIDSTR is used to create the user id packet; if the user
	id already exists NULL is returned. UIDSTR is expected to be utf-8
	encoded and should have already been checked for a valid length
	etc. */
	PKT_user_id *
	generate_user_id (KBNODE keyblock, const char *uidstr)
	{
	PKT_user_id *uid;
	char *p;

	if (uidstr)
	{
	if (uid_already_in_keyblock (keyblock, uidstr))
	return NULL; /* Already exists. */
	uid = uid_from_string (uidstr);
	}
	else
	{
	p = ask_user_id (1, 1, keyblock);
	if (!p)
	return NULL; /* Canceled. */
	uid = uid_from_string (p);
	xfree (p);
	}
	return uid;
	}


	/* Helper for parse_key_parameter_string for one part of the
	* specification string; i.e. ALGO/FLAGS. If STRING is NULL or empty
	* success is returned. On error an error code is returned. Note
	* that STRING may be modified by this function. NULL may be passed
	* for any parameter. FOR_SUBKEY shall be true if this is used as a
	* subkey. */
	static gpg_error_t
	parse_key_parameter_part (char *string, int for_subkey,
	int r_algo, unsigned int r_size,
	unsigned int *r_keyuse,
	char const **r_curve)
	{
	char *flags;
	int algo;
	char *endp;
	const char *curve = NULL;
	int ecdh_or_ecdsa = 0;
	unsigned int size;
	int keyuse;
	int i;
	const char *s;

	if (!string \|\| !*string)
	return 0; /* Success. */

	flags = strchr (string, '/');
	if (flags)
	*flags++ = 0;

	algo = 0;
	if (strlen (string) >= 3 && (digitp (string+3) \|\| !string[3]))
	{
	if (!ascii_memcasecmp (string, "rsa", 3))
	algo = PUBKEY_ALGO_RSA;
	else if (!ascii_memcasecmp (string, "dsa", 3))
	algo = PUBKEY_ALGO_DSA;
	else if (!ascii_memcasecmp (string, "elg", 3))
	algo = PUBKEY_ALGO_ELGAMAL_E;
	}
	if (algo)
	{
	if (!string[3])
	size = get_keysize_range (algo, NULL, NULL);
	else
	{
	size = strtoul (string+3, &endp, 10);
	if (size < 512 \|\| size > 16384 \|\| *endp)
	return gpg_error (GPG_ERR_INV_VALUE);
	}
	}
	else if ((curve = openpgp_is_curve_supported (string, &algo, &size)))
	{
	if (!algo)
	{
	algo = PUBKEY_ALGO_ECDH; /* Default ECC algorithm. */
	ecdh_or_ecdsa = 1; /* We may need to switch the algo. */
	}
	}
	else
	return gpg_error (GPG_ERR_UNKNOWN_CURVE);

	/* Parse the flags. */
	keyuse = 0;
	if (flags)
	{
	char **tokens = NULL;

	tokens = strtokenize (flags, ",");
	if (!tokens)
	return gpg_error_from_syserror ();

	for (i=0; (s = tokens[i]); i++)
	{
	if (!*s)
	;
	else if (!ascii_strcasecmp (s, "sign"))
	keyuse \|= PUBKEY_USAGE_SIG;
	else if (!ascii_strcasecmp (s, "encrypt")
	\|\| !ascii_strcasecmp (s, "encr"))
	keyuse \|= PUBKEY_USAGE_ENC;
	else if (!ascii_strcasecmp (s, "auth"))
	keyuse \|= PUBKEY_USAGE_AUTH;
	else if (!ascii_strcasecmp (s, "cert"))
	keyuse \|= PUBKEY_USAGE_CERT;
	else if (!ascii_strcasecmp (s, "ecdsa"))
	{
	if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ECDSA)
	algo = PUBKEY_ALGO_ECDSA;
	else
	{
	xfree (tokens);
	return gpg_error (GPG_ERR_INV_FLAG);
	}
	ecdh_or_ecdsa = 0;
	}
	else if (!ascii_strcasecmp (s, "ecdh"))
	{
	if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ECDSA)
	algo = PUBKEY_ALGO_ECDH;
	else
	{
	xfree (tokens);
	return gpg_error (GPG_ERR_INV_FLAG);
	}
	ecdh_or_ecdsa = 0;
	}
	else if (!ascii_strcasecmp (s, "eddsa"))
	{
	/* Not required but we allow it for consistency. */
	if (algo == PUBKEY_ALGO_EDDSA)
	;
	else
	{
	xfree (tokens);
	return gpg_error (GPG_ERR_INV_FLAG);
	}
	}
	else
	{
	xfree (tokens);
	return gpg_error (GPG_ERR_UNKNOWN_FLAG);
	}
	}

	xfree (tokens);
	}

	/* If not yet decided switch between ecdh and ecdsa. */
	if (ecdh_or_ecdsa && keyuse)
	algo = (keyuse & PUBKEY_USAGE_ENC)? PUBKEY_ALGO_ECDH : PUBKEY_ALGO_ECDSA;
	else if (ecdh_or_ecdsa)
	algo = for_subkey? PUBKEY_ALGO_ECDH : PUBKEY_ALGO_ECDSA;

	/* Set or fix key usage. */
	if (!keyuse)
	{
	if (algo == PUBKEY_ALGO_ECDSA \|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_DSA)
	keyuse = PUBKEY_USAGE_SIG;
	else if (algo == PUBKEY_ALGO_RSA)
	keyuse = for_subkey? PUBKEY_USAGE_ENC : PUBKEY_USAGE_SIG;
	else
	keyuse = PUBKEY_USAGE_ENC;
	}
	else if (algo == PUBKEY_ALGO_ECDSA \|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_DSA)
	{
	keyuse &= ~PUBKEY_USAGE_ENC; /* Forbid encryption. */
	}
	else if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ELGAMAL_E)
	{
	keyuse = PUBKEY_USAGE_ENC; /* Allow only encryption. */
	}

	/* Make sure a primary key can certify. */
	if (!for_subkey)
	keyuse \|= PUBKEY_USAGE_CERT;

	/* Check that usage is actually possible. */
	if (/**/((keyuse & (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_AUTH\|PUBKEY_USAGE_CERT))
	&& !pubkey_get_nsig (algo))
	\|\| ((keyuse & PUBKEY_USAGE_ENC)
	&& !pubkey_get_nenc (algo))
	\|\| (for_subkey && (keyuse & PUBKEY_USAGE_CERT)))
	return gpg_error (GPG_ERR_WRONG_KEY_USAGE);

	/* Return values. */
	if (r_algo)
	*r_algo = algo;
	if (r_size)
	{
	unsigned int min, def, max;

	/* Make sure the keysize is in the allowed range. */
	def = get_keysize_range (algo, &min, &max);
	if (!size)
	size = def;
	else if (size < min)
	size = min;
	else if (size > max)
	size = max;

	*r_size = fixup_keysize (size, algo, 1);
	}
	if (r_keyuse)
	*r_keyuse = keyuse;
	if (r_curve)
	*r_curve = curve;

	return 0;
	}

	/* Parse and return the standard key generation parameter.
	* The string is expected to be in this format:
	*
	* ALGO[/FLAGS][+SUBALGO[/FLAGS]]
	*
	* Here ALGO is a string in the same format as printed by the
	* keylisting. For example:
	*
	* rsa3072 := RSA with 3072 bit.
	* dsa2048 := DSA with 2048 bit.
	* elg2048 := Elgamal with 2048 bit.
	* ed25519 := EDDSA using curve Ed25519.
	* cv25519 := ECDH using curve Curve25519.
	* nistp256:= ECDSA or ECDH using curve NIST P-256
	*
	* All strings with an unknown prefix are considered an elliptic
	* curve. Curves which have no implicit algorithm require that FLAGS
	* is given to select whether ECDSA or ECDH is used; this can eoither
	* be done using an algorithm keyword or usage keywords.
	*
	* FLAGS is a comma delimited string of keywords:
	*
	* cert := Allow usage Certify
	* sign := Allow usage Sign
	* encr := Allow usage Encrypt
	* auth := Allow usage Authentication
	* encrypt := Alias for "encr"
	* ecdsa := Use algorithm ECDSA.
	* eddsa := Use algorithm EdDSA.
	* ecdh := Use algorithm ECDH.
	*
	* There are several defaults and fallbacks depending on the
	* algorithm. PART can be used to select which part of STRING is
	* used:
	* -1 := Both parts
	* 0 := Only the part of the primary key
	* 1 := If there is one part parse that one, if there are
	* two parts parse the second part. Always return
	* in the args for the primary key (R_ALGO,....).
	*
	*/
	gpg_error_t
	parse_key_parameter_string (const char *string, int part,
	int r_algo, unsigned int r_size,
	unsigned *r_keyuse,
	char const **r_curve,
	int r_subalgo, unsigned int r_subsize,
	unsigned *r_subkeyuse,
	char const **r_subcurve)
	{
	gpg_error_t err = 0;
	char primary, secondary;

	if (r_algo)
	*r_algo = 0;
	if (r_size)
	*r_size = 0;
	if (r_keyuse)
	*r_keyuse = 0;
	if (r_curve)
	*r_curve = NULL;
	if (r_subalgo)
	*r_subalgo = 0;
	if (r_subsize)
	*r_subsize = 0;
	if (r_subkeyuse)
	*r_subkeyuse = 0;
	if (r_subcurve)
	*r_subcurve = NULL;

	if (!string \|\| !*string
	\|\| !strcmp (string, "default") \|\| !strcmp (string, "-"))
	string = get_default_pubkey_algo ();
	else if (!strcmp (string, "future-default"))
	string = FUTURE_STD_KEY_PARAM;

	primary = xstrdup (string);
	secondary = strchr (primary, '+');
	if (secondary)
	*secondary++ = 0;
	if (part == -1 \|\| part == 0)
	{
	err = parse_key_parameter_part (primary, 0, r_algo, r_size,
	r_keyuse, r_curve);
	if (!err && part == -1)
	err = parse_key_parameter_part (secondary, 1, r_subalgo, r_subsize,
	r_subkeyuse, r_subcurve);
	}
	else if (part == 1)
	{
	/* If we have SECONDARY, use that part. If there is only one
	* part consider this to be the subkey algo. */
	err = parse_key_parameter_part (secondary? secondary : primary, 1,
	r_algo, r_size, r_keyuse, r_curve);
	}

	xfree (primary);

	return err;
	}



	/* Append R to the linked list PARA. */
	static void
	append_to_parameter (struct para_data_s para, struct para_data_s r)
	{
	log_assert (para);
	while (para->next)
	para = para->next;
	para->next = r;
	}

	/* Release the parameter list R. */
	static void
	release_parameter_list (struct para_data_s *r)
	{
	struct para_data_s *r2;

	for (; r ; r = r2)
	{
	r2 = r->next;
	if (r->key == pPASSPHRASE && *r->u.value)
	wipememory (r->u.value, strlen (r->u.value));
	xfree (r);
	}
	}

	static struct para_data_s *
	get_parameter( struct para_data_s *para, enum para_name key )
	{
	struct para_data_s *r;

	for( r = para; r && r->key != key; r = r->next )
	;
	return r;
	}

	static const char *
	get_parameter_value( struct para_data_s *para, enum para_name key )
	{
	struct para_data_s *r = get_parameter( para, key );
	return (r && *r->u.value)? r->u.value : NULL;
	}


	/* This is similar to get_parameter_value but also returns the empty
	string. This is required so that quick_generate_keypair can use an
	empty Passphrase to specify no-protection. */
	static const char *
	get_parameter_passphrase (struct para_data_s *para)
	{
	struct para_data_s *r = get_parameter (para, pPASSPHRASE);
	return r ? r->u.value : NULL;
	}


	static int
	get_parameter_algo( struct para_data_s *para, enum para_name key,
	int *r_default)
	{
	int i;
	struct para_data_s *r = get_parameter( para, key );

	if (r_default)
	*r_default = 0;

	if (!r)
	return -1;

	/* Note that we need to handle the ECC algorithms specified as
	strings directly because Libgcrypt folds them all to ECC. */
	if (!ascii_strcasecmp (r->u.value, "default"))
	{
	/* Note: If you change this default algo, remember to change it
	* also in gpg.c:gpgconf_list. */
	/* FIXME: We only allow the algo here and have a separate thing
	* for the curve etc. That is a ugly but demanded for backward
	* compatibility with the batch key generation. It would be
	* better to make full use of parse_key_parameter_string. */
	parse_key_parameter_string (NULL, 0,
	&i, NULL, NULL, NULL,
	NULL, NULL, NULL, NULL);

	if (r_default)
	*r_default = 1;
	}
	else if (digitp (r->u.value))
	i = atoi( r->u.value );
	else if (!strcmp (r->u.value, "ELG-E")
	\|\| !strcmp (r->u.value, "ELG"))
	i = PUBKEY_ALGO_ELGAMAL_E;
	else if (!ascii_strcasecmp (r->u.value, "EdDSA"))
	i = PUBKEY_ALGO_EDDSA;
	else if (!ascii_strcasecmp (r->u.value, "ECDSA"))
	i = PUBKEY_ALGO_ECDSA;
	else if (!ascii_strcasecmp (r->u.value, "ECDH"))
	i = PUBKEY_ALGO_ECDH;
	else
	i = map_pk_gcry_to_openpgp (gcry_pk_map_name (r->u.value));

	if (i == PUBKEY_ALGO_RSA_E \|\| i == PUBKEY_ALGO_RSA_S)
	i = 0; /* we don't want to allow generation of these algorithms */
	return i;
	}


	/* Parse a usage string. The usage keywords "auth", "sign", "encr"
	* may be delimited by space, tab, or comma. On error -1 is returned
	* instead of the usage flags. */
	static int
	parse_usagestr (const char *usagestr)
	{
	gpg_error_t err;
	char **tokens = NULL;
	const char *s;
	int i;
	unsigned int use = 0;

	tokens = strtokenize (usagestr, " \t,");
	if (!tokens)
	{
	err = gpg_error_from_syserror ();
	log_error ("strtokenize failed: %s\n", gpg_strerror (err));
	return -1;
	}

	for (i=0; (s = tokens[i]); i++)
	{
	if (!*s)
	;
	else if (!ascii_strcasecmp (s, "sign"))
	use \|= PUBKEY_USAGE_SIG;
	else if (!ascii_strcasecmp (s, "encrypt")
	\|\| !ascii_strcasecmp (s, "encr"))
	use \|= PUBKEY_USAGE_ENC;
	else if (!ascii_strcasecmp (s, "auth"))
	use \|= PUBKEY_USAGE_AUTH;
	else if (!ascii_strcasecmp (s, "cert"))
	use \|= PUBKEY_USAGE_CERT;
	else
	{
	xfree (tokens);
	return -1; /* error */
	}
	}

	xfree (tokens);
	return use;
	}


	/*
	* Parse the usage parameter and set the keyflags. Returns -1 on
	* error, 0 for no usage given or 1 for usage available.
	*/
	static int
	parse_parameter_usage (const char *fname,
	struct para_data_s *para, enum para_name key)
	{
	struct para_data_s *r = get_parameter( para, key );
	int i;

	if (!r)
	return 0; /* none (this is an optional parameter)*/

	i = parse_usagestr (r->u.value);
	if (i == -1)
	{
	log_error ("%s:%d: invalid usage list\n", fname, r->lnr );
	return -1; /* error */
	}

	r->u.usage = i;
	return 1;
	}


	static int
	parse_revocation_key (const char *fname,
	struct para_data_s *para, enum para_name key)
	{
	struct para_data_s *r = get_parameter( para, key );
	struct revocation_key revkey;
	char *pn;
	int i;

	if( !r )
	return 0; /* none (this is an optional parameter) */

	pn = r->u.value;

	revkey.class=0x80;
	revkey.algid=atoi(pn);
	if(!revkey.algid)
	goto fail;

	/* Skip to the fpr */
	while(pn && pn!=':')
	pn++;

	if(*pn!=':')
	goto fail;

	pn++;

	for(i=0;i<MAX_FINGERPRINT_LEN && *pn;i++,pn+=2)
	{
	int c=hextobyte(pn);
	if(c==-1)
	goto fail;

	revkey.fpr[i]=c;
	}

	/* skip to the tag */
	while(pn && pn!='s' && *pn!='S')
	pn++;

	if(ascii_strcasecmp(pn,"sensitive")==0)
	revkey.class\|=0x40;

	memcpy(&r->u.revkey,&revkey,sizeof(struct revocation_key));

	return 0;

	fail:
	log_error("%s:%d: invalid revocation key\n", fname, r->lnr );
	return -1; /* error */
	}


	static u32
	get_parameter_u32( struct para_data_s *para, enum para_name key )
	{
	struct para_data_s *r = get_parameter( para, key );

	if( !r )
	return 0;
	if( r->key == pKEYCREATIONDATE )
	return r->u.creation;
	if( r->key == pKEYEXPIRE \|\| r->key == pSUBKEYEXPIRE )
	return r->u.expire;
	if( r->key == pKEYUSAGE \|\| r->key == pSUBKEYUSAGE )
	return r->u.usage;

	return (unsigned int)strtoul( r->u.value, NULL, 10 );
	}

	static unsigned int
	get_parameter_uint( struct para_data_s *para, enum para_name key )
	{
	return get_parameter_u32( para, key );
	}

	static struct revocation_key *
	get_parameter_revkey( struct para_data_s *para, enum para_name key )
	{
	struct para_data_s *r = get_parameter( para, key );
	return r? &r->u.revkey : NULL;
	}

	static int
	proc_parameter_file (ctrl_t ctrl, struct para_data_s para, const char fname,
	struct output_control_s *outctrl, int card )
	{
	struct para_data_s *r;
	const char s1, s2, *s3;
	size_t n;
	char *p;
	int is_default = 0;
	int have_user_id = 0;
	int err, algo;

	/* Check that we have all required parameters. */
	r = get_parameter( para, pKEYTYPE );
	if(r)
	{
	algo = get_parameter_algo (para, pKEYTYPE, &is_default);
	if (openpgp_pk_test_algo2 (algo, PUBKEY_USAGE_SIG))
	{
	log_error ("%s:%d: invalid algorithm\n", fname, r->lnr );
	return -1;
	}
	}
	else
	{
	log_error ("%s: no Key-Type specified\n",fname);
	return -1;
	}

	err = parse_parameter_usage (fname, para, pKEYUSAGE);
	if (!err)
	{
	/* Default to algo capabilities if key-usage is not provided and
	no default algorithm has been requested. */
	r = xmalloc_clear(sizeof(*r));
	r->key = pKEYUSAGE;
	r->u.usage = (is_default
	? (PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG)
	: openpgp_pk_algo_usage(algo));
	append_to_parameter (para, r);
	}
	else if (err == -1)
	return -1;
	else
	{
	r = get_parameter (para, pKEYUSAGE);
	if (r && (r->u.usage & ~openpgp_pk_algo_usage (algo)))
	{
	log_error ("%s:%d: specified Key-Usage not allowed for algo %d\n",
	fname, r->lnr, algo);
	return -1;
	}
	}

	is_default = 0;
	r = get_parameter( para, pSUBKEYTYPE );
	if(r)
	{
	algo = get_parameter_algo (para, pSUBKEYTYPE, &is_default);
	if (openpgp_pk_test_algo (algo))
	{
	log_error ("%s:%d: invalid algorithm\n", fname, r->lnr );
	return -1;
	}

	err = parse_parameter_usage (fname, para, pSUBKEYUSAGE);
	if (!err)
	{
	/* Default to algo capabilities if subkey-usage is not
	provided */
	r = xmalloc_clear (sizeof(*r));
	r->key = pSUBKEYUSAGE;
	r->u.usage = (is_default
	? PUBKEY_USAGE_ENC
	: openpgp_pk_algo_usage (algo));
	append_to_parameter (para, r);
	}
	else if (err == -1)
	return -1;
	else
	{
	r = get_parameter (para, pSUBKEYUSAGE);
	if (r && (r->u.usage & ~openpgp_pk_algo_usage (algo)))
	{
	log_error ("%s:%d: specified Subkey-Usage not allowed"
	" for algo %d\n", fname, r->lnr, algo);
	return -1;
	}
	}
	}


	if( get_parameter_value( para, pUSERID ) )
	have_user_id=1;
	else
	{
	/* create the formatted user ID */
	s1 = get_parameter_value( para, pNAMEREAL );
	s2 = get_parameter_value( para, pNAMECOMMENT );
	s3 = get_parameter_value( para, pNAMEEMAIL );
	if( s1 \|\| s2 \|\| s3 )
	{
	n = (s1?strlen(s1):0) + (s2?strlen(s2):0) + (s3?strlen(s3):0);
	r = xmalloc_clear( sizeof *r + n + 20 );
	r->key = pUSERID;
	p = r->u.value;
	if( s1 )
	p = stpcpy(p, s1 );
	if( s2 )
	p = stpcpy(stpcpy(stpcpy(p," ("), s2 ),")");
	if( s3 )
	p = stpcpy(stpcpy(stpcpy(p," <"), s3 ),">");
	append_to_parameter (para, r);
	have_user_id=1;
	}
	}

	if(!have_user_id)
	{
	log_error("%s: no User-ID specified\n",fname);
	return -1;
	}

	/* Set preferences, if any. */
	keygen_set_std_prefs(get_parameter_value( para, pPREFERENCES ), 0);

	/* Set keyserver, if any. */
	s1=get_parameter_value( para, pKEYSERVER );
	if(s1)
	{
	struct keyserver_spec *spec;

	spec = parse_keyserver_uri (s1, 1);
	if(spec)
	{
	free_keyserver_spec(spec);
	opt.def_keyserver_url=s1;
	}
	else
	{
	r = get_parameter (para, pKEYSERVER);
	log_error("%s:%d: invalid keyserver url\n", fname, r->lnr );
	return -1;
	}
	}

	/* Set revoker, if any. */
	if (parse_revocation_key (fname, para, pREVOKER))
	return -1;


	/* Make KEYCREATIONDATE from Creation-Date. */
	r = get_parameter (para, pCREATIONDATE);
	if (r && *r->u.value)
	{
	u32 seconds;

	seconds = parse_creation_string (r->u.value);
	if (!seconds)
	{
	log_error ("%s:%d: invalid creation date\n", fname, r->lnr );
	return -1;
	}
	r->u.creation = seconds;
	r->key = pKEYCREATIONDATE; /* Change that entry. */
	}

	/* Make KEYEXPIRE from Expire-Date. */
	r = get_parameter( para, pEXPIREDATE );
	if( r && *r->u.value )
	{
	u32 seconds;

	seconds = parse_expire_string( r->u.value );
	if( seconds == (u32)-1 )
	{
	log_error("%s:%d: invalid expire date\n", fname, r->lnr );
	return -1;
	}
	r->u.expire = seconds;
	r->key = pKEYEXPIRE; /* change hat entry */
	/* also set it for the subkey */
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pSUBKEYEXPIRE;
	r->u.expire = seconds;
	append_to_parameter (para, r);
	}

	do_generate_keypair (ctrl, para, outctrl, card );
	return 0;
	}


	/****************
	* Kludge to allow non interactive key generation controlled
	* by a parameter file.
	* Note, that string parameters are expected to be in UTF-8
	*/
	static void
	read_parameter_file (ctrl_t ctrl, const char *fname )
	{
	static struct { const char *name;
	enum para_name key;
	} keywords[] = {
	{ "Key-Type", pKEYTYPE},
	{ "Key-Length", pKEYLENGTH },
	{ "Key-Curve", pKEYCURVE },
	{ "Key-Usage", pKEYUSAGE },
	{ "Subkey-Type", pSUBKEYTYPE },
	{ "Subkey-Length", pSUBKEYLENGTH },
	{ "Subkey-Curve", pSUBKEYCURVE },
	{ "Subkey-Usage", pSUBKEYUSAGE },
	{ "Name-Real", pNAMEREAL },
	{ "Name-Email", pNAMEEMAIL },
	{ "Name-Comment", pNAMECOMMENT },
	{ "Expire-Date", pEXPIREDATE },
	{ "Creation-Date", pCREATIONDATE },
	{ "Passphrase", pPASSPHRASE },
	{ "Preferences", pPREFERENCES },
	{ "Revoker", pREVOKER },
	{ "Handle", pHANDLE },
	{ "Keyserver", pKEYSERVER },
	{ "Keygrip", pKEYGRIP },
	{ NULL, 0 }
	};
	IOBUF fp;
	byte *line;
	unsigned int maxlen, nline;
	char *p;
	int lnr;
	const char *err = NULL;
	struct para_data_s para, r;
	int i;
	struct output_control_s outctrl;

	memset( &outctrl, 0, sizeof( outctrl ) );
	outctrl.pub.afx = new_armor_context ();

	if( !fname \|\| !*fname)
	fname = "-";

	fp = iobuf_open (fname);
	if (fp && is_secured_file (iobuf_get_fd (fp)))
	{
	iobuf_close (fp);
	fp = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!fp) {
	log_error (_("can't open '%s': %s\n"), fname, strerror(errno) );
	return;
	}
	iobuf_ioctl (fp, IOBUF_IOCTL_NO_CACHE, 1, NULL);

	lnr = 0;
	err = NULL;
	para = NULL;
	maxlen = 1024;
	line = NULL;
	while ( iobuf_read_line (fp, &line, &nline, &maxlen) ) {
	char keyword, value;

	lnr++;
	if( !maxlen ) {
	err = "line too long";
	break;
	}
	for( p = line; isspace((byte)p); p++ )
	;
	if( !p \|\| p == '#' )
	continue;
	keyword = p;
	if( *keyword == '%' ) {
	for( ; !isspace((byte)p); p++ )
	;
	if( *p )
	*p++ = 0;
	for( ; isspace((byte)p); p++ )
	;
	value = p;
	trim_trailing_ws( value, strlen(value) );
	if( !ascii_strcasecmp( keyword, "%echo" ) )
	log_info("%s\n", value );
	else if( !ascii_strcasecmp( keyword, "%dry-run" ) )
	outctrl.dryrun = 1;
	else if( !ascii_strcasecmp( keyword, "%ask-passphrase" ) )
	; /* Dummy for backward compatibility. */
	else if( !ascii_strcasecmp( keyword, "%no-ask-passphrase" ) )
	; /* Dummy for backward compatibility. */
	else if( !ascii_strcasecmp( keyword, "%no-protection" ) )
	outctrl.keygen_flags \|= KEYGEN_FLAG_NO_PROTECTION;
	else if( !ascii_strcasecmp( keyword, "%transient-key" ) )
	outctrl.keygen_flags \|= KEYGEN_FLAG_TRANSIENT_KEY;
	else if( !ascii_strcasecmp( keyword, "%commit" ) ) {
	outctrl.lnr = lnr;
	if (proc_parameter_file (ctrl, para, fname, &outctrl, 0 ))
	print_status_key_not_created
	(get_parameter_value (para, pHANDLE));
	release_parameter_list( para );
	para = NULL;
	}
	else if( !ascii_strcasecmp( keyword, "%pubring" ) ) {
	if( outctrl.pub.fname && !strcmp( outctrl.pub.fname, value ) )
	; /* still the same file - ignore it */
	else {
	xfree( outctrl.pub.newfname );
	outctrl.pub.newfname = xstrdup( value );
	outctrl.use_files = 1;
	}
	}
	else if( !ascii_strcasecmp( keyword, "%secring" ) ) {
	/* Ignore this command. */
	}
	else
	log_info("skipping control '%s' (%s)\n", keyword, value );


	continue;
	}


	if( !(p = strchr( p, ':' )) \|\| p == keyword ) {
	err = "missing colon";
	break;
	}
	if( *p )
	*p++ = 0;
	for( ; isspace((byte)p); p++ )
	;
	if( !*p ) {
	err = "missing argument";
	break;
	}
	value = p;
	trim_trailing_ws( value, strlen(value) );

	for(i=0; keywords[i].name; i++ ) {
	if( !ascii_strcasecmp( keywords[i].name, keyword ) )
	break;
	}
	if( !keywords[i].name ) {
	err = "unknown keyword";
	break;
	}
	if( keywords[i].key != pKEYTYPE && !para ) {
	err = "parameter block does not start with \"Key-Type\"";
	break;
	}

	if( keywords[i].key == pKEYTYPE && para ) {
	outctrl.lnr = lnr;
	if (proc_parameter_file (ctrl, para, fname, &outctrl, 0 ))
	print_status_key_not_created
	(get_parameter_value (para, pHANDLE));
	release_parameter_list( para );
	para = NULL;
	}
	else {
	for( r = para; r; r = r->next ) {
	if( r->key == keywords[i].key )
	break;
	}
	if( r ) {
	err = "duplicate keyword";
	break;
	}
	}
	r = xmalloc_clear( sizeof *r + strlen( value ) );
	r->lnr = lnr;
	r->key = keywords[i].key;
	strcpy( r->u.value, value );
	r->next = para;
	para = r;
	}
	if( err )
	log_error("%s:%d: %s\n", fname, lnr, err );
	else if( iobuf_error (fp) ) {
	log_error("%s:%d: read error\n", fname, lnr);
	}
	else if( para ) {
	outctrl.lnr = lnr;
	if (proc_parameter_file (ctrl, para, fname, &outctrl, 0 ))
	print_status_key_not_created (get_parameter_value (para, pHANDLE));
	}

	if( outctrl.use_files ) { /* close open streams */
	iobuf_close( outctrl.pub.stream );

	/* Must invalidate that ugly cache to actually close it. */
	if (outctrl.pub.fname)
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE,
	0, (char*)outctrl.pub.fname);

	xfree( outctrl.pub.fname );
	xfree( outctrl.pub.newfname );
	}

	xfree (line);
	release_parameter_list( para );
	iobuf_close (fp);
	release_armor_context (outctrl.pub.afx);
	}


	/* Helper for quick_generate_keypair. */
	static struct para_data_s *
	quickgen_set_para (struct para_data_s *para, int for_subkey,
	int algo, int nbits, const char *curve, unsigned int use)
	{
	struct para_data_s *r;

	r = xmalloc_clear (sizeof *r + 30);
	r->key = for_subkey? pSUBKEYUSAGE : pKEYUSAGE;
	if (use)
	snprintf (r->u.value, 30, "%s%s%s%s",
	(use & PUBKEY_USAGE_ENC)? "encr " : "",
	(use & PUBKEY_USAGE_SIG)? "sign " : "",
	(use & PUBKEY_USAGE_AUTH)? "auth " : "",
	(use & PUBKEY_USAGE_CERT)? "cert " : "");
	else
	strcpy (r->u.value, for_subkey ? "encr" : "sign");
	r->next = para;
	para = r;
	r = xmalloc_clear (sizeof *r + 20);
	r->key = for_subkey? pSUBKEYTYPE : pKEYTYPE;
	snprintf (r->u.value, 20, "%d", algo);
	r->next = para;
	para = r;

	if (curve)
	{
	r = xmalloc_clear (sizeof *r + strlen (curve));
	r->key = for_subkey? pSUBKEYCURVE : pKEYCURVE;
	strcpy (r->u.value, curve);
	r->next = para;
	para = r;
	}
	else
	{
	r = xmalloc_clear (sizeof *r + 20);
	r->key = for_subkey? pSUBKEYLENGTH : pKEYLENGTH;
	sprintf (r->u.value, "%u", nbits);
	r->next = para;
	para = r;
	}

	return para;
	}


	/*
	* Unattended generation of a standard key.
	*/
	void
	quick_generate_keypair (ctrl_t ctrl, const char uid, const char algostr,
	const char usagestr, const char expirestr)
	{
	gpg_error_t err;
	struct para_data_s *para = NULL;
	struct para_data_s *r;
	struct output_control_s outctrl;
	int use_tty;

	memset (&outctrl, 0, sizeof outctrl);

	use_tty = (!opt.batch && !opt.answer_yes
	&& !algostr && !usagestr && !*expirestr
	&& !cpr_enabled ()
	&& gnupg_isatty (fileno (stdin))
	&& gnupg_isatty (fileno (stdout))
	&& gnupg_isatty (fileno (stderr)));

	r = xmalloc_clear (sizeof *r + strlen (uid));
	r->key = pUSERID;
	strcpy (r->u.value, uid);
	r->next = para;
	para = r;

	uid = trim_spaces (r->u.value);
	if (!*uid \|\| (!opt.allow_freeform_uid && !is_valid_user_id (uid)))
	{
	log_error (_("Key generation failed: %s\n"),
	gpg_strerror (GPG_ERR_INV_USER_ID));
	goto leave;
	}

	/* If gpg is directly used on the console ask whether a key with the
	given user id shall really be created. */
	if (use_tty)
	{
	tty_printf (_("About to create a key for:\n \"%s\"\n\n"), uid);
	if (!cpr_get_answer_is_yes_def ("quick_keygen.okay",
	_("Continue? (Y/n) "), 1))
	goto leave;
	}

	/* Check whether such a user ID already exists. */
	{
	KEYDB_HANDLE kdbhd;
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_EXACT;
	desc.u.name = uid;

	kdbhd = keydb_new ();
	if (!kdbhd)
	goto leave;

	err = keydb_search (kdbhd, &desc, 1, NULL);
	keydb_release (kdbhd);
	if (gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	log_info (_("A key for \"%s\" already exists\n"), uid);
	if (opt.answer_yes)
	;
	else if (!use_tty
	\|\| !cpr_get_answer_is_yes_def ("quick_keygen.force",
	_("Create anyway? (y/N) "), 0))
	{
	write_status_error ("genkey", gpg_error (304));
	log_inc_errorcount (); /* we used log_info */
	goto leave;
	}
	log_info (_("creating anyway\n"));
	}
	}

	if (!*expirestr \|\| strcmp (expirestr, "-") == 0)
	expirestr = default_expiration_interval;

	if ((!*algostr \|\| !strcmp (algostr, "default")
	\|\| !strcmp (algostr, "future-default"))
	&& (!*usagestr \|\| !strcmp (usagestr, "default")
	\|\| !strcmp (usagestr, "-")))
	{
	/* Use default key parameters. */
	int algo, subalgo;
	unsigned int size, subsize;
	unsigned int keyuse, subkeyuse;
	const char curve, subcurve;

	err = parse_key_parameter_string (algostr, -1,
	&algo, &size, &keyuse, &curve,
	&subalgo, &subsize, &subkeyuse,
	&subcurve);
	if (err)
	{
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	para = quickgen_set_para (para, 0, algo, size, curve, keyuse);
	if (subalgo)
	para = quickgen_set_para (para, 1,
	subalgo, subsize, subcurve, subkeyuse);

	if (*expirestr)
	{
	u32 expire;

	expire = parse_expire_string (expirestr);
	if (expire == (u32)-1 )
	{
	err = gpg_error (GPG_ERR_INV_VALUE);
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err));
	goto leave;
	}
	r = xmalloc_clear (sizeof *r + 20);
	r->key = pKEYEXPIRE;
	r->u.expire = expire;
	r->next = para;
	para = r;
	}
	}
	else
	{
	/* Extended unattended mode. Creates only the primary key. */
	int algo;
	unsigned int use;
	u32 expire;
	unsigned int nbits;
	char *curve;

	err = parse_algo_usage_expire (ctrl, 0, algostr, usagestr, expirestr,
	&algo, &use, &expire, &nbits, &curve);
	if (err)
	{
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err) );
	goto leave;
	}

	para = quickgen_set_para (para, 0, algo, nbits, curve, use);
	r = xmalloc_clear (sizeof *r + 20);
	r->key = pKEYEXPIRE;
	r->u.expire = expire;
	r->next = para;
	para = r;
	}

	/* If the pinentry loopback mode is not and we have a static
	passphrase (i.e. set with --passphrase{,-fd,-file} while in batch
	mode), we use that passphrase for the new key. */
	if (opt.pinentry_mode != PINENTRY_MODE_LOOPBACK
	&& have_static_passphrase ())
	{
	const char *s = get_static_passphrase ();

	r = xmalloc_clear (sizeof *r + strlen (s));
	r->key = pPASSPHRASE;
	strcpy (r->u.value, s);
	r->next = para;
	para = r;
	}

	proc_parameter_file (ctrl, para, "[internal]", &outctrl, 0);

	leave:
	release_parameter_list (para);
	}


	/*
	* Generate a keypair (fname is only used in batch mode) If
	* CARD_SERIALNO is not NULL the function will create the keys on an
	* OpenPGP Card. If CARD_BACKUP_KEY has been set and CARD_SERIALNO is
	* NOT NULL, the encryption key for the card is generated on the host,
	* imported to the card and a backup file created by gpg-agent. If
	* FULL is not set only the basic prompts are used (except for batch
	* mode).
	*/
	void
	generate_keypair (ctrl_t ctrl, int full, const char *fname,
	const char *card_serialno, int card_backup_key)
	{
	gpg_error_t err;
	unsigned int nbits;
	char *uid = NULL;
	int algo;
	unsigned int use;
	int both = 0;
	u32 expire;
	struct para_data_s *para = NULL;
	struct para_data_s *r;
	struct output_control_s outctrl;

	#ifndef ENABLE_CARD_SUPPORT
	(void)card_backup_key;
	#endif

	memset( &outctrl, 0, sizeof( outctrl ) );

	if (opt.batch && card_serialno)
	{
	/* We don't yet support unattended key generation. */
	log_error (_("can't do this in batch mode\n"));
	return;
	}

	if (opt.batch)
	{
	read_parameter_file (ctrl, fname);
	return;
	}

	if (card_serialno)
	{
	#ifdef ENABLE_CARD_SUPPORT
	struct agent_card_info_s info;

	memset (&info, 0, sizeof (info));
	err = agent_scd_getattr ("KEY-ATTR", &info);
	if (err)
	{
	log_error (_("error getting current key info: %s\n"),
	gpg_strerror (err));
	return;
	}

	r = xcalloc (1, sizeof *r + strlen (card_serialno) );
	r->key = pSERIALNO;
	strcpy( r->u.value, card_serialno);
	r->next = para;
	para = r;

	r = xcalloc (1, sizeof *r + 20 );
	r->key = pKEYTYPE;
	sprintf( r->u.value, "%d", info.key_attr[0].algo );
	r->next = para;
	para = r;
	r = xcalloc (1, sizeof *r + 20 );
	r->key = pKEYUSAGE;
	strcpy (r->u.value, "sign");
	r->next = para;
	para = r;

	r = xcalloc (1, sizeof *r + 20 );
	r->key = pSUBKEYTYPE;
	sprintf( r->u.value, "%d", info.key_attr[1].algo );
	r->next = para;
	para = r;
	r = xcalloc (1, sizeof *r + 20 );
	r->key = pSUBKEYUSAGE;
	strcpy (r->u.value, "encrypt");
	r->next = para;
	para = r;
	if (info.key_attr[1].algo == PUBKEY_ALGO_RSA)
	{
	r = xcalloc (1, sizeof *r + 20 );
	r->key = pSUBKEYLENGTH;
	sprintf( r->u.value, "%u", info.key_attr[1].nbits);
	r->next = para;
	para = r;
	}
	else if (info.key_attr[1].algo == PUBKEY_ALGO_ECDSA
	\|\| info.key_attr[1].algo == PUBKEY_ALGO_EDDSA
	\|\| info.key_attr[1].algo == PUBKEY_ALGO_ECDH)
	{
	r = xcalloc (1, sizeof *r + strlen (info.key_attr[1].curve));
	r->key = pSUBKEYCURVE;
	strcpy (r->u.value, info.key_attr[1].curve);
	r->next = para;
	para = r;
	}

	r = xcalloc (1, sizeof *r + 20 );
	r->key = pAUTHKEYTYPE;
	sprintf( r->u.value, "%d", info.key_attr[2].algo );
	r->next = para;
	para = r;

	if (card_backup_key)
	{
	r = xcalloc (1, sizeof *r + 1);
	r->key = pCARDBACKUPKEY;
	strcpy (r->u.value, "1");
	r->next = para;
	para = r;
	}
	#endif /ENABLE_CARD_SUPPORT/
	}
	else if (full) /* Full featured key generation. */
	{
	int subkey_algo;
	char *key_from_hexgrip = NULL;

	algo = ask_algo (ctrl, 0, &subkey_algo, &use, &key_from_hexgrip);
	if (key_from_hexgrip)
	{
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYTYPE;
	sprintf( r->u.value, "%d", algo);
	r->next = para;
	para = r;

	if (use)
	{
	r = xmalloc_clear( sizeof *r + 25 );
	r->key = pKEYUSAGE;
	sprintf( r->u.value, "%s%s%s",
	(use & PUBKEY_USAGE_SIG)? "sign ":"",
	(use & PUBKEY_USAGE_ENC)? "encrypt ":"",
	(use & PUBKEY_USAGE_AUTH)? "auth":"" );
	r->next = para;
	para = r;
	}

	r = xmalloc_clear( sizeof *r + 40 );
	r->key = pKEYGRIP;
	strcpy (r->u.value, key_from_hexgrip);
	r->next = para;
	para = r;

	xfree (key_from_hexgrip);
	}
	else
	{
	char *curve = NULL;

	if (subkey_algo)
	{
	/* Create primary and subkey at once. */
	both = 1;
	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	{
	curve = ask_curve (&algo, &subkey_algo);
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYTYPE;
	sprintf( r->u.value, "%d", algo);
	r->next = para;
	para = r;
	nbits = 0;
	r = xmalloc_clear (sizeof *r + strlen (curve));
	r->key = pKEYCURVE;
	strcpy (r->u.value, curve);
	r->next = para;
	para = r;
	}
	else
	{
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYTYPE;
	sprintf( r->u.value, "%d", algo);
	r->next = para;
	para = r;
	nbits = ask_keysize (algo, 0);
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYLENGTH;
	sprintf( r->u.value, "%u", nbits);
	r->next = para;
	para = r;
	}
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYUSAGE;
	strcpy( r->u.value, "sign" );
	r->next = para;
	para = r;

	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pSUBKEYTYPE;
	sprintf( r->u.value, "%d", subkey_algo);
	r->next = para;
	para = r;
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pSUBKEYUSAGE;
	strcpy( r->u.value, "encrypt" );
	r->next = para;
	para = r;

	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	{
	if (algo == PUBKEY_ALGO_EDDSA
	&& subkey_algo == PUBKEY_ALGO_ECDH)
	{
	/* Need to switch to a different curve for the
	encryption key. */
	xfree (curve);
	curve = xstrdup ("Curve25519");
	}
	r = xmalloc_clear (sizeof *r + strlen (curve));
	r->key = pSUBKEYCURVE;
	strcpy (r->u.value, curve);
	r->next = para;
	para = r;
	}
	}
	else /* Create only a single key. */
	{
	/* For ECC we need to ask for the curve before storing the
	algo because ask_curve may change the algo. */
	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	{
	curve = ask_curve (&algo, NULL);
	r = xmalloc_clear (sizeof *r + strlen (curve));
	r->key = pKEYCURVE;
	strcpy (r->u.value, curve);
	r->next = para;
	para = r;
	}

	r = xmalloc_clear( sizeof *r + 20 );
	r->key = pKEYTYPE;
	sprintf( r->u.value, "%d", algo );
	r->next = para;
	para = r;

	if (use)
	{
	r = xmalloc_clear( sizeof *r + 25 );
	r->key = pKEYUSAGE;
	sprintf( r->u.value, "%s%s%s",
	(use & PUBKEY_USAGE_SIG)? "sign ":"",
	(use & PUBKEY_USAGE_ENC)? "encrypt ":"",
	(use & PUBKEY_USAGE_AUTH)? "auth":"" );
	r->next = para;
	para = r;
	}
	nbits = 0;
	}

	if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	{
	/* The curve has already been set. */
	}
	else
	{
	nbits = ask_keysize (both? subkey_algo : algo, nbits);
	r = xmalloc_clear( sizeof *r + 20 );
	r->key = both? pSUBKEYLENGTH : pKEYLENGTH;
	sprintf( r->u.value, "%u", nbits);
	r->next = para;
	para = r;
	}

	xfree (curve);
	}
	}
	else /* Default key generation. */
	{
	int subalgo;
	unsigned int size, subsize;
	unsigned int keyuse, subkeyuse;
	const char curve, subcurve;

	tty_printf ( _("Note: Use \"%s %s\""
	" for a full featured key generation dialog.\n"),
	#if USE_GPG2_HACK
	GPG_NAME "2"
	#else
	GPG_NAME
	#endif
	, "--full-generate-key" );

	err = parse_key_parameter_string (NULL, -1,
	&algo, &size, &keyuse, &curve,
	&subalgo, &subsize,
	&subkeyuse, &subcurve);
	if (err)
	{
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err));
	return;
	}
	para = quickgen_set_para (para, 0, algo, size, curve, keyuse);
	if (subalgo)
	para = quickgen_set_para (para, 1,
	subalgo, subsize, subcurve, subkeyuse);


	}


	expire = full? ask_expire_interval (0, NULL)
	: parse_expire_string (default_expiration_interval);
	r = xcalloc (1, sizeof *r + 20);
	r->key = pKEYEXPIRE;
	r->u.expire = expire;
	r->next = para;
	para = r;
	r = xcalloc (1, sizeof *r + 20);
	r->key = pSUBKEYEXPIRE;
	r->u.expire = expire;
	r->next = para;
	para = r;

	uid = ask_user_id (0, full, NULL);
	if (!uid)
	{
	log_error(_("Key generation canceled.\n"));
	release_parameter_list( para );
	return;
	}
	r = xcalloc (1, sizeof *r + strlen (uid));
	r->key = pUSERID;
	strcpy (r->u.value, uid);
	r->next = para;
	para = r;

	proc_parameter_file (ctrl, para, "[internal]", &outctrl, !!card_serialno);
	release_parameter_list (para);
	}


	/* Create and delete a dummy packet to start off a list of kbnodes. */
	static void
	start_tree(KBNODE *tree)
	{
	PACKET *pkt;

	pkt=xmalloc_clear(sizeof(*pkt));
	pkt->pkttype=PKT_NONE;
	*tree=new_kbnode(pkt);
	delete_kbnode(*tree);
	}


	/* Write the protected secret key to the file. */
	static gpg_error_t
	card_write_key_to_backup_file (PKT_public_key sk, const char backup_dir)
	{
	gpg_error_t err = 0;
	int rc;
	char keyid_buffer[2 * 8 + 1];
	char name_buffer[50];
	char *fname;
	IOBUF fp;
	mode_t oldmask;
	PACKET *pkt = NULL;

	format_keyid (pk_keyid (sk), KF_LONG, keyid_buffer, sizeof (keyid_buffer));
	snprintf (name_buffer, sizeof name_buffer, "sk_%s.gpg", keyid_buffer);

	fname = make_filename (backup_dir, name_buffer, NULL);
	/* Note that the umask call is not anymore needed because
	iobuf_create now takes care of it. However, it does not harm
	and thus we keep it. */
	oldmask = umask (077);
	if (is_secured_filename (fname))
	{
	fp = NULL;
	gpg_err_set_errno (EPERM);
	}
	else
	fp = iobuf_create (fname, 1);
	umask (oldmask);
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't create backup file '%s': %s\n"), fname, strerror (errno) );
	goto leave;
	}

	pkt = xcalloc (1, sizeof *pkt);
	pkt->pkttype = PKT_SECRET_KEY;
	pkt->pkt.secret_key = sk;

	rc = build_packet (fp, pkt);
	if (rc)
	{
	log_error ("build packet failed: %s\n", gpg_strerror (rc));
	iobuf_cancel (fp);
	}
	else
	{
	char *fprbuf;

	iobuf_close (fp);
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	log_info (_("Note: backup of card key saved to '%s'\n"), fname);

	fprbuf = hexfingerprint (sk, NULL, 0);
	write_status_text_and_buffer (STATUS_BACKUP_KEY_CREATED, fprbuf,
	fname, strlen (fname), 0);
	xfree (fprbuf);
	}

	leave:
	xfree (pkt);
	xfree (fname);
	return err;
	}


	/* Store key to card and make a backup file in OpenPGP format. */
	static gpg_error_t
	card_store_key_with_backup (ctrl_t ctrl, PKT_public_key *sub_psk,
	const char *backup_dir)
	{
	PKT_public_key *sk;
	gnupg_isotime_t timestamp;
	gpg_error_t err;
	char *hexgrip;
	int rc;
	struct agent_card_info_s info;
	gcry_cipher_hd_t cipherhd = NULL;
	char *cache_nonce = NULL;
	void *kek = NULL;
	size_t keklen;

	sk = copy_public_key (NULL, sub_psk);
	if (!sk)
	return gpg_error_from_syserror ();

	epoch2isotime (timestamp, (time_t)sk->timestamp);
	err = hexkeygrip_from_pk (sk, &hexgrip);
	if (err)
	return err;

	memset(&info, 0, sizeof (info));
	rc = agent_scd_getattr ("SERIALNO", &info);
	if (rc)
	return (gpg_error_t)rc;

	rc = agent_keytocard (hexgrip, 2, 1, info.serialno, timestamp);
	xfree (info.serialno);
	if (rc)
	{
	err = (gpg_error_t)rc;
	goto leave;
	}

	err = agent_keywrap_key (ctrl, 1, &kek, &keklen);
	if (err)
	{
	log_error ("error getting the KEK: %s\n", gpg_strerror (err));
	goto leave;
	}

	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (!err)
	err = gcry_cipher_setkey (cipherhd, kek, keklen);
	if (err)
	{
	log_error ("error setting up an encryption context: %s\n",
	gpg_strerror (err));
	goto leave;
	}

	err = receive_seckey_from_agent (ctrl, cipherhd, 0,
	&cache_nonce, hexgrip, sk);
	if (err)
	{
	log_error ("error getting secret key from agent: %s\n",
	gpg_strerror (err));
	goto leave;
	}

	err = card_write_key_to_backup_file (sk, backup_dir);
	if (err)
	log_error ("writing card key to backup file: %s\n", gpg_strerror (err));
	else
	/* Remove secret key data in agent side. */
	agent_scd_learn (NULL, 1);

	leave:
	xfree (cache_nonce);
	gcry_cipher_close (cipherhd);
	xfree (kek);
	xfree (hexgrip);
	free_public_key (sk);
	return err;
	}


	static void
	do_generate_keypair (ctrl_t ctrl, struct para_data_s *para,
	struct output_control_s *outctrl, int card)
	{
	gpg_error_t err;
	KBNODE pub_root = NULL;
	const char *s;
	PKT_public_key *pri_psk = NULL;
	PKT_public_key *sub_psk = NULL;
	struct revocation_key *revkey;
	int did_sub = 0;
	u32 timestamp;
	char *cache_nonce = NULL;
	int algo;
	u32 expire;
	const char *key_from_hexgrip = NULL;

	if (outctrl->dryrun)
	{
	log_info("dry-run mode - key generation skipped\n");
	return;
	}

	if ( outctrl->use_files )
	{
	if ( outctrl->pub.newfname )
	{
	iobuf_close(outctrl->pub.stream);
	outctrl->pub.stream = NULL;
	if (outctrl->pub.fname)
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE,
	0, (char*)outctrl->pub.fname);
	xfree( outctrl->pub.fname );
	outctrl->pub.fname = outctrl->pub.newfname;
	outctrl->pub.newfname = NULL;

	if (is_secured_filename (outctrl->pub.fname) )
	{
	outctrl->pub.stream = NULL;
	gpg_err_set_errno (EPERM);
	}
	else
	outctrl->pub.stream = iobuf_create (outctrl->pub.fname, 0);
	if (!outctrl->pub.stream)
	{
	log_error(_("can't create '%s': %s\n"), outctrl->pub.newfname,
	strerror(errno) );
	return;
	}
	if (opt.armor)
	{
	outctrl->pub.afx->what = 1;
	push_armor_filter (outctrl->pub.afx, outctrl->pub.stream);
	}
	}
	log_assert( outctrl->pub.stream );
	if (opt.verbose)
	log_info (_("writing public key to '%s'\n"), outctrl->pub.fname );
	}


	/* We create the packets as a tree of kbnodes. Because the
	structure we create is known in advance we simply generate a
	linked list. The first packet is a dummy packet which we flag as
	deleted. The very first packet must always be a KEY packet. */

	start_tree (&pub_root);

	timestamp = get_parameter_u32 (para, pKEYCREATIONDATE);
	if (!timestamp)
	timestamp = make_timestamp ();

	/* Note that, depending on the backend (i.e. the used scdaemon
	version), the card key generation may update TIMESTAMP for each
	key. Thus we need to pass TIMESTAMP to all signing function to
	make sure that the binding signature is done using the timestamp
	of the corresponding (sub)key and not that of the primary key.
	An alternative implementation could tell the signing function the
	node of the subkey but that is more work than just to pass the
	current timestamp. */

	algo = get_parameter_algo( para, pKEYTYPE, NULL );
	expire = get_parameter_u32( para, pKEYEXPIRE );
	key_from_hexgrip = get_parameter_value (para, pKEYGRIP);
	if (key_from_hexgrip)
	err = do_create_from_keygrip (ctrl, algo, key_from_hexgrip,
	pub_root, timestamp, expire, 0);
	else if (!card)
	err = do_create (algo,
	get_parameter_uint( para, pKEYLENGTH ),
	get_parameter_value (para, pKEYCURVE),
	pub_root,
	timestamp,
	expire, 0,
	outctrl->keygen_flags,
	get_parameter_passphrase (para),
	&cache_nonce, NULL);
	else
	err = gen_card_key (1, algo,
	1, pub_root, &timestamp,
	expire);

	/* Get the pointer to the generated public key packet. */
	if (!err)
	{
	pri_psk = pub_root->next->pkt->pkt.public_key;
	log_assert (pri_psk);

	/* Make sure a few fields are correctly set up before going
	further. */
	pri_psk->flags.primary = 1;
	keyid_from_pk (pri_psk, NULL);
	/* We don't use pk_keyid to get keyid, because it also asserts
	that main_keyid is set! */
	keyid_copy (pri_psk->main_keyid, pri_psk->keyid);
	}

	if (!err && (revkey = get_parameter_revkey (para, pREVOKER)))
	err = write_direct_sig (pub_root, pri_psk, revkey, timestamp, cache_nonce);

	if (!err && (s = get_parameter_value (para, pUSERID)))
	{
	write_uid (pub_root, s );
	err = write_selfsigs (pub_root, pri_psk,
	get_parameter_uint (para, pKEYUSAGE), timestamp,
	cache_nonce);
	}

	/* Write the auth key to the card before the encryption key. This
	is a partial workaround for a PGP bug (as of this writing, all
	versions including 8.1), that causes it to try and encrypt to
	the most recent subkey regardless of whether that subkey is
	actually an encryption type. In this case, the auth key is an
	RSA key so it succeeds. */

	if (!err && card && get_parameter (para, pAUTHKEYTYPE))
	{
	err = gen_card_key (3, get_parameter_algo( para, pAUTHKEYTYPE, NULL ),
	0, pub_root, &timestamp,
	get_parameter_u32 (para, pKEYEXPIRE));
	if (!err)
	err = write_keybinding (pub_root, pri_psk, NULL,
	PUBKEY_USAGE_AUTH, timestamp, cache_nonce);
	}

	if (!err && get_parameter (para, pSUBKEYTYPE))
	{
	sub_psk = NULL;
	s = NULL;
	if (!card \|\| (s = get_parameter_value (para, pCARDBACKUPKEY)))
	{
	err = do_create (get_parameter_algo (para, pSUBKEYTYPE, NULL),
	get_parameter_uint (para, pSUBKEYLENGTH),
	get_parameter_value (para, pSUBKEYCURVE),
	pub_root,
	timestamp,
	get_parameter_u32 (para, pSUBKEYEXPIRE), 1,
	s ? KEYGEN_FLAG_NO_PROTECTION : outctrl->keygen_flags,
	get_parameter_passphrase (para),
	&cache_nonce, NULL);
	/* Get the pointer to the generated public subkey packet. */
	if (!err)
	{
	kbnode_t node;

	for (node = pub_root; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	sub_psk = node->pkt->pkt.public_key;
	log_assert (sub_psk);

	if (s)
	err = card_store_key_with_backup (ctrl,
	sub_psk, gnupg_homedir ());
	}
	}
	else
	{
	err = gen_card_key (2, get_parameter_algo (para, pSUBKEYTYPE, NULL),
	0, pub_root, &timestamp,
	get_parameter_u32 (para, pKEYEXPIRE));
	}

	if (!err)
	err = write_keybinding (pub_root, pri_psk, sub_psk,
	get_parameter_uint (para, pSUBKEYUSAGE),
	timestamp, cache_nonce);
	did_sub = 1;
	}

	if (!err && outctrl->use_files) /* Direct write to specified files. */
	{
	err = write_keyblock (outctrl->pub.stream, pub_root);
	if (err)
	log_error ("can't write public key: %s\n", gpg_strerror (err));
	}
	else if (!err) /* Write to the standard keyrings. */
	{
	KEYDB_HANDLE pub_hd;

	pub_hd = keydb_new ();
	if (!pub_hd)
	err = gpg_error_from_syserror ();
	else
	{
	err = keydb_locate_writable (pub_hd);
	if (err)
	log_error (_("no writable public keyring found: %s\n"),
	gpg_strerror (err));
	}

	if (!err && opt.verbose)
	{
	log_info (_("writing public key to '%s'\n"),
	keydb_get_resource_name (pub_hd));
	}

	if (!err)
	{
	err = keydb_insert_keyblock (pub_hd, pub_root);
	if (err)
	log_error (_("error writing public keyring '%s': %s\n"),
	keydb_get_resource_name (pub_hd), gpg_strerror (err));
	}

	keydb_release (pub_hd);

	if (!err)
	{
	int no_enc_rsa;
	PKT_public_key *pk;

	no_enc_rsa = ((get_parameter_algo (para, pKEYTYPE, NULL)
	== PUBKEY_ALGO_RSA)
	&& get_parameter_uint (para, pKEYUSAGE)
	&& !((get_parameter_uint (para, pKEYUSAGE)
	& PUBKEY_USAGE_ENC)) );

	pk = find_kbnode (pub_root, PKT_PUBLIC_KEY)->pkt->pkt.public_key;

	keyid_from_pk (pk, pk->main_keyid);
	register_trusted_keyid (pk->main_keyid);

	update_ownertrust (pk, ((get_ownertrust (pk) & ~TRUST_MASK)
	\| TRUST_ULTIMATE ));

	gen_standard_revoke (pk, cache_nonce);

	/* Get rid of the first empty packet. */
	commit_kbnode (&pub_root);

	if (!opt.batch)
	{
	tty_printf (_("public and secret key created and signed.\n") );
	tty_printf ("\n");
	merge_keys_and_selfsig (pub_root);
	list_keyblock_direct (ctrl, pub_root, 0, 1, 1, 1);
	}


	if (!opt.batch
	&& (get_parameter_algo (para, pKEYTYPE, NULL) == PUBKEY_ALGO_DSA
	\|\| no_enc_rsa )
	&& !get_parameter (para, pSUBKEYTYPE) )
	{
	tty_printf(_("Note that this key cannot be used for "
	"encryption. You may want to use\n"
	"the command \"--edit-key\" to generate a "
	"subkey for this purpose.\n") );
	}
	}
	}

	if (err)
	{
	if (opt.batch)
	log_error ("key generation failed: %s\n", gpg_strerror (err) );
	else
	tty_printf (_("Key generation failed: %s\n"), gpg_strerror (err) );
	write_status_error (card? "card_key_generate":"key_generate", err);
	print_status_key_not_created ( get_parameter_value (para, pHANDLE) );
	}
	else
	{
	PKT_public_key *pk = find_kbnode (pub_root,
	PKT_PUBLIC_KEY)->pkt->pkt.public_key;
	print_status_key_created (did_sub? 'B':'P', pk,
	get_parameter_value (para, pHANDLE));
	}

	release_kbnode (pub_root);
	xfree (cache_nonce);
	}


	static gpg_error_t
	parse_algo_usage_expire (ctrl_t ctrl, int for_subkey,
	const char algostr, const char usagestr,
	const char *expirestr,
	int r_algo, unsigned int r_usage, u32 *r_expire,
	unsigned int r_nbits, char *r_curve)
	{
	gpg_error_t err;
	int algo;
	unsigned int use, nbits;
	u32 expire;
	int wantuse;
	const char *curve = NULL;

	*r_curve = NULL;

	nbits = 0;

	/* Parse the algo string. */
	if (algostr && *algostr == '&' && strlen (algostr) == 41)
	{
	/* Take algo from existing key. */
	algo = check_keygrip (ctrl, algostr+1);
	/* FIXME: We need the curve name as well. */
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	}

	err = parse_key_parameter_string (algostr, for_subkey? 1 : 0,
	&algo, &nbits, &use, &curve,
	NULL, NULL, NULL, NULL);
	if (err)
	return err;

	/* Parse the usage string. */
	if (!usagestr \|\| !*usagestr
	\|\| !strcmp (usagestr, "default") \|\| !strcmp (usagestr, "-"))
	; /* Keep usage from parse_key_parameter_string. */
	else if ((wantuse = parse_usagestr (usagestr)) != -1)
	use = wantuse;
	else
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Make sure a primary key has the CERT usage. */
	if (!for_subkey)
	use \|= PUBKEY_USAGE_CERT;

	/* Check that usage is possible. NB: We have the same check in
	* parse_key_parameter_string but need it here again in case the
	* separate usage value has been given. */
	if (/**/((use & (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_AUTH\|PUBKEY_USAGE_CERT))
	&& !pubkey_get_nsig (algo))
	\|\| ((use & PUBKEY_USAGE_ENC)
	&& !pubkey_get_nenc (algo))
	\|\| (for_subkey && (use & PUBKEY_USAGE_CERT)))
	return gpg_error (GPG_ERR_WRONG_KEY_USAGE);

	/* Parse the expire string. */
	expire = parse_expire_string (expirestr);
	if (expire == (u32)-1 )
	return gpg_error (GPG_ERR_INV_VALUE);

	if (curve)
	{
	*r_curve = xtrystrdup (curve);
	if (!*r_curve)
	return gpg_error_from_syserror ();
	}
	*r_algo = algo;
	*r_usage = use;
	*r_expire = expire;
	*r_nbits = nbits;
	return 0;
	}


	/* Add a new subkey to an existing key. Returns 0 if a new key has
	been generated and put into the keyblocks. If any of ALGOSTR,
	USAGESTR, or EXPIRESTR is NULL interactive mode is used. */
	gpg_error_t
	generate_subkeypair (ctrl_t ctrl, kbnode_t keyblock, const char *algostr,
	const char usagestr, const char expirestr)
	{
	gpg_error_t err = 0;
	int interactive;
	kbnode_t node;
	PKT_public_key *pri_psk = NULL;
	PKT_public_key *sub_psk = NULL;
	int algo;
	unsigned int use;
	u32 expire;
	unsigned int nbits = 0;
	char *curve = NULL;
	u32 cur_time;
	char *key_from_hexgrip = NULL;
	char *hexgrip = NULL;
	char *serialno = NULL;
	char *cache_nonce = NULL;
	char *passwd_nonce = NULL;

	interactive = (!algostr \|\| !usagestr \|\| !expirestr);

	/* Break out the primary key. */
	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	{
	log_error ("Oops; primary key missing in keyblock!\n");
	err = gpg_error (GPG_ERR_BUG);
	goto leave;
	}
	pri_psk = node->pkt->pkt.public_key;

	cur_time = make_timestamp ();

	if (pri_psk->timestamp > cur_time)
	{
	ulong d = pri_psk->timestamp - cur_time;
	log_info ( d==1 ? _("key has been created %lu second "
	"in future (time warp or clock problem)\n")
	: _("key has been created %lu seconds "
	"in future (time warp or clock problem)\n"), d );
	if (!opt.ignore_time_conflict)
	{
	err = gpg_error (GPG_ERR_TIME_CONFLICT);
	goto leave;
	}
	}

	if (pri_psk->version < 4)
	{
	log_info (_("Note: creating subkeys for v3 keys "
	"is not OpenPGP compliant\n"));
	err = gpg_error (GPG_ERR_CONFLICT);
	goto leave;
	}

	err = hexkeygrip_from_pk (pri_psk, &hexgrip);
	if (err)
	goto leave;
	if (agent_get_keyinfo (NULL, hexgrip, &serialno, NULL))
	{
	if (interactive)
	tty_printf (_("Secret parts of primary key are not available.\n"));
	else
	log_info ( _("Secret parts of primary key are not available.\n"));
	err = gpg_error (GPG_ERR_NO_SECKEY);
	goto leave;
	}
	if (serialno)
	{
	if (interactive)
	tty_printf (_("Secret parts of primary key are stored on-card.\n"));
	else
	log_info ( _("Secret parts of primary key are stored on-card.\n"));
	}

	if (interactive)
	{
	algo = ask_algo (ctrl, 1, NULL, &use, &key_from_hexgrip);
	log_assert (algo);

	if (key_from_hexgrip)
	nbits = 0;
	else if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH)
	curve = ask_curve (&algo, NULL);
	else
	nbits = ask_keysize (algo, 0);

	expire = ask_expire_interval (0, NULL);
	if (!cpr_enabled() && !cpr_get_answer_is_yes("keygen.sub.okay",
	_("Really create? (y/N) ")))
	{
	err = gpg_error (GPG_ERR_CANCELED);
	goto leave;
	}
	}
	else /* Unattended mode. */
	{
	err = parse_algo_usage_expire (ctrl, 1, algostr, usagestr, expirestr,
	&algo, &use, &expire, &nbits, &curve);
	if (err)
	goto leave;
	}

	/* Verify the passphrase now so that we get a cache item for the
	* primary key passphrase. The agent also returns a passphrase
	* nonce, which we can use to set the passphrase for the subkey to
	* that of the primary key. */
	{
	char *desc = gpg_format_keydesc (pri_psk, FORMAT_KEYDESC_NORMAL, 1);
	err = agent_passwd (ctrl, hexgrip, desc, 1 /=verify/,
	&cache_nonce, &passwd_nonce);
	xfree (desc);
	}

	/* Start creation. */
	if (key_from_hexgrip)
	{
	err = do_create_from_keygrip (ctrl, algo, key_from_hexgrip,
	keyblock, cur_time, expire, 1);
	}
	else
	{
	const char *passwd;

	/* If the pinentry loopback mode is not and we have a static
	passphrase (i.e. set with --passphrase{,-fd,-file} while in batch
	mode), we use that passphrase for the new subkey. */
	if (opt.pinentry_mode != PINENTRY_MODE_LOOPBACK
	&& have_static_passphrase ())
	passwd = get_static_passphrase ();
	else
	passwd = NULL;

	err = do_create (algo, nbits, curve,
	keyblock, cur_time, expire, 1, 0,
	passwd, &cache_nonce, &passwd_nonce);
	}
	if (err)
	goto leave;

	/* Get the pointer to the generated public subkey packet. */
	for (node = keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	sub_psk = node->pkt->pkt.public_key;

	/* Write the binding signature. */
	err = write_keybinding (keyblock, pri_psk, sub_psk, use, cur_time,
	cache_nonce);
	if (err)
	goto leave;

	print_status_key_created ('S', sub_psk, NULL);


	leave:
	xfree (key_from_hexgrip);
	xfree (curve);
	xfree (hexgrip);
	xfree (serialno);
	xfree (cache_nonce);
	xfree (passwd_nonce);
	if (err)
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err) );
	return err;
	}


	#ifdef ENABLE_CARD_SUPPORT
	/* Generate a subkey on a card. */
	gpg_error_t
	generate_card_subkeypair (kbnode_t pub_keyblock,
	int keyno, const char *serialno)
	{
	gpg_error_t err = 0;
	kbnode_t node;
	PKT_public_key *pri_pk = NULL;
	unsigned int use;
	u32 expire;
	u32 cur_time;
	struct para_data_s *para = NULL;
	PKT_public_key *sub_pk = NULL;
	int algo;
	struct agent_card_info_s info;

	log_assert (keyno >= 1 && keyno <= 3);

	memset (&info, 0, sizeof (info));
	err = agent_scd_getattr ("KEY-ATTR", &info);
	if (err)
	{
	log_error (_("error getting current key info: %s\n"), gpg_strerror (err));
	return err;
	}
	algo = info.key_attr[keyno-1].algo;

	para = xtrycalloc (1, sizeof *para + strlen (serialno) );
	if (!para)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	para->key = pSERIALNO;
	strcpy (para->u.value, serialno);

	/* Break out the primary secret key */
	node = find_kbnode (pub_keyblock, PKT_PUBLIC_KEY);
	if (!node)
	{
	log_error ("Oops; publkic key lost!\n");
	err = gpg_error (GPG_ERR_INTERNAL);
	goto leave;
	}
	pri_pk = node->pkt->pkt.public_key;

	cur_time = make_timestamp();
	if (pri_pk->timestamp > cur_time)
	{
	ulong d = pri_pk->timestamp - cur_time;
	log_info (d==1 ? _("key has been created %lu second "
	"in future (time warp or clock problem)\n")
	: _("key has been created %lu seconds "
	"in future (time warp or clock problem)\n"), d );
	if (!opt.ignore_time_conflict)
	{
	err = gpg_error (GPG_ERR_TIME_CONFLICT);
	goto leave;
	}
	}

	if (pri_pk->version < 4)
	{
	log_info (_("Note: creating subkeys for v3 keys "
	"is not OpenPGP compliant\n"));
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	goto leave;
	}

	expire = ask_expire_interval (0, NULL);
	if (keyno == 1)
	use = PUBKEY_USAGE_SIG;
	else if (keyno == 2)
	use = PUBKEY_USAGE_ENC;
	else
	use = PUBKEY_USAGE_AUTH;
	if (!cpr_enabled() && !cpr_get_answer_is_yes("keygen.cardsub.okay",
	_("Really create? (y/N) ")))
	{
	err = gpg_error (GPG_ERR_CANCELED);
	goto leave;
	}

	/* Note, that depending on the backend, the card key generation may
	update CUR_TIME. */
	err = gen_card_key (keyno, algo, 0, pub_keyblock, &cur_time, expire);
	/* Get the pointer to the generated public subkey packet. */
	if (!err)
	{
	for (node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	sub_pk = node->pkt->pkt.public_key;
	log_assert (sub_pk);
	err = write_keybinding (pub_keyblock, pri_pk, sub_pk,
	use, cur_time, NULL);
	}

	leave:
	if (err)
	log_error (_("Key generation failed: %s\n"), gpg_strerror (err) );
	else
	print_status_key_created ('S', sub_pk, NULL);
	release_parameter_list (para);
	return err;
	}
	#endif /* !ENABLE_CARD_SUPPORT */

	/*
	* Write a keyblock to an output stream
	*/
	static int
	write_keyblock( IOBUF out, KBNODE node )
	{
	for( ; node ; node = node->next )
	{
	if(!is_deleted_kbnode(node))
	{
	int rc = build_packet( out, node->pkt );
	if( rc )
	{
	log_error("build_packet(%d) failed: %s\n",
	node->pkt->pkttype, gpg_strerror (rc) );
	return rc;
	}
	}
	}

	return 0;
	}


	/* Note that timestamp is an in/out arg. */
	static gpg_error_t
	gen_card_key (int keyno, int algo, int is_primary, kbnode_t pub_root,
	u32 *timestamp, u32 expireval)
	{
	#ifdef ENABLE_CARD_SUPPORT
	gpg_error_t err;
	PACKET *pkt;
	PKT_public_key *pk;
	char keyid[10];
	unsigned char *public;
	gcry_sexp_t s_key;

	snprintf (keyid, DIM(keyid), "OPENPGP.%d", keyno);

	pk = xtrycalloc (1, sizeof *pk );
	if (!pk)
	return gpg_error_from_syserror ();
	pkt = xtrycalloc (1, sizeof *pkt);
	if (!pkt)
	{
	xfree (pk);
	return gpg_error_from_syserror ();
	}

	/* Note: SCD knows the serialnumber, thus there is no point in passing it. */
	err = agent_scd_genkey (keyno, 1, timestamp);
	/* The code below is not used because we force creation of
	* the a card key (3rd arg).
	* if (gpg_err_code (rc) == GPG_ERR_EEXIST)
	* {
	* tty_printf ("\n");
	* log_error ("WARNING: key does already exists!\n");
	* tty_printf ("\n");
	* if ( cpr_get_answer_is_yes( "keygen.card.replace_key",
	* _("Replace existing key? ")))
	* rc = agent_scd_genkey (keyno, 1, timestamp);
	* }
	*/
	if (err)
	{
	log_error ("key generation failed: %s\n", gpg_strerror (err));
	xfree (pkt);
	xfree (pk);
	return err;
	}

	/* Send the READKEY command so that the agent creates a shadow key for
	card key. We need to do that now so that we are able to create
	the self-signatures. */
	err = agent_readkey (NULL, 1, keyid, &public);
	if (err)
	return err;
	err = gcry_sexp_sscan (&s_key, NULL, public,
	gcry_sexp_canon_len (public, 0, NULL, NULL));
	xfree (public);
	if (err)
	return err;

	if (algo == PUBKEY_ALGO_RSA)
	err = key_from_sexp (pk->pkey, s_key, "public-key", "ne");
	else if (algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA
	\|\| algo == PUBKEY_ALGO_ECDH )
	err = ecckey_from_sexp (pk->pkey, s_key, algo);
	else
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);
	gcry_sexp_release (s_key);

	if (err)
	{
	log_error ("key_from_sexp failed: %s\n", gpg_strerror (err) );
	free_public_key (pk);
	return err;
	}

	pk->timestamp = *timestamp;
	pk->version = 4;
	if (expireval)
	pk->expiredate = pk->timestamp + expireval;
	pk->pubkey_algo = algo;

	pkt->pkttype = is_primary ? PKT_PUBLIC_KEY : PKT_PUBLIC_SUBKEY;
	pkt->pkt.public_key = pk;
	add_kbnode (pub_root, new_kbnode (pkt));

	return 0;
	#else
	(void)keyno;
	(void)is_primary;
	(void)pub_root;
	(void)timestamp;
	(void)expireval;
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	#endif /!ENABLE_CARD_SUPPORT/
	}
	diff --git a/g10/keyid.c b/g10/keyid.c
	index dd098fd19..6e8d97fa2 100644
	--- a/g10/keyid.c
	+++ b/g10/keyid.c
	@@ -1,981 +1,981 @@
	/* keyid.c - key ID and fingerprint handling
	* Copyright (C) 1998, 1999, 2000, 2001, 2003,
	* 2004, 2006, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	* Copyright (C) 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <time.h>

	#include "gpg.h"
	#include "util.h"
	#include "main.h"
	#include "packet.h"
	#include "options.h"
	#include "keydb.h"
	#include "i18n.h"
	#include "rmd160.h"
	#include "host2net.h"


	#define KEYID_STR_SIZE 19

	#ifdef HAVE_UNSIGNED_TIME_T
	# define IS_INVALID_TIME_T(a) ((a) == (time_t)(-1))
	#else
	/* Error or 32 bit time_t and value after 2038-01-19. */
	# define IS_INVALID_TIME_T(a) ((a) < 0)
	#endif


	/* Return a letter describing the public key algorithms. */
	int
	pubkey_letter( int algo )
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA: return 'R' ;
	case PUBKEY_ALGO_RSA_E: return 'r' ;
	case PUBKEY_ALGO_RSA_S: return 's' ;
	case PUBKEY_ALGO_ELGAMAL_E: return 'g' ;
	case PUBKEY_ALGO_ELGAMAL: return 'G' ;
	case PUBKEY_ALGO_DSA: return 'D' ;
	case PUBKEY_ALGO_ECDH: return 'e' ; /* ECC DH (encrypt only) */
	case PUBKEY_ALGO_ECDSA: return 'E' ; /* ECC DSA (sign only) */
	case PUBKEY_ALGO_EDDSA: return 'E' ; /* ECC EdDSA (sign only) */
	default: return '?';
	}
	}

	/* Return a string describing the public key algorithm and the
	keysize. For elliptic curves the functions prints the name of the
	curve because the keysize is a property of the curve. The string
	is copied to the supplied buffer up a length of BUFSIZE-1.
	Examples for the output are:

	"rsa2048" - RSA with 2048 bit
	"elg1024" - Elgamal with 1024 bit
	"ed25519" - ECC using the curve Ed25519.
	"E_1.2.3.4" - ECC using the unsupported curve with OID "1.2.3.4".
	"E_1.3.6.1.4.1.11591.2.12242973" ECC with a bogus OID.
	"unknown_N" - Unknown OpenPGP algorithm N.

	If the option --legacy-list-mode is active, the output use the
	legacy format:

	"2048R" - RSA with 2048 bit
	"1024g" - Elgamal with 1024 bit
	"256E" - ECDSA using a curve with 256 bit

	The macro PUBKEY_STRING_SIZE may be used to allocate a buffer with
	a suitable size.*/
	char *
	pubkey_string (PKT_public_key pk, char buffer, size_t bufsize)
	{
	const char *prefix = NULL;

	if (opt.legacy_list_mode)
	{
	snprintf (buffer, bufsize, "%4u%c",
	nbits_from_pk (pk), pubkey_letter (pk->pubkey_algo));
	return buffer;
	}

	switch (pk->pubkey_algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: prefix = "rsa"; break;
	case PUBKEY_ALGO_ELGAMAL_E: prefix = "elg"; break;
	case PUBKEY_ALGO_DSA: prefix = "dsa"; break;
	case PUBKEY_ALGO_ELGAMAL: prefix = "xxx"; break;
	case PUBKEY_ALGO_ECDH:
	case PUBKEY_ALGO_ECDSA:
	case PUBKEY_ALGO_EDDSA: prefix = ""; break;
	}

	if (prefix && *prefix)
	snprintf (buffer, bufsize, "%s%u", prefix, nbits_from_pk (pk));
	else if (prefix)
	{
	char *curve = openpgp_oid_to_str (pk->pkey[0]);
	const char *name = openpgp_oid_to_curve (curve, 0);

	if (name)
	snprintf (buffer, bufsize, "%s", name);
	else if (curve)
	snprintf (buffer, bufsize, "E_%s", curve);
	else
	snprintf (buffer, bufsize, "E_error");
	xfree (curve);
	}
	else
	snprintf (buffer, bufsize, "unknown_%u", (unsigned int)pk->pubkey_algo);

	return buffer;
	}


	/* Hash a public key. This function is useful for v4 fingerprints and
	for v3 or v4 key signing. */
	void
	hash_public_key (gcry_md_hd_t md, PKT_public_key *pk)
	{
	unsigned int n = 6;
	unsigned int nn[PUBKEY_MAX_NPKEY];
	byte *pp[PUBKEY_MAX_NPKEY];
	int i;
	unsigned int nbits;
	size_t nbytes;
	int npkey = pubkey_get_npkey (pk->pubkey_algo);

	/* FIXME: We can avoid the extra malloc by calling only the first
	mpi_print here which computes the required length and calling the
	real mpi_print only at the end. The speed advantage would only be
	for ECC (opaque MPIs) or if we could implement an mpi_print
	variant with a callback handler to do the hashing. */
	if (npkey==0 && pk->pkey[0]
	&& gcry_mpi_get_flag (pk->pkey[0], GCRYMPI_FLAG_OPAQUE))
	{
	pp[0] = gcry_mpi_get_opaque (pk->pkey[0], &nbits);
	nn[0] = (nbits+7)/8;
	n+=nn[0];
	}
	else
	{
	for (i=0; i < npkey; i++ )
	{
	if (!pk->pkey[i])
	{
	/* This case may only happen if the parsing of the MPI
	failed but the key was anyway created. May happen
	during "gpg KEYFILE". */
	pp[i] = NULL;
	nn[i] = 0;
	}
	else if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_OPAQUE))
	{
	const void *p;

	p = gcry_mpi_get_opaque (pk->pkey[i], &nbits);
	pp[i] = xmalloc ((nbits+7)/8);
	if (p)
	memcpy (pp[i], p, (nbits+7)/8);
	else
	pp[i] = NULL;
	nn[i] = (nbits+7)/8;
	n += nn[i];
	}
	else
	{
	if (gcry_mpi_print (GCRYMPI_FMT_PGP, NULL, 0,
	&nbytes, pk->pkey[i]))
	BUG ();
	pp[i] = xmalloc (nbytes);
	if (gcry_mpi_print (GCRYMPI_FMT_PGP, pp[i], nbytes,
	&nbytes, pk->pkey[i]))
	BUG ();
	nn[i] = nbytes;
	n += nn[i];
	}
	}
	}

	gcry_md_putc ( md, 0x99 ); /* ctb */
	- /* What does it mean if n is greater than than 0xFFFF ? */
	+ /* What does it mean if n is greater than 0xFFFF ? */
	gcry_md_putc ( md, n >> 8 ); /* 2 byte length header */
	gcry_md_putc ( md, n );
	gcry_md_putc ( md, pk->version );

	gcry_md_putc ( md, pk->timestamp >> 24 );
	gcry_md_putc ( md, pk->timestamp >> 16 );
	gcry_md_putc ( md, pk->timestamp >> 8 );
	gcry_md_putc ( md, pk->timestamp );

	gcry_md_putc ( md, pk->pubkey_algo );

	if(npkey==0 && pk->pkey[0]
	&& gcry_mpi_get_flag (pk->pkey[0], GCRYMPI_FLAG_OPAQUE))
	{
	if (pp[0])
	gcry_md_write (md, pp[0], nn[0]);
	}
	else
	{
	for(i=0; i < npkey; i++ )
	{
	if (pp[i])
	gcry_md_write ( md, pp[i], nn[i] );
	xfree(pp[i]);
	}
	}
	}


	static gcry_md_hd_t
	do_fingerprint_md( PKT_public_key *pk )
	{
	gcry_md_hd_t md;

	if (gcry_md_open (&md, DIGEST_ALGO_SHA1, 0))
	BUG ();
	hash_public_key(md,pk);
	gcry_md_final( md );

	return md;
	}


	/* fixme: Check whether we can replace this function or if not
	describe why we need it. */
	u32
	v3_keyid (gcry_mpi_t a, u32 *ki)
	{
	byte buffer, p;
	size_t nbytes;

	if (gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &nbytes, a ))
	BUG ();
	/* fixme: allocate it on the stack */
	buffer = xmalloc (nbytes);
	if (gcry_mpi_print( GCRYMPI_FMT_USG, buffer, nbytes, NULL, a ))
	BUG ();
	if (nbytes < 8) /* oops */
	ki[0] = ki[1] = 0;
	else
	{
	p = buffer + nbytes - 8;
	ki[0] = buf32_to_u32 (p);
	p += 4;
	ki[1] = buf32_to_u32 (p);
	}
	xfree (buffer);
	return ki[1];
	}


	/* Return PK's keyid. The memory is owned by PK. */
	u32 *
	pk_keyid (PKT_public_key *pk)
	{
	keyid_from_pk (pk, NULL);

	/* Uncomment this for help tracking down bugs related to keyid or
	main_keyid not being set correctly. */
	#if 0
	if (! (pk->main_keyid[0] \|\| pk->main_keyid[1]))
	log_bug ("pk->main_keyid not set!\n");
	if (keyid_cmp (pk->keyid, pk->main_keyid) == 0
	&& ! pk->flags.primary)
	log_bug ("keyid and main_keyid are the same, but primary flag not set!\n");
	if (keyid_cmp (pk->keyid, pk->main_keyid) != 0
	&& pk->flags.primary)
	log_bug ("keyid and main_keyid are different, but primary flag set!\n");
	#endif

	return pk->keyid;
	}

	/* Return the keyid of the primary key associated with PK. The memory
	is owned by PK. */
	u32 *
	pk_main_keyid (PKT_public_key *pk)
	{
	/* Uncomment this for help tracking down bugs related to keyid or
	main_keyid not being set correctly. */
	#if 0
	if (! (pk->main_keyid[0] \|\| pk->main_keyid[1]))
	log_bug ("pk->main_keyid not set!\n");
	#endif

	return pk->main_keyid;
	}

	/* Copy the keyid in SRC to DEST and return DEST. */
	u32 *
	keyid_copy (u32 dest, const u32 src)
	{
	dest[0] = src[0];
	dest[1] = src[1];
	return dest;
	}

	char *
	format_keyid (u32 keyid, int format, char buffer, int len)
	{
	char tmp[KEYID_STR_SIZE];
	if (! buffer)
	{
	buffer = tmp;
	len = sizeof (tmp);
	}

	if (format == KF_DEFAULT)
	format = opt.keyid_format;
	if (format == KF_DEFAULT)
	format = KF_NONE;

	switch (format)
	{
	case KF_NONE:
	if (len)
	*buffer = 0;
	break;

	case KF_SHORT:
	snprintf (buffer, len, "%08lX", (ulong)keyid[1]);
	break;

	case KF_LONG:
	snprintf (buffer, len, "%08lX%08lX", (ulong)keyid[0], (ulong)keyid[1]);
	break;

	case KF_0xSHORT:
	snprintf (buffer, len, "0x%08lX", (ulong)keyid[1]);
	break;

	case KF_0xLONG:
	snprintf (buffer, len, "0x%08lX%08lX", (ulong)keyid[0],(ulong)keyid[1]);
	break;

	default:
	BUG();
	}

	if (buffer == tmp)
	return xstrdup (buffer);
	return buffer;
	}

	size_t
	keystrlen(void)
	{
	int format = opt.keyid_format;
	if (format == KF_DEFAULT)
	format = KF_NONE;

	switch(format)
	{
	case KF_NONE:
	return 0;

	case KF_SHORT:
	return 8;

	case KF_LONG:
	return 16;

	case KF_0xSHORT:
	return 10;

	case KF_0xLONG:
	return 18;

	default:
	BUG();
	}
	}


	const char *
	keystr (u32 *keyid)
	{
	static char keyid_str[KEYID_STR_SIZE];
	int format = opt.keyid_format;

	if (format == KF_DEFAULT)
	format = KF_NONE;
	if (format == KF_NONE)
	format = KF_LONG;

	return format_keyid (keyid, format, keyid_str, sizeof (keyid_str));
	}

	/* This function returns the key id of the main and possible the
	* subkey as one string. It is used by error messages. */
	const char *
	keystr_with_sub (u32 main_kid, u32 sub_kid)
	{
	static char buffer[KEYID_STR_SIZE+1+KEYID_STR_SIZE];
	char *p;
	int format = opt.keyid_format;

	if (format == KF_NONE)
	format = KF_LONG;

	format_keyid (main_kid, format, buffer, KEYID_STR_SIZE);
	if (sub_kid)
	{
	p = buffer + strlen (buffer);
	*p++ = '/';
	format_keyid (sub_kid, format, p, KEYID_STR_SIZE);
	}
	return buffer;
	}


	const char *
	keystr_from_pk(PKT_public_key *pk)
	{
	keyid_from_pk(pk,NULL);

	return keystr(pk->keyid);
	}


	const char *
	keystr_from_pk_with_sub (PKT_public_key main_pk, PKT_public_key sub_pk)
	{
	keyid_from_pk (main_pk, NULL);
	if (sub_pk)
	keyid_from_pk (sub_pk, NULL);

	return keystr_with_sub (main_pk->keyid, sub_pk? sub_pk->keyid:NULL);
	}


	/* Return PK's key id as a string using the default format. PK owns
	the storage. */
	const char *
	pk_keyid_str (PKT_public_key *pk)
	{
	return keystr (pk_keyid (pk));
	}


	const char *
	keystr_from_desc(KEYDB_SEARCH_DESC *desc)
	{
	switch(desc->mode)
	{
	case KEYDB_SEARCH_MODE_LONG_KID:
	case KEYDB_SEARCH_MODE_SHORT_KID:
	return keystr(desc->u.kid);

	case KEYDB_SEARCH_MODE_FPR20:
	{
	u32 keyid[2];

	keyid[0] = buf32_to_u32 (desc->u.fpr+12);
	keyid[1] = buf32_to_u32 (desc->u.fpr+16);
	return keystr(keyid);
	}

	case KEYDB_SEARCH_MODE_FPR16:
	return "?v3 fpr?";

	default:
	BUG();
	}
	}


	/*
	* Get the keyid from the public key and put it into keyid
	* if this is not NULL. Return the 32 low bits of the keyid.
	*/
	u32
	keyid_from_pk (PKT_public_key pk, u32 keyid)
	{
	u32 lowbits;
	u32 dummy_keyid[2];

	if (!keyid)
	keyid = dummy_keyid;

	if( pk->keyid[0] \|\| pk->keyid[1] )
	{
	keyid[0] = pk->keyid[0];
	keyid[1] = pk->keyid[1];
	lowbits = keyid[1];
	}
	else
	{
	const byte *dp;
	gcry_md_hd_t md;

	md = do_fingerprint_md(pk);
	if(md)
	{
	dp = gcry_md_read ( md, 0 );
	keyid[0] = buf32_to_u32 (dp+12);
	keyid[1] = buf32_to_u32 (dp+16);
	lowbits = keyid[1];
	gcry_md_close (md);
	pk->keyid[0] = keyid[0];
	pk->keyid[1] = keyid[1];
	}
	else
	pk->keyid[0]=pk->keyid[1]=keyid[0]=keyid[1]=lowbits=0xFFFFFFFF;
	}

	return lowbits;
	}


	/*
	* Get the keyid from the fingerprint. This function is simple for most
	* keys, but has to do a keylookup for old stayle keys.
	*/
	u32
	keyid_from_fingerprint( const byte fprint, size_t fprint_len, u32 keyid )
	{
	u32 dummy_keyid[2];

	if( !keyid )
	keyid = dummy_keyid;

	if (fprint_len != 20)
	{
	/* This is special as we have to lookup the key first. */
	PKT_public_key pk;
	int rc;

	memset (&pk, 0, sizeof pk);
	rc = get_pubkey_byfprint (&pk, NULL, fprint, fprint_len);
	if( rc )
	{
	log_error("Oops: keyid_from_fingerprint: no pubkey\n");
	keyid[0] = 0;
	keyid[1] = 0;
	}
	else
	keyid_from_pk (&pk, keyid);
	}
	else
	{
	const byte *dp = fprint;
	keyid[0] = buf32_to_u32 (dp+12);
	keyid[1] = buf32_to_u32 (dp+16);
	}

	return keyid[1];
	}


	u32
	keyid_from_sig (PKT_signature sig, u32 keyid)
	{
	if( keyid )
	{
	keyid[0] = sig->keyid[0];
	keyid[1] = sig->keyid[1];
	}
	return sig->keyid[1];
	}


	byte *
	namehash_from_uid (PKT_user_id *uid)
	{
	if (!uid->namehash)
	{
	uid->namehash = xmalloc (20);

	if (uid->attrib_data)
	rmd160_hash_buffer (uid->namehash, uid->attrib_data, uid->attrib_len);
	else
	rmd160_hash_buffer (uid->namehash, uid->name, uid->len);
	}

	return uid->namehash;
	}


	/*
	* Return the number of bits used in PK.
	*/
	unsigned int
	nbits_from_pk (PKT_public_key *pk)
	{
	return pubkey_nbits (pk->pubkey_algo, pk->pkey);
	}


	static const char *
	mk_datestr (char *buffer, time_t atime)
	{
	struct tm *tp;

	if (IS_INVALID_TIME_T (atime))
	strcpy (buffer, "????" "-??" "-??"); /* Mark this as invalid. */
	else
	{
	tp = gmtime (&atime);
	sprintf (buffer,"%04d-%02d-%02d",
	1900+tp->tm_year, tp->tm_mon+1, tp->tm_mday );
	}
	return buffer;
	}


	/*
	* return a string with the creation date of the pk
	* Note: this is alloced in a static buffer.
	* Format is: yyyy-mm-dd
	*/
	const char *
	datestr_from_pk (PKT_public_key *pk)
	{
	static char buffer[11+5];
	time_t atime = pk->timestamp;

	return mk_datestr (buffer, atime);
	}


	const char *
	datestr_from_sig (PKT_signature *sig )
	{
	static char buffer[11+5];
	time_t atime = sig->timestamp;

	return mk_datestr (buffer, atime);
	}


	const char *
	expirestr_from_pk (PKT_public_key *pk)
	{
	static char buffer[11+5];
	time_t atime;

	if (!pk->expiredate)
	return _("never ");
	atime = pk->expiredate;
	return mk_datestr (buffer, atime);
	}


	const char *
	expirestr_from_sig (PKT_signature *sig)
	{
	static char buffer[11+5];
	time_t atime;

	if (!sig->expiredate)
	return _("never ");
	atime=sig->expiredate;
	return mk_datestr (buffer, atime);
	}


	const char *
	revokestr_from_pk( PKT_public_key *pk )
	{
	static char buffer[11+5];
	time_t atime;

	if(!pk->revoked.date)
	return _("never ");
	atime=pk->revoked.date;
	return mk_datestr (buffer, atime);
	}


	const char *
	usagestr_from_pk (PKT_public_key *pk, int fill)
	{
	static char buffer[10];
	int i = 0;
	unsigned int use = pk->pubkey_usage;

	if ( use & PUBKEY_USAGE_SIG )
	buffer[i++] = 'S';

	if ( use & PUBKEY_USAGE_CERT )
	buffer[i++] = 'C';

	if ( use & PUBKEY_USAGE_ENC )
	buffer[i++] = 'E';

	if ( (use & PUBKEY_USAGE_AUTH) )
	buffer[i++] = 'A';

	while (fill && i < 4)
	buffer[i++] = ' ';

	buffer[i] = 0;
	return buffer;
	}


	const char *
	colon_strtime (u32 t)
	{
	static char buf[20];

	if (!t)
	return "";
	snprintf (buf, sizeof buf, "%lu", (ulong)t);
	return buf;
	}

	const char *
	colon_datestr_from_pk (PKT_public_key *pk)
	{
	static char buf[20];

	snprintf (buf, sizeof buf, "%lu", (ulong)pk->timestamp);
	return buf;
	}


	const char *
	colon_datestr_from_sig (PKT_signature *sig)
	{
	static char buf[20];

	snprintf (buf, sizeof buf, "%lu", (ulong)sig->timestamp);
	return buf;
	}

	const char *
	colon_expirestr_from_sig (PKT_signature *sig)
	{
	static char buf[20];

	if (!sig->expiredate)
	return "";

	snprintf (buf, sizeof buf,"%lu", (ulong)sig->expiredate);
	return buf;
	}


	/*
	* Return a byte array with the fingerprint for the given PK/SK
	* The length of the array is returned in ret_len. Caller must free
	* the array or provide an array of length MAX_FINGERPRINT_LEN.
	*/
	byte *
	fingerprint_from_pk (PKT_public_key pk, byte array, size_t *ret_len)
	{
	const byte *dp;
	size_t len;
	gcry_md_hd_t md;

	md = do_fingerprint_md(pk);
	dp = gcry_md_read( md, 0 );
	len = gcry_md_get_algo_dlen (gcry_md_get_algo (md));
	log_assert( len <= MAX_FINGERPRINT_LEN );
	if (!array)
	array = xmalloc ( len );
	memcpy (array, dp, len );
	pk->keyid[0] = buf32_to_u32 (dp+12);
	pk->keyid[1] = buf32_to_u32 (dp+16);
	gcry_md_close( md);

	if (ret_len)
	*ret_len = len;
	return array;
	}


	/* Return an allocated buffer with the fingerprint of PK formatted as
	a plain hexstring. If BUFFER is NULL the result is a malloc'd
	string. If BUFFER is not NULL the result will be copied into this
	buffer. In the latter case BUFLEN describes the length of the
	buffer; if this is too short the function terminates the process.
	Returns a malloc'ed string or BUFFER. A suitable length for BUFFER
	is (2MAX_FINGERPRINT_LEN + 1). /
	char *
	hexfingerprint (PKT_public_key pk, char buffer, size_t buflen)
	{
	unsigned char fpr[MAX_FINGERPRINT_LEN];
	size_t len;

	fingerprint_from_pk (pk, fpr, &len);
	if (!buffer)
	buffer = xmalloc (2 * len + 1);
	else if (buflen < 2*len+1)
	log_fatal ("%s: buffer too short (%zu)\n", __func__, buflen);
	bin2hex (fpr, len, buffer);
	return buffer;
	}


	/* Pretty print a hex fingerprint. If BUFFER is NULL the result is a
	malloc'd string. If BUFFER is not NULL the result will be copied
	into this buffer. In the latter case BUFLEN describes the length
	of the buffer; if this is too short the function terminates the
	process. Returns a malloc'ed string or BUFFER. A suitable length
	for BUFFER is (MAX_FORMATTED_FINGERPRINT_LEN + 1). */
	char *
	format_hexfingerprint (const char fingerprint, char buffer, size_t buflen)
	{
	int hexlen = strlen (fingerprint);
	int space;
	int i, j;

	if (hexlen == 40) /* v4 fingerprint */
	{
	space = (/* The characters and the NUL. */
	40 + 1
	/* After every fourth character, we add a space (except
	the last). */
	+ 40 / 4 - 1
	/* Half way through we add a second space. */
	+ 1);
	}
	else /* Other fingerprint versions - print as is. */
	{
	space = hexlen + 1;
	}

	if (!buffer)
	buffer = xmalloc (space);
	else if (buflen < space)
	log_fatal ("%s: buffer too short (%zu)\n", __func__, buflen);

	if (hexlen == 40) /* v4 fingerprint */
	{
	for (i = 0, j = 0; i < 40; i ++)
	{
	if (i && i % 4 == 0)
	buffer[j ++] = ' ';
	if (i == 40 / 2)
	buffer[j ++] = ' ';

	buffer[j ++] = fingerprint[i];
	}
	buffer[j ++] = 0;
	log_assert (j == space);
	}
	else
	{
	strcpy (buffer, fingerprint);
	}

	return buffer;
	}



	/* Return the so called KEYGRIP which is the SHA-1 hash of the public
	key parameters expressed as an canoncial encoded S-Exp. ARRAY must
	be 20 bytes long. Returns 0 on success or an error code. */
	gpg_error_t
	keygrip_from_pk (PKT_public_key pk, unsigned char array)
	{
	gpg_error_t err;
	gcry_sexp_t s_pkey;

	if (DBG_PACKET)
	log_debug ("get_keygrip for public key\n");

	switch (pk->pubkey_algo)
	{
	case GCRY_PK_DSA:
	err = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
	pk->pkey[0], pk->pkey[1],
	pk->pkey[2], pk->pkey[3]);
	break;

	case GCRY_PK_ELG:
	case GCRY_PK_ELG_E:
	err = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(elg(p%m)(g%m)(y%m)))",
	pk->pkey[0], pk->pkey[1], pk->pkey[2]);
	break;

	case GCRY_PK_RSA:
	case GCRY_PK_RSA_S:
	case GCRY_PK_RSA_E:
	err = gcry_sexp_build (&s_pkey, NULL,
	"(public-key(rsa(n%m)(e%m)))",
	pk->pkey[0], pk->pkey[1]);
	break;

	case PUBKEY_ALGO_EDDSA:
	case PUBKEY_ALGO_ECDSA:
	case PUBKEY_ALGO_ECDH:
	{
	char *curve = openpgp_oid_to_str (pk->pkey[0]);
	if (!curve)
	err = gpg_error_from_syserror ();
	else
	{
	err = gcry_sexp_build (&s_pkey, NULL,
	pk->pubkey_algo == PUBKEY_ALGO_EDDSA?
	"(public-key(ecc(curve%s)(flags eddsa)(q%m)))":
	(pk->pubkey_algo == PUBKEY_ALGO_ECDH
	&& openpgp_oid_is_cv25519 (pk->pkey[0]))?
	"(public-key(ecc(curve%s)(flags djb-tweak)(q%m)))":
	"(public-key(ecc(curve%s)(q%m)))",
	curve, pk->pkey[1]);
	xfree (curve);
	}
	}
	break;

	default:
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);
	break;
	}

	if (err)
	return err;

	if (!gcry_pk_get_keygrip (s_pkey, array))
	{
	log_info ("error computing keygrip\n");
	memset (array, 0, 20);
	err = gpg_error (GPG_ERR_GENERAL);
	}
	else
	{
	if (DBG_PACKET)
	log_printhex ("keygrip=", array, 20);
	/* FIXME: Save the keygrip in PK. */
	}
	gcry_sexp_release (s_pkey);

	return err;
	}


	/* Store an allocated buffer with the keygrip of PK encoded as a
	hexstring at r_GRIP. Returns 0 on success. */
	gpg_error_t
	hexkeygrip_from_pk (PKT_public_key pk, char *r_grip)
	{
	gpg_error_t err;
	unsigned char grip[20];

	*r_grip = NULL;
	err = keygrip_from_pk (pk, grip);
	if (!err)
	{
	char * buf = xtrymalloc (20*2+1);
	if (!buf)
	err = gpg_error_from_syserror ();
	else
	{
	bin2hex (grip, 20, buf);
	*r_grip = buf;
	}
	}
	return err;
	}
	diff --git a/g10/keyring.c b/g10/keyring.c
	index 328290ed8..9b7b5fd74 100644
	--- a/g10/keyring.c
	+++ b/g10/keyring.c
	@@ -1,1785 +1,1785 @@
	/* keyring.c - keyring file handling
	* Copyright (C) 1998-2010 Free Software Foundation, Inc.
	* Copyright (C) 1997-2015 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <sys/types.h>
	#include <sys/stat.h>

	#include "gpg.h"
	#include "util.h"
	#include "keyring.h"
	#include "packet.h"
	#include "keydb.h"
	#include "options.h"
	#include "main.h" /for check_key_signature()/
	#include "i18n.h"
	#include "../kbx/keybox.h"


	typedef struct keyring_resource *KR_RESOURCE;
	struct keyring_resource
	{
	struct keyring_resource *next;
	int read_only;
	dotlock_t lockhd;
	int is_locked;
	int did_full_scan;
	char fname[1];
	};
	typedef struct keyring_resource const * CONST_KR_RESOURCE;

	static KR_RESOURCE kr_resources;

	struct keyring_handle
	{
	CONST_KR_RESOURCE resource;
	struct {
	CONST_KR_RESOURCE kr;
	IOBUF iobuf;
	int eof;
	int error;
	} current;
	struct {
	CONST_KR_RESOURCE kr;
	off_t offset;
	size_t pk_no;
	size_t uid_no;
	unsigned int n_packets; /used for delete and update/
	} found, saved_found;
	struct {
	char *name;
	char *pattern;
	} word_match;
	};

	/* The number of extant handles. */
	static int active_handles;

	static int do_copy (int mode, const char *fname, KBNODE root,
	off_t start_offset, unsigned int n_packets );



	/* We keep a cache of entries that we have entered in the DB. This
	includes not only public keys, but also subkeys.

	Note: we'd like to keep the offset of the items that are present,
	however, this doesn't work, because another concurrent GnuPG
	process could modify the keyring. */
	struct key_present {
	struct key_present *next;
	u32 kid[2];
	};

	/* For the hash table, we use separate chaining with linked lists.
	This means that we have an array of N linked lists (buckets), which
	is indexed by KEYID[1] mod N. Elements present in the keyring will
	be on the list; elements not present in the keyring will not be on
	the list.

	Note: since the hash table stores both present and not present
	information, it cannot be used until we complete a full scan of the
	keyring. This is indicated by key_present_hash_ready. */
	typedef struct key_present **key_present_hash_t;
	static key_present_hash_t key_present_hash;
	static int key_present_hash_ready;

	#define KEY_PRESENT_HASH_BUCKETS 2048

	/* Allocate a new value for a key present hash table. */
	static struct key_present *
	key_present_value_new (void)
	{
	struct key_present *k;

	k = xmalloc_clear (sizeof *k);
	return k;
	}

	/* Allocate a new key present hash table. */
	static key_present_hash_t
	key_present_hash_new (void)
	{
	struct key_present **tbl;

	tbl = xmalloc_clear (KEY_PRESENT_HASH_BUCKETS * sizeof *tbl);
	return tbl;
	}

	/* Return whether the value described by KID if it is in the hash
	table. Otherwise, return NULL. */
	static struct key_present *
	key_present_hash_lookup (key_present_hash_t tbl, u32 *kid)
	{
	struct key_present *k;

	for (k = tbl[(kid[1] % (KEY_PRESENT_HASH_BUCKETS - 1))]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return k;
	return NULL;
	}

	/* Add the key to the hash table TBL if it is not already present. */
	static void
	key_present_hash_update (key_present_hash_t tbl, u32 *kid)
	{
	struct key_present *k;

	for (k = tbl[(kid[1] % (KEY_PRESENT_HASH_BUCKETS - 1))]; k; k = k->next)
	{
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return;
	}

	k = key_present_value_new ();
	k->kid[0] = kid[0];
	k->kid[1] = kid[1];
	k->next = tbl[(kid[1] % (KEY_PRESENT_HASH_BUCKETS - 1))];
	tbl[(kid[1] % (KEY_PRESENT_HASH_BUCKETS - 1))] = k;
	}

	/* Add all the keys (public and subkeys) present in the keyblock to
	the hash TBL. */
	static void
	key_present_hash_update_from_kb (key_present_hash_t tbl, KBNODE node)
	{
	for (; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	u32 aki[2];
	keyid_from_pk (node->pkt->pkt.public_key, aki);
	key_present_hash_update (tbl, aki);
	}
	}
	}

	/*
	* Register a filename for plain keyring files. ptr is set to a
	* pointer to be used to create a handles etc, or the already-issued
	* pointer if it has already been registered. The function returns 1
	* if a new keyring was registered.
	*/
	int
	keyring_register_filename (const char fname, int read_only, void *ptr)
	{
	KR_RESOURCE kr;

	if (active_handles)
	/* There are open handles. */
	BUG ();

	for (kr=kr_resources; kr; kr = kr->next)
	{
	if (same_file_p (kr->fname, fname))
	{
	/* Already registered. */
	if (read_only)
	kr->read_only = 1;
	*ptr=kr;
	return 0;
	}
	}

	kr = xmalloc (sizeof *kr + strlen (fname));
	strcpy (kr->fname, fname);
	kr->read_only = read_only;
	kr->lockhd = NULL;
	kr->is_locked = 0;
	kr->did_full_scan = 0;
	/* keep a list of all issued pointers */
	kr->next = kr_resources;
	kr_resources = kr;

	/* create the offset table the first time a function here is used */
	if (!key_present_hash)
	key_present_hash = key_present_hash_new ();

	*ptr=kr;

	return 1;
	}

	int
	keyring_is_writable (void *token)
	{
	KR_RESOURCE r = token;

	return r? (r->read_only \|\| !access (r->fname, W_OK)) : 0;
	}



	/* Create a new handle for the resource associated with TOKEN.
	On error NULL is returned and ERRNO is set.
	The returned handle must be released using keyring_release (). */
	KEYRING_HANDLE
	keyring_new (void *token)
	{
	KEYRING_HANDLE hd;
	KR_RESOURCE resource = token;

	log_assert (resource);

	hd = xtrycalloc (1, sizeof *hd);
	if (!hd)
	return hd;
	hd->resource = resource;
	active_handles++;
	return hd;
	}

	void
	keyring_release (KEYRING_HANDLE hd)
	{
	if (!hd)
	return;
	log_assert (active_handles > 0);
	active_handles--;
	xfree (hd->word_match.name);
	xfree (hd->word_match.pattern);
	iobuf_close (hd->current.iobuf);
	xfree (hd);
	}


	/* Save the current found state in HD for later retrieval by
	keybox_pop_found_state. Only one state may be saved. */
	void
	keyring_push_found_state (KEYRING_HANDLE hd)
	{
	hd->saved_found = hd->found;
	hd->found.kr = NULL;
	}


	/* Restore the saved found state in HD. */
	void
	keyring_pop_found_state (KEYRING_HANDLE hd)
	{
	hd->found = hd->saved_found;
	hd->saved_found.kr = NULL;
	}


	const char *
	keyring_get_resource_name (KEYRING_HANDLE hd)
	{
	if (!hd \|\| !hd->resource)
	return NULL;
	return hd->resource->fname;
	}


	/*
	* Lock the keyring with the given handle, or unlock if YES is false.
	* We ignore the handle and lock all registered files.
	*/
	int
	keyring_lock (KEYRING_HANDLE hd, int yes)
	{
	KR_RESOURCE kr;
	int rc = 0;

	(void)hd;

	if (yes) {
	/* first make sure the lock handles are created */
	for (kr=kr_resources; kr; kr = kr->next) {
	if (!keyring_is_writable(kr))
	continue;
	if (!kr->lockhd) {
	kr->lockhd = dotlock_create (kr->fname, 0);
	if (!kr->lockhd) {
	log_info ("can't allocate lock for '%s'\n", kr->fname );
	rc = GPG_ERR_GENERAL;
	}
	}
	}
	if (rc)
	return rc;

	/* and now set the locks */
	for (kr=kr_resources; kr; kr = kr->next) {
	if (!keyring_is_writable(kr))
	continue;
	if (kr->is_locked)
	continue;

	#ifdef HAVE_W32_SYSTEM
	/* Under Windows we need to CloseHandle the file before we
	* try to lock it. This is because another process might
	* have taken the lock and is using keybox_file_rename to
	* rename the base file. How if our dotlock_take below is
	* waiting for the lock but we have the base file still
	* open, keybox_file_rename will never succeed as we are
	* in a deadlock. */
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0,
	(char*)kr->fname);
	#endif /HAVE_W32_SYSTEM/
	if (dotlock_take (kr->lockhd, -1) ) {
	log_info ("can't lock '%s'\n", kr->fname );
	rc = GPG_ERR_GENERAL;
	}
	else
	kr->is_locked = 1;
	}
	}

	if (rc \|\| !yes) {
	for (kr=kr_resources; kr; kr = kr->next) {
	if (!keyring_is_writable(kr))
	continue;
	if (!kr->is_locked)
	continue;

	if (dotlock_release (kr->lockhd))
	log_info ("can't unlock '%s'\n", kr->fname );
	else
	kr->is_locked = 0;
	}
	}

	return rc;
	}



	/*
	* Return the last found keyblock. Caller must free it.
	* The returned keyblock has the kbode flag bit 0 set for the node with
	* the public key used to locate the keyblock or flag bit 1 set for
	* the user ID node.
	*/
	int
	keyring_get_keyblock (KEYRING_HANDLE hd, KBNODE *ret_kb)
	{
	PACKET *pkt;
	int rc;
	KBNODE keyblock = NULL, node, lastnode;
	IOBUF a;
	int in_cert = 0;
	int pk_no = 0;
	int uid_no = 0;
	int save_mode;

	if (ret_kb)
	*ret_kb = NULL;

	if (!hd->found.kr)
	return -1; /* no successful search */

	a = iobuf_open (hd->found.kr->fname);
	if (!a)
	{
	log_error(_("can't open '%s'\n"), hd->found.kr->fname);
	return GPG_ERR_KEYRING_OPEN;
	}

	if (iobuf_seek (a, hd->found.offset) ) {
	log_error ("can't seek '%s'\n", hd->found.kr->fname);
	iobuf_close(a);
	return GPG_ERR_KEYRING_OPEN;
	}

	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	hd->found.n_packets = 0;;
	lastnode = NULL;
	save_mode = set_packet_list_mode(0);
	while ((rc=parse_packet (a, pkt)) != -1) {
	hd->found.n_packets++;
	if (gpg_err_code (rc) == GPG_ERR_UNKNOWN_PACKET) {
	free_packet (pkt);
	init_packet (pkt);
	continue;
	}
	if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY)
	{
	if (in_cert)
	/* It is not this key that is problematic, but the
	following key. */
	{
	rc = 0;
	hd->found.n_packets --;
	}
	else
	/* Upper layer needs to handle this. */
	{
	}
	break;
	}
	if (rc) {
	log_error ("keyring_get_keyblock: read error: %s\n",
	gpg_strerror (rc) );
	rc = GPG_ERR_INV_KEYRING;
	break;
	}

	/* Filter allowed packets. */
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_USER_ID:
	case PKT_ATTRIBUTE:
	case PKT_SIGNATURE:
	break; /* Allowed per RFC. */
	case PKT_RING_TRUST:
	case PKT_OLD_COMMENT:
	case PKT_COMMENT:
	case PKT_GPG_CONTROL:
	break; /* Allowed by us. */

	default:
	log_error ("skipped packet of type %d in keyring\n",
	(int)pkt->pkttype);
	free_packet(pkt);
	init_packet(pkt);
	continue;
	}

	if (in_cert && (pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY)) {
	hd->found.n_packets--; /* fix counter */
	break; /* ready */
	}

	in_cert = 1;
	if (pkt->pkttype == PKT_RING_TRUST)
	{
	/(this code is duplicated after the loop)/
	if ( lastnode
	&& lastnode->pkt->pkttype == PKT_SIGNATURE
	&& (pkt->pkt.ring_trust->sigcache & 1) ) {
	/* This is a ring trust packet with a checked signature
	* status cache following directly a signature paket.
	* Set the cache status into that signature packet. */
	PKT_signature *sig = lastnode->pkt->pkt.signature;

	sig->flags.checked = 1;
	sig->flags.valid = !!(pkt->pkt.ring_trust->sigcache & 2);
	}
	/* Reset LASTNODE, so that we set the cache status only from
	* the ring trust packet immediately following a signature. */
	lastnode = NULL;
	free_packet(pkt);
	init_packet(pkt);
	continue;
	}


	node = lastnode = new_kbnode (pkt);
	if (!keyblock)
	keyblock = node;
	else
	add_kbnode (keyblock, node);
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	if (++pk_no == hd->found.pk_no)
	node->flag \|= 1;
	break;

	case PKT_USER_ID:
	if (++uid_no == hd->found.uid_no)
	node->flag \|= 2;
	break;

	default:
	break;
	}

	pkt = xmalloc (sizeof *pkt);
	init_packet(pkt);
	}
	set_packet_list_mode(save_mode);

	if (rc == -1 && keyblock)
	rc = 0; /* got the entire keyblock */

	if (rc \|\| !ret_kb)
	release_kbnode (keyblock);
	else {
	/(duplicated from the loop body)/
	if ( pkt && pkt->pkttype == PKT_RING_TRUST
	&& lastnode
	&& lastnode->pkt->pkttype == PKT_SIGNATURE
	&& (pkt->pkt.ring_trust->sigcache & 1) ) {
	PKT_signature *sig = lastnode->pkt->pkt.signature;
	sig->flags.checked = 1;
	sig->flags.valid = !!(pkt->pkt.ring_trust->sigcache & 2);
	}
	*ret_kb = keyblock;
	}
	free_packet (pkt);
	xfree (pkt);
	iobuf_close(a);

	/* Make sure that future search operations fail immediately when
	* we know that we are working on a invalid keyring
	*/
	if (gpg_err_code (rc) == GPG_ERR_INV_KEYRING)
	hd->current.error = rc;

	return rc;
	}

	int
	keyring_update_keyblock (KEYRING_HANDLE hd, KBNODE kb)
	{
	int rc;

	if (!hd->found.kr)
	return -1; /* no successful prior search */

	if (hd->found.kr->read_only)
	return gpg_error (GPG_ERR_EACCES);

	if (!hd->found.n_packets) {
	/* need to know the number of packets - do a dummy get_keyblock*/
	rc = keyring_get_keyblock (hd, NULL);
	if (rc) {
	log_error ("re-reading keyblock failed: %s\n", gpg_strerror (rc));
	return rc;
	}
	if (!hd->found.n_packets)
	BUG ();
	}

	/* The open iobuf isn't needed anymore and in fact is a problem when
	it comes to renaming the keyring files on some operating systems,
	so close it here */
	iobuf_close(hd->current.iobuf);
	hd->current.iobuf = NULL;

	/* do the update */
	rc = do_copy (3, hd->found.kr->fname, kb,
	hd->found.offset, hd->found.n_packets );
	if (!rc) {
	if (key_present_hash)
	{
	key_present_hash_update_from_kb (key_present_hash, kb);
	}
	/* better reset the found info */
	hd->found.kr = NULL;
	hd->found.offset = 0;
	}
	return rc;
	}

	int
	keyring_insert_keyblock (KEYRING_HANDLE hd, KBNODE kb)
	{
	int rc;
	const char *fname;

	if (!hd)
	fname = NULL;
	else if (hd->found.kr)
	{
	fname = hd->found.kr->fname;
	if (hd->found.kr->read_only)
	return gpg_error (GPG_ERR_EACCES);
	}
	else if (hd->current.kr)
	{
	fname = hd->current.kr->fname;
	if (hd->current.kr->read_only)
	return gpg_error (GPG_ERR_EACCES);
	}
	else
	fname = hd->resource? hd->resource->fname:NULL;

	if (!fname)
	return GPG_ERR_GENERAL;

	/* Close this one otherwise we will lose the position for
	* a next search. Fixme: it would be better to adjust the position
	* after the write opertions.
	*/
	iobuf_close (hd->current.iobuf);
	hd->current.iobuf = NULL;

	/* do the insert */
	rc = do_copy (1, fname, kb, 0, 0 );
	if (!rc && key_present_hash)
	{
	key_present_hash_update_from_kb (key_present_hash, kb);
	}

	return rc;
	}


	int
	keyring_delete_keyblock (KEYRING_HANDLE hd)
	{
	int rc;

	if (!hd->found.kr)
	return -1; /* no successful prior search */

	if (hd->found.kr->read_only)
	return gpg_error (GPG_ERR_EACCES);

	if (!hd->found.n_packets) {
	/* need to know the number of packets - do a dummy get_keyblock*/
	rc = keyring_get_keyblock (hd, NULL);
	if (rc) {
	log_error ("re-reading keyblock failed: %s\n", gpg_strerror (rc));
	return rc;
	}
	if (!hd->found.n_packets)
	BUG ();
	}

	/* close this one otherwise we will lose the position for
	* a next search. Fixme: it would be better to adjust the position
	* after the write opertions.
	*/
	iobuf_close (hd->current.iobuf);
	hd->current.iobuf = NULL;

	/* do the delete */
	rc = do_copy (2, hd->found.kr->fname, NULL,
	hd->found.offset, hd->found.n_packets );
	if (!rc) {
	/* better reset the found info */
	hd->found.kr = NULL;
	hd->found.offset = 0;
	/* Delete is a rare operations, so we don't remove the keys
	* from the offset table */
	}
	return rc;
	}



	/*
	* Start the next search on this handle right at the beginning
	*/
	int
	keyring_search_reset (KEYRING_HANDLE hd)
	{
	log_assert (hd);

	hd->current.kr = NULL;
	iobuf_close (hd->current.iobuf);
	hd->current.iobuf = NULL;
	hd->current.eof = 0;
	hd->current.error = 0;

	hd->found.kr = NULL;
	hd->found.offset = 0;
	return 0;
	}


	static int
	prepare_search (KEYRING_HANDLE hd)
	{
	if (hd->current.error) {
	/* If the last key was a legacy key, we simply ignore the error so that
	we can easily use search_next. */
	if (gpg_err_code (hd->current.error) == GPG_ERR_LEGACY_KEY)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: last error was GPG_ERR_LEGACY_KEY, clearing\n",
	__func__);
	hd->current.error = 0;
	}
	else
	{
	if (DBG_LOOKUP)
	log_debug ("%s: returning last error: %s\n",
	__func__, gpg_strerror (hd->current.error));
	return hd->current.error; /* still in error state */
	}
	}

	if (hd->current.kr && !hd->current.eof) {
	if ( !hd->current.iobuf )
	{
	if (DBG_LOOKUP)
	log_debug ("%s: missing iobuf!\n", __func__);
	return GPG_ERR_GENERAL; /* Position invalid after a modify. */
	}
	return 0; /* okay */
	}

	if (!hd->current.kr && hd->current.eof)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: EOF!\n", __func__);
	return -1; /* still EOF */
	}

	if (!hd->current.kr) { /* start search with first keyring */
	hd->current.kr = hd->resource;
	if (!hd->current.kr) {
	if (DBG_LOOKUP)
	log_debug ("%s: keyring not available!\n", __func__);
	hd->current.eof = 1;
	return -1; /* keyring not available */
	}
	log_assert (!hd->current.iobuf);
	}
	else { /* EOF */
	if (DBG_LOOKUP)
	log_debug ("%s: EOF\n", __func__);
	iobuf_close (hd->current.iobuf);
	hd->current.iobuf = NULL;
	hd->current.kr = NULL;
	hd->current.eof = 1;
	return -1;
	}

	hd->current.eof = 0;
	hd->current.iobuf = iobuf_open (hd->current.kr->fname);
	if (!hd->current.iobuf)
	{
	hd->current.error = gpg_error_from_syserror ();
	log_error(_("can't open '%s'\n"), hd->current.kr->fname );
	return hd->current.error;
	}

	return 0;
	}


	/* A map of the all characters valid used for word_match()
	- * Valid characters are in in this table converted to uppercase.
	+ * Valid characters are in this table converted to uppercase.
	* because the upper 128 bytes have special meaning, we assume
	* that they are all valid.
	* Note: We must use numerical values here in case that this program
	* will be converted to those little blue HAL9000s with their strange
	* EBCDIC character set (user ids are UTF-8).
	* wk 2000-04-13: Hmmm, does this really make sense, given the fact that
	* we can run gpg now on a S/390 running GNU/Linux, where the code
	* translation is done by the device drivers?
	*/
	static const byte word_match_chars[256] = {
	/* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 08 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 10 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 18 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 20 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 28 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 30 */ 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
	/* 38 */ 0x38, 0x39, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 40 */ 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
	/* 48 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
	/* 50 */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
	/* 58 */ 0x58, 0x59, 0x5a, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 60 */ 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
	/* 68 */ 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
	/* 70 */ 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
	/* 78 */ 0x58, 0x59, 0x5a, 0x00, 0x00, 0x00, 0x00, 0x00,
	/* 80 */ 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
	/* 88 */ 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
	/* 90 */ 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
	/* 98 */ 0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
	/* a0 */ 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
	/* a8 */ 0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
	/* b0 */ 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
	/* b8 */ 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
	/* c0 */ 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
	/* c8 */ 0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
	/* d0 */ 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
	/* d8 */ 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
	/* e0 */ 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
	/* e8 */ 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
	/* f0 */ 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
	/* f8 */ 0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff
	};

	/****************
	* Do a word match (original user id starts with a '+').
	* The pattern is already tokenized to a more suitable format:
	* There are only the real words in it delimited by one space
	* and all converted to uppercase.
	*
	* Returns: 0 if all words match.
	*
	* Note: This algorithm is a straightforward one and not very
	* fast. It works for UTF-8 strings. The uidlen should
	* be removed but due to the fact that old versions of
	* pgp don't use UTF-8 we still use the length; this should
	* be fixed in parse-packet (and replace \0 by some special
	* UTF-8 encoding)
	*/
	static int
	word_match( const byte uid, size_t uidlen, const byte pattern )
	{
	size_t wlen, n;
	const byte *p;
	const byte *s;

	for( s=pattern; *s; ) {
	do {
	/* skip leading delimiters */
	while( uidlen && !word_match_chars[*uid] )
	uid++, uidlen--;
	/* get length of the word */
	n = uidlen; p = uid;
	while( n && word_match_chars[*p] )
	p++, n--;
	wlen = p - uid;
	/* and compare against the current word from pattern */
	for(n=0, p=uid; n < wlen && s[n] != ' ' && s[n] ; n++, p++ ) {
	if( word_match_chars[*p] != s[n] )
	break;
	}
	if( n == wlen && (s[n] == ' ' \|\| !s[n]) )
	break; /* found */
	uid += wlen;
	uidlen -= wlen;
	} while( uidlen );
	if( !uidlen )
	return -1; /* not found */

	/* advance to next word in pattern */
	for(; s != ' ' && s ; s++ )
	;
	if( *s )
	s++ ;
	}
	return 0; /* found */
	}

	/****************
	* prepare word word_match; that is parse the name and
	* build the pattern.
	* caller has to free the returned pattern
	*/
	static char*
	prepare_word_match (const byte *name)
	{
	byte pattern, p;
	int c;

	/* the original length is always enough for the pattern */
	p = pattern = xmalloc(strlen(name)+1);
	do {
	/* skip leading delimiters */
	while( name && !word_match_chars[name] )
	name++;
	/* copy as long as we don't have a delimiter and convert
	* to uppercase.
	* fixme: how can we handle utf8 uppercasing */
	for( ; name && (c=word_match_chars[name]); name++ )
	*p++ = c;
	p++ = ' '; / append pattern delimiter */
	} while( *name );
	p[-1] = 0; /* replace last pattern delimiter by EOS */

	return pattern;
	}




	static int
	compare_name (int mode, const char name, const char uid, size_t uidlen)
	{
	int i;
	const char s, se;

	if (mode == KEYDB_SEARCH_MODE_EXACT) {
	for (i=0; name[i] && uidlen; i++, uidlen--)
	if (uid[i] != name[i])
	break;
	if (!uidlen && !name[i])
	return 0; /* found */
	}
	else if (mode == KEYDB_SEARCH_MODE_SUBSTR) {
	if (ascii_memistr( uid, uidlen, name ))
	return 0;
	}
	else if ( mode == KEYDB_SEARCH_MODE_MAIL
	\|\| mode == KEYDB_SEARCH_MODE_MAILSUB
	\|\| mode == KEYDB_SEARCH_MODE_MAILEND) {
	int have_angles = 1;
	for (i=0, s= uid; i < uidlen && *s != '<'; s++, i++)
	;
	if (i == uidlen)
	{
	/* The UID is a plain addr-spec (cf. RFC2822 section 4.3). */
	have_angles = 0;
	s = uid;
	i = 0;
	}
	if (i < uidlen) {
	if (have_angles)
	{
	/* skip opening delim and one char and look for the closing one*/
	s++; i++;
	for (se=s+1, i++; i < uidlen && *se != '>'; se++, i++)
	;
	}
	else
	se = s + uidlen;

	if (i < uidlen) {
	i = se - s;
	if (mode == KEYDB_SEARCH_MODE_MAIL) {
	if( strlen(name)-2 == i
	&& !ascii_memcasecmp( s, name+1, i) )
	return 0;
	}
	else if (mode == KEYDB_SEARCH_MODE_MAILSUB) {
	if( ascii_memistr( s, i, name ) )
	return 0;
	}
	else { /* email from end */
	/* nyi */
	}
	}
	}
	}
	else if (mode == KEYDB_SEARCH_MODE_WORDS)
	return word_match (uid, uidlen, name);
	else
	BUG();

	return -1; /* not found */
	}


	/*
	* Search through the keyring(s), starting at the current position,
	* for a keyblock which contains one of the keys described in the DESC array.
	*/
	int
	keyring_search (KEYRING_HANDLE hd, KEYDB_SEARCH_DESC *desc,
	size_t ndesc, size_t *descindex, int ignore_legacy)
	{
	int rc;
	PACKET pkt;
	int save_mode;
	off_t offset, main_offset;
	size_t n;
	int need_uid, need_words, need_keyid, need_fpr, any_skip;
	int pk_no, uid_no;
	int initial_skip;
	int scanned_from_start;
	int use_key_present_hash;
	PKT_user_id *uid = NULL;
	PKT_public_key *pk = NULL;
	u32 aki[2];

	/* figure out what information we need */
	need_uid = need_words = need_keyid = need_fpr = any_skip = 0;
	for (n=0; n < ndesc; n++)
	{
	switch (desc[n].mode)
	{
	case KEYDB_SEARCH_MODE_EXACT:
	case KEYDB_SEARCH_MODE_SUBSTR:
	case KEYDB_SEARCH_MODE_MAIL:
	case KEYDB_SEARCH_MODE_MAILSUB:
	case KEYDB_SEARCH_MODE_MAILEND:
	need_uid = 1;
	break;
	case KEYDB_SEARCH_MODE_WORDS:
	need_uid = 1;
	need_words = 1;
	break;
	case KEYDB_SEARCH_MODE_SHORT_KID:
	case KEYDB_SEARCH_MODE_LONG_KID:
	need_keyid = 1;
	break;
	case KEYDB_SEARCH_MODE_FPR16:
	case KEYDB_SEARCH_MODE_FPR20:
	case KEYDB_SEARCH_MODE_FPR:
	need_fpr = 1;
	break;
	case KEYDB_SEARCH_MODE_FIRST:
	/* always restart the search in this mode */
	keyring_search_reset (hd);
	break;
	default: break;
	}
	if (desc[n].skipfnc)
	{
	any_skip = 1;
	need_keyid = 1;
	}
	}

	if (DBG_LOOKUP)
	log_debug ("%s: need_uid = %d; need_words = %d; need_keyid = %d; need_fpr = %d; any_skip = %d\n",
	__func__, need_uid, need_words, need_keyid, need_fpr, any_skip);

	rc = prepare_search (hd);
	if (rc)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: prepare_search failed: %s (%d)\n",
	__func__, gpg_strerror (rc), gpg_err_code (rc));
	return rc;
	}

	use_key_present_hash = !!key_present_hash;
	if (!use_key_present_hash)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: no offset table.\n", __func__);
	}
	else if (!key_present_hash_ready)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: initializing offset table. (need_keyid: %d => 1)\n",
	__func__, need_keyid);
	need_keyid = 1;
	}
	else if (ndesc == 1 && desc[0].mode == KEYDB_SEARCH_MODE_LONG_KID)
	{
	struct key_present *oi;

	if (DBG_LOOKUP)
	log_debug ("%s: look up by long key id, checking cache\n", __func__);

	oi = key_present_hash_lookup (key_present_hash, desc[0].u.kid);
	if (!oi)
	{ /* We know that we don't have this key */
	if (DBG_LOOKUP)
	log_debug ("%s: cache says not present\n", __func__);
	hd->found.kr = NULL;
	hd->current.eof = 1;
	return -1;
	}
	/* We could now create a positive search status and return.
	* However the problem is that another instance of gpg may
	* have changed the keyring so that the offsets are not valid
	* anymore - therefore we don't do it
	*/
	}

	if (need_words)
	{
	const char *name = NULL;

	log_debug ("word search mode does not yet work\n");
	/* FIXME: here is a long standing bug in our function and in addition we
	just use the first search description */
	for (n=0; n < ndesc && !name; n++)
	{
	if (desc[n].mode == KEYDB_SEARCH_MODE_WORDS)
	name = desc[n].u.name;
	}
	log_assert (name);
	if ( !hd->word_match.name \|\| strcmp (hd->word_match.name, name) )
	{
	/* name changed */
	xfree (hd->word_match.name);
	xfree (hd->word_match.pattern);
	hd->word_match.name = xstrdup (name);
	hd->word_match.pattern = prepare_word_match (name);
	}
	/* name = hd->word_match.pattern; */
	}

	init_packet(&pkt);
	save_mode = set_packet_list_mode(0);

	hd->found.kr = NULL;
	main_offset = 0;
	pk_no = uid_no = 0;
	initial_skip = 1; /* skip until we see the start of a keyblock */
	scanned_from_start = iobuf_tell (hd->current.iobuf) == 0;
	if (DBG_LOOKUP)
	log_debug ("%s: %ssearching from start of resource.\n",
	__func__, scanned_from_start ? "" : "not ");
	while (1)
	{
	byte afp[MAX_FINGERPRINT_LEN];
	size_t an;

	rc = search_packet (hd->current.iobuf, &pkt, &offset, need_uid);
	if (ignore_legacy && gpg_err_code (rc) == GPG_ERR_LEGACY_KEY)
	{
	free_packet (&pkt);
	continue;
	}
	if (rc)
	break;

	if (pkt.pkttype == PKT_PUBLIC_KEY \|\| pkt.pkttype == PKT_SECRET_KEY)
	{
	main_offset = offset;
	pk_no = uid_no = 0;
	initial_skip = 0;
	}
	if (initial_skip)
	{
	free_packet (&pkt);
	continue;
	}

	pk = NULL;
	uid = NULL;
	if ( pkt.pkttype == PKT_PUBLIC_KEY
	\|\| pkt.pkttype == PKT_PUBLIC_SUBKEY
	\|\| pkt.pkttype == PKT_SECRET_KEY
	\|\| pkt.pkttype == PKT_SECRET_SUBKEY)
	{
	pk = pkt.pkt.public_key;
	++pk_no;

	if (need_fpr) {
	fingerprint_from_pk (pk, afp, &an);
	while (an < 20) /* fill up to 20 bytes */
	afp[an++] = 0;
	}
	if (need_keyid)
	keyid_from_pk (pk, aki);

	if (use_key_present_hash
	&& !key_present_hash_ready
	&& scanned_from_start)
	key_present_hash_update (key_present_hash, aki);
	}
	else if (pkt.pkttype == PKT_USER_ID)
	{
	uid = pkt.pkt.user_id;
	++uid_no;
	}

	for (n=0; n < ndesc; n++)
	{
	switch (desc[n].mode) {
	case KEYDB_SEARCH_MODE_NONE:
	BUG ();
	break;
	case KEYDB_SEARCH_MODE_EXACT:
	case KEYDB_SEARCH_MODE_SUBSTR:
	case KEYDB_SEARCH_MODE_MAIL:
	case KEYDB_SEARCH_MODE_MAILSUB:
	case KEYDB_SEARCH_MODE_MAILEND:
	case KEYDB_SEARCH_MODE_WORDS:
	if ( uid && !compare_name (desc[n].mode,
	desc[n].u.name,
	uid->name, uid->len))
	goto found;
	break;

	case KEYDB_SEARCH_MODE_SHORT_KID:
	if (pk && desc[n].u.kid[1] == aki[1])
	goto found;
	break;
	case KEYDB_SEARCH_MODE_LONG_KID:
	if (pk && desc[n].u.kid[0] == aki[0]
	&& desc[n].u.kid[1] == aki[1])
	goto found;
	break;
	case KEYDB_SEARCH_MODE_FPR16:
	if (pk && !memcmp (desc[n].u.fpr, afp, 16))
	goto found;
	break;
	case KEYDB_SEARCH_MODE_FPR20:
	case KEYDB_SEARCH_MODE_FPR:
	if (pk && !memcmp (desc[n].u.fpr, afp, 20))
	goto found;
	break;
	case KEYDB_SEARCH_MODE_FIRST:
	if (pk)
	goto found;
	break;
	case KEYDB_SEARCH_MODE_NEXT:
	if (pk)
	goto found;
	break;
	default:
	rc = GPG_ERR_INV_ARG;
	goto found;
	}
	}
	free_packet (&pkt);
	continue;
	found:
	if (rc)
	goto real_found;

	if (DBG_LOOKUP)
	log_debug ("%s: packet starting at offset %lld matched descriptor %zu\n"
	, __func__, (long long)offset, n);

	/* Record which desc we matched on. Note this value is only
	meaningful if this function returns with no errors. */
	if(descindex)
	*descindex=n;
	for (n=any_skip?0:ndesc; n < ndesc; n++)
	{
	if (desc[n].skipfnc
	&& desc[n].skipfnc (desc[n].skipfncvalue, aki, uid_no))
	{
	if (DBG_LOOKUP)
	log_debug ("%s: skipping match: desc %zd's skip function returned TRUE\n",
	__func__, n);
	break;
	}
	}
	if (n == ndesc)
	goto real_found;
	free_packet (&pkt);
	}
	real_found:
	if (!rc)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: returning success\n", __func__);
	hd->found.offset = main_offset;
	hd->found.kr = hd->current.kr;
	hd->found.pk_no = pk? pk_no : 0;
	hd->found.uid_no = uid? uid_no : 0;
	}
	else if (rc == -1)
	{
	if (DBG_LOOKUP)
	log_debug ("%s: no matches (EOF)\n", __func__);

	hd->current.eof = 1;
	/* if we scanned all keyrings, we are sure that
	* all known key IDs are in our offtbl, mark that. */
	if (use_key_present_hash
	&& !key_present_hash_ready
	&& scanned_from_start)
	{
	KR_RESOURCE kr;

	/* First set the did_full_scan flag for this keyring. */
	for (kr=kr_resources; kr; kr = kr->next)
	{
	if (hd->resource == kr)
	{
	kr->did_full_scan = 1;
	break;
	}
	}
	/* Then check whether all flags are set and if so, mark the
	offtbl ready */
	for (kr=kr_resources; kr; kr = kr->next)
	{
	if (!kr->did_full_scan)
	break;
	}
	if (!kr)
	key_present_hash_ready = 1;
	}
	}
	else
	{
	if (DBG_LOOKUP)
	log_debug ("%s: error encountered during search: %s (%d)\n",
	__func__, gpg_strerror (rc), rc);
	hd->current.error = rc;
	}

	free_packet(&pkt);
	set_packet_list_mode(save_mode);
	return rc;
	}


	static int
	create_tmp_file (const char *template,
	char r_bakfname, char r_tmpfname, IOBUF *r_fp)
	{
	gpg_error_t err;
	mode_t oldmask;

	err = keybox_tmp_names (template, 1, r_bakfname, r_tmpfname);
	if (err)
	return err;

	/* Create the temp file with limited access. Note that the umask
	call is not anymore needed because iobuf_create now takes care of
	it. However, it does not harm and thus we keep it. */
	oldmask = umask (077);
	if (is_secured_filename (*r_tmpfname))
	{
	*r_fp = NULL;
	gpg_err_set_errno (EPERM);
	}
	else
	r_fp = iobuf_create (r_tmpfname, 1);
	umask (oldmask);
	if (!*r_fp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't create '%s': %s\n"), *r_tmpfname, gpg_strerror (err));
	xfree (*r_tmpfname);
	*r_tmpfname = NULL;
	xfree (*r_bakfname);
	*r_bakfname = NULL;
	}

	return err;
	}


	static int
	rename_tmp_file (const char bakfname, const char tmpfname, const char *fname)
	{
	int rc = 0;
	int block = 0;

	/* Invalidate close caches. */
	if (iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)tmpfname ))
	{
	rc = gpg_error_from_syserror ();
	goto fail;
	}
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)bakfname );
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname );

	/* First make a backup file. */
	block = 1;
	rc = gnupg_rename_file (fname, bakfname, &block);
	if (rc)
	goto fail;

	/* then rename the file */
	rc = gnupg_rename_file (tmpfname, fname, NULL);
	if (block)
	{
	gnupg_unblock_all_signals ();
	block = 0;
	}
	if (rc)
	{
	register_secured_file (fname);
	goto fail;
	}

	/* Now make sure the file has the same permissions as the original */
	#ifndef HAVE_DOSISH_SYSTEM
	{
	struct stat statbuf;

	statbuf.st_mode=S_IRUSR \| S_IWUSR;

	if (!stat (bakfname, &statbuf) && !chmod (fname, statbuf.st_mode))
	;
	else
	log_error ("WARNING: unable to restore permissions to '%s': %s",
	fname, strerror(errno));
	}
	#endif

	return 0;

	fail:
	if (block)
	gnupg_unblock_all_signals ();
	return rc;
	}


	static int
	write_keyblock (IOBUF fp, KBNODE keyblock)
	{
	KBNODE kbctx = NULL, node;
	int rc;

	while ( (node = walk_kbnode (keyblock, &kbctx, 0)) )
	{
	if (node->pkt->pkttype == PKT_RING_TRUST)
	continue; /* we write it later on our own */

	if ( (rc = build_packet (fp, node->pkt) ))
	{
	log_error ("build_packet(%d) failed: %s\n",
	node->pkt->pkttype, gpg_strerror (rc) );
	return rc;
	}
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{ /* always write a signature cache packet */
	PKT_signature *sig = node->pkt->pkt.signature;
	unsigned int cacheval = 0;

	if (sig->flags.checked)
	{
	cacheval \|= 1;
	if (sig->flags.valid)
	cacheval \|= 2;
	}
	iobuf_put (fp, 0xb0); /* old style packet 12, 1 byte len*/
	iobuf_put (fp, 2); /* 2 bytes */
	iobuf_put (fp, 0); /* unused */
	if (iobuf_put (fp, cacheval))
	{
	rc = gpg_error_from_syserror ();
	log_error ("writing sigcache packet failed\n");
	return rc;
	}
	}
	}
	return 0;
	}

	/*
	* Walk over all public keyrings, check the signatures and replace the
	* keyring with a new one where the signature cache is then updated.
	* This is only done for the public keyrings.
	*/
	int
	keyring_rebuild_cache (void *token,int noisy)
	{
	KEYRING_HANDLE hd;
	KEYDB_SEARCH_DESC desc;
	KBNODE keyblock = NULL, node;
	const char lastresname = NULL, resname;
	IOBUF tmpfp = NULL;
	char *tmpfilename = NULL;
	char *bakfilename = NULL;
	int rc;
	ulong count = 0, sigcount = 0;

	hd = keyring_new (token);
	if (!hd)
	return gpg_error_from_syserror ();
	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FIRST;

	rc=keyring_lock (hd, 1);
	if(rc)
	goto leave;

	for (;;)
	{
	rc = keyring_search (hd, &desc, 1, NULL, 1 /* ignore_legacy */);
	if (rc)
	break; /* ready. */

	desc.mode = KEYDB_SEARCH_MODE_NEXT;
	resname = keyring_get_resource_name (hd);
	if (lastresname != resname )
	{ /* we have switched to a new keyring - commit changes */
	if (tmpfp)
	{
	if (iobuf_close (tmpfp))
	{
	rc = gpg_error_from_syserror ();
	log_error ("error closing '%s': %s\n",
	tmpfilename, strerror (errno));
	goto leave;
	}
	/* because we have switched resources, we can be sure that
	* the original file is closed */
	tmpfp = NULL;
	}
	/* Static analyzer note: BAKFILENAME is never NULL here
	because it is controlled by LASTRESNAME. */
	rc = lastresname? rename_tmp_file (bakfilename, tmpfilename,
	lastresname) : 0;
	xfree (tmpfilename); tmpfilename = NULL;
	xfree (bakfilename); bakfilename = NULL;
	if (rc)
	goto leave;
	lastresname = resname;
	if (noisy && !opt.quiet)
	log_info (_("caching keyring '%s'\n"), resname);
	rc = create_tmp_file (resname, &bakfilename, &tmpfilename, &tmpfp);
	if (rc)
	goto leave;
	}

	release_kbnode (keyblock);
	rc = keyring_get_keyblock (hd, &keyblock);
	if (rc)
	{
	if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY)
	continue; /* Skip legacy keys. */
	log_error ("keyring_get_keyblock failed: %s\n", gpg_strerror (rc));
	goto leave;
	}
	if ( keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	/* We had a few reports about corrupted keyrings; if we have
	been called directly from the command line we delete such
	a keyblock instead of bailing out. */
	log_error ("unexpected keyblock found (pkttype=%d)%s\n",
	keyblock->pkt->pkttype, noisy? " - deleted":"");
	if (noisy)
	continue;
	log_info ("Hint: backup your keys and try running '%s'\n",
	"gpg --rebuild-keydb-caches");
	rc = gpg_error (GPG_ERR_INV_KEYRING);
	goto leave;
	}

	if (keyblock->pkt->pkt.public_key->version < 4)
	{
	/* We do not copy/cache v3 keys or any other unknown
	packets. It is better to remove them from the keyring.
	The code required to keep them in the keyring would be
	too complicated. Given that we do not touch the old
	secring.gpg a suitable backup for decryption of v3 stuff
	using an older gpg version will always be available.
	Note: This test is actually superfluous because we
	already acted upon GPG_ERR_LEGACY_KEY. */
	}
	else
	{
	/* Check all signature to set the signature's cache flags. */
	for (node=keyblock; node; node=node->next)
	{
	/* Note that this doesn't cache the result of a
	revocation issued by a designated revoker. This is
	because the pk in question does not carry the revkeys
	as we haven't merged the key and selfsigs. It is
	questionable whether this matters very much since
	there are very very few designated revoker revocation
	packets out there. */
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig=node->pkt->pkt.signature;

	if(!opt.no_sig_cache && sig->flags.checked && sig->flags.valid
	&& (openpgp_md_test_algo(sig->digest_algo)
	\|\| openpgp_pk_test_algo(sig->pubkey_algo)))
	sig->flags.checked=sig->flags.valid=0;
	else
	check_key_signature (keyblock, node, NULL);

	sigcount++;
	}
	}

	/* Write the keyblock to the temporary file. */
	rc = write_keyblock (tmpfp, keyblock);
	if (rc)
	goto leave;

	if ( !(++count % 50) && noisy && !opt.quiet)
	log_info (ngettext("%lu keys cached so far (%lu signature)\n",
	"%lu keys cached so far (%lu signatures)\n",
	sigcount),
	count, sigcount);
	}
	} /* end main loop */
	if (rc == -1)
	rc = 0;
	if (rc)
	{
	log_error ("keyring_search failed: %s\n", gpg_strerror (rc));
	goto leave;
	}

	if (noisy \|\| opt.verbose)
	{
	log_info (ngettext("%lu key cached",
	"%lu keys cached", count), count);
	log_printf (ngettext(" (%lu signature)\n",
	" (%lu signatures)\n", sigcount), sigcount);
	}

	if (tmpfp)
	{
	if (iobuf_close (tmpfp))
	{
	rc = gpg_error_from_syserror ();
	log_error ("error closing '%s': %s\n",
	tmpfilename, strerror (errno));
	goto leave;
	}
	/* because we have switched resources, we can be sure that
	* the original file is closed */
	tmpfp = NULL;
	}
	rc = lastresname? rename_tmp_file (bakfilename, tmpfilename,
	lastresname) : 0;
	xfree (tmpfilename); tmpfilename = NULL;
	xfree (bakfilename); bakfilename = NULL;

	leave:
	if (tmpfp)
	iobuf_cancel (tmpfp);
	xfree (tmpfilename);
	xfree (bakfilename);
	release_kbnode (keyblock);
	keyring_lock (hd, 0);
	keyring_release (hd);
	return rc;
	}


	/****************
	* Perform insert/delete/update operation.
	* mode 1 = insert
	* 2 = delete
	* 3 = update
	*/
	static int
	do_copy (int mode, const char *fname, KBNODE root,
	off_t start_offset, unsigned int n_packets )
	{
	IOBUF fp, newfp;
	int rc=0;
	char *bakfname = NULL;
	char *tmpfname = NULL;

	/* Open the source file. Because we do a rename, we have to check the
	permissions of the file */
	if (access (fname, W_OK))
	return gpg_error_from_syserror ();

	fp = iobuf_open (fname);
	if (mode == 1 && !fp && errno == ENOENT) {
	/* insert mode but file does not exist: create a new file */
	KBNODE kbctx, node;
	mode_t oldmask;

	oldmask=umask(077);
	if (is_secured_filename (fname)) {
	newfp = NULL;
	gpg_err_set_errno (EPERM);
	}
	else
	newfp = iobuf_create (fname, 1);
	umask(oldmask);
	if( !newfp )
	{
	rc = gpg_error_from_syserror ();
	log_error (_("can't create '%s': %s\n"), fname, strerror(errno));
	return rc;
	}
	if( !opt.quiet )
	log_info(_("%s: keyring created\n"), fname );

	kbctx=NULL;
	while ( (node = walk_kbnode( root, &kbctx, 0 )) ) {
	if( (rc = build_packet( newfp, node->pkt )) ) {
	log_error("build_packet(%d) failed: %s\n",
	node->pkt->pkttype, gpg_strerror (rc) );
	iobuf_cancel(newfp);
	return rc;
	}
	}
	if( iobuf_close(newfp) ) {
	rc = gpg_error_from_syserror ();
	log_error ("%s: close failed: %s\n", fname, strerror(errno));
	return rc;
	}
	return 0; /* ready */
	}

	if( !fp )
	{
	rc = gpg_error_from_syserror ();
	log_error(_("can't open '%s': %s\n"), fname, strerror(errno) );
	goto leave;
	}

	/* Create the new file. */
	rc = create_tmp_file (fname, &bakfname, &tmpfname, &newfp);
	if (rc) {
	iobuf_close(fp);
	goto leave;
	}

	if( mode == 1 ) { /* insert */
	/* copy everything to the new file */
	rc = copy_all_packets (fp, newfp);
	if( rc != -1 ) {
	log_error("%s: copy to '%s' failed: %s\n",
	fname, tmpfname, gpg_strerror (rc) );
	iobuf_close(fp);
	iobuf_cancel(newfp);
	goto leave;
	}
	}

	if( mode == 2 \|\| mode == 3 ) { /* delete or update */
	/* copy first part to the new file */
	rc = copy_some_packets( fp, newfp, start_offset );
	if( rc ) { /* should never get EOF here */
	log_error ("%s: copy to '%s' failed: %s\n",
	fname, tmpfname, gpg_strerror (rc) );
	iobuf_close(fp);
	iobuf_cancel(newfp);
	goto leave;
	}
	/* skip this keyblock */
	log_assert( n_packets );
	rc = skip_some_packets( fp, n_packets );
	if( rc ) {
	log_error("%s: skipping %u packets failed: %s\n",
	fname, n_packets, gpg_strerror (rc));
	iobuf_close(fp);
	iobuf_cancel(newfp);
	goto leave;
	}
	}

	if( mode == 1 \|\| mode == 3 ) { /* insert or update */
	rc = write_keyblock (newfp, root);
	if (rc) {
	iobuf_close(fp);
	iobuf_cancel(newfp);
	goto leave;
	}
	}

	if( mode == 2 \|\| mode == 3 ) { /* delete or update */
	/* copy the rest */
	rc = copy_all_packets( fp, newfp );
	if( rc != -1 ) {
	log_error("%s: copy to '%s' failed: %s\n",
	fname, tmpfname, gpg_strerror (rc) );
	iobuf_close(fp);
	iobuf_cancel(newfp);
	goto leave;
	}
	}

	/* close both files */
	if( iobuf_close(fp) ) {
	rc = gpg_error_from_syserror ();
	log_error("%s: close failed: %s\n", fname, strerror(errno) );
	goto leave;
	}
	if( iobuf_close(newfp) ) {
	rc = gpg_error_from_syserror ();
	log_error("%s: close failed: %s\n", tmpfname, strerror(errno) );
	goto leave;
	}

	rc = rename_tmp_file (bakfname, tmpfname, fname);

	leave:
	xfree(bakfname);
	xfree(tmpfname);
	return rc;
	}
	diff --git a/g10/mainproc.c b/g10/mainproc.c
	index ac2ab03c9..8e2989187 100644
	--- a/g10/mainproc.c
	+++ b/g10/mainproc.c
	@@ -1,2491 +1,2491 @@
	/* mainproc.c - handle packets
	* Copyright (C) 1998-2009 Free Software Foundation, Inc.
	* Copyright (C) 2013-2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <time.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "iobuf.h"
	#include "options.h"
	#include "keydb.h"
	#include "filter.h"
	#include "main.h"
	#include "status.h"
	#include "i18n.h"
	#include "trustdb.h"
	#include "keyserver-internal.h"
	#include "photoid.h"
	#include "mbox-util.h"
	#include "call-dirmngr.h"

	/* Put an upper limit on nested packets. The 32 is an arbitrary
	value, a much lower should actually be sufficient. */
	#define MAX_NESTING_DEPTH 32


	/* An object to build a list of keyid related info. */
	struct kidlist_item
	{
	struct kidlist_item *next;
	u32 kid[2];
	int pubkey_algo;
	int reason;
	};


	/*
	* Object to hold the processing context.
	*/
	typedef struct mainproc_context *CTX;
	struct mainproc_context
	{
	ctrl_t ctrl;
	struct mainproc_context anchor; / May be useful in the future. */
	PKT_public_key *last_pubkey;
	PKT_user_id *last_user_id;
	md_filter_context_t mfx;
	int sigs_only; /* Process only signatures and reject all other stuff. */
	int encrypt_only; /* Process only encryption messages. */

	/* Name of the file with the complete signature or the file with the
	detached signature. This is currently only used to deduce the
	file name of the data file if that has not been given. */
	const char *sigfilename;

	/* A structure to describe the signed data in case of a detached
	signature. */
	struct
	{
	- /* A file descriptor of the the signed data. Only used if not -1. */
	+ /* A file descriptor of the signed data. Only used if not -1. */
	int data_fd;
	/* A list of filenames with the data files or NULL. This is only
	used if DATA_FD is -1. */
	strlist_t data_names;
	/* Flag to indicated that either one of the next previous fields
	is used. This is only needed for better readability. */
	int used;
	} signed_data;

	DEK *dek;
	int last_was_session_key;
	kbnode_t list; /* The current list of packets. */
	iobuf_t iobuf; /* Used to get the filename etc. */
	int trustletter; /* Temporary usage in list_node. */
	ulong symkeys;
	struct kidlist_item pkenc_list; / List of encryption packets. */
	struct {
	unsigned int sig_seen:1; /* Set to true if a signature packet
	has been seen. */
	unsigned int data:1; /* Any data packet seen */
	unsigned int uncompress_failed:1;
	} any;
	};


	/* Local prototypes. */
	static int do_proc_packets (ctrl_t ctrl, CTX c, iobuf_t a);
	static void list_node (CTX c, kbnode_t node);
	static void proc_tree (CTX c, kbnode_t node);
	static int literals_seen;


	/* Functions. */


	void
	reset_literals_seen(void)
	{
	literals_seen = 0;
	}


	static void
	release_list( CTX c )
	{
	proc_tree (c, c->list);
	release_kbnode (c->list);
	while (c->pkenc_list)
	{
	struct kidlist_item *tmp = c->pkenc_list->next;
	xfree (c->pkenc_list);
	c->pkenc_list = tmp;
	}
	c->pkenc_list = NULL;
	c->list = NULL;
	c->any.data = 0;
	c->any.uncompress_failed = 0;
	c->last_was_session_key = 0;
	xfree (c->dek);
	c->dek = NULL;
	}


	static int
	add_onepass_sig (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = node = new_kbnode (pkt);

	return 1;
	}


	static int
	add_gpg_control (CTX c, PACKET *pkt)
	{
	if ( pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* New clear text signature.
	* Process the last one and reset everything */
	release_list(c);
	}

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = new_kbnode (pkt);

	return 1;
	}


	static int
	add_user_id (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("orphaned user ID\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_subkey (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("subkey w/o mainkey\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_ring_trust (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("ring trust w/o key\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_signature (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	c->any.sig_seen = 1;
	if (pkt->pkttype == PKT_SIGNATURE && !c->list)
	{
	/* This is the first signature for the following datafile.
	* GPG does not write such packets; instead it always uses
	* onepass-sig packets. The drawback of PGP's method
	* of prepending the signature to the data is
	* that it is not possible to make a signature from data read
	* from stdin. (GPG is able to read PGP stuff anyway.) */
	node = new_kbnode (pkt);
	c->list = node;
	return 1;
	}
	else if (!c->list)
	return 0; /* oops (invalid packet sequence)*/
	else if (!c->list->pkt)
	BUG(); /* so nicht */

	/* Add a new signature node item at the end. */
	node = new_kbnode (pkt);
	add_kbnode (c->list, node);

	return 1;
	}

	static int
	symkey_decrypt_seskey (DEK dek, byte seskey, size_t slen)
	{
	gcry_cipher_hd_t hd;

	if(slen < 17 \|\| slen > 33)
	{
	log_error ( _("weird size for an encrypted session key (%d)\n"),
	(int)slen);
	return GPG_ERR_BAD_KEY;
	}

	if (openpgp_cipher_open (&hd, dek->algo, GCRY_CIPHER_MODE_CFB, 1))
	BUG ();
	if (gcry_cipher_setkey ( hd, dek->key, dek->keylen ))
	BUG ();
	gcry_cipher_setiv ( hd, NULL, 0 );
	gcry_cipher_decrypt ( hd, seskey, slen, NULL, 0 );
	gcry_cipher_close ( hd );

	/* Now we replace the dek components with the real session key to
	decrypt the contents of the sequencing packet. */

	dek->keylen=slen-1;
	dek->algo=seskey[0];

	if(dek->keylen > DIM(dek->key))
	BUG ();

	memcpy(dek->key, seskey + 1, dek->keylen);

	/log_hexdump( "thekey", dek->key, dek->keylen );/

	return 0;
	}


	static void
	proc_symkey_enc (CTX c, PACKET *pkt)
	{
	PKT_symkey_enc *enc;

	enc = pkt->pkt.symkey_enc;
	if (!enc)
	log_error ("invalid symkey encrypted packet\n");
	else if(!c->dek)
	{
	int algo = enc->cipher_algo;
	const char *s = openpgp_cipher_algo_name (algo);

	if (!openpgp_cipher_test_algo (algo))
	{
	if (!opt.quiet)
	{
	if (enc->seskeylen)
	log_info (_("%s encrypted session key\n"), s );
	else
	log_info (_("%s encrypted data\n"), s );
	}
	}
	else
	log_error (_("encrypted with unknown algorithm %d\n"), algo);

	if (openpgp_md_test_algo (enc->s2k.hash_algo))
	{
	log_error(_("passphrase generated with unknown digest"
	" algorithm %d\n"),enc->s2k.hash_algo);
	s = NULL;
	}

	c->last_was_session_key = 2;
	if (!s \|\| opt.list_only)
	goto leave;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	if (get_override_session_key (c->dek, opt.override_session_key))
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	c->dek = passphrase_to_dek (algo, &enc->s2k, 0, 0, NULL, NULL);
	if (c->dek)
	{
	c->dek->symmetric = 1;

	/* FIXME: This doesn't work perfectly if a symmetric key
	comes before a public key in the message - if the
	user doesn't know the passphrase, then there is a
	chance that the "decrypted" algorithm will happen to
	be a valid one, which will make the returned dek
	appear valid, so we won't try any public keys that
	come later. */
	if (enc->seskeylen)
	{
	if (symkey_decrypt_seskey (c->dek,
	enc->seskey, enc->seskeylen))
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	c->dek->algo_info_printed = 1;
	}
	}
	}

	leave:
	c->symkeys++;
	free_packet (pkt);
	}


	static void
	proc_pubkey_enc (ctrl_t ctrl, CTX c, PACKET *pkt)
	{
	PKT_pubkey_enc *enc;
	int result = 0;

	/* Check whether the secret key is available and store in this case. */
	c->last_was_session_key = 1;
	enc = pkt->pkt.pubkey_enc;
	/printf("enc: encrypted by a pubkey with keyid %08lX\n", enc->keyid[1] );/
	/* Hmmm: why do I have this algo check here - anyway there is
	* function to check it. */
	if (opt.verbose)
	log_info (_("public key is %s\n"), keystr (enc->keyid));

	if (is_status_enabled())
	{
	char buf[50];
	/* FIXME: For ECC support we need to map the OpenPGP algo number
	to the Libgcrypt defined one. This is due a chicken-egg
	problem: We need to have code in Libgcrypt for a new
	algorithm so to implement a proposed new algorithm before the
	IANA will finally assign an OpenPGP identifier. */
	snprintf (buf, sizeof buf, "%08lX%08lX %d 0",
	(ulong)enc->keyid[0], (ulong)enc->keyid[1], enc->pubkey_algo);
	write_status_text (STATUS_ENC_TO, buf);
	}

	if (!opt.list_only && opt.override_session_key)
	{
	/* It does not make much sense to store the session key in
	* secure memory because it has already been passed on the
	* command line and the GCHQ knows about it. */
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else if (enc->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E
	\|\| enc->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| enc->pubkey_algo == PUBKEY_ALGO_RSA
	\|\| enc->pubkey_algo == PUBKEY_ALGO_RSA_E
	\|\| enc->pubkey_algo == PUBKEY_ALGO_ELGAMAL)
	{
	/* Note that we also allow type 20 Elgamal keys for decryption.
	There are still a couple of those keys in active use as a
	subkey. */

	/* FIXME: Store this all in a list and process it later so that
	we can prioritize what key to use. This gives a better user
	experience if wildcard keyids are used. */
	if (!c->dek && ((!enc->keyid[0] && !enc->keyid[1])
	\|\| opt.try_all_secrets
	\|\| have_secret_key_with_kid (enc->keyid)))
	{
	if(opt.list_only)
	result = -1;
	else
	{
	c->dek = xmalloc_secure_clear (sizeof *c->dek);
	if ((result = get_session_key (ctrl, enc, c->dek)))
	{
	/* Error: Delete the DEK. */
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	}
	else
	result = GPG_ERR_NO_SECKEY;
	}
	else
	result = GPG_ERR_PUBKEY_ALGO;

	if (result == -1)
	;
	else
	{
	/* Store it for later display. */
	struct kidlist_item x = xmalloc (sizeof x);
	x->kid[0] = enc->keyid[0];
	x->kid[1] = enc->keyid[1];
	x->pubkey_algo = enc->pubkey_algo;
	x->reason = result;
	x->next = c->pkenc_list;
	c->pkenc_list = x;

	if (!result && opt.verbose > 1)
	log_info (_("public key encrypted data: good DEK\n"));
	}

	free_packet(pkt);
	}


	/*
	* Print the list of public key encrypted packets which we could
	* not decrypt.
	*/
	static void
	print_pkenc_list (struct kidlist_item *list, int failed)
	{
	for (; list; list = list->next)
	{
	PKT_public_key *pk;
	const char *algstr;

	if (failed && !list->reason)
	continue;
	if (!failed && list->reason)
	continue;

	algstr = openpgp_pk_algo_name (list->pubkey_algo);
	pk = xmalloc_clear (sizeof *pk);

	if (!algstr)
	algstr = "[?]";
	pk->pubkey_algo = list->pubkey_algo;
	if (!get_pubkey (pk, list->kid))
	{
	char *p;
	log_info (_("encrypted with %u-bit %s key, ID %s, created %s\n"),
	nbits_from_pk (pk), algstr, keystr_from_pk(pk),
	strtimestamp (pk->timestamp));
	p = get_user_id_native (list->kid);
	log_printf (_(" \"%s\"\n"), p);
	xfree (p);
	}
	else
	log_info (_("encrypted with %s key, ID %s\n"),
	algstr, keystr(list->kid));

	free_public_key (pk);

	if (gpg_err_code (list->reason) == GPG_ERR_NO_SECKEY)
	{
	if (is_status_enabled())
	{
	char buf[20];
	snprintf (buf, sizeof buf, "%08lX%08lX",
	(ulong)list->kid[0], (ulong)list->kid[1]);
	write_status_text (STATUS_NO_SECKEY, buf);
	}
	}
	else if (list->reason)
	{
	log_info (_("public key decryption failed: %s\n"),
	gpg_strerror (list->reason));
	write_status_error ("pkdecrypt_failed", list->reason);
	}
	}
	}


	static void
	proc_encrypted (CTX c, PACKET *pkt)
	{
	int result = 0;

	if (!opt.quiet)
	{
	if (c->symkeys>1)
	log_info (_("encrypted with %lu passphrases\n"), c->symkeys);
	else if (c->symkeys == 1)
	log_info (_("encrypted with 1 passphrase\n"));
	print_pkenc_list ( c->pkenc_list, 1 );
	print_pkenc_list ( c->pkenc_list, 0 );
	}

	/* FIXME: Figure out the session key by looking at all pkenc packets. */

	write_status (STATUS_BEGIN_DECRYPTION);

	/log_debug("dat: %sencrypted data\n", c->dek?"":"conventional ");/
	if (opt.list_only)
	result = -1;
	else if (!c->dek && !c->last_was_session_key)
	{
	int algo;
	STRING2KEY s2kbuf;
	STRING2KEY *s2k = NULL;
	int canceled;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	/* Assume this is old style conventional encrypted data. */
	algo = opt.def_cipher_algo;
	if (algo)
	log_info (_("assuming %s encrypted data\n"),
	openpgp_cipher_algo_name (algo));
	else if (openpgp_cipher_test_algo (CIPHER_ALGO_IDEA))
	{
	algo = opt.def_cipher_algo;
	if (!algo)
	algo = opt.s2k_cipher_algo;
	log_info (_("IDEA cipher unavailable, "
	"optimistically attempting to use %s instead\n"),
	openpgp_cipher_algo_name (algo));
	}
	else
	{
	algo = CIPHER_ALGO_IDEA;
	if (!opt.s2k_digest_algo)
	{
	/* If no digest is given we assume SHA-1. */
	s2kbuf.mode = 0;
	s2kbuf.hash_algo = DIGEST_ALGO_SHA1;
	s2k = &s2kbuf;
	}
	log_info (_("assuming %s encrypted data\n"), "IDEA");
	}

	c->dek = passphrase_to_dek (algo, s2k, 0, 0, NULL, &canceled);
	if (c->dek)
	c->dek->algo_info_printed = 1;
	else if (canceled)
	result = gpg_error (GPG_ERR_CANCELED);
	else
	result = gpg_error (GPG_ERR_INV_PASSPHRASE);
	}
	}
	else if (!c->dek)
	result = GPG_ERR_NO_SECKEY;

	if (!result)
	result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );

	if (result == -1)
	;
	else if (!result
	&& !opt.ignore_mdc_error
	&& !pkt->pkt.encrypted->mdc_method
	&& openpgp_cipher_get_algo_blklen (c->dek->algo) != 8
	&& c->dek->algo != CIPHER_ALGO_TWOFISH)
	{
	/* The message has been decrypted but has no MDC despite that a
	modern cipher (blocklength != 64 bit, except for Twofish) is
	used and the option to ignore MDC errors is not used: To
	avoid attacks changing an MDC message to a non-MDC message,
	we fail here. */
	log_error (_("WARNING: message was not integrity protected\n"));
	if (opt.verbose > 1)
	log_info ("decryption forced to fail\n");
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else if (!result \|\| (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
	&& opt.ignore_mdc_error))
	{
	write_status (STATUS_DECRYPTION_OKAY);
	if (opt.verbose > 1)
	log_info(_("decryption okay\n"));
	if (pkt->pkt.encrypted->mdc_method && !result)
	write_status (STATUS_GOODMDC);
	else if (!opt.no_mdc_warn)
	log_info (_("WARNING: message was not integrity protected\n"));
	}
	else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE)
	{
	glo_ctrl.lasterr = result;
	log_error (_("WARNING: encrypted message has been manipulated!\n"));
	write_status (STATUS_BADMDC);
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else
	{
	if (gpg_err_code (result) == GPG_ERR_BAD_KEY
	&& *c->dek->s2k_cacheid != '\0')
	{
	if (opt.debug)
	log_debug ("cleared passphrase cached with ID: %s\n",
	c->dek->s2k_cacheid);
	passphrase_clear_cache (c->dek->s2k_cacheid);
	}
	glo_ctrl.lasterr = result;
	write_status (STATUS_DECRYPTION_FAILED);
	log_error (_("decryption failed: %s\n"), gpg_strerror (result));
	/* Hmmm: does this work when we have encrypted using multiple
	* ways to specify the session key (symmmetric and PK). */
	}

	xfree (c->dek);
	c->dek = NULL;
	free_packet (pkt);
	c->last_was_session_key = 0;
	write_status (STATUS_END_DECRYPTION);
	}


	static void
	proc_plaintext( CTX c, PACKET *pkt )
	{
	PKT_plaintext *pt = pkt->pkt.plaintext;
	int any, clearsig, rc;
	kbnode_t n;

	literals_seen++;

	if (pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8))
	log_info (_("Note: sender requested \"for-your-eyes-only\"\n"));
	else if (opt.verbose)
	log_info (_("original file name='%.*s'\n"), pt->namelen, pt->name);

	free_md_filter_context (&c->mfx);
	if (gcry_md_open (&c->mfx.md, 0, 0))
	BUG ();
	/* fixme: we may need to push the textfilter if we have sigclass 1
	* and no armoring - Not yet tested
	* Hmmm, why don't we need it at all if we have sigclass 1
	* Should we assume that plaintext in mode 't' has always sigclass 1??
	* See: Russ Allbery's mail 1999-02-09
	*/
	any = clearsig = 0;
	for (n=c->list; n; n = n->next )
	{
	if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* The onepass signature case. */
	if (n->pkt->pkt.onepass_sig->digest_algo)
	{
	gcry_md_enable (c->mfx.md, n->pkt->pkt.onepass_sig->digest_algo);
	any = 1;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* The clearsigned message case. */
	size_t datalen = n->pkt->pkt.gpg_control->datalen;
	const byte *data = n->pkt->pkt.gpg_control->data;

	/* Check that we have at least the sigclass and one hash. */
	if (datalen < 2)
	log_fatal ("invalid control packet CTRLPKT_CLEARSIGN_START\n");
	/* Note that we don't set the clearsig flag for not-dash-escaped
	* documents. */
	clearsig = (*data == 0x01);
	for (data++, datalen--; datalen; datalen--, data++)
	gcry_md_enable (c->mfx.md, *data);
	any = 1;
	break; /* Stop here as one-pass signature packets are not
	expected. */
	}
	else if (n->pkt->pkttype == PKT_SIGNATURE)
	{
	/* The SIG+LITERAL case that PGP used to use. */
	gcry_md_enable ( c->mfx.md, n->pkt->pkt.signature->digest_algo );
	any = 1;
	}
	}

	if (!any && !opt.skip_verify)
	{
	/* This is for the old GPG LITERAL+SIG case. It's not legal
	according to 2440, so hopefully it won't come up that often.
	There is no good way to specify what algorithms to use in
	that case, so these there are the historical answer. */
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
	}
	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	rc=0;

	if (literals_seen > 1)
	{
	log_info (_("WARNING: multiple plaintexts seen\n"));

	if (!opt.flags.allow_multiple_messages)
	{
	write_status_text (STATUS_ERROR, "proc_pkt.plaintext 89_BAD_DATA");
	log_inc_errorcount ();
	rc = gpg_error (GPG_ERR_UNEXPECTED);
	}
	}

	if (!rc)
	{
	/* It we are in --verify mode, we do not want to output the
	* signed text. However, if --output is also used we do what
	* has been requested and write out the signed data. */
	rc = handle_plaintext (pt, &c->mfx,
	(opt.outfp \|\| opt.outfile)? 0 : c->sigs_only,
	clearsig);
	if (gpg_err_code (rc) == GPG_ERR_EACCES && !c->sigs_only)
	{
	/* Can't write output but we hash it anyway to check the
	signature. */
	rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
	}
	}

	if (rc)
	log_error ("handle plaintext failed: %s\n", gpg_strerror (rc));

	free_packet(pkt);
	c->last_was_session_key = 0;

	/* We add a marker control packet instead of the plaintext packet.
	* This is so that we can later detect invalid packet sequences. */
	n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK, NULL, 0));
	if (c->list)
	add_kbnode (c->list, n);
	else
	c->list = n;
	}


	static int
	proc_compressed_cb (iobuf_t a, void *info)
	{
	if ( ((CTX)info)->signed_data.used
	&& ((CTX)info)->signed_data.data_fd != -1)
	return proc_signature_packets_by_fd (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_fd);
	else
	return proc_signature_packets (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_names,
	((CTX)info)->sigfilename );
	}


	static int
	proc_encrypt_cb (iobuf_t a, void *info )
	{
	CTX c = info;
	return proc_encryption_packets (c->ctrl, info, a );
	}


	static int
	proc_compressed (CTX c, PACKET *pkt)
	{
	PKT_compressed *zd = pkt->pkt.compressed;
	int rc;

	/printf("zip: compressed data packet\n");/
	if (c->sigs_only)
	rc = handle_compressed (c->ctrl, c, zd, proc_compressed_cb, c);
	else if( c->encrypt_only )
	rc = handle_compressed (c->ctrl, c, zd, proc_encrypt_cb, c);
	else
	rc = handle_compressed (c->ctrl, c, zd, NULL, NULL);

	if (gpg_err_code (rc) == GPG_ERR_BAD_DATA)
	{
	if (!c->any.uncompress_failed)
	{
	CTX cc;

	for (cc=c; cc; cc = cc->anchor)
	cc->any.uncompress_failed = 1;
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));
	}
	}
	else if (rc)
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));

	free_packet(pkt);
	c->last_was_session_key = 0;
	return rc;
	}


	/*
	* Check the signature. If R_PK is not NULL a copy of the public key
	* used to verify the signature will be stored tehre, or NULL if not
	* found. Returns: 0 = valid signature or an error code
	*/
	static int
	do_check_sig (CTX c, kbnode_t node, int *is_selfsig,
	int is_expkey, int is_revkey, PKT_public_key **r_pk)
	{
	PKT_signature *sig;
	gcry_md_hd_t md = NULL;
	gcry_md_hd_t md2 = NULL;
	gcry_md_hd_t md_good = NULL;
	int algo, rc;

	if (r_pk)
	*r_pk = NULL;

	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	if (is_selfsig)
	*is_selfsig = 0;
	sig = node->pkt->pkt.signature;

	algo = sig->digest_algo;
	rc = openpgp_md_test_algo (algo);
	if (rc)
	return rc;

	if (sig->sig_class == 0x00)
	{
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	}
	else /* detached signature */
	{
	/* check_signature() will enable the md. */
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	}
	}
	else if (sig->sig_class == 0x01)
	{
	/* How do we know that we have to hash the (already hashed) text
	in canonical mode ??? (calculating both modes???) */
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	if (c->mfx.md2 && gcry_md_copy (&md2, c->mfx.md2))
	BUG ();
	}
	else /* detached signature */
	{
	log_debug ("Do we really need this here?");
	/* check_signature() will enable the md*/
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	if (gcry_md_open (&md2, 0, 0 ))
	BUG ();
	}
	}
	else if ((sig->sig_class&~3) == 0x10
	\|\| sig->sig_class == 0x18
	\|\| sig->sig_class == 0x1f
	\|\| sig->sig_class == 0x20
	\|\| sig->sig_class == 0x28
	\|\| sig->sig_class == 0x30)
	{
	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	return check_key_signature( c->list, node, is_selfsig );
	}
	else if (sig->sig_class == 0x20)
	{
	log_error (_("standalone revocation - "
	"use \"gpg --import\" to apply\n"));
	return GPG_ERR_NOT_PROCESSED;
	}
	else
	{
	log_error ("invalid root packet for sigclass %02x\n", sig->sig_class);
	return GPG_ERR_SIG_CLASS;
	}
	}
	else
	return GPG_ERR_SIG_CLASS;

	/* We only get here if we are checking the signature of a binary
	(0x00) or text document (0x01). */
	rc = check_signature2 (sig, md, NULL, is_expkey, is_revkey, r_pk);
	if (! rc)
	md_good = md;
	else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
	{
	PKT_public_key *pk2;

	rc = check_signature2 (sig, md2, NULL, is_expkey, is_revkey,
	r_pk? &pk2 : NULL);
	if (!rc)
	{
	md_good = md2;
	if (r_pk)
	{
	free_public_key (*r_pk);
	*r_pk = pk2;
	}
	}
	}

	if (md_good)
	{
	unsigned char *buffer = gcry_md_read (md_good, sig->digest_algo);
	sig->digest_len = gcry_md_get_algo_dlen (map_md_openpgp_to_gcry (algo));
	memcpy (sig->digest, buffer, sig->digest_len);
	}

	gcry_md_close (md);
	gcry_md_close (md2);

	return rc;
	}


	static void
	print_userid (PACKET *pkt)
	{
	if (!pkt)
	BUG();

	if (pkt->pkttype != PKT_USER_ID)
	{
	es_printf ("ERROR: unexpected packet type %d", pkt->pkttype );
	return;
	}
	if (opt.with_colons)
	{
	if (pkt->pkt.user_id->attrib_data)
	es_printf("%u %lu",
	pkt->pkt.user_id->numattribs,
	pkt->pkt.user_id->attrib_len);
	else
	es_write_sanitized (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len, ":", NULL);
	}
	else
	print_utf8_buffer (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len );
	}


	/*
	* List the keyblock in a user friendly way
	*/
	static void
	list_node (CTX c, kbnode_t node)
	{
	if (!node)
	;
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	if (opt.with_colons)
	{
	u32 keyid[2];

	keyid_from_pk( pk, keyid );
	if (pk->flags.primary)
	c->trustletter = (opt.fast_list_mode
	? 0
	: get_validity_info
	(c->ctrl,
	node->pkt->pkttype == PKT_PUBLIC_KEY
	? node : NULL,
	pk, NULL));
	es_printf ("%s:", pk->flags.primary? "pub":"sub" );
	if (c->trustletter)
	es_putc (c->trustletter, es_stdout);
	es_printf (":%u:%d:%08lX%08lX:%s:%s::",
	nbits_from_pk( pk ),
	pk->pubkey_algo,
	(ulong)keyid[0],(ulong)keyid[1],
	colon_datestr_from_pk( pk ),
	colon_strtime (pk->expiredate) );
	if (pk->flags.primary && !opt.fast_list_mode)
	es_putc (get_ownertrust_info (pk), es_stdout);
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	}
	else
	{
	print_key_line (es_stdout, pk, 0);
	}

	if (opt.keyid_format == KF_NONE && !opt.with_colons)
	; /* Already printed. */
	else if ((pk->flags.primary && opt.fingerprint) \|\| opt.fingerprint > 1)
	print_fingerprint (NULL, pk, 0);

	if (opt.with_colons)
	{
	if (node->next && node->next->pkt->pkttype == PKT_RING_TRUST)
	es_printf ("rtv:1:%u:\n",
	node->next->pkt->pkt.ring_trust->trustval);
	}

	if (pk->flags.primary)
	{
	int kl = opt.keyid_format == KF_NONE? 0 : keystrlen ();

	/* Now list all userids with their signatures. */
	for (node = node->next; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	list_node (c, node );
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (opt.with_colons)
	es_printf ("%s:::::::::",
	node->pkt->pkt.user_id->attrib_data?"uat":"uid");
	else
	es_printf ("uid%*s",
	kl + (opt.legacy_list_mode? 9:11),
	"" );
	print_userid (node->pkt);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	if (opt.with_colons
	&& node->next
	&& node->next->pkt->pkttype == PKT_RING_TRUST)
	{
	es_printf ("rtv:2:%u:\n",
	node->next->pkt->pkt.ring_trust?
	node->next->pkt->pkt.ring_trust->trustval : 0);
	}
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	list_node(c, node );
	}
	}
	}
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{

	log_debug ("FIXME: No way to print secret key packets here\n");
	/* fixme: We may use a function to turn a secret key packet into
	a public key one and use that here. */
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int is_selfsig = 0;
	int rc2 = 0;
	size_t n;
	char *p;
	int sigrc = ' ';

	if (!opt.verbose)
	return;

	if (sig->sig_class == 0x20 \|\| sig->sig_class == 0x30)
	es_fputs ("rev", es_stdout);
	else
	es_fputs ("sig", es_stdout);
	if (opt.check_sigs)
	{
	fflush (stdout);
	rc2 = do_check_sig (c, node, &is_selfsig, NULL, NULL, NULL);
	switch (gpg_err_code (rc2))
	{
	case 0: sigrc = '!'; break;
	case GPG_ERR_BAD_SIGNATURE: sigrc = '-'; break;
	case GPG_ERR_NO_PUBKEY:
	case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
	default: sigrc = '%'; break;
	}
	}
	else /* Check whether this is a self signature. */
	{
	u32 keyid[2];

	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_SECRET_KEY )
	{
	keyid_from_pk (c->list->pkt->pkt.public_key, keyid);

	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	is_selfsig = 1;
	}
	}

	if (opt.with_colons)
	{
	es_putc (':', es_stdout);
	if (sigrc != ' ')
	es_putc (sigrc, es_stdout);
	es_printf ("::%d:%08lX%08lX:%s:%s:", sig->pubkey_algo,
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	colon_datestr_from_sig (sig),
	colon_expirestr_from_sig (sig));

	if (sig->trust_depth \|\| sig->trust_value)
	es_printf ("%d %d",sig->trust_depth,sig->trust_value);
	es_putc (':', es_stdout);

	if (sig->trust_regexp)
	es_write_sanitized (es_stdout, sig->trust_regexp,
	strlen (sig->trust_regexp), ":", NULL);
	es_putc (':', es_stdout);
	}
	else
	es_printf ("%c %s %s ",
	sigrc, keystr (sig->keyid), datestr_from_sig(sig));
	if (sigrc == '%')
	es_printf ("[%s] ", gpg_strerror (rc2) );
	else if (sigrc == '?')
	;
	else if (is_selfsig)
	{
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_fputs (sig->sig_class == 0x18? "[keybind]":"[selfsig]", es_stdout);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	}
	else if (!opt.fast_list_mode)
	{
	p = get_user_id (sig->keyid, &n);
	es_write_sanitized (es_stdout, p, n,
	opt.with_colons?":":NULL, NULL );
	xfree (p);
	}
	if (opt.with_colons)
	es_printf (":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
	es_putc ('\n', es_stdout);
	}
	else
	log_error ("invalid node with packet of type %d\n", node->pkt->pkttype);
	}


	int
	proc_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	int rc;
	CTX c = xmalloc_clear (sizeof *c);

	c->ctrl = ctrl;
	c->anchor = anchor;
	rc = do_proc_packets (ctrl, c, a);
	xfree (c);

	return rc;
	}


	int
	proc_signature_packets (ctrl_t ctrl, void *anchor, iobuf_t a,
	strlist_t signedfiles, const char *sigfilename )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = -1;
	c->signed_data.data_names = signedfiles;
	c->signed_data.used = !!signedfiles;

	c->sigfilename = sigfilename;
	rc = do_proc_packets (ctrl, c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = GPG_ERR_NO_DATA;
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree (c);
	return rc;
	}


	int
	proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, iobuf_t a, int signed_data_fd )
	{
	int rc;
	CTX c;

	c = xtrycalloc (1, sizeof *c);
	if (!c)
	return gpg_error_from_syserror ();

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = signed_data_fd;
	c->signed_data.data_names = NULL;
	c->signed_data.used = (signed_data_fd != -1);

	rc = do_proc_packets (ctrl, c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = gpg_error (GPG_ERR_NO_DATA);
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree ( c );
	return rc;
	}


	int
	proc_encryption_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->encrypt_only = 1;
	rc = do_proc_packets (ctrl, c, a);
	xfree (c);
	return rc;
	}


	static int
	check_nesting (CTX c)
	{
	int level;

	for (level=0; c; c = c->anchor)
	level++;

	if (level > MAX_NESTING_DEPTH)
	{
	log_error ("input data with too deeply nested packets\n");
	write_status_text (STATUS_UNEXPECTED, "1");
	return GPG_ERR_BAD_DATA;
	}

	return 0;
	}


	static int
	do_proc_packets (ctrl_t ctrl, CTX c, iobuf_t a)
	{
	PACKET *pkt;
	int rc = 0;
	int any_data = 0;
	int newpkt;

	rc = check_nesting (c);
	if (rc)
	return rc;

	pkt = xmalloc( sizeof *pkt );
	c->iobuf = a;
	init_packet(pkt);
	while ((rc=parse_packet(a, pkt)) != -1)
	{
	any_data = 1;
	if (rc)
	{
	free_packet (pkt);
	/* Stop processing when an invalid packet has been encountered
	* but don't do so when we are doing a --list-packets. */
	if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
	&& opt.list_packets == 0)
	break;
	continue;
	}
	newpkt = -1;
	if (opt.list_packets)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->sigs_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	case PKT_SYMKEY_ENC:
	case PKT_PUBKEY_ENC:
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	write_status_text( STATUS_UNEXPECTED, "0" );
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->encrypt_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	write_status_text (STATUS_UNEXPECTED, "0");
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	release_list (c);
	c->list = new_kbnode (pkt);
	newpkt = 1;
	break;
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_SUBKEY:
	newpkt = add_subkey (c, pkt);
	break;
	case PKT_USER_ID: newpkt = add_user_id (c, pkt); break;
	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (ctrl, c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
	case PKT_RING_TRUST: newpkt = add_ring_trust (c, pkt); break;
	default: newpkt = 0; break;
	}
	}

	if (rc)
	goto leave;

	/* This is a very ugly construct and frankly, I don't remember why
	* I used it. Adding the MDC check here is a hack.
	* The right solution is to initiate another context for encrypted
	* packet and not to reuse the current one ... It works right
	* when there is a compression packet between which adds just
	* an extra layer.
	* Hmmm: Rewrite this whole module here??
	*/
	if (pkt->pkttype != PKT_SIGNATURE && pkt->pkttype != PKT_MDC)
	c->any.data = (pkt->pkttype == PKT_PLAINTEXT);

	if (newpkt == -1)
	;
	else if (newpkt)
	{
	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	}
	else
	free_packet(pkt);
	}

	if (rc == GPG_ERR_INV_PACKET)
	write_status_text (STATUS_NODATA, "3");

	if (any_data)
	rc = 0;
	else if (rc == -1)
	write_status_text (STATUS_NODATA, "2");


	leave:
	release_list (c);
	xfree(c->dek);
	free_packet (pkt);
	xfree (pkt);
	free_md_filter_context (&c->mfx);
	return rc;
	}


	/* Helper for pka_uri_from_sig to parse the to-be-verified address out
	of the notation data. */
	static pka_info_t *
	get_pka_address (PKT_signature *sig)
	{
	pka_info_t *pka = NULL;
	struct notation nd,notation;

	notation=sig_to_notation(sig);

	for(nd=notation;nd;nd=nd->next)
	{
	if(strcmp(nd->name,"pka-address@gnupg.org")!=0)
	continue; /* Not the notation we want. */

	/* For now we only use the first valid PKA notation. In future
	we might want to keep additional PKA notations in a linked
	list. */
	if (is_valid_mailbox (nd->value))
	{
	pka = xmalloc (sizeof *pka + strlen(nd->value));
	pka->valid = 0;
	pka->checked = 0;
	pka->uri = NULL;
	strcpy (pka->email, nd->value);
	break;
	}
	}

	free_notation(notation);

	return pka;
	}


	/* Return the URI from a DNS PKA record. If this record has already
	be retrieved for the signature we merely return it; if not we go
	out and try to get that DNS record. */
	static const char *
	pka_uri_from_sig (CTX c, PKT_signature *sig)
	{
	if (!sig->flags.pka_tried)
	{
	log_assert (!sig->pka_info);
	sig->flags.pka_tried = 1;
	sig->pka_info = get_pka_address (sig);
	if (sig->pka_info)
	{
	char *url;
	unsigned char *fpr;
	size_t fprlen;

	if (!gpg_dirmngr_get_pka (c->ctrl, sig->pka_info->email,
	&fpr, &fprlen, &url))
	{
	if (fpr && fprlen == sizeof sig->pka_info->fpr)
	{
	memcpy (sig->pka_info->fpr, fpr, fprlen);
	if (url)
	{
	sig->pka_info->valid = 1;
	if (!*url)
	xfree (url);
	else
	sig->pka_info->uri = url;
	url = NULL;
	}
	}
	xfree (fpr);
	xfree (url);
	}
	}
	}
	return sig->pka_info? sig->pka_info->uri : NULL;
	}


	/* Return true if the AKL has the WKD method specified. */
	static int
	akl_has_wkd_method (void)
	{
	struct akl *akl;

	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_WKD)
	return 1;
	return 0;
	}


	/* Return the ISSUER fingerprint string in human readbale format if
	* available. Caller must release the string. */
	static char *
	issuer_fpr_string (PKT_signature *sig)
	{
	const byte *p;
	size_t n;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_ISSUER_FPR, &n);
	if (p && n == 21 && p[0] == 4)
	return bin2hex (p+1, n-1, NULL);
	return NULL;
	}


	static void
	print_good_bad_signature (int statno, const char *keyid_str, kbnode_t un,
	PKT_signature *sig, int rc)
	{
	char *p;

	write_status_text_and_buffer (statno, keyid_str,
	un? un->pkt->pkt.user_id->name:"[?]",
	un? un->pkt->pkt.user_id->len:3,
	-1);

	if (un)
	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	else
	p = xstrdup ("[?]");

	if (rc)
	log_info (_("BAD signature from \"%s\""), p);
	else if (sig->flags.expired)
	log_info (_("Expired signature from \"%s\""), p);
	else
	log_info (_("Good signature from \"%s\""), p);

	xfree (p);
	}


	static int
	check_sig_and_print (CTX c, kbnode_t node)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	const char *astr;
	int rc;
	int is_expkey = 0;
	int is_revkey = 0;
	char *issuer_fpr;
	PKT_public_key pk = NULL; / The public key for the signature or NULL. */

	if (opt.skip_verify)
	{
	log_info(_("signature verification suppressed\n"));
	return 0;
	}

	/* Check that the message composition is valid.
	*
	* Per RFC-2440bis (-15) allowed:
	*
	* S{1,n} -- detached signature.
	* S{1,n} P -- old style PGP2 signature
	* O{1,n} P S{1,n} -- standard OpenPGP signature.
	* C P S{1,n} -- cleartext signature.
	*
	*
	* O = One-Pass Signature packet.
	* S = Signature packet.
	* P = OpenPGP Message packet (Encrypted \| Compressed \| Literal)
	* (Note that the current rfc2440bis draft also allows
	* for a signed message but that does not work as it
	* introduces ambiguities.)
	* We keep track of these packages using the marker packet
	* CTRLPKT_PLAINTEXT_MARK.
	* C = Marker packet for cleartext signatures.
	*
	* We reject all other messages.
	*
	* Actually we are calling this too often, i.e. for verification of
	* each message but better have some duplicate work than to silently
	* introduce a bug here.
	*/
	{
	kbnode_t n;
	int n_onepass, n_sig;

	/* log_debug ("checking signature packet composition\n"); */
	/* dump_kbnode (c->list); */

	n = c->list;
	log_assert (n);
	if ( n->pkt->pkttype == PKT_SIGNATURE )
	{
	/* This is either "S{1,n}" case (detached signature) or
	"S{1,n} P" (old style PGP2 signature). */
	for (n = n->next; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (!n)
	; /* Okay, this is a detached signature. */
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK) )
	{
	if (n->next)
	goto ambiguous; /* We only allow one P packet. */
	}
	else
	goto ambiguous;
	}
	else if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* This is the "O{1,n} P S{1,n}" case (standard signature). */
	for (n_onepass=1, n = n->next;
	n && n->pkt->pkttype == PKT_ONEPASS_SIG; n = n->next)
	n_onepass++;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (!n_sig)
	goto ambiguous;

	/* If we wanted to disallow multiple sig verification, we'd do
	something like this:

	if (n && !opt.allow_multisig_verification)
	goto ambiguous;

	However, now that we have --allow-multiple-messages, this
	can stay allowable as we can't get here unless multiple
	messages (i.e. multiple literals) are allowed. */

	if (n_onepass != n_sig)
	{
	log_info ("number of one-pass packets does not match "
	"number of signature packets\n");
	goto ambiguous;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* This is the "C P S{1,n}" case (clear text signature). */
	n = n->next;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (n \|\| !n_sig)
	goto ambiguous;
	}
	else
	{
	ambiguous:
	log_error(_("can't handle this ambiguous signature data\n"));
	return 0;
	}
	}

	if (sig->signers_uid)
	write_status_buffer (STATUS_NEWSIG,
	sig->signers_uid, strlen (sig->signers_uid), 0);
	else
	write_status_text (STATUS_NEWSIG, NULL);

	astr = openpgp_pk_algo_name ( sig->pubkey_algo );
	if ((issuer_fpr = issuer_fpr_string (sig)))
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", issuer_fpr);

	xfree (issuer_fpr);
	}
	else if (!keystrlen () \|\| keystrlen () > 8)
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", keystr(sig->keyid));
	}
	else /* Legacy format. */
	log_info (_("Signature made %s using %s key ID %s\n"),
	asctimestamp(sig->timestamp), astr? astr: "?",
	keystr(sig->keyid));

	/* In verbose mode print the signers UID. */
	if (sig->signers_uid)
	log_info (_(" issuer \"%s\"\n"), sig->signers_uid);

	rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);

	/* If the key isn't found, check for a preferred keyserver. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY && sig->flags.pref_ks)
	{
	const byte *p;
	int seq = 0;
	size_t n;

	while ((p=enum_sig_subpkt (sig->hashed,SIGSUBPKT_PREF_KS,&n,&seq,NULL)))
	{
	/* According to my favorite copy editor, in English grammar,
	you say "at" if the key is located on a web page, but
	"from" if it is located on a keyserver. I'm not going to
	even try to make two strings here :) */
	log_info(_("Key available at: ") );
	print_utf8_buffer (log_get_stream(), p, n);
	log_printf ("\n");

	if (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE
	&& opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL)
	{
	struct keyserver_spec *spec;

	spec = parse_preferred_keyserver (sig);
	if (spec)
	{
	int res;

	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid,spec, 1);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	rc = do_check_sig (c, node, NULL,
	&is_expkey, &is_revkey, &pk);
	free_keyserver_spec (spec);

	if (!rc)
	break;
	}
	}
	}
	}

	/* If the avove methods didn't work, our next try is to use the URI
	* from a DNS PKA record. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& (opt.keyserver_options.options & KEYSERVER_HONOR_PKA_RECORD))
	{
	const char *uri = pka_uri_from_sig (c, sig);

	if (uri)
	{
	/* FIXME: We might want to locate the key using the
	fingerprint instead of the keyid. */
	int res;
	struct keyserver_spec *spec;

	spec = parse_keyserver_uri (uri, 1);
	if (spec)
	{
	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid, spec, 1);
	glo_ctrl.in_auto_key_retrieve--;
	free_keyserver_spec (spec);
	if (!res)
	rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}
	}
	}

	/* If the above methods didn't work, our next try is to locate
	* the key via its fingerprint from a keyserver. This requires
	* that the signers fingerprint is encoded in the signature. We
	* favor this over the WKD method (to be tried next), because an
	* arbitrary keyserver is less subject to web bug like monitoring. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (c->ctrl))
	{
	int res;
	const byte *p;
	size_t n;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_ISSUER_FPR, &n);
	if (p && n == 21 && p[0] == 4)
	{
	/* v4 packet with a SHA-1 fingerprint. */
	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_fprint (c->ctrl, p+1, n-1, opt.keyserver, 1);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}
	}

	/* If the above methods didn't work, our next try is to retrieve the
	* key from the WKD. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& !opt.flags.disable_signer_uid
	&& akl_has_wkd_method ()
	&& sig->signers_uid)
	{
	int res;

	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_wkd (c->ctrl, sig->signers_uid, 1, NULL, NULL);
	glo_ctrl.in_auto_key_retrieve--;
	/* Fixme: If the fingerprint is embedded in the signature,
	* compare it to the fingerprint of the returned key. */
	if (!res)
	rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}

	/* If the above methods did't work, our next try is to use a
	* keyserver. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (c->ctrl))
	{
	int res;

	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid, opt.keyserver, 1);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
	}

	if (!rc \|\| gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
	{
	kbnode_t un, keyblock;
	int count = 0;
	int statno;
	char keyid_str[50];
	PKT_public_key *mainpk = NULL;

	if (rc)
	statno = STATUS_BADSIG;
	else if (sig->flags.expired)
	statno = STATUS_EXPSIG;
	else if (is_expkey)
	statno = STATUS_EXPKEYSIG;
	else if(is_revkey)
	statno = STATUS_REVKEYSIG;
	else
	statno = STATUS_GOODSIG;

	/* FIXME: We should have the public key in PK and thus the
	* keyboock has already been fetched. Thus we could use the
	* fingerprint or PK itself to lookup the entire keyblock. That
	* would best be done with a cache. */
	keyblock = get_pubkeyblock (sig->keyid);

	snprintf (keyid_str, sizeof keyid_str, "%08lX%08lX [uncertain] ",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1]);

	/* Find and print the primary user ID along with the
	"Good\|Expired\|Bad signature" line. */
	for (un=keyblock; un; un = un->next)
	{
	int valid;

	if (un->pkt->pkttype==PKT_PUBLIC_KEY)
	{
	mainpk = un->pkt->pkt.public_key;
	continue;
	}
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if (!un->pkt->pkt.user_id->created)
	continue;
	if (un->pkt->pkt.user_id->is_revoked)
	continue;
	if (un->pkt->pkt.user_id->is_expired)
	continue;
	if (!un->pkt->pkt.user_id->is_primary)
	continue;
	/* We want the textual primary user ID here */
	if (un->pkt->pkt.user_id->attrib_data)
	continue;

	log_assert (mainpk);

	/* Since this is just informational, don't actually ask the
	user to update any trust information. (Note: we register
	the signature later.) Because print_good_bad_signature
	does not print a LF we need to compute the validity
	before calling that function. */
	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	valid = get_validity (c->ctrl, keyblock, mainpk,
	un->pkt->pkt.user_id, NULL, 0);
	else
	valid = 0; /* Not used. */

	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	log_printf (" [%s]\n",trust_value_to_string(valid));
	else
	log_printf ("\n");

	count++;
	}

	log_assert (mainpk);

	- /* In case we did not found a valid valid textual userid above
	+ /* In case we did not found a valid textual userid above
	we print the first user id packet or a "[?]" instead along
	with the "Good\|Expired\|Bad signature" line. */
	if (!count)
	{
	/* Try for an invalid textual userid */
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID
	&& !un->pkt->pkt.user_id->attrib_data)
	break;
	}

	/* Try for any userid at all */
	if (!un)
	{
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID)
	break;
	}
	}

	if (opt.trust_model==TM_ALWAYS \|\| !un)
	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if (opt.trust_model != TM_ALWAYS && un)
	log_printf (" %s",_("[uncertain]") );
	log_printf ("\n");
	}

	/* If we have a good signature and already printed
	* the primary user ID, print all the other user IDs */
	if (count
	&& !rc
	&& !(opt.verify_options & VERIFY_SHOW_PRIMARY_UID_ONLY))
	{
	char *p;
	for( un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if ((un->pkt->pkt.user_id->is_revoked
	\|\| un->pkt->pkt.user_id->is_expired)
	&& !(opt.verify_options & VERIFY_SHOW_UNUSABLE_UIDS))
	continue;
	/* Skip textual primary user ids which we printed above. */
	if (un->pkt->pkt.user_id->is_primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	/* If this user id has attribute data, print that. */
	if (un->pkt->pkt.user_id->attrib_data)
	{
	dump_attribs (un->pkt->pkt.user_id, mainpk);

	if (opt.verify_options&VERIFY_SHOW_PHOTOS)
	show_photos (c->ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs,
	mainpk ,un->pkt->pkt.user_id);
	}

	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	log_info (_(" aka \"%s\""), p);
	xfree (p);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	{
	const char *valid;

	if (un->pkt->pkt.user_id->is_revoked)
	valid = _("revoked");
	else if (un->pkt->pkt.user_id->is_expired)
	valid = _("expired");
	else
	/* Since this is just informational, don't
	actually ask the user to update any trust
	information. */
	valid = (trust_value_to_string
	(get_validity (c->ctrl, keyblock, mainpk,
	un->pkt->pkt.user_id, NULL, 0)));
	log_printf (" [%s]\n",valid);
	}
	else
	log_printf ("\n");
	}
	}

	/* For good signatures print notation data. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_SHOW_POLICY_URLS))
	show_policy_url (sig, 0, 1);
	else
	show_policy_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_KEYSERVER_URLS))
	show_keyserver_url (sig, 0, 1);
	else
	show_keyserver_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_NOTATIONS))
	show_notation
	(sig, 0, 1,
	(((opt.verify_options&VERIFY_SHOW_STD_NOTATIONS)?1:0)
	+ ((opt.verify_options&VERIFY_SHOW_USER_NOTATIONS)?2:0)));
	else
	show_notation (sig, 0, 2, 0);
	}

	/* For good signatures print the VALIDSIG status line. */
	if (!rc && is_status_enabled () && pk)
	{
	char pkhex[MAX_FINGERPRINT_LEN*2+1];
	char mainpkhex[MAX_FINGERPRINT_LEN*2+1];

	hexfingerprint (pk, pkhex, sizeof pkhex);
	hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);

	/* TODO: Replace the reserved '0' in the field below with
	bits for status flags (policy url, notation, etc.). */
	write_status_printf (STATUS_VALIDSIG,
	"%s %s %lu %lu %d 0 %d %d %02X %s",
	pkhex,
	strtimestamp (sig->timestamp),
	(ulong)sig->timestamp,
	(ulong)sig->expiredate,
	sig->version, sig->pubkey_algo,
	sig->digest_algo,
	sig->sig_class,
	mainpkhex);
	}

	/* For good signatures compute and print the trust information.
	Note that in the Tofu trust model this may ask the user on
	how to resolve a conflict. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_PKA_LOOKUPS))
	pka_uri_from_sig (c, sig); /* Make sure PKA info is available. */
	rc = check_signatures_trust (c->ctrl, sig);
	}

	/* Print extra information about the signature. */
	if (sig->flags.expired)
	{
	log_info (_("Signature expired %s\n"), asctimestamp(sig->expiredate));
	rc = GPG_ERR_GENERAL; /* Need a better error here? */
	}
	else if (sig->expiredate)
	log_info (_("Signature expires %s\n"), asctimestamp(sig->expiredate));

	if (opt.verbose)
	{
	char pkstrbuf[PUBKEY_STRING_SIZE];

	if (pk)
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
	else
	*pkstrbuf = 0;

	log_info (_("%s signature, digest algorithm %s%s%s\n"),
	sig->sig_class==0x00?_("binary"):
	sig->sig_class==0x01?_("textmode"):_("unknown"),
	gcry_md_algo_name (sig->digest_algo),
	*pkstrbuf?_(", key algorithm "):"", pkstrbuf);
	}

	/* Print final warnings. */
	if (!rc && !c->signed_data.used)
	{
	/* Signature is basically good but we test whether the
	deprecated command
	gpg --verify FILE.sig
	was used instead of
	gpg --verify FILE.sig FILE
	to verify a detached signature. If we figure out that a
	data file with a matching name exists, we print a warning.

	The problem is that the first form would also verify a
	standard signature. This behavior could be used to
	create a made up .sig file for a tarball by creating a
	standard signature from a valid detached signature packet
	(for example from a signed git tag). Then replace the
	sig file on the FTP server along with a changed tarball.
	Using the first form the verify command would correctly
	verify the signature but don't even consider the tarball. */
	kbnode_t n;
	char *dfile;

	dfile = get_matching_datafile (c->sigfilename);
	if (dfile)
	{
	for (n = c->list; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (n)
	{
	/* Not only signature packets in the tree thus this
	is not a detached signature. */
	log_info (_("WARNING: not a detached signature; "
	"file '%s' was NOT verified!\n"), dfile);
	}
	xfree (dfile);
	}
	}

	free_public_key (pk);
	pk = NULL;
	release_kbnode( keyblock );
	if (rc)
	g10_errors_seen = 1;
	if (opt.batch && rc)
	g10_exit (1);
	}
	else
	{
	char buf[50];

	snprintf (buf, sizeof buf, "%08lX%08lX %d %d %02x %lu %d",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	sig->pubkey_algo, sig->digest_algo,
	sig->sig_class, (ulong)sig->timestamp, gpg_err_code (rc));
	write_status_text (STATUS_ERRSIG, buf);
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	{
	buf[16] = 0;
	write_status_text (STATUS_NO_PUBKEY, buf);
	}
	if (gpg_err_code (rc) != GPG_ERR_NOT_PROCESSED)
	log_error (_("Can't check signature: %s\n"), gpg_strerror (rc));
	}

	return rc;
	}


	/*
	* Process the tree which starts at node
	*/
	static void
	proc_tree (CTX c, kbnode_t node)
	{
	kbnode_t n1;
	int rc;

	if (opt.list_packets \|\| opt.list_only)
	return;

	/* We must skip our special plaintext marker packets here because
	they may be the root packet. These packets are only used in
	additional checks and skipping them here doesn't matter. */
	while (node
	&& node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_PLAINTEXT_MARK)
	{
	node = node->next;
	}
	if (!node)
	return;

	c->trustletter = ' ';
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_keys_and_selfsig (node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY)
	{
	merge_keys_and_selfsig (node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* Check all signatures. */
	if (!c->any.data)
	{
	int use_textmode = 0;

	free_md_filter_context (&c->mfx);
	/* Prepare to create all requested message digests. */
	rc = gcry_md_open (&c->mfx.md, 0, 0);
	if (rc)
	goto hash_err;

	/* Fixme: why looking for the signature packet and not the
	one-pass packet? */
	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	gcry_md_enable (c->mfx.md, n1->pkt->pkt.signature->digest_algo);

	if (n1 && n1->pkt->pkt.onepass_sig->sig_class == 0x01)
	use_textmode = 1;

	/* Ask for file and hash it. */
	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, NULL,
	c->signed_data.data_fd,
	use_textmode);
	else
	rc = hash_datafiles (c->mfx.md, NULL,
	c->signed_data.data_names,
	c->sigfilename,
	use_textmode);
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname (c->iobuf),
	use_textmode);
	}

	hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* Clear text signed message. */
	if (!c->any.data)
	{
	log_error ("cleartext signature without data\n");
	return;
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int multiple_ok = 1;

	n1 = find_next_kbnode (node, PKT_SIGNATURE);
	if (n1)
	{
	byte class = sig->sig_class;
	byte hash = sig->digest_algo;

	for (; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	{
	/* We can't currently handle multiple signatures of
	* different classes (we'd pretty much have to run a
	* different hash context for each), but if they are all
	* the same and it is detached signature, we make an
	* exception. Note that the old code also disallowed
	* multiple signatures if the digest algorithms are
	* different. We softened this restriction only for
	* detached signatures, to be on the safe side. */
	if (n1->pkt->pkt.signature->sig_class != class
	\|\| (c->any.data
	&& n1->pkt->pkt.signature->digest_algo != hash))
	{
	multiple_ok = 0;
	log_info (_("WARNING: multiple signatures detected. "
	"Only the first will be checked.\n"));
	break;
	}
	}
	}

	if (sig->sig_class != 0x00 && sig->sig_class != 0x01)
	{
	log_info(_("standalone signature of class 0x%02x\n"), sig->sig_class);
	}
	else if (!c->any.data)
	{
	/* Detached signature */
	free_md_filter_context (&c->mfx);
	rc = gcry_md_open (&c->mfx.md, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;

	if (multiple_ok)
	{
	/* If we have and want to handle multiple signatures we
	* need to enable all hash algorithms for the context. */
	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE)); )
	if (!openpgp_md_test_algo (n1->pkt->pkt.signature->digest_algo))
	gcry_md_enable (c->mfx.md,
	map_md_openpgp_to_gcry
	(n1->pkt->pkt.signature->digest_algo));
	}

	if (RFC2440 \|\| RFC4880)
	; /* Strict RFC mode. */
	else if (sig->digest_algo == DIGEST_ALGO_SHA1
	&& sig->pubkey_algo == PUBKEY_ALGO_DSA
	&& sig->sig_class == 0x01)
	{
	/* Enable a workaround for a pgp5 bug when the detached
	* signature has been created in textmode. Note that we
	* do not implement this for multiple signatures with
	* different hash algorithms. */
	rc = gcry_md_open (&c->mfx.md2, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;
	}

	/* Here we used to have another hack to work around a pgp
	* 2 bug: It worked by not using the textmode for detached
	* signatures; this would let the first signature check
	* (on md) fail but the second one (on md2), which adds an
	* extra CR would then have produced the "correct" hash.
	* This is very, very ugly hack but it may haved help in
	* some cases (and break others).
	* c->mfx.md2? 0 :(sig->sig_class == 0x01)
	*/

	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, c->mfx.md2,
	c->signed_data.data_fd,
	(sig->sig_class == 0x01));
	else
	rc = hash_datafiles (c->mfx.md, c->mfx.md2,
	c->signed_data.data_names,
	c->sigfilename,
	(sig->sig_class == 0x01));
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname(c->iobuf),
	(sig->sig_class == 0x01));
	}

	detached_hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}
	else if (!opt.quiet)
	log_info (_("old style (PGP 2.x) signature\n"));

	if (multiple_ok)
	{
	for (n1 = node; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	check_sig_and_print (c, n1);
	}
	else
	check_sig_and_print (c, node);

	}
	else
	{
	dump_kbnode (c->list);
	log_error ("invalid root packet detected in proc_tree()\n");
	dump_kbnode (node);
	}
	}
	diff --git a/g10/misc.c b/g10/misc.c
	index 4b9ad990b..ac0000943 100644
	--- a/g10/misc.c
	+++ b/g10/misc.c
	@@ -1,1772 +1,1772 @@
	/* misc.c - miscellaneous functions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
	#include <asm/sysinfo.h>
	#include <asm/unistd.h>
	#endif
	#ifdef HAVE_SETRLIMIT
	#include <time.h>
	#include <sys/time.h>
	#include <sys/resource.h>
	#endif
	#ifdef ENABLE_SELINUX_HACKS
	#include <sys/stat.h>
	#endif

	#ifdef HAVE_W32_SYSTEM
	#include <time.h>
	#include <process.h>
	#ifdef HAVE_WINSOCK2_H
	# include <winsock2.h>
	#endif
	#include <windows.h>
	#include <shlobj.h>
	#ifndef CSIDL_APPDATA
	#define CSIDL_APPDATA 0x001a
	#endif
	#ifndef CSIDL_LOCAL_APPDATA
	#define CSIDL_LOCAL_APPDATA 0x001c
	#endif
	#ifndef CSIDL_FLAG_CREATE
	#define CSIDL_FLAG_CREATE 0x8000
	#endif
	#endif /HAVE_W32_SYSTEM/

	#include "gpg.h"
	#ifdef HAVE_W32_SYSTEM
	# include "status.h"
	#endif /HAVE_W32_SYSTEM/
	#include "util.h"
	#include "main.h"
	#include "photoid.h"
	#include "options.h"
	#include "call-agent.h"
	#include "i18n.h"
	#include "zb32.h"


	#ifdef ENABLE_SELINUX_HACKS
	/* A object and a global variable to keep track of files marked as
	secured. */
	struct secured_file_item
	{
	struct secured_file_item *next;
	ino_t ino;
	dev_t dev;
	};
	static struct secured_file_item *secured_files;
	#endif /ENABLE_SELINUX_HACKS/




	/* For the sake of SELinux we want to restrict access through gpg to
	certain files we keep under our own control. This function
	registers such a file and is_secured_file may then be used to
	check whether a file has ben registered as secured. */
	void
	register_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	/* Note that we stop immediately if something goes wrong here. */
	if (stat (fname, &buf))
	log_fatal (_("fstat of '%s' failed in %s: %s\n"), fname,
	"register_secured_file", strerror (errno));
	/* log_debug ("registering '%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return; /* Already registered. */
	}

	sf = xmalloc (sizeof *sf);
	sf->ino = buf.st_ino;
	sf->dev = buf.st_dev;
	sf->next = secured_files;
	secured_files = sf;
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	}

	/* Remove a file registered as secure. */
	void
	unregister_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item sf, sfprev;

	if (stat (fname, &buf))
	{
	log_error (_("fstat of '%s' failed in %s: %s\n"), fname,
	"unregister_secured_file", strerror (errno));
	return;
	}
	/* log_debug ("unregistering '%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sfprev=NULL,sf=secured_files; sf; sfprev=sf, sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	{
	if (sfprev)
	sfprev->next = sf->next;
	else
	secured_files = sf->next;
	xfree (sf);
	return;
	}
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	}

	/* Return true if FD is corresponds to a secured file. Using -1 for
	FS is allowed and will return false. */
	int
	is_secured_file (int fd)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (fd == -1)
	return 0; /* No file descriptor so it can't be secured either. */

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (fstat (fd, &buf))
	{
	log_error (_("fstat(%d) failed in %s: %s\n"), fd,
	"is_secured_file", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_file (%d) i=%lu.%lu\n", fd, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fd;
	#endif /!ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}

	/* Return true if FNAME is corresponds to a secured file. Using NULL,
	"" or "-" for FS is allowed and will return false. This function is
	used before creating a file, thus it won't fail if the file does
	not exist. */
	int
	is_secured_filename (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (iobuf_is_pipe_filename (fname) \|\| !*fname)
	return 0;

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (stat (fname, &buf))
	{
	if (errno == ENOENT \|\| errno == EPERM \|\| errno == EACCES)
	return 0;
	log_error (_("fstat of '%s' failed in %s: %s\n"), fname,
	"is_secured_filename", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_filename (%s) i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}



	u16
	checksum_u16( unsigned n )
	{
	u16 a;

	a = (n >> 8) & 0xff;
	a += n & 0xff;
	return a;
	}


	u16
	checksum( byte *p, unsigned n )
	{
	u16 a;

	for(a=0; n; n-- )
	a += *p++;
	return a;
	}

	u16
	checksum_mpi (gcry_mpi_t a)
	{
	u16 csum;
	byte *buffer;
	size_t nbytes;

	if ( gcry_mpi_print (GCRYMPI_FMT_PGP, NULL, 0, &nbytes, a) )
	BUG ();
	/* Fixme: For numbers not in secure memory we should use a stack
	* based buffer and only allocate a larger one if mpi_print returns
	* an error. */
	buffer = (gcry_is_secure(a)?
	gcry_xmalloc_secure (nbytes) : gcry_xmalloc (nbytes));
	if ( gcry_mpi_print (GCRYMPI_FMT_PGP, buffer, nbytes, NULL, a) )
	BUG ();
	csum = checksum (buffer, nbytes);
	xfree (buffer);
	return csum;
	}


	void
	print_pubkey_algo_note (pubkey_algo_t algo)
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental public key algorithm %s\n"),
	openpgp_pk_algo_name (algo));
	}
	}
	else if (algo == PUBKEY_ALGO_ELGAMAL)
	{
	es_fflush (es_stdout);
	log_info (_("WARNING: Elgamal sign+encrypt keys are deprecated\n"));
	}
	}

	void
	print_cipher_algo_note (cipher_algo_t algo)
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental cipher algorithm %s\n"),
	openpgp_cipher_algo_name (algo));
	}
	}
	}

	void
	print_digest_algo_note (digest_algo_t algo)
	{
	const enum gcry_md_algos galgo = map_md_openpgp_to_gcry (algo);
	const struct weakhash *weak;

	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental digest algorithm %s\n"),
	gcry_md_algo_name (galgo));
	}
	}
	else
	for (weak = opt.weak_digests; weak != NULL; weak = weak->next)
	if (weak->algo == galgo)
	{
	es_fflush (es_stdout);
	log_info (_("WARNING: digest algorithm %s is deprecated\n"),
	gcry_md_algo_name (galgo));
	}
	}


	void
	print_digest_rejected_note (enum gcry_md_algos algo)
	{
	struct weakhash* weak;
	int show = 1;
	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (weak->algo == algo)
	{
	if (weak->rejection_shown)
	show = 0;
	else
	weak->rejection_shown = 1;
	break;
	}

	if (show)
	{
	es_fflush (es_stdout);
	log_info
	(_("Note: signatures using the %s algorithm are rejected\n"),
	gcry_md_algo_name(algo));
	}
	}


	/* Print a message
	* "(reported error: %s)\n
	* in verbose mode to further explain an error. If the error code has
	* the value IGNORE_EC no message is printed. A message is also not
	* printed if ERR is 0. */
	void
	print_reported_error (gpg_error_t err, gpg_err_code_t ignore_ec)
	{
	if (!opt.verbose)
	return;

	if (!gpg_err_code (err))
	;
	else if (gpg_err_code (err) == ignore_ec)
	;
	else if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
	log_info (_("(reported error: %s)\n"),
	gpg_strerror (err));
	else
	log_info (_("(reported error: %s <%s>)\n"),
	gpg_strerror (err), gpg_strsource (err));

	}


	/* Print a message
	* "(further info: %s)\n
	* in verbose mode to further explain an error. That message is
	* intended to help debug a problem and should not be translated.
	*/
	void
	print_further_info (const char *format, ...)
	{
	va_list arg_ptr;

	if (!opt.verbose)
	return;

	log_info (_("(further info: "));
	va_start (arg_ptr, format);
	log_logv (GPGRT_LOG_CONT, format, arg_ptr);
	va_end (arg_ptr);
	log_printf (")\n");
	}


	/* Map OpenPGP algo numbers to those used by Libgcrypt. We need to do
	this for algorithms we implemented in Libgcrypt after they become
	part of OpenPGP. */
	enum gcry_cipher_algos
	map_cipher_openpgp_to_gcry (cipher_algo_t algo)
	{
	switch (algo)
	{
	case CIPHER_ALGO_NONE: return GCRY_CIPHER_NONE;

	#ifdef GPG_USE_IDEA
	case CIPHER_ALGO_IDEA: return GCRY_CIPHER_IDEA;
	#else
	case CIPHER_ALGO_IDEA: return 0;
	#endif

	case CIPHER_ALGO_3DES: return GCRY_CIPHER_3DES;

	#ifdef GPG_USE_CAST5
	case CIPHER_ALGO_CAST5: return GCRY_CIPHER_CAST5;
	#else
	case CIPHER_ALGO_CAST5: return 0;
	#endif

	#ifdef GPG_USE_BLOWFISH
	case CIPHER_ALGO_BLOWFISH: return GCRY_CIPHER_BLOWFISH;
	#else
	case CIPHER_ALGO_BLOWFISH: return 0;
	#endif

	#ifdef GPG_USE_AES128
	case CIPHER_ALGO_AES: return GCRY_CIPHER_AES;
	#else
	case CIPHER_ALGO_AES: return 0;
	#endif

	#ifdef GPG_USE_AES192
	case CIPHER_ALGO_AES192: return GCRY_CIPHER_AES192;
	#else
	case CIPHER_ALGO_AES192: return 0;
	#endif

	#ifdef GPG_USE_AES256
	case CIPHER_ALGO_AES256: return GCRY_CIPHER_AES256;
	#else
	case CIPHER_ALGO_AES256: return 0;
	#endif

	#ifdef GPG_USE_TWOFISH
	case CIPHER_ALGO_TWOFISH: return GCRY_CIPHER_TWOFISH;
	#else
	case CIPHER_ALGO_TWOFISH: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA128
	case CIPHER_ALGO_CAMELLIA128: return GCRY_CIPHER_CAMELLIA128;
	#else
	case CIPHER_ALGO_CAMELLIA128: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA192
	case CIPHER_ALGO_CAMELLIA192: return GCRY_CIPHER_CAMELLIA192;
	#else
	case CIPHER_ALGO_CAMELLIA192: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA256
	case CIPHER_ALGO_CAMELLIA256: return GCRY_CIPHER_CAMELLIA256;
	#else
	case CIPHER_ALGO_CAMELLIA256: return 0;
	#endif
	}
	return 0;
	}

	/* The inverse function of above. */
	static cipher_algo_t
	map_cipher_gcry_to_openpgp (enum gcry_cipher_algos algo)
	{
	switch (algo)
	{
	case GCRY_CIPHER_NONE: return CIPHER_ALGO_NONE;
	case GCRY_CIPHER_IDEA: return CIPHER_ALGO_IDEA;
	case GCRY_CIPHER_3DES: return CIPHER_ALGO_3DES;
	case GCRY_CIPHER_CAST5: return CIPHER_ALGO_CAST5;
	case GCRY_CIPHER_BLOWFISH: return CIPHER_ALGO_BLOWFISH;
	case GCRY_CIPHER_AES: return CIPHER_ALGO_AES;
	case GCRY_CIPHER_AES192: return CIPHER_ALGO_AES192;
	case GCRY_CIPHER_AES256: return CIPHER_ALGO_AES256;
	case GCRY_CIPHER_TWOFISH: return CIPHER_ALGO_TWOFISH;
	case GCRY_CIPHER_CAMELLIA128: return CIPHER_ALGO_CAMELLIA128;
	case GCRY_CIPHER_CAMELLIA192: return CIPHER_ALGO_CAMELLIA192;
	case GCRY_CIPHER_CAMELLIA256: return CIPHER_ALGO_CAMELLIA256;
	default: return 0;
	}
	}

	/* Map Gcrypt public key algorithm numbers to those used by OpenPGP.
	FIXME: This mapping is used at only two places - we should get rid
	of it. */
	pubkey_algo_t
	map_pk_gcry_to_openpgp (enum gcry_pk_algos algo)
	{
	switch (algo)
	{
	case GCRY_PK_ECDSA: return PUBKEY_ALGO_ECDSA;
	case GCRY_PK_ECDH: return PUBKEY_ALGO_ECDH;
	default: return algo < 110 ? algo : 0;
	}
	}


	/* Return the block length of an OpenPGP cipher algorithm. */
	int
	openpgp_cipher_blocklen (cipher_algo_t algo)
	{
	/* We use the numbers from OpenPGP to be sure that we get the right
	block length. This is so that the packet parsing code works even
	for unknown algorithms (for which we assume 8 due to tradition).

	- NOTE: If you change the the returned blocklen above 16, check
	+ NOTE: If you change the returned blocklen above 16, check
	the callers because they may use a fixed size buffer of that
	size. */
	switch (algo)
	{
	case CIPHER_ALGO_AES:
	case CIPHER_ALGO_AES192:
	case CIPHER_ALGO_AES256:
	case CIPHER_ALGO_TWOFISH:
	case CIPHER_ALGO_CAMELLIA128:
	case CIPHER_ALGO_CAMELLIA192:
	case CIPHER_ALGO_CAMELLIA256:
	return 16;

	default:
	return 8;
	}
	}

	/****************
	* Wrapper around the libgcrypt function with additional checks on
	* the OpenPGP contraints for the algo ID.
	*/
	int
	openpgp_cipher_test_algo (cipher_algo_t algo)
	{
	enum gcry_cipher_algos ga;

	ga = map_cipher_openpgp_to_gcry (algo);
	if (!ga)
	return gpg_error (GPG_ERR_CIPHER_ALGO);

	return gcry_cipher_test_algo (ga);
	}

	/* Map the OpenPGP cipher algorithm whose ID is contained in ALGORITHM to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_cipher_algo_name (cipher_algo_t algo)
	{
	switch (algo)
	{
	case CIPHER_ALGO_NONE: break;
	case CIPHER_ALGO_IDEA: return "IDEA";
	case CIPHER_ALGO_3DES: return "3DES";
	case CIPHER_ALGO_CAST5: return "CAST5";
	case CIPHER_ALGO_BLOWFISH: return "BLOWFISH";
	case CIPHER_ALGO_AES: return "AES";
	case CIPHER_ALGO_AES192: return "AES192";
	case CIPHER_ALGO_AES256: return "AES256";
	case CIPHER_ALGO_TWOFISH: return "TWOFISH";
	case CIPHER_ALGO_CAMELLIA128: return "CAMELLIA128";
	case CIPHER_ALGO_CAMELLIA192: return "CAMELLIA192";
	case CIPHER_ALGO_CAMELLIA256: return "CAMELLIA256";
	}
	return "?";
	}


	/* Return 0 if ALGO is a supported OpenPGP public key algorithm. */
	int
	openpgp_pk_test_algo (pubkey_algo_t algo)
	{
	return openpgp_pk_test_algo2 (algo, 0);
	}


	/* Return 0 if ALGO is a supported OpenPGP public key algorithm and
	allows the usage USE. */
	int
	openpgp_pk_test_algo2 (pubkey_algo_t algo, unsigned int use)
	{
	enum gcry_pk_algos ga = 0;
	size_t use_buf = use;

	switch (algo)
	{
	#ifdef GPG_USE_RSA
	case PUBKEY_ALGO_RSA: ga = GCRY_PK_RSA; break;
	case PUBKEY_ALGO_RSA_E: ga = GCRY_PK_RSA_E; break;
	case PUBKEY_ALGO_RSA_S: ga = GCRY_PK_RSA_S; break;
	#else
	case PUBKEY_ALGO_RSA: break;
	case PUBKEY_ALGO_RSA_E: break;
	case PUBKEY_ALGO_RSA_S: break;
	#endif

	case PUBKEY_ALGO_ELGAMAL_E: ga = GCRY_PK_ELG; break;
	case PUBKEY_ALGO_DSA: ga = GCRY_PK_DSA; break;

	#ifdef GPG_USE_ECDH
	case PUBKEY_ALGO_ECDH: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_ECDH: break;
	#endif

	#ifdef GPG_USE_ECDSA
	case PUBKEY_ALGO_ECDSA: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_ECDSA: break;
	#endif

	#ifdef GPG_USE_EDDSA
	case PUBKEY_ALGO_EDDSA: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_EDDSA: break;
	#endif

	case PUBKEY_ALGO_ELGAMAL:
	/* Dont't allow type 20 keys unless in rfc2440 mode. */
	if (RFC2440)
	ga = GCRY_PK_ELG;
	break;
	}
	if (!ga)
	return gpg_error (GPG_ERR_PUBKEY_ALGO);

	/* No check whether Libgcrypt has support for the algorithm. */
	return gcry_pk_algo_info (ga, GCRYCTL_TEST_ALGO, NULL, &use_buf);
	}


	int
	openpgp_pk_algo_usage ( int algo )
	{
	int use = 0;

	/* They are hardwired in gpg 1.0. */
	switch ( algo ) {
	case PUBKEY_ALGO_RSA:
	use = (PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG
	\| PUBKEY_USAGE_ENC \| PUBKEY_USAGE_AUTH);
	break;
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_ECDH:
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_RSA_S:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG;
	break;
	case PUBKEY_ALGO_ELGAMAL:
	if (RFC2440)
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_ELGAMAL_E:
	use = PUBKEY_USAGE_ENC;
	break;
	case PUBKEY_ALGO_DSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_AUTH;
	break;
	case PUBKEY_ALGO_ECDSA:
	case PUBKEY_ALGO_EDDSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_AUTH;
	default:
	break;
	}
	return use;
	}

	/* Map the OpenPGP pubkey algorithm whose ID is contained in ALGO to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_pk_algo_name (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return "RSA";
	case PUBKEY_ALGO_ELGAMAL:
	case PUBKEY_ALGO_ELGAMAL_E: return "ELG";
	case PUBKEY_ALGO_DSA: return "DSA";
	case PUBKEY_ALGO_ECDH: return "ECDH";
	case PUBKEY_ALGO_ECDSA: return "ECDSA";
	case PUBKEY_ALGO_EDDSA: return "EDDSA";
	}
	return "?";
	}


	/* Explicit mapping of OpenPGP digest algos to Libgcrypt. */
	/* FIXME: We do not yes use it everywhere. */
	enum gcry_md_algos
	map_md_openpgp_to_gcry (digest_algo_t algo)
	{
	switch (algo)
	{
	#ifdef GPG_USE_MD5
	case DIGEST_ALGO_MD5: return GCRY_MD_MD5;
	#else
	case DIGEST_ALGO_MD5: return 0;
	#endif

	case DIGEST_ALGO_SHA1: return GCRY_MD_SHA1;

	#ifdef GPG_USE_RMD160
	case DIGEST_ALGO_RMD160: return GCRY_MD_RMD160;
	#else
	case DIGEST_ALGO_RMD160: return 0;
	#endif

	#ifdef GPG_USE_SHA224
	case DIGEST_ALGO_SHA224: return GCRY_MD_SHA224;
	#else
	case DIGEST_ALGO_SHA224: return 0;
	#endif

	case DIGEST_ALGO_SHA256: return GCRY_MD_SHA256;

	#ifdef GPG_USE_SHA384
	case DIGEST_ALGO_SHA384: return GCRY_MD_SHA384;
	#else
	case DIGEST_ALGO_SHA384: return 0;
	#endif

	#ifdef GPG_USE_SHA512
	case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
	#else
	case DIGEST_ALGO_SHA512: return 0;
	#endif
	}
	return 0;
	}


	/* Return 0 if ALGO is suitable and implemented OpenPGP hash
	algorithm. */
	int
	openpgp_md_test_algo (digest_algo_t algo)
	{
	enum gcry_md_algos ga;

	ga = map_md_openpgp_to_gcry (algo);
	if (!ga)
	return gpg_error (GPG_ERR_DIGEST_ALGO);

	return gcry_md_test_algo (ga);
	}


	/* Map the OpenPGP digest algorithm whose ID is contained in ALGO to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_md_algo_name (int algo)
	{
	switch (algo)
	{
	case DIGEST_ALGO_MD5: return "MD5";
	case DIGEST_ALGO_SHA1: return "SHA1";
	case DIGEST_ALGO_RMD160: return "RIPEMD160";
	case DIGEST_ALGO_SHA256: return "SHA256";
	case DIGEST_ALGO_SHA384: return "SHA384";
	case DIGEST_ALGO_SHA512: return "SHA512";
	case DIGEST_ALGO_SHA224: return "SHA224";
	}
	return "?";
	}


	static unsigned long
	get_signature_count (PKT_public_key *pk)
	{
	#ifdef ENABLE_CARD_SUPPORT
	struct agent_card_info_s info;

	(void)pk;
	if (!agent_scd_getattr ("SIG-COUNTER",&info))
	return info.sig_counter;
	else
	return 0;
	#else
	(void)pk;
	return 0;
	#endif
	}

	/* Expand %-strings. Returns a string which must be xfreed. Returns
	NULL if the string cannot be expanded (too large). */
	char *
	pct_expando(const char string,struct expando_args args)
	{
	const char *ch=string;
	int idx=0,maxlen=0,done=0;
	u32 pk_keyid[2]={0,0},sk_keyid[2]={0,0};
	char *ret=NULL;

	if(args->pk)
	keyid_from_pk(args->pk,pk_keyid);

	if(args->pksk)
	keyid_from_pk (args->pksk, sk_keyid);

	/* This is used so that %k works in photoid command strings in
	--list-secret-keys (which of course has a sk, but no pk). */
	if(!args->pk && args->pksk)
	keyid_from_pk (args->pksk, pk_keyid);

	while(*ch!='\0')
	{
	if(!done)
	{
	/* 8192 is way bigger than we'll need here */
	if(maxlen>=8192)
	goto fail;

	maxlen+=1024;
	ret=xrealloc(ret,maxlen);
	}

	done=0;

	if(*ch=='%')
	{
	switch(*(ch+1))
	{
	case 's': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)sk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'S': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)sk_keyid[0],(ulong)sk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'k': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)pk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'K': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)pk_keyid[0],(ulong)pk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'U': /* z-base-32 encoded user id hash. */
	if (args->namehash)
	{
	char tmp = zb32_encode (args->namehash, 820);
	if (tmp)
	{
	if (idx + strlen (tmp) < maxlen)
	{
	strcpy (ret+idx, tmp);
	idx += strlen (tmp);
	}
	xfree (tmp);
	done = 1;
	}
	}
	break;

	case 'c': /* signature count from card, if any. */
	if(idx+10<maxlen)
	{
	sprintf (&ret[idx],"%lu", get_signature_count (args->pksk));
	idx+=strlen(&ret[idx]);
	done=1;
	}
	break;

	case 'f': /* Fingerprint of key being signed */
	case 'p': /* Fingerprint of the primary key making the signature. */
	case 'g': /* Fingerprint of the key making the signature. */
	{
	byte array[MAX_FINGERPRINT_LEN];
	size_t len;
	int i;

	if ((*(ch+1))=='f' && args->pk)
	fingerprint_from_pk (args->pk, array, &len);
	else if ((*(ch+1))=='p' && args->pksk)
	{
	if(args->pksk->flags.primary)
	fingerprint_from_pk (args->pksk, array, &len);
	else if (args->pksk->main_keyid[0]
	\|\| args->pksk->main_keyid[1])
	{
	/* Not the primary key: Find the fingerprint
	of the primary key. */
	PKT_public_key *pk=
	xmalloc_clear(sizeof(PKT_public_key));

	if (!get_pubkey_fast (pk,args->pksk->main_keyid))
	fingerprint_from_pk (pk, array, &len);
	else
	memset (array, 0, (len=MAX_FINGERPRINT_LEN));
	free_public_key (pk);
	}
	else /* Oops: info about the primary key missing. */
	memset(array,0,(len=MAX_FINGERPRINT_LEN));
	}
	else if((*(ch+1))=='g' && args->pksk)
	fingerprint_from_pk (args->pksk, array, &len);
	else
	memset(array,0,(len=MAX_FINGERPRINT_LEN));

	if(idx+(len*2)<maxlen)
	{
	for(i=0;i<len;i++)
	{
	sprintf(&ret[idx],"%02X",array[i]);
	idx+=2;
	}
	done=1;
	}
	}
	break;

	case 'v': /* validity letters */
	if(args->validity_info && idx+1<maxlen)
	{
	ret[idx++]=args->validity_info;
	ret[idx]='\0';
	done=1;
	}
	break;

	/* The text string types */
	case 't':
	case 'T':
	case 'V':
	{
	const char *str=NULL;

	switch(*(ch+1))
	{
	case 't': /* e.g. "jpg" */
	str=image_type_to_string(args->imagetype,0);
	break;

	case 'T': /* e.g. "image/jpeg" */
	str=image_type_to_string(args->imagetype,2);
	break;

	case 'V': /* e.g. "full", "expired", etc. */
	str=args->validity_string;
	break;
	}

	if(str && idx+strlen(str)<maxlen)
	{
	strcpy(&ret[idx],str);
	idx+=strlen(str);
	done=1;
	}
	}
	break;

	case '%':
	if(idx+1<maxlen)
	{
	ret[idx++]='%';
	ret[idx]='\0';
	done=1;
	}
	break;

	/* Any unknown %-keys (like %i, %o, %I, and %O) are
	passed through for later expansion. Note this also
	handles the case where the last character in the
	string is a '%' - the terminating \0 will end up here
	and properly terminate the string. */
	default:
	if(idx+2<maxlen)
	{
	ret[idx++]='%';
	ret[idx++]=*(ch+1);
	ret[idx]='\0';
	done=1;
	}
	break;
	}

	if(done)
	ch++;
	}
	else
	{
	if(idx+1<maxlen)
	{
	ret[idx++]=*ch;
	ret[idx]='\0';
	done=1;
	}
	}

	if(done)
	ch++;
	}

	return ret;

	fail:
	xfree(ret);
	return NULL;
	}

	void
	deprecated_warning(const char *configname,unsigned int configlineno,
	const char option,const char repl1,const char *repl2)
	{
	if(configname)
	{
	if(strncmp("--",option,2)==0)
	option+=2;

	if(strncmp("--",repl1,2)==0)
	repl1+=2;

	log_info(_("%s:%d: deprecated option \"%s\"\n"),
	configname,configlineno,option);
	}
	else
	log_info(_("WARNING: \"%s\" is a deprecated option\n"),option);

	log_info(_("please use \"%s%s\" instead\n"),repl1,repl2);
	}


	void
	deprecated_command (const char *name)
	{
	log_info(_("WARNING: \"%s\" is a deprecated command - do not use it\n"),
	name);
	}


	void
	obsolete_scdaemon_option (const char *configname, unsigned int configlineno,
	const char *name)
	{
	if (configname)
	log_info (_("%s:%u: \"%s\" is obsolete in this file"
	" - it only has effect in %s\n"),
	configname, configlineno, name, SCDAEMON_NAME EXTSEP_S "conf");
	else
	log_info (_("WARNING: \"%s%s\" is an obsolete option"
	" - it has no effect except on %s\n"),
	"--", name, SCDAEMON_NAME);
	}


	/*
	* Wrapper around gcry_cipher_map_name to provide a fallback using the
	* "Sn" syntax as used by the preference strings.
	*/
	int
	string_to_cipher_algo (const char *string)
	{
	int val;

	val = map_cipher_gcry_to_openpgp (gcry_cipher_map_name (string));
	if (!val && string && (string[0]=='S' \|\| string[0]=='s'))
	{
	char *endptr;

	string++;
	val = strtol (string, &endptr, 10);
	if (!string \|\| endptr \|\| openpgp_cipher_test_algo (val))
	val = 0;
	}

	return val;
	}

	/*
	* Wrapper around gcry_md_map_name to provide a fallback using the
	* "Hn" syntax as used by the preference strings.
	*/
	int
	string_to_digest_algo (const char *string)
	{
	int val;

	/* FIXME: We should make use of our wrapper function and not assume
	that there is a 1 to 1 mapping between OpenPGP and Libgcrypt. */
	val = gcry_md_map_name (string);
	if (!val && string && (string[0]=='H' \|\| string[0]=='h'))
	{
	char *endptr;

	string++;
	val = strtol (string, &endptr, 10);
	if (!string \|\| endptr \|\| openpgp_md_test_algo (val))
	val = 0;
	}

	return val;
	}



	const char *
	compress_algo_to_string(int algo)
	{
	const char *s=NULL;

	switch(algo)
	{
	case COMPRESS_ALGO_NONE:
	s=_("Uncompressed");
	break;

	case COMPRESS_ALGO_ZIP:
	s="ZIP";
	break;

	case COMPRESS_ALGO_ZLIB:
	s="ZLIB";
	break;

	#ifdef HAVE_BZIP2
	case COMPRESS_ALGO_BZIP2:
	s="BZIP2";
	break;
	#endif
	}

	return s;
	}

	int
	string_to_compress_algo(const char *string)
	{
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	if(match_multistr(_("uncompressed\|none"),string))
	return 0;
	else if(ascii_strcasecmp(string,"uncompressed")==0)
	return 0;
	else if(ascii_strcasecmp(string,"none")==0)
	return 0;
	else if(ascii_strcasecmp(string,"zip")==0)
	return 1;
	else if(ascii_strcasecmp(string,"zlib")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"bzip2")==0)
	return 3;
	#endif
	else if(ascii_strcasecmp(string,"z0")==0)
	return 0;
	else if(ascii_strcasecmp(string,"z1")==0)
	return 1;
	else if(ascii_strcasecmp(string,"z2")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"z3")==0)
	return 3;
	#endif
	else
	return -1;
	}

	int
	check_compress_algo(int algo)
	{
	switch (algo)
	{
	case 0: return 0;
	#ifdef HAVE_ZIP
	case 1:
	case 2: return 0;
	#endif
	#ifdef HAVE_BZIP2
	case 3: return 0;
	#endif
	default: return GPG_ERR_COMPR_ALGO;
	}
	}

	int
	default_cipher_algo(void)
	{
	if(opt.def_cipher_algo)
	return opt.def_cipher_algo;
	else if(opt.personal_cipher_prefs)
	return opt.personal_cipher_prefs[0].value;
	else
	return opt.s2k_cipher_algo;
	}

	/* There is no default_digest_algo function, but see
	sign.c:hash_for() */

	int
	default_compress_algo(void)
	{
	if(opt.compress_algo!=-1)
	return opt.compress_algo;
	else if(opt.personal_compress_prefs)
	return opt.personal_compress_prefs[0].value;
	else
	return DEFAULT_COMPRESS_ALGO;
	}

	const char *
	compliance_option_string(void)
	{
	char *ver="???";

	switch(opt.compliance)
	{
	case CO_GNUPG: return "--gnupg";
	case CO_RFC4880: return "--openpgp";
	case CO_RFC2440: return "--rfc2440";
	case CO_PGP6: return "--pgp6";
	case CO_PGP7: return "--pgp7";
	case CO_PGP8: return "--pgp8";
	case CO_DE_VS: return "--compliance=de-vs";
	}

	return ver;
	}

	void
	compliance_failure(void)
	{
	char *ver="???";

	switch(opt.compliance)
	{
	case CO_GNUPG:
	ver="GnuPG";
	break;

	case CO_RFC4880:
	ver="OpenPGP";
	break;

	case CO_RFC2440:
	ver="OpenPGP (older)";
	break;

	case CO_PGP6:
	ver="PGP 6.x";
	break;

	case CO_PGP7:
	ver="PGP 7.x";
	break;

	case CO_PGP8:
	ver="PGP 8.x";
	break;

	case CO_DE_VS:
	ver="DE-VS applications";
	break;
	}

	log_info(_("this message may not be usable by %s\n"),ver);
	opt.compliance=CO_GNUPG;
	}

	/* Break a string into successive option pieces. Accepts single word
	options and key=value argument options. */
	char *
	optsep(char **stringp)
	{
	char tok,end;

	tok=*stringp;
	if(tok)
	{
	end=strpbrk(tok," ,=");
	if(end)
	{
	int sawequals=0;
	char *ptr=end;

	/* what we need to do now is scan along starting with *end,
	If the next character we see (ignoring spaces) is an =
	sign, then there is an argument. */

	while(*ptr)
	{
	if(*ptr=='=')
	sawequals=1;
	else if(*ptr!=' ')
	break;
	ptr++;
	}

	/* There is an argument, so grab that too. At this point,
	ptr points to the first character of the argument. */
	if(sawequals)
	{
	/* Is it a quoted argument? */
	if(*ptr=='"')
	{
	ptr++;
	end=strchr(ptr,'"');
	if(end)
	end++;
	}
	else
	end=strpbrk(ptr," ,");
	}

	if(end && *end)
	{
	*end='\0';
	*stringp=end+1;
	}
	else
	*stringp=NULL;
	}
	else
	*stringp=NULL;
	}

	return tok;
	}

	/* Breaks an option value into key and value. Returns NULL if there
	is no value. Note that "string" is modified to remove the =value
	part. */
	char *
	argsplit(char *string)
	{
	char equals,arg=NULL;

	equals=strchr(string,'=');
	if(equals)
	{
	char quote,space;

	*equals='\0';
	arg=equals+1;

	/* Quoted arg? */
	quote=strchr(arg,'"');
	if(quote)
	{
	arg=quote+1;

	quote=strchr(arg,'"');
	if(quote)
	*quote='\0';
	}
	else
	{
	size_t spaces;

	/* Trim leading spaces off of the arg */
	spaces=strspn(arg," ");
	arg+=spaces;
	}

	/* Trim tailing spaces off of the tag */
	space=strchr(string,' ');
	if(space)
	*space='\0';
	}

	return arg;
	}

	/* Return the length of the initial token, leaving off any
	argument. */
	static size_t
	optlen(const char *s)
	{
	char *end=strpbrk(s," =");

	if(end)
	return end-s;
	else
	return strlen(s);
	}

	int
	parse_options(char str,unsigned int options,
	struct parse_options *opts,int noisy)
	{
	char *tok;

	if (str && !strcmp (str, "help"))
	{
	int i,maxlen=0;

	/* Figure out the longest option name so we can line these up
	neatly. */
	for(i=0;opts[i].name;i++)
	if(opts[i].help && maxlen<strlen(opts[i].name))
	maxlen=strlen(opts[i].name);

	for(i=0;opts[i].name;i++)
	if(opts[i].help)
	es_printf("%s%*s%s\n",opts[i].name,
	maxlen+2-(int)strlen(opts[i].name),"",_(opts[i].help));

	g10_exit(0);
	}

	while((tok=optsep(&str)))
	{
	int i,rev=0;
	char *otok=tok;

	if(tok[0]=='\0')
	continue;

	if(ascii_strncasecmp("no-",tok,3)==0)
	{
	rev=1;
	tok+=3;
	}

	for(i=0;opts[i].name;i++)
	{
	size_t toklen=optlen(tok);

	if(ascii_strncasecmp(opts[i].name,tok,toklen)==0)
	{
	/* We have a match, but it might be incomplete */
	if(toklen!=strlen(opts[i].name))
	{
	int j;

	for(j=i+1;opts[j].name;j++)
	{
	if(ascii_strncasecmp(opts[j].name,tok,toklen)==0)
	{
	if(noisy)
	log_info(_("ambiguous option '%s'\n"),otok);
	return 0;
	}
	}
	}

	if(rev)
	{
	*options&=~opts[i].bit;
	if(opts[i].value)
	*opts[i].value=NULL;
	}
	else
	{
	*options\|=opts[i].bit;
	if(opts[i].value)
	*opts[i].value=argsplit(tok);
	}
	break;
	}
	}

	if(!opts[i].name)
	{
	if(noisy)
	log_info(_("unknown option '%s'\n"),otok);
	return 0;
	}
	}

	return 1;
	}


	/* Similar to access(2), but uses PATH to find the file. */
	int
	path_access(const char *file,int mode)
	{
	char *envpath;
	int ret=-1;

	envpath=getenv("PATH");

	if(!envpath
	#ifdef HAVE_DRIVE_LETTERS
	\|\| (((file[0]>='A' && file[0]<='Z')
	\|\| (file[0]>='a' && file[0]<='z'))
	&& file[1]==':')
	#else
	\|\| file[0]=='/'
	#endif
	)
	return access(file,mode);
	else
	{
	/* At least as large as, but most often larger than we need. */
	char *buffer=xmalloc(strlen(envpath)+1+strlen(file)+1);
	char split,item,*path=xstrdup(envpath);

	split=path;

	while((item=strsep(&split,PATHSEP_S)))
	{
	strcpy(buffer,item);
	strcat(buffer,"/");
	strcat(buffer,file);
	ret=access(buffer,mode);
	if(ret==0)
	break;
	}

	xfree(path);
	xfree(buffer);
	}

	return ret;
	}



	/* Return the number of public key parameters as used by OpenPGP. */
	int
	pubkey_get_npkey (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 2;
	case PUBKEY_ALGO_ELGAMAL_E: return 3;
	case PUBKEY_ALGO_DSA: return 4;
	case PUBKEY_ALGO_ECDH: return 3;
	case PUBKEY_ALGO_ECDSA: return 2;
	case PUBKEY_ALGO_ELGAMAL: return 3;
	case PUBKEY_ALGO_EDDSA: return 2;
	}
	return 0;
	}


	/* Return the number of secret key parameters as used by OpenPGP. */
	int
	pubkey_get_nskey (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 6;
	case PUBKEY_ALGO_ELGAMAL_E: return 4;
	case PUBKEY_ALGO_DSA: return 5;
	case PUBKEY_ALGO_ECDH: return 4;
	case PUBKEY_ALGO_ECDSA: return 3;
	case PUBKEY_ALGO_ELGAMAL: return 4;
	case PUBKEY_ALGO_EDDSA: return 3;
	}
	return 0;
	}

	/* Temporary helper. */
	int
	pubkey_get_nsig (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 1;
	case PUBKEY_ALGO_ELGAMAL_E: return 0;
	case PUBKEY_ALGO_DSA: return 2;
	case PUBKEY_ALGO_ECDH: return 0;
	case PUBKEY_ALGO_ECDSA: return 2;
	case PUBKEY_ALGO_ELGAMAL: return 2;
	case PUBKEY_ALGO_EDDSA: return 2;
	}
	return 0;
	}


	/* Temporary helper. */
	int
	pubkey_get_nenc (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 1;
	case PUBKEY_ALGO_ELGAMAL_E: return 2;
	case PUBKEY_ALGO_DSA: return 0;
	case PUBKEY_ALGO_ECDH: return 2;
	case PUBKEY_ALGO_ECDSA: return 0;
	case PUBKEY_ALGO_ELGAMAL: return 2;
	case PUBKEY_ALGO_EDDSA: return 0;
	}
	return 0;
	}


	/* Temporary helper. */
	unsigned int
	pubkey_nbits( int algo, gcry_mpi_t *key )
	{
	int rc, nbits;
	gcry_sexp_t sexp;

	if (algo == PUBKEY_ALGO_DSA
	&& key[0] && key[1] && key[2] && key[3])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
	key[0], key[1], key[2], key[3] );
	}
	else if ((algo == PUBKEY_ALGO_ELGAMAL \|\| algo == PUBKEY_ALGO_ELGAMAL_E)
	&& key[0] && key[1] && key[2])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(elg(p%m)(g%m)(y%m)))",
	key[0], key[1], key[2] );
	}
	else if (is_RSA (algo)
	&& key[0] && key[1])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(rsa(n%m)(e%m)))",
	key[0], key[1] );
	}
	else if ((algo == PUBKEY_ALGO_ECDSA \|\| algo == PUBKEY_ALGO_ECDH
	\|\| algo == PUBKEY_ALGO_EDDSA)
	&& key[0] && key[1])
	{
	char *curve = openpgp_oid_to_str (key[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(ecc(curve%s)(q%m)))",
	curve, key[1]);
	xfree (curve);
	}
	}
	else
	return 0;

	if (rc)
	BUG ();

	nbits = gcry_pk_get_nbits (sexp);
	gcry_sexp_release (sexp);
	return nbits;
	}



	int
	mpi_print (estream_t fp, gcry_mpi_t a, int mode)
	{
	int n = 0;
	size_t nwritten;

	if (!a)
	return es_fprintf (fp, "[MPI_NULL]");
	if (!mode)
	{
	unsigned int n1;
	n1 = gcry_mpi_get_nbits(a);
	n += es_fprintf (fp, "[%u bits]", n1);
	}
	else if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
	{
	unsigned int nbits;
	unsigned char *p = gcry_mpi_get_opaque (a, &nbits);
	if (!p)
	n += es_fprintf (fp, "[invalid opaque value]");
	else
	{
	if (!es_write_hexstring (fp, p, (nbits + 7)/8, 0, &nwritten))
	n += nwritten;
	}
	}
	else
	{
	unsigned char *buffer;
	size_t buflen;

	if (gcry_mpi_aprint (GCRYMPI_FMT_USG, &buffer, &buflen, a))
	BUG ();
	if (!es_write_hexstring (fp, buffer, buflen, 0, &nwritten))
	n += nwritten;
	gcry_free (buffer);
	}
	return n;
	}


	/* pkey[1] or skey[1] is Q for ECDSA, which is an uncompressed point,
	i.e. 04 <x> <y> */
	unsigned int
	ecdsa_qbits_from_Q (unsigned int qbits)
	{
	if ((qbits%8) > 3)
	{
	log_error (_("ECDSA public key is expected to be in SEC encoding "
	"multiple of 8 bits\n"));
	return 0;
	}
	qbits -= qbits%8;
	qbits /= 2;
	return qbits;
	}


	/* Ignore signatures and certifications made over certain digest
	* algorithms by default, MD5 is considered weak. This allows users
	* to deprecate support for other algorithms as well.
	*/
	void
	additional_weak_digest (const char* digestname)
	{
	struct weakhash *weak = NULL;
	const enum gcry_md_algos algo = string_to_digest_algo(digestname);

	if (algo == GCRY_MD_NONE)
	{
	log_error (_("unknown weak digest '%s'\n"), digestname);
	return;
	}

	/* Check to ensure it's not already present. */
	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (algo == weak->algo)
	return;

	/* Add it to the head of the list. */
	weak = xmalloc(sizeof(*weak));
	weak->algo = algo;
	weak->rejection_shown = 0;
	weak->next = opt.weak_digests;
	opt.weak_digests = weak;
	}
	diff --git a/g10/pkclist.c b/g10/pkclist.c
	index 288affc13..4991d20ba 100644
	--- a/g10/pkclist.c
	+++ b/g10/pkclist.c
	@@ -1,1694 +1,1694 @@
	/* pkclist.c - create a list of public keys
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "keydb.h"
	#include "util.h"
	#include "main.h"
	#include "trustdb.h"
	#include "ttyio.h"
	#include "status.h"
	#include "photoid.h"
	#include "i18n.h"
	#include "tofu.h"

	#define CONTROL_D ('D' - 'A' + 1)

	static void
	send_status_inv_recp (int reason, const char *name)
	{
	char buf[40];

	snprintf (buf, sizeof buf, "%d ", reason);
	write_status_text_and_buffer (STATUS_INV_RECP, buf,
	name, strlen (name),
	-1);
	}


	/****************
	* Show the revocation reason as it is stored with the given signature
	*/
	static void
	do_show_revocation_reason( PKT_signature *sig )
	{
	size_t n, nn;
	const byte p, pp;
	int seq = 0;
	const char *text;

	while( (p = enum_sig_subpkt (sig->hashed, SIGSUBPKT_REVOC_REASON,
	&n, &seq, NULL )) ) {
	if( !n )
	continue; /* invalid - just skip it */

	if( *p == 0 )
	text = _("No reason specified");
	else if( *p == 0x01 )
	text = _("Key is superseded");
	else if( *p == 0x02 )
	text = _("Key has been compromised");
	else if( *p == 0x03 )
	text = _("Key is no longer used");
	else if( *p == 0x20 )
	text = _("User ID is no longer valid");
	else
	text = NULL;

	log_info ( _("reason for revocation: "));
	if (text)
	log_printf ("%s\n", text);
	else
	log_printf ("code=%02x\n", *p );
	n--; p++;
	pp = NULL;
	do {
	/* We don't want any empty lines, so skip them */
	while( n && *p == '\n' ) {
	p++;
	n--;
	}
	if( n ) {
	pp = memchr( p, '\n', n );
	nn = pp? pp - p : n;
	log_info ( _("revocation comment: ") );
	es_write_sanitized (log_get_stream(), p, nn, NULL, NULL);
	log_printf ("\n");
	p += nn; n -= nn;
	}
	} while( pp );
	}
	}

	/* Mode 0: try and find the revocation based on the pk (i.e. check
	subkeys, etc.) Mode 1: use only the revocation on the main pk */

	void
	show_revocation_reason( PKT_public_key *pk, int mode )
	{
	/* Hmmm, this is not so easy because we have to duplicate the code
	* used in the trustbd to calculate the keyflags. We need to find
	* a clean way to check revocation certificates on keys and
	* signatures. And there should be no duplicate code. Because we
	* enter this function only when the trustdb told us that we have
	* a revoked key, we could simply look for a revocation cert and
	* display this one, when there is only one. Let's try to do this
	* until we have a better solution. */
	KBNODE node, keyblock = NULL;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	size_t fingerlen;
	int rc;

	/* get the keyblock */
	fingerprint_from_pk( pk, fingerprint, &fingerlen );
	rc = get_pubkey_byfprint(NULL, &keyblock, fingerprint, fingerlen);
	if( rc ) { /* that should never happen */
	log_debug( "failed to get the keyblock\n");
	return;
	}

	for( node=keyblock; node; node = node->next ) {
	if( (mode && node->pkt->pkttype == PKT_PUBLIC_KEY) \|\|
	( ( node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	&& !cmp_public_keys( node->pkt->pkt.public_key, pk ) ) )
	break;
	}
	if( !node ) {
	log_debug("Oops, PK not in keyblock\n");
	release_kbnode( keyblock );
	return;
	}
	/* now find the revocation certificate */
	for( node = node->next; node ; node = node->next ) {
	if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	break;
	if( node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class == 0x20
	\|\| node->pkt->pkt.signature->sig_class == 0x28 ) ) {
	/* FIXME: we should check the signature here */
	do_show_revocation_reason ( node->pkt->pkt.signature );
	break;
	}
	}

	/* We didn't find it, so check if the whole key is revoked */
	if(!node && !mode)
	show_revocation_reason(pk,1);

	release_kbnode( keyblock );
	}


	/****************
	* mode: 0 = standard
	* 1 = Without key info and additional menu option 'm'
	* this does also add an option to set the key to ultimately trusted.
	* Returns:
	* -2 = nothing changed - caller should show some additional info
	* -1 = quit operation
	* 0 = nothing changed
	* 1 = new ownertrust now in new_trust
	*/
	#ifndef NO_TRUST_MODELS
	static int
	do_edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode,
	unsigned *new_trust, int defer_help )
	{
	char *p;
	u32 keyid[2];
	int changed=0;
	int quit=0;
	int show=0;
	int min_num;
	int did_help=defer_help;
	unsigned int minimum = tdb_get_min_ownertrust (pk);

	switch(minimum)
	{
	default:
	case TRUST_UNDEFINED: min_num=1; break;
	case TRUST_NEVER: min_num=2; break;
	case TRUST_MARGINAL: min_num=3; break;
	case TRUST_FULLY: min_num=4; break;
	}

	keyid_from_pk (pk, keyid);
	for(;;) {
	/* A string with valid answers.

	TRANSLATORS: These are the allowed answers in lower and
	uppercase. Below you will find the matching strings which
	should be translated accordingly and the letter changed to
	match the one in the answer string.

	i = please show me more information
	m = back to the main menu
	s = skip this key
	q = quit
	*/
	const char *ans = _("iImMqQsS");

	if( !did_help )
	{
	if( !mode )
	{
	KBNODE keyblock, un;

	tty_printf (_("No trust value assigned to:\n"));
	print_key_line (NULL, pk, 0);

	p = get_user_id_native(keyid);
	tty_printf (_(" \"%s\"\n"),p);
	xfree (p);

	keyblock = get_pubkeyblock (keyid);
	if (!keyblock)
	BUG ();
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID )
	continue;
	if (un->pkt->pkt.user_id->is_revoked )
	continue;
	if (un->pkt->pkt.user_id->is_expired )
	continue;
	/* Only skip textual primaries */
	if (un->pkt->pkt.user_id->is_primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	if((opt.verify_options&VERIFY_SHOW_PHOTOS)
	&& un->pkt->pkt.user_id->attrib_data)
	show_photos (ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs, pk,
	un->pkt->pkt.user_id);

	p=utf8_to_native(un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len,0);

	tty_printf(_(" aka \"%s\"\n"),p);
	}

	print_fingerprint (NULL, pk, 2);
	tty_printf("\n");
	release_kbnode (keyblock);
	}

	if(opt.trust_model==TM_DIRECT)
	{
	tty_printf(_("How much do you trust that this key actually "
	"belongs to the named user?\n"));
	tty_printf("\n");
	}
	else
	{
	/* This string also used in keyedit.c:trustsig_prompt */
	tty_printf(_("Please decide how far you trust this user to"
	" correctly verify other users' keys\n"
	"(by looking at passports, checking fingerprints from"
	" different sources, etc.)\n"));
	tty_printf("\n");
	}

	if(min_num<=1)
	tty_printf (_(" %d = I don't know or won't say\n"), 1);
	if(min_num<=2)
	tty_printf (_(" %d = I do NOT trust\n"), 2);
	if(min_num<=3)
	tty_printf (_(" %d = I trust marginally\n"), 3);
	if(min_num<=4)
	tty_printf (_(" %d = I trust fully\n"), 4);
	if (mode)
	tty_printf (_(" %d = I trust ultimately\n"), 5);
	#if 0
	/* not yet implemented */
	tty_printf (" i = please show me more information\n");
	#endif
	if( mode )
	tty_printf(_(" m = back to the main menu\n"));
	else
	{
	tty_printf(_(" s = skip this key\n"));
	tty_printf(_(" q = quit\n"));
	}
	tty_printf("\n");
	if(minimum)
	tty_printf(_("The minimum trust level for this key is: %s\n\n"),
	trust_value_to_string(minimum));
	did_help = 1;
	}
	if( strlen(ans) != 8 )
	BUG();
	p = cpr_get("edit_ownertrust.value",_("Your decision? "));
	trim_spaces(p);
	cpr_kill_prompt();
	if( !*p )
	did_help = 0;
	else if( *p && p[1] )
	;
	else if( !p[1] && ((p >= '0'+min_num) && p <= (mode?'5':'4')) )
	{
	unsigned int trust;
	switch( *p )
	{
	case '1': trust = TRUST_UNDEFINED; break;
	case '2': trust = TRUST_NEVER ; break;
	case '3': trust = TRUST_MARGINAL ; break;
	case '4': trust = TRUST_FULLY ; break;
	case '5': trust = TRUST_ULTIMATE ; break;
	default: BUG();
	}
	if (trust == TRUST_ULTIMATE
	&& !cpr_get_answer_is_yes ("edit_ownertrust.set_ultimate.okay",
	_("Do you really want to set this key"
	" to ultimate trust? (y/N) ")))
	; /* no */
	else
	{
	*new_trust = trust;
	changed = 1;
	break;
	}
	}
	#if 0
	/* not yet implemented */
	else if( p == ans[0] \|\| p == ans[1] )
	{
	tty_printf(_("Certificates leading to an ultimately trusted key:\n"));
	show = 1;
	break;
	}
	#endif
	else if( mode && (p == ans[2] \|\| p == ans[3] \|\| *p == CONTROL_D ) )
	{
	break ; /* back to the menu */
	}
	else if( !mode && (p == ans[6] \|\| p == ans[7] ) )
	{
	break; /* skip */
	}
	else if( !mode && (p == ans[4] \|\| p == ans[5] ) )
	{
	quit = 1;
	break ; /* back to the menu */
	}
	xfree(p); p = NULL;
	}
	xfree(p);
	return show? -2: quit? -1 : changed;
	}
	#endif /!NO_TRUST_MODELS/


	/*
	* Display a menu to change the ownertrust of the key PK (which should
	* be a primary key).
	* For mode values see do_edit_ownertrust ()
	*/
	#ifndef NO_TRUST_MODELS
	int
	edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode )
	{
	unsigned int trust = 0;
	int no_help = 0;

	for(;;)
	{
	switch ( do_edit_ownertrust (ctrl, pk, mode, &trust, no_help ) )
	{
	case -1: /* quit */
	return -1;
	case -2: /* show info */
	no_help = 1;
	break;
	case 1: /* trust value set */
	trust &= ~TRUST_FLAG_DISABLED;
	trust \|= get_ownertrust (pk) & TRUST_FLAG_DISABLED;
	update_ownertrust (pk, trust );
	return 1;
	default:
	return 0;
	}
	}
	}
	#endif /!NO_TRUST_MODELS/


	/****************
	* Check whether we can trust this pk which has a trustlevel of TRUSTLEVEL
	* Returns: true if we trust.
	*/
	static int
	do_we_trust( PKT_public_key *pk, unsigned int trustlevel )
	{
	/* We should not be able to get here with a revoked or expired
	key */
	if(trustlevel & TRUST_FLAG_REVOKED
	\|\| trustlevel & TRUST_FLAG_SUB_REVOKED
	\|\| (trustlevel & TRUST_MASK) == TRUST_EXPIRED)
	BUG();

	if( opt.trust_model==TM_ALWAYS )
	{
	if( opt.verbose )
	log_info("No trust check due to '--trust-model always' option\n");
	return 1;
	}

	switch(trustlevel & TRUST_MASK)
	{
	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	log_info(_("%s: There is no assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 0; /* no */

	case TRUST_MARGINAL:
	log_info(_("%s: There is limited assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 1; /* yes */

	case TRUST_FULLY:
	if( opt.verbose )
	log_info(_("This key probably belongs to the named user\n"));
	return 1; /* yes */

	case TRUST_ULTIMATE:
	if( opt.verbose )
	log_info(_("This key belongs to us\n"));
	return 1; /* yes */

	case TRUST_NEVER:
	/* This can be returned by TOFU, which can return negative
	assertions. */
	log_info(_("%s: This key is bad! It has been marked as untrusted!\n"),
	keystr_from_pk(pk));
	return 0; /* no */
	}

	return 1; /NOTREACHED/
	}


	/****************
	* wrapper around do_we_trust, so we can ask whether to use the
	* key anyway.
	*/
	static int
	do_we_trust_pre( PKT_public_key *pk, unsigned int trustlevel )
	{
	int rc;

	rc = do_we_trust( pk, trustlevel );

	if( !opt.batch && !rc )
	{
	print_pubkey_info(NULL,pk);
	print_fingerprint (NULL, pk, 2);
	tty_printf("\n");

	if ((trustlevel & TRUST_MASK) == TRUST_NEVER)
	tty_printf(
	_("This key is bad! It has been marked as untrusted! If you\n"
	"really know what you are doing, you may answer the next\n"
	"question with yes.\n"));
	else
	tty_printf(
	_("It is NOT certain that the key belongs to the person named\n"
	"in the user ID. If you really know what you are doing,\n"
	"you may answer the next question with yes.\n"));

	tty_printf("\n");


	if (is_status_enabled ())
	{
	u32 kid[2];
	char *hint_str;

	keyid_from_pk (pk, kid);
	hint_str = get_long_user_id_string ( kid );
	write_status_text ( STATUS_USERID_HINT, hint_str );
	xfree (hint_str);
	}

	if( cpr_get_answer_is_yes("untrusted_key.override",
	_("Use this key anyway? (y/N) ")) )
	rc = 1;

	/* Hmmm: Should we set a flag to tell the user about
	* his decision the next time he encrypts for this recipient?
	*/
	}

	return rc;
	}


	/* Write a TRUST_foo status line inclduing the validation model. */
	static void
	write_trust_status (int statuscode, int trustlevel)
	{
	#ifdef NO_TRUST_MODELS
	write_status (statuscode);
	#else /* NO_TRUST_MODELS */
	int tm;

	/* For the combined tofu+pgp method, we return the trust model which
	* was responsible for the trustlevel. */
	if (opt.trust_model == TM_TOFU_PGP)
	tm = (trustlevel & TRUST_FLAG_TOFU_BASED)? TM_TOFU : TM_PGP;
	else
	tm = opt.trust_model;
	write_status_strings (statuscode, "0 ", trust_model_string (tm), NULL);
	#endif /* NO_TRUST_MODELS */
	}


	/****************
	* Check whether we can trust this signature.
	* Returns an error code if we should not trust this signature.
	*/
	int
	check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
	{
	PKT_public_key pk = xmalloc_clear( sizeof pk );
	unsigned int trustlevel = TRUST_UNKNOWN;
	int rc=0;

	rc = get_pubkey( pk, sig->keyid );
	if (rc)
	{ /* this should not happen */
	log_error("Ooops; the key vanished - can't check the trust\n");
	rc = GPG_ERR_NO_PUBKEY;
	goto leave;
	}

	if ( opt.trust_model==TM_ALWAYS )
	{
	if( !opt.quiet )
	log_info(_("WARNING: Using untrusted key!\n"));
	if (opt.with_fingerprint)
	print_fingerprint (NULL, pk, 1);
	goto leave;
	}

	if(pk->flags.maybe_revoked && !pk->flags.revoked)
	log_info(_("WARNING: this key might be revoked (revocation key"
	" not present)\n"));

	trustlevel = get_validity (ctrl, NULL, pk, NULL, sig, 1);

	if ( (trustlevel & TRUST_FLAG_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	if(pk->flags.revoked == 2)
	log_info(_("WARNING: This key has been revoked by its"
	" designated revoker!\n"));
	else
	log_info(_("WARNING: This key has been revoked by its owner!\n"));
	log_info(_(" This could mean that the signature is forged.\n"));
	show_revocation_reason( pk, 0 );
	}
	else if ((trustlevel & TRUST_FLAG_SUB_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	log_info(_("WARNING: This subkey has been revoked by its owner!\n"));
	show_revocation_reason( pk, 0 );
	}

	if ((trustlevel & TRUST_FLAG_DISABLED))
	log_info (_("Note: This key has been disabled.\n"));

	/* If we have PKA information adjust the trustlevel. */
	if (sig->pka_info && sig->pka_info->valid)
	{
	unsigned char fpr[MAX_FINGERPRINT_LEN];
	PKT_public_key *primary_pk;
	size_t fprlen;
	int okay;


	primary_pk = xmalloc_clear (sizeof *primary_pk);
	get_pubkey (primary_pk, pk->main_keyid);
	fingerprint_from_pk (primary_pk, fpr, &fprlen);
	free_public_key (primary_pk);

	if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) )
	{
	okay = 1;
	write_status_text (STATUS_PKA_TRUST_GOOD, sig->pka_info->email);
	log_info (_("Note: Verified signer's address is '%s'\n"),
	sig->pka_info->email);
	}
	else
	{
	okay = 0;
	write_status_text (STATUS_PKA_TRUST_BAD, sig->pka_info->email);
	log_info (_("Note: Signer's address '%s' "
	"does not match DNS entry\n"), sig->pka_info->email);
	}

	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	case TRUST_MARGINAL:
	if (okay && opt.verify_options&VERIFY_PKA_TRUST_INCREASE)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_FULLY);
	log_info (_("trustlevel adjusted to FULL"
	" due to valid PKA info\n"));
	}
	/* (fall through) */
	case TRUST_FULLY:
	if (!okay)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_NEVER);
	log_info (_("trustlevel adjusted to NEVER"
	" due to bad PKA info\n"));
	}
	break;
	}
	}

	/* Now let the user know what up with the trustlevel. */
	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_EXPIRED:
	log_info(_("Note: This key has expired!\n"));
	print_fingerprint (NULL, pk, 1);
	break;

	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	write_trust_status (STATUS_TRUST_UNDEFINED, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" a trusted signature!\n"));
	log_info(_(" There is no indication that the "
	"signature belongs to the owner.\n" ));
	print_fingerprint (NULL, pk, 1);
	break;

	case TRUST_NEVER:
	/* This level can be returned by TOFU, which supports negative
	* assertions. */
	write_trust_status (STATUS_TRUST_NEVER, trustlevel);
	log_info(_("WARNING: We do NOT trust this key!\n"));
	log_info(_(" The signature is probably a FORGERY.\n"));
	if (opt.with_fingerprint)
	print_fingerprint (NULL, pk, 1);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	break;

	case TRUST_MARGINAL:
	write_trust_status (STATUS_TRUST_MARGINAL, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" sufficiently trusted signatures!\n"));
	log_info(_(" It is not certain that the"
	" signature belongs to the owner.\n" ));
	print_fingerprint (NULL, pk, 1);
	break;

	case TRUST_FULLY:
	write_trust_status (STATUS_TRUST_FULLY, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (NULL, pk, 1);
	break;

	case TRUST_ULTIMATE:
	write_trust_status (STATUS_TRUST_ULTIMATE, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (NULL, pk, 1);
	break;
	}

	leave:
	free_public_key( pk );
	return rc;
	}


	void
	release_pk_list (pk_list_t pk_list)
	{
	PK_LIST pk_rover;

	for ( ; pk_list; pk_list = pk_rover)
	{
	pk_rover = pk_list->next;
	free_public_key ( pk_list->pk );
	xfree ( pk_list );
	}
	}


	static int
	key_present_in_pk_list(PK_LIST pk_list, PKT_public_key *pk)
	{
	for( ; pk_list; pk_list = pk_list->next)
	if (cmp_public_keys(pk_list->pk, pk) == 0)
	return 0;

	return -1;
	}


	/****************
	* Return a malloced string with a default recipient if there is any
	*/
	static char *
	default_recipient(ctrl_t ctrl)
	{
	PKT_public_key *pk;
	byte fpr[MAX_FINGERPRINT_LEN+1];
	size_t n;
	char *p;
	int i;

	if( opt.def_recipient )
	return xstrdup( opt.def_recipient );
	if( !opt.def_recipient_self )
	return NULL;
	pk = xmalloc_clear( sizeof *pk );
	i = get_seckey_default (ctrl, pk);
	if( i ) {
	free_public_key( pk );
	return NULL;
	}
	n = MAX_FINGERPRINT_LEN;
	fingerprint_from_pk( pk, fpr, &n );
	free_public_key( pk );
	p = xmalloc( 2*n+3 );
	*p++ = '0';
	*p++ = 'x';
	for(i=0; i < n; i++ )
	sprintf( p+2*i, "%02X", fpr[i] );
	p -= 2;
	return p;
	}

	static int
	expand_id(const char id,strlist_t into,unsigned int flags)
	{
	struct groupitem *groups;
	int count=0;

	for(groups=opt.grouplist;groups;groups=groups->next)
	{
	/* need strcasecmp() here, as this should be localized */
	if(strcasecmp(groups->name,id)==0)
	{
	strlist_t each,sl;

	/* this maintains the current utf8-ness */
	for(each=groups->values;each;each=each->next)
	{
	sl=add_to_strlist(into,each->d);
	sl->flags=flags;
	count++;
	}

	break;
	}
	}

	return count;
	}

	/* For simplicity, and to avoid potential loops, we only expand once -
	* you can't make an alias that points to an alias. */
	static strlist_t
	expand_group (strlist_t input)
	{
	strlist_t output = NULL;
	strlist_t sl, rover;

	for (rover = input; rover; rover = rover->next)
	if (!(rover->flags & PK_LIST_FROM_FILE)
	&& !expand_id(rover->d,&output,rover->flags))
	{
	/* Didn't find any groups, so use the existing string */
	sl=add_to_strlist(&output,rover->d);
	sl->flags=rover->flags;
	}

	return output;
	}


	/* Helper for build_pk_list to find and check one key. This helper is
	* also used directly in server mode by the RECIPIENTS command. On
	* success the new key is added to PK_LIST_ADDR. NAME is the user id
	* of the key. USE the requested usage and a set MARK_HIDDEN will
	* mark the key in the updated list as a hidden recipient. If
	- * FROM_FILE is true, NAME is is not a user ID but the name of a file
	+ * FROM_FILE is true, NAME is not a user ID but the name of a file
	* holding a key. */
	gpg_error_t
	find_and_check_key (ctrl_t ctrl, const char *name, unsigned int use,
	int mark_hidden, int from_file, pk_list_t *pk_list_addr)
	{
	int rc;
	PKT_public_key *pk;

	if (!name \|\| !*name)
	return gpg_error (GPG_ERR_INV_USER_ID);

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	return gpg_error_from_syserror ();
	pk->req_usage = use;

	if (from_file)
	rc = get_pubkey_fromfile (ctrl, pk, name);
	else
	rc = get_best_pubkey_byname (ctrl, NULL, pk, name, NULL, 0, 0);
	if (rc)
	{
	int code;

	/* Key not found or other error. */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	switch (gpg_err_code (rc))
	{
	case GPG_ERR_NO_SECKEY:
	case GPG_ERR_NO_PUBKEY: code = 1; break;
	case GPG_ERR_INV_USER_ID: code = 14; break;
	default: code = 0; break;
	}
	send_status_inv_recp (code, name);
	free_public_key (pk);
	return rc;
	}

	rc = openpgp_pk_test_algo2 (pk->pubkey_algo, use);
	if (rc)
	{
	/* Key found but not usable for us (e.g. sign-only key). */
	send_status_inv_recp (3, name); /* Wrong key usage */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	free_public_key (pk);
	return rc;
	}

	/* Key found and usable. Check validity. */
	if (!from_file)
	{
	int trustlevel;

	trustlevel = get_validity (ctrl, NULL, pk, pk->user_id, NULL, 1);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	/* Key has been disabled. */
	send_status_inv_recp (13, name);
	log_info (_("%s: skipped: public key is disabled\n"), name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}

	if ( !do_we_trust_pre (pk, trustlevel) )
	{
	/* We don't trust this key. */
	send_status_inv_recp (10, name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}
	}

	/* Skip the actual key if the key is already present in the
	list. */
	if (!key_present_in_pk_list (*pk_list_addr, pk))
	{
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"), name);
	free_public_key (pk);
	}
	else
	{
	pk_list_t r;

	r = xtrymalloc (sizeof *r);
	if (!r)
	{
	rc = gpg_error_from_syserror ();
	free_public_key (pk);
	return rc;
	}
	r->pk = pk;
	r->next = *pk_list_addr;
	r->flags = mark_hidden? 1:0;
	*pk_list_addr = r;
	}

	return 0;
	}



	/* This is the central function to collect the keys for recipients.
	* It is thus used to prepare a public key encryption. encrypt-to
	* keys, default keys and the keys for the actual recipients are all
	* collected here. When not in batch mode and no recipient has been
	* passed on the commandline, the function will also ask for
	* recipients.
	*
	* RCPTS is a string list with the recipients; NULL is an allowed
	* value but not very useful. Group expansion is done on these names;
	* they may be in any of the user Id formats we can handle. The flags
	* bits for each string in the string list are used for:
	*
	* - PK_LIST_ENCRYPT_TO :: This is an encrypt-to recipient.
	* - PK_LIST_HIDDEN :: This is a hidden recipient.
	* - PK_LIST_FROM_FILE :: The argument is a file with a key.
	*
	* On success a list of keys is stored at the address RET_PK_LIST; the
	* caller must free this list. On error the value at this address is
	* not changed.
	*/
	int
	build_pk_list (ctrl_t ctrl, strlist_t rcpts, PK_LIST *ret_pk_list)
	{
	PK_LIST pk_list = NULL;
	PKT_public_key *pk=NULL;
	int rc=0;
	int any_recipients=0;
	strlist_t rov,remusr;
	char *def_rec = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* Try to expand groups if any have been defined. */
	if (opt.grouplist)
	remusr = expand_group (rcpts);
	else
	remusr = rcpts;

	/* XXX: Change this function to use get_pubkeys instead of
	get_pubkey_byname to detect ambiguous key specifications and warn
	about duplicate keyblocks. For ambiguous key specifications on
	the command line or provided interactively, prompt the user to
	select the best key. If a key specification is ambiguous and we
	are in batch mode, die. */

	if (opt.encrypt_to_default_key)
	{
	static int warned;

	const char *default_key = parse_def_secret_key (ctrl);
	if (default_key)
	{
	PK_LIST r = xmalloc_clear (sizeof *r);

	r->pk = xmalloc_clear (sizeof *r->pk);
	r->pk->req_usage = PUBKEY_USAGE_ENC;

	rc = get_pubkey_byname (ctrl, NULL, r->pk, default_key,
	NULL, NULL, 0, 1);
	if (rc)
	{
	xfree (r->pk);
	xfree (r);

	log_error (_("can't encrypt to '%s'\n"), default_key);
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"),
	"--default-key");
	}
	else
	{
	r->next = pk_list;
	r->flags = 0;
	pk_list = r;
	}
	}
	else if (opt.def_secret_key)
	{
	if (! warned)
	log_info (_("option '%s' given, but no valid default keys given\n"),
	"--encrypt-to-default-key");
	warned = 1;
	}
	else
	{
	if (! warned)
	log_info (_("option '%s' given, but option '%s' not given\n"),
	"--encrypt-to-default-key", "--default-key");
	warned = 1;
	}
	}

	/* Check whether there are any recipients in the list and build the
	* list of the encrypt-to ones (we always trust them). */
	for ( rov = remusr; rov; rov = rov->next )
	{
	if ( !(rov->flags & PK_LIST_ENCRYPT_TO) )
	{
	/* This is a regular recipient; i.e. not an encrypt-to
	one. */
	any_recipients = 1;

	/* Hidden recipients are not allowed while in PGP mode,
	issue a warning and switch into GnuPG mode. */
	if ((rov->flags & PK_LIST_HIDDEN) && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("you may not use %s while in %s mode\n"),
	"--hidden-recipient",
	compliance_option_string());

	compliance_failure();
	}
	}
	else if (!opt.no_encrypt_to)
	{
	/* --encrypt-to has not been disabled. Check this
	encrypt-to key. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* We explicitly allow encrypt-to to an disabled key; thus
	we pass 1 for the second last argument and 1 as the last
	argument to disable AKL. */
	if ( (rc = get_pubkey_byname (ctrl,
	NULL, pk, rov->d, NULL, NULL, 1, 1)) )
	{
	free_public_key ( pk ); pk = NULL;
	log_error (_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (0, rov->d);
	goto fail;
	}
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Skip the actual key if the key is already present
	* in the list. Add it to our list if not. */
	if (key_present_in_pk_list(pk_list, pk) == 0)
	{
	free_public_key (pk); pk = NULL;
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"),
	rov->d);
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = (rov->flags&PK_LIST_HIDDEN)?1:0;
	pk_list = r;

	/* Hidden encrypt-to recipients are not allowed while
	in PGP mode, issue a warning and switch into
	GnuPG mode. */
	if ((r->flags&PK_LIST_ENCRYPT_TO) && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("you may not use %s while in %s mode\n"),
	"--hidden-encrypt-to",
	compliance_option_string());

	compliance_failure();
	}
	}
	}
	else
	{
	/* The public key is not usable for encryption. */
	free_public_key( pk ); pk = NULL;
	log_error(_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (3, rov->d); /* Wrong key usage */
	goto fail;
	}
	}
	}

	/* If we don't have any recipients yet and we are not in batch mode
	drop into interactive selection mode. */
	if ( !any_recipients && !opt.batch )
	{
	int have_def_rec;
	char *answer = NULL;
	strlist_t backlog = NULL;

	if (pk_list)
	any_recipients = 1;
	def_rec = default_recipient(ctrl);
	have_def_rec = !!def_rec;
	if ( !have_def_rec )
	tty_printf(_("You did not specify a user ID. (you may use \"-r\")\n"));

	for (;;)
	{
	rc = 0;
	xfree(answer);
	if ( have_def_rec )
	{
	/* A default recipient is taken as the first entry. */
	answer = def_rec;
	def_rec = NULL;
	}
	else if (backlog)
	{
	/* This is part of our trick to expand and display groups. */
	answer = strlist_pop (&backlog);
	}
	else
	{
	/* Show the list of already collected recipients and ask
	for more. */
	PK_LIST iter;

	tty_printf("\n");
	tty_printf(_("Current recipients:\n"));
	for (iter=pk_list;iter;iter=iter->next)
	{
	u32 keyid[2];

	keyid_from_pk(iter->pk,keyid);
	tty_printf ("%s/%s %s \"",
	pubkey_string (iter->pk,
	pkstrbuf, sizeof pkstrbuf),
	keystr(keyid),
	datestr_from_pk (iter->pk));

	if (iter->pk->user_id)
	tty_print_utf8_string(iter->pk->user_id->name,
	iter->pk->user_id->len);
	else
	{
	size_t n;
	char *p = get_user_id( keyid, &n );
	tty_print_utf8_string( p, n );
	xfree(p);
	}
	tty_printf("\"\n");
	}

	answer = cpr_get_utf8("pklist.user_id.enter",
	_("\nEnter the user ID. "
	"End with an empty line: "));
	trim_spaces(answer);
	cpr_kill_prompt();
	}

	if ( !answer \|\| !*answer )
	{
	xfree(answer);
	break; /* No more recipients entered - get out of loop. */
	}

	/* Do group expand here too. The trick here is to continue
	the loop if any expansion occurred. The code above will
	then list all expanded keys. */
	if (expand_id(answer,&backlog,0))
	continue;

	/* Get and check key for the current name. */
	free_public_key (pk);
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;
	rc = get_pubkey_byname (ctrl, NULL, pk, answer, NULL, NULL, 0, 0 );
	if (rc)
	tty_printf(_("No such user ID.\n"));
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	if ( have_def_rec )
	{
	/* No validation for a default recipient. */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info (_("skipped: public key "
	"already set as default recipient\n") );
	}
	else
	{
	PK_LIST r = xmalloc (sizeof *r);
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	else
	{ /* Check validity of this key. */
	int trustlevel;

	trustlevel =
	get_validity (ctrl, NULL, pk, pk->user_id, NULL, 1);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	tty_printf (_("Public key is disabled.\n") );
	}
	else if ( do_we_trust_pre (pk, trustlevel) )
	{
	/* Skip the actual key if the key is already
	* present in the list */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info(_("skipped: public key already set\n") );
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing interactive ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	}
	}
	xfree(def_rec); def_rec = NULL;
	have_def_rec = 0;
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	}
	else if ( !any_recipients && (def_rec = default_recipient(ctrl)) )
	{
	/* We are in batch mode and have only a default recipient. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* The default recipient is allowed to be disabled; thus pass 1
	as second last argument. We also don't want an AKL. */
	rc = get_pubkey_byname (ctrl, NULL, pk, def_rec, NULL, NULL, 1, 1);
	if (rc)
	log_error(_("unknown default recipient \"%s\"\n"), def_rec );
	else if ( !(rc=openpgp_pk_test_algo2(pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Mark any_recipients here since the default recipient
	would have been used if it wasn't already there. It
	doesn't really matter if we got this key from the default
	recipient or an encrypt-to. */
	any_recipients = 1;
	if (!key_present_in_pk_list(pk_list, pk))
	log_info (_("skipped: public key already set "
	"as default recipient\n"));
	else
	{
	PK_LIST r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	xfree(def_rec); def_rec = NULL;
	}
	else
	{
	/* General case: Check all keys. */
	any_recipients = 0;
	for (; remusr; remusr = remusr->next )
	{
	if ( (remusr->flags & PK_LIST_ENCRYPT_TO) )
	continue; /* encrypt-to keys are already handled. */

	rc = find_and_check_key (ctrl, remusr->d, PUBKEY_USAGE_ENC,
	!!(remusr->flags&PK_LIST_HIDDEN),
	!!(remusr->flags&PK_LIST_FROM_FILE),
	&pk_list);
	if (rc)
	goto fail;
	any_recipients = 1;
	}
	}

	if ( !rc && !any_recipients )
	{
	log_error(_("no valid addressees\n"));
	write_status_text (STATUS_NO_RECP, "0");
	rc = GPG_ERR_NO_USER_ID;
	}

	#ifdef USE_TOFU
	if (! rc && (opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU))
	{
	PK_LIST iter;
	for (iter = pk_list; iter; iter = iter->next)
	{
	int rc2;

	/* Note: we already resolved any conflict when looking up
	the key. Don't annoy the user again if she selected
	accept once. */
	rc2 = tofu_register_encryption (ctrl, iter->pk, NULL, 0);
	if (rc2)
	log_info ("WARNING: Failed to register encryption to %s"
	" with TOFU engine\n",
	keystr (pk_main_keyid (iter->pk)));
	else if (DBG_TRUST)
	log_debug ("Registered encryption to %s with TOFU DB.\n",
	keystr (pk_main_keyid (iter->pk)));
	}
	}
	#endif /USE_TOFU/

	fail:

	if ( rc )
	release_pk_list( pk_list );
	else
	*ret_pk_list = pk_list;
	if (opt.grouplist)
	free_strlist(remusr);
	return rc;
	}


	/* In pgp6 mode, disallow all ciphers except IDEA (1), 3DES (2), and
	CAST5 (3), all hashes except MD5 (1), SHA1 (2), and RIPEMD160 (3),
	and all compressions except none (0) and ZIP (1). pgp7 and pgp8
	mode expands the cipher list to include AES128 (7), AES192 (8),
	AES256 (9), and TWOFISH (10). pgp8 adds the SHA-256 hash (8). For
	a true PGP key all of this is unneeded as they are the only items
	present in the preferences subpacket, but checking here covers the
	weird case of encrypting to a key that had preferences from a
	different implementation which was then used with PGP. I am not
	completely comfortable with this as the right thing to do, as it
	slightly alters the list of what the user is supposedly requesting.
	It is not against the RFC however, as the preference chosen will
	never be one that the user didn't specify somewhere ("The
	implementation may use any mechanism to pick an algorithm in the
	intersection"), and PGP has no mechanism to fix such a broken
	preference list, so I'm including it. -dms */

	int
	algo_available( preftype_t preftype, int algo, const union pref_hint *hint)
	{
	if( preftype == PREFTYPE_SYM )
	{
	if(PGP6 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5))
	return 0;

	if(PGP7 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5
	&& algo != CIPHER_ALGO_AES
	&& algo != CIPHER_ALGO_AES192
	&& algo != CIPHER_ALGO_AES256
	&& algo != CIPHER_ALGO_TWOFISH))
	return 0;

	/* PGP8 supports all the ciphers we do.. */

	return algo && !openpgp_cipher_test_algo ( algo );
	}
	else if( preftype == PREFTYPE_HASH )
	{
	if (hint && hint->digest_length)
	{
	if (hint->digest_length!=20 \|\| opt.flags.dsa2)
	{
	/* If --enable-dsa2 is set or the hash isn't 160 bits
	(which implies DSA2), then we'll accept a hash that
	is larger than we need. Otherwise we won't accept
	any hash that isn't exactly the right size. */
	if (hint->digest_length > gcry_md_get_algo_dlen (algo))
	return 0;
	}
	else if (hint->digest_length != gcry_md_get_algo_dlen (algo))
	return 0;
	}

	if((PGP6 \|\| PGP7) && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160))
	return 0;


	if(PGP8 && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160
	&& algo != DIGEST_ALGO_SHA256))
	return 0;

	return algo && !openpgp_md_test_algo (algo);
	}
	else if( preftype == PREFTYPE_ZIP )
	{
	if((PGP6 \|\| PGP7) && (algo != COMPRESS_ALGO_NONE
	&& algo != COMPRESS_ALGO_ZIP))
	return 0;

	/* PGP8 supports all the compression algos we do */

	return !check_compress_algo( algo );
	}
	else
	return 0;
	}

	/****************
	* Return -1 if we could not find an algorithm.
	*/
	int
	select_algo_from_prefs(PK_LIST pk_list, int preftype,
	int request, const union pref_hint *hint)
	{
	PK_LIST pkr;
	u32 bits[8];
	const prefitem_t *prefs;
	int result=-1,i;
	u16 scores[256];

	if( !pk_list )
	return -1;

	memset(bits,0xFF,sizeof(bits));
	memset(scores,0,sizeof(scores));

	for( pkr = pk_list; pkr; pkr = pkr->next )
	{
	u32 mask[8];
	int rank=1,implicit=-1;

	memset(mask,0,sizeof(mask));

	switch(preftype)
	{
	case PREFTYPE_SYM:
	/* IDEA is implicitly there for v3 keys with v3 selfsigs if
	--pgp2 mode is on. This was a 2440 thing that was
	dropped from 4880 but is still relevant to GPG's 1991
	support. All this doesn't mean IDEA is actually
	available, of course. */
	implicit=CIPHER_ALGO_3DES;

	break;

	case PREFTYPE_HASH:
	/* While I am including this code for completeness, note
	that currently --pgp2 mode locks the hash at MD5, so this
	code will never even be called. Even if the hash wasn't
	locked at MD5, we don't support sign+encrypt in --pgp2
	mode, and that's the only time PREFTYPE_HASH is used
	anyway. -dms */

	implicit=DIGEST_ALGO_SHA1;

	break;

	case PREFTYPE_ZIP:
	/* Uncompressed is always an option. */
	implicit=COMPRESS_ALGO_NONE;
	}

	if (pkr->pk->user_id) /* selected by user ID */
	prefs = pkr->pk->user_id->prefs;
	else
	prefs = pkr->pk->prefs;

	if( prefs )
	{
	for (i=0; prefs[i].type; i++ )
	{
	if( prefs[i].type == preftype )
	{
	/* Make sure all scores don't add up past 0xFFFF
	(and roll around) */
	if(rank+scores[prefs[i].value]<=0xFFFF)
	scores[prefs[i].value]+=rank;
	else
	scores[prefs[i].value]=0xFFFF;

	mask[prefs[i].value/32] \|= 1<<(prefs[i].value%32);

	rank++;

	/* We saw the implicit algorithm, so we don't need
	tack it on the end ourselves. */
	if(implicit==prefs[i].value)
	implicit=-1;
	}
	}
	}

	if(rank==1 && preftype==PREFTYPE_ZIP)
	{
	/* If the compression preferences are not present, they are
	assumed to be ZIP, Uncompressed (RFC4880:13.3.1) */
	scores[1]=1; /* ZIP is first choice */
	scores[0]=2; /* Uncompressed is second choice */
	mask[0]\|=3;
	}

	/* If the key didn't have the implicit algorithm listed
	explicitly, add it here at the tail of the list. */
	if(implicit>-1)
	{
	scores[implicit]+=rank;
	mask[implicit/32] \|= 1<<(implicit%32);
	}

	for(i=0;i<8;i++)
	bits[i]&=mask[i];
	}

	/* We've now scored all of the algorithms, and the usable ones have
	bits set. Let's pick the winner. */

	/* The caller passed us a request. Can we use it? */
	if(request>-1 && (bits[request/32] & (1<<(request%32))) &&
	algo_available(preftype,request,hint))
	result=request;

	if(result==-1)
	{
	/* If we have personal prefs set, use them. */
	prefs=NULL;
	if(preftype==PREFTYPE_SYM && opt.personal_cipher_prefs)
	prefs=opt.personal_cipher_prefs;
	else if(preftype==PREFTYPE_HASH && opt.personal_digest_prefs)
	prefs=opt.personal_digest_prefs;
	else if(preftype==PREFTYPE_ZIP && opt.personal_compress_prefs)
	prefs=opt.personal_compress_prefs;

	if( prefs )
	for(i=0; prefs[i].type; i++ )
	{
	if(bits[prefs[i].value/32] & (1<<(prefs[i].value%32))
	&& algo_available( preftype, prefs[i].value, hint))
	{
	result = prefs[i].value;
	break;
	}
	}
	}

	if(result==-1)
	{
	unsigned int best=-1;

	/* At this point, we have not selected an algorithm due to a
	special request or via personal prefs. Pick the highest
	ranked algorithm (i.e. the one with the lowest score). */

	if(preftype==PREFTYPE_HASH && scores[DIGEST_ALGO_MD5])
	{
	/* "If you are building an authentication system, the recipient
	may specify a preferred signing algorithm. However, the
	signer would be foolish to use a weak algorithm simply
	because the recipient requests it." (RFC4880:14). If any
	other hash algorithm is available, pretend that MD5 isn't.
	Note that if the user intentionally chose MD5 by putting it
	in their personal prefs, then we do what the user said (as we
	never reach this code). */

	for(i=DIGEST_ALGO_MD5+1;i<256;i++)
	if(scores[i])
	{
	scores[DIGEST_ALGO_MD5]=0;
	break;
	}
	}

	for(i=0;i<256;i++)
	{
	/* Note the '<' here. This means in case of a tie, we will
	favor the lower algorithm number. We have a choice
	between the lower number (probably an older algorithm
	with more time in use), or the higher number (probably a
	newer algorithm with less time in use). Older is
	probably safer here, even though the newer algorithms
	tend to be "stronger". */
	if(scores[i] && scores[i]<best
	&& (bits[i/32] & (1<<(i%32)))
	&& algo_available(preftype,i,hint))
	{
	best=scores[i];
	result=i;
	}
	}
	}

	return result;
	}

	/*
	* Select the MDC flag from the pk_list. We can only use MDC if all
	* recipients support this feature.
	*/
	int
	select_mdc_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	if ( !pk_list )
	return 0;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.mdc;
	else
	mdc = pkr->pk->flags.mdc;
	if (!mdc)
	return 0; /* At least one recipient does not support it. */
	}
	return 1; /* Can be used. */
	}


	/* Print a warning for all keys in PK_LIST missing the MDC feature. */
	void
	warn_missing_mdc_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.mdc;
	else
	mdc = pkr->pk->flags.mdc;
	if (!mdc)
	log_info (_("Note: key %s has no %s feature\n"),
	keystr_from_pk (pkr->pk), "MDC");
	}
	}

	void
	warn_missing_aes_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	const prefitem_t *prefs;
	int i;
	int gotit = 0;

	prefs = pkr->pk->user_id? pkr->pk->user_id->prefs : pkr->pk->prefs;
	if (prefs)
	{
	for (i=0; !gotit && prefs[i].type; i++ )
	if (prefs[i].type == PREFTYPE_SYM
	&& prefs[i].value == CIPHER_ALGO_AES)
	gotit++;
	}
	if (!gotit)
	log_info (_("Note: key %s has no preference for %s\n"),
	keystr_from_pk (pkr->pk), "AES");
	}
	}
	diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
	index 117744fb4..de98d99c9 100644
	--- a/g10/pubkey-enc.c
	+++ b/g10/pubkey-enc.c
	@@ -1,430 +1,430 @@
	/* pubkey-enc.c - Process a public key encoded packet.
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2006, 2009,
	* 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "util.h"
	#include "packet.h"
	#include "keydb.h"
	#include "trustdb.h"
	#include "status.h"
	#include "options.h"
	#include "main.h"
	#include "i18n.h"
	#include "pkglue.h"
	#include "call-agent.h"
	#include "host2net.h"


	static gpg_error_t get_it (PKT_pubkey_enc *k,
	DEK dek, PKT_public_key sk, u32 *keyid);


	/* Check that the given algo is mentioned in one of the valid user-ids. */
	static int
	is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
	{
	kbnode_t k;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	prefitem_t *prefs = uid->prefs;

	if (uid->created && prefs && !uid->is_revoked && !uid->is_expired)
	{
	for (; prefs->type; prefs++)
	if (prefs->type == type && prefs->value == algo)
	return 1;
	}
	}
	}
	return 0;
	}


	/*
	* Get the session key from a pubkey enc packet and return it in DEK,
	* which should have been allocated in secure memory by the caller.
	*/
	gpg_error_t
	get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
	{
	PKT_public_key *sk = NULL;
	int rc;

	if (DBG_CLOCK)
	log_clock ("get_session_key enter");

	rc = openpgp_pk_test_algo2 (k->pubkey_algo, PUBKEY_USAGE_ENC);
	if (rc)
	goto leave;

	if ((k->keyid[0] \|\| k->keyid[1]) && !opt.try_all_secrets)
	{
	sk = xmalloc_clear (sizeof *sk);
	sk->pubkey_algo = k->pubkey_algo; /* We want a pubkey with this algo. */
	if (!(rc = get_seckey (sk, k->keyid)))
	rc = get_it (k, dek, sk, k->keyid);
	}
	else if (opt.skip_hidden_recipients)
	rc = gpg_error (GPG_ERR_NO_SECKEY);
	else /* Anonymous receiver: Try all available secret keys. */
	{
	void *enum_context = NULL;
	u32 keyid[2];

	for (;;)
	{
	free_public_key (sk);
	sk = xmalloc_clear (sizeof *sk);
	rc = enum_secret_keys (ctrl, &enum_context, sk);
	if (rc)
	{
	rc = GPG_ERR_NO_SECKEY;
	break;
	}
	if (sk->pubkey_algo != k->pubkey_algo)
	continue;
	if (!(sk->pubkey_usage & PUBKEY_USAGE_ENC))
	continue;
	keyid_from_pk (sk, keyid);
	if (!opt.quiet)
	log_info (_("anonymous recipient; trying secret key %s ...\n"),
	keystr (keyid));

	rc = get_it (k, dek, sk, keyid);
	if (!rc)
	{
	if (!opt.quiet)
	log_info (_("okay, we are the anonymous recipient.\n"));
	break;
	}
	else if (gpg_err_code (rc) == GPG_ERR_FULLY_CANCELED)
	break; /* Don't try any more secret keys. */
	}
	enum_secret_keys (ctrl, &enum_context, NULL); /* free context */
	}

	leave:
	free_public_key (sk);
	if (DBG_CLOCK)
	log_clock ("get_session_key leave");
	return rc;
	}


	static gpg_error_t
	get_it (PKT_pubkey_enc enc, DEK dek, PKT_public_key sk, u32 keyid)
	{
	gpg_error_t err;
	byte *frame = NULL;
	unsigned int n;
	size_t nframe;
	u16 csum, csum2;
	int padding;
	gcry_sexp_t s_data;
	char *desc;
	char *keygrip;
	byte fp[MAX_FINGERPRINT_LEN];
	size_t fpn;

	if (DBG_CLOCK)
	log_clock ("decryption start");

	/* Get the keygrip. */
	err = hexkeygrip_from_pk (sk, &keygrip);
	if (err)
	goto leave;

	/* Convert the data to an S-expression. */
	if (sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL
	\|\| sk->pubkey_algo == PUBKEY_ALGO_ELGAMAL_E)
	{
	if (!enc->data[0] \|\| !enc->data[1])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(elg(a%m)(b%m)))",
	enc->data[0], enc->data[1]);
	}
	else if (sk->pubkey_algo == PUBKEY_ALGO_RSA
	\|\| sk->pubkey_algo == PUBKEY_ALGO_RSA_E)
	{
	if (!enc->data[0])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))",
	enc->data[0]);
	}
	else if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	if (!enc->data[0] \|\| !enc->data[1])
	err = gpg_error (GPG_ERR_BAD_MPI);
	else
	err = gcry_sexp_build (&s_data, NULL, "(enc-val(ecdh(s%m)(e%m)))",
	enc->data[1], enc->data[0]);
	}
	else
	err = gpg_error (GPG_ERR_BUG);

	if (err)
	goto leave;

	if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	fingerprint_from_pk (sk, fp, &fpn);
	log_assert (fpn == 20);
	}

	/* Decrypt. */
	desc = gpg_format_keydesc (sk, FORMAT_KEYDESC_NORMAL, 1);
	err = agent_pkdecrypt (NULL, keygrip,
	desc, sk->keyid, sk->main_keyid, sk->pubkey_algo,
	s_data, &frame, &nframe, &padding);
	xfree (desc);
	gcry_sexp_release (s_data);
	if (err)
	goto leave;

	/* Now get the DEK (data encryption key) from the frame
	*
	- * Old versions encode the DEK in in this format (msb is left):
	+ * Old versions encode the DEK in this format (msb is left):
	*
	* 0 1 DEK(16 bytes) CSUM(2 bytes) 0 RND(n bytes) 2
	*
	* Later versions encode the DEK like this:
	*
	* 0 2 RND(n bytes) 0 A DEK(k bytes) CSUM(2 bytes)
	*
	* (mpi_get_buffer already removed the leading zero).
	*
	* RND are non-zero randow bytes.
	* A is the cipher algorithm
	* DEK is the encryption key (session key) with length k
	* CSUM
	*/
	if (DBG_CRYPTO)
	log_printhex ("DEK frame:", frame, nframe);
	n = 0;

	if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	gcry_mpi_t shared_mpi;
	gcry_mpi_t decoded;

	/* At the beginning the frame are the bytes of shared point MPI. */
	err = gcry_mpi_scan (&shared_mpi, GCRYMPI_FMT_USG, frame, nframe, NULL);
	if (err)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	err = pk_ecdh_decrypt (&decoded, fp, enc->data[1]/encr data as an MPI/,
	shared_mpi, sk->pkey);
	mpi_release (shared_mpi);
	if(err)
	goto leave;

	xfree (frame);
	err = gcry_mpi_aprint (GCRYMPI_FMT_USG, &frame, &nframe, decoded);
	mpi_release (decoded);
	if (err)
	goto leave;

	/* Now the frame are the bytes decrypted but padded session key. */

	/* Allow double padding for the benefit of DEK size concealment.
	Higher than this is wasteful. */
	if (!nframe \|\| frame[nframe-1] > 8*2 \|\| nframe <= 8
	\|\| frame[nframe-1] > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	nframe -= frame[nframe-1]; /* Remove padding. */
	log_assert (!n); /* (used just below) */
	}
	else
	{
	if (padding)
	{
	if (n + 7 > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	if (frame[n] == 1 && frame[nframe - 1] == 2)
	{
	log_info (_("old encoding of the DEK is not supported\n"));
	err = gpg_error (GPG_ERR_CIPHER_ALGO);
	goto leave;
	}
	if (frame[n] != 2) /* Something went wrong. */
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	for (n++; n < nframe && frame[n]; n++) /* Skip the random bytes. */
	;
	n++; /* Skip the zero byte. */
	}
	}

	if (n + 4 > nframe)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	dek->keylen = nframe - (n + 1) - 2;
	dek->algo = frame[n++];
	err = openpgp_cipher_test_algo (dek->algo);
	if (err)
	{
	if (!opt.quiet && gpg_err_code (err) == GPG_ERR_CIPHER_ALGO)
	{
	log_info (_("cipher algorithm %d%s is unknown or disabled\n"),
	dek->algo,
	dek->algo == CIPHER_ALGO_IDEA ? " (IDEA)" : "");
	}
	dek->algo = 0;
	goto leave;
	}
	if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}

	/* Copy the key to DEK and compare the checksum. */
	csum = buf16_to_u16 (frame+nframe-2);
	memcpy (dek->key, frame + n, dek->keylen);
	for (csum2 = 0, n = 0; n < dek->keylen; n++)
	csum2 += dek->key[n];
	if (csum != csum2)
	{
	err = gpg_error (GPG_ERR_WRONG_SECKEY);
	goto leave;
	}
	if (DBG_CLOCK)
	log_clock ("decryption ready");
	if (DBG_CRYPTO)
	log_printhex ("DEK is:", dek->key, dek->keylen);

	/* Check that the algo is in the preferences and whether it has expired. */
	{
	PKT_public_key *pk = NULL;
	KBNODE pkb = get_pubkeyblock (keyid);

	if (!pkb)
	{
	err = -1;
	log_error ("oops: public key not found for preference check\n");
	}
	else if (pkb->pkt->pkt.public_key->selfsigversion > 3
	&& dek->algo != CIPHER_ALGO_3DES
	&& !opt.quiet
	&& !is_algo_in_prefs (pkb, PREFTYPE_SYM, dek->algo))
	log_info (_("WARNING: cipher algorithm %s not found in recipient"
	" preferences\n"), openpgp_cipher_algo_name (dek->algo));
	if (!err)
	{
	KBNODE k;

	for (k = pkb; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	u32 aki[2];
	keyid_from_pk (k->pkt->pkt.public_key, aki);

	if (aki[0] == keyid[0] && aki[1] == keyid[1])
	{
	pk = k->pkt->pkt.public_key;
	break;
	}
	}
	}
	if (!pk)
	BUG ();
	if (pk->expiredate && pk->expiredate <= make_timestamp ())
	{
	log_info (_("Note: secret key %s expired at %s\n"),
	keystr (keyid), asctimestamp (pk->expiredate));
	}
	}

	if (pk && pk->flags.revoked)
	{
	log_info (_("Note: key has been revoked"));
	log_printf ("\n");
	show_revocation_reason (pk, 1);
	}

	release_kbnode (pkb);
	err = 0;
	}

	leave:
	xfree (frame);
	xfree (keygrip);
	return err;
	}


	/*
	* Get the session key from the given string.
	* String is supposed to be formatted as this:
	* <algo-id>:<even-number-of-hex-digits>
	*/
	gpg_error_t
	get_override_session_key (DEK dek, const char string)
	{
	const char *s;
	int i;

	if (!string)
	return GPG_ERR_BAD_KEY;
	dek->algo = atoi (string);
	if (dek->algo < 1)
	return GPG_ERR_BAD_KEY;
	if (!(s = strchr (string, ':')))
	return GPG_ERR_BAD_KEY;
	s++;
	for (i = 0; i < DIM (dek->key) && *s; i++, s += 2)
	{
	int c = hextobyte (s);
	if (c == -1)
	return GPG_ERR_BAD_KEY;
	dek->key[i] = c;
	}
	if (*s)
	return GPG_ERR_BAD_KEY;
	dek->keylen = i;
	return 0;
	}
	diff --git a/g10/revoke.c b/g10/revoke.c
	index 591b641d3..3a2b068fc 100644
	--- a/g10/revoke.c
	+++ b/g10/revoke.c
	@@ -1,883 +1,883 @@
	/* revoke.c - Create recovation certificates.
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003,
	* 2004 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "status.h"
	#include "keydb.h"
	#include "util.h"
	#include "main.h"
	#include "ttyio.h"
	#include "status.h"
	#include "i18n.h"
	#include "call-agent.h"

	struct revocation_reason_info {
	int code;
	char *desc;
	};


	int
	revocation_reason_build_cb( PKT_signature sig, void opaque )
	{
	struct revocation_reason_info *reason = opaque;
	char *ud = NULL;
	byte *buffer;
	size_t buflen = 1;

	if(!reason)
	return 0;

	if( reason->desc ) {
	ud = native_to_utf8( reason->desc );
	buflen += strlen(ud);
	}
	buffer = xmalloc( buflen );
	*buffer = reason->code;
	if( ud ) {
	memcpy(buffer+1, ud, strlen(ud) );
	xfree( ud );
	}

	build_sig_subpkt( sig, SIGSUBPKT_REVOC_REASON, buffer, buflen );
	xfree( buffer );
	return 0;
	}

	/* Outputs a minimal pk (as defined by 2440) from a keyblock. A
	minimal pk consists of the public key packet and a user ID. We try
	and pick a user ID that has a uid signature, and include it if
	possible. */
	static int
	export_minimal_pk(IOBUF out,KBNODE keyblock,
	PKT_signature revsig,PKT_signature revkey)
	{
	KBNODE node;
	PACKET pkt;
	PKT_user_id *uid=NULL;
	PKT_signature *selfsig=NULL;
	u32 keyid[2];
	int rc;

	node=find_kbnode(keyblock,PKT_PUBLIC_KEY);
	if(!node)
	{
	log_error("key incomplete\n");
	return GPG_ERR_GENERAL;
	}

	keyid_from_pk(node->pkt->pkt.public_key,keyid);

	pkt=*node->pkt;
	rc=build_packet(out,&pkt);
	if(rc)
	{
	log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
	return rc;
	}

	init_packet(&pkt);
	pkt.pkttype=PKT_SIGNATURE;

	/* the revocation itself, if any. 2440 likes this to come first. */
	if(revsig)
	{
	pkt.pkt.signature=revsig;
	rc=build_packet(out,&pkt);
	if(rc)
	{
	log_error("build_packet failed: %s\n", gpg_strerror (rc) );
	return rc;
	}
	}

	/* If a revkey in a 1F sig is present, include it too */
	if(revkey)
	{
	pkt.pkt.signature=revkey;
	rc=build_packet(out,&pkt);
	if(rc)
	{
	log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
	return rc;
	}
	}

	while(!selfsig)
	{
	KBNODE signode;

	node=find_next_kbnode(node,PKT_USER_ID);
	if(!node)
	{
	/* We're out of user IDs - none were self-signed. */
	if(uid)
	break;
	else
	{
	log_error(_("key %s has no user IDs\n"),keystr(keyid));
	return GPG_ERR_GENERAL;
	}
	}

	if(node->pkt->pkt.user_id->attrib_data)
	continue;

	uid=node->pkt->pkt.user_id;
	signode=node;

	while((signode=find_next_kbnode(signode,PKT_SIGNATURE)))
	{
	if(keyid[0]==signode->pkt->pkt.signature->keyid[0] &&
	keyid[1]==signode->pkt->pkt.signature->keyid[1] &&
	IS_UID_SIG(signode->pkt->pkt.signature))
	{
	selfsig=signode->pkt->pkt.signature;
	break;
	}
	}
	}

	pkt.pkttype=PKT_USER_ID;
	pkt.pkt.user_id=uid;

	rc=build_packet(out,&pkt);
	if(rc)
	{
	log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
	return rc;
	}

	if(selfsig)
	{
	pkt.pkttype=PKT_SIGNATURE;
	pkt.pkt.signature=selfsig;

	rc=build_packet(out,&pkt);
	if(rc)
	{
	log_error(_("build_packet failed: %s\n"), gpg_strerror (rc) );
	return rc;
	}
	}

	return 0;
	}

	/****************
	* Generate a revocation certificate for UNAME via a designated revoker
	*/
	int
	gen_desig_revoke (ctrl_t ctrl, const char *uname, strlist_t locusr)
	{
	int rc = 0;
	armor_filter_context_t *afx;
	PKT_public_key *pk = NULL;
	PKT_public_key *pk2 = NULL;
	PKT_signature *sig = NULL;
	IOBUF out = NULL;
	struct revocation_reason_info *reason = NULL;
	KEYDB_HANDLE kdbhd;
	KEYDB_SEARCH_DESC desc;
	KBNODE keyblock=NULL,node;
	u32 keyid[2];
	int i,any=0;
	SK_LIST sk_list=NULL;

	if( opt.batch )
	{
	log_error(_("can't do this in batch mode\n"));
	return GPG_ERR_GENERAL;
	}

	afx = new_armor_context ();

	kdbhd = keydb_new ();
	if (!kdbhd)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	rc = classify_user_id (uname, &desc, 1);
	if (!rc)
	rc = keydb_search (kdbhd, &desc, 1, NULL);
	if (rc) {
	log_error (_("key \"%s\" not found: %s\n"),uname, gpg_strerror (rc));
	goto leave;
	}

	rc = keydb_get_keyblock (kdbhd, &keyblock );
	if( rc ) {
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
	goto leave;
	}

	/* To parse the revkeys */
	merge_keys_and_selfsig(keyblock);

	/* get the key from the keyblock */
	node = find_kbnode( keyblock, PKT_PUBLIC_KEY );
	if( !node )
	BUG ();

	pk=node->pkt->pkt.public_key;

	keyid_from_pk(pk,keyid);

	if(locusr)
	{
	rc = build_sk_list (ctrl, locusr, &sk_list, PUBKEY_USAGE_CERT);
	if(rc)
	goto leave;
	}

	/* Are we a designated revoker for this key? */

	if(!pk->revkey && pk->numrevkeys)
	BUG();

	for(i=0;i<pk->numrevkeys;i++)
	{
	SK_LIST list;

	free_public_key (pk2);
	pk2 = NULL;

	if(sk_list)
	{
	for(list=sk_list;list;list=list->next)
	{
	byte fpr[MAX_FINGERPRINT_LEN];
	size_t fprlen;

	fingerprint_from_pk (list->pk, fpr, &fprlen);

	/* Don't get involved with keys that don't have 160
	bit fingerprints */
	if(fprlen!=20)
	continue;

	if(memcmp(fpr,pk->revkey[i].fpr,20)==0)
	break;
	}

	if (list)
	pk2 = copy_public_key (NULL, list->pk);
	else
	continue;
	}
	else
	{
	pk2 = xmalloc_clear (sizeof *pk2);
	rc = get_pubkey_byfprint (pk2, NULL,
	pk->revkey[i].fpr, MAX_FINGERPRINT_LEN);
	}

	/* We have the revocation key. */
	if(!rc)
	{
	PKT_signature *revkey = NULL;

	any = 1;

	print_pubkey_info (NULL, pk);
	tty_printf ("\n");

	tty_printf (_("To be revoked by:\n"));
	print_seckey_info (pk2);

	if(pk->revkey[i].class&0x40)
	tty_printf(_("(This is a sensitive revocation key)\n"));
	tty_printf("\n");

	rc = agent_probe_secret_key (ctrl, pk2);
	if (rc)
	{
	tty_printf (_("Secret key is not available.\n"));
	continue;
	}

	if( !cpr_get_answer_is_yes("gen_desig_revoke.okay",
	_("Create a designated revocation certificate for this key? (y/N) ")))
	continue;

	/* get the reason for the revocation (this is always v4) */
	reason = ask_revocation_reason( 1, 0, 1 );
	if( !reason )
	continue;

	if( !opt.armor )
	tty_printf(_("ASCII armored output forced.\n"));

	if( (rc = open_outfile (-1, NULL, 0, 1, &out )) )
	goto leave;

	afx->what = 1;
	afx->hdrlines = "Comment: A designated revocation certificate"
	" should follow\n";
	push_armor_filter (afx, out);

	/* create it */
	rc = make_keysig_packet( &sig, pk, NULL, NULL, pk2, 0x20, 0,
	0, 0,
	revocation_reason_build_cb, reason,
	NULL);
	if( rc ) {
	log_error(_("make_keysig_packet failed: %s\n"), gpg_strerror (rc));
	goto leave;
	}

	/* Spit out a minimal pk as well, since otherwise there is
	no way to know which key to attach this revocation to.
	Also include the direct key signature that contains
	this revocation key. We're allowed to include
	sensitive revocation keys along with a revocation, as
	this may be the only time the recipient has seen it.
	Note that this means that if we have multiple different
	sensitive revocation keys in a given direct key
	signature, we're going to include them all here. This
	is annoying, but the good outweighs the bad, since
	without including this a sensitive revoker can't really
	do their job. People should not include multiple
	sensitive revocation keys in one signature: 2440 says
	"Note that it may be appropriate to isolate this
	subpacket within a separate signature so that it is not
	combined with other subpackets that need to be
	exported." -dms */

	while(!revkey)
	{
	KBNODE signode;

	signode=find_next_kbnode(node,PKT_SIGNATURE);
	if(!signode)
	break;

	node=signode;

	if(keyid[0]==signode->pkt->pkt.signature->keyid[0] &&
	keyid[1]==signode->pkt->pkt.signature->keyid[1] &&
	IS_KEY_SIG(signode->pkt->pkt.signature))
	{
	int j;

	for(j=0;j<signode->pkt->pkt.signature->numrevkeys;j++)
	{
	if(pk->revkey[i].class==
	signode->pkt->pkt.signature->revkey[j].class &&
	pk->revkey[i].algid==
	signode->pkt->pkt.signature->revkey[j].algid &&
	memcmp(pk->revkey[i].fpr,
	signode->pkt->pkt.signature->revkey[j].fpr,
	MAX_FINGERPRINT_LEN)==0)
	{
	revkey=signode->pkt->pkt.signature;
	break;
	}
	}
	}
	}

	if(!revkey)
	BUG();

	rc=export_minimal_pk(out,keyblock,sig,revkey);
	if(rc)
	goto leave;

	/* and issue a usage notice */
	tty_printf(_("Revocation certificate created.\n"));
	break;
	}
	}

	if(!any)
	log_error(_("no revocation keys found for \"%s\"\n"),uname);

	leave:
	free_public_key (pk);
	free_public_key (pk2);
	if( sig )
	free_seckey_enc( sig );

	release_sk_list(sk_list);

	if( rc )
	iobuf_cancel(out);
	else
	iobuf_close(out);
	release_revocation_reason_info( reason );
	release_armor_context (afx);
	return rc;
	}


	/* Common core to create the revocation. FILENAME may be NULL to write
	to stdout or the filename given by --output. REASON describes the
	revocation reason. PSK is the public primary key - we expect that
	a corresponding secret key is available. KEYBLOCK is the entire
	- KEYBLOCK which is used in PGP mode to write a a minimal key and not
	+ KEYBLOCK which is used in PGP mode to write a minimal key and not
	just the naked revocation signature; it may be NULL. If LEADINTEXT
	is not NULL, it is written right before the (armored) output.*/
	static int
	create_revocation (const char *filename,
	struct revocation_reason_info *reason,
	PKT_public_key *psk,
	kbnode_t keyblock,
	const char *leadintext, int suffix,
	const char *cache_nonce)
	{
	int rc;
	iobuf_t out = NULL;
	armor_filter_context_t *afx;
	PKT_signature *sig = NULL;
	PACKET pkt;

	afx = new_armor_context ();

	if ((rc = open_outfile (-1, filename, suffix, 1, &out)))
	goto leave;

	if (leadintext )
	iobuf_writestr (out, leadintext);

	afx->what = 1;
	afx->hdrlines = "Comment: This is a revocation certificate\n";
	push_armor_filter (afx, out);

	rc = make_keysig_packet (&sig, psk, NULL, NULL, psk, 0x20, 0,
	0, 0,
	revocation_reason_build_cb, reason, cache_nonce);
	if (rc)
	{
	log_error (_("make_keysig_packet failed: %s\n"), gpg_strerror (rc));
	goto leave;
	}

	if (keyblock && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	/* Use a minimal pk for PGPx mode, since PGP can't import bare
	revocation certificates. */
	rc = export_minimal_pk (out, keyblock, sig, NULL);
	if (rc)
	goto leave;
	}
	else
	{
	init_packet (&pkt);
	pkt.pkttype = PKT_SIGNATURE;
	pkt.pkt.signature = sig;

	rc = build_packet (out, &pkt);
	if (rc)
	{
	log_error (_("build_packet failed: %s\n"), gpg_strerror (rc));
	goto leave;
	}
	}

	leave:
	if (sig)
	free_seckey_enc (sig);
	if (rc)
	iobuf_cancel (out);
	else
	iobuf_close (out);
	release_armor_context (afx);
	return rc;
	}


	/* This function is used to generate a standard revocation certificate
	by gpg's interactive key generation function. The certificate is
	stored at a dedicated place in a slightly modified form to avoid an
	accidental import. PSK is the primary key; a corresponding secret
	key must be available. CACHE_NONCE is optional but can be used to
	help gpg-agent to avoid an extra passphrase prompt. */
	int
	gen_standard_revoke (PKT_public_key psk, const char cache_nonce)
	{
	int rc;
	estream_t memfp;
	struct revocation_reason_info reason;
	char dir, tmpstr, *fname;
	void *leadin;
	size_t len;
	u32 keyid[2];
	int kl;
	char *orig_codeset;

	dir = get_openpgp_revocdir (gnupg_homedir ());
	tmpstr = hexfingerprint (psk, NULL, 0);
	fname = xstrconcat (dir, DIRSEP_S, tmpstr, NULL);
	xfree (tmpstr);
	xfree (dir);

	keyid_from_pk (psk, keyid);

	memfp = es_fopenmem (0, "r+");
	if (!memfp)
	log_fatal ("error creating memory stream\n");

	orig_codeset = i18n_switchto_utf8 ();

	es_fprintf (memfp, "%s\n\n",
	_("This is a revocation certificate for the OpenPGP key:"));

	print_key_line (memfp, psk, 0);

	if (opt.keyid_format != KF_NONE)
	print_fingerprint (memfp, psk, 3);

	kl = opt.keyid_format == KF_NONE? 0 : keystrlen ();

	tmpstr = get_user_id (keyid, &len);
	es_fprintf (memfp, "uid%s%.s\n\n",
	kl + 10, "",
	(int)len, tmpstr);
	xfree (tmpstr);

	es_fprintf (memfp, "%s\n\n%s\n\n%s\n\n:",
	_("A revocation certificate is a kind of \"kill switch\" to publicly\n"
	"declare that a key shall not anymore be used. It is not possible\n"
	"to retract such a revocation certificate once it has been published."),
	_("Use it to revoke this key in case of a compromise or loss of\n"
	"the secret key. However, if the secret key is still accessible,\n"
	"it is better to generate a new revocation certificate and give\n"
	"a reason for the revocation. For details see the description of\n"
	"of the gpg command \"--generate-revocation\" in the "
	"GnuPG manual."),
	_("To avoid an accidental use of this file, a colon has been inserted\n"
	"before the 5 dashes below. Remove this colon with a text editor\n"
	"before importing and publishing this revocation certificate."));

	es_putc (0, memfp);

	i18n_switchback (orig_codeset);

	if (es_fclose_snatch (memfp, &leadin, NULL))
	log_fatal ("error snatching memory stream\n");

	reason.code = 0x00; /* No particular reason. */
	reason.desc = NULL;
	rc = create_revocation (fname, &reason, psk, NULL, leadin, 3, cache_nonce);
	if (!rc && !opt.quiet)
	log_info (_("revocation certificate stored as '%s.rev'\n"), fname);

	xfree (leadin);
	xfree (fname);

	return rc;
	}



	/****************
	* Generate a revocation certificate for UNAME
	*/
	int
	gen_revoke (const char *uname)
	{
	int rc = 0;
	PKT_public_key *psk;
	u32 keyid[2];
	kbnode_t keyblock = NULL;
	kbnode_t node;
	KEYDB_HANDLE kdbhd;
	struct revocation_reason_info *reason = NULL;
	KEYDB_SEARCH_DESC desc;

	if( opt.batch )
	{
	log_error(_("can't do this in batch mode\n"));
	return GPG_ERR_GENERAL;
	}

	/* Search the userid; we don't want the whole getkey stuff here. */
	kdbhd = keydb_new ();
	if (!kdbhd)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	rc = classify_user_id (uname, &desc, 1);
	if (!rc)
	rc = keydb_search (kdbhd, &desc, 1, NULL);
	if (rc)
	{
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	log_error (_("secret key \"%s\" not found\n"), uname);
	else
	log_error (_("secret key \"%s\" not found: %s\n"),
	uname, gpg_strerror (rc));
	goto leave;
	}

	rc = keydb_get_keyblock (kdbhd, &keyblock );
	if (rc)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (rc) );
	goto leave;
	}

	rc = keydb_search (kdbhd, &desc, 1, NULL);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	/* Not ambiguous. */
	{
	}
	else if (rc == 0)
	/* Ambiguous. */
	{
	char *info;

	/* TRANSLATORS: The %s prints a key specification which
	for example has been given at the command line. Several lines
	lines with secret key infos are printed after this message. */
	log_error (_("'%s' matches multiple secret keys:\n"), uname);

	info = format_seckey_info (keyblock->pkt->pkt.public_key);
	log_error (" %s\n", info);
	xfree (info);
	release_kbnode (keyblock);

	rc = keydb_get_keyblock (kdbhd, &keyblock);
	while (! rc)
	{
	info = format_seckey_info (keyblock->pkt->pkt.public_key);
	log_info (" %s\n", info);
	xfree (info);
	release_kbnode (keyblock);
	keyblock = NULL;

	rc = keydb_search (kdbhd, &desc, 1, NULL);
	if (! rc)
	rc = keydb_get_keyblock (kdbhd, &keyblock);
	}

	rc = GPG_ERR_AMBIGUOUS_NAME;

	goto leave;
	}
	else
	{
	log_error (_("error searching the keyring: %s\n"), gpg_strerror (rc));
	goto leave;
	}

	/* Get the keyid from the keyblock. */
	node = find_kbnode (keyblock, PKT_PUBLIC_KEY);
	if (!node)
	BUG ();

	psk = node->pkt->pkt.public_key;
	rc = agent_probe_secret_key (NULL, psk);
	if (rc)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	uname, gpg_strerror (rc));
	goto leave;
	}

	keyid_from_pk (psk, keyid );
	print_seckey_info (psk);

	tty_printf("\n");
	if (!cpr_get_answer_is_yes ("gen_revoke.okay",
	_("Create a revocation certificate for this key? (y/N) ")))
	{
	rc = 0;
	goto leave;
	}

	/* Get the reason for the revocation. */
	reason = ask_revocation_reason (1, 0, 1);
	if (!reason)
	{
	/* User decided to cancel. */
	rc = 0;
	goto leave;
	}

	if (!opt.armor)
	tty_printf (_("ASCII armored output forced.\n"));

	rc = create_revocation (NULL, reason, psk, keyblock, NULL, 0, NULL);
	if (rc)
	goto leave;

	/* and issue a usage notice */
	tty_printf (_(
	"Revocation certificate created.\n\n"
	"Please move it to a medium which you can hide away; if Mallory gets\n"
	"access to this certificate he can use it to make your key unusable.\n"
	"It is smart to print this certificate and store it away, just in case\n"
	"your media become unreadable. But have some caution: The print system of\n"
	"your machine might store the data and make it available to others!\n"));

	leave:
	release_kbnode (keyblock);
	keydb_release (kdbhd);
	release_revocation_reason_info( reason );
	return rc;
	}



	struct revocation_reason_info *
	ask_revocation_reason( int key_rev, int cert_rev, int hint )
	{
	int code=-1;
	char *description = NULL;
	struct revocation_reason_info *reason;
	const char *text_0 = _("No reason specified");
	const char *text_1 = _("Key has been compromised");
	const char *text_2 = _("Key is superseded");
	const char *text_3 = _("Key is no longer used");
	const char *text_4 = _("User ID is no longer valid");
	const char *code_text = NULL;

	do {
	code=-1;
	xfree(description);
	description = NULL;

	tty_printf(_("Please select the reason for the revocation:\n"));
	tty_printf( " 0 = %s\n", text_0 );
	if( key_rev )
	tty_printf(" 1 = %s\n", text_1 );
	if( key_rev )
	tty_printf(" 2 = %s\n", text_2 );
	if( key_rev )
	tty_printf(" 3 = %s\n", text_3 );
	if( cert_rev )
	tty_printf(" 4 = %s\n", text_4 );
	tty_printf( " Q = %s\n", _("Cancel") );
	if( hint )
	tty_printf(_("(Probably you want to select %d here)\n"), hint );

	while(code==-1) {
	int n;
	char *answer = cpr_get("ask_revocation_reason.code",
	_("Your decision? "));
	trim_spaces( answer );
	cpr_kill_prompt();
	if( answer == 'q' \|\| answer == 'Q')
	return NULL; /* cancel */
	if( hint && !*answer )
	n = hint;
	else if(!digitp( answer ) )
	n = -1;
	else
	n = atoi(answer);
	xfree(answer);
	if( n == 0 ) {
	code = 0x00; /* no particular reason */
	code_text = text_0;
	}
	else if( key_rev && n == 1 ) {
	code = 0x02; /* key has been compromised */
	code_text = text_1;
	}
	else if( key_rev && n == 2 ) {
	code = 0x01; /* key is superseded */
	code_text = text_2;
	}
	else if( key_rev && n == 3 ) {
	code = 0x03; /* key is no longer used */
	code_text = text_3;
	}
	else if( cert_rev && n == 4 ) {
	code = 0x20; /* uid is no longer valid */
	code_text = text_4;
	}
	else
	tty_printf(_("Invalid selection.\n"));
	}

	tty_printf(_("Enter an optional description; "
	"end it with an empty line:\n") );
	for(;;) {
	char *answer = cpr_get("ask_revocation_reason.text", "> " );
	trim_trailing_ws( answer, strlen(answer) );
	cpr_kill_prompt();
	if( !*answer ) {
	xfree(answer);
	break;
	}

	{
	char *p = make_printable_string( answer, strlen(answer), 0 );
	xfree(answer);
	answer = p;
	}

	if( !description )
	description = xstrdup(answer);
	else {
	char *p = xmalloc( strlen(description) + strlen(answer) + 2 );
	strcpy(stpcpy(stpcpy( p, description),"\n"),answer);
	xfree(description);
	description = p;
	}
	xfree(answer);
	}

	tty_printf(_("Reason for revocation: %s\n"), code_text );
	if( !description )
	tty_printf(_("(No description given)\n") );
	else
	tty_printf("%s\n", description );

	} while( !cpr_get_answer_is_yes("ask_revocation_reason.okay",
	_("Is this okay? (y/N) ")) );

	reason = xmalloc( sizeof *reason );
	reason->code = code;
	reason->desc = description;
	return reason;
	}

	struct revocation_reason_info *
	get_default_uid_revocation_reason(void)
	{
	struct revocation_reason_info *reason;
	reason = xmalloc( sizeof *reason );
	reason->code = 0x20; /* uid is no longer valid */
	reason->desc = strdup(""); /* no text */
	return reason;
	}

	void
	release_revocation_reason_info( struct revocation_reason_info *reason )
	{
	if( reason ) {
	xfree( reason->desc );
	xfree( reason );
	}
	}
	diff --git a/g10/rmd160.c b/g10/rmd160.c
	index 7c77ca591..cf2779641 100644
	--- a/g10/rmd160.c
	+++ b/g10/rmd160.c
	@@ -1,425 +1,425 @@
	/* rmd160.c - RIPE-MD160
	* Copyright (C) 1998, 1999, 2000, 2001, 2008 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	-/* For historic reasons gpg uses RIPE-MD160 to to identify names in
	+/* For historic reasons gpg uses RIPE-MD160 to identify names in
	the trustdb. It would be better to change that to SHA-1, to take
	advantage of a SHA-1 hardware operation provided by some CPUs.
	This would break trustdb compatibility and thus we don't want to do
	it now.

	We do not use the libgcrypt provided implementation of RMD160
	because that is not available in FIPS mode, thus for the sake of
	gpg internal non-cryptographic, purposes, we use this separate
	implementation.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "../common/types.h"
	#include "rmd160.h"

	/*
	* Rotate the 32 bit integer X by N bytes.
	*/
	#if defined(__GNUC__) && defined(__i386__)
	static inline u32
	rol (u32 x, int n)
	{
	__asm__("roll %%cl,%0"
	:"=r" (x)
	:"0" (x),"c" (n));
	return x;
	}
	#else
	#define rol(x,n) ( ((x) << (n)) \| ((x) >> (32-(n))) )
	#endif

	/* Structure holding the context for the RIPE-MD160 computation. */
	typedef struct
	{
	u32 h0, h1, h2, h3, h4;
	u32 nblocks;
	unsigned char buf[64];
	int count;
	} rmd160_context_t;



	static void
	rmd160_init (rmd160_context_t *hd)
	{
	hd->h0 = 0x67452301;
	hd->h1 = 0xEFCDAB89;
	hd->h2 = 0x98BADCFE;
	hd->h3 = 0x10325476;
	hd->h4 = 0xC3D2E1F0;
	hd->nblocks = 0;
	hd->count = 0;
	}



	/*
	* Transform the message X which consists of 16 32-bit-words.
	*/
	static void
	transform (rmd160_context_t hd, const unsigned char data)
	{
	u32 a,b,c,d,e,aa,bb,cc,dd,ee,t;
	#ifdef BIG_ENDIAN_HOST
	u32 x[16];
	{
	int i;
	unsigned char p2, p1;
	for (i=0, p1=data, p2=(unsigned char*)x; i < 16; i++, p2 += 4 )
	{
	p2[3] = *p1++;
	p2[2] = *p1++;
	p2[1] = *p1++;
	p2[0] = *p1++;
	}
	}
	#else
	u32 x[16];
	memcpy (x, data, 64);
	#endif


	#define K0 0x00000000
	#define K1 0x5A827999
	#define K2 0x6ED9EBA1
	#define K3 0x8F1BBCDC
	#define K4 0xA953FD4E
	#define KK0 0x50A28BE6
	#define KK1 0x5C4DD124
	#define KK2 0x6D703EF3
	#define KK3 0x7A6D76E9
	#define KK4 0x00000000
	#define F0(x,y,z) ( (x) ^ (y) ^ (z) )
	#define F1(x,y,z) ( ((x) & (y)) \| (~(x) & (z)) )
	#define F2(x,y,z) ( ((x) \| ~(y)) ^ (z) )
	#define F3(x,y,z) ( ((x) & (z)) \| ((y) & ~(z)) )
	#define F4(x,y,z) ( (x) ^ ((y) \| ~(z)) )
	#define R(a,b,c,d,e,f,k,r,s) do { t = a + f(b,c,d) + k + x[r]; \
	a = rol(t,s) + e; \
	c = rol(c,10); \
	} while(0)

	/* Left lane. */
	a = hd->h0;
	b = hd->h1;
	c = hd->h2;
	d = hd->h3;
	e = hd->h4;
	R( a, b, c, d, e, F0, K0, 0, 11 );
	R( e, a, b, c, d, F0, K0, 1, 14 );
	R( d, e, a, b, c, F0, K0, 2, 15 );
	R( c, d, e, a, b, F0, K0, 3, 12 );
	R( b, c, d, e, a, F0, K0, 4, 5 );
	R( a, b, c, d, e, F0, K0, 5, 8 );
	R( e, a, b, c, d, F0, K0, 6, 7 );
	R( d, e, a, b, c, F0, K0, 7, 9 );
	R( c, d, e, a, b, F0, K0, 8, 11 );
	R( b, c, d, e, a, F0, K0, 9, 13 );
	R( a, b, c, d, e, F0, K0, 10, 14 );
	R( e, a, b, c, d, F0, K0, 11, 15 );
	R( d, e, a, b, c, F0, K0, 12, 6 );
	R( c, d, e, a, b, F0, K0, 13, 7 );
	R( b, c, d, e, a, F0, K0, 14, 9 );
	R( a, b, c, d, e, F0, K0, 15, 8 );
	R( e, a, b, c, d, F1, K1, 7, 7 );
	R( d, e, a, b, c, F1, K1, 4, 6 );
	R( c, d, e, a, b, F1, K1, 13, 8 );
	R( b, c, d, e, a, F1, K1, 1, 13 );
	R( a, b, c, d, e, F1, K1, 10, 11 );
	R( e, a, b, c, d, F1, K1, 6, 9 );
	R( d, e, a, b, c, F1, K1, 15, 7 );
	R( c, d, e, a, b, F1, K1, 3, 15 );
	R( b, c, d, e, a, F1, K1, 12, 7 );
	R( a, b, c, d, e, F1, K1, 0, 12 );
	R( e, a, b, c, d, F1, K1, 9, 15 );
	R( d, e, a, b, c, F1, K1, 5, 9 );
	R( c, d, e, a, b, F1, K1, 2, 11 );
	R( b, c, d, e, a, F1, K1, 14, 7 );
	R( a, b, c, d, e, F1, K1, 11, 13 );
	R( e, a, b, c, d, F1, K1, 8, 12 );
	R( d, e, a, b, c, F2, K2, 3, 11 );
	R( c, d, e, a, b, F2, K2, 10, 13 );
	R( b, c, d, e, a, F2, K2, 14, 6 );
	R( a, b, c, d, e, F2, K2, 4, 7 );
	R( e, a, b, c, d, F2, K2, 9, 14 );
	R( d, e, a, b, c, F2, K2, 15, 9 );
	R( c, d, e, a, b, F2, K2, 8, 13 );
	R( b, c, d, e, a, F2, K2, 1, 15 );
	R( a, b, c, d, e, F2, K2, 2, 14 );
	R( e, a, b, c, d, F2, K2, 7, 8 );
	R( d, e, a, b, c, F2, K2, 0, 13 );
	R( c, d, e, a, b, F2, K2, 6, 6 );
	R( b, c, d, e, a, F2, K2, 13, 5 );
	R( a, b, c, d, e, F2, K2, 11, 12 );
	R( e, a, b, c, d, F2, K2, 5, 7 );
	R( d, e, a, b, c, F2, K2, 12, 5 );
	R( c, d, e, a, b, F3, K3, 1, 11 );
	R( b, c, d, e, a, F3, K3, 9, 12 );
	R( a, b, c, d, e, F3, K3, 11, 14 );
	R( e, a, b, c, d, F3, K3, 10, 15 );
	R( d, e, a, b, c, F3, K3, 0, 14 );
	R( c, d, e, a, b, F3, K3, 8, 15 );
	R( b, c, d, e, a, F3, K3, 12, 9 );
	R( a, b, c, d, e, F3, K3, 4, 8 );
	R( e, a, b, c, d, F3, K3, 13, 9 );
	R( d, e, a, b, c, F3, K3, 3, 14 );
	R( c, d, e, a, b, F3, K3, 7, 5 );
	R( b, c, d, e, a, F3, K3, 15, 6 );
	R( a, b, c, d, e, F3, K3, 14, 8 );
	R( e, a, b, c, d, F3, K3, 5, 6 );
	R( d, e, a, b, c, F3, K3, 6, 5 );
	R( c, d, e, a, b, F3, K3, 2, 12 );
	R( b, c, d, e, a, F4, K4, 4, 9 );
	R( a, b, c, d, e, F4, K4, 0, 15 );
	R( e, a, b, c, d, F4, K4, 5, 5 );
	R( d, e, a, b, c, F4, K4, 9, 11 );
	R( c, d, e, a, b, F4, K4, 7, 6 );
	R( b, c, d, e, a, F4, K4, 12, 8 );
	R( a, b, c, d, e, F4, K4, 2, 13 );
	R( e, a, b, c, d, F4, K4, 10, 12 );
	R( d, e, a, b, c, F4, K4, 14, 5 );
	R( c, d, e, a, b, F4, K4, 1, 12 );
	R( b, c, d, e, a, F4, K4, 3, 13 );
	R( a, b, c, d, e, F4, K4, 8, 14 );
	R( e, a, b, c, d, F4, K4, 11, 11 );
	R( d, e, a, b, c, F4, K4, 6, 8 );
	R( c, d, e, a, b, F4, K4, 15, 5 );
	R( b, c, d, e, a, F4, K4, 13, 6 );

	aa = a; bb = b; cc = c; dd = d; ee = e;

	/* Right lane. */
	a = hd->h0;
	b = hd->h1;
	c = hd->h2;
	d = hd->h3;
	e = hd->h4;
	R( a, b, c, d, e, F4, KK0, 5, 8);
	R( e, a, b, c, d, F4, KK0, 14, 9);
	R( d, e, a, b, c, F4, KK0, 7, 9);
	R( c, d, e, a, b, F4, KK0, 0, 11);
	R( b, c, d, e, a, F4, KK0, 9, 13);
	R( a, b, c, d, e, F4, KK0, 2, 15);
	R( e, a, b, c, d, F4, KK0, 11, 15);
	R( d, e, a, b, c, F4, KK0, 4, 5);
	R( c, d, e, a, b, F4, KK0, 13, 7);
	R( b, c, d, e, a, F4, KK0, 6, 7);
	R( a, b, c, d, e, F4, KK0, 15, 8);
	R( e, a, b, c, d, F4, KK0, 8, 11);
	R( d, e, a, b, c, F4, KK0, 1, 14);
	R( c, d, e, a, b, F4, KK0, 10, 14);
	R( b, c, d, e, a, F4, KK0, 3, 12);
	R( a, b, c, d, e, F4, KK0, 12, 6);
	R( e, a, b, c, d, F3, KK1, 6, 9);
	R( d, e, a, b, c, F3, KK1, 11, 13);
	R( c, d, e, a, b, F3, KK1, 3, 15);
	R( b, c, d, e, a, F3, KK1, 7, 7);
	R( a, b, c, d, e, F3, KK1, 0, 12);
	R( e, a, b, c, d, F3, KK1, 13, 8);
	R( d, e, a, b, c, F3, KK1, 5, 9);
	R( c, d, e, a, b, F3, KK1, 10, 11);
	R( b, c, d, e, a, F3, KK1, 14, 7);
	R( a, b, c, d, e, F3, KK1, 15, 7);
	R( e, a, b, c, d, F3, KK1, 8, 12);
	R( d, e, a, b, c, F3, KK1, 12, 7);
	R( c, d, e, a, b, F3, KK1, 4, 6);
	R( b, c, d, e, a, F3, KK1, 9, 15);
	R( a, b, c, d, e, F3, KK1, 1, 13);
	R( e, a, b, c, d, F3, KK1, 2, 11);
	R( d, e, a, b, c, F2, KK2, 15, 9);
	R( c, d, e, a, b, F2, KK2, 5, 7);
	R( b, c, d, e, a, F2, KK2, 1, 15);
	R( a, b, c, d, e, F2, KK2, 3, 11);
	R( e, a, b, c, d, F2, KK2, 7, 8);
	R( d, e, a, b, c, F2, KK2, 14, 6);
	R( c, d, e, a, b, F2, KK2, 6, 6);
	R( b, c, d, e, a, F2, KK2, 9, 14);
	R( a, b, c, d, e, F2, KK2, 11, 12);
	R( e, a, b, c, d, F2, KK2, 8, 13);
	R( d, e, a, b, c, F2, KK2, 12, 5);
	R( c, d, e, a, b, F2, KK2, 2, 14);
	R( b, c, d, e, a, F2, KK2, 10, 13);
	R( a, b, c, d, e, F2, KK2, 0, 13);
	R( e, a, b, c, d, F2, KK2, 4, 7);
	R( d, e, a, b, c, F2, KK2, 13, 5);
	R( c, d, e, a, b, F1, KK3, 8, 15);
	R( b, c, d, e, a, F1, KK3, 6, 5);
	R( a, b, c, d, e, F1, KK3, 4, 8);
	R( e, a, b, c, d, F1, KK3, 1, 11);
	R( d, e, a, b, c, F1, KK3, 3, 14);
	R( c, d, e, a, b, F1, KK3, 11, 14);
	R( b, c, d, e, a, F1, KK3, 15, 6);
	R( a, b, c, d, e, F1, KK3, 0, 14);
	R( e, a, b, c, d, F1, KK3, 5, 6);
	R( d, e, a, b, c, F1, KK3, 12, 9);
	R( c, d, e, a, b, F1, KK3, 2, 12);
	R( b, c, d, e, a, F1, KK3, 13, 9);
	R( a, b, c, d, e, F1, KK3, 9, 12);
	R( e, a, b, c, d, F1, KK3, 7, 5);
	R( d, e, a, b, c, F1, KK3, 10, 15);
	R( c, d, e, a, b, F1, KK3, 14, 8);
	R( b, c, d, e, a, F0, KK4, 12, 8);
	R( a, b, c, d, e, F0, KK4, 15, 5);
	R( e, a, b, c, d, F0, KK4, 10, 12);
	R( d, e, a, b, c, F0, KK4, 4, 9);
	R( c, d, e, a, b, F0, KK4, 1, 12);
	R( b, c, d, e, a, F0, KK4, 5, 5);
	R( a, b, c, d, e, F0, KK4, 8, 14);
	R( e, a, b, c, d, F0, KK4, 7, 6);
	R( d, e, a, b, c, F0, KK4, 6, 8);
	R( c, d, e, a, b, F0, KK4, 2, 13);
	R( b, c, d, e, a, F0, KK4, 13, 6);
	R( a, b, c, d, e, F0, KK4, 14, 5);
	R( e, a, b, c, d, F0, KK4, 0, 15);
	R( d, e, a, b, c, F0, KK4, 3, 13);
	R( c, d, e, a, b, F0, KK4, 9, 11);
	R( b, c, d, e, a, F0, KK4, 11, 11);


	t = hd->h1 + d + cc;
	hd->h1 = hd->h2 + e + dd;
	hd->h2 = hd->h3 + a + ee;
	hd->h3 = hd->h4 + b + aa;
	hd->h4 = hd->h0 + c + bb;
	hd->h0 = t;
	}


	/* Update the message digest with the content of (INBUF,INLEN). */
	static void
	rmd160_write (rmd160_context_t hd, const unsigned char inbuf, size_t inlen)
	{
	if( hd->count == 64 )
	{
	/* Flush the buffer. */
	transform (hd, hd->buf);
	hd->count = 0;
	hd->nblocks++;
	}
	if (!inbuf)
	return;

	if (hd->count)
	{
	for (; inlen && hd->count < 64; inlen--)
	hd->buf[hd->count++] = *inbuf++;
	rmd160_write (hd, NULL, 0);
	if (!inlen)
	return;
	}

	while (inlen >= 64)
	{
	transform (hd, inbuf);
	hd->count = 0;
	hd->nblocks++;
	inlen -= 64;
	inbuf += 64;
	}
	for (; inlen && hd->count < 64; inlen--)
	hd->buf[hd->count++] = *inbuf++;
	}


	/* Complete the message computation. */
	static void
	rmd160_final( rmd160_context_t *hd )
	{
	u32 t, msb, lsb;
	unsigned char *p;

	rmd160_write (hd, NULL, 0); /* Flush buffer. */

	t = hd->nblocks;
	/* Multiply by 64 to make a byte count. */
	lsb = t << 6;
	msb = t >> 26;
	/* Add the count. */
	t = lsb;
	if ((lsb += hd->count) < t)
	msb++;
	/* Multiply by 8 to make a bit count. */
	t = lsb;
	lsb <<= 3;
	msb <<= 3;
	msb \|= t >> 29;

	if (hd->count < 56)
	{
	/* Enough room. */
	hd->buf[hd->count++] = 0x80; /* Pad character. */
	while (hd->count < 56)
	hd->buf[hd->count++] = 0;
	}
	else
	{
	/* Need one extra block. */
	hd->buf[hd->count++] = 0x80; /* Pad character. */
	while (hd->count < 64)
	hd->buf[hd->count++] = 0;
	rmd160_write (hd, NULL, 0); /* Flush buffer. */
	memset (hd->buf, 0, 56); /* Fill next block with zeroes. */
	}
	/* Append the 64 bit count. */
	hd->buf[56] = lsb;
	hd->buf[57] = lsb >> 8;
	hd->buf[58] = lsb >> 16;
	hd->buf[59] = lsb >> 24;
	hd->buf[60] = msb;
	hd->buf[61] = msb >> 8;
	hd->buf[62] = msb >> 16;
	hd->buf[63] = msb >> 24;
	transform (hd, hd->buf);

	p = hd->buf;
	#define X(a) do { p++ = hd->h##a; p++ = hd->h##a >> 8; \
	p++ = hd->h##a >> 16; p++ = hd->h##a >> 24; } while(0)
	X(0);
	X(1);
	X(2);
	X(3);
	X(4);
	#undef X
	}


	/*
	* Compines function to put the hash value of the supplied BUFFER into
	* OUTBUF which must have a size of 20 bytes.
	*/
	void
	rmd160_hash_buffer (void outbuf, const void buffer, size_t length)
	{
	rmd160_context_t hd;

	rmd160_init (&hd);
	rmd160_write (&hd, buffer, length);
	rmd160_final (&hd);
	memcpy (outbuf, hd.buf, 20);
	}
	diff --git a/g10/tofu.c b/g10/tofu.c
	index 449e921b6..8c41ad701 100644
	--- a/g10/tofu.c
	+++ b/g10/tofu.c
	@@ -1,3978 +1,3978 @@
	/* tofu.c - TOFU trust model.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* TODO:

	- Format the fingerprints nicely when printing (similar to gpg
	--list-keys)
	*/

	#include <config.h>
	#include <stdio.h>
	#include <sys/stat.h>
	#include <stdarg.h>
	#include <sqlite3.h>
	#include <time.h>

	#include "gpg.h"
	#include "types.h"
	#include "logging.h"
	#include "stringhelp.h"
	#include "options.h"
	#include "mbox-util.h"
	#include "i18n.h"
	#include "ttyio.h"
	#include "trustdb.h"
	#include "mkdir_p.h"
	#include "gpgsql.h"
	#include "status.h"
	#include "sqrtu32.h"

	#include "tofu.h"


	#define CONTROL_L ('L' - 'A' + 1)

	/* Number of days with signed / ecnrypted messages required to
	* indicate that enough history is available for basic trust. */
	#define BASIC_TRUST_THRESHOLD 4
	/* Number of days with signed / encrypted messages required to
	* indicate that a lot of history is available. */
	#define FULL_TRUST_THRESHOLD 21


	/* A struct with data pertaining to the tofu DB. There is one such
	struct per session and it is cached in session's ctrl structure.
	To initialize this or get the current singleton, call opendbs().
	There is no need to explicitly release it; cleanup is done when the
	CTRL object is released. */
	struct tofu_dbs_s
	{
	sqlite3 *db;
	char *want_lock_file;
	time_t want_lock_file_ctime;

	struct
	{
	sqlite3_stmt *savepoint_batch;
	sqlite3_stmt *savepoint_batch_commit;

	sqlite3_stmt *record_binding_get_old_policy;
	sqlite3_stmt *record_binding_update;
	sqlite3_stmt *get_policy_select_policy_and_conflict;
	sqlite3_stmt *get_trust_bindings_with_this_email;
	sqlite3_stmt *get_trust_gather_other_user_ids;
	sqlite3_stmt *get_trust_gather_signature_stats;
	sqlite3_stmt *get_trust_gather_encryption_stats;
	sqlite3_stmt *register_already_seen;
	sqlite3_stmt *register_signature;
	sqlite3_stmt *register_encryption;
	} s;

	int in_batch_transaction;
	int in_transaction;
	time_t batch_update_started;
	};


	#define STRINGIFY(s) STRINGIFY2(s)
	#define STRINGIFY2(s) #s

	/* The grouping parameters when collecting signature statistics. */

	/* If a message is signed a couple of hours in the future, just assume
	some clock skew. */
	#define TIME_AGO_FUTURE_IGNORE (2 * 60 * 60)
	/* Days. */
	#define TIME_AGO_UNIT_SMALL (24 * 60 * 60)
	#define TIME_AGO_SMALL_THRESHOLD (7 * TIME_AGO_UNIT_SMALL)
	/* Months. */
	#define TIME_AGO_UNIT_MEDIUM (30 * 24 * 60 * 60)
	#define TIME_AGO_MEDIUM_THRESHOLD (2 * TIME_AGO_UNIT_MEDIUM)
	/* Years. */
	#define TIME_AGO_UNIT_LARGE (365 * 24 * 60 * 60)
	#define TIME_AGO_LARGE_THRESHOLD (2 * TIME_AGO_UNIT_LARGE)

	/* Local prototypes. */
	static gpg_error_t end_transaction (ctrl_t ctrl, int only_batch);
	static char email_from_user_id (const char user_id);
	static int show_statistics (tofu_dbs_t dbs,
	const char fingerprint, const char email,
	enum tofu_policy policy,
	estream_t outfp, int only_status_fd, time_t now);

	const char *
	tofu_policy_str (enum tofu_policy policy)
	{
	switch (policy)
	{
	case TOFU_POLICY_NONE: return "none";
	case TOFU_POLICY_AUTO: return "auto";
	case TOFU_POLICY_GOOD: return "good";
	case TOFU_POLICY_UNKNOWN: return "unknown";
	case TOFU_POLICY_BAD: return "bad";
	case TOFU_POLICY_ASK: return "ask";
	default: return "???";
	}
	}

	/* Convert a binding policy (e.g., TOFU_POLICY_BAD) to a trust level
	(e.g., TRUST_BAD) in light of the current configuration. */
	int
	tofu_policy_to_trust_level (enum tofu_policy policy)
	{
	if (policy == TOFU_POLICY_AUTO)
	/* If POLICY is AUTO, fallback to OPT.TOFU_DEFAULT_POLICY. */
	policy = opt.tofu_default_policy;

	switch (policy)
	{
	case TOFU_POLICY_AUTO:
	/* If POLICY and OPT.TOFU_DEFAULT_POLICY are both AUTO, default
	to marginal trust. */
	return TRUST_MARGINAL;
	case TOFU_POLICY_GOOD:
	return TRUST_FULLY;
	case TOFU_POLICY_UNKNOWN:
	return TRUST_UNKNOWN;
	case TOFU_POLICY_BAD:
	return TRUST_NEVER;
	case TOFU_POLICY_ASK:
	return TRUST_UNKNOWN;
	default:
	log_bug ("Bad value for trust policy: %d\n",
	opt.tofu_default_policy);
	return 0;
	}
	}



	/* Start a transaction on DB. If ONLY_BATCH is set, then this will
	start a batch transaction if we haven't started a batch transaction
	and one has been requested. */
	static gpg_error_t
	begin_transaction (ctrl_t ctrl, int only_batch)
	{
	tofu_dbs_t dbs = ctrl->tofu.dbs;
	int rc;
	char *err = NULL;

	log_assert (dbs);

	/* If we've been in batch update mode for a while (on average, more
	* than 500 ms), to prevent starving other gpg processes, we drop
	* and retake the batch lock.
	*
	* Note: gnupg_get_time has a one second resolution, if we wanted a
	* higher resolution, we could use npth_clock_gettime. */
	if (/* No real transactions. */
	dbs->in_transaction == 0
	/* There is an open batch transaction. */
	&& dbs->in_batch_transaction
	/* And some time has gone by since it was started. */
	&& dbs->batch_update_started != gnupg_get_time ())
	{
	struct stat statbuf;

	/* If we are in a batch update, then batch updates better have
	been enabled. */
	log_assert (ctrl->tofu.batch_updated_wanted);

	/* Check if another process wants to run. (We just ignore any
	* stat failure. A waiter might have to wait a bit longer, but
	* otherwise there should be no impact.) */
	if (stat (dbs->want_lock_file, &statbuf) == 0
	&& statbuf.st_ctime != dbs->want_lock_file_ctime)
	{
	end_transaction (ctrl, 2);

	/* Yield to allow another process a chance to run. Note:
	* testing suggests that anything less than a 100ms tends to
	* not result in the other process getting the lock. */
	gnupg_usleep (100000);
	}
	else
	dbs->batch_update_started = gnupg_get_time ();
	}

	if (/* We don't have an open batch transaction. */
	!dbs->in_batch_transaction
	&& (/* Batch mode is enabled or we are starting a new transaction. */
	ctrl->tofu.batch_updated_wanted \|\| dbs->in_transaction == 0))
	{
	struct stat statbuf;

	/* We are in batch mode, but we don't have an open batch
	* transaction. Since the batch save point must be the outer
	* save point, it must be taken before the inner save point. */
	log_assert (dbs->in_transaction == 0);

	rc = gpgsql_stepx (dbs->db, &dbs->s.savepoint_batch,
	NULL, NULL, &err,
	"begin immediate transaction;", GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error beginning transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return gpg_error (GPG_ERR_GENERAL);
	}

	dbs->in_batch_transaction = 1;
	dbs->batch_update_started = gnupg_get_time ();

	if (stat (dbs->want_lock_file, &statbuf) == 0)
	dbs->want_lock_file_ctime = statbuf.st_ctime;
	}

	if (only_batch)
	return 0;

	log_assert (dbs->in_transaction >= 0);
	dbs->in_transaction ++;

	rc = gpgsql_exec_printf (dbs->db, NULL, NULL, &err,
	"savepoint inner%d;",
	dbs->in_transaction);
	if (rc)
	{
	log_error (_("error beginning transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return gpg_error (GPG_ERR_GENERAL);
	}

	return 0;
	}


	/* Commit a transaction. If ONLY_BATCH is 1, then this only ends the
	* batch transaction if we have left batch mode. If ONLY_BATCH is 2,
	* this commits any open batch transaction even if we are still in
	* batch mode. */
	static gpg_error_t
	end_transaction (ctrl_t ctrl, int only_batch)
	{
	tofu_dbs_t dbs = ctrl->tofu.dbs;
	int rc;
	char *err = NULL;

	if (only_batch \|\| (! only_batch && dbs->in_transaction == 1))
	{
	if (!dbs)
	return 0; /* Shortcut to allow for easier cleanup code. */

	/* If we are releasing the batch transaction, then we better not
	be in a normal transaction. */
	if (only_batch)
	log_assert (dbs->in_transaction == 0);

	if (/* Batch mode disabled? */
	(!ctrl->tofu.batch_updated_wanted \|\| only_batch == 2)
	/* But, we still have an open batch transaction? */
	&& dbs->in_batch_transaction)
	{
	/* The batch transaction is still in open, but we've left
	* batch mode. */
	dbs->in_batch_transaction = 0;
	dbs->in_transaction = 0;

	rc = gpgsql_stepx (dbs->db, &dbs->s.savepoint_batch_commit,
	NULL, NULL, &err,
	"commit transaction;", GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error committing transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return gpg_error (GPG_ERR_GENERAL);
	}

	return 0;
	}

	if (only_batch)
	return 0;
	}

	log_assert (dbs);
	log_assert (dbs->in_transaction > 0);

	rc = gpgsql_exec_printf (dbs->db, NULL, NULL, &err,
	"release inner%d;", dbs->in_transaction);

	dbs->in_transaction --;

	if (rc)
	{
	log_error (_("error committing transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return gpg_error (GPG_ERR_GENERAL);
	}

	return 0;
	}


	static gpg_error_t
	rollback_transaction (ctrl_t ctrl)
	{
	tofu_dbs_t dbs = ctrl->tofu.dbs;
	int rc;
	char *err = NULL;

	log_assert (dbs);
	log_assert (dbs->in_transaction > 0);

	/* Be careful to not undo any progress made by closed transactions in
	batch mode. */
	rc = gpgsql_exec_printf (dbs->db, NULL, NULL, &err,
	"rollback to inner%d;",
	dbs->in_transaction);

	dbs->in_transaction --;

	if (rc)
	{
	log_error (_("error rolling back transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return gpg_error (GPG_ERR_GENERAL);
	}

	return 0;
	}

	void
	tofu_begin_batch_update (ctrl_t ctrl)
	{
	ctrl->tofu.batch_updated_wanted ++;
	}

	void
	tofu_end_batch_update (ctrl_t ctrl)
	{
	log_assert (ctrl->tofu.batch_updated_wanted > 0);
	ctrl->tofu.batch_updated_wanted --;
	end_transaction (ctrl, 1);
	}

	/* Suspend any extant batch transaction (it is safe to call this even
	no batch transaction has been started). Note: you cannot suspend a
	batch transaction if you are in a normal transaction. The batch
	transaction can be resumed explicitly by calling
	tofu_resume_batch_transaction or implicitly by starting a normal
	transaction. */
	static void
	tofu_suspend_batch_transaction (ctrl_t ctrl)
	{
	end_transaction (ctrl, 2);
	}

	/* Resume a batch transaction if there is no extant batch transaction
	and one has been requested using tofu_begin_batch_transaction. */
	static void
	tofu_resume_batch_transaction (ctrl_t ctrl)
	{
	begin_transaction (ctrl, 1);
	}



	/* Wrapper around strtol which prints a warning in case of a
	* conversion error. On success the converted value is stored at
	* R_VALUE and 0 is returned; on error FALLBACK is stored at R_VALUE
	* and an error code is returned. */
	static gpg_error_t
	string_to_long (long r_value, const char string, long fallback, int line)
	{
	gpg_error_t err;
	char *tail = NULL;

	gpg_err_set_errno (0);
	*r_value = strtol (string, &tail, 0);
	if (errno \|\| !(!strcmp (tail, ".0") \|\| !*tail))
	{
	err = errno? gpg_error_from_errno (errno) : gpg_error (GPG_ERR_BAD_DATA);
	log_debug ("%s:%d: strtol failed for TOFU DB data; returned string"
	" (string='%.10s%s'; tail='%.10s%s'): %s\n",
	__FILE__, line,
	string, string && strlen(string) > 10 ? "..." : "",
	tail, tail && strlen(tail) > 10 ? "..." : "",
	gpg_strerror (err));
	*r_value = fallback;
	}
	else
	err = 0;

	return err;
	}


	/* Wrapper around strtoul which prints a warning in case of a
	* conversion error. On success the converted value is stored at
	* R_VALUE and 0 is returned; on error FALLBACK is stored at R_VALUE
	* and an error code is returned. */
	static gpg_error_t
	string_to_ulong (unsigned long r_value, const char string,
	unsigned long fallback, int line)
	{
	gpg_error_t err;
	char *tail = NULL;

	gpg_err_set_errno (0);
	*r_value = strtoul (string, &tail, 0);
	if (errno \|\| !(!strcmp (tail, ".0") \|\| !*tail))
	{
	err = errno? gpg_error_from_errno (errno) : gpg_error (GPG_ERR_BAD_DATA);
	log_debug ("%s:%d: strtoul failed for TOFU DB data; returned string"
	" (string='%.10s%s'; tail='%.10s%s'): %s\n",
	__FILE__, line,
	string, string && strlen(string) > 10 ? "..." : "",
	tail, tail && strlen(tail) > 10 ? "..." : "",
	gpg_strerror (err));
	*r_value = fallback;
	}
	else
	err = 0;

	return err;
	}



	/* Collect results of a select count (*) ...; style query. Aborts if
	the argument is not a valid integer (or real of the form X.0). */
	static int
	get_single_unsigned_long_cb (void cookie, int argc, char *argv,
	char **azColName)
	{
	unsigned long int *count = cookie;

	(void) azColName;

	log_assert (argc == 1);

	if (string_to_ulong (count, argv[0], 0, __LINE__))
	return 1; /* Abort. */
	return 0;
	}

	static int
	get_single_unsigned_long_cb2 (void cookie, int argc, char *argv,
	char *azColName, sqlite3_stmt stmt)
	{
	(void) stmt;
	return get_single_unsigned_long_cb (cookie, argc, argv, azColName);
	}

	/* We expect a single integer column whose name is "version". COOKIE
	must point to an int. This function always aborts. On error or a
	if the version is bad, sets VERSION to -1. /
	static int
	version_check_cb (void cookie, int argc, char argv, char *azColName)
	{
	int *version = cookie;

	if (argc != 1 \|\| strcmp (azColName[0], "version") != 0)
	{
	*version = -1;
	return 1;
	}

	if (strcmp (argv[0], "1") == 0)
	*version = 1;
	else
	{
	log_error (_("unsupported TOFU database version: %s\n"), argv[0]);
	*version = -1;
	}

	/* Don't run again. */
	return 1;
	}

	static int
	check_utks (sqlite3 *db)
	{
	int rc;
	char *err = NULL;
	struct key_item *utks;
	struct key_item *ki;
	int utk_count;
	char *utks_string = NULL;
	char keyid_str[16+1];
	long utks_unchanged = 0;

	/* An early version of the v1 format did not include the list of
	* known ultimately trusted keys.
	*
	* This list is used to detect when the set of ultimately trusted
	* keys changes. We need to detect this to invalidate the effective
	* policy, which can change if an ultimately trusted key is added or
	* removed. */
	rc = sqlite3_exec (db,
	"create table if not exists ultimately_trusted_keys"
	" (keyid);\n",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error creating 'ultimately_trusted_keys' TOFU table: %s\n"),
	err);
	sqlite3_free (err);
	goto out;
	}


	utks = tdb_utks ();
	for (ki = utks, utk_count = 0; ki; ki = ki->next, utk_count ++)
	;

	if (utk_count)
	{
	/* Build a list of keyids of the form "XXX","YYY","ZZZ". */
	int len = (1 + 16 + 1 + 1) * utk_count;
	int o = 0;

	utks_string = xmalloc (len);
	*utks_string = 0;
	for (ki = utks, utk_count = 0; ki; ki = ki->next, utk_count ++)
	{
	utks_string[o ++] = '\'';
	format_keyid (ki->kid, KF_LONG,
	keyid_str, sizeof (keyid_str));
	memcpy (&utks_string[o], keyid_str, 16);
	o += 16;
	utks_string[o ++] = '\'';
	utks_string[o ++] = ',';
	}
	utks_string[o - 1] = 0;
	log_assert (o == len);
	}

	rc = gpgsql_exec_printf
	(db, get_single_unsigned_long_cb, &utks_unchanged, &err,
	"select"
	/* Removed UTKs? (Known UTKs in current UTKs.) */
	" ((select count(*) from ultimately_trusted_keys"
	" where (keyid in (%s))) == %d)"
	" and"
	/* New UTKs? */
	" ((select count(*) from ultimately_trusted_keys"
	" where keyid not in (%s)) == 0);",
	utks_string ? utks_string : "",
	utk_count,
	utks_string ? utks_string : "");
	xfree (utks_string);
	if (rc)
	{
	log_error (_("TOFU DB error"));
	print_further_info ("checking if ultimately trusted keys changed: %s",
	err);
	sqlite3_free (err);
	goto out;
	}

	if (utks_unchanged)
	goto out;

	if (DBG_TRUST)
	log_debug ("TOFU: ultimately trusted keys changed.\n");

	/* Given that the set of ultimately trusted keys
	* changed, clear any cached policies. */
	rc = gpgsql_exec_printf
	(db, NULL, NULL, &err,
	"update bindings set effective_policy = %d;",
	TOFU_POLICY_NONE);
	if (rc)
	{
	log_error (_("TOFU DB error"));
	print_further_info ("clearing cached policies: %s", err);
	sqlite3_free (err);
	goto out;
	}

	/* Now, update the UTK table. */
	rc = sqlite3_exec (db,
	"drop table ultimately_trusted_keys;",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("TOFU DB error"));
	print_further_info ("dropping ultimately_trusted_keys: %s", err);
	sqlite3_free (err);
	goto out;
	}

	rc = sqlite3_exec (db,
	"create table if not exists"
	" ultimately_trusted_keys (keyid);\n",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("TOFU DB error"));
	print_further_info ("creating ultimately_trusted_keys: %s", err);
	sqlite3_free (err);
	goto out;
	}

	for (ki = utks; ki; ki = ki->next)
	{
	format_keyid (ki->kid, KF_LONG,
	keyid_str, sizeof (keyid_str));
	rc = gpgsql_exec_printf
	(db, NULL, NULL, &err,
	"insert into ultimately_trusted_keys values ('%s');",
	keyid_str);
	if (rc)
	{
	log_error (_("TOFU DB error"));
	print_further_info ("updating ultimately_trusted_keys: %s",
	err);
	sqlite3_free (err);
	goto out;
	}
	}

	out:
	return rc;
	}

	/* If the DB is new, initialize it. Otherwise, check the DB's
	version.

	Return 0 if the database is okay and 1 otherwise. */
	static int
	initdb (sqlite3 *db)
	{
	char *err = NULL;
	int rc;
	unsigned long int count;
	int version = -1;

	rc = sqlite3_exec (db, "begin transaction;", NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error beginning transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return 1;
	}

	/* If the DB has no tables, then assume this is a new DB that needs
	to be initialized. */
	rc = sqlite3_exec (db,
	"select count(*) from sqlite_master where type='table';",
	get_single_unsigned_long_cb, &count, &err);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("query available tables");
	sqlite3_free (err);
	goto out;
	}
	else if (count != 0)
	/* Assume that the DB is already initialized. Make sure the
	version is okay. */
	{
	rc = sqlite3_exec (db, "select version from version;", version_check_cb,
	&version, &err);
	if (rc == SQLITE_ABORT && version == 1)
	/* Happy, happy, joy, joy. */
	{
	sqlite3_free (err);
	rc = 0;
	goto out;
	}
	else if (rc == SQLITE_ABORT && version == -1)
	/* Unsupported version. */
	{
	/* An error message was already displayed. */
	sqlite3_free (err);
	goto out;
	}
	else if (rc)
	/* Some error. */
	{
	log_error (_("error determining TOFU database's version: %s\n"), err);
	sqlite3_free (err);
	goto out;
	}
	else
	{
	/* Unexpected success. This can only happen if there are no
	rows. (select returned 0, but expected ABORT.) */
	log_error (_("error determining TOFU database's version: %s\n"),
	gpg_strerror (GPG_ERR_NO_DATA));
	rc = 1;
	goto out;
	}
	}

	/* Create the version table. */
	rc = sqlite3_exec (db,
	"create table version (version INTEGER);",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error initializing TOFU database: %s\n"), err);
	print_further_info ("create version");
	sqlite3_free (err);
	goto out;
	}

	/* Initialize the version table, which contains a single integer
	value. */
	rc = sqlite3_exec (db,
	"insert into version values (1);",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error initializing TOFU database: %s\n"), err);
	print_further_info ("insert version");
	sqlite3_free (err);
	goto out;
	}

	/* The list of <fingerprint, email> bindings and auxiliary data.
	*
	* OID is a unique ID identifying this binding (and used by the
	* signatures table, see below). Note: OIDs will never be
	* reused.
	*
	* FINGERPRINT: The key's fingerprint.
	*
	* EMAIL: The normalized email address.
	*
	* USER_ID: The unmodified user id from which EMAIL was extracted.
	*
	* TIME: The time this binding was first observed.
	*
	* POLICY: The trust policy (TOFU_POLICY_BAD, etc. as an integer).
	*
	* CONFLICT is either NULL or a fingerprint. Assume that we have
	* a binding <0xdeadbeef, foo@example.com> and then we observe
	* <0xbaddecaf, foo@example.com>. There two bindings conflict
	* (they have the same email address). When we observe the
	* latter binding, we warn the user about the conflict and ask
	* for a policy decision about the new binding. We also change
	* the old binding's policy to ask if it was auto. So that we
	* know why this occurred, we also set conflict to 0xbaddecaf.
	*/
	rc = gpgsql_exec_printf
	(db, NULL, NULL, &err,
	"create table bindings\n"
	" (oid INTEGER PRIMARY KEY AUTOINCREMENT,\n"
	" fingerprint TEXT, email TEXT, user_id TEXT, time INTEGER,\n"
	" policy INTEGER CHECK (policy in (%d, %d, %d, %d, %d)),\n"
	" conflict STRING,\n"
	" unique (fingerprint, email));\n"
	"create index bindings_fingerprint_email\n"
	" on bindings (fingerprint, email);\n"
	"create index bindings_email on bindings (email);\n",
	TOFU_POLICY_AUTO, TOFU_POLICY_GOOD, TOFU_POLICY_UNKNOWN,
	TOFU_POLICY_BAD, TOFU_POLICY_ASK);
	if (rc)
	{
	log_error (_("error initializing TOFU database: %s\n"), err);
	print_further_info ("create bindings");
	sqlite3_free (err);
	goto out;
	}

	/* The signatures that we have observed.
	*
	* BINDING refers to a record in the bindings table, which
	* describes the binding (i.e., this is a foreign key that
	* references bindings.oid).
	*
	* SIG_DIGEST is the digest stored in the signature.
	*
	* SIG_TIME is the timestamp stored in the signature.
	*
	* ORIGIN is a free-form string that describes who fed this
	* signature to GnuPG (e.g., email:claws).
	*
	* TIME is the time this signature was registered. */
	rc = sqlite3_exec (db,
	"create table signatures "
	" (binding INTEGER NOT NULL, sig_digest TEXT,"
	" origin TEXT, sig_time INTEGER, time INTEGER,"
	" primary key (binding, sig_digest, origin));",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error initializing TOFU database: %s\n"), err);
	print_further_info ("create signatures");
	sqlite3_free (err);
	goto out;
	}

	out:
	if (! rc)
	{
	/* Early version of the v1 format did not include the encryption
	table. Add it. */
	rc = sqlite3_exec (db,
	"create table if not exists encryptions"
	" (binding INTEGER NOT NULL,"
	" time INTEGER);"
	"create index if not exists encryptions_binding"
	" on encryptions (binding);\n",
	NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error creating 'encryptions' TOFU table: %s\n"),
	err);
	sqlite3_free (err);
	}
	}
	if (! rc)
	{
	/* The effective policy for a binding. If a key is ultimately
	* trusted, then the effective policy of all of its bindings is
	* good. Likewise if a key is signed by an ultimately trusted
	* key, etc. If the effective policy is NONE, then we need to
	* recompute the effective policy. Otherwise, the effective
	* policy is considered to be up to date, i.e., effective_policy
	* is a cache of the computed policy. */
	rc = gpgsql_exec_printf
	(db, NULL, NULL, &err,
	"alter table bindings"
	" add column effective_policy INTEGER"
	" DEFAULT %d"
	" CHECK (effective_policy in (%d, %d, %d, %d, %d, %d));",
	TOFU_POLICY_NONE,
	TOFU_POLICY_NONE, TOFU_POLICY_AUTO, TOFU_POLICY_GOOD,
	TOFU_POLICY_UNKNOWN, TOFU_POLICY_BAD, TOFU_POLICY_ASK);
	if (rc)
	{
	if (rc == SQLITE_ERROR)
	/* Almost certainly "duplicate column name", which we can
	* safely ignore. */
	rc = 0;
	else
	log_error (_("adding column effective_policy to bindings DB: %s\n"),
	err);
	sqlite3_free (err);
	}
	}

	if (! rc)
	rc = check_utks (db);

	if (rc)
	{
	rc = sqlite3_exec (db, "rollback;", NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error rolling back transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	}
	return 1;
	}
	else
	{
	rc = sqlite3_exec (db, "end transaction;", NULL, NULL, &err);
	if (rc)
	{
	log_error (_("error committing transaction on TOFU database: %s\n"),
	err);
	sqlite3_free (err);
	return 1;
	}
	return 0;
	}
	}

	static int
	busy_handler (void *cookie, int call_count)
	{
	ctrl_t ctrl = cookie;
	tofu_dbs_t dbs = ctrl->tofu.dbs;

	(void) call_count;

	/* Update the want-lock-file time stamp (specifically, the ctime) so
	* that the current owner knows that we (well, someone) want the
	* lock. */
	if (dbs)
	{
	/* Note: we don't fail if we can't create the lock file: this
	* process will have to wait a bit longer, but otherwise nothing
	* horrible should happen. */

	estream_t fp;

	fp = es_fopen (dbs->want_lock_file, "w");
	if (! fp)
	log_debug ("TOFU: Error opening '%s': %s\n",
	dbs->want_lock_file, strerror (errno));
	else
	es_fclose (fp);
	}

	/* Call again. */
	return 1;
	}

	/* Create a new DB handle. Returns NULL on error. */
	/* FIXME: Change to return an error code for better reporting by the
	caller. */
	static tofu_dbs_t
	opendbs (ctrl_t ctrl)
	{
	char *filename;
	sqlite3 *db;
	int rc;

	if (!ctrl->tofu.dbs)
	{
	filename = make_filename (gnupg_homedir (), "tofu.db", NULL);

	rc = sqlite3_open (filename, &db);
	if (rc)
	{
	log_error (_("error opening TOFU database '%s': %s\n"),
	filename, sqlite3_errmsg (db));
	/* Even if an error occurs, DB is guaranteed to be valid. */
	sqlite3_close (db);
	db = NULL;
	}

	/* If a DB is locked wait up to 5 seconds for the lock to be cleared
	before failing. */
	if (db)
	{
	sqlite3_busy_timeout (db, 5 * 1000);
	sqlite3_busy_handler (db, busy_handler, ctrl);
	}

	if (db && initdb (db))
	{
	sqlite3_close (db);
	db = NULL;
	}

	if (db)
	{
	ctrl->tofu.dbs = xmalloc_clear (sizeof *ctrl->tofu.dbs);
	ctrl->tofu.dbs->db = db;
	ctrl->tofu.dbs->want_lock_file = xasprintf ("%s-want-lock", filename);
	}

	xfree (filename);
	}
	else
	log_assert (ctrl->tofu.dbs->db);

	return ctrl->tofu.dbs;
	}


	/* Release all of the resources associated with the DB handle. */
	void
	tofu_closedbs (ctrl_t ctrl)
	{
	tofu_dbs_t dbs;
	sqlite3_stmt **statements;

	dbs = ctrl->tofu.dbs;
	if (!dbs)
	return; /* Not initialized. */

	log_assert (dbs->in_transaction == 0);

	end_transaction (ctrl, 2);

	/* Arghh, that is a surprising use of the struct. */
	for (statements = (void *) &dbs->s;
	(void ) statements < (void ) &(&dbs->s)[1];
	statements ++)
	sqlite3_finalize (*statements);

	sqlite3_close (dbs->db);
	xfree (dbs->want_lock_file);
	xfree (dbs);
	ctrl->tofu.dbs = NULL;
	}


	/* Collect results of a select min (foo) ...; style query. Aborts if
	the argument is not a valid integer (or real of the form X.0). */
	static int
	get_single_long_cb (void cookie, int argc, char argv, char *azColName)
	{
	long *count = cookie;

	(void) azColName;

	log_assert (argc == 1);

	if (string_to_long (count, argv[0], 0, __LINE__))
	return 1; /* Abort. */

	return 0;
	}

	static int
	get_single_long_cb2 (void cookie, int argc, char argv, char *azColName,
	sqlite3_stmt *stmt)
	{
	(void) stmt;
	return get_single_long_cb (cookie, argc, argv, azColName);
	}

	/* Record (or update) a trust policy about a (possibly new)
	binding.

	If SHOW_OLD is set, the binding's old policy is displayed. */
	static gpg_error_t
	record_binding (tofu_dbs_t dbs, const char fingerprint, const char email,
	const char *user_id,
	enum tofu_policy policy, enum tofu_policy effective_policy,
	const char *conflict, int set_conflict,
	int show_old, time_t now)
	{
	char *fingerprint_pp = format_hexfingerprint (fingerprint, NULL, 0);
	gpg_error_t rc;
	char *err = NULL;

	if (! (policy == TOFU_POLICY_AUTO
	\|\| policy == TOFU_POLICY_GOOD
	\|\| policy == TOFU_POLICY_UNKNOWN
	\|\| policy == TOFU_POLICY_BAD
	\|\| policy == TOFU_POLICY_ASK))
	log_bug ("%s: Bad value for policy (%d)!\n", __func__, policy);


	if (DBG_TRUST \|\| show_old)
	{
	/* Get the old policy. Since this is just for informational
	* purposes, there is no need to start a transaction or to die
	* if there is a failure. */

	/* policy_old needs to be a long and not an enum tofu_policy,
	because we pass it by reference to get_single_long_cb2, which
	expects a long. */
	long policy_old = TOFU_POLICY_NONE;

	rc = gpgsql_stepx
	(dbs->db, &dbs->s.record_binding_get_old_policy,
	get_single_long_cb2, &policy_old, &err,
	"select policy from bindings where fingerprint = ? and email = ?",
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_debug ("TOFU: Error reading from binding database"
	" (reading policy for <key: %s, user id: %s>): %s\n",
	fingerprint, email, err);
	sqlite3_free (err);
	}

	if (policy_old != TOFU_POLICY_NONE)
	(show_old ? log_info : log_debug)
	("Changing TOFU trust policy for binding"
	" <key: %s, user id: %s> from %s to %s.\n",
	fingerprint, show_old ? user_id : email,
	tofu_policy_str (policy_old),
	tofu_policy_str (policy));
	else
	(show_old ? log_info : log_debug)
	("Setting TOFU trust policy for new binding"
	" <key: %s, user id: %s> to %s.\n",
	fingerprint, show_old ? user_id : email,
	tofu_policy_str (policy));
	}

	if (opt.dry_run)
	{
	log_info ("TOFU database update skipped due to --dry-run\n");
	rc = 0;
	goto leave;
	}

	rc = gpgsql_stepx
	(dbs->db, &dbs->s.record_binding_update, NULL, NULL, &err,
	"insert or replace into bindings\n"
	" (oid, fingerprint, email, user_id, time,"
	" policy, conflict, effective_policy)\n"
	" values (\n"
	/* If we don't explicitly reuse the OID, then SQLite will
	* reallocate a new one. We just need to search for the OID
	* based on the fingerprint and email since they are unique. */
	" (select oid from bindings where fingerprint = ? and email = ?),\n"
	" ?, ?, ?, ?, ?,"
	/* If SET_CONFLICT is 0, then preserve conflict's current value. */
	" case ?"
	" when 0 then"
	" (select conflict from bindings where fingerprint = ? and email = ?)"
	" else ?"
	" end,"
	" ?);",
	/* oid subquery. */
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	/* values 2 through 6. */
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, user_id,
	GPGSQL_ARG_LONG_LONG, (long long) now,
	GPGSQL_ARG_INT, (int) policy,
	/* conflict subquery. */
	GPGSQL_ARG_INT, set_conflict ? 1 : 0,
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, conflict ? conflict : "",
	GPGSQL_ARG_INT, (int) effective_policy,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error updating TOFU database: %s\n"), err);
	print_further_info (" insert bindings <key: %s, user id: %s> = %s",
	fingerprint, email, tofu_policy_str (policy));
	sqlite3_free (err);
	goto leave;
	}

	leave:
	xfree (fingerprint_pp);
	return rc;
	}


	/* Collect the strings returned by a query in a simple string list.
	Any NULL values are converted to the empty string.

	If a result has 3 rows and each row contains two columns, then the
	results are added to the list as follows (the value is parentheses
	is the 1-based index in the final list):

	row 1, col 2 (6)
	row 1, col 1 (5)
	row 2, col 2 (4)
	row 2, col 1 (3)
	row 3, col 2 (2)
	row 3, col 1 (1)

	This is because add_to_strlist pushes the results onto the front of
	the list. The end result is that the rows are backwards, but the
	columns are in the expected order. */
	static int
	strings_collect_cb (void cookie, int argc, char argv, char *azColName)
	{
	int i;
	strlist_t *strlist = cookie;

	(void) azColName;

	for (i = argc - 1; i >= 0; i --)
	add_to_strlist (strlist, argv[i] ? argv[i] : "");

	return 0;
	}

	static int
	strings_collect_cb2 (void cookie, int argc, char argv, char *azColName,
	sqlite3_stmt *stmt)
	{
	(void) stmt;
	return strings_collect_cb (cookie, argc, argv, azColName);

	}

	/* Auxiliary data structure to collect statistics about
	signatures. */
	struct signature_stats
	{
	struct signature_stats *next;

	/* The user-assigned policy for this binding. */
	enum tofu_policy policy;

	/* How long ago the signature was created (rounded to a multiple of
	TIME_AGO_UNIT_SMALL, etc.). */
	long time_ago;
	/* Number of signatures during this time. */
	unsigned long count;

	/* If the corresponding key/user id has been expired / revoked. */
	int is_expired;
	int is_revoked;

	/* The key that generated this signature. */
	char fingerprint[1];
	};

	static void
	signature_stats_free (struct signature_stats *stats)
	{
	while (stats)
	{
	struct signature_stats *next = stats->next;
	xfree (stats);
	stats = next;
	}
	}

	static void
	signature_stats_prepend (struct signature_stats **statsp,
	const char *fingerprint,
	enum tofu_policy policy,
	long time_ago,
	unsigned long count)
	{
	struct signature_stats *stats =
	xmalloc_clear (sizeof (*stats) + strlen (fingerprint));

	stats->next = *statsp;
	*statsp = stats;

	strcpy (stats->fingerprint, fingerprint);
	stats->policy = policy;
	stats->time_ago = time_ago;
	stats->count = count;
	}


	/* Process rows that contain the four columns:

	<fingerprint, policy, time ago, count>. */
	static int
	signature_stats_collect_cb (void cookie, int argc, char *argv,
	char *azColName, sqlite3_stmt stmt)
	{
	struct signature_stats **statsp = cookie;
	int i = 0;
	enum tofu_policy policy;
	long time_ago;
	unsigned long count;
	long along;

	(void) azColName;
	(void) stmt;

	i ++;

	if (string_to_long (&along, argv[i], 0, __LINE__))
	return 1; /* Abort */
	policy = along;
	i ++;

	if (! argv[i])
	time_ago = 0;
	else
	{
	if (string_to_long (&time_ago, argv[i], 0, __LINE__))
	return 1; /* Abort. */
	}
	i ++;

	/* If time_ago is NULL, then we had no messages, but we still have a
	single row, which count() turns into 1. /
	if (! argv[i - 1])
	count = 0;
	else
	{
	if (string_to_ulong (&count, argv[i], 0, __LINE__))
	return 1; /* Abort */
	}
	i ++;

	log_assert (argc == i);

	signature_stats_prepend (statsp, argv[0], policy, time_ago, count);

	return 0;
	}

	/* Format the first part of a conflict message and return that as a
	* malloced string. */
	static char *
	format_conflict_msg_part1 (int policy, strlist_t conflict_set,
	const char *email)
	{
	estream_t fp;
	char *fingerprint;
	char tmpstr, text;

	log_assert (conflict_set);
	fingerprint = conflict_set->d;

	fp = es_fopenmem (0, "rw,samethread");
	if (!fp)
	log_fatal ("error creating memory stream: %s\n",
	gpg_strerror (gpg_error_from_syserror()));

	if (policy == TOFU_POLICY_NONE)
	{
	es_fprintf (fp,
	_("This is the first time the email address \"%s\" is "
	"being used with key %s."),
	email, fingerprint);
	es_fputs (" ", fp);
	}
	else if (policy == TOFU_POLICY_ASK && conflict_set->next)
	{
	int conflicts = strlist_length (conflict_set);
	es_fprintf
	(fp, ngettext("The email address \"%s\" is associated with %d key!",
	"The email address \"%s\" is associated with %d keys!",
	conflicts),
	email, conflicts);
	if (opt.verbose)
	es_fprintf (fp,
	_(" Since this binding's policy was 'auto', it has been "
	"changed to 'ask'."));
	es_fputs (" ", fp);
	}

	es_fprintf (fp,
	_("Please indicate whether this email address should"
	" be associated with key %s or whether you think someone"
	" is impersonating \"%s\"."),
	fingerprint, email);
	es_fputc ('\n', fp);

	es_fputc (0, fp);
	if (es_fclose_snatch (fp, (void **)&tmpstr, NULL))
	log_fatal ("error snatching memory stream\n");
	text = format_text (tmpstr, 0, 72, 80);
	es_free (tmpstr);

	return text;
	}


	/* Return 1 if A signed B and B signed A. */
	static int
	cross_sigs (const char *email, kbnode_t a, kbnode_t b)
	{
	int i;

	PKT_public_key *a_pk = a->pkt->pkt.public_key;
	PKT_public_key *b_pk = b->pkt->pkt.public_key;

	char a_keyid[33];
	char b_keyid[33];

	if (DBG_TRUST)
	{
	format_keyid (pk_main_keyid (a_pk),
	KF_LONG, a_keyid, sizeof (a_keyid));
	format_keyid (pk_main_keyid (b_pk),
	KF_LONG, b_keyid, sizeof (b_keyid));
	}

	for (i = 0; i < 2; i ++)
	{
	/* See if SIGNER signed SIGNEE. */

	kbnode_t signer = i == 0 ? a : b;
	kbnode_t signee = i == 0 ? b : a;

	PKT_public_key *signer_pk = signer->pkt->pkt.public_key;
	u32 *signer_kid = pk_main_keyid (signer_pk);
	kbnode_t n;

	int saw_email = 0;

	/* Iterate over SIGNEE's keyblock and see if there is a valid
	signature from SIGNER. */
	for (n = signee; n; n = n->next)
	{
	PKT_signature *sig;

	if (n->pkt->pkttype == PKT_USER_ID)
	{
	if (saw_email)
	/* We're done: we've processed all signatures on the
	user id. */
	break;
	else
	{
	/* See if this is the matching user id. */
	PKT_user_id *user_id = n->pkt->pkt.user_id;
	char *email2 = email_from_user_id (user_id->name);

	if (strcmp (email, email2) == 0)
	saw_email = 1;

	xfree (email2);
	}
	}

	if (! saw_email)
	continue;

	if (n->pkt->pkttype != PKT_SIGNATURE)
	continue;

	sig = n->pkt->pkt.signature;

	if (! (sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13))
	/* Not a signature over a user id. */
	continue;

	/* SIG is on SIGNEE's keyblock. If SIG was generated by the
	signer, then it's a match. */
	if (keyid_cmp (sig->keyid, signer_kid) == 0)
	/* Match! */
	break;
	}
	if (! n)
	/* We didn't find a signature from signer over signee. */
	{
	if (DBG_TRUST)
	log_debug ("No cross sig between %s and %s\n",
	a_keyid, b_keyid);
	return 0;
	}
	}

	/* A signed B and B signed A. */
	if (DBG_TRUST)
	log_debug ("Cross sig between %s and %s\n",
	a_keyid, b_keyid);

	return 1;
	}

	/* Return whether the key was signed by an ultimately trusted key. */
	static int
	signed_by_utk (const char *email, kbnode_t a)
	{
	kbnode_t n;
	int saw_email = 0;

	for (n = a; n; n = n->next)
	{
	PKT_signature *sig;

	if (n->pkt->pkttype == PKT_USER_ID)
	{
	if (saw_email)
	/* We're done: we've processed all signatures on the
	user id. */
	break;
	else
	{
	/* See if this is the matching user id. */
	PKT_user_id *user_id = n->pkt->pkt.user_id;
	char *email2 = email_from_user_id (user_id->name);

	if (strcmp (email, email2) == 0)
	saw_email = 1;

	xfree (email2);
	}
	}

	if (! saw_email)
	continue;

	if (n->pkt->pkttype != PKT_SIGNATURE)
	continue;

	sig = n->pkt->pkt.signature;

	if (! (sig->sig_class == 0x10
	\|\| sig->sig_class == 0x11
	\|\| sig->sig_class == 0x12
	\|\| sig->sig_class == 0x13))
	/* Not a signature over a user id. */
	continue;

	/* SIG is on SIGNEE's keyblock. If SIG was generated by the
	signer, then it's a match. */
	if (tdb_keyid_is_utk (sig->keyid))
	{
	/* Match! */
	if (DBG_TRUST)
	log_debug ("TOFU: %s is signed by an ultimately trusted key.\n",
	pk_keyid_str (a->pkt->pkt.public_key));

	return 1;
	}
	}

	if (DBG_TRUST)
	log_debug ("TOFU: %s is NOT signed by an ultimately trusted key.\n",
	pk_keyid_str (a->pkt->pkt.public_key));

	return 0;
	}


	enum
	{
	BINDING_NEW = 1 << 0,
	BINDING_CONFLICT = 1 << 1,
	BINDING_EXPIRED = 1 << 2,
	BINDING_REVOKED = 1 << 3
	};


	/* Ask the user about the binding. There are three ways we could end
	* up here:
	*
	* - This is a new binding and there is a conflict
	* (policy == TOFU_POLICY_NONE && conflict_set_count > 1),
	*
	* - This is a new binding and opt.tofu_default_policy is set to
	* ask. (policy == TOFU_POLICY_NONE && opt.tofu_default_policy ==
	* TOFU_POLICY_ASK), or,
	*
	* - The policy is ask (the user deferred last time) (policy ==
	* TOFU_POLICY_ASK).
	*
	* Note: this function must not be called while in a transaction!
	*
	* CONFLICT_SET includes all of the conflicting bindings
	* with FINGERPRINT first. FLAGS is a bit-wise or of
	* BINDING_NEW, etc.
	*/
	static void
	ask_about_binding (ctrl_t ctrl,
	enum tofu_policy *policy,
	int *trust_level,
	strlist_t conflict_set,
	const char *fingerprint,
	const char *email,
	const char *user_id,
	time_t now)
	{
	tofu_dbs_t dbs;
	strlist_t iter;
	int conflict_set_count = strlist_length (conflict_set);
	char *sqerr = NULL;
	int rc;
	estream_t fp;
	strlist_t other_user_ids = NULL;
	struct signature_stats *stats = NULL;
	struct signature_stats *stats_iter = NULL;
	char *prompt = NULL;
	char *choices;

	dbs = ctrl->tofu.dbs;
	log_assert (dbs);
	log_assert (dbs->in_transaction == 0);

	fp = es_fopenmem (0, "rw,samethread");
	if (!fp)
	log_fatal ("error creating memory stream: %s\n",
	gpg_strerror (gpg_error_from_syserror()));

	{
	char text = format_conflict_msg_part1 (policy, conflict_set, email);
	es_fputs (text, fp);
	es_fputc ('\n', fp);
	xfree (text);
	}

	begin_transaction (ctrl, 0);

	/* Find other user ids associated with this key and whether the
	* bindings are marked as good or bad. */
	rc = gpgsql_stepx
	(dbs->db, &dbs->s.get_trust_gather_other_user_ids,
	strings_collect_cb2, &other_user_ids, &sqerr,
	"select user_id, policy from bindings where fingerprint = ?;",
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error gathering other user IDs: %s\n"), sqerr);
	sqlite3_free (sqerr);
	sqerr = NULL;
	rc = gpg_error (GPG_ERR_GENERAL);
	}

	if (other_user_ids)
	{
	strlist_t strlist_iter;

	es_fprintf (fp, _("This key's user IDs:\n"));
	for (strlist_iter = other_user_ids;
	strlist_iter;
	strlist_iter = strlist_iter->next)
	{
	char *other_user_id = strlist_iter->d;
	char *other_thing;
	enum tofu_policy other_policy;

	log_assert (strlist_iter->next);
	strlist_iter = strlist_iter->next;
	other_thing = strlist_iter->d;

	other_policy = atoi (other_thing);

	es_fprintf (fp, " %s (", other_user_id);
	es_fprintf (fp, _("policy: %s"), tofu_policy_str (other_policy));
	es_fprintf (fp, ")\n");
	}
	es_fprintf (fp, "\n");

	free_strlist (other_user_ids);
	}

	/* Get the stats for all the keys in CONFLICT_SET. */
	strlist_rev (&conflict_set);
	for (iter = conflict_set; iter && ! rc; iter = iter->next)
	{
	#define STATS_SQL(table, time, sign) \
	"select fingerprint, policy, time_ago, count(*)\n" \
	" from\n" \
	" (select bindings.*,\n" \
	" "sign" case\n" \
	" when delta ISNULL then 1\n" \
	/* From the future (but if its just a couple of hours in the \
	* future don't turn it into a warning)? Or should we use \
	* small, medium or large units? (Note: whatever we do, we \
	* keep the value in seconds. Then when we group, everything \
	* that rounds to the same number of seconds is grouped.) */ \
	" when delta < -("STRINGIFY (TIME_AGO_FUTURE_IGNORE)") then 2\n" \
	" when delta < ("STRINGIFY (TIME_AGO_SMALL_THRESHOLD)")\n" \
	" then 3\n" \
	" when delta < ("STRINGIFY (TIME_AGO_MEDIUM_THRESHOLD)")\n" \
	" then 4\n" \
	" when delta < ("STRINGIFY (TIME_AGO_LARGE_THRESHOLD)")\n" \
	" then 5\n" \
	" else 6\n" \
	" end time_ago,\n" \
	" delta time_ago_raw\n" \
	" from bindings\n" \
	" left join\n" \
	" (select *,\n" \
	" cast(? - " time " as real) delta\n" \
	" from " table ") ss\n" \
	" on ss.binding = bindings.oid)\n" \
	" where email = ? and fingerprint = ?\n" \
	" group by time_ago\n" \
	/* Make sure the current key is first. */ \
	" order by time_ago desc;\n"

	/* Use the time when we saw the signature, not when the
	signature was created as that can be forged. */
	rc = gpgsql_stepx
	(dbs->db, &dbs->s.get_trust_gather_signature_stats,
	signature_stats_collect_cb, &stats, &sqerr,
	STATS_SQL ("signatures", "time", ""),
	GPGSQL_ARG_LONG_LONG, (long long) now,
	GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, iter->d,
	GPGSQL_ARG_END);
	if (rc)
	{
	rc = gpg_error (GPG_ERR_GENERAL);
	break;
	}

	if (!stats \|\| strcmp (iter->d, stats->fingerprint) != 0)
	/* No stats for this binding. Add a dummy entry. */
	signature_stats_prepend (&stats, iter->d, TOFU_POLICY_AUTO, 1, 1);

	rc = gpgsql_stepx
	(dbs->db, &dbs->s.get_trust_gather_encryption_stats,
	signature_stats_collect_cb, &stats, &sqerr,
	STATS_SQL ("encryptions", "time", "-"),
	GPGSQL_ARG_LONG_LONG, (long long) now,
	GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, iter->d,
	GPGSQL_ARG_END);
	if (rc)
	{
	rc = gpg_error (GPG_ERR_GENERAL);
	break;
	}

	#undef STATS_SQL

	if (!stats \|\| strcmp (iter->d, stats->fingerprint) != 0
	\|\| stats->time_ago > 0)
	/* No stats for this binding. Add a dummy entry. */
	signature_stats_prepend (&stats, iter->d, TOFU_POLICY_AUTO, -1, 1);
	}
	end_transaction (ctrl, 0);
	strlist_rev (&conflict_set);
	if (rc)
	{
	strlist_t strlist_iter;

	log_error (_("error gathering signature stats: %s\n"), sqerr);
	sqlite3_free (sqerr);
	sqerr = NULL;

	es_fprintf (fp, ngettext("The email address \"%s\" is"
	" associated with %d key:\n",
	"The email address \"%s\" is"
	" associated with %d keys:\n",
	conflict_set_count),
	email, conflict_set_count);
	for (strlist_iter = conflict_set;
	strlist_iter;
	strlist_iter = strlist_iter->next)
	es_fprintf (fp, " %s\n", strlist_iter->d);
	}
	else
	{
	char *key = NULL;
	strlist_t binding;
	int seen_in_past = 0;
	int encrypted = 1;

	es_fprintf (fp, _("Statistics for keys"
	" with the email address \"%s\":\n"),
	email);
	for (stats_iter = stats; stats_iter; stats_iter = stats_iter->next)
	{
	#if 0
	log_debug ("%s: time_ago: %ld; count: %ld\n",
	stats_iter->fingerprint,
	stats_iter->time_ago,
	stats_iter->count);
	#endif

	if (stats_iter->time_ago > 0 && encrypted)
	{
	/* We've change from the encrypted stats to the verified
	* stats. Reset SEEN_IN_PAST. */
	encrypted = 0;
	seen_in_past = 0;
	}

	if (! key \|\| strcmp (key, stats_iter->fingerprint))
	{
	int this_key;
	char *key_pp;

	key = stats_iter->fingerprint;
	this_key = strcmp (key, fingerprint) == 0;
	key_pp = format_hexfingerprint (key, NULL, 0);
	es_fprintf (fp, " %s (", key_pp);

	/* Find the associated binding. */
	for (binding = conflict_set;
	binding;
	binding = binding->next)
	if (strcmp (key, binding->d) == 0)
	break;
	log_assert (binding);

	if ((binding->flags & BINDING_REVOKED))
	{
	es_fprintf (fp, _("revoked"));
	es_fprintf (fp, _(", "));
	}
	else if ((binding->flags & BINDING_EXPIRED))
	{
	es_fprintf (fp, _("expired"));
	es_fprintf (fp, _(", "));
	}

	if (this_key)
	es_fprintf (fp, _("this key"));
	else
	es_fprintf (fp, _("policy: %s"),
	tofu_policy_str (stats_iter->policy));
	es_fputs ("):\n", fp);
	xfree (key_pp);

	seen_in_past = 0;

	show_statistics (dbs, stats_iter->fingerprint, email,
	TOFU_POLICY_ASK, NULL, 1, now);
	}

	if (labs(stats_iter->time_ago) == 1)
	{
	/* The 1 in this case is the NULL entry. */
	log_assert (stats_iter->count == 1);
	stats_iter->count = 0;
	}
	seen_in_past += stats_iter->count;

	es_fputs (" ", fp);

	if (!stats_iter->count)
	{
	if (stats_iter->time_ago > 0)
	es_fprintf (fp, ngettext("Verified %d message.",
	"Verified %d messages.",
	seen_in_past), seen_in_past);
	else
	es_fprintf (fp, ngettext("Encrypted %d message.",
	"Encrypted %d messages.",
	seen_in_past), seen_in_past);
	}
	else if (labs(stats_iter->time_ago) == 2)
	{
	if (stats_iter->time_ago > 0)
	es_fprintf (fp, ngettext("Verified %d message in the future.",
	"Verified %d messages in the future.",
	seen_in_past), seen_in_past);
	else
	es_fprintf (fp, ngettext("Encrypted %d message in the future.",
	"Encrypted %d messages in the future.",
	seen_in_past), seen_in_past);
	/* Reset it. */
	seen_in_past = 0;
	}
	else
	{
	if (labs(stats_iter->time_ago) == 3)
	{
	int days = 1 + stats_iter->time_ago / TIME_AGO_UNIT_SMALL;
	if (stats_iter->time_ago > 0)
	es_fprintf
	(fp,
	ngettext("Messages verified over the past %d day: %d.",
	"Messages verified over the past %d days: %d.",
	days), days, seen_in_past);
	else
	es_fprintf
	(fp,
	ngettext("Messages encrypted over the past %d day: %d.",
	"Messages encrypted over the past %d days: %d.",
	days), days, seen_in_past);
	}
	else if (labs(stats_iter->time_ago) == 4)
	{
	int months = 1 + stats_iter->time_ago / TIME_AGO_UNIT_MEDIUM;
	if (stats_iter->time_ago > 0)
	es_fprintf
	(fp,
	ngettext("Messages verified over the past %d month: %d.",
	"Messages verified over the past %d months: %d.",
	months), months, seen_in_past);
	else
	es_fprintf
	(fp,
	ngettext("Messages encrypted over the past %d month: %d.",
	"Messages encrypted over the past %d months: %d.",
	months), months, seen_in_past);
	}
	else if (labs(stats_iter->time_ago) == 5)
	{
	int years = 1 + stats_iter->time_ago / TIME_AGO_UNIT_LARGE;
	if (stats_iter->time_ago > 0)
	es_fprintf
	(fp,
	ngettext("Messages verified over the past %d year: %d.",
	"Messages verified over the past %d years: %d.",
	years), years, seen_in_past);
	else
	es_fprintf
	(fp,
	ngettext("Messages encrypted over the past %d year: %d.",
	"Messages encrypted over the past %d years: %d.",
	years), years, seen_in_past);
	}
	else if (labs(stats_iter->time_ago) == 6)
	{
	if (stats_iter->time_ago > 0)
	es_fprintf
	(fp, _("Messages verified in the past: %d."),
	seen_in_past);
	else
	es_fprintf
	(fp, _("Messages encrypted in the past: %d."),
	seen_in_past);
	}
	else
	log_assert (! "Broken SQL.\n");
	}
	es_fputs ("\n", fp);
	}
	}

	if (conflict_set_count > 1 \|\| (conflict_set->flags & BINDING_CONFLICT))
	{
	/* This is a conflict. */

	/* TRANSLATORS: Please translate the text found in the source
	* file below. We don't directly internationalize that text so
	* that we can tweak it without breaking translations. */
	char *text = _("TOFU detected a binding conflict");
	char *textbuf;
	if (!strcmp (text, "TOFU detected a binding conflict"))
	{
	/* No translation. Use the English text. */
	text =
	"Normally, an email address is associated with a single key. "
	"However, people sometimes generate a new key if "
	"their key is too old or they think it might be compromised. "
	"Alternatively, a new key may indicate a man-in-the-middle "
	"attack! Before accepting this association, you should talk to or "
	"call the person to make sure this new key is legitimate.";
	}
	textbuf = format_text (text, 0, 72, 80);
	es_fprintf (fp, "\n%s\n", textbuf);
	xfree (textbuf);
	}

	es_fputc ('\n', fp);

	/* Add a NUL terminator. */
	es_fputc (0, fp);
	if (es_fclose_snatch (fp, (void **) &prompt, NULL))
	log_fatal ("error snatching memory stream\n");

	/* I think showing the large message once is sufficient. If we
	* would move it right before the cpr_get many lines will scroll
	* away and the user might not realize that he merely entered a
	* wrong choise (because he does not see that either). As a small
	* benefit we allow C-L to redisplay everything. */
	tty_printf ("%s", prompt);

	/* Suspend any transaction: it could take a while until the user
	responds. */
	tofu_suspend_batch_transaction (ctrl);
	while (1)
	{
	char *response;

	/* TRANSLATORS: Two letters (normally the lower and upper case
	* version of the hotkey) for each of the five choices. If
	* there is only one choice in your language, repeat it. */
	choices = _("gG" "aA" "uU" "rR" "bB");
	if (strlen (choices) != 10)
	log_bug ("Bad TOFU conflict translation! Please report.");

	response = cpr_get
	("tofu.conflict",
	_("(G)ood, (A)ccept once, (U)nknown, (R)eject once, (B)ad? "));
	trim_spaces (response);
	cpr_kill_prompt ();
	if (*response == CONTROL_L)
	tty_printf ("%s", prompt);
	else if (!response[0])
	/* Default to unknown. Don't save it. */
	{
	tty_printf (_("Defaulting to unknown.\n"));
	*policy = TOFU_POLICY_UNKNOWN;
	break;
	}
	else if (!response[1])
	{
	char choice = strchr (choices, response);

	if (choice)
	{
	int c = ((size_t) choice - (size_t) choices) / 2;

	switch (c)
	{
	case 0: /* Good. */
	*policy = TOFU_POLICY_GOOD;
	trust_level = tofu_policy_to_trust_level (policy);
	break;
	case 1: /* Accept once. */
	*policy = TOFU_POLICY_ASK;
	*trust_level = tofu_policy_to_trust_level (TOFU_POLICY_GOOD);
	break;
	case 2: /* Unknown. */
	*policy = TOFU_POLICY_UNKNOWN;
	trust_level = tofu_policy_to_trust_level (policy);
	break;
	case 3: /* Reject once. */
	*policy = TOFU_POLICY_ASK;
	*trust_level = tofu_policy_to_trust_level (TOFU_POLICY_BAD);
	break;
	case 4: /* Bad. */
	*policy = TOFU_POLICY_BAD;
	trust_level = tofu_policy_to_trust_level (policy);
	break;
	default:
	log_bug ("c should be between 0 and 4 but it is %d!", c);
	}

	if (record_binding (dbs, fingerprint, email, user_id,
	*policy, TOFU_POLICY_NONE, NULL, 0, 0, now))
	{
	/* If there's an error registering the
	* binding, don't save the signature. */
	*trust_level = _tofu_GET_TRUST_ERROR;
	}
	break;
	}
	}
	xfree (response);
	}

	tofu_resume_batch_transaction (ctrl);

	xfree (prompt);

	signature_stats_free (stats);
	}

	/* Return the set of keys that conflict with the binding <fingerprint,
	email> (including the binding itself, which will be first in the
	list). For each returned key also sets BINDING_NEW, etc. */
	static strlist_t
	build_conflict_set (tofu_dbs_t dbs,
	PKT_public_key pk, const char fingerprint,
	const char *email)
	{
	gpg_error_t rc;
	char *sqerr;
	strlist_t conflict_set = NULL;
	int conflict_set_count;
	strlist_t iter;
	kbnode_t *kb_all;
	KEYDB_HANDLE hd;
	int i;

	/* Get the fingerprints of any bindings that share the email address
	* and whether the bindings have a known conflict.
	*
	* Note: if the binding in question is in the DB, it will also be
	* returned. Thus, if the result set is empty, then <email,
	* fingerprint> is a new binding. */
	rc = gpgsql_stepx
	(dbs->db, &dbs->s.get_trust_bindings_with_this_email,
	strings_collect_cb2, &conflict_set, &sqerr,
	"select"
	/* A binding should only appear once, but try not to break in the
	* case of corruption. */
	" fingerprint \|\| case sum(conflict NOTNULL) when 0 then '' else '!' end"
	" from bindings where email = ?"
	" group by fingerprint"
	/* Make sure the current key comes first in the result list (if
	it is present). */
	" order by fingerprint = ? asc, fingerprint desc;",
	GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, fingerprint,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), sqerr);
	print_further_info ("listing fingerprints");
	sqlite3_free (sqerr);
	rc = gpg_error (GPG_ERR_GENERAL);
	return NULL;
	}

	/* Set BINDING_CONFLICT if the binding has a known conflict. This
	* allows us to distinguish between bindings where the user
	* explicitly set the policy to ask and bindings where we set the
	* policy to ask due to a conflict. */
	for (iter = conflict_set; iter; iter = iter->next)
	{
	int l = strlen (iter->d);
	if (!(l == 2 * MAX_FINGERPRINT_LEN
	\|\| l == 2 * MAX_FINGERPRINT_LEN + 1))
	{
	log_error (_("TOFU db corruption detected.\n"));
	print_further_info ("fingerprint '%s' is not %d characters long",
	iter->d, 2 * MAX_FINGERPRINT_LEN);
	}

	if (l >= 1 && iter->d[l - 1] == '!')
	{
	iter->flags \|= BINDING_CONFLICT;
	/* Remove the !. */
	iter->d[l - 1] = 0;
	}
	}

	/* If the current binding has not yet been recorded, add it to the
	* list. (The order by above ensures that if it is present, it will
	* be first.) */
	if (! (conflict_set && strcmp (conflict_set->d, fingerprint) == 0))
	{
	add_to_strlist (&conflict_set, fingerprint);
	conflict_set->flags \|= BINDING_NEW;
	}

	conflict_set_count = strlist_length (conflict_set);

	/* Eliminate false conflicts. */

	if (conflict_set_count == 1)
	/* We only have a single key. There are no false conflicts to
	eliminate. But, we do need to set the flags. */
	{
	if (pk->has_expired)
	conflict_set->flags \|= BINDING_EXPIRED;
	if (pk->flags.revoked)
	conflict_set->flags \|= BINDING_REVOKED;

	return conflict_set;
	}

	/* If two keys have cross signatures, then they are controlled by
	* the same person and thus are not in conflict. */
	kb_all = xcalloc (sizeof (kb_all[0]), conflict_set_count);
	hd = keydb_new ();
	for (i = 0, iter = conflict_set;
	i < conflict_set_count;
	i ++, iter = iter->next)
	{
	char *fp = iter->d;
	KEYDB_SEARCH_DESC desc;
	kbnode_t kb;
	PKT_public_key *binding_pk;
	kbnode_t n;
	int found_user_id;

	rc = keydb_search_reset (hd);
	if (rc)
	{
	log_error (_("resetting keydb: %s\n"),
	gpg_strerror (rc));
	continue;
	}

	rc = classify_user_id (fp, &desc, 0);
	if (rc)
	{
	log_error (_("error parsing key specification '%s': %s\n"),
	fp, gpg_strerror (rc));
	continue;
	}

	rc = keydb_search (hd, &desc, 1, NULL);
	if (rc)
	{
	/* Note: it is entirely possible that we don't have the key
	corresponding to an entry in the TOFU DB. This can
	happen if we merge two TOFU DBs, but not the key
	rings. */
	log_info (_("key \"%s\" not found: %s\n"),
	fp, gpg_strerror (rc));
	continue;
	}

	rc = keydb_get_keyblock (hd, &kb);
	if (rc)
	{
	log_error (_("error reading keyblock: %s\n"),
	gpg_strerror (rc));
	print_further_info ("fingerprint: %s", fp);
	continue;
	}

	merge_keys_and_selfsig (kb);

	log_assert (kb->pkt->pkttype == PKT_PUBLIC_KEY);

	kb_all[i] = kb;

	/* Since we have the key block, use this opportunity to figure
	* out if the binding is expired or revoked. */
	binding_pk = kb->pkt->pkt.public_key;

	/* The binding is always expired/revoked if the key is
	* expired/revoked. */
	if (binding_pk->has_expired)
	iter->flags \|= BINDING_EXPIRED;
	if (binding_pk->flags.revoked)
	iter->flags \|= BINDING_REVOKED;

	/* The binding is also expired/revoked if the user id is
	* expired/revoked. */
	n = kb;
	found_user_id = 0;
	while ((n = find_next_kbnode (n, PKT_USER_ID)) && ! found_user_id)
	{
	PKT_user_id *user_id2 = n->pkt->pkt.user_id;
	char *email2;

	if (user_id2->attrib_data)
	continue;

	email2 = email_from_user_id (user_id2->name);

	if (strcmp (email, email2) == 0)
	{
	found_user_id = 1;

	if (user_id2->is_revoked)
	iter->flags \|= BINDING_REVOKED;
	if (user_id2->is_expired)
	iter->flags \|= BINDING_EXPIRED;
	}

	xfree (email2);
	}

	if (! found_user_id)
	{
	log_info (_("TOFU db corruption detected.\n"));
	print_further_info ("user id '%s' not on key block '%s'",
	email, fingerprint);
	}
	}
	keydb_release (hd);

	/* Now that we have the key blocks, check for cross sigs. */
	{
	int j;
	strlist_t *prevp;
	strlist_t iter_next;
	int *die;

	log_assert (conflict_set_count > 0);
	die = xtrycalloc (conflict_set_count, sizeof *die);
	if (!die)
	{
	/err = gpg_error_from_syserror ();/
	xoutofcore (); /* Fixme: Let the fucntion return an error. */
	}

	for (i = 0; i < conflict_set_count; i ++)
	{
	/* Look for cross sigs between this key (i == 0) or a key
	* that has cross sigs with i == 0 (i.e., transitively) */
	if (! (i == 0 \|\| die[i]))
	continue;

	for (j = i + 1; j < conflict_set_count; j ++)
	/* Be careful: we might not have a key block for a key. */
	if (kb_all[i] && kb_all[j] && cross_sigs (email, kb_all[i], kb_all[j]))
	die[j] = 1;
	}

	/* Free unconflicting bindings (and all of the key blocks). */
	for (iter = conflict_set, prevp = &conflict_set, i = 0;
	iter;
	iter = iter_next, i ++)
	{
	iter_next = iter->next;

	release_kbnode (kb_all[i]);

	if (die[i])
	{
	*prevp = iter_next;
	iter->next = NULL;
	free_strlist (iter);
	conflict_set_count --;
	}
	else
	{
	prevp = &iter->next;
	}
	}

	/* We shouldn't have removed the head. */
	log_assert (conflict_set);
	log_assert (conflict_set_count >= 1);
	xfree (die);
	}
	xfree (kb_all);

	if (DBG_TRUST)
	{
	log_debug ("binding <key: %s, email: %s> conflicts:\n",
	fingerprint, email);
	for (iter = conflict_set; iter; iter = iter->next)
	{
	log_debug (" %s:%s%s%s%s\n",
	iter->d,
	(iter->flags & BINDING_NEW) ? " new" : "",
	(iter->flags & BINDING_CONFLICT) ? " known_conflict" : "",
	(iter->flags & BINDING_EXPIRED) ? " expired" : "",
	(iter->flags & BINDING_REVOKED) ? " revoked" : "");
	}
	}

	return conflict_set;
	}


	/* Return the effective policy for the binding <FINGERPRINT, EMAIL>
	* (email has already been normalized) and any conflict information in
	* *CONFLICT_SETP, if CONFLICT_SETP is not NULL. Returns
	* _tofu_GET_POLICY_ERROR if an error occurs.
	*
	* This function registers the binding in the bindings table if it has
	* not yet been registered.
	*/
	static enum tofu_policy
	get_policy (tofu_dbs_t dbs, PKT_public_key *pk,
	const char fingerprint, const char user_id, const char *email,
	strlist_t *conflict_setp, time_t now)
	{
	int rc;
	char *err = NULL;
	strlist_t results = NULL;
	enum tofu_policy policy = _tofu_GET_POLICY_ERROR;
	enum tofu_policy effective_policy_orig = TOFU_POLICY_NONE;
	enum tofu_policy effective_policy = _tofu_GET_POLICY_ERROR;
	long along;
	char *conflict_orig = NULL;
	char *conflict = NULL;
	strlist_t conflict_set = NULL;
	int conflict_set_count;

	/* Check if the <FINGERPRINT, EMAIL> binding is known
	(TOFU_POLICY_NONE cannot appear in the DB. Thus, if POLICY is
	still TOFU_POLICY_NONE after executing the query, then the
	result set was empty.) */
	rc = gpgsql_stepx (dbs->db, &dbs->s.get_policy_select_policy_and_conflict,
	strings_collect_cb2, &results, &err,
	"select policy, conflict, effective_policy from bindings\n"
	" where fingerprint = ? and email = ?",
	GPGSQL_ARG_STRING, fingerprint,
	GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("reading the policy");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto out;
	}

	if (strlist_length (results) == 0)
	{
	/* No results. Use the defaults. */
	policy = TOFU_POLICY_NONE;
	effective_policy = TOFU_POLICY_NONE;
	}
	else if (strlist_length (results) == 3)
	{
	/* Parse and sanity check the results. */

	if (string_to_long (&along, results->d, 0, __LINE__))
	{
	log_error (_("error reading TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_BAD_DATA));
	print_further_info ("bad value for policy: %s", results->d);
	goto out;
	}
	policy = along;

	if (! (policy == TOFU_POLICY_AUTO
	\|\| policy == TOFU_POLICY_GOOD
	\|\| policy == TOFU_POLICY_UNKNOWN
	\|\| policy == TOFU_POLICY_BAD
	\|\| policy == TOFU_POLICY_ASK))
	{
	log_error (_("error reading TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_DB_CORRUPTED));
	print_further_info ("invalid value for policy (%d)", policy);
	effective_policy = _tofu_GET_POLICY_ERROR;
	goto out;
	}

	if (*results->next->d)
	conflict = xstrdup (results->next->d);

	if (string_to_long (&along, results->next->next->d, 0, __LINE__))
	{
	log_error (_("error reading TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_BAD_DATA));
	print_further_info ("bad value for effective policy: %s",
	results->next->next->d);
	goto out;
	}
	effective_policy = along;

	if (! (effective_policy == TOFU_POLICY_NONE
	\|\| effective_policy == TOFU_POLICY_AUTO
	\|\| effective_policy == TOFU_POLICY_GOOD
	\|\| effective_policy == TOFU_POLICY_UNKNOWN
	\|\| effective_policy == TOFU_POLICY_BAD
	\|\| effective_policy == TOFU_POLICY_ASK))
	{
	log_error (_("error reading TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_DB_CORRUPTED));
	print_further_info ("invalid value for effective_policy (%d)",
	effective_policy);
	effective_policy = _tofu_GET_POLICY_ERROR;
	goto out;
	}
	}
	else
	{
	/* The result has the wrong form. */

	log_error (_("error reading TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_BAD_DATA));
	print_further_info ("reading policy: expected 3 columns, got %d\n",
	strlist_length (results));
	goto out;
	}

	/* Save the effective policy and conflict so we know if we changed
	* them. */
	effective_policy_orig = effective_policy;
	conflict_orig = conflict;

	/* Unless there is a conflict, if the effective policy is cached,
	* just return it. The reason we don't do this when there is a
	* conflict is because of the following scenario: assume A and B
	* conflict and B has signed A's key. Now, later we import A's
	* signature on B. We need to recheck A, but the signature was on
	* B, i.e., when B changes, we invalidate B's effective policy, but
	* we also need to invalidate A's effective policy. Instead, we
	* assume that conflicts are rare and don't optimize for them, which
	* would complicate the code. */
	if (effective_policy != TOFU_POLICY_NONE && !conflict)
	goto out;

	/* If the user explicitly set the policy, then respect that. */
	if (policy != TOFU_POLICY_AUTO && policy != TOFU_POLICY_NONE)
	{
	effective_policy = policy;
	goto out;
	}

	/* Unless proven wrong, assume the effective policy is 'auto'. */
	effective_policy = TOFU_POLICY_AUTO;

	/* See if the key is ultimately trusted. */
	{
	u32 kid[2];

	keyid_from_pk (pk, kid);
	if (tdb_keyid_is_utk (kid))
	{
	effective_policy = TOFU_POLICY_GOOD;
	goto out;
	}
	}

	/* See if the key is signed by an ultimately trusted key. */
	{
	int fingerprint_raw_len = strlen (fingerprint) / 2;
	char fingerprint_raw[20];
	int len = 0;

	if (fingerprint_raw_len != sizeof fingerprint_raw
	\|\| ((len = hex2bin (fingerprint,
	fingerprint_raw, fingerprint_raw_len))
	!= strlen (fingerprint)))
	{
	if (DBG_TRUST)
	log_debug ("TOFU: Bad fingerprint: %s (len: %zu, parsed: %d)\n",
	fingerprint, strlen (fingerprint), len);
	}
	else
	{
	int lookup_err;
	kbnode_t kb;

	lookup_err = get_pubkey_byfprint (NULL, &kb,
	fingerprint_raw,
	fingerprint_raw_len);
	if (lookup_err)
	{
	if (DBG_TRUST)
	log_debug ("TOFU: Looking up %s: %s\n",
	fingerprint, gpg_strerror (lookup_err));
	}
	else
	{
	int is_signed_by_utk = signed_by_utk (email, kb);
	release_kbnode (kb);
	if (is_signed_by_utk)
	{
	effective_policy = TOFU_POLICY_GOOD;
	goto out;
	}
	}
	}
	}

	/* Check for any conflicts / see if a previously discovered conflict
	* disappeared. The latter can happen if the conflicting bindings
	* are now cross signed, for instance. */

	conflict_set = build_conflict_set (dbs, pk, fingerprint, email);
	conflict_set_count = strlist_length (conflict_set);
	if (conflict_set_count == 0)
	{
	/* build_conflict_set should always at least return the current
	binding. Something went wrong. */
	effective_policy = _tofu_GET_POLICY_ERROR;
	goto out;
	}

	if (conflict_set_count == 1
	&& (conflict_set->flags & BINDING_NEW))
	{
	/* We've never observed a binding with this email address and we
	* have a default policy, which is not to ask the user. */

	/* If we've seen this binding, then we've seen this email and
	* policy couldn't possibly be TOFU_POLICY_NONE. */
	log_assert (policy == TOFU_POLICY_NONE);

	if (DBG_TRUST)
	log_debug ("TOFU: New binding <key: %s, user id: %s>, no conflict.\n",
	fingerprint, email);

	effective_policy = TOFU_POLICY_AUTO;
	goto out;
	}

	if (conflict_set_count == 1
	&& (conflict_set->flags & BINDING_CONFLICT))
	{
	/* No known conflicts now, but there was a conflict. This means
	* at some point, there was a conflict and we changed this
	* binding's policy to ask and set the conflicting key. The
	* conflict can go away if there is not a cross sig between the
	* two keys. In this case, just silently clear the conflict and
	* reset the policy to auto. */

	if (DBG_TRUST)
	log_debug ("TOFU: binding <key: %s, user id: %s> had a conflict, but it's been resolved (probably via cross sig).\n",
	fingerprint, email);

	effective_policy = TOFU_POLICY_AUTO;
	conflict = NULL;

	goto out;
	}

	if (conflict_set_count == 1)
	{
	/* No conflicts and never marked as conflicting. */

	log_assert (!conflict);

	effective_policy = TOFU_POLICY_AUTO;

	goto out;
	}

	/* There is a conflicting key. */
	log_assert (conflict_set_count > 1);
	effective_policy = TOFU_POLICY_ASK;
	conflict = xstrdup (conflict_set->next->d);

	out:
	log_assert (policy == _tofu_GET_POLICY_ERROR
	\|\| policy == TOFU_POLICY_NONE
	\|\| policy == TOFU_POLICY_AUTO
	\|\| policy == TOFU_POLICY_GOOD
	\|\| policy == TOFU_POLICY_UNKNOWN
	\|\| policy == TOFU_POLICY_BAD
	\|\| policy == TOFU_POLICY_ASK);
	/* Everything but NONE. */
	log_assert (effective_policy == _tofu_GET_POLICY_ERROR
	\|\| effective_policy == TOFU_POLICY_AUTO
	\|\| effective_policy == TOFU_POLICY_GOOD
	\|\| effective_policy == TOFU_POLICY_UNKNOWN
	\|\| effective_policy == TOFU_POLICY_BAD
	\|\| effective_policy == TOFU_POLICY_ASK);

	if (effective_policy != TOFU_POLICY_ASK && conflict)
	conflict = NULL;

	/* If we don't have a record of this binding, its effective policy
	* changed, or conflict changed, update the DB. */
	if (effective_policy != _tofu_GET_POLICY_ERROR
	&& (/* New binding. */
	policy == TOFU_POLICY_NONE
	/* effective_policy changed. */
	\|\| effective_policy != effective_policy_orig
	/* conflict changed. */
	\|\| (conflict != conflict_orig
	&& (!conflict \|\| !conflict_orig
	\|\| strcmp (conflict, conflict_orig) != 0))))
	{
	if (record_binding (dbs, fingerprint, email, user_id,
	policy == TOFU_POLICY_NONE ? TOFU_POLICY_AUTO : policy,
	effective_policy, conflict, 1, 0, now) != 0)
	log_error (_("error setting TOFU binding's policy"
	" to %s\n"), tofu_policy_str (policy));
	}

	/* If the caller wants the set of conflicts, return it. */
	if (effective_policy == TOFU_POLICY_ASK && conflict_setp)
	{
	if (! conflict_set)
	conflict_set = build_conflict_set (dbs, pk, fingerprint, email);
	*conflict_setp = conflict_set;
	}
	else
	{
	free_strlist (conflict_set);

	if (conflict_setp)
	*conflict_setp = NULL;
	}

	xfree (conflict_orig);
	if (conflict != conflict_orig)
	xfree (conflict);
	free_strlist (results);

	return effective_policy;
	}


	/* Return the trust level (TRUST_NEVER, etc.) for the binding
	* <FINGERPRINT, EMAIL> (email is already normalized). If no policy
	* is registered, returns TOFU_POLICY_NONE. If an error occurs,
	* returns _tofu_GET_TRUST_ERROR.
	*
	* PK is the public key object for FINGERPRINT.
	*
	* USER_ID is the unadulterated user id.
	*
	* If MAY_ASK is set, then we may interact with the user. This is
	* necessary if there is a conflict or the binding's policy is
	* TOFU_POLICY_ASK. In the case of a conflict, we set the new
	* conflicting binding's policy to TOFU_POLICY_ASK. In either case,
	* we return TRUST_UNDEFINED. Note: if MAY_ASK is set, then this
	* function must not be called while in a transaction! */
	static enum tofu_policy
	get_trust (ctrl_t ctrl, PKT_public_key *pk,
	const char fingerprint, const char email,
	const char *user_id, int may_ask,
	enum tofu_policy policyp, strlist_t conflict_setp,
	time_t now)
	{
	tofu_dbs_t dbs = ctrl->tofu.dbs;
	int in_transaction = 0;
	enum tofu_policy policy;
	int rc;
	char *sqerr = NULL;
	strlist_t conflict_set = NULL;
	int trust_level = TRUST_UNKNOWN;
	strlist_t iter;

	log_assert (dbs);

	if (may_ask)
	log_assert (dbs->in_transaction == 0);

	if (opt.batch)
	may_ask = 0;

	log_assert (pk_is_primary (pk));

	/* Make sure _tofu_GET_TRUST_ERROR isn't equal to any of the trust
	levels. */
	log_assert (_tofu_GET_TRUST_ERROR != TRUST_UNKNOWN
	&& _tofu_GET_TRUST_ERROR != TRUST_EXPIRED
	&& _tofu_GET_TRUST_ERROR != TRUST_UNDEFINED
	&& _tofu_GET_TRUST_ERROR != TRUST_NEVER
	&& _tofu_GET_TRUST_ERROR != TRUST_MARGINAL
	&& _tofu_GET_TRUST_ERROR != TRUST_FULLY
	&& _tofu_GET_TRUST_ERROR != TRUST_ULTIMATE);

	begin_transaction (ctrl, 0);
	in_transaction = 1;

	/* We need to call get_policy even if the key is ultimately trusted
	* to make sure the binding has been registered. */
	policy = get_policy (dbs, pk, fingerprint, user_id, email,
	&conflict_set, now);

	/* If the key is ultimately trusted, there is nothing to do. */
	{
	u32 kid[2];

	keyid_from_pk (pk, kid);
	if (tdb_keyid_is_utk (kid))
	{
	trust_level = TRUST_ULTIMATE;
	policy = TOFU_POLICY_GOOD;
	goto out;
	}
	}

	if (policy == TOFU_POLICY_AUTO)
	{
	policy = opt.tofu_default_policy;
	if (DBG_TRUST)
	log_debug ("TOFU: binding <key: %s, user id: %s>'s policy is"
	" auto (default: %s).\n",
	fingerprint, email,
	tofu_policy_str (opt.tofu_default_policy));
	}
	switch (policy)
	{
	case TOFU_POLICY_AUTO:
	case TOFU_POLICY_GOOD:
	case TOFU_POLICY_UNKNOWN:
	case TOFU_POLICY_BAD:
	/* The saved judgement is auto -> auto, good, unknown or bad.
	* We don't need to ask the user anything. */
	if (DBG_TRUST)
	log_debug ("TOFU: Known binding <key: %s, user id: %s>'s policy: %s\n",
	fingerprint, email, tofu_policy_str (policy));
	trust_level = tofu_policy_to_trust_level (policy);
	goto out;

	case TOFU_POLICY_ASK:
	/* We need to ask the user what to do. */
	break;

	case _tofu_GET_POLICY_ERROR:
	trust_level = _tofu_GET_TRUST_ERROR;
	goto out;

	default:
	log_bug ("%s: Impossible value for policy (%d)\n", __func__, policy);
	}


	/* We get here if:
	*
	* 1. The saved policy is auto and the default policy is ask
	* (get_policy() == TOFU_POLICY_AUTO
	* && opt.tofu_default_policy == TOFU_POLICY_ASK)
	*
	* 2. The saved policy is ask (either last time the user selected
	* accept once or reject once or there was a conflict and this
	* binding's policy was changed from auto to ask)
	* (policy == TOFU_POLICY_ASK).
	*/
	log_assert (policy == TOFU_POLICY_ASK);

	if (may_ask)
	{
	/* We can't be in a normal transaction in ask_about_binding. */
	end_transaction (ctrl, 0);
	in_transaction = 0;

	/* If we get here, we need to ask the user about the binding. */
	ask_about_binding (ctrl,
	&policy,
	&trust_level,
	conflict_set,
	fingerprint,
	email,
	user_id,
	now);
	}
	else
	{
	trust_level = TRUST_UNDEFINED;
	}

	/* Mark any conflicting bindings that have an automatic policy as
	* now requiring confirmation. Note: we do this after we ask for
	* confirmation so that when the current policy is printed, it is
	* correct. */
	if (! in_transaction)
	{
	begin_transaction (ctrl, 0);
	in_transaction = 1;
	}

	/* The conflict set should always contain at least one element:
	* the current key. */
	log_assert (conflict_set);

	for (iter = conflict_set->next; iter; iter = iter->next)
	{
	/* We don't immediately set the effective policy to 'ask,
	because */
	rc = gpgsql_exec_printf
	(dbs->db, NULL, NULL, &sqerr,
	"update bindings set effective_policy = %d, conflict = %Q"
	" where email = %Q and fingerprint = %Q and effective_policy != %d;",
	TOFU_POLICY_NONE, fingerprint,
	email, iter->d, TOFU_POLICY_ASK);
	if (rc)
	{
	log_error (_("error changing TOFU policy: %s\n"), sqerr);
	print_further_info ("binding: <key: %s, user id: %s>",
	fingerprint, user_id);
	sqlite3_free (sqerr);
	sqerr = NULL;
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if (DBG_TRUST)
	log_debug ("Set %s to conflict with %s\n",
	iter->d, fingerprint);
	}

	out:
	if (in_transaction)
	end_transaction (ctrl, 0);

	if (policyp)
	*policyp = policy;

	if (conflict_setp)
	*conflict_setp = conflict_set;
	else
	free_strlist (conflict_set);

	return trust_level;
	}


	/* Return a malloced string of the form
	* "7~months"
	* The caller should replace all '~' in the returned string by a space
	* and also free the returned string.
	*
	* This is actually a bad hack which may not work correctly with all
	* languages.
	*/
	static char *
	time_ago_str (long long int t)
	{
	/* It would be nice to use a macro to do this, but gettext
	works on the unpreprocessed code. */
	#define MIN_SECS (60)
	#define HOUR_SECS (60 * MIN_SECS)
	#define DAY_SECS (24 * HOUR_SECS)
	#define WEEK_SECS (7 * DAY_SECS)
	#define MONTH_SECS (30 * DAY_SECS)
	#define YEAR_SECS (365 * DAY_SECS)

	if (t > 2 * YEAR_SECS)
	{
	long long int c = t / YEAR_SECS;
	return xtryasprintf (ngettext("%lld~year", "%lld~years", c), c);
	}
	if (t > 2 * MONTH_SECS)
	{
	long long int c = t / MONTH_SECS;
	return xtryasprintf (ngettext("%lld~month", "%lld~months", c), c);
	}
	if (t > 2 * WEEK_SECS)
	{
	long long int c = t / WEEK_SECS;
	return xtryasprintf (ngettext("%lld~week", "%lld~weeks", c), c);
	}
	if (t > 2 * DAY_SECS)
	{
	long long int c = t / DAY_SECS;
	return xtryasprintf (ngettext("%lld~day", "%lld~days", c), c);
	}
	if (t > 2 * HOUR_SECS)
	{
	long long int c = t / HOUR_SECS;
	return xtryasprintf (ngettext("%lld~hour", "%lld~hours", c), c);
	}
	if (t > 2 * MIN_SECS)
	{
	long long int c = t / MIN_SECS;
	return xtryasprintf (ngettext("%lld~minute", "%lld~minutes", c), c);
	}
	return xtryasprintf (ngettext("%lld~second", "%lld~seconds", t), t);
	}


	/* If FP is NULL, write TOFU_STATS status line. If FP is not NULL
	* write a "tfs" record to that stream. */
	static void
	write_stats_status (estream_t fp,
	enum tofu_policy policy,
	unsigned long signature_count,
	unsigned long signature_first_seen,
	unsigned long signature_most_recent,
	unsigned long signature_days,
	unsigned long encryption_count,
	unsigned long encryption_first_done,
	unsigned long encryption_most_recent,
	unsigned long encryption_days)
	{
	int summary;
	int validity;
	unsigned long days;

	/* Use the euclidean distance (m = sqrt(a^2 + b^2)) rather then the
	sum of the magnitudes (m = a + b) to ensure a balance between
	verified signatures and encrypted messages. */
	days = sqrtu32 (signature_days * signature_days
	+ encryption_days * encryption_days);

	if (days < 1)
	validity = 1; /* Key without history. */
	else if (days < 2 * BASIC_TRUST_THRESHOLD)
	validity = 2; /* Key with too little history. */
	else if (days < 2 * FULL_TRUST_THRESHOLD)
	validity = 3; /* Key with enough history for basic trust. */
	else
	validity = 4; /* Key with a lot of history. */

	if (policy == TOFU_POLICY_ASK)
	summary = 0; /* Key requires attention. */
	else
	summary = validity;

	if (fp)
	{
	es_fprintf (fp, "tfs:1:%d:%lu:%lu:%s:%lu:%lu:%lu:%lu:%d:%lu:%lu:\n",
	summary, signature_count, encryption_count,
	tofu_policy_str (policy),
	signature_first_seen, signature_most_recent,
	encryption_first_done, encryption_most_recent,
	validity, signature_days, encryption_days);
	}
	else
	{
	write_status_printf (STATUS_TOFU_STATS,
	"%d %lu %lu %s %lu %lu %lu %lu %d %lu %lu",
	summary,
	signature_count,
	encryption_count,
	tofu_policy_str (policy),
	signature_first_seen,
	signature_most_recent,
	encryption_first_done,
	encryption_most_recent,
	validity,
	signature_days, encryption_days);
	}
	}

	/* Note: If OUTFP is not NULL, this function merely prints a "tfs" record
	* to OUTFP.
	*
	* POLICY is the key's policy (as returned by get_policy).
	*
	- * Returns 0 if if ONLY_STATUS_FD is set. Otherwise, returns whether
	+ * Returns 0 if ONLY_STATUS_FD is set. Otherwise, returns whether
	* the caller should call show_warning after iterating over all user
	* ids.
	*/
	static int
	show_statistics (tofu_dbs_t dbs,
	const char fingerprint, const char email,
	enum tofu_policy policy,
	estream_t outfp, int only_status_fd, time_t now)
	{
	char *fingerprint_pp;
	int rc;
	strlist_t strlist = NULL;
	char *err = NULL;

	unsigned long signature_first_seen = 0;
	unsigned long signature_most_recent = 0;
	unsigned long signature_count = 0;
	unsigned long signature_days = 0;
	unsigned long encryption_first_done = 0;
	unsigned long encryption_most_recent = 0;
	unsigned long encryption_count = 0;
	unsigned long encryption_days = 0;

	int show_warning = 0;

	if (only_status_fd && ! is_status_enabled ())
	return 0;

	fingerprint_pp = format_hexfingerprint (fingerprint, NULL, 0);

	/* Get the signature stats. */
	rc = gpgsql_exec_printf
	(dbs->db, strings_collect_cb, &strlist, &err,
	"select count (*), coalesce (min (signatures.time), 0),\n"
	" coalesce (max (signatures.time), 0)\n"
	" from signatures\n"
	" left join bindings on signatures.binding = bindings.oid\n"
	" where fingerprint = %Q and email = %Q;",
	fingerprint, email);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("getting signature statistics");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto out;
	}
	rc = gpgsql_exec_printf
	(dbs->db, strings_collect_cb, &strlist, &err,
	"select count (*) from\n"
	" (select round(signatures.time / (24 * 60 * 60)) day\n"
	" from signatures\n"
	" left join bindings on signatures.binding = bindings.oid\n"
	" where fingerprint = %Q and email = %Q\n"
	" group by day);",
	fingerprint, email);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("getting signature statistics (by day)");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto out;
	}

	if (strlist)
	{
	/* We expect exactly 4 elements. */
	log_assert (strlist->next);
	log_assert (strlist->next->next);
	log_assert (strlist->next->next->next);
	log_assert (! strlist->next->next->next->next);

	string_to_ulong (&signature_days, strlist->d, -1, __LINE__);
	string_to_ulong (&signature_count, strlist->next->d, -1, __LINE__);
	string_to_ulong (&signature_first_seen,
	strlist->next->next->d, -1, __LINE__);
	string_to_ulong (&signature_most_recent,
	strlist->next->next->next->d, -1, __LINE__);

	free_strlist (strlist);
	strlist = NULL;
	}

	/* Get the encryption stats. */
	rc = gpgsql_exec_printf
	(dbs->db, strings_collect_cb, &strlist, &err,
	"select count (*), coalesce (min (encryptions.time), 0),\n"
	" coalesce (max (encryptions.time), 0)\n"
	" from encryptions\n"
	" left join bindings on encryptions.binding = bindings.oid\n"
	" where fingerprint = %Q and email = %Q;",
	fingerprint, email);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("getting encryption statistics");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto out;
	}
	rc = gpgsql_exec_printf
	(dbs->db, strings_collect_cb, &strlist, &err,
	"select count (*) from\n"
	" (select round(encryptions.time / (24 * 60 * 60)) day\n"
	" from encryptions\n"
	" left join bindings on encryptions.binding = bindings.oid\n"
	" where fingerprint = %Q and email = %Q\n"
	" group by day);",
	fingerprint, email);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("getting encryption statistics (by day)");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto out;
	}

	if (strlist)
	{
	/* We expect exactly 4 elements. */
	log_assert (strlist->next);
	log_assert (strlist->next->next);
	log_assert (strlist->next->next->next);
	log_assert (! strlist->next->next->next->next);

	string_to_ulong (&encryption_days, strlist->d, -1, __LINE__);
	string_to_ulong (&encryption_count, strlist->next->d, -1, __LINE__);
	string_to_ulong (&encryption_first_done,
	strlist->next->next->d, -1, __LINE__);
	string_to_ulong (&encryption_most_recent,
	strlist->next->next->next->d, -1, __LINE__);

	free_strlist (strlist);
	strlist = NULL;
	}

	if (!outfp)
	write_status_text_and_buffer (STATUS_TOFU_USER, fingerprint,
	email, strlen (email), 0);

	write_stats_status (outfp, policy,
	signature_count,
	signature_first_seen,
	signature_most_recent,
	signature_days,
	encryption_count,
	encryption_first_done,
	encryption_most_recent,
	encryption_days);

	if (!outfp && !only_status_fd)
	{
	estream_t fp;
	char *msg;

	fp = es_fopenmem (0, "rw,samethread");
	if (! fp)
	log_fatal ("error creating memory stream: %s\n",
	gpg_strerror (gpg_error_from_syserror()));

	if (signature_count == 0 && encryption_count == 0)
	{
	es_fprintf (fp,
	_("%s: Verified 0~signatures and encrypted 0~messages."),
	email);
	}
	else
	{
	if (signature_count == 0)
	es_fprintf (fp, _("%s: Verified 0 signatures."), email);
	else
	{
	/* TRANSLATORS: The final %s is replaced by a string like
	"7~months". */
	char *ago_str = time_ago_str (now - signature_first_seen);
	es_fprintf
	(fp,
	ngettext("%s: Verified %ld~signature in the past %s.",
	"%s: Verified %ld~signatures in the past %s.",
	signature_count),
	email, signature_count, ago_str);
	xfree (ago_str);
	}

	es_fputs (" ", fp);

	if (encryption_count == 0)
	es_fprintf (fp, _("Encrypted 0 messages."));
	else
	{
	char *ago_str = time_ago_str (now - encryption_first_done);

	/* TRANSLATORS: The final %s is replaced by a string like
	"7~months". */
	es_fprintf (fp,
	ngettext("Encrypted %ld~message in the past %s.",
	"Encrypted %ld~messages in the past %s.",
	encryption_count),
	encryption_count, ago_str);
	xfree (ago_str);
	}
	}

	if (opt.verbose)
	{
	es_fputs (" ", fp);
	es_fprintf (fp, _("(policy: %s)"), tofu_policy_str (policy));
	}
	es_fputs ("\n", fp);


	{
	char tmpmsg, p;
	es_fputc (0, fp);
	if (es_fclose_snatch (fp, (void **) &tmpmsg, NULL))
	log_fatal ("error snatching memory stream\n");
	msg = format_text (tmpmsg, 0, 72, 80);
	es_free (tmpmsg);

	/* Print a status line but suppress the trailing LF.
	* Spaces are not percent escaped. */
	if (*msg)
	write_status_buffer (STATUS_TOFU_STATS_LONG,
	msg, strlen (msg)-1, -1);

	/* Remove the non-breaking space markers. */
	for (p=msg; *p; p++)
	if (*p == '~')
	*p = ' ';
	}

	log_string (GPGRT_LOG_INFO, msg);
	xfree (msg);

	if (policy == TOFU_POLICY_AUTO)
	{
	if (signature_count == 0)
	log_info (_("Warning: we have yet to see"
	" a message signed using this key and user id!\n"));
	else if (signature_count == 1)
	log_info (_("Warning: we've only seen one message"
	" signed using this key and user id!\n"));

	if (encryption_count == 0)
	log_info (_("Warning: you have yet to encrypt"
	" a message to this key!\n"));
	else if (encryption_count == 1)
	log_info (_("Warning: you have only encrypted"
	" one message to this key!\n"));

	/* Cf. write_stats_status */
	if (sqrtu32 (encryption_count * encryption_count
	+ signature_count * signature_count)
	< 2 * BASIC_TRUST_THRESHOLD)
	show_warning = 1;
	}
	}

	out:
	xfree (fingerprint_pp);

	return show_warning;
	}

	static void
	show_warning (const char *fingerprint, strlist_t user_id_list)
	{
	char *set_policy_command;
	char *text;
	char *tmpmsg;

	set_policy_command =
	xasprintf ("gpg --tofu-policy bad %s", fingerprint);

	tmpmsg = xasprintf
	(ngettext
	("Warning: if you think you've seen more signatures "
	"by this key and user id, then this key might be a "
	"forgery! Carefully examine the email address for small "
	"variations. If the key is suspect, then use\n"
	" %s\n"
	"to mark it as being bad.\n",
	"Warning: if you think you've seen more signatures "
	"by this key and these user ids, then this key might be a "
	"forgery! Carefully examine the email addresses for small "
	"variations. If the key is suspect, then use\n"
	" %s\n"
	"to mark it as being bad.\n",
	strlist_length (user_id_list)),
	set_policy_command);

	text = format_text (tmpmsg, 0, 72, 80);
	xfree (tmpmsg);
	log_string (GPGRT_LOG_INFO, text);
	xfree (text);

	es_free (set_policy_command);
	}


	/* Extract the email address from a user id and normalize it. If the
	user id doesn't contain an email address, then we use the whole
	user_id and normalize that. The returned string must be freed. */
	static char *
	email_from_user_id (const char *user_id)
	{
	char *email = mailbox_from_userid (user_id);
	if (! email)
	{
	/* Hmm, no email address was provided or we are out of core. Just
	take the lower-case version of the whole user id. It could be
	a hostname, for instance. */
	email = ascii_strlwr (xstrdup (user_id));
	}

	return email;
	}

	/* Register the signature with the bindings <fingerprint, USER_ID>,
	for each USER_ID in USER_ID_LIST. The fingerprint is taken from
	the primary key packet PK.

	SIG_DIGEST_BIN is the binary representation of the message's
	digest. SIG_DIGEST_BIN_LEN is its length.

	SIG_TIME is the time that the signature was generated.

	ORIGIN is a free-formed string describing the origin of the
	signature. If this was from an email and the Claws MUA was used,
	then this should be something like: "email:claws". If this is
	NULL, the default is simply "unknown".

	If MAY_ASK is 1, then this function may interact with the user.
	This is necessary if there is a conflict or the binding's policy is
	TOFU_POLICY_ASK.

	This function returns 0 on success and an error code if an error
	occurred. */
	gpg_error_t
	tofu_register_signature (ctrl_t ctrl,
	PKT_public_key *pk, strlist_t user_id_list,
	const byte *sig_digest_bin, int sig_digest_bin_len,
	time_t sig_time, const char *origin)
	{
	time_t now = gnupg_get_time ();
	gpg_error_t rc;
	tofu_dbs_t dbs;
	char *fingerprint = NULL;
	strlist_t user_id;
	char *email = NULL;
	char *err = NULL;
	char *sig_digest;
	unsigned long c;

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	rc = gpg_error (GPG_ERR_GENERAL);
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	/* We do a query and then an insert. Make sure they are atomic
	by wrapping them in a transaction. */
	rc = begin_transaction (ctrl, 0);
	if (rc)
	return rc;

	log_assert (pk_is_primary (pk));

	sig_digest = make_radix64_string (sig_digest_bin, sig_digest_bin_len);
	fingerprint = hexfingerprint (pk, NULL, 0);

	if (! origin)
	/* The default origin is simply "unknown". */
	origin = "unknown";

	for (user_id = user_id_list; user_id; user_id = user_id->next)
	{
	email = email_from_user_id (user_id->d);

	if (DBG_TRUST)
	log_debug ("TOFU: Registering signature %s with binding"
	" <key: %s, user id: %s>\n",
	sig_digest, fingerprint, email);

	/* Make sure the binding exists and record any TOFU
	conflicts. */
	if (get_trust (ctrl, pk, fingerprint, email, user_id->d,
	0, NULL, NULL, now)
	== _tofu_GET_TRUST_ERROR)
	{
	rc = gpg_error (GPG_ERR_GENERAL);
	xfree (email);
	break;
	}

	/* If we've already seen this signature before, then don't add
	it again. */
	rc = gpgsql_stepx
	(dbs->db, &dbs->s.register_already_seen,
	get_single_unsigned_long_cb2, &c, &err,
	"select count (*)\n"
	" from signatures left join bindings\n"
	" on signatures.binding = bindings.oid\n"
	" where fingerprint = ? and email = ? and sig_time = ?\n"
	" and sig_digest = ?",
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_LONG_LONG, (long long) sig_time,
	GPGSQL_ARG_STRING, sig_digest,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error reading TOFU database: %s\n"), err);
	print_further_info ("checking existence");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if (c > 1)
	/* Duplicates! This should not happen. In particular,
	because <fingerprint, email, sig_time, sig_digest> is the
	primary key! */
	log_debug ("SIGNATURES DB contains duplicate records"
	" <key: %s, email: %s, time: 0x%lx, sig: %s,"
	" origin: %s>."
	" Please report.\n",
	fingerprint, email, (unsigned long) sig_time,
	sig_digest, origin);
	else if (c == 1)
	{
	if (DBG_TRUST)
	log_debug ("Already observed the signature and binding"
	" <key: %s, email: %s, time: 0x%lx, sig: %s,"
	" origin: %s>\n",
	fingerprint, email, (unsigned long) sig_time,
	sig_digest, origin);
	}
	else if (opt.dry_run)
	{
	log_info ("TOFU database update skipped due to --dry-run\n");
	}
	else
	/* This is the first time that we've seen this signature and
	binding. Record it. */
	{
	if (DBG_TRUST)
	log_debug ("TOFU: Saving signature"
	" <key: %s, user id: %s, sig: %s>\n",
	fingerprint, email, sig_digest);

	log_assert (c == 0);

	rc = gpgsql_stepx
	(dbs->db, &dbs->s.register_signature, NULL, NULL, &err,
	"insert into signatures\n"
	" (binding, sig_digest, origin, sig_time, time)\n"
	" values\n"
	" ((select oid from bindings\n"
	" where fingerprint = ? and email = ?),\n"
	" ?, ?, ?, ?);",
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_STRING, sig_digest, GPGSQL_ARG_STRING, origin,
	GPGSQL_ARG_LONG_LONG, (long long) sig_time,
	GPGSQL_ARG_LONG_LONG, (long long) now,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error updating TOFU database: %s\n"), err);
	print_further_info ("insert signatures");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	}

	xfree (email);

	if (rc)
	break;
	}

	if (rc)
	rollback_transaction (ctrl);
	else
	rc = end_transaction (ctrl, 0);

	xfree (fingerprint);
	xfree (sig_digest);

	return rc;
	}

	gpg_error_t
	tofu_register_encryption (ctrl_t ctrl,
	PKT_public_key *pk, strlist_t user_id_list,
	int may_ask)
	{
	time_t now = gnupg_get_time ();
	gpg_error_t rc = 0;
	tofu_dbs_t dbs;
	kbnode_t kb = NULL;
	int free_user_id_list = 0;
	char *fingerprint = NULL;
	strlist_t user_id;
	char *err = NULL;

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	rc = gpg_error (GPG_ERR_GENERAL);
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	if (/* We need the key block to find the primary key. */
	! pk_is_primary (pk)
	/* We need the key block to find all user ids. */
	\|\| ! user_id_list)
	kb = get_pubkeyblock (pk->keyid);

	/* Make sure PK is a primary key. */
	if (! pk_is_primary (pk))
	pk = kb->pkt->pkt.public_key;

	if (! user_id_list)
	{
	/* Use all non-revoked user ids. Do use expired user ids. */
	kbnode_t n = kb;

	while ((n = find_next_kbnode (n, PKT_USER_ID)))
	{
	PKT_user_id *uid = n->pkt->pkt.user_id;

	if (uid->is_revoked)
	continue;

	add_to_strlist (&user_id_list, uid->name);
	}

	free_user_id_list = 1;

	if (! user_id_list)
	log_info (_("WARNING: Encrypting to %s, which has no "
	"non-revoked user ids\n"),
	keystr (pk->keyid));
	}

	fingerprint = hexfingerprint (pk, NULL, 0);

	tofu_begin_batch_update (ctrl);
	tofu_resume_batch_transaction (ctrl);

	for (user_id = user_id_list; user_id; user_id = user_id->next)
	{
	char *email = email_from_user_id (user_id->d);
	strlist_t conflict_set = NULL;
	enum tofu_policy policy;

	/* Make sure the binding exists and that we recognize any
	conflicts. */
	int tl = get_trust (ctrl, pk, fingerprint, email, user_id->d,
	may_ask, &policy, &conflict_set, now);
	if (tl == _tofu_GET_TRUST_ERROR)
	{
	/* An error. */
	rc = gpg_error (GPG_ERR_GENERAL);
	xfree (email);
	goto die;
	}


	/* If there is a conflict and MAY_ASK is true, we need to show
	* the TOFU statistics for the current binding and the
	* conflicting bindings. But, if we are not in batch mode, then
	* they have already been printed (this is required to make sure
	* the information is available to the caller before cpr_get is
	* called). */
	if (policy == TOFU_POLICY_ASK && may_ask && opt.batch)
	{
	strlist_t iter;

	/* The conflict set should contain at least the current
	* key. */
	log_assert (conflict_set);

	for (iter = conflict_set; iter; iter = iter->next)
	show_statistics (dbs, iter->d, email,
	TOFU_POLICY_ASK, NULL, 1, now);
	}

	free_strlist (conflict_set);

	rc = gpgsql_stepx
	(dbs->db, &dbs->s.register_encryption, NULL, NULL, &err,
	"insert into encryptions\n"
	" (binding, time)\n"
	" values\n"
	" ((select oid from bindings\n"
	" where fingerprint = ? and email = ?),\n"
	" ?);",
	GPGSQL_ARG_STRING, fingerprint, GPGSQL_ARG_STRING, email,
	GPGSQL_ARG_LONG_LONG, (long long) now,
	GPGSQL_ARG_END);
	if (rc)
	{
	log_error (_("error updating TOFU database: %s\n"), err);
	print_further_info ("insert encryption");
	sqlite3_free (err);
	rc = gpg_error (GPG_ERR_GENERAL);
	}

	xfree (email);
	}

	die:
	tofu_end_batch_update (ctrl);

	if (kb)
	release_kbnode (kb);

	if (free_user_id_list)
	free_strlist (user_id_list);

	xfree (fingerprint);

	return rc;
	}


	/* Combine a trust level returned from the TOFU trust model with a
	trust level returned by the PGP trust model. This is primarily of
	interest when the trust model is tofu+pgp (TM_TOFU_PGP).

	This function ors together the upper bits (the values not covered
	by TRUST_MASK, i.e., TRUST_FLAG_REVOKED, etc.). */
	int
	tofu_wot_trust_combine (int tofu_base, int wot_base)
	{
	int tofu = tofu_base & TRUST_MASK;
	int wot = wot_base & TRUST_MASK;
	int upper = (tofu_base & ~TRUST_MASK) \| (wot_base & ~TRUST_MASK);

	log_assert (tofu == TRUST_UNKNOWN
	\|\| tofu == TRUST_EXPIRED
	\|\| tofu == TRUST_UNDEFINED
	\|\| tofu == TRUST_NEVER
	\|\| tofu == TRUST_MARGINAL
	\|\| tofu == TRUST_FULLY
	\|\| tofu == TRUST_ULTIMATE);
	log_assert (wot == TRUST_UNKNOWN
	\|\| wot == TRUST_EXPIRED
	\|\| wot == TRUST_UNDEFINED
	\|\| wot == TRUST_NEVER
	\|\| wot == TRUST_MARGINAL
	\|\| wot == TRUST_FULLY
	\|\| wot == TRUST_ULTIMATE);

	/* We first consider negative trust policys. These trump positive
	trust policies. */
	if (tofu == TRUST_NEVER \|\| wot == TRUST_NEVER)
	/* TRUST_NEVER trumps everything else. */
	return upper \| TRUST_NEVER;
	if (tofu == TRUST_EXPIRED \|\| wot == TRUST_EXPIRED)
	/* TRUST_EXPIRED trumps everything but TRUST_NEVER. */
	return upper \| TRUST_EXPIRED;

	/* Now we only have positive or neutral trust policies. We take
	the max. */
	if (tofu == TRUST_ULTIMATE)
	return upper \| TRUST_ULTIMATE \| TRUST_FLAG_TOFU_BASED;
	if (wot == TRUST_ULTIMATE)
	return upper \| TRUST_ULTIMATE;

	if (tofu == TRUST_FULLY)
	return upper \| TRUST_FULLY \| TRUST_FLAG_TOFU_BASED;
	if (wot == TRUST_FULLY)
	return upper \| TRUST_FULLY;

	if (tofu == TRUST_MARGINAL)
	return upper \| TRUST_MARGINAL \| TRUST_FLAG_TOFU_BASED;
	if (wot == TRUST_MARGINAL)
	return upper \| TRUST_MARGINAL;

	if (tofu == TRUST_UNDEFINED)
	return upper \| TRUST_UNDEFINED \| TRUST_FLAG_TOFU_BASED;
	if (wot == TRUST_UNDEFINED)
	return upper \| TRUST_UNDEFINED;

	return upper \| TRUST_UNKNOWN;
	}


	/* Write a "tfs" record for a --with-colons listing. */
	gpg_error_t
	tofu_write_tfs_record (ctrl_t ctrl, estream_t fp,
	PKT_public_key pk, const char user_id)
	{
	time_t now = gnupg_get_time ();
	gpg_error_t err;
	tofu_dbs_t dbs;
	char *fingerprint;
	char *email;
	enum tofu_policy policy;

	if (!*user_id)
	return 0; /* No TOFU stats possible for an empty ID. */

	dbs = opendbs (ctrl);
	if (!dbs)
	{
	err = gpg_error (GPG_ERR_GENERAL);
	log_error (_("error opening TOFU database: %s\n"), gpg_strerror (err));
	return err;
	}

	fingerprint = hexfingerprint (pk, NULL, 0);
	email = email_from_user_id (user_id);
	policy = get_policy (dbs, pk, fingerprint, user_id, email, NULL, now);

	show_statistics (dbs, fingerprint, email, policy, fp, 0, now);

	xfree (email);
	xfree (fingerprint);
	return 0;
	}


	/* Return the validity (TRUST_NEVER, etc.) of the bindings
	<FINGERPRINT, USER_ID>, for each USER_ID in USER_ID_LIST. If
	USER_ID_LIST->FLAG is set, then the id is considered to be expired.

	PK is the primary key packet.

	If MAY_ASK is 1 and the policy is TOFU_POLICY_ASK, then the user
	will be prompted to choose a policy. If MAY_ASK is 0 and the
	policy is TOFU_POLICY_ASK, then TRUST_UNKNOWN is returned.

	Returns TRUST_UNDEFINED if an error occurs. */
	int
	tofu_get_validity (ctrl_t ctrl, PKT_public_key *pk, strlist_t user_id_list,
	int may_ask)
	{
	time_t now = gnupg_get_time ();
	tofu_dbs_t dbs;
	char *fingerprint = NULL;
	strlist_t user_id;
	int trust_level = TRUST_UNKNOWN;
	int bindings = 0;
	int bindings_valid = 0;
	int need_warning = 0;
	int had_conflict = 0;

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_GENERAL));
	return TRUST_UNDEFINED;
	}

	fingerprint = hexfingerprint (pk, NULL, 0);

	tofu_begin_batch_update (ctrl);
	/* Start the batch transaction now. */
	tofu_resume_batch_transaction (ctrl);

	for (user_id = user_id_list; user_id; user_id = user_id->next, bindings ++)
	{
	char *email = email_from_user_id (user_id->d);
	strlist_t conflict_set = NULL;
	enum tofu_policy policy;

	/* Always call get_trust to make sure the binding is
	registered. */
	int tl = get_trust (ctrl, pk, fingerprint, email, user_id->d,
	may_ask, &policy, &conflict_set, now);
	if (tl == _tofu_GET_TRUST_ERROR)
	{
	/* An error. */
	trust_level = TRUST_UNDEFINED;
	xfree (email);
	goto die;
	}

	if (DBG_TRUST)
	log_debug ("TOFU: validity for <key: %s, user id: %s>: %s%s.\n",
	fingerprint, email,
	trust_value_to_string (tl),
	user_id->flags ? " (but expired)" : "");

	if (user_id->flags)
	tl = TRUST_EXPIRED;

	if (tl != TRUST_EXPIRED)
	bindings_valid ++;

	if (may_ask && tl != TRUST_ULTIMATE && tl != TRUST_EXPIRED)
	{
	/* If policy is ask, then we already printed out the
	* conflict information in ask_about_binding or will do so
	* in a moment. */
	if (policy != TOFU_POLICY_ASK)
	need_warning \|=
	show_statistics (dbs, fingerprint, email, policy, NULL, 0, now);

	/* If there is a conflict and MAY_ASK is true, we need to
	* show the TOFU statistics for the current binding and the
	* conflicting bindings. But, if we are not in batch mode,
	* then they have already been printed (this is required to
	* make sure the information is available to the caller
	* before cpr_get is called). */
	if (policy == TOFU_POLICY_ASK && opt.batch)
	{
	strlist_t iter;

	/* The conflict set should contain at least the current
	* key. */
	log_assert (conflict_set);

	had_conflict = 1;
	for (iter = conflict_set; iter; iter = iter->next)
	show_statistics (dbs, iter->d, email,
	TOFU_POLICY_ASK, NULL, 1, now);
	}
	}

	free_strlist (conflict_set);

	if (tl == TRUST_NEVER)
	trust_level = TRUST_NEVER;
	else if (tl == TRUST_EXPIRED)
	/* Ignore expired bindings in the trust calculation. */
	;
	else if (tl > trust_level)
	{
	/* The expected values: */
	log_assert (tl == TRUST_UNKNOWN \|\| tl == TRUST_UNDEFINED
	\|\| tl == TRUST_MARGINAL \|\| tl == TRUST_FULLY
	\|\| tl == TRUST_ULTIMATE);

	/* We assume the following ordering: */
	log_assert (TRUST_UNKNOWN < TRUST_UNDEFINED);
	log_assert (TRUST_UNDEFINED < TRUST_MARGINAL);
	log_assert (TRUST_MARGINAL < TRUST_FULLY);
	log_assert (TRUST_FULLY < TRUST_ULTIMATE);

	trust_level = tl;
	}

	xfree (email);
	}

	if (need_warning && ! had_conflict)
	show_warning (fingerprint, user_id_list);

	die:
	tofu_end_batch_update (ctrl);

	xfree (fingerprint);

	if (bindings_valid == 0)
	{
	if (DBG_TRUST)
	log_debug ("no (of %d) valid bindings."
	" Can't get TOFU validity for this set of user ids.\n",
	bindings);
	return TRUST_NEVER;
	}

	return trust_level;
	}

	/* Set the policy for all non-revoked user ids in the keyblock KB to
	POLICY.

	If no key is available with the specified key id, then this
	function returns GPG_ERR_NO_PUBKEY.

	Returns 0 on success and an error code otherwise. */
	gpg_error_t
	tofu_set_policy (ctrl_t ctrl, kbnode_t kb, enum tofu_policy policy)
	{
	gpg_error_t err;
	time_t now = gnupg_get_time ();
	tofu_dbs_t dbs;
	PKT_public_key *pk;
	char *fingerprint = NULL;

	log_assert (kb->pkt->pkttype == PKT_PUBLIC_KEY);
	pk = kb->pkt->pkt.public_key;

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_GENERAL));
	return gpg_error (GPG_ERR_GENERAL);
	}

	if (DBG_TRUST)
	log_debug ("Setting TOFU policy for %s to %s\n",
	keystr (pk->keyid), tofu_policy_str (policy));
	if (! pk_is_primary (pk))
	log_bug ("%s: Passed a subkey, but expecting a primary key.\n", __func__);

	fingerprint = hexfingerprint (pk, NULL, 0);

	begin_transaction (ctrl, 0);

	for (; kb; kb = kb->next)
	{
	PKT_user_id *user_id;
	char *email;

	if (kb->pkt->pkttype != PKT_USER_ID)
	continue;

	user_id = kb->pkt->pkt.user_id;
	if (user_id->is_revoked)
	/* Skip revoked user ids. (Don't skip expired user ids, the
	expiry can be changed.) */
	continue;

	email = email_from_user_id (user_id->name);

	err = record_binding (dbs, fingerprint, email, user_id->name,
	policy, TOFU_POLICY_NONE, NULL, 0, 1, now);
	if (err)
	{
	log_error (_("error setting policy for key %s, user id \"%s\": %s"),
	fingerprint, email, gpg_strerror (err));
	xfree (email);
	break;
	}

	xfree (email);
	}

	if (err)
	rollback_transaction (ctrl);
	else
	end_transaction (ctrl, 0);

	xfree (fingerprint);
	return err;
	}

	/* Return the TOFU policy for the specified binding in *POLICY. If no
	policy has been set for the binding, sets *POLICY to
	TOFU_POLICY_NONE.

	PK is a primary public key and USER_ID is a user id.

	Returns 0 on success and an error code otherwise. */
	gpg_error_t
	tofu_get_policy (ctrl_t ctrl, PKT_public_key pk, PKT_user_id user_id,
	enum tofu_policy *policy)
	{
	time_t now = gnupg_get_time ();
	tofu_dbs_t dbs;
	char *fingerprint;
	char *email;

	/* Make sure PK is a primary key. */
	log_assert (pk_is_primary (pk));

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_GENERAL));
	return gpg_error (GPG_ERR_GENERAL);
	}

	fingerprint = hexfingerprint (pk, NULL, 0);

	email = email_from_user_id (user_id->name);

	*policy = get_policy (dbs, pk, fingerprint, user_id->name, email, NULL, now);

	xfree (email);
	xfree (fingerprint);
	if (*policy == _tofu_GET_POLICY_ERROR)
	return gpg_error (GPG_ERR_GENERAL);
	return 0;
	}

	gpg_error_t
	tofu_notice_key_changed (ctrl_t ctrl, kbnode_t kb)
	{
	tofu_dbs_t dbs;
	PKT_public_key *pk;
	char *fingerprint;
	char *sqlerr = NULL;
	int rc;

	/* Make sure PK is a primary key. */
	setup_main_keyids (kb);
	pk = kb->pkt->pkt.public_key;
	log_assert (pk_is_primary (pk));

	dbs = opendbs (ctrl);
	if (! dbs)
	{
	log_error (_("error opening TOFU database: %s\n"),
	gpg_strerror (GPG_ERR_GENERAL));
	return gpg_error (GPG_ERR_GENERAL);
	}

	fingerprint = hexfingerprint (pk, NULL, 0);

	rc = gpgsql_stepx (dbs->db, NULL, NULL, NULL, &sqlerr,
	"update bindings set effective_policy = ?"
	" where fingerprint = ?;",
	GPGSQL_ARG_INT, (int) TOFU_POLICY_NONE,
	GPGSQL_ARG_STRING, fingerprint,
	GPGSQL_ARG_END);
	xfree (fingerprint);

	if (rc == _tofu_GET_POLICY_ERROR)
	return gpg_error (GPG_ERR_GENERAL);
	return 0;
	}
	diff --git a/g10/trust.c b/g10/trust.c
	index 888b4ca53..b1fa3d652 100644
	--- a/g10/trust.c
	+++ b/g10/trust.c
	@@ -1,796 +1,796 @@
	/* trust.c - High level trust functions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2012 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "keydb.h"
	#include "util.h"
	#include "options.h"
	#include "packet.h"
	#include "main.h"
	#include "i18n.h"
	#include "trustdb.h"
	#include "host2net.h"


	/* Return true if key is disabled. Note that this is usually used via
	the pk_is_disabled macro. */
	int
	cache_disabled_value (PKT_public_key *pk)
	{
	#ifdef NO_TRUST_MODELS
	(void)pk;
	return 0;
	#else
	return tdb_cache_disabled_value (pk);
	#endif
	}


	void
	register_trusted_keyid (u32 *keyid)
	{
	#ifdef NO_TRUST_MODELS
	(void)keyid;
	#else
	tdb_register_trusted_keyid (keyid);
	#endif
	}


	void
	register_trusted_key (const char *string)
	{
	#ifdef NO_TRUST_MODELS
	(void)string;
	#else
	tdb_register_trusted_key (string);
	#endif
	}



	/*
	* This function returns a letter for a trust value. Trust flags
	* are ignored.
	*/
	static int
	trust_letter (unsigned int value)
	{
	switch( (value & TRUST_MASK) )
	{
	case TRUST_UNKNOWN: return '-';
	case TRUST_EXPIRED: return 'e';
	case TRUST_UNDEFINED: return 'q';
	case TRUST_NEVER: return 'n';
	case TRUST_MARGINAL: return 'm';
	case TRUST_FULLY: return 'f';
	case TRUST_ULTIMATE: return 'u';
	default: return '?';
	}
	}


	/* The strings here are similar to those in
	pkclist.c:do_edit_ownertrust() */
	const char *
	trust_value_to_string (unsigned int value)
	{
	switch ((value & TRUST_MASK))
	{
	case TRUST_UNKNOWN: return _("unknown");
	case TRUST_EXPIRED: return _("expired");
	case TRUST_UNDEFINED: return _("undefined");
	case TRUST_NEVER: return _("never");
	case TRUST_MARGINAL: return _("marginal");
	case TRUST_FULLY: return _("full");
	case TRUST_ULTIMATE: return _("ultimate");
	default: return "err";
	}
	}


	int
	string_to_trust_value (const char *str)
	{
	if (!ascii_strcasecmp (str, "undefined"))
	return TRUST_UNDEFINED;
	else if (!ascii_strcasecmp (str, "never"))
	return TRUST_NEVER;
	else if (!ascii_strcasecmp (str, "marginal"))
	return TRUST_MARGINAL;
	else if (!ascii_strcasecmp (str, "full"))
	return TRUST_FULLY;
	else if (!ascii_strcasecmp(str, "ultimate"))
	return TRUST_ULTIMATE;
	else
	return -1;
	}


	const char *
	uid_trust_string_fixed (ctrl_t ctrl, PKT_public_key key, PKT_user_id uid)
	{
	if (!key && !uid)
	{
	/* TRANSLATORS: these strings are similar to those in
	trust_value_to_string(), but are a fixed length. This is needed to
	make attractive information listings where columns line up
	properly. The value "10" should be the length of the strings you
	choose to translate to. This is the length in printable columns.
	It gets passed to atoi() so everything after the number is
	essentially a comment and need not be translated. Either key and
	uid are both NULL, or neither are NULL. */
	return _("10 translator see trust.c:uid_trust_string_fixed");
	}
	else if(uid->is_revoked \|\| (key && key->flags.revoked))
	return _("[ revoked]");
	else if(uid->is_expired)
	return _("[ expired]");
	else if(key)
	{
	switch (get_validity (ctrl, NULL, key, uid, NULL, 0) & TRUST_MASK)
	{
	case TRUST_UNKNOWN: return _("[ unknown]");
	case TRUST_EXPIRED: return _("[ expired]");
	case TRUST_UNDEFINED: return _("[ undef ]");
	case TRUST_NEVER: return _("[ never ]");
	case TRUST_MARGINAL: return _("[marginal]");
	case TRUST_FULLY: return _("[ full ]");
	case TRUST_ULTIMATE: return _("[ultimate]");
	}
	}

	return "err";
	}



	/*
	* Return the assigned ownertrust value for the given public key.
	* The key should be the primary key.
	*/
	unsigned int
	get_ownertrust (PKT_public_key *pk)
	{
	#ifdef NO_TRUST_MODELS
	(void)pk;
	return TRUST_UNKNOWN;
	#else
	return tdb_get_ownertrust (pk);
	#endif
	}


	/*
	* Same as get_ownertrust but this takes the minimum ownertrust value
	- * into into account, and will bump up the value as needed.
	+ * into account, and will bump up the value as needed.
	*/
	static int
	get_ownertrust_with_min (PKT_public_key *pk)
	{
	#ifdef NO_TRUST_MODELS
	(void)pk;
	return TRUST_UNKNOWN;
	#else
	unsigned int otrust, otrust_min;

	otrust = (tdb_get_ownertrust (pk) & TRUST_MASK);
	otrust_min = tdb_get_min_ownertrust (pk);
	if (otrust < otrust_min)
	{
	/* If the trust that the user has set is less than the trust
	that was calculated from a trust signature chain, use the
	higher of the two. We do this here and not in
	get_ownertrust since the underlying ownertrust should not
	really be set - just the appearance of the ownertrust. */

	otrust = otrust_min;
	}

	return otrust;
	#endif
	}


	/*
	* Same as get_ownertrust but return a trust letter instead of an
	* value. This takes the minimum ownertrust value into account.
	*/
	int
	get_ownertrust_info (PKT_public_key *pk)
	{
	return trust_letter (get_ownertrust_with_min (pk));
	}


	/*
	* Same as get_ownertrust but return a trust string instead of an
	* value. This takes the minimum ownertrust value into account.
	*/
	const char *
	get_ownertrust_string (PKT_public_key *pk)
	{
	return trust_value_to_string (get_ownertrust_with_min (pk));
	}


	/*
	* Set the trust value of the given public key to the new value.
	* The key should be a primary one.
	*/
	void
	update_ownertrust (PKT_public_key *pk, unsigned int new_trust)
	{
	#ifdef NO_TRUST_MODELS
	(void)pk;
	(void)new_trust;
	#else
	tdb_update_ownertrust (pk, new_trust);
	#endif
	}


	int
	clear_ownertrusts (PKT_public_key *pk)
	{
	#ifdef NO_TRUST_MODELS
	(void)pk;
	return 0;
	#else
	return tdb_clear_ownertrusts (pk);
	#endif
	}


	void
	revalidation_mark (void)
	{
	#ifndef NO_TRUST_MODELS
	tdb_revalidation_mark ();
	#endif
	}


	void
	check_trustdb_stale (ctrl_t ctrl)
	{
	#ifndef NO_TRUST_MODELS
	tdb_check_trustdb_stale (ctrl);
	#else
	(void)ctrl;
	#endif
	}


	void
	check_or_update_trustdb (ctrl_t ctrl)
	{
	#ifndef NO_TRUST_MODELS
	tdb_check_or_update (ctrl);
	#else
	(void)ctrl;
	#endif
	}


	/*
	* Return the validity information for KB/PK (at least one must be
	* non-NULL). If the namehash is not NULL, the validity of the
	* corresponding user ID is returned, otherwise, a reasonable value
	* for the entire key is returned.
	*/
	unsigned int
	get_validity (ctrl_t ctrl, kbnode_t kb, PKT_public_key pk, PKT_user_id uid,
	PKT_signature *sig, int may_ask)
	{
	int rc;
	unsigned int validity;
	u32 kid[2];
	PKT_public_key *main_pk;

	if (kb && pk)
	log_assert (keyid_cmp (pk_main_keyid (pk),
	pk_main_keyid (kb->pkt->pkt.public_key)) == 0);

	if (! pk)
	{
	log_assert (kb);
	pk = kb->pkt->pkt.public_key;
	}

	if (uid)
	namehash_from_uid (uid);

	keyid_from_pk (pk, kid);
	if (pk->main_keyid[0] != kid[0] \|\| pk->main_keyid[1] != kid[1])
	{
	/* This is a subkey - get the mainkey. */
	if (kb)
	main_pk = kb->pkt->pkt.public_key;
	else
	{
	main_pk = xmalloc_clear (sizeof *main_pk);
	rc = get_pubkey (main_pk, pk->main_keyid);
	if (rc)
	{
	char *tempkeystr = xstrdup (keystr (pk->main_keyid));
	log_error ("error getting main key %s of subkey %s: %s\n",
	tempkeystr, keystr (kid), gpg_strerror (rc));
	xfree (tempkeystr);
	validity = TRUST_UNKNOWN;
	goto leave;
	}
	}
	}
	else
	main_pk = pk;

	#ifdef NO_TRUST_MODELS
	validity = TRUST_UNKNOWN;
	#else
	validity = tdb_get_validity_core (ctrl, kb, pk, uid, main_pk, sig, may_ask);
	#endif

	leave:
	/* Set some flags direct from the key */
	if (main_pk->flags.revoked)
	validity \|= TRUST_FLAG_REVOKED;
	if (main_pk != pk && pk->flags.revoked)
	validity \|= TRUST_FLAG_SUB_REVOKED;
	/* Note: expiration is a trust value and not a flag - don't know why
	* I initially designed it that way. */
	if (main_pk->has_expired \|\| pk->has_expired)
	validity = ((validity & (~TRUST_MASK \| TRUST_FLAG_PENDING_CHECK))
	\| TRUST_EXPIRED);

	if (main_pk != pk && !kb)
	free_public_key (main_pk);
	return validity;
	}


	int
	get_validity_info (ctrl_t ctrl, kbnode_t kb, PKT_public_key *pk,
	PKT_user_id *uid)
	{
	int trustlevel;

	if (kb && pk)
	log_assert (keyid_cmp (pk_main_keyid (pk),
	pk_main_keyid (kb->pkt->pkt.public_key)) == 0);

	if (! pk && kb)
	pk = kb->pkt->pkt.public_key;
	if (!pk)
	return '?'; /* Just in case a NULL PK is passed. */

	trustlevel = get_validity (ctrl, kb, pk, uid, NULL, 0);
	if ((trustlevel & TRUST_FLAG_REVOKED))
	return 'r';
	return trust_letter (trustlevel);
	}


	const char *
	get_validity_string (ctrl_t ctrl, PKT_public_key pk, PKT_user_id uid)
	{
	int trustlevel;

	if (!pk)
	return "err"; /* Just in case a NULL PK is passed. */

	trustlevel = get_validity (ctrl, NULL, pk, uid, NULL, 0);
	if ((trustlevel & TRUST_FLAG_REVOKED))
	return _("revoked");
	return trust_value_to_string (trustlevel);
	}



	/*
	* Mark the signature of the given UID which are used to certify it.
	* To do this, we first revmove all signatures which are not valid and
	* from the remain ones we look for the latest one. If this is not a
	* certification revocation signature we mark the signature by setting
	* node flag bit 8. Revocations are marked with flag 11, and sigs
	* from unavailable keys are marked with flag 12. Note that flag bits
	* 9 and 10 are used for internal purposes.
	*/
	void
	mark_usable_uid_certs (kbnode_t keyblock, kbnode_t uidnode,
	u32 main_kid, struct key_item klist,
	u32 curtime, u32 *next_expire)
	{
	kbnode_t node;
	PKT_signature *sig;

	/* First check all signatures. */
	for (node=uidnode->next; node; node = node->next)
	{
	int rc;

	node->flag &= ~(1<<8 \| 1<<9 \| 1<<10 \| 1<<11 \| 1<<12);
	if (node->pkt->pkttype == PKT_USER_ID
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	break; /* ready */
	if (node->pkt->pkttype != PKT_SIGNATURE)
	continue;
	sig = node->pkt->pkt.signature;
	if (main_kid
	&& sig->keyid[0] == main_kid[0] && sig->keyid[1] == main_kid[1])
	continue; /* ignore self-signatures if we pass in a main_kid */
	if (!IS_UID_SIG(sig) && !IS_UID_REV(sig))
	continue; /* we only look at these signature classes */
	if(sig->sig_class>=0x11 && sig->sig_class<=0x13 &&
	sig->sig_class-0x10<opt.min_cert_level)
	continue; /* treat anything under our min_cert_level as an
	invalid signature */
	if (klist && !is_in_klist (klist, sig))
	continue; /* no need to check it then */
	if ((rc=check_key_signature (keyblock, node, NULL)))
	{
	/* we ignore anything that won't verify, but tag the
	no_pubkey case */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	node->flag \|= 1<<12;
	continue;
	}
	node->flag \|= 1<<9;
	}
	/* Reset the remaining flags. */
	for (; node; node = node->next)
	node->flag &= ~(1<<8 \| 1<<9 \| 1<<10 \| 1<<11 \| 1<<12);

	/* kbnode flag usage: bit 9 is here set for signatures to consider,
	* bit 10 will be set by the loop to keep track of keyIDs already
	* processed, bit 8 will be set for the usable signatures, and bit
	* 11 will be set for usable revocations. */

	/* For each cert figure out the latest valid one. */
	for (node=uidnode->next; node; node = node->next)
	{
	KBNODE n, signode;
	u32 kid[2];
	u32 sigdate;

	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	break;
	if ( !(node->flag & (1<<9)) )
	continue; /* not a node to look at */
	if ( (node->flag & (1<<10)) )
	continue; /* signature with a keyID already processed */
	node->flag \|= (1<<10); /* mark this node as processed */
	sig = node->pkt->pkt.signature;
	signode = node;
	sigdate = sig->timestamp;
	kid[0] = sig->keyid[0]; kid[1] = sig->keyid[1];

	/* Now find the latest and greatest signature */
	for (n=uidnode->next; n; n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n->pkt->pkttype == PKT_SECRET_SUBKEY)
	break;
	if ( !(n->flag & (1<<9)) )
	continue;
	if ( (n->flag & (1<<10)) )
	continue; /* shortcut already processed signatures */
	sig = n->pkt->pkt.signature;
	if (kid[0] != sig->keyid[0] \|\| kid[1] != sig->keyid[1])
	continue;
	n->flag \|= (1<<10); /* mark this node as processed */

	/* If signode is nonrevocable and unexpired and n isn't,
	then take signode (skip). It doesn't matter which is
	older: if signode was older then we don't want to take n
	as signode is nonrevocable. If n was older then we're
	automatically fine. */

	if(((IS_UID_SIG(signode->pkt->pkt.signature) &&
	!signode->pkt->pkt.signature->flags.revocable &&
	(signode->pkt->pkt.signature->expiredate==0 \|\|
	signode->pkt->pkt.signature->expiredate>curtime))) &&
	(!(IS_UID_SIG(n->pkt->pkt.signature) &&
	!n->pkt->pkt.signature->flags.revocable &&
	(n->pkt->pkt.signature->expiredate==0 \|\|
	n->pkt->pkt.signature->expiredate>curtime))))
	continue;

	/* If n is nonrevocable and unexpired and signode isn't,
	then take n. Again, it doesn't matter which is older: if
	n was older then we don't want to take signode as n is
	nonrevocable. If signode was older then we're
	automatically fine. */

	if((!(IS_UID_SIG(signode->pkt->pkt.signature) &&
	!signode->pkt->pkt.signature->flags.revocable &&
	(signode->pkt->pkt.signature->expiredate==0 \|\|
	signode->pkt->pkt.signature->expiredate>curtime))) &&
	((IS_UID_SIG(n->pkt->pkt.signature) &&
	!n->pkt->pkt.signature->flags.revocable &&
	(n->pkt->pkt.signature->expiredate==0 \|\|
	n->pkt->pkt.signature->expiredate>curtime))))
	{
	signode = n;
	sigdate = sig->timestamp;
	continue;
	}

	/* At this point, if it's newer, it goes in as the only
	remaining possibilities are signode and n are both either
	revocable or expired or both nonrevocable and unexpired.
	If the timestamps are equal take the later ordered
	packet, presuming that the key packets are hopefully in
	their original order. */

	if (sig->timestamp >= sigdate)
	{
	signode = n;
	sigdate = sig->timestamp;
	}
	}

	sig = signode->pkt->pkt.signature;
	if (IS_UID_SIG (sig))
	{ /* this seems to be a usable one which is not revoked.
	* Just need to check whether there is an expiration time,
	* We do the expired certification after finding a suitable
	* certification, the assumption is that a signator does not
	* want that after the expiration of his certificate the
	* system falls back to an older certification which has a
	* different expiration time */
	const byte *p;
	u32 expire;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_SIG_EXPIRE, NULL );
	expire = p? sig->timestamp + buf32_to_u32(p) : 0;

	if (expire==0 \|\| expire > curtime )
	{
	signode->flag \|= (1<<8); /* yeah, found a good cert */
	if (next_expire && expire && expire < *next_expire)
	*next_expire = expire;
	}
	}
	else
	signode->flag \|= (1<<11);
	}
	}


	static int
	clean_sigs_from_uid (kbnode_t keyblock, kbnode_t uidnode,
	int noisy, int self_only)
	{
	int deleted = 0;
	kbnode_t node;
	u32 keyid[2];

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_SECRET_KEY);

	keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);

	/* Passing in a 0 for current time here means that we'll never weed
	out an expired sig. This is correct behavior since we want to
	keep the most recent expired sig in a series. */
	mark_usable_uid_certs (keyblock, uidnode, NULL, NULL, 0, NULL);

	/* What we want to do here is remove signatures that are not
	considered as part of the trust calculations. Thus, all invalid
	signatures are out, as are any signatures that aren't the last of
	a series of uid sigs or revocations It breaks down like this:
	coming out of mark_usable_uid_certs, if a sig is unflagged, it is
	not even a candidate. If a sig has flag 9 or 10, that means it
	was selected as a candidate and vetted. If a sig has flag 8 it
	is a usable signature. If a sig has flag 11 it is a usable
	revocation. If a sig has flag 12 it was issued by an unavailable
	key. "Usable" here means the most recent valid
	signature/revocation in a series from a particular signer.

	Delete everything that isn't a usable uid sig (which might be
	expired), a usable revocation, or a sig from an unavailable
	key. */

	for (node=uidnode->next;
	node && node->pkt->pkttype==PKT_SIGNATURE;
	node=node->next)
	{
	int keep;

	keep = self_only? (node->pkt->pkt.signature->keyid[0] == keyid[0]
	&& node->pkt->pkt.signature->keyid[1] == keyid[1]) : 1;

	/* Keep usable uid sigs ... */
	if ((node->flag & (1<<8)) && keep)
	continue;

	/* ... and usable revocations... */
	if ((node->flag & (1<<11)) && keep)
	continue;

	/* ... and sigs from unavailable keys. */
	/* disabled for now since more people seem to want sigs from
	unavailable keys removed altogether. */
	/*
	if(node->flag & (1<<12))
	continue;
	*/

	/* Everything else we delete */

	/* At this point, if 12 is set, the signing key was unavailable.
	If 9 or 10 is set, it's superseded. Otherwise, it's
	invalid. */

	if (noisy)
	log_info ("removing signature from key %s on user ID \"%s\": %s\n",
	keystr (node->pkt->pkt.signature->keyid),
	uidnode->pkt->pkt.user_id->name,
	node->flag&(1<<12)? "key unavailable":
	node->flag&(1<<9)? "signature superseded"
	/* */ :"invalid signature" );

	delete_kbnode (node);
	deleted++;
	}

	return deleted;
	}


	/* This is substantially easier than clean_sigs_from_uid since we just
	have to establish if the uid has a valid self-sig, is not revoked,
	and is not expired. Note that this does not take into account
	whether the uid has a trust path to it - just whether the keyholder
	themselves has certified the uid. Returns true if the uid was
	compacted. To "compact" a user ID, we simply remove ALL signatures
	except the self-sig that caused the user ID to be remove-worthy.
	We don't actually remove the user ID packet itself since it might
	be resurrected in a later merge. Note that this function requires
	that the caller has already done a merge_keys_and_selfsig().

	TODO: change the import code to allow importing a uid with only a
	revocation if the uid already exists on the keyring. */

	static int
	clean_uid_from_key (kbnode_t keyblock, kbnode_t uidnode, int noisy)
	{
	kbnode_t node;
	PKT_user_id *uid = uidnode->pkt->pkt.user_id;
	int deleted = 0;

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_SECRET_KEY);
	log_assert (uidnode->pkt->pkttype==PKT_USER_ID);

	/* Skip valid user IDs, compacted user IDs, and non-self-signed user
	IDs if --allow-non-selfsigned-uid is set. */
	if (uid->created
	\|\| uid->flags.compacted
	\|\| (!uid->is_expired && !uid->is_revoked && opt.allow_non_selfsigned_uid))
	return 0;

	for (node=uidnode->next;
	node && node->pkt->pkttype == PKT_SIGNATURE;
	node=node->next)
	{
	if (!node->pkt->pkt.signature->flags.chosen_selfsig)
	{
	delete_kbnode (node);
	deleted = 1;
	uidnode->pkt->pkt.user_id->flags.compacted = 1;
	}
	}

	if (noisy)
	{
	const char *reason;
	char *user = utf8_to_native (uid->name, uid->len, 0);

	if (uid->is_revoked)
	reason = _("revoked");
	else if (uid->is_expired)
	reason = _("expired");
	else
	reason = _("invalid");

	log_info ("compacting user ID \"%s\" on key %s: %s\n",
	user, keystr_from_pk (keyblock->pkt->pkt.public_key),
	reason);

	xfree (user);
	}

	return deleted;
	}


	/* Needs to be called after a merge_keys_and_selfsig() */
	void
	clean_one_uid (kbnode_t keyblock, kbnode_t uidnode, int noisy, int self_only,
	int uids_cleaned, int sigs_cleaned)
	{
	int dummy = 0;

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_SECRET_KEY);
	log_assert (uidnode->pkt->pkttype==PKT_USER_ID);

	if (!uids_cleaned)
	uids_cleaned = &dummy;

	if (!sigs_cleaned)
	sigs_cleaned = &dummy;

	/* Do clean_uid_from_key first since if it fires off, we don't have
	to bother with the other. */
	*uids_cleaned += clean_uid_from_key (keyblock, uidnode, noisy);
	if (!uidnode->pkt->pkt.user_id->flags.compacted)
	*sigs_cleaned += clean_sigs_from_uid (keyblock, uidnode, noisy, self_only);
	}


	/* NB: This function marks the deleted nodes only and the caller is
	* responsible to skip or remove them. */
	void
	clean_key (kbnode_t keyblock, int noisy, int self_only,
	int uids_cleaned, int sigs_cleaned)
	{
	kbnode_t node;

	merge_keys_and_selfsig (keyblock);

	for (node = keyblock->next;
	node && !(node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY);
	node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	clean_one_uid (keyblock, node, noisy, self_only,
	uids_cleaned, sigs_cleaned);
	}

	/* Remove bogus subkey binding signatures: The only signatures
	* allowed are of class 0x18 and 0x28. */
	log_assert (!node \|\| (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY));
	for (; node; node = node->next)
	{
	if (is_deleted_kbnode (node))
	continue;
	if (node->pkt->pkttype == PKT_SIGNATURE
	&& !(IS_SUBKEY_SIG (node->pkt->pkt.signature)
	\|\| IS_SUBKEY_REV (node->pkt->pkt.signature)))
	{
	delete_kbnode (node);
	if (sigs_cleaned)
	++*sigs_cleaned;
	}
	}
	}
	diff --git a/g10/trustdb.c b/g10/trustdb.c
	index 75714ab6e..103f83ec9 100644
	--- a/g10/trustdb.c
	+++ b/g10/trustdb.c
	@@ -1,2204 +1,2204 @@
	/* trustdb.c
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2012 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#ifndef DISABLE_REGEX
	#include <sys/types.h>
	#include <regex.h>
	#endif /* !DISABLE_REGEX */

	#include "gpg.h"
	#include "status.h"
	#include "iobuf.h"
	#include "keydb.h"
	#include "util.h"
	#include "options.h"
	#include "packet.h"
	#include "main.h"
	#include "mbox-util.h"
	#include "i18n.h"
	#include "tdbio.h"
	#include "trustdb.h"
	#include "tofu.h"


	typedef struct key_item *KeyHashTable; / see new_key_hash_table() */

	/*
	* Structure to keep track of keys, this is used as an array wherre
	* the item right after the last one has a keyblock set to NULL.
	* Maybe we can drop this thing and replace it by key_item
	*/
	struct key_array
	{
	KBNODE keyblock;
	};


	/* Control information for the trust DB. */
	static struct
	{
	int init;
	int level;
	char *dbname;
	int no_trustdb;
	} trustdb_args;

	/* Some globals. */
	static struct key_item user_utk_list; / temp. used to store --trusted-keys */
	static struct key_item utk_list; / all ultimately trusted keys */

	static int pending_check_trustdb;

	static int validate_keys (ctrl_t ctrl, int interactive);


	/**********************************************
	*********** some helpers *****************
	**********************************************/

	static struct key_item *
	new_key_item (void)
	{
	struct key_item *k;

	k = xmalloc_clear (sizeof *k);
	return k;
	}

	static void
	release_key_items (struct key_item *k)
	{
	struct key_item *k2;

	for (; k; k = k2)
	{
	k2 = k->next;
	xfree (k->trust_regexp);
	xfree (k);
	}
	}

	#define KEY_HASH_TABLE_SIZE 1024

	/*
	* For fast keylook up we need a hash table. Each byte of a KeyID
	* should be distributed equally over the 256 possible values (except
	* for v3 keyIDs but we consider them as not important here). So we
	* can just use 10 bits to index a table of KEY_HASH_TABLE_SIZE key items.
	* Possible optimization: Do not use key_items but other hash_table when the
	* duplicates lists get too large.
	*/
	static KeyHashTable
	new_key_hash_table (void)
	{
	struct key_item **tbl;

	tbl = xmalloc_clear (KEY_HASH_TABLE_SIZE * sizeof *tbl);
	return tbl;
	}

	static void
	release_key_hash_table (KeyHashTable tbl)
	{
	int i;

	if (!tbl)
	return;
	for (i=0; i < KEY_HASH_TABLE_SIZE; i++)
	release_key_items (tbl[i]);
	xfree (tbl);
	}

	/*
	* Returns: True if the keyID is in the given hash table
	*/
	static int
	test_key_hash_table (KeyHashTable tbl, u32 *kid)
	{
	struct key_item *k;

	for (k = tbl[(kid[1] % KEY_HASH_TABLE_SIZE)]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return 1;
	return 0;
	}

	/*
	* Add a new key to the hash table. The key is identified by its key ID.
	*/
	static void
	add_key_hash_table (KeyHashTable tbl, u32 *kid)
	{
	int i = kid[1] % KEY_HASH_TABLE_SIZE;
	struct key_item k, kk;

	for (k = tbl[i]; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return; /* already in table */

	kk = new_key_item ();
	kk->kid[0] = kid[0];
	kk->kid[1] = kid[1];
	kk->next = tbl[i];
	tbl[i] = kk;
	}

	/*
	* Release a key_array
	*/
	static void
	release_key_array ( struct key_array *keys )
	{
	struct key_array *k;

	if (keys) {
	for (k=keys; k->keyblock; k++)
	release_kbnode (k->keyblock);
	xfree (keys);
	}
	}


	/*********************************************
	******** Initialization ***************
	*********************************************/



	/*
	* Used to register extra ultimately trusted keys - this has to be done
	* before initializing the validation module.
	* FIXME: Should be replaced by a function to add those keys to the trustdb.
	*/
	void
	tdb_register_trusted_keyid (u32 *keyid)
	{
	struct key_item *k;

	k = new_key_item ();
	k->kid[0] = keyid[0];
	k->kid[1] = keyid[1];
	k->next = user_utk_list;
	user_utk_list = k;
	}

	void
	tdb_register_trusted_key( const char *string )
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;

	err = classify_user_id (string, &desc, 1);
	if (err \|\| desc.mode != KEYDB_SEARCH_MODE_LONG_KID )
	{
	log_error(_("'%s' is not a valid long keyID\n"), string );
	return;
	}

	register_trusted_keyid(desc.u.kid);
	}

	/*
	* Helper to add a key to the global list of ultimately trusted keys.
	- * Retruns: true = inserted, false = already in in list.
	+ * Retruns: true = inserted, false = already in list.
	*/
	static int
	add_utk (u32 *kid)
	{
	struct key_item *k;

	if (tdb_keyid_is_utk (kid))
	return 0;

	k = new_key_item ();
	k->kid[0] = kid[0];
	k->kid[1] = kid[1];
	k->ownertrust = TRUST_ULTIMATE;
	k->next = utk_list;
	utk_list = k;
	if( opt.verbose > 1 )
	log_info(_("key %s: accepted as trusted key\n"), keystr(kid));
	return 1;
	}


	/****************
	* Verify that all our secret keys are usable and put them into the utk_list.
	*/
	static void
	verify_own_keys(void)
	{
	TRUSTREC rec;
	ulong recnum;
	int rc;
	struct key_item *k;

	if (utk_list)
	return;

	/* scan the trustdb to find all ultimately trusted keys */
	for (recnum=1; !tdbio_read_record (recnum, &rec, 0); recnum++ )
	{
	if ( rec.rectype == RECTYPE_TRUST
	&& (rec.r.trust.ownertrust & TRUST_MASK) == TRUST_ULTIMATE)
	{
	byte *fpr = rec.r.trust.fingerprint;
	int fprlen;
	u32 kid[2];

	/* Problem: We do only use fingerprints in the trustdb but
	* we need the keyID here to indetify the key; we can only
	* use that ugly hack to distinguish between 16 and 20
	* butes fpr - it does not work always so we better change
	* the whole validation code to only work with
	* fingerprints */
	fprlen = (!fpr[16] && !fpr[17] && !fpr[18] && !fpr[19])? 16:20;
	keyid_from_fingerprint (fpr, fprlen, kid);
	if (!add_utk (kid))
	log_info(_("key %s occurs more than once in the trustdb\n"),
	keystr(kid));
	}
	}

	/* Put any --trusted-key keys into the trustdb */
	for (k = user_utk_list; k; k = k->next)
	{
	if ( add_utk (k->kid) )
	{ /* not yet in trustDB as ultimately trusted */
	PKT_public_key pk;

	memset (&pk, 0, sizeof pk);
	rc = get_pubkey (&pk, k->kid);
	if (rc)
	log_info(_("key %s: no public key for trusted key - skipped\n"),
	keystr(k->kid));
	else
	{
	tdb_update_ownertrust (&pk,
	((tdb_get_ownertrust (&pk) & ~TRUST_MASK)
	\| TRUST_ULTIMATE ));
	release_public_key_parts (&pk);
	}

	log_info (_("key %s marked as ultimately trusted\n"),keystr(k->kid));
	}
	}

	/* release the helper table table */
	release_key_items (user_utk_list);
	user_utk_list = NULL;
	return;
	}

	/* Returns whether KID is on the list of ultimately trusted keys. */
	int
	tdb_keyid_is_utk (u32 *kid)
	{
	struct key_item *k;

	for (k = utk_list; k; k = k->next)
	if (k->kid[0] == kid[0] && k->kid[1] == kid[1])
	return 1;

	return 0;
	}

	/* Return the list of ultimately trusted keys. */
	struct key_item *
	tdb_utks (void)
	{
	return utk_list;
	}

	/*********************************************
	********* TrustDB stuff *****************
	*********************************************/

	/*
	* Read a record but die if it does not exist
	*/
	static void
	read_record (ulong recno, TRUSTREC *rec, int rectype )
	{
	int rc = tdbio_read_record (recno, rec, rectype);
	if (rc)
	{
	log_error(_("trust record %lu, req type %d: read failed: %s\n"),
	recno, rec->rectype, gpg_strerror (rc) );
	tdbio_invalid();
	}
	if (rectype != rec->rectype)
	{
	log_error(_("trust record %lu is not of requested type %d\n"),
	rec->recnum, rectype);
	tdbio_invalid();
	}
	}

	/*
	* Write a record and die on error
	*/
	static void
	write_record (TRUSTREC *rec)
	{
	int rc = tdbio_write_record (rec);
	if (rc)
	{
	log_error(_("trust record %lu, type %d: write failed: %s\n"),
	rec->recnum, rec->rectype, gpg_strerror (rc) );
	tdbio_invalid();
	}
	}

	/*
	* sync the TrustDb and die on error
	*/
	static void
	do_sync(void)
	{
	int rc = tdbio_sync ();
	if(rc)
	{
	log_error (_("trustdb: sync failed: %s\n"), gpg_strerror (rc) );
	g10_exit(2);
	}
	}

	const char *
	trust_model_string (int model)
	{
	switch (model)
	{
	case TM_CLASSIC: return "classic";
	case TM_PGP: return "pgp";
	case TM_EXTERNAL: return "external";
	case TM_TOFU: return "tofu";
	case TM_TOFU_PGP: return "tofu+pgp";
	case TM_ALWAYS: return "always";
	case TM_DIRECT: return "direct";
	default: return "unknown";
	}
	}

	/****************
	* Perform some checks over the trustdb
	* level 0: only open the db
	* 1: used for initial program startup
	*/
	int
	setup_trustdb( int level, const char *dbname )
	{
	/* just store the args */
	if( trustdb_args.init )
	return 0;
	trustdb_args.level = level;
	trustdb_args.dbname = dbname? xstrdup(dbname): NULL;
	return 0;
	}

	void
	how_to_fix_the_trustdb ()
	{
	const char *name = trustdb_args.dbname;

	if (!name)
	name = "trustdb.gpg";

	log_info (_("You may try to re-create the trustdb using the commands:\n"));
	log_info (" cd %s\n", default_homedir ());
	log_info (" %s --export-ownertrust > otrust.tmp\n", GPG_NAME);
	#ifdef HAVE_W32_SYSTEM
	log_info (" del %s\n", name);
	#else
	log_info (" rm %s\n", name);
	#endif
	log_info (" %s --import-ownertrust < otrust.tmp\n", GPG_NAME);
	log_info (_("If that does not work, please consult the manual\n"));
	}


	void
	init_trustdb ()
	{
	int level = trustdb_args.level;
	const char* dbname = trustdb_args.dbname;

	if( trustdb_args.init )
	return;

	trustdb_args.init = 1;

	if(level==0 \|\| level==1)
	{
	int rc = tdbio_set_dbname( dbname, !!level, &trustdb_args.no_trustdb);
	if( rc )
	log_fatal("can't init trustdb: %s\n", gpg_strerror (rc) );
	}
	else
	BUG();

	if(opt.trust_model==TM_AUTO)
	{
	/* Try and set the trust model off of whatever the trustdb says
	it is. */
	opt.trust_model=tdbio_read_model();

	/* Sanity check this ;) */
	if(opt.trust_model != TM_CLASSIC
	&& opt.trust_model != TM_PGP
	&& opt.trust_model != TM_TOFU_PGP
	&& opt.trust_model != TM_TOFU
	&& opt.trust_model != TM_EXTERNAL)
	{
	log_info(_("unable to use unknown trust model (%d) - "
	"assuming %s trust model\n"),opt.trust_model,"pgp");
	opt.trust_model = TM_PGP;
	}

	if(opt.verbose)
	log_info(_("using %s trust model\n"),
	trust_model_string (opt.trust_model));
	}

	if (opt.trust_model==TM_PGP \|\| opt.trust_model==TM_CLASSIC
	\|\| opt.trust_model == TM_TOFU \|\| opt.trust_model == TM_TOFU_PGP)
	{
	/* Verify the list of ultimately trusted keys and move the
	--trusted-keys list there as well. */
	if(level==1)
	verify_own_keys();

	if(!tdbio_db_matches_options())
	pending_check_trustdb=1;
	}
	}


	/****************
	* Recreate the WoT but do not ask for new ownertrusts. Special
	* feature: In batch mode and without a forced yes, this is only done
	* when a check is due. This can be used to run the check from a crontab
	*/
	void
	check_trustdb (ctrl_t ctrl)
	{
	init_trustdb();
	if (opt.trust_model == TM_PGP \|\| opt.trust_model == TM_CLASSIC
	\|\| opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU)
	{
	if (opt.batch && !opt.answer_yes)
	{
	ulong scheduled;

	scheduled = tdbio_read_nextcheck ();
	if (!scheduled)
	{
	log_info (_("no need for a trustdb check\n"));
	return;
	}

	if (scheduled > make_timestamp ())
	{
	log_info (_("next trustdb check due at %s\n"),
	strtimestamp (scheduled));
	return;
	}
	}

	validate_keys (ctrl, 0);
	}
	else
	log_info (_("no need for a trustdb check with '%s' trust model\n"),
	trust_model_string(opt.trust_model));
	}


	/*
	* Recreate the WoT.
	*/
	void
	update_trustdb (ctrl_t ctrl)
	{
	init_trustdb ();
	if (opt.trust_model == TM_PGP \|\| opt.trust_model == TM_CLASSIC
	\|\| opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU)
	validate_keys (ctrl, 1);
	else
	log_info (_("no need for a trustdb update with '%s' trust model\n"),
	trust_model_string(opt.trust_model));
	}

	void
	tdb_revalidation_mark (void)
	{
	init_trustdb();
	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return;

	/* We simply set the time for the next check to 1 (far back in 1970)
	so that a --update-trustdb will be scheduled. */
	if (tdbio_write_nextcheck (1))
	do_sync ();
	pending_check_trustdb = 1;
	}

	int
	trustdb_pending_check(void)
	{
	return pending_check_trustdb;
	}

	/* If the trustdb is dirty, and we're interactive, update it.
	Otherwise, check it unless no-auto-check-trustdb is set. */
	void
	tdb_check_or_update (ctrl_t ctrl)
	{
	if (trustdb_pending_check ())
	{
	if (opt.interactive)
	update_trustdb (ctrl);
	else if (!opt.no_auto_check_trustdb)
	check_trustdb (ctrl);
	}
	}

	void
	read_trust_options(byte trust_model,ulong created,ulong *nextcheck,
	byte marginals,byte completes,byte *cert_depth,
	byte *min_cert_level)
	{
	TRUSTREC opts;

	init_trustdb();
	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	memset (&opts, 0, sizeof opts);
	else
	read_record (0, &opts, RECTYPE_VER);

	if(trust_model)
	*trust_model=opts.r.ver.trust_model;
	if(created)
	*created=opts.r.ver.created;
	if(nextcheck)
	*nextcheck=opts.r.ver.nextcheck;
	if(marginals)
	*marginals=opts.r.ver.marginals;
	if(completes)
	*completes=opts.r.ver.completes;
	if(cert_depth)
	*cert_depth=opts.r.ver.cert_depth;
	if(min_cert_level)
	*min_cert_level=opts.r.ver.min_cert_level;
	}

	/***********************************************
	********* Ownertrust et al. **************
	***********************************************/

	static int
	read_trust_record (PKT_public_key pk, TRUSTREC rec)
	{
	int rc;

	init_trustdb();
	rc = tdbio_search_trust_bypk (pk, rec);
	if (rc)
	{
	if (gpg_err_code (rc) != GPG_ERR_NOT_FOUND)
	log_error ("trustdb: searching trust record failed: %s\n",
	gpg_strerror (rc));
	return rc;
	}

	if (rec->rectype != RECTYPE_TRUST)
	{
	log_error ("trustdb: record %lu is not a trust record\n",
	rec->recnum);
	return GPG_ERR_TRUSTDB;
	}

	return 0;
	}

	/****************
	* Return the assigned ownertrust value for the given public key.
	* The key should be the primary key.
	*/
	unsigned int
	tdb_get_ownertrust ( PKT_public_key *pk)
	{
	TRUSTREC rec;
	gpg_error_t err;

	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return TRUST_UNKNOWN;

	err = read_trust_record (pk, &rec);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	return TRUST_UNKNOWN; /* no record yet */
	if (err)
	{
	tdbio_invalid ();
	return TRUST_UNKNOWN; /* actually never reached */
	}

	return rec.r.trust.ownertrust;
	}


	unsigned int
	tdb_get_min_ownertrust (PKT_public_key *pk)
	{
	TRUSTREC rec;
	gpg_error_t err;

	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return TRUST_UNKNOWN;

	err = read_trust_record (pk, &rec);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	return TRUST_UNKNOWN; /* no record yet */
	if (err)
	{
	tdbio_invalid ();
	return TRUST_UNKNOWN; /* actually never reached */
	}

	return rec.r.trust.min_ownertrust;
	}


	/*
	* Set the trust value of the given public key to the new value.
	* The key should be a primary one.
	*/
	void
	tdb_update_ownertrust (PKT_public_key *pk, unsigned int new_trust )
	{
	TRUSTREC rec;
	gpg_error_t err;

	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return;

	err = read_trust_record (pk, &rec);
	if (!err)
	{
	if (DBG_TRUST)
	log_debug ("update ownertrust from %u to %u\n",
	(unsigned int)rec.r.trust.ownertrust, new_trust );
	if (rec.r.trust.ownertrust != new_trust)
	{
	rec.r.trust.ownertrust = new_trust;
	write_record( &rec );
	tdb_revalidation_mark ();
	do_sync ();
	}
	}
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{ /* no record yet - create a new one */
	size_t dummy;

	if (DBG_TRUST)
	log_debug ("insert ownertrust %u\n", new_trust );

	memset (&rec, 0, sizeof rec);
	rec.recnum = tdbio_new_recnum ();
	rec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, rec.r.trust.fingerprint, &dummy);
	rec.r.trust.ownertrust = new_trust;
	write_record (&rec);
	tdb_revalidation_mark ();
	do_sync ();
	}
	else
	{
	tdbio_invalid ();
	}
	}

	static void
	update_min_ownertrust (u32 *kid, unsigned int new_trust )
	{
	PKT_public_key *pk;
	TRUSTREC rec;
	gpg_error_t err;

	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return;

	pk = xmalloc_clear (sizeof *pk);
	err = get_pubkey (pk, kid);
	if (err)
	{
	log_error (_("public key %s not found: %s\n"),
	keystr (kid), gpg_strerror (err));
	return;
	}

	err = read_trust_record (pk, &rec);
	if (!err)
	{
	if (DBG_TRUST)
	log_debug ("key %08lX%08lX: update min_ownertrust from %u to %u\n",
	(ulong)kid[0],(ulong)kid[1],
	(unsigned int)rec.r.trust.min_ownertrust,
	new_trust );
	if (rec.r.trust.min_ownertrust != new_trust)
	{
	rec.r.trust.min_ownertrust = new_trust;
	write_record( &rec );
	tdb_revalidation_mark ();
	do_sync ();
	}
	}
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{ /* no record yet - create a new one */
	size_t dummy;

	if (DBG_TRUST)
	log_debug ("insert min_ownertrust %u\n", new_trust );

	memset (&rec, 0, sizeof rec);
	rec.recnum = tdbio_new_recnum ();
	rec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, rec.r.trust.fingerprint, &dummy);
	rec.r.trust.min_ownertrust = new_trust;
	write_record (&rec);
	tdb_revalidation_mark ();
	do_sync ();
	}
	else
	{
	tdbio_invalid ();
	}
	}


	/*
	* Clear the ownertrust and min_ownertrust values.
	*
	* Return: True if a change actually happened.
	*/
	int
	tdb_clear_ownertrusts (PKT_public_key *pk)
	{
	TRUSTREC rec;
	gpg_error_t err;

	init_trustdb ();

	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return 0;

	err = read_trust_record (pk, &rec);
	if (!err)
	{
	if (DBG_TRUST)
	{
	log_debug ("clearing ownertrust (old value %u)\n",
	(unsigned int)rec.r.trust.ownertrust);
	log_debug ("clearing min_ownertrust (old value %u)\n",
	(unsigned int)rec.r.trust.min_ownertrust);
	}
	if (rec.r.trust.ownertrust \|\| rec.r.trust.min_ownertrust)
	{
	rec.r.trust.ownertrust = 0;
	rec.r.trust.min_ownertrust = 0;
	write_record( &rec );
	tdb_revalidation_mark ();
	do_sync ();
	return 1;
	}
	}
	else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	tdbio_invalid ();
	}
	return 0;
	}

	/*
	* Note: Caller has to do a sync
	*/
	static void
	update_validity (PKT_public_key pk, PKT_user_id uid,
	int depth, int validity)
	{
	TRUSTREC trec, vrec;
	gpg_error_t err;
	ulong recno;

	namehash_from_uid(uid);

	err = read_trust_record (pk, &trec);
	if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	tdbio_invalid ();
	return;
	}
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{
	/* No record yet - create a new one. */
	size_t dummy;

	memset (&trec, 0, sizeof trec);
	trec.recnum = tdbio_new_recnum ();
	trec.rectype = RECTYPE_TRUST;
	fingerprint_from_pk (pk, trec.r.trust.fingerprint, &dummy);
	trec.r.trust.ownertrust = 0;
	}

	/* locate an existing one */
	recno = trec.r.trust.validlist;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);
	if ( !memcmp (vrec.r.valid.namehash, uid->namehash, 20) )
	break;
	recno = vrec.r.valid.next;
	}

	if (!recno) /* insert a new validity record */
	{
	memset (&vrec, 0, sizeof vrec);
	vrec.recnum = tdbio_new_recnum ();
	vrec.rectype = RECTYPE_VALID;
	memcpy (vrec.r.valid.namehash, uid->namehash, 20);
	vrec.r.valid.next = trec.r.trust.validlist;
	trec.r.trust.validlist = vrec.recnum;
	}
	vrec.r.valid.validity = validity;
	vrec.r.valid.full_count = uid->help_full_count;
	vrec.r.valid.marginal_count = uid->help_marginal_count;
	write_record (&vrec);
	trec.r.trust.depth = depth;
	write_record (&trec);
	}


	/***********************************************
	******* Query trustdb values ************
	***********************************************/

	/* Return true if key is disabled. Note that this is usually used via
	the pk_is_disabled macro. */
	int
	tdb_cache_disabled_value (PKT_public_key *pk)
	{
	gpg_error_t err;
	TRUSTREC trec;
	int disabled = 0;

	if (pk->flags.disabled_valid)
	return pk->flags.disabled;

	init_trustdb();

	if (trustdb_args.no_trustdb)
	return 0; /* No trustdb => not disabled. */

	err = read_trust_record (pk, &trec);
	if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	tdbio_invalid ();
	goto leave;
	}
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{
	/* No record found, so assume not disabled. */
	goto leave;
	}

	if ((trec.r.trust.ownertrust & TRUST_FLAG_DISABLED))
	disabled = 1;

	/* Cache it for later so we don't need to look at the trustdb every
	time */
	pk->flags.disabled = disabled;
	pk->flags.disabled_valid = 1;

	leave:
	return disabled;
	}


	void
	tdb_check_trustdb_stale (ctrl_t ctrl)
	{
	static int did_nextcheck=0;

	init_trustdb ();

	if (trustdb_args.no_trustdb)
	return; /* No trustdb => can't be stale. */

	if (!did_nextcheck
	&& (opt.trust_model == TM_PGP \|\| opt.trust_model == TM_CLASSIC
	\|\| opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU))
	{
	ulong scheduled;

	did_nextcheck = 1;
	scheduled = tdbio_read_nextcheck ();
	if ((scheduled && scheduled <= make_timestamp ())
	\|\| pending_check_trustdb)
	{
	if (opt.no_auto_check_trustdb)
	{
	pending_check_trustdb = 1;
	if (!opt.quiet)
	log_info (_("please do a --check-trustdb\n"));
	}
	else
	{
	if (!opt.quiet)
	log_info (_("checking the trustdb\n"));
	validate_keys (ctrl, 0);
	}
	}
	}
	}

	/*
	* Return the validity information for KB/PK (at least one of them
	* must be non-NULL). This is the core of get_validity. If SIG is
	* not NULL, then the trust is being evaluated in the context of the
	* provided signature. This is used by the TOFU code to record
	* statistics.
	*/
	unsigned int
	tdb_get_validity_core (ctrl_t ctrl,
	kbnode_t kb,
	PKT_public_key pk, PKT_user_id uid,
	PKT_public_key *main_pk,
	PKT_signature *sig,
	int may_ask)
	{
	TRUSTREC trec, vrec;
	gpg_error_t err = 0;
	ulong recno;
	#ifdef USE_TOFU
	unsigned int tofu_validity = TRUST_UNKNOWN;
	int free_kb = 0;
	#endif
	unsigned int validity = TRUST_UNKNOWN;

	if (kb && pk)
	log_assert (keyid_cmp (pk_main_keyid (pk),
	pk_main_keyid (kb->pkt->pkt.public_key)) == 0);

	if (! pk)
	{
	log_assert (kb);
	pk = kb->pkt->pkt.public_key;
	}

	#ifndef USE_TOFU
	(void)sig;
	(void)may_ask;
	#endif

	init_trustdb ();

	/* If we have no trustdb (which also means it has not been created)
	and the trust-model is always, we don't know the validity -
	return immediately. If we won't do that the tdbio code would try
	to open the trustdb and run into a fatal error. */
	if (trustdb_args.no_trustdb && opt.trust_model == TM_ALWAYS)
	return TRUST_UNKNOWN;

	check_trustdb_stale (ctrl);

	if(opt.trust_model==TM_DIRECT)
	{
	/* Note that this happens BEFORE any user ID stuff is checked.
	The direct trust model applies to keys as a whole. */
	validity = tdb_get_ownertrust (main_pk);
	goto leave;
	}

	#ifdef USE_TOFU
	if (opt.trust_model == TM_TOFU \|\| opt.trust_model == TM_TOFU_PGP)
	{
	kbnode_t n = NULL;
	strlist_t user_id_list = NULL;
	int done = 0;

	/* If the caller didn't supply a user id then use all uids. */
	if (! uid)
	{
	if (! kb)
	{
	kb = get_pubkeyblock (main_pk->keyid);
	free_kb = 1;
	}
	n = kb;
	}

	if (DBG_TRUST && sig && sig->signers_uid)
	log_debug ("TOFU: only considering user id: '%s'\n",
	sig->signers_uid);

	while (!done && (uid \|\| (n = find_next_kbnode (n, PKT_USER_ID))))
	{
	PKT_user_id *user_id;
	int expired = 0;

	if (uid)
	{
	user_id = uid;
	/* If the caller specified a user id, then we only
	process the specified user id and are done after the
	first iteration. */
	done = 1;
	}
	else
	user_id = n->pkt->pkt.user_id;

	if (user_id->attrib_data)
	/* Skip user attributes. */
	continue;

	if (sig && sig->signers_uid)
	/* Make sure the UID matches. */
	{
	char *email = mailbox_from_userid (user_id->name);
	if (!email \|\| !*email \|\| strcmp (sig->signers_uid, email) != 0)
	{
	if (DBG_TRUST)
	log_debug ("TOFU: skipping user id '%s', which does"
	" not match the signer's email ('%s')\n",
	email, sig->signers_uid);
	xfree (email);
	continue;
	}
	xfree (email);
	}

	/* If the user id is revoked or expired, then skip it. */
	if (user_id->is_revoked \|\| user_id->is_expired)
	{
	if (DBG_TRUST)
	{
	char *s;
	if (user_id->is_revoked && user_id->is_expired)
	s = "revoked and expired";
	else if (user_id->is_revoked)
	s = "revoked";
	else
	s = "expire";

	log_debug ("TOFU: Ignoring %s user id (%s)\n",
	s, user_id->name);
	}

	if (user_id->is_revoked)
	continue;

	expired = 1;
	}

	add_to_strlist (&user_id_list, user_id->name);
	user_id_list->flags = expired;
	}

	/* Process the user ids in the order they appear in the key
	block. */
	strlist_rev (&user_id_list);

	/* It only makes sense to observe any signature before getting
	the validity. This is because if the current signature
	results in a conflict, then we damn well want to take that
	into account. */
	if (sig)
	{
	err = tofu_register_signature (ctrl, main_pk, user_id_list,
	sig->digest, sig->digest_len,
	sig->timestamp, "unknown");
	if (err)
	{
	log_error ("TOFU: error registering signature: %s\n",
	gpg_strerror (err));

	tofu_validity = TRUST_UNKNOWN;
	}
	}
	if (! err)
	tofu_validity = tofu_get_validity (ctrl, main_pk, user_id_list,
	may_ask);

	free_strlist (user_id_list);
	if (free_kb)
	release_kbnode (kb);
	}
	#endif /USE_TOFU/

	if (opt.trust_model == TM_TOFU_PGP
	\|\| opt.trust_model == TM_CLASSIC
	\|\| opt.trust_model == TM_PGP)
	{
	err = read_trust_record (main_pk, &trec);
	if (err && gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	tdbio_invalid ();
	return 0;
	}
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{
	/* No record found. */
	validity = TRUST_UNKNOWN;
	goto leave;
	}

	/* Loop over all user IDs */
	recno = trec.r.trust.validlist;
	validity = 0;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);

	if(uid)
	{
	/* If a user ID is given we return the validity for that
	user ID ONLY. If the namehash is not found, then
	there is no validity at all (i.e. the user ID wasn't
	signed). */
	if(memcmp(vrec.r.valid.namehash,uid->namehash,20)==0)
	{
	validity=(vrec.r.valid.validity & TRUST_MASK);
	break;
	}
	}
	else
	{
	/* If no user ID is given, we take the maximum validity
	over all user IDs */
	if (validity < (vrec.r.valid.validity & TRUST_MASK))
	validity = (vrec.r.valid.validity & TRUST_MASK);
	}

	recno = vrec.r.valid.next;
	}

	if ((trec.r.trust.ownertrust & TRUST_FLAG_DISABLED))
	{
	validity \|= TRUST_FLAG_DISABLED;
	pk->flags.disabled = 1;
	}
	else
	pk->flags.disabled = 0;
	pk->flags.disabled_valid = 1;
	}

	leave:
	#ifdef USE_TOFU
	validity = tofu_wot_trust_combine (tofu_validity, validity);
	#else /!USE_TOFU/
	validity &= TRUST_MASK;

	if (validity == TRUST_NEVER)
	/* TRUST_NEVER trumps everything else. */
	validity \|= TRUST_NEVER;
	if (validity == TRUST_EXPIRED)
	/* TRUST_EXPIRED trumps everything but TRUST_NEVER. */
	validity \|= TRUST_EXPIRED;
	#endif /!USE_TOFU/

	if (opt.trust_model != TM_TOFU
	&& pending_check_trustdb)
	validity \|= TRUST_FLAG_PENDING_CHECK;

	return validity;
	}


	static void
	get_validity_counts (PKT_public_key pk, PKT_user_id uid)
	{
	TRUSTREC trec, vrec;
	ulong recno;

	if(pk==NULL \|\| uid==NULL)
	BUG();

	namehash_from_uid(uid);

	uid->help_marginal_count=uid->help_full_count=0;

	init_trustdb ();

	if(read_trust_record (pk, &trec))
	return;

	/* loop over all user IDs */
	recno = trec.r.trust.validlist;
	while (recno)
	{
	read_record (recno, &vrec, RECTYPE_VALID);

	if(memcmp(vrec.r.valid.namehash,uid->namehash,20)==0)
	{
	uid->help_marginal_count=vrec.r.valid.marginal_count;
	uid->help_full_count=vrec.r.valid.full_count;
	/* es_printf("Fetched marginal %d, full %d\n",uid->help_marginal_count,uid->help_full_count); */
	break;
	}

	recno = vrec.r.valid.next;
	}
	}

	void
	list_trust_path( const char *username )
	{
	(void)username;
	}

	/****************
	* Enumerate all keys, which are needed to build all trust paths for
	* the given key. This function does not return the key itself or
	* the ultimate key (the last point in cerificate chain). Only
	* certificate chains which ends up at an ultimately trusted key
	* are listed. If ownertrust or validity is not NULL, the corresponding
	* value for the returned LID is also returned in these variable(s).
	*
	* 1) create a void pointer and initialize it to NULL
	* 2) pass this void pointer by reference to this function.
	* Set lid to the key you want to enumerate and pass it by reference.
	* 3) call this function as long as it does not return -1
	* to indicate EOF. LID does contain the next key used to build the web
	* 4) Always call this function a last time with LID set to NULL,
	* so that it can free its context.
	*
	* Returns: -1 on EOF or the level of the returned LID
	*/
	int
	enum_cert_paths( void *context, ulong lid,
	unsigned ownertrust, unsigned validity )
	{
	(void)context;
	(void)lid;
	(void)ownertrust;
	(void)validity;
	return -1;
	}


	/****************
	* Print the current path
	*/
	void
	enum_cert_paths_print (void *context, FILE fp,
	int refresh, ulong selected_lid)
	{
	(void)context;
	(void)fp;
	(void)refresh;
	(void)selected_lid;
	}



	/****************************************
	********* NEW NEW NEW **************
	****************************************/

	static int
	ask_ownertrust (ctrl_t ctrl, u32 *kid, int minimum)
	{
	PKT_public_key *pk;
	int rc;
	int ot;

	pk = xmalloc_clear (sizeof *pk);
	rc = get_pubkey (pk, kid);
	if (rc)
	{
	log_error (_("public key %s not found: %s\n"),
	keystr(kid), gpg_strerror (rc) );
	return TRUST_UNKNOWN;
	}

	if(opt.force_ownertrust)
	{
	log_info("force trust for key %s to %s\n",
	keystr(kid),trust_value_to_string(opt.force_ownertrust));
	tdb_update_ownertrust (pk, opt.force_ownertrust);
	ot=opt.force_ownertrust;
	}
	else
	{
	ot=edit_ownertrust (ctrl, pk, 0);
	if(ot>0)
	ot = tdb_get_ownertrust (pk);
	else if(ot==0)
	ot = minimum?minimum:TRUST_UNDEFINED;
	else
	ot = -1; /* quit */
	}

	free_public_key( pk );

	return ot;
	}


	static void
	mark_keyblock_seen (KeyHashTable tbl, KBNODE node)
	{
	for ( ;node; node = node->next )
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	u32 aki[2];

	keyid_from_pk (node->pkt->pkt.public_key, aki);
	add_key_hash_table (tbl, aki);
	}
	}


	static void
	dump_key_array (int depth, struct key_array *keys)
	{
	struct key_array *kar;

	for (kar=keys; kar->keyblock; kar++)
	{
	KBNODE node = kar->keyblock;
	u32 kid[2];

	keyid_from_pk(node->pkt->pkt.public_key, kid);
	es_printf ("%d:%08lX%08lX:K::%c::::\n",
	depth, (ulong)kid[0], (ulong)kid[1], '?');

	for (; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	int len = node->pkt->pkt.user_id->len;

	if (len > 30)
	len = 30;
	es_printf ("%d:%08lX%08lX:U:::%c:::",
	depth, (ulong)kid[0], (ulong)kid[1],
	(node->flag & 4)? 'f':
	(node->flag & 2)? 'm':
	(node->flag & 1)? 'q':'-');
	es_write_sanitized (es_stdout, node->pkt->pkt.user_id->name,
	len, ":", NULL);
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	}
	}
	}
	}


	static void
	store_validation_status (int depth, KBNODE keyblock, KeyHashTable stored)
	{
	KBNODE node;
	int status;
	int any = 0;

	for (node=keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	if (node->flag & 4)
	status = TRUST_FULLY;
	else if (node->flag & 2)
	status = TRUST_MARGINAL;
	else if (node->flag & 1)
	status = TRUST_UNDEFINED;
	else
	status = 0;

	if (status)
	{
	update_validity (keyblock->pkt->pkt.public_key,
	uid, depth, status);

	mark_keyblock_seen(stored,keyblock);

	any = 1;
	}
	}
	}

	if (any)
	do_sync ();
	}


	/* Returns a sanitized copy of the regexp (which might be "", but not
	NULL). */
	#ifndef DISABLE_REGEX
	static char *
	sanitize_regexp(const char *old)
	{
	size_t start=0,len=strlen(old),idx=0;
	int escaped=0,standard_bracket=0;
	char new=xmalloc((len2)+1); /* enough to \-escape everything if we
	have to */

	/* There are basically two commonly-used regexps here. GPG and most
	versions of PGP use "<[^>]+[@.]example\.com>$" and PGP (9)
	command line uses "example.com" (i.e. whatever the user specfies,
	and we can't expect users know to use "\." instead of "."). So
	here are the rules: we're allowed to start with "<[^>]+[@.]" and
	end with ">$" or start and end with nothing. In between, the
	only legal regex character is ".", and everything else gets
	escaped. Part of the gotcha here is that some regex packages
	allow more than RFC-4880 requires. For example, 4880 has no "{}"
	operator, but GNU regex does. Commenting removes these operators
	from consideration. A possible future enhancement is to use
	commenting to effectively back off a given regex to the Henry
	Spencer syntax in 4880. -dshaw */

	/* Are we bracketed between "<[^>]+[@.]" and ">$" ? */
	if(len>=12 && strncmp(old,"<[^>]+[@.]",10)==0
	&& old[len-2]=='>' && old[len-1]=='$')
	{
	strcpy(new,"<[^>]+[@.]");
	idx=strlen(new);
	standard_bracket=1;
	start+=10;
	len-=2;
	}

	/* Walk the remaining characters and ensure that everything that is
	left is not an operational regex character. */
	for(;start<len;start++)
	{
	if(!escaped && old[start]=='\\')
	escaped=1;
	else if(!escaped && old[start]!='.')
	new[idx++]='\\';
	else
	escaped=0;

	new[idx++]=old[start];
	}

	new[idx]='\0';

	/* Note that the (sub)string we look at might end with a bare "\".
	If it does, leave it that way. If the regexp actually ended with
	">$", then it was escaping the ">" and is fine. If the regexp
	actually ended with the bare "\", then it's an illegal regexp and
	regcomp should kick it out. */

	if(standard_bracket)
	strcat(new,">$");

	return new;
	}
	#endif /!DISABLE_REGEX/

	/* Used by validate_one_keyblock to confirm a regexp within a trust
	signature. Returns 1 for match, and 0 for no match or regex
	error. */
	static int
	check_regexp(const char expr,const char string)
	{
	#ifdef DISABLE_REGEX
	(void)expr;
	(void)string;
	/* When DISABLE_REGEX is defined, assume all regexps do not
	match. */
	return 0;
	#else
	int ret;
	char *regexp;

	regexp=sanitize_regexp(expr);

	#ifdef __riscos__
	ret=riscos_check_regexp(expr, string, DBG_TRUST);
	#else
	{
	regex_t pat;

	ret=regcomp(&pat,regexp,REG_ICASE\|REG_NOSUB\|REG_EXTENDED);
	if(ret==0)
	{
	ret=regexec(&pat,string,0,NULL,0);
	regfree(&pat);
	}
	ret=(ret==0);
	}
	#endif

	if(DBG_TRUST)
	log_debug("regexp '%s' ('%s') on '%s': %s\n",
	regexp,expr,string,ret?"YES":"NO");

	xfree(regexp);

	return ret;
	#endif
	}

	/*
	* Return true if the key is signed by one of the keys in the given
	* key ID list. User IDs with a valid signature are marked by node
	* flags as follows:
	* flag bit 0: There is at least one signature
	* 1: There is marginal confidence that this is a legitimate uid
	* 2: There is full confidence that this is a legitimate uid.
	* 8: Used for internal purposes.
	* 9: Ditto (in mark_usable_uid_certs())
	* 10: Ditto (ditto)
	* This function assumes that all kbnode flags are cleared on entry.
	*/
	static int
	validate_one_keyblock (KBNODE kb, struct key_item *klist,
	u32 curtime, u32 *next_expire)
	{
	struct key_item *kr;
	KBNODE node, uidnode=NULL;
	PKT_user_id *uid=NULL;
	PKT_public_key *pk = kb->pkt->pkt.public_key;
	u32 main_kid[2];
	int issigned=0, any_signed = 0;

	keyid_from_pk(pk, main_kid);
	for (node=kb; node; node = node->next)
	{
	/* A bit of discussion here: is it better for the web of trust
	to be built among only self-signed uids? On the one hand, a
	self-signed uid is a statement that the key owner definitely
	intended that uid to be there, but on the other hand, a
	signed (but not self-signed) uid does carry trust, of a sort,
	even if it is a statement being made by people other than the
	key owner "through" the uids on the key owner's key. I'm
	going with the latter. However, if the user ID was
	explicitly revoked, or passively allowed to expire, that
	should stop validity through the user ID until it is
	resigned. -dshaw */

	if (node->pkt->pkttype == PKT_USER_ID
	&& !node->pkt->pkt.user_id->is_revoked
	&& !node->pkt->pkt.user_id->is_expired)
	{
	if (uidnode && issigned)
	{
	if (uid->help_full_count >= opt.completes_needed
	\|\| uid->help_marginal_count >= opt.marginals_needed )
	uidnode->flag \|= 4;
	else if (uid->help_full_count \|\| uid->help_marginal_count)
	uidnode->flag \|= 2;
	uidnode->flag \|= 1;
	any_signed = 1;
	}
	uidnode = node;
	uid=uidnode->pkt->pkt.user_id;

	/* If the selfsig is going to expire... */
	if(uid->expiredate && uid->expiredate<*next_expire)
	*next_expire = uid->expiredate;

	issigned = 0;
	get_validity_counts(pk,uid);
	mark_usable_uid_certs (kb, uidnode, main_kid, klist,
	curtime, next_expire);
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& (node->flag & (1<<8)) && uid)
	{
	/* Note that we are only seeing unrevoked sigs here */
	PKT_signature *sig = node->pkt->pkt.signature;

	kr = is_in_klist (klist, sig);
	/* If the trust_regexp does not match, it's as if the sig
	did not exist. This is safe for non-trust sigs as well
	since we don't accept a regexp on the sig unless it's a
	trust sig. */
	if (kr && (!kr->trust_regexp
	\|\| !(opt.trust_model == TM_PGP
	\|\| opt.trust_model == TM_TOFU_PGP)
	\|\| (uidnode
	&& check_regexp(kr->trust_regexp,
	uidnode->pkt->pkt.user_id->name))))
	{
	/* Are we part of a trust sig chain? We always favor
	the latest trust sig, rather than the greater or
	lesser trust sig or value. I could make a decent
	argument for any of these cases, but this seems to be
	what PGP does, and I'd like to be compatible. -dms */
	if ((opt.trust_model == TM_PGP
	\|\| opt.trust_model == TM_TOFU_PGP)
	&& sig->trust_depth
	&& pk->trust_timestamp <= sig->timestamp)
	{
	unsigned char depth;

	/* If the depth on the signature is less than the
	chain currently has, then use the signature depth
	so we don't increase the depth beyond what the
	signer wanted. If the depth on the signature is
	more than the chain currently has, then use the
	chain depth so we use as much of the signature
	depth as the chain will permit. An ultimately
	trusted signature can restart the depth to
	whatever level it likes. */

	if (sig->trust_depth < kr->trust_depth
	\|\| kr->ownertrust == TRUST_ULTIMATE)
	depth = sig->trust_depth;
	else
	depth = kr->trust_depth;

	if (depth)
	{
	if(DBG_TRUST)
	log_debug ("trust sig on %s, sig depth is %d,"
	" kr depth is %d\n",
	uidnode->pkt->pkt.user_id->name,
	sig->trust_depth,
	kr->trust_depth);

	/* If we got here, we know that:

	this is a trust sig.

	it's a newer trust sig than any previous trust
	sig on this key (not uid).

	it is legal in that it was either generated by an
	ultimate key, or a key that was part of a trust
	chain, and the depth does not violate the
	original trust sig.

	if there is a regexp attached, it matched
	successfully.
	*/

	if (DBG_TRUST)
	log_debug ("replacing trust value %d with %d and "
	"depth %d with %d\n",
	pk->trust_value,sig->trust_value,
	pk->trust_depth,depth);

	pk->trust_value = sig->trust_value;
	pk->trust_depth = depth-1;

	/* If the trust sig contains a regexp, record it
	on the pk for the next round. */
	if (sig->trust_regexp)
	pk->trust_regexp = sig->trust_regexp;
	}
	}

	if (kr->ownertrust == TRUST_ULTIMATE)
	uid->help_full_count = opt.completes_needed;
	else if (kr->ownertrust == TRUST_FULLY)
	uid->help_full_count++;
	else if (kr->ownertrust == TRUST_MARGINAL)
	uid->help_marginal_count++;
	issigned = 1;
	}
	}
	}

	if (uidnode && issigned)
	{
	if (uid->help_full_count >= opt.completes_needed
	\|\| uid->help_marginal_count >= opt.marginals_needed )
	uidnode->flag \|= 4;
	else if (uid->help_full_count \|\| uid->help_marginal_count)
	uidnode->flag \|= 2;
	uidnode->flag \|= 1;
	any_signed = 1;
	}

	return any_signed;
	}


	static int
	search_skipfnc (void opaque, u32 kid, int dummy_uid_no)
	{
	(void)dummy_uid_no;
	return test_key_hash_table ((KeyHashTable)opaque, kid);
	}


	/*
	* Scan all keys and return a key_array of all suitable keys from
	* kllist. The caller has to pass keydb handle so that we don't use
	* to create our own. Returns either a key_array or NULL in case of
	* an error. No results found are indicated by an empty array.
	* Caller hast to release the returned array.
	*/
	static struct key_array *
	validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
	struct key_item klist, u32 curtime, u32 next_expire)
	{
	KBNODE keyblock = NULL;
	struct key_array *keys = NULL;
	size_t nkeys, maxkeys;
	int rc;
	KEYDB_SEARCH_DESC desc;

	maxkeys = 1000;
	keys = xmalloc ((maxkeys+1) * sizeof *keys);
	nkeys = 0;

	rc = keydb_search_reset (hd);
	if (rc)
	{
	log_error ("keydb_search_reset failed: %s\n", gpg_strerror (rc));
	xfree (keys);
	return NULL;
	}

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FIRST;
	desc.skipfnc = search_skipfnc;
	desc.skipfncvalue = full_trust;
	rc = keydb_search (hd, &desc, 1, NULL);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	{
	keys[nkeys].keyblock = NULL;
	return keys;
	}
	if (rc)
	{
	log_error ("keydb_search(first) failed: %s\n", gpg_strerror (rc));
	goto die;
	}

	desc.mode = KEYDB_SEARCH_MODE_NEXT; /* change mode */
	do
	{
	PKT_public_key *pk;

	rc = keydb_get_keyblock (hd, &keyblock);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	goto die;
	}

	if ( keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	log_debug ("ooops: invalid pkttype %d encountered\n",
	keyblock->pkt->pkttype);
	dump_kbnode (keyblock);
	release_kbnode(keyblock);
	continue;
	}

	/* prepare the keyblock for further processing */
	merge_keys_and_selfsig (keyblock);
	clear_kbnode_flags (keyblock);
	pk = keyblock->pkt->pkt.public_key;
	if (pk->has_expired \|\| pk->flags.revoked)
	{
	/* it does not make sense to look further at those keys */
	mark_keyblock_seen (full_trust, keyblock);
	}
	else if (validate_one_keyblock (keyblock, klist, curtime, next_expire))
	{
	KBNODE node;

	if (pk->expiredate && pk->expiredate >= curtime
	&& pk->expiredate < *next_expire)
	*next_expire = pk->expiredate;

	if (nkeys == maxkeys) {
	maxkeys += 1000;
	keys = xrealloc (keys, (maxkeys+1) * sizeof *keys);
	}
	keys[nkeys++].keyblock = keyblock;

	/* Optimization - if all uids are fully trusted, then we
	never need to consider this key as a candidate again. */

	for (node=keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID && !(node->flag & 4))
	break;

	if(node==NULL)
	mark_keyblock_seen (full_trust, keyblock);

	keyblock = NULL;
	}

	release_kbnode (keyblock);
	keyblock = NULL;
	}
	while (!(rc = keydb_search (hd, &desc, 1, NULL)));

	if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND)
	{
	log_error ("keydb_search_next failed: %s\n", gpg_strerror (rc));
	goto die;
	}

	keys[nkeys].keyblock = NULL;
	return keys;

	die:
	keys[nkeys].keyblock = NULL;
	release_key_array (keys);
	return NULL;
	}

	/* Caller must sync */
	static void
	reset_trust_records(void)
	{
	TRUSTREC rec;
	ulong recnum;
	int count = 0, nreset = 0;

	for (recnum=1; !tdbio_read_record (recnum, &rec, 0); recnum++ )
	{
	if(rec.rectype==RECTYPE_TRUST)
	{
	count++;
	if(rec.r.trust.min_ownertrust)
	{
	rec.r.trust.min_ownertrust=0;
	write_record(&rec);
	}

	}
	else if(rec.rectype==RECTYPE_VALID
	&& ((rec.r.valid.validity&TRUST_MASK)
	\|\| rec.r.valid.marginal_count
	\|\| rec.r.valid.full_count))
	{
	rec.r.valid.validity &= ~TRUST_MASK;
	rec.r.valid.marginal_count=rec.r.valid.full_count=0;
	nreset++;
	write_record(&rec);
	}

	}

	if (opt.verbose)
	{
	log_info (ngettext("%d key processed",
	"%d keys processed",
	count), count);
	log_printf (ngettext(" (%d validity count cleared)\n",
	" (%d validity counts cleared)\n",
	nreset), nreset);
	}
	}

	/*
	* Run the key validation procedure.
	*
	* This works this way:
	* Step 1: Find all ultimately trusted keys (UTK).
	* mark them all as seen and put them into klist.
	* Step 2: loop max_cert_times
	* Step 3: if OWNERTRUST of any key in klist is undefined
	* ask user to assign ownertrust
	* Step 4: Loop over all keys in the keyDB which are not marked seen
	* Step 5: if key is revoked or expired
	* mark key as seen
	* continue loop at Step 4
	* Step 6: For each user ID of that key signed by a key in klist
	* Calculate validity by counting trusted signatures.
	* Set validity of user ID
	* Step 7: If any signed user ID was found
	* mark key as seen
	* End Loop
	* Step 8: Build a new klist from all fully trusted keys from step 6
	* End Loop
	* Ready
	*
	*/
	static int
	validate_keys (ctrl_t ctrl, int interactive)
	{
	int rc = 0;
	int quit=0;
	struct key_item *klist = NULL;
	struct key_item *k;
	struct key_array *keys = NULL;
	struct key_array *kar;
	KEYDB_HANDLE kdb = NULL;
	KBNODE node;
	int depth;
	int ot_unknown, ot_undefined, ot_never, ot_marginal, ot_full, ot_ultimate;
	KeyHashTable stored,used,full_trust;
	u32 start_time, next_expire;

	/* Make sure we have all sigs cached. TODO: This is going to
	require some architectural re-thinking, as it is agonizingly slow.
	Perhaps combine this with reset_trust_records(), or only check
	the caches on keys that are actually involved in the web of
	trust. */
	keydb_rebuild_caches(0);

	kdb = keydb_new ();
	if (!kdb)
	return gpg_error_from_syserror ();

	start_time = make_timestamp ();
	next_expire = 0xffffffff; /* set next expire to the year 2106 */
	stored = new_key_hash_table ();
	used = new_key_hash_table ();
	full_trust = new_key_hash_table ();

	reset_trust_records();

	/* Fixme: Instead of always building a UTK list, we could just build it
	* here when needed */
	if (!utk_list)
	{
	if (!opt.quiet)
	log_info (_("no ultimately trusted keys found\n"));
	goto leave;
	}

	/* mark all UTKs as used and fully_trusted and set validity to
	ultimate */
	for (k=utk_list; k; k = k->next)
	{
	KBNODE keyblock;
	PKT_public_key *pk;

	keyblock = get_pubkeyblock (k->kid);
	if (!keyblock)
	{
	log_error (_("public key of ultimately"
	" trusted key %s not found\n"), keystr(k->kid));
	continue;
	}
	mark_keyblock_seen (used, keyblock);
	mark_keyblock_seen (stored, keyblock);
	mark_keyblock_seen (full_trust, keyblock);
	pk = keyblock->pkt->pkt.public_key;
	for (node=keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	update_validity (pk, node->pkt->pkt.user_id, 0, TRUST_ULTIMATE);
	}
	if ( pk->expiredate && pk->expiredate >= start_time
	&& pk->expiredate < next_expire)
	next_expire = pk->expiredate;

	release_kbnode (keyblock);
	do_sync ();
	}

	if (opt.trust_model == TM_TOFU)
	/* In the TOFU trust model, we only need to save the ultimately
	trusted keys. */
	goto leave;

	klist = utk_list;

	if (!opt.quiet)
	log_info ("marginals needed: %d completes needed: %d trust model: %s\n",
	opt.marginals_needed, opt.completes_needed,
	trust_model_string (opt.trust_model));

	for (depth=0; depth < opt.max_cert_depth; depth++)
	{
	int valids=0,key_count;
	/* See whether we should assign ownertrust values to the keys in
	klist. */
	ot_unknown = ot_undefined = ot_never = 0;
	ot_marginal = ot_full = ot_ultimate = 0;
	for (k=klist; k; k = k->next)
	{
	int min=0;

	/* 120 and 60 are as per RFC2440 */
	if(k->trust_value>=120)
	min=TRUST_FULLY;
	else if(k->trust_value>=60)
	min=TRUST_MARGINAL;

	if(min!=k->min_ownertrust)
	update_min_ownertrust(k->kid,min);

	if (interactive && k->ownertrust == TRUST_UNKNOWN)
	{
	k->ownertrust = ask_ownertrust (ctrl, k->kid,min);

	if (k->ownertrust == (unsigned int)(-1))
	{
	quit=1;
	goto leave;
	}
	}

	/* This can happen during transition from an old trustdb
	before trust sigs. It can also happen if a user uses two
	different versions of GnuPG or changes the --trust-model
	setting. */
	if(k->ownertrust<min)
	{
	if(DBG_TRUST)
	log_debug("key %08lX%08lX:"
	" overriding ownertrust '%s' with '%s'\n",
	(ulong)k->kid[0],(ulong)k->kid[1],
	trust_value_to_string(k->ownertrust),
	trust_value_to_string(min));

	k->ownertrust=min;
	}

	if (k->ownertrust == TRUST_UNKNOWN)
	ot_unknown++;
	else if (k->ownertrust == TRUST_UNDEFINED)
	ot_undefined++;
	else if (k->ownertrust == TRUST_NEVER)
	ot_never++;
	else if (k->ownertrust == TRUST_MARGINAL)
	ot_marginal++;
	else if (k->ownertrust == TRUST_FULLY)
	ot_full++;
	else if (k->ownertrust == TRUST_ULTIMATE)
	ot_ultimate++;

	valids++;
	}

	/* Find all keys which are signed by a key in kdlist */
	keys = validate_key_list (kdb, full_trust, klist,
	start_time, &next_expire);
	if (!keys)
	{
	log_error ("validate_key_list failed\n");
	rc = GPG_ERR_GENERAL;
	goto leave;
	}

	for (key_count=0, kar=keys; kar->keyblock; kar++, key_count++)
	;

	/* Store the calculated valididation status somewhere */
	if (opt.verbose > 1 && DBG_TRUST)
	dump_key_array (depth, keys);

	for (kar=keys; kar->keyblock; kar++)
	store_validation_status (depth, kar->keyblock, stored);

	if (!opt.quiet)
	log_info (_("depth: %d valid: %3d signed: %3d"
	" trust: %d-, %dq, %dn, %dm, %df, %du\n"),
	depth, valids, key_count, ot_unknown, ot_undefined,
	ot_never, ot_marginal, ot_full, ot_ultimate );

	/* Build a new kdlist from all fully valid keys in KEYS */
	if (klist != utk_list)
	release_key_items (klist);
	klist = NULL;
	for (kar=keys; kar->keyblock; kar++)
	{
	for (node=kar->keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID && (node->flag & 4))
	{
	u32 kid[2];

	/* have we used this key already? */
	keyid_from_pk (kar->keyblock->pkt->pkt.public_key, kid);
	if(test_key_hash_table(used,kid)==0)
	{
	/* Normally we add both the primary and subkey
	ids to the hash via mark_keyblock_seen, but
	since we aren't using this hash as a skipfnc,
	that doesn't matter here. */
	add_key_hash_table (used,kid);
	k = new_key_item ();
	k->kid[0]=kid[0];
	k->kid[1]=kid[1];
	k->ownertrust =
	(tdb_get_ownertrust
	(kar->keyblock->pkt->pkt.public_key) & TRUST_MASK);
	k->min_ownertrust = tdb_get_min_ownertrust
	(kar->keyblock->pkt->pkt.public_key);
	k->trust_depth=
	kar->keyblock->pkt->pkt.public_key->trust_depth;
	k->trust_value=
	kar->keyblock->pkt->pkt.public_key->trust_value;
	if(kar->keyblock->pkt->pkt.public_key->trust_regexp)
	k->trust_regexp=
	xstrdup(kar->keyblock->pkt->
	pkt.public_key->trust_regexp);
	k->next = klist;
	klist = k;
	break;
	}
	}
	}
	}
	release_key_array (keys);
	keys = NULL;
	if (!klist)
	break; /* no need to dive in deeper */
	}

	leave:
	keydb_release (kdb);
	release_key_array (keys);
	if (klist != utk_list)
	release_key_items (klist);
	release_key_hash_table (full_trust);
	release_key_hash_table (used);
	release_key_hash_table (stored);
	if (!rc && !quit) /* mark trustDB as checked */
	{
	int rc2;

	if (next_expire == 0xffffffff \|\| next_expire < start_time )
	tdbio_write_nextcheck (0);
	else
	{
	tdbio_write_nextcheck (next_expire);
	if (!opt.quiet)
	log_info (_("next trustdb check due at %s\n"),
	strtimestamp (next_expire));
	}

	rc2 = tdbio_update_version_record ();
	if (rc2)
	{
	log_error (_("unable to update trustdb version record: "
	"write failed: %s\n"), gpg_strerror (rc2));
	tdbio_invalid ();
	}

	do_sync ();
	pending_check_trustdb = 0;
	}

	return rc;
	}
	diff --git a/g13/g13-syshelp.h b/g13/g13-syshelp.h
	index b6adcbd92..0243166ba 100644
	--- a/g13/g13-syshelp.h
	+++ b/g13/g13-syshelp.h
	@@ -1,96 +1,96 @@
	/* g130syshelp.h - Global definitions for G13-SYSHELP.
	* Copyright (C) 2015 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef G13_SYSHELP_H
	#define G13_SYSHELP_H

	#include "g13-common.h"
	#include "g13tuple.h"

	struct tab_item_s;
	typedef struct tab_item_s *tab_item_t;

	struct tab_item_s
	{
	tab_item_t next;
	char label; / Optional malloced label for that entry. */
	char mountpoint; / NULL or a malloced mountpoint. */
	char blockdev[1]; /* String with the name of the block device. If
	- it starts with a slash is is a regular device
	+ it starts with a slash it is a regular device
	name, otherwise it is a PARTUUID. */
	};



	/* Forward declaration for an object defined in g13-sh-cmd.c. */
	struct server_local_s;

	/* Session control object. This object is passed down to most
	functions. The default values for it are set by
	g13_syshelp_init_default_ctrl(). */
	struct server_control_s
	{
	int no_server; /* We are not running under server control */
	int status_fd; /* Only for non-server mode */
	struct server_local_s *server_local;

	struct {
	uid_t uid; /* UID of the client calling use. */
	char *uname;
	tab_item_t tab;/* Linked list with the g13tab items for this user. */
	} client;

	/* Flag indicating that we should fail all commands. */
	int fail_all_cmds;

	/* Type of the current container. See the CONTTYPE_ constants. */
	int conttype;

	/* A pointer into client.tab with the selected tab line or NULL. */
	tab_item_t devti;
	};


	/-- g13-syshelp.c --/
	void g13_syshelp_init_default_ctrl (struct server_control_s *ctrl);
	void g13_syshelp_i_know_what_i_am_doing (void);

	/-- sh-cmd.c --/
	gpg_error_t syshelp_server (ctrl_t ctrl);
	gpg_error_t sh_encrypt_keyblob (ctrl_t ctrl,
	const void *keyblob, size_t keybloblen,
	char *r_enckeyblob, size_t r_enckeybloblen);

	/-- sh-blockdev.c --/
	gpg_error_t sh_blockdev_getsz (const char name, unsigned long long r_nblocks);
	gpg_error_t sh_is_empty_partition (const char *name);

	/-- sh-dmcrypt.c --/
	gpg_error_t sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname,
	estream_t devfp);
	gpg_error_t sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
	tupledesc_t keyblob);
	gpg_error_t sh_dmcrypt_umount_container (ctrl_t ctrl, const char *devname);
	gpg_error_t sh_dmcrypt_suspend_container (ctrl_t ctrl, const char *devname);
	gpg_error_t sh_dmcrypt_resume_container (ctrl_t ctrl, const char *devname,
	tupledesc_t keyblob);



	#endif /G13_SYSHELP_H/
	diff --git a/kbx/keybox-blob.c b/kbx/keybox-blob.c
	index 73ecfbe0d..f3bdceb3e 100644
	--- a/kbx/keybox-blob.c
	+++ b/kbx/keybox-blob.c
	@@ -1,1061 +1,1061 @@
	/* keybox-blob.c - KBX Blob handling
	* Copyright (C) 2000, 2001, 2002, 2003, 2008 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/*
	* The keybox data format

	The KeyBox uses an augmented OpenPGP/X.509 key format. This makes
	random access to a keyblock/certificate easier and also gives the
	opportunity to store additional information (e.g. the fingerprint)
	along with the key. All integers are stored in network byte order,
	offsets are counted from the beginning of the Blob.

	** Overview of blob types

	\| Byte 4 \| Blob type \|
	\|--------+--------------\|
	\| 0 \| Empty blob \|
	\| 1 \| First blob \|
	\| 2 \| OpenPGP blob \|
	\| 3 \| X.509 blob \|

	** The First blob

	The first blob of a plain KBX file has a special format:

	- u32 Length of this blob
	- byte Blob type (1)
	- byte Version number (1)
	- u16 Header flags
	bit 0 - RFU
	bit 1 - Is being or has been used for OpenPGP blobs
	- b4 Magic 'KBXf'
	- u32 RFU
	- u32 file_created_at
	- u32 last_maintenance_run
	- u32 RFU
	- u32 RFU

	** The OpenPGP and X.509 blobs

	The OpenPGP and X.509 blobs are very similar, things which are
	X.509 specific are noted like [X.509: xxx]

	- u32 Length of this blob (including these 4 bytes)
	- byte Blob type
	2 = OpenPGP
	3 = X509
	- byte Version number of this blob type
	1 = The only defined value
	- u16 Blob flags
	bit 0 = contains secret key material (not used)
	bit 1 = ephemeral blob (e.g. used while quering external resources)
	- u32 Offset to the OpenPGP keyblock or the X.509 DER encoded
	certificate
	- u32 The length of the keyblock or certificate
	- u16 [NKEYS] Number of keys (at least 1!) [X509: always 1]
	- u16 Size of the key information structure (at least 28).
	- NKEYS times:
	- b20 The fingerprint of the key.
	Fingerprints are always 20 bytes, MD5 left padded with zeroes.
	- u32 Offset to the n-th key's keyID (a keyID is always 8 byte)
	or 0 if not known which is the case only for X.509.
	- u16 Key flags
	bit 0 = qualified signature (not yet implemented}
	- u16 RFU
	- bN Optional filler up to the specified length of this
	structure.
	- u16 Size of the serial number (may be zero)
	- bN The serial number. N as giiven above.
	- u16 Number of user IDs
	- u16 [NUIDS] Size of user ID information structure
	- NUIDS times:

	For X509, the first user ID is the Issuer, the second the
	Subject and the others are subjectAltNames. For OpenPGP we only
	store the information from UserID packets here.

	- u32 Blob offset to the n-th user ID
	- u32 Length of this user ID.
	- u16 User ID flags.
	(not yet used)
	- byte Validity
	- byte RFU

	- u16 [NSIGS] Number of signatures
	- u16 Size of signature information (4)
	- NSIGS times:
	- u32 Expiration time of signature with some special values:
	- 0x00000000 = not checked
	- 0x00000001 = missing key
	- 0x00000002 = bad signature
	- 0x10000000 = valid and expires at some date in 1978.
	- 0xffffffff = valid and does not expire
	- u8 Assigned ownertrust [X509: not used]
	- u8 All_Validity
	OpenPGP: See ../g10/trustdb/TRUST_* [not yet used]
	X509: Bit 4 set := key has been revoked.
	Note that this value matches TRUST_FLAG_REVOKED
	- u16 RFU
	- u32 Recheck_after
	- u32 Latest timestamp in the keyblock (useful for KS syncronsiation?)
	- u32 Blob created at
	- u32 [NRES] Size of reserved space (not including this field)
	- bN Reserved space of size NRES for future use.
	- bN Arbitrary space for example used to store data which is not
	part of the keyblock or certificate. For example the v3 key
	IDs go here.
	- bN Space for the keyblock or certificate.
	- bN RFU. This is the remaining space after keyblock and before
	- the checksum. Is is not covered by the checksum.
	+ the checksum. It is not covered by the checksum.
	- b20 SHA-1 checksum (useful for KS syncronisation?)
	Note, that KBX versions before GnuPG 2.1 used an MD5
	checksum. However it was only created but never checked.
	Thus we do not expect problems if we switch to SHA-1. If
	the checksum fails and the first 4 bytes are zero, we can
	try again with MD5. SHA-1 has the advantage that it is
	faster on CPUs with dedicated SHA-1 support.


	*/


	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <assert.h>
	#include <time.h>

	#include "keybox-defs.h"
	#include <gcrypt.h>

	#ifdef KEYBOX_WITH_X509
	#include <ksba.h>
	#endif


	#include "../common/gettime.h"


	/* special values of the signature status */
	#define SF_NONE(a) ( !(a) )
	#define SF_NOKEY(a) ((a) & (1<<0))
	#define SF_BAD(a) ((a) & (1<<1))
	#define SF_VALID(a) ((a) & (1<<29))


	struct membuf {
	size_t len;
	size_t size;
	char *buf;
	int out_of_core;
	};


	/* #if MAX_FINGERPRINT_LEN < 20 */
	/* #error fingerprints are 20 bytes */
	/* #endif */

	struct keyboxblob_key {
	char fpr[20];
	u32 off_kid;
	ulong off_kid_addr;
	u16 flags;
	};
	struct keyboxblob_uid {
	u32 off;
	ulong off_addr;
	char name; / used only with x509 */
	u32 len;
	u16 flags;
	byte validity;
	};

	struct keyid_list {
	struct keyid_list *next;
	int seqno;
	byte kid[8];
	};

	struct fixup_list {
	struct fixup_list *next;
	u32 off;
	u32 val;
	};


	struct keyboxblob {
	byte *blob;
	size_t bloblen;
	off_t fileoffset;

	/* stuff used only by keybox_create_blob */
	unsigned char *serialbuf;
	const unsigned char *serial;
	size_t seriallen;
	int nkeys;
	struct keyboxblob_key *keys;
	int nuids;
	struct keyboxblob_uid *uids;
	int nsigs;
	u32 *sigs;
	struct fixup_list *fixups;
	int fixup_out_of_core;

	struct keyid_list *temp_kids;
	struct membuf bufbuf; /* temporary store for the blob */
	struct membuf *buf;
	};



	/* A simple implemention of a dynamic buffer. Use init_membuf() to
	create a buffer, put_membuf to append bytes and get_membuf to
	release and return the buffer. Allocation errors are detected but
	only returned at the final get_membuf(), this helps not to clutter
	the code with out of core checks. */

	static void
	init_membuf (struct membuf *mb, int initiallen)
	{
	mb->len = 0;
	mb->size = initiallen;
	mb->out_of_core = 0;
	mb->buf = xtrymalloc (initiallen);
	if (!mb->buf)
	mb->out_of_core = 1;
	}

	static void
	put_membuf (struct membuf mb, const void buf, size_t len)
	{
	if (mb->out_of_core)
	return;

	if (mb->len + len >= mb->size)
	{
	char *p;

	mb->size += len + 1024;
	p = xtryrealloc (mb->buf, mb->size);
	if (!p)
	{
	mb->out_of_core = 1;
	return;
	}
	mb->buf = p;
	}
	if (buf)
	memcpy (mb->buf + mb->len, buf, len);
	else
	memset (mb->buf + mb->len, 0, len);
	mb->len += len;
	}

	static void *
	get_membuf (struct membuf mb, size_t len)
	{
	char *p;

	if (mb->out_of_core)
	{
	xfree (mb->buf);
	mb->buf = NULL;
	return NULL;
	}

	p = mb->buf;
	*len = mb->len;
	mb->buf = NULL;
	mb->out_of_core = 1; /* don't allow a reuse */
	return p;
	}


	static void
	put8 (struct membuf *mb, byte a )
	{
	put_membuf (mb, &a, 1);
	}

	static void
	put16 (struct membuf *mb, u16 a )
	{
	unsigned char tmp[2];
	tmp[0] = a>>8;
	tmp[1] = a;
	put_membuf (mb, tmp, 2);
	}

	static void
	put32 (struct membuf *mb, u32 a )
	{
	unsigned char tmp[4];
	tmp[0] = a>>24;
	tmp[1] = a>>16;
	tmp[2] = a>>8;
	tmp[3] = a;
	put_membuf (mb, tmp, 4);
	}



	/* Store a value in the fixup list */
	static void
	add_fixup (KEYBOXBLOB blob, u32 off, u32 val)
	{
	struct fixup_list *fl;

	if (blob->fixup_out_of_core)
	return;

	fl = xtrycalloc(1, sizeof *fl);
	if (!fl)
	blob->fixup_out_of_core = 1;
	else
	{
	fl->off = off;
	fl->val = val;
	fl->next = blob->fixups;
	blob->fixups = fl;
	}
	}



	/*
	OpenPGP specific stuff
	*/


	/* We must store the keyid at some place because we can't calculate
	the offset yet. This is only used for v3 keyIDs. Function returns
	an index value for later fixup or -1 for out of core. The value
	must be a non-zero value. */
	static int
	pgp_temp_store_kid (KEYBOXBLOB blob, struct _keybox_openpgp_key_info *kinfo)
	{
	struct keyid_list k, r;

	k = xtrymalloc (sizeof *k);
	if (!k)
	return -1;
	memcpy (k->kid, kinfo->keyid, 8);
	k->seqno = 0;
	k->next = blob->temp_kids;
	blob->temp_kids = k;
	for (r=k; r; r = r->next)
	k->seqno++;

	return k->seqno;
	}


	/* Helper for pgp_create_key_part. */
	static gpg_error_t
	pgp_create_key_part_single (KEYBOXBLOB blob, int n,
	struct _keybox_openpgp_key_info *kinfo)
	{
	size_t fprlen;
	int off;

	fprlen = kinfo->fprlen;
	if (fprlen > 20)
	fprlen = 20;
	memcpy (blob->keys[n].fpr, kinfo->fpr, fprlen);
	if (fprlen != 20) /* v3 fpr - shift right and fill with zeroes. */
	{
	memmove (blob->keys[n].fpr + 20 - fprlen, blob->keys[n].fpr, fprlen);
	memset (blob->keys[n].fpr, 0, 20 - fprlen);
	off = pgp_temp_store_kid (blob, kinfo);
	if (off == -1)
	return gpg_error_from_syserror ();
	blob->keys[n].off_kid = off;
	}
	else
	blob->keys[n].off_kid = 0; /* Will be fixed up later */
	blob->keys[n].flags = 0;
	return 0;
	}


	static gpg_error_t
	pgp_create_key_part (KEYBOXBLOB blob, keybox_openpgp_info_t info)
	{
	gpg_error_t err;
	int n = 0;
	struct _keybox_openpgp_key_info *kinfo;

	err = pgp_create_key_part_single (blob, n++, &info->primary);
	if (err)
	return err;
	if (info->nsubkeys)
	for (kinfo = &info->subkeys; kinfo; kinfo = kinfo->next)
	if ((err=pgp_create_key_part_single (blob, n++, kinfo)))
	return err;

	assert (n == blob->nkeys);
	return 0;
	}


	static void
	pgp_create_uid_part (KEYBOXBLOB blob, keybox_openpgp_info_t info)
	{
	int n = 0;
	struct _keybox_openpgp_uid_info *u;

	if (info->nuids)
	{
	for (u = &info->uids; u; u = u->next)
	{
	blob->uids[n].off = u->off;
	blob->uids[n].len = u->len;
	blob->uids[n].flags = 0;
	blob->uids[n].validity = 0;
	n++;
	}
	}

	assert (n == blob->nuids);
	}


	static void
	pgp_create_sig_part (KEYBOXBLOB blob, u32 *sigstatus)
	{
	int n;

	for (n=0; n < blob->nsigs; n++)
	{
	blob->sigs[n] = sigstatus? sigstatus[n+1] : 0;
	}
	}


	static int
	pgp_create_blob_keyblock (KEYBOXBLOB blob,
	const unsigned char *image, size_t imagelen)
	{
	struct membuf *a = blob->buf;
	int n;
	u32 kbstart = a->len;

	add_fixup (blob, 8, kbstart);

	for (n = 0; n < blob->nuids; n++)
	add_fixup (blob, blob->uids[n].off_addr, kbstart + blob->uids[n].off);

	put_membuf (a, image, imagelen);

	add_fixup (blob, 12, a->len - kbstart);
	return 0;
	}



	#ifdef KEYBOX_WITH_X509
	/*
	X.509 specific stuff
	*/

	/* Write the raw certificate out */
	static int
	x509_create_blob_cert (KEYBOXBLOB blob, ksba_cert_t cert)
	{
	struct membuf *a = blob->buf;
	const unsigned char *image;
	size_t length;
	u32 kbstart = a->len;

	/* Store our offset for later fixup */
	add_fixup (blob, 8, kbstart);

	image = ksba_cert_get_image (cert, &length);
	if (!image)
	return gpg_error (GPG_ERR_GENERAL);
	put_membuf (a, image, length);

	add_fixup (blob, 12, a->len - kbstart);
	return 0;
	}

	#endif /KEYBOX_WITH_X509/

	/* Write a stored keyID out to the buffer */
	static void
	write_stored_kid (KEYBOXBLOB blob, int seqno)
	{
	struct keyid_list *r;

	for ( r = blob->temp_kids; r; r = r->next )
	{
	if (r->seqno == seqno )
	{
	put_membuf (blob->buf, r->kid, 8);
	return;
	}
	}
	never_reached ();
	}

	/* Release a list of key IDs */
	static void
	release_kid_list (struct keyid_list *kl)
	{
	struct keyid_list r, r2;

	for ( r = kl; r; r = r2 )
	{
	r2 = r->next;
	xfree (r);
	}
	}



	static int
	create_blob_header (KEYBOXBLOB blob, int blobtype, int as_ephemeral)
	{
	struct membuf *a = blob->buf;
	int i;

	put32 ( a, 0 ); /* blob length, needs fixup */
	put8 ( a, blobtype);
	put8 ( a, 1 ); /* blob type version */
	put16 ( a, as_ephemeral? 2:0 ); /* blob flags */

	put32 ( a, 0 ); /* offset to the raw data, needs fixup */
	put32 ( a, 0 ); /* length of the raw data, needs fixup */

	put16 ( a, blob->nkeys );
	put16 ( a, 20 + 4 + 2 + 2 ); /* size of key info */
	for ( i=0; i < blob->nkeys; i++ )
	{
	put_membuf (a, blob->keys[i].fpr, 20);
	blob->keys[i].off_kid_addr = a->len;
	put32 ( a, 0 ); /* offset to keyid, fixed up later */
	put16 ( a, blob->keys[i].flags );
	put16 ( a, 0 ); /* reserved */
	}

	put16 (a, blob->seriallen); /fixme: check that it fits into 16 bits/
	if (blob->serial)
	put_membuf (a, blob->serial, blob->seriallen);

	put16 ( a, blob->nuids );
	put16 ( a, 4 + 4 + 2 + 1 + 1 ); /* size of uid info */
	for (i=0; i < blob->nuids; i++)
	{
	blob->uids[i].off_addr = a->len;
	put32 ( a, 0 ); /* offset to userid, fixed up later */
	put32 ( a, blob->uids[i].len );
	put16 ( a, blob->uids[i].flags );
	put8 ( a, 0 ); /* validity */
	put8 ( a, 0 ); /* reserved */
	}

	put16 ( a, blob->nsigs );
	put16 ( a, 4 ); /* size of sig info */
	for (i=0; i < blob->nsigs; i++)
	{
	put32 ( a, blob->sigs[i]);
	}

	put8 ( a, 0 ); /* assigned ownertrust */
	put8 ( a, 0 ); /* validity of all user IDs */
	put16 ( a, 0 ); /* reserved */
	put32 ( a, 0 ); /* time of next recheck */
	put32 ( a, 0 ); /* newest timestamp (none) */
	put32 ( a, make_timestamp() ); /* creation time */
	put32 ( a, 0 ); /* size of reserved space */
	/* reserved space (which is currently of size 0) */

	- /* space where we write keyIDs and and other stuff so that the
	+ /* space where we write keyIDs and other stuff so that the
	pointers can actually point to somewhere */
	if (blobtype == KEYBOX_BLOBTYPE_PGP)
	{
	/* We need to store the keyids for all pgp v3 keys because those key
	IDs are not part of the fingerprint. While we are doing that, we
	fixup all the keyID offsets */
	for (i=0; i < blob->nkeys; i++ )
	{
	if (blob->keys[i].off_kid)
	{ /* this is a v3 one */
	add_fixup (blob, blob->keys[i].off_kid_addr, a->len);
	write_stored_kid (blob, blob->keys[i].off_kid);
	}
	else
	{ /* the better v4 key IDs - just store an offset 8 bytes back */
	add_fixup (blob, blob->keys[i].off_kid_addr,
	blob->keys[i].off_kid_addr - 8);
	}
	}
	}

	if (blobtype == KEYBOX_BLOBTYPE_X509)
	{
	/* We don't want to point to ASN.1 encoded UserIDs (DNs) but to
	the utf-8 string represenation of them */
	for (i=0; i < blob->nuids; i++ )
	{
	if (blob->uids[i].name)
	{ /* this is a v3 one */
	add_fixup (blob, blob->uids[i].off_addr, a->len);
	put_membuf (blob->buf, blob->uids[i].name, blob->uids[i].len);
	}
	}
	}

	return 0;
	}



	static int
	create_blob_trailer (KEYBOXBLOB blob)
	{
	(void)blob;
	return 0;
	}


	static int
	create_blob_finish (KEYBOXBLOB blob)
	{
	struct membuf *a = blob->buf;
	unsigned char *p;
	unsigned char *pp;
	size_t n;

	/* Write a placeholder for the checksum */
	put_membuf (a, NULL, 20);

	/* get the memory area */
	n = 0; /* (Just to avoid compiler warning.) */
	p = get_membuf (a, &n);
	if (!p)
	return gpg_error (GPG_ERR_ENOMEM);
	assert (n >= 20);

	/* fixup the length */
	add_fixup (blob, 0, n);

	/* do the fixups */
	if (blob->fixup_out_of_core)
	{
	xfree (p);
	return gpg_error (GPG_ERR_ENOMEM);
	}

	{
	struct fixup_list fl, next;
	for (fl = blob->fixups; fl; fl = next)
	{
	assert (fl->off+4 <= n);
	p[fl->off+0] = fl->val >> 24;
	p[fl->off+1] = fl->val >> 16;
	p[fl->off+2] = fl->val >> 8;
	p[fl->off+3] = fl->val;
	next = fl->next;
	xfree (fl);
	}
	blob->fixups = NULL;
	}

	/* Compute and store the SHA-1 checksum. */
	gcry_md_hash_buffer (GCRY_MD_SHA1, p + n - 20, p, n - 20);

	pp = xtrymalloc (n);
	if ( !pp )
	{
	xfree (p);
	return gpg_error_from_syserror ();
	}
	memcpy (pp , p, n);
	xfree (p);
	blob->blob = pp;
	blob->bloblen = n;

	return 0;
	}



	gpg_error_t
	_keybox_create_openpgp_blob (KEYBOXBLOB *r_blob,
	keybox_openpgp_info_t info,
	const unsigned char *image,
	size_t imagelen,
	u32 *sigstatus,
	int as_ephemeral)
	{
	gpg_error_t err;
	KEYBOXBLOB blob;

	*r_blob = NULL;

	/* If we have a signature status vector, check that the number of
	elements matches the actual number of signatures. */
	if (sigstatus && sigstatus[0] != info->nsigs)
	return gpg_error (GPG_ERR_INTERNAL);

	blob = xtrycalloc (1, sizeof *blob);
	if (!blob)
	return gpg_error_from_syserror ();

	blob->nkeys = 1 + info->nsubkeys;
	blob->keys = xtrycalloc (blob->nkeys, sizeof *blob->keys );
	if (!blob->keys)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	blob->nuids = info->nuids;
	if (blob->nuids)
	{
	blob->uids = xtrycalloc (blob->nuids, sizeof *blob->uids );
	if (!blob->uids)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	blob->nsigs = info->nsigs;
	if (blob->nsigs)
	{
	blob->sigs = xtrycalloc (blob->nsigs, sizeof *blob->sigs );
	if (!blob->sigs)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	}

	err = pgp_create_key_part (blob, info);
	if (err)
	goto leave;
	pgp_create_uid_part (blob, info);
	pgp_create_sig_part (blob, sigstatus);

	init_membuf (&blob->bufbuf, 1024);
	blob->buf = &blob->bufbuf;
	err = create_blob_header (blob, KEYBOX_BLOBTYPE_PGP, as_ephemeral);
	if (err)
	goto leave;
	err = pgp_create_blob_keyblock (blob, image, imagelen);
	if (err)
	goto leave;
	err = create_blob_trailer (blob);
	if (err)
	goto leave;
	err = create_blob_finish (blob);
	if (err)
	goto leave;

	leave:
	release_kid_list (blob->temp_kids);
	blob->temp_kids = NULL;
	if (err)
	_keybox_release_blob (blob);
	else
	*r_blob = blob;
	return err;
	}


	#ifdef KEYBOX_WITH_X509

	/* Return an allocated string with the email address extracted from a
	DN. Note hat we use this code also in ../sm/keylist.c. */
	static char *
	x509_email_kludge (const char *name)
	{
	const char p, string;
	unsigned char *buf;
	int n;

	string = name;
	for (;;)
	{
	p = strstr (string, "1.2.840.113549.1.9.1=#");
	if (!p)
	return NULL;
	if (p == name \|\| (p > string+1 && p[-1] == ',' && p[-2] != '\\'))
	{
	name = p + 22;
	break;
	}
	string = p + 22;
	}


	/* This looks pretty much like an email address in the subject's DN
	we use this to add an additional user ID entry. This way,
	OpenSSL generated keys get a nicer and usable listing. */
	for (n=0, p=name; hexdigitp (p) && hexdigitp (p+1); p +=2, n++)
	;
	if (!n)
	return NULL;
	buf = xtrymalloc (n+3);
	if (!buf)
	return NULL; /* oops, out of core */
	*buf = '<';
	for (n=1, p=name; hexdigitp (p); p +=2, n++)
	buf[n] = xtoi_2 (p);
	buf[n++] = '>';
	buf[n] = 0;
	return (char*)buf;
	}



	/* Note: We should move calculation of the digest into libksba and
	remove that parameter */
	int
	_keybox_create_x509_blob (KEYBOXBLOB *r_blob, ksba_cert_t cert,
	unsigned char *sha1_digest, int as_ephemeral)
	{
	int i, rc = 0;
	KEYBOXBLOB blob;
	unsigned char *sn;
	char *p;
	char **names = NULL;
	size_t max_names;

	*r_blob = NULL;
	blob = xtrycalloc (1, sizeof *blob);
	if( !blob )
	return gpg_error_from_syserror ();

	sn = ksba_cert_get_serial (cert);
	if (sn)
	{
	size_t n, len;
	n = gcry_sexp_canon_len (sn, 0, NULL, NULL);
	if (n < 2)
	{
	xfree (sn);
	return gpg_error (GPG_ERR_GENERAL);
	}
	blob->serialbuf = sn;
	sn++; n--; /* skip '(' */
	for (len=0; n && sn && sn != ':' && digitp (sn); n--, sn++)
	len = len*10 + atoi_1 (sn);
	if (*sn != ':')
	{
	xfree (blob->serialbuf);
	blob->serialbuf = NULL;
	return gpg_error (GPG_ERR_GENERAL);
	}
	sn++;
	blob->serial = sn;
	blob->seriallen = len;
	}

	blob->nkeys = 1;

	/* create list of names */
	blob->nuids = 0;
	max_names = 100;
	names = xtrymalloc (max_names * sizeof *names);
	if (!names)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}

	p = ksba_cert_get_issuer (cert, 0);
	if (!p)
	{
	rc = gpg_error (GPG_ERR_MISSING_VALUE);
	goto leave;
	}
	names[blob->nuids++] = p;
	for (i=0; (p = ksba_cert_get_subject (cert, i)); i++)
	{
	if (blob->nuids >= max_names)
	{
	char **tmp;

	max_names += 100;
	tmp = xtryrealloc (names, max_names * sizeof *names);
	if (!tmp)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	names = tmp;
	}
	names[blob->nuids++] = p;
	if (!i && (p=x509_email_kludge (p)))
	names[blob->nuids++] = p; /* due to !i we don't need to check bounds*/
	}

	/* space for signature information */
	blob->nsigs = 1;

	blob->keys = xtrycalloc (blob->nkeys, sizeof *blob->keys );
	blob->uids = xtrycalloc (blob->nuids, sizeof *blob->uids );
	blob->sigs = xtrycalloc (blob->nsigs, sizeof *blob->sigs );
	if (!blob->keys \|\| !blob->uids \|\| !blob->sigs)
	{
	rc = gpg_error (GPG_ERR_ENOMEM);
	goto leave;
	}

	memcpy (blob->keys[0].fpr, sha1_digest, 20);
	blob->keys[0].off_kid = 0; /* We don't have keyids */
	blob->keys[0].flags = 0;

	/* issuer and subject names */
	for (i=0; i < blob->nuids; i++)
	{
	blob->uids[i].name = names[i];
	blob->uids[i].len = strlen(names[i]);
	names[i] = NULL;
	blob->uids[i].flags = 0;
	blob->uids[i].validity = 0;
	}
	xfree (names);
	names = NULL;

	/* signatures */
	blob->sigs[0] = 0; /* not yet checked */

	/* Create a temporary buffer for further processing */
	init_membuf (&blob->bufbuf, 1024);
	blob->buf = &blob->bufbuf;
	/* write out what we already have */
	rc = create_blob_header (blob, KEYBOX_BLOBTYPE_X509, as_ephemeral);
	if (rc)
	goto leave;
	rc = x509_create_blob_cert (blob, cert);
	if (rc)
	goto leave;
	rc = create_blob_trailer (blob);
	if (rc)
	goto leave;
	rc = create_blob_finish ( blob );
	if (rc)
	goto leave;


	leave:
	release_kid_list (blob->temp_kids);
	blob->temp_kids = NULL;
	if (names)
	{
	for (i=0; i < blob->nuids; i++)
	xfree (names[i]);
	xfree (names);
	}
	if (rc)
	{
	_keybox_release_blob (blob);
	*r_blob = NULL;
	}
	else
	{
	*r_blob = blob;
	}
	return rc;
	}
	#endif /KEYBOX_WITH_X509/



	int
	_keybox_new_blob (KEYBOXBLOB *r_blob,
	unsigned char *image, size_t imagelen, off_t off)
	{
	KEYBOXBLOB blob;

	*r_blob = NULL;
	blob = xtrycalloc (1, sizeof *blob);
	if (!blob)
	return gpg_error_from_syserror ();

	blob->blob = image;
	blob->bloblen = imagelen;
	blob->fileoffset = off;
	*r_blob = blob;
	return 0;
	}


	void
	_keybox_release_blob (KEYBOXBLOB blob)
	{
	int i;
	if (!blob)
	return;
	if (blob->buf)
	{
	size_t len;
	xfree (get_membuf (blob->buf, &len));
	}
	xfree (blob->keys );
	xfree (blob->serialbuf);
	for (i=0; i < blob->nuids; i++)
	xfree (blob->uids[i].name);
	xfree (blob->uids );
	xfree (blob->sigs );
	xfree (blob->blob );
	xfree (blob );
	}



	const unsigned char *
	_keybox_get_blob_image ( KEYBOXBLOB blob, size_t *n )
	{
	*n = blob->bloblen;
	return blob->blob;
	}

	off_t
	_keybox_get_blob_fileoffset (KEYBOXBLOB blob)
	{
	return blob->fileoffset;
	}



	void
	_keybox_update_header_blob (KEYBOXBLOB blob, int for_openpgp)
	{
	if (blob->bloblen >= 32 && blob->blob[4] == KEYBOX_BLOBTYPE_HEADER)
	{
	u32 val = make_timestamp ();

	/* Update the last maintenance run times tamp. */
	blob->blob[20] = (val >> 24);
	blob->blob[20+1] = (val >> 16);
	blob->blob[20+2] = (val >> 8);
	blob->blob[20+3] = (val );

	if (for_openpgp)
	blob->blob[7] \|= 0x02; /* OpenPGP data may be available. */
	}
	}
	diff --git a/m4/autobuild.m4 b/m4/autobuild.m4
	index bd1f4dc1b..ceed46494 100644
	--- a/m4/autobuild.m4
	+++ b/m4/autobuild.m4
	@@ -1,34 +1,34 @@
	# autobuild.m4 serial 2 (autobuild-3.3)
	# Copyright (C) 2004 Simon Josefsson
	#
	# This file is free software, distributed under the terms of the GNU
	# General Public License. As a special exception to the GNU General
	# Public License, this file may be distributed as part of a program
	# that contains a configuration script generated by Autoconf, under
	# the same distribution terms as the rest of that program.
	#
	-# This file can can be used in projects which are not available under
	+# This file can be used in projects which are not available under
	# the GNU General Public License or the GNU Library General Public
	# License but which still want to provide support for Autobuild.

	# Usage: AB_INIT([MODE]).
	AC_DEFUN([AB_INIT],
	[
	AC_REQUIRE([AC_CANONICAL_BUILD])
	AC_REQUIRE([AC_CANONICAL_HOST])

	AC_MSG_NOTICE([autobuild project... ${PACKAGE_NAME:-$PACKAGE}])
	AC_MSG_NOTICE([autobuild revision... ${PACKAGE_VERSION:-$VERSION}])
	hostname=`hostname`
	if test "$hostname"; then
	AC_MSG_NOTICE([autobuild hostname... $hostname])
	fi
	ifelse([$1],[],,[AC_MSG_NOTICE([autobuild mode... $1])])
	date=`date +%Y%m%d-%H%M%S`
	if test "$?" != 0; then
	date=`date`
	fi
	if test "$date"; then
	AC_MSG_NOTICE([autobuild timestamp... $date])
	fi
	])
	diff --git a/m4/gettext.m4 b/m4/gettext.m4
	index c9ae1f7de..cdac01476 100644
	--- a/m4/gettext.m4
	+++ b/m4/gettext.m4
	@@ -1,381 +1,381 @@
	# gettext.m4 serial 60 (gettext-0.17)
	dnl Copyright (C) 1995-2007 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1995-2000.
	dnl Bruno Haible <haible@clisp.cons.org>, 2000-2006.

	dnl Macro to add for using GNU gettext.

	dnl Usage: AM_GNU_GETTEXT([INTLSYMBOL], [NEEDSYMBOL], [INTLDIR]).
	dnl INTLSYMBOL can be one of 'external', 'no-libtool', 'use-libtool'. The
	dnl default (if it is not specified or empty) is 'no-libtool'.
	dnl INTLSYMBOL should be 'external' for packages with no intl directory,
	dnl and 'no-libtool' or 'use-libtool' for packages with an intl directory.
	dnl If INTLSYMBOL is 'use-libtool', then a libtool library
	dnl $(top_builddir)/intl/libintl.la will be created (shared and/or static,
	dnl depending on --{enable,disable}-{shared,static} and on the presence of
	dnl AM-DISABLE-SHARED). If INTLSYMBOL is 'no-libtool', a static library
	dnl $(top_builddir)/intl/libintl.a will be created.
	dnl If NEEDSYMBOL is specified and is 'need-ngettext', then GNU gettext
	dnl implementations (in libc or libintl) without the ngettext() function
	dnl will be ignored. If NEEDSYMBOL is specified and is
	dnl 'need-formatstring-macros', then GNU gettext implementations that don't
	dnl support the ISO C 99 <inttypes.h> formatstring macros will be ignored.
	dnl INTLDIR is used to find the intl libraries. If empty,
	dnl the value `$(top_builddir)/intl/' is used.
	dnl
	dnl The result of the configuration is one of three cases:
	dnl 1) GNU gettext, as included in the intl subdirectory, will be compiled
	dnl and used.
	dnl Catalog format: GNU --> install in $(datadir)
	dnl Catalog extension: .mo after installation, .gmo in source tree
	dnl 2) GNU gettext has been found in the system's C library.
	dnl Catalog format: GNU --> install in $(datadir)
	dnl Catalog extension: .mo after installation, .gmo in source tree
	dnl 3) No internationalization, always use English msgid.
	dnl Catalog format: none
	dnl Catalog extension: none
	dnl If INTLSYMBOL is 'external', only cases 2 and 3 can occur.
	dnl The use of .gmo is historical (it was needed to avoid overwriting the
	dnl GNU format catalogs when building on a platform with an X/Open gettext),
	dnl but we keep it in order not to force irrelevant filename changes on the
	dnl maintainers.
	dnl
	AC_DEFUN([AM_GNU_GETTEXT],
	[
	dnl Argument checking.
	ifelse([$1], [], , [ifelse([$1], [external], , [ifelse([$1], [no-libtool], , [ifelse([$1], [use-libtool], ,
	[errprint([ERROR: invalid first argument to AM_GNU_GETTEXT
	])])])])])
	ifelse([$2], [], , [ifelse([$2], [need-ngettext], , [ifelse([$2], [need-formatstring-macros], ,
	[errprint([ERROR: invalid second argument to AM_GNU_GETTEXT
	])])])])
	define([gt_included_intl],
	ifelse([$1], [external],
	ifdef([AM_GNU_GETTEXT_][INTL_SUBDIR], [yes], [no]),
	[yes]))
	define([gt_libtool_suffix_prefix], ifelse([$1], [use-libtool], [l], []))
	gt_NEEDS_INIT
	AM_GNU_GETTEXT_NEED([$2])

	AC_REQUIRE([AM_PO_SUBDIRS])dnl
	ifelse(gt_included_intl, yes, [
	AC_REQUIRE([AM_INTL_SUBDIR])dnl
	])

	dnl Prerequisites of AC_LIB_LINKFLAGS_BODY.
	AC_REQUIRE([AC_LIB_PREPARE_PREFIX])
	AC_REQUIRE([AC_LIB_RPATH])

	dnl Sometimes libintl requires libiconv, so first search for libiconv.
	dnl Ideally we would do this search only after the
	dnl if test "$USE_NLS" = "yes"; then
	dnl if { eval "gt_val=\$$gt_func_gnugettext_libc"; test "$gt_val" != "yes"; }; then
	dnl tests. But if configure.in invokes AM_ICONV after AM_GNU_GETTEXT
	dnl the configure script would need to contain the same shell code
	dnl again, outside any 'if'. There are two solutions:
	dnl - Invoke AM_ICONV_LINKFLAGS_BODY here, outside any 'if'.
	dnl - Control the expansions in more detail using AC_PROVIDE_IFELSE.
	dnl Since AC_PROVIDE_IFELSE is only in autoconf >= 2.52 and not
	dnl documented, we avoid it.
	ifelse(gt_included_intl, yes, , [
	AC_REQUIRE([AM_ICONV_LINKFLAGS_BODY])
	])

	dnl Sometimes, on MacOS X, libintl requires linking with CoreFoundation.
	gt_INTL_MACOSX

	dnl Set USE_NLS.
	AC_REQUIRE([AM_NLS])

	ifelse(gt_included_intl, yes, [
	BUILD_INCLUDED_LIBINTL=no
	USE_INCLUDED_LIBINTL=no
	])
	LIBINTL=
	LTLIBINTL=
	POSUB=

	dnl Add a version number to the cache macros.
	case " $gt_needs " in
	" need-formatstring-macros ") gt_api_version=3 ;;
	" need-ngettext ") gt_api_version=2 ;;
	*) gt_api_version=1 ;;
	esac
	gt_func_gnugettext_libc="gt_cv_func_gnugettext${gt_api_version}_libc"
	gt_func_gnugettext_libintl="gt_cv_func_gnugettext${gt_api_version}_libintl"

	dnl If we use NLS figure out what method
	if test "$USE_NLS" = "yes"; then
	gt_use_preinstalled_gnugettext=no
	ifelse(gt_included_intl, yes, [
	AC_MSG_CHECKING([whether included gettext is requested])
	AC_ARG_WITH(included-gettext,
	[ --with-included-gettext use the GNU gettext library included here],
	nls_cv_force_use_gnu_gettext=$withval,
	nls_cv_force_use_gnu_gettext=no)
	AC_MSG_RESULT($nls_cv_force_use_gnu_gettext)

	nls_cv_use_gnu_gettext="$nls_cv_force_use_gnu_gettext"
	if test "$nls_cv_force_use_gnu_gettext" != "yes"; then
	])
	dnl User does not insist on using GNU NLS library. Figure out what
	dnl to use. If GNU gettext is available we use this. Else we have
	dnl to fall back to GNU NLS library.

	if test $gt_api_version -ge 3; then
	gt_revision_test_code='
	#ifndef __GNU_GETTEXT_SUPPORTED_REVISION
	#define __GNU_GETTEXT_SUPPORTED_REVISION(major) ((major) == 0 ? 0 : -1)
	#endif
	changequote(,)dnl
	typedef int array [2 * (__GNU_GETTEXT_SUPPORTED_REVISION(0) >= 1) - 1];
	changequote([,])dnl
	'
	else
	gt_revision_test_code=
	fi
	if test $gt_api_version -ge 2; then
	gt_expression_test_code=' + * ngettext ("", "", 0)'
	else
	gt_expression_test_code=
	fi

	AC_CACHE_CHECK([for GNU gettext in libc], [$gt_func_gnugettext_libc],
	[AC_TRY_LINK([#include <libintl.h>
	$gt_revision_test_code
	extern int _nl_msg_cat_cntr;
	extern int *_nl_domain_bindings;],
	[bindtextdomain ("", "");
	return * gettext ("")$gt_expression_test_code + _nl_msg_cat_cntr + *_nl_domain_bindings],
	[eval "$gt_func_gnugettext_libc=yes"],
	[eval "$gt_func_gnugettext_libc=no"])])

	if { eval "gt_val=\$$gt_func_gnugettext_libc"; test "$gt_val" != "yes"; }; then
	dnl Sometimes libintl requires libiconv, so first search for libiconv.
	ifelse(gt_included_intl, yes, , [
	AM_ICONV_LINK
	])
	dnl Search for libintl and define LIBINTL, LTLIBINTL and INCINTL
	dnl accordingly. Don't use AC_LIB_LINKFLAGS_BODY([intl],[iconv])
	dnl because that would add "-liconv" to LIBINTL and LTLIBINTL
	dnl even if libiconv doesn't exist.
	AC_LIB_LINKFLAGS_BODY([intl])
	AC_CACHE_CHECK([for GNU gettext in libintl],
	[$gt_func_gnugettext_libintl],
	[gt_save_CPPFLAGS="$CPPFLAGS"
	CPPFLAGS="$CPPFLAGS $INCINTL"
	gt_save_LIBS="$LIBS"
	LIBS="$LIBS $LIBINTL"
	dnl Now see whether libintl exists and does not depend on libiconv.
	AC_TRY_LINK([#include <libintl.h>
	$gt_revision_test_code
	extern int _nl_msg_cat_cntr;
	extern
	#ifdef __cplusplus
	"C"
	#endif
	const char _nl_expand_alias (const char );],
	[bindtextdomain ("", "");
	return * gettext ("")$gt_expression_test_code + _nl_msg_cat_cntr + *_nl_expand_alias ("")],
	[eval "$gt_func_gnugettext_libintl=yes"],
	[eval "$gt_func_gnugettext_libintl=no"])
	dnl Now see whether libintl exists and depends on libiconv.
	if { eval "gt_val=\$$gt_func_gnugettext_libintl"; test "$gt_val" != yes; } && test -n "$LIBICONV"; then
	LIBS="$LIBS $LIBICONV"
	AC_TRY_LINK([#include <libintl.h>
	$gt_revision_test_code
	extern int _nl_msg_cat_cntr;
	extern
	#ifdef __cplusplus
	"C"
	#endif
	const char _nl_expand_alias (const char );],
	[bindtextdomain ("", "");
	return * gettext ("")$gt_expression_test_code + _nl_msg_cat_cntr + *_nl_expand_alias ("")],
	[LIBINTL="$LIBINTL $LIBICONV"
	LTLIBINTL="$LTLIBINTL $LTLIBICONV"
	eval "$gt_func_gnugettext_libintl=yes"
	])
	fi
	CPPFLAGS="$gt_save_CPPFLAGS"
	LIBS="$gt_save_LIBS"])
	fi

	dnl If an already present or preinstalled GNU gettext() is found,
	dnl use it. But if this macro is used in GNU gettext, and GNU
	dnl gettext is already preinstalled in libintl, we update this
	dnl libintl. (Cf. the install rule in intl/Makefile.in.)
	if { eval "gt_val=\$$gt_func_gnugettext_libc"; test "$gt_val" = "yes"; } \
	\|\| { { eval "gt_val=\$$gt_func_gnugettext_libintl"; test "$gt_val" = "yes"; } \
	&& test "$PACKAGE" != gettext-runtime \
	&& test "$PACKAGE" != gettext-tools; }; then
	gt_use_preinstalled_gnugettext=yes
	else
	dnl Reset the values set by searching for libintl.
	LIBINTL=
	LTLIBINTL=
	INCINTL=
	fi

	ifelse(gt_included_intl, yes, [
	if test "$gt_use_preinstalled_gnugettext" != "yes"; then
	dnl GNU gettext is not found in the C library.
	dnl Fall back on included GNU gettext library.
	nls_cv_use_gnu_gettext=yes
	fi
	fi

	if test "$nls_cv_use_gnu_gettext" = "yes"; then
	dnl Mark actions used to generate GNU NLS library.
	BUILD_INCLUDED_LIBINTL=yes
	USE_INCLUDED_LIBINTL=yes
	LIBINTL="ifelse([$3],[],\${top_builddir}/intl,[$3])/libintl.[]gt_libtool_suffix_prefix[]a $LIBICONV $LIBTHREAD"
	LTLIBINTL="ifelse([$3],[],\${top_builddir}/intl,[$3])/libintl.[]gt_libtool_suffix_prefix[]a $LTLIBICONV $LTLIBTHREAD"
	LIBS=`echo " $LIBS " \| sed -e 's/ -lintl / /' -e 's/^ //' -e 's/ $//'`
	fi

	CATOBJEXT=
	if test "$gt_use_preinstalled_gnugettext" = "yes" \
	\|\| test "$nls_cv_use_gnu_gettext" = "yes"; then
	dnl Mark actions to use GNU gettext tools.
	CATOBJEXT=.gmo
	fi
	])

	if test -n "$INTL_MACOSX_LIBS"; then
	if test "$gt_use_preinstalled_gnugettext" = "yes" \
	\|\| test "$nls_cv_use_gnu_gettext" = "yes"; then
	dnl Some extra flags are needed during linking.
	LIBINTL="$LIBINTL $INTL_MACOSX_LIBS"
	LTLIBINTL="$LTLIBINTL $INTL_MACOSX_LIBS"
	fi
	fi

	if test "$gt_use_preinstalled_gnugettext" = "yes" \
	\|\| test "$nls_cv_use_gnu_gettext" = "yes"; then
	AC_DEFINE(ENABLE_NLS, 1,
	[Define to 1 if translation of program messages to the user's native language
	is requested.])
	else
	USE_NLS=no
	fi
	fi

	AC_MSG_CHECKING([whether to use NLS])
	AC_MSG_RESULT([$USE_NLS])
	if test "$USE_NLS" = "yes"; then
	AC_MSG_CHECKING([where the gettext function comes from])
	if test "$gt_use_preinstalled_gnugettext" = "yes"; then
	if { eval "gt_val=\$$gt_func_gnugettext_libintl"; test "$gt_val" = "yes"; }; then
	gt_source="external libintl"
	else
	gt_source="libc"
	fi
	else
	gt_source="included intl directory"
	fi
	AC_MSG_RESULT([$gt_source])
	fi

	if test "$USE_NLS" = "yes"; then

	if test "$gt_use_preinstalled_gnugettext" = "yes"; then
	if { eval "gt_val=\$$gt_func_gnugettext_libintl"; test "$gt_val" = "yes"; }; then
	AC_MSG_CHECKING([how to link with libintl])
	AC_MSG_RESULT([$LIBINTL])
	AC_LIB_APPENDTOVAR([CPPFLAGS], [$INCINTL])
	fi

	dnl For backward compatibility. Some packages may be using this.
	AC_DEFINE(HAVE_GETTEXT, 1,
	[Define if the GNU gettext() function is already present or preinstalled.])
	AC_DEFINE(HAVE_DCGETTEXT, 1,
	[Define if the GNU dcgettext() function is already present or preinstalled.])
	fi

	dnl We need to process the po/ directory.
	POSUB=po
	fi

	ifelse(gt_included_intl, yes, [
	dnl If this is used in GNU gettext we have to set BUILD_INCLUDED_LIBINTL
	dnl to 'yes' because some of the testsuite requires it.
	if test "$PACKAGE" = gettext-runtime \|\| test "$PACKAGE" = gettext-tools; then
	BUILD_INCLUDED_LIBINTL=yes
	fi

	dnl Make all variables we use known to autoconf.
	AC_SUBST(BUILD_INCLUDED_LIBINTL)
	AC_SUBST(USE_INCLUDED_LIBINTL)
	AC_SUBST(CATOBJEXT)

	dnl For backward compatibility. Some configure.ins may be using this.
	nls_cv_header_intl=
	nls_cv_header_libgt=

	dnl For backward compatibility. Some Makefiles may be using this.
	DATADIRNAME=share
	AC_SUBST(DATADIRNAME)

	dnl For backward compatibility. Some Makefiles may be using this.
	INSTOBJEXT=.mo
	AC_SUBST(INSTOBJEXT)

	dnl For backward compatibility. Some Makefiles may be using this.
	GENCAT=gencat
	AC_SUBST(GENCAT)

	dnl For backward compatibility. Some Makefiles may be using this.
	INTLOBJS=
	if test "$USE_INCLUDED_LIBINTL" = yes; then
	INTLOBJS="\$(GETTOBJS)"
	fi
	AC_SUBST(INTLOBJS)

	dnl Enable libtool support if the surrounding package wishes it.
	INTL_LIBTOOL_SUFFIX_PREFIX=gt_libtool_suffix_prefix
	AC_SUBST(INTL_LIBTOOL_SUFFIX_PREFIX)
	])

	dnl For backward compatibility. Some Makefiles may be using this.
	INTLLIBS="$LIBINTL"
	AC_SUBST(INTLLIBS)

	dnl Make all documented variables known to autoconf.
	AC_SUBST(LIBINTL)
	AC_SUBST(LTLIBINTL)
	AC_SUBST(POSUB)
	])


	dnl gt_NEEDS_INIT ensures that the gt_needs variable is initialized.
	m4_define([gt_NEEDS_INIT],
	[
	m4_divert_text([DEFAULTS], [gt_needs=])
	m4_define([gt_NEEDS_INIT], [])
	])


	dnl Usage: AM_GNU_GETTEXT_NEED([NEEDSYMBOL])
	AC_DEFUN([AM_GNU_GETTEXT_NEED],
	[
	m4_divert_text([INIT_PREPARE], [gt_needs="$gt_needs $1"])
	])


	dnl Usage: AM_GNU_GETTEXT_VERSION([gettext-version])
	AC_DEFUN([AM_GNU_GETTEXT_VERSION], [])
	diff --git a/m4/intl.m4 b/m4/intl.m4
	index 3906a1732..ee4718272 100644
	--- a/m4/intl.m4
	+++ b/m4/intl.m4
	@@ -1,259 +1,259 @@
	# intl.m4 serial 3 (gettext-0.16)
	dnl Copyright (C) 1995-2006 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1995-2000.
	dnl Bruno Haible <haible@clisp.cons.org>, 2000-2006.

	AC_PREREQ(2.52)

	dnl Checks for all prerequisites of the intl subdirectory,
	dnl except for INTL_LIBTOOL_SUFFIX_PREFIX (and possibly LIBTOOL), INTLOBJS,
	dnl USE_INCLUDED_LIBINTL, BUILD_INCLUDED_LIBINTL.
	AC_DEFUN([AM_INTL_SUBDIR],
	[
	AC_REQUIRE([AC_PROG_INSTALL])dnl
	AC_REQUIRE([AC_PROG_MKDIR_P])dnl
	AC_REQUIRE([AC_PROG_CC])dnl
	AC_REQUIRE([AC_CANONICAL_HOST])dnl
	AC_REQUIRE([gt_GLIBC2])dnl
	AC_REQUIRE([AC_PROG_RANLIB])dnl
	AC_REQUIRE([gl_VISIBILITY])dnl
	AC_REQUIRE([gt_INTL_SUBDIR_CORE])dnl
	AC_REQUIRE([AC_TYPE_LONG_LONG_INT])dnl
	AC_REQUIRE([gt_TYPE_LONGDOUBLE])dnl
	AC_REQUIRE([gt_TYPE_WCHAR_T])dnl
	AC_REQUIRE([gt_TYPE_WINT_T])dnl
	AC_REQUIRE([gl_AC_HEADER_INTTYPES_H])
	AC_REQUIRE([gt_TYPE_INTMAX_T])
	AC_REQUIRE([gt_PRINTF_POSIX])
	AC_REQUIRE([gl_GLIBC21])dnl
	AC_REQUIRE([gl_XSIZE])dnl
	AC_REQUIRE([gt_INTL_MACOSX])dnl

	AC_CHECK_TYPE([ptrdiff_t], ,
	[AC_DEFINE([ptrdiff_t], [long],
	[Define as the type of the result of subtracting two pointers, if the system doesn't define it.])
	])
	AC_CHECK_HEADERS([stddef.h stdlib.h string.h])
	AC_CHECK_FUNCS([asprintf fwprintf putenv setenv setlocale snprintf wcslen])

	dnl Use the _snprintf function only if it is declared (because on NetBSD it
	dnl is defined as a weak alias of snprintf; we prefer to use the latter).
	gt_CHECK_DECL(_snprintf, [#include <stdio.h>])
	gt_CHECK_DECL(_snwprintf, [#include <stdio.h>])

	dnl Use the *_unlocked functions only if they are declared.
	dnl (because some of them were defined without being declared in Solaris
	dnl 2.5.1 but were removed in Solaris 2.6, whereas we want binaries built
	dnl on Solaris 2.5.1 to run on Solaris 2.6).
	dnl Don't use AC_CHECK_DECLS because it isn't supported in autoconf-2.13.
	gt_CHECK_DECL(getc_unlocked, [#include <stdio.h>])

	case $gt_cv_func_printf_posix in
	*yes) HAVE_POSIX_PRINTF=1 ;;
	*) HAVE_POSIX_PRINTF=0 ;;
	esac
	AC_SUBST([HAVE_POSIX_PRINTF])
	if test "$ac_cv_func_asprintf" = yes; then
	HAVE_ASPRINTF=1
	else
	HAVE_ASPRINTF=0
	fi
	AC_SUBST([HAVE_ASPRINTF])
	if test "$ac_cv_func_snprintf" = yes; then
	HAVE_SNPRINTF=1
	else
	HAVE_SNPRINTF=0
	fi
	AC_SUBST([HAVE_SNPRINTF])
	if test "$ac_cv_func_wprintf" = yes; then
	HAVE_WPRINTF=1
	else
	HAVE_WPRINTF=0
	fi
	AC_SUBST([HAVE_WPRINTF])

	AM_LANGINFO_CODESET
	gt_LC_MESSAGES

	dnl Compilation on mingw and Cygwin needs special Makefile rules, because
	dnl 1. when we install a shared library, we must arrange to export
	dnl auxiliary pointer variables for every exported variable,
	dnl 2. when we install a shared library and a static library simultaneously,
	dnl the include file specifies __declspec(dllimport) and therefore we
	dnl must arrange to define the auxiliary pointer variables for the
	dnl exported variables _also_ in the static library.
	if test "$enable_shared" = yes; then
	case "$host_os" in
	cygwin*) is_woe32dll=yes ;;
	*) is_woe32dll=no ;;
	esac
	else
	is_woe32dll=no
	fi
	WOE32DLL=$is_woe32dll
	AC_SUBST([WOE32DLL])

	dnl Rename some macros and functions used for locking.
	AH_BOTTOM([
	#define __libc_lock_t gl_lock_t
	#define __libc_lock_define gl_lock_define
	#define __libc_lock_define_initialized gl_lock_define_initialized
	#define __libc_lock_init gl_lock_init
	#define __libc_lock_lock gl_lock_lock
	#define __libc_lock_unlock gl_lock_unlock
	#define __libc_lock_recursive_t gl_recursive_lock_t
	#define __libc_lock_define_recursive gl_recursive_lock_define
	#define __libc_lock_define_initialized_recursive gl_recursive_lock_define_initialized
	#define __libc_lock_init_recursive gl_recursive_lock_init
	#define __libc_lock_lock_recursive gl_recursive_lock_lock
	#define __libc_lock_unlock_recursive gl_recursive_lock_unlock
	#define glthread_in_use libintl_thread_in_use
	#define glthread_lock_init libintl_lock_init
	#define glthread_lock_lock libintl_lock_lock
	#define glthread_lock_unlock libintl_lock_unlock
	#define glthread_lock_destroy libintl_lock_destroy
	#define glthread_rwlock_init libintl_rwlock_init
	#define glthread_rwlock_rdlock libintl_rwlock_rdlock
	#define glthread_rwlock_wrlock libintl_rwlock_wrlock
	#define glthread_rwlock_unlock libintl_rwlock_unlock
	#define glthread_rwlock_destroy libintl_rwlock_destroy
	#define glthread_recursive_lock_init libintl_recursive_lock_init
	#define glthread_recursive_lock_lock libintl_recursive_lock_lock
	#define glthread_recursive_lock_unlock libintl_recursive_lock_unlock
	#define glthread_recursive_lock_destroy libintl_recursive_lock_destroy
	#define glthread_once libintl_once
	#define glthread_once_call libintl_once_call
	#define glthread_once_singlethreaded libintl_once_singlethreaded
	])
	])


	dnl Checks for the core files of the intl subdirectory:
	dnl dcigettext.c
	dnl eval-plural.h
	dnl explodename.c
	dnl finddomain.c
	dnl gettextP.h
	dnl gmo.h
	dnl hash-string.h hash-string.c
	dnl l10nflist.c
	dnl libgnuintl.h.in (except the *printf stuff)
	dnl loadinfo.h
	dnl loadmsgcat.c
	dnl localealias.c
	dnl log.c
	dnl plural-exp.h plural-exp.c
	dnl plural.y
	dnl Used by libglocale.
	AC_DEFUN([gt_INTL_SUBDIR_CORE],
	[
	AC_REQUIRE([AC_C_INLINE])dnl
	AC_REQUIRE([AC_TYPE_SIZE_T])dnl
	AC_REQUIRE([gl_AC_HEADER_STDINT_H])
	AC_REQUIRE([AC_FUNC_ALLOCA])dnl
	AC_REQUIRE([AC_FUNC_MMAP])dnl
	AC_REQUIRE([gt_INTDIV0])dnl
	AC_REQUIRE([gl_AC_TYPE_UINTMAX_T])dnl
	AC_REQUIRE([gt_INTTYPES_PRI])dnl
	AC_REQUIRE([gl_LOCK])dnl

	AC_TRY_LINK(
	[int foo (int a) { a = __builtin_expect (a, 10); return a == 10 ? 0 : 1; }],
	[],
	[AC_DEFINE([HAVE_BUILTIN_EXPECT], 1,
	[Define to 1 if the compiler understands __builtin_expect.])])

	AC_CHECK_HEADERS([argz.h inttypes.h limits.h unistd.h sys/param.h])
	AC_CHECK_FUNCS([getcwd getegid geteuid getgid getuid mempcpy munmap \
	stpcpy strcasecmp strdup strtoul tsearch argz_count argz_stringify \
	argz_next __fsetlocking])

	dnl Use the *_unlocked functions only if they are declared.
	dnl (because some of them were defined without being declared in Solaris
	dnl 2.5.1 but were removed in Solaris 2.6, whereas we want binaries built
	dnl on Solaris 2.5.1 to run on Solaris 2.6).
	dnl Don't use AC_CHECK_DECLS because it isn't supported in autoconf-2.13.
	gt_CHECK_DECL(feof_unlocked, [#include <stdio.h>])
	gt_CHECK_DECL(fgets_unlocked, [#include <stdio.h>])

	AM_ICONV

	dnl glibc >= 2.4 has a NL_LOCALE_NAME macro when _GNU_SOURCE is defined,
	dnl and a _NL_LOCALE_NAME macro always.
	AC_CACHE_CHECK([for NL_LOCALE_NAME macro], gt_cv_nl_locale_name,
	[AC_TRY_LINK([#include <langinfo.h>
	#include <locale.h>],
	[char* cs = nl_langinfo(_NL_LOCALE_NAME(LC_MESSAGES));],
	gt_cv_nl_locale_name=yes,
	gt_cv_nl_locale_name=no)
	])
	if test $gt_cv_nl_locale_name = yes; then
	AC_DEFINE(HAVE_NL_LOCALE_NAME, 1,
	[Define if you have <langinfo.h> and it defines the NL_LOCALE_NAME macro if _GNU_SOURCE is defined.])
	fi

	dnl intl/plural.c is generated from intl/plural.y. It requires bison,
	dnl because plural.y uses bison specific features. It requires at least
	dnl bison-1.26 because earlier versions generate a plural.c that doesn't
	dnl compile.
	dnl bison is only needed for the maintainer (who touches plural.y). But in
	dnl order to avoid separate Makefiles or --enable-maintainer-mode, we put
	dnl the rule in general Makefile. Now, some people carelessly touch the
	dnl files or have a broken "make" program, hence the plural.c rule will
	dnl sometimes fire. To avoid an error, defines BISON to ":" if it is not
	dnl present or too old.
	AC_CHECK_PROGS([INTLBISON], [bison])
	if test -z "$INTLBISON"; then
	ac_verc_fail=yes
	else
	dnl Found it, now check the version.
	AC_MSG_CHECKING([version of bison])
	changequote(<<,>>)dnl
	ac_prog_version=`$INTLBISON --version 2>&1 \| sed -n 's/^.GNU Bison. $[0-9]\.[0-9.]$.*$/\1/p'`
	case $ac_prog_version in
	'') ac_prog_version="v. ?.??, bad"; ac_verc_fail=yes;;
	1.2[6-9]* \| 1.[3-9][0-9]* \| [2-9].*)
	changequote([,])dnl
	ac_prog_version="$ac_prog_version, ok"; ac_verc_fail=no;;
	*) ac_prog_version="$ac_prog_version, bad"; ac_verc_fail=yes;;
	esac
	AC_MSG_RESULT([$ac_prog_version])
	fi
	if test $ac_verc_fail = yes; then
	INTLBISON=:
	fi
	])


	dnl gt_CHECK_DECL(FUNC, INCLUDES)
	dnl Check whether a function is declared.
	AC_DEFUN([gt_CHECK_DECL],
	[
	AC_CACHE_CHECK([whether $1 is declared], ac_cv_have_decl_$1,
	[AC_TRY_COMPILE([$2], [
	#ifndef $1
	char p = (char ) $1;
	#endif
	], ac_cv_have_decl_$1=yes, ac_cv_have_decl_$1=no)])
	if test $ac_cv_have_decl_$1 = yes; then
	gt_value=1
	else
	gt_value=0
	fi
	AC_DEFINE_UNQUOTED([HAVE_DECL_]translit($1, [a-z], [A-Z]), [$gt_value],
	[Define to 1 if you have the declaration of `$1', and to 0 if you don't.])
	])
	diff --git a/m4/intldir.m4 b/m4/intldir.m4
	index 7a28843f6..0bc1b7a08 100644
	--- a/m4/intldir.m4
	+++ b/m4/intldir.m4
	@@ -1,19 +1,19 @@
	# intldir.m4 serial 1 (gettext-0.16)
	dnl Copyright (C) 2006 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	AC_PREREQ(2.52)

	dnl Tells the AM_GNU_GETTEXT macro to consider an intl/ directory.
	AC_DEFUN([AM_GNU_GETTEXT_INTL_SUBDIR], [])
	diff --git a/m4/lcmessage.m4 b/m4/lcmessage.m4
	index 19aa77e4f..eef389d53 100644
	--- a/m4/lcmessage.m4
	+++ b/m4/lcmessage.m4
	@@ -1,30 +1,30 @@
	# lcmessage.m4 serial 4 (gettext-0.14.2)
	dnl Copyright (C) 1995-2002, 2004-2005 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1995.

	# Check whether LC_MESSAGES is available in <locale.h>.

	AC_DEFUN([gt_LC_MESSAGES],
	[
	AC_CACHE_CHECK([for LC_MESSAGES], gt_cv_val_LC_MESSAGES,
	[AC_TRY_LINK([#include <locale.h>], [return LC_MESSAGES],
	gt_cv_val_LC_MESSAGES=yes, gt_cv_val_LC_MESSAGES=no)])
	if test $gt_cv_val_LC_MESSAGES = yes; then
	AC_DEFINE(HAVE_LC_MESSAGES, 1,
	[Define if your <locale.h> file defines LC_MESSAGES.])
	fi
	])
	diff --git a/m4/nls.m4 b/m4/nls.m4
	index 7967cc2f9..6b50be3af 100644
	--- a/m4/nls.m4
	+++ b/m4/nls.m4
	@@ -1,31 +1,31 @@
	# nls.m4 serial 3 (gettext-0.15)
	dnl Copyright (C) 1995-2003, 2005-2006 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1995-2000.
	dnl Bruno Haible <haible@clisp.cons.org>, 2000-2003.

	AC_PREREQ(2.50)

	AC_DEFUN([AM_NLS],
	[
	AC_MSG_CHECKING([whether NLS is requested])
	dnl Default is enabled NLS
	AC_ARG_ENABLE(nls,
	[ --disable-nls do not use Native Language Support],
	USE_NLS=$enableval, USE_NLS=yes)
	AC_MSG_RESULT($USE_NLS)
	AC_SUBST(USE_NLS)
	])
	diff --git a/m4/po.m4 b/m4/po.m4
	index f7c9c067f..201c7cab3 100644
	--- a/m4/po.m4
	+++ b/m4/po.m4
	@@ -1,449 +1,449 @@
	# po.m4 serial 15 (gettext-0.17)
	dnl Copyright (C) 1995-2007 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1995-2000.
	dnl Bruno Haible <haible@clisp.cons.org>, 2000-2003.

	AC_PREREQ(2.50)

	dnl Checks for all prerequisites of the po subdirectory.
	AC_DEFUN([AM_PO_SUBDIRS],
	[
	AC_REQUIRE([AC_PROG_MAKE_SET])dnl
	AC_REQUIRE([AC_PROG_INSTALL])dnl
	AC_REQUIRE([AC_PROG_MKDIR_P])dnl
	AC_REQUIRE([AM_NLS])dnl

	dnl Release version of the gettext macros. This is used to ensure that
	dnl the gettext macros and po/Makefile.in.in are in sync.
	AC_SUBST([GETTEXT_MACRO_VERSION], [0.17])

	dnl Perform the following tests also if --disable-nls has been given,
	dnl because they are needed for "make dist" to work.

	dnl Search for GNU msgfmt in the PATH.
	dnl The first test excludes Solaris msgfmt and early GNU msgfmt versions.
	dnl The second test excludes FreeBSD msgfmt.
	AM_PATH_PROG_WITH_TEST(MSGFMT, msgfmt,
	[$ac_dir/$ac_word --statistics /dev/null >&]AS_MESSAGE_LOG_FD[ 2>&1 &&
	(if $ac_dir/$ac_word --statistics /dev/null 2>&1 >/dev/null \| grep usage >/dev/null; then exit 1; else exit 0; fi)],
	:)
	AC_PATH_PROG(GMSGFMT, gmsgfmt, $MSGFMT)

	dnl Test whether it is GNU msgfmt >= 0.15.
	changequote(,)dnl
	case `$MSGFMT --version \| sed 1q \| sed -e 's,^[^0-9]*,,'` in
	'' \| 0.[0-9] \| 0.[0-9].* \| 0.1[0-4] \| 0.1[0-4].*) MSGFMT_015=: ;;
	*) MSGFMT_015=$MSGFMT ;;
	esac
	changequote([,])dnl
	AC_SUBST([MSGFMT_015])
	changequote(,)dnl
	case `$GMSGFMT --version \| sed 1q \| sed -e 's,^[^0-9]*,,'` in
	'' \| 0.[0-9] \| 0.[0-9].* \| 0.1[0-4] \| 0.1[0-4].*) GMSGFMT_015=: ;;
	*) GMSGFMT_015=$GMSGFMT ;;
	esac
	changequote([,])dnl
	AC_SUBST([GMSGFMT_015])

	dnl Search for GNU xgettext 0.12 or newer in the PATH.
	dnl The first test excludes Solaris xgettext and early GNU xgettext versions.
	dnl The second test excludes FreeBSD xgettext.
	AM_PATH_PROG_WITH_TEST(XGETTEXT, xgettext,
	[$ac_dir/$ac_word --omit-header --copyright-holder= --msgid-bugs-address= /dev/null >&]AS_MESSAGE_LOG_FD[ 2>&1 &&
	(if $ac_dir/$ac_word --omit-header --copyright-holder= --msgid-bugs-address= /dev/null 2>&1 >/dev/null \| grep usage >/dev/null; then exit 1; else exit 0; fi)],
	:)
	dnl Remove leftover from FreeBSD xgettext call.
	rm -f messages.po

	dnl Test whether it is GNU xgettext >= 0.15.
	changequote(,)dnl
	case `$XGETTEXT --version \| sed 1q \| sed -e 's,^[^0-9]*,,'` in
	'' \| 0.[0-9] \| 0.[0-9].* \| 0.1[0-4] \| 0.1[0-4].*) XGETTEXT_015=: ;;
	*) XGETTEXT_015=$XGETTEXT ;;
	esac
	changequote([,])dnl
	AC_SUBST([XGETTEXT_015])

	dnl Search for GNU msgmerge 0.11 or newer in the PATH.
	AM_PATH_PROG_WITH_TEST(MSGMERGE, msgmerge,
	[$ac_dir/$ac_word --update -q /dev/null /dev/null >&]AS_MESSAGE_LOG_FD[ 2>&1], :)

	dnl Installation directories.
	dnl Autoconf >= 2.60 defines localedir. For older versions of autoconf, we
	dnl have to define it here, so that it can be used in po/Makefile.
	test -n "$localedir" \|\| localedir='${datadir}/locale'
	AC_SUBST([localedir])

	dnl Support for AM_XGETTEXT_OPTION.
	test -n "${XGETTEXT_EXTRA_OPTIONS+set}" \|\| XGETTEXT_EXTRA_OPTIONS=
	AC_SUBST([XGETTEXT_EXTRA_OPTIONS])

	AC_CONFIG_COMMANDS([po-directories], [[
	for ac_file in $CONFIG_FILES; do
	# Support "outfile[:infile[:infile...]]"
	case "$ac_file" in
	:) ac_file=`echo "$ac_file"\|sed 's%:.*%%'` ;;
	esac
	# PO directories have a Makefile.in generated from Makefile.in.in.
	case "$ac_file" in */Makefile.in)
	# Adjust a relative srcdir.
	ac_dir=`echo "$ac_file"\|sed 's%/[^/][^/]*$%%'`
	ac_dir_suffix="/`echo "$ac_dir"\|sed 's%^\./%%'`"
	ac_dots=`echo "$ac_dir_suffix"\|sed 's%/[^/]*%../%g'`
	# In autoconf-2.13 it is called $ac_given_srcdir.
	# In autoconf-2.50 it is called $srcdir.
	test -n "$ac_given_srcdir" \|\| ac_given_srcdir="$srcdir"
	case "$ac_given_srcdir" in
	.) top_srcdir=`echo $ac_dots\|sed 's%/$%%'` ;;
	/*) top_srcdir="$ac_given_srcdir" ;;
	*) top_srcdir="$ac_dots$ac_given_srcdir" ;;
	esac
	# Treat a directory as a PO directory if and only if it has a
	# POTFILES.in file. This allows packages to have multiple PO
	# directories under different names or in different locations.
	if test -f "$ac_given_srcdir/$ac_dir/POTFILES.in"; then
	rm -f "$ac_dir/POTFILES"
	test -n "$as_me" && echo "$as_me: creating $ac_dir/POTFILES" \|\| echo "creating $ac_dir/POTFILES"
	cat "$ac_given_srcdir/$ac_dir/POTFILES.in" \| sed -e "/^#/d" -e "/^[ ]\$/d" -e "s,., $top_srcdir/& \\\\," \| sed -e "\$s/$.*$ \\\\/\1/" > "$ac_dir/POTFILES"
	POMAKEFILEDEPS="POTFILES.in"
	# ALL_LINGUAS, POFILES, UPDATEPOFILES, DUMMYPOFILES, GMOFILES depend
	# on $ac_dir but don't depend on user-specified configuration
	# parameters.
	if test -f "$ac_given_srcdir/$ac_dir/LINGUAS"; then
	# The LINGUAS file contains the set of available languages.
	if test -n "$OBSOLETE_ALL_LINGUAS"; then
	test -n "$as_me" && echo "$as_me: setting ALL_LINGUAS in configure.in is obsolete" \|\| echo "setting ALL_LINGUAS in configure.in is obsolete"
	fi
	ALL_LINGUAS_=`sed -e "/^#/d" -e "s/#.*//" "$ac_given_srcdir/$ac_dir/LINGUAS"`
	# Hide the ALL_LINGUAS assigment from automake < 1.5.
	eval 'ALL_LINGUAS''=$ALL_LINGUAS_'
	POMAKEFILEDEPS="$POMAKEFILEDEPS LINGUAS"
	else
	# The set of available languages was given in configure.in.
	# Hide the ALL_LINGUAS assigment from automake < 1.5.
	eval 'ALL_LINGUAS''=$OBSOLETE_ALL_LINGUAS'
	fi
	# Compute POFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(lang).po)
	# Compute UPDATEPOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(lang).po-update)
	# Compute DUMMYPOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(lang).nop)
	# Compute GMOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(lang).gmo)
	case "$ac_given_srcdir" in
	.) srcdirpre= ;;
	*) srcdirpre='$(srcdir)/' ;;
	esac
	POFILES=
	UPDATEPOFILES=
	DUMMYPOFILES=
	GMOFILES=
	for lang in $ALL_LINGUAS; do
	POFILES="$POFILES $srcdirpre$lang.po"
	UPDATEPOFILES="$UPDATEPOFILES $lang.po-update"
	DUMMYPOFILES="$DUMMYPOFILES $lang.nop"
	GMOFILES="$GMOFILES $srcdirpre$lang.gmo"
	done
	# CATALOGS depends on both $ac_dir and the user's LINGUAS
	# environment variable.
	INST_LINGUAS=
	if test -n "$ALL_LINGUAS"; then
	for presentlang in $ALL_LINGUAS; do
	useit=no
	if test "%UNSET%" != "$LINGUAS"; then
	desiredlanguages="$LINGUAS"
	else
	desiredlanguages="$ALL_LINGUAS"
	fi
	for desiredlang in $desiredlanguages; do
	# Use the presentlang catalog if desiredlang is
	# a. equal to presentlang, or
	# b. a variant of presentlang (because in this case,
	# presentlang can be used as a fallback for messages
	# which are not translated in the desiredlang catalog).
	case "$desiredlang" in
	"$presentlang"*) useit=yes;;
	esac
	done
	if test $useit = yes; then
	INST_LINGUAS="$INST_LINGUAS $presentlang"
	fi
	done
	fi
	CATALOGS=
	if test -n "$INST_LINGUAS"; then
	for lang in $INST_LINGUAS; do
	CATALOGS="$CATALOGS $lang.gmo"
	done
	fi
	test -n "$as_me" && echo "$as_me: creating $ac_dir/Makefile" \|\| echo "creating $ac_dir/Makefile"
	sed -e "/^POTFILES =/r $ac_dir/POTFILES" -e "/^# Makevars/r $ac_given_srcdir/$ac_dir/Makevars" -e "s\|@POFILES@\|$POFILES\|g" -e "s\|@UPDATEPOFILES@\|$UPDATEPOFILES\|g" -e "s\|@DUMMYPOFILES@\|$DUMMYPOFILES\|g" -e "s\|@GMOFILES@\|$GMOFILES\|g" -e "s\|@CATALOGS@\|$CATALOGS\|g" -e "s\|@POMAKEFILEDEPS@\|$POMAKEFILEDEPS\|g" "$ac_dir/Makefile.in" > "$ac_dir/Makefile"
	for f in "$ac_given_srcdir/$ac_dir"/Rules-*; do
	if test -f "$f"; then
	case "$f" in
	.orig \| .bak \| *~) ;;
	*) cat "$f" >> "$ac_dir/Makefile" ;;
	esac
	fi
	done
	fi
	;;
	esac
	done]],
	[# Capture the value of obsolete ALL_LINGUAS because we need it to compute
	# POFILES, UPDATEPOFILES, DUMMYPOFILES, GMOFILES, CATALOGS. But hide it
	# from automake < 1.5.
	eval 'OBSOLETE_ALL_LINGUAS''="$ALL_LINGUAS"'
	# Capture the value of LINGUAS because we need it to compute CATALOGS.
	LINGUAS="${LINGUAS-%UNSET%}"
	])
	])

	dnl Postprocesses a Makefile in a directory containing PO files.
	AC_DEFUN([AM_POSTPROCESS_PO_MAKEFILE],
	[
	# When this code is run, in config.status, two variables have already been
	# set:
	# - OBSOLETE_ALL_LINGUAS is the value of LINGUAS set in configure.in,
	# - LINGUAS is the value of the environment variable LINGUAS at configure
	# time.

	changequote(,)dnl
	# Adjust a relative srcdir.
	ac_dir=`echo "$ac_file"\|sed 's%/[^/][^/]*$%%'`
	ac_dir_suffix="/`echo "$ac_dir"\|sed 's%^\./%%'`"
	ac_dots=`echo "$ac_dir_suffix"\|sed 's%/[^/]*%../%g'`
	# In autoconf-2.13 it is called $ac_given_srcdir.
	# In autoconf-2.50 it is called $srcdir.
	test -n "$ac_given_srcdir" \|\| ac_given_srcdir="$srcdir"
	case "$ac_given_srcdir" in
	.) top_srcdir=`echo $ac_dots\|sed 's%/$%%'` ;;
	/*) top_srcdir="$ac_given_srcdir" ;;
	*) top_srcdir="$ac_dots$ac_given_srcdir" ;;
	esac

	# Find a way to echo strings without interpreting backslash.
	if test "X`(echo '\t') 2>/dev/null`" = 'X\t'; then
	gt_echo='echo'
	else
	if test "X`(printf '%s\n' '\t') 2>/dev/null`" = 'X\t'; then
	gt_echo='printf %s\n'
	else
	echo_func () {
	cat <<EOT
	$*
	EOT
	}
	gt_echo='echo_func'
	fi
	fi

	# A sed script that extracts the value of VARIABLE from a Makefile.
	sed_x_variable='
	# Test if the hold space is empty.
	x
	s/P/P/
	x
	ta
	# Yes it was empty. Look if we have the expected variable definition.
	/^[ ]VARIABLE[ ]=/{
	# Seen the first line of the variable definition.
	s/^[ ]VARIABLE[ ]=//
	ba
	}
	bd
	:a
	# Here we are processing a line from the variable definition.
	# Remove comment, more precisely replace it with a space.
	s/#.*$/ /
	# See if the line ends in a backslash.
	tb
	:b
	s/\\$//
	# Print the line, without the trailing backslash.
	p
	tc
	# There was no trailing backslash. The end of the variable definition is
	# reached. Clear the hold space.
	s/^.*$//
	x
	bd
	:c
	# A trailing backslash means that the variable definition continues in the
	# next line. Put a nonempty string into the hold space to indicate this.
	s/^.*$/P/
	x
	:d
	'
	changequote([,])dnl

	# Set POTFILES to the value of the Makefile variable POTFILES.
	sed_x_POTFILES=`$gt_echo "$sed_x_variable" \| sed -e '/^ *#/d' -e 's/VARIABLE/POTFILES/g'`
	POTFILES=`sed -n -e "$sed_x_POTFILES" < "$ac_file"`
	# Compute POTFILES_DEPS as
	# $(foreach file, $(POTFILES), $(top_srcdir)/$(file))
	POTFILES_DEPS=
	for file in $POTFILES; do
	POTFILES_DEPS="$POTFILES_DEPS "'$(top_srcdir)/'"$file"
	done
	POMAKEFILEDEPS=""

	if test -n "$OBSOLETE_ALL_LINGUAS"; then
	test -n "$as_me" && echo "$as_me: setting ALL_LINGUAS in configure.in is obsolete" \|\| echo "setting ALL_LINGUAS in configure.in is obsolete"
	fi
	if test -f "$ac_given_srcdir/$ac_dir/LINGUAS"; then
	# The LINGUAS file contains the set of available languages.
	ALL_LINGUAS_=`sed -e "/^#/d" -e "s/#.*//" "$ac_given_srcdir/$ac_dir/LINGUAS"`
	POMAKEFILEDEPS="$POMAKEFILEDEPS LINGUAS"
	else
	# Set ALL_LINGUAS to the value of the Makefile variable LINGUAS.
	sed_x_LINGUAS=`$gt_echo "$sed_x_variable" \| sed -e '/^ *#/d' -e 's/VARIABLE/LINGUAS/g'`
	ALL_LINGUAS_=`sed -n -e "$sed_x_LINGUAS" < "$ac_file"`
	fi
	# Hide the ALL_LINGUAS assigment from automake < 1.5.
	eval 'ALL_LINGUAS''=$ALL_LINGUAS_'
	# Compute POFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(lang).po)
	# Compute UPDATEPOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(lang).po-update)
	# Compute DUMMYPOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(lang).nop)
	# Compute GMOFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(lang).gmo)
	# Compute PROPERTIESFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(top_srcdir)/$(DOMAIN)_$(lang).properties)
	# Compute CLASSFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(top_srcdir)/$(DOMAIN)_$(lang).class)
	# Compute QMFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(lang).qm)
	# Compute MSGFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(frob $(lang)).msg)
	# Compute RESOURCESDLLFILES
	# as $(foreach lang, $(ALL_LINGUAS), $(srcdir)/$(frob $(lang))/$(DOMAIN).resources.dll)
	case "$ac_given_srcdir" in
	.) srcdirpre= ;;
	*) srcdirpre='$(srcdir)/' ;;
	esac
	POFILES=
	UPDATEPOFILES=
	DUMMYPOFILES=
	GMOFILES=
	PROPERTIESFILES=
	CLASSFILES=
	QMFILES=
	MSGFILES=
	RESOURCESDLLFILES=
	for lang in $ALL_LINGUAS; do
	POFILES="$POFILES $srcdirpre$lang.po"
	UPDATEPOFILES="$UPDATEPOFILES $lang.po-update"
	DUMMYPOFILES="$DUMMYPOFILES $lang.nop"
	GMOFILES="$GMOFILES $srcdirpre$lang.gmo"
	PROPERTIESFILES="$PROPERTIESFILES \$(top_srcdir)/\$(DOMAIN)_$lang.properties"
	CLASSFILES="$CLASSFILES \$(top_srcdir)/\$(DOMAIN)_$lang.class"
	QMFILES="$QMFILES $srcdirpre$lang.qm"
	frobbedlang=`echo $lang \| sed -e 's/\..*$//' -e 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/'`
	MSGFILES="$MSGFILES $srcdirpre$frobbedlang.msg"
	frobbedlang=`echo $lang \| sed -e 's/_/-/g' -e 's/^sr-CS/sr-SP/' -e 's/@latin$/-Latn/' -e 's/@cyrillic$/-Cyrl/' -e 's/^sr-SP$/sr-SP-Latn/' -e 's/^uz-UZ$/uz-UZ-Latn/'`
	RESOURCESDLLFILES="$RESOURCESDLLFILES $srcdirpre$frobbedlang/\$(DOMAIN).resources.dll"
	done
	# CATALOGS depends on both $ac_dir and the user's LINGUAS
	# environment variable.
	INST_LINGUAS=
	if test -n "$ALL_LINGUAS"; then
	for presentlang in $ALL_LINGUAS; do
	useit=no
	if test "%UNSET%" != "$LINGUAS"; then
	desiredlanguages="$LINGUAS"
	else
	desiredlanguages="$ALL_LINGUAS"
	fi
	for desiredlang in $desiredlanguages; do
	# Use the presentlang catalog if desiredlang is
	# a. equal to presentlang, or
	# b. a variant of presentlang (because in this case,
	# presentlang can be used as a fallback for messages
	# which are not translated in the desiredlang catalog).
	case "$desiredlang" in
	"$presentlang"*) useit=yes;;
	esac
	done
	if test $useit = yes; then
	INST_LINGUAS="$INST_LINGUAS $presentlang"
	fi
	done
	fi
	CATALOGS=
	JAVACATALOGS=
	QTCATALOGS=
	TCLCATALOGS=
	CSHARPCATALOGS=
	if test -n "$INST_LINGUAS"; then
	for lang in $INST_LINGUAS; do
	CATALOGS="$CATALOGS $lang.gmo"
	JAVACATALOGS="$JAVACATALOGS \$(DOMAIN)_$lang.properties"
	QTCATALOGS="$QTCATALOGS $lang.qm"
	frobbedlang=`echo $lang \| sed -e 's/\..*$//' -e 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/'`
	TCLCATALOGS="$TCLCATALOGS $frobbedlang.msg"
	frobbedlang=`echo $lang \| sed -e 's/_/-/g' -e 's/^sr-CS/sr-SP/' -e 's/@latin$/-Latn/' -e 's/@cyrillic$/-Cyrl/' -e 's/^sr-SP$/sr-SP-Latn/' -e 's/^uz-UZ$/uz-UZ-Latn/'`
	CSHARPCATALOGS="$CSHARPCATALOGS $frobbedlang/\$(DOMAIN).resources.dll"
	done
	fi

	sed -e "s\|@POTFILES_DEPS@\|$POTFILES_DEPS\|g" -e "s\|@POFILES@\|$POFILES\|g" -e "s\|@UPDATEPOFILES@\|$UPDATEPOFILES\|g" -e "s\|@DUMMYPOFILES@\|$DUMMYPOFILES\|g" -e "s\|@GMOFILES@\|$GMOFILES\|g" -e "s\|@PROPERTIESFILES@\|$PROPERTIESFILES\|g" -e "s\|@CLASSFILES@\|$CLASSFILES\|g" -e "s\|@QMFILES@\|$QMFILES\|g" -e "s\|@MSGFILES@\|$MSGFILES\|g" -e "s\|@RESOURCESDLLFILES@\|$RESOURCESDLLFILES\|g" -e "s\|@CATALOGS@\|$CATALOGS\|g" -e "s\|@JAVACATALOGS@\|$JAVACATALOGS\|g" -e "s\|@QTCATALOGS@\|$QTCATALOGS\|g" -e "s\|@TCLCATALOGS@\|$TCLCATALOGS\|g" -e "s\|@CSHARPCATALOGS@\|$CSHARPCATALOGS\|g" -e 's,^#distdir:,distdir:,' < "$ac_file" > "$ac_file.tmp"
	if grep -l '@TCLCATALOGS@' "$ac_file" > /dev/null; then
	# Add dependencies that cannot be formulated as a simple suffix rule.
	for lang in $ALL_LINGUAS; do
	frobbedlang=`echo $lang \| sed -e 's/\..*$//' -e 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/'`
	cat >> "$ac_file.tmp" <<EOF
	$frobbedlang.msg: $lang.po
	@echo "\$(MSGFMT) -c --tcl -d \$(srcdir) -l $lang $srcdirpre$lang.po"; \
	\$(MSGFMT) -c --tcl -d "\$(srcdir)" -l $lang $srcdirpre$lang.po \|\| { rm -f "\$(srcdir)/$frobbedlang.msg"; exit 1; }
	EOF
	done
	fi
	if grep -l '@CSHARPCATALOGS@' "$ac_file" > /dev/null; then
	# Add dependencies that cannot be formulated as a simple suffix rule.
	for lang in $ALL_LINGUAS; do
	frobbedlang=`echo $lang \| sed -e 's/_/-/g' -e 's/^sr-CS/sr-SP/' -e 's/@latin$/-Latn/' -e 's/@cyrillic$/-Cyrl/' -e 's/^sr-SP$/sr-SP-Latn/' -e 's/^uz-UZ$/uz-UZ-Latn/'`
	cat >> "$ac_file.tmp" <<EOF
	$frobbedlang/\$(DOMAIN).resources.dll: $lang.po
	@echo "\$(MSGFMT) -c --csharp -d \$(srcdir) -l $lang $srcdirpre$lang.po -r \$(DOMAIN)"; \
	\$(MSGFMT) -c --csharp -d "\$(srcdir)" -l $lang $srcdirpre$lang.po -r "\$(DOMAIN)" \|\| { rm -f "\$(srcdir)/$frobbedlang.msg"; exit 1; }
	EOF
	done
	fi
	if test -n "$POMAKEFILEDEPS"; then
	cat >> "$ac_file.tmp" <<EOF
	Makefile: $POMAKEFILEDEPS
	EOF
	fi
	mv "$ac_file.tmp" "$ac_file"
	])

	dnl Initializes the accumulator used by AM_XGETTEXT_OPTION.
	AC_DEFUN([AM_XGETTEXT_OPTION_INIT],
	[
	XGETTEXT_EXTRA_OPTIONS=
	])

	dnl Registers an option to be passed to xgettext in the po subdirectory.
	AC_DEFUN([AM_XGETTEXT_OPTION],
	[
	AC_REQUIRE([AM_XGETTEXT_OPTION_INIT])
	XGETTEXT_EXTRA_OPTIONS="$XGETTEXT_EXTRA_OPTIONS $1"
	])
	diff --git a/m4/progtest.m4 b/m4/progtest.m4
	index a56365cd3..6dc2f0fd4 100644
	--- a/m4/progtest.m4
	+++ b/m4/progtest.m4
	@@ -1,92 +1,92 @@
	# progtest.m4 serial 4 (gettext-0.14.2)
	dnl Copyright (C) 1996-2003, 2005 Free Software Foundation, Inc.
	dnl This file is free software; the Free Software Foundation
	dnl gives unlimited permission to copy and/or distribute it,
	dnl with or without modifications, as long as this notice is preserved.
	dnl
	-dnl This file can can be used in projects which are not available under
	+dnl This file can be used in projects which are not available under
	dnl the GNU General Public License or the GNU Library General Public
	dnl License but which still want to provide support for the GNU gettext
	dnl functionality.
	dnl Please note that the actual code of the GNU gettext library is covered
	dnl by the GNU Library General Public License, and the rest of the GNU
	-dnl gettext package package is covered by the GNU General Public License.
	+dnl gettext package is covered by the GNU General Public License.
	dnl They are not in the public domain.

	dnl Authors:
	dnl Ulrich Drepper <drepper@cygnus.com>, 1996.

	AC_PREREQ(2.50)

	# Search path for a program which passes the given test.

	dnl AM_PATH_PROG_WITH_TEST(VARIABLE, PROG-TO-CHECK-FOR,
	dnl TEST-PERFORMED-ON-FOUND_PROGRAM [, VALUE-IF-NOT-FOUND [, PATH]])
	AC_DEFUN([AM_PATH_PROG_WITH_TEST],
	[
	# Prepare PATH_SEPARATOR.
	# The user is always right.
	if test "${PATH_SEPARATOR+set}" != set; then
	echo "#! /bin/sh" >conf$$.sh
	echo "exit 0" >>conf$$.sh
	chmod +x conf$$.sh
	if (PATH="/nonexistent;."; conf$$.sh) >/dev/null 2>&1; then
	PATH_SEPARATOR=';'
	else
	PATH_SEPARATOR=:
	fi
	rm -f conf$$.sh
	fi

	# Find out how to test for executable files. Don't use a zero-byte file,
	# as systems may use methods other than mode bits to determine executability.
	cat >conf$$.file <<_ASEOF
	#! /bin/sh
	exit 0
	_ASEOF
	chmod +x conf$$.file
	if test -x conf$$.file >/dev/null 2>&1; then
	ac_executable_p="test -x"
	else
	ac_executable_p="test -f"
	fi
	rm -f conf$$.file

	# Extract the first word of "$2", so it can be a program name with args.
	set dummy $2; ac_word=[$]2
	AC_MSG_CHECKING([for $ac_word])
	AC_CACHE_VAL(ac_cv_path_$1,
	[case "[$]$1" in
	[[\\/]]* \| ?:[[\\/]]*)
	ac_cv_path_$1="[$]$1" # Let the user override the test with a path.
	;;
	*)
	ac_save_IFS="$IFS"; IFS=$PATH_SEPARATOR
	for ac_dir in ifelse([$5], , $PATH, [$5]); do
	IFS="$ac_save_IFS"
	test -z "$ac_dir" && ac_dir=.
	for ac_exec_ext in '' $ac_executable_extensions; do
	if $ac_executable_p "$ac_dir/$ac_word$ac_exec_ext"; then
	echo "$as_me: trying $ac_dir/$ac_word..." >&AS_MESSAGE_LOG_FD
	if [$3]; then
	ac_cv_path_$1="$ac_dir/$ac_word$ac_exec_ext"
	break 2
	fi
	fi
	done
	done
	IFS="$ac_save_IFS"
	dnl If no 4th arg is given, leave the cache variable unset,
	dnl so AC_PATH_PROGS will keep looking.
	ifelse([$4], , , [ test -z "[$]ac_cv_path_$1" && ac_cv_path_$1="$4"
	])dnl
	;;
	esac])dnl
	$1="$ac_cv_path_$1"
	if test ifelse([$4], , [-n "[$]$1"], ["[$]$1" != "$4"]); then
	AC_MSG_RESULT([$]$1)
	else
	AC_MSG_RESULT(no)
	fi
	AC_SUBST($1)dnl
	])
	diff --git a/scd/apdu.c b/scd/apdu.c
	index 82d53b1fa..9df1572f5 100644
	--- a/scd/apdu.c
	+++ b/scd/apdu.c
	@@ -1,4387 +1,4387 @@
	/* apdu.c - ISO 7816 APDU functions and low level I/O
	* Copyright (C) 2003, 2004, 2008, 2009, 2010,
	* 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* NOTE: This module is also used by other software, thus the use of
	the macro USE_NPTH is mandatory. For GnuPG this macro is
	guaranteed to be defined true. */

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <signal.h>
	#ifdef USE_NPTH
	# include <unistd.h>
	# include <fcntl.h>
	# include <npth.h>
	#endif


	/* If requested include the definitions for the remote APDU protocol
	code. */
	#ifdef USE_G10CODE_RAPDU
	#include "rapdu.h"
	#endif /USE_G10CODE_RAPDU/

	#if defined(GNUPG_SCD_MAIN_HEADER)
	#include GNUPG_SCD_MAIN_HEADER
	#elif GNUPG_MAJOR_VERSION == 1
	/* This is used with GnuPG version < 1.9. The code has been source
	copied from the current GnuPG >= 1.9 and is maintained over
	there. */
	#include "options.h"
	#include "errors.h"
	#include "memory.h"
	#include "util.h"
	#include "i18n.h"
	#include "dynload.h"
	#include "cardglue.h"
	#else /* GNUPG_MAJOR_VERSION != 1 */
	#include "scdaemon.h"
	#include "exechelp.h"
	#endif /* GNUPG_MAJOR_VERSION != 1 */
	#include "host2net.h"

	#include "iso7816.h"
	#include "apdu.h"
	#define CCID_DRIVER_INCLUDE_USB_IDS 1
	#include "ccid-driver.h"

	struct dev_list {
	struct ccid_dev_table *ccid_table;
	const char *portstr;
	int idx;
	int idx_max;
	};

	/* Due to conflicting use of threading libraries we usually can't link
	against libpcsclite if we are using Pth. Instead we use a wrapper
	program. Note that with nPth there is no need for a wrapper. */
	#ifdef USE_PTH /* Right, plain old Pth. */
	#if !defined(HAVE_W32_SYSTEM) && !defined(__CYGWIN__)
	#define NEED_PCSC_WRAPPER 1
	#endif
	#endif


	#define MAX_READER 4 /* Number of readers we support concurrently. */


	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	#define DLSTDCALL __stdcall
	#else
	#define DLSTDCALL
	#endif

	#if defined(__APPLE__) \|\| defined(_WIN32) \|\| defined(__CYGWIN__)
	typedef unsigned int pcsc_dword_t;
	#else
	typedef unsigned long pcsc_dword_t;
	#endif

	/* A structure to collect information pertaining to one reader
	slot. */
	struct reader_table_s {
	int used; /* True if slot is used. */
	unsigned short port; /* Port number: 0 = unused, 1 - dev/tty */

	/* Function pointers intialized to the various backends. */
	int (*connect_card)(int);
	int (*disconnect_card)(int);
	int (*close_reader)(int);
	int (*reset_reader)(int);
	int (get_status_reader)(int, unsigned int , int);
	int (send_apdu_reader)(int,unsigned char ,size_t,
	unsigned char , size_t , pininfo_t *);
	int (check_pinpad)(int, int, pininfo_t );
	void (*dump_status_reader)(int);
	int (set_progress_cb)(int, gcry_handler_progress_t, void);
	int (pinpad_verify)(int, int, int, int, int, pininfo_t );
	int (pinpad_modify)(int, int, int, int, int, pininfo_t );

	struct {
	ccid_driver_t handle;
	} ccid;
	struct {
	long context;
	long card;
	pcsc_dword_t protocol;
	pcsc_dword_t verify_ioctl;
	pcsc_dword_t modify_ioctl;
	int pinmin;
	int pinmax;
	#ifdef NEED_PCSC_WRAPPER
	int req_fd;
	int rsp_fd;
	pid_t pid;
	#endif /NEED_PCSC_WRAPPER/
	} pcsc;
	#ifdef USE_G10CODE_RAPDU
	struct {
	rapdu_t handle;
	} rapdu;
	#endif /USE_G10CODE_RAPDU/
	char rdrname; / Name of the connected reader or NULL if unknown. */
	unsigned int is_t0:1; /* True if we know that we are running T=0. */
	unsigned int is_spr532:1; /* True if we know that the reader is a SPR532. */
	unsigned int pinpad_varlen_supported:1; /* True if we know that the reader
	supports variable length pinpad
	input. */
	unsigned int require_get_status:1;
	unsigned char atr[33];
	size_t atrlen; /* A zero length indicates that the ATR has
	not yet been read; i.e. the card is not
	ready for use. */
	#ifdef USE_NPTH
	npth_mutex_t lock;
	#endif
	};
	typedef struct reader_table_s *reader_table_t;

	/* A global table to keep track of active readers. */
	static struct reader_table_s reader_table[MAX_READER];

	#ifdef USE_NPTH
	static npth_mutex_t reader_table_lock;
	#endif


	/* ct API function pointer. */
	static char (* DLSTDCALL CT_init) (unsigned short ctn, unsigned short Pn);
	static char (* DLSTDCALL CT_data) (unsigned short ctn, unsigned char *dad,
	unsigned char *sad, unsigned short lc,
	unsigned char cmd, unsigned short lr,
	unsigned char *rsp);
	static char (* DLSTDCALL CT_close) (unsigned short ctn);

	/* PC/SC constants and function pointer. */
	#define PCSC_SCOPE_USER 0
	#define PCSC_SCOPE_TERMINAL 1
	#define PCSC_SCOPE_SYSTEM 2
	#define PCSC_SCOPE_GLOBAL 3

	#define PCSC_PROTOCOL_T0 1
	#define PCSC_PROTOCOL_T1 2
	#ifdef HAVE_W32_SYSTEM
	# define PCSC_PROTOCOL_RAW 0x00010000 /* The active protocol. */
	#else
	# define PCSC_PROTOCOL_RAW 4
	#endif

	#define PCSC_SHARE_EXCLUSIVE 1
	#define PCSC_SHARE_SHARED 2
	#define PCSC_SHARE_DIRECT 3

	#define PCSC_LEAVE_CARD 0
	#define PCSC_RESET_CARD 1
	#define PCSC_UNPOWER_CARD 2
	#define PCSC_EJECT_CARD 3

	#ifdef HAVE_W32_SYSTEM
	# define PCSC_UNKNOWN 0x0000 /* The driver is not aware of the status. */
	# define PCSC_ABSENT 0x0001 /* Card is absent. */
	# define PCSC_PRESENT 0x0002 /* Card is present. */
	# define PCSC_SWALLOWED 0x0003 /* Card is present and electrical connected. */
	# define PCSC_POWERED 0x0004 /* Card is powered. */
	# define PCSC_NEGOTIABLE 0x0005 /* Card is awaiting PTS. */
	# define PCSC_SPECIFIC 0x0006 /* Card is ready for use. */
	#else
	# define PCSC_UNKNOWN 0x0001
	# define PCSC_ABSENT 0x0002 /* Card is absent. */
	# define PCSC_PRESENT 0x0004 /* Card is present. */
	# define PCSC_SWALLOWED 0x0008 /* Card is present and electrical connected. */
	# define PCSC_POWERED 0x0010 /* Card is powered. */
	# define PCSC_NEGOTIABLE 0x0020 /* Card is awaiting PTS. */
	# define PCSC_SPECIFIC 0x0040 /* Card is ready for use. */
	#endif

	#define PCSC_STATE_UNAWARE 0x0000 /* Want status. */
	#define PCSC_STATE_IGNORE 0x0001 /* Ignore this reader. */
	#define PCSC_STATE_CHANGED 0x0002 /* State has changed. */
	#define PCSC_STATE_UNKNOWN 0x0004 /* Reader unknown. */
	#define PCSC_STATE_UNAVAILABLE 0x0008 /* Status unavailable. */
	#define PCSC_STATE_EMPTY 0x0010 /* Card removed. */
	#define PCSC_STATE_PRESENT 0x0020 /* Card inserted. */
	#define PCSC_STATE_ATRMATCH 0x0040 /* ATR matches card. */
	#define PCSC_STATE_EXCLUSIVE 0x0080 /* Exclusive Mode. */
	#define PCSC_STATE_INUSE 0x0100 /* Shared mode. */
	#define PCSC_STATE_MUTE 0x0200 /* Unresponsive card. */
	#ifdef HAVE_W32_SYSTEM
	# define PCSC_STATE_UNPOWERED 0x0400 /* Card not powerred up. */
	#endif

	/* Some PC/SC error codes. */
	#define PCSC_E_CANCELLED 0x80100002
	#define PCSC_E_CANT_DISPOSE 0x8010000E
	#define PCSC_E_INSUFFICIENT_BUFFER 0x80100008
	#define PCSC_E_INVALID_ATR 0x80100015
	#define PCSC_E_INVALID_HANDLE 0x80100003
	#define PCSC_E_INVALID_PARAMETER 0x80100004
	#define PCSC_E_INVALID_TARGET 0x80100005
	#define PCSC_E_INVALID_VALUE 0x80100011
	#define PCSC_E_NO_MEMORY 0x80100006
	#define PCSC_E_UNKNOWN_READER 0x80100009
	#define PCSC_E_TIMEOUT 0x8010000A
	#define PCSC_E_SHARING_VIOLATION 0x8010000B
	#define PCSC_E_NO_SMARTCARD 0x8010000C
	#define PCSC_E_UNKNOWN_CARD 0x8010000D
	#define PCSC_E_PROTO_MISMATCH 0x8010000F
	#define PCSC_E_NOT_READY 0x80100010
	#define PCSC_E_SYSTEM_CANCELLED 0x80100012
	#define PCSC_E_NOT_TRANSACTED 0x80100016
	#define PCSC_E_READER_UNAVAILABLE 0x80100017
	#define PCSC_E_NO_SERVICE 0x8010001D
	#define PCSC_E_SERVICE_STOPPED 0x8010001E
	#define PCSC_W_REMOVED_CARD 0x80100069

	/* Fix pcsc-lite ABI incompatibilty. */
	#ifndef SCARD_CTL_CODE
	#ifdef _WIN32
	#include <winioctl.h>
	#define SCARD_CTL_CODE(code) CTL_CODE(FILE_DEVICE_SMARTCARD, (code), \
	METHOD_BUFFERED, FILE_ANY_ACCESS)
	#else
	#define SCARD_CTL_CODE(code) (0x42000000 + (code))
	#endif
	#endif

	#define CM_IOCTL_GET_FEATURE_REQUEST SCARD_CTL_CODE(3400)
	#define CM_IOCTL_VENDOR_IFD_EXCHANGE SCARD_CTL_CODE(1)
	#define FEATURE_VERIFY_PIN_DIRECT 0x06
	#define FEATURE_MODIFY_PIN_DIRECT 0x07
	#define FEATURE_GET_TLV_PROPERTIES 0x12

	#define PCSCv2_PART10_PROPERTY_bEntryValidationCondition 2
	#define PCSCv2_PART10_PROPERTY_bTimeOut2 3
	#define PCSCv2_PART10_PROPERTY_bMinPINSize 6
	#define PCSCv2_PART10_PROPERTY_bMaxPINSize 7
	#define PCSCv2_PART10_PROPERTY_wIdVendor 11
	#define PCSCv2_PART10_PROPERTY_wIdProduct 12


	/* The PC/SC error is defined as a long as per specs. Due to left
	shifts bit 31 will get sign extended. We use this mask to fix
	it. */
	#define PCSC_ERR_MASK(a) ((a) & 0xffffffff)


	struct pcsc_io_request_s
	{
	unsigned long protocol;
	unsigned long pci_len;
	};

	typedef struct pcsc_io_request_s *pcsc_io_request_t;

	#ifdef __APPLE__
	#pragma pack(1)
	#endif

	struct pcsc_readerstate_s
	{
	const char *reader;
	void *user_data;
	pcsc_dword_t current_state;
	pcsc_dword_t event_state;
	pcsc_dword_t atrlen;
	unsigned char atr[33];
	};

	#ifdef __APPLE__
	#pragma pack()
	#endif

	typedef struct pcsc_readerstate_s *pcsc_readerstate_t;

	long (* DLSTDCALL pcsc_establish_context) (pcsc_dword_t scope,
	const void *reserved1,
	const void *reserved2,
	long *r_context);
	long (* DLSTDCALL pcsc_release_context) (long context);
	long (* DLSTDCALL pcsc_list_readers) (long context,
	const char *groups,
	char readers, pcsc_dword_treaderslen);
	long (* DLSTDCALL pcsc_get_status_change) (long context,
	pcsc_dword_t timeout,
	pcsc_readerstate_t readerstates,
	pcsc_dword_t nreaderstates);
	long (* DLSTDCALL pcsc_connect) (long context,
	const char *reader,
	pcsc_dword_t share_mode,
	pcsc_dword_t preferred_protocols,
	long *r_card,
	pcsc_dword_t *r_active_protocol);
	long (* DLSTDCALL pcsc_reconnect) (long card,
	pcsc_dword_t share_mode,
	pcsc_dword_t preferred_protocols,
	pcsc_dword_t initialization,
	pcsc_dword_t *r_active_protocol);
	long (* DLSTDCALL pcsc_disconnect) (long card,
	pcsc_dword_t disposition);
	long (* DLSTDCALL pcsc_status) (long card,
	char reader, pcsc_dword_t readerlen,
	pcsc_dword_t *r_state,
	pcsc_dword_t *r_protocol,
	unsigned char atr, pcsc_dword_t atrlen);
	long (* DLSTDCALL pcsc_begin_transaction) (long card);
	long (* DLSTDCALL pcsc_end_transaction) (long card,
	pcsc_dword_t disposition);
	long (* DLSTDCALL pcsc_transmit) (long card,
	const pcsc_io_request_t send_pci,
	const unsigned char *send_buffer,
	pcsc_dword_t send_len,
	pcsc_io_request_t recv_pci,
	unsigned char *recv_buffer,
	pcsc_dword_t *recv_len);
	long (* DLSTDCALL pcsc_set_timeout) (long context,
	pcsc_dword_t timeout);
	long (* DLSTDCALL pcsc_control) (long card,
	pcsc_dword_t control_code,
	const void *send_buffer,
	pcsc_dword_t send_len,
	void *recv_buffer,
	pcsc_dword_t recv_len,
	pcsc_dword_t *bytes_returned);


	/* Prototypes. */
	static int pcsc_vendor_specific_init (int slot);
	static int pcsc_get_status (int slot, unsigned int *status, int on_wire);
	static int reset_pcsc_reader (int slot);
	static int apdu_get_status_internal (int slot, int hang, unsigned int *status,
	int on_wire);
	static int check_pcsc_pinpad (int slot, int command, pininfo_t *pininfo);
	static int pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo);
	static int pcsc_pinpad_modify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo);



	/*
	Helper
	*/

	static int
	lock_slot (int slot)
	{
	#ifdef USE_NPTH
	int err;

	err = npth_mutex_lock (&reader_table[slot].lock);
	if (err)
	{
	log_error ("failed to acquire apdu lock: %s\n", strerror (err));
	return SW_HOST_LOCKING_FAILED;
	}
	#endif /USE_NPTH/
	return 0;
	}

	static int
	trylock_slot (int slot)
	{
	#ifdef USE_NPTH
	int err;

	err = npth_mutex_trylock (&reader_table[slot].lock);
	if (err == EBUSY)
	return SW_HOST_BUSY;
	else if (err)
	{
	log_error ("failed to acquire apdu lock: %s\n", strerror (err));
	return SW_HOST_LOCKING_FAILED;
	}
	#endif /USE_NPTH/
	return 0;
	}

	static void
	unlock_slot (int slot)
	{
	#ifdef USE_NPTH
	int err;

	err = npth_mutex_unlock (&reader_table[slot].lock);
	if (err)
	log_error ("failed to release apdu lock: %s\n", strerror (errno));
	#endif /USE_NPTH/
	}


	/* Find an unused reader slot for PORTSTR and put it into the reader
	table. Return -1 on error or the index into the reader table.
	Acquire slot's lock on successful return. Caller needs to unlock it. */
	static int
	new_reader_slot (void)
	{
	int i, reader = -1;

	for (i=0; i < MAX_READER; i++)
	if (!reader_table[i].used)
	{
	reader = i;
	reader_table[reader].used = 1;
	break;
	}

	if (reader == -1)
	{
	log_error ("new_reader_slot: out of slots\n");
	return -1;
	}

	if (lock_slot (reader))
	{
	reader_table[reader].used = 0;
	return -1;
	}

	reader_table[reader].connect_card = NULL;
	reader_table[reader].disconnect_card = NULL;
	reader_table[reader].close_reader = NULL;
	reader_table[reader].reset_reader = NULL;
	reader_table[reader].get_status_reader = NULL;
	reader_table[reader].send_apdu_reader = NULL;
	reader_table[reader].check_pinpad = check_pcsc_pinpad;
	reader_table[reader].dump_status_reader = NULL;
	reader_table[reader].set_progress_cb = NULL;
	reader_table[reader].pinpad_verify = pcsc_pinpad_verify;
	reader_table[reader].pinpad_modify = pcsc_pinpad_modify;

	reader_table[reader].is_t0 = 1;
	reader_table[reader].is_spr532 = 0;
	reader_table[reader].pinpad_varlen_supported = 0;
	reader_table[reader].require_get_status = 1;
	#ifdef NEED_PCSC_WRAPPER
	reader_table[reader].pcsc.req_fd = -1;
	reader_table[reader].pcsc.rsp_fd = -1;
	reader_table[reader].pcsc.pid = (pid_t)(-1);
	#endif
	reader_table[reader].pcsc.verify_ioctl = 0;
	reader_table[reader].pcsc.modify_ioctl = 0;
	reader_table[reader].pcsc.pinmin = -1;
	reader_table[reader].pcsc.pinmax = -1;

	return reader;
	}


	static void
	dump_reader_status (int slot)
	{
	if (!opt.verbose)
	return;

	if (reader_table[slot].dump_status_reader)
	reader_table[slot].dump_status_reader (slot);

	if (reader_table[slot].atrlen)
	{
	log_info ("slot %d: ATR=", slot);
	log_printhex ("", reader_table[slot].atr, reader_table[slot].atrlen);
	}
	}



	static const char *
	host_sw_string (long err)
	{
	switch (err)
	{
	case 0: return "okay";
	case SW_HOST_OUT_OF_CORE: return "out of core";
	case SW_HOST_INV_VALUE: return "invalid value";
	case SW_HOST_NO_DRIVER: return "no driver";
	case SW_HOST_NOT_SUPPORTED: return "not supported";
	case SW_HOST_LOCKING_FAILED: return "locking failed";
	case SW_HOST_BUSY: return "busy";
	case SW_HOST_NO_CARD: return "no card";
	case SW_HOST_CARD_INACTIVE: return "card inactive";
	case SW_HOST_CARD_IO_ERROR: return "card I/O error";
	case SW_HOST_GENERAL_ERROR: return "general error";
	case SW_HOST_NO_READER: return "no reader";
	case SW_HOST_ABORTED: return "aborted";
	case SW_HOST_NO_PINPAD: return "no pinpad";
	case SW_HOST_ALREADY_CONNECTED: return "already connected";
	default: return "unknown host status error";
	}
	}


	const char *
	apdu_strerror (int rc)
	{
	switch (rc)
	{
	case SW_EOF_REACHED : return "eof reached";
	case SW_EEPROM_FAILURE : return "eeprom failure";
	case SW_WRONG_LENGTH : return "wrong length";
	case SW_CHV_WRONG : return "CHV wrong";
	case SW_CHV_BLOCKED : return "CHV blocked";
	case SW_REF_DATA_INV : return "referenced data invalidated";
	case SW_USE_CONDITIONS : return "use conditions not satisfied";
	case SW_BAD_PARAMETER : return "bad parameter";
	case SW_NOT_SUPPORTED : return "not supported";
	case SW_FILE_NOT_FOUND : return "file not found";
	case SW_RECORD_NOT_FOUND:return "record not found";
	case SW_REF_NOT_FOUND : return "reference not found";
	case SW_NOT_ENOUGH_MEMORY: return "not enough memory space in the file";
	case SW_INCONSISTENT_LC: return "Lc inconsistent with TLV structure.";
	case SW_INCORRECT_P0_P1: return "incorrect parameters P0,P1";
	case SW_BAD_LC : return "Lc inconsistent with P0,P1";
	case SW_BAD_P0_P1 : return "bad P0,P1";
	case SW_INS_NOT_SUP : return "instruction not supported";
	case SW_CLA_NOT_SUP : return "class not supported";
	case SW_SUCCESS : return "success";
	default:
	if ((rc & ~0x00ff) == SW_MORE_DATA)
	return "more data available";
	if ( (rc & 0x10000) )
	return host_sw_string (rc);
	return "unknown status error";
	}
	}



	/*
	ct API Interface
	*/

	static const char *
	ct_error_string (long err)
	{
	switch (err)
	{
	case 0: return "okay";
	case -1: return "invalid data";
	case -8: return "ct error";
	case -10: return "transmission error";
	case -11: return "memory allocation error";
	case -128: return "HTSI error";
	default: return "unknown CT-API error";
	}
	}


	/* Wait for the card in SLOT and activate it. Return a status word
	error or 0 on success. */
	static int
	ct_activate_card (int slot)
	{
	int rc;
	unsigned char dad[1], sad[1], cmd[11], buf[256];
	unsigned short buflen;

	/* Check whether card has been inserted. */
	dad[0] = 1; /* Destination address: CT. */
	sad[0] = 2; /* Source address: Host. */

	cmd[0] = 0x20; /* Class byte. */
	cmd[1] = 0x13; /* Request status. */
	cmd[2] = 0x00; /* From kernel. */
	cmd[3] = 0x80; /* Return card's DO. */
	cmd[4] = 0x00;

	buflen = DIM(buf);

	rc = CT_data (slot, dad, sad, 5, cmd, &buflen, buf);
	if (rc \|\| buflen < 2 \|\| buf[buflen-2] != 0x90)
	{
	log_error ("ct_activate_card: can't get status of reader %d: %s\n",
	slot, ct_error_string (rc));
	return SW_HOST_CARD_IO_ERROR;
	}

	/* Connected, now activate the card. */
	dad[0] = 1; /* Destination address: CT. */
	sad[0] = 2; /* Source address: Host. */

	cmd[0] = 0x20; /* Class byte. */
	cmd[1] = 0x12; /* Request ICC. */
	cmd[2] = 0x01; /* From first interface. */
	cmd[3] = 0x01; /* Return card's ATR. */
	cmd[4] = 0x00;

	buflen = DIM(buf);

	rc = CT_data (slot, dad, sad, 5, cmd, &buflen, buf);
	if (rc \|\| buflen < 2 \|\| buf[buflen-2] != 0x90)
	{
	log_error ("ct_activate_card(%d): activation failed: %s\n",
	slot, ct_error_string (rc));
	if (!rc)
	log_printhex (" received data:", buf, buflen);
	return SW_HOST_CARD_IO_ERROR;
	}

	/* Store the type and the ATR. */
	if (buflen - 2 > DIM (reader_table[0].atr))
	{
	log_error ("ct_activate_card(%d): ATR too long\n", slot);
	return SW_HOST_CARD_IO_ERROR;
	}

	memcpy (reader_table[slot].atr, buf, buflen - 2);
	reader_table[slot].atrlen = buflen - 2;
	return 0;
	}


	static int
	close_ct_reader (int slot)
	{
	CT_close (slot);
	return 0;
	}

	static int
	reset_ct_reader (int slot)
	{
	/* FIXME: Check is this is sufficient do do a reset. */
	return ct_activate_card (slot);
	}


	static int
	ct_get_status (int slot, unsigned int *status, int on_wire)
	{
	(void)slot;
	(void)on_wire;
	/* The status we returned is wrong but we don't care because ctAPI
	is not anymore required. */
	*status = APDU_CARD_USABLE\|APDU_CARD_PRESENT\|APDU_CARD_ACTIVE;
	return 0;
	}

	/* Actually send the APDU of length APDULEN to SLOT and return a
	maximum of *BUFLEN data in BUFFER, the actual returned size will be
	set to BUFLEN. Returns: CT API error code. */
	static int
	ct_send_apdu (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen, pininfo_t *pininfo)
	{
	int rc;
	unsigned char dad[1], sad[1];
	unsigned short ctbuflen;

	(void)pininfo;

	/* If we don't have an ATR, we need to reset the reader first. */
	if (!reader_table[slot].atrlen
	&& (rc = reset_ct_reader (slot)))
	return rc;

	dad[0] = 0; /* Destination address: Card. */
	sad[0] = 2; /* Source address: Host. */
	ctbuflen = *buflen;
	if (DBG_CARD_IO)
	log_printhex (" CT_data:", apdu, apdulen);
	rc = CT_data (slot, dad, sad, apdulen, apdu, &ctbuflen, buffer);
	*buflen = ctbuflen;

	return rc? SW_HOST_CARD_IO_ERROR: 0;
	}



	/* Open a reader and return an internal handle for it. PORT is a
	non-negative value with the port number of the reader. USB readers
	do have port numbers starting at 32769. */
	static int
	open_ct_reader (int port)
	{
	int rc, reader;

	if (port < 0 \|\| port > 0xffff)
	{
	log_error ("open_ct_reader: invalid port %d requested\n", port);
	return -1;
	}
	reader = new_reader_slot ();
	if (reader == -1)
	return reader;
	reader_table[reader].port = port;

	rc = CT_init (reader, (unsigned short)port);
	if (rc)
	{
	log_error ("apdu_open_ct_reader failed on port %d: %s\n",
	port, ct_error_string (rc));
	reader_table[reader].used = 0;
	unlock_slot (reader);
	return -1;
	}

	/* Only try to activate the card. */
	rc = ct_activate_card (reader);
	if (rc)
	{
	reader_table[reader].atrlen = 0;
	rc = 0;
	}

	reader_table[reader].close_reader = close_ct_reader;
	reader_table[reader].reset_reader = reset_ct_reader;
	reader_table[reader].get_status_reader = ct_get_status;
	reader_table[reader].send_apdu_reader = ct_send_apdu;
	reader_table[reader].check_pinpad = NULL;
	reader_table[reader].dump_status_reader = NULL;
	reader_table[reader].pinpad_verify = NULL;
	reader_table[reader].pinpad_modify = NULL;

	dump_reader_status (reader);
	unlock_slot (reader);
	return reader;
	}


	/*
	PC/SC Interface
	*/

	#ifdef NEED_PCSC_WRAPPER
	static int
	writen (int fd, const void *buf, size_t nbytes)
	{
	size_t nleft = nbytes;
	int nwritten;

	/* log_printhex (" writen:", buf, nbytes); */

	while (nleft > 0)
	{
	#ifdef USE_NPTH
	nwritten = npth_write (fd, buf, nleft);
	#else
	nwritten = write (fd, buf, nleft);
	#endif
	if (nwritten < 0 && errno == EINTR)
	continue;
	if (nwritten < 0)
	return -1;
	nleft -= nwritten;
	buf = (const char*)buf + nwritten;
	}
	return 0;
	}

	/* Read up to BUFLEN bytes from FD and return the number of bytes
	actually read in NREAD. Returns -1 on error or 0 on success. */
	static int
	readn (int fd, void buf, size_t buflen, size_t nread)
	{
	size_t nleft = buflen;
	int n;
	/* void orig_buf = buf; /

	while (nleft > 0)
	{
	#ifdef USE_NPTH
	# ifdef HAVE_W32_SYSTEM
	# error Cannot use npth_read here because it expects a system HANDLE.
	# endif
	n = npth_read (fd, buf, nleft);
	#else
	n = read (fd, buf, nleft);
	#endif
	if (n < 0 && errno == EINTR)
	continue;
	if (n < 0)
	return -1; /* read error. */
	if (!n)
	break; /* EOF */
	nleft -= n;
	buf = (char*)buf + n;
	}
	if (nread)
	*nread = buflen - nleft;

	/* log_printhex (" readn:", orig_buf, nread); /

	return 0;
	}
	#endif /NEED_PCSC_WRAPPER/

	static const char *
	pcsc_error_string (long err)
	{
	const char *s;

	if (!err)
	return "okay";
	if ((err & 0x80100000) != 0x80100000)
	return "invalid PC/SC error code";
	err &= 0xffff;
	switch (err)
	{
	case 0x0002: s = "cancelled"; break;
	case 0x000e: s = "can't dispose"; break;
	case 0x0008: s = "insufficient buffer"; break;
	case 0x0015: s = "invalid ATR"; break;
	case 0x0003: s = "invalid handle"; break;
	case 0x0004: s = "invalid parameter"; break;
	case 0x0005: s = "invalid target"; break;
	case 0x0011: s = "invalid value"; break;
	case 0x0006: s = "no memory"; break;
	case 0x0013: s = "comm error"; break;
	case 0x0001: s = "internal error"; break;
	case 0x0014: s = "unknown error"; break;
	case 0x0007: s = "waited too long"; break;
	case 0x0009: s = "unknown reader"; break;
	case 0x000a: s = "timeout"; break;
	case 0x000b: s = "sharing violation"; break;
	case 0x000c: s = "no smartcard"; break;
	case 0x000d: s = "unknown card"; break;
	case 0x000f: s = "proto mismatch"; break;
	case 0x0010: s = "not ready"; break;
	case 0x0012: s = "system cancelled"; break;
	case 0x0016: s = "not transacted"; break;
	case 0x0017: s = "reader unavailable"; break;
	case 0x0065: s = "unsupported card"; break;
	case 0x0066: s = "unresponsive card"; break;
	case 0x0067: s = "unpowered card"; break;
	case 0x0068: s = "reset card"; break;
	case 0x0069: s = "removed card"; break;
	case 0x006a: s = "inserted card"; break;
	case 0x001f: s = "unsupported feature"; break;
	case 0x0019: s = "PCI too small"; break;
	case 0x001a: s = "reader unsupported"; break;
	case 0x001b: s = "duplicate reader"; break;
	case 0x001c: s = "card unsupported"; break;
	case 0x001d: s = "no service"; break;
	case 0x001e: s = "service stopped"; break;
	default: s = "unknown PC/SC error code"; break;
	}
	return s;
	}

	/* Map PC/SC error codes to our special host status words. */
	static int
	pcsc_error_to_sw (long ec)
	{
	int rc;

	switch ( PCSC_ERR_MASK (ec) )
	{
	case 0: rc = 0; break;

	case PCSC_E_CANCELLED: rc = SW_HOST_ABORTED; break;
	case PCSC_E_NO_MEMORY: rc = SW_HOST_OUT_OF_CORE; break;
	case PCSC_E_TIMEOUT: rc = SW_HOST_CARD_IO_ERROR; break;
	case PCSC_E_NO_SERVICE:
	case PCSC_E_SERVICE_STOPPED:
	case PCSC_E_UNKNOWN_READER: rc = SW_HOST_NO_READER; break;
	case PCSC_E_SHARING_VIOLATION: rc = SW_HOST_LOCKING_FAILED; break;
	case PCSC_E_NO_SMARTCARD: rc = SW_HOST_NO_CARD; break;
	case PCSC_W_REMOVED_CARD: rc = SW_HOST_NO_CARD; break;

	case PCSC_E_INVALID_TARGET:
	case PCSC_E_INVALID_VALUE:
	case PCSC_E_INVALID_HANDLE:
	case PCSC_E_INVALID_PARAMETER:
	case PCSC_E_INSUFFICIENT_BUFFER: rc = SW_HOST_INV_VALUE; break;

	default: rc = SW_HOST_GENERAL_ERROR; break;
	}

	return rc;
	}

	static void
	dump_pcsc_reader_status (int slot)
	{
	if (reader_table[slot].pcsc.card)
	{
	log_info ("reader slot %d: active protocol:", slot);
	if ((reader_table[slot].pcsc.protocol & PCSC_PROTOCOL_T0))
	log_printf (" T0");
	else if ((reader_table[slot].pcsc.protocol & PCSC_PROTOCOL_T1))
	log_printf (" T1");
	else if ((reader_table[slot].pcsc.protocol & PCSC_PROTOCOL_RAW))
	log_printf (" raw");
	log_printf ("\n");
	}
	else
	log_info ("reader slot %d: not connected\n", slot);
	}


	#ifndef NEED_PCSC_WRAPPER
	static int
	pcsc_get_status_direct (int slot, unsigned int *status, int on_wire)
	{
	long err;
	struct pcsc_readerstate_s rdrstates[1];

	(void)on_wire;
	memset (rdrstates, 0, sizeof *rdrstates);
	rdrstates[0].reader = reader_table[slot].rdrname;
	rdrstates[0].current_state = PCSC_STATE_UNAWARE;
	err = pcsc_get_status_change (reader_table[slot].pcsc.context,
	0,
	rdrstates, 1);
	if (err == PCSC_E_TIMEOUT)
	err = 0; /* Timeout is no error error here. */
	if (err)
	{
	log_error ("pcsc_get_status_change failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	return pcsc_error_to_sw (err);
	}

	/* log_debug */
	/* ("pcsc_get_status_change: %s%s%s%s%s%s%s%s%s%s\n", */
	/* (rdrstates[0].event_state & PCSC_STATE_IGNORE)? " ignore":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_CHANGED)? " changed":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_UNKNOWN)? " unknown":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_UNAVAILABLE)?" unavail":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_EMPTY)? " empty":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_PRESENT)? " present":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_ATRMATCH)? " atr":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_EXCLUSIVE)? " excl":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_INUSE)? " unuse":"", */
	/* (rdrstates[0].event_state & PCSC_STATE_MUTE)? " mute":"" ); */

	*status = 0;
	if ( (rdrstates[0].event_state & PCSC_STATE_PRESENT) )
	{
	*status \|= APDU_CARD_PRESENT;
	if ( !(rdrstates[0].event_state & PCSC_STATE_MUTE) )
	*status \|= APDU_CARD_ACTIVE;
	}
	#ifndef HAVE_W32_SYSTEM
	/* We indicate a useful card if it is not in use by another
	application. This is because we only use exclusive access
	mode. */
	if ( (*status & (APDU_CARD_PRESENT\|APDU_CARD_ACTIVE))
	== (APDU_CARD_PRESENT\|APDU_CARD_ACTIVE)
	&& !(rdrstates[0].event_state & PCSC_STATE_INUSE) )
	*status \|= APDU_CARD_USABLE;
	#else
	/* Some winscard drivers may set EXCLUSIVE and INUSE at the same
	time when we are the only user (SCM SCR335) under Windows. */
	if ((*status & (APDU_CARD_PRESENT\|APDU_CARD_ACTIVE))
	== (APDU_CARD_PRESENT\|APDU_CARD_ACTIVE))
	*status \|= APDU_CARD_USABLE;
	#endif

	return 0;
	}
	#endif /!NEED_PCSC_WRAPPER/


	#ifdef NEED_PCSC_WRAPPER
	static int
	pcsc_get_status_wrapped (int slot, unsigned int *status, int on_wire)
	{
	long err;
	reader_table_t slotp;
	size_t len, full_len;
	int i, n;
	unsigned char msgbuf[9];
	unsigned char buffer[16];
	int sw = SW_HOST_CARD_IO_ERROR;

	(void)on_wire;
	slotp = reader_table + slot;

	if (slotp->pcsc.req_fd == -1
	\|\| slotp->pcsc.rsp_fd == -1
	\|\| slotp->pcsc.pid == (pid_t)(-1) )
	{
	log_error ("pcsc_get_status: pcsc-wrapper not running\n");
	return sw;
	}

	msgbuf[0] = 0x04; /* STATUS command. */
	len = 0;
	msgbuf[1] = (len >> 24);
	msgbuf[2] = (len >> 16);
	msgbuf[3] = (len >> 8);
	msgbuf[4] = (len );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 5) )
	{
	log_error ("error sending PC/SC STATUS request: %s\n",
	strerror (errno));
	goto command_failed;
	}

	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC STATUS response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	{
	log_error ("pcsc_status failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	/* This is a proper error code, so return immediately. */
	return pcsc_error_to_sw (err);
	}

	full_len = len;

	/* The current version returns 3 words but we allow also for old
	versions returning only 2 words. */
	n = 12 < len ? 12 : len;
	if ((i=readn (slotp->pcsc.rsp_fd, buffer, n, &len))
	\|\| (len != 8 && len != 12))
	{
	log_error ("error receiving PC/SC STATUS response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}

	slotp->is_t0 = (len == 12 && !!(buffer[11] & PCSC_PROTOCOL_T0));


	full_len -= len;
	/* Newer versions of the wrapper might send more status bytes.
	Read them. */
	while (full_len)
	{
	unsigned char dummybuf[128];

	n = full_len < DIM (dummybuf) ? full_len : DIM (dummybuf);
	if ((i=readn (slotp->pcsc.rsp_fd, dummybuf, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC TRANSMIT response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	full_len -= n;
	}

	/* We are lucky: The wrapper already returns the data in the
	required format. */
	*status = buffer[3];
	return 0;

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	return sw;
	}
	#endif /NEED_PCSC_WRAPPER/


	static int
	pcsc_get_status (int slot, unsigned int *status, int on_wire)
	{
	#ifdef NEED_PCSC_WRAPPER
	return pcsc_get_status_wrapped (slot, status, on_wire);
	#else
	return pcsc_get_status_direct (slot, status, on_wire);
	#endif
	}


	#ifndef NEED_PCSC_WRAPPER
	static int
	pcsc_send_apdu_direct (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen,
	pininfo_t *pininfo)
	{
	long err;
	struct pcsc_io_request_s send_pci;
	pcsc_dword_t recv_len;

	(void)pininfo;

	if (!reader_table[slot].atrlen
	&& (err = reset_pcsc_reader (slot)))
	return err;

	if (DBG_CARD_IO)
	log_printhex (" PCSC_data:", apdu, apdulen);

	if ((reader_table[slot].pcsc.protocol & PCSC_PROTOCOL_T1))
	send_pci.protocol = PCSC_PROTOCOL_T1;
	else
	send_pci.protocol = PCSC_PROTOCOL_T0;
	send_pci.pci_len = sizeof send_pci;
	recv_len = *buflen;
	err = pcsc_transmit (reader_table[slot].pcsc.card,
	&send_pci, apdu, apdulen,
	NULL, buffer, &recv_len);
	*buflen = recv_len;
	if (err)
	log_error ("pcsc_transmit failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);

	return pcsc_error_to_sw (err);
	}
	#endif /!NEED_PCSC_WRAPPER/


	#ifdef NEED_PCSC_WRAPPER
	static int
	pcsc_send_apdu_wrapped (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen,
	pininfo_t *pininfo)
	{
	long err;
	reader_table_t slotp;
	size_t len, full_len;
	int i, n;
	unsigned char msgbuf[9];
	int sw = SW_HOST_CARD_IO_ERROR;

	(void)pininfo;

	if (!reader_table[slot].atrlen
	&& (err = reset_pcsc_reader (slot)))
	return err;

	if (DBG_CARD_IO)
	log_printhex (" PCSC_data:", apdu, apdulen);

	slotp = reader_table + slot;

	if (slotp->pcsc.req_fd == -1
	\|\| slotp->pcsc.rsp_fd == -1
	\|\| slotp->pcsc.pid == (pid_t)(-1) )
	{
	log_error ("pcsc_send_apdu: pcsc-wrapper not running\n");
	return sw;
	}

	msgbuf[0] = 0x03; /* TRANSMIT command. */
	len = apdulen;
	msgbuf[1] = (len >> 24);
	msgbuf[2] = (len >> 16);
	msgbuf[3] = (len >> 8);
	msgbuf[4] = (len );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 5)
	\|\| writen (slotp->pcsc.req_fd, apdu, len))
	{
	log_error ("error sending PC/SC TRANSMIT request: %s\n",
	strerror (errno));
	goto command_failed;
	}

	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC TRANSMIT response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	{
	log_error ("pcsc_transmit failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	return pcsc_error_to_sw (err);
	}

	full_len = len;

	n = buflen < len ? buflen : len;
	if ((i=readn (slotp->pcsc.rsp_fd, buffer, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC TRANSMIT response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	*buflen = n;

	full_len -= len;
	if (full_len)
	{
	log_error ("pcsc_send_apdu: provided buffer too short - truncated\n");
	err = SW_HOST_INV_VALUE;
	}
	/* We need to read any rest of the response, to keep the
	protocol running. */
	while (full_len)
	{
	unsigned char dummybuf[128];

	n = full_len < DIM (dummybuf) ? full_len : DIM (dummybuf);
	if ((i=readn (slotp->pcsc.rsp_fd, dummybuf, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC TRANSMIT response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	full_len -= n;
	}

	return err;

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	return sw;
	}
	#endif /NEED_PCSC_WRAPPER/


	/* Send the APDU of length APDULEN to SLOT and return a maximum of
	*BUFLEN data in BUFFER, the actual returned size will be stored at
	BUFLEN. Returns: A status word. */
	static int
	pcsc_send_apdu (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen,
	pininfo_t *pininfo)
	{
	#ifdef NEED_PCSC_WRAPPER
	return pcsc_send_apdu_wrapped (slot, apdu, apdulen, buffer, buflen, pininfo);
	#else
	return pcsc_send_apdu_direct (slot, apdu, apdulen, buffer, buflen, pininfo);
	#endif
	}


	#ifndef NEED_PCSC_WRAPPER
	static int
	control_pcsc_direct (int slot, pcsc_dword_t ioctl_code,
	const unsigned char *cntlbuf, size_t len,
	unsigned char buffer, pcsc_dword_t buflen)
	{
	long err;

	err = pcsc_control (reader_table[slot].pcsc.card, ioctl_code,
	cntlbuf, len, buffer, buflen? *buflen:0, buflen);
	if (err)
	{
	log_error ("pcsc_control failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	return pcsc_error_to_sw (err);
	}

	return 0;
	}
	#endif /!NEED_PCSC_WRAPPER/


	#ifdef NEED_PCSC_WRAPPER
	static int
	control_pcsc_wrapped (int slot, pcsc_dword_t ioctl_code,
	const unsigned char *cntlbuf, size_t len,
	unsigned char buffer, pcsc_dword_t buflen)
	{
	long err = PCSC_E_NOT_TRANSACTED;
	reader_table_t slotp;
	unsigned char msgbuf[9];
	int i, n;
	size_t full_len;

	slotp = reader_table + slot;

	msgbuf[0] = 0x06; /* CONTROL command. */
	msgbuf[1] = ((len + 4) >> 24);
	msgbuf[2] = ((len + 4) >> 16);
	msgbuf[3] = ((len + 4) >> 8);
	msgbuf[4] = ((len + 4) );
	msgbuf[5] = (ioctl_code >> 24);
	msgbuf[6] = (ioctl_code >> 16);
	msgbuf[7] = (ioctl_code >> 8);
	msgbuf[8] = (ioctl_code );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 9)
	\|\| writen (slotp->pcsc.req_fd, cntlbuf, len))
	{
	log_error ("error sending PC/SC CONTROL request: %s\n",
	strerror (errno));
	goto command_failed;
	}

	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC CONTROL response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf32_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	{
	log_error ("pcsc_control failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	return pcsc_error_to_sw (err);
	}

	full_len = len;

	if (buflen)
	n = buflen < len ? buflen : len;
	else
	n = 0;
	if ((i=readn (slotp->pcsc.rsp_fd, buffer, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC CONTROL response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	if (buflen)
	*buflen = n;

	full_len -= len;
	if (full_len)
	{
	log_error ("pcsc_send_apdu: provided buffer too short - truncated\n");
	err = PCSC_E_INVALID_VALUE;
	}
	/* We need to read any rest of the response, to keep the
	protocol running. */
	while (full_len)
	{
	unsigned char dummybuf[128];

	n = full_len < DIM (dummybuf) ? full_len : DIM (dummybuf);
	if ((i=readn (slotp->pcsc.rsp_fd, dummybuf, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC CONTROL response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	full_len -= n;
	}

	if (!err)
	return 0;

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	return pcsc_error_to_sw (err);
	}
	#endif /NEED_PCSC_WRAPPER/



	/* Do some control with the value of IOCTL_CODE to the card inserted
	to SLOT. Input buffer is specified by CNTLBUF of length LEN.
	Output buffer is specified by BUFFER of length *BUFLEN, and the
	actual output size will be stored at BUFLEN. Returns: A status word.
	This routine is used for PIN pad input support. */
	static int
	control_pcsc (int slot, pcsc_dword_t ioctl_code,
	const unsigned char *cntlbuf, size_t len,
	unsigned char buffer, pcsc_dword_t buflen)
	{
	#ifdef NEED_PCSC_WRAPPER
	return control_pcsc_wrapped (slot, ioctl_code, cntlbuf, len, buffer, buflen);
	#else
	return control_pcsc_direct (slot, ioctl_code, cntlbuf, len, buffer, buflen);
	#endif
	}


	#ifndef NEED_PCSC_WRAPPER
	static int
	close_pcsc_reader_direct (int slot)
	{
	pcsc_release_context (reader_table[slot].pcsc.context);
	return 0;
	}
	#endif /!NEED_PCSC_WRAPPER/


	#ifdef NEED_PCSC_WRAPPER
	static int
	close_pcsc_reader_wrapped (int slot)
	{
	long err;
	reader_table_t slotp;
	size_t len;
	int i;
	unsigned char msgbuf[9];

	slotp = reader_table + slot;

	if (slotp->pcsc.req_fd == -1
	\|\| slotp->pcsc.rsp_fd == -1
	\|\| slotp->pcsc.pid == (pid_t)(-1) )
	{
	log_error ("close_pcsc_reader: pcsc-wrapper not running\n");
	return 0;
	}

	msgbuf[0] = 0x02; /* CLOSE command. */
	len = 0;
	msgbuf[1] = (len >> 24);
	msgbuf[2] = (len >> 16);
	msgbuf[3] = (len >> 8);
	msgbuf[4] = (len );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 5) )
	{
	log_error ("error sending PC/SC CLOSE request: %s\n",
	strerror (errno));
	goto command_failed;
	}

	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC CLOSE response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf32_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	log_error ("pcsc_close failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);

	/* We will close the wrapper in any case - errors are merely
	informational. */

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	return 0;
	}
	#endif /NEED_PCSC_WRAPPER/


	static int
	close_pcsc_reader (int slot)
	{
	#ifdef NEED_PCSC_WRAPPER
	return close_pcsc_reader_wrapped (slot);
	#else
	return close_pcsc_reader_direct (slot);
	#endif
	}


	/* Connect a PC/SC card. */
	#ifndef NEED_PCSC_WRAPPER
	static int
	connect_pcsc_card (int slot)
	{
	long err;

	assert (slot >= 0 && slot < MAX_READER);

	if (reader_table[slot].pcsc.card)
	return SW_HOST_ALREADY_CONNECTED;

	reader_table[slot].atrlen = 0;
	reader_table[slot].is_t0 = 0;

	err = pcsc_connect (reader_table[slot].pcsc.context,
	reader_table[slot].rdrname,
	PCSC_SHARE_EXCLUSIVE,
	PCSC_PROTOCOL_T0\|PCSC_PROTOCOL_T1,
	&reader_table[slot].pcsc.card,
	&reader_table[slot].pcsc.protocol);
	if (err)
	{
	reader_table[slot].pcsc.card = 0;
	if (err != PCSC_E_NO_SMARTCARD)
	log_error ("pcsc_connect failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	}
	else
	{
	char reader[250];
	pcsc_dword_t readerlen, atrlen;
	pcsc_dword_t card_state, card_protocol;

	pcsc_vendor_specific_init (slot);

	atrlen = DIM (reader_table[0].atr);
	readerlen = sizeof reader -1 ;
	err = pcsc_status (reader_table[slot].pcsc.card,
	reader, &readerlen,
	&card_state, &card_protocol,
	reader_table[slot].atr, &atrlen);
	if (err)
	log_error ("pcsc_status failed: %s (0x%lx) %lu\n",
	pcsc_error_string (err), err, (long unsigned int)readerlen);
	else
	{
	if (atrlen > DIM (reader_table[0].atr))
	log_bug ("ATR returned by pcsc_status is too large\n");
	reader_table[slot].atrlen = atrlen;
	reader_table[slot].is_t0 = !!(card_protocol & PCSC_PROTOCOL_T0);
	}
	}

	dump_reader_status (slot);
	return pcsc_error_to_sw (err);
	}
	#endif /!NEED_PCSC_WRAPPER/


	/* Disconnect a PC/SC card. Note that this succeeds even if the card
	is not connected. */
	#ifndef NEED_PCSC_WRAPPER
	static int
	disconnect_pcsc_card (int slot)
	{
	long err;

	assert (slot >= 0 && slot < MAX_READER);

	if (!reader_table[slot].pcsc.card)
	return 0;

	err = pcsc_disconnect (reader_table[slot].pcsc.card, PCSC_LEAVE_CARD);
	if (err)
	{
	log_error ("pcsc_disconnect failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	return SW_HOST_CARD_IO_ERROR;
	}
	reader_table[slot].pcsc.card = 0;
	return 0;
	}
	#endif /!NEED_PCSC_WRAPPER/


	#ifndef NEED_PCSC_WRAPPER
	static int
	reset_pcsc_reader_direct (int slot)
	{
	int sw;

	sw = disconnect_pcsc_card (slot);
	if (!sw)
	sw = connect_pcsc_card (slot);

	return sw;
	}
	#endif /NEED_PCSC_WRAPPER/


	#ifdef NEED_PCSC_WRAPPER
	static int
	reset_pcsc_reader_wrapped (int slot)
	{
	long err;
	reader_table_t slotp;
	size_t len;
	int i, n;
	unsigned char msgbuf[9];
	unsigned int dummy_status;
	int sw = SW_HOST_CARD_IO_ERROR;

	slotp = reader_table + slot;

	if (slotp->pcsc.req_fd == -1
	\|\| slotp->pcsc.rsp_fd == -1
	\|\| slotp->pcsc.pid == (pid_t)(-1) )
	{
	log_error ("pcsc_get_status: pcsc-wrapper not running\n");
	return sw;
	}

	msgbuf[0] = 0x05; /* RESET command. */
	len = 0;
	msgbuf[1] = (len >> 24);
	msgbuf[2] = (len >> 16);
	msgbuf[3] = (len >> 8);
	msgbuf[4] = (len );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 5) )
	{
	log_error ("error sending PC/SC RESET request: %s\n",
	strerror (errno));
	goto command_failed;
	}

	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC RESET response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf32_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	if (len > DIM (slotp->atr))
	{
	log_error ("PC/SC returned a too large ATR (len=%lx)\n",
	(unsigned long)len);
	sw = SW_HOST_GENERAL_ERROR;
	goto command_failed;
	}
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	{
	log_error ("PC/SC RESET failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	/* If the error code is no smart card, we should not considere
	this a major error and close the wrapper. */
	sw = pcsc_error_to_sw (err);
	if (err == PCSC_E_NO_SMARTCARD)
	return sw;
	goto command_failed;
	}

	/* The open function may return a zero for the ATR length to
	indicate that no card is present. */
	n = len;
	if (n)
	{
	if ((i=readn (slotp->pcsc.rsp_fd, slotp->atr, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC RESET response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	}
	slotp->atrlen = len;

	/* Read the status so that IS_T0 will be set. */
	pcsc_get_status (slot, &dummy_status, 1);

	return 0;

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	return sw;
	}
	#endif /* !NEED_PCSC_WRAPPER */


	/* Send an PC/SC reset command and return a status word on error or 0
	on success. */
	static int
	reset_pcsc_reader (int slot)
	{
	#ifdef NEED_PCSC_WRAPPER
	return reset_pcsc_reader_wrapped (slot);
	#else
	return reset_pcsc_reader_direct (slot);
	#endif
	}


	/* Examine reader specific parameters and initialize. This is mostly
	for pinpad input. Called at opening the connection to the reader. */
	static int
	pcsc_vendor_specific_init (int slot)
	{
	unsigned char buf[256];
	pcsc_dword_t len;
	int sw;
	int vendor = 0;
	int product = 0;
	pcsc_dword_t get_tlv_ioctl = (pcsc_dword_t)-1;
	unsigned char *p;

	len = sizeof (buf);
	sw = control_pcsc (slot, CM_IOCTL_GET_FEATURE_REQUEST, NULL, 0, buf, &len);
	if (sw)
	{
	log_error ("pcsc_vendor_specific_init: GET_FEATURE_REQUEST failed: %d\n",
	sw);
	return SW_NOT_SUPPORTED;
	}
	else
	{
	p = buf;
	while (p < buf + len)
	{
	unsigned char code = *p++;
	int l = *p++;
	unsigned int v = 0;

	if (l == 1)
	v = p[0];
	else if (l == 2)
	v = buf16_to_uint (p);
	else if (l == 4)
	v = buf32_to_uint (p);

	if (code == FEATURE_VERIFY_PIN_DIRECT)
	reader_table[slot].pcsc.verify_ioctl = v;
	else if (code == FEATURE_MODIFY_PIN_DIRECT)
	reader_table[slot].pcsc.modify_ioctl = v;
	else if (code == FEATURE_GET_TLV_PROPERTIES)
	get_tlv_ioctl = v;

	if (DBG_CARD_IO)
	log_debug ("feature: code=%02X, len=%d, v=%02X\n", code, l, v);

	p += l;
	}
	}

	if (get_tlv_ioctl == (pcsc_dword_t)-1)
	{
	/*
	* For system which doesn't support GET_TLV_PROPERTIES,
	* we put some heuristics here.
	*/
	if (reader_table[slot].rdrname)
	{
	if (strstr (reader_table[slot].rdrname, "SPRx32"))
	{
	reader_table[slot].is_spr532 = 1;
	reader_table[slot].pinpad_varlen_supported = 1;
	}
	else if (strstr (reader_table[slot].rdrname, "ST-2xxx"))
	{
	reader_table[slot].pcsc.pinmax = 15;
	reader_table[slot].pinpad_varlen_supported = 1;
	}
	else if (strstr (reader_table[slot].rdrname, "cyberJack")
	\|\| strstr (reader_table[slot].rdrname, "DIGIPASS")
	\|\| strstr (reader_table[slot].rdrname, "Gnuk")
	\|\| strstr (reader_table[slot].rdrname, "KAAN"))
	reader_table[slot].pinpad_varlen_supported = 1;
	}

	return 0;
	}

	len = sizeof (buf);
	sw = control_pcsc (slot, get_tlv_ioctl, NULL, 0, buf, &len);
	if (sw)
	{
	log_error ("pcsc_vendor_specific_init: GET_TLV_IOCTL failed: %d\n", sw);
	return SW_NOT_SUPPORTED;
	}

	p = buf;
	while (p < buf + len)
	{
	unsigned char tag = *p++;
	int l = *p++;
	unsigned int v = 0;

	/* Umm... here is little endian, while the encoding above is big. */
	if (l == 1)
	v = p[0];
	else if (l == 2)
	v = (((unsigned int)p[1] << 8) \| p[0]);
	else if (l == 4)
	v = (((unsigned int)p[3] << 24) \| (p[2] << 16) \| (p[1] << 8) \| p[0]);

	if (tag == PCSCv2_PART10_PROPERTY_bMinPINSize)
	reader_table[slot].pcsc.pinmin = v;
	else if (tag == PCSCv2_PART10_PROPERTY_bMaxPINSize)
	reader_table[slot].pcsc.pinmax = v;
	else if (tag == PCSCv2_PART10_PROPERTY_wIdVendor)
	vendor = v;
	else if (tag == PCSCv2_PART10_PROPERTY_wIdProduct)
	product = v;

	if (DBG_CARD_IO)
	log_debug ("TLV properties: tag=%02X, len=%d, v=%08X\n", tag, l, v);

	p += l;
	}

	if (vendor == VENDOR_VEGA && product == VEGA_ALPHA)
	{
	/*
	* Please read the comment of ccid_vendor_specific_init in
	* ccid-driver.c.
	*/
	const unsigned char cmd[] = { '\xb5', '\x01', '\x00', '\x03', '\x00' };
	sw = control_pcsc (slot, CM_IOCTL_VENDOR_IFD_EXCHANGE,
	cmd, sizeof (cmd), NULL, 0);
	if (sw)
	return SW_NOT_SUPPORTED;
	}
	else if (vendor == VENDOR_SCM && product == SCM_SPR532) /* SCM SPR532 */
	{
	reader_table[slot].is_spr532 = 1;
	reader_table[slot].pinpad_varlen_supported = 1;
	}
	else if (vendor == 0x046a)
	{
	/* Cherry ST-2xxx (product == 0x003e) supports TPDU level
	* exchange. Other products which only support short APDU level
	* exchange only work with shorter keys like RSA 1024.
	*/
	reader_table[slot].pcsc.pinmax = 15;
	reader_table[slot].pinpad_varlen_supported = 1;
	}
	else if (vendor == 0x0c4b /* Tested with Reiner cyberJack GO */
	\|\| vendor == 0x1a44 /* Tested with Vasco DIGIPASS 920 */
	\|\| vendor == 0x234b /* Tested with FSIJ Gnuk Token */
	\|\| vendor == 0x0d46 /* Tested with KAAN Advanced??? */)
	reader_table[slot].pinpad_varlen_supported = 1;

	return 0;
	}


	/* Open the PC/SC reader without using the wrapper. Returns -1 on
	error or a slot number for the reader. */
	#ifndef NEED_PCSC_WRAPPER
	static int
	open_pcsc_reader_direct (const char *portstr)
	{
	long err;
	int slot;
	char *list = NULL;
	char *rdrname = NULL;
	pcsc_dword_t nreader;
	char *p;

	slot = new_reader_slot ();
	if (slot == -1)
	return -1;

	/* Fixme: Allocating a context for each slot is not required. One
	global context should be sufficient. */
	err = pcsc_establish_context (PCSC_SCOPE_SYSTEM, NULL, NULL,
	&reader_table[slot].pcsc.context);
	if (err)
	{
	log_error ("pcsc_establish_context failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	reader_table[slot].used = 0;
	unlock_slot (slot);
	return -1;
	}

	err = pcsc_list_readers (reader_table[slot].pcsc.context,
	NULL, NULL, &nreader);
	if (!err)
	{
	list = xtrymalloc (nreader+1); /* Better add 1 for safety reasons. */
	if (!list)
	{
	log_error ("error allocating memory for reader list\n");
	pcsc_release_context (reader_table[slot].pcsc.context);
	reader_table[slot].used = 0;
	unlock_slot (slot);
	return -1 /SW_HOST_OUT_OF_CORE/;
	}
	err = pcsc_list_readers (reader_table[slot].pcsc.context,
	NULL, list, &nreader);
	}
	if (err)
	{
	log_error ("pcsc_list_readers failed: %s (0x%lx)\n",
	pcsc_error_string (err), err);
	pcsc_release_context (reader_table[slot].pcsc.context);
	reader_table[slot].used = 0;
	xfree (list);
	unlock_slot (slot);
	return -1;
	}

	p = list;
	while (nreader)
	{
	if (!*p && !p[1])
	break;
	log_info ("detected reader '%s'\n", p);
	if (nreader < (strlen (p)+1))
	{
	log_error ("invalid response from pcsc_list_readers\n");
	break;
	}
	if (!rdrname && portstr && !strncmp (p, portstr, strlen (portstr)))
	rdrname = p;
	nreader -= strlen (p)+1;
	p += strlen (p) + 1;
	}

	if (!rdrname)
	rdrname = list;

	reader_table[slot].rdrname = xtrystrdup (rdrname);
	if (!reader_table[slot].rdrname)
	{
	log_error ("error allocating memory for reader name\n");
	pcsc_release_context (reader_table[slot].pcsc.context);
	reader_table[slot].used = 0;
	unlock_slot (slot);
	return -1;
	}
	xfree (list);
	list = NULL;

	reader_table[slot].pcsc.card = 0;
	reader_table[slot].atrlen = 0;

	reader_table[slot].connect_card = connect_pcsc_card;
	reader_table[slot].disconnect_card = disconnect_pcsc_card;
	reader_table[slot].close_reader = close_pcsc_reader;
	reader_table[slot].reset_reader = reset_pcsc_reader;
	reader_table[slot].get_status_reader = pcsc_get_status;
	reader_table[slot].send_apdu_reader = pcsc_send_apdu;
	reader_table[slot].dump_status_reader = dump_pcsc_reader_status;

	dump_reader_status (slot);
	unlock_slot (slot);
	return slot;
	}
	#endif /!NEED_PCSC_WRAPPER /


	/* Open the PC/SC reader using the pcsc_wrapper program. This is
	needed to cope with different thread models and other peculiarities
	of libpcsclite. */
	#ifdef NEED_PCSC_WRAPPER
	static int
	open_pcsc_reader_wrapped (const char *portstr)
	{
	int slot;
	reader_table_t slotp;
	int fd, rp[2], wp[2];
	int n, i;
	pid_t pid;
	size_t len;
	unsigned char msgbuf[9];
	int err;
	unsigned int dummy_status;

	/* Note that we use the constant and not the function because this
	- code won't be be used under Windows. */
	+ code won't be used under Windows. */
	const char *wrapperpgm = GNUPG_LIBEXECDIR "/gnupg-pcsc-wrapper";

	if (access (wrapperpgm, X_OK))
	{
	log_error ("can't run PC/SC access module '%s': %s\n",
	wrapperpgm, strerror (errno));
	return -1;
	}

	slot = new_reader_slot ();
	if (slot == -1)
	return -1;
	slotp = reader_table + slot;

	/* Fire up the PC/SCc wrapper. We don't use any fork/exec code from
	the common directy but implement it directly so that this file
	may still be source copied. */

	if (pipe (rp) == -1)
	{
	log_error ("error creating a pipe: %s\n", strerror (errno));
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}
	if (pipe (wp) == -1)
	{
	log_error ("error creating a pipe: %s\n", strerror (errno));
	close (rp[0]);
	close (rp[1]);
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}

	pid = fork ();
	if (pid == -1)
	{
	log_error ("error forking process: %s\n", strerror (errno));
	close (rp[0]);
	close (rp[1]);
	close (wp[0]);
	close (wp[1]);
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}
	slotp->pcsc.pid = pid;

	if (!pid)
	{ /*
	=== Child ===
	*/

	/* Double fork. */
	pid = fork ();
	if (pid == -1)
	_exit (31);
	if (pid)
	_exit (0); /* Immediate exit this parent, so that the child
	gets cleaned up by the init process. */

	/* Connect our pipes. */
	if (wp[0] != 0 && dup2 (wp[0], 0) == -1)
	log_fatal ("dup2 stdin failed: %s\n", strerror (errno));
	if (rp[1] != 1 && dup2 (rp[1], 1) == -1)
	log_fatal ("dup2 stdout failed: %s\n", strerror (errno));

	/* Send stderr to the bit bucket. */
	fd = open ("/dev/null", O_WRONLY);
	if (fd == -1)
	log_fatal ("can't open '/dev/null': %s", strerror (errno));
	if (fd != 2 && dup2 (fd, 2) == -1)
	log_fatal ("dup2 stderr failed: %s\n", strerror (errno));

	/* Close all other files. */
	close_all_fds (3, NULL);

	execl (wrapperpgm,
	"pcsc-wrapper",
	"--",
	"1", /* API version */
	opt.pcsc_driver, /* Name of the PC/SC library. */
	NULL);
	_exit (31);
	}

	/*
	=== Parent ===
	*/
	close (wp[0]);
	close (rp[1]);
	slotp->pcsc.req_fd = wp[1];
	slotp->pcsc.rsp_fd = rp[0];

	/* Wait for the intermediate child to terminate. */
	#ifdef USE_NPTH
	#define WAIT npth_waitpid
	#else
	#define WAIT waitpid
	#endif
	while ( (i=WAIT (pid, NULL, 0)) == -1 && errno == EINTR)
	;
	#undef WAIT

	/* Now send the open request. */
	msgbuf[0] = 0x01; /* OPEN command. */
	len = portstr? strlen (portstr):0;
	msgbuf[1] = (len >> 24);
	msgbuf[2] = (len >> 16);
	msgbuf[3] = (len >> 8);
	msgbuf[4] = (len );
	if ( writen (slotp->pcsc.req_fd, msgbuf, 5)
	\|\| (portstr && writen (slotp->pcsc.req_fd, portstr, len)))
	{
	log_error ("error sending PC/SC OPEN request: %s\n",
	strerror (errno));
	goto command_failed;
	}
	/* Read the response. */
	if ((i=readn (slotp->pcsc.rsp_fd, msgbuf, 9, &len)) \|\| len != 9)
	{
	log_error ("error receiving PC/SC OPEN response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	len = buf32_to_size_t (msgbuf+1);
	if (msgbuf[0] != 0x81 \|\| len < 4)
	{
	log_error ("invalid response header from PC/SC received\n");
	goto command_failed;
	}
	len -= 4; /* Already read the error code. */
	if (len > DIM (slotp->atr))
	{
	log_error ("PC/SC returned a too large ATR (len=%lx)\n",
	(unsigned long)len);
	goto command_failed;
	}
	err = PCSC_ERR_MASK (buf32_to_ulong (msgbuf+5));
	if (err)
	{
	log_error ("PC/SC OPEN failed: %s\n", pcsc_error_string (err));
	goto command_failed;
	}

	/* The open request may return a zero for the ATR length to
	indicate that no card is present. */
	n = len;
	if (n)
	{
	if ((i=readn (slotp->pcsc.rsp_fd, slotp->atr, n, &len)) \|\| len != n)
	{
	log_error ("error receiving PC/SC OPEN response: %s\n",
	i? strerror (errno) : "premature EOF");
	goto command_failed;
	}
	}
	slotp->atrlen = len;

	reader_table[slot].close_reader = close_pcsc_reader;
	reader_table[slot].reset_reader = reset_pcsc_reader;
	reader_table[slot].get_status_reader = pcsc_get_status;
	reader_table[slot].send_apdu_reader = pcsc_send_apdu;
	reader_table[slot].dump_status_reader = dump_pcsc_reader_status;

	pcsc_vendor_specific_init (slot);

	/* Read the status so that IS_T0 will be set. */
	pcsc_get_status (slot, &dummy_status, 1);

	dump_reader_status (slot);
	unlock_slot (slot);
	return slot;

	command_failed:
	close (slotp->pcsc.req_fd);
	close (slotp->pcsc.rsp_fd);
	slotp->pcsc.req_fd = -1;
	slotp->pcsc.rsp_fd = -1;
	if (slotp->pcsc.pid != -1)
	kill (slotp->pcsc.pid, SIGTERM);
	slotp->pcsc.pid = (pid_t)(-1);
	slotp->used = 0;
	unlock_slot (slot);
	/* There is no way to return SW. */
	return -1;

	}
	#endif /NEED_PCSC_WRAPPER/


	static int
	open_pcsc_reader (const char *portstr)
	{
	#ifdef NEED_PCSC_WRAPPER
	return open_pcsc_reader_wrapped (portstr);
	#else
	return open_pcsc_reader_direct (portstr);
	#endif
	}


	/* Check whether the reader supports the ISO command code COMMAND
	on the pinpad. Return 0 on success. */
	static int
	check_pcsc_pinpad (int slot, int command, pininfo_t *pininfo)
	{
	int r;

	if (reader_table[slot].pcsc.pinmin >= 0)
	pininfo->minlen = reader_table[slot].pcsc.pinmin;

	if (reader_table[slot].pcsc.pinmax >= 0)
	pininfo->maxlen = reader_table[slot].pcsc.pinmax;

	if (!pininfo->minlen)
	pininfo->minlen = 1;
	if (!pininfo->maxlen)
	pininfo->maxlen = 15;

	if ((command == ISO7816_VERIFY && reader_table[slot].pcsc.verify_ioctl != 0)
	\|\| (command == ISO7816_CHANGE_REFERENCE_DATA
	&& reader_table[slot].pcsc.modify_ioctl != 0))
	r = 0; /* Success */
	else
	r = SW_NOT_SUPPORTED;

	if (DBG_CARD_IO)
	log_debug ("check_pcsc_pinpad: command=%02X, r=%d\n",
	(unsigned int)command, r);

	if (reader_table[slot].pinpad_varlen_supported)
	pininfo->fixedlen = 0;

	return r;
	}

	#define PIN_VERIFY_STRUCTURE_SIZE 24
	static int
	pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo)
	{
	int sw;
	unsigned char *pin_verify;
	int len = PIN_VERIFY_STRUCTURE_SIZE + pininfo->fixedlen;
	/*
	* The result buffer is only expected to have two-byte result on
	* return. However, some implementation uses this buffer for lower
	* layer too and it assumes that there is enough space for lower
	* layer communication. Such an implementation fails for TPDU
	* readers with "insufficient buffer", as it needs header and
	* trailer. Six is the number for header + result + trailer (TPDU).
	*/
	unsigned char result[6];
	pcsc_dword_t resultlen = 6;
	int no_lc;

	if (!reader_table[slot].atrlen
	&& (sw = reset_pcsc_reader (slot)))
	return sw;

	if (pininfo->fixedlen < 0 \|\| pininfo->fixedlen >= 16)
	return SW_NOT_SUPPORTED;

	pin_verify = xtrymalloc (len);
	if (!pin_verify)
	return SW_HOST_OUT_OF_CORE;

	no_lc = (!pininfo->fixedlen && reader_table[slot].is_spr532);

	pin_verify[0] = 0x00; /* bTimeOut */
	pin_verify[1] = 0x00; /* bTimeOut2 */
	pin_verify[2] = 0x82; /* bmFormatString: Byte, pos=0, left, ASCII. */
	pin_verify[3] = pininfo->fixedlen; /* bmPINBlockString */
	pin_verify[4] = 0x00; /* bmPINLengthFormat */
	pin_verify[5] = pininfo->maxlen; /* wPINMaxExtraDigit */
	pin_verify[6] = pininfo->minlen; /* wPINMaxExtraDigit */
	pin_verify[7] = 0x02; /* bEntryValidationCondition: Validation key pressed */
	if (pininfo->minlen && pininfo->maxlen && pininfo->minlen == pininfo->maxlen)
	pin_verify[7] \|= 0x01; /* Max size reached. */
	pin_verify[8] = 0x01; /* bNumberMessage: One message */
	pin_verify[9] = 0x09; /* wLangId: 0x0409: US English */
	pin_verify[10] = 0x04; /* wLangId: 0x0409: US English */
	pin_verify[11] = 0x00; /* bMsgIndex */
	pin_verify[12] = 0x00; /* bTeoPrologue[0] */
	pin_verify[13] = 0x00; /* bTeoPrologue[1] */
	pin_verify[14] = pininfo->fixedlen + 0x05 - no_lc; /* bTeoPrologue[2] */
	pin_verify[15] = pininfo->fixedlen + 0x05 - no_lc; /* ulDataLength */
	pin_verify[16] = 0x00; /* ulDataLength */
	pin_verify[17] = 0x00; /* ulDataLength */
	pin_verify[18] = 0x00; /* ulDataLength */
	pin_verify[19] = class; /* abData[0] */
	pin_verify[20] = ins; /* abData[1] */
	pin_verify[21] = p0; /* abData[2] */
	pin_verify[22] = p1; /* abData[3] */
	pin_verify[23] = pininfo->fixedlen; /* abData[4] */
	if (pininfo->fixedlen)
	memset (&pin_verify[24], 0xff, pininfo->fixedlen);
	else if (no_lc)
	len--;

	if (DBG_CARD_IO)
	log_debug ("send secure: c=%02X i=%02X p1=%02X p2=%02X len=%d pinmax=%d\n",
	class, ins, p0, p1, len, pininfo->maxlen);

	sw = control_pcsc (slot, reader_table[slot].pcsc.verify_ioctl,
	pin_verify, len, result, &resultlen);
	xfree (pin_verify);
	if (sw \|\| resultlen < 2)
	{
	log_error ("control_pcsc failed: %d\n", sw);
	return sw? sw: SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	if (DBG_CARD_IO)
	log_debug (" response: sw=%04X datalen=%d\n", sw, (unsigned int)resultlen);
	return sw;
	}


	#define PIN_MODIFY_STRUCTURE_SIZE 29
	static int
	pcsc_pinpad_modify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo)
	{
	int sw;
	unsigned char *pin_modify;
	int len = PIN_MODIFY_STRUCTURE_SIZE + 2 * pininfo->fixedlen;
	unsigned char result[6]; /* See the comment at pinpad_verify. */
	pcsc_dword_t resultlen = 6;
	int no_lc;

	if (!reader_table[slot].atrlen
	&& (sw = reset_pcsc_reader (slot)))
	return sw;

	if (pininfo->fixedlen < 0 \|\| pininfo->fixedlen >= 16)
	return SW_NOT_SUPPORTED;

	pin_modify = xtrymalloc (len);
	if (!pin_modify)
	return SW_HOST_OUT_OF_CORE;

	no_lc = (!pininfo->fixedlen && reader_table[slot].is_spr532);

	pin_modify[0] = 0x00; /* bTimeOut */
	pin_modify[1] = 0x00; /* bTimeOut2 */
	pin_modify[2] = 0x82; /* bmFormatString: Byte, pos=0, left, ASCII. */
	pin_modify[3] = pininfo->fixedlen; /* bmPINBlockString */
	pin_modify[4] = 0x00; /* bmPINLengthFormat */
	pin_modify[5] = 0x00; /* bInsertionOffsetOld */
	pin_modify[6] = pininfo->fixedlen; /* bInsertionOffsetNew */
	pin_modify[7] = pininfo->maxlen; /* wPINMaxExtraDigit */
	pin_modify[8] = pininfo->minlen; /* wPINMaxExtraDigit */
	pin_modify[9] = (p0 == 0 ? 0x03 : 0x01);
	/* bConfirmPIN
	* 0x00: new PIN once
	* 0x01: new PIN twice (confirmation)
	* 0x02: old PIN and new PIN once
	* 0x03: old PIN and new PIN twice (confirmation)
	*/
	pin_modify[10] = 0x02; /* bEntryValidationCondition: Validation key pressed */
	if (pininfo->minlen && pininfo->maxlen && pininfo->minlen == pininfo->maxlen)
	pin_modify[10] \|= 0x01; /* Max size reached. */
	pin_modify[11] = 0x03; /* bNumberMessage: Three messages */
	pin_modify[12] = 0x09; /* wLangId: 0x0409: US English */
	pin_modify[13] = 0x04; /* wLangId: 0x0409: US English */
	pin_modify[14] = 0x00; /* bMsgIndex1 */
	pin_modify[15] = 0x01; /* bMsgIndex2 */
	pin_modify[16] = 0x02; /* bMsgIndex3 */
	pin_modify[17] = 0x00; /* bTeoPrologue[0] */
	pin_modify[18] = 0x00; /* bTeoPrologue[1] */
	pin_modify[19] = 2 * pininfo->fixedlen + 0x05 - no_lc; /* bTeoPrologue[2] */
	pin_modify[20] = 2 * pininfo->fixedlen + 0x05 - no_lc; /* ulDataLength */
	pin_modify[21] = 0x00; /* ulDataLength */
	pin_modify[22] = 0x00; /* ulDataLength */
	pin_modify[23] = 0x00; /* ulDataLength */
	pin_modify[24] = class; /* abData[0] */
	pin_modify[25] = ins; /* abData[1] */
	pin_modify[26] = p0; /* abData[2] */
	pin_modify[27] = p1; /* abData[3] */
	pin_modify[28] = 2 * pininfo->fixedlen; /* abData[4] */
	if (pininfo->fixedlen)
	memset (&pin_modify[29], 0xff, 2 * pininfo->fixedlen);
	else if (no_lc)
	len--;

	if (DBG_CARD_IO)
	log_debug ("send secure: c=%02X i=%02X p1=%02X p2=%02X len=%d pinmax=%d\n",
	class, ins, p0, p1, len, (int)pininfo->maxlen);

	sw = control_pcsc (slot, reader_table[slot].pcsc.modify_ioctl,
	pin_modify, len, result, &resultlen);
	xfree (pin_modify);
	if (sw \|\| resultlen < 2)
	{
	log_error ("control_pcsc failed: %d\n", sw);
	return sw? sw : SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	if (DBG_CARD_IO)
	log_debug (" response: sw=%04X datalen=%d\n", sw, (unsigned int)resultlen);
	return sw;
	}

	#ifdef HAVE_LIBUSB
	/*
	Internal CCID driver interface.
	*/


	static void
	dump_ccid_reader_status (int slot)
	{
	log_info ("reader slot %d: using ccid driver\n", slot);
	}

	static int
	close_ccid_reader (int slot)
	{
	ccid_close_reader (reader_table[slot].ccid.handle);
	return 0;
	}


	static int
	reset_ccid_reader (int slot)
	{
	int err;
	reader_table_t slotp = reader_table + slot;
	unsigned char atr[33];
	size_t atrlen;

	err = ccid_get_atr (slotp->ccid.handle, atr, sizeof atr, &atrlen);
	if (err)
	return err;
	/* If the reset was successful, update the ATR. */
	assert (sizeof slotp->atr >= sizeof atr);
	slotp->atrlen = atrlen;
	memcpy (slotp->atr, atr, atrlen);
	dump_reader_status (slot);
	return 0;
	}


	static int
	set_progress_cb_ccid_reader (int slot, gcry_handler_progress_t cb, void *cb_arg)
	{
	reader_table_t slotp = reader_table + slot;

	return ccid_set_progress_cb (slotp->ccid.handle, cb, cb_arg);
	}


	static int
	get_status_ccid (int slot, unsigned int *status, int on_wire)
	{
	int rc;
	int bits;

	rc = ccid_slot_status (reader_table[slot].ccid.handle, &bits, on_wire);
	if (rc)
	return rc;

	if (bits == 0)
	*status = (APDU_CARD_USABLE\|APDU_CARD_PRESENT\|APDU_CARD_ACTIVE);
	else if (bits == 1)
	*status = APDU_CARD_PRESENT;
	else
	*status = 0;

	return 0;
	}


	/* Actually send the APDU of length APDULEN to SLOT and return a
	maximum of *BUFLEN data in BUFFER, the actual returned size will be
	set to BUFLEN. Returns: Internal CCID driver error code. */
	static int
	send_apdu_ccid (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen,
	pininfo_t *pininfo)
	{
	long err;
	size_t maxbuflen;

	/* If we don't have an ATR, we need to reset the reader first. */
	if (!reader_table[slot].atrlen
	&& (err = reset_ccid_reader (slot)))
	return err;

	if (DBG_CARD_IO)
	log_printhex (" raw apdu:", apdu, apdulen);

	maxbuflen = *buflen;
	if (pininfo)
	err = ccid_transceive_secure (reader_table[slot].ccid.handle,
	apdu, apdulen, pininfo,
	buffer, maxbuflen, buflen);
	else
	err = ccid_transceive (reader_table[slot].ccid.handle,
	apdu, apdulen,
	buffer, maxbuflen, buflen);
	if (err)
	log_error ("ccid_transceive failed: (0x%lx)\n",
	err);

	return err;
	}


	/* Check whether the CCID reader supports the ISO command code COMMAND
	on the pinpad. Return 0 on success. For a description of the pin
	parameters, see ccid-driver.c */
	static int
	check_ccid_pinpad (int slot, int command, pininfo_t *pininfo)
	{
	unsigned char apdu[] = { 0, 0, 0, 0x81 };

	apdu[1] = command;
	return ccid_transceive_secure (reader_table[slot].ccid.handle, apdu,
	sizeof apdu, pininfo, NULL, 0, NULL);
	}


	static int
	ccid_pinpad_operation (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo)
	{
	unsigned char apdu[4];
	int err, sw;
	unsigned char result[2];
	size_t resultlen = 2;

	apdu[0] = class;
	apdu[1] = ins;
	apdu[2] = p0;
	apdu[3] = p1;
	err = ccid_transceive_secure (reader_table[slot].ccid.handle,
	apdu, sizeof apdu, pininfo,
	result, 2, &resultlen);
	if (err)
	return err;

	if (resultlen < 2)
	return SW_HOST_INCOMPLETE_CARD_RESPONSE;

	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	return sw;
	}


	/* Open the reader and try to read an ATR. */
	static int
	open_ccid_reader (struct dev_list *dl)
	{
	int err;
	int slot;
	int require_get_status;
	reader_table_t slotp;

	slot = new_reader_slot ();
	if (slot == -1)
	return -1;
	slotp = reader_table + slot;

	err = ccid_open_reader (dl->portstr, dl->idx, dl->ccid_table,
	&slotp->ccid.handle, &slotp->rdrname);
	if (err)
	{
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}

	err = ccid_get_atr (slotp->ccid.handle,
	slotp->atr, sizeof slotp->atr, &slotp->atrlen);
	if (err)
	{
	slotp->atrlen = 0;
	err = 0;
	}

	require_get_status = ccid_require_get_status (slotp->ccid.handle);

	reader_table[slot].close_reader = close_ccid_reader;
	reader_table[slot].reset_reader = reset_ccid_reader;
	reader_table[slot].get_status_reader = get_status_ccid;
	reader_table[slot].send_apdu_reader = send_apdu_ccid;
	reader_table[slot].check_pinpad = check_ccid_pinpad;
	reader_table[slot].dump_status_reader = dump_ccid_reader_status;
	reader_table[slot].set_progress_cb = set_progress_cb_ccid_reader;
	reader_table[slot].pinpad_verify = ccid_pinpad_operation;
	reader_table[slot].pinpad_modify = ccid_pinpad_operation;
	/* Our CCID reader code does not support T=0 at all, thus reset the
	flag. */
	reader_table[slot].is_t0 = 0;
	reader_table[slot].require_get_status = require_get_status;

	dump_reader_status (slot);
	unlock_slot (slot);
	return slot;
	}
	#endif /* HAVE_LIBUSB */

	#ifdef USE_G10CODE_RAPDU
	/*
	The Remote APDU Interface.

	This uses the Remote APDU protocol to contact a reader.

	The port number is actually an index into the list of ports as
	returned via the protocol.
	*/


	static int
	rapdu_status_to_sw (int status)
	{
	int rc;

	switch (status)
	{
	case RAPDU_STATUS_SUCCESS: rc = 0; break;

	case RAPDU_STATUS_INVCMD:
	case RAPDU_STATUS_INVPROT:
	case RAPDU_STATUS_INVSEQ:
	case RAPDU_STATUS_INVCOOKIE:
	case RAPDU_STATUS_INVREADER: rc = SW_HOST_INV_VALUE; break;

	case RAPDU_STATUS_TIMEOUT: rc = SW_HOST_CARD_IO_ERROR; break;
	case RAPDU_STATUS_CARDIO: rc = SW_HOST_CARD_IO_ERROR; break;
	case RAPDU_STATUS_NOCARD: rc = SW_HOST_NO_CARD; break;
	case RAPDU_STATUS_CARDCHG: rc = SW_HOST_NO_CARD; break;
	case RAPDU_STATUS_BUSY: rc = SW_HOST_BUSY; break;
	case RAPDU_STATUS_NEEDRESET: rc = SW_HOST_CARD_INACTIVE; break;

	default: rc = SW_HOST_GENERAL_ERROR; break;
	}

	return rc;
	}



	static int
	close_rapdu_reader (int slot)
	{
	rapdu_release (reader_table[slot].rapdu.handle);
	return 0;
	}


	static int
	reset_rapdu_reader (int slot)
	{
	int err;
	reader_table_t slotp;
	rapdu_msg_t msg = NULL;

	slotp = reader_table + slot;

	err = rapdu_send_cmd (slotp->rapdu.handle, RAPDU_CMD_RESET);
	if (err)
	{
	log_error ("sending rapdu command RESET failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	rapdu_msg_release (msg);
	return rapdu_status_to_sw (err);
	}
	err = rapdu_read_msg (slotp->rapdu.handle, &msg);
	if (err)
	{
	log_error ("receiving rapdu message failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	rapdu_msg_release (msg);
	return rapdu_status_to_sw (err);
	}
	if (msg->cmd != RAPDU_STATUS_SUCCESS \|\| !msg->datalen)
	{
	int sw = rapdu_status_to_sw (msg->cmd);
	log_error ("rapdu command RESET failed: %s\n",
	rapdu_strerror (msg->cmd));
	rapdu_msg_release (msg);
	return sw;
	}
	if (msg->datalen > DIM (slotp->atr))
	{
	log_error ("ATR returned by the RAPDU layer is too large\n");
	rapdu_msg_release (msg);
	return SW_HOST_INV_VALUE;
	}
	slotp->atrlen = msg->datalen;
	memcpy (slotp->atr, msg->data, msg->datalen);

	rapdu_msg_release (msg);
	return 0;
	}


	static int
	my_rapdu_get_status (int slot, unsigned int *status, int on_wire)
	{
	int err;
	reader_table_t slotp;
	rapdu_msg_t msg = NULL;
	int oldslot;

	(void)on_wire;
	slotp = reader_table + slot;

	oldslot = rapdu_set_reader (slotp->rapdu.handle, slot);
	err = rapdu_send_cmd (slotp->rapdu.handle, RAPDU_CMD_GET_STATUS);
	rapdu_set_reader (slotp->rapdu.handle, oldslot);
	if (err)
	{
	log_error ("sending rapdu command GET_STATUS failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	return rapdu_status_to_sw (err);
	}
	err = rapdu_read_msg (slotp->rapdu.handle, &msg);
	if (err)
	{
	log_error ("receiving rapdu message failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	rapdu_msg_release (msg);
	return rapdu_status_to_sw (err);
	}
	if (msg->cmd != RAPDU_STATUS_SUCCESS \|\| !msg->datalen)
	{
	int sw = rapdu_status_to_sw (msg->cmd);
	log_error ("rapdu command GET_STATUS failed: %s\n",
	rapdu_strerror (msg->cmd));
	rapdu_msg_release (msg);
	return sw;
	}
	*status = msg->data[0];

	rapdu_msg_release (msg);
	return 0;
	}


	/* Actually send the APDU of length APDULEN to SLOT and return a
	maximum of *BUFLEN data in BUFFER, the actual returned size will be
	set to BUFLEN. Returns: APDU error code. */
	static int
	my_rapdu_send_apdu (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen,
	pininfo_t *pininfo)
	{
	int err;
	reader_table_t slotp;
	rapdu_msg_t msg = NULL;
	size_t maxlen = *buflen;

	slotp = reader_table + slot;

	*buflen = 0;
	if (DBG_CARD_IO)
	log_printhex (" APDU_data:", apdu, apdulen);

	if (apdulen < 4)
	{
	log_error ("rapdu_send_apdu: APDU is too short\n");
	return SW_HOST_INV_VALUE;
	}

	err = rapdu_send_apdu (slotp->rapdu.handle, apdu, apdulen);
	if (err)
	{
	log_error ("sending rapdu command APDU failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	rapdu_msg_release (msg);
	return rapdu_status_to_sw (err);
	}
	err = rapdu_read_msg (slotp->rapdu.handle, &msg);
	if (err)
	{
	log_error ("receiving rapdu message failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	rapdu_msg_release (msg);
	return rapdu_status_to_sw (err);
	}
	if (msg->cmd != RAPDU_STATUS_SUCCESS \|\| !msg->datalen)
	{
	int sw = rapdu_status_to_sw (msg->cmd);
	log_error ("rapdu command APDU failed: %s\n",
	rapdu_strerror (msg->cmd));
	rapdu_msg_release (msg);
	return sw;
	}

	if (msg->datalen > maxlen)
	{
	log_error ("rapdu response apdu too large\n");
	rapdu_msg_release (msg);
	return SW_HOST_INV_VALUE;
	}

	*buflen = msg->datalen;
	memcpy (buffer, msg->data, msg->datalen);

	rapdu_msg_release (msg);
	return 0;
	}

	static int
	open_rapdu_reader (int portno,
	const unsigned char *cookie, size_t length,
	int (readfnc) (void opaque,
	void *buffer, size_t size),
	void *readfnc_value,
	int (writefnc) (void opaque,
	const void *buffer, size_t size),
	void *writefnc_value,
	void (closefnc) (void opaque),
	void *closefnc_value)
	{
	int err;
	int slot;
	reader_table_t slotp;
	rapdu_msg_t msg = NULL;

	slot = new_reader_slot ();
	if (slot == -1)
	return -1;
	slotp = reader_table + slot;

	slotp->rapdu.handle = rapdu_new ();
	if (!slotp->rapdu.handle)
	{
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}

	rapdu_set_reader (slotp->rapdu.handle, portno);

	rapdu_set_iofunc (slotp->rapdu.handle,
	readfnc, readfnc_value,
	writefnc, writefnc_value,
	closefnc, closefnc_value);
	rapdu_set_cookie (slotp->rapdu.handle, cookie, length);

	/* First try to get the current ATR, but if the card is inactive
	issue a reset instead. */
	err = rapdu_send_cmd (slotp->rapdu.handle, RAPDU_CMD_GET_ATR);
	if (err == RAPDU_STATUS_NEEDRESET)
	err = rapdu_send_cmd (slotp->rapdu.handle, RAPDU_CMD_RESET);
	if (err)
	{
	log_info ("sending rapdu command GET_ATR/RESET failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	goto failure;
	}
	err = rapdu_read_msg (slotp->rapdu.handle, &msg);
	if (err)
	{
	log_info ("receiving rapdu message failed: %s\n",
	err < 0 ? strerror (errno): rapdu_strerror (err));
	goto failure;
	}
	if (msg->cmd != RAPDU_STATUS_SUCCESS \|\| !msg->datalen)
	{
	log_info ("rapdu command GET ATR failed: %s\n",
	rapdu_strerror (msg->cmd));
	goto failure;
	}
	if (msg->datalen > DIM (slotp->atr))
	{
	log_error ("ATR returned by the RAPDU layer is too large\n");
	goto failure;
	}
	slotp->atrlen = msg->datalen;
	memcpy (slotp->atr, msg->data, msg->datalen);

	reader_table[slot].close_reader = close_rapdu_reader;
	reader_table[slot].reset_reader = reset_rapdu_reader;
	reader_table[slot].get_status_reader = my_rapdu_get_status;
	reader_table[slot].send_apdu_reader = my_rapdu_send_apdu;
	reader_table[slot].check_pinpad = NULL;
	reader_table[slot].dump_status_reader = NULL;
	reader_table[slot].pinpad_verify = NULL;
	reader_table[slot].pinpad_modify = NULL;

	dump_reader_status (slot);
	rapdu_msg_release (msg);
	unlock_slot (slot);
	return slot;

	failure:
	rapdu_msg_release (msg);
	rapdu_release (slotp->rapdu.handle);
	slotp->used = 0;
	unlock_slot (slot);
	return -1;
	}

	#endif /USE_G10CODE_RAPDU/



	/*
	Driver Access
	*/
	gpg_error_t
	apdu_dev_list_start (const char portstr, struct dev_list *l_p)
	{
	struct dev_list *dl = xtrymalloc (sizeof (struct dev_list));

	*l_p = NULL;
	if (!dl)
	return gpg_error_from_syserror ();

	dl->portstr = portstr;
	dl->idx = 0;

	npth_mutex_lock (&reader_table_lock);

	#ifdef HAVE_LIBUSB
	if (opt.disable_ccid)
	{
	dl->ccid_table = NULL;
	dl->idx_max = 1;
	}
	else
	{
	gpg_error_t err;

	err = ccid_dev_scan (&dl->idx_max, &dl->ccid_table);
	if (err)
	return err;

	if (dl->idx_max == 0)
	{
	/* If a CCID reader specification has been given, the user does
	not want a fallback to other drivers. */
	if (portstr && strlen (portstr) > 5 && portstr[4] == ':')
	{
	if (DBG_READER)
	log_debug ("leave: apdu_open_reader => slot=-1 (no ccid)\n");

	xfree (dl);
	npth_mutex_unlock (&reader_table_lock);
	return gpg_error (GPG_ERR_ENODEV);
	}
	else
	dl->idx_max = 1;
	}
	}
	#else
	dl->ccid_table = NULL;
	dl->idx_max = 1;
	#endif /* HAVE_LIBUSB */

	*l_p = dl;
	return 0;
	}

	void
	apdu_dev_list_finish (struct dev_list *dl)
	{
	#ifdef HAVE_LIBUSB
	if (dl->ccid_table)
	ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
	#endif
	xfree (dl);
	npth_mutex_unlock (&reader_table_lock);
	}


	/* Open the reader and return an internal slot number or -1 on
	error. If PORTSTR is NULL we default to a suitable port (for ctAPI:
	the first USB reader. For PC/SC the first listed reader). */
	static int
	apdu_open_one_reader (const char *portstr)
	{
	static int pcsc_api_loaded, ct_api_loaded;
	int slot;

	if (DBG_READER)
	log_debug ("enter: apdu_open_reader: portstr=%s\n", portstr);

	if (opt.ctapi_driver && *opt.ctapi_driver)
	{
	int port = portstr? atoi (portstr) : 32768;

	if (!ct_api_loaded)
	{
	void *handle;

	handle = dlopen (opt.ctapi_driver, RTLD_LAZY);
	if (!handle)
	{
	log_error ("apdu_open_reader: failed to open driver: %s\n",
	dlerror ());
	return -1;
	}
	CT_init = dlsym (handle, "CT_init");
	CT_data = dlsym (handle, "CT_data");
	CT_close = dlsym (handle, "CT_close");
	if (!CT_init \|\| !CT_data \|\| !CT_close)
	{
	log_error ("apdu_open_reader: invalid CT-API driver\n");
	dlclose (handle);
	return -1;
	}
	ct_api_loaded = 1;
	}
	return open_ct_reader (port);
	}

	/* No ctAPI configured, so lets try the PC/SC API */
	if (!pcsc_api_loaded)
	{
	#ifndef NEED_PCSC_WRAPPER
	void *handle;

	handle = dlopen (opt.pcsc_driver, RTLD_LAZY);
	if (!handle)
	{
	log_error ("apdu_open_reader: failed to open driver '%s': %s\n",
	opt.pcsc_driver, dlerror ());
	return -1;
	}

	pcsc_establish_context = dlsym (handle, "SCardEstablishContext");
	pcsc_release_context = dlsym (handle, "SCardReleaseContext");
	pcsc_list_readers = dlsym (handle, "SCardListReaders");
	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	if (!pcsc_list_readers)
	pcsc_list_readers = dlsym (handle, "SCardListReadersA");
	#endif
	pcsc_get_status_change = dlsym (handle, "SCardGetStatusChange");
	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	if (!pcsc_get_status_change)
	pcsc_get_status_change = dlsym (handle, "SCardGetStatusChangeA");
	#endif
	pcsc_connect = dlsym (handle, "SCardConnect");
	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	if (!pcsc_connect)
	pcsc_connect = dlsym (handle, "SCardConnectA");
	#endif
	pcsc_reconnect = dlsym (handle, "SCardReconnect");
	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	if (!pcsc_reconnect)
	pcsc_reconnect = dlsym (handle, "SCardReconnectA");
	#endif
	pcsc_disconnect = dlsym (handle, "SCardDisconnect");
	pcsc_status = dlsym (handle, "SCardStatus");
	#if defined(_WIN32) \|\| defined(__CYGWIN__)
	if (!pcsc_status)
	pcsc_status = dlsym (handle, "SCardStatusA");
	#endif
	pcsc_begin_transaction = dlsym (handle, "SCardBeginTransaction");
	pcsc_end_transaction = dlsym (handle, "SCardEndTransaction");
	pcsc_transmit = dlsym (handle, "SCardTransmit");
	pcsc_set_timeout = dlsym (handle, "SCardSetTimeout");
	pcsc_control = dlsym (handle, "SCardControl");

	if (!pcsc_establish_context
	\|\| !pcsc_release_context
	\|\| !pcsc_list_readers
	\|\| !pcsc_get_status_change
	\|\| !pcsc_connect
	\|\| !pcsc_reconnect
	\|\| !pcsc_disconnect
	\|\| !pcsc_status
	\|\| !pcsc_begin_transaction
	\|\| !pcsc_end_transaction
	\|\| !pcsc_transmit
	\|\| !pcsc_control
	/* \|\| !pcsc_set_timeout */)
	{
	/* Note that set_timeout is currently not used and also not
	available under Windows. */
	log_error ("apdu_open_reader: invalid PC/SC driver "
	"(%d%d%d%d%d%d%d%d%d%d%d%d%d)\n",
	!!pcsc_establish_context,
	!!pcsc_release_context,
	!!pcsc_list_readers,
	!!pcsc_get_status_change,
	!!pcsc_connect,
	!!pcsc_reconnect,
	!!pcsc_disconnect,
	!!pcsc_status,
	!!pcsc_begin_transaction,
	!!pcsc_end_transaction,
	!!pcsc_transmit,
	!!pcsc_set_timeout,
	!!pcsc_control );
	dlclose (handle);
	return -1;
	}
	#endif /!NEED_PCSC_WRAPPER/
	pcsc_api_loaded = 1;
	}

	slot = open_pcsc_reader (portstr);

	if (DBG_READER)
	log_debug ("leave: apdu_open_reader => slot=%d [pc/sc]\n", slot);
	return slot;
	}

	int
	apdu_open_reader (struct dev_list *dl, int app_empty)
	{
	int slot;

	#ifdef HAVE_LIBUSB
	if (dl->ccid_table)
	{ /* CCID readers. */
	int readerno;

	/* See whether we want to use the reader ID string or a reader
	number. A readerno of -1 indicates that the reader ID string is
	to be used. */
	if (dl->portstr && strchr (dl->portstr, ':'))
	readerno = -1; /* We want to use the readerid. */
	else if (dl->portstr)
	{
	readerno = atoi (dl->portstr);
	if (readerno < 0)
	{
	return -1;
	}
	}
	else
	readerno = 0; /* Default. */

	if (readerno > 0)
	{ /* Use single, the specific reader. */
	if (readerno >= dl->idx_max)
	return -1;

	dl->idx = readerno;
	dl->portstr = NULL;
	slot = open_ccid_reader (dl);
	dl->idx = dl->idx_max;
	if (slot >= 0)
	return slot;
	else
	return -1;
	}

	while (dl->idx < dl->idx_max)
	{
	unsigned int bai = ccid_get_BAI (dl->idx, dl->ccid_table);

	if (DBG_READER)
	log_debug ("apdu_open_reader: BAI=%x\n", bai);

	/* Check identity by BAI against already opened HANDLEs. */
	for (slot = 0; slot < MAX_READER; slot++)
	if (reader_table[slot].used
	&& reader_table[slot].ccid.handle
	&& ccid_compare_BAI (reader_table[slot].ccid.handle, bai))
	break;

	if (slot == MAX_READER)
	{ /* Found a new device. */
	if (DBG_READER)
	log_debug ("apdu_open_reader: new device=%x\n", bai);

	slot = open_ccid_reader (dl);

	dl->idx++;
	if (slot >= 0)
	return slot;
	else
	{
	/* Skip this reader. */
	log_error ("ccid open error: skip\n");
	continue;
	}
	}
	else
	dl->idx++;
	}

	/* Not found. Try one for PC/SC, only when it's the initial scan. */
	if (app_empty && dl->idx == dl->idx_max)
	{
	dl->idx++;
	slot = apdu_open_one_reader (dl->portstr);
	}
	else
	slot = -1;
	}
	else
	#endif
	{ /* PC/SC readers. */
	if (app_empty && dl->idx == 0)
	{
	dl->idx++;
	slot = apdu_open_one_reader (dl->portstr);
	}
	else
	slot = -1;
	}

	return slot;
	}


	/* Open an remote reader and return an internal slot number or -1 on
	error. This function is an alternative to apdu_open_reader and used
	with remote readers only. Note that the supplied CLOSEFNC will
	only be called once and the slot will not be valid afther this.

	If PORTSTR is NULL we default to the first available port.
	*/
	int
	apdu_open_remote_reader (const char *portstr,
	const unsigned char *cookie, size_t length,
	int (readfnc) (void opaque,
	void *buffer, size_t size),
	void *readfnc_value,
	int (writefnc) (void opaque,
	const void *buffer, size_t size),
	void *writefnc_value,
	void (closefnc) (void opaque),
	void *closefnc_value)
	{
	#ifdef USE_G10CODE_RAPDU
	return open_rapdu_reader (portstr? atoi (portstr) : 0,
	cookie, length,
	readfnc, readfnc_value,
	writefnc, writefnc_value,
	closefnc, closefnc_value);
	#else
	(void)portstr;
	(void)cookie;
	(void)length;
	(void)readfnc;
	(void)readfnc_value;
	(void)writefnc;
	(void)writefnc_value;
	(void)closefnc;
	(void)closefnc_value;
	#ifdef _WIN32
	errno = ENOENT;
	#else
	errno = ENOSYS;
	#endif
	return -1;
	#endif
	}


	int
	apdu_close_reader (int slot)
	{
	int sw;

	if (DBG_READER)
	log_debug ("enter: apdu_close_reader: slot=%d\n", slot);

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	{
	if (DBG_READER)
	log_debug ("leave: apdu_close_reader => SW_HOST_NO_DRIVER\n");
	return SW_HOST_NO_DRIVER;
	}
	sw = apdu_disconnect (slot);
	if (sw)
	{
	/*
	* When the reader/token was removed it might come here.
	* It should go through to call CLOSE_READER even if we got an error.
	*/
	if (DBG_READER)
	log_debug ("apdu_close_reader => 0x%x (apdu_disconnect)\n", sw);
	}
	if (reader_table[slot].close_reader)
	{
	sw = reader_table[slot].close_reader (slot);
	reader_table[slot].used = 0;
	if (DBG_READER)
	log_debug ("leave: apdu_close_reader => 0x%x (close_reader)\n", sw);
	return sw;
	}
	xfree (reader_table[slot].rdrname);
	reader_table[slot].rdrname = NULL;
	reader_table[slot].used = 0;
	if (DBG_READER)
	log_debug ("leave: apdu_close_reader => SW_HOST_NOT_SUPPORTED\n");
	return SW_HOST_NOT_SUPPORTED;
	}


	/* Function suitable for a cleanup function to close all reader. It
	should not be used if the reader will be opened again. The reason
	for implementing this to properly close USB devices so that they
	will startup the next time without error. */
	void
	apdu_prepare_exit (void)
	{
	static int sentinel;
	int slot;

	if (!sentinel)
	{
	sentinel = 1;
	npth_mutex_lock (&reader_table_lock);
	for (slot = 0; slot < MAX_READER; slot++)
	if (reader_table[slot].used)
	{
	apdu_disconnect (slot);
	if (reader_table[slot].close_reader)
	reader_table[slot].close_reader (slot);
	xfree (reader_table[slot].rdrname);
	reader_table[slot].rdrname = NULL;
	reader_table[slot].used = 0;
	}
	npth_mutex_unlock (&reader_table_lock);
	sentinel = 0;
	}
	}


	/* Enumerate all readers and return information on whether this reader
	is in use. The caller should start with SLOT set to 0 and
	increment it with each call until an error is returned. */
	int
	apdu_enum_reader (int slot, int *used)
	{
	if (slot < 0 \|\| slot >= MAX_READER)
	return SW_HOST_NO_DRIVER;
	*used = reader_table[slot].used;
	return 0;
	}


	/* Connect a card. This is used to power up the card and make sure
	that an ATR is available. Depending on the reader backend it may
	return an error for an inactive card or if no card is available.
	Return -1 on error. Return 1 if reader requires get_status to
	watch card removal. Return 0 if it's a token (always with a card),
	or it supports INTERRUPT endpoint to watch card removal.
	*/
	int
	apdu_connect (int slot)
	{
	int sw = 0;
	unsigned int status = 0;

	if (DBG_READER)
	log_debug ("enter: apdu_connect: slot=%d\n", slot);

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	{
	if (DBG_READER)
	log_debug ("leave: apdu_connect => SW_HOST_NO_DRIVER\n");
	return -1;
	}

	/* Only if the access method provides a connect function we use it.
	If not, we expect that the card has been implicitly connected by
	apdu_open_reader. */
	if (reader_table[slot].connect_card)
	{
	sw = lock_slot (slot);
	if (!sw)
	{
	sw = reader_table[slot].connect_card (slot);
	unlock_slot (slot);
	}
	}

	/* We need to call apdu_get_status_internal, so that the last-status
	machinery gets setup properly even if a card is inserted while
	scdaemon is fired up and apdu_get_status has not yet been called.
	Without that we would force a reset of the card with the next
	call to apdu_get_status. */
	if (!sw)
	sw = apdu_get_status_internal (slot, 1, &status, 1);

	if (sw)
	;
	else if (!(status & APDU_CARD_PRESENT))
	sw = SW_HOST_NO_CARD;
	else if ((status & APDU_CARD_PRESENT) && !(status & APDU_CARD_ACTIVE))
	sw = SW_HOST_CARD_INACTIVE;

	if (sw == SW_HOST_CARD_INACTIVE)
	{
	/* Try power it up again. */
	sw = apdu_reset (slot);
	}

	if (DBG_READER)
	log_debug ("leave: apdu_connect => sw=0x%x\n", sw);

	if (sw)
	return -1;

	return reader_table[slot].require_get_status;
	}


	int
	apdu_disconnect (int slot)
	{
	int sw;

	if (DBG_READER)
	log_debug ("enter: apdu_disconnect: slot=%d\n", slot);

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	{
	if (DBG_READER)
	log_debug ("leave: apdu_disconnect => SW_HOST_NO_DRIVER\n");
	return SW_HOST_NO_DRIVER;
	}

	if (reader_table[slot].disconnect_card)
	{
	sw = lock_slot (slot);
	if (!sw)
	{
	sw = reader_table[slot].disconnect_card (slot);
	unlock_slot (slot);
	}
	}
	else
	sw = 0;

	if (DBG_READER)
	log_debug ("leave: apdu_disconnect => sw=0x%x\n", sw);
	return sw;
	}


	/* Set the progress callback of SLOT to CB and its args to CB_ARG. If
	CB is NULL the progress callback is removed. */
	int
	apdu_set_progress_cb (int slot, gcry_handler_progress_t cb, void *cb_arg)
	{
	int sw;

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (reader_table[slot].set_progress_cb)
	{
	sw = lock_slot (slot);
	if (!sw)
	{
	sw = reader_table[slot].set_progress_cb (slot, cb, cb_arg);
	unlock_slot (slot);
	}
	}
	else
	sw = 0;
	return sw;
	}


	/* Do a reset for the card in reader at SLOT. */
	int
	apdu_reset (int slot)
	{
	int sw;

	if (DBG_READER)
	log_debug ("enter: apdu_reset: slot=%d\n", slot);

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	{
	if (DBG_READER)
	log_debug ("leave: apdu_reset => SW_HOST_NO_DRIVER\n");
	return SW_HOST_NO_DRIVER;
	}

	if ((sw = lock_slot (slot)))
	{
	if (DBG_READER)
	log_debug ("leave: apdu_reset => sw=0x%x (lock_slot)\n", sw);
	return sw;
	}

	if (reader_table[slot].reset_reader)
	sw = reader_table[slot].reset_reader (slot);

	unlock_slot (slot);
	if (DBG_READER)
	log_debug ("leave: apdu_reset => sw=0x%x\n", sw);
	return sw;
	}


	/* Return the ATR or NULL if none is available. On success the length
	of the ATR is stored at ATRLEN. The caller must free the returned
	value. */
	unsigned char *
	apdu_get_atr (int slot, size_t *atrlen)
	{
	unsigned char *buf;

	if (DBG_READER)
	log_debug ("enter: apdu_get_atr: slot=%d\n", slot);

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	{
	if (DBG_READER)
	log_debug ("leave: apdu_get_atr => NULL (bad slot)\n");
	return NULL;
	}
	if (!reader_table[slot].atrlen)
	{
	if (DBG_READER)
	log_debug ("leave: apdu_get_atr => NULL (no ATR)\n");
	return NULL;
	}

	buf = xtrymalloc (reader_table[slot].atrlen);
	if (!buf)
	{
	if (DBG_READER)
	log_debug ("leave: apdu_get_atr => NULL (out of core)\n");
	return NULL;
	}
	memcpy (buf, reader_table[slot].atr, reader_table[slot].atrlen);
	*atrlen = reader_table[slot].atrlen;
	if (DBG_READER)
	log_debug ("leave: apdu_get_atr => atrlen=%zu\n", *atrlen);
	return buf;
	}



	/* Retrieve the status for SLOT. The function does only wait for the
	card to become available if HANG is set to true. On success the
	bits in STATUS will be set to

	APDU_CARD_USABLE (bit 0) = card present and usable
	APDU_CARD_PRESENT (bit 1) = card present
	APDU_CARD_ACTIVE (bit 2) = card active
	(bit 3) = card access locked [not yet implemented]

	For most applications, testing bit 0 is sufficient.
	*/
	static int
	apdu_get_status_internal (int slot, int hang, unsigned int *status, int on_wire)
	{
	int sw;
	unsigned int s;

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if ((sw = hang? lock_slot (slot) : trylock_slot (slot)))
	return sw;

	if (reader_table[slot].get_status_reader)
	sw = reader_table[slot].get_status_reader (slot, &s, on_wire);

	unlock_slot (slot);

	if (sw)
	{
	if (on_wire)
	reader_table[slot].atrlen = 0;
	s = 0;
	}

	if (status)
	*status = s;
	return sw;
	}


	/* See above for a description. */
	int
	apdu_get_status (int slot, int hang, unsigned int *status)
	{
	int sw;

	if (DBG_READER)
	log_debug ("enter: apdu_get_status: slot=%d hang=%d\n", slot, hang);
	sw = apdu_get_status_internal (slot, hang, status, 0);
	if (DBG_READER)
	{
	if (status)
	log_debug ("leave: apdu_get_status => sw=0x%x status=%u\n",
	sw, *status);
	else
	log_debug ("leave: apdu_get_status => sw=0x%x\n", sw);
	}
	return sw;
	}


	/* Check whether the reader supports the ISO command code COMMAND on
	the pinpad. Return 0 on success. For a description of the pin
	parameters, see ccid-driver.c */
	int
	apdu_check_pinpad (int slot, int command, pininfo_t *pininfo)
	{
	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (opt.enable_pinpad_varlen)
	pininfo->fixedlen = 0;

	if (reader_table[slot].check_pinpad)
	{
	int sw;

	if ((sw = lock_slot (slot)))
	return sw;

	sw = reader_table[slot].check_pinpad (slot, command, pininfo);
	unlock_slot (slot);
	return sw;
	}
	else
	return SW_HOST_NOT_SUPPORTED;
	}


	int
	apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo)
	{
	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (reader_table[slot].pinpad_verify)
	{
	int sw;

	if ((sw = lock_slot (slot)))
	return sw;

	sw = reader_table[slot].pinpad_verify (slot, class, ins, p0, p1,
	pininfo);
	unlock_slot (slot);
	return sw;
	}
	else
	return SW_HOST_NOT_SUPPORTED;
	}


	int
	apdu_pinpad_modify (int slot, int class, int ins, int p0, int p1,
	pininfo_t *pininfo)
	{
	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (reader_table[slot].pinpad_modify)
	{
	int sw;

	if ((sw = lock_slot (slot)))
	return sw;

	sw = reader_table[slot].pinpad_modify (slot, class, ins, p0, p1,
	pininfo);
	unlock_slot (slot);
	return sw;
	}
	else
	return SW_HOST_NOT_SUPPORTED;
	}


	/* Dispatcher for the actual send_apdu function. Note, that this
	function should be called in locked state. */
	static int
	send_apdu (int slot, unsigned char *apdu, size_t apdulen,
	unsigned char buffer, size_t buflen, pininfo_t *pininfo)
	{
	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (reader_table[slot].send_apdu_reader)
	return reader_table[slot].send_apdu_reader (slot,
	apdu, apdulen,
	buffer, buflen,
	pininfo);
	else
	return SW_HOST_NOT_SUPPORTED;
	}


	/* Core APDU tranceiver function. Parameters are described at
	apdu_send_le with the exception of PININFO which indicates pinpad
	related operations if not NULL. If EXTENDED_MODE is not 0
	command chaining or extended length will be used according to these
	values:
	n < 0 := Use command chaining with the data part limited to -n
	in each chunk. If -1 is used a default value is used.
	n == 0 := No extended mode or command chaining.
	n == 1 := Use extended length for input and output without a
	length limit.
	n > 1 := Use extended length with up to N bytes.

	*/
	static int
	send_le (int slot, int class, int ins, int p0, int p1,
	int lc, const char *data, int le,
	unsigned char *retbuf, size_t retbuflen,
	pininfo_t *pininfo, int extended_mode)
	{
	#define SHORT_RESULT_BUFFER_SIZE 258
	/* We allocate 8 extra bytes as a safety margin towards a driver bug. */
	unsigned char short_result_buffer[SHORT_RESULT_BUFFER_SIZE+10];
	unsigned char *result_buffer = NULL;
	size_t result_buffer_size;
	unsigned char *result;
	size_t resultlen;
	unsigned char short_apdu_buffer[5+256+1];
	unsigned char *apdu_buffer = NULL;
	size_t apdu_buffer_size;
	unsigned char *apdu;
	size_t apdulen;
	int sw;
	long rc; /* We need a long here due to PC/SC. */
	int did_exact_length_hack = 0;
	int use_chaining = 0;
	int use_extended_length = 0;
	int lc_chunk;

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (DBG_CARD_IO)
	log_debug ("send apdu: c=%02X i=%02X p1=%02X p2=%02X lc=%d le=%d em=%d\n",
	class, ins, p0, p1, lc, le, extended_mode);

	if (lc != -1 && (lc > 255 \|\| lc < 0))
	{
	/* Data does not fit into an APDU. What we do now depends on
	the EXTENDED_MODE parameter. */
	if (!extended_mode)
	return SW_WRONG_LENGTH; /* No way to send such an APDU. */
	else if (extended_mode > 0)
	use_extended_length = 1;
	else if (extended_mode < 0)
	{
	/* Send APDU using chaining mode. */
	if (lc > 16384)
	return SW_WRONG_LENGTH; /* Sanity check. */
	if ((class&0xf0) != 0)
	return SW_HOST_INV_VALUE; /* Upper 4 bits need to be 0. */
	use_chaining = extended_mode == -1? 255 : -extended_mode;
	use_chaining &= 0xff;
	}
	else
	return SW_HOST_INV_VALUE;
	}
	else if (lc == -1 && extended_mode > 0)
	use_extended_length = 1;

	if (le != -1 && (le > (extended_mode > 0? 255:256) \|\| le < 0))
	{
	/* Expected Data does not fit into an APDU. What we do now
	depends on the EXTENDED_MODE parameter. Note that a check
	for command chaining does not make sense because we are
	looking at Le. */
	if (!extended_mode)
	return SW_WRONG_LENGTH; /* No way to send such an APDU. */
	else if (use_extended_length)
	; /* We are already using extended length. */
	else if (extended_mode > 0)
	use_extended_length = 1;
	else
	return SW_HOST_INV_VALUE;
	}

	if ((!data && lc != -1) \|\| (data && lc == -1))
	return SW_HOST_INV_VALUE;

	if (use_extended_length)
	{
	if (reader_table[slot].is_t0)
	return SW_HOST_NOT_SUPPORTED;

	/* Space for: cls/ins/p1/p2+Z+2_byte_Lc+Lc+2_byte_Le. */
	apdu_buffer_size = 4 + 1 + (lc >= 0? (2+lc):0) + 2;
	apdu_buffer = xtrymalloc (apdu_buffer_size + 10);
	if (!apdu_buffer)
	return SW_HOST_OUT_OF_CORE;
	apdu = apdu_buffer;
	}
	else
	{
	apdu_buffer_size = sizeof short_apdu_buffer;
	apdu = short_apdu_buffer;
	}

	if (use_extended_length && (le > 256 \|\| le < 0))
	{
	/* Two more bytes are needed for status bytes. */
	result_buffer_size = le < 0? 4096 : (le + 2);
	result_buffer = xtrymalloc (result_buffer_size);
	if (!result_buffer)
	{
	xfree (apdu_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	result = result_buffer;
	}
	else
	{
	result_buffer_size = SHORT_RESULT_BUFFER_SIZE;
	result = short_result_buffer;
	}
	#undef SHORT_RESULT_BUFFER_SIZE

	if ((sw = lock_slot (slot)))
	{
	xfree (apdu_buffer);
	xfree (result_buffer);
	return sw;
	}

	do
	{
	if (use_extended_length)
	{
	use_chaining = 0;
	apdulen = 0;
	apdu[apdulen++] = class;
	apdu[apdulen++] = ins;
	apdu[apdulen++] = p0;
	apdu[apdulen++] = p1;
	if (lc > 0)
	{
	apdu[apdulen++] = 0; /* Z byte: Extended length marker. */
	apdu[apdulen++] = ((lc >> 8) & 0xff);
	apdu[apdulen++] = (lc & 0xff);
	memcpy (apdu+apdulen, data, lc);
	data += lc;
	apdulen += lc;
	}
	if (le != -1)
	{
	if (lc <= 0)
	apdu[apdulen++] = 0; /* Z byte: Extended length marker. */
	apdu[apdulen++] = ((le >> 8) & 0xff);
	apdu[apdulen++] = (le & 0xff);
	}
	}
	else
	{
	apdulen = 0;
	apdu[apdulen] = class;
	if (use_chaining && lc > 255)
	{
	apdu[apdulen] \|= 0x10;
	assert (use_chaining < 256);
	lc_chunk = use_chaining;
	lc -= use_chaining;
	}
	else
	{
	use_chaining = 0;
	lc_chunk = lc;
	}
	apdulen++;
	apdu[apdulen++] = ins;
	apdu[apdulen++] = p0;
	apdu[apdulen++] = p1;
	if (lc_chunk != -1)
	{
	apdu[apdulen++] = lc_chunk;
	memcpy (apdu+apdulen, data, lc_chunk);
	data += lc_chunk;
	apdulen += lc_chunk;
	/* T=0 does not allow the use of Lc together with Le;
	thus disable Le in this case. */
	if (reader_table[slot].is_t0)
	le = -1;
	}
	if (le != -1 && !use_chaining)
	apdu[apdulen++] = le; /* Truncation is okay (0 means 256). */
	}

	exact_length_hack:
	/* As a safeguard don't pass any garbage to the driver. */
	assert (apdulen <= apdu_buffer_size);
	memset (apdu+apdulen, 0, apdu_buffer_size - apdulen);
	resultlen = result_buffer_size;
	rc = send_apdu (slot, apdu, apdulen, result, &resultlen, pininfo);
	if (rc \|\| resultlen < 2)
	{
	log_info ("apdu_send_simple(%d) failed: %s\n",
	slot, apdu_strerror (rc));
	unlock_slot (slot);
	xfree (apdu_buffer);
	xfree (result_buffer);
	return rc? rc : SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	if (!use_extended_length
	&& !did_exact_length_hack && SW_EXACT_LENGTH_P (sw))
	{
	apdu[apdulen-1] = (sw & 0x00ff);
	did_exact_length_hack = 1;
	goto exact_length_hack;
	}
	}
	while (use_chaining && sw == SW_SUCCESS);

	if (apdu_buffer)
	{
	xfree (apdu_buffer);
	apdu_buffer = NULL;
	apdu_buffer_size = 0;
	}

	/* Store away the returned data but strip the statusword. */
	resultlen -= 2;
	if (DBG_CARD_IO)
	{
	log_debug (" response: sw=%04X datalen=%d\n",
	sw, (unsigned int)resultlen);
	if ( !retbuf && (sw == SW_SUCCESS \|\| (sw & 0xff00) == SW_MORE_DATA))
	log_printhex (" dump: ", result, resultlen);
	}

	if (sw == SW_SUCCESS \|\| sw == SW_EOF_REACHED)
	{
	if (retbuf)
	{
	*retbuf = xtrymalloc (resultlen? resultlen : 1);
	if (!*retbuf)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	*retbuflen = resultlen;
	memcpy (*retbuf, result, resultlen);
	}
	}
	else if ((sw & 0xff00) == SW_MORE_DATA)
	{
	unsigned char p = NULL, tmp;
	size_t bufsize = 4096;

	/* It is likely that we need to return much more data, so we
	start off with a large buffer. */
	if (retbuf)
	{
	*retbuf = p = xtrymalloc (bufsize);
	if (!*retbuf)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	assert (resultlen < bufsize);
	memcpy (p, result, resultlen);
	p += resultlen;
	}

	do
	{
	int len = (sw & 0x00ff);

	if (DBG_CARD_IO)
	log_debug ("apdu_send_simple(%d): %d more bytes available\n",
	slot, len);
	apdu_buffer_size = sizeof short_apdu_buffer;
	apdu = short_apdu_buffer;
	apdulen = 0;
	apdu[apdulen++] = class;
	apdu[apdulen++] = 0xC0;
	apdu[apdulen++] = 0;
	apdu[apdulen++] = 0;
	apdu[apdulen++] = len;
	assert (apdulen <= apdu_buffer_size);
	memset (apdu+apdulen, 0, apdu_buffer_size - apdulen);
	resultlen = result_buffer_size;
	rc = send_apdu (slot, apdu, apdulen, result, &resultlen, NULL);
	if (rc \|\| resultlen < 2)
	{
	log_error ("apdu_send_simple(%d) for get response failed: %s\n",
	slot, apdu_strerror (rc));
	unlock_slot (slot);
	xfree (result_buffer);
	return rc? rc : SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	resultlen -= 2;
	if (DBG_CARD_IO)
	{
	log_debug (" more: sw=%04X datalen=%d\n",
	sw, (unsigned int)resultlen);
	if (!retbuf && (sw==SW_SUCCESS \|\| (sw&0xff00)==SW_MORE_DATA))
	log_printhex (" dump: ", result, resultlen);
	}

	if ((sw & 0xff00) == SW_MORE_DATA
	\|\| sw == SW_SUCCESS
	\|\| sw == SW_EOF_REACHED )
	{
	if (retbuf && resultlen)
	{
	if (p - *retbuf + resultlen > bufsize)
	{
	bufsize += resultlen > 4096? resultlen: 4096;
	tmp = xtryrealloc (*retbuf, bufsize);
	if (!tmp)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	p = tmp + (p - *retbuf);
	*retbuf = tmp;
	}
	memcpy (p, result, resultlen);
	p += resultlen;
	}
	}
	else
	log_info ("apdu_send_simple(%d) "
	"got unexpected status %04X from get response\n",
	slot, sw);
	}
	while ((sw & 0xff00) == SW_MORE_DATA);

	if (retbuf)
	{
	retbuflen = p - retbuf;
	tmp = xtryrealloc (retbuf, retbuflen);
	if (tmp)
	*retbuf = tmp;
	}
	}

	unlock_slot (slot);
	xfree (result_buffer);

	if (DBG_CARD_IO && retbuf && sw == SW_SUCCESS)
	log_printhex (" dump: ", retbuf, retbuflen);

	return sw;
	}

	/* Send an APDU to the card in SLOT. The APDU is created from all
	given parameters: CLASS, INS, P0, P1, LC, DATA, LE. A value of -1
	for LC won't sent this field and the data field; in this case DATA
	must also be passed as NULL. If EXTENDED_MODE is not 0 command
	chaining or extended length will be used; see send_le for details.
	The return value is the status word or -1 for an invalid SLOT or
	other non card related error. If RETBUF is not NULL, it will
	receive an allocated buffer with the returned data. The length of
	that data will be put into *RETBUFLEN. The caller is responsible
	for releasing the buffer even in case of errors. */
	int
	apdu_send_le(int slot, int extended_mode,
	int class, int ins, int p0, int p1,
	int lc, const char *data, int le,
	unsigned char *retbuf, size_t retbuflen)
	{
	return send_le (slot, class, ins, p0, p1,
	lc, data, le,
	retbuf, retbuflen,
	NULL, extended_mode);
	}


	/* Send an APDU to the card in SLOT. The APDU is created from all
	given parameters: CLASS, INS, P0, P1, LC, DATA. A value of -1 for
	LC won't sent this field and the data field; in this case DATA must
	also be passed as NULL. If EXTENDED_MODE is not 0 command chaining
	or extended length will be used; see send_le for details. The
	return value is the status word or -1 for an invalid SLOT or other
	non card related error. If RETBUF is not NULL, it will receive an
	allocated buffer with the returned data. The length of that data
	will be put into *RETBUFLEN. The caller is responsible for
	releasing the buffer even in case of errors. */
	int
	apdu_send (int slot, int extended_mode,
	int class, int ins, int p0, int p1,
	int lc, const char data, unsigned char retbuf, size_t retbuflen)
	{
	return send_le (slot, class, ins, p0, p1, lc, data, 256,
	retbuf, retbuflen, NULL, extended_mode);
	}

	/* Send an APDU to the card in SLOT. The APDU is created from all
	given parameters: CLASS, INS, P0, P1, LC, DATA. A value of -1 for
	LC won't sent this field and the data field; in this case DATA must
	also be passed as NULL. If EXTENDED_MODE is not 0 command chaining
	or extended length will be used; see send_le for details. The
	return value is the status word or -1 for an invalid SLOT or other
	non card related error. No data will be returned. */
	int
	apdu_send_simple (int slot, int extended_mode,
	int class, int ins, int p0, int p1,
	int lc, const char *data)
	{
	return send_le (slot, class, ins, p0, p1, lc, data, -1, NULL, NULL, NULL,
	extended_mode);
	}


	/* This is a more generic version of the apdu sending routine. It
	takes an already formatted APDU in APDUDATA or length APDUDATALEN
	and returns with an APDU including the status word. With
	HANDLE_MORE set to true this function will handle the MORE DATA
	status and return all APDUs concatenated with one status word at
	the end. If EXTENDED_LENGTH is != 0 extended lengths are allowed
	with a max. result data length of EXTENDED_LENGTH bytes. The
	function does not return a regular status word but 0 on success.
	If the slot is locked, the function returns immediately with an
	error. */
	int
	apdu_send_direct (int slot, size_t extended_length,
	const unsigned char *apdudata, size_t apdudatalen,
	int handle_more,
	unsigned char *retbuf, size_t retbuflen)
	{
	#define SHORT_RESULT_BUFFER_SIZE 258
	unsigned char short_result_buffer[SHORT_RESULT_BUFFER_SIZE+10];
	unsigned char *result_buffer = NULL;
	size_t result_buffer_size;
	unsigned char *result;
	size_t resultlen;
	unsigned char short_apdu_buffer[5+256+10];
	unsigned char *apdu_buffer = NULL;
	unsigned char *apdu;
	size_t apdulen;
	int sw;
	long rc; /* we need a long here due to PC/SC. */
	int class;

	if (slot < 0 \|\| slot >= MAX_READER \|\| !reader_table[slot].used )
	return SW_HOST_NO_DRIVER;

	if (apdudatalen > 65535)
	return SW_HOST_INV_VALUE;

	if (apdudatalen > sizeof short_apdu_buffer - 5)
	{
	apdu_buffer = xtrymalloc (apdudatalen + 5);
	if (!apdu_buffer)
	return SW_HOST_OUT_OF_CORE;
	apdu = apdu_buffer;
	}
	else
	{
	apdu = short_apdu_buffer;
	}
	apdulen = apdudatalen;
	memcpy (apdu, apdudata, apdudatalen);
	class = apdulen? *apdu : 0;

	if (extended_length >= 256 && extended_length <= 65536)
	{
	result_buffer_size = extended_length;
	result_buffer = xtrymalloc (result_buffer_size + 10);
	if (!result_buffer)
	{
	xfree (apdu_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	result = result_buffer;
	}
	else
	{
	result_buffer_size = SHORT_RESULT_BUFFER_SIZE;
	result = short_result_buffer;
	}
	#undef SHORT_RESULT_BUFFER_SIZE

	if ((sw = trylock_slot (slot)))
	{
	xfree (apdu_buffer);
	xfree (result_buffer);
	return sw;
	}

	resultlen = result_buffer_size;
	rc = send_apdu (slot, apdu, apdulen, result, &resultlen, NULL);
	xfree (apdu_buffer);
	apdu_buffer = NULL;
	if (rc \|\| resultlen < 2)
	{
	log_error ("apdu_send_direct(%d) failed: %s\n",
	slot, apdu_strerror (rc));
	unlock_slot (slot);
	xfree (result_buffer);
	return rc? rc : SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	/* Store away the returned data but strip the statusword. */
	resultlen -= 2;
	if (DBG_CARD_IO)
	{
	log_debug (" response: sw=%04X datalen=%d\n",
	sw, (unsigned int)resultlen);
	if ( !retbuf && (sw == SW_SUCCESS \|\| (sw & 0xff00) == SW_MORE_DATA))
	log_printhex (" dump: ", result, resultlen);
	}

	if (handle_more && (sw & 0xff00) == SW_MORE_DATA)
	{
	unsigned char p = NULL, tmp;
	size_t bufsize = 4096;

	/* It is likely that we need to return much more data, so we
	start off with a large buffer. */
	if (retbuf)
	{
	*retbuf = p = xtrymalloc (bufsize + 2);
	if (!*retbuf)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	assert (resultlen < bufsize);
	memcpy (p, result, resultlen);
	p += resultlen;
	}

	do
	{
	int len = (sw & 0x00ff);

	if (DBG_CARD_IO)
	log_debug ("apdu_send_direct(%d): %d more bytes available\n",
	slot, len);
	apdu = short_apdu_buffer;
	apdulen = 0;
	apdu[apdulen++] = class;
	apdu[apdulen++] = 0xC0;
	apdu[apdulen++] = 0;
	apdu[apdulen++] = 0;
	apdu[apdulen++] = len;
	memset (apdu+apdulen, 0, sizeof (short_apdu_buffer) - apdulen);
	resultlen = result_buffer_size;
	rc = send_apdu (slot, apdu, apdulen, result, &resultlen, NULL);
	if (rc \|\| resultlen < 2)
	{
	log_error ("apdu_send_direct(%d) for get response failed: %s\n",
	slot, apdu_strerror (rc));
	unlock_slot (slot);
	xfree (result_buffer);
	return rc ? rc : SW_HOST_INCOMPLETE_CARD_RESPONSE;
	}
	sw = (result[resultlen-2] << 8) \| result[resultlen-1];
	resultlen -= 2;
	if (DBG_CARD_IO)
	{
	log_debug (" more: sw=%04X datalen=%d\n",
	sw, (unsigned int)resultlen);
	if (!retbuf && (sw==SW_SUCCESS \|\| (sw&0xff00)==SW_MORE_DATA))
	log_printhex (" dump: ", result, resultlen);
	}

	if ((sw & 0xff00) == SW_MORE_DATA
	\|\| sw == SW_SUCCESS
	\|\| sw == SW_EOF_REACHED )
	{
	if (retbuf && resultlen)
	{
	if (p - *retbuf + resultlen > bufsize)
	{
	bufsize += resultlen > 4096? resultlen: 4096;
	tmp = xtryrealloc (*retbuf, bufsize + 2);
	if (!tmp)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	p = tmp + (p - *retbuf);
	*retbuf = tmp;
	}
	memcpy (p, result, resultlen);
	p += resultlen;
	}
	}
	else
	log_info ("apdu_send_direct(%d) "
	"got unexpected status %04X from get response\n",
	slot, sw);
	}
	while ((sw & 0xff00) == SW_MORE_DATA);

	if (retbuf)
	{
	retbuflen = p - retbuf;
	tmp = xtryrealloc (retbuf, retbuflen + 2);
	if (tmp)
	*retbuf = tmp;
	}
	}
	else
	{
	if (retbuf)
	{
	*retbuf = xtrymalloc ((resultlen? resultlen : 1)+2);
	if (!*retbuf)
	{
	unlock_slot (slot);
	xfree (result_buffer);
	return SW_HOST_OUT_OF_CORE;
	}
	*retbuflen = resultlen;
	memcpy (*retbuf, result, resultlen);
	}
	}

	unlock_slot (slot);
	xfree (result_buffer);

	/* Append the status word. Note that we reserved the two extra
	bytes while allocating the buffer. */
	if (retbuf)
	{
	(retbuf)[(retbuflen)++] = (sw >> 8);
	(retbuf)[(retbuflen)++] = sw;
	}

	if (DBG_CARD_IO && retbuf)
	log_printhex (" dump: ", retbuf, retbuflen);

	return 0;
	}


	const char *
	apdu_get_reader_name (int slot)
	{
	return reader_table[slot].rdrname;
	}

	gpg_error_t
	apdu_init (void)
	{
	#ifdef USE_NPTH
	gpg_error_t err;
	int i;

	if (npth_mutex_init (&reader_table_lock, NULL))
	goto leave;

	for (i = 0; i < MAX_READER; i++)
	if (npth_mutex_init (&reader_table[i].lock, NULL))
	goto leave;

	/* All done well. */
	return 0;

	leave:
	err = gpg_error_from_syserror ();
	log_error ("apdu: error initializing mutex: %s\n", gpg_strerror (err));
	return err;
	#endif /USE_NPTH/
	return 0;
	}
	diff --git a/scd/app-dinsig.c b/scd/app-dinsig.c
	index 3f99e2e5b..99e4f00db 100644
	--- a/scd/app-dinsig.c
	+++ b/scd/app-dinsig.c
	@@ -1,574 +1,574 @@
	/* app-dinsig.c - The DINSIG (DIN V 66291-1) card application.
	* Copyright (C) 2002, 2004, 2005, 2007, 2008 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/


	/* The German signature law and its bylaw (SigG and SigV) is currently
	used with an interface specification described in DIN V 66291-1.
	The AID to be used is: 'D27600006601'.

	The file IDs for certificates utilize the generic format:
	Cxyz
	C being the hex digit 'C' (12).
	x being the service indicator:
	'0' := SigG conform digital signature.
	'1' := entity authentication.
	'2' := key encipherment.
	'3' := data encipherment.
	'4' := key agreement.
	other values are reserved for future use.
	y being the security environment number using '0' for cards
	not supporting a SE number.
	z being the certificate type:
	'0' := C.CH (base certificate of card holder) or C.ICC.
	'1' .. '7' := C.CH (business or professional certificate
	of card holder.
	'8' .. 'D' := C.CA (certificate of a CA issue by the Root-CA).
	'E' := C.RCA (self certified certificate of the Root-CA).
	'F' := reserved.

	The file IDs used by default are:
	'1F00' EF.SSD (security service descriptor). [o,o]
	'2F02' EF.GDO (global data objects) [m,m]
	'A000' EF.PROT (signature log). Cyclic file with 20 records of 53 byte.
	Read and update after user authentication. [o,o]
	'B000' EF.PK.RCA.DS (public keys of Root-CA). Size is 512b or size
	of keys. [m (unless a 'C00E' is present),m]
	'B001' EF.PK.CA.DS (public keys of CAs). Size is 512b or size
	of keys. [o,o]
	'C00n' EF.C.CH.DS (digital signature certificate of card holder)
	with n := 0 .. 7. Size is 2k or size of cert. Read and
	update allowed after user authentication. [m,m]
	'C00m' EF.C.CA.DS (digital signature certificate of CA)
	with m := 8 .. E. Size is 1k or size of cert. Read always
	allowed, update after user authentication. [o,o]
	'C100' EF.C.ICC.AUT (AUT certificate of ICC) [o,m]
	'C108' EF.C.CA.AUT (AUT certificate of CA) [o,m]
	'D000' EF.DM (display message) [-,m]

	The letters in brackets indicate optional or mandatory files: The
	first for card terminals under full control and the second for
	"business" card terminals.
	*/




	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <time.h>

	#include "scdaemon.h"

	#include "i18n.h"
	#include "iso7816.h"
	#include "app-common.h"
	#include "tlv.h"


	static gpg_error_t
	do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
	{
	gpg_error_t err;
	char ct_buf[100], id_buf[100];
	char hexkeygrip[41];
	size_t len, certoff;
	unsigned char *der;
	size_t derlen;
	ksba_cert_t cert;
	int fid;

	(void)flags;

	/* Return the certificate of the card holder. */
	fid = 0xC000;
	len = app_help_read_length_of_cert (app->slot, fid, &certoff);
	if (!len)
	return 0; /* Card has not been personalized. */

	sprintf (ct_buf, "%d", 101);
	sprintf (id_buf, "DINSIG.%04X", fid);
	send_status_info (ctrl, "CERTINFO",
	ct_buf, strlen (ct_buf),
	id_buf, strlen (id_buf),
	NULL, (size_t)0);

	/* Now we need to read the certificate, so that we can get the
	public key out of it. */
	err = iso7816_read_binary (app->slot, certoff, len-certoff, &der, &derlen);
	if (err)
	{
	log_info ("error reading entire certificate from FID 0x%04X: %s\n",
	fid, gpg_strerror (err));
	return 0;
	}

	err = ksba_cert_new (&cert);
	if (err)
	{
	xfree (der);
	return err;
	}
	err = ksba_cert_init_from_mem (cert, der, derlen);
	xfree (der); der = NULL;
	if (err)
	{
	log_error ("failed to parse the certificate at FID 0x%04X: %s\n",
	fid, gpg_strerror (err));
	ksba_cert_release (cert);
	return err;
	}
	err = app_help_get_keygrip_string (cert, hexkeygrip);
	if (err)
	{
	log_error ("failed to calculate the keygrip for FID 0x%04X\n", fid);
	ksba_cert_release (cert);
	return gpg_error (GPG_ERR_CARD);
	}
	ksba_cert_release (cert);

	sprintf (id_buf, "DINSIG.%04X", fid);
	send_status_info (ctrl, "KEYPAIRINFO",
	hexkeygrip, 40,
	id_buf, strlen (id_buf),
	NULL, (size_t)0);
	return 0;
	}




	/* Read the certificate with id CERTID (as returned by learn_status in
	the CERTINFO status lines) and return it in the freshly allocated
	buffer put into CERT and the length of the certificate put into
	CERTLEN.

	FIXME: This needs some cleanups and caching with do_learn_status.
	*/
	static gpg_error_t
	do_readcert (app_t app, const char *certid,
	unsigned char *cert, size_t certlen)
	{
	int fid;
	gpg_error_t err;
	unsigned char *buffer;
	const unsigned char *p;
	size_t buflen, n;
	int class, tag, constructed, ndef;
	size_t totobjlen, objlen, hdrlen;
	int rootca = 0;

	*cert = NULL;
	*certlen = 0;
	if (strncmp (certid, "DINSIG.", 7) )
	return gpg_error (GPG_ERR_INV_ID);
	certid += 7;
	if (!hexdigitp (certid) \|\| !hexdigitp (certid+1)
	\|\| !hexdigitp (certid+2) \|\| !hexdigitp (certid+3)
	\|\| certid[4])
	return gpg_error (GPG_ERR_INV_ID);
	fid = xtoi_4 (certid);
	if (fid != 0xC000 )
	return gpg_error (GPG_ERR_NOT_FOUND);

	/* Read the entire file. fixme: This could be optimized by first
	reading the header to figure out how long the certificate
	actually is. */
	err = iso7816_select_file (app->slot, fid, 0, NULL, NULL);
	if (err)
	{
	log_error ("error selecting FID 0x%04X: %s\n", fid, gpg_strerror (err));
	return err;
	}

	err = iso7816_read_binary (app->slot, 0, 0, &buffer, &buflen);
	if (err)
	{
	log_error ("error reading certificate from FID 0x%04X: %s\n",
	fid, gpg_strerror (err));
	return err;
	}

	if (!buflen \|\| *buffer == 0xff)
	{
	log_info ("no certificate contained in FID 0x%04X\n", fid);
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave;
	}

	/* Now figure something out about the object. */
	p = buffer;
	n = buflen;
	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;
	if ( class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed )
	;
	else if ( class == CLASS_UNIVERSAL && tag == TAG_SET && constructed )
	rootca = 1;
	else
	return gpg_error (GPG_ERR_INV_OBJ);
	totobjlen = objlen + hdrlen;
	assert (totobjlen <= buflen);

	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;

	if (rootca)
	;
	else if (class == CLASS_UNIVERSAL && tag == TAG_OBJECT_ID && !constructed)
	{
	const unsigned char *save_p;

	/* The certificate seems to be contained in a userCertificate
	container. Skip this and assume the following sequence is
	the certificate. */
	if (n < objlen)
	{
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}
	p += objlen;
	n -= objlen;
	save_p = p;
	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;
	if ( !(class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed) )
	return gpg_error (GPG_ERR_INV_OBJ);
	totobjlen = objlen + hdrlen;
	assert (save_p + totobjlen <= buffer + buflen);
	memmove (buffer, save_p, totobjlen);
	}

	*cert = buffer;
	buffer = NULL;
	*certlen = totobjlen;

	leave:
	xfree (buffer);
	return err;
	}


	/* Verify the PIN if required. */
	static gpg_error_t
	verify_pin (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	const char *s;
	int rc;
	pininfo_t pininfo;

	if ( app->did_chv1 && !app->force_chv1 )
	return 0; /* No need to verify it again. */

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.fixedlen = -1;
	pininfo.minlen = 6;
	pininfo.maxlen = 8;

	if (!opt.disable_pinpad
	&& !iso7816_check_pinpad (app->slot, ISO7816_VERIFY, &pininfo) )
	{
	rc = pincb (pincb_arg,
	_("\|\|Please enter your PIN at the reader's pinpad"),
	NULL);
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}
	rc = iso7816_verify_kp (app->slot, 0x81, &pininfo);
	/* Dismiss the prompt. */
	pincb (pincb_arg, NULL, NULL);
	}
	else /* No Pinpad. */
	{
	char *pinvalue;

	rc = pincb (pincb_arg, "PIN", &pinvalue);
	if (rc)
	{
	log_info ("PIN callback returned error: %s\n", gpg_strerror (rc));
	return rc;
	}

	/* We require the PIN to be at least 6 and at max 8 bytes.
	According to the specs, this should all be ASCII. */
	for (s=pinvalue; digitp (s); s++)
	;
	if (*s)
	{
	log_error ("Non-numeric digits found in PIN\n");
	xfree (pinvalue);
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	if (strlen (pinvalue) < pininfo.minlen)
	{
	log_error ("PIN is too short; minimum length is %d\n",
	pininfo.minlen);
	xfree (pinvalue);
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	else if (strlen (pinvalue) > pininfo.maxlen)
	{
	log_error ("PIN is too large; maximum length is %d\n",
	pininfo.maxlen);
	xfree (pinvalue);
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	rc = iso7816_verify (app->slot, 0x81, pinvalue, strlen (pinvalue));
	if (gpg_err_code (rc) == GPG_ERR_INV_VALUE)
	{
	/* We assume that ISO 9564-1 encoding is used and we failed
	because the first nibble we passed was 3 and not 2. DIN
	says something about looking up such an encoding in the
	SSD but I was not able to find any tag relevant to
	this. */
	char paddedpin[8];
	int i, ndigits;

	for (ndigits=0, s=pinvalue; *s; ndigits++, s++)
	;
	i = 0;
	paddedpin[i++] = 0x20 \| (ndigits & 0x0f);
	for (s=pinvalue; i < sizeof paddedpin && *s && s[1]; s = s+2 )
	paddedpin[i++] = (((*s - '0') << 4) \| ((s[1] - '0') & 0x0f));
	if (i < sizeof paddedpin && *s)
	paddedpin[i++] = (((*s - '0') << 4) \| 0x0f);
	while (i < sizeof paddedpin)
	paddedpin[i++] = 0xff;
	rc = iso7816_verify (app->slot, 0x81, paddedpin, sizeof paddedpin);
	}
	xfree (pinvalue);
	}

	if (rc)
	{
	log_error ("verify PIN failed\n");
	return rc;
	}
	app->did_chv1 = 1;
	return 0;
	}



	/* Create the signature and return the allocated result in OUTDATA.
	If a PIN is required the PINCB will be used to ask for the PIN;
	that callback should return the PIN in an allocated buffer and
	store that in the 3rd argument. */
	static gpg_error_t
	do_sign (app_t app, const char *keyidstr, int hashalgo,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	static unsigned char sha1_prefix[15] = /* Object ID is 1.3.14.3.2.26 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
	0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
	0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char sha256_prefix[19] = /* OID is 2.16.840.1.101.3.4.2.1 */
	{ 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
	0x00, 0x04, 0x20 };
	int rc;
	int fid;
	unsigned char data[19+32]; /* Must be large enough for a SHA-256 digest
	+ the largest OID _prefix above. */
	int datalen;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);
	if (indatalen != 20 && indatalen != 16 && indatalen != 32
	&& indatalen != (15+20) && indatalen != (19+32))
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check that the provided ID is vaid. This is not really needed
	- but we do it to to enforce correct usage by the caller. */
	+ but we do it to enforce correct usage by the caller. */
	if (strncmp (keyidstr, "DINSIG.", 7) )
	return gpg_error (GPG_ERR_INV_ID);
	keyidstr += 7;
	if (!hexdigitp (keyidstr) \|\| !hexdigitp (keyidstr+1)
	\|\| !hexdigitp (keyidstr+2) \|\| !hexdigitp (keyidstr+3)
	\|\| keyidstr[4])
	return gpg_error (GPG_ERR_INV_ID);
	fid = xtoi_4 (keyidstr);
	if (fid != 0xC000)
	return gpg_error (GPG_ERR_NOT_FOUND);

	/* Prepare the DER object from INDATA. */
	datalen = 35;
	if (indatalen == 15+20)
	{
	/* Alright, the caller was so kind to send us an already
	prepared DER object. Check that it is what we want and that
	it matches the hash algorithm. */
	if (hashalgo == GCRY_MD_SHA1 && !memcmp (indata, sha1_prefix, 15))
	;
	else if (hashalgo == GCRY_MD_RMD160 && !memcmp (indata, rmd160_prefix,15))
	;
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	memcpy (data, indata, indatalen);
	}
	else if (indatalen == 19+32)
	{
	/* Alright, the caller was so kind to send us an already
	prepared DER object. Check that it is what we want and that
	it matches the hash algorithm. */
	datalen = indatalen;
	if (hashalgo == GCRY_MD_SHA256 && !memcmp (indata, sha256_prefix, 19))
	;
	else if (hashalgo == GCRY_MD_SHA1 && !memcmp (indata, sha256_prefix, 19))
	{
	/* Fixme: This is a kludge. A better solution is not to use
	SHA1 as default but use an autodetection. However this
	needs changes in all app-.c /
	hashalgo = GCRY_MD_SHA256;
	datalen = indatalen;
	}
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	memcpy (data, indata, indatalen);
	}
	else
	{
	int len = 15;
	if (hashalgo == GCRY_MD_SHA1)
	memcpy (data, sha1_prefix, len);
	else if (hashalgo == GCRY_MD_RMD160)
	memcpy (data, rmd160_prefix, len);
	else if (hashalgo == GCRY_MD_SHA256)
	{
	len = 19;
	datalen = len + indatalen;
	memcpy (data, sha256_prefix, len);
	}
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	memcpy (data+len, indata, indatalen);
	}

	rc = verify_pin (app, pincb, pincb_arg);
	if (!rc)
	rc = iso7816_compute_ds (app->slot, 0, data, datalen, 0,
	outdata, outdatalen);
	return rc;
	}


	#if 0
	#warning test function - works but may brick your card
	/* Handle the PASSWD command. CHVNOSTR is currently ignored; we
	always use VHV0. RESET_MODE is not yet implemented. */
	static gpg_error_t
	do_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr,
	unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;
	char *pinvalue;
	const char *oldpin;
	size_t oldpinlen;

	if ((flags & APP_CHANGE_FLAG_RESET))
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);

	if ((flags & APP_CHANGE_FLAG_NULLPIN))
	{
	/* With the nullpin flag, we do not verify the PIN - it would fail
	if the Nullpin is still set. */
	oldpin = "\0\0\0\0\0";
	oldpinlen = 6;
	}
	else
	{
	err = verify_pin (app, pincb, pincb_arg);
	if (err)
	return err;
	oldpin = NULL;
	oldpinlen = 0;
	}

	/* TRANSLATORS: Do not translate the "\|*\|" prefixes but
	keep it at the start of the string. We need this elsewhere
	to get some infos on the string. */
	err = pincb (pincb_arg, _("\|N\|Initial New PIN"), &pinvalue);
	if (err)
	{
	log_error (_("error getting new PIN: %s\n"), gpg_strerror (err));
	return err;
	}

	err = iso7816_change_reference_data (app->slot, 0x81,
	oldpin, oldpinlen,
	pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	return err;
	}
	#endif /0/


	/* Select the DINSIG application on the card in SLOT. This function
	must be used before any other DINSIG application functions. */
	gpg_error_t
	app_select_dinsig (app_t app)
	{
	static char const aid[] = { 0xD2, 0x76, 0x00, 0x00, 0x66, 0x01 };
	int slot = app->slot;
	int rc;

	rc = iso7816_select_application (slot, aid, sizeof aid, 0);
	if (!rc)
	{
	app->apptype = "DINSIG";

	app->fnc.learn_status = do_learn_status;
	app->fnc.readcert = do_readcert;
	app->fnc.getattr = NULL;
	app->fnc.setattr = NULL;
	app->fnc.genkey = NULL;
	app->fnc.sign = do_sign;
	app->fnc.auth = NULL;
	app->fnc.decipher = NULL;
	app->fnc.change_pin = NULL /do_change_pin/;
	app->fnc.check_pin = NULL;

	app->force_chv1 = 1;
	}

	return rc;
	}
	diff --git a/scd/app-geldkarte.c b/scd/app-geldkarte.c
	index e3c7dcc62..c2771719d 100644
	--- a/scd/app-geldkarte.c
	+++ b/scd/app-geldkarte.c
	@@ -1,409 +1,409 @@
	/* app-geldkarte.c - The German Geldkarte application
	* Copyright (C) 2004 g10 Code GmbH
	* Copyright (C) 2009 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/


	/* This is a read-only application to quickly dump information of a
	German Geldkarte (debit card for small amounts). We only support
	newer Geldkarte (with the AID DF_BOERSE_NEU) issued since 2000 or
	even earlier.
	*/


	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <time.h>
	#include <ctype.h>

	#include "scdaemon.h"

	#include "i18n.h"
	#include "iso7816.h"
	#include "app-common.h"
	#include "tlv.h"



	/* Object with application (i.e. Geldkarte) specific data. */
	struct app_local_s
	{
	char kblz[2+1+4+1];
	const char *banktype;
	char *cardno;
	char expires[7+1];
	char validfrom[10+1];
	char *country;
	char currency[3+1];
	unsigned int currency_mult100;
	unsigned char chipid;
	unsigned char osvers;
	int balance;
	int maxamount;
	int maxamount1;
	};




	/* Deconstructor. */
	static void
	do_deinit (app_t app)
	{
	if (app && app->app_local)
	{
	xfree (app->app_local->cardno);
	xfree (app->app_local->country);
	xfree (app->app_local);
	app->app_local = NULL;
	}
	}


	static gpg_error_t
	send_one_string (ctrl_t ctrl, const char name, const char string)
	{
	if (!name \|\| !string)
	return 0;
	send_status_info (ctrl, name, string, strlen (string), NULL, 0);
	return 0;
	}

	/* Implement the GETATTR command. This is similar to the LEARN
	command but returns just one value via the status interface. */
	static gpg_error_t
	do_getattr (app_t app, ctrl_t ctrl, const char *name)
	{
	gpg_error_t err;
	struct app_local_s *ld = app->app_local;
	char numbuf[100];

	if (!strcmp (name, "X-KBLZ"))
	err = send_one_string (ctrl, name, ld->kblz);
	else if (!strcmp (name, "X-BANKINFO"))
	err = send_one_string (ctrl, name, ld->banktype);
	else if (!strcmp (name, "X-CARDNO"))
	err = send_one_string (ctrl, name, ld->cardno);
	else if (!strcmp (name, "X-EXPIRES"))
	err = send_one_string (ctrl, name, ld->expires);
	else if (!strcmp (name, "X-VALIDFROM"))
	err = send_one_string (ctrl, name, ld->validfrom);
	else if (!strcmp (name, "X-COUNTRY"))
	err = send_one_string (ctrl, name, ld->country);
	else if (!strcmp (name, "X-CURRENCY"))
	err = send_one_string (ctrl, name, ld->currency);
	else if (!strcmp (name, "X-ZKACHIPID"))
	{
	snprintf (numbuf, sizeof numbuf, "0x%02X", ld->chipid);
	err = send_one_string (ctrl, name, numbuf);
	}
	else if (!strcmp (name, "X-OSVERSION"))
	{
	snprintf (numbuf, sizeof numbuf, "0x%02X", ld->osvers);
	err = send_one_string (ctrl, name, numbuf);
	}
	else if (!strcmp (name, "X-BALANCE"))
	{
	snprintf (numbuf, sizeof numbuf, "%.2f",
	(double)ld->balance / 100 * ld->currency_mult100);
	err = send_one_string (ctrl, name, numbuf);
	}
	else if (!strcmp (name, "X-MAXAMOUNT"))
	{
	snprintf (numbuf, sizeof numbuf, "%.2f",
	(double)ld->maxamount / 100 * ld->currency_mult100);
	err = send_one_string (ctrl, name, numbuf);
	}
	else if (!strcmp (name, "X-MAXAMOUNT1"))
	{
	snprintf (numbuf, sizeof numbuf, "%.2f",
	(double)ld->maxamount1 / 100 * ld->currency_mult100);
	err = send_one_string (ctrl, name, numbuf);
	}
	else
	err = gpg_error (GPG_ERR_INV_NAME);

	return err;
	}


	static gpg_error_t
	do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
	{
	static const char *names[] = {
	"X-KBLZ",
	"X-BANKINFO",
	"X-CARDNO",
	"X-EXPIRES",
	"X-VALIDFROM",
	"X-COUNTRY",
	"X-CURRENCY",
	"X-ZKACHIPID",
	"X-OSVERSION",
	"X-BALANCE",
	"X-MAXAMOUNT",
	"X-MAXAMOUNT1",
	NULL
	};
	gpg_error_t err = 0;
	int idx;

	(void)flags;

	for (idx=0; names[idx] && !err; idx++)
	err = do_getattr (app, ctrl, names[idx]);
	return err;
	}


	static char *
	copy_bcd (const unsigned char *string, size_t length)
	{
	const unsigned char *s;
	size_t n;
	size_t needed;
	char buffer, dst;

	if (!length)
	return xtrystrdup ("");

	/* Skip leading zeroes. */
	for (; length && !*string; length--, string++)
	;
	s = string;
	n = length;
	needed = 0;
	for (; n ; n--, s++)
	{
	if (!needed && !(*s & 0xf0))
	; /* Skip the leading zero in the first nibble. */
	else
	{
	if ( ((*s >> 4) & 0x0f) > 9 )
	{
	errno = EINVAL;
	return NULL;
	}
	needed++;
	}
	if ( n == 1 && (*s & 0x0f) > 9 )
	; /* Ignore the last digit if it has the sign. */
	else
	{
	needed++;
	if ( (*s & 0x0f) > 9 )
	{
	errno = EINVAL;
	return NULL;
	}
	}

	}
	if (!needed) /* If it is all zero, print a "0". */
	needed++;

	buffer = dst = xtrymalloc (needed+1);
	if (!buffer)
	return NULL;

	s = string;
	n = length;
	needed = 0;
	for (; n ; n--, s++)
	{
	if (!needed && !(*s & 0xf0))
	; /* Skip the leading zero in the first nibble. */
	else
	{
	dst++ = '0' + ((s >> 4) & 0x0f);
	needed++;
	}

	if ( n == 1 && (*s & 0x0f) > 9 )
	; /* Ignore the last digit if it has the sign. */
	else
	{
	dst++ = '0' + (s & 0x0f);
	needed++;
	}
	}
	if (!needed)
	*dst++ = '0';
	*dst = 0;

	return buffer;
	}


	/* Convert the BCD number at STING of LENGTH into an integer and store
	that at RESULT. Return 0 on success. */
	static gpg_error_t
	bcd_to_int (const unsigned char string, size_t length, int result)
	{
	char *tmp;

	tmp = copy_bcd (string, length);
	if (!tmp)
	return gpg_error (GPG_ERR_BAD_DATA);
	*result = strtol (tmp, NULL, 10);
	xfree (tmp);
	return 0;
	}


	/* Select the Geldkarte application. */
	gpg_error_t
	app_select_geldkarte (app_t app)
	{
	static char const aid[] =
	{ 0xD2, 0x76, 0x00, 0x00, 0x25, 0x45, 0x50, 0x02, 0x00 };
	gpg_error_t err;
	int slot = app->slot;
	unsigned char *result = NULL;
	size_t resultlen;
	struct app_local_s *ld;
	const char *banktype;

	err = iso7816_select_application (slot, aid, sizeof aid, 0);
	if (err)
	goto leave;

	/* Read the first record of EF_ID (SFI=0x17). We require this
	- record to be at least 24 bytes with the the first byte 0x67 and a
	+ record to be at least 24 bytes with the first byte 0x67 and a
	correct filler byte. */
	err = iso7816_read_record (slot, 1, 1, ((0x17 << 3)\|4), &result, &resultlen);
	if (err)
	goto leave; /* Oops - not a Geldkarte. */
	if (resultlen < 24 \|\| *result != 0x67 \|\| result[22])
	{
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave;
	}

	/* The short Bankleitzahl consists of 3 bytes at offset 1. */
	switch (result[1])
	{
	case 0x21: banktype = "Oeffentlich-rechtliche oder private Bank"; break;
	case 0x22: banktype = "Privat- oder Geschaeftsbank"; break;
	case 0x25: banktype = "Sparkasse"; break;
	case 0x26:
	case 0x29: banktype = "Genossenschaftsbank"; break;
	default:
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave; /* Probably not a Geldkarte. */
	}

	app->apptype = "GELDKARTE";
	app->fnc.deinit = do_deinit;

	/* If we don't have a serialno yet construct it from the EF_ID. */
	if (!app->serialno)
	{
	app->serialno = xtrymalloc (10);
	if (!app->serialno)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	memcpy (app->serialno, result, 10);
	app->serialnolen = 10;
	err = app_munge_serialno (app);
	if (err)
	goto leave;
	}


	app->app_local = ld = xtrycalloc (1, sizeof *app->app_local);
	if (!app->app_local)
	{
	err = gpg_err_code_from_syserror ();
	goto leave;
	}

	snprintf (ld->kblz, sizeof ld->kblz, "%02X-%02X%02X",
	result[1], result[2], result[3]);
	ld->banktype = banktype;
	ld->cardno = copy_bcd (result+4, 5);
	if (!ld->cardno)
	{
	err = gpg_err_code_from_syserror ();
	goto leave;
	}

	snprintf (ld->expires, sizeof ld->expires, "20%02X-%02X",
	result[10], result[11]);
	snprintf (ld->validfrom, sizeof ld->validfrom, "20%02X-%02X-%02X",
	result[12], result[13], result[14]);

	ld->country = copy_bcd (result+15, 2);
	if (!ld->country)
	{
	err = gpg_err_code_from_syserror ();
	goto leave;
	}

	snprintf (ld->currency, sizeof ld->currency, "%c%c%c",
	isascii (result[17])? result[17]:' ',
	isascii (result[18])? result[18]:' ',
	isascii (result[19])? result[19]:' ');

	ld->currency_mult100 = (result[20] == 0x01? 1:
	result[20] == 0x02? 10:
	result[20] == 0x04? 100:
	result[20] == 0x08? 1000:
	result[20] == 0x10? 10000:
	result[20] == 0x20? 100000:0);

	ld->chipid = result[21];
	ld->osvers = result[23];

	/* Read the first record of EF_BETRAG (SFI=0x18). */
	xfree (result);
	err = iso7816_read_record (slot, 1, 1, ((0x18 << 3)\|4), &result, &resultlen);
	if (err)
	goto leave; /* It does not make sense to continue. */
	if (resultlen < 12)
	{
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave;
	}
	err = bcd_to_int (result+0, 3, &ld->balance);
	if (!err)
	err = bcd_to_int (result+3, 3, &ld->maxamount);
	if (!err)
	err = bcd_to_int (result+6, 3, &ld->maxamount1);
	/* The next 3 bytes are the maximum amount chargable without using a
	MAC. This is usually 0. */
	if (err)
	goto leave;

	/* Setup the rest of the methods. */
	app->fnc.learn_status = do_learn_status;
	app->fnc.getattr = do_getattr;


	leave:
	xfree (result);
	if (err)
	do_deinit (app);
	return err;
	}
	diff --git a/scd/app-nks.c b/scd/app-nks.c
	index a6487c4b0..4442a100b 100644
	--- a/scd/app-nks.c
	+++ b/scd/app-nks.c
	@@ -1,1429 +1,1429 @@
	/* app-nks.c - The Telesec NKS card application.
	* Copyright (C) 2004, 2007, 2008, 2009 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* Notes:

	- We are now targeting TCOS 3 cards and it may happen that there is
	a regression towards TCOS 2 cards. Please report.

	- The TKS3 AUT key is not used. It seems that it is only useful for
	the internal authentication command and not accessible by other
	applications. The key itself is in the encryption class but the
	corresponding certificate has only the digitalSignature
	capability.

	- If required, we automagically switch between the NKS application
	and the SigG application. This avoids to use the DINSIG
	application which is somewhat limited, has no support for Secure
	Messaging as required by TCOS 3 and has no way to change the PIN
	or even set the NullPIN.

	- We use the prefix NKS-DF01 for TCOS 2 cards and NKS-NKS3 for newer
	cards. This is because the NKS application has moved to DF02 with
	TCOS 3 and thus we better use a DF independent tag.

	- We use only the global PINs for the NKS application.

	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <time.h>

	#include "scdaemon.h"
	#include "i18n.h"
	#include "iso7816.h"
	#include "app-common.h"
	#include "tlv.h"
	#include "apdu.h"
	#include "host2net.h"

	static char const aid_nks[] = { 0xD2, 0x76, 0x00, 0x00, 0x03, 0x01, 0x02 };
	static char const aid_sigg[] = { 0xD2, 0x76, 0x00, 0x00, 0x66, 0x01 };


	static struct
	{
	int is_sigg; /* Valid for SigG application. */
	int fid; /* File ID. */
	int nks_ver; /* 0 for NKS version 2, 3 for version 3. */
	int certtype; /* Type of certificate or 0 if it is not a certificate. */
	int iskeypair; /* If true has the FID of the corresponding certificate. */
	int issignkey; /* True if file is a key usable for signing. */
	int isenckey; /* True if file is a key usable for decryption. */
	unsigned char kid; /* Corresponding key references. */
	} filelist[] = {
	{ 0, 0x4531, 0, 0, 0xC000, 1, 0, 0x80 }, /* EF_PK.NKS.SIG */
	{ 0, 0xC000, 0, 101 }, /* EF_C.NKS.SIG */
	{ 0, 0x4331, 0, 100 },
	{ 0, 0x4332, 0, 100 },
	{ 0, 0xB000, 0, 110 }, /* EF_PK.RCA.NKS */
	{ 0, 0x45B1, 0, 0, 0xC200, 0, 1, 0x81 }, /* EF_PK.NKS.ENC */
	{ 0, 0xC200, 0, 101 }, /* EF_C.NKS.ENC */
	{ 0, 0x43B1, 0, 100 },
	{ 0, 0x43B2, 0, 100 },
	/* The authentication key is not used. */
	/* { 0, 0x4571, 3, 0, 0xC500, 0, 0, 0x82 }, /\* EF_PK.NKS.AUT \/ /
	/* { 0, 0xC500, 3, 101 }, /\* EF_C.NKS.AUT \/ /
	{ 0, 0x45B2, 3, 0, 0xC201, 0, 1, 0x83 }, /* EF_PK.NKS.ENC1024 */
	{ 0, 0xC201, 3, 101 }, /* EF_C.NKS.ENC1024 */
	{ 1, 0x4531, 3, 0, 0xC000, 1, 1, 0x84 }, /* EF_PK.CH.SIG */
	{ 1, 0xC000, 0, 101 }, /* EF_C.CH.SIG */
	{ 1, 0xC008, 3, 101 }, /* EF_C.CA.SIG */
	{ 1, 0xC00E, 3, 111 }, /* EF_C.RCA.SIG */
	{ 0, 0 }
	};



	/* Object with application (i.e. NKS) specific data. */
	struct app_local_s {
	int nks_version; /* NKS version. */

	int sigg_active; /* True if switched to the SigG application. */
	int sigg_msig_checked;/* True if we checked for a mass signature card. */
	int sigg_is_msig; /* True if this is a mass signature card. */

	int need_app_select; /* Need to re-select the application. */

	};



	static gpg_error_t switch_application (app_t app, int enable_sigg);



	/* Release local data. */
	static void
	do_deinit (app_t app)
	{
	if (app && app->app_local)
	{
	xfree (app->app_local);
	app->app_local = NULL;
	}
	}


	static int
	all_zero_p (void *buffer, size_t length)
	{
	char *p;

	for (p=buffer; length; length--, p++)
	if (*p)
	return 0;
	return 1;
	}


	/* Read the file with FID, assume it contains a public key and return
	its keygrip in the caller provided 41 byte buffer R_GRIPSTR. */
	static gpg_error_t
	keygripstr_from_pk_file (app_t app, int fid, char *r_gripstr)
	{
	gpg_error_t err;
	unsigned char grip[20];
	unsigned char *buffer[2];
	size_t buflen[2];
	gcry_sexp_t sexp;
	int i;
	int offset[2] = { 0, 0 };

	err = iso7816_select_file (app->slot, fid, 0, NULL, NULL);
	if (err)
	return err;
	err = iso7816_read_record (app->slot, 1, 1, 0, &buffer[0], &buflen[0]);
	if (err)
	return err;
	err = iso7816_read_record (app->slot, 2, 1, 0, &buffer[1], &buflen[1]);
	if (err)
	{
	xfree (buffer[0]);
	return err;
	}

	if (app->app_local->nks_version < 3)
	{
	/* Old versions of NKS store the values in a TLV encoded format.
	We need to do some checks. */
	for (i=0; i < 2; i++)
	{
	/* Check that the value appears like an integer encoded as
	Simple-TLV. We don't check the tag because the tests cards I
	have use 1 for both, the modulus and the exponent - the
	example in the documentation gives 2 for the exponent. */
	if (buflen[i] < 3)
	err = gpg_error (GPG_ERR_TOO_SHORT);
	else if (buffer[i][1] != buflen[i]-2 )
	err = gpg_error (GPG_ERR_INV_OBJ);
	else
	offset[i] = 2;
	}
	}
	else
	{
	/* Remove leading zeroes to get a correct keygrip. Take care of
	negative numbers. We should also fix it the same way in
	libgcrypt but we can't yet rely on it yet. */
	for (i=0; i < 2; i++)
	{
	while (buflen[i]-offset[i] > 1
	&& !buffer[i][offset[i]]
	&& !(buffer[i][offset[i]+1] & 0x80))
	offset[i]++;
	}
	}

	/* Check whether negative values are not prefixed with a zero and
	fix that. */
	for (i=0; i < 2; i++)
	{
	if ((buflen[i]-offset[i]) && (buffer[i][offset[i]] & 0x80))
	{
	unsigned char *newbuf;
	size_t newlen;

	newlen = 1 + buflen[i] - offset[i];
	newbuf = xtrymalloc (newlen);
	if (!newlen)
	{
	xfree (buffer[0]);
	xfree (buffer[1]);
	return gpg_error_from_syserror ();
	}
	newbuf[0] = 0;
	memcpy (newbuf+1, buffer[i]+offset[i], buflen[i] - offset[i]);
	xfree (buffer[i]);
	buffer[i] = newbuf;
	buflen[i] = newlen;
	offset[i] = 0;
	}
	}

	if (!err)
	err = gcry_sexp_build (&sexp, NULL,
	"(public-key (rsa (n %b) (e %b)))",
	(int)buflen[0]-offset[0], buffer[0]+offset[0],
	(int)buflen[1]-offset[1], buffer[1]+offset[1]);

	xfree (buffer[0]);
	xfree (buffer[1]);
	if (err)
	return err;

	if (!gcry_pk_get_keygrip (sexp, grip))
	{
	err = gpg_error (GPG_ERR_INTERNAL); /* i.e. RSA not supported by
	libgcrypt. */
	}
	else
	{
	bin2hex (grip, 20, r_gripstr);
	}
	gcry_sexp_release (sexp);
	return err;
	}


	/* TCOS responds to a verify with empty data (i.e. without the Lc
	byte) with the status of the PIN. PWID is the PIN ID, If SIGG is
	true, the application is switched into SigG mode.
	Returns:
	-1 = Error retrieving the data,
	-2 = No such PIN,
	-3 = PIN blocked,
	-4 = NullPIN activ,
	n >= 0 = Number of verification attempts left. */
	static int
	get_chv_status (app_t app, int sigg, int pwid)
	{
	unsigned char *result = NULL;
	size_t resultlen;
	char command[4];
	int rc;

	if (switch_application (app, sigg))
	return sigg? -2 : -1; /* No such PIN / General error. */

	command[0] = 0x00;
	command[1] = 0x20;
	command[2] = 0x00;
	command[3] = pwid;

	if (apdu_send_direct (app->slot, 0, (unsigned char *)command,
	4, 0, &result, &resultlen))
	rc = -1; /* Error. */
	else if (resultlen < 2)
	rc = -1; /* Error. */
	else
	{
	unsigned int sw = buf16_to_uint (result+resultlen-2);

	if (sw == 0x6a88)
	rc = -2; /* No such PIN. */
	else if (sw == 0x6983)
	rc = -3; /* PIN is blocked. */
	else if (sw == 0x6985)
	rc = -4; /* NullPIN is activ. */
	else if ((sw & 0xfff0) == 0x63C0)
	rc = (sw & 0x000f); /* PIN has N tries left. */
	else
	rc = -1; /* Other error. */
	}
	xfree (result);

	return rc;
	}


	/* Implement the GETATTR command. This is similar to the LEARN
	command but returns just one value via the status interface. */
	static gpg_error_t
	do_getattr (app_t app, ctrl_t ctrl, const char *name)
	{
	static struct {
	const char *name;
	int special;
	} table[] = {
	{ "$AUTHKEYID", 1 },
	{ "NKS-VERSION", 2 },
	{ "CHV-STATUS", 3 },
	{ NULL, 0 }
	};
	gpg_error_t err = 0;
	int idx;
	char buffer[100];

	err = switch_application (app, 0);
	if (err)
	return err;

	for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
	;
	if (!table[idx].name)
	return gpg_error (GPG_ERR_INV_NAME);

	switch (table[idx].special)
	{
	case 1: /* $AUTHKEYID */
	{
	/* NetKey 3.0 cards define an authentication key but according
	to the specs this key is only usable for encryption and not
	signing. it might work anyway but it has not yet been
	tested - fixme. Thus for now we use the NKS signature key
	for authentication. */
	char const tmp[] = "NKS-NKS3.4531";
	send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
	}
	break;

	case 2: /* NKS-VERSION */
	snprintf (buffer, sizeof buffer, "%d", app->app_local->nks_version);
	send_status_info (ctrl, table[idx].name,
	buffer, strlen (buffer), NULL, 0);
	break;

	case 3: /* CHV-STATUS */
	{
	/* Returns: PW1.CH PW2.CH PW1.CH.SIG PW2.CH.SIG That are the
	two global passwords followed by the two SigG passwords.
	For the values, see the function get_chv_status. */
	int tmp[4];

	/* We use a helper array so that we can control that there is
	no superfluous application switch. Note that PW2.CH.SIG
	really has the identifier 0x83 and not 0x82 as one would
	expect. */
	tmp[0] = get_chv_status (app, 0, 0x00);
	tmp[1] = get_chv_status (app, 0, 0x01);
	tmp[2] = get_chv_status (app, 1, 0x81);
	tmp[3] = get_chv_status (app, 1, 0x83);
	snprintf (buffer, sizeof buffer,
	"%d %d %d %d", tmp[0], tmp[1], tmp[2], tmp[3]);
	send_status_info (ctrl, table[idx].name,
	buffer, strlen (buffer), NULL, 0);
	}
	break;


	default:
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	break;
	}

	return err;
	}



	static void
	do_learn_status_core (app_t app, ctrl_t ctrl, unsigned int flags, int is_sigg)
	{
	gpg_error_t err;
	char ct_buf[100], id_buf[100];
	int i;
	const char *tag;

	if (is_sigg)
	tag = "SIGG";
	else if (app->app_local->nks_version < 3)
	tag = "DF01";
	else
	tag = "NKS3";

	/* Output information about all useful objects in the NKS application. */
	for (i=0; filelist[i].fid; i++)
	{
	if (filelist[i].nks_ver > app->app_local->nks_version)
	continue;

	if (!!filelist[i].is_sigg != !!is_sigg)
	continue;

	if (filelist[i].certtype && !(flags &1))
	{
	size_t len;

	len = app_help_read_length_of_cert (app->slot,
	filelist[i].fid, NULL);
	if (len)
	{
	/* FIXME: We should store the length in the application's
	context so that a following readcert does only need to
	read that many bytes. */
	snprintf (ct_buf, sizeof ct_buf, "%d", filelist[i].certtype);
	snprintf (id_buf, sizeof id_buf, "NKS-%s.%04X",
	tag, filelist[i].fid);
	send_status_info (ctrl, "CERTINFO",
	ct_buf, strlen (ct_buf),
	id_buf, strlen (id_buf),
	NULL, (size_t)0);
	}
	}
	else if (filelist[i].iskeypair)
	{
	char gripstr[40+1];

	err = keygripstr_from_pk_file (app, filelist[i].fid, gripstr);
	if (err)
	log_error ("can't get keygrip from FID 0x%04X: %s\n",
	filelist[i].fid, gpg_strerror (err));
	else
	{
	snprintf (id_buf, sizeof id_buf, "NKS-%s.%04X",
	tag, filelist[i].fid);
	send_status_info (ctrl, "KEYPAIRINFO",
	gripstr, 40,
	id_buf, strlen (id_buf),
	NULL, (size_t)0);
	}
	}
	}


	}


	static gpg_error_t
	do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
	{
	gpg_error_t err;

	err = switch_application (app, 0);
	if (err)
	return err;

	do_learn_status_core (app, ctrl, flags, 0);

	err = switch_application (app, 1);
	if (err)
	return 0; /* Silently ignore if we can't switch to SigG. */

	do_learn_status_core (app, ctrl, flags, 1);

	return 0;
	}




	/* Read the certificate with id CERTID (as returned by learn_status in
	the CERTINFO status lines) and return it in the freshly allocated
	buffer put into CERT and the length of the certificate put into
	CERTLEN. */
	static gpg_error_t
	do_readcert (app_t app, const char *certid,
	unsigned char *cert, size_t certlen)
	{
	int i, fid;
	gpg_error_t err;
	unsigned char *buffer;
	const unsigned char *p;
	size_t buflen, n;
	int class, tag, constructed, ndef;
	size_t totobjlen, objlen, hdrlen;
	int rootca = 0;
	int is_sigg = 0;

	*cert = NULL;
	*certlen = 0;

	if (!strncmp (certid, "NKS-NKS3.", 9))
	;
	else if (!strncmp (certid, "NKS-DF01.", 9))
	;
	else if (!strncmp (certid, "NKS-SIGG.", 9))
	is_sigg = 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	err = switch_application (app, is_sigg);
	if (err)
	return err;

	certid += 9;
	if (!hexdigitp (certid) \|\| !hexdigitp (certid+1)
	\|\| !hexdigitp (certid+2) \|\| !hexdigitp (certid+3)
	\|\| certid[4])
	return gpg_error (GPG_ERR_INV_ID);
	fid = xtoi_4 (certid);
	for (i=0; filelist[i].fid; i++)
	if ((filelist[i].certtype \|\| filelist[i].iskeypair)
	&& filelist[i].fid == fid)
	break;
	if (!filelist[i].fid)
	return gpg_error (GPG_ERR_NOT_FOUND);

	/* If the requested objects is a plain public key, redirect it to
	the corresponding certificate. The whole system is a bit messy
	because we sometime use the key directly or let the caller
	retrieve the key from the certificate. The rationale for
	that is to support not-yet stored certificates. */
	if (filelist[i].iskeypair)
	fid = filelist[i].iskeypair;


	/* Read the entire file. fixme: This could be optimized by first
	reading the header to figure out how long the certificate
	actually is. */
	err = iso7816_select_file (app->slot, fid, 0, NULL, NULL);
	if (err)
	{
	log_error ("error selecting FID 0x%04X: %s\n", fid, gpg_strerror (err));
	return err;
	}

	err = iso7816_read_binary (app->slot, 0, 0, &buffer, &buflen);
	if (err)
	{
	log_error ("error reading certificate from FID 0x%04X: %s\n",
	fid, gpg_strerror (err));
	return err;
	}

	if (!buflen \|\| *buffer == 0xff)
	{
	log_info ("no certificate contained in FID 0x%04X\n", fid);
	err = gpg_error (GPG_ERR_NOT_FOUND);
	goto leave;
	}

	/* Now figure something out about the object. */
	p = buffer;
	n = buflen;
	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;
	if ( class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed )
	;
	else if ( class == CLASS_UNIVERSAL && tag == TAG_SET && constructed )
	rootca = 1;
	else
	return gpg_error (GPG_ERR_INV_OBJ);
	totobjlen = objlen + hdrlen;
	assert (totobjlen <= buflen);

	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;

	if (rootca)
	;
	else if (class == CLASS_UNIVERSAL && tag == TAG_OBJECT_ID && !constructed)
	{
	const unsigned char *save_p;

	/* The certificate seems to be contained in a userCertificate
	container. Skip this and assume the following sequence is
	the certificate. */
	if (n < objlen)
	{
	err = gpg_error (GPG_ERR_INV_OBJ);
	goto leave;
	}
	p += objlen;
	n -= objlen;
	save_p = p;
	err = parse_ber_header (&p, &n, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (err)
	goto leave;
	if ( !(class == CLASS_UNIVERSAL && tag == TAG_SEQUENCE && constructed) )
	return gpg_error (GPG_ERR_INV_OBJ);
	totobjlen = objlen + hdrlen;
	assert (save_p + totobjlen <= buffer + buflen);
	memmove (buffer, save_p, totobjlen);
	}

	*cert = buffer;
	buffer = NULL;
	*certlen = totobjlen;

	leave:
	xfree (buffer);
	return err;
	}


	/* Handle the READKEY command. On success a canonical encoded
	S-expression with the public key will get stored at PK and its
	length at PKLEN; the caller must release that buffer. On error PK
	and PKLEN are not changed and an error code is returned. As of now
	this function is only useful for the internal authentication key.
	Other keys are automagically retrieved via by means of the
	certificate parsing code in commands.c:cmd_readkey. For internal
	use PK and PKLEN may be NULL to just check for an existing key. */
	static gpg_error_t
	do_readkey (app_t app, int advanced, const char *keyid,
	unsigned char *pk, size_t pklen)
	{
	gpg_error_t err;
	unsigned char *buffer[2];
	size_t buflen[2];
	unsigned short path[1] = { 0x4500 };

	if (advanced)
	return GPG_ERR_NOT_SUPPORTED;

	/* We use a generic name to retrieve PK.AUT.IFD-SPK. */
	if (!strcmp (keyid, "$IFDAUTHKEY") && app->app_local->nks_version >= 3)
	;
	else /* Return the error code expected by cmd_readkey. */
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	/* Access the KEYD file which is always in the master directory. */
	err = iso7816_select_path (app->slot, path, DIM (path), NULL, NULL);
	if (err)
	return err;
	/* Due to the above select we need to re-select our application. */
	app->app_local->need_app_select = 1;
	/* Get the two records. */
	err = iso7816_read_record (app->slot, 5, 1, 0, &buffer[0], &buflen[0]);
	if (err)
	return err;
	if (all_zero_p (buffer[0], buflen[0]))
	{
	xfree (buffer[0]);
	return gpg_error (GPG_ERR_NOT_FOUND);
	}
	err = iso7816_read_record (app->slot, 6, 1, 0, &buffer[1], &buflen[1]);
	if (err)
	{
	xfree (buffer[0]);
	return err;
	}

	if (pk && pklen)
	{
	*pk = make_canon_sexp_from_rsa_pk (buffer[0], buflen[0],
	buffer[1], buflen[1],
	pklen);
	if (!*pk)
	err = gpg_error_from_syserror ();
	}

	xfree (buffer[0]);
	xfree (buffer[1]);
	return err;
	}


	/* Handle the WRITEKEY command for NKS. This function expects a
	canonical encoded S-expression with the public key in KEYDATA and
	its length in KEYDATALEN. The only supported KEYID is
	"$IFDAUTHKEY" to store the terminal key on the card. Bit 0 of
	FLAGS indicates whether an existing key shall get overwritten.
	PINCB and PINCB_ARG are the usual arguments for the pinentry
	callback. */
	static gpg_error_t
	do_writekey (app_t app, ctrl_t ctrl,
	const char *keyid, unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *keydata, size_t keydatalen)
	{
	gpg_error_t err;
	int force = (flags & 1);
	const unsigned char *rsa_n = NULL;
	const unsigned char *rsa_e = NULL;
	size_t rsa_n_len, rsa_e_len;
	unsigned int nbits;

	(void)ctrl;
	(void)pincb;
	(void)pincb_arg;

	if (!strcmp (keyid, "$IFDAUTHKEY") && app->app_local->nks_version >= 3)
	;
	else
	return gpg_error (GPG_ERR_INV_ID);

	if (!force && !do_readkey (app, 0, keyid, NULL, NULL))
	return gpg_error (GPG_ERR_EEXIST);

	/* Parse the S-expression. */
	err = get_rsa_pk_from_canon_sexp (keydata, keydatalen,
	&rsa_n, &rsa_n_len, &rsa_e, &rsa_e_len);
	if (err)
	goto leave;

	/* Check that the parameters match the requirements. */
	nbits = app_help_count_bits (rsa_n, rsa_n_len);
	if (nbits != 1024)
	{
	log_error (_("RSA modulus missing or not of size %d bits\n"), 1024);
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	goto leave;
	}

	nbits = app_help_count_bits (rsa_e, rsa_e_len);
	if (nbits < 2 \|\| nbits > 32)
	{
	log_error (_("RSA public exponent missing or larger than %d bits\n"),
	32);
	err = gpg_error (GPG_ERR_BAD_PUBKEY);
	goto leave;
	}

	/* /\* Store them. \/ /
	/* err = verify_pin (app, 0, NULL, pincb, pincb_arg); */
	/* if (err) */
	/* goto leave; */

	/* Send the MSE:Store_Public_Key. */
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	/* mse = xtrymalloc (1000); */

	/* mse[0] = 0x80; /\* Algorithm reference. \/ /
	/* mse[1] = 1; */
	/* mse[2] = 0x17; */
	/* mse[3] = 0x84; /\* Private key reference. \/ /
	/* mse[4] = 1; */
	/* mse[5] = 0x77; */
	/* mse[6] = 0x7F; /\* Public key parameter. \/ /
	/* mse[7] = 0x49; */
	/* mse[8] = 0x81; */
	/* mse[9] = 3 + 0x80 + 2 + rsa_e_len; */
	/* mse[10] = 0x81; /\* RSA modulus of 128 byte. \/ /
	/* mse[11] = 0x81; */
	/* mse[12] = rsa_n_len; */
	/* memcpy (mse+12, rsa_n, rsa_n_len); */
	/* mse[10] = 0x82; /\* RSA public exponent of up to 4 bytes. \/ /
	/* mse[12] = rsa_e_len; */
	/* memcpy (mse+12, rsa_e, rsa_e_len); */
	/* err = iso7816_manage_security_env (app->slot, 0x81, 0xB6, */
	/* mse, sizeof mse); */

	leave:
	return err;
	}


	static gpg_error_t
	basic_pin_checks (const char *pinvalue, int minlen, int maxlen)
	{
	if (strlen (pinvalue) < minlen)
	{
	log_error ("PIN is too short; minimum length is %d\n", minlen);
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	if (strlen (pinvalue) > maxlen)
	{
	log_error ("PIN is too large; maximum length is %d\n", maxlen);
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	return 0;
	}


	/* Verify the PIN if required. */
	static gpg_error_t
	verify_pin (app_t app, int pwid, const char *desc,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	pininfo_t pininfo;
	int rc;

	if (!desc)
	desc = "PIN";

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.fixedlen = -1;
	pininfo.minlen = 6;
	pininfo.maxlen = 16;

	if (!opt.disable_pinpad
	&& !iso7816_check_pinpad (app->slot, ISO7816_VERIFY, &pininfo) )
	{
	rc = pincb (pincb_arg, desc, NULL);
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	rc = iso7816_verify_kp (app->slot, pwid, &pininfo);
	pincb (pincb_arg, NULL, NULL); /* Dismiss the prompt. */
	}
	else
	{
	char *pinvalue;

	rc = pincb (pincb_arg, desc, &pinvalue);
	if (rc)
	{
	log_info ("PIN callback returned error: %s\n", gpg_strerror (rc));
	return rc;
	}

	rc = basic_pin_checks (pinvalue, pininfo.minlen, pininfo.maxlen);
	if (rc)
	{
	xfree (pinvalue);
	return rc;
	}

	rc = iso7816_verify (app->slot, pwid, pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	}

	if (rc)
	{
	if ( gpg_err_code (rc) == GPG_ERR_USE_CONDITIONS )
	log_error (_("the NullPIN has not yet been changed\n"));
	else
	log_error ("verify PIN failed\n");
	return rc;
	}

	return 0;
	}


	/* Create the signature and return the allocated result in OUTDATA.
	If a PIN is required the PINCB will be used to ask for the PIN;
	that callback should return the PIN in an allocated buffer and
	store that in the 3rd argument. */
	static gpg_error_t
	do_sign (app_t app, const char *keyidstr, int hashalgo,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	static unsigned char sha1_prefix[15] = /* Object ID is 1.3.14.3.2.26 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
	0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
	0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
	int rc, i;
	int is_sigg = 0;
	int fid;
	unsigned char kid;
	unsigned char data[83]; /* Must be large enough for a SHA-1 digest
	+ the largest OID prefix. */
	size_t datalen;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);
	switch (indatalen)
	{
	case 16: case 20: case 35: case 47: case 51: case 67: case 83: break;
	default: return gpg_error (GPG_ERR_INV_VALUE);
	}

	/* Check that the provided ID is valid. This is not really needed
	but we do it to enforce correct usage by the caller. */
	if (!strncmp (keyidstr, "NKS-NKS3.", 9) )
	;
	else if (!strncmp (keyidstr, "NKS-DF01.", 9) )
	;
	else if (!strncmp (keyidstr, "NKS-SIGG.", 9) )
	is_sigg = 1;
	else
	return gpg_error (GPG_ERR_INV_ID);
	keyidstr += 9;

	rc = switch_application (app, is_sigg);
	if (rc)
	return rc;

	if (is_sigg && app->app_local->sigg_is_msig)
	{
	log_info ("mass signature cards are not allowed\n");
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	}

	if (!hexdigitp (keyidstr) \|\| !hexdigitp (keyidstr+1)
	\|\| !hexdigitp (keyidstr+2) \|\| !hexdigitp (keyidstr+3)
	\|\| keyidstr[4])
	return gpg_error (GPG_ERR_INV_ID);
	fid = xtoi_4 (keyidstr);
	for (i=0; filelist[i].fid; i++)
	if (filelist[i].iskeypair && filelist[i].fid == fid)
	break;
	if (!filelist[i].fid)
	return gpg_error (GPG_ERR_NOT_FOUND);
	if (!filelist[i].issignkey)
	return gpg_error (GPG_ERR_INV_ID);
	kid = filelist[i].kid;

	/* Prepare the DER object from INDATA. */
	if (app->app_local->nks_version > 2 && (indatalen == 35
	\|\| indatalen == 47
	\|\| indatalen == 51
	\|\| indatalen == 67
	\|\| indatalen == 83))
	{
	/* The caller send data matching the length of the ASN.1 encoded
	hash for SHA-{1,224,256,384,512}. Assume that is okay. */
	assert (indatalen <= sizeof data);
	memcpy (data, indata, indatalen);
	datalen = indatalen;
	}
	else if (indatalen == 35)
	{
	/* Alright, the caller was so kind to send us an already
	prepared DER object. This is for TCOS 2. */
	if (hashalgo == GCRY_MD_SHA1 && !memcmp (indata, sha1_prefix, 15))
	;
	else if (hashalgo == GCRY_MD_RMD160 && !memcmp (indata,rmd160_prefix,15))
	;
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	memcpy (data, indata, indatalen);
	datalen = 35;
	}
	else if (indatalen == 20)
	{
	if (hashalgo == GCRY_MD_SHA1)
	memcpy (data, sha1_prefix, 15);
	else if (hashalgo == GCRY_MD_RMD160)
	memcpy (data, rmd160_prefix, 15);
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	memcpy (data+15, indata, indatalen);
	datalen = 35;
	}
	else
	return gpg_error (GPG_ERR_INV_VALUE);


	/* Send an MSE for PSO:Computer_Signature. */
	if (app->app_local->nks_version > 2)
	{
	unsigned char mse[6];

	mse[0] = 0x80; /* Algorithm reference. */
	mse[1] = 1;
	mse[2] = 2; /* RSA, card does pkcs#1 v1.5 padding, no ASN.1 check. */
	mse[3] = 0x84; /* Private key reference. */
	mse[4] = 1;
	mse[5] = kid;
	rc = iso7816_manage_security_env (app->slot, 0x41, 0xB6,
	mse, sizeof mse);
	}
	/* Verify using PW1.CH. */
	if (!rc)
	rc = verify_pin (app, 0, NULL, pincb, pincb_arg);
	/* Compute the signature. */
	if (!rc)
	rc = iso7816_compute_ds (app->slot, 0, data, datalen, 0,
	outdata, outdatalen);
	return rc;
	}



	/* Decrypt the data in INDATA and return the allocated result in OUTDATA.
	If a PIN is required the PINCB will be used to ask for the PIN; it
	should return the PIN in an allocated buffer and put it into PIN. */
	static gpg_error_t
	do_decipher (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen,
	unsigned int *r_info)
	{
	int rc, i;
	int is_sigg = 0;
	int fid;
	int kid;

	(void)r_info;

	if (!keyidstr \|\| !*keyidstr \|\| !indatalen)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check that the provided ID is valid. This is not really needed
	- but we do it to to enforce correct usage by the caller. */
	+ but we do it to enforce correct usage by the caller. */
	if (!strncmp (keyidstr, "NKS-NKS3.", 9) )
	;
	else if (!strncmp (keyidstr, "NKS-DF01.", 9) )
	;
	else if (!strncmp (keyidstr, "NKS-SIGG.", 9) )
	is_sigg = 1;
	else
	return gpg_error (GPG_ERR_INV_ID);
	keyidstr += 9;

	rc = switch_application (app, is_sigg);
	if (rc)
	return rc;

	if (!hexdigitp (keyidstr) \|\| !hexdigitp (keyidstr+1)
	\|\| !hexdigitp (keyidstr+2) \|\| !hexdigitp (keyidstr+3)
	\|\| keyidstr[4])
	return gpg_error (GPG_ERR_INV_ID);
	fid = xtoi_4 (keyidstr);
	for (i=0; filelist[i].fid; i++)
	if (filelist[i].iskeypair && filelist[i].fid == fid)
	break;
	if (!filelist[i].fid)
	return gpg_error (GPG_ERR_NOT_FOUND);
	if (!filelist[i].isenckey)
	return gpg_error (GPG_ERR_INV_ID);
	kid = filelist[i].kid;

	if (app->app_local->nks_version > 2)
	{
	unsigned char mse[6];
	mse[0] = 0x80; /* Algorithm reference. */
	mse[1] = 1;
	mse[2] = 0x0a; /* RSA no padding. (0x1A is pkcs#1.5 padding.) */
	mse[3] = 0x84; /* Private key reference. */
	mse[4] = 1;
	mse[5] = kid;
	rc = iso7816_manage_security_env (app->slot, 0x41, 0xB8,
	mse, sizeof mse);
	}
	else
	{
	static const unsigned char mse[] =
	{
	0x80, 1, 0x10, /* Select algorithm RSA. */
	0x84, 1, 0x81 /* Select local secret key 1 for decryption. */
	};
	rc = iso7816_manage_security_env (app->slot, 0xC1, 0xB8,
	mse, sizeof mse);

	}

	if (!rc)
	rc = verify_pin (app, 0, NULL, pincb, pincb_arg);

	/* Note that we need to use extended length APDUs for TCOS 3 cards.
	Command chaining does not work. */
	if (!rc)
	rc = iso7816_decipher (app->slot, app->app_local->nks_version > 2? 1:0,
	indata, indatalen, 0, 0x81,
	outdata, outdatalen);
	return rc;
	}



	/* Parse a password ID string. Returns NULL on error or a string
	suitable as passphrase prompt on success. On success stores the
	reference value for the password at R_PWID and a flag indicating
	that the SigG application is to be used at R_SIGG. If NEW_MODE is
	true, the returned description is suitable for a new Password.
	Supported values for PWIDSTR are:

	PW1.CH - Global password 1
	PW2.CH - Global password 2
	PW1.CH.SIG - SigG password 1
	PW2.CH.SIG - SigG password 2
	*/
	static const char *
	parse_pwidstr (const char pwidstr, int new_mode, int r_sigg, int *r_pwid)
	{
	const char *desc;

	if (!pwidstr)
	desc = NULL;
	else if (!strcmp (pwidstr, "PW1.CH"))
	{
	*r_sigg = 0;
	*r_pwid = 0x00;
	/* TRANSLATORS: Do not translate the "\|*\|" prefixes but keep
	them verbatim at the start of the string. */
	desc = (new_mode
	? _("\|N\|Please enter a new PIN for the standard keys.")
	: _("\|\|Please enter the PIN for the standard keys."));
	}
	else if (!strcmp (pwidstr, "PW2.CH"))
	{
	*r_pwid = 0x01;
	desc = (new_mode
	? _("\|NP\|Please enter a new PIN Unblocking Code (PUK) "
	"for the standard keys.")
	: _("\|P\|Please enter the PIN Unblocking Code (PUK) "
	"for the standard keys."));
	}
	else if (!strcmp (pwidstr, "PW1.CH.SIG"))
	{
	*r_pwid = 0x81;
	*r_sigg = 1;
	desc = (new_mode
	? _("\|N\|Please enter a new PIN for the key to create "
	"qualified signatures.")
	: _("\|\|Please enter the PIN for the key to create "
	"qualified signatures."));
	}
	else if (!strcmp (pwidstr, "PW2.CH.SIG"))
	{
	r_pwid = 0x83; / Yes, that is 83 and not 82. */
	*r_sigg = 1;
	desc = (new_mode
	? _("\|NP\|Please enter a new PIN Unblocking Code (PUK) "
	"for the key to create qualified signatures.")
	: _("\|P\|Please enter the PIN Unblocking Code (PUK) "
	"for the key to create qualified signatures."));
	}
	else
	{
	r_pwid = 0; / Only to avoid gcc warning in calling function. */
	desc = NULL; /* Error. */
	}

	return desc;
	}


	/* Handle the PASSWD command. See parse_pwidstr() for allowed values
	for CHVNOSTR. */
	static gpg_error_t
	do_change_pin (app_t app, ctrl_t ctrl, const char *pwidstr,
	unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;
	char *newpin = NULL;
	char *oldpin = NULL;
	size_t newpinlen;
	size_t oldpinlen;
	int is_sigg;
	const char *newdesc;
	int pwid;
	pininfo_t pininfo;

	(void)ctrl;

	/* The minimum length is enforced by TCOS, the maximum length is
	just a reasonable value. */
	memset (&pininfo, 0, sizeof pininfo);
	pininfo.minlen = 6;
	pininfo.maxlen = 16;

	newdesc = parse_pwidstr (pwidstr, 1, &is_sigg, &pwid);
	if (!newdesc)
	return gpg_error (GPG_ERR_INV_ID);

	err = switch_application (app, is_sigg);
	if (err)
	return err;

	if ((flags & APP_CHANGE_FLAG_NULLPIN))
	{
	/* With the nullpin flag, we do not verify the PIN - it would
	fail if the Nullpin is still set. */
	oldpin = xtrycalloc (1, 6);
	if (!oldpin)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	oldpinlen = 6;
	}
	else
	{
	const char *desc;
	int dummy1, dummy2;

	if ((flags & APP_CHANGE_FLAG_RESET))
	{
	/* Reset mode: Ask for the alternate PIN. */
	const char *altpwidstr;

	if (!strcmp (pwidstr, "PW1.CH"))
	altpwidstr = "PW2.CH";
	else if (!strcmp (pwidstr, "PW2.CH"))
	altpwidstr = "PW1.CH";
	else if (!strcmp (pwidstr, "PW1.CH.SIG"))
	altpwidstr = "PW2.CH.SIG";
	else if (!strcmp (pwidstr, "PW2.CH.SIG"))
	altpwidstr = "PW1.CH.SIG";
	else
	{
	err = gpg_error (GPG_ERR_BUG);
	goto leave;
	}
	desc = parse_pwidstr (altpwidstr, 0, &dummy1, &dummy2);
	}
	else
	{
	/* Regular change mode: Ask for the old PIN. */
	desc = parse_pwidstr (pwidstr, 0, &dummy1, &dummy2);
	}
	err = pincb (pincb_arg, desc, &oldpin);
	if (err)
	{
	log_error ("error getting old PIN: %s\n", gpg_strerror (err));
	goto leave;
	}
	oldpinlen = strlen (oldpin);
	err = basic_pin_checks (oldpin, pininfo.minlen, pininfo.maxlen);
	if (err)
	goto leave;
	}

	err = pincb (pincb_arg, newdesc, &newpin);
	if (err)
	{
	log_error (_("error getting new PIN: %s\n"), gpg_strerror (err));
	goto leave;
	}
	newpinlen = strlen (newpin);

	err = basic_pin_checks (newpin, pininfo.minlen, pininfo.maxlen);
	if (err)
	goto leave;

	if ((flags & APP_CHANGE_FLAG_RESET))
	{
	char *data;
	size_t datalen = oldpinlen + newpinlen;

	data = xtrymalloc (datalen);
	if (!data)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	memcpy (data, oldpin, oldpinlen);
	memcpy (data+oldpinlen, newpin, newpinlen);
	err = iso7816_reset_retry_counter_with_rc (app->slot, pwid,
	data, datalen);
	wipememory (data, datalen);
	xfree (data);
	}
	else
	err = iso7816_change_reference_data (app->slot, pwid,
	oldpin, oldpinlen,
	newpin, newpinlen);
	leave:
	xfree (oldpin);
	xfree (newpin);
	return err;
	}


	/* Perform a simple verify operation. KEYIDSTR should be NULL or empty. */
	static gpg_error_t
	do_check_pin (app_t app, const char *pwidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;
	int pwid;
	int is_sigg;
	const char *desc;

	desc = parse_pwidstr (pwidstr, 0, &is_sigg, &pwid);
	if (!desc)
	return gpg_error (GPG_ERR_INV_ID);

	err = switch_application (app, is_sigg);
	if (err)
	return err;

	return verify_pin (app, pwid, desc, pincb, pincb_arg);
	}


	/* Return the version of the NKS application. */
	static int
	get_nks_version (int slot)
	{
	unsigned char *result = NULL;
	size_t resultlen;
	int type;

	if (iso7816_apdu_direct (slot, "\x80\xaa\x06\x00\x00", 5, 0,
	&result, &resultlen))
	return 2; /* NKS 2 does not support this command. */

	/* Example value: 04 11 19 22 21 6A 20 80 03 03 01 01 01 00 00 00
	vv tt ccccccccccccccccc aa bb cc vvvvvvvvvvv xx
	vendor (Philips) -+ \| \| \| \| \| \| \|
	chip type -----------+ \| \| \| \| \| \|
	chip id ----------------+ \| \| \| \| \|
	card type (3 - tcos 3) -------------------+ \| \| \| \|
	OS version of card type ---------------------+ \| \| \|
	OS release of card type ------------------------+ \| \|
	OS vendor internal version ------------------------+ \|
	RFU -----------------------------------------------------------+
	*/
	if (resultlen < 16)
	type = 0; /* Invalid data returned. */
	else
	type = result[8];
	xfree (result);

	return type;
	}


	/* If ENABLE_SIGG is true switch to the SigG application if not yet
	active. If false switch to the NKS application if not yet active.
	Returns 0 on success. */
	static gpg_error_t
	switch_application (app_t app, int enable_sigg)
	{
	gpg_error_t err;

	if (((app->app_local->sigg_active && enable_sigg)
	\|\| (!app->app_local->sigg_active && !enable_sigg))
	&& !app->app_local->need_app_select)
	return 0; /* Already switched. */

	log_info ("app-nks: switching to %s\n", enable_sigg? "SigG":"NKS");
	if (enable_sigg)
	err = iso7816_select_application (app->slot, aid_sigg, sizeof aid_sigg, 0);
	else
	err = iso7816_select_application (app->slot, aid_nks, sizeof aid_nks, 0);

	if (!err && enable_sigg && app->app_local->nks_version >= 3
	&& !app->app_local->sigg_msig_checked)
	{
	/* Check whether this card is a mass signature card. */
	unsigned char *buffer;
	size_t buflen;
	const unsigned char *tmpl;
	size_t tmpllen;

	app->app_local->sigg_msig_checked = 1;
	app->app_local->sigg_is_msig = 1;
	err = iso7816_select_file (app->slot, 0x5349, 0, NULL, NULL);
	if (!err)
	err = iso7816_read_record (app->slot, 1, 1, 0, &buffer, &buflen);
	if (!err)
	{
	tmpl = find_tlv (buffer, buflen, 0x7a, &tmpllen);
	if (tmpl && tmpllen == 12
	&& !memcmp (tmpl,
	"\x93\x02\x00\x01\xA4\x06\x83\x01\x81\x83\x01\x83",
	12))
	app->app_local->sigg_is_msig = 0;
	xfree (buffer);
	}
	if (app->app_local->sigg_is_msig)
	log_info ("This is a mass signature card\n");
	}

	if (!err)
	{
	app->app_local->need_app_select = 0;
	app->app_local->sigg_active = enable_sigg;
	}
	else
	log_error ("app-nks: error switching to %s: %s\n",
	enable_sigg? "SigG":"NKS", gpg_strerror (err));

	return err;
	}


	/* Select the NKS application. */
	gpg_error_t
	app_select_nks (app_t app)
	{
	int slot = app->slot;
	int rc;

	rc = iso7816_select_application (slot, aid_nks, sizeof aid_nks, 0);
	if (!rc)
	{
	app->apptype = "NKS";

	app->app_local = xtrycalloc (1, sizeof *app->app_local);
	if (!app->app_local)
	{
	rc = gpg_error (gpg_err_code_from_errno (errno));
	goto leave;
	}

	app->app_local->nks_version = get_nks_version (slot);
	if (opt.verbose)
	log_info ("Detected NKS version: %d\n", app->app_local->nks_version);

	app->fnc.deinit = do_deinit;
	app->fnc.learn_status = do_learn_status;
	app->fnc.readcert = do_readcert;
	app->fnc.readkey = do_readkey;
	app->fnc.getattr = do_getattr;
	app->fnc.setattr = NULL;
	app->fnc.writekey = do_writekey;
	app->fnc.genkey = NULL;
	app->fnc.sign = do_sign;
	app->fnc.auth = NULL;
	app->fnc.decipher = do_decipher;
	app->fnc.change_pin = do_change_pin;
	app->fnc.check_pin = do_check_pin;
	}

	leave:
	if (rc)
	do_deinit (app);
	return rc;
	}
	diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
	index 71c9e1b83..608e3ccbc 100644
	--- a/scd/app-openpgp.c
	+++ b/scd/app-openpgp.c
	@@ -1,4952 +1,4952 @@
	/* app-openpgp.c - The OpenPGP card application.
	* Copyright (C) 2003, 2004, 2005, 2007, 2008,
	* 2009, 2013, 2014, 2015 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* Some notes:

	CHV means Card Holder Verification and is nothing else than a PIN
	or password. That term seems to have been used originally with GSM
	cards. Version v2 of the specs changes the term to the clearer
	term PW for password. We use the terms here interchangeable
	because we do not want to change existing strings i18n wise.

	Version 2 of the specs also drops the separate PW2 which was
	required in v1 due to ISO requirements. It is now possible to have
	one physical PW but two reference to it so that they can be
	individually be verified (e.g. to implement a forced verification
	for one key). Thus you will noticed the use of PW2 with the verify
	command but not with change_reference_data because the latter
	operates directly on the physical PW.

	The Reset Code (RC) as implemented by v2 cards uses the same error
	counter as the PW2 of v1 cards. By default no RC is set and thus
	that error counter is set to 0. After setting the RC the error
	counter will be initialized to 3.

	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdarg.h>
	#include <string.h>
	#include <assert.h>
	#include <time.h>

	#if GNUPG_MAJOR_VERSION == 1
	/* This is used with GnuPG version < 1.9. The code has been source
	copied from the current GnuPG >= 1.9 and is maintained over
	there. */
	#include "options.h"
	#include "errors.h"
	#include "memory.h"
	#include "cardglue.h"
	#else /* GNUPG_MAJOR_VERSION != 1 */
	#include "scdaemon.h"
	#endif /* GNUPG_MAJOR_VERSION != 1 */

	#include "util.h"
	#include "i18n.h"
	#include "iso7816.h"
	#include "app-common.h"
	#include "tlv.h"
	#include "host2net.h"
	#include "openpgpdefs.h"


	/* A table describing the DOs of the card. */
	static struct {
	int tag;
	int constructed;
	int get_from; /* Constructed DO with this DO or 0 for direct access. */
	int binary:1;
	int dont_cache:1;
	int flush_on_error:1;
	int get_immediate_in_v11:1; /* Enable a hack to bypass the cache of
	this data object if it is used in 1.1
	and later versions of the card. This
	does not work with composite DO and
	is currently only useful for the CHV
	status bytes. */
	int try_extlen:1; /* Large object; try to use an extended
	length APDU. */
	char *desc;
	} data_objects[] = {
	{ 0x005E, 0, 0, 1, 0, 0, 0, 0, "Login Data" },
	{ 0x5F50, 0, 0, 0, 0, 0, 0, 0, "URL" },
	{ 0x5F52, 0, 0, 1, 0, 0, 0, 0, "Historical Bytes" },
	{ 0x0065, 1, 0, 1, 0, 0, 0, 0, "Cardholder Related Data"},
	{ 0x005B, 0, 0x65, 0, 0, 0, 0, 0, "Name" },
	{ 0x5F2D, 0, 0x65, 0, 0, 0, 0, 0, "Language preferences" },
	{ 0x5F35, 0, 0x65, 0, 0, 0, 0, 0, "Sex" },
	{ 0x006E, 1, 0, 1, 0, 0, 0, 0, "Application Related Data" },
	{ 0x004F, 0, 0x6E, 1, 0, 0, 0, 0, "AID" },
	{ 0x0073, 1, 0, 1, 0, 0, 0, 0, "Discretionary Data Objects" },
	{ 0x0047, 0, 0x6E, 1, 1, 0, 0, 0, "Card Capabilities" },
	{ 0x00C0, 0, 0x6E, 1, 1, 0, 0, 0, "Extended Card Capabilities" },
	{ 0x00C1, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Signature" },
	{ 0x00C2, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Decryption" },
	{ 0x00C3, 0, 0x6E, 1, 1, 0, 0, 0, "Algorithm Attributes Authentication" },
	{ 0x00C4, 0, 0x6E, 1, 0, 1, 1, 0, "CHV Status Bytes" },
	{ 0x00C5, 0, 0x6E, 1, 0, 0, 0, 0, "Fingerprints" },
	{ 0x00C6, 0, 0x6E, 1, 0, 0, 0, 0, "CA Fingerprints" },
	{ 0x00CD, 0, 0x6E, 1, 0, 0, 0, 0, "Generation time" },
	{ 0x007A, 1, 0, 1, 0, 0, 0, 0, "Security Support Template" },
	{ 0x0093, 0, 0x7A, 1, 1, 0, 0, 0, "Digital Signature Counter" },
	{ 0x0101, 0, 0, 0, 0, 0, 0, 0, "Private DO 1"},
	{ 0x0102, 0, 0, 0, 0, 0, 0, 0, "Private DO 2"},
	{ 0x0103, 0, 0, 0, 0, 0, 0, 0, "Private DO 3"},
	{ 0x0104, 0, 0, 0, 0, 0, 0, 0, "Private DO 4"},
	{ 0x7F21, 1, 0, 1, 0, 0, 0, 1, "Cardholder certificate"},
	/* V3.0 */
	{ 0x7F74, 0, 0, 1, 0, 0, 0, 0, "General Feature Management"},
	{ 0x00D5, 0, 0, 1, 0, 0, 0, 0, "AES key data"},
	{ 0 }
	};


	/* Type of keys. */
	typedef enum
	{
	KEY_TYPE_ECC,
	KEY_TYPE_RSA,
	}
	key_type_t;


	/* The format of RSA private keys. */
	typedef enum
	{
	RSA_UNKNOWN_FMT,
	RSA_STD,
	RSA_STD_N,
	RSA_CRT,
	RSA_CRT_N
	}
	rsa_key_format_t;


	/* One cache item for DOs. */
	struct cache_s {
	struct cache_s *next;
	int tag;
	size_t length;
	unsigned char data[1];
	};


	/* Object with application (i.e. OpenPGP card) specific data. */
	struct app_local_s {
	/* A linked list with cached DOs. */
	struct cache_s *cache;

	/* Keep track of the public keys. */
	struct
	{
	int read_done; /* True if we have at least tried to read them. */
	unsigned char key; / This is a malloced buffer with a canonical
	encoded S-expression encoding a public
	key. Might be NULL if key is not
	available. */
	size_t keylen; /* The length of the above S-expression. This
	is usually only required for cross checks
	because the length of an S-expression is
	implicitly available. */
	} pk[3];

	unsigned char status_indicator; /* The card status indicator. */

	unsigned int manufacturer:16; /* Manufacturer ID from the s/n. */

	/* Keep track of the ISO card capabilities. */
	struct
	{
	unsigned int cmd_chaining:1; /* Command chaining is supported. */
	unsigned int ext_lc_le:1; /* Extended Lc and Le are supported. */
	} cardcap;

	/* Keep track of extended card capabilities. */
	struct
	{
	unsigned int is_v2:1; /* This is a v2.0 compatible card. */
	unsigned int sm_supported:1; /* Secure Messaging is supported. */
	unsigned int get_challenge:1;
	unsigned int key_import:1;
	unsigned int change_force_chv:1;
	unsigned int private_dos:1;
	unsigned int algo_attr_change:1; /* Algorithm attributes changeable. */
	unsigned int has_decrypt:1; /* Support symmetric decryption. */
	unsigned int has_button:1;
	unsigned int sm_algo:2; /* Symmetric crypto algo for SM. */
	unsigned int max_certlen_3:16;
	unsigned int max_get_challenge:16; /* Maximum size for get_challenge. */
	} extcap;

	/* Flags used to control the application. */
	struct
	{
	unsigned int no_sync:1; /* Do not sync CHV1 and CHV2 */
	unsigned int def_chv2:1; /* Use 123456 for CHV2. */
	} flags;

	/* Pinpad request specified on card. */
	struct
	{
	unsigned int specified:1;
	int fixedlen_user;
	int fixedlen_admin;
	} pinpad;

	struct
	{
	key_type_t key_type;
	union {
	struct {
	unsigned int n_bits; /* Size of the modulus in bits. The rest
	of this strucuire is only valid if
	this is not 0. */
	unsigned int e_bits; /* Size of the public exponent in bits. */
	rsa_key_format_t format;
	} rsa;
	struct {
	const char *curve;
	int flags;
	} ecc;
	};
	} keyattr[3];
	};

	#define ECC_FLAG_DJB_TWEAK (1 << 0)
	#define ECC_FLAG_PUBKEY (1 << 1)


	/*** Local prototypes ***/
	static unsigned long convert_sig_counter_value (const unsigned char *value,
	size_t valuelen);
	static unsigned long get_sig_counter (app_t app);
	static gpg_error_t do_auth (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen);
	static void parse_algorithm_attribute (app_t app, int keyno);
	static gpg_error_t change_keyattr_from_string
	(app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *value, size_t valuelen);





	/* Deconstructor. */
	static void
	do_deinit (app_t app)
	{
	if (app && app->app_local)
	{
	struct cache_s c, c2;
	int i;

	for (c = app->app_local->cache; c; c = c2)
	{
	c2 = c->next;
	xfree (c);
	}

	for (i=0; i < DIM (app->app_local->pk); i++)
	{
	xfree (app->app_local->pk[i].key);
	app->app_local->pk[i].read_done = 0;
	}
	xfree (app->app_local);
	app->app_local = NULL;
	}
	}


	/* Wrapper around iso7816_get_data which first tries to get the data
	from the cache. With GET_IMMEDIATE passed as true, the cache is
	bypassed. With TRY_EXTLEN extended lengths APDUs are use if
	supported by the card. */
	static gpg_error_t
	get_cached_data (app_t app, int tag,
	unsigned char *result, size_t resultlen,
	int get_immediate, int try_extlen)
	{
	gpg_error_t err;
	int i;
	unsigned char *p;
	size_t len;
	struct cache_s *c;
	int exmode;

	*result = NULL;
	*resultlen = 0;

	if (!get_immediate)
	{
	for (c=app->app_local->cache; c; c = c->next)
	if (c->tag == tag)
	{
	if(c->length)
	{
	p = xtrymalloc (c->length);
	if (!p)
	return gpg_error (gpg_err_code_from_errno (errno));
	memcpy (p, c->data, c->length);
	*result = p;
	}

	*resultlen = c->length;

	return 0;
	}
	}

	if (try_extlen && app->app_local->cardcap.ext_lc_le)
	exmode = app->app_local->extcap.max_certlen_3;
	else
	exmode = 0;

	err = iso7816_get_data (app->slot, exmode, tag, &p, &len);
	if (err)
	return err;
	*result = p;
	*resultlen = len;

	/* Check whether we should cache this object. */
	if (get_immediate)
	return 0;

	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].tag == tag)
	{
	if (data_objects[i].dont_cache)
	return 0;
	break;
	}

	/* Okay, cache it. */
	for (c=app->app_local->cache; c; c = c->next)
	assert (c->tag != tag);

	c = xtrymalloc (sizeof *c + len);
	if (c)
	{
	memcpy (c->data, p, len);
	c->length = len;
	c->tag = tag;
	c->next = app->app_local->cache;
	app->app_local->cache = c;
	}

	return 0;
	}

	/* Remove DO at TAG from the cache. */
	static void
	flush_cache_item (app_t app, int tag)
	{
	struct cache_s c, cprev;
	int i;

	if (!app->app_local)
	return;

	for (c=app->app_local->cache, cprev=NULL; c ; cprev=c, c = c->next)
	if (c->tag == tag)
	{
	if (cprev)
	cprev->next = c->next;
	else
	app->app_local->cache = c->next;
	xfree (c);

	for (c=app->app_local->cache; c ; c = c->next)
	{
	assert (c->tag != tag); /* Oops: duplicated entry. */
	}
	return;
	}

	/* Try again if we have an outer tag. */
	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].tag == tag && data_objects[i].get_from
	&& data_objects[i].get_from != tag)
	flush_cache_item (app, data_objects[i].get_from);
	}

	/* Flush all entries from the cache which might be out of sync after
	an error. */
	static void
	flush_cache_after_error (app_t app)
	{
	int i;

	for (i=0; data_objects[i].tag; i++)
	if (data_objects[i].flush_on_error)
	flush_cache_item (app, data_objects[i].tag);
	}


	/* Flush the entire cache. */
	static void
	flush_cache (app_t app)
	{
	if (app && app->app_local)
	{
	struct cache_s c, c2;

	for (c = app->app_local->cache; c; c = c2)
	{
	c2 = c->next;
	xfree (c);
	}
	app->app_local->cache = NULL;
	}
	}


	/* Get the DO identified by TAG from the card in SLOT and return a
	buffer with its content in RESULT and NBYTES. The return value is
	NULL if not found or a pointer which must be used to release the
	buffer holding value. */
	static void *
	get_one_do (app_t app, int tag, unsigned char *result, size_t nbytes,
	int *r_rc)
	{
	int rc, i;
	unsigned char *buffer;
	size_t buflen;
	unsigned char *value;
	size_t valuelen;
	int dummyrc;
	int exmode;

	if (!r_rc)
	r_rc = &dummyrc;

	*result = NULL;
	*nbytes = 0;
	*r_rc = 0;
	for (i=0; data_objects[i].tag && data_objects[i].tag != tag; i++)
	;

	if (app->card_version > 0x0100 && data_objects[i].get_immediate_in_v11)
	{
	exmode = 0;
	rc = iso7816_get_data (app->slot, exmode, tag, &buffer, &buflen);
	if (rc)
	{
	*r_rc = rc;
	return NULL;
	}
	*result = buffer;
	*nbytes = buflen;
	return buffer;
	}

	value = NULL;
	rc = -1;
	if (data_objects[i].tag && data_objects[i].get_from)
	{
	rc = get_cached_data (app, data_objects[i].get_from,
	&buffer, &buflen,
	(data_objects[i].dont_cache
	\|\| data_objects[i].get_immediate_in_v11),
	data_objects[i].try_extlen);
	if (!rc)
	{
	const unsigned char *s;

	s = find_tlv_unchecked (buffer, buflen, tag, &valuelen);
	if (!s)
	value = NULL; /* not found */
	else if (valuelen > buflen - (s - buffer))
	{
	log_error ("warning: constructed DO too short\n");
	value = NULL;
	xfree (buffer); buffer = NULL;
	}
	else
	value = buffer + (s - buffer);
	}
	}

	if (!value) /* Not in a constructed DO, try simple. */
	{
	rc = get_cached_data (app, tag, &buffer, &buflen,
	(data_objects[i].dont_cache
	\|\| data_objects[i].get_immediate_in_v11),
	data_objects[i].try_extlen);
	if (!rc)
	{
	value = buffer;
	valuelen = buflen;
	}
	}

	if (!rc)
	{
	*nbytes = valuelen;
	*result = value;
	return buffer;
	}
	*r_rc = rc;
	return NULL;
	}


	static void
	dump_all_do (int slot)
	{
	int rc, i, j;
	unsigned char *buffer;
	size_t buflen;

	for (i=0; data_objects[i].tag; i++)
	{
	if (data_objects[i].get_from)
	continue;

	/* We don't try extended length APDU because such large DO would
	be pretty useless in a log file. */
	rc = iso7816_get_data (slot, 0, data_objects[i].tag, &buffer, &buflen);
	if (gpg_err_code (rc) == GPG_ERR_NO_OBJ)
	;
	else if (rc)
	log_info ("DO '%s' not available: %s\n",
	data_objects[i].desc, gpg_strerror (rc));
	else
	{
	if (data_objects[i].binary)
	{
	log_info ("DO '%s': ", data_objects[i].desc);
	log_printhex ("", buffer, buflen);
	}
	else
	log_info ("DO '%s': '%.*s'\n",
	data_objects[i].desc,
	(int)buflen, buffer); /* FIXME: sanitize */

	if (data_objects[i].constructed)
	{
	for (j=0; data_objects[j].tag; j++)
	{
	const unsigned char *value;
	size_t valuelen;

	if (j==i \|\| data_objects[i].tag != data_objects[j].get_from)
	continue;
	value = find_tlv_unchecked (buffer, buflen,
	data_objects[j].tag, &valuelen);
	if (!value)
	; /* not found */
	else if (valuelen > buflen - (value - buffer))
	log_error ("warning: constructed DO too short\n");
	else
	{
	if (data_objects[j].binary)
	{
	log_info ("DO '%s': ", data_objects[j].desc);
	if (valuelen > 200)
	log_info ("[%u]\n", (unsigned int)valuelen);
	else
	log_printhex ("", value, valuelen);
	}
	else
	log_info ("DO '%s': '%.*s'\n",
	data_objects[j].desc,
	(int)valuelen, value); /* FIXME: sanitize */
	}
	}
	}
	}
	xfree (buffer); buffer = NULL;
	}
	}


	/* Count the number of bits, assuming the A represents an unsigned big
	integer of length LEN bytes. */
	static unsigned int
	count_bits (const unsigned char *a, size_t len)
	{
	unsigned int n = len * 8;
	int i;

	for (; len && !*a; len--, a++, n -=8)
	;
	if (len)
	{
	for (i=7; i && !(*a & (1<<i)); i--)
	n--;
	}
	return n;
	}

	/* GnuPG makes special use of the login-data DO, this function parses
	the login data to store the flags for later use. It may be called
	at any time and should be called after changing the login-data DO.

	Everything up to a LF is considered a mailbox or account name. If
	the first LF is followed by DC4 (0x14) control sequence are
	expected up to the next LF. Control sequences are separated by FS
	(0x18) and consist of key=value pairs. There are two keys defined:

	F=<flags>

	Where FLAGS is a plain hexadecimal number representing flag values.
	The lsb is here the rightmost bit. Defined flags bits are:

	Bit 0 = CHV1 and CHV2 are not syncronized
	- Bit 1 = CHV2 has been been set to the default PIN of "123456"
	+ Bit 1 = CHV2 has been set to the default PIN of "123456"
	(this implies that bit 0 is also set).

	P=<pinpad-request>

	Where PINPAD_REQUEST is in the format of: <n> or <n>,<m>.
	N for user PIN, M for admin PIN. If M is missing it means M=N.
	0 means to force not to use pinpad.

	*/
	static void
	parse_login_data (app_t app)
	{
	unsigned char buffer, p;
	size_t buflen, len;
	void *relptr;

	/* Set defaults. */
	app->app_local->flags.no_sync = 0;
	app->app_local->flags.def_chv2 = 0;
	app->app_local->pinpad.specified = 0;
	app->app_local->pinpad.fixedlen_user = -1;
	app->app_local->pinpad.fixedlen_admin = -1;

	/* Read the DO. */
	relptr = get_one_do (app, 0x005E, &buffer, &buflen, NULL);
	if (!relptr)
	return; /* Ooops. */
	for (; buflen; buflen--, buffer++)
	if (*buffer == '\n')
	break;
	if (buflen < 2 \|\| buffer[1] != '\x14')
	{
	xfree (relptr);
	return; /* No control sequences. */
	}

	buflen--;
	buffer++;
	do
	{
	buflen--;
	buffer++;
	if (buflen > 1 && *buffer == 'F' && buffer[1] == '=')
	{
	/* Flags control sequence found. */
	int lastdig = 0;

	/* For now we are only interested in the last digit, so skip
	any leading digits but bail out on invalid characters. */
	for (p=buffer+2, len = buflen-2; len && hexdigitp (p); p++, len--)
	lastdig = xtoi_1 (p);
	buffer = p;
	buflen = len;
	if (len && !(p == '\n' \|\| p == '\x18'))
	goto next; /* Invalid characters in field. */
	app->app_local->flags.no_sync = !!(lastdig & 1);
	app->app_local->flags.def_chv2 = (lastdig & 3) == 3;
	}
	else if (buflen > 1 && *buffer == 'P' && buffer[1] == '=')
	{
	/* Pinpad request control sequence found. */
	buffer += 2;
	buflen -= 2;

	if (buflen)
	{
	if (digitp (buffer))
	{
	char *q;
	int n, m;

	n = strtol (buffer, &q, 10);
	if (q >= (char *)buffer + buflen
	\|\| q == '\x18' \|\| q == '\n')
	m = n;
	else
	{
	if (*q++ != ',' \|\| !digitp (q))
	goto next;
	m = strtol (q, &q, 10);
	}

	if (buflen < ((unsigned char *)q - buffer))
	break;

	buflen -= ((unsigned char *)q - buffer);
	buffer = q;

	if (buflen && !(buffer == '\n' \|\| buffer == '\x18'))
	goto next;
	app->app_local->pinpad.specified = 1;
	app->app_local->pinpad.fixedlen_user = n;
	app->app_local->pinpad.fixedlen_admin = m;
	}
	}
	}
	next:
	/* Skip to FS (0x18) or LF (\n). */
	for (; buflen && buffer != '\x18' && buffer != '\n'; buflen--)
	buffer++;
	}
	while (buflen && *buffer != '\n');

	xfree (relptr);
	}


	#define MAX_ARGS_STORE_FPR 3

	/* Note, that FPR must be at least 20 bytes. */
	static gpg_error_t
	store_fpr (app_t app, int keynumber, u32 timestamp, unsigned char *fpr,
	int algo, ...)
	{
	unsigned int n, nbits;
	unsigned char buffer, p;
	int tag, tag2;
	int rc;
	const unsigned char *m[MAX_ARGS_STORE_FPR];
	size_t mlen[MAX_ARGS_STORE_FPR];
	va_list ap;
	int argc;
	int i;

	n = 6; /* key packet version, 4-byte timestamps, and algorithm */
	if (algo == PUBKEY_ALGO_ECDH)
	argc = 3;
	else
	argc = 2;

	va_start (ap, algo);
	for (i = 0; i < argc; i++)
	{
	m[i] = va_arg (ap, const unsigned char *);
	mlen[i] = va_arg (ap, size_t);
	if (algo == PUBKEY_ALGO_RSA \|\| i == 1)
	n += 2;
	n += mlen[i];
	}
	va_end (ap);

	p = buffer = xtrymalloc (3 + n);
	if (!buffer)
	return gpg_error_from_syserror ();

	p++ = 0x99; / ctb */
	p++ = n >> 8; / 2 byte length header */
	*p++ = n;
	p++ = 4; / key packet version */
	*p++ = timestamp >> 24;
	*p++ = timestamp >> 16;
	*p++ = timestamp >> 8;
	*p++ = timestamp;
	*p++ = algo;

	for (i = 0; i < argc; i++)
	{
	if (algo == PUBKEY_ALGO_RSA \|\| i == 1)
	{
	nbits = count_bits (m[i], mlen[i]);
	*p++ = nbits >> 8;
	*p++ = nbits;
	}
	memcpy (p, m[i], mlen[i]);
	p += mlen[i];
	}

	gcry_md_hash_buffer (GCRY_MD_SHA1, fpr, buffer, n+3);

	xfree (buffer);

	tag = (app->card_version > 0x0007? 0xC7 : 0xC6) + keynumber;
	flush_cache_item (app, 0xC5);
	tag2 = 0xCE + keynumber;
	flush_cache_item (app, 0xCD);

	rc = iso7816_put_data (app->slot, 0, tag, fpr, 20);
	if (rc)
	log_error (_("failed to store the fingerprint: %s\n"),gpg_strerror (rc));

	if (!rc && app->card_version > 0x0100)
	{
	unsigned char buf[4];

	buf[0] = timestamp >> 24;
	buf[1] = timestamp >> 16;
	buf[2] = timestamp >> 8;
	buf[3] = timestamp;

	rc = iso7816_put_data (app->slot, 0, tag2, buf, 4);
	if (rc)
	log_error (_("failed to store the creation date: %s\n"),
	gpg_strerror (rc));
	}

	return rc;
	}


	static void
	send_fpr_if_not_null (ctrl_t ctrl, const char *keyword,
	int number, const unsigned char *fpr)
	{
	int i;
	char buf[41];
	char numbuf[25];

	for (i=0; i < 20 && !fpr[i]; i++)
	;
	if (i==20)
	return; /* All zero. */
	bin2hex (fpr, 20, buf);
	if (number == -1)
	numbuf = 0; / Don't print the key number */
	else
	sprintf (numbuf, "%d", number);
	send_status_info (ctrl, keyword,
	numbuf, (size_t)strlen(numbuf),
	buf, (size_t)strlen (buf), NULL, 0);
	}

	static void
	send_fprtime_if_not_null (ctrl_t ctrl, const char *keyword,
	int number, const unsigned char *stamp)
	{
	char numbuf1[50], numbuf2[50];
	unsigned long value;

	value = buf32_to_ulong (stamp);
	if (!value)
	return;
	sprintf (numbuf1, "%d", number);
	sprintf (numbuf2, "%lu", value);
	send_status_info (ctrl, keyword,
	numbuf1, (size_t)strlen(numbuf1),
	numbuf2, (size_t)strlen(numbuf2), NULL, 0);
	}

	static void
	send_key_data (ctrl_t ctrl, const char *name,
	const unsigned char *a, size_t alen)
	{
	char buffer, buf;
	size_t buflen;

	buffer = buf = bin2hex (a, alen, NULL);
	if (!buffer)
	{
	log_error ("memory allocation error in send_key_data\n");
	return;
	}
	buflen = strlen (buffer);

	/* 768 is the hexified size for the modulus of an 3072 bit key. We
	use extra chunks to transmit larger data (i.e for 4096 bit). */
	for ( ;buflen > 768; buflen -= 768, buf += 768)
	send_status_info (ctrl, "KEY-DATA",
	"-", 1,
	buf, 768,
	NULL, 0);
	send_status_info (ctrl, "KEY-DATA",
	name, (size_t)strlen(name),
	buf, buflen,
	NULL, 0);
	xfree (buffer);
	}


	static void
	send_key_attr (ctrl_t ctrl, app_t app, const char *keyword, int keyno)
	{
	char buffer[200];

	assert (keyno >=0 && keyno < DIM(app->app_local->keyattr));

	if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
	snprintf (buffer, sizeof buffer, "%d 1 rsa%u %u %d",
	keyno+1,
	app->app_local->keyattr[keyno].rsa.n_bits,
	app->app_local->keyattr[keyno].rsa.e_bits,
	app->app_local->keyattr[keyno].rsa.format);
	else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECC)
	{
	snprintf (buffer, sizeof buffer, "%d %d %s",
	keyno+1,
	keyno==1? PUBKEY_ALGO_ECDH :
	(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)?
	PUBKEY_ALGO_EDDSA : PUBKEY_ALGO_ECDSA,
	app->app_local->keyattr[keyno].ecc.curve);
	}
	else
	snprintf (buffer, sizeof buffer, "%d 0 0 UNKNOWN", keyno+1);

	send_status_direct (ctrl, keyword, buffer);
	}


	#define RSA_SMALL_SIZE_KEY 1952
	#define RSA_SMALL_SIZE_OP 2048

	static int
	determine_rsa_response (app_t app, int keyno)
	{
	int size;

	size = 2 + 3 /* header */
	+ 4 /* tag+len */ + app->app_local->keyattr[keyno].rsa.n_bits/8
	+ 2 /* tag+len */ + app->app_local->keyattr[keyno].rsa.e_bits/8;

	return size;
	}


	/* Implement the GETATTR command. This is similar to the LEARN
	command but returns just one value via the status interface. */
	static gpg_error_t
	do_getattr (app_t app, ctrl_t ctrl, const char *name)
	{
	static struct {
	const char *name;
	int tag;
	int special;
	} table[] = {
	{ "DISP-NAME", 0x005B },
	{ "LOGIN-DATA", 0x005E },
	{ "DISP-LANG", 0x5F2D },
	{ "DISP-SEX", 0x5F35 },
	{ "PUBKEY-URL", 0x5F50 },
	{ "KEY-FPR", 0x00C5, 3 },
	{ "KEY-TIME", 0x00CD, 4 },
	{ "KEY-ATTR", 0x0000, -5 },
	{ "CA-FPR", 0x00C6, 3 },
	{ "CHV-STATUS", 0x00C4, 1 },
	{ "SIG-COUNTER", 0x0093, 2 },
	{ "SERIALNO", 0x004F, -1 },
	{ "AID", 0x004F },
	{ "EXTCAP", 0x0000, -2 },
	{ "PRIVATE-DO-1", 0x0101 },
	{ "PRIVATE-DO-2", 0x0102 },
	{ "PRIVATE-DO-3", 0x0103 },
	{ "PRIVATE-DO-4", 0x0104 },
	{ "$AUTHKEYID", 0x0000, -3 },
	{ "$DISPSERIALNO",0x0000, -4 },
	{ NULL, 0 }
	};
	int idx, i, rc;
	void *relptr;
	unsigned char *value;
	size_t valuelen;

	for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
	;
	if (!table[idx].name)
	return gpg_error (GPG_ERR_INV_NAME);

	if (table[idx].special == -1)
	{
	/* The serial number is very special. We could have used the
	AID DO to retrieve it. The AID DO is available anyway but
	not hex formatted. */
	char *serial = app_get_serialno (app);

	if (serial)
	{
	send_status_direct (ctrl, "SERIALNO", serial);
	xfree (serial);
	}
	return 0;
	}
	if (table[idx].special == -2)
	{
	char tmp[110];

	snprintf (tmp, sizeof tmp,
	"gc=%d ki=%d fc=%d pd=%d mcl3=%u aac=%d "
	"sm=%d si=%u dec=%d bt=%d",
	app->app_local->extcap.get_challenge,
	app->app_local->extcap.key_import,
	app->app_local->extcap.change_force_chv,
	app->app_local->extcap.private_dos,
	app->app_local->extcap.max_certlen_3,
	app->app_local->extcap.algo_attr_change,
	(app->app_local->extcap.sm_supported
	? (app->app_local->extcap.sm_algo == 0? CIPHER_ALGO_3DES :
	(app->app_local->extcap.sm_algo == 1?
	CIPHER_ALGO_AES : CIPHER_ALGO_AES256))
	: 0),
	app->app_local->status_indicator,
	app->app_local->extcap.has_decrypt,
	app->app_local->extcap.has_button);
	send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
	return 0;
	}
	if (table[idx].special == -3)
	{
	char const tmp[] = "OPENPGP.3";
	send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0);
	return 0;
	}
	if (table[idx].special == -4)
	{
	char *serial = app_get_serialno (app);

	if (serial)
	{
	if (strlen (serial) > 16+12)
	{
	send_status_info (ctrl, table[idx].name, serial+16, 12, NULL, 0);
	xfree (serial);
	return 0;
	}
	xfree (serial);
	}
	return gpg_error (GPG_ERR_INV_NAME);
	}
	if (table[idx].special == -5)
	{
	for (i=0; i < 3; i++)
	send_key_attr (ctrl, app, table[idx].name, i);
	return 0;
	}

	relptr = get_one_do (app, table[idx].tag, &value, &valuelen, &rc);
	if (relptr)
	{
	if (table[idx].special == 1)
	{
	char numbuf[7*23];

	for (i=0,*numbuf=0; i < valuelen && i < 7; i++)
	sprintf (numbuf+strlen (numbuf), " %d", value[i]);
	send_status_info (ctrl, table[idx].name,
	numbuf, strlen (numbuf), NULL, 0);
	}
	else if (table[idx].special == 2)
	{
	char numbuf[50];

	sprintf (numbuf, "%lu", convert_sig_counter_value (value, valuelen));
	send_status_info (ctrl, table[idx].name,
	numbuf, strlen (numbuf), NULL, 0);
	}
	else if (table[idx].special == 3)
	{
	if (valuelen >= 60)
	for (i=0; i < 3; i++)
	send_fpr_if_not_null (ctrl, table[idx].name, i+1, value+i*20);
	}
	else if (table[idx].special == 4)
	{
	if (valuelen >= 12)
	for (i=0; i < 3; i++)
	send_fprtime_if_not_null (ctrl, table[idx].name, i+1, value+i*4);
	}
	else
	send_status_info (ctrl, table[idx].name, value, valuelen, NULL, 0);

	xfree (relptr);
	}
	return rc;
	}

	/* Retrieve the fingerprint from the card inserted in SLOT and write
	the according hex representation to FPR. Caller must have provide
	a buffer at FPR of least 41 bytes. Returns 0 on success or an
	error code. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	retrieve_fpr_from_card (app_t app, int keyno, char *fpr)
	{
	gpg_error_t err = 0;
	void *relptr;
	unsigned char *value;
	size_t valuelen;

	assert (keyno >=0 && keyno <= 2);

	relptr = get_one_do (app, 0x00C5, &value, &valuelen, NULL);
	if (relptr && valuelen >= 60)
	bin2hex (value+keyno*20, 20, fpr);
	else
	err = gpg_error (GPG_ERR_NOT_FOUND);
	xfree (relptr);
	return err;
	}
	#endif /GNUPG_MAJOR_VERSION > 1/


	/* Retrieve the public key material for the RSA key, whose fingerprint
	is FPR, from gpg output, which can be read through the stream FP.
	The RSA modulus will be stored at the address of M and MLEN, the
	public exponent at E and ELEN. Returns zero on success, an error
	code on failure. Caller must release the allocated buffers at M
	and E if the function returns success. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	retrieve_key_material (FILE fp, const char hexkeyid,
	const unsigned char *m, size_t mlen,
	const unsigned char *e, size_t elen)
	{
	gcry_error_t err = 0;
	char line = NULL; / read_line() buffer. */
	size_t line_size = 0; /* Helper for for read_line. */
	int found_key = 0; /* Helper to find a matching key. */
	unsigned char *m_new = NULL;
	unsigned char *e_new = NULL;
	size_t m_new_n = 0;
	size_t e_new_n = 0;

	/* Loop over all records until we have found the subkey
	corresponding to the fingerprint. Inm general the first record
	should be the pub record, but we don't rely on that. Given that
	we only need to look at one key, it is sufficient to compare the
	keyid so that we don't need to look at "fpr" records. */
	for (;;)
	{
	char *p;
	char *fields[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
	int nfields;
	size_t max_length;
	gcry_mpi_t mpi;
	int i;

	max_length = 4096;
	i = read_line (fp, &line, &line_size, &max_length);
	if (!i)
	break; /* EOF. */
	if (i < 0)
	{
	err = gpg_error_from_syserror ();
	goto leave; /* Error. */
	}
	if (!max_length)
	{
	err = gpg_error (GPG_ERR_TRUNCATED);
	goto leave; /* Line truncated - we better stop processing. */
	}

	/* Parse the line into fields. */
	for (nfields=0, p=line; p && nfields < DIM (fields); nfields++)
	{
	fields[nfields] = p;
	p = strchr (p, ':');
	if (p)
	*(p++) = 0;
	}
	if (!nfields)
	continue; /* No fields at all - skip line. */

	if (!found_key)
	{
	if ( (!strcmp (fields[0], "sub") \|\| !strcmp (fields[0], "pub") )
	&& nfields > 4 && !strcmp (fields[4], hexkeyid))
	found_key = 1;
	continue;
	}

	if ( !strcmp (fields[0], "sub") \|\| !strcmp (fields[0], "pub") )
	break; /* Next key - stop. */

	if ( strcmp (fields[0], "pkd") )
	continue; /* Not a key data record. */
	i = 0; /* Avoid erroneous compiler warning. */
	if ( nfields < 4 \|\| (i = atoi (fields[1])) < 0 \|\| i > 1
	\|\| (!i && m_new) \|\| (i && e_new))
	{
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave; /* Error: Invalid key data record or not an RSA key. */
	}

	err = gcry_mpi_scan (&mpi, GCRYMPI_FMT_HEX, fields[3], 0, NULL);
	if (err)
	mpi = NULL;
	else if (!i)
	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &m_new, &m_new_n, mpi);
	else
	err = gcry_mpi_aprint (GCRYMPI_FMT_STD, &e_new, &e_new_n, mpi);
	gcry_mpi_release (mpi);
	if (err)
	goto leave;
	}

	if (m_new && e_new)
	{
	*m = m_new;
	*mlen = m_new_n;
	m_new = NULL;
	*e = e_new;
	*elen = e_new_n;
	e_new = NULL;
	}
	else
	err = gpg_error (GPG_ERR_GENERAL);

	leave:
	xfree (m_new);
	xfree (e_new);
	xfree (line);
	return err;
	}
	#endif /GNUPG_MAJOR_VERSION > 1/


	static gpg_error_t
	rsa_read_pubkey (app_t app, ctrl_t ctrl, u32 created_at, int keyno,
	const unsigned char data, size_t datalen, gcry_sexp_t r_sexp)
	{
	gpg_error_t err;
	const unsigned char m, e;
	size_t mlen, elen;
	unsigned char mbuf = NULL, ebuf = NULL;

	m = find_tlv (data, datalen, 0x0081, &mlen);
	if (!m)
	{
	log_error (_("response does not contain the RSA modulus\n"));
	return gpg_error (GPG_ERR_CARD);
	}

	e = find_tlv (data, datalen, 0x0082, &elen);
	if (!e)
	{
	log_error (_("response does not contain the RSA public exponent\n"));
	return gpg_error (GPG_ERR_CARD);
	}

	if (ctrl)
	{
	send_key_data (ctrl, "n", m, mlen);
	send_key_data (ctrl, "e", e, elen);
	}

	for (; mlen && !m; mlen--, m++) / strip leading zeroes */
	;
	for (; elen && !e; elen--, e++) / strip leading zeroes */
	;

	if (ctrl)
	{
	unsigned char fprbuf[20];

	err = store_fpr (app, keyno, created_at, fprbuf, PUBKEY_ALGO_RSA,
	m, mlen, e, elen);
	if (err)
	return err;

	send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf);
	}

	mbuf = xtrymalloc (mlen + 1);
	if (!mbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Prepend numbers with a 0 if needed. */
	if (mlen && (*m & 0x80))
	{
	*mbuf = 0;
	memcpy (mbuf+1, m, mlen);
	mlen++;
	}
	else
	memcpy (mbuf, m, mlen);

	ebuf = xtrymalloc (elen + 1);
	if (!ebuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	/* Prepend numbers with a 0 if needed. */
	if (elen && (*e & 0x80))
	{
	*ebuf = 0;
	memcpy (ebuf+1, e, elen);
	elen++;
	}
	else
	memcpy (ebuf, e, elen);

	err = gcry_sexp_build (r_sexp, NULL, "(public-key(rsa(n%b)(e%b)))",
	(int)mlen, mbuf, (int)elen, ebuf);
	leave:
	xfree (mbuf);
	xfree (ebuf);
	return err;
	}


	/* Determine KDF hash algorithm and KEK encryption algorithm by CURVE. */
	static const unsigned char*
	ecdh_params (const char *curve)
	{
	unsigned int nbits;

	openpgp_curve_to_oid (curve, &nbits);

	/* See RFC-6637 for those constants.
	0x03: Number of bytes
	0x01: Version for this parameter format
	KDF algo
	KEK algo
	*/
	if (nbits <= 256)
	return (const unsigned char*)"\x03\x01\x08\x07";
	else if (nbits <= 384)
	return (const unsigned char*)"\x03\x01\x09\x08";
	else
	return (const unsigned char*)"\x03\x01\x0a\x09";
	}

	static gpg_error_t
	ecc_read_pubkey (app_t app, ctrl_t ctrl, u32 created_at, int keyno,
	const unsigned char data, size_t datalen, gcry_sexp_t r_sexp)
	{
	gpg_error_t err;
	unsigned char *qbuf = NULL;
	const unsigned char *ecc_q;
	size_t ecc_q_len;
	gcry_mpi_t oid = NULL;
	int n;
	const char *curve;
	const char *oidstr;
	const unsigned char *oidbuf;
	size_t oid_len;
	int algo;
	const char *format;

	ecc_q = find_tlv (data, datalen, 0x0086, &ecc_q_len);
	if (!ecc_q)
	{
	log_error (_("response does not contain the EC public key\n"));
	return gpg_error (GPG_ERR_CARD);
	}

	curve = app->app_local->keyattr[keyno].ecc.curve;
	oidstr = openpgp_curve_to_oid (curve, NULL);
	err = openpgp_oid_from_str (oidstr, &oid);
	if (err)
	return err;
	oidbuf = gcry_mpi_get_opaque (oid, &n);
	if (!oidbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	oid_len = (n+7)/8;

	qbuf = xtrymalloc (ecc_q_len + 1);
	if (!qbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if ((app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
	{ /* Prepend 0x40 prefix. */
	*qbuf = 0x40;
	memcpy (qbuf+1, ecc_q, ecc_q_len);
	ecc_q_len++;
	}
	else
	memcpy (qbuf, ecc_q, ecc_q_len);

	if (ctrl)
	{
	send_key_data (ctrl, "q", qbuf, ecc_q_len);
	send_key_data (ctrl, "curve", oidbuf, oid_len);
	}

	if (keyno == 1)
	{
	if (ctrl)
	send_key_data (ctrl, "kdf/kek", ecdh_params (curve), (size_t)4);
	algo = PUBKEY_ALGO_ECDH;
	}
	else
	{
	if ((app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
	algo = PUBKEY_ALGO_EDDSA;
	else
	algo = PUBKEY_ALGO_ECDSA;
	}

	if (ctrl)
	{
	unsigned char fprbuf[20];

	err = store_fpr (app, keyno, created_at, fprbuf, algo, oidbuf, oid_len,
	qbuf, ecc_q_len, ecdh_params (curve), (size_t)4);
	if (err)
	goto leave;

	send_fpr_if_not_null (ctrl, "KEY-FPR", -1, fprbuf);
	}

	if (!(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK))
	format = "(public-key(ecc(curve%s)(q%b)))";
	else if (keyno == 1)
	format = "(public-key(ecc(curve%s)(flags djb-tweak)(q%b)))";
	else
	format = "(public-key(ecc(curve%s)(flags eddsa)(q%b)))";

	err = gcry_sexp_build (r_sexp, NULL, format,
	app->app_local->keyattr[keyno].ecc.curve,
	(int)ecc_q_len, qbuf);
	leave:
	gcry_mpi_release (oid);
	xfree (qbuf);
	return err;
	}


	/* Parse tag-length-value data for public key in BUFFER of BUFLEN
	length. Key of KEYNO in APP is updated with an S-expression of
	public key. When CTRL is not NULL, fingerprint is computed with
	CREATED_AT, and fingerprint is written to the card, and key data
	and fingerprint are send back to the client side.
	*/
	static gpg_error_t
	read_public_key (app_t app, ctrl_t ctrl, u32 created_at, int keyno,
	const unsigned char *buffer, size_t buflen)
	{
	gpg_error_t err;
	const unsigned char *data;
	size_t datalen;
	gcry_sexp_t s_pkey = NULL;

	data = find_tlv (buffer, buflen, 0x7F49, &datalen);
	if (!data)
	{
	log_error (_("response does not contain the public key data\n"));
	return gpg_error (GPG_ERR_CARD);
	}

	if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
	err = rsa_read_pubkey (app, ctrl, created_at, keyno,
	data, datalen, &s_pkey);
	else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECC)
	err = ecc_read_pubkey (app, ctrl, created_at, keyno,
	data, datalen, &s_pkey);
	else
	err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);

	if (!err)
	{
	unsigned char *keybuf;
	size_t len;

	len = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0);
	keybuf = xtrymalloc (len);
	if (!data)
	{
	err = gpg_error_from_syserror ();
	gcry_sexp_release (s_pkey);
	return err;
	}

	gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, keybuf, len);
	gcry_sexp_release (s_pkey);

	app->app_local->pk[keyno].key = keybuf;
	/* Decrement for trailing '\0' */
	app->app_local->pk[keyno].keylen = len - 1;
	}

	return err;
	}


	/* Get the public key for KEYNO and store it as an S-expresion with
	the APP handle. On error that field gets cleared. If we already
	know about the public key we will just return. Note that this does
	not mean a key is available; this is solely indicated by the
	presence of the app->app_local->pk[KEYNO].key field.

	Note that GnuPG 1.x does not need this and it would be too time
	consuming to send it just for the fun of it. However, given that we
	use the same code in gpg 1.4, we can't use the gcry S-expresion
	here but need to open encode it. */
	#if GNUPG_MAJOR_VERSION > 1
	static gpg_error_t
	get_public_key (app_t app, int keyno)
	{
	gpg_error_t err = 0;
	unsigned char *buffer;
	const unsigned char m, e;
	size_t buflen;
	size_t mlen = 0;
	size_t elen = 0;
	char *keybuf = NULL;
	gcry_sexp_t s_pkey;
	size_t len;

	if (keyno < 0 \|\| keyno > 2)
	return gpg_error (GPG_ERR_INV_ID);

	/* Already cached? */
	if (app->app_local->pk[keyno].read_done)
	return 0;

	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;

	m = e = NULL; /* (avoid cc warning) */

	if (app->card_version > 0x0100)
	{
	int exmode, le_value;

	/* We may simply read the public key out of these cards. */
	if (app->app_local->cardcap.ext_lc_le
	&& app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA
	&& app->app_local->keyattr[keyno].rsa.n_bits > RSA_SMALL_SIZE_KEY)
	{
	exmode = 1; /* Use extended length. */
	le_value = determine_rsa_response (app, keyno);
	}
	else
	{
	exmode = 0;
	le_value = 256; /* Use legacy value. */
	}

	err = iso7816_read_public_key (app->slot, exmode,
	(keyno == 0? "\xB6" :
	keyno == 1? "\xB8" : "\xA4"),
	2, le_value, &buffer, &buflen);
	if (err)
	{
	log_error (_("reading public key failed: %s\n"), gpg_strerror (err));
	goto leave;
	}

	err = read_public_key (app, NULL, 0U, keyno, buffer, buflen);
	}
	else
	{
	/* Due to a design problem in v1.0 cards we can't get the public
	key out of these cards without doing a verify on CHV3.
	Clearly that is not an option and thus we try to locate the
	key using an external helper.

	The helper we use here is gpg itself, which should know about
	the key in any case. */

	char fpr[41];
	char *hexkeyid;
	char *command = NULL;
	FILE *fp;
	int ret;

	buffer = NULL; /* We don't need buffer. */

	err = retrieve_fpr_from_card (app, keyno, fpr);
	if (err)
	{
	log_error ("error while retrieving fpr from card: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	hexkeyid = fpr + 24;

	ret = gpgrt_asprintf
	(&command, "gpg --list-keys --with-colons --with-key-data '%s'", fpr);
	if (ret < 0)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	fp = popen (command, "r");
	xfree (command);
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	log_error ("running gpg failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	err = retrieve_key_material (fp, hexkeyid, &m, &mlen, &e, &elen);
	pclose (fp);
	if (err)
	{
	log_error ("error while retrieving key material through pipe: %s\n",
	gpg_strerror (err));
	goto leave;
	}

	err = gcry_sexp_build (&s_pkey, NULL, "(public-key(rsa(n%b)(e%b)))",
	(int)mlen, m, (int)elen, e);
	if (err)
	goto leave;

	len = gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, NULL, 0);

	keybuf = xtrymalloc (len);
	if (!keybuf)
	{
	err = gpg_error_from_syserror ();
	gcry_sexp_release (s_pkey);
	goto leave;
	}

	gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, keybuf, len);
	gcry_sexp_release (s_pkey);

	app->app_local->pk[keyno].key = (unsigned char*)keybuf;
	/* Decrement for trailing '\0' */
	app->app_local->pk[keyno].keylen = len - 1;
	}

	leave:
	/* Set a flag to indicate that we tried to read the key. */
	app->app_local->pk[keyno].read_done = 1;

	xfree (buffer);
	return err;
	}
	#endif /* GNUPG_MAJOR_VERSION > 1 */



	/* Send the KEYPAIRINFO back. KEY needs to be in the range [1,3].
	This is used by the LEARN command. */
	static gpg_error_t
	send_keypair_info (app_t app, ctrl_t ctrl, int key)
	{
	int keyno = key - 1;
	gpg_error_t err = 0;
	/* Note that GnuPG 1.x does not need this and it would be too time
	consuming to send it just for the fun of it. */
	#if GNUPG_MAJOR_VERSION > 1
	unsigned char grip[20];
	char gripstr[41];
	char idbuf[50];

	err = get_public_key (app, keyno);
	if (err)
	goto leave;

	assert (keyno >= 0 && keyno <= 2);
	if (!app->app_local->pk[keyno].key)
	goto leave; /* No such key - ignore. */

	err = keygrip_from_canon_sexp (app->app_local->pk[keyno].key,
	app->app_local->pk[keyno].keylen,
	grip);
	if (err)
	goto leave;

	bin2hex (grip, 20, gripstr);

	sprintf (idbuf, "OPENPGP.%d", keyno+1);
	send_status_info (ctrl, "KEYPAIRINFO",
	gripstr, 40,
	idbuf, strlen (idbuf),
	NULL, (size_t)0);

	leave:
	#endif /* GNUPG_MAJOR_VERSION > 1 */

	return err;
	}


	/* Handle the LEARN command for OpenPGP. */
	static gpg_error_t
	do_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
	{
	(void)flags;

	do_getattr (app, ctrl, "EXTCAP");
	do_getattr (app, ctrl, "DISP-NAME");
	do_getattr (app, ctrl, "DISP-LANG");
	do_getattr (app, ctrl, "DISP-SEX");
	do_getattr (app, ctrl, "PUBKEY-URL");
	do_getattr (app, ctrl, "LOGIN-DATA");
	do_getattr (app, ctrl, "KEY-FPR");
	if (app->card_version > 0x0100)
	do_getattr (app, ctrl, "KEY-TIME");
	do_getattr (app, ctrl, "CA-FPR");
	do_getattr (app, ctrl, "CHV-STATUS");
	do_getattr (app, ctrl, "SIG-COUNTER");
	if (app->app_local->extcap.private_dos)
	{
	do_getattr (app, ctrl, "PRIVATE-DO-1");
	do_getattr (app, ctrl, "PRIVATE-DO-2");
	if (app->did_chv2)
	do_getattr (app, ctrl, "PRIVATE-DO-3");
	if (app->did_chv3)
	do_getattr (app, ctrl, "PRIVATE-DO-4");
	}
	send_keypair_info (app, ctrl, 1);
	send_keypair_info (app, ctrl, 2);
	send_keypair_info (app, ctrl, 3);
	/* Note: We do not send the Cardholder Certificate, because that is
	relatively long and for OpenPGP applications not really needed. */
	return 0;
	}


	/* Handle the READKEY command for OpenPGP. On success a canonical
	encoded S-expression with the public key will get stored at PK and
	its length (for assertions) at PKLEN; the caller must release that
	buffer. On error PK and PKLEN are not changed and an error code is
	returned. */
	static gpg_error_t
	do_readkey (app_t app, int advanced, const char *keyid,
	unsigned char *pk, size_t pklen)
	{
	#if GNUPG_MAJOR_VERSION > 1
	gpg_error_t err;
	int keyno;
	unsigned char *buf;

	if (!strcmp (keyid, "OPENPGP.1"))
	keyno = 0;
	else if (!strcmp (keyid, "OPENPGP.2"))
	keyno = 1;
	else if (!strcmp (keyid, "OPENPGP.3"))
	keyno = 2;
	else
	return gpg_error (GPG_ERR_INV_ID);

	err = get_public_key (app, keyno);
	if (err)
	return err;

	buf = app->app_local->pk[keyno].key;
	if (!buf)
	return gpg_error (GPG_ERR_NO_PUBKEY);

	if (advanced)
	{
	gcry_sexp_t s_key;

	err = gcry_sexp_new (&s_key, buf, app->app_local->pk[keyno].keylen, 0);
	if (err)
	return err;

	*pklen = gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, NULL, 0);
	pk = xtrymalloc (pklen);
	if (!*pk)
	{
	err = gpg_error_from_syserror ();
	*pklen = 0;
	return err;
	}

	gcry_sexp_sprint (s_key, GCRYSEXP_FMT_ADVANCED, pk, pklen);
	gcry_sexp_release (s_key);
	/* Decrement for trailing '\0' */
	pklen = pklen - 1;
	}
	else
	{
	*pklen = app->app_local->pk[keyno].keylen;
	pk = xtrymalloc (pklen);
	if (!*pk)
	{
	err = gpg_error_from_syserror ();
	*pklen = 0;
	return err;
	}
	memcpy (pk, buf, pklen);
	}

	return 0;
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}

	/* Read the standard certificate of an OpenPGP v2 card. It is
	returned in a freshly allocated buffer with that address stored at
	CERT and the length of the certificate stored at CERTLEN. CERTID
	needs to be set to "OPENPGP.3". */
	static gpg_error_t
	do_readcert (app_t app, const char *certid,
	unsigned char *cert, size_t certlen)
	{
	#if GNUPG_MAJOR_VERSION > 1
	gpg_error_t err;
	unsigned char *buffer;
	size_t buflen;
	void *relptr;

	*cert = NULL;
	*certlen = 0;
	if (strcmp (certid, "OPENPGP.3"))
	return gpg_error (GPG_ERR_INV_ID);
	if (!app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_FOUND);

	relptr = get_one_do (app, 0x7F21, &buffer, &buflen, NULL);
	if (!relptr)
	return gpg_error (GPG_ERR_NOT_FOUND);

	if (!buflen)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	else if (!(*cert = xtrymalloc (buflen)))
	err = gpg_error_from_syserror ();
	else
	{
	memcpy (*cert, buffer, buflen);
	*certlen = buflen;
	err = 0;
	}
	xfree (relptr);
	return err;
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}


	/* Decide if we use the pinpad of the reader for PIN input according
	to the user preference on the card, and the capability of the
	reader. This routine is only called when the reader has pinpad.
	Returns 0 if we use pinpad, 1 otherwise. */
	static int
	check_pinpad_request (app_t app, pininfo_t *pininfo, int admin_pin)
	{
	if (app->app_local->pinpad.specified == 0) /* No preference on card. */
	{
	if (pininfo->fixedlen == 0) /* Reader has varlen capability. */
	return 0; /* Then, use pinpad. */
	else
	/*
	* Reader has limited capability, and it may not match PIN of
	* the card.
	*/
	return 1;
	}

	if (admin_pin)
	pininfo->fixedlen = app->app_local->pinpad.fixedlen_admin;
	else
	pininfo->fixedlen = app->app_local->pinpad.fixedlen_user;

	if (pininfo->fixedlen == 0 /* User requests disable pinpad. */
	\|\| pininfo->fixedlen < pininfo->minlen
	\|\| pininfo->fixedlen > pininfo->maxlen
	/* Reader doesn't have the capability to input a PIN which
	* length is FIXEDLEN. */)
	return 1;

	return 0;
	}


	-/* Verify a CHV either using using the pinentry or if possible by
	+/* Verify a CHV either using the pinentry or if possible by
	using a pinpad. PINCB and PINCB_ARG describe the usual callback
	for the pinentry. CHVNO must be either 1 or 2. SIGCOUNT is only
	used with CHV1. PINVALUE is the address of a pointer which will
	receive a newly allocated block with the actual PIN (this is useful
	in case that PIN shall be used for another verify operation). The
	caller needs to free this value. If the function returns with
	success and NULL is stored at PINVALUE, the caller should take this
	as an indication that the pinpad has been used.
	*/
	static gpg_error_t
	verify_a_chv (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	int chvno, unsigned long sigcount, char **pinvalue)
	{
	int rc = 0;
	char *prompt_buffer = NULL;
	const char *prompt;
	pininfo_t pininfo;
	int minlen = 6;

	assert (chvno == 1 \|\| chvno == 2);

	*pinvalue = NULL;

	if (chvno == 2 && app->app_local->flags.def_chv2)
	{
	/* Special case for def_chv2 mechanism. */
	if (opt.verbose)
	log_info (_("using default PIN as %s\n"), "CHV2");
	rc = iso7816_verify (app->slot, 0x82, "123456", 6);
	if (rc)
	{
	/* Verification of CHV2 with the default PIN failed,
	although the card pretends to have the default PIN set as
	CHV2. We better disable the def_chv2 flag now. */
	log_info (_("failed to use default PIN as %s: %s"
	" - disabling further default use\n"),
	"CHV2", gpg_strerror (rc));
	app->app_local->flags.def_chv2 = 0;
	}
	return rc;
	}

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.fixedlen = -1;
	pininfo.minlen = minlen;


	if (chvno == 1)
	{
	#define PROMPTSTRING _("\|\|Please enter the PIN%%0A[sigs done: %lu]")
	size_t promptsize = strlen (PROMPTSTRING) + 50;

	prompt_buffer = xtrymalloc (promptsize);
	if (!prompt_buffer)
	return gpg_error_from_syserror ();
	snprintf (prompt_buffer, promptsize, PROMPTSTRING, sigcount);
	prompt = prompt_buffer;
	#undef PROMPTSTRING
	}
	else
	prompt = _("\|\|Please enter the PIN");


	if (!opt.disable_pinpad
	&& !iso7816_check_pinpad (app->slot, ISO7816_VERIFY, &pininfo)
	&& !check_pinpad_request (app, &pininfo, 0))
	{
	/* The reader supports the verify command through the pinpad.
	Note that the pincb appends a text to the prompt telling the
	user to use the pinpad. */
	rc = pincb (pincb_arg, prompt, NULL);
	prompt = NULL;
	xfree (prompt_buffer);
	prompt_buffer = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}
	rc = iso7816_verify_kp (app->slot, 0x80+chvno, &pininfo);
	/* Dismiss the prompt. */
	pincb (pincb_arg, NULL, NULL);

	assert (!*pinvalue);
	}
	else
	{
	/* The reader has no pinpad or we don't want to use it. */
	rc = pincb (pincb_arg, prompt, pinvalue);
	prompt = NULL;
	xfree (prompt_buffer);
	prompt_buffer = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	if (strlen (*pinvalue) < minlen)
	{
	log_error (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), chvno, minlen);
	xfree (*pinvalue);
	*pinvalue = NULL;
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	rc = iso7816_verify (app->slot, 0x80+chvno,
	pinvalue, strlen (pinvalue));
	}

	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), chvno, gpg_strerror (rc));
	xfree (*pinvalue);
	*pinvalue = NULL;
	flush_cache_after_error (app);
	}

	return rc;
	}


	/* Verify CHV2 if required. Depending on the configuration of the
	card CHV1 will also be verified. */
	static gpg_error_t
	verify_chv2 (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc;
	char *pinvalue;

	if (app->did_chv2)
	return 0; /* We already verified CHV2. */

	rc = verify_a_chv (app, pincb, pincb_arg, 2, 0, &pinvalue);
	if (rc)
	return rc;
	app->did_chv2 = 1;

	if (!app->did_chv1 && !app->force_chv1 && pinvalue)
	{
	/* For convenience we verify CHV1 here too. We do this only if
	the card is not configured to require a verification before
	each CHV1 controlled operation (force_chv1) and if we are not
	using the pinpad (PINVALUE == NULL). */
	rc = iso7816_verify (app->slot, 0x81, pinvalue, strlen (pinvalue));
	if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
	rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 1, gpg_strerror (rc));
	flush_cache_after_error (app);
	}
	else
	app->did_chv1 = 1;
	}

	xfree (pinvalue);

	return rc;
	}


	/* Build the prompt to enter the Admin PIN. The prompt depends on the
	current sdtate of the card. */
	static gpg_error_t
	build_enter_admin_pin_prompt (app_t app, char **r_prompt)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int remaining;
	char *prompt;

	*r_prompt = NULL;

	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_CARD);
	}
	if (value[6] == 0)
	{
	log_info (_("card is permanently locked!\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	remaining = value[6];
	xfree (relptr);

	log_info (ngettext("%d Admin PIN attempt remaining before card"
	" is permanently locked\n",
	"%d Admin PIN attempts remaining before card"
	" is permanently locked\n",
	remaining), remaining);

	if (remaining < 3)
	{
	/* TRANSLATORS: Do not translate the "\|A\|" prefix but keep it at
	the start of the string. Use %%0A to force a linefeed. */
	prompt = xtryasprintf (_("\|A\|Please enter the Admin PIN%%0A"
	"[remaining attempts: %d]"), remaining);
	}
	else
	prompt = xtrystrdup (_("\|A\|Please enter the Admin PIN"));

	if (!prompt)
	return gpg_error_from_syserror ();

	*r_prompt = prompt;
	return 0;
	}


	/* Verify CHV3 if required. */
	static gpg_error_t
	verify_chv3 (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc = 0;

	#if GNUPG_MAJOR_VERSION != 1
	if (!opt.allow_admin)
	{
	log_info (_("access to admin commands is not configured\n"));
	return gpg_error (GPG_ERR_EACCES);
	}
	#endif

	if (!app->did_chv3)
	{
	pininfo_t pininfo;
	int minlen = 8;
	char *prompt;

	memset (&pininfo, 0, sizeof pininfo);
	pininfo.fixedlen = -1;
	pininfo.minlen = minlen;

	rc = build_enter_admin_pin_prompt (app, &prompt);
	if (rc)
	return rc;

	if (!opt.disable_pinpad
	&& !iso7816_check_pinpad (app->slot, ISO7816_VERIFY, &pininfo)
	&& !check_pinpad_request (app, &pininfo, 1))
	{
	/* The reader supports the verify command through the pinpad. */
	rc = pincb (pincb_arg, prompt, NULL);
	xfree (prompt);
	prompt = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}
	rc = iso7816_verify_kp (app->slot, 0x83, &pininfo);
	/* Dismiss the prompt. */
	pincb (pincb_arg, NULL, NULL);
	}
	else
	{
	char *pinvalue;

	rc = pincb (pincb_arg, prompt, &pinvalue);
	xfree (prompt);
	prompt = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	if (strlen (pinvalue) < minlen)
	{
	log_error (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), 3, minlen);
	xfree (pinvalue);
	return gpg_error (GPG_ERR_BAD_PIN);
	}

	rc = iso7816_verify (app->slot, 0x83, pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	}

	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 3, gpg_strerror (rc));
	flush_cache_after_error (app);
	return rc;
	}
	app->did_chv3 = 1;
	}
	return rc;
	}


	/* Handle the SETATTR operation. All arguments are already basically
	checked. */
	static gpg_error_t
	do_setattr (app_t app, const char *name,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *value, size_t valuelen)
	{
	gpg_error_t rc;
	int idx;
	static struct {
	const char *name;
	int tag;
	int need_chv;
	int special;
	unsigned int need_v2:1;
	} table[] = {
	{ "DISP-NAME", 0x005B, 3 },
	{ "LOGIN-DATA", 0x005E, 3, 2 },
	{ "DISP-LANG", 0x5F2D, 3 },
	{ "DISP-SEX", 0x5F35, 3 },
	{ "PUBKEY-URL", 0x5F50, 3 },
	{ "CHV-STATUS-1", 0x00C4, 3, 1 },
	{ "CA-FPR-1", 0x00CA, 3 },
	{ "CA-FPR-2", 0x00CB, 3 },
	{ "CA-FPR-3", 0x00CC, 3 },
	{ "PRIVATE-DO-1", 0x0101, 2 },
	{ "PRIVATE-DO-2", 0x0102, 3 },
	{ "PRIVATE-DO-3", 0x0103, 2 },
	{ "PRIVATE-DO-4", 0x0104, 3 },
	{ "CERT-3", 0x7F21, 3, 0, 1 },
	{ "SM-KEY-ENC", 0x00D1, 3, 0, 1 },
	{ "SM-KEY-MAC", 0x00D2, 3, 0, 1 },
	{ "KEY-ATTR", 0, 0, 3, 1 },
	{ "AESKEY", 0x00D5, 3, 0, 1 },
	{ NULL, 0 }
	};
	int exmode;

	for (idx=0; table[idx].name && strcmp (table[idx].name, name); idx++)
	;
	if (!table[idx].name)
	return gpg_error (GPG_ERR_INV_NAME);
	if (table[idx].need_v2 && !app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_SUPPORTED); /* Not yet supported. */

	if (table[idx].special == 3)
	return change_keyattr_from_string (app, pincb, pincb_arg, value, valuelen);

	switch (table[idx].need_chv)
	{
	case 2:
	rc = verify_chv2 (app, pincb, pincb_arg);
	break;
	case 3:
	rc = verify_chv3 (app, pincb, pincb_arg);
	break;
	default:
	rc = 0;
	}
	if (rc)
	return rc;

	/* Flush the cache before writing it, so that the next get operation
	will reread the data from the card and thus get synced in case of
	errors (e.g. data truncated by the card). */
	flush_cache_item (app, table[idx].tag);

	if (app->app_local->cardcap.ext_lc_le && valuelen > 254)
	exmode = 1; /* Use extended length w/o a limit. */
	else if (app->app_local->cardcap.cmd_chaining && valuelen > 254)
	exmode = -254; /* Command chaining with max. 254 bytes. */
	else
	exmode = 0;
	rc = iso7816_put_data (app->slot, exmode, table[idx].tag, value, valuelen);
	if (rc)
	log_error ("failed to set '%s': %s\n", table[idx].name, gpg_strerror (rc));

	if (table[idx].special == 1)
	app->force_chv1 = (valuelen && *value == 0);
	else if (table[idx].special == 2)
	parse_login_data (app);

	return rc;
	}


	/* Handle the WRITECERT command for OpenPGP. This rites the standard
	certifciate to the card; CERTID needs to be set to "OPENPGP.3".
	PINCB and PINCB_ARG are the usual arguments for the pinentry
	callback. */
	static gpg_error_t
	do_writecert (app_t app, ctrl_t ctrl,
	const char *certidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *certdata, size_t certdatalen)
	{
	(void)ctrl;
	#if GNUPG_MAJOR_VERSION > 1
	if (strcmp (certidstr, "OPENPGP.3"))
	return gpg_error (GPG_ERR_INV_ID);
	if (!certdata \|\| !certdatalen)
	return gpg_error (GPG_ERR_INV_ARG);
	if (!app->app_local->extcap.is_v2)
	return gpg_error (GPG_ERR_NOT_SUPPORTED);
	if (certdatalen > app->app_local->extcap.max_certlen_3)
	return gpg_error (GPG_ERR_TOO_LARGE);
	return do_setattr (app, "CERT-3", pincb, pincb_arg, certdata, certdatalen);
	#else
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	#endif
	}



	/* Handle the PASSWD command. The following combinations are
	possible:

	Flags CHVNO Vers. Description
	RESET 1 1 Verify CHV3 and set a new CHV1 and CHV2
	RESET 1 2 Verify PW3 and set a new PW1.
	RESET 2 1 Verify CHV3 and set a new CHV1 and CHV2.
	RESET 2 2 Verify PW3 and set a new Reset Code.
	RESET 3 any Returns GPG_ERR_INV_ID.
	- 1 1 Verify CHV2 and set a new CHV1 and CHV2.
	- 1 2 Verify PW1 and set a new PW1.
	- 2 1 Verify CHV2 and set a new CHV1 and CHV2.
	- 2 2 Verify Reset Code and set a new PW1.
	- 3 any Verify CHV3/PW3 and set a new CHV3/PW3.
	*/
	static gpg_error_t
	do_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr,
	unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	int rc = 0;
	int chvno = atoi (chvnostr);
	char *resetcode = NULL;
	char *oldpinvalue = NULL;
	char *pinvalue = NULL;
	int reset_mode = !!(flags & APP_CHANGE_FLAG_RESET);
	int set_resetcode = 0;
	pininfo_t pininfo;
	int use_pinpad = 0;
	int minlen = 6;

	(void)ctrl;
	memset (&pininfo, 0, sizeof pininfo);
	pininfo.fixedlen = -1;
	pininfo.minlen = minlen;

	if (reset_mode && chvno == 3)
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}

	if (!app->app_local->extcap.is_v2)
	{
	/* Version 1 cards. */

	if (reset_mode \|\| chvno == 3)
	{
	/* We always require that the PIN is entered. */
	app->did_chv3 = 0;
	rc = verify_chv3 (app, pincb, pincb_arg);
	if (rc)
	goto leave;
	}
	else if (chvno == 1 \|\| chvno == 2)
	{
	/* On a v1.x card CHV1 and CVH2 should always have the same
	value, thus we enforce it here. */
	int save_force = app->force_chv1;

	app->force_chv1 = 0;
	app->did_chv1 = 0;
	app->did_chv2 = 0;
	rc = verify_chv2 (app, pincb, pincb_arg);
	app->force_chv1 = save_force;
	if (rc)
	goto leave;
	}
	else
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}
	}
	else
	{
	/* Version 2 cards. */

	if (!opt.disable_pinpad
	&& !iso7816_check_pinpad (app->slot,
	ISO7816_CHANGE_REFERENCE_DATA, &pininfo)
	&& !check_pinpad_request (app, &pininfo, chvno == 3))
	use_pinpad = 1;

	if (reset_mode)
	{
	/* To reset a PIN the Admin PIN is required. */
	use_pinpad = 0;
	app->did_chv3 = 0;
	rc = verify_chv3 (app, pincb, pincb_arg);
	if (rc)
	goto leave;

	if (chvno == 2)
	set_resetcode = 1;
	}
	else if (chvno == 1 \|\| chvno == 3)
	{
	if (!use_pinpad)
	{
	char *promptbuf = NULL;
	const char *prompt;

	if (chvno == 3)
	{
	minlen = 8;
	rc = build_enter_admin_pin_prompt (app, &promptbuf);
	if (rc)
	goto leave;
	prompt = promptbuf;
	}
	else
	prompt = _("\|\|Please enter the PIN");
	rc = pincb (pincb_arg, prompt, &oldpinvalue);
	xfree (promptbuf);
	promptbuf = NULL;
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}

	if (strlen (oldpinvalue) < minlen)
	{
	log_info (_("PIN for CHV%d is too short;"
	" minimum length is %d\n"), chvno, minlen);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}
	}
	}
	else if (chvno == 2)
	{
	/* There is no PW2 for v2 cards. We use this condition to
	allow a PW reset using the Reset Code. */
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int remaining;

	use_pinpad = 0;
	minlen = 8;
	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	rc = gpg_error (GPG_ERR_CARD);
	goto leave;
	}
	remaining = value[5];
	xfree (relptr);
	if (!remaining)
	{
	log_error (_("Reset Code not or not anymore available\n"));
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}

	rc = pincb (pincb_arg,
	_("\|\|Please enter the Reset Code for the card"),
	&resetcode);
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}
	if (strlen (resetcode) < minlen)
	{
	log_info (_("Reset Code is too short; minimum length is %d\n"),
	minlen);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	goto leave;
	}
	}
	else
	{
	rc = gpg_error (GPG_ERR_INV_ID);
	goto leave;
	}
	}

	if (chvno == 3)
	app->did_chv3 = 0;
	else
	app->did_chv1 = app->did_chv2 = 0;

	if (!use_pinpad)
	{
	/* TRANSLATORS: Do not translate the "\|*\|" prefixes but
	keep it at the start of the string. We need this elsewhere
	to get some infos on the string. */
	rc = pincb (pincb_arg, set_resetcode? _("\|RN\|New Reset Code") :
	chvno == 3? _("\|AN\|New Admin PIN") : _("\|N\|New PIN"),
	&pinvalue);
	if (rc)
	{
	log_error (_("error getting new PIN: %s\n"), gpg_strerror (rc));
	goto leave;
	}
	}


	if (resetcode)
	{
	char *buffer;

	buffer = xtrymalloc (strlen (resetcode) + strlen (pinvalue) + 1);
	if (!buffer)
	rc = gpg_error_from_syserror ();
	else
	{
	strcpy (stpcpy (buffer, resetcode), pinvalue);
	rc = iso7816_reset_retry_counter_with_rc (app->slot, 0x81,
	buffer, strlen (buffer));
	wipememory (buffer, strlen (buffer));
	xfree (buffer);
	}
	}
	else if (set_resetcode)
	{
	if (strlen (pinvalue) < 8)
	{
	log_error (_("Reset Code is too short; minimum length is %d\n"), 8);
	rc = gpg_error (GPG_ERR_BAD_PIN);
	}
	else
	rc = iso7816_put_data (app->slot, 0, 0xD3,
	pinvalue, strlen (pinvalue));
	}
	else if (reset_mode)
	{
	rc = iso7816_reset_retry_counter (app->slot, 0x81,
	pinvalue, strlen (pinvalue));
	if (!rc && !app->app_local->extcap.is_v2)
	rc = iso7816_reset_retry_counter (app->slot, 0x82,
	pinvalue, strlen (pinvalue));
	}
	else if (!app->app_local->extcap.is_v2)
	{
	/* Version 1 cards. */
	if (chvno == 1 \|\| chvno == 2)
	{
	rc = iso7816_change_reference_data (app->slot, 0x81, NULL, 0,
	pinvalue, strlen (pinvalue));
	if (!rc)
	rc = iso7816_change_reference_data (app->slot, 0x82, NULL, 0,
	pinvalue, strlen (pinvalue));
	}
	else /* CHVNO == 3 */
	{
	rc = iso7816_change_reference_data (app->slot, 0x80 + chvno, NULL, 0,
	pinvalue, strlen (pinvalue));
	}
	}
	else
	{
	/* Version 2 cards. */
	assert (chvno == 1 \|\| chvno == 3);

	if (use_pinpad)
	{
	rc = pincb (pincb_arg,
	chvno == 3 ?
	_("\|\|Please enter the Admin PIN and New Admin PIN") :
	_("\|\|Please enter the PIN and New PIN"), NULL);
	if (rc)
	{
	log_info (_("PIN callback returned error: %s\n"),
	gpg_strerror (rc));
	goto leave;
	}
	rc = iso7816_change_reference_data_kp (app->slot, 0x80 + chvno, 0,
	&pininfo);
	pincb (pincb_arg, NULL, NULL); /* Dismiss the prompt. */
	}
	else
	rc = iso7816_change_reference_data (app->slot, 0x80 + chvno,
	oldpinvalue, strlen (oldpinvalue),
	pinvalue, strlen (pinvalue));
	}

	if (pinvalue)
	{
	wipememory (pinvalue, strlen (pinvalue));
	xfree (pinvalue);
	}
	if (rc)
	flush_cache_after_error (app);

	leave:
	if (resetcode)
	{
	wipememory (resetcode, strlen (resetcode));
	xfree (resetcode);
	}
	if (oldpinvalue)
	{
	wipememory (oldpinvalue, strlen (oldpinvalue));
	xfree (oldpinvalue);
	}
	return rc;
	}


	/* Check whether a key already exists. KEYIDX is the index of the key
	(0..2). If FORCE is TRUE a diagnositic will be printed but no
	error returned if the key already exists. The flag GENERATING is
	only used to print correct messages. */
	static gpg_error_t
	does_key_exist (app_t app, int keyidx, int generating, int force)
	{
	const unsigned char *fpr;
	unsigned char *buffer;
	size_t buflen, n;
	int i;

	assert (keyidx >=0 && keyidx <= 2);

	if (iso7816_get_data (app->slot, 0, 0x006E, &buffer, &buflen))
	{
	log_error (_("error reading application data\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr = find_tlv (buffer, buflen, 0x00C5, &n);
	if (!fpr \|\| n < 60)
	{
	log_error (_("error reading fingerprint DO\n"));
	xfree (buffer);
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr += 20*keyidx;
	for (i=0; i < 20 && !fpr[i]; i++)
	;
	xfree (buffer);
	if (i!=20 && !force)
	{
	log_error (_("key already exists\n"));
	return gpg_error (GPG_ERR_EEXIST);
	}
	else if (i!=20)
	log_info (_("existing key will be replaced\n"));
	else if (generating)
	log_info (_("generating new key\n"));
	else
	log_info (_("writing new key\n"));
	return 0;
	}


	/* Create a TLV tag and value and store it at BUFFER. Return the length
	of tag and length. A LENGTH greater than 65535 is truncated. */
	static size_t
	add_tlv (unsigned char *buffer, unsigned int tag, size_t length)
	{
	unsigned char *p = buffer;

	assert (tag <= 0xffff);
	if ( tag > 0xff )
	*p++ = tag >> 8;
	*p++ = tag;
	if (length < 128)
	*p++ = length;
	else if (length < 256)
	{
	*p++ = 0x81;
	*p++ = length;
	}
	else
	{
	if (length > 0xffff)
	length = 0xffff;
	*p++ = 0x82;
	*p++ = length >> 8;
	*p++ = length;
	}

	return p - buffer;
	}


	static gpg_error_t
	build_privkey_template (app_t app, int keyno,
	const unsigned char *rsa_n, size_t rsa_n_len,
	const unsigned char *rsa_e, size_t rsa_e_len,
	const unsigned char *rsa_p, size_t rsa_p_len,
	const unsigned char *rsa_q, size_t rsa_q_len,
	const unsigned char *rsa_u, size_t rsa_u_len,
	const unsigned char *rsa_dp, size_t rsa_dp_len,
	const unsigned char *rsa_dq, size_t rsa_dq_len,
	unsigned char *result, size_t resultlen)
	{
	size_t rsa_e_reqlen;
	unsigned char privkey[7*(1+3+3)];
	size_t privkey_len;
	unsigned char exthdr[2+2+3];
	size_t exthdr_len;
	unsigned char suffix[2+3];
	size_t suffix_len;
	unsigned char *tp;
	size_t datalen;
	unsigned char *template;
	size_t template_size;

	*result = NULL;
	*resultlen = 0;

	switch (app->app_local->keyattr[keyno].rsa.format)
	{
	case RSA_STD:
	case RSA_STD_N:
	case RSA_CRT:
	case RSA_CRT_N:
	break;

	default:
	return gpg_error (GPG_ERR_INV_VALUE);
	}

	/* Get the required length for E. Rounded up to the nearest byte */
	rsa_e_reqlen = (app->app_local->keyattr[keyno].rsa.e_bits + 7) / 8;
	assert (rsa_e_len <= rsa_e_reqlen);

	/* Build the 7f48 cardholder private key template. */
	datalen = 0;
	tp = privkey;

	tp += add_tlv (tp, 0x91, rsa_e_reqlen);
	datalen += rsa_e_reqlen;

	tp += add_tlv (tp, 0x92, rsa_p_len);
	datalen += rsa_p_len;

	tp += add_tlv (tp, 0x93, rsa_q_len);
	datalen += rsa_q_len;

	if (app->app_local->keyattr[keyno].rsa.format == RSA_CRT
	\|\| app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
	{
	tp += add_tlv (tp, 0x94, rsa_u_len);
	datalen += rsa_u_len;
	tp += add_tlv (tp, 0x95, rsa_dp_len);
	datalen += rsa_dp_len;
	tp += add_tlv (tp, 0x96, rsa_dq_len);
	datalen += rsa_dq_len;
	}

	if (app->app_local->keyattr[keyno].rsa.format == RSA_STD_N
	\|\| app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
	{
	tp += add_tlv (tp, 0x97, rsa_n_len);
	datalen += rsa_n_len;
	}
	privkey_len = tp - privkey;

	/* Build the extended header list without the private key template. */
	tp = exthdr;
	*tp++ = keyno ==0 ? 0xb6 : keyno == 1? 0xb8 : 0xa4;
	*tp++ = 0;
	tp += add_tlv (tp, 0x7f48, privkey_len);
	exthdr_len = tp - exthdr;

	/* Build the 5f48 suffix of the data. */
	tp = suffix;
	tp += add_tlv (tp, 0x5f48, datalen);
	suffix_len = tp - suffix;

	/* Now concatenate everything. */
	template_size = (1 + 3 /* 0x4d and len. */
	+ exthdr_len
	+ privkey_len
	+ suffix_len
	+ datalen);
	tp = template = xtrymalloc_secure (template_size);
	if (!template)
	return gpg_error_from_syserror ();

	tp += add_tlv (tp, 0x4d, exthdr_len + privkey_len + suffix_len + datalen);
	memcpy (tp, exthdr, exthdr_len);
	tp += exthdr_len;
	memcpy (tp, privkey, privkey_len);
	tp += privkey_len;
	memcpy (tp, suffix, suffix_len);
	tp += suffix_len;

	memcpy (tp, rsa_e, rsa_e_len);
	if (rsa_e_len < rsa_e_reqlen)
	{
	/* Right justify E. */
	memmove (tp + rsa_e_reqlen - rsa_e_len, tp, rsa_e_len);
	memset (tp, 0, rsa_e_reqlen - rsa_e_len);
	}
	tp += rsa_e_reqlen;

	memcpy (tp, rsa_p, rsa_p_len);
	tp += rsa_p_len;

	memcpy (tp, rsa_q, rsa_q_len);
	tp += rsa_q_len;

	if (app->app_local->keyattr[keyno].rsa.format == RSA_CRT
	\|\| app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
	{
	memcpy (tp, rsa_u, rsa_u_len);
	tp += rsa_u_len;
	memcpy (tp, rsa_dp, rsa_dp_len);
	tp += rsa_dp_len;
	memcpy (tp, rsa_dq, rsa_dq_len);
	tp += rsa_dq_len;
	}

	if (app->app_local->keyattr[keyno].rsa.format == RSA_STD_N
	\|\| app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N)
	{
	memcpy (tp, rsa_n, rsa_n_len);
	tp += rsa_n_len;
	}

	/* Sanity check. We don't know the exact length because we
	allocated 3 bytes for the first length header. */
	assert (tp - template <= template_size);

	*result = template;
	*resultlen = tp - template;
	return 0;
	}

	static gpg_error_t
	build_ecc_privkey_template (app_t app, int keyno,
	const unsigned char *ecc_d, size_t ecc_d_len,
	const unsigned char *ecc_q, size_t ecc_q_len,
	unsigned char *result, size_t resultlen)
	{
	unsigned char privkey[2+2];
	size_t privkey_len;
	unsigned char exthdr[2+2+1];
	size_t exthdr_len;
	unsigned char suffix[2+1];
	size_t suffix_len;
	unsigned char *tp;
	size_t datalen;
	unsigned char *template;
	size_t template_size;
	int pubkey_required;

	pubkey_required = !!(app->app_local->keyattr[keyno].ecc.flags
	& ECC_FLAG_PUBKEY);

	*result = NULL;
	*resultlen = 0;

	/* Build the 7f48 cardholder private key template. */
	datalen = 0;
	tp = privkey;

	tp += add_tlv (tp, 0x92, ecc_d_len);
	datalen += ecc_d_len;

	if (pubkey_required)
	{
	tp += add_tlv (tp, 0x99, ecc_q_len);
	datalen += ecc_q_len;
	}

	privkey_len = tp - privkey;


	/* Build the extended header list without the private key template. */
	tp = exthdr;
	*tp++ = keyno ==0 ? 0xb6 : keyno == 1? 0xb8 : 0xa4;
	*tp++ = 0;
	tp += add_tlv (tp, 0x7f48, privkey_len);
	exthdr_len = tp - exthdr;

	/* Build the 5f48 suffix of the data. */
	tp = suffix;
	tp += add_tlv (tp, 0x5f48, datalen);
	suffix_len = tp - suffix;

	/* Now concatenate everything. */
	template_size = (1 + 1 /* 0x4d and len. */
	+ exthdr_len
	+ privkey_len
	+ suffix_len
	+ datalen);
	if (exthdr_len + privkey_len + suffix_len + datalen >= 128)
	template_size++;
	tp = template = xtrymalloc_secure (template_size);
	if (!template)
	return gpg_error_from_syserror ();

	tp += add_tlv (tp, 0x4d, exthdr_len + privkey_len + suffix_len + datalen);
	memcpy (tp, exthdr, exthdr_len);
	tp += exthdr_len;
	memcpy (tp, privkey, privkey_len);
	tp += privkey_len;
	memcpy (tp, suffix, suffix_len);
	tp += suffix_len;

	memcpy (tp, ecc_d, ecc_d_len);
	tp += ecc_d_len;

	if (pubkey_required)
	{
	memcpy (tp, ecc_q, ecc_q_len);
	tp += ecc_q_len;
	}

	assert (tp - template == template_size);

	*result = template;
	*resultlen = tp - template;
	return 0;
	}


	/* Helper for do_writekley to change the size of a key. Not ethat
	this deletes the entire key without asking. */
	static gpg_error_t
	change_keyattr (app_t app, int keyno, const unsigned char *buf, size_t buflen,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;

	assert (keyno >=0 && keyno <= 2);

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	return err;

	/* Change the attribute. */
	err = iso7816_put_data (app->slot, 0, 0xC1+keyno, buf, buflen);
	if (err)
	log_error ("error changing key attribute (key=%d)\n", keyno+1);
	else
	log_info ("key attribute changed (key=%d)\n", keyno+1);
	flush_cache (app);
	parse_algorithm_attribute (app, keyno);
	app->did_chv1 = 0;
	app->did_chv2 = 0;
	app->did_chv3 = 0;
	return err;
	}


	static gpg_error_t
	change_rsa_keyattr (app_t app, int keyno, unsigned int nbits,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err = 0;
	unsigned char *buf;
	size_t buflen;
	void *relptr;

	/* Read the current attributes into a buffer. */
	relptr = get_one_do (app, 0xC1+keyno, &buf, &buflen, NULL);
	if (!relptr)
	err = gpg_error (GPG_ERR_CARD);
	else if (buflen < 6 \|\| buf[0] != PUBKEY_ALGO_RSA)
	{
	/* Attriutes too short or not an RSA key. */
	xfree (relptr);
	err = gpg_error (GPG_ERR_CARD);
	}
	else
	{
	/* We only change n_bits and don't touch anything else. Before we
	do so, we round up NBITS to a sensible way in the same way as
	gpg's key generation does it. This may help to sort out problems
	with a few bits too short keys. */
	nbits = ((nbits + 31) / 32) * 32;
	buf[1] = (nbits >> 8);
	buf[2] = nbits;
	err = change_keyattr (app, keyno, buf, buflen, pincb, pincb_arg);
	xfree (relptr);
	}

	return err;
	}


	/* Helper to process an setattr command for name KEY-ATTR.
	In (VALUE,VALUELEN), it expects following string:
	RSA: "--force <key> <algo> rsa<nbits>"
	ECC: "--force <key> <algo> <curvename>"
	*/
	static gpg_error_t
	change_keyattr_from_string (app_t app,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *value, size_t valuelen)
	{
	gpg_error_t err = 0;
	char *string;
	int key, keyno, algo;
	int n = 0;

	/* VALUE is expected to be a string but not guaranteed to be
	terminated. Thus copy it to an allocated buffer first. */
	string = xtrymalloc (valuelen+1);
	if (!string)
	return gpg_error_from_syserror ();
	memcpy (string, value, valuelen);
	string[valuelen] = 0;

	/* Because this function deletes the key we require the string
	"--force" in the data to make clear that something serious might
	happen. */
	sscanf (string, "--force %d %d %n", &key, &algo, &n);
	if (n < 12)
	{
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}

	keyno = key - 1;
	if (keyno < 0 \|\| keyno > 2)
	err = gpg_error (GPG_ERR_INV_ID);
	else if (algo == PUBKEY_ALGO_RSA)
	{
	unsigned int nbits;

	errno = 0;
	nbits = strtoul (string+n+3, NULL, 10);
	if (errno)
	err = gpg_error (GPG_ERR_INV_DATA);
	else if (nbits < 1024)
	err = gpg_error (GPG_ERR_TOO_SHORT);
	else if (nbits > 4096)
	err = gpg_error (GPG_ERR_TOO_LARGE);
	else
	err = change_rsa_keyattr (app, keyno, nbits, pincb, pincb_arg);
	}
	else if (algo == PUBKEY_ALGO_ECDH \|\| algo == PUBKEY_ALGO_ECDSA
	\|\| algo == PUBKEY_ALGO_EDDSA)
	{
	const char *oidstr;
	gcry_mpi_t oid;
	const unsigned char *oidbuf;
	size_t oid_len;

	oidstr = openpgp_curve_to_oid (string+n, NULL);
	if (!oidstr)
	{
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}

	err = openpgp_oid_from_str (oidstr, &oid);
	if (err)
	goto leave;

	oidbuf = gcry_mpi_get_opaque (oid, &n);
	oid_len = (n+7)/8;

	/* We have enough room at STRING. */
	string[0] = algo;
	memcpy (string+1, oidbuf+1, oid_len-1);
	err = change_keyattr (app, keyno, string, oid_len, pincb, pincb_arg);
	gcry_mpi_release (oid);
	}
	else
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);

	leave:
	xfree (string);
	return err;
	}


	static gpg_error_t
	rsa_writekey (app_t app, gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg, int keyno,
	const unsigned char *buf, size_t buflen, int depth)
	{
	gpg_error_t err;
	const unsigned char *tok;
	size_t toklen;
	int last_depth1, last_depth2;
	const unsigned char *rsa_n = NULL;
	const unsigned char *rsa_e = NULL;
	const unsigned char *rsa_p = NULL;
	const unsigned char *rsa_q = NULL;
	size_t rsa_n_len, rsa_e_len, rsa_p_len, rsa_q_len;
	unsigned int nbits;
	unsigned int maxbits;
	unsigned char *template = NULL;
	unsigned char *tp;
	size_t template_len;
	unsigned char fprbuf[20];
	u32 created_at = 0;

	if (app->app_local->keyattr[keyno].key_type != KEY_TYPE_RSA)
	{
	log_error (_("unsupported algorithm: %s"), "RSA");
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}

	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 1)
	{
	const unsigned char **mpi;
	size_t *mpi_len;

	switch (*tok)
	{
	case 'n': mpi = &rsa_n; mpi_len = &rsa_n_len; break;
	case 'e': mpi = &rsa_e; mpi_len = &rsa_e_len; break;
	case 'p': mpi = &rsa_p; mpi_len = &rsa_p_len; break;
	case 'q': mpi = &rsa_q; mpi_len = &rsa_q_len;break;
	default: mpi = NULL; mpi_len = NULL; break;
	}
	if (mpi && *mpi)
	{
	err = gpg_error (GPG_ERR_DUP_VALUE);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && mpi)
	{
	/* Strip off leading zero bytes and save. */
	for (;toklen && !*tok; toklen--, tok++)
	;
	*mpi = tok;
	*mpi_len = toklen;
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}
	/* Parse other attributes. */
	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 10 && !memcmp ("created-at", tok, toklen))
	{
	if ((err = parse_sexp (&buf,&buflen,&depth,&tok,&toklen)))
	goto leave;
	if (tok)
	{
	for (created_at=0; toklen && tok && tok >= '0' && *tok <= '9';
	tok++, toklen--)
	created_at = created_at10 + (tok - '0');
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}


	/* Check that we have all parameters and that they match the card
	description. */
	if (!created_at)
	{
	log_error (_("creation timestamp missing\n"));
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].rsa.n_bits;
	nbits = rsa_n? count_bits (rsa_n, rsa_n_len) : 0;
	if (opt.verbose)
	log_info ("RSA modulus size is %u bits (%u bytes)\n",
	nbits, (unsigned int)rsa_n_len);
	if (nbits && nbits != maxbits
	&& app->app_local->extcap.algo_attr_change)
	{
	/* Try to switch the key to a new length. */
	err = change_rsa_keyattr (app, keyno, nbits, pincb, pincb_arg);
	if (!err)
	maxbits = app->app_local->keyattr[keyno].rsa.n_bits;
	}
	if (nbits != maxbits)
	{
	log_error (_("RSA modulus missing or not of size %d bits\n"),
	(int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].rsa.e_bits;
	if (maxbits > 32 && !app->app_local->extcap.is_v2)
	maxbits = 32; /* Our code for v1 does only support 32 bits. */
	nbits = rsa_e? count_bits (rsa_e, rsa_e_len) : 0;
	if (nbits < 2 \|\| nbits > maxbits)
	{
	log_error (_("RSA public exponent missing or larger than %d bits\n"),
	(int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	maxbits = app->app_local->keyattr[keyno].rsa.n_bits/2;
	nbits = rsa_p? count_bits (rsa_p, rsa_p_len) : 0;
	if (nbits != maxbits)
	{
	log_error (_("RSA prime %s missing or not of size %d bits\n"),
	"P", (int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}
	nbits = rsa_q? count_bits (rsa_q, rsa_q_len) : 0;
	if (nbits != maxbits)
	{
	log_error (_("RSA prime %s missing or not of size %d bits\n"),
	"Q", (int)maxbits);
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}

	/* We need to remove the cached public key. */
	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;
	app->app_local->pk[keyno].read_done = 0;


	if (app->app_local->extcap.is_v2)
	{
	unsigned char rsa_u, rsa_dp, *rsa_dq;
	size_t rsa_u_len, rsa_dp_len, rsa_dq_len;
	gcry_mpi_t mpi_e, mpi_p, mpi_q;
	gcry_mpi_t mpi_u = gcry_mpi_snew (0);
	gcry_mpi_t mpi_dp = gcry_mpi_snew (0);
	gcry_mpi_t mpi_dq = gcry_mpi_snew (0);
	gcry_mpi_t mpi_tmp = gcry_mpi_snew (0);
	int exmode;

	/* Calculate the u, dp and dq components needed by RSA_CRT cards */
	gcry_mpi_scan (&mpi_e, GCRYMPI_FMT_USG, rsa_e, rsa_e_len, NULL);
	gcry_mpi_scan (&mpi_p, GCRYMPI_FMT_USG, rsa_p, rsa_p_len, NULL);
	gcry_mpi_scan (&mpi_q, GCRYMPI_FMT_USG, rsa_q, rsa_q_len, NULL);

	gcry_mpi_invm (mpi_u, mpi_q, mpi_p);
	gcry_mpi_sub_ui (mpi_tmp, mpi_p, 1);
	gcry_mpi_invm (mpi_dp, mpi_e, mpi_tmp);
	gcry_mpi_sub_ui (mpi_tmp, mpi_q, 1);
	gcry_mpi_invm (mpi_dq, mpi_e, mpi_tmp);

	gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_u, &rsa_u_len, mpi_u);
	gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dp, &rsa_dp_len, mpi_dp);
	gcry_mpi_aprint (GCRYMPI_FMT_USG, &rsa_dq, &rsa_dq_len, mpi_dq);

	gcry_mpi_release (mpi_e);
	gcry_mpi_release (mpi_p);
	gcry_mpi_release (mpi_q);
	gcry_mpi_release (mpi_u);
	gcry_mpi_release (mpi_dp);
	gcry_mpi_release (mpi_dq);
	gcry_mpi_release (mpi_tmp);

	/* Build the private key template as described in section 4.3.3.7 of
	the OpenPGP card specs version 2.0. */
	err = build_privkey_template (app, keyno,
	rsa_n, rsa_n_len,
	rsa_e, rsa_e_len,
	rsa_p, rsa_p_len,
	rsa_q, rsa_q_len,
	rsa_u, rsa_u_len,
	rsa_dp, rsa_dp_len,
	rsa_dq, rsa_dq_len,
	&template, &template_len);
	xfree(rsa_u);
	xfree(rsa_dp);
	xfree(rsa_dq);

	if (err)
	goto leave;

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	goto leave;

	/* Store the key. */
	if (app->app_local->cardcap.ext_lc_le && template_len > 254)
	exmode = 1; /* Use extended length w/o a limit. */
	else if (app->app_local->cardcap.cmd_chaining && template_len > 254)
	exmode = -254;
	else
	exmode = 0;
	err = iso7816_put_data_odd (app->slot, exmode, 0x3fff,
	template, template_len);
	}
	else
	{
	/* Build the private key template as described in section 4.3.3.6 of
	the OpenPGP card specs version 1.1:
	0xC0 <length> public exponent
	0xC1 <length> prime p
	0xC2 <length> prime q
	*/
	assert (rsa_e_len <= 4);
	template_len = (1 + 1 + 4
	+ 1 + 1 + rsa_p_len
	+ 1 + 1 + rsa_q_len);
	template = tp = xtrymalloc_secure (template_len);
	if (!template)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	*tp++ = 0xC0;
	*tp++ = 4;
	memcpy (tp, rsa_e, rsa_e_len);
	if (rsa_e_len < 4)
	{
	/* Right justify E. */
	memmove (tp+4-rsa_e_len, tp, rsa_e_len);
	memset (tp, 0, 4-rsa_e_len);
	}
	tp += 4;

	*tp++ = 0xC1;
	*tp++ = rsa_p_len;
	memcpy (tp, rsa_p, rsa_p_len);
	tp += rsa_p_len;

	*tp++ = 0xC2;
	*tp++ = rsa_q_len;
	memcpy (tp, rsa_q, rsa_q_len);
	tp += rsa_q_len;

	assert (tp - template == template_len);

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	goto leave;

	/* Store the key. */
	err = iso7816_put_data (app->slot, 0,
	(app->card_version > 0x0007? 0xE0:0xE9)+keyno,
	template, template_len);
	}
	if (err)
	{
	log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
	goto leave;
	}

	err = store_fpr (app, keyno, created_at, fprbuf, PUBKEY_ALGO_RSA,
	rsa_n, rsa_n_len, rsa_e, rsa_e_len);
	if (err)
	goto leave;


	leave:
	xfree (template);
	return err;
	}


	static gpg_error_t
	ecc_writekey (app_t app, gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg, int keyno,
	const unsigned char *buf, size_t buflen, int depth)
	{
	gpg_error_t err;
	const unsigned char *tok;
	size_t toklen;
	int last_depth1, last_depth2;
	const unsigned char *ecc_q = NULL;
	const unsigned char *ecc_d = NULL;
	size_t ecc_q_len, ecc_d_len;
	const char *curve = NULL;
	u32 created_at = 0;
	const char *oidstr;
	int flag_djb_tweak = 0;
	int algo;
	gcry_mpi_t oid = NULL;
	const unsigned char *oidbuf;
	unsigned int n;
	size_t oid_len;
	unsigned char fprbuf[20];

	/* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)):
	curve = "NIST P-256" */
	/* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)):
	curve = "secp256k1" */
	/* (private-key(ecc(curve%s)(flags eddsa)(q%m)(d%m))(created-at%d)):
	curve = "Ed25519" */
	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;

	if (tok && toklen == 5 && !memcmp (tok, "curve", 5))
	{
	char *curve_name;

	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;

	curve_name = xtrymalloc (toklen+1);
	if (!curve_name)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	memcpy (curve_name, tok, toklen);
	curve_name[toklen] = 0;
	curve = openpgp_is_curve_supported (curve_name, NULL, NULL);
	xfree (curve_name);
	}
	else if (tok && toklen == 5 && !memcmp (tok, "flags", 5))
	{
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;

	if (tok)
	{
	if ((toklen == 5 && !memcmp (tok, "eddsa", 5))
	\|\| (toklen == 9 && !memcmp (tok, "djb-tweak", 9)))
	flag_djb_tweak = 1;
	}
	}
	else if (tok && toklen == 1)
	{
	const unsigned char **buf2;
	size_t *buf2len;
	int native = flag_djb_tweak;

	switch (*tok)
	{
	case 'q': buf2 = &ecc_q; buf2len = &ecc_q_len; break;
	case 'd': buf2 = &ecc_d; buf2len = &ecc_d_len; native = 0; break;
	default: buf2 = NULL; buf2len = NULL; break;
	}
	if (buf2 && *buf2)
	{
	err = gpg_error (GPG_ERR_DUP_VALUE);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && buf2)
	{
	if (!native)
	/* Strip off leading zero bytes and save. */
	for (;toklen && !*tok; toklen--, tok++)
	;

	*buf2 = tok;
	*buf2len = toklen;
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}
	/* Parse other attributes. */
	last_depth1 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth1)
	{
	if (tok)
	{
	err = gpg_error (GPG_ERR_UNKNOWN_SEXP);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 10 && !memcmp ("created-at", tok, toklen))
	{
	if ((err = parse_sexp (&buf,&buflen,&depth,&tok,&toklen)))
	goto leave;
	if (tok)
	{
	for (created_at=0; toklen && tok && tok >= '0' && *tok <= '9';
	tok++, toklen--)
	created_at = created_at10 + (tok - '0');
	}
	}
	/* Skip until end of list. */
	last_depth2 = depth;
	while (!(err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))
	&& depth && depth >= last_depth2)
	;
	if (err)
	goto leave;
	}


	/* Check that we have all parameters and that they match the card
	description. */
	if (!curve)
	{
	log_error (_("unsupported curve\n"));
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}
	if (!created_at)
	{
	log_error (_("creation timestamp missing\n"));
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}
	if (flag_djb_tweak && keyno != 1)
	algo = PUBKEY_ALGO_EDDSA;
	else if (keyno == 1)
	algo = PUBKEY_ALGO_ECDH;
	else
	algo = PUBKEY_ALGO_ECDSA;

	oidstr = openpgp_curve_to_oid (curve, NULL);
	err = openpgp_oid_from_str (oidstr, &oid);
	if (err)
	goto leave;
	oidbuf = gcry_mpi_get_opaque (oid, &n);
	if (!oidbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	oid_len = (n+7)/8;

	if (app->app_local->keyattr[keyno].key_type != KEY_TYPE_ECC
	\|\| app->app_local->keyattr[keyno].ecc.curve != curve
	\|\| (flag_djb_tweak !=
	(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)))
	{
	if (app->app_local->extcap.algo_attr_change)
	{
	unsigned char *keyattr;

	if (!oid_len)
	{
	err = gpg_error (GPG_ERR_INTERNAL);
	goto leave;
	}
	keyattr = xtrymalloc (oid_len);
	if (!keyattr)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	keyattr[0] = algo;
	memcpy (keyattr+1, oidbuf+1, oid_len-1);
	err = change_keyattr (app, keyno, keyattr, oid_len, pincb, pincb_arg);
	xfree (keyattr);
	if (err)
	goto leave;
	}
	else
	{
	log_error ("key attribute on card doesn't match\n");
	err = gpg_error (GPG_ERR_INV_VALUE);
	goto leave;
	}
	}

	if (opt.verbose)
	log_info ("ECC private key size is %u bytes\n", (unsigned int)ecc_d_len);

	/* We need to remove the cached public key. */
	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;
	app->app_local->pk[keyno].read_done = 0;

	if (app->app_local->extcap.is_v2)
	{
	/* Build the private key template as described in section 4.3.3.7 of
	the OpenPGP card specs version 2.0. */
	unsigned char *template;
	size_t template_len;
	int exmode;

	err = build_ecc_privkey_template (app, keyno,
	ecc_d, ecc_d_len,
	ecc_q, ecc_q_len,
	&template, &template_len);
	if (err)
	goto leave;

	/* Prepare for storing the key. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	{
	xfree (template);
	goto leave;
	}

	/* Store the key. */
	if (app->app_local->cardcap.ext_lc_le && template_len > 254)
	exmode = 1; /* Use extended length w/o a limit. */
	else if (app->app_local->cardcap.cmd_chaining && template_len > 254)
	exmode = -254;
	else
	exmode = 0;
	err = iso7816_put_data_odd (app->slot, exmode, 0x3fff,
	template, template_len);
	xfree (template);
	}
	else
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);

	if (err)
	{
	log_error (_("failed to store the key: %s\n"), gpg_strerror (err));
	goto leave;
	}

	err = store_fpr (app, keyno, created_at, fprbuf, algo, oidbuf, oid_len,
	ecc_q, ecc_q_len, ecdh_params (curve), (size_t)4);

	leave:
	gcry_mpi_release (oid);
	return err;
	}

	/* Handle the WRITEKEY command for OpenPGP. This function expects a
	canonical encoded S-expression with the secret key in KEYDATA and
	its length (for assertions) in KEYDATALEN. KEYID needs to be the
	usual keyid which for OpenPGP is the string "OPENPGP.n" with
	n=1,2,3. Bit 0 of FLAGS indicates whether an existing key shall
	get overwritten. PINCB and PINCB_ARG are the usual arguments for
	the pinentry callback. */
	static gpg_error_t
	do_writekey (app_t app, ctrl_t ctrl,
	const char *keyid, unsigned int flags,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const unsigned char *keydata, size_t keydatalen)
	{
	gpg_error_t err;
	int force = (flags & 1);
	int keyno;
	const unsigned char buf, tok;
	size_t buflen, toklen;
	int depth;

	(void)ctrl;

	if (!strcmp (keyid, "OPENPGP.1"))
	keyno = 0;
	else if (!strcmp (keyid, "OPENPGP.2"))
	keyno = 1;
	else if (!strcmp (keyid, "OPENPGP.3"))
	keyno = 2;
	else
	return gpg_error (GPG_ERR_INV_ID);

	err = does_key_exist (app, keyno, 0, force);
	if (err)
	return err;


	/*
	Parse the S-expression
	*/
	buf = keydata;
	buflen = keydatalen;
	depth = 0;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (!tok \|\| toklen != 11 \|\| memcmp ("private-key", tok, toklen))
	{
	if (!tok)
	;
	else if (toklen == 21 && !memcmp ("protected-private-key", tok, toklen))
	log_info ("protected-private-key passed to writekey\n");
	else if (toklen == 20 && !memcmp ("shadowed-private-key", tok, toklen))
	log_info ("shadowed-private-key passed to writekey\n");
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	goto leave;
	}
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen)))
	goto leave;
	if (tok && toklen == 3 && memcmp ("rsa", tok, toklen) == 0)
	err = rsa_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth);
	else if (tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0)
	err = ecc_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth);
	else
	{
	err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);
	goto leave;
	}

	leave:
	return err;
	}



	/* Handle the GENKEY command. */
	static gpg_error_t
	do_genkey (app_t app, ctrl_t ctrl, const char *keynostr, unsigned int flags,
	time_t createtime,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	gpg_error_t err;
	char numbuf[30];
	unsigned char *buffer = NULL;
	const unsigned char *keydata;
	size_t buflen, keydatalen;
	u32 created_at;
	int keyno = atoi (keynostr) - 1;
	int force = (flags & 1);
	time_t start_at;
	int exmode = 0;
	int le_value = 256; /* Use legacy value. */

	if (keyno < 0 \|\| keyno > 2)
	return gpg_error (GPG_ERR_INV_ID);

	/* We flush the cache to increase the traffic before a key
	generation. This _might_ help a card to gather more entropy. */
	flush_cache (app);

	/* Obviously we need to remove the cached public key. */
	xfree (app->app_local->pk[keyno].key);
	app->app_local->pk[keyno].key = NULL;
	app->app_local->pk[keyno].keylen = 0;
	app->app_local->pk[keyno].read_done = 0;

	/* Check whether a key already exists. */
	err = does_key_exist (app, keyno, 1, force);
	if (err)
	return err;

	if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
	{
	unsigned int keybits = app->app_local->keyattr[keyno].rsa.n_bits;

	/* Because we send the key parameter back via status lines we need
	to put a limit on the max. allowed keysize. 2048 bit will
	already lead to a 527 byte long status line and thus a 4096 bit
	key would exceed the Assuan line length limit. */
	if (keybits > 4096)
	return gpg_error (GPG_ERR_TOO_LARGE);

	if (app->app_local->cardcap.ext_lc_le && keybits > RSA_SMALL_SIZE_KEY
	&& app->app_local->keyattr[keyno].key_type == KEY_TYPE_RSA)
	{
	exmode = 1; /* Use extended length w/o a limit. */
	le_value = determine_rsa_response (app, keyno);
	/* No need to check le_value because it comes from a 16 bit
	value and thus can't create an overflow on a 32 bit
	system. */
	}
	}

	/* Prepare for key generation by verifying the Admin PIN. */
	err = verify_chv3 (app, pincb, pincb_arg);
	if (err)
	return err;


	log_info (_("please wait while key is being generated ...\n"));
	start_at = time (NULL);
	err = iso7816_generate_keypair (app->slot, exmode,
	(keyno == 0? "\xB6" :
	keyno == 1? "\xB8" : "\xA4"),
	2, le_value, &buffer, &buflen);
	if (err)
	{
	log_error (_("generating key failed\n"));
	return gpg_error (GPG_ERR_CARD);
	}

	{
	int nsecs = (int)(time (NULL) - start_at);
	log_info (ngettext("key generation completed (%d second)\n",
	"key generation completed (%d seconds)\n",
	nsecs), nsecs);
	}

	keydata = find_tlv (buffer, buflen, 0x7F49, &keydatalen);
	if (!keydata)
	{
	err = gpg_error (GPG_ERR_CARD);
	log_error (_("response does not contain the public key data\n"));
	goto leave;
	}

	created_at = (u32)(createtime? createtime : gnupg_get_time ());
	sprintf (numbuf, "%u", created_at);
	send_status_info (ctrl, "KEY-CREATED-AT",
	numbuf, (size_t)strlen(numbuf), NULL, 0);

	err = read_public_key (app, ctrl, created_at, keyno, buffer, buflen);
	leave:
	xfree (buffer);
	return err;
	}


	static unsigned long
	convert_sig_counter_value (const unsigned char *value, size_t valuelen)
	{
	unsigned long ul;

	if (valuelen == 3 )
	ul = (value[0] << 16) \| (value[1] << 8) \| value[2];
	else
	{
	log_error (_("invalid structure of OpenPGP card (DO 0x93)\n"));
	ul = 0;
	}
	return ul;
	}

	static unsigned long
	get_sig_counter (app_t app)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	unsigned long ul;

	relptr = get_one_do (app, 0x0093, &value, &valuelen, NULL);
	if (!relptr)
	return 0;
	ul = convert_sig_counter_value (value, valuelen);
	xfree (relptr);
	return ul;
	}

	static gpg_error_t
	compare_fingerprint (app_t app, int keyno, unsigned char *sha1fpr)
	{
	const unsigned char *fpr;
	unsigned char *buffer;
	size_t buflen, n;
	int rc, i;

	assert (keyno >= 0 && keyno <= 2);

	rc = get_cached_data (app, 0x006E, &buffer, &buflen, 0, 0);
	if (rc)
	{
	log_error (_("error reading application data\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr = find_tlv (buffer, buflen, 0x00C5, &n);
	if (!fpr \|\| n != 60)
	{
	xfree (buffer);
	log_error (_("error reading fingerprint DO\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}
	fpr += keyno*20;
	for (i=0; i < 20; i++)
	if (sha1fpr[i] != fpr[i])
	{
	xfree (buffer);
	log_info (_("fingerprint on card does not match requested one\n"));
	return gpg_error (GPG_ERR_WRONG_SECKEY);
	}
	xfree (buffer);
	return 0;
	}


	/* If a fingerprint has been specified check it against the one on the
	card. This allows for a meaningful error message in case the key
	on the card has been replaced but the shadow information known to
	gpg has not been updated. If there is no fingerprint we assume
	that this is okay. */
	static gpg_error_t
	check_against_given_fingerprint (app_t app, const char *fpr, int key)
	{
	unsigned char tmp[20];
	const char *s;
	int n;

	for (s=fpr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 40)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* okay */
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=fpr, n=0; n < 20; s += 2, n++)
	tmp[n] = xtoi_2 (s);
	return compare_fingerprint (app, key-1, tmp);
	}



	/* Compute a digital signature on INDATA which is expected to be the
	raw message digest. For this application the KEYIDSTR consists of
	the serialnumber and the fingerprint delimited by a slash.

	Note that this function may return the error code
	GPG_ERR_WRONG_CARD to indicate that the card currently present does
	not match the one required for the requested action (e.g. the
	serial number does not match).

	As a special feature a KEYIDSTR of "OPENPGP.3" redirects the
	operation to the auth command.
	*/
	static gpg_error_t
	do_sign (app_t app, const char *keyidstr, int hashalgo,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	static unsigned char rmd160_prefix[15] = /* Object ID is 1.3.36.3.2.1 */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x24, 0x03,
	0x02, 0x01, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char sha1_prefix[15] = /* (1.3.14.3.2.26) */
	{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
	0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
	static unsigned char sha224_prefix[19] = /* (2.16.840.1.101.3.4.2.4) */
	{ 0x30, 0x2D, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x04, 0x05, 0x00, 0x04,
	0x1C };
	static unsigned char sha256_prefix[19] = /* (2.16.840.1.101.3.4.2.1) */
	{ 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05,
	0x00, 0x04, 0x20 };
	static unsigned char sha384_prefix[19] = /* (2.16.840.1.101.3.4.2.2) */
	{ 0x30, 0x41, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05,
	0x00, 0x04, 0x30 };
	static unsigned char sha512_prefix[19] = /* (2.16.840.1.101.3.4.2.3) */
	{ 0x30, 0x51, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86,
	0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05,
	0x00, 0x04, 0x40 };
	int rc;
	unsigned char data[19+64];
	size_t datalen;
	unsigned char tmp_sn[20]; /* Actually 16 bytes but also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;
	unsigned long sigcount;
	int use_auth = 0;
	int exmode, le_value;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Strip off known prefixes. */
	#define X(a,b,c,d) \
	if (hashalgo == GCRY_MD_ ## a \
	&& (d) \
	&& indatalen == sizeof b ## _prefix + (c) \
	&& !memcmp (indata, b ## _prefix, sizeof b ## _prefix)) \
	{ \
	indata = (const char*)indata + sizeof b ## _prefix; \
	indatalen -= sizeof b ## _prefix; \
	}

	if (indatalen == 20)
	; /* Assume a plain SHA-1 or RMD160 digest has been given. */
	else X(SHA1, sha1, 20, 1)
	else X(RMD160, rmd160, 20, 1)
	else X(SHA224, sha224, 28, app->app_local->extcap.is_v2)
	else X(SHA256, sha256, 32, app->app_local->extcap.is_v2)
	else X(SHA384, sha384, 48, app->app_local->extcap.is_v2)
	else X(SHA512, sha512, 64, app->app_local->extcap.is_v2)
	else if ((indatalen == 28 \|\| indatalen == 32
	\|\| indatalen == 48 \|\| indatalen ==64)
	&& app->app_local->extcap.is_v2)
	; /* Assume a plain SHA-3 digest has been given. */
	else
	{
	log_error (_("card does not support digest algorithm %s\n"),
	gcry_md_algo_name (hashalgo));
	/* Or the supplied digest length does not match an algorithm. */
	return gpg_error (GPG_ERR_INV_VALUE);
	}
	#undef X

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.1"))
	;
	else if (!strcmp (keyidstr, "OPENPGP.3"))
	use_auth = 1;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, gpg
	will detect a bogus signature anyway due to the
	verify-after-signing feature. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 1) : 0;
	if (rc)
	return rc;

	/* Concatenate prefix and digest. */
	#define X(a,b,d) \
	if (hashalgo == GCRY_MD_ ## a && (d) ) \
	{ \
	datalen = sizeof b ## _prefix + indatalen; \
	assert (datalen <= sizeof data); \
	memcpy (data, b ## _prefix, sizeof b ## _prefix); \
	memcpy (data + sizeof b ## _prefix, indata, indatalen); \
	}

	if (use_auth
	\|\| app->app_local->keyattr[use_auth? 2: 0].key_type == KEY_TYPE_RSA)
	{
	X(SHA1, sha1, 1)
	else X(RMD160, rmd160, 1)
	else X(SHA224, sha224, app->app_local->extcap.is_v2)
	else X(SHA256, sha256, app->app_local->extcap.is_v2)
	else X(SHA384, sha384, app->app_local->extcap.is_v2)
	else X(SHA512, sha512, app->app_local->extcap.is_v2)
	else
	return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM);
	}
	else
	{
	datalen = indatalen;
	memcpy (data, indata, indatalen);
	}
	#undef X

	/* Redirect to the AUTH command if asked to. */
	if (use_auth)
	{
	return do_auth (app, "OPENPGP.3", pincb, pincb_arg,
	data, datalen,
	outdata, outdatalen);
	}

	/* Show the number of signature done using this key. */
	sigcount = get_sig_counter (app);
	log_info (_("signatures created so far: %lu\n"), sigcount);

	/* Check CHV if needed. */
	if (!app->did_chv1 \|\| app->force_chv1 )
	{
	char *pinvalue;

	rc = verify_a_chv (app, pincb, pincb_arg, 1, sigcount, &pinvalue);
	if (rc)
	return rc;

	app->did_chv1 = 1;

	/* For cards with versions < 2 we want to keep CHV1 and CHV2 in
	sync, thus we verify CHV2 here using the given PIN. Cards
	with version2 to not have the need for a separate CHV2 and
	internally use just one. Obviously we can't do that if the
	pinpad has been used. */
	if (!app->did_chv2 && pinvalue && !app->app_local->extcap.is_v2)
	{
	rc = iso7816_verify (app->slot, 0x82, pinvalue, strlen (pinvalue));
	if (gpg_err_code (rc) == GPG_ERR_BAD_PIN)
	rc = gpg_error (GPG_ERR_PIN_NOT_SYNCED);
	if (rc)
	{
	log_error (_("verify CHV%d failed: %s\n"), 2, gpg_strerror (rc));
	xfree (pinvalue);
	flush_cache_after_error (app);
	return rc;
	}
	app->did_chv2 = 1;
	}
	xfree (pinvalue);
	}


	if (app->app_local->cardcap.ext_lc_le
	&& app->app_local->keyattr[0].key_type == KEY_TYPE_RSA
	&& app->app_local->keyattr[0].rsa.n_bits > RSA_SMALL_SIZE_OP)
	{
	exmode = 1; /* Use extended length. */
	le_value = app->app_local->keyattr[0].rsa.n_bits / 8;
	}
	else
	{
	exmode = 0;
	le_value = 0;
	}
	rc = iso7816_compute_ds (app->slot, exmode, data, datalen, le_value,
	outdata, outdatalen);
	return rc;
	}

	/* Compute a digital signature using the INTERNAL AUTHENTICATE command
	on INDATA which is expected to be the raw message digest. For this
	application the KEYIDSTR consists of the serialnumber and the
	fingerprint delimited by a slash. Optionally the id OPENPGP.3 may
	be given.

	Note that this function may return the error code
	GPG_ERR_WRONG_CARD to indicate that the card currently present does
	not match the one required for the requested action (e.g. the
	serial number does not match). */
	static gpg_error_t
	do_auth (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen )
	{
	int rc;
	unsigned char tmp_sn[20]; /* Actually 16 but we use it also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);
	if (app->app_local->keyattr[2].key_type == KEY_TYPE_RSA
	&& indatalen > 101) /* For a 2048 bit key. */
	return gpg_error (GPG_ERR_INV_VALUE);

	if (app->app_local->keyattr[2].key_type == KEY_TYPE_ECC)
	{
	if (!(app->app_local->keyattr[2].ecc.flags & ECC_FLAG_DJB_TWEAK)
	&& (indatalen == 51 \|\| indatalen == 67 \|\| indatalen == 83))
	{
	const char p = (const char )indata + 19;
	indata = p;
	indatalen -= 19;
	}
	else
	{
	const char p = (const char )indata + 15;
	indata = p;
	indatalen -= 15;
	}
	}

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.3"))
	;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, gpg
	will detect a bogus signature anyway due to the
	verify-after-signing feature. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 3) : 0;
	if (rc)
	return rc;

	rc = verify_chv2 (app, pincb, pincb_arg);
	if (!rc)
	{
	int exmode, le_value;

	if (app->app_local->cardcap.ext_lc_le
	&& app->app_local->keyattr[2].key_type == KEY_TYPE_RSA
	&& app->app_local->keyattr[2].rsa.n_bits > RSA_SMALL_SIZE_OP)
	{
	exmode = 1; /* Use extended length. */
	le_value = app->app_local->keyattr[2].rsa.n_bits / 8;
	}
	else
	{
	exmode = 0;
	le_value = 0;
	}
	rc = iso7816_internal_authenticate (app->slot, exmode,
	indata, indatalen, le_value,
	outdata, outdatalen);
	}
	return rc;
	}


	static gpg_error_t
	do_decipher (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg,
	const void *indata, size_t indatalen,
	unsigned char *outdata, size_t outdatalen,
	unsigned int *r_info)
	{
	int rc;
	unsigned char tmp_sn[20]; /* actually 16 but we use it also for the fpr. */
	const char *s;
	int n;
	const char *fpr = NULL;
	int exmode, le_value;
	unsigned char *fixbuf = NULL;
	int padind = 0;
	int fixuplen = 0;

	if (!keyidstr \|\| !*keyidstr \|\| !indatalen)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check whether an OpenPGP card of any version has been requested. */
	if (!strcmp (keyidstr, "OPENPGP.2"))
	;
	else if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);
	else
	{
	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* no fingerprint given: we allow this for now. */
	else if (*s == '/')
	fpr = s + 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);
	}

	/* If a fingerprint has been specified check it against the one on
	the card. This is allows for a meaningful error message in case
	the key on the card has been replaced but the shadow information
	known to gpg was not updated. If there is no fingerprint, the
	decryption won't produce the right plaintext anyway. */
	rc = fpr? check_against_given_fingerprint (app, fpr, 2) : 0;
	if (rc)
	return rc;

	rc = verify_chv2 (app, pincb, pincb_arg);
	if (rc)
	return rc;

	if ((indatalen == 16 + 1 \|\| indatalen == 32 + 1)
	&& ((char *)indata)[0] == 0x02)
	{
	/* PSO:DECIPHER with symmetric key. */
	padind = -1;
	}
	else if (app->app_local->keyattr[1].key_type == KEY_TYPE_RSA)
	{
	/* We might encounter a couple of leading zeroes in the
	cryptogram. Due to internal use of MPIs these leading zeroes
	are stripped. However the OpenPGP card expects exactly 128
	bytes for the cryptogram (for a 1k key). Thus we need to fix
	it up. We do this for up to 16 leading zero bytes; a
	cryptogram with more than this is with a very high
	probability anyway broken. If a signed conversion was used
	we may also encounter one leading zero followed by the correct
	length. We fix that as well. */
	if (indatalen >= (128-16) && indatalen < 128) /* 1024 bit key. */
	fixuplen = 128 - indatalen;
	else if (indatalen >= (192-16) && indatalen < 192) /* 1536 bit key. */
	fixuplen = 192 - indatalen;
	else if (indatalen >= (256-16) && indatalen < 256) /* 2048 bit key. */
	fixuplen = 256 - indatalen;
	else if (indatalen >= (384-16) && indatalen < 384) /* 3072 bit key. */
	fixuplen = 384 - indatalen;
	else if (indatalen >= (512-16) && indatalen < 512) /* 4096 bit key. */
	fixuplen = 512 - indatalen;
	else if (!(const char )indata && (indatalen == 129
	\|\| indatalen == 193
	\|\| indatalen == 257
	\|\| indatalen == 385
	\|\| indatalen == 513))
	fixuplen = -1;
	else
	fixuplen = 0;

	if (fixuplen > 0)
	{
	/* While we have to prepend stuff anyway, we can also
	include the padding byte here so that iso1816_decipher
	does not need to do another data mangling. */
	fixuplen++;

	fixbuf = xtrymalloc (fixuplen + indatalen);
	if (!fixbuf)
	return gpg_error_from_syserror ();

	memset (fixbuf, 0, fixuplen);
	memcpy (fixbuf+fixuplen, indata, indatalen);
	indata = fixbuf;
	indatalen = fixuplen + indatalen;
	padind = -1; /* Already padded. */
	}
	else if (fixuplen < 0)
	{
	/* We use the extra leading zero as the padding byte. */
	padind = -1;
	}
	}
	else if (app->app_local->keyattr[1].key_type == KEY_TYPE_ECC)
	{
	int old_format_len = 0;

	if ((app->app_local->keyattr[1].ecc.flags & ECC_FLAG_DJB_TWEAK))
	{
	if (indatalen > 32 && (indatalen % 2))
	{ /*
	* Skip the prefix. It may be 0x40 (in new format), or MPI
	* head of 0x00 (in old format).
	*/
	indata = (const char *)indata + 1;
	indatalen--;
	}
	else if (indatalen < 32)
	{ /*
	* Old format trancated by MPI handling.
	*/
	old_format_len = indatalen;
	indatalen = 32;
	}
	}

	fixuplen = 7;
	fixbuf = xtrymalloc (fixuplen + indatalen);
	if (!fixbuf)
	return gpg_error_from_syserror ();

	/* Build 'Cipher DO' */
	fixbuf[0] = '\xa6';
	fixbuf[1] = (char)(indatalen+5);
	fixbuf[2] = '\x7f';
	fixbuf[3] = '\x49';
	fixbuf[4] = (char)(indatalen+2);
	fixbuf[5] = '\x86';
	fixbuf[6] = (char)indatalen;
	if (old_format_len)
	{
	memset (fixbuf+fixuplen, 0, 32 - old_format_len);
	memcpy (fixbuf+fixuplen + 32 - old_format_len,
	indata, old_format_len);
	}
	else
	{
	memcpy (fixbuf+fixuplen, indata, indatalen);
	}
	indata = fixbuf;
	indatalen = fixuplen + indatalen;

	padind = -1;
	}
	else
	return gpg_error (GPG_ERR_INV_VALUE);

	if (app->app_local->cardcap.ext_lc_le
	&& (indatalen > 254
	\|\| (app->app_local->keyattr[1].key_type == KEY_TYPE_RSA
	&& app->app_local->keyattr[1].rsa.n_bits > RSA_SMALL_SIZE_OP)))
	{
	exmode = 1; /* Extended length w/o a limit. */
	le_value = app->app_local->keyattr[1].rsa.n_bits / 8;
	}
	else if (app->app_local->cardcap.cmd_chaining && indatalen > 254)
	{
	exmode = -254; /* Command chaining with max. 254 bytes. */
	le_value = 0;
	}
	else
	exmode = le_value = 0;

	rc = iso7816_decipher (app->slot, exmode,
	indata, indatalen, le_value, padind,
	outdata, outdatalen);
	xfree (fixbuf);
	if (app->app_local->keyattr[1].key_type == KEY_TYPE_ECC)
	{
	unsigned char prefix = 0;

	if (app->app_local->keyattr[1].ecc.flags & ECC_FLAG_DJB_TWEAK)
	prefix = 0x40;
	else if ((outdatalen % 2) == 0) / No 0x04 -> x-coordinate only */
	prefix = 0x41;

	if (prefix)
	{ /* Add the prefix */
	fixbuf = xtrymalloc (*outdatalen + 1);
	if (!fixbuf)
	{
	xfree (*outdata);
	return gpg_error_from_syserror ();
	}
	fixbuf[0] = prefix;
	memcpy (fixbuf+1, outdata, outdatalen);
	xfree (*outdata);
	*outdata = fixbuf;
	outdatalen = outdatalen + 1;
	}
	}

	if (gpg_err_code (rc) == GPG_ERR_CARD /* actual SW is 0x640a */
	&& app->app_local->manufacturer == 5
	&& app->card_version == 0x0200)
	log_info ("NOTE: Cards with manufacturer id 5 and s/n <= 346 (0x15a)"
	" do not work with encryption keys > 2048 bits\n");

	*r_info \|= APP_DECIPHER_INFO_NOPAD;

	return rc;
	}


	/* Perform a simple verify operation for CHV1 and CHV2, so that
	further operations won't ask for CHV2 and it is possible to do a
	cheap check on the PIN: If there is something wrong with the PIN
	entry system, only the regular CHV will get blocked and not the
	dangerous CHV3. KEYIDSTR is the usual card's serial number; an
	optional fingerprint part will be ignored.

	There is a special mode if the keyidstr is "<serialno>[CHV3]" with
	the "[CHV3]" being a literal string: The Admin Pin is checked if
	and only if the retry counter is still at 3. */
	static gpg_error_t
	do_check_pin (app_t app, const char *keyidstr,
	gpg_error_t (pincb)(void, const char , char *),
	void *pincb_arg)
	{
	unsigned char tmp_sn[20];
	const char *s;
	int n;
	int admin_pin = 0;

	if (!keyidstr \|\| !*keyidstr)
	return gpg_error (GPG_ERR_INV_VALUE);

	/* Check whether an OpenPGP card of any version has been requested. */
	if (strlen (keyidstr) < 32 \|\| strncmp (keyidstr, "D27600012401", 12))
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; hexdigitp (s); s++, n++)
	;
	if (n != 32)
	return gpg_error (GPG_ERR_INV_ID);
	else if (!*s)
	; /* No fingerprint given: we allow this for now. */
	else if (*s == '/')
	; /* We ignore a fingerprint. */
	else if (!strcmp (s, "[CHV3]") )
	admin_pin = 1;
	else
	return gpg_error (GPG_ERR_INV_ID);

	for (s=keyidstr, n=0; n < 16; s += 2, n++)
	tmp_sn[n] = xtoi_2 (s);

	if (app->serialnolen != 16)
	return gpg_error (GPG_ERR_INV_CARD);
	if (memcmp (app->serialno, tmp_sn, 16))
	return gpg_error (GPG_ERR_WRONG_CARD);

	/* Yes, there is a race conditions: The user might pull the card
	right here and we won't notice that. However this is not a
	problem and the check above is merely for a graceful failure
	between operations. */

	if (admin_pin)
	{
	void *relptr;
	unsigned char *value;
	size_t valuelen;
	int count;

	relptr = get_one_do (app, 0x00C4, &value, &valuelen, NULL);
	if (!relptr \|\| valuelen < 7)
	{
	log_error (_("error retrieving CHV status from card\n"));
	xfree (relptr);
	return gpg_error (GPG_ERR_CARD);
	}
	count = value[6];
	xfree (relptr);

	if (!count)
	{
	log_info (_("card is permanently locked!\n"));
	return gpg_error (GPG_ERR_BAD_PIN);
	}
	else if (count < 3)
	{
	log_info (_("verification of Admin PIN is currently prohibited "
	"through this command\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}

	app->did_chv3 = 0; /* Force verification. */
	return verify_chv3 (app, pincb, pincb_arg);
	}
	else
	return verify_chv2 (app, pincb, pincb_arg);
	}


	/* Show information about card capabilities. */
	static void
	show_caps (struct app_local_s *s)
	{
	log_info ("Version-2 ......: %s\n", s->extcap.is_v2? "yes":"no");
	log_info ("Get-Challenge ..: %s", s->extcap.get_challenge? "yes":"no");
	if (s->extcap.get_challenge)
	log_printf (" (%u bytes max)", s->extcap.max_get_challenge);
	log_info ("Key-Import .....: %s\n", s->extcap.key_import? "yes":"no");
	log_info ("Change-Force-PW1: %s\n", s->extcap.change_force_chv? "yes":"no");
	log_info ("Private-DOs ....: %s\n", s->extcap.private_dos? "yes":"no");
	log_info ("Algo-Attr-Change: %s\n", s->extcap.algo_attr_change? "yes":"no");
	log_info ("SM-Support .....: %s", s->extcap.sm_supported? "yes":"no");
	if (s->extcap.sm_supported)
	log_printf (" (%s)", s->extcap.sm_algo==2? "3DES":
	(s->extcap.sm_algo==2? "AES-128" : "AES-256"));
	log_info ("Max-Cert3-Len ..: %u\n", s->extcap.max_certlen_3);
	log_info ("Cmd-Chaining ...: %s\n", s->cardcap.cmd_chaining?"yes":"no");
	log_info ("Ext-Lc-Le ......: %s\n", s->cardcap.ext_lc_le?"yes":"no");
	log_info ("Status Indicator: %02X\n", s->status_indicator);
	log_info ("Symmetric crypto: %s\n", s->extcap.has_decrypt? "yes":"no");
	log_info ("Button..........: %s\n", s->extcap.has_button? "yes":"no");

	log_info ("GnuPG-No-Sync ..: %s\n", s->flags.no_sync? "yes":"no");
	log_info ("GnuPG-Def-PW2 ..: %s\n", s->flags.def_chv2? "yes":"no");
	}


	/* Parse the historical bytes in BUFFER of BUFLEN and store them in
	APPLOC. */
	static void
	parse_historical (struct app_local_s *apploc,
	const unsigned char * buffer, size_t buflen)
	{
	/* Example buffer: 00 31 C5 73 C0 01 80 00 90 00 */
	if (buflen < 4)
	{
	log_error ("warning: historical bytes are too short\n");
	return; /* Too short. */
	}
	if (*buffer)
	{
	log_error ("warning: bad category indicator in historical bytes\n");
	return;
	}

	/* Skip category indicator. */
	buffer++;
	buflen--;

	/* Get the status indicator. */
	apploc->status_indicator = buffer[buflen-3];
	buflen -= 3;

	/* Parse the compact TLV. */
	while (buflen)
	{
	unsigned int tag = (*buffer & 0xf0) >> 4;
	unsigned int len = (*buffer & 0x0f);
	if (len+1 > buflen)
	{
	log_error ("warning: bad Compact-TLV in historical bytes\n");
	return; /* Error. */
	}
	buffer++;
	buflen--;
	if (tag == 7 && len == 3)
	{
	/* Card capabilities. */
	apploc->cardcap.cmd_chaining = !!(buffer[2] & 0x80);
	apploc->cardcap.ext_lc_le = !!(buffer[2] & 0x40);
	}
	buffer += len;
	buflen -= len;
	}
	}


	/*
	* Check if the OID in an DER encoding is available by GnuPG/libgcrypt,
	* and return the curve name. Return NULL if not available.
	* The constant string is not allocated dynamically, never free it.
	*/
	static const char *
	ecc_curve (unsigned char *buf, size_t buflen)
	{
	gcry_mpi_t oid;
	char *oidstr;
	const char *result;
	unsigned char *oidbuf;

	oidbuf = xtrymalloc (buflen + 1);
	if (!oidbuf)
	return NULL;

	memcpy (oidbuf+1, buf, buflen);
	oidbuf[0] = buflen;
	oid = gcry_mpi_set_opaque (NULL, oidbuf, (buflen+1) * 8);
	if (!oid)
	{
	xfree (oidbuf);
	return NULL;
	}

	oidstr = openpgp_oid_to_str (oid);
	gcry_mpi_release (oid);
	if (!oidstr)
	return NULL;

	result = openpgp_oid_to_curve (oidstr, 1);
	xfree (oidstr);
	return result;
	}


	/* Parse and optionally show the algorithm attributes for KEYNO.
	KEYNO must be in the range 0..2. */
	static void
	parse_algorithm_attribute (app_t app, int keyno)
	{
	unsigned char *buffer;
	size_t buflen;
	void *relptr;
	const char desc[3][5] = {"sign", "encr", "auth"};

	assert (keyno >=0 && keyno <= 2);

	app->app_local->keyattr[keyno].key_type = KEY_TYPE_RSA;
	app->app_local->keyattr[keyno].rsa.n_bits = 0;

	relptr = get_one_do (app, 0xC1+keyno, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
	return;
	}
	if (buflen < 1)
	{
	log_error ("error reading DO 0x%02X\n", 0xc1+keyno);
	xfree (relptr);
	return;
	}

	if (opt.verbose)
	log_info ("Key-Attr-%s ..: ", desc[keyno]);
	if (*buffer == PUBKEY_ALGO_RSA && (buflen == 5 \|\| buflen == 6))
	{
	app->app_local->keyattr[keyno].rsa.n_bits = (buffer[1]<<8 \| buffer[2]);
	app->app_local->keyattr[keyno].rsa.e_bits = (buffer[3]<<8 \| buffer[4]);
	app->app_local->keyattr[keyno].rsa.format = 0;
	if (buflen < 6)
	app->app_local->keyattr[keyno].rsa.format = RSA_STD;
	else
	app->app_local->keyattr[keyno].rsa.format = (buffer[5] == 0? RSA_STD :
	buffer[5] == 1? RSA_STD_N :
	buffer[5] == 2? RSA_CRT :
	buffer[5] == 3? RSA_CRT_N :
	RSA_UNKNOWN_FMT);

	if (opt.verbose)
	log_printf
	("RSA, n=%u, e=%u, fmt=%s\n",
	app->app_local->keyattr[keyno].rsa.n_bits,
	app->app_local->keyattr[keyno].rsa.e_bits,
	app->app_local->keyattr[keyno].rsa.format == RSA_STD? "std" :
	app->app_local->keyattr[keyno].rsa.format == RSA_STD_N?"std+n":
	app->app_local->keyattr[keyno].rsa.format == RSA_CRT? "crt" :
	app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N?"crt+n":"?");
	}
	else if (buffer == PUBKEY_ALGO_ECDH \|\| buffer == PUBKEY_ALGO_ECDSA
	\|\| *buffer == PUBKEY_ALGO_EDDSA)
	{
	const char *curve;
	int oidlen = buflen - 1;

	app->app_local->keyattr[keyno].ecc.flags = 0;

	if (buffer[buflen-1] == 0x00 \|\| buffer[buflen-1] == 0xff)
	{ /* Found "pubkey required"-byte for private key template. */
	oidlen--;
	if (buffer[buflen-1] == 0xff)
	app->app_local->keyattr[keyno].ecc.flags \|= ECC_FLAG_PUBKEY;
	}

	curve = ecc_curve (buffer + 1, oidlen);

	if (!curve)
	log_printhex ("Curve with OID not supported: ", buffer+1, buflen-1);
	else
	{
	app->app_local->keyattr[keyno].key_type = KEY_TYPE_ECC;
	app->app_local->keyattr[keyno].ecc.curve = curve;
	if (*buffer == PUBKEY_ALGO_EDDSA
	\|\| (*buffer == PUBKEY_ALGO_ECDH
	&& !strcmp (app->app_local->keyattr[keyno].ecc.curve,
	"Curve25519")))
	app->app_local->keyattr[keyno].ecc.flags \|= ECC_FLAG_DJB_TWEAK;
	if (opt.verbose)
	log_printf
	("ECC, curve=%s%s\n", app->app_local->keyattr[keyno].ecc.curve,
	!(app->app_local->keyattr[keyno].ecc.flags & ECC_FLAG_DJB_TWEAK)?
	"": keyno==1? " (djb-tweak)": " (eddsa)");
	}
	}
	else if (opt.verbose)
	log_printhex ("", buffer, buflen);

	xfree (relptr);
	}

	/* Select the OpenPGP application on the card in SLOT. This function
	must be used before any other OpenPGP application functions. */
	gpg_error_t
	app_select_openpgp (app_t app)
	{
	static char const aid[] = { 0xD2, 0x76, 0x00, 0x01, 0x24, 0x01 };
	int slot = app->slot;
	int rc;
	unsigned char *buffer;
	size_t buflen;
	void *relptr;

	/* Note that the card can't cope with P2=0xCO, thus we need to pass a
	special flag value. */
	rc = iso7816_select_application (slot, aid, sizeof aid, 0x0001);
	if (!rc)
	{
	unsigned int manufacturer;

	app->apptype = "OPENPGP";

	app->did_chv1 = 0;
	app->did_chv2 = 0;
	app->did_chv3 = 0;
	app->app_local = NULL;

	/* The OpenPGP card returns the serial number as part of the
	AID; because we prefer to use OpenPGP serial numbers, we
	replace a possibly already set one from a EF.GDO with this
	one. Note, that for current OpenPGP cards, no EF.GDO exists
	and thus it won't matter at all. */
	rc = iso7816_get_data (slot, 0, 0x004F, &buffer, &buflen);
	if (rc)
	goto leave;
	if (opt.verbose)
	{
	log_info ("AID: ");
	log_printhex ("", buffer, buflen);
	}

	app->card_version = buffer[6] << 8;
	app->card_version \|= buffer[7];
	manufacturer = (buffer[8]<<8 \| buffer[9]);

	xfree (app->serialno);
	app->serialno = buffer;
	app->serialnolen = buflen;
	buffer = NULL;
	app->app_local = xtrycalloc (1, sizeof *app->app_local);
	if (!app->app_local)
	{
	rc = gpg_error (gpg_err_code_from_errno (errno));
	goto leave;
	}

	app->app_local->manufacturer = manufacturer;

	if (app->card_version >= 0x0200)
	app->app_local->extcap.is_v2 = 1;


	/* Read the historical bytes. */
	relptr = get_one_do (app, 0x5f52, &buffer, &buflen, NULL);
	if (relptr)
	{
	if (opt.verbose)
	{
	log_info ("Historical Bytes: ");
	log_printhex ("", buffer, buflen);
	}
	parse_historical (app->app_local, buffer, buflen);
	xfree (relptr);
	}

	/* Read the force-chv1 flag. */
	relptr = get_one_do (app, 0x00C4, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error (_("can't access %s - invalid OpenPGP card?\n"),
	"CHV Status Bytes");
	goto leave;
	}
	app->force_chv1 = (buflen && *buffer == 0);
	xfree (relptr);

	/* Read the extended capabilities. */
	relptr = get_one_do (app, 0x00C0, &buffer, &buflen, NULL);
	if (!relptr)
	{
	log_error (_("can't access %s - invalid OpenPGP card?\n"),
	"Extended Capability Flags" );
	goto leave;
	}
	if (buflen)
	{
	app->app_local->extcap.sm_supported = !!(*buffer & 0x80);
	app->app_local->extcap.get_challenge = !!(*buffer & 0x40);
	app->app_local->extcap.key_import = !!(*buffer & 0x20);
	app->app_local->extcap.change_force_chv = !!(*buffer & 0x10);
	app->app_local->extcap.private_dos = !!(*buffer & 0x08);
	app->app_local->extcap.algo_attr_change = !!(*buffer & 0x04);
	app->app_local->extcap.has_decrypt = !!(*buffer & 0x02);
	}
	if (buflen >= 10)
	{
	/* Available with v2 cards. */
	app->app_local->extcap.sm_algo = buffer[1];
	app->app_local->extcap.max_get_challenge
	= (buffer[2] << 8 \| buffer[3]);
	app->app_local->extcap.max_certlen_3 = (buffer[4] << 8 \| buffer[5]);
	}
	xfree (relptr);

	/* Some of the first cards accidentally don't set the
	CHANGE_FORCE_CHV bit but allow it anyway. */
	if (app->card_version <= 0x0100 && manufacturer == 1)
	app->app_local->extcap.change_force_chv = 1;

	/* Check optional DO of "General Feature Management" for button. */
	relptr = get_one_do (app, 0x7f74, &buffer, &buflen, NULL);
	if (relptr)
	/* It must be: 03 81 01 20 */
	app->app_local->extcap.has_button = 1;

	parse_login_data (app);

	if (opt.verbose)
	show_caps (app->app_local);

	parse_algorithm_attribute (app, 0);
	parse_algorithm_attribute (app, 1);
	parse_algorithm_attribute (app, 2);

	if (opt.verbose > 1)
	dump_all_do (slot);

	app->fnc.deinit = do_deinit;
	app->fnc.learn_status = do_learn_status;
	app->fnc.readcert = do_readcert;
	app->fnc.readkey = do_readkey;
	app->fnc.getattr = do_getattr;
	app->fnc.setattr = do_setattr;
	app->fnc.writecert = do_writecert;
	app->fnc.writekey = do_writekey;
	app->fnc.genkey = do_genkey;
	app->fnc.sign = do_sign;
	app->fnc.auth = do_auth;
	app->fnc.decipher = do_decipher;
	app->fnc.change_pin = do_change_pin;
	app->fnc.check_pin = do_check_pin;
	}

	leave:
	if (rc)
	do_deinit (app);
	return rc;
	}
	diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
	index 1a01ff0a1..40b25991e 100644
	--- a/scd/ccid-driver.c
	+++ b/scd/ccid-driver.c
	@@ -1,4266 +1,4266 @@
	/* ccid-driver.c - USB ChipCardInterfaceDevices driver
	* Copyright (C) 2003, 2004, 2005, 2006, 2007
	* 2008, 2009, 2013 Free Software Foundation, Inc.
	* Written by Werner Koch.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*
	* ALTERNATIVELY, this file may be distributed under the terms of the
	* following license, in which case the provisions of this license are
	* required INSTEAD OF the GNU General Public License. If you wish to
	* allow use of your version of this file only under the terms of the
	* GNU General Public License, and not to allow others to use your
	* version of this file under the terms of the following license,
	* indicate your decision by deleting this paragraph and the license
	* below.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, and the entire permission notice in its entirety,
	* including the disclaimer of warranties.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	* 3. The name of the author may not be used to endorse or promote
	* products derived from this software without specific prior
	* written permission.
	*
	* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
	* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
	* DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
	* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
	* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
	* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
	* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
	* OF THE POSSIBILITY OF SUCH DAMAGE.
	*/


	/* CCID (ChipCardInterfaceDevices) is a specification for accessing
	smartcard via a reader connected to the USB.

	This is a limited driver allowing to use some CCID drivers directly
	without any other specila drivers. This is a fallback driver to be
	used when nothing else works or the system should be kept minimal
	for security reasons. It makes use of the libusb library to gain
	portable access to USB.

	This driver has been tested with the SCM SCR335 and SPR532
	smartcard readers and requires that a reader implements APDU or
	TPDU level exchange and does fully automatic initialization.
	*/

	#ifdef HAVE_CONFIG_H
	# include <config.h>
	#endif

	#if defined(HAVE_LIBUSB) \|\| defined(TEST)

	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <fcntl.h>
	#include <time.h>
	#include <unistd.h>
	#ifdef HAVE_NPTH
	# include <npth.h>
	#endif /HAVE_NPTH/

	#include <libusb.h>

	#include "scdaemon.h"
	#include "iso7816.h"
	#define CCID_DRIVER_INCLUDE_USB_IDS 1
	#include "ccid-driver.h"

	#define DRVNAME "ccid-driver: "

	/* Max length of buffer with out CCID message header of 10-byte
	Sending: 547 for RSA-4096 key import
	APDU size = 540 (24+4+256+256)
	commnd + lc + le = 4 + 3 + 0
	Sending: write data object of cardholder certificate
	APDU size = 2048
	commnd + lc + le = 4 + 3 + 0
	Receiving: 2048 for cardholder certificate
	*/
	#define CCID_MAX_BUF (2048+7+10)

	/* CCID command timeout. OpenPGPcard v2.1 requires timeout of 13 seconds. */
	#define CCID_CMD_TIMEOUT (13*1000)

	/* Depending on how this source is used we either define our error
	output to go to stderr or to the GnuPG based logging functions. We
	use the latter when GNUPG_MAJOR_VERSION or GNUPG_SCD_MAIN_HEADER
	are defined. */
	#if defined(GNUPG_MAJOR_VERSION) \|\| defined(GNUPG_SCD_MAIN_HEADER)

	#if defined(GNUPG_SCD_MAIN_HEADER)
	# include GNUPG_SCD_MAIN_HEADER
	#elif GNUPG_MAJOR_VERSION == 1 /* GnuPG Version is < 1.9. */
	# include "options.h"
	# include "util.h"
	# include "memory.h"
	# include "cardglue.h"
	# else /* This is the modularized GnuPG 1.9 or later. */
	# include "scdaemon.h"
	#endif


	# define DEBUGOUT(t) do { if (debug_level) \
	log_debug (DRVNAME t); } while (0)
	# define DEBUGOUT_1(t,a) do { if (debug_level) \
	log_debug (DRVNAME t,(a)); } while (0)
	# define DEBUGOUT_2(t,a,b) do { if (debug_level) \
	log_debug (DRVNAME t,(a),(b)); } while (0)
	# define DEBUGOUT_3(t,a,b,c) do { if (debug_level) \
	log_debug (DRVNAME t,(a),(b),(c));} while (0)
	# define DEBUGOUT_4(t,a,b,c,d) do { if (debug_level) \
	log_debug (DRVNAME t,(a),(b),(c),(d));} while (0)
	# define DEBUGOUT_CONT(t) do { if (debug_level) \
	log_printf (t); } while (0)
	# define DEBUGOUT_CONT_1(t,a) do { if (debug_level) \
	log_printf (t,(a)); } while (0)
	# define DEBUGOUT_CONT_2(t,a,b) do { if (debug_level) \
	log_printf (t,(a),(b)); } while (0)
	# define DEBUGOUT_CONT_3(t,a,b,c) do { if (debug_level) \
	log_printf (t,(a),(b),(c)); } while (0)
	# define DEBUGOUT_LF() do { if (debug_level) \
	log_printf ("\n"); } while (0)

	#else /* Other usage of this source - don't use gnupg specifics. */

	# define DEBUGOUT(t) do { if (debug_level) \
	fprintf (stderr, DRVNAME t); } while (0)
	# define DEBUGOUT_1(t,a) do { if (debug_level) \
	fprintf (stderr, DRVNAME t, (a)); } while (0)
	# define DEBUGOUT_2(t,a,b) do { if (debug_level) \
	fprintf (stderr, DRVNAME t, (a), (b)); } while (0)
	# define DEBUGOUT_3(t,a,b,c) do { if (debug_level) \
	fprintf (stderr, DRVNAME t, (a), (b), (c)); } while (0)
	# define DEBUGOUT_4(t,a,b,c,d) do { if (debug_level) \
	fprintf (stderr, DRVNAME t, (a), (b), (c), (d));} while(0)
	# define DEBUGOUT_CONT(t) do { if (debug_level) \
	fprintf (stderr, t); } while (0)
	# define DEBUGOUT_CONT_1(t,a) do { if (debug_level) \
	fprintf (stderr, t, (a)); } while (0)
	# define DEBUGOUT_CONT_2(t,a,b) do { if (debug_level) \
	fprintf (stderr, t, (a), (b)); } while (0)
	# define DEBUGOUT_CONT_3(t,a,b,c) do { if (debug_level) \
	fprintf (stderr, t, (a), (b), (c)); } while (0)
	# define DEBUGOUT_LF() do { if (debug_level) \
	putc ('\n', stderr); } while (0)

	#endif /* This source not used by scdaemon. */


	#ifndef EAGAIN
	#define EAGAIN EWOULDBLOCK
	#endif



	enum {
	RDR_to_PC_NotifySlotChange= 0x50,
	RDR_to_PC_HardwareError = 0x51,

	PC_to_RDR_SetParameters = 0x61,
	PC_to_RDR_IccPowerOn = 0x62,
	PC_to_RDR_IccPowerOff = 0x63,
	PC_to_RDR_GetSlotStatus = 0x65,
	PC_to_RDR_Secure = 0x69,
	PC_to_RDR_T0APDU = 0x6a,
	PC_to_RDR_Escape = 0x6b,
	PC_to_RDR_GetParameters = 0x6c,
	PC_to_RDR_ResetParameters = 0x6d,
	PC_to_RDR_IccClock = 0x6e,
	PC_to_RDR_XfrBlock = 0x6f,
	PC_to_RDR_Mechanical = 0x71,
	PC_to_RDR_Abort = 0x72,
	PC_to_RDR_SetDataRate = 0x73,

	RDR_to_PC_DataBlock = 0x80,
	RDR_to_PC_SlotStatus = 0x81,
	RDR_to_PC_Parameters = 0x82,
	RDR_to_PC_Escape = 0x83,
	RDR_to_PC_DataRate = 0x84
	};


	/* Two macro to detect whether a CCID command has failed and to get
	the error code. These macros assume that we can access the
	mandatory first 10 bytes of a CCID message in BUF. */
	#define CCID_COMMAND_FAILED(buf) ((buf)[7] & 0x40)
	#define CCID_ERROR_CODE(buf) (((unsigned char *)(buf))[8])


	/* A list and a table with special transport descriptions. */
	enum {
	TRANSPORT_USB = 0, /* Standard USB transport. */
	TRANSPORT_CM4040 = 1 /* As used by the Cardman 4040. */
	};

	static struct
	{
	char name; / Device name. */
	int type;

	} transports[] = {
	{ "/dev/cmx0", TRANSPORT_CM4040 },
	{ "/dev/cmx1", TRANSPORT_CM4040 },
	{ NULL },
	};


	/* Store information on the driver's state. A pointer to such a
	structure is used as handle for most functions. */
	struct ccid_driver_s
	{
	libusb_device_handle *idev;
	int dev_fd; /* -1 for USB transport or file descriptor of the
	transport device. */
	unsigned int bai;
	unsigned short id_vendor;
	unsigned short id_product;
	int ifc_no;
	int ep_bulk_out;
	int ep_bulk_in;
	int ep_intr;
	int seqno;
	unsigned char t1_ns;
	unsigned char t1_nr;
	unsigned char nonnull_nad;
	int max_ifsd;
	int max_ccid_msglen;
	int ifsc;
	unsigned char apdu_level:2; /* Reader supports short APDU level
	exchange. With a value of 2 short
	and extended level is supported.*/
	unsigned int auto_voltage:1;
	unsigned int auto_param:1;
	unsigned int auto_pps:1;
	unsigned int auto_ifsd:1;
	unsigned int has_pinpad:2;
	unsigned int enodev_seen:1;
	int powered_off;

	time_t last_progress; /* Last time we sent progress line. */

	/* The progress callback and its first arg as supplied to
	ccid_set_progress_cb. */
	void (progress_cb)(void , const char *, int, int, int);
	void *progress_cb_arg;

	unsigned char intr_buf[64];
	struct libusb_transfer *transfer;
	};


	static int initialized_usb; /* Tracks whether USB has been initialized. */
	static int debug_level; /* Flag to control the debug output.
	0 = No debugging
	1 = USB I/O info
	2 = Level 1 + T=1 protocol tracing
	3 = Level 2 + USB/I/O tracing of SlotStatus.
	*/
	static int ccid_usb_thread_is_alive;


	static unsigned int compute_edc (const unsigned char *data, size_t datalen,
	int use_crc);
	static int bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
	int no_debug);
	static int bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
	size_t *nread, int expected_type, int seqno, int timeout,
	int no_debug);
	static int abort_cmd (ccid_driver_t handle, int seqno);
	static int send_escape_cmd (ccid_driver_t handle, const unsigned char *data,
	size_t datalen, unsigned char *result,
	size_t resultmax, size_t *resultlen);

	/* Convert a little endian stored 4 byte value into an unsigned
	integer. */
	static unsigned int
	convert_le_u32 (const unsigned char *buf)
	{
	return buf[0] \| (buf[1] << 8) \| (buf[2] << 16) \| ((unsigned int)buf[3] << 24);
	}


	/* Convert a little endian stored 2 byte value into an unsigned
	integer. */
	static unsigned int
	convert_le_u16 (const unsigned char *buf)
	{
	return buf[0] \| (buf[1] << 8);
	}

	static void
	set_msg_len (unsigned char *msg, unsigned int length)
	{
	msg[1] = length;
	msg[2] = length >> 8;
	msg[3] = length >> 16;
	msg[4] = length >> 24;
	}


	static void
	my_sleep (int seconds)
	{
	#ifdef USE_NPTH
	npth_sleep (seconds);
	#else
	# ifdef HAVE_W32_SYSTEM
	Sleep (seconds*1000);
	# else
	sleep (seconds);
	# endif
	#endif
	}

	static void
	print_progress (ccid_driver_t handle)
	{
	time_t ct = time (NULL);

	/* We don't want to print progress lines too often. */
	if (ct == handle->last_progress)
	return;

	if (handle->progress_cb)
	handle->progress_cb (handle->progress_cb_arg, "card_busy", 'w', 0, 0);

	handle->last_progress = ct;
	}



	/* Pint an error message for a failed CCID command including a textual
	error code. MSG shall be the CCID message at a minimum of 10 bytes. */
	static void
	print_command_failed (const unsigned char *msg)
	{
	const char *t;
	char buffer[100];
	int ec;

	if (!debug_level)
	return;

	ec = CCID_ERROR_CODE (msg);
	switch (ec)
	{
	case 0x00: t = "Command not supported"; break;

	case 0xE0: t = "Slot busy"; break;
	case 0xEF: t = "PIN cancelled"; break;
	case 0xF0: t = "PIN timeout"; break;

	case 0xF2: t = "Automatic sequence ongoing"; break;
	case 0xF3: t = "Deactivated Protocol"; break;
	case 0xF4: t = "Procedure byte conflict"; break;
	case 0xF5: t = "ICC class not supported"; break;
	case 0xF6: t = "ICC protocol not supported"; break;
	case 0xF7: t = "Bad checksum in ATR"; break;
	case 0xF8: t = "Bad TS in ATR"; break;

	case 0xFB: t = "An all inclusive hardware error occurred"; break;
	case 0xFC: t = "Overrun error while talking to the ICC"; break;
	case 0xFD: t = "Parity error while talking to the ICC"; break;
	case 0xFE: t = "CCID timed out while talking to the ICC"; break;
	case 0xFF: t = "Host aborted the current activity"; break;

	default:
	if (ec > 0 && ec < 128)
	sprintf (buffer, "Parameter error at offset %d", ec);
	else
	sprintf (buffer, "Error code %02X", ec);
	t = buffer;
	break;
	}
	DEBUGOUT_1 ("CCID command failed: %s\n", t);
	}


	static void
	print_pr_data (const unsigned char *data, size_t datalen, size_t off)
	{
	int any = 0;

	for (; off < datalen; off++)
	{
	if (!any \|\| !(off % 16))
	{
	if (any)
	DEBUGOUT_LF ();
	DEBUGOUT_1 (" [%04lu] ", (unsigned long) off);
	}
	DEBUGOUT_CONT_1 (" %02X", data[off]);
	any = 1;
	}
	if (any && (off % 16))
	DEBUGOUT_LF ();
	}


	static void
	print_p2r_header (const char name, const unsigned char msg, size_t msglen)
	{
	DEBUGOUT_1 ("%s:\n", name);
	if (msglen < 7)
	return;
	DEBUGOUT_1 (" dwLength ..........: %u\n", convert_le_u32 (msg+1));
	DEBUGOUT_1 (" bSlot .............: %u\n", msg[5]);
	DEBUGOUT_1 (" bSeq ..............: %u\n", msg[6]);
	}


	static void
	print_p2r_iccpoweron (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_IccPowerOn", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_2 (" bPowerSelect ......: 0x%02x (%s)\n", msg[7],
	msg[7] == 0? "auto":
	msg[7] == 1? "5.0 V":
	msg[7] == 2? "3.0 V":
	msg[7] == 3? "1.8 V":"");
	print_pr_data (msg, msglen, 8);
	}


	static void
	print_p2r_iccpoweroff (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_IccPowerOff", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_getslotstatus (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_GetSlotStatus", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_xfrblock (const unsigned char *msg, size_t msglen)
	{
	unsigned int val;

	print_p2r_header ("PC_to_RDR_XfrBlock", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bBWI ..............: 0x%02x\n", msg[7]);
	val = convert_le_u16 (msg+8);
	DEBUGOUT_2 (" wLevelParameter ...: 0x%04x%s\n", val,
	val == 1? " (continued)":
	val == 2? " (continues+ends)":
	val == 3? " (continues+continued)":
	val == 16? " (DataBlock-expected)":"");
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_p2r_getparameters (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_GetParameters", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_resetparameters (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_ResetParameters", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_setparameters (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_SetParameters", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bProtocolNum ......: 0x%02x\n", msg[7]);
	print_pr_data (msg, msglen, 8);
	}


	static void
	print_p2r_escape (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_Escape", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_iccclock (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_IccClock", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bClockCommand .....: 0x%02x\n", msg[7]);
	print_pr_data (msg, msglen, 8);
	}


	static void
	print_p2r_to0apdu (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_T0APDU", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bmChanges .........: 0x%02x\n", msg[7]);
	DEBUGOUT_1 (" bClassGetResponse .: 0x%02x\n", msg[8]);
	DEBUGOUT_1 (" bClassEnvelope ....: 0x%02x\n", msg[9]);
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_p2r_secure (const unsigned char *msg, size_t msglen)
	{
	unsigned int val;

	print_p2r_header ("PC_to_RDR_Secure", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bBMI ..............: 0x%02x\n", msg[7]);
	val = convert_le_u16 (msg+8);
	DEBUGOUT_2 (" wLevelParameter ...: 0x%04x%s\n", val,
	val == 1? " (continued)":
	val == 2? " (continues+ends)":
	val == 3? " (continues+continued)":
	val == 16? " (DataBlock-expected)":"");
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_p2r_mechanical (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_Mechanical", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bFunction .........: 0x%02x\n", msg[7]);
	print_pr_data (msg, msglen, 8);
	}


	static void
	print_p2r_abort (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_Abort", msg, msglen);
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_setdatarate (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("PC_to_RDR_SetDataRate", msg, msglen);
	if (msglen < 10)
	return;
	print_pr_data (msg, msglen, 7);
	}


	static void
	print_p2r_unknown (const unsigned char *msg, size_t msglen)
	{
	print_p2r_header ("Unknown PC_to_RDR command", msg, msglen);
	if (msglen < 10)
	return;
	print_pr_data (msg, msglen, 0);
	}


	static void
	print_r2p_header (const char name, const unsigned char msg, size_t msglen)
	{
	DEBUGOUT_1 ("%s:\n", name);
	if (msglen < 9)
	return;
	DEBUGOUT_1 (" dwLength ..........: %u\n", convert_le_u32 (msg+1));
	DEBUGOUT_1 (" bSlot .............: %u\n", msg[5]);
	DEBUGOUT_1 (" bSeq ..............: %u\n", msg[6]);
	DEBUGOUT_1 (" bStatus ...........: %u\n", msg[7]);
	if (msg[8])
	DEBUGOUT_1 (" bError ............: %u\n", msg[8]);
	}


	static void
	print_r2p_datablock (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("RDR_to_PC_DataBlock", msg, msglen);
	if (msglen < 10)
	return;
	if (msg[9])
	DEBUGOUT_2 (" bChainParameter ...: 0x%02x%s\n", msg[9],
	msg[9] == 1? " (continued)":
	msg[9] == 2? " (continues+ends)":
	msg[9] == 3? " (continues+continued)":
	msg[9] == 16? " (XferBlock-expected)":"");
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_r2p_slotstatus (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("RDR_to_PC_SlotStatus", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_2 (" bClockStatus ......: 0x%02x%s\n", msg[9],
	msg[9] == 0? " (running)":
	msg[9] == 1? " (stopped-L)":
	msg[9] == 2? " (stopped-H)":
	msg[9] == 3? " (stopped)":"");
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_r2p_parameters (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("RDR_to_PC_Parameters", msg, msglen);
	if (msglen < 10)
	return;

	DEBUGOUT_1 (" protocol ..........: T=%d\n", msg[9]);
	if (msglen == 17 && msg[9] == 1)
	{
	/* Protocol T=1. */
	DEBUGOUT_1 (" bmFindexDindex ....: %02X\n", msg[10]);
	DEBUGOUT_1 (" bmTCCKST1 .........: %02X\n", msg[11]);
	DEBUGOUT_1 (" bGuardTimeT1 ......: %02X\n", msg[12]);
	DEBUGOUT_1 (" bmWaitingIntegersT1: %02X\n", msg[13]);
	DEBUGOUT_1 (" bClockStop ........: %02X\n", msg[14]);
	DEBUGOUT_1 (" bIFSC .............: %d\n", msg[15]);
	DEBUGOUT_1 (" bNadValue .........: %d\n", msg[16]);
	}
	else
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_r2p_escape (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("RDR_to_PC_Escape", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" buffer[9] .........: %02X\n", msg[9]);
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_r2p_datarate (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("RDR_to_PC_DataRate", msg, msglen);
	if (msglen < 10)
	return;
	if (msglen >= 18)
	{
	DEBUGOUT_1 (" dwClockFrequency ..: %u\n", convert_le_u32 (msg+10));
	DEBUGOUT_1 (" dwDataRate ..... ..: %u\n", convert_le_u32 (msg+14));
	print_pr_data (msg, msglen, 18);
	}
	else
	print_pr_data (msg, msglen, 10);
	}


	static void
	print_r2p_unknown (const unsigned char *msg, size_t msglen)
	{
	print_r2p_header ("Unknown RDR_to_PC command", msg, msglen);
	if (msglen < 10)
	return;
	DEBUGOUT_1 (" bMessageType ......: %02X\n", msg[0]);
	DEBUGOUT_1 (" buffer[9] .........: %02X\n", msg[9]);
	print_pr_data (msg, msglen, 10);
	}


	/* Given a handle used for special transport prepare it for use. In
	particular setup all information in way that resembles what
	parse_cccid_descriptor does. */
	static void
	prepare_special_transport (ccid_driver_t handle)
	{
	assert (!handle->id_vendor);

	handle->nonnull_nad = 0;
	handle->auto_ifsd = 0;
	handle->max_ifsd = 32;
	handle->max_ccid_msglen = CCID_MAX_BUF;
	handle->has_pinpad = 0;
	handle->apdu_level = 0;
	switch (handle->id_product)
	{
	case TRANSPORT_CM4040:
	DEBUGOUT ("setting up transport for CardMan 4040\n");
	handle->apdu_level = 1;
	break;

	default: assert (!"transport not defined");
	}
	}

	/* Parse a CCID descriptor, optionally print all available features
	and test whether this reader is usable by this driver. Returns 0
	if it is usable.

	Note, that this code is based on the one in lsusb.c of the
	usb-utils package, I wrote on 2003-09-01. -wk. */
	static int
	parse_ccid_descriptor (ccid_driver_t handle, unsigned short bcd_device,
	const unsigned char *buf, size_t buflen)
	{
	unsigned int i;
	unsigned int us;
	int have_t1 = 0, have_tpdu=0;

	handle->nonnull_nad = 0;
	handle->auto_ifsd = 0;
	handle->max_ifsd = 32;
	handle->has_pinpad = 0;
	handle->apdu_level = 0;
	handle->auto_voltage = 0;
	handle->auto_param = 0;
	handle->auto_pps = 0;
	DEBUGOUT_3 ("idVendor: %04X idProduct: %04X bcdDevice: %04X\n",
	handle->id_vendor, handle->id_product, bcd_device);
	if (buflen < 54 \|\| buf[0] < 54)
	{
	DEBUGOUT ("CCID device descriptor is too short\n");
	return -1;
	}

	DEBUGOUT ("ChipCard Interface Descriptor:\n");
	DEBUGOUT_1 (" bLength %5u\n", buf[0]);
	DEBUGOUT_1 (" bDescriptorType %5u\n", buf[1]);
	DEBUGOUT_2 (" bcdCCID %2x.%02x", buf[3], buf[2]);
	if (buf[3] != 1 \|\| buf[2] != 0)
	DEBUGOUT_CONT(" (Warning: Only accurate for version 1.0)");
	DEBUGOUT_LF ();

	DEBUGOUT_1 (" nMaxSlotIndex %5u\n", buf[4]);
	DEBUGOUT_2 (" bVoltageSupport %5u %s\n",
	buf[5], (buf[5] == 1? "5.0V" : buf[5] == 2? "3.0V"
	: buf[5] == 3? "1.8V":"?"));

	us = convert_le_u32 (buf+6);
	DEBUGOUT_1 (" dwProtocols %5u ", us);
	if ((us & 1))
	DEBUGOUT_CONT (" T=0");
	if ((us & 2))
	{
	DEBUGOUT_CONT (" T=1");
	have_t1 = 1;
	}
	if ((us & ~3))
	DEBUGOUT_CONT (" (Invalid values detected)");
	DEBUGOUT_LF ();

	us = convert_le_u32(buf+10);
	DEBUGOUT_1 (" dwDefaultClock %5u\n", us);
	us = convert_le_u32(buf+14);
	DEBUGOUT_1 (" dwMaxiumumClock %5u\n", us);
	DEBUGOUT_1 (" bNumClockSupported %5u\n", buf[18]);
	us = convert_le_u32(buf+19);
	DEBUGOUT_1 (" dwDataRate %7u bps\n", us);
	us = convert_le_u32(buf+23);
	DEBUGOUT_1 (" dwMaxDataRate %7u bps\n", us);
	DEBUGOUT_1 (" bNumDataRatesSupp. %5u\n", buf[27]);

	us = convert_le_u32(buf+28);
	DEBUGOUT_1 (" dwMaxIFSD %5u\n", us);
	handle->max_ifsd = us;

	us = convert_le_u32(buf+32);
	DEBUGOUT_1 (" dwSyncProtocols %08X ", us);
	if ((us&1))
	DEBUGOUT_CONT ( " 2-wire");
	if ((us&2))
	DEBUGOUT_CONT ( " 3-wire");
	if ((us&4))
	DEBUGOUT_CONT ( " I2C");
	DEBUGOUT_LF ();

	us = convert_le_u32(buf+36);
	DEBUGOUT_1 (" dwMechanical %08X ", us);
	if ((us & 1))
	DEBUGOUT_CONT (" accept");
	if ((us & 2))
	DEBUGOUT_CONT (" eject");
	if ((us & 4))
	DEBUGOUT_CONT (" capture");
	if ((us & 8))
	DEBUGOUT_CONT (" lock");
	DEBUGOUT_LF ();

	us = convert_le_u32(buf+40);
	DEBUGOUT_1 (" dwFeatures %08X\n", us);
	if ((us & 0x0002))
	{
	DEBUGOUT (" Auto configuration based on ATR (assumes auto voltage)\n");
	handle->auto_voltage = 1;
	}
	if ((us & 0x0004))
	DEBUGOUT (" Auto activation on insert\n");
	if ((us & 0x0008))
	{
	DEBUGOUT (" Auto voltage selection\n");
	handle->auto_voltage = 1;
	}
	if ((us & 0x0010))
	DEBUGOUT (" Auto clock change\n");
	if ((us & 0x0020))
	DEBUGOUT (" Auto baud rate change\n");
	if ((us & 0x0040))
	{
	DEBUGOUT (" Auto parameter negotiation made by CCID\n");
	handle->auto_param = 1;
	}
	else if ((us & 0x0080))
	{
	DEBUGOUT (" Auto PPS made by CCID\n");
	handle->auto_pps = 1;
	}
	if ((us & (0x0040 \| 0x0080)) == (0x0040 \| 0x0080))
	DEBUGOUT (" WARNING: conflicting negotiation features\n");

	if ((us & 0x0100))
	DEBUGOUT (" CCID can set ICC in clock stop mode\n");
	if ((us & 0x0200))
	{
	DEBUGOUT (" NAD value other than 0x00 accepted\n");
	handle->nonnull_nad = 1;
	}
	if ((us & 0x0400))
	{
	DEBUGOUT (" Auto IFSD exchange\n");
	handle->auto_ifsd = 1;
	}

	if ((us & 0x00010000))
	{
	DEBUGOUT (" TPDU level exchange\n");
	have_tpdu = 1;
	}
	else if ((us & 0x00020000))
	{
	DEBUGOUT (" Short APDU level exchange\n");
	handle->apdu_level = 1;
	}
	else if ((us & 0x00040000))
	{
	DEBUGOUT (" Short and extended APDU level exchange\n");
	handle->apdu_level = 2;
	}
	else if ((us & 0x00070000))
	DEBUGOUT (" WARNING: conflicting exchange levels\n");

	us = convert_le_u32(buf+44);
	DEBUGOUT_1 (" dwMaxCCIDMsgLen %5u\n", us);
	handle->max_ccid_msglen = us;

	DEBUGOUT ( " bClassGetResponse ");
	if (buf[48] == 0xff)
	DEBUGOUT_CONT ("echo\n");
	else
	DEBUGOUT_CONT_1 (" %02X\n", buf[48]);

	DEBUGOUT ( " bClassEnvelope ");
	if (buf[49] == 0xff)
	DEBUGOUT_CONT ("echo\n");
	else
	DEBUGOUT_CONT_1 (" %02X\n", buf[48]);

	DEBUGOUT ( " wlcdLayout ");
	if (!buf[50] && !buf[51])
	DEBUGOUT_CONT ("none\n");
	else
	DEBUGOUT_CONT_2 ("%u cols %u lines\n", buf[50], buf[51]);

	DEBUGOUT_1 (" bPINSupport %5u ", buf[52]);
	if ((buf[52] & 1))
	{
	DEBUGOUT_CONT ( " verification");
	handle->has_pinpad \|= 1;
	}
	if ((buf[52] & 2))
	{
	DEBUGOUT_CONT ( " modification");
	handle->has_pinpad \|= 2;
	}
	DEBUGOUT_LF ();

	DEBUGOUT_1 (" bMaxCCIDBusySlots %5u\n", buf[53]);

	if (buf[0] > 54)
	{
	DEBUGOUT (" junk ");
	for (i=54; i < buf[0]-54; i++)
	DEBUGOUT_CONT_1 (" %02X", buf[i]);
	DEBUGOUT_LF ();
	}

	if (!have_t1 \|\| !(have_tpdu \|\| handle->apdu_level))
	{
	DEBUGOUT ("this drivers requires that the reader supports T=1, "
	"TPDU or APDU level exchange - this is not available\n");
	return -1;
	}


	/* SCM drivers get stuck in their internal USB stack if they try to
	send a frame of n*wMaxPacketSize back to us. Given that
	wMaxPacketSize is 64 for these readers we set the IFSD to a value
	lower than that:
	64 - 10 CCID header - 4 T1frame - 2 reserved = 48
	Product Ids:
	0xe001 - SCR 331
	0x5111 - SCR 331-DI
	0x5115 - SCR 335
	0xe003 - SPR 532
	The
	0x5117 - SCR 3320 USB ID-000 reader
	seems to be very slow but enabling this workaround boosts the
	- performance to a a more or less acceptable level (tested by David).
	+ performance to a more or less acceptable level (tested by David).

	*/
	if (handle->id_vendor == VENDOR_SCM
	&& handle->max_ifsd > 48
	&& ( (handle->id_product == SCM_SCR331 && bcd_device < 0x0516)
	\|\|(handle->id_product == SCM_SCR331DI && bcd_device < 0x0620)
	\|\|(handle->id_product == SCM_SCR335 && bcd_device < 0x0514)
	\|\|(handle->id_product == SCM_SPR532 && bcd_device < 0x0504)
	\|\|(handle->id_product == SCM_SCR3320 && bcd_device < 0x0522)
	))
	{
	DEBUGOUT ("enabling workaround for buggy SCM readers\n");
	handle->max_ifsd = 48;
	}

	if (handle->id_vendor == VENDOR_GEMPC)
	{
	DEBUGOUT ("enabling product quirk: disable non-null NAD\n");
	handle->nonnull_nad = 0;
	}

	return 0;
	}


	static char *
	get_escaped_usb_string (libusb_device_handle *idev, int idx,
	const char prefix, const char suffix)
	{
	int rc;
	unsigned char buf[280];
	unsigned char *s;
	unsigned int langid;
	size_t i, n, len;
	char *result;

	if (!idx)
	return NULL;

	/* Fixme: The next line is for the current Valgrid without support
	for USB IOCTLs. */
	memset (buf, 0, sizeof buf);

	/* First get the list of supported languages and use the first one.
	If we do don't find it we try to use English. Note that this is
	all in a 2 bute Unicode encoding using little endian. */
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_control_transfer (idev, LIBUSB_ENDPOINT_IN,
	LIBUSB_REQUEST_GET_DESCRIPTOR,
	(LIBUSB_DT_STRING << 8), 0,
	(char)buf, sizeof buf, 1000 / ms timeout */);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc < 4)
	langid = 0x0409; /* English. */
	else
	langid = (buf[3] << 8) \| buf[2];

	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_control_transfer (idev, LIBUSB_ENDPOINT_IN,
	LIBUSB_REQUEST_GET_DESCRIPTOR,
	(LIBUSB_DT_STRING << 8) + idx, langid,
	(char)buf, sizeof buf, 1000 / ms timeout */);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc < 2 \|\| buf[1] != LIBUSB_DT_STRING)
	return NULL; /* Error or not a string. */
	len = buf[0];
	if (len > rc)
	return NULL; /* Larger than our buffer. */

	for (s=buf+2, i=2, n=0; i+1 < len; i += 2, s += 2)
	{
	if (s[1])
	n++; /* High byte set. */
	else if (s <= 0x20 \|\| s >= 0x7f \|\| s == '%' \|\| s == ':')
	n += 3 ;
	else
	n++;
	}

	result = malloc (strlen (prefix) + n + strlen (suffix) + 1);
	if (!result)
	return NULL;

	strcpy (result, prefix);
	n = strlen (prefix);
	for (s=buf+2, i=2; i+1 < len; i += 2, s += 2)
	{
	if (s[1])
	result[n++] = '\xff'; /* High byte set. */
	else if (s <= 0x20 \|\| s >= 0x7f \|\| s == '%' \|\| s == ':')
	{
	sprintf (result+n, "%%%02X", *s);
	n += 3;
	}
	else
	result[n++] = *s;
	}
	strcpy (result+n, suffix);

	return result;
	}

	/* This function creates an reader id to be used to find the same
	physical reader after a reset. It returns an allocated and possibly
	percent escaped string or NULL if not enough memory is available. */
	static char *
	make_reader_id (libusb_device_handle *idev,
	unsigned int vendor, unsigned int product,
	unsigned char serialno_index)
	{
	char *rid;
	char prefix[20];

	sprintf (prefix, "%04X:%04X:", (vendor & 0xffff), (product & 0xffff));
	rid = get_escaped_usb_string (idev, serialno_index, prefix, ":0");
	if (!rid)
	{
	rid = malloc (strlen (prefix) + 3 + 1);
	if (!rid)
	return NULL;
	strcpy (rid, prefix);
	strcat (rid, "X:0");
	}
	return rid;
	}


	/* Helper to find the endpoint from an interface descriptor. */
	static int
	find_endpoint (const struct libusb_interface_descriptor *ifcdesc, int mode)
	{
	int no;
	int want_bulk_in = 0;

	if (mode == 1)
	want_bulk_in = 0x80;
	for (no=0; no < ifcdesc->bNumEndpoints; no++)
	{
	const struct libusb_endpoint_descriptor *ep = ifcdesc->endpoint + no;
	if (ep->bDescriptorType != LIBUSB_DT_ENDPOINT)
	;
	else if (mode == 2
	&& ((ep->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK)
	== LIBUSB_TRANSFER_TYPE_INTERRUPT)
	&& (ep->bEndpointAddress & 0x80))
	return ep->bEndpointAddress;
	else if ((mode == 0 \|\| mode == 1)
	&& ((ep->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK)
	== LIBUSB_TRANSFER_TYPE_BULK)
	&& (ep->bEndpointAddress & 0x80) == want_bulk_in)
	return ep->bEndpointAddress;
	}

	return -1;
	}


	/* Helper for scan_or_find_devices. This function returns true if a
	requested device has been found or the caller should stop scanning
	for other reasons. */
	static int
	scan_or_find_usb_device (int scan_mode,
	int readerno, int count, char *rid_list,
	const char *readerid,
	struct libusb_device *dev,
	char **r_rid,
	struct libusb_device_descriptor *desc,
	libusb_device_handle **r_idev,
	unsigned char **ifcdesc_extra,
	size_t *ifcdesc_extra_len,
	int interface_number, int setting_number,
	int ep_bulk_out, int ep_bulk_in, int *ep_intr)
	{
	int ifc_no;
	int set_no;
	const struct libusb_interface_descriptor *ifcdesc;
	char *rid;
	libusb_device_handle *idev = NULL;
	int err;
	struct libusb_config_descriptor *config;

	err = libusb_get_device_descriptor (dev, desc);
	if (err)
	return 0;

	*r_idev = NULL;

	err = libusb_get_active_config_descriptor (dev, &config);
	if (err)
	return 0;

	for (ifc_no=0; ifc_no < config->bNumInterfaces; ifc_no++)
	for (set_no=0; set_no < config->interface[ifc_no].num_altsetting; set_no++)
	{
	ifcdesc = (config->interface[ifc_no].altsetting + set_no);
	/* The second condition is for older SCM SPR 532 who did
	not know about the assigned CCID class. The third
	condition does the same for a Cherry SmartTerminal
	ST-2000. Instead of trying to interpret the strings
	we simply check the product ID. */
	if (ifcdesc && ifcdesc->extra
	&& ((ifcdesc->bInterfaceClass == 11
	&& ifcdesc->bInterfaceSubClass == 0
	&& ifcdesc->bInterfaceProtocol == 0)
	\|\| (ifcdesc->bInterfaceClass == 255
	&& desc->idVendor == VENDOR_SCM
	&& desc->idProduct == SCM_SPR532)
	\|\| (ifcdesc->bInterfaceClass == 255
	&& desc->idVendor == VENDOR_CHERRY
	&& desc->idProduct == CHERRY_ST2000)))
	{
	++*count;
	if (!scan_mode && ((readerno > 0 && readerno != *count - 1)))
	continue;

	err = libusb_open (dev, &idev);
	if (err)
	{
	DEBUGOUT_1 ("usb_open failed: %s\n", libusb_error_name (err));
	continue; /* with next setting. */
	}

	rid = make_reader_id (idev, desc->idVendor, desc->idProduct,
	desc->iSerialNumber);
	if (!rid)
	{
	libusb_free_config_descriptor (config);
	return 0;
	}

	if (!scan_mode && readerno == -1 && readerid
	&& strncmp (rid, readerid, strlen (readerid)))
	continue;

	if (scan_mode)
	{
	char *p;

	/* We are collecting infos about all
	available CCID readers. Store them and
	continue. */
	DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n", *count, rid);
	p = malloc ((rid_list? strlen (rid_list):0) + 1
	+ strlen (rid) + 1);
	if (p)
	{
	*p = 0;
	if (*rid_list)
	{
	strcat (p, *rid_list);
	free (*rid_list);
	}
	strcat (p, rid);
	strcat (p, "\n");
	*rid_list = p;
	}
	else /* Out of memory. */
	{
	libusb_free_config_descriptor (config);
	free (rid);
	return 0;
	}
	}
	else
	{
	/* We found the requested reader. */
	if (ifcdesc_extra && ifcdesc_extra_len)
	{
	*ifcdesc_extra = malloc (ifcdesc->extra_length);
	if (!*ifcdesc_extra)
	{
	libusb_close (idev);
	free (rid);
	libusb_free_config_descriptor (config);
	return 1; /* Out of core. */
	}
	memcpy (*ifcdesc_extra, ifcdesc->extra,
	ifcdesc->extra_length);
	*ifcdesc_extra_len = ifcdesc->extra_length;
	}

	if (interface_number)
	*interface_number = ifc_no;

	if (setting_number)
	*setting_number = set_no;

	if (ep_bulk_out)
	*ep_bulk_out = find_endpoint (ifcdesc, 0);
	if (ep_bulk_in)
	*ep_bulk_in = find_endpoint (ifcdesc, 1);
	if (ep_intr)
	*ep_intr = find_endpoint (ifcdesc, 2);

	if (r_rid)
	{
	*r_rid = rid;
	rid = NULL;
	}
	else
	free (rid);

	*r_idev = idev;
	libusb_free_config_descriptor (config);
	return 1; /* Found requested device. */
	}

	free (rid);
	libusb_close (idev);
	idev = NULL;
	}
	}

	libusb_free_config_descriptor (config);

	return 0;
	}

	/* Combination function to either scan all CCID devices or to find and
	open one specific device.

	The function returns 0 if a reader has been found or when a scan
	returned without error.

	With READERNO = -1 and READERID is NULL, scan mode is used and
	R_RID should be the address where to store the list of reader_ids
	we found. If on return this list is empty, no CCID device has been
	found; otherwise it points to an allocated linked list of reader
	IDs. Note that in this mode the function always returns NULL.

	With READERNO >= 0 or READERID is not NULL find mode is used. This
	uses the same algorithm as the scan mode but stops and returns at
	- the entry number READERNO and return the handle for the the opened
	+ the entry number READERNO and return the handle for the opened
	USB device. If R_RID is not NULL it will receive the reader ID of
	that device. If R_DEV is not NULL it will the device pointer of
	that device. If IFCDESC_EXTRA is NOT NULL it will receive a
	malloced copy of the interfaces "extra: data filed;
	IFCDESC_EXTRA_LEN receive the length of this field. If there is
	no reader with number READERNO or that reader is not usable by our
	implementation NULL will be returned. The caller must close a
	returned USB device handle and free (if not passed as NULL) the
	returned reader ID info as well as the IFCDESC_EXTRA. On error
	NULL will get stored at R_RID, R_DEV, IFCDESC_EXTRA and
	IFCDESC_EXTRA_LEN. With READERID being -1 the function stops if
	the READERID was found.

	If R_FD is not -1 on return the device is not using USB for
	transport but the device associated with that file descriptor. In
	this case INTERFACE will receive the transport type and the other
	USB specific return values are not used; the return value is
	(void*)(1).

	Note that the first entry of the returned reader ID list in scan mode
	corresponds with a READERNO of 0 in find mode.
	*/
	static int
	scan_or_find_devices (int readerno, const char *readerid,
	char **r_rid,
	struct libusb_device_descriptor *r_desc,
	unsigned char **ifcdesc_extra,
	size_t *ifcdesc_extra_len,
	int interface_number, int setting_number,
	int ep_bulk_out, int ep_bulk_in, int *ep_intr,
	libusb_device_handle **r_idev,
	int *r_fd)
	{
	char *rid_list = NULL;
	int count = 0;
	libusb_device **dev_list = NULL;
	libusb_device *dev;
	libusb_device_handle *idev = NULL;
	int scan_mode = (readerno == -1 && !readerid);
	int i;
	ssize_t n;
	struct libusb_device_descriptor desc;

	/* Set return values to a default. */
	if (r_rid)
	*r_rid = NULL;
	if (ifcdesc_extra)
	*ifcdesc_extra = NULL;
	if (ifcdesc_extra_len)
	*ifcdesc_extra_len = 0;
	if (interface_number)
	*interface_number = 0;
	if (setting_number)
	*setting_number = 0;
	if (r_idev)
	*r_idev = NULL;
	if (r_fd)
	*r_fd = -1;

	/* See whether we want scan or find mode. */
	if (scan_mode)
	{
	assert (r_rid);
	}

	n = libusb_get_device_list (NULL, &dev_list);

	for (i = 0; i < n; i++)
	{
	dev = dev_list[i];
	if (scan_or_find_usb_device (scan_mode, readerno, &count, &rid_list,
	readerid,
	dev,
	r_rid,
	&desc,
	&idev,
	ifcdesc_extra,
	ifcdesc_extra_len,
	interface_number, setting_number,
	ep_bulk_out, ep_bulk_in, ep_intr))
	{
	libusb_free_device_list (dev_list, 1);
	/* Found requested device or out of core. */
	if (!idev)
	{
	free (rid_list);
	return -1; /* error */
	}
	*r_idev = idev;
	if (r_desc)
	memcpy (r_desc, &desc, sizeof (struct libusb_device_descriptor));
	return 0;
	}
	}

	libusb_free_device_list (dev_list, 1);

	/* Now check whether there are any devices with special transport types. */
	for (i=0; transports[i].name; i++)
	{
	int fd;
	char rid, p;

	fd = open (transports[i].name, O_RDWR);
	if (fd == -1 && scan_mode && errno == EBUSY)
	{
	/* Ignore this error in scan mode because it indicates that
	the device exists but is already open (most likely by us)
	and thus in general suitable as a reader. */
	}
	else if (fd == -1)
	{
	DEBUGOUT_2 ("failed to open '%s': %s\n",
	transports[i].name, strerror (errno));
	continue;
	}

	rid = malloc (strlen (transports[i].name) + 30 + 10);
	if (!rid)
	{
	if (fd != -1)
	close (fd);
	free (rid_list);
	return -1; /* Error. */
	}
	sprintf (rid, "0000:%04X:%s:0", transports[i].type, transports[i].name);
	if (scan_mode)
	{
	DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n", count, rid);
	p = malloc ((rid_list? strlen (rid_list):0) + 1 + strlen (rid) + 1);
	if (!p)
	{
	if (fd != -1)
	close (fd);
	free (rid_list);
	free (rid);
	return -1; /* Error. */
	}
	*p = 0;
	if (rid_list)
	{
	strcat (p, rid_list);
	free (rid_list);
	}
	strcat (p, rid);
	strcat (p, "\n");
	rid_list = p;
	++count;
	}
	else if (!readerno \|\|
	(readerno < 0 && readerid && !strcmp (readerid, rid)))
	{
	/* Found requested device. */
	if (interface_number)
	*interface_number = transports[i].type;
	if (r_rid)
	*r_rid = rid;
	else
	free (rid);
	if (r_fd)
	*r_fd = fd;
	return 0; /* Okay, found device */
	}
	else /* This is not yet the reader we want. */
	{
	if (readerno >= 0)
	--readerno;
	}
	free (rid);
	if (fd != -1)
	close (fd);
	}

	if (scan_mode)
	{
	*r_rid = rid_list;
	return 0;
	}
	else
	return -1;
	}


	/* Set the level of debugging to LEVEL and return the old level. -1
	just returns the old level. A level of 0 disables debugging, 1
	enables debugging, 2 enables additional tracing of the T=1
	protocol, 3 additionally enables debugging for GetSlotStatus, other
	values are not yet defined.

	Note that libusb may provide its own debugging feature which is
	enabled by setting the envvar USB_DEBUG. */
	int
	ccid_set_debug_level (int level)
	{
	int old = debug_level;
	if (level != -1)
	debug_level = level;
	return old;
	}


	char *
	ccid_get_reader_list (void)
	{
	char *reader_list;

	if (!initialized_usb)
	{
	libusb_init (NULL);
	initialized_usb = 1;
	}

	if (scan_or_find_devices (-1, NULL, &reader_list, NULL, NULL, NULL, NULL,
	NULL, NULL, NULL, NULL, NULL, NULL))
	return NULL; /* Error. */
	return reader_list;
	}


	/* Vendor specific custom initialization. */
	static int
	ccid_vendor_specific_init (ccid_driver_t handle)
	{
	if (handle->id_vendor == VENDOR_VEGA && handle->id_product == VEGA_ALPHA)
	{
	int r;
	/*
	* Vega alpha has a feature to show retry counter on the pinpad
	* display. But it assumes that the card returns the value of
	* retry counter by VERIFY with empty data (return code of
	* 63Cx). Unfortunately, existing OpenPGP cards don't support
	* VERIFY command with empty data. This vendor specific command
	* sequence is to disable the feature.
	*/
	const unsigned char cmd[] = { '\xb5', '\x01', '\x00', '\x03', '\x00' };

	r = send_escape_cmd (handle, cmd, sizeof (cmd), NULL, 0, NULL);
	if (r != 0 && r != CCID_DRIVER_ERR_CARD_INACTIVE
	&& r != CCID_DRIVER_ERR_NO_CARD)
	return r;
	}

	return 0;
	}


	#define MAX_DEVICE 4 /* See MAX_READER in apdu.c. */

	struct ccid_dev_table {
	int n; /* Index to ccid_usb_dev_list */
	int transport;
	int interface_number;
	int setting_number;
	unsigned char *ifcdesc_extra;
	int ep_bulk_out;
	int ep_bulk_in;
	int ep_intr;
	size_t ifcdesc_extra_len;
	};

	static libusb_device **ccid_usb_dev_list;
	static struct ccid_dev_table ccid_dev_table[MAX_DEVICE];

	gpg_error_t
	ccid_dev_scan (int idx_max_p, struct ccid_dev_table *t_p)
	{
	ssize_t n;
	libusb_device *dev;
	int i;
	int ifc_no;
	int set_no;
	int idx = 0;
	int err = 0;

	if (!initialized_usb)
	{
	libusb_init (NULL);
	initialized_usb = 1;
	}

	n = libusb_get_device_list (NULL, &ccid_usb_dev_list);
	for (i = 0; i < n; i++)
	{
	struct libusb_config_descriptor *config;
	struct libusb_device_descriptor desc;

	dev = ccid_usb_dev_list[i];

	if (libusb_get_device_descriptor (dev, &desc))
	continue;

	if (libusb_get_active_config_descriptor (dev, &config))
	continue;

	for (ifc_no=0; ifc_no < config->bNumInterfaces; ifc_no++)
	for (set_no=0; set_no < config->interface[ifc_no].num_altsetting;
	set_no++)
	{
	const struct libusb_interface_descriptor *ifcdesc;

	ifcdesc = &config->interface[ifc_no].altsetting[set_no];
	/* The second condition is for older SCM SPR 532 who did
	not know about the assigned CCID class. The third
	condition does the same for a Cherry SmartTerminal
	ST-2000. Instead of trying to interpret the strings
	we simply check the product ID. */
	if (ifcdesc && ifcdesc->extra
	&& ((ifcdesc->bInterfaceClass == 11
	&& ifcdesc->bInterfaceSubClass == 0
	&& ifcdesc->bInterfaceProtocol == 0)
	\|\| (ifcdesc->bInterfaceClass == 255
	&& desc.idVendor == VENDOR_SCM
	&& desc.idProduct == SCM_SPR532)
	\|\| (ifcdesc->bInterfaceClass == 255
	&& desc.idVendor == VENDOR_CHERRY
	&& desc.idProduct == CHERRY_ST2000)))
	{
	/* Found a reader. */
	unsigned char *ifcdesc_extra;

	ifcdesc_extra = malloc (ifcdesc->extra_length);
	if (!ifcdesc_extra)
	{
	err = gpg_error_from_syserror ();
	libusb_free_config_descriptor (config);
	goto scan_finish;
	}
	memcpy (ifcdesc_extra, ifcdesc->extra, ifcdesc->extra_length);

	ccid_dev_table[idx].transport = TRANSPORT_USB;
	ccid_dev_table[idx].n = i;
	ccid_dev_table[idx].interface_number = ifc_no;
	ccid_dev_table[idx].setting_number = set_no;
	ccid_dev_table[idx].ifcdesc_extra = ifcdesc_extra;
	ccid_dev_table[idx].ifcdesc_extra_len = ifcdesc->extra_length;
	ccid_dev_table[idx].ep_bulk_out = find_endpoint (ifcdesc, 0);
	ccid_dev_table[idx].ep_bulk_in = find_endpoint (ifcdesc, 1);
	ccid_dev_table[idx].ep_intr = find_endpoint (ifcdesc, 2);

	idx++;
	if (idx >= MAX_DEVICE)
	{
	libusb_free_config_descriptor (config);
	err = 0;
	goto scan_finish;
	}
	}
	}

	libusb_free_config_descriptor (config);
	}

	/* Now check whether there are any devices with special transport types. */
	for (i=0; transports[i].name; i++)
	{
	if (access (transports[i].name, (R_OK\|W_OK)) == 0)
	{
	/* Found a device. */
	DEBUGOUT_1 ("Found CCID reader %d\n", idx);

	ccid_dev_table[idx].transport = TRANSPORT_CM4040;
	ccid_dev_table[idx].n = i;
	ccid_dev_table[idx].interface_number = 0;
	ccid_dev_table[idx].setting_number = 0;
	ccid_dev_table[idx].ifcdesc_extra = NULL;
	ccid_dev_table[idx].ifcdesc_extra_len = 0;
	ccid_dev_table[idx].ep_bulk_out = 0;
	ccid_dev_table[idx].ep_bulk_in = 0;
	ccid_dev_table[idx].ep_intr = 0;

	idx++;
	if (idx >= MAX_DEVICE)
	goto scan_finish;
	}
	}

	scan_finish:

	if (err)
	{
	*idx_max_p = 0;
	*t_p = NULL;
	for (i = 0; i < idx; i++)
	{
	free (ccid_dev_table[idx].ifcdesc_extra);
	ccid_dev_table[idx].transport = 0;
	ccid_dev_table[idx].n = 0;
	ccid_dev_table[idx].interface_number = 0;
	ccid_dev_table[idx].setting_number = 0;
	ccid_dev_table[idx].ifcdesc_extra = NULL;
	ccid_dev_table[idx].ifcdesc_extra_len = 0;
	ccid_dev_table[idx].ep_bulk_out = 0;
	ccid_dev_table[idx].ep_bulk_in = 0;
	ccid_dev_table[idx].ep_intr = 0;
	}
	libusb_free_device_list (ccid_usb_dev_list, 1);
	ccid_usb_dev_list = NULL;
	}
	else
	{
	*idx_max_p = idx;
	if (idx)
	*t_p = ccid_dev_table;
	else
	*t_p = NULL;
	}

	return err;
	}

	void
	ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
	{
	int i;

	for (i = 0; i < max; i++)
	{
	free (tbl[i].ifcdesc_extra);
	tbl[i].transport = 0;
	tbl[i].n = 0;
	tbl[i].interface_number = 0;
	tbl[i].setting_number = 0;
	tbl[i].ifcdesc_extra = NULL;
	tbl[i].ifcdesc_extra_len = 0;
	tbl[i].ep_bulk_out = 0;
	tbl[i].ep_bulk_in = 0;
	tbl[i].ep_intr = 0;
	}
	libusb_free_device_list (ccid_usb_dev_list, 1);
	ccid_usb_dev_list = NULL;
	}

	unsigned int
	ccid_get_BAI (int idx, struct ccid_dev_table *tbl)
	{
	int n;
	int bus, addr, intf;
	unsigned int bai;

	if (tbl[idx].transport == TRANSPORT_USB)
	{
	libusb_device *dev;

	n = tbl[idx].n;
	dev = ccid_usb_dev_list[n];

	bus = libusb_get_bus_number (dev);
	addr = libusb_get_device_address (dev);
	intf = tbl[idx].interface_number;
	bai = (bus << 16) \| (addr << 8) \| intf;
	}
	else
	{
	n = tbl[idx].n;
	bai = 0xFFFF0000 \| n;
	}

	return bai;
	}

	int
	ccid_compare_BAI (ccid_driver_t handle, unsigned int bai)
	{
	return handle->bai == bai;
	}


	static void
	intr_cb (struct libusb_transfer *transfer)
	{
	ccid_driver_t handle = transfer->user_data;

	DEBUGOUT_1 ("CCID: interrupt callback %d\n", transfer->status);

	if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT)
	{
	int err;

	submit_again:
	/* Submit the URB again to keep watching the INTERRUPT transfer. */
	err = libusb_submit_transfer (transfer);
	if (err == LIBUSB_ERROR_NO_DEVICE)
	goto device_removed;

	DEBUGOUT_1 ("CCID submit transfer again %d\n", err);
	}
	else if (transfer->status == LIBUSB_TRANSFER_COMPLETED)
	{
	if (transfer->actual_length == 2
	&& transfer->buffer[0] == 0x50
	&& (transfer->buffer[1] & 1) == 0)
	{
	DEBUGOUT ("CCID: card removed\n");
	handle->powered_off = 1;
	}
	else
	{
	/* Event other than card removal. */
	goto submit_again;
	}
	}
	else if (transfer->status == LIBUSB_TRANSFER_CANCELLED)
	handle->powered_off = 1;
	else
	{
	device_removed:
	DEBUGOUT ("CCID: device removed\n");
	handle->powered_off = 1;
	}

	scd_kick_the_loop ();
	}

	static void
	ccid_setup_intr (ccid_driver_t handle)
	{
	struct libusb_transfer *transfer;
	int err;

	transfer = libusb_alloc_transfer (0);
	handle->transfer = transfer;
	libusb_fill_interrupt_transfer (transfer, handle->idev, handle->ep_intr,
	handle->intr_buf, sizeof (handle->intr_buf),
	intr_cb, handle, 0);
	err = libusb_submit_transfer (transfer);
	DEBUGOUT_2 ("CCID submit transfer (%x): %d", handle->ep_intr, err);
	}


	static void *
	ccid_usb_thread (void *arg)
	{
	libusb_context *ctx = arg;

	while (ccid_usb_thread_is_alive)
	{
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	libusb_handle_events_completed (ctx, NULL);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	}

	return NULL;
	}


	static int
	ccid_open_usb_reader (const char *spec_reader_name,
	int idx, struct ccid_dev_table *ccid_table,
	ccid_driver_t handle, char *rdrname_p)
	{
	libusb_device *dev;
	libusb_device_handle *idev = NULL;
	char *rid = NULL;
	int rc = 0;
	int ifc_no, set_no;
	struct libusb_device_descriptor desc;
	int n;
	int bus, addr;
	unsigned int bai;

	n = ccid_table[idx].n;
	ifc_no = ccid_table[idx].interface_number;
	set_no = ccid_table[idx].setting_number;

	dev = ccid_usb_dev_list[n];
	bus = libusb_get_bus_number (dev);
	addr = libusb_get_device_address (dev);
	bai = (bus << 16) \| (addr << 8) \| ifc_no;

	rc = libusb_open (dev, &idev);
	if (rc)
	{
	DEBUGOUT_1 ("usb_open failed: %s\n", libusb_error_name (rc));
	free (*handle);
	*handle = NULL;
	return rc;
	}

	if (ccid_usb_thread_is_alive++ == 0)
	{
	npth_t thread;
	npth_attr_t tattr;
	int err;

	err = npth_attr_init (&tattr);
	if (err)
	{
	DEBUGOUT_1 ("npth_attr_init failed: %s\n", strerror (err));
	free (*handle);
	*handle = NULL;
	return err;
	}

	npth_attr_setdetachstate (&tattr, NPTH_CREATE_DETACHED);
	err = npth_create (&thread, &tattr, ccid_usb_thread, NULL);
	if (err)
	{
	DEBUGOUT_1 ("npth_create failed: %s\n", strerror (err));
	free (*handle);
	*handle = NULL;
	return err;
	}

	npth_attr_destroy (&tattr);
	}

	rc = libusb_get_device_descriptor (dev, &desc);
	if (rc)
	{
	DEBUGOUT ("get_device_descripor failed\n");
	goto leave;
	}

	rid = make_reader_id (idev, desc.idVendor, desc.idProduct,
	desc.iSerialNumber);

	/* Check to see if reader name matches the spec. */
	if (spec_reader_name
	&& strncmp (rid, spec_reader_name, strlen (spec_reader_name)))
	{
	DEBUGOUT ("device not matched\n");
	rc = CCID_DRIVER_ERR_NO_READER;
	goto leave;
	}

	(*handle)->id_vendor = desc.idVendor;
	(*handle)->id_product = desc.idProduct;
	(*handle)->idev = idev;
	(*handle)->dev_fd = -1;
	(*handle)->bai = bai;
	(*handle)->ifc_no = ifc_no;
	(*handle)->ep_bulk_out = ccid_table[idx].ep_bulk_out;
	(*handle)->ep_bulk_in = ccid_table[idx].ep_bulk_in;
	(*handle)->ep_intr = ccid_table[idx].ep_intr;

	DEBUGOUT_2 ("using CCID reader %d (ID=%s)\n", idx, rid);

	if (parse_ccid_descriptor (*handle, desc.bcdDevice,
	ccid_table[idx].ifcdesc_extra,
	ccid_table[idx].ifcdesc_extra_len))
	{
	DEBUGOUT ("device not supported\n");
	rc = CCID_DRIVER_ERR_NO_READER;
	goto leave;
	}

	rc = libusb_claim_interface (idev, ifc_no);
	if (rc)
	{
	DEBUGOUT_1 ("usb_claim_interface failed: %d\n", rc);
	rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
	goto leave;
	}

	if (set_no != 0)
	{
	rc = libusb_set_interface_alt_setting (idev, ifc_no, set_no);
	if (rc)
	{
	DEBUGOUT_1 ("usb_set_interface_alt_setting failed: %d\n", rc);
	rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
	goto leave;
	}
	}

	if ((*handle)->ep_intr >= 0)
	ccid_setup_intr (*handle);

	rc = ccid_vendor_specific_init (*handle);

	leave:
	if (rc)
	{
	--ccid_usb_thread_is_alive;
	free (rid);
	libusb_close (idev);
	free (*handle);
	*handle = NULL;
	}
	else
	{
	if (rdrname_p)
	*rdrname_p = rid;
	else
	free (rid);
	}

	return rc;
	}

	/* Open the reader with the internal number READERNO and return a
	pointer to be used as handle in HANDLE. Returns 0 on success. */
	int
	ccid_open_reader (const char *spec_reader_name, int idx,
	struct ccid_dev_table *ccid_table,
	ccid_driver_t handle, char *rdrname_p)
	{
	int n;
	int fd;
	char *rid;

	handle = calloc (1, sizeof *handle);
	if (!*handle)
	{
	DEBUGOUT ("out of memory\n");
	return CCID_DRIVER_ERR_OUT_OF_CORE;
	}

	if (ccid_table[idx].transport == TRANSPORT_USB)
	return ccid_open_usb_reader (spec_reader_name, idx, ccid_table,
	handle, rdrname_p);

	/* Special transport support. */

	n = ccid_table[idx].n;
	fd = open (transports[n].name, O_RDWR);
	if (fd < 0)
	{
	DEBUGOUT_2 ("failed to open '%s': %s\n",
	transports[n].name, strerror (errno));
	free (*handle);
	*handle = NULL;
	return -1;
	}

	rid = malloc (strlen (transports[n].name) + 30 + 10);
	if (!rid)
	{
	close (fd);
	free (*handle);
	*handle = NULL;
	return -1; /* Error. */
	}

	sprintf (rid, "0000:%04X:%s:0", transports[n].type, transports[n].name);

	/* Check to see if reader name matches the spec. */
	if (spec_reader_name
	&& strncmp (rid, spec_reader_name, strlen (spec_reader_name)))
	{
	DEBUGOUT ("device not matched\n");
	free (rid);
	close (fd);
	free (*handle);
	*handle = NULL;
	return -1;
	}

	(*handle)->id_vendor = 0;
	(*handle)->id_product = transports[n].type;
	(*handle)->idev = NULL;
	(*handle)->dev_fd = fd;
	(*handle)->bai = 0xFFFF0000 \| n;
	prepare_special_transport (*handle);
	if (rdrname_p)
	*rdrname_p = rid;
	else
	free (rid);

	return 0;
	}


	int
	ccid_require_get_status (ccid_driver_t handle)
	{
	/* When a card reader supports interrupt transfer to check the
	status of card, it is possible to submit only an interrupt
	transfer, and no check is required by application layer. USB can
	detect removal of a card and can detect removal of a reader.
	*/
	if (handle->ep_intr >= 0)
	return 0;

	/* Libusb actually detects the removal of USB device in use.
	However, there is no good API to handle the removal (yet),
	cleanly and with good portability.

	There is libusb_set_pollfd_notifiers function, but it doesn't
	offer libusb_device_handle* data to its callback. So, when it
	watches multiple devices, there is no way to know which device is
	removed.

	Once, we will have a good programming interface of libusb, we can
	list tokens (with no interrupt transfer support, but always with
	card inserted) here to return 0, so that scdaemon can submit
	minimum packet on wire.
	*/
	return 1;
	}


	static void
	do_close_reader (ccid_driver_t handle)
	{
	int rc;
	unsigned char msg[100];
	size_t msglen;
	unsigned char seqno;

	if (!handle->powered_off)
	{
	msg[0] = PC_to_RDR_IccPowerOff;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, 0);
	msglen = 10;

	rc = bulk_out (handle, msg, msglen, 0);
	if (!rc)
	bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_SlotStatus,
	seqno, 2000, 0);
	}
	if (handle->idev)
	{
	if (handle->transfer)
	{
	if (!handle->powered_off)
	{
	DEBUGOUT ("libusb_cancel_transfer\n");

	rc = libusb_cancel_transfer (handle->transfer);
	if (rc != LIBUSB_ERROR_NOT_FOUND)
	while (!handle->powered_off)
	{
	DEBUGOUT ("libusb_handle_events_completed\n");
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	libusb_handle_events_completed (NULL, &handle->powered_off);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	}
	}

	libusb_free_transfer (handle->transfer);
	}
	libusb_release_interface (handle->idev, handle->ifc_no);
	--ccid_usb_thread_is_alive;
	libusb_close (handle->idev);
	handle->idev = NULL;
	}
	if (handle->dev_fd != -1)
	{
	close (handle->dev_fd);
	handle->dev_fd = -1;
	}
	}


	int
	ccid_set_progress_cb (ccid_driver_t handle,
	void (cb)(void , const char *, int, int, int),
	void *cb_arg)
	{
	if (!handle)
	return CCID_DRIVER_ERR_INV_VALUE;

	handle->progress_cb = cb;
	handle->progress_cb_arg = cb_arg;
	return 0;
	}


	/* Close the reader HANDLE. */
	int
	ccid_close_reader (ccid_driver_t handle)
	{
	if (!handle \|\| (!handle->idev && handle->dev_fd == -1))
	return 0;

	do_close_reader (handle);
	free (handle);
	return 0;
	}


	/* Return False if a card is present and powered. */
	int
	ccid_check_card_presence (ccid_driver_t handle)
	{
	(void)handle; /* Not yet implemented. */
	return -1;
	}


	/* Write NBYTES of BUF to file descriptor FD. */
	static int
	writen (int fd, const void *buf, size_t nbytes)
	{
	size_t nleft = nbytes;
	int nwritten;

	while (nleft > 0)
	{
	nwritten = write (fd, buf, nleft);
	if (nwritten < 0)
	{
	if (errno == EINTR)
	nwritten = 0;
	else
	return -1;
	}
	nleft -= nwritten;
	buf = (const char*)buf + nwritten;
	}

	return 0;
	}


	/* Write a MSG of length MSGLEN to the designated bulk out endpoint.
	Returns 0 on success. */
	static int
	bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
	int no_debug)
	{
	int rc;

	/* No need to continue and clutter the log with USB write error
	messages after we got the first ENODEV. */
	if (handle->enodev_seen)
	return CCID_DRIVER_ERR_NO_READER;

	if (debug_level && (!no_debug \|\| debug_level >= 3))
	{
	switch (msglen? msg[0]:0)
	{
	case PC_to_RDR_IccPowerOn:
	print_p2r_iccpoweron (msg, msglen);
	break;
	case PC_to_RDR_IccPowerOff:
	print_p2r_iccpoweroff (msg, msglen);
	break;
	case PC_to_RDR_GetSlotStatus:
	print_p2r_getslotstatus (msg, msglen);
	break;
	case PC_to_RDR_XfrBlock:
	print_p2r_xfrblock (msg, msglen);
	break;
	case PC_to_RDR_GetParameters:
	print_p2r_getparameters (msg, msglen);
	break;
	case PC_to_RDR_ResetParameters:
	print_p2r_resetparameters (msg, msglen);
	break;
	case PC_to_RDR_SetParameters:
	print_p2r_setparameters (msg, msglen);
	break;
	case PC_to_RDR_Escape:
	print_p2r_escape (msg, msglen);
	break;
	case PC_to_RDR_IccClock:
	print_p2r_iccclock (msg, msglen);
	break;
	case PC_to_RDR_T0APDU:
	print_p2r_to0apdu (msg, msglen);
	break;
	case PC_to_RDR_Secure:
	print_p2r_secure (msg, msglen);
	break;
	case PC_to_RDR_Mechanical:
	print_p2r_mechanical (msg, msglen);
	break;
	case PC_to_RDR_Abort:
	print_p2r_abort (msg, msglen);
	break;
	case PC_to_RDR_SetDataRate:
	print_p2r_setdatarate (msg, msglen);
	break;
	default:
	print_p2r_unknown (msg, msglen);
	break;
	}
	}

	if (handle->idev)
	{
	int transferred;

	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_out,
	(char*)msg, msglen, &transferred,
	5000 /* ms timeout */);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc == 0 && transferred == msglen)
	return 0;

	if (rc)
	{
	DEBUGOUT_1 ("usb_bulk_write error: %s\n", libusb_error_name (rc));
	if (rc == LIBUSB_ERROR_NO_DEVICE)
	{
	handle->enodev_seen = 1;
	return CCID_DRIVER_ERR_NO_READER;
	}
	}
	}
	else
	{
	rc = writen (handle->dev_fd, msg, msglen);
	if (!rc)
	return 0;
	DEBUGOUT_2 ("writen to %d failed: %s\n",
	handle->dev_fd, strerror (errno));

	}
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}


	/* Read a maximum of LENGTH bytes from the bulk in endpoint into
	BUFFER and return the actual read number if bytes in NREAD. SEQNO
	is the sequence number used to send the request and EXPECTED_TYPE
	the type of message we expect. Does checks on the ccid
	header. TIMEOUT is the timeout value in ms. NO_DEBUG may be set to
	avoid debug messages in case of no error; this can be overriden
	with a glibal debug level of at least 3. Returns 0 on success. */
	static int
	bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
	size_t *nread, int expected_type, int seqno, int timeout,
	int no_debug)
	{
	int rc;
	int msglen;
	int eagain_retries = 0;

	/* Fixme: The next line for the current Valgrind without support
	for USB IOCTLs. */
	memset (buffer, 0, length);
	retry:
	if (handle->idev)
	{
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
	(char*)buffer, length, &msglen, timeout);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc)
	{
	DEBUGOUT_1 ("usb_bulk_read error: %s\n", libusb_error_name (rc));
	if (rc == LIBUSB_ERROR_NO_DEVICE)
	{
	handle->enodev_seen = 1;
	return CCID_DRIVER_ERR_NO_READER;
	}

	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	if (msglen < 0)
	return CCID_DRIVER_ERR_INV_VALUE; /* Faulty libusb. */
	*nread = msglen;
	}
	else
	{
	rc = read (handle->dev_fd, buffer, length);
	if (rc < 0)
	{
	rc = errno;
	DEBUGOUT_2 ("read from %d failed: %s\n",
	handle->dev_fd, strerror (rc));
	if (rc == EAGAIN && eagain_retries++ < 5)
	{
	my_sleep (1);
	goto retry;
	}
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	*nread = msglen = rc;
	}
	eagain_retries = 0;

	if (msglen < 10)
	{
	DEBUGOUT_1 ("bulk-in msg too short (%u)\n", (unsigned int)msglen);
	abort_cmd (handle, seqno);
	return CCID_DRIVER_ERR_INV_VALUE;
	}
	if (buffer[5] != 0)
	{
	DEBUGOUT_1 ("unexpected bulk-in slot (%d)\n", buffer[5]);
	return CCID_DRIVER_ERR_INV_VALUE;
	}
	if (buffer[6] != seqno)
	{
	DEBUGOUT_2 ("bulk-in seqno does not match (%d/%d)\n",
	seqno, buffer[6]);
	/* Retry until we are synced again. */
	goto retry;
	}

	/* We need to handle the time extension request before we check that
	we got the expected message type. This is in particular required
	for the Cherry keyboard which sends a time extension request for
	each key hit. */
	if ( !(buffer[7] & 0x03) && (buffer[7] & 0xC0) == 0x80)
	{
	/* Card present and active, time extension requested. */
	DEBUGOUT_2 ("time extension requested (%02X,%02X)\n",
	buffer[7], buffer[8]);
	goto retry;
	}

	if (buffer[0] != expected_type)
	{
	DEBUGOUT_1 ("unexpected bulk-in msg type (%02x)\n", buffer[0]);
	abort_cmd (handle, seqno);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	if (debug_level && (!no_debug \|\| debug_level >= 3))
	{
	switch (buffer[0])
	{
	case RDR_to_PC_DataBlock:
	print_r2p_datablock (buffer, msglen);
	break;
	case RDR_to_PC_SlotStatus:
	print_r2p_slotstatus (buffer, msglen);
	break;
	case RDR_to_PC_Parameters:
	print_r2p_parameters (buffer, msglen);
	break;
	case RDR_to_PC_Escape:
	print_r2p_escape (buffer, msglen);
	break;
	case RDR_to_PC_DataRate:
	print_r2p_datarate (buffer, msglen);
	break;
	default:
	print_r2p_unknown (buffer, msglen);
	break;
	}
	}
	if (CCID_COMMAND_FAILED (buffer))
	print_command_failed (buffer);

	/* Check whether a card is at all available. Note: If you add new
	error codes here, check whether they need to be ignored in
	send_escape_cmd. */
	switch ((buffer[7] & 0x03))
	{
	case 0: /* no error */ break;
	case 1: return CCID_DRIVER_ERR_CARD_INACTIVE;
	case 2: return CCID_DRIVER_ERR_NO_CARD;
	case 3: /* RFU */ break;
	}
	return 0;
	}



	/* Send an abort sequence and wait until everything settled. */
	static int
	abort_cmd (ccid_driver_t handle, int seqno)
	{
	int rc;
	char dummybuf[8];
	unsigned char msg[100];
	int msglen;

	if (!handle->idev)
	{
	/* I don't know how to send an abort to non-USB devices. */
	rc = CCID_DRIVER_ERR_NOT_SUPPORTED;
	}

	seqno &= 0xff;
	DEBUGOUT_1 ("sending abort sequence for seqno %d\n", seqno);
	/* Send the abort command to the control pipe. Note that we don't
	need to keep track of sent abort commands because there should
	never be another thread using the same slot concurrently. */
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_control_transfer (handle->idev,
	0x21,/* bmRequestType: host-to-device,
	class specific, to interface. */
	1, /* ABORT */
	(seqno << 8 \| 0 /* slot */),
	handle->ifc_no,
	dummybuf, 0,
	1000 /* ms timeout */);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc)
	{
	DEBUGOUT_1 ("usb_control_msg error: %s\n", libusb_error_name (rc));
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	/* Now send the abort command to the bulk out pipe using the same
	SEQNO and SLOT. Do this in a loop to so that all seqno are
	tried. */
	seqno--; /* Adjust for next increment. */
	do
	{
	int transferred;

	seqno++;
	msg[0] = PC_to_RDR_Abort;
	msg[5] = 0; /* slot */
	msg[6] = seqno;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	msglen = 10;
	set_msg_len (msg, 0);

	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_out,
	(char*)msg, msglen, &transferred,
	5000 /* ms timeout */);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc == 0 && transferred == msglen)
	rc = 0;
	else if (rc)
	DEBUGOUT_1 ("usb_bulk_write error in abort_cmd: %s\n",
	libusb_error_name (rc));

	if (rc)
	return rc;

	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
	(char*)msg, sizeof msg, &msglen,
	5000 /ms timeout/);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	if (rc)
	{
	DEBUGOUT_1 ("usb_bulk_read error in abort_cmd: %s\n",
	libusb_error_name (rc));
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	if (msglen < 10)
	{
	DEBUGOUT_1 ("bulk-in msg in abort_cmd too short (%u)\n",
	(unsigned int)msglen);
	return CCID_DRIVER_ERR_INV_VALUE;
	}
	if (msg[5] != 0)
	{
	DEBUGOUT_1 ("unexpected bulk-in slot (%d) in abort_cmd\n", msg[5]);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	DEBUGOUT_3 ("status: %02X error: %02X octet[9]: %02X\n",
	msg[7], msg[8], msg[9]);
	if (CCID_COMMAND_FAILED (msg))
	print_command_failed (msg);
	}
	while (msg[0] != RDR_to_PC_SlotStatus && msg[5] != 0 && msg[6] != seqno);

	handle->seqno = ((seqno + 1) & 0xff);
	DEBUGOUT ("sending abort sequence succeeded\n");

	return 0;
	}


	/* Note that this function won't return the error codes NO_CARD or
	CARD_INACTIVE. IF RESULT is not NULL, the result from the
	operation will get returned in RESULT and its length in RESULTLEN.
	If the response is larger than RESULTMAX, an error is returned and
	the required buffer length returned in RESULTLEN. */
	static int
	send_escape_cmd (ccid_driver_t handle,
	const unsigned char *data, size_t datalen,
	unsigned char result, size_t resultmax, size_t resultlen)
	{
	int rc;
	unsigned char msg[100];
	size_t msglen;
	unsigned char seqno;

	if (resultlen)
	*resultlen = 0;

	if (datalen > sizeof msg - 10)
	return CCID_DRIVER_ERR_INV_VALUE; /* Escape data too large. */

	msg[0] = PC_to_RDR_Escape;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	memcpy (msg+10, data, datalen);
	msglen = 10 + datalen;
	set_msg_len (msg, datalen);

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;
	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_Escape,
	seqno, 5000, 0);
	if (result)
	switch (rc)
	{
	/* We need to ignore certain errorcode here. */
	case 0:
	case CCID_DRIVER_ERR_CARD_INACTIVE:
	case CCID_DRIVER_ERR_NO_CARD:
	{
	if (msglen > resultmax)
	rc = CCID_DRIVER_ERR_INV_VALUE; /* Response too large. */
	else
	{
	memcpy (result, msg, msglen);
	*resultlen = msglen;
	rc = 0;
	}
	}
	break;
	default:
	break;
	}

	return rc;
	}


	int
	ccid_transceive_escape (ccid_driver_t handle,
	const unsigned char *data, size_t datalen,
	unsigned char resp, size_t maxresplen, size_t nresp)
	{
	return send_escape_cmd (handle, data, datalen, resp, maxresplen, nresp);
	}



	/* experimental */
	int
	ccid_poll (ccid_driver_t handle)
	{
	int rc;
	unsigned char msg[10];
	int msglen;
	int i, j;

	if (handle->idev)
	{
	rc = libusb_interrupt_transfer (handle->idev, handle->ep_intr,
	(char*)msg, sizeof msg, &msglen,
	0 /* ms timeout */ );
	if (rc == LIBUSB_ERROR_TIMEOUT)
	return 0;
	}
	else
	return 0;

	if (rc)
	{
	DEBUGOUT_1 ("usb_intr_read error: %s\n", libusb_error_name (rc));
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	if (msglen < 1)
	{
	DEBUGOUT ("intr-in msg too short\n");
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	if (msg[0] == RDR_to_PC_NotifySlotChange)
	{
	DEBUGOUT ("notify slot change:");
	for (i=1; i < msglen; i++)
	for (j=0; j < 4; j++)
	DEBUGOUT_CONT_3 (" %d:%c%c",
	(i-1)*4+j,
	(msg[i] & (1<<(j*2)))? 'p':'-',
	(msg[i] & (2<<(j2)))? '':' ');
	DEBUGOUT_LF ();
	}
	else if (msg[0] == RDR_to_PC_HardwareError)
	{
	DEBUGOUT ("hardware error occurred\n");
	}
	else
	{
	DEBUGOUT_1 ("unknown intr-in msg of type %02X\n", msg[0]);
	}

	return 0;
	}


	/* Note that this function won't return the error codes NO_CARD or
	CARD_INACTIVE */
	int
	ccid_slot_status (ccid_driver_t handle, int *statusbits, int on_wire)
	{
	int rc;
	unsigned char msg[100];
	size_t msglen;
	unsigned char seqno;
	int retries = 0;

	if (handle->powered_off)
	return CCID_DRIVER_ERR_NO_READER;

	/* If the card (with its lower-level driver) doesn't require
	GET_STATUS on wire (because it supports INTERRUPT transfer for
	status change, or it's a token which has a card always inserted),
	no need to send on wire. */
	if (!on_wire && !ccid_require_get_status (handle))
	{
	*statusbits = 0;
	return 0;
	}

	retry:
	msg[0] = PC_to_RDR_GetSlotStatus;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, 0);

	rc = bulk_out (handle, msg, 10, 1);
	if (rc)
	return rc;
	/* Note that we set the NO_DEBUG flag here, so that the logs won't
	get cluttered up by a ticker function checking for the slot
	status and debugging enabled. */
	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_SlotStatus,
	seqno, retries? 1000 : 200, 1);
	if (rc == CCID_DRIVER_ERR_CARD_IO_ERROR && retries < 3)
	{
	if (!retries)
	{
	DEBUGOUT ("USB: CALLING USB_CLEAR_HALT\n");
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	libusb_clear_halt (handle->idev, handle->ep_bulk_in);
	libusb_clear_halt (handle->idev, handle->ep_bulk_out);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	}
	else
	DEBUGOUT ("USB: RETRYING bulk_in AGAIN\n");
	retries++;
	goto retry;
	}
	if (rc && rc != CCID_DRIVER_ERR_NO_CARD && rc != CCID_DRIVER_ERR_CARD_INACTIVE)
	return rc;
	*statusbits = (msg[7] & 3);

	return 0;
	}


	/* Parse ATR string (of ATRLEN) and update parameters at PARAM.
	Calling this routine, it should prepare default values at PARAM
	beforehand. This routine assumes that card is accessed by T=1
	protocol. It doesn't analyze historical bytes at all.

	Returns < 0 value on error:
	-1 for parse error or integrity check error
	-2 for card doesn't support T=1 protocol
	-3 for parameters are nod explicitly defined by ATR
	-4 for this driver doesn't support CRC

	Returns >= 0 on success:
	0 for card is negotiable mode
	1 for card is specific mode (and not negotiable)
	*/
	static int
	update_param_by_atr (unsigned char param, unsigned char atr, size_t atrlen)
	{
	int i = -1;
	int t, y, chk;
	int historical_bytes_num, negotiable = 1;

	#define NEXTBYTE() do { i++; if (atrlen <= i) return -1; } while (0)

	NEXTBYTE ();

	if (atr[i] == 0x3F)
	param[1] \|= 0x02; /* Convention is inverse. */
	NEXTBYTE ();

	y = (atr[i] >> 4);
	historical_bytes_num = atr[i] & 0x0f;
	NEXTBYTE ();

	if ((y & 1))
	{
	param[0] = atr[i]; /* TA1 - Fi & Di */
	NEXTBYTE ();
	}

	if ((y & 2))
	NEXTBYTE (); /* TB1 - ignore */

	if ((y & 4))
	{
	param[2] = atr[i]; /* TC1 - Guard Time */
	NEXTBYTE ();
	}

	if ((y & 8))
	{
	y = (atr[i] >> 4); /* TD1 */
	t = atr[i] & 0x0f;
	NEXTBYTE ();

	if ((y & 1))
	{ /* TA2 - PPS mode */
	if ((atr[i] & 0x0f) != 1)
	return -2; /* Wrong card protocol (!= 1). */

	if ((atr[i] & 0x10) != 0x10)
	return -3; /* Transmission parameters are implicitly defined. */

	negotiable = 0; /* TA2 means specific mode. */
	NEXTBYTE ();
	}

	if ((y & 2))
	NEXTBYTE (); /* TB2 - ignore */

	if ((y & 4))
	NEXTBYTE (); /* TC2 - ignore */

	if ((y & 8))
	{
	y = (atr[i] >> 4); /* TD2 */
	t = atr[i] & 0x0f;
	NEXTBYTE ();
	}
	else
	y = 0;

	while (y)
	{
	if ((y & 1))
	{ /* TAx */
	if (t == 1)
	param[5] = atr[i]; /* IFSC */
	else if (t == 15)
	/* XXX: check voltage? */
	param[4] = (atr[i] >> 6); /* ClockStop */

	NEXTBYTE ();
	}

	if ((y & 2))
	{
	if (t == 1)
	param[3] = atr[i]; /* TBx - BWI & CWI */
	NEXTBYTE ();
	}

	if ((y & 4))
	{
	if (t == 1)
	param[1] \|= (atr[i] & 0x01); /* TCx - LRC/CRC */
	NEXTBYTE ();

	if (param[1] & 0x01)
	return -4; /* CRC not supported yet. */
	}

	if ((y & 8))
	{
	y = (atr[i] >> 4); /* TDx */
	t = atr[i] & 0x0f;
	NEXTBYTE ();
	}
	else
	y = 0;
	}
	}

	i += historical_bytes_num - 1;
	NEXTBYTE ();
	if (atrlen != i+1)
	return -1;

	#undef NEXTBYTE

	chk = 0;
	do
	{
	chk ^= atr[i];
	i--;
	}
	while (i > 0);

	if (chk != 0)
	return -1;

	return negotiable;
	}


	/* Return the ATR of the card. This is not a cached value and thus an
	actual reset is done. */
	int
	ccid_get_atr (ccid_driver_t handle,
	unsigned char atr, size_t maxatrlen, size_t atrlen)
	{
	int rc;
	int statusbits;
	unsigned char msg[100];
	unsigned char *tpdu;
	size_t msglen, tpdulen;
	unsigned char seqno;
	int use_crc = 0;
	unsigned int edc;
	int tried_iso = 0;
	int got_param;
	unsigned char param[7] = { /* For Protocol T=1 */
	0x11, /* bmFindexDindex */
	0x10, /* bmTCCKST1 */
	0x00, /* bGuardTimeT1 */
	0x4d, /* bmWaitingIntegersT1 */
	0x00, /* bClockStop */
	0x20, /* bIFSC */
	0x00 /* bNadValue */
	};

	/* First check whether a card is available. */
	rc = ccid_slot_status (handle, &statusbits, 1);
	if (rc)
	return rc;
	if (statusbits == 2)
	return CCID_DRIVER_ERR_NO_CARD;

	/* For an inactive and also for an active card, issue the PowerOn
	command to get the ATR. */
	again:
	msg[0] = PC_to_RDR_IccPowerOn;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	/* power select (0=auto, 1=5V, 2=3V, 3=1.8V) */
	msg[7] = handle->auto_voltage ? 0 : 1;
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, 0);
	msglen = 10;

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;
	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_DataBlock,
	seqno, 5000, 0);
	if (rc)
	return rc;
	if (!tried_iso && CCID_COMMAND_FAILED (msg) && CCID_ERROR_CODE (msg) == 0xbb
	&& ((handle->id_vendor == VENDOR_CHERRY
	&& handle->id_product == 0x0005)
	\|\| (handle->id_vendor == VENDOR_GEMPC
	&& handle->id_product == 0x4433)
	))
	{
	tried_iso = 1;
	/* Try switching to ISO mode. */
	if (!send_escape_cmd (handle, (const unsigned char*)"\xF1\x01", 2,
	NULL, 0, NULL))
	goto again;
	}
	else if (CCID_COMMAND_FAILED (msg))
	return CCID_DRIVER_ERR_CARD_IO_ERROR;


	handle->powered_off = 0;

	if (atr)
	{
	size_t n = msglen - 10;

	if (n > maxatrlen)
	n = maxatrlen;
	memcpy (atr, msg+10, n);
	*atrlen = n;
	}

	param[6] = handle->nonnull_nad? ((1 << 4) \| 0): 0;
	rc = update_param_by_atr (param, msg+10, msglen - 10);
	if (rc < 0)
	{
	DEBUGOUT_1 ("update_param_by_atr failed: %d\n", rc);
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	got_param = 0;

	if (handle->auto_param)
	{
	msg[0] = PC_to_RDR_GetParameters;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, 0);
	msglen = 10;
	rc = bulk_out (handle, msg, msglen, 0);
	if (!rc)
	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_Parameters,
	seqno, 2000, 0);
	if (rc)
	DEBUGOUT ("GetParameters failed\n");
	else if (msglen == 17 && msg[9] == 1)
	got_param = 1;
	}
	else if (handle->auto_pps)
	;
	else if (rc == 1) /* It's negotiable, send PPS. */
	{
	msg[0] = PC_to_RDR_XfrBlock;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0;
	msg[8] = 0;
	msg[9] = 0;
	msg[10] = 0xff; /* PPSS */
	msg[11] = 0x11; /* PPS0: PPS1, Protocol T=1 */
	msg[12] = param[0]; /* PPS1: Fi / Di */
	msg[13] = 0xff ^ 0x11 ^ param[0]; /* PCK */
	set_msg_len (msg, 4);
	msglen = 10 + 4;

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;

	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_DataBlock,
	seqno, 5000, 0);
	if (rc)
	return rc;

	if (msglen != 10 + 4)
	{
	DEBUGOUT_1 ("Setting PPS failed: %zu\n", msglen);
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	if (msg[10] != 0xff \|\| msg[11] != 0x11 \|\| msg[12] != param[0])
	{
	DEBUGOUT_1 ("Setting PPS failed: 0x%02x\n", param[0]);
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	}

	/* Setup parameters to select T=1. */
	msg[0] = PC_to_RDR_SetParameters;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 1; /* Select T=1. */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */

	if (!got_param)
	memcpy (&msg[10], param, 7);
	set_msg_len (msg, 7);
	msglen = 10 + 7;

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;
	rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_Parameters,
	seqno, 5000, 0);
	if (rc)
	DEBUGOUT ("SetParameters failed (ignored)\n");

	if (!rc && msglen > 15 && msg[15] >= 16 && msg[15] <= 254 )
	handle->ifsc = msg[15];
	else
	handle->ifsc = 128; /* Something went wrong, assume 128 bytes. */

	if (handle->nonnull_nad && msglen > 16 && msg[16] == 0)
	{
	DEBUGOUT ("Use Null-NAD, clearing handle->nonnull_nad.\n");
	handle->nonnull_nad = 0;
	}

	handle->t1_ns = 0;
	handle->t1_nr = 0;

	/* Send an S-Block with our maximum IFSD to the CCID. */
	if (!handle->apdu_level && !handle->auto_ifsd)
	{
	tpdu = msg+10;
	/* NAD: DAD=1, SAD=0 */
	tpdu[0] = handle->nonnull_nad? ((1 << 4) \| 0): 0;
	tpdu[1] = (0xc0 \| 0 \| 1); /* S-block request: change IFSD */
	tpdu[2] = 1;
	tpdu[3] = handle->max_ifsd? handle->max_ifsd : 32;
	tpdulen = 4;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;

	msg[0] = PC_to_RDR_XfrBlock;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0;
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, tpdulen);
	msglen = 10 + tpdulen;

	if (debug_level > 1)
	DEBUGOUT_3 ("T=1: put %c-block seq=%d%s\n",
	((msg[11] & 0xc0) == 0x80)? 'R' :
	(msg[11] & 0x80)? 'S' : 'I',
	((msg[11] & 0x80)? !!(msg[11]& 0x10)
	: !!(msg[11] & 0x40)),
	(!(msg[11] & 0x80) && (msg[11] & 0x20)? " [more]":""));

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;


	rc = bulk_in (handle, msg, sizeof msg, &msglen,
	RDR_to_PC_DataBlock, seqno, 5000, 0);
	if (rc)
	return rc;

	tpdu = msg + 10;
	tpdulen = msglen - 10;

	if (tpdulen < 4)
	return CCID_DRIVER_ERR_ABORTED;

	if (debug_level > 1)
	DEBUGOUT_4 ("T=1: got %c-block seq=%d err=%d%s\n",
	((msg[11] & 0xc0) == 0x80)? 'R' :
	(msg[11] & 0x80)? 'S' : 'I',
	((msg[11] & 0x80)? !!(msg[11]& 0x10)
	: !!(msg[11] & 0x40)),
	((msg[11] & 0xc0) == 0x80)? (msg[11] & 0x0f) : 0,
	(!(msg[11] & 0x80) && (msg[11] & 0x20)? " [more]":""));

	if ((tpdu[1] & 0xe0) != 0xe0 \|\| tpdu[2] != 1)
	{
	DEBUGOUT ("invalid response for S-block (Change-IFSD)\n");
	return -1;
	}
	DEBUGOUT_1 ("IFSD has been set to %d\n", tpdu[3]);
	}

	return 0;
	}




	static unsigned int
	compute_edc (const unsigned char *data, size_t datalen, int use_crc)
	{
	if (use_crc)
	{
	return 0x42; /* Not yet implemented. */
	}
	else
	{
	unsigned char crc = 0;

	for (; datalen; datalen--)
	crc ^= *data++;
	return crc;
	}
	}


	/* Return true if APDU is an extended length one. */
	static int
	is_exlen_apdu (const unsigned char *apdu, size_t apdulen)
	{
	if (apdulen < 7 \|\| apdu[4])
	return 0; /* Too short or no Z byte. */
	return 1;
	}


	/* Helper for ccid_transceive used for APDU level exchanges. */
	static int
	ccid_transceive_apdu_level (ccid_driver_t handle,
	const unsigned char *apdu_buf, size_t apdu_len,
	unsigned char *resp, size_t maxresplen,
	size_t *nresp)
	{
	int rc;
	unsigned char msg[CCID_MAX_BUF];
	const unsigned char *apdu_p;
	size_t apdu_part_len;
	size_t msglen;
	unsigned char seqno;
	int bwi = 4;
	unsigned char chain = 0;

	if (apdu_len == 0 \|\| apdu_len > sizeof (msg) - 10)
	return CCID_DRIVER_ERR_INV_VALUE; /* Invalid length. */

	apdu_p = apdu_buf;
	while (1)
	{
	apdu_part_len = apdu_len;
	if (apdu_part_len > handle->max_ccid_msglen - 10)
	{
	apdu_part_len = handle->max_ccid_msglen - 10;
	chain \|= 0x01;
	}

	msg[0] = PC_to_RDR_XfrBlock;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = bwi;
	msg[8] = chain;
	msg[9] = 0;
	memcpy (msg+10, apdu_p, apdu_part_len);
	set_msg_len (msg, apdu_part_len);
	msglen = 10 + apdu_part_len;

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;

	apdu_p += apdu_part_len;
	apdu_len -= apdu_part_len;

	rc = bulk_in (handle, msg, sizeof msg, &msglen,
	RDR_to_PC_DataBlock, seqno, CCID_CMD_TIMEOUT, 0);
	if (rc)
	return rc;

	if (!(chain & 0x01))
	break;

	chain = 0x02;
	}

	apdu_len = 0;
	while (1)
	{
	apdu_part_len = msglen - 10;
	if (resp && apdu_len + apdu_part_len <= maxresplen)
	memcpy (resp + apdu_len, msg+10, apdu_part_len);
	apdu_len += apdu_part_len;

	if (!(msg[9] & 0x01))
	break;

	msg[0] = PC_to_RDR_XfrBlock;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = bwi;
	msg[8] = 0x10; /* Request next data block */
	msg[9] = 0;
	set_msg_len (msg, 0);
	msglen = 10;

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;

	rc = bulk_in (handle, msg, sizeof msg, &msglen,
	RDR_to_PC_DataBlock, seqno, CCID_CMD_TIMEOUT, 0);
	if (rc)
	return rc;
	}

	if (resp)
	{
	if (apdu_len > maxresplen)
	{
	DEBUGOUT_2 ("provided buffer too short for received data "
	"(%u/%u)\n",
	(unsigned int)apdu_len, (unsigned int)maxresplen);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	*nresp = apdu_len;
	}

	return 0;
	}



	/*
	Protocol T=1 overview

	Block Structure:
	Prologue Field:
	1 byte Node Address (NAD)
	1 byte Protocol Control Byte (PCB)
	1 byte Length (LEN)
	Information Field:
	0-254 byte APDU or Control Information (INF)
	Epilogue Field:
	1 byte Error Detection Code (EDC)

	NAD:
	bit 7 unused
	bit 4..6 Destination Node Address (DAD)
	bit 3 unused
	bit 2..0 Source Node Address (SAD)

	If node adresses are not used, SAD and DAD should be set to 0 on
	the first block sent to the card. If they are used they should
	have different values (0 for one is okay); that first block sets up
	the addresses of the nodes.

	PCB:
	Information Block (I-Block):
	bit 7 0
	bit 6 Sequence number (yep, that is modulo 2)
	bit 5 Chaining flag
	bit 4..0 reserved
	Received-Ready Block (R-Block):
	bit 7 1
	bit 6 0
	bit 5 0
	bit 4 Sequence number
	bit 3..0 0 = no error
	1 = EDC or parity error
	2 = other error
	other values are reserved
	Supervisory Block (S-Block):
	bit 7 1
	bit 6 1
	bit 5 clear=request,set=response
	bit 4..0 0 = resyncronisation request
	1 = information field size request
	2 = abort request
	3 = extension of BWT request
	4 = VPP error
	other values are reserved

	*/

	int
	ccid_transceive (ccid_driver_t handle,
	const unsigned char *apdu_buf, size_t apdu_buflen,
	unsigned char resp, size_t maxresplen, size_t nresp)
	{
	int rc;
	/* The size of the buffer used to be 10+259. For the via_escape
	hack we need one extra byte, thus 11+259. */
	unsigned char send_buffer[11+259], recv_buffer[11+259];
	const unsigned char *apdu;
	size_t apdulen;
	unsigned char msg, tpdu, *p;
	size_t msglen, tpdulen, last_tpdulen, n;
	unsigned char seqno;
	unsigned int edc;
	int use_crc = 0;
	int hdrlen, pcboff;
	size_t dummy_nresp;
	int via_escape = 0;
	int next_chunk = 1;
	int sending = 1;
	int retries = 0;
	int resyncing = 0;
	int nad_byte;

	if (!nresp)
	nresp = &dummy_nresp;
	*nresp = 0;

	/* Smarter readers allow sending APDUs directly; divert here. */
	if (handle->apdu_level)
	{
	/* We employ a hack for Omnikey readers which are able to send
	TPDUs using an escape sequence. There is no documentation
	but the Windows driver does it this way. Tested using a
	CM6121. This method works also for the Cherry XX44
	keyboards; however there are problems with the
	ccid_tranceive_secure which leads to a loss of sync on the
	CCID level. If Cherry wants to make their keyboard work
	again, they should hand over some docs. */
	if ((handle->id_vendor == VENDOR_OMNIKEY
	\|\| (!handle->idev && handle->id_product == TRANSPORT_CM4040))
	&& handle->apdu_level < 2
	&& is_exlen_apdu (apdu_buf, apdu_buflen))
	via_escape = 1;
	else
	return ccid_transceive_apdu_level (handle, apdu_buf, apdu_buflen,
	resp, maxresplen, nresp);
	}

	/* The other readers we support require sending TPDUs. */

	tpdulen = 0; /* Avoid compiler warning about no initialization. */
	msg = send_buffer;
	hdrlen = via_escape? 11 : 10;

	/* NAD: DAD=1, SAD=0 */
	nad_byte = handle->nonnull_nad? ((1 << 4) \| 0): 0;
	if (via_escape)
	nad_byte = 0;

	last_tpdulen = 0; /* Avoid gcc warning (controlled by RESYNCING). */
	for (;;)
	{
	if (next_chunk)
	{
	next_chunk = 0;

	apdu = apdu_buf;
	apdulen = apdu_buflen;
	assert (apdulen);

	/* Construct an I-Block. */
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = ((handle->t1_ns & 1) << 6); /* I-block */
	if (apdulen > handle->ifsc )
	{
	apdulen = handle->ifsc;
	apdu_buf += handle->ifsc;
	apdu_buflen -= handle->ifsc;
	tpdu[1] \|= (1 << 5); /* Set more bit. */
	}
	tpdu[2] = apdulen;
	memcpy (tpdu+3, apdu, apdulen);
	tpdulen = 3 + apdulen;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;
	}

	if (via_escape)
	{
	msg[0] = PC_to_RDR_Escape;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* RFU */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	msg[10] = 0x1a; /* Omnikey command to send a TPDU. */
	set_msg_len (msg, 1 + tpdulen);
	}
	else
	{
	msg[0] = PC_to_RDR_XfrBlock;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 4; /* bBWI */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	set_msg_len (msg, tpdulen);
	}
	msglen = hdrlen + tpdulen;
	if (!resyncing)
	last_tpdulen = tpdulen;
	pcboff = hdrlen+1;

	if (debug_level > 1)
	DEBUGOUT_3 ("T=1: put %c-block seq=%d%s\n",
	((msg[pcboff] & 0xc0) == 0x80)? 'R' :
	(msg[pcboff] & 0x80)? 'S' : 'I',
	((msg[pcboff] & 0x80)? !!(msg[pcboff]& 0x10)
	: !!(msg[pcboff] & 0x40)),
	(!(msg[pcboff] & 0x80) && (msg[pcboff] & 0x20)?
	" [more]":""));

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;

	msg = recv_buffer;
	rc = bulk_in (handle, msg, sizeof recv_buffer, &msglen,
	via_escape? RDR_to_PC_Escape : RDR_to_PC_DataBlock,
	seqno, CCID_CMD_TIMEOUT, 0);
	if (rc)
	return rc;

	tpdu = msg + hdrlen;
	tpdulen = msglen - hdrlen;
	resyncing = 0;

	if (tpdulen < 4)
	{
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	libusb_clear_halt (handle->idev, handle->ep_bulk_in);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	return CCID_DRIVER_ERR_ABORTED;
	}

	if (debug_level > 1)
	DEBUGOUT_4 ("T=1: got %c-block seq=%d err=%d%s\n",
	((msg[pcboff] & 0xc0) == 0x80)? 'R' :
	(msg[pcboff] & 0x80)? 'S' : 'I',
	((msg[pcboff] & 0x80)? !!(msg[pcboff]& 0x10)
	: !!(msg[pcboff] & 0x40)),
	((msg[pcboff] & 0xc0) == 0x80)? (msg[pcboff] & 0x0f) : 0,
	(!(msg[pcboff] & 0x80) && (msg[pcboff] & 0x20)?
	" [more]":""));

	if (!(tpdu[1] & 0x80))
	{ /* This is an I-block. */
	retries = 0;
	if (sending)
	{ /* last block sent was successful. */
	handle->t1_ns ^= 1;
	sending = 0;
	}

	if (!!(tpdu[1] & 0x40) != handle->t1_nr)
	{ /* Response does not match our sequence number. */
	msg = send_buffer;
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = (0x80 \| (handle->t1_nr & 1) << 4 \| 2); /* R-block */
	tpdu[2] = 0;
	tpdulen = 3;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;

	continue;
	}

	handle->t1_nr ^= 1;

	p = tpdu + 3; /* Skip the prologue field. */
	n = tpdulen - 3 - 1; /* Strip the epilogue field. */
	/* fixme: verify the checksum. */
	if (resp)
	{
	if (n > maxresplen)
	{
	DEBUGOUT_2 ("provided buffer too short for received data "
	"(%u/%u)\n",
	(unsigned int)n, (unsigned int)maxresplen);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	memcpy (resp, p, n);
	resp += n;
	*nresp += n;
	maxresplen -= n;
	}

	if (!(tpdu[1] & 0x20))
	return 0; /* No chaining requested - ready. */

	msg = send_buffer;
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = (0x80 \| (handle->t1_nr & 1) << 4); /* R-block */
	tpdu[2] = 0;
	tpdulen = 3;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;
	}
	else if ((tpdu[1] & 0xc0) == 0x80)
	{ /* This is a R-block. */
	if ( (tpdu[1] & 0x0f))
	{
	retries++;
	if (via_escape && retries == 1 && (msg[pcboff] & 0x0f))
	{
	/* Error probably due to switching to TPDU. Send a
	resync request. We use the recv_buffer so that
	we don't corrupt the send_buffer. */
	msg = recv_buffer;
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = 0xc0; /* S-block resync request. */
	tpdu[2] = 0;
	tpdulen = 3;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;
	resyncing = 1;
	DEBUGOUT ("T=1: requesting resync\n");
	}
	else if (retries > 3)
	{
	DEBUGOUT ("T=1: 3 failed retries\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	else
	{
	/* Error: repeat last block */
	msg = send_buffer;
	tpdulen = last_tpdulen;
	}
	}
	else if (sending && !!(tpdu[1] & 0x10) == handle->t1_ns)
	{ /* Response does not match our sequence number. */
	DEBUGOUT ("R-block with wrong seqno received on more bit\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	else if (sending)
	{ /* Send next chunk. */
	retries = 0;
	msg = send_buffer;
	next_chunk = 1;
	handle->t1_ns ^= 1;
	}
	else
	{
	DEBUGOUT ("unexpected ACK R-block received\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	}
	else
	{ /* This is a S-block. */
	retries = 0;
	DEBUGOUT_2 ("T=1: S-block %s received cmd=%d\n",
	(tpdu[1] & 0x20)? "response": "request",
	(tpdu[1] & 0x1f));
	if ( !(tpdu[1] & 0x20) && (tpdu[1] & 0x1f) == 1 && tpdu[2] == 1)
	{
	/* Information field size request. */
	unsigned char ifsc = tpdu[3];

	if (ifsc < 16 \|\| ifsc > 254)
	return CCID_DRIVER_ERR_CARD_IO_ERROR;

	msg = send_buffer;
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = (0xc0 \| 0x20 \| 1); /* S-block response */
	tpdu[2] = 1;
	tpdu[3] = ifsc;
	tpdulen = 4;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;
	DEBUGOUT_1 ("T=1: requesting an ifsc=%d\n", ifsc);
	}
	else if ( !(tpdu[1] & 0x20) && (tpdu[1] & 0x1f) == 3 && tpdu[2])
	{
	/* Wait time extension request. */
	unsigned char bwi = tpdu[3];
	msg = send_buffer;
	tpdu = msg + hdrlen;
	tpdu[0] = nad_byte;
	tpdu[1] = (0xc0 \| 0x20 \| 3); /* S-block response */
	tpdu[2] = 1;
	tpdu[3] = bwi;
	tpdulen = 4;
	edc = compute_edc (tpdu, tpdulen, use_crc);
	if (use_crc)
	tpdu[tpdulen++] = (edc >> 8);
	tpdu[tpdulen++] = edc;
	DEBUGOUT_1 ("T=1: waittime extension of bwi=%d\n", bwi);
	print_progress (handle);
	}
	else if ( (tpdu[1] & 0x20) && (tpdu[1] & 0x1f) == 0 && !tpdu[2])
	{
	DEBUGOUT ("T=1: resync ack from reader\n");
	/* Repeat previous block. */
	msg = send_buffer;
	tpdulen = last_tpdulen;
	}
	else
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	} /* end T=1 protocol loop. */

	return 0;
	}


	/* Send the CCID Secure command to the reader. APDU_BUF should
	contain the APDU template. PIN_MODE defines how the pin gets
	formatted:

	1 := The PIN is ASCII encoded and of variable length. The
	length of the PIN entered will be put into Lc by the reader.
	The APDU should me made up of 4 bytes without Lc.

	PINLEN_MIN and PINLEN_MAX define the limits for the pin length. 0
	may be used t enable reasonable defaults.

	When called with RESP and NRESP set to NULL, the function will
	merely check whether the reader supports the secure command for the
	given APDU and PIN_MODE. */
	int
	ccid_transceive_secure (ccid_driver_t handle,
	const unsigned char *apdu_buf, size_t apdu_buflen,
	pininfo_t *pininfo,
	unsigned char resp, size_t maxresplen, size_t nresp)
	{
	int rc;
	unsigned char send_buffer[10+259], recv_buffer[10+259];
	unsigned char msg, tpdu, *p;
	size_t msglen, tpdulen, n;
	unsigned char seqno;
	size_t dummy_nresp;
	int testmode;
	int cherry_mode = 0;
	int add_zero = 0;
	int enable_varlen = 0;

	testmode = !resp && !nresp;

	if (!nresp)
	nresp = &dummy_nresp;
	*nresp = 0;

	if (apdu_buflen >= 4 && apdu_buf[1] == 0x20 && (handle->has_pinpad & 1))
	;
	else if (apdu_buflen >= 4 && apdu_buf[1] == 0x24 && (handle->has_pinpad & 2))
	;
	else
	return CCID_DRIVER_ERR_NO_PINPAD;

	if (!pininfo->minlen)
	pininfo->minlen = 1;
	if (!pininfo->maxlen)
	pininfo->maxlen = 15;

	/* Note that the 25 is the maximum value the SPR532 allows. */
	if (pininfo->minlen < 1 \|\| pininfo->minlen > 25
	\|\| pininfo->maxlen < 1 \|\| pininfo->maxlen > 25
	\|\| pininfo->minlen > pininfo->maxlen)
	return CCID_DRIVER_ERR_INV_VALUE;

	/* We have only tested a few readers so better don't risk anything
	and do not allow the use with other readers. */
	switch (handle->id_vendor)
	{
	case VENDOR_SCM: /* Tested with SPR 532. */
	case VENDOR_KAAN: /* Tested with KAAN Advanced (1.02). */
	case VENDOR_FSIJ: /* Tested with Gnuk (0.21). */
	pininfo->maxlen = 25;
	enable_varlen = 1;
	break;
	case VENDOR_REINER:/* Tested with cyberJack go */
	case VENDOR_VASCO: /* Tested with DIGIPASS 920 */
	enable_varlen = 1;
	break;
	case VENDOR_CHERRY:
	pininfo->maxlen = 15;
	enable_varlen = 1;
	/* The CHERRY XX44 keyboard echos an asterisk for each entered
	character on the keyboard channel. We use a special variant
	of PC_to_RDR_Secure which directs these characters to the
	smart card's bulk-in channel. We also need to append a zero
	Lc byte to the APDU. It seems that it will be replaced with
	the actual length instead of being appended before the APDU
	is send to the card. */
	add_zero = 1;
	if (handle->id_product != CHERRY_ST2000)
	cherry_mode = 1;
	break;
	default:
	if ((handle->id_vendor == VENDOR_GEMPC &&
	handle->id_product == GEMPC_PINPAD)
	\|\| (handle->id_vendor == VENDOR_VEGA &&
	handle->id_product == VEGA_ALPHA))
	{
	enable_varlen = 0;
	pininfo->minlen = 4;
	pininfo->maxlen = 8;
	break;
	}
	return CCID_DRIVER_ERR_NOT_SUPPORTED;
	}

	if (enable_varlen)
	pininfo->fixedlen = 0;

	if (testmode)
	return 0; /* Success */

	if (pininfo->fixedlen < 0 \|\| pininfo->fixedlen >= 16)
	return CCID_DRIVER_ERR_NOT_SUPPORTED;

	msg = send_buffer;
	if (handle->id_vendor == VENDOR_SCM)
	{
	DEBUGOUT ("sending escape sequence to switch to a case 1 APDU\n");
	rc = send_escape_cmd (handle, (const unsigned char*)"\x80\x02\x00", 3,
	NULL, 0, NULL);
	if (rc)
	return rc;
	}

	msg[0] = cherry_mode? 0x89 : PC_to_RDR_Secure;
	msg[5] = 0; /* slot */
	msg[6] = seqno = handle->seqno++;
	msg[7] = 0; /* bBWI */
	msg[8] = 0; /* RFU */
	msg[9] = 0; /* RFU */
	msg[10] = apdu_buf[1] == 0x20 ? 0 : 1;
	/* Perform PIN verification or PIN modification. */
	msg[11] = 0; /* Timeout in seconds. */
	msg[12] = 0x82; /* bmFormatString: Byte, pos=0, left, ASCII. */
	if (handle->id_vendor == VENDOR_SCM)
	{
	/* For the SPR532 the next 2 bytes need to be zero. We do this
	for all SCM products. Kudos to Martin Paljak for this
	hint. */
	msg[13] = msg[14] = 0;
	}
	else
	{
	msg[13] = pininfo->fixedlen; /* bmPINBlockString:
	0 bits of pin length to insert.
	PIN block size by fixedlen. */
	msg[14] = 0x00; /* bmPINLengthFormat:
	Units are bytes, position is 0. */
	}

	msglen = 15;
	if (apdu_buf[1] == 0x24)
	{
	msg[msglen++] = 0; /* bInsertionOffsetOld */
	msg[msglen++] = pininfo->fixedlen; /* bInsertionOffsetNew */
	}

	/* The following is a little endian word. */
	msg[msglen++] = pininfo->maxlen; /* wPINMaxExtraDigit-Maximum. */
	msg[msglen++] = pininfo->minlen; /* wPINMaxExtraDigit-Minimum. */

	if (apdu_buf[1] == 0x24)
	msg[msglen++] = apdu_buf[2] == 0 ? 0x03 : 0x01;
	/* bConfirmPIN
	* 0x00: new PIN once
	* 0x01: new PIN twice (confirmation)
	* 0x02: old PIN and new PIN once
	* 0x03: old PIN and new PIN twice (confirmation)
	*/

	msg[msglen] = 0x02; /* bEntryValidationCondition:
	Validation key pressed */
	if (pininfo->minlen && pininfo->maxlen && pininfo->minlen == pininfo->maxlen)
	msg[msglen] \|= 0x01; /* Max size reached. */
	msglen++;

	if (apdu_buf[1] == 0x20)
	msg[msglen++] = 0x01; /* bNumberMessage. */
	else
	msg[msglen++] = 0x03; /* bNumberMessage. */

	msg[msglen++] = 0x09; /* wLangId-Low: English FIXME: use the first entry. */
	msg[msglen++] = 0x04; /* wLangId-High. */

	if (apdu_buf[1] == 0x20)
	msg[msglen++] = 0; /* bMsgIndex. */
	else
	{
	msg[msglen++] = 0; /* bMsgIndex1. */
	msg[msglen++] = 1; /* bMsgIndex2. */
	msg[msglen++] = 2; /* bMsgIndex3. */
	}

	/* Calculate Lc. */
	n = pininfo->fixedlen;
	if (apdu_buf[1] == 0x24)
	n += pininfo->fixedlen;

	/* bTeoProlog follows: */
	msg[msglen++] = handle->nonnull_nad? ((1 << 4) \| 0): 0;
	msg[msglen++] = ((handle->t1_ns & 1) << 6); /* I-block */
	if (n)
	msg[msglen++] = n + 5; /* apdulen should be filled for fixed length. */
	else
	msg[msglen++] = 0; /* The apdulen will be filled in by the reader. */
	/* APDU follows: */
	msg[msglen++] = apdu_buf[0]; /* CLA */
	msg[msglen++] = apdu_buf[1]; /* INS */
	msg[msglen++] = apdu_buf[2]; /* P1 */
	msg[msglen++] = apdu_buf[3]; /* P2 */
	if (add_zero)
	msg[msglen++] = 0;
	else if (pininfo->fixedlen != 0)
	{
	msg[msglen++] = n;
	memset (&msg[msglen], 0xff, n);
	msglen += n;
	}
	/* An EDC is not required. */
	set_msg_len (msg, msglen - 10);

	rc = bulk_out (handle, msg, msglen, 0);
	if (rc)
	return rc;

	msg = recv_buffer;
	rc = bulk_in (handle, msg, sizeof recv_buffer, &msglen,
	RDR_to_PC_DataBlock, seqno, 30000, 0);
	if (rc)
	return rc;

	tpdu = msg + 10;
	tpdulen = msglen - 10;

	if (handle->apdu_level)
	{
	if (resp)
	{
	if (tpdulen > maxresplen)
	{
	DEBUGOUT_2 ("provided buffer too short for received data "
	"(%u/%u)\n",
	(unsigned int)tpdulen, (unsigned int)maxresplen);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	memcpy (resp, tpdu, tpdulen);
	*nresp = tpdulen;
	}
	return 0;
	}

	if (tpdulen < 4)
	{
	#ifdef USE_NPTH
	npth_unprotect ();
	#endif
	libusb_clear_halt (handle->idev, handle->ep_bulk_in);
	#ifdef USE_NPTH
	npth_protect ();
	#endif
	return CCID_DRIVER_ERR_ABORTED;
	}
	if (debug_level > 1)
	DEBUGOUT_4 ("T=1: got %c-block seq=%d err=%d%s\n",
	((msg[11] & 0xc0) == 0x80)? 'R' :
	(msg[11] & 0x80)? 'S' : 'I',
	((msg[11] & 0x80)? !!(msg[11]& 0x10) : !!(msg[11] & 0x40)),
	((msg[11] & 0xc0) == 0x80)? (msg[11] & 0x0f) : 0,
	(!(msg[11] & 0x80) && (msg[11] & 0x20)? " [more]":""));

	if (!(tpdu[1] & 0x80))
	{ /* This is an I-block. */
	/* Last block sent was successful. */
	handle->t1_ns ^= 1;

	if (!!(tpdu[1] & 0x40) != handle->t1_nr)
	{ /* Response does not match our sequence number. */
	DEBUGOUT ("I-block with wrong seqno received\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	handle->t1_nr ^= 1;

	p = tpdu + 3; /* Skip the prologue field. */
	n = tpdulen - 3 - 1; /* Strip the epilogue field. */
	/* fixme: verify the checksum. */
	if (resp)
	{
	if (n > maxresplen)
	{
	DEBUGOUT_2 ("provided buffer too short for received data "
	"(%u/%u)\n",
	(unsigned int)n, (unsigned int)maxresplen);
	return CCID_DRIVER_ERR_INV_VALUE;
	}

	memcpy (resp, p, n);
	resp += n;
	*nresp += n;
	maxresplen -= n;
	}

	if (!(tpdu[1] & 0x20))
	return 0; /* No chaining requested - ready. */

	DEBUGOUT ("chaining requested but not supported for Secure operation\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	else if ((tpdu[1] & 0xc0) == 0x80)
	{ /* This is a R-block. */
	if ( (tpdu[1] & 0x0f))
	{ /* Error: repeat last block */
	DEBUGOUT ("No retries supported for Secure operation\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	else if (!!(tpdu[1] & 0x10) == handle->t1_ns)
	{ /* Response does not match our sequence number. */
	DEBUGOUT ("R-block with wrong seqno received on more bit\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	else
	{ /* Send next chunk. */
	DEBUGOUT ("chaining not supported on Secure operation\n");
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}
	}
	else
	{ /* This is a S-block. */
	DEBUGOUT_2 ("T=1: S-block %s received cmd=%d for Secure operation\n",
	(tpdu[1] & 0x20)? "response": "request",
	(tpdu[1] & 0x1f));
	return CCID_DRIVER_ERR_CARD_IO_ERROR;
	}

	return 0;
	}




	#ifdef TEST


	static void
	print_error (int err)
	{
	const char *p;
	char buf[50];

	switch (err)
	{
	case 0: p = "success";
	case CCID_DRIVER_ERR_OUT_OF_CORE: p = "out of core"; break;
	case CCID_DRIVER_ERR_INV_VALUE: p = "invalid value"; break;
	case CCID_DRIVER_ERR_NO_DRIVER: p = "no driver"; break;
	case CCID_DRIVER_ERR_NOT_SUPPORTED: p = "not supported"; break;
	case CCID_DRIVER_ERR_LOCKING_FAILED: p = "locking failed"; break;
	case CCID_DRIVER_ERR_BUSY: p = "busy"; break;
	case CCID_DRIVER_ERR_NO_CARD: p = "no card"; break;
	case CCID_DRIVER_ERR_CARD_INACTIVE: p = "card inactive"; break;
	case CCID_DRIVER_ERR_CARD_IO_ERROR: p = "card I/O error"; break;
	case CCID_DRIVER_ERR_GENERAL_ERROR: p = "general error"; break;
	case CCID_DRIVER_ERR_NO_READER: p = "no reader"; break;
	case CCID_DRIVER_ERR_ABORTED: p = "aborted"; break;
	default: sprintf (buf, "0x%05x", err); p = buf; break;
	}
	fprintf (stderr, "operation failed: %s\n", p);
	}


	static void
	print_data (const unsigned char *data, size_t length)
	{
	if (length >= 2)
	{
	fprintf (stderr, "operation status: %02X%02X\n",
	data[length-2], data[length-1]);
	length -= 2;
	}
	if (length)
	{
	fputs (" returned data:", stderr);
	for (; length; length--, data++)
	fprintf (stderr, " %02X", *data);
	putc ('\n', stderr);
	}
	}

	static void
	print_result (int rc, const unsigned char *data, size_t length)
	{
	if (rc)
	print_error (rc);
	else if (data)
	print_data (data, length);
	}

	int
	main (int argc, char **argv)
	{
	int rc;
	ccid_driver_t ccid;
	int slotstat;
	unsigned char result[512];
	size_t resultlen;
	int no_pinpad = 0;
	int verify_123456 = 0;
	int did_verify = 0;
	int no_poll = 0;

	if (argc)
	{
	argc--;
	argv++;
	}

	while (argc)
	{
	if ( !strcmp (*argv, "--list"))
	{
	char *p;
	p = ccid_get_reader_list ();
	if (!p)
	return 1;
	fputs (p, stderr);
	free (p);
	return 0;
	}
	else if ( !strcmp (*argv, "--debug"))
	{
	ccid_set_debug_level (ccid_set_debug_level (-1)+1);
	argc--; argv++;
	}
	else if ( !strcmp (*argv, "--no-poll"))
	{
	no_poll = 1;
	argc--; argv++;
	}
	else if ( !strcmp (*argv, "--no-pinpad"))
	{
	no_pinpad = 1;
	argc--; argv++;
	}
	else if ( !strcmp (*argv, "--verify-123456"))
	{
	verify_123456 = 1;
	argc--; argv++;
	}
	else
	break;
	}

	rc = ccid_open_reader (&ccid, argc? *argv:NULL, NULL);
	if (rc)
	return 1;

	if (!no_poll)
	ccid_poll (ccid);
	fputs ("getting ATR ...\n", stderr);
	rc = ccid_get_atr (ccid, NULL, 0, NULL);
	if (rc)
	{
	print_error (rc);
	return 1;
	}

	if (!no_poll)
	ccid_poll (ccid);
	fputs ("getting slot status ...\n", stderr);
	rc = ccid_slot_status (ccid, &slotstat);
	if (rc)
	{
	print_error (rc);
	return 1;
	}

	if (!no_poll)
	ccid_poll (ccid);

	fputs ("selecting application OpenPGP ....\n", stderr);
	{
	static unsigned char apdu[] = {
	0, 0xA4, 4, 0, 6, 0xD2, 0x76, 0x00, 0x01, 0x24, 0x01};
	rc = ccid_transceive (ccid,
	apdu, sizeof apdu,
	result, sizeof result, &resultlen);
	print_result (rc, result, resultlen);
	}


	if (!no_poll)
	ccid_poll (ccid);

	fputs ("getting OpenPGP DO 0x65 ....\n", stderr);
	{
	static unsigned char apdu[] = { 0, 0xCA, 0, 0x65, 254 };
	rc = ccid_transceive (ccid, apdu, sizeof apdu,
	result, sizeof result, &resultlen);
	print_result (rc, result, resultlen);
	}

	if (!no_pinpad)
	{
	}

	if (!no_pinpad)
	{
	static unsigned char apdu[] = { 0, 0x20, 0, 0x81 };


	if (ccid_transceive_secure (ccid,
	apdu, sizeof apdu,
	1, 0, 0, 0,
	NULL, 0, NULL))
	fputs ("can't verify using a PIN-Pad reader\n", stderr);
	else
	{
	fputs ("verifying CHV1 using the PINPad ....\n", stderr);

	rc = ccid_transceive_secure (ccid,
	apdu, sizeof apdu,
	1, 0, 0, 0,
	result, sizeof result, &resultlen);
	print_result (rc, result, resultlen);
	did_verify = 1;
	}
	}

	if (verify_123456 && !did_verify)
	{
	fputs ("verifying that CHV1 is 123456....\n", stderr);
	{
	static unsigned char apdu[] = {0, 0x20, 0, 0x81,
	6, '1','2','3','4','5','6'};
	rc = ccid_transceive (ccid, apdu, sizeof apdu,
	result, sizeof result, &resultlen);
	print_result (rc, result, resultlen);
	}
	}

	if (!rc)
	{
	fputs ("getting OpenPGP DO 0x5E ....\n", stderr);
	{
	static unsigned char apdu[] = { 0, 0xCA, 0, 0x5E, 254 };
	rc = ccid_transceive (ccid, apdu, sizeof apdu,
	result, sizeof result, &resultlen);
	print_result (rc, result, resultlen);
	}
	}

	ccid_close_reader (ccid);

	return 0;
	}

	/*
	* Local Variables:
	* compile-command: "gcc -DTEST -Wall -I/usr/local/include -lusb -g ccid-driver.c"
	* End:
	*/
	#endif /TEST/
	#endif /HAVE_LIBUSB/
	diff --git a/scd/command.c b/scd/command.c
	index 5b7ddc867..b1d5539cb 100644
	--- a/scd/command.c
	+++ b/scd/command.c
	@@ -1,1983 +1,1983 @@
	/* command.c - SCdaemon command handler
	* Copyright (C) 2001, 2002, 2003, 2004, 2005,
	* 2007, 2008, 2009, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <unistd.h>
	#include <signal.h>
	#ifdef USE_NPTH
	# include <npth.h>
	#endif

	#include "scdaemon.h"
	#include <assuan.h>
	#include <ksba.h>
	#include "app-common.h"
	#include "iso7816.h"
	#include "apdu.h" /* Required for apdu__reader (). /
	#include "atr.h"
	#ifdef HAVE_LIBUSB
	#include "ccid-driver.h"
	#endif
	#include "asshelp.h"
	#include "server-help.h"

	/* Maximum length allowed as a PIN; used for INQUIRE NEEDPIN */
	#define MAXLEN_PIN 100

	/* Maximum allowed size of key data as used in inquiries. */
	#define MAXLEN_KEYDATA 4096

	/* Maximum allowed total data size for SETDATA. */
	#define MAXLEN_SETDATA 4096

	/* Maximum allowed size of certificate data as used in inquiries. */
	#define MAXLEN_CERTDATA 16384


	#define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))

	#define IS_LOCKED(c) (locked_session && locked_session != (c)->server_local)


	/* Data used to associate an Assuan context with local server data.
	This object describes the local properties of one session. */
	struct server_local_s
	{
	/* We keep a list of all active sessions with the anchor at
	SESSION_LIST (see below). This field is used for linking. */
	struct server_local_s *next_session;

	/* This object is usually assigned to a CTRL object (which is
	globally visible). While enumerating all sessions we sometimes
	need to access data of the CTRL object; thus we keep a
	backpointer here. */
	ctrl_t ctrl_backlink;

	/* The Assuan context used by this session/server. */
	assuan_context_t assuan_ctx;

	#ifdef HAVE_W32_SYSTEM
	unsigned long event_signal; /* Or 0 if not used. */
	#else
	int event_signal; /* Or 0 if not used. */
	#endif

	/* True if the card has been removed and a reset is required to
	continue operation. */
	int card_removed;

	/* If set to true we will be terminate ourself at the end of the
	this session. */
	int stopme;

	};


	/* To keep track of all running sessions, we link all active server
	contexts and the anchor in this variable. */
	static struct server_local_s *session_list;

	/* If a session has been locked we store a link to its server object
	in this variable. */
	static struct server_local_s *locked_session;


	/* Convert the STRING into a newly allocated buffer while translating
	the hex numbers. Stops at the first invalid character. Blanks and
	colons are allowed to separate the hex digits. Returns NULL on
	error or a newly malloced buffer and its length in LENGTH. */
	static unsigned char *
	hex_to_buffer (const char string, size_t r_length)
	{
	unsigned char *buffer;
	const char *s;
	size_t n;

	buffer = xtrymalloc (strlen (string)+1);
	if (!buffer)
	return NULL;
	for (s=string, n=0; *s; s++)
	{
	if (spacep (s) \|\| *s == ':')
	continue;
	if (hexdigitp (s) && hexdigitp (s+1))
	{
	buffer[n++] = xtoi_2 (s);
	s++;
	}
	else
	break;
	}
	*r_length = n;
	return buffer;
	}



	/* Reset the card and free the application context. With SEND_RESET
	set to true actually send a RESET to the reader; this is the normal
	way of calling the function. */
	static void
	do_reset (ctrl_t ctrl, int send_reset)
	{
	app_t app = ctrl->app_ctx;

	if (app)
	app_reset (app, ctrl, IS_LOCKED (ctrl)? 0: send_reset);

	/* If we hold a lock, unlock now. */
	if (locked_session && ctrl->server_local == locked_session)
	{
	locked_session = NULL;
	log_info ("implicitly unlocking due to RESET\n");
	}
	}

	static gpg_error_t
	reset_notify (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void) line;

	do_reset (ctrl, 1);
	return 0;
	}


	static gpg_error_t
	option_handler (assuan_context_t ctx, const char key, const char value)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	if (!strcmp (key, "event-signal"))
	{
	/* A value of 0 is allowed to reset the event signal. */
	#ifdef HAVE_W32_SYSTEM
	if (!*value)
	return gpg_error (GPG_ERR_ASS_PARAMETER);
	ctrl->server_local->event_signal = strtoul (value, NULL, 16);
	#else
	int i = *value? atoi (value) : -1;
	if (i < 0)
	return gpg_error (GPG_ERR_ASS_PARAMETER);
	ctrl->server_local->event_signal = i;
	#endif
	}

	return 0;
	}


	/* If the card has not yet been opened, do it. */
	static gpg_error_t
	open_card (ctrl_t ctrl)
	{
	/* If we ever got a card not present error code, return that. Only
	the SERIALNO command and a reset are able to clear from that
	state. */
	if (ctrl->server_local->card_removed)
	return gpg_error (GPG_ERR_CARD_REMOVED);

	if ( IS_LOCKED (ctrl) )
	return gpg_error (GPG_ERR_LOCKED);

	if (ctrl->app_ctx)
	return 0;

	return select_application (ctrl, NULL, &ctrl->app_ctx, 0, NULL, 0);
	}

	/* Explicitly open a card for a specific use of APPTYPE or SERIALNO. */
	static gpg_error_t
	open_card_with_request (ctrl_t ctrl, const char apptype, const char serialno)
	{
	gpg_error_t err;
	unsigned char *serialno_bin = NULL;
	size_t serialno_bin_len = 0;
	app_t app = ctrl->app_ctx;

	/* If we are already initialized for one specific application we
	need to check that the client didn't requested a specific
	application different from the one in use before we continue. */
	if (apptype && ctrl->app_ctx)
	return check_application_conflict (apptype, ctrl->app_ctx);

	/* Re-scan USB devices. Release APP, before the scan. */
	ctrl->app_ctx = NULL;
	release_application (app, 0);

	if (serialno)
	serialno_bin = hex_to_buffer (serialno, &serialno_bin_len);

	err = select_application (ctrl, apptype, &ctrl->app_ctx, 1,
	serialno_bin, serialno_bin_len);
	xfree (serialno_bin);

	return err;
	}


	static const char hlp_serialno[] =
	"SERIALNO [--demand=<serialno>] [<apptype>]\n"
	"\n"
	"Return the serial number of the card using a status response. This\n"
	"function should be used to check for the presence of a card.\n"
	"\n"
	"If --demand is given, an application on the card with SERIALNO is\n"
	"selected and an error is returned if no such card available.\n"
	"\n"
	"If APPTYPE is given, an application of that type is selected and an\n"
	"error is returned if the application is not supported or available.\n"
	"The default is to auto-select the application using a hardwired\n"
	"preference system. Note, that a future extension to this function\n"
	"may enable specifying a list and order of applications to try.\n"
	"\n"
	"This function is special in that it can be used to reset the card.\n"
	"Most other functions will return an error when a card change has\n"
	"been detected and the use of this function is therefore required.\n"
	"\n"
	"Background: We want to keep the client clear of handling card\n"
	"changes between operations; i.e. the client can assume that all\n"
	"operations are done on the same card unless he calls this function.";
	static gpg_error_t
	cmd_serialno (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	struct server_local_s *sl;
	int rc = 0;
	char *serial;
	const char *demand;

	if ( IS_LOCKED (ctrl) )
	return gpg_error (GPG_ERR_LOCKED);

	if ((demand = has_option_name (line, "--demand")))
	{
	if (*demand != '=')
	return set_error (GPG_ERR_ASS_PARAMETER, "missing value for option");
	line = (char *)++demand;
	for (; *line && !spacep (line); line++)
	;
	if (*line)
	*line++ = 0;
	}
	else
	demand = NULL;

	/* Clear the remove flag so that the open_card is able to reread it. */
	if (ctrl->server_local->card_removed)
	ctrl->server_local->card_removed = 0;

	if ((rc = open_card_with_request (ctrl, *line? line:NULL, demand)))
	{
	ctrl->server_local->card_removed = 1;
	return rc;
	}

	/* Success, clear the card_removed flag for all sessions. */
	for (sl=session_list; sl; sl = sl->next_session)
	{
	ctrl_t c = sl->ctrl_backlink;

	if (c != ctrl)
	c->server_local->card_removed = 0;
	}

	serial = app_get_serialno (ctrl->app_ctx);
	if (!serial)
	return gpg_error (GPG_ERR_INV_VALUE);

	rc = assuan_write_status (ctx, "SERIALNO", serial);
	xfree (serial);
	return rc;
	}


	static const char hlp_learn[] =
	"LEARN [--force] [--keypairinfo]\n"
	"\n"
	"Learn all useful information of the currently inserted card. When\n"
	"used without the force options, the command might do an INQUIRE\n"
	"like this:\n"
	"\n"
	" INQUIRE KNOWNCARDP <hexstring_with_serialNumber>\n"
	"\n"
	"The client should just send an \"END\" if the processing should go on\n"
	"or a \"CANCEL\" to force the function to terminate with a Cancel\n"
	"error message.\n"
	"\n"
	"With the option --keypairinfo only KEYPARIINFO lstatus lines are\n"
	"returned.\n"
	"\n"
	"The response of this command is a list of status lines formatted as\n"
	"this:\n"
	"\n"
	" S APPTYPE <apptype>\n"
	"\n"
	"This returns the type of the application, currently the strings:\n"
	"\n"
	" P15 = PKCS-15 structure used\n"
	" DINSIG = DIN SIG\n"
	" OPENPGP = OpenPGP card\n"
	" NKS = NetKey card\n"
	"\n"
	"are implemented. These strings are aliases for the AID\n"
	"\n"
	" S KEYPAIRINFO <hexstring_with_keygrip> <hexstring_with_id>\n"
	"\n"
	"If there is no certificate yet stored on the card a single 'X' is\n"
	"returned as the keygrip. In addition to the keypair info, information\n"
	"about all certificates stored on the card is also returned:\n"
	"\n"
	" S CERTINFO <certtype> <hexstring_with_id>\n"
	"\n"
	"Where CERTTYPE is a number indicating the type of certificate:\n"
	" 0 := Unknown\n"
	" 100 := Regular X.509 cert\n"
	" 101 := Trusted X.509 cert\n"
	" 102 := Useful X.509 cert\n"
	" 110 := Root CA cert in a special format (e.g. DINSIG)\n"
	" 111 := Root CA cert as standard X509 cert.\n"
	"\n"
	"For certain cards, more information will be returned:\n"
	"\n"
	" S KEY-FPR <no> <hexstring>\n"
	"\n"
	"For OpenPGP cards this returns the stored fingerprints of the\n"
	"keys. This can be used check whether a key is available on the\n"
	"card. NO may be 1, 2 or 3.\n"
	"\n"
	" S CA-FPR <no> <hexstring>\n"
	"\n"
	"Similar to above, these are the fingerprints of keys assumed to be\n"
	"ultimately trusted.\n"
	"\n"
	" S DISP-NAME <name_of_card_holder>\n"
	"\n"
	"The name of the card holder as stored on the card; percent\n"
	"escaping takes place, spaces are encoded as '+'\n"
	"\n"
	" S PUBKEY-URL <url>\n"
	"\n"
	"The URL to be used for locating the entire public key.\n"
	" \n"
	"Note, that this function may even be used on a locked card.";
	static gpg_error_t
	cmd_learn (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;
	int only_keypairinfo = has_option (line, "--keypairinfo");

	if ((rc = open_card (ctrl)))
	return rc;

	/* Unless the force option is used we try a shortcut by identifying
	the card using a serial number and inquiring the client with
	that. The client may choose to cancel the operation if he already
	knows about this card */
	if (!only_keypairinfo)
	{
	const char *reader;
	char *serial;
	app_t app = ctrl->app_ctx;

	if (!app)
	return gpg_error (GPG_ERR_CARD_NOT_PRESENT);

	reader = apdu_get_reader_name (app->slot);
	if (!reader)
	return out_of_core ();
	send_status_direct (ctrl, "READER", reader);
	/* No need to free the string of READER. */

	serial = app_get_serialno (ctrl->app_ctx);
	if (!serial)
	return gpg_error (GPG_ERR_INV_VALUE);

	rc = assuan_write_status (ctx, "SERIALNO", serial);
	if (rc < 0)
	{
	xfree (serial);
	return out_of_core ();
	}

	if (!has_option (line, "--force"))
	{
	char *command;

	rc = gpgrt_asprintf (&command, "KNOWNCARDP %s", serial);
	if (rc < 0)
	{
	xfree (serial);
	return out_of_core ();
	}
	rc = assuan_inquire (ctx, command, NULL, NULL, 0);
	xfree (command);
	if (rc)
	{
	if (gpg_err_code (rc) != GPG_ERR_ASS_CANCELED)
	log_error ("inquire KNOWNCARDP failed: %s\n",
	gpg_strerror (rc));
	xfree (serial);
	return rc;
	}
	/* Not canceled, so we have to proceeed. */
	}
	xfree (serial);
	}

	/* Let the application print out its collection of useful status
	information. */
	if (!rc)
	rc = app_write_learn_status (ctrl->app_ctx, ctrl, only_keypairinfo);

	return rc;
	}



	static const char hlp_readcert[] =
	"READCERT <hexified_certid>\|<keyid>\n"
	"\n"
	"Note, that this function may even be used on a locked card.";
	static gpg_error_t
	cmd_readcert (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	unsigned char *cert;
	size_t ncert;

	if ((rc = open_card (ctrl)))
	return rc;

	line = xstrdup (line); /* Need a copy of the line. */
	rc = app_readcert (ctrl->app_ctx, ctrl, line, &cert, &ncert);
	if (rc)
	log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
	xfree (line);
	line = NULL;
	if (!rc)
	{
	rc = assuan_send_data (ctx, cert, ncert);
	xfree (cert);
	if (rc)
	return rc;
	}

	return rc;
	}


	static const char hlp_readkey[] =
	"READKEY [--advanced] <keyid>\n"
	"\n"
	"Return the public key for the given cert or key ID as a standard\n"
	"S-expression.\n"
	"In --advanced mode it returns the S-expression in advanced format.\n"
	"\n"
	"Note that this function may even be used on a locked card.";
	static gpg_error_t
	cmd_readkey (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	int advanced = 0;
	unsigned char *cert = NULL;
	size_t ncert, n;
	ksba_cert_t kc = NULL;
	ksba_sexp_t p;
	unsigned char *pk;
	size_t pklen;

	if ((rc = open_card (ctrl)))
	return rc;

	if (has_option (line, "--advanced"))
	advanced = 1;

	line = skip_options (line);

	line = xstrdup (line); /* Need a copy of the line. */
	/* If the application supports the READKEY function we use that.
	Otherwise we use the old way by extracting it from the
	certificate. */
	rc = app_readkey (ctrl->app_ctx, ctrl, advanced, line, &pk, &pklen);
	if (!rc)
	{ /* Yeah, got that key - send it back. */
	rc = assuan_send_data (ctx, pk, pklen);
	xfree (pk);
	xfree (line);
	line = NULL;
	goto leave;
	}

	if (gpg_err_code (rc) != GPG_ERR_UNSUPPORTED_OPERATION)
	log_error ("app_readkey failed: %s\n", gpg_strerror (rc));
	else
	{
	rc = app_readcert (ctrl->app_ctx, ctrl, line, &cert, &ncert);
	if (rc)
	log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
	}
	xfree (line);
	line = NULL;
	if (rc)
	goto leave;

	rc = ksba_cert_new (&kc);
	if (rc)
	goto leave;

	rc = ksba_cert_init_from_mem (kc, cert, ncert);
	if (rc)
	{
	log_error ("failed to parse the certificate: %s\n", gpg_strerror (rc));
	goto leave;
	}

	p = ksba_cert_get_public_key (kc);
	if (!p)
	{
	rc = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}

	n = gcry_sexp_canon_len (p, 0, NULL, NULL);
	rc = assuan_send_data (ctx, p, n);
	xfree (p);


	leave:
	ksba_cert_release (kc);
	xfree (cert);
	return rc;
	}



	static const char hlp_setdata[] =
	"SETDATA [--append] <hexstring>\n"
	"\n"
	"The client should use this command to tell us the data he want to sign.\n"
	"With the option --append, the data is appended to the data set by a\n"
	"previous SETDATA command.";
	static gpg_error_t
	cmd_setdata (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int append;
	int n, i, off;
	char *p;
	unsigned char *buf;

	append = (ctrl->in_data.value && has_option (line, "--append"));

	line = skip_options (line);

	if (locked_session && locked_session != ctrl->server_local)
	return gpg_error (GPG_ERR_LOCKED);

	/* Parse the hexstring. */
	for (p=line,n=0; hexdigitp (p); p++, n++)
	;
	if (*p)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid hexstring");
	if (!n)
	return set_error (GPG_ERR_ASS_PARAMETER, "no data given");
	if ((n&1))
	return set_error (GPG_ERR_ASS_PARAMETER, "odd number of digits");
	n /= 2;
	if (append)
	{
	if (ctrl->in_data.valuelen + n > MAXLEN_SETDATA)
	return set_error (GPG_ERR_TOO_LARGE,
	"limit on total size of data reached");
	buf = xtrymalloc (ctrl->in_data.valuelen + n);
	}
	else
	buf = xtrymalloc (n);
	if (!buf)
	return out_of_core ();

	if (append)
	{
	memcpy (buf, ctrl->in_data.value, ctrl->in_data.valuelen);
	off = ctrl->in_data.valuelen;
	}
	else
	off = 0;
	for (p=line, i=0; i < n; p += 2, i++)
	buf[off+i] = xtoi_2 (p);

	xfree (ctrl->in_data.value);
	ctrl->in_data.value = buf;
	ctrl->in_data.valuelen = off+n;
	return 0;
	}



	static gpg_error_t
	pin_cb (void opaque, const char info, char **retstr)
	{
	assuan_context_t ctx = opaque;
	char *command;
	int rc;
	unsigned char *value;
	size_t valuelen;

	if (!retstr)
	{
	/* We prompt for pinpad entry. To make sure that the popup has
	been show we use an inquire and not just a status message.
	We ignore any value returned. */
	if (info)
	{
	log_debug ("prompting for pinpad entry '%s'\n", info);
	rc = gpgrt_asprintf (&command, "POPUPPINPADPROMPT %s", info);
	if (rc < 0)
	return gpg_error (gpg_err_code_from_errno (errno));
	rc = assuan_inquire (ctx, command, &value, &valuelen, MAXLEN_PIN);
	xfree (command);
	}
	else
	{
	log_debug ("dismiss pinpad entry prompt\n");
	rc = assuan_inquire (ctx, "DISMISSPINPADPROMPT",
	&value, &valuelen, MAXLEN_PIN);
	}
	if (!rc)
	xfree (value);
	return rc;
	}

	*retstr = NULL;
	log_debug ("asking for PIN '%s'\n", info);

	rc = gpgrt_asprintf (&command, "NEEDPIN %s", info);
	if (rc < 0)
	return gpg_error (gpg_err_code_from_errno (errno));

	/* Fixme: Write an inquire function which returns the result in
	secure memory and check all further handling of the PIN. */
	rc = assuan_inquire (ctx, command, &value, &valuelen, MAXLEN_PIN);
	xfree (command);
	if (rc)
	return rc;

	if (!valuelen \|\| value[valuelen-1])
	{
	/* We require that the returned value is an UTF-8 string */
	xfree (value);
	return gpg_error (GPG_ERR_INV_RESPONSE);
	}
	retstr = (char)value;
	return 0;
	}


	static const char hlp_pksign[] =
	"PKSIGN [--hash=[rmd160\|sha{1,224,256,384,512}\|md5]] <hexified_id>\n"
	"\n"
	"The --hash option is optional; the default is SHA1.";
	static gpg_error_t
	cmd_pksign (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	unsigned char *outdata;
	size_t outdatalen;
	char *keyidstr;
	int hash_algo;

	if (has_option (line, "--hash=rmd160"))
	hash_algo = GCRY_MD_RMD160;
	else if (has_option (line, "--hash=sha1"))
	hash_algo = GCRY_MD_SHA1;
	else if (has_option (line, "--hash=sha224"))
	hash_algo = GCRY_MD_SHA224;
	else if (has_option (line, "--hash=sha256"))
	hash_algo = GCRY_MD_SHA256;
	else if (has_option (line, "--hash=sha384"))
	hash_algo = GCRY_MD_SHA384;
	else if (has_option (line, "--hash=sha512"))
	hash_algo = GCRY_MD_SHA512;
	else if (has_option (line, "--hash=md5"))
	hash_algo = GCRY_MD_MD5;
	else if (!strstr (line, "--"))
	hash_algo = GCRY_MD_SHA1;
	else
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid hash algorithm");

	line = skip_options (line);

	if ((rc = open_card (ctrl)))
	return rc;

	/* We have to use a copy of the key ID because the function may use
	the pin_cb which in turn uses the assuan line buffer and thus
	overwriting the original line with the keyid */
	keyidstr = xtrystrdup (line);
	if (!keyidstr)
	return out_of_core ();

	rc = app_sign (ctrl->app_ctx, ctrl,
	keyidstr, hash_algo,
	pin_cb, ctx,
	ctrl->in_data.value, ctrl->in_data.valuelen,
	&outdata, &outdatalen);

	xfree (keyidstr);
	if (rc)
	{
	log_error ("app_sign failed: %s\n", gpg_strerror (rc));
	}
	else
	{
	rc = assuan_send_data (ctx, outdata, outdatalen);
	xfree (outdata);
	if (rc)
	return rc; /* that is already an assuan error code */
	}

	return rc;
	}


	static const char hlp_pkauth[] =
	"PKAUTH <hexified_id>";
	static gpg_error_t
	cmd_pkauth (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	unsigned char *outdata;
	size_t outdatalen;
	char *keyidstr;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	/* We have to use a copy of the key ID because the function may use
	the pin_cb which in turn uses the assuan line buffer and thus
	overwriting the original line with the keyid */
	keyidstr = xtrystrdup (line);
	if (!keyidstr)
	return out_of_core ();

	rc = app_auth (ctrl->app_ctx, ctrl, keyidstr, pin_cb, ctx,
	ctrl->in_data.value, ctrl->in_data.valuelen,
	&outdata, &outdatalen);
	xfree (keyidstr);
	if (rc)
	{
	log_error ("app_auth failed: %s\n", gpg_strerror (rc));
	}
	else
	{
	rc = assuan_send_data (ctx, outdata, outdatalen);
	xfree (outdata);
	if (rc)
	return rc; /* that is already an assuan error code */
	}

	return rc;
	}


	static const char hlp_pkdecrypt[] =
	"PKDECRYPT <hexified_id>";
	static gpg_error_t
	cmd_pkdecrypt (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	unsigned char *outdata;
	size_t outdatalen;
	char *keyidstr;
	unsigned int infoflags;

	if ((rc = open_card (ctrl)))
	return rc;

	keyidstr = xtrystrdup (line);
	if (!keyidstr)
	return out_of_core ();
	rc = app_decipher (ctrl->app_ctx, ctrl, keyidstr, pin_cb, ctx,
	ctrl->in_data.value, ctrl->in_data.valuelen,
	&outdata, &outdatalen, &infoflags);

	xfree (keyidstr);
	if (rc)
	{
	log_error ("app_decipher failed: %s\n", gpg_strerror (rc));
	}
	else
	{
	/* If the card driver told us that there is no padding, send a
	status line. If there is a padding it is assumed that the
	caller knows what padding is used. It would have been better
	to always send that information but for backward
	compatibility we can't do that. */
	if ((infoflags & APP_DECIPHER_INFO_NOPAD))
	send_status_direct (ctrl, "PADDING", "0");
	rc = assuan_send_data (ctx, outdata, outdatalen);
	xfree (outdata);
	if (rc)
	return rc; /* that is already an assuan error code */
	}

	return rc;
	}


	static const char hlp_getattr[] =
	"GETATTR <name>\n"
	"\n"
	"This command is used to retrieve data from a smartcard. The\n"
	"allowed names depend on the currently selected smartcard\n"
	"application. NAME must be percent and '+' escaped. The value is\n"
	"returned through status message, see the LEARN command for details.\n"
	"\n"
	"However, the current implementation assumes that Name is not escaped;\n"
	"this works as long as no one uses arbitrary escaping. \n"
	"\n"
	"Note, that this function may even be used on a locked card.";
	static gpg_error_t
	cmd_getattr (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	const char *keyword;

	if ((rc = open_card (ctrl)))
	return rc;

	keyword = line;
	for (; *line && !spacep (line); line++)
	;
	if (*line)
	*line++ = 0;

	/* (We ignore any garbage for now.) */

	/* FIXME: Applications should not return sensitive data if the card
	is locked. */
	rc = app_getattr (ctrl->app_ctx, ctrl, keyword);

	return rc;
	}


	static const char hlp_setattr[] =
	"SETATTR <name> <value> \n"
	"\n"
	- "This command is used to store data on a a smartcard. The allowed\n"
	+ "This command is used to store data on a smartcard. The allowed\n"
	"names and values are depend on the currently selected smartcard\n"
	"application. NAME and VALUE must be percent and '+' escaped.\n"
	"\n"
	"However, the current implementation assumes that NAME is not\n"
	"escaped; this works as long as no one uses arbitrary escaping.\n"
	"\n"
	"A PIN will be requested for most NAMEs. See the corresponding\n"
	"setattr function of the actually used application (app-*.c) for\n"
	"details.";
	static gpg_error_t
	cmd_setattr (assuan_context_t ctx, char *orig_line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *keyword;
	int keywordlen;
	size_t nbytes;
	char line, linebuf;

	if ((rc = open_card (ctrl)))
	return rc;

	/* We need to use a copy of LINE, because PIN_CB uses the same
	context and thus reuses the Assuan provided LINE. */
	line = linebuf = xtrystrdup (orig_line);
	if (!line)
	return out_of_core ();

	keyword = line;
	for (keywordlen=0; *line && !spacep (line); line++, keywordlen++)
	;
	if (*line)
	*line++ = 0;
	while (spacep (line))
	line++;
	nbytes = percent_plus_unescape_inplace (line, 0);

	rc = app_setattr (ctrl->app_ctx, ctrl, keyword, pin_cb, ctx,
	(const unsigned char*)line, nbytes);
	xfree (linebuf);

	return rc;
	}


	static const char hlp_writecert[] =
	"WRITECERT <hexified_certid>\n"
	"\n"
	"This command is used to store a certifciate on a smartcard. The\n"
	"allowed certids depend on the currently selected smartcard\n"
	"application. The actual certifciate is requested using the inquiry\n"
	"\"CERTDATA\" and needs to be provided in its raw (e.g. DER) form.\n"
	"\n"
	- "In almost all cases a a PIN will be requested. See the related\n"
	+ "In almost all cases a PIN will be requested. See the related\n"
	"writecert function of the actually used application (app-*.c) for\n"
	"details.";
	static gpg_error_t
	cmd_writecert (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *certid;
	unsigned char *certdata;
	size_t certdatalen;

	line = skip_options (line);

	if (!*line)
	return set_error (GPG_ERR_ASS_PARAMETER, "no certid given");
	certid = line;
	while (*line && !spacep (line))
	line++;
	*line = 0;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	certid = xtrystrdup (certid);
	if (!certid)
	return out_of_core ();

	/* Now get the actual keydata. */
	rc = assuan_inquire (ctx, "CERTDATA",
	&certdata, &certdatalen, MAXLEN_CERTDATA);
	if (rc)
	{
	xfree (certid);
	return rc;
	}

	/* Write the certificate to the card. */
	rc = app_writecert (ctrl->app_ctx, ctrl, certid,
	pin_cb, ctx, certdata, certdatalen);
	xfree (certid);
	xfree (certdata);

	return rc;
	}


	static const char hlp_writekey[] =
	"WRITEKEY [--force] <keyid> \n"
	"\n"
	- "This command is used to store a secret key on a a smartcard. The\n"
	+ "This command is used to store a secret key on a smartcard. The\n"
	"allowed keyids depend on the currently selected smartcard\n"
	"application. The actual keydata is requested using the inquiry\n"
	"\"KEYDATA\" and need to be provided without any protection. With\n"
	"--force set an existing key under this KEYID will get overwritten.\n"
	"The keydata is expected to be the usual canonical encoded\n"
	"S-expression.\n"
	"\n"
	"A PIN will be requested for most NAMEs. See the corresponding\n"
	"writekey function of the actually used application (app-*.c) for\n"
	"details.";
	static gpg_error_t
	cmd_writekey (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *keyid;
	int force = has_option (line, "--force");
	unsigned char *keydata;
	size_t keydatalen;

	line = skip_options (line);

	if (!*line)
	return set_error (GPG_ERR_ASS_PARAMETER, "no keyid given");
	keyid = line;
	while (*line && !spacep (line))
	line++;
	*line = 0;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	keyid = xtrystrdup (keyid);
	if (!keyid)
	return out_of_core ();

	/* Now get the actual keydata. */
	assuan_begin_confidential (ctx);
	rc = assuan_inquire (ctx, "KEYDATA", &keydata, &keydatalen, MAXLEN_KEYDATA);
	assuan_end_confidential (ctx);
	if (rc)
	{
	xfree (keyid);
	return rc;
	}

	/* Write the key to the card. */
	rc = app_writekey (ctrl->app_ctx, ctrl, keyid, force? 1:0,
	pin_cb, ctx, keydata, keydatalen);
	xfree (keyid);
	xfree (keydata);

	return rc;
	}


	static const char hlp_genkey[] =
	"GENKEY [--force] [--timestamp=<isodate>] <no>\n"
	"\n"
	"Generate a key on-card identified by NO, which is application\n"
	"specific. Return values are application specific. For OpenPGP\n"
	"cards 3 status lines are returned:\n"
	"\n"
	" S KEY-FPR <hexstring>\n"
	" S KEY-CREATED-AT <seconds_since_epoch>\n"
	" S KEY-DATA [-\|p\|n] <hexdata>\n"
	"\n"
	" 'p' and 'n' are the names of the RSA parameters; '-' is used to\n"
	" indicate that HEXDATA is the first chunk of a parameter given\n"
	" by the next KEY-DATA.\n"
	"\n"
	"--force is required to overwrite an already existing key. The\n"
	"KEY-CREATED-AT is required for further processing because it is\n"
	"part of the hashed key material for the fingerprint.\n"
	"\n"
	"If --timestamp is given an OpenPGP key will be created using this\n"
	"value. The value needs to be in ISO Format; e.g.\n"
	"\"--timestamp=20030316T120000\" and after 1970-01-01 00:00:00.\n"
	"\n"
	"The public part of the key can also later be retrieved using the\n"
	"READKEY command.";
	static gpg_error_t
	cmd_genkey (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *keyno;
	int force;
	const char *s;
	time_t timestamp;

	force = has_option (line, "--force");

	if ((s=has_option_name (line, "--timestamp")))
	{
	if (*s != '=')
	return set_error (GPG_ERR_ASS_PARAMETER, "missing value for option");
	timestamp = isotime2epoch (s+1);
	if (timestamp < 1)
	return set_error (GPG_ERR_ASS_PARAMETER, "invalid time value");
	}
	else
	timestamp = 0;


	line = skip_options (line);
	if (!*line)
	return set_error (GPG_ERR_ASS_PARAMETER, "no key number given");
	keyno = line;
	while (*line && !spacep (line))
	line++;
	*line = 0;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	keyno = xtrystrdup (keyno);
	if (!keyno)
	return out_of_core ();
	rc = app_genkey (ctrl->app_ctx, ctrl, keyno, force? 1:0,
	timestamp, pin_cb, ctx);
	xfree (keyno);

	return rc;
	}


	static const char hlp_random[] =
	"RANDOM <nbytes>\n"
	"\n"
	"Get NBYTES of random from the card and send them back as data.\n"
	"This usually involves EEPROM write on the card and thus excessive\n"
	"use of this command may destroy the card.\n"
	"\n"
	"Note, that this function may be even be used on a locked card.";
	static gpg_error_t
	cmd_random (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	size_t nbytes;
	unsigned char *buffer;

	if (!*line)
	return set_error (GPG_ERR_ASS_PARAMETER,
	"number of requested bytes missing");
	nbytes = strtoul (line, NULL, 0);

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	buffer = xtrymalloc (nbytes);
	if (!buffer)
	return out_of_core ();

	rc = app_get_challenge (ctrl->app_ctx, ctrl, nbytes, buffer);
	if (!rc)
	{
	rc = assuan_send_data (ctx, buffer, nbytes);
	xfree (buffer);
	return rc; /* that is already an assuan error code */
	}
	xfree (buffer);

	return rc;
	}



	static const char hlp_passwd[] =
	"PASSWD [--reset] [--nullpin] <chvno>\n"
	"\n"
	"Change the PIN or, if --reset is given, reset the retry counter of\n"
	"the card holder verification vector CHVNO. The option --nullpin is\n"
	"used for TCOS cards to set the initial PIN. The format of CHVNO\n"
	"depends on the card application.";
	static gpg_error_t
	cmd_passwd (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *chvnostr;
	unsigned int flags = 0;

	if (has_option (line, "--reset"))
	flags \|= APP_CHANGE_FLAG_RESET;
	if (has_option (line, "--nullpin"))
	flags \|= APP_CHANGE_FLAG_NULLPIN;

	line = skip_options (line);

	if (!*line)
	return set_error (GPG_ERR_ASS_PARAMETER, "no CHV number given");
	chvnostr = line;
	while (*line && !spacep (line))
	line++;
	*line = 0;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	chvnostr = xtrystrdup (chvnostr);
	if (!chvnostr)
	return out_of_core ();
	rc = app_change_pin (ctrl->app_ctx, ctrl, chvnostr, flags, pin_cb, ctx);
	if (rc)
	log_error ("command passwd failed: %s\n", gpg_strerror (rc));
	xfree (chvnostr);

	return rc;
	}


	static const char hlp_checkpin[] =
	"CHECKPIN <idstr>\n"
	"\n"
	"Perform a VERIFY operation without doing anything else. This may\n"
	"be used to initialize a the PIN cache earlier to long lasting\n"
	"operations. Its use is highly application dependent.\n"
	"\n"
	"For OpenPGP:\n"
	"\n"
	" Perform a simple verify operation for CHV1 and CHV2, so that\n"
	" further operations won't ask for CHV2 and it is possible to do a\n"
	" cheap check on the PIN: If there is something wrong with the PIN\n"
	" entry system, only the regular CHV will get blocked and not the\n"
	" dangerous CHV3. IDSTR is the usual card's serial number in hex\n"
	" notation; an optional fingerprint part will get ignored. There\n"
	" is however a special mode if the IDSTR is sffixed with the\n"
	" literal string \"[CHV3]\": In this case the Admin PIN is checked\n"
	" if and only if the retry counter is still at 3.\n"
	"\n"
	"For Netkey:\n"
	"\n"
	" Any of the valid PIN Ids may be used. These are the strings:\n"
	"\n"
	" PW1.CH - Global password 1\n"
	" PW2.CH - Global password 2\n"
	" PW1.CH.SIG - SigG password 1\n"
	" PW2.CH.SIG - SigG password 2\n"
	"\n"
	" For a definitive list, see the implementation in app-nks.c.\n"
	" Note that we call a PW2.* PIN a \"PUK\" despite that since TCOS\n"
	" 3.0 they are technically alternative PINs used to mutally\n"
	" unblock each other.";
	static gpg_error_t
	cmd_checkpin (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc;
	char *idstr;

	if ((rc = open_card (ctrl)))
	return rc;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	/* We have to use a copy of the key ID because the function may use
	the pin_cb which in turn uses the assuan line buffer and thus
	overwriting the original line with the keyid. */
	idstr = xtrystrdup (line);
	if (!idstr)
	return out_of_core ();

	rc = app_check_pin (ctrl->app_ctx, ctrl, idstr, pin_cb, ctx);
	xfree (idstr);
	if (rc)
	log_error ("app_check_pin failed: %s\n", gpg_strerror (rc));

	return rc;
	}


	static const char hlp_lock[] =
	"LOCK [--wait]\n"
	"\n"
	"Grant exclusive card access to this session. Note that there is\n"
	"no lock counter used and a second lock from the same session will\n"
	"be ignored. A single unlock (or RESET) unlocks the session.\n"
	"Return GPG_ERR_LOCKED if another session has locked the reader.\n"
	"\n"
	"If the option --wait is given the command will wait until a\n"
	"lock has been released.";
	static gpg_error_t
	cmd_lock (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;

	retry:
	if (locked_session)
	{
	if (locked_session != ctrl->server_local)
	rc = gpg_error (GPG_ERR_LOCKED);
	}
	else
	locked_session = ctrl->server_local;

	#ifdef USE_NPTH
	if (rc && has_option (line, "--wait"))
	{
	rc = 0;
	npth_sleep (1); /* Better implement an event mechanism. However,
	for card operations this should be
	sufficient. */
	/* FIXME: Need to check that the connection is still alive.
	This can be done by issuing status messages. */
	goto retry;
	}
	#endif /USE_NPTH/

	if (rc)
	log_error ("cmd_lock failed: %s\n", gpg_strerror (rc));
	return rc;
	}


	static const char hlp_unlock[] =
	"UNLOCK\n"
	"\n"
	"Release exclusive card access.";
	static gpg_error_t
	cmd_unlock (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	int rc = 0;

	(void)line;

	if (locked_session)
	{
	if (locked_session != ctrl->server_local)
	rc = gpg_error (GPG_ERR_LOCKED);
	else
	locked_session = NULL;
	}
	else
	rc = gpg_error (GPG_ERR_NOT_LOCKED);

	if (rc)
	log_error ("cmd_unlock failed: %s\n", gpg_strerror (rc));
	return rc;
	}


	static const char hlp_getinfo[] =
	"GETINFO <what>\n"
	"\n"
	"Multi purpose command to return certain information. \n"
	"Supported values of WHAT are:\n"
	"\n"
	" version - Return the version of the program.\n"
	" pid - Return the process id of the server.\n"
	" socket_name - Return the name of the socket.\n"
	" connections - Return number of active connections.\n"
	" status - Return the status of the current reader (in the future,\n"
	" may also return the status of all readers). The status\n"
	" is a list of one-character flags. The following flags\n"
	" are currently defined:\n"
	" 'u' Usable card present.\n"
	" 'r' Card removed. A reset is necessary.\n"
	" These flags are exclusive.\n"
	" reader_list - Return a list of detected card readers. Does\n"
	" currently only work with the internal CCID driver.\n"
	" deny_admin - Returns OK if admin commands are not allowed or\n"
	" GPG_ERR_GENERAL if admin commands are allowed.\n"
	" app_list - Return a list of supported applications. One\n"
	" application per line, fields delimited by colons,\n"
	" first field is the name.\n"
	" card_list - Return a list of serial numbers of active cards,\n"
	" using a status response.";
	static gpg_error_t
	cmd_getinfo (assuan_context_t ctx, char *line)
	{
	int rc = 0;

	if (!strcmp (line, "version"))
	{
	const char *s = VERSION;
	rc = assuan_send_data (ctx, s, strlen (s));
	}
	else if (!strcmp (line, "pid"))
	{
	char numbuf[50];

	snprintf (numbuf, sizeof numbuf, "%lu", (unsigned long)getpid ());
	rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else if (!strcmp (line, "socket_name"))
	{
	const char *s = scd_get_socket_name ();

	if (s)
	rc = assuan_send_data (ctx, s, strlen (s));
	else
	rc = gpg_error (GPG_ERR_NO_DATA);
	}
	else if (!strcmp (line, "connections"))
	{
	char numbuf[20];

	snprintf (numbuf, sizeof numbuf, "%d", get_active_connection_count ());
	rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
	}
	else if (!strcmp (line, "status"))
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	char flag;

	if (open_card (ctrl))
	flag = 'r';
	else
	flag = 'u';

	rc = assuan_send_data (ctx, &flag, 1);
	}
	else if (!strcmp (line, "reader_list"))
	{
	#ifdef HAVE_LIBUSB
	char *s = ccid_get_reader_list ();
	#else
	char *s = NULL;
	#endif

	if (s)
	rc = assuan_send_data (ctx, s, strlen (s));
	else
	rc = gpg_error (GPG_ERR_NO_DATA);
	xfree (s);
	}
	else if (!strcmp (line, "deny_admin"))
	rc = opt.allow_admin? gpg_error (GPG_ERR_GENERAL) : 0;
	else if (!strcmp (line, "app_list"))
	{
	char *s = get_supported_applications ();
	if (s)
	rc = assuan_send_data (ctx, s, strlen (s));
	else
	rc = 0;
	xfree (s);
	}
	else if (!strcmp (line, "card_list"))
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	app_send_card_list (ctrl);
	}
	else
	rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
	return rc;
	}


	static const char hlp_restart[] =
	"RESTART\n"
	"\n"
	"Restart the current connection; this is a kind of warm reset. It\n"
	"deletes the context used by this connection but does not send a\n"
	"RESET to the card. Thus the card itself won't get reset. \n"
	"\n"
	"This is used by gpg-agent to reuse a primary pipe connection and\n"
	"may be used by clients to backup from a conflict in the serial\n"
	"command; i.e. to select another application.";
	static gpg_error_t
	cmd_restart (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	app_t app = ctrl->app_ctx;

	(void)line;

	if (app)
	{
	ctrl->app_ctx = NULL;
	release_application (app, 0);
	}
	if (locked_session && ctrl->server_local == locked_session)
	{
	locked_session = NULL;
	log_info ("implicitly unlocking due to RESTART\n");
	}
	return 0;
	}


	static const char hlp_disconnect[] =
	"DISCONNECT\n"
	"\n"
	"Disconnect the card if the backend supports a disconnect operation.";
	static gpg_error_t
	cmd_disconnect (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	if (!ctrl->app_ctx)
	return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);

	apdu_disconnect (ctrl->app_ctx->slot);
	return 0;
	}



	static const char hlp_apdu[] =
	"APDU [--[dump-]atr] [--more] [--exlen[=N]] [hexstring]\n"
	"\n"
	"Send an APDU to the current reader. This command bypasses the high\n"
	"level functions and sends the data directly to the card. HEXSTRING\n"
	"is expected to be a proper APDU. If HEXSTRING is not given no\n"
	"commands are set to the card but the command will implictly check\n"
	"whether the card is ready for use. \n"
	"\n"
	"Using the option \"--atr\" returns the ATR of the card as a status\n"
	"message before any data like this:\n"
	" S CARD-ATR 3BFA1300FF813180450031C173C00100009000B1\n"
	"\n"
	"Using the option --more handles the card status word MORE_DATA\n"
	"(61xx) and concatenates all responses to one block.\n"
	"\n"
	"Using the option \"--exlen\" the returned APDU may use extended\n"
	"length up to N bytes. If N is not given a default value is used\n"
	"(currently 4096).";
	static gpg_error_t
	cmd_apdu (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);
	app_t app;
	int rc;
	unsigned char *apdu;
	size_t apdulen;
	int with_atr;
	int handle_more;
	const char *s;
	size_t exlen;

	if (has_option (line, "--dump-atr"))
	with_atr = 2;
	else
	with_atr = has_option (line, "--atr");
	handle_more = has_option (line, "--more");

	if ((s=has_option_name (line, "--exlen")))
	{
	if (*s == '=')
	exlen = strtoul (s+1, NULL, 0);
	else
	exlen = 4096;
	}
	else
	exlen = 0;

	line = skip_options (line);

	if ((rc = open_card (ctrl)))
	return rc;

	app = ctrl->app_ctx;
	if (!app)
	return gpg_error (GPG_ERR_CARD_NOT_PRESENT);

	if (with_atr)
	{
	unsigned char *atr;
	size_t atrlen;
	char hexbuf[400];

	atr = apdu_get_atr (app->slot, &atrlen);
	if (!atr \|\| atrlen > sizeof hexbuf - 2 )
	{
	rc = gpg_error (GPG_ERR_INV_CARD);
	goto leave;
	}
	if (with_atr == 2)
	{
	char string, p, *pend;

	string = atr_dump (atr, atrlen);
	if (string)
	{
	for (rc=0, p=string; !rc && (pend = strchr (p, '\n')); p = pend+1)
	{
	rc = assuan_send_data (ctx, p, pend - p + 1);
	if (!rc)
	rc = assuan_send_data (ctx, NULL, 0);
	}
	if (!rc && *p)
	rc = assuan_send_data (ctx, p, strlen (p));
	es_free (string);
	if (rc)
	goto leave;
	}
	}
	else
	{
	bin2hex (atr, atrlen, hexbuf);
	send_status_info (ctrl, "CARD-ATR", hexbuf, strlen (hexbuf), NULL, 0);
	}
	xfree (atr);
	}

	apdu = hex_to_buffer (line, &apdulen);
	if (!apdu)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	if (apdulen)
	{
	unsigned char *result = NULL;
	size_t resultlen;

	rc = apdu_send_direct (app->slot, exlen,
	apdu, apdulen, handle_more,
	&result, &resultlen);
	if (rc)
	log_error ("apdu_send_direct failed: %s\n", gpg_strerror (rc));
	else
	{
	rc = assuan_send_data (ctx, result, resultlen);
	xfree (result);
	}
	}
	xfree (apdu);

	leave:
	return rc;
	}


	static const char hlp_killscd[] =
	"KILLSCD\n"
	"\n"
	"Commit suicide.";
	static gpg_error_t
	cmd_killscd (assuan_context_t ctx, char *line)
	{
	ctrl_t ctrl = assuan_get_pointer (ctx);

	(void)line;

	ctrl->server_local->stopme = 1;
	assuan_set_flag (ctx, ASSUAN_FORCE_CLOSE, 1);
	return 0;
	}



	/* Tell the assuan library about our commands */
	static int
	register_commands (assuan_context_t ctx)
	{
	static struct {
	const char *name;
	assuan_handler_t handler;
	const char * const help;
	} table[] = {
	{ "SERIALNO", cmd_serialno, hlp_serialno },
	{ "LEARN", cmd_learn, hlp_learn },
	{ "READCERT", cmd_readcert, hlp_readcert },
	{ "READKEY", cmd_readkey, hlp_readkey },
	{ "SETDATA", cmd_setdata, hlp_setdata },
	{ "PKSIGN", cmd_pksign, hlp_pksign },
	{ "PKAUTH", cmd_pkauth, hlp_pkauth },
	{ "PKDECRYPT", cmd_pkdecrypt,hlp_pkdecrypt },
	{ "INPUT", NULL },
	{ "OUTPUT", NULL },
	{ "GETATTR", cmd_getattr, hlp_getattr },
	{ "SETATTR", cmd_setattr, hlp_setattr },
	{ "WRITECERT", cmd_writecert,hlp_writecert },
	{ "WRITEKEY", cmd_writekey, hlp_writekey },
	{ "GENKEY", cmd_genkey, hlp_genkey },
	{ "RANDOM", cmd_random, hlp_random },
	{ "PASSWD", cmd_passwd, hlp_passwd },
	{ "CHECKPIN", cmd_checkpin, hlp_checkpin },
	{ "LOCK", cmd_lock, hlp_lock },
	{ "UNLOCK", cmd_unlock, hlp_unlock },
	{ "GETINFO", cmd_getinfo, hlp_getinfo },
	{ "RESTART", cmd_restart, hlp_restart },
	{ "DISCONNECT", cmd_disconnect,hlp_disconnect },
	{ "APDU", cmd_apdu, hlp_apdu },
	{ "KILLSCD", cmd_killscd, hlp_killscd },
	{ NULL }
	};
	int i, rc;

	for (i=0; table[i].name; i++)
	{
	rc = assuan_register_command (ctx, table[i].name, table[i].handler,
	table[i].help);
	if (rc)
	return rc;
	}
	assuan_set_hello_line (ctx, "GNU Privacy Guard's Smartcard server ready");

	assuan_register_reset_notify (ctx, reset_notify);
	assuan_register_option_handler (ctx, option_handler);
	return 0;
	}


	/* Startup the server. If FD is given as -1 this is simple pipe
	server, otherwise it is a regular server. Returns true if there
	are no more active asessions. */
	int
	scd_command_handler (ctrl_t ctrl, int fd)
	{
	int rc;
	assuan_context_t ctx = NULL;
	int stopme;

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("failed to allocate assuan context: %s\n",
	gpg_strerror (rc));
	scd_exit (2);
	}

	if (fd == -1)
	{
	assuan_fd_t filedes[2];

	filedes[0] = assuan_fdopen (0);
	filedes[1] = assuan_fdopen (1);
	rc = assuan_init_pipe_server (ctx, filedes);
	}
	else
	{
	rc = assuan_init_socket_server (ctx, INT2FD(fd),
	ASSUAN_SOCKET_SERVER_ACCEPTED);
	}
	if (rc)
	{
	log_error ("failed to initialize the server: %s\n",
	gpg_strerror(rc));
	scd_exit (2);
	}
	rc = register_commands (ctx);
	if (rc)
	{
	log_error ("failed to register commands with Assuan: %s\n",
	gpg_strerror(rc));
	scd_exit (2);
	}
	assuan_set_pointer (ctx, ctrl);

	/* Allocate and initialize the server object. Put it into the list
	of active sessions. */
	ctrl->server_local = xcalloc (1, sizeof *ctrl->server_local);
	ctrl->server_local->next_session = session_list;
	session_list = ctrl->server_local;
	ctrl->server_local->ctrl_backlink = ctrl;
	ctrl->server_local->assuan_ctx = ctx;

	/* Command processing loop. */
	for (;;)
	{
	rc = assuan_accept (ctx);
	if (rc == -1)
	{
	break;
	}
	else if (rc)
	{
	log_info ("Assuan accept problem: %s\n", gpg_strerror (rc));
	break;
	}

	rc = assuan_process (ctx);
	if (rc)
	{
	log_info ("Assuan processing failed: %s\n", gpg_strerror (rc));
	continue;
	}
	}

	/* Cleanup. We don't send an explicit reset to the card. */
	do_reset (ctrl, 0);

	/* Release the server object. */
	if (session_list == ctrl->server_local)
	session_list = ctrl->server_local->next_session;
	else
	{
	struct server_local_s *sl;

	for (sl=session_list; sl->next_session; sl = sl->next_session)
	if (sl->next_session == ctrl->server_local)
	break;
	if (!sl->next_session)
	BUG ();
	sl->next_session = ctrl->server_local->next_session;
	}
	stopme = ctrl->server_local->stopme;
	xfree (ctrl->server_local);
	ctrl->server_local = NULL;

	/* Release the Assuan context. */
	assuan_release (ctx);

	if (stopme)
	scd_exit (0);

	/* If there are no more sessions return true. */
	return !session_list;
	}


	/* Send a line with status information via assuan and escape all given
	buffers. The variable elements are pairs of (char *, size_t),
	terminated with a (NULL, 0). */
	void
	send_status_info (ctrl_t ctrl, const char *keyword, ...)
	{
	va_list arg_ptr;
	const unsigned char *value;
	size_t valuelen;
	char buf[950], *p;
	size_t n;
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;

	va_start (arg_ptr, keyword);

	p = buf;
	n = 0;
	while ( (value = va_arg (arg_ptr, const unsigned char *)) )
	{
	valuelen = va_arg (arg_ptr, size_t);
	if (!valuelen)
	continue; /* empty buffer */
	if (n)
	{
	*p++ = ' ';
	n++;
	}
	for ( ; valuelen && n < DIM (buf)-2; n++, valuelen--, value++)
	{
	if (value == '+' \|\| value == '\"' \|\| *value == '%'
	\|\| *value < ' ')
	{
	sprintf (p, "%%%02X", *value);
	p += 3;
	}
	else if (*value == ' ')
	*p++ = '+';
	else
	p++ = value;
	}
	}
	*p = 0;
	assuan_write_status (ctx, keyword, buf);

	va_end (arg_ptr);
	}


	/* Send a ready formatted status line via assuan. */
	void
	send_status_direct (ctrl_t ctrl, const char keyword, const char args)
	{
	assuan_context_t ctx = ctrl->server_local->assuan_ctx;

	if (strchr (args, '\n'))
	log_error ("error: LF detected in status line - not sending\n");
	else
	assuan_write_status (ctx, keyword, args);
	}


	/* Helper to send the clients a status change notification. */
	void
	send_client_notifications (app_t app, int removal)
	{
	struct {
	pid_t pid;
	#ifdef HAVE_W32_SYSTEM
	HANDLE handle;
	#else
	int signo;
	#endif
	} killed[50];
	int killidx = 0;
	int kidx;
	struct server_local_s *sl;

	for (sl=session_list; sl; sl = sl->next_session)
	if (sl->ctrl_backlink && sl->ctrl_backlink->app_ctx == app)
	{
	pid_t pid;
	#ifdef HAVE_W32_SYSTEM
	HANDLE handle;
	#else
	int signo;
	#endif

	if (removal)
	{
	sl->ctrl_backlink->app_ctx = NULL;
	sl->card_removed = 1;
	release_application (app, 1);
	}

	if (!sl->event_signal \|\| !sl->assuan_ctx)
	continue;

	pid = assuan_get_pid (sl->assuan_ctx);

	#ifdef HAVE_W32_SYSTEM
	handle = (void *)sl->event_signal;
	for (kidx=0; kidx < killidx; kidx++)
	if (killed[kidx].pid == pid
	&& killed[kidx].handle == handle)
	break;
	if (kidx < killidx)
	log_info ("event %lx (%p) already triggered for client %d\n",
	sl->event_signal, handle, (int)pid);
	else
	{
	log_info ("triggering event %lx (%p) for client %d\n",
	sl->event_signal, handle, (int)pid);
	if (!SetEvent (handle))
	log_error ("SetEvent(%lx) failed: %s\n",
	sl->event_signal, w32_strerror (-1));
	if (killidx < DIM (killed))
	{
	killed[killidx].pid = pid;
	killed[killidx].handle = handle;
	killidx++;
	}
	}
	#else /!HAVE_W32_SYSTEM/
	signo = sl->event_signal;

	if (pid != (pid_t)(-1) && pid && signo > 0)
	{
	for (kidx=0; kidx < killidx; kidx++)
	if (killed[kidx].pid == pid
	&& killed[kidx].signo == signo)
	break;
	if (kidx < killidx)
	log_info ("signal %d already sent to client %d\n",
	signo, (int)pid);
	else
	{
	log_info ("sending signal %d to client %d\n",
	signo, (int)pid);
	kill (pid, signo);
	if (killidx < DIM (killed))
	{
	killed[killidx].pid = pid;
	killed[killidx].signo = signo;
	killidx++;
	}
	}
	}
	#endif /!HAVE_W32_SYSTEM/
	}
	}
	diff --git a/sm/call-dirmngr.c b/sm/call-dirmngr.c
	index d0250634a..45303e8c4 100644
	--- a/sm/call-dirmngr.c
	+++ b/sm/call-dirmngr.c
	@@ -1,1048 +1,1048 @@
	/* call-dirmngr.c - Communication with the dirmngr
	* Copyright (C) 2002, 2003, 2005, 2007, 2008,
	* 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#include <assert.h>
	#include <ctype.h>

	#include "gpgsm.h"
	#include <gcrypt.h>
	#include <assuan.h>

	#include "i18n.h"
	#include "keydb.h"
	#include "asshelp.h"


	struct membuf {
	size_t len;
	size_t size;
	char *buf;
	int out_of_core;
	};



	/* fixme: We need a context for each thread or serialize the access to
	the dirmngr. */
	static assuan_context_t dirmngr_ctx = NULL;
	static assuan_context_t dirmngr2_ctx = NULL;

	static int dirmngr_ctx_locked;
	static int dirmngr2_ctx_locked;

	struct inq_certificate_parm_s {
	ctrl_t ctrl;
	assuan_context_t ctx;
	ksba_cert_t cert;
	ksba_cert_t issuer_cert;
	};

	struct isvalid_status_parm_s {
	ctrl_t ctrl;
	int seen;
	unsigned char fpr[20];
	};


	struct lookup_parm_s {
	ctrl_t ctrl;
	assuan_context_t ctx;
	void (cb)(void , ksba_cert_t);
	void *cb_value;
	struct membuf data;
	int error;
	};

	struct run_command_parm_s {
	ctrl_t ctrl;
	assuan_context_t ctx;
	};



	static gpg_error_t get_cached_cert (assuan_context_t ctx,
	const unsigned char *fpr,
	ksba_cert_t *r_cert);



	/* A simple implementation of a dynamic buffer. Use init_membuf() to
	create a buffer, put_membuf to append bytes and get_membuf to
	release and return the buffer. Allocation errors are detected but
	only returned at the final get_membuf(), this helps not to clutter
	the code with out of core checks. */

	static void
	init_membuf (struct membuf *mb, int initiallen)
	{
	mb->len = 0;
	mb->size = initiallen;
	mb->out_of_core = 0;
	mb->buf = xtrymalloc (initiallen);
	if (!mb->buf)
	mb->out_of_core = 1;
	}

	static void
	put_membuf (struct membuf mb, const void buf, size_t len)
	{
	if (mb->out_of_core)
	return;

	if (mb->len + len >= mb->size)
	{
	char *p;

	mb->size += len + 1024;
	p = xtryrealloc (mb->buf, mb->size);
	if (!p)
	{
	mb->out_of_core = 1;
	return;
	}
	mb->buf = p;
	}
	memcpy (mb->buf + mb->len, buf, len);
	mb->len += len;
	}

	static void *
	get_membuf (struct membuf mb, size_t len)
	{
	char *p;

	if (mb->out_of_core)
	{
	xfree (mb->buf);
	mb->buf = NULL;
	return NULL;
	}

	p = mb->buf;
	*len = mb->len;
	mb->buf = NULL;
	mb->out_of_core = 1; /* don't allow a reuse */
	return p;
	}


	/* Print a warning if the server's version number is less than our
	version number. Returns an error code on a connection problem. */
	static gpg_error_t
	warn_version_mismatch (ctrl_t ctrl, assuan_context_t ctx,
	const char *servername, int mode)
	{
	gpg_error_t err;
	char *serverversion;
	const char *myversion = strusage (13);

	err = get_assuan_server_version (ctx, mode, &serverversion);
	if (err)
	log_error (_("error getting version from '%s': %s\n"),
	servername, gpg_strerror (err));
	else if (compare_version_strings (serverversion, myversion) < 0)
	{
	char *warn;

	warn = xtryasprintf (_("server '%s' is older than us (%s < %s)"),
	servername, serverversion, myversion);
	if (!warn)
	err = gpg_error_from_syserror ();
	else
	{
	log_info (_("WARNING: %s\n"), warn);
	gpgsm_status2 (ctrl, STATUS_WARNING, "server_version_mismatch 0",
	warn, NULL);
	xfree (warn);
	}
	}
	xfree (serverversion);
	return err;
	}


	/* This function prepares the dirmngr for a new session. The
	audit-events option is used so that other dirmngr clients won't get
	disturbed by such events. */
	static void
	prepare_dirmngr (ctrl_t ctrl, assuan_context_t ctx, gpg_error_t err)
	{
	struct keyserver_spec *server;

	if (!err)
	err = warn_version_mismatch (ctrl, ctx, DIRMNGR_NAME, 0);

	if (!err)
	{
	err = assuan_transact (ctx, "OPTION audit-events=1",
	NULL, NULL, NULL, NULL, NULL, NULL);
	if (gpg_err_code (err) == GPG_ERR_UNKNOWN_OPTION)
	err = 0; /* Allow the use of old dirmngr versions. */
	}
	audit_log_ok (ctrl->audit, AUDIT_DIRMNGR_READY, err);

	if (!ctx \|\| err)
	return;

	server = opt.keyserver;
	while (server)
	{
	char line[ASSUAN_LINELENGTH];
	char *user = server->user ? server->user : "";
	char *pass = server->pass ? server->pass : "";
	char *base = server->base ? server->base : "";

	snprintf (line, DIM (line), "LDAPSERVER %s:%i:%s:%s:%s",
	server->host, server->port, user, pass, base);

	assuan_transact (ctx, line, NULL, NULL, NULL, NULL, NULL, NULL);
	/* The code below is not required because we don't return an error. */
	/* err = [above call] */
	/* if (gpg_err_code (err) == GPG_ERR_ASS_UNKNOWN_CMD) */
	/* err = 0; /\* Allow the use of old dirmngr versions. \/ /

	server = server->next;
	}
	}



	/* Return a new assuan context for a Dirmngr connection. */
	static gpg_error_t
	start_dirmngr_ext (ctrl_t ctrl, assuan_context_t *ctx_r)
	{
	gpg_error_t err;
	assuan_context_t ctx;

	if (opt.disable_dirmngr \|\| ctrl->offline)
	return gpg_error (GPG_ERR_NO_DIRMNGR);

	if (*ctx_r)
	return 0;

	/* Note: if you change this to multiple connections, you also need
	to take care of the implicit option sending caching. */

	err = start_new_dirmngr (&ctx, GPG_ERR_SOURCE_DEFAULT,
	opt.dirmngr_program,
	opt.autostart, opt.verbose, DBG_IPC,
	gpgsm_status2, ctrl);
	if (!opt.autostart && gpg_err_code (err) == GPG_ERR_NO_DIRMNGR)
	{
	static int shown;

	if (!shown)
	{
	shown = 1;
	log_info (_("no dirmngr running in this session\n"));
	}
	}
	prepare_dirmngr (ctrl, ctx, err);
	if (err)
	return err;

	*ctx_r = ctx;
	return 0;
	}


	static int
	start_dirmngr (ctrl_t ctrl)
	{
	gpg_error_t err;

	assert (! dirmngr_ctx_locked);
	dirmngr_ctx_locked = 1;

	err = start_dirmngr_ext (ctrl, &dirmngr_ctx);
	/* We do not check ERR but the existence of a context because the
	error might come from a failed command send to the dirmngr.
	Fixme: Why don't we close the drimngr context if we encountered
	an error in prepare_dirmngr? */
	if (!dirmngr_ctx)
	dirmngr_ctx_locked = 0;
	return err;
	}


	static void
	release_dirmngr (ctrl_t ctrl)
	{
	(void)ctrl;

	if (!dirmngr_ctx_locked)
	log_error ("WARNING: trying to release a non-locked dirmngr ctx\n");
	dirmngr_ctx_locked = 0;
	}


	static int
	start_dirmngr2 (ctrl_t ctrl)
	{
	gpg_error_t err;

	assert (! dirmngr2_ctx_locked);
	dirmngr2_ctx_locked = 1;

	err = start_dirmngr_ext (ctrl, &dirmngr2_ctx);
	if (!dirmngr2_ctx)
	dirmngr2_ctx_locked = 0;
	return err;
	}


	static void
	release_dirmngr2 (ctrl_t ctrl)
	{
	(void)ctrl;

	if (!dirmngr2_ctx_locked)
	log_error ("WARNING: trying to release a non-locked dirmngr2 ctx\n");
	dirmngr2_ctx_locked = 0;
	}



	/* Handle a SENDCERT inquiry. */
	static gpg_error_t
	inq_certificate (void opaque, const char line)
	{
	struct inq_certificate_parm_s *parm = opaque;
	const char *s;
	int rc;
	size_t n;
	const unsigned char *der;
	size_t derlen;
	int issuer_mode = 0;
	ksba_sexp_t ski = NULL;

	if ((s = has_leading_keyword (line, "SENDCERT")))
	{
	line = s;
	}
	else if ((s = has_leading_keyword (line, "SENDCERT_SKI")))
	{
	/* Send a certificate where a sourceKeyIdentifier is included. */
	line = s;
	ski = make_simple_sexp_from_hexstr (line, &n);
	line += n;
	while (*line == ' ')
	line++;
	}
	else if ((s = has_leading_keyword (line, "SENDISSUERCERT")))
	{
	line = s;
	issuer_mode = 1;
	}
	else if ((s = has_leading_keyword (line, "ISTRUSTED")))
	{
	/* The server is asking us whether the certificate is a trusted
	root certificate. */
	char fpr[41];
	struct rootca_flags_s rootca_flags;

	line = s;

	for (s=line,n=0; hexdigitp (s); s++, n++)
	;
	if (*s \|\| n != 40)
	return gpg_error (GPG_ERR_ASS_PARAMETER);
	for (s=line, n=0; n < 40; s++, n++)
	fpr[n] = (s >= 'a')? (s & 0xdf): *s;
	fpr[n] = 0;

	if (!gpgsm_agent_istrusted (parm->ctrl, NULL, fpr, &rootca_flags))
	rc = assuan_send_data (parm->ctx, "1", 1);
	else
	rc = 0;
	return rc;
	}
	else
	{
	log_error ("unsupported inquiry '%s'\n", line);
	return gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
	}

	if (!*line)
	{ /* Send the current certificate. */
	der = ksba_cert_get_image (issuer_mode? parm->issuer_cert : parm->cert,
	&derlen);
	if (!der)
	rc = gpg_error (GPG_ERR_INV_CERT_OBJ);
	else
	rc = assuan_send_data (parm->ctx, der, derlen);
	}
	else if (issuer_mode)
	{
	log_error ("sending specific issuer certificate back "
	"is not yet implemented\n");
	rc = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
	}
	else
	{ /* Send the given certificate. */
	int err;
	ksba_cert_t cert;


	err = gpgsm_find_cert (parm->ctrl, line, ski, &cert);
	if (err)
	{
	log_error ("certificate not found: %s\n", gpg_strerror (err));
	rc = gpg_error (GPG_ERR_NOT_FOUND);
	}
	else
	{
	der = ksba_cert_get_image (cert, &derlen);
	if (!der)
	rc = gpg_error (GPG_ERR_INV_CERT_OBJ);
	else
	rc = assuan_send_data (parm->ctx, der, derlen);
	ksba_cert_release (cert);
	}
	}

	xfree (ski);
	return rc;
	}


	-/* Take a 20 byte hexencoded string and put it into the the provided
	+/* Take a 20 byte hexencoded string and put it into the provided
	20 byte buffer FPR in binary format. */
	static int
	unhexify_fpr (const char hexstr, unsigned char fpr)
	{
	const char *s;
	int n;

	for (s=hexstr, n=0; hexdigitp (s); s++, n++)
	;
	if (*s \|\| (n != 40))
	return 0; /* no fingerprint (invalid or wrong length). */
	for (s=hexstr, n=0; *s; s += 2, n++)
	fpr[n] = xtoi_2 (s);
	return 1; /* okay */
	}


	static gpg_error_t
	isvalid_status_cb (void opaque, const char line)
	{
	struct isvalid_status_parm_s *parm = opaque;
	const char *s;

	if ((s = has_leading_keyword (line, "PROGRESS")))
	{
	if (parm->ctrl)
	{
	line = s;
	if (gpgsm_status (parm->ctrl, STATUS_PROGRESS, line))
	return gpg_error (GPG_ERR_ASS_CANCELED);
	}
	}
	else if ((s = has_leading_keyword (line, "ONLY_VALID_IF_CERT_VALID")))
	{
	parm->seen++;
	if (!*s \|\| !unhexify_fpr (s, parm->fpr))
	parm->seen++; /* Bumb it to indicate an error. */
	}
	return 0;
	}




	/* Call the directory manager to check whether the certificate is valid
	Returns 0 for valid or usually one of the errors:

	GPG_ERR_CERTIFICATE_REVOKED
	GPG_ERR_NO_CRL_KNOWN
	GPG_ERR_CRL_TOO_OLD

	Values for USE_OCSP:
	0 = Do CRL check.
	1 = Do an OCSP check.
	2 = Do an OCSP check using only the default responder.
	*/
	int
	gpgsm_dirmngr_isvalid (ctrl_t ctrl,
	ksba_cert_t cert, ksba_cert_t issuer_cert, int use_ocsp)
	{
	static int did_options;
	int rc;
	char *certid;
	char line[ASSUAN_LINELENGTH];
	struct inq_certificate_parm_s parm;
	struct isvalid_status_parm_s stparm;

	rc = start_dirmngr (ctrl);
	if (rc)
	return rc;

	if (use_ocsp)
	{
	certid = gpgsm_get_fingerprint_hexstring (cert, GCRY_MD_SHA1);
	}
	else
	{
	certid = gpgsm_get_certid (cert);
	if (!certid)
	{
	log_error ("error getting the certificate ID\n");
	release_dirmngr (ctrl);
	return gpg_error (GPG_ERR_GENERAL);
	}
	}

	if (opt.verbose > 1)
	{
	char *fpr = gpgsm_get_fingerprint_string (cert, GCRY_MD_SHA1);
	log_info ("asking dirmngr about %s%s\n", fpr,
	use_ocsp? " (using OCSP)":"");
	xfree (fpr);
	}

	parm.ctx = dirmngr_ctx;
	parm.ctrl = ctrl;
	parm.cert = cert;
	parm.issuer_cert = issuer_cert;

	stparm.ctrl = ctrl;
	stparm.seen = 0;
	memset (stparm.fpr, 0, 20);

	/* FIXME: If --disable-crl-checks has been set, we should pass an
	option to dirmngr, so that no fallback CRL check is done after an
	ocsp check. It is not a problem right now as dirmngr does not
	fallback to CRL checking. */

	/* It is sufficient to send the options only once because we have
	one connection per process only. */
	if (!did_options)
	{
	if (opt.force_crl_refresh)
	assuan_transact (dirmngr_ctx, "OPTION force-crl-refresh=1",
	NULL, NULL, NULL, NULL, NULL, NULL);
	did_options = 1;
	}
	snprintf (line, DIM(line), "ISVALID%s %s",
	use_ocsp == 2? " --only-ocsp --force-default-responder":"",
	certid);
	xfree (certid);

	rc = assuan_transact (dirmngr_ctx, line, NULL, NULL,
	inq_certificate, &parm,
	isvalid_status_cb, &stparm);
	if (opt.verbose > 1)
	log_info ("response of dirmngr: %s\n", rc? gpg_strerror (rc): "okay");

	if (!rc && stparm.seen)
	{
	/* Need to also check the certificate validity. */
	if (stparm.seen != 1)
	{
	log_error ("communication problem with dirmngr detected\n");
	rc = gpg_error (GPG_ERR_INV_CRL);
	}
	else
	{
	ksba_cert_t rspcert = NULL;

	if (get_cached_cert (dirmngr_ctx, stparm.fpr, &rspcert))
	{
	/* Ooops: Something went wrong getting the certificate
	from the dirmngr. Try our own cert store now. */
	KEYDB_HANDLE kh;

	kh = keydb_new ();
	if (!kh)
	rc = gpg_error (GPG_ERR_ENOMEM);
	if (!rc)
	rc = keydb_search_fpr (ctrl, kh, stparm.fpr);
	if (!rc)
	rc = keydb_get_cert (kh, &rspcert);
	if (rc)
	{
	log_error ("unable to find the certificate used "
	"by the dirmngr: %s\n", gpg_strerror (rc));
	rc = gpg_error (GPG_ERR_INV_CRL);
	}
	keydb_release (kh);
	}

	if (!rc)
	{
	rc = gpgsm_cert_use_ocsp_p (rspcert);
	if (rc)
	rc = gpg_error (GPG_ERR_INV_CRL);
	else
	{
	/* Note the no_dirmngr flag: This avoids checking
	this certificate over and over again. */
	rc = gpgsm_validate_chain (ctrl, rspcert, "", NULL, 0, NULL,
	VALIDATE_FLAG_NO_DIRMNGR, NULL);
	if (rc)
	{
	log_error ("invalid certificate used for CRL/OCSP: %s\n",
	gpg_strerror (rc));
	rc = gpg_error (GPG_ERR_INV_CRL);
	}
	}
	}
	ksba_cert_release (rspcert);
	}
	}
	release_dirmngr (ctrl);
	return rc;
	}



	/* Lookup helpers*/
	static gpg_error_t
	lookup_cb (void opaque, const void buffer, size_t length)
	{
	struct lookup_parm_s *parm = opaque;
	size_t len;
	char *buf;
	ksba_cert_t cert;
	int rc;

	if (parm->error)
	return 0;

	if (buffer)
	{
	put_membuf (&parm->data, buffer, length);
	return 0;
	}
	/* END encountered - process what we have */
	buf = get_membuf (&parm->data, &len);
	if (!buf)
	{
	parm->error = gpg_error (GPG_ERR_ENOMEM);
	return 0;
	}

	rc = ksba_cert_new (&cert);
	if (rc)
	{
	parm->error = rc;
	return 0;
	}
	rc = ksba_cert_init_from_mem (cert, buf, len);
	if (rc)
	{
	log_error ("failed to parse a certificate: %s\n", gpg_strerror (rc));
	}
	else
	{
	parm->cb (parm->cb_value, cert);
	}

	ksba_cert_release (cert);
	init_membuf (&parm->data, 4096);
	return 0;
	}

	/* Return a properly escaped pattern from NAMES. The only error
	return is NULL to indicate a malloc failure. */
	static char *
	pattern_from_strlist (strlist_t names)
	{
	strlist_t sl;
	int n;
	const char *s;
	char pattern, p;

	for (n=0, sl=names; sl; sl = sl->next)
	{
	for (s=sl->d; *s; s++, n++)
	{
	if (s == '%' \|\| s == ' ' \|\| *s == '+')
	n += 2;
	}
	n++;
	}

	p = pattern = xtrymalloc (n+1);
	if (!pattern)
	return NULL;

	for (sl=names; sl; sl = sl->next)
	{
	for (s=sl->d; *s; s++)
	{
	switch (*s)
	{
	case '%':
	*p++ = '%';
	*p++ = '2';
	*p++ = '5';
	break;
	case ' ':
	*p++ = '%';
	*p++ = '2';
	*p++ = '0';
	break;
	case '+':
	*p++ = '%';
	*p++ = '2';
	*p++ = 'B';
	break;
	default:
	p++ = s;
	break;
	}
	}
	*p++ = ' ';
	}
	if (p == pattern)
	pattern = 0; / is empty */
	else
	p[-1] = '\0'; /* remove trailing blank */

	return pattern;
	}

	static gpg_error_t
	lookup_status_cb (void opaque, const char line)
	{
	struct lookup_parm_s *parm = opaque;
	const char *s;

	if ((s = has_leading_keyword (line, "PROGRESS")))
	{
	if (parm->ctrl)
	{
	line = s;
	if (gpgsm_status (parm->ctrl, STATUS_PROGRESS, line))
	return gpg_error (GPG_ERR_ASS_CANCELED);
	}
	}
	else if ((s = has_leading_keyword (line, "TRUNCATED")))
	{
	if (parm->ctrl)
	{
	line = s;
	gpgsm_status (parm->ctrl, STATUS_TRUNCATED, line);
	}
	}
	return 0;
	}


	/* Run the Directory Manager's lookup command using the pattern
	compiled from the strings given in NAMES. The caller must provide
	the callback CB which will be passed cert by cert. Note that CTRL
	is optional. With CACHE_ONLY the dirmngr will search only its own
	key cache. */
	int
	gpgsm_dirmngr_lookup (ctrl_t ctrl, strlist_t names, int cache_only,
	void (cb)(void, ksba_cert_t), void *cb_value)
	{
	int rc;
	char *pattern;
	char line[ASSUAN_LINELENGTH];
	struct lookup_parm_s parm;
	size_t len;
	assuan_context_t ctx;

	/* The lookup function can be invoked from the callback of a lookup
	function, for example to walk the chain. */
	if (!dirmngr_ctx_locked)
	{
	rc = start_dirmngr (ctrl);
	if (rc)
	return rc;
	ctx = dirmngr_ctx;
	}
	else if (!dirmngr2_ctx_locked)
	{
	rc = start_dirmngr2 (ctrl);
	if (rc)
	return rc;
	ctx = dirmngr2_ctx;
	}
	else
	{
	log_fatal ("both dirmngr contexts are in use\n");
	}

	pattern = pattern_from_strlist (names);
	if (!pattern)
	{
	if (ctx == dirmngr_ctx)
	release_dirmngr (ctrl);
	else
	release_dirmngr2 (ctrl);

	return out_of_core ();
	}
	snprintf (line, DIM(line), "LOOKUP%s %s",
	cache_only? " --cache-only":"", pattern);
	xfree (pattern);

	parm.ctrl = ctrl;
	parm.ctx = ctx;
	parm.cb = cb;
	parm.cb_value = cb_value;
	parm.error = 0;
	init_membuf (&parm.data, 4096);

	rc = assuan_transact (ctx, line, lookup_cb, &parm,
	NULL, NULL, lookup_status_cb, &parm);
	xfree (get_membuf (&parm.data, &len));

	if (ctx == dirmngr_ctx)
	release_dirmngr (ctrl);
	else
	release_dirmngr2 (ctrl);

	if (rc)
	return rc;
	return parm.error;
	}



	static gpg_error_t
	get_cached_cert_data_cb (void opaque, const void buffer, size_t length)
	{
	struct membuf *mb = opaque;

	if (buffer)
	put_membuf (mb, buffer, length);
	return 0;
	}

	/* Return a certificate from the Directory Manager's cache. This
	function only returns one certificate which must be specified using
	the fingerprint FPR and will be stored at R_CERT. On error NULL is
	stored at R_CERT and an error code returned. Note that the caller
	must provide the locked dirmngr context CTX. */
	static gpg_error_t
	get_cached_cert (assuan_context_t ctx,
	const unsigned char fpr, ksba_cert_t r_cert)
	{
	gpg_error_t err;
	char line[ASSUAN_LINELENGTH];
	char hexfpr[2*20+1];
	struct membuf mb;
	char *buf;
	size_t buflen = 0;
	ksba_cert_t cert;

	*r_cert = NULL;

	bin2hex (fpr, 20, hexfpr);
	snprintf (line, DIM(line), "LOOKUP --single --cache-only 0x%s", hexfpr);

	init_membuf (&mb, 4096);
	err = assuan_transact (ctx, line, get_cached_cert_data_cb, &mb,
	NULL, NULL, NULL, NULL);
	buf = get_membuf (&mb, &buflen);
	if (err)
	{
	xfree (buf);
	return err;
	}
	if (!buf)
	return gpg_error (GPG_ERR_ENOMEM);

	err = ksba_cert_new (&cert);
	if (err)
	{
	xfree (buf);
	return err;
	}
	err = ksba_cert_init_from_mem (cert, buf, buflen);
	xfree (buf);
	if (err)
	{
	log_error ("failed to parse a certificate: %s\n", gpg_strerror (err));
	ksba_cert_release (cert);
	return err;
	}

	*r_cert = cert;
	return 0;
	}



	/* Run Command helpers*/

	/* Fairly simple callback to write all output of dirmngr to stdout. */
	static gpg_error_t
	run_command_cb (void opaque, const void buffer, size_t length)
	{
	(void)opaque;

	if (buffer)
	{
	if ( fwrite (buffer, length, 1, stdout) != 1 )
	log_error ("error writing to stdout: %s\n", strerror (errno));
	}
	return 0;
	}

	/* Handle inquiries from the dirmngr COMMAND. */
	static gpg_error_t
	run_command_inq_cb (void opaque, const char line)
	{
	struct run_command_parm_s *parm = opaque;
	const char *s;
	int rc = 0;

	if ((s = has_leading_keyword (line, "SENDCERT")))
	{ /* send the given certificate */
	int err;
	ksba_cert_t cert;
	const unsigned char *der;
	size_t derlen;

	line = s;
	if (!*line)
	return gpg_error (GPG_ERR_ASS_PARAMETER);

	err = gpgsm_find_cert (parm->ctrl, line, NULL, &cert);
	if (err)
	{
	log_error ("certificate not found: %s\n", gpg_strerror (err));
	rc = gpg_error (GPG_ERR_NOT_FOUND);
	}
	else
	{
	der = ksba_cert_get_image (cert, &derlen);
	if (!der)
	rc = gpg_error (GPG_ERR_INV_CERT_OBJ);
	else
	rc = assuan_send_data (parm->ctx, der, derlen);
	ksba_cert_release (cert);
	}
	}
	else if ((s = has_leading_keyword (line, "PRINTINFO")))
	{ /* Simply show the message given in the argument. */
	line = s;
	log_info ("dirmngr: %s\n", line);
	}
	else
	{
	log_error ("unsupported inquiry '%s'\n", line);
	rc = gpg_error (GPG_ERR_ASS_UNKNOWN_INQUIRE);
	}

	return rc;
	}

	static gpg_error_t
	run_command_status_cb (void opaque, const char line)
	{
	ctrl_t ctrl = opaque;
	const char *s;

	if (opt.verbose)
	{
	log_info ("dirmngr status: %s\n", line);
	}
	if ((s = has_leading_keyword (line, "PROGRESS")))
	{
	if (ctrl)
	{
	line = s;
	if (gpgsm_status (ctrl, STATUS_PROGRESS, line))
	return gpg_error (GPG_ERR_ASS_CANCELED);
	}
	}
	return 0;
	}



	/* Pass COMMAND to dirmngr and print all output generated by Dirmngr
	to stdout. A couple of inquiries are defined (see above). ARGC
	arguments in ARGV are given to the Dirmngr. Spaces, plus and
	percent characters within the argument strings are percent escaped
	so that blanks can act as delimiters. */
	int
	gpgsm_dirmngr_run_command (ctrl_t ctrl, const char *command,
	int argc, char **argv)
	{
	int rc;
	int i;
	const char *s;
	char line, p;
	size_t len;
	struct run_command_parm_s parm;

	rc = start_dirmngr (ctrl);
	if (rc)
	return rc;

	parm.ctrl = ctrl;
	parm.ctx = dirmngr_ctx;

	len = strlen (command) + 1;
	for (i=0; i < argc; i++)
	len += 1 + 3strlen (argv[i]); / enough space for percent escaping */
	line = xtrymalloc (len);
	if (!line)
	{
	release_dirmngr (ctrl);
	return out_of_core ();
	}

	p = stpcpy (line, command);
	for (i=0; i < argc; i++)
	{
	*p++ = ' ';
	for (s=argv[i]; *s; s++)
	{
	if (!isascii (*s))
	p++ = s;
	else if (*s == ' ')
	*p++ = '+';
	else if (!isprint (s) \|\| s == '+')
	{
	sprintf (p, "%%%02X", (const unsigned char )s);
	p += 3;
	}
	else
	p++ = s;
	}
	}
	*p = 0;

	rc = assuan_transact (dirmngr_ctx, line,
	run_command_cb, NULL,
	run_command_inq_cb, &parm,
	run_command_status_cb, ctrl);
	xfree (line);
	log_info ("response of dirmngr: %s\n", rc? gpg_strerror (rc): "okay");
	release_dirmngr (ctrl);
	return rc;
	}
	diff --git a/sm/certchain.c b/sm/certchain.c
	index 083c3ad92..b3e8656ca 100644
	--- a/sm/certchain.c
	+++ b/sm/certchain.c
	@@ -1,2153 +1,2153 @@
	/* certchain.c - certificate chain validation
	* Copyright (C) 2001, 2002, 2003, 2004, 2005,
	* 2006, 2007, 2008, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#include <stdarg.h>
	#include <assert.h>

	#include "gpgsm.h"
	#include <gcrypt.h>
	#include <ksba.h>

	#include "keydb.h"
	#include "../kbx/keybox.h" /* for KEYBOX_FLAG_* */
	#include "i18n.h"
	#include "tlv.h"


	/* Object to keep track of certain root certificates. */
	struct marktrusted_info_s
	{
	struct marktrusted_info_s *next;
	unsigned char fpr[20];
	};
	static struct marktrusted_info_s *marktrusted_info;


	/* While running the validation function we want to keep track of the
	certificates in the chain. This type is used for that. */
	struct chain_item_s
	{
	struct chain_item_s *next;
	ksba_cert_t cert; /* The certificate. */
	int is_root; /* The certificate is the root certificate. */
	};
	typedef struct chain_item_s *chain_item_t;


	static int is_root_cert (ksba_cert_t cert,
	const char issuerdn, const char subjectdn);
	static int get_regtp_ca_info (ctrl_t ctrl, ksba_cert_t cert, int *chainlen);


	/* This function returns true if we already asked during this session
	whether the root certificate CERT shall be marked as trusted. */
	static int
	already_asked_marktrusted (ksba_cert_t cert)
	{
	unsigned char fpr[20];
	struct marktrusted_info_s *r;

	gpgsm_get_fingerprint (cert, GCRY_MD_SHA1, fpr, NULL);
	/* No context switches in the loop! */
	for (r=marktrusted_info; r; r= r->next)
	if (!memcmp (r->fpr, fpr, 20))
	return 1;
	return 0;
	}

	/* Flag certificate CERT as already asked whether it shall be marked
	as trusted. */
	static void
	set_already_asked_marktrusted (ksba_cert_t cert)
	{
	unsigned char fpr[20];
	struct marktrusted_info_s *r;

	gpgsm_get_fingerprint (cert, GCRY_MD_SHA1, fpr, NULL);
	for (r=marktrusted_info; r; r= r->next)
	if (!memcmp (r->fpr, fpr, 20))
	return; /* Already marked. */
	r = xtrycalloc (1, sizeof *r);
	if (!r)
	return;
	memcpy (r->fpr, fpr, 20);
	r->next = marktrusted_info;
	marktrusted_info = r;
	}

	/* If LISTMODE is true, print FORMAT using LISTMODE to FP. If
	LISTMODE is false, use the string to print an log_info or, if
	IS_ERROR is true, and log_error. */
	static void
	do_list (int is_error, int listmode, estream_t fp, const char *format, ...)
	{
	va_list arg_ptr;

	va_start (arg_ptr, format) ;
	if (listmode)
	{
	if (fp)
	{
	es_fputs (" [", fp);
	es_vfprintf (fp, format, arg_ptr);
	es_fputs ("]\n", fp);
	}
	}
	else
	{
	log_logv (is_error? GPGRT_LOG_ERROR: GPGRT_LOG_INFO, format, arg_ptr);
	log_printf ("\n");
	}
	va_end (arg_ptr);
	}

	/* Return 0 if A and B are equal. */
	static int
	compare_certs (ksba_cert_t a, ksba_cert_t b)
	{
	const unsigned char img_a, img_b;
	size_t len_a, len_b;

	img_a = ksba_cert_get_image (a, &len_a);
	if (!img_a)
	return 1;
	img_b = ksba_cert_get_image (b, &len_b);
	if (!img_b)
	return 1;
	return !(len_a == len_b && !memcmp (img_a, img_b, len_a));
	}


	/* Return true if CERT has the validityModel extensions and defines
	the use of the chain model. */
	static int
	has_validation_model_chain (ksba_cert_t cert, int listmode, estream_t listfp)
	{
	gpg_error_t err;
	int idx, yes;
	const char *oid;
	size_t off, derlen, objlen, hdrlen;
	const unsigned char *der;
	int class, tag, constructed, ndef;
	char *oidbuf;

	for (idx=0; !(err=ksba_cert_get_extension (cert, idx,
	&oid, NULL, &off, &derlen));idx++)
	if (!strcmp (oid, "1.3.6.1.4.1.8301.3.5") )
	break;
	if (err)
	return 0; /* Not found. */
	der = ksba_cert_get_image (cert, NULL);
	if (!der)
	{
	err = gpg_error (GPG_ERR_INV_OBJ); /* Oops */
	goto leave;
	}
	der += off;

	err = parse_ber_header (&der, &derlen, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (!err && (objlen > derlen \|\| tag != TAG_SEQUENCE))
	err = gpg_error (GPG_ERR_INV_OBJ);
	if (err)
	goto leave;
	derlen = objlen;
	err = parse_ber_header (&der, &derlen, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (!err && (objlen > derlen \|\| tag != TAG_OBJECT_ID))
	err = gpg_error (GPG_ERR_INV_OBJ);
	if (err)
	goto leave;
	oidbuf = ksba_oid_to_str (der, objlen);
	if (!oidbuf)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if (opt.verbose)
	do_list (0, listmode, listfp,
	_("validation model requested by certificate: %s"),
	!strcmp (oidbuf, "1.3.6.1.4.1.8301.3.5.1")? _("chain") :
	!strcmp (oidbuf, "1.3.6.1.4.1.8301.3.5.2")? _("shell") :
	/* */ oidbuf);
	yes = !strcmp (oidbuf, "1.3.6.1.4.1.8301.3.5.1");
	ksba_free (oidbuf);
	return yes;


	leave:
	log_error ("error parsing validityModel: %s\n", gpg_strerror (err));
	return 0;
	}



	static int
	unknown_criticals (ksba_cert_t cert, int listmode, estream_t fp)
	{
	static const char *known[] = {
	"2.5.29.15", /* keyUsage */
	"2.5.29.17", /* subjectAltName
	Japanese DoCoMo certs mark them as critical. PKIX
	only requires them as critical if subjectName is
	empty. I don't know whether our code gracefully
	handles such empry subjectNames but that is
	another story. */
	"2.5.29.19", /* basic Constraints */
	"2.5.29.32", /* certificatePolicies */
	"2.5.29.37", /* extendedKeyUsage - handled by certlist.c */
	"1.3.6.1.4.1.8301.3.5", /* validityModel - handled here. */
	NULL
	};
	int rc = 0, i, idx, crit;
	const char *oid;
	gpg_error_t err;
	int unsupported;
	strlist_t sl;

	for (idx=0; !(err=ksba_cert_get_extension (cert, idx,
	&oid, &crit, NULL, NULL));idx++)
	{
	if (!crit)
	continue;
	for (i=0; known[i] && strcmp (known[i],oid); i++)
	;
	unsupported = !known[i];

	/* If this critical extension is not supported. Check the list
	of to be ignored extensions to see whether we claim that it
	is supported. */
	if (unsupported && opt.ignored_cert_extensions)
	{
	for (sl=opt.ignored_cert_extensions;
	sl && strcmp (sl->d, oid); sl = sl->next)
	;
	if (sl)
	unsupported = 0;
	}
	if (unsupported)
	{
	do_list (1, listmode, fp,
	_("critical certificate extension %s is not supported"),
	oid);
	rc = gpg_error (GPG_ERR_UNSUPPORTED_CERT);
	}
	}
	/* We ignore the error codes EOF as well as no-value. The later will
	occur for certificates with no extensions at all. */
	if (err
	&& gpg_err_code (err) != GPG_ERR_EOF
	&& gpg_err_code (err) != GPG_ERR_NO_VALUE)
	rc = err;

	return rc;
	}


	/* Check whether CERT is an allowed certificate. This requires that
	CERT matches all requirements for such a CA, i.e. the
	BasicConstraints extension. The function returns 0 on success and
	the allowed length of the chain at CHAINLEN. */
	static int
	allowed_ca (ctrl_t ctrl,
	ksba_cert_t cert, int *chainlen, int listmode, estream_t fp)
	{
	gpg_error_t err;
	int flag;

	err = ksba_cert_is_ca (cert, &flag, chainlen);
	if (err)
	return err;
	if (!flag)
	{
	if (get_regtp_ca_info (ctrl, cert, chainlen))
	{
	/* Note that dirmngr takes a different way to cope with such
	certs. */
	return 0; /* RegTP issued certificate. */
	}

	do_list (1, listmode, fp,_("issuer certificate is not marked as a CA"));
	return gpg_error (GPG_ERR_BAD_CA_CERT);
	}
	return 0;
	}


	static int
	check_cert_policy (ksba_cert_t cert, int listmode, estream_t fplist)
	{
	gpg_error_t err;
	char *policies;
	FILE *fp;
	int any_critical;

	err = ksba_cert_get_cert_policies (cert, &policies);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	return 0; /* No policy given. */
	if (err)
	return err;

	/* STRING is a line delimited list of certificate policies as stored
	in the certificate. The line itself is colon delimited where the
	first field is the OID of the policy and the second field either
	N or C for normal or critical extension */

	if (opt.verbose > 1 && !listmode)
	log_info ("certificate's policy list: %s\n", policies);

	/* The check is very minimal but won't give false positives */
	any_critical = !!strstr (policies, ":C");

	if (!opt.policy_file)
	{
	xfree (policies);
	if (any_critical)
	{
	do_list (1, listmode, fplist,
	_("critical marked policy without configured policies"));
	return gpg_error (GPG_ERR_NO_POLICY_MATCH);
	}
	return 0;
	}

	fp = fopen (opt.policy_file, "r");
	if (!fp)
	{
	if (opt.verbose \|\| errno != ENOENT)
	log_info (_("failed to open '%s': %s\n"),
	opt.policy_file, strerror (errno));
	xfree (policies);
	/* With no critical policies this is only a warning */
	if (!any_critical)
	{
	if (!opt.quiet)
	do_list (0, listmode, fplist,
	_("Note: non-critical certificate policy not allowed"));
	return 0;
	}
	do_list (1, listmode, fplist,
	_("certificate policy not allowed"));
	return gpg_error (GPG_ERR_NO_POLICY_MATCH);
	}

	for (;;)
	{
	int c;
	char *p, line[256];
	char haystack, allowed;

	/* read line */
	do
	{
	if (!fgets (line, DIM(line)-1, fp) )
	{
	gpg_error_t tmperr = gpg_error (gpg_err_code_from_errno (errno));

	xfree (policies);
	if (feof (fp))
	{
	fclose (fp);
	/* With no critical policies this is only a warning */
	if (!any_critical)
	{
	do_list (0, listmode, fplist,
	_("Note: non-critical certificate policy not allowed"));
	return 0;
	}
	do_list (1, listmode, fplist,
	_("certificate policy not allowed"));
	return gpg_error (GPG_ERR_NO_POLICY_MATCH);
	}
	fclose (fp);
	return tmperr;
	}

	if (!*line \|\| line[strlen(line)-1] != '\n')
	{
	/* eat until end of line */
	while ( (c=getc (fp)) != EOF && c != '\n')
	;
	fclose (fp);
	xfree (policies);
	return gpg_error (*line? GPG_ERR_LINE_TOO_LONG
	: GPG_ERR_INCOMPLETE_LINE);
	}

	/* Allow for empty lines and spaces */
	for (p=line; spacep (p); p++)
	;
	}
	while (!p \|\| p == '\n' \|\| *p == '#');

	/* Parse line. Note that the line has always a LF and spacep
	does not consider a LF a space. Thus strpbrk will always
	succeed. */
	for (allowed=line; spacep (allowed); allowed++)
	;
	p = strpbrk (allowed, " :\n");
	if (!*p \|\| p == allowed)
	{
	fclose (fp);
	xfree (policies);
	return gpg_error (GPG_ERR_CONFIGURATION);
	}
	p = 0; / strip the rest of the line */
	/* See whether we find ALLOWED (which is an OID) in POLICIES */
	for (haystack=policies; (p=strstr (haystack, allowed)); haystack = p+1)
	{
	if ( !(p == policies \|\| p[-1] == '\n') )
	continue; /* Does not match the begin of a line. */
	if (p[strlen (allowed)] != ':')
	continue; /* The length does not match. */
	/* Yep - it does match so return okay. */
	fclose (fp);
	xfree (policies);
	return 0;
	}
	}
	}


	/* Helper function for find_up. This resets the key handle and search
	for an issuer ISSUER with a subjectKeyIdentifier of KEYID. Returns
	0 on success or -1 when not found. */
	static int
	find_up_search_by_keyid (ctrl_t ctrl, KEYDB_HANDLE kh,
	const char *issuer, ksba_sexp_t keyid)
	{
	int rc;
	ksba_cert_t cert = NULL;
	ksba_sexp_t subj = NULL;
	int anyfound = 0;
	ksba_isotime_t not_before, last_not_before;

	keydb_search_reset (kh);
	while (!(rc = keydb_search_subject (ctrl, kh, issuer)))
	{
	ksba_cert_release (cert); cert = NULL;
	rc = keydb_get_cert (kh, &cert);
	if (rc)
	{
	log_error ("keydb_get_cert() failed: rc=%d\n", rc);
	rc = -1;
	break;
	}
	xfree (subj);
	if (!ksba_cert_get_subj_key_id (cert, NULL, &subj))
	{
	if (!cmp_simple_canon_sexp (keyid, subj))
	{
	/* Found matching cert. */
	rc = ksba_cert_get_validity (cert, 0, not_before);
	if (rc)
	{
	log_error ("keydb_get_validity() failed: rc=%d\n", rc);
	rc = -1;
	break;
	}

	if (!anyfound \|\| strcmp (last_not_before, not_before) < 0)
	{
	/* This certificate is the first one found or newer
	than the previous one. This copes with
	re-issuing CA certificates while keeping the same
	key information. */
	anyfound = 1;
	gnupg_copy_time (last_not_before, not_before);
	keydb_push_found_state (kh);
	}
	}
	}
	}

	if (anyfound)
	{
	/* Take the last saved one. */
	keydb_pop_found_state (kh);
	rc = 0; /* Ignore EOF or other error after the first cert. */
	}

	ksba_cert_release (cert);
	xfree (subj);
	return rc? -1:0;
	}


	struct find_up_store_certs_s
	{
	ctrl_t ctrl;
	int count;
	};

	static void
	find_up_store_certs_cb (void *cb_value, ksba_cert_t cert)
	{
	struct find_up_store_certs_s *parm = cb_value;

	if (keydb_store_cert (parm->ctrl, cert, 1, NULL))
	log_error ("error storing issuer certificate as ephemeral\n");
	parm->count++;
	}


	/* Helper for find_up(). Locate the certificate for ISSUER using an
	external lookup. KH is the keydb context we are currently using.
	On success 0 is returned and the certificate may be retrieved from
	the keydb using keydb_get_cert(). KEYID is the keyIdentifier from
	the AKI or NULL. */
	static int
	find_up_external (ctrl_t ctrl, KEYDB_HANDLE kh,
	const char *issuer, ksba_sexp_t keyid)
	{
	int rc;
	strlist_t names = NULL;
	struct find_up_store_certs_s find_up_store_certs_parm;
	char *pattern;
	const char *s;

	find_up_store_certs_parm.ctrl = ctrl;
	find_up_store_certs_parm.count = 0;

	if (opt.verbose)
	log_info (_("looking up issuer at external location\n"));
	/* The Dirmngr process is confused about unknown attributes. As a
	quick and ugly hack we locate the CN and use the issuer string
	starting at this attribite. Fixme: we should have far better
	parsing for external lookups in the Dirmngr. */
	s = strstr (issuer, "CN=");
	if (!s \|\| s == issuer \|\| s[-1] != ',')
	s = issuer;
	pattern = xtrymalloc (strlen (s)+2);
	if (!pattern)
	return gpg_error_from_syserror ();
	strcpy (stpcpy (pattern, "/"), s);
	add_to_strlist (&names, pattern);
	xfree (pattern);

	rc = gpgsm_dirmngr_lookup (ctrl, names, 0, find_up_store_certs_cb,
	&find_up_store_certs_parm);
	free_strlist (names);

	if (opt.verbose)
	log_info (_("number of issuers matching: %d\n"),
	find_up_store_certs_parm.count);
	if (rc)
	{
	log_error ("external key lookup failed: %s\n", gpg_strerror (rc));
	rc = -1;
	}
	else if (!find_up_store_certs_parm.count)
	rc = -1;
	else
	{
	int old;
	/* The issuers are currently stored in the ephemeral key DB, so
	we temporary switch to ephemeral mode. */
	old = keydb_set_ephemeral (kh, 1);
	if (keyid)
	rc = find_up_search_by_keyid (ctrl, kh, issuer, keyid);
	else
	{
	keydb_search_reset (kh);
	rc = keydb_search_subject (ctrl, kh, issuer);
	}
	keydb_set_ephemeral (kh, old);
	}
	return rc;
	}


	/* Helper for find_up(). Ask the dirmngr for the certificate for
	ISSUER with optional SERIALNO. KH is the keydb context we are
	currently using. With SUBJECT_MODE set, ISSUER is searched as the
	subject. On success 0 is returned and the certificate is available
	in the ephemeral DB. */
	static int
	find_up_dirmngr (ctrl_t ctrl, KEYDB_HANDLE kh,
	ksba_sexp_t serialno, const char *issuer, int subject_mode)
	{
	int rc;
	strlist_t names = NULL;
	struct find_up_store_certs_s find_up_store_certs_parm;
	char *pattern;

	(void)kh;

	find_up_store_certs_parm.ctrl = ctrl;
	find_up_store_certs_parm.count = 0;

	if (opt.verbose)
	log_info (_("looking up issuer from the Dirmngr cache\n"));
	if (subject_mode)
	{
	pattern = xtrymalloc (strlen (issuer)+2);
	if (pattern)
	strcpy (stpcpy (pattern, "/"), issuer);
	}
	else if (serialno)
	pattern = gpgsm_format_sn_issuer (serialno, issuer);
	else
	{
	pattern = xtrymalloc (strlen (issuer)+3);
	if (pattern)
	strcpy (stpcpy (pattern, "#/"), issuer);
	}
	if (!pattern)
	return gpg_error_from_syserror ();
	add_to_strlist (&names, pattern);
	xfree (pattern);

	rc = gpgsm_dirmngr_lookup (ctrl, names, 1, find_up_store_certs_cb,
	&find_up_store_certs_parm);
	free_strlist (names);

	if (opt.verbose)
	log_info (_("number of matching certificates: %d\n"),
	find_up_store_certs_parm.count);
	if (rc && !opt.quiet)
	log_info (_("dirmngr cache-only key lookup failed: %s\n"),
	gpg_strerror (rc));
	return (!rc && find_up_store_certs_parm.count)? 0 : -1;
	}



	/* Locate issuing certificate for CERT. ISSUER is the name of the
	issuer used as a fallback if the other methods don't work. If
	FIND_NEXT is true, the function shall return the next possible
	issuer. The certificate itself is not directly returned but a
	keydb_get_cert on the keyDb context KH will return it. Returns 0
	on success, -1 if not found or an error code. */
	static int
	find_up (ctrl_t ctrl, KEYDB_HANDLE kh,
	ksba_cert_t cert, const char *issuer, int find_next)
	{
	ksba_name_t authid;
	ksba_sexp_t authidno;
	ksba_sexp_t keyid;
	int rc = -1;

	if (DBG_X509)
	log_debug ("looking for parent certificate\n");
	if (!ksba_cert_get_auth_key_id (cert, &keyid, &authid, &authidno))
	{
	const char *s = ksba_name_enum (authid, 0);
	if (s && *authidno)
	{
	rc = keydb_search_issuer_sn (ctrl, kh, s, authidno);
	if (rc)
	keydb_search_reset (kh);

	if (!rc && DBG_X509)
	log_debug (" found via authid and sn+issuer\n");

	/* In case of an error, try to get the certificate from the
	dirmngr. That is done by trying to put that certifcate
	into the ephemeral DB and let the code below do the
	actual retrieve. Thus there is no error checking.
	Skipped in find_next mode as usual. */
	if (rc == -1 && !find_next)
	find_up_dirmngr (ctrl, kh, authidno, s, 0);

	/* In case of an error try the ephemeral DB. We can't do
	that in find_next mode because we can't keep the search
	state then. */
	if (rc == -1 && !find_next)
	{
	int old = keydb_set_ephemeral (kh, 1);
	if (!old)
	{
	rc = keydb_search_issuer_sn (ctrl, kh, s, authidno);
	if (rc)
	keydb_search_reset (kh);

	if (!rc && DBG_X509)
	log_debug (" found via authid and sn+issuer (ephem)\n");
	}
	keydb_set_ephemeral (kh, old);
	}
	if (rc)
	rc = -1; /* Need to make sure to have this error code. */
	}

	if (rc == -1 && keyid && !find_next)
	{
	/* Not found by AIK.issuer_sn. Lets try the AIK.ki
	instead. Loop over all certificates with that issuer as
	subject and stop for the one with a matching
	subjectKeyIdentifier. */
	/* Fixme: Should we also search in the dirmngr? */
	rc = find_up_search_by_keyid (ctrl, kh, issuer, keyid);
	if (!rc && DBG_X509)
	log_debug (" found via authid and keyid\n");
	if (rc)
	{
	int old = keydb_set_ephemeral (kh, 1);
	if (!old)
	rc = find_up_search_by_keyid (ctrl, kh, issuer, keyid);
	if (!rc && DBG_X509)
	log_debug (" found via authid and keyid (ephem)\n");
	keydb_set_ephemeral (kh, old);
	}
	if (rc)
	rc = -1; /* Need to make sure to have this error code. */
	}

	/* If we still didn't found it, try to find it via the subject
	from the dirmngr-cache. */
	if (rc == -1 && !find_next)
	{
	if (!find_up_dirmngr (ctrl, kh, NULL, issuer, 1))
	{
	int old = keydb_set_ephemeral (kh, 1);
	if (keyid)
	rc = find_up_search_by_keyid (ctrl, kh, issuer, keyid);
	else
	{
	keydb_search_reset (kh);
	rc = keydb_search_subject (ctrl, kh, issuer);
	}
	keydb_set_ephemeral (kh, old);
	}
	if (rc)
	rc = -1; /* Need to make sure to have this error code. */

	if (!rc && DBG_X509)
	log_debug (" found via authid and issuer from dirmngr cache\n");
	}

	/* If we still didn't found it, try an external lookup. */
	if (rc == -1 && opt.auto_issuer_key_retrieve && !find_next)
	{
	rc = find_up_external (ctrl, kh, issuer, keyid);
	if (!rc && DBG_X509)
	log_debug (" found via authid and external lookup\n");
	}


	/* Print a note so that the user does not feel too helpless when
	an issuer certificate was found and gpgsm prints BAD
	signature because it is not the correct one. */
	if (rc == -1 && opt.quiet)
	;
	else if (rc == -1)
	{
	log_info ("%sissuer certificate ", find_next?"next ":"");
	if (keyid)
	{
	log_printf ("{");
	gpgsm_dump_serial (keyid);
	log_printf ("} ");
	}
	if (authidno)
	{
	log_printf ("(#");
	gpgsm_dump_serial (authidno);
	log_printf ("/");
	gpgsm_dump_string (s);
	log_printf (") ");
	}
	log_printf ("not found using authorityKeyIdentifier\n");
	}
	else if (rc)
	log_error ("failed to find authorityKeyIdentifier: rc=%d\n", rc);
	xfree (keyid);
	ksba_name_release (authid);
	xfree (authidno);
	}

	if (rc) /* Not found via authorithyKeyIdentifier, try regular issuer name. */
	rc = keydb_search_subject (ctrl, kh, issuer);
	if (rc == -1 && !find_next)
	{
	int old;

	/* Also try to get it from the Dirmngr cache. The function
	merely puts it into the ephemeral database. */
	find_up_dirmngr (ctrl, kh, NULL, issuer, 0);

	/* Not found, let us see whether we have one in the ephemeral key DB. */
	old = keydb_set_ephemeral (kh, 1);
	if (!old)
	{
	keydb_search_reset (kh);
	rc = keydb_search_subject (ctrl, kh, issuer);
	}
	keydb_set_ephemeral (kh, old);

	if (!rc && DBG_X509)
	log_debug (" found via issuer\n");
	}

	/* Still not found. If enabled, try an external lookup. */
	if (rc == -1 && opt.auto_issuer_key_retrieve && !find_next)
	{
	rc = find_up_external (ctrl, kh, issuer, NULL);
	if (!rc && DBG_X509)
	log_debug (" found via issuer and external lookup\n");
	}

	return rc;
	}


	/* Return the next certificate up in the chain starting at START.
	Returns -1 when there are no more certificates. */
	int
	gpgsm_walk_cert_chain (ctrl_t ctrl, ksba_cert_t start, ksba_cert_t *r_next)
	{
	int rc = 0;
	char *issuer = NULL;
	char *subject = NULL;
	KEYDB_HANDLE kh = keydb_new ();

	*r_next = NULL;
	if (!kh)
	{
	log_error (_("failed to allocate keyDB handle\n"));
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	issuer = ksba_cert_get_issuer (start, 0);
	subject = ksba_cert_get_subject (start, 0);
	if (!issuer)
	{
	log_error ("no issuer found in certificate\n");
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}
	if (!subject)
	{
	log_error ("no subject found in certificate\n");
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}

	if (is_root_cert (start, issuer, subject))
	{
	rc = -1; /* we are at the root */
	goto leave;
	}

	rc = find_up (ctrl, kh, start, issuer, 0);
	if (rc)
	{
	/* It is quite common not to have a certificate, so better don't
	print an error here. */
	if (rc != -1 && opt.verbose > 1)
	log_error ("failed to find issuer's certificate: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_MISSING_ISSUER_CERT);
	goto leave;
	}

	rc = keydb_get_cert (kh, r_next);
	if (rc)
	{
	log_error ("keydb_get_cert() failed: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_GENERAL);
	}

	leave:
	xfree (issuer);
	xfree (subject);
	keydb_release (kh);
	return rc;
	}


	/* Helper for gpgsm_is_root_cert. This one is used if the subject and
	issuer DNs are already known. */
	static int
	is_root_cert (ksba_cert_t cert, const char issuerdn, const char subjectdn)
	{
	gpg_error_t err;
	int result = 0;
	ksba_sexp_t serialno;
	ksba_sexp_t ak_keyid;
	ksba_name_t ak_name;
	ksba_sexp_t ak_sn;
	const char *ak_name_str;
	ksba_sexp_t subj_keyid = NULL;

	if (!issuerdn \|\| !subjectdn)
	return 0; /* No. */

	if (strcmp (issuerdn, subjectdn))
	return 0; /* No. */

	err = ksba_cert_get_auth_key_id (cert, &ak_keyid, &ak_name, &ak_sn);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	return 1; /* Yes. Without a authorityKeyIdentifier this needs
	to be the Root certifcate (our trust anchor). */
	log_error ("error getting authorityKeyIdentifier: %s\n",
	gpg_strerror (err));
	return 0; /* Well, it is broken anyway. Return No. */
	}

	serialno = ksba_cert_get_serial (cert);
	if (!serialno)
	{
	log_error ("error getting serialno: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Check whether the auth name's matches the issuer name+sn. If
	that is the case this is a root certificate. */
	ak_name_str = ksba_name_enum (ak_name, 0);
	if (ak_name_str
	&& !strcmp (ak_name_str, issuerdn)
	&& !cmp_simple_canon_sexp (ak_sn, serialno))
	{
	result = 1; /* Right, CERT is self-signed. */
	goto leave;
	}

	/* Similar for the ak_keyid. */
	if (ak_keyid && !ksba_cert_get_subj_key_id (cert, NULL, &subj_keyid)
	&& !cmp_simple_canon_sexp (ak_keyid, subj_keyid))
	{
	result = 1; /* Right, CERT is self-signed. */
	goto leave;
	}


	leave:
	ksba_free (subj_keyid);
	ksba_free (ak_keyid);
	ksba_name_release (ak_name);
	ksba_free (ak_sn);
	ksba_free (serialno);
	return result;
	}



	/* Check whether the CERT is a root certificate. Returns True if this
	is the case. */
	int
	gpgsm_is_root_cert (ksba_cert_t cert)
	{
	char *issuer;
	char *subject;
	int yes;

	issuer = ksba_cert_get_issuer (cert, 0);
	subject = ksba_cert_get_subject (cert, 0);
	yes = is_root_cert (cert, issuer, subject);
	xfree (issuer);
	xfree (subject);
	return yes;
	}


	/* This is a helper for gpgsm_validate_chain. */
	static gpg_error_t
	is_cert_still_valid (ctrl_t ctrl, int force_ocsp, int lm, estream_t fp,
	ksba_cert_t subject_cert, ksba_cert_t issuer_cert,
	int any_revoked, int any_no_crl, int *any_crl_too_old)
	{
	gpg_error_t err;

	if (ctrl->offline \|\| (opt.no_crl_check && !ctrl->use_ocsp))
	{
	audit_log_ok (ctrl->audit, AUDIT_CRL_CHECK,
	gpg_error (GPG_ERR_NOT_ENABLED));
	return 0;
	}

	err = gpgsm_dirmngr_isvalid (ctrl,
	subject_cert, issuer_cert,
	force_ocsp? 2 : !!ctrl->use_ocsp);
	audit_log_ok (ctrl->audit, AUDIT_CRL_CHECK, err);

	if (err)
	{
	if (!lm)
	gpgsm_cert_log_name (NULL, subject_cert);
	switch (gpg_err_code (err))
	{
	case GPG_ERR_CERT_REVOKED:
	do_list (1, lm, fp, _("certificate has been revoked"));
	*any_revoked = 1;
	/* Store that in the keybox so that key listings are able to
	return the revoked flag. We don't care about error,
	though. */
	keydb_set_cert_flags (ctrl, subject_cert, 1, KEYBOX_FLAG_VALIDITY, 0,
	~0, VALIDITY_REVOKED);
	break;

	case GPG_ERR_NO_CRL_KNOWN:
	do_list (1, lm, fp, _("no CRL found for certificate"));
	*any_no_crl = 1;
	break;

	case GPG_ERR_NO_DATA:
	do_list (1, lm, fp, _("the status of the certificate is unknown"));
	*any_no_crl = 1;
	break;

	case GPG_ERR_CRL_TOO_OLD:
	do_list (1, lm, fp, _("the available CRL is too old"));
	if (!lm)
	log_info (_("please make sure that the "
	"\"dirmngr\" is properly installed\n"));
	*any_crl_too_old = 1;
	break;

	default:
	do_list (1, lm, fp, _("checking the CRL failed: %s"),
	gpg_strerror (err));
	return err;
	}
	}
	return 0;
	}


	/* Helper for gpgsm_validate_chain to check the validity period of
	SUBJECT_CERT. The caller needs to pass EXPTIME which will be
	updated to the nearest expiration time seen. A DEPTH of 0 indicates
	the target certifciate, -1 the final root certificate and other
	values intermediate certificates. */
	static gpg_error_t
	check_validity_period (ksba_isotime_t current_time,
	ksba_cert_t subject_cert,
	ksba_isotime_t exptime,
	int listmode, estream_t listfp, int depth)
	{
	gpg_error_t err;
	ksba_isotime_t not_before, not_after;

	err = ksba_cert_get_validity (subject_cert, 0, not_before);
	if (!err)
	err = ksba_cert_get_validity (subject_cert, 1, not_after);
	if (err)
	{
	do_list (1, listmode, listfp,
	_("certificate with invalid validity: %s"), gpg_strerror (err));
	return gpg_error (GPG_ERR_BAD_CERT);
	}

	if (*not_after)
	{
	if (!*exptime)
	gnupg_copy_time (exptime, not_after);
	else if (strcmp (not_after, exptime) < 0 )
	gnupg_copy_time (exptime, not_after);
	}

	if (*not_before && strcmp (current_time, not_before) < 0 )
	{
	do_list (1, listmode, listfp,
	depth == 0 ? _("certificate not yet valid") :
	depth == -1 ? _("root certificate not yet valid") :
	/* other */ _("intermediate certificate not yet valid"));
	if (!listmode)
	{
	log_info (" (valid from ");
	dump_isotime (not_before);
	log_printf (")\n");
	}
	return gpg_error (GPG_ERR_CERT_TOO_YOUNG);
	}

	if (*not_after && strcmp (current_time, not_after) > 0 )
	{
	do_list (opt.ignore_expiration?0:1, listmode, listfp,
	depth == 0 ? _("certificate has expired") :
	depth == -1 ? _("root certificate has expired") :
	/* other */ _("intermediate certificate has expired"));
	if (!listmode)
	{
	log_info (" (expired at ");
	dump_isotime (not_after);
	log_printf (")\n");
	}
	if (opt.ignore_expiration)
	log_info ("WARNING: ignoring expiration\n");
	else
	return gpg_error (GPG_ERR_CERT_EXPIRED);
	}

	return 0;
	}

	/* This is a variant of check_validity_period used with the chain
	model. The dextra contraint here is that notBefore and notAfter
	must exists and if the additional argument CHECK_TIME is given this
	time is used to check the validity period of SUBJECT_CERT. */
	static gpg_error_t
	check_validity_period_cm (ksba_isotime_t current_time,
	ksba_isotime_t check_time,
	ksba_cert_t subject_cert,
	ksba_isotime_t exptime,
	int listmode, estream_t listfp, int depth)
	{
	gpg_error_t err;
	ksba_isotime_t not_before, not_after;

	err = ksba_cert_get_validity (subject_cert, 0, not_before);
	if (!err)
	err = ksba_cert_get_validity (subject_cert, 1, not_after);
	if (err)
	{
	do_list (1, listmode, listfp,
	_("certificate with invalid validity: %s"), gpg_strerror (err));
	return gpg_error (GPG_ERR_BAD_CERT);
	}
	if (!not_before \|\| !not_after)
	{
	do_list (1, listmode, listfp,
	_("required certificate attributes missing: %s%s%s"),
	!*not_before? "notBefore":"",
	(!not_before && !not_after)? ", ":"",
	!*not_before? "notAfter":"");
	return gpg_error (GPG_ERR_BAD_CERT);
	}
	if (strcmp (not_before, not_after) > 0 )
	{
	do_list (1, listmode, listfp,
	_("certificate with invalid validity"));
	log_info (" (valid from ");
	dump_isotime (not_before);
	log_printf (" expired at ");
	dump_isotime (not_after);
	log_printf (")\n");
	return gpg_error (GPG_ERR_BAD_CERT);
	}

	if (!*exptime)
	gnupg_copy_time (exptime, not_after);
	else if (strcmp (not_after, exptime) < 0 )
	gnupg_copy_time (exptime, not_after);

	if (strcmp (current_time, not_before) < 0 )
	{
	do_list (1, listmode, listfp,
	depth == 0 ? _("certificate not yet valid") :
	depth == -1 ? _("root certificate not yet valid") :
	/* other */ _("intermediate certificate not yet valid"));
	if (!listmode)
	{
	log_info (" (valid from ");
	dump_isotime (not_before);
	log_printf (")\n");
	}
	return gpg_error (GPG_ERR_CERT_TOO_YOUNG);
	}

	if (*check_time
	&& (strcmp (check_time, not_before) < 0
	\|\| strcmp (check_time, not_after) > 0))
	{
	/* Note that we don't need a case for the root certificate
	because its own consitency has already been checked. */
	do_list(opt.ignore_expiration?0:1, listmode, listfp,
	depth == 0 ?
	_("signature not created during lifetime of certificate") :
	depth == 1 ?
	_("certificate not created during lifetime of issuer") :
	_("intermediate certificate not created during lifetime "
	"of issuer"));
	if (!listmode)
	{
	log_info (depth== 0? _(" ( signature created at ") :
	/* */ _(" (certificate created at ") );
	dump_isotime (check_time);
	log_printf (")\n");
	log_info (depth==0? _(" (certificate valid from ") :
	/* */ _(" ( issuer valid from ") );
	dump_isotime (not_before);
	log_info (" to ");
	dump_isotime (not_after);
	log_printf (")\n");
	}
	if (opt.ignore_expiration)
	log_info ("WARNING: ignoring expiration\n");
	else
	return gpg_error (GPG_ERR_CERT_EXPIRED);
	}

	return 0;
	}



	/* Ask the user whether he wants to mark the certificate CERT trusted.
	Returns true if the CERT is the trusted. We also check whether the
	agent is at all enabled to allow marktrusted and don't call it in
	this session again if it is not. */
	static int
	ask_marktrusted (ctrl_t ctrl, ksba_cert_t cert, int listmode)
	{
	static int no_more_questions;
	int rc;
	char *fpr;
	int success = 0;

	fpr = gpgsm_get_fingerprint_string (cert, GCRY_MD_SHA1);
	log_info (_("fingerprint=%s\n"), fpr? fpr : "?");
	xfree (fpr);

	if (no_more_questions)
	rc = gpg_error (GPG_ERR_NOT_SUPPORTED);
	else
	rc = gpgsm_agent_marktrusted (ctrl, cert);
	if (!rc)
	{
	log_info (_("root certificate has now been marked as trusted\n"));
	success = 1;
	}
	else if (!listmode)
	{
	gpgsm_dump_cert ("issuer", cert);
	log_info ("after checking the fingerprint, you may want "
	"to add it manually to the list of trusted certificates.\n");
	}

	if (gpg_err_code (rc) == GPG_ERR_NOT_SUPPORTED)
	{
	if (!no_more_questions)
	log_info (_("interactive marking as trusted "
	"not enabled in gpg-agent\n"));
	no_more_questions = 1;
	}
	else if (gpg_err_code (rc) == GPG_ERR_CANCELED)
	{
	log_info (_("interactive marking as trusted "
	"disabled for this session\n"));
	no_more_questions = 1;
	}
	else
	set_already_asked_marktrusted (cert);

	return success;
	}




	/* Validate a chain and optionally return the nearest expiration time
	in R_EXPTIME. With LISTMODE set to 1 a special listmode is
	activated where only information about the certificate is printed
	to LISTFP and no output is send to the usual log stream. If
	CHECKTIME_ARG is set, it is used only in the chain model instead of the
	current time.

	Defined flag bits

	VALIDATE_FLAG_NO_DIRMNGR - Do not do any dirmngr isvalid checks.
	VALIDATE_FLAG_CHAIN_MODEL - Check according to chain model.
	VALIDATE_FLAG_STEED - Check according to the STEED model.
	*/
	static int
	do_validate_chain (ctrl_t ctrl, ksba_cert_t cert, ksba_isotime_t checktime_arg,
	ksba_isotime_t r_exptime,
	int listmode, estream_t listfp, unsigned int flags,
	struct rootca_flags_s *rootca_flags)
	{
	int rc = 0, depth, maxdepth;
	char *issuer = NULL;
	char *subject = NULL;
	KEYDB_HANDLE kh = NULL;
	ksba_cert_t subject_cert = NULL, issuer_cert = NULL;
	ksba_isotime_t current_time;
	ksba_isotime_t check_time;
	ksba_isotime_t exptime;
	int any_expired = 0;
	int any_revoked = 0;
	int any_no_crl = 0;
	int any_crl_too_old = 0;
	int any_no_policy_match = 0;
	int is_qualified = -1; /* Indicates whether the certificate stems
	from a qualified root certificate.
	-1 = unknown, 0 = no, 1 = yes. */
	chain_item_t chain = NULL; /* A list of all certificates in the chain. */


	gnupg_get_isotime (current_time);

	if ( (flags & VALIDATE_FLAG_CHAIN_MODEL) )
	{
	if (!strcmp (checktime_arg, "19700101T000000"))
	{
	do_list (1, listmode, listfp,
	_("WARNING: creation time of signature not known - "
	"assuming current time"));
	gnupg_copy_time (check_time, current_time);
	}
	else
	gnupg_copy_time (check_time, checktime_arg);
	}
	else
	*check_time = 0;

	if (r_exptime)
	*r_exptime = 0;
	*exptime = 0;

	if (opt.no_chain_validation && !listmode)
	{
	log_info ("WARNING: bypassing certificate chain validation\n");
	return 0;
	}

	kh = keydb_new ();
	if (!kh)
	{
	log_error (_("failed to allocate keyDB handle\n"));
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	if (DBG_X509 && !listmode)
	gpgsm_dump_cert ("target", cert);

	subject_cert = cert;
	ksba_cert_ref (subject_cert);
	maxdepth = 50;
	depth = 0;

	for (;;)
	{
	int is_root;
	gpg_error_t istrusted_rc = -1;

	/* Put the certificate on our list. */
	{
	chain_item_t ci;

	ci = xtrycalloc (1, sizeof *ci);
	if (!ci)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	ksba_cert_ref (subject_cert);
	ci->cert = subject_cert;
	ci->next = chain;
	chain = ci;
	}

	xfree (issuer);
	xfree (subject);
	issuer = ksba_cert_get_issuer (subject_cert, 0);
	subject = ksba_cert_get_subject (subject_cert, 0);

	if (!issuer)
	{
	do_list (1, listmode, listfp, _("no issuer found in certificate"));
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}


	/* Is this a self-issued certificate (i.e. the root certificate)? */
	is_root = is_root_cert (subject_cert, issuer, subject);
	if (is_root)
	{
	chain->is_root = 1;
	/* Check early whether the certificate is listed as trusted.
	We used to do this only later but changed it to call the
	check right here so that we can access special flags
	associated with that specific root certificate. */
	if (gpgsm_cert_has_well_known_private_key (subject_cert))
	{
	memset (rootca_flags, 0, sizeof *rootca_flags);
	istrusted_rc = ((flags & VALIDATE_FLAG_STEED)
	? 0 : gpg_error (GPG_ERR_NOT_TRUSTED));
	}
	else
	istrusted_rc = gpgsm_agent_istrusted (ctrl, subject_cert, NULL,
	rootca_flags);
	audit_log_cert (ctrl->audit, AUDIT_ROOT_TRUSTED,
	subject_cert, istrusted_rc);
	/* If the chain model extended attribute is used, make sure
	that our chain model flag is set. */
	if (!(flags & VALIDATE_FLAG_STEED)
	&& has_validation_model_chain (subject_cert, listmode, listfp))
	rootca_flags->chain_model = 1;
	}


	/* Check the validity period. */
	if ( (flags & VALIDATE_FLAG_CHAIN_MODEL) )
	rc = check_validity_period_cm (current_time, check_time, subject_cert,
	exptime, listmode, listfp,
	(depth && is_root)? -1: depth);
	else
	rc = check_validity_period (current_time, subject_cert,
	exptime, listmode, listfp,
	(depth && is_root)? -1: depth);
	if (gpg_err_code (rc) == GPG_ERR_CERT_EXPIRED)
	any_expired = 1;
	else if (rc)
	goto leave;


	/* Assert that we understand all critical extensions. */
	rc = unknown_criticals (subject_cert, listmode, listfp);
	if (rc)
	goto leave;

	/* Do a policy check. */
	if (!opt.no_policy_check)
	{
	rc = check_cert_policy (subject_cert, listmode, listfp);
	if (gpg_err_code (rc) == GPG_ERR_NO_POLICY_MATCH)
	{
	any_no_policy_match = 1;
	rc = 1; /* Be on the safe side and set RC. */
	}
	else if (rc)
	goto leave;
	}


	/* If this is the root certificate we are at the end of the chain. */
	if (is_root)
	{
	if (!istrusted_rc)
	; /* No need to check the certificate for a trusted one. */
	else if (gpgsm_check_cert_sig (subject_cert, subject_cert) )
	{
	/* We only check the signature if the certificate is not
	trusted for better diagnostics. */
	do_list (1, listmode, listfp,
	_("self-signed certificate has a BAD signature"));
	if (DBG_X509)
	{
	gpgsm_dump_cert ("self-signing cert", subject_cert);
	}
	rc = gpg_error (depth? GPG_ERR_BAD_CERT_CHAIN
	: GPG_ERR_BAD_CERT);
	goto leave;
	}
	if (!rootca_flags->relax)
	{
	rc = allowed_ca (ctrl, subject_cert, NULL, listmode, listfp);
	if (rc)
	goto leave;
	}


	/* Set the flag for qualified signatures. This flag is
	deduced from a list of root certificates allowed for
	qualified signatures. */
	if (is_qualified == -1 && !(flags & VALIDATE_FLAG_STEED))
	{
	gpg_error_t err;
	size_t buflen;
	char buf[1];

	if (!ksba_cert_get_user_data (cert, "is_qualified",
	&buf, sizeof (buf),
	&buflen) && buflen)
	{
	/* We already checked this for this certificate,
	thus we simply take it from the user data. */
	is_qualified = !!*buf;
	}
	else
	{
	/* Need to consult the list of root certificates for
	qualified signatures. */
	err = gpgsm_is_in_qualified_list (ctrl, subject_cert, NULL);
	if (!err)
	is_qualified = 1;
	else if ( gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	is_qualified = 0;
	else
	log_error ("checking the list of qualified "
	"root certificates failed: %s\n",
	gpg_strerror (err));
	if ( is_qualified != -1 )
	{
	/* Cache the result but don't care too much
	about an error. */
	buf[0] = !!is_qualified;
	err = ksba_cert_set_user_data (subject_cert,
	"is_qualified", buf, 1);
	if (err)
	log_error ("set_user_data(is_qualified) failed: %s\n",
	gpg_strerror (err));
	}
	}
	}


	/* Act on the check for a trusted root certificates. */
	rc = istrusted_rc;
	if (!rc)
	;
	else if (gpg_err_code (rc) == GPG_ERR_NOT_TRUSTED)
	{
	do_list (0, listmode, listfp,
	_("root certificate is not marked trusted"));
	/* If we already figured out that the certificate is
	expired it does not make much sense to ask the user
	whether we wants to trust the root certificate. We
	should do this only if the certificate under question
	will then be usable. If the certificate has a well
	known private key asking the user does not make any
	sense. */
	if ( !any_expired
	&& !gpgsm_cert_has_well_known_private_key (subject_cert)
	&& (!listmode \|\| !already_asked_marktrusted (subject_cert))
	&& ask_marktrusted (ctrl, subject_cert, listmode) )
	rc = 0;
	}
	else
	{
	log_error (_("checking the trust list failed: %s\n"),
	gpg_strerror (rc));
	}

	if (rc)
	goto leave;

	/* Check for revocations etc. */
	if ((flags & VALIDATE_FLAG_NO_DIRMNGR))
	;
	else if ((flags & VALIDATE_FLAG_STEED))
	; /* Fixme: check revocations via DNS. */
	else if (opt.no_trusted_cert_crl_check \|\| rootca_flags->relax)
	;
	else
	rc = is_cert_still_valid (ctrl,
	(flags & VALIDATE_FLAG_CHAIN_MODEL),
	listmode, listfp,
	subject_cert, subject_cert,
	&any_revoked, &any_no_crl,
	&any_crl_too_old);
	if (rc)
	goto leave;

	break; /* Okay: a self-signed certicate is an end-point. */
	} /* End is_root. */


	/* Take care that the chain does not get too long. */
	if ((depth+1) > maxdepth)
	{
	do_list (1, listmode, listfp, _("certificate chain too long\n"));
	rc = gpg_error (GPG_ERR_BAD_CERT_CHAIN);
	goto leave;
	}

	/* Find the next cert up the tree. */
	keydb_search_reset (kh);
	rc = find_up (ctrl, kh, subject_cert, issuer, 0);
	if (rc)
	{
	if (rc == -1)
	{
	do_list (0, listmode, listfp, _("issuer certificate not found"));
	if (!listmode)
	{
	log_info ("issuer certificate: #/");
	gpgsm_dump_string (issuer);
	log_printf ("\n");
	}
	}
	else
	log_error ("failed to find issuer's certificate: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_MISSING_ISSUER_CERT);
	goto leave;
	}

	ksba_cert_release (issuer_cert); issuer_cert = NULL;
	rc = keydb_get_cert (kh, &issuer_cert);
	if (rc)
	{
	log_error ("keydb_get_cert() failed: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	try_another_cert:
	if (DBG_X509)
	{
	log_debug ("got issuer's certificate:\n");
	gpgsm_dump_cert ("issuer", issuer_cert);
	}

	rc = gpgsm_check_cert_sig (issuer_cert, subject_cert);
	if (rc)
	{
	do_list (0, listmode, listfp, _("certificate has a BAD signature"));
	if (DBG_X509)
	{
	gpgsm_dump_cert ("signing issuer", issuer_cert);
	gpgsm_dump_cert ("signed subject", subject_cert);
	}
	if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
	{
	/* We now try to find other issuer certificates which
	might have been used. This is required because some
	CAs are reusing the issuer and subject DN for new
	root certificates. */
	/* FIXME: Do this only if we don't have an
	AKI.keyIdentifier */
	rc = find_up (ctrl, kh, subject_cert, issuer, 1);
	if (!rc)
	{
	ksba_cert_t tmp_cert;

	rc = keydb_get_cert (kh, &tmp_cert);
	if (rc \|\| !compare_certs (issuer_cert, tmp_cert))
	{
	/* The find next did not work or returned an
	identical certificate. We better stop here
	to avoid infinite checks. */
	/* No need to set RC because it is not used:
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE); */
	ksba_cert_release (tmp_cert);
	}
	else
	{
	do_list (0, listmode, listfp,
	_("found another possible matching "
	"CA certificate - trying again"));
	ksba_cert_release (issuer_cert);
	issuer_cert = tmp_cert;
	goto try_another_cert;
	}
	}
	}

	/* We give a more descriptive error code than the one
	returned from the signature checking. */
	rc = gpg_error (GPG_ERR_BAD_CERT_CHAIN);
	goto leave;
	}

	is_root = gpgsm_is_root_cert (issuer_cert);
	istrusted_rc = -1;


	/* Check that a CA is allowed to issue certificates. */
	{
	int chainlen;

	rc = allowed_ca (ctrl, issuer_cert, &chainlen, listmode, listfp);
	if (rc)
	{
	/* Not allowed. Check whether this is a trusted root
	certificate and whether we allow special exceptions.
	We could carry the result of the test over to the
	regular root check at the top of the loop but for
	clarity we won't do that. Given that the majority of
	certificates carry proper BasicContraints our way of
	overriding an error in the way is justified for
	performance reasons. */
	if (is_root)
	{
	if (gpgsm_cert_has_well_known_private_key (issuer_cert))
	{
	memset (rootca_flags, 0, sizeof *rootca_flags);
	istrusted_rc = ((flags & VALIDATE_FLAG_STEED)
	? 0 : gpg_error (GPG_ERR_NOT_TRUSTED));
	}
	else
	istrusted_rc = gpgsm_agent_istrusted
	(ctrl, issuer_cert, NULL, rootca_flags);

	if (!istrusted_rc && rootca_flags->relax)
	{
	/* Ignore the error due to the relax flag. */
	rc = 0;
	chainlen = -1;
	}
	}
	}
	if (rc)
	goto leave;
	if (chainlen >= 0 && depth > chainlen)
	{
	do_list (1, listmode, listfp,
	_("certificate chain longer than allowed by CA (%d)"),
	chainlen);
	rc = gpg_error (GPG_ERR_BAD_CERT_CHAIN);
	goto leave;
	}
	}

	/* Is the certificate allowed to sign other certificates. */
	if (!listmode)
	{
	rc = gpgsm_cert_use_cert_p (issuer_cert);
	if (rc)
	{
	char numbuf[50];
	sprintf (numbuf, "%d", rc);
	gpgsm_status2 (ctrl, STATUS_ERROR, "certcert.issuer.keyusage",
	numbuf, NULL);
	goto leave;
	}
	}

	/* Check for revocations etc. Note that for a root certificate
	this test is done a second time later. This should eventually
	be fixed. */
	if ((flags & VALIDATE_FLAG_NO_DIRMNGR))
	rc = 0;
	else if ((flags & VALIDATE_FLAG_STEED))
	rc = 0; /* Fixme: XXX */
	else if (is_root && (opt.no_trusted_cert_crl_check
	\|\| (!istrusted_rc && rootca_flags->relax)))
	rc = 0;
	else
	rc = is_cert_still_valid (ctrl,
	(flags & VALIDATE_FLAG_CHAIN_MODEL),
	listmode, listfp,
	subject_cert, issuer_cert,
	&any_revoked, &any_no_crl, &any_crl_too_old);
	if (rc)
	goto leave;


	if (opt.verbose && !listmode)
	log_info (depth == 0 ? _("certificate is good\n") :
	!is_root ? _("intermediate certificate is good\n") :
	/* other */ _("root certificate is good\n"));

	/* Under the chain model the next check time is the creation
	time of the subject certificate. */
	if ( (flags & VALIDATE_FLAG_CHAIN_MODEL) )
	{
	rc = ksba_cert_get_validity (subject_cert, 0, check_time);
	if (rc)
	{
	/* That will never happen as we have already checked
	this above. */
	BUG ();
	}
	}

	/* For the next round the current issuer becomes the new subject. */
	keydb_search_reset (kh);
	ksba_cert_release (subject_cert);
	subject_cert = issuer_cert;
	issuer_cert = NULL;
	depth++;
	} /* End chain traversal. */

	if (!listmode && !opt.quiet)
	{
	if (opt.no_policy_check)
	log_info ("policies not checked due to %s option\n",
	"--disable-policy-checks");
	if (ctrl->offline \|\| (opt.no_crl_check && !ctrl->use_ocsp))
	log_info ("CRLs not checked due to %s option\n",
	ctrl->offline ? "offline" : "--disable-crl-checks");
	}

	if (!rc)
	{ /* If we encountered an error somewhere during the checks, set
	the error code to the most critical one */
	if (any_revoked)
	rc = gpg_error (GPG_ERR_CERT_REVOKED);
	else if (any_expired)
	rc = gpg_error (GPG_ERR_CERT_EXPIRED);
	else if (any_no_crl)
	rc = gpg_error (GPG_ERR_NO_CRL_KNOWN);
	else if (any_crl_too_old)
	rc = gpg_error (GPG_ERR_CRL_TOO_OLD);
	else if (any_no_policy_match)
	rc = gpg_error (GPG_ERR_NO_POLICY_MATCH);
	}

	leave:
	/* If we have traversed a complete chain up to the root we will
	reset the ephemeral flag for all these certificates. This is done
	regardless of any error because those errors may only be
	transient. */
	if (chain && chain->is_root)
	{
	gpg_error_t err;
	chain_item_t ci;

	for (ci = chain; ci; ci = ci->next)
	{
	/* Note that it is possible for the last certificate in the
	chain (i.e. our target certificate) that it has not yet
	been stored in the keybox and thus the flag can't be set.
	We ignore this error because it will later be stored
	anyway. */
	err = keydb_set_cert_flags (ctrl, ci->cert, 1, KEYBOX_FLAG_BLOB, 0,
	KEYBOX_FLAG_BLOB_EPHEMERAL, 0);
	if (!ci->next && gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	;
	else if (err)
	log_error ("clearing ephemeral flag failed: %s\n",
	gpg_strerror (err));
	}
	}

	/* If we have figured something about the qualified signature
	capability of the certificate under question, store the result as
	user data in all certificates of the chain. We do this even if the
	validation itself failed. */
	if (is_qualified != -1 && !(flags & VALIDATE_FLAG_STEED))
	{
	gpg_error_t err;
	chain_item_t ci;
	char buf[1];

	buf[0] = !!is_qualified;

	for (ci = chain; ci; ci = ci->next)
	{
	err = ksba_cert_set_user_data (ci->cert, "is_qualified", buf, 1);
	if (err)
	{
	log_error ("set_user_data(is_qualified) failed: %s\n",
	gpg_strerror (err));
	if (!rc)
	rc = err;
	}
	}
	}

	/* If auditing has been enabled, record what is in the chain. */
	if (ctrl->audit)
	{
	chain_item_t ci;

	audit_log (ctrl->audit, AUDIT_CHAIN_BEGIN);
	for (ci = chain; ci; ci = ci->next)
	{
	audit_log_cert (ctrl->audit,
	ci->is_root? AUDIT_CHAIN_ROOTCERT : AUDIT_CHAIN_CERT,
	ci->cert, 0);
	}
	audit_log (ctrl->audit, AUDIT_CHAIN_END);
	}

	if (r_exptime)
	gnupg_copy_time (r_exptime, exptime);
	xfree (issuer);
	xfree (subject);
	keydb_release (kh);
	while (chain)
	{
	chain_item_t ci_next = chain->next;
	ksba_cert_release (chain->cert);
	xfree (chain);
	chain = ci_next;
	}
	ksba_cert_release (issuer_cert);
	ksba_cert_release (subject_cert);
	return rc;
	}


	/* Validate a certificate chain. For a description see
	do_validate_chain. This function is a wrapper to handle a root
	certificate with the chain_model flag set. If RETFLAGS is not
	NULL, flags indicating now the verification was done are stored
	there. The only defined vits for RETFLAGS are
	VALIDATE_FLAG_CHAIN_MODEL and VALIDATE_FLAG_STEED.

	If you are verifying a signature you should set CHECKTIME to the
	creation time of the signature. If your are verifying a
	certificate, set it nil (i.e. the empty string). If the creation
	date of the signature is not known use the special date
	"19700101T000000" which is treated in a special way here. */
	int
	gpgsm_validate_chain (ctrl_t ctrl, ksba_cert_t cert, ksba_isotime_t checktime,
	ksba_isotime_t r_exptime,
	int listmode, estream_t listfp, unsigned int flags,
	unsigned int *retflags)
	{
	int rc;
	struct rootca_flags_s rootca_flags;
	unsigned int dummy_retflags;

	if (!retflags)
	retflags = &dummy_retflags;

	/* If the session requested a certain validation mode make sure the
	corresponding flags are set. */
	if (ctrl->validation_model == 1)
	flags \|= VALIDATE_FLAG_CHAIN_MODEL;
	else if (ctrl->validation_model == 2)
	flags \|= VALIDATE_FLAG_STEED;

	/* If the chain model was forced, set this immediately into
	RETFLAGS. */
	*retflags = (flags & VALIDATE_FLAG_CHAIN_MODEL);

	memset (&rootca_flags, 0, sizeof rootca_flags);

	rc = do_validate_chain (ctrl, cert, checktime,
	r_exptime, listmode, listfp, flags,
	&rootca_flags);
	if (!rc && (flags & VALIDATE_FLAG_STEED))
	{
	*retflags \|= VALIDATE_FLAG_STEED;
	}
	else if (gpg_err_code (rc) == GPG_ERR_CERT_EXPIRED
	&& !(flags & VALIDATE_FLAG_CHAIN_MODEL)
	&& (rootca_flags.valid && rootca_flags.chain_model))
	{
	do_list (0, listmode, listfp, _("switching to chain model"));
	rc = do_validate_chain (ctrl, cert, checktime,
	r_exptime, listmode, listfp,
	(flags \|= VALIDATE_FLAG_CHAIN_MODEL),
	&rootca_flags);
	*retflags \|= VALIDATE_FLAG_CHAIN_MODEL;
	}

	if (opt.verbose)
	do_list (0, listmode, listfp, _("validation model used: %s"),
	(*retflags & VALIDATE_FLAG_STEED)?
	"steed" :
	(*retflags & VALIDATE_FLAG_CHAIN_MODEL)?
	_("chain"):_("shell"));

	return rc;
	}


	/* Check that the given certificate is valid but DO NOT check any
	constraints. We assume that the issuers certificate is already in
	the DB and that this one is valid; which it should be because it
	has been checked using this function. */
	int
	gpgsm_basic_cert_check (ctrl_t ctrl, ksba_cert_t cert)
	{
	int rc = 0;
	char *issuer = NULL;
	char *subject = NULL;
	KEYDB_HANDLE kh;
	ksba_cert_t issuer_cert = NULL;

	if (opt.no_chain_validation)
	{
	log_info ("WARNING: bypassing basic certificate checks\n");
	return 0;
	}

	kh = keydb_new ();
	if (!kh)
	{
	log_error (_("failed to allocate keyDB handle\n"));
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	issuer = ksba_cert_get_issuer (cert, 0);
	subject = ksba_cert_get_subject (cert, 0);
	if (!issuer)
	{
	log_error ("no issuer found in certificate\n");
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}

	if (is_root_cert (cert, issuer, subject))
	{
	rc = gpgsm_check_cert_sig (cert, cert);
	if (rc)
	{
	log_error ("self-signed certificate has a BAD signature: %s\n",
	gpg_strerror (rc));
	if (DBG_X509)
	{
	gpgsm_dump_cert ("self-signing cert", cert);
	}
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}
	}
	else
	{
	/* Find the next cert up the tree. */
	keydb_search_reset (kh);
	rc = find_up (ctrl, kh, cert, issuer, 0);
	if (rc)
	{
	if (rc == -1)
	{
	log_info ("issuer certificate (#/");
	gpgsm_dump_string (issuer);
	log_printf (") not found\n");
	}
	else
	log_error ("failed to find issuer's certificate: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_MISSING_ISSUER_CERT);
	goto leave;
	}

	ksba_cert_release (issuer_cert); issuer_cert = NULL;
	rc = keydb_get_cert (kh, &issuer_cert);
	if (rc)
	{
	log_error ("keydb_get_cert() failed: rc=%d\n", rc);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	rc = gpgsm_check_cert_sig (issuer_cert, cert);
	if (rc)
	{
	log_error ("certificate has a BAD signature: %s\n",
	gpg_strerror (rc));
	if (DBG_X509)
	{
	gpgsm_dump_cert ("signing issuer", issuer_cert);
	gpgsm_dump_cert ("signed subject", cert);
	}
	rc = gpg_error (GPG_ERR_BAD_CERT);
	goto leave;
	}
	if (opt.verbose)
	log_info (_("certificate is good\n"));
	}

	leave:
	xfree (issuer);
	xfree (subject);
	keydb_release (kh);
	ksba_cert_release (issuer_cert);
	return rc;
	}



	/* Check whether the certificate CERT has been issued by the German
	authority for qualified signature. They do not set the
	basicConstraints and thus we need this workaround. It works by
	looking up the root certificate and checking whether that one is
	listed as a qualified certificate for Germany.

	We also try to cache this data but as long as don't keep a
	reference to the certificate this won't be used.

	Returns: True if CERT is a RegTP issued CA cert (i.e. the root
	certificate itself or one of the CAs). In that case CHAINLEN will
	receive the length of the chain which is either 0 or 1.
	*/
	static int
	get_regtp_ca_info (ctrl_t ctrl, ksba_cert_t cert, int *chainlen)
	{
	gpg_error_t err;
	ksba_cert_t next;
	int rc = 0;
	int i, depth;
	char country[3];
	ksba_cert_t array[4];
	char buf[2];
	size_t buflen;
	int dummy_chainlen;

	if (!chainlen)
	chainlen = &dummy_chainlen;

	*chainlen = 0;
	err = ksba_cert_get_user_data (cert, "regtp_ca_chainlen",
	&buf, sizeof (buf), &buflen);
	if (!err)
	{
	/* Got info. */
	if (buflen < 2 \|\| !*buf)
	return 0; /* Nothing found. */
	*chainlen = buf[1];
	return 1; /* This is a regtp CA. */
	}
	else if (gpg_err_code (err) != GPG_ERR_NOT_FOUND)
	{
	log_error ("ksba_cert_get_user_data(%s) failed: %s\n",
	"regtp_ca_chainlen", gpg_strerror (err));
	return 0; /* Nothing found. */
	}

	/* Need to gather the info. This requires to walk up the chain
	until we have found the root. Because we are only interested in
	German Bundesnetzagentur (former RegTP) derived certificates 3
	levels are enough. (The German signature law demands a 3 tier
	hierarchy; thus there is only one CA between the EE and the Root
	CA.) */
	memset (&array, 0, sizeof array);

	depth = 0;
	ksba_cert_ref (cert);
	array[depth++] = cert;
	ksba_cert_ref (cert);
	while (depth < DIM(array) && !(rc=gpgsm_walk_cert_chain (ctrl, cert, &next)))
	{
	ksba_cert_release (cert);
	ksba_cert_ref (next);
	array[depth++] = next;
	cert = next;
	}
	ksba_cert_release (cert);
	if (rc != -1 \|\| !depth \|\| depth == DIM(array) )
	{
	/* We did not reached the root. */
	goto leave;
	}

	/* If this is a German signature law issued certificate, we store
	- additional additional information. */
	+ additional information. */
	if (!gpgsm_is_in_qualified_list (NULL, array[depth-1], country)
	&& !strcmp (country, "de"))
	{
	/* Setting the pathlen for the root CA and the CA flag for the
	next one is all what we need to do. */
	err = ksba_cert_set_user_data (array[depth-1], "regtp_ca_chainlen",
	"\x01\x01", 2);
	if (!err && depth > 1)
	err = ksba_cert_set_user_data (array[depth-2], "regtp_ca_chainlen",
	"\x01\x00", 2);
	if (err)
	log_error ("ksba_set_user_data(%s) failed: %s\n",
	"regtp_ca_chainlen", gpg_strerror (err));
	for (i=0; i < depth; i++)
	ksba_cert_release (array[i]);
	*chainlen = (depth>1? 0:1);
	return 1;
	}

	leave:
	/* Nothing special with this certificate. Mark the target
	certificate anyway to avoid duplicate lookups. */
	err = ksba_cert_set_user_data (cert, "regtp_ca_chainlen", "", 1);
	if (err)
	log_error ("ksba_set_user_data(%s) failed: %s\n",
	"regtp_ca_chainlen", gpg_strerror (err));
	for (i=0; i < depth; i++)
	ksba_cert_release (array[i]);
	return 0;
	}
	diff --git a/sm/certdump.c b/sm/certdump.c
	index bd7c6c3be..bd37da406 100644
	--- a/sm/certdump.c
	+++ b/sm/certdump.c
	@@ -1,858 +1,858 @@
	/* certdump.c - Dump a certificate for debugging
	* Copyright (C) 2001-2010, 2014-2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#include <assert.h>
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif
	#ifdef HAVE_LANGINFO_CODESET
	#include <langinfo.h>
	#endif

	#include "gpgsm.h"
	#include <gcrypt.h>
	#include <ksba.h>

	#include "keydb.h"
	#include "i18n.h"


	struct dn_array_s {
	char *key;
	char *value;
	int multivalued;
	int done;
	};


	/* Print the first element of an S-Expression. */
	void
	gpgsm_print_serial (estream_t fp, ksba_const_sexp_t sn)
	{
	const char p = (const char )sn;
	unsigned long n;
	char *endp;

	if (!p)
	es_fputs (_("none"), fp);
	else if (*p != '(')
	es_fputs ("[Internal error - not an S-expression]", fp);
	else
	{
	p++;
	n = strtoul (p, &endp, 10);
	p = endp;
	if (*p++ != ':')
	es_fputs ("[Internal Error - invalid S-expression]", fp);
	else
	es_write_hexstring (fp, p, n, 0, NULL);
	}
	}


	/* Dump the serial number or any other simple S-expression. */
	void
	gpgsm_dump_serial (ksba_const_sexp_t sn)
	{
	const char p = (const char )sn;
	unsigned long n;
	char *endp;

	if (!p)
	log_printf ("none");
	else if (*p != '(')
	log_printf ("ERROR - not an S-expression");
	else
	{
	p++;
	n = strtoul (p, &endp, 10);
	p = endp;
	if (*p!=':')
	log_printf ("ERROR - invalid S-expression");
	else
	{
	for (p++; n; n--, p++)
	log_printf ("%02X", (const unsigned char )p);
	}
	}
	}


	char *
	gpgsm_format_serial (ksba_const_sexp_t sn)
	{
	const char p = (const char )sn;
	unsigned long n;
	char *endp;
	char *buffer;
	int i;

	if (!p)
	return NULL;

	if (*p != '(')
	BUG (); /* Not a valid S-expression. */

	p++;
	n = strtoul (p, &endp, 10);
	p = endp;
	if (*p!=':')
	BUG (); /* Not a valid S-expression. */
	p++;

	buffer = xtrymalloc (n*2+1);
	if (buffer)
	{
	for (i=0; n; n--, p++, i+=2)
	sprintf (buffer+i, "%02X", (unsigned char )p);
	buffer[i] = 0;
	}
	return buffer;
	}




	void
	gpgsm_print_time (estream_t fp, ksba_isotime_t t)
	{
	if (!t \|\| !*t)
	es_fputs (_("none"), fp);
	else
	es_fprintf (fp, "%.4s-%.2s-%.2s %.2s:%.2s:%s",
	t, t+4, t+6, t+9, t+11, t+13);
	}


	void
	gpgsm_dump_string (const char *string)
	{

	if (!string)
	log_printf ("[error]");
	else
	{
	const unsigned char *s;

	for (s=(const unsigned char)string; s; s++)
	{
	if (s < ' ' \|\| (s >= 0x7f && *s <= 0xa0))
	break;
	}
	if (!s && string != '[')
	log_printf ("%s", string);
	else
	{
	log_printf ( "[ ");
	log_printhex (NULL, string, strlen (string));
	log_printf ( " ]");
	}
	}
	}


	/* This simple dump function is mainly used for debugging purposes. */
	void
	gpgsm_dump_cert (const char *text, ksba_cert_t cert)
	{
	ksba_sexp_t sexp;
	char *p;
	char *dn;
	ksba_isotime_t t;

	log_debug ("BEGIN Certificate '%s':\n", text? text:"");
	if (cert)
	{
	sexp = ksba_cert_get_serial (cert);
	log_debug (" serial: ");
	gpgsm_dump_serial (sexp);
	ksba_free (sexp);
	log_printf ("\n");

	ksba_cert_get_validity (cert, 0, t);
	log_debug (" notBefore: ");
	dump_isotime (t);
	log_printf ("\n");
	ksba_cert_get_validity (cert, 1, t);
	log_debug (" notAfter: ");
	dump_isotime (t);
	log_printf ("\n");

	dn = ksba_cert_get_issuer (cert, 0);
	log_debug (" issuer: ");
	gpgsm_dump_string (dn);
	ksba_free (dn);
	log_printf ("\n");

	dn = ksba_cert_get_subject (cert, 0);
	log_debug (" subject: ");
	gpgsm_dump_string (dn);
	ksba_free (dn);
	log_printf ("\n");

	log_debug (" hash algo: %s\n", ksba_cert_get_digest_algo (cert));

	p = gpgsm_get_fingerprint_string (cert, 0);
	log_debug (" SHA1 Fingerprint: %s\n", p);
	xfree (p);
	}
	log_debug ("END Certificate\n");
	}


	/* Return a new string holding the format serial number and issuer
	("#SN/issuer"). No filtering on invalid characters is done.
	Caller must release the string. On memory failure NULL is
	returned. */
	char *
	gpgsm_format_sn_issuer (ksba_sexp_t sn, const char *issuer)
	{
	char p, p1;

	if (sn && issuer)
	{
	p1 = gpgsm_format_serial (sn);
	if (!p1)
	p = xtrystrdup ("[invalid SN]");
	else
	{
	p = xtrymalloc (strlen (p1) + strlen (issuer) + 2 + 1);
	if (p)
	{
	*p = '#';
	strcpy (stpcpy (stpcpy (p+1, p1),"/"), issuer);
	}
	xfree (p1);
	}
	}
	else
	p = xtrystrdup ("[invalid SN/issuer]");
	return p;
	}


	/* Log the certificate's name in "#SN/ISSUERDN" format along with
	TEXT. */
	void
	gpgsm_cert_log_name (const char *text, ksba_cert_t cert)
	{
	log_info ("%s", text? text:"certificate" );
	if (cert)
	{
	ksba_sexp_t sn;
	char *p;

	p = ksba_cert_get_issuer (cert, 0);
	sn = ksba_cert_get_serial (cert);
	if (p && sn)
	{
	log_printf (" #");
	gpgsm_dump_serial (sn);
	log_printf ("/");
	gpgsm_dump_string (p);
	}
	else
	log_printf (" [invalid]");
	ksba_free (sn);
	xfree (p);
	}
	log_printf ("\n");
	}






	/* helper for the rfc2253 string parser */
	static const unsigned char *
	parse_dn_part (struct dn_array_s array, const unsigned char string)
	{
	static struct {
	const char *label;
	const char *oid;
	} label_map[] = {
	/* Warning: When adding new labels, make sure that the buffer
	below we be allocated large enough. */
	{"EMail", "1.2.840.113549.1.9.1" },
	{"T", "2.5.4.12" },
	{"GN", "2.5.4.42" },
	{"SN", "2.5.4.4" },
	{"NameDistinguisher", "0.2.262.1.10.7.20"},
	{"ADDR", "2.5.4.16" },
	{"BC", "2.5.4.15" },
	{"D", "2.5.4.13" },
	{"PostalCode", "2.5.4.17" },
	{"Pseudo", "2.5.4.65" },
	{"SerialNumber", "2.5.4.5" },
	{NULL, NULL}
	};
	const unsigned char s, s1;
	size_t n;
	char *p;
	int i;

	/* Parse attributeType */
	for (s = string+1; s && s != '='; s++)
	;
	if (!*s)
	return NULL; /* error */
	n = s - string;
	if (!n)
	return NULL; /* empty key */

	/* We need to allocate a few bytes more due to the possible mapping
	from the shorter OID to the longer label. */
	array->key = p = xtrymalloc (n+10);
	if (!array->key)
	return NULL;
	memcpy (p, string, n);
	p[n] = 0;
	trim_trailing_spaces (p);

	if (digitp (p))
	{
	for (i=0; label_map[i].label; i++ )
	if ( !strcmp (p, label_map[i].oid) )
	{
	strcpy (p, label_map[i].label);
	break;
	}
	}
	string = s + 1;

	if (*string == '#')
	{ /* hexstring */
	string++;
	for (s=string; hexdigitp (s); s++)
	s++;
	n = s - string;
	if (!n \|\| (n & 1))
	return NULL; /* Empty or odd number of digits. */
	n /= 2;
	array->value = p = xtrymalloc (n+1);
	if (!p)
	return NULL;
	for (s1=string; n; s1 += 2, n--, p++)
	{
	(unsigned char )p = xtoi_2 (s1);
	if (!*p)
	p = 0x01; / Better print a wrong value than truncating
	the string. */
	}
	*p = 0;
	}
	else
	{ /* regular v3 quoted string */
	for (n=0, s=string; *s; s++)
	{
	if (*s == '\\')
	{ /* pair */
	s++;
	if (s == ',' \|\| s == '=' \|\| *s == '+'
	\|\| s == '<' \|\| s == '>' \|\| s == '#' \|\| s == ';'
	\|\| s == '\\' \|\| s == '\"' \|\| *s == ' ')
	n++;
	else if (hexdigitp (s) && hexdigitp (s+1))
	{
	s++;
	n++;
	}
	else
	return NULL; /* invalid escape sequence */
	}
	else if (*s == '\"')
	return NULL; /* invalid encoding */
	else if (s == ',' \|\| s == '=' \|\| *s == '+'
	\|\| s == '<' \|\| s == '>' \|\| *s == ';' )
	break;
	else
	n++;
	}

	array->value = p = xtrymalloc (n+1);
	if (!p)
	return NULL;
	for (s=string; n; s++, n--)
	{
	if (*s == '\\')
	{
	s++;
	if (hexdigitp (s))
	{
	(unsigned char )p++ = xtoi_2 (s);
	s++;
	}
	else
	p++ = s;
	}
	else
	p++ = s;
	}
	*p = 0;
	}
	return s;
	}


	/* Parse a DN and return an array-ized one. This is not a validating
	parser and it does not support any old-stylish syntax; KSBA is
	expected to return only rfc2253 compatible strings. */
	static struct dn_array_s *
	parse_dn (const unsigned char *string)
	{
	struct dn_array_s *array;
	size_t arrayidx, arraysize;
	int i;

	arraysize = 7; /* C,ST,L,O,OU,CN,email */
	arrayidx = 0;
	array = xtrymalloc ((arraysize+1) * sizeof *array);
	if (!array)
	return NULL;
	while (*string)
	{
	while (*string == ' ')
	string++;
	if (!*string)
	break; /* ready */
	if (arrayidx >= arraysize)
	{
	struct dn_array_s *a2;

	arraysize += 5;
	a2 = xtryrealloc (array, (arraysize+1) * sizeof *array);
	if (!a2)
	goto failure;
	array = a2;
	}
	array[arrayidx].key = NULL;
	array[arrayidx].value = NULL;
	string = parse_dn_part (array+arrayidx, string);
	if (!string)
	goto failure;
	while (*string == ' ')
	string++;
	array[arrayidx].multivalued = (*string == '+');
	array[arrayidx].done = 0;
	arrayidx++;
	if (string && string != ',' && string != ';' && string != '+')
	goto failure; /* invalid delimiter */
	if (*string)
	string++;
	}
	array[arrayidx].key = NULL;
	array[arrayidx].value = NULL;
	return array;

	failure:
	for (i=0; i < arrayidx; i++)
	{
	xfree (array[i].key);
	xfree (array[i].value);
	}
	xfree (array);
	return NULL;
	}


	/* Print a DN part to STREAM. */
	static void
	print_dn_part (estream_t stream,
	struct dn_array_s dn, const char key, int translate)
	{
	struct dn_array_s *first_dn = dn;

	for (; dn->key; dn++)
	{
	if (!dn->done && !strcmp (dn->key, key))
	{
	/* Forward to the last multi-valued RDN, so that we can
	print them all in reverse in the correct order. Note
	- that this overrides the the standard sequence but that
	+ that this overrides the standard sequence but that
	seems to a reasonable thing to do with multi-valued
	RDNs. */
	while (dn->multivalued && dn[1].key)
	dn++;
	next:
	if (!dn->done && dn->value && *dn->value)
	{
	es_fprintf (stream, "/%s=", dn->key);
	if (translate)
	print_utf8_buffer3 (stream, dn->value, strlen (dn->value),
	"/");
	else
	es_write_sanitized (stream, dn->value, strlen (dn->value),
	"/", NULL);
	}
	dn->done = 1;
	if (dn > first_dn && dn[-1].multivalued)
	{
	dn--;
	goto next;
	}
	}
	}
	}

	/* Print all parts of a DN in a "standard" sequence. We first print
	all the known parts, followed by the uncommon ones */
	static void
	print_dn_parts (estream_t stream,
	struct dn_array_s *dn, int translate)
	{
	const char *stdpart[] = {
	"CN", "OU", "O", "STREET", "L", "ST", "C", "EMail", NULL
	};
	int i;

	for (i=0; stdpart[i]; i++)
	print_dn_part (stream, dn, stdpart[i], translate);

	/* Now print the rest without any specific ordering */
	for (; dn->key; dn++)
	print_dn_part (stream, dn, dn->key, translate);
	}


	/* Print the S-Expression in BUF to extended STREAM, which has a valid
	length of BUFLEN, as a human readable string in one line to FP. */
	static void
	pretty_es_print_sexp (estream_t fp, const unsigned char *buf, size_t buflen)
	{
	size_t len;
	gcry_sexp_t sexp;
	char result, p;

	if ( gcry_sexp_sscan (&sexp, NULL, (const char*)buf, buflen) )
	{
	es_fputs (_("[Error - invalid encoding]"), fp);
	return;
	}
	len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, NULL, 0);
	assert (len);
	result = xtrymalloc (len);
	if (!result)
	{
	es_fputs (_("[Error - out of core]"), fp);
	gcry_sexp_release (sexp);
	return;
	}
	len = gcry_sexp_sprint (sexp, GCRYSEXP_FMT_ADVANCED, result, len);
	assert (len);
	for (p = result; len; len--, p++)
	{
	if (*p == '\n')
	{
	if (len > 1) /* Avoid printing the trailing LF. */
	es_fputs ("\\n", fp);
	}
	else if (*p == '\r')
	es_fputs ("\\r", fp);
	else if (*p == '\v')
	es_fputs ("\\v", fp);
	else if (*p == '\t')
	es_fputs ("\\t", fp);
	else
	es_putc (*p, fp);
	}
	xfree (result);
	gcry_sexp_release (sexp);
	}


	/* This is a variant of gpgsm_print_name sending it output to an estream. */
	void
	gpgsm_es_print_name2 (estream_t fp, const char *name, int translate)
	{
	const unsigned char s = (const unsigned char )name;
	int i;

	if (!s)
	{
	es_fputs (_("[Error - No name]"), fp);
	}
	else if (*s == '<')
	{
	const char s2 = strchr ( (char)s+1, '>');

	if (s2)
	{
	if (translate)
	print_utf8_buffer (fp, s + 1, s2 - (char*)s - 1);
	else
	es_write_sanitized (fp, s + 1, s2 - (char*)s - 1, NULL, NULL);
	}
	}
	else if (*s == '(')
	{
	pretty_es_print_sexp (fp, s, gcry_sexp_canon_len (s, 0, NULL, NULL));
	}
	else if (!((s >= '0' && s < '9')
	\|\| (s >= 'A' && s <= 'Z')
	\|\| (s >= 'a' && s <= 'z')))
	es_fputs (_("[Error - invalid encoding]"), fp);
	else
	{
	struct dn_array_s *dn = parse_dn (s);

	if (!dn)
	es_fputs (_("[Error - invalid DN]"), fp);
	else
	{
	print_dn_parts (fp, dn, translate);
	for (i=0; dn[i].key; i++)
	{
	xfree (dn[i].key);
	xfree (dn[i].value);
	}
	xfree (dn);
	}
	}
	}


	void
	gpgsm_es_print_name (estream_t fp, const char *name)
	{
	gpgsm_es_print_name2 (fp, name, 1);
	}


	/* A cookie structure used for the memory stream. */
	struct format_name_cookie
	{
	char buffer; / Malloced buffer with the data to deliver. */
	size_t size; /* Allocated size of this buffer. */
	size_t len; /* strlen (buffer). */
	int error; /* system error code if any. */
	};

	/* The writer function for the memory stream. */
	static gpgrt_ssize_t
	format_name_writer (void cookie, const void buffer, size_t size)
	{
	struct format_name_cookie *c = cookie;
	char *p;

	if (!c->buffer)
	{
	p = xtrymalloc (size + 1 + 1);
	if (p)
	{
	c->size = size + 1;
	c->buffer = p;
	c->len = 0;
	}
	}
	else if (c->len + size < c->len)
	{
	p = NULL;
	gpg_err_set_errno (ENOMEM);
	}
	else if (c->size < c->len + size)
	{
	p = xtryrealloc (c->buffer, c->len + size + 1);
	if (p)
	{
	c->size = c->len + size;
	c->buffer = p;
	}
	}
	else
	p = c->buffer;
	if (!p)
	{
	c->error = errno;
	xfree (c->buffer);
	c->buffer = NULL;
	gpg_err_set_errno (c->error);
	return -1;
	}
	memcpy (p + c->len, buffer, size);
	c->len += size;
	p[c->len] = 0; /* Terminate string. */

	return (gpgrt_ssize_t)size;
	}


	/* Format NAME which is expected to be in rfc2253 format into a better
	human readable format. Caller must free the returned string. NULL
	is returned in case of an error. With TRANSLATE set to true the
	name will be translated to the native encoding. Note that NAME is
	internally always UTF-8 encoded. */
	char *
	gpgsm_format_name2 (const char *name, int translate)
	{
	estream_t fp;
	struct format_name_cookie cookie;
	es_cookie_io_functions_t io = { NULL };

	memset (&cookie, 0, sizeof cookie);

	io.func_write = format_name_writer;
	fp = es_fopencookie (&cookie, "w", io);
	if (!fp)
	{
	int save_errno = errno;
	log_error ("error creating memory stream: %s\n", strerror (save_errno));
	gpg_err_set_errno (save_errno);
	return NULL;
	}
	gpgsm_es_print_name2 (fp, name, translate);
	es_fclose (fp);
	if (cookie.error \|\| !cookie.buffer)
	{
	xfree (cookie.buffer);
	gpg_err_set_errno (cookie.error);
	return NULL;
	}
	return cookie.buffer;
	}


	char *
	gpgsm_format_name (const char *name)
	{
	return gpgsm_format_name2 (name, 1);
	}


	/* Return fingerprint and a percent escaped name in a human readable
	format suitable for status messages like GOODSIG. May return NULL
	on error (out of core). */
	char *
	gpgsm_fpr_and_name_for_status (ksba_cert_t cert)
	{
	char fpr, name, *p;
	char *buffer;

	fpr = gpgsm_get_fingerprint_hexstring (cert, GCRY_MD_SHA1);
	if (!fpr)
	return NULL;

	name = ksba_cert_get_subject (cert, 0);
	if (!name)
	{
	xfree (fpr);
	return NULL;
	}

	p = gpgsm_format_name2 (name, 0);
	ksba_free (name);
	name = p;
	if (!name)
	{
	xfree (fpr);
	return NULL;
	}

	buffer = xtrymalloc (strlen (fpr) + 1 + 3*strlen (name) + 1);
	if (buffer)
	{
	const char *s;

	p = stpcpy (stpcpy (buffer, fpr), " ");
	for (s = name; *s; s++)
	{
	if (*s < ' ')
	{
	sprintf (p, "%%%02X", (const unsigned char)s);
	p += 3;
	}
	else
	p++ = s;
	}
	*p = 0;
	}
	xfree (fpr);
	xfree (name);
	return buffer;
	}


	/* Create a key description for the CERT, this may be passed to the
	pinentry. The caller must free the returned string. NULL may be
	returned on error. */
	char *
	gpgsm_format_keydesc (ksba_cert_t cert)
	{
	char name, subject, *buffer;
	ksba_isotime_t t;
	char created[20];
	char expires[20];
	char *sn;
	ksba_sexp_t sexp;
	char *orig_codeset;

	name = ksba_cert_get_subject (cert, 0);
	subject = name? gpgsm_format_name2 (name, 0) : NULL;
	ksba_free (name); name = NULL;

	sexp = ksba_cert_get_serial (cert);
	sn = sexp? gpgsm_format_serial (sexp) : NULL;
	ksba_free (sexp);

	ksba_cert_get_validity (cert, 0, t);
	if (*t)
	sprintf (created, "%.4s-%.2s-%.2s", t, t+4, t+6);
	else
	*created = 0;
	ksba_cert_get_validity (cert, 1, t);
	if (*t)
	sprintf (expires, "%.4s-%.2s-%.2s", t, t+4, t+6);
	else
	*expires = 0;

	orig_codeset = i18n_switchto_utf8 ();

	name = xtryasprintf (_("Please enter the passphrase to unlock the"
	" secret key for the X.509 certificate:\n"
	"\"%s\"\n"
	"S/N %s, ID 0x%08lX,\n"
	"created %s, expires %s.\n" ),
	subject? subject:"?",
	sn? sn: "?",
	gpgsm_get_short_fingerprint (cert, NULL),
	created, expires);

	i18n_switchback (orig_codeset);

	if (!name)
	{
	xfree (subject);
	xfree (sn);
	return NULL;
	}

	xfree (subject);
	xfree (sn);

	buffer = percent_plus_escape (name);
	xfree (name);
	return buffer;
	}
	diff --git a/sm/certlist.c b/sm/certlist.c
	index 7baec6557..bfc35cefc 100644
	--- a/sm/certlist.c
	+++ b/sm/certlist.c
	@@ -1,570 +1,570 @@
	/* certlist.c - build list of certificates
	* Copyright (C) 2001, 2003, 2004, 2005, 2007,
	* 2008, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#include <assert.h>

	#include "gpgsm.h"
	#include <gcrypt.h>
	#include <ksba.h>

	#include "keydb.h"
	#include "i18n.h"


	static const char oid_kp_serverAuth[] = "1.3.6.1.5.5.7.3.1";
	static const char oid_kp_clientAuth[] = "1.3.6.1.5.5.7.3.2";
	static const char oid_kp_codeSigning[] = "1.3.6.1.5.5.7.3.3";
	static const char oid_kp_emailProtection[]= "1.3.6.1.5.5.7.3.4";
	static const char oid_kp_timeStamping[] = "1.3.6.1.5.5.7.3.8";
	static const char oid_kp_ocspSigning[] = "1.3.6.1.5.5.7.3.9";

	/* Return 0 if the cert is usable for encryption. A MODE of 0 checks
	for signing a MODE of 1 checks for encryption, a MODE of 2 checks
	for verification and a MODE of 3 for decryption (just for
	debugging). MODE 4 is for certificate signing, MODE for COSP
	response signing. */
	static int
	cert_usage_p (ksba_cert_t cert, int mode)
	{
	gpg_error_t err;
	unsigned int use;
	char *extkeyusages;
	int have_ocsp_signing = 0;

	err = ksba_cert_get_ext_key_usages (cert, &extkeyusages);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	err = 0; /* no policy given */
	if (!err)
	{
	unsigned int extusemask = ~0; /* Allow all. */

	if (extkeyusages)
	{
	char p, pend;
	int any_critical = 0;

	extusemask = 0;

	p = extkeyusages;
	while (p && (pend=strchr (p, ':')))
	{
	*pend++ = 0;
	/* Only care about critical flagged usages. */
	if ( *pend == 'C' )
	{
	any_critical = 1;
	if ( !strcmp (p, oid_kp_serverAuth))
	extusemask \|= (KSBA_KEYUSAGE_DIGITAL_SIGNATURE
	\| KSBA_KEYUSAGE_KEY_ENCIPHERMENT
	\| KSBA_KEYUSAGE_KEY_AGREEMENT);
	else if ( !strcmp (p, oid_kp_clientAuth))
	extusemask \|= (KSBA_KEYUSAGE_DIGITAL_SIGNATURE
	\| KSBA_KEYUSAGE_KEY_AGREEMENT);
	else if ( !strcmp (p, oid_kp_codeSigning))
	extusemask \|= (KSBA_KEYUSAGE_DIGITAL_SIGNATURE);
	else if ( !strcmp (p, oid_kp_emailProtection))
	extusemask \|= (KSBA_KEYUSAGE_DIGITAL_SIGNATURE
	\| KSBA_KEYUSAGE_NON_REPUDIATION
	\| KSBA_KEYUSAGE_KEY_ENCIPHERMENT
	\| KSBA_KEYUSAGE_KEY_AGREEMENT);
	else if ( !strcmp (p, oid_kp_timeStamping))
	extusemask \|= (KSBA_KEYUSAGE_DIGITAL_SIGNATURE
	\| KSBA_KEYUSAGE_NON_REPUDIATION);
	}

	/* This is a hack to cope with OCSP. Note that we do
	not yet fully comply with the requirements and that
	the entire CRL/OCSP checking thing should undergo a
	thorough review and probably redesign. */
	if ( !strcmp (p, oid_kp_ocspSigning))
	have_ocsp_signing = 1;

	if ((p = strchr (pend, '\n')))
	p++;
	}
	xfree (extkeyusages);
	extkeyusages = NULL;

	if (!any_critical)
	extusemask = ~0; /* Reset to the don't care mask. */
	}


	err = ksba_cert_get_key_usage (cert, &use);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	{
	err = 0;
	if (opt.verbose && mode < 2)
	log_info (_("no key usage specified - assuming all usages\n"));
	use = ~0;
	}

	/* Apply extKeyUsage. */
	use &= extusemask;

	}
	if (err)
	{
	log_error (_("error getting key usage information: %s\n"),
	gpg_strerror (err));
	xfree (extkeyusages);
	return err;
	}

	if (mode == 4)
	{
	if ((use & (KSBA_KEYUSAGE_KEY_CERT_SIGN)))
	return 0;
	log_info (_("certificate should not have "
	"been used for certification\n"));
	return gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	}

	if (mode == 5)
	{
	if (use != ~0
	&& (have_ocsp_signing
	\|\| (use & (KSBA_KEYUSAGE_KEY_CERT_SIGN
	\|KSBA_KEYUSAGE_CRL_SIGN))))
	return 0;
	log_info (_("certificate should not have "
	"been used for OCSP response signing\n"));
	return gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	}

	if ((use & ((mode&1)?
	(KSBA_KEYUSAGE_KEY_ENCIPHERMENT\|KSBA_KEYUSAGE_DATA_ENCIPHERMENT):
	(KSBA_KEYUSAGE_DIGITAL_SIGNATURE\|KSBA_KEYUSAGE_NON_REPUDIATION)))
	)
	return 0;

	log_info (mode==3? _("certificate should not have been used for encryption\n"):
	mode==2? _("certificate should not have been used for signing\n"):
	mode==1? _("certificate is not usable for encryption\n"):
	_("certificate is not usable for signing\n"));
	return gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	}


	/* Return 0 if the cert is usable for signing */
	int
	gpgsm_cert_use_sign_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 0);
	}


	/* Return 0 if the cert is usable for encryption */
	int
	gpgsm_cert_use_encrypt_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 1);
	}

	int
	gpgsm_cert_use_verify_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 2);
	}

	int
	gpgsm_cert_use_decrypt_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 3);
	}

	int
	gpgsm_cert_use_cert_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 4);
	}

	int
	gpgsm_cert_use_ocsp_p (ksba_cert_t cert)
	{
	return cert_usage_p (cert, 5);
	}


	/* Return true if CERT has the well known private key extension. */
	int
	gpgsm_cert_has_well_known_private_key (ksba_cert_t cert)
	{
	int idx;
	const char *oid;

	for (idx=0; !ksba_cert_get_extension (cert, idx,
	&oid, NULL, NULL, NULL);idx++)
	if (!strcmp (oid, "1.3.6.1.4.1.11591.2.2.2") )
	return 1; /* Yes. */
	return 0; /* No. */
	}


	static int
	same_subject_issuer (const char subject, const char issuer, ksba_cert_t cert)
	{
	char *subject2 = ksba_cert_get_subject (cert, 0);
	char *issuer2 = ksba_cert_get_issuer (cert, 0);
	int tmp;

	tmp = (subject && subject2
	&& !strcmp (subject, subject2)
	&& issuer && issuer2
	&& !strcmp (issuer, issuer2));
	xfree (subject2);
	xfree (issuer2);
	return tmp;
	}


	/* Return true if CERT_A is the same as CERT_B. */
	int
	gpgsm_certs_identical_p (ksba_cert_t cert_a, ksba_cert_t cert_b)
	{
	const unsigned char img_a, img_b;
	size_t len_a, len_b;

	img_a = ksba_cert_get_image (cert_a, &len_a);
	if (img_a)
	{
	img_b = ksba_cert_get_image (cert_b, &len_b);
	if (img_b && len_a == len_b && !memcmp (img_a, img_b, len_a))
	return 1; /* Identical. */
	}
	return 0;
	}


	/* Return true if CERT is already contained in CERTLIST. */
	static int
	is_cert_in_certlist (ksba_cert_t cert, certlist_t certlist)
	{
	const unsigned char img_a, img_b;
	size_t len_a, len_b;

	img_a = ksba_cert_get_image (cert, &len_a);
	if (img_a)
	{
	for ( ; certlist; certlist = certlist->next)
	{
	img_b = ksba_cert_get_image (certlist->cert, &len_b);
	if (img_b && len_a == len_b && !memcmp (img_a, img_b, len_a))
	return 1; /* Already contained. */
	}
	}
	return 0;
	}


	/* Add CERT to the list of certificates at CERTADDR but avoid
	duplicates. */
	int
	gpgsm_add_cert_to_certlist (ctrl_t ctrl, ksba_cert_t cert,
	certlist_t *listaddr, int is_encrypt_to)
	{
	(void)ctrl;

	if (!is_cert_in_certlist (cert, *listaddr))
	{
	certlist_t cl = xtrycalloc (1, sizeof *cl);
	if (!cl)
	return out_of_core ();
	cl->cert = cert;
	ksba_cert_ref (cert);
	cl->next = *listaddr;
	cl->is_encrypt_to = is_encrypt_to;
	*listaddr = cl;
	}
	return 0;
	}

	/* Add a certificate to a list of certificate and make sure that it is
	a valid certificate. With SECRET set to true a secret key must be
	available for the certificate. IS_ENCRYPT_TO sets the corresponding
	flag in the new create LISTADDR item. */
	int
	gpgsm_add_to_certlist (ctrl_t ctrl, const char *name, int secret,
	certlist_t *listaddr, int is_encrypt_to)
	{
	int rc;
	KEYDB_SEARCH_DESC desc;
	KEYDB_HANDLE kh = NULL;
	ksba_cert_t cert = NULL;

	rc = classify_user_id (name, &desc, 0);
	if (!rc)
	{
	kh = keydb_new ();
	if (!kh)
	rc = gpg_error (GPG_ERR_ENOMEM);
	else
	{
	int wrong_usage = 0;
	char *first_subject = NULL;
	char *first_issuer = NULL;

	get_next:
	rc = keydb_search (ctrl, kh, &desc, 1);
	if (!rc)
	rc = keydb_get_cert (kh, &cert);
	if (!rc)
	{
	if (!first_subject)
	{
	- /* Save the the subject and the issuer for key usage
	+ /* Save the subject and the issuer for key usage
	and ambiguous name tests. */
	first_subject = ksba_cert_get_subject (cert, 0);
	first_issuer = ksba_cert_get_issuer (cert, 0);
	}
	rc = secret? gpgsm_cert_use_sign_p (cert)
	: gpgsm_cert_use_encrypt_p (cert);
	if (gpg_err_code (rc) == GPG_ERR_WRONG_KEY_USAGE)
	{
	/* There might be another certificate with the
	correct usage, so we try again */
	if (!wrong_usage)
	{ /* save the first match */
	wrong_usage = rc;
	ksba_cert_release (cert);
	cert = NULL;
	goto get_next;
	}
	else if (same_subject_issuer (first_subject, first_issuer,
	cert))
	{
	wrong_usage = rc;
	ksba_cert_release (cert);
	cert = NULL;
	goto get_next;
	}
	else
	wrong_usage = rc;

	}
	}
	/* We want the error code from the first match in this case. */
	if (rc && wrong_usage)
	rc = wrong_usage;

	if (!rc)
	{
	certlist_t dup_certs = NULL;

	next_ambigious:
	rc = keydb_search (ctrl, kh, &desc, 1);
	if (rc == -1)
	rc = 0;
	else if (!rc)
	{
	ksba_cert_t cert2 = NULL;

	/* If this is the first possible duplicate, add the original
	certificate to our list of duplicates. */
	if (!dup_certs)
	gpgsm_add_cert_to_certlist (ctrl, cert, &dup_certs, 0);

	/* We have to ignore ambigious names as long as
	there only fault is a bad key usage. This is
	required to support encryption and signing
	certificates of the same subject.

	Further we ignore them if they are due to an
	identical certificate (which may happen if a
	certificate is accidential duplicated in the
	keybox). */
	if (!keydb_get_cert (kh, &cert2))
	{
	int tmp = (same_subject_issuer (first_subject,
	first_issuer,
	cert2)
	&& ((gpg_err_code (
	secret? gpgsm_cert_use_sign_p (cert2)
	: gpgsm_cert_use_encrypt_p (cert2)
	)
	) == GPG_ERR_WRONG_KEY_USAGE));
	if (tmp)
	gpgsm_add_cert_to_certlist (ctrl, cert2,
	&dup_certs, 0);
	else
	{
	if (is_cert_in_certlist (cert2, dup_certs))
	tmp = 1;
	}

	ksba_cert_release (cert2);
	if (tmp)
	goto next_ambigious;
	}
	rc = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
	}
	gpgsm_release_certlist (dup_certs);
	}
	xfree (first_subject);
	xfree (first_issuer);
	first_subject = NULL;
	first_issuer = NULL;

	if (!rc && !is_cert_in_certlist (cert, *listaddr))
	{
	if (!rc && secret)
	{
	char *p;

	rc = gpg_error (GPG_ERR_NO_SECKEY);
	p = gpgsm_get_keygrip_hexstring (cert);
	if (p)
	{
	if (!gpgsm_agent_havekey (ctrl, p))
	rc = 0;
	xfree (p);
	}
	}
	if (!rc)
	rc = gpgsm_validate_chain (ctrl, cert, "", NULL,
	0, NULL, 0, NULL);
	if (!rc)
	{
	certlist_t cl = xtrycalloc (1, sizeof *cl);
	if (!cl)
	rc = out_of_core ();
	else
	{
	cl->cert = cert; cert = NULL;
	cl->next = *listaddr;
	cl->is_encrypt_to = is_encrypt_to;
	*listaddr = cl;
	}
	}
	}
	}
	}

	keydb_release (kh);
	ksba_cert_release (cert);
	return rc == -1? gpg_error (GPG_ERR_NO_PUBKEY): rc;
	}


	void
	gpgsm_release_certlist (certlist_t list)
	{
	while (list)
	{
	certlist_t cl = list->next;
	ksba_cert_release (list->cert);
	xfree (list);
	list = cl;
	}
	}


	/* Like gpgsm_add_to_certlist, but look only for one certificate. No
	chain validation is done. If KEYID is not NULL it is taken as an
	additional filter value which must match the
	subjectKeyIdentifier. */
	int
	gpgsm_find_cert (ctrl_t ctrl,
	const char name, ksba_sexp_t keyid, ksba_cert_t r_cert)
	{
	int rc;
	KEYDB_SEARCH_DESC desc;
	KEYDB_HANDLE kh = NULL;

	*r_cert = NULL;
	rc = classify_user_id (name, &desc, 0);
	if (!rc)
	{
	kh = keydb_new ();
	if (!kh)
	rc = gpg_error (GPG_ERR_ENOMEM);
	else
	{
	nextone:
	rc = keydb_search (ctrl, kh, &desc, 1);
	if (!rc)
	{
	rc = keydb_get_cert (kh, r_cert);
	if (!rc && keyid)
	{
	ksba_sexp_t subj;

	rc = ksba_cert_get_subj_key_id (*r_cert, NULL, &subj);
	if (!rc)
	{
	if (cmp_simple_canon_sexp (keyid, subj))
	{
	xfree (subj);
	goto nextone;
	}
	xfree (subj);
	/* Okay: Here we know that the certificate's
	subjectKeyIdentifier matches the requested
	one. */
	}
	else if (gpg_err_code (rc) == GPG_ERR_NO_DATA)
	goto nextone;
	}
	}

	/* If we don't have the KEYID filter we need to check for
	ambigious search results. Note, that it is somehwat
	reasonable to assume that a specification of a KEYID
	won't lead to ambiguous names. */
	if (!rc && !keyid)
	{
	next_ambiguous:
	rc = keydb_search (ctrl, kh, &desc, 1);
	if (rc == -1)
	rc = 0;
	else
	{
	if (!rc)
	{
	ksba_cert_t cert2 = NULL;

	if (!keydb_get_cert (kh, &cert2))
	{
	if (gpgsm_certs_identical_p (*r_cert, cert2))
	{
	ksba_cert_release (cert2);
	goto next_ambiguous;
	}
	ksba_cert_release (cert2);
	}
	rc = gpg_error (GPG_ERR_AMBIGUOUS_NAME);
	}
	ksba_cert_release (*r_cert);
	*r_cert = NULL;
	}
	}
	}
	}

	keydb_release (kh);
	return rc == -1? gpg_error (GPG_ERR_NO_PUBKEY): rc;
	}
	diff --git a/sm/keydb.c b/sm/keydb.c
	index 44dd9ca14..75f83ee2d 100644
	--- a/sm/keydb.c
	+++ b/sm/keydb.c
	@@ -1,1361 +1,1361 @@
	/* keydb.c - key database dispatcher
	* Copyright (C) 2001, 2003, 2004 Free Software Foundation, Inc.
	* Copyright (C) 2014 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <assert.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <unistd.h>

	#include "gpgsm.h"
	#include "../kbx/keybox.h"
	#include "keydb.h"
	#include "i18n.h"

	static int active_handles;

	typedef enum {
	KEYDB_RESOURCE_TYPE_NONE = 0,
	KEYDB_RESOURCE_TYPE_KEYBOX
	} KeydbResourceType;
	#define MAX_KEYDB_RESOURCES 20

	struct resource_item {
	KeydbResourceType type;
	union {
	KEYBOX_HANDLE kr;
	} u;
	void *token;
	dotlock_t lockhandle;
	};

	static struct resource_item all_resources[MAX_KEYDB_RESOURCES];
	static int used_resources;

	/* Whether we have successfully registered any resource. */
	static int any_registered;


	struct keydb_handle {
	int locked;
	int found;
	int saved_found;
	int current;
	int is_ephemeral;
	int used; /* items in active */
	struct resource_item active[MAX_KEYDB_RESOURCES];
	};


	static int lock_all (KEYDB_HANDLE hd);
	static void unlock_all (KEYDB_HANDLE hd);


	static void
	try_make_homedir (const char *fname)
	{
	const char *defhome = standard_homedir ();

	/* Create the directory only if the supplied directory name is the
	same as the default one. This way we avoid to create arbitrary
	directories when a non-default home directory is used. To cope
	with HOME, we do compare only the suffix if we see that the
	default homedir does start with a tilde. */
	if ( opt.dry_run \|\| opt.no_homedir_creation )
	return;

	if (
	#ifdef HAVE_W32_SYSTEM
	( !compare_filenames (fname, defhome) )
	#else
	( *defhome == '~'
	&& (strlen(fname) >= strlen (defhome+1)
	&& !strcmp(fname+strlen(fname)-strlen(defhome+1), defhome+1 ) ))
	\|\| (*defhome != '~' && !compare_filenames( fname, defhome ) )
	#endif
	)
	{
	if (gnupg_mkdir (fname, "-rwx"))
	log_info (_("can't create directory '%s': %s\n"),
	fname, strerror(errno) );
	else if (!opt.quiet )
	log_info (_("directory '%s' created\n"), fname);
	}
	}


	/* Handle the creation of a keybox if it does not yet exist. Take
	into acount that other processes might have the keybox already
	locked. This lock check does not work if the directory itself is
	not yet available. If R_CREATED is not NULL it will be set to true
	if the function created a new keybox. */
	static gpg_error_t
	maybe_create_keybox (char filename, int force, int r_created)
	{
	dotlock_t lockhd = NULL;
	FILE *fp;
	int rc;
	mode_t oldmask;
	char *last_slash_in_filename;
	int save_slash;

	if (r_created)
	*r_created = 0;

	/* A quick test whether the filename already exists. */
	if (!access (filename, F_OK))
	return !access (filename, R_OK)? 0 : gpg_error (GPG_ERR_EACCES);

	/* If we don't want to create a new file at all, there is no need to
	go any further - bail out right here. */
	if (!force)
	return gpg_error (GPG_ERR_ENOENT);

	/* First of all we try to create the home directory. Note, that we
	don't do any locking here because any sane application of gpg
	would create the home directory by itself and not rely on gpg's
	tricky auto-creation which is anyway only done for some home
	directory name patterns. */
	last_slash_in_filename = strrchr (filename, DIRSEP_C);
	#if HAVE_W32_SYSTEM
	{
	/* Windows may either have a slash or a backslash. Take care of it. */
	char *p = strrchr (filename, '/');
	if (!last_slash_in_filename \|\| p > last_slash_in_filename)
	last_slash_in_filename = p;
	}
	#endif /HAVE_W32_SYSTEM/
	if (!last_slash_in_filename)
	return gpg_error (GPG_ERR_ENOENT); /* No slash at all - should
	not happen though. */
	save_slash = *last_slash_in_filename;
	*last_slash_in_filename = 0;
	if (access(filename, F_OK))
	{
	static int tried;

	if (!tried)
	{
	tried = 1;
	try_make_homedir (filename);
	}
	if (access (filename, F_OK))
	{
	rc = gpg_error_from_syserror ();
	*last_slash_in_filename = save_slash;
	goto leave;
	}
	}
	*last_slash_in_filename = save_slash;

	/* To avoid races with other instances of gpg trying to create or
	update the keybox (it is removed during an update for a short
	time), we do the next stuff in a locked state. */
	lockhd = dotlock_create (filename, 0);
	if (!lockhd)
	{
	/* A reason for this to fail is that the directory is not
	writable. However, this whole locking stuff does not make
	sense if this is the case. An empty non-writable directory
	with no keyring is not really useful at all. */
	if (opt.verbose)
	log_info ("can't allocate lock for '%s'\n", filename );

	if (!force)
	return gpg_error (GPG_ERR_ENOENT);
	else
	return gpg_error (GPG_ERR_GENERAL);
	}

	if ( dotlock_take (lockhd, -1) )
	{
	/* This is something bad. Probably a stale lockfile. */
	log_info ("can't lock '%s'\n", filename);
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	/* Now the real test while we are locked. */
	if (!access(filename, F_OK))
	{
	rc = 0; /* Okay, we may access the file now. */
	goto leave;
	}

	/* The file does not yet exist, create it now. */
	oldmask = umask (077);
	fp = fopen (filename, "w");
	if (!fp)
	{
	rc = gpg_error_from_syserror ();
	umask (oldmask);
	log_error (_("error creating keybox '%s': %s\n"),
	filename, gpg_strerror (rc));
	goto leave;
	}
	umask (oldmask);

	/* Make sure that at least one record is in a new keybox file, so
	that the detection magic for OpenPGP keyboxes works the next time
	it is used. */
	rc = _keybox_write_header_blob (fp, 0);
	if (rc)
	{
	fclose (fp);
	log_error (_("error creating keybox '%s': %s\n"),
	filename, gpg_strerror (rc));
	goto leave;
	}

	if (!opt.quiet)
	log_info (_("keybox '%s' created\n"), filename);
	if (r_created)
	*r_created = 1;

	fclose (fp);
	rc = 0;

	leave:
	if (lockhd)
	{
	dotlock_release (lockhd);
	dotlock_destroy (lockhd);
	}
	return rc;
	}


	/*
	* Register a resource (which currently may only be a keybox file).
	* The first keybox which is added by this function is created if it
	* does not exist. If AUTO_CREATED is not NULL it will be set to true
	* if the function has created a new keybox.
	*/
	gpg_error_t
	keydb_add_resource (ctrl_t ctrl, const char url, int force, int auto_created)
	{
	const char *resname = url;
	char *filename = NULL;
	gpg_error_t err = 0;
	KeydbResourceType rt = KEYDB_RESOURCE_TYPE_NONE;

	if (auto_created)
	*auto_created = 0;

	/* Do we have an URL?
	gnupg-kbx:filename := this is a plain keybox
	- filename := See what is is, but create as plain keybox.
	+ filename := See what it is, but create as plain keybox.
	*/
	if (strlen (resname) > 10)
	{
	if (!strncmp (resname, "gnupg-kbx:", 10) )
	{
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	resname += 10;
	}
	#if !defined(HAVE_DRIVE_LETTERS) && !defined(__riscos__)
	else if (strchr (resname, ':'))
	{
	log_error ("invalid key resource URL '%s'\n", url );
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	#endif /* !HAVE_DRIVE_LETTERS && !__riscos__ */
	}

	if (*resname != DIRSEP_C )
	{ /* do tilde expansion etc */
	if (strchr(resname, DIRSEP_C) )
	filename = make_filename (resname, NULL);
	else
	filename = make_filename (gnupg_homedir (), resname, NULL);
	}
	else
	filename = xstrdup (resname);

	if (!force)
	force = !any_registered;

	/* see whether we can determine the filetype */
	if (rt == KEYDB_RESOURCE_TYPE_NONE)
	{
	FILE *fp = fopen( filename, "rb" );

	if (fp)
	{
	u32 magic;

	/* FIXME: check for the keybox magic */
	if (fread (&magic, 4, 1, fp) == 1 )
	{
	if (magic == 0x13579ace \|\| magic == 0xce9a5713)
	; /* GDBM magic - no more support */
	else
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	}
	else /* maybe empty: assume keybox */
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	fclose (fp);
	}
	else /* no file yet: create keybox */
	rt = KEYDB_RESOURCE_TYPE_KEYBOX;
	}

	switch (rt)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	log_error ("unknown type of key resource '%s'\n", url );
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;

	case KEYDB_RESOURCE_TYPE_KEYBOX:
	err = maybe_create_keybox (filename, force, auto_created);
	if (err)
	goto leave;
	/* Now register the file */
	{
	void *token;

	err = keybox_register_file (filename, 0, &token);
	if (gpg_err_code (err) == GPG_ERR_EEXIST)
	; /* Already registered - ignore. */
	else if (err)
	; /* Other error. */
	else if (used_resources >= MAX_KEYDB_RESOURCES)
	err = gpg_error (GPG_ERR_RESOURCE_LIMIT);
	else
	{
	all_resources[used_resources].type = rt;
	all_resources[used_resources].u.kr = NULL; /* Not used here */
	all_resources[used_resources].token = token;

	all_resources[used_resources].lockhandle
	= dotlock_create (filename, 0);
	if (!all_resources[used_resources].lockhandle)
	log_fatal ( _("can't create lock for '%s'\n"), filename);

	/* Do a compress run if needed and the file is not locked. */
	if (!dotlock_take (all_resources[used_resources].lockhandle, 0))
	{
	KEYBOX_HANDLE kbxhd = keybox_new_x509 (token, 0);

	if (kbxhd)
	{
	keybox_compress (kbxhd);
	keybox_release (kbxhd);
	}
	dotlock_release (all_resources[used_resources].lockhandle);
	}

	used_resources++;
	}
	}
	break;

	default:
	log_error ("resource type of '%s' not supported\n", url);
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	goto leave;
	}

	/* fixme: check directory permissions and print a warning */

	leave:
	if (err)
	{
	log_error ("keyblock resource '%s': %s\n", filename, gpg_strerror (err));
	gpgsm_status_with_error (ctrl, STATUS_ERROR,
	"add_keyblock_resource", err);
	}
	else
	any_registered = 1;
	xfree (filename);
	return err;
	}


	KEYDB_HANDLE
	keydb_new (void)
	{
	KEYDB_HANDLE hd;
	int i, j;

	hd = xcalloc (1, sizeof *hd);
	hd->found = -1;
	hd->saved_found = -1;

	assert (used_resources <= MAX_KEYDB_RESOURCES);
	for (i=j=0; i < used_resources; i++)
	{
	switch (all_resources[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE: /* ignore */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	hd->active[j].type = all_resources[i].type;
	hd->active[j].token = all_resources[i].token;
	hd->active[j].lockhandle = all_resources[i].lockhandle;
	hd->active[j].u.kr = keybox_new_x509 (all_resources[i].token, 0);
	if (!hd->active[j].u.kr)
	{
	xfree (hd);
	return NULL; /* fixme: release all previously allocated handles*/
	}
	j++;
	break;
	}
	}
	hd->used = j;

	active_handles++;
	return hd;
	}

	void
	keydb_release (KEYDB_HANDLE hd)
	{
	int i;

	if (!hd)
	return;
	assert (active_handles > 0);
	active_handles--;

	unlock_all (hd);
	for (i=0; i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_release (hd->active[i].u.kr);
	break;
	}
	}

	xfree (hd);
	}


	/* Return the name of the current resource. This is function first
	looks for the last found found, then for the current search
	position, and last returns the first available resource. The
	returned string is only valid as long as the handle exists. This
	function does only return NULL if no handle is specified, in all
	other error cases an empty string is returned. */
	const char *
	keydb_get_resource_name (KEYDB_HANDLE hd)
	{
	int idx;
	const char *s = NULL;

	if (!hd)
	return NULL;

	if ( hd->found >= 0 && hd->found < hd->used)
	idx = hd->found;
	else if ( hd->current >= 0 && hd->current < hd->used)
	idx = hd->current;
	else
	idx = 0;

	switch (hd->active[idx].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	s = NULL;
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	s = keybox_get_resource_name (hd->active[idx].u.kr);
	break;
	}

	return s? s: "";
	}

	/* Switch the handle into ephemeral mode and return the original value. */
	int
	keydb_set_ephemeral (KEYDB_HANDLE hd, int yes)
	{
	int i;

	if (!hd)
	return 0;

	yes = !!yes;
	if (hd->is_ephemeral != yes)
	{
	for (i=0; i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_set_ephemeral (hd->active[i].u.kr, yes);
	break;
	}
	}
	}

	i = hd->is_ephemeral;
	hd->is_ephemeral = yes;
	return i;
	}


	/* If the keyring has not yet been locked, lock it now. This
	operation is required before any update operation; it is optional
	for an insert operation. The lock is released with
	keydb_released. */
	gpg_error_t
	keydb_lock (KEYDB_HANDLE hd)
	{
	if (!hd)
	return gpg_error (GPG_ERR_INV_HANDLE);
	if (hd->locked)
	return 0; /* Already locked. */
	return lock_all (hd);
	}



	static int
	lock_all (KEYDB_HANDLE hd)
	{
	int i, rc = 0;

	/* Fixme: This locking scheme may lead to deadlock if the resources
	are not added in the same order by all processes. We are
	currently only allowing one resource so it is not a problem. */
	for (i=0; i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	if (hd->active[i].lockhandle)
	rc = dotlock_take (hd->active[i].lockhandle, -1);
	break;
	}
	if (rc)
	break;
	}

	if (rc)
	{
	/* revert the already set locks */
	for (i--; i >= 0; i--)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	if (hd->active[i].lockhandle)
	dotlock_release (hd->active[i].lockhandle);
	break;
	}
	}
	}
	else
	hd->locked = 1;

	/* make_dotlock () does not yet guarantee that errno is set, thus
	we can't rely on the error reason and will simply use
	EACCES. */
	return rc? gpg_error (GPG_ERR_EACCES) : 0;
	}

	static void
	unlock_all (KEYDB_HANDLE hd)
	{
	int i;

	if (!hd->locked)
	return;

	for (i=hd->used-1; i >= 0; i--)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	if (hd->active[i].lockhandle)
	dotlock_release (hd->active[i].lockhandle);
	break;
	}
	}
	hd->locked = 0;
	}



	/* Push the last found state if any. */
	void
	keydb_push_found_state (KEYDB_HANDLE hd)
	{
	if (!hd)
	return;

	if (hd->found < 0 \|\| hd->found >= hd->used)
	{
	hd->saved_found = -1;
	return;
	}

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_push_found_state (hd->active[hd->found].u.kr);
	break;
	}

	hd->saved_found = hd->found;
	hd->found = -1;
	}


	/* Pop the last found state. */
	void
	keydb_pop_found_state (KEYDB_HANDLE hd)
	{
	if (!hd)
	return;

	hd->found = hd->saved_found;
	hd->saved_found = -1;
	if (hd->found < 0 \|\| hd->found >= hd->used)
	return;

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	keybox_pop_found_state (hd->active[hd->found].u.kr);
	break;
	}
	}



	/*
	Return the last found object. Caller must free it. The returned
	keyblock has the kbode flag bit 0 set for the node with the public
	key used to locate the keyblock or flag bit 1 set for the user ID
	node. */
	int
	keydb_get_cert (KEYDB_HANDLE hd, ksba_cert_t *r_cert)
	{
	int rc = 0;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if ( hd->found < 0 \|\| hd->found >= hd->used)
	return -1; /* nothing found */

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	rc = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_get_cert (hd->active[hd->found].u.kr, r_cert);
	break;
	}

	return rc;
	}

	/* Return a flag of the last found object. WHICH is the flag requested;
	it should be one of the KEYBOX_FLAG_ values. If the operation is
	successful, the flag value will be stored at the address given by
	VALUE. Return 0 on success or an error code. */
	gpg_error_t
	keydb_get_flags (KEYDB_HANDLE hd, int which, int idx, unsigned int *value)
	{
	int err = 0;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if ( hd->found < 0 \|\| hd->found >= hd->used)
	return gpg_error (GPG_ERR_NOTHING_FOUND);

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	err = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	err = keybox_get_flags (hd->active[hd->found].u.kr, which, idx, value);
	break;
	}

	return err;
	}

	/* Set a flag of the last found object. WHICH is the flag to be set; it
	should be one of the KEYBOX_FLAG_ values. If the operation is
	successful, the flag value will be stored in the keybox. Note,
	that some flag values can't be updated and thus may return an
	error, some other flag values may be masked out before an update.
	Returns 0 on success or an error code. */
	gpg_error_t
	keydb_set_flags (KEYDB_HANDLE hd, int which, int idx, unsigned int value)
	{
	int err = 0;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if ( hd->found < 0 \|\| hd->found >= hd->used)
	return gpg_error (GPG_ERR_NOTHING_FOUND);

	if (!hd->locked)
	return gpg_error (GPG_ERR_NOT_LOCKED);

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	err = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	err = keybox_set_flags (hd->active[hd->found].u.kr, which, idx, value);
	break;
	}

	return err;
	}

	/*
	* Insert a new Certificate into one of the resources.
	*/
	int
	keydb_insert_cert (KEYDB_HANDLE hd, ksba_cert_t cert)
	{
	int rc = -1;
	int idx;
	unsigned char digest[20];

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if (opt.dry_run)
	return 0;

	if ( hd->found >= 0 && hd->found < hd->used)
	idx = hd->found;
	else if ( hd->current >= 0 && hd->current < hd->used)
	idx = hd->current;
	else
	return gpg_error (GPG_ERR_GENERAL);

	if (!hd->locked)
	return gpg_error (GPG_ERR_NOT_LOCKED);

	gpgsm_get_fingerprint (cert, GCRY_MD_SHA1, digest, NULL); /* kludge*/

	switch (hd->active[idx].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	rc = gpg_error (GPG_ERR_GENERAL);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_insert_cert (hd->active[idx].u.kr, cert, digest);
	break;
	}

	unlock_all (hd);
	return rc;
	}



	/* Update the current keyblock with KB. */
	int
	keydb_update_cert (KEYDB_HANDLE hd, ksba_cert_t cert)
	{
	int rc = 0;
	unsigned char digest[20];

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if ( hd->found < 0 \|\| hd->found >= hd->used)
	return -1; /* nothing found */

	if (opt.dry_run)
	return 0;

	rc = lock_all (hd);
	if (rc)
	return rc;

	gpgsm_get_fingerprint (cert, GCRY_MD_SHA1, digest, NULL); /* kludge*/

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	rc = gpg_error (GPG_ERR_GENERAL); /* oops */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_update_cert (hd->active[hd->found].u.kr, cert, digest);
	break;
	}

	unlock_all (hd);
	return rc;
	}


	/*
	* The current keyblock or cert will be deleted.
	*/
	int
	keydb_delete (KEYDB_HANDLE hd, int unlock)
	{
	int rc = -1;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if ( hd->found < 0 \|\| hd->found >= hd->used)
	return -1; /* nothing found */

	if( opt.dry_run )
	return 0;

	if (!hd->locked)
	return gpg_error (GPG_ERR_NOT_LOCKED);

	switch (hd->active[hd->found].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	rc = gpg_error (GPG_ERR_GENERAL);
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_delete (hd->active[hd->found].u.kr);
	break;
	}

	if (unlock)
	unlock_all (hd);
	return rc;
	}



	/*
	* Locate the default writable key resource, so that the next
	* operation (which is only relevant for inserts) will be done on this
	* resource.
	*/
	int
	keydb_locate_writable (KEYDB_HANDLE hd, const char *reserved)
	{
	int rc;

	(void)reserved;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	rc = keydb_search_reset (hd); /* this does reset hd->current */
	if (rc)
	return rc;

	for ( ; hd->current >= 0 && hd->current < hd->used; hd->current++)
	{
	switch (hd->active[hd->current].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	BUG();
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	if (keybox_is_writable (hd->active[hd->current].token))
	return 0; /* found (hd->current is set to it) */
	break;
	}
	}

	return -1;
	}

	/*
	* Rebuild the caches of all key resources.
	*/
	void
	keydb_rebuild_caches (void)
	{
	int i;

	for (i=0; i < used_resources; i++)
	{
	switch (all_resources[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE: /* ignore */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	/* rc = keybox_rebuild_cache (all_resources[i].token); */
	/* if (rc) */
	/* log_error (_("failed to rebuild keybox cache: %s\n"), */
	/* g10_errstr (rc)); */
	break;
	}
	}
	}



	/*
	* Start the next search on this handle right at the beginning
	*/
	gpg_error_t
	keydb_search_reset (KEYDB_HANDLE hd)
	{
	int i;
	gpg_error_t rc = 0;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	hd->current = 0;
	hd->found = -1;
	/* and reset all resources */
	for (i=0; !rc && i < hd->used; i++)
	{
	switch (hd->active[i].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_search_reset (hd->active[i].u.kr);
	break;
	}
	}
	return rc;
	}

	/*
	* Search through all keydb resources, starting at the current position,
	* for a keyblock which contains one of the keys described in the DESC array.
	*/
	int
	keydb_search (ctrl_t ctrl, KEYDB_HANDLE hd,
	KEYDB_SEARCH_DESC *desc, size_t ndesc)
	{
	int rc = -1;
	unsigned long skipped;

	if (!hd)
	return gpg_error (GPG_ERR_INV_VALUE);

	if (!any_registered)
	{
	gpgsm_status_with_error (ctrl, STATUS_ERROR, "keydb_search",
	gpg_error (GPG_ERR_KEYRING_OPEN));
	return gpg_error (GPG_ERR_NOT_FOUND);
	}

	while (rc == -1 && hd->current >= 0 && hd->current < hd->used)
	{
	switch (hd->active[hd->current].type)
	{
	case KEYDB_RESOURCE_TYPE_NONE:
	BUG(); /* we should never see it here */
	break;
	case KEYDB_RESOURCE_TYPE_KEYBOX:
	rc = keybox_search (hd->active[hd->current].u.kr, desc, ndesc,
	KEYBOX_BLOBTYPE_X509,
	NULL, &skipped);
	break;
	}
	if (rc == -1 \|\| gpg_err_code (rc) == GPG_ERR_EOF)
	{ /* EOF -> switch to next resource */
	hd->current++;
	}
	else if (!rc)
	hd->found = hd->current;
	}

	return rc;
	}


	int
	keydb_search_first (ctrl_t ctrl, KEYDB_HANDLE hd)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FIRST;
	return keydb_search (ctrl, hd, &desc, 1);
	}

	int
	keydb_search_next (ctrl_t ctrl, KEYDB_HANDLE hd)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_NEXT;
	return keydb_search (ctrl, hd, &desc, 1);
	}

	int
	keydb_search_kid (ctrl_t ctrl, KEYDB_HANDLE hd, u32 *kid)
	{
	KEYDB_SEARCH_DESC desc;

	(void)kid;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_LONG_KID;
	desc.u.kid[0] = kid[0];
	desc.u.kid[1] = kid[1];
	return keydb_search (ctrl, hd, &desc, 1);
	}

	int
	keydb_search_fpr (ctrl_t ctrl, KEYDB_HANDLE hd, const byte *fpr)
	{
	KEYDB_SEARCH_DESC desc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_FPR;
	memcpy (desc.u.fpr, fpr, 20);
	return keydb_search (ctrl, hd, &desc, 1);
	}

	int
	keydb_search_issuer (ctrl_t ctrl, KEYDB_HANDLE hd, const char *issuer)
	{
	KEYDB_SEARCH_DESC desc;
	int rc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_ISSUER;
	desc.u.name = issuer;
	rc = keydb_search (ctrl, hd, &desc, 1);
	return rc;
	}

	int
	keydb_search_issuer_sn (ctrl_t ctrl, KEYDB_HANDLE hd,
	const char *issuer, ksba_const_sexp_t serial)
	{
	KEYDB_SEARCH_DESC desc;
	int rc;
	const unsigned char *s;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_ISSUER_SN;
	s = serial;
	if (*s !='(')
	return gpg_error (GPG_ERR_INV_VALUE);
	s++;
	for (desc.snlen = 0; digitp (s); s++)
	desc.snlen = 10*desc.snlen + atoi_1 (s);
	if (*s !=':')
	return gpg_error (GPG_ERR_INV_VALUE);
	desc.sn = s+1;
	desc.u.name = issuer;
	rc = keydb_search (ctrl, hd, &desc, 1);
	return rc;
	}

	int
	keydb_search_subject (ctrl_t ctrl, KEYDB_HANDLE hd, const char *name)
	{
	KEYDB_SEARCH_DESC desc;
	int rc;

	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_SUBJECT;
	desc.u.name = name;
	rc = keydb_search (ctrl, hd, &desc, 1);
	return rc;
	}



	/* Store the certificate in the key DB but make sure that it does not
	already exists. We do this simply by comparing the fingerprint.
	If EXISTED is not NULL it will be set to true if the certificate
	was already in the DB. */
	int
	keydb_store_cert (ctrl_t ctrl, ksba_cert_t cert, int ephemeral, int *existed)
	{
	KEYDB_HANDLE kh;
	int rc;
	unsigned char fpr[20];

	if (existed)
	*existed = 0;

	if (!gpgsm_get_fingerprint (cert, 0, fpr, NULL))
	{
	log_error (_("failed to get the fingerprint\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}

	kh = keydb_new ();
	if (!kh)
	{
	log_error (_("failed to allocate keyDB handle\n"));
	return gpg_error (GPG_ERR_ENOMEM);;
	}

	/* Set the ephemeral flag so that the search looks at all
	records. */
	keydb_set_ephemeral (kh, 1);

	rc = lock_all (kh);
	if (rc)
	return rc;

	rc = keydb_search_fpr (ctrl, kh, fpr);
	if (rc != -1)
	{
	keydb_release (kh);
	if (!rc)
	{
	if (existed)
	*existed = 1;
	if (!ephemeral)
	{
	/* Remove ephemeral flags from existing certificate to "store"
	it permanently. */
	rc = keydb_set_cert_flags (ctrl, cert, 1, KEYBOX_FLAG_BLOB, 0,
	KEYBOX_FLAG_BLOB_EPHEMERAL, 0);
	if (rc)
	{
	log_error ("clearing ephemeral flag failed: %s\n",
	gpg_strerror (rc));
	return rc;
	}
	}
	return 0; /* okay */
	}
	log_error (_("problem looking for existing certificate: %s\n"),
	gpg_strerror (rc));
	return rc;
	}

	/* Reset the ephemeral flag if not requested. */
	if (!ephemeral)
	keydb_set_ephemeral (kh, 0);

	rc = keydb_locate_writable (kh, 0);
	if (rc)
	{
	log_error (_("error finding writable keyDB: %s\n"), gpg_strerror (rc));
	keydb_release (kh);
	return rc;
	}

	rc = keydb_insert_cert (kh, cert);
	if (rc)
	{
	log_error (_("error storing certificate: %s\n"), gpg_strerror (rc));
	keydb_release (kh);
	return rc;
	}
	keydb_release (kh);
	return 0;
	}


	/* This is basically keydb_set_flags but it implements a complete
	transaction by locating the certificate in the DB and updating the
	flags. */
	gpg_error_t
	keydb_set_cert_flags (ctrl_t ctrl, ksba_cert_t cert, int ephemeral,
	int which, int idx,
	unsigned int mask, unsigned int value)
	{
	KEYDB_HANDLE kh;
	gpg_error_t err;
	unsigned char fpr[20];
	unsigned int old_value;

	if (!gpgsm_get_fingerprint (cert, 0, fpr, NULL))
	{
	log_error (_("failed to get the fingerprint\n"));
	return gpg_error (GPG_ERR_GENERAL);
	}

	kh = keydb_new ();
	if (!kh)
	{
	log_error (_("failed to allocate keyDB handle\n"));
	return gpg_error (GPG_ERR_ENOMEM);;
	}

	if (ephemeral)
	keydb_set_ephemeral (kh, 1);

	err = keydb_lock (kh);
	if (err)
	{
	log_error (_("error locking keybox: %s\n"), gpg_strerror (err));
	keydb_release (kh);
	return err;
	}

	err = keydb_search_fpr (ctrl, kh, fpr);
	if (err)
	{
	if (err == -1)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	else
	log_error (_("problem re-searching certificate: %s\n"),
	gpg_strerror (err));
	keydb_release (kh);
	return err;
	}

	err = keydb_get_flags (kh, which, idx, &old_value);
	if (err)
	{
	log_error (_("error getting stored flags: %s\n"), gpg_strerror (err));
	keydb_release (kh);
	return err;
	}

	value = ((old_value & ~mask) \| (value & mask));

	if (value != old_value)
	{
	err = keydb_set_flags (kh, which, idx, value);
	if (err)
	{
	log_error (_("error storing flags: %s\n"), gpg_strerror (err));
	keydb_release (kh);
	return err;
	}
	}

	keydb_release (kh);
	return 0;
	}


	/* Reset all the certificate flags we have stored with the certificates
	for performance reasons. */
	void
	keydb_clear_some_cert_flags (ctrl_t ctrl, strlist_t names)
	{
	gpg_error_t err;
	KEYDB_HANDLE hd = NULL;
	KEYDB_SEARCH_DESC *desc = NULL;
	int ndesc;
	strlist_t sl;
	int rc=0;
	unsigned int old_value, value;

	(void)ctrl;

	hd = keydb_new ();
	if (!hd)
	{
	log_error ("keydb_new failed\n");
	goto leave;
	}

	if (!names)
	ndesc = 1;
	else
	{
	for (sl=names, ndesc=0; sl; sl = sl->next, ndesc++)
	;
	}

	desc = xtrycalloc (ndesc, sizeof *desc);
	if (!ndesc)
	{
	log_error ("allocating memory failed: %s\n",
	gpg_strerror (out_of_core ()));
	goto leave;
	}

	if (!names)
	desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
	else
	{
	for (ndesc=0, sl=names; sl; sl = sl->next)
	{
	rc = classify_user_id (sl->d, desc+ndesc, 0);
	if (rc)
	log_error ("key '%s' not found: %s\n", sl->d, gpg_strerror (rc));
	else
	ndesc++;
	}
	}

	err = keydb_lock (hd);
	if (err)
	{
	log_error (_("error locking keybox: %s\n"), gpg_strerror (err));
	goto leave;
	}

	while (!(rc = keydb_search (ctrl, hd, desc, ndesc)))
	{
	if (!names)
	desc[0].mode = KEYDB_SEARCH_MODE_NEXT;

	err = keydb_get_flags (hd, KEYBOX_FLAG_VALIDITY, 0, &old_value);
	if (err)
	{
	log_error (_("error getting stored flags: %s\n"),
	gpg_strerror (err));
	goto leave;
	}

	value = (old_value & ~VALIDITY_REVOKED);
	if (value != old_value)
	{
	err = keydb_set_flags (hd, KEYBOX_FLAG_VALIDITY, 0, value);
	if (err)
	{
	log_error (_("error storing flags: %s\n"), gpg_strerror (err));
	goto leave;
	}
	}
	}
	if (rc && rc != -1)
	log_error ("keydb_search failed: %s\n", gpg_strerror (rc));

	leave:
	xfree (desc);
	keydb_release (hd);
	}
	diff --git a/sm/keylist.c b/sm/keylist.c
	index 88a9c4fef..6db42e3f6 100644
	--- a/sm/keylist.c
	+++ b/sm/keylist.c
	@@ -1,1586 +1,1586 @@
	/* keylist.c - Print certificates in various formats.
	* Copyright (C) 1998, 1999, 2000, 2001, 2003, 2004, 2005, 2008, 2009,
	* 2010, 2011 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <unistd.h>
	#include <time.h>
	#include <assert.h>

	#include "gpgsm.h"

	#include <gcrypt.h>
	#include <ksba.h>

	#include "keydb.h"
	#include "../kbx/keybox.h" /* for KEYBOX_FLAG_* */
	#include "i18n.h"
	#include "tlv.h"

	struct list_external_parm_s
	{
	ctrl_t ctrl;
	estream_t fp;
	int print_header;
	int with_colons;
	int with_chain;
	int raw_mode;
	};


	/* This table is to map Extended Key Usage OIDs to human readable
	names. */
	struct
	{
	const char *oid;
	const char *name;
	} key_purpose_map[] = {
	{ "1.3.6.1.5.5.7.3.1", "serverAuth" },
	{ "1.3.6.1.5.5.7.3.2", "clientAuth" },
	{ "1.3.6.1.5.5.7.3.3", "codeSigning" },
	{ "1.3.6.1.5.5.7.3.4", "emailProtection" },
	{ "1.3.6.1.5.5.7.3.5", "ipsecEndSystem" },
	{ "1.3.6.1.5.5.7.3.6", "ipsecTunnel" },
	{ "1.3.6.1.5.5.7.3.7", "ipsecUser" },
	{ "1.3.6.1.5.5.7.3.8", "timeStamping" },
	{ "1.3.6.1.5.5.7.3.9", "ocspSigning" },
	{ "1.3.6.1.5.5.7.3.10", "dvcs" },
	{ "1.3.6.1.5.5.7.3.11", "sbgpCertAAServerAuth" },
	{ "1.3.6.1.5.5.7.3.13", "eapOverPPP" },
	{ "1.3.6.1.5.5.7.3.14", "wlanSSID" },

	{ "2.16.840.1.113730.4.1", "serverGatedCrypto.ns" }, /* Netscape. */
	{ "1.3.6.1.4.1.311.10.3.3", "serverGatedCrypto.ms"}, /* Microsoft. */

	{ "1.3.6.1.5.5.7.48.1.5", "ocspNoCheck" },

	{ NULL, NULL }
	};


	/* Do not print this extension in the list of extensions. This is set
	for oids which are already available via ksba fucntions. */
	#define OID_FLAG_SKIP 1
	/* The extension is a simple UTF8String and should be printed. */
	#define OID_FLAG_UTF8 2

	/* A table mapping OIDs to a descriptive string. */
	static struct
	{
	char *oid;
	char *name;
	unsigned int flag; /* A flag as described above. */
	} oidtranstbl[] = {

	/* Algorithms. */
	{ "1.2.840.10040.4.1", "dsa" },
	{ "1.2.840.10040.4.3", "dsaWithSha1" },

	{ "1.2.840.113549.1.1.1", "rsaEncryption" },
	{ "1.2.840.113549.1.1.2", "md2WithRSAEncryption" },
	{ "1.2.840.113549.1.1.3", "md4WithRSAEncryption" },
	{ "1.2.840.113549.1.1.4", "md5WithRSAEncryption" },
	{ "1.2.840.113549.1.1.5", "sha1WithRSAEncryption" },
	{ "1.2.840.113549.1.1.7", "rsaOAEP" },
	{ "1.2.840.113549.1.1.8", "rsaOAEP-MGF" },
	{ "1.2.840.113549.1.1.9", "rsaOAEP-pSpecified" },
	{ "1.2.840.113549.1.1.10", "rsaPSS" },
	{ "1.2.840.113549.1.1.11", "sha256WithRSAEncryption" },
	{ "1.2.840.113549.1.1.12", "sha384WithRSAEncryption" },
	{ "1.2.840.113549.1.1.13", "sha512WithRSAEncryption" },

	{ "1.3.14.3.2.26", "sha1" },
	{ "1.3.14.3.2.29", "sha-1WithRSAEncryption" },
	{ "1.3.36.3.3.1.2", "rsaSignatureWithripemd160" },


	/* Telesec extensions. */
	{ "0.2.262.1.10.12.0", "certExtensionLiabilityLimitationExt" },
	{ "0.2.262.1.10.12.1", "telesecCertIdExt" },
	{ "0.2.262.1.10.12.2", "telesecPolicyIdentifier" },
	{ "0.2.262.1.10.12.3", "telesecPolicyQualifierID" },
	{ "0.2.262.1.10.12.4", "telesecCRLFilteredExt" },
	{ "0.2.262.1.10.12.5", "telesecCRLFilterExt"},
	{ "0.2.262.1.10.12.6", "telesecNamingAuthorityExt" },
	#define OIDSTR_restriction \
	"1.3.36.8.3.8"
	{ OIDSTR_restriction, "restriction", OID_FLAG_UTF8 },


	/* PKIX private extensions. */
	{ "1.3.6.1.5.5.7.1.1", "authorityInfoAccess" },
	{ "1.3.6.1.5.5.7.1.2", "biometricInfo" },
	{ "1.3.6.1.5.5.7.1.3", "qcStatements" },
	{ "1.3.6.1.5.5.7.1.4", "acAuditIdentity" },
	{ "1.3.6.1.5.5.7.1.5", "acTargeting" },
	{ "1.3.6.1.5.5.7.1.6", "acAaControls" },
	{ "1.3.6.1.5.5.7.1.7", "sbgp-ipAddrBlock" },
	{ "1.3.6.1.5.5.7.1.8", "sbgp-autonomousSysNum" },
	{ "1.3.6.1.5.5.7.1.9", "sbgp-routerIdentifier" },
	{ "1.3.6.1.5.5.7.1.10", "acProxying" },
	{ "1.3.6.1.5.5.7.1.11", "subjectInfoAccess" },

	{ "1.3.6.1.5.5.7.48.1", "ocsp" },
	{ "1.3.6.1.5.5.7.48.2", "caIssuers" },
	{ "1.3.6.1.5.5.7.48.3", "timeStamping" },
	{ "1.3.6.1.5.5.7.48.5", "caRepository" },

	/* X.509 id-ce */
	{ "2.5.29.14", "subjectKeyIdentifier", OID_FLAG_SKIP},
	{ "2.5.29.15", "keyUsage", OID_FLAG_SKIP},
	{ "2.5.29.16", "privateKeyUsagePeriod" },
	{ "2.5.29.17", "subjectAltName", OID_FLAG_SKIP},
	{ "2.5.29.18", "issuerAltName", OID_FLAG_SKIP},
	{ "2.5.29.19", "basicConstraints", OID_FLAG_SKIP},
	{ "2.5.29.20", "cRLNumber" },
	{ "2.5.29.21", "cRLReason" },
	{ "2.5.29.22", "expirationDate" },
	{ "2.5.29.23", "instructionCode" },
	{ "2.5.29.24", "invalidityDate" },
	{ "2.5.29.27", "deltaCRLIndicator" },
	{ "2.5.29.28", "issuingDistributionPoint" },
	{ "2.5.29.29", "certificateIssuer" },
	{ "2.5.29.30", "nameConstraints" },
	{ "2.5.29.31", "cRLDistributionPoints", OID_FLAG_SKIP},
	{ "2.5.29.32", "certificatePolicies", OID_FLAG_SKIP},
	{ "2.5.29.32.0", "anyPolicy" },
	{ "2.5.29.33", "policyMappings" },
	{ "2.5.29.35", "authorityKeyIdentifier", OID_FLAG_SKIP},
	{ "2.5.29.36", "policyConstraints" },
	{ "2.5.29.37", "extKeyUsage", OID_FLAG_SKIP},
	{ "2.5.29.46", "freshestCRL" },
	{ "2.5.29.54", "inhibitAnyPolicy" },

	/* Netscape certificate extensions. */
	{ "2.16.840.1.113730.1.1", "netscape-cert-type" },
	{ "2.16.840.1.113730.1.2", "netscape-base-url" },
	{ "2.16.840.1.113730.1.3", "netscape-revocation-url" },
	{ "2.16.840.1.113730.1.4", "netscape-ca-revocation-url" },
	{ "2.16.840.1.113730.1.7", "netscape-cert-renewal-url" },
	{ "2.16.840.1.113730.1.8", "netscape-ca-policy-url" },
	{ "2.16.840.1.113730.1.9", "netscape-homePage-url" },
	{ "2.16.840.1.113730.1.10", "netscape-entitylogo" },
	{ "2.16.840.1.113730.1.11", "netscape-userPicture" },
	{ "2.16.840.1.113730.1.12", "netscape-ssl-server-name" },
	{ "2.16.840.1.113730.1.13", "netscape-comment" },

	/* GnuPG extensions */
	{ "1.3.6.1.4.1.11591.2.1.1", "pkaAddress" },
	{ "1.3.6.1.4.1.11591.2.2.1", "standaloneCertificate" },
	{ "1.3.6.1.4.1.11591.2.2.2", "wellKnownPrivateKey" },

	/* Extensions used by the Bundesnetzagentur. */
	{ "1.3.6.1.4.1.8301.3.5", "validityModel" },

	{ NULL }
	};


	/* Return the description for OID; if no description is available
	NULL is returned. */
	static const char *
	get_oid_desc (const char oid, unsigned int flag)
	{
	int i;

	if (oid)
	for (i=0; oidtranstbl[i].oid; i++)
	if (!strcmp (oidtranstbl[i].oid, oid))
	{
	if (flag)
	*flag = oidtranstbl[i].flag;
	return oidtranstbl[i].name;
	}
	if (flag)
	*flag = 0;
	return NULL;
	}


	static void
	print_key_data (ksba_cert_t cert, estream_t fp)
	{
	#if 0
	int n = pk ? pubkey_get_npkey( pk->pubkey_algo ) : 0;
	int i;

	for(i=0; i < n; i++ )
	{
	es_fprintf (fp, "pkd:%d:%u:", i, mpi_get_nbits( pk->pkey[i] ) );
	mpi_print(stdout, pk->pkey[i], 1 );
	putchar(':');
	putchar('\n');
	}
	#else
	(void)cert;
	(void)fp;
	#endif
	}

	static void
	print_capabilities (ksba_cert_t cert, estream_t fp)
	{
	gpg_error_t err;
	unsigned int use;
	size_t buflen;
	char buffer[1];

	err = ksba_cert_get_user_data (cert, "is_qualified",
	&buffer, sizeof (buffer), &buflen);
	if (!err && buflen)
	{
	if (*buffer)
	es_putc ('q', fp);
	}
	else if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	; /* Don't know - will not get marked as 'q' */
	else
	log_debug ("get_user_data(is_qualified) failed: %s\n",
	gpg_strerror (err));

	err = ksba_cert_get_key_usage (cert, &use);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	{
	es_putc ('e', fp);
	es_putc ('s', fp);
	es_putc ('c', fp);
	es_putc ('E', fp);
	es_putc ('S', fp);
	es_putc ('C', fp);
	return;
	}
	if (err)
	{
	log_error (_("error getting key usage information: %s\n"),
	gpg_strerror (err));
	return;
	}

	if ((use & (KSBA_KEYUSAGE_KEY_ENCIPHERMENT\|KSBA_KEYUSAGE_DATA_ENCIPHERMENT)))
	es_putc ('e', fp);
	if ((use & (KSBA_KEYUSAGE_DIGITAL_SIGNATURE\|KSBA_KEYUSAGE_NON_REPUDIATION)))
	es_putc ('s', fp);
	if ((use & KSBA_KEYUSAGE_KEY_CERT_SIGN))
	es_putc ('c', fp);
	if ((use & (KSBA_KEYUSAGE_KEY_ENCIPHERMENT\|KSBA_KEYUSAGE_DATA_ENCIPHERMENT)))
	es_putc ('E', fp);
	if ((use & (KSBA_KEYUSAGE_DIGITAL_SIGNATURE\|KSBA_KEYUSAGE_NON_REPUDIATION)))
	es_putc ('S', fp);
	if ((use & KSBA_KEYUSAGE_KEY_CERT_SIGN))
	es_putc ('C', fp);

	es_putc (':', fp);
	}


	static void
	print_time (gnupg_isotime_t t, estream_t fp)
	{
	if (!t \|\| !*t)
	;
	else
	es_fputs (t, fp);
	}


	/* Return an allocated string with the email address extracted from a
	DN. Note hat we use this code also in ../kbx/keybox-blob.c. */
	static char *
	email_kludge (const char *name)
	{
	const char p, string;
	unsigned char *buf;
	int n;

	string = name;
	for (;;)
	{
	p = strstr (string, "1.2.840.113549.1.9.1=#");
	if (!p)
	return NULL;
	if (p == name \|\| (p > string+1 && p[-1] == ',' && p[-2] != '\\'))
	{
	name = p + 22;
	break;
	}
	string = p + 22;
	}


	/* This looks pretty much like an email address in the subject's DN
	we use this to add an additional user ID entry. This way,
	OpenSSL generated keys get a nicer and usable listing. */
	for (n=0, p=name; hexdigitp (p) && hexdigitp (p+1); p +=2, n++)
	;
	if (!n)
	return NULL;
	buf = xtrymalloc (n+3);
	if (!buf)
	return NULL; /* oops, out of core */
	*buf = '<';
	for (n=1, p=name; hexdigitp (p); p +=2, n++)
	buf[n] = xtoi_2 (p);
	buf[n++] = '>';
	buf[n] = 0;
	return (char*)buf;
	}




	/* List one certificate in colon mode */
	static void
	list_cert_colon (ctrl_t ctrl, ksba_cert_t cert, unsigned int validity,
	estream_t fp, int have_secret)
	{
	int rc;
	int idx;
	char truststring[2];
	char *p;
	ksba_sexp_t sexp;
	char *fpr;
	ksba_isotime_t t;
	gpg_error_t valerr;
	int algo;
	unsigned int nbits;
	const char *chain_id;
	char *chain_id_buffer = NULL;
	int is_root = 0;
	char *kludge_uid;

	if (ctrl->with_validation)
	valerr = gpgsm_validate_chain (ctrl, cert, "", NULL, 1, NULL, 0, NULL);
	else
	valerr = 0;


	/* We need to get the fingerprint and the chaining ID in advance. */
	fpr = gpgsm_get_fingerprint_hexstring (cert, GCRY_MD_SHA1);
	{
	ksba_cert_t next;

	rc = gpgsm_walk_cert_chain (ctrl, cert, &next);
	if (!rc) /* We known the issuer's certificate. */
	{
	p = gpgsm_get_fingerprint_hexstring (next, GCRY_MD_SHA1);
	chain_id_buffer = p;
	chain_id = chain_id_buffer;
	ksba_cert_release (next);
	}
	else if (rc == -1) /* We have reached the root certificate. */
	{
	chain_id = fpr;
	is_root = 1;
	}
	else
	chain_id = NULL;
	}


	es_fputs (have_secret? "crs:":"crt:", fp);

	/* Note: We can't use multiple flags, like "ei", because the
	validation check does only return one error. */
	truststring[0] = 0;
	truststring[1] = 0;
	if ((validity & VALIDITY_REVOKED)
	\|\| gpg_err_code (valerr) == GPG_ERR_CERT_REVOKED)
	*truststring = 'r';
	else if (gpg_err_code (valerr) == GPG_ERR_CERT_EXPIRED)
	*truststring = 'e';
	else
	{
	/* Lets also check whether the certificate under question
	expired. This is merely a hack until we found a proper way
	to store the expiration flag in the keybox. */
	ksba_isotime_t current_time, not_after;

	gnupg_get_isotime (current_time);
	if (!opt.ignore_expiration
	&& !ksba_cert_get_validity (cert, 1, not_after)
	&& *not_after && strcmp (current_time, not_after) > 0 )
	*truststring = 'e';
	else if (valerr)
	{
	if (gpgsm_cert_has_well_known_private_key (cert))
	truststring = 'w'; / Well, this is dummy CA. */
	else
	*truststring = 'i';
	}
	else if (ctrl->with_validation && !is_root)
	*truststring = 'f';
	}

	/* If we have no truststring yet (i.e. the certificate might be
	good) and this is a root certificate, we ask the agent whether
	this is a trusted root certificate. */
	if (!*truststring && is_root)
	{
	struct rootca_flags_s dummy_flags;

	if (gpgsm_cert_has_well_known_private_key (cert))
	truststring = 'w'; / Well, this is dummy CA. */
	else
	{
	rc = gpgsm_agent_istrusted (ctrl, cert, NULL, &dummy_flags);
	if (!rc)
	truststring = 'u'; / Yes, we trust this one (ultimately). */
	else if (gpg_err_code (rc) == GPG_ERR_NOT_TRUSTED)
	truststring = 'n'; / No, we do not trust this one. */
	/* (in case of an error we can't tell anything.) */
	}
	}

	if (*truststring)
	es_fputs (truststring, fp);

	algo = gpgsm_get_key_algo_info (cert, &nbits);
	es_fprintf (fp, ":%u:%d:%s:", nbits, algo, fpr+24);

	ksba_cert_get_validity (cert, 0, t);
	print_time (t, fp);
	es_putc (':', fp);
	ksba_cert_get_validity (cert, 1, t);
	print_time ( t, fp);
	es_putc (':', fp);
	/* Field 8, serial number: */
	if ((sexp = ksba_cert_get_serial (cert)))
	{
	int len;
	const unsigned char *s = sexp;

	if (*s == '(')
	{
	s++;
	for (len=0; s && s != ':' && digitp (s); s++)
	len = len*10 + atoi_1 (s);
	if (*s == ':')
	for (s++; len; len--, s++)
	es_fprintf (fp,"%02X", *s);
	}
	xfree (sexp);
	}
	es_putc (':', fp);
	/* Field 9, ownertrust - not used here */
	es_putc (':', fp);
	/* field 10, old user ID - we use it here for the issuer DN */
	if ((p = ksba_cert_get_issuer (cert,0)))
	{
	es_write_sanitized (fp, p, strlen (p), ":", NULL);
	xfree (p);
	}
	es_putc (':', fp);
	/* Field 11, signature class - not used */
	es_putc (':', fp);
	/* Field 12, capabilities: */
	print_capabilities (cert, fp);
	/* Field 13, not used: */
	es_putc (':', fp);
	if (have_secret \|\| ctrl->with_secret)
	{
	char *cardsn;

	p = gpgsm_get_keygrip_hexstring (cert);
	if (!gpgsm_agent_keyinfo (ctrl, p, &cardsn)
	&& (cardsn \|\| ctrl->with_secret))
	{
	/* Field 14, not used: */
	es_putc (':', fp);
	/* Field 15: Token serial number or secret key indicator. */
	if (cardsn)
	es_fputs (cardsn, fp);
	else if (ctrl->with_secret)
	es_putc ('+', fp);
	es_putc (':', fp);
	}
	xfree (cardsn);
	xfree (p);
	}
	es_putc ('\n', fp);

	/* FPR record */
	es_fprintf (fp, "fpr:::::::::%s:::", fpr);
	/* Print chaining ID (field 13)*/
	if (chain_id)
	es_fputs (chain_id, fp);
	es_putc (':', fp);
	es_putc ('\n', fp);
	xfree (fpr); fpr = NULL; chain_id = NULL;
	xfree (chain_id_buffer); chain_id_buffer = NULL;

	if (opt.with_key_data)
	{
	if ( (p = gpgsm_get_keygrip_hexstring (cert)))
	{
	es_fprintf (fp, "grp:::::::::%s:\n", p);
	xfree (p);
	}
	print_key_data (cert, fp);
	}

	kludge_uid = NULL;
	for (idx=0; (p = ksba_cert_get_subject (cert,idx)); idx++)
	{
	/* In the case that the same email address is in the subject DN
	as well as in an alternate subject name we avoid printing it
	a second time. */
	if (kludge_uid && !strcmp (kludge_uid, p))
	continue;

	es_fprintf (fp, "uid:%s::::::::", truststring);
	es_write_sanitized (fp, p, strlen (p), ":", NULL);
	es_putc (':', fp);
	es_putc (':', fp);
	es_putc ('\n', fp);
	if (!idx)
	{
	/* It would be better to get the faked email address from
	the keydb. But as long as we don't have a way to pass
	the meta data back, we just check it the same way as the
	code used to create the keybox meta data does */
	kludge_uid = email_kludge (p);
	if (kludge_uid)
	{
	es_fprintf (fp, "uid:%s::::::::", truststring);
	es_write_sanitized (fp, kludge_uid, strlen (kludge_uid),
	":", NULL);
	es_putc (':', fp);
	es_putc (':', fp);
	es_putc ('\n', fp);
	}
	}
	xfree (p);
	}
	xfree (kludge_uid);
	}


	static void
	print_name_raw (estream_t fp, const char *string)
	{
	if (!string)
	es_fputs ("[error]", fp);
	else
	es_write_sanitized (fp, string, strlen (string), NULL, NULL);
	}

	static void
	print_names_raw (estream_t fp, int indent, ksba_name_t name)
	{
	int idx;
	const char *s;
	int indent_all;

	if ((indent_all = (indent < 0)))
	indent = - indent;

	if (!name)
	{
	es_fputs ("none\n", fp);
	return;
	}

	for (idx=0; (s = ksba_name_enum (name, idx)); idx++)
	{
	char *p = ksba_name_get_uri (name, idx);
	es_fprintf (fp, "%*s", idx\|\|indent_all?indent:0, "");
	es_write_sanitized (fp, p?p:s, strlen (p?p:s), NULL, NULL);
	es_putc ('\n', fp);
	xfree (p);
	}
	}


	static void
	print_utf8_extn_raw (estream_t fp, int indent,
	const unsigned char *der, size_t derlen)
	{
	gpg_error_t err;
	int class, tag, constructed, ndef;
	size_t objlen, hdrlen;

	if (indent < 0)
	indent = - indent;

	err = parse_ber_header (&der, &derlen, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (!err && (objlen > derlen \|\| tag != TAG_UTF8_STRING))
	err = gpg_error (GPG_ERR_INV_OBJ);
	if (err)
	{
	es_fprintf (fp, "%*s[%s]\n", indent, "", gpg_strerror (err));
	return;
	}
	es_fprintf (fp, "%s(%.s)\n", indent, "", (int)objlen, der);
	}


	static void
	print_utf8_extn (estream_t fp, int indent,
	const unsigned char *der, size_t derlen)
	{
	gpg_error_t err;
	int class, tag, constructed, ndef;
	size_t objlen, hdrlen;
	int indent_all;

	if ((indent_all = (indent < 0)))
	indent = - indent;

	err = parse_ber_header (&der, &derlen, &class, &tag, &constructed,
	&ndef, &objlen, &hdrlen);
	if (!err && (objlen > derlen \|\| tag != TAG_UTF8_STRING))
	err = gpg_error (GPG_ERR_INV_OBJ);
	if (err)
	{
	es_fprintf (fp, "%*s[%s%s]\n",
	indent_all? indent:0, "", _("Error - "), gpg_strerror (err));
	return;
	}
	es_fprintf (fp, "%*s\"", indent_all? indent:0, "");
	/* Fixme: we should implement word wrapping */
	es_write_sanitized (fp, der, objlen, "\"", NULL);
	es_fputs ("\"\n", fp);
	}


	/* List one certificate in raw mode useful to have a closer look at
	the certificate. This one does no beautification and only minimal
	output sanitation. It is mainly useful for debugging. */
	static void
	list_cert_raw (ctrl_t ctrl, KEYDB_HANDLE hd,
	ksba_cert_t cert, estream_t fp, int have_secret,
	int with_validation)
	{
	gpg_error_t err;
	size_t off, len;
	ksba_sexp_t sexp, keyid;
	char *dn;
	ksba_isotime_t t;
	int idx, i;
	int is_ca, chainlen;
	unsigned int kusage;
	char string, p, *pend;
	const char oid, s;
	ksba_name_t name, name2;
	unsigned int reason;
	const unsigned char *cert_der = NULL;

	(void)have_secret;

	es_fprintf (fp, " ID: 0x%08lX\n",
	gpgsm_get_short_fingerprint (cert, NULL));

	sexp = ksba_cert_get_serial (cert);
	es_fputs (" S/N: ", fp);
	gpgsm_print_serial (fp, sexp);
	ksba_free (sexp);
	es_putc ('\n', fp);

	dn = ksba_cert_get_issuer (cert, 0);
	es_fputs (" Issuer: ", fp);
	print_name_raw (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	for (idx=1; (dn = ksba_cert_get_issuer (cert, idx)); idx++)
	{
	es_fputs (" aka: ", fp);
	print_name_raw (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	}

	dn = ksba_cert_get_subject (cert, 0);
	es_fputs (" Subject: ", fp);
	print_name_raw (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	for (idx=1; (dn = ksba_cert_get_subject (cert, idx)); idx++)
	{
	es_fputs (" aka: ", fp);
	print_name_raw (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	}

	dn = gpgsm_get_fingerprint_string (cert, 0);
	es_fprintf (fp, " sha1_fpr: %s\n", dn?dn:"error");
	xfree (dn);

	dn = gpgsm_get_fingerprint_string (cert, GCRY_MD_MD5);
	es_fprintf (fp, " md5_fpr: %s\n", dn?dn:"error");
	xfree (dn);

	dn = gpgsm_get_certid (cert);
	es_fprintf (fp, " certid: %s\n", dn?dn:"error");
	xfree (dn);

	dn = gpgsm_get_keygrip_hexstring (cert);
	es_fprintf (fp, " keygrip: %s\n", dn?dn:"error");
	xfree (dn);

	ksba_cert_get_validity (cert, 0, t);
	es_fputs (" notBefore: ", fp);
	gpgsm_print_time (fp, t);
	es_putc ('\n', fp);
	es_fputs (" notAfter: ", fp);
	ksba_cert_get_validity (cert, 1, t);
	gpgsm_print_time (fp, t);
	es_putc ('\n', fp);

	oid = ksba_cert_get_digest_algo (cert);
	s = get_oid_desc (oid, NULL);
	es_fprintf (fp, " hashAlgo: %s%s%s%s\n", oid, s?" (":"",s?s:"",s?")":"");

	{
	const char *algoname;
	unsigned int nbits;

	algoname = gcry_pk_algo_name (gpgsm_get_key_algo_info (cert, &nbits));
	es_fprintf (fp, " keyType: %u bit %s\n",
	nbits, algoname? algoname:"?");
	}

	/* subjectKeyIdentifier */
	es_fputs (" subjKeyId: ", fp);
	err = ksba_cert_get_subj_key_id (cert, NULL, &keyid);
	if (!err \|\| gpg_err_code (err) == GPG_ERR_NO_DATA)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	es_fputs ("[none]\n", fp);
	else
	{
	gpgsm_print_serial (fp, keyid);
	ksba_free (keyid);
	es_putc ('\n', fp);
	}
	}
	else
	es_fputs ("[?]\n", fp);


	/* authorityKeyIdentifier */
	es_fputs (" authKeyId: ", fp);
	err = ksba_cert_get_auth_key_id (cert, &keyid, &name, &sexp);
	if (!err \|\| gpg_err_code (err) == GPG_ERR_NO_DATA)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_DATA \|\| !name)
	es_fputs ("[none]\n", fp);
	else
	{
	gpgsm_print_serial (fp, sexp);
	ksba_free (sexp);
	es_putc ('\n', fp);
	print_names_raw (fp, -15, name);
	ksba_name_release (name);
	}
	if (keyid)
	{
	es_fputs (" authKeyId.ki: ", fp);
	gpgsm_print_serial (fp, keyid);
	ksba_free (keyid);
	es_putc ('\n', fp);
	}
	}
	else
	es_fputs ("[?]\n", fp);

	es_fputs (" keyUsage:", fp);
	err = ksba_cert_get_key_usage (cert, &kusage);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	if (err)
	es_fprintf (fp, " [error: %s]", gpg_strerror (err));
	else
	{
	if ( (kusage & KSBA_KEYUSAGE_DIGITAL_SIGNATURE))
	es_fputs (" digitalSignature", fp);
	if ( (kusage & KSBA_KEYUSAGE_NON_REPUDIATION))
	es_fputs (" nonRepudiation", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_ENCIPHERMENT))
	es_fputs (" keyEncipherment", fp);
	if ( (kusage & KSBA_KEYUSAGE_DATA_ENCIPHERMENT))
	es_fputs (" dataEncipherment", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_AGREEMENT))
	es_fputs (" keyAgreement", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_CERT_SIGN))
	es_fputs (" certSign", fp);
	if ( (kusage & KSBA_KEYUSAGE_CRL_SIGN))
	es_fputs (" crlSign", fp);
	if ( (kusage & KSBA_KEYUSAGE_ENCIPHER_ONLY))
	es_fputs (" encipherOnly", fp);
	if ( (kusage & KSBA_KEYUSAGE_DECIPHER_ONLY))
	es_fputs (" decipherOnly", fp);
	}
	es_putc ('\n', fp);
	}
	else
	es_fputs (" [none]\n", fp);

	es_fputs (" extKeyUsage: ", fp);
	err = ksba_cert_get_ext_key_usages (cert, &string);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else
	{
	p = string;
	while (p && (pend=strchr (p, ':')))
	{
	*pend++ = 0;
	for (i=0; key_purpose_map[i].oid; i++)
	if ( !strcmp (key_purpose_map[i].oid, p) )
	break;
	es_fputs (key_purpose_map[i].oid?key_purpose_map[i].name:p, fp);
	p = pend;
	if (*p != 'C')
	es_fputs (" (suggested)", fp);
	if ((p = strchr (p, '\n')))
	{
	p++;
	es_fputs ("\n ", fp);
	}
	}
	xfree (string);
	}
	es_putc ('\n', fp);
	}
	else
	es_fputs ("[none]\n", fp);


	es_fputs (" policies: ", fp);
	err = ksba_cert_get_cert_policies (cert, &string);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else
	{
	p = string;
	while (p && (pend=strchr (p, ':')))
	{
	*pend++ = 0;
	for (i=0; key_purpose_map[i].oid; i++)
	if ( !strcmp (key_purpose_map[i].oid, p) )
	break;
	es_fputs (p, fp);
	p = pend;
	if (*p == 'C')
	es_fputs (" (critical)", fp);
	if ((p = strchr (p, '\n')))
	{
	p++;
	es_fputs ("\n ", fp);
	}
	}
	xfree (string);
	}
	es_putc ('\n', fp);
	}
	else
	es_fputs ("[none]\n", fp);

	es_fputs (" chainLength: ", fp);
	err = ksba_cert_is_ca (cert, &is_ca, &chainlen);
	if (err \|\| is_ca)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_VALUE )
	es_fprintf (fp, "[none]");
	else if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else if (chainlen == -1)
	es_fputs ("unlimited", fp);
	else
	es_fprintf (fp, "%d", chainlen);
	es_putc ('\n', fp);
	}
	else
	es_fputs ("not a CA\n", fp);


	/* CRL distribution point */
	for (idx=0; !(err=ksba_cert_get_crl_dist_point (cert, idx, &name, &name2,
	&reason)) ;idx++)
	{
	es_fputs (" crlDP: ", fp);
	print_names_raw (fp, 15, name);
	if (reason)
	{
	es_fputs (" reason: ", fp);
	if ( (reason & KSBA_CRLREASON_UNSPECIFIED))
	es_fputs (" unused", fp);
	if ( (reason & KSBA_CRLREASON_KEY_COMPROMISE))
	es_fputs (" keyCompromise", fp);
	if ( (reason & KSBA_CRLREASON_CA_COMPROMISE))
	es_fputs (" caCompromise", fp);
	if ( (reason & KSBA_CRLREASON_AFFILIATION_CHANGED))
	es_fputs (" affiliationChanged", fp);
	if ( (reason & KSBA_CRLREASON_SUPERSEDED))
	es_fputs (" superseded", fp);
	if ( (reason & KSBA_CRLREASON_CESSATION_OF_OPERATION))
	es_fputs (" cessationOfOperation", fp);
	if ( (reason & KSBA_CRLREASON_CERTIFICATE_HOLD))
	es_fputs (" certificateHold", fp);
	es_putc ('\n', fp);
	}
	es_fputs (" issuer: ", fp);
	print_names_raw (fp, 23, name2);
	ksba_name_release (name);
	ksba_name_release (name2);
	}
	if (err && gpg_err_code (err) != GPG_ERR_EOF
	&& gpg_err_code (err) != GPG_ERR_NO_VALUE)
	es_fputs (" crlDP: [error]\n", fp);
	else if (!idx)
	es_fputs (" crlDP: [none]\n", fp);


	/* authorityInfoAccess. */
	for (idx=0; !(err=ksba_cert_get_authority_info_access (cert, idx, &string,
	&name)); idx++)
	{
	es_fputs (" authInfo: ", fp);
	s = get_oid_desc (string, NULL);
	es_fprintf (fp, "%s%s%s%s\n", string, s?" (":"", s?s:"", s?")":"");
	print_names_raw (fp, -15, name);
	ksba_name_release (name);
	ksba_free (string);
	}
	if (err && gpg_err_code (err) != GPG_ERR_EOF
	&& gpg_err_code (err) != GPG_ERR_NO_VALUE)
	es_fputs (" authInfo: [error]\n", fp);
	else if (!idx)
	es_fputs (" authInfo: [none]\n", fp);

	/* subjectInfoAccess. */
	for (idx=0; !(err=ksba_cert_get_subject_info_access (cert, idx, &string,
	&name)); idx++)
	{
	es_fputs (" subjectInfo: ", fp);
	s = get_oid_desc (string, NULL);
	es_fprintf (fp, "%s%s%s%s\n", string, s?" (":"", s?s:"", s?")":"");
	print_names_raw (fp, -15, name);
	ksba_name_release (name);
	ksba_free (string);
	}
	if (err && gpg_err_code (err) != GPG_ERR_EOF
	&& gpg_err_code (err) != GPG_ERR_NO_VALUE)
	es_fputs (" subjInfo: [error]\n", fp);
	else if (!idx)
	es_fputs (" subjInfo: [none]\n", fp);


	for (idx=0; !(err=ksba_cert_get_extension (cert, idx,
	&oid, &i, &off, &len));idx++)
	{
	unsigned int flag;

	s = get_oid_desc (oid, &flag);
	if ((flag & OID_FLAG_SKIP))
	continue;

	es_fprintf (fp, " %s: %s%s%s%s [%d octets]\n",
	i? "critExtn":" extn",
	oid, s?" (":"", s?s:"", s?")":"", (int)len);
	if ((flag & OID_FLAG_UTF8))
	{
	if (!cert_der)
	cert_der = ksba_cert_get_image (cert, NULL);
	assert (cert_der);
	print_utf8_extn_raw (fp, -15, cert_der+off, len);
	}
	}


	if (with_validation)
	{
	err = gpgsm_validate_chain (ctrl, cert, "", NULL, 1, fp, 0, NULL);
	if (!err)
	es_fprintf (fp, " [certificate is good]\n");
	else
	es_fprintf (fp, " [certificate is bad: %s]\n", gpg_strerror (err));
	}

	if (hd)
	{
	unsigned int blobflags;

	err = keydb_get_flags (hd, KEYBOX_FLAG_BLOB, 0, &blobflags);
	if (err)
	es_fprintf (fp, " [error getting keyflags: %s]\n",gpg_strerror (err));
	else if ((blobflags & KEYBOX_FLAG_BLOB_EPHEMERAL))
	es_fprintf (fp, " [stored as ephemeral]\n");
	}

	}




	/* List one certificate in standard mode */
	static void
	list_cert_std (ctrl_t ctrl, ksba_cert_t cert, estream_t fp, int have_secret,
	int with_validation)
	{
	gpg_error_t err;
	ksba_sexp_t sexp;
	char *dn;
	ksba_isotime_t t;
	int idx, i;
	int is_ca, chainlen;
	unsigned int kusage;
	char string, p, *pend;
	size_t off, len;
	const char *oid;
	const unsigned char *cert_der = NULL;


	es_fprintf (fp, " ID: 0x%08lX\n",
	gpgsm_get_short_fingerprint (cert, NULL));

	sexp = ksba_cert_get_serial (cert);
	es_fputs (" S/N: ", fp);
	gpgsm_print_serial (fp, sexp);
	ksba_free (sexp);
	es_putc ('\n', fp);

	dn = ksba_cert_get_issuer (cert, 0);
	es_fputs (" Issuer: ", fp);
	gpgsm_es_print_name (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	for (idx=1; (dn = ksba_cert_get_issuer (cert, idx)); idx++)
	{
	es_fputs (" aka: ", fp);
	gpgsm_es_print_name (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	}

	dn = ksba_cert_get_subject (cert, 0);
	es_fputs (" Subject: ", fp);
	gpgsm_es_print_name (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	for (idx=1; (dn = ksba_cert_get_subject (cert, idx)); idx++)
	{
	es_fputs (" aka: ", fp);
	gpgsm_es_print_name (fp, dn);
	ksba_free (dn);
	es_putc ('\n', fp);
	}

	ksba_cert_get_validity (cert, 0, t);
	es_fputs (" validity: ", fp);
	gpgsm_print_time (fp, t);
	es_fputs (" through ", fp);
	ksba_cert_get_validity (cert, 1, t);
	gpgsm_print_time (fp, t);
	es_putc ('\n', fp);


	{
	const char *algoname;
	unsigned int nbits;

	algoname = gcry_pk_algo_name (gpgsm_get_key_algo_info (cert, &nbits));
	es_fprintf (fp, " key type: %u bit %s\n",
	nbits, algoname? algoname:"?");
	}


	err = ksba_cert_get_key_usage (cert, &kusage);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	es_fputs (" key usage:", fp);
	if (err)
	es_fprintf (fp, " [error: %s]", gpg_strerror (err));
	else
	{
	if ( (kusage & KSBA_KEYUSAGE_DIGITAL_SIGNATURE))
	es_fputs (" digitalSignature", fp);
	if ( (kusage & KSBA_KEYUSAGE_NON_REPUDIATION))
	es_fputs (" nonRepudiation", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_ENCIPHERMENT))
	es_fputs (" keyEncipherment", fp);
	if ( (kusage & KSBA_KEYUSAGE_DATA_ENCIPHERMENT))
	es_fputs (" dataEncipherment", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_AGREEMENT))
	es_fputs (" keyAgreement", fp);
	if ( (kusage & KSBA_KEYUSAGE_KEY_CERT_SIGN))
	es_fputs (" certSign", fp);
	if ( (kusage & KSBA_KEYUSAGE_CRL_SIGN))
	es_fputs (" crlSign", fp);
	if ( (kusage & KSBA_KEYUSAGE_ENCIPHER_ONLY))
	es_fputs (" encipherOnly", fp);
	if ( (kusage & KSBA_KEYUSAGE_DECIPHER_ONLY))
	es_fputs (" decipherOnly", fp);
	}
	es_putc ('\n', fp);
	}

	err = ksba_cert_get_ext_key_usages (cert, &string);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	es_fputs ("ext key usage: ", fp);
	if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else
	{
	p = string;
	while (p && (pend=strchr (p, ':')))
	{
	*pend++ = 0;
	for (i=0; key_purpose_map[i].oid; i++)
	if ( !strcmp (key_purpose_map[i].oid, p) )
	break;
	es_fputs (key_purpose_map[i].oid?key_purpose_map[i].name:p, fp);
	p = pend;
	if (*p != 'C')
	es_fputs (" (suggested)", fp);
	if ((p = strchr (p, '\n')))
	{
	p++;
	es_fputs (", ", fp);
	}
	}
	xfree (string);
	}
	es_putc ('\n', fp);
	}

	/* Print restrictions. */
	for (idx=0; !(err=ksba_cert_get_extension (cert, idx,
	&oid, NULL, &off, &len));idx++)
	{
	if (!strcmp (oid, OIDSTR_restriction) )
	{
	if (!cert_der)
	cert_der = ksba_cert_get_image (cert, NULL);
	assert (cert_der);
	es_fputs (" restriction: ", fp);
	print_utf8_extn (fp, 15, cert_der+off, len);
	}
	}

	/* Print policies. */
	err = ksba_cert_get_cert_policies (cert, &string);
	if (gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	es_fputs (" policies: ", fp);
	if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else
	{
	for (p=string; *p; p++)
	{
	if (*p == '\n')
	*p = ',';
	}
	es_write_sanitized (fp, string, strlen (string), NULL, NULL);
	xfree (string);
	}
	es_putc ('\n', fp);
	}

	err = ksba_cert_is_ca (cert, &is_ca, &chainlen);
	if (err \|\| is_ca)
	{
	es_fputs (" chain length: ", fp);
	if (gpg_err_code (err) == GPG_ERR_NO_VALUE )
	es_fprintf (fp, "none");
	else if (err)
	es_fprintf (fp, "[error: %s]", gpg_strerror (err));
	else if (chainlen == -1)
	es_fputs ("unlimited", fp);
	else
	es_fprintf (fp, "%d", chainlen);
	es_putc ('\n', fp);
	}

	if (opt.with_md5_fingerprint)
	{
	dn = gpgsm_get_fingerprint_string (cert, GCRY_MD_MD5);
	es_fprintf (fp, " md5 fpr: %s\n", dn?dn:"error");
	xfree (dn);
	}

	dn = gpgsm_get_fingerprint_string (cert, 0);
	es_fprintf (fp, " fingerprint: %s\n", dn?dn:"error");
	xfree (dn);

	if (opt.with_keygrip)
	{
	dn = gpgsm_get_keygrip_hexstring (cert);
	if (dn)
	{
	es_fprintf (fp, " keygrip: %s\n", dn);
	xfree (dn);
	}
	}

	if (have_secret)
	{
	char *cardsn;

	p = gpgsm_get_keygrip_hexstring (cert);
	if (!gpgsm_agent_keyinfo (ctrl, p, &cardsn) && cardsn)
	es_fprintf (fp, " card s/n: %s\n", cardsn);
	xfree (cardsn);
	xfree (p);
	}

	if (with_validation)
	{
	gpg_error_t tmperr;
	size_t buflen;
	char buffer[1];

	err = gpgsm_validate_chain (ctrl, cert, "", NULL, 1, fp, 0, NULL);
	tmperr = ksba_cert_get_user_data (cert, "is_qualified",
	&buffer, sizeof (buffer), &buflen);
	if (!tmperr && buflen)
	{
	if (*buffer)
	es_fputs (" [qualified]\n", fp);
	}
	else if (gpg_err_code (tmperr) == GPG_ERR_NOT_FOUND)
	; /* Don't know - will not get marked as 'q' */
	else
	log_debug ("get_user_data(is_qualified) failed: %s\n",
	gpg_strerror (tmperr));

	if (!err)
	es_fprintf (fp, " [certificate is good]\n");
	else
	es_fprintf (fp, " [certificate is bad: %s]\n", gpg_strerror (err));
	}
	}


	-/* Same as standard mode mode list all certifying certs too. */
	+/* Same as standard mode list all certifying certs too. */
	static void
	list_cert_chain (ctrl_t ctrl, KEYDB_HANDLE hd,
	ksba_cert_t cert, int raw_mode,
	estream_t fp, int with_validation)
	{
	ksba_cert_t next = NULL;

	if (raw_mode)
	list_cert_raw (ctrl, hd, cert, fp, 0, with_validation);
	else
	list_cert_std (ctrl, cert, fp, 0, with_validation);
	ksba_cert_ref (cert);
	while (!gpgsm_walk_cert_chain (ctrl, cert, &next))
	{
	ksba_cert_release (cert);
	es_fputs ("Certified by\n", fp);
	if (raw_mode)
	list_cert_raw (ctrl, hd, next, fp, 0, with_validation);
	else
	list_cert_std (ctrl, next, fp, 0, with_validation);
	cert = next;
	}
	ksba_cert_release (cert);
	es_putc ('\n', fp);
	}



	/* List all internal keys or just the keys given as NAMES. MODE is a
	bit vector to specify what keys are to be included; see
	gpgsm_list_keys (below) for details. If RAW_MODE is true, the raw
	output mode will be used instead of the standard beautified one.
	*/
	static gpg_error_t
	list_internal_keys (ctrl_t ctrl, strlist_t names, estream_t fp,
	unsigned int mode, int raw_mode)
	{
	KEYDB_HANDLE hd;
	KEYDB_SEARCH_DESC *desc = NULL;
	strlist_t sl;
	int ndesc;
	ksba_cert_t cert = NULL;
	ksba_cert_t lastcert = NULL;
	gpg_error_t rc = 0;
	const char lastresname, resname;
	int have_secret;
	int want_ephemeral = ctrl->with_ephemeral_keys;

	hd = keydb_new ();
	if (!hd)
	{
	log_error ("keydb_new failed\n");
	rc = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}

	if (!names)
	ndesc = 1;
	else
	{
	for (sl=names, ndesc=0; sl; sl = sl->next, ndesc++)
	;
	}

	desc = xtrycalloc (ndesc, sizeof *desc);
	if (!ndesc)
	{
	rc = gpg_error_from_syserror ();
	log_error ("out of core\n");
	goto leave;
	}

	if (!names)
	desc[0].mode = KEYDB_SEARCH_MODE_FIRST;
	else
	{
	for (ndesc=0, sl=names; sl; sl = sl->next)
	{
	rc = classify_user_id (sl->d, desc+ndesc, 0);
	if (rc)
	{
	log_error ("key '%s' not found: %s\n",
	sl->d, gpg_strerror (rc));
	rc = 0;
	}
	else
	ndesc++;
	}

	}

	/* If all specifications are done by fingerprint or keygrip, we
	switch to ephemeral mode so that _all_ currently available and
	matching certificates are listed. */
	if (!want_ephemeral && names && ndesc)
	{
	int i;

	for (i=0; (i < ndesc
	&& (desc[i].mode == KEYDB_SEARCH_MODE_FPR
	\|\| desc[i].mode == KEYDB_SEARCH_MODE_FPR20
	\|\| desc[i].mode == KEYDB_SEARCH_MODE_FPR16
	\|\| desc[i].mode == KEYDB_SEARCH_MODE_KEYGRIP)); i++)
	;
	if (i == ndesc)
	want_ephemeral = 1;
	}

	if (want_ephemeral)
	keydb_set_ephemeral (hd, 1);

	/* It would be nice to see which of the given users did actually
	match one in the keyring. To implement this we need to have a
	found flag for each entry in desc and to set this we must check
	all those entries after a match to mark all matched one -
	currently we stop at the first match. To do this we need an
	extra flag to enable this feature so */

	/* Suppress duplicates at least when they follow each other. */
	lastresname = NULL;
	while (!(rc = keydb_search (ctrl, hd, desc, ndesc)))
	{
	unsigned int validity;

	if (!names)
	desc[0].mode = KEYDB_SEARCH_MODE_NEXT;

	rc = keydb_get_flags (hd, KEYBOX_FLAG_VALIDITY, 0, &validity);
	if (rc)
	{
	log_error ("keydb_get_flags failed: %s\n", gpg_strerror (rc));
	goto leave;
	}
	rc = keydb_get_cert (hd, &cert);
	if (rc)
	{
	log_error ("keydb_get_cert failed: %s\n", gpg_strerror (rc));
	goto leave;
	}
	/* Skip duplicated certificates, at least if they follow each
	others. This works best if a single key is searched for and
	expected. FIXME: Non-sequential duplicates remain. */
	if (gpgsm_certs_identical_p (cert, lastcert))
	{
	ksba_cert_release (cert);
	cert = NULL;
	continue;
	}

	resname = keydb_get_resource_name (hd);

	if (lastresname != resname )
	{
	int i;

	if (ctrl->no_server)
	{
	es_fprintf (fp, "%s\n", resname );
	for (i=strlen(resname); i; i-- )
	es_putc ('-', fp);
	es_putc ('\n', fp);
	lastresname = resname;
	}
	}

	have_secret = 0;
	if (mode)
	{
	char *p = gpgsm_get_keygrip_hexstring (cert);
	if (p)
	{
	rc = gpgsm_agent_havekey (ctrl, p);
	if (!rc)
	have_secret = 1;
	else if ( gpg_err_code (rc) != GPG_ERR_NO_SECKEY)
	goto leave;
	rc = 0;
	xfree (p);
	}
	}

	if (!mode \|\| ((mode & 1) && !have_secret)
	\|\| ((mode & 2) && have_secret) )
	{
	if (ctrl->with_colons)
	list_cert_colon (ctrl, cert, validity, fp, have_secret);
	else if (ctrl->with_chain)
	list_cert_chain (ctrl, hd, cert,
	raw_mode, fp, ctrl->with_validation);
	else
	{
	if (raw_mode)
	list_cert_raw (ctrl, hd, cert, fp, have_secret,
	ctrl->with_validation);
	else
	list_cert_std (ctrl, cert, fp, have_secret,
	ctrl->with_validation);
	es_putc ('\n', fp);
	}
	}

	ksba_cert_release (lastcert);
	lastcert = cert;
	cert = NULL;
	}
	if (gpg_err_code (rc) == GPG_ERR_EOF \|\| rc == -1 )
	rc = 0;
	if (rc)
	log_error ("keydb_search failed: %s\n", gpg_strerror (rc));

	leave:
	ksba_cert_release (cert);
	ksba_cert_release (lastcert);
	xfree (desc);
	keydb_release (hd);
	return rc;
	}



	static void
	list_external_cb (void *cb_value, ksba_cert_t cert)
	{
	struct list_external_parm_s *parm = cb_value;

	if (keydb_store_cert (parm->ctrl, cert, 1, NULL))
	log_error ("error storing certificate as ephemeral\n");

	if (parm->print_header)
	{
	const char *resname = "[external keys]";
	int i;

	es_fprintf (parm->fp, "%s\n", resname );
	for (i=strlen(resname); i; i-- )
	es_putc('-', parm->fp);
	es_putc ('\n', parm->fp);
	parm->print_header = 0;
	}

	if (parm->with_colons)
	list_cert_colon (parm->ctrl, cert, 0, parm->fp, 0);
	else if (parm->with_chain)
	list_cert_chain (parm->ctrl, NULL, cert, parm->raw_mode, parm->fp, 0);
	else
	{
	if (parm->raw_mode)
	list_cert_raw (parm->ctrl, NULL, cert, parm->fp, 0, 0);
	else
	list_cert_std (parm->ctrl, cert, parm->fp, 0, 0);
	es_putc ('\n', parm->fp);
	}
	}


	/* List external keys similar to internal one. Note: mode does not
	make sense here because it would be unwise to list external secret
	keys */
	static gpg_error_t
	list_external_keys (ctrl_t ctrl, strlist_t names, estream_t fp, int raw_mode)
	{
	int rc;
	struct list_external_parm_s parm;

	parm.fp = fp;
	parm.ctrl = ctrl,
	parm.print_header = ctrl->no_server;
	parm.with_colons = ctrl->with_colons;
	parm.with_chain = ctrl->with_chain;
	parm.raw_mode = raw_mode;

	rc = gpgsm_dirmngr_lookup (ctrl, names, 0, list_external_cb, &parm);
	if (gpg_err_code (rc) == GPG_ERR_EOF \|\| rc == -1
	\|\| gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	rc = 0; /* "Not found" is not an error here. */
	if (rc)
	log_error ("listing external keys failed: %s\n", gpg_strerror (rc));
	return rc;
	}

	/* List all keys or just the key given as NAMES.
	MODE controls the operation mode:
	Bit 0-2:
	0 = list all public keys but don't flag secret ones
	1 = list only public keys
	2 = list only secret keys
	3 = list secret and public keys
	Bit 6: list internal keys
	Bit 7: list external keys
	Bit 8: Do a raw format dump.
	*/
	gpg_error_t
	gpgsm_list_keys (ctrl_t ctrl, strlist_t names, estream_t fp,
	unsigned int mode)
	{
	gpg_error_t err = 0;

	if ((mode & (1<<6)))
	err = list_internal_keys (ctrl, names, fp, (mode & 3), (mode&256));
	if (!err && (mode & (1<<7)))
	err = list_external_keys (ctrl, names, fp, (mode&256));
	return err;
	}
	diff --git a/tests/gpgscm/main.c b/tests/gpgscm/main.c
	index c96dcf189..3191e0597 100644
	--- a/tests/gpgscm/main.c
	+++ b/tests/gpgscm/main.c
	@@ -1,303 +1,303 @@
	/* TinyScheme-based test driver.
	*
	* Copyright (C) 2016 g10 code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>

	#include <assert.h>
	#include <ctype.h>
	#include <errno.h>
	#include <gcrypt.h>
	#include <gpg-error.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

	#include "private.h"
	#include "scheme.h"
	#include "scheme-private.h"
	#include "ffi.h"
	#include "i18n.h"
	#include "../../common/argparse.h"
	#include "../../common/init.h"
	#include "../../common/logging.h"
	#include "../../common/strlist.h"
	#include "../../common/sysutils.h"
	#include "../../common/util.h"

	/* The TinyScheme banner. Unfortunately, it isn't in the header
	file. */
	#define ts_banner "TinyScheme 1.41"

	int verbose;



	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,
	oVerbose = 'v',
	};

	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] =
	{
	ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
	ARGPARSE_end (),
	};

	char *scmpath = "";
	size_t scmpath_len = 0;

	/* Command line parsing. */
	static void
	parse_arguments (ARGPARSE_ARGS pargs, ARGPARSE_OPTS popts)
	{
	int no_more_options = 0;

	while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
	{
	switch (pargs->r_opt)
	{
	case oVerbose:
	verbose++;
	break;

	default:
	pargs->err = 2;
	break;
	}
	}
	}

	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "gpgscm (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40:
	p = _("Usage: gpgscm [options] [file] (-h for help)");
	break;
	case 41:
	p = _("Syntax: gpgscm [options] [file]\n"
	"Execute the given Scheme program, or spawn interactive shell.\n");
	break;

	default: p = NULL; break;
	}
	return p;
	}


	/* Load the Scheme program from FILE_NAME. If FILE_NAME is not an
	absolute path, and LOOKUP_IN_PATH is given, then it is qualified
	with the values in scmpath until the file is found. */
	static gpg_error_t
	load (scheme sc, char file_name,
	int lookup_in_cwd, int lookup_in_path)
	{
	gpg_error_t err = 0;
	size_t n;
	const char *directory;
	char *qualified_name = file_name;
	int use_path;
	FILE *h = NULL;

	use_path =
	lookup_in_path && ! (file_name[0] == '/' \|\| scmpath_len == 0);

	if (file_name[0] == '/' \|\| lookup_in_cwd \|\| scmpath_len == 0)
	{
	h = fopen (file_name, "r");
	if (! h)
	err = gpg_error_from_syserror ();
	}

	if (h == NULL && use_path)
	for (directory = scmpath, n = scmpath_len; n;
	directory += strlen (directory) + 1, n--)
	{
	if (asprintf (&qualified_name, "%s/%s", directory, file_name) < 0)
	return gpg_error_from_syserror ();

	h = fopen (qualified_name, "r");
	if (h)
	{
	err = 0;
	break;
	}

	if (n > 1)
	{
	free (qualified_name);
	continue; /* Try again! */
	}

	err = gpg_error_from_syserror ();
	}

	if (h == NULL)
	{
	/* Failed and no more elements in scmpath to try. */
	fprintf (stderr, "Could not read %s: %s.\n",
	qualified_name, gpg_strerror (err));
	if (lookup_in_path)
	fprintf (stderr,
	"Consider using GPGSCM_PATH to specify the location "
	"of the Scheme library.\n");
	goto leave;
	}
	if (verbose > 1)
	fprintf (stderr, "Loading %s...\n", qualified_name);
	scheme_load_named_file (sc, h, qualified_name);
	fclose (h);

	if (sc->retcode && sc->nesting)
	{
	fprintf (stderr, "%s: Unbalanced parenthesis\n", qualified_name);
	err = gpg_error (GPG_ERR_GENERAL);
	}

	leave:
	if (file_name != qualified_name)
	free (qualified_name);
	return err;
	}



	int
	main (int argc, char **argv)
	{
	int retcode;
	gpg_error_t err;
	char *argv0;
	ARGPARSE_ARGS pargs;
	scheme *sc;
	char *p;
	#if _WIN32
	char pathsep = ';';
	#else
	char pathsep = ':';
	#endif
	char *script = NULL;

	/* Save argv[0] so that we can re-exec. */
	argv0 = argv[0];

	/* Parse path. */
	if (getenv ("GPGSCM_PATH"))
	scmpath = getenv ("GPGSCM_PATH");

	p = scmpath = strdup (scmpath);
	if (p == NULL)
	return 2;

	if (*p)
	scmpath_len++;
	for (; *p; p++)
	if (*p == pathsep)
	*p = 0, scmpath_len++;

	set_strusage (my_strusage);
	log_set_prefix ("gpgscm", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init ();
	init_common_subsystems (&argc, &argv);

	if (!gcry_check_version (NEED_LIBGCRYPT_VERSION))
	{
	fputs ("libgcrypt version mismatch\n", stderr);
	exit (2);
	}

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = 0;
	parse_arguments (&pargs, opts);

	if (log_get_errorcount (0))
	exit (2);

	sc = scheme_init_new_custom_alloc (gcry_malloc, gcry_free);
	if (! sc) {
	fprintf (stderr, "Could not initialize TinyScheme!\n");
	return 2;
	}
	scheme_set_input_port_file (sc, stdin);
	scheme_set_output_port_file (sc, stderr);

	if (argc)
	{
	script = argv[0];
	argc--, argv++;
	}

	err = load (sc, "init.scm", 0, 1);
	if (! err)
	err = load (sc, "ffi.scm", 0, 1);
	if (! err)
	err = ffi_init (sc, argv0, script ? script : "interactive",
	argc, (const char **) argv);
	if (! err)
	err = load (sc, "lib.scm", 0, 1);
	if (! err)
	err = load (sc, "repl.scm", 0, 1);
	if (! err)
	err = load (sc, "tests.scm", 0, 1);
	if (err)
	{
	fprintf (stderr, "Error initializing gpgscm: %s.\n",
	gpg_strerror (err));
	exit (2);
	}

	if (script == NULL)
	{
	/* Interactive shell. */
	fprintf (stderr, "gpgscm/"ts_banner".\n");
	scheme_load_string (sc, "(interactive-repl)");
	}
	else
	{
	err = load (sc, script, 1, 1);
	if (err)
	log_fatal ("%s: %s", script, gpg_strerror (err));
	}

	retcode = sc->retcode;
	scheme_load_string (sc, "(run-atexit-handlers)");
	scheme_deinit (sc);
	xfree (sc);
	return retcode;
	}
	diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
	index 1d8173dba..a890d4086 100644
	--- a/tests/openpgp/defs.scm
	+++ b/tests/openpgp/defs.scm
	@@ -1,432 +1,432 @@
	;; Common definitions for the OpenPGP test scripts.
	;;
	;; Copyright (C) 2016, 2017 g10 Code GmbH
	;;
	;; This file is part of GnuPG.
	;;
	;; GnuPG is free software; you can redistribute it and/or modify
	;; it under the terms of the GNU General Public License as published by
	;; the Free Software Foundation; either version 3 of the License, or
	;; (at your option) any later version.
	;;
	;; GnuPG is distributed in the hope that it will be useful,
	;; but WITHOUT ANY WARRANTY; without even the implied warranty of
	;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	;; GNU General Public License for more details.
	;;
	;; You should have received a copy of the GNU General Public License
	;; along with this program; if not, see <http://www.gnu.org/licenses/>.

	;;
	;; Constants.
	;;

	(define usrname1 "one@example.com")
	(define usrpass1 "def")
	(define usrname2 "two@example.com")
	(define usrpass2 "")
	(define usrname3 "three@example.com")
	(define usrpass3 "")

	(define dsa-usrname1 "pgp5")
	-;; we use the sub key because we do not yet have the logic to to derive
	+;; we use the sub key because we do not yet have the logic to derive
	;; the first encryption key from a keyblock (I guess) (Well of course
	;; we have this by now and the notation below will lookup the primary
	;; first and then search for the encryption subkey.)
	(define dsa-usrname2 "0xCB879DE9")

	(define keys
	(package
	(define (new fpr grip uids subkeys)
	(package))
	(define (subkey fpr grip)
	(package))
	(define alfa (new "A0FF4590BB6122EDEF6E3C542D727CC768697734"
	"76F7E2B35832976B50A27A282D9B87E44577EB66"
	'("alfa@example.net" "alpha@example.net")
	(list
	(subkey "3B3FBC948FE59301ED629EFB6AE6D7EE46A871F8"
	"A0747D5F9425E6664F4FFBEED20FBCA79FDED2BD"))))
	(define one (new "289B0EF1D105E124B6F626020EF77096D74C5F22"
	"50B2D4FA4122C212611048BC5FC31BD44393626E"
	'("one@example.com")
	(list
	(subkey "EB467DCA4AD7676A6A62B2ABABAB28A247BE2775"
	"7E201E28B6FEB2927B321F443205F4724EBE637E"))))
	(define two (new "C1DEBB34EA8B71009EAFA474973D50E1C40FDECF"
	"343D8AF79796EE107D645A2787A9D9252F924E6F"
	'("two@example.com")
	(list
	(subkey "CD3D0F5701CBFCACB2A4907305A37887B27907AA"
	"8B5ABF3EF9EB8D96B91A0B8C2C4401C91C834C34"))))))

	(define key-file1 "samplekeys/rsa-rsa-sample-1.asc")
	(define key-file2 "samplekeys/ed25519-cv25519-sample-1.asc")

	(define plain-files '("plain-1" "plain-2" "plain-3" "plain-large"))
	(define data-files '("data-500" "data-9000" "data-32000" "data-80000"))
	(define exp-files '())
	(define all-files (append plain-files data-files))

	(let ((verbose (string->number (getenv "verbose"))))
	(if (number? verbose)
	(set-verbose! verbose)))

	(define (qualify executable)
	(string-append executable (getenv "EXEEXT")))

	(define (getenv' key default)
	(let ((value (getenv key)))
	(if (string=? "" value)
	default
	value)))

	(define (percent-decode s)
	(define (decode c)
	(if (and (> (length c) 2) (char=? #\% (car c)))
	(integer->char (string->number (string #\# #\x (cadr c) (caddr c))))
	#f))
	(let loop ((i 0) (c (string->list s)) (r (make-string (string-length s))))
	(if (null? c)
	(substring r 0 i)
	(let ((decoded (decode c)))
	(string-set! r i (if decoded decoded (car c)))
	(loop (+ 1 i) (if decoded (cdddr c) (cdr c)) r)))))
	(assert (equal? (percent-decode "") ""))
	(assert (equal? (percent-decode "%61") "a"))
	(assert (equal? (percent-decode "foob%61r") "foobar"))

	(define (percent-encode s)
	(define (encode c)
	`(#\% ,@(string->list (number->string (char->integer c) 16))))
	(let loop ((acc '()) (cs (reverse (string->list s))))
	(if (null? cs)
	(list->string acc)
	(case (car cs)
	((#\: #\%)
	(loop (append (encode (car cs)) acc) (cdr cs)))
	(else
	(loop (cons (car cs) acc) (cdr cs)))))))
	(assert (equal? (percent-encode "") ""))
	(assert (equal? (percent-encode "%61") "%2561"))
	(assert (equal? (percent-encode "foob%61r") "foob%2561r"))

	(define tools
	'((gpgv "GPGV" "g10/gpgv")
	(gpg-connect-agent "GPG_CONNECT_AGENT" "tools/gpg-connect-agent")
	(gpgconf "GPGCONF" "tools/gpgconf")
	(gpg-preset-passphrase "GPG_PRESET_PASSPHRASE"
	"agent/gpg-preset-passphrase")
	(gpgtar "GPGTAR" "tools/gpgtar")
	(gpg-zip "GPGZIP" "tools/gpg-zip")
	(pinentry "PINENTRY" "tests/openpgp/fake-pinentry")))

	(define bin-prefix (getenv "BIN_PREFIX"))
	(define installed? (not (string=? "" bin-prefix)))

	(define (tool-hardcoded which)
	(let ((t (assoc which tools)))
	(getenv' (cadr t)
	(qualify (if installed?
	(string-append bin-prefix "/" (basename (caddr t)))
	(string-append (getenv "objdir") "/" (caddr t)))))))

	;; You can splice VALGRIND into your argument vector to run programs
	;; under valgrind. For example, to run valgrind on gpg, you may want
	;; to redefine gpg:
	;;
	;; (set! gpg `(,@valgrind ,@gpg))
	;;
	(define valgrind
	'("/usr/bin/valgrind" --leak-check=full --error-exitcode=154))

	(define (gpg-conf . args)
	(gpg-conf' "" args))
	(define (gpg-conf' input args)
	(let ((s (call-popen `(,(tool-hardcoded 'gpgconf) ,@args) input)))
	(map (lambda (line) (map percent-decode (string-split line #\:)))
	(string-split-newlines s))))
	(define :gc:c:name car)
	(define :gc:c:description cadr)
	(define :gc:c:pgmname caddr)

	(define (gpg-config component key)
	(package
	(define (value)
	(assoc key (gpg-conf '--list-options component)))
	(define (update value)
	(gpg-conf' (string-append key ":0:" (percent-encode value))
	`(--change-options ,component)))
	(define (clear)
	(gpg-conf' (string-append key ":16:")
	`(--change-options ,component)))))


	(unless installed?
	(setenv "GNUPG_BUILDDIR" (getenv "objdir") #t))
	(define gpg-components (apply gpg-conf
	`(,@(if installed? '()
	(list '--build-prefix (getenv "objdir")))
	--list-components)))

	(define (tool which)
	(case which
	((gpg gpg-agent scdaemon gpgsm dirmngr)
	(:gc:c:pgmname (assoc (symbol->string which) gpg-components)))
	(else
	(tool-hardcoded which))))

	(define (gpg-has-option? option)
	(string-contains? (call-popen `(,(tool 'gpg) --dump-options) "")
	option))

	(define have-opt-always-trust
	(catch #f
	(call-check `(,(tool 'gpg) --gpgconf-test --always-trust))
	#t))

	(define GPG `(,(tool 'gpg) --no-permission-warning
	,@(if have-opt-always-trust '(--always-trust) '())))
	(define GPGV `(,(tool 'gpgv)))
	(define PINENTRY (tool 'pinentry))

	(define (tr:gpg input args)
	(tr:spawn input `(,@GPG --output out ,@args in)))

	(define (pipe:gpg args)
	(pipe:spawn `(,@GPG --output - ,@args -)))

	(define (gpg-with-colons args)
	(let ((s (call-popen `(,@GPG --with-colons ,@args) "")))
	(map (lambda (line) (string-split line #\:))
	(string-split-newlines s))))

	;; Convenient accessors for the colon output.
	(define (:type x) (string->symbol (list-ref x 0)))
	(define (:length x) (string->number (list-ref x 2)))
	(define (:alg x) (string->number (list-ref x 3)))
	(define (:expire x) (list-ref x 6))
	(define (:fpr x) (list-ref x 9))
	(define (:cap x) (list-ref x 11))

	(define (have-public-key? key)
	(catch #f
	(pair? (filter (lambda (l) (and (equal? 'fpr (:type l))
	(equal? key::fpr (:fpr l))))
	(gpg-with-colons `(--list-keys ,key::fpr))))))

	(define (have-secret-key? key)
	(catch #f
	(pair? (filter (lambda (l) (and (equal? 'fpr (:type l))
	(equal? key::fpr (:fpr l))))
	(gpg-with-colons `(--list-secret-keys ,key::fpr))))))

	(define (have-secret-key-file? key)
	(file-exists? (path-join (getenv "GNUPGHOME") "private-keys-v1.d"
	(string-append key::grip ".key"))))

	(define (get-config what)
	(string-split (caddar (gpg-with-colons `(--list-config ,what))) #\;))

	(define all-pubkey-algos (delay (get-config "pubkeyname")))
	(define all-hash-algos (delay (get-config "digestname")))
	(define all-cipher-algos (delay (get-config "ciphername")))
	(define all-compression-algos (delay (get-config "compressname")))

	(define (have-pubkey-algo? x)
	(not (not (member x (force all-pubkey-algos)))))
	(define (have-hash-algo? x)
	(not (not (member x (force all-hash-algos)))))
	(define (have-cipher-algo? x)
	(not (not (member x (force all-cipher-algos)))))

	(define (gpg-pipe args0 args1 errfd)
	(lambda (source sink)
	(let* ((p (pipe))
	(task0 (spawn-process-fd `(,@GPG ,@args0)
	source (:write-end p) errfd))
	(_ (close (:write-end p)))
	(task1 (spawn-process-fd `(,@GPG ,@args1)
	(:read-end p) sink errfd)))
	(close (:read-end p))
	(wait-processes (list GPG GPG) (list task0 task1) #t))))

	(setenv "GPG_AGENT_INFO" "" #t)
	(setenv "GNUPGHOME" (getcwd) #t)
	(define GNUPGHOME (getcwd))

	;;
	;; GnuPG helper.
	;;

	;; Evaluate a sequence of expressions with an ephemeral home
	;; directory.
	(define-macro (with-ephemeral-home-directory . expressions)
	(let ((original-home-directory (gensym))
	(ephemeral-home-directory (gensym)))
	`(let ((,original-home-directory (getenv "GNUPGHOME"))
	(,ephemeral-home-directory (mkdtemp)))
	(finally (unlink-recursively ,ephemeral-home-directory)
	(dynamic-wind
	(lambda () (setenv "GNUPGHOME" ,ephemeral-home-directory #t))
	(lambda () ,@expressions)
	(lambda () (setenv "GNUPGHOME" ,original-home-directory #t)))))))

	;; Call GPG to obtain the hash sums. Either specify an input file in
	;; ARGS, or an string in INPUT. Returns a list of (<algo>
	;; "<hashsum>") lists.
	(define (gpg-hash-string args input)
	(map
	(lambda (line)
	(let ((p (string-split line #\:)))
	(list (string->number (cadr p)) (caddr p))))
	(string-split-newlines
	(call-popen `(,@GPG --with-colons ,@args) input))))

	;; Dearmor a file.
	(define (dearmor source-name sink-name)
	(pipe:do
	(pipe:open source-name (logior O_RDONLY O_BINARY))
	(pipe:spawn `(,@GPG --dearmor))
	(pipe:write-to sink-name (logior O_WRONLY O_CREAT O_BINARY) #o600)))

	;;
	;; Support for test environment creation and teardown.
	;;

	(define (make-test-data filename size)
	(call-with-binary-output-file
	filename
	(lambda (port)
	(display (make-random-string size) port))))

	(define (create-gpghome)
	(log "Creating test environment...")

	(srandom (getpid))
	(make-test-data "random_seed" 600)

	(log "Creating configuration files")
	(for-each
	(lambda (name)
	(file-copy (in-srcdir (string-append name ".tmpl")) name)
	(let ((p (open-input-output-file name)))
	(cond
	((string=? "gpg.conf" name)
	(if have-opt-always-trust
	(display "no-auto-check-trustdb\n" p))
	(display (string-append "agent-program "
	(tool 'gpg-agent)
	"\|--debug-quick-random\n") p)
	(display "allow-weak-digest-algos\n" p))
	((string=? "gpg-agent.conf" name)
	(display (string-append "pinentry-program " PINENTRY "\n") p)))))
	'("gpg.conf" "gpg-agent.conf")))

	;; Initialize the test environment, install appropriate configuration
	;; and start the agent, without any keys.
	(define (setup-environment)
	(create-gpghome)
	(start-agent))

	(define (create-sample-files)
	(log "Creating sample data files")
	(for-each
	(lambda (size)
	(make-test-data (string-append "data-" (number->string size))
	size))
	'(500 9000 32000 80000))

	(log "Unpacking samples")
	(for-each
	(lambda (name)
	(dearmor (in-srcdir ".." "openpgp" (string-append name "o.asc")) name))
	plain-files))

	(define (create-legacy-gpghome)
	(create-sample-files)
	(mkdir "private-keys-v1.d" "-rwx")

	(log "Storing private keys")
	(for-each
	(lambda (name)
	(dearmor (in-srcdir (string-append "/privkeys/" name ".asc"))
	(string-append "private-keys-v1.d/" name ".key")))
	'("50B2D4FA4122C212611048BC5FC31BD44393626E"
	"7E201E28B6FEB2927B321F443205F4724EBE637E"
	"13FDB8809B17C5547779F9D205C45F47CE0217CE"
	"343D8AF79796EE107D645A2787A9D9252F924E6F"
	"8B5ABF3EF9EB8D96B91A0B8C2C4401C91C834C34"
	"0D6F6AD4C4C803B25470F9104E9F4E6A4CA64255"
	"FD692BD59D6640A84C8422573D469F84F3B98E53"
	"76F7E2B35832976B50A27A282D9B87E44577EB66"
	"A0747D5F9425E6664F4FFBEED20FBCA79FDED2BD"
	"00FE67F28A52A8AA08FFAED20AF832DA916D1985"
	"1DF48228FEFF3EC2481B106E0ACA8C465C662CC5"
	"A2832820DC9F40751BDCD375BB0945BA33EC6B4C"
	"ADE710D74409777B7729A7653373D820F67892E0"
	"CEFC51AF91F68A2904FBFF62C4F075A4785B803F"
	"1E28F20E41B54C2D1234D896096495FF57E08D18"
	"EB33B687EB8581AB64D04852A54453E85F3DF62D"
	"C6A6390E9388CDBAD71EAEA698233FE5E04F001E"
	"D69102E0F5AC6B6DB8E4D16DA8E18CF46D88CAE3"))

	(log "Importing public demo and test keys")
	(for-each
	(lambda (file)
	(call-check `(,@GPG --yes --import ,(in-srcdir file))))
	(list "pubdemo.asc" "pubring.asc" key-file1))

	(pipe:do
	(pipe:open (in-srcdir "pubring.pkr.asc") (logior O_RDONLY O_BINARY))
	(pipe:spawn `(,@GPG --dearmor))
	(pipe:spawn `(,@GPG --yes --import))))

	(define (preset-passphrases)
	(log "Presetting passphrases")
	;; one@example.com
	(call-check `(,(tool 'gpg-preset-passphrase)
	--preset --passphrase def
	"50B2D4FA4122C212611048BC5FC31BD44393626E"))
	(call-check `(,(tool 'gpg-preset-passphrase)
	--preset --passphrase def
	"7E201E28B6FEB2927B321F443205F4724EBE637E"))
	;; alpha@example.net
	(call-check `(,(tool 'gpg-preset-passphrase)
	--preset --passphrase abc
	"76F7E2B35832976B50A27A282D9B87E44577EB66"))
	(call-check `(,(tool 'gpg-preset-passphrase)
	--preset --passphrase abc
	"A0747D5F9425E6664F4FFBEED20FBCA79FDED2BD")))

	;; Initialize the test environment, install appropriate configuration
	;; and start the agent, with the keys from the legacy test suite.
	(define (setup-legacy-environment)
	(create-gpghome)
	(if (member "--unpack-tarball" args)
	(begin
	(call-check `(,(tool 'gpgtar) --extract --directory=. ,(cadr args)))
	(start-agent))
	(begin
	(start-agent)
	(create-legacy-gpghome)))
	(preset-passphrases))

	;; Create the socket dir and start the agent.
	(define (start-agent)
	(log "Starting gpg-agent...")
	(atexit stop-agent)
	(catch (log "Warning: Creating socket directory failed:" (car error))
	(call-popen `(,(tool 'gpgconf) --create-socketdir) ""))
	(call-check `(,(tool 'gpg-connect-agent) --verbose
	,(string-append "--agent-program=" (tool 'gpg-agent)
	"\|--debug-quick-random")
	/bye)))

	;; Stop the agent and remove the socket dir.
	(define (stop-agent)
	(log "Stopping gpg-agent...")
	(catch (log "Warning: Removing socket directory failed.")
	(call-popen `(,(tool 'gpgconf) --remove-socketdir) ""))
	(call-check `(,(tool 'gpg-connect-agent) --verbose --no-autostart
	killagent /bye)))
	diff --git a/tests/openpgp/verify.scm b/tests/openpgp/verify.scm
	index a398a1483..9b8282716 100755
	--- a/tests/openpgp/verify.scm
	+++ b/tests/openpgp/verify.scm
	@@ -1,350 +1,350 @@
	#!/usr/bin/env gpgscm

	;; Copyright (C) 2016 g10 Code GmbH
	;;
	;; This file is part of GnuPG.
	;;
	;; GnuPG is free software; you can redistribute it and/or modify
	;; it under the terms of the GNU General Public License as published by
	;; the Free Software Foundation; either version 3 of the License, or
	;; (at your option) any later version.
	;;
	;; GnuPG is distributed in the hope that it will be useful,
	;; but WITHOUT ANY WARRANTY; without even the implied warranty of
	;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	;; GNU General Public License for more details.
	;;
	;; You should have received a copy of the GNU General Public License
	;; along with this program; if not, see <http://www.gnu.org/licenses/>.

	(load (with-path "defs.scm"))
	(setup-legacy-environment)

	;;
	;; Two simple tests to check that verify fails for bad input data
	;;
	(for-each-p
	"Checking bogus signature"
	(lambda (char)
	(lettmp (x)
	(call-with-binary-output-file
	x
	(lambda (port)
	(display (make-string 64 (integer->char (string->number char)))
	port)))
	(if (= 0 (call `(,@GPG --verify ,x data-500)))
	(fail "no error code from verify"))))
	'("#x2d" "#xca"))

	;; A plain signed message created using
	;; echo abc \| gpg --homedir . --passphrase-fd 0 -u Alpha -z0 -sa msg
	(define msg_ols_asc "
	-----BEGIN PGP MESSAGE-----

	kA0DAAIRLXJ8x2hpdzQBrQEHYgNtc2dEDFJaSSB0aGluayB0aGF0IGFsbCByaWdo
	dC10aGlua2luZyBwZW9wbGUgaW4gdGhpcyBjb3VudHJ5IGFyZSBzaWNrIGFuZAp0
	aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgb3JkaW5hcnkgZGVjZW50IHBlb3BsZSBh
	cmUgZmVkIHVwIGluIHRoaXMKY291bnRyeSB3aXRoIGJlaW5nIHNpY2sgYW5kIHRp
	cmVkLiAgSSdtIGNlcnRhaW5seSBub3QuICBCdXQgSSdtCnNpY2sgYW5kIHRpcmVk
	IG9mIGJlaW5nIHRvbGQgdGhhdCBJIGFtLgotIE1vbnR5IFB5dGhvbgqIPwMFAEQM
	UlotcnzHaGl3NBECR4IAoJlEGTY+bHjD2HYuCixLQCmk01pbAKCIjkzLOAmkZNm0
	D8luT78c/1x45Q==
	=a29i
	-----END PGP MESSAGE-----
	")

	;; A plain signed message created using
	;; echo abc \| gpg --homedir . --passphrase-fd 0 -u Alpha -sa msg
	(define msg_cols_asc "
	-----BEGIN PGP MESSAGE-----

	owGbwMvMwCSoW1RzPCOz3IRxLSN7EnNucboLT6Cgp0JJRmZeNpBMLFFIzMlRKMpM
	zyjRBQtm5qUrFKTmF+SkKmTmgdQVKyTnl+aVFFUqJBalKhRnJmcrJOalcJVkFqWm
	KOSnKSSlgrSU5OekQMzLL0rJzEsEKk9JTU7NK4EZBtKcBtRRWgAzlwtmbnlmSQbU
	GJjxCmDj9RQUPNVzFZJTi0oSM/NyKhXy8kuAYk6lJSBxLlTF2NziqZCYq8elq+Cb
	n1dSqRBQWZKRn8fVYc/MygAKBljYCDIFiTDMT+9seu836Q+bevyHTJ0dzPNuvCjn
	ZpgrwX38z58rJsfYDhwOSS4SkN/d6vUAAA==
	=s6sY
	-----END PGP MESSAGE-----
	")

	;; A PGP 2 style message.
	(define msg_sl_asc "
	-----BEGIN PGP MESSAGE-----

	iD8DBQBEDFJaLXJ8x2hpdzQRAkeCAKCZRBk2Pmx4w9h2LgosS0AppNNaWwCgiI5M
	yzgJpGTZtA/Jbk+/HP9ceOWtAQdiA21zZ0QMUlpJIHRoaW5rIHRoYXQgYWxsIHJp
	Z2h0LXRoaW5raW5nIHBlb3BsZSBpbiB0aGlzIGNvdW50cnkgYXJlIHNpY2sgYW5k
	CnRpcmVkIG9mIGJlaW5nIHRvbGQgdGhhdCBvcmRpbmFyeSBkZWNlbnQgcGVvcGxl
	IGFyZSBmZWQgdXAgaW4gdGhpcwpjb3VudHJ5IHdpdGggYmVpbmcgc2ljayBhbmQg
	dGlyZWQuICBJJ20gY2VydGFpbmx5IG5vdC4gIEJ1dCBJJ20Kc2ljayBhbmQgdGly
	ZWQgb2YgYmVpbmcgdG9sZCB0aGF0IEkgYW0uCi0gTW9udHkgUHl0aG9uCg==
	=0ukK
	-----END PGP MESSAGE-----
	")

	;; An OpenPGP message lacking the onepass packet. We used to accept
	;; such messages but now consider them invalid.
	(define bad_ls_asc "
	-----BEGIN PGP MESSAGE-----

	rQEHYgNtc2dEDFJaSSB0aGluayB0aGF0IGFsbCByaWdodC10aGlua2luZyBwZW9w
	bGUgaW4gdGhpcyBjb3VudHJ5IGFyZSBzaWNrIGFuZAp0aXJlZCBvZiBiZWluZyB0
	b2xkIHRoYXQgb3JkaW5hcnkgZGVjZW50IHBlb3BsZSBhcmUgZmVkIHVwIGluIHRo
	aXMKY291bnRyeSB3aXRoIGJlaW5nIHNpY2sgYW5kIHRpcmVkLiAgSSdtIGNlcnRh
	aW5seSBub3QuICBCdXQgSSdtCnNpY2sgYW5kIHRpcmVkIG9mIGJlaW5nIHRvbGQg
	dGhhdCBJIGFtLgotIE1vbnR5IFB5dGhvbgqIPwMFAEQMUlotcnzHaGl3NBECR4IA
	oJlEGTY+bHjD2HYuCixLQCmk01pbAKCIjkzLOAmkZNm0D8luT78c/1x45Q==
	=Mpiu
	-----END PGP MESSAGE-----
	")


	;; A signed message prefixed with an unsigned literal packet.
	;; (fols = faked-literal-data, one-pass, literal-data, signature)
	;; This should throw an error because running gpg to extract the
	;; signed data will return both literal data packets
	(define bad_fols_asc "
	-----BEGIN PGP MESSAGE-----

	rF1iDG1zZy51bnNpZ25lZEQMY0x0aW1lc2hhcmluZywgbjoKCUFuIGFjY2VzcyBt
	ZXRob2Qgd2hlcmVieSBvbmUgY29tcHV0ZXIgYWJ1c2VzIG1hbnkgcGVvcGxlLgqQ
	DQMAAhEtcnzHaGl3NAGtAQdiA21zZ0QMUlpJIHRoaW5rIHRoYXQgYWxsIHJpZ2h0
	LXRoaW5raW5nIHBlb3BsZSBpbiB0aGlzIGNvdW50cnkgYXJlIHNpY2sgYW5kCnRp
	cmVkIG9mIGJlaW5nIHRvbGQgdGhhdCBvcmRpbmFyeSBkZWNlbnQgcGVvcGxlIGFy
	ZSBmZWQgdXAgaW4gdGhpcwpjb3VudHJ5IHdpdGggYmVpbmcgc2ljayBhbmQgdGly
	ZWQuICBJJ20gY2VydGFpbmx5IG5vdC4gIEJ1dCBJJ20Kc2ljayBhbmQgdGlyZWQg
	b2YgYmVpbmcgdG9sZCB0aGF0IEkgYW0uCi0gTW9udHkgUHl0aG9uCog/AwUARAxS
	Wi1yfMdoaXc0EQJHggCgmUQZNj5seMPYdi4KLEtAKaTTWlsAoIiOTMs4CaRk2bQP
	yW5Pvxz/XHjl
	=UNM4
	-----END PGP MESSAGE-----
	")

	;; A signed message suffixed with an unsigned literal packet.
	;; (fols = faked-literal-data, one-pass, literal-data, signature)
	;; This should throw an error because running gpg to extract the
	;; signed data will return both literal data packets
	(define bad_olsf_asc "
	-----BEGIN PGP MESSAGE-----

	kA0DAAIRLXJ8x2hpdzQBrQEHYgNtc2dEDFJaSSB0aGluayB0aGF0IGFsbCByaWdo
	dC10aGlua2luZyBwZW9wbGUgaW4gdGhpcyBjb3VudHJ5IGFyZSBzaWNrIGFuZAp0
	aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgb3JkaW5hcnkgZGVjZW50IHBlb3BsZSBh
	cmUgZmVkIHVwIGluIHRoaXMKY291bnRyeSB3aXRoIGJlaW5nIHNpY2sgYW5kIHRp
	cmVkLiAgSSdtIGNlcnRhaW5seSBub3QuICBCdXQgSSdtCnNpY2sgYW5kIHRpcmVk
	IG9mIGJlaW5nIHRvbGQgdGhhdCBJIGFtLgotIE1vbnR5IFB5dGhvbgqIPwMFAEQM
	UlotcnzHaGl3NBECR4IAoJlEGTY+bHjD2HYuCixLQCmk01pbAKCIjkzLOAmkZNm0
	D8luT78c/1x45axdYgxtc2cudW5zaWduZWREDGNMdGltZXNoYXJpbmcsIG46CglB
	biBhY2Nlc3MgbWV0aG9kIHdoZXJlYnkgb25lIGNvbXB1dGVyIGFidXNlcyBtYW55
	IHBlb3BsZS4K
	=3gnG
	-----END PGP MESSAGE-----
	")


	;; Two standard signed messages in a row
	(define msg_olsols_asc_multiple "
	-----BEGIN PGP MESSAGE-----

	kA0DAAIRLXJ8x2hpdzQBrQEHYgNtc2dEDFJaSSB0aGluayB0aGF0IGFsbCByaWdo
	dC10aGlua2luZyBwZW9wbGUgaW4gdGhpcyBjb3VudHJ5IGFyZSBzaWNrIGFuZAp0
	aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgb3JkaW5hcnkgZGVjZW50IHBlb3BsZSBh
	cmUgZmVkIHVwIGluIHRoaXMKY291bnRyeSB3aXRoIGJlaW5nIHNpY2sgYW5kIHRp
	cmVkLiAgSSdtIGNlcnRhaW5seSBub3QuICBCdXQgSSdtCnNpY2sgYW5kIHRpcmVk
	IG9mIGJlaW5nIHRvbGQgdGhhdCBJIGFtLgotIE1vbnR5IFB5dGhvbgqIPwMFAEQM
	UlotcnzHaGl3NBECR4IAoJlEGTY+bHjD2HYuCixLQCmk01pbAKCIjkzLOAmkZNm0
	D8luT78c/1x45ZANAwACES1yfMdoaXc0Aa0BB2IDbXNnRAxSWkkgdGhpbmsgdGhh
	dCBhbGwgcmlnaHQtdGhpbmtpbmcgcGVvcGxlIGluIHRoaXMgY291bnRyeSBhcmUg
	c2ljayBhbmQKdGlyZWQgb2YgYmVpbmcgdG9sZCB0aGF0IG9yZGluYXJ5IGRlY2Vu
	dCBwZW9wbGUgYXJlIGZlZCB1cCBpbiB0aGlzCmNvdW50cnkgd2l0aCBiZWluZyBz
	aWNrIGFuZCB0aXJlZC4gIEknbSBjZXJ0YWlubHkgbm90LiAgQnV0IEknbQpzaWNr
	IGFuZCB0aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgSSBhbS4KLSBNb250eSBQeXRo
	b24KiD8DBQBEDFJaLXJ8x2hpdzQRAkeCAKCZRBk2Pmx4w9h2LgosS0AppNNaWwCg
	iI5MyzgJpGTZtA/Jbk+/HP9ceOU=
	=8nLN
	-----END PGP MESSAGE-----
	")

	;; A standard message with two signatures (actually the same signature
	;; duplicated).
	(define msg_oolss_asc "
	-----BEGIN PGP MESSAGE-----

	kA0DAAIRLXJ8x2hpdzQBkA0DAAIRLXJ8x2hpdzQBrQEHYgNtc2dEDFJaSSB0aGlu
	ayB0aGF0IGFsbCByaWdodC10aGlua2luZyBwZW9wbGUgaW4gdGhpcyBjb3VudHJ5
	IGFyZSBzaWNrIGFuZAp0aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgb3JkaW5hcnkg
	ZGVjZW50IHBlb3BsZSBhcmUgZmVkIHVwIGluIHRoaXMKY291bnRyeSB3aXRoIGJl
	aW5nIHNpY2sgYW5kIHRpcmVkLiAgSSdtIGNlcnRhaW5seSBub3QuICBCdXQgSSdt
	CnNpY2sgYW5kIHRpcmVkIG9mIGJlaW5nIHRvbGQgdGhhdCBJIGFtLgotIE1vbnR5
	IFB5dGhvbgqIPwMFAEQMUlotcnzHaGl3NBECR4IAoJlEGTY+bHjD2HYuCixLQCmk
	01pbAKCIjkzLOAmkZNm0D8luT78c/1x45Yg/AwUARAxSWi1yfMdoaXc0EQJHggCg
	mUQZNj5seMPYdi4KLEtAKaTTWlsAoIiOTMs4CaRk2bQPyW5Pvxz/XHjl
	=KVw5
	-----END PGP MESSAGE-----
	")

	;; A standard message with two one-pass packet but only one signature
	;; packet
	(define bad_ools_asc "
	-----BEGIN PGP MESSAGE-----

	kA0DAAIRLXJ8x2hpdzQBkA0DAAIRLXJ8x2hpdzQBrQEHYgNtc2dEDFJaSSB0aGlu
	ayB0aGF0IGFsbCByaWdodC10aGlua2luZyBwZW9wbGUgaW4gdGhpcyBjb3VudHJ5
	IGFyZSBzaWNrIGFuZAp0aXJlZCBvZiBiZWluZyB0b2xkIHRoYXQgb3JkaW5hcnkg
	ZGVjZW50IHBlb3BsZSBhcmUgZmVkIHVwIGluIHRoaXMKY291bnRyeSB3aXRoIGJl
	aW5nIHNpY2sgYW5kIHRpcmVkLiAgSSdtIGNlcnRhaW5seSBub3QuICBCdXQgSSdt
	CnNpY2sgYW5kIHRpcmVkIG9mIGJlaW5nIHRvbGQgdGhhdCBJIGFtLgotIE1vbnR5
	IFB5dGhvbgqIPwMFAEQMUlotcnzHaGl3NBECR4IAoJlEGTY+bHjD2HYuCixLQCmk
	01pbAKCIjkzLOAmkZNm0D8luT78c/1x45Q==
	=1/ix
	-----END PGP MESSAGE-----
	")

	;; Standard cleartext signature
	(define msg_cls_asc "
	-----BEGIN PGP SIGNED MESSAGE-----
	Hash: SHA1

	I think that all right-thinking people in this country are sick and
	tired of being told that ordinary decent people are fed up in this
	country with being sick and tired. I'm certainly not. But I'm
	sick and tired of being told that I am.
	- - Monty Python
	-----BEGIN PGP SIGNATURE-----

	iD8DBQFEDVp1LXJ8x2hpdzQRAplUAKCMfpG3GPw/TLN52tosgXP5lNECkwCfQhAa
	emmev7IuQjWYrGF9Lxj+zj8=
	=qJsY
	-----END PGP SIGNATURE-----
	")

	;; Cleartext signature with two signatures
	(define msg_clss_asc "
	-----BEGIN PGP SIGNED MESSAGE-----
	Hash: SHA1

	What is the difference between a Turing machine and the modern computer?
	It's the same as that between Hillary's ascent of Everest and the
	establishment of a Hilton on its peak.
	-----BEGIN PGP SIGNATURE-----

	iD8DBQFEDVz6LXJ8x2hpdzQRAtkGAKCeMhNbHnh339fpjNj9owsYcC4zBwCfYO5l
	2u+KEfXX0FKyk8SMzLjZ536IPwMFAUQNXPr+GAsdqeOwshEC2QYAoPOWAiQm0EF/
	FWIAQUplk7JWbyRKAJ92ZJyJpWfzb0yc1s7MY65r2qEHrg==
	=1Xvv
	-----END PGP SIGNATURE-----
	")

	;; Two clear text signatures in a row
	(define msg_clsclss_asc_multiple (string-append msg_cls_asc msg_clss_asc))


	;; An Ed25519 cleartext message with an R parameter of only 247 bits
	;; so that the code to re-insert the stripped zero byte kicks in. The
	;; S parameter has 253 bits but that does not strip a full byte.
	(define msg_ed25519_rshort "
	-----BEGIN PGP SIGNED MESSAGE-----
	Hash: SHA256

	Dear Emily:
	I'm still confused as to what groups articles should be posted
	to. How about an example?
	-- Still Confused

	Dear Still:
	Ok. Let's say you want to report that Gretzky has been traded from
	the Oilers to the Kings. Now right away you might think rec.sport.hockey
	would be enough. WRONG. Many more people might be interested. This is a
	big trade! Since it's a NEWS article, it belongs in the news.* hierarchy
	as well. If you are a news admin, or there is one on your machine, try
	news.admin. If not, use news.misc.
	The Oilers are probably interested in geology, so try sci.physics.
	He is a big star, so post to sci.astro, and sci.space because they are also
	interested in stars. Next, his name is Polish sounding. So post to
	soc.culture.polish. But that group doesn't exist, so cross-post to
	news.groups suggesting it should be created. With this many groups of
	interest, your article will be quite bizarre, so post to talk.bizarre as
	well. (And post to comp.std.mumps, since they hardly get any articles
	there, and a \"comp\" group will propagate your article further.)
	You may also find it is more fun to post the article once in each
	group. If you list all the newsgroups in the same article, some newsreaders
	-will only show the the article to the reader once! Don't tolerate this.
	+will only show the article to the reader once! Don't tolerate this.
	-- Emily Postnews Answers Your Questions on Netiquette
	-----BEGIN PGP SIGNATURE-----

	iJEEARYIADoWIQSyHeq0+HX7PaQvHR0TlWNoKgINCgUCV772DhwccGF0cmljZS5s
	dW11bWJhQGV4YW1wbGUubmV0AAoJEBOVY2gqAg0KMAIA90EtUwAja0iJGpO91wyz
	GLh9pS5v495V0r94yU6uUyUA/RT/StyPWe1wbnEZuacZnLbUV6Yy/aTXCVAlxf0r
	TusO
	=vQ3f
	-----END PGP SIGNATURE-----
	")

	;; An Ed25519 cleartext message with an S parameter of only 248 bits
	;; so that the code to re-insert the stripped zero byte kicks in.
	(define msg_ed25519_sshort "
	-----BEGIN PGP SIGNED MESSAGE-----
	Hash: SHA256

	All articles that coruscate with resplendence are not truly auriferous.
	-----BEGIN PGP SIGNATURE-----

	iJEEARYIADoWIQSyHeq0+HX7PaQvHR0TlWNoKgINCgUCV771QhwccGF0cmljZS5s
	dW11bWJhQGV4YW1wbGUubmV0AAoJEBOVY2gqAg0KHVEBAI66OPDYXKWO3r6SaFT+
	uxmh8x4ZerW41vMA9gkJ4AEKAPjoe/Z7fDqo1lCptIFutFAGbfNxcm/53prfx2fT
	GisM
	=L7sk
	-----END PGP SIGNATURE-----
	")



	;; Fixme: We need more tests with manipulated cleartext signatures.

	;;
	;; Now run the tests.
	;;
	(for-each-p
	"Checking that a valid signature is verified as such"
	(lambda (armored-file)
	(pipe:do
	(pipe:echo (eval armored-file (current-environment)))
	(pipe:spawn `(,@GPG --verify))))
	'(msg_ols_asc msg_cols_asc msg_sl_asc msg_oolss_asc msg_cls_asc msg_clss_asc))

	(for-each-p
	"Checking that a valid signature over multiple messages is verified as such"
	(lambda (armored-file)
	(pipe:do
	(pipe:echo (eval armored-file (current-environment)))
	(pipe:spawn `(,@GPG --verify --allow-multiple-messages)))
	(catch '()
	(pipe:do
	(pipe:defer (lambda (sink)
	(display armored-file (fdopen sink "w"))))
	(pipe:spawn `(,@GPG --verify)))
	(fail "verification succeeded but should not")))
	'(msg_olsols_asc_multiple msg_clsclss_asc_multiple))

	(for-each-p
	"Checking that an invalid signature is verified as such"
	(lambda (armored-file)
	(catch '()
	(pipe:do
	(pipe:echo (eval armored-file (current-environment)))
	(pipe:spawn `(,@GPG --verify)))
	(fail "verification succeeded but should not")))
	'(bad_ls_asc bad_fols_asc bad_olsf_asc bad_ools_asc))


	;;; Need to import the ed25519 sample key used for
	;;; the next two tests.
	(call-check `(,@GPG --quiet --yes --import ,(in-srcdir key-file2)))
	(for-each-p
	"Checking that a valid Ed25519 signature is verified as such"
	(lambda (armored-file)
	(pipe:do
	(pipe:echo (eval armored-file (current-environment)))
	(pipe:spawn `(,@GPG --verify))))
	'(msg_ed25519_rshort msg_ed25519_sshort))
	diff --git a/tools/gpg-connect-agent.c b/tools/gpg-connect-agent.c
	index 2d054f4da..59e219217 100644
	--- a/tools/gpg-connect-agent.c
	+++ b/tools/gpg-connect-agent.c
	@@ -1,2258 +1,2258 @@
	/* gpg-connect-agent.c - Tool to connect to the agent.
	* Copyright (C) 2005, 2007, 2008, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <ctype.h>
	#include <assuan.h>
	#include <unistd.h>
	#include <assert.h>

	#include "i18n.h"
	#include "../common/util.h"
	#include "../common/asshelp.h"
	#include "../common/sysutils.h"
	#include "../common/membuf.h"
	#include "../common/ttyio.h"
	#ifdef HAVE_W32_SYSTEM
	# include "../common/exechelp.h"
	#endif
	#include "../common/init.h"


	#define CONTROL_D ('D' - 'A' + 1)
	#define octdigitp(p) ((p) >= '0' && (p) <= '7')

	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,
	oQuiet = 'q',
	oVerbose = 'v',
	oRawSocket = 'S',
	oTcpSocket = 'T',
	oExec = 'E',
	oRun = 'r',
	oSubst = 's',

	oNoVerbose = 500,
	oHomedir,
	oAgentProgram,
	oDirmngrProgram,
	oHex,
	oDecode,
	oNoExtConnect,
	oDirmngr,
	oUIServer,
	oNoAutostart,

	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] = {
	ARGPARSE_group (301, N_("@\nOptions:\n ")),

	ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", N_("quiet")),
	ARGPARSE_s_n (oHex, "hex", N_("print data out hex encoded")),
	ARGPARSE_s_n (oDecode,"decode", N_("decode received data lines")),
	ARGPARSE_s_n (oDirmngr,"dirmngr", N_("connect to the dirmngr")),
	ARGPARSE_s_n (oUIServer, "uiserver", "@"),
	ARGPARSE_s_s (oRawSocket, "raw-socket",
	N_("\|NAME\|connect to Assuan socket NAME")),
	ARGPARSE_s_s (oTcpSocket, "tcp-socket",
	N_("\|ADDR\|connect to Assuan server at ADDR")),
	ARGPARSE_s_n (oExec, "exec",
	N_("run the Assuan server given on the command line")),
	ARGPARSE_s_n (oNoExtConnect, "no-ext-connect",
	N_("do not use extended connect mode")),
	ARGPARSE_s_s (oRun, "run",
	N_("\|FILE\|run commands from FILE on startup")),
	ARGPARSE_s_n (oSubst, "subst", N_("run /subst on startup")),

	ARGPARSE_s_n (oNoAutostart, "no-autostart", "@"),
	ARGPARSE_s_n (oNoVerbose, "no-verbose", "@"),
	ARGPARSE_s_s (oHomedir, "homedir", "@" ),
	ARGPARSE_s_s (oAgentProgram, "agent-program", "@"),
	ARGPARSE_s_s (oDirmngrProgram, "dirmngr-program", "@"),

	ARGPARSE_end ()
	};


	/* We keep all global options in the structure OPT. */
	struct
	{
	int verbose; /* Verbosity level. */
	int quiet; /* Be extra quiet. */
	int autostart; /* Start the server if not running. */
	const char homedir; / Configuration directory name */
	const char agent_program; / Value of --agent-program. */
	const char dirmngr_program; / Value of --dirmngr-program. */
	int hex; /* Print data lines in hex format. */
	int decode; /* Decode received data lines. */
	int use_dirmngr; /* Use the dirmngr and not gpg-agent. */
	int use_uiserver; /* Use the standard UI server. */
	const char raw_socket; / Name of socket to connect in raw mode. */
	const char tcp_socket; / Name of server to connect in tcp mode. */
	int exec; /* Run the pgm given on the command line. */
	unsigned int connect_flags; /* Flags used for connecting. */
	int enable_varsubst; /* Set if variable substitution is enabled. */
	int trim_leading_spaces;
	} opt;



	/* Definitions for /definq commands and a global linked list with all
	the definitions. */
	struct definq_s
	{
	struct definq_s *next;
	char name; / Name of inquiry or NULL for any name. */
	int is_var; /* True if FILE is a variable name. */
	int is_prog; /* True if FILE is a program to run. */
	char file[1]; /* Name of file or program. */
	};
	typedef struct definq_s *definq_t;

	static definq_t definq_list;
	static definq_t *definq_list_tail = &definq_list;


	/* Variable definitions and glovbal table. */
	struct variable_s
	{
	struct variable_s *next;
	char value; / Malloced value - always a string. */
	char name[1]; /* Name of the variable. */
	};
	typedef struct variable_s *variable_t;

	static variable_t variable_table;


	/* To implement loops we store entire lines in a linked list. */
	struct loopline_s
	{
	struct loopline_s *next;
	char line[1];
	};
	typedef struct loopline_s *loopline_t;


	/* This is used to store the pid of the server. */
	static pid_t server_pid = (pid_t)(-1);

	/* The current datasink file or NULL. */
	static FILE *current_datasink;

	/* A list of open file descriptors. */
	static struct
	{
	int inuse;
	#ifdef HAVE_W32_SYSTEM
	HANDLE handle;
	#endif
	} open_fd_table[256];


	/-- local prototypes --/
	static char substitute_line_copy (const char buffer);
	static int read_and_print_response (assuan_context_t ctx, int withhash,
	int *r_goterr);
	static assuan_context_t start_agent (void);




	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "@GPG@-connect-agent (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40: p = _("Usage: @GPG@-connect-agent [options] (-h for help)");
	break;
	case 41:
	p = _("Syntax: @GPG@-connect-agent [options]\n"
	"Connect to a running agent and send commands\n");
	break;
	case 31: p = "\nHome: "; break;
	case 32: p = gnupg_homedir (); break;
	case 33: p = "\n"; break;

	default: p = NULL; break;
	}
	return p;
	}


	/* Unescape STRING and returned the malloced result. The surrounding
	quotes must already be removed from STRING. */
	static char *
	unescape_string (const char *string)
	{
	const unsigned char *s;
	int esc;
	size_t n;
	char *buffer;
	unsigned char *d;

	n = 0;
	for (s = (const unsigned char)string, esc=0; s; s++)
	{
	if (esc)
	{
	switch (*s)
	{
	case 'b':
	case 't':
	case 'v':
	case 'n':
	case 'f':
	case 'r':
	case '"':
	case '\'':
	case '\\': n++; break;
	case 'x':
	if (s[1] && s[2] && hexdigitp (s+1) && hexdigitp (s+2))
	n++;
	break;

	default:
	if (s[1] && s[2]
	&& octdigitp (s) && octdigitp (s+1) && octdigitp (s+2))
	n++;
	break;
	}
	esc = 0;
	}
	else if (*s == '\\')
	esc = 1;
	else
	n++;
	}

	buffer = xmalloc (n+1);
	d = (unsigned char*)buffer;
	for (s = (const unsigned char)string, esc=0; s; s++)
	{
	if (esc)
	{
	switch (*s)
	{
	case 'b': *d++ = '\b'; break;
	case 't': *d++ = '\t'; break;
	case 'v': *d++ = '\v'; break;
	case 'n': *d++ = '\n'; break;
	case 'f': *d++ = '\f'; break;
	case 'r': *d++ = '\r'; break;
	case '"': *d++ = '\"'; break;
	case '\'': *d++ = '\''; break;
	case '\\': *d++ = '\\'; break;
	case 'x':
	if (s[1] && s[2] && hexdigitp (s+1) && hexdigitp (s+2))
	{
	s++;
	*d++ = xtoi_2 (s);
	s++;
	}
	break;

	default:
	if (s[1] && s[2]
	&& octdigitp (s) && octdigitp (s+1) && octdigitp (s+2))
	{
	d++ = (atoi_1 (s)64) + (atoi_1 (s+1)*8) + atoi_1 (s+2);
	s += 2;
	}
	break;
	}
	esc = 0;
	}
	else if (*s == '\\')
	esc = 1;
	else
	d++ = s;
	}
	*d = 0;
	return buffer;
	}


	/* Do the percent unescaping and return a newly malloced string.
	If WITH_PLUS is set '+' characters will be changed to space. */
	static char *
	unpercent_string (const char *string, int with_plus)
	{
	const unsigned char *s;
	unsigned char buffer, p;
	size_t n;

	n = 0;
	for (s=(const unsigned char )string; s; s++)
	{
	if (*s == '%' && s[1] && s[2])
	{
	s++;
	n++;
	s++;
	}
	else if (with_plus && *s == '+')
	n++;
	else
	n++;
	}

	buffer = xmalloc (n+1);
	p = buffer;
	for (s=(const unsigned char )string; s; s++)
	{
	if (*s == '%' && s[1] && s[2])
	{
	s++;
	*p++ = xtoi_2 (s);
	s++;
	}
	else if (with_plus && *s == '+')
	*p++ = ' ';
	else
	p++ = s;
	}
	*p = 0;
	return (char*)buffer;
	}





	static const char *
	set_var (const char name, const char value)
	{
	variable_t var;

	for (var = variable_table; var; var = var->next)
	if (!strcmp (var->name, name))
	break;
	if (!var)
	{
	var = xmalloc (sizeof *var + strlen (name));
	var->value = NULL;
	strcpy (var->name, name);
	var->next = variable_table;
	variable_table = var;
	}
	xfree (var->value);
	var->value = value? xstrdup (value) : NULL;
	return var->value;
	}


	static void
	set_int_var (const char *name, int value)
	{
	char numbuf[35];

	snprintf (numbuf, sizeof numbuf, "%d", value);
	set_var (name, numbuf);
	}


	/* Return the value of a variable. That value is valid until a
	variable of the name is changed. Return NULL if not found. Note
	that envvars are copied to our variable list at the first access
	and not at oprogram start. */
	static const char *
	get_var (const char *name)
	{
	variable_t var;
	const char *s;

	if (!*name)
	return "";
	for (var = variable_table; var; var = var->next)
	if (!strcmp (var->name, name))
	break;
	if (!var && (s = getenv (name)))
	return set_var (name, s);
	if (!var \|\| !var->value)
	return NULL;
	return var->value;
	}


	/* Perform some simple arithmetic operations. Caller must release
	the return value. On error the return value is NULL. */
	static char *
	arithmetic_op (int operator, const char *operands)
	{
	long result, value;
	char numbuf[35];

	while ( spacep (operands) )
	operands++;
	if (!*operands)
	return NULL;
	result = strtol (operands, NULL, 0);
	while (*operands && !spacep (operands) )
	operands++;
	if (operator == '!')
	result = !result;

	while (*operands)
	{
	while ( spacep (operands) )
	operands++;
	if (!*operands)
	break;
	value = strtol (operands, NULL, 0);
	while (*operands && !spacep (operands) )
	operands++;
	switch (operator)
	{
	case '+': result += value; break;
	case '-': result -= value; break;
	case '': result = value; break;
	case '/':
	if (!value)
	return NULL;
	result /= value;
	break;
	case '%':
	if (!value)
	return NULL;
	result %= value;
	break;
	case '!': result = !value; break;
	case '\|': result = result \|\| value; break;
	case '&': result = result && value; break;
	default:
	log_error ("unknown arithmetic operator '%c'\n", operator);
	return NULL;
	}
	}
	snprintf (numbuf, sizeof numbuf, "%ld", result);
	return xstrdup (numbuf);
	}



	/* Extended version of get_var. This returns a malloced string and
	understand the function syntax: "func args".

	Defined functions are

	get - Return a value described by the next argument:
	cwd - The current working directory.
	homedir - The gnupg homedir.
	sysconfdir - GnuPG's system configuration directory.
	bindir - GnuPG's binary directory.
	libdir - GnuPG's library directory.
	libexecdir - GnuPG's library directory for executable files.
	datadir - GnuPG's data directory.
	serverpid - The PID of the current server.

	unescape ARGS
	Remove C-style escapes from string. Note that "\0" and
	"\x00" terminate the string implictly. Use "\x7d" to
	represent the closing brace. The args start right after
	the first space after the function name.

	unpercent ARGS
	unpercent+ ARGS
	Remove percent style ecaping from string. Note that "%00
	terminates the string implicitly. Use "%7d" to represetn
	the closing brace. The args start right after the first
	space after the function name. "unpercent+" also maps '+'
	to space.

	percent ARGS
	percent+ ARGS
	Escape the args using the percent style. Tabs, formfeeds,
	linefeeds, carriage return, and the plus sign are also
	escaped. "percent+" also maps spaces to plus characters.

	errcode ARG
	Assuming ARG is an integer, return the gpg-error code.

	errsource ARG
	Assuming ARG is an integer, return the gpg-error source.

	errstring ARG
	Assuming ARG is an integer return a formatted fpf error string.


	Example: get_var_ext ("get sysconfdir") -> "/etc/gnupg"

	*/
	static char *
	get_var_ext (const char *name)
	{
	static int recursion_count;
	const char *s;
	char *result;
	char *p;
	char *free_me = NULL;
	int intvalue;

	if (recursion_count > 50)
	{
	log_error ("variables nested too deeply\n");
	return NULL;
	}

	recursion_count++;
	free_me = opt.enable_varsubst? substitute_line_copy (name) : NULL;
	if (free_me)
	name = free_me;
	for (s=name; *s && !spacep (s); s++)
	;
	if (!*s)
	{
	s = get_var (name);
	result = s? xstrdup (s): NULL;
	}
	else if ( (s - name) == 3 && !strncmp (name, "get", 3))
	{
	while ( spacep (s) )
	s++;
	if (!strcmp (s, "cwd"))
	{
	result = gnupg_getcwd ();
	if (!result)
	log_error ("getcwd failed: %s\n", strerror (errno));
	}
	else if (!strcmp (s, "homedir"))
	result = xstrdup (gnupg_homedir ());
	else if (!strcmp (s, "sysconfdir"))
	result = xstrdup (gnupg_sysconfdir ());
	else if (!strcmp (s, "bindir"))
	result = xstrdup (gnupg_bindir ());
	else if (!strcmp (s, "libdir"))
	result = xstrdup (gnupg_libdir ());
	else if (!strcmp (s, "libexecdir"))
	result = xstrdup (gnupg_libexecdir ());
	else if (!strcmp (s, "datadir"))
	result = xstrdup (gnupg_datadir ());
	else if (!strcmp (s, "serverpid"))
	result = xasprintf ("%d", (int)server_pid);
	else
	{
	log_error ("invalid argument '%s' for variable function 'get'\n", s);
	log_info ("valid are: cwd, "
	"{home,bin,lib,libexec,data}dir, serverpid\n");
	result = NULL;
	}
	}
	else if ( (s - name) == 8 && !strncmp (name, "unescape", 8))
	{
	s++;
	result = unescape_string (s);
	}
	else if ( (s - name) == 9 && !strncmp (name, "unpercent", 9))
	{
	s++;
	result = unpercent_string (s, 0);
	}
	else if ( (s - name) == 10 && !strncmp (name, "unpercent+", 10))
	{
	s++;
	result = unpercent_string (s, 1);
	}
	else if ( (s - name) == 7 && !strncmp (name, "percent", 7))
	{
	s++;
	result = percent_escape (s, "+\t\r\n\f\v");
	}
	else if ( (s - name) == 8 && !strncmp (name, "percent+", 8))
	{
	s++;
	result = percent_escape (s, "+\t\r\n\f\v");
	for (p=result; *p; p++)
	if (*p == ' ')
	*p = '+';
	}
	else if ( (s - name) == 7 && !strncmp (name, "errcode", 7))
	{
	s++;
	intvalue = (int)strtol (s, NULL, 0);
	result = xasprintf ("%d", gpg_err_code (intvalue));
	}
	else if ( (s - name) == 9 && !strncmp (name, "errsource", 9))
	{
	s++;
	intvalue = (int)strtol (s, NULL, 0);
	result = xasprintf ("%d", gpg_err_source (intvalue));
	}
	else if ( (s - name) == 9 && !strncmp (name, "errstring", 9))
	{
	s++;
	intvalue = (int)strtol (s, NULL, 0);
	result = xasprintf ("%s <%s>",
	gpg_strerror (intvalue), gpg_strsource (intvalue));
	}
	else if ( (s - name) == 1 && strchr ("+-/%!\|&", name))
	{
	result = arithmetic_op (*name, s+1);
	}
	else
	{
	log_error ("unknown variable function '%.*s'\n", (int)(s-name), name);
	result = NULL;
	}

	xfree (free_me);
	recursion_count--;
	return result;
	}


	/* Substitute variables in LINE and return a new allocated buffer if
	required. The function might modify LINE if the expanded version
	fits into it. */
	static char *
	substitute_line (char *buffer)
	{
	char *line = buffer;
	char p, pend;
	const char *value;
	size_t valuelen, n;
	char *result = NULL;
	char *freeme = NULL;

	while (*line)
	{
	p = strchr (line, '$');
	if (!p)
	return result; /* No more variables. */

	if (p[1] == '$') /* Escaped dollar sign. */
	{
	memmove (p, p+1, strlen (p+1)+1);
	line = p + 1;
	continue;
	}
	if (p[1] == '{')
	{
	int count = 0;

	for (pend=p+2; *pend; pend++)
	{
	if (*pend == '{')
	count++;
	else if (*pend == '}')
	{
	if (--count < 0)
	break;
	}
	}
	if (!*pend)
	return result; /* Unclosed - don't substitute. */
	}
	else
	{
	for (pend=p+1; pend && !spacep (pend) && pend != '$' ; pend++)
	;
	}
	if (p[1] == '{' && *pend == '}')
	{
	int save = *pend;
	*pend = 0;
	freeme = get_var_ext (p+2);
	value = freeme;
	*pend++ = save;
	}
	else if (*pend)
	{
	int save = *pend;
	*pend = 0;
	value = get_var (p+1);
	*pend = save;
	}
	else
	value = get_var (p+1);
	if (!value)
	value = "";
	valuelen = strlen (value);
	if (valuelen <= pend - p)
	{
	memcpy (p, value, valuelen);
	p += valuelen;
	n = pend - p;
	if (n)
	memmove (p, p+n, strlen (p+n)+1);
	line = p;
	}
	else
	{
	char *src = result? result : buffer;
	char *dst;

	dst = xmalloc (strlen (src) + valuelen + 1);
	n = p - src;
	memcpy (dst, src, n);
	memcpy (dst + n, value, valuelen);
	n += valuelen;
	strcpy (dst + n, pend);
	line = dst + n;
	xfree (result);
	result = dst;
	}
	xfree (freeme);
	freeme = NULL;
	}
	return result;
	}

	/* Same as substitute_line but do not modify BUFFER. */
	static char *
	substitute_line_copy (const char *buffer)
	{
	char result, p;

	p = xstrdup (buffer?buffer:"");
	result = substitute_line (p);
	if (!result)
	result = p;
	else
	xfree (p);
	return result;
	}


	static void
	assign_variable (char *line, int syslet)
	{
	char name, p, tmp, free_me, *buffer;

	/* Get the name. */
	name = line;
	for (p=name; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;

	if (!*p)
	set_var (name, NULL); /* Remove variable. */
	else if (syslet)
	{
	free_me = opt.enable_varsubst? substitute_line_copy (p) : NULL;
	if (free_me)
	p = free_me;
	buffer = xmalloc (4 + strlen (p) + 1);
	strcpy (stpcpy (buffer, "get "), p);
	tmp = get_var_ext (buffer);
	xfree (buffer);
	set_var (name, tmp);
	xfree (tmp);
	xfree (free_me);
	}
	else
	{
	tmp = opt.enable_varsubst? substitute_line_copy (p) : NULL;
	if (tmp)
	{
	set_var (name, tmp);
	xfree (tmp);
	}
	else
	set_var (name, p);
	}
	}


	static void
	show_variables (void)
	{
	variable_t var;

	for (var = variable_table; var; var = var->next)
	if (var->value)
	printf ("%-20s %s\n", var->name, var->value);
	}


	/* Store an inquire response pattern. Note, that this function may
	change the content of LINE. We assume that leading white spaces
	are already removed. */
	static void
	add_definq (char *line, int is_var, int is_prog)
	{
	definq_t d;
	char name, p;

	/* Get name. */
	name = line;
	for (p=name; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;

	d = xmalloc (sizeof *d + strlen (p) );
	strcpy (d->file, p);
	d->is_var = is_var;
	d->is_prog = is_prog;
	if ( !strcmp (name, "*"))
	d->name = NULL;
	else
	d->name = xstrdup (name);

	d->next = NULL;
	*definq_list_tail = d;
	definq_list_tail = &d->next;
	}


	/* Show all inquiry defintions. */
	static void
	show_definq (void)
	{
	definq_t d;

	for (d=definq_list; d; d = d->next)
	if (d->name)
	printf ("%-20s %c %s\n",
	d->name, d->is_var? 'v' : d->is_prog? 'p':'f', d->file);
	for (d=definq_list; d; d = d->next)
	if (!d->name)
	printf ("%-20s %c %s\n", "*",
	d->is_var? 'v': d->is_prog? 'p':'f', d->file);
	}


	/* Clear all inquiry definitions. */
	static void
	clear_definq (void)
	{
	while (definq_list)
	{
	definq_t tmp = definq_list->next;
	xfree (definq_list->name);
	xfree (definq_list);
	definq_list = tmp;
	}
	definq_list_tail = &definq_list;
	}


	static void
	do_sendfd (assuan_context_t ctx, char *line)
	{
	FILE *fp;
	char name, mode, *p;
	int rc, fd;

	/* Get file name. */
	name = line;
	for (p=name; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;

	/* Get mode. */
	mode = p;
	if (!*mode)
	mode = "r";
	else
	{
	for (p=mode; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	}

	/* Open and send. */
	fp = fopen (name, mode);
	if (!fp)
	{
	log_error ("can't open '%s' in \"%s\" mode: %s\n",
	name, mode, strerror (errno));
	return;
	}
	fd = fileno (fp);

	if (opt.verbose)
	log_error ("file '%s' opened in \"%s\" mode, fd=%d\n",
	name, mode, fd);

	rc = assuan_sendfd (ctx, INT2FD (fd) );
	if (rc)
	log_error ("sending descriptor %d failed: %s\n", fd, gpg_strerror (rc));
	fclose (fp);
	}


	static void
	do_recvfd (assuan_context_t ctx, char *line)
	{
	(void)ctx;
	(void)line;
	log_info ("This command has not yet been implemented\n");
	}


	static void
	do_open (char *line)
	{
	FILE *fp;
	char varname, name, mode, p;
	int fd;

	#ifdef HAVE_W32_SYSTEM
	if (server_pid == (pid_t)(-1))
	{
	log_error ("the pid of the server is unknown\n");
	log_info ("use command \"/serverpid\" first\n");
	return;
	}
	#endif

	/* Get variable name. */
	varname = line;
	for (p=varname; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;

	/* Get file name. */
	name = p;
	for (p=name; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;

	/* Get mode. */
	mode = p;
	if (!*mode)
	mode = "r";
	else
	{
	for (p=mode; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	}

	/* Open and send. */
	fp = fopen (name, mode);
	if (!fp)
	{
	log_error ("can't open '%s' in \"%s\" mode: %s\n",
	name, mode, strerror (errno));
	return;
	}
	fd = fileno (fp);
	if (fd >= 0 && fd < DIM (open_fd_table))
	{
	open_fd_table[fd].inuse = 1;
	#ifdef HAVE_W32CE_SYSTEM
	# warning fixme: implement our pipe emulation.
	#endif
	#if defined(HAVE_W32_SYSTEM) && !defined(HAVE_W32CE_SYSTEM)
	{
	HANDLE prochandle, handle, newhandle;

	handle = (void*)_get_osfhandle (fd);

	prochandle = OpenProcess (PROCESS_DUP_HANDLE, FALSE, server_pid);
	if (!prochandle)
	{
	log_error ("failed to open the server process\n");
	close (fd);
	return;
	}

	if (!DuplicateHandle (GetCurrentProcess(), handle,
	prochandle, &newhandle, 0,
	TRUE, DUPLICATE_SAME_ACCESS ))
	{
	log_error ("failed to duplicate the handle\n");
	close (fd);
	CloseHandle (prochandle);
	return;
	}
	CloseHandle (prochandle);
	open_fd_table[fd].handle = newhandle;
	}
	if (opt.verbose)
	log_info ("file '%s' opened in \"%s\" mode, fd=%d (libc=%d)\n",
	name, mode, (int)open_fd_table[fd].handle, fd);
	set_int_var (varname, (int)open_fd_table[fd].handle);
	#else
	if (opt.verbose)
	log_info ("file '%s' opened in \"%s\" mode, fd=%d\n",
	name, mode, fd);
	set_int_var (varname, fd);
	#endif
	}
	else
	{
	log_error ("can't put fd %d into table\n", fd);
	close (fd);
	}
	}


	static void
	do_close (char *line)
	{
	int fd = atoi (line);

	#ifdef HAVE_W32_SYSTEM
	int i;

	for (i=0; i < DIM (open_fd_table); i++)
	if ( open_fd_table[i].inuse && open_fd_table[i].handle == (void*)fd)
	break;
	if (i < DIM (open_fd_table))
	fd = i;
	else
	{
	log_error ("given fd (system handle) has not been opened\n");
	return;
	}
	#endif

	if (fd < 0 \|\| fd >= DIM (open_fd_table))
	{
	log_error ("invalid fd\n");
	return;
	}

	if (!open_fd_table[fd].inuse)
	{
	log_error ("given fd has not been opened\n");
	return;
	}
	#ifdef HAVE_W32_SYSTEM
	CloseHandle (open_fd_table[fd].handle); /* Close duped handle. */
	#endif
	close (fd);
	open_fd_table[fd].inuse = 0;
	}


	static void
	do_showopen (void)
	{
	int i;

	for (i=0; i < DIM (open_fd_table); i++)
	if (open_fd_table[i].inuse)
	{
	#ifdef HAVE_W32_SYSTEM
	printf ("%-15d (libc=%d)\n", (int)open_fd_table[i].handle, i);
	#else
	printf ("%-15d\n", i);
	#endif
	}
	}



	static gpg_error_t
	getinfo_pid_cb (void opaque, const void buffer, size_t length)
	{
	membuf_t *mb = opaque;
	put_membuf (mb, buffer, length);
	return 0;
	}

	/* Get the pid of the server and store it locally. */
	static void
	do_serverpid (assuan_context_t ctx)
	{
	int rc;
	membuf_t mb;
	char *buffer;

	init_membuf (&mb, 100);
	rc = assuan_transact (ctx, "GETINFO pid", getinfo_pid_cb, &mb,
	NULL, NULL, NULL, NULL);
	put_membuf (&mb, "", 1);
	buffer = get_membuf (&mb, NULL);
	if (rc \|\| !buffer)
	log_error ("command \"%s\" failed: %s\n",
	"GETINFO pid", gpg_strerror (rc));
	else
	{
	server_pid = (pid_t)strtoul (buffer, NULL, 10);
	if (opt.verbose)
	log_info ("server's PID is %lu\n", (unsigned long)server_pid);
	}
	xfree (buffer);
	}


	/* Return true if the command is either "HELP" or "SCD HELP". */
	static int
	help_cmd_p (const char *line)
	{
	if (!ascii_strncasecmp (line, "SCD", 3)
	&& (spacep (line+3) \|\| !line[3]))
	{
	for (line += 3; spacep (line); line++)
	;
	}

	return (!ascii_strncasecmp (line, "HELP", 4)
	&& (spacep (line+4) \|\| !line[4]));
	}


	/* gpg-connect-agent's entry point. */
	int
	main (int argc, char **argv)
	{
	ARGPARSE_ARGS pargs;
	int no_more_options = 0;
	assuan_context_t ctx;
	char line, p;
	char *tmpline;
	size_t linesize;
	int rc;
	int cmderr;
	const char *opt_run = NULL;
	gpgrt_stream_t script_fp = NULL;
	int use_tty, keep_line;
	struct {
	int collecting;
	loopline_t head;
	loopline_t *tail;
	loopline_t current;
	unsigned int nestlevel;
	int oneshot;
	char *condition;
	} loopstack[20];
	int loopidx;
	char **cmdline_commands = NULL;

	early_system_init ();
	gnupg_rl_initialize ();
	set_strusage (my_strusage);
	log_set_prefix ("gpg-connect-agent", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);

	assuan_set_gpg_err_source (0);


	opt.autostart = 1;
	opt.connect_flags = 1;

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = 1; /* Do not remove the args. */
	while (!no_more_options && optfile_parse (NULL, NULL, NULL, &pargs, opts))
	{
	switch (pargs.r_opt)
	{
	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;
	case oNoVerbose: opt.verbose = 0; break;
	case oHomedir: gnupg_set_homedir (pargs.r.ret_str); break;
	case oAgentProgram: opt.agent_program = pargs.r.ret_str; break;
	case oDirmngrProgram: opt.dirmngr_program = pargs.r.ret_str; break;
	case oNoAutostart: opt.autostart = 0; break;
	case oHex: opt.hex = 1; break;
	case oDecode: opt.decode = 1; break;
	case oDirmngr: opt.use_dirmngr = 1; break;
	case oUIServer: opt.use_uiserver = 1; break;
	case oRawSocket: opt.raw_socket = pargs.r.ret_str; break;
	case oTcpSocket: opt.tcp_socket = pargs.r.ret_str; break;
	case oExec: opt.exec = 1; break;
	case oNoExtConnect: opt.connect_flags &= ~(1); break;
	case oRun: opt_run = pargs.r.ret_str; break;
	case oSubst:
	opt.enable_varsubst = 1;
	opt.trim_leading_spaces = 1;
	break;

	default: pargs.err = 2; break;
	}
	}

	if (log_get_errorcount (0))
	exit (2);

	/* --uiserver is a shortcut for a specific raw socket. This comes
	in particular handy on Windows. */
	if (opt.use_uiserver)
	{
	opt.raw_socket = make_absfilename (gnupg_homedir (), "S.uiserver", NULL);
	}

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (_("Note: '%s' is not considered an option\n"), argv[i]);
	}


	use_tty = (gnupg_isatty (fileno (stdin)) && gnupg_isatty (fileno (stdout)));

	if (opt.exec)
	{
	if (!argc)
	{
	log_error (_("option \"%s\" requires a program "
	"and optional arguments\n"), "--exec" );
	exit (1);
	}
	}
	else if (argc)
	cmdline_commands = argv;

	if (opt.exec && opt.raw_socket)
	{
	opt.raw_socket = NULL;
	log_info (_("option \"%s\" ignored due to \"%s\"\n"),
	"--raw-socket", "--exec");
	}
	if (opt.exec && opt.tcp_socket)
	{
	opt.tcp_socket = NULL;
	log_info (_("option \"%s\" ignored due to \"%s\"\n"),
	"--tcp-socket", "--exec");
	}
	if (opt.tcp_socket && opt.raw_socket)
	{
	opt.tcp_socket = NULL;
	log_info (_("option \"%s\" ignored due to \"%s\"\n"),
	"--tcp-socket", "--raw-socket");
	}

	if (opt_run && !(script_fp = gpgrt_fopen (opt_run, "r")))
	{
	log_error ("cannot open run file '%s': %s\n",
	opt_run, strerror (errno));
	exit (1);
	}


	if (opt.exec)
	{
	assuan_fd_t no_close[3];

	no_close[0] = assuan_fd_from_posix_fd (es_fileno (es_stderr));
	no_close[1] = assuan_fd_from_posix_fd (log_get_fd ());
	no_close[2] = ASSUAN_INVALID_FD;

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("assuan_new failed: %s\n", gpg_strerror (rc));
	exit (1);
	}

	rc = assuan_pipe_connect
	(ctx, argv, (const char *)argv, no_close, NULL, NULL,
	(opt.connect_flags & 1) ? ASSUAN_PIPE_CONNECT_FDPASSING : 0);
	if (rc)
	{
	log_error ("assuan_pipe_connect_ext failed: %s\n",
	gpg_strerror (rc));
	exit (1);
	}

	if (opt.verbose)
	log_info ("server '%s' started\n", *argv);

	}
	else if (opt.raw_socket)
	{
	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("assuan_new failed: %s\n", gpg_strerror (rc));
	exit (1);
	}

	rc = assuan_socket_connect
	(ctx, opt.raw_socket, 0,
	(opt.connect_flags & 1) ? ASSUAN_SOCKET_CONNECT_FDPASSING : 0);
	if (rc)
	{
	log_error ("can't connect to socket '%s': %s\n",
	opt.raw_socket, gpg_strerror (rc));
	exit (1);
	}

	if (opt.verbose)
	log_info ("connection to socket '%s' established\n", opt.raw_socket);
	}
	else if (opt.tcp_socket)
	{
	char *url;

	url = xstrconcat ("assuan://", opt.tcp_socket, NULL);

	rc = assuan_new (&ctx);
	if (rc)
	{
	log_error ("assuan_new failed: %s\n", gpg_strerror (rc));
	exit (1);
	}

	rc = assuan_socket_connect (ctx, opt.tcp_socket, 0, 0);
	if (rc)
	{
	log_error ("can't connect to server '%s': %s\n",
	opt.tcp_socket, gpg_strerror (rc));
	exit (1);
	}

	if (opt.verbose)
	log_info ("connection to socket '%s' established\n", url);

	xfree (url);
	}
	else
	ctx = start_agent ();

	/* See whether there is a line pending from the server (in case
	assuan did not run the initial handshaking). */
	if (assuan_pending_line (ctx))
	{
	rc = read_and_print_response (ctx, 0, &cmderr);
	if (rc)
	log_info (_("receiving line failed: %s\n"), gpg_strerror (rc) );
	}


	for (loopidx=0; loopidx < DIM (loopstack); loopidx++)
	loopstack[loopidx].collecting = 0;
	loopidx = -1;
	line = NULL;
	linesize = 0;
	keep_line = 1;
	for (;;)
	{
	int n;
	size_t maxlength = 2048;

	assert (loopidx < (int)DIM (loopstack));
	if (loopidx >= 0 && loopstack[loopidx].current)
	{
	keep_line = 0;
	xfree (line);
	line = xstrdup (loopstack[loopidx].current->line);
	n = strlen (line);
	/* Never go beyond of the final /end. */
	if (loopstack[loopidx].current->next)
	loopstack[loopidx].current = loopstack[loopidx].current->next;
	else if (!strncmp (line, "/end", 4) && (!line[4]\|\|spacep(line+4)))
	;
	else
	log_fatal ("/end command vanished\n");
	}
	else if (cmdline_commands && *cmdline_commands && !script_fp)
	{
	keep_line = 0;
	xfree (line);
	line = xstrdup (*cmdline_commands);
	cmdline_commands++;
	n = strlen (line);
	if (n >= maxlength)
	maxlength = 0;
	}
	else if (use_tty && !script_fp)
	{
	keep_line = 0;
	xfree (line);
	line = tty_get ("> ");
	n = strlen (line);
	if (n==1 && *line == CONTROL_D)
	n = 0;
	if (n >= maxlength)
	maxlength = 0;
	}
	else
	{
	if (!keep_line)
	{
	xfree (line);
	line = NULL;
	linesize = 0;
	keep_line = 1;
	}
	n = gpgrt_read_line (script_fp ? script_fp : gpgrt_stdin,
	&line, &linesize, &maxlength);
	}
	if (n < 0)
	{
	log_error (_("error reading input: %s\n"), strerror (errno));
	if (script_fp)
	{
	gpgrt_fclose (script_fp);
	script_fp = NULL;
	log_error ("stopping script execution\n");
	continue;
	}
	exit (1);
	}
	if (!n)
	{
	/* EOF */
	if (script_fp)
	{
	gpgrt_fclose (script_fp);
	script_fp = NULL;
	if (opt.verbose)
	log_info ("end of script\n");
	continue;
	}
	break;
	}
	if (!maxlength)
	{
	log_error (_("line too long - skipped\n"));
	continue;
	}
	if (memchr (line, 0, n))
	log_info (_("line shortened due to embedded Nul character\n"));
	if (line[n-1] == '\n')
	line[n-1] = 0;

	if (opt.trim_leading_spaces)
	{
	const char *s = line;

	while (spacep (s))
	s++;
	if (s != line)
	{
	for (p=line; *s;)
	p++ = s++;
	*p = 0;
	n = p - line;
	}
	}

	if (loopidx+1 >= 0 && loopstack[loopidx+1].collecting)
	{
	loopline_t ll;

	ll = xmalloc (sizeof *ll + strlen (line));
	ll->next = NULL;
	strcpy (ll->line, line);
	*loopstack[loopidx+1].tail = ll;
	loopstack[loopidx+1].tail = &ll->next;

	if (!strncmp (line, "/end", 4) && (!line[4]\|\|spacep(line+4)))
	loopstack[loopidx+1].nestlevel--;
	else if (!strncmp (line, "/while", 6) && (!line[6]\|\|spacep(line+6)))
	loopstack[loopidx+1].nestlevel++;

	if (loopstack[loopidx+1].nestlevel)
	continue;
	/* We reached the corresponding /end. */
	loopstack[loopidx+1].collecting = 0;
	loopidx++;
	}

	if (*line == '/')
	{
	/* Handle control commands. */
	char *cmd = line+1;

	for (p=cmd; *p && !spacep (p); p++)
	;
	if (*p)
	*p++ = 0;
	while (spacep (p))
	p++;
	if (!strcmp (cmd, "let"))
	{
	assign_variable (p, 0);
	}
	else if (!strcmp (cmd, "slet"))
	{
	/* Deprecated - never used in a released version. */
	assign_variable (p, 1);
	}
	else if (!strcmp (cmd, "showvar"))
	{
	show_variables ();
	}
	else if (!strcmp (cmd, "definq"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	add_definq (tmpline, 1, 0);
	xfree (tmpline);
	}
	else
	add_definq (p, 1, 0);
	}
	else if (!strcmp (cmd, "definqfile"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	add_definq (tmpline, 0, 0);
	xfree (tmpline);
	}
	else
	add_definq (p, 0, 0);
	}
	else if (!strcmp (cmd, "definqprog"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	add_definq (tmpline, 0, 1);
	xfree (tmpline);
	}
	else
	add_definq (p, 0, 1);
	}
	else if (!strcmp (cmd, "datafile"))
	{
	const char *fname;

	if (current_datasink)
	{
	if (current_datasink != stdout)
	fclose (current_datasink);
	current_datasink = NULL;
	}
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	fname = tmpline? tmpline : p;
	if (fname && !strcmp (fname, "-"))
	current_datasink = stdout;
	else if (fname && *fname)
	{
	current_datasink = fopen (fname, "wb");
	if (!current_datasink)
	log_error ("can't open '%s': %s\n",
	fname, strerror (errno));
	}
	xfree (tmpline);
	}
	else if (!strcmp (cmd, "showdef"))
	{
	show_definq ();
	}
	else if (!strcmp (cmd, "cleardef"))
	{
	clear_definq ();
	}
	else if (!strcmp (cmd, "echo"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	puts (tmpline);
	xfree (tmpline);
	}
	else
	puts (p);
	}
	else if (!strcmp (cmd, "sendfd"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	do_sendfd (ctx, tmpline);
	xfree (tmpline);
	}
	else
	do_sendfd (ctx, p);
	continue;
	}
	else if (!strcmp (cmd, "recvfd"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	do_recvfd (ctx, tmpline);
	xfree (tmpline);
	}
	else
	do_recvfd (ctx, p);
	continue;
	}
	else if (!strcmp (cmd, "open"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	do_open (tmpline);
	xfree (tmpline);
	}
	else
	do_open (p);
	}
	else if (!strcmp (cmd, "close"))
	{
	tmpline = opt.enable_varsubst? substitute_line (p) : NULL;
	if (tmpline)
	{
	do_close (tmpline);
	xfree (tmpline);
	}
	else
	do_close (p);
	}
	else if (!strcmp (cmd, "showopen"))
	{
	do_showopen ();
	}
	else if (!strcmp (cmd, "serverpid"))
	{
	do_serverpid (ctx);
	}
	else if (!strcmp (cmd, "hex"))
	opt.hex = 1;
	else if (!strcmp (cmd, "nohex"))
	opt.hex = 0;
	else if (!strcmp (cmd, "decode"))
	opt.decode = 1;
	else if (!strcmp (cmd, "nodecode"))
	opt.decode = 0;
	else if (!strcmp (cmd, "subst"))
	{
	opt.enable_varsubst = 1;
	opt.trim_leading_spaces = 1;
	}
	else if (!strcmp (cmd, "nosubst"))
	opt.enable_varsubst = 0;
	else if (!strcmp (cmd, "run"))
	{
	char *p2;

	for (p2=p; *p2 && !spacep (p2); p2++)
	;
	if (*p2)
	*p2++ = 0;
	while (spacep (p2))
	p++;
	if (*p2)
	{
	log_error ("syntax error in run command\n");
	if (script_fp)
	{
	gpgrt_fclose (script_fp);
	script_fp = NULL;
	}
	}
	else if (script_fp)
	{
	log_error ("cannot nest run commands - stop\n");
	gpgrt_fclose (script_fp);
	script_fp = NULL;
	}
	else if (!(script_fp = gpgrt_fopen (p, "r")))
	{
	log_error ("cannot open run file '%s': %s\n",
	p, strerror (errno));
	}
	else if (opt.verbose)
	log_info ("running commands from '%s'\n", p);
	}
	else if (!strcmp (cmd, "while"))
	{
	if (loopidx+2 >= (int)DIM(loopstack))
	{
	log_error ("blocks are nested too deep\n");
	/* We should better die or break all loop in this
	case as recovering from this error won't be
	easy. */
	}
	else
	{
	loopstack[loopidx+1].head = NULL;
	loopstack[loopidx+1].tail = &loopstack[loopidx+1].head;
	loopstack[loopidx+1].current = NULL;
	loopstack[loopidx+1].nestlevel = 1;
	loopstack[loopidx+1].oneshot = 0;
	loopstack[loopidx+1].condition = xstrdup (p);
	loopstack[loopidx+1].collecting = 1;
	}
	}
	else if (!strcmp (cmd, "if"))
	{
	if (loopidx+2 >= (int)DIM(loopstack))
	{
	log_error ("blocks are nested too deep\n");
	}
	else
	{
	/* Note that we need to evaluate the condition right
	away and not just at the end of the block as we
	do with a WHILE. */
	loopstack[loopidx+1].head = NULL;
	loopstack[loopidx+1].tail = &loopstack[loopidx+1].head;
	loopstack[loopidx+1].current = NULL;
	loopstack[loopidx+1].nestlevel = 1;
	loopstack[loopidx+1].oneshot = 1;
	loopstack[loopidx+1].condition = substitute_line_copy (p);
	loopstack[loopidx+1].collecting = 1;
	}
	}
	else if (!strcmp (cmd, "end"))
	{
	if (loopidx < 0)
	log_error ("stray /end command encountered - ignored\n");
	else
	{
	char *tmpcond;
	const char *value;
	long condition;

	/* Evaluate the condition. */
	tmpcond = xstrdup (loopstack[loopidx].condition);
	if (loopstack[loopidx].oneshot)
	{
	xfree (loopstack[loopidx].condition);
	loopstack[loopidx].condition = xstrdup ("0");
	}
	tmpline = substitute_line (tmpcond);
	value = tmpline? tmpline : tmpcond;
	/* "true" or "yes" are commonly used to mean TRUE;
	all other strings will evaluate to FALSE due to
	the strtoul. */
	if (!ascii_strcasecmp (value, "true")
	\|\| !ascii_strcasecmp (value, "yes"))
	condition = 1;
	else
	condition = strtol (value, NULL, 0);
	xfree (tmpline);
	xfree (tmpcond);

	if (condition)
	{
	/* Run loop. */
	loopstack[loopidx].current = loopstack[loopidx].head;
	}
	else
	{
	/* Cleanup. */
	while (loopstack[loopidx].head)
	{
	loopline_t tmp = loopstack[loopidx].head->next;
	xfree (loopstack[loopidx].head);
	loopstack[loopidx].head = tmp;
	}
	loopstack[loopidx].tail = NULL;
	loopstack[loopidx].current = NULL;
	loopstack[loopidx].nestlevel = 0;
	loopstack[loopidx].collecting = 0;
	loopstack[loopidx].oneshot = 0;
	xfree (loopstack[loopidx].condition);
	loopstack[loopidx].condition = NULL;
	loopidx--;
	}
	}
	}
	else if (!strcmp (cmd, "bye"))
	{
	break;
	}
	else if (!strcmp (cmd, "sleep"))
	{
	gnupg_sleep (1);
	}
	else if (!strcmp (cmd, "help"))
	{
	puts (
	"Available commands:\n"
	"/echo ARGS Echo ARGS.\n"
	"/let NAME VALUE Set variable NAME to VALUE.\n"
	"/showvar Show all variables.\n"
	"/definq NAME VAR Use content of VAR for inquiries with NAME.\n"
	"/definqfile NAME FILE Use content of FILE for inquiries with NAME.\n"
	"/definqprog NAME PGM Run PGM for inquiries with NAME.\n"
	"/datafile [NAME] Write all D line content to file NAME.\n"
	"/showdef Print all definitions.\n"
	"/cleardef Delete all definitions.\n"
	"/sendfd FILE MODE Open FILE and pass descriptor to server.\n"
	"/recvfd Receive FD from server and print.\n"
	"/open VAR FILE MODE Open FILE and assign the file descriptor to VAR.\n"
	"/close FD Close file with descriptor FD.\n"
	"/showopen Show descriptors of all open files.\n"
	"/serverpid Retrieve the pid of the server.\n"
	"/[no]hex Enable hex dumping of received data lines.\n"
	"/[no]decode Enable decoding of received data lines.\n"
	"/[no]subst Enable variable substitution.\n"
	"/run FILE Run commands from FILE.\n"
	"/if VAR Begin conditional block controlled by VAR.\n"
	"/while VAR Begin loop controlled by VAR.\n"
	"/end End loop or condition\n"
	"/bye Terminate gpg-connect-agent.\n"
	"/help Print this help.");
	}
	else
	log_error (_("unknown command '%s'\n"), cmd );

	continue;
	}

	if (opt.verbose && script_fp)
	puts (line);

	tmpline = opt.enable_varsubst? substitute_line (line) : NULL;
	if (tmpline)
	{
	rc = assuan_write_line (ctx, tmpline);
	xfree (tmpline);
	}
	else
	rc = assuan_write_line (ctx, line);
	if (rc)
	{
	log_info (_("sending line failed: %s\n"), gpg_strerror (rc) );
	break;
	}
	if (line == '#' \|\| !line)
	continue; /* Don't expect a response for a comment line. */

	rc = read_and_print_response (ctx, help_cmd_p (line), &cmderr);
	if (rc)
	log_info (_("receiving line failed: %s\n"), gpg_strerror (rc) );
	if ((rc \|\| cmderr) && script_fp)
	{
	log_error ("stopping script execution\n");
	gpgrt_fclose (script_fp);
	script_fp = NULL;
	}


	/* FIXME: If the last command was BYE or the server died for
	some other reason, we won't notice until we get the next
	input command. Probing the connection with a non-blocking
	read could help to notice termination or other problems
	early. */
	}

	if (opt.verbose)
	log_info ("closing connection to agent\n");

	/* XXX: We would like to release the context here, but libassuan
	nicely says good bye to the server, which results in a SIGPIPE if
	the server died. Unfortunately, libassuan does not ignore
	SIGPIPE when used with UNIX sockets, hence we simply leak the
	context here. */
	if (0)
	assuan_release (ctx);
	else
	gpgrt_annotate_leaked_object (ctx);
	xfree (line);
	return 0;
	}


	/* Handle an Inquire from the server. Return False if it could not be
	handled; in this case the caller shll complete the operation. LINE
	is the complete line as received from the server. This function
	may change the content of LINE. */
	static int
	handle_inquire (assuan_context_t ctx, char *line)
	{
	const char *name;
	definq_t d;
	FILE *fp = NULL;
	char buffer[1024];
	int rc, n;

	/* Skip the command and trailing spaces. */
	for (; *line && !spacep (line); line++)
	;
	while (spacep (line))
	line++;
	/* Get the name. */
	name = line;
	for (; *line && !spacep (line); line++)
	;
	if (*line)
	*line++ = 0;

	/* Now match it against our list. The second loop is there to
	detect the match-all entry. */
	for (d=definq_list; d; d = d->next)
	if (d->name && !strcmp (d->name, name))
	break;
	if (!d)
	for (d=definq_list; d; d = d->next)
	if (!d->name)
	break;
	if (!d)
	{
	if (opt.verbose)
	log_info ("no handler for inquiry '%s' found\n", name);
	return 0;
	}

	if (d->is_var)
	{
	char *tmpvalue = get_var_ext (d->file);
	if (tmpvalue)
	rc = assuan_send_data (ctx, tmpvalue, strlen (tmpvalue));
	else
	rc = assuan_send_data (ctx, "", 0);
	xfree (tmpvalue);
	if (rc)
	log_error ("sending data back failed: %s\n", gpg_strerror (rc) );
	}
	else
	{
	if (d->is_prog)
	{
	#ifdef HAVE_W32CE_SYSTEM
	fp = NULL;
	#else
	fp = popen (d->file, "r");
	#endif
	if (!fp)
	log_error ("error executing '%s': %s\n",
	d->file, strerror (errno));
	else if (opt.verbose)
	log_error ("handling inquiry '%s' by running '%s'\n",
	name, d->file);
	}
	else
	{
	fp = fopen (d->file, "rb");
	if (!fp)
	log_error ("error opening '%s': %s\n", d->file, strerror (errno));
	else if (opt.verbose)
	log_error ("handling inquiry '%s' by returning content of '%s'\n",
	name, d->file);
	}
	if (!fp)
	return 0;

	while ( (n = fread (buffer, 1, sizeof buffer, fp)) )
	{
	rc = assuan_send_data (ctx, buffer, n);
	if (rc)
	{
	log_error ("sending data back failed: %s\n", gpg_strerror (rc) );
	break;
	}
	}
	if (ferror (fp))
	log_error ("error reading from '%s': %s\n", d->file, strerror (errno));
	}

	rc = assuan_send_data (ctx, NULL, 0);
	if (rc)
	log_error ("sending data back failed: %s\n", gpg_strerror (rc) );

	if (d->is_var)
	;
	else if (d->is_prog)
	{
	#ifndef HAVE_W32CE_SYSTEM
	if (pclose (fp))
	log_error ("error running '%s': %s\n", d->file, strerror (errno));
	#endif
	}
	else
	fclose (fp);
	return 1;
	}


	/* Read all response lines from server and print them. Returns 0 on
	success or an assuan error code. If WITHHASH istrue, comment lines
	are printed. Sets R_GOTERR to true if the command did not returned
	OK. */
	static int
	read_and_print_response (assuan_context_t ctx, int withhash, int *r_goterr)
	{
	char *line;
	size_t linelen;
	gpg_error_t rc;
	int i, j;
	int need_lf = 0;

	*r_goterr = 0;
	for (;;)
	{
	do
	{
	rc = assuan_read_line (ctx, &line, &linelen);
	if (rc)
	return rc;

	if ((withhash \|\| opt.verbose > 1) && *line == '#')
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	}
	while (*line == '#' \|\| !linelen);

	if (linelen >= 1
	&& line[0] == 'D' && line[1] == ' ')
	{
	if (current_datasink)
	{
	const unsigned char *s;
	int c = 0;

	for (j=2, s=(unsigned char*)line+2; j < linelen; j++, s++ )
	{
	if (*s == '%' && j+2 < linelen)
	{
	s++; j++;
	c = xtoi_2 ( s );
	s++; j++;
	}
	else
	c = *s;
	putc (c, current_datasink);
	}
	}
	else if (opt.hex)
	{
	for (i=2; i < linelen; )
	{
	int save_i = i;

	printf ("D[%04X] ", i-2);
	for (j=0; j < 16 ; j++, i++)
	{
	if (j == 8)
	putchar (' ');
	if (i < linelen)
	printf (" %02X", ((unsigned char*)line)[i]);
	else
	fputs (" ", stdout);
	}
	fputs (" ", stdout);
	i= save_i;
	for (j=0; j < 16; j++, i++)
	{
	unsigned int c = ((unsigned char*)line)[i];
	if ( i >= linelen )
	putchar (' ');
	else if (isascii (c) && isprint (c) && !iscntrl (c))
	putchar (c);
	else
	putchar ('.');
	}
	putchar ('\n');
	}
	}
	else if (opt.decode)
	{
	const unsigned char *s;
	int need_d = 1;
	int c = 0;

	for (j=2, s=(unsigned char*)line+2; j < linelen; j++, s++ )
	{
	if (need_d)
	{
	fputs ("D ", stdout);
	need_d = 0;
	}
	if (*s == '%' && j+2 < linelen)
	{
	s++; j++;
	c = xtoi_2 ( s );
	s++; j++;
	}
	else
	c = *s;
	if (c == '\n')
	need_d = 1;
	putchar (c);
	}
	need_lf = (c != '\n');
	}
	else
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	}
	else
	{
	if (need_lf)
	{
	if (!current_datasink \|\| current_datasink != stdout)
	putchar ('\n');
	need_lf = 0;
	}

	if (linelen >= 1
	&& line[0] == 'S'
	&& (line[1] == '\0' \|\| line[1] == ' '))
	{
	if (!current_datasink \|\| current_datasink != stdout)
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	}
	else if (linelen >= 2
	&& line[0] == 'O' && line[1] == 'K'
	&& (line[2] == '\0' \|\| line[2] == ' '))
	{
	if (!current_datasink \|\| current_datasink != stdout)
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	set_int_var ("?", 0);
	return 0;
	}
	else if (linelen >= 3
	&& line[0] == 'E' && line[1] == 'R' && line[2] == 'R'
	&& (line[3] == '\0' \|\| line[3] == ' '))
	{
	int errval;

	errval = strtol (line+3, NULL, 10);
	if (!errval)
	errval = -1;
	set_int_var ("?", errval);
	if (!current_datasink \|\| current_datasink != stdout)
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	*r_goterr = 1;
	return 0;
	}
	else if (linelen >= 7
	&& line[0] == 'I' && line[1] == 'N' && line[2] == 'Q'
	&& line[3] == 'U' && line[4] == 'I' && line[5] == 'R'
	&& line[6] == 'E'
	&& (line[7] == '\0' \|\| line[7] == ' '))
	{
	if (!current_datasink \|\| current_datasink != stdout)
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	if (!handle_inquire (ctx, line))
	assuan_write_line (ctx, "CANCEL");
	}
	else if (linelen >= 3
	&& line[0] == 'E' && line[1] == 'N' && line[2] == 'D'
	&& (line[3] == '\0' \|\| line[3] == ' '))
	{
	if (!current_datasink \|\| current_datasink != stdout)
	{
	fwrite (line, linelen, 1, stdout);
	putchar ('\n');
	}
	/* Received from server, thus more responses are expected. */
	}
	else
	return gpg_error (GPG_ERR_ASS_INV_RESPONSE);
	}
	}
	}




	/* Connect to the agent and send the standard options. */
	static assuan_context_t
	start_agent (void)
	{
	gpg_error_t err;
	assuan_context_t ctx;
	session_env_t session_env;

	session_env = session_env_new ();
	if (!session_env)
	log_fatal ("error allocating session environment block: %s\n",
	strerror (errno));
	if (opt.use_dirmngr)
	err = start_new_dirmngr (&ctx,
	GPG_ERR_SOURCE_DEFAULT,
	opt.dirmngr_program,
	opt.autostart,
	!opt.quiet, 0,
	NULL, NULL);
	else
	err = start_new_gpg_agent (&ctx,
	GPG_ERR_SOURCE_DEFAULT,
	opt.agent_program,
	NULL, NULL,
	session_env,
	opt.autostart,
	!opt.quiet, 0,
	NULL, NULL);

	session_env_release (session_env);
	if (err)
	{
	if (!opt.autostart
	&& (gpg_err_code (err)
	== opt.use_dirmngr? GPG_ERR_NO_DIRMNGR : GPG_ERR_NO_AGENT))
	{
	/* In the no-autostart case we don't make gpg-connect-agent
	fail on a missing server. */
	log_info (opt.use_dirmngr?
	_("no dirmngr running in this session\n"):
	_("no gpg-agent running in this session\n"));
	exit (0);
	}
	else
	{
	log_error (_("error sending standard options: %s\n"),
	gpg_strerror (err));
	exit (1);
	}
	}

	return ctx;
	}
	diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
	index 5814b4056..fa19fc14c 100644
	--- a/tools/gpg-wks-client.c
	+++ b/tools/gpg-wks-client.c
	@@ -1,1167 +1,1167 @@
	/* gpg-wks-client.c - A client for the Web Key Service protocols.
	* Copyright (C) 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "util.h"
	#include "status.h"
	#include "i18n.h"
	#include "sysutils.h"
	#include "init.h"
	#include "asshelp.h"
	#include "userids.h"
	#include "ccparray.h"
	#include "exectool.h"
	#include "mbox-util.h"
	#include "name-value.h"
	#include "call-dirmngr.h"
	#include "mime-maker.h"
	#include "send-mail.h"
	#include "gpg-wks.h"


	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,

	oQuiet = 'q',
	oVerbose = 'v',
	oOutput = 'o',

	oDebug = 500,

	aSupported,
	aCheck,
	aCreate,
	aReceive,
	aRead,

	oGpgProgram,
	oSend,
	oFakeSubmissionAddr,
	oStatusFD,

	oDummy
	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] = {
	ARGPARSE_group (300, ("@Commands:\n ")),

	ARGPARSE_c (aSupported, "supported",
	("check whether provider supports WKS")),
	ARGPARSE_c (aCheck, "check",
	("check whether a key is available")),
	ARGPARSE_c (aCreate, "create",
	("create a publication request")),
	ARGPARSE_c (aReceive, "receive",
	("receive a MIME confirmation request")),
	ARGPARSE_c (aRead, "read",
	("receive a plain text confirmation request")),

	ARGPARSE_group (301, ("@\nOptions:\n ")),

	ARGPARSE_s_n (oVerbose, "verbose", ("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", ("be somewhat more quiet")),
	ARGPARSE_s_s (oDebug, "debug", "@"),
	ARGPARSE_s_s (oGpgProgram, "gpg", "@"),
	ARGPARSE_s_n (oSend, "send", "send the mail using sendmail"),
	ARGPARSE_s_s (oOutput, "output", "\|FILE\|write the mail to FILE"),
	ARGPARSE_s_i (oStatusFD, "status-fd", N_("\|FD\|write status info to this FD")),

	ARGPARSE_s_s (oFakeSubmissionAddr, "fake-submission-addr", "@"),

	ARGPARSE_end ()
	};


	/* The list of supported debug flags. */
	static struct debug_flags_s debug_flags [] =
	{
	{ DBG_MIME_VALUE , "mime" },
	{ DBG_PARSER_VALUE , "parser" },
	{ DBG_CRYPTO_VALUE , "crypto" },
	{ DBG_MEMORY_VALUE , "memory" },
	{ DBG_MEMSTAT_VALUE, "memstat" },
	{ DBG_IPC_VALUE , "ipc" },
	{ DBG_EXTPROG_VALUE, "extprog" },
	{ 0, NULL }
	};



	/* Value of the option --fake-submission-addr. */
	const char *fake_submission_addr;


	static void wrong_args (const char *text) GPGRT_ATTR_NORETURN;
	static gpg_error_t command_supported (char *userid);
	static gpg_error_t command_check (char *userid);
	static gpg_error_t command_send (const char fingerprint, char userid);
	static gpg_error_t encrypt_response (estream_t *r_output, estream_t input,
	const char *addrspec,
	const char *fingerprint);
	static gpg_error_t read_confirmation_request (estream_t msg);
	static gpg_error_t command_receive_cb (void *opaque,
	const char *mediatype, estream_t fp,
	unsigned int flags);



	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "gpg-wks-client (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = ("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40:
	p = ("Usage: gpg-wks-client [command] [options] [args] (-h for help)");
	break;
	case 41:
	p = ("Syntax: gpg-wks-client [command] [options] [args]\n"
	"Client for the Web Key Service\n");
	break;

	default: p = NULL; break;
	}
	return p;
	}


	static void
	wrong_args (const char *text)
	{
	es_fprintf (es_stderr, _("usage: %s [options] %s\n"), strusage (11), text);
	exit (2);
	}



	/* Command line parsing. */
	static enum cmd_and_opt_values
	parse_arguments (ARGPARSE_ARGS pargs, ARGPARSE_OPTS popts)
	{
	enum cmd_and_opt_values cmd = 0;
	int no_more_options = 0;

	while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
	{
	switch (pargs->r_opt)
	{
	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;
	case oDebug:
	if (parse_debug_flag (pargs->r.ret_str, &opt.debug, debug_flags))
	{
	pargs->r_opt = ARGPARSE_INVALID_ARG;
	pargs->err = ARGPARSE_PRINT_ERROR;
	}
	break;

	case oGpgProgram:
	opt.gpg_program = pargs->r.ret_str;
	break;
	case oSend:
	opt.use_sendmail = 1;
	break;
	case oOutput:
	opt.output = pargs->r.ret_str;
	break;
	case oFakeSubmissionAddr:
	fake_submission_addr = pargs->r.ret_str;
	break;
	case oStatusFD:
	wks_set_status_fd (translate_sys2libc_fd_int (pargs->r.ret_int, 1));
	break;

	case aSupported:
	case aCreate:
	case aReceive:
	case aRead:
	case aCheck:
	cmd = pargs->r_opt;
	break;

	default: pargs->err = 2; break;
	}
	}

	return cmd;
	}



	/* gpg-wks-client main. */
	int
	main (int argc, char **argv)
	{
	gpg_error_t err;
	ARGPARSE_ARGS pargs;
	enum cmd_and_opt_values cmd;

	gnupg_reopen_std ("gpg-wks-client");
	set_strusage (my_strusage);
	log_set_prefix ("gpg-wks-client", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);

	assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
	setup_libassuan_logging (&opt.debug, NULL);

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = ARGPARSE_FLAG_KEEP;
	cmd = parse_arguments (&pargs, opts);

	if (log_get_errorcount (0))
	exit (2);

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (("NOTE: '%s' is not considered an option\n"), argv[i]);
	}

	/* Set defaults for non given options. */
	if (!opt.gpg_program)
	opt.gpg_program = gnupg_module_name (GNUPG_MODULE_NAME_GPG);

	/* Tell call-dirmngr what options we want. */
	set_dirmngr_options (opt.verbose, (opt.debug & DBG_IPC_VALUE), 1);

	/* Run the selected command. */
	switch (cmd)
	{
	case aSupported:
	if (argc != 1)
	wrong_args ("--supported USER-ID");
	err = command_supported (argv[0]);
	if (err && gpg_err_code (err) != GPG_ERR_FALSE)
	log_error ("checking support failed: %s\n", gpg_strerror (err));
	break;

	case aCreate:
	if (argc != 2)
	wrong_args ("--create FINGERPRINT USER-ID");
	err = command_send (argv[0], argv[1]);
	if (err)
	log_error ("creating request failed: %s\n", gpg_strerror (err));
	break;

	case aReceive:
	if (argc)
	wrong_args ("--receive < MIME-DATA");
	err = wks_receive (es_stdin, command_receive_cb, NULL);
	if (err)
	log_error ("processing mail failed: %s\n", gpg_strerror (err));
	break;

	case aRead:
	if (argc)
	wrong_args ("--read < WKS-DATA");
	err = read_confirmation_request (es_stdin);
	if (err)
	log_error ("processing mail failed: %s\n", gpg_strerror (err));
	break;

	case aCheck:
	if (argc != 1)
	wrong_args ("--check USER-ID");
	err = command_check (argv[0]);
	break;

	default:
	usage (1);
	err = 0;
	break;
	}

	if (err)
	wks_write_status (STATUS_FAILURE, "- %u", err);
	else if (log_get_errorcount (0))
	wks_write_status (STATUS_FAILURE, "- %u", GPG_ERR_GENERAL);
	else
	wks_write_status (STATUS_SUCCESS, NULL);
	return log_get_errorcount (0)? 1:0;
	}



	struct get_key_status_parm_s
	{
	const char *fpr;
	int found;
	int count;
	};

	static void
	get_key_status_cb (void opaque, const char keyword, char *args)
	{
	struct get_key_status_parm_s *parm = opaque;

	/log_debug ("%s: %s\n", keyword, args);/
	if (!strcmp (keyword, "EXPORTED"))
	{
	parm->count++;
	if (!ascii_strcasecmp (args, parm->fpr))
	parm->found = 1;
	}
	}


	/* Get a key by fingerprint from gpg's keyring and make sure that the
	* mail address ADDRSPEC is included in the key. The key is returned
	* as a new memory stream at R_KEY.
	*
	* Fixme: After we have implemented import and export filters for gpg
	* this function shall only return a key with just this user id. */
	static gpg_error_t
	get_key (estream_t r_key, const char fingerprint, const char *addrspec)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv = NULL;
	estream_t key = NULL;
	struct get_key_status_parm_s parm;
	char *filterexp = NULL;

	memset (&parm, 0, sizeof parm);

	*r_key = NULL;

	key = es_fopenmem (0, "w+b");
	if (!key)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	goto leave;
	}
	/* Prefix the key with the MIME content type. */
	es_fputs ("Content-Type: application/pgp-keys\n"
	"\n", key);

	filterexp = es_bsprintf ("keep-uid=mbox = %s", addrspec);
	if (!filterexp)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	goto leave;
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--status-fd=2");
	ccparray_put (&ccp, "--always-trust");
	ccparray_put (&ccp, "--armor");
	ccparray_put (&ccp, "--export-options=export-minimal");
	ccparray_put (&ccp, "--export-filter");
	ccparray_put (&ccp, filterexp);
	ccparray_put (&ccp, "--export");
	ccparray_put (&ccp, "--");
	ccparray_put (&ccp, fingerprint);

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	parm.fpr = fingerprint;
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, NULL,
	NULL, key,
	get_key_status_cb, &parm);
	if (!err && parm.count > 1)
	err = gpg_error (GPG_ERR_TOO_MANY);
	else if (!err && !parm.found)
	err = gpg_error (GPG_ERR_NOT_FOUND);
	if (err)
	{
	log_error ("export failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	es_rewind (key);
	*r_key = key;
	key = NULL;

	leave:
	es_fclose (key);
	xfree (argv);
	xfree (filterexp);
	return err;
	}



	static void
	decrypt_stream_status_cb (void opaque, const char keyword, char *args)
	{
	(void)opaque;

	if (DBG_CRYPTO)
	log_debug ("gpg status: %s %s\n", keyword, args);
	}


	/* Decrypt the INPUT stream to a new stream which is stored at success
	* at R_OUTPUT. */
	static gpg_error_t
	decrypt_stream (estream_t *r_output, estream_t input)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv;
	estream_t output;

	*r_output = NULL;

	output = es_fopenmem (0, "w+b");
	if (!output)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	return err;
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	/* We limit the output to 64 KiB to avoid DoS using compression
	* tricks. A regular client will anyway only send a minimal key;
	* that is one w/o key signatures and attribute packets. */
	ccparray_put (&ccp, "--max-output=0x10000");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--status-fd=2");
	ccparray_put (&ccp, "--decrypt");
	ccparray_put (&ccp, "--");

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, input,
	NULL, output,
	decrypt_stream_status_cb, NULL);
	if (err)
	{
	log_error ("decryption failed: %s\n", gpg_strerror (err));
	goto leave;
	}
	else if (opt.verbose)
	log_info ("decryption succeeded\n");

	es_rewind (output);
	*r_output = output;
	output = NULL;

	leave:
	es_fclose (output);
	xfree (argv);
	return err;
	}




	/* Check whether the provider supports the WKS protocol. */
	static gpg_error_t
	command_supported (char *userid)
	{
	gpg_error_t err;
	char *addrspec = NULL;
	char *submission_to = NULL;

	addrspec = mailbox_from_userid (userid);
	if (!addrspec)
	{
	log_error (_("\"%s\" is not a proper mail address\n"), userid);
	err = gpg_error (GPG_ERR_INV_USER_ID);
	goto leave;
	}

	/* Get the submission address. */
	err = wkd_get_submission_address (addrspec, &submission_to);
	if (err)
	{
	if (gpg_err_code (err) == GPG_ERR_NO_DATA
	\|\| gpg_err_code (err) == GPG_ERR_UNKNOWN_HOST)
	{
	if (opt.verbose)
	log_info ("provider for '%s' does NOT support WKS (%s)\n",
	addrspec, gpg_strerror (err));
	err = gpg_error (GPG_ERR_FALSE);
	log_inc_errorcount ();
	}
	goto leave;
	}
	if (opt.verbose)
	log_info ("provider for '%s' supports WKS\n", addrspec);

	leave:
	xfree (submission_to);
	xfree (addrspec);
	return err;
	}



	/* Check whether the key for USERID is available in the WKD. */
	static gpg_error_t
	command_check (char *userid)
	{
	gpg_error_t err;
	char *addrspec = NULL;
	estream_t key = NULL;
	char *fpr = NULL;
	strlist_t mboxes = NULL;
	strlist_t sl;
	int found = 0;

	addrspec = mailbox_from_userid (userid);
	if (!addrspec)
	{
	log_error (_("\"%s\" is not a proper mail address\n"), userid);
	err = gpg_error (GPG_ERR_INV_USER_ID);
	goto leave;
	}

	/* Get the submission address. */
	err = wkd_get_key (addrspec, &key);
	switch (gpg_err_code (err))
	{
	case 0:
	if (opt.verbose)
	log_info ("public key for '%s' found via WKD\n", addrspec);
	/* Fixme: Check that the key contains the user id. */
	break;

	case GPG_ERR_NO_DATA: /* No such key. */
	if (opt.verbose)
	log_info ("public key for '%s' NOT found via WKD\n", addrspec);
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	log_inc_errorcount ();
	break;

	case GPG_ERR_UNKNOWN_HOST:
	if (opt.verbose)
	log_info ("error looking up '%s' via WKD: %s\n",
	addrspec, gpg_strerror (err));
	err = gpg_error (GPG_ERR_NOT_SUPPORTED);
	break;

	default:
	log_error ("error looking up '%s' via WKD: %s\n",
	addrspec, gpg_strerror (err));
	break;
	}

	if (err)
	goto leave;

	/* Look closer at the key. */
	err = wks_list_key (key, &fpr, &mboxes);
	if (err \|\| !fpr)
	{
	log_error ("error parsing key: %s\n",
	err? gpg_strerror (err) : "no fingerprint found");
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}

	if (opt.verbose)
	log_info ("fingerprint: %s\n", fpr);

	for (sl = mboxes; sl; sl = sl->next)
	{
	if (!strcmp (sl->d, addrspec))
	found = 1;
	if (opt.verbose)
	log_info (" addr-spec: %s\n", sl->d);
	}
	if (!found)
	{
	log_error ("public key for '%s' has no user id with the mail address\n",
	addrspec);
	err = gpg_error (GPG_ERR_CERT_REVOKED);
	}

	leave:
	xfree (fpr);
	free_strlist (mboxes);
	es_fclose (key);
	xfree (addrspec);
	return err;
	}



	/* Locate the key by fingerprint and userid and send a publication
	* request. */
	static gpg_error_t
	command_send (const char fingerprint, char userid)
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;
	char *addrspec = NULL;
	estream_t key = NULL;
	estream_t keyenc = NULL;
	char *submission_to = NULL;
	mime_maker_t mime = NULL;
	struct policy_flags_s policy;

	memset (&policy, 0, sizeof policy);

	if (classify_user_id (fingerprint, &desc, 1)
	\|\| !(desc.mode == KEYDB_SEARCH_MODE_FPR
	\|\| desc.mode == KEYDB_SEARCH_MODE_FPR20))
	{
	log_error (_("\"%s\" is not a fingerprint\n"), fingerprint);
	err = gpg_error (GPG_ERR_INV_NAME);
	goto leave;
	}
	addrspec = mailbox_from_userid (userid);
	if (!addrspec)
	{
	log_error (_("\"%s\" is not a proper mail address\n"), userid);
	err = gpg_error (GPG_ERR_INV_USER_ID);
	goto leave;
	}
	err = get_key (&key, fingerprint, addrspec);
	if (err)
	goto leave;

	/* Get the submission address. */
	if (fake_submission_addr)
	{
	submission_to = xstrdup (fake_submission_addr);
	err = 0;
	}
	else
	err = wkd_get_submission_address (addrspec, &submission_to);
	if (err)
	{
	char *domain = strchr (addrspec, '@');
	if (domain)
	domain = domain + 1;
	log_error (_("looking up WKS submission address for %s: %s\n"),
	domain ? domain : addrspec, gpg_strerror (err));
	if (gpg_err_code (err) == GPG_ERR_NO_DATA)
	log_error (_("this domain probably doesn't support WKS.\n"));
	goto leave;
	}
	log_info ("submitting request to '%s'\n", submission_to);

	/* Get the policy flags. */
	if (!fake_submission_addr)
	{
	estream_t mbuf;

	err = wkd_get_policy_flags (addrspec, &mbuf);
	if (err && gpg_err_code (err) != GPG_ERR_NO_DATA)
	{
	log_error ("error reading policy flags for '%s': %s\n",
	submission_to, gpg_strerror (err));
	goto leave;
	}
	if (mbuf)
	{
	err = wks_parse_policy (&policy, mbuf, 1);
	es_fclose (mbuf);
	if (err)
	goto leave;
	}
	}

	if (policy.auth_submit)
	log_info ("no confirmation required for '%s'\n", addrspec);

	/* Encrypt the key part. */
	es_rewind (key);
	err = encrypt_response (&keyenc, key, submission_to, fingerprint);
	if (err)
	goto leave;
	es_fclose (key);
	key = NULL;


	/* Send the key. */
	err = mime_maker_new (&mime, NULL);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "From", addrspec);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "To", submission_to);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Subject", "Key publishing request");
	if (err)
	goto leave;

	/* Tell server that we support draft version 3. */
	err = mime_maker_add_header (mime, "Wks-Draft-Version", "3");
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"multipart/encrypted; "
	"protocol=\"application/pgp-encrypted\"");
	if (err)
	goto leave;
	err = mime_maker_add_container (mime);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/pgp-encrypted");
	if (err)
	goto leave;
	err = mime_maker_add_body (mime, "Version: 1\n");
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Content-Type",
	"application/octet-stream");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &keyenc);
	if (err)
	goto leave;

	err = wks_send_mime (mime);

	leave:
	mime_maker_release (mime);
	xfree (submission_to);
	es_fclose (keyenc);
	es_fclose (key);
	xfree (addrspec);
	return err;
	}



	static void
	encrypt_response_status_cb (void opaque, const char keyword, char *args)
	{
	gpg_error_t *failure = opaque;
	char *fields[2];

	if (DBG_CRYPTO)
	log_debug ("gpg status: %s %s\n", keyword, args);

	if (!strcmp (keyword, "FAILURE"))
	{
	if (split_fields (args, fields, DIM (fields)) >= 2
	&& !strcmp (fields[0], "encrypt"))
	*failure = strtoul (fields[1], NULL, 10);
	}

	}


	/* Encrypt the INPUT stream to a new stream which is stored at success
	* at R_OUTPUT. Encryption is done for ADDRSPEC and for FINGERPRINT
	* (so that the sent message may later be inspected by the user). We
	* currently retrieve that key from the WKD, DANE, or from "local".
	* "local" is last to prefer the latest key version but use a local
	* copy in case we are working offline. It might be useful for the
	* server to send the fingerprint of its encryption key - or even the
	* entire key back. */
	static gpg_error_t
	encrypt_response (estream_t r_output, estream_t input, const char addrspec,
	const char *fingerprint)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv;
	estream_t output;
	gpg_error_t gpg_err = 0;

	*r_output = NULL;

	output = es_fopenmem (0, "w+b");
	if (!output)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	return err;
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--status-fd=2");
	ccparray_put (&ccp, "--always-trust");
	ccparray_put (&ccp, "--armor");
	if (fake_submission_addr)
	ccparray_put (&ccp, "--auto-key-locate=clear,local");
	else
	ccparray_put (&ccp, "--auto-key-locate=clear,wkd,dane,local");
	ccparray_put (&ccp, "--recipient");
	ccparray_put (&ccp, addrspec);
	ccparray_put (&ccp, "--recipient");
	ccparray_put (&ccp, fingerprint);
	ccparray_put (&ccp, "--encrypt");
	ccparray_put (&ccp, "--");

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, input,
	NULL, output,
	encrypt_response_status_cb, &gpg_err);
	if (err)
	{
	if (gpg_err)
	err = gpg_err;
	log_error ("encryption failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	es_rewind (output);
	*r_output = output;
	output = NULL;

	leave:
	es_fclose (output);
	xfree (argv);
	return err;
	}


	static gpg_error_t
	send_confirmation_response (const char sender, const char address,
	const char *nonce, int encrypt,
	const char *fingerprint)
	{
	gpg_error_t err;
	estream_t body = NULL;
	estream_t bodyenc = NULL;
	mime_maker_t mime = NULL;

	body = es_fopenmem (0, "w+b");
	if (!body)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	return err;
	}

	/* It is fine to use 8 bit encoding because that is encrypted and
	* only our client will see it. */
	if (encrypt)
	{
	es_fputs ("Content-Type: application/vnd.gnupg.wks\n"
	"Content-Transfer-Encoding: 8bit\n"
	"\n",
	body);
	}

	es_fprintf (body, ("type: confirmation-response\n"
	"sender: %s\n"
	"address: %s\n"
	"nonce: %s\n"),
	sender,
	address,
	nonce);

	es_rewind (body);
	if (encrypt)
	{
	err = encrypt_response (&bodyenc, body, sender, fingerprint);
	if (err)
	goto leave;
	es_fclose (body);
	body = NULL;
	}

	err = mime_maker_new (&mime, NULL);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "From", address);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "To", sender);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Subject", "Key publication confirmation");
	if (err)
	goto leave;

	if (encrypt)
	{
	err = mime_maker_add_header (mime, "Content-Type",
	"multipart/encrypted; "
	"protocol=\"application/pgp-encrypted\"");
	if (err)
	goto leave;
	err = mime_maker_add_container (mime);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/pgp-encrypted");
	if (err)
	goto leave;
	err = mime_maker_add_body (mime, "Version: 1\n");
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Content-Type",
	"application/octet-stream");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &bodyenc);
	if (err)
	goto leave;
	}
	else
	{
	err = mime_maker_add_header (mime, "Content-Type",
	"application/vnd.gnupg.wks");
	if (err)
	goto leave;
	err = mime_maker_add_stream (mime, &body);
	if (err)
	goto leave;
	}

	err = wks_send_mime (mime);

	leave:
	mime_maker_release (mime);
	es_fclose (bodyenc);
	es_fclose (body);
	return err;
	}


	/* Reply to a confirmation request. The MSG has already been
	* decrypted and we only need to send the nonce back. */
	static gpg_error_t
	process_confirmation_request (estream_t msg)
	{
	gpg_error_t err;
	nvc_t nvc;
	nve_t item;
	const char value, sender, address, fingerprint, *nonce;

	err = nvc_parse (&nvc, NULL, msg);
	if (err)
	{
	log_error ("parsing the WKS message failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	if (DBG_MIME)
	{
	log_debug ("request follows:\n");
	nvc_write (nvc, log_get_stream ());
	}

	/* Check that this is a confirmation request. */
	if (!((item = nvc_lookup (nvc, "type:")) && (value = nve_value (item))
	&& !strcmp (value, "confirmation-request")))
	{
	if (item && value)
	log_error ("received unexpected wks message '%s'\n", value);
	else
	log_error ("received invalid wks message: %s\n", "'type' missing");
	err = gpg_error (GPG_ERR_UNEXPECTED_MSG);
	goto leave;
	}

	/* Get the fingerprint. */
	if (!((item = nvc_lookup (nvc, "fingerprint:"))
	&& (value = nve_value (item))
	&& strlen (value) >= 40))
	{
	log_error ("received invalid wks message: %s\n",
	"'fingerprint' missing or invalid");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	fingerprint = value;

	/* FIXME: Check that the fingerprint matches the key used to decrypt the
	* message. */

	/* Get the address. */
	if (!((item = nvc_lookup (nvc, "address:")) && (value = nve_value (item))
	&& is_valid_mailbox (value)))
	{
	log_error ("received invalid wks message: %s\n",
	"'address' missing or invalid");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	address = value;
	/* FIXME: Check that the "address" matches the User ID we want to
	* publish. Also get the "fingerprint" and compare that to our to
	* be published key. Further we should make sure that we actually
	* decrypted using that fingerprint (which is a bit problematic if
	* --read is used). */

	/* Get the sender. */
	if (!((item = nvc_lookup (nvc, "sender:")) && (value = nve_value (item))
	&& is_valid_mailbox (value)))
	{
	log_error ("received invalid wks message: %s\n",
	"'sender' missing or invalid");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	sender = value;
	/* FIXME: Check that the "sender" matches the From: address. */

	/* Get the nonce. */
	if (!((item = nvc_lookup (nvc, "nonce:")) && (value = nve_value (item))
	&& strlen (value) > 16))
	{
	log_error ("received invalid wks message: %s\n",
	"'nonce' missing or too short");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	nonce = value;

	/* Send the confirmation. If no key was found, try again without
	* encryption. */
	err = send_confirmation_response (sender, address, nonce, 1, fingerprint);
	if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY)
	{
	log_info ("no encryption key found - sending response in the clear\n");
	err = send_confirmation_response (sender, address, nonce, 0, NULL);
	}

	leave:
	nvc_release (nvc);
	return err;
	}


	/* Read a confirmation request and decrypt it if needed. This
	* function may not be used with a mail or MIME message but only with
	* the actual encrypted or plaintext WKS data. */
	static gpg_error_t
	read_confirmation_request (estream_t msg)
	{
	gpg_error_t err;
	int c;
	estream_t plaintext = NULL;

	/* We take a really simple approach to check whether MSG is
	* encrypted: We know that an encrypted message is always armored
	* and thus starts with a few dashes. It is even sufficient to
	* check for a single dash, because that can never be a proper first
	* WKS data octet. We need to skip leading spaces, though. */
	while ((c = es_fgetc (msg)) == ' ' \|\| c == '\t' \|\| c == '\r' \|\| c == '\n')
	;
	if (c == EOF)
	{
	log_error ("can't process an empty message\n");
	return gpg_error (GPG_ERR_INV_DATA);
	}
	if (es_ungetc (c, msg) != c)
	{
	log_error ("error ungetting octet from message\n");
	return gpg_error (GPG_ERR_INTERNAL);
	}

	if (c != '-')
	err = process_confirmation_request (msg);
	else
	{
	err = decrypt_stream (&plaintext, msg);
	if (err)
	log_error ("decryption failed: %s\n", gpg_strerror (err));
	else
	err = process_confirmation_request (plaintext);
	}

	es_fclose (plaintext);
	return err;
	}


	/* Called from the MIME receiver to process the plain text data in MSG. */
	static gpg_error_t
	command_receive_cb (void opaque, const char mediatype,
	estream_t msg, unsigned int flags)
	{
	gpg_error_t err;

	(void)opaque;
	(void)flags;

	if (!strcmp (mediatype, "application/vnd.gnupg.wks"))
	err = read_confirmation_request (msg);
	else
	{
	log_info ("ignoring unexpected message of type '%s'\n", mediatype);
	err = gpg_error (GPG_ERR_UNEXPECTED_MSG);
	}

	return err;
	}
	diff --git a/tools/gpg-wks-server.c b/tools/gpg-wks-server.c
	index ca89fc385..c17c1cf2e 100644
	--- a/tools/gpg-wks-server.c
	+++ b/tools/gpg-wks-server.c
	@@ -1,1849 +1,1849 @@
	/* gpg-wks-server.c - A server for the Web Key Service protocols.
	* Copyright (C) 2016 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* The Web Key Service I-D defines an update protocol to store a
	* public key in the Web Key Directory. The current specification is
	* draft-koch-openpgp-webkey-service-01.txt.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <dirent.h>

	#include "util.h"
	#include "init.h"
	#include "sysutils.h"
	#include "ccparray.h"
	#include "exectool.h"
	#include "zb32.h"
	#include "mbox-util.h"
	#include "name-value.h"
	#include "mime-maker.h"
	#include "send-mail.h"
	#include "gpg-wks.h"


	/* The time we wait for a confirmation response. */
	#define PENDING_TTL (86400 * 3) /* 3 days. */


	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,

	oQuiet = 'q',
	oVerbose = 'v',
	oOutput = 'o',

	oDebug = 500,

	aReceive,
	aCron,
	aListDomains,

	oGpgProgram,
	oSend,
	oFrom,
	oHeader,

	oDummy
	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] = {
	ARGPARSE_group (300, ("@Commands:\n ")),

	ARGPARSE_c (aReceive, "receive",
	("receive a submission or confirmation")),
	ARGPARSE_c (aCron, "cron",
	("run regular jobs")),
	ARGPARSE_c (aListDomains, "list-domains",
	("list configured domains")),

	ARGPARSE_group (301, ("@\nOptions:\n ")),

	ARGPARSE_s_n (oVerbose, "verbose", ("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", ("be somewhat more quiet")),
	ARGPARSE_s_s (oDebug, "debug", "@"),
	ARGPARSE_s_s (oGpgProgram, "gpg", "@"),
	ARGPARSE_s_n (oSend, "send", "send the mail using sendmail"),
	ARGPARSE_s_s (oOutput, "output", "\|FILE\|write the mail to FILE"),
	ARGPARSE_s_s (oFrom, "from", "\|ADDR\|use ADDR as the default sender"),
	ARGPARSE_s_s (oHeader, "header" ,
	"\|NAME=VALUE\|add \"NAME: VALUE\" as header to all mails"),

	ARGPARSE_end ()
	};


	/* The list of supported debug flags. */
	static struct debug_flags_s debug_flags [] =
	{
	{ DBG_MIME_VALUE , "mime" },
	{ DBG_PARSER_VALUE , "parser" },
	{ DBG_CRYPTO_VALUE , "crypto" },
	{ DBG_MEMORY_VALUE , "memory" },
	{ DBG_MEMSTAT_VALUE, "memstat" },
	{ DBG_IPC_VALUE , "ipc" },
	{ DBG_EXTPROG_VALUE, "extprog" },
	{ 0, NULL }
	};


	/* State for processing a message. */
	struct server_ctx_s
	{
	char *fpr;
	strlist_t mboxes; /* List of addr-specs taken from the UIDs. */
	unsigned int draft_version_2:1; /* Client supports the draft 2. */
	};
	typedef struct server_ctx_s *server_ctx_t;

	/* Prototypes. */
	static gpg_error_t get_domain_list (strlist_t *r_list);

	static gpg_error_t command_receive_cb (void *opaque,
	const char *mediatype, estream_t fp,
	unsigned int flags);
	static gpg_error_t command_list_domains (void);
	static gpg_error_t command_cron (void);



	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "gpg-wks-server (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = ("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40:
	p = ("Usage: gpg-wks-server command [options] (-h for help)");
	break;
	case 41:
	p = ("Syntax: gpg-wks-server command [options]\n"
	"Server for the Web Key Service protocol\n");
	break;

	default: p = NULL; break;
	}
	return p;
	}


	static void
	wrong_args (const char *text)
	{
	es_fprintf (es_stderr, "usage: %s [options] %s\n", strusage (11), text);
	exit (2);
	}



	/* Command line parsing. */
	static enum cmd_and_opt_values
	parse_arguments (ARGPARSE_ARGS pargs, ARGPARSE_OPTS popts)
	{
	enum cmd_and_opt_values cmd = 0;
	int no_more_options = 0;

	while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
	{
	switch (pargs->r_opt)
	{
	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;
	case oDebug:
	if (parse_debug_flag (pargs->r.ret_str, &opt.debug, debug_flags))
	{
	pargs->r_opt = ARGPARSE_INVALID_ARG;
	pargs->err = ARGPARSE_PRINT_ERROR;
	}
	break;

	case oGpgProgram:
	opt.gpg_program = pargs->r.ret_str;
	break;
	case oFrom:
	opt.default_from = pargs->r.ret_str;
	break;
	case oHeader:
	append_to_strlist (&opt.extra_headers, pargs->r.ret_str);
	break;
	case oSend:
	opt.use_sendmail = 1;
	break;
	case oOutput:
	opt.output = pargs->r.ret_str;
	break;

	case aReceive:
	case aCron:
	case aListDomains:
	cmd = pargs->r_opt;
	break;

	default: pargs->err = 2; break;
	}
	}

	return cmd;
	}



	/* gpg-wks-server main. */
	int
	main (int argc, char **argv)
	{
	gpg_error_t err;
	ARGPARSE_ARGS pargs;
	enum cmd_and_opt_values cmd;

	gnupg_reopen_std ("gpg-wks-server");
	set_strusage (my_strusage);
	log_set_prefix ("gpg-wks-server", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	init_common_subsystems (&argc, &argv);

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = ARGPARSE_FLAG_KEEP;
	cmd = parse_arguments (&pargs, opts);

	if (log_get_errorcount (0))
	exit (2);

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (("NOTE: '%s' is not considered an option\n"), argv[i]);
	}

	/* Set defaults for non given options. */
	if (!opt.gpg_program)
	opt.gpg_program = gnupg_module_name (GNUPG_MODULE_NAME_GPG);

	if (!opt.directory)
	opt.directory = "/var/lib/gnupg/wks";

	/* Check for syntax errors in the --header option to avoid later
	* error messages with a not easy to find cause */
	if (opt.extra_headers)
	{
	strlist_t sl;

	for (sl = opt.extra_headers; sl; sl = sl->next)
	{
	err = mime_maker_add_header (NULL, sl->d, NULL);
	if (err)
	log_error ("syntax error in \"--header %s\": %s\n",
	sl->d, gpg_strerror (err));
	}
	}

	if (log_get_errorcount (0))
	exit (2);


	/* Check that we have a working directory. */
	#if defined(HAVE_STAT)
	{
	struct stat sb;

	if (stat (opt.directory, &sb))
	{
	err = gpg_error_from_syserror ();
	log_error ("error accessing directory '%s': %s\n",
	opt.directory, gpg_strerror (err));
	exit (2);
	}
	if (!S_ISDIR(sb.st_mode))
	{
	log_error ("error accessing directory '%s': %s\n",
	opt.directory, "not a directory");
	exit (2);
	}
	if (sb.st_uid != getuid())
	{
	log_error ("directory '%s' not owned by user\n", opt.directory);
	exit (2);
	}
	if ((sb.st_mode & (S_IROTH\|S_IWOTH)))
	{
	log_error ("directory '%s' has too relaxed permissions\n",
	opt.directory);
	exit (2);
	}
	}
	#else /!HAVE_STAT/
	log_fatal ("program build w/o stat() call\n");
	#endif /!HAVE_STAT/

	/* Run the selected command. */
	switch (cmd)
	{
	case aReceive:
	if (argc)
	wrong_args ("--receive");
	err = wks_receive (es_stdin, command_receive_cb, NULL);
	break;

	case aCron:
	if (argc)
	wrong_args ("--cron");
	err = command_cron ();
	break;

	case aListDomains:
	err = command_list_domains ();
	break;

	default:
	usage (1);
	err = gpg_error (GPG_ERR_BUG);
	break;
	}

	if (err)
	log_error ("command failed: %s\n", gpg_strerror (err));
	return log_get_errorcount (0)? 1:0;
	}


	/* Take the key in KEYFILE and write it to OUTFILE in binary encoding.
	* If ADDRSPEC is given only matching user IDs are included in the
	* output. */
	static gpg_error_t
	copy_key_as_binary (const char keyfile, const char outfile,
	const char *addrspec)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv = NULL;
	char *filterexp = NULL;

	if (addrspec)
	{
	filterexp = es_bsprintf ("keep-uid=mbox = %s", addrspec);
	if (!filterexp)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--yes");
	ccparray_put (&ccp, "--always-trust");
	ccparray_put (&ccp, "--no-keyring");
	ccparray_put (&ccp, "--output");
	ccparray_put (&ccp, outfile);
	ccparray_put (&ccp, "--import-options=import-export");
	if (filterexp)
	{
	ccparray_put (&ccp, "--import-filter");
	ccparray_put (&ccp, filterexp);
	}
	ccparray_put (&ccp, "--import");
	ccparray_put (&ccp, "--");
	ccparray_put (&ccp, keyfile);

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, NULL,
	NULL, NULL, NULL, NULL);
	if (err)
	{
	log_error ("%s failed: %s\n", __func__, gpg_strerror (err));
	goto leave;
	}

	leave:
	xfree (filterexp);
	xfree (argv);
	return err;
	}


	/* Take the key in KEYFILE and write it to DANEFILE using the DANE
	* output format. */
	static gpg_error_t
	copy_key_as_dane (const char keyfile, const char danefile)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv;

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--yes");
	ccparray_put (&ccp, "--always-trust");
	ccparray_put (&ccp, "--no-keyring");
	ccparray_put (&ccp, "--output");
	ccparray_put (&ccp, danefile);
	ccparray_put (&ccp, "--export-options=export-dane");
	ccparray_put (&ccp, "--import-options=import-export");
	ccparray_put (&ccp, "--import");
	ccparray_put (&ccp, "--");
	ccparray_put (&ccp, keyfile);

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, NULL,
	NULL, NULL, NULL, NULL);
	if (err)
	{
	log_error ("%s failed: %s\n", __func__, gpg_strerror (err));
	goto leave;
	}

	leave:
	xfree (argv);
	return err;
	}


	static void
	encrypt_stream_status_cb (void opaque, const char keyword, char *args)
	{
	(void)opaque;

	if (DBG_CRYPTO)
	log_debug ("gpg status: %s %s\n", keyword, args);
	}


	/* Encrypt the INPUT stream to a new stream which is stored at success
	* at R_OUTPUT. Encryption is done for the key in file KEYFIL. */
	static gpg_error_t
	encrypt_stream (estream_t r_output, estream_t input, const char keyfile)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv;
	estream_t output;

	*r_output = NULL;

	output = es_fopenmem (0, "w+b");
	if (!output)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	return err;
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--status-fd=2");
	ccparray_put (&ccp, "--always-trust");
	ccparray_put (&ccp, "--no-keyring");
	ccparray_put (&ccp, "--armor");
	ccparray_put (&ccp, "--recipient-file");
	ccparray_put (&ccp, keyfile);
	ccparray_put (&ccp, "--encrypt");
	ccparray_put (&ccp, "--");

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, input,
	NULL, output,
	encrypt_stream_status_cb, NULL);
	if (err)
	{
	log_error ("encryption failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	es_rewind (output);
	*r_output = output;
	output = NULL;

	leave:
	es_fclose (output);
	xfree (argv);
	return err;
	}


	static void
	sign_stream_status_cb (void opaque, const char keyword, char *args)
	{
	(void)opaque;

	if (DBG_CRYPTO)
	log_debug ("gpg status: %s %s\n", keyword, args);
	}

	/* Sign the INPUT stream to a new stream which is stored at success at
	* R_OUTPUT. A detached signature is created using the key specified
	* by USERID. */
	static gpg_error_t
	sign_stream (estream_t r_output, estream_t input, const char userid)
	{
	gpg_error_t err;
	ccparray_t ccp;
	const char **argv;
	estream_t output;

	*r_output = NULL;

	output = es_fopenmem (0, "w+b");
	if (!output)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	return err;
	}

	ccparray_init (&ccp, 0);

	ccparray_put (&ccp, "--no-options");
	if (!opt.verbose)
	ccparray_put (&ccp, "--quiet");
	else if (opt.verbose > 1)
	ccparray_put (&ccp, "--verbose");
	ccparray_put (&ccp, "--batch");
	ccparray_put (&ccp, "--status-fd=2");
	ccparray_put (&ccp, "--armor");
	ccparray_put (&ccp, "--local-user");
	ccparray_put (&ccp, userid);
	ccparray_put (&ccp, "--detach-sign");
	ccparray_put (&ccp, "--");

	ccparray_put (&ccp, NULL);
	argv = ccparray_get (&ccp, NULL);
	if (!argv)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = gnupg_exec_tool_stream (opt.gpg_program, argv, input,
	NULL, output,
	sign_stream_status_cb, NULL);
	if (err)
	{
	log_error ("signing failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	es_rewind (output);
	*r_output = output;
	output = NULL;

	leave:
	es_fclose (output);
	xfree (argv);
	return err;
	}


	/* Get the submission address for address MBOX. Caller must free the
	* value. If no address can be found NULL is returned. */
	static char *
	get_submission_address (const char *mbox)
	{
	gpg_error_t err;
	const char *domain;
	char fname, line, *p;
	size_t n;
	estream_t fp;

	domain = strchr (mbox, '@');
	if (!domain)
	return NULL;
	domain++;

	fname = make_filename_try (opt.directory, domain, "submission-address", NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	log_error ("make_filename failed in %s: %s\n",
	__func__, gpg_strerror (err));
	return NULL;
	}

	fp = es_fopen (fname, "r");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	log_info ("Note: no specific submission address configured"
	" for domain '%s'\n", domain);
	else
	log_error ("error reading '%s': %s\n", fname, gpg_strerror (err));
	xfree (fname);
	return NULL;
	}

	line = NULL;
	n = 0;
	if (es_getline (&line, &n, fp) < 0)
	{
	err = gpg_error_from_syserror ();
	log_error ("error reading '%s': %s\n", fname, gpg_strerror (err));
	xfree (line);
	es_fclose (fp);
	xfree (fname);
	return NULL;
	}
	es_fclose (fp);
	xfree (fname);

	p = strchr (line, '\n');
	if (p)
	*p = 0;
	trim_spaces (line);
	if (!is_valid_mailbox (line))
	{
	log_error ("invalid submission address for domain '%s' detected\n",
	domain);
	xfree (line);
	return NULL;
	}

	return line;
	}


	/* Get the policy flags for address MBOX and store them in POLICY. */
	static gpg_error_t
	get_policy_flags (policy_flags_t policy, const char *mbox)
	{
	gpg_error_t err;
	const char *domain;
	char *fname;
	estream_t fp;

	memset (policy, 0, sizeof *policy);

	domain = strchr (mbox, '@');
	if (!domain)
	return gpg_error (GPG_ERR_INV_USER_ID);
	domain++;

	fname = make_filename_try (opt.directory, domain, "policy", NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	log_error ("make_filename failed in %s: %s\n",
	__func__, gpg_strerror (err));
	return err;
	}

	fp = es_fopen (fname, "r");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	err = 0;
	else
	log_error ("error reading '%s': %s\n", fname, gpg_strerror (err));
	xfree (fname);
	return err;
	}

	err = wks_parse_policy (policy, fp, 0);
	es_fclose (fp);
	xfree (fname);
	return err;
	}


	/* We store the key under the name of the nonce we will then send to
	* the user. On success the nonce is stored at R_NONCE and the file
	* name at R_FNAME. */
	static gpg_error_t
	store_key_as_pending (const char *dir, estream_t key,
	char r_nonce, char r_fname)
	{
	gpg_error_t err;
	char *dname = NULL;
	char *fname = NULL;
	char *nonce = NULL;
	estream_t outfp = NULL;
	char buffer[1024];
	size_t nbytes, nwritten;

	*r_nonce = NULL;
	*r_fname = NULL;

	dname = make_filename_try (dir, "pending", NULL);
	if (!dname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Create the nonce. We use 20 bytes so that we don't waste a
	* character in our zBase-32 encoding. Using the gcrypt's nonce
	* function is faster than using the strong random function; this is
	* Good Enough for our purpose. */
	log_assert (sizeof buffer > 20);
	gcry_create_nonce (buffer, 20);
	nonce = zb32_encode (buffer, 8 * 20);
	memset (buffer, 0, 20); /* Not actually needed but it does not harm. */
	if (!nonce)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	fname = strconcat (dname, "/", nonce, NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* With 128 bits of random we can expect that no other file exists
	* under this name. We use "x" to detect internal errors. */
	outfp = es_fopen (fname, "wbx,mode=-rw");
	if (!outfp)
	{
	err = gpg_error_from_syserror ();
	log_error ("error creating '%s': %s\n", fname, gpg_strerror (err));
	goto leave;
	}
	es_rewind (key);
	for (;;)
	{
	if (es_read (key, buffer, sizeof buffer, &nbytes))
	{
	err = gpg_error_from_syserror ();
	log_error ("error reading '%s': %s\n",
	es_fname_get (key), gpg_strerror (err));
	break;
	}

	if (!nbytes)
	{
	err = 0;
	goto leave; /* Ready. */
	}
	if (es_write (outfp, buffer, nbytes, &nwritten))
	{
	err = gpg_error_from_syserror ();
	log_error ("error writing '%s': %s\n", fname, gpg_strerror (err));
	goto leave;
	}
	else if (nwritten != nbytes)
	{
	err = gpg_error (GPG_ERR_EIO);
	log_error ("error writing '%s': %s\n", fname, "short write");
	goto leave;
	}
	}

	leave:
	if (err)
	{
	es_fclose (outfp);
	gnupg_remove (fname);
	}
	else if (es_fclose (outfp))
	{
	err = gpg_error_from_syserror ();
	log_error ("error closing '%s': %s\n", fname, gpg_strerror (err));
	}

	if (!err)
	{
	*r_nonce = nonce;
	*r_fname = fname;
	}
	else
	{
	xfree (nonce);
	xfree (fname);
	}
	xfree (dname);
	return err;
	}


	/* Send a confirmation request. DIR is the directory used for the
	* address MBOX. NONCE is the nonce we want to see in the response to
	* this mail. FNAME the name of the file with the key. */
	static gpg_error_t
	send_confirmation_request (server_ctx_t ctx,
	const char mbox, const char nonce,
	const char *keyfile)
	{
	gpg_error_t err;
	estream_t body = NULL;
	estream_t bodyenc = NULL;
	estream_t signeddata = NULL;
	estream_t signature = NULL;
	mime_maker_t mime = NULL;
	char *from_buffer = NULL;
	const char *from;
	strlist_t sl;

	from = from_buffer = get_submission_address (mbox);
	if (!from)
	{
	from = opt.default_from;
	if (!from)
	{
	log_error ("no sender address found for '%s'\n", mbox);
	err = gpg_error (GPG_ERR_CONFIGURATION);
	goto leave;
	}
	log_info ("Note: using default sender address '%s'\n", from);
	}

	body = es_fopenmem (0, "w+b");
	if (!body)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	goto leave;
	}

	if (!ctx->draft_version_2)
	{
	/* It is fine to use 8 bit encoding because that is encrypted and
	* only our client will see it. */
	es_fputs ("Content-Type: application/vnd.gnupg.wks\n"
	"Content-Transfer-Encoding: 8bit\n"
	"\n",
	body);
	}

	es_fprintf (body, ("type: confirmation-request\n"
	"sender: %s\n"
	"address: %s\n"
	"fingerprint: %s\n"
	"nonce: %s\n"),
	from,
	mbox,
	ctx->fpr,
	nonce);

	es_rewind (body);
	err = encrypt_stream (&bodyenc, body, keyfile);
	if (err)
	goto leave;
	es_fclose (body);
	body = NULL;


	err = mime_maker_new (&mime, NULL);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "From", from);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "To", mbox);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Subject", "Confirm your key publication");
	if (err)
	goto leave;

	/* Help Enigmail to identify messages. Note that this is on no way
	* secured. */
	err = mime_maker_add_header (mime, "WKS-Phase", "confirm");
	if (err)
	goto leave;

	for (sl = opt.extra_headers; sl; sl = sl->next)
	{
	err = mime_maker_add_header (mime, sl->d, NULL);
	if (err)
	goto leave;
	}

	if (!ctx->draft_version_2)
	{
	err = mime_maker_add_header (mime, "Content-Type",
	"multipart/encrypted; "
	"protocol=\"application/pgp-encrypted\"");
	if (err)
	goto leave;
	err = mime_maker_add_container (mime);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/pgp-encrypted");
	if (err)
	goto leave;
	err = mime_maker_add_body (mime, "Version: 1\n");
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Content-Type",
	"application/octet-stream");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &bodyenc);
	if (err)
	goto leave;

	}
	else
	{
	unsigned int partid;

	/* FIXME: Add micalg. */
	err = mime_maker_add_header (mime, "Content-Type",
	"multipart/signed; "
	"protocol=\"application/pgp-signature\"");
	if (err)
	goto leave;
	err = mime_maker_add_container (mime);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type", "multipart/mixed");
	if (err)
	goto leave;

	err = mime_maker_add_container (mime);
	if (err)
	goto leave;
	partid = mime_maker_get_partid (mime);

	err = mime_maker_add_header (mime, "Content-Type", "text/plain");
	if (err)
	goto leave;

	err = mime_maker_add_body
	(mime,
	"This message has been send to confirm your request\n"
	"to publish your key. If you did not request a key\n"
	"publication, simply ignore this message.\n"
	"\n"
	"Most mail software can handle this kind of message\n"
	"automatically and thus you would not have seen this\n"
	"message. It seems that your client does not fully\n"
	"support this service. The web page\n"
	"\n"
	" https://gnupg.org/faq/wkd.html\n"
	"\n"
	"explains how you can process this message anyway in\n"
	"a few manual steps.\n");
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/vnd.gnupg.wks");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &bodyenc);
	if (err)
	goto leave;

	err = mime_maker_end_container (mime);
	if (err)
	goto leave;

	mime_maker_dump_tree (mime);
	err = mime_maker_get_part (mime, partid, &signeddata);
	if (err)
	goto leave;

	err = sign_stream (&signature, signeddata, from);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/pgp-signature");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &signature);
	if (err)
	goto leave;
	}

	err = wks_send_mime (mime);

	leave:
	mime_maker_release (mime);
	es_fclose (signature);
	es_fclose (signeddata);
	es_fclose (bodyenc);
	es_fclose (body);
	xfree (from_buffer);
	return err;
	}


	/* Store the key given by KEY into the pending directory and send a
	* confirmation requests. */
	static gpg_error_t
	process_new_key (server_ctx_t ctx, estream_t key)
	{
	gpg_error_t err;
	strlist_t sl;
	const char *s;
	char *dname = NULL;
	char *nonce = NULL;
	char *fname = NULL;
	struct policy_flags_s policybuf;

	/* First figure out the user id from the key. */
	xfree (ctx->fpr);
	free_strlist (ctx->mboxes);
	err = wks_list_key (key, &ctx->fpr, &ctx->mboxes);
	if (err)
	goto leave;
	if (!ctx->fpr)
	{
	log_error ("error parsing key (no fingerprint)\n");
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}
	log_info ("fingerprint: %s\n", ctx->fpr);
	for (sl = ctx->mboxes; sl; sl = sl->next)
	{
	log_info (" addr-spec: %s\n", sl->d);
	}

	/* Walk over all user ids and send confirmation requests for those
	* we support. */
	for (sl = ctx->mboxes; sl; sl = sl->next)
	{
	s = strchr (sl->d, '@');
	log_assert (s && s[1]);
	xfree (dname);
	dname = make_filename_try (opt.directory, s+1, NULL);
	if (!dname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	if (access (dname, W_OK))
	{
	log_info ("skipping address '%s': Domain not configured\n", sl->d);
	continue;
	}
	if (get_policy_flags (&policybuf, sl->d))
	{
	log_info ("skipping address '%s': Bad policy flags\n", sl->d);
	continue;
	}

	if (policybuf.auth_submit)
	{
	- /* Bypass the confirmation stuff and publish the the key as is. */
	+ /* Bypass the confirmation stuff and publish the key as is. */
	log_info ("publishing address '%s'\n", sl->d);
	/* FIXME: We need to make sure that we do this only for the
	* address in the mail. */
	log_debug ("auth-submit not yet working!\n");
	}
	else
	{
	log_info ("storing address '%s'\n", sl->d);

	xfree (nonce);
	xfree (fname);
	err = store_key_as_pending (dname, key, &nonce, &fname);
	if (err)
	goto leave;

	err = send_confirmation_request (ctx, sl->d, nonce, fname);
	if (err)
	goto leave;
	}
	}

	leave:
	if (nonce)
	wipememory (nonce, strlen (nonce));
	xfree (nonce);
	xfree (fname);
	xfree (dname);
	return err;
	}



	/* Send a message to tell the user at MBOX that their key has been
	* published. FNAME the name of the file with the key. */
	static gpg_error_t
	send_congratulation_message (const char mbox, const char keyfile)
	{
	gpg_error_t err;
	estream_t body = NULL;
	estream_t bodyenc = NULL;
	mime_maker_t mime = NULL;
	char *from_buffer = NULL;
	const char *from;
	strlist_t sl;

	from = from_buffer = get_submission_address (mbox);
	if (!from)
	{
	from = opt.default_from;
	if (!from)
	{
	log_error ("no sender address found for '%s'\n", mbox);
	err = gpg_error (GPG_ERR_CONFIGURATION);
	goto leave;
	}
	log_info ("Note: using default sender address '%s'\n", from);
	}

	body = es_fopenmem (0, "w+b");
	if (!body)
	{
	err = gpg_error_from_syserror ();
	log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
	goto leave;
	}
	/* It is fine to use 8 bit encoding because that is encrypted and
	* only our client will see it. */
	es_fputs ("Content-Type: text/plain; charset=utf-8\n"
	"Content-Transfer-Encoding: 8bit\n"
	"\n",
	body);

	es_fprintf (body,
	"Hello!\n\n"
	"The key for your address '%s' has been published\n"
	"and can now be retrieved from the Web Key Directory.\n"
	"\n"
	"For more information on this system see:\n"
	"\n"
	" https://gnupg.org/faq/wkd.html\n"
	"\n"
	"Best regards\n"
	"\n"
	" Gnu Key Publisher\n\n\n"
	"-- \n"
	"The GnuPG Project welcomes donations: %s\n",
	mbox, "https://gnupg.org/donate");

	es_rewind (body);
	err = encrypt_stream (&bodyenc, body, keyfile);
	if (err)
	goto leave;
	es_fclose (body);
	body = NULL;

	err = mime_maker_new (&mime, NULL);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "From", from);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "To", mbox);
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Subject", "Your key has been published");
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "WKS-Phase", "done");
	if (err)
	goto leave;
	for (sl = opt.extra_headers; sl; sl = sl->next)
	{
	err = mime_maker_add_header (mime, sl->d, NULL);
	if (err)
	goto leave;
	}

	err = mime_maker_add_header (mime, "Content-Type",
	"multipart/encrypted; "
	"protocol=\"application/pgp-encrypted\"");
	if (err)
	goto leave;
	err = mime_maker_add_container (mime);
	if (err)
	goto leave;

	err = mime_maker_add_header (mime, "Content-Type",
	"application/pgp-encrypted");
	if (err)
	goto leave;
	err = mime_maker_add_body (mime, "Version: 1\n");
	if (err)
	goto leave;
	err = mime_maker_add_header (mime, "Content-Type",
	"application/octet-stream");
	if (err)
	goto leave;

	err = mime_maker_add_stream (mime, &bodyenc);
	if (err)
	goto leave;

	err = wks_send_mime (mime);

	leave:
	mime_maker_release (mime);
	es_fclose (bodyenc);
	es_fclose (body);
	xfree (from_buffer);
	return err;
	}


	/* Check that we have send a request with NONCE and publish the key. */
	static gpg_error_t
	check_and_publish (server_ctx_t ctx, const char address, const char nonce)
	{
	gpg_error_t err;
	char *fname = NULL;
	char *fnewname = NULL;
	estream_t key = NULL;
	char *hash = NULL;
	const char *domain;
	const char *s;
	strlist_t sl;
	char shaxbuf[32]; /* Used for SHA-1 and SHA-256 */

	/* FIXME: There is a bug in name-value.c which adds white space for
	* the last pair and thus we strip the nonce here until this has
	* been fixed. */
	char *nonce2 = xstrdup (nonce);
	trim_trailing_spaces (nonce2);
	nonce = nonce2;


	domain = strchr (address, '@');
	log_assert (domain && domain[1]);
	domain++;
	fname = make_filename_try (opt.directory, domain, "pending", nonce, NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Try to open the file with the key. */
	key = es_fopen (fname, "rb");
	if (!key)
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	{
	log_info ("no pending request for '%s'\n", address);
	err = gpg_error (GPG_ERR_NOT_FOUND);
	}
	else
	log_error ("error reading '%s': %s\n", fname, gpg_strerror (err));
	goto leave;
	}

	/* We need to get the fingerprint from the key. */
	xfree (ctx->fpr);
	free_strlist (ctx->mboxes);
	err = wks_list_key (key, &ctx->fpr, &ctx->mboxes);
	if (err)
	goto leave;
	if (!ctx->fpr)
	{
	log_error ("error parsing key (no fingerprint)\n");
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}
	log_info ("fingerprint: %s\n", ctx->fpr);
	for (sl = ctx->mboxes; sl; sl = sl->next)
	log_info (" addr-spec: %s\n", sl->d);

	/* Check that the key has 'address' as a user id. We use
	* case-insensitive matching because the client is expected to
	* return the address verbatim. */
	for (sl = ctx->mboxes; sl; sl = sl->next)
	if (!strcmp (sl->d, address))
	break;
	if (!sl)
	{
	log_error ("error publishing key: '%s' is not a user ID of %s\n",
	address, ctx->fpr);
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	goto leave;
	}


	/* Hash user ID and create filename. */
	s = strchr (address, '@');
	log_assert (s);
	gcry_md_hash_buffer (GCRY_MD_SHA1, shaxbuf, address, s - address);
	hash = zb32_encode (shaxbuf, 8*20);
	if (!hash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	fnewname = make_filename_try (opt.directory, domain, "hu", hash, NULL);
	if (!fnewname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	/* Publish. */
	err = copy_key_as_binary (fname, fnewname, address);
	if (err)
	{
	err = gpg_error_from_syserror ();
	log_error ("copying '%s' to '%s' failed: %s\n",
	fname, fnewname, gpg_strerror (err));
	goto leave;
	}

	log_info ("key %s published for '%s'\n", ctx->fpr, address);
	send_congratulation_message (address, fnewname);

	/* Try to publish as DANE record if the DANE directory exists. */
	xfree (fname);
	fname = fnewname;
	fnewname = make_filename_try (opt.directory, domain, "dane", NULL);
	if (!fnewname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	if (!access (fnewname, W_OK))
	{
	/* Yes, we have a dane directory. */
	s = strchr (address, '@');
	log_assert (s);
	gcry_md_hash_buffer (GCRY_MD_SHA256, shaxbuf, address, s - address);
	xfree (hash);
	hash = bin2hex (shaxbuf, 28, NULL);
	if (!hash)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	xfree (fnewname);
	fnewname = make_filename_try (opt.directory, domain, "dane", hash, NULL);
	if (!fnewname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	err = copy_key_as_dane (fname, fnewname);
	if (err)
	goto leave;
	log_info ("key %s published for '%s' (DANE record)\n", ctx->fpr, address);
	}

	leave:
	es_fclose (key);
	xfree (hash);
	xfree (fnewname);
	xfree (fname);
	xfree (nonce2);
	return err;
	}


	/* Process a confirmation response in MSG. */
	static gpg_error_t
	process_confirmation_response (server_ctx_t ctx, estream_t msg)
	{
	gpg_error_t err;
	nvc_t nvc;
	nve_t item;
	const char value, sender, address, nonce;

	err = nvc_parse (&nvc, NULL, msg);
	if (err)
	{
	log_error ("parsing the WKS message failed: %s\n", gpg_strerror (err));
	goto leave;
	}

	if (opt.debug)
	{
	log_debug ("response follows:\n");
	nvc_write (nvc, log_get_stream ());
	}

	/* Check that this is a confirmation response. */
	if (!((item = nvc_lookup (nvc, "type:")) && (value = nve_value (item))
	&& !strcmp (value, "confirmation-response")))
	{
	if (item && value)
	log_error ("received unexpected wks message '%s'\n", value);
	else
	log_error ("received invalid wks message: %s\n", "'type' missing");
	err = gpg_error (GPG_ERR_UNEXPECTED_MSG);
	goto leave;
	}

	/* Get the sender. */
	if (!((item = nvc_lookup (nvc, "sender:")) && (value = nve_value (item))
	&& is_valid_mailbox (value)))
	{
	log_error ("received invalid wks message: %s\n",
	"'sender' missing or invalid");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	sender = value;
	(void)sender;
	/* FIXME: Do we really need the sender?. */

	/* Get the address. */
	if (!((item = nvc_lookup (nvc, "address:")) && (value = nve_value (item))
	&& is_valid_mailbox (value)))
	{
	log_error ("received invalid wks message: %s\n",
	"'address' missing or invalid");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	address = value;

	/* Get the nonce. */
	if (!((item = nvc_lookup (nvc, "nonce:")) && (value = nve_value (item))
	&& strlen (value) > 16))
	{
	log_error ("received invalid wks message: %s\n",
	"'nonce' missing or too short");
	err = gpg_error (GPG_ERR_INV_DATA);
	goto leave;
	}
	nonce = value;

	err = check_and_publish (ctx, address, nonce);


	leave:
	nvc_release (nvc);
	return err;
	}



	/* Called from the MIME receiver to process the plain text data in MSG . */
	static gpg_error_t
	command_receive_cb (void opaque, const char mediatype,
	estream_t msg, unsigned int flags)
	{
	gpg_error_t err;
	struct server_ctx_s ctx;

	(void)opaque;

	memset (&ctx, 0, sizeof ctx);
	if ((flags & WKS_RECEIVE_DRAFT2))
	ctx.draft_version_2 = 1;

	if (!strcmp (mediatype, "application/pgp-keys"))
	err = process_new_key (&ctx, msg);
	else if (!strcmp (mediatype, "application/vnd.gnupg.wks"))
	err = process_confirmation_response (&ctx, msg);
	else
	{
	log_info ("ignoring unexpected message of type '%s'\n", mediatype);
	err = gpg_error (GPG_ERR_UNEXPECTED_MSG);
	}

	xfree (ctx.fpr);
	free_strlist (ctx.mboxes);

	return err;
	}



	/* Return a list of all configured domains. ECh list element is the
	- * top directory for for the domain. To figure out the actual domain
	+ * top directory for the domain. To figure out the actual domain
	* name strrchr(name, '/') can be used. */
	static gpg_error_t
	get_domain_list (strlist_t *r_list)
	{
	gpg_error_t err;
	DIR *dir = NULL;
	char *fname = NULL;
	struct dirent *dentry;
	struct stat sb;
	strlist_t list = NULL;

	*r_list = NULL;

	dir = opendir (opt.directory);
	if (!dir)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	while ((dentry = readdir (dir)))
	{
	if (*dentry->d_name == '.')
	continue;
	if (!strchr (dentry->d_name, '.'))
	continue; /* No dot - can't be a domain subdir. */

	xfree (fname);
	fname = make_filename_try (opt.directory, dentry->d_name, NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	log_error ("make_filename failed in %s: %s\n",
	__func__, gpg_strerror (err));
	goto leave;
	}

	if (stat (fname, &sb))
	{
	err = gpg_error_from_syserror ();
	log_error ("error accessing '%s': %s\n", fname, gpg_strerror (err));
	continue;
	}
	if (!S_ISDIR(sb.st_mode))
	continue;

	if (!add_to_strlist_try (&list, fname))
	{
	err = gpg_error_from_syserror ();
	log_error ("add_to_strlist failed in %s: %s\n",
	__func__, gpg_strerror (err));
	goto leave;
	}
	}
	err = 0;
	*r_list = list;
	list = NULL;

	leave:
	free_strlist (list);
	if (dir)
	closedir (dir);
	xfree (fname);
	return err;
	}



	static gpg_error_t
	expire_one_domain (const char top_dirname, const char domain)
	{
	gpg_error_t err;
	char *dirname;
	char *fname = NULL;
	DIR *dir = NULL;
	struct dirent *dentry;
	struct stat sb;
	time_t now = gnupg_get_time ();

	dirname = make_filename_try (top_dirname, "pending", NULL);
	if (!dirname)
	{
	err = gpg_error_from_syserror ();
	log_error ("make_filename failed in %s: %s\n",
	__func__, gpg_strerror (err));
	goto leave;
	}

	dir = opendir (dirname);
	if (!dir)
	{
	err = gpg_error_from_syserror ();
	log_error (("can't access directory '%s': %s\n"),
	dirname, gpg_strerror (err));
	goto leave;
	}

	while ((dentry = readdir (dir)))
	{
	if (*dentry->d_name == '.')
	continue;
	xfree (fname);
	fname = make_filename_try (dirname, dentry->d_name, NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	log_error ("make_filename failed in %s: %s\n",
	__func__, gpg_strerror (err));
	goto leave;
	}
	if (strlen (dentry->d_name) != 32)
	{
	log_info ("garbage file '%s' ignored\n", fname);
	continue;
	}
	if (stat (fname, &sb))
	{
	err = gpg_error_from_syserror ();
	log_error ("error accessing '%s': %s\n", fname, gpg_strerror (err));
	continue;
	}
	if (S_ISDIR(sb.st_mode))
	{
	log_info ("garbage directory '%s' ignored\n", fname);
	continue;
	}
	if (sb.st_mtime + PENDING_TTL < now)
	{
	if (opt.verbose)
	log_info ("domain %s: removing pending key '%s'\n",
	domain, dentry->d_name);
	if (remove (fname))
	{
	err = gpg_error_from_syserror ();
	/* In case the file has just been renamed or another
	* processes is cleaning up, we don't print a diagnostic
	* for ENOENT. */
	if (gpg_err_code (err) != GPG_ERR_ENOENT)
	log_error ("error removing '%s': %s\n",
	fname, gpg_strerror (err));
	}
	}
	}
	err = 0;

	leave:
	if (dir)
	closedir (dir);
	xfree (dirname);
	xfree (fname);
	return err;

	}


	/* Scan spool directories and expire too old pending keys. */
	static gpg_error_t
	expire_pending_confirmations (strlist_t domaindirs)
	{
	gpg_error_t err = 0;
	strlist_t sl;
	const char *domain;

	for (sl = domaindirs; sl; sl = sl->next)
	{
	domain = strrchr (sl->d, '/');
	log_assert (domain);
	domain++;

	expire_one_domain (sl->d, domain);
	}

	return err;
	}


	/* List all configured domains. */
	static gpg_error_t
	command_list_domains (void)
	{
	static struct {
	const char *name;
	const char *perm;
	} requireddirs[] = {
	{ "pending", "-rwx" },
	{ "hu", "-rwxr-xr-x" }
	};

	gpg_error_t err;
	strlist_t domaindirs;
	strlist_t sl;
	const char *domain;
	char *fname = NULL;
	int i;
	estream_t fp;

	err = get_domain_list (&domaindirs);
	if (err)
	{
	log_error ("error reading list of domains: %s\n", gpg_strerror (err));
	return err;
	}

	for (sl = domaindirs; sl; sl = sl->next)
	{
	domain = strrchr (sl->d, '/');
	log_assert (domain);
	domain++;
	es_printf ("%s\n", domain);

	/* Check that the required directories are there. */
	for (i=0; i < DIM (requireddirs); i++)
	{
	xfree (fname);
	fname = make_filename_try (sl->d, requireddirs[i].name, NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	if (access (fname, W_OK))
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	{
	if (gnupg_mkdir (fname, requireddirs[i].perm))
	{
	err = gpg_error_from_syserror ();
	log_error ("domain %s: error creating subdir '%s': %s\n",
	domain, requireddirs[i].name,
	gpg_strerror (err));
	}
	else
	log_info ("domain %s: subdir '%s' created\n",
	domain, requireddirs[i].name);
	}
	else if (err)
	log_error ("domain %s: problem with subdir '%s': %s\n",
	domain, requireddirs[i].name, gpg_strerror (err));
	}
	}

	/* Print a warning if the submission address is not configured. */
	xfree (fname);
	fname = make_filename_try (sl->d, "submission-address", NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	if (access (fname, F_OK))
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) == GPG_ERR_ENOENT)
	log_error ("domain %s: submission address not configured\n",
	domain);
	else
	log_error ("domain %s: problem with '%s': %s\n",
	domain, fname, gpg_strerror (err));
	}

	/* Check the syntax of the optional policy file. */
	xfree (fname);
	fname = make_filename_try (sl->d, "policy", NULL);
	if (!fname)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	fp = es_fopen (fname, "r");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	if (gpg_err_code (err) != GPG_ERR_ENOENT)
	log_error ("domain %s: error in policy file: %s\n",
	domain, gpg_strerror (err));
	}
	else
	{
	struct policy_flags_s policy;
	err = wks_parse_policy (&policy, fp, 0);
	es_fclose (fp);
	if (!err)
	{
	struct policy_flags_s empty_policy;
	memset (&empty_policy, 0, sizeof empty_policy);
	if (!memcmp (&empty_policy, &policy, sizeof policy))
	log_error ("domain %s: empty policy file\n", domain);
	}
	}


	}
	err = 0;

	leave:
	xfree (fname);
	free_strlist (domaindirs);
	return err;
	}


	/* Run regular maintenance jobs. */
	static gpg_error_t
	command_cron (void)
	{
	gpg_error_t err;
	strlist_t domaindirs;

	err = get_domain_list (&domaindirs);
	if (err)
	{
	log_error ("error reading list of domains: %s\n", gpg_strerror (err));
	return err;
	}

	err = expire_pending_confirmations (domaindirs);

	free_strlist (domaindirs);
	return err;
	}
	diff --git a/tools/gpgconf.c b/tools/gpgconf.c
	index a5ee188ec..a9f4607bf 100644
	--- a/tools/gpgconf.c
	+++ b/tools/gpgconf.c
	@@ -1,771 +1,771 @@
	/* gpgconf.c - Configuration utility for GnuPG
	* Copyright (C) 2003, 2007, 2009, 2011 Free Software Foundation, Inc.
	* Copyright (C) 2016 g10 Code GmbH.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

	#include "gpgconf.h"
	#include "i18n.h"
	#include "sysutils.h"
	#include "../common/init.h"


	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,
	oDryRun = 'n',
	oOutput = 'o',
	oQuiet = 'q',
	oVerbose = 'v',
	oRuntime = 'r',
	oComponent = 'c',
	oNull = '0',
	oNoVerbose = 500,
	oHomedir,
	oBuilddir,

	aListComponents,
	aCheckPrograms,
	aListOptions,
	aChangeOptions,
	aCheckOptions,
	aApplyDefaults,
	aListConfig,
	aCheckConfig,
	aQuerySWDB,
	aListDirs,
	aLaunch,
	aKill,
	aCreateSocketDir,
	aRemoveSocketDir,
	aApplyProfile,
	aReload
	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] =
	{
	{ 300, NULL, 0, N_("@Commands:\n ") },

	{ aListComponents, "list-components", 256, N_("list all components") },
	{ aCheckPrograms, "check-programs", 256, N_("check all programs") },
	{ aListOptions, "list-options", 256, N_("\|COMPONENT\|list options") },
	{ aChangeOptions, "change-options", 256, N_("\|COMPONENT\|change options") },
	{ aCheckOptions, "check-options", 256, N_("\|COMPONENT\|check options") },
	{ aApplyDefaults, "apply-defaults", 256,
	N_("apply global default values") },
	{ aApplyProfile, "apply-profile", 256,
	N_("\|FILE\|update configuration files using FILE") },
	{ aListDirs, "list-dirs", 256,
	N_("get the configuration directories for @GPGCONF@") },
	{ aListConfig, "list-config", 256,
	N_("list global configuration file") },
	{ aCheckConfig, "check-config", 256,
	N_("check global configuration file") },
	{ aQuerySWDB, "query-swdb", 256,
	N_("query the software version database") },
	{ aReload, "reload", 256, N_("reload all or a given component")},
	{ aLaunch, "launch", 256, N_("launch a given component")},
	{ aKill, "kill", 256, N_("kill a given component")},
	{ aCreateSocketDir, "create-socketdir", 256, "@"},
	{ aRemoveSocketDir, "remove-socketdir", 256, "@"},

	{ 301, NULL, 0, N_("@\nOptions:\n ") },

	{ oOutput, "output", 2, N_("use as output file") },
	{ oVerbose, "verbose", 0, N_("verbose") },
	{ oQuiet, "quiet", 0, N_("quiet") },
	{ oDryRun, "dry-run", 0, N_("do not make any changes") },
	{ oRuntime, "runtime", 0, N_("activate changes at runtime, if possible") },
	/* hidden options */
	{ oHomedir, "homedir", 2, "@" },
	{ oBuilddir, "build-prefix", 2, "@" },
	{ oNull, "null", 0, "@" },
	{ oNoVerbose, "no-verbose", 0, "@"},
	{0}
	};


	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "@GPGCONF@ (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40: p = _("Usage: @GPGCONF@ [options] (-h for help)");
	break;
	case 41:
	p = _("Syntax: @GPGCONF@ [options]\n"
	"Manage configuration options for tools of the @GNUPG@ system\n");
	break;

	default: p = NULL; break;
	}
	return p;
	}


	/* Return the fp for the output. This is usually stdout unless
	--output has been used. In the latter case this function opens
	that file. */
	static estream_t
	get_outfp (estream_t *fp)
	{
	if (!*fp)
	{
	if (opt.outfile)
	{
	*fp = es_fopen (opt.outfile, "w");
	if (!*fp)
	gc_error (1, errno, "can not open '%s'", opt.outfile);
	}
	else
	*fp = es_stdout;
	}
	return *fp;
	}


	static void
	list_dirs (estream_t fp, char **names)
	{
	static struct {
	const char *name;
	const char (fnc)(void);
	const char *extra;
	} list[] = {
	{ "sysconfdir", gnupg_sysconfdir, NULL },
	{ "bindir", gnupg_bindir, NULL },
	{ "libexecdir", gnupg_libexecdir, NULL },
	{ "libdir", gnupg_libdir, NULL },
	{ "datadir", gnupg_datadir, NULL },
	{ "localedir", gnupg_localedir, NULL },
	{ "socketdir", gnupg_socketdir, NULL },
	{ "dirmngr-socket", dirmngr_socket_name, NULL,},
	{ "agent-ssh-socket", gnupg_socketdir, GPG_AGENT_SSH_SOCK_NAME },
	{ "agent-extra-socket", gnupg_socketdir, GPG_AGENT_EXTRA_SOCK_NAME },
	{ "agent-browser-socket",gnupg_socketdir, GPG_AGENT_BROWSER_SOCK_NAME },
	{ "agent-socket", gnupg_socketdir, GPG_AGENT_SOCK_NAME },
	{ "homedir", gnupg_homedir, NULL }
	};
	int idx, j;
	char *tmp;
	const char *s;


	for (idx = 0; idx < DIM (list); idx++)
	{
	s = list[idx].fnc ();
	if (list[idx].extra)
	{
	tmp = make_filename (s, list[idx].extra, NULL);
	s = tmp;
	}
	else
	tmp = NULL;
	if (!names)
	es_fprintf (fp, "%s:%s\n", list[idx].name, gc_percent_escape (s));
	else
	{
	for (j=0; names[j]; j++)
	if (!strcmp (names[j], list[idx].name))
	{
	es_fputs (s, fp);
	es_putc (opt.null? '\0':'\n', fp);
	}
	}

	xfree (tmp);
	}
	}



	/* Check whether NAME is valid argument for query_swdb(). Valid names
	* start with a letter and contain only alphanumeric characters or an
	* underscore. */
	static int
	valid_swdb_name_p (const char *name)
	{
	if (!name \|\| !*name \|\| !alphap (name))
	return 0;

	for (name++; *name; name++)
	if (!alnump (name) && *name != '_')
	return 0;

	return 1;
	}


	/* Query the SWDB file. If necessary and possible this functions asks
	* the dirmngr to load an updated version of that file. The caller
	* needs to provide the NAME to query (e.g. "gnupg", "libgcrypt") and
	* optional the currently installed version in CURRENT_VERSION. The
	* output written to OUT is a colon delimited line with these fields:
	*
	* name :: The name of the package
	* curvers:: The installed version if given.
	* status :: This value tells the status of the software package
	* '-' :: No information available
	* (error or CURRENT_VERSION not given)
	* '?' :: Unknown NAME
	* 'u' :: Update available
	* 'c' :: The version is Current
	* 'n' :: The current version is already Newer than the
	* available one.
	* urgency :: If the value is greater than zero an urgent update is required.
	* error :: 0 on success or an gpg_err_code_t
	* Common codes seen:
	* GPG_ERR_TOO_OLD :: The SWDB file is to old to be used.
	* GPG_ERR_ENOENT :: The SWDB file is not available.
	* GPG_ERR_BAD_SIGNATURE :: Currupted SWDB file.
	* filedate:: Date of the swdb file (yyyymmddThhmmss)
	* verified:: Date we checked the validity of the file (yyyyymmddThhmmss)
	* version :: The version string from the swdb.
	* reldate :: Release date of that version (yyyymmddThhmmss)
	* size :: Size of the package in bytes.
	* hash :: SHA-2 hash of the package.
	*
	*/
	static void
	query_swdb (estream_t out, const char name, const char current_version)
	{
	gpg_error_t err;
	const char *search_name;
	char *fname = NULL;
	estream_t fp = NULL;
	char *line = NULL;
	char *self_version = NULL;
	size_t length_of_line = 0;
	size_t maxlen;
	ssize_t len;
	char *fields[2];
	char *p;
	gnupg_isotime_t filedate = {0};
	gnupg_isotime_t verified = {0};
	char *value_ver = NULL;
	gnupg_isotime_t value_date = {0};
	char *value_size = NULL;
	char *value_sha2 = NULL;
	unsigned long value_size_ul = 0;
	int status, i;


	if (!valid_swdb_name_p (name))
	{
	log_error ("error in package name '%s': %s\n",
	name, gpg_strerror (GPG_ERR_INV_NAME));
	goto leave;
	}
	if (!strcmp (name, "gnupg"))
	search_name = "gnupg21";
	else if (!strcmp (name, "gnupg1"))
	search_name = "gnupg1";
	else
	search_name = name;

	if (!current_version && !strcmp (name, "gnupg"))
	{
	/* Use our own version but string a possible beta string. */
	self_version = xstrdup (PACKAGE_VERSION);
	p = strchr (self_version, '-');
	if (p)
	*p = 0;
	current_version = self_version;
	}

	if (current_version && (strchr (current_version, ':')
	\|\| compare_version_strings (current_version, NULL)))
	{
	log_error ("error in version string '%s': %s\n",
	current_version, gpg_strerror (GPG_ERR_INV_ARG));
	goto leave;
	}

	fname = make_filename (gnupg_homedir (), "swdb.lst", NULL);
	fp = es_fopen (fname, "r");
	if (!fp)
	{
	err = gpg_error_from_syserror ();
	es_fprintf (out, "%s:%s:-::%u:::::::\n",
	name,
	current_version? current_version : "",
	gpg_err_code (err));
	if (gpg_err_code (err) != GPG_ERR_ENOENT)
	log_error (_("error opening '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}

	/* Note that the parser uses the first occurance of a matching
	* values and ignores possible duplicated values. */

	maxlen = 2048; /* Set limit. */
	while ((len = es_read_line (fp, &line, &length_of_line, &maxlen)) > 0)
	{
	if (!maxlen)
	{
	err = gpg_error (GPG_ERR_LINE_TOO_LONG);
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}
	/* Strip newline and carriage return, if present. */
	while (len > 0 && (line[len - 1] == '\n' \|\| line[len - 1] == '\r'))
	line[--len] = '\0';

	if (split_fields (line, fields, DIM (fields)) < DIM(fields))
	continue; /* Skip empty lines and names w/o a value. */
	if (*fields[0] == '#')
	continue; /* Skip comments. */

	/* Record the meta data. */
	if (!*filedate && !strcmp (fields[0], ".filedate"))
	{
	string2isotime (filedate, fields[1]);
	continue;
	}
	if (!*verified && !strcmp (fields[0], ".verified"))
	{
	string2isotime (verified, fields[1]);
	continue;
	}

	/* Tokenize the name. */
	p = strrchr (fields[0], '_');
	if (!p)
	continue; /* Name w/o an underscore. */
	*p++ = 0;

	/* Wait for the requested name. */
	if (!strcmp (fields[0], search_name))
	{
	if (!strcmp (p, "ver") && !value_ver)
	value_ver = xstrdup (fields[1]);
	else if (!strcmp (p, "date") && !*value_date)
	string2isotime (value_date, fields[1]);
	else if (!strcmp (p, "size") && !value_size)
	value_size = xstrdup (fields[1]);
	else if (!strcmp (p, "sha2") && !value_sha2)
	value_sha2 = xstrdup (fields[1]);
	}
	}
	if (len < 0 \|\| es_ferror (fp))
	{
	err = gpg_error_from_syserror ();
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	goto leave;
	}

	if (!filedate \|\| !verified)
	{
	err = gpg_error (GPG_ERR_INV_TIME);
	es_fprintf (out, "%s:%s:-::%u:::::::\n",
	name,
	current_version? current_version : "",
	gpg_err_code (err));
	goto leave;
	}

	if (!value_ver)
	{
	es_fprintf (out, "%s:%s:?:::::::::\n",
	name,
	current_version? current_version : "");
	goto leave;
	}

	if (value_size)
	{
	gpg_err_set_errno (0);
	value_size_ul = strtoul (value_size, &p, 10);
	if (errno)
	value_size_ul = 0;
	else if (*p == 'k')
	value_size_ul *= 1024;
	}

	err = 0;
	status = '-';
	if (compare_version_strings (value_ver, NULL))
	err = gpg_error (GPG_ERR_INV_VALUE);
	else if (!current_version)
	;
	else if (!(i = compare_version_strings (value_ver, current_version)))
	status = 'c';
	else if (i > 0)
	status = 'u';
	else
	status = 'n';

	es_fprintf (out, "%s:%s:%c::%d:%s:%s:%s:%s:%lu:%s:\n",
	name,
	current_version? current_version : "",
	status,
	err,
	filedate,
	verified,
	value_ver,
	value_date,
	value_size_ul,
	value_sha2? value_sha2 : "");

	leave:
	xfree (value_ver);
	xfree (value_size);
	xfree (value_sha2);
	xfree (line);
	es_fclose (fp);
	xfree (fname);
	xfree (self_version);
	}


	/* gpgconf main. */
	int
	main (int argc, char **argv)
	{
	ARGPARSE_ARGS pargs;
	const char *fname;
	int no_more_options = 0;
	enum cmd_and_opt_values cmd = 0;
	estream_t outfp = NULL;

	early_system_init ();
	gnupg_reopen_std (GPGCONF_NAME);
	set_strusage (my_strusage);
	log_set_prefix (GPGCONF_NAME, GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);
	gc_components_init ();

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = 1; /* Do not remove the args. */
	while (!no_more_options && optfile_parse (NULL, NULL, NULL, &pargs, opts))
	{
	switch (pargs.r_opt)
	{
	case oOutput: opt.outfile = pargs.r.ret_str; break;
	case oQuiet: opt.quiet = 1; break;
	case oDryRun: opt.dry_run = 1; break;
	case oRuntime:
	opt.runtime = 1;
	break;
	case oVerbose: opt.verbose++; break;
	case oNoVerbose: opt.verbose = 0; break;
	case oHomedir: gnupg_set_homedir (pargs.r.ret_str); break;
	case oBuilddir: gnupg_set_builddir (pargs.r.ret_str); break;
	case oNull: opt.null = 1; break;

	case aListDirs:
	case aListComponents:
	case aCheckPrograms:
	case aListOptions:
	case aChangeOptions:
	case aCheckOptions:
	case aApplyDefaults:
	case aApplyProfile:
	case aListConfig:
	case aCheckConfig:
	case aQuerySWDB:
	case aReload:
	case aLaunch:
	case aKill:
	case aCreateSocketDir:
	case aRemoveSocketDir:
	cmd = pargs.r_opt;
	break;

	default: pargs.err = 2; break;
	}
	}

	if (log_get_errorcount (0))
	exit (2);

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (_("Note: '%s' is not considered an option\n"), argv[i]);
	}

	fname = argc ? *argv : NULL;

	switch (cmd)
	{
	case aListComponents:
	default:
	/* List all components. */
	gc_component_list_components (get_outfp (&outfp));
	break;

	case aCheckPrograms:
	/* Check all programs. */
	gc_check_programs (get_outfp (&outfp));
	break;

	case aListOptions:
	case aChangeOptions:
	case aCheckOptions:
	if (!fname)
	{
	es_fprintf (es_stderr, _("usage: %s [options] "), GPGCONF_NAME);
	es_putc ('\n', es_stderr);
	es_fputs (_("Need one component argument"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (2);
	}
	else
	{
	int idx = gc_component_find (fname);
	if (idx < 0)
	{
	es_fputs (_("Component not found"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (1);
	}
	if (cmd == aCheckOptions)
	gc_component_check_options (idx, get_outfp (&outfp), NULL);
	else
	{
	gc_component_retrieve_options (idx);
	if (gc_process_gpgconf_conf (NULL, 1, 0, NULL))
	exit (1);
	if (cmd == aListOptions)
	gc_component_list_options (idx, get_outfp (&outfp));
	else if (cmd == aChangeOptions)
	gc_component_change_options (idx, es_stdin,
	get_outfp (&outfp), 0);
	}
	}
	break;

	case aLaunch:
	case aKill:
	if (!fname)
	{
	es_fprintf (es_stderr, _("usage: %s [options] "), GPGCONF_NAME);
	es_putc ('\n', es_stderr);
	es_fputs (_("Need one component argument"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (2);
	}
	else if (!strcmp (fname, "all"))
	{
	if (cmd == aLaunch)
	{
	if (gc_component_launch (-1))
	exit (1);
	}
	else
	{
	gc_component_kill (-1);
	}
	}
	else
	{
	/* Launch/Kill a given component. */
	int idx;

	idx = gc_component_find (fname);
	if (idx < 0)
	{
	es_fputs (_("Component not found"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (1);
	}
	else if (cmd == aLaunch)
	{
	if (gc_component_launch (idx))
	exit (1);
	}
	else
	{
	/* We don't error out if the kill failed because this
	command should do nothing if the component is not
	running. */
	gc_component_kill (idx);
	}
	}
	break;

	case aReload:
	if (!fname \|\| !strcmp (fname, "all"))
	{
	/* Reload all. */
	gc_component_reload (-1);
	}
	else
	{
	/* Reload given component. */
	int idx;

	idx = gc_component_find (fname);
	if (idx < 0)
	{
	es_fputs (_("Component not found"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (1);
	}
	else
	{
	gc_component_reload (idx);
	}
	}
	break;

	case aListConfig:
	if (gc_process_gpgconf_conf (fname, 0, 0, get_outfp (&outfp)))
	exit (1);
	break;

	case aCheckConfig:
	if (gc_process_gpgconf_conf (fname, 0, 0, NULL))
	exit (1);
	break;

	case aApplyDefaults:
	if (fname)
	{
	es_fprintf (es_stderr, _("usage: %s [options] "), GPGCONF_NAME);
	es_putc ('\n', es_stderr);
	es_fputs (_("No argument allowed"), es_stderr);
	es_putc ('\n', es_stderr);
	exit (2);
	}
	gc_component_retrieve_options (-1);
	if (gc_process_gpgconf_conf (NULL, 1, 1, NULL))
	exit (1);
	break;

	case aApplyProfile:
	gc_component_retrieve_options (-1);
	if (gc_apply_profile (fname))
	exit (1);
	break;

	case aListDirs:
	/* Show the system configuration directories for gpgconf. */
	get_outfp (&outfp);
	list_dirs (outfp, argc? argv : NULL);
	break;

	case aQuerySWDB:
	/* Query the software version database. */
	if (!fname \|\| argc > 2)
	{
	es_fprintf (es_stderr, "usage: %s --query-swdb NAME [VERSION]\n",
	GPGCONF_NAME);
	exit (2);
	}
	get_outfp (&outfp);
	query_swdb (outfp, fname, argc > 1? argv[1] : NULL);
	break;

	case aCreateSocketDir:
	{
	char *socketdir;
	unsigned int flags;

	/* Make sure that the top /run/user/UID/gnupg dir has been
	* created. */
	gnupg_socketdir ();

	/* Check the /var/run dir. */
	socketdir = _gnupg_socketdir_internal (1, &flags);
	if ((flags & 64) && !opt.dry_run)
	{
	/* No sub dir - create it. */
	if (gnupg_mkdir (socketdir, "-rwx"))
	gc_error (1, errno, "error creating '%s'", socketdir);
	/* Try again. */
	xfree (socketdir);
	socketdir = _gnupg_socketdir_internal (1, &flags);
	}

	/* Give some info. */
	if ( (flags & ~32) \|\| opt.verbose \|\| opt.dry_run)
	{
	log_info ("socketdir is '%s'\n", socketdir);
	if ((flags & 1)) log_info ("\tgeneral error\n");
	if ((flags & 2)) log_info ("\tno /run/user dir\n");
	if ((flags & 4)) log_info ("\tbad permissions\n");
	if ((flags & 8)) log_info ("\tbad permissions (subdir)\n");
	if ((flags & 16)) log_info ("\tmkdir failed\n");
	if ((flags & 32)) log_info ("\tnon-default homedir\n");
	if ((flags & 64)) log_info ("\tno such subdir\n");
	if ((flags & 128)) log_info ("\tusing homedir as fallback\n");
	}

	if ((flags & ~32) && !opt.dry_run)
	gc_error (1, 0, "error creating socket directory");

	xfree (socketdir);
	}
	break;

	case aRemoveSocketDir:
	{
	char *socketdir;
	unsigned int flags;

	/* Check the /var/run dir. */
	socketdir = _gnupg_socketdir_internal (1, &flags);
	if ((flags & 128))
	log_info ("ignoring request to remove non /run/user socket dir\n");
	else if (opt.dry_run)
	;
	else if (rmdir (socketdir))
	gc_error (1, errno, "error removing '%s'", socketdir);

	xfree (socketdir);
	}
	break;

	}

	if (outfp != es_stdout)
	if (es_fclose (outfp))
	gc_error (1, errno, "error closing '%s'", opt.outfile);

	return 0;
	}
	diff --git a/tools/gpgtar.c b/tools/gpgtar.c
	index 23176dc9c..3dff176e1 100644
	--- a/tools/gpgtar.c
	+++ b/tools/gpgtar.c
	@@ -1,597 +1,597 @@
	/* gpgtar.c - A simple TAR implementation mainly useful for Windows.
	* Copyright (C) 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	/* GnuPG comes with a shell script gpg-zip which creates archive files
	in the same format as PGP Zip, which is actually a USTAR format.
	That is fine and works nicely on all Unices but for Windows we
	don't have a compatible shell and the supply of tar programs is
	limited. Given that we need just a few tar option and it is an
	open question how many Unix concepts are to be mapped to Windows,
	we might as well write our own little tar customized for use with
	gpg. So here we go. */

	#include <config.h>
	#include <ctype.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <assert.h>

	#include "util.h"
	#include "i18n.h"
	#include "sysutils.h"
	#include "../common/openpgpdefs.h"
	#include "../common/init.h"
	#include "../common/strlist.h"

	#include "gpgtar.h"


	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,
	aCreate = 600,
	aExtract,
	aEncrypt = 'e',
	aDecrypt = 'd',
	aSign = 's',
	aList = 't',

	oSymmetric = 'c',
	oRecipient = 'r',
	oUser = 'u',
	oOutput = 'o',
	oDirectory = 'C',
	oQuiet = 'q',
	oVerbose = 'v',
	oFilesFrom = 'T',
	oNoVerbose = 500,

	aSignEncrypt,
	oGpgProgram,
	oSkipCrypto,
	oOpenPGP,
	oCMS,
	oSetFilename,
	oNull,

	/* Compatibility with gpg-zip. */
	oGpgArgs,
	oTarArgs,

	/* Debugging. */
	oDryRun,
	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] = {
	ARGPARSE_group (300, N_("@Commands:\n ")),

	ARGPARSE_c (aCreate, "create", N_("create an archive")),
	ARGPARSE_c (aExtract, "extract", N_("extract an archive")),
	ARGPARSE_c (aEncrypt, "encrypt", N_("create an encrypted archive")),
	ARGPARSE_c (aDecrypt, "decrypt", N_("extract an encrypted archive")),
	ARGPARSE_c (aSign, "sign", N_("create a signed archive")),
	ARGPARSE_c (aList, "list-archive", N_("list an archive")),

	ARGPARSE_group (301, N_("@\nOptions:\n ")),

	ARGPARSE_s_n (oSymmetric, "symmetric", N_("use symmetric encryption")),
	ARGPARSE_s_s (oRecipient, "recipient", N_("\|USER-ID\|encrypt for USER-ID")),
	ARGPARSE_s_s (oUser, "local-user",
	N_("\|USER-ID\|use USER-ID to sign or decrypt")),
	ARGPARSE_s_s (oOutput, "output", N_("\|FILE\|write output to FILE")),
	ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", N_("be somewhat more quiet")),
	ARGPARSE_s_s (oGpgProgram, "gpg", "@"),
	ARGPARSE_s_n (oSkipCrypto, "skip-crypto", N_("skip the crypto processing")),
	ARGPARSE_s_n (oDryRun, "dry-run", N_("do not make any changes")),
	ARGPARSE_s_s (oSetFilename, "set-filename", "@"),
	ARGPARSE_s_n (oOpenPGP, "openpgp", "@"),
	ARGPARSE_s_n (oCMS, "cms", "@"),

	ARGPARSE_group (302, N_("@\nTar options:\n ")),

	ARGPARSE_s_s (oDirectory, "directory",
	N_("\|DIRECTORY\|extract files into DIRECTORY")),
	ARGPARSE_s_s (oFilesFrom, "files-from",
	N_("\|FILE\|get names to create from FILE")),
	ARGPARSE_s_n (oNull, "null", N_("-T reads null-terminated names")),

	ARGPARSE_s_s (oGpgArgs, "gpg-args", "@"),
	ARGPARSE_s_s (oTarArgs, "tar-args", "@"),

	ARGPARSE_end ()
	};


	/* The list of commands and options for tar that we understand. */
	static ARGPARSE_OPTS tar_opts[] = {
	ARGPARSE_s_s (oDirectory, "directory",
	N_("\|DIRECTORY\|extract files into DIRECTORY")),
	ARGPARSE_s_s (oFilesFrom, "files-from",
	N_("\|FILE\|get names to create from FILE")),
	ARGPARSE_s_n (oNull, "null", N_("-T reads null-terminated names")),

	ARGPARSE_end ()
	};



	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage( int level )
	{
	const char *p;

	switch (level)
	{
	case 11: p = "@GPGTAR@ (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40:
	p = _("Usage: gpgtar [options] [files] [directories] (-h for help)");
	break;
	case 41:
	p = _("Syntax: gpgtar [options] [files] [directories]\n"
	"Encrypt or sign files into an archive\n");
	break;

	default: p = NULL; break;
	}
	return p;
	}


	static void
	set_cmd (enum cmd_and_opt_values *ret_cmd, enum cmd_and_opt_values new_cmd)
	{
	enum cmd_and_opt_values cmd = *ret_cmd;

	if (!cmd \|\| cmd == new_cmd)
	cmd = new_cmd;
	else if (cmd == aSign && new_cmd == aEncrypt)
	cmd = aSignEncrypt;
	else if (cmd == aEncrypt && new_cmd == aSign)
	cmd = aSignEncrypt;
	else
	{
	log_error (_("conflicting commands\n"));
	exit (2);
	}

	*ret_cmd = cmd;
	}

	/* Shell-like argument splitting.

	For compatibility with gpg-zip we accept arguments for GnuPG and
	tar given as a string argument to '--gpg-args' and '--tar-args'.
	gpg-zip was implemented as a Bourne Shell script, and therefore, we
	need to split the string the same way the shell would. */
	static int
	shell_parse_stringlist (const char str, strlist_t r_list)
	{
	strlist_t list = NULL;
	const char *s = str;
	char quoted = 0;
	char arg[1024];
	char *p = arg;
	#define addchar(c) \
	do { if (p - arg + 2 < sizeof arg) *p++ = (c); else return 1; } while (0)
	#define addargument() \
	do { \
	if (p > arg) \
	{ \
	*p = 0; \
	append_to_strlist (&list, arg); \
	p = arg; \
	} \
	} while (0)

	#define unquoted 0
	#define singlequote '\''
	#define doublequote '"'

	for (; *s; s++)
	{
	switch (quoted)
	{
	case unquoted:
	if (isspace (*s))
	addargument ();
	else if (s == singlequote \|\| s == doublequote)
	quoted = *s;
	else
	addchar (*s);
	break;

	case singlequote:
	if (*s == singlequote)
	quoted = unquoted;
	else
	addchar (*s);
	break;

	case doublequote:
	assert (s > str \|\| !"cannot be quoted at first char");
	if (s == doublequote && (s - 1) != '\\')
	quoted = unquoted;
	else
	addchar (*s);
	break;

	default:
	assert (! "reached");
	}
	}

	/* Append the last argument. */
	addargument ();

	#undef doublequote
	#undef singlequote
	#undef unquoted
	#undef addargument
	#undef addchar
	*r_list = list;
	return 0;
	}


	/* Like shell_parse_stringlist, but returns an argv vector
	instead of a strlist. */
	static int
	shell_parse_argv (const char s, int r_argc, char ***r_argv)
	{
	int i;
	strlist_t list;

	if (shell_parse_stringlist (s, &list))
	return 1;

	*r_argc = strlist_length (list);
	r_argv = xtrycalloc (r_argc, sizeof **r_argv);
	if (*r_argv == NULL)
	return 1;

	for (i = 0; list; i++)
	{
	gpgrt_annotate_leaked_object (list);
	(*r_argv)[i] = list->d;
	list = list->next;
	}
	gpgrt_annotate_leaked_object (*r_argv);
	return 0;
	}

	/* Global flags. */
	enum cmd_and_opt_values cmd = 0;
	int skip_crypto = 0;
	const char *files_from = NULL;
	int null_names = 0;


	/* Command line parsing. */
	static void
	parse_arguments (ARGPARSE_ARGS pargs, ARGPARSE_OPTS popts)
	{
	int no_more_options = 0;

	while (!no_more_options && optfile_parse (NULL, NULL, NULL, pargs, popts))
	{
	switch (pargs->r_opt)
	{
	case oOutput: opt.outfile = pargs->r.ret_str; break;
	case oDirectory: opt.directory = pargs->r.ret_str; break;
	case oSetFilename: opt.filename = pargs->r.ret_str; break;
	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;
	case oNoVerbose: opt.verbose = 0; break;
	case oFilesFrom: files_from = pargs->r.ret_str; break;
	case oNull: null_names = 1; break;

	case aList:
	case aDecrypt:
	case aEncrypt:
	case aSign:
	set_cmd (&cmd, pargs->r_opt);
	break;

	case aCreate:
	set_cmd (&cmd, aEncrypt);
	skip_crypto = 1;
	break;

	case aExtract:
	set_cmd (&cmd, aDecrypt);
	skip_crypto = 1;
	break;

	case oRecipient:
	add_to_strlist (&opt.recipients, pargs->r.ret_str);
	break;

	case oUser:
	opt.user = pargs->r.ret_str;
	break;

	case oSymmetric:
	set_cmd (&cmd, aEncrypt);
	opt.symmetric = 1;
	break;

	case oGpgProgram:
	opt.gpg_program = pargs->r.ret_str;
	break;

	case oSkipCrypto:
	skip_crypto = 1;
	break;

	case oOpenPGP: /* Dummy option for now. */ break;
	case oCMS: /* Dummy option for now. */ break;

	case oGpgArgs:;
	{
	strlist_t list;
	if (shell_parse_stringlist (pargs->r.ret_str, &list))
	log_error ("failed to parse gpg arguments '%s'\n",
	pargs->r.ret_str);
	else
	{
	if (opt.gpg_arguments)
	strlist_last (opt.gpg_arguments)->next = list;
	else
	opt.gpg_arguments = list;
	}
	}
	break;

	case oTarArgs:;
	{
	int tar_argc;
	char **tar_argv;

	if (shell_parse_argv (pargs->r.ret_str, &tar_argc, &tar_argv))
	log_error ("failed to parse tar arguments '%s'\n",
	pargs->r.ret_str);
	else
	{
	ARGPARSE_ARGS tar_args;
	tar_args.argc = &tar_argc;
	tar_args.argv = &tar_argv;
	tar_args.flags = ARGPARSE_FLAG_ARG0;
	parse_arguments (&tar_args, tar_opts);
	if (tar_args.err)
	log_error ("unsupported tar arguments '%s'\n",
	pargs->r.ret_str);
	pargs->err = tar_args.err;
	}
	}
	break;

	case oDryRun:
	opt.dry_run = 1;
	break;

	default: pargs->err = 2; break;
	}
	}
	}


	/* gpgtar main. */
	int
	main (int argc, char **argv)
	{
	gpg_error_t err;
	const char *fname;
	ARGPARSE_ARGS pargs;

	assert (sizeof (struct ustar_raw_header) == 512);

	gnupg_reopen_std (GPGTAR_NAME);
	set_strusage (my_strusage);
	log_set_prefix (GPGTAR_NAME, GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);

	/* Parse the command line. */
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags = ARGPARSE_FLAG_KEEP;
	parse_arguments (&pargs, opts);

	if ((files_from && !null_names) \|\| (!files_from && null_names))
	log_error ("--files-from and --null may only be used in conjunction\n");
	if (files_from && strcmp (files_from, "-"))
	log_error ("--files-from only supports argument \"-\"\n");

	if (log_get_errorcount (0))
	exit (2);

	/* Print a warning if an argument looks like an option. */
	if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
	{
	int i;

	for (i=0; i < argc; i++)
	if (argv[i][0] == '-' && argv[i][1] == '-')
	log_info (_("NOTE: '%s' is not considered an option\n"), argv[i]);
	}

	if (! opt.gpg_program)
	opt.gpg_program = gnupg_module_name (GNUPG_MODULE_NAME_GPG);

	if (opt.verbose > 1)
	opt.debug_level = 1024;

	switch (cmd)
	{
	case aList:
	if (argc > 1)
	usage (1);
	fname = argc ? *argv : NULL;
	if (opt.filename)
	log_info ("note: ignoring option --set-filename\n");
	if (files_from)
	log_info ("note: ignoring option --files-from\n");
	err = gpgtar_list (fname, !skip_crypto);
	if (err && log_get_errorcount (0) == 0)
	log_error ("listing archive failed: %s\n", gpg_strerror (err));
	break;

	case aEncrypt:
	case aSign:
	case aSignEncrypt:
	if ((!argc && !null_names)
	\|\| (argc && null_names))
	usage (1);
	if (opt.filename)
	log_info ("note: ignoring option --set-filename\n");
	err = gpgtar_create (null_names? NULL :argv,
	!skip_crypto
	&& (cmd == aEncrypt \|\| cmd == aSignEncrypt),
	cmd == aSign \|\| cmd == aSignEncrypt);
	if (err && log_get_errorcount (0) == 0)
	log_error ("creating archive failed: %s\n", gpg_strerror (err));
	break;

	case aDecrypt:
	if (argc != 1)
	usage (1);
	if (opt.outfile)
	log_info ("note: ignoring option --output\n");
	if (files_from)
	log_info ("note: ignoring option --files-from\n");
	fname = argc ? *argv : NULL;
	err = gpgtar_extract (fname, !skip_crypto);
	if (err && log_get_errorcount (0) == 0)
	log_error ("extracting archive failed: %s\n", gpg_strerror (err));
	break;

	default:
	log_error (_("invalid command (there is no implicit command)\n"));
	break;
	}

	return log_get_errorcount (0)? 1:0;
	}


	/* Read the next record from STREAM. RECORD is a buffer provided by
	the caller and must be at leadt of size RECORDSIZE. The function
	- return 0 on success and and error code on failure; a diagnostic
	+ return 0 on success and error code on failure; a diagnostic
	printed as well. Note that there is no need for an EOF indicator
	because a tarball has an explicit EOF record. */
	gpg_error_t
	read_record (estream_t stream, void *record)
	{
	gpg_error_t err;
	size_t nread;

	nread = es_fread (record, 1, RECORDSIZE, stream);
	if (nread != RECORDSIZE)
	{
	err = gpg_error_from_syserror ();
	if (es_ferror (stream))
	log_error ("error reading '%s': %s\n",
	es_fname_get (stream), gpg_strerror (err));
	else
	log_error ("error reading '%s': premature EOF "
	"(size of last record: %zu)\n",
	es_fname_get (stream), nread);
	}
	else
	err = 0;

	return err;
	}


	/* Write the RECORD of size RECORDSIZE to STREAM. FILENAME is the
	name of the file used for diagnostics. */
	gpg_error_t
	write_record (estream_t stream, const void *record)
	{
	gpg_error_t err;
	size_t nwritten;

	nwritten = es_fwrite (record, 1, RECORDSIZE, stream);
	if (nwritten != RECORDSIZE)
	{
	err = gpg_error_from_syserror ();
	log_error ("error writing '%s': %s\n",
	es_fname_get (stream), gpg_strerror (err));
	}
	else
	err = 0;

	return err;
	}


	/* Return true if FP is an unarmored OpenPGP message. Note that this
	function reads a few bytes from FP but pushes them back. */
	#if 0
	static int
	openpgp_message_p (estream_t fp)
	{
	int ctb;

	ctb = es_getc (fp);
	if (ctb != EOF)
	{
	if (es_ungetc (ctb, fp))
	log_fatal ("error ungetting first byte: %s\n",
	gpg_strerror (gpg_error_from_syserror ()));

	if ((ctb & 0x80))
	{
	switch ((ctb & 0x40) ? (ctb & 0x3f) : ((ctb>>2)&0xf))
	{
	case PKT_MARKER:
	case PKT_SYMKEY_ENC:
	case PKT_ONEPASS_SIG:
	case PKT_PUBKEY_ENC:
	case PKT_SIGNATURE:
	case PKT_COMMENT:
	case PKT_OLD_COMMENT:
	case PKT_PLAINTEXT:
	case PKT_COMPRESSED:
	case PKT_ENCRYPTED:
	return 1; /* Yes, this seems to be an OpenPGP message. */
	default:
	break;
	}
	}
	}
	return 0;
	}
	#endif
	diff --git a/tools/mail-signed-keys b/tools/mail-signed-keys
	index c63001a45..3c564f11c 100755
	--- a/tools/mail-signed-keys
	+++ b/tools/mail-signed-keys
	@@ -1,114 +1,114 @@
	#!/bin/sh
	# Copyright (C) 2000, 2001 Free Software Foundation, Inc.
	#
	# This file is free software; as a special exception the author gives
	# unlimited permission to copy and/or distribute it, with or without
	# modifications, as long as this notice is preserved.
	#
	# This program is distributed in the hope that it will be useful, but
	# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
	# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

	# FIXME: Use only valid email addreses, extract only given keys

	dryrun=0
	if [ "$1" = "--dry-run" ]; then
	dryrun=1
	shift
	fi

	if [ -z "$1" -o -z "$2" -o -z "$3" ]; then
	echo "usage: mail-signed-keys keyring signedby signame" >&2
	exit 1
	fi

	signame="$3"

	if [ ! -f $1 ]; then
	echo "mail-signed-keys: '$1': no such file" >&2
	exit 1
	fi

	[ -f '.#tdb.tmp' ] && rm '.#tdb.tmp'
	ro="--homedir . --no-options --trustdb-name=./.#tdb.tmp --dry-run --lock-never --no-default-keyring --keyring $1"

	signedby=`gpg $ro --list-keys --with-colons $2 \
	2>/dev/null \| awk -F: '$1=="pub" {print $5; exit 0}'`

	if [ -z "$signedby" ]; then
	echo "mail-signed-keys: '$2': no such signator" >&2
	exit 1
	fi

	if [ "$dryrun" = "0" ]; then
	- echo "About to send the the keys signed by $signedby" >&2
	+ echo "About to send the keys signed by $signedby" >&2
	echo -n "to their owners. Do you really want to do this? (y/N)" >&2
	read
	[ "$REPLY" != "y" -a "$REPLY" != "Y" ] && exit 0
	fi

	gpg $ro --check-sigs --with-colons 2>/dev/null \
	\| awk -F: -v signedby="$signedby" -v gpgopt="$ro" \
	-v dryrun="$dryrun" -v signame="$signame" '
	BEGIN { sendmail="/usr/lib/sendmail -oi -t " }
	$1 == "pub" { nextkid=$5; nextuid=$10
	if( uidcount > 0 ) { myflush() }
	kid=nextkid; uid=nextuid; next
	}
	$1 == "uid" { uid=$10 ; next }
	$1 == "sig" && $2 == "!" && $5 == signedby { uids[uidcount++] = uid; next }
	END { if( uidcount > 0 ) { myflush() } }

	function myflush()
	{
	if ( kid == signedby ) { uidcount=0; return }
	print "sending key " substr(kid,9) " to" \| "cat >&2"
	for(i=0; i < 1; i++ ) {
	print " " uids[i] \| "cat >&2"
	if( dryrun == 0 ) {
	if( i == 0 ) {
	printf "To: %s", uids[i] \| sendmail
	}
	else {
	printf ",\n %s", uids[i] \| sendmail
	}
	}
	}
	if(dryrun == 0) {
	printf "\n" \| sendmail
	print "Subject: I signed your key " substr(kid,9) \| sendmail
	print "" \| sendmail
	print "Hi," \| sendmail
	print "" \| sendmail
	print "Here you get back the signed key." \| sendmail
	print "I already sent them to the keyservers." \| sendmail
	print "" \| sendmail
	print "Peace," \| sendmail
	print " " signame \| sendmail
	print "" \| sendmail
	cmd = "gpg " gpgopt " --export -a " kid " 2>/dev/null"
	while( (cmd \| getline) > 0 ) {
	print \| sendmail
	}
	print "" \| sendmail
	close(cmd)
	close( sendmail )
	}
	uidcount=0
	}
	'















	diff --git a/tools/symcryptrun.c b/tools/symcryptrun.c
	index dc680f5a5..a72b9cf7a 100644
	--- a/tools/symcryptrun.c
	+++ b/tools/symcryptrun.c
	@@ -1,1023 +1,1023 @@
	/* symcryptrun.c - Tool to call simple symmetric encryption tools.
	* Copyright (C) 2005, 2007 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/


	/* Sometimes simple encryption tools are already in use for a long
	time and there is a desire to integrate them into the GnuPG
	framework. The protocols and encryption methods might be
	non-standard or not even properly documented, so that a
	full-fledged encryption tool with an interface like gpg is not
	doable. This simple wrapper program provides a solution: It
	operates by calling the encryption/decryption module and providing
	the passphrase for a key (or even the key directly) using the
	standard pinentry mechanism through gpg-agent. */

	/* This program is invoked in the following way:

	symcryptrun --class CLASS --program PROGRAM --keyfile KEYFILE \
	[--decrypt \| --encrypt]

	For encryption, the plain text must be provided on STDIN, and the
	ciphertext will be output to STDOUT. For decryption vice versa.

	CLASS can currently only be "confucius".

	PROGRAM must be the path to the crypto engine.

	KEYFILE must contain the secret key, which may be protected by a
	passphrase. The passphrase is retrieved via the pinentry program.


	The GPG Agent _must_ be running before starting symcryptrun.

	The possible exit status codes:

	0 Success
	1 Some error occurred
	2 No valid passphrase was provided
	3 The operation was canceled by the user

	Other classes may be added in the future. */

	#define SYMC_BAD_PASSPHRASE 2
	#define SYMC_CANCELED 3


	#include <config.h>

	#include <unistd.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>
	#include <assert.h>
	#include <signal.h>
	#include <sys/stat.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#ifdef HAVE_PTY_H
	#include <pty.h>
	#endif
	#ifdef HAVE_UTMP_H
	#include <utmp.h>
	#endif
	#include <ctype.h>
	#ifdef HAVE_LOCALE_H
	#include <locale.h>
	#endif
	#ifdef HAVE_LANGINFO_CODESET
	#include <langinfo.h>
	#endif
	#include <gpg-error.h>

	#include "i18n.h"
	#include "../common/util.h"
	#include "../common/init.h"
	#include "../common/sysutils.h"

	/* FIXME: Bah. For spwq_secure_free. */
	#define SIMPLE_PWQUERY_IMPLEMENTATION 1
	#include "../common/simple-pwquery.h"


	/* From simple-gettext.c. */

	/* We assume to have 'unsigned long int' value with at least 32 bits. */
	#define HASHWORDBITS 32

	/* The so called 'hashpjw' function by P.J. Weinberger
	[see Aho/Sethi/Ullman, COMPILERS: Principles, Techniques and Tools,
	1986, 1987 Bell Telephone Laboratories, Inc.] */

	static __inline__ ulong
	hash_string( const char *str_param )
	{
	unsigned long int hval, g;
	const char *str = str_param;

	hval = 0;
	while (*str != '\0')
	{
	hval <<= 4;
	hval += (unsigned long int) *str++;
	g = hval & ((unsigned long int) 0xf << (HASHWORDBITS - 4));
	if (g != 0)
	{
	hval ^= g >> (HASHWORDBITS - 8);
	hval ^= g;
	}
	}
	return hval;
	}


	/* Constants to identify the commands and options. */
	enum cmd_and_opt_values
	{
	aNull = 0,
	oQuiet = 'q',
	oVerbose = 'v',

	oNoVerbose = 500,
	oOptions,
	oNoOptions,
	oLogFile,
	oHomedir,
	oClass,
	oProgram,
	oKeyfile,
	oDecrypt,
	oEncrypt,
	oInput
	};


	/* The list of commands and options. */
	static ARGPARSE_OPTS opts[] =
	{
	{ 301, NULL, 0, N_("@\nCommands:\n ") },

	{ oDecrypt, "decrypt", 0, N_("decryption modus") },
	{ oEncrypt, "encrypt", 0, N_("encryption modus") },

	{ 302, NULL, 0, N_("@\nOptions:\n ") },

	{ oClass, "class", 2, N_("tool class (confucius)") },
	{ oProgram, "program", 2, N_("program filename") },

	{ oKeyfile, "keyfile", 2, N_("secret key file (required)") },
	{ oInput, "inputfile", 2, N_("input file name (default stdin)") },
	{ oVerbose, "verbose", 0, N_("verbose") },
	{ oQuiet, "quiet", 0, N_("quiet") },
	{ oLogFile, "log-file", 2, N_("use a log file for the server") },
	{ oOptions, "options" , 2, N_("\|FILE\|read options from FILE") },

	/* Hidden options. */
	{ oNoVerbose, "no-verbose", 0, "@" },
	{ oHomedir, "homedir", 2, "@" },
	{ oNoOptions, "no-options", 0, "@" },/* shortcut for --options /dev/null */

	{0}
	};


	/* We keep all global options in the structure OPT. */
	struct
	{
	int verbose; /* Verbosity level. */
	int quiet; /* Be extra quiet. */
	const char homedir; / Configuration directory name */

	char *class;
	char *program;
	char *keyfile;
	char *input;
	} opt;


	-/* Print usage information and and provide strings for help. */
	+/* Print usage information and provide strings for help. */
	static const char *
	my_strusage (int level)
	{
	const char *p;

	switch (level)
	{
	case 11: p = "symcryptrun (@GNUPG@)";
	break;
	case 13: p = VERSION; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40: p = _("Usage: symcryptrun [options] (-h for help)");
	break;
	case 41:
	p = _("Syntax: symcryptrun --class CLASS --program PROGRAM "
	"--keyfile KEYFILE [options...] COMMAND [inputfile]\n"
	"Call a simple symmetric encryption tool\n");
	break;
	case 31: p = "\nHome: "; break;
	case 32: p = gnupg_homedir (); break;
	case 33: p = "\n"; break;

	default: p = NULL; break;
	}
	return p;
	}



	/* This is in the GNU C library in unistd.h. */

	#ifndef TEMP_FAILURE_RETRY
	/* Evaluate EXPRESSION, and repeat as long as it returns -1 with 'errno'
	set to EINTR. */

	# define TEMP_FAILURE_RETRY(expression) \
	(__extension__ \
	({ long int __result; \
	do __result = (long int) (expression); \
	while (__result == -1L && errno == EINTR); \
	__result; }))
	#endif

	/* Unlink a file, and shred it if SHRED is true. */
	int
	remove_file (char *name, int shred)
	{
	if (!shred)
	return unlink (name);
	else
	{
	int status;
	pid_t pid;

	pid = fork ();
	if (pid == 0)
	{
	/* Child. */

	/* -f forces file to be writable, and -u unlinks it afterwards. */
	char *args[] = { SHRED, "-uf", name, NULL };

	execv (SHRED, args);
	_exit (127);
	}
	else if (pid < 0)
	{
	/* Fork failed. */
	status = -1;
	}
	else
	{
	/* Parent. */

	if (TEMP_FAILURE_RETRY (waitpid (pid, &status, 0)) != pid)
	status = -1;
	}

	if (!WIFEXITED (status))
	{
	log_error (_("%s on %s aborted with status %i\n"),
	SHRED, name, status);
	unlink (name);
	return 1;
	}
	else if (WEXITSTATUS (status))
	{
	log_error (_("%s on %s failed with status %i\n"), SHRED, name,
	WEXITSTATUS (status));
	unlink (name);
	return 1;
	}

	return 0;
	}
	}


	/* Class Confucius.

	"Don't worry that other people don't know you;
	worry that you don't know other people." Analects--1.16. */

	/* Create temporary directory with mode 0700. Returns a dynamically
	allocated string with the filename of the directory. */
	static char *
	confucius_mktmpdir (void)
	{
	char name, p;

	p = getenv ("TMPDIR");
	if (!p \|\| !*p)
	p = "/tmp";
	if (p[strlen (p) - 1] == '/')
	name = xstrconcat (p, "gpg-XXXXXX", NULL);
	else
	name = xstrconcat (p, "/", "gpg-XXXXXX", NULL);
	if (!name \|\| !gnupg_mkdtemp (name))
	{
	log_error (_("can't create temporary directory '%s': %s\n"),
	name?name:"", strerror (errno));
	return NULL;
	}

	return name;
	}


	/* Buffer size for I/O operations. */
	#define CONFUCIUS_BUFSIZE 4096

	/* Buffer size for output lines. */
	#define CONFUCIUS_LINESIZE 4096


	/* Copy the file IN to OUT, either of which may be "-". If PLAIN is
	true, and the copying fails, and OUT is not STDOUT, then shred the
	file instead unlinking it. */
	static int
	confucius_copy_file (char infile, char outfile, int plain)
	{
	FILE *in;
	int in_is_stdin = 0;
	FILE *out;
	int out_is_stdout = 0;
	char data[CONFUCIUS_BUFSIZE];
	ssize_t data_len;

	if (infile[0] == '-' && infile[1] == '\0')
	{
	/* FIXME: Is stdin in binary mode? */
	in = stdin;
	in_is_stdin = 1;
	}
	else
	{
	in = fopen (infile, "rb");
	if (!in)
	{
	log_error (_("could not open %s for writing: %s\n"),
	infile, strerror (errno));
	return 1;
	}
	}

	if (outfile[0] == '-' && outfile[1] == '\0')
	{
	/* FIXME: Is stdout in binary mode? */
	out = stdout;
	out_is_stdout = 1;
	}
	else
	{
	out = fopen (outfile, "wb");
	if (!out)
	{
	log_error (_("could not open %s for writing: %s\n"),
	infile, strerror (errno));
	return 1;
	}
	}

	/* Now copy the data. */
	while ((data_len = fread (data, 1, sizeof (data), in)) > 0)
	{
	if (fwrite (data, 1, data_len, out) != data_len)
	{
	log_error (_("error writing to %s: %s\n"), outfile,
	strerror (errno));
	goto copy_err;
	}
	}
	if (data_len < 0 \|\| ferror (in))
	{
	log_error (_("error reading from %s: %s\n"), infile, strerror (errno));
	goto copy_err;
	}

	/* Close IN if appropriate. */
	if (!in_is_stdin && fclose (in) && ferror (in))
	{
	log_error (_("error closing %s: %s\n"), infile, strerror (errno));
	goto copy_err;
	}

	/* Close OUT if appropriate. */
	if (!out_is_stdout && fclose (out) && ferror (out))
	{
	log_error (_("error closing %s: %s\n"), infile, strerror (errno));
	goto copy_err;
	}

	return 0;

	copy_err:
	if (!out_is_stdout)
	remove_file (outfile, plain);

	return 1;
	}


	/* Get a passphrase in secure storage (if possible). If AGAIN is
	true, then this is a repeated attempt. If CANCELED is not a null
	pointer, it will be set to true or false, depending on if the user
	canceled the operation or not. On error (including cancelation), a
	null pointer is returned. The passphrase must be deallocated with
	confucius_drop_pass. CACHEID is the ID to be used for passphrase
	caching and can be NULL to disable caching. */
	char *
	confucius_get_pass (const char cacheid, int again, int canceled)
	{
	int err;
	char *pw;
	char *orig_codeset;

	if (canceled)
	*canceled = 0;

	orig_codeset = i18n_switchto_utf8 ();
	pw = simple_pwquery (cacheid,
	again ? _("does not match - try again"):NULL,
	_("Passphrase:"), NULL, 0, &err);
	i18n_switchback (orig_codeset);

	if (!pw)
	{
	if (err)
	log_error (_("error while asking for the passphrase: %s\n"),
	gpg_strerror (err));
	else
	{
	log_info (_("cancelled\n"));
	if (canceled)
	*canceled = 1;
	}
	}

	return pw;
	}


	/* Drop a passphrase retrieved with confucius_get_pass. */
	void
	confucius_drop_pass (char *pass)
	{
	if (pass)
	spwq_secure_free (pass);
	}


	/* Run a confucius crypto engine. If MODE is oEncrypt, encryption is
	requested. If it is oDecrypt, decryption is requested. INFILE and
	OUTFILE are the temporary files used in the process. */
	int
	confucius_process (int mode, char infile, char outfile,
	int argc, char *argv[])
	{
	char **args;
	int cstderr[2];
	int master;
	int slave;
	int res;
	pid_t pid;
	pid_t wpid;
	int tries = 0;
	char cacheid[40];

	signal (SIGPIPE, SIG_IGN);

	if (!opt.program)
	{
	log_error (_("no --program option provided\n"));
	return 1;
	}

	if (mode != oDecrypt && mode != oEncrypt)
	{
	log_error (_("only --decrypt and --encrypt are supported\n"));
	return 1;
	}

	if (!opt.keyfile)
	{
	log_error (_("no --keyfile option provided\n"));
	return 1;
	}

	/* Generate a hash from the keyfile name for caching. */
	snprintf (cacheid, sizeof (cacheid), "confucius:%lu",
	hash_string (opt.keyfile));
	cacheid[sizeof (cacheid) - 1] = '\0';
	args = malloc (sizeof (char ) (10 + argc));
	if (!args)
	{
	log_error (_("cannot allocate args vector\n"));
	return 1;
	}
	args[0] = opt.program;
	args[1] = (mode == oEncrypt) ? "-m1" : "-m2";
	args[2] = "-q";
	args[3] = infile;
	args[4] = "-z";
	args[5] = outfile;
	args[6] = "-s";
	args[7] = opt.keyfile;
	args[8] = (mode == oEncrypt) ? "-af" : "-f";
	args[9 + argc] = NULL;
	while (argc--)
	args[9 + argc] = argv[argc];

	if (pipe (cstderr) < 0)
	{
	log_error (_("could not create pipe: %s\n"), strerror (errno));
	free (args);
	return 1;
	}

	if (openpty (&master, &slave, NULL, NULL, NULL) == -1)
	{
	log_error (_("could not create pty: %s\n"), strerror (errno));
	close (cstderr[0]);
	close (cstderr[1]);
	free (args);
	return -1;
	}

	/* We don't want to deal with the worst case scenarios. */
	assert (master > 2);
	assert (slave > 2);
	assert (cstderr[0] > 2);
	assert (cstderr[1] > 2);

	pid = fork ();
	if (pid < 0)
	{
	log_error (_("could not fork: %s\n"), strerror (errno));
	close (master);
	close (slave);
	close (cstderr[0]);
	close (cstderr[1]);
	free (args);
	return 1;
	}
	else if (pid == 0)
	{
	/* Child. */

	/* Close the parent ends. */
	close (master);
	close (cstderr[0]);

	/* Change controlling terminal. */
	if (login_tty (slave))
	{
	/* It's too early to output a debug message. */
	_exit (1);
	}

	dup2 (cstderr[1], 2);
	close (cstderr[1]);

	/* Now kick off the engine program. */
	execv (opt.program, args);
	log_error (_("execv failed: %s\n"), strerror (errno));
	_exit (1);
	}
	else
	{
	/* Parent. */
	char buffer[CONFUCIUS_LINESIZE];
	int buffer_len = 0;
	fd_set fds;
	int slave_closed = 0;
	int stderr_closed = 0;

	close (slave);
	close (cstderr[1]);
	free (args);

	/* Listen on the output FDs. */
	do
	{
	FD_ZERO (&fds);

	if (!slave_closed)
	FD_SET (master, &fds);
	if (!stderr_closed)
	FD_SET (cstderr[0], &fds);

	res = select (FD_SETSIZE, &fds, NULL, NULL, NULL);
	if (res < 0)
	{
	log_error (_("select failed: %s\n"), strerror (errno));

	kill (pid, SIGTERM);
	close (master);
	close (cstderr[0]);
	return 1;
	}

	if (FD_ISSET (cstderr[0], &fds))
	{
	/* We got some output on stderr. This is just passed
	through via the logging facility. */

	res = read (cstderr[0], &buffer[buffer_len],
	sizeof (buffer) - buffer_len - 1);
	if (res < 0)
	{
	log_error (_("read failed: %s\n"), strerror (errno));

	kill (pid, SIGTERM);
	close (master);
	close (cstderr[0]);
	return 1;
	}
	else
	{
	char *newline;

	buffer_len += res;
	for (;;)
	{
	buffer[buffer_len] = '\0';
	newline = strchr (buffer, '\n');
	if (newline)
	{
	*newline = '\0';
	log_error ("%s\n", buffer);
	buffer_len -= newline + 1 - buffer;
	memmove (buffer, newline + 1, buffer_len);
	}
	else if (buffer_len == sizeof (buffer) - 1)
	{
	/* Overflow. */
	log_error ("%s\n", buffer);
	buffer_len = 0;
	}
	else
	break;
	}

	if (res == 0)
	stderr_closed = 1;
	}
	}
	else if (FD_ISSET (master, &fds))
	{
	char data[512];

	res = read (master, data, sizeof (data));
	if (res < 0)
	{
	if (errno == EIO)
	{
	/* Slave-side close leads to readable fd and
	EIO. */
	slave_closed = 1;
	}
	else
	{
	log_error (_("pty read failed: %s\n"), strerror (errno));

	kill (pid, SIGTERM);
	close (master);
	close (cstderr[0]);
	return 1;
	}
	}
	else if (res == 0)
	/* This never seems to be what happens on slave-side
	close. */
	slave_closed = 1;
	else
	{
	/* Check for password prompt. */
	if (data[res - 1] == ':')
	{
	char *pass;
	int canceled;

	/* If this is not the first attempt, the
	passphrase seems to be wrong, so clear the
	cache. */
	if (tries)
	simple_pwclear (cacheid);

	pass = confucius_get_pass (cacheid,
	tries ? 1 : 0, &canceled);
	if (!pass)
	{
	kill (pid, SIGTERM);
	close (master);
	close (cstderr[0]);
	return canceled ? SYMC_CANCELED : 1;
	}
	write (master, pass, strlen (pass));
	write (master, "\n", 1);
	confucius_drop_pass (pass);

	tries++;
	}
	}
	}
	}
	while (!stderr_closed \|\| !slave_closed);

	close (master);
	close (cstderr[0]);

	wpid = waitpid (pid, &res, 0);
	if (wpid < 0)
	{
	log_error (_("waitpid failed: %s\n"), strerror (errno));

	kill (pid, SIGTERM);
	/* State of cached password is unclear. Just remove it. */
	simple_pwclear (cacheid);
	return 1;
	}
	else
	{
	/* Shouldn't happen, as we don't use WNOHANG. */
	assert (wpid != 0);

	if (!WIFEXITED (res))
	{
	log_error (_("child aborted with status %i\n"), res);

	/* State of cached password is unclear. Just remove it. */
	simple_pwclear (cacheid);

	return 1;
	}

	if (WEXITSTATUS (res))
	{
	/* The passphrase was wrong. Remove it from the cache. */
	simple_pwclear (cacheid);

	/* We probably exceeded our number of attempts at guessing
	the password. */
	if (tries >= 3)
	return SYMC_BAD_PASSPHRASE;
	else
	return 1;
	}

	return 0;
	}
	}

	/* Not reached. */
	}


	/* Class confucius main program. If MODE is oEncrypt, encryption is
	requested. If it is oDecrypt, decryption is requested. The other
	parameters are taken from the global option data. */
	int
	confucius_main (int mode, int argc, char *argv[])
	{
	int res;
	char *tmpdir;
	char *infile;
	int infile_from_stdin = 0;
	char *outfile;

	tmpdir = confucius_mktmpdir ();
	if (!tmpdir)
	return 1;

	if (opt.input && !(opt.input[0] == '-' && opt.input[1] == '\0'))
	infile = xstrdup (opt.input);
	else
	{
	infile_from_stdin = 1;

	/* TMPDIR + "/" + "in" + "\0". */
	infile = malloc (strlen (tmpdir) + 1 + 2 + 1);
	if (!infile)
	{
	log_error (_("cannot allocate infile string: %s\n"),
	strerror (errno));
	rmdir (tmpdir);
	return 1;
	}
	strcpy (infile, tmpdir);
	strcat (infile, "/in");
	}

	/* TMPDIR + "/" + "out" + "\0". */
	outfile = malloc (strlen (tmpdir) + 1 + 3 + 1);
	if (!outfile)
	{
	log_error (_("cannot allocate outfile string: %s\n"), strerror (errno));
	free (infile);
	rmdir (tmpdir);
	return 1;
	}
	strcpy (outfile, tmpdir);
	strcat (outfile, "/out");

	if (infile_from_stdin)
	{
	/* Create INFILE and fill it with content. */
	res = confucius_copy_file ("-", infile, mode == oEncrypt);
	if (res)
	{
	free (outfile);
	free (infile);
	rmdir (tmpdir);
	return res;
	}
	}

	/* Run the engine and thus create the output file, handling
	passphrase retrieval. */
	res = confucius_process (mode, infile, outfile, argc, argv);
	if (res)
	{
	remove_file (outfile, mode == oDecrypt);
	if (infile_from_stdin)
	remove_file (infile, mode == oEncrypt);
	free (outfile);
	free (infile);
	rmdir (tmpdir);
	return res;
	}

	/* Dump the output file to stdout. */
	res = confucius_copy_file (outfile, "-", mode == oDecrypt);
	if (res)
	{
	remove_file (outfile, mode == oDecrypt);
	if (infile_from_stdin)
	remove_file (infile, mode == oEncrypt);
	free (outfile);
	free (infile);
	rmdir (tmpdir);
	return res;
	}

	remove_file (outfile, mode == oDecrypt);
	if (infile_from_stdin)
	remove_file (infile, mode == oEncrypt);
	free (outfile);
	free (infile);
	rmdir (tmpdir);
	return 0;
	}


	/* symcryptrun's entry point. */
	int
	main (int argc, char **argv)
	{
	ARGPARSE_ARGS pargs;
	int orig_argc;
	char **orig_argv;
	FILE *configfp = NULL;
	char *configname = NULL;
	unsigned configlineno;
	int mode = 0;
	int res;
	char *logfile = NULL;
	int default_config = 1;

	early_system_init ();
	set_strusage (my_strusage);
	log_set_prefix ("symcryptrun", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);

	/* Check whether we have a config file given on the commandline */
	orig_argc = argc;
	orig_argv = argv;
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= 1\|(1<<6); /* do not remove the args, ignore version */
	while (arg_parse( &pargs, opts))
	{
	if (pargs.r_opt == oOptions)
	{ /* Yes there is one, so we do not try the default one, but
	read the option file when it is encountered at the
	commandline */
	default_config = 0;
	}
	else if (pargs.r_opt == oNoOptions)
	default_config = 0; /* --no-options */
	else if (pargs.r_opt == oHomedir)
	gnupg_set_homedir (pargs.r.ret_str);
	}

	if (default_config)
	configname = make_filename (gnupg_homedir (), "symcryptrun.conf", NULL );

	argc = orig_argc;
	argv = orig_argv;
	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= 1; /* do not remove the args */
	next_pass:
	if (configname)
	{
	configlineno = 0;
	configfp = fopen (configname, "r");
	if (!configfp)
	{
	if (!default_config)
	{
	log_error (_("option file '%s': %s\n"),
	configname, strerror(errno) );
	exit(1);
	}
	xfree (configname);
	configname = NULL;
	}
	default_config = 0;
	}

	/* Parse the command line. */
	while (optfile_parse (configfp, configname, &configlineno, &pargs, opts))
	{
	switch (pargs.r_opt)
	{
	case oDecrypt: mode = oDecrypt; break;
	case oEncrypt: mode = oEncrypt; break;

	case oQuiet: opt.quiet = 1; break;
	case oVerbose: opt.verbose++; break;
	case oNoVerbose: opt.verbose = 0; break;

	case oClass: opt.class = pargs.r.ret_str; break;
	case oProgram: opt.program = pargs.r.ret_str; break;
	case oKeyfile: opt.keyfile = pargs.r.ret_str; break;
	case oInput: opt.input = pargs.r.ret_str; break;

	case oLogFile: logfile = pargs.r.ret_str; break;

	case oOptions:
	/* Config files may not be nested (silently ignore them) */
	if (!configfp)
	{
	xfree(configname);
	configname = xstrdup(pargs.r.ret_str);
	goto next_pass;
	}
	break;
	case oNoOptions: break; /* no-options */
	case oHomedir: /* Ignore this option here. */; break;

	default : pargs.err = configfp? 1:2; break;
	}
	}
	if (configfp)
	{
	fclose( configfp );
	configfp = NULL;
	configname = NULL;
	goto next_pass;
	}
	xfree (configname);
	configname = NULL;

	if (!mode)
	log_error (_("either %s or %s must be given\n"),
	"--decrypt", "--encrypt");

	if (log_get_errorcount (0))
	exit (1);

	if (logfile)
	log_set_file (logfile);

	gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
	setup_libgcrypt_logging ();
	gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);

	- /* Tell simple-pwquery about the the standard socket name. */
	+ /* Tell simple-pwquery about the standard socket name. */
	{
	char *tmp = make_filename (gnupg_socketdir (), GPG_AGENT_SOCK_NAME, NULL);
	simple_pw_set_socket (tmp);
	xfree (tmp);
	}

	if (!opt.class)
	{
	log_error (_("no class provided\n"));
	res = 1;
	}
	else if (!strcmp (opt.class, "confucius"))
	{
	res = confucius_main (mode, argc, argv);
	}
	else
	{
	log_error (_("class %s is not supported\n"), opt.class);
	res = 1;
	}

	return res;
	}

File Metadata

Mime Type: application/octet-stream
Expires: Mon, Jul 14, 2:02 PM (12 h, 6 m)
Storage Engine: chunks
Storage Format: Chunks
Storage Handle: TfgJObkzQnYb

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions