No OneTemporary
Actions

Size

337 KB

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/g10/getkey.c b/g10/getkey.c
	index e5f3a6d08..7822fd109 100644
	--- a/g10/getkey.c
	+++ b/g10/getkey.c
	@@ -1,4562 +1,4571 @@
	/* getkey.c - Get a key from the database
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007, 2008, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "keydb.h"
	#include "options.h"
	#include "main.h"
	#include "trustdb.h"
	#include "../common/i18n.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "../common/host2net.h"
	#include "../common/mbox-util.h"
	#include "../common/status.h"

	#define MAX_PK_CACHE_ENTRIES PK_UID_CACHE_SIZE
	#define MAX_UID_CACHE_ENTRIES PK_UID_CACHE_SIZE

	#if MAX_PK_CACHE_ENTRIES < 2
	#error We need the cache for key creation
	#endif

	/* Flags values returned by the lookup code. Note that the values are
	* directly used by the KEY_CONSIDERED status line. */
	#define LOOKUP_NOT_SELECTED (1<<0)
	#define LOOKUP_ALL_SUBKEYS_EXPIRED (1<<1) /* or revoked */


	/* A context object used by the lookup functions. */
	struct getkey_ctx_s
	{
	/* Part of the search criteria: whether the search is an exact
	search or not. A search that is exact requires that a key or
	subkey meet all of the specified criteria. A search that is not
	exact allows selecting a different key or subkey from the
	keyblock that matched the critera. Further, an exact search
	returns the key or subkey that matched whereas a non-exact search
	typically returns the primary key. See finish_lookup for
	details. */
	int exact;

	/* Part of the search criteria: Whether the caller only wants keys
	with an available secret key. This is used by getkey_next to get
	the next result with the same initial criteria. */
	int want_secret;

	/* Part of the search criteria: The type of the requested key. A
	mask of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT.
	If non-zero, then for a key to match, it must implement one of
	the required uses. */
	int req_usage;

	/* The database handle. */
	KEYDB_HANDLE kr_handle;

	/* Whether we should call xfree() on the context when the context is
	released using getkey_end()). */
	int not_allocated;

	/* This variable is used as backing store for strings which have
	their address used in ITEMS. */
	strlist_t extra_list;

	/* Hack to return the mechanism (AKL_foo) used to find the key. */
	int found_via_akl;

	/* Part of the search criteria: The low-level search specification
	as passed to keydb_search. */
	int nitems;
	/* This must be the last element in the structure. When we allocate
	the structure, we allocate it so that ITEMS can hold NITEMS. */
	KEYDB_SEARCH_DESC items[1];
	};

	#if 0
	static struct
	{
	int any;
	int okay_count;
	int nokey_count;
	int error_count;
	} lkup_stats[21];
	#endif

	typedef struct keyid_list
	{
	struct keyid_list *next;
	char fpr[MAX_FINGERPRINT_LEN];
	u32 keyid[2];
	} *keyid_list_t;


	#if MAX_PK_CACHE_ENTRIES
	typedef struct pk_cache_entry
	{
	struct pk_cache_entry *next;
	u32 keyid[2];
	PKT_public_key *pk;
	} *pk_cache_entry_t;
	static pk_cache_entry_t pk_cache;
	static int pk_cache_entries; /* Number of entries in pk cache. */
	static int pk_cache_disabled;
	#endif

	#if MAX_UID_CACHE_ENTRIES < 5
	#error we really need the userid cache
	#endif
	typedef struct user_id_db
	{
	struct user_id_db *next;
	keyid_list_t keyids;
	int len;
	char name[1];
	} *user_id_db_t;
	static user_id_db_t user_id_db;
	static int uid_cache_entries; /* Number of entries in uid cache. */

	static void merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock);
	static int lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
	kbnode_t ret_keyblock, kbnode_t ret_found_key);
	static kbnode_t finish_lookup (kbnode_t keyblock,
	unsigned int req_usage, int want_exact,
	int want_secret, unsigned int *r_flags);
	static void print_status_key_considered (kbnode_t keyblock, unsigned int flags);


	#if 0
	static void
	print_stats ()
	{
	int i;
	for (i = 0; i < DIM (lkup_stats); i++)
	{
	if (lkup_stats[i].any)
	es_fprintf (es_stderr,
	"lookup stats: mode=%-2d ok=%-6d nokey=%-6d err=%-6d\n",
	i,
	lkup_stats[i].okay_count,
	lkup_stats[i].nokey_count, lkup_stats[i].error_count);
	}
	}
	#endif


	/* Cache a copy of a public key in the public key cache. PK is not
	* cached if caching is disabled (via getkey_disable_caches), if
	* PK->FLAGS.DONT_CACHE is set, we don't know how to derive a key id
	* from the public key (e.g., unsupported algorithm), or a key with
	* the key id is already in the cache.
	*
	* The public key packet is copied into the cache using
	* copy_public_key. Thus, any secret parts are not copied, for
	* instance.
	*
	* This cache is filled by get_pubkey and is read by get_pubkey and
	* get_pubkey_fast. */
	void
	cache_public_key (PKT_public_key * pk)
	{
	#if MAX_PK_CACHE_ENTRIES
	pk_cache_entry_t ce, ce2;
	u32 keyid[2];

	if (pk_cache_disabled)
	return;

	if (pk->flags.dont_cache)
	return;

	if (is_ELGAMAL (pk->pubkey_algo)
	\|\| pk->pubkey_algo == PUBKEY_ALGO_DSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_EDDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| is_RSA (pk->pubkey_algo))
	{
	keyid_from_pk (pk, keyid);
	}
	else
	return; /* Don't know how to get the keyid. */

	for (ce = pk_cache; ce; ce = ce->next)
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	{
	if (DBG_CACHE)
	log_debug ("cache_public_key: already in cache\n");
	return;
	}

	if (pk_cache_entries >= MAX_PK_CACHE_ENTRIES)
	{
	int n;

	/* Remove the last 50% of the entries. */
	for (ce = pk_cache, n = 0; ce && n < pk_cache_entries/2; n++)
	ce = ce->next;
	if (ce && ce != pk_cache && ce->next)
	{
	ce2 = ce->next;
	ce->next = NULL;
	ce = ce2;
	for (; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	pk_cache_entries--;
	}
	}
	log_assert (pk_cache_entries < MAX_PK_CACHE_ENTRIES);
	}
	pk_cache_entries++;
	ce = xmalloc (sizeof *ce);
	ce->next = pk_cache;
	pk_cache = ce;
	ce->pk = copy_public_key (NULL, pk);
	ce->keyid[0] = keyid[0];
	ce->keyid[1] = keyid[1];
	#endif
	}


	/* Return a const utf-8 string with the text "[User ID not found]".
	This function is required so that we don't need to switch gettext's
	encoding temporary. */
	static const char *
	user_id_not_found_utf8 (void)
	{
	static char *text;

	if (!text)
	text = native_to_utf8 (_("[User ID not found]"));
	return text;
	}



	/* Return the user ID from the given keyblock.
	* We use the primary uid flag which has been set by the merge_selfsigs
	* function. The returned value is only valid as long as the given
	* keyblock is not changed. */
	static const char *
	get_primary_uid (KBNODE keyblock, size_t * uidlen)
	{
	KBNODE k;
	const char *s;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data
	&& k->pkt->pkt.user_id->flags.primary)
	{
	*uidlen = k->pkt->pkt.user_id->len;
	return k->pkt->pkt.user_id->name;
	}
	}
	s = user_id_not_found_utf8 ();
	*uidlen = strlen (s);
	return s;
	}


	static void
	release_keyid_list (keyid_list_t k)
	{
	while (k)
	{
	keyid_list_t k2 = k->next;
	xfree (k);
	k = k2;
	}
	}

	/****************
	* Store the association of keyid and userid
	* Feed only public keys to this function.
	*/
	static void
	cache_user_id (KBNODE keyblock)
	{
	user_id_db_t r;
	const char *uid;
	size_t uidlen;
	keyid_list_t keyids = NULL;
	KBNODE k;

	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	keyid_list_t a = xmalloc_clear (sizeof *a);
	/* Hmmm: For a long list of keyids it might be an advantage
	* to append the keys. */
	fingerprint_from_pk (k->pkt->pkt.public_key, a->fpr, NULL);
	keyid_from_pk (k->pkt->pkt.public_key, a->keyid);
	/* First check for duplicates. */
	for (r = user_id_db; r; r = r->next)
	{
	keyid_list_t b;

	for (b = r->keyids; b; b = b->next)
	{
	if (!memcmp (b->fpr, a->fpr, MAX_FINGERPRINT_LEN))
	{
	if (DBG_CACHE)
	log_debug ("cache_user_id: already in cache\n");
	release_keyid_list (keyids);
	xfree (a);
	return;
	}
	}
	}
	/* Now put it into the cache. */
	a->next = keyids;
	keyids = a;
	}
	}
	if (!keyids)
	BUG (); /* No key no fun. */


	uid = get_primary_uid (keyblock, &uidlen);

	if (uid_cache_entries >= MAX_UID_CACHE_ENTRIES)
	{
	/* fixme: use another algorithm to free some cache slots */
	r = user_id_db;
	user_id_db = r->next;
	release_keyid_list (r->keyids);
	xfree (r);
	uid_cache_entries--;
	}
	r = xmalloc (sizeof *r + uidlen - 1);
	r->keyids = keyids;
	r->len = uidlen;
	memcpy (r->name, uid, r->len);
	r->next = user_id_db;
	user_id_db = r;
	uid_cache_entries++;
	}


	/* Disable and drop the public key cache (which is filled by
	cache_public_key and get_pubkey). Note: there is currently no way
	to re-enable this cache. */
	void
	getkey_disable_caches ()
	{
	#if MAX_PK_CACHE_ENTRIES
	{
	pk_cache_entry_t ce, ce2;

	for (ce = pk_cache; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	}
	pk_cache_disabled = 1;
	pk_cache_entries = 0;
	pk_cache = NULL;
	}
	#endif
	/* fixme: disable user id cache ? */
	}


	/* Free a list of pubkey_t objects. */
	void
	pubkeys_free (pubkey_t keys)
	{
	while (keys)
	{
	pubkey_t next = keys->next;
	xfree (keys->pk);
	release_kbnode (keys->keyblock);
	xfree (keys);
	keys = next;
	}
	}


	static void
	pk_from_block (PKT_public_key *pk, kbnode_t keyblock, kbnode_t found_key)
	{
	kbnode_t a = found_key ? found_key : keyblock;

	log_assert (a->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| a->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	copy_public_key (pk, a->pkt->pkt.public_key);
	}


	/* Specialized version of get_pubkey which retrieves the key based on
	* information in SIG. In contrast to get_pubkey PK is required. IF
	* FORCED_PK is not NULL, this public key is used and copied to PK. */
	gpg_error_t
	get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig,
	PKT_public_key *forced_pk)
	{
	const byte *fpr;
	size_t fprlen;

	if (forced_pk)
	{
	copy_public_key (pk, forced_pk);
	return 0;
	}

	/* First try the new ISSUER_FPR info. */
	fpr = issuer_fpr_raw (sig, &fprlen);
	if (fpr && !get_pubkey_byfprint (ctrl, pk, NULL, fpr, fprlen))
	return 0;

	/* Fallback to use the ISSUER_KEYID. */
	return get_pubkey (ctrl, pk, sig->keyid);
	}


	/* Return the public key with the key id KEYID and store it at PK.
	* The resources in *PK should be released using
	* release_public_key_parts(). This function also stores a copy of
	* the public key in the user id cache (see cache_public_key).
	*
	* If PK is NULL, this function just stores the public key in the
	* cache and returns the usual return code.
	*
	* PK->REQ_USAGE (which is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT) is passed through to the
	* lookup function. If this is non-zero, only keys with the specified
	* usage will be returned. As such, it is essential that
	* PK->REQ_USAGE be correctly initialized!
	*
	* Returns 0 on success, GPG_ERR_NO_PUBKEY if there is no public key
	* with the specified key id, or another error code if an error
	* occurs.
	*
	* If the data was not read from the cache, then the self-signed data
	* has definitely been merged into the public key using
	* merge_selfsigs. */
	int
	get_pubkey (ctrl_t ctrl, PKT_public_key * pk, u32 * keyid)
	{
	int internal = 0;
	int rc = 0;

	#if MAX_PK_CACHE_ENTRIES
	if (pk)
	{
	/* Try to get it from the cache. We don't do this when pk is
	NULL as it does not guarantee that the user IDs are
	cached. */
	pk_cache_entry_t ce;
	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	/* XXX: We don't check PK->REQ_USAGE here, but if we don't
	read from the cache, we do check it! */
	{
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif
	/* More init stuff. */
	if (!pk)
	{
	internal++;
	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	}


	/* Do a lookup. */
	{
	struct getkey_ctx_s ctx;
	kbnode_t kb = NULL;
	kbnode_t found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;

	if (ctrl && ctrl->cached_getkey_kdb)
	{
	ctx.kr_handle = ctrl->cached_getkey_kdb;
	ctrl->cached_getkey_kdb = NULL;
	keydb_search_reset (ctx.kr_handle);
	}
	else
	{
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	}
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	rc = lookup (ctrl, &ctx, 0, &kb, &found_key);
	if (!rc)
	{
	pk_from_block (pk, kb, found_key);
	}
	getkey_end (ctrl, &ctx);
	release_kbnode (kb);
	}
	if (!rc)
	goto leave;

	rc = GPG_ERR_NO_PUBKEY;

	leave:
	if (!rc)
	cache_public_key (pk);
	if (internal)
	free_public_key (pk);
	return rc;
	}


	/* Same as get_pubkey but if the key was not found the function tries
	* to import it from LDAP. FIXME: We should not need this but swicth
	* to a fingerprint lookup. */
	gpg_error_t
	get_pubkey_with_ldap_fallback (ctrl_t ctrl, PKT_public_key pk, u32 keyid)
	{
	gpg_error_t err;

	err = get_pubkey (ctrl, pk, keyid);
	if (!err)
	return 0;

	if (gpg_err_code (err) != GPG_ERR_NO_PUBKEY)
	return err;

	/* Note that this code does not handle the case for two readers
	* having both openpgp encryption keys. Only one will be tried. */
	if (opt.debug)
	log_debug ("using LDAP to find a public key\n");
	err = keyserver_import_keyid (ctrl, keyid,
	opt.keyserver, KEYSERVER_IMPORT_FLAG_LDAP);
	if (gpg_err_code (err) == GPG_ERR_NO_DATA
	\|\| gpg_err_code (err) == GPG_ERR_NO_KEYSERVER)
	{
	/* Dirmngr returns NO DATA is the selected keyserver
	* does not have the requested key. It returns NO
	* KEYSERVER if no LDAP keyservers are configured. */
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	}
	if (err)
	return err;

	return get_pubkey (ctrl, pk, keyid);
	}


	/* Similar to get_pubkey, but it does not take PK->REQ_USAGE into
	* account nor does it merge in the self-signed data. This function
	* also only considers primary keys. It is intended to be used as a
	* quick check of the key to avoid recursion. It should only be used
	* in very certain cases. Like get_pubkey and unlike any of the other
	* lookup functions, this function also consults the user id cache
	* (see cache_public_key).
	*
	* Return the public key in PK. The resources in PK should be
	* released using release_public_key_parts(). */
	int
	get_pubkey_fast (PKT_public_key * pk, u32 * keyid)
	{
	int rc = 0;
	KEYDB_HANDLE hd;
	KBNODE keyblock;
	u32 pkid[2];

	log_assert (pk);
	#if MAX_PK_CACHE_ENTRIES
	{
	/* Try to get it from the cache */
	pk_cache_entry_t ce;

	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1]
	/* Only consider primary keys. */
	&& ce->pk->keyid[0] == ce->pk->main_keyid[0]
	&& ce->pk->keyid[1] == ce->pk->main_keyid[1])
	{
	if (pk)
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif

	hd = keydb_new ();
	if (!hd)
	return gpg_error_from_syserror ();
	rc = keydb_search_kid (hd, keyid);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	{
	keydb_release (hd);
	return GPG_ERR_NO_PUBKEY;
	}
	rc = keydb_get_keyblock (hd, &keyblock);
	keydb_release (hd);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	return GPG_ERR_NO_PUBKEY;
	}

	log_assert (keyblock && keyblock->pkt
	&& keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* We return the primary key. If KEYID matched a subkey, then we
	return an error. */
	keyid_from_pk (keyblock->pkt->pkt.public_key, pkid);
	if (keyid[0] == pkid[0] && keyid[1] == pkid[1])
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	else
	rc = GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	return rc;
	}


	/* Return the entire keyblock used to create SIG. This is a
	* specialized version of get_pubkeyblock.
	*
	* FIXME: This is a hack because get_pubkey_for_sig was already called
	* and it could have used a cache to hold the key. */
	kbnode_t
	get_pubkeyblock_for_sig (ctrl_t ctrl, PKT_signature *sig)
	{
	const byte *fpr;
	size_t fprlen;
	kbnode_t keyblock;

	/* First try the new ISSUER_FPR info. */
	fpr = issuer_fpr_raw (sig, &fprlen);
	if (fpr && !get_pubkey_byfprint (ctrl, NULL, &keyblock, fpr, fprlen))
	return keyblock;

	/* Fallback to use the ISSUER_KEYID. */
	return get_pubkeyblock (ctrl, sig->keyid);
	}


	/* Return the key block for the key with key id KEYID or NULL, if an
	* error occurs. Use release_kbnode() to release the key block.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	kbnode_t
	get_pubkeyblock (ctrl_t ctrl, u32 * keyid)
	{
	struct getkey_ctx_s ctx;
	int rc = 0;
	KBNODE keyblock = NULL;

	memset (&ctx, 0, sizeof ctx);
	/* No need to set exact here because we want the entire block. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return NULL;
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	rc = lookup (ctrl, &ctx, 0, &keyblock, NULL);
	getkey_end (ctrl, &ctx);

	return rc ? NULL : keyblock;
	}


	/* Return the public key with the key id KEYID iff the secret key is
	* available and store it at PK. The resources should be released
	* using release_public_key_parts().
	*
	* Unlike other lookup functions, PK may not be NULL. PK->REQ_USAGE
	* is passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. Thus, it
	* must be valid! If this is non-zero, only keys with the specified
	* usage will be returned.
	*
	* Returns 0 on success. If a public key with the specified key id is
	* not found or a secret key is not available for that public key, an
	* error code is returned. Note: this function ignores legacy keys.
	* An error code is also return if an error occurs.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	get_seckey (ctrl_t ctrl, PKT_public_key pk, u32 keyid)
	{
	gpg_error_t err;
	struct getkey_ctx_s ctx;
	kbnode_t keyblock = NULL;
	kbnode_t found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	err = lookup (ctrl, &ctx, 1, &keyblock, &found_key);
	if (!err)
	{
	pk_from_block (pk, keyblock, found_key);
	}
	getkey_end (ctrl, &ctx);
	release_kbnode (keyblock);

	if (!err)
	{
	err = agent_probe_secret_key (/ctrl/NULL, pk);
	if (err)
	release_public_key_parts (pk);
	}

	return err;
	}


	/* Skip unusable keys. A key is unusable if it is revoked, expired or
	disabled or if the selected user id is revoked or expired. */
	static int
	skip_unusable (void opaque, u32 keyid, int uid_no)
	{
	ctrl_t ctrl = opaque;
	int unusable = 0;
	KBNODE keyblock;
	PKT_public_key *pk;

	keyblock = get_pubkeyblock (ctrl, keyid);
	if (!keyblock)
	{
	log_error ("error checking usability status of %s\n", keystr (keyid));
	goto leave;
	}

	pk = keyblock->pkt->pkt.public_key;

	/* Is the key revoked or expired? */
	if (pk->flags.revoked \|\| pk->has_expired)
	unusable = 1;

	/* Is the user ID in question revoked or expired? */
	if (!unusable && uid_no)
	{
	KBNODE node;
	int uids_seen = 0;

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *user_id = node->pkt->pkt.user_id;

	uids_seen ++;
	if (uids_seen != uid_no)
	continue;

	if (user_id->flags.revoked \|\| user_id->flags.expired)
	unusable = 1;

	break;
	}
	}

	/* If UID_NO is non-zero, then the keyblock better have at least
	that many UIDs. */
	log_assert (uids_seen == uid_no);
	}

	if (!unusable)
	unusable = pk_is_disabled (pk);

	leave:
	release_kbnode (keyblock);
	return unusable;
	}


	/* Search for keys matching some criteria.

	If RETCTX is not NULL, then the constructed context is returned in
	*RETCTX so that getpubkey_next can be used to get subsequent
	results. In this case, getkey_end() must be used to free the
	search context. If RETCTX is not NULL, then RET_KDBHD must be
	NULL.

	If NAMELIST is not NULL, then a search query is constructed using
	classify_user_id on each of the strings in the list. (Recall: the
	database does an OR of the terms, not an AND.) If NAMELIST is
	NULL, then all results are returned.

	If PK is not NULL, the public key of the first result is returned
	in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	set, it is used to filter the search results. See the
	documentation for finish_lookup to understand exactly how this is
	used. Note: The self-signed data has already been merged into the
	public key using merge_selfsigs. Free *PK by calling
	release_public_key_parts (or, if PK was allocated using xfree, you
	can use free_public_key, which calls release_public_key_parts(PK)
	and then xfree(PK)).

	If WANT_SECRET is set, then only keys with an available secret key
	(either locally or via key registered on a smartcard) are returned.

	If INCLUDE_UNUSABLE is set, then unusable keys (see the
	documentation for skip_unusable for an exact definition) are
	skipped unless they are looked up by key id or by fingerprint.

	If RET_KB is not NULL, the keyblock is returned in *RET_KB. This
	should be freed using release_kbnode().

	If RET_KDBHD is not NULL, then the new database handle used to
	conduct the search is returned in *RET_KDBHD. This can be used to
	get subsequent results using keydb_search_next. Note: in this
	case, no advanced filtering is done for subsequent results (e.g.,
	WANT_SECRET and PK->REQ_USAGE are not respected).

	This function returns 0 on success. Otherwise, an error code is
	returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	(if want_secret is set) is returned if the key is not found. */
	static int
	key_byname (ctrl_t ctrl, GETKEY_CTX *retctx, strlist_t namelist,
	PKT_public_key *pk,
	int want_secret, int include_unusable,
	KBNODE * ret_kb, KEYDB_HANDLE * ret_kdbhd)
	{
	int rc = 0;
	int n;
	strlist_t r;
	GETKEY_CTX ctx;
	KBNODE help_kb = NULL;
	KBNODE found_key = NULL;

	if (retctx)
	{
	/* Reset the returned context in case of error. */
	log_assert (!ret_kdbhd); /* Not allowed because the handle is stored
	in the context. */
	*retctx = NULL;
	}
	if (ret_kdbhd)
	*ret_kdbhd = NULL;

	if (!namelist)
	/* No search terms: iterate over the whole DB. */
	{
	ctx = xmalloc_clear (sizeof *ctx);
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_FIRST;
	if (!include_unusable)
	{
	ctx->items[0].skipfnc = skip_unusable;
	ctx->items[0].skipfncvalue = ctrl;
	}
	}
	else
	{
	/* Build the search context. */
	for (n = 0, r = namelist; r; r = r->next)
	n++;

	/* CTX has space for a single search term at the end. Thus, we
	need to allocate sizeof *CTX plus (n - 1) sizeof
	CTX->ITEMS. */
	ctx = xmalloc_clear (sizeof ctx + (n - 1) sizeof ctx->items);
	ctx->nitems = n;

	for (n = 0, r = namelist; r; r = r->next, n++)
	{
	gpg_error_t err;

	err = classify_user_id (r->d, &ctx->items[n], 1);

	if (ctx->items[n].exact)
	ctx->exact = 1;
	if (err)
	{
	xfree (ctx);
	return gpg_err_code (err); /* FIXME: remove gpg_err_code. */
	}
	if (!include_unusable
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_SHORT_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_LONG_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR16
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR20
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR)
	{
	ctx->items[n].skipfnc = skip_unusable;
	ctx->items[n].skipfncvalue = ctrl;
	}
	}
	}

	ctx->want_secret = want_secret;
	ctx->kr_handle = keydb_new ();
	if (!ctx->kr_handle)
	{
	rc = gpg_error_from_syserror ();
	getkey_end (ctrl, ctx);
	return rc;
	}

	if (!ret_kb)
	ret_kb = &help_kb;

	if (pk)
	{
	ctx->req_usage = pk->req_usage;
	}

	rc = lookup (ctrl, ctx, want_secret, ret_kb, &found_key);
	if (!rc && pk)
	{
	pk_from_block (pk, *ret_kb, found_key);
	}

	release_kbnode (help_kb);

	if (retctx) /* Caller wants the context. */
	*retctx = ctx;
	else
	{
	if (ret_kdbhd)
	{
	*ret_kdbhd = ctx->kr_handle;
	ctx->kr_handle = NULL;
	}
	getkey_end (ctrl, ctx);
	}

	return rc;
	}


	/* Find a public key identified by NAME.
	*
	* If name appears to be a valid RFC822 mailbox (i.e., email address)
	* and auto key lookup is enabled (mode != GET_PUBKEY_NO_AKL), then
	* the specified auto key lookup methods (--auto-key-lookup) are used
	* to import the key into the local keyring. Otherwise, just the
	* local keyring is consulted.
	*
	* MODE can be one of:
	* GET_PUBKEY_NORMAL - The standard mode
	* GET_PUBKEY_NO_AKL - The auto key locate functionality is
	* disabled and only the local key ring is
	* considered. Note: the local key ring is
	* consulted even if local is not in the
	* auto-key-locate option list!
	* GET_PUBKEY_NO_LOCAL - Only the auto key locate functionaly is
	* used and no local search is done.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! PK->REQ_USAGE is
	* passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this
	* is non-zero, only keys with the specified usage will be returned.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* NAME is a string, which is turned into a search query using
	* classify_user_id.
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* If RET_KDBHD is not NULL, then the new database handle used to
	* conduct the search is returned in *RET_KDBHD. This can be used to
	* get subsequent results using keydb_search_next or to modify the
	* returned record. Note: in this case, no advanced filtering is done
	* for subsequent results (e.g., PK->REQ_USAGE is not respected).
	* Unlike RETCTX, this is always returned.
	*
	* If INCLUDE_UNUSABLE is set, then unusable keys (see the
	* documentation for skip_unusable for an exact definition) are
	* skipped unless they are looked up by key id or by fingerprint.
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	int
	get_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX * retctx, PKT_public_key * pk,
	const char name, KBNODE ret_keyblock,
	KEYDB_HANDLE * ret_kdbhd, int include_unusable)
	{
	int rc;
	strlist_t namelist = NULL;
	struct akl *akl;
	int is_mbox, is_fpr;
	KEYDB_SEARCH_DESC fprbuf;
	int nodefault = 0;
	int anylocalfirst = 0;
	int mechanism_type = AKL_NODEFAULT;
	size_t fprbuf_fprlen = 0;

	/* If RETCTX is not NULL, then RET_KDBHD must be NULL. */
	log_assert (retctx == NULL \|\| ret_kdbhd == NULL);

	if (retctx)
	*retctx = NULL;

	/* Does NAME appear to be a mailbox (mail address)? */
	is_mbox = is_valid_mailbox (name);
	if (!is_mbox && *name == '<' && name[1] && name[strlen(name)-1]=='>'
	&& name[1] != '>'
	&& is_valid_mailbox_mem (name+1, strlen (name)-2))
	{
	/* The mailbox is in the form "<foo@example.org>" which is not
	* detected by is_valid_mailbox. Set the flag but keep name as
	* it is because the bracketed name is actual the better
	* specification for a local search and the other methods
	* extract the mail address anyway. */
	is_mbox = 1;
	}

	/* If we are called due to --locate-external-key Check whether NAME
	* is a fingerprint and then try to lookup that key by configured
	* method which support lookup by fingerprint. FPRBUF carries the
	* parsed fingerpint iff IS_FPR is true. */
	is_fpr = 0;
	if (!is_mbox && mode == GET_PUBKEY_NO_LOCAL)
	{
	if (!classify_user_id (name, &fprbuf, 1)
	&& (fprbuf.mode == KEYDB_SEARCH_MODE_FPR16
	\|\| fprbuf.mode == KEYDB_SEARCH_MODE_FPR20
	\|\| fprbuf.mode == KEYDB_SEARCH_MODE_FPR))
	{
	/* Note: We should get rid of the FPR16 because we don't
	* support v3 keys anymore. However, in 2.3 the fingerprint
	* code has already been reworked and thus it is
	* questionable whether we should really tackle this here. */
	if (fprbuf.mode == KEYDB_SEARCH_MODE_FPR16)
	fprbuf_fprlen = 16;
	else
	fprbuf_fprlen = 20;
	is_fpr = 1;
	}
	}

	/* The auto-key-locate feature works as follows: there are a number
	* of methods to look up keys. By default, the local keyring is
	* tried first. Then, each method listed in the --auto-key-locate is
	* tried in the order it appears.
	*
	* This can be changed as follows:
	*
	* - if nodefault appears anywhere in the list of options, then
	* the local keyring is not tried first, or,
	*
	* - if local appears anywhere in the list of options, then the
	* local keyring is not tried first, but in the order in which
	* it was listed in the --auto-key-locate option.
	*
	* Note: we only save the search context in RETCTX if the local
	* method is the first method tried (either explicitly or
	* implicitly). */
	if (mode == GET_PUBKEY_NO_LOCAL)
	nodefault = 1; /* Auto-key-locate but ignore "local". */
	else if (mode != GET_PUBKEY_NO_AKL)
	{
	/* auto-key-locate is enabled. */

	/* nodefault is true if "nodefault" or "local" appear. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_NODEFAULT \|\| akl->type == AKL_LOCAL)
	{
	nodefault = 1;
	break;
	}
	/* anylocalfirst is true if "local" appears before any other
	search methods (except "nodefault"). */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type != AKL_NODEFAULT)
	{
	if (akl->type == AKL_LOCAL)
	anylocalfirst = 1;
	break;
	}
	}

	if (!nodefault)
	{
	/* "nodefault" didn't occur. Thus, "local" is implicitly the
	* first method to try. */
	anylocalfirst = 1;
	}

	if (mode == GET_PUBKEY_NO_LOCAL)
	{
	/* Force using the AKL. If IS_MBOX is not set this is the final
	* error code. */
	rc = GPG_ERR_NO_PUBKEY;
	}
	else if (nodefault && is_mbox)
	{
	/* Either "nodefault" or "local" (explicitly) appeared in the
	* auto key locate list and NAME appears to be an email address.
	* Don't try the local keyring. */
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	/* Either "nodefault" and "local" don't appear in the auto key
	* locate list (in which case we try the local keyring first) or
	* NAME does not appear to be an email address (in which case we
	* only try the local keyring). In this case, lookup NAME in
	* the local keyring. */
	add_to_strlist (&namelist, name);
	rc = key_byname (ctrl, retctx, namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}

	/* If the requested name resembles a valid mailbox and automatic
	retrieval has been enabled, we try to import the key. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& mode != GET_PUBKEY_NO_AKL
	&& (is_mbox \|\| is_fpr))
	{
	/* NAME wasn't present in the local keyring (or we didn't try
	* the local keyring). Since the auto key locate feature is
	* enabled and NAME appears to be an email address, try the auto
	* locate feature. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	{
	unsigned char *fpr = NULL;
	size_t fpr_len;
	int did_akl_local = 0;
	int no_fingerprint = 0;
	const char *mechanism_string = "?";

	mechanism_type = akl->type;
	switch (mechanism_type)
	{
	case AKL_NODEFAULT:
	/* This is a dummy mechanism. */
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	break;

	case AKL_LOCAL:
	if (mode == GET_PUBKEY_NO_LOCAL)
	{
	/* Note that we get here in is_fpr more, so there is
	* no extra check for it required. */
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "Local";
	did_akl_local = 1;
	if (retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}
	add_to_strlist (&namelist, name);
	rc = key_byname (ctrl, anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}
	break;

	case AKL_CERT:
	if (is_fpr)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "DNS CERT";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;

	case AKL_PKA:
	if (is_fpr)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "PKA";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_pka (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;

	case AKL_DANE:
	if (is_fpr)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "DANE";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 1, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;

	case AKL_WKD:
	if (is_fpr)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "WKD";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_wkd (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;

	case AKL_LDAP:
	if (is_fpr)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "LDAP";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_ldap (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;

	case AKL_NTDS:
	mechanism_string = "NTDS";
	glo_ctrl.in_auto_key_retrieve++;
	if (is_fpr)
	rc = keyserver_import_fprint_ntds (ctrl,
	fprbuf.u.fpr, fprbuf_fprlen);
	else
	rc = keyserver_import_ntds (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_KEYSERVER:
	/* Strictly speaking, we don't need to only use a valid
	* mailbox for the getname search, but it helps cut down
	* on the problem of searching for something like "john"
	* and getting a whole lot of keys back. */
	if (keyserver_any_configured (ctrl))
	{
	mechanism_string = "keyserver";
	glo_ctrl.in_auto_key_retrieve++;
	if (is_fpr)
	{
	rc = keyserver_import_fprint (ctrl,
	fprbuf.u.fpr, fprbuf_fprlen,
	opt.keyserver,
	KEYSERVER_IMPORT_FLAG_LDAP);
	/* Map error codes because Dirmngr returns NO
	* DATA if the keyserver does not have the
	* requested key. It returns NO KEYSERVER if no
	* LDAP keyservers are configured. */
	if (gpg_err_code (rc) == GPG_ERR_NO_DATA
	\|\| gpg_err_code (rc) == GPG_ERR_NO_KEYSERVER)
	rc = gpg_error (GPG_ERR_NO_PUBKEY);
	}
	else
	{
	rc = keyserver_import_mbox (ctrl, name, &fpr, &fpr_len,
	opt.keyserver);
	}
	glo_ctrl.in_auto_key_retrieve--;
	}
	else
	{
	mechanism_string = "Unconfigured keyserver";
	rc = GPG_ERR_NO_PUBKEY;
	}
	break;

	case AKL_SPEC:
	{
	struct keyserver_spec *keyserver;

	mechanism_string = akl->spec->uri;
	keyserver = keyserver_match (akl->spec);
	glo_ctrl.in_auto_key_retrieve++;
	if (is_fpr)
	{
	rc = keyserver_import_fprint (ctrl,
	fprbuf.u.fpr, fprbuf_fprlen,
	opt.keyserver,
	KEYSERVER_IMPORT_FLAG_LDAP);
	if (gpg_err_code (rc) == GPG_ERR_NO_DATA
	\|\| gpg_err_code (rc) == GPG_ERR_NO_KEYSERVER)
	rc = gpg_error (GPG_ERR_NO_PUBKEY);
	}
	else
	{
	rc = keyserver_import_mbox (ctrl, name,
	&fpr, &fpr_len, keyserver);
	}
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;
	}

	/* Use the fingerprint of the key that we actually fetched.
	* This helps prevent problems where the key that we fetched
	* doesn't have the same name that we used to fetch it. In
	* the case of CERT and PKA, this is an actual security
	* requirement as the URL might point to a key put in by an
	* attacker. By forcing the use of the fingerprint, we
	* won't use the attacker's key here. */
	if (!rc && (fpr \|\| is_fpr))
	{
	char fpr_string[MAX_FINGERPRINT_LEN * 2 + 1];

	if (is_fpr)
	{
	log_assert (fprbuf_fprlen <= MAX_FINGERPRINT_LEN);
	bin2hex (fprbuf.u.fpr, fprbuf_fprlen, fpr_string);
	}
	else
	{
	log_assert (fpr_len <= MAX_FINGERPRINT_LEN);
	bin2hex (fpr, fpr_len, fpr_string);
	}

	if (opt.verbose)
	log_info ("auto-key-locate found fingerprint %s\n",
	fpr_string);

	free_strlist (namelist);
	namelist = NULL;
	add_to_strlist (&namelist, fpr_string);
	}
	else if (!rc && !fpr && !did_akl_local)
	{ /* The acquisition method said no failure occurred, but
	* it didn't return a fingerprint. That's a failure. */
	no_fingerprint = 1;
	rc = GPG_ERR_NO_PUBKEY;
	}
	xfree (fpr);
	fpr = NULL;

	if (!rc && !did_akl_local)
	{ /* There was no error and we didn't do a local lookup.
	* This means that we imported a key into the local
	* keyring. Try to read the imported key from the
	* keyring. */
	if (retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}
	rc = key_byname (ctrl, anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}
	if (!rc)
	{
	/* Key found. */
	if (opt.verbose)
	log_info (_("automatically retrieved '%s' via %s\n"),
	name, mechanism_string);
	break;
	}
	if ((gpg_err_code (rc) != GPG_ERR_NO_PUBKEY
	\|\| opt.verbose \|\| no_fingerprint) && *mechanism_string)
	log_info (_("error retrieving '%s' via %s: %s\n"),
	name, mechanism_string,
	no_fingerprint ? _("No fingerprint") : gpg_strerror (rc));
	}
	}

	if (rc && retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}

	if (retctx && *retctx)
	{
	log_assert (!(*retctx)->extra_list);
	(*retctx)->extra_list = namelist;
	(*retctx)->found_via_akl = mechanism_type;
	}
	else
	free_strlist (namelist);

	return rc;
	}




	/* Comparison machinery for get_best_pubkey_byname. */

	/* First we have a struct to cache computed information about the key
	* in question. */
	struct pubkey_cmp_cookie
	{
	int valid; /* Is this cookie valid? */
	PKT_public_key key; /* The key. */
	PKT_user_id uid; / The matching UID packet. */
	unsigned int validity; /* Computed validity of (KEY, UID). */
	u32 creation_time; /* Creation time of the newest subkey
	capable of encryption. */
	};


	/* Then we have a series of helper functions. */
	static int
	key_is_ok (const PKT_public_key *key)
	{
	return (! key->has_expired && ! key->flags.revoked
	&& key->flags.valid && ! key->flags.disabled);
	}


	static int
	uid_is_ok (const PKT_public_key key, const PKT_user_id uid)
	{
	return key_is_ok (key) && ! uid->flags.revoked;
	}


	static int
	subkey_is_ok (const PKT_public_key *sub)
	{
	return ! sub->flags.revoked && sub->flags.valid && ! sub->flags.disabled;
	}

	/* Return true if KEYBLOCK has only expired encryption subkyes. Note
	* that the function returns false if the key has no encryption
	* subkeys at all or the subkeys are revoked. */
	static int
	only_expired_enc_subkeys (kbnode_t keyblock)
	{
	kbnode_t node;
	PKT_public_key *sub;
	int any = 0;

	for (node = find_next_kbnode (keyblock, PKT_PUBLIC_SUBKEY);
	node; node = find_next_kbnode (node, PKT_PUBLIC_SUBKEY))
	{
	sub = node->pkt->pkt.public_key;

	if (!(sub->pubkey_usage & PUBKEY_USAGE_ENC))
	continue;

	if (!subkey_is_ok (sub))
	continue;

	any = 1;
	if (!sub->has_expired)
	return 0;
	}

	return any? 1 : 0;
	}

	/* Finally this function compares a NEW key to the former candidate
	* OLD. Returns < 0 if the old key is worse, > 0 if the old key is
	* better, == 0 if it is a tie. */
	static int
	pubkey_cmp (ctrl_t ctrl, const char name, struct pubkey_cmp_cookie old,
	struct pubkey_cmp_cookie *new, KBNODE new_keyblock)
	{
	kbnode_t n;

	new->creation_time = 0;
	for (n = find_next_kbnode (new_keyblock, PKT_PUBLIC_SUBKEY);
	n; n = find_next_kbnode (n, PKT_PUBLIC_SUBKEY))
	{
	PKT_public_key *sub = n->pkt->pkt.public_key;

	if ((sub->pubkey_usage & PUBKEY_USAGE_ENC) == 0)
	continue;

	if (! subkey_is_ok (sub))
	continue;

	if (sub->timestamp > new->creation_time)
	new->creation_time = sub->timestamp;
	}

	for (n = find_next_kbnode (new_keyblock, PKT_USER_ID);
	n; n = find_next_kbnode (n, PKT_USER_ID))
	{
	PKT_user_id *uid = n->pkt->pkt.user_id;
	char *mbox = mailbox_from_userid (uid->name);
	int match = mbox ? strcasecmp (name, mbox) == 0 : 0;

	xfree (mbox);
	if (! match)
	continue;

	new->uid = scopy_user_id (uid);
	new->validity =
	get_validity (ctrl, new_keyblock, &new->key, uid, NULL, 0) & TRUST_MASK;
	new->valid = 1;

	if (! old->valid)
	return -1; /* No OLD key. */

	if (! uid_is_ok (&old->key, old->uid) && uid_is_ok (&new->key, uid))
	return -1; /* Validity of the NEW key is better. */

	if (old->validity < new->validity)
	return -1; /* Validity of the NEW key is better. */

	if (old->validity == new->validity && uid_is_ok (&new->key, uid)
	&& old->creation_time < new->creation_time)
	return -1; /* Both keys are of the same validity, but the
	NEW key is newer. */
	}

	/* Stick with the OLD key. */
	return 1;
	}


	/* This function works like get_pubkey_byname, but if the name
	* resembles a mail address, the results are ranked and only the best
	* result is returned. */
	gpg_error_t
	get_best_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char name, KBNODE ret_keyblock,
	int include_unusable)
	{
	gpg_error_t err;
	struct getkey_ctx_s *ctx = NULL;
	int is_mbox;
	int wkd_tried = 0;

	if (retctx)
	*retctx = NULL;

	is_mbox = is_valid_mailbox (name);
	if (!is_mbox && *name == '<' && name[1] && name[strlen(name)-1]=='>'
	&& name[1] != '>'
	&& is_valid_mailbox_mem (name+1, strlen (name)-2))
	{
	/* The mailbox is in the form "<foo@example.org>" which is not
	* detected by is_valid_mailbox. Set the flag but keep name as
	* it is because get_pubkey_byname does an is_valid_mailbox_mem
	* itself. */
	is_mbox = 1;
	}

	start_over:
	if (ctx) /* Clear in case of a start over. */
	{
	if (ret_keyblock)
	{
	release_kbnode (*ret_keyblock);
	*ret_keyblock = NULL;
	}
	getkey_end (ctrl, ctx);
	ctx = NULL;
	}
	err = get_pubkey_byname (ctrl, mode,
	&ctx, pk, name, ret_keyblock,
	NULL, include_unusable);
	if (err)
	{
	goto leave;
	}

	/* If the keyblock was retrieved from the local database and the key
	* has expired, do further checks. However, we can do this only if
	* the caller requested a keyblock. */
	if (is_mbox && ctx && ctx->found_via_akl == AKL_LOCAL && ret_keyblock)
	{
	u32 now = make_timestamp ();
	PKT_public_key pk2 = (ret_keyblock)->pkt->pkt.public_key;
	int found;

	/* If the key has expired and its origin was the WKD then try to
	* get a fresh key from the WKD. We also try this if the key
	* has any only expired encryption subkeys. In case we checked
	* for a fresh copy in the last 3 hours we won't do that again.
	* Unfortunately that does not yet work because KEYUPDATE is
	* only updated during import iff the key has actually changed
	* (see import.c:import_one). */
	if (!wkd_tried && pk2->keyorg == KEYORG_WKD
	&& (pk2->keyupdate + 3*3600) < now
	&& (pk2->has_expired \|\| only_expired_enc_subkeys (*ret_keyblock)))
	{
	if (opt.verbose)
	log_info (_("checking for a fresh copy of an expired key via %s\n"),
	"WKD");
	wkd_tried = 1;
	glo_ctrl.in_auto_key_retrieve++;
	found = !keyserver_import_wkd (ctrl, name, 0, NULL, NULL);
	glo_ctrl.in_auto_key_retrieve--;
	if (found)
	goto start_over;
	}
	}

	if (is_mbox && ctx)
	{
	/* Rank results and return only the most relevant key. */
	struct pubkey_cmp_cookie best = { 0 };
	struct pubkey_cmp_cookie new = { 0 };
	kbnode_t new_keyblock;

	while (getkey_next (ctrl, ctx, &new.key, &new_keyblock) == 0)
	{
	int diff = pubkey_cmp (ctrl, name, &best, &new, new_keyblock);
	release_kbnode (new_keyblock);
	if (diff < 0)
	{
	/* New key is better. */
	release_public_key_parts (&best.key);
	free_user_id (best.uid);
	best = new;
	}
	else if (diff > 0)
	{
	/* Old key is better. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	else
	{
	/* A tie. Keep the old key. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	new.uid = NULL;
	}
	getkey_end (ctrl, ctx);
	ctx = NULL;
	free_user_id (best.uid);
	best.uid = NULL;

	if (best.valid)
	{
	if (retctx \|\| ret_keyblock)
	{
	ctx = xtrycalloc (1, sizeof **retctx);
	if (! ctx)
	err = gpg_error_from_syserror ();
	else
	{
	ctx->kr_handle = keydb_new ();
	if (! ctx->kr_handle)
	{
	err = gpg_error_from_syserror ();
	xfree (ctx);
	ctx = NULL;
	if (retctx)
	*retctx = NULL;
	}
	else
	{
	u32 *keyid = pk_keyid (&best.key);
	ctx->exact = 1;
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx->items[0].u.kid[0] = keyid[0];
	ctx->items[0].u.kid[1] = keyid[1];

	if (ret_keyblock)
	{
	release_kbnode (*ret_keyblock);
	*ret_keyblock = NULL;
	err = getkey_next (ctrl, ctx, NULL, ret_keyblock);
	}
	}
	}
	}

	if (pk)
	{
	release_public_key_parts (pk);
	*pk = best.key;
	}
	else
	release_public_key_parts (&best.key);
	}
	}

	if (err && ctx)
	{
	getkey_end (ctrl, ctx);
	ctx = NULL;
	}

	if (retctx && ctx)
	{
	*retctx = ctx;
	ctx = NULL;
	}

	leave:
	getkey_end (ctrl, ctx);
	return err;
	}



	/* Get a public key from a file.
	*
	* PK is the buffer to store the key. The caller needs to make sure
	* that PK->REQ_USAGE is valid. PK->REQ_USAGE is passed through to
	* the lookup function and is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this is non-zero, only
	* keys with the specified usage will be returned.
	*
	* FNAME is the file name. That file should contain exactly one
	* keyblock.
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY is returned if the key
	- * is not found.
	+ * is not found. If R_KEYBLOCK is not NULL and a key was found the
	+ * keyblock is stored there; otherwiese NULL is stored there.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. The caller must release the content of PK by
	* calling release_public_key_parts (or, if PK was malloced, using
	* free_public_key).
	*/
	gpg_error_t
	-get_pubkey_fromfile (ctrl_t ctrl, PKT_public_key pk, const char fname)
	+get_pubkey_fromfile (ctrl_t ctrl, PKT_public_key pk, const char fname,
	+ kbnode_t *r_keyblock)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	kbnode_t found_key;
	unsigned int infoflags;

	+ if (r_keyblock)
	+ *r_keyblock = NULL;
	+
	err = read_key_from_file_or_buffer (ctrl, fname, NULL, 0, &keyblock);
	if (!err)
	{
	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. FIXME: Check whether this still holds. */
	merge_selfsigs (ctrl, keyblock);
	found_key = finish_lookup (keyblock, pk->req_usage, 0, 0, &infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	pk_from_block (pk, keyblock, found_key);
	else
	err = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
	}

	- release_kbnode (keyblock);
	+ if (!err && r_keyblock)
	+ *r_keyblock = keyblock;
	+ else
	+ release_kbnode (keyblock);
	return err;
	}


	/* Return a public key from the buffer (BUFFER, BUFLEN). The key is
	* onlyretruned if it matches the keyid given in WANT_KEYID. On
	* success the key is stored at the caller provided PKBUF structure.
	* The caller must release the content of PK by calling
	* release_public_key_parts (or, if PKBUF was malloced, using
	* free_public_key). If R_KEYBLOCK is not NULL the full keyblock is
	* also stored there. */
	gpg_error_t
	get_pubkey_from_buffer (ctrl_t ctrl, PKT_public_key *pkbuf,
	const void buffer, size_t buflen, u32 want_keyid,
	kbnode_t *r_keyblock)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	kbnode_t node;
	PKT_public_key *pk;

	if (r_keyblock)
	*r_keyblock = NULL;

	err = read_key_from_file_or_buffer (ctrl, NULL, buffer, buflen, &keyblock);
	if (!err)
	{
	merge_selfsigs (ctrl, keyblock);
	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, NULL);
	if (pk->keyid[0] == want_keyid[0]
	&& pk->keyid[1] == want_keyid[1])
	break;
	}
	}
	if (node)
	copy_public_key (pkbuf, pk);
	else
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	}

	if (!err && r_keyblock)
	*r_keyblock = keyblock;
	else
	release_kbnode (keyblock);
	return err;
	}


	/* Lookup a key with the specified fingerprint.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: this function does an exact search and thus the
	* returned public key may be a subkey rather than the primary key.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	- * release_public_key_parts (or, if PK was allocated using xfree, you
	+ * release_public_key_parts (or, if PK was allocated using xmalloc, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If PK->REQ_USAGE is set, it is used to filter the search results.
	- * (Thus, if PK is not NULL, PK->REQ_USAGE must be valid!!!) See the
	+ * Thus, if PK is not NULL, PK->REQ_USAGE must be valid! See the
	* documentation for finish_lookup to understand exactly how this is
	* used.
	*
	* If R_KEYBLOCK is not NULL, then the first result's keyblock is
	* returned in *R_KEYBLOCK. This should be freed using
	* release_kbnode().
	*
	* FPRINT is a byte array whose contents is the fingerprint to use as
	* the search term. FPRINT_LEN specifies the length of the
	* fingerprint (in bytes). Currently, only 16 and 20-byte
	* fingerprints are supported.
	*
	* FIXME: We should replace this with the _byname function. This can
	* be done by creating a userID conforming to the unified fingerprint
	* style. */
	int
	get_pubkey_byfprint (ctrl_t ctrl, PKT_public_key pk, kbnode_t r_keyblock,
	const byte * fprint, size_t fprint_len)
	{
	int rc;

	if (r_keyblock)
	*r_keyblock = NULL;

	if (fprint_len == 20 \|\| fprint_len == 16)
	{
	struct getkey_ctx_s ctx;
	KBNODE kb = NULL;
	KBNODE found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1;
	ctx.not_allocated = 1;
	/* FIXME: We should get the handle from the cache like we do in
	* get_pubkey. */
	ctx.kr_handle = keydb_new ();
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();

	ctx.nitems = 1;
	ctx.items[0].mode = fprint_len == 16 ? KEYDB_SEARCH_MODE_FPR16
	: KEYDB_SEARCH_MODE_FPR20;
	memcpy (ctx.items[0].u.fpr, fprint, fprint_len);
	if (pk)
	ctx.req_usage = pk->req_usage;
	rc = lookup (ctrl, &ctx, 0, &kb, &found_key);
	if (!rc && pk)
	pk_from_block (pk, kb, found_key);
	if (!rc && r_keyblock)
	{
	*r_keyblock = kb;
	kb = NULL;
	}
	release_kbnode (kb);
	getkey_end (ctrl, &ctx);
	}
	else
	rc = GPG_ERR_GENERAL; /* Oops */
	return rc;
	}


	/* This function is similar to get_pubkey_byfprint, but it doesn't
	* merge the self-signed data into the public key and subkeys or into
	* the user ids. It also doesn't add the key to the user id cache.
	* Further, this function ignores PK->REQ_USAGE.
	*
	* This function is intended to avoid recursion and, as such, should
	* only be used in very specific situations.
	*
	* Like get_pubkey_byfprint, PK may be NULL. In that case, this
	* function effectively just checks for the existence of the key. */
	gpg_error_t
	get_pubkey_byfprint_fast (PKT_public_key * pk,
	const byte * fprint, size_t fprint_len)
	{
	gpg_error_t err;
	KBNODE keyblock;

	err = get_keyblock_byfprint_fast (&keyblock, NULL, fprint, fprint_len, 0);
	if (!err)
	{
	if (pk)
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	release_kbnode (keyblock);
	}

	return err;
	}


	/* This function is similar to get_pubkey_byfprint_fast but returns a
	* keydb handle at R_HD and the keyblock at R_KEYBLOCK. R_KEYBLOCK or
	* R_HD may be NULL. If LOCK is set the handle has been opend in
	* locked mode and keydb_disable_caching () has been called. On error
	* R_KEYBLOCK is set to NULL but R_HD must be released by the caller;
	* it may have a value of NULL, though. This allows to do an insert
	* operation on a locked keydb handle. */
	gpg_error_t
	get_keyblock_byfprint_fast (kbnode_t r_keyblock, KEYDB_HANDLE r_hd,
	const byte *fprint, size_t fprint_len, int lock)
	{
	gpg_error_t err;
	KEYDB_HANDLE hd;
	kbnode_t keyblock;
	byte fprbuf[MAX_FINGERPRINT_LEN];
	int i;

	if (r_keyblock)
	*r_keyblock = NULL;
	if (r_hd)
	*r_hd = NULL;

	for (i = 0; i < MAX_FINGERPRINT_LEN && i < fprint_len; i++)
	fprbuf[i] = fprint[i];
	while (i < MAX_FINGERPRINT_LEN)
	fprbuf[i++] = 0;

	hd = keydb_new ();
	if (!hd)
	return gpg_error_from_syserror ();

	if (lock)
	{
	err = keydb_lock (hd);
	if (err)
	{
	/* If locking did not work, we better don't return a handle
	* at all - there was a reason that locking has been
	* requested. */
	keydb_release (hd);
	return err;
	}
	keydb_disable_caching (hd);
	}

	/* Fo all other errors we return the handle. */
	if (r_hd)
	*r_hd = hd;

	err = keydb_search_fpr (hd, fprbuf);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{
	if (!r_hd)
	keydb_release (hd);
	return gpg_error (GPG_ERR_NO_PUBKEY);
	}
	err = keydb_get_keyblock (hd, &keyblock);
	if (err)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (err));
	if (!r_hd)
	keydb_release (hd);
	return gpg_error (GPG_ERR_NO_PUBKEY);
	}

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	if (r_keyblock)
	*r_keyblock = keyblock;
	else
	release_kbnode (keyblock);

	if (!r_hd)
	keydb_release (hd);

	return 0;
	}


	const char *
	parse_def_secret_key (ctrl_t ctrl)
	{
	KEYDB_HANDLE hd = NULL;
	strlist_t t;
	static int warned;

	for (t = opt.def_secret_key; t; t = t->next)
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;
	KBNODE kb;
	KBNODE node;

	err = classify_user_id (t->d, &desc, 1);
	if (err)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	t->d, gpg_strerror (err));
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"), "--default-key");
	continue;
	}

	if (! hd)
	{
	hd = keydb_new ();
	if (!hd)
	return NULL;
	}
	else
	keydb_search_reset (hd);


	err = keydb_search (hd, &desc, 1, NULL);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	continue;

	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), t->d, gpg_strerror (err));
	t = NULL;
	break;
	}

	err = keydb_get_keyblock (hd, &kb);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"),
	gpg_strerror (err));
	continue;
	}

	merge_selfsigs (ctrl, kb);

	err = gpg_error (GPG_ERR_NO_SECKEY);
	node = kb;
	do
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	/* Check if the key is valid. */
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "revoked");
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "expired");
	continue;
	}
	if (pk_is_disabled (pk))
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "disabled");
	continue;
	}

	err = agent_probe_secret_key (ctrl, pk);
	if (! err)
	/* This is a valid key. */
	break;
	}
	while ((node = find_next_kbnode (node, PKT_PUBLIC_SUBKEY)));

	release_kbnode (kb);
	if (err)
	{
	if (! warned && ! opt.quiet)
	{
	log_info (_("Warning: not using '%s' as default key: %s\n"),
	t->d, gpg_strerror (GPG_ERR_NO_SECKEY));
	print_reported_error (err, GPG_ERR_NO_SECKEY);
	}
	}
	else
	{
	if (! warned && ! opt.quiet)
	log_info (_("using \"%s\" as default secret key for signing\n"),
	t->d);
	break;
	}
	}

	if (! warned && opt.def_secret_key && ! t)
	log_info (_("all values passed to '%s' ignored\n"),
	"--default-key");

	warned = 1;

	if (hd)
	keydb_release (hd);

	if (t)
	return t->d;
	return NULL;
	}


	/* Look up a secret key.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If --default-key was set, then the specified key is looked up. (In
	* this case, the default key is returned even if it is considered
	* unusable. See the documentation for skip_unusable for exactly what
	* this means.)
	*
	* Otherwise, this initiates a DB scan that returns all keys that are
	* usable (see previous paragraph for exactly what usable means) and
	* for which a secret key is available.
	*
	* This function returns the first match. Additional results can be
	* returned using getkey_next. */
	gpg_error_t
	get_seckey_default (ctrl_t ctrl, PKT_public_key *pk)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int include_unusable = 1;


	const char *def_secret_key = parse_def_secret_key (ctrl);
	if (def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else
	include_unusable = 0;

	err = key_byname (ctrl, NULL, namelist, pk, 1, include_unusable, NULL, NULL);

	free_strlist (namelist);

	return err;
	}



	/* Search for keys matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAMES is not NULL, then a search query is constructed using
	* classify_user_id on each of the strings in the list. (Recall: the
	* database does an OR of the terms, not an AND.) If NAMES is
	* NULL, then all results are returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	gpg_error_t
	getkey_bynames (ctrl_t ctrl, getkey_ctx_t retctx, PKT_public_key pk,
	strlist_t names, int want_secret, kbnode_t *ret_keyblock)
	{
	return key_byname (ctrl, retctx, names, pk, want_secret, 1,
	ret_keyblock, NULL);
	}


	/* Search for one key matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAME is not NULL, then a search query is constructed using
	* classify_user_id on the string. In this case, even unusable keys
	* (see the documentation for skip_unusable for an exact definition of
	* unusable) are returned. Otherwise, if --default-key was set, then
	* that key is returned (even if it is unusable). If neither of these
	* conditions holds, then the first usable key is returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found.
	*
	* FIXME: We also have the get_pubkey_byname function which has a
	* different semantic. Should be merged with this one. */
	gpg_error_t
	getkey_byname (ctrl_t ctrl, getkey_ctx_t retctx, PKT_public_key pk,
	const char name, int want_secret, kbnode_t ret_keyblock)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int with_unusable = 1;
	const char *def_secret_key = NULL;

	if (want_secret && !name)
	def_secret_key = parse_def_secret_key (ctrl);

	if (want_secret && !name && def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else if (name)
	add_to_strlist (&namelist, name);
	else
	with_unusable = 0;

	err = key_byname (ctrl, retctx, namelist, pk, want_secret, with_unusable,
	ret_keyblock, NULL);

	/* FIXME: Check that we really return GPG_ERR_NO_SECKEY if
	WANT_SECRET has been used. */

	free_strlist (namelist);

	return err;
	}


	/* Return the next search result.
	*
	* If PK is not NULL, the public key of the next result is returned in
	* *PK. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xmalloc, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* RET_KEYBLOCK can be given as NULL; if it is not NULL it the entire
	* found keyblock is returned which must be released with
	* release_kbnode. If the function returns an error NULL is stored at
	* RET_KEYBLOCK.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	getkey_next (ctrl_t ctrl, getkey_ctx_t ctx,
	PKT_public_key pk, kbnode_t ret_keyblock)
	{
	int rc; /* Fixme: Make sure this is proper gpg_error */
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;

	/* We need to disable the caching so that for an exact key search we
	won't get the result back from the cache and thus end up in an
	endless loop. The endless loop can occur, because the cache is
	used without respecting the current file pointer! */
	keydb_disable_caching (ctx->kr_handle);

	/* FOUND_KEY is only valid as long as RET_KEYBLOCK is. If the
	* caller wants PK, but not RET_KEYBLOCK, we need hand in our own
	* keyblock. */
	if (pk && ret_keyblock == NULL)
	ret_keyblock = &keyblock;

	rc = lookup (ctrl, ctx, ctx->want_secret,
	ret_keyblock, pk ? &found_key : NULL);
	if (!rc && pk)
	{
	log_assert (found_key);
	pk_from_block (pk, NULL, found_key);
	release_kbnode (keyblock);
	}

	return rc;
	}


	/* Release any resources used by a key listing context. This must be
	* called on the context returned by, e.g., getkey_byname. */
	void
	getkey_end (ctrl_t ctrl, getkey_ctx_t ctx)
	{
	if (ctx)
	{
	#ifdef HAVE_W32_SYSTEM

	/* FIXME: This creates a big regression for Windows because the
	* keyring is only released after the global ctrl is released.
	* So if an operation does a getkey and then tries to modify the
	* keyring it will fail on Windows with a sharing violation. We
	* need to modify all keyring write operations to also take the
	* ctrl and close the cached_getkey_kdb handle to make writing
	* work. See: GnuPG-bug-id: 3097 */
	(void)ctrl;
	keydb_release (ctx->kr_handle);

	#else /!HAVE_W32_SYSTEM/

	if (ctrl && !ctrl->cached_getkey_kdb)
	ctrl->cached_getkey_kdb = ctx->kr_handle;
	else
	keydb_release (ctx->kr_handle);

	#endif /!HAVE_W32_SYSTEM/

	free_strlist (ctx->extra_list);
	if (!ctx->not_allocated)
	xfree (ctx);
	}
	}



	/************************************************
	*********** Merging stuff ******************
	************************************************/

	/* Set the mainkey_id fields for all keys in KEYBLOCK. This is
	* usually done by merge_selfsigs but at some places we only need the
	* main_kid not a full merge. The function also guarantees that all
	* pk->keyids are computed. */
	void
	setup_main_keyids (kbnode_t keyblock)
	{
	u32 kid[2], mainkid[2];
	kbnode_t kbctx, node;
	PKT_public_key *pk;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	BUG ();
	pk = keyblock->pkt->pkt.public_key;

	keyid_from_pk (pk, mainkid);
	for (kbctx=NULL; (node = walk_kbnode (keyblock, &kbctx, 0)); )
	{
	if (!(node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY))
	continue;
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, kid); /* Make sure pk->keyid is set. */
	if (!pk->main_keyid[0] && !pk->main_keyid[1])
	{
	pk->main_keyid[0] = mainkid[0];
	pk->main_keyid[1] = mainkid[1];
	}
	}
	}


	/* KEYBLOCK corresponds to a public key block. This function merges
	* much of the information from the self-signed data into the public
	* key, public subkey and user id data structures. If you use the
	* high-level search API (e.g., get_pubkey) for looking up key blocks,
	* then you don't need to call this function. This function is
	* useful, however, if you change the keyblock, e.g., by adding or
	* removing a self-signed data packet. */
	void
	merge_keys_and_selfsig (ctrl_t ctrl, kbnode_t keyblock)
	{
	if (!keyblock)
	;
	else if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	merge_selfsigs (ctrl, keyblock);
	else
	log_debug ("FIXME: merging secret key blocks is not anymore available\n");
	}


	-static int
	+/* This function parses the key flags and returns PUBKEY_USAGE_ flags. */
	+unsigned int
	parse_key_usage (PKT_signature * sig)
	{
	int key_usage = 0;
	const byte *p;
	size_t n;
	byte flags;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_FLAGS, &n);
	if (p && n)
	{
	/* First octet of the keyflags. */
	flags = *p;

	if (flags & 1)
	{
	key_usage \|= PUBKEY_USAGE_CERT;
	flags &= ~1;
	}

	if (flags & 2)
	{
	key_usage \|= PUBKEY_USAGE_SIG;
	flags &= ~2;
	}

	/* We do not distinguish between encrypting communications and
	encrypting storage. */
	if (flags & (0x04 \| 0x08))
	{
	key_usage \|= PUBKEY_USAGE_ENC;
	flags &= ~(0x04 \| 0x08);
	}

	if (flags & 0x20)
	{
	key_usage \|= PUBKEY_USAGE_AUTH;
	flags &= ~0x20;
	}

	if ((flags & 0x80))
	{
	key_usage \|= PUBKEY_USAGE_GROUP;
	flags &= ~0x80;
	}

	if (flags)
	key_usage \|= PUBKEY_USAGE_UNKNOWN;

	n--;
	p++;
	if (n)
	{
	flags = *p;
	if ((flags & 0x04))
	key_usage \|= PUBKEY_USAGE_RENC;
	if ((flags & 0x08))
	key_usage \|= PUBKEY_USAGE_TIME;
	}

	if (!key_usage)
	key_usage \|= PUBKEY_USAGE_NONE;

	}
	else if (p) /* Key flags of length zero. */
	key_usage \|= PUBKEY_USAGE_NONE;

	/* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
	capability that we do not handle. This serves to distinguish
	between a zero key usage which we handle as the default
	capabilities for that algorithm, and a usage that we do not
	handle. Likewise we use PUBKEY_USAGE_NONE to indicate that
	key_flags have been given but they do not specify any usage. */

	return key_usage;
	}


	/* Apply information from SIGNODE (which is the valid self-signature
	* associated with that UID) to the UIDNODE:
	* - wether the UID has been revoked
	* - assumed creation date of the UID
	* - temporary store the keyflags here
	* - temporary store the key expiration time here
	* - mark whether the primary user ID flag hat been set.
	* - store the preferences
	*/
	static void
	fixup_uidnode (KBNODE uidnode, KBNODE signode, u32 keycreated)
	{
	PKT_user_id *uid = uidnode->pkt->pkt.user_id;
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte p, sym, aead, hash, *zip;
	size_t n, nsym, naead, nhash, nzip;

	sig->flags.chosen_selfsig = 1;/* We chose this one. */
	uid->created = 0; /* Not created == invalid. */
	if (IS_UID_REV (sig))
	{
	uid->flags.revoked = 1;
	return; /* Has been revoked. */
	}
	else
	uid->flags.revoked = 0;

	uid->expiredate = sig->expiredate;

	if (sig->flags.expired)
	{
	uid->flags.expired = 1;
	return; /* Has expired. */
	}
	else
	uid->flags.expired = 0;

	uid->created = sig->timestamp; /* This one is okay. */
	uid->selfsigversion = sig->version;
	/* If we got this far, it's not expired :) */
	uid->flags.expired = 0;

	/* Store the key flags in the helper variable for later processing. */
	uid->help_key_usage = parse_key_usage (sig);

	/* Ditto for the key expiration. */
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	uid->help_key_expire = keycreated + buf32_to_u32 (p);
	else
	uid->help_key_expire = 0;

	/* Set the primary user ID flag - we will later wipe out some
	* of them to only have one in our keyblock. */
	uid->flags.primary = 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID, NULL);
	if (p && *p)
	uid->flags.primary = 2;

	/* We could also query this from the unhashed area if it is not in
	* the hased area and then later try to decide which is the better
	* there should be no security problem with this.
	* For now we only look at the hashed one. */

	/* Now build the preferences list. These must come from the
	hashed section so nobody can modify the ciphers a key is
	willing to accept. */
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_SYM, &n);
	sym = p;
	nsym = p ? n : 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_AEAD, &n);
	aead = p;
	naead = p ? n : 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_HASH, &n);
	hash = p;
	nhash = p ? n : 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_COMPR, &n);
	zip = p;
	nzip = p ? n : 0;
	if (uid->prefs)
	xfree (uid->prefs);
	n = nsym + naead + nhash + nzip;
	if (!n)
	uid->prefs = NULL;
	else
	{
	uid->prefs = xmalloc (sizeof (uid->prefs) (n + 1));
	n = 0;
	for (; nsym; nsym--, n++)
	{
	uid->prefs[n].type = PREFTYPE_SYM;
	uid->prefs[n].value = *sym++;
	}
	for (; naead; naead--, n++)
	{
	uid->prefs[n].type = PREFTYPE_AEAD;
	uid->prefs[n].value = *aead++;
	}
	for (; nhash; nhash--, n++)
	{
	uid->prefs[n].type = PREFTYPE_HASH;
	uid->prefs[n].value = *hash++;
	}
	for (; nzip; nzip--, n++)
	{
	uid->prefs[n].type = PREFTYPE_ZIP;
	uid->prefs[n].value = *zip++;
	}
	uid->prefs[n].type = PREFTYPE_NONE; /* End of list marker */
	uid->prefs[n].value = 0;
	}

	/* See whether we have the MDC feature. */
	uid->flags.mdc = 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_FEATURES, &n);
	if (p && n && (p[0] & 0x01))
	uid->flags.mdc = 1;

	/* See whether we have the AEAD feature. */
	uid->flags.aead = 0;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_FEATURES, &n);
	if (p && n && (p[0] & 0x02))
	uid->flags.aead = 1;

	/* And the keyserver modify flag. */
	uid->flags.ks_modify = 1;
	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KS_FLAGS, &n);
	if (p && n && (p[0] & 0x80))
	uid->flags.ks_modify = 0;
	}

	static void
	sig_to_revoke_info (PKT_signature * sig, struct revoke_info *rinfo)
	{
	rinfo->date = sig->timestamp;
	rinfo->algo = sig->pubkey_algo;
	rinfo->keyid[0] = sig->keyid[0];
	rinfo->keyid[1] = sig->keyid[1];
	}


	/* Given a keyblock, parse the key block and extract various pieces of
	* information and save them with the primary key packet and the user
	* id packets. For instance, some information is stored in signature
	* packets. We find the latest such valid packet (since the user can
	* change that information) and copy its contents into the
	* PKT_public_key.
	*
	* Note that R_REVOKED may be set to 0, 1 or 2.
	*
	* This function fills in the following fields in the primary key's
	* keyblock:
	*
	* main_keyid (computed)
	* revkey / numrevkeys (derived from self signed key data)
	* flags.valid (whether we have at least 1 self-sig)
	* flags.maybe_revoked (whether a designed revoked the key, but
	* we are missing the key to check the sig)
	* selfsigversion (highest version of any valid self-sig)
	* pubkey_usage (derived from most recent self-sig or most
	* recent user id)
	* has_expired (various sources)
	* expiredate (various sources)
	*
	* See the documentation for fixup_uidnode for how the user id packets
	* are modified. In addition to that the primary user id's is_primary
	* field is set to 1 and the other user id's is_primary are set to 0.
	*/
	static void
	merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
	struct revoke_info *rinfo)
	{
	PKT_public_key *pk = NULL;
	KBNODE k;
	u32 kid[2];
	u32 sigdate, uiddate, uiddate2;
	KBNODE signode, uidnode, uidnode2;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0; /* Creation time of the key. */
	u32 key_expire = 0;
	int key_expire_seen = 0;
	byte sigversion = 0;

	*r_revoked = 0;
	memset (rinfo, 0, sizeof (*rinfo));

	/* Section 11.1 of RFC 4880 determines the order of packets within a
	* message. There are three sections, which must occur in the
	* following order: the public key, the user ids and user attributes
	* and the subkeys. Within each section, each primary packet (e.g.,
	* a user id packet) is followed by one or more signature packets,
	* which modify that packet. */

	/* According to Section 11.1 of RFC 4880, the public key must be the
	first packet. Note that parse_keyblock_image ensures that the
	first packet is the public key. */
	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	BUG ();
	pk = keyblock->pkt->pkt.public_key;
	keytimestamp = pk->timestamp;

	keyid_from_pk (pk, kid);
	pk->main_keyid[0] = kid[0];
	pk->main_keyid[1] = kid[1];

	if (pk->version < 4)
	{
	/* Before v4 the key packet itself contains the expiration date
	* and there was no way to change it, so we start with the one
	* from the key packet. We do not support v3 keys anymore but
	* we keep the code in case a future key versions introduces a
	* hard expire time again. */
	key_expire = pk->max_expiredate;
	key_expire_seen = 1;
	}

	/* First pass:
	*
	* - Find the latest direct key self-signature. We assume that the
	* newest one overrides all others.
	*
	* - Determine whether the key has been revoked.
	*
	* - Gather all revocation keys (unlike other data, we don't just
	* take them from the latest self-signed packet).
	*
	* - Determine max (sig[...]->version).
	*/

	/* Reset this in case this key was already merged. */
	xfree (pk->revkey);
	pk->revkey = NULL;
	pk->numrevkeys = 0;

	signode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature. */

	/* According to Section 11.1 of RFC 4880, the public key comes first
	* and is immediately followed by any signature packets that modify
	* it. */
	for (k = keyblock;
	k && k->pkt->pkttype != PKT_USER_ID
	&& k->pkt->pkttype != PKT_ATTRIBUTE
	&& k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	{ /* Self sig. */

	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_KEY_REV (sig))
	{
	/* Key has been revoked - there is no way to
	* override such a revocation, so we theoretically
	* can stop now. We should not cope with expiration
	* times for revocations here because we have to
	* assume that an attacker can generate all kinds of
	* signatures. However due to the fact that the key
	* has been revoked it does not harm either and by
	* continuing we gather some more info on that
	* key. */
	*r_revoked = 1;
	sig_to_revoke_info (sig, rinfo);
	}
	else if (IS_KEY_SIG (sig))
	{
	/* Add the indicated revocations keys from all
	* signatures not just the latest. We do this
	* because you need multiple 1F sigs to properly
	* handle revocation keys (PGP does it this way, and
	* a revocation key could be sensitive and hence in
	* a different signature). */
	if (sig->revkey)
	{
	int i;

	pk->revkey =
	xrealloc (pk->revkey, sizeof (struct revocation_key) *
	(pk->numrevkeys + sig->numrevkeys));

	for (i = 0; i < sig->numrevkeys; i++)
	memcpy (&pk->revkey[pk->numrevkeys++],
	&sig->revkey[i],
	sizeof (struct revocation_key));
	}

	if (sig->timestamp >= sigdate)
	{ /* This is the latest signature so far. */

	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	if (sig->version > sigversion)
	sigversion = sig->version;

	}
	}
	}
	}
	}
	}

	/* Remove dupes from the revocation keys. */
	if (pk->revkey)
	{
	int i, j, x, changed = 0;

	for (i = 0; i < pk->numrevkeys; i++)
	{
	for (j = i + 1; j < pk->numrevkeys; j++)
	{
	if (memcmp (&pk->revkey[i], &pk->revkey[j],
	sizeof (struct revocation_key)) == 0)
	{
	/* remove j */

	for (x = j; x < pk->numrevkeys - 1; x++)
	pk->revkey[x] = pk->revkey[x + 1];

	pk->numrevkeys--;
	j--;
	changed = 1;
	}
	}
	}

	if (changed)
	pk->revkey = xrealloc (pk->revkey,
	pk->numrevkeys *
	sizeof (struct revocation_key));
	}

	/* SIGNODE is the direct key signature packet (sigclass 0x1f) with
	* the latest creation time. Extract some information from it. */
	if (signode)
	{
	/* Some information from a direct key signature take precedence
	* over the same information given in UID sigs. */
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte *p;

	key_usage = parse_key_usage (sig);

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	{
	key_expire = keytimestamp + buf32_to_u32 (p);
	key_expire_seen = 1;
	}

	/* Mark that key as valid: One direct key signature should
	* render a key as valid. */
	pk->flags.valid = 1;
	}

	/* Pass 1.5: Look for key revocation signatures that were not made
	* by the key (i.e. did a revocation key issue a revocation for
	* us?). Only bother to do this if there is a revocation key in the
	* first place and we're not revoked already. */

	if (!*r_revoked && pk->revkey)
	for (k = keyblock; k && k->pkt->pkttype != PKT_USER_ID; k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (IS_KEY_REV (sig) &&
	(sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1]))
	{
	int rc = check_revocation_keys (ctrl, pk, sig);
	if (rc == 0)
	{
	*r_revoked = 2;
	sig_to_revoke_info (sig, rinfo);
	/* Don't continue checking since we can't be any
	* more revoked than this. */
	break;
	}
	else if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	pk->flags.maybe_revoked = 1;

	/* A failure here means the sig did not verify, was
	* not issued by a revocation key, or a revocation
	* key loop was broken. If a revocation key isn't
	* findable, however, the key might be revoked and
	* we don't know it. */

	/* Fixme: In the future handle subkey and cert
	* revocations? PGP doesn't, but it's in 2440. */
	}
	}
	}

	/* Second pass: Look at the self-signature of all user IDs. */

	/* According to RFC 4880 section 11.1, user id and attribute packets
	* are in the second section, after the public key packet and before
	* the subkey packets. */
	signode = uidnode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature in one UID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID \|\| k->pkt->pkttype == PKT_ATTRIBUTE)
	{ /* New user id packet. */

	/* Apply the data from the most recent self-signed packet to
	* the preceding user id packet. */
	if (uidnode && signode)
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}

	/* Clear SIGNODE. The only relevant self-signed data for
	* UIDNODE follows it. */
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else
	uidnode = NULL;

	signode = NULL;
	sigdate = 0;
	}
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	{
	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* signature did not verify */
	else if ((IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	&& sig->timestamp >= sigdate)
	{
	/* Note: we allow invalidation of cert revocations
	* by a newer signature. An attacker can't use this
	* because a key should be revoked with a key revocation.
	* The reason why we have to allow for that is that at
	* one time an email address may become invalid but later
	* the same email address may become valid again (hired,
	* fired, hired again). */

	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	if (sig->version > sigversion)
	sigversion = sig->version;
	}
	}
	}
	}
	if (uidnode && signode)
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}

	/* If the key isn't valid yet, and we have
	* --allow-non-selfsigned-uid set, then force it valid. */
	if (!pk->flags.valid && opt.allow_non_selfsigned_uid)
	{
	if (opt.verbose)
	log_info (_("Invalid key %s made valid by"
	" --allow-non-selfsigned-uid\n"), keystr_from_pk (pk));
	pk->flags.valid = 1;
	}

	/* The key STILL isn't valid, so try and find an ultimately
	* trusted signature. */
	if (!pk->flags.valid)
	{
	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1])
	{
	PKT_public_key *ultimate_pk;

	ultimate_pk = xmalloc_clear (sizeof (*ultimate_pk));

	/* We don't want to use the full get_pubkey to avoid
	* infinite recursion in certain cases. There is no
	* reason to check that an ultimately trusted key is
	* still valid - if it has been revoked the user
	* should also remove the ultimate trust flag. */
	if (get_pubkey_fast (ultimate_pk, sig->keyid) == 0
	&& check_key_signature2 (ctrl,
	keyblock, k, ultimate_pk,
	NULL, NULL, NULL, NULL) == 0
	&& get_ownertrust (ctrl, ultimate_pk) == TRUST_ULTIMATE)
	{
	free_public_key (ultimate_pk);
	pk->flags.valid = 1;
	break;
	}

	free_public_key (ultimate_pk);
	}
	}
	}
	}

	/* Record the highest selfsig version so we know if this is a v3 key
	* through and through, or a v3 key with a v4 selfsig somewhere.
	* This is useful in a few places to know if the key must be treated
	* as PGP2-style or OpenPGP-style. Note that a selfsig revocation
	* with a higher version number will also raise this value. This is
	* okay since such a revocation must be issued by the user (i.e. it
	* cannot be issued by someone else to modify the key behavior.) */

	pk->selfsigversion = sigversion;

	/* Now that we had a look at all user IDs we can now get some
	* information from those user IDs. */

	if (!key_usage)
	{
	/* Find the latest user ID with key flags set. */
	uiddate = 0; /* Helper to find the latest user ID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;

	if (uid->help_key_usage
	&& (uid->created > uiddate \|\| (!uid->created && !uiddate)))
	{
	key_usage = uid->help_key_usage;
	uiddate = uid->created;
	}
	}
	}
	}

	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (pk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (pk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	/* Whatever happens, it's a primary key, so it can certify. */
	pk->pubkey_usage = key_usage \| PUBKEY_USAGE_CERT;

	if (!key_expire_seen)
	{
	/* Find the latest valid user ID with a key expiration set.
	* This may be a different one than from usage computation above
	* because some user IDs may have no expiration date set. */
	uiddate = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->help_key_expire
	&& (uid->created > uiddate \|\| (!uid->created && !uiddate)))
	{
	key_expire = uid->help_key_expire;
	uiddate = uid->created;
	}
	}
	}
	}

	/* Currently only the not anymore supported v3 keys have a maximum
	* expiration date, but future key versions may get this feature again. */
	if (key_expire == 0
	\|\| (pk->max_expiredate && key_expire > pk->max_expiredate))
	key_expire = pk->max_expiredate;

	pk->has_expired = key_expire >= curtime ? 0 : key_expire;
	pk->expiredate = key_expire;

	/* Fixme: we should see how to get rid of the expiretime fields but
	* this needs changes at other places too. */

	/* And now find the real primary user ID and delete all others. */
	uiddate = uiddate2 = 0;
	uidnode = uidnode2 = NULL;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID && !k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->flags.primary)
	{
	if (uid->created > uiddate)
	{
	uiddate = uid->created;
	uidnode = k;
	}
	else if (uid->created == uiddate && uidnode)
	{
	/* The dates are equal, so we need to do a different
	* (and arbitrary) comparison. This should rarely,
	* if ever, happen. It's good to try and guarantee
	* that two different GnuPG users with two different
	* keyrings at least pick the same primary. */
	if (cmp_user_ids (uid, uidnode->pkt->pkt.user_id) > 0)
	uidnode = k;
	}
	}
	else
	{
	if (uid->created > uiddate2)
	{
	uiddate2 = uid->created;
	uidnode2 = k;
	}
	else if (uid->created == uiddate2 && uidnode2)
	{
	if (cmp_user_ids (uid, uidnode2->pkt->pkt.user_id) > 0)
	uidnode2 = k;
	}
	}
	}
	}
	if (uidnode)
	{
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID &&
	!k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (k != uidnode)
	uid->flags.primary = 0;
	}
	}
	}
	else if (uidnode2)
	{
	/* None is flagged primary - use the latest user ID we have,
	* and disambiguate with the arbitrary packet comparison. */
	uidnode2->pkt->pkt.user_id->flags.primary = 1;
	}
	else
	{
	/* None of our uids were self-signed, so pick the one that
	* sorts first to be the primary. This is the best we can do
	* here since there are no self sigs to date the uids. */

	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data)
	{
	if (!uidnode)
	{
	uidnode = k;
	uidnode->pkt->pkt.user_id->flags.primary = 1;
	continue;
	}
	else
	{
	if (cmp_user_ids (k->pkt->pkt.user_id,
	uidnode->pkt->pkt.user_id) > 0)
	{
	uidnode->pkt->pkt.user_id->flags.primary = 0;
	uidnode = k;
	uidnode->pkt->pkt.user_id->flags.primary = 1;
	}
	else
	{
	/* just to be safe: */
	k->pkt->pkt.user_id->flags.primary = 0;
	}
	}
	}
	}
	}
	}


	/* Convert a buffer to a signature. Useful for 0x19 embedded sigs.
	* Caller must free the signature when they are done. */
	static PKT_signature *
	buf_to_sig (const byte * buf, size_t len)
	{
	PKT_signature *sig = xmalloc_clear (sizeof (PKT_signature));
	IOBUF iobuf = iobuf_temp_with_content (buf, len);
	int save_mode = set_packet_list_mode (0);

	if (parse_signature (iobuf, PKT_SIGNATURE, len, sig) != 0)
	{
	free_seckey_enc (sig);
	sig = NULL;
	}

	set_packet_list_mode (save_mode);
	iobuf_close (iobuf);

	return sig;
	}


	/* Use the self-signed data to fill in various fields in subkeys.
	*
	* KEYBLOCK is the whole keyblock. SUBNODE is the subkey to fill in.
	*
	* Sets the following fields on the subkey:
	*
	* main_keyid
	* flags.valid if the subkey has a valid self-sig binding
	* flags.revoked
	* flags.backsig
	* pubkey_usage
	* has_expired
	* expired_date
	*
	* On this subkey's most revent valid self-signed packet, the
	* following field is set:
	*
	* flags.chosen_selfsig
	*/
	static void
	merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
	{
	PKT_public_key mainpk = NULL, subpk = NULL;
	PKT_signature *sig;
	KBNODE k;
	u32 mainkid[2];
	u32 sigdate = 0;
	KBNODE signode;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0;
	u32 key_expire = 0;
	const byte *p;

	if (subnode->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	BUG ();
	mainpk = keyblock->pkt->pkt.public_key;
	if (mainpk->version < 4)
	return;/* (actually this should never happen) */
	keyid_from_pk (mainpk, mainkid);
	subpk = subnode->pkt->pkt.public_key;
	keytimestamp = subpk->timestamp;

	subpk->flags.valid = 0;
	subpk->flags.exact = 0;
	subpk->main_keyid[0] = mainpk->main_keyid[0];
	subpk->main_keyid[1] = mainpk->main_keyid[1];

	/* Find the latest key binding self-signature. */
	signode = NULL;
	sigdate = 0; /* Helper to find the latest signature. */
	for (k = subnode->next; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == mainkid[0] && sig->keyid[1] == mainkid[1])
	{
	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_SUBKEY_REV (sig))
	{
	/* Note that this means that the date on a
	* revocation sig does not matter - even if the
	* binding sig is dated after the revocation sig,
	* the subkey is still marked as revoked. This
	* seems ok, as it is just as easy to make new
	* subkeys rather than re-sign old ones as the
	* problem is in the distribution. Plus, PGP (7)
	* does this the same way. */
	subpk->flags.revoked = 1;
	sig_to_revoke_info (sig, &subpk->revoked);
	/* Although we could stop now, we continue to
	* figure out other information like the old expiration
	* time. */
	}
	else if (IS_SUBKEY_SIG (sig) && sig->timestamp >= sigdate)
	{
	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	}
	}
	}
	}
	}

	/* No valid key binding. */
	if (!signode)
	return;

	sig = signode->pkt->pkt.signature;
	sig->flags.chosen_selfsig = 1; /* So we know which selfsig we chose later. */

	key_usage = parse_key_usage (sig);
	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (subpk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (subpk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	subpk->pubkey_usage = key_usage;

	p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	key_expire = keytimestamp + buf32_to_u32 (p);
	else
	key_expire = 0;

	subpk->has_expired = key_expire >= curtime ? 0 : key_expire;
	subpk->expiredate = key_expire;

	/* Algo doesn't exist. */
	if (openpgp_pk_test_algo (subpk->pubkey_algo))
	return;

	subpk->flags.valid = 1;

	/* Find the most recent 0x19 embedded signature on our self-sig. */
	if (!subpk->flags.backsig)
	{
	int seq = 0;
	size_t n;
	PKT_signature *backsig = NULL;

	sigdate = 0;

	/* We do this while() since there may be other embedded
	* signatures in the future. We only want 0x19 here. */

	while ((p = enum_sig_subpkt (sig->hashed,
	SIGSUBPKT_SIGNATURE, &n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	seq = 0;

	/* It is safe to have this in the unhashed area since the 0x19
	* is located on the selfsig for convenience, not security. */

	while ((p = enum_sig_subpkt (sig->unhashed, SIGSUBPKT_SIGNATURE,
	&n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	if (backsig)
	{
	/* At this point, backsig contains the most recent 0x19 sig.
	* Let's see if it is good. */

	/* 2==valid, 1==invalid, 0==didn't check */
	if (check_backsig (mainpk, subpk, backsig) == 0)
	subpk->flags.backsig = 2;
	else
	subpk->flags.backsig = 1;

	free_seckey_enc (backsig);
	}
	}
	}


	/* Merge information from the self-signatures with the public key,
	* subkeys and user ids to make using them more easy.
	*
	* See documentation for merge_selfsigs_main, merge_selfsigs_subkey
	* and fixup_uidnode for exactly which fields are updated. */
	static void
	merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock)
	{
	KBNODE k;
	int revoked;
	struct revoke_info rinfo;
	PKT_public_key *main_pk;
	prefitem_t *prefs;
	unsigned int mdc_feature;
	unsigned int aead_feature;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	log_error ("expected public key but found secret key "
	"- must stop\n");
	/* We better exit here because a public key is expected at
	* other places too. FIXME: Figure this out earlier and
	* don't get to here at all */
	g10_exit (1);
	}
	BUG ();
	}

	merge_selfsigs_main (ctrl, keyblock, &revoked, &rinfo);

	/* Now merge in the data from each of the subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_selfsigs_subkey (ctrl, keyblock, k);
	}
	}

	main_pk = keyblock->pkt->pkt.public_key;
	if (revoked \|\| main_pk->has_expired \|\| !main_pk->flags.valid)
	{
	/* If the primary key is revoked, expired, or invalid we
	* better set the appropriate flags on that key and all
	* subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (!main_pk->flags.valid)
	pk->flags.valid = 0;
	if (revoked && !pk->flags.revoked)
	{
	pk->flags.revoked = revoked;
	memcpy (&pk->revoked, &rinfo, sizeof (rinfo));
	}
	if (main_pk->has_expired)
	pk->has_expired = main_pk->has_expired;
	}
	}
	return;
	}

	/* Set the preference list of all keys to those of the primary real
	* user ID. Note: we use these preferences when we don't know by
	* which user ID the key has been selected.
	* fixme: we should keep atoms of commonly used preferences or
	* use reference counting to optimize the preference lists storage.
	* FIXME: it might be better to use the intersection of
	* all preferences.
	* Do a similar thing for the MDC feature flag. */
	prefs = NULL;
	mdc_feature = aead_feature = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data
	&& k->pkt->pkt.user_id->flags.primary)
	{
	prefs = k->pkt->pkt.user_id->prefs;
	mdc_feature = k->pkt->pkt.user_id->flags.mdc;
	aead_feature = k->pkt->pkt.user_id->flags.aead;
	break;
	}
	}
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (pk->prefs)
	xfree (pk->prefs);
	pk->prefs = copy_prefs (prefs);
	pk->flags.mdc = mdc_feature;
	pk->flags.aead = aead_feature;
	}
	}
	}



	/* See whether the key satisfies any additional requirements specified
	* in CTX. If so, return the node of an appropriate key or subkey.
	* Otherwise, return NULL if there was no appropriate key.
	*
	* Note that we do not return a reference, i.e. the result must not be
	* freed using 'release_kbnode'.
	*
	* In case the primary key is not required, select a suitable subkey.
	* We need the primary key if PUBKEY_USAGE_CERT is set in REQ_USAGE or
	* we are in PGP6 or PGP7 mode and PUBKEY_USAGE_SIG is set in
	* REQ_USAGE.
	*
	* If any of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT
	* are set in REQ_USAGE, we filter by the key's function. Concretely,
	* if PUBKEY_USAGE_SIG and PUBKEY_USAGE_CERT are set, then we only
	* return a key if it is (at least) either a signing or a
	* certification key.
	*
	* If REQ_USAGE is set, then we reject any keys that are not good
	* (i.e., valid, not revoked, not expired, etc.). This allows the
	* getkey functions to be used for plain key listings.
	*
	* Sets the matched key's user id field (pk->user_id) to the user id
	* that matched the low-level search criteria or NULL.
	*
	* If R_FLAGS is not NULL set certain flags for more detailed error
	* reporting. Used flags are:
	*
	* - LOOKUP_ALL_SUBKEYS_EXPIRED :: All Subkeys are expired or have
	* been revoked.
	* - LOOKUP_NOT_SELECTED :: No suitable key found
	*
	* This function needs to handle several different cases:
	*
	* 1. No requested usage and no primary key requested
	* Examples for this case are that we have a keyID to be used
	* for decrytion or verification.
	* 2. No usage but primary key requested
	* This is the case for all functions which work on an
	* entire keyblock, e.g. for editing or listing
	* 3. Usage and primary key requested
	* FIXME
	* 4. Usage but no primary key requested
	* FIXME
	*
	*/
	static kbnode_t
	finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
	int want_secret, unsigned int *r_flags)
	{
	kbnode_t k;

	/* If WANT_EXACT is set, the key or subkey that actually matched the
	low-level search criteria. */
	kbnode_t foundk = NULL;
	/* The user id (if any) that matched the low-level search criteria. */
	PKT_user_id *foundu = NULL;

	u32 latest_date;
	kbnode_t latest_key;
	PKT_public_key *pk;
	int req_prim;
	u32 curtime = make_timestamp ();

	if (r_flags)
	*r_flags = 0;

	#define USAGE_MASK (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_ENC\|PUBKEY_USAGE_CERT)
	req_usage &= USAGE_MASK;

	/* Request the primary if we're certifying another key, and also if
	* signing data while --pgp6 or --pgp7 is on since pgp 6 and 7 do
	* not understand signatures made by a signing subkey. PGP 8 does. */
	req_prim = ((req_usage & PUBKEY_USAGE_CERT)
	\|\| ((PGP6 \|\| PGP7) && (req_usage & PUBKEY_USAGE_SIG)));


	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* For an exact match mark the primary or subkey that matched the
	low-level search criteria. */
	if (want_exact)
	{
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 1))
	{
	log_assert (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY);
	foundk = k;
	pk = k->pkt->pkt.public_key;
	pk->flags.exact = 1;
	break;
	}
	}
	}

	/* Get the user id that matched that low-level search criteria. */
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 2))
	{
	log_assert (k->pkt->pkttype == PKT_USER_ID);
	foundu = k->pkt->pkt.user_id;
	break;
	}
	}

	if (DBG_LOOKUP)
	log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
	(ulong) keyid_from_pk (keyblock->pkt->pkt.public_key, NULL),
	foundk ? "one" : "all", req_usage);

	if (!req_usage)
	{
	latest_key = foundk ? foundk : keyblock;
	goto found;
	}

	latest_date = 0;
	latest_key = NULL;
	/* Set LATEST_KEY to the latest (the one with the most recent
	* timestamp) good (valid, not revoked, not expired, etc.) subkey.
	*
	* Don't bother if we are only looking for a primary key or we need
	* an exact match and the exact match is not a subkey. */
	if (req_prim \|\| (foundk && foundk->pkt->pkttype != PKT_PUBLIC_SUBKEY))
	;
	else
	{
	kbnode_t nextk;
	int n_subkeys = 0;
	int n_revoked_or_expired = 0;

	/* Either start a loop or check just this one subkey. */
	for (k = foundk ? foundk : keyblock; k; k = nextk)
	{
	if (foundk)
	{
	/* If FOUNDK is not NULL, then only consider that exact
	key, i.e., don't iterate. */
	nextk = NULL;
	}
	else
	nextk = k->next;

	if (k->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk = k->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tchecking subkey %08lX\n",
	(ulong) keyid_from_pk (pk, NULL));

	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not valid\n");
	continue;
	}
	if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tusage does not match: want=%x have=%x\n",
	req_usage, pk->pubkey_usage);
	continue;
	}

	n_subkeys++;
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has been revoked\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has expired\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->timestamp > curtime && !opt.ignore_valid_from)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not yet valid\n");
	continue;
	}

	if (want_secret && agent_probe_secret_key (NULL, pk))
	{
	if (DBG_LOOKUP)
	log_debug ("\tno secret key\n");
	continue;
	}

	if (DBG_LOOKUP)
	log_debug ("\tsubkey might be fine\n");
	/* In case a key has a timestamp of 0 set, we make sure
	that it is used. A better change would be to compare
	">=" but that might also change the selected keys and
	is as such a more intrusive change. */
	if (pk->timestamp > latest_date \|\| (!pk->timestamp && !latest_date))
	{
	latest_date = pk->timestamp;
	latest_key = k;
	}
	}
	if (n_subkeys == n_revoked_or_expired && r_flags)
	*r_flags \|= LOOKUP_ALL_SUBKEYS_EXPIRED;
	}

	/* Check if the primary key is ok (valid, not revoke, not expire,
	* matches requested usage) if:
	*
	* - we didn't find an appropriate subkey and we're not doing an
	* exact search,
	*
	* - we're doing an exact match and the exact match was the
	* primary key, or,
	*
	* - we're just considering the primary key. */
	if ((!latest_key && !want_exact) \|\| foundk == keyblock \|\| req_prim)
	{
	if (DBG_LOOKUP && !foundk && !req_prim)
	log_debug ("\tno suitable subkeys found - trying primary\n");
	pk = keyblock->pkt->pkt.public_key;
	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not valid\n");
	}
	else if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key usage does not match: "
	"want=%x have=%x\n", req_usage, pk->pubkey_usage);
	}
	else if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has been revoked\n");
	}
	else if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has expired\n");
	}
	else /* Okay. */
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key may be used\n");
	latest_key = keyblock;
	}
	}

	if (!latest_key)
	{
	if (DBG_LOOKUP)
	log_debug ("\tno suitable key found - giving up\n");
	if (r_flags)
	*r_flags \|= LOOKUP_NOT_SELECTED;
	return NULL; /* Not found. */
	}

	found:
	if (DBG_LOOKUP)
	log_debug ("\tusing key %08lX\n",
	(ulong) keyid_from_pk (latest_key->pkt->pkt.public_key, NULL));

	if (latest_key)
	{
	pk = latest_key->pkt->pkt.public_key;
	free_user_id (pk->user_id);
	pk->user_id = scopy_user_id (foundu);
	}

	if (latest_key != keyblock && opt.verbose)
	{
	char *tempkeystr =
	xstrdup (keystr_from_pk (latest_key->pkt->pkt.public_key));
	log_info (_("using subkey %s instead of primary key %s\n"),
	tempkeystr, keystr_from_pk (keyblock->pkt->pkt.public_key));
	xfree (tempkeystr);
	}

	cache_user_id (keyblock);

	return latest_key ? latest_key : keyblock; /* Found. */
	}


	/* Print a KEY_CONSIDERED status line. */
	static void
	print_status_key_considered (kbnode_t keyblock, unsigned int flags)
	{
	char hexfpr[2*MAX_FINGERPRINT_LEN + 1];
	kbnode_t node;
	char flagbuf[20];

	if (!is_status_enabled ())
	return;

	for (node=keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY)
	break;
	if (!node)
	{
	log_error ("%s: keyblock w/o primary key\n", __func__);
	return;
	}

	hexfingerprint (node->pkt->pkt.public_key, hexfpr, sizeof hexfpr);
	snprintf (flagbuf, sizeof flagbuf, " %u", flags);
	write_status_strings (STATUS_KEY_CONSIDERED, hexfpr, flagbuf, NULL);
	}



	/* A high-level function to lookup keys.
	*
	* This function builds on top of the low-level keydb API. It first
	* searches the database using the description stored in CTX->ITEMS,
	* then it filters the results using CTX and, finally, if WANT_SECRET
	* is set, it ignores any keys for which no secret key is available.
	*
	* Unlike the low-level search functions, this function also merges
	* all of the self-signed data into the keys, subkeys and user id
	* packets (see the merge_selfsigs for details).
	*
	* On success the key's keyblock is stored at *RET_KEYBLOCK, and the
	* specific subkey is stored at *RET_FOUND_KEY. Note that we do not
	* return a reference in *RET_FOUND_KEY, i.e. the result must not be
	* freed using 'release_kbnode', and it is only valid until
	* *RET_KEYBLOCK is deallocated. Therefore, if RET_FOUND_KEY is not
	* NULL, then RET_KEYBLOCK must not be NULL. */
	static int
	lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
	kbnode_t ret_keyblock, kbnode_t ret_found_key)
	{
	int rc;
	int no_suitable_key = 0;
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;
	unsigned int infoflags;

	log_assert (ret_found_key == NULL \|\| ret_keyblock != NULL);
	if (ret_keyblock)
	*ret_keyblock = NULL;

	for (;;)
	{
	rc = keydb_search (ctx->kr_handle, ctx->items, ctx->nitems, NULL);
	if (rc)
	break;

	/* If we are iterating over the entire database, then we need to
	* change from KEYDB_SEARCH_MODE_FIRST, which does an implicit
	* reset, to KEYDB_SEARCH_MODE_NEXT, which gets the next record. */
	if (ctx->nitems && ctx->items->mode == KEYDB_SEARCH_MODE_FIRST)
	ctx->items->mode = KEYDB_SEARCH_MODE_NEXT;

	rc = keydb_get_keyblock (ctx->kr_handle, &keyblock);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	goto skip;
	}

	if (want_secret)
	{
	rc = agent_probe_any_secret_key (NULL, keyblock);
	if (gpg_err_code(rc) == GPG_ERR_NO_SECKEY)
	goto skip; /* No secret key available. */
	if (rc)
	goto found; /* Unexpected error. */
	}

	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. */
	merge_selfsigs (ctrl, keyblock);
	found_key = finish_lookup (keyblock, ctx->req_usage, ctx->exact,
	want_secret, &infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	{
	no_suitable_key = 0;
	goto found;
	}
	else
	{
	no_suitable_key = 1;
	}

	skip:
	/* Release resources and continue search. */
	release_kbnode (keyblock);
	keyblock = NULL;
	/* The keyblock cache ignores the current "file position".
	* Thus, if we request the next result and the cache matches
	* (and it will since it is what we just looked for), we'll get
	* the same entry back! We can avoid this infinite loop by
	* disabling the cache. */
	keydb_disable_caching (ctx->kr_handle);
	}

	found:
	if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND)
	log_error ("keydb_search failed: %s\n", gpg_strerror (rc));

	if (!rc)
	{
	if (ret_keyblock)
	{
	ret_keyblock = keyblock; / Return the keyblock. */
	keyblock = NULL;
	}
	}
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND && no_suitable_key)
	rc = want_secret? GPG_ERR_UNUSABLE_SECKEY : GPG_ERR_UNUSABLE_PUBKEY;
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	rc = want_secret? GPG_ERR_NO_SECKEY : GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	if (ret_found_key)
	{
	if (! rc)
	*ret_found_key = found_key;
	else
	*ret_found_key = NULL;
	}

	return rc;
	}


	/* If a default key has been specified, return that key. If a card
	* based key is also available as indicated by FPR_CARD not being
	* NULL, return that key if suitable. */
	gpg_error_t
	get_seckey_default_or_card (ctrl_t ctrl, PKT_public_key *pk,
	const byte *fpr_card, size_t fpr_len)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	const char *def_secret_key;

	def_secret_key = parse_def_secret_key (ctrl);

	if (def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else if (fpr_card)
	{
	err = get_pubkey_byfprint (ctrl, pk, NULL, fpr_card, fpr_len);
	if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY)
	{
	if (opt.debug)
	log_debug ("using LDAP to find public key for current card\n");
	err = keyserver_import_fprint (ctrl, fpr_card, fpr_len,
	opt.keyserver,
	KEYSERVER_IMPORT_FLAG_LDAP);
	if (!err)
	err = get_pubkey_byfprint (ctrl, pk, NULL, fpr_card, fpr_len);
	else if (gpg_err_code (err) == GPG_ERR_NO_DATA
	\|\| gpg_err_code (err) == GPG_ERR_NO_KEYSERVER)
	{
	/* Dirmngr returns NO DATA is the selected keyserver
	* does not have the requested key. It returns NO
	* KEYSERVER if no LDAP keyservers are configured. */
	err = gpg_error (GPG_ERR_NO_PUBKEY);
	}
	}

	/* The key on card can be not suitable for requested usage. */
	if (gpg_err_code (err) == GPG_ERR_UNUSABLE_PUBKEY)
	fpr_card = NULL; /* Fallthrough as no card. */
	else
	return err; /* Success or other error. */
	}

	if (!fpr_card \|\| (def_secret_key && *def_secret_key
	&& def_secret_key[strlen (def_secret_key)-1] == '!'))
	{
	err = key_byname (ctrl, NULL, namelist, pk, 1, 0, NULL, NULL);
	}
	else
	{ /* Default key is specified and card key is also available. */
	kbnode_t k, keyblock = NULL;

	err = key_byname (ctrl, NULL, namelist, pk, 1, 0, &keyblock, NULL);
	if (err)
	goto leave;
	for (k = keyblock; k; k = k->next)
	{
	PKT_public_key *pk_candidate;
	char fpr[MAX_FINGERPRINT_LEN];

	if (k->pkt->pkttype != PKT_PUBLIC_KEY
	&&k->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk_candidate = k->pkt->pkt.public_key;
	if (!pk_candidate->flags.valid)
	continue;
	if (!((pk_candidate->pubkey_usage & USAGE_MASK) & pk->req_usage))
	continue;
	fingerprint_from_pk (pk_candidate, fpr, NULL);
	if (!memcmp (fpr_card, fpr, fpr_len))
	{
	release_public_key_parts (pk);
	copy_public_key (pk, pk_candidate);
	break;
	}
	}
	release_kbnode (keyblock);
	}

	leave:
	free_strlist (namelist);
	return err;
	}



	/*********************************************
	********* User ID printing helpers *****
	*********************************************/

	/* Return a string with a printable representation of the user_id.
	* this string must be freed by xfree. If R_NOUID is not NULL it is
	* set to true if a user id was not found; otherwise to false. */
	static char *
	get_user_id_string (ctrl_t ctrl, u32 * keyid, int mode, size_t *r_len,
	int *r_nouid)
	{
	user_id_db_t r;
	keyid_list_t a;
	int pass = 0;
	char *p;

	if (r_nouid)
	*r_nouid = 0;

	/* Try it two times; second pass reads from the database. */
	do
	{
	for (r = user_id_db; r; r = r->next)
	{
	for (a = r->keyids; a; a = a->next)
	{
	if (a->keyid[0] == keyid[0] && a->keyid[1] == keyid[1])
	{
	if (mode == 2)
	{
	/* An empty string as user id is possible. Make
	sure that the malloc allocates one byte and
	does not bail out. */
	p = xmalloc (r->len? r->len : 1);
	memcpy (p, r->name, r->len);
	if (r_len)
	*r_len = r->len;
	}
	else
	{
	if (mode)
	p = xasprintf ("%08lX%08lX %.*s",
	(ulong) keyid[0], (ulong) keyid[1],
	r->len, r->name);
	else
	p = xasprintf ("%s %.*s", keystr (keyid),
	r->len, r->name);
	if (r_len)
	*r_len = strlen (p);
	}

	return p;
	}
	}
	}
	}
	while (++pass < 2 && !get_pubkey (ctrl, NULL, keyid));

	if (mode == 2)
	p = xstrdup (user_id_not_found_utf8 ());
	else if (mode)
	p = xasprintf ("%08lX%08lX [?]", (ulong) keyid[0], (ulong) keyid[1]);
	else
	p = xasprintf ("%s [?]", keystr (keyid));

	if (r_nouid)
	*r_nouid = 1;
	if (r_len)
	*r_len = strlen (p);
	return p;
	}


	char *
	get_user_id_string_native (ctrl_t ctrl, u32 * keyid)
	{
	char *p = get_user_id_string (ctrl, keyid, 0, NULL, NULL);
	char *p2 = utf8_to_native (p, strlen (p), 0);
	xfree (p);
	return p2;
	}


	char *
	get_long_user_id_string (ctrl_t ctrl, u32 * keyid)
	{
	return get_user_id_string (ctrl, keyid, 1, NULL, NULL);
	}


	/* Please try to use get_user_byfpr instead of this one. */
	char *
	get_user_id (ctrl_t ctrl, u32 keyid, size_t rn, int *r_nouid)
	{
	return get_user_id_string (ctrl, keyid, 2, rn, r_nouid);
	}


	/* Please try to use get_user_id_byfpr_native instead of this one. */
	char *
	get_user_id_native (ctrl_t ctrl, u32 *keyid)
	{
	size_t rn;
	char *p = get_user_id (ctrl, keyid, &rn, NULL);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the user id for a key designated by its fingerprint, FPR,
	which must be MAX_FINGERPRINT_LEN bytes in size. Note: the
	returned string, which must be freed using xfree, may not be NUL
	terminated. To determine the length of the string, you must use
	RN. /
	char *
	get_user_id_byfpr (ctrl_t ctrl, const byte fpr, size_t rn)
	{
	user_id_db_t r;
	char *p;
	int pass = 0;

	/* Try it two times; second pass reads from the database. */
	do
	{
	for (r = user_id_db; r; r = r->next)
	{
	keyid_list_t a;
	for (a = r->keyids; a; a = a->next)
	{
	if (!memcmp (a->fpr, fpr, MAX_FINGERPRINT_LEN))
	{
	/* An empty string as user id is possible. Make
	sure that the malloc allocates one byte and does
	not bail out. */
	p = xmalloc (r->len? r->len : 1);
	memcpy (p, r->name, r->len);
	*rn = r->len;
	return p;
	}
	}
	}
	}
	while (++pass < 2
	&& !get_pubkey_byfprint (ctrl, NULL, NULL, fpr, MAX_FINGERPRINT_LEN));
	p = xstrdup (user_id_not_found_utf8 ());
	*rn = strlen (p);
	return p;
	}

	/* Like get_user_id_byfpr, but convert the string to the native
	encoding. The returned string needs to be freed. Unlike
	get_user_id_byfpr, the returned string is NUL terminated. */
	char *
	get_user_id_byfpr_native (ctrl_t ctrl, const byte *fpr)
	{
	size_t rn;
	char *p = get_user_id_byfpr (ctrl, fpr, &rn);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the database handle used by this context. The context still
	owns the handle. */
	KEYDB_HANDLE
	get_ctx_handle (GETKEY_CTX ctx)
	{
	return ctx->kr_handle;
	}

	static void
	free_akl (struct akl *akl)
	{
	if (! akl)
	return;

	if (akl->spec)
	free_keyserver_spec (akl->spec);

	xfree (akl);
	}

	void
	release_akl (void)
	{
	while (opt.auto_key_locate)
	{
	struct akl *akl2 = opt.auto_key_locate;
	opt.auto_key_locate = opt.auto_key_locate->next;
	free_akl (akl2);
	}
	}


	/* Returns true if the AKL is empty or has only the local method
	* active. */
	int
	akl_empty_or_only_local (void)
	{
	struct akl *akl;
	int any = 0;

	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type != AKL_NODEFAULT && akl->type != AKL_LOCAL)
	{
	any = 1;
	break;
	}

	return !any;
	}


	/* Returns false on error. */
	int
	parse_auto_key_locate (const char *options_arg)
	{
	char *tok;
	char options, options_buf;

	options = options_buf = xstrdup (options_arg);
	while ((tok = optsep (&options)))
	{
	struct akl akl, check, *last = NULL;
	int dupe = 0;

	if (tok[0] == '\0')
	continue;

	akl = xmalloc_clear (sizeof (*akl));

	if (ascii_strcasecmp (tok, "clear") == 0)
	{
	xfree (akl);
	free_akl (opt.auto_key_locate);
	opt.auto_key_locate = NULL;
	continue;
	}
	else if (ascii_strcasecmp (tok, "nodefault") == 0)
	akl->type = AKL_NODEFAULT;
	else if (ascii_strcasecmp (tok, "local") == 0)
	akl->type = AKL_LOCAL;
	else if (ascii_strcasecmp (tok, "ldap") == 0)
	akl->type = AKL_LDAP;
	else if (ascii_strcasecmp (tok, "keyserver") == 0)
	akl->type = AKL_KEYSERVER;
	else if (ascii_strcasecmp (tok, "cert") == 0)
	akl->type = AKL_CERT;
	else if (ascii_strcasecmp (tok, "pka") == 0)
	akl->type = AKL_PKA;
	else if (ascii_strcasecmp (tok, "dane") == 0)
	akl->type = AKL_DANE;
	else if (ascii_strcasecmp (tok, "wkd") == 0)
	akl->type = AKL_WKD;
	else if (ascii_strcasecmp (tok, "ntds") == 0)
	akl->type = AKL_NTDS;
	else if ((akl->spec = parse_keyserver_uri (tok, 1)))
	akl->type = AKL_SPEC;
	else
	{
	free_akl (akl);
	xfree (options_buf);
	return 0;
	}

	/* We must maintain the order the user gave us */
	for (check = opt.auto_key_locate; check;
	last = check, check = check->next)
	{
	/* Check for duplicates */
	if (check->type == akl->type
	&& (akl->type != AKL_SPEC
	\|\| (akl->type == AKL_SPEC
	&& strcmp (check->spec->uri, akl->spec->uri) == 0)))
	{
	dupe = 1;
	free_akl (akl);
	break;
	}
	}

	if (!dupe)
	{
	if (last)
	last->next = akl;
	else
	opt.auto_key_locate = akl;
	}
	}

	xfree (options_buf);
	return 1;
	}



	/* The list of key origins. */
	static struct {
	const char *name;
	int origin;
	} key_origin_list[] =
	{
	{ "self", KEYORG_SELF },
	{ "file", KEYORG_FILE },
	{ "url", KEYORG_URL },
	{ "wkd", KEYORG_WKD },
	{ "dane", KEYORG_DANE },
	{ "ks-pref", KEYORG_KS_PREF },
	{ "ks", KEYORG_KS },
	{ "unknown", KEYORG_UNKNOWN }
	};

	/* Parse the argument for --key-origin. Return false on error. */
	int
	parse_key_origin (char *string)
	{
	int i;
	char *comma;

	comma = strchr (string, ',');
	if (comma)
	*comma = 0;

	if (!ascii_strcasecmp (string, "help"))
	{
	log_info (_("valid values for option '%s':\n"), "--key-origin");
	for (i=0; i < DIM (key_origin_list); i++)
	log_info (" %s\n", key_origin_list[i].name);
	g10_exit (1);
	}

	for (i=0; i < DIM (key_origin_list); i++)
	if (!ascii_strcasecmp (string, key_origin_list[i].name))
	{
	opt.key_origin = key_origin_list[i].origin;
	xfree (opt.key_origin_url);
	opt.key_origin_url = NULL;
	if (comma && comma[1])
	{
	opt.key_origin_url = xstrdup (comma+1);
	trim_spaces (opt.key_origin_url);
	}

	return 1;
	}

	if (comma)
	*comma = ',';
	return 0;
	}

	/* Return a string or "?" for the key ORIGIN. */
	const char *
	key_origin_string (int origin)
	{
	int i;

	for (i=0; i < DIM (key_origin_list); i++)
	if (key_origin_list[i].origin == origin)
	return key_origin_list[i].name;
	return "?";
	}



	/* Returns true if a secret key is available for the public key with
	key id KEYID; returns false if not. This function ignores legacy
	keys. Note: this is just a fast check and does not tell us whether
	the secret key is valid; this check merely indicates whether there
	is some secret key with the specified key id. */
	int
	have_secret_key_with_kid (u32 *keyid)
	{
	gpg_error_t err;
	KEYDB_HANDLE kdbhd;
	KEYDB_SEARCH_DESC desc;
	kbnode_t keyblock;
	kbnode_t node;
	int result = 0;

	kdbhd = keydb_new ();
	if (!kdbhd)
	return 0;
	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_LONG_KID;
	desc.u.kid[0] = keyid[0];
	desc.u.kid[1] = keyid[1];
	while (!result)
	{
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (err)
	break;

	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	break;
	}

	for (node = keyblock; node; node = node->next)
	{
	/* Bit 0 of the flags is set if the search found the key
	using that key or subkey. Note: a search will only ever
	match a single key or subkey. */
	if ((node->flag & 1))
	{
	log_assert (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	if (!agent_probe_secret_key (NULL, node->pkt->pkt.public_key))
	result = 1; /* Secret key available. */
	else
	result = 0;

	break;
	}
	}
	release_kbnode (keyblock);
	}

	keydb_release (kdbhd);
	return result;
	}
	diff --git a/g10/keydb.h b/g10/keydb.h
	index 4be889e07..074027690 100644
	--- a/g10/keydb.h
	+++ b/g10/keydb.h
	@@ -1,571 +1,575 @@
	/* keydb.h - Key database
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
	* 2006, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef G10_KEYDB_H
	#define G10_KEYDB_H

	#include "../common/types.h"
	#include "../common/util.h"
	#include "packet.h"

	/* What qualifies as a certification (key-signature in contrast to a
	* data signature)? Note that a back signature is special and can be
	* made by key and data signatures capable subkeys.) */
	#define IS_CERT(s) (IS_KEY_SIG(s) \|\| IS_UID_SIG(s) \|\| IS_SUBKEY_SIG(s) \
	\|\| IS_KEY_REV(s) \|\| IS_UID_REV(s) \|\| IS_SUBKEY_REV(s))
	#define IS_SIG(s) (!IS_CERT(s))
	#define IS_KEY_SIG(s) ((s)->sig_class == 0x1f)
	#define IS_UID_SIG(s) (((s)->sig_class & ~3) == 0x10)
	#define IS_SUBKEY_SIG(s) ((s)->sig_class == 0x18)
	#define IS_BACK_SIG(s) ((s)->sig_class == 0x19)
	#define IS_KEY_REV(s) ((s)->sig_class == 0x20)
	#define IS_UID_REV(s) ((s)->sig_class == 0x30)
	#define IS_SUBKEY_REV(s) ((s)->sig_class == 0x28)

	struct getkey_ctx_s;
	typedef struct getkey_ctx_s *GETKEY_CTX;
	typedef struct getkey_ctx_s *getkey_ctx_t;

	/****************
	* A Keyblock is all packets which form an entire certificate;
	* i.e. the public key, certificate, trust packets, user ids,
	* signatures, and subkey.
	*
	* This structure is also used to bind arbitrary packets together.
	*/

	struct kbnode_struct
	{
	kbnode_t next;
	PACKET *pkt;
	int flag; /* Local use during keyblock processing (not cloned).*/
	unsigned int tag; /* Ditto. */
	int private_flag;
	};

	#define is_deleted_kbnode(a) ((a)->private_flag & 1)
	#define is_cloned_kbnode(a) ((a)->private_flag & 2)


	/*
	* A structure to store key identification as well as some stuff
	* needed for key validation.
	*/
	struct key_item {
	struct key_item *next;
	unsigned int ownertrust,min_ownertrust;
	byte trust_depth;
	byte trust_value;
	char *trust_regexp;
	u32 kid[2];
	};


	/* Bit flags used with build_pk_list. */
	enum
	{
	PK_LIST_ENCRYPT_TO = 1, /* This is an encrypt-to recipient. */
	PK_LIST_HIDDEN = 2, /* This is a hidden recipient. */
	PK_LIST_CONFIG = 4, /* Specified via config file. */
	PK_LIST_FROM_FILE = 8 /* Take key from file with that name. */
	};

	/* To store private data in the flags the private data must be left
	* shifted by this value. */
	enum
	{
	PK_LIST_SHIFT = 4
	};


	/* Structure to hold a couple of public key certificates. */
	typedef struct pk_list PK_LIST; / Deprecated. */
	typedef struct pk_list *pk_list_t;
	struct pk_list
	{
	PK_LIST next;
	PKT_public_key *pk;
	int flags; /* See PK_LIST_ constants. */
	};

	/* Structure to hold a list of secret key certificates. */
	typedef struct sk_list *SK_LIST;
	struct sk_list
	{
	SK_LIST next;
	PKT_public_key *pk;
	int mark; /* not used */
	};

	/* structure to collect all information which can be used to
	* identify a public key */
	typedef struct pubkey_find_info *PUBKEY_FIND_INFO;
	struct pubkey_find_info {
	u32 keyid[2];
	unsigned nbits;
	byte pubkey_algo;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	char userid[1];
	};


	/* Helper type for preference functions. */
	struct pref_hint
	{
	int digest_length; /* We want at least this digest length. */
	int exact; /* We need to use exactly this length. */
	};


	/* Constants to describe from where a key was fetched or updated. */
	enum
	{
	KEYORG_UNKNOWN = 0,
	KEYORG_KS = 1, /* Public keyserver. */
	KEYORG_KS_PREF = 2, /* Preferred keysrver. */
	KEYORG_DANE = 3, /* OpenPGP DANE. */
	KEYORG_WKD = 4, /* Web Key Directory. */
	KEYORG_URL = 5, /* Trusted URL. */
	KEYORG_FILE = 6, /* Trusted file. */
	KEYORG_SELF = 7 /* We generated it. */
	};


	/*
	* Check whether the signature SIG is in the klist K.
	*/
	static inline struct key_item *
	is_in_klist (struct key_item k, PKT_signature sig)
	{
	for (; k; k = k->next)
	{
	if (k->kid[0] == sig->keyid[0] && k->kid[1] == sig->keyid[1])
	return k;
	}
	return NULL;
	}



	/-- keydb.c --/

	#define KEYDB_RESOURCE_FLAG_PRIMARY 2 /* The primary resource. */
	#define KEYDB_RESOURCE_FLAG_DEFAULT 4 /* The default one. */
	#define KEYDB_RESOURCE_FLAG_READONLY 8 /* Open in read only mode. */
	#define KEYDB_RESOURCE_FLAG_GPGVDEF 16 /* Default file for gpgv. */

	/* Format a search term for debugging output. The caller must free
	the result. */
	char keydb_search_desc_dump (struct keydb_search_desc desc);

	/* Register a resource (keyring or keybox). */
	gpg_error_t keydb_add_resource (const char *url, unsigned int flags);

	/* Dump some statistics to the log. */
	void keydb_dump_stats (void);

	/* Create a new database handle. Returns NULL on error, sets ERRNO,
	and prints an error diagnostic. */
	KEYDB_HANDLE keydb_new (void);

	/* Free all resources owned by the database handle. */
	void keydb_release (KEYDB_HANDLE hd);

	/* Take a lock on the files immediately and not only during insert or
	* update. This lock is released with keydb_release. */
	gpg_error_t keydb_lock (KEYDB_HANDLE hd);

	/* Set a flag on the handle to suppress use of cached results. This
	is required for updating a keyring and for key listings. Fixme:
	Using a new parameter for keydb_new might be a better solution. */
	void keydb_disable_caching (KEYDB_HANDLE hd);

	/* Save the last found state and invalidate the current selection. */
	void keydb_push_found_state (KEYDB_HANDLE hd);

	/* Restore the previous save state. */
	void keydb_pop_found_state (KEYDB_HANDLE hd);

	/* Return the file name of the resource. */
	const char *keydb_get_resource_name (KEYDB_HANDLE hd);

	/* Return the keyblock last found by keydb_search. */
	gpg_error_t keydb_get_keyblock (KEYDB_HANDLE hd, KBNODE *ret_kb);

	/* Update the keyblock KB. */
	gpg_error_t keydb_update_keyblock (ctrl_t ctrl, KEYDB_HANDLE hd, kbnode_t kb);

	/* Insert a keyblock into one of the underlying keyrings or keyboxes. */
	gpg_error_t keydb_insert_keyblock (KEYDB_HANDLE hd, kbnode_t kb);

	/* Delete the currently selected keyblock. */
	gpg_error_t keydb_delete_keyblock (KEYDB_HANDLE hd);

	/* Find the first writable resource. */
	gpg_error_t keydb_locate_writable (KEYDB_HANDLE hd);

	/* Rebuild the on-disk caches of all key resources. */
	void keydb_rebuild_caches (ctrl_t ctrl, int noisy);

	/* Return the number of skipped blocks (because they were to large to
	read from a keybox) since the last search reset. */
	unsigned long keydb_get_skipped_counter (KEYDB_HANDLE hd);

	/* Clears the current search result and resets the handle's position. */
	gpg_error_t keydb_search_reset (KEYDB_HANDLE hd);

	/* Search the database for keys matching the search description. */
	gpg_error_t keydb_search (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc,
	size_t ndesc, size_t *descindex);

	/* Return the first non-legacy key in the database. */
	gpg_error_t keydb_search_first (KEYDB_HANDLE hd);

	/* Return the next key (not the next matching key!). */
	gpg_error_t keydb_search_next (KEYDB_HANDLE hd);

	/* This is a convenience function for searching for keys with a long
	key id. */
	gpg_error_t keydb_search_kid (KEYDB_HANDLE hd, u32 *kid);

	/* This is a convenience function for searching for keys with a long
	(20 byte) fingerprint. */
	gpg_error_t keydb_search_fpr (KEYDB_HANDLE hd, const byte *fpr);


	/-- pkclist.c --/
	void show_revocation_reason (ctrl_t ctrl, PKT_public_key *pk, int mode );
	int check_signatures_trust (ctrl_t ctrl, PKT_signature *sig);

	void release_pk_list (PK_LIST pk_list);
	int build_pk_list (ctrl_t ctrl, strlist_t rcpts, PK_LIST *ret_pk_list);
	gpg_error_t find_and_check_key (ctrl_t ctrl,
	const char *name, unsigned int use,
	int mark_hidden, int from_file,
	pk_list_t *pk_list_addr);

	int algo_available( preftype_t preftype, int algo,
	const struct pref_hint *hint );
	int select_algo_from_prefs( PK_LIST pk_list, int preftype,
	int request, const struct pref_hint *hint);
	aead_algo_t select_aead_from_pklist (PK_LIST pk_list);
	void warn_missing_aead_from_pklist (PK_LIST pk_list);
	void warn_missing_aes_from_pklist (PK_LIST pk_list);

	/-- skclist.c --/
	int random_is_faked (void);
	void release_sk_list( SK_LIST sk_list );
	gpg_error_t build_sk_list (ctrl_t ctrl, strlist_t locusr,
	SK_LIST *ret_sk_list, unsigned use);

	/-- passphrase.h --/

	/* Flags for passphrase_to_dek */
	#define GETPASSWORD_FLAG_SYMDECRYPT 1


	unsigned char encode_s2k_iterations (int iterations);
	int have_static_passphrase(void);
	const char *get_static_passphrase (void);
	void set_passphrase_from_string(const char *pass);
	void read_passphrase_from_fd( int fd );
	void passphrase_clear_cache (const char *cacheid);
	DEK passphrase_to_dek (int cipher_algo, STRING2KEY s2k,
	int create, int nocache,
	const char *tryagain_text, unsigned int flags,
	int *canceled);
	void set_next_passphrase( const char *s );
	char *get_last_passphrase(void);
	void next_to_last_passphrase(void);

	void emit_status_need_passphrase (ctrl_t ctrl, u32 *keyid,
	u32 *mainkeyid, int pubkey_algo);

	#define FORMAT_KEYDESC_NORMAL 0
	#define FORMAT_KEYDESC_IMPORT 1
	#define FORMAT_KEYDESC_EXPORT 2
	#define FORMAT_KEYDESC_DELKEY 3
	char *gpg_format_keydesc (ctrl_t ctrl,
	PKT_public_key *pk, int mode, int escaped);


	/-- getkey.c --/

	/* Cache a copy of a public key in the public key cache. */
	void cache_public_key( PKT_public_key *pk );

	/* Disable and drop the public key cache. */
	void getkey_disable_caches(void);

	/* Return the public key used for signature SIG and store it at PK. */
	gpg_error_t get_pubkey_for_sig (ctrl_t ctrl,
	PKT_public_key pk, PKT_signature sig,
	PKT_public_key *forced_pk);

	/* Return the public key with the key id KEYID and store it at PK. */
	int get_pubkey (ctrl_t ctrl, PKT_public_key pk, u32 keyid);

	/* Same as get_pubkey but with auto LDAP fetch. */
	gpg_error_t get_pubkey_with_ldap_fallback (ctrl_t ctrl,
	PKT_public_key pk, u32 keyid);

	/* Similar to get_pubkey, but it does not take PK->REQ_USAGE into
	account nor does it merge in the self-signed data. This function
	also only considers primary keys. */
	int get_pubkey_fast (PKT_public_key pk, u32 keyid);

	/* Return the entire keyblock used to create SIG. This is a
	* specialized version of get_pubkeyblock. */
	kbnode_t get_pubkeyblock_for_sig (ctrl_t ctrl, PKT_signature *sig);

	/* Return the key block for the key with KEYID. */
	kbnode_t get_pubkeyblock (ctrl_t ctrl, u32 *keyid);

	/* A list used by get_pubkeys to gather all of the matches. */
	struct pubkey_s
	{
	struct pubkey_s *next;
	/* The key to use (either the public key or the subkey). */
	PKT_public_key *pk;
	kbnode_t keyblock;
	};
	typedef struct pubkey_s *pubkey_t;

	/* Free a list of public keys. */
	void pubkeys_free (pubkey_t keys);


	/* Mode flags for get_pubkey_byname. */
	enum get_pubkey_modes
	{
	GET_PUBKEY_NORMAL = 0,
	GET_PUBKEY_NO_AKL = 1,
	GET_PUBKEY_NO_LOCAL = 2
	};

	/* Find a public key identified by NAME. */
	int get_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char *name,
	KBNODE ret_keyblock, KEYDB_HANDLE ret_kdbhd,
	int include_unusable);

	/* Likewise, but only return the best match if NAME resembles a mail
	* address. */
	gpg_error_t get_best_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char name, KBNODE ret_keyblock,
	int include_unusable);

	/* Get a public key directly from file FNAME. */
	gpg_error_t get_pubkey_fromfile (ctrl_t ctrl,
	- PKT_public_key pk, const char fname);
	+ PKT_public_key pk, const char fname,
	+ kbnode_t *r_keyblock);

	/* Get a public key from a buffer. */
	gpg_error_t get_pubkey_from_buffer (ctrl_t ctrl, PKT_public_key *pkbuf,
	const void *buffer, size_t buflen,
	u32 want_keyid, kbnode_t r_keyblock);

	/* Return the public key with the key id KEYID iff the secret key is
	* available and store it at PK. */
	gpg_error_t get_seckey (ctrl_t ctrl, PKT_public_key pk, u32 keyid);

	/* Lookup a key with the specified fingerprint. */
	int get_pubkey_byfprint (ctrl_t ctrl, PKT_public_key pk, kbnode_t r_keyblock,
	const byte *fprint, size_t fprint_len);

	/* This function is similar to get_pubkey_byfprint, but it doesn't
	merge the self-signed data into the public key and subkeys or into
	the user ids. */
	gpg_error_t get_pubkey_byfprint_fast (PKT_public_key *pk,
	const byte *fprint, size_t fprint_len);

	/* This function is similar to get_pubkey_byfprint, but it doesn't
	merge the self-signed data into the public key and subkeys or into
	the user ids. */
	gpg_error_t get_keyblock_byfprint_fast (kbnode_t *r_keyblock,
	KEYDB_HANDLE *r_hd,
	const byte *fprint, size_t fprint_len,
	int lock);


	/* Returns true if a secret key is available for the public key with
	key id KEYID. */
	int have_secret_key_with_kid (u32 *keyid);

	/* Parse the --default-key parameter. Returns the last key (in terms
	of when the option is given) that is available. */
	const char *parse_def_secret_key (ctrl_t ctrl);

	/* Look up a secret key. */
	gpg_error_t get_seckey_default (ctrl_t ctrl, PKT_public_key *pk);
	gpg_error_t get_seckey_default_or_card (ctrl_t ctrl, PKT_public_key *pk,
	const byte *fpr, size_t fpr_len);

	/* Search for keys matching some criteria. */
	gpg_error_t getkey_bynames (ctrl_t ctrl,
	getkey_ctx_t retctx, PKT_public_key pk,
	strlist_t names, int want_secret,
	kbnode_t *ret_keyblock);

	/* Search for one key matching some criteria. */
	gpg_error_t getkey_byname (ctrl_t ctrl,
	getkey_ctx_t retctx, PKT_public_key pk,
	const char *name, int want_secret,
	kbnode_t *ret_keyblock);

	/* Return the next search result. */
	gpg_error_t getkey_next (ctrl_t ctrl, getkey_ctx_t ctx,
	PKT_public_key pk, kbnode_t ret_keyblock);

	/* Release any resources used by a key listing context. */
	void getkey_end (ctrl_t ctrl, getkey_ctx_t ctx);

	/* Return the database handle used by this context. The context still
	owns the handle. */
	KEYDB_HANDLE get_ctx_handle(GETKEY_CTX ctx);

	/* Enumerate some secret keys. */
	gpg_error_t enum_secret_keys (ctrl_t ctrl, void *context, PKT_public_key pk);

	/* Set the mainkey_id fields for all keys in KEYBLOCK. */
	void setup_main_keyids (kbnode_t keyblock);

	/* This function merges information from the self-signed data into the
	data structures. */
	void merge_keys_and_selfsig (ctrl_t ctrl, kbnode_t keyblock);

	+/* This function parses the key flags and returns PUBKEY_USAGE_ flags. */
	+unsigned int parse_key_usage (PKT_signature *sig);
	+
	char get_user_id_string_native (ctrl_t ctrl, u32 keyid);
	char get_long_user_id_string (ctrl_t ctrl, u32 keyid);
	char get_user_id (ctrl_t ctrl, u32 keyid, size_t rn, int r_nouid);
	char get_user_id_native (ctrl_t ctrl, u32 keyid);
	char get_user_id_byfpr (ctrl_t ctrl, const byte fpr, size_t *rn);
	char get_user_id_byfpr_native (ctrl_t ctrl, const byte fpr);

	void release_akl(void);
	int akl_empty_or_only_local (void);
	int parse_auto_key_locate(const char *options);
	int parse_key_origin (char *string);
	const char *key_origin_string (int origin);

	/-- keyid.c --/
	int pubkey_letter( int algo );
	char pubkey_string (PKT_public_key pk, char *buffer, size_t bufsize);
	#define PUBKEY_STRING_SIZE 32
	u32 v3_keyid (gcry_mpi_t a, u32 *ki);
	void hash_public_key( gcry_md_hd_t md, PKT_public_key *pk );
	char format_keyid (u32 keyid, int format, char *buffer, int len);

	/* Return PK's keyid. The memory is owned by PK. */
	u32 pk_keyid (PKT_public_key pk);

	/* Return the keyid of the primary key associated with PK. The memory
	is owned by PK. */
	u32 pk_main_keyid (PKT_public_key pk);

	/* Order A and B. If A < B then return -1, if A == B then return 0,
	and if A > B then return 1. */
	static int GPGRT_ATTR_UNUSED
	keyid_cmp (const u32 a, const u32 b)
	{
	if (a[0] < b[0])
	return -1;
	if (a[0] > b[0])
	return 1;
	if (a[1] < b[1])
	return -1;
	if (a[1] > b[1])
	return 1;
	return 0;
	}

	/* Return whether PK is a primary key. */
	static int GPGRT_ATTR_UNUSED
	pk_is_primary (PKT_public_key *pk)
	{
	return keyid_cmp (pk_keyid (pk), pk_main_keyid (pk)) == 0;
	}

	/* Copy the keyid in SRC to DEST and return DEST. */
	u32 keyid_copy (u32 dest, const u32 *src);

	size_t keystrlen(void);
	const char keystr(u32 keyid);
	const char keystr_with_sub (u32 main_kid, u32 *sub_kid);
	const char keystr_from_pk(PKT_public_key pk);
	const char keystr_from_pk_with_sub (PKT_public_key main_pk,
	PKT_public_key *sub_pk);

	/* Return PK's key id as a string using the default format. PK owns
	the storage. */
	const char pk_keyid_str (PKT_public_key pk);

	const char keystr_from_desc(KEYDB_SEARCH_DESC desc);
	u32 keyid_from_pk( PKT_public_key pk, u32 keyid );
	u32 keyid_from_sig (PKT_signature sig, u32 keyid );
	u32 keyid_from_fingerprint (ctrl_t ctrl, const byte *fprint, size_t fprint_len,
	u32 *keyid);
	byte namehash_from_uid(PKT_user_id uid);
	unsigned nbits_from_pk( PKT_public_key *pk );

	/* Convert an UTC TIMESTAMP into an UTC yyyy-mm-dd string. Return
	* that string. The caller should pass a buffer with at least a size
	* of MK_DATESTR_SIZE. */
	char mk_datestr (char buffer, size_t bufsize, u32 timestamp);
	#define MK_DATESTR_SIZE 11

	const char datestr_from_pk( PKT_public_key pk );
	const char datestr_from_sig( PKT_signature sig );
	const char expirestr_from_pk( PKT_public_key pk );
	const char expirestr_from_sig( PKT_signature sig );
	const char revokestr_from_pk( PKT_public_key pk );
	const char usagestr_from_pk (PKT_public_key pk, int fill);
	const char *colon_strtime (u32 t);
	const char colon_datestr_from_pk (PKT_public_key pk);
	const char colon_datestr_from_sig (PKT_signature sig);
	const char colon_expirestr_from_sig (PKT_signature sig);
	byte fingerprint_from_pk( PKT_public_key pk, byte buf, size_t ret_len );
	char hexfingerprint (PKT_public_key pk, char *buffer, size_t buflen);
	char format_hexfingerprint (const char fingerprint,
	char *buffer, size_t buflen);
	gpg_error_t keygrip_from_pk (PKT_public_key pk, unsigned char array);
	gpg_error_t hexkeygrip_from_pk (PKT_public_key pk, char *r_grip);


	/-- kbnode.c --/
	KBNODE new_kbnode( PACKET *pkt );
	kbnode_t new_kbnode2 (kbnode_t list, PACKET *pkt);
	KBNODE clone_kbnode( KBNODE node );
	void release_kbnode( KBNODE n );
	void delete_kbnode( KBNODE node );
	void add_kbnode( KBNODE root, KBNODE node );
	void insert_kbnode( KBNODE root, KBNODE node, int pkttype );
	void move_kbnode( KBNODE *root, KBNODE node, KBNODE where );
	void remove_kbnode( KBNODE *root, KBNODE node );
	KBNODE find_prev_kbnode( KBNODE root, KBNODE node, int pkttype );
	KBNODE find_next_kbnode( KBNODE node, int pkttype );
	KBNODE find_kbnode( KBNODE node, int pkttype );
	KBNODE walk_kbnode( KBNODE root, KBNODE *context, int all );
	void clear_kbnode_flags( KBNODE n );
	int commit_kbnode( KBNODE *root );
	void dump_kbnode( KBNODE node );

	#endif /G10_KEYDB_H/
	diff --git a/g10/misc.c b/g10/misc.c
	index 23a627a66..768e02da3 100644
	--- a/g10/misc.c
	+++ b/g10/misc.c
	@@ -1,1905 +1,1905 @@
	/* misc.c - miscellaneous functions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2014 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>
	#include <errno.h>
	#if defined(__linux__) && defined(__alpha__) && __GLIBC__ < 2
	#include <asm/sysinfo.h>
	#include <asm/unistd.h>
	#endif
	#ifdef HAVE_SETRLIMIT
	#include <time.h>
	#include <sys/time.h>
	#include <sys/resource.h>
	#endif
	#ifdef ENABLE_SELINUX_HACKS
	#include <sys/stat.h>
	#endif

	#ifdef HAVE_W32_SYSTEM
	#include <time.h>
	#include <process.h>
	#ifdef HAVE_WINSOCK2_H
	# define WIN32_LEAN_AND_MEAN 1
	# include <winsock2.h>
	#endif
	#include <windows.h>
	#include <shlobj.h>
	#ifndef CSIDL_APPDATA
	#define CSIDL_APPDATA 0x001a
	#endif
	#ifndef CSIDL_LOCAL_APPDATA
	#define CSIDL_LOCAL_APPDATA 0x001c
	#endif
	#ifndef CSIDL_FLAG_CREATE
	#define CSIDL_FLAG_CREATE 0x8000
	#endif
	#endif /HAVE_W32_SYSTEM/

	#include "gpg.h"
	#ifdef HAVE_W32_SYSTEM
	# include "../common/status.h"
	#endif /HAVE_W32_SYSTEM/
	#include "../common/util.h"
	#include "main.h"
	#include "photoid.h"
	#include "options.h"
	#include "call-agent.h"
	#include "../common/i18n.h"
	#include "../common/zb32.h"

	/* FIXME: Libgcrypt 1.9 will support EAX. Until we name this a
	* requirement we hardwire the enum used for EAX. */
	#define MY_GCRY_CIPHER_MODE_EAX 14


	#ifdef ENABLE_SELINUX_HACKS
	/* A object and a global variable to keep track of files marked as
	secured. */
	struct secured_file_item
	{
	struct secured_file_item *next;
	ino_t ino;
	dev_t dev;
	};
	static struct secured_file_item *secured_files;
	#endif /ENABLE_SELINUX_HACKS/




	/* For the sake of SELinux we want to restrict access through gpg to
	certain files we keep under our own control. This function
	registers such a file and is_secured_file may then be used to
	check whether a file has ben registered as secured. */
	void
	register_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	/* Note that we stop immediately if something goes wrong here. */
	if (gnupg_stat (fname, &buf))
	log_fatal (_("fstat of '%s' failed in %s: %s\n"), fname,
	"register_secured_file", strerror (errno));
	/* log_debug ("registering '%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return; /* Already registered. */
	}

	sf = xmalloc (sizeof *sf);
	sf->ino = buf.st_ino;
	sf->dev = buf.st_dev;
	sf->next = secured_files;
	secured_files = sf;
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	}

	/* Remove a file registered as secure. */
	void
	unregister_secured_file (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item sf, sfprev;

	if (gnupg_stat (fname, &buf))
	{
	log_error (_("fstat of '%s' failed in %s: %s\n"), fname,
	"unregister_secured_file", strerror (errno));
	return;
	}
	/* log_debug ("unregistering '%s' i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sfprev=NULL,sf=secured_files; sf; sfprev=sf, sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	{
	if (sfprev)
	sfprev->next = sf->next;
	else
	secured_files = sf->next;
	xfree (sf);
	return;
	}
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	}

	/* Return true if FD is corresponds to a secured file. Using -1 for
	FS is allowed and will return false. */
	int
	is_secured_file (int fd)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (fd == -1)
	return 0; /* No file descriptor so it can't be secured either. */

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (fstat (fd, &buf))
	{
	log_error (_("fstat(%d) failed in %s: %s\n"), fd,
	"is_secured_file", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_file (%d) i=%lu.%lu\n", fd, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fd;
	#endif /!ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}

	/* Return true if FNAME is corresponds to a secured file. Using NULL,
	"" or "-" for FS is allowed and will return false. This function is
	used before creating a file, thus it won't fail if the file does
	not exist. */
	int
	is_secured_filename (const char *fname)
	{
	#ifdef ENABLE_SELINUX_HACKS
	struct stat buf;
	struct secured_file_item *sf;

	if (iobuf_is_pipe_filename (fname) \|\| !*fname)
	return 0;

	/* Note that we print out a error here and claim that a file is
	secure if something went wrong. */
	if (gnupg_stat (fname, &buf))
	{
	if (errno == ENOENT \|\| errno == EPERM \|\| errno == EACCES)
	return 0;
	log_error (_("fstat of '%s' failed in %s: %s\n"), fname,
	"is_secured_filename", strerror (errno));
	return 1;
	}
	/* log_debug ("is_secured_filename (%s) i=%lu.%lu\n", fname, */
	/* (unsigned long)buf.st_dev, (unsigned long)buf.st_ino); */
	for (sf=secured_files; sf; sf = sf->next)
	{
	if (sf->ino == buf.st_ino && sf->dev == buf.st_dev)
	return 1; /* Yes. */
	}
	#else /!ENABLE_SELINUX_HACKS/
	(void)fname;
	#endif /!ENABLE_SELINUX_HACKS/
	return 0; /* No. */
	}



	u16
	checksum_u16( unsigned n )
	{
	u16 a;

	a = (n >> 8) & 0xff;
	a += n & 0xff;
	return a;
	}


	u16
	checksum( byte *p, unsigned n )
	{
	u16 a;

	for(a=0; n; n-- )
	a += *p++;
	return a;
	}

	u16
	checksum_mpi (gcry_mpi_t a)
	{
	u16 csum;
	byte *buffer;
	size_t nbytes;

	if ( gcry_mpi_print (GCRYMPI_FMT_PGP, NULL, 0, &nbytes, a) )
	BUG ();
	/* Fixme: For numbers not in secure memory we should use a stack
	* based buffer and only allocate a larger one if mpi_print returns
	* an error. */
	buffer = (gcry_is_secure(a)?
	gcry_xmalloc_secure (nbytes) : gcry_xmalloc (nbytes));
	if ( gcry_mpi_print (GCRYMPI_FMT_PGP, buffer, nbytes, NULL, a) )
	BUG ();
	csum = checksum (buffer, nbytes);
	xfree (buffer);
	return csum;
	}


	void
	print_pubkey_algo_note (pubkey_algo_t algo)
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental public key algorithm %s\n"),
	openpgp_pk_algo_name (algo));
	}
	}
	else if (algo == PUBKEY_ALGO_ELGAMAL)
	{
	es_fflush (es_stdout);
	log_info (_("WARNING: Elgamal sign+encrypt keys are deprecated\n"));
	}
	}

	void
	print_cipher_algo_note (cipher_algo_t algo)
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental cipher algorithm %s\n"),
	openpgp_cipher_algo_name (algo));
	}
	}
	}

	void
	print_digest_algo_note (digest_algo_t algo)
	{
	if(algo >= 100 && algo <= 110)
	{
	static int warn=0;
	const enum gcry_md_algos galgo = map_md_openpgp_to_gcry (algo);

	if(!warn)
	{
	warn=1;
	es_fflush (es_stdout);
	log_info (_("WARNING: using experimental digest algorithm %s\n"),
	gcry_md_algo_name (galgo));
	}
	}
	else if (is_weak_digest (algo))
	{
	const enum gcry_md_algos galgo = map_md_openpgp_to_gcry (algo);
	es_fflush (es_stdout);
	log_info (_("WARNING: digest algorithm %s is deprecated\n"),
	gcry_md_algo_name (galgo));
	}
	}


	void
	print_digest_rejected_note (enum gcry_md_algos algo)
	{
	struct weakhash* weak;
	int show = 1;

	if (opt.quiet)
	return;

	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (weak->algo == algo)
	{
	if (weak->rejection_shown)
	show = 0;
	else
	weak->rejection_shown = 1;
	break;
	}

	if (show)
	{
	es_fflush (es_stdout);
	log_info
	(_("Note: signatures using the %s algorithm are rejected\n"),
	gcry_md_algo_name(algo));
	}
	}


	void
	print_sha1_keysig_rejected_note (void)
	{
	static int shown;

	if (shown \|\| opt.quiet)
	return;

	shown = 1;
	es_fflush (es_stdout);
	log_info (_("Note: third-party key signatures using"
	" the %s algorithm are rejected\n"),
	gcry_md_algo_name (GCRY_MD_SHA1));
	print_further_info ("use option \"%s\" to override",
	"--allow-weak-key-signatures");
	}


	/* Print a message
	* "(reported error: %s)\n
	* in verbose mode to further explain an error. If the error code has
	* the value IGNORE_EC no message is printed. A message is also not
	* printed if ERR is 0. */
	void
	print_reported_error (gpg_error_t err, gpg_err_code_t ignore_ec)
	{
	if (!opt.verbose)
	return;

	if (!gpg_err_code (err))
	;
	else if (gpg_err_code (err) == ignore_ec)
	;
	else if (gpg_err_source (err) == GPG_ERR_SOURCE_DEFAULT)
	log_info (_("(reported error: %s)\n"),
	gpg_strerror (err));
	else
	log_info (_("(reported error: %s <%s>)\n"),
	gpg_strerror (err), gpg_strsource (err));

	}


	/* Print a message
	* "(further info: %s)\n
	* in verbose mode to further explain an error. That message is
	* intended to help debug a problem and should not be translated.
	*/
	void
	print_further_info (const char *format, ...)
	{
	va_list arg_ptr;

	if (!opt.verbose)
	return;

	log_info (_("(further info: "));
	va_start (arg_ptr, format);
	log_logv (GPGRT_LOG_CONT, format, arg_ptr);
	va_end (arg_ptr);
	log_printf (")\n");
	}


	/* Map OpenPGP algo numbers to those used by Libgcrypt. We need to do
	this for algorithms we implemented in Libgcrypt after they become
	part of OpenPGP. */
	enum gcry_cipher_algos
	map_cipher_openpgp_to_gcry (cipher_algo_t algo)
	{
	switch (algo)
	{
	case CIPHER_ALGO_NONE: return GCRY_CIPHER_NONE;

	#ifdef GPG_USE_IDEA
	case CIPHER_ALGO_IDEA: return GCRY_CIPHER_IDEA;
	#else
	case CIPHER_ALGO_IDEA: return 0;
	#endif

	case CIPHER_ALGO_3DES: return GCRY_CIPHER_3DES;

	#ifdef GPG_USE_CAST5
	case CIPHER_ALGO_CAST5: return GCRY_CIPHER_CAST5;
	#else
	case CIPHER_ALGO_CAST5: return 0;
	#endif

	#ifdef GPG_USE_BLOWFISH
	case CIPHER_ALGO_BLOWFISH: return GCRY_CIPHER_BLOWFISH;
	#else
	case CIPHER_ALGO_BLOWFISH: return 0;
	#endif

	#ifdef GPG_USE_AES128
	case CIPHER_ALGO_AES: return GCRY_CIPHER_AES;
	#else
	case CIPHER_ALGO_AES: return 0;
	#endif

	#ifdef GPG_USE_AES192
	case CIPHER_ALGO_AES192: return GCRY_CIPHER_AES192;
	#else
	case CIPHER_ALGO_AES192: return 0;
	#endif

	#ifdef GPG_USE_AES256
	case CIPHER_ALGO_AES256: return GCRY_CIPHER_AES256;
	#else
	case CIPHER_ALGO_AES256: return 0;
	#endif

	#ifdef GPG_USE_TWOFISH
	case CIPHER_ALGO_TWOFISH: return GCRY_CIPHER_TWOFISH;
	#else
	case CIPHER_ALGO_TWOFISH: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA128
	case CIPHER_ALGO_CAMELLIA128: return GCRY_CIPHER_CAMELLIA128;
	#else
	case CIPHER_ALGO_CAMELLIA128: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA192
	case CIPHER_ALGO_CAMELLIA192: return GCRY_CIPHER_CAMELLIA192;
	#else
	case CIPHER_ALGO_CAMELLIA192: return 0;
	#endif

	#ifdef GPG_USE_CAMELLIA256
	case CIPHER_ALGO_CAMELLIA256: return GCRY_CIPHER_CAMELLIA256;
	#else
	case CIPHER_ALGO_CAMELLIA256: return 0;
	#endif
	default: return 0;
	}
	}

	/* The inverse function of above. */
	static cipher_algo_t
	map_cipher_gcry_to_openpgp (enum gcry_cipher_algos algo)
	{
	switch (algo)
	{
	case GCRY_CIPHER_NONE: return CIPHER_ALGO_NONE;
	case GCRY_CIPHER_IDEA: return CIPHER_ALGO_IDEA;
	case GCRY_CIPHER_3DES: return CIPHER_ALGO_3DES;
	case GCRY_CIPHER_CAST5: return CIPHER_ALGO_CAST5;
	case GCRY_CIPHER_BLOWFISH: return CIPHER_ALGO_BLOWFISH;
	case GCRY_CIPHER_AES: return CIPHER_ALGO_AES;
	case GCRY_CIPHER_AES192: return CIPHER_ALGO_AES192;
	case GCRY_CIPHER_AES256: return CIPHER_ALGO_AES256;
	case GCRY_CIPHER_TWOFISH: return CIPHER_ALGO_TWOFISH;
	case GCRY_CIPHER_CAMELLIA128: return CIPHER_ALGO_CAMELLIA128;
	case GCRY_CIPHER_CAMELLIA192: return CIPHER_ALGO_CAMELLIA192;
	case GCRY_CIPHER_CAMELLIA256: return CIPHER_ALGO_CAMELLIA256;
	default: return 0;
	}
	}

	/* Map Gcrypt public key algorithm numbers to those used by OpenPGP.
	FIXME: This mapping is used at only two places - we should get rid
	of it. */
	pubkey_algo_t
	map_pk_gcry_to_openpgp (enum gcry_pk_algos algo)
	{
	switch (algo)
	{
	case GCRY_PK_EDDSA: return PUBKEY_ALGO_EDDSA;
	case GCRY_PK_ECDSA: return PUBKEY_ALGO_ECDSA;
	case GCRY_PK_ECDH: return PUBKEY_ALGO_ECDH;
	default: return algo < 110 ? (pubkey_algo_t)algo : 0;
	}
	}


	/* Return the block length of an OpenPGP cipher algorithm. */
	int
	openpgp_cipher_blocklen (cipher_algo_t algo)
	{
	/* We use the numbers from OpenPGP to be sure that we get the right
	block length. This is so that the packet parsing code works even
	for unknown algorithms (for which we assume 8 due to tradition).

	NOTE: If you change the returned blocklen above 16, check
	the callers because they may use a fixed size buffer of that
	size. */
	switch (algo)
	{
	case CIPHER_ALGO_AES:
	case CIPHER_ALGO_AES192:
	case CIPHER_ALGO_AES256:
	case CIPHER_ALGO_TWOFISH:
	case CIPHER_ALGO_CAMELLIA128:
	case CIPHER_ALGO_CAMELLIA192:
	case CIPHER_ALGO_CAMELLIA256:
	return 16;

	default:
	return 8;
	}
	}

	/****************
	* Wrapper around the libgcrypt function with additional checks on
	* the OpenPGP contraints for the algo ID.
	*/
	int
	openpgp_cipher_test_algo (cipher_algo_t algo)
	{
	enum gcry_cipher_algos ga;

	ga = map_cipher_openpgp_to_gcry (algo);
	if (!ga)
	return gpg_error (GPG_ERR_CIPHER_ALGO);

	return gcry_cipher_test_algo (ga);
	}

	/* Map the OpenPGP cipher algorithm whose ID is contained in ALGORITHM to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_cipher_algo_name (cipher_algo_t algo)
	{
	switch (algo)
	{
	case CIPHER_ALGO_IDEA: return "IDEA";
	case CIPHER_ALGO_3DES: return "3DES";
	case CIPHER_ALGO_CAST5: return "CAST5";
	case CIPHER_ALGO_BLOWFISH: return "BLOWFISH";
	case CIPHER_ALGO_AES: return "AES";
	case CIPHER_ALGO_AES192: return "AES192";
	case CIPHER_ALGO_AES256: return "AES256";
	case CIPHER_ALGO_TWOFISH: return "TWOFISH";
	case CIPHER_ALGO_CAMELLIA128: return "CAMELLIA128";
	case CIPHER_ALGO_CAMELLIA192: return "CAMELLIA192";
	case CIPHER_ALGO_CAMELLIA256: return "CAMELLIA256";
	case CIPHER_ALGO_NONE:
	default: return "?";
	}
	}


	/* Same as openpgp_cipher_algo_name but returns a string in the form
	* "ALGO.MODE" if AEAD is not 0. Note that in this version we do not
	* print "ALGO.CFB" as we do in 2.3 to avoid confusing users. */
	const char *
	openpgp_cipher_algo_mode_name (cipher_algo_t algo, aead_algo_t aead)
	{

	if (aead == AEAD_ALGO_NONE)
	return openpgp_cipher_algo_name (algo);

	return map_static_strings ("openpgp_cipher_algo_mode_name", algo, aead,
	openpgp_cipher_algo_name (algo),
	".",
	openpgp_aead_algo_name (aead),
	NULL);
	}


	/* Return 0 if ALGO is supported. Return an error if not. */
	gpg_error_t
	openpgp_aead_test_algo (aead_algo_t algo)
	{
	/* FIXME: We currently have no easy way to test whether libgcrypt
	* implements a mode. The only way we can do this is to open a
	* cipher context with that mode and close it immediately. That is
	* a bit costly. So we look at the libgcrypt version and assume
	* nothing has been patched out. */
	switch (algo)
	{
	case AEAD_ALGO_NONE:
	break;

	case AEAD_ALGO_EAX:
	#if GCRYPT_VERSION_NUMBER < 0x010900
	break;
	#else
	return 0;
	#endif

	case AEAD_ALGO_OCB:
	return 0;
	}

	return gpg_error (GPG_ERR_INV_CIPHER_MODE);
	}


	/* Map the OpenPGP AEAD algorithm with ID ALGO to a string
	* representation of the algorithm name. For unknown algorithm IDs
	* this function returns "?". */
	const char *
	openpgp_aead_algo_name (aead_algo_t algo)
	{
	switch (algo)
	{
	case AEAD_ALGO_NONE: break;
	case AEAD_ALGO_EAX: return "EAX";
	case AEAD_ALGO_OCB: return "OCB";
	}

	return "?";
	}


	/* Return information for the AEAD algorithm ALGO. The corresponding
	* Libgcrypt ciphermode is stored at R_MODE and the required number of
	* octets for the nonce at R_NONCELEN. On error and error code is
	* returned. Note that the taglen is always 128 bits. */
	gpg_error_t
	openpgp_aead_algo_info (aead_algo_t algo, enum gcry_cipher_modes *r_mode,
	unsigned int *r_noncelen)
	{
	switch (algo)
	{
	case AEAD_ALGO_OCB:
	*r_mode = GCRY_CIPHER_MODE_OCB;
	*r_noncelen = 15;
	break;

	case AEAD_ALGO_EAX: /* Only for decryption of some old data. */
	*r_mode = MY_GCRY_CIPHER_MODE_EAX;
	*r_noncelen = 16;
	break;

	default:
	log_error ("unsupported AEAD algo %d\n", algo);
	return gpg_error (GPG_ERR_INV_CIPHER_MODE);
	}
	return 0;
	}


	/* Return 0 if ALGO is a supported OpenPGP public key algorithm. */
	int
	openpgp_pk_test_algo (pubkey_algo_t algo)
	{
	return openpgp_pk_test_algo2 (algo, 0);
	}


	/* Return 0 if ALGO is a supported OpenPGP public key algorithm and
	allows the usage USE. */
	int
	openpgp_pk_test_algo2 (pubkey_algo_t algo, unsigned int use)
	{
	enum gcry_pk_algos ga = 0;
	size_t use_buf = use;

	switch (algo)
	{
	#ifdef GPG_USE_RSA
	case PUBKEY_ALGO_RSA: ga = GCRY_PK_RSA; break;
	case PUBKEY_ALGO_RSA_E: ga = GCRY_PK_RSA_E; break;
	case PUBKEY_ALGO_RSA_S: ga = GCRY_PK_RSA_S; break;
	#else
	case PUBKEY_ALGO_RSA: break;
	case PUBKEY_ALGO_RSA_E: break;
	case PUBKEY_ALGO_RSA_S: break;
	#endif

	case PUBKEY_ALGO_ELGAMAL_E: ga = GCRY_PK_ELG; break;
	case PUBKEY_ALGO_DSA: ga = GCRY_PK_DSA; break;

	#ifdef GPG_USE_ECDH
	case PUBKEY_ALGO_ECDH: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_ECDH: break;
	#endif

	#ifdef GPG_USE_ECDSA
	case PUBKEY_ALGO_ECDSA: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_ECDSA: break;
	#endif

	#ifdef GPG_USE_EDDSA
	case PUBKEY_ALGO_EDDSA: ga = GCRY_PK_ECC; break;
	#else
	case PUBKEY_ALGO_EDDSA: break;
	#endif

	case PUBKEY_ALGO_ELGAMAL:
	/* Dont't allow type 20 keys unless in rfc2440 mode. */
	if (RFC2440)
	ga = GCRY_PK_ELG;
	break;

	default:
	break;
	}
	if (!ga)
	return gpg_error (GPG_ERR_PUBKEY_ALGO);

	/* Elgamal in OpenPGP used to support signing and Libgcrypt still
	* does. However, we removed the signing capability from gpg ages
	* ago. This function should reflect this so that errors are thrown
	* early and not only when we try to sign using Elgamal. */
	if (ga == GCRY_PK_ELG && (use & (PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG)))
	return gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO);

	/* Now check whether Libgcrypt has support for the algorithm. */
	return gcry_pk_algo_info (ga, GCRYCTL_TEST_ALGO, NULL, &use_buf);
	}


	int
	openpgp_pk_algo_usage ( int algo )
	{
	int use = 0;

	/* They are hardwired in gpg 1.0. */
	switch ( algo ) {
	case PUBKEY_ALGO_RSA:
	use = (PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG
	- \| PUBKEY_USAGE_ENC \| PUBKEY_USAGE_AUTH);
	+ \| PUBKEY_USAGE_ENC \| PUBKEY_USAGE_RENC \| PUBKEY_USAGE_AUTH);
	break;
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_ECDH:
	- use = PUBKEY_USAGE_ENC;
	+ use = PUBKEY_USAGE_ENC \| PUBKEY_USAGE_RENC;
	break;
	case PUBKEY_ALGO_RSA_S:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG;
	break;
	case PUBKEY_ALGO_ELGAMAL:
	if (RFC2440)
	- use = PUBKEY_USAGE_ENC;
	+ use = PUBKEY_USAGE_ENC \| PUBKEY_USAGE_RENC;
	break;
	case PUBKEY_ALGO_ELGAMAL_E:
	- use = PUBKEY_USAGE_ENC;
	+ use = PUBKEY_USAGE_ENC \| PUBKEY_USAGE_RENC;
	break;
	case PUBKEY_ALGO_DSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_AUTH;
	break;
	case PUBKEY_ALGO_ECDSA:
	case PUBKEY_ALGO_EDDSA:
	use = PUBKEY_USAGE_CERT \| PUBKEY_USAGE_SIG \| PUBKEY_USAGE_AUTH;
	default:
	break;
	}
	return use;
	}

	/* Map the OpenPGP pubkey algorithm whose ID is contained in ALGO to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_pk_algo_name (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return "RSA";
	case PUBKEY_ALGO_ELGAMAL:
	case PUBKEY_ALGO_ELGAMAL_E: return "ELG";
	case PUBKEY_ALGO_DSA: return "DSA";
	case PUBKEY_ALGO_ECDH: return "ECDH";
	case PUBKEY_ALGO_ECDSA: return "ECDSA";
	case PUBKEY_ALGO_EDDSA: return "EDDSA";
	default: return "?";
	}
	}


	/* Explicit mapping of OpenPGP digest algos to Libgcrypt. */
	/* FIXME: We do not yes use it everywhere. */
	enum gcry_md_algos
	map_md_openpgp_to_gcry (digest_algo_t algo)
	{
	switch (algo)
	{
	#ifdef GPG_USE_MD5
	case DIGEST_ALGO_MD5: return GCRY_MD_MD5;
	#else
	case DIGEST_ALGO_MD5: return 0;
	#endif

	case DIGEST_ALGO_SHA1: return GCRY_MD_SHA1;

	#ifdef GPG_USE_RMD160
	case DIGEST_ALGO_RMD160: return GCRY_MD_RMD160;
	#else
	case DIGEST_ALGO_RMD160: return 0;
	#endif

	#ifdef GPG_USE_SHA224
	case DIGEST_ALGO_SHA224: return GCRY_MD_SHA224;
	#else
	case DIGEST_ALGO_SHA224: return 0;
	#endif

	case DIGEST_ALGO_SHA256: return GCRY_MD_SHA256;

	#ifdef GPG_USE_SHA384
	case DIGEST_ALGO_SHA384: return GCRY_MD_SHA384;
	#else
	case DIGEST_ALGO_SHA384: return 0;
	#endif

	#ifdef GPG_USE_SHA512
	case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
	#else
	case DIGEST_ALGO_SHA512: return 0;
	#endif
	default: return 0;
	}
	}


	/* Return 0 if ALGO is suitable and implemented OpenPGP hash
	algorithm. */
	int
	openpgp_md_test_algo (digest_algo_t algo)
	{
	enum gcry_md_algos ga;

	ga = map_md_openpgp_to_gcry (algo);
	if (!ga)
	return gpg_error (GPG_ERR_DIGEST_ALGO);

	return gcry_md_test_algo (ga);
	}


	/* Map the OpenPGP digest algorithm whose ID is contained in ALGO to a
	string representation of the algorithm name. For unknown algorithm
	IDs this function returns "?". */
	const char *
	openpgp_md_algo_name (int algo)
	{
	switch (algo)
	{
	case DIGEST_ALGO_MD5: return "MD5";
	case DIGEST_ALGO_SHA1: return "SHA1";
	case DIGEST_ALGO_RMD160: return "RIPEMD160";
	case DIGEST_ALGO_SHA256: return "SHA256";
	case DIGEST_ALGO_SHA384: return "SHA384";
	case DIGEST_ALGO_SHA512: return "SHA512";
	case DIGEST_ALGO_SHA224: return "SHA224";
	}
	return "?";
	}


	static unsigned long
	get_signature_count (PKT_public_key *pk)
	{
	#ifdef ENABLE_CARD_SUPPORT
	struct agent_card_info_s info;

	(void)pk;
	if (!agent_scd_getattr ("SIG-COUNTER",&info))
	return info.sig_counter;
	else
	return 0;
	#else
	(void)pk;
	return 0;
	#endif
	}

	/* Expand %-strings. Returns a string which must be xfreed. Returns
	NULL if the string cannot be expanded (too large). */
	char *
	pct_expando(const char string,struct expando_args args)
	{
	const char *ch=string;
	int idx=0,maxlen=0,done=0;
	u32 pk_keyid[2]={0,0},sk_keyid[2]={0,0};
	char *ret=NULL;

	/* The parser below would return NULL for an empty string, thus we
	* catch it here. Also catch NULL here. */
	if (!string \|\| !*string)
	return xstrdup ("");

	if(args->pk)
	keyid_from_pk(args->pk,pk_keyid);

	if(args->pksk)
	keyid_from_pk (args->pksk, sk_keyid);

	/* This is used so that %k works in photoid command strings in
	--list-secret-keys (which of course has a sk, but no pk). */
	if(!args->pk && args->pksk)
	keyid_from_pk (args->pksk, pk_keyid);

	while(*ch!='\0')
	{
	if(!done)
	{
	/* 8192 is way bigger than we'll need here */
	if(maxlen>=8192)
	goto fail;

	maxlen+=1024;
	ret=xrealloc(ret,maxlen);
	}

	done=0;

	if(*ch=='%')
	{
	switch(*(ch+1))
	{
	case 's': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)sk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'S': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)sk_keyid[0],(ulong)sk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'k': /* short key id */
	if(idx+8<maxlen)
	{
	sprintf(&ret[idx],"%08lX",(ulong)pk_keyid[1]);
	idx+=8;
	done=1;
	}
	break;

	case 'K': /* long key id */
	if(idx+16<maxlen)
	{
	sprintf(&ret[idx],"%08lX%08lX",
	(ulong)pk_keyid[0],(ulong)pk_keyid[1]);
	idx+=16;
	done=1;
	}
	break;

	case 'U': /* z-base-32 encoded user id hash. */
	if (args->namehash)
	{
	char tmp = zb32_encode (args->namehash, 820);
	if (tmp)
	{
	if (idx + strlen (tmp) < maxlen)
	{
	strcpy (ret+idx, tmp);
	idx += strlen (tmp);
	}
	xfree (tmp);
	done = 1;
	}
	}
	break;

	case 'c': /* signature count from card, if any. */
	if(idx+10<maxlen)
	{
	sprintf (&ret[idx],"%lu", get_signature_count (args->pksk));
	idx+=strlen(&ret[idx]);
	done=1;
	}
	break;

	case 'f': /* Fingerprint of key being signed */
	case 'p': /* Fingerprint of the primary key making the signature. */
	case 'g': /* Fingerprint of the key making the signature. */
	{
	byte array[MAX_FINGERPRINT_LEN];
	size_t len;
	int i;

	if ((*(ch+1))=='f' && args->pk)
	fingerprint_from_pk (args->pk, array, &len);
	else if ((*(ch+1))=='p' && args->pksk)
	{
	if(args->pksk->flags.primary)
	fingerprint_from_pk (args->pksk, array, &len);
	else if (args->pksk->main_keyid[0]
	\|\| args->pksk->main_keyid[1])
	{
	/* Not the primary key: Find the fingerprint
	of the primary key. */
	PKT_public_key *pk=
	xmalloc_clear(sizeof(PKT_public_key));

	if (!get_pubkey_fast (pk,args->pksk->main_keyid))
	fingerprint_from_pk (pk, array, &len);
	else
	memset (array, 0, (len=MAX_FINGERPRINT_LEN));
	free_public_key (pk);
	}
	else /* Oops: info about the primary key missing. */
	memset(array,0,(len=MAX_FINGERPRINT_LEN));
	}
	else if((*(ch+1))=='g' && args->pksk)
	fingerprint_from_pk (args->pksk, array, &len);
	else
	memset(array,0,(len=MAX_FINGERPRINT_LEN));

	if(idx+(len*2)<maxlen)
	{
	for(i=0;i<len;i++)
	{
	sprintf(&ret[idx],"%02X",array[i]);
	idx+=2;
	}
	done=1;
	}
	}
	break;

	case 'v': /* validity letters */
	if(args->validity_info && idx+1<maxlen)
	{
	ret[idx++]=args->validity_info;
	ret[idx]='\0';
	done=1;
	}
	break;

	/* The text string types */
	case 't':
	case 'T':
	case 'V':
	{
	const char *str=NULL;

	switch(*(ch+1))
	{
	case 't': /* e.g. "jpg" */
	str=image_type_to_string(args->imagetype,0);
	break;

	case 'T': /* e.g. "image/jpeg" */
	str=image_type_to_string(args->imagetype,2);
	break;

	case 'V': /* e.g. "full", "expired", etc. */
	str=args->validity_string;
	break;
	}

	if(str && idx+strlen(str)<maxlen)
	{
	strcpy(&ret[idx],str);
	idx+=strlen(str);
	done=1;
	}
	}
	break;

	case '%':
	if(idx+1<maxlen)
	{
	ret[idx++]='%';
	ret[idx]='\0';
	done=1;
	}
	break;

	/* Any unknown %-keys (like %i, %o, %I, and %O) are
	passed through for later expansion. Note this also
	handles the case where the last character in the
	string is a '%' - the terminating \0 will end up here
	and properly terminate the string. */
	default:
	if(idx+2<maxlen)
	{
	ret[idx++]='%';
	ret[idx++]=*(ch+1);
	ret[idx]='\0';
	done=1;
	}
	break;
	}

	if(done)
	ch++;
	}
	else
	{
	if(idx+1<maxlen)
	{
	ret[idx++]=*ch;
	ret[idx]='\0';
	done=1;
	}
	}

	if(done)
	ch++;
	}

	return ret;

	fail:
	xfree(ret);
	return NULL;
	}

	void
	deprecated_warning(const char *configname,unsigned int configlineno,
	const char option,const char repl1,const char *repl2)
	{
	if(configname)
	{
	if(strncmp("--",option,2)==0)
	option+=2;

	if(strncmp("--",repl1,2)==0)
	repl1+=2;

	log_info(_("%s:%d: deprecated option \"%s\"\n"),
	configname,configlineno,option);
	}
	else
	log_info(_("WARNING: \"%s\" is a deprecated option\n"),option);

	log_info(_("please use \"%s%s\" instead\n"),repl1,repl2);
	}


	void
	deprecated_command (const char *name)
	{
	log_info(_("WARNING: \"%s\" is a deprecated command - do not use it\n"),
	name);
	}


	void
	obsolete_scdaemon_option (const char *configname, unsigned int configlineno,
	const char *name)
	{
	if (configname)
	log_info (_("%s:%u: \"%s\" is obsolete in this file"
	" - it only has effect in %s\n"),
	configname, configlineno, name, SCDAEMON_NAME EXTSEP_S "conf");
	else
	log_info (_("WARNING: \"%s%s\" is an obsolete option"
	" - it has no effect except on %s\n"),
	"--", name, SCDAEMON_NAME);
	}


	/*
	* Wrapper around gcry_cipher_map_name to provide a fallback using the
	* "Sn" syntax as used by the preference strings.
	*/
	int
	string_to_cipher_algo (const char *string)
	{
	int val;

	val = map_cipher_gcry_to_openpgp (gcry_cipher_map_name (string));
	if (!val && string && (string[0]=='S' \|\| string[0]=='s'))
	{
	char *endptr;

	string++;
	val = strtol (string, &endptr, 10);
	if (!string \|\| endptr \|\| openpgp_cipher_test_algo (val))
	val = 0;
	}

	return val;
	}

	/*
	* Wrapper around gcry_md_map_name to provide a fallback using the
	* "Hn" syntax as used by the preference strings.
	*/
	int
	string_to_digest_algo (const char *string)
	{
	int val;

	/* FIXME: We should make use of our wrapper function and not assume
	that there is a 1 to 1 mapping between OpenPGP and Libgcrypt. */
	val = gcry_md_map_name (string);
	if (!val && string && (string[0]=='H' \|\| string[0]=='h'))
	{
	char *endptr;

	string++;
	val = strtol (string, &endptr, 10);
	if (!string \|\| endptr \|\| openpgp_md_test_algo (val))
	val = 0;
	}

	return val;
	}



	const char *
	compress_algo_to_string(int algo)
	{
	const char *s=NULL;

	switch(algo)
	{
	case COMPRESS_ALGO_NONE:
	s=_("Uncompressed");
	break;

	case COMPRESS_ALGO_ZIP:
	s="ZIP";
	break;

	case COMPRESS_ALGO_ZLIB:
	s="ZLIB";
	break;

	#ifdef HAVE_BZIP2
	case COMPRESS_ALGO_BZIP2:
	s="BZIP2";
	break;
	#endif
	}

	return s;
	}

	int
	string_to_compress_algo(const char *string)
	{
	/* TRANSLATORS: See doc/TRANSLATE about this string. */
	if(match_multistr(_("uncompressed\|none"),string))
	return 0;
	else if(ascii_strcasecmp(string,"uncompressed")==0)
	return 0;
	else if(ascii_strcasecmp(string,"none")==0)
	return 0;
	else if(ascii_strcasecmp(string,"zip")==0)
	return 1;
	else if(ascii_strcasecmp(string,"zlib")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"bzip2")==0)
	return 3;
	#endif
	else if(ascii_strcasecmp(string,"z0")==0)
	return 0;
	else if(ascii_strcasecmp(string,"z1")==0)
	return 1;
	else if(ascii_strcasecmp(string,"z2")==0)
	return 2;
	#ifdef HAVE_BZIP2
	else if(ascii_strcasecmp(string,"z3")==0)
	return 3;
	#endif
	else
	return -1;
	}

	int
	check_compress_algo(int algo)
	{
	switch (algo)
	{
	case 0: return 0;
	#ifdef HAVE_ZIP
	case 1:
	case 2: return 0;
	#endif
	#ifdef HAVE_BZIP2
	case 3: return 0;
	#endif
	default: return GPG_ERR_COMPR_ALGO;
	}
	}

	int
	default_cipher_algo(void)
	{
	if(opt.def_cipher_algo)
	return opt.def_cipher_algo;
	else if(opt.personal_cipher_prefs)
	return opt.personal_cipher_prefs[0].value;
	else
	return opt.s2k_cipher_algo;
	}

	/* There is no default_digest_algo function, but see
	sign.c:hash_for() */

	int
	default_compress_algo(void)
	{
	if(opt.compress_algo!=-1)
	return opt.compress_algo;
	else if(opt.personal_compress_prefs)
	return opt.personal_compress_prefs[0].value;
	else
	return DEFAULT_COMPRESS_ALGO;
	}


	void
	compliance_failure(void)
	{
	char *ver="???";

	switch(opt.compliance)
	{
	case CO_GNUPG:
	ver="GnuPG";
	break;

	case CO_RFC4880:
	ver="OpenPGP";
	break;

	case CO_RFC2440:
	ver="OpenPGP (older)";
	break;

	case CO_PGP6:
	ver="PGP 6.x";
	break;

	case CO_PGP7:
	ver="PGP 7.x";
	break;

	case CO_PGP8:
	ver="PGP 8.x";
	break;

	case CO_DE_VS:
	/* For de-vs we do not allow any kind of fallback. */
	write_status_failure ("compliance-check", gpg_error (GPG_ERR_FORBIDDEN));
	log_error (_("operation forced to fail due to"
	" unfulfilled compliance rules\n"));
	g10_errors_seen = 1;
	return;
	}

	log_info(_("this message may not be usable by %s\n"),ver);
	opt.compliance=CO_GNUPG;
	}

	/* Break a string into successive option pieces. Accepts single word
	options and key=value argument options. */
	char *
	optsep(char **stringp)
	{
	char tok,end;

	tok=*stringp;
	if(tok)
	{
	end=strpbrk(tok," ,=");
	if(end)
	{
	int sawequals=0;
	char *ptr=end;

	/* what we need to do now is scan along starting with *end,
	If the next character we see (ignoring spaces) is an =
	sign, then there is an argument. */

	while(*ptr)
	{
	if(*ptr=='=')
	sawequals=1;
	else if(*ptr!=' ')
	break;
	ptr++;
	}

	/* There is an argument, so grab that too. At this point,
	ptr points to the first character of the argument. */
	if(sawequals)
	{
	/* Is it a quoted argument? */
	if(*ptr=='"')
	{
	ptr++;
	end=strchr(ptr,'"');
	if(end)
	end++;
	}
	else
	end=strpbrk(ptr," ,");
	}

	if(end && *end)
	{
	*end='\0';
	*stringp=end+1;
	}
	else
	*stringp=NULL;
	}
	else
	*stringp=NULL;
	}

	return tok;
	}

	/* Breaks an option value into key and value. Returns NULL if there
	is no value. Note that "string" is modified to remove the =value
	part. */
	char *
	argsplit(char *string)
	{
	char equals,arg=NULL;

	equals=strchr(string,'=');
	if(equals)
	{
	char quote,space;

	*equals='\0';
	arg=equals+1;

	/* Quoted arg? */
	quote=strchr(arg,'"');
	if(quote)
	{
	arg=quote+1;

	quote=strchr(arg,'"');
	if(quote)
	*quote='\0';
	}
	else
	{
	size_t spaces;

	/* Trim leading spaces off of the arg */
	spaces=strspn(arg," ");
	arg+=spaces;
	}

	/* Trim tailing spaces off of the tag */
	space=strchr(string,' ');
	if(space)
	*space='\0';
	}

	return arg;
	}

	/* Return the length of the initial token, leaving off any
	argument. */
	static size_t
	optlen(const char *s)
	{
	char *end=strpbrk(s," =");

	if(end)
	return end-s;
	else
	return strlen(s);
	}

	int
	parse_options(char str,unsigned int options,
	struct parse_options *opts,int noisy)
	{
	char *tok;

	if (str && !strcmp (str, "help"))
	{
	int i,maxlen=0;

	/* Figure out the longest option name so we can line these up
	neatly. */
	for(i=0;opts[i].name;i++)
	if(opts[i].help && maxlen<strlen(opts[i].name))
	maxlen=strlen(opts[i].name);

	for(i=0;opts[i].name;i++)
	if(opts[i].help)
	es_printf("%s%*s%s\n",opts[i].name,
	maxlen+2-(int)strlen(opts[i].name),"",_(opts[i].help));

	g10_exit(0);
	}

	while((tok=optsep(&str)))
	{
	int i,rev=0;
	char *otok=tok;

	if(tok[0]=='\0')
	continue;

	if(ascii_strncasecmp("no-",tok,3)==0)
	{
	rev=1;
	tok+=3;
	}

	for(i=0;opts[i].name;i++)
	{
	size_t toklen=optlen(tok);

	if(ascii_strncasecmp(opts[i].name,tok,toklen)==0)
	{
	/* We have a match, but it might be incomplete */
	if(toklen!=strlen(opts[i].name))
	{
	int j;

	for(j=i+1;opts[j].name;j++)
	{
	if(ascii_strncasecmp(opts[j].name,tok,toklen)==0)
	{
	if(noisy)
	log_info(_("ambiguous option '%s'\n"),otok);
	return 0;
	}
	}
	}

	if(rev)
	{
	*options&=~opts[i].bit;
	if(opts[i].value)
	*opts[i].value=NULL;
	}
	else
	{
	*options\|=opts[i].bit;
	if(opts[i].value)
	*opts[i].value=argsplit(tok);
	}
	break;
	}
	}

	if(!opts[i].name)
	{
	if(noisy)
	log_info(_("unknown option '%s'\n"),otok);
	return 0;
	}
	}

	return 1;
	}


	/* Similar to access(2), but uses PATH to find the file. */
	int
	path_access(const char *file,int mode)
	{
	char *envpath;
	int ret=-1;

	envpath=getenv("PATH");

	if(!envpath
	#ifdef HAVE_DRIVE_LETTERS
	\|\| (((file[0]>='A' && file[0]<='Z')
	\|\| (file[0]>='a' && file[0]<='z'))
	&& file[1]==':')
	#else
	\|\| file[0]=='/'
	#endif
	)
	return access(file,mode);
	else
	{
	/* At least as large as, but most often larger than we need. */
	char *buffer=xmalloc(strlen(envpath)+1+strlen(file)+1);
	char split,item,*path=xstrdup(envpath);

	split=path;

	while((item=strsep(&split,PATHSEP_S)))
	{
	strcpy(buffer,item);
	strcat(buffer,"/");
	strcat(buffer,file);
	ret=access(buffer,mode);
	if(ret==0)
	break;
	}

	xfree(path);
	xfree(buffer);
	}

	return ret;
	}



	/* Return the number of public key parameters as used by OpenPGP. */
	int
	pubkey_get_npkey (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 2;
	case PUBKEY_ALGO_ELGAMAL_E: return 3;
	case PUBKEY_ALGO_DSA: return 4;
	case PUBKEY_ALGO_ECDH: return 3;
	case PUBKEY_ALGO_ECDSA: return 2;
	case PUBKEY_ALGO_ELGAMAL: return 3;
	case PUBKEY_ALGO_EDDSA: return 2;
	default: return 0;
	}
	}


	/* Return the number of secret key parameters as used by OpenPGP. */
	int
	pubkey_get_nskey (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 6;
	case PUBKEY_ALGO_ELGAMAL_E: return 4;
	case PUBKEY_ALGO_DSA: return 5;
	case PUBKEY_ALGO_ECDH: return 4;
	case PUBKEY_ALGO_ECDSA: return 3;
	case PUBKEY_ALGO_ELGAMAL: return 4;
	case PUBKEY_ALGO_EDDSA: return 3;
	default: return 0;
	}
	}

	/* Temporary helper. */
	int
	pubkey_get_nsig (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 1;
	case PUBKEY_ALGO_ELGAMAL_E: return 0;
	case PUBKEY_ALGO_DSA: return 2;
	case PUBKEY_ALGO_ECDH: return 0;
	case PUBKEY_ALGO_ECDSA: return 2;
	case PUBKEY_ALGO_ELGAMAL: return 2;
	case PUBKEY_ALGO_EDDSA: return 2;
	default: return 0;
	}
	}


	/* Temporary helper. */
	int
	pubkey_get_nenc (pubkey_algo_t algo)
	{
	switch (algo)
	{
	case PUBKEY_ALGO_RSA:
	case PUBKEY_ALGO_RSA_E:
	case PUBKEY_ALGO_RSA_S: return 1;
	case PUBKEY_ALGO_ELGAMAL_E: return 2;
	case PUBKEY_ALGO_DSA: return 0;
	case PUBKEY_ALGO_ECDH: return 2;
	case PUBKEY_ALGO_ECDSA: return 0;
	case PUBKEY_ALGO_ELGAMAL: return 2;
	case PUBKEY_ALGO_EDDSA: return 0;
	default: return 0;
	}
	}


	/* Temporary helper. */
	unsigned int
	pubkey_nbits( int algo, gcry_mpi_t *key )
	{
	int rc, nbits;
	gcry_sexp_t sexp;

	if (algo == PUBKEY_ALGO_DSA
	&& key[0] && key[1] && key[2] && key[3])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
	key[0], key[1], key[2], key[3] );
	}
	else if ((algo == PUBKEY_ALGO_ELGAMAL \|\| algo == PUBKEY_ALGO_ELGAMAL_E)
	&& key[0] && key[1] && key[2])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(elg(p%m)(g%m)(y%m)))",
	key[0], key[1], key[2] );
	}
	else if (is_RSA (algo)
	&& key[0] && key[1])
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(rsa(n%m)(e%m)))",
	key[0], key[1] );
	}
	else if ((algo == PUBKEY_ALGO_ECDSA \|\| algo == PUBKEY_ALGO_ECDH
	\|\| algo == PUBKEY_ALGO_EDDSA)
	&& key[0] && key[1])
	{
	char *curve = openpgp_oid_to_str (key[0]);
	if (!curve)
	rc = gpg_error_from_syserror ();
	else
	{
	rc = gcry_sexp_build (&sexp, NULL,
	"(public-key(ecc(curve%s)(q%m)))",
	curve, key[1]);
	xfree (curve);
	}
	}
	else
	return 0;

	if (rc)
	BUG ();

	nbits = gcry_pk_get_nbits (sexp);
	gcry_sexp_release (sexp);
	return nbits;
	}



	int
	mpi_print (estream_t fp, gcry_mpi_t a, int mode)
	{
	int n = 0;
	size_t nwritten;

	if (!a)
	return es_fprintf (fp, "[MPI_NULL]");
	if (!mode)
	{
	unsigned int n1;
	n1 = gcry_mpi_get_nbits(a);
	n += es_fprintf (fp, "[%u bits]", n1);
	}
	else if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
	{
	unsigned int nbits;
	unsigned char *p = gcry_mpi_get_opaque (a, &nbits);
	if (!p)
	n += es_fprintf (fp, "[invalid opaque value]");
	else
	{
	if (!es_write_hexstring (fp, p, (nbits + 7)/8, 0, &nwritten))
	n += nwritten;
	}
	}
	else
	{
	unsigned char *buffer;
	size_t buflen;

	if (gcry_mpi_aprint (GCRYMPI_FMT_USG, &buffer, &buflen, a))
	BUG ();
	if (!es_write_hexstring (fp, buffer, buflen, 0, &nwritten))
	n += nwritten;
	gcry_free (buffer);
	}
	return n;
	}


	/* pkey[1] or skey[1] is Q for ECDSA, which is an uncompressed point,
	i.e. 04 <x> <y> */
	unsigned int
	ecdsa_qbits_from_Q (unsigned int qbits)
	{
	if ((qbits%8) > 3)
	{
	log_error (_("ECDSA public key is expected to be in SEC encoding "
	"multiple of 8 bits\n"));
	return 0;
	}
	qbits -= qbits%8;
	qbits /= 2;
	return qbits;
	}


	/* Ignore signatures and certifications made over certain digest
	* algorithms by default, MD5 is considered weak. This allows users
	* to deprecate support for other algorithms as well.
	*/
	void
	additional_weak_digest (const char* digestname)
	{
	struct weakhash *weak = NULL;
	const enum gcry_md_algos algo = string_to_digest_algo(digestname);

	if (algo == GCRY_MD_NONE)
	{
	log_error (_("unknown weak digest '%s'\n"), digestname);
	return;
	}

	/* Check to ensure it's not already present. */
	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (algo == weak->algo)
	return;

	/* Add it to the head of the list. */
	weak = xmalloc(sizeof(*weak));
	weak->algo = algo;
	weak->rejection_shown = 0;
	weak->next = opt.weak_digests;
	opt.weak_digests = weak;
	}


	/* Return true if ALGO is in the list of weak digests. */
	int
	is_weak_digest (digest_algo_t algo)
	{
	const enum gcry_md_algos galgo = map_md_openpgp_to_gcry (algo);
	const struct weakhash *weak;

	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (weak->algo == galgo)
	return 1;
	return 0;
	}
	diff --git a/g10/packet.h b/g10/packet.h
	index e5bedac21..409d7d419 100644
	--- a/g10/packet.h
	+++ b/g10/packet.h
	@@ -1,946 +1,946 @@
	/* packet.h - OpenPGP packet definitions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef G10_PACKET_H
	#define G10_PACKET_H

	#include "../common/types.h"
	#include "../common/iobuf.h"
	#include "../common/strlist.h"
	#include "dek.h"
	#include "filter.h"
	#include "../common/openpgpdefs.h"
	#include "../common/userids.h"
	#include "../common/util.h"

	#define DEBUG_PARSE_PACKET 1

	/* Maximum length of packets to avoid excessive memory allocation. */
	#define MAX_KEY_PACKET_LENGTH (256 * 1024)
	#define MAX_UID_PACKET_LENGTH ( 2 * 1024)
	#define MAX_COMMENT_PACKET_LENGTH ( 64 * 1024)
	#define MAX_ATTR_PACKET_LENGTH ( 16 * 1024*1024)

	/* Constants to allocate static MPI arrays. */
	#define PUBKEY_MAX_NPKEY OPENPGP_MAX_NPKEY
	#define PUBKEY_MAX_NSKEY OPENPGP_MAX_NSKEY
	#define PUBKEY_MAX_NSIG OPENPGP_MAX_NSIG
	#define PUBKEY_MAX_NENC OPENPGP_MAX_NENC

	/* Usage flags */
	#define PUBKEY_USAGE_SIG GCRY_PK_USAGE_SIGN /* Good for signatures. */
	#define PUBKEY_USAGE_ENC GCRY_PK_USAGE_ENCR /* Good for encryption. */
	#define PUBKEY_USAGE_CERT GCRY_PK_USAGE_CERT /* Also good to certify keys.*/
	#define PUBKEY_USAGE_AUTH GCRY_PK_USAGE_AUTH /* Good for authentication. */
	#define PUBKEY_USAGE_UNKNOWN GCRY_PK_USAGE_UNKN /* Unknown usage flag. */
	#define PUBKEY_USAGE_NONE 256 /* No usage given. */
	#if (GCRY_PK_USAGE_SIGN \| GCRY_PK_USAGE_ENCR \| GCRY_PK_USAGE_CERT \
	\| GCRY_PK_USAGE_AUTH \| GCRY_PK_USAGE_UNKN) >= 256
	# error Please choose another value for PUBKEY_USAGE_NONE
	#endif
	#define PUBKEY_USAGE_GROUP 512 /* Group flag. */
	#define PUBKEY_USAGE_RENC 1024 /* Restricted encryption. */
	#define PUBKEY_USAGE_TIME 2048 /* Timestamp use. */

	/* Helper macros. */
	#define is_RSA(a) ((a)==PUBKEY_ALGO_RSA \|\| (a)==PUBKEY_ALGO_RSA_E \
	\|\| (a)==PUBKEY_ALGO_RSA_S )
	#define is_ELGAMAL(a) ((a)==PUBKEY_ALGO_ELGAMAL_E)
	#define is_DSA(a) ((a)==PUBKEY_ALGO_DSA)

	/* A pointer to the packet object. */
	typedef struct packet_struct PACKET;

	/* PKT_GPG_CONTROL types */
	typedef enum {
	CTRLPKT_CLEARSIGN_START = 1,
	CTRLPKT_PIPEMODE = 2,
	CTRLPKT_PLAINTEXT_MARK =3
	} ctrlpkttype_t;

	typedef enum {
	PREFTYPE_NONE = 0,
	PREFTYPE_SYM = 1,
	PREFTYPE_HASH = 2,
	PREFTYPE_ZIP = 3,
	PREFTYPE_AEAD = 4
	} preftype_t;

	typedef struct {
	byte type;
	byte value;
	} prefitem_t;

	/* A string-to-key specifier as defined in RFC 4880, Section 3.7. */
	typedef struct
	{
	int mode; /* Must be an integer due to the GNU modes 1001 et al. */
	byte hash_algo;
	byte salt[8];
	/* The coded (i.e., the serialized version) iteration count. */
	u32 count;
	} STRING2KEY;

	/* A symmetric-key encrypted session key packet as defined in RFC
	4880, Section 5.3. All fields are serialized. */
	typedef struct {
	/* RFC 4880: this must be 4. */
	byte version;
	/* The cipher algorithm used to encrypt the session key. (This may
	be different from the algorithm that is used to encrypt the SED
	packet.) */
	byte cipher_algo;
	/* The AEAD algorithm or 0 for CFB encryption. */
	byte aead_algo;
	/* The string-to-key specifier. */
	STRING2KEY s2k;
	/* The length of SESKEY in bytes or 0 if this packet does not
	encrypt a session key. (In the latter case, the results of the
	S2K function on the password is the session key. See RFC 4880,
	Section 5.3.) */
	byte seskeylen;
	/* The session key as encrypted by the S2K specifier. For AEAD this
	* includes the nonce and the authentication tag. */
	byte seskey[1];
	} PKT_symkey_enc;

	/* A public-key encrypted session key packet as defined in RFC 4880,
	Section 5.1. All fields are serialized. */
	typedef struct {
	/* The 64-bit keyid. */
	u32 keyid[2];
	/* The packet's version. Currently, only version 3 is defined. */
	byte version;
	/* The algorithm used for the public key encryption scheme. */
	byte pubkey_algo;
	/* Whether to hide the key id. This value is not directly
	serialized. */
	byte throw_keyid;
	/* The session key. */
	gcry_mpi_t data[PUBKEY_MAX_NENC];
	} PKT_pubkey_enc;


	/* A one-pass signature packet as defined in RFC 4880, Section
	5.4. All fields are serialized. */
	typedef struct {
	u32 keyid[2]; /* The 64-bit keyid */
	/* The signature's classification (RFC 4880, Section 5.2.1). */
	byte sig_class;
	byte digest_algo; /* algorithm used for digest */
	byte pubkey_algo; /* algorithm used for public key scheme */
	/* A message can be signed by multiple keys. In this case, there
	are n one-pass signature packets before the message to sign and
	n signatures packets after the message. It is conceivable that
	someone wants to not only sign the message, but all of the
	signatures. Now we need to distinguish between signing the
	message and signing the message plus the surrounding
	signatures. This is the point of this flag. If set, it means:
	I sign all of the data starting at the next packet. */
	byte last;
	} PKT_onepass_sig;


	/* A v4 OpenPGP signature has a hashed and unhashed area containing
	co-called signature subpackets (RFC 4880, Section 5.2.3). These
	areas are described by this data structure. Use enum_sig_subpkt to
	parse this area. */
	typedef struct {
	size_t size; /* allocated */
	size_t len; /* used (serialized) */
	byte data[1]; /* the serialized subpackes (serialized) */
	} subpktarea_t;

	/* The in-memory representation of a designated revoker signature
	subpacket (RFC 4880, Section 5.2.3.15). */
	struct revocation_key {
	/* A bit field. 0x80 must be set. 0x40 means this information is
	sensitive (and should not be uploaded to a keyserver by
	default). */
	byte class;
	/* The public-key algorithm ID. */
	byte algid;
	/* The fingerprint of the authorized key. */
	byte fpr[MAX_FINGERPRINT_LEN];
	};


	/* Object to keep information about a PKA DNS record. */
	typedef struct
	{
	int valid; /* An actual PKA record exists for EMAIL. */
	int checked; /* Set to true if the FPR has been checked against the
	actual key. */
	char uri; / Malloced string with the URI. NULL if the URI is
	not available.*/
	unsigned char fpr[20]; /* The fingerprint as stored in the PKA RR. */
	char email[1];/* The email address from the notation data. */
	} pka_info_t;


	/* A signature packet (RFC 4880, Section 5.2). Only a subset of these
	fields are directly serialized (these are marked as such); the rest
	are read from the subpackets, which are not synthesized when
	serializing this data structure (i.e., when using build_packet()).
	Instead, the subpackets must be created by hand. */
	typedef struct
	{
	struct
	{
	unsigned checked:1; /* Signature has been checked. */
	unsigned valid:1; /* Signature is good (if checked is set). */
	unsigned chosen_selfsig:1; /* A selfsig that is the chosen one. */
	unsigned unknown_critical:1;
	unsigned exportable:1;
	unsigned revocable:1;
	unsigned policy_url:1; /* At least one policy URL is present */
	unsigned notation:1; /* At least one notation is present */
	unsigned pref_ks:1; /* At least one preferred keyserver is present */
	unsigned key_block:1; /* A key block subpacket is present. */
	unsigned expired:1;
	unsigned pka_tried:1; /* Set if we tried to retrieve the PKA record. */
	} flags;
	/* The key that allegedly generated this signature. (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as an issuer subpacket (5.2.3.5.) */
	u32 keyid[2];
	/* When the signature was made (seconds since the Epoch). (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as a signature creation time subpacket (5.2.3.4).) */
	u32 timestamp;
	u32 expiredate; /* Expires at this date or 0 if not at all. */
	/* The serialization format used / to use. If 0, then defaults to
	version 3. (Serialized.) */
	byte version;
	/* The signature type. (See RFC 4880, Section 5.2.1.) */
	byte sig_class;
	/* Algorithm used for public key scheme (e.g., PUBKEY_ALGO_RSA).
	(Serialized.) */
	byte pubkey_algo;
	/* Algorithm used for digest (e.g., DIGEST_ALGO_SHA1).
	(Serialized.) */
	byte digest_algo;
	byte trust_depth;
	byte trust_value;
	const byte *trust_regexp;
	struct revocation_key *revkey;
	int numrevkeys;
	int help_counter; /* Used internally bu some fucntions. */
	pka_info_t pka_info; / Malloced PKA data or NULL if not
	available. See also flags.pka_tried. */
	char signers_uid; / Malloced value of the SIGNERS_UID
	* subpacket or NULL. This string has
	* already been sanitized. */
	subpktarea_t hashed; / All subpackets with hashed data (v4 only). */
	subpktarea_t unhashed; / Ditto for unhashed data. */
	/* First 2 bytes of the digest. (Serialized. Note: this is not
	automatically filled in when serializing a signature!) */
	byte digest_start[2];
	/* The signature. (Serialized.) */
	gcry_mpi_t data[PUBKEY_MAX_NSIG];
	/* The message digest and its length (in bytes). Note the maximum
	digest length is 512 bits (64 bytes). If DIGEST_LEN is 0, then
	the digest's value has not been saved here. */
	byte digest[512 / 8];
	int digest_len;
	} PKT_signature;

	#define ATTRIB_IMAGE 1

	/* This is the cooked form of attributes. */
	struct user_attribute {
	byte type;
	const byte *data;
	u32 len;
	};


	/* A user id (RFC 4880, Section 5.11) or a user attribute packet (RFC
	4880, Section 5.12). Only a subset of these fields are directly
	serialized (these are marked as such); the rest are read from the
	self-signatures in merge_keys_and_selfsig()). */
	typedef struct
	{
	int ref; /* reference counter */
	/* The length of NAME. */
	int len;
	struct user_attribute *attribs;
	int numattribs;
	/* If this is not NULL, the packet is a user attribute rather than a
	user id (See RFC 4880 5.12). (Serialized.) */
	byte *attrib_data;
	/* The length of ATTRIB_DATA. */
	unsigned long attrib_len;
	byte *namehash;
	- int help_key_usage;
	+ u16 help_key_usage;
	u32 help_key_expire;
	int help_full_count;
	int help_marginal_count;
	u32 expiredate; /* expires at this date or 0 if not at all */
	prefitem_t prefs; / list of preferences (may be NULL)*/
	u32 created; /* according to the self-signature */
	u32 keyupdate; /* From the ring trust packet. */
	char updateurl; / NULL or the URL of the last update origin. */
	byte keyorg; /* From the ring trust packet. */
	byte selfsigversion;
	struct
	{
	unsigned int mdc:1;
	unsigned int aead:1;
	unsigned int ks_modify:1;
	unsigned int compacted:1;
	unsigned int primary:2; /* 2 if set via the primary flag, 1 if calculated */
	unsigned int revoked:1;
	unsigned int expired:1;
	} flags;

	char mbox; / NULL or the result of mailbox_from_userid. */

	/* The text contained in the user id packet, which is normally the
	* name and email address of the key holder (See RFC 4880 5.11).
	* (Serialized.). For convenience an extra Nul is always appended. */
	char name[1];
	} PKT_user_id;



	struct revoke_info
	{
	/* revoked at this date */
	u32 date;
	/* the keyid of the revoking key (selfsig or designated revoker) */
	u32 keyid[2];
	/* the algo of the revoking key */
	byte algo;
	};


	/* Information pertaining to secret keys. */
	struct seckey_info
	{
	int is_protected:1; /* The secret info is protected and must */
	/* be decrypted before use, the protected */
	/* MPIs are simply (void) pointers to memory /
	/* and should never be passed to a mpi_xxx() */
	int sha1chk:1; /* SHA1 is used instead of a 16 bit checksum */
	u16 csum; /* Checksum for old protection modes. */
	byte algo; /* Cipher used to protect the secret information. */
	STRING2KEY s2k; /* S2K parameter. */
	byte ivlen; /* Used length of the IV. */
	byte iv[16]; /* Initialization vector for CFB mode. */
	};


	/****************
	* The in-memory representation of a public key (RFC 4880, Section
	* 5.5). Note: this structure contains significantly more information
	* than is contained in an OpenPGP public key packet. This
	* information is derived from the self-signed signatures (by
	* merge_keys_and_selfsig()) and is ignored when serializing the
	* packet. The fields that are actually written out when serializing
	* this packet are marked as accordingly.
	*
	* We assume that secret keys have the same number of parameters as
	* the public key and that the public parameters are the first items
	* in the PKEY array. Thus NPKEY is always less than NSKEY and it is
	* possible to compare the secret and public keys by comparing the
	* first NPKEY elements of the PKEY array. Note that since GnuPG 2.1
	* we don't use secret keys anymore directly because they are managed
	* by gpg-agent. However for parsing OpenPGP key files we need a way
	* to temporary store those secret keys. We do this by putting them
	* into the public key structure and extending the PKEY field to NSKEY
	* elements; the extra secret key information are stored in the
	* SECKEY_INFO field.
	*/
	typedef struct
	{
	/* When the key was created. (Serialized.) */
	u32 timestamp;
	u32 expiredate; /* expires at this date or 0 if not at all */
	u32 max_expiredate; /* must not expire past this date */
	struct revoke_info revoked;
	/* An OpenPGP packet consists of a header and a body. This is the
	size of the header. If this is 0, an appropriate size is
	automatically chosen based on the size of the body.
	(Serialized.) */
	byte hdrbytes;
	/* The serialization format. If 0, the default version (4) is used
	when serializing. (Serialized.) */
	byte version;
	byte selfsigversion; /* highest version of all of the self-sigs */
	/* The public key algorithm. (Serialized.) */
	byte pubkey_algo;
	- byte pubkey_usage; /* for now only used to pass it to getkey() */
	+ u16 pubkey_usage; /* carries the usage info. */
	byte req_usage; /* hack to pass a request to getkey() */
	u32 has_expired; /* set to the expiration date if expired */
	/* keyid of the primary key. Never access this value directly.
	Instead, use pk_main_keyid(). */
	u32 main_keyid[2];
	/* keyid of this key. Never access this value directly! Instead,
	use pk_keyid(). */
	u32 keyid[2];
	prefitem_t prefs; / list of preferences (may be NULL) */
	struct
	{
	unsigned int mdc:1; /* MDC feature set. */
	unsigned int aead:1; /* AEAD feature set. */
	unsigned int disabled_valid:1;/* The next flag is valid. */
	unsigned int disabled:1; /* The key has been disabled. */
	unsigned int primary:1; /* This is a primary key. */
	unsigned int revoked:2; /* Key has been revoked.
	1 = revoked by the owner
	2 = revoked by designated revoker. */
	unsigned int maybe_revoked:1; /* A designated revocation is
	present, but without the key to
	check it. */
	unsigned int valid:1; /* Key (especially subkey) is valid. */
	unsigned int dont_cache:1; /* Do not cache this key. */
	unsigned int backsig:2; /* 0=none, 1=bad, 2=good. */
	unsigned int serialno_valid:1;/* SERIALNO below is valid. */
	unsigned int exact:1; /* Found via exact (!) search. */
	} flags;
	PKT_user_id user_id; / If != NULL: found by that uid. */
	struct revocation_key *revkey;
	int numrevkeys;
	u32 trust_timestamp;
	byte trust_depth;
	byte trust_value;
	byte keyorg; /* From the ring trust packet. */
	u32 keyupdate; /* From the ring trust packet. */
	char updateurl; / NULL or the URL of the last update origin. */
	const byte *trust_regexp;
	char serialno; / Malloced hex string or NULL if it is
	likely not on a card. See also
	flags.serialno_valid. */
	/* If not NULL this malloced structure describes a secret key.
	(Serialized.) */
	struct seckey_info *seckey_info;
	/* The public key. Contains pubkey_get_npkey (pubkey_algo) +
	pubkey_get_nskey (pubkey_algo) MPIs. (If pubkey_get_npkey
	returns 0, then the algorithm is not understood and the PKEY
	contains a single opaque MPI.) (Serialized.) */
	gcry_mpi_t pkey[PUBKEY_MAX_NSKEY]; /* Right, NSKEY elements. */
	} PKT_public_key;

	/* Evaluates as true if the pk is disabled, and false if it isn't. If
	there is no disable value cached, fill one in. */
	#define pk_is_disabled(a) \
	(((a)->flags.disabled_valid)? \
	((a)->flags.disabled):(cache_disabled_value(ctrl,(a))))


	typedef struct {
	int len; /* length of data */
	char data[1];
	} PKT_comment;

	/* A compression packet (RFC 4880, Section 5.6). */
	typedef struct {
	/* Not used. */
	u32 len;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* The compression algorithm. */
	byte algorithm;
	/* An iobuf holding the data to be decompressed. (This is not used
	for compression!) */
	iobuf_t buf;
	} PKT_compressed;

	/* A symmetrically encrypted data packet (RFC 4880, Section 5.7) or a
	symmetrically encrypted integrity protected data packet (Section
	5.13) */
	typedef struct {
	/* Remaining length of encrypted data. */
	u32 len;
	/* When encrypting in CFB mode, the first block size bytes of data
	* are random data and the following 2 bytes are copies of the last
	* two bytes of the random data (RFC 4880, Section 5.7). This
	* provides a simple check that the key is correct. EXTRALEN is the
	* size of this extra data or, in AEAD mode, the length of the
	* headers and the tags. This is used by build_packet when writing
	* out the packet's header. */
	int extralen;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* Whether the packet has an indeterminate length (old format) or
	was encoded using partial body length headers (new format).
	Note: this is ignored when encrypting. */
	byte is_partial;
	/* If 0, MDC is disabled. Otherwise, the MDC method that was used
	(currently, only DIGEST_ALGO_SHA1 is supported). */
	byte mdc_method;
	/* If 0, AEAD is not used. Otherwise, the used AEAD algorithm.
	* MDC_METHOD (above) shall be zero if AEAD is used. */
	byte aead_algo;
	/* The cipher algo for/from the AEAD packet. 0 for other encryption
	* packets. */
	byte cipher_algo;
	/* The chunk byte from the AEAD packet. */
	byte chunkbyte;

	/* An iobuf holding the data to be decrypted. (This is not used for
	encryption!) */
	iobuf_t buf;
	} PKT_encrypted;

	typedef struct {
	byte hash[20];
	} PKT_mdc;


	/* Subtypes for the ring trust packet. */
	#define RING_TRUST_SIG 0 /* The classical signature cache. */
	#define RING_TRUST_KEY 1 /* A KEYORG on a primary key. */
	#define RING_TRUST_UID 2 /* A KEYORG on a user id. */

	/* The local only ring trust packet which OpenPGP declares as
	* implementation defined. GnuPG uses this to cache signature
	* verification status and since 2.1.18 also to convey information
	* about the origin of a key. Note that this packet is not part
	* struct packet_struct because we use it only local in the packet
	* parser and builder. */
	typedef struct {
	unsigned int trustval;
	unsigned int sigcache;
	unsigned char subtype; /* The subtype of this ring trust packet. */
	unsigned char keyorg; /* The origin of the key (KEYORG_). /
	u32 keyupdate; /* The wall time the key was last updated. */
	char url; / NULL or the URL of the source. */
	} PKT_ring_trust;


	/* A plaintext packet (see RFC 4880, 5.9). */
	typedef struct {
	/* The length of data in BUF or 0 if unknown. */
	u32 len;
	/* A buffer containing the data stored in the packet's body. */
	iobuf_t buf;
	byte new_ctb;
	byte is_partial; /* partial length encoded */
	/* The data's formatting. This is either 'b', 't', 'u', 'l' or '1'
	(however, the last two are deprecated). */
	int mode;
	u32 timestamp;
	/* The name of the file. This can be at most 255 characters long,
	since namelen is just a byte in the serialized format. */
	int namelen;
	char name[1];
	} PKT_plaintext;

	typedef struct {
	int control;
	size_t datalen;
	char data[1];
	} PKT_gpg_control;

	/* combine all packets into a union */
	struct packet_struct {
	pkttype_t pkttype;
	union {
	void *generic;
	PKT_symkey_enc symkey_enc; / PKT_SYMKEY_ENC */
	PKT_pubkey_enc pubkey_enc; / PKT_PUBKEY_ENC */
	PKT_onepass_sig onepass_sig; / PKT_ONEPASS_SIG */
	PKT_signature signature; / PKT_SIGNATURE */
	PKT_public_key public_key; / PKT_PUBLIC_[SUB]KEY */
	PKT_public_key secret_key; / PKT_SECRET_[SUB]KEY */
	PKT_comment comment; / PKT_COMMENT */
	PKT_user_id user_id; / PKT_USER_ID */
	PKT_compressed compressed; / PKT_COMPRESSED */
	PKT_encrypted encrypted; / PKT_ENCRYPTED[_MDC] */
	PKT_mdc mdc; / PKT_MDC */
	PKT_plaintext plaintext; / PKT_PLAINTEXT */
	PKT_gpg_control gpg_control; / PKT_GPG_CONTROL */
	} pkt;
	};

	#define init_packet(a) do { (a)->pkttype = 0; \
	(a)->pkt.generic = NULL; \
	} while(0)


	/* A notation. See RFC 4880, Section 5.2.3.16. */
	struct notation
	{
	/* The notation's name. */
	char *name;
	/* If the notation is human readable, then the value is stored here
	as a NUL-terminated string. If it is not human readable a human
	readable approximation of the binary value _may_ be stored
	here. */
	char *value;
	/* Sometimes we want to %-expand the value. In these cases, we save
	that transformed value here. */
	char *altvalue;
	/* If the notation is not human readable, then the value is stored
	here. */
	unsigned char *bdat;
	/* The amount of data stored in BDAT.

	Note: if this is 0 and BDAT is NULL, this does not necessarily
	mean that the value is human readable. It could be that we have
	a 0-length value. To determine whether the notation is human
	readable, always check if VALUE is not NULL. This works, because
	if a human-readable value has a length of 0, we will still
	allocate space for the NUL byte. */
	size_t blen;
	struct
	{
	/* The notation is critical. */
	unsigned int critical:1;
	/* The notation is human readable. */
	unsigned int human:1;
	/* The notation should be deleted. */
	unsigned int ignore:1;
	} flags;

	/* A field to facilitate creating a list of notations. */
	struct notation *next;
	};
	typedef struct notation *notation_t;

	/-- mainproc.c --/
	void reset_literals_seen(void);
	int proc_packets (ctrl_t ctrl, void *ctx, iobuf_t a );
	int proc_signature_packets (ctrl_t ctrl, void *ctx, iobuf_t a,
	strlist_t signedfiles, const char *sigfile );
	int proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, IOBUF a, int signed_data_fd );
	int proc_encryption_packets (ctrl_t ctrl, void *ctx, iobuf_t a);
	int list_packets( iobuf_t a );

	const byte issuer_fpr_raw (PKT_signature sig, size_t *r_len);
	char issuer_fpr_string (PKT_signature sig);

	/-- parse-packet.c --/


	void register_known_notation (const char *string);

	/* Sets the packet list mode to MODE (i.e., whether we are dumping a
	packet or not). Returns the current mode. This allows for
	temporarily suspending dumping by doing the following:

	int saved_mode = set_packet_list_mode (0);
	...
	set_packet_list_mode (saved_mode);
	*/
	int set_packet_list_mode( int mode );


	/* A context used with parse_packet. */
	struct parse_packet_ctx_s
	{
	iobuf_t inp; /* The input stream with the packets. */
	struct packet_struct last_pkt; /* The last parsed packet. */
	int free_last_pkt; /* Indicates that LAST_PKT must be freed. */
	int skip_meta; /* Skip ring trust packets. */
	unsigned int n_parsed_packets; /* Number of parsed packets. */
	};
	typedef struct parse_packet_ctx_s *parse_packet_ctx_t;

	#define init_parse_packet(a,i) do { \
	(a)->inp = (i); \
	(a)->last_pkt.pkttype = 0; \
	(a)->last_pkt.pkt.generic= NULL;\
	(a)->free_last_pkt = 0; \
	(a)->skip_meta = 0; \
	(a)->n_parsed_packets = 0; \
	} while (0)

	#define deinit_parse_packet(a) do { \
	if ((a)->free_last_pkt) \
	free_packet (NULL, (a)); \
	} while (0)


	#if DEBUG_PARSE_PACKET
	/* There are debug functions and should not be used directly. */
	int dbg_search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t *retpos, int with_uid,
	const char* file, int lineno );
	int dbg_parse_packet (parse_packet_ctx_t ctx, PACKET *ret_pkt,
	const char *file, int lineno);
	int dbg_copy_all_packets( iobuf_t inp, iobuf_t out,
	const char* file, int lineno );
	int dbg_copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff,
	const char* file, int lineno );
	int dbg_skip_some_packets( iobuf_t inp, unsigned n,
	const char* file, int lineno );
	#define search_packet( a,b,c,d ) \
	dbg_search_packet( (a), (b), (c), (d), __FILE__, __LINE__ )
	#define parse_packet( a, b ) \
	dbg_parse_packet( (a), (b), __FILE__, __LINE__ )
	#define copy_all_packets( a,b ) \
	dbg_copy_all_packets((a),(b), __FILE__, __LINE__ )
	#define copy_some_packets( a,b,c ) \
	dbg_copy_some_packets((a),(b),(c), __FILE__, __LINE__ )
	#define skip_some_packets( a,b ) \
	dbg_skip_some_packets((a),(b), __FILE__, __LINE__ )
	#else
	/* Return the next valid OpenPGP packet in *PKT. (This function will
	* skip any packets whose type is 0.) CTX must have been setup prior to
	* calling this function.
	*
	* Returns 0 on success, -1 if EOF is reached, and an error code
	* otherwise. In the case of an error, the packet in *PKT may be
	* partially constructed. As such, even if there is an error, it is
	* necessary to free *PKT to avoid a resource leak. To detect what
	* has been allocated, clear PKT before calling this function. /
	int parse_packet (parse_packet_ctx_t ctx, PACKET *pkt);

	/* Return the first OpenPGP packet in *PKT that contains a key (either
	* a public subkey, a public key, a secret subkey or a secret key) or,
	* if WITH_UID is set, a user id.
	*
	* Saves the position in the pipeline of the start of the returned
	* packet (according to iobuf_tell) in RETPOS, if it is not NULL.
	*
	* The return semantics are the same as parse_packet. */
	int search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t *retpos, int with_uid);

	/* Copy all packets (except invalid packets, i.e., those with a type
	* of 0) from INP to OUT until either an error occurs or EOF is
	* reached.
	*
	* Returns -1 when end of file is reached or an error code, if an
	* error occurred. (Note: this function never returns 0, because it
	* effectively keeps going until it gets an EOF.) */
	int copy_all_packets (iobuf_t inp, iobuf_t out );

	/* Like copy_all_packets, but stops at the first packet that starts at
	* or after STOPOFF (as indicated by iobuf_tell).
	*
	* Example: if STOPOFF is 100, the first packet in INP goes from
	* 0 to 110 and the next packet starts at offset 111, then the packet
	* starting at offset 0 will be completely processed (even though it
	* extends beyond STOPOFF) and the packet starting at offset 111 will
	* not be processed at all. */
	int copy_some_packets (iobuf_t inp, iobuf_t out, off_t stopoff);

	/* Skips the next N packets from INP.
	*
	* If parsing a packet returns an error code, then the function stops
	* immediately and returns the error code. Note: in the case of an
	* error, this function does not indicate how many packets were
	* successfully processed. */
	int skip_some_packets (iobuf_t inp, unsigned int n);
	#endif

	/* Parse a signature packet and store it in *SIG.

	The signature packet is read from INP. The OpenPGP header (the tag
	and the packet's length) have already been read; the next byte read
	from INP should be the first byte of the packet's contents. The
	packet's type (as extract from the tag) must be passed as PKTTYPE
	and the packet's length must be passed as PKTLEN. This is used as
	the upper bound on the amount of data read from INP. If the packet
	is shorter than PKTLEN, the data at the end will be silently
	skipped. If an error occurs, an error code will be returned. -1
	means the EOF was encountered. 0 means parsing was successful. */
	int parse_signature( iobuf_t inp, int pkttype, unsigned long pktlen,
	PKT_signature *sig );

	/* Given a subpacket area (typically either PKT_signature.hashed or
	PKT_signature.unhashed), either:

	- test whether there are any subpackets with the critical bit set
	that we don't understand,

	- list the subpackets, or,

	- find a subpacket with a specific type.

	REQTYPE indicates the type of operation.

	If REQTYPE is SIGSUBPKT_TEST_CRITICAL, then this function checks
	whether there are any subpackets that have the critical bit and
	which GnuPG cannot handle. If GnuPG understands all subpackets
	whose critical bit is set, then this function returns simply
	returns SUBPKTS. If there is a subpacket whose critical bit is set
	and which GnuPG does not understand, then this function returns
	NULL and, if START is not NULL, sets *START to the 1-based index of
	the subpacket that violates the constraint.

	If REQTYPE is SIGSUBPKT_LIST_HASHED or SIGSUBPKT_LIST_UNHASHED, the
	packets are dumped. Note: if REQTYPE is SIGSUBPKT_LIST_HASHED,
	this function does not check whether the hash is correct; this is
	merely an indication of the section that the subpackets came from.

	If REQTYPE is anything else, then this function interprets the
	values as a subpacket type and looks for the first subpacket with
	that type. If such a packet is found, *CRITICAL (if not NULL) is
	set if the critical bit was set, *RET_N is set to the offset of the
	subpacket's content within the SUBPKTS buffer, *START is set to the
	1-based index of the subpacket within the buffer, and returns
	&SUBPKTS[*RET_N].

	*START is the number of initial subpackets to not consider. Thus,
	if START is 2, then the first 2 subpackets are ignored. /
	const byte enum_sig_subpkt ( const subpktarea_t subpkts,
	sigsubpkttype_t reqtype,
	size_t ret_n, int start, int *critical );

	/* Shorthand for:

	enum_sig_subpkt (buffer, reqtype, ret_n, NULL, NULL); */
	const byte parse_sig_subpkt ( const subpktarea_t buffer,
	sigsubpkttype_t reqtype,
	size_t *ret_n );

	/* This calls parse_sig_subpkt first on the hashed signature area in
	SIG and then, if that returns NULL, calls parse_sig_subpkt on the
	unhashed subpacket area in SIG. */
	const byte parse_sig_subpkt2 ( PKT_signature sig,
	sigsubpkttype_t reqtype);

	/* Returns whether the N byte large buffer BUFFER is sufficient to
	hold a subpacket of type TYPE. Note: the buffer refers to the
	contents of the subpacket (not the header) and it must already be
	initialized: for some subpackets, it checks some internal
	constraints.

	Returns 0 if the size is acceptable. Returns -2 if the buffer is
	definitely too short. To check for an error, check whether the
	return value is less than 0. */
	int parse_one_sig_subpkt( const byte *buffer, size_t n, int type );

	/* Looks for revocation key subpackets (see RFC 4880 5.2.3.15) in the
	hashed area of the signature packet. Any that are found are added
	to SIG->REVKEY and SIG->NUMREVKEYS is updated appropriately. */
	void parse_revkeys(PKT_signature *sig);

	/* Extract the attributes from the buffer at UID->ATTRIB_DATA and
	update UID->ATTRIBS and UID->NUMATTRIBS accordingly. */
	int parse_attribute_subpkts(PKT_user_id *uid);

	/* Set the UID->NAME field according to the attributes. MAX_NAMELEN
	must be at least 71. */
	void make_attribute_uidname(PKT_user_id *uid, size_t max_namelen);

	/* Allocate and initialize a new GPG control packet. DATA is the data
	to save in the packet. */
	PACKET *create_gpg_control ( ctrlpkttype_t type,
	const byte *data,
	size_t datalen );

	/-- build-packet.c --/
	int build_packet (iobuf_t out, PACKET *pkt);
	gpg_error_t build_packet_and_meta (iobuf_t out, PACKET *pkt);
	gpg_error_t gpg_mpi_write (iobuf_t out, gcry_mpi_t a);
	gpg_error_t gpg_mpi_write_nohdr (iobuf_t out, gcry_mpi_t a);
	u32 calc_packet_length( PACKET *pkt );
	void build_sig_subpkt( PKT_signature *sig, sigsubpkttype_t type,
	const byte *buffer, size_t buflen );
	void build_sig_subpkt_from_sig (PKT_signature sig, PKT_public_key pksk);
	int delete_sig_subpkt(subpktarea_t *buffer, sigsubpkttype_t type );
	void build_attribute_subpkt(PKT_user_id *uid,byte type,
	const void *buf,u32 buflen,
	const void *header,u32 headerlen);
	struct notation string_to_notation(const char string,int is_utf8);
	struct notation blob_to_notation(const char name,
	const char *data, size_t len);
	struct notation sig_to_notation(PKT_signature sig);
	void free_notation(struct notation *notation);

	/-- free-packet.c --/
	void free_symkey_enc( PKT_symkey_enc *enc );
	void free_pubkey_enc( PKT_pubkey_enc *enc );
	void free_seckey_enc( PKT_signature *enc );
	void release_public_key_parts( PKT_public_key *pk );
	void free_public_key( PKT_public_key *key );
	void free_attributes(PKT_user_id *uid);
	void free_user_id( PKT_user_id *uid );
	void free_comment( PKT_comment *rem );
	void free_packet (PACKET *pkt, parse_packet_ctx_t parsectx);
	prefitem_t copy_prefs (const prefitem_t prefs);
	PKT_public_key copy_public_key( PKT_public_key d, PKT_public_key *s );
	PKT_signature copy_signature( PKT_signature d, PKT_signature *s );
	PKT_user_id scopy_user_id (PKT_user_id sd );
	int cmp_public_keys( PKT_public_key a, PKT_public_key b );
	int cmp_signatures( PKT_signature a, PKT_signature b );
	int cmp_user_ids( PKT_user_id a, PKT_user_id b );


	/-- sig-check.c --/
	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest);

	/* Check a signature. Looks up the public key from the key db. (If
	* R_PK is not NULL, it is stored at RET_PK.) DIGEST contains a
	* valid hash context that already includes the signed data. This
	* function adds the relevant meta-data to the hash before finalizing
	* it and verifying the signature. FOCRED_PK is usually NULL. */
	gpg_error_t check_signature2 (ctrl_t ctrl,
	PKT_signature *sig, gcry_md_hd_t digest,
	PKT_public_key *forced_pk,
	u32 r_expiredate, int r_expired, int *r_revoked,
	PKT_public_key **r_pk);


	/-- pubkey-enc.c --/
	gpg_error_t get_session_key (ctrl_t ctrl, PKT_pubkey_enc k, DEK dek);
	gpg_error_t get_override_session_key (DEK dek, const char string);

	/-- compress.c --/
	int handle_compressed (ctrl_t ctrl, void ctx, PKT_compressed cd,
	int (callback)(iobuf_t, void ), void *passthru );

	/-- decrypt-data.c --/
	int decrypt_data (ctrl_t ctrl, void ctx, PKT_encrypted ed, DEK *dek,
	int *compliance_error);

	/-- plaintext.c --/
	gpg_error_t get_output_file (const byte *embedded_name, int embedded_namelen,
	iobuf_t data, char *fnamep, estream_t fpp);
	int handle_plaintext( PKT_plaintext pt, md_filter_context_t mfx,
	int nooutput, int clearsig );
	int ask_for_detached_datafile( gcry_md_hd_t md, gcry_md_hd_t md2,
	const char *inname, int textmode );

	/-- sign.c --/
	int make_keysig_packet (ctrl_t ctrl,
	PKT_signature *ret_sig, PKT_public_key pk,
	PKT_user_id uid, PKT_public_key subpk,
	PKT_public_key *pksk, int sigclass, int digest_algo,
	u32 timestamp, u32 duration,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque,
	const char *cache_nonce);
	gpg_error_t update_keysig_packet (ctrl_t ctrl,
	PKT_signature **ret_sig,
	PKT_signature *orig_sig,
	PKT_public_key *pk,
	PKT_user_id *uid,
	PKT_public_key *subpk,
	PKT_public_key *pksk,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque );

	/-- keygen.c --/
	PKT_user_id generate_user_id (kbnode_t keyblock, const char uidstr);

	#endif /G10_PACKET_H/
	diff --git a/g10/pkclist.c b/g10/pkclist.c
	index 54326822d..3fd7995c3 100644
	--- a/g10/pkclist.c
	+++ b/g10/pkclist.c
	@@ -1,1722 +1,1738 @@
	/* pkclist.c - create a list of public keys
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "../common/status.h"
	#include "keydb.h"
	#include "../common/util.h"
	#include "main.h"
	#include "trustdb.h"
	#include "../common/ttyio.h"
	#include "../common/status.h"
	#include "photoid.h"
	#include "../common/i18n.h"
	#include "tofu.h"

	#define CONTROL_D ('D' - 'A' + 1)

	static void
	send_status_inv_recp (int reason, const char *name)
	{
	char buf[40];

	snprintf (buf, sizeof buf, "%d ", reason);
	write_status_text_and_buffer (STATUS_INV_RECP, buf,
	name, strlen (name),
	-1);
	}


	/****************
	* Show the revocation reason as it is stored with the given signature
	*/
	static void
	do_show_revocation_reason( PKT_signature *sig )
	{
	size_t n, nn;
	const byte p, pp;
	int seq = 0;
	const char *text;

	while( (p = enum_sig_subpkt (sig->hashed, SIGSUBPKT_REVOC_REASON,
	&n, &seq, NULL )) ) {
	if( !n )
	continue; /* invalid - just skip it */

	if( *p == 0 )
	text = _("No reason specified");
	else if( *p == 0x01 )
	text = _("Key is superseded");
	else if( *p == 0x02 )
	text = _("Key has been compromised");
	else if( *p == 0x03 )
	text = _("Key is no longer used");
	else if( *p == 0x20 )
	text = _("User ID is no longer valid");
	else
	text = NULL;

	log_info ( _("reason for revocation: "));
	if (text)
	log_printf ("%s\n", text);
	else
	log_printf ("code=%02x\n", *p );
	n--; p++;
	pp = NULL;
	do {
	/* We don't want any empty lines, so skip them */
	while( n && *p == '\n' ) {
	p++;
	n--;
	}
	if( n ) {
	pp = memchr( p, '\n', n );
	nn = pp? pp - p : n;
	log_info ( _("revocation comment: ") );
	es_write_sanitized (log_get_stream(), p, nn, NULL, NULL);
	log_printf ("\n");
	p += nn; n -= nn;
	}
	} while( pp );
	}
	}

	/* Mode 0: try and find the revocation based on the pk (i.e. check
	subkeys, etc.) Mode 1: use only the revocation on the main pk */

	void
	show_revocation_reason (ctrl_t ctrl, PKT_public_key *pk, int mode)
	{
	/* Hmmm, this is not so easy because we have to duplicate the code
	* used in the trustdb to calculate the keyflags. We need to find
	* a clean way to check revocation certificates on keys and
	* signatures. And there should be no duplicate code. Because we
	* enter this function only when the trustdb told us that we have
	* a revoked key, we could simply look for a revocation cert and
	* display this one, when there is only one. Let's try to do this
	* until we have a better solution. */
	KBNODE node, keyblock = NULL;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	size_t fingerlen;
	int rc;

	/* get the keyblock */
	fingerprint_from_pk( pk, fingerprint, &fingerlen );
	rc = get_pubkey_byfprint (ctrl, NULL, &keyblock, fingerprint, fingerlen);
	if( rc ) { /* that should never happen */
	log_debug( "failed to get the keyblock\n");
	return;
	}

	for( node=keyblock; node; node = node->next ) {
	if( (mode && node->pkt->pkttype == PKT_PUBLIC_KEY) \|\|
	( ( node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	&& !cmp_public_keys( node->pkt->pkt.public_key, pk ) ) )
	break;
	}
	if( !node ) {
	log_debug("Oops, PK not in keyblock\n");
	release_kbnode( keyblock );
	return;
	}
	/* now find the revocation certificate */
	for( node = node->next; node ; node = node->next ) {
	if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	break;
	if( node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class == 0x20
	\|\| node->pkt->pkt.signature->sig_class == 0x28 ) ) {
	/* FIXME: we should check the signature here */
	do_show_revocation_reason ( node->pkt->pkt.signature );
	break;
	}
	}

	/* We didn't find it, so check if the whole key is revoked */
	if(!node && !mode)
	show_revocation_reason (ctrl, pk, 1);

	release_kbnode( keyblock );
	}


	/****************
	* mode: 0 = standard
	* 1 = Without key info and additional menu option 'm'
	* this does also add an option to set the key to ultimately trusted.
	* Returns:
	* -2 = nothing changed - caller should show some additional info
	* -1 = quit operation
	* 0 = nothing changed
	* 1 = new ownertrust now in new_trust
	*/
	#ifndef NO_TRUST_MODELS
	static int
	do_edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode,
	unsigned *new_trust, int defer_help )
	{
	char *p;
	u32 keyid[2];
	int changed=0;
	int quit=0;
	int show=0;
	int min_num;
	int did_help=defer_help;
	unsigned int minimum = tdb_get_min_ownertrust (ctrl, pk, 0);

	switch(minimum)
	{
	default:
	case TRUST_UNDEFINED: min_num=1; break;
	case TRUST_NEVER: min_num=2; break;
	case TRUST_MARGINAL: min_num=3; break;
	case TRUST_FULLY: min_num=4; break;
	}

	keyid_from_pk (pk, keyid);
	for(;;) {
	/* A string with valid answers.

	TRANSLATORS: These are the allowed answers in lower and
	uppercase. Below you will find the matching strings which
	should be translated accordingly and the letter changed to
	match the one in the answer string.

	i = please show me more information
	m = back to the main menu
	s = skip this key
	q = quit
	*/
	const char *ans = _("iImMqQsS");

	if( !did_help )
	{
	if( !mode )
	{
	KBNODE keyblock, un;

	tty_printf (_("No trust value assigned to:\n"));
	print_key_line (ctrl, NULL, pk, 0);

	p = get_user_id_native (ctrl, keyid);
	tty_printf (_(" \"%s\"\n"),p);
	xfree (p);

	keyblock = get_pubkeyblock (ctrl, keyid);
	if (!keyblock)
	BUG ();
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID )
	continue;
	if (un->pkt->pkt.user_id->flags.revoked)
	continue;
	if (un->pkt->pkt.user_id->flags.expired)
	continue;
	/* Only skip textual primaries */
	if (un->pkt->pkt.user_id->flags.primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	if((opt.verify_options&VERIFY_SHOW_PHOTOS)
	&& un->pkt->pkt.user_id->attrib_data)
	show_photos (ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs, pk,
	un->pkt->pkt.user_id);

	p=utf8_to_native(un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len,0);

	tty_printf(_(" aka \"%s\"\n"),p);
	}

	print_fingerprint (ctrl, NULL, pk, 2);
	tty_printf("\n");
	release_kbnode (keyblock);
	}

	if(opt.trust_model==TM_DIRECT)
	{
	tty_printf(_("How much do you trust that this key actually "
	"belongs to the named user?\n"));
	tty_printf("\n");
	}
	else
	{
	/* This string also used in keyedit.c:trustsig_prompt */
	tty_printf(_("Please decide how far you trust this user to"
	" correctly verify other users' keys\n"
	"(by looking at passports, checking fingerprints from"
	" different sources, etc.)\n"));
	tty_printf("\n");
	}

	if(min_num<=1)
	tty_printf (_(" %d = I don't know or won't say\n"), 1);
	if(min_num<=2)
	tty_printf (_(" %d = I do NOT trust\n"), 2);
	if(min_num<=3)
	tty_printf (_(" %d = I trust marginally\n"), 3);
	if(min_num<=4)
	tty_printf (_(" %d = I trust fully\n"), 4);
	if (mode)
	tty_printf (_(" %d = I trust ultimately\n"), 5);
	#if 0
	/* not yet implemented */
	tty_printf (" i = please show me more information\n");
	#endif
	if( mode )
	tty_printf(_(" m = back to the main menu\n"));
	else
	{
	tty_printf(_(" s = skip this key\n"));
	tty_printf(_(" q = quit\n"));
	}
	tty_printf("\n");
	if(minimum)
	tty_printf(_("The minimum trust level for this key is: %s\n\n"),
	trust_value_to_string(minimum));
	did_help = 1;
	}
	if( strlen(ans) != 8 )
	BUG();
	p = cpr_get("edit_ownertrust.value",_("Your decision? "));
	trim_spaces(p);
	cpr_kill_prompt();
	if( !*p )
	did_help = 0;
	else if( *p && p[1] )
	;
	else if( !p[1] && ((p >= '0'+min_num) && p <= (mode?'5':'4')) )
	{
	unsigned int trust;
	switch( *p )
	{
	case '1': trust = TRUST_UNDEFINED; break;
	case '2': trust = TRUST_NEVER ; break;
	case '3': trust = TRUST_MARGINAL ; break;
	case '4': trust = TRUST_FULLY ; break;
	case '5': trust = TRUST_ULTIMATE ; break;
	default: BUG();
	}
	if (trust == TRUST_ULTIMATE
	&& !cpr_get_answer_is_yes ("edit_ownertrust.set_ultimate.okay",
	_("Do you really want to set this key"
	" to ultimate trust? (y/N) ")))
	; /* no */
	else
	{
	*new_trust = trust;
	changed = 1;
	break;
	}
	}
	#if 0
	/* not yet implemented */
	else if( p == ans[0] \|\| p == ans[1] )
	{
	tty_printf(_("Certificates leading to an ultimately trusted key:\n"));
	show = 1;
	break;
	}
	#endif
	else if( mode && (p == ans[2] \|\| p == ans[3] \|\| *p == CONTROL_D ) )
	{
	break ; /* back to the menu */
	}
	else if( !mode && (p == ans[6] \|\| p == ans[7] ) )
	{
	break; /* skip */
	}
	else if( !mode && (p == ans[4] \|\| p == ans[5] ) )
	{
	quit = 1;
	break ; /* back to the menu */
	}
	xfree(p); p = NULL;
	}
	xfree(p);
	return show? -2: quit? -1 : changed;
	}
	#endif /!NO_TRUST_MODELS/


	/*
	* Display a menu to change the ownertrust of the key PK (which should
	* be a primary key).
	* For mode values see do_edit_ownertrust ()
	*/
	#ifndef NO_TRUST_MODELS
	int
	edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode )
	{
	unsigned int trust = 0;
	int no_help = 0;

	for(;;)
	{
	switch ( do_edit_ownertrust (ctrl, pk, mode, &trust, no_help ) )
	{
	case -1: /* quit */
	return -1;
	case -2: /* show info */
	no_help = 1;
	break;
	case 1: /* trust value set */
	trust &= ~TRUST_FLAG_DISABLED;
	trust \|= get_ownertrust (ctrl, pk) & TRUST_FLAG_DISABLED;
	update_ownertrust (ctrl, pk, trust );
	return 1;
	default:
	return 0;
	}
	}
	}
	#endif /!NO_TRUST_MODELS/


	/****************
	* Check whether we can trust this pk which has a trustlevel of TRUSTLEVEL
	* Returns: true if we trust.
	*/
	static int
	do_we_trust( PKT_public_key *pk, unsigned int trustlevel )
	{
	/* We should not be able to get here with a revoked or expired
	key */
	if(trustlevel & TRUST_FLAG_REVOKED
	\|\| trustlevel & TRUST_FLAG_SUB_REVOKED
	\|\| (trustlevel & TRUST_MASK) == TRUST_EXPIRED)
	BUG();

	if( opt.trust_model==TM_ALWAYS )
	{
	if( opt.verbose )
	log_info("No trust check due to '--trust-model always' option\n");
	return 1;
	}

	switch(trustlevel & TRUST_MASK)
	{
	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	log_info(_("%s: There is no assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 0; /* no */

	case TRUST_MARGINAL:
	log_info(_("%s: There is limited assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 1; /* yes */

	case TRUST_FULLY:
	if( opt.verbose )
	log_info(_("This key probably belongs to the named user\n"));
	return 1; /* yes */

	case TRUST_ULTIMATE:
	if( opt.verbose )
	log_info(_("This key belongs to us\n"));
	return 1; /* yes */

	case TRUST_NEVER:
	/* This can be returned by TOFU, which can return negative
	assertions. */
	log_info(_("%s: This key is bad! It has been marked as untrusted!\n"),
	keystr_from_pk(pk));
	return 0; /* no */
	}

	return 1; /NOTREACHED/
	}


	/****************
	* wrapper around do_we_trust, so we can ask whether to use the
	* key anyway.
	*/
	static int
	do_we_trust_pre (ctrl_t ctrl, PKT_public_key *pk, unsigned int trustlevel )
	{
	int rc;

	rc = do_we_trust( pk, trustlevel );

	if( !opt.batch && !rc )
	{
	print_pubkey_info (ctrl, NULL,pk);
	print_fingerprint (ctrl, NULL, pk, 2);
	tty_printf("\n");

	if ((trustlevel & TRUST_MASK) == TRUST_NEVER)
	tty_printf(
	_("This key is bad! It has been marked as untrusted! If you\n"
	"really know what you are doing, you may answer the next\n"
	"question with yes.\n"));
	else
	tty_printf(
	_("It is NOT certain that the key belongs to the person named\n"
	"in the user ID. If you really know what you are doing,\n"
	"you may answer the next question with yes.\n"));

	tty_printf("\n");


	if (is_status_enabled ())
	{
	u32 kid[2];
	char *hint_str;

	keyid_from_pk (pk, kid);
	hint_str = get_long_user_id_string (ctrl, kid);
	write_status_text ( STATUS_USERID_HINT, hint_str );
	xfree (hint_str);
	}

	if( cpr_get_answer_is_yes("untrusted_key.override",
	_("Use this key anyway? (y/N) ")) )
	rc = 1;

	/* Hmmm: Should we set a flag to tell the user about
	* his decision the next time he encrypts for this recipient?
	*/
	}

	return rc;
	}


	/* Write a TRUST_foo status line inclduing the validation model. */
	static void
	write_trust_status (int statuscode, int trustlevel)
	{
	#ifdef NO_TRUST_MODELS
	write_status (statuscode);
	#else /* NO_TRUST_MODELS */
	int tm;

	/* For the combined tofu+pgp method, we return the trust model which
	* was responsible for the trustlevel. */
	if (opt.trust_model == TM_TOFU_PGP)
	tm = (trustlevel & TRUST_FLAG_TOFU_BASED)? TM_TOFU : TM_PGP;
	else
	tm = opt.trust_model;
	write_status_strings (statuscode, "0 ", trust_model_string (tm), NULL);
	#endif /* NO_TRUST_MODELS */
	}


	/****************
	* Check whether we can trust this signature.
	* Returns an error code if we should not trust this signature.
	*/
	int
	check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
	{
	PKT_public_key pk = xmalloc_clear( sizeof pk );
	unsigned int trustlevel = TRUST_UNKNOWN;
	int rc=0;

	rc = get_pubkey_for_sig (ctrl, pk, sig, NULL);
	if (rc)
	{ /* this should not happen */
	log_error("Ooops; the key vanished - can't check the trust\n");
	rc = GPG_ERR_NO_PUBKEY;
	goto leave;
	}

	if ( opt.trust_model==TM_ALWAYS )
	{
	if( !opt.quiet )
	log_info(_("WARNING: Using untrusted key!\n"));
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	goto leave;
	}

	if(pk->flags.maybe_revoked && !pk->flags.revoked)
	log_info(_("WARNING: this key might be revoked (revocation key"
	" not present)\n"));

	trustlevel = get_validity (ctrl, NULL, pk, NULL, sig, 1);

	if ( (trustlevel & TRUST_FLAG_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	if(pk->flags.revoked == 2)
	log_info(_("WARNING: This key has been revoked by its"
	" designated revoker!\n"));
	else
	log_info(_("WARNING: This key has been revoked by its owner!\n"));
	log_info(_(" This could mean that the signature is forged.\n"));
	show_revocation_reason (ctrl, pk, 0);
	}
	else if ((trustlevel & TRUST_FLAG_SUB_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	log_info(_("WARNING: This subkey has been revoked by its owner!\n"));
	show_revocation_reason (ctrl, pk, 0);
	}

	if ((trustlevel & TRUST_FLAG_DISABLED))
	log_info (_("Note: This key has been disabled.\n"));

	/* If we have PKA information adjust the trustlevel. */
	if (sig->pka_info && sig->pka_info->valid)
	{
	unsigned char fpr[MAX_FINGERPRINT_LEN];
	PKT_public_key *primary_pk;
	size_t fprlen;
	int okay;


	primary_pk = xmalloc_clear (sizeof *primary_pk);
	get_pubkey (ctrl, primary_pk, pk->main_keyid);
	fingerprint_from_pk (primary_pk, fpr, &fprlen);
	free_public_key (primary_pk);

	if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) )
	{
	okay = 1;
	write_status_text (STATUS_PKA_TRUST_GOOD, sig->pka_info->email);
	log_info (_("Note: Verified signer's address is '%s'\n"),
	sig->pka_info->email);
	}
	else
	{
	okay = 0;
	write_status_text (STATUS_PKA_TRUST_BAD, sig->pka_info->email);
	log_info (_("Note: Signer's address '%s' "
	"does not match DNS entry\n"), sig->pka_info->email);
	}

	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	case TRUST_MARGINAL:
	if (okay && opt.verify_options&VERIFY_PKA_TRUST_INCREASE)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_FULLY);
	log_info (_("trustlevel adjusted to FULL"
	" due to valid PKA info\n"));
	}
	/* fall through */
	case TRUST_FULLY:
	if (!okay)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_NEVER);
	log_info (_("trustlevel adjusted to NEVER"
	" due to bad PKA info\n"));
	}
	break;
	}
	}

	/* Now let the user know what up with the trustlevel. */
	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_EXPIRED:
	log_info(_("Note: This key has expired!\n"));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	write_trust_status (STATUS_TRUST_UNDEFINED, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" a trusted signature!\n"));
	log_info(_(" There is no indication that the "
	"signature belongs to the owner.\n" ));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_NEVER:
	/* This level can be returned by TOFU, which supports negative
	* assertions. */
	write_trust_status (STATUS_TRUST_NEVER, trustlevel);
	log_info(_("WARNING: We do NOT trust this key!\n"));
	log_info(_(" The signature is probably a FORGERY.\n"));
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	break;

	case TRUST_MARGINAL:
	write_trust_status (STATUS_TRUST_MARGINAL, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" sufficiently trusted signatures!\n"));
	log_info(_(" It is not certain that the"
	" signature belongs to the owner.\n" ));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_FULLY:
	write_trust_status (STATUS_TRUST_FULLY, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_ULTIMATE:
	write_trust_status (STATUS_TRUST_ULTIMATE, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	break;
	}

	leave:
	free_public_key( pk );
	return rc;
	}


	void
	release_pk_list (pk_list_t pk_list)
	{
	PK_LIST pk_rover;

	for ( ; pk_list; pk_list = pk_rover)
	{
	pk_rover = pk_list->next;
	free_public_key ( pk_list->pk );
	xfree ( pk_list );
	}
	}


	static int
	key_present_in_pk_list(PK_LIST pk_list, PKT_public_key *pk)
	{
	for( ; pk_list; pk_list = pk_list->next)
	if (cmp_public_keys(pk_list->pk, pk) == 0)
	return 0;

	return -1;
	}


	/*
	* Return a malloced string with a default recipient if there is any
	* Fixme: We don't distinguish between malloc failure and no-default-recipient.
	*/
	static char *
	default_recipient (ctrl_t ctrl)
	{
	PKT_public_key *pk;
	char *result;

	if (opt.def_recipient)
	return xtrystrdup (opt.def_recipient);

	if (!opt.def_recipient_self)
	return NULL;
	pk = xtrycalloc (1, sizeof *pk );
	if (!pk)
	return NULL;
	if (get_seckey_default (ctrl, pk))
	{
	free_public_key (pk);
	return NULL;
	}
	result = hexfingerprint (pk, NULL, 0);
	free_public_key (pk);
	return result;
	}


	static int
	expand_id(const char id,strlist_t into,unsigned int flags)
	{
	struct groupitem *groups;
	int count=0;

	for(groups=opt.grouplist;groups;groups=groups->next)
	{
	/* need strcasecmp() here, as this should be localized */
	if(strcasecmp(groups->name,id)==0)
	{
	strlist_t each,sl;

	/* this maintains the current utf8-ness */
	for(each=groups->values;each;each=each->next)
	{
	sl=add_to_strlist(into,each->d);
	sl->flags=flags;
	count++;
	}

	break;
	}
	}

	return count;
	}

	/* For simplicity, and to avoid potential loops, we only expand once -
	* you can't make an alias that points to an alias. */
	static strlist_t
	expand_group (strlist_t input)
	{
	strlist_t output = NULL;
	strlist_t sl, rover;

	for (rover = input; rover; rover = rover->next)
	if (!(rover->flags & PK_LIST_FROM_FILE)
	&& !expand_id(rover->d,&output,rover->flags))
	{
	/* Didn't find any groups, so use the existing string */
	sl=add_to_strlist(&output,rover->d);
	sl->flags=rover->flags;
	}

	return output;
	}


	/* Helper for build_pk_list to find and check one key. This helper is
	* also used directly in server mode by the RECIPIENTS command. On
	* success the new key is added to PK_LIST_ADDR. NAME is the user id
	* of the key. USE the requested usage and a set MARK_HIDDEN will
	* mark the key in the updated list as a hidden recipient. If
	* FROM_FILE is true, NAME is not a user ID but the name of a file
	* holding a key. */
	gpg_error_t
	find_and_check_key (ctrl_t ctrl, const char *name, unsigned int use,
	int mark_hidden, int from_file, pk_list_t *pk_list_addr)
	{
	int rc;
	PKT_public_key *pk;
	- KBNODE keyblock = NULL;
	+ kbnode_t keyblock = NULL;
	+ kbnode_t node;

	if (!name \|\| !*name)
	return gpg_error (GPG_ERR_INV_USER_ID);

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	return gpg_error_from_syserror ();
	pk->req_usage = use;

	if (from_file)
	- rc = get_pubkey_fromfile (ctrl, pk, name);
	+ rc = get_pubkey_fromfile (ctrl, pk, name, &keyblock);
	else
	rc = get_best_pubkey_byname (ctrl, GET_PUBKEY_NORMAL,
	NULL, pk, name, &keyblock, 0);
	if (rc)
	{
	int code;

	/* Key not found or other error. */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	switch (gpg_err_code (rc))
	{
	case GPG_ERR_NO_SECKEY:
	case GPG_ERR_NO_PUBKEY: code = 1; break;
	case GPG_ERR_INV_USER_ID: code = 14; break;
	default: code = 0; break;
	}
	send_status_inv_recp (code, name);
	free_public_key (pk);
	return rc;
	}

	rc = openpgp_pk_test_algo2 (pk->pubkey_algo, use);
	if (rc)
	{
	/* Key found but not usable for us (e.g. sign-only key). */
	release_kbnode (keyblock);
	send_status_inv_recp (3, name); /* Wrong key usage */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	free_public_key (pk);
	return rc;
	}

	/* Key found and usable. Check validity. */
	if (!from_file)
	{
	int trustlevel;

	trustlevel = get_validity (ctrl, keyblock, pk, pk->user_id, NULL, 1);
	- release_kbnode (keyblock);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	/* Key has been disabled. */
	+ release_kbnode (keyblock);
	send_status_inv_recp (13, name);
	log_info (_("%s: skipped: public key is disabled\n"), name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}

	if ( !do_we_trust_pre (ctrl, pk, trustlevel) )
	{
	/* We don't trust this key. */
	+ release_kbnode (keyblock);
	send_status_inv_recp (10, name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}
	}

	/* Skip the actual key if the key is already present in the
	list. */
	if (!key_present_in_pk_list (*pk_list_addr, pk))
	{
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"), name);
	free_public_key (pk);
	}
	else
	{
	pk_list_t r;

	- r = xtrymalloc (sizeof *r);
	- if (!r)
	- {
	- rc = gpg_error_from_syserror ();
	- free_public_key (pk);
	- return rc;
	- }
	+ r = xmalloc (sizeof *r);
	r->pk = pk;
	r->next = *pk_list_addr;
	r->flags = mark_hidden? 1:0;
	*pk_list_addr = r;
	}

	+ for (node = keyblock; node; node = node->next)
	+ if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	+ && ((pk=node->pkt->pkt.public_key)->pubkey_usage & PUBKEY_USAGE_RENC)
	+ && pk->flags.valid
	+ && !pk->flags.revoked
	+ && !pk->flags.disabled
	+ && !pk->has_expired
	+ && key_present_in_pk_list (*pk_list_addr, pk))
	+ {
	+ pk_list_t r;
	+
	+ r = xmalloc (sizeof *r);
	+ r->pk = copy_public_key (NULL, pk);
	+ r->next = *pk_list_addr;
	+ r->flags = mark_hidden? 1:0; /* FIXME: Use PK_LIST_HIDDEN ? */
	+ *pk_list_addr = r;
	+ }
	+
	+
	+ release_kbnode (keyblock);
	return 0;
	}



	/* This is the central function to collect the keys for recipients.
	* It is thus used to prepare a public key encryption. encrypt-to
	* keys, default keys and the keys for the actual recipients are all
	* collected here. When not in batch mode and no recipient has been
	* passed on the commandline, the function will also ask for
	* recipients.
	*
	* RCPTS is a string list with the recipients; NULL is an allowed
	* value but not very useful. Group expansion is done on these names;
	* they may be in any of the user Id formats we can handle. The flags
	* bits for each string in the string list are used for:
	*
	* - PK_LIST_ENCRYPT_TO :: This is an encrypt-to recipient.
	* - PK_LIST_HIDDEN :: This is a hidden recipient.
	* - PK_LIST_FROM_FILE :: The argument is a file with a key.
	*
	* On success a list of keys is stored at the address RET_PK_LIST; the
	* caller must free this list. On error the value at this address is
	* not changed.
	*/
	int
	build_pk_list (ctrl_t ctrl, strlist_t rcpts, PK_LIST *ret_pk_list)
	{
	PK_LIST pk_list = NULL;
	PKT_public_key *pk=NULL;
	int rc=0;
	int any_recipients=0;
	strlist_t rov,remusr;
	char *def_rec = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* Try to expand groups if any have been defined. */
	if (opt.grouplist)
	remusr = expand_group (rcpts);
	else
	remusr = rcpts;

	/* XXX: Change this function to use get_pubkeys instead of
	get_pubkey_byname to detect ambiguous key specifications and warn
	about duplicate keyblocks. For ambiguous key specifications on
	the command line or provided interactively, prompt the user to
	select the best key. If a key specification is ambiguous and we
	are in batch mode, die. */

	if (opt.encrypt_to_default_key)
	{
	static int warned;

	const char *default_key = parse_def_secret_key (ctrl);
	if (default_key)
	{
	PK_LIST r = xmalloc_clear (sizeof *r);

	r->pk = xmalloc_clear (sizeof *r->pk);
	r->pk->req_usage = PUBKEY_USAGE_ENC;

	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, r->pk, default_key, NULL, NULL, 0);
	if (rc)
	{
	xfree (r->pk);
	xfree (r);

	log_error (_("can't encrypt to '%s'\n"), default_key);
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"),
	"--default-key");
	}
	else
	{
	r->next = pk_list;
	r->flags = 0;
	pk_list = r;
	}
	}
	else if (opt.def_secret_key)
	{
	if (! warned)
	log_info (_("option '%s' given, but no valid default keys given\n"),
	"--encrypt-to-default-key");
	warned = 1;
	}
	else
	{
	if (! warned)
	log_info (_("option '%s' given, but option '%s' not given\n"),
	"--encrypt-to-default-key", "--default-key");
	warned = 1;
	}
	}

	/* Check whether there are any recipients in the list and build the
	* list of the encrypt-to ones (we always trust them). */
	for ( rov = remusr; rov; rov = rov->next )
	{
	if ( !(rov->flags & PK_LIST_ENCRYPT_TO) )
	{
	/* This is a regular recipient; i.e. not an encrypt-to
	one. */
	any_recipients = 1;

	/* Hidden recipients are not allowed while in PGP mode,
	issue a warning and switch into GnuPG mode. */
	if ((rov->flags & PK_LIST_HIDDEN) && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("option '%s' may not be used in %s mode\n"),
	"--hidden-recipient",
	gnupg_compliance_option_string (opt.compliance));

	compliance_failure();
	}
	}
	else if (!opt.no_encrypt_to)
	{
	/* --encrypt-to has not been disabled. Check this
	encrypt-to key. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* We explicitly allow encrypt-to to an disabled key; thus
	we pass 1 for the second last argument and 1 as the last
	argument to disable AKL. */
	if ((rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, pk, rov->d, NULL, NULL, 1)))
	{
	free_public_key ( pk ); pk = NULL;
	log_error (_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (0, rov->d);
	goto fail;
	}
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Skip the actual key if the key is already present
	* in the list. Add it to our list if not. */
	if (key_present_in_pk_list(pk_list, pk) == 0)
	{
	free_public_key (pk); pk = NULL;
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"),
	rov->d);
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = (rov->flags&PK_LIST_HIDDEN)?1:0;
	pk_list = r;

	/* Hidden encrypt-to recipients are not allowed while
	in PGP mode, issue a warning and switch into
	GnuPG mode. */
	if ((r->flags&PK_LIST_ENCRYPT_TO) && (PGP6 \|\| PGP7 \|\| PGP8))
	{
	log_info(_("option '%s' may not be used in %s mode\n"),
	"--hidden-encrypt-to",
	gnupg_compliance_option_string (opt.compliance));

	compliance_failure();
	}
	}
	}
	else
	{
	/* The public key is not usable for encryption. */
	free_public_key( pk ); pk = NULL;
	log_error(_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (3, rov->d); /* Wrong key usage */
	goto fail;
	}
	}
	}

	/* If we don't have any recipients yet and we are not in batch mode
	drop into interactive selection mode. */
	if ( !any_recipients && !opt.batch )
	{
	int have_def_rec;
	char *answer = NULL;
	strlist_t backlog = NULL;

	if (pk_list)
	any_recipients = 1;
	def_rec = default_recipient(ctrl);
	have_def_rec = !!def_rec;
	if ( !have_def_rec )
	tty_printf(_("You did not specify a user ID. (you may use \"-r\")\n"));

	for (;;)
	{
	rc = 0;
	xfree(answer);
	if ( have_def_rec )
	{
	/* A default recipient is taken as the first entry. */
	answer = def_rec;
	def_rec = NULL;
	}
	else if (backlog)
	{
	/* This is part of our trick to expand and display groups. */
	answer = strlist_pop (&backlog);
	}
	else
	{
	/* Show the list of already collected recipients and ask
	for more. */
	PK_LIST iter;

	tty_printf("\n");
	tty_printf(_("Current recipients:\n"));
	for (iter=pk_list;iter;iter=iter->next)
	{
	u32 keyid[2];

	keyid_from_pk(iter->pk,keyid);
	tty_printf ("%s/%s %s \"",
	pubkey_string (iter->pk,
	pkstrbuf, sizeof pkstrbuf),
	keystr(keyid),
	datestr_from_pk (iter->pk));

	if (iter->pk->user_id)
	tty_print_utf8_string(iter->pk->user_id->name,
	iter->pk->user_id->len);
	else
	{
	size_t n;
	char *p = get_user_id (ctrl, keyid, &n, NULL);
	tty_print_utf8_string ( p, n );
	xfree(p);
	}
	tty_printf("\"\n");
	}

	answer = cpr_get_utf8("pklist.user_id.enter",
	_("\nEnter the user ID. "
	"End with an empty line: "));
	trim_spaces(answer);
	cpr_kill_prompt();
	}

	if ( !answer \|\| !*answer )
	{
	xfree(answer);
	break; /* No more recipients entered - get out of loop. */
	}

	/* Do group expand here too. The trick here is to continue
	the loop if any expansion occurred. The code above will
	then list all expanded keys. */
	if (expand_id(answer,&backlog,0))
	continue;

	/* Get and check key for the current name. */
	free_public_key (pk);
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;
	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NORMAL,
	NULL, pk, answer, NULL, NULL, 0);
	if (rc)
	tty_printf(_("No such user ID.\n"));
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	if ( have_def_rec )
	{
	/* No validation for a default recipient. */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info (_("skipped: public key "
	"already set as default recipient\n") );
	}
	else
	{
	PK_LIST r = xmalloc (sizeof *r);
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	else
	{ /* Check validity of this key. */
	int trustlevel;

	trustlevel =
	get_validity (ctrl, NULL, pk, pk->user_id, NULL, 1);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	tty_printf (_("Public key is disabled.\n") );
	}
	else if ( do_we_trust_pre (ctrl, pk, trustlevel) )
	{
	/* Skip the actual key if the key is already
	* present in the list */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info(_("skipped: public key already set\n") );
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing interactive ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	}
	}
	xfree(def_rec); def_rec = NULL;
	have_def_rec = 0;
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	}
	else if ( !any_recipients && (def_rec = default_recipient(ctrl)) )
	{
	/* We are in batch mode and have only a default recipient. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* The default recipient is allowed to be disabled; thus pass 1
	as second last argument. We also don't want an AKL. */
	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, pk, def_rec, NULL, NULL, 1);
	if (rc)
	log_error(_("unknown default recipient \"%s\"\n"), def_rec );
	else if ( !(rc=openpgp_pk_test_algo2(pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Mark any_recipients here since the default recipient
	would have been used if it wasn't already there. It
	doesn't really matter if we got this key from the default
	recipient or an encrypt-to. */
	any_recipients = 1;
	if (!key_present_in_pk_list(pk_list, pk))
	log_info (_("skipped: public key already set "
	"as default recipient\n"));
	else
	{
	PK_LIST r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	xfree(def_rec); def_rec = NULL;
	}
	else
	{
	/* General case: Check all keys. */
	any_recipients = 0;
	for (; remusr; remusr = remusr->next )
	{
	if ( (remusr->flags & PK_LIST_ENCRYPT_TO) )
	continue; /* encrypt-to keys are already handled. */

	rc = find_and_check_key (ctrl, remusr->d, PUBKEY_USAGE_ENC,
	!!(remusr->flags&PK_LIST_HIDDEN),
	!!(remusr->flags&PK_LIST_FROM_FILE),
	&pk_list);
	if (rc)
	goto fail;
	any_recipients = 1;
	}
	}

	if ( !rc && !any_recipients )
	{
	log_error(_("no valid addressees\n"));
	write_status_text (STATUS_NO_RECP, "0");
	rc = GPG_ERR_NO_USER_ID;
	}

	#ifdef USE_TOFU
	if (! rc && (opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU))
	{
	PK_LIST iter;
	for (iter = pk_list; iter; iter = iter->next)
	{
	int rc2;

	/* Note: we already resolved any conflict when looking up
	the key. Don't annoy the user again if she selected
	accept once. */
	rc2 = tofu_register_encryption (ctrl, iter->pk, NULL, 0);
	if (rc2)
	log_info ("WARNING: Failed to register encryption to %s"
	" with TOFU engine\n",
	keystr (pk_main_keyid (iter->pk)));
	else if (DBG_TRUST)
	log_debug ("Registered encryption to %s with TOFU DB.\n",
	keystr (pk_main_keyid (iter->pk)));
	}
	}
	#endif /USE_TOFU/

	fail:

	if ( rc )
	release_pk_list( pk_list );
	else
	*ret_pk_list = pk_list;
	if (opt.grouplist)
	free_strlist(remusr);
	return rc;
	}


	/* In pgp6 mode, disallow all ciphers except IDEA (1), 3DES (2), and
	CAST5 (3), all hashes except MD5 (1), SHA1 (2), and RIPEMD160 (3),
	and all compressions except none (0) and ZIP (1). pgp7 and pgp8
	mode expands the cipher list to include AES128 (7), AES192 (8),
	AES256 (9), and TWOFISH (10). pgp8 adds the SHA-256 hash (8). For
	a true PGP key all of this is unneeded as they are the only items
	present in the preferences subpacket, but checking here covers the
	weird case of encrypting to a key that had preferences from a
	different implementation which was then used with PGP. I am not
	completely comfortable with this as the right thing to do, as it
	slightly alters the list of what the user is supposedly requesting.
	It is not against the RFC however, as the preference chosen will
	never be one that the user didn't specify somewhere ("The
	implementation may use any mechanism to pick an algorithm in the
	intersection"), and PGP has no mechanism to fix such a broken
	preference list, so I'm including it. -dms */

	int
	algo_available( preftype_t preftype, int algo, const struct pref_hint *hint)
	{
	if( preftype == PREFTYPE_SYM )
	{
	if(PGP6 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5))
	return 0;

	if(PGP7 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5
	&& algo != CIPHER_ALGO_AES
	&& algo != CIPHER_ALGO_AES192
	&& algo != CIPHER_ALGO_AES256
	&& algo != CIPHER_ALGO_TWOFISH))
	return 0;

	/* PGP8 supports all the ciphers we do.. */

	return algo && !openpgp_cipher_test_algo ( algo );
	}
	else if( preftype == PREFTYPE_HASH )
	{
	if (hint && hint->digest_length)
	{
	unsigned int n = gcry_md_get_algo_dlen (algo);

	if (hint->exact)
	{
	/* For example ECDSA requires an exact hash value so
	* that we do not truncate. For DSA we allow truncation
	* and thus exact is not set. */
	if (hint->digest_length != n)
	return 0;
	}
	else if (hint->digest_length!=20 \|\| opt.flags.dsa2)
	{
	/* If --enable-dsa2 is set or the hash isn't 160 bits
	(which implies DSA2), then we'll accept a hash that
	is larger than we need. Otherwise we won't accept
	any hash that isn't exactly the right size. */
	if (hint->digest_length > n)
	return 0;
	}
	else if (hint->digest_length != n)
	return 0;
	}

	if((PGP6 \|\| PGP7) && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160))
	return 0;


	if(PGP8 && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160
	&& algo != DIGEST_ALGO_SHA256))
	return 0;

	return algo && !openpgp_md_test_algo (algo);
	}
	else if( preftype == PREFTYPE_ZIP )
	{
	if((PGP6 \|\| PGP7) && (algo != COMPRESS_ALGO_NONE
	&& algo != COMPRESS_ALGO_ZIP))
	return 0;

	/* PGP8 supports all the compression algos we do */

	return !check_compress_algo( algo );
	}
	else
	return 0;
	}

	/****************
	* Return -1 if we could not find an algorithm.
	*/
	int
	select_algo_from_prefs(PK_LIST pk_list, int preftype,
	int request, const struct pref_hint *hint)
	{
	PK_LIST pkr;
	u32 bits[8];
	const prefitem_t *prefs;
	int result=-1,i;
	u16 scores[256];

	if( !pk_list )
	return -1;

	memset(bits,0xFF,sizeof(bits));
	memset(scores,0,sizeof(scores));

	for( pkr = pk_list; pkr; pkr = pkr->next )
	{
	u32 mask[8];
	int rank=1,implicit=-1;

	memset(mask,0,sizeof(mask));

	switch(preftype)
	{
	case PREFTYPE_SYM:
	/* IDEA is implicitly there for v3 keys with v3 selfsigs if
	--pgp2 mode is on. This was a 2440 thing that was
	dropped from 4880 but is still relevant to GPG's 1991
	support. All this doesn't mean IDEA is actually
	available, of course.

	Because "de-vs" compliance will soon not anymore allow
	3DES it does not make sense to assign 3DES as implicit
	algorithm. Instead it is better to use AES-128 as
	implicit algorithm here. */
	if (opt.compliance == CO_DE_VS)
	implicit = CIPHER_ALGO_AES;
	else
	implicit=CIPHER_ALGO_3DES;

	break;

	case PREFTYPE_HASH:
	/* While I am including this code for completeness, note
	that currently --pgp2 mode locks the hash at MD5, so this
	code will never even be called. Even if the hash wasn't
	locked at MD5, we don't support sign+encrypt in --pgp2
	mode, and that's the only time PREFTYPE_HASH is used
	anyway. -dms

	Because "de-vs" compliance does not allow SHA-1 it does
	not make sense to assign SHA-1 as implicit algorithm.
	Instead it is better to use SHA-256 as implicit algorithm
	(which will be the case for rfc4880bis anyway). */

	if (opt.compliance == CO_DE_VS)
	implicit = DIGEST_ALGO_SHA256;
	else
	implicit = DIGEST_ALGO_SHA1;

	break;

	case PREFTYPE_ZIP:
	/* Uncompressed is always an option. */
	implicit=COMPRESS_ALGO_NONE;
	}

	if (pkr->pk->user_id) /* selected by user ID */
	prefs = pkr->pk->user_id->prefs;
	else
	prefs = pkr->pk->prefs;

	if( prefs )
	{
	for (i=0; prefs[i].type; i++ )
	{
	if( prefs[i].type == preftype )
	{
	/* Make sure all scores don't add up past 0xFFFF
	(and roll around) */
	if(rank+scores[prefs[i].value]<=0xFFFF)
	scores[prefs[i].value]+=rank;
	else
	scores[prefs[i].value]=0xFFFF;

	mask[prefs[i].value/32] \|= 1<<(prefs[i].value%32);

	rank++;

	/* We saw the implicit algorithm, so we don't need
	tack it on the end ourselves. */
	if(implicit==prefs[i].value)
	implicit=-1;
	}
	}
	}

	if(rank==1 && preftype==PREFTYPE_ZIP)
	{
	/* If the compression preferences are not present, they are
	assumed to be ZIP, Uncompressed (RFC4880:13.3.1) */
	scores[1]=1; /* ZIP is first choice */
	scores[0]=2; /* Uncompressed is second choice */
	mask[0]\|=3;
	}

	/* If the key didn't have the implicit algorithm listed
	explicitly, add it here at the tail of the list. */
	if(implicit>-1)
	{
	scores[implicit]+=rank;
	mask[implicit/32] \|= 1<<(implicit%32);
	}

	for(i=0;i<8;i++)
	bits[i]&=mask[i];
	}

	/* We've now scored all of the algorithms, and the usable ones have
	bits set. Let's pick the winner. */

	/* The caller passed us a request. Can we use it? */
	if(request>-1 && (bits[request/32] & (1<<(request%32))) &&
	algo_available(preftype,request,hint))
	result=request;

	if(result==-1)
	{
	/* If we have personal prefs set, use them. */
	prefs=NULL;
	if(preftype==PREFTYPE_SYM && opt.personal_cipher_prefs)
	prefs=opt.personal_cipher_prefs;
	else if(preftype==PREFTYPE_HASH && opt.personal_digest_prefs)
	prefs=opt.personal_digest_prefs;
	else if(preftype==PREFTYPE_ZIP && opt.personal_compress_prefs)
	prefs=opt.personal_compress_prefs;

	if( prefs )
	for(i=0; prefs[i].type; i++ )
	{
	if(bits[prefs[i].value/32] & (1<<(prefs[i].value%32))
	&& algo_available( preftype, prefs[i].value, hint))
	{
	result = prefs[i].value;
	break;
	}
	}
	}

	if(result==-1)
	{
	unsigned int best=-1;

	/* At this point, we have not selected an algorithm due to a
	special request or via personal prefs. Pick the highest
	ranked algorithm (i.e. the one with the lowest score). */

	if(preftype==PREFTYPE_HASH && scores[DIGEST_ALGO_MD5])
	{
	/* "If you are building an authentication system, the recipient
	may specify a preferred signing algorithm. However, the
	signer would be foolish to use a weak algorithm simply
	because the recipient requests it." (RFC4880:14). If any
	other hash algorithm is available, pretend that MD5 isn't.
	Note that if the user intentionally chose MD5 by putting it
	in their personal prefs, then we do what the user said (as we
	never reach this code). */

	for(i=DIGEST_ALGO_MD5+1;i<256;i++)
	if(scores[i])
	{
	scores[DIGEST_ALGO_MD5]=0;
	break;
	}
	}

	for(i=0;i<256;i++)
	{
	/* Note the '<' here. This means in case of a tie, we will
	favor the lower algorithm number. We have a choice
	between the lower number (probably an older algorithm
	with more time in use), or the higher number (probably a
	newer algorithm with less time in use). Older is
	probably safer here, even though the newer algorithms
	tend to be "stronger". */
	if(scores[i] && scores[i]<best
	&& (bits[i/32] & (1<<(i%32)))
	&& algo_available(preftype,i,hint))
	{
	best=scores[i];
	result=i;
	}
	}
	}

	return result;
	}


	/* Select the AEAD flag from the pk_list. We can only use AEAD if all
	* recipients support this feature. Returns the AEAD to be used or 0
	* if AEAD shall not be used. */
	aead_algo_t
	select_aead_from_pklist (PK_LIST pk_list)
	{
	pk_list_t pkr;
	int aead;

	if (!pk_list)
	return 0;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	if (pkr->pk->user_id) /* selected by user ID */
	aead = pkr->pk->user_id->flags.aead;
	else
	aead = pkr->pk->flags.aead;
	if (!aead)
	return 0; /* At least one recipient does not support it. */
	}

	return AEAD_ALGO_OCB; /* Yes, AEAD can be used. */
	}


	/* Print a warning for all keys in PK_LIST missing the AEAD feature
	* flag or AEAD algorithms. */
	void
	warn_missing_aead_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.aead;
	else
	mdc = pkr->pk->flags.aead;
	if (!mdc)
	log_info (_("Note: key %s has no %s feature\n"),
	keystr_from_pk (pkr->pk), "AEAD");
	}
	}

	void
	warn_missing_aes_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	const prefitem_t *prefs;
	int i;
	int gotit = 0;

	prefs = pkr->pk->user_id? pkr->pk->user_id->prefs : pkr->pk->prefs;
	if (prefs)
	{
	for (i=0; !gotit && prefs[i].type; i++ )
	if (prefs[i].type == PREFTYPE_SYM
	&& prefs[i].value == CIPHER_ALGO_AES)
	gotit++;
	}
	if (!gotit)
	log_info (_("Note: key %s has no preference for %s\n"),
	keystr_from_pk (pkr->pk), "AES");
	}
	}
	diff --git a/g10/sig-check.c b/g10/sig-check.c
	index ec136024b..09d5a8b5f 100644
	--- a/g10/sig-check.c
	+++ b/g10/sig-check.c
	@@ -1,1222 +1,1223 @@
	/* sig-check.c - Check a signature
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003,
	* 2004, 2006 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "keydb.h"
	#include "main.h"
	#include "../common/status.h"
	#include "../common/i18n.h"
	#include "options.h"
	#include "pkglue.h"
	#include "../common/compliance.h"

	static int check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	int r_expired, int r_revoked,
	PKT_public_key *ret_pk);

	static int check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest);


	/* Statistics for signature verification. */
	struct
	{
	unsigned int total; /* Total number of verifications. */
	unsigned int cached; /* Number of seen cache entries. */
	unsigned int goodsig;/* Number of good verifications from the cache. */
	unsigned int badsig; /* Number of bad verifications from the cache. */
	} cache_stats;


	/* Dump verification stats. */
	void
	sig_check_dump_stats (void)
	{
	log_info ("sig_cache: total=%u cached=%u good=%u bad=%u\n",
	cache_stats.total, cache_stats.cached,
	cache_stats.goodsig, cache_stats.badsig);
	}


	static gpg_error_t
	check_key_verify_compliance (PKT_public_key *pk)
	{
	gpg_error_t err = 0;

	if (!gnupg_pk_is_allowed (opt.compliance, PK_USE_VERIFICATION,
	pk->pubkey_algo, 0, pk->pkey,
	nbits_from_pk (pk),
	NULL))
	{
	/* Compliance failure. */
	log_error (_("key %s may not be used for signing in %s mode\n"),
	keystr_from_pk (pk),
	gnupg_compliance_option_string (opt.compliance));
	err = gpg_error (GPG_ERR_PUBKEY_ALGO);
	}

	return err;
	}



	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int
	check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest)
	{
	return check_signature2 (ctrl, sig, digest, NULL, NULL, NULL, NULL, NULL);
	}


	/* Check a signature.
	*
	* Looks up the public key that created the signature (SIG->KEYID)
	* from the key db. Makes sure that the signature is valid (it was
	* not created prior to the key, the public key was created in the
	* past, and the signature does not include any unsupported critical
	* features), finishes computing the hash of the signature data, and
	* checks that the signature verifies the digest. If the key that
	* generated the signature is a subkey, this function also verifies
	* that there is a valid backsig from the subkey to the primary key.
	* Finally, if status fd is enabled and the signature class is 0x00 or
	* 0x01, then a STATUS_SIG_ID is emitted on the status fd.
	*
	* SIG is the signature to check.
	*
	* DIGEST contains a valid hash context that already includes the
	* signed data. This function adds the relevant meta-data from the
	* signature packet to compute the final hash. (See Section 5.2 of
	* RFC 4880: "The concatenation of the data being signed and the
	* signature data from the version number through the hashed subpacket
	* data (inclusive) is hashed.")
	*
	* If FORCED_PK is not NULL this public key is used to verify the
	* signature and no other public key is looked up.
	*
	* If R_EXPIREDATE is not NULL, R_EXPIREDATE is set to the key's
	* expiry.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	* If R_PK is not NULL, the public key is stored at that address if it
	* was found; other wise NULL is stored.
	*
	* Returns 0 on success. An error code otherwise. */
	gpg_error_t
	check_signature2 (ctrl_t ctrl,
	PKT_signature *sig, gcry_md_hd_t digest,
	PKT_public_key *forced_pk,
	u32 *r_expiredate,
	int r_expired, int r_revoked, PKT_public_key **r_pk)
	{
	int rc=0;
	PKT_public_key *pk;

	if (r_expiredate)
	*r_expiredate = 0;
	if (r_expired)
	*r_expired = 0;
	if (r_revoked)
	*r_revoked = 0;
	if (r_pk)
	*r_pk = NULL;

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	return gpg_error_from_syserror ();

	if ((rc=openpgp_md_test_algo(sig->digest_algo)))
	{
	/* We don't have this digest. */
	}
	else if (!gnupg_digest_is_allowed (opt.compliance, 0, sig->digest_algo))
	{
	/* Compliance failure. */
	log_info (_("digest algorithm '%s' may not be used in %s mode\n"),
	gcry_md_algo_name (sig->digest_algo),
	gnupg_compliance_option_string (opt.compliance));
	rc = gpg_error (GPG_ERR_DIGEST_ALGO);
	}
	else if ((rc=openpgp_pk_test_algo(sig->pubkey_algo)))
	{
	/* We don't have this pubkey algo. */
	}
	else if (!gcry_md_is_enabled (digest,sig->digest_algo))
	{
	/* Sanity check that the md has a context for the hash that the
	* sig is expecting. This can happen if a onepass sig header
	* does not match the actual sig, and also if the clearsign
	* "Hash:" header is missing or does not match the actual sig. */
	log_info(_("WARNING: signature digest conflict in message\n"));
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if (get_pubkey_for_sig (ctrl, pk, sig, forced_pk))
	rc = gpg_error (GPG_ERR_NO_PUBKEY);
	else if ((rc = check_key_verify_compliance (pk)))
	;/* Compliance failure. */
	else if (!pk->flags.valid)
	{
	/* You cannot have a good sig from an invalid key. */
	rc = gpg_error (GPG_ERR_BAD_PUBKEY);
	}
	else
	{
	if (r_expiredate)
	*r_expiredate = pk->expiredate;

	rc = check_signature_end (pk, sig, digest, r_expired, r_revoked, NULL);

	/* Check the backsig. This is a back signature (0x19) from
	* the subkey on the primary key. The idea here is that it
	* should not be possible for someone to "steal" subkeys and
	* claim them as their own. The attacker couldn't actually
	* use the subkey, but they could try and claim ownership of
	* any signatures issued by it. */
	if (!rc && !pk->flags.primary && pk->flags.backsig < 2)
	{
	if (!pk->flags.backsig)
	{
	log_info (_("WARNING: signing subkey %s is not"
	" cross-certified\n"),keystr_from_pk(pk));
	log_info (_("please see %s for more information\n"),
	"https://gnupg.org/faq/subkey-cross-certify.html");
	/* The default option --require-cross-certification
	* makes this warning an error. */
	if (opt.flags.require_cross_cert)
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if(pk->flags.backsig == 1)
	{
	log_info (_("WARNING: signing subkey %s has an invalid"
	" cross-certification\n"), keystr_from_pk(pk));
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	}

	}

	if (!rc && sig->sig_class < 2 && is_status_enabled ())
	{
	/* This signature id works best with DLP algorithms because
	* they use a random parameter for every signature. Instead of
	* this sig-id we could have also used the hash of the document
	* and the timestamp, but the drawback of this is, that it is
	* not possible to sign more than one identical document within
	* one second. Some remote batch processing applications might
	* like this feature here.
	*
	* Note that before 2.0.10, we used RIPE-MD160 for the hash
	* and accidentally didn't include the timestamp and algorithm
	* information in the hash. Given that this feature is not
	* commonly used and that a replay attacks detection should
	* not solely be based on this feature (because it does not
	* work with RSA), we take the freedom and switch to SHA-1
	* with 2.0.10 to take advantage of hardware supported SHA-1
	* implementations. We also include the missing information
	* in the hash. Note also the SIG_ID as computed by gpg 1.x
	* and gpg 2.x didn't matched either because 2.x used to print
	* MPIs not in PGP format. */
	u32 a = sig->timestamp;
	int nsig = pubkey_get_nsig (sig->pubkey_algo);
	unsigned char p, buffer;
	size_t n, nbytes;
	int i;
	char hashbuf[20];

	nbytes = 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &n, sig->data[i]))
	BUG();
	nbytes += n;
	}

	/* Make buffer large enough to be later used as output buffer. */
	if (nbytes < 100)
	nbytes = 100;
	nbytes += 10; /* Safety margin. */

	/* Fill and hash buffer. */
	buffer = p = xmalloc (nbytes);
	*p++ = sig->pubkey_algo;
	*p++ = sig->digest_algo;
	*p++ = (a >> 24) & 0xff;
	*p++ = (a >> 16) & 0xff;
	*p++ = (a >> 8) & 0xff;
	*p++ = a & 0xff;
	nbytes -= 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_PGP, p, nbytes, &n, sig->data[i]))
	BUG();
	p += n;
	nbytes -= n;
	}
	gcry_md_hash_buffer (GCRY_MD_SHA1, hashbuf, buffer, p-buffer);

	p = make_radix64_string (hashbuf, 20);
	sprintf (buffer, "%s %s %lu",
	p, strtimestamp (sig->timestamp), (ulong)sig->timestamp);
	xfree (p);
	write_status_text (STATUS_SIG_ID, buffer);
	xfree (buffer);
	}

	if (r_pk)
	*r_pk = pk;
	else
	{
	release_public_key_parts (pk);
	xfree (pk);
	}

	return rc;
	}


	/* The signature SIG was generated with the public key PK. Check
	* whether the signature is valid in the following sense:
	*
	* - Make sure the public key was created before the signature was
	* generated.
	*
	* - Make sure the public key was created in the past
	*
	* - Check whether PK has expired (set *R_EXPIRED to 1 if so and 0
	* otherwise)
	*
	* - Check whether PK has been revoked (set *R_REVOKED to 1 if so
	* and 0 otherwise).
	*
	* If either of the first two tests fail, returns an error code.
	* Otherwise returns 0. (Thus, this function doesn't fail if the
	* public key is expired or revoked.) */
	static int
	check_signature_metadata_validity (PKT_public_key pk, PKT_signature sig,
	int r_expired, int r_revoked)
	{
	u32 cur_time;

	if (r_expired)
	*r_expired = 0;
	if (r_revoked)
	*r_revoked = 0;

	- if (pk->timestamp > sig->timestamp )
	+ if (pk->timestamp > sig->timestamp
	+ && !(parse_key_usage (sig) & PUBKEY_USAGE_RENC))
	{
	ulong d = pk->timestamp - sig->timestamp;
	if ( d < 86400 )
	{
	log_info (ngettext
	("public key %s is %lu second newer than the signature\n",
	"public key %s is %lu seconds newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info (ngettext
	("public key %s is %lu day newer than the signature\n",
	"public key %s is %lu days newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT; /* pubkey newer than signature. */
	}

	cur_time = make_timestamp ();
	if (pk->timestamp > cur_time)
	{
	ulong d = pk->timestamp - cur_time;
	if (d < 86400)
	{
	log_info (ngettext("key %s was created %lu second"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu seconds"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info (ngettext("key %s was created %lu day"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu days"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT;
	}

	/* Check whether the key has expired. We check the has_expired
	* flag which is set after a full evaluation of the key (getkey.c)
	* as well as a simple compare to the current time in case the
	* merge has for whatever reasons not been done. */
	if (pk->has_expired \|\| (pk->expiredate && pk->expiredate < cur_time))
	{
	char buf[11];
	if (opt.verbose)
	log_info (_("Note: signature key %s expired %s\n"),
	keystr_from_pk(pk), asctimestamp( pk->expiredate ) );
	snprintf (buf, sizeof buf, "%lu",(ulong)pk->expiredate);
	write_status_text (STATUS_KEYEXPIRED, buf);
	if (r_expired)
	*r_expired = 1;
	}

	if (pk->flags.revoked)
	{
	if (opt.verbose)
	log_info (_("Note: signature key %s has been revoked\n"),
	keystr_from_pk(pk));
	if (r_revoked)
	*r_revoked=1;
	}

	return 0;
	}


	/* Finish generating a signature and check it. Concretely: make sure
	* that the signature is valid (it was not created prior to the key,
	* the public key was created in the past, and the signature does not
	* include any unsupported critical features), finish computing the
	* digest by adding the relevant data from the signature packet, and
	* check that the signature verifies the digest.
	*
	* DIGEST contains a hash context, which has already hashed the signed
	* data. This function adds the relevant meta-data from the signature
	* packet to compute the final hash. (See Section 5.2 of RFC 4880:
	* "The concatenation of the data being signed and the signature data
	* from the version number through the hashed subpacket data
	* (inclusive) is hashed.")
	*
	* SIG is the signature to check.
	*
	* PK is the public key used to generate the signature.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	* If RET_PK is not NULL, PK is copied into RET_PK on success.
	*
	* Returns 0 on success. An error code other. */
	static int
	check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	int r_expired, int r_revoked, PKT_public_key *ret_pk)
	{
	int rc = 0;

	if ((rc = check_signature_metadata_validity (pk, sig,
	r_expired, r_revoked)))
	return rc;

	if ((rc = check_signature_end_simple (pk, sig, digest)))
	return rc;

	if (!rc && ret_pk)
	copy_public_key(ret_pk,pk);

	return rc;
	}


	/* This function is similar to check_signature_end, but it only checks
	* whether the signature was generated by PK. It does not check
	* expiration, revocation, etc. */
	static int
	check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest)
	{
	gcry_mpi_t result = NULL;
	int rc = 0;

	if (!opt.flags.allow_weak_digest_algos)
	{
	if (is_weak_digest (sig->digest_algo))
	{
	print_digest_rejected_note (sig->digest_algo);
	return GPG_ERR_DIGEST_ALGO;
	}
	}

	/* For key signatures check that the key has a cert usage. We may
	* do this only for subkeys because the primary may always issue key
	* signature. The latter may not be reflected in the pubkey_usage
	* field because we need to check the key signatures to extract the
	* key usage. */
	if (!pk->flags.primary
	&& IS_CERT (sig) && !(pk->pubkey_usage & PUBKEY_USAGE_CERT))
	{
	rc = gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	if (!opt.quiet)
	log_info (_("bad key signature from key %s: %s (0x%02x, 0x%x)\n"),
	keystr_from_pk (pk), gpg_strerror (rc),
	sig->sig_class, pk->pubkey_usage);
	return rc;
	}

	/* For data signatures check that the key has sign usage. */
	if (!IS_BACK_SIG (sig) && IS_SIG (sig)
	&& !(pk->pubkey_usage & PUBKEY_USAGE_SIG))
	{
	rc = gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	if (!opt.quiet)
	log_info (_("bad data signature from key %s: %s (0x%02x, 0x%x)\n"),
	keystr_from_pk (pk), gpg_strerror (rc),
	sig->sig_class, pk->pubkey_usage);
	return rc;
	}

	/* Make sure the digest algo is enabled (in case of a detached
	* signature). */
	gcry_md_enable (digest, sig->digest_algo);

	/* Complete the digest. */
	if (sig->version >= 4)
	gcry_md_putc (digest, sig->version);

	gcry_md_putc( digest, sig->sig_class );
	if (sig->version < 4)
	{
	u32 a = sig->timestamp;
	gcry_md_putc (digest, ((a >> 24) & 0xff));
	gcry_md_putc (digest, ((a >> 16) & 0xff));
	gcry_md_putc (digest, ((a >> 8) & 0xff));
	gcry_md_putc (digest, ( a & 0xff));
	}
	else
	{
	byte buf[6];
	size_t n;
	gcry_md_putc (digest, sig->pubkey_algo);
	gcry_md_putc (digest, sig->digest_algo);
	if (sig->hashed)
	{
	n = sig->hashed->len;
	gcry_md_putc (digest, (n >> 8) );
	gcry_md_putc (digest, n );
	gcry_md_write (digest, sig->hashed->data, n);
	n += 6;
	}
	else
	{
	/* Two octets for the (empty) length of the hashed
	* section. */
	gcry_md_putc (digest, 0);
	gcry_md_putc (digest, 0);
	n = 6;
	}
	/* Add some magic per Section 5.2.4 of RFC 4880. */
	buf[0] = sig->version;
	buf[1] = 0xff;
	buf[2] = n >> 24;
	buf[3] = n >> 16;
	buf[4] = n >> 8;
	buf[5] = n;
	gcry_md_write( digest, buf, 6 );
	}
	gcry_md_final( digest );

	/* Convert the digest to an MPI. */
	result = encode_md_value (pk, digest, sig->digest_algo );
	if (!result)
	return GPG_ERR_GENERAL;

	/* Verify the signature. */
	rc = pk_verify (pk->pubkey_algo, result, sig->data, pk->pkey);
	gcry_mpi_release (result);

	if (!rc && sig->flags.unknown_critical)
	{
	log_info(_("assuming bad signature from key %s"
	" due to an unknown critical bit\n"),keystr_from_pk(pk));
	rc = GPG_ERR_BAD_SIGNATURE;
	}

	return rc;
	}


	/* Add a uid node to a hash context. See section 5.2.4, paragraph 4
	* of RFC 4880. */
	static void
	hash_uid_packet (PKT_user_id uid, gcry_md_hd_t md, PKT_signature sig )
	{
	if (uid->attrib_data)
	{
	if (sig->version >=4)
	{
	byte buf[5];
	buf[0] = 0xd1; /* packet of type 17 */
	buf[1] = uid->attrib_len >> 24; /* always use 4 length bytes */
	buf[2] = uid->attrib_len >> 16;
	buf[3] = uid->attrib_len >> 8;
	buf[4] = uid->attrib_len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->attrib_data, uid->attrib_len );
	}
	else
	{
	if (sig->version >=4)
	{
	byte buf[5];
	buf[0] = 0xb4; /* indicates a userid packet */
	buf[1] = uid->len >> 24; /* always use 4 length bytes */
	buf[2] = uid->len >> 16;
	buf[3] = uid->len >> 8;
	buf[4] = uid->len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->name, uid->len );
	}
	}

	static void
	cache_sig_result ( PKT_signature *sig, int result )
	{
	if (!result)
	{
	sig->flags.checked = 1;
	sig->flags.valid = 1;
	}
	else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE)
	{
	sig->flags.checked = 1;
	sig->flags.valid = 0;
	}
	else
	{
	sig->flags.checked = 0;
	sig->flags.valid = 0;
	}
	}


	/* SIG is a key revocation signature. Check if this signature was
	* generated by any of the public key PK's designated revokers.
	*
	* PK is the public key that SIG allegedly revokes.
	*
	* SIG is the revocation signature to check.
	*
	* This function avoids infinite recursion, which can happen if two
	* keys are designed revokers for each other and they revoke each
	* other. This is done by observing that if a key A is revoked by key
	* B we still consider the revocation to be valid even if B is
	* revoked. Thus, we don't need to determine whether B is revoked to
	* determine whether A has been revoked by B, we just need to check
	* the signature.
	*
	* Returns 0 if sig is valid (i.e. pk is revoked), non-0 if not
	* revoked. We are careful to make sure that GPG_ERR_NO_PUBKEY is
	* only returned when a revocation signature is from a valid
	* revocation key designated in a revkey subpacket, but the revocation
	* key itself isn't present.
	*
	* XXX: This code will need to be modified if gpg ever becomes
	* multi-threaded. Note that this guarantees that a designated
	* revocation sig will never be considered valid unless it is actually
	* valid, as well as being issued by a revocation key in a valid
	* direct signature. Note also that this is written so that a revoked
	* revoker can still issue revocations: i.e. If A revokes B, but A is
	* revoked, B is still revoked. I'm not completely convinced this is
	* the proper behavior, but it matches how PGP does it. -dms */
	int
	check_revocation_keys (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig)
	{
	static int busy=0;
	int i;
	int rc = GPG_ERR_GENERAL;

	log_assert (IS_KEY_REV(sig));
	log_assert ((sig->keyid[0]!=pk->keyid[0]) \|\| (sig->keyid[0]!=pk->keyid[1]));

	/* Avoid infinite recursion. Consider the following:
	*
	* - We want to check if A is revoked.
	*
	* - C is a designated revoker for B and has revoked B.
	*
	* - B is a designated revoker for A and has revoked A.
	*
	* When checking if A is revoked (in merge_selfsigs_main), we
	* observe that A has a designed revoker. As such, we call this
	* function. This function sees that there is a valid revocation
	* signature, which is signed by B. It then calls check_signature()
	* to verify that the signature is good. To check the sig, we need
	* to lookup B. Looking up B means calling merge_selfsigs_main,
	* which checks whether B is revoked, which calls this function to
	* see if B was revoked by some key.
	*
	* In this case, the added level of indirection doesn't hurt. It
	* just means a bit more work. However, if C == A, then we'd end up
	* in a loop. But, it doesn't make sense to look up C anyways: even
	* if B is revoked, we conservatively consider a valid revocation
	* signed by B to revoke A. Since this is the only place where this
	* type of recursion can occur, we simply cause this function to
	* fail if it is entered recursively. */
	if (busy)
	{
	/* Return an error (i.e. not revoked), but mark the pk as
	uncacheable as we don't really know its revocation status
	until it is checked directly. */
	pk->flags.dont_cache = 1;
	return rc;
	}

	busy=1;

	/* es_printf("looking at %08lX with a sig from %08lX\n",(ulong)pk->keyid[1],
	(ulong)sig->keyid[1]); */

	/* is the issuer of the sig one of our revokers? */
	if( !pk->revkey && pk->numrevkeys )
	BUG();
	else
	for(i=0;i<pk->numrevkeys;i++)
	{
	/* The revoker's keyid. */
	u32 keyid[2];

	keyid_from_fingerprint (ctrl, pk->revkey[i].fpr,
	MAX_FINGERPRINT_LEN, keyid);

	if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
	/* The signature was generated by a designated revoker.
	Verify the signature. */
	{
	gcry_md_hd_t md;

	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();
	hash_public_key(md,pk);
	/* Note: check_signature only checks that the signature
	is good. It does not fail if the key is revoked. */
	rc = check_signature (ctrl, sig, md);
	cache_sig_result(sig,rc);
	gcry_md_close (md);
	break;
	}
	}

	busy=0;

	return rc;
	}

	/* Check that the backsig BACKSIG from the subkey SUB_PK to its
	* primary key MAIN_PK is valid.
	*
	* Backsigs (0x19) have the same format as binding sigs (0x18), but
	* this function is simpler than check_key_signature in a few ways.
	* For example, there is no support for expiring backsigs since it is
	* questionable what such a thing actually means. Note also that the
	* sig cache check here, unlike other sig caches in GnuPG, is not
	* persistent. */
	int
	check_backsig (PKT_public_key main_pk,PKT_public_key sub_pk,
	PKT_signature *backsig)
	{
	gcry_md_hd_t md;
	int rc;

	/* Always check whether the algorithm is available. Although
	gcry_md_open would throw an error, some libgcrypt versions will
	print a debug message in that case too. */
	if ((rc=openpgp_md_test_algo (backsig->digest_algo)))
	return rc;

	if(!opt.no_sig_cache && backsig->flags.checked)
	return backsig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);

	rc = gcry_md_open (&md, backsig->digest_algo,0);
	if (!rc)
	{
	hash_public_key(md,main_pk);
	hash_public_key(md,sub_pk);
	rc = check_signature_end (sub_pk, backsig, md, NULL, NULL, NULL);
	cache_sig_result(backsig,rc);
	gcry_md_close(md);
	}

	return rc;
	}


	/* Check that a signature over a key is valid. This is a
	* specialization of check_key_signature2 with the unnamed parameters
	* passed as NULL. See the documentation for that function for more
	* details. */
	int
	check_key_signature (ctrl_t ctrl, kbnode_t root, kbnode_t node,
	int *is_selfsig)
	{
	return check_key_signature2 (ctrl, root, node, NULL, NULL,
	is_selfsig, NULL, NULL);
	}


	/* Returns whether SIGNER generated the signature SIG over the packet
	* PACKET, which is a key, subkey or uid, and comes from the key block
	* KB. (KB is PACKET's corresponding keyblock; we don't assume that
	* SIG has been added to the keyblock.)
	*
	* If SIGNER is set, then checks whether SIGNER generated the
	* signature. Otherwise, uses SIG->KEYID to find the alleged signer.
	* This parameter can be used to effectively override the alleged
	* signer that is stored in SIG.
	*
	* KB may be NULL if SIGNER is set.
	*
	* Unlike check_key_signature, this function ignores any cached
	* results! That is, it does not consider SIG->FLAGS.CHECKED and
	* SIG->FLAGS.VALID nor does it set them.
	*
	* This doesn't check the signature's semantic mean. Concretely, it
	* doesn't check whether a non-self signed revocation signature was
	* created by a designated revoker. In fact, it doesn't return an
	* error for a binding generated by a completely different key!
	*
	* Returns 0 if the signature is valid. Returns GPG_ERR_SIG_CLASS if
	* this signature can't be over PACKET. Returns GPG_ERR_NOT_FOUND if
	* the key that generated the signature (according to SIG) could not
	* be found. Returns GPG_ERR_BAD_SIGNATURE if the signature is bad.
	* Other errors codes may be returned if something else goes wrong.
	*
	* IF IS_SELFSIG is not NULL, sets *IS_SELFSIG to 1 if this is a
	* self-signature (by the key's primary key) or 0 if not.
	*
	* If RET_PK is not NULL, returns a copy of the public key that
	* generated the signature (i.e., the signer) on success. This must
	* be released by the caller using release_public_key_parts (). */
	gpg_error_t
	check_signature_over_key_or_uid (ctrl_t ctrl, PKT_public_key *signer,
	PKT_signature sig, KBNODE kb, PACKET packet,
	int is_selfsig, PKT_public_key ret_pk)
	{
	int rc;
	PKT_public_key *pripk = kb->pkt->pkt.public_key;
	gcry_md_hd_t md;
	int signer_alloced = 0;
	int stub_is_selfsig;

	if (!is_selfsig)
	is_selfsig = &stub_is_selfsig;

	rc = openpgp_pk_test_algo (sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo (sig->digest_algo);
	if (rc)
	return rc;

	/* A signature's class indicates the type of packet that it
	signs. */
	if (IS_BACK_SIG (sig) \|\| IS_KEY_SIG (sig) \|\| IS_KEY_REV (sig))
	{
	/* Key revocations can only be over primary keys. */
	if (packet->pkttype != PKT_PUBLIC_KEY)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (IS_SUBKEY_SIG (sig) \|\| IS_SUBKEY_REV (sig))
	{
	if (packet->pkttype != PKT_PUBLIC_SUBKEY)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	if (packet->pkttype != PKT_USER_ID)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else
	return gpg_error (GPG_ERR_SIG_CLASS);

	/* PACKET is the right type for SIG. */

	if (signer)
	{
	if (signer->keyid[0] == pripk->keyid[0]
	&& signer->keyid[1] == pripk->keyid[1])
	*is_selfsig = 1;
	else
	*is_selfsig = 0;
	}
	else
	{
	/* Get the signer. If possible, avoid a look up. */
	if (sig->keyid[0] == pripk->keyid[0]
	&& sig->keyid[1] == pripk->keyid[1])
	{
	/* Issued by the primary key. */
	signer = pripk;
	*is_selfsig = 1;
	}
	else
	{
	/* See if one of the subkeys was the signer (although this
	* is extremely unlikely). */
	kbnode_t ctx = NULL;
	kbnode_t n;

	while ((n = walk_kbnode (kb, &ctx, 0)))
	{
	PKT_public_key *subk;

	if (n->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	subk = n->pkt->pkt.public_key;
	if (sig->keyid[0] == subk->keyid[0]
	&& sig->keyid[1] == subk->keyid[1])
	{
	/* Issued by a subkey. */
	signer = subk;
	break;
	}
	}

	if (! signer)
	{
	/* Signer by some other key. */
	*is_selfsig = 0;
	if (ret_pk)
	{
	signer = ret_pk;
	/* FIXME: Using memset here is probematic because it
	* assumes that there are no allocated fields in
	* SIGNER. */
	memset (signer, 0, sizeof (*signer));
	signer_alloced = 1;
	}
	else
	{
	signer = xmalloc_clear (sizeof (*signer));
	signer_alloced = 2;
	}

	if (IS_CERT (sig))
	signer->req_usage = PUBKEY_USAGE_CERT;

	rc = get_pubkey_for_sig (ctrl, signer, sig, NULL);
	if (rc)
	{
	xfree (signer);
	signer = NULL;
	signer_alloced = 0;
	goto leave;
	}
	}
	}
	}

	/* We checked above that we supported this algo, so an error here is
	* a bug. */
	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();

	/* Hash the relevant data. */

	if (IS_KEY_SIG (sig) \|\| IS_KEY_REV (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (IS_BACK_SIG (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	hash_public_key (md, signer);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (IS_SUBKEY_SIG (sig) \|\| IS_SUBKEY_REV (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_SUBKEY);
	hash_public_key (md, pripk);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	log_assert (packet->pkttype == PKT_USER_ID);
	if (sig->digest_algo == DIGEST_ALGO_SHA1 && !*is_selfsig
	&& sig->timestamp > 1547856000
	&& !opt.flags.allow_weak_key_signatures)
	{
	/* If the signature was created using SHA-1 we consider this
	* signature invalid because it makes it possible to mount a
	* chosen-prefix collision. We don't do this for
	* self-signatures or for signatures created before the
	* somewhat arbitrary cut-off date 2019-01-19. */
	print_sha1_keysig_rejected_note ();
	rc = gpg_error (GPG_ERR_DIGEST_ALGO);
	}
	else
	{
	hash_public_key (md, pripk);
	hash_uid_packet (packet->pkt.user_id, md, sig);
	rc = check_signature_end_simple (signer, sig, md);
	}
	}
	else
	{
	/* We should never get here. (The first if above should have
	* already caught this error.) */
	BUG ();
	}

	gcry_md_close (md);

	leave:
	if (! rc && ret_pk && ret_pk != signer)
	copy_public_key (ret_pk, signer);

	if (signer_alloced)
	{
	/* We looked up SIGNER; it is not a pointer into KB. */
	release_public_key_parts (signer);
	/* Free if we also allocated the memory. */
	if (signer_alloced == 2)
	xfree (signer);
	}

	return rc;
	}


	/* Check that a signature over a key (e.g., a key revocation, key
	* binding, user id certification, etc.) is valid. If the function
	* detects a self-signature, it uses the public key from the specified
	* key block and does not bother looking up the key specified in the
	* signature packet.
	*
	* ROOT is a keyblock.
	*
	* NODE references a signature packet that appears in the keyblock
	* that should be verified.
	*
	* If CHECK_PK is set, the specified key is sometimes preferred for
	* verifying signatures. See the implementation for details.
	*
	* If RET_PK is not NULL, the public key that successfully verified
	* the signature is copied into *RET_PK.
	*
	* If IS_SELFSIG is not NULL, *IS_SELFSIG is set to 1 if NODE is a
	* self-signature.
	*
	* If R_EXPIREDATE is not NULL, *R_EXPIREDATE is set to the expiry
	* date.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has been
	* expired (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	*
	* If OPT.NO_SIG_CACHE is not set, this function will first check if
	* the result of a previous verification is already cached in the
	* signature packet's data structure.
	*
	* TODO: add r_revoked here as well. It has the same problems as
	* r_expiredate and r_expired and the cache. */
	int
	check_key_signature2 (ctrl_t ctrl,
	kbnode_t root, kbnode_t node, PKT_public_key *check_pk,
	PKT_public_key ret_pk, int is_selfsig,
	u32 r_expiredate, int r_expired )
	{
	PKT_public_key *pk;
	PKT_signature *sig;
	int algo;
	int rc;

	if (is_selfsig)
	*is_selfsig = 0;
	if (r_expiredate)
	*r_expiredate = 0;
	if (r_expired)
	*r_expired = 0;
	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	log_assert (root->pkt->pkttype == PKT_PUBLIC_KEY);

	pk = root->pkt->pkt.public_key;
	sig = node->pkt->pkt.signature;
	algo = sig->digest_algo;

	/* Check whether we have cached the result of a previous signature
	* check. Note that we may no longer have the pubkey or hash
	* needed to verify a sig, but can still use the cached value. A
	* cache refresh detects and clears these cases. */
	if ( !opt.no_sig_cache )
	{
	cache_stats.total++;
	if (sig->flags.checked) /* Cached status available. */
	{
	cache_stats.cached++;
	if (is_selfsig)
	{
	u32 keyid[2];

	keyid_from_pk (pk, keyid);
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	*is_selfsig = 1;
	}
	/* BUG: This is wrong for non-self-sigs... needs to be the
	* actual pk. */
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (rc)
	return rc;
	if (sig->flags.valid)
	{
	cache_stats.goodsig++;
	return 0;
	}
	cache_stats.badsig++;
	return gpg_error (GPG_ERR_BAD_SIGNATURE);
	}
	}

	rc = openpgp_pk_test_algo(sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo(algo);
	if (rc)
	return rc;

	if (IS_KEY_REV (sig))
	{
	u32 keyid[2];
	keyid_from_pk( pk, keyid );

	/* Is it a designated revoker? */
	if (keyid[0] != sig->keyid[0] \|\| keyid[1] != sig->keyid[1])
	rc = check_revocation_keys (ctrl, pk, sig);
	else
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (ctrl, pk, sig,
	root, root->pkt,
	is_selfsig, ret_pk);
	}
	}
	else if (IS_SUBKEY_REV (sig) \|\| IS_SUBKEY_SIG (sig))
	{
	kbnode_t snode = find_prev_kbnode (root, node, PKT_PUBLIC_SUBKEY);

	if (snode)
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	{
	/* A subkey revocation (0x28) must be a self-sig, but a
	* subkey signature (0x18) needn't be. */
	rc = check_signature_over_key_or_uid (ctrl,
	IS_SUBKEY_SIG (sig)
	? NULL : pk,
	sig, root, snode->pkt,
	is_selfsig, ret_pk);
	}
	}
	else
	{
	if (opt.verbose)
	{
	if (IS_SUBKEY_REV (sig))
	log_info (_("key %s: no subkey for subkey"
	" revocation signature\n"), keystr_from_pk(pk));
	else if (sig->sig_class == 0x18)
	log_info(_("key %s: no subkey for subkey"
	" binding signature\n"), keystr_from_pk(pk));
	}
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else if (IS_KEY_SIG (sig)) /* direct key signature */
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (ctrl, pk, sig, root, root->pkt,
	is_selfsig, ret_pk);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	kbnode_t unode = find_prev_kbnode (root, node, PKT_USER_ID);

	if (unode)
	{
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (! rc)
	{
	/* If this is a self-sig, ignore check_pk. */
	rc = check_signature_over_key_or_uid
	(ctrl,
	keyid_cmp (pk_keyid (pk), sig->keyid) == 0 ? pk : check_pk,
	sig, root, unode->pkt, NULL, ret_pk);
	}
	}
	else
	{
	if (!opt.quiet)
	log_info ("key %s: no user ID for key signature packet"
	" of class %02x\n",keystr_from_pk(pk),sig->sig_class);
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else
	{
	log_info ("sig issued by %s with class %d (digest: %02x %02x)"
	" is not valid over a user id or a key id, ignoring.\n",
	keystr (sig->keyid), sig->sig_class,
	sig->digest_start[0], sig->digest_start[1]);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	}

	cache_sig_result (sig, rc);

	return rc;
	}

File Metadata

Mime Type: text/x-diff
Expires: Tue, Jan 20, 1:43 AM (1 d, 20 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 46/44/1170d711d1c0e9b501824f5c482f

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions