No OneTemporary
Actions

Size

672 KB

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/g10/getkey.c b/g10/getkey.c
	index 0349a3858..4b31b8468 100644
	--- a/g10/getkey.c
	+++ b/g10/getkey.c
	@@ -1,4260 +1,4318 @@
	/* getkey.c - Get a key from the database
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007, 2008, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "keydb.h"
	#include "options.h"
	#include "main.h"
	#include "trustdb.h"
	#include "../common/i18n.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "objcache.h"
	#include "../common/host2net.h"
	#include "../common/mbox-util.h"
	#include "../common/status.h"

	#define MAX_PK_CACHE_ENTRIES PK_UID_CACHE_SIZE
	#define MAX_UID_CACHE_ENTRIES PK_UID_CACHE_SIZE

	#if MAX_PK_CACHE_ENTRIES < 2
	#error We need the cache for key creation
	#endif

	/* Flags values returned by the lookup code. Note that the values are
	* directly used by the KEY_CONSIDERED status line. */
	#define LOOKUP_NOT_SELECTED (1<<0)
	#define LOOKUP_ALL_SUBKEYS_EXPIRED (1<<1) /* or revoked */


	/* A context object used by the lookup functions. */
	struct getkey_ctx_s
	{
	/* Part of the search criteria: whether the search is an exact
	search or not. A search that is exact requires that a key or
	subkey meet all of the specified criteria. A search that is not
	exact allows selecting a different key or subkey from the
	keyblock that matched the criteria. Further, an exact search
	returns the key or subkey that matched whereas a non-exact search
	typically returns the primary key. See finish_lookup for
	details. */
	int exact;

	/* Part of the search criteria: Whether the caller only wants keys
	with an available secret key. This is used by getkey_next to get
	the next result with the same initial criteria. */
	int want_secret;

	/* Part of the search criteria: The type of the requested key. A
	mask of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT.
	If non-zero, then for a key to match, it must implement one of
	the required uses. */
	int req_usage;

	/* The database handle. */
	KEYDB_HANDLE kr_handle;

	/* Whether we should call xfree() on the context when the context is
	released using getkey_end()). */
	int not_allocated;

	/* This variable is used as backing store for strings which have
	their address used in ITEMS. */
	strlist_t extra_list;

	/* Hack to return the mechanism (AKL_foo) used to find the key. */
	int found_via_akl;

	/* Part of the search criteria: The low-level search specification
	as passed to keydb_search. */
	int nitems;
	/* This must be the last element in the structure. When we allocate
	the structure, we allocate it so that ITEMS can hold NITEMS. */
	KEYDB_SEARCH_DESC items[1];
	};

	#if 0
	static struct
	{
	int any;
	int okay_count;
	int nokey_count;
	int error_count;
	} lkup_stats[21];
	#endif

	typedef struct keyid_list
	{
	struct keyid_list *next;
	byte fprlen;
	char fpr[MAX_FINGERPRINT_LEN];
	u32 keyid[2];
	} *keyid_list_t;


	#if MAX_PK_CACHE_ENTRIES
	typedef struct pk_cache_entry
	{
	struct pk_cache_entry *next;
	u32 keyid[2];
	PKT_public_key *pk;
	} *pk_cache_entry_t;
	static pk_cache_entry_t pk_cache;
	static int pk_cache_entries; /* Number of entries in pk cache. */
	static int pk_cache_disabled;
	#endif

	#if MAX_UID_CACHE_ENTRIES < 5
	#error we really need the userid cache
	#endif

	static void merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock);
	static int lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
	kbnode_t ret_keyblock, kbnode_t ret_found_key);
	static kbnode_t finish_lookup (kbnode_t keyblock,
	unsigned int req_usage, int want_exact,
	int want_secret, unsigned int *r_flags);
	static void print_status_key_considered (kbnode_t keyblock, unsigned int flags);


	#if 0
	static void
	print_stats ()
	{
	int i;
	for (i = 0; i < DIM (lkup_stats); i++)
	{
	if (lkup_stats[i].any)
	es_fprintf (es_stderr,
	"lookup stats: mode=%-2d ok=%-6d nokey=%-6d err=%-6d\n",
	i,
	lkup_stats[i].okay_count,
	lkup_stats[i].nokey_count, lkup_stats[i].error_count);
	}
	}
	#endif


	/* Cache a copy of a public key in the public key cache. PK is not
	* cached if caching is disabled (via getkey_disable_caches), if
	* PK->FLAGS.DONT_CACHE is set, we don't know how to derive a key id
	* from the public key (e.g., unsupported algorithm), or a key with
	* the key id is already in the cache.
	*
	* The public key packet is copied into the cache using
	* copy_public_key. Thus, any secret parts are not copied, for
	* instance.
	*
	* This cache is filled by get_pubkey and is read by get_pubkey and
	* get_pubkey_fast. */
	void
	cache_public_key (PKT_public_key * pk)
	{
	#if MAX_PK_CACHE_ENTRIES
	pk_cache_entry_t ce, ce2;
	u32 keyid[2];

	if (pk_cache_disabled)
	return;

	if (pk->flags.dont_cache)
	return;

	if (is_ELGAMAL (pk->pubkey_algo)
	\|\| pk->pubkey_algo == PUBKEY_ALGO_DSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_EDDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDH
	\|\| is_RSA (pk->pubkey_algo))
	{
	keyid_from_pk (pk, keyid);
	}
	else
	return; /* Don't know how to get the keyid. */

	for (ce = pk_cache; ce; ce = ce->next)
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	{
	if (DBG_CACHE)
	log_debug ("cache_public_key: already in cache\n");
	return;
	}

	if (pk_cache_entries >= MAX_PK_CACHE_ENTRIES)
	{
	int n;

	/* Remove the last 50% of the entries. */
	for (ce = pk_cache, n = 0; ce && n < pk_cache_entries/2; n++)
	ce = ce->next;
	if (ce && ce != pk_cache && ce->next)
	{
	ce2 = ce->next;
	ce->next = NULL;
	ce = ce2;
	for (; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	pk_cache_entries--;
	}
	}
	log_assert (pk_cache_entries < MAX_PK_CACHE_ENTRIES);
	}
	pk_cache_entries++;
	ce = xmalloc (sizeof *ce);
	ce->next = pk_cache;
	pk_cache = ce;
	ce->pk = copy_public_key (NULL, pk);
	ce->keyid[0] = keyid[0];
	ce->keyid[1] = keyid[1];
	#endif
	}


	/* Return a const utf-8 string with the text "[User ID not found]".
	This function is required so that we don't need to switch gettext's
	encoding temporary. */
	static const char *
	user_id_not_found_utf8 (void)
	{
	static char *text;

	if (!text)
	text = native_to_utf8 (_("[User ID not found]"));
	return text;
	}




	/* Disable and drop the public key cache (which is filled by
	cache_public_key and get_pubkey). Note: there is currently no way
	to re-enable this cache. */
	void
	getkey_disable_caches ()
	{
	#if MAX_PK_CACHE_ENTRIES
	{
	pk_cache_entry_t ce, ce2;

	for (ce = pk_cache; ce; ce = ce2)
	{
	ce2 = ce->next;
	free_public_key (ce->pk);
	xfree (ce);
	}
	pk_cache_disabled = 1;
	pk_cache_entries = 0;
	pk_cache = NULL;
	}
	#endif
	/* fixme: disable user id cache ? */
	}


	/* Free a list of pubkey_t objects. */
	void
	pubkeys_free (pubkey_t keys)
	{
	while (keys)
	{
	pubkey_t next = keys->next;
	xfree (keys->pk);
	release_kbnode (keys->keyblock);
	xfree (keys);
	keys = next;
	}
	}


	static void
	pk_from_block (PKT_public_key *pk, kbnode_t keyblock, kbnode_t found_key)
	{
	kbnode_t a = found_key ? found_key : keyblock;

	log_assert (a->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| a->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	copy_public_key (pk, a->pkt->pkt.public_key);
	}


	/* Specialized version of get_pubkey which retrieves the key based on
	- * information in SIG. In contrast to get_pubkey PK is required. */
	+ * information in SIG. In contrast to get_pubkey PK is required. IF
	+ * FORCED_PK is not NULL, this public key is used and copied to PK. */
	gpg_error_t
	-get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig)
	+get_pubkey_for_sig (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig,
	+ PKT_public_key *forced_pk)
	{
	const byte *fpr;
	size_t fprlen;

	+ if (forced_pk)
	+ {
	+ copy_public_key (pk, forced_pk);
	+ return 0;
	+ }
	+
	/* First try the new ISSUER_FPR info. */
	fpr = issuer_fpr_raw (sig, &fprlen);
	if (fpr && !get_pubkey_byfprint (ctrl, pk, NULL, fpr, fprlen))
	return 0;

	/* Fallback to use the ISSUER_KEYID. */
	return get_pubkey (ctrl, pk, sig->keyid);
	}


	/* Return the public key with the key id KEYID and store it at PK.
	* The resources in *PK should be released using
	* release_public_key_parts(). This function also stores a copy of
	* the public key in the user id cache (see cache_public_key).
	*
	* If PK is NULL, this function just stores the public key in the
	* cache and returns the usual return code.
	*
	* PK->REQ_USAGE (which is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT) is passed through to the
	* lookup function. If this is non-zero, only keys with the specified
	* usage will be returned. As such, it is essential that
	* PK->REQ_USAGE be correctly initialized!
	*
	* Returns 0 on success, GPG_ERR_NO_PUBKEY if there is no public key
	* with the specified key id, or another error code if an error
	* occurs.
	*
	* If the data was not read from the cache, then the self-signed data
	* has definitely been merged into the public key using
	* merge_selfsigs. */
	int
	get_pubkey (ctrl_t ctrl, PKT_public_key * pk, u32 * keyid)
	{
	int internal = 0;
	int rc = 0;

	#if MAX_PK_CACHE_ENTRIES
	if (pk)
	{
	/* Try to get it from the cache. We don't do this when pk is
	NULL as it does not guarantee that the user IDs are
	cached. */
	pk_cache_entry_t ce;
	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1])
	/* XXX: We don't check PK->REQ_USAGE here, but if we don't
	read from the cache, we do check it! */
	{
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif
	/* More init stuff. */
	if (!pk)
	{
	internal++;
	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	}


	/* Do a lookup. */
	{
	struct getkey_ctx_s ctx;
	kbnode_t kb = NULL;
	kbnode_t found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;

	if (ctrl && ctrl->cached_getkey_kdb)
	{
	ctx.kr_handle = ctrl->cached_getkey_kdb;
	ctrl->cached_getkey_kdb = NULL;
	keydb_search_reset (ctx.kr_handle);
	}
	else
	{
	ctx.kr_handle = keydb_new (ctrl);
	if (!ctx.kr_handle)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	}
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	rc = lookup (ctrl, &ctx, 0, &kb, &found_key);
	if (!rc)
	{
	pk_from_block (pk, kb, found_key);
	}
	getkey_end (ctrl, &ctx);
	release_kbnode (kb);
	}
	if (!rc)
	goto leave;

	rc = GPG_ERR_NO_PUBKEY;

	leave:
	if (!rc)
	cache_public_key (pk);
	if (internal)
	free_public_key (pk);
	return rc;
	}


	/* Similar to get_pubkey, but it does not take PK->REQ_USAGE into
	* account nor does it merge in the self-signed data. This function
	* also only considers primary keys. It is intended to be used as a
	* quick check of the key to avoid recursion. It should only be used
	* in very certain cases. Like get_pubkey and unlike any of the other
	* lookup functions, this function also consults the user id cache
	* (see cache_public_key).
	*
	* Return the public key in PK. The resources in PK should be
	* released using release_public_key_parts(). */
	int
	get_pubkey_fast (ctrl_t ctrl, PKT_public_key * pk, u32 * keyid)
	{
	int rc = 0;
	KEYDB_HANDLE hd;
	KBNODE keyblock;
	u32 pkid[2];

	log_assert (pk);
	#if MAX_PK_CACHE_ENTRIES
	{
	/* Try to get it from the cache */
	pk_cache_entry_t ce;

	for (ce = pk_cache; ce; ce = ce->next)
	{
	if (ce->keyid[0] == keyid[0] && ce->keyid[1] == keyid[1]
	/* Only consider primary keys. */
	&& ce->pk->keyid[0] == ce->pk->main_keyid[0]
	&& ce->pk->keyid[1] == ce->pk->main_keyid[1])
	{
	if (pk)
	copy_public_key (pk, ce->pk);
	return 0;
	}
	}
	}
	#endif

	hd = keydb_new (ctrl);
	if (!hd)
	return gpg_error_from_syserror ();
	rc = keydb_search_kid (hd, keyid);
	if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	{
	keydb_release (hd);
	return GPG_ERR_NO_PUBKEY;
	}
	rc = keydb_get_keyblock (hd, &keyblock);
	keydb_release (hd);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	return GPG_ERR_NO_PUBKEY;
	}

	log_assert (keyblock && keyblock->pkt
	&& keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* We return the primary key. If KEYID matched a subkey, then we
	return an error. */
	keyid_from_pk (keyblock->pkt->pkt.public_key, pkid);
	if (keyid[0] == pkid[0] && keyid[1] == pkid[1])
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	else
	rc = GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	return rc;
	}


	/* Return the entire keyblock used to create SIG. This is a
	* specialized version of get_pubkeyblock.
	*
	* FIXME: This is a hack because get_pubkey_for_sig was already called
	* and it could have used a cache to hold the key. */
	kbnode_t
	get_pubkeyblock_for_sig (ctrl_t ctrl, PKT_signature *sig)
	{
	const byte *fpr;
	size_t fprlen;
	kbnode_t keyblock;

	/* First try the new ISSUER_FPR info. */
	fpr = issuer_fpr_raw (sig, &fprlen);
	if (fpr && !get_pubkey_byfprint (ctrl, NULL, &keyblock, fpr, fprlen))
	return keyblock;

	/* Fallback to use the ISSUER_KEYID. */
	return get_pubkeyblock (ctrl, sig->keyid);
	}


	/* Return the key block for the key with key id KEYID or NULL, if an
	* error occurs. Use release_kbnode() to release the key block.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	kbnode_t
	get_pubkeyblock (ctrl_t ctrl, u32 * keyid)
	{
	struct getkey_ctx_s ctx;
	int rc = 0;
	KBNODE keyblock = NULL;

	memset (&ctx, 0, sizeof ctx);
	/* No need to set exact here because we want the entire block. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new (ctrl);
	if (!ctx.kr_handle)
	return NULL;
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	rc = lookup (ctrl, &ctx, 0, &keyblock, NULL);
	getkey_end (ctrl, &ctx);

	return rc ? NULL : keyblock;
	}


	/* Return the public key with the key id KEYID iff the secret key is
	* available and store it at PK. The resources should be released
	* using release_public_key_parts().
	*
	* Unlike other lookup functions, PK may not be NULL. PK->REQ_USAGE
	* is passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. Thus, it
	* must be valid! If this is non-zero, only keys with the specified
	* usage will be returned.
	*
	* Returns 0 on success. If a public key with the specified key id is
	* not found or a secret key is not available for that public key, an
	* error code is returned. Note: this function ignores legacy keys.
	* An error code is also return if an error occurs.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	get_seckey (ctrl_t ctrl, PKT_public_key pk, u32 keyid)
	{
	gpg_error_t err;
	struct getkey_ctx_s ctx;
	kbnode_t keyblock = NULL;
	kbnode_t found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1; /* Use the key ID exactly as given. */
	ctx.not_allocated = 1;
	ctx.kr_handle = keydb_new (ctrl);
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();
	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx.items[0].u.kid[0] = keyid[0];
	ctx.items[0].u.kid[1] = keyid[1];
	ctx.req_usage = pk->req_usage;
	err = lookup (ctrl, &ctx, 1, &keyblock, &found_key);
	if (!err)
	{
	pk_from_block (pk, keyblock, found_key);
	}
	getkey_end (ctrl, &ctx);
	release_kbnode (keyblock);

	if (!err)
	{
	if (!agent_probe_secret_key (/ctrl/NULL, pk))
	{
	release_public_key_parts (pk);
	err = gpg_error (GPG_ERR_NO_SECKEY);
	}
	}

	return err;
	}


	/* Skip unusable keys. A key is unusable if it is revoked, expired or
	disabled or if the selected user id is revoked or expired. */
	static int
	skip_unusable (void opaque, u32 keyid, int uid_no)
	{
	ctrl_t ctrl = opaque;
	int unusable = 0;
	KBNODE keyblock;
	PKT_public_key *pk;

	keyblock = get_pubkeyblock (ctrl, keyid);
	if (!keyblock)
	{
	log_error ("error checking usability status of %s\n", keystr (keyid));
	goto leave;
	}

	pk = keyblock->pkt->pkt.public_key;

	/* Is the key revoked or expired? */
	if (pk->flags.revoked \|\| pk->has_expired)
	unusable = 1;

	/* Is the user ID in question revoked or expired? */
	if (!unusable && uid_no)
	{
	KBNODE node;
	int uids_seen = 0;

	for (node = keyblock; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *user_id = node->pkt->pkt.user_id;

	uids_seen ++;
	if (uids_seen != uid_no)
	continue;

	if (user_id->flags.revoked \|\| user_id->flags.expired)
	unusable = 1;

	break;
	}
	}

	/* If UID_NO is non-zero, then the keyblock better have at least
	that many UIDs. */
	log_assert (uids_seen == uid_no);
	}

	if (!unusable)
	unusable = pk_is_disabled (pk);

	leave:
	release_kbnode (keyblock);
	return unusable;
	}


	/* Search for keys matching some criteria.

	If RETCTX is not NULL, then the constructed context is returned in
	*RETCTX so that getpubkey_next can be used to get subsequent
	results. In this case, getkey_end() must be used to free the
	search context. If RETCTX is not NULL, then RET_KDBHD must be
	NULL.

	If NAMELIST is not NULL, then a search query is constructed using
	classify_user_id on each of the strings in the list. (Recall: the
	database does an OR of the terms, not an AND.) If NAMELIST is
	NULL, then all results are returned.

	If PK is not NULL, the public key of the first result is returned
	in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	set, it is used to filter the search results. See the
	documentation for finish_lookup to understand exactly how this is
	used. Note: The self-signed data has already been merged into the
	public key using merge_selfsigs. Free *PK by calling
	release_public_key_parts (or, if PK was allocated using xfree, you
	can use free_public_key, which calls release_public_key_parts(PK)
	and then xfree(PK)).

	If WANT_SECRET is set, then only keys with an available secret key
	(either locally or via key registered on a smartcard) are returned.

	If INCLUDE_UNUSABLE is set, then unusable keys (see the
	documentation for skip_unusable for an exact definition) are
	skipped unless they are looked up by key id or by fingerprint.

	If RET_KB is not NULL, the keyblock is returned in *RET_KB. This
	should be freed using release_kbnode().

	If RET_KDBHD is not NULL, then the new database handle used to
	conduct the search is returned in *RET_KDBHD. This can be used to
	get subsequent results using keydb_search_next. Note: in this
	case, no advanced filtering is done for subsequent results (e.g.,
	WANT_SECRET and PK->REQ_USAGE are not respected).

	This function returns 0 on success. Otherwise, an error code is
	returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	(if want_secret is set) is returned if the key is not found. */
	static int
	key_byname (ctrl_t ctrl, GETKEY_CTX *retctx, strlist_t namelist,
	PKT_public_key *pk,
	int want_secret, int include_unusable,
	KBNODE * ret_kb, KEYDB_HANDLE * ret_kdbhd)
	{
	int rc = 0;
	int n;
	strlist_t r;
	strlist_t namelist_expanded = NULL;
	GETKEY_CTX ctx;
	KBNODE help_kb = NULL;
	KBNODE found_key = NULL;

	if (retctx)
	{
	/* Reset the returned context in case of error. */
	log_assert (!ret_kdbhd); /* Not allowed because the handle is stored
	in the context. */
	*retctx = NULL;
	}
	if (ret_kdbhd)
	*ret_kdbhd = NULL;

	if (!namelist)
	/* No search terms: iterate over the whole DB. */
	{
	ctx = xmalloc_clear (sizeof *ctx);
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_FIRST;
	if (!include_unusable)
	{
	ctx->items[0].skipfnc = skip_unusable;
	ctx->items[0].skipfncvalue = ctrl;
	}
	}
	else
	{
	namelist_expanded = expand_group (namelist, 1);
	namelist = namelist_expanded;

	/* Build the search context. */
	for (n = 0, r = namelist; r; r = r->next)
	n++;

	/* CTX has space for a single search term at the end. Thus, we
	need to allocate sizeof *CTX plus (n - 1) sizeof
	CTX->ITEMS. */
	ctx = xmalloc_clear (sizeof ctx + (n - 1) sizeof ctx->items);
	ctx->nitems = n;

	for (n = 0, r = namelist; r; r = r->next, n++)
	{
	gpg_error_t err;

	err = classify_user_id (r->d, &ctx->items[n], 1);

	if (ctx->items[n].exact)
	ctx->exact = 1;
	if (err)
	{
	xfree (ctx);
	rc = gpg_err_code (err); /* FIXME: remove gpg_err_code. */
	goto leave;
	}
	if (!include_unusable
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_SHORT_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_LONG_KID
	&& ctx->items[n].mode != KEYDB_SEARCH_MODE_FPR)
	{
	ctx->items[n].skipfnc = skip_unusable;
	ctx->items[n].skipfncvalue = ctrl;
	}
	}
	}

	ctx->want_secret = want_secret;
	ctx->kr_handle = keydb_new (ctrl);
	if (!ctx->kr_handle)
	{
	rc = gpg_error_from_syserror ();
	getkey_end (ctrl, ctx);
	goto leave;
	}

	if (!ret_kb)
	ret_kb = &help_kb;

	if (pk)
	{
	ctx->req_usage = pk->req_usage;
	}

	rc = lookup (ctrl, ctx, want_secret, ret_kb, &found_key);
	if (!rc && pk)
	{
	pk_from_block (pk, *ret_kb, found_key);
	}

	release_kbnode (help_kb);

	if (retctx) /* Caller wants the context. */
	{
	if (ctx->extra_list)
	{
	for (r=ctx->extra_list; r->next; r = r->next)
	;
	r->next = namelist_expanded;
	}
	else
	ctx->extra_list = namelist_expanded;
	namelist_expanded = NULL;
	*retctx = ctx;
	}
	else
	{
	if (ret_kdbhd)
	{
	*ret_kdbhd = ctx->kr_handle;
	ctx->kr_handle = NULL;
	}
	getkey_end (ctrl, ctx);
	}

	leave:
	free_strlist (namelist_expanded);
	return rc;
	}


	/* Find a public key identified by NAME.
	*
	* If name appears to be a valid RFC822 mailbox (i.e., email address)
	* and auto key lookup is enabled (mode != GET_PUBKEY_NO_AKL), then
	* the specified auto key lookup methods (--auto-key-lookup) are used
	* to import the key into the local keyring. Otherwise, just the
	* local keyring is consulted.
	*
	* MODE can be one of:
	* GET_PUBKEY_NORMAL - The standard mode
	* GET_PUBKEY_NO_AKL - The auto key locate functionality is
	* disabled and only the local key ring is
	* considered. Note: the local key ring is
	* consulted even if local is not in the
	* auto-key-locate option list!
	* GET_PUBKEY_NO_LOCAL - Only the auto key locate functionality is
	* used and no local search is done.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! PK->REQ_USAGE is
	* passed through to the lookup function and is a mask of
	* PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this
	* is non-zero, only keys with the specified usage will be returned.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* NAME is a string, which is turned into a search query using
	* classify_user_id.
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* If RET_KDBHD is not NULL, then the new database handle used to
	* conduct the search is returned in *RET_KDBHD. This can be used to
	* get subsequent results using keydb_search_next or to modify the
	* returned record. Note: in this case, no advanced filtering is done
	* for subsequent results (e.g., PK->REQ_USAGE is not respected).
	* Unlike RETCTX, this is always returned.
	*
	* If INCLUDE_UNUSABLE is set, then unusable keys (see the
	* documentation for skip_unusable for an exact definition) are
	* skipped unless they are looked up by key id or by fingerprint.
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	int
	get_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX * retctx, PKT_public_key * pk,
	const char name, KBNODE ret_keyblock,
	KEYDB_HANDLE * ret_kdbhd, int include_unusable)
	{
	int rc;
	strlist_t namelist = NULL;
	struct akl *akl;
	int is_mbox;
	int nodefault = 0;
	int anylocalfirst = 0;
	int mechanism_type = AKL_NODEFAULT;

	/* If RETCTX is not NULL, then RET_KDBHD must be NULL. */
	log_assert (retctx == NULL \|\| ret_kdbhd == NULL);

	if (retctx)
	*retctx = NULL;

	/* Does NAME appear to be a mailbox (mail address)? */
	is_mbox = is_valid_mailbox (name);
	if (!is_mbox && *name == '<' && name[1] && name[strlen(name)-1]=='>'
	&& name[1] != '>'
	&& is_valid_mailbox_mem (name+1, strlen (name)-2))
	{
	/* The mailbox is in the form "<foo@example.org>" which is not
	* detected by is_valid_mailbox. Set the flag but keep name as
	* it is because the bracketed name is actual the better
	* specification for a local search and the other methods
	* extract the mail address anyway. */
	is_mbox = 1;
	}

	/* The auto-key-locate feature works as follows: there are a number
	* of methods to look up keys. By default, the local keyring is
	* tried first. Then, each method listed in the --auto-key-locate is
	* tried in the order it appears.
	*
	* This can be changed as follows:
	*
	* - if nodefault appears anywhere in the list of options, then
	* the local keyring is not tried first, or,
	*
	* - if local appears anywhere in the list of options, then the
	* local keyring is not tried first, but in the order in which
	* it was listed in the --auto-key-locate option.
	*
	* Note: we only save the search context in RETCTX if the local
	* method is the first method tried (either explicitly or
	* implicitly). */
	if (mode == GET_PUBKEY_NO_LOCAL)
	nodefault = 1; /* Auto-key-locate but ignore "local". */
	else if (mode != GET_PUBKEY_NO_AKL)
	{
	/* auto-key-locate is enabled. */

	/* nodefault is true if "nodefault" or "local" appear. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_NODEFAULT \|\| akl->type == AKL_LOCAL)
	{
	nodefault = 1;
	break;
	}
	/* anylocalfirst is true if "local" appears before any other
	search methods (except "nodefault"). */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type != AKL_NODEFAULT)
	{
	if (akl->type == AKL_LOCAL)
	anylocalfirst = 1;
	break;
	}
	}

	if (!nodefault)
	{
	/* "nodefault" didn't occur. Thus, "local" is implicitly the
	* first method to try. */
	anylocalfirst = 1;
	}

	if (mode == GET_PUBKEY_NO_LOCAL)
	{
	/* Force using the AKL. If IS_MBOX is not set this is the final
	* error code. */
	rc = GPG_ERR_NO_PUBKEY;
	}
	else if (nodefault && is_mbox)
	{
	/* Either "nodefault" or "local" (explicitly) appeared in the
	* auto key locate list and NAME appears to be an email address.
	* Don't try the local keyring. */
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	/* Either "nodefault" and "local" don't appear in the auto key
	* locate list (in which case we try the local keyring first) or
	* NAME does not appear to be an email address (in which case we
	* only try the local keyring). In this case, lookup NAME in
	* the local keyring. */
	add_to_strlist (&namelist, name);
	rc = key_byname (ctrl, retctx, namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}

	/* If the requested name resembles a valid mailbox and automatic
	retrieval has been enabled, we try to import the key. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& mode != GET_PUBKEY_NO_AKL
	&& is_mbox)
	{
	/* NAME wasn't present in the local keyring (or we didn't try
	* the local keyring). Since the auto key locate feature is
	* enabled and NAME appears to be an email address, try the auto
	* locate feature. */
	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	{
	unsigned char *fpr = NULL;
	size_t fpr_len;
	int did_akl_local = 0;
	int no_fingerprint = 0;
	const char *mechanism_string = "?";

	mechanism_type = akl->type;
	switch (mechanism_type)
	{
	case AKL_NODEFAULT:
	/* This is a dummy mechanism. */
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	break;

	case AKL_LOCAL:
	if (mode == GET_PUBKEY_NO_LOCAL)
	{
	mechanism_string = "";
	rc = GPG_ERR_NO_PUBKEY;
	}
	else
	{
	mechanism_string = "Local";
	did_akl_local = 1;
	if (retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}
	add_to_strlist (&namelist, name);
	rc = key_byname (ctrl, anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}
	break;

	case AKL_CERT:
	mechanism_string = "DNS CERT";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_PKA:
	mechanism_string = "PKA";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_pka (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_DANE:
	mechanism_string = "DANE";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_cert (ctrl, name, 1, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_WKD:
	mechanism_string = "WKD";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_wkd (ctrl, name, 0, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_LDAP:
	mechanism_string = "LDAP";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_ldap (ctrl, name, &fpr, &fpr_len);
	glo_ctrl.in_auto_key_retrieve--;
	break;

	case AKL_KEYSERVER:
	/* Strictly speaking, we don't need to only use a valid
	* mailbox for the getname search, but it helps cut down
	* on the problem of searching for something like "john"
	* and getting a whole lot of keys back. */
	if (keyserver_any_configured (ctrl))
	{
	mechanism_string = "keyserver";
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_name (ctrl, name, &fpr, &fpr_len,
	opt.keyserver);
	glo_ctrl.in_auto_key_retrieve--;
	}
	else
	{
	mechanism_string = "Unconfigured keyserver";
	rc = GPG_ERR_NO_PUBKEY;
	}
	break;

	case AKL_SPEC:
	{
	struct keyserver_spec *keyserver;

	mechanism_string = akl->spec->uri;
	keyserver = keyserver_match (akl->spec);
	glo_ctrl.in_auto_key_retrieve++;
	rc = keyserver_import_name (ctrl,
	name, &fpr, &fpr_len, keyserver);
	glo_ctrl.in_auto_key_retrieve--;
	}
	break;
	}

	/* Use the fingerprint of the key that we actually fetched.
	* This helps prevent problems where the key that we fetched
	* doesn't have the same name that we used to fetch it. In
	* the case of CERT and PKA, this is an actual security
	* requirement as the URL might point to a key put in by an
	* attacker. By forcing the use of the fingerprint, we
	* won't use the attacker's key here. */
	if (!rc && fpr)
	{
	char fpr_string[MAX_FINGERPRINT_LEN * 2 + 1];

	log_assert (fpr_len <= MAX_FINGERPRINT_LEN);

	free_strlist (namelist);
	namelist = NULL;

	bin2hex (fpr, fpr_len, fpr_string);

	if (opt.verbose)
	log_info ("auto-key-locate found fingerprint %s\n",
	fpr_string);

	add_to_strlist (&namelist, fpr_string);
	}
	else if (!rc && !fpr && !did_akl_local)
	{ /* The acquisition method said no failure occurred, but
	* it didn't return a fingerprint. That's a failure. */
	no_fingerprint = 1;
	rc = GPG_ERR_NO_PUBKEY;
	}
	xfree (fpr);
	fpr = NULL;

	if (!rc && !did_akl_local)
	{ /* There was no error and we didn't do a local lookup.
	* This means that we imported a key into the local
	* keyring. Try to read the imported key from the
	* keyring. */
	if (retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}
	rc = key_byname (ctrl, anylocalfirst ? retctx : NULL,
	namelist, pk, 0,
	include_unusable, ret_keyblock, ret_kdbhd);
	}
	if (!rc)
	{
	/* Key found. */
	if (opt.verbose)
	log_info (_("automatically retrieved '%s' via %s\n"),
	name, mechanism_string);
	break;
	}
	if ((gpg_err_code (rc) != GPG_ERR_NO_PUBKEY
	\|\| opt.verbose \|\| no_fingerprint) && *mechanism_string)
	log_info (_("error retrieving '%s' via %s: %s\n"),
	name, mechanism_string,
	no_fingerprint ? _("No fingerprint") : gpg_strerror (rc));
	}
	}

	if (rc && retctx)
	{
	getkey_end (ctrl, *retctx);
	*retctx = NULL;
	}

	if (retctx && *retctx)
	{
	GETKEY_CTX ctx = *retctx;
	strlist_t sl;

	if (ctx->extra_list)
	{
	for (sl=ctx->extra_list; sl->next; sl = sl->next)
	;
	sl->next = namelist;
	}
	else
	ctx->extra_list = namelist;
	(*retctx)->found_via_akl = mechanism_type;
	}
	else
	free_strlist (namelist);

	return rc;
	}




	/* Comparison machinery for get_best_pubkey_byname. */

	/* First we have a struct to cache computed information about the key
	* in question. */
	struct pubkey_cmp_cookie
	{
	int valid; /* Is this cookie valid? */
	PKT_public_key key; /* The key. */
	PKT_user_id uid; / The matching UID packet. */
	unsigned int validity; /* Computed validity of (KEY, UID). */
	u32 creation_time; /* Creation time of the newest subkey
	capable of encryption. */
	};


	/* Then we have a series of helper functions. */
	static int
	key_is_ok (const PKT_public_key *key)
	{
	return (! key->has_expired && ! key->flags.revoked
	&& key->flags.valid && ! key->flags.disabled);
	}


	static int
	uid_is_ok (const PKT_public_key key, const PKT_user_id uid)
	{
	return key_is_ok (key) && ! uid->flags.revoked;
	}


	static int
	subkey_is_ok (const PKT_public_key *sub)
	{
	return ! sub->flags.revoked && sub->flags.valid && ! sub->flags.disabled;
	}

	/* Return true if KEYBLOCK has only expired encryption subkyes. Note
	* that the function returns false if the key has no encryption
	* subkeys at all or the subkeys are revoked. */
	static int
	only_expired_enc_subkeys (kbnode_t keyblock)
	{
	kbnode_t node;
	PKT_public_key *sub;
	int any = 0;

	for (node = find_next_kbnode (keyblock, PKT_PUBLIC_SUBKEY);
	node; node = find_next_kbnode (node, PKT_PUBLIC_SUBKEY))
	{
	sub = node->pkt->pkt.public_key;

	if (!(sub->pubkey_usage & PUBKEY_USAGE_ENC))
	continue;

	if (!subkey_is_ok (sub))
	continue;

	any = 1;
	if (!sub->has_expired)
	return 0;
	}

	return any? 1 : 0;
	}

	/* Finally this function compares a NEW key to the former candidate
	* OLD. Returns < 0 if the old key is worse, > 0 if the old key is
	* better, == 0 if it is a tie. */
	static int
	pubkey_cmp (ctrl_t ctrl, const char name, struct pubkey_cmp_cookie old,
	struct pubkey_cmp_cookie *new, KBNODE new_keyblock)
	{
	kbnode_t n;

	if ((new->key.pubkey_usage & PUBKEY_USAGE_ENC) == 0)
	new->creation_time = 0;
	else
	new->creation_time = new->key.timestamp;

	for (n = find_next_kbnode (new_keyblock, PKT_PUBLIC_SUBKEY);
	n; n = find_next_kbnode (n, PKT_PUBLIC_SUBKEY))
	{
	PKT_public_key *sub = n->pkt->pkt.public_key;

	if ((sub->pubkey_usage & PUBKEY_USAGE_ENC) == 0)
	continue;

	if (! subkey_is_ok (sub))
	continue;

	if (sub->timestamp > new->creation_time)
	new->creation_time = sub->timestamp;
	}

	/* When new key has no encryption key, use OLD key. */
	if (new->creation_time == 0)
	return 1;

	for (n = find_next_kbnode (new_keyblock, PKT_USER_ID);
	n; n = find_next_kbnode (n, PKT_USER_ID))
	{
	PKT_user_id *uid = n->pkt->pkt.user_id;
	char *mbox = mailbox_from_userid (uid->name, 0);
	int match = mbox ? strcasecmp (name, mbox) == 0 : 0;

	xfree (mbox);
	if (! match)
	continue;

	new->uid = scopy_user_id (uid);
	new->validity =
	get_validity (ctrl, new_keyblock, &new->key, uid, NULL, 0) & TRUST_MASK;
	new->valid = 1;

	if (! old->valid)
	return -1; /* No OLD key. */

	if (! uid_is_ok (&old->key, old->uid) && uid_is_ok (&new->key, uid))
	return -1; /* Validity of the NEW key is better. */

	if (old->validity < new->validity)
	return -1; /* Validity of the NEW key is better. */

	if (old->validity == new->validity && uid_is_ok (&new->key, uid)
	&& old->creation_time < new->creation_time)
	return -1; /* Both keys are of the same validity, but the
	NEW key is newer. */
	}

	/* Stick with the OLD key. */
	return 1;
	}


	/* This function works like get_pubkey_byname, but if the name
	* resembles a mail address, the results are ranked and only the best
	* result is returned. */
	gpg_error_t
	get_best_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char name, KBNODE ret_keyblock,
	int include_unusable)
	{
	gpg_error_t err;
	struct getkey_ctx_s *ctx = NULL;
	int is_mbox;
	int wkd_tried = 0;
	PKT_public_key pk0;

	log_assert (ret_keyblock != NULL);

	if (retctx)
	*retctx = NULL;

	memset (&pk0, 0, sizeof pk0);
	pk0.req_usage = pk? pk->req_usage : 0;

	is_mbox = is_valid_mailbox (name);
	if (!is_mbox && *name == '<' && name[1] && name[strlen(name)-1]=='>'
	&& name[1] != '>'
	&& is_valid_mailbox_mem (name+1, strlen (name)-2))
	{
	/* The mailbox is in the form "<foo@example.org>" which is not
	* detected by is_valid_mailbox. Set the flag but keep name as
	* it is because get_pubkey_byname does an is_valid_mailbox_mem
	* itself. */
	is_mbox = 1;
	}

	start_over:
	if (ctx) /* Clear in case of a start over. */
	{
	release_kbnode (*ret_keyblock);
	*ret_keyblock = NULL;
	getkey_end (ctrl, ctx);
	ctx = NULL;
	}
	err = get_pubkey_byname (ctrl, mode,
	&ctx, &pk0, name, ret_keyblock,
	NULL, include_unusable);
	if (err)
	{
	goto leave;
	}

	/* If the keyblock was retrieved from the local database and the key
	* has expired, do further checks. However, we can do this only if
	* the caller requested a keyblock. */
	if (is_mbox && ctx && ctx->found_via_akl == AKL_LOCAL)
	{
	u32 now = make_timestamp ();
	int found;

	/* If the key has expired and its origin was the WKD then try to
	* get a fresh key from the WKD. We also try this if the key
	* has any only expired encryption subkeys. In case we checked
	* for a fresh copy in the last 3 hours we won't do that again.
	* Unfortunately that does not yet work because KEYUPDATE is
	* only updated during import iff the key has actually changed
	* (see import.c:import_one). */
	if (!wkd_tried && pk0.keyorg == KEYORG_WKD
	&& (pk0.keyupdate + 3*3600) < now
	&& (pk0.has_expired \|\| only_expired_enc_subkeys (*ret_keyblock)))
	{
	if (opt.verbose)
	log_info (_("checking for a fresh copy of an expired key via %s\n"),
	"WKD");
	wkd_tried = 1;
	glo_ctrl.in_auto_key_retrieve++;
	found = !keyserver_import_wkd (ctrl, name, 0, NULL, NULL);
	glo_ctrl.in_auto_key_retrieve--;
	if (found)
	{
	release_public_key_parts (&pk0);
	goto start_over;
	}
	}
	}

	if (is_mbox && ctx)
	{
	/* Rank results and return only the most relevant key for encryption. */
	struct pubkey_cmp_cookie best = { 0 };
	struct pubkey_cmp_cookie new = { 0 };
	kbnode_t new_keyblock;

	copy_public_key (&new.key, &pk0);
	if (pubkey_cmp (ctrl, name, &best, &new, *ret_keyblock) >= 0)
	{
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	else
	best = new;
	new.uid = NULL;

	while (getkey_next (ctrl, ctx, &new.key, &new_keyblock) == 0)
	{
	int diff = pubkey_cmp (ctrl, name, &best, &new, new_keyblock);
	release_kbnode (new_keyblock);
	if (diff < 0)
	{
	/* New key is better. */
	release_public_key_parts (&best.key);
	free_user_id (best.uid);
	best = new;
	}
	else if (diff > 0)
	{
	/* Old key is better. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	else
	{
	/* A tie. Keep the old key. */
	release_public_key_parts (&new.key);
	free_user_id (new.uid);
	}
	new.uid = NULL;
	}

	getkey_end (ctrl, ctx);
	ctx = NULL;
	free_user_id (best.uid);
	best.uid = NULL;

	if (best.valid)
	{
	ctx = xtrycalloc (1, sizeof **retctx);
	if (! ctx)
	err = gpg_error_from_syserror ();
	else
	{
	ctx->kr_handle = keydb_new (ctrl);
	if (! ctx->kr_handle)
	{
	err = gpg_error_from_syserror ();
	xfree (ctx);
	ctx = NULL;
	if (retctx)
	*retctx = NULL;
	}
	else
	{
	u32 *keyid = pk_keyid (&best.key);
	ctx->exact = 1;
	ctx->nitems = 1;
	ctx->items[0].mode = KEYDB_SEARCH_MODE_LONG_KID;
	ctx->items[0].u.kid[0] = keyid[0];
	ctx->items[0].u.kid[1] = keyid[1];

	release_kbnode (*ret_keyblock);
	*ret_keyblock = NULL;
	err = getkey_next (ctrl, ctx, NULL, ret_keyblock);
	}
	}

	if (pk)
	*pk = best.key;
	else
	release_public_key_parts (&best.key);
	release_public_key_parts (&pk0);
	}
	else
	{
	if (pk)
	*pk = pk0;
	else
	release_public_key_parts (&pk0);
	}
	}
	else
	{
	if (pk)
	*pk = pk0;
	else
	release_public_key_parts (&pk0);
	}

	if (err && ctx)
	{
	getkey_end (ctrl, ctx);
	ctx = NULL;
	}

	if (retctx && ctx)
	{
	*retctx = ctx;
	ctx = NULL;
	}

	leave:
	getkey_end (ctrl, ctx);
	return err;
	}



	/* Get a public key from a file.
	*
	* PK is the buffer to store the key. The caller needs to make sure
	* that PK->REQ_USAGE is valid. PK->REQ_USAGE is passed through to
	* the lookup function and is a mask of PUBKEY_USAGE_SIG,
	* PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT. If this is non-zero, only
	* keys with the specified usage will be returned.
	*
	* FNAME is the file name. That file should contain exactly one
	* keyblock.
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY is returned if the key
	* is not found.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. The caller must release the content of PK by
	* calling release_public_key_parts (or, if PK was malloced, using
	* free_public_key).
	*/
	gpg_error_t
	get_pubkey_fromfile (ctrl_t ctrl, PKT_public_key pk, const char fname)
	{
	gpg_error_t err;
	kbnode_t keyblock;
	kbnode_t found_key;
	unsigned int infoflags;

	- err = read_key_from_file (ctrl, fname, &keyblock);
	+ err = read_key_from_file_or_buffer (ctrl, fname, NULL, 0, &keyblock);
	if (!err)
	{
	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. FIXME: Check whether this still holds. */
	merge_selfsigs (ctrl, keyblock);
	found_key = finish_lookup (keyblock, pk->req_usage, 0, 0, &infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	pk_from_block (pk, keyblock, found_key);
	else
	err = gpg_error (GPG_ERR_UNUSABLE_PUBKEY);
	}

	release_kbnode (keyblock);
	return err;
	}


	+/* Return a public key from the buffer (BUFFER, BUFLEN). The key is
	+ * onlyretruned if it matches the keyid given in WANT_KEYID. On
	+ * success the key is stored at the caller provided PKBUF structure.
	+ * The caller must release the content of PK by calling
	+ * release_public_key_parts (or, if PKBUF was malloced, using
	+ * free_public_key). If R_KEYBLOCK is not NULL the full keyblock is
	+ * also stored there. */
	+gpg_error_t
	+get_pubkey_from_buffer (ctrl_t ctrl, PKT_public_key *pkbuf,
	+ const void buffer, size_t buflen, u32 want_keyid,
	+ kbnode_t *r_keyblock)
	+{
	+ gpg_error_t err;
	+ kbnode_t keyblock;
	+ kbnode_t node;
	+ PKT_public_key *pk;
	+
	+ if (r_keyblock)
	+ *r_keyblock = NULL;
	+
	+ err = read_key_from_file_or_buffer (ctrl, NULL, buffer, buflen, &keyblock);
	+ if (!err)
	+ {
	+ merge_selfsigs (ctrl, keyblock);
	+ for (node = keyblock; node; node = node->next)
	+ {
	+ if (node->pkt->pkttype == PKT_PUBLIC_KEY
	+ \|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	+ {
	+ pk = node->pkt->pkt.public_key;
	+ keyid_from_pk (pk, NULL);
	+ if (pk->keyid[0] == want_keyid[0]
	+ && pk->keyid[1] == want_keyid[1])
	+ break;
	+ }
	+ }
	+ if (node)
	+ copy_public_key (pkbuf, pk);
	+ else
	+ err = gpg_error (GPG_ERR_NO_PUBKEY);
	+ }
	+
	+ if (!err && r_keyblock)
	+ *r_keyblock = keyblock;
	+ else
	+ release_kbnode (keyblock);
	+ return err;
	+}
	+
	+
	/* Lookup a key with the specified fingerprint.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: this function does an exact search and thus the
	* returned public key may be a subkey rather than the primary key.
	* Note: The self-signed data has already been merged into the public
	* key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If PK->REQ_USAGE is set, it is used to filter the search results.
	* (Thus, if PK is not NULL, PK->REQ_USAGE must be valid!!!) See the
	* documentation for finish_lookup to understand exactly how this is
	* used.
	*
	* If R_KEYBLOCK is not NULL, then the first result's keyblock is
	* returned in *R_KEYBLOCK. This should be freed using
	* release_kbnode().
	*
	* FPRINT is a byte array whose contents is the fingerprint to use as
	* the search term. FPRINT_LEN specifies the length of the
	* fingerprint (in bytes). Currently, only 16, 20, and 32-byte
	* fingerprints are supported.
	*
	* FIXME: We should replace this with the _byname function. This can
	* be done by creating a userID conforming to the unified fingerprint
	* style. */
	int
	get_pubkey_byfprint (ctrl_t ctrl, PKT_public_key pk, kbnode_t r_keyblock,
	const byte * fprint, size_t fprint_len)
	{
	int rc;

	if (r_keyblock)
	*r_keyblock = NULL;

	if (fprint_len == 32 \|\| fprint_len == 20 \|\| fprint_len == 16)
	{
	struct getkey_ctx_s ctx;
	KBNODE kb = NULL;
	KBNODE found_key = NULL;

	memset (&ctx, 0, sizeof ctx);
	ctx.exact = 1;
	ctx.not_allocated = 1;
	/* FIXME: We should get the handle from the cache like we do in
	* get_pubkey. */
	ctx.kr_handle = keydb_new (ctrl);
	if (!ctx.kr_handle)
	return gpg_error_from_syserror ();

	ctx.nitems = 1;
	ctx.items[0].mode = KEYDB_SEARCH_MODE_FPR;
	memcpy (ctx.items[0].u.fpr, fprint, fprint_len);
	ctx.items[0].fprlen = fprint_len;
	if (pk)
	ctx.req_usage = pk->req_usage;
	rc = lookup (ctrl, &ctx, 0, &kb, &found_key);
	if (!rc && pk)
	pk_from_block (pk, kb, found_key);
	if (!rc && r_keyblock)
	{
	*r_keyblock = kb;
	kb = NULL;
	}
	release_kbnode (kb);
	getkey_end (ctrl, &ctx);
	}
	else
	rc = GPG_ERR_GENERAL; /* Oops */
	return rc;
	}


	/* This function is similar to get_pubkey_byfprint, but it doesn't
	* merge the self-signed data into the public key and subkeys or into
	* the user ids. It also doesn't add the key to the user id cache.
	* Further, this function ignores PK->REQ_USAGE.
	*
	* This function is intended to avoid recursion and, as such, should
	* only be used in very specific situations.
	*
	* Like get_pubkey_byfprint, PK may be NULL. In that case, this
	* function effectively just checks for the existence of the key. */
	gpg_error_t
	get_pubkey_byfprint_fast (ctrl_t ctrl, PKT_public_key * pk,
	const byte * fprint, size_t fprint_len)
	{
	gpg_error_t err;
	KBNODE keyblock;

	err = get_keyblock_byfprint_fast (ctrl,
	&keyblock, NULL, fprint, fprint_len, 0);
	if (!err)
	{
	if (pk)
	copy_public_key (pk, keyblock->pkt->pkt.public_key);
	release_kbnode (keyblock);
	}

	return err;
	}


	/* This function is similar to get_pubkey_byfprint_fast but returns a
	* keydb handle at R_HD and the keyblock at R_KEYBLOCK. R_KEYBLOCK or
	* R_HD may be NULL. If LOCK is set the handle has been opend in
	* locked mode and keydb_disable_caching () has been called. On error
	* R_KEYBLOCK is set to NULL but R_HD must be released by the caller;
	* it may have a value of NULL, though. This allows to do an insert
	* operation on a locked keydb handle. */
	gpg_error_t
	get_keyblock_byfprint_fast (ctrl_t ctrl,
	kbnode_t r_keyblock, KEYDB_HANDLE r_hd,
	const byte *fprint, size_t fprint_len, int lock)
	{
	gpg_error_t err;
	KEYDB_HANDLE hd;
	kbnode_t keyblock;
	byte fprbuf[MAX_FINGERPRINT_LEN];
	int i;

	if (r_keyblock)
	*r_keyblock = NULL;
	if (r_hd)
	*r_hd = NULL;

	for (i = 0; i < MAX_FINGERPRINT_LEN && i < fprint_len; i++)
	fprbuf[i] = fprint[i];

	hd = keydb_new (ctrl);
	if (!hd)
	return gpg_error_from_syserror ();

	if (lock)
	{
	err = keydb_lock (hd);
	if (err)
	{
	/* If locking did not work, we better don't return a handle
	* at all - there was a reason that locking has been
	* requested. */
	keydb_release (hd);
	return err;
	}
	keydb_disable_caching (hd);
	}

	/* For all other errors we return the handle. */
	if (r_hd)
	*r_hd = hd;

	err = keydb_search_fpr (hd, fprbuf, fprint_len);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	{
	if (!r_hd)
	keydb_release (hd);
	return gpg_error (GPG_ERR_NO_PUBKEY);
	}
	err = keydb_get_keyblock (hd, &keyblock);
	if (err)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (err));
	if (!r_hd)
	keydb_release (hd);
	return gpg_error (GPG_ERR_NO_PUBKEY);
	}

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| keyblock->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	/* Not caching key here since it won't have all of the fields
	properly set. */

	if (r_keyblock)
	*r_keyblock = keyblock;
	else
	release_kbnode (keyblock);

	if (!r_hd)
	keydb_release (hd);

	return 0;
	}


	const char *
	parse_def_secret_key (ctrl_t ctrl)
	{
	KEYDB_HANDLE hd = NULL;
	strlist_t t;
	static int warned;

	for (t = opt.def_secret_key; t; t = t->next)
	{
	gpg_error_t err;
	KEYDB_SEARCH_DESC desc;
	KBNODE kb;
	KBNODE node;

	err = classify_user_id (t->d, &desc, 1);
	if (err)
	{
	log_error (_("secret key \"%s\" not found: %s\n"),
	t->d, gpg_strerror (err));
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"), "--default-key");
	continue;
	}

	if (! hd)
	{
	hd = keydb_new (ctrl);
	if (!hd)
	return NULL;
	}
	else
	keydb_search_reset (hd);


	err = keydb_search (hd, &desc, 1, NULL);
	if (gpg_err_code (err) == GPG_ERR_NOT_FOUND)
	continue;

	if (err)
	{
	log_error (_("key \"%s\" not found: %s\n"), t->d, gpg_strerror (err));
	t = NULL;
	break;
	}

	err = keydb_get_keyblock (hd, &kb);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"),
	gpg_strerror (err));
	continue;
	}

	merge_selfsigs (ctrl, kb);

	err = gpg_error (GPG_ERR_NO_SECKEY);
	node = kb;
	do
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	/* Check if the key is valid. */
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "revoked");
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "expired");
	continue;
	}
	if (pk_is_disabled (pk))
	{
	if (DBG_LOOKUP)
	log_debug ("not using %s as default key, %s",
	keystr_from_pk (pk), "disabled");
	continue;
	}

	if (agent_probe_secret_key (ctrl, pk))
	{
	/* This is a valid key. */
	err = 0;
	break;
	}
	}
	while ((node = find_next_kbnode (node, PKT_PUBLIC_SUBKEY)));

	release_kbnode (kb);
	if (err)
	{
	if (! warned && ! opt.quiet)
	{
	log_info (_("Warning: not using '%s' as default key: %s\n"),
	t->d, gpg_strerror (GPG_ERR_NO_SECKEY));
	print_reported_error (err, GPG_ERR_NO_SECKEY);
	}
	}
	else
	{
	if (! warned && ! opt.quiet)
	log_info (_("using \"%s\" as default secret key for signing\n"),
	t->d);
	break;
	}
	}

	if (! warned && opt.def_secret_key && ! t)
	log_info (_("all values passed to '%s' ignored\n"),
	"--default-key");

	warned = 1;

	if (hd)
	keydb_release (hd);

	if (t)
	return t->d;
	return NULL;
	}


	/* Look up a secret key.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If --default-key was set, then the specified key is looked up. (In
	* this case, the default key is returned even if it is considered
	* unusable. See the documentation for skip_unusable for exactly what
	* this means.)
	*
	* Otherwise, this initiates a DB scan that returns all keys that are
	* usable (see previous paragraph for exactly what usable means) and
	* for which a secret key is available.
	*
	* This function returns the first match. Additional results can be
	* returned using getkey_next. */
	gpg_error_t
	get_seckey_default (ctrl_t ctrl, PKT_public_key *pk)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int include_unusable = 1;


	const char *def_secret_key = parse_def_secret_key (ctrl);
	if (def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else
	include_unusable = 0;

	err = key_byname (ctrl, NULL, namelist, pk, 1, include_unusable, NULL, NULL);

	free_strlist (namelist);

	return err;
	}



	/* Search for keys matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAMES is not NULL, then a search query is constructed using
	* classify_user_id on each of the strings in the list. (Recall: the
	* database does an OR of the terms, not an AND.) If NAMES is
	* NULL, then all results are returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found. */
	gpg_error_t
	getkey_bynames (ctrl_t ctrl, getkey_ctx_t retctx, PKT_public_key pk,
	strlist_t names, int want_secret, kbnode_t *ret_keyblock)
	{
	return key_byname (ctrl, retctx, names, pk, want_secret, 1,
	ret_keyblock, NULL);
	}


	/* Search for one key matching some criteria.
	*
	* If RETCTX is not NULL, then the constructed context is returned in
	* *RETCTX so that getpubkey_next can be used to get subsequent
	* results. In this case, getkey_end() must be used to free the
	* search context. If RETCTX is not NULL, then RET_KDBHD must be
	* NULL.
	*
	* If PK is not NULL, the public key of the first result is returned
	* in *PK. Note: PK->REQ_USAGE must be valid!!! If PK->REQ_USAGE is
	* set, it is used to filter the search results. See the
	* documentation for finish_lookup to understand exactly how this is
	* used. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xfree, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* If NAME is not NULL, then a search query is constructed using
	* classify_user_id on the string. In this case, even unusable keys
	* (see the documentation for skip_unusable for an exact definition of
	* unusable) are returned. Otherwise, if --default-key was set, then
	* that key is returned (even if it is unusable). If neither of these
	* conditions holds, then the first usable key is returned.
	*
	* If WANT_SECRET is set, then only keys with an available secret key
	* (either locally or via key registered on a smartcard) are returned.
	*
	* This function does not skip unusable keys (see the documentation
	* for skip_unusable for an exact definition).
	*
	* If RET_KEYBLOCK is not NULL, the keyblock is returned in
	* *RET_KEYBLOCK. This should be freed using release_kbnode().
	*
	* This function returns 0 on success. Otherwise, an error code is
	* returned. In particular, GPG_ERR_NO_PUBKEY or GPG_ERR_NO_SECKEY
	* (if want_secret is set) is returned if the key is not found.
	*
	* FIXME: We also have the get_pubkey_byname function which has a
	* different semantic. Should be merged with this one. */
	gpg_error_t
	getkey_byname (ctrl_t ctrl, getkey_ctx_t retctx, PKT_public_key pk,
	const char name, int want_secret, kbnode_t ret_keyblock)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;
	int with_unusable = 1;
	const char *def_secret_key = NULL;

	if (want_secret && !name)
	def_secret_key = parse_def_secret_key (ctrl);

	if (want_secret && !name && def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else if (name)
	add_to_strlist (&namelist, name);
	else
	with_unusable = 0;

	err = key_byname (ctrl, retctx, namelist, pk, want_secret, with_unusable,
	ret_keyblock, NULL);

	/* FIXME: Check that we really return GPG_ERR_NO_SECKEY if
	WANT_SECRET has been used. */

	free_strlist (namelist);

	return err;
	}


	/* Return the next search result.
	*
	* If PK is not NULL, the public key of the next result is returned in
	* *PK. Note: The self-signed data has already been merged into the
	* public key using merge_selfsigs. Free *PK by calling
	* release_public_key_parts (or, if PK was allocated using xmalloc, you
	* can use free_public_key, which calls release_public_key_parts(PK)
	* and then xfree(PK)).
	*
	* RET_KEYBLOCK can be given as NULL; if it is not NULL it the entire
	* found keyblock is returned which must be released with
	* release_kbnode. If the function returns an error NULL is stored at
	* RET_KEYBLOCK.
	*
	* The self-signed data has already been merged into the public key
	* using merge_selfsigs. */
	gpg_error_t
	getkey_next (ctrl_t ctrl, getkey_ctx_t ctx,
	PKT_public_key pk, kbnode_t ret_keyblock)
	{
	int rc; /* Fixme: Make sure this is proper gpg_error */
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;

	/* We need to disable the caching so that for an exact key search we
	won't get the result back from the cache and thus end up in an
	endless loop. The endless loop can occur, because the cache is
	used without respecting the current file pointer! */
	keydb_disable_caching (ctx->kr_handle);

	/* FOUND_KEY is only valid as long as RET_KEYBLOCK is. If the
	* caller wants PK, but not RET_KEYBLOCK, we need hand in our own
	* keyblock. */
	if (pk && ret_keyblock == NULL)
	ret_keyblock = &keyblock;

	rc = lookup (ctrl, ctx, ctx->want_secret,
	ret_keyblock, pk ? &found_key : NULL);
	if (!rc && pk)
	{
	log_assert (found_key);
	pk_from_block (pk, NULL, found_key);
	release_kbnode (keyblock);
	}

	return rc;
	}


	/* Release any resources used by a key listing context. This must be
	* called on the context returned by, e.g., getkey_byname. */
	void
	getkey_end (ctrl_t ctrl, getkey_ctx_t ctx)
	{
	if (ctx)
	{
	#ifdef HAVE_W32_SYSTEM

	/* FIXME: This creates a big regression for Windows because the
	* keyring is only released after the global ctrl is released.
	* So if an operation does a getkey and then tries to modify the
	* keyring it will fail on Windows with a sharing violation. We
	* need to modify all keyring write operations to also take the
	* ctrl and close the cached_getkey_kdb handle to make writing
	* work. See: GnuPG-bug-id: 3097 */
	(void)ctrl;
	keydb_release (ctx->kr_handle);

	#else /!HAVE_W32_SYSTEM/

	if (ctrl && !ctrl->cached_getkey_kdb)
	ctrl->cached_getkey_kdb = ctx->kr_handle;
	else
	keydb_release (ctx->kr_handle);

	#endif /!HAVE_W32_SYSTEM/

	free_strlist (ctx->extra_list);
	if (!ctx->not_allocated)
	xfree (ctx);
	}
	}



	/************************************************
	*********** Merging stuff ******************
	************************************************/

	/* Set the mainkey_id fields for all keys in KEYBLOCK. This is
	* usually done by merge_selfsigs but at some places we only need the
	* main_kid not a full merge. The function also guarantees that all
	* pk->keyids are computed. */
	void
	setup_main_keyids (kbnode_t keyblock)
	{
	u32 kid[2], mainkid[2];
	kbnode_t kbctx, node;
	PKT_public_key *pk;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	BUG ();
	pk = keyblock->pkt->pkt.public_key;

	keyid_from_pk (pk, mainkid);
	for (kbctx=NULL; (node = walk_kbnode (keyblock, &kbctx, 0)); )
	{
	if (!(node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY))
	continue;
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, kid); /* Make sure pk->keyid is set. */
	if (!pk->main_keyid[0] && !pk->main_keyid[1])
	{
	pk->main_keyid[0] = mainkid[0];
	pk->main_keyid[1] = mainkid[1];
	}
	}
	}


	/* KEYBLOCK corresponds to a public key block. This function merges
	* much of the information from the self-signed data into the public
	* key, public subkey and user id data structures. If you use the
	* high-level search API (e.g., get_pubkey) for looking up key blocks,
	* then you don't need to call this function. This function is
	* useful, however, if you change the keyblock, e.g., by adding or
	* removing a self-signed data packet. */
	void
	merge_keys_and_selfsig (ctrl_t ctrl, kbnode_t keyblock)
	{
	if (!keyblock)
	;
	else if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	merge_selfsigs (ctrl, keyblock);
	else
	log_debug ("FIXME: merging secret key blocks is not anymore available\n");
	}


	static int
	parse_key_usage (PKT_signature * sig)
	{
	int key_usage = 0;
	const byte *p;
	size_t n;
	byte flags;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_FLAGS, &n);
	if (p && n)
	{
	/* First octet of the keyflags. */
	flags = *p;

	if (flags & 1)
	{
	key_usage \|= PUBKEY_USAGE_CERT;
	flags &= ~1;
	}

	if (flags & 2)
	{
	key_usage \|= PUBKEY_USAGE_SIG;
	flags &= ~2;
	}

	/* We do not distinguish between encrypting communications and
	encrypting storage. */
	if (flags & (0x04 \| 0x08))
	{
	key_usage \|= PUBKEY_USAGE_ENC;
	flags &= ~(0x04 \| 0x08);
	}

	if (flags & 0x20)
	{
	key_usage \|= PUBKEY_USAGE_AUTH;
	flags &= ~0x20;
	}

	if (flags)
	key_usage \|= PUBKEY_USAGE_UNKNOWN;

	if (!key_usage)
	key_usage \|= PUBKEY_USAGE_NONE;
	}
	else if (p) /* Key flags of length zero. */
	key_usage \|= PUBKEY_USAGE_NONE;

	/* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
	capability that we do not handle. This serves to distinguish
	between a zero key usage which we handle as the default
	capabilities for that algorithm, and a usage that we do not
	handle. Likewise we use PUBKEY_USAGE_NONE to indicate that
	key_flags have been given but they do not specify any usage. */

	return key_usage;
	}


	/* Apply information from SIGNODE (which is the valid self-signature
	* associated with that UID) to the UIDNODE:
	* - weather the UID has been revoked
	* - assumed creation date of the UID
	* - temporary store the keyflags here
	* - temporary store the key expiration time here
	* - mark whether the primary user ID flag hat been set.
	* - store the preferences
	*/
	static void
	fixup_uidnode (KBNODE uidnode, KBNODE signode, u32 keycreated)
	{
	PKT_user_id *uid = uidnode->pkt->pkt.user_id;
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte p, sym, aead, hash, *zip;
	size_t n, nsym, naead, nhash, nzip;

	sig->flags.chosen_selfsig = 1;/* We chose this one. */
	uid->created = 0; /* Not created == invalid. */
	if (IS_UID_REV (sig))
	{
	uid->flags.revoked = 1;
	return; /* Has been revoked. */
	}
	else
	uid->flags.revoked = 0;

	uid->expiredate = sig->expiredate;

	if (sig->flags.expired)
	{
	uid->flags.expired = 1;
	return; /* Has expired. */
	}
	else
	uid->flags.expired = 0;

	uid->created = sig->timestamp; /* This one is okay. */
	uid->selfsigversion = sig->version;
	/* If we got this far, it's not expired :) */
	uid->flags.expired = 0;

	/* Store the key flags in the helper variable for later processing. */
	uid->help_key_usage = parse_key_usage (sig);

	/* Ditto for the key expiration. */
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	uid->help_key_expire = keycreated + buf32_to_u32 (p);
	else
	uid->help_key_expire = 0;

	/* Set the primary user ID flag - we will later wipe out some
	* of them to only have one in our keyblock. */
	uid->flags.primary = 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PRIMARY_UID, NULL);
	if (p && *p)
	uid->flags.primary = 2;

	/* We could also query this from the unhashed area if it is not in
	* the hased area and then later try to decide which is the better
	* there should be no security problem with this.
	* For now we only look at the hashed one. */

	/* Now build the preferences list. These must come from the
	hashed section so nobody can modify the ciphers a key is
	willing to accept. */
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PREF_SYM, &n);
	sym = p;
	nsym = p ? n : 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PREF_AEAD, &n);
	aead = p;
	naead = p ? n : 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PREF_HASH, &n);
	hash = p;
	nhash = p ? n : 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PREF_COMPR, &n);
	zip = p;
	nzip = p ? n : 0;
	if (uid->prefs)
	xfree (uid->prefs);
	n = nsym + naead + nhash + nzip;
	if (!n)
	uid->prefs = NULL;
	else
	{
	uid->prefs = xmalloc (sizeof (uid->prefs) (n + 1));
	n = 0;
	for (; nsym; nsym--, n++)
	{
	uid->prefs[n].type = PREFTYPE_SYM;
	uid->prefs[n].value = *sym++;
	}
	for (; naead; naead--, n++)
	{
	uid->prefs[n].type = PREFTYPE_AEAD;
	uid->prefs[n].value = *aead++;
	}
	for (; nhash; nhash--, n++)
	{
	uid->prefs[n].type = PREFTYPE_HASH;
	uid->prefs[n].value = *hash++;
	}
	for (; nzip; nzip--, n++)
	{
	uid->prefs[n].type = PREFTYPE_ZIP;
	uid->prefs[n].value = *zip++;
	}
	uid->prefs[n].type = PREFTYPE_NONE; /* End of list marker */
	uid->prefs[n].value = 0;
	}

	/* See whether we have the MDC feature. */
	uid->flags.mdc = 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_FEATURES, &n);
	if (p && n && (p[0] & 0x01))
	uid->flags.mdc = 1;

	/* See whether we have the AEAD feature. */
	uid->flags.aead = 0;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_FEATURES, &n);
	if (p && n && (p[0] & 0x02))
	uid->flags.aead = 1;

	/* And the keyserver modify flag. */
	uid->flags.ks_modify = 1;
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KS_FLAGS, &n);
	if (p && n && (p[0] & 0x80))
	uid->flags.ks_modify = 0;
	}

	static void
	sig_to_revoke_info (PKT_signature * sig, struct revoke_info *rinfo)
	{
	rinfo->date = sig->timestamp;
	rinfo->algo = sig->pubkey_algo;
	rinfo->keyid[0] = sig->keyid[0];
	rinfo->keyid[1] = sig->keyid[1];
	}


	/* Given a keyblock, parse the key block and extract various pieces of
	* information and save them with the primary key packet and the user
	* id packets. For instance, some information is stored in signature
	* packets. We find the latest such valid packet (since the user can
	* change that information) and copy its contents into the
	* PKT_public_key.
	*
	* Note that R_REVOKED may be set to 0, 1 or 2.
	*
	* This function fills in the following fields in the primary key's
	* keyblock:
	*
	* main_keyid (computed)
	* revkey / numrevkeys (derived from self signed key data)
	* flags.valid (whether we have at least 1 self-sig)
	* flags.maybe_revoked (whether a designed revoked the key, but
	* we are missing the key to check the sig)
	* selfsigversion (highest version of any valid self-sig)
	* pubkey_usage (derived from most recent self-sig or most
	* recent user id)
	* has_expired (various sources)
	* expiredate (various sources)
	*
	* See the documentation for fixup_uidnode for how the user id packets
	* are modified. In addition to that the primary user id's is_primary
	* field is set to 1 and the other user id's is_primary are set to 0.
	*/
	static void
	merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
	struct revoke_info *rinfo)
	{
	PKT_public_key *pk = NULL;
	KBNODE k;
	u32 kid[2];
	u32 sigdate, uiddate, uiddate2;
	KBNODE signode, uidnode, uidnode2;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0;
	u32 key_expire = 0;
	int key_expire_seen = 0;
	byte sigversion = 0;

	*r_revoked = 0;
	memset (rinfo, 0, sizeof (*rinfo));

	/* Section 11.1 of RFC 4880 determines the order of packets within a
	* message. There are three sections, which must occur in the
	* following order: the public key, the user ids and user attributes
	* and the subkeys. Within each section, each primary packet (e.g.,
	* a user id packet) is followed by one or more signature packets,
	* which modify that packet. */

	/* According to Section 11.1 of RFC 4880, the public key must be the
	first packet. Note that parse_keyblock_image ensures that the
	first packet is the public key. */
	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	BUG ();
	pk = keyblock->pkt->pkt.public_key;
	keytimestamp = pk->timestamp;

	keyid_from_pk (pk, kid);
	pk->main_keyid[0] = kid[0];
	pk->main_keyid[1] = kid[1];

	if (pk->version < 4)
	{
	/* Before v4 the key packet itself contains the expiration date
	* and there was no way to change it, so we start with the one
	* from the key packet. */
	key_expire = pk->max_expiredate;
	key_expire_seen = 1;
	}

	/* First pass:
	*
	* - Find the latest direct key self-signature. We assume that the
	* newest one overrides all others.
	*
	* - Determine whether the key has been revoked.
	*
	* - Gather all revocation keys (unlike other data, we don't just
	* take them from the latest self-signed packet).
	*
	* - Determine max (sig[...]->version).
	*/

	/* Reset this in case this key was already merged. */
	xfree (pk->revkey);
	pk->revkey = NULL;
	pk->numrevkeys = 0;

	signode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature. */

	/* According to Section 11.1 of RFC 4880, the public key comes first
	* and is immediately followed by any signature packets that modify
	* it. */
	for (k = keyblock;
	k && k->pkt->pkttype != PKT_USER_ID
	&& k->pkt->pkttype != PKT_ATTRIBUTE
	&& k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	{ /* Self sig. */

	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_KEY_REV (sig))
	{
	/* Key has been revoked - there is no way to
	* override such a revocation, so we theoretically
	* can stop now. We should not cope with expiration
	* times for revocations here because we have to
	* assume that an attacker can generate all kinds of
	* signatures. However due to the fact that the key
	* has been revoked it does not harm either and by
	* continuing we gather some more info on that
	* key. */
	*r_revoked = 1;
	sig_to_revoke_info (sig, rinfo);
	}
	else if (IS_KEY_SIG (sig))
	{
	/* Add the indicated revocations keys from all
	* signatures not just the latest. We do this
	* because you need multiple 1F sigs to properly
	* handle revocation keys (PGP does it this way, and
	* a revocation key could be sensitive and hence in
	* a different signature). */
	if (sig->revkey)
	{
	int i;

	pk->revkey =
	xrealloc (pk->revkey, sizeof (struct revocation_key) *
	(pk->numrevkeys + sig->numrevkeys));

	for (i = 0; i < sig->numrevkeys; i++, pk->numrevkeys++)
	{
	pk->revkey[pk->numrevkeys].class
	= sig->revkey[i].class;
	pk->revkey[pk->numrevkeys].algid
	= sig->revkey[i].algid;
	pk->revkey[pk->numrevkeys].fprlen
	= sig->revkey[i].fprlen;
	memcpy (pk->revkey[pk->numrevkeys].fpr,
	sig->revkey[i].fpr, sig->revkey[i].fprlen);
	memset (pk->revkey[pk->numrevkeys].fpr
	+ sig->revkey[i].fprlen,
	0,
	sizeof (sig->revkey[i].fpr)
	- sig->revkey[i].fprlen);
	}
	}

	if (sig->timestamp >= sigdate)
	{ /* This is the latest signature so far. */

	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	if (sig->version > sigversion)
	sigversion = sig->version;

	}
	}
	}
	}
	}
	}

	/* Remove dupes from the revocation keys. */
	if (pk->revkey)
	{
	int i, j, x, changed = 0;

	for (i = 0; i < pk->numrevkeys; i++)
	{
	for (j = i + 1; j < pk->numrevkeys; j++)
	{
	if (memcmp (&pk->revkey[i], &pk->revkey[j],
	sizeof (struct revocation_key)) == 0)
	{
	/* remove j */

	for (x = j; x < pk->numrevkeys - 1; x++)
	pk->revkey[x] = pk->revkey[x + 1];

	pk->numrevkeys--;
	j--;
	changed = 1;
	}
	}
	}

	if (changed)
	pk->revkey = xrealloc (pk->revkey,
	pk->numrevkeys *
	sizeof (struct revocation_key));
	}

	/* SIGNODE is the 1F signature packet with the latest creation time.
	* Extract some information from it. */
	if (signode)
	{
	/* Some information from a direct key signature take precedence
	* over the same information given in UID sigs. */
	PKT_signature *sig = signode->pkt->pkt.signature;
	const byte *p;

	key_usage = parse_key_usage (sig);

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	{
	key_expire = keytimestamp + buf32_to_u32 (p);
	key_expire_seen = 1;
	}

	/* Mark that key as valid: One direct key signature should
	* render a key as valid. */
	pk->flags.valid = 1;
	}

	/* Pass 1.5: Look for key revocation signatures that were not made
	* by the key (i.e. did a revocation key issue a revocation for
	* us?). Only bother to do this if there is a revocation key in the
	* first place and we're not revoked already. */

	if (!*r_revoked && pk->revkey)
	for (k = keyblock; k && k->pkt->pkttype != PKT_USER_ID; k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (IS_KEY_REV (sig) &&
	(sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1]))
	{
	int rc = check_revocation_keys (ctrl, pk, sig);
	if (rc == 0)
	{
	*r_revoked = 2;
	sig_to_revoke_info (sig, rinfo);
	/* Don't continue checking since we can't be any
	* more revoked than this. */
	break;
	}
	else if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	pk->flags.maybe_revoked = 1;

	/* A failure here means the sig did not verify, was
	* not issued by a revocation key, or a revocation
	* key loop was broken. If a revocation key isn't
	* findable, however, the key might be revoked and
	* we don't know it. */

	/* Fixme: In the future handle subkey and cert
	* revocations? PGP doesn't, but it's in 2440. */
	}
	}
	}

	/* Second pass: Look at the self-signature of all user IDs. */

	/* According to RFC 4880 section 11.1, user id and attribute packets
	* are in the second section, after the public key packet and before
	* the subkey packets. */
	signode = uidnode = NULL;
	sigdate = 0; /* Helper variable to find the latest signature in one UID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID \|\| k->pkt->pkttype == PKT_ATTRIBUTE)
	{ /* New user id packet. */

	/* Apply the data from the most recent self-signed packet to
	* the preceding user id packet. */
	if (uidnode && signode)
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}

	/* Clear SIGNODE. The only relevant self-signed data for
	* UIDNODE follows it. */
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else
	uidnode = NULL;

	signode = NULL;
	sigdate = 0;
	}
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
	{
	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* signature did not verify */
	else if ((IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	&& sig->timestamp >= sigdate)
	{
	/* Note: we allow invalidation of cert revocations
	* by a newer signature. An attacker can't use this
	* because a key should be revoked with a key revocation.
	* The reason why we have to allow for that is that at
	* one time an email address may become invalid but later
	* the same email address may become valid again (hired,
	* fired, hired again). */

	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	if (sig->version > sigversion)
	sigversion = sig->version;
	}
	}
	}
	}
	if (uidnode && signode)
	{
	fixup_uidnode (uidnode, signode, keytimestamp);
	pk->flags.valid = 1;
	}

	/* If the key isn't valid yet, and we have
	* --allow-non-selfsigned-uid set, then force it valid. */
	if (!pk->flags.valid && opt.allow_non_selfsigned_uid)
	{
	if (opt.verbose)
	log_info (_("Invalid key %s made valid by"
	" --allow-non-selfsigned-uid\n"), keystr_from_pk (pk));
	pk->flags.valid = 1;
	}

	/* The key STILL isn't valid, so try and find an ultimately
	* trusted signature. */
	if (!pk->flags.valid)
	{
	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	uidnode = k;
	else if (k->pkt->pkttype == PKT_SIGNATURE && uidnode)
	{
	PKT_signature *sig = k->pkt->pkt.signature;

	if (sig->keyid[0] != kid[0] \|\| sig->keyid[1] != kid[1])
	{
	PKT_public_key *ultimate_pk;

	ultimate_pk = xmalloc_clear (sizeof (*ultimate_pk));

	/* We don't want to use the full get_pubkey to avoid
	* infinite recursion in certain cases. There is no
	* reason to check that an ultimately trusted key is
	* still valid - if it has been revoked the user
	* should also remove the ultimate trust flag. */
	if (get_pubkey_fast (ctrl, ultimate_pk, sig->keyid) == 0
	&& check_key_signature2 (ctrl,
	keyblock, k, ultimate_pk,
	NULL, NULL, NULL, NULL) == 0
	&& get_ownertrust (ctrl, ultimate_pk) == TRUST_ULTIMATE)
	{
	free_public_key (ultimate_pk);
	pk->flags.valid = 1;
	break;
	}

	free_public_key (ultimate_pk);
	}
	}
	}
	}

	/* Record the highest selfsig version so we know if this is a v3 key
	* through and through, or a v3 key with a v4 selfsig somewhere.
	* This is useful in a few places to know if the key must be treated
	* as PGP2-style or OpenPGP-style. Note that a selfsig revocation
	* with a higher version number will also raise this value. This is
	* okay since such a revocation must be issued by the user (i.e. it
	* cannot be issued by someone else to modify the key behavior.) */

	pk->selfsigversion = sigversion;

	/* Now that we had a look at all user IDs we can now get some
	* information from those user IDs. */

	if (!key_usage)
	{
	/* Find the latest user ID with key flags set. */
	uiddate = 0; /* Helper to find the latest user ID. */
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;

	if (uid->help_key_usage && uid->created > uiddate)
	{
	key_usage = uid->help_key_usage;
	uiddate = uid->created;
	}
	}
	}
	}

	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (pk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (pk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	/* Whatever happens, it's a primary key, so it can certify. */
	pk->pubkey_usage = key_usage \| PUBKEY_USAGE_CERT;

	if (!key_expire_seen)
	{
	/* Find the latest valid user ID with a key expiration set
	* Note, that this may be a different one from the above because
	* some user IDs may have no expiration date set. */
	uiddate = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->help_key_expire && uid->created > uiddate)
	{
	key_expire = uid->help_key_expire;
	uiddate = uid->created;
	}
	}
	}
	}

	/* Currently only v3 keys have a maximum expiration date, but I'll
	* bet v5 keys get this feature again. */
	if (key_expire == 0
	\|\| (pk->max_expiredate && key_expire > pk->max_expiredate))
	key_expire = pk->max_expiredate;

	pk->has_expired = key_expire >= curtime ? 0 : key_expire;
	pk->expiredate = key_expire;

	/* Fixme: we should see how to get rid of the expiretime fields but
	* this needs changes at other places too. */

	/* And now find the real primary user ID and delete all others. */
	uiddate = uiddate2 = 0;
	uidnode = uidnode2 = NULL;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID && !k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (uid->flags.primary)
	{
	if (uid->created > uiddate)
	{
	uiddate = uid->created;
	uidnode = k;
	}
	else if (uid->created == uiddate && uidnode)
	{
	/* The dates are equal, so we need to do a different
	* (and arbitrary) comparison. This should rarely,
	* if ever, happen. It's good to try and guarantee
	* that two different GnuPG users with two different
	* keyrings at least pick the same primary. */
	if (cmp_user_ids (uid, uidnode->pkt->pkt.user_id) > 0)
	uidnode = k;
	}
	}
	else
	{
	if (uid->created > uiddate2)
	{
	uiddate2 = uid->created;
	uidnode2 = k;
	}
	else if (uid->created == uiddate2 && uidnode2)
	{
	if (cmp_user_ids (uid, uidnode2->pkt->pkt.user_id) > 0)
	uidnode2 = k;
	}
	}
	}
	}
	if (uidnode)
	{
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID &&
	!k->pkt->pkt.user_id->attrib_data)
	{
	PKT_user_id *uid = k->pkt->pkt.user_id;
	if (k != uidnode)
	uid->flags.primary = 0;
	}
	}
	}
	else if (uidnode2)
	{
	/* None is flagged primary - use the latest user ID we have,
	* and disambiguate with the arbitrary packet comparison. */
	uidnode2->pkt->pkt.user_id->flags.primary = 1;
	}
	else
	{
	/* None of our uids were self-signed, so pick the one that
	* sorts first to be the primary. This is the best we can do
	* here since there are no self sigs to date the uids. */

	uidnode = NULL;

	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data)
	{
	if (!uidnode)
	{
	uidnode = k;
	uidnode->pkt->pkt.user_id->flags.primary = 1;
	continue;
	}
	else
	{
	if (cmp_user_ids (k->pkt->pkt.user_id,
	uidnode->pkt->pkt.user_id) > 0)
	{
	uidnode->pkt->pkt.user_id->flags.primary = 0;
	uidnode = k;
	uidnode->pkt->pkt.user_id->flags.primary = 1;
	}
	else
	{
	/* just to be safe: */
	k->pkt->pkt.user_id->flags.primary = 0;
	}
	}
	}
	}
	}
	}


	/* Convert a buffer to a signature. Useful for 0x19 embedded sigs.
	* Caller must free the signature when they are done. */
	static PKT_signature *
	buf_to_sig (const byte * buf, size_t len)
	{
	PKT_signature *sig = xmalloc_clear (sizeof (PKT_signature));
	IOBUF iobuf = iobuf_temp_with_content (buf, len);
	int save_mode = set_packet_list_mode (0);

	if (parse_signature (iobuf, PKT_SIGNATURE, len, sig) != 0)
	{
	free_seckey_enc (sig);
	sig = NULL;
	}

	set_packet_list_mode (save_mode);
	iobuf_close (iobuf);

	return sig;
	}


	/* Use the self-signed data to fill in various fields in subkeys.
	*
	* KEYBLOCK is the whole keyblock. SUBNODE is the subkey to fill in.
	*
	* Sets the following fields on the subkey:
	*
	* main_keyid
	* flags.valid if the subkey has a valid self-sig binding
	* flags.revoked
	* flags.backsig
	* pubkey_usage
	* has_expired
	* expired_date
	*
	* On this subkey's most revent valid self-signed packet, the
	* following field is set:
	*
	* flags.chosen_selfsig
	*/
	static void
	merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
	{
	PKT_public_key mainpk = NULL, subpk = NULL;
	PKT_signature *sig;
	KBNODE k;
	u32 mainkid[2];
	u32 sigdate = 0;
	KBNODE signode;
	u32 curtime = make_timestamp ();
	unsigned int key_usage = 0;
	u32 keytimestamp = 0;
	u32 key_expire = 0;
	const byte *p;

	if (subnode->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	BUG ();
	mainpk = keyblock->pkt->pkt.public_key;
	if (mainpk->version < 4)
	return;/* (actually this should never happen) */
	keyid_from_pk (mainpk, mainkid);
	subpk = subnode->pkt->pkt.public_key;
	keytimestamp = subpk->timestamp;

	subpk->flags.valid = 0;
	subpk->flags.exact = 0;
	subpk->main_keyid[0] = mainpk->main_keyid[0];
	subpk->main_keyid[1] = mainpk->main_keyid[1];

	/* Find the latest key binding self-signature. */
	signode = NULL;
	sigdate = 0; /* Helper to find the latest signature. */
	for (k = subnode->next; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY;
	k = k->next)
	{
	if (k->pkt->pkttype == PKT_SIGNATURE)
	{
	sig = k->pkt->pkt.signature;
	if (sig->keyid[0] == mainkid[0] && sig->keyid[1] == mainkid[1])
	{
	if (check_key_signature (ctrl, keyblock, k, NULL))
	; /* Signature did not verify. */
	else if (IS_SUBKEY_REV (sig))
	{
	/* Note that this means that the date on a
	* revocation sig does not matter - even if the
	* binding sig is dated after the revocation sig,
	* the subkey is still marked as revoked. This
	* seems ok, as it is just as easy to make new
	* subkeys rather than re-sign old ones as the
	* problem is in the distribution. Plus, PGP (7)
	* does this the same way. */
	subpk->flags.revoked = 1;
	sig_to_revoke_info (sig, &subpk->revoked);
	/* Although we could stop now, we continue to
	* figure out other information like the old expiration
	* time. */
	}
	else if (IS_SUBKEY_SIG (sig) && sig->timestamp >= sigdate)
	{
	if (sig->flags.expired)
	; /* Signature has expired - ignore it. */
	else
	{
	sigdate = sig->timestamp;
	signode = k;
	signode->pkt->pkt.signature->flags.chosen_selfsig = 0;
	}
	}
	}
	}
	}

	/* No valid key binding. */
	if (!signode)
	return;

	sig = signode->pkt->pkt.signature;
	sig->flags.chosen_selfsig = 1; /* So we know which selfsig we chose later. */

	key_usage = parse_key_usage (sig);
	if (!key_usage)
	{
	/* No key flags at all: get it from the algo. */
	key_usage = openpgp_pk_algo_usage (subpk->pubkey_algo);
	}
	else
	{
	/* Check that the usage matches the usage as given by the algo. */
	int x = openpgp_pk_algo_usage (subpk->pubkey_algo);
	if (x) /* Mask it down to the actual allowed usage. */
	key_usage &= x;
	}

	subpk->pubkey_usage = key_usage;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	key_expire = keytimestamp + buf32_to_u32 (p);
	else
	key_expire = 0;

	subpk->has_expired = key_expire >= curtime ? 0 : key_expire;
	subpk->expiredate = key_expire;

	/* Algo doesn't exist. */
	if (openpgp_pk_test_algo (subpk->pubkey_algo))
	return;

	subpk->flags.valid = 1;

	/* Find the most recent 0x19 embedded signature on our self-sig. */
	if (!subpk->flags.backsig)
	{
	int seq = 0;
	size_t n;
	PKT_signature *backsig = NULL;

	sigdate = 0;

	/* We do this while() since there may be other embedded
	* signatures in the future. We only want 0x19 here. */

	while ((p = enum_sig_subpkt (sig, 1, SIGSUBPKT_SIGNATURE,
	&n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	seq = 0;

	/* It is safe to have this in the unhashed area since the 0x19
	* is located on the selfsig for convenience, not security. */
	while ((p = enum_sig_subpkt (sig, 0, SIGSUBPKT_SIGNATURE,
	&n, &seq, NULL)))
	if (n > 3
	&& ((p[0] == 3 && p[2] == 0x19) \|\| (p[0] == 4 && p[1] == 0x19)))
	{
	PKT_signature *tempsig = buf_to_sig (p, n);
	if (tempsig)
	{
	if (tempsig->timestamp > sigdate)
	{
	if (backsig)
	free_seckey_enc (backsig);

	backsig = tempsig;
	sigdate = backsig->timestamp;
	}
	else
	free_seckey_enc (tempsig);
	}
	}

	if (backsig)
	{
	/* At this point, backsig contains the most recent 0x19 sig.
	* Let's see if it is good. */

	/* 2==valid, 1==invalid, 0==didn't check */
	if (check_backsig (mainpk, subpk, backsig) == 0)
	subpk->flags.backsig = 2;
	else
	subpk->flags.backsig = 1;

	free_seckey_enc (backsig);
	}
	}
	}


	/* Merge information from the self-signatures with the public key,
	* subkeys and user ids to make using them more easy.
	*
	* See documentation for merge_selfsigs_main, merge_selfsigs_subkey
	* and fixup_uidnode for exactly which fields are updated. */
	static void
	merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock)
	{
	KBNODE k;
	int revoked;
	struct revoke_info rinfo;
	PKT_public_key *main_pk;
	prefitem_t *prefs;
	unsigned int mdc_feature;
	unsigned int aead_feature;

	if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
	{
	if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	log_error ("expected public key but found secret key "
	"- must stop\n");
	/* We better exit here because a public key is expected at
	* other places too. FIXME: Figure this out earlier and
	* don't get to here at all */
	g10_exit (1);
	}
	BUG ();
	}

	merge_selfsigs_main (ctrl, keyblock, &revoked, &rinfo);

	/* Now merge in the data from each of the subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_selfsigs_subkey (ctrl, keyblock, k);
	}
	}

	main_pk = keyblock->pkt->pkt.public_key;
	if (revoked \|\| main_pk->has_expired \|\| !main_pk->flags.valid)
	{
	/* If the primary key is revoked, expired, or invalid we
	* better set the appropriate flags on that key and all
	* subkeys. */
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (!main_pk->flags.valid)
	pk->flags.valid = 0;
	if (revoked && !pk->flags.revoked)
	{
	pk->flags.revoked = revoked;
	memcpy (&pk->revoked, &rinfo, sizeof (rinfo));
	}
	if (main_pk->has_expired)
	{
	pk->has_expired = main_pk->has_expired;
	if (!pk->expiredate \|\| pk->expiredate > main_pk->expiredate)
	pk->expiredate = main_pk->expiredate;
	}
	}
	}
	return;
	}

	/* Set the preference list of all keys to those of the primary real
	* user ID. Note: we use these preferences when we don't know by
	* which user ID the key has been selected.
	* fixme: we should keep atoms of commonly used preferences or
	* use reference counting to optimize the preference lists storage.
	* FIXME: it might be better to use the intersection of
	* all preferences.
	* Do a similar thing for the MDC feature flag. */
	prefs = NULL;
	mdc_feature = aead_feature = 0;
	for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
	{
	if (k->pkt->pkttype == PKT_USER_ID
	&& !k->pkt->pkt.user_id->attrib_data
	&& k->pkt->pkt.user_id->flags.primary)
	{
	prefs = k->pkt->pkt.user_id->prefs;
	mdc_feature = k->pkt->pkt.user_id->flags.mdc;
	aead_feature = k->pkt->pkt.user_id->flags.aead;
	break;
	}
	}
	for (k = keyblock; k; k = k->next)
	{
	if (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = k->pkt->pkt.public_key;
	if (pk->prefs)
	xfree (pk->prefs);
	pk->prefs = copy_prefs (prefs);
	pk->flags.mdc = mdc_feature;
	pk->flags.aead = aead_feature;
	}
	}
	}



	/* See whether the key satisfies any additional requirements specified
	* in CTX. If so, return the node of an appropriate key or subkey.
	* Otherwise, return NULL if there was no appropriate key.
	*
	* Note that we do not return a reference, i.e. the result must not be
	* freed using 'release_kbnode'.
	*
	* In case the primary key is not required, select a suitable subkey.
	* We need the primary key if PUBKEY_USAGE_CERT is set in REQ_USAGE or
	* we are in PGP7 mode and PUBKEY_USAGE_SIG is set in
	* REQ_USAGE.
	*
	* If any of PUBKEY_USAGE_SIG, PUBKEY_USAGE_ENC and PUBKEY_USAGE_CERT
	* are set in REQ_USAGE, we filter by the key's function. Concretely,
	* if PUBKEY_USAGE_SIG and PUBKEY_USAGE_CERT are set, then we only
	* return a key if it is (at least) either a signing or a
	* certification key.
	*
	* If REQ_USAGE is set, then we reject any keys that are not good
	* (i.e., valid, not revoked, not expired, etc.). This allows the
	* getkey functions to be used for plain key listings.
	*
	* Sets the matched key's user id field (pk->user_id) to the user id
	* that matched the low-level search criteria or NULL.
	*
	* If R_FLAGS is not NULL set certain flags for more detailed error
	* reporting. Used flags are:
	*
	* - LOOKUP_ALL_SUBKEYS_EXPIRED :: All Subkeys are expired or have
	* been revoked.
	* - LOOKUP_NOT_SELECTED :: No suitable key found
	*
	* This function needs to handle several different cases:
	*
	* 1. No requested usage and no primary key requested
	* Examples for this case are that we have a keyID to be used
	* for decryption or verification.
	* 2. No usage but primary key requested
	* This is the case for all functions which work on an
	* entire keyblock, e.g. for editing or listing
	* 3. Usage and primary key requested
	* FIXME
	* 4. Usage but no primary key requested
	* FIXME
	*
	*/
	static kbnode_t
	finish_lookup (kbnode_t keyblock, unsigned int req_usage, int want_exact,
	int want_secret, unsigned int *r_flags)
	{
	kbnode_t k;

	/* If WANT_EXACT is set, the key or subkey that actually matched the
	low-level search criteria. */
	kbnode_t foundk = NULL;
	/* The user id (if any) that matched the low-level search criteria. */
	PKT_user_id *foundu = NULL;

	u32 latest_date;
	kbnode_t latest_key;
	PKT_public_key *pk;
	int req_prim;
	u32 curtime = make_timestamp ();

	if (r_flags)
	*r_flags = 0;

	#define USAGE_MASK (PUBKEY_USAGE_SIG\|PUBKEY_USAGE_ENC\|PUBKEY_USAGE_CERT)
	req_usage &= USAGE_MASK;

	/* Request the primary if we're certifying another key, and also if
	* signing data while --pgp7 is on since pgp 7 do
	* not understand signatures made by a signing subkey. PGP 8 does. */
	req_prim = ((req_usage & PUBKEY_USAGE_CERT)
	\|\| (PGP7 && (req_usage & PUBKEY_USAGE_SIG)));


	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);

	/* For an exact match mark the primary or subkey that matched the
	low-level search criteria. */
	if (want_exact)
	{
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 1))
	{
	log_assert (k->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| k->pkt->pkttype == PKT_PUBLIC_SUBKEY);
	foundk = k;
	pk = k->pkt->pkt.public_key;
	pk->flags.exact = 1;
	break;
	}
	}
	}

	/* Get the user id that matched that low-level search criteria. */
	for (k = keyblock; k; k = k->next)
	{
	if ((k->flag & 2))
	{
	log_assert (k->pkt->pkttype == PKT_USER_ID);
	foundu = k->pkt->pkt.user_id;
	break;
	}
	}

	if (DBG_LOOKUP)
	log_debug ("finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
	(ulong) keyid_from_pk (keyblock->pkt->pkt.public_key, NULL),
	foundk ? "one" : "all", req_usage);

	if (!req_usage)
	{
	latest_key = foundk ? foundk : keyblock;
	goto found;
	}

	latest_date = 0;
	latest_key = NULL;
	/* Set LATEST_KEY to the latest (the one with the most recent
	* timestamp) good (valid, not revoked, not expired, etc.) subkey.
	*
	* Don't bother if we are only looking for a primary key or we need
	* an exact match and the exact match is not a subkey. */
	if (req_prim \|\| (foundk && foundk->pkt->pkttype != PKT_PUBLIC_SUBKEY))
	;
	else
	{
	kbnode_t nextk;
	int n_subkeys = 0;
	int n_revoked_or_expired = 0;
	int last_secret_key_avail = 0;

	/* Either start a loop or check just this one subkey. */
	for (k = foundk ? foundk : keyblock; k; k = nextk)
	{
	if (foundk)
	{
	/* If FOUNDK is not NULL, then only consider that exact
	key, i.e., don't iterate. */
	nextk = NULL;
	}
	else
	nextk = k->next;

	if (k->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk = k->pkt->pkt.public_key;
	if (DBG_LOOKUP)
	log_debug ("\tchecking subkey %08lX\n",
	(ulong) keyid_from_pk (pk, NULL));

	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not valid\n");
	continue;
	}
	if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tusage does not match: want=%x have=%x\n",
	req_usage, pk->pubkey_usage);
	continue;
	}

	n_subkeys++;
	if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has been revoked\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey has expired\n");
	n_revoked_or_expired++;
	continue;
	}
	if (pk->timestamp > curtime && !opt.ignore_valid_from)
	{
	if (DBG_LOOKUP)
	log_debug ("\tsubkey not yet valid\n");
	continue;
	}

	if (want_secret)
	{
	int secret_key_avail = agent_probe_secret_key (NULL, pk);

	if (!secret_key_avail)
	{
	if (DBG_LOOKUP)
	log_debug ("\tno secret key\n");
	continue;
	}

	if (secret_key_avail > last_secret_key_avail)
	{
	/* Use this key. */
	last_secret_key_avail = secret_key_avail;
	latest_date = 0;
	}
	}

	if (DBG_LOOKUP)
	log_debug ("\tsubkey might be fine\n");
	/* In case a key has a timestamp of 0 set, we make sure
	that it is used. A better change would be to compare
	">=" but that might also change the selected keys and
	is as such a more intrusive change. */
	if (pk->timestamp > latest_date \|\| (!pk->timestamp && !latest_date))
	{
	latest_date = pk->timestamp;
	latest_key = k;
	}
	}
	if (n_subkeys == n_revoked_or_expired && r_flags)
	*r_flags \|= LOOKUP_ALL_SUBKEYS_EXPIRED;
	}

	/* Check if the primary key is ok (valid, not revoke, not expire,
	* matches requested usage) if:
	*
	* - we didn't find an appropriate subkey and we're not doing an
	* exact search,
	*
	* - we're doing an exact match and the exact match was the
	* primary key, or,
	*
	* - we're just considering the primary key. */
	if ((!latest_key && !want_exact) \|\| foundk == keyblock \|\| req_prim)
	{
	if (DBG_LOOKUP && !foundk && !req_prim)
	log_debug ("\tno suitable subkeys found - trying primary\n");
	pk = keyblock->pkt->pkt.public_key;
	if (!pk->flags.valid)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key not valid\n");
	}
	else if (!((pk->pubkey_usage & USAGE_MASK) & req_usage))
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key usage does not match: "
	"want=%x have=%x\n", req_usage, pk->pubkey_usage);
	}
	else if (pk->flags.revoked)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has been revoked\n");
	}
	else if (pk->has_expired)
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key has expired\n");
	}
	else /* Okay. */
	{
	if (DBG_LOOKUP)
	log_debug ("\tprimary key may be used\n");
	latest_key = keyblock;
	}
	}

	if (!latest_key)
	{
	if (DBG_LOOKUP)
	log_debug ("\tno suitable key found - giving up\n");
	if (r_flags)
	*r_flags \|= LOOKUP_NOT_SELECTED;
	return NULL; /* Not found. */
	}

	found:
	if (DBG_LOOKUP)
	log_debug ("\tusing key %08lX\n",
	(ulong) keyid_from_pk (latest_key->pkt->pkt.public_key, NULL));

	if (latest_key)
	{
	pk = latest_key->pkt->pkt.public_key;
	free_user_id (pk->user_id);
	pk->user_id = scopy_user_id (foundu);
	}

	if (latest_key != keyblock && opt.verbose)
	{
	char *tempkeystr =
	xstrdup (keystr_from_pk (latest_key->pkt->pkt.public_key));
	log_info (_("using subkey %s instead of primary key %s\n"),
	tempkeystr, keystr_from_pk (keyblock->pkt->pkt.public_key));
	xfree (tempkeystr);
	}

	cache_put_keyblock (keyblock);

	return latest_key ? latest_key : keyblock; /* Found. */
	}


	/* Print a KEY_CONSIDERED status line. */
	static void
	print_status_key_considered (kbnode_t keyblock, unsigned int flags)
	{
	char hexfpr[2*MAX_FINGERPRINT_LEN + 1];
	kbnode_t node;
	char flagbuf[20];

	if (!is_status_enabled ())
	return;

	for (node=keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY)
	break;
	if (!node)
	{
	log_error ("%s: keyblock w/o primary key\n", __func__);
	return;
	}

	hexfingerprint (node->pkt->pkt.public_key, hexfpr, sizeof hexfpr);
	snprintf (flagbuf, sizeof flagbuf, " %u", flags);
	write_status_strings (STATUS_KEY_CONSIDERED, hexfpr, flagbuf, NULL);
	}



	/* A high-level function to lookup keys.
	*
	* This function builds on top of the low-level keydb API. It first
	* searches the database using the description stored in CTX->ITEMS,
	* then it filters the results using CTX and, finally, if WANT_SECRET
	* is set, it ignores any keys for which no secret key is available.
	*
	* Unlike the low-level search functions, this function also merges
	* all of the self-signed data into the keys, subkeys and user id
	* packets (see the merge_selfsigs for details).
	*
	* On success the key's keyblock is stored at *RET_KEYBLOCK, and the
	* specific subkey is stored at *RET_FOUND_KEY. Note that we do not
	* return a reference in *RET_FOUND_KEY, i.e. the result must not be
	* freed using 'release_kbnode', and it is only valid until
	* *RET_KEYBLOCK is deallocated. Therefore, if RET_FOUND_KEY is not
	* NULL, then RET_KEYBLOCK must not be NULL. */
	static int
	lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
	kbnode_t ret_keyblock, kbnode_t ret_found_key)
	{
	int rc;
	int no_suitable_key = 0;
	KBNODE keyblock = NULL;
	KBNODE found_key = NULL;
	unsigned int infoflags;

	log_assert (ret_found_key == NULL \|\| ret_keyblock != NULL);
	if (ret_keyblock)
	*ret_keyblock = NULL;

	for (;;)
	{
	rc = keydb_search (ctx->kr_handle, ctx->items, ctx->nitems, NULL);
	if (rc)
	break;

	/* If we are iterating over the entire database, then we need to
	* change from KEYDB_SEARCH_MODE_FIRST, which does an implicit
	* reset, to KEYDB_SEARCH_MODE_NEXT, which gets the next record. */
	if (ctx->nitems && ctx->items->mode == KEYDB_SEARCH_MODE_FIRST)
	ctx->items->mode = KEYDB_SEARCH_MODE_NEXT;

	rc = keydb_get_keyblock (ctx->kr_handle, &keyblock);
	if (rc)
	{
	log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));
	goto skip;
	}

	if (want_secret)
	{
	rc = agent_probe_any_secret_key (NULL, keyblock);
	if (gpg_err_code(rc) == GPG_ERR_NO_SECKEY)
	goto skip; /* No secret key available. */
	if (rc)
	goto found; /* Unexpected error. */
	}

	/* Warning: node flag bits 0 and 1 should be preserved by
	* merge_selfsigs. */
	merge_selfsigs (ctrl, keyblock);
	found_key = finish_lookup (keyblock, ctx->req_usage, ctx->exact,
	want_secret, &infoflags);
	print_status_key_considered (keyblock, infoflags);
	if (found_key)
	{
	no_suitable_key = 0;
	goto found;
	}
	else
	{
	no_suitable_key = 1;
	}

	skip:
	/* Release resources and continue search. */
	release_kbnode (keyblock);
	keyblock = NULL;
	/* The keyblock cache ignores the current "file position".
	* Thus, if we request the next result and the cache matches
	* (and it will since it is what we just looked for), we'll get
	* the same entry back! We can avoid this infinite loop by
	* disabling the cache. */
	keydb_disable_caching (ctx->kr_handle);
	}

	found:
	if (rc && gpg_err_code (rc) != GPG_ERR_NOT_FOUND)
	log_error ("keydb_search failed: %s\n", gpg_strerror (rc));

	if (!rc)
	{
	if (ret_keyblock)
	{
	ret_keyblock = keyblock; / Return the keyblock. */
	keyblock = NULL;
	}
	}
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND && no_suitable_key)
	rc = want_secret? GPG_ERR_UNUSABLE_SECKEY : GPG_ERR_UNUSABLE_PUBKEY;
	else if (gpg_err_code (rc) == GPG_ERR_NOT_FOUND)
	rc = want_secret? GPG_ERR_NO_SECKEY : GPG_ERR_NO_PUBKEY;

	release_kbnode (keyblock);

	if (ret_found_key)
	{
	if (! rc)
	*ret_found_key = found_key;
	else
	*ret_found_key = NULL;
	}

	return rc;
	}


	gpg_error_t
	get_seckey_default_or_card (ctrl_t ctrl, PKT_public_key *pk,
	const byte *fpr_card, size_t fpr_len)
	{
	gpg_error_t err;
	strlist_t namelist = NULL;

	const char *def_secret_key = parse_def_secret_key (ctrl);

	if (def_secret_key)
	add_to_strlist (&namelist, def_secret_key);
	else if (fpr_card)
	{
	int rc = get_pubkey_byfprint (ctrl, pk, NULL, fpr_card, fpr_len);

	/* The key on card can be not suitable for requested usage. */
	if (rc == GPG_ERR_UNUSABLE_PUBKEY)
	fpr_card = NULL; /* Fallthrough as no card. */
	else
	return rc;
	}

	if (!fpr_card
	\|\| (def_secret_key && def_secret_key[strlen (def_secret_key)-1] == '!'))
	err = key_byname (ctrl, NULL, namelist, pk, 1, 0, NULL, NULL);
	else
	{ /* Default key is specified and card key is also available. */
	kbnode_t k, keyblock = NULL;

	err = key_byname (ctrl, NULL, namelist, pk, 1, 0, &keyblock, NULL);
	if (!err)
	for (k = keyblock; k; k = k->next)
	{
	PKT_public_key *pk_candidate;
	char fpr[MAX_FINGERPRINT_LEN];

	if (k->pkt->pkttype != PKT_PUBLIC_KEY
	&&k->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	pk_candidate = k->pkt->pkt.public_key;
	if (!pk_candidate->flags.valid)
	continue;
	if (!((pk_candidate->pubkey_usage & USAGE_MASK) & pk->req_usage))
	continue;
	fingerprint_from_pk (pk_candidate, fpr, NULL);
	if (!memcmp (fpr_card, fpr, fpr_len))
	{
	release_public_key_parts (pk);
	copy_public_key (pk, pk_candidate);
	break;
	}
	}
	release_kbnode (keyblock);
	}

	free_strlist (namelist);

	return err;
	}

	/*********************************************
	********* User ID printing helpers *****
	*********************************************/

	/* Return a string with a printable representation of the user_id.
	* this string must be freed by xfree. If R_NOUID is not NULL it is
	* set to true if a user id was not found; otherwise to false. */
	static char *
	get_user_id_string (ctrl_t ctrl, u32 * keyid, int mode)
	{
	char *name;
	unsigned int namelen;
	char *p;

	log_assert (mode != 2);

	name = cache_get_uid_bykid (keyid, &namelen);
	if (!name)
	{
	/* Get it so that the cache will be filled. */
	if (!get_pubkey (ctrl, NULL, keyid))
	name = cache_get_uid_bykid (keyid, &namelen);
	}

	if (name)
	{
	if (mode)
	p = xasprintf ("%08lX%08lX %.*s",
	(ulong) keyid[0], (ulong) keyid[1], namelen, name);
	else
	p = xasprintf ("%s %.*s", keystr (keyid), namelen, name);

	xfree (name);
	}
	else
	{
	if (mode)
	p = xasprintf ("%08lX%08lX [?]", (ulong) keyid[0], (ulong) keyid[1]);
	else
	p = xasprintf ("%s [?]", keystr (keyid));
	}

	return p;
	}


	char *
	get_user_id_string_native (ctrl_t ctrl, u32 * keyid)
	{
	char *p = get_user_id_string (ctrl, keyid, 0);
	char *p2 = utf8_to_native (p, strlen (p), 0);
	xfree (p);
	return p2;
	}


	char *
	get_long_user_id_string (ctrl_t ctrl, u32 * keyid)
	{
	return get_user_id_string (ctrl, keyid, 1);
	}


	/* Please try to use get_user_byfpr instead of this one. */
	char *
	get_user_id (ctrl_t ctrl, u32 keyid, size_t rn, int *r_nouid)
	{
	char *name;
	unsigned int namelen;

	if (r_nouid)
	*r_nouid = 0;

	name = cache_get_uid_bykid (keyid, &namelen);
	if (!name)
	{
	/* Get it so that the cache will be filled. */
	if (!get_pubkey (ctrl, NULL, keyid))
	name = cache_get_uid_bykid (keyid, &namelen);
	}

	if (!name)
	{
	name = xstrdup (user_id_not_found_utf8 ());
	namelen = strlen (name);
	if (r_nouid)
	*r_nouid = 1;
	}

	if (rn && name)
	*rn = namelen;
	return name;
	}


	/* Please try to use get_user_id_byfpr_native instead of this one. */
	char *
	get_user_id_native (ctrl_t ctrl, u32 *keyid)
	{
	size_t rn;
	char *p = get_user_id (ctrl, keyid, &rn, NULL);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the user id for a key designated by its fingerprint, FPR,
	which must be MAX_FINGERPRINT_LEN bytes in size. Note: the
	returned string, which must be freed using xfree, may not be NUL
	terminated. To determine the length of the string, you must use
	RN. /
	static char *
	get_user_id_byfpr (ctrl_t ctrl, const byte fpr, size_t fprlen, size_t rn)
	{
	char *name;

	name = cache_get_uid_byfpr (fpr, fprlen, rn);
	if (!name)
	{
	/* Get it so that the cache will be filled. */
	if (!get_pubkey_byfprint (ctrl, NULL, NULL, fpr, fprlen))
	name = cache_get_uid_byfpr (fpr, fprlen, rn);
	}

	if (!name)
	{
	name = xstrdup (user_id_not_found_utf8 ());
	*rn = strlen (name);
	}

	return name;
	}

	/* Like get_user_id_byfpr, but convert the string to the native
	encoding. The returned string needs to be freed. Unlike
	get_user_id_byfpr, the returned string is NUL terminated. */
	char *
	get_user_id_byfpr_native (ctrl_t ctrl, const byte *fpr, size_t fprlen)
	{
	size_t rn;
	char *p = get_user_id_byfpr (ctrl, fpr, fprlen, &rn);
	char *p2 = utf8_to_native (p, rn, 0);
	xfree (p);
	return p2;
	}


	/* Return the database handle used by this context. The context still
	owns the handle. */
	KEYDB_HANDLE
	get_ctx_handle (GETKEY_CTX ctx)
	{
	return ctx->kr_handle;
	}

	static void
	free_akl (struct akl *akl)
	{
	if (! akl)
	return;

	if (akl->spec)
	free_keyserver_spec (akl->spec);

	xfree (akl);
	}

	void
	release_akl (void)
	{
	while (opt.auto_key_locate)
	{
	struct akl *akl2 = opt.auto_key_locate;
	opt.auto_key_locate = opt.auto_key_locate->next;
	free_akl (akl2);
	}
	}


	/* Returns true if the AKL is empty or has only the local method
	* active. */
	int
	akl_empty_or_only_local (void)
	{
	struct akl *akl;
	int any = 0;

	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type != AKL_NODEFAULT && akl->type != AKL_LOCAL)
	{
	any = 1;
	break;
	}

	return !any;
	}


	/* Returns false on error. */
	int
	parse_auto_key_locate (const char *options_arg)
	{
	char *tok;
	char options, options_buf;

	options = options_buf = xstrdup (options_arg);
	while ((tok = optsep (&options)))
	{
	struct akl akl, check, *last = NULL;
	int dupe = 0;

	if (tok[0] == '\0')
	continue;

	akl = xmalloc_clear (sizeof (*akl));

	if (ascii_strcasecmp (tok, "clear") == 0)
	{
	xfree (akl);
	free_akl (opt.auto_key_locate);
	opt.auto_key_locate = NULL;
	continue;
	}
	else if (ascii_strcasecmp (tok, "nodefault") == 0)
	akl->type = AKL_NODEFAULT;
	else if (ascii_strcasecmp (tok, "local") == 0)
	akl->type = AKL_LOCAL;
	else if (ascii_strcasecmp (tok, "ldap") == 0)
	akl->type = AKL_LDAP;
	else if (ascii_strcasecmp (tok, "keyserver") == 0)
	akl->type = AKL_KEYSERVER;
	else if (ascii_strcasecmp (tok, "cert") == 0)
	akl->type = AKL_CERT;
	else if (ascii_strcasecmp (tok, "pka") == 0)
	akl->type = AKL_PKA;
	else if (ascii_strcasecmp (tok, "dane") == 0)
	akl->type = AKL_DANE;
	else if (ascii_strcasecmp (tok, "wkd") == 0)
	akl->type = AKL_WKD;
	else if ((akl->spec = parse_keyserver_uri (tok, 1)))
	akl->type = AKL_SPEC;
	else
	{
	free_akl (akl);
	xfree (options_buf);
	return 0;
	}

	/* We must maintain the order the user gave us */
	for (check = opt.auto_key_locate; check;
	last = check, check = check->next)
	{
	/* Check for duplicates */
	if (check->type == akl->type
	&& (akl->type != AKL_SPEC
	\|\| (akl->type == AKL_SPEC
	&& strcmp (check->spec->uri, akl->spec->uri) == 0)))
	{
	dupe = 1;
	free_akl (akl);
	break;
	}
	}

	if (!dupe)
	{
	if (last)
	last->next = akl;
	else
	opt.auto_key_locate = akl;
	}
	}

	xfree (options_buf);
	return 1;
	}



	/* The list of key origins. */
	static struct {
	const char *name;
	int origin;
	} key_origin_list[] =
	{
	{ "self", KEYORG_SELF },
	{ "file", KEYORG_FILE },
	{ "url", KEYORG_URL },
	{ "wkd", KEYORG_WKD },
	{ "dane", KEYORG_DANE },
	{ "ks-pref", KEYORG_KS_PREF },
	{ "ks", KEYORG_KS },
	{ "unknown", KEYORG_UNKNOWN }
	};

	/* Parse the argument for --key-origin. Return false on error. */
	int
	parse_key_origin (char *string)
	{
	int i;
	char *comma;

	comma = strchr (string, ',');
	if (comma)
	*comma = 0;

	if (!ascii_strcasecmp (string, "help"))
	{
	log_info (_("valid values for option '%s':\n"), "--key-origin");
	for (i=0; i < DIM (key_origin_list); i++)
	log_info (" %s\n", key_origin_list[i].name);
	g10_exit (1);
	}

	for (i=0; i < DIM (key_origin_list); i++)
	if (!ascii_strcasecmp (string, key_origin_list[i].name))
	{
	opt.key_origin = key_origin_list[i].origin;
	xfree (opt.key_origin_url);
	opt.key_origin_url = NULL;
	if (comma && comma[1])
	{
	opt.key_origin_url = xstrdup (comma+1);
	trim_spaces (opt.key_origin_url);
	}

	return 1;
	}

	if (comma)
	*comma = ',';
	return 0;
	}

	/* Return a string or "?" for the key ORIGIN. */
	const char *
	key_origin_string (int origin)
	{
	int i;

	for (i=0; i < DIM (key_origin_list); i++)
	if (key_origin_list[i].origin == origin)
	return key_origin_list[i].name;
	return "?";
	}



	/* Returns true if a secret key is available for the public key with
	key id KEYID; returns false if not. This function ignores legacy
	keys. Note: this is just a fast check and does not tell us whether
	the secret key is valid; this check merely indicates whether there
	is some secret key with the specified key id. */
	int
	have_secret_key_with_kid (ctrl_t ctrl, u32 *keyid)
	{
	gpg_error_t err;
	KEYDB_HANDLE kdbhd;
	KEYDB_SEARCH_DESC desc;
	kbnode_t keyblock;
	kbnode_t node;
	int result = 0;

	kdbhd = keydb_new (ctrl);
	if (!kdbhd)
	return 0;
	memset (&desc, 0, sizeof desc);
	desc.mode = KEYDB_SEARCH_MODE_LONG_KID;
	desc.u.kid[0] = keyid[0];
	desc.u.kid[1] = keyid[1];
	while (!result)
	{
	err = keydb_search (kdbhd, &desc, 1, NULL);
	if (err)
	break;

	err = keydb_get_keyblock (kdbhd, &keyblock);
	if (err)
	{
	log_error (_("error reading keyblock: %s\n"), gpg_strerror (err));
	break;
	}

	for (node = keyblock; node; node = node->next)
	{
	/* Bit 0 of the flags is set if the search found the key
	using that key or subkey. Note: a search will only ever
	match a single key or subkey. */
	if ((node->flag & 1))
	{
	log_assert (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY);

	if (agent_probe_secret_key (NULL, node->pkt->pkt.public_key))
	result = 1; /* Secret key available. */
	else
	result = 0;

	break;
	}
	}
	release_kbnode (keyblock);
	}

	keydb_release (kdbhd);
	return result;
	}
	diff --git a/g10/gpgv.c b/g10/gpgv.c
	index ae37fa340..65f5f89c7 100644
	--- a/g10/gpgv.c
	+++ b/g10/gpgv.c
	@@ -1,799 +1,811 @@
	/* gpgv.c - The GnuPG signature verify utility
	* Copyright (C) 1998-2020 Free Software Foundation, Inc.
	* Copyright (C) 1997-2019 Werner Koch
	* Copyright (C) 2015-2020 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	* SPDX-License-Identifier: GPL-3.0-or-later
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <unistd.h>
	#ifdef HAVE_DOSISH_SYSTEM
	#include <fcntl.h> /* for setmode() */
	#endif
	#ifdef HAVE_LIBREADLINE
	#define GNUPG_LIBREADLINE_H_INCLUDED
	#include <readline/readline.h>
	#endif

	#define INCLUDED_BY_MAIN_MODULE 1
	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "main.h"
	#include "options.h"
	#include "keydb.h"
	#include "trustdb.h"
	#include "filter.h"
	#include "../common/ttyio.h"
	#include "../common/i18n.h"
	#include "../common/sysutils.h"
	#include "../common/status.h"
	#include "call-agent.h"
	#include "../common/init.h"


	enum cmd_and_opt_values {
	aNull = 0,
	oQuiet = 'q',
	oVerbose = 'v',
	oOutput = 'o',
	oBatch = 500,
	oKeyring,
	oIgnoreTimeConflict,
	oStatusFD,
	oLoggerFD,
	oLoggerFile,
	oHomedir,
	oWeakDigest,
	oEnableSpecialFilenames,
	oDebug,
	aTest
	};


	static gpgrt_opt_t opts[] = {
	ARGPARSE_group (300, N_("@\nOptions:\n ")),

	ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
	ARGPARSE_s_n (oQuiet, "quiet", N_("be somewhat more quiet")),
	ARGPARSE_s_s (oKeyring, "keyring",
	N_("\|FILE\|take the keys from the keyring FILE")),
	ARGPARSE_s_s (oOutput, "output", N_("\|FILE\|write output to FILE")),
	ARGPARSE_s_n (oIgnoreTimeConflict, "ignore-time-conflict",
	N_("make timestamp conflicts only a warning")),
	ARGPARSE_s_i (oStatusFD, "status-fd",
	N_("\|FD\|write status info to this FD")),
	ARGPARSE_s_i (oLoggerFD, "logger-fd", "@"),
	ARGPARSE_s_s (oLoggerFile, "log-file", "@"),
	ARGPARSE_s_s (oHomedir, "homedir", "@"),
	ARGPARSE_s_s (oWeakDigest, "weak-digest",
	N_("\|ALGO\|reject signatures made with ALGO")),
	ARGPARSE_s_n (oEnableSpecialFilenames, "enable-special-filenames", "@"),
	ARGPARSE_s_s (oDebug, "debug", "@"),

	ARGPARSE_end ()
	};


	/* The list of supported debug flags. */
	static struct debug_flags_s debug_flags [] =
	{
	{ DBG_PACKET_VALUE , "packet" },
	{ DBG_MPI_VALUE , "mpi" },
	{ DBG_CRYPTO_VALUE , "crypto" },
	{ DBG_FILTER_VALUE , "filter" },
	{ DBG_IOBUF_VALUE , "iobuf" },
	{ DBG_MEMORY_VALUE , "memory" },
	{ DBG_CACHE_VALUE , "cache" },
	{ DBG_MEMSTAT_VALUE, "memstat" },
	{ DBG_TRUST_VALUE , "trust" },
	{ DBG_HASHING_VALUE, "hashing" },
	{ DBG_IPC_VALUE , "ipc" },
	{ DBG_CLOCK_VALUE , "clock" },
	{ DBG_LOOKUP_VALUE , "lookup" },
	{ DBG_EXTPROG_VALUE, "extprog" },
	{ 0, NULL }
	};


	int g10_errors_seen = 0;


	static char *
	make_libversion (const char libname, const char (getfnc)(const char))
	{
	const char *s;
	char *result;

	s = getfnc (NULL);
	result = xmalloc (strlen (libname) + 1 + strlen (s) + 1);
	strcpy (stpcpy (stpcpy (result, libname), " "), s);
	return result;
	}

	static const char *
	my_strusage( int level )
	{
	static char *ver_gcry;
	const char *p;

	switch (level)
	{
	case 9: p = "GPL-3.0-or-later"; break;
	case 11: p = "@GPG@v (GnuPG)";
	break;
	case 13: p = VERSION; break;
	case 14: p = GNUPG_DEF_COPYRIGHT_LINE; break;
	case 17: p = PRINTABLE_OS_NAME; break;
	case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;

	case 1:
	case 40: p = _("Usage: gpgv [options] [files] (-h for help)");
	break;
	case 41: p = _("Syntax: gpgv [options] [files]\n"
	"Check signatures against known trusted keys\n");
	break;

	case 20:
	if (!ver_gcry)
	ver_gcry = make_libversion ("libgcrypt", gcry_check_version);
	p = ver_gcry;
	break;


	default: p = NULL;
	}
	return p;
	}



	int
	main( int argc, char **argv )
	{
	gpgrt_argparse_t pargs;
	int rc=0;
	strlist_t sl;
	strlist_t nrings = NULL;
	ctrl_t ctrl;

	early_system_init ();
	gpgrt_set_strusage (my_strusage);
	log_set_prefix ("gpgv", GPGRT_LOG_WITH_PREFIX);

	/* Make sure that our subsystems are ready. */
	i18n_init();
	init_common_subsystems (&argc, &argv);

	gcry_control (GCRYCTL_DISABLE_SECMEM, 0);

	gnupg_init_signals (0, NULL);

	opt.command_fd = -1; /* no command fd */
	opt.keyserver_options.options \|= KEYSERVER_AUTO_KEY_RETRIEVE;
	opt.trust_model = TM_ALWAYS;
	opt.no_sig_cache = 1;
	opt.flags.require_cross_cert = 1;
	opt.batch = 1;
	opt.answer_yes = 1;

	opt.weak_digests = NULL;

	tty_no_terminal(1);
	tty_batchmode(1);
	dotlock_disable ();
	gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
	additional_weak_digest("MD5");
	gnupg_initialize_compliance (GNUPG_MODULE_NAME_GPG);

	pargs.argc = &argc;
	pargs.argv = &argv;
	pargs.flags= ARGPARSE_FLAG_KEEP;
	while (gpgrt_argparser (&pargs, opts, NULL))
	{
	switch (pargs.r_opt)
	{
	case ARGPARSE_CONFFILE: break;

	case oQuiet: opt.quiet = 1; break;
	case oVerbose:
	opt.verbose++;
	opt.list_sigs=1;
	gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
	break;
	case oDebug:
	if (parse_debug_flag (pargs.r.ret_str, &opt.debug, debug_flags))
	{
	pargs.r_opt = ARGPARSE_INVALID_ARG;
	pargs.err = ARGPARSE_PRINT_ERROR;
	}
	break;
	case oKeyring: append_to_strlist( &nrings, pargs.r.ret_str); break;
	case oOutput: opt.outfile = pargs.r.ret_str; break;
	case oStatusFD:
	set_status_fd (translate_sys2libc_fd_int (pargs.r.ret_int, 1));
	break;
	case oLoggerFD:
	log_set_fd (translate_sys2libc_fd_int (pargs.r.ret_int, 1));
	break;
	case oLoggerFile:
	log_set_file (pargs.r.ret_str);
	log_set_prefix (NULL, (GPGRT_LOG_WITH_PREFIX
	\| GPGRT_LOG_WITH_TIME
	\| GPGRT_LOG_WITH_PID) );
	break;
	case oHomedir: gnupg_set_homedir (pargs.r.ret_str); break;
	case oWeakDigest:
	additional_weak_digest(pargs.r.ret_str);
	break;
	case oIgnoreTimeConflict: opt.ignore_time_conflict = 1; break;
	case oEnableSpecialFilenames:
	enable_special_filenames ();
	break;
	default : pargs.err = ARGPARSE_PRINT_ERROR; break;
	}
	}

	gpgrt_argparse (NULL, &pargs, NULL); /* Release internal state. */

	if (log_get_errorcount (0))
	g10_exit(2);

	if (opt.verbose > 1)
	set_packet_list_mode(1);

	/* Note: We open all keyrings in read-only mode. */
	if (!nrings) /* No keyring given: use default one. */
	keydb_add_resource ("trustedkeys" EXTSEP_S "kbx",
	(KEYDB_RESOURCE_FLAG_READONLY
	\|KEYDB_RESOURCE_FLAG_GPGVDEF));
	for (sl = nrings; sl; sl = sl->next)
	keydb_add_resource (sl->d, KEYDB_RESOURCE_FLAG_READONLY);

	FREE_STRLIST (nrings);

	ctrl = xcalloc (1, sizeof *ctrl);

	if ((rc = verify_signatures (ctrl, argc, argv)))
	log_error("verify signatures failed: %s\n", gpg_strerror (rc) );

	keydb_release (ctrl->cached_getkey_kdb);
	xfree (ctrl);

	/* cleanup */
	g10_exit (0);
	return 8; /NOTREACHED/
	}


	void
	g10_exit( int rc )
	{
	rc = rc? rc : log_get_errorcount(0)? 2 : g10_errors_seen? 1 : 0;
	exit(rc );
	}


	/* Stub:
	* We have to override the trustcheck from pkclist.c because
	* this utility assumes that all keys in the keyring are trustworthy
	*/
	int
	check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
	{
	(void)ctrl;
	(void)sig;
	return 0;
	}

	void
	read_trust_options (ctrl_t ctrl,
	byte trust_model, ulong created, ulong *nextcheck,
	byte marginals, byte completes, byte *cert_depth,
	byte *min_cert_level)
	{
	(void)ctrl;
	(void)trust_model;
	(void)created;
	(void)nextcheck;
	(void)marginals;
	(void)completes;
	(void)cert_depth;
	(void)min_cert_level;
	}

	/* Stub:
	* We don't have the trustdb , so we have to provide some stub functions
	* instead
	*/

	int
	cache_disabled_value (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return 0;
	}

	void
	check_trustdb_stale (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	int
	get_validity_info (ctrl_t ctrl, kbnode_t kb, PKT_public_key *pk,
	PKT_user_id *uid)
	{
	(void)ctrl;
	(void)kb;
	(void)pk;
	(void)uid;
	return '?';
	}

	unsigned int
	get_validity (ctrl_t ctrl, kbnode_t kb, PKT_public_key pk, PKT_user_id uid,
	PKT_signature *sig, int may_ask)
	{
	(void)ctrl;
	(void)kb;
	(void)pk;
	(void)uid;
	(void)sig;
	(void)may_ask;
	return 0;
	}

	const char *
	trust_value_to_string (unsigned int value)
	{
	(void)value;
	return "err";
	}

	const char *
	uid_trust_string_fixed (ctrl_t ctrl, PKT_public_key key, PKT_user_id uid)
	{
	(void)ctrl;
	(void)key;
	(void)uid;
	return "err";
	}

	int
	get_ownertrust_info (ctrl_t ctrl, PKT_public_key *pk, int no_create)
	{
	(void)ctrl;
	(void)pk;
	(void)no_create;
	return '?';
	}

	unsigned int
	get_ownertrust (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return TRUST_UNKNOWN;
	}


	/* Stubs:
	* Because we only work with trusted keys, it does not make sense to
	* get them from a keyserver
	*/

	struct keyserver_spec *
	keyserver_match (struct keyserver_spec *spec)
	{
	(void)spec;
	return NULL;
	}

	int
	keyserver_any_configured (ctrl_t ctrl)
	{
	(void)ctrl;
	return 0;
	}

	int
	keyserver_import_keyid (u32 keyid, void dummy, int quick)
	{
	(void)keyid;
	(void)dummy;
	(void)quick;
	return -1;
	}

	int
	keyserver_import_fprint (ctrl_t ctrl, const byte *fprint,size_t fprint_len,
	struct keyserver_spec *keyserver, int quick)
	{
	(void)ctrl;
	(void)fprint;
	(void)fprint_len;
	(void)keyserver;
	(void)quick;
	return -1;
	}

	int
	keyserver_import_cert (const char *name)
	{
	(void)name;
	return -1;
	}

	int
	keyserver_import_pka (const char name,unsigned char fpr)
	{
	(void)name;
	(void)fpr;
	return -1;
	}

	gpg_error_t
	keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
	unsigned char *fpr, size_t fpr_len)
	{
	(void)ctrl;
	(void)name;
	(void)quick;
	(void)fpr;
	(void)fpr_len;
	return GPG_ERR_BUG;
	}

	int
	keyserver_import_name (const char name,struct keyserver_spec spec)
	{
	(void)name;
	(void)spec;
	return -1;
	}

	int
	keyserver_import_ldap (const char *name)
	{
	(void)name;
	return -1;
	}


	gpg_error_t
	-read_key_from_file (ctrl_t ctrl, const char fname, kbnode_t r_keyblock)
	+read_key_from_file_or_buffer (ctrl_t ctrl, const char *fname,
	+ const void *buffer, size_t buflen,
	+ kbnode_t *r_keyblock)
	{
	(void)ctrl;
	(void)fname;
	+ (void)buffer;
	+ (void)buflen;
	(void)r_keyblock;
	return -1;
	}

	+gpg_error_t
	+import_included_key_block (ctrl_t ctrl, kbnode_t keyblock)
	+{
	+ (void)ctrl;
	+ (void)keyblock;
	+ return -1;
	+}
	+

	/* Stub:
	* No encryption here but mainproc links to these functions.
	*/
	gpg_error_t
	get_session_key (ctrl_t ctrl, struct pubkey_enc_list k, DEK dek)
	{
	(void)ctrl;
	(void)k;
	(void)dek;
	return GPG_ERR_GENERAL;
	}

	/* Stub: */
	gpg_error_t
	get_override_session_key (DEK dek, const char string)
	{
	(void)dek;
	(void)string;
	return GPG_ERR_GENERAL;
	}

	/* Stub: */
	int
	decrypt_data (ctrl_t ctrl, void procctx, PKT_encrypted ed, DEK *dek)
	{
	(void)ctrl;
	(void)procctx;
	(void)ed;
	(void)dek;
	return GPG_ERR_GENERAL;
	}


	/* Stub:
	* No interactive commands, so we don't need the helptexts
	*/
	void
	display_online_help (const char *keyword)
	{
	(void)keyword;
	}

	/* Stub:
	* We don't use secret keys, but getkey.c links to this
	*/
	int
	check_secret_key (PKT_public_key *pk, int n)
	{
	(void)pk;
	(void)n;
	return GPG_ERR_GENERAL;
	}

	/* Stub:
	* No secret key, so no passphrase needed
	*/
	DEK *
	passphrase_to_dek (int cipher_algo, STRING2KEY *s2k, int create, int nocache,
	const char tmp, int canceled)
	{
	(void)cipher_algo;
	(void)s2k;
	(void)create;
	(void)nocache;
	(void)tmp;

	if (canceled)
	*canceled = 0;
	return NULL;
	}

	void
	passphrase_clear_cache (const char *cacheid)
	{
	(void)cacheid;
	}

	struct keyserver_spec *
	parse_preferred_keyserver(PKT_signature *sig)
	{
	(void)sig;
	return NULL;
	}

	struct keyserver_spec *
	parse_keyserver_uri (const char *uri, int require_scheme,
	const char *configname, unsigned int configlineno)
	{
	(void)uri;
	(void)require_scheme;
	(void)configname;
	(void)configlineno;
	return NULL;
	}

	void
	free_keyserver_spec (struct keyserver_spec *keyserver)
	{
	(void)keyserver;
	}

	/* Stubs to avoid linking to photoid.c */
	void
	show_photos (const struct user_attribute attrs, int count, PKT_public_key pk)
	{
	(void)attrs;
	(void)count;
	(void)pk;
	}

	int
	parse_image_header (const struct user_attribute attr, byte type, u32 *len)
	{
	(void)attr;
	(void)type;
	(void)len;
	return 0;
	}

	char *
	image_type_to_string (byte type, int string)
	{
	(void)type;
	(void)string;
	return NULL;
	}

	#ifdef ENABLE_CARD_SUPPORT
	int
	agent_scd_getattr (const char name, struct agent_card_info_s info)
	{
	(void)name;
	(void)info;
	return 0;
	}
	#endif /* ENABLE_CARD_SUPPORT */

	/* We do not do any locking, so use these stubs here */
	void
	dotlock_disable (void)
	{
	}

	dotlock_t
	dotlock_create (const char *file_to_lock, unsigned int flags)
	{
	(void)file_to_lock;
	(void)flags;
	return NULL;
	}

	void
	dotlock_destroy (dotlock_t h)
	{
	(void)h;
	}

	int
	dotlock_take (dotlock_t h, long timeout)
	{
	(void)h;
	(void)timeout;
	return 0;
	}

	int
	dotlock_release (dotlock_t h)
	{
	(void)h;
	return 0;
	}

	void
	dotlock_remove_lockfiles (void)
	{
	}

	int
	agent_probe_secret_key (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return 0;
	}

	gpg_error_t
	agent_probe_any_secret_key (ctrl_t ctrl, kbnode_t keyblock)
	{
	(void)ctrl;
	(void)keyblock;
	return gpg_error (GPG_ERR_NO_SECKEY);
	}

	gpg_error_t
	agent_get_keyinfo (ctrl_t ctrl, const char *hexkeygrip,
	char *r_serialno, int r_cleartext)
	{
	(void)ctrl;
	(void)hexkeygrip;
	(void)r_cleartext;
	*r_serialno = NULL;
	return gpg_error (GPG_ERR_NO_SECKEY);
	}

	gpg_error_t
	gpg_dirmngr_get_pka (ctrl_t ctrl, const char *userid,
	unsigned char *r_fpr, size_t r_fprlen,
	char **r_url)
	{
	(void)ctrl;
	(void)userid;
	if (r_fpr)
	*r_fpr = NULL;
	if (r_fprlen)
	*r_fprlen = 0;
	if (r_url)
	*r_url = NULL;
	return gpg_error (GPG_ERR_NOT_FOUND);
	}

	gpg_error_t
	export_pubkey_buffer (ctrl_t ctrl, const char *keyspec, unsigned int options,
	const void *prefix, size_t prefixlen,
	export_stats_t stats,
	kbnode_t r_keyblock, void r_data, size_t r_datalen)
	{
	(void)ctrl;
	(void)keyspec;
	(void)options;
	(void)prefix;
	(void)prefixlen;
	(void)stats;

	*r_keyblock = NULL;
	*r_data = NULL;
	*r_datalen = 0;
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	}

	gpg_error_t
	tofu_write_tfs_record (ctrl_t ctrl, estream_t fp,
	PKT_public_key pk, const char user_id)
	{
	(void)ctrl;
	(void)fp;
	(void)pk;
	(void)user_id;
	return gpg_error (GPG_ERR_GENERAL);
	}

	gpg_error_t
	tofu_get_policy (ctrl_t ctrl, PKT_public_key pk, PKT_user_id user_id,
	enum tofu_policy *policy)
	{
	(void)ctrl;
	(void)pk;
	(void)user_id;
	(void)policy;
	return gpg_error (GPG_ERR_GENERAL);
	}

	const char *
	tofu_policy_str (enum tofu_policy policy)
	{
	(void)policy;

	return "unknown";
	}

	void
	tofu_begin_batch_update (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	void
	tofu_end_batch_update (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	gpg_error_t
	tofu_notice_key_changed (ctrl_t ctrl, kbnode_t kb)
	{
	(void) ctrl;
	(void) kb;

	return 0;
	}


	int
	get_revocation_reason (PKT_signature sig, char *r_reason,
	char *r_comment, size_t r_commentlen)
	{
	(void)sig;
	(void)r_commentlen;

	if (r_reason)
	*r_reason = NULL;
	if (r_comment)
	*r_comment = NULL;
	return 0;
	}
	diff --git a/g10/import.c b/g10/import.c
	index 77c05c1f1..b7101a9bf 100644
	--- a/g10/import.c
	+++ b/g10/import.c
	@@ -1,4543 +1,4589 @@
	/* import.c - import a key into our key storage.
	* Copyright (C) 1998-2007, 2010-2011 Free Software Foundation, Inc.
	* Copyright (C) 2014, 2016, 2017, 2019 Werner Koch
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "../common/status.h"
	#include "keydb.h"
	#include "../common/util.h"
	#include "trustdb.h"
	#include "main.h"
	#include "../common/i18n.h"
	#include "../common/ttyio.h"
	#include "../common/recsel.h"
	#include "keyserver-internal.h"
	#include "call-agent.h"
	#include "../common/membuf.h"
	#include "../common/init.h"
	#include "../common/mbox-util.h"
	#include "key-check.h"
	#include "key-clean.h"


	struct import_stats_s
	{
	ulong count;
	ulong no_user_id;
	ulong imported;
	ulong n_uids;
	ulong n_sigs;
	ulong n_subk;
	ulong unchanged;
	ulong n_revoc;
	ulong secret_read;
	ulong secret_imported;
	ulong secret_dups;
	ulong skipped_new_keys;
	ulong not_imported;
	ulong n_sigs_cleaned;
	ulong n_uids_cleaned;
	ulong v3keys; /* Number of V3 keys seen. */
	};


	/* Node flag to indicate that a user ID or a subkey has a
	* valid self-signature. */
	#define NODE_GOOD_SELFSIG 1
	/* Node flag to indicate that a user ID or subkey has
	* an invalid self-signature. */
	#define NODE_BAD_SELFSIG 2
	/* Node flag to indicate that the node shall be deleted. */
	#define NODE_DELETION_MARK 4
	/* A node flag used to temporary mark a node. */
	#define NODE_FLAG_A 8
	/* A flag used by transfer_secret_keys. */
	#define NODE_TRANSFER_SECKEY 16


	/* An object and a global instance to store selectors created from
	* --import-filter keep-uid=EXPR.
	* --import-filter drop-sig=EXPR.
	*
	* FIXME: We should put this into the CTRL object but that requires a
	* lot more changes right now. For now we use save and restore
	* function to temporary change them.
	*/
	/* Definition of the import filters. */
	struct import_filter_s
	{
	recsel_expr_t keep_uid;
	recsel_expr_t drop_sig;
	};
	/* The current instance. */
	struct import_filter_s import_filter;


	static int import (ctrl_t ctrl,
	IOBUF inp, const char* fname, struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len, unsigned int options,
	import_screener_t screener, void *screener_arg,
	int origin, const char *url);
	static int read_block (IOBUF a, unsigned int options,
	PACKET *pending_pkt, kbnode_t ret_root, int *r_v3keys);
	static void revocation_present (ctrl_t ctrl, kbnode_t keyblock);
	static gpg_error_t import_one (ctrl_t ctrl,
	kbnode_t keyblock,
	struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options, int from_sk, int silent,
	import_screener_t screener, void *screener_arg,
	int origin, const char url, int r_valid);
	static gpg_error_t import_matching_seckeys (
	ctrl_t ctrl, kbnode_t seckeys,
	const byte *mainfpr, size_t mainfprlen,
	struct import_stats_s *stats, int batch);
	static gpg_error_t import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
	struct import_stats_s *stats, int batch,
	unsigned int options, int for_migration,
	import_screener_t screener, void *screener_arg,
	kbnode_t *r_secattic);
	static int import_revoke_cert (ctrl_t ctrl, kbnode_t node, unsigned int options,
	struct import_stats_s *stats);
	static int chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
	int *non_self);
	static int delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock,
	u32 *keyid, unsigned int options);
	static int any_uid_left (kbnode_t keyblock);
	static int remove_all_uids (kbnode_t *keyblock);
	static void remove_all_non_self_sigs (kbnode_t keyblock, u32 keyid);
	static int merge_blocks (ctrl_t ctrl, unsigned int options,
	kbnode_t keyblock_orig,
	kbnode_t keyblock, u32 *keyid,
	u32 curtime, int origin, const char *url,
	int n_uids, int n_sigs, int *n_subk );
	static gpg_error_t append_new_uid (unsigned int options,
	kbnode_t keyblock, kbnode_t node,
	u32 curtime, int origin, const char *url,
	int *n_sigs);
	static int append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs);
	static int merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs);
	static int merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs);



	static void
	release_import_filter (import_filter_t filt)
	{
	recsel_release (filt->keep_uid);
	filt->keep_uid = NULL;
	recsel_release (filt->drop_sig);
	filt->drop_sig = NULL;
	}

	static void
	cleanup_import_globals (void)
	{
	release_import_filter (&import_filter);
	}


	int
	parse_import_options(char str,unsigned int options,int noisy)
	{
	struct parse_options import_opts[]=
	{
	{"import-local-sigs",IMPORT_LOCAL_SIGS,NULL,
	N_("import signatures that are marked as local-only")},

	{"repair-pks-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,
	N_("repair damage from the pks keyserver during import")},

	{"keep-ownertrust", IMPORT_KEEP_OWNERTTRUST, NULL,
	N_("do not clear the ownertrust values during import")},

	{"fast-import",IMPORT_FAST,NULL,
	N_("do not update the trustdb after import")},

	{"import-show",IMPORT_SHOW,NULL,
	N_("show key during import")},

	{"merge-only",IMPORT_MERGE_ONLY,NULL,
	N_("only accept updates to existing keys")},

	{"import-clean",IMPORT_CLEAN,NULL,
	N_("remove unusable parts from key after import")},

	{"import-minimal",IMPORT_MINIMAL\|IMPORT_CLEAN,NULL,
	N_("remove as much as possible from key after import")},

	{"import-drop-uids", IMPORT_DROP_UIDS, NULL,
	N_("do not import user id or attribute packets")},

	{"self-sigs-only", IMPORT_SELF_SIGS_ONLY, NULL,
	N_("ignore key-signatures which are not self-signatures")},

	{"import-export", IMPORT_EXPORT, NULL,
	N_("run import filters and export key immediately")},

	{"restore", IMPORT_RESTORE, NULL,
	N_("assume the GnuPG key backup format")},
	{"import-restore", IMPORT_RESTORE, NULL, NULL},

	{"repair-keys", IMPORT_REPAIR_KEYS, NULL,
	N_("repair keys on import")},

	/* No description to avoid string change: Fixme for 2.3 */
	{"show-only", (IMPORT_SHOW \| IMPORT_DRY_RUN), NULL,
	NULL},

	/* Aliases for backward compatibility */
	{"allow-local-sigs",IMPORT_LOCAL_SIGS,NULL,NULL},
	{"repair-hkp-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,NULL},
	/* dummy */
	{"import-unusable-sigs",0,NULL,NULL},
	{"import-clean-sigs",0,NULL,NULL},
	{"import-clean-uids",0,NULL,NULL},
	{"convert-sk-to-pk",0, NULL,NULL}, /* Not anymore needed due to
	the new design. */
	{NULL,0,NULL,NULL}
	};
	int rc;

	rc = parse_options (str, options, import_opts, noisy);
	if (rc && (*options & IMPORT_RESTORE))
	{
	/* Alter other options we want or don't want for restore. */
	*options \|= (IMPORT_LOCAL_SIGS \| IMPORT_KEEP_OWNERTTRUST);
	*options &= ~(IMPORT_MINIMAL \| IMPORT_CLEAN
	\| IMPORT_REPAIR_PKS_SUBKEY_BUG
	\| IMPORT_MERGE_ONLY);
	}
	return rc;
	}


	/* Parse and set an import filter from string. STRING has the format
	* "NAME=EXPR" with NAME being the name of the filter. Spaces before
	* and after NAME are not allowed. If this function is all called
	* several times all expressions for the same NAME are concatenated.
	* Supported filter names are:
	*
	* - keep-uid :: If the expression evaluates to true for a certain
	* user ID packet, that packet and all it dependencies
	* will be imported. The expression may use these
	* variables:
	*
	* - uid :: The entire user ID.
	* - mbox :: The mail box part of the user ID.
	* - primary :: Evaluate to true for the primary user ID.
	*/
	gpg_error_t
	parse_and_set_import_filter (const char *string)
	{
	gpg_error_t err;

	/* Auto register the cleanup function. */
	register_mem_cleanup_func (cleanup_import_globals);

	if (!strncmp (string, "keep-uid=", 9))
	err = recsel_parse_expr (&import_filter.keep_uid, string+9);
	else if (!strncmp (string, "drop-sig=", 9))
	err = recsel_parse_expr (&import_filter.drop_sig, string+9);
	else
	err = gpg_error (GPG_ERR_INV_NAME);

	return err;
	}


	/* Save the current import filters, return them, and clear the current
	* filters. Returns NULL on error and sets ERRNO. */
	import_filter_t
	save_and_clear_import_filter (void)
	{
	import_filter_t filt;

	filt = xtrycalloc (1, sizeof *filt);
	if (!filt)
	return NULL;
	*filt = import_filter;
	memset (&import_filter, 0, sizeof import_filter);

	return filt;
	}


	/* Release the current import filters and restore them from NEWFILT.
	* Ownership of NEWFILT is moved to this function. */
	void
	restore_import_filter (import_filter_t filt)
	{
	if (filt)
	{
	release_import_filter (&import_filter);
	import_filter = *filt;
	xfree (filt);
	}
	}


	import_stats_t
	import_new_stats_handle (void)
	{
	return xmalloc_clear ( sizeof (struct import_stats_s) );
	}


	void
	import_release_stats_handle (import_stats_t p)
	{
	xfree (p);
	}


	/* Read a key from a file. Only the first key in the file is
	* considered and stored at R_KEYBLOCK. FNAME is the name of the
	* file.
	*/
	gpg_error_t
	-read_key_from_file (ctrl_t ctrl, const char fname, kbnode_t r_keyblock)
	+read_key_from_file_or_buffer (ctrl_t ctrl, const char *fname,
	+ const void *buffer, size_t buflen,
	+ kbnode_t *r_keyblock)
	{
	gpg_error_t err;
	iobuf_t inp;
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL;
	u32 keyid[2];
	int v3keys; /* Dummy */
	int non_self; /* Dummy */

	(void)ctrl;

	*r_keyblock = NULL;

	- inp = iobuf_open (fname);
	- if (!inp)
	- err = gpg_error_from_syserror ();
	- else if (is_secured_file (iobuf_get_fd (inp)))
	+ log_assert (!!fname ^ !!buffer);
	+
	+ if (fname)
	{
	- iobuf_close (inp);
	- inp = NULL;
	- err = gpg_error (GPG_ERR_EPERM);
	+ inp = iobuf_open (fname);
	+ if (!inp)
	+ err = gpg_error_from_syserror ();
	+ else if (is_secured_file (iobuf_get_fd (inp)))
	+ {
	+ iobuf_close (inp);
	+ inp = NULL;
	+ err = gpg_error (GPG_ERR_EPERM);
	+ }
	+ else
	+ err = 0;
	+ if (err)
	+ {
	+ log_error (_("can't open '%s': %s\n"),
	+ iobuf_is_pipe_filename (fname)? "[stdin]": fname,
	+ gpg_strerror (err));
	+ if (gpg_err_code (err) == GPG_ERR_ENOENT)
	+ err = gpg_error (GPG_ERR_NO_PUBKEY);
	+ goto leave;
	+ }
	+
	+ /* Push the armor filter. */
	+ {
	+ armor_filter_context_t *afx;
	+ afx = new_armor_context ();
	+ afx->only_keyblocks = 1;
	+ push_armor_filter (afx, inp);
	+ release_armor_context (afx);
	+ }
	+
	}
	- else
	- err = 0;
	- if (err)
	+ else /* Read from buffer (No armor expected). */
	{
	- log_error (_("can't open '%s': %s\n"),
	- iobuf_is_pipe_filename (fname)? "[stdin]": fname,
	- gpg_strerror (err));
	- if (gpg_err_code (err) == GPG_ERR_ENOENT)
	- err = gpg_error (GPG_ERR_NO_PUBKEY);
	- goto leave;
	+ inp = iobuf_temp_with_content (buffer, buflen);
	}

	- /* Push the armor filter. */
	- {
	- armor_filter_context_t *afx;
	- afx = new_armor_context ();
	- afx->only_keyblocks = 1;
	- push_armor_filter (afx, inp);
	- release_armor_context (afx);
	- }
	-
	/* Read the first non-v3 keyblock. */
	while (!(err = read_block (inp, 0, &pending_pkt, &keyblock, &v3keys)))
	{
	if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	break;
	log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);
	release_kbnode (keyblock);
	keyblock = NULL;
	}
	if (err)
	{
	if (gpg_err_code (err) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"),
	- iobuf_is_pipe_filename (fname)? "[stdin]": fname,
	+ fname? (iobuf_is_pipe_filename (fname)? "[stdin]": fname)
	+ /* */ : "[buffer]",
	gpg_strerror (err));
	goto leave;
	}

	keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);

	if (!find_next_kbnode (keyblock, PKT_USER_ID))
	{
	err = gpg_error (GPG_ERR_NO_USER_ID);
	goto leave;
	}

	collapse_uids (&keyblock);

	clear_kbnode_flags (keyblock);
	if (chk_self_sigs (ctrl, keyblock, keyid, &non_self))
	{
	err = gpg_error (GPG_ERR_INV_KEYRING);
	goto leave;
	}

	if (!delete_inv_parts (ctrl, keyblock, keyid, 0) )
	{
	err = gpg_error (GPG_ERR_NO_USER_ID);
	goto leave;
	}

	*r_keyblock = keyblock;
	keyblock = NULL;

	leave:
	if (inp)
	{
	iobuf_close (inp);
	/* Must invalidate that ugly cache to actually close the file. */
	- iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	+ if (fname)
	+ iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	}
	release_kbnode (keyblock);
	/* FIXME: Do we need to free PENDING_PKT ? */
	return err;
	}


	+/* Import an already checked public key which was included in a
	+ * signature and the signature verified out using this key. */
	+gpg_error_t
	+import_included_key_block (ctrl_t ctrl, kbnode_t keyblock)
	+{
	+ gpg_error_t err;
	+ struct import_stats_s *stats;
	+ import_filter_t save_filt;
	+ int save_armor = opt.armor;
	+
	+ opt.armor = 0;
	+ stats = import_new_stats_handle ();
	+ save_filt = save_and_clear_import_filter ();
	+ if (!save_filt)
	+ {
	+ err = gpg_error_from_syserror ();
	+ goto leave;
	+ }
	+
	+ /* FIXME: Should we introduce a dedicated KEYORG ? */
	+ err = import_one (ctrl, keyblock,
	+ stats, NULL, 0, 0, 0, 0,
	+ NULL, NULL, KEYORG_UNKNOWN, NULL, NULL);
	+
	+ leave:
	+ restore_import_filter (save_filt);
	+ import_release_stats_handle (stats);
	+ opt.armor = save_armor;
	+ return err;
	+}
	+
	+

	/*
	* Import the public keys from the given filename. Input may be armored.
	* This function rejects all keys which are not validly self signed on at
	* least one userid. Only user ids which are self signed will be imported.
	* Other signatures are not checked.
	*
	* Actually this function does a merge. It works like this:
	*
	* - get the keyblock
	* - check self-signatures and remove all userids and their signatures
	* without/invalid self-signatures.
	* - reject the keyblock, if we have no valid userid.
	* - See whether we have this key already in one of our pubrings.
	* If not, simply add it to the default keyring.
	* - Compare the key and the self-signatures of the new and the one in
	* our keyring. If they are different something weird is going on;
	* ask what to do.
	* - See whether we have only non-self-signature on one user id; if not
	* ask the user what to do.
	* - compare the signatures: If we already have this signature, check
	* that they compare okay; if not, issue a warning and ask the user.
	* (consider looking at the timestamp and use the newest?)
	* - Simply add the signature. Can't verify here because we may not have
	* the signature's public key yet; verification is done when putting it
	* into the trustdb, which is done automagically as soon as this pubkey
	* is used.
	* - Proceed with next signature.
	*
	* Key revocation certificates have special handling.
	*/
	static gpg_error_t
	import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
	import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options,
	import_screener_t screener, void *screener_arg,
	int origin, const char *url)
	{
	int i;
	gpg_error_t err = 0;
	struct import_stats_s *stats = stats_handle;

	if (!stats)
	stats = import_new_stats_handle ();

	if (inp)
	{
	err = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options,
	screener, screener_arg, origin, url);
	}
	else
	{
	if (!fnames && !nnames)
	nnames = 1; /* Ohh what a ugly hack to jump into the loop */

	for (i=0; i < nnames; i++)
	{
	const char *fname = fnames? fnames[i] : NULL;
	IOBUF inp2 = iobuf_open(fname);

	if (!fname)
	fname = "[stdin]";
	if (inp2 && is_secured_file (iobuf_get_fd (inp2)))
	{
	iobuf_close (inp2);
	inp2 = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp2)
	log_error (_("can't open '%s': %s\n"), fname, strerror (errno));
	else
	{
	err = import (ctrl, inp2, fname, stats, fpr, fpr_len, options,
	screener, screener_arg, origin, url);
	iobuf_close (inp2);
	/* Must invalidate that ugly cache to actually close it. */
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
	if (err)
	log_error ("import from '%s' failed: %s\n",
	fname, gpg_strerror (err) );
	}
	if (!fname)
	break;
	}
	}

	if (!stats_handle)
	{
	if ((options & (IMPORT_SHOW \| IMPORT_DRY_RUN))
	!= (IMPORT_SHOW \| IMPORT_DRY_RUN))
	import_print_stats (stats);
	import_release_stats_handle (stats);
	}

	/* If no fast import and the trustdb is dirty (i.e. we added a key
	or userID that had something other than a selfsig, a signature
	that was other than a selfsig, or any revocation), then
	update/check the trustdb if the user specified by setting
	interactive or by not setting no-auto-check-trustdb */

	if (!(options & IMPORT_FAST))
	check_or_update_trustdb (ctrl);

	return err;
	}


	void
	import_keys (ctrl_t ctrl, char **fnames, int nnames,
	import_stats_t stats_handle, unsigned int options,
	int origin, const char *url)
	{
	import_keys_internal (ctrl, NULL, fnames, nnames, stats_handle,
	NULL, NULL, options, NULL, NULL, origin, url);
	}


	gpg_error_t
	import_keys_es_stream (ctrl_t ctrl, estream_t fp,
	import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options,
	import_screener_t screener, void *screener_arg,
	int origin, const char *url)
	{
	gpg_error_t err;
	iobuf_t inp;

	inp = iobuf_esopen (fp, "rb", 1, 0);
	if (!inp)
	{
	err = gpg_error_from_syserror ();
	log_error ("iobuf_esopen failed: %s\n", gpg_strerror (err));
	return err;
	}

	err = import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
	fpr, fpr_len, options,
	screener, screener_arg, origin, url);

	iobuf_close (inp);
	return err;
	}


	static int
	import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
	unsigned char *fpr,size_t fpr_len, unsigned int options,
	import_screener_t screener, void *screener_arg,
	int origin, const char *url)
	{
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL; /* Need to initialize because gcc can't
	grasp the return semantics of
	read_block. */
	kbnode_t secattic = NULL; /* Kludge for PGP desktop percularity */
	int rc = 0;
	int v3keys;

	getkey_disable_caches ();

	if (!opt.no_armor) /* Armored reading is not disabled. */
	{
	armor_filter_context_t *afx;

	afx = new_armor_context ();
	afx->only_keyblocks = 1;
	push_armor_filter (afx, inp);
	release_armor_context (afx);
	}

	while (!(rc = read_block (inp, options, &pending_pkt, &keyblock, &v3keys)))
	{
	stats->v3keys += v3keys;
	if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	rc = import_one (ctrl, keyblock,
	stats, fpr, fpr_len, options, 0, 0,
	screener, screener_arg, origin, url, NULL);
	if (secattic)
	{
	byte tmpfpr[MAX_FINGERPRINT_LEN];
	size_t tmpfprlen;

	if (!rc && !(opt.dry_run \|\| (options & IMPORT_DRY_RUN)))
	{
	/* Kudge for PGP desktop - see below. */
	fingerprint_from_pk (keyblock->pkt->pkt.public_key,
	tmpfpr, &tmpfprlen);
	rc = import_matching_seckeys (ctrl, secattic,
	tmpfpr, tmpfprlen,
	stats, opt.batch);
	}
	release_kbnode (secattic);
	secattic = NULL;
	}
	}
	else if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	release_kbnode (secattic);
	secattic = NULL;
	rc = import_secret_one (ctrl, keyblock, stats,
	opt.batch, options, 0,
	screener, screener_arg, &secattic);
	keyblock = NULL; /* Ownership was transferred. */
	if (secattic)
	{
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	rc = 0; /* Try import after the next pubkey. */

	/* The attic is a workaround for the peculiar PGP
	* Desktop method of exporting a secret key: The
	* exported file is the concatenation of two armored
	* keyblocks; first the private one and then the public
	* one. The strange thing is that the secret one has no
	* binding signatures at all and thus we have not
	* imported it. The attic stores that secret keys and
	* we try to import it once after the very next public
	* keyblock. */
	}
	}
	else if (keyblock->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (keyblock->pkt->pkt.signature) )
	{
	release_kbnode (secattic);
	secattic = NULL;
	rc = import_revoke_cert (ctrl, keyblock, options, stats);
	}
	else
	{
	release_kbnode (secattic);
	secattic = NULL;
	log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype);
	}
	release_kbnode (keyblock);

	/* fixme: we should increment the not imported counter but
	this does only make sense if we keep on going despite of
	errors. For now we do this only if the imported key is too
	large. */
	if (gpg_err_code (rc) == GPG_ERR_TOO_LARGE
	&& gpg_err_source (rc) == GPG_ERR_SOURCE_KEYBOX)
	{
	stats->not_imported++;
	}
	else if (rc)
	break;

	if (!(++stats->count % 100) && !opt.quiet)
	log_info (_("%lu keys processed so far\n"), stats->count );

	if (origin == KEYORG_WKD && stats->count >= 5)
	{
	/* We limit the number of keys _received_ from the WKD to 5.
	* In fact there should be only one key but some sites want
	* to store a few expired keys there also. gpg's key
	* selection will later figure out which key to use. Note
	* that for WKD we always return the fingerprint of the
	* first imported key. */
	log_info ("import from WKD stopped after %d keys\n", 5);
	break;
	}
	}
	stats->v3keys += v3keys;
	if (rc == -1)
	rc = 0;
	else if (rc && gpg_err_code (rc) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (rc));

	release_kbnode (secattic);

	/* When read_block loop was stopped by error, we have PENDING_PKT left. */
	if (pending_pkt)
	{
	free_packet (pending_pkt, NULL);
	xfree (pending_pkt);
	}
	return rc;
	}


	/* Helper to migrate secring.gpg to GnuPG 2.1. */
	gpg_error_t
	import_old_secring (ctrl_t ctrl, const char *fname)
	{
	gpg_error_t err;
	iobuf_t inp;
	PACKET *pending_pkt = NULL;
	kbnode_t keyblock = NULL; /* Need to initialize because gcc can't
	grasp the return semantics of
	read_block. */
	struct import_stats_s *stats;
	int v3keys;

	inp = iobuf_open (fname);
	if (inp && is_secured_file (iobuf_get_fd (inp)))
	{
	iobuf_close (inp);
	inp = NULL;
	gpg_err_set_errno (EPERM);
	}
	if (!inp)
	{
	err = gpg_error_from_syserror ();
	log_error (_("can't open '%s': %s\n"), fname, gpg_strerror (err));
	return err;
	}

	getkey_disable_caches();
	stats = import_new_stats_handle ();
	while (!(err = read_block (inp, 0, &pending_pkt, &keyblock, &v3keys)))
	{
	if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	err = import_secret_one (ctrl, keyblock, stats, 1, 0, 1,
	NULL, NULL, NULL);
	keyblock = NULL; /* Ownership was transferred. */
	}
	release_kbnode (keyblock);
	if (err)
	break;
	}
	import_release_stats_handle (stats);
	if (err == -1)
	err = 0;
	else if (err && gpg_err_code (err) != GPG_ERR_INV_KEYRING)
	log_error (_("error reading '%s': %s\n"), fname, gpg_strerror (err));
	else if (err)
	log_error ("import from '%s' failed: %s\n", fname, gpg_strerror (err));

	iobuf_close (inp);
	iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);

	return err;
	}


	void
	import_print_stats (import_stats_t stats)
	{
	if (!opt.quiet)
	{
	log_info(_("Total number processed: %lu\n"),
	stats->count + stats->v3keys);
	if (stats->v3keys)
	log_info(_(" skipped PGP-2 keys: %lu\n"), stats->v3keys);
	if (stats->skipped_new_keys )
	log_info(_(" skipped new keys: %lu\n"),
	stats->skipped_new_keys );
	if (stats->no_user_id )
	log_info(_(" w/o user IDs: %lu\n"), stats->no_user_id );
	if (stats->imported)
	{
	log_info(_(" imported: %lu"), stats->imported );
	log_printf ("\n");
	}
	if (stats->unchanged )
	log_info(_(" unchanged: %lu\n"), stats->unchanged );
	if (stats->n_uids )
	log_info(_(" new user IDs: %lu\n"), stats->n_uids );
	if (stats->n_subk )
	log_info(_(" new subkeys: %lu\n"), stats->n_subk );
	if (stats->n_sigs )
	log_info(_(" new signatures: %lu\n"), stats->n_sigs );
	if (stats->n_revoc )
	log_info(_(" new key revocations: %lu\n"), stats->n_revoc );
	if (stats->secret_read )
	log_info(_(" secret keys read: %lu\n"), stats->secret_read );
	if (stats->secret_imported )
	log_info(_(" secret keys imported: %lu\n"), stats->secret_imported );
	if (stats->secret_dups )
	log_info(_(" secret keys unchanged: %lu\n"), stats->secret_dups );
	if (stats->not_imported )
	log_info(_(" not imported: %lu\n"), stats->not_imported );
	if (stats->n_sigs_cleaned)
	log_info(_(" signatures cleaned: %lu\n"),stats->n_sigs_cleaned);
	if (stats->n_uids_cleaned)
	log_info(_(" user IDs cleaned: %lu\n"),stats->n_uids_cleaned);
	}

	if (is_status_enabled ())
	{
	char buf[15*20];

	snprintf (buf, sizeof buf,
	"%lu %lu %lu 0 %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu",
	stats->count + stats->v3keys,
	stats->no_user_id,
	stats->imported,
	stats->unchanged,
	stats->n_uids,
	stats->n_subk,
	stats->n_sigs,
	stats->n_revoc,
	stats->secret_read,
	stats->secret_imported,
	stats->secret_dups,
	stats->skipped_new_keys,
	stats->not_imported,
	stats->v3keys );
	write_status_text (STATUS_IMPORT_RES, buf);
	}
	}


	/* Return true if PKTTYPE is valid in a keyblock. */
	static int
	valid_keyblock_packet (int pkttype)
	{
	switch (pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	case PKT_SIGNATURE:
	case PKT_USER_ID:
	case PKT_ATTRIBUTE:
	case PKT_RING_TRUST:
	return 1;
	default:
	return 0;
	}
	}


	/* Read the next keyblock from stream A. Meta data (ring trust
	* packets) are only considered if OPTIONS has the IMPORT_RESTORE flag
	* set. PENDING_PKT should be initialized to NULL and not changed by
	* the caller.
	*
	* Returns 0 for okay, -1 no more blocks, or any other errorcode. The
	* integer at R_V3KEY counts the number of unsupported v3 keyblocks.
	*/
	static int
	read_block( IOBUF a, unsigned int options,
	PACKET *pending_pkt, kbnode_t ret_root, int *r_v3keys)
	{
	int rc;
	struct parse_packet_ctx_s parsectx;
	PACKET *pkt;
	kbnode_t root = NULL;
	kbnode_t lastnode = NULL;
	int in_cert, in_v3key, skip_sigs;
	u32 keyid[2];
	int got_keyid = 0;
	unsigned int dropped_nonselfsigs = 0;

	*r_v3keys = 0;

	if (*pending_pkt)
	{
	root = lastnode = new_kbnode( *pending_pkt );
	*pending_pkt = NULL;
	log_assert (root->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| root->pkt->pkttype == PKT_SECRET_KEY);
	in_cert = 1;
	keyid_from_pk (root->pkt->pkt.public_key, keyid);
	got_keyid = 1;
	}
	else
	in_cert = 0;

	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	init_parse_packet (&parsectx, a);
	if (!(options & IMPORT_RESTORE))
	parsectx.skip_meta = 1;
	in_v3key = 0;
	skip_sigs = 0;
	while ((rc=parse_packet (&parsectx, pkt)) != -1)
	{
	if (rc && (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY
	&& (pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY)))
	{
	in_v3key = 1;
	++*r_v3keys;
	free_packet (pkt, &parsectx);
	init_packet (pkt);
	continue;
	}
	else if (rc ) /* (ignore errors) */
	{
	skip_sigs = 0;
	if (gpg_err_code (rc) == GPG_ERR_UNKNOWN_PACKET)
	; /* Do not show a diagnostic. */
	else if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
	&& (pkt->pkttype == PKT_USER_ID
	\|\| pkt->pkttype == PKT_ATTRIBUTE))
	{
	/* This indicates a too large user id or attribute
	* packet. We skip this packet and all following
	* signatures. Sure, this won't allow to repair a
	* garbled keyring in case one of the signatures belong
	* to another user id. However, this better mitigates
	* DoS using inserted user ids. */
	skip_sigs = 1;
	}
	else if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
	&& (pkt->pkttype == PKT_OLD_COMMENT
	\|\| pkt->pkttype == PKT_COMMENT))
	; /* Ignore too large comment packets. */
	else
	{
	log_error("read_block: read error: %s\n", gpg_strerror (rc) );
	rc = GPG_ERR_INV_KEYRING;
	goto ready;
	}
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	continue;
	}

	if (skip_sigs)
	{
	if (pkt->pkttype == PKT_SIGNATURE)
	{
	free_packet (pkt, &parsectx);
	init_packet (pkt);
	continue;
	}
	skip_sigs = 0;
	}

	if (in_v3key && !(pkt->pkttype == PKT_PUBLIC_KEY
	\|\| pkt->pkttype == PKT_SECRET_KEY))
	{
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	continue;
	}
	in_v3key = 0;

	if (!root && pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (pkt->pkt.signature) )
	{
	/* This is a revocation certificate which is handled in a
	* special way. */
	root = new_kbnode( pkt );
	pkt = NULL;
	goto ready;
	}

	/* Make a linked list of all packets. */
	switch (pkt->pkttype)
	{
	case PKT_COMPRESSED:
	if (check_compress_algo (pkt->pkt.compressed->algorithm))
	{
	rc = GPG_ERR_COMPR_ALGO;
	goto ready;
	}
	else
	{
	compress_filter_context_t cfx = xmalloc_clear( sizeof cfx );
	pkt->pkt.compressed->buf = NULL;
	if (push_compress_filter2 (a, cfx,
	pkt->pkt.compressed->algorithm, 1))
	xfree (cfx); /* e.g. in case of compression_algo NONE. */
	}
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	break;

	case PKT_RING_TRUST:
	/* Skip those packets unless we are in restore mode. */
	if ((opt.import_options & IMPORT_RESTORE))
	goto x_default;
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	break;

	case PKT_SIGNATURE:
	if (!in_cert)
	goto x_default;
	if (!(options & IMPORT_SELF_SIGS_ONLY))
	goto x_default;
	log_assert (got_keyid);
	if (pkt->pkt.signature->keyid[0] == keyid[0]
	&& pkt->pkt.signature->keyid[1] == keyid[1])
	{ /* This is likely a self-signature. We import this one.
	* Eventually we should use the ISSUER_FPR to compare
	* self-signatures, but that will work only for v5 keys
	* which are currently not even deployed.
	* Note that we do not do any crypto verify here because
	* that would defeat this very mitigation of DoS by
	* importing a key with a huge amount of faked
	* key-signatures. A verification will be done later in
	* the processing anyway. Here we want a cheap an early
	* way to drop non-self-signatures. */
	goto x_default;
	}
	/* Skip this signature. */
	dropped_nonselfsigs++;
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	break;

	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	if (!got_keyid)
	{
	keyid_from_pk (pkt->pkt.public_key, keyid);
	got_keyid = 1;
	}
	if (in_cert) /* Store this packet. */
	{
	*pending_pkt = pkt;
	pkt = NULL;
	goto ready;
	}
	in_cert = 1;
	goto x_default;

	default:
	x_default:
	if (in_cert && valid_keyblock_packet (pkt->pkttype))
	{
	if (!root )
	root = lastnode = new_kbnode (pkt);
	else
	{
	lastnode->next = new_kbnode (pkt);
	lastnode = lastnode->next;
	}
	pkt = xmalloc (sizeof *pkt);
	}
	else
	free_packet (pkt, &parsectx);
	init_packet(pkt);
	break;
	}
	}

	ready:
	if (rc == -1 && root )
	rc = 0;

	if (rc )
	release_kbnode( root );
	else
	*ret_root = root;
	free_packet (pkt, &parsectx);
	deinit_parse_packet (&parsectx);
	xfree( pkt );
	if (!rc && dropped_nonselfsigs && opt.verbose)
	log_info ("key %s: number of dropped non-self-signatures: %u\n",
	keystr (keyid), dropped_nonselfsigs);

	return rc;
	}


	/* Walk through the subkeys on a pk to find if we have the PKS
	disease: multiple subkeys with their binding sigs stripped, and the
	sig for the first subkey placed after the last subkey. That is,
	instead of "pk uid sig sub1 bind1 sub2 bind2 sub3 bind3" we have
	"pk uid sig sub1 sub2 sub3 bind1". We can't do anything about sub2
	and sub3, as they are already lost, but we can try and rescue sub1
	by reordering the keyblock so that it reads "pk uid sig sub1 bind1
	sub2 sub3". Returns TRUE if the keyblock was modified. */
	static int
	fix_pks_corruption (ctrl_t ctrl, kbnode_t keyblock)
	{
	int changed = 0;
	int keycount = 0;
	kbnode_t node;
	kbnode_t last = NULL;
	kbnode_t sknode=NULL;

	/* First determine if we have the problem at all. Look for 2 or
	more subkeys in a row, followed by a single binding sig. */
	for (node=keyblock; node; last=node, node=node->next)
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	keycount++;
	if(!sknode)
	sknode=node;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_SUBKEY_SIG (node->pkt->pkt.signature)
	&& keycount >= 2
	&& !node->next)
	{
	/* We might have the problem, as this key has two subkeys in
	a row without any intervening packets. */

	/* Sanity check */
	if (!last)
	break;

	/* Temporarily attach node to sknode. */
	node->next = sknode->next;
	sknode->next = node;
	last->next = NULL;

	/* Note we aren't checking whether this binding sig is a
	selfsig. This is not necessary here as the subkey and
	binding sig will be rejected later if that is the
	case. */
	if (check_key_signature (ctrl, keyblock,node,NULL))
	{
	/* Not a match, so undo the changes. */
	sknode->next = node->next;
	last->next = node;
	node->next = NULL;
	break;
	}
	else
	{
	/* Mark it good so we don't need to check it again */
	sknode->flag \|= NODE_GOOD_SELFSIG;
	changed = 1;
	break;
	}
	}
	else
	keycount = 0;
	}

	return changed;
	}


	/* Versions of GnuPG before 1.4.11 and 2.0.16 allowed to import bogus
	direct key signatures. A side effect of this was that a later
	import of the same good direct key signatures was not possible
	because the cmp_signature check in merge_blocks considered them
	equal. Although direct key signatures are now checked during
	import, there might still be bogus signatures sitting in a keyring.
	We need to detect and delete them before doing a merge. This
	function returns the number of removed sigs. */
	static int
	fix_bad_direct_key_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid)
	{
	gpg_error_t err;
	kbnode_t node;
	int count = 0;

	for (node = keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	break;
	if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_SIG (node->pkt->pkt.signature))
	{
	err = check_key_signature (ctrl, keyblock, node, NULL);
	if (err && gpg_err_code (err) != GPG_ERR_PUBKEY_ALGO )
	{
	/* If we don't know the error, we can't decide; this is
	not a problem because cmp_signature can't compare the
	signature either. */
	log_info ("key %s: invalid direct key signature removed\n",
	keystr (keyid));
	delete_kbnode (node);
	count++;
	}
	}
	}

	return count;
	}


	static void
	print_import_ok (PKT_public_key *pk, unsigned int reason)
	{
	byte array[MAX_FINGERPRINT_LEN], *s;
	char buf[MAX_FINGERPRINT_LEN2+30], p;
	size_t i, n;

	snprintf (buf, sizeof buf, "%u ", reason);
	p = buf + strlen (buf);

	fingerprint_from_pk (pk, array, &n);
	s = array;
	for (i=0; i < n ; i++, s++, p += 2)
	sprintf (p, "%02X", *s);

	write_status_text (STATUS_IMPORT_OK, buf);
	}


	static void
	print_import_check (PKT_public_key * pk, PKT_user_id * id)
	{
	byte hexfpr[2*MAX_FINGERPRINT_LEN+1];
	u32 keyid[2];

	keyid_from_pk (pk, keyid);
	hexfingerprint (pk, hexfpr, sizeof hexfpr);
	write_status_printf (STATUS_IMPORT_CHECK, "%08X%08X %s %s",
	keyid[0], keyid[1], hexfpr, id->name);

	}


	static void
	check_prefs_warning(PKT_public_key *pk)
	{
	log_info(_("WARNING: key %s contains preferences for unavailable\n"
	"algorithms on these user IDs:\n"), keystr_from_pk(pk));
	}


	static void
	check_prefs (ctrl_t ctrl, kbnode_t keyblock)
	{
	kbnode_t node;
	PKT_public_key *pk;
	int problem=0;

	merge_keys_and_selfsig (ctrl, keyblock);
	pk=keyblock->pkt->pkt.public_key;

	for(node=keyblock;node;node=node->next)
	{
	if(node->pkt->pkttype==PKT_USER_ID
	&& node->pkt->pkt.user_id->created
	&& node->pkt->pkt.user_id->prefs)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;
	prefitem_t *prefs = uid->prefs;
	char *user = utf8_to_native(uid->name,strlen(uid->name),0);

	for(;prefs->type;prefs++)
	{
	char num[10]; /* prefs->value is a byte, so we're over
	safe here */

	sprintf(num,"%u",prefs->value);

	if(prefs->type==PREFTYPE_SYM)
	{
	if (openpgp_cipher_test_algo (prefs->value))
	{
	const char *algo =
	(openpgp_cipher_test_algo (prefs->value)
	? num
	: openpgp_cipher_algo_name (prefs->value));
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for cipher"
	" algorithm %s\n"), user, algo);
	problem=1;
	}
	}
	else if(prefs->type==PREFTYPE_AEAD)
	{
	if (openpgp_aead_test_algo (prefs->value))
	{
	/* FIXME: The test below is wrong. We should
	* check if ...algo_name yields a "?" and
	* only in that case use NUM. */
	const char *algo =
	(openpgp_aead_test_algo (prefs->value)
	? num
	: openpgp_aead_algo_name (prefs->value));
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for AEAD"
	" algorithm %s\n"), user, algo);
	problem=1;
	}
	}
	else if(prefs->type==PREFTYPE_HASH)
	{
	if(openpgp_md_test_algo(prefs->value))
	{
	const char *algo =
	(gcry_md_test_algo (prefs->value)
	? num
	: gcry_md_algo_name (prefs->value));
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for digest"
	" algorithm %s\n"), user, algo);
	problem=1;
	}
	}
	else if(prefs->type==PREFTYPE_ZIP)
	{
	if(check_compress_algo (prefs->value))
	{
	const char *algo=compress_algo_to_string(prefs->value);
	if(!problem)
	check_prefs_warning(pk);
	log_info(_(" \"%s\": preference for compression"
	" algorithm %s\n"),user,algo?algo:num);
	problem=1;
	}
	}
	}

	xfree(user);
	}
	}

	if(problem)
	{
	log_info(_("it is strongly suggested that you update"
	" your preferences and\n"));
	log_info(_("re-distribute this key to avoid potential algorithm"
	" mismatch problems\n"));

	if(!opt.batch)
	{
	strlist_t sl = NULL;
	strlist_t locusr = NULL;
	size_t fprlen=0;
	byte fpr[MAX_FINGERPRINT_LEN], *p;
	char username[(MAX_FINGERPRINT_LEN*2)+1];
	unsigned int i;

	p = fingerprint_from_pk (pk,fpr,&fprlen);
	for(i=0;i<fprlen;i++,p++)
	sprintf(username+2i,"%02X",p);
	add_to_strlist(&locusr,username);

	append_to_strlist(&sl,"updpref");
	append_to_strlist(&sl,"save");

	keyedit_menu (ctrl, username, locusr, sl, 1, 1 );
	free_strlist(sl);
	free_strlist(locusr);
	}
	else if(!opt.quiet)
	log_info(_("you can update your preferences with:"
	" gpg --edit-key %s updpref save\n"),keystr_from_pk(pk));
	}
	}


	/* Helper for apply__filter in import.c and export.c. /
	const char *
	impex_filter_getval (void cookie, const char propname)
	{
	/* FIXME: Malloc our static buffers and access them via PARM. */
	struct impex_filter_parm_s *parm = cookie;
	ctrl_t ctrl = parm->ctrl;
	kbnode_t node = parm->node;
	static char numbuf[20];
	const char *result;

	log_assert (ctrl && ctrl->magic == SERVER_CONTROL_MAGIC);

	if (node->pkt->pkttype == PKT_USER_ID
	\|\| node->pkt->pkttype == PKT_ATTRIBUTE)
	{
	PKT_user_id *uid = node->pkt->pkt.user_id;

	if (!strcmp (propname, "uid"))
	result = uid->name;
	else if (!strcmp (propname, "mbox"))
	{
	if (!uid->mbox)
	{
	uid->mbox = mailbox_from_userid (uid->name, 0);
	}
	result = uid->mbox;
	}
	else if (!strcmp (propname, "primary"))
	{
	result = uid->flags.primary? "1":"0";
	}
	else if (!strcmp (propname, "expired"))
	{
	result = uid->flags.expired? "1":"0";
	}
	else if (!strcmp (propname, "revoked"))
	{
	result = uid->flags.revoked? "1":"0";
	}
	else
	result = NULL;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;

	if (!strcmp (propname, "sig_created"))
	{
	snprintf (numbuf, sizeof numbuf, "%lu", (ulong)sig->timestamp);
	result = numbuf;
	}
	else if (!strcmp (propname, "sig_created_d"))
	{
	result = dateonlystr_from_sig (sig);
	}
	else if (!strcmp (propname, "sig_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", sig->pubkey_algo);
	result = numbuf;
	}
	else if (!strcmp (propname, "sig_digest_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", sig->digest_algo);
	result = numbuf;
	}
	else if (!strcmp (propname, "expired"))
	{
	result = sig->flags.expired? "1":"0";
	}
	else
	result = NULL;
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	if (!strcmp (propname, "secret"))
	{
	result = (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)? "1":"0";
	}
	else if (!strcmp (propname, "key_algo"))
	{
	snprintf (numbuf, sizeof numbuf, "%d", pk->pubkey_algo);
	result = numbuf;
	}
	else if (!strcmp (propname, "key_created"))
	{
	snprintf (numbuf, sizeof numbuf, "%lu", (ulong)pk->timestamp);
	result = numbuf;
	}
	else if (!strcmp (propname, "key_created_d"))
	{
	result = dateonlystr_from_pk (pk);
	}
	else if (!strcmp (propname, "expired"))
	{
	result = pk->has_expired? "1":"0";
	}
	else if (!strcmp (propname, "revoked"))
	{
	result = pk->flags.revoked? "1":"0";
	}
	else if (!strcmp (propname, "disabled"))
	{
	result = pk_is_disabled (pk)? "1":"0";
	}
	else if (!strcmp (propname, "usage"))
	{
	snprintf (numbuf, sizeof numbuf, "%s%s%s%s%s",
	(pk->pubkey_usage & PUBKEY_USAGE_ENC)?"e":"",
	(pk->pubkey_usage & PUBKEY_USAGE_SIG)?"s":"",
	(pk->pubkey_usage & PUBKEY_USAGE_CERT)?"c":"",
	(pk->pubkey_usage & PUBKEY_USAGE_AUTH)?"a":"",
	(pk->pubkey_usage & PUBKEY_USAGE_UNKNOWN)?"?":"");
	result = numbuf;
	}
	else if (!strcmp (propname, "fpr"))
	{
	hexfingerprint (pk, parm->hexfpr, sizeof parm->hexfpr);
	result = parm->hexfpr;
	}
	else
	result = NULL;
	}
	else
	result = NULL;

	return result;
	}


	/*
	* Apply the keep-uid filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_keep_uid_filter (ctrl_t ctrl, kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;
	struct impex_filter_parm_s parm;

	parm.ctrl = ctrl;

	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	parm.node = node;
	if (!recsel_select (selector, impex_filter_getval, &parm))
	{

	/* log_debug ("keep-uid: deleting '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	/* The UID packet and all following packets up to the
	* next UID or a subkey. */
	delete_kbnode (node);
	for (; node->next
	&& node->next->pkt->pkttype != PKT_USER_ID
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ;
	node = node->next)
	delete_kbnode (node->next);
	}
	/* else */
	/* log_debug ("keep-uid: keeping '%s'\n", */
	/* node->pkt->pkt.user_id->name); */
	}
	}
	}


	/*
	* Apply the drop-sig filter to the keyblock. The deleted nodes are
	* marked and thus the caller should call commit_kbnode afterwards.
	* KEYBLOCK must not have any blocks marked as deleted.
	*/
	static void
	apply_drop_sig_filter (ctrl_t ctrl, kbnode_t keyblock, recsel_expr_t selector)
	{
	kbnode_t node;
	int active = 0;
	u32 main_keyid[2];
	PKT_signature *sig;
	struct impex_filter_parm_s parm;

	parm.ctrl = ctrl;

	keyid_from_pk (keyblock->pkt->pkt.public_key, main_keyid);

	/* Loop over all signatures for user id and attribute packets which
	* are not self signatures. */
	for (node = keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	break; /* ready. */
	if (node->pkt->pkttype == PKT_USER_ID
	\|\| node->pkt->pkttype == PKT_ATTRIBUTE)
	active = 1;
	if (!active)
	continue;
	if (node->pkt->pkttype != PKT_SIGNATURE)
	continue;

	sig = node->pkt->pkt.signature;
	if (main_keyid[0] == sig->keyid[0] \|\| main_keyid[1] == sig->keyid[1])
	continue; /* Skip self-signatures. */

	if (IS_UID_SIG(sig) \|\| IS_UID_REV(sig))
	{
	parm.node = node;
	if (recsel_select (selector, impex_filter_getval, &parm))
	delete_kbnode (node);
	}
	}
	}


	/* Insert a key origin into a public key packet. */
	static gpg_error_t
	insert_key_origin_pk (PKT_public_key *pk, u32 curtime,
	int origin, const char *url)
	{
	if (origin == KEYORG_WKD \|\| origin == KEYORG_DANE)
	{
	/* For WKD and DANE we insert origin information also for the
	* key but we don't record the URL because we have have no use
	* for that: An update using a keyserver has higher precedence
	* and will thus update this origin info. For refresh using WKD
	* or DANE we need to go via the User ID anyway. Recall that we
	* are only inserting a new key. */
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	}
	else if (origin == KEYORG_KS && url)
	{
	/* If the key was retrieved from a keyserver using a fingerprint
	* request we add the meta information. Note that the use of a
	* fingerprint needs to be enforced by the caller of the import
	* function. This is commonly triggered by verifying a modern
	* signature which has an Issuer Fingerprint signature
	* subpacket. */
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	xfree (pk->updateurl);
	pk->updateurl = xtrystrdup (url);
	if (!pk->updateurl)
	return gpg_error_from_syserror ();
	}
	else if (origin == KEYORG_FILE)
	{
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	}
	else if (origin == KEYORG_URL)
	{
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	if (url)
	{
	xfree (pk->updateurl);
	pk->updateurl = xtrystrdup (url);
	if (!pk->updateurl)
	return gpg_error_from_syserror ();
	}
	}

	return 0;
	}


	/* Insert a key origin into a user id packet. */
	static gpg_error_t
	insert_key_origin_uid (PKT_user_id *uid, u32 curtime,
	int origin, const char *url)

	{
	if (origin == KEYORG_WKD \|\| origin == KEYORG_DANE)
	{
	/* We insert origin information on a UID only when we received
	* them via the Web Key Directory or a DANE record. The key we
	* receive here from the WKD has been filtered to contain only
	* the user ID as looked up in the WKD. For a DANE origin we
	* this should also be the case. Thus we will see here only one
	* user id. */
	uid->keyorg = origin;
	uid->keyupdate = curtime;
	if (url)
	{
	xfree (uid->updateurl);
	uid->updateurl = xtrystrdup (url);
	if (!uid->updateurl)
	return gpg_error_from_syserror ();
	}
	}
	else if (origin == KEYORG_KS && url)
	{
	/* If the key was retrieved from a keyserver using a fingerprint
	* request we mark that also in the user ID. However we do not
	* store the keyserver URL in the UID. A later update (merge)
	* from a more trusted source will replace this info. */
	uid->keyorg = origin;
	uid->keyupdate = curtime;
	}
	else if (origin == KEYORG_FILE)
	{
	uid->keyorg = origin;
	uid->keyupdate = curtime;
	}
	else if (origin == KEYORG_URL)
	{
	uid->keyorg = origin;
	uid->keyupdate = curtime;
	}

	return 0;
	}


	/* Apply meta data to KEYBLOCK. This sets the origin of the key to
	* ORIGIN and the updateurl to URL. Note that this function is only
	* used for a new key, that is not when we are merging keys. */
	static gpg_error_t
	insert_key_origin (kbnode_t keyblock, int origin, const char *url)
	{
	gpg_error_t err;
	kbnode_t node;
	u32 curtime = make_timestamp ();

	for (node = keyblock; node; node = node->next)
	{
	if (is_deleted_kbnode (node))
	;
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY)
	{
	err = insert_key_origin_pk (node->pkt->pkt.public_key, curtime,
	origin, url);
	if (err)
	return err;
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	err = insert_key_origin_uid (node->pkt->pkt.user_id, curtime,
	origin, url);
	if (err)
	return err;
	}
	}

	return 0;
	}


	/* Update meta data on KEYBLOCK. This updates the key origin on the
	* public key according to ORIGIN and URL. The UIDs are already
	* updated when this function is called. */
	static gpg_error_t
	update_key_origin (kbnode_t keyblock, u32 curtime, int origin, const char *url)
	{
	PKT_public_key *pk;

	log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
	pk = keyblock->pkt->pkt.public_key;

	if (pk->keyupdate > curtime)
	; /* Don't do it for a time warp. */
	else if (origin == KEYORG_WKD \|\| origin == KEYORG_DANE)
	{
	/* We only update the origin info if they either have never been
	* set or are the origin was the same as the new one. If this
	* is WKD we also update the UID to show from which user id this
	* was updated. */
	if (!pk->keyorg \|\| pk->keyorg == KEYORG_WKD \|\| pk->keyorg == KEYORG_DANE)
	{
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	xfree (pk->updateurl);
	pk->updateurl = NULL;
	if (origin == KEYORG_WKD && url)
	{
	pk->updateurl = xtrystrdup (url);
	if (!pk->updateurl)
	return gpg_error_from_syserror ();
	}
	}
	}
	else if (origin == KEYORG_KS)
	{
	/* All updates from a keyserver are considered to have the
	* freshed key. Thus we always set the new key origin. */
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	xfree (pk->updateurl);
	pk->updateurl = NULL;
	if (url)
	{
	pk->updateurl = xtrystrdup (url);
	if (!pk->updateurl)
	return gpg_error_from_syserror ();
	}
	}
	else if (origin == KEYORG_FILE)
	{
	/* Updates from a file are considered to be fresh. */
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	xfree (pk->updateurl);
	pk->updateurl = NULL;
	}
	else if (origin == KEYORG_URL)
	{
	/* Updates from a URL are considered to be fresh. */
	pk->keyorg = origin;
	pk->keyupdate = curtime;
	xfree (pk->updateurl);
	pk->updateurl = NULL;
	if (url)
	{
	pk->updateurl = xtrystrdup (url);
	if (!pk->updateurl)
	return gpg_error_from_syserror ();
	}
	}

	return 0;
	}


	/*
	* Try to import one keyblock. Return an error only in serious cases,
	* but never for an invalid keyblock. It uses log_error to increase
	* the internal errorcount, so that invalid input can be detected by
	* programs which called gpg. If SILENT is no messages are printed -
	* even most error messages are suppressed. ORIGIN is the origin of
	* the key (0 for unknown) and URL the corresponding URL. FROM_SK
	* indicates that the key has been made from a secret key. If R_SAVED
	* is not NULL a boolean will be stored indicating whether the keyblock
	* has valid parts.
	*/
	static gpg_error_t
	import_one_real (ctrl_t ctrl,
	kbnode_t keyblock, struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len, unsigned int options,
	int from_sk, int silent,
	import_screener_t screener, void *screener_arg,
	int origin, const char url, int r_valid)
	{
	gpg_error_t err = 0;
	PKT_public_key *pk;
	kbnode_t node, uidnode;
	kbnode_t keyblock_orig = NULL;
	byte fpr2[MAX_FINGERPRINT_LEN];
	size_t fpr2len;
	u32 keyid[2];
	int new_key = 0;
	int mod_key = 0;
	int same_key = 0;
	int non_self = 0;
	size_t an;
	char pkstrbuf[PUBKEY_STRING_SIZE];
	int merge_keys_done = 0;
	int any_filter = 0;
	KEYDB_HANDLE hd = NULL;

	if (r_valid)
	*r_valid = 0;

	/* If show-only is active we don't won't any extra output. */
	if ((options & (IMPORT_SHOW \| IMPORT_DRY_RUN)))
	silent = 1;

	/* Get the key and print some info about it. */
	node = find_kbnode( keyblock, PKT_PUBLIC_KEY );
	if (!node )
	BUG();

	pk = node->pkt->pkt.public_key;

	fingerprint_from_pk (pk, fpr2, &fpr2len);
	for (an = fpr2len; an < MAX_FINGERPRINT_LEN; an++)
	fpr2[an] = 0;
	keyid_from_pk( pk, keyid );
	uidnode = find_next_kbnode( keyblock, PKT_USER_ID );

	if (opt.verbose && !opt.interactive && !silent && !from_sk)
	{
	/* Note that we do not print this info in FROM_SK mode
	* because import_secret_one already printed that. */
	log_info ("pub %s/%s %s ",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk(pk), datestr_from_pk(pk) );
	if (uidnode)
	print_utf8_buffer (log_get_stream (),
	uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len );
	log_printf ("\n");
	}


	/* Unless import-drop-uids has been requested we don't allow import
	* of a key without UIDs. */
	if (!uidnode && !(options & IMPORT_DROP_UIDS))
	{
	if (!silent)
	log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
	return 0;
	}

	if (screener && screener (keyblock, screener_arg))
	{
	log_error (_("key %s: %s\n"), keystr_from_pk (pk),
	_("rejected by import screener"));
	return 0;
	}

	if (opt.interactive && !silent)
	{
	if (is_status_enabled())
	print_import_check (pk, uidnode->pkt->pkt.user_id);
	merge_keys_and_selfsig (ctrl, keyblock);
	tty_printf ("\n");
	show_basic_key_info (ctrl, keyblock, from_sk);
	tty_printf ("\n");
	if (!cpr_get_answer_is_yes ("import.okay",
	"Do you want to import this key? (y/N) "))
	return 0;
	}

	/* Remove all non-self-sigs if requested. Note that this is a NOP if
	* that option has been globally set but we may also be called
	* latter with the already parsed keyblock and a locally changed
	* option. This is why we need to remove them here as well. */
	if ((options & IMPORT_SELF_SIGS_ONLY))
	remove_all_non_self_sigs (&keyblock, keyid);

	/* Remove or collapse the user ids. */
	if ((options & IMPORT_DROP_UIDS))
	remove_all_uids (&keyblock);
	else
	collapse_uids (&keyblock);

	/* Clean the key that we're about to import, to cut down on things
	that we have to clean later. This has no practical impact on the
	end result, but does result in less logging which might confuse
	the user. */
	if ((options & IMPORT_CLEAN))
	{
	merge_keys_and_selfsig (ctrl, keyblock);
	clean_all_uids (ctrl, keyblock,
	opt.verbose, (options&IMPORT_MINIMAL), NULL, NULL);
	clean_all_subkeys (ctrl, keyblock, opt.verbose, KEY_CLEAN_NONE,
	NULL, NULL);
	}

	clear_kbnode_flags( keyblock );

	if ((options&IMPORT_REPAIR_PKS_SUBKEY_BUG)
	&& fix_pks_corruption (ctrl, keyblock)
	&& opt.verbose)
	log_info (_("key %s: PKS subkey corruption repaired\n"),
	keystr_from_pk(pk));

	if ((options & IMPORT_REPAIR_KEYS))
	key_check_all_keysigs (ctrl, 1, keyblock, 0, 0);

	if (chk_self_sigs (ctrl, keyblock, keyid, &non_self))
	return 0; /* Invalid keyblock - error already printed. */

	/* If we allow such a thing, mark unsigned uids as valid */
	if (opt.allow_non_selfsigned_uid)
	{
	for (node=keyblock; node; node = node->next )
	if (node->pkt->pkttype == PKT_USER_ID
	&& !(node->flag & NODE_GOOD_SELFSIG)
	&& !(node->flag & NODE_BAD_SELFSIG) )
	{
	char *user=utf8_to_native(node->pkt->pkt.user_id->name,
	node->pkt->pkt.user_id->len,0);
	/* Fake a good signature status for the user id. */
	node->flag \|= NODE_GOOD_SELFSIG;
	log_info( _("key %s: accepted non self-signed user ID \"%s\"\n"),
	keystr_from_pk(pk),user);
	xfree(user);
	}
	}

	/* Delete invalid parts and without the drop option bail out if
	* there are no user ids. */
	if (!delete_inv_parts (ctrl, keyblock, keyid, options)
	&& !(options & IMPORT_DROP_UIDS) )
	{
	if (!silent)
	{
	log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
	if (!opt.quiet )
	log_info(_("this may be caused by a missing self-signature\n"));
	}
	stats->no_user_id++;
	return 0;
	}

	/* Get rid of deleted nodes. */
	commit_kbnode (&keyblock);

	/* Apply import filter. */
	if (import_filter.keep_uid)
	{
	apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
	commit_kbnode (&keyblock);
	any_filter = 1;
	}
	if (import_filter.drop_sig)
	{
	apply_drop_sig_filter (ctrl, keyblock, import_filter.drop_sig);
	commit_kbnode (&keyblock);
	any_filter = 1;
	}

	/* If we ran any filter we need to check that at least one user id
	* is left in the keyring. Note that we do not use log_error in
	* this case. */
	if (any_filter && !any_uid_left (keyblock))
	{
	if (!opt.quiet )
	log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
	stats->no_user_id++;
	return 0;
	}

	/* The keyblock is valid and ready for real import. */
	if (r_valid)
	*r_valid = 1;

	/* Show the key in the form it is merged or inserted. We skip this
	* if "import-export" is also active without --armor or the output
	* file has explicily been given. */
	if ((options & IMPORT_SHOW)
	&& !((options & IMPORT_EXPORT) && !opt.armor && !opt.outfile))
	{
	merge_keys_and_selfsig (ctrl, keyblock);
	merge_keys_done = 1;
	/* Note that we do not want to show the validity because the key
	* has not yet imported. */
	list_keyblock_direct (ctrl, keyblock, from_sk, 0,
	opt.fingerprint \|\| opt.with_fingerprint, 1);
	es_fflush (es_stdout);
	}

	/* Write the keyblock to the output and do not actually import. */
	if ((options & IMPORT_EXPORT))
	{
	if (!merge_keys_done)
	{
	merge_keys_and_selfsig (ctrl, keyblock);
	merge_keys_done = 1;
	}
	err = write_keyblock_to_output (keyblock, opt.armor, opt.export_options);
	goto leave;
	}

	if (opt.dry_run \|\| (options & IMPORT_DRY_RUN))
	goto leave;

	/* Do we have this key already in one of our pubrings ? */
	err = get_keyblock_byfprint_fast (ctrl, &keyblock_orig, &hd,
	fpr2, fpr2len, 1/locked/);
	if ((err
	&& gpg_err_code (err) != GPG_ERR_NO_PUBKEY
	&& gpg_err_code (err) != GPG_ERR_UNUSABLE_PUBKEY)
	\|\| !hd)
	{
	/* The !hd above is to catch a misbehaving function which
	* returns NO_PUBKEY for failing to allocate a handle. */
	if (!silent)
	log_error (_("key %s: public key not found: %s\n"),
	keystr(keyid), gpg_strerror (err));
	}
	else if (err && (opt.import_options&IMPORT_MERGE_ONLY) )
	{
	if (opt.verbose && !silent )
	log_info( _("key %s: new key - skipped\n"), keystr(keyid));
	err = 0;
	stats->skipped_new_keys++;
	}
	else if (err) /* Insert this key. */
	{
	/* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY. */
	int n_sigs_cleaned, n_uids_cleaned;

	err = keydb_locate_writable (hd);
	if (err)
	{
	log_error (_("no writable keyring found: %s\n"), gpg_strerror (err));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	if (opt.verbose > 1 )
	log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) );

	if ((options & IMPORT_CLEAN))
	{
	merge_keys_and_selfsig (ctrl, keyblock);
	clean_all_uids (ctrl, keyblock, opt.verbose, (options&IMPORT_MINIMAL),
	&n_uids_cleaned,&n_sigs_cleaned);
	clean_all_subkeys (ctrl, keyblock, opt.verbose, KEY_CLEAN_NONE,
	NULL, NULL);
	}

	/* Unless we are in restore mode apply meta data to the
	* keyblock. Note that this will never change the first packet
	* and thus the address of KEYBLOCK won't change. */
	if ( !(options & IMPORT_RESTORE) )
	{
	err = insert_key_origin (keyblock, origin, url);
	if (err)
	{
	log_error ("insert_key_origin failed: %s\n", gpg_strerror (err));
	err = gpg_error (GPG_ERR_GENERAL);
	goto leave;
	}
	}

	err = keydb_insert_keyblock (hd, keyblock );
	if (err)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (err));
	else if (!(opt.import_options & IMPORT_KEEP_OWNERTTRUST))
	{
	/* This should not be possible since we delete the
	ownertrust when a key is deleted, but it can happen if
	the keyring and trustdb are out of sync. It can also
	be made to happen with the trusted-key command and by
	importing and locally exported key. */

	clear_ownertrusts (ctrl, pk);
	if (non_self)
	revalidation_mark (ctrl);
	}

	/* Release the handle and thus unlock the keyring asap. */
	keydb_release (hd);
	hd = NULL;

	/* We are ready. */
	if (!err && !opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (ctrl, fpr2, fpr2len);
	log_info (_("key %s: public key \"%s\" imported\n"),
	keystr(keyid), p);
	xfree(p);
	}
	if (!err && is_status_enabled())
	{
	char *us = get_long_user_id_string (ctrl, keyid);
	write_status_text( STATUS_IMPORTED, us );
	xfree(us);
	print_import_ok (pk, 1);
	}
	if (!err)
	{
	stats->imported++;
	new_key = 1;
	}
	}
	else /* Key already exists - merge. */
	{
	int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned;
	u32 curtime = make_timestamp ();

	/* Compare the original against the new key; just to be sure nothing
	* weird is going on */
	if (cmp_public_keys (keyblock_orig->pkt->pkt.public_key, pk))
	{
	if (!silent)
	log_error( _("key %s: doesn't match our copy\n"),keystr(keyid));
	goto leave;
	}

	/* Make sure the original direct key sigs are all sane. */
	n_sigs_cleaned = fix_bad_direct_key_sigs (ctrl, keyblock_orig, keyid);
	if (n_sigs_cleaned)
	commit_kbnode (&keyblock_orig);

	/* Try to merge KEYBLOCK into KEYBLOCK_ORIG. */
	clear_kbnode_flags( keyblock_orig );
	clear_kbnode_flags( keyblock );
	n_uids = n_sigs = n_subk = n_uids_cleaned = 0;
	err = merge_blocks (ctrl, options, keyblock_orig, keyblock, keyid,
	curtime, origin, url,
	&n_uids, &n_sigs, &n_subk );
	if (err)
	goto leave;

	/* Clean the final keyblock again if requested. we can't do
	* this if only self-signatures are imported; see bug #4628. */
	if ((options & IMPORT_CLEAN)
	&& !(options & IMPORT_SELF_SIGS_ONLY))
	{
	merge_keys_and_selfsig (ctrl, keyblock_orig);
	clean_all_uids (ctrl, keyblock_orig, opt.verbose,
	(options&IMPORT_MINIMAL),
	&n_uids_cleaned,&n_sigs_cleaned);
	clean_all_subkeys (ctrl, keyblock_orig, opt.verbose, KEY_CLEAN_NONE,
	NULL, NULL);
	}

	if (n_uids \|\| n_sigs \|\| n_subk \|\| n_sigs_cleaned \|\| n_uids_cleaned)
	{
	/* Unless we are in restore mode apply meta data to the
	* keyblock. Note that this will never change the first packet
	* and thus the address of KEYBLOCK won't change. */
	if ( !(options & IMPORT_RESTORE) )
	{
	err = update_key_origin (keyblock_orig, curtime, origin, url);
	if (err)
	{
	log_error ("update_key_origin failed: %s\n",
	gpg_strerror (err));
	goto leave;
	}
	}

	mod_key = 1;
	/* KEYBLOCK_ORIG has been updated; write */
	err = keydb_update_keyblock (ctrl, hd, keyblock_orig);
	if (err)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (err));
	else if (non_self)
	revalidation_mark (ctrl);

	/* Release the handle and thus unlock the keyring asap. */
	keydb_release (hd);
	hd = NULL;

	/* We are ready. Print and update stats if we got no error.
	* An error here comes from writing the keyblock and thus
	* very likely means that no update happened. */
	if (!err && !opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (ctrl, fpr2, fpr2len);
	if (n_uids == 1 )
	log_info( _("key %s: \"%s\" 1 new user ID\n"),
	keystr(keyid),p);
	else if (n_uids )
	log_info( _("key %s: \"%s\" %d new user IDs\n"),
	keystr(keyid),p,n_uids);
	if (n_sigs == 1 )
	log_info( _("key %s: \"%s\" 1 new signature\n"),
	keystr(keyid), p);
	else if (n_sigs )
	log_info( _("key %s: \"%s\" %d new signatures\n"),
	keystr(keyid), p, n_sigs );
	if (n_subk == 1 )
	log_info( _("key %s: \"%s\" 1 new subkey\n"),
	keystr(keyid), p);
	else if (n_subk )
	log_info( _("key %s: \"%s\" %d new subkeys\n"),
	keystr(keyid), p, n_subk );
	if (n_sigs_cleaned==1)
	log_info(_("key %s: \"%s\" %d signature cleaned\n"),
	keystr(keyid),p,n_sigs_cleaned);
	else if (n_sigs_cleaned)
	log_info(_("key %s: \"%s\" %d signatures cleaned\n"),
	keystr(keyid),p,n_sigs_cleaned);
	if (n_uids_cleaned==1)
	log_info(_("key %s: \"%s\" %d user ID cleaned\n"),
	keystr(keyid),p,n_uids_cleaned);
	else if (n_uids_cleaned)
	log_info(_("key %s: \"%s\" %d user IDs cleaned\n"),
	keystr(keyid),p,n_uids_cleaned);
	xfree(p);
	}

	if (!err)
	{
	stats->n_uids +=n_uids;
	stats->n_sigs +=n_sigs;
	stats->n_subk +=n_subk;
	stats->n_sigs_cleaned +=n_sigs_cleaned;
	stats->n_uids_cleaned +=n_uids_cleaned;

	if (is_status_enabled () && !silent)
	print_import_ok (pk, ((n_uids?2:0)\|(n_sigs?4:0)\|(n_subk?8:0)));
	}
	}
	else
	{
	/* Release the handle and thus unlock the keyring asap. */
	keydb_release (hd);
	hd = NULL;

	/* FIXME: We do not track the time we last checked a key for
	* updates. To do this we would need to rewrite even the
	* keys which have no changes. Adding this would be useful
	* for the automatic update of expired keys via the WKD in
	* case the WKD still carries the expired key. See
	* get_best_pubkey_byname. */
	same_key = 1;
	if (is_status_enabled ())
	print_import_ok (pk, 0);

	if (!opt.quiet && !silent)
	{
	char *p = get_user_id_byfpr_native (ctrl, fpr2, fpr2len);
	log_info( _("key %s: \"%s\" not changed\n"),keystr(keyid),p);
	xfree(p);
	}

	stats->unchanged++;
	}
	}

	leave:
	keydb_release (hd);
	if (mod_key \|\| new_key \|\| same_key)
	{
	/* A little explanation for this: we fill in the fingerprint
	when importing keys as it can be useful to know the
	fingerprint in certain keyserver-related cases (a keyserver
	asked for a particular name, but the key doesn't have that
	name). However, in cases where we're importing more than
	one key at a time, we cannot know which key to fingerprint.
	In these cases, rather than guessing, we do not
	fingerprinting at all, and we must hope the user ID on the
	keys are useful. Note that we need to do this for new
	keys, merged keys and even for unchanged keys. This is
	required because for example the --auto-key-locate feature
	may import an already imported key and needs to know the
	fingerprint of the key in all cases. */
	if (fpr)
	{
	/* Note that we need to compare against 0 here because
	COUNT gets only incremented after returning from this
	function. */
	if (!stats->count)
	{
	xfree (*fpr);
	*fpr = fingerprint_from_pk (pk, NULL, fpr_len);
	}
	else if (origin != KEYORG_WKD)
	{
	xfree (*fpr);
	*fpr = NULL;
	}
	}
	}

	/* Now that the key is definitely incorporated into the keydb, we
	need to check if a designated revocation is present or if the
	prefs are not rational so we can warn the user. */

	if (mod_key)
	{
	revocation_present (ctrl, keyblock_orig);
	if (!from_sk && have_secret_key_with_kid (ctrl, keyid))
	check_prefs (ctrl, keyblock_orig);
	}
	else if (new_key)
	{
	revocation_present (ctrl, keyblock);
	if (!from_sk && have_secret_key_with_kid (ctrl, keyid))
	check_prefs (ctrl, keyblock);
	}

	release_kbnode( keyblock_orig );

	return err;
	}


	/* Wrapper around import_one_real to retry the import in some cases. */
	static gpg_error_t
	import_one (ctrl_t ctrl,
	kbnode_t keyblock, struct import_stats_s *stats,
	unsigned char *fpr, size_t fpr_len, unsigned int options,
	int from_sk, int silent,
	import_screener_t screener, void *screener_arg,
	int origin, const char url, int r_valid)
	{
	gpg_error_t err;

	err = import_one_real (ctrl, keyblock, stats, fpr, fpr_len, options,
	from_sk, silent, screener, screener_arg,
	origin, url, r_valid);
	if (gpg_err_code (err) == GPG_ERR_TOO_LARGE
	&& gpg_err_source (err) == GPG_ERR_SOURCE_KEYBOX
	&& ((options & (IMPORT_SELF_SIGS_ONLY \| IMPORT_CLEAN))
	!= (IMPORT_SELF_SIGS_ONLY \| IMPORT_CLEAN)))
	{
	/* We hit the maximum image length. Ask the wrapper to do
	* everything again but this time with some extra options. */
	u32 keyid[2];

	keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);
	log_info ("key %s: keyblock too large, retrying with self-sigs-only\n",
	keystr (keyid));
	options \|= IMPORT_SELF_SIGS_ONLY \| IMPORT_CLEAN;
	err = import_one_real (ctrl, keyblock, stats, fpr, fpr_len, options,
	from_sk, silent, screener, screener_arg,
	origin, url, r_valid);
	}
	return err;
	}


	/* Transfer all the secret keys in SEC_KEYBLOCK to the gpg-agent. The
	* function prints diagnostics and returns an error code. If BATCH is
	* true the secret keys are stored by gpg-agent in the transfer format
	* (i.e. no re-protection and aksing for passphrases). If ONLY_MARKED
	* is set, only those nodes with flag NODE_TRANSFER_SECKEY are
	* processed. */
	gpg_error_t
	transfer_secret_keys (ctrl_t ctrl, struct import_stats_s *stats,
	kbnode_t sec_keyblock, int batch, int force,
	int only_marked)
	{
	gpg_error_t err = 0;
	void *kek = NULL;
	size_t keklen;
	kbnode_t ctx = NULL;
	kbnode_t node;
	PKT_public_key main_pk, pk;
	struct seckey_info *ski;
	int nskey;
	membuf_t mbuf;
	int i, j;
	void format_args[2PUBKEY_MAX_NSKEY];
	gcry_sexp_t skey, prot, tmpsexp;
	gcry_sexp_t curve = NULL;
	unsigned char *transferkey = NULL;
	size_t transferkeylen;
	gcry_cipher_hd_t cipherhd = NULL;
	unsigned char *wrappedkey = NULL;
	size_t wrappedkeylen;
	char *cache_nonce = NULL;
	int stub_key_skipped = 0;

	/* Get the current KEK. */
	err = agent_keywrap_key (ctrl, 0, &kek, &keklen);
	if (err)
	{
	log_error ("error getting the KEK: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Prepare a cipher context. */
	err = gcry_cipher_open (&cipherhd, GCRY_CIPHER_AES128,
	GCRY_CIPHER_MODE_AESWRAP, 0);
	if (!err)
	err = gcry_cipher_setkey (cipherhd, kek, keklen);
	if (err)
	goto leave;
	xfree (kek);
	kek = NULL;

	/* Note: We need to use walk_kbnode so that we skip nodes which are
	* marked as deleted. */
	main_pk = NULL;
	while ((node = walk_kbnode (sec_keyblock, &ctx, 0)))
	{
	if (node->pkt->pkttype != PKT_SECRET_KEY
	&& node->pkt->pkttype != PKT_SECRET_SUBKEY)
	continue;
	if (only_marked && !(node->flag & NODE_TRANSFER_SECKEY))
	continue;
	pk = node->pkt->pkt.public_key;
	if (!main_pk)
	main_pk = pk;

	/* Make sure the keyids are available. */
	keyid_from_pk (pk, NULL);
	if (node->pkt->pkttype == PKT_SECRET_KEY)
	{
	pk->main_keyid[0] = pk->keyid[0];
	pk->main_keyid[1] = pk->keyid[1];
	}
	else
	{
	pk->main_keyid[0] = main_pk->keyid[0];
	pk->main_keyid[1] = main_pk->keyid[1];
	}


	ski = pk->seckey_info;
	if (!ski)
	BUG ();

	if (stats)
	{
	stats->count++;
	stats->secret_read++;
	}

	/* We ignore stub keys. The way we handle them in other parts
	of the code is by asking the agent whether any secret key is
	available for a given keyblock and then concluding that we
	have a secret key; all secret (sub)keys of the keyblock the
	agent does not know of are then stub keys. This works also
	for card stub keys. The learn command or the card-status
	command may be used to check with the agent whether a card
	has been inserted and a stub key is in turn generated by the
	agent. */
	if (ski->s2k.mode == 1001 \|\| ski->s2k.mode == 1002)
	{
	stub_key_skipped = 1;
	continue;
	}

	/* Convert our internal secret key object into an S-expression. */
	nskey = pubkey_get_nskey (pk->pubkey_algo);
	if (!nskey \|\| nskey > PUBKEY_MAX_NSKEY)
	{
	err = gpg_error (GPG_ERR_BAD_SECKEY);
	log_error ("internal error: %s\n", gpg_strerror (err));
	goto leave;
	}

	init_membuf (&mbuf, 50);
	put_membuf_str (&mbuf, "(skey");
	if (pk->pubkey_algo == PUBKEY_ALGO_ECDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_EDDSA
	\|\| pk->pubkey_algo == PUBKEY_ALGO_ECDH)
	{
	/* The ECC case. */
	char *curvestr = openpgp_oid_to_str (pk->pkey[0]);
	if (!curvestr)
	err = gpg_error_from_syserror ();
	else
	{
	const char *curvename = openpgp_oid_to_curve (curvestr, 1);
	gcry_sexp_release (curve);
	err = gcry_sexp_build (&curve, NULL, "(curve %s)",
	curvename?curvename:curvestr);
	xfree (curvestr);
	if (!err)
	{
	j = 0;
	/* Append the public key element Q. */
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + 1;

	/* Append the secret key element D. For ECDH we
	skip PKEY[2] because this holds the KEK which is
	not needed by gpg-agent. */
	i = pk->pubkey_algo == PUBKEY_ALGO_ECDH? 3 : 2;
	if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_USER1))
	put_membuf_str (&mbuf, " e %m");
	else
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + i;
	}
	}
	}
	else
	{
	/* Standard case for the old (non-ECC) algorithms. */
	for (i=j=0; i < nskey; i++)
	{
	if (!pk->pkey[i])
	continue; /* Protected keys only have NPKEY+1 elements. */

	if (gcry_mpi_get_flag (pk->pkey[i], GCRYMPI_FLAG_USER1))
	put_membuf_str (&mbuf, " e %m");
	else
	put_membuf_str (&mbuf, " _ %m");
	format_args[j++] = pk->pkey + i;
	}
	}
	put_membuf_str (&mbuf, ")");
	put_membuf (&mbuf, "", 1);
	if (err)
	xfree (get_membuf (&mbuf, NULL));
	else
	{
	char *format = get_membuf (&mbuf, NULL);
	if (!format)
	err = gpg_error_from_syserror ();
	else
	err = gcry_sexp_build_array (&skey, NULL, format, format_args);
	xfree (format);
	}
	if (err)
	{
	log_error ("error building skey array: %s\n", gpg_strerror (err));
	goto leave;
	}

	if (ski->is_protected)
	{
	char countbuf[35];

	/* FIXME: Support AEAD */
	/* Note that the IVLEN may be zero if we are working on a
	dummy key. We can't express that in an S-expression and
	thus we send dummy data for the IV. */
	snprintf (countbuf, sizeof countbuf, "%lu",
	(unsigned long)ski->s2k.count);
	err = gcry_sexp_build
	(&prot, NULL,
	" (protection %s %s %b %d %s %b %s)\n",
	ski->sha1chk? "sha1":"sum",
	openpgp_cipher_algo_name (ski->algo),
	ski->ivlen? (int)ski->ivlen:1,
	ski->ivlen? ski->iv: (const unsigned char*)"X",
	ski->s2k.mode,
	openpgp_md_algo_name (ski->s2k.hash_algo),
	(int)sizeof (ski->s2k.salt), ski->s2k.salt,
	countbuf);
	}
	else
	err = gcry_sexp_build (&prot, NULL, " (protection none)\n");

	tmpsexp = NULL;
	xfree (transferkey);
	transferkey = NULL;
	if (!err)
	err = gcry_sexp_build (&tmpsexp, NULL,
	"(openpgp-private-key\n"
	" (version %d)\n"
	" (algo %s)\n"
	" %S%S\n"
	" (csum %d)\n"
	" %S)\n",
	pk->version,
	openpgp_pk_algo_name (pk->pubkey_algo),
	curve, skey,
	(int)(unsigned long)ski->csum, prot);
	gcry_sexp_release (skey);
	gcry_sexp_release (prot);
	if (!err)
	err = make_canon_sexp_pad (tmpsexp, 1, &transferkey, &transferkeylen);
	gcry_sexp_release (tmpsexp);
	if (err)
	{
	log_error ("error building transfer key: %s\n", gpg_strerror (err));
	goto leave;
	}

	/* Wrap the key. */
	wrappedkeylen = transferkeylen + 8;
	xfree (wrappedkey);
	wrappedkey = xtrymalloc (wrappedkeylen);
	if (!wrappedkey)
	err = gpg_error_from_syserror ();
	else
	err = gcry_cipher_encrypt (cipherhd, wrappedkey, wrappedkeylen,
	transferkey, transferkeylen);
	if (err)
	goto leave;
	xfree (transferkey);
	transferkey = NULL;

	/* Send the wrapped key to the agent. */
	{
	char *desc = gpg_format_keydesc (ctrl, pk, FORMAT_KEYDESC_IMPORT, 1);
	err = agent_import_key (ctrl, desc, &cache_nonce,
	wrappedkey, wrappedkeylen, batch, force,
	pk->keyid, pk->main_keyid, pk->pubkey_algo);
	xfree (desc);
	}
	if (!err)
	{
	if (opt.verbose)
	log_info (_("key %s: secret key imported\n"),
	keystr_from_pk_with_sub (main_pk, pk));
	if (stats)
	stats->secret_imported++;
	}
	else if ( gpg_err_code (err) == GPG_ERR_EEXIST )
	{
	if (opt.verbose)
	log_info (_("key %s: secret key already exists\n"),
	keystr_from_pk_with_sub (main_pk, pk));
	err = 0;
	if (stats)
	stats->secret_dups++;
	}
	else
	{
	log_error (_("key %s: error sending to agent: %s\n"),
	keystr_from_pk_with_sub (main_pk, pk),
	gpg_strerror (err));
	if (gpg_err_code (err) == GPG_ERR_CANCELED
	\|\| gpg_err_code (err) == GPG_ERR_FULLY_CANCELED)
	break; /* Don't try the other subkeys. */
	}
	}

	if (!err && stub_key_skipped)
	/* We need to notify user how to migrate stub keys. */
	err = gpg_error (GPG_ERR_NOT_PROCESSED);

	leave:
	gcry_sexp_release (curve);
	xfree (cache_nonce);
	xfree (wrappedkey);
	xfree (transferkey);
	gcry_cipher_close (cipherhd);
	xfree (kek);
	return err;
	}


	/* Walk a secret keyblock and produce a public keyblock out of it.
	* Returns a new node or NULL on error. Modifies the tag field of the
	* nodes. */
	static kbnode_t
	sec_to_pub_keyblock (kbnode_t sec_keyblock)
	{
	kbnode_t pub_keyblock = NULL;
	kbnode_t ctx = NULL;
	kbnode_t secnode, pubnode;
	kbnode_t lastnode = NULL;
	unsigned int tag = 0;

	/* Set a tag to all nodes. */
	for (secnode = sec_keyblock; secnode; secnode = secnode->next)
	secnode->tag = ++tag;

	/* Copy. */
	while ((secnode = walk_kbnode (sec_keyblock, &ctx, 0)))
	{
	if (secnode->pkt->pkttype == PKT_SECRET_KEY
	\|\| secnode->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	/* Make a public key. */
	PACKET *pkt;
	PKT_public_key *pk;

	pkt = xtrycalloc (1, sizeof *pkt);
	pk = pkt? copy_public_key (NULL, secnode->pkt->pkt.public_key): NULL;
	if (!pk)
	{
	xfree (pkt);
	release_kbnode (pub_keyblock);
	return NULL;
	}
	if (secnode->pkt->pkttype == PKT_SECRET_KEY)
	pkt->pkttype = PKT_PUBLIC_KEY;
	else
	pkt->pkttype = PKT_PUBLIC_SUBKEY;
	pkt->pkt.public_key = pk;

	pubnode = new_kbnode (pkt);
	}
	else
	{
	pubnode = clone_kbnode (secnode);
	}
	pubnode->tag = secnode->tag;

	if (!pub_keyblock)
	pub_keyblock = lastnode = pubnode;
	else
	{
	lastnode->next = pubnode;
	lastnode = pubnode;
	}
	}

	return pub_keyblock;
	}


	/* Delete all notes in the keyblock at R_KEYBLOCK which are not in
	* PUB_KEYBLOCK. Modifies the tags of both keyblock's nodes. */
	static gpg_error_t
	resync_sec_with_pub_keyblock (kbnode_t *r_keyblock, kbnode_t pub_keyblock,
	kbnode_t *r_removedsecs)
	{
	kbnode_t sec_keyblock = *r_keyblock;
	kbnode_t node, prevnode;
	unsigned int *taglist;
	unsigned int ntaglist, n;
	kbnode_t attic = NULL;
	kbnode_t *attic_head = &attic;

	/* Collect all tags in an array for faster searching. */
	for (ntaglist = 0, node = pub_keyblock; node; node = node->next)
	ntaglist++;
	taglist = xtrycalloc (ntaglist, sizeof *taglist);
	if (!taglist)
	return gpg_error_from_syserror ();
	for (ntaglist = 0, node = pub_keyblock; node; node = node->next)
	taglist[ntaglist++] = node->tag;

	/* Walks over the secret keyblock and delete all nodes which are not
	* in the tag list. Those nodes have been deleted in the
	* pub_keyblock. Sequential search is a bit lazy and could be
	* optimized by sorting and bsearch; however secret keyrings are
	* short and there are easier ways to DoS the import. */
	again:
	for (prevnode=NULL, node=sec_keyblock; node; prevnode=node, node=node->next)
	{
	for (n=0; n < ntaglist; n++)
	if (taglist[n] == node->tag)
	break;
	if (n == ntaglist) /* Not in public keyblock. */
	{
	if (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	if (!prevnode)
	sec_keyblock = node->next;
	else
	prevnode->next = node->next;
	node->next = NULL;
	*attic_head = node;
	attic_head = &node->next;
	goto again; /* That's lame; I know. */
	}
	else
	delete_kbnode (node);
	}
	}

	xfree (taglist);

	/* Commit the as deleted marked nodes and return the possibly
	* modified keyblock and a list of removed secret key nodes. */
	commit_kbnode (&sec_keyblock);
	*r_keyblock = sec_keyblock;
	*r_removedsecs = attic;
	return 0;
	}


	/* Helper for import_secret_one. */
	static gpg_error_t
	do_transfer (ctrl_t ctrl, kbnode_t keyblock, PKT_public_key *pk,
	struct import_stats_s *stats, int batch, int only_marked)

	{
	gpg_error_t err;
	struct import_stats_s subkey_stats = {0};

	err = transfer_secret_keys (ctrl, &subkey_stats, keyblock,
	batch, 0, only_marked);
	if (gpg_err_code (err) == GPG_ERR_NOT_PROCESSED)
	{
	/* TRANSLATORS: For a smartcard, each private key on host has a
	* reference (stub) to a smartcard and actual private key data
	* is stored on the card. A single smartcard can have up to
	* three private key data. Importing private key stub is always
	* skipped in 2.1, and it returns GPG_ERR_NOT_PROCESSED.
	* Instead, user should be suggested to run 'gpg --card-status',
	* then, references to a card will be automatically created
	* again. */
	log_info (_("To migrate '%s', with each smartcard, "
	"run: %s\n"), "secring.gpg", "gpg --card-status");
	err = 0;
	}

	if (!err)
	{
	int status = 16;

	if (!opt.quiet)
	log_info (_("key %s: secret key imported\n"), keystr_from_pk (pk));
	if (subkey_stats.secret_imported)
	{
	status \|= 1;
	stats->secret_imported += 1;
	}
	if (subkey_stats.secret_dups)
	stats->secret_dups += 1;

	if (is_status_enabled ())
	print_import_ok (pk, status);
	}

	return err;
	}


	/* If the secret keys (main or subkey) in SECKEYS have a corresponding
	* public key in the public key described by (FPR,FPRLEN) import these
	* parts.
	*/
	static gpg_error_t
	import_matching_seckeys (ctrl_t ctrl, kbnode_t seckeys,
	const byte *mainfpr, size_t mainfprlen,
	struct import_stats_s *stats, int batch)
	{
	gpg_error_t err;
	kbnode_t pub_keyblock = NULL;
	kbnode_t node;
	struct { byte fpr[MAX_FINGERPRINT_LEN]; size_t fprlen; } *fprlist = NULL;
	size_t n, nfprlist;
	byte fpr[MAX_FINGERPRINT_LEN];
	size_t fprlen;
	PKT_public_key *pk;

	/* Get the entire public key block from our keystore and put all its
	* fingerprints into an array. */
	err = get_pubkey_byfprint (ctrl, NULL, &pub_keyblock, mainfpr, mainfprlen);
	if (err)
	goto leave;
	log_assert (pub_keyblock && pub_keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
	pk = pub_keyblock->pkt->pkt.public_key;

	for (nfprlist = 0, node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	nfprlist++;
	log_assert (nfprlist);
	fprlist = xtrycalloc (nfprlist, sizeof *fprlist);
	if (!fprlist)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	for (n = 0, node = pub_keyblock; node; node = node->next)
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	fingerprint_from_pk (node->pkt->pkt.public_key,
	fprlist[n].fpr, &fprlist[n].fprlen);
	n++;
	}
	log_assert (n == nfprlist);

	/* for (n=0; n < nfprlist; n++) */
	/* log_printhex (fprlist[n].fpr, fprlist[n].fprlen, "pubkey %zu:", n); */

	/* Mark all secret keys which have a matching public key part in
	* PUB_KEYBLOCK. */
	for (node = seckeys; node; node = node->next)
	{
	if (node->pkt->pkttype != PKT_SECRET_KEY
	&& node->pkt->pkttype != PKT_SECRET_SUBKEY)
	continue; /* Should not happen. */
	fingerprint_from_pk (node->pkt->pkt.public_key, fpr, &fprlen);
	node->flag &= ~NODE_TRANSFER_SECKEY;
	for (n=0; n < nfprlist; n++)
	if (fprlist[n].fprlen == fprlen && !memcmp (fprlist[n].fpr,fpr,fprlen))
	{
	node->flag \|= NODE_TRANSFER_SECKEY;
	/* log_debug ("found matching seckey\n"); */
	break;
	}
	}

	/* Transfer all marked keys. */
	err = do_transfer (ctrl, seckeys, pk, stats, batch, 1);

	leave:
	xfree (fprlist);
	release_kbnode (pub_keyblock);
	return err;
	}


	/* Import function for a single secret keyblock. Handling is simpler
	* than for public keys. We allow secret key importing only when
	* allow is true, this is so that a secret key can not be imported
	* accidentally and thereby tampering with the trust calculation.
	*
	* Ownership of KEYBLOCK is transferred to this function!
	*
	* If R_SECATTIC is not null the last special sec_keyblock is stored
	* there.
	*/
	static gpg_error_t
	import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
	struct import_stats_s *stats, int batch,
	unsigned int options, int for_migration,
	import_screener_t screener, void *screener_arg,
	kbnode_t *r_secattic)
	{
	PKT_public_key *pk;
	struct seckey_info *ski;
	kbnode_t node, uidnode;
	u32 keyid[2];
	gpg_error_t err = 0;
	int nr_prev;
	kbnode_t pub_keyblock;
	kbnode_t attic = NULL;
	byte fpr[MAX_FINGERPRINT_LEN];
	size_t fprlen;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* Get the key and print some info about it */
	node = find_kbnode (keyblock, PKT_SECRET_KEY);
	if (!node)
	BUG ();

	pk = node->pkt->pkt.public_key;

	fingerprint_from_pk (pk, fpr, &fprlen);
	keyid_from_pk (pk, keyid);
	uidnode = find_next_kbnode (keyblock, PKT_USER_ID);

	if (screener && screener (keyblock, screener_arg))
	{
	log_error (_("secret key %s: %s\n"), keystr_from_pk (pk),
	_("rejected by import screener"));
	release_kbnode (keyblock);
	return 0;
	}

	if (opt.verbose && !for_migration)
	{
	log_info ("sec %s/%s %s ",
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),
	keystr_from_pk (pk), datestr_from_pk (pk));
	if (uidnode)
	print_utf8_buffer (log_get_stream (), uidnode->pkt->pkt.user_id->name,
	uidnode->pkt->pkt.user_id->len);
	log_printf ("\n");
	}
	stats->secret_read++;

	if ((options & IMPORT_NO_SECKEY))
	{
	if (!for_migration)
	log_error (_("importing secret keys not allowed\n"));
	release_kbnode (keyblock);
	return 0;
	}

	if (!uidnode)
	{
	if (!for_migration)
	log_error( _("key %s: no user ID\n"), keystr_from_pk (pk));
	release_kbnode (keyblock);
	return 0;
	}

	ski = pk->seckey_info;
	if (!ski)
	{
	/* Actually an internal error. */
	log_error ("key %s: secret key info missing\n", keystr_from_pk (pk));
	release_kbnode (keyblock);
	return 0;
	}

	/* A quick check to not import keys with an invalid protection
	cipher algorithm (only checks the primary key, though). */
	if (ski->algo > 110)
	{
	if (!for_migration)
	log_error (_("key %s: secret key with invalid cipher %d"
	" - skipped\n"), keystr_from_pk (pk), ski->algo);
	release_kbnode (keyblock);
	return 0;
	}

	#ifdef ENABLE_SELINUX_HACKS
	if (1)
	{
	/* We don't allow importing secret keys because that may be used
	to put a secret key into the keyring and the user might later
	be tricked into signing stuff with that key. */
	log_error (_("importing secret keys not allowed\n"));
	release_kbnode (keyblock);
	return 0;
	}
	#endif

	clear_kbnode_flags (keyblock);

	nr_prev = stats->skipped_new_keys;

	/* Make a public key out of the key. */
	pub_keyblock = sec_to_pub_keyblock (keyblock);
	if (!pub_keyblock)
	{
	err = gpg_error_from_syserror ();
	log_error ("key %s: failed to create public key from secret key\n",
	keystr_from_pk (pk));
	}
	else
	{
	int valid;

	/* Note that this outputs an IMPORT_OK status message for the
	public key block, and below we will output another one for
	the secret keys. FIXME? */
	import_one (ctrl, pub_keyblock, stats,
	NULL, NULL, options, 1, for_migration,
	screener, screener_arg, 0, NULL, &valid);

	/* The secret keyblock may not have nodes which are deleted in
	* the public keyblock. Otherwise we would import just the
	* secret key without having the public key. That would be
	* surprising and clutters our private-keys-v1.d. */
	err = resync_sec_with_pub_keyblock (&keyblock, pub_keyblock, &attic);
	if (err)
	goto leave;

	if (!valid)
	{
	/* If the block was not valid the primary key is left in the
	* original keyblock because we require that for the first
	* node. Move it to ATTIC. */
	if (keyblock && keyblock->pkt->pkttype == PKT_SECRET_KEY)
	{
	node = keyblock;
	keyblock = node->next;
	node->next = NULL;
	if (attic)
	{
	node->next = attic;
	attic = node;
	}
	else
	attic = node;
	}

	/* Try to import the secret key iff we have a public key. */
	if (attic && !(opt.dry_run \|\| (options & IMPORT_DRY_RUN)))
	err = import_matching_seckeys (ctrl, attic, fpr, fprlen,
	stats, batch);
	else
	err = gpg_error (GPG_ERR_NO_SECKEY);
	goto leave;
	}

	/* log_debug ("attic is:\n"); */
	/* dump_kbnode (attic); */

	/* Proceed with the valid parts of PUBKEYBLOCK. */

	/* At least we cancel the secret key import when the public key
	import was skipped due to MERGE_ONLY option and a new
	key. */
	if (!(opt.dry_run \|\| (options & IMPORT_DRY_RUN))
	&& stats->skipped_new_keys <= nr_prev)
	{
	/* Read the keyblock again to get the effects of a merge for
	* the public key. */
	err = get_pubkey_byfprint (ctrl, NULL, &node, fpr, fprlen);
	if (err \|\| !node)
	log_error ("key %s: failed to re-lookup public key: %s\n",
	keystr_from_pk (pk), gpg_strerror (err));
	else
	{
	err = do_transfer (ctrl, keyblock, pk, stats, batch, 0);
	if (!err)
	check_prefs (ctrl, node);
	release_kbnode (node);

	if (!err && attic)
	{
	/* Try to import invalid subkeys. This can be the
	* case if the primary secret key was imported due
	* to --allow-non-selfsigned-uid. */
	err = import_matching_seckeys (ctrl, attic, fpr, fprlen,
	stats, batch);
	}

	}
	}
	}

	leave:
	release_kbnode (keyblock);
	release_kbnode (pub_keyblock);
	if (r_secattic)
	*r_secattic = attic;
	else
	release_kbnode (attic);
	return err;
	}



	/* Return the recocation reason from signature SIG. If no revocation
	* reason is available 0 is returned, in other cases the reason
	* (0..255). If R_REASON is not NULL a malloced textual
	* representation of the code is stored there. If R_COMMENT is not
	* NULL the comment from the reason is stored there and its length at
	* R_COMMENTLEN. Note that the value at R_COMMENT is not filtered but
	* user supplied data in UTF8; thus it needs to be escaped for display
	* purposes. Both return values are either NULL or a malloced
	* string/buffer. */
	int
	get_revocation_reason (PKT_signature sig, char *r_reason,
	char *r_comment, size_t r_commentlen)
	{
	int reason_seq = 0;
	size_t reason_n;
	const byte *reason_p;
	char reason_code_buf[20];
	const char *reason_text = NULL;
	int reason_code = 0;

	if (r_reason)
	*r_reason = NULL;
	if (r_comment)
	*r_comment = NULL;

	/* Skip over empty reason packets. */
	while ((reason_p = enum_sig_subpkt (sig, 1, SIGSUBPKT_REVOC_REASON,
	&reason_n, &reason_seq, NULL))
	&& !reason_n)
	;
	if (reason_p)
	{
	reason_code = *reason_p;
	reason_n--; reason_p++;
	switch (reason_code)
	{
	case 0x00: reason_text = _("No reason specified"); break;
	case 0x01: reason_text = _("Key is superseded"); break;
	case 0x02: reason_text = _("Key has been compromised"); break;
	case 0x03: reason_text = _("Key is no longer used"); break;
	case 0x20: reason_text = _("User ID is no longer valid"); break;
	default:
	snprintf (reason_code_buf, sizeof reason_code_buf,
	"code=%02x", reason_code);
	reason_text = reason_code_buf;
	break;
	}

	if (r_reason)
	*r_reason = xstrdup (reason_text);

	if (r_comment && reason_n)
	{
	*r_comment = xmalloc (reason_n);
	memcpy (*r_comment, reason_p, reason_n);
	*r_commentlen = reason_n;
	}
	}

	return reason_code;
	}


	/* List the recocation signature as a "rvs" record. SIGRC shows the
	* character from the signature verification or 0 if no public key was
	* found. */
	static void
	list_standalone_revocation (ctrl_t ctrl, PKT_signature *sig, int sigrc)
	{
	char *siguid = NULL;
	size_t siguidlen = 0;
	char *issuer_fpr = NULL;
	int reason_code = 0;
	char *reason_text = NULL;
	char *reason_comment = NULL;
	size_t reason_commentlen;

	if (sigrc != '%' && sigrc != '?' && !opt.fast_list_mode)
	{
	int nouid;
	siguid = get_user_id (ctrl, sig->keyid, &siguidlen, &nouid);
	if (nouid)
	sigrc = '?';
	}

	reason_code = get_revocation_reason (sig, &reason_text,
	&reason_comment, &reason_commentlen);

	if (opt.with_colons)
	{
	es_fputs ("rvs:", es_stdout);
	if (sigrc)
	es_putc (sigrc, es_stdout);
	es_fprintf (es_stdout, "::%d:%08lX%08lX:%s:%s:::",
	sig->pubkey_algo,
	(ulong) sig->keyid[0], (ulong) sig->keyid[1],
	colon_datestr_from_sig (sig),
	colon_expirestr_from_sig (sig));

	if (siguid)
	es_write_sanitized (es_stdout, siguid, siguidlen, ":", NULL);

	es_fprintf (es_stdout, ":%02x%c", sig->sig_class,
	sig->flags.exportable ? 'x' : 'l');
	if (reason_text)
	es_fprintf (es_stdout, ",%02x", reason_code);
	es_fputs ("::", es_stdout);

	if ((issuer_fpr = issuer_fpr_string (sig)))
	es_fputs (issuer_fpr, es_stdout);

	es_fprintf (es_stdout, ":::%d:", sig->digest_algo);

	if (reason_comment)
	{
	es_fputs ("::::", es_stdout);
	es_write_sanitized (es_stdout, reason_comment, reason_commentlen,
	":", NULL);
	es_putc (':', es_stdout);
	}
	es_putc ('\n', es_stdout);

	if (opt.show_subpackets)
	print_subpackets_colon (sig);
	}
	else /* Human readable. */
	{
	es_fputs ("rvs", es_stdout);
	es_fprintf (es_stdout, "%c%c %c%c%c%c%c%c %s %s",
	sigrc, (sig->sig_class - 0x10 > 0 &&
	sig->sig_class - 0x10 <
	4) ? '0' + sig->sig_class - 0x10 : ' ',
	sig->flags.exportable ? ' ' : 'L',
	sig->flags.revocable ? ' ' : 'R',
	sig->flags.policy_url ? 'P' : ' ',
	sig->flags.notation ? 'N' : ' ',
	sig->flags.expired ? 'X' : ' ',
	(sig->trust_depth > 9) ? 'T' : (sig->trust_depth >
	0) ? '0' +
	sig->trust_depth : ' ', keystr (sig->keyid),
	datestr_from_sig (sig));
	if (siguid)
	{
	es_fprintf (es_stdout, " ");
	print_utf8_buffer (es_stdout, siguid, siguidlen);
	}
	es_putc ('\n', es_stdout);

	if (sig->flags.policy_url
	&& (opt.list_options & LIST_SHOW_POLICY_URLS))
	show_policy_url (sig, 3, 0);

	if (sig->flags.notation && (opt.list_options & LIST_SHOW_NOTATIONS))
	show_notation (sig, 3, 0,
	((opt.list_options & LIST_SHOW_STD_NOTATIONS) ? 1 : 0)
	+
	((opt.list_options & LIST_SHOW_USER_NOTATIONS) ? 2 : 0));

	if (sig->flags.pref_ks
	&& (opt.list_options & LIST_SHOW_KEYSERVER_URLS))
	show_keyserver_url (sig, 3, 0);

	if (reason_text)
	{
	es_fprintf (es_stdout, " %s%s\n",
	_("reason for revocation: "), reason_text);
	if (reason_comment)
	{
	const byte s, s_lf;
	size_t n, n_lf;

	s = reason_comment;
	n = reason_commentlen;
	s_lf = NULL;
	do
	{
	/* We don't want any empty lines, so we skip them. */
	for (;n && *s == '\n'; s++, n--)
	;
	if (n)
	{
	s_lf = memchr (s, '\n', n);
	n_lf = s_lf? s_lf - s : n;
	es_fprintf (es_stdout, " %s",
	_("revocation comment: "));
	es_write_sanitized (es_stdout, s, n_lf, NULL, NULL);
	es_putc ('\n', es_stdout);
	s += n_lf; n -= n_lf;
	}
	} while (s_lf);
	}
	}
	}

	es_fflush (es_stdout);

	xfree (reason_text);
	xfree (reason_comment);
	xfree (siguid);
	xfree (issuer_fpr);
	}


	/****************
	* Import a revocation certificate; this is a single signature packet.
	*/
	static int
	import_revoke_cert (ctrl_t ctrl, kbnode_t node, unsigned int options,
	struct import_stats_s *stats)
	{
	PKT_public_key *pk = NULL;
	kbnode_t onode;
	kbnode_t keyblock = NULL;
	KEYDB_HANDLE hd = NULL;
	u32 keyid[2];
	int rc = 0;
	int sigrc = 0;
	int silent;

	/* No error output for --show-keys. */
	silent = (options & (IMPORT_SHOW \| IMPORT_DRY_RUN));

	log_assert (!node->next );
	log_assert (node->pkt->pkttype == PKT_SIGNATURE );
	log_assert (IS_KEY_REV (node->pkt->pkt.signature));

	keyid[0] = node->pkt->pkt.signature->keyid[0];
	keyid[1] = node->pkt->pkt.signature->keyid[1];

	pk = xmalloc_clear( sizeof *pk );
	rc = get_pubkey (ctrl, pk, keyid );
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY )
	{
	if (!silent)
	log_error (_("key %s: no public key -"
	" can't apply revocation certificate\n"), keystr(keyid));
	rc = 0;
	goto leave;
	}
	else if (rc )
	{
	log_error (_("key %s: public key not found: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* Read the original keyblock. */
	hd = keydb_new (ctrl);
	if (!hd)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}

	{
	byte afp[MAX_FINGERPRINT_LEN];
	size_t an;

	fingerprint_from_pk (pk, afp, &an);
	rc = keydb_search_fpr (hd, afp, an);
	}
	if (rc)
	{
	log_error (_("key %s: can't locate original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}
	rc = keydb_get_keyblock (hd, &keyblock );
	if (rc)
	{
	log_error (_("key %s: can't read original keyblock: %s\n"),
	keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* it is okay, that node is not in keyblock because
	* check_key_signature works fine for sig_class 0x20 (KEY_REV) in
	* this special case. SIGRC is only used for IMPORT_SHOW. */
	rc = check_key_signature (ctrl, keyblock, node, NULL);
	switch (gpg_err_code (rc))
	{
	case 0: sigrc = '!'; break;
	case GPG_ERR_BAD_SIGNATURE: sigrc = '-'; break;
	case GPG_ERR_NO_PUBKEY: sigrc = '?'; break;
	case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
	default: sigrc = '%'; break;
	}
	if (rc )
	{
	if (!silent)
	log_error (_("key %s: invalid revocation certificate"
	": %s - rejected\n"), keystr(keyid), gpg_strerror (rc));
	goto leave;
	}

	/* check whether we already have this */
	for(onode=keyblock->next; onode; onode=onode->next ) {
	if (onode->pkt->pkttype == PKT_USER_ID )
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& !cmp_signatures(node->pkt->pkt.signature,
	onode->pkt->pkt.signature))
	{
	rc = 0;
	goto leave; /* yes, we already know about it */
	}
	}

	/* insert it */
	insert_kbnode( keyblock, clone_kbnode(node), 0 );

	/* and write the keyblock back unless in dry run mode. */
	if (!(opt.dry_run \|\| (options & IMPORT_DRY_RUN)))
	{
	rc = keydb_update_keyblock (ctrl, hd, keyblock );
	if (rc)
	log_error (_("error writing keyring '%s': %s\n"),
	keydb_get_resource_name (hd), gpg_strerror (rc) );
	keydb_release (hd);
	hd = NULL;

	/* we are ready */
	if (!opt.quiet )
	{
	char *p=get_user_id_native (ctrl, keyid);
	log_info( _("key %s: \"%s\" revocation certificate imported\n"),
	keystr(keyid),p);
	xfree(p);
	}

	/* If the key we just revoked was ultimately trusted, remove its
	* ultimate trust. This doesn't stop the user from putting the
	* ultimate trust back, but is a reasonable solution for now. */
	if (get_ownertrust (ctrl, pk) == TRUST_ULTIMATE)
	clear_ownertrusts (ctrl, pk);

	revalidation_mark (ctrl);
	}
	stats->n_revoc++;

	leave:
	if ((options & IMPORT_SHOW))
	list_standalone_revocation (ctrl, node->pkt->pkt.signature, sigrc);

	keydb_release (hd);
	release_kbnode( keyblock );
	free_public_key( pk );
	return rc;
	}


	/* Loop over the KEYBLOCK and check all self signatures. KEYID is the
	* keyid of the primary key for reporting purposes. On return the
	* following bits in the node flags are set:
	*
	* - NODE_GOOD_SELFSIG :: User ID or subkey has a self-signature
	* - NODE_BAD_SELFSIG :: Used ID or subkey has an invalid self-signature
	* - NODE_DELETION_MARK :: This node shall be deleted
	*
	* NON_SELF is set to true if there are any sigs other than self-sigs
	* in this keyblock.
	*
	* Returns 0 on success or -1 (but not an error code) if the keyblock
	* is invalid.
	*/
	static int
	chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 keyid, int non_self)
	{
	kbnode_t knode = NULL; /* The node of the current subkey. */
	PKT_public_key subpk = NULL; / and its packet. */
	kbnode_t bsnode = NULL; /* Subkey binding signature node. */
	u32 bsdate = 0; /* Timestamp of that node. */
	kbnode_t rsnode = NULL; /* Subkey recocation signature node. */
	u32 rsdate = 0; /* Timestamp of that node. */
	PKT_signature *sig;
	int rc;
	kbnode_t n;

	for (n=keyblock; (n = find_next_kbnode (n, 0)); )
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	knode = n;
	subpk = knode->pkt->pkt.public_key;
	bsdate = 0;
	rsdate = 0;
	bsnode = NULL;
	rsnode = NULL;
	continue;
	}

	if ( n->pkt->pkttype != PKT_SIGNATURE )
	continue;

	sig = n->pkt->pkt.signature;
	if ( keyid[0] != sig->keyid[0] \|\| keyid[1] != sig->keyid[1] )
	{
	*non_self = 1;
	continue;
	}

	/* This just caches the sigs for later use. That way we
	import a fully-cached key which speeds things up. */
	if (!opt.no_sig_cache)
	check_key_signature (ctrl, keyblock, n, NULL);

	if ( IS_UID_SIG(sig) \|\| IS_UID_REV(sig) )
	{
	kbnode_t unode = find_prev_kbnode( keyblock, n, PKT_USER_ID );
	if ( !unode )
	{
	log_error( _("key %s: no user ID for signature\n"),
	keystr(keyid));
	return -1; /* The complete keyblock is invalid. */
	}

	/* If it hasn't been marked valid yet, keep trying. */
	if (!(unode->flag & NODE_GOOD_SELFSIG))
	{
	rc = check_key_signature (ctrl, keyblock, n, NULL);
	if ( rc )
	{
	if ( opt.verbose )
	{
	char *p = utf8_to_native
	(unode->pkt->pkt.user_id->name,
	strlen (unode->pkt->pkt.user_id->name),0);
	log_info (gpg_err_code(rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key "
	"algorithm on user ID \"%s\"\n"):
	_("key %s: invalid self-signature "
	"on user ID \"%s\"\n"),
	keystr (keyid),p);
	xfree (p);
	}
	}
	else
	unode->flag \|= NODE_GOOD_SELFSIG;
	}
	}
	else if (IS_KEY_SIG (sig))
	{
	rc = check_key_signature (ctrl, keyblock, n, NULL);
	if ( rc )
	{
	if (opt.verbose)
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key algorithm\n"):
	_("key %s: invalid direct key signature\n"),
	keystr (keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	}
	else if ( IS_SUBKEY_SIG (sig) )
	{
	/* Note that this works based solely on the timestamps like
	the rest of gpg. If the standard gets revocation
	targets, this may need to be revised. */

	if ( !knode )
	{
	if (opt.verbose)
	log_info (_("key %s: no subkey for key binding\n"),
	keystr (keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	rc = check_key_signature (ctrl, keyblock, n, NULL);
	if ( rc )
	{
	if (opt.verbose)
	{
	keyid_from_pk (subpk, NULL);
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public key"
	" algorithm\n"):
	_("key %s: invalid subkey binding\n"),
	keystr_with_sub (keyid, subpk->keyid));
	}
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	/* It's valid, so is it newer? */
	if (sig->timestamp >= bsdate)
	{
	knode->flag \|= NODE_GOOD_SELFSIG; /* Subkey is valid. */
	if (bsnode)
	{
	/* Delete the last binding sig since this
	one is newer */
	bsnode->flag \|= NODE_DELETION_MARK;
	if (opt.verbose)
	{
	keyid_from_pk (subpk, NULL);
	log_info (_("key %s: removed multiple subkey"
	" binding\n"),
	keystr_with_sub (keyid, subpk->keyid));
	}
	}

	bsnode = n;
	bsdate = sig->timestamp;
	}
	else
	n->flag \|= NODE_DELETION_MARK; /* older */
	}
	}
	}
	else if ( IS_SUBKEY_REV (sig) )
	{
	/* We don't actually mark the subkey as revoked right now,
	so just check that the revocation sig is the most recent
	valid one. Note that we don't care if the binding sig is
	newer than the revocation sig. See the comment in
	getkey.c:merge_selfsigs_subkey for more. */
	if ( !knode )
	{
	if (opt.verbose)
	log_info (_("key %s: no subkey for key revocation\n"),
	keystr(keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	rc = check_key_signature (ctrl, keyblock, n, NULL);
	if ( rc )
	{
	if(opt.verbose)
	log_info (gpg_err_code (rc) == GPG_ERR_PUBKEY_ALGO ?
	_("key %s: unsupported public"
	" key algorithm\n"):
	_("key %s: invalid subkey revocation\n"),
	keystr(keyid));
	n->flag \|= NODE_DELETION_MARK;
	}
	else
	{
	/* It's valid, so is it newer? */
	if (sig->timestamp >= rsdate)
	{
	if (rsnode)
	{
	/* Delete the last revocation sig since
	this one is newer. */
	rsnode->flag \|= NODE_DELETION_MARK;
	if (opt.verbose)
	log_info (_("key %s: removed multiple subkey"
	" revocation\n"),keystr(keyid));
	}

	rsnode = n;
	rsdate = sig->timestamp;
	}
	else
	n->flag \|= NODE_DELETION_MARK; /* older */
	}
	}
	}
	}

	return 0;
	}


	/* Delete all parts which are invalid and those signatures whose
	* public key algorithm is not available in this implementation; but
	* consider RSA as valid, because parse/build_packets knows about it.
	*
	* Returns: True if at least one valid user-id is left over.
	*/
	static int
	delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
	unsigned int options)
	{
	kbnode_t node;
	int nvalid=0, uid_seen=0, subkey_seen=0;
	PKT_public_key *pk;

	for (node=keyblock->next; node; node = node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	uid_seen = 1;
	if ((node->flag & NODE_BAD_SELFSIG)
	\|\| !(node->flag & NODE_GOOD_SELFSIG))
	{
	if (opt.verbose )
	{
	char *p=utf8_to_native(node->pkt->pkt.user_id->name,
	node->pkt->pkt.user_id->len,0);
	log_info( _("key %s: skipped user ID \"%s\"\n"),
	keystr(keyid),p);
	xfree(p);
	}
	delete_kbnode( node ); /* the user-id */
	/* and all following packets up to the next user-id */
	while (node->next
	&& node->next->pkt->pkttype != PKT_USER_ID
	&& node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY
	&& node->next->pkt->pkttype != PKT_SECRET_SUBKEY ){
	delete_kbnode( node->next );
	node = node->next;
	}
	}
	else
	nvalid++;
	}
	else if ( node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY )
	{
	if ((node->flag & NODE_BAD_SELFSIG)
	\|\| !(node->flag & NODE_GOOD_SELFSIG))
	{
	if (opt.verbose )
	{
	pk = node->pkt->pkt.public_key;
	keyid_from_pk (pk, NULL);
	log_info (_("key %s: skipped subkey\n"),
	keystr_with_sub (keyid, pk->keyid));
	}

	delete_kbnode( node ); /* the subkey */
	/* and all following signature packets */
	while (node->next
	&& node->next->pkt->pkttype == PKT_SIGNATURE ) {
	delete_kbnode( node->next );
	node = node->next;
	}
	}
	else
	subkey_seen = 1;
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& openpgp_pk_test_algo (node->pkt->pkt.signature->pubkey_algo)
	&& node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA )
	{
	delete_kbnode( node ); /* build_packet() can't handle this */
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& !node->pkt->pkt.signature->flags.exportable
	&& !(options&IMPORT_LOCAL_SIGS)
	&& !have_secret_key_with_kid (ctrl,
	node->pkt->pkt.signature->keyid))
	{
	/* here we violate the rfc a bit by still allowing
	* to import non-exportable signature when we have the
	* the secret key used to create this signature - it
	* seems that this makes sense */
	if(opt.verbose)
	log_info( _("key %s: non exportable signature"
	" (class 0x%02X) - skipped\n"),
	keystr(keyid), node->pkt->pkt.signature->sig_class );
	delete_kbnode( node );
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (node->pkt->pkt.signature))
	{
	if (uid_seen )
	{
	if(opt.verbose)
	log_info( _("key %s: revocation certificate"
	" at wrong place - skipped\n"),keystr(keyid));
	delete_kbnode( node );
	}
	else
	{
	/* If the revocation cert is from a different key than
	the one we're working on don't check it - it's
	probably from a revocation key and won't be
	verifiable with this key anyway. */

	if(node->pkt->pkt.signature->keyid[0]==keyid[0]
	&& node->pkt->pkt.signature->keyid[1]==keyid[1])
	{
	int rc = check_key_signature (ctrl, keyblock, node, NULL);
	if (rc )
	{
	if(opt.verbose)
	log_info( _("key %s: invalid revocation"
	" certificate: %s - skipped\n"),
	keystr(keyid), gpg_strerror (rc));
	delete_kbnode( node );
	}
	}
	}
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& (IS_SUBKEY_SIG (node->pkt->pkt.signature)
	\|\| IS_SUBKEY_REV (node->pkt->pkt.signature))
	&& !subkey_seen )
	{
	if(opt.verbose)
	log_info( _("key %s: subkey signature"
	" in wrong place - skipped\n"), keystr(keyid));
	delete_kbnode( node );
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& !IS_CERT(node->pkt->pkt.signature))
	{
	if(opt.verbose)
	log_info(_("key %s: unexpected signature class (0x%02X) -"
	" skipped\n"),keystr(keyid),
	node->pkt->pkt.signature->sig_class);
	delete_kbnode(node);
	}
	else if ((node->flag & NODE_DELETION_MARK))
	delete_kbnode( node );
	}

	/* note: because keyblock is the public key, it is never marked
	* for deletion and so keyblock cannot change */
	commit_kbnode( &keyblock );
	return nvalid;
	}

	/* This function returns true if any UID is left in the keyring. */
	static int
	any_uid_left (kbnode_t keyblock)
	{
	kbnode_t node;

	for (node=keyblock->next; node; node = node->next)
	if (node->pkt->pkttype == PKT_USER_ID)
	return 1;
	return 0;
	}



	/* Delete all user ids from KEYBLOCK.
	* Returns: True if the keyblock has changed. */
	static int
	remove_all_uids (kbnode_t *keyblock)
	{
	kbnode_t node;
	int any = 0;

	for (node = *keyblock; node; node = node->next)
	{
	if (is_deleted_kbnode (node))
	continue;

	if (node->pkt->pkttype != PKT_USER_ID)
	continue;

	/* We are at the first user id. Delete everything up to the
	* first subkey. */
	for (; node; node = node->next)
	{
	if (is_deleted_kbnode (node))
	continue;

	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	break;
	delete_kbnode (node);
	any = 1;
	}
	break; /* All done. */
	}

	commit_kbnode (keyblock);
	return any;
	}


	/* Delete all non-self-sigs from KEYBLOCK.
	* Returns: True if the keyblock has changed. */
	static void
	remove_all_non_self_sigs (kbnode_t keyblock, u32 keyid)
	{
	kbnode_t node;
	unsigned int dropped = 0;

	for (node = *keyblock; node; node = node->next)
	{
	if (is_deleted_kbnode (node))
	continue;

	if (node->pkt->pkttype != PKT_SIGNATURE)
	continue;

	if (node->pkt->pkt.signature->keyid[0] == keyid[0]
	&& node->pkt->pkt.signature->keyid[1] == keyid[1])
	continue;
	delete_kbnode (node);
	dropped++;
	}

	if (dropped)
	commit_kbnode (keyblock);

	if (dropped && opt.verbose)
	log_info ("key %s: number of dropped non-self-signatures: %u\n",
	keystr (keyid), dropped);
	}


	/*
	* It may happen that the imported keyblock has duplicated user IDs.
	* We check this here and collapse those user IDs together with their
	* sigs into one.
	* Returns: True if the keyblock has changed.
	*/
	int
	collapse_uids (kbnode_t *keyblock)
	{
	kbnode_t uid1;
	int any=0;

	for(uid1=*keyblock;uid1;uid1=uid1->next)
	{
	kbnode_t uid2;

	if(is_deleted_kbnode(uid1))
	continue;

	if(uid1->pkt->pkttype!=PKT_USER_ID)
	continue;

	for(uid2=uid1->next;uid2;uid2=uid2->next)
	{
	if(is_deleted_kbnode(uid2))
	continue;

	if(uid2->pkt->pkttype!=PKT_USER_ID)
	continue;

	if(cmp_user_ids(uid1->pkt->pkt.user_id,
	uid2->pkt->pkt.user_id)==0)
	{
	/* We have a duplicated uid */
	kbnode_t sig1,last;

	any=1;

	/* Now take uid2's signatures, and attach them to
	uid1 */
	for(last=uid2;last->next;last=last->next)
	{
	if(is_deleted_kbnode(last))
	continue;

	if(last->next->pkt->pkttype==PKT_USER_ID
	\|\| last->next->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| last->next->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;
	}

	/* Snip out uid2 */
	(find_prev_kbnode(*keyblock,uid2,0))->next=last->next;

	/* Now put uid2 in place as part of uid1 */
	last->next=uid1->next;
	uid1->next=uid2;
	delete_kbnode(uid2);

	/* Now dedupe uid1 */
	for(sig1=uid1->next;sig1;sig1=sig1->next)
	{
	kbnode_t sig2;

	if(is_deleted_kbnode(sig1))
	continue;

	if(sig1->pkt->pkttype==PKT_USER_ID
	\|\| sig1->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| sig1->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;

	if(sig1->pkt->pkttype!=PKT_SIGNATURE)
	continue;

	for(sig2=sig1->next,last=sig1;sig2;last=sig2,sig2=sig2->next)
	{
	if(is_deleted_kbnode(sig2))
	continue;

	if(sig2->pkt->pkttype==PKT_USER_ID
	\|\| sig2->pkt->pkttype==PKT_PUBLIC_SUBKEY
	\|\| sig2->pkt->pkttype==PKT_SECRET_SUBKEY)
	break;

	if(sig2->pkt->pkttype!=PKT_SIGNATURE)
	continue;

	if(cmp_signatures(sig1->pkt->pkt.signature,
	sig2->pkt->pkt.signature)==0)
	{
	/* We have a match, so delete the second
	signature */
	delete_kbnode(sig2);
	sig2=last;
	}
	}
	}
	}
	}
	}

	commit_kbnode(keyblock);

	if(any && !opt.quiet)
	{
	const char *key="???";

	if ((uid1 = find_kbnode (*keyblock, PKT_PUBLIC_KEY)) )
	key = keystr_from_pk (uid1->pkt->pkt.public_key);
	else if ((uid1 = find_kbnode( *keyblock, PKT_SECRET_KEY)) )
	key = keystr_from_pk (uid1->pkt->pkt.public_key);

	log_info (_("key %s: duplicated user ID detected - merged\n"), key);
	}

	return any;
	}


	/* Check for a 0x20 revocation from a revocation key that is not
	present. This may be called without the benefit of merge_xxxx so
	you can't rely on pk->revkey and friends. */
	static void
	revocation_present (ctrl_t ctrl, kbnode_t keyblock)
	{
	kbnode_t onode, inode;
	PKT_public_key *pk = keyblock->pkt->pkt.public_key;

	for(onode=keyblock->next;onode;onode=onode->next)
	{
	/* If we reach user IDs, we're done. */
	if(onode->pkt->pkttype==PKT_USER_ID)
	break;

	if (onode->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_SIG (onode->pkt->pkt.signature)
	&& onode->pkt->pkt.signature->revkey)
	{
	int idx;
	PKT_signature *sig=onode->pkt->pkt.signature;

	for(idx=0;idx<sig->numrevkeys;idx++)
	{
	u32 keyid[2];

	keyid_from_fingerprint (ctrl, sig->revkey[idx].fpr,
	sig->revkey[idx].fprlen, keyid);

	for(inode=keyblock->next;inode;inode=inode->next)
	{
	/* If we reach user IDs, we're done. */
	if(inode->pkt->pkttype==PKT_USER_ID)
	break;

	if (inode->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (inode->pkt->pkt.signature)
	&& inode->pkt->pkt.signature->keyid[0]==keyid[0]
	&& inode->pkt->pkt.signature->keyid[1]==keyid[1])
	{
	/* Okay, we have a revocation key, and a
	* revocation issued by it. Do we have the key
	* itself? */
	gpg_error_t err;

	err = get_pubkey_byfprint_fast (ctrl, NULL,
	sig->revkey[idx].fpr,
	sig->revkey[idx].fprlen);
	if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY
	\|\| gpg_err_code (err) == GPG_ERR_UNUSABLE_PUBKEY)
	{
	char *tempkeystr = xstrdup (keystr_from_pk (pk));

	/* No, so try and get it */
	if ((opt.keyserver_options.options
	& KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (ctrl))
	{
	log_info(_("WARNING: key %s may be revoked:"
	" fetching revocation key %s\n"),
	tempkeystr,keystr(keyid));
	keyserver_import_fprint (ctrl,
	sig->revkey[idx].fpr,
	sig->revkey[idx].fprlen,
	opt.keyserver, 0);

	/* Do we have it now? */
	err = get_pubkey_byfprint_fast (ctrl, NULL,
	sig->revkey[idx].fpr,
	sig->revkey[idx].fprlen);
	}

	if (gpg_err_code (err) == GPG_ERR_NO_PUBKEY
	\|\| gpg_err_code (err) == GPG_ERR_UNUSABLE_PUBKEY)
	log_info(_("WARNING: key %s may be revoked:"
	" revocation key %s not present.\n"),
	tempkeystr,keystr(keyid));

	xfree(tempkeystr);
	}
	}
	}
	}
	}
	}
	}


	/*
	* compare and merge the blocks
	*
	* o compare the signatures: If we already have this signature, check
	* that they compare okay; if not, issue a warning and ask the user.
	* o Simply add the signature. Can't verify here because we may not have
	* the signature's public key yet; verification is done when putting it
	* into the trustdb, which is done automagically as soon as this pubkey
	* is used.
	* Note: We indicate newly inserted packets with NODE_FLAG_A.
	*/
	static int
	merge_blocks (ctrl_t ctrl, unsigned int options,
	kbnode_t keyblock_orig, kbnode_t keyblock,
	u32 keyid, u32 curtime, int origin, const char url,
	int n_uids, int n_sigs, int *n_subk )
	{
	kbnode_t onode, node;
	int rc, found;

	/* 1st: handle revocation certificates */
	for (node=keyblock->next; node; node=node->next )
	{
	if (node->pkt->pkttype == PKT_USER_ID )
	break;
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (node->pkt->pkt.signature))
	{
	/* check whether we already have this */
	found = 0;
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (onode->pkt->pkttype == PKT_USER_ID )
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_REV (onode->pkt->pkt.signature)
	&& !cmp_signatures(onode->pkt->pkt.signature,
	node->pkt->pkt.signature))
	{
	found = 1;
	break;
	}
	}
	if (!found)
	{
	kbnode_t n2 = clone_kbnode(node);
	insert_kbnode( keyblock_orig, n2, 0 );
	n2->flag \|= NODE_FLAG_A;
	++*n_sigs;
	if(!opt.quiet)
	{
	char *p = get_user_id_native (ctrl, keyid);
	log_info(_("key %s: \"%s\" revocation"
	" certificate added\n"), keystr(keyid),p);
	xfree(p);
	}
	}
	}
	}

	/* 2nd: merge in any direct key (0x1F) sigs */
	for(node=keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID )
	break;
	else if (node->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_SIG (node->pkt->pkt.signature))
	{
	/* check whether we already have this */
	found = 0;
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (onode->pkt->pkttype == PKT_USER_ID)
	break;
	else if (onode->pkt->pkttype == PKT_SIGNATURE
	&& IS_KEY_SIG (onode->pkt->pkt.signature)
	&& !cmp_signatures(onode->pkt->pkt.signature,
	node->pkt->pkt.signature))
	{
	found = 1;
	break;
	}
	}
	if (!found )
	{
	kbnode_t n2 = clone_kbnode(node);
	insert_kbnode( keyblock_orig, n2, 0 );
	n2->flag \|= NODE_FLAG_A;
	++*n_sigs;
	if(!opt.quiet)
	log_info( _("key %s: direct key signature added\n"),
	keystr(keyid));
	}
	}
	}

	/* 3rd: try to merge new certificates in */
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (!(onode->flag & NODE_FLAG_A) && onode->pkt->pkttype == PKT_USER_ID)
	{
	/* find the user id in the imported keyblock */
	for (node=keyblock->next; node; node=node->next)
	if (node->pkt->pkttype == PKT_USER_ID
	&& !cmp_user_ids( onode->pkt->pkt.user_id,
	node->pkt->pkt.user_id ) )
	break;
	if (node ) /* found: merge */
	{
	rc = merge_sigs (onode, node, n_sigs);
	if (rc )
	return rc;
	}
	}
	}

	/* 4th: add new user-ids */
	for (node=keyblock->next; node; node=node->next)
	{
	if (node->pkt->pkttype == PKT_USER_ID)
	{
	/* do we have this in the original keyblock */
	for (onode=keyblock_orig->next; onode; onode=onode->next )
	if (onode->pkt->pkttype == PKT_USER_ID
	&& !cmp_user_ids( onode->pkt->pkt.user_id,
	node->pkt->pkt.user_id ) )
	break;
	if (!onode ) /* this is a new user id: append */
	{
	rc = append_new_uid (options, keyblock_orig, node,
	curtime, origin, url, n_sigs);
	if (rc )
	return rc;
	++*n_uids;
	}
	}
	}

	/* 5th: add new subkeys */
	for (node=keyblock->next; node; node=node->next)
	{
	onode = NULL;
	if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	/* do we have this in the original keyblock? */
	for(onode=keyblock_orig->next; onode; onode=onode->next)
	if (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
	&& !cmp_public_keys( onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key))
	break;
	if (!onode ) /* This is a new subkey: append. */
	{
	rc = append_key (keyblock_orig, node, n_sigs);
	if (rc)
	return rc;
	++*n_subk;
	}
	}
	else if (node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{
	/* do we have this in the original keyblock? */
	for (onode=keyblock_orig->next; onode; onode=onode->next )
	if (onode->pkt->pkttype == PKT_SECRET_SUBKEY
	&& !cmp_public_keys (onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key) )
	break;
	if (!onode ) /* This is a new subkey: append. */
	{
	rc = append_key (keyblock_orig, node, n_sigs);
	if (rc )
	return rc;
	++*n_subk;
	}
	}
	}

	/* 6th: merge subkey certificates */
	for (onode=keyblock_orig->next; onode; onode=onode->next)
	{
	if (!(onode->flag & NODE_FLAG_A)
	&& (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| onode->pkt->pkttype == PKT_SECRET_SUBKEY))
	{
	/* find the subkey in the imported keyblock */
	for(node=keyblock->next; node; node=node->next)
	{
	if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	&& !cmp_public_keys( onode->pkt->pkt.public_key,
	node->pkt->pkt.public_key ) )
	break;
	}
	if (node) /* Found: merge. */
	{
	rc = merge_keysigs( onode, node, n_sigs);
	if (rc )
	return rc;
	}
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks.
	*
	* Append the new userid starting with NODE and all signatures to
	* KEYBLOCK. ORIGIN and URL conveys the usual key origin info. The
	* integer at N_SIGS is updated with the number of new signatures.
	*/
	static gpg_error_t
	append_new_uid (unsigned int options,
	kbnode_t keyblock, kbnode_t node, u32 curtime,
	int origin, const char url, int n_sigs)
	{
	gpg_error_t err;
	kbnode_t n;
	kbnode_t n_where = NULL;

	log_assert (node->pkt->pkttype == PKT_USER_ID);

	/* Find the right position for the new user id and its signatures. */
	for (n = keyblock; n; n_where = n, n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n->pkt->pkttype == PKT_SECRET_SUBKEY )
	break;
	}
	if (!n)
	n_where = NULL;

	/* and append/insert */
	while (node)
	{
	/* we add a clone to the original keyblock, because this
	* one is released first. */
	n = clone_kbnode(node);
	if (n->pkt->pkttype == PKT_USER_ID
	&& !(options & IMPORT_RESTORE) )
	{
	err = insert_key_origin_uid (n->pkt->pkt.user_id,
	curtime, origin, url);
	if (err)
	return err;
	}

	if (n_where)
	{
	insert_kbnode( n_where, n, 0 );
	n_where = n;
	}
	else
	add_kbnode( keyblock, n );
	n->flag \|= NODE_FLAG_A;
	node->flag \|= NODE_FLAG_A;
	if (n->pkt->pkttype == PKT_SIGNATURE )
	++*n_sigs;

	node = node->next;
	if (node && node->pkt->pkttype != PKT_SIGNATURE )
	break;
	}

	return 0;
	}


	/* Helper function for merge_blocks
	* Merge the sigs from SRC onto DST. SRC and DST are both a PKT_USER_ID.
	* (how should we handle comment packets here?)
	*/
	static int
	merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs)
	{
	kbnode_t n, n2;
	int found = 0;

	log_assert (dst->pkt->pkttype == PKT_USER_ID);
	log_assert (src->pkt->pkttype == PKT_USER_ID);

	for (n=src->next; n && n->pkt->pkttype != PKT_USER_ID; n = n->next)
	{
	if (n->pkt->pkttype != PKT_SIGNATURE )
	continue;
	if (IS_SUBKEY_SIG (n->pkt->pkt.signature)
	\|\| IS_SUBKEY_REV (n->pkt->pkt.signature) )
	continue; /* skip signatures which are only valid on subkeys */

	found = 0;
	for (n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next)
	if (!cmp_signatures(n->pkt->pkt.signature,n2->pkt->pkt.signature))
	{
	found++;
	break;
	}
	if (!found )
	{
	/* This signature is new or newer, append N to DST.
	* We add a clone to the original keyblock, because this
	* one is released first */
	n2 = clone_kbnode(n);
	insert_kbnode( dst, n2, PKT_SIGNATURE );
	n2->flag \|= NODE_FLAG_A;
	n->flag \|= NODE_FLAG_A;
	++*n_sigs;
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks
	* Merge the sigs from SRC onto DST. SRC and DST are both a PKT_xxx_SUBKEY.
	*/
	static int
	merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs)
	{
	kbnode_t n, n2;
	int found = 0;

	log_assert (dst->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| dst->pkt->pkttype == PKT_SECRET_SUBKEY);

	for (n=src->next; n ; n = n->next)
	{
	if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n->pkt->pkttype == PKT_PUBLIC_KEY )
	break;
	if (n->pkt->pkttype != PKT_SIGNATURE )
	continue;

	found = 0;
	for (n2=dst->next; n2; n2 = n2->next)
	{
	if (n2->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| n2->pkt->pkttype == PKT_PUBLIC_KEY )
	break;
	if (n2->pkt->pkttype == PKT_SIGNATURE
	&& (n->pkt->pkt.signature->keyid[0]
	== n2->pkt->pkt.signature->keyid[0])
	&& (n->pkt->pkt.signature->keyid[1]
	== n2->pkt->pkt.signature->keyid[1])
	&& (n->pkt->pkt.signature->timestamp
	<= n2->pkt->pkt.signature->timestamp)
	&& (n->pkt->pkt.signature->sig_class
	== n2->pkt->pkt.signature->sig_class))
	{
	found++;
	break;
	}
	}
	if (!found )
	{
	/* This signature is new or newer, append N to DST.
	* We add a clone to the original keyblock, because this
	* one is released first */
	n2 = clone_kbnode(n);
	insert_kbnode( dst, n2, PKT_SIGNATURE );
	n2->flag \|= NODE_FLAG_A;
	n->flag \|= NODE_FLAG_A;
	++*n_sigs;
	}
	}

	return 0;
	}


	/* Helper function for merge_blocks.
	* Append the subkey starting with NODE and all signatures to KEYBLOCK.
	* Mark all new and copied packets by setting flag bit 0.
	*/
	static int
	append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs)
	{
	kbnode_t n;

	log_assert (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY);

	while (node)
	{
	/* we add a clone to the original keyblock, because this
	* one is released first */
	n = clone_kbnode(node);
	add_kbnode( keyblock, n );
	n->flag \|= NODE_FLAG_A;
	node->flag \|= NODE_FLAG_A;
	if (n->pkt->pkttype == PKT_SIGNATURE )
	++*n_sigs;

	node = node->next;
	if (node && node->pkt->pkttype != PKT_SIGNATURE )
	break;
	}

	return 0;
	}
	diff --git a/g10/keydb.h b/g10/keydb.h
	index 96b22eef2..75d3cd0d5 100644
	--- a/g10/keydb.h
	+++ b/g10/keydb.h
	@@ -1,573 +1,579 @@
	/* keydb.h - Key database
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
	* 2006, 2010 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef G10_KEYDB_H
	#define G10_KEYDB_H

	#include "../common/types.h"
	#include "../common/util.h"
	#include "packet.h"

	/* What qualifies as a certification (key-signature in contrast to a
	* data signature)? Note that a back signature is special and can be
	* made by key and data signatures capable subkeys.) */
	#define IS_CERT(s) (IS_KEY_SIG(s) \
	\|\| IS_UID_SIG(s) \
	\|\| IS_SUBKEY_SIG(s) \
	\|\| IS_KEY_REV(s) \
	\|\| IS_UID_REV(s) \
	\|\| IS_SUBKEY_REV(s) \
	\|\| IS_ATTST_SIGS(s) )
	#define IS_SIG(s) (!IS_CERT(s))
	#define IS_KEY_SIG(s) ((s)->sig_class == 0x1f)
	#define IS_UID_SIG(s) (((s)->sig_class & ~3) == 0x10)
	#define IS_ATTST_SIGS(s) ((s)->sig_class == 0x16)
	#define IS_SUBKEY_SIG(s) ((s)->sig_class == 0x18)
	#define IS_BACK_SIG(s) ((s)->sig_class == 0x19)
	#define IS_KEY_REV(s) ((s)->sig_class == 0x20)
	#define IS_UID_REV(s) ((s)->sig_class == 0x30)
	#define IS_SUBKEY_REV(s) ((s)->sig_class == 0x28)

	struct getkey_ctx_s;
	typedef struct getkey_ctx_s *GETKEY_CTX;
	typedef struct getkey_ctx_s *getkey_ctx_t;

	/****************
	* A Keyblock is all packets which form an entire certificate;
	* i.e. the public key, certificate, trust packets, user ids,
	* signatures, and subkey.
	*
	* This structure is also used to bind arbitrary packets together.
	*/

	struct kbnode_struct
	{
	kbnode_t next;
	PACKET *pkt;
	int flag; /* Local use during keyblock processing (not cloned).*/
	unsigned int tag; /* Ditto. */
	int private_flag;
	};

	#define is_deleted_kbnode(a) ((a)->private_flag & 1)
	#define is_cloned_kbnode(a) ((a)->private_flag & 2)


	/*
	* A structure to store key identification as well as some stuff
	* needed for key validation.
	*/
	struct key_item {
	struct key_item *next;
	unsigned int ownertrust,min_ownertrust;
	byte trust_depth;
	byte trust_value;
	char *trust_regexp;
	u32 kid[2];
	};


	/* Bit flags used with build_pk_list. */
	enum
	{
	PK_LIST_ENCRYPT_TO = 1, /* This is an encrypt-to recipient. */
	PK_LIST_HIDDEN = 2, /* This is a hidden recipient. */
	PK_LIST_CONFIG = 4, /* Specified via config file. */
	PK_LIST_FROM_FILE = 8 /* Take key from file with that name. */
	};

	/* To store private data in the flags the private data must be left
	* shifted by this value. */
	enum
	{
	PK_LIST_SHIFT = 4
	};


	/* Structure to hold a couple of public key certificates. */
	typedef struct pk_list PK_LIST; / Deprecated. */
	typedef struct pk_list *pk_list_t;
	struct pk_list
	{
	PK_LIST next;
	PKT_public_key *pk;
	int flags; /* See PK_LIST_ constants. */
	};

	/* Structure to hold a list of secret key certificates. */
	typedef struct sk_list *SK_LIST;
	struct sk_list
	{
	SK_LIST next;
	PKT_public_key *pk;
	int mark; /* not used */
	};

	/* structure to collect all information which can be used to
	* identify a public key */
	typedef struct pubkey_find_info *PUBKEY_FIND_INFO;
	struct pubkey_find_info {
	u32 keyid[2];
	unsigned nbits;
	byte pubkey_algo;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	char userid[1];
	};


	/* Helper type for preference functions. */
	union pref_hint
	{
	int digest_length;
	};


	/* Constants to describe from where a key was fetched or updated. */
	enum
	{
	KEYORG_UNKNOWN = 0,
	KEYORG_KS = 1, /* Public keyserver. */
	KEYORG_KS_PREF = 2, /* Preferred keysrver. */
	KEYORG_DANE = 3, /* OpenPGP DANE. */
	KEYORG_WKD = 4, /* Web Key Directory. */
	KEYORG_URL = 5, /* Trusted URL. */
	KEYORG_FILE = 6, /* Trusted file. */
	KEYORG_SELF = 7 /* We generated it. */
	};


	/*
	* Check whether the signature SIG is in the klist K.
	*/
	static inline struct key_item *
	is_in_klist (struct key_item k, PKT_signature sig)
	{
	for (; k; k = k->next)
	{
	if (k->kid[0] == sig->keyid[0] && k->kid[1] == sig->keyid[1])
	return k;
	}
	return NULL;
	}


	/-- call-keyboxd.c --/

	/* Release all open contexts to the keyboxd. */
	void gpg_keyboxd_deinit_session_data (ctrl_t ctrl);

	/* Create a new database handle. Returns NULL on error, sets ERRNO,
	* and prints an error diagnostic. */
	KEYDB_HANDLE keydb_new (ctrl_t ctrl);

	/* Release a keydb handle. */
	void keydb_release (KEYDB_HANDLE hd);

	/* Take a lock if we are not using the keyboxd. */
	gpg_error_t keydb_lock (KEYDB_HANDLE hd);

	/* Return the keyblock last found by keydb_search. */
	gpg_error_t keydb_get_keyblock (KEYDB_HANDLE hd, kbnode_t *ret_kb);

	/* Update the keyblock KB. */
	gpg_error_t keydb_update_keyblock (ctrl_t ctrl, KEYDB_HANDLE hd, kbnode_t kb);

	/* Insert a keyblock into one of the storage system. */
	gpg_error_t keydb_insert_keyblock (KEYDB_HANDLE hd, kbnode_t kb);

	/* Delete the currently selected keyblock. */
	gpg_error_t keydb_delete_keyblock (KEYDB_HANDLE hd);

	/* Clears the current search result and resets the handle's position. */
	gpg_error_t keydb_search_reset (KEYDB_HANDLE hd);

	/* Search the database for keys matching the search description. */
	gpg_error_t keydb_search (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc,
	size_t ndesc, size_t *descindex);



	/-- keydb.c --/

	#define KEYDB_RESOURCE_FLAG_PRIMARY 2 /* The primary resource. */
	#define KEYDB_RESOURCE_FLAG_DEFAULT 4 /* The default one. */
	#define KEYDB_RESOURCE_FLAG_READONLY 8 /* Open in read only mode. */
	#define KEYDB_RESOURCE_FLAG_GPGVDEF 16 /* Default file for gpgv. */

	/* Format a search term for debugging output. The caller must free
	the result. */
	char keydb_search_desc_dump (struct keydb_search_desc desc);

	/* Register a resource (keyring or keybox). */
	gpg_error_t keydb_add_resource (const char *url, unsigned int flags);

	/* Dump some statistics to the log. */
	void keydb_dump_stats (void);

	/* Set a flag on the handle to suppress use of cached results. This
	is required for updating a keyring and for key listings. Fixme:
	Using a new parameter for keydb_new might be a better solution. */
	void keydb_disable_caching (KEYDB_HANDLE hd);

	/* Save the last found state and invalidate the current selection. */
	void keydb_push_found_state (KEYDB_HANDLE hd);

	/* Restore the previous save state. */
	void keydb_pop_found_state (KEYDB_HANDLE hd);

	/* Return the file name of the resource. */
	const char *keydb_get_resource_name (KEYDB_HANDLE hd);

	/* Find the first writable resource. */
	gpg_error_t keydb_locate_writable (KEYDB_HANDLE hd);

	/* Rebuild the on-disk caches of all key resources. */
	void keydb_rebuild_caches (ctrl_t ctrl, int noisy);

	/* Return the number of skipped blocks (because they were to large to
	read from a keybox) since the last search reset. */
	unsigned long keydb_get_skipped_counter (KEYDB_HANDLE hd);

	/* Return the first non-legacy key in the database. */
	gpg_error_t keydb_search_first (KEYDB_HANDLE hd);

	/* Return the next key (not the next matching key!). */
	gpg_error_t keydb_search_next (KEYDB_HANDLE hd);

	/* This is a convenience function for searching for keys with a long
	key id. */
	gpg_error_t keydb_search_kid (KEYDB_HANDLE hd, u32 *kid);

	/* This is a convenience function for searching for keys by
	* fingerprint. */
	gpg_error_t keydb_search_fpr (KEYDB_HANDLE hd, const byte *fpr, size_t fprlen);


	/-- pkclist.c --/
	void show_revocation_reason (ctrl_t ctrl, PKT_public_key *pk, int mode );
	int check_signatures_trust (ctrl_t ctrl, PKT_signature *sig);

	void release_pk_list (PK_LIST pk_list);
	int expand_id (const char id, strlist_t into, unsigned int flags);
	strlist_t expand_group (strlist_t input, int prepend_input);
	int build_pk_list (ctrl_t ctrl, strlist_t rcpts, PK_LIST *ret_pk_list);
	gpg_error_t find_and_check_key (ctrl_t ctrl,
	const char *name, unsigned int use,
	int mark_hidden, int from_file,
	pk_list_t *pk_list_addr);

	int algo_available( preftype_t preftype, int algo,
	const union pref_hint *hint );
	int select_algo_from_prefs( PK_LIST pk_list, int preftype,
	int request, const union pref_hint *hint);
	int select_mdc_from_pklist (PK_LIST pk_list);
	aead_algo_t select_aead_from_pklist (pk_list_t pk_list);
	void warn_missing_aead_from_pklist (PK_LIST pk_list);
	void warn_missing_aes_from_pklist (PK_LIST pk_list);

	/-- skclist.c --/
	int random_is_faked (void);
	void release_sk_list( SK_LIST sk_list );
	gpg_error_t build_sk_list (ctrl_t ctrl, strlist_t locusr,
	SK_LIST *ret_sk_list, unsigned use);

	/-- passphrase.h --/
	int have_static_passphrase(void);
	const char *get_static_passphrase (void);
	void set_passphrase_from_string(const char *pass);
	void read_passphrase_from_fd( int fd );
	void passphrase_clear_cache (const char *cacheid);
	DEK passphrase_to_dek_ext(u32 keyid, int pubkey_algo,
	int cipher_algo, STRING2KEY *s2k, int mode,
	const char *tryagain_text,
	const char custdesc, const char custprompt,
	int *canceled);
	DEK passphrase_to_dek (int cipher_algo, STRING2KEY s2k,
	int create, int nocache,
	const char tryagain_text, int canceled);
	void set_next_passphrase( const char *s );
	char *get_last_passphrase(void);
	void next_to_last_passphrase(void);

	void emit_status_need_passphrase (ctrl_t ctrl, u32 *keyid,
	u32 *mainkeyid, int pubkey_algo);

	#define FORMAT_KEYDESC_NORMAL 0
	#define FORMAT_KEYDESC_IMPORT 1
	#define FORMAT_KEYDESC_EXPORT 2
	#define FORMAT_KEYDESC_DELKEY 3
	char *gpg_format_keydesc (ctrl_t ctrl,
	PKT_public_key *pk, int mode, int escaped);


	/-- getkey.c --/

	/* Cache a copy of a public key in the public key cache. */
	void cache_public_key( PKT_public_key *pk );

	/* Disable and drop the public key cache. */
	void getkey_disable_caches(void);

	/* Return the public key used for signature SIG and store it at PK. */
	gpg_error_t get_pubkey_for_sig (ctrl_t ctrl,
	- PKT_public_key pk, PKT_signature sig);
	+ PKT_public_key pk, PKT_signature sig,
	+ PKT_public_key *forced_pk);

	/* Return the public key with the key id KEYID and store it at PK. */
	int get_pubkey (ctrl_t ctrl, PKT_public_key pk, u32 keyid);

	/* Similar to get_pubkey, but it does not take PK->REQ_USAGE into
	account nor does it merge in the self-signed data. This function
	also only considers primary keys. */
	int get_pubkey_fast (ctrl_t ctrl, PKT_public_key pk, u32 keyid);

	/* Return the entire keyblock used to create SIG. This is a
	* specialized version of get_pubkeyblock. */
	kbnode_t get_pubkeyblock_for_sig (ctrl_t ctrl, PKT_signature *sig);

	/* Return the key block for the key with KEYID. */
	kbnode_t get_pubkeyblock (ctrl_t ctrl, u32 *keyid);

	/* A list used by get_pubkeys to gather all of the matches. */
	struct pubkey_s
	{
	struct pubkey_s *next;
	/* The key to use (either the public key or the subkey). */
	PKT_public_key *pk;
	kbnode_t keyblock;
	};
	typedef struct pubkey_s *pubkey_t;

	/* Free a list of public keys. */
	void pubkeys_free (pubkey_t keys);


	/* Mode flags for get_pubkey_byname. */
	enum get_pubkey_modes
	{
	GET_PUBKEY_NORMAL = 0,
	GET_PUBKEY_NO_AKL = 1,
	GET_PUBKEY_NO_LOCAL = 2
	};

	/* Find a public key identified by NAME. */
	int get_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char *name,
	KBNODE ret_keyblock, KEYDB_HANDLE ret_kdbhd,
	int include_unusable);

	/* Likewise, but only return the best match if NAME resembles a mail
	* address. */
	gpg_error_t get_best_pubkey_byname (ctrl_t ctrl, enum get_pubkey_modes mode,
	GETKEY_CTX retctx, PKT_public_key pk,
	const char name, KBNODE ret_keyblock,
	int include_unusable);

	/* Get a public key directly from file FNAME. */
	gpg_error_t get_pubkey_fromfile (ctrl_t ctrl,
	PKT_public_key pk, const char fname);

	+/* Get a public key from a buffer. */
	+gpg_error_t get_pubkey_from_buffer (ctrl_t ctrl, PKT_public_key *pkbuf,
	+ const void *buffer, size_t buflen,
	+ u32 want_keyid, kbnode_t r_keyblock);
	+
	/* Return the public key with the key id KEYID iff the secret key is
	* available and store it at PK. */
	gpg_error_t get_seckey (ctrl_t ctrl, PKT_public_key pk, u32 keyid);

	/* Lookup a key with the specified fingerprint. */
	int get_pubkey_byfprint (ctrl_t ctrl, PKT_public_key pk, kbnode_t r_keyblock,
	const byte *fprint, size_t fprint_len);

	/* This function is similar to get_pubkey_byfprint, but it doesn't
	merge the self-signed data into the public key and subkeys or into
	the user ids. */
	gpg_error_t get_pubkey_byfprint_fast (ctrl_t ctrl, PKT_public_key *pk,
	const byte *fprint, size_t fprint_len);

	/* This function is similar to get_pubkey_byfprint, but it doesn't
	merge the self-signed data into the public key and subkeys or into
	the user ids. */
	gpg_error_t get_keyblock_byfprint_fast (ctrl_t ctrl,
	kbnode_t *r_keyblock,
	KEYDB_HANDLE *r_hd,
	const byte *fprint, size_t fprint_len,
	int lock);


	/* Returns true if a secret key is available for the public key with
	key id KEYID. */
	int have_secret_key_with_kid (ctrl_t ctrl, u32 *keyid);

	/* Parse the --default-key parameter. Returns the last key (in terms
	of when the option is given) that is available. */
	const char *parse_def_secret_key (ctrl_t ctrl);

	/* Look up a secret key. */
	gpg_error_t get_seckey_default (ctrl_t ctrl, PKT_public_key *pk);
	gpg_error_t get_seckey_default_or_card (ctrl_t ctrl, PKT_public_key *pk,
	const byte *fpr, size_t fpr_len);

	/* Search for keys matching some criteria. */
	gpg_error_t getkey_bynames (ctrl_t ctrl,
	getkey_ctx_t retctx, PKT_public_key pk,
	strlist_t names, int want_secret,
	kbnode_t *ret_keyblock);

	/* Search for one key matching some criteria. */
	gpg_error_t getkey_byname (ctrl_t ctrl,
	getkey_ctx_t retctx, PKT_public_key pk,
	const char *name, int want_secret,
	kbnode_t *ret_keyblock);

	/* Return the next search result. */
	gpg_error_t getkey_next (ctrl_t ctrl, getkey_ctx_t ctx,
	PKT_public_key pk, kbnode_t ret_keyblock);

	/* Release any resources used by a key listing context. */
	void getkey_end (ctrl_t ctrl, getkey_ctx_t ctx);

	/* Return the database handle used by this context. The context still
	owns the handle. */
	KEYDB_HANDLE get_ctx_handle(GETKEY_CTX ctx);

	/* Enumerate some secret keys. */
	gpg_error_t enum_secret_keys (ctrl_t ctrl, void *context, PKT_public_key pk);

	/* Set the mainkey_id fields for all keys in KEYBLOCK. */
	void setup_main_keyids (kbnode_t keyblock);

	/* This function merges information from the self-signed data into the
	data structures. */
	void merge_keys_and_selfsig (ctrl_t ctrl, kbnode_t keyblock);

	char get_user_id_string_native (ctrl_t ctrl, u32 keyid);
	char get_long_user_id_string (ctrl_t ctrl, u32 keyid);
	char get_user_id (ctrl_t ctrl, u32 keyid, size_t rn, int r_nouid);
	char get_user_id_native (ctrl_t ctrl, u32 keyid);
	char get_user_id_byfpr_native (ctrl_t ctrl, const byte fpr, size_t fprlen);

	void release_akl(void);
	int akl_empty_or_only_local (void);
	int parse_auto_key_locate(const char *options);
	int parse_key_origin (char *string);
	const char *key_origin_string (int origin);

	/-- keyid.c --/
	int pubkey_letter( int algo );
	char pubkey_string (PKT_public_key pk, char *buffer, size_t bufsize);
	#define PUBKEY_STRING_SIZE 32
	u32 v3_keyid (gcry_mpi_t a, u32 *ki);
	void hash_public_key( gcry_md_hd_t md, PKT_public_key *pk );
	char format_keyid (u32 keyid, int format, char *buffer, int len);

	/* Return PK's keyid. The memory is owned by PK. */
	u32 pk_keyid (PKT_public_key pk);

	/* Return the keyid of the primary key associated with PK. The memory
	is owned by PK. */
	u32 pk_main_keyid (PKT_public_key pk);

	/* Order A and B. If A < B then return -1, if A == B then return 0,
	and if A > B then return 1. */
	static int GPGRT_ATTR_UNUSED
	keyid_cmp (const u32 a, const u32 b)
	{
	if (a[0] < b[0])
	return -1;
	if (a[0] > b[0])
	return 1;
	if (a[1] < b[1])
	return -1;
	if (a[1] > b[1])
	return 1;
	return 0;
	}

	/* Return whether PK is a primary key. */
	static int GPGRT_ATTR_UNUSED
	pk_is_primary (PKT_public_key *pk)
	{
	return keyid_cmp (pk_keyid (pk), pk_main_keyid (pk)) == 0;
	}

	/* Copy the keyid in SRC to DEST and return DEST. */
	u32 keyid_copy (u32 dest, const u32 *src);

	size_t keystrlen(void);
	const char keystr(u32 keyid);
	const char keystr_with_sub (u32 main_kid, u32 *sub_kid);
	const char keystr_from_pk(PKT_public_key pk);
	const char keystr_from_pk_with_sub (PKT_public_key main_pk,
	PKT_public_key *sub_pk);

	/* Return PK's key id as a string using the default format. PK owns
	the storage. */
	const char pk_keyid_str (PKT_public_key pk);

	const char keystr_from_desc(KEYDB_SEARCH_DESC desc);
	u32 keyid_from_pk( PKT_public_key pk, u32 keyid );
	u32 keyid_from_sig (PKT_signature sig, u32 keyid );
	u32 keyid_from_fingerprint (ctrl_t ctrl, const byte *fprint, size_t fprint_len,
	u32 *keyid);
	byte namehash_from_uid(PKT_user_id uid);
	unsigned nbits_from_pk( PKT_public_key *pk );

	/* Convert an UTC TIMESTAMP into an UTC yyyy-mm-dd string. Return
	* that string. The caller should pass a buffer with at least a size
	* of MK_DATESTR_SIZE. */
	char mk_datestr (char buffer, size_t bufsize, u32 timestamp);
	#define MK_DATESTR_SIZE 11

	const char dateonlystr_from_pk (PKT_public_key pk);
	const char datestr_from_pk( PKT_public_key pk );
	const char dateonlystr_from_sig( PKT_signature sig );
	const char datestr_from_sig( PKT_signature sig );
	const char expirestr_from_pk( PKT_public_key pk );
	const char expirestr_from_sig( PKT_signature sig );
	const char revokestr_from_pk( PKT_public_key pk );
	const char usagestr_from_pk (PKT_public_key pk, int fill);
	const char *colon_strtime (u32 t);
	const char colon_datestr_from_pk (PKT_public_key pk);
	const char colon_datestr_from_sig (PKT_signature sig);
	const char colon_expirestr_from_sig (PKT_signature sig);
	byte fingerprint_from_pk( PKT_public_key pk, byte buf, size_t ret_len );
	char hexfingerprint (PKT_public_key pk, char *buffer, size_t buflen);
	char format_hexfingerprint (const char fingerprint,
	char *buffer, size_t buflen);
	gpg_error_t keygrip_from_pk (PKT_public_key pk, unsigned char array);
	gpg_error_t hexkeygrip_from_pk (PKT_public_key pk, char *r_grip);


	/-- kbnode.c --/
	KBNODE new_kbnode( PACKET *pkt );
	KBNODE clone_kbnode( KBNODE node );
	void release_kbnode( KBNODE n );
	void delete_kbnode( KBNODE node );
	void add_kbnode( KBNODE root, KBNODE node );
	void insert_kbnode( KBNODE root, KBNODE node, int pkttype );
	void move_kbnode( KBNODE *root, KBNODE node, KBNODE where );
	void remove_kbnode( KBNODE *root, KBNODE node );
	KBNODE find_prev_kbnode( KBNODE root, KBNODE node, int pkttype );
	KBNODE find_next_kbnode( KBNODE node, int pkttype );
	KBNODE find_kbnode( KBNODE node, int pkttype );
	KBNODE walk_kbnode( KBNODE root, KBNODE *context, int all );
	void clear_kbnode_flags( KBNODE n );
	int commit_kbnode( KBNODE *root );
	void dump_kbnode( KBNODE node );

	#endif /G10_KEYDB_H/
	diff --git a/g10/main.h b/g10/main.h
	index 3b44b16c6..35b84618a 100644
	--- a/g10/main.h
	+++ b/g10/main.h
	@@ -1,523 +1,525 @@
	/* main.h
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/
	#ifndef G10_MAIN_H
	#define G10_MAIN_H

	#include "../common/types.h"
	#include "../common/iobuf.h"
	#include "../common/util.h"
	#include "keydb.h"
	#include "keyedit.h"

	/* It could be argued that the default cipher should be 3DES rather
	than AES128, and the default compression should be 0
	(i.e. uncompressed) rather than 1 (zip). However, the real world
	issues of speed and size come into play here. */

	#if GPG_USE_AES256
	# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_AES256
	#elif GPG_USE_AES128
	# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_AES
	#elif GPG_USE_CAST5
	# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_CAST5
	#else
	# define DEFAULT_CIPHER_ALGO CIPHER_ALGO_3DES
	#endif

	/* We will start using OCB mode by default only if the yet to be
	* released libgcrypt 1.9 is used. */
	#if GCRYPT_VERSION_NUMBER < 0x010900
	# define DEFAULT_AEAD_ALGO AEAD_ALGO_OCB
	#else
	# define DEFAULT_AEAD_ALGO AEAD_ALGO_EAX
	#endif

	#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1)
	#define DEFAULT_S2K_DIGEST_ALGO DIGEST_ALGO_SHA1
	#ifdef HAVE_ZIP
	# define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_ZIP
	#else
	# define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_NONE
	#endif


	#define S2K_DIGEST_ALGO (opt.s2k_digest_algo?opt.s2k_digest_algo:DEFAULT_S2K_DIGEST_ALGO)


	/* Various data objects. */

	typedef struct
	{
	ctrl_t ctrl;
	int header_okay;
	PK_LIST pk_list;
	DEK *symkey_dek;
	STRING2KEY *symkey_s2k;
	cipher_filter_context_t cfx;
	} encrypt_filter_context_t;


	struct groupitem
	{
	char *name;
	strlist_t values;
	struct groupitem *next;
	};

	struct weakhash
	{
	enum gcry_md_algos algo;
	int rejection_shown;
	struct weakhash *next;
	};


	/-- gpg.c --/
	extern int g10_errors_seen;

	#if __GNUC__ > 2 \|\| (__GNUC__ == 2 && __GNUC_MINOR__ >= 5 )
	void g10_exit(int rc) __attribute__ ((noreturn));
	#else
	void g10_exit(int rc);
	#endif
	void print_pubkey_algo_note (pubkey_algo_t algo);
	void print_cipher_algo_note (cipher_algo_t algo);
	void print_digest_algo_note (digest_algo_t algo);
	void print_digest_rejected_note (enum gcry_md_algos algo);
	void print_sha1_keysig_rejected_note (void);
	void print_reported_error (gpg_error_t err, gpg_err_code_t skip_if_ec);
	void print_further_info (const char *format, ...) GPGRT_ATTR_PRINTF(1,2);
	void additional_weak_digest (const char* digestname);

	/-- armor.c --/
	char make_radix64_string( const byte data, size_t len );

	/-- misc.c --/
	void trap_unaligned(void);
	void register_secured_file (const char *fname);
	void unregister_secured_file (const char *fname);
	int is_secured_file (int fd);
	int is_secured_filename (const char *fname);
	u16 checksum_u16( unsigned n );
	u16 checksum( byte *p, unsigned n );
	u16 checksum_mpi( gcry_mpi_t a );
	u32 buffer_to_u32( const byte *buffer );
	const byte get_session_marker( size_t rlen );

	enum gcry_cipher_algos map_cipher_openpgp_to_gcry (cipher_algo_t algo);
	#define openpgp_cipher_open(_a,_b,_c,_d) \
	gcry_cipher_open((_a),map_cipher_openpgp_to_gcry((_b)),(_c),(_d))
	#define openpgp_cipher_get_algo_keylen(_a) \
	gcry_cipher_get_algo_keylen(map_cipher_openpgp_to_gcry((_a)))
	#define openpgp_cipher_get_algo_blklen(_a) \
	gcry_cipher_get_algo_blklen(map_cipher_openpgp_to_gcry((_a)))
	int openpgp_cipher_blocklen (cipher_algo_t algo);
	int openpgp_cipher_test_algo(cipher_algo_t algo);
	const char *openpgp_cipher_algo_name (cipher_algo_t algo);

	gpg_error_t openpgp_aead_test_algo (aead_algo_t algo);
	const char *openpgp_aead_algo_name (aead_algo_t algo);
	gpg_error_t openpgp_aead_algo_info (aead_algo_t algo,
	enum gcry_cipher_modes *r_mode,
	unsigned int *r_noncelen);

	int openpgp_pk_test_algo (pubkey_algo_t algo);
	int openpgp_pk_test_algo2 (pubkey_algo_t algo, unsigned int use);
	int openpgp_pk_algo_usage ( int algo );
	const char *openpgp_pk_algo_name (pubkey_algo_t algo);

	enum gcry_md_algos map_md_openpgp_to_gcry (digest_algo_t algo);
	int openpgp_md_test_algo (digest_algo_t algo);
	const char *openpgp_md_algo_name (int algo);

	struct expando_args
	{
	PKT_public_key *pk;
	PKT_public_key *pksk;
	byte imagetype;
	int validity_info;
	const char *validity_string;
	const byte *namehash;
	};

	char pct_expando (ctrl_t ctrl, const char string,struct expando_args *args);
	void deprecated_warning(const char *configname,unsigned int configlineno,
	const char option,const char repl1,const char *repl2);
	void deprecated_command (const char *name);
	void obsolete_scdaemon_option (const char *configname,
	unsigned int configlineno, const char *name);

	int string_to_cipher_algo (const char *string);
	aead_algo_t string_to_aead_algo (const char *string);
	int string_to_digest_algo (const char *string);

	const char *compress_algo_to_string(int algo);
	int string_to_compress_algo(const char *string);
	int check_compress_algo(int algo);
	int default_cipher_algo(void);
	aead_algo_t default_aead_algo(void);
	int default_compress_algo(void);
	void compliance_failure(void);

	struct parse_options
	{
	char *name;
	unsigned int bit;
	char **value;
	char *help;
	};

	char optsep(char *stringp);
	char argsplit(char string);
	int parse_options(char str,unsigned int options,
	struct parse_options *opts,int noisy);
	const char *get_libexecdir (void);
	int path_access(const char *file,int mode);

	int pubkey_get_npkey (pubkey_algo_t algo);
	int pubkey_get_nskey (pubkey_algo_t algo);
	int pubkey_get_nsig (pubkey_algo_t algo);
	int pubkey_get_nenc (pubkey_algo_t algo);

	/* Temporary helpers. */
	unsigned int pubkey_nbits( int algo, gcry_mpi_t *pkey );
	int mpi_print (estream_t stream, gcry_mpi_t a, int mode);
	unsigned int ecdsa_qbits_from_Q (unsigned int qbits);


	/-- cpr.c --/
	void set_status_fd ( int fd );
	int is_status_enabled ( void );
	void write_status ( int no );
	void write_status_error (const char *where, gpg_error_t err);
	void write_status_errcode (const char *where, int errcode);
	void write_status_failure (const char *where, gpg_error_t err);
	void write_status_text ( int no, const char *text );
	void write_status_printf (int no, const char *format,
	...) GPGRT_ATTR_PRINTF(2,3);
	void write_status_strings (int no, const char *text,
	...) GPGRT_ATTR_SENTINEL(0);
	void write_status_buffer ( int no,
	const char *buffer, size_t len, int wrap );
	void write_status_text_and_buffer ( int no, const char *text,
	const char *buffer, size_t len, int wrap );

	void write_status_begin_signing (gcry_md_hd_t md);


	int cpr_enabled(void);
	char cpr_get( const char keyword, const char *prompt );
	char cpr_get_no_help( const char keyword, const char *prompt );
	char cpr_get_utf8( const char keyword, const char *prompt );
	char cpr_get_hidden( const char keyword, const char *prompt );
	void cpr_kill_prompt(void);
	int cpr_get_answer_is_yes_def (const char keyword, const char prompt,
	int def_yes);
	int cpr_get_answer_is_yes( const char keyword, const char prompt );
	int cpr_get_answer_yes_no_quit( const char keyword, const char prompt );
	int cpr_get_answer_okay_cancel (const char *keyword,
	const char *prompt,
	int def_answer);

	/-- helptext.c --/
	void display_online_help( const char *keyword );

	/-- encode.c --/
	int setup_symkey (STRING2KEY symkey_s2k,DEK symkey_dek);
	gpg_error_t encrypt_seskey (DEK dek, aead_algo_t aead_algo, DEK *r_seskey,
	void *r_enckey, size_t r_enckeylen);
	aead_algo_t use_aead (pk_list_t pk_list, int algo);
	int use_mdc (pk_list_t pk_list,int algo);
	int encrypt_symmetric (const char *filename );
	int encrypt_store (const char *filename );
	int encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
	strlist_t remusr, int use_symkey, pk_list_t provided_keys,
	int outputfd);
	void encrypt_crypt_files (ctrl_t ctrl,
	int nfiles, char **files, strlist_t remusr);
	int encrypt_filter (void *opaque, int control,
	iobuf_t a, byte buf, size_t ret_len);

	int write_pubkey_enc (ctrl_t ctrl, PKT_public_key *pk, int throw_keyid,
	DEK *dek, iobuf_t out);

	/-- sign.c --/
	int sign_file (ctrl_t ctrl, strlist_t filenames, int detached, strlist_t locusr,
	int do_encrypt, strlist_t remusr, const char *outfile );
	int clearsign_file (ctrl_t ctrl,
	const char fname, strlist_t locusr, const char outfile);
	int sign_symencrypt_file (ctrl_t ctrl, const char *fname, strlist_t locusr);

	/-- sig-check.c --/
	void sig_check_dump_stats (void);

	/* SIG is a revocation signature. Check if any of PK's designated
	revokers generated it. If so, return 0. Note: this function
	(correctly) doesn't care if the designated revoker is revoked. */
	int check_revocation_keys (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig);
	/* Check that the backsig BACKSIG from the subkey SUB_PK to its
	primary key MAIN_PK is valid. */
	int check_backsig(PKT_public_key main_pk,PKT_public_key sub_pk,
	PKT_signature *backsig);
	/* Check that the signature SIG over a key (e.g., a key binding or a
	key revocation) is valid. (To check signatures over data, use
	check_signature.) */
	int check_key_signature (ctrl_t ctrl, kbnode_t root, kbnode_t sig,
	int *is_selfsig );
	/* Like check_key_signature, but with the ability to specify some
	additional parameters and get back additional information. See the
	documentation for the implementation for details. */
	int check_key_signature2 (ctrl_t ctrl, kbnode_t root, kbnode_t node,
	PKT_public_key check_pk, PKT_public_key ret_pk,
	int is_selfsig, u32 r_expiredate, int *r_expired);

	/* Returns whether SIGNER generated the signature SIG over the packet
	PACKET, which is a key, subkey or uid, and comes from the key block
	KB. If SIGNER is NULL, it is looked up based on the information in
	SIG. If not NULL, sets *IS_SELFSIG to indicate whether the
	signature is a self-signature and *RET_PK to a copy of the signer's
	key. */
	gpg_error_t check_signature_over_key_or_uid (ctrl_t ctrl,
	PKT_public_key *signer,
	PKT_signature *sig,
	KBNODE kb, PACKET *packet,
	int *is_selfsig,
	PKT_public_key *ret_pk);


	/-- delkey.c --/
	gpg_error_t delete_keys (ctrl_t ctrl,
	strlist_t names, int secret, int allow_both);

	/-- keygen.c --/
	const char *get_default_pubkey_algo (void);
	u32 parse_expire_string(const char *string);
	u32 ask_expire_interval(int object,const char *def_expire);
	u32 ask_expiredate(void);
	unsigned int ask_key_flags (int algo, int subkey, unsigned int current);
	const char ask_curve (int algo, int subkey_algo, const char current);
	void quick_generate_keypair (ctrl_t ctrl, const char uid, const char algostr,
	const char usagestr, const char expirestr);
	void generate_keypair (ctrl_t ctrl, int full, const char *fname,
	const char *card_serialno, int card_backup_key);
	int keygen_set_std_prefs (const char *string,int personal);
	PKT_user_id *keygen_get_std_prefs (void);
	int keygen_add_key_expire( PKT_signature sig, void opaque );
	int keygen_add_key_flags (PKT_signature sig, void opaque);
	int keygen_add_std_prefs( PKT_signature sig, void opaque );
	int keygen_upd_std_prefs( PKT_signature sig, void opaque );
	int keygen_add_keyserver_url(PKT_signature sig, void opaque);
	int keygen_add_notations(PKT_signature sig,void opaque);
	int keygen_add_revkey(PKT_signature sig, void opaque);
	gpg_error_t make_backsig (ctrl_t ctrl,
	PKT_signature sig, PKT_public_key pk,
	PKT_public_key sub_pk, PKT_public_key sub_psk,
	u32 timestamp, const char *cache_nonce);
	gpg_error_t generate_subkeypair (ctrl_t ctrl, kbnode_t keyblock,
	const char *algostr,
	const char *usagestr,
	const char *expirestr);
	#ifdef ENABLE_CARD_SUPPORT
	gpg_error_t generate_card_subkeypair (ctrl_t ctrl, kbnode_t pub_keyblock,
	int keyno, const char *serialno);
	#endif


	/-- openfile.c --/
	int overwrite_filep( const char *fname );
	char make_outfile_name( const char iname );
	char ask_outfile_name( const char name, size_t namelen );
	int open_outfile (int out_fd, const char *iname, int mode,
	int restrictedperm, iobuf_t *a);
	char get_matching_datafile (const char sigfilename);
	iobuf_t open_sigfile (const char sigfilename, progress_filter_context_t pfx);
	void try_make_homedir( const char *fname );
	char get_openpgp_revocdir (const char home);

	/-- seskey.c --/
	void make_session_key( DEK *dek );
	gcry_mpi_t encode_session_key( int openpgp_pk_algo, DEK *dek, unsigned nbits );
	gcry_mpi_t encode_md_value (PKT_public_key *pk,
	gcry_md_hd_t md, int hash_algo );

	/-- import.c --/
	struct import_stats_s;
	typedef struct import_stats_s *import_stats_t;
	struct import_filter_s;
	typedef struct import_filter_s *import_filter_t;
	typedef gpg_error_t (import_screener_t)(kbnode_t keyblock, void arg);

	int parse_import_options(char str,unsigned int options,int noisy);

	gpg_error_t parse_and_set_import_filter (const char *string);
	import_filter_t save_and_clear_import_filter (void);
	void restore_import_filter (import_filter_t filt);

	-gpg_error_t read_key_from_file (ctrl_t ctrl, const char *fname,
	- kbnode_t *r_keyblock);
	+gpg_error_t read_key_from_file_or_buffer (ctrl_t ctrl, const char *fname,
	+ const void *buffer, size_t buflen,
	+ kbnode_t *r_keyblock);
	+gpg_error_t import_included_key_block (ctrl_t ctrl, kbnode_t keyblock);
	void import_keys (ctrl_t ctrl, char **fnames, int nnames,
	import_stats_t stats_hd, unsigned int options,
	int origin, const char *url);
	gpg_error_t import_keys_es_stream (ctrl_t ctrl, estream_t fp,
	import_stats_t stats_handle,
	unsigned char *fpr, size_t fpr_len,
	unsigned int options,
	import_screener_t screener, void *screener_arg,
	int origin, const char *url);
	gpg_error_t import_old_secring (ctrl_t ctrl, const char *fname);
	import_stats_t import_new_stats_handle (void);
	void import_release_stats_handle (import_stats_t hd);
	void import_print_stats (import_stats_t hd);
	/* Communication for impex_filter_getval */
	struct impex_filter_parm_s
	{
	ctrl_t ctrl;
	kbnode_t node;
	char hexfpr[2*MAX_FINGERPRINT_LEN + 1];
	};

	const char impex_filter_getval (void cookie, const char *propname);
	gpg_error_t transfer_secret_keys (ctrl_t ctrl, struct import_stats_s *stats,
	kbnode_t sec_keyblock, int batch, int force,
	int only_marked);

	int collapse_uids( KBNODE *keyblock );

	int get_revocation_reason (PKT_signature sig, char *r_reason,
	char *r_comment, size_t r_commentlen);


	/-- export.c --/
	struct export_stats_s;
	typedef struct export_stats_s *export_stats_t;

	export_stats_t export_new_stats (void);
	void export_release_stats (export_stats_t stats);
	void export_print_stats (export_stats_t stats);

	int parse_export_options(char str,unsigned int options,int noisy);
	gpg_error_t parse_and_set_export_filter (const char *string);
	void push_export_filters (void);
	void pop_export_filters (void);

	int exact_subkey_match_p (KEYDB_SEARCH_DESC *desc, kbnode_t node);

	int export_pubkeys (ctrl_t ctrl, strlist_t users, unsigned int options,
	export_stats_t stats);
	int export_seckeys (ctrl_t ctrl, strlist_t users, unsigned int options,
	export_stats_t stats);
	int export_secsubkeys (ctrl_t ctrl, strlist_t users, unsigned int options,
	export_stats_t stats);

	gpg_error_t export_pubkey_buffer (ctrl_t ctrl, const char *keyspec,
	unsigned int options,
	const void *prefix, size_t prefixlen,
	export_stats_t stats,
	kbnode_t *r_keyblock,
	void *r_data, size_t r_datalen);

	gpg_error_t receive_seckey_from_agent (ctrl_t ctrl, gcry_cipher_hd_t cipherhd,
	int cleartext,
	char **cache_nonce_addr,
	const char *hexgrip,
	PKT_public_key *pk);

	gpg_error_t write_keyblock_to_output (kbnode_t keyblock,
	int with_armor, unsigned int options);

	gpg_error_t export_ssh_key (ctrl_t ctrl, const char *userid);

	/-- dearmor.c --/
	int dearmor_file( const char *fname );
	int enarmor_file( const char *fname );

	/-- revoke.c --/
	struct revocation_reason_info;

	int gen_standard_revoke (ctrl_t ctrl,
	PKT_public_key psk, const char cache_nonce);
	int gen_revoke (ctrl_t ctrl, const char *uname);
	int gen_desig_revoke (ctrl_t ctrl, const char *uname, strlist_t locusr);
	int revocation_reason_build_cb( PKT_signature sig, void opaque );
	struct revocation_reason_info *
	ask_revocation_reason( int key_rev, int cert_rev, int hint );
	struct revocation_reason_info * get_default_uid_revocation_reason(void);
	void release_revocation_reason_info( struct revocation_reason_info *reason );

	/-- keylist.c --/
	void public_key_list (ctrl_t ctrl, strlist_t list,
	int locate_mode, int no_local);
	void secret_key_list (ctrl_t ctrl, strlist_t list );
	void print_subpackets_colon(PKT_signature *sig);
	void reorder_keyblock (KBNODE keyblock);
	void list_keyblock_direct (ctrl_t ctrl, kbnode_t keyblock, int secret,
	int has_secret, int fpr, int no_validity);
	void print_fingerprint (ctrl_t ctrl, estream_t fp,
	PKT_public_key *pk, int mode);
	void print_revokers (estream_t fp, PKT_public_key *pk);
	void show_policy_url(PKT_signature *sig,int indent,int mode);
	void show_keyserver_url(PKT_signature *sig,int indent,int mode);
	void show_notation(PKT_signature *sig,int indent,int mode,int which);
	void dump_attribs (const PKT_user_id uid, PKT_public_key pk);
	void set_attrib_fd(int fd);
	void print_key_info (ctrl_t ctrl, estream_t fp, int indent,
	PKT_public_key *pk, int secret);
	void print_key_info_log (ctrl_t ctrl, int loglevel, int indent,
	PKT_public_key *pk, int secret);
	void print_card_key_info (estream_t fp, KBNODE keyblock);
	void print_key_line (ctrl_t ctrl, estream_t fp, PKT_public_key *pk, int secret);

	/-- verify.c --/
	void print_file_status( int status, const char *name, int what );
	int verify_signatures (ctrl_t ctrl, int nfiles, char **files );
	int verify_files (ctrl_t ctrl, int nfiles, char **files );
	int gpg_verify (ctrl_t ctrl, int sig_fd, int data_fd, estream_t out_fp);

	/-- decrypt.c --/
	int decrypt_message (ctrl_t ctrl, const char *filename );
	gpg_error_t decrypt_message_fd (ctrl_t ctrl, int input_fd, int output_fd);
	void decrypt_messages (ctrl_t ctrl, int nfiles, char *files[]);

	/-- plaintext.c --/
	int hash_datafiles( gcry_md_hd_t md, gcry_md_hd_t md2,
	strlist_t files, const char *sigfilename, int textmode);
	int hash_datafile_by_fd ( gcry_md_hd_t md, gcry_md_hd_t md2, int data_fd,
	int textmode );
	PKT_plaintext setup_plaintext_name(const char filename,IOBUF iobuf);

	/-- server.c --/
	int gpg_server (ctrl_t);
	gpg_error_t gpg_proxy_pinentry_notify (ctrl_t ctrl,
	const unsigned char *line);

	#ifdef ENABLE_CARD_SUPPORT
	/-- card-util.c --/
	void change_pin (int no, int allow_admin);
	void card_status (ctrl_t ctrl, estream_t fp, const char *serialno);
	void card_edit (ctrl_t ctrl, strlist_t commands);
	gpg_error_t card_generate_subkey (ctrl_t ctrl, kbnode_t pub_keyblock);
	int card_store_subkey (KBNODE node, int use);
	#endif

	/-- migrate.c --/
	void migrate_secring (ctrl_t ctrl);


	#endif /G10_MAIN_H/
	diff --git a/g10/mainproc.c b/g10/mainproc.c
	index c12039e6d..ffde748c0 100644
	--- a/g10/mainproc.c
	+++ b/g10/mainproc.c
	@@ -1,2758 +1,2806 @@
	/* mainproc.c - handle packets
	* Copyright (C) 1998-2009 Free Software Foundation, Inc.
	* Copyright (C) 2013-2014 Werner Koch
	+ * Copyright (C) 2020 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <time.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "options.h"
	#include "keydb.h"
	#include "filter.h"
	#include "main.h"
	#include "../common/status.h"
	#include "../common/i18n.h"
	#include "trustdb.h"
	#include "keyserver-internal.h"
	#include "photoid.h"
	#include "../common/mbox-util.h"
	#include "call-dirmngr.h"
	#include "../common/compliance.h"

	/* Put an upper limit on nested packets. The 32 is an arbitrary
	value, a much lower should actually be sufficient. */
	#define MAX_NESTING_DEPTH 32


	/*
	* Object to hold the processing context.
	*/
	typedef struct mainproc_context *CTX;
	struct mainproc_context
	{
	ctrl_t ctrl;
	struct mainproc_context anchor; / May be useful in the future. */
	PKT_public_key *last_pubkey;
	PKT_user_id *last_user_id;
	md_filter_context_t mfx;
	int sigs_only; /* Process only signatures and reject all other stuff. */
	int encrypt_only; /* Process only encryption messages. */

	/* Name of the file with the complete signature or the file with the
	detached signature. This is currently only used to deduce the
	file name of the data file if that has not been given. */
	const char *sigfilename;

	/* A structure to describe the signed data in case of a detached
	signature. */
	struct
	{
	/* A file descriptor of the signed data. Only used if not -1. */
	int data_fd;
	/* A list of filenames with the data files or NULL. This is only
	used if DATA_FD is -1. */
	strlist_t data_names;
	/* Flag to indicated that either one of the next previous fields
	is used. This is only needed for better readability. */
	int used;
	} signed_data;

	DEK *dek;
	int last_was_session_key;
	kbnode_t list; /* The current list of packets. */
	iobuf_t iobuf; /* Used to get the filename etc. */
	int trustletter; /* Temporary usage in list_node. */
	ulong symkeys; /* Number of symmetrically encrypted session keys. */
	struct pubkey_enc_list pkenc_list; / List of encryption packets. */
	int seen_pkt_encrypted_aead; /* PKT_ENCRYPTED_AEAD packet seen. */
	struct {
	unsigned int sig_seen:1; /* Set to true if a signature packet
	has been seen. */
	unsigned int data:1; /* Any data packet seen */
	unsigned int uncompress_failed:1;
	} any;
	};


	/* Counter with the number of literal data packets seen. Note that
	* this is also bumped at the end of an encryption. This counter is
	* used for a basic consistency check of a received PGP message. */
	static int literals_seen;


	/* Local prototypes. */
	static int do_proc_packets (CTX c, iobuf_t a);
	static void list_node (CTX c, kbnode_t node);
	static void proc_tree (CTX c, kbnode_t node);


	/* Functions. */

	/* Reset the literal data counter. This is required to setup a new
	* decryption or verification context. */
	void
	reset_literals_seen(void)
	{
	literals_seen = 0;
	}


	static void
	release_list( CTX c )
	{
	proc_tree (c, c->list);
	release_kbnode (c->list);
	while (c->pkenc_list)
	{
	struct pubkey_enc_list *tmp = c->pkenc_list->next;

	mpi_release (c->pkenc_list->data[0]);
	mpi_release (c->pkenc_list->data[1]);
	xfree (c->pkenc_list);
	c->pkenc_list = tmp;
	}
	c->pkenc_list = NULL;
	c->list = NULL;
	c->any.data = 0;
	c->any.uncompress_failed = 0;
	c->last_was_session_key = 0;
	c->seen_pkt_encrypted_aead = 0;
	xfree (c->dek);
	c->dek = NULL;
	}


	static int
	add_onepass_sig (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = node = new_kbnode (pkt);

	return 1;
	}


	static int
	add_gpg_control (CTX c, PACKET *pkt)
	{
	if ( pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* New clear text signature.
	* Process the last one and reset everything */
	release_list(c);
	}

	if (c->list) /* Add another packet. */
	add_kbnode (c->list, new_kbnode (pkt));
	else /* Insert the first one. */
	c->list = new_kbnode (pkt);

	return 1;
	}


	static int
	add_user_id (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("orphaned user ID\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_subkey (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("subkey w/o mainkey\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_ring_trust (CTX c, PACKET *pkt)
	{
	if (!c->list)
	{
	log_error ("ring trust w/o key\n");
	return 0;
	}
	add_kbnode (c->list, new_kbnode (pkt));
	return 1;
	}


	static int
	add_signature (CTX c, PACKET *pkt)
	{
	kbnode_t node;

	c->any.sig_seen = 1;
	if (pkt->pkttype == PKT_SIGNATURE && !c->list)
	{
	/* This is the first signature for the following datafile.
	* GPG does not write such packets; instead it always uses
	* onepass-sig packets. The drawback of PGP's method
	* of prepending the signature to the data is
	* that it is not possible to make a signature from data read
	* from stdin. (GPG is able to read PGP stuff anyway.) */
	node = new_kbnode (pkt);
	c->list = node;
	return 1;
	}
	else if (!c->list)
	return 0; /* oops (invalid packet sequence)*/
	else if (!c->list->pkt)
	BUG(); /* so nicht */

	/* Add a new signature node item at the end. */
	node = new_kbnode (pkt);
	add_kbnode (c->list, node);

	return 1;
	}

	static gpg_error_t
	symkey_decrypt_seskey (DEK dek, byte seskey, size_t slen)
	{
	gpg_error_t err;
	gcry_cipher_hd_t hd;
	unsigned int noncelen, keylen;
	enum gcry_cipher_modes ciphermode;

	if (dek->use_aead)
	{
	err = openpgp_aead_algo_info (dek->use_aead, &ciphermode, &noncelen);
	if (err)
	return err;
	}
	else
	{
	ciphermode = GCRY_CIPHER_MODE_CFB;
	noncelen = 0;
	}

	/* Check that the session key has a size of 16 to 32 bytes. */
	if ((dek->use_aead && (slen < (noncelen + 16 + 16)
	\|\| slen > (noncelen + 32 + 16)))
	\|\| (!dek->use_aead && (slen < 17 \|\| slen > 33)))
	{
	log_error ( _("weird size for an encrypted session key (%d)\n"),
	(int)slen);
	return gpg_error (GPG_ERR_BAD_KEY);
	}

	err = openpgp_cipher_open (&hd, dek->algo, ciphermode, GCRY_CIPHER_SECURE);
	if (!err)
	err = gcry_cipher_setkey (hd, dek->key, dek->keylen);
	if (!err)
	err = gcry_cipher_setiv (hd, noncelen? seskey : NULL, noncelen);
	if (err)
	goto leave;

	if (dek->use_aead)
	{
	byte ad[4];

	ad[0] = (0xc0 \| PKT_SYMKEY_ENC);
	ad[1] = 5;
	ad[2] = dek->algo;
	ad[3] = dek->use_aead;
	err = gcry_cipher_authenticate (hd, ad, 4);
	if (err)
	goto leave;
	gcry_cipher_final (hd);
	keylen = slen - noncelen - 16;
	err = gcry_cipher_decrypt (hd, seskey+noncelen, keylen, NULL, 0);
	if (err)
	goto leave;
	err = gcry_cipher_checktag (hd, seskey+noncelen+keylen, 16);
	if (err)
	goto leave;
	/* Now we replace the dek components with the real session key to
	* decrypt the contents of the sequencing packet. */
	if (keylen > DIM(dek->key))
	{
	err = gpg_error (GPG_ERR_TOO_LARGE);
	goto leave;
	}
	dek->keylen = keylen;
	memcpy (dek->key, seskey + noncelen, dek->keylen);
	}
	else
	{
	gcry_cipher_decrypt (hd, seskey, slen, NULL, 0 );
	/* Here we can only test whether the algo given in decrypted
	* session key is a valid OpenPGP algo. With 11 defined
	* symmetric algorithms we will miss 4.3% of wrong passphrases
	* here. The actual checking is done later during bulk
	* decryption; we can't bring this check forward easily. We
	* need to use the GPG_ERR_CHECKSUM so that we won't run into
	* the gnupg < 2.2 bug compatible case which would terminate the
	* process on GPG_ERR_CIPHER_ALGO. Note that with AEAD (above)
	* we will have a reliable test here. */
	if (openpgp_cipher_test_algo (seskey[0])
	\|\| openpgp_cipher_get_algo_keylen (seskey[0]) != slen - 1)
	{
	err = gpg_error (GPG_ERR_CHECKSUM);
	goto leave;
	}

	/* Now we replace the dek components with the real session key to
	* decrypt the contents of the sequencing packet. */
	keylen = slen-1;
	if (keylen > DIM(dek->key))
	{
	err = gpg_error (GPG_ERR_TOO_LARGE);
	goto leave;
	}
	dek->algo = seskey[0];
	dek->keylen = keylen;
	memcpy (dek->key, seskey + 1, dek->keylen);
	}

	/log_hexdump( "thekey", dek->key, dek->keylen );/

	leave:
	gcry_cipher_close (hd);
	return err;
	}


	static void
	proc_symkey_enc (CTX c, PACKET *pkt)
	{
	gpg_error_t err;
	PKT_symkey_enc *enc;

	enc = pkt->pkt.symkey_enc;
	if (!enc)
	log_error ("invalid symkey encrypted packet\n");
	else if(!c->dek)
	{
	int algo = enc->cipher_algo;
	const char *s = openpgp_cipher_algo_name (algo);
	const char *a = (enc->aead_algo ? openpgp_aead_algo_name (enc->aead_algo)
	/**/ : "CFB");

	if (!openpgp_cipher_test_algo (algo))
	{
	if (!opt.quiet)
	{
	if (enc->seskeylen)
	log_info (_("%s.%s encrypted session key\n"), s, a );
	else
	log_info (_("%s.%s encrypted data\n"), s, a );
	}
	}
	else
	log_error (_("encrypted with unknown algorithm %d.%s\n"), algo, a);

	if (openpgp_md_test_algo (enc->s2k.hash_algo))
	{
	log_error(_("passphrase generated with unknown digest"
	" algorithm %d\n"),enc->s2k.hash_algo);
	s = NULL;
	}

	c->last_was_session_key = 2;
	if (!s \|\| opt.list_only)
	goto leave;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	if (get_override_session_key (c->dek, opt.override_session_key))
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	c->dek = passphrase_to_dek (algo, &enc->s2k, 0, 0, NULL, NULL);
	if (c->dek)
	{
	c->dek->symmetric = 1;
	c->dek->use_aead = enc->aead_algo;

	/* FIXME: This doesn't work perfectly if a symmetric key
	comes before a public key in the message - if the
	user doesn't know the passphrase, then there is a
	chance that the "decrypted" algorithm will happen to
	be a valid one, which will make the returned dek
	appear valid, so we won't try any public keys that
	come later. */
	if (enc->seskeylen)
	{
	err = symkey_decrypt_seskey (c->dek,
	enc->seskey, enc->seskeylen);
	if (err)
	{
	log_info ("decryption of the symmetrically encrypted"
	" session key failed: %s\n",
	gpg_strerror (err));
	if (gpg_err_code (err) != GPG_ERR_BAD_KEY
	&& gpg_err_code (err) != GPG_ERR_CHECKSUM)
	log_fatal ("process terminated to be bug compatible"
	" with GnuPG <= 2.2\n");
	if (c->dek->s2k_cacheid[0])
	{
	if (opt.debug)
	log_debug ("cleared passphrase cached with ID:"
	" %s\n", c->dek->s2k_cacheid);
	passphrase_clear_cache (c->dek->s2k_cacheid);
	}
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	c->dek->algo_info_printed = 1;
	}
	}
	}

	leave:
	c->symkeys++;
	free_packet (pkt, NULL);
	}


	static void
	proc_pubkey_enc (CTX c, PACKET *pkt)
	{
	PKT_pubkey_enc *enc;

	/* Check whether the secret key is available and store in this case. */
	c->last_was_session_key = 1;
	enc = pkt->pkt.pubkey_enc;
	/printf("enc: encrypted by a pubkey with keyid %08lX\n", enc->keyid[1] );/
	/* Hmmm: why do I have this algo check here - anyway there is
	* function to check it. */
	if (opt.verbose)
	log_info (_("public key is %s\n"), keystr (enc->keyid));

	if (is_status_enabled ())
	{
	char buf[50];
	snprintf (buf, sizeof buf, "%08lX%08lX %d 0",
	(ulong)enc->keyid[0], (ulong)enc->keyid[1], enc->pubkey_algo);
	write_status_text (STATUS_ENC_TO, buf);
	}

	if (!opt.list_only && !opt.override_session_key)
	{
	struct pubkey_enc_list x = xmalloc (sizeof x);

	x->keyid[0] = enc->keyid[0];
	x->keyid[1] = enc->keyid[1];
	x->pubkey_algo = enc->pubkey_algo;
	x->result = -1;
	x->data[0] = x->data[1] = NULL;
	if (enc->data[0])
	{
	x->data[0] = mpi_copy (enc->data[0]);
	x->data[1] = mpi_copy (enc->data[1]);
	}
	x->next = c->pkenc_list;
	c->pkenc_list = x;
	}

	free_packet(pkt, NULL);
	}


	/*
	* Print the list of public key encrypted packets which we could
	* not decrypt.
	*/
	static void
	print_pkenc_list (ctrl_t ctrl, struct pubkey_enc_list *list)
	{
	for (; list; list = list->next)
	{
	PKT_public_key *pk;
	char pkstrbuf[PUBKEY_STRING_SIZE];
	char *p;

	pk = xmalloc_clear (sizeof *pk);

	pk->pubkey_algo = list->pubkey_algo;
	if (!get_pubkey (ctrl, pk, list->keyid))
	{
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);

	log_info (_("encrypted with %s key, ID %s, created %s\n"),
	pkstrbuf, keystr_from_pk (pk),
	strtimestamp (pk->timestamp));
	p = get_user_id_native (ctrl, list->keyid);
	log_printf (_(" \"%s\"\n"), p);
	xfree (p);
	}
	else
	log_info (_("encrypted with %s key, ID %s\n"),
	openpgp_pk_algo_name (list->pubkey_algo),
	keystr(list->keyid));

	free_public_key (pk);
	}
	}


	static void
	proc_encrypted (CTX c, PACKET *pkt)
	{
	int result = 0;
	int early_plaintext = literals_seen;

	if (pkt->pkttype == PKT_ENCRYPTED_AEAD)
	c->seen_pkt_encrypted_aead = 1;

	if (early_plaintext)
	{
	log_info (_("WARNING: multiple plaintexts seen\n"));
	write_status_errcode ("decryption.early_plaintext", GPG_ERR_BAD_DATA);
	/* We fail only later so that we can print some more info first. */
	}

	if (!opt.quiet)
	{
	if (c->symkeys>1)
	log_info (_("encrypted with %lu passphrases\n"), c->symkeys);
	else if (c->symkeys == 1)
	log_info (_("encrypted with 1 passphrase\n"));
	print_pkenc_list (c->ctrl, c->pkenc_list);
	}

	/* Figure out the session key by looking at all pkenc packets. */
	if (opt.list_only \|\| c->dek)
	;
	else if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	log_info (_("public key decryption failed: %s\n"),
	gpg_strerror (result));
	write_status_error ("pkdecrypt_failed", result);
	}
	}
	else if (c->pkenc_list)
	{
	c->dek = xmalloc_secure_clear (sizeof *c->dek);
	result = get_session_key (c->ctrl, c->pkenc_list, c->dek);
	if (is_status_enabled ())
	{
	struct pubkey_enc_list *list;

	for (list = c->pkenc_list; list; list = list->next)
	if (list->result && list->result != -1)
	{
	char buf[20];
	snprintf (buf, sizeof buf, "%08lX%08lX",
	(ulong)list->keyid[0], (ulong)list->keyid[1]);
	write_status_text (STATUS_NO_SECKEY, buf);
	}
	}

	if (result)
	{
	log_info (_("public key decryption failed: %s\n"),
	gpg_strerror (result));
	write_status_error ("pkdecrypt_failed", result);

	/* Error: Delete the DEK. */
	xfree (c->dek);
	c->dek = NULL;
	}
	}

	if (c->dek && opt.verbose > 1)
	log_info (_("public key encrypted data: good DEK\n"));

	write_status (STATUS_BEGIN_DECRYPTION);

	/log_debug("dat: %sencrypted data\n", c->dek?"":"conventional ");/
	if (opt.list_only)
	result = -1;
	else if (!c->dek && !c->last_was_session_key)
	{
	int algo;
	STRING2KEY s2kbuf;
	STRING2KEY *s2k = NULL;
	int canceled;

	if (opt.override_session_key)
	{
	c->dek = xmalloc_clear (sizeof *c->dek);
	result = get_override_session_key (c->dek, opt.override_session_key);
	if (result)
	{
	xfree (c->dek);
	c->dek = NULL;
	}
	}
	else
	{
	/* Assume this is old style conventional encrypted data. */
	algo = opt.def_cipher_algo;
	if (algo)
	log_info (_("assuming %s encrypted data\n"),
	openpgp_cipher_algo_name (algo));
	else if (openpgp_cipher_test_algo (CIPHER_ALGO_IDEA))
	{
	algo = opt.def_cipher_algo;
	if (!algo)
	algo = opt.s2k_cipher_algo;
	log_info (_("IDEA cipher unavailable, "
	"optimistically attempting to use %s instead\n"),
	openpgp_cipher_algo_name (algo));
	}
	else
	{
	algo = CIPHER_ALGO_IDEA;
	if (!opt.s2k_digest_algo)
	{
	/* If no digest is given we assume SHA-1. */
	s2kbuf.mode = 0;
	s2kbuf.hash_algo = DIGEST_ALGO_SHA1;
	s2k = &s2kbuf;
	}
	log_info (_("assuming %s encrypted data\n"), "IDEA");
	}

	c->dek = passphrase_to_dek (algo, s2k, 0, 0, NULL, &canceled);
	if (c->dek)
	c->dek->algo_info_printed = 1;
	else if (canceled)
	result = gpg_error (GPG_ERR_CANCELED);
	else
	result = gpg_error (GPG_ERR_INV_PASSPHRASE);
	}
	}
	else if (!c->dek)
	{
	if (c->symkeys && !c->pkenc_list)
	result = gpg_error (GPG_ERR_BAD_KEY);

	if (!result)
	result = gpg_error (GPG_ERR_NO_SECKEY);
	}

	/* Compute compliance with CO_DE_VS. */
	if (!result && is_status_enabled ()
	/* Symmetric encryption and asymmetric encryption voids compliance. */
	&& (c->symkeys != !!c->pkenc_list )
	/* Overriding session key voids compliance. */
	&& !opt.override_session_key
	/* Check symmetric cipher. */
	&& gnupg_cipher_is_compliant (CO_DE_VS, c->dek->algo,
	GCRY_CIPHER_MODE_CFB))
	{
	struct pubkey_enc_list *i;
	int compliant = 1;
	PKT_public_key pk = xmalloc (sizeof pk);

	if ( !(c->pkenc_list \|\| c->symkeys) )
	log_debug ("%s: where else did the session key come from?\n", __func__);

	/* Now check that every key used to encrypt the session key is
	* compliant. */
	for (i = c->pkenc_list; i && compliant; i = i->next)
	{
	memset (pk, 0, sizeof *pk);
	pk->pubkey_algo = i->pubkey_algo;
	if (get_pubkey (c->ctrl, pk, i->keyid) != 0
	\|\| ! gnupg_pk_is_compliant (CO_DE_VS, pk->pubkey_algo, pk->pkey,
	nbits_from_pk (pk), NULL))
	compliant = 0;
	release_public_key_parts (pk);
	}

	xfree (pk);

	if (compliant)
	write_status_strings (STATUS_DECRYPTION_COMPLIANCE_MODE,
	gnupg_status_compliance_flag (CO_DE_VS),
	NULL);

	}

	if (!result)
	result = decrypt_data (c->ctrl, c, pkt->pkt.encrypted, c->dek );

	/* Trigger the deferred error. */
	if (!result && early_plaintext)
	result = gpg_error (GPG_ERR_BAD_DATA);

	if (result == -1)
	;
	else if (!result
	&& !opt.ignore_mdc_error
	&& !pkt->pkt.encrypted->mdc_method
	&& !pkt->pkt.encrypted->aead_algo)
	{
	/* The message has been decrypted but does not carry an MDC or
	* uses AEAD encryption. --ignore-mdc-error has also not been
	* used. To avoid attacks changing an MDC message to a non-MDC
	* message, we fail here. */
	log_error (_("WARNING: message was not integrity protected\n"));
	if (!pkt->pkt.encrypted->mdc_method
	&& (openpgp_cipher_get_algo_blklen (c->dek->algo) == 8
	\|\| c->dek->algo == CIPHER_ALGO_TWOFISH))
	{
	/* Before 2.2.8 we did not fail hard for a missing MDC if
	* one of the old ciphers where used. Although these cases
	* are rare in practice we print a hint on how to decrypt
	* such messages. */
	log_string
	(GPGRT_LOGLVL_INFO,
	_("Hint: If this message was created before the year 2003 it is\n"
	"likely that this message is legitimate. This is because back\n"
	"then integrity protection was not widely used.\n"));
	log_info (_("Use the option '%s' to decrypt anyway.\n"),
	"--ignore-mdc-error");
	write_status_errcode ("nomdc_with_legacy_cipher",
	GPG_ERR_DECRYPT_FAILED);
	}
	log_info (_("decryption forced to fail!\n"));
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else if (!result \|\| (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
	&& !pkt->pkt.encrypted->aead_algo
	&& opt.ignore_mdc_error))
	{
	/* All is fine or for an MDC message the MDC failed but the
	* --ignore-mdc-error option is active. For compatibility
	* reasons we issue GOODMDC also for AEAD messages. */
	write_status (STATUS_DECRYPTION_OKAY);
	if (opt.verbose > 1)
	log_info(_("decryption okay\n"));

	if (pkt->pkt.encrypted->aead_algo)
	write_status (STATUS_GOODMDC);
	else if (pkt->pkt.encrypted->mdc_method && !result)
	write_status (STATUS_GOODMDC);
	else
	log_info (_("WARNING: message was not integrity protected\n"));
	}
	else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE
	\|\| gpg_err_code (result) == GPG_ERR_TRUNCATED)
	{
	glo_ctrl.lasterr = result;
	log_error (_("WARNING: encrypted message has been manipulated!\n"));
	write_status (STATUS_BADMDC);
	write_status (STATUS_DECRYPTION_FAILED);
	}
	else
	{
	if ((gpg_err_code (result) == GPG_ERR_BAD_KEY
	\|\| gpg_err_code (result) == GPG_ERR_CHECKSUM
	\|\| gpg_err_code (result) == GPG_ERR_CIPHER_ALGO)
	&& c->dek && *c->dek->s2k_cacheid != '\0')
	{
	if (opt.debug)
	log_debug ("cleared passphrase cached with ID: %s\n",
	c->dek->s2k_cacheid);
	passphrase_clear_cache (c->dek->s2k_cacheid);
	}
	glo_ctrl.lasterr = result;
	write_status (STATUS_DECRYPTION_FAILED);
	log_error (_("decryption failed: %s\n"), gpg_strerror (result));
	/* Hmmm: does this work when we have encrypted using multiple
	* ways to specify the session key (symmmetric and PK). */
	}

	xfree (c->dek);
	c->dek = NULL;
	free_packet (pkt, NULL);
	c->last_was_session_key = 0;
	write_status (STATUS_END_DECRYPTION);

	/* Bump the counter even if we have not seen a literal data packet
	* inside an encryption container. This acts as a sentinel in case
	* a misplace extra literal data packets follows after this
	* encrypted packet. */
	literals_seen++;
	}


	static int
	have_seen_pkt_encrypted_aead( CTX c )
	{
	CTX cc;

	for (cc = c; cc; cc = cc->anchor)
	{
	if (cc->seen_pkt_encrypted_aead)
	return 1;
	}

	return 0;
	}


	static void
	proc_plaintext( CTX c, PACKET *pkt )
	{
	PKT_plaintext *pt = pkt->pkt.plaintext;
	int any, clearsig, rc;
	kbnode_t n;
	unsigned char *extrahash;
	size_t extrahashlen;

	/* This is a literal data packet. Bump a counter for later checks. */
	literals_seen++;

	if (pt->namelen == 8 && !memcmp( pt->name, "_CONSOLE", 8))
	log_info (_("Note: sender requested \"for-your-eyes-only\"\n"));
	else if (opt.verbose)
	{
	/* We don't use print_utf8_buffer because that would require a
	* string change which we don't want in 2.2. It is also not
	* clear whether the filename is always utf-8 encoded. */
	char *tmp = make_printable_string (pt->name, pt->namelen, 0);
	log_info (_("original file name='%.*s'\n"), (int)strlen (tmp), tmp);
	xfree (tmp);
	}

	free_md_filter_context (&c->mfx);
	if (gcry_md_open (&c->mfx.md, 0, 0))
	BUG ();
	/* fixme: we may need to push the textfilter if we have sigclass 1
	* and no armoring - Not yet tested
	* Hmmm, why don't we need it at all if we have sigclass 1
	* Should we assume that plaintext in mode 't' has always sigclass 1??
	* See: Russ Allbery's mail 1999-02-09
	*/
	any = clearsig = 0;
	for (n=c->list; n; n = n->next )
	{
	if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* The onepass signature case. */
	if (n->pkt->pkt.onepass_sig->digest_algo)
	{
	if (!opt.skip_verify)
	gcry_md_enable (c->mfx.md,
	n->pkt->pkt.onepass_sig->digest_algo);

	any = 1;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* The clearsigned message case. */
	size_t datalen = n->pkt->pkt.gpg_control->datalen;
	const byte *data = n->pkt->pkt.gpg_control->data;

	/* Check that we have at least the sigclass and one hash. */
	if (datalen < 2)
	log_fatal ("invalid control packet CTRLPKT_CLEARSIGN_START\n");
	/* Note that we don't set the clearsig flag for not-dash-escaped
	* documents. */
	clearsig = (*data == 0x01);
	for (data++, datalen--; datalen; datalen--, data++)
	if (!opt.skip_verify)
	gcry_md_enable (c->mfx.md, *data);
	any = 1;
	break; /* Stop here as one-pass signature packets are not
	expected. */
	}
	else if (n->pkt->pkttype == PKT_SIGNATURE)
	{
	/* The SIG+LITERAL case that PGP used to use. */
	if (!opt.skip_verify)
	gcry_md_enable (c->mfx.md, n->pkt->pkt.signature->digest_algo);
	any = 1;
	}
	}

	if (!any && !opt.skip_verify && !have_seen_pkt_encrypted_aead(c))
	{
	/* This is for the old GPG LITERAL+SIG case. It's not legal
	according to 2440, so hopefully it won't come up that often.
	There is no good way to specify what algorithms to use in
	that case, so these there are the historical answer. */
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
	}
	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	rc=0;

	if (literals_seen > 1)
	{
	log_info (_("WARNING: multiple plaintexts seen\n"));

	write_status_text (STATUS_ERROR, "proc_pkt.plaintext 89_BAD_DATA");
	log_inc_errorcount ();
	rc = gpg_error (GPG_ERR_UNEXPECTED);
	}

	if (!rc)
	{
	/* It we are in --verify mode, we do not want to output the
	* signed text. However, if --output is also used we do what
	* has been requested and write out the signed data. */
	rc = handle_plaintext (pt, &c->mfx,
	(opt.outfp \|\| opt.outfile)? 0 : c->sigs_only,
	clearsig);
	if (gpg_err_code (rc) == GPG_ERR_EACCES && !c->sigs_only)
	{
	/* Can't write output but we hash it anyway to check the
	signature. */
	rc = handle_plaintext( pt, &c->mfx, 1, clearsig );
	}
	}

	if (rc)
	log_error ("handle plaintext failed: %s\n", gpg_strerror (rc));

	/* We add a marker control packet instead of the plaintext packet.
	* This is so that we can later detect invalid packet sequences.
	* The apcket is further used to convey extra data from the
	* plaintext packet to the signature verification. */
	extrahash = xtrymalloc (6 + pt->namelen);
	if (!extrahash)
	{
	/* No way to return an error. */
	rc = gpg_error_from_syserror ();
	log_error ("malloc failed in %s: %s\n", __func__, gpg_strerror (rc));
	extrahashlen = 0;
	}
	else
	{
	extrahash[0] = pt->mode;
	extrahash[1] = pt->namelen;
	if (pt->namelen)
	memcpy (extrahash+2, pt->name, pt->namelen);
	extrahashlen = 2 + pt->namelen;
	extrahash[extrahashlen++] = pt->timestamp >> 24;
	extrahash[extrahashlen++] = pt->timestamp >> 16;
	extrahash[extrahashlen++] = pt->timestamp >> 8;
	extrahash[extrahashlen++] = pt->timestamp ;
	}

	free_packet (pkt, NULL);
	c->last_was_session_key = 0;

	n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK,
	extrahash, extrahashlen));
	xfree (extrahash);
	if (c->list)
	add_kbnode (c->list, n);
	else
	c->list = n;
	}


	static int
	proc_compressed_cb (iobuf_t a, void *info)
	{
	if ( ((CTX)info)->signed_data.used
	&& ((CTX)info)->signed_data.data_fd != -1)
	return proc_signature_packets_by_fd (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_fd);
	else
	return proc_signature_packets (((CTX)info)->ctrl, info, a,
	((CTX)info)->signed_data.data_names,
	((CTX)info)->sigfilename );
	}


	static int
	proc_encrypt_cb (iobuf_t a, void *info )
	{
	CTX c = info;
	return proc_encryption_packets (c->ctrl, info, a );
	}


	static int
	proc_compressed (CTX c, PACKET *pkt)
	{
	PKT_compressed *zd = pkt->pkt.compressed;
	int rc;

	/printf("zip: compressed data packet\n");/
	if (c->sigs_only)
	rc = handle_compressed (c->ctrl, c, zd, proc_compressed_cb, c);
	else if( c->encrypt_only )
	rc = handle_compressed (c->ctrl, c, zd, proc_encrypt_cb, c);
	else
	rc = handle_compressed (c->ctrl, c, zd, NULL, NULL);

	if (gpg_err_code (rc) == GPG_ERR_BAD_DATA)
	{
	if (!c->any.uncompress_failed)
	{
	CTX cc;

	for (cc=c; cc; cc = cc->anchor)
	cc->any.uncompress_failed = 1;
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));
	}
	}
	else if (rc)
	log_error ("uncompressing failed: %s\n", gpg_strerror (rc));

	free_packet (pkt, NULL);
	c->last_was_session_key = 0;
	return rc;
	}


	/*
	* Check the signature. If R_PK is not NULL a copy of the public key
	* used to verify the signature will be stored there, or NULL if not
	- * found. Returns: 0 = valid signature or an error code
	+ * found. If FORCED_PK is not NULL, this public key is used to verify
	+ * _data signatures_ and no key lookup is done. Returns: 0 = valid
	+ * signature or an error code
	*/
	static int
	do_check_sig (CTX c, kbnode_t node, const void *extrahash, size_t extrahashlen,
	- int *is_selfsig,
	+ PKT_public_key forced_pk, int is_selfsig,
	int is_expkey, int is_revkey, PKT_public_key **r_pk)
	{
	PKT_signature *sig;
	gcry_md_hd_t md = NULL;
	gcry_md_hd_t md2 = NULL;
	gcry_md_hd_t md_good = NULL;
	int algo, rc;

	if (r_pk)
	*r_pk = NULL;

	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	if (is_selfsig)
	*is_selfsig = 0;
	sig = node->pkt->pkt.signature;

	algo = sig->digest_algo;
	rc = openpgp_md_test_algo (algo);
	if (rc)
	return rc;

	if (sig->sig_class == 0x00)
	{
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	}
	else /* detached signature */
	{
	/* check_signature() will enable the md. */
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	}
	}
	else if (sig->sig_class == 0x01)
	{
	/* How do we know that we have to hash the (already hashed) text
	in canonical mode ??? (calculating both modes???) */
	if (c->mfx.md)
	{
	if (gcry_md_copy (&md, c->mfx.md ))
	BUG ();
	if (c->mfx.md2 && gcry_md_copy (&md2, c->mfx.md2))
	BUG ();
	}
	else /* detached signature */
	{
	log_debug ("Do we really need this here?");
	/* check_signature() will enable the md*/
	if (gcry_md_open (&md, 0, 0 ))
	BUG ();
	if (gcry_md_open (&md2, 0, 0 ))
	BUG ();
	}
	}
	else if ((sig->sig_class&~3) == 0x10
	\|\| sig->sig_class == 0x18
	\|\| sig->sig_class == 0x1f
	\|\| sig->sig_class == 0x20
	\|\| sig->sig_class == 0x28
	\|\| sig->sig_class == 0x30)
	{
	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	return check_key_signature (c->ctrl, c->list, node, is_selfsig);
	}
	else if (sig->sig_class == 0x20)
	{
	log_error (_("standalone revocation - "
	"use \"gpg --import\" to apply\n"));
	return GPG_ERR_NOT_PROCESSED;
	}
	else
	{
	log_error ("invalid root packet for sigclass %02x\n", sig->sig_class);
	return GPG_ERR_SIG_CLASS;
	}
	}
	else
	return GPG_ERR_SIG_CLASS;

	/* We only get here if we are checking the signature of a binary
	(0x00) or text document (0x01). */
	rc = check_signature2 (c->ctrl, sig, md, extrahash, extrahashlen,
	+ forced_pk,
	NULL, is_expkey, is_revkey, r_pk);
	if (! rc)
	md_good = md;
	else if (gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE && md2)
	{
	PKT_public_key *pk2;

	rc = check_signature2 (c->ctrl, sig, md2, extrahash, extrahashlen,
	+ forced_pk,
	NULL, is_expkey, is_revkey,
	r_pk? &pk2 : NULL);
	if (!rc)
	{
	md_good = md2;
	if (r_pk)
	{
	free_public_key (*r_pk);
	*r_pk = pk2;
	}
	}
	}

	if (md_good)
	{
	unsigned char *buffer = gcry_md_read (md_good, sig->digest_algo);
	sig->digest_len = gcry_md_get_algo_dlen (map_md_openpgp_to_gcry (algo));
	memcpy (sig->digest, buffer, sig->digest_len);
	}

	gcry_md_close (md);
	gcry_md_close (md2);

	return rc;
	}


	static void
	print_userid (PACKET *pkt)
	{
	if (!pkt)
	BUG();

	if (pkt->pkttype != PKT_USER_ID)
	{
	es_printf ("ERROR: unexpected packet type %d", pkt->pkttype );
	return;
	}
	if (opt.with_colons)
	{
	if (pkt->pkt.user_id->attrib_data)
	es_printf("%u %lu",
	pkt->pkt.user_id->numattribs,
	pkt->pkt.user_id->attrib_len);
	else
	es_write_sanitized (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len, ":", NULL);
	}
	else
	print_utf8_buffer (es_stdout, pkt->pkt.user_id->name,
	pkt->pkt.user_id->len );
	}


	/*
	* List the keyblock in a user friendly way
	*/
	static void
	list_node (CTX c, kbnode_t node)
	{
	if (!node)
	;
	else if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	PKT_public_key *pk = node->pkt->pkt.public_key;

	if (opt.with_colons)
	{
	u32 keyid[2];

	keyid_from_pk( pk, keyid );
	if (pk->flags.primary)
	c->trustletter = (opt.fast_list_mode
	? 0
	: get_validity_info
	(c->ctrl,
	node->pkt->pkttype == PKT_PUBLIC_KEY
	? node : NULL,
	pk, NULL));
	es_printf ("%s:", pk->flags.primary? "pub":"sub" );
	if (c->trustletter)
	es_putc (c->trustletter, es_stdout);
	es_printf (":%u:%d:%08lX%08lX:%s:%s::",
	nbits_from_pk( pk ),
	pk->pubkey_algo,
	(ulong)keyid[0],(ulong)keyid[1],
	colon_datestr_from_pk( pk ),
	colon_strtime (pk->expiredate) );
	if (pk->flags.primary && !opt.fast_list_mode)
	es_putc (get_ownertrust_info (c->ctrl, pk, 1), es_stdout);
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	}
	else
	{
	print_key_line (c->ctrl, es_stdout, pk, 0);
	}

	if (opt.keyid_format == KF_NONE && !opt.with_colons)
	; /* Already printed. */
	else if ((pk->flags.primary && opt.fingerprint) \|\| opt.fingerprint > 1)
	print_fingerprint (c->ctrl, NULL, pk, 0);

	if (pk->flags.primary)
	{
	int kl = opt.keyid_format == KF_NONE? 0 : keystrlen ();

	/* Now list all userids with their signatures. */
	for (node = node->next; node; node = node->next)
	{
	if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	list_node (c, node );
	}
	else if (node->pkt->pkttype == PKT_USER_ID)
	{
	if (opt.with_colons)
	es_printf ("%s:::::::::",
	node->pkt->pkt.user_id->attrib_data?"uat":"uid");
	else
	es_printf ("uid%*s",
	kl + (opt.legacy_list_mode? 9:11),
	"" );
	print_userid (node->pkt);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_putc ('\n', es_stdout);
	}
	else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	list_node(c, node );
	}
	}
	}
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY
	\|\| node->pkt->pkttype == PKT_SECRET_SUBKEY)
	{

	log_debug ("FIXME: No way to print secret key packets here\n");
	/* fixme: We may use a function to turn a secret key packet into
	a public key one and use that here. */
	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int is_selfsig = 0;
	int rc2 = 0;
	size_t n;
	char *p;
	int sigrc = ' ';

	if (!opt.verbose)
	return;

	if (sig->sig_class == 0x20 \|\| sig->sig_class == 0x30)
	es_fputs ("rev", es_stdout);
	else
	es_fputs ("sig", es_stdout);
	if (opt.check_sigs)
	{
	fflush (stdout);
	- rc2 = do_check_sig (c, node, NULL, 0, &is_selfsig, NULL, NULL, NULL);
	+ rc2 = do_check_sig (c, node, NULL, 0, NULL,
	+ &is_selfsig, NULL, NULL, NULL);
	switch (gpg_err_code (rc2))
	{
	case 0: sigrc = '!'; break;
	case GPG_ERR_BAD_SIGNATURE: sigrc = '-'; break;
	case GPG_ERR_NO_PUBKEY:
	case GPG_ERR_UNUSABLE_PUBKEY: sigrc = '?'; break;
	default: sigrc = '%'; break;
	}
	}
	else /* Check whether this is a self signature. */
	{
	u32 keyid[2];

	if (c->list->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| c->list->pkt->pkttype == PKT_SECRET_KEY )
	{
	keyid_from_pk (c->list->pkt->pkt.public_key, keyid);

	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	is_selfsig = 1;
	}
	}

	if (opt.with_colons)
	{
	es_putc (':', es_stdout);
	if (sigrc != ' ')
	es_putc (sigrc, es_stdout);
	es_printf ("::%d:%08lX%08lX:%s:%s:", sig->pubkey_algo,
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	colon_datestr_from_sig (sig),
	colon_expirestr_from_sig (sig));

	if (sig->trust_depth \|\| sig->trust_value)
	es_printf ("%d %d",sig->trust_depth,sig->trust_value);
	es_putc (':', es_stdout);

	if (sig->trust_regexp)
	es_write_sanitized (es_stdout, sig->trust_regexp,
	strlen (sig->trust_regexp), ":", NULL);
	es_putc (':', es_stdout);
	}
	else
	es_printf ("%c %s %s ",
	sigrc, keystr (sig->keyid), datestr_from_sig(sig));
	if (sigrc == '%')
	es_printf ("[%s] ", gpg_strerror (rc2) );
	else if (sigrc == '?')
	;
	else if (is_selfsig)
	{
	if (opt.with_colons)
	es_putc (':', es_stdout);
	es_fputs (sig->sig_class == 0x18? "[keybind]":"[selfsig]", es_stdout);
	if (opt.with_colons)
	es_putc (':', es_stdout);
	}
	else if (!opt.fast_list_mode)
	{
	p = get_user_id (c->ctrl, sig->keyid, &n, NULL);
	es_write_sanitized (es_stdout, p, n,
	opt.with_colons?":":NULL, NULL );
	xfree (p);
	}
	if (opt.with_colons)
	es_printf (":%02x%c:", sig->sig_class, sig->flags.exportable?'x':'l');
	es_putc ('\n', es_stdout);
	}
	else
	log_error ("invalid node with packet of type %d\n", node->pkt->pkttype);
	}


	int
	proc_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	int rc;
	CTX c = xmalloc_clear (sizeof *c);

	c->ctrl = ctrl;
	c->anchor = anchor;
	rc = do_proc_packets (c, a);
	xfree (c);

	return rc;
	}


	int
	proc_signature_packets (ctrl_t ctrl, void *anchor, iobuf_t a,
	strlist_t signedfiles, const char *sigfilename )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = -1;
	c->signed_data.data_names = signedfiles;
	c->signed_data.used = !!signedfiles;

	c->sigfilename = sigfilename;
	rc = do_proc_packets (c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = GPG_ERR_NO_DATA;
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree (c);
	return rc;
	}


	int
	proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, iobuf_t a, int signed_data_fd )
	{
	int rc;
	CTX c;

	c = xtrycalloc (1, sizeof *c);
	if (!c)
	return gpg_error_from_syserror ();

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->sigs_only = 1;

	c->signed_data.data_fd = signed_data_fd;
	c->signed_data.data_names = NULL;
	c->signed_data.used = (signed_data_fd != -1);

	rc = do_proc_packets (c, a);

	/* If we have not encountered any signature we print an error
	messages, send a NODATA status back and return an error code.
	Using log_error is required because verify_files does not check
	error codes for each file but we want to terminate the process
	with an error. */
	if (!rc && !c->any.sig_seen)
	{
	write_status_text (STATUS_NODATA, "4");
	log_error (_("no signature found\n"));
	rc = gpg_error (GPG_ERR_NO_DATA);
	}

	/* Propagate the signature seen flag upward. Do this only on success
	so that we won't issue the nodata status several times. */
	if (!rc && c->anchor && c->any.sig_seen)
	c->anchor->any.sig_seen = 1;

	xfree ( c );
	return rc;
	}


	int
	proc_encryption_packets (ctrl_t ctrl, void *anchor, iobuf_t a )
	{
	CTX c = xmalloc_clear (sizeof *c);
	int rc;

	c->ctrl = ctrl;
	c->anchor = anchor;
	c->encrypt_only = 1;
	rc = do_proc_packets (c, a);
	xfree (c);
	return rc;
	}


	static int
	check_nesting (CTX c)
	{
	int level;

	for (level=0; c; c = c->anchor)
	level++;

	if (level > MAX_NESTING_DEPTH)
	{
	log_error ("input data with too deeply nested packets\n");
	write_status_text (STATUS_UNEXPECTED, "1");
	return GPG_ERR_BAD_DATA;
	}

	return 0;
	}


	static int
	do_proc_packets (CTX c, iobuf_t a)
	{
	PACKET *pkt;
	struct parse_packet_ctx_s parsectx;
	int rc = 0;
	int any_data = 0;
	int newpkt;

	rc = check_nesting (c);
	if (rc)
	return rc;

	pkt = xmalloc( sizeof *pkt );
	c->iobuf = a;
	init_packet(pkt);
	init_parse_packet (&parsectx, a);
	while ((rc=parse_packet (&parsectx, pkt)) != -1)
	{
	any_data = 1;
	if (rc)
	{
	free_packet (pkt, &parsectx);
	/* Stop processing when an invalid packet has been encountered
	* but don't do so when we are doing a --list-packets. */
	if (gpg_err_code (rc) == GPG_ERR_INV_PACKET
	&& opt.list_packets == 0)
	break;
	continue;
	}
	newpkt = -1;
	if (opt.list_packets)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_ENCRYPTED_AEAD:proc_encrypted (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->sigs_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	case PKT_SYMKEY_ENC:
	case PKT_PUBKEY_ENC:
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_ENCRYPTED_AEAD:
	write_status_text( STATUS_UNEXPECTED, "0" );
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else if (c->encrypt_only)
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	case PKT_USER_ID:
	write_status_text (STATUS_UNEXPECTED, "0");
	rc = GPG_ERR_UNEXPECTED;
	goto leave;

	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_ENCRYPTED_AEAD: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control (c, pkt); break;
	default: newpkt = 0; break;
	}
	}
	else
	{
	switch (pkt->pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_SECRET_KEY:
	release_list (c);
	c->list = new_kbnode (pkt);
	newpkt = 1;
	break;
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_SUBKEY:
	newpkt = add_subkey (c, pkt);
	break;
	case PKT_USER_ID: newpkt = add_user_id (c, pkt); break;
	case PKT_SIGNATURE: newpkt = add_signature (c, pkt); break;
	case PKT_PUBKEY_ENC: proc_pubkey_enc (c, pkt); break;
	case PKT_SYMKEY_ENC: proc_symkey_enc (c, pkt); break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_ENCRYPTED_AEAD: proc_encrypted (c, pkt); break;
	case PKT_PLAINTEXT: proc_plaintext (c, pkt); break;
	case PKT_COMPRESSED: rc = proc_compressed (c, pkt); break;
	case PKT_ONEPASS_SIG: newpkt = add_onepass_sig (c, pkt); break;
	case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
	case PKT_RING_TRUST: newpkt = add_ring_trust (c, pkt); break;
	default: newpkt = 0; break;
	}
	}

	if (rc)
	goto leave;

	/* This is a very ugly construct and frankly, I don't remember why
	* I used it. Adding the MDC check here is a hack.
	* The right solution is to initiate another context for encrypted
	* packet and not to reuse the current one ... It works right
	* when there is a compression packet between which adds just
	* an extra layer.
	* Hmmm: Rewrite this whole module here??
	*/
	if (pkt->pkttype != PKT_SIGNATURE && pkt->pkttype != PKT_MDC)
	c->any.data = (pkt->pkttype == PKT_PLAINTEXT);

	if (newpkt == -1)
	;
	else if (newpkt)
	{
	pkt = xmalloc (sizeof *pkt);
	init_packet (pkt);
	}
	else
	free_packet (pkt, &parsectx);
	}

	if (rc == GPG_ERR_INV_PACKET)
	write_status_text (STATUS_NODATA, "3");

	if (any_data)
	rc = 0;
	else if (rc == -1)
	write_status_text (STATUS_NODATA, "2");


	leave:
	release_list (c);
	xfree(c->dek);
	free_packet (pkt, &parsectx);
	deinit_parse_packet (&parsectx);
	xfree (pkt);
	free_md_filter_context (&c->mfx);
	return rc;
	}


	/* Helper for pka_uri_from_sig to parse the to-be-verified address out
	of the notation data. */
	static pka_info_t *
	get_pka_address (PKT_signature *sig)
	{
	pka_info_t *pka = NULL;
	struct notation nd,notation;

	notation=sig_to_notation(sig);

	for(nd=notation;nd;nd=nd->next)
	{
	if(strcmp(nd->name,"pka-address@gnupg.org")!=0)
	continue; /* Not the notation we want. */

	/* For now we only use the first valid PKA notation. In future
	we might want to keep additional PKA notations in a linked
	list. */
	if (is_valid_mailbox (nd->value))
	{
	pka = xmalloc (sizeof *pka + strlen(nd->value));
	pka->valid = 0;
	pka->checked = 0;
	pka->uri = NULL;
	strcpy (pka->email, nd->value);
	break;
	}
	}

	free_notation(notation);

	return pka;
	}


	/* Return the URI from a DNS PKA record. If this record has already
	be retrieved for the signature we merely return it; if not we go
	out and try to get that DNS record. */
	static const char *
	pka_uri_from_sig (CTX c, PKT_signature *sig)
	{
	if (!sig->flags.pka_tried)
	{
	log_assert (!sig->pka_info);
	sig->flags.pka_tried = 1;
	sig->pka_info = get_pka_address (sig);
	if (sig->pka_info)
	{
	char *url;
	unsigned char *fpr;
	size_t fprlen;

	if (!gpg_dirmngr_get_pka (c->ctrl, sig->pka_info->email,
	&fpr, &fprlen, &url))
	{
	if (fpr && fprlen == sizeof sig->pka_info->fpr)
	{
	memcpy (sig->pka_info->fpr, fpr, fprlen);
	if (url)
	{
	sig->pka_info->valid = 1;
	if (!*url)
	xfree (url);
	else
	sig->pka_info->uri = url;
	url = NULL;
	}
	}
	xfree (fpr);
	xfree (url);
	}
	}
	}
	return sig->pka_info? sig->pka_info->uri : NULL;
	}


	/* Return true if the AKL has the WKD method specified. */
	static int
	akl_has_wkd_method (void)
	{
	struct akl *akl;

	for (akl = opt.auto_key_locate; akl; akl = akl->next)
	if (akl->type == AKL_WKD)
	return 1;
	return 0;
	}


	/* Return the ISSUER fingerprint buffer and its length at R_LEN.
	* Returns NULL if not available. The returned buffer is valid as
	* long as SIG is not modified. */
	const byte *
	issuer_fpr_raw (PKT_signature sig, size_t r_len)
	{
	const byte *p;
	size_t n;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_ISSUER_FPR, &n);
	if (p && ((n == 21 && p[0] == 4) \|\| (n == 33 && p[0] == 5)))
	{
	*r_len = n - 1;
	return p+1;
	}
	*r_len = 0;
	return NULL;
	}


	/* Return the ISSUER fingerprint string in human readable format if
	* available. Caller must release the string. */
	/* FIXME: Move to another file. */
	char *
	issuer_fpr_string (PKT_signature *sig)
	{
	const byte *p;
	size_t n;

	p = issuer_fpr_raw (sig, &n);
	return p? bin2hex (p, n, NULL) : NULL;
	}


	static void
	print_good_bad_signature (int statno, const char *keyid_str, kbnode_t un,
	PKT_signature *sig, int rc)
	{
	char *p;

	write_status_text_and_buffer (statno, keyid_str,
	un? un->pkt->pkt.user_id->name:"[?]",
	un? un->pkt->pkt.user_id->len:3,
	-1);

	if (un)
	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	else
	p = xstrdup ("[?]");

	if (rc)
	log_info (_("BAD signature from \"%s\""), p);
	else if (sig->flags.expired)
	log_info (_("Expired signature from \"%s\""), p);
	else
	log_info (_("Good signature from \"%s\""), p);

	xfree (p);
	}


	static int
	check_sig_and_print (CTX c, kbnode_t node)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	const char *astr;
	int rc;
	int is_expkey = 0;
	int is_revkey = 0;
	char *issuer_fpr = NULL;
	PKT_public_key pk = NULL; / The public key for the signature or NULL. */
	const void *extrahash = NULL;
	size_t extrahashlen = 0;
	+ kbnode_t included_keyblock = NULL;

	if (opt.skip_verify)
	{
	log_info(_("signature verification suppressed\n"));
	return 0;
	}

	/* Check that the message composition is valid.
	*
	* Per RFC-2440bis (-15) allowed:
	*
	* S{1,n} -- detached signature.
	* S{1,n} P -- old style PGP2 signature
	* O{1,n} P S{1,n} -- standard OpenPGP signature.
	* C P S{1,n} -- cleartext signature.
	*
	*
	* O = One-Pass Signature packet.
	* S = Signature packet.
	* P = OpenPGP Message packet (Encrypted \| Compressed \| Literal)
	* (Note that the current rfc2440bis draft also allows
	* for a signed message but that does not work as it
	* introduces ambiguities.)
	* We keep track of these packages using the marker packet
	* CTRLPKT_PLAINTEXT_MARK.
	* C = Marker packet for cleartext signatures.
	*
	* We reject all other messages.
	*
	* Actually we are calling this too often, i.e. for verification of
	* each message but better have some duplicate work than to silently
	* introduce a bug here.
	*/
	{
	kbnode_t n;
	int n_onepass, n_sig;

	/* log_debug ("checking signature packet composition\n"); */
	/* dump_kbnode (c->list); */

	n = c->list;
	log_assert (n);
	if ( n->pkt->pkttype == PKT_SIGNATURE )
	{
	/* This is either "S{1,n}" case (detached signature) or
	"S{1,n} P" (old style PGP2 signature). */
	for (n = n->next; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (!n)
	; /* Okay, this is a detached signature. */
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK) )
	{
	if (n->next)
	goto ambiguous; /* We only allow one P packet. */
	extrahash = n->pkt->pkt.gpg_control->data;
	extrahashlen = n->pkt->pkt.gpg_control->datalen;
	}
	else
	goto ambiguous;
	}
	else if (n->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* This is the "O{1,n} P S{1,n}" case (standard signature). */
	for (n_onepass=1, n = n->next;
	n && n->pkt->pkttype == PKT_ONEPASS_SIG; n = n->next)
	n_onepass++;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	extrahash = n->pkt->pkt.gpg_control->data;
	extrahashlen = n->pkt->pkt.gpg_control->datalen;

	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (!n_sig)
	goto ambiguous;

	/* If we wanted to disallow multiple sig verification, we'd do
	* something like this:
	*
	* if (n)
	* goto ambiguous;
	*
	* However, this can stay allowable as we can't get here. */

	if (n_onepass != n_sig)
	{
	log_info ("number of one-pass packets does not match "
	"number of signature packets\n");
	goto ambiguous;
	}
	}
	else if (n->pkt->pkttype == PKT_GPG_CONTROL
	&& n->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START )
	{
	/* This is the "C P S{1,n}" case (clear text signature). */
	n = n->next;
	if (!n \|\| !(n->pkt->pkttype == PKT_GPG_CONTROL
	&& (n->pkt->pkt.gpg_control->control
	== CTRLPKT_PLAINTEXT_MARK)))
	goto ambiguous;
	extrahash = n->pkt->pkt.gpg_control->data;
	extrahashlen = n->pkt->pkt.gpg_control->datalen;
	for (n_sig=0, n = n->next;
	n && n->pkt->pkttype == PKT_SIGNATURE; n = n->next)
	n_sig++;
	if (n \|\| !n_sig)
	goto ambiguous;
	}
	else
	{
	ambiguous:
	log_error(_("can't handle this ambiguous signature data\n"));
	return 0;
	}
	}

	if (sig->signers_uid)
	write_status_buffer (STATUS_NEWSIG,
	sig->signers_uid, strlen (sig->signers_uid), 0);
	else
	write_status_text (STATUS_NEWSIG, NULL);

	astr = openpgp_pk_algo_name ( sig->pubkey_algo );
	issuer_fpr = issuer_fpr_string (sig);

	if (issuer_fpr)
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", issuer_fpr);

	}
	else if (!keystrlen () \|\| keystrlen () > 8)
	{
	log_info (_("Signature made %s\n"), asctimestamp(sig->timestamp));
	log_info (_(" using %s key %s\n"),
	astr? astr: "?", keystr(sig->keyid));
	}
	else /* Legacy format. */
	log_info (_("Signature made %s using %s key ID %s\n"),
	asctimestamp(sig->timestamp), astr? astr: "?",
	keystr(sig->keyid));

	/* In verbose mode print the signers UID. */
	if (sig->signers_uid)
	log_info (_(" issuer \"%s\"\n"), sig->signers_uid);

	- rc = do_check_sig (c, node, extrahash, extrahashlen,
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
	NULL, &is_expkey, &is_revkey, &pk);

	+ /* If the key is not found but the signaure includes a key bnlock we
	+ * import that key block and trry again. We keep this key block
	+ * only if the signature verifies. */
	+ /* FIXME: Shall we add an option to disable it or use it only if
	+ * --auto-key-retriueve is set? */
	+ if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	+ && sig->flags.key_block)
	+ /* && (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)) */
	+ {
	+ PKT_public_key *included_pk;
	+ const byte *kblock;
	+ size_t kblock_len;
	+
	+ included_pk = xcalloc (1, sizeof *included_pk);
	+ kblock = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_BLOCK, &kblock_len);
	+ if (kblock && kblock_len > 1
	+ && !get_pubkey_from_buffer (c->ctrl, included_pk,
	+ kblock+1, kblock_len-1,
	+ sig->keyid, &included_keyblock))
	+ {
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, included_pk,
	+ NULL, &is_expkey, &is_revkey, &pk);
	+ log_debug ("checked signature using included key block: %s\n",
	+ gpg_strerror (rc));
	+ if (!rc)
	+ {
	+ /* The keyblock has been verified, we now import it. */
	+ rc = import_included_key_block (c->ctrl, included_keyblock);
	+ }
	+
	+ }
	+ free_public_key (included_pk);
	+ }
	+
	/* If the key isn't found, check for a preferred keyserver. Note
	* that this is only done if honor-keyserver-url has been set. We
	* test for this in the loop so that we can show info about the
	* preferred keyservers. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& sig->flags.pref_ks)
	{
	const byte *p;
	int seq = 0;
	size_t n;
	int any_pref_ks = 0;

	while ((p=enum_sig_subpkt (sig, 1, SIGSUBPKT_PREF_KS, &n, &seq, NULL)))
	{
	/* According to my favorite copy editor, in English grammar,
	you say "at" if the key is located on a web page, but
	"from" if it is located on a keyserver. I'm not going to
	even try to make two strings here :) */
	log_info(_("Key available at: ") );
	print_utf8_buffer (log_get_stream(), p, n);
	log_printf ("\n");
	any_pref_ks = 1;

	if ((opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& (opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL))
	{
	struct keyserver_spec *spec;

	spec = parse_preferred_keyserver (sig);
	if (spec)
	{
	int res;

	if (DBG_LOOKUP)
	log_debug ("trying auto-key-retrieve method %s\n",
	"Pref-KS");

	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid,spec, 1);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	- rc = do_check_sig (c, node, extrahash, extrahashlen,
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
	NULL, &is_expkey, &is_revkey, &pk);
	else if (DBG_LOOKUP)
	log_debug ("lookup via %s failed: %s\n", "Pref-KS",
	gpg_strerror (res));
	free_keyserver_spec (spec);

	if (!rc)
	break;
	}
	}
	}

	if (any_pref_ks
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& !(opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL))
	log_info (_("Note: Use '%s' to make use of this info\n"),
	"--keyserver-option honor-keyserver-url");
	}

	/* If the above methods didn't work, our next try is to retrieve the
	* key from the WKD. This requires that WKD is in the AKL and the
	* Signer's UID is in the signature. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& !opt.flags.disable_signer_uid
	&& akl_has_wkd_method ()
	&& sig->signers_uid)
	{
	int res;

	if (DBG_LOOKUP)
	log_debug ("trying auto-key-retrieve method %s\n", "WKD");
	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_wkd (c->ctrl, sig->signers_uid, 1, NULL, NULL);
	glo_ctrl.in_auto_key_retrieve--;
	/* Fixme: If the fingerprint is embedded in the signature,
	* compare it to the fingerprint of the returned key. */
	if (!res)
	- rc = do_check_sig (c, node, extrahash, extrahashlen,
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
	NULL, &is_expkey, &is_revkey, &pk);
	else if (DBG_LOOKUP)
	log_debug ("lookup via %s failed: %s\n", "WKD", gpg_strerror (res));
	}

	/* If the avove methods didn't work, our next try is to use the URI
	* from a DNS PKA record. This is a legacy method which will
	* eventually be removed. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options & KEYSERVER_AUTO_KEY_RETRIEVE)
	&& (opt.keyserver_options.options & KEYSERVER_HONOR_PKA_RECORD))
	{
	const char *uri = pka_uri_from_sig (c, sig);

	if (uri)
	{
	/* FIXME: We might want to locate the key using the
	fingerprint instead of the keyid. */
	int res;
	struct keyserver_spec *spec;

	spec = parse_keyserver_uri (uri, 1);
	if (spec)
	{
	if (DBG_LOOKUP)
	log_debug ("trying auto-key-retrieve method %s\n", "PKA");

	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_keyid (c->ctrl, sig->keyid, spec, 1);
	glo_ctrl.in_auto_key_retrieve--;
	free_keyserver_spec (spec);
	if (!res)
	- rc = do_check_sig (c, node, extrahash, extrahashlen,
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
	NULL, &is_expkey, &is_revkey, &pk);
	else if (DBG_LOOKUP)
	log_debug ("lookup via %s failed: %s\n", "PKA",
	gpg_strerror (res));
	}
	}
	}

	/* If the above methods didn't work, our next try is to locate
	* the key via its fingerprint from a keyserver. This requires
	* that the signers fingerprint is encoded in the signature. */
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
	&& (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
	&& keyserver_any_configured (c->ctrl))
	{
	int res;
	const byte *p;
	size_t n;

	p = issuer_fpr_raw (sig, &n);
	if (p)
	{
	if (DBG_LOOKUP)
	log_debug ("trying auto-key-retrieve method %s\n", "KS");

	/* v4 or v5 packet with a SHA-1/256 fingerprint. */
	free_public_key (pk);
	pk = NULL;
	glo_ctrl.in_auto_key_retrieve++;
	res = keyserver_import_fprint (c->ctrl, p, n, opt.keyserver, 1);
	glo_ctrl.in_auto_key_retrieve--;
	if (!res)
	- rc = do_check_sig (c, node, extrahash, extrahashlen,
	+ rc = do_check_sig (c, node, extrahash, extrahashlen, NULL,
	NULL, &is_expkey, &is_revkey, &pk);
	else if (DBG_LOOKUP)
	log_debug ("lookup via %s failed: %s\n", "KS", gpg_strerror (res));
	}
	}

	if (!rc \|\| gpg_err_code (rc) == GPG_ERR_BAD_SIGNATURE)
	{
	kbnode_t un, keyblock;
	int count = 0;
	int statno;
	char keyid_str[50];
	PKT_public_key *mainpk = NULL;

	if (rc)
	statno = STATUS_BADSIG;
	else if (sig->flags.expired)
	statno = STATUS_EXPSIG;
	else if (is_expkey)
	statno = STATUS_EXPKEYSIG;
	else if(is_revkey)
	statno = STATUS_REVKEYSIG;
	else
	statno = STATUS_GOODSIG;

	/* FIXME: We should have the public key in PK and thus the
	* keyblock has already been fetched. Thus we could use the
	* fingerprint or PK itself to lookup the entire keyblock. That
	* would best be done with a cache. */
	- keyblock = get_pubkeyblock_for_sig (c->ctrl, sig);
	+ if (included_keyblock)
	+ {
	+ keyblock = included_keyblock;
	+ included_keyblock = NULL;
	+ }
	+ else
	+ keyblock = get_pubkeyblock_for_sig (c->ctrl, sig);

	snprintf (keyid_str, sizeof keyid_str, "%08lX%08lX [uncertain] ",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1]);

	/* Find and print the primary user ID along with the
	"Good\|Expired\|Bad signature" line. */
	for (un=keyblock; un; un = un->next)
	{
	int valid;

	if (un->pkt->pkttype==PKT_PUBLIC_KEY)
	{
	mainpk = un->pkt->pkt.public_key;
	continue;
	}
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if (!un->pkt->pkt.user_id->created)
	continue;
	if (un->pkt->pkt.user_id->flags.revoked)
	continue;
	if (un->pkt->pkt.user_id->flags.expired)
	continue;
	if (!un->pkt->pkt.user_id->flags.primary)
	continue;
	/* We want the textual primary user ID here */
	if (un->pkt->pkt.user_id->attrib_data)
	continue;

	log_assert (mainpk);

	/* Since this is just informational, don't actually ask the
	user to update any trust information. (Note: we register
	the signature later.) Because print_good_bad_signature
	does not print a LF we need to compute the validity
	before calling that function. */
	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	valid = get_validity (c->ctrl, keyblock, mainpk,
	un->pkt->pkt.user_id, NULL, 0);
	else
	valid = 0; /* Not used. */

	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	log_printf (" [%s]\n",trust_value_to_string(valid));
	else
	log_printf ("\n");

	count++;
	}

	log_assert (mainpk);

	/* In case we did not found a valid textual userid above
	we print the first user id packet or a "[?]" instead along
	with the "Good\|Expired\|Bad signature" line. */
	if (!count)
	{
	/* Try for an invalid textual userid */
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID
	&& !un->pkt->pkt.user_id->attrib_data)
	break;
	}

	/* Try for any userid at all */
	if (!un)
	{
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype == PKT_USER_ID)
	break;
	}
	}

	if (opt.trust_model==TM_ALWAYS \|\| !un)
	keyid_str[17] = 0; /* cut off the "[uncertain]" part */

	print_good_bad_signature (statno, keyid_str, un, sig, rc);

	if (opt.trust_model != TM_ALWAYS && un)
	log_printf (" %s",_("[uncertain]") );
	log_printf ("\n");
	}

	/* If we have a good signature and already printed
	* the primary user ID, print all the other user IDs */
	if (count
	&& !rc
	&& !(opt.verify_options & VERIFY_SHOW_PRIMARY_UID_ONLY))
	{
	char *p;
	for( un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID)
	continue;
	if ((un->pkt->pkt.user_id->flags.revoked
	\|\| un->pkt->pkt.user_id->flags.expired)
	&& !(opt.verify_options & VERIFY_SHOW_UNUSABLE_UIDS))
	continue;
	/* Skip textual primary user ids which we printed above. */
	if (un->pkt->pkt.user_id->flags.primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	/* If this user id has attribute data, print that. */
	if (un->pkt->pkt.user_id->attrib_data)
	{
	dump_attribs (un->pkt->pkt.user_id, mainpk);

	if (opt.verify_options&VERIFY_SHOW_PHOTOS)
	show_photos (c->ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs,
	mainpk ,un->pkt->pkt.user_id);
	}

	p = utf8_to_native (un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len, 0);
	log_info (_(" aka \"%s\""), p);
	xfree (p);

	if ((opt.verify_options & VERIFY_SHOW_UID_VALIDITY))
	{
	const char *valid;

	if (un->pkt->pkt.user_id->flags.revoked)
	valid = _("revoked");
	else if (un->pkt->pkt.user_id->flags.expired)
	valid = _("expired");
	else
	/* Since this is just informational, don't
	actually ask the user to update any trust
	information. */
	valid = (trust_value_to_string
	(get_validity (c->ctrl, keyblock, mainpk,
	un->pkt->pkt.user_id, NULL, 0)));
	log_printf (" [%s]\n",valid);
	}
	else
	log_printf ("\n");
	}
	}

	/* For good signatures print notation data. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_SHOW_POLICY_URLS))
	show_policy_url (sig, 0, 1);
	else
	show_policy_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_KEYSERVER_URLS))
	show_keyserver_url (sig, 0, 1);
	else
	show_keyserver_url (sig, 0, 2);

	if ((opt.verify_options & VERIFY_SHOW_NOTATIONS))
	show_notation
	(sig, 0, 1,
	(((opt.verify_options&VERIFY_SHOW_STD_NOTATIONS)?1:0)
	+ ((opt.verify_options&VERIFY_SHOW_USER_NOTATIONS)?2:0)));
	else
	show_notation (sig, 0, 2, 0);
	}

	/* For good signatures print the VALIDSIG status line. */
	if (!rc && is_status_enabled () && pk)
	{
	char pkhex[MAX_FINGERPRINT_LEN*2+1];
	char mainpkhex[MAX_FINGERPRINT_LEN*2+1];

	hexfingerprint (pk, pkhex, sizeof pkhex);
	hexfingerprint (mainpk, mainpkhex, sizeof mainpkhex);

	/* TODO: Replace the reserved '0' in the field below with
	bits for status flags (policy url, notation, etc.). */
	write_status_printf (STATUS_VALIDSIG,
	"%s %s %lu %lu %d 0 %d %d %02X %s",
	pkhex,
	strtimestamp (sig->timestamp),
	(ulong)sig->timestamp,
	(ulong)sig->expiredate,
	sig->version, sig->pubkey_algo,
	sig->digest_algo,
	sig->sig_class,
	mainpkhex);
	}

	/* Print compliance warning for Good signatures. */
	if (!rc && pk && !opt.quiet
	&& !gnupg_pk_is_compliant (opt.compliance, pk->pubkey_algo,
	pk->pkey, nbits_from_pk (pk), NULL))
	{
	log_info (_("WARNING: This key is not suitable for signing"
	" in %s mode\n"),
	gnupg_compliance_option_string (opt.compliance));
	}

	/* For good signatures compute and print the trust information.
	Note that in the Tofu trust model this may ask the user on
	how to resolve a conflict. */
	if (!rc)
	{
	if ((opt.verify_options & VERIFY_PKA_LOOKUPS))
	pka_uri_from_sig (c, sig); /* Make sure PKA info is available. */
	rc = check_signatures_trust (c->ctrl, sig);
	}

	/* Print extra information about the signature. */
	if (sig->flags.expired)
	{
	log_info (_("Signature expired %s\n"), asctimestamp(sig->expiredate));
	rc = GPG_ERR_GENERAL; /* Need a better error here? */
	}
	else if (sig->expiredate)
	log_info (_("Signature expires %s\n"), asctimestamp(sig->expiredate));

	if (opt.verbose)
	{
	char pkstrbuf[PUBKEY_STRING_SIZE];

	if (pk)
	pubkey_string (pk, pkstrbuf, sizeof pkstrbuf);
	else
	*pkstrbuf = 0;

	log_info (_("%s signature, digest algorithm %s%s%s\n"),
	sig->sig_class==0x00?_("binary"):
	sig->sig_class==0x01?_("textmode"):_("unknown"),
	gcry_md_algo_name (sig->digest_algo),
	*pkstrbuf?_(", key algorithm "):"", pkstrbuf);
	}

	/* Print final warnings. */
	if (!rc && !c->signed_data.used)
	{
	/* Signature is basically good but we test whether the
	deprecated command
	gpg --verify FILE.sig
	was used instead of
	gpg --verify FILE.sig FILE
	to verify a detached signature. If we figure out that a
	data file with a matching name exists, we print a warning.

	The problem is that the first form would also verify a
	standard signature. This behavior could be used to
	create a made up .sig file for a tarball by creating a
	standard signature from a valid detached signature packet
	(for example from a signed git tag). Then replace the
	sig file on the FTP server along with a changed tarball.
	Using the first form the verify command would correctly
	verify the signature but don't even consider the tarball. */
	kbnode_t n;
	char *dfile;

	dfile = get_matching_datafile (c->sigfilename);
	if (dfile)
	{
	for (n = c->list; n; n = n->next)
	if (n->pkt->pkttype != PKT_SIGNATURE)
	break;
	if (n)
	{
	/* Not only signature packets in the tree thus this
	is not a detached signature. */
	log_info (_("WARNING: not a detached signature; "
	"file '%s' was NOT verified!\n"), dfile);
	}
	xfree (dfile);
	}
	}

	/* Compute compliance with CO_DE_VS. */
	if (pk && is_status_enabled ()
	&& gnupg_pk_is_compliant (CO_DE_VS, pk->pubkey_algo, pk->pkey,
	nbits_from_pk (pk), NULL)
	&& gnupg_digest_is_compliant (CO_DE_VS, sig->digest_algo))
	write_status_strings (STATUS_VERIFICATION_COMPLIANCE_MODE,
	gnupg_status_compliance_flag (CO_DE_VS),
	NULL);

	free_public_key (pk);
	pk = NULL;
	release_kbnode( keyblock );
	if (rc)
	g10_errors_seen = 1;
	if (opt.batch && rc)
	g10_exit (1);
	}
	else
	{
	write_status_printf (STATUS_ERRSIG, "%08lX%08lX %d %d %02x %lu %d %s",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1],
	sig->pubkey_algo, sig->digest_algo,
	sig->sig_class, (ulong)sig->timestamp,
	gpg_err_code (rc),
	issuer_fpr? issuer_fpr:"-");
	if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
	{
	write_status_printf (STATUS_NO_PUBKEY, "%08lX%08lX",
	(ulong)sig->keyid[0], (ulong)sig->keyid[1]);
	}
	if (gpg_err_code (rc) != GPG_ERR_NOT_PROCESSED)
	log_error (_("Can't check signature: %s\n"), gpg_strerror (rc));
	}

	free_public_key (pk);
	+ release_kbnode (included_keyblock);
	xfree (issuer_fpr);
	return rc;
	}


	/*
	* Process the tree which starts at node
	*/
	static void
	proc_tree (CTX c, kbnode_t node)
	{
	kbnode_t n1;
	int rc;

	if (opt.list_packets \|\| opt.list_only)
	return;

	/* We must skip our special plaintext marker packets here because
	they may be the root packet. These packets are only used in
	additional checks and skipping them here doesn't matter. */
	while (node
	&& node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_PLAINTEXT_MARK)
	{
	node = node->next;
	}
	if (!node)
	return;

	c->trustletter = ' ';
	if (node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
	{
	merge_keys_and_selfsig (c->ctrl, node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_SECRET_KEY)
	{
	merge_keys_and_selfsig (c->ctrl, node);
	list_node (c, node);
	}
	else if (node->pkt->pkttype == PKT_ONEPASS_SIG)
	{
	/* Check all signatures. */
	if (!c->any.data)
	{
	int use_textmode = 0;

	free_md_filter_context (&c->mfx);
	/* Prepare to create all requested message digests. */
	rc = gcry_md_open (&c->mfx.md, 0, 0);
	if (rc)
	goto hash_err;

	/* Fixme: why looking for the signature packet and not the
	one-pass packet? */
	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	gcry_md_enable (c->mfx.md, n1->pkt->pkt.signature->digest_algo);

	if (n1 && n1->pkt->pkt.onepass_sig->sig_class == 0x01)
	use_textmode = 1;

	/* Ask for file and hash it. */
	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, NULL,
	c->signed_data.data_fd,
	use_textmode);
	else
	rc = hash_datafiles (c->mfx.md, NULL,
	c->signed_data.data_names,
	c->sigfilename,
	use_textmode);
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname (c->iobuf),
	use_textmode);
	}

	hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_GPG_CONTROL
	&& node->pkt->pkt.gpg_control->control == CTRLPKT_CLEARSIGN_START)
	{
	/* Clear text signed message. */
	if (!c->any.data)
	{
	log_error ("cleartext signature without data\n");
	return;
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}

	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE));)
	check_sig_and_print (c, n1);

	}
	else if (node->pkt->pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = node->pkt->pkt.signature;
	int multiple_ok = 1;

	n1 = find_next_kbnode (node, PKT_SIGNATURE);
	if (n1)
	{
	byte class = sig->sig_class;
	byte hash = sig->digest_algo;

	for (; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	{
	/* We can't currently handle multiple signatures of
	* different classes (we'd pretty much have to run a
	* different hash context for each), but if they are all
	* the same and it is detached signature, we make an
	* exception. Note that the old code also disallowed
	* multiple signatures if the digest algorithms are
	* different. We softened this restriction only for
	* detached signatures, to be on the safe side. */
	if (n1->pkt->pkt.signature->sig_class != class
	\|\| (c->any.data
	&& n1->pkt->pkt.signature->digest_algo != hash))
	{
	multiple_ok = 0;
	log_info (_("WARNING: multiple signatures detected. "
	"Only the first will be checked.\n"));
	break;
	}
	}
	}

	if (sig->sig_class != 0x00 && sig->sig_class != 0x01)
	{
	log_info(_("standalone signature of class 0x%02x\n"), sig->sig_class);
	}
	else if (!c->any.data)
	{
	/* Detached signature */
	free_md_filter_context (&c->mfx);
	rc = gcry_md_open (&c->mfx.md, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;

	if (multiple_ok)
	{
	/* If we have and want to handle multiple signatures we
	* need to enable all hash algorithms for the context. */
	for (n1 = node; (n1 = find_next_kbnode (n1, PKT_SIGNATURE)); )
	if (!openpgp_md_test_algo (n1->pkt->pkt.signature->digest_algo))
	gcry_md_enable (c->mfx.md,
	map_md_openpgp_to_gcry
	(n1->pkt->pkt.signature->digest_algo));
	}

	if (RFC2440 \|\| RFC4880)
	; /* Strict RFC mode. */
	else if (sig->digest_algo == DIGEST_ALGO_SHA1
	&& sig->pubkey_algo == PUBKEY_ALGO_DSA
	&& sig->sig_class == 0x01)
	{
	/* Enable a workaround for a pgp5 bug when the detached
	* signature has been created in textmode. Note that we
	* do not implement this for multiple signatures with
	* different hash algorithms. */
	rc = gcry_md_open (&c->mfx.md2, sig->digest_algo, 0);
	if (rc)
	goto detached_hash_err;
	}

	/* Here we used to have another hack to work around a pgp
	* 2 bug: It worked by not using the textmode for detached
	* signatures; this would let the first signature check
	* (on md) fail but the second one (on md2), which adds an
	* extra CR would then have produced the "correct" hash.
	* This is very, very ugly hack but it may haved help in
	* some cases (and break others).
	* c->mfx.md2? 0 :(sig->sig_class == 0x01)
	*/

	if (DBG_HASHING)
	{
	gcry_md_debug (c->mfx.md, "verify");
	if (c->mfx.md2)
	gcry_md_debug (c->mfx.md2, "verify2");
	}

	if (c->sigs_only)
	{
	if (c->signed_data.used && c->signed_data.data_fd != -1)
	rc = hash_datafile_by_fd (c->mfx.md, c->mfx.md2,
	c->signed_data.data_fd,
	(sig->sig_class == 0x01));
	else
	rc = hash_datafiles (c->mfx.md, c->mfx.md2,
	c->signed_data.data_names,
	c->sigfilename,
	(sig->sig_class == 0x01));
	}
	else
	{
	rc = ask_for_detached_datafile (c->mfx.md, c->mfx.md2,
	iobuf_get_real_fname(c->iobuf),
	(sig->sig_class == 0x01));
	}

	detached_hash_err:
	if (rc)
	{
	log_error ("can't hash datafile: %s\n", gpg_strerror (rc));
	return;
	}
	}
	else if (c->signed_data.used)
	{
	log_error (_("not a detached signature\n"));
	return;
	}
	else if (!opt.quiet)
	log_info (_("old style (PGP 2.x) signature\n"));

	if (multiple_ok)
	{
	for (n1 = node; n1; (n1 = find_next_kbnode(n1, PKT_SIGNATURE)))
	check_sig_and_print (c, n1);
	}
	else
	check_sig_and_print (c, node);

	}
	else
	{
	dump_kbnode (c->list);
	log_error ("invalid root packet detected in proc_tree()\n");
	dump_kbnode (node);
	}
	}
	diff --git a/g10/packet.h b/g10/packet.h
	index db4945237..5c0de577c 100644
	--- a/g10/packet.h
	+++ b/g10/packet.h
	@@ -1,961 +1,963 @@
	/* packet.h - OpenPGP packet definitions
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
	* 2007 Free Software Foundation, Inc.
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#ifndef G10_PACKET_H
	#define G10_PACKET_H

	#include "../common/types.h"
	#include "../common/iobuf.h"
	#include "../common/strlist.h"
	#include "dek.h"
	#include "filter.h"
	#include "../common/openpgpdefs.h"
	#include "../common/userids.h"
	#include "../common/util.h"

	#define DEBUG_PARSE_PACKET 1

	/* Maximum length of packets to avoid excessive memory allocation. */
	#define MAX_KEY_PACKET_LENGTH (256 * 1024)
	#define MAX_UID_PACKET_LENGTH ( 2 * 1024)
	#define MAX_COMMENT_PACKET_LENGTH ( 64 * 1024)
	#define MAX_ATTR_PACKET_LENGTH ( 16 * 1024*1024)

	/* Constants to allocate static MPI arrays. */
	#define PUBKEY_MAX_NPKEY OPENPGP_MAX_NPKEY
	#define PUBKEY_MAX_NSKEY OPENPGP_MAX_NSKEY
	#define PUBKEY_MAX_NSIG OPENPGP_MAX_NSIG
	#define PUBKEY_MAX_NENC OPENPGP_MAX_NENC

	/* Usage flags */
	#define PUBKEY_USAGE_SIG GCRY_PK_USAGE_SIGN /* Good for signatures. */
	#define PUBKEY_USAGE_ENC GCRY_PK_USAGE_ENCR /* Good for encryption. */
	#define PUBKEY_USAGE_CERT GCRY_PK_USAGE_CERT /* Also good to certify keys.*/
	#define PUBKEY_USAGE_AUTH GCRY_PK_USAGE_AUTH /* Good for authentication. */
	#define PUBKEY_USAGE_UNKNOWN GCRY_PK_USAGE_UNKN /* Unknown usage flag. */
	#define PUBKEY_USAGE_NONE 256 /* No usage given. */
	#if (GCRY_PK_USAGE_SIGN \| GCRY_PK_USAGE_ENCR \| GCRY_PK_USAGE_CERT \
	\| GCRY_PK_USAGE_AUTH \| GCRY_PK_USAGE_UNKN) >= 256
	# error Please choose another value for PUBKEY_USAGE_NONE
	#endif

	/* Helper macros. */
	#define is_RSA(a) ((a)==PUBKEY_ALGO_RSA \|\| (a)==PUBKEY_ALGO_RSA_E \
	\|\| (a)==PUBKEY_ALGO_RSA_S )
	#define is_ELGAMAL(a) ((a)==PUBKEY_ALGO_ELGAMAL_E)
	#define is_DSA(a) ((a)==PUBKEY_ALGO_DSA)

	/* A pointer to the packet object. */
	typedef struct packet_struct PACKET;

	/* PKT_GPG_CONTROL types */
	typedef enum {
	CTRLPKT_CLEARSIGN_START = 1,
	CTRLPKT_PIPEMODE = 2,
	CTRLPKT_PLAINTEXT_MARK =3
	} ctrlpkttype_t;

	typedef enum {
	PREFTYPE_NONE = 0,
	PREFTYPE_SYM = 1,
	PREFTYPE_HASH = 2,
	PREFTYPE_ZIP = 3,
	PREFTYPE_AEAD = 4
	} preftype_t;

	typedef struct {
	byte type;
	byte value;
	} prefitem_t;

	/* A string-to-key specifier as defined in RFC 4880, Section 3.7. */
	typedef struct
	{
	int mode; /* Must be an integer due to the GNU modes 1001 et al. */
	byte hash_algo;
	byte salt[8];
	/* The coded (i.e., the serialized version) iteration count. */
	u32 count;
	} STRING2KEY;

	/* A symmetric-key encrypted session key packet as defined in RFC
	4880, Section 5.3. All fields are serialized. */
	typedef struct {
	/* We support version 4 (rfc4880) and 5 (rfc4880bis). */
	byte version;
	/* The cipher algorithm used to encrypt the session key. Note that
	* this may be different from the algorithm that is used to encrypt
	* bulk data. */
	byte cipher_algo;
	/* The AEAD algorithm or 0 for CFB encryption. */
	byte aead_algo;
	/* The string-to-key specifier. */
	STRING2KEY s2k;
	/* The length of SESKEY in bytes or 0 if this packet does not
	encrypt a session key. (In the latter case, the results of the
	S2K function on the password is the session key. See RFC 4880,
	Section 5.3.) */
	byte seskeylen;
	/* The session key as encrypted by the S2K specifier. For AEAD this
	* includes the nonce and the authentication tag. */
	byte seskey[1];
	} PKT_symkey_enc;

	/* A public-key encrypted session key packet as defined in RFC 4880,
	Section 5.1. All fields are serialized. */
	typedef struct {
	/* The 64-bit keyid. */
	u32 keyid[2];
	/* The packet's version. Currently, only version 3 is defined. */
	byte version;
	/* The algorithm used for the public key encryption scheme. */
	byte pubkey_algo;
	/* Whether to hide the key id. This value is not directly
	serialized. */
	byte throw_keyid;
	/* The session key. */
	gcry_mpi_t data[PUBKEY_MAX_NENC];
	} PKT_pubkey_enc;


	/* An object to build a list of public-key encrypted session key. */
	struct pubkey_enc_list
	{
	struct pubkey_enc_list *next;
	u32 keyid[2];
	int pubkey_algo;
	int result;
	gcry_mpi_t data[PUBKEY_MAX_NENC];
	};


	/* A one-pass signature packet as defined in RFC 4880, Section
	5.4. All fields are serialized. */
	typedef struct {
	u32 keyid[2]; /* The 64-bit keyid */
	/* The signature's classification (RFC 4880, Section 5.2.1). */
	byte sig_class;
	byte digest_algo; /* algorithm used for digest */
	byte pubkey_algo; /* algorithm used for public key scheme */
	/* A message can be signed by multiple keys. In this case, there
	are n one-pass signature packets before the message to sign and
	n signatures packets after the message. It is conceivable that
	someone wants to not only sign the message, but all of the
	signatures. Now we need to distinguish between signing the
	message and signing the message plus the surrounding
	signatures. This is the point of this flag. If set, it means:
	I sign all of the data starting at the next packet. */
	byte last;
	} PKT_onepass_sig;


	/* A v4 OpenPGP signature has a hashed and unhashed area containing
	co-called signature subpackets (RFC 4880, Section 5.2.3). These
	areas are described by this data structure. Use enum_sig_subpkt to
	parse this area. */
	typedef struct {
	size_t size; /* allocated */
	size_t len; /* used (serialized) */
	byte data[1]; /* the serialized subpackes (serialized) */
	} subpktarea_t;

	/* The in-memory representation of a designated revoker signature
	subpacket (RFC 4880, Section 5.2.3.15). */
	struct revocation_key {
	/* A bit field. 0x80 must be set. 0x40 means this information is
	sensitive (and should not be uploaded to a keyserver by
	default). */
	byte class;
	/* The public-key algorithm ID. */
	byte algid;
	/* The length of the fingerprint. */
	byte fprlen;
	/* The fingerprint of the authorized key. */
	byte fpr[MAX_FINGERPRINT_LEN];
	};


	/* Object to keep information about a PKA DNS record. */
	typedef struct
	{
	int valid; /* An actual PKA record exists for EMAIL. */
	int checked; /* Set to true if the FPR has been checked against the
	actual key. */
	char uri; / Malloced string with the URI. NULL if the URI is
	not available.*/
	unsigned char fpr[20]; /* The fingerprint as stored in the PKA RR. */
	char email[1];/* The email address from the notation data. */
	} pka_info_t;


	/* A signature packet (RFC 4880, Section 5.2). Only a subset of these
	fields are directly serialized (these are marked as such); the rest
	are read from the subpackets, which are not synthesized when
	serializing this data structure (i.e., when using build_packet()).
	Instead, the subpackets must be created by hand. */
	typedef struct
	{
	struct
	{
	unsigned checked:1; /* Signature has been checked. */
	unsigned valid:1; /* Signature is good (if checked is set). */
	unsigned chosen_selfsig:1; /* A selfsig that is the chosen one. */
	unsigned unknown_critical:1;
	unsigned exportable:1;
	unsigned revocable:1;
	unsigned policy_url:1; /* At least one policy URL is present */
	unsigned notation:1; /* At least one notation is present */
	unsigned pref_ks:1; /* At least one preferred keyserver is present */
	+ unsigned key_block:1; /* A key block subpacket is present. */
	unsigned expired:1;
	unsigned pka_tried:1; /* Set if we tried to retrieve the PKA record. */
	} flags;
	/* The key that allegedly generated this signature. (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as an issuer subpacket (5.2.3.5.) */
	u32 keyid[2];
	/* When the signature was made (seconds since the Epoch). (Directly
	serialized in v3 sigs; for v4 sigs, this must be explicitly added
	as a signature creation time subpacket (5.2.3.4).) */
	u32 timestamp;
	u32 expiredate; /* Expires at this date or 0 if not at all. */
	/* The serialization format used / to use. If 0, then defaults to
	version 3. (Serialized.) */
	byte version;
	/* The signature type. (See RFC 4880, Section 5.2.1.) */
	byte sig_class;
	/* Algorithm used for public key scheme (e.g., PUBKEY_ALGO_RSA).
	(Serialized.) */
	byte pubkey_algo;
	/* Algorithm used for digest (e.g., DIGEST_ALGO_SHA1).
	(Serialized.) */
	byte digest_algo;
	byte trust_depth;
	byte trust_value;
	const byte *trust_regexp;
	struct revocation_key *revkey;
	int numrevkeys;
	int help_counter; /* Used internally bu some functions. */
	pka_info_t pka_info; / Malloced PKA data or NULL if not
	available. See also flags.pka_tried. */
	char signers_uid; / Malloced value of the SIGNERS_UID
	* subpacket or NULL. This string has
	* already been sanitized. */
	subpktarea_t hashed; / All subpackets with hashed data (v4 only). */
	subpktarea_t unhashed; / Ditto for unhashed data. */
	/* First 2 bytes of the digest. (Serialized. Note: this is not
	automatically filled in when serializing a signature!) */
	byte digest_start[2];
	/* The signature. (Serialized.) */
	gcry_mpi_t data[PUBKEY_MAX_NSIG];
	/* The message digest and its length (in bytes). Note the maximum
	digest length is 512 bits (64 bytes). If DIGEST_LEN is 0, then
	the digest's value has not been saved here. */
	byte digest[512 / 8];
	int digest_len;
	} PKT_signature;

	#define ATTRIB_IMAGE 1

	/* This is the cooked form of attributes. */
	struct user_attribute {
	byte type;
	const byte *data;
	u32 len;
	};


	/* A user id (RFC 4880, Section 5.11) or a user attribute packet (RFC
	4880, Section 5.12). Only a subset of these fields are directly
	serialized (these are marked as such); the rest are read from the
	self-signatures in merge_keys_and_selfsig()). */
	typedef struct
	{
	int ref; /* reference counter */
	/* The length of NAME. */
	int len;
	struct user_attribute *attribs;
	int numattribs;
	/* If this is not NULL, the packet is a user attribute rather than a
	user id (See RFC 4880 5.12). (Serialized.) */
	byte *attrib_data;
	/* The length of ATTRIB_DATA. */
	unsigned long attrib_len;
	byte *namehash;
	int help_key_usage;
	u32 help_key_expire;
	int help_full_count;
	int help_marginal_count;
	u32 expiredate; /* expires at this date or 0 if not at all */
	prefitem_t prefs; / list of preferences (may be NULL)*/
	u32 created; /* according to the self-signature */
	u32 keyupdate; /* From the ring trust packet. */
	char updateurl; / NULL or the URL of the last update origin. */
	byte keyorg; /* From the ring trust packet. */
	byte selfsigversion;
	struct
	{
	unsigned int mdc:1;
	unsigned int aead:1;
	unsigned int ks_modify:1;
	unsigned int compacted:1;
	unsigned int primary:2; /* 2 if set via the primary flag, 1 if calculated */
	unsigned int revoked:1;
	unsigned int expired:1;
	} flags;

	char mbox; / NULL or the result of mailbox_from_userid. */

	/* The text contained in the user id packet, which is normally the
	* name and email address of the key holder (See RFC 4880 5.11).
	* (Serialized.). For convenience an extra Nul is always appended. */
	char name[1];
	} PKT_user_id;



	struct revoke_info
	{
	/* revoked at this date */
	u32 date;
	/* the keyid of the revoking key (selfsig or designated revoker) */
	u32 keyid[2];
	/* the algo of the revoking key */
	byte algo;
	};


	/* Information pertaining to secret keys. */
	struct seckey_info
	{
	int is_protected:1; /* The secret info is protected and must */
	/* be decrypted before use, the protected */
	/* MPIs are simply (void) pointers to memory /
	/* and should never be passed to a mpi_xxx() */
	int sha1chk:1; /* SHA1 is used instead of a 16 bit checksum */
	u16 csum; /* Checksum for old protection modes. */
	byte algo; /* Cipher used to protect the secret information. */
	STRING2KEY s2k; /* S2K parameter. */
	byte ivlen; /* Used length of the IV. */
	byte iv[16]; /* Initialization vector for CFB mode. */
	};


	/****************
	* The in-memory representation of a public key (RFC 4880, Section
	* 5.5). Note: this structure contains significantly more information
	* than is contained in an OpenPGP public key packet. This
	* information is derived from the self-signed signatures (by
	* merge_keys_and_selfsig()) and is ignored when serializing the
	* packet. The fields that are actually written out when serializing
	* this packet are marked as accordingly.
	*
	* We assume that secret keys have the same number of parameters as
	* the public key and that the public parameters are the first items
	* in the PKEY array. Thus NPKEY is always less than NSKEY and it is
	* possible to compare the secret and public keys by comparing the
	* first NPKEY elements of the PKEY array. Note that since GnuPG 2.1
	* we don't use secret keys anymore directly because they are managed
	* by gpg-agent. However for parsing OpenPGP key files we need a way
	* to temporary store those secret keys. We do this by putting them
	* into the public key structure and extending the PKEY field to NSKEY
	* elements; the extra secret key information are stored in the
	* SECKEY_INFO field.
	*/
	typedef struct
	{
	/* When the key was created. (Serialized.) */
	u32 timestamp;
	u32 expiredate; /* expires at this date or 0 if not at all */
	u32 max_expiredate; /* must not expire past this date */
	struct revoke_info revoked;
	/* An OpenPGP packet consists of a header and a body. This is the
	size of the header. If this is 0, an appropriate size is
	automatically chosen based on the size of the body.
	(Serialized.) */
	byte hdrbytes;
	/* The serialization format. If 0, the default version (4) is used
	when serializing. (Serialized.) */
	byte version;
	byte selfsigversion; /* highest version of all of the self-sigs */
	/* The public key algorithm. (Serialized.) */
	byte pubkey_algo;
	byte pubkey_usage; /* for now only used to pass it to getkey() */
	byte req_usage; /* hack to pass a request to getkey() */
	byte fprlen; /* 0 or length of FPR. */
	u32 has_expired; /* set to the expiration date if expired */
	/* keyid of the primary key. Never access this value directly.
	Instead, use pk_main_keyid(). */
	u32 main_keyid[2];
	/* keyid of this key. Never access this value directly! Instead,
	use pk_keyid(). */
	u32 keyid[2];
	/* Fingerprint of the key. Only valid if FPRLEN is not 0. */
	byte fpr[MAX_FINGERPRINT_LEN];
	prefitem_t prefs; / list of preferences (may be NULL) */
	struct
	{
	unsigned int mdc:1; /* MDC feature set. */
	unsigned int aead:1; /* AEAD feature set. */
	unsigned int disabled_valid:1;/* The next flag is valid. */
	unsigned int disabled:1; /* The key has been disabled. */
	unsigned int primary:1; /* This is a primary key. */
	unsigned int revoked:2; /* Key has been revoked.
	1 = revoked by the owner
	2 = revoked by designated revoker. */
	unsigned int maybe_revoked:1; /* A designated revocation is
	present, but without the key to
	check it. */
	unsigned int valid:1; /* Key (especially subkey) is valid. */
	unsigned int dont_cache:1; /* Do not cache this key. */
	unsigned int backsig:2; /* 0=none, 1=bad, 2=good. */
	unsigned int serialno_valid:1;/* SERIALNO below is valid. */
	unsigned int exact:1; /* Found via exact (!) search. */
	} flags;
	PKT_user_id user_id; / If != NULL: found by that uid. */
	struct revocation_key *revkey;
	int numrevkeys;
	u32 trust_timestamp;
	byte trust_depth;
	byte trust_value;
	byte keyorg; /* From the ring trust packet. */
	u32 keyupdate; /* From the ring trust packet. */
	char updateurl; / NULL or the URL of the last update origin. */
	const byte *trust_regexp;
	char serialno; / Malloced hex string or NULL if it is
	likely not on a card. See also
	flags.serialno_valid. */
	/* If not NULL this malloced structure describes a secret key.
	(Serialized.) */
	struct seckey_info *seckey_info;
	/* The public key. Contains pubkey_get_npkey (pubkey_algo) +
	pubkey_get_nskey (pubkey_algo) MPIs. (If pubkey_get_npkey
	returns 0, then the algorithm is not understood and the PKEY
	contains a single opaque MPI.) (Serialized.) */
	gcry_mpi_t pkey[PUBKEY_MAX_NSKEY]; /* Right, NSKEY elements. */
	} PKT_public_key;

	/* Evaluates as true if the pk is disabled, and false if it isn't. If
	there is no disable value cached, fill one in. */
	#define pk_is_disabled(a) \
	(((a)->flags.disabled_valid)? \
	((a)->flags.disabled):(cache_disabled_value(ctrl,(a))))


	typedef struct {
	int len; /* length of data */
	char data[1];
	} PKT_comment;

	/* A compression packet (RFC 4880, Section 5.6). */
	typedef struct {
	/* Not used. */
	u32 len;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* The compression algorithm. */
	byte algorithm;
	/* An iobuf holding the data to be decompressed. (This is not used
	for compression!) */
	iobuf_t buf;
	} PKT_compressed;

	/* A symmetrically encrypted data packet (RFC 4880, Section 5.7) or a
	symmetrically encrypted integrity protected data packet (Section
	5.13) */
	typedef struct {
	/* Remaining length of encrypted data. */
	u32 len;
	/* When encrypting in CFB mode, the first block size bytes of data
	* are random data and the following 2 bytes are copies of the last
	* two bytes of the random data (RFC 4880, Section 5.7). This
	* provides a simple check that the key is correct. EXTRALEN is the
	* size of this extra data or, in AEAD mode, the length of the
	* headers and the tags. This is used by build_packet when writing
	* out the packet's header. */
	int extralen;
	/* Whether the serialized version of the packet used / should use
	the new format. */
	byte new_ctb;
	/* Whether the packet has an indeterminate length (old format) or
	was encoded using partial body length headers (new format).
	Note: this is ignored when encrypting. */
	byte is_partial;
	/* If 0, MDC is disabled. Otherwise, the MDC method that was used
	(only DIGEST_ALGO_SHA1 has ever been defined). */
	byte mdc_method;
	/* If 0, AEAD is not used. Otherwise, the used AEAD algorithm.
	* MDC_METHOD (above) shall be zero if AEAD is used. */
	byte aead_algo;
	/* The cipher algo for/from the AEAD packet. 0 for other encryption
	* packets. */
	byte cipher_algo;
	/* The chunk byte from the AEAD packet. */
	byte chunkbyte;

	/* An iobuf holding the data to be decrypted. (This is not used for
	encryption!) */
	iobuf_t buf;
	} PKT_encrypted;

	typedef struct {
	byte hash[20];
	} PKT_mdc;


	/* Subtypes for the ring trust packet. */
	#define RING_TRUST_SIG 0 /* The classical signature cache. */
	#define RING_TRUST_KEY 1 /* A KEYORG on a primary key. */
	#define RING_TRUST_UID 2 /* A KEYORG on a user id. */

	/* The local only ring trust packet which OpenPGP declares as
	* implementation defined. GnuPG uses this to cache signature
	* verification status and since 2.1.18 also to convey information
	* about the origin of a key. Note that this packet is not part
	* struct packet_struct because we use it only local in the packet
	* parser and builder. */
	typedef struct {
	unsigned int trustval;
	unsigned int sigcache;
	unsigned char subtype; /* The subtype of this ring trust packet. */
	unsigned char keyorg; /* The origin of the key (KEYORG_). /
	u32 keyupdate; /* The wall time the key was last updated. */
	char url; / NULL or the URL of the source. */
	} PKT_ring_trust;


	/* A plaintext packet (see RFC 4880, 5.9). */
	typedef struct {
	/* The length of data in BUF or 0 if unknown. */
	u32 len;
	/* A buffer containing the data stored in the packet's body. */
	iobuf_t buf;
	byte new_ctb;
	byte is_partial; /* partial length encoded */
	/* The data's formatting. This is either 'b', 't', 'u', 'l' or '1'
	(however, the last two are deprecated). */
	int mode;
	u32 timestamp;
	/* The name of the file. This can be at most 255 characters long,
	since namelen is just a byte in the serialized format. */
	int namelen;
	char name[1];
	} PKT_plaintext;

	typedef struct {
	int control;
	size_t datalen;
	char data[1];
	} PKT_gpg_control;

	/* combine all packets into a union */
	struct packet_struct {
	pkttype_t pkttype;
	union {
	void *generic;
	PKT_symkey_enc symkey_enc; / PKT_SYMKEY_ENC */
	PKT_pubkey_enc pubkey_enc; / PKT_PUBKEY_ENC */
	PKT_onepass_sig onepass_sig; / PKT_ONEPASS_SIG */
	PKT_signature signature; / PKT_SIGNATURE */
	PKT_public_key public_key; / PKT_PUBLIC_[SUB]KEY */
	PKT_public_key secret_key; / PKT_SECRET_[SUB]KEY */
	PKT_comment comment; / PKT_COMMENT */
	PKT_user_id user_id; / PKT_USER_ID */
	PKT_compressed compressed; / PKT_COMPRESSED */
	PKT_encrypted encrypted; / PKT_ENCRYPTED[_MDC] */
	PKT_mdc mdc; / PKT_MDC */
	PKT_plaintext plaintext; / PKT_PLAINTEXT */
	PKT_gpg_control gpg_control; / PKT_GPG_CONTROL */
	} pkt;
	};

	#define init_packet(a) do { (a)->pkttype = 0; \
	(a)->pkt.generic = NULL; \
	} while(0)


	/* A notation. See RFC 4880, Section 5.2.3.16. */
	struct notation
	{
	/* The notation's name. */
	char *name;
	/* If the notation is human readable, then the value is stored here
	as a NUL-terminated string. If it is not human readable a human
	readable approximation of the binary value _may_ be stored
	here. */
	char *value;
	/* Sometimes we want to %-expand the value. In these cases, we save
	that transformed value here. */
	char *altvalue;
	/* If the notation is not human readable, then the value is stored
	here. */
	unsigned char *bdat;
	/* The amount of data stored in BDAT.

	Note: if this is 0 and BDAT is NULL, this does not necessarily
	mean that the value is human readable. It could be that we have
	a 0-length value. To determine whether the notation is human
	readable, always check if VALUE is not NULL. This works, because
	if a human-readable value has a length of 0, we will still
	allocate space for the NUL byte. */
	size_t blen;
	struct
	{
	/* The notation is critical. */
	unsigned int critical:1;
	/* The notation is human readable. */
	unsigned int human:1;
	/* The notation should be deleted. */
	unsigned int ignore:1;
	} flags;

	/* A field to facilitate creating a list of notations. */
	struct notation *next;
	};
	typedef struct notation *notation_t;

	/-- mainproc.c --/
	void reset_literals_seen(void);
	int proc_packets (ctrl_t ctrl, void *ctx, iobuf_t a );
	int proc_signature_packets (ctrl_t ctrl, void *ctx, iobuf_t a,
	strlist_t signedfiles, const char *sigfile );
	int proc_signature_packets_by_fd (ctrl_t ctrl,
	void *anchor, IOBUF a, int signed_data_fd );
	int proc_encryption_packets (ctrl_t ctrl, void *ctx, iobuf_t a);
	int list_packets( iobuf_t a );

	const byte issuer_fpr_raw (PKT_signature sig, size_t *r_len);
	char issuer_fpr_string (PKT_signature sig);

	/-- parse-packet.c --/


	void register_known_notation (const char *string);

	/* Sets the packet list mode to MODE (i.e., whether we are dumping a
	packet or not). Returns the current mode. This allows for
	temporarily suspending dumping by doing the following:

	int saved_mode = set_packet_list_mode (0);
	...
	set_packet_list_mode (saved_mode);
	*/
	int set_packet_list_mode( int mode );


	/* A context used with parse_packet. */
	struct parse_packet_ctx_s
	{
	iobuf_t inp; /* The input stream with the packets. */
	struct packet_struct last_pkt; /* The last parsed packet. */
	int free_last_pkt; /* Indicates that LAST_PKT must be freed. */
	int skip_meta; /* Skip ring trust packets. */
	unsigned int n_parsed_packets; /* Number of parsed packets. */
	};
	typedef struct parse_packet_ctx_s *parse_packet_ctx_t;

	#define init_parse_packet(a,i) do { \
	(a)->inp = (i); \
	(a)->last_pkt.pkttype = 0; \
	(a)->last_pkt.pkt.generic= NULL;\
	(a)->free_last_pkt = 0; \
	(a)->skip_meta = 0; \
	(a)->n_parsed_packets = 0; \
	} while (0)

	#define deinit_parse_packet(a) do { \
	if ((a)->free_last_pkt) \
	free_packet (NULL, (a)); \
	} while (0)


	#if DEBUG_PARSE_PACKET
	/* There are debug functions and should not be used directly. */
	int dbg_search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t *retpos, int with_uid,
	const char* file, int lineno );
	int dbg_parse_packet (parse_packet_ctx_t ctx, PACKET *ret_pkt,
	const char *file, int lineno);
	int dbg_copy_all_packets( iobuf_t inp, iobuf_t out,
	const char* file, int lineno );
	int dbg_copy_some_packets( iobuf_t inp, iobuf_t out, off_t stopoff,
	const char* file, int lineno );
	int dbg_skip_some_packets( iobuf_t inp, unsigned n,
	const char* file, int lineno );
	#define search_packet( a,b,c,d ) \
	dbg_search_packet( (a), (b), (c), (d), __FILE__, __LINE__ )
	#define parse_packet( a, b ) \
	dbg_parse_packet( (a), (b), __FILE__, __LINE__ )
	#define copy_all_packets( a,b ) \
	dbg_copy_all_packets((a),(b), __FILE__, __LINE__ )
	#define copy_some_packets( a,b,c ) \
	dbg_copy_some_packets((a),(b),(c), __FILE__, __LINE__ )
	#define skip_some_packets( a,b ) \
	dbg_skip_some_packets((a),(b), __FILE__, __LINE__ )
	#else
	/* Return the next valid OpenPGP packet in *PKT. (This function will
	* skip any packets whose type is 0.) CTX must have been setup prior to
	* calling this function.
	*
	* Returns 0 on success, -1 if EOF is reached, and an error code
	* otherwise. In the case of an error, the packet in *PKT may be
	* partially constructed. As such, even if there is an error, it is
	* necessary to free *PKT to avoid a resource leak. To detect what
	* has been allocated, clear PKT before calling this function. /
	int parse_packet (parse_packet_ctx_t ctx, PACKET *pkt);

	/* Return the first OpenPGP packet in *PKT that contains a key (either
	* a public subkey, a public key, a secret subkey or a secret key) or,
	* if WITH_UID is set, a user id.
	*
	* Saves the position in the pipeline of the start of the returned
	* packet (according to iobuf_tell) in RETPOS, if it is not NULL.
	*
	* The return semantics are the same as parse_packet. */
	int search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t *retpos, int with_uid);

	/* Copy all packets (except invalid packets, i.e., those with a type
	* of 0) from INP to OUT until either an error occurs or EOF is
	* reached.
	*
	* Returns -1 when end of file is reached or an error code, if an
	* error occurred. (Note: this function never returns 0, because it
	* effectively keeps going until it gets an EOF.) */
	int copy_all_packets (iobuf_t inp, iobuf_t out );

	/* Like copy_all_packets, but stops at the first packet that starts at
	* or after STOPOFF (as indicated by iobuf_tell).
	*
	* Example: if STOPOFF is 100, the first packet in INP goes from
	* 0 to 110 and the next packet starts at offset 111, then the packet
	* starting at offset 0 will be completely processed (even though it
	* extends beyond STOPOFF) and the packet starting at offset 111 will
	* not be processed at all. */
	int copy_some_packets (iobuf_t inp, iobuf_t out, off_t stopoff);

	/* Skips the next N packets from INP.
	*
	* If parsing a packet returns an error code, then the function stops
	* immediately and returns the error code. Note: in the case of an
	* error, this function does not indicate how many packets were
	* successfully processed. */
	int skip_some_packets (iobuf_t inp, unsigned int n);
	#endif

	/* Parse a signature packet and store it in *SIG.

	The signature packet is read from INP. The OpenPGP header (the tag
	and the packet's length) have already been read; the next byte read
	from INP should be the first byte of the packet's contents. The
	packet's type (as extract from the tag) must be passed as PKTTYPE
	and the packet's length must be passed as PKTLEN. This is used as
	the upper bound on the amount of data read from INP. If the packet
	is shorter than PKTLEN, the data at the end will be silently
	skipped. If an error occurs, an error code will be returned. -1
	means the EOF was encountered. 0 means parsing was successful. */
	int parse_signature( iobuf_t inp, int pkttype, unsigned long pktlen,
	PKT_signature *sig );

	/* Given a signature packet, either:
	*
	* - test whether there are any subpackets with the critical bit set
	* that we don't understand,
	*
	* - list the subpackets, or,
	*
	* - find a subpacket with a specific type.
	*
	* The WANT_HASHED flag indicates that the hashed area shall be
	* considered.
	*
	* REQTYPE indicates the type of operation.
	*
	* If REQTYPE is SIGSUBPKT_TEST_CRITICAL, then this function checks
	* whether there are any subpackets that have the critical bit and
	* which GnuPG cannot handle. If GnuPG understands all subpackets
	* whose critical bit is set, then this function returns simply
	* returns SUBPKTS. If there is a subpacket whose critical bit is set
	* and which GnuPG does not understand, then this function returns
	* NULL and, if START is not NULL, sets *START to the 1-based index of
	* the subpacket that violates the constraint.
	*
	* If REQTYPE is SIGSUBPKT_LIST_HASHED or SIGSUBPKT_LIST_UNHASHED, the
	* packets are dumped. Note: if REQTYPE is SIGSUBPKT_LIST_HASHED,
	* this function does not check whether the hash is correct; this is
	* merely an indication of the section that the subpackets came from.
	*
	* If REQTYPE is anything else, then this function interprets the
	* values as a subpacket type and looks for the first subpacket with
	* that type. If such a packet is found, *CRITICAL (if not NULL) is
	* set if the critical bit was set, *RET_N is set to the offset of the
	* subpacket's content within the SUBPKTS buffer, *START is set to the
	* 1-based index of the subpacket within the buffer, and returns
	* &SUBPKTS[*RET_N].
	*
	* *START is the number of initial subpackets to not consider. Thus,
	* if *START is 2, then the first 2 subpackets are ignored.
	*/
	const byte enum_sig_subpkt (PKT_signature sig, int want_hashed,
	sigsubpkttype_t reqtype,
	size_t ret_n, int start, int *critical );

	/* Shorthand for:
	*
	* enum_sig_subpkt (sig, want_hashed, reqtype, ret_n, NULL, NULL);
	*/
	const byte parse_sig_subpkt (PKT_signature sig, int want_hashed,
	sigsubpkttype_t reqtype,
	size_t *ret_n );

	/* This calls parse_sig_subpkt first on the hashed signature area in
	* SIG and then, if that returns NULL, calls parse_sig_subpkt on the
	* unhashed subpacket area in SIG. */
	const byte parse_sig_subpkt2 (PKT_signature sig, sigsubpkttype_t reqtype);

	/* Returns whether the N byte large buffer BUFFER is sufficient to
	hold a subpacket of type TYPE. Note: the buffer refers to the
	contents of the subpacket (not the header) and it must already be
	initialized: for some subpackets, it checks some internal
	constraints.

	Returns 0 if the size is acceptable. Returns -2 if the buffer is
	definitely too short. To check for an error, check whether the
	return value is less than 0. */
	int parse_one_sig_subpkt( const byte *buffer, size_t n, int type );

	/* Looks for revocation key subpackets (see RFC 4880 5.2.3.15) in the
	hashed area of the signature packet. Any that are found are added
	to SIG->REVKEY and SIG->NUMREVKEYS is updated appropriately. */
	void parse_revkeys(PKT_signature *sig);

	/* Extract the attributes from the buffer at UID->ATTRIB_DATA and
	update UID->ATTRIBS and UID->NUMATTRIBS accordingly. */
	int parse_attribute_subpkts(PKT_user_id *uid);

	/* Set the UID->NAME field according to the attributes. MAX_NAMELEN
	must be at least 71. */
	void make_attribute_uidname(PKT_user_id *uid, size_t max_namelen);

	/* Allocate and initialize a new GPG control packet. DATA is the data
	to save in the packet. */
	PACKET *create_gpg_control ( ctrlpkttype_t type,
	const byte *data,
	size_t datalen );

	/-- build-packet.c --/
	gpg_error_t build_keyblock_image (kbnode_t keyblock, iobuf_t *r_iobuf);
	int build_packet (iobuf_t out, PACKET *pkt);
	gpg_error_t build_packet_and_meta (iobuf_t out, PACKET *pkt);
	gpg_error_t gpg_mpi_write (iobuf_t out, gcry_mpi_t a, unsigned int *t_nwritten);
	gpg_error_t gpg_mpi_write_nohdr (iobuf_t out, gcry_mpi_t a);
	u32 calc_packet_length( PACKET *pkt );
	void build_sig_subpkt( PKT_signature *sig, sigsubpkttype_t type,
	const byte *buffer, size_t buflen );
	void build_sig_subpkt_from_sig (PKT_signature sig, PKT_public_key pksk);
	int delete_sig_subpkt(subpktarea_t *buffer, sigsubpkttype_t type );
	void build_attribute_subpkt(PKT_user_id *uid,byte type,
	const void *buf,u32 buflen,
	const void *header,u32 headerlen);
	struct notation string_to_notation(const char string,int is_utf8);
	struct notation blob_to_notation(const char name,
	const char *data, size_t len);
	struct notation sig_to_notation(PKT_signature sig);
	void free_notation(struct notation *notation);

	/-- free-packet.c --/
	void free_symkey_enc( PKT_symkey_enc *enc );
	void free_pubkey_enc( PKT_pubkey_enc *enc );
	void free_seckey_enc( PKT_signature *enc );
	void release_public_key_parts( PKT_public_key *pk );
	void free_public_key( PKT_public_key *key );
	void free_attributes(PKT_user_id *uid);
	void free_user_id( PKT_user_id *uid );
	void free_comment( PKT_comment *rem );
	void free_packet (PACKET *pkt, parse_packet_ctx_t parsectx);
	prefitem_t copy_prefs (const prefitem_t prefs);
	PKT_public_key copy_public_key( PKT_public_key d, PKT_public_key *s );
	PKT_signature copy_signature( PKT_signature d, PKT_signature *s );
	PKT_user_id scopy_user_id (PKT_user_id sd );
	int cmp_public_keys( PKT_public_key a, PKT_public_key b );
	int cmp_signatures( PKT_signature a, PKT_signature b );
	int cmp_user_ids( PKT_user_id a, PKT_user_id b );


	/-- sig-check.c --/
	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest);

	/* Check a signature. Looks up the public key from the key db. (If
	* R_PK is not NULL, it is stored at RET_PK.) DIGEST contains a
	* valid hash context that already includes the signed data. This
	* function adds the relevant meta-data to the hash before finalizing
	- * it and verifying the signature. */
	+ * it and verifying the signature. FOCRED_PK is usually NULL. */
	gpg_error_t check_signature2 (ctrl_t ctrl,
	PKT_signature *sig, gcry_md_hd_t digest,
	const void *extrahash, size_t extrahashlen,
	+ PKT_public_key *forced_pk,
	u32 r_expiredate, int r_expired, int *r_revoked,
	PKT_public_key **r_pk);


	/-- pubkey-enc.c --/
	gpg_error_t get_session_key (ctrl_t ctrl, struct pubkey_enc_list k, DEK dek);
	gpg_error_t get_override_session_key (DEK dek, const char string);

	/-- compress.c --/
	int handle_compressed (ctrl_t ctrl, void ctx, PKT_compressed cd,
	int (callback)(iobuf_t, void ), void *passthru );

	/-- encr-data.c --/
	int decrypt_data (ctrl_t ctrl, void ctx, PKT_encrypted ed, DEK *dek );

	/-- plaintext.c --/
	gpg_error_t get_output_file (const byte *embedded_name, int embedded_namelen,
	iobuf_t data, char *fnamep, estream_t fpp);
	int handle_plaintext( PKT_plaintext pt, md_filter_context_t mfx,
	int nooutput, int clearsig );
	int ask_for_detached_datafile( gcry_md_hd_t md, gcry_md_hd_t md2,
	const char *inname, int textmode );

	/-- sign.c --/
	int make_keysig_packet (ctrl_t ctrl,
	PKT_signature *ret_sig, PKT_public_key pk,
	PKT_user_id uid, PKT_public_key subpk,
	PKT_public_key *pksk, int sigclass,
	u32 timestamp, u32 duration,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque,
	const char *cache_nonce);
	gpg_error_t update_keysig_packet (ctrl_t ctrl,
	PKT_signature **ret_sig,
	PKT_signature *orig_sig,
	PKT_public_key *pk,
	PKT_user_id *uid,
	PKT_public_key *subpk,
	PKT_public_key *pksk,
	int (mksubpkt)(PKT_signature , void *),
	void *opaque );

	/-- keygen.c --/
	PKT_user_id generate_user_id (kbnode_t keyblock, const char uidstr);

	#endif /G10_PACKET_H/
	diff --git a/g10/parse-packet.c b/g10/parse-packet.c
	index d554bf5fe..36ce15229 100644
	--- a/g10/parse-packet.c
	+++ b/g10/parse-packet.c
	@@ -1,3660 +1,3664 @@
	/* parse-packet.c - read packets
	* Copyright (C) 1998-2007, 2009-2010 Free Software Foundation, Inc.
	* Copyright (C) 2014, 2018 Werner Koch
	* Copyright (C) 2015 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	* SPDX-License-Identifier: GPL-3.0+
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "filter.h"
	#include "photoid.h"
	#include "options.h"
	#include "main.h"
	#include "../common/i18n.h"
	#include "../common/host2net.h"
	#include "../common/mbox-util.h"


	static int mpi_print_mode;
	static int list_mode;
	static estream_t listfp;

	/* A linked list of known notation names. Note that the FLAG is used
	* to store the length of the name to speed up the check. */
	static strlist_t known_notations_list;


	static int parse (parse_packet_ctx_t ctx, PACKET *pkt, int onlykeypkts,
	off_t * retpos, int *skip, IOBUF out, int do_skip
	#if DEBUG_PARSE_PACKET
	, const char dbg_w, const char dbg_f, int dbg_l
	#endif
	);
	static int copy_packet (IOBUF inp, IOBUF out, int pkttype,
	unsigned long pktlen, int partial);
	static void skip_packet (IOBUF inp, int pkttype,
	unsigned long pktlen, int partial);
	static void *read_rest (IOBUF inp, size_t pktlen);
	static int parse_marker (IOBUF inp, int pkttype, unsigned long pktlen);
	static int parse_symkeyenc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet);
	static int parse_pubkeyenc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet);
	static int parse_onepass_sig (IOBUF inp, int pkttype, unsigned long pktlen,
	PKT_onepass_sig * ops);
	static int parse_key (IOBUF inp, int pkttype, unsigned long pktlen,
	byte * hdr, int hdrlen, PACKET * packet);
	static int parse_user_id (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet);
	static int parse_attribute (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet);
	static int parse_comment (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet);
	static gpg_error_t parse_ring_trust (parse_packet_ctx_t ctx,
	unsigned long pktlen);
	static int parse_plaintext (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int new_ctb, int partial);
	static int parse_compressed (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int new_ctb);
	static int parse_encrypted (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int new_ctb, int partial);
	static gpg_error_t parse_encrypted_aead (IOBUF inp, int pkttype,
	unsigned long pktlen, PACKET *packet,
	int partial);
	static int parse_mdc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int new_ctb);
	static int parse_gpg_control (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int partial);

	/* Read a 16-bit value in MSB order (big endian) from an iobuf. */
	static unsigned short
	read_16 (IOBUF inp)
	{
	unsigned short a;
	a = (unsigned short)iobuf_get_noeof (inp) << 8;
	a \|= iobuf_get_noeof (inp);
	return a;
	}


	/* Read a 32-bit value in MSB order (big endian) from an iobuf. */
	static unsigned long
	read_32 (IOBUF inp)
	{
	unsigned long a;
	a = (unsigned long)iobuf_get_noeof (inp) << 24;
	a \|= iobuf_get_noeof (inp) << 16;
	a \|= iobuf_get_noeof (inp) << 8;
	a \|= iobuf_get_noeof (inp);
	return a;
	}


	/* Read an external representation of an MPI and return the MPI. The
	external format is a 16-bit unsigned value stored in network byte
	order giving the number of bits for the following integer. The
	integer is stored MSB first and is left padded with zero bits to
	align on a byte boundary.

	The caller must set *RET_NREAD to the maximum number of bytes to
	read from the pipeline INP. This function sets *RET_NREAD to be
	the number of bytes actually read from the pipeline.

	If SECURE is true, the integer is stored in secure memory
	(allocated using gcry_xmalloc_secure). */
	static gcry_mpi_t
	mpi_read (iobuf_t inp, unsigned int *ret_nread, int secure)
	{
	int c, c1, c2, i;
	unsigned int nmax = *ret_nread;
	unsigned int nbits, nbytes;
	size_t nread = 0;
	gcry_mpi_t a = NULL;
	byte *buf = NULL;
	byte *p;

	if (!nmax)
	goto overflow;

	if ((c = c1 = iobuf_get (inp)) == -1)
	goto leave;
	if (++nread == nmax)
	goto overflow;
	nbits = c << 8;
	if ((c = c2 = iobuf_get (inp)) == -1)
	goto leave;
	++nread;
	nbits \|= c;
	if (nbits > MAX_EXTERN_MPI_BITS)
	{
	log_error ("mpi too large (%u bits)\n", nbits);
	goto leave;
	}

	nbytes = (nbits + 7) / 8;
	buf = secure ? gcry_xmalloc_secure (nbytes + 2) : gcry_xmalloc (nbytes + 2);
	p = buf;
	p[0] = c1;
	p[1] = c2;
	for (i = 0; i < nbytes; i++)
	{
	if (nread == nmax)
	goto overflow;

	c = iobuf_get (inp);
	if (c == -1)
	goto leave;

	p[i + 2] = c;
	nread ++;
	}

	if (gcry_mpi_scan (&a, GCRYMPI_FMT_PGP, buf, nread, &nread))
	a = NULL;

	*ret_nread = nread;
	gcry_free(buf);
	return a;

	overflow:
	log_error ("mpi larger than indicated length (%u bits)\n", 8*nmax);
	leave:
	*ret_nread = nread;
	gcry_free(buf);
	return a;
	}


	/* Register STRING as a known critical notation name. */
	void
	register_known_notation (const char *string)
	{
	strlist_t sl;

	if (!known_notations_list)
	{
	sl = add_to_strlist (&known_notations_list,
	"preferred-email-encoding@pgp.com");
	sl->flags = 32;
	sl = add_to_strlist (&known_notations_list, "pka-address@gnupg.org");
	sl->flags = 21;
	}
	if (!string)
	return; /* Only initialized the default known notations. */

	/* In --set-notation we use an exclamation mark to indicate a
	* critical notation. As a convenience skip this here. */
	if (*string == '!')
	string++;

	if (!*string \|\| strlist_find (known_notations_list, string))
	return; /* Empty string or already registered. */

	sl = add_to_strlist (&known_notations_list, string);
	sl->flags = strlen (string);
	}


	int
	set_packet_list_mode (int mode)
	{
	int old = list_mode;
	list_mode = mode;

	/* We use stdout only if invoked by the --list-packets command
	but switch to stderr in all other cases. This breaks the
	previous behaviour but that seems to be more of a bug than
	intentional. I don't believe that any application makes use of
	this long standing annoying way of printing to stdout except when
	doing a --list-packets. If this assumption fails, it will be easy
	to add an option for the listing stream. Note that we initialize
	it only once; mainly because there is code which switches
	opt.list_mode back to 1 and we want to have all output to the
	same stream. The MPI_PRINT_MODE will be enabled if the
	corresponding debug flag is set or if we are in --list-packets
	and --verbose is given.

	Using stderr is not actually very clean because it bypasses the
	logging code but it is a special thing anyway. I am not sure
	whether using log_stream() would be better. Perhaps we should
	enable the list mode only with a special option. */
	if (!listfp)
	{
	if (opt.list_packets)
	{
	listfp = es_stdout;
	if (opt.verbose)
	mpi_print_mode = 1;
	}
	else
	listfp = es_stderr;

	if (DBG_MPI)
	mpi_print_mode = 1;
	}
	return old;
	}


	/* If OPT.VERBOSE is set, print a warning that the algorithm ALGO is
	not suitable for signing and encryption. */
	static void
	unknown_pubkey_warning (int algo)
	{
	static byte unknown_pubkey_algos[256];

	/* First check whether the algorithm is usable but not suitable for
	encryption/signing. */
	if (pubkey_get_npkey (algo))
	{
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	{
	if (!pubkey_get_nsig (algo))
	log_info ("public key algorithm %s not suitable for %s\n",
	openpgp_pk_algo_name (algo), "signing");
	if (!pubkey_get_nenc (algo))
	log_info ("public key algorithm %s not suitable for %s\n",
	openpgp_pk_algo_name (algo), "encryption");
	}
	}
	else
	{
	algo &= 0xff;
	if (!unknown_pubkey_algos[algo])
	{
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info (_("can't handle public key algorithm %d\n"), algo);
	unknown_pubkey_algos[algo] = 1;
	}
	}
	}


	#if DEBUG_PARSE_PACKET
	int
	dbg_parse_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	const char *dbg_f, int dbg_l)
	{
	int skip, rc;

	do
	{
	rc = parse (ctx, pkt, 0, NULL, &skip, NULL, 0, "parse", dbg_f, dbg_l);
	}
	while (skip && ! rc);
	return rc;
	}
	#else /!DEBUG_PARSE_PACKET/
	int
	parse_packet (parse_packet_ctx_t ctx, PACKET *pkt)
	{
	int skip, rc;

	do
	{
	rc = parse (ctx, pkt, 0, NULL, &skip, NULL, 0);
	}
	while (skip && ! rc);
	return rc;
	}
	#endif /!DEBUG_PARSE_PACKET/


	/*
	* Like parse packet, but only return secret or public (sub)key
	* packets.
	*/
	#if DEBUG_PARSE_PACKET
	int
	dbg_search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t * retpos, int with_uid,
	const char *dbg_f, int dbg_l)
	{
	int skip, rc;

	do
	{
	rc = parse (ctx, pkt, with_uid ? 2 : 1, retpos, &skip, NULL, 0, "search",
	dbg_f, dbg_l);
	}
	while (skip && ! rc);
	return rc;
	}
	#else /!DEBUG_PARSE_PACKET/
	int
	search_packet (parse_packet_ctx_t ctx, PACKET *pkt,
	off_t * retpos, int with_uid)
	{
	int skip, rc;

	do
	{
	rc = parse (ctx, pkt, with_uid ? 2 : 1, retpos, &skip, NULL, 0);
	}
	while (skip && ! rc);
	return rc;
	}
	#endif /!DEBUG_PARSE_PACKET/


	/*
	* Copy all packets from INP to OUT, thereby removing unused spaces.
	*/
	#if DEBUG_PARSE_PACKET
	int
	dbg_copy_all_packets (iobuf_t inp, iobuf_t out, const char *dbg_f, int dbg_l)
	{
	PACKET pkt;
	struct parse_packet_ctx_s parsectx;
	int skip, rc = 0;

	if (! out)
	log_bug ("copy_all_packets: OUT may not be NULL.\n");

	init_parse_packet (&parsectx, inp);

	do
	{
	init_packet (&pkt);
	}
	while (!
	(rc =
	parse (&parsectx, &pkt, 0, NULL, &skip, out, 0, "copy",
	dbg_f, dbg_l)));

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#else /!DEBUG_PARSE_PACKET/
	int
	copy_all_packets (iobuf_t inp, iobuf_t out)
	{
	PACKET pkt;
	struct parse_packet_ctx_s parsectx;
	int skip, rc = 0;

	if (! out)
	log_bug ("copy_all_packets: OUT may not be NULL.\n");

	init_parse_packet (&parsectx, inp);

	do
	{
	init_packet (&pkt);
	}
	while (!(rc = parse (&parsectx, &pkt, 0, NULL, &skip, out, 0)));

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#endif /!DEBUG_PARSE_PACKET/


	/*
	* Copy some packets from INP to OUT, thereby removing unused spaces.
	* Stop at offset STOPoff (i.e. don't copy packets at this or later
	* offsets)
	*/
	#if DEBUG_PARSE_PACKET
	int
	dbg_copy_some_packets (iobuf_t inp, iobuf_t out, off_t stopoff,
	const char *dbg_f, int dbg_l)
	{
	int rc = 0;
	PACKET pkt;
	int skip;
	struct parse_packet_ctx_s parsectx;

	init_parse_packet (&parsectx, inp);

	do
	{
	if (iobuf_tell (inp) >= stopoff)
	{
	deinit_parse_packet (&parsectx);
	return 0;
	}
	init_packet (&pkt);
	}
	while (!(rc = parse (&parsectx, &pkt, 0, NULL, &skip, out, 0,
	"some", dbg_f, dbg_l)));

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#else /!DEBUG_PARSE_PACKET/
	int
	copy_some_packets (iobuf_t inp, iobuf_t out, off_t stopoff)
	{
	int rc = 0;
	PACKET pkt;
	struct parse_packet_ctx_s parsectx;
	int skip;

	init_parse_packet (&parsectx, inp);

	do
	{
	if (iobuf_tell (inp) >= stopoff)
	{
	deinit_parse_packet (&parsectx);
	return 0;
	}
	init_packet (&pkt);
	}
	while (!(rc = parse (&parsectx, &pkt, 0, NULL, &skip, out, 0)));

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#endif /!DEBUG_PARSE_PACKET/


	/*
	* Skip over N packets
	*/
	#if DEBUG_PARSE_PACKET
	int
	dbg_skip_some_packets (iobuf_t inp, unsigned n, const char *dbg_f, int dbg_l)
	{
	int rc = 0;
	int skip;
	PACKET pkt;
	struct parse_packet_ctx_s parsectx;

	init_parse_packet (&parsectx, inp);

	for (; n && !rc; n--)
	{
	init_packet (&pkt);
	rc = parse (&parsectx, &pkt, 0, NULL, &skip, NULL, 1, "skip",
	dbg_f, dbg_l);
	}

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#else /!DEBUG_PARSE_PACKET/
	int
	skip_some_packets (iobuf_t inp, unsigned int n)
	{
	int rc = 0;
	int skip;
	PACKET pkt;
	struct parse_packet_ctx_s parsectx;

	init_parse_packet (&parsectx, inp);

	for (; n && !rc; n--)
	{
	init_packet (&pkt);
	rc = parse (&parsectx, &pkt, 0, NULL, &skip, NULL, 1);
	}

	deinit_parse_packet (&parsectx);

	return rc;
	}
	#endif /!DEBUG_PARSE_PACKET/


	/* Parse a packet and save it in *PKT.

	If OUT is not NULL and the packet is valid (its type is not 0),
	then the header, the initial length field and the packet's contents
	are written to OUT. In this case, the packet is not saved in *PKT.

	ONLYKEYPKTS is a simple packet filter. If ONLYKEYPKTS is set to 1,
	then only public subkey packets, public key packets, private subkey
	packets and private key packets are parsed. The rest are skipped
	(i.e., the header and the contents are read from the pipeline and
	discarded). If ONLYKEYPKTS is set to 2, then in addition to the
	above 4 types of packets, user id packets are also accepted.

	DO_SKIP is a more coarse grained filter. Unless ONLYKEYPKTS is set
	to 2 and the packet is a user id packet, all packets are skipped.

	Finally, if a packet is invalid (it's type is 0), it is skipped.

	If a packet is skipped and SKIP is not NULL, then *SKIP is set to
	1.

	Note: ONLYKEYPKTS and DO_SKIP are only respected if OUT is NULL,
	i.e., the packets are not simply being copied.

	If RETPOS is not NULL, then the position of CTX->INP (as returned by
	iobuf_tell) is saved there before any data is read from CTX->INP.
	*/
	static int
	parse (parse_packet_ctx_t ctx, PACKET pkt, int onlykeypkts, off_t retpos,
	int *skip, IOBUF out, int do_skip
	#if DEBUG_PARSE_PACKET
	, const char dbg_w, const char dbg_f, int dbg_l
	#endif
	)
	{
	int rc = 0;
	iobuf_t inp;
	int c, ctb, pkttype, lenbytes;
	unsigned long pktlen;
	byte hdr[8];
	int hdrlen;
	int new_ctb = 0, partial = 0;
	int with_uid = (onlykeypkts == 2);
	off_t pos;

	*skip = 0;
	inp = ctx->inp;

	again:
	log_assert (!pkt->pkt.generic);
	if (retpos \|\| list_mode)
	{
	pos = iobuf_tell (inp);
	if (retpos)
	*retpos = pos;
	}
	else
	pos = 0; /* (silence compiler warning) */

	/* The first byte of a packet is the so-called tag. The highest bit
	must be set. */
	if ((ctb = iobuf_get (inp)) == -1)
	{
	rc = -1;
	goto leave;
	}
	hdrlen = 0;
	hdr[hdrlen++] = ctb;

	if (!(ctb & 0x80))
	{
	log_error ("%s: invalid packet (ctb=%02x)\n", iobuf_where (inp), ctb);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	/* Immediately following the header is the length. There are two
	formats: the old format and the new format. If bit 6 (where the
	least significant bit is bit 0) is set in the tag, then we are
	dealing with a new format packet. Otherwise, it is an old format
	packet. */
	pktlen = 0;
	new_ctb = !!(ctb & 0x40);
	if (new_ctb)
	{
	/* Get the packet's type. This is encoded in the 6 least
	significant bits of the tag. */
	pkttype = ctb & 0x3f;

	/* Extract the packet's length. New format packets have 4 ways
	to encode the packet length. The value of the first byte
	determines the encoding and partially determines the length.
	See section 4.2.2 of RFC 4880 for details. */
	if ((c = iobuf_get (inp)) == -1)
	{
	log_error ("%s: 1st length byte missing\n", iobuf_where (inp));
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}


	hdr[hdrlen++] = c;
	if (c < 192)
	pktlen = c;
	else if (c < 224)
	{
	pktlen = (c - 192) * 256;
	if ((c = iobuf_get (inp)) == -1)
	{
	log_error ("%s: 2nd length byte missing\n",
	iobuf_where (inp));
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	hdr[hdrlen++] = c;
	pktlen += c + 192;
	}
	else if (c == 255)
	{
	int i;
	char value[4];

	for (i = 0; i < 4; i ++)
	{
	if ((c = iobuf_get (inp)) == -1)
	{
	log_error ("%s: 4 byte length invalid\n", iobuf_where (inp));
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	value[i] = hdr[hdrlen++] = c;
	}

	pktlen = buf32_to_ulong (value);
	}
	else /* Partial body length. */
	{
	switch (pkttype)
	{
	case PKT_PLAINTEXT:
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	case PKT_ENCRYPTED_AEAD:
	case PKT_COMPRESSED:
	iobuf_set_partial_body_length_mode (inp, c & 0xff);
	pktlen = 0; /* To indicate partial length. */
	partial = 1;
	break;

	default:
	log_error ("%s: partial length invalid for"
	" packet type %d\n", iobuf_where (inp), pkttype);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	}

	}
	else
	/* This is an old format packet. */
	{
	/* Extract the packet's type. This is encoded in bits 2-5. */
	pkttype = (ctb >> 2) & 0xf;

	/* The type of length encoding is encoded in bits 0-1 of the
	tag. */
	lenbytes = ((ctb & 3) == 3) ? 0 : (1 << (ctb & 3));
	if (!lenbytes)
	{
	pktlen = 0; /* Don't know the value. */
	/* This isn't really partial, but we can treat it the same
	in a "read until the end" sort of way. */
	partial = 1;
	if (pkttype != PKT_ENCRYPTED && pkttype != PKT_PLAINTEXT
	&& pkttype != PKT_COMPRESSED)
	{
	log_error ("%s: indeterminate length for invalid"
	" packet type %d\n", iobuf_where (inp), pkttype);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	}
	else
	{
	for (; lenbytes; lenbytes--)
	{
	pktlen <<= 8;
	c = iobuf_get (inp);
	if (c == -1)
	{
	log_error ("%s: length invalid\n", iobuf_where (inp));
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	pktlen \|= hdr[hdrlen++] = c;
	}
	}
	}

	/* Sometimes the decompressing layer enters an error state in which
	it simply outputs 0xff for every byte read. If we have a stream
	of 0xff bytes, then it will be detected as a new format packet
	with type 63 and a 4-byte encoded length that is 4G-1. Since
	packets with type 63 are private and we use them as a control
	packet, which won't be 4 GB, we reject such packets as
	invalid. */
	if (pkttype == 63 && pktlen == 0xFFFFFFFF)
	{
	/* With some probability this is caused by a problem in the
	* the uncompressing layer - in some error cases it just loops
	* and spits out 0xff bytes. */
	log_error ("%s: garbled packet detected\n", iobuf_where (inp));
	g10_exit (2);
	}

	if (out && pkttype)
	{
	/* This type of copying won't work if the packet uses a partial
	body length. (In other words, this only works if HDR is
	actually the length.) Currently, no callers require this
	functionality so we just log this as an error. */
	if (partial)
	{
	log_error ("parse: Can't copy partial packet. Aborting.\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	rc = iobuf_write (out, hdr, hdrlen);
	if (!rc)
	rc = copy_packet (inp, out, pkttype, pktlen, partial);
	goto leave;
	}

	if (with_uid && pkttype == PKT_USER_ID)
	/* If ONLYKEYPKTS is set to 2, then we never skip user id packets,
	even if DO_SKIP is set. */
	;
	else if (do_skip
	/* type==0 is not allowed. This is an invalid packet. */
	\|\| !pkttype
	/* When ONLYKEYPKTS is set, we don't skip keys. */
	\|\| (onlykeypkts && pkttype != PKT_PUBLIC_SUBKEY
	&& pkttype != PKT_PUBLIC_KEY
	&& pkttype != PKT_SECRET_SUBKEY && pkttype != PKT_SECRET_KEY))
	{
	iobuf_skip_rest (inp, pktlen, partial);
	*skip = 1;
	rc = 0;
	goto leave;
	}

	if (DBG_PACKET)
	{
	#if DEBUG_PARSE_PACKET
	log_debug ("parse_packet(iob=%d): type=%d length=%lu%s (%s.%s.%d)\n",
	iobuf_id (inp), pkttype, pktlen, new_ctb ? " (new_ctb)" : "",
	dbg_w, dbg_f, dbg_l);
	#else
	log_debug ("parse_packet(iob=%d): type=%d length=%lu%s\n",
	iobuf_id (inp), pkttype, pktlen,
	new_ctb ? " (new_ctb)" : "");
	#endif
	}

	if (list_mode)
	es_fprintf (listfp, "# off=%lu ctb=%02x tag=%d hlen=%d plen=%lu%s%s\n",
	(unsigned long)pos, ctb, pkttype, hdrlen, pktlen,
	partial? (new_ctb ? " partial" : " indeterminate") :"",
	new_ctb? " new-ctb":"");

	/* Count it. */
	ctx->n_parsed_packets++;

	pkt->pkttype = pkttype;
	rc = GPG_ERR_UNKNOWN_PACKET; /* default error */
	switch (pkttype)
	{
	case PKT_PUBLIC_KEY:
	case PKT_PUBLIC_SUBKEY:
	case PKT_SECRET_KEY:
	case PKT_SECRET_SUBKEY:
	pkt->pkt.public_key = xmalloc_clear (sizeof *pkt->pkt.public_key);
	rc = parse_key (inp, pkttype, pktlen, hdr, hdrlen, pkt);
	break;
	case PKT_SYMKEY_ENC:
	rc = parse_symkeyenc (inp, pkttype, pktlen, pkt);
	break;
	case PKT_PUBKEY_ENC:
	rc = parse_pubkeyenc (inp, pkttype, pktlen, pkt);
	break;
	case PKT_SIGNATURE:
	pkt->pkt.signature = xmalloc_clear (sizeof *pkt->pkt.signature);
	rc = parse_signature (inp, pkttype, pktlen, pkt->pkt.signature);
	break;
	case PKT_ONEPASS_SIG:
	pkt->pkt.onepass_sig = xmalloc_clear (sizeof *pkt->pkt.onepass_sig);
	rc = parse_onepass_sig (inp, pkttype, pktlen, pkt->pkt.onepass_sig);
	break;
	case PKT_USER_ID:
	rc = parse_user_id (inp, pkttype, pktlen, pkt);
	break;
	case PKT_ATTRIBUTE:
	pkt->pkttype = pkttype = PKT_USER_ID; /* we store it in the userID */
	rc = parse_attribute (inp, pkttype, pktlen, pkt);
	break;
	case PKT_OLD_COMMENT:
	case PKT_COMMENT:
	rc = parse_comment (inp, pkttype, pktlen, pkt);
	break;
	case PKT_RING_TRUST:
	{
	rc = parse_ring_trust (ctx, pktlen);
	if (!rc)
	goto again; /* Directly read the next packet. */
	}
	break;
	case PKT_PLAINTEXT:
	rc = parse_plaintext (inp, pkttype, pktlen, pkt, new_ctb, partial);
	break;
	case PKT_COMPRESSED:
	rc = parse_compressed (inp, pkttype, pktlen, pkt, new_ctb);
	break;
	case PKT_ENCRYPTED:
	case PKT_ENCRYPTED_MDC:
	rc = parse_encrypted (inp, pkttype, pktlen, pkt, new_ctb, partial);
	break;
	case PKT_MDC:
	rc = parse_mdc (inp, pkttype, pktlen, pkt, new_ctb);
	break;
	case PKT_ENCRYPTED_AEAD:
	rc = parse_encrypted_aead (inp, pkttype, pktlen, pkt, partial);
	break;
	case PKT_GPG_CONTROL:
	rc = parse_gpg_control (inp, pkttype, pktlen, pkt, partial);
	break;
	case PKT_MARKER:
	rc = parse_marker (inp, pkttype, pktlen);
	break;
	default:
	/* Unknown packet. Skip it. */
	skip_packet (inp, pkttype, pktlen, partial);
	break;
	}

	/* Store a shallow copy of certain packets in the context. */
	free_packet (NULL, ctx);
	if (!rc && (pkttype == PKT_PUBLIC_KEY
	\|\| pkttype == PKT_SECRET_KEY
	\|\| pkttype == PKT_USER_ID
	\|\| pkttype == PKT_ATTRIBUTE
	\|\| pkttype == PKT_SIGNATURE))
	{
	ctx->last_pkt = *pkt;
	}

	leave:
	/* FIXME: We leak in case of an error (see the xmalloc's above). */
	if (!rc && iobuf_error (inp))
	rc = GPG_ERR_INV_KEYRING;

	/* FIXME: We use only the error code for now to avoid problems with
	callers which have not been checked to always use gpg_err_code()
	when comparing error codes. */
	return rc == -1? -1 : gpg_err_code (rc);
	}


	static void
	dump_hex_line (int c, int *i)
	{
	if (i && !(i % 8))
	{
	if (i && !(i % 24))
	es_fprintf (listfp, "\n%4d:", *i);
	else
	es_putc (' ', listfp);
	}
	if (c == -1)
	es_fprintf (listfp, " EOF");
	else
	es_fprintf (listfp, " %02x", c);
	++*i;
	}


	/* Copy the contents of a packet from the pipeline IN to the pipeline
	OUT.

	The header and length have already been read from INP and the
	decoded values are given as PKGTYPE and PKTLEN.

	If the packet is a partial body length packet (RFC 4880, Section
	4.2.2.4), then iobuf_set_partial_block_modeiobuf_set_partial_block_mode
	should already have been called on INP and PARTIAL should be set.

	If PARTIAL is set or PKTLEN is 0 and PKTTYPE is PKT_COMPRESSED,
	copy until the first EOF is encountered on INP.

	Returns 0 on success and an error code if an error occurs. */
	static int
	copy_packet (IOBUF inp, IOBUF out, int pkttype,
	unsigned long pktlen, int partial)
	{
	int rc;
	int n;
	char buf[100];

	if (partial)
	{
	while ((n = iobuf_read (inp, buf, sizeof (buf))) != -1)
	if ((rc = iobuf_write (out, buf, n)))
	return rc; /* write error */
	}
	else if (!pktlen && pkttype == PKT_COMPRESSED)
	{
	log_debug ("copy_packet: compressed!\n");
	/* compressed packet, copy till EOF */
	while ((n = iobuf_read (inp, buf, sizeof (buf))) != -1)
	if ((rc = iobuf_write (out, buf, n)))
	return rc; /* write error */
	}
	else
	{
	for (; pktlen; pktlen -= n)
	{
	n = pktlen > sizeof (buf) ? sizeof (buf) : pktlen;
	n = iobuf_read (inp, buf, n);
	if (n == -1)
	return gpg_error (GPG_ERR_EOF);
	if ((rc = iobuf_write (out, buf, n)))
	return rc; /* write error */
	}
	}
	return 0;
	}


	/* Skip an unknown packet. PKTTYPE is the packet's type, PKTLEN is
	the length of the packet's content and PARTIAL is whether partial
	body length encoding in used (in this case PKTLEN is ignored). */
	static void
	skip_packet (IOBUF inp, int pkttype, unsigned long pktlen, int partial)
	{
	if (list_mode)
	{
	es_fprintf (listfp, ":unknown packet: type %2d, length %lu\n",
	pkttype, pktlen);
	if (pkttype)
	{
	int c, i = 0;
	es_fputs ("dump:", listfp);
	if (partial)
	{
	while ((c = iobuf_get (inp)) != -1)
	dump_hex_line (c, &i);
	}
	else
	{
	for (; pktlen; pktlen--)
	{
	dump_hex_line ((c = iobuf_get (inp)), &i);
	if (c == -1)
	break;
	}
	}
	es_putc ('\n', listfp);
	return;
	}
	}
	iobuf_skip_rest (inp, pktlen, partial);
	}


	/* Read PKTLEN bytes from INP and return them in a newly allocated
	* buffer. In case of an error (including reading fewer than PKTLEN
	* bytes from INP before EOF is returned), NULL is returned and an
	* error message is logged. */
	static void *
	read_rest (IOBUF inp, size_t pktlen)
	{
	int c;
	byte buf, p;

	buf = xtrymalloc (pktlen);
	if (!buf)
	{
	gpg_error_t err = gpg_error_from_syserror ();
	log_error ("error reading rest of packet: %s\n", gpg_strerror (err));
	return NULL;
	}
	for (p = buf; pktlen; pktlen--)
	{
	c = iobuf_get (inp);
	if (c == -1)
	{
	log_error ("premature eof while reading rest of packet\n");
	xfree (buf);
	return NULL;
	}
	*p++ = c;
	}

	return buf;
	}


	/* Read a special size+body from INP. On success store an opaque MPI
	with it at R_DATA. On error return an error code and store NULL at
	R_DATA. Even in the error case store the number of read bytes at
	R_NREAD. The caller shall pass the remaining size of the packet in
	PKTLEN. */
	static gpg_error_t
	read_size_body (iobuf_t inp, int pktlen, size_t *r_nread,
	gcry_mpi_t *r_data)
	{
	char buffer[256];
	char *tmpbuf;
	int i, c, nbytes;

	*r_nread = 0;
	*r_data = NULL;

	if (!pktlen)
	return gpg_error (GPG_ERR_INV_PACKET);
	c = iobuf_readbyte (inp);
	if (c < 0)
	return gpg_error (GPG_ERR_INV_PACKET);
	pktlen--;
	++*r_nread;
	nbytes = c;
	if (nbytes < 2 \|\| nbytes > 254)
	return gpg_error (GPG_ERR_INV_PACKET);
	if (nbytes > pktlen)
	return gpg_error (GPG_ERR_INV_PACKET);

	buffer[0] = nbytes;

	for (i = 0; i < nbytes; i++)
	{
	c = iobuf_get (inp);
	if (c < 0)
	return gpg_error (GPG_ERR_INV_PACKET);
	++*r_nread;
	buffer[1+i] = c;
	}

	tmpbuf = xtrymalloc (1 + nbytes);
	if (!tmpbuf)
	return gpg_error_from_syserror ();
	memcpy (tmpbuf, buffer, 1 + nbytes);
	r_data = gcry_mpi_set_opaque (NULL, tmpbuf, 8 (1 + nbytes));
	if (!*r_data)
	{
	xfree (tmpbuf);
	return gpg_error_from_syserror ();
	}
	return 0;
	}


	/* Parse a marker packet. */
	static int
	parse_marker (IOBUF inp, int pkttype, unsigned long pktlen)
	{
	(void) pkttype;

	if (pktlen != 3)
	goto fail;

	if (iobuf_get (inp) != 'P')
	{
	pktlen--;
	goto fail;
	}

	if (iobuf_get (inp) != 'G')
	{
	pktlen--;
	goto fail;
	}

	if (iobuf_get (inp) != 'P')
	{
	pktlen--;
	goto fail;
	}

	if (list_mode)
	es_fputs (":marker packet: PGP\n", listfp);

	return 0;

	fail:
	log_error ("invalid marker packet\n");
	if (list_mode)
	es_fputs (":marker packet: [invalid]\n", listfp);
	iobuf_skip_rest (inp, pktlen, 0);
	return GPG_ERR_INV_PACKET;
	}


	static int
	parse_symkeyenc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet)
	{
	PKT_symkey_enc *k;
	int rc = 0;
	int i, version, s2kmode, cipher_algo, aead_algo, hash_algo, seskeylen, minlen;

	if (pktlen < 4)
	goto too_short;
	version = iobuf_get_noeof (inp);
	pktlen--;
	if (version == 4)
	;
	else if (version == 5)
	;
	else
	{
	log_error ("packet(%d) with unknown version %d\n", pkttype, version);
	if (list_mode)
	es_fprintf (listfp, ":symkey enc packet: [unknown version]\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	if (pktlen > 200)
	{ /* (we encode the seskeylen in a byte) */
	log_error ("packet(%d) too large\n", pkttype);
	if (list_mode)
	es_fprintf (listfp, ":symkey enc packet: [too large]\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	cipher_algo = iobuf_get_noeof (inp);
	pktlen--;
	if (version == 5)
	{
	aead_algo = iobuf_get_noeof (inp);
	pktlen--;
	}
	else
	aead_algo = 0;
	if (pktlen < 2)
	goto too_short;
	s2kmode = iobuf_get_noeof (inp);
	pktlen--;
	hash_algo = iobuf_get_noeof (inp);
	pktlen--;
	switch (s2kmode)
	{
	case 0: /* Simple S2K. */
	minlen = 0;
	break;
	case 1: /* Salted S2K. */
	minlen = 8;
	break;
	case 3: /* Iterated+salted S2K. */
	minlen = 9;
	break;
	default:
	log_error ("unknown S2K mode %d\n", s2kmode);
	if (list_mode)
	es_fprintf (listfp, ":symkey enc packet: [unknown S2K mode]\n");
	goto leave;
	}
	if (minlen > pktlen)
	{
	log_error ("packet with S2K %d too short\n", s2kmode);
	if (list_mode)
	es_fprintf (listfp, ":symkey enc packet: [too short]\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	seskeylen = pktlen - minlen;
	k = packet->pkt.symkey_enc = xmalloc_clear (sizeof *packet->pkt.symkey_enc
	+ seskeylen - 1);
	k->version = version;
	k->cipher_algo = cipher_algo;
	k->aead_algo = aead_algo;
	k->s2k.mode = s2kmode;
	k->s2k.hash_algo = hash_algo;
	if (s2kmode == 1 \|\| s2kmode == 3)
	{
	for (i = 0; i < 8 && pktlen; i++, pktlen--)
	k->s2k.salt[i] = iobuf_get_noeof (inp);
	}
	if (s2kmode == 3)
	{
	k->s2k.count = iobuf_get_noeof (inp);
	pktlen--;
	}
	k->seskeylen = seskeylen;
	if (k->seskeylen)
	{
	for (i = 0; i < seskeylen && pktlen; i++, pktlen--)
	k->seskey[i] = iobuf_get_noeof (inp);

	/* What we're watching out for here is a session key decryptor
	with no salt. The RFC says that using salt for this is a
	MUST. */
	if (s2kmode != 1 && s2kmode != 3)
	log_info (_("WARNING: potentially insecure symmetrically"
	" encrypted session key\n"));
	}
	log_assert (!pktlen);

	if (list_mode)
	{
	es_fprintf (listfp,
	":symkey enc packet: version %d, cipher %d, aead %d,"
	" s2k %d, hash %d",
	version, cipher_algo, aead_algo, s2kmode, hash_algo);
	if (seskeylen)
	{
	/* To compute the size of the session key we need to know
	* the size of the AEAD nonce which we may not know. Thus
	* we show only the seize of the entire encrypted session
	* key. */
	if (aead_algo)
	es_fprintf (listfp, ", encrypted seskey %d bytes", seskeylen);
	else
	es_fprintf (listfp, ", seskey %d bits", (seskeylen - 1) * 8);
	}
	es_fprintf (listfp, "\n");
	if (s2kmode == 1 \|\| s2kmode == 3)
	{
	es_fprintf (listfp, "\tsalt ");
	es_write_hexstring (listfp, k->s2k.salt, 8, 0, NULL);
	if (s2kmode == 3)
	es_fprintf (listfp, ", count %lu (%lu)",
	S2K_DECODE_COUNT ((ulong) k->s2k.count),
	(ulong) k->s2k.count);
	es_fprintf (listfp, "\n");
	}
	}

	leave:
	iobuf_skip_rest (inp, pktlen, 0);
	return rc;

	too_short:
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fprintf (listfp, ":symkey enc packet: [too short]\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}


	static int
	parse_pubkeyenc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet)
	{
	int rc = 0;
	int i, ndata;
	PKT_pubkey_enc *k;

	k = packet->pkt.pubkey_enc = xmalloc_clear (sizeof *packet->pkt.pubkey_enc);
	if (pktlen < 12)
	{
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":pubkey enc packet: [too short]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	k->version = iobuf_get_noeof (inp);
	pktlen--;
	if (k->version != 2 && k->version != 3)
	{
	log_error ("packet(%d) with unknown version %d\n", pkttype, k->version);
	if (list_mode)
	es_fputs (":pubkey enc packet: [unknown version]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	k->keyid[0] = read_32 (inp);
	pktlen -= 4;
	k->keyid[1] = read_32 (inp);
	pktlen -= 4;
	k->pubkey_algo = iobuf_get_noeof (inp);
	pktlen--;
	k->throw_keyid = 0; /* Only used as flag for build_packet. */
	if (list_mode)
	es_fprintf (listfp,
	":pubkey enc packet: version %d, algo %d, keyid %08lX%08lX\n",
	k->version, k->pubkey_algo, (ulong) k->keyid[0],
	(ulong) k->keyid[1]);

	ndata = pubkey_get_nenc (k->pubkey_algo);
	if (!ndata)
	{
	if (list_mode)
	es_fprintf (listfp, "\tunsupported algorithm %d\n", k->pubkey_algo);
	unknown_pubkey_warning (k->pubkey_algo);
	k->data[0] = NULL; /* No need to store the encrypted data. */
	}
	else
	{
	for (i = 0; i < ndata; i++)
	{
	if (k->pubkey_algo == PUBKEY_ALGO_ECDH && i == 1)
	{
	size_t n;
	rc = read_size_body (inp, pktlen, &n, k->data+i);
	pktlen -= n;
	}
	else
	{
	int n = pktlen;
	k->data[i] = mpi_read (inp, &n, 0);
	pktlen -= n;
	if (!k->data[i])
	rc = gpg_error (GPG_ERR_INV_PACKET);
	}
	if (rc)
	goto leave;
	if (list_mode)
	{
	es_fprintf (listfp, "\tdata: ");
	mpi_print (listfp, k->data[i], mpi_print_mode);
	es_putc ('\n', listfp);
	}
	}
	}

	leave:
	iobuf_skip_rest (inp, pktlen, 0);
	return rc;
	}


	/* Dump a subpacket to LISTFP. BUFFER contains the subpacket in
	* question and points to the type field in the subpacket header (not
	* the start of the header). TYPE is the subpacket's type with the
	* critical bit cleared. CRITICAL is the value of the CRITICAL bit.
	* BUFLEN is the length of the buffer and LENGTH is the length of the
	* subpacket according to the subpacket's header. DIGEST_ALGO is the
	* digest algo of the signature. */
	static void
	dump_sig_subpkt (int hashed, int type, int critical,
	const byte * buffer, size_t buflen, size_t length,
	int digest_algo)
	{
	const char *p = NULL;
	int i;
	int nprinted;

	/* The CERT has warning out with explains how to use GNUPG to detect
	* the ARRs - we print our old message here when it is a faked ARR
	* and add an additional notice. */
	if (type == SIGSUBPKT_ARR && !hashed)
	{
	es_fprintf (listfp,
	"\tsubpkt %d len %u (additional recipient request)\n"
	"WARNING: PGP versions > 5.0 and < 6.5.8 will automagically "
	"encrypt to this key and thereby reveal the plaintext to "
	"the owner of this ARR key. Detailed info follows:\n",
	type, (unsigned) length);
	}

	buffer++;
	length--;

	nprinted = es_fprintf (listfp, "\t%s%ssubpkt %d len %u (", /) /
	critical ? "critical " : "",
	hashed ? "hashed " : "", type, (unsigned) length);
	if (nprinted < 1)
	nprinted = 1; /(we use (nprinted-1) later.)/
	if (length > buflen)
	{
	es_fprintf (listfp, "too short: buffer is only %u)\n", (unsigned) buflen);
	return;
	}
	switch (type)
	{
	case SIGSUBPKT_SIG_CREATED:
	if (length >= 4)
	es_fprintf (listfp, "sig created %s",
	strtimestamp (buf32_to_u32 (buffer)));
	break;
	case SIGSUBPKT_SIG_EXPIRE:
	if (length >= 4)
	{
	if (buf32_to_u32 (buffer))
	es_fprintf (listfp, "sig expires after %s",
	strtimevalue (buf32_to_u32 (buffer)));
	else
	es_fprintf (listfp, "sig does not expire");
	}
	break;
	case SIGSUBPKT_EXPORTABLE:
	if (length)
	es_fprintf (listfp, "%sexportable", *buffer ? "" : "not ");
	break;
	case SIGSUBPKT_TRUST:
	if (length != 2)
	p = "[invalid trust subpacket]";
	else
	es_fprintf (listfp, "trust signature of depth %d, value %d", buffer[0],
	buffer[1]);
	break;
	case SIGSUBPKT_REGEXP:
	if (!length)
	p = "[invalid regexp subpacket]";
	else
	{
	es_fprintf (listfp, "regular expression: \"");
	es_write_sanitized (listfp, buffer, length, "\"", NULL);
	p = "\"";
	}
	break;
	case SIGSUBPKT_REVOCABLE:
	if (length)
	es_fprintf (listfp, "%srevocable", *buffer ? "" : "not ");
	break;
	case SIGSUBPKT_KEY_EXPIRE:
	if (length >= 4)
	{
	if (buf32_to_u32 (buffer))
	es_fprintf (listfp, "key expires after %s",
	strtimevalue (buf32_to_u32 (buffer)));
	else
	es_fprintf (listfp, "key does not expire");
	}
	break;
	case SIGSUBPKT_PREF_SYM:
	es_fputs ("pref-sym-algos:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %d", buffer[i]);
	break;
	case SIGSUBPKT_PREF_AEAD:
	es_fputs ("pref-aead-algos:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %d", buffer[i]);
	break;
	case SIGSUBPKT_REV_KEY:
	es_fputs ("revocation key: ", listfp);
	if (length < 22)
	p = "[too short]";
	else
	{
	es_fprintf (listfp, "c=%02x a=%d f=", buffer[0], buffer[1]);
	for (i = 2; i < length; i++)
	es_fprintf (listfp, "%02X", buffer[i]);
	}
	break;
	case SIGSUBPKT_ISSUER:
	if (length >= 8)
	es_fprintf (listfp, "issuer key ID %08lX%08lX",
	(ulong) buf32_to_u32 (buffer),
	(ulong) buf32_to_u32 (buffer + 4));
	break;
	case SIGSUBPKT_ISSUER_FPR:
	if (length >= 21)
	{
	char *tmp;
	es_fprintf (listfp, "issuer fpr v%d ", buffer[0]);
	tmp = bin2hex (buffer+1, length-1, NULL);
	if (tmp)
	{
	es_fputs (tmp, listfp);
	xfree (tmp);
	}
	}
	break;
	case SIGSUBPKT_NOTATION:
	{
	es_fputs ("notation: ", listfp);
	if (length < 8)
	p = "[too short]";
	else
	{
	const byte *s = buffer;
	size_t n1, n2;

	n1 = (s[4] << 8) \| s[5];
	n2 = (s[6] << 8) \| s[7];
	s += 8;
	if (8 + n1 + n2 != length)
	p = "[error]";
	else
	{
	es_write_sanitized (listfp, s, n1, ")", NULL);
	es_putc ('=', listfp);

	if (*buffer & 0x80)
	es_write_sanitized (listfp, s + n1, n2, ")", NULL);
	else
	p = "[not human readable]";
	}
	}
	}
	break;
	case SIGSUBPKT_PREF_HASH:
	es_fputs ("pref-hash-algos:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %d", buffer[i]);
	break;
	case SIGSUBPKT_PREF_COMPR:
	es_fputs ("pref-zip-algos:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %d", buffer[i]);
	break;
	case SIGSUBPKT_KS_FLAGS:
	es_fputs ("keyserver preferences:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %02X", buffer[i]);
	break;
	case SIGSUBPKT_PREF_KS:
	es_fputs ("preferred keyserver: ", listfp);
	es_write_sanitized (listfp, buffer, length, ")", NULL);
	break;
	case SIGSUBPKT_PRIMARY_UID:
	p = "primary user ID";
	break;
	case SIGSUBPKT_POLICY:
	es_fputs ("policy: ", listfp);
	es_write_sanitized (listfp, buffer, length, ")", NULL);
	break;
	case SIGSUBPKT_KEY_FLAGS:
	es_fputs ("key flags:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %02X", buffer[i]);
	break;
	case SIGSUBPKT_SIGNERS_UID:
	p = "signer's user ID";
	break;
	case SIGSUBPKT_REVOC_REASON:
	if (length)
	{
	es_fprintf (listfp, "revocation reason 0x%02x (", *buffer);
	es_write_sanitized (listfp, buffer + 1, length - 1, ")", NULL);
	p = ")";
	}
	break;
	case SIGSUBPKT_ARR:
	es_fputs ("Big Brother's key (ignored): ", listfp);
	if (length < 22)
	p = "[too short]";
	else
	{
	es_fprintf (listfp, "c=%02x a=%d f=", buffer[0], buffer[1]);
	if (length > 2)
	es_write_hexstring (listfp, buffer+2, length-2, 0, NULL);
	}
	break;
	case SIGSUBPKT_FEATURES:
	es_fputs ("features:", listfp);
	for (i = 0; i < length; i++)
	es_fprintf (listfp, " %02x", buffer[i]);
	break;
	case SIGSUBPKT_SIGNATURE:
	es_fputs ("signature: ", listfp);
	if (length < 17)
	p = "[too short]";
	else
	es_fprintf (listfp, "v%d, class 0x%02X, algo %d, digest algo %d",
	buffer[0],
	buffer[0] == 3 ? buffer[2] : buffer[1],
	buffer[0] == 3 ? buffer[15] : buffer[2],
	buffer[0] == 3 ? buffer[16] : buffer[3]);
	break;

	case SIGSUBPKT_ATTST_SIGS:
	{
	unsigned int hlen;

	es_fputs ("attst-sigs: ", listfp);
	hlen = gcry_md_get_algo_dlen (map_md_openpgp_to_gcry (digest_algo));
	if (!hlen)
	p = "[unknown digest algo]";
	else if ((length % hlen))
	p = "[invalid length]";
	else
	{
	es_fprintf (listfp, "%u", (unsigned int)length/hlen);
	while (length)
	{
	es_fprintf (listfp, "\n\t%*s", nprinted-1, "");
	es_write_hexstring (listfp, buffer, hlen, 0, NULL);
	buffer += hlen;
	length -= hlen;
	}
	}
	}
	break;

	case SIGSUBPKT_KEY_BLOCK:
	es_fputs ("key-block: ", listfp);
	if (length && buffer[0])
	p = "[unknown reserved octet]";
	else if (length < 50) /* 50 is an arbitrary min. length. */
	p = "[invalid subpacket]";
	else
	{
	/* estream_t fp; */
	/* fp = es_fopen ("a.key-block", "wb"); */
	/* log_assert (fp); */
	/* es_fwrite ( buffer+1, length-1, 1, fp); */
	/* es_fclose (fp); */
	es_fprintf (listfp, "[%u octets]", (unsigned int)length-1);
	}
	break;


	default:
	if (type >= 100 && type <= 110)
	p = "experimental / private subpacket";
	else
	p = "?";
	break;
	}

	es_fprintf (listfp, "%s)\n", p ? p : "");
	}


	/*
	* Returns: >= 0 use this offset into buffer
	* -1 explicitly reject returning this type
	* -2 subpacket too short
	*/
	int
	parse_one_sig_subpkt (const byte * buffer, size_t n, int type)
	{
	switch (type)
	{
	case SIGSUBPKT_REV_KEY:
	if (n < 22)
	break;
	return 0;
	case SIGSUBPKT_SIG_CREATED:
	case SIGSUBPKT_SIG_EXPIRE:
	case SIGSUBPKT_KEY_EXPIRE:
	if (n < 4)
	break;
	return 0;
	case SIGSUBPKT_KEY_FLAGS:
	case SIGSUBPKT_KS_FLAGS:
	case SIGSUBPKT_PREF_SYM:
	case SIGSUBPKT_PREF_AEAD:
	case SIGSUBPKT_PREF_HASH:
	case SIGSUBPKT_PREF_COMPR:
	case SIGSUBPKT_POLICY:
	case SIGSUBPKT_PREF_KS:
	case SIGSUBPKT_FEATURES:
	case SIGSUBPKT_REGEXP:
	case SIGSUBPKT_ATTST_SIGS:
	return 0;
	case SIGSUBPKT_SIGNATURE:
	case SIGSUBPKT_EXPORTABLE:
	case SIGSUBPKT_REVOCABLE:
	case SIGSUBPKT_REVOC_REASON:
	if (!n)
	break;
	return 0;
	case SIGSUBPKT_ISSUER: /* issuer key ID */
	if (n < 8)
	break;
	return 0;
	case SIGSUBPKT_ISSUER_FPR: /* issuer key fingerprint */
	if (n < 21)
	break;
	return 0;
	case SIGSUBPKT_NOTATION:
	/* minimum length needed, and the subpacket must be well-formed
	where the name length and value length all fit inside the
	packet. */
	if (n < 8
	\|\| 8 + ((buffer[4] << 8) \| buffer[5]) +
	((buffer[6] << 8) \| buffer[7]) != n)
	break;
	return 0;
	case SIGSUBPKT_PRIMARY_UID:
	if (n != 1)
	break;
	return 0;
	case SIGSUBPKT_TRUST:
	if (n != 2)
	break;
	return 0;
	case SIGSUBPKT_KEY_BLOCK:
	if (n && buffer[0])
	return -1; /* Unknown version - ignore. */
	if (n < 50)
	break; /* Definitely too short to carry a key block. */
	return 0;
	default:
	return 0;
	}
	return -2;
	}


	/* Return true if we understand the critical notation. */
	static int
	can_handle_critical_notation (const byte *name, size_t len)
	{
	strlist_t sl;

	register_known_notation (NULL); /* Make sure it is initialized. */

	for (sl = known_notations_list; sl; sl = sl->next)
	if (sl->flags == len && !memcmp (sl->d, name, len))
	return 1; /* Known */

	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	{
	log_info(_("Unknown critical signature notation: ") );
	print_utf8_buffer (log_get_stream(), name, len);
	log_printf ("\n");
	}

	return 0; /* Unknown. */
	}


	static int
	can_handle_critical (const byte * buffer, size_t n, int type)
	{
	switch (type)
	{
	case SIGSUBPKT_NOTATION:
	if (n >= 8)
	{
	size_t notation_len = ((buffer[4] << 8) \| buffer[5]);
	if (n - 8 >= notation_len)
	return can_handle_critical_notation (buffer + 8, notation_len);
	}
	return 0;
	case SIGSUBPKT_SIGNATURE:
	case SIGSUBPKT_SIG_CREATED:
	case SIGSUBPKT_SIG_EXPIRE:
	case SIGSUBPKT_KEY_EXPIRE:
	case SIGSUBPKT_EXPORTABLE:
	case SIGSUBPKT_REVOCABLE:
	case SIGSUBPKT_REV_KEY:
	case SIGSUBPKT_ISSUER: /* issuer key ID */
	case SIGSUBPKT_ISSUER_FPR: /* issuer fingerprint */
	case SIGSUBPKT_PREF_SYM:
	case SIGSUBPKT_PREF_AEAD:
	case SIGSUBPKT_PREF_HASH:
	case SIGSUBPKT_PREF_COMPR:
	case SIGSUBPKT_KEY_FLAGS:
	case SIGSUBPKT_PRIMARY_UID:
	case SIGSUBPKT_FEATURES:
	case SIGSUBPKT_TRUST:
	case SIGSUBPKT_REGEXP:
	case SIGSUBPKT_ATTST_SIGS:
	/* Is it enough to show the policy or keyserver? */
	case SIGSUBPKT_POLICY:
	case SIGSUBPKT_PREF_KS:
	case SIGSUBPKT_REVOC_REASON: /* At least we know about it. */
	return 1;

	case SIGSUBPKT_KEY_BLOCK:
	if (n && !buffer[0])
	return 1;
	else
	return 0;

	default:
	return 0;
	}
	}


	const byte *
	enum_sig_subpkt (PKT_signature *sig, int want_hashed, sigsubpkttype_t reqtype,
	size_t ret_n, int start, int *critical)
	{
	const byte *buffer;
	int buflen;
	int type;
	int critical_dummy;
	int offset;
	size_t n;
	const subpktarea_t *pktbuf = want_hashed? sig->hashed : sig->unhashed;
	int seq = 0;
	int reqseq = start ? *start : 0;

	if (!critical)
	critical = &critical_dummy;

	if (!pktbuf \|\| reqseq == -1)
	{
	static char dummy[] = "x";
	/* Return a value different from NULL to indicate that
	* there is no critical bit we do not understand. */
	return reqtype == SIGSUBPKT_TEST_CRITICAL ? dummy : NULL;
	}
	buffer = pktbuf->data;
	buflen = pktbuf->len;
	while (buflen)
	{
	n = *buffer++;
	buflen--;
	if (n == 255) /* 4 byte length header. */
	{
	if (buflen < 4)
	goto too_short;
	n = buf32_to_size_t (buffer);
	buffer += 4;
	buflen -= 4;
	}
	else if (n >= 192) /* 4 byte special encoded length header. */
	{
	if (buflen < 2)
	goto too_short;
	n = ((n - 192) << 8) + *buffer + 192;
	buffer++;
	buflen--;
	}
	if (buflen < n)
	goto too_short;
	if (!buflen)
	goto no_type_byte;
	type = *buffer;
	if (type & 0x80)
	{
	type &= 0x7f;
	*critical = 1;
	}
	else
	*critical = 0;
	if (!(++seq > reqseq))
	;
	else if (reqtype == SIGSUBPKT_TEST_CRITICAL)
	{
	if (*critical)
	{
	if (n - 1 > buflen + 1)
	goto too_short;
	if (!can_handle_critical (buffer + 1, n - 1, type))
	{
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info (_("subpacket of type %d has "
	"critical bit set\n"), type);
	if (start)
	*start = seq;
	return NULL; /* This is an error. */
	}
	}
	}
	else if (reqtype < 0) /* List packets. */
	dump_sig_subpkt (reqtype == SIGSUBPKT_LIST_HASHED,
	type, *critical, buffer, buflen, n, sig->digest_algo);
	else if (type == reqtype) /* Found. */
	{
	buffer++;
	n--;
	if (n > buflen)
	goto too_short;
	if (ret_n)
	*ret_n = n;
	offset = parse_one_sig_subpkt (buffer, n, type);
	switch (offset)
	{
	case -2:
	log_error ("subpacket of type %d too short\n", type);
	return NULL;
	case -1:
	return NULL;
	default:
	break;
	}
	if (start)
	*start = seq;
	return buffer + offset;
	}
	buffer += n;
	buflen -= n;
	}
	if (reqtype == SIGSUBPKT_TEST_CRITICAL)
	/* Returning NULL means we found a subpacket with the critical bit
	set that we don't grok. We've iterated over all the subpackets
	and haven't found such a packet so we need to return a non-NULL
	value. */
	return buffer;

	/* Critical bit we don't understand. */
	if (start)
	*start = -1;
	return NULL; /* End of packets; not found. */

	too_short:
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_printhex (pktbuf->data, pktbuf->len > 16? 16 : pktbuf->len,
	"buffer shorter than subpacket (%zu/%d/%zu); dump:",
	pktbuf->len, buflen, n);

	if (start)
	*start = -1;
	return NULL;

	no_type_byte:
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info ("type octet missing in subpacket\n");
	if (start)
	*start = -1;
	return NULL;
	}


	const byte *
	parse_sig_subpkt (PKT_signature *sig, int want_hashed, sigsubpkttype_t reqtype,
	size_t *ret_n)
	{
	return enum_sig_subpkt (sig, want_hashed, reqtype, ret_n, NULL, NULL);
	}


	const byte *
	parse_sig_subpkt2 (PKT_signature *sig, sigsubpkttype_t reqtype)
	{
	const byte *p;

	p = parse_sig_subpkt (sig, 1, reqtype, NULL);
	if (!p)
	p = parse_sig_subpkt (sig, 0, reqtype, NULL);
	return p;
	}


	/* Find all revocation keys. Look in hashed area only. */
	void
	parse_revkeys (PKT_signature * sig)
	{
	const byte *revkey;
	int seq = 0;
	size_t len;

	if (sig->sig_class != 0x1F)
	return;

	while ((revkey = enum_sig_subpkt (sig, 1, SIGSUBPKT_REV_KEY,
	&len, &seq, NULL)))
	{
	/* Consider only valid packets. They must have a length of
	* either 2+20 or 2+32 octets and bit 7 of the class octet must
	* be set. */
	if ((len == 22 \|\| len == 34)
	&& (revkey[0] & 0x80))
	{
	sig->revkey = xrealloc (sig->revkey,
	sizeof (struct revocation_key) *
	(sig->numrevkeys + 1));

	sig->revkey[sig->numrevkeys].class = revkey[0];
	sig->revkey[sig->numrevkeys].algid = revkey[1];
	len -= 2;
	sig->revkey[sig->numrevkeys].fprlen = len;
	memcpy (sig->revkey[sig->numrevkeys].fpr, revkey+2, len);
	memset (sig->revkey[sig->numrevkeys].fpr+len, 0,
	sizeof (sig->revkey[sig->numrevkeys].fpr) - len);
	sig->numrevkeys++;
	}
	}
	}


	int
	parse_signature (IOBUF inp, int pkttype, unsigned long pktlen,
	PKT_signature * sig)
	{
	int md5_len = 0;
	unsigned n;
	int is_v4or5 = 0;
	int rc = 0;
	int i, ndata;

	if (pktlen < 16)
	{
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":signature packet: [too short]\n", listfp);
	goto leave;
	}
	sig->version = iobuf_get_noeof (inp);
	pktlen--;
	if (sig->version == 4 \|\| sig->version == 5)
	is_v4or5 = 1;
	else if (sig->version != 2 && sig->version != 3)
	{
	log_error ("packet(%d) with unknown version %d\n",
	pkttype, sig->version);
	if (list_mode)
	es_fputs (":signature packet: [unknown version]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	if (!is_v4or5)
	{
	if (pktlen == 0)
	goto underflow;
	md5_len = iobuf_get_noeof (inp);
	pktlen--;
	}
	if (pktlen == 0)
	goto underflow;
	sig->sig_class = iobuf_get_noeof (inp);
	pktlen--;
	if (!is_v4or5)
	{
	if (pktlen < 12)
	goto underflow;
	sig->timestamp = read_32 (inp);
	pktlen -= 4;
	sig->keyid[0] = read_32 (inp);
	pktlen -= 4;
	sig->keyid[1] = read_32 (inp);
	pktlen -= 4;
	}
	if (pktlen < 2)
	goto underflow;
	sig->pubkey_algo = iobuf_get_noeof (inp);
	pktlen--;
	sig->digest_algo = iobuf_get_noeof (inp);
	pktlen--;
	sig->flags.exportable = 1;
	sig->flags.revocable = 1;
	if (is_v4or5) /* Read subpackets. */
	{
	if (pktlen < 2)
	goto underflow;
	n = read_16 (inp);
	pktlen -= 2; /* Length of hashed data. */
	if (pktlen < n)
	goto underflow;
	if (n > 10000)
	{
	log_error ("signature packet: hashed data too long\n");
	if (list_mode)
	es_fputs (":signature packet: [hashed data too long]\n", listfp);
	rc = GPG_ERR_INV_PACKET;
	goto leave;
	}
	if (n)
	{
	sig->hashed = xmalloc (sizeof (*sig->hashed) + n - 1);
	sig->hashed->size = n;
	sig->hashed->len = n;
	if (iobuf_read (inp, sig->hashed->data, n) != n)
	{
	log_error ("premature eof while reading "
	"hashed signature data\n");
	if (list_mode)
	es_fputs (":signature packet: [premature eof]\n", listfp);
	rc = -1;
	goto leave;
	}
	pktlen -= n;
	}
	if (pktlen < 2)
	goto underflow;
	n = read_16 (inp);
	pktlen -= 2; /* Length of unhashed data. */
	if (pktlen < n)
	goto underflow;
	if (n > 10000)
	{
	log_error ("signature packet: unhashed data too long\n");
	if (list_mode)
	es_fputs (":signature packet: [unhashed data too long]\n", listfp);
	rc = GPG_ERR_INV_PACKET;
	goto leave;
	}
	if (n)
	{
	sig->unhashed = xmalloc (sizeof (*sig->unhashed) + n - 1);
	sig->unhashed->size = n;
	sig->unhashed->len = n;
	if (iobuf_read (inp, sig->unhashed->data, n) != n)
	{
	log_error ("premature eof while reading "
	"unhashed signature data\n");
	if (list_mode)
	es_fputs (":signature packet: [premature eof]\n", listfp);
	rc = -1;
	goto leave;
	}
	pktlen -= n;
	}
	}

	if (pktlen < 2)
	goto underflow;
	sig->digest_start[0] = iobuf_get_noeof (inp);
	pktlen--;
	sig->digest_start[1] = iobuf_get_noeof (inp);
	pktlen--;

	if (is_v4or5 && sig->pubkey_algo) /* Extract required information. */
	{
	const byte *p;
	size_t len;

	/* Set sig->flags.unknown_critical if there is a critical bit
	* set for packets which we do not understand. */
	if (!parse_sig_subpkt (sig, 1, SIGSUBPKT_TEST_CRITICAL, NULL)
	\|\| !parse_sig_subpkt (sig, 0, SIGSUBPKT_TEST_CRITICAL, NULL))
	sig->flags.unknown_critical = 1;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_SIG_CREATED, NULL);
	if (p)
	sig->timestamp = buf32_to_u32 (p);
	else if (!(sig->pubkey_algo >= 100 && sig->pubkey_algo <= 110)
	&& opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info ("signature packet without timestamp\n");

	/* Set the key id. We first try the issuer fingerprint and if
	* it is a v4 signature the fallback to the issuer. Note that
	* only the issuer packet is also searched in the unhashed area. */
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_ISSUER_FPR, &len);
	if (p && len == 21 && p[0] == 4)
	{
	sig->keyid[0] = buf32_to_u32 (p + 1 + 12);
	sig->keyid[1] = buf32_to_u32 (p + 1 + 16);
	}
	else if (p && len == 33 && p[0] == 5)
	{
	sig->keyid[0] = buf32_to_u32 (p + 1 );
	sig->keyid[1] = buf32_to_u32 (p + 1 + 4);
	}
	else if ((p = parse_sig_subpkt2 (sig, SIGSUBPKT_ISSUER)))
	{
	sig->keyid[0] = buf32_to_u32 (p);
	sig->keyid[1] = buf32_to_u32 (p + 4);
	}
	else if (!(sig->pubkey_algo >= 100 && sig->pubkey_algo <= 110)
	&& opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info ("signature packet without keyid\n");

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_SIG_EXPIRE, NULL);
	if (p && buf32_to_u32 (p))
	sig->expiredate = sig->timestamp + buf32_to_u32 (p);
	if (sig->expiredate && sig->expiredate <= make_timestamp ())
	sig->flags.expired = 1;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_POLICY, NULL);
	if (p)
	sig->flags.policy_url = 1;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_PREF_KS, NULL);
	if (p)
	sig->flags.pref_ks = 1;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_SIGNERS_UID, &len);
	if (p && len)
	{
	char *mbox;

	sig->signers_uid = try_make_printable_string (p, len, 0);
	if (!sig->signers_uid)
	{
	rc = gpg_error_from_syserror ();
	goto leave;
	}
	mbox = mailbox_from_userid (sig->signers_uid, 0);
	if (mbox)
	{
	xfree (sig->signers_uid);
	sig->signers_uid = mbox;
	}
	}

	+ p = parse_sig_subpkt (sig, 1, SIGSUBPKT_KEY_BLOCK, NULL);
	+ if (p)
	+ sig->flags.key_block = 1;
	+
	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_NOTATION, NULL);
	if (p)
	sig->flags.notation = 1;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_REVOCABLE, NULL);
	if (p && *p == 0)
	sig->flags.revocable = 0;

	p = parse_sig_subpkt (sig, 1, SIGSUBPKT_TRUST, &len);
	if (p && len == 2)
	{
	sig->trust_depth = p[0];
	sig->trust_value = p[1];

	/* Only look for a regexp if there is also a trust
	subpacket. */
	sig->trust_regexp =
	parse_sig_subpkt (sig, 1, SIGSUBPKT_REGEXP, &len);

	/* If the regular expression is of 0 length, there is no
	regular expression. */
	if (len == 0)
	sig->trust_regexp = NULL;
	}

	/* We accept the exportable subpacket from either the hashed or
	unhashed areas as older versions of gpg put it in the
	unhashed area. In theory, anyway, we should never see this
	packet off of a local keyring. */

	p = parse_sig_subpkt2 (sig, SIGSUBPKT_EXPORTABLE);
	if (p && *p == 0)
	sig->flags.exportable = 0;

	/* Find all revocation keys. */
	if (sig->sig_class == 0x1F)
	parse_revkeys (sig);
	}

	if (list_mode)
	{
	es_fprintf (listfp, ":signature packet: algo %d, keyid %08lX%08lX\n"
	"\tversion %d, created %lu, md5len %d, sigclass 0x%02x\n"
	"\tdigest algo %d, begin of digest %02x %02x\n",
	sig->pubkey_algo,
	(ulong) sig->keyid[0], (ulong) sig->keyid[1],
	sig->version, (ulong) sig->timestamp, md5_len, sig->sig_class,
	sig->digest_algo, sig->digest_start[0], sig->digest_start[1]);
	if (is_v4or5)
	{
	parse_sig_subpkt (sig, 1, SIGSUBPKT_LIST_HASHED, NULL);
	parse_sig_subpkt (sig, 0, SIGSUBPKT_LIST_UNHASHED, NULL);
	}
	}

	ndata = pubkey_get_nsig (sig->pubkey_algo);
	if (!ndata)
	{
	if (list_mode)
	es_fprintf (listfp, "\tunknown algorithm %d\n", sig->pubkey_algo);
	unknown_pubkey_warning (sig->pubkey_algo);

	/* We store the plain material in data[0], so that we are able
	* to write it back with build_packet(). */
	if (pktlen > (5 * MAX_EXTERN_MPI_BITS / 8))
	{
	/* We include a limit to avoid too trivial DoS attacks by
	having gpg allocate too much memory. */
	log_error ("signature packet: too much data\n");
	rc = GPG_ERR_INV_PACKET;
	}
	else
	{
	sig->data[0] =
	gcry_mpi_set_opaque (NULL, read_rest (inp, pktlen), pktlen * 8);
	pktlen = 0;
	}
	}
	else
	{
	for (i = 0; i < ndata; i++)
	{
	n = pktlen;
	sig->data[i] = mpi_read (inp, &n, 0);
	pktlen -= n;
	if (list_mode)
	{
	es_fprintf (listfp, "\tdata: ");
	mpi_print (listfp, sig->data[i], mpi_print_mode);
	es_putc ('\n', listfp);
	}
	if (!sig->data[i])
	rc = GPG_ERR_INV_PACKET;
	}
	}

	leave:
	iobuf_skip_rest (inp, pktlen, 0);
	return rc;

	underflow:
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":signature packet: [too short]\n", listfp);

	iobuf_skip_rest (inp, pktlen, 0);

	return GPG_ERR_INV_PACKET;
	}


	static int
	parse_onepass_sig (IOBUF inp, int pkttype, unsigned long pktlen,
	PKT_onepass_sig * ops)
	{
	int version;
	int rc = 0;

	if (pktlen < 13)
	{
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":onepass_sig packet: [too short]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	version = iobuf_get_noeof (inp);
	pktlen--;
	if (version != 3)
	{
	log_error ("onepass_sig with unknown version %d\n", version);
	if (list_mode)
	es_fputs (":onepass_sig packet: [unknown version]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	ops->sig_class = iobuf_get_noeof (inp);
	pktlen--;
	ops->digest_algo = iobuf_get_noeof (inp);
	pktlen--;
	ops->pubkey_algo = iobuf_get_noeof (inp);
	pktlen--;
	ops->keyid[0] = read_32 (inp);
	pktlen -= 4;
	ops->keyid[1] = read_32 (inp);
	pktlen -= 4;
	ops->last = iobuf_get_noeof (inp);
	pktlen--;
	if (list_mode)
	es_fprintf (listfp,
	":onepass_sig packet: keyid %08lX%08lX\n"
	"\tversion %d, sigclass 0x%02x, digest %d, pubkey %d, "
	"last=%d\n",
	(ulong) ops->keyid[0], (ulong) ops->keyid[1],
	version, ops->sig_class,
	ops->digest_algo, ops->pubkey_algo, ops->last);


	leave:
	iobuf_skip_rest (inp, pktlen, 0);
	return rc;
	}


	static int
	parse_key (IOBUF inp, int pkttype, unsigned long pktlen,
	byte * hdr, int hdrlen, PACKET * pkt)
	{
	gpg_error_t err = 0;
	int i, version, algorithm;
	unsigned long timestamp, expiredate, max_expiredate;
	int npkey, nskey;
	u32 keyid[2];
	PKT_public_key *pk;
	int is_v5;
	unsigned int pkbytes; /* For v5 keys: Number of bytes in the public
	* key material. For v4 keys: 0. */

	(void) hdr;

	pk = pkt->pkt.public_key; /* PK has been cleared. */

	version = iobuf_get_noeof (inp);
	pktlen--;
	if (pkttype == PKT_PUBLIC_SUBKEY && version == '#')
	{
	/* Early versions of G10 used the old PGP comments packets;
	* luckily all those comments are started by a hash. */
	if (list_mode)
	{
	es_fprintf (listfp, ":rfc1991 comment packet: \"");
	for (; pktlen; pktlen--)
	{
	int c;
	c = iobuf_get (inp);
	if (c == -1)
	break; /* Ooops: shorter than indicated. */
	if (c >= ' ' && c <= 'z')
	es_putc (c, listfp);
	else
	es_fprintf (listfp, "\\x%02x", c);
	}
	es_fprintf (listfp, "\"\n");
	}
	iobuf_skip_rest (inp, pktlen, 0);
	return 0;
	}
	else if (version == 4)
	is_v5 = 0;
	else if (version == 5)
	is_v5 = 1;
	else if (version == 2 \|\| version == 3)
	{
	/* Not anymore supported since 2.1. Use an older gpg version
	* (i.e. gpg 1.4) to parse v3 packets. */
	if (opt.verbose > 1 && !glo_ctrl.silence_parse_warnings)
	log_info ("packet(%d) with obsolete version %d\n", pkttype, version);
	if (list_mode)
	es_fprintf (listfp, ":key packet: [obsolete version %d]\n", version);
	pk->version = version;
	err = gpg_error (GPG_ERR_LEGACY_KEY);
	goto leave;
	}
	else
	{
	log_error ("packet(%d) with unknown version %d\n", pkttype, version);
	if (list_mode)
	es_fputs (":key packet: [unknown version]\n", listfp);
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	if (pktlen < (is_v5? 15:11))
	{
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":key packet: [too short]\n", listfp);
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	else if (pktlen > MAX_KEY_PACKET_LENGTH)
	{
	log_error ("packet(%d) too large\n", pkttype);
	if (list_mode)
	es_fputs (":key packet: [too large]\n", listfp);
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	timestamp = read_32 (inp);
	pktlen -= 4;
	expiredate = 0; /* have to get it from the selfsignature */
	max_expiredate = 0;
	algorithm = iobuf_get_noeof (inp);
	pktlen--;
	if (is_v5)
	{
	pkbytes = read_32 (inp);
	pktlen -= 4;
	}
	else
	pkbytes = 0;

	if (list_mode)
	{
	es_fprintf (listfp, ":%s key packet:\n"
	"\tversion %d, algo %d, created %lu, expires %lu",
	pkttype == PKT_PUBLIC_KEY ? "public" :
	pkttype == PKT_SECRET_KEY ? "secret" :
	pkttype == PKT_PUBLIC_SUBKEY ? "public sub" :
	pkttype == PKT_SECRET_SUBKEY ? "secret sub" : "??",
	version, algorithm, timestamp, expiredate);
	if (is_v5)
	es_fprintf (listfp, ", pkbytes %u\n", pkbytes);
	else
	es_fprintf (listfp, "\n");
	}

	pk->timestamp = timestamp;
	pk->expiredate = expiredate;
	pk->max_expiredate = max_expiredate;
	pk->hdrbytes = hdrlen;
	pk->version = version;
	pk->flags.primary = (pkttype == PKT_PUBLIC_KEY \|\| pkttype == PKT_SECRET_KEY);
	pk->pubkey_algo = algorithm;

	nskey = pubkey_get_nskey (algorithm);
	npkey = pubkey_get_npkey (algorithm);
	if (!npkey)
	{
	if (list_mode)
	es_fprintf (listfp, "\tunknown algorithm %d\n", algorithm);
	unknown_pubkey_warning (algorithm);
	}

	if (!npkey)
	{
	/* Unknown algorithm - put data into an opaque MPI. */
	pk->pkey[0] = gcry_mpi_set_opaque (NULL,
	read_rest (inp, pktlen), pktlen * 8);
	pktlen = 0;
	goto leave;
	}
	else
	{
	for (i = 0; i < npkey; i++)
	{
	if ( (algorithm == PUBKEY_ALGO_ECDSA && (i == 0))
	\|\| (algorithm == PUBKEY_ALGO_EDDSA && (i == 0))
	\|\| (algorithm == PUBKEY_ALGO_ECDH && (i == 0 \|\| i == 2)))
	{
	/* Read the OID (i==1) or the KDF params (i==2). */
	size_t n;
	err = read_size_body (inp, pktlen, &n, pk->pkey+i);
	pktlen -= n;
	}
	else
	{
	unsigned int n = pktlen;
	pk->pkey[i] = mpi_read (inp, &n, 0);
	pktlen -= n;
	if (!pk->pkey[i])
	err = gpg_error (GPG_ERR_INV_PACKET);
	}
	if (err)
	goto leave;
	if (list_mode)
	{
	es_fprintf (listfp, "\tpkey[%d]: ", i);
	mpi_print (listfp, pk->pkey[i], mpi_print_mode);
	if ((algorithm == PUBKEY_ALGO_ECDSA
	\|\| algorithm == PUBKEY_ALGO_EDDSA
	\|\| algorithm == PUBKEY_ALGO_ECDH) && i==0)
	{
	char *curve = openpgp_oid_to_str (pk->pkey[0]);
	const char *name = openpgp_oid_to_curve (curve, 0);
	es_fprintf (listfp, " %s (%s)", name?name:"", curve);
	xfree (curve);
	}
	es_putc ('\n', listfp);
	}
	}
	}
	if (list_mode)
	keyid_from_pk (pk, keyid);

	if (pkttype == PKT_SECRET_KEY \|\| pkttype == PKT_SECRET_SUBKEY)
	{
	struct seckey_info *ski;
	byte temp[16];
	size_t snlen = 0;
	unsigned int skbytes;

	if (pktlen < 1)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	pk->seckey_info = ski = xtrycalloc (1, sizeof *ski);
	if (!pk->seckey_info)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}

	ski->algo = iobuf_get_noeof (inp);
	pktlen--;

	if (is_v5)
	{
	unsigned int protcount = 0;

	/* Read the one octet count of the following key-protection
	* material. Only required in case of unknown values. */
	if (!pktlen)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	protcount = iobuf_get_noeof (inp);
	pktlen--;
	if (list_mode)
	es_fprintf (listfp, "\tprotbytes: %u\n", protcount);
	}

	if (ski->algo)
	{
	ski->is_protected = 1;
	ski->s2k.count = 0;
	if (ski->algo == 254 \|\| ski->algo == 255)
	{
	if (pktlen < 3)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	ski->sha1chk = (ski->algo == 254);
	ski->algo = iobuf_get_noeof (inp);
	pktlen--;
	/* Note that a ski->algo > 110 is illegal, but I'm not
	* erroring out here as otherwise there would be no way
	* to delete such a key. */
	ski->s2k.mode = iobuf_get_noeof (inp);
	pktlen--;
	ski->s2k.hash_algo = iobuf_get_noeof (inp);
	pktlen--;
	/* Check for the special GNU extension. */
	if (ski->s2k.mode == 101)
	{
	for (i = 0; i < 4 && pktlen; i++, pktlen--)
	temp[i] = iobuf_get_noeof (inp);
	if (i < 4 \|\| memcmp (temp, "GNU", 3))
	{
	if (list_mode)
	es_fprintf (listfp, "\tunknown S2K %d\n",
	ski->s2k.mode);
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	/* Here we know that it is a GNU extension. What
	* follows is the GNU protection mode: All values
	* have special meanings and they are mapped to MODE
	* with a base of 1000. */
	ski->s2k.mode = 1000 + temp[3];
	}

	/* Read the salt. */
	if (ski->s2k.mode == 3 \|\| ski->s2k.mode == 1)
	{
	for (i = 0; i < 8 && pktlen; i++, pktlen--)
	temp[i] = iobuf_get_noeof (inp);
	if (i < 8)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	memcpy (ski->s2k.salt, temp, 8);
	}

	/* Check the mode. */
	switch (ski->s2k.mode)
	{
	case 0:
	if (list_mode)
	es_fprintf (listfp, "\tsimple S2K");
	break;
	case 1:
	if (list_mode)
	es_fprintf (listfp, "\tsalted S2K");
	break;
	case 3:
	if (list_mode)
	es_fprintf (listfp, "\titer+salt S2K");
	break;
	case 1001:
	if (list_mode)
	es_fprintf (listfp, "\tgnu-dummy S2K");
	break;
	case 1002:
	if (list_mode)
	es_fprintf (listfp, "\tgnu-divert-to-card S2K");
	break;
	default:
	if (list_mode)
	es_fprintf (listfp, "\tunknown %sS2K %d\n",
	ski->s2k.mode < 1000 ? "" : "GNU ",
	ski->s2k.mode);
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	/* Print some info. */
	if (list_mode)
	{
	es_fprintf (listfp, ", algo: %d,%s hash: %d",
	ski->algo,
	ski->sha1chk ? " SHA1 protection,"
	: " simple checksum,", ski->s2k.hash_algo);
	if (ski->s2k.mode == 1 \|\| ski->s2k.mode == 3)
	{
	es_fprintf (listfp, ", salt: ");
	es_write_hexstring (listfp, ski->s2k.salt, 8, 0, NULL);
	}
	es_putc ('\n', listfp);
	}

	/* Read remaining protection parameters. */
	if (ski->s2k.mode == 3)
	{
	if (pktlen < 1)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	ski->s2k.count = iobuf_get_noeof (inp);
	pktlen--;
	if (list_mode)
	es_fprintf (listfp, "\tprotect count: %lu (%lu)\n",
	(ulong)S2K_DECODE_COUNT ((ulong)ski->s2k.count),
	(ulong) ski->s2k.count);
	}
	else if (ski->s2k.mode == 1002)
	{
	/* Read the serial number. */
	if (pktlen < 1)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	snlen = iobuf_get (inp);
	pktlen--;
	if (pktlen < snlen \|\| snlen == (size_t)(-1))
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	}
	}
	else /* Old version; no S2K, so we set mode to 0, hash MD5. */
	{
	/* Note that a ski->algo > 110 is illegal, but I'm not
	erroring on it here as otherwise there would be no
	way to delete such a key. */
	ski->s2k.mode = 0;
	ski->s2k.hash_algo = DIGEST_ALGO_MD5;
	if (list_mode)
	es_fprintf (listfp, "\tprotect algo: %d (hash algo: %d)\n",
	ski->algo, ski->s2k.hash_algo);
	}

	/* It is really ugly that we don't know the size
	* of the IV here in cases we are not aware of the algorithm.
	* so a
	* ski->ivlen = cipher_get_blocksize (ski->algo);
	* won't work. The only solution I see is to hardwire it.
	* NOTE: if you change the ivlen above 16, don't forget to
	* enlarge temp.
	* FIXME: For v5 keys we can deduce this info!
	*/
	ski->ivlen = openpgp_cipher_blocklen (ski->algo);
	log_assert (ski->ivlen <= sizeof (temp));

	if (ski->s2k.mode == 1001)
	ski->ivlen = 0;
	else if (ski->s2k.mode == 1002)
	ski->ivlen = snlen < 16 ? snlen : 16;

	if (pktlen < ski->ivlen)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	for (i = 0; i < ski->ivlen; i++, pktlen--)
	temp[i] = iobuf_get_noeof (inp);
	if (list_mode)
	{
	es_fprintf (listfp,
	ski->s2k.mode == 1002 ? "\tserial-number: "
	: "\tprotect IV: ");
	for (i = 0; i < ski->ivlen; i++)
	es_fprintf (listfp, " %02x", temp[i]);
	es_putc ('\n', listfp);
	}
	memcpy (ski->iv, temp, ski->ivlen);
	}

	/* Skip count of secret key material. */
	if (is_v5)
	{
	if (pktlen < 4)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	skbytes = read_32 (inp);
	pktlen -= 4;
	if (list_mode)
	es_fprintf (listfp, "\tskbytes: %u\n", skbytes);
	}

	/* It does not make sense to read it into secure memory.
	* If the user is so careless, not to protect his secret key,
	* we can assume, that he operates an open system :=(.
	* So we put the key into secure memory when we unprotect it. */
	if (ski->s2k.mode == 1001 \|\| ski->s2k.mode == 1002)
	{
	/* Better set some dummy stuff here. */
	pk->pkey[npkey] = gcry_mpi_set_opaque (NULL,
	xstrdup ("dummydata"),
	10 * 8);
	pktlen = 0;
	}
	else if (ski->is_protected)
	{
	if (pktlen < 2) /* At least two bytes for the length. */
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	/* Ugly: The length is encrypted too, so we read all stuff
	* up to the end of the packet into the first SKEY
	* element.
	* FIXME: We can do better for v5 keys. */
	pk->pkey[npkey] = gcry_mpi_set_opaque (NULL,
	read_rest (inp, pktlen),
	pktlen * 8);
	/* Mark that MPI as protected - we need this information for
	* importing a key. The OPAQUE flag can't be used because
	* we also store public EdDSA values in opaque MPIs. */
	if (pk->pkey[npkey])
	gcry_mpi_set_flag (pk->pkey[npkey], GCRYMPI_FLAG_USER1);
	pktlen = 0;
	if (list_mode)
	es_fprintf (listfp, "\tskey[%d]: [v4 protected]\n", npkey);
	}
	else
	{
	/* Not encrypted. */
	for (i = npkey; i < nskey; i++)
	{
	unsigned int n;

	if (pktlen < 2) /* At least two bytes for the length. */
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	n = pktlen;
	pk->pkey[i] = mpi_read (inp, &n, 0);
	pktlen -= n;
	if (list_mode)
	{
	es_fprintf (listfp, "\tskey[%d]: ", i);
	mpi_print (listfp, pk->pkey[i], mpi_print_mode);
	es_putc ('\n', listfp);
	}

	if (!pk->pkey[i])
	err = gpg_error (GPG_ERR_INV_PACKET);
	}
	if (err)
	goto leave;

	if (pktlen < 2)
	{
	err = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	ski->csum = read_16 (inp);
	pktlen -= 2;
	if (list_mode)
	es_fprintf (listfp, "\tchecksum: %04hx\n", ski->csum);
	}
	}

	/* Note that KEYID below has been initialized above in list_mode. */
	if (list_mode)
	es_fprintf (listfp, "\tkeyid: %08lX%08lX\n",
	(ulong) keyid[0], (ulong) keyid[1]);

	leave:
	iobuf_skip_rest (inp, pktlen, 0);
	return err;
	}


	/* Attribute subpackets have the same format as v4 signature
	subpackets. This is not part of OpenPGP, but is done in several
	versions of PGP nevertheless. */
	int
	parse_attribute_subpkts (PKT_user_id * uid)
	{
	size_t n;
	int count = 0;
	struct user_attribute *attribs = NULL;
	const byte *buffer = uid->attrib_data;
	int buflen = uid->attrib_len;
	byte type;

	xfree (uid->attribs);

	while (buflen)
	{
	n = *buffer++;
	buflen--;
	if (n == 255) /* 4 byte length header. */
	{
	if (buflen < 4)
	goto too_short;
	n = buf32_to_size_t (buffer);
	buffer += 4;
	buflen -= 4;
	}
	else if (n >= 192) /* 2 byte special encoded length header. */
	{
	if (buflen < 2)
	goto too_short;
	n = ((n - 192) << 8) + *buffer + 192;
	buffer++;
	buflen--;
	}
	if (buflen < n)
	goto too_short;

	if (!n)
	{
	/* Too short to encode the subpacket type. */
	if (opt.verbose)
	log_info ("attribute subpacket too short\n");
	break;
	}

	attribs = xrealloc (attribs,
	(count + 1) * sizeof (struct user_attribute));
	memset (&attribs[count], 0, sizeof (struct user_attribute));

	type = *buffer;
	buffer++;
	buflen--;
	n--;

	attribs[count].type = type;
	attribs[count].data = buffer;
	attribs[count].len = n;
	buffer += n;
	buflen -= n;
	count++;
	}

	uid->attribs = attribs;
	uid->numattribs = count;
	return count;

	too_short:
	if (opt.verbose && !glo_ctrl.silence_parse_warnings)
	log_info ("buffer shorter than attribute subpacket\n");
	uid->attribs = attribs;
	uid->numattribs = count;
	return count;
	}


	static int
	parse_user_id (IOBUF inp, int pkttype, unsigned long pktlen, PACKET * packet)
	{
	byte *p;

	/* Cap the size of a user ID at 2k: a value absurdly large enough
	that there is no sane user ID string (which is printable text
	as of RFC2440bis) that won't fit in it, but yet small enough to
	avoid allocation problems. A large pktlen may not be
	allocatable, and a very large pktlen could actually cause our
	allocation to wrap around in xmalloc to a small number. */

	if (pktlen > MAX_UID_PACKET_LENGTH)
	{
	log_error ("packet(%d) too large\n", pkttype);
	if (list_mode)
	es_fprintf (listfp, ":user ID packet: [too large]\n");
	iobuf_skip_rest (inp, pktlen, 0);
	return GPG_ERR_INV_PACKET;
	}

	packet->pkt.user_id = xmalloc_clear (sizeof *packet->pkt.user_id + pktlen);
	packet->pkt.user_id->len = pktlen;
	packet->pkt.user_id->ref = 1;

	p = packet->pkt.user_id->name;
	for (; pktlen; pktlen--, p++)
	*p = iobuf_get_noeof (inp);
	*p = 0;

	if (list_mode)
	{
	int n = packet->pkt.user_id->len;
	es_fprintf (listfp, ":user ID packet: \"");
	/* fixme: Hey why don't we replace this with es_write_sanitized?? */
	for (p = packet->pkt.user_id->name; n; p++, n--)
	{
	if (p >= ' ' && p <= 'z')
	es_putc (*p, listfp);
	else
	es_fprintf (listfp, "\\x%02x", *p);
	}
	es_fprintf (listfp, "\"\n");
	}
	return 0;
	}


	void
	make_attribute_uidname (PKT_user_id * uid, size_t max_namelen)
	{
	log_assert (max_namelen > 70);
	if (uid->numattribs <= 0)
	sprintf (uid->name, "[bad attribute packet of size %lu]",
	uid->attrib_len);
	else if (uid->numattribs > 1)
	sprintf (uid->name, "[%d attributes of size %lu]",
	uid->numattribs, uid->attrib_len);
	else
	{
	/* Only one attribute, so list it as the "user id" */

	if (uid->attribs->type == ATTRIB_IMAGE)
	{
	u32 len;
	byte type;

	if (parse_image_header (uid->attribs, &type, &len))
	sprintf (uid->name, "[%.20s image of size %lu]",
	image_type_to_string (type, 1), (ulong) len);
	else
	sprintf (uid->name, "[invalid image]");
	}
	else
	sprintf (uid->name, "[unknown attribute of size %lu]",
	(ulong) uid->attribs->len);
	}

	uid->len = strlen (uid->name);
	}


	static int
	parse_attribute (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet)
	{
	byte *p;

	(void) pkttype;

	/* We better cap the size of an attribute packet to make DoS not too
	easy. 16MB should be more then enough for one attribute packet
	(ie. a photo). */
	if (pktlen > MAX_ATTR_PACKET_LENGTH)
	{
	log_error ("packet(%d) too large\n", pkttype);
	if (list_mode)
	es_fprintf (listfp, ":attribute packet: [too large]\n");
	iobuf_skip_rest (inp, pktlen, 0);
	return GPG_ERR_INV_PACKET;
	}

	#define EXTRA_UID_NAME_SPACE 71
	packet->pkt.user_id = xmalloc_clear (sizeof *packet->pkt.user_id
	+ EXTRA_UID_NAME_SPACE);
	packet->pkt.user_id->ref = 1;
	packet->pkt.user_id->attrib_data = xmalloc (pktlen? pktlen:1);
	packet->pkt.user_id->attrib_len = pktlen;

	p = packet->pkt.user_id->attrib_data;
	for (; pktlen; pktlen--, p++)
	*p = iobuf_get_noeof (inp);

	/* Now parse out the individual attribute subpackets. This is
	somewhat pointless since there is only one currently defined
	attribute type (jpeg), but it is correct by the spec. */
	parse_attribute_subpkts (packet->pkt.user_id);

	make_attribute_uidname (packet->pkt.user_id, EXTRA_UID_NAME_SPACE);

	if (list_mode)
	{
	es_fprintf (listfp, ":attribute packet: %s\n", packet->pkt.user_id->name);
	}
	return 0;
	}


	static int
	parse_comment (IOBUF inp, int pkttype, unsigned long pktlen, PACKET * packet)
	{
	byte *p;

	/* Cap comment packet at a reasonable value to avoid an integer
	overflow in the malloc below. Comment packets are actually not
	anymore define my OpenPGP and we even stopped to use our
	private comment packet. */
	if (pktlen > MAX_COMMENT_PACKET_LENGTH)
	{
	log_error ("packet(%d) too large\n", pkttype);
	if (list_mode)
	es_fprintf (listfp, ":%scomment packet: [too large]\n",
	pkttype == PKT_OLD_COMMENT ? "OpenPGP draft " : "");
	iobuf_skip_rest (inp, pktlen, 0);
	return GPG_ERR_INV_PACKET;
	}
	packet->pkt.comment = xmalloc (sizeof *packet->pkt.comment + pktlen - 1);
	packet->pkt.comment->len = pktlen;
	p = packet->pkt.comment->data;
	for (; pktlen; pktlen--, p++)
	*p = iobuf_get_noeof (inp);

	if (list_mode)
	{
	int n = packet->pkt.comment->len;
	es_fprintf (listfp, ":%scomment packet: \"", pkttype == PKT_OLD_COMMENT ?
	"OpenPGP draft " : "");
	for (p = packet->pkt.comment->data; n; p++, n--)
	{
	if (p >= ' ' && p <= 'z')
	es_putc (*p, listfp);
	else
	es_fprintf (listfp, "\\x%02x", *p);
	}
	es_fprintf (listfp, "\"\n");
	}
	return 0;
	}


	/* Parse a ring trust packet RFC4880 (5.10).
	*
	* This parser is special in that the packet is not stored as a packet
	* but its content is merged into the previous packet. */
	static gpg_error_t
	parse_ring_trust (parse_packet_ctx_t ctx, unsigned long pktlen)
	{
	gpg_error_t err;
	iobuf_t inp = ctx->inp;
	PKT_ring_trust rt = {0};
	int c;
	int not_gpg = 0;

	if (!pktlen)
	{
	if (list_mode)
	es_fprintf (listfp, ":trust packet: empty\n");
	err = 0;
	goto leave;
	}

	c = iobuf_get_noeof (inp);
	pktlen--;
	rt.trustval = c;
	if (pktlen)
	{
	if (!c)
	{
	c = iobuf_get_noeof (inp);
	/* We require that bit 7 of the sigcache is 0 (easier
	* eof handling). */
	if (!(c & 0x80))
	rt.sigcache = c;
	}
	else
	iobuf_get_noeof (inp); /* Dummy read. */
	pktlen--;
	}

	/* Next is the optional subtype. */
	if (pktlen > 3)
	{
	char tmp[4];
	tmp[0] = iobuf_get_noeof (inp);
	tmp[1] = iobuf_get_noeof (inp);
	tmp[2] = iobuf_get_noeof (inp);
	tmp[3] = iobuf_get_noeof (inp);
	pktlen -= 4;
	if (!memcmp (tmp, "gpg", 3))
	rt.subtype = tmp[3];
	else
	not_gpg = 1;
	}
	/* If it is a key or uid subtype read the remaining data. */
	if ((rt.subtype == RING_TRUST_KEY \|\| rt.subtype == RING_TRUST_UID)
	&& pktlen >= 6 )
	{
	int i;
	unsigned int namelen;

	rt.keyorg = iobuf_get_noeof (inp);
	pktlen--;
	rt.keyupdate = read_32 (inp);
	pktlen -= 4;
	namelen = iobuf_get_noeof (inp);
	pktlen--;
	if (namelen && pktlen)
	{
	rt.url = xtrymalloc (namelen + 1);
	if (!rt.url)
	{
	err = gpg_error_from_syserror ();
	goto leave;
	}
	for (i = 0; pktlen && i < namelen; pktlen--, i++)
	rt.url[i] = iobuf_get_noeof (inp);
	rt.url[i] = 0;
	}
	}

	if (list_mode)
	{
	if (rt.subtype == RING_TRUST_SIG)
	es_fprintf (listfp, ":trust packet: sig flag=%02x sigcache=%02x\n",
	rt.trustval, rt.sigcache);
	else if (rt.subtype == RING_TRUST_UID \|\| rt.subtype == RING_TRUST_KEY)
	{
	unsigned char *p;

	es_fprintf (listfp, ":trust packet: %s upd=%lu src=%d%s",
	(rt.subtype == RING_TRUST_UID? "uid" : "key"),
	(unsigned long)rt.keyupdate,
	rt.keyorg,
	(rt.url? " url=":""));
	if (rt.url)
	{
	for (p = rt.url; *p; p++)
	{
	if (p >= ' ' && p <= 'z')
	es_putc (*p, listfp);
	else
	es_fprintf (listfp, "\\x%02x", *p);
	}
	}
	es_putc ('\n', listfp);
	}
	else if (not_gpg)
	es_fprintf (listfp, ":trust packet: not created by gpg\n");
	else
	es_fprintf (listfp, ":trust packet: subtype=%02x\n",
	rt.subtype);
	}

	/* Now transfer the data to the respective packet. Do not do this
	* if SKIP_META is set. */
	if (!ctx->last_pkt.pkt.generic \|\| ctx->skip_meta)
	;
	else if (rt.subtype == RING_TRUST_SIG
	&& ctx->last_pkt.pkttype == PKT_SIGNATURE)
	{
	PKT_signature *sig = ctx->last_pkt.pkt.signature;

	if ((rt.sigcache & 1))
	{
	sig->flags.checked = 1;
	sig->flags.valid = !!(rt.sigcache & 2);
	}
	}
	else if (rt.subtype == RING_TRUST_UID
	&& (ctx->last_pkt.pkttype == PKT_USER_ID
	\|\| ctx->last_pkt.pkttype == PKT_ATTRIBUTE))
	{
	PKT_user_id *uid = ctx->last_pkt.pkt.user_id;

	uid->keyorg = rt.keyorg;
	uid->keyupdate = rt.keyupdate;
	uid->updateurl = rt.url;
	rt.url = NULL;
	}
	else if (rt.subtype == RING_TRUST_KEY
	&& (ctx->last_pkt.pkttype == PKT_PUBLIC_KEY
	\|\| ctx->last_pkt.pkttype == PKT_SECRET_KEY))
	{
	PKT_public_key *pk = ctx->last_pkt.pkt.public_key;

	pk->keyorg = rt.keyorg;
	pk->keyupdate = rt.keyupdate;
	pk->updateurl = rt.url;
	rt.url = NULL;
	}

	err = 0;

	leave:
	xfree (rt.url);
	free_packet (NULL, ctx); /* This sets ctx->last_pkt to NULL. */
	iobuf_skip_rest (inp, pktlen, 0);
	return err;
	}


	static int
	parse_plaintext (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * pkt, int new_ctb, int partial)
	{
	int rc = 0;
	int mode, namelen;
	PKT_plaintext *pt;
	byte *p;
	int c, i;

	if (!partial && pktlen < 6)
	{
	log_error ("packet(%d) too short (%lu)\n", pkttype, (ulong) pktlen);
	if (list_mode)
	es_fputs (":literal data packet: [too short]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	mode = iobuf_get_noeof (inp);
	if (pktlen)
	pktlen--;
	namelen = iobuf_get_noeof (inp);
	if (pktlen)
	pktlen--;
	/* Note that namelen will never exceed 255 bytes. */
	pt = pkt->pkt.plaintext =
	xmalloc (sizeof *pkt->pkt.plaintext + namelen - 1);
	pt->new_ctb = new_ctb;
	pt->mode = mode;
	pt->namelen = namelen;
	pt->is_partial = partial;
	if (pktlen)
	{
	for (i = 0; pktlen > 4 && i < namelen; pktlen--, i++)
	pt->name[i] = iobuf_get_noeof (inp);
	}
	else
	{
	for (i = 0; i < namelen; i++)
	if ((c = iobuf_get (inp)) == -1)
	break;
	else
	pt->name[i] = c;
	}
	/* Fill up NAME so that a check with valgrind won't complain about
	* reading from uninitialized memory. This case may be triggred by
	* corrupted packets. */
	for (; i < namelen; i++)
	pt->name[i] = 0;

	pt->timestamp = read_32 (inp);
	if (pktlen)
	pktlen -= 4;
	pt->len = pktlen;
	pt->buf = inp;

	if (list_mode)
	{
	es_fprintf (listfp, ":literal data packet:\n"
	"\tmode %c (%X), created %lu, name=\"",
	mode >= ' ' && mode < 'z' ? mode : '?', mode,
	(ulong) pt->timestamp);
	for (p = pt->name, i = 0; i < namelen; p++, i++)
	{
	if (p >= ' ' && p <= 'z')
	es_putc (*p, listfp);
	else
	es_fprintf (listfp, "\\x%02x", *p);
	}
	es_fprintf (listfp, "\",\n\traw data: ");
	if (partial)
	es_fprintf (listfp, "unknown length\n");
	else
	es_fprintf (listfp, "%lu bytes\n", (ulong) pt->len);
	}

	leave:
	return rc;
	}


	static int
	parse_compressed (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * pkt, int new_ctb)
	{
	PKT_compressed *zd;

	/* PKTLEN is here 0, but data follows (this should be the last
	object in a file or the compress algorithm should know the
	length). */
	(void) pkttype;
	(void) pktlen;

	zd = pkt->pkt.compressed = xmalloc (sizeof *pkt->pkt.compressed);
	zd->algorithm = iobuf_get_noeof (inp);
	zd->len = 0; /* not used */
	zd->new_ctb = new_ctb;
	zd->buf = inp;
	if (list_mode)
	es_fprintf (listfp, ":compressed packet: algo=%d\n", zd->algorithm);
	return 0;
	}


	static int
	parse_encrypted (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * pkt, int new_ctb, int partial)
	{
	int rc = 0;
	PKT_encrypted *ed;
	unsigned long orig_pktlen = pktlen;

	ed = pkt->pkt.encrypted = xmalloc (sizeof *pkt->pkt.encrypted);
	/* ed->len is set below. */
	ed->extralen = 0; /* Unknown here; only used in build_packet. */
	ed->buf = NULL;
	ed->new_ctb = new_ctb;
	ed->is_partial = partial;
	ed->aead_algo = 0;
	ed->cipher_algo = 0; /* Only used with AEAD. */
	ed->chunkbyte = 0; /* Only used with AEAD. */
	if (pkttype == PKT_ENCRYPTED_MDC)
	{
	/* Fixme: add some pktlen sanity checks. */
	int version;

	version = iobuf_get_noeof (inp);
	if (orig_pktlen)
	pktlen--;
	if (version != 1)
	{
	log_error ("encrypted_mdc packet with unknown version %d\n",
	version);
	if (list_mode)
	es_fputs (":encrypted data packet: [unknown version]\n", listfp);
	/skip_rest(inp, pktlen); should we really do this? /
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	ed->mdc_method = DIGEST_ALGO_SHA1;
	}
	else
	ed->mdc_method = 0;

	/* A basic sanity check. We need at least an 8 byte IV plus the 2
	detection bytes. Note that we don't known the algorithm and thus
	we may only check against the minimum blocksize. */
	if (orig_pktlen && pktlen < 10)
	{
	/* Actually this is blocksize+2. */
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":encrypted data packet: [too short]\n", listfp);
	rc = GPG_ERR_INV_PACKET;
	iobuf_skip_rest (inp, pktlen, partial);
	goto leave;
	}

	/* Store the remaining length of the encrypted data (i.e. without
	the MDC version number but with the IV etc.). This value is
	required during decryption. */
	ed->len = pktlen;

	if (list_mode)
	{
	if (orig_pktlen)
	es_fprintf (listfp, ":encrypted data packet:\n\tlength: %lu\n",
	orig_pktlen);
	else
	es_fprintf (listfp, ":encrypted data packet:\n\tlength: unknown\n");
	if (ed->mdc_method)
	es_fprintf (listfp, "\tmdc_method: %d\n", ed->mdc_method);
	}

	ed->buf = inp;

	leave:
	return rc;
	}


	/* Note, that this code is not anymore used in real life because the
	MDC checking is now done right after the decryption in
	decrypt_data. */
	static int
	parse_mdc (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * pkt, int new_ctb)
	{
	int rc = 0;
	PKT_mdc *mdc;
	byte *p;

	(void) pkttype;

	mdc = pkt->pkt.mdc = xmalloc (sizeof *pkt->pkt.mdc);
	if (list_mode)
	es_fprintf (listfp, ":mdc packet: length=%lu\n", pktlen);
	if (!new_ctb \|\| pktlen != 20)
	{
	log_error ("mdc_packet with invalid encoding\n");
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}
	p = mdc->hash;
	for (; pktlen; pktlen--, p++)
	*p = iobuf_get_noeof (inp);

	leave:
	return rc;
	}


	static gpg_error_t
	parse_encrypted_aead (iobuf_t inp, int pkttype, unsigned long pktlen,
	PACKET *pkt, int partial)
	{
	int rc = 0;
	PKT_encrypted *ed;
	unsigned long orig_pktlen = pktlen;
	int version;

	ed = pkt->pkt.encrypted = xtrymalloc (sizeof *pkt->pkt.encrypted);
	if (!ed)
	return gpg_error_from_syserror ();
	ed->len = 0;
	ed->extralen = 0; /* (only used in build_packet.) */
	ed->buf = NULL;
	ed->new_ctb = 1; /* (packet number requires a new CTB anyway.) */
	ed->is_partial = partial;
	ed->mdc_method = 0;
	/* A basic sanity check. We need one version byte, one algo byte,
	* one aead algo byte, one chunkbyte, at least 15 byte IV. */
	if (orig_pktlen && pktlen < 19)
	{
	log_error ("packet(%d) too short\n", pkttype);
	if (list_mode)
	es_fputs (":aead encrypted packet: [too short]\n", listfp);
	rc = gpg_error (GPG_ERR_INV_PACKET);
	iobuf_skip_rest (inp, pktlen, partial);
	goto leave;
	}

	version = iobuf_get_noeof (inp);
	if (orig_pktlen)
	pktlen--;
	if (version != 1)
	{
	log_error ("aead encrypted packet with unknown version %d\n",
	version);
	if (list_mode)
	es_fputs (":aead encrypted packet: [unknown version]\n", listfp);
	/skip_rest(inp, pktlen); should we really do this? /
	rc = gpg_error (GPG_ERR_INV_PACKET);
	goto leave;
	}

	ed->cipher_algo = iobuf_get_noeof (inp);
	if (orig_pktlen)
	pktlen--;
	ed->aead_algo = iobuf_get_noeof (inp);
	if (orig_pktlen)
	pktlen--;
	ed->chunkbyte = iobuf_get_noeof (inp);
	if (orig_pktlen)
	pktlen--;

	/* Store the remaining length of the encrypted data. We read the
	* rest during decryption. */
	ed->len = pktlen;

	if (list_mode)
	{
	es_fprintf (listfp, ":aead encrypted packet: cipher=%u aead=%u cb=%u\n",
	ed->cipher_algo, ed->aead_algo, ed->chunkbyte);
	if (orig_pktlen)
	es_fprintf (listfp, "\tlength: %lu\n", orig_pktlen);
	else
	es_fprintf (listfp, "\tlength: unknown\n");
	}

	ed->buf = inp;

	leave:
	return rc;
	}


	/*
	* This packet is internally generated by us (in armor.c) to transfer
	* some information to the lower layer. To make sure that this packet
	* is really a GPG faked one and not one coming from outside, we
	* first check that there is a unique tag in it.
	*
	* The format of such a control packet is:
	* n byte session marker
	* 1 byte control type CTRLPKT_xxxxx
	* m byte control data
	*/
	static int
	parse_gpg_control (IOBUF inp, int pkttype, unsigned long pktlen,
	PACKET * packet, int partial)
	{
	byte *p;
	const byte *sesmark;
	size_t sesmarklen;
	int i;

	(void) pkttype;

	if (list_mode)
	es_fprintf (listfp, ":packet 63: length %lu ", pktlen);

	sesmark = get_session_marker (&sesmarklen);
	if (pktlen < sesmarklen + 1) /* 1 is for the control bytes */
	goto skipit;
	for (i = 0; i < sesmarklen; i++, pktlen--)
	{
	if (sesmark[i] != iobuf_get_noeof (inp))
	goto skipit;
	}
	if (pktlen > 4096)
	goto skipit; /* Definitely too large. We skip it to avoid an
	overflow in the malloc. */
	if (list_mode)
	es_fputs ("- gpg control packet", listfp);

	packet->pkt.gpg_control = xmalloc (sizeof *packet->pkt.gpg_control
	+ pktlen - 1);
	packet->pkt.gpg_control->control = iobuf_get_noeof (inp);
	pktlen--;
	packet->pkt.gpg_control->datalen = pktlen;
	p = packet->pkt.gpg_control->data;
	for (; pktlen; pktlen--, p++)
	*p = iobuf_get_noeof (inp);

	return 0;

	skipit:
	if (list_mode)
	{
	int c;

	i = 0;
	es_fprintf (listfp, "- private (rest length %lu)\n", pktlen);
	if (partial)
	{
	while ((c = iobuf_get (inp)) != -1)
	dump_hex_line (c, &i);
	}
	else
	{
	for (; pktlen; pktlen--)
	{
	dump_hex_line ((c = iobuf_get (inp)), &i);
	if (c == -1)
	break;
	}
	}
	es_putc ('\n', listfp);
	}
	iobuf_skip_rest (inp, pktlen, 0);
	return gpg_error (GPG_ERR_INV_PACKET);
	}


	/* Create a GPG control packet to be used internally as a placeholder. */
	PACKET *
	create_gpg_control (ctrlpkttype_t type, const byte * data, size_t datalen)
	{
	PACKET *packet;
	byte *p;

	if (!data)
	datalen = 0;

	packet = xmalloc (sizeof *packet);
	init_packet (packet);
	packet->pkttype = PKT_GPG_CONTROL;
	packet->pkt.gpg_control = xmalloc (sizeof *packet->pkt.gpg_control + datalen);
	packet->pkt.gpg_control->control = type;
	packet->pkt.gpg_control->datalen = datalen;
	p = packet->pkt.gpg_control->data;
	for (; datalen; datalen--, p++)
	p = data++;

	return packet;
	}
	diff --git a/g10/pkclist.c b/g10/pkclist.c
	index 9ebfb131d..370b474d0 100644
	--- a/g10/pkclist.c
	+++ b/g10/pkclist.c
	@@ -1,1673 +1,1673 @@
	/* pkclist.c - create a list of public keys
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
	* 2008, 2009, 2010 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <errno.h>

	#include "gpg.h"
	#include "options.h"
	#include "packet.h"
	#include "../common/status.h"
	#include "keydb.h"
	#include "../common/util.h"
	#include "main.h"
	#include "trustdb.h"
	#include "../common/ttyio.h"
	#include "../common/status.h"
	#include "photoid.h"
	#include "../common/i18n.h"
	#include "tofu.h"

	#define CONTROL_D ('D' - 'A' + 1)

	static void
	send_status_inv_recp (int reason, const char *name)
	{
	char buf[40];

	snprintf (buf, sizeof buf, "%d ", reason);
	write_status_text_and_buffer (STATUS_INV_RECP, buf,
	name, strlen (name),
	-1);
	}


	/****************
	* Show the revocation reason as it is stored with the given signature
	*/
	static void
	do_show_revocation_reason( PKT_signature *sig )
	{
	size_t n, nn;
	const byte p, pp;
	int seq = 0;
	const char *text;

	while ((p = enum_sig_subpkt (sig, 1, SIGSUBPKT_REVOC_REASON,
	&n, &seq, NULL)) ) {
	if( !n )
	continue; /* invalid - just skip it */

	if( *p == 0 )
	text = _("No reason specified");
	else if( *p == 0x01 )
	text = _("Key is superseded");
	else if( *p == 0x02 )
	text = _("Key has been compromised");
	else if( *p == 0x03 )
	text = _("Key is no longer used");
	else if( *p == 0x20 )
	text = _("User ID is no longer valid");
	else
	text = NULL;

	log_info ( _("reason for revocation: "));
	if (text)
	log_printf ("%s\n", text);
	else
	log_printf ("code=%02x\n", *p );
	n--; p++;
	pp = NULL;
	do {
	/* We don't want any empty lines, so skip them */
	while( n && *p == '\n' ) {
	p++;
	n--;
	}
	if( n ) {
	pp = memchr( p, '\n', n );
	nn = pp? pp - p : n;
	log_info ( _("revocation comment: ") );
	es_write_sanitized (log_get_stream(), p, nn, NULL, NULL);
	log_printf ("\n");
	p += nn; n -= nn;
	}
	} while( pp );
	}
	}

	/* Mode 0: try and find the revocation based on the pk (i.e. check
	subkeys, etc.) Mode 1: use only the revocation on the main pk */

	void
	show_revocation_reason (ctrl_t ctrl, PKT_public_key *pk, int mode)
	{
	/* Hmmm, this is not so easy because we have to duplicate the code
	* used in the trustdb to calculate the keyflags. We need to find
	* a clean way to check revocation certificates on keys and
	* signatures. And there should be no duplicate code. Because we
	* enter this function only when the trustdb told us that we have
	* a revoked key, we could simply look for a revocation cert and
	* display this one, when there is only one. Let's try to do this
	* until we have a better solution. */
	KBNODE node, keyblock = NULL;
	byte fingerprint[MAX_FINGERPRINT_LEN];
	size_t fingerlen;
	int rc;

	/* get the keyblock */
	fingerprint_from_pk( pk, fingerprint, &fingerlen );
	rc = get_pubkey_byfprint (ctrl, NULL, &keyblock, fingerprint, fingerlen);
	if( rc ) { /* that should never happen */
	log_debug( "failed to get the keyblock\n");
	return;
	}

	for( node=keyblock; node; node = node->next ) {
	if( (mode && node->pkt->pkttype == PKT_PUBLIC_KEY) \|\|
	( ( node->pkt->pkttype == PKT_PUBLIC_KEY
	\|\| node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	&& !cmp_public_keys( node->pkt->pkt.public_key, pk ) ) )
	break;
	}
	if( !node ) {
	log_debug("Oops, PK not in keyblock\n");
	release_kbnode( keyblock );
	return;
	}
	/* now find the revocation certificate */
	for( node = node->next; node ; node = node->next ) {
	if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
	break;
	if( node->pkt->pkttype == PKT_SIGNATURE
	&& (node->pkt->pkt.signature->sig_class == 0x20
	\|\| node->pkt->pkt.signature->sig_class == 0x28 ) ) {
	/* FIXME: we should check the signature here */
	do_show_revocation_reason ( node->pkt->pkt.signature );
	break;
	}
	}

	/* We didn't find it, so check if the whole key is revoked */
	if(!node && !mode)
	show_revocation_reason (ctrl, pk, 1);

	release_kbnode( keyblock );
	}


	/****************
	* mode: 0 = standard
	* 1 = Without key info and additional menu option 'm'
	* this does also add an option to set the key to ultimately trusted.
	* Returns:
	* -2 = nothing changed - caller should show some additional info
	* -1 = quit operation
	* 0 = nothing changed
	* 1 = new ownertrust now in new_trust
	*/
	#ifndef NO_TRUST_MODELS
	static int
	do_edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode,
	unsigned *new_trust, int defer_help )
	{
	char *p;
	u32 keyid[2];
	int changed=0;
	int quit=0;
	int show=0;
	int min_num;
	int did_help=defer_help;
	unsigned int minimum = tdb_get_min_ownertrust (ctrl, pk, 0);

	switch(minimum)
	{
	default:
	case TRUST_UNDEFINED: min_num=1; break;
	case TRUST_NEVER: min_num=2; break;
	case TRUST_MARGINAL: min_num=3; break;
	case TRUST_FULLY: min_num=4; break;
	}

	keyid_from_pk (pk, keyid);
	for(;;) {
	/* A string with valid answers.

	TRANSLATORS: These are the allowed answers in lower and
	uppercase. Below you will find the matching strings which
	should be translated accordingly and the letter changed to
	match the one in the answer string.

	i = please show me more information
	m = back to the main menu
	s = skip this key
	q = quit
	*/
	const char *ans = _("iImMqQsS");

	if( !did_help )
	{
	if( !mode )
	{
	KBNODE keyblock, un;

	tty_printf (_("No trust value assigned to:\n"));
	print_key_line (ctrl, NULL, pk, 0);

	p = get_user_id_native (ctrl, keyid);
	tty_printf (_(" \"%s\"\n"),p);
	xfree (p);

	keyblock = get_pubkeyblock (ctrl, keyid);
	if (!keyblock)
	BUG ();
	for (un=keyblock; un; un = un->next)
	{
	if (un->pkt->pkttype != PKT_USER_ID )
	continue;
	if (un->pkt->pkt.user_id->flags.revoked)
	continue;
	if (un->pkt->pkt.user_id->flags.expired)
	continue;
	/* Only skip textual primaries */
	if (un->pkt->pkt.user_id->flags.primary
	&& !un->pkt->pkt.user_id->attrib_data )
	continue;

	if((opt.verify_options&VERIFY_SHOW_PHOTOS)
	&& un->pkt->pkt.user_id->attrib_data)
	show_photos (ctrl,
	un->pkt->pkt.user_id->attribs,
	un->pkt->pkt.user_id->numattribs, pk,
	un->pkt->pkt.user_id);

	p=utf8_to_native(un->pkt->pkt.user_id->name,
	un->pkt->pkt.user_id->len,0);

	tty_printf(_(" aka \"%s\"\n"),p);
	}

	print_fingerprint (ctrl, NULL, pk, 2);
	tty_printf("\n");
	release_kbnode (keyblock);
	}

	if(opt.trust_model==TM_DIRECT)
	{
	tty_printf(_("How much do you trust that this key actually "
	"belongs to the named user?\n"));
	tty_printf("\n");
	}
	else
	{
	/* This string also used in keyedit.c:trustsig_prompt */
	tty_printf(_("Please decide how far you trust this user to"
	" correctly verify other users' keys\n"
	"(by looking at passports, checking fingerprints from"
	" different sources, etc.)\n"));
	tty_printf("\n");
	}

	if(min_num<=1)
	tty_printf (_(" %d = I don't know or won't say\n"), 1);
	if(min_num<=2)
	tty_printf (_(" %d = I do NOT trust\n"), 2);
	if(min_num<=3)
	tty_printf (_(" %d = I trust marginally\n"), 3);
	if(min_num<=4)
	tty_printf (_(" %d = I trust fully\n"), 4);
	if (mode)
	tty_printf (_(" %d = I trust ultimately\n"), 5);
	#if 0
	/* not yet implemented */
	tty_printf (" i = please show me more information\n");
	#endif
	if( mode )
	tty_printf(_(" m = back to the main menu\n"));
	else
	{
	tty_printf(_(" s = skip this key\n"));
	tty_printf(_(" q = quit\n"));
	}
	tty_printf("\n");
	if(minimum)
	tty_printf(_("The minimum trust level for this key is: %s\n\n"),
	trust_value_to_string(minimum));
	did_help = 1;
	}
	if( strlen(ans) != 8 )
	BUG();
	p = cpr_get("edit_ownertrust.value",_("Your decision? "));
	trim_spaces(p);
	cpr_kill_prompt();
	if( !*p )
	did_help = 0;
	else if( *p && p[1] )
	;
	else if( !p[1] && ((p >= '0'+min_num) && p <= (mode?'5':'4')) )
	{
	unsigned int trust;
	switch( *p )
	{
	case '1': trust = TRUST_UNDEFINED; break;
	case '2': trust = TRUST_NEVER ; break;
	case '3': trust = TRUST_MARGINAL ; break;
	case '4': trust = TRUST_FULLY ; break;
	case '5': trust = TRUST_ULTIMATE ; break;
	default: BUG();
	}
	if (trust == TRUST_ULTIMATE
	&& !cpr_get_answer_is_yes ("edit_ownertrust.set_ultimate.okay",
	_("Do you really want to set this key"
	" to ultimate trust? (y/N) ")))
	; /* no */
	else
	{
	*new_trust = trust;
	changed = 1;
	break;
	}
	}
	#if 0
	/* not yet implemented */
	else if( p == ans[0] \|\| p == ans[1] )
	{
	tty_printf(_("Certificates leading to an ultimately trusted key:\n"));
	show = 1;
	break;
	}
	#endif
	else if( mode && (p == ans[2] \|\| p == ans[3] \|\| *p == CONTROL_D ) )
	{
	break ; /* back to the menu */
	}
	else if( !mode && (p == ans[6] \|\| p == ans[7] ) )
	{
	break; /* skip */
	}
	else if( !mode && (p == ans[4] \|\| p == ans[5] ) )
	{
	quit = 1;
	break ; /* back to the menu */
	}
	xfree(p); p = NULL;
	}
	xfree(p);
	return show? -2: quit? -1 : changed;
	}
	#endif /!NO_TRUST_MODELS/


	/*
	* Display a menu to change the ownertrust of the key PK (which should
	* be a primary key).
	* For mode values see do_edit_ownertrust ()
	*/
	#ifndef NO_TRUST_MODELS
	int
	edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode )
	{
	unsigned int trust = 0;
	int no_help = 0;

	for(;;)
	{
	switch ( do_edit_ownertrust (ctrl, pk, mode, &trust, no_help ) )
	{
	case -1: /* quit */
	return -1;
	case -2: /* show info */
	no_help = 1;
	break;
	case 1: /* trust value set */
	trust &= ~TRUST_FLAG_DISABLED;
	trust \|= get_ownertrust (ctrl, pk) & TRUST_FLAG_DISABLED;
	update_ownertrust (ctrl, pk, trust );
	return 1;
	default:
	return 0;
	}
	}
	}
	#endif /!NO_TRUST_MODELS/


	/****************
	* Check whether we can trust this pk which has a trustlevel of TRUSTLEVEL
	* Returns: true if we trust.
	*/
	static int
	do_we_trust( PKT_public_key *pk, unsigned int trustlevel )
	{
	/* We should not be able to get here with a revoked or expired
	key */
	if(trustlevel & TRUST_FLAG_REVOKED
	\|\| trustlevel & TRUST_FLAG_SUB_REVOKED
	\|\| (trustlevel & TRUST_MASK) == TRUST_EXPIRED)
	BUG();

	if( opt.trust_model==TM_ALWAYS )
	{
	if( opt.verbose )
	log_info("No trust check due to '--trust-model always' option\n");
	return 1;
	}

	switch(trustlevel & TRUST_MASK)
	{
	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	log_info(_("%s: There is no assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 0; /* no */

	case TRUST_MARGINAL:
	log_info(_("%s: There is limited assurance this key belongs"
	" to the named user\n"),keystr_from_pk(pk));
	return 1; /* yes */

	case TRUST_FULLY:
	if( opt.verbose )
	log_info(_("This key probably belongs to the named user\n"));
	return 1; /* yes */

	case TRUST_ULTIMATE:
	if( opt.verbose )
	log_info(_("This key belongs to us\n"));
	return 1; /* yes */

	case TRUST_NEVER:
	/* This can be returned by TOFU, which can return negative
	assertions. */
	log_info(_("%s: This key is bad! It has been marked as untrusted!\n"),
	keystr_from_pk(pk));
	return 0; /* no */
	}

	return 1; /NOTREACHED/
	}


	/****************
	* wrapper around do_we_trust, so we can ask whether to use the
	* key anyway.
	*/
	static int
	do_we_trust_pre (ctrl_t ctrl, PKT_public_key *pk, unsigned int trustlevel )
	{
	int rc;

	rc = do_we_trust( pk, trustlevel );

	if( !opt.batch && !rc )
	{
	print_key_info (ctrl, NULL, 0, pk, 0);
	print_fingerprint (ctrl, NULL, pk, 2);
	tty_printf("\n");

	if ((trustlevel & TRUST_MASK) == TRUST_NEVER)
	tty_printf(
	_("This key is bad! It has been marked as untrusted! If you\n"
	"really know what you are doing, you may answer the next\n"
	"question with yes.\n"));
	else
	tty_printf(
	_("It is NOT certain that the key belongs to the person named\n"
	"in the user ID. If you really know what you are doing,\n"
	"you may answer the next question with yes.\n"));

	tty_printf("\n");


	if (is_status_enabled ())
	{
	u32 kid[2];
	char *hint_str;

	keyid_from_pk (pk, kid);
	hint_str = get_long_user_id_string (ctrl, kid);
	write_status_text ( STATUS_USERID_HINT, hint_str );
	xfree (hint_str);
	}

	if( cpr_get_answer_is_yes("untrusted_key.override",
	_("Use this key anyway? (y/N) ")) )
	rc = 1;

	/* Hmmm: Should we set a flag to tell the user about
	* his decision the next time he encrypts for this recipient?
	*/
	}

	return rc;
	}


	/* Write a TRUST_foo status line inclduing the validation model. */
	static void
	write_trust_status (int statuscode, int trustlevel)
	{
	#ifdef NO_TRUST_MODELS
	write_status (statuscode);
	#else /* NO_TRUST_MODELS */
	int tm;

	/* For the combined tofu+pgp method, we return the trust model which
	* was responsible for the trustlevel. */
	if (opt.trust_model == TM_TOFU_PGP)
	tm = (trustlevel & TRUST_FLAG_TOFU_BASED)? TM_TOFU : TM_PGP;
	else
	tm = opt.trust_model;
	write_status_strings (statuscode, "0 ", trust_model_string (tm), NULL);
	#endif /* NO_TRUST_MODELS */
	}


	/****************
	* Check whether we can trust this signature.
	* Returns an error code if we should not trust this signature.
	*/
	int
	check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
	{
	PKT_public_key pk = xmalloc_clear( sizeof pk );
	unsigned int trustlevel = TRUST_UNKNOWN;
	int rc=0;

	- rc = get_pubkey_for_sig (ctrl, pk, sig);
	+ rc = get_pubkey_for_sig (ctrl, pk, sig, NULL);
	if (rc)
	{ /* this should not happen */
	log_error("Ooops; the key vanished - can't check the trust\n");
	rc = GPG_ERR_NO_PUBKEY;
	goto leave;
	}

	if ( opt.trust_model==TM_ALWAYS )
	{
	if( !opt.quiet )
	log_info(_("WARNING: Using untrusted key!\n"));
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	goto leave;
	}

	if(pk->flags.maybe_revoked && !pk->flags.revoked)
	log_info(_("WARNING: this key might be revoked (revocation key"
	" not present)\n"));

	trustlevel = get_validity (ctrl, NULL, pk, NULL, sig, 1);

	if ( (trustlevel & TRUST_FLAG_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	if(pk->flags.revoked == 2)
	log_info(_("WARNING: This key has been revoked by its"
	" designated revoker!\n"));
	else
	log_info(_("WARNING: This key has been revoked by its owner!\n"));
	log_info(_(" This could mean that the signature is forged.\n"));
	show_revocation_reason (ctrl, pk, 0);
	}
	else if ((trustlevel & TRUST_FLAG_SUB_REVOKED) )
	{
	write_status( STATUS_KEYREVOKED );
	log_info(_("WARNING: This subkey has been revoked by its owner!\n"));
	show_revocation_reason (ctrl, pk, 0);
	}

	if ((trustlevel & TRUST_FLAG_DISABLED))
	log_info (_("Note: This key has been disabled.\n"));

	/* If we have PKA information adjust the trustlevel. */
	if (sig->pka_info && sig->pka_info->valid)
	{
	unsigned char fpr[MAX_FINGERPRINT_LEN];
	PKT_public_key *primary_pk;
	size_t fprlen;
	int okay;


	primary_pk = xmalloc_clear (sizeof *primary_pk);
	get_pubkey (ctrl, primary_pk, pk->main_keyid);
	fingerprint_from_pk (primary_pk, fpr, &fprlen);
	free_public_key (primary_pk);

	if ( fprlen == 20 && !memcmp (sig->pka_info->fpr, fpr, 20) )
	{
	okay = 1;
	write_status_text (STATUS_PKA_TRUST_GOOD, sig->pka_info->email);
	log_info (_("Note: Verified signer's address is '%s'\n"),
	sig->pka_info->email);
	}
	else
	{
	okay = 0;
	write_status_text (STATUS_PKA_TRUST_BAD, sig->pka_info->email);
	log_info (_("Note: Signer's address '%s' "
	"does not match DNS entry\n"), sig->pka_info->email);
	}

	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	case TRUST_MARGINAL:
	if (okay && opt.verify_options&VERIFY_PKA_TRUST_INCREASE)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_FULLY);
	log_info (_("trustlevel adjusted to FULL"
	" due to valid PKA info\n"));
	}
	/* fall through */
	case TRUST_FULLY:
	if (!okay)
	{
	trustlevel = ((trustlevel & ~TRUST_MASK) \| TRUST_NEVER);
	log_info (_("trustlevel adjusted to NEVER"
	" due to bad PKA info\n"));
	}
	break;
	}
	}

	/* Now let the user know what up with the trustlevel. */
	switch ( (trustlevel & TRUST_MASK) )
	{
	case TRUST_EXPIRED:
	log_info(_("Note: This key has expired!\n"));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	default:
	log_error ("invalid trustlevel %u returned from validation layer\n",
	trustlevel);
	/* fall through */
	case TRUST_UNKNOWN:
	case TRUST_UNDEFINED:
	write_trust_status (STATUS_TRUST_UNDEFINED, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" a trusted signature!\n"));
	log_info(_(" There is no indication that the "
	"signature belongs to the owner.\n" ));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_NEVER:
	/* This level can be returned by TOFU, which supports negative
	* assertions. */
	write_trust_status (STATUS_TRUST_NEVER, trustlevel);
	log_info(_("WARNING: We do NOT trust this key!\n"));
	log_info(_(" The signature is probably a FORGERY.\n"));
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	break;

	case TRUST_MARGINAL:
	write_trust_status (STATUS_TRUST_MARGINAL, trustlevel);
	log_info(_("WARNING: This key is not certified with"
	" sufficiently trusted signatures!\n"));
	log_info(_(" It is not certain that the"
	" signature belongs to the owner.\n" ));
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_FULLY:
	write_trust_status (STATUS_TRUST_FULLY, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	break;

	case TRUST_ULTIMATE:
	write_trust_status (STATUS_TRUST_ULTIMATE, trustlevel);
	if (opt.with_fingerprint)
	print_fingerprint (ctrl, NULL, pk, 1);
	break;
	}

	leave:
	free_public_key( pk );
	return rc;
	}


	void
	release_pk_list (pk_list_t pk_list)
	{
	PK_LIST pk_rover;

	for ( ; pk_list; pk_list = pk_rover)
	{
	pk_rover = pk_list->next;
	free_public_key ( pk_list->pk );
	xfree ( pk_list );
	}
	}


	static int
	key_present_in_pk_list(PK_LIST pk_list, PKT_public_key *pk)
	{
	for( ; pk_list; pk_list = pk_list->next)
	if (cmp_public_keys(pk_list->pk, pk) == 0)
	return 0;

	return -1;
	}


	/*
	* Return a malloced string with a default recipient if there is any
	* Fixme: We don't distinguish between malloc failure and no-default-recipient.
	*/
	static char *
	default_recipient (ctrl_t ctrl)
	{
	PKT_public_key *pk;
	char *result;

	if (opt.def_recipient)
	return xtrystrdup (opt.def_recipient);

	if (!opt.def_recipient_self)
	return NULL;
	pk = xtrycalloc (1, sizeof *pk );
	if (!pk)
	return NULL;
	if (get_seckey_default (ctrl, pk))
	{
	free_public_key (pk);
	return NULL;
	}
	result = hexfingerprint (pk, NULL, 0);
	free_public_key (pk);
	return result;
	}


	/* Helper for build_pk_list to find and check one key. This helper is
	* also used directly in server mode by the RECIPIENTS command. On
	* success the new key is added to PK_LIST_ADDR. NAME is the user id
	* of the key. USE the requested usage and a set MARK_HIDDEN will
	* mark the key in the updated list as a hidden recipient. If
	* FROM_FILE is true, NAME is not a user ID but the name of a file
	* holding a key. */
	gpg_error_t
	find_and_check_key (ctrl_t ctrl, const char *name, unsigned int use,
	int mark_hidden, int from_file, pk_list_t *pk_list_addr)
	{
	int rc;
	PKT_public_key *pk;
	KBNODE keyblock = NULL;

	if (!name \|\| !*name)
	return gpg_error (GPG_ERR_INV_USER_ID);

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	return gpg_error_from_syserror ();
	pk->req_usage = use;

	if (from_file)
	rc = get_pubkey_fromfile (ctrl, pk, name);
	else
	rc = get_best_pubkey_byname (ctrl, GET_PUBKEY_NORMAL,
	NULL, pk, name, &keyblock, 0);
	if (rc)
	{
	int code;

	/* Key not found or other error. */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	switch (gpg_err_code (rc))
	{
	case GPG_ERR_NO_SECKEY:
	case GPG_ERR_NO_PUBKEY: code = 1; break;
	case GPG_ERR_INV_USER_ID: code = 14; break;
	default: code = 0; break;
	}
	send_status_inv_recp (code, name);
	free_public_key (pk);
	return rc;
	}

	rc = openpgp_pk_test_algo2 (pk->pubkey_algo, use);
	if (rc)
	{
	/* Key found but not usable for us (e.g. sign-only key). */
	release_kbnode (keyblock);
	send_status_inv_recp (3, name); /* Wrong key usage */
	log_error (_("%s: skipped: %s\n"), name, gpg_strerror (rc) );
	free_public_key (pk);
	return rc;
	}

	/* Key found and usable. Check validity. */
	if (!from_file)
	{
	int trustlevel;

	trustlevel = get_validity (ctrl, keyblock, pk, pk->user_id, NULL, 1);
	release_kbnode (keyblock);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	/* Key has been disabled. */
	send_status_inv_recp (13, name);
	log_info (_("%s: skipped: public key is disabled\n"), name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}

	if ( !do_we_trust_pre (ctrl, pk, trustlevel) )
	{
	/* We don't trust this key. */
	send_status_inv_recp (10, name);
	free_public_key (pk);
	return GPG_ERR_UNUSABLE_PUBKEY;
	}
	}

	/* Skip the actual key if the key is already present in the
	list. */
	if (!key_present_in_pk_list (*pk_list_addr, pk))
	{
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"), name);
	free_public_key (pk);
	}
	else
	{
	pk_list_t r;

	r = xtrymalloc (sizeof *r);
	if (!r)
	{
	rc = gpg_error_from_syserror ();
	free_public_key (pk);
	return rc;
	}
	r->pk = pk;
	r->next = *pk_list_addr;
	r->flags = mark_hidden? 1:0;
	*pk_list_addr = r;
	}

	return 0;
	}



	/* This is the central function to collect the keys for recipients.
	* It is thus used to prepare a public key encryption. encrypt-to
	* keys, default keys and the keys for the actual recipients are all
	* collected here. When not in batch mode and no recipient has been
	* passed on the commandline, the function will also ask for
	* recipients.
	*
	* RCPTS is a string list with the recipients; NULL is an allowed
	* value but not very useful. Group expansion is done on these names;
	* they may be in any of the user Id formats we can handle. The flags
	* bits for each string in the string list are used for:
	*
	* - PK_LIST_ENCRYPT_TO :: This is an encrypt-to recipient.
	* - PK_LIST_HIDDEN :: This is a hidden recipient.
	* - PK_LIST_FROM_FILE :: The argument is a file with a key.
	*
	* On success a list of keys is stored at the address RET_PK_LIST; the
	* caller must free this list. On error the value at this address is
	* not changed.
	*/
	int
	build_pk_list (ctrl_t ctrl, strlist_t rcpts, PK_LIST *ret_pk_list)
	{
	PK_LIST pk_list = NULL;
	PKT_public_key *pk=NULL;
	int rc=0;
	int any_recipients=0;
	strlist_t rov,remusr;
	char *def_rec = NULL;
	char pkstrbuf[PUBKEY_STRING_SIZE];

	/* Try to expand groups if any have been defined. */
	if (opt.grouplist)
	remusr = expand_group (rcpts, 0);
	else
	remusr = rcpts;

	/* XXX: Change this function to use get_pubkeys instead of
	get_pubkey_byname to detect ambiguous key specifications and warn
	about duplicate keyblocks. For ambiguous key specifications on
	the command line or provided interactively, prompt the user to
	select the best key. If a key specification is ambiguous and we
	are in batch mode, die. */

	if (opt.encrypt_to_default_key)
	{
	static int warned;

	const char *default_key = parse_def_secret_key (ctrl);
	if (default_key)
	{
	PK_LIST r = xmalloc_clear (sizeof *r);

	r->pk = xmalloc_clear (sizeof *r->pk);
	r->pk->req_usage = PUBKEY_USAGE_ENC;

	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, r->pk, default_key, NULL, NULL, 0);
	if (rc)
	{
	xfree (r->pk);
	xfree (r);

	log_error (_("can't encrypt to '%s'\n"), default_key);
	if (!opt.quiet)
	log_info (_("(check argument of option '%s')\n"),
	"--default-key");
	}
	else
	{
	r->next = pk_list;
	r->flags = 0;
	pk_list = r;
	}
	}
	else if (opt.def_secret_key)
	{
	if (! warned)
	log_info (_("option '%s' given, but no valid default keys given\n"),
	"--encrypt-to-default-key");
	warned = 1;
	}
	else
	{
	if (! warned)
	log_info (_("option '%s' given, but option '%s' not given\n"),
	"--encrypt-to-default-key", "--default-key");
	warned = 1;
	}
	}

	/* Check whether there are any recipients in the list and build the
	* list of the encrypt-to ones (we always trust them). */
	for ( rov = remusr; rov; rov = rov->next )
	{
	if ( !(rov->flags & PK_LIST_ENCRYPT_TO) )
	{
	/* This is a regular recipient; i.e. not an encrypt-to
	one. */
	any_recipients = 1;

	/* Hidden recipients are not allowed while in PGP mode,
	issue a warning and switch into GnuPG mode. */
	if ((rov->flags & PK_LIST_HIDDEN) && (PGP7 \|\| PGP8))
	{
	log_info(_("option '%s' may not be used in %s mode\n"),
	"--hidden-recipient",
	gnupg_compliance_option_string (opt.compliance));

	compliance_failure();
	}
	}
	else if (!opt.no_encrypt_to)
	{
	/* --encrypt-to has not been disabled. Check this
	encrypt-to key. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* We explicitly allow encrypt-to to an disabled key; thus
	we pass 1 for the second last argument and 1 as the last
	argument to disable AKL. */
	if ((rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, pk, rov->d, NULL, NULL, 1)))
	{
	free_public_key ( pk ); pk = NULL;
	log_error (_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (0, rov->d);
	goto fail;
	}
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Skip the actual key if the key is already present
	* in the list. Add it to our list if not. */
	if (key_present_in_pk_list(pk_list, pk) == 0)
	{
	free_public_key (pk); pk = NULL;
	if (!opt.quiet)
	log_info (_("%s: skipped: public key already present\n"),
	rov->d);
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = (rov->flags&PK_LIST_HIDDEN)?1:0;
	pk_list = r;

	/* Hidden encrypt-to recipients are not allowed while
	in PGP mode, issue a warning and switch into
	GnuPG mode. */
	if ((r->flags&PK_LIST_ENCRYPT_TO) && (PGP7 \|\| PGP8))
	{
	log_info(_("option '%s' may not be used in %s mode\n"),
	"--hidden-encrypt-to",
	gnupg_compliance_option_string (opt.compliance));

	compliance_failure();
	}
	}
	}
	else
	{
	/* The public key is not usable for encryption. */
	free_public_key( pk ); pk = NULL;
	log_error(_("%s: skipped: %s\n"), rov->d, gpg_strerror (rc) );
	send_status_inv_recp (3, rov->d); /* Wrong key usage */
	goto fail;
	}
	}
	}

	/* If we don't have any recipients yet and we are not in batch mode
	drop into interactive selection mode. */
	if ( !any_recipients && !opt.batch )
	{
	int have_def_rec;
	char *answer = NULL;
	strlist_t backlog = NULL;

	if (pk_list)
	any_recipients = 1;
	def_rec = default_recipient(ctrl);
	have_def_rec = !!def_rec;
	if ( !have_def_rec )
	tty_printf(_("You did not specify a user ID. (you may use \"-r\")\n"));

	for (;;)
	{
	rc = 0;
	xfree(answer);
	if ( have_def_rec )
	{
	/* A default recipient is taken as the first entry. */
	answer = def_rec;
	def_rec = NULL;
	}
	else if (backlog)
	{
	/* This is part of our trick to expand and display groups. */
	answer = strlist_pop (&backlog);
	}
	else
	{
	/* Show the list of already collected recipients and ask
	for more. */
	PK_LIST iter;

	tty_printf("\n");
	tty_printf(_("Current recipients:\n"));
	for (iter=pk_list;iter;iter=iter->next)
	{
	u32 keyid[2];

	keyid_from_pk(iter->pk,keyid);
	tty_printf ("%s/%s %s \"",
	pubkey_string (iter->pk,
	pkstrbuf, sizeof pkstrbuf),
	keystr(keyid),
	datestr_from_pk (iter->pk));

	if (iter->pk->user_id)
	tty_print_utf8_string(iter->pk->user_id->name,
	iter->pk->user_id->len);
	else
	{
	size_t n;
	char *p = get_user_id (ctrl, keyid, &n, NULL);
	tty_print_utf8_string ( p, n );
	xfree(p);
	}
	tty_printf("\"\n");
	}

	answer = cpr_get_utf8("pklist.user_id.enter",
	_("\nEnter the user ID. "
	"End with an empty line: "));
	trim_spaces(answer);
	cpr_kill_prompt();
	}

	if ( !answer \|\| !*answer )
	{
	xfree(answer);
	break; /* No more recipients entered - get out of loop. */
	}

	/* Do group expand here too. The trick here is to continue
	the loop if any expansion occurred. The code above will
	then list all expanded keys. */
	if (expand_id(answer,&backlog,0))
	continue;

	/* Get and check key for the current name. */
	free_public_key (pk);
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;
	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NORMAL,
	NULL, pk, answer, NULL, NULL, 0);
	if (rc)
	tty_printf(_("No such user ID.\n"));
	else if ( !(rc=openpgp_pk_test_algo2 (pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	if ( have_def_rec )
	{
	/* No validation for a default recipient. */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info (_("skipped: public key "
	"already set as default recipient\n") );
	}
	else
	{
	PK_LIST r = xmalloc (sizeof *r);
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	else
	{ /* Check validity of this key. */
	int trustlevel;

	trustlevel =
	get_validity (ctrl, NULL, pk, pk->user_id, NULL, 1);
	if ( (trustlevel & TRUST_FLAG_DISABLED) )
	{
	tty_printf (_("Public key is disabled.\n") );
	}
	else if ( do_we_trust_pre (ctrl, pk, trustlevel) )
	{
	/* Skip the actual key if the key is already
	* present in the list */
	if (!key_present_in_pk_list(pk_list, pk))
	{
	free_public_key (pk);
	pk = NULL;
	log_info(_("skipped: public key already set\n") );
	}
	else
	{
	PK_LIST r;
	r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing interactive ids. */
	pk_list = r;
	}
	any_recipients = 1;
	continue;
	}
	}
	}
	xfree(def_rec); def_rec = NULL;
	have_def_rec = 0;
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	}
	else if ( !any_recipients && (def_rec = default_recipient(ctrl)) )
	{
	/* We are in batch mode and have only a default recipient. */
	pk = xmalloc_clear( sizeof *pk );
	pk->req_usage = PUBKEY_USAGE_ENC;

	/* The default recipient is allowed to be disabled; thus pass 1
	as second last argument. We also don't want an AKL. */
	rc = get_pubkey_byname (ctrl, GET_PUBKEY_NO_AKL,
	NULL, pk, def_rec, NULL, NULL, 1);
	if (rc)
	log_error(_("unknown default recipient \"%s\"\n"), def_rec );
	else if ( !(rc=openpgp_pk_test_algo2(pk->pubkey_algo,
	PUBKEY_USAGE_ENC)) )
	{
	/* Mark any_recipients here since the default recipient
	would have been used if it wasn't already there. It
	doesn't really matter if we got this key from the default
	recipient or an encrypt-to. */
	any_recipients = 1;
	if (!key_present_in_pk_list(pk_list, pk))
	log_info (_("skipped: public key already set "
	"as default recipient\n"));
	else
	{
	PK_LIST r = xmalloc( sizeof *r );
	r->pk = pk; pk = NULL;
	r->next = pk_list;
	r->flags = 0; /* No throwing default ids. */
	pk_list = r;
	}
	}
	if ( pk )
	{
	free_public_key( pk );
	pk = NULL;
	}
	xfree(def_rec); def_rec = NULL;
	}
	else
	{
	/* General case: Check all keys. */
	any_recipients = 0;
	for (; remusr; remusr = remusr->next )
	{
	if ( (remusr->flags & PK_LIST_ENCRYPT_TO) )
	continue; /* encrypt-to keys are already handled. */

	rc = find_and_check_key (ctrl, remusr->d, PUBKEY_USAGE_ENC,
	!!(remusr->flags&PK_LIST_HIDDEN),
	!!(remusr->flags&PK_LIST_FROM_FILE),
	&pk_list);
	if (rc)
	goto fail;
	any_recipients = 1;
	}
	}

	if ( !rc && !any_recipients )
	{
	log_error(_("no valid addressees\n"));
	write_status_text (STATUS_NO_RECP, "0");
	rc = GPG_ERR_NO_USER_ID;
	}

	#ifdef USE_TOFU
	if (! rc && (opt.trust_model == TM_TOFU_PGP \|\| opt.trust_model == TM_TOFU))
	{
	PK_LIST iter;
	for (iter = pk_list; iter; iter = iter->next)
	{
	int rc2;

	/* Note: we already resolved any conflict when looking up
	the key. Don't annoy the user again if she selected
	accept once. */
	rc2 = tofu_register_encryption (ctrl, iter->pk, NULL, 0);
	if (rc2)
	log_info ("WARNING: Failed to register encryption to %s"
	" with TOFU engine\n",
	keystr (pk_main_keyid (iter->pk)));
	else if (DBG_TRUST)
	log_debug ("Registered encryption to %s with TOFU DB.\n",
	keystr (pk_main_keyid (iter->pk)));
	}
	}
	#endif /USE_TOFU/

	fail:

	if ( rc )
	release_pk_list( pk_list );
	else
	*ret_pk_list = pk_list;
	if (opt.grouplist)
	free_strlist(remusr);
	return rc;
	}


	/* In pgp6 mode, disallow all ciphers except IDEA (1), 3DES (2), and
	CAST5 (3), all hashes except MD5 (1), SHA1 (2), and RIPEMD160 (3),
	and all compressions except none (0) and ZIP (1). pgp7 and pgp8
	mode expands the cipher list to include AES128 (7), AES192 (8),
	AES256 (9), and TWOFISH (10). pgp8 adds the SHA-256 hash (8). For
	a true PGP key all of this is unneeded as they are the only items
	present in the preferences subpacket, but checking here covers the
	weird case of encrypting to a key that had preferences from a
	different implementation which was then used with PGP. I am not
	completely comfortable with this as the right thing to do, as it
	slightly alters the list of what the user is supposedly requesting.
	It is not against the RFC however, as the preference chosen will
	never be one that the user didn't specify somewhere ("The
	implementation may use any mechanism to pick an algorithm in the
	intersection"), and PGP has no mechanism to fix such a broken
	preference list, so I'm including it. -dms */

	int
	algo_available( preftype_t preftype, int algo, const union pref_hint *hint)
	{
	if( preftype == PREFTYPE_SYM )
	{
	if(PGP7 && (algo != CIPHER_ALGO_IDEA
	&& algo != CIPHER_ALGO_3DES
	&& algo != CIPHER_ALGO_CAST5
	&& algo != CIPHER_ALGO_AES
	&& algo != CIPHER_ALGO_AES192
	&& algo != CIPHER_ALGO_AES256
	&& algo != CIPHER_ALGO_TWOFISH))
	return 0;

	/* PGP8 supports all the ciphers we do.. */

	return algo && !openpgp_cipher_test_algo ( algo );
	}
	else if( preftype == PREFTYPE_HASH )
	{
	if (hint && hint->digest_length)
	{
	if (hint->digest_length!=20 \|\| opt.flags.dsa2)
	{
	/* If --enable-dsa2 is set or the hash isn't 160 bits
	(which implies DSA2), then we'll accept a hash that
	is larger than we need. Otherwise we won't accept
	any hash that isn't exactly the right size. */
	if (hint->digest_length > gcry_md_get_algo_dlen (algo))
	return 0;
	}
	else if (hint->digest_length != gcry_md_get_algo_dlen (algo))
	return 0;
	}

	if (PGP7 && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160))
	return 0;


	if(PGP8 && (algo != DIGEST_ALGO_MD5
	&& algo != DIGEST_ALGO_SHA1
	&& algo != DIGEST_ALGO_RMD160
	&& algo != DIGEST_ALGO_SHA256))
	return 0;

	return algo && !openpgp_md_test_algo (algo);
	}
	else if( preftype == PREFTYPE_ZIP )
	{
	if (PGP7 && (algo != COMPRESS_ALGO_NONE
	&& algo != COMPRESS_ALGO_ZIP))
	return 0;

	/* PGP8 supports all the compression algos we do */

	return !check_compress_algo( algo );
	}
	else
	return 0;
	}

	/****************
	* Return -1 if we could not find an algorithm.
	*/
	int
	select_algo_from_prefs(PK_LIST pk_list, int preftype,
	int request, const union pref_hint *hint)
	{
	PK_LIST pkr;
	u32 bits[8];
	const prefitem_t *prefs;
	int result=-1,i;
	u16 scores[256];

	if( !pk_list )
	return -1;

	memset(bits,0xFF,sizeof(bits));
	memset(scores,0,sizeof(scores));

	for( pkr = pk_list; pkr; pkr = pkr->next )
	{
	u32 mask[8];
	int rank=1,implicit=-1;

	memset(mask,0,sizeof(mask));

	switch(preftype)
	{
	case PREFTYPE_SYM:
	/* IDEA is implicitly there for v3 keys with v3 selfsigs if
	--pgp2 mode is on. This was a 2440 thing that was
	dropped from 4880 but is still relevant to GPG's 1991
	support. All this doesn't mean IDEA is actually
	available, of course. */
	implicit=CIPHER_ALGO_3DES;
	break;

	case PREFTYPE_AEAD:
	/* No implicit algo. */
	break;

	case PREFTYPE_HASH:
	/* While I am including this code for completeness, note
	that currently --pgp2 mode locks the hash at MD5, so this
	code will never even be called. Even if the hash wasn't
	locked at MD5, we don't support sign+encrypt in --pgp2
	mode, and that's the only time PREFTYPE_HASH is used
	anyway. -dms */

	implicit=DIGEST_ALGO_SHA1;

	break;

	case PREFTYPE_ZIP:
	/* Uncompressed is always an option. */
	implicit=COMPRESS_ALGO_NONE;
	}

	if (pkr->pk->user_id) /* selected by user ID */
	prefs = pkr->pk->user_id->prefs;
	else
	prefs = pkr->pk->prefs;

	if( prefs )
	{
	for (i=0; prefs[i].type; i++ )
	{
	if( prefs[i].type == preftype )
	{
	/* Make sure all scores don't add up past 0xFFFF
	(and roll around) */
	if(rank+scores[prefs[i].value]<=0xFFFF)
	scores[prefs[i].value]+=rank;
	else
	scores[prefs[i].value]=0xFFFF;

	mask[prefs[i].value/32] \|= 1<<(prefs[i].value%32);

	rank++;

	/* We saw the implicit algorithm, so we don't need
	tack it on the end ourselves. */
	if(implicit==prefs[i].value)
	implicit=-1;
	}
	}
	}

	if(rank==1 && preftype==PREFTYPE_ZIP)
	{
	/* If the compression preferences are not present, they are
	assumed to be ZIP, Uncompressed (RFC4880:13.3.1) */
	scores[1]=1; /* ZIP is first choice */
	scores[0]=2; /* Uncompressed is second choice */
	mask[0]\|=3;
	}

	/* If the key didn't have the implicit algorithm listed
	explicitly, add it here at the tail of the list. */
	if(implicit>-1)
	{
	scores[implicit]+=rank;
	mask[implicit/32] \|= 1<<(implicit%32);
	}

	for(i=0;i<8;i++)
	bits[i]&=mask[i];
	}

	/* We've now scored all of the algorithms, and the usable ones have
	bits set. Let's pick the winner. */

	/* The caller passed us a request. Can we use it? */
	if(request>-1 && (bits[request/32] & (1<<(request%32))) &&
	algo_available(preftype,request,hint))
	result=request;

	if(result==-1)
	{
	/* If we have personal prefs set, use them. */
	prefs=NULL;
	if(preftype==PREFTYPE_SYM && opt.personal_cipher_prefs)
	prefs=opt.personal_cipher_prefs;
	else if(preftype==PREFTYPE_AEAD && opt.personal_aead_prefs)
	prefs=opt.personal_aead_prefs;
	else if(preftype==PREFTYPE_HASH && opt.personal_digest_prefs)
	prefs=opt.personal_digest_prefs;
	else if(preftype==PREFTYPE_ZIP && opt.personal_compress_prefs)
	prefs=opt.personal_compress_prefs;

	if( prefs )
	for(i=0; prefs[i].type; i++ )
	{
	if(bits[prefs[i].value/32] & (1<<(prefs[i].value%32))
	&& algo_available( preftype, prefs[i].value, hint))
	{
	result = prefs[i].value;
	break;
	}
	}
	}

	if(result==-1)
	{
	unsigned int best=-1;

	/* At this point, we have not selected an algorithm due to a
	special request or via personal prefs. Pick the highest
	ranked algorithm (i.e. the one with the lowest score). */

	if(preftype==PREFTYPE_HASH && scores[DIGEST_ALGO_MD5])
	{
	/* "If you are building an authentication system, the recipient
	may specify a preferred signing algorithm. However, the
	signer would be foolish to use a weak algorithm simply
	because the recipient requests it." (RFC4880:14). If any
	other hash algorithm is available, pretend that MD5 isn't.
	Note that if the user intentionally chose MD5 by putting it
	in their personal prefs, then we do what the user said (as we
	never reach this code). */

	for(i=DIGEST_ALGO_MD5+1;i<256;i++)
	if(scores[i])
	{
	scores[DIGEST_ALGO_MD5]=0;
	break;
	}
	}

	for(i=0;i<256;i++)
	{
	/* Note the '<' here. This means in case of a tie, we will
	favor the lower algorithm number. We have a choice
	between the lower number (probably an older algorithm
	with more time in use), or the higher number (probably a
	newer algorithm with less time in use). Older is
	probably safer here, even though the newer algorithms
	tend to be "stronger". */
	if(scores[i] && scores[i]<best
	&& (bits[i/32] & (1<<(i%32)))
	&& algo_available(preftype,i,hint))
	{
	best=scores[i];
	result=i;
	}
	}
	}

	return result;
	}

	/*
	* Select the MDC flag from the pk_list. We can only use MDC if all
	* recipients support this feature.
	*/
	int
	select_mdc_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	if ( !pk_list )
	return 0;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.mdc;
	else
	mdc = pkr->pk->flags.mdc;
	if (!mdc)
	return 0; /* At least one recipient does not support it. */
	}
	return 1; /* Can be used. */
	}


	/* Select the AEAD flag from the pk_list. We can only use AEAD if all
	* recipients support this feature. Returns the AEAD to be used or 0
	* if AEAD shall not be used. */
	aead_algo_t
	select_aead_from_pklist (PK_LIST pk_list)
	{
	pk_list_t pkr;
	int aead;

	if (!pk_list)
	return 0;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	if (pkr->pk->user_id) /* selected by user ID */
	aead = pkr->pk->user_id->flags.aead;
	else
	aead = pkr->pk->flags.aead;
	if (!aead)
	return 0; /* At least one recipient does not support it. */
	}

	return default_aead_algo (); /* Yes, AEAD can be used. */
	}


	/* Print a warning for all keys in PK_LIST missing the AEAD feature
	* flag or AEAD algorithms. */
	void
	warn_missing_aead_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	int mdc;

	if (pkr->pk->user_id) /* selected by user ID */
	mdc = pkr->pk->user_id->flags.aead;
	else
	mdc = pkr->pk->flags.aead;
	if (!mdc)
	log_info (_("Note: key %s has no %s feature\n"),
	keystr_from_pk (pkr->pk), "AEAD");
	}
	}

	void
	warn_missing_aes_from_pklist (PK_LIST pk_list)
	{
	PK_LIST pkr;

	for (pkr = pk_list; pkr; pkr = pkr->next)
	{
	const prefitem_t *prefs;
	int i;
	int gotit = 0;

	prefs = pkr->pk->user_id? pkr->pk->user_id->prefs : pkr->pk->prefs;
	if (prefs)
	{
	for (i=0; !gotit && prefs[i].type; i++ )
	if (prefs[i].type == PREFTYPE_SYM
	&& prefs[i].value == CIPHER_ALGO_AES)
	gotit++;
	}
	if (!gotit)
	log_info (_("Note: key %s has no preference for %s\n"),
	keystr_from_pk (pkr->pk), "AES");
	}
	}
	diff --git a/g10/sig-check.c b/g10/sig-check.c
	index 8a46f7653..e622d9883 100644
	--- a/g10/sig-check.c
	+++ b/g10/sig-check.c
	@@ -1,1251 +1,1256 @@
	/* sig-check.c - Check a signature
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003,
	* 2004, 2006 Free Software Foundation, Inc.
	* Copyright (C) 2015, 2016 g10 Code GmbH
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "keydb.h"
	#include "main.h"
	#include "../common/status.h"
	#include "../common/i18n.h"
	#include "options.h"
	#include "pkglue.h"
	#include "../common/compliance.h"

	static int check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	const void *extrahash, size_t extrahashlen,
	int r_expired, int r_revoked,
	PKT_public_key *ret_pk);

	static int check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	const void *extrahash,
	size_t extrahashlen);


	/* Statistics for signature verification. */
	struct
	{
	unsigned int total; /* Total number of verifications. */
	unsigned int cached; /* Number of seen cache entries. */
	unsigned int goodsig;/* Number of good verifications from the cache. */
	unsigned int badsig; /* Number of bad verifications from the cache. */
	} cache_stats;


	/* Dump verification stats. */
	void
	sig_check_dump_stats (void)
	{
	log_info ("sig_cache: total=%u cached=%u good=%u bad=%u\n",
	cache_stats.total, cache_stats.cached,
	cache_stats.goodsig, cache_stats.badsig);
	}


	/* Check a signature. This is shorthand for check_signature2 with
	the unnamed arguments passed as NULL. */
	int
	check_signature (ctrl_t ctrl, PKT_signature *sig, gcry_md_hd_t digest)
	{
	- return check_signature2 (ctrl, sig, digest, NULL, 0, NULL, NULL, NULL, NULL);
	+ return check_signature2 (ctrl, sig, digest, NULL, 0, NULL,
	+ NULL, NULL, NULL, NULL);
	}


	/* Check a signature.
	*
	* Looks up the public key that created the signature (SIG->KEYID)
	* from the key db. Makes sure that the signature is valid (it was
	* not created prior to the key, the public key was created in the
	* past, and the signature does not include any unsupported critical
	* features), finishes computing the hash of the signature data, and
	* checks that the signature verifies the digest. If the key that
	* generated the signature is a subkey, this function also verifies
	* that there is a valid backsig from the subkey to the primary key.
	* Finally, if status fd is enabled and the signature class is 0x00 or
	* 0x01, then a STATUS_SIG_ID is emitted on the status fd.
	*
	* SIG is the signature to check.
	*
	* DIGEST contains a valid hash context that already includes the
	* signed data. This function adds the relevant meta-data from the
	* signature packet to compute the final hash. (See Section 5.2 of
	* RFC 4880: "The concatenation of the data being signed and the
	* signature data from the version number through the hashed subpacket
	* data (inclusive) is hashed.")
	*
	* EXTRAHASH and EXTRAHASHLEN is additional data which is hashed with
	* v5 signatures. They may be NULL to use the default.
	*
	+ * If FORCED_PK is not NULL this public key is used to verify the
	+ * signature and no other public key is looked up.
	+ *
	* If R_EXPIREDATE is not NULL, R_EXPIREDATE is set to the key's
	* expiry.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	* If R_PK is not NULL, the public key is stored at that address if it
	* was found; other wise NULL is stored.
	*
	* Returns 0 on success. An error code otherwise. */
	gpg_error_t
	check_signature2 (ctrl_t ctrl,
	PKT_signature *sig, gcry_md_hd_t digest,
	const void *extrahash, size_t extrahashlen,
	+ PKT_public_key *forced_pk,
	u32 *r_expiredate,
	int r_expired, int r_revoked, PKT_public_key **r_pk)
	{
	int rc=0;
	PKT_public_key *pk;

	if (r_expiredate)
	*r_expiredate = 0;
	if (r_expired)
	*r_expired = 0;
	if (r_revoked)
	*r_revoked = 0;
	if (r_pk)
	*r_pk = NULL;

	pk = xtrycalloc (1, sizeof *pk);
	if (!pk)
	return gpg_error_from_syserror ();

	if ((rc=openpgp_md_test_algo(sig->digest_algo)))
	{
	/* We don't have this digest. */
	}
	else if (!gnupg_digest_is_allowed (opt.compliance, 0, sig->digest_algo))
	{
	/* Compliance failure. */
	log_info (_("digest algorithm '%s' may not be used in %s mode\n"),
	gcry_md_algo_name (sig->digest_algo),
	gnupg_compliance_option_string (opt.compliance));
	rc = gpg_error (GPG_ERR_DIGEST_ALGO);
	}
	else if ((rc=openpgp_pk_test_algo(sig->pubkey_algo)))
	{
	/* We don't have this pubkey algo. */
	}
	else if (!gcry_md_is_enabled (digest,sig->digest_algo))
	{
	/* Sanity check that the md has a context for the hash that the
	* sig is expecting. This can happen if a onepass sig header
	* does not match the actual sig, and also if the clearsign
	* "Hash:" header is missing or does not match the actual sig. */
	log_info(_("WARNING: signature digest conflict in message\n"));
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	- else if (get_pubkey_for_sig (ctrl, pk, sig))
	+ else if (get_pubkey_for_sig (ctrl, pk, sig, forced_pk))
	rc = gpg_error (GPG_ERR_NO_PUBKEY);
	else if (!gnupg_pk_is_allowed (opt.compliance, PK_USE_VERIFICATION,
	pk->pubkey_algo, pk->pkey,
	nbits_from_pk (pk),
	NULL))
	{
	/* Compliance failure. */
	log_error (_("key %s may not be used for signing in %s mode\n"),
	keystr_from_pk (pk),
	gnupg_compliance_option_string (opt.compliance));
	rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
	}
	else if (!pk->flags.valid)
	{
	/* You cannot have a good sig from an invalid key. */
	rc = gpg_error (GPG_ERR_BAD_PUBKEY);
	}
	else
	{
	if (r_expiredate)
	*r_expiredate = pk->expiredate;

	rc = check_signature_end (pk, sig, digest, extrahash, extrahashlen,
	r_expired, r_revoked, NULL);

	/* Check the backsig. This is a back signature (0x19) from
	* the subkey on the primary key. The idea here is that it
	* should not be possible for someone to "steal" subkeys and
	* claim them as their own. The attacker couldn't actually
	* use the subkey, but they could try and claim ownership of
	* any signatures issued by it. */
	if (!rc && !pk->flags.primary && pk->flags.backsig < 2)
	{
	if (!pk->flags.backsig)
	{
	log_info (_("WARNING: signing subkey %s is not"
	" cross-certified\n"),keystr_from_pk(pk));
	log_info (_("please see %s for more information\n"),
	"https://gnupg.org/faq/subkey-cross-certify.html");
	/* The default option --require-cross-certification
	* makes this warning an error. */
	if (opt.flags.require_cross_cert)
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	else if(pk->flags.backsig == 1)
	{
	log_info (_("WARNING: signing subkey %s has an invalid"
	" cross-certification\n"), keystr_from_pk(pk));
	rc = gpg_error (GPG_ERR_GENERAL);
	}
	}

	}

	if( !rc && sig->sig_class < 2 && is_status_enabled() ) {
	/* This signature id works best with DLP algorithms because
	* they use a random parameter for every signature. Instead of
	* this sig-id we could have also used the hash of the document
	* and the timestamp, but the drawback of this is, that it is
	* not possible to sign more than one identical document within
	* one second. Some remote batch processing applications might
	* like this feature here.
	*
	* Note that before 2.0.10, we used RIPE-MD160 for the hash
	* and accidentally didn't include the timestamp and algorithm
	* information in the hash. Given that this feature is not
	* commonly used and that a replay attacks detection should
	* not solely be based on this feature (because it does not
	* work with RSA), we take the freedom and switch to SHA-1
	* with 2.0.10 to take advantage of hardware supported SHA-1
	* implementations. We also include the missing information
	* in the hash. Note also the SIG_ID as computed by gpg 1.x
	* and gpg 2.x didn't matched either because 2.x used to print
	* MPIs not in PGP format. */
	u32 a = sig->timestamp;
	int nsig = pubkey_get_nsig( sig->pubkey_algo );
	unsigned char p, buffer;
	size_t n, nbytes;
	int i;
	char hashbuf[20]; /* We use SHA-1 here. */

	nbytes = 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &n, sig->data[i]))
	BUG();
	nbytes += n;
	}

	/* Make buffer large enough to be later used as output buffer. */
	if (nbytes < 100)
	nbytes = 100;
	nbytes += 10; /* Safety margin. */

	/* Fill and hash buffer. */
	buffer = p = xmalloc (nbytes);
	*p++ = sig->pubkey_algo;
	*p++ = sig->digest_algo;
	*p++ = (a >> 24) & 0xff;
	*p++ = (a >> 16) & 0xff;
	*p++ = (a >> 8) & 0xff;
	*p++ = a & 0xff;
	nbytes -= 6;
	for (i=0; i < nsig; i++ )
	{
	if (gcry_mpi_print (GCRYMPI_FMT_PGP, p, nbytes, &n, sig->data[i]))
	BUG();
	p += n;
	nbytes -= n;
	}
	gcry_md_hash_buffer (GCRY_MD_SHA1, hashbuf, buffer, p-buffer);

	p = make_radix64_string (hashbuf, 20);
	sprintf (buffer, "%s %s %lu",
	p, strtimestamp (sig->timestamp), (ulong)sig->timestamp);
	xfree (p);
	write_status_text (STATUS_SIG_ID, buffer);
	xfree (buffer);
	}

	if (r_pk)
	*r_pk = pk;
	else
	{
	release_public_key_parts (pk);
	xfree (pk);
	}

	return rc;
	}


	/* The signature SIG was generated with the public key PK. Check
	* whether the signature is valid in the following sense:
	*
	* - Make sure the public key was created before the signature was
	* generated.
	*
	* - Make sure the public key was created in the past
	*
	* - Check whether PK has expired (set *R_EXPIRED to 1 if so and 0
	* otherwise)
	*
	* - Check whether PK has been revoked (set *R_REVOKED to 1 if so
	* and 0 otherwise).
	*
	* If either of the first two tests fail, returns an error code.
	* Otherwise returns 0. (Thus, this function doesn't fail if the
	* public key is expired or revoked.) */
	static int
	check_signature_metadata_validity (PKT_public_key pk, PKT_signature sig,
	int r_expired, int r_revoked)
	{
	u32 cur_time;

	if (r_expired)
	*r_expired = 0;
	if (r_revoked)
	*r_revoked = 0;

	if (pk->timestamp > sig->timestamp )
	{
	ulong d = pk->timestamp - sig->timestamp;
	if ( d < 86400 )
	{
	log_info (ngettext
	("public key %s is %lu second newer than the signature\n",
	"public key %s is %lu seconds newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info (ngettext
	("public key %s is %lu day newer than the signature\n",
	"public key %s is %lu days newer than the signature\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT; /* pubkey newer than signature. */
	}

	cur_time = make_timestamp ();
	if (pk->timestamp > cur_time)
	{
	ulong d = pk->timestamp - cur_time;
	if (d < 86400)
	{
	log_info (ngettext("key %s was created %lu second"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu seconds"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	else
	{
	d /= 86400;
	log_info (ngettext("key %s was created %lu day"
	" in the future (time warp or clock problem)\n",
	"key %s was created %lu days"
	" in the future (time warp or clock problem)\n",
	d), keystr_from_pk (pk), d);
	}
	if (!opt.ignore_time_conflict)
	return GPG_ERR_TIME_CONFLICT;
	}

	/* Check whether the key has expired. We check the has_expired
	* flag which is set after a full evaluation of the key (getkey.c)
	* as well as a simple compare to the current time in case the
	* merge has for whatever reasons not been done. */
	if (pk->has_expired \|\| (pk->expiredate && pk->expiredate < cur_time))
	{
	char buf[11];
	if (opt.verbose)
	log_info (_("Note: signature key %s expired %s\n"),
	keystr_from_pk(pk), asctimestamp( pk->expiredate ) );
	snprintf (buf, sizeof buf, "%lu",(ulong)pk->expiredate);
	write_status_text (STATUS_KEYEXPIRED, buf);
	if (r_expired)
	*r_expired = 1;
	}

	if (pk->flags.revoked)
	{
	if (opt.verbose)
	log_info (_("Note: signature key %s has been revoked\n"),
	keystr_from_pk(pk));
	if (r_revoked)
	*r_revoked=1;
	}

	return 0;
	}


	/* Finish generating a signature and check it. Concretely: make sure
	* that the signature is valid (it was not created prior to the key,
	* the public key was created in the past, and the signature does not
	* include any unsupported critical features), finish computing the
	* digest by adding the relevant data from the signature packet, and
	* check that the signature verifies the digest.
	*
	* DIGEST contains a hash context, which has already hashed the signed
	* data. This function adds the relevant meta-data from the signature
	* packet to compute the final hash. (See Section 5.2 of RFC 4880:
	* "The concatenation of the data being signed and the signature data
	* from the version number through the hashed subpacket data
	* (inclusive) is hashed.")
	*
	* SIG is the signature to check.
	*
	* PK is the public key used to generate the signature.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has expired
	* (0 otherwise). Note: PK being expired does not cause this function
	* to fail.
	*
	* If R_REVOKED is not NULL, *R_REVOKED is set to 1 if PK has been
	* revoked (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	* If RET_PK is not NULL, PK is copied into RET_PK on success.
	*
	* Returns 0 on success. An error code other. */
	static int
	check_signature_end (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	const void *extrahash, size_t extrahashlen,
	int r_expired, int r_revoked, PKT_public_key *ret_pk)
	{
	int rc = 0;

	if ((rc = check_signature_metadata_validity (pk, sig,
	r_expired, r_revoked)))
	return rc;

	if ((rc = check_signature_end_simple (pk, sig, digest,
	extrahash, extrahashlen)))
	return rc;

	if (!rc && ret_pk)
	copy_public_key(ret_pk,pk);

	return rc;
	}


	/* This function is similar to check_signature_end, but it only checks
	* whether the signature was generated by PK. It does not check
	* expiration, revocation, etc. */
	static int
	check_signature_end_simple (PKT_public_key pk, PKT_signature sig,
	gcry_md_hd_t digest,
	const void *extrahash, size_t extrahashlen)
	{
	gcry_mpi_t result = NULL;
	int rc = 0;
	const struct weakhash *weak;

	if (!opt.flags.allow_weak_digest_algos)
	{
	for (weak = opt.weak_digests; weak; weak = weak->next)
	if (sig->digest_algo == weak->algo)
	{
	print_digest_rejected_note(sig->digest_algo);
	return GPG_ERR_DIGEST_ALGO;
	}
	}

	/* For key signatures check that the key has a cert usage. We may
	* do this only for subkeys because the primary may always issue key
	* signature. The latter may not be reflected in the pubkey_usage
	* field because we need to check the key signatures to extract the
	* key usage. */
	if (!pk->flags.primary
	&& IS_CERT (sig) && !(pk->pubkey_usage & PUBKEY_USAGE_CERT))
	{
	rc = gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	if (!opt.quiet)
	log_info (_("bad key signature from key %s: %s (0x%02x, 0x%x)\n"),
	keystr_from_pk (pk), gpg_strerror (rc),
	sig->sig_class, pk->pubkey_usage);
	return rc;
	}

	/* For data signatures check that the key has sign usage. */
	if (!IS_BACK_SIG (sig) && IS_SIG (sig)
	&& !(pk->pubkey_usage & PUBKEY_USAGE_SIG))
	{
	rc = gpg_error (GPG_ERR_WRONG_KEY_USAGE);
	if (!opt.quiet)
	log_info (_("bad data signature from key %s: %s (0x%02x, 0x%x)\n"),
	keystr_from_pk (pk), gpg_strerror (rc),
	sig->sig_class, pk->pubkey_usage);
	return rc;
	}

	/* Make sure the digest algo is enabled (in case of a detached
	* signature). */
	gcry_md_enable (digest, sig->digest_algo);

	/* Complete the digest. */
	if (sig->version >= 4)
	gcry_md_putc (digest, sig->version);

	gcry_md_putc( digest, sig->sig_class );
	if (sig->version < 4)
	{
	u32 a = sig->timestamp;
	gcry_md_putc (digest, ((a >> 24) & 0xff));
	gcry_md_putc (digest, ((a >> 16) & 0xff));
	gcry_md_putc (digest, ((a >> 8) & 0xff));
	gcry_md_putc (digest, ( a & 0xff));
	}
	else
	{
	byte buf[10];
	int i;
	size_t n;

	gcry_md_putc (digest, sig->pubkey_algo);
	gcry_md_putc (digest, sig->digest_algo);
	if (sig->hashed)
	{
	n = sig->hashed->len;
	gcry_md_putc (digest, (n >> 8) );
	gcry_md_putc (digest, n );
	gcry_md_write (digest, sig->hashed->data, n);
	n += 6;
	}
	else
	{
	/* Two octets for the (empty) length of the hashed
	* section. */
	gcry_md_putc (digest, 0);
	gcry_md_putc (digest, 0);
	n = 6;
	}
	/* Hash data from the literal data packet. */
	if (sig->version >= 5
	&& (sig->sig_class == 0x00 \|\| sig->sig_class == 0x01))
	{
	/* - One octet content format
	* - File name (one octet length followed by the name)
	* - Four octet timestamp */
	if (extrahash && extrahashlen)
	gcry_md_write (digest, extrahash, extrahashlen);
	else /* Detached signature. */
	{
	memset (buf, 0, 6);
	gcry_md_write (digest, buf, 6);
	}
	}
	/* Add some magic per Section 5.2.4 of RFC 4880. */
	i = 0;
	buf[i++] = sig->version;
	buf[i++] = 0xff;
	if (sig->version >= 5)
	{
	#if SIZEOF_SIZE_T > 4
	buf[i++] = n >> 56;
	buf[i++] = n >> 48;
	buf[i++] = n >> 40;
	buf[i++] = n >> 32;
	#else
	buf[i++] = 0;
	buf[i++] = 0;
	buf[i++] = 0;
	buf[i++] = 0;
	#endif
	}
	buf[i++] = n >> 24;
	buf[i++] = n >> 16;
	buf[i++] = n >> 8;
	buf[i++] = n;
	gcry_md_write (digest, buf, i);
	}
	gcry_md_final( digest );

	/* Convert the digest to an MPI. */
	result = encode_md_value (pk, digest, sig->digest_algo );
	if (!result)
	return GPG_ERR_GENERAL;

	/* Verify the signature. */
	if (DBG_CLOCK && sig->sig_class <= 0x01)
	log_clock ("enter pk_verify");
	rc = pk_verify( pk->pubkey_algo, result, sig->data, pk->pkey );
	if (DBG_CLOCK && sig->sig_class <= 0x01)
	log_clock ("leave pk_verify");
	gcry_mpi_release (result);

	if (!rc && sig->flags.unknown_critical)
	{
	log_info(_("assuming bad signature from key %s"
	" due to an unknown critical bit\n"),keystr_from_pk(pk));
	rc = GPG_ERR_BAD_SIGNATURE;
	}

	return rc;
	}


	/* Add a uid node to a hash context. See section 5.2.4, paragraph 4
	* of RFC 4880. */
	static void
	hash_uid_packet (PKT_user_id uid, gcry_md_hd_t md, PKT_signature sig )
	{
	if (uid->attrib_data)
	{
	if (sig->version >= 4)
	{
	byte buf[5];
	buf[0] = 0xd1; /* packet of type 17 */
	buf[1] = uid->attrib_len >> 24; /* always use 4 length bytes */
	buf[2] = uid->attrib_len >> 16;
	buf[3] = uid->attrib_len >> 8;
	buf[4] = uid->attrib_len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->attrib_data, uid->attrib_len );
	}
	else
	{
	if (sig->version >= 4)
	{
	byte buf[5];
	buf[0] = 0xb4; /* indicates a userid packet */
	buf[1] = uid->len >> 24; /* always use 4 length bytes */
	buf[2] = uid->len >> 16;
	buf[3] = uid->len >> 8;
	buf[4] = uid->len;
	gcry_md_write( md, buf, 5 );
	}
	gcry_md_write( md, uid->name, uid->len );
	}
	}

	static void
	cache_sig_result ( PKT_signature *sig, int result )
	{
	if (!result)
	{
	sig->flags.checked = 1;
	sig->flags.valid = 1;
	}
	else if (gpg_err_code (result) == GPG_ERR_BAD_SIGNATURE)
	{
	sig->flags.checked = 1;
	sig->flags.valid = 0;
	}
	else
	{
	sig->flags.checked = 0;
	sig->flags.valid = 0;
	}
	}


	/* SIG is a key revocation signature. Check if this signature was
	* generated by any of the public key PK's designated revokers.
	*
	* PK is the public key that SIG allegedly revokes.
	*
	* SIG is the revocation signature to check.
	*
	* This function avoids infinite recursion, which can happen if two
	* keys are designed revokers for each other and they revoke each
	* other. This is done by observing that if a key A is revoked by key
	* B we still consider the revocation to be valid even if B is
	* revoked. Thus, we don't need to determine whether B is revoked to
	* determine whether A has been revoked by B, we just need to check
	* the signature.
	*
	* Returns 0 if sig is valid (i.e. pk is revoked), non-0 if not
	* revoked. We are careful to make sure that GPG_ERR_NO_PUBKEY is
	* only returned when a revocation signature is from a valid
	* revocation key designated in a revkey subpacket, but the revocation
	* key itself isn't present.
	*
	* XXX: This code will need to be modified if gpg ever becomes
	* multi-threaded. Note that this guarantees that a designated
	* revocation sig will never be considered valid unless it is actually
	* valid, as well as being issued by a revocation key in a valid
	* direct signature. Note also that this is written so that a revoked
	* revoker can still issue revocations: i.e. If A revokes B, but A is
	* revoked, B is still revoked. I'm not completely convinced this is
	* the proper behavior, but it matches how PGP does it. -dms */
	int
	check_revocation_keys (ctrl_t ctrl, PKT_public_key pk, PKT_signature sig)
	{
	static int busy=0;
	int i;
	int rc = GPG_ERR_GENERAL;

	log_assert (IS_KEY_REV(sig));
	log_assert ((sig->keyid[0]!=pk->keyid[0]) \|\| (sig->keyid[0]!=pk->keyid[1]));

	/* Avoid infinite recursion. Consider the following:
	*
	* - We want to check if A is revoked.
	*
	* - C is a designated revoker for B and has revoked B.
	*
	* - B is a designated revoker for A and has revoked A.
	*
	* When checking if A is revoked (in merge_selfsigs_main), we
	* observe that A has a designed revoker. As such, we call this
	* function. This function sees that there is a valid revocation
	* signature, which is signed by B. It then calls check_signature()
	* to verify that the signature is good. To check the sig, we need
	* to lookup B. Looking up B means calling merge_selfsigs_main,
	* which checks whether B is revoked, which calls this function to
	* see if B was revoked by some key.
	*
	* In this case, the added level of indirection doesn't hurt. It
	* just means a bit more work. However, if C == A, then we'd end up
	* in a loop. But, it doesn't make sense to look up C anyways: even
	* if B is revoked, we conservatively consider a valid revocation
	* signed by B to revoke A. Since this is the only place where this
	* type of recursion can occur, we simply cause this function to
	* fail if it is entered recursively. */
	if (busy)
	{
	/* Return an error (i.e. not revoked), but mark the pk as
	uncacheable as we don't really know its revocation status
	until it is checked directly. */
	pk->flags.dont_cache = 1;
	return rc;
	}

	busy=1;

	/* es_printf("looking at %08lX with a sig from %08lX\n",(ulong)pk->keyid[1],
	(ulong)sig->keyid[1]); */

	/* is the issuer of the sig one of our revokers? */
	if( !pk->revkey && pk->numrevkeys )
	BUG();
	else
	for(i=0;i<pk->numrevkeys;i++)
	{
	/* The revoker's keyid. */
	u32 keyid[2];

	keyid_from_fingerprint (ctrl, pk->revkey[i].fpr, pk->revkey[i].fprlen,
	keyid);

	if(keyid[0]==sig->keyid[0] && keyid[1]==sig->keyid[1])
	/* The signature was generated by a designated revoker.
	Verify the signature. */
	{
	gcry_md_hd_t md;

	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();
	hash_public_key(md,pk);
	/* Note: check_signature only checks that the signature
	is good. It does not fail if the key is revoked. */
	rc = check_signature (ctrl, sig, md);
	cache_sig_result(sig,rc);
	gcry_md_close (md);
	break;
	}
	}

	busy=0;

	return rc;
	}

	/* Check that the backsig BACKSIG from the subkey SUB_PK to its
	* primary key MAIN_PK is valid.
	*
	* Backsigs (0x19) have the same format as binding sigs (0x18), but
	* this function is simpler than check_key_signature in a few ways.
	* For example, there is no support for expiring backsigs since it is
	* questionable what such a thing actually means. Note also that the
	* sig cache check here, unlike other sig caches in GnuPG, is not
	* persistent. */
	int
	check_backsig (PKT_public_key main_pk,PKT_public_key sub_pk,
	PKT_signature *backsig)
	{
	gcry_md_hd_t md;
	int rc;

	/* Always check whether the algorithm is available. Although
	gcry_md_open would throw an error, some libgcrypt versions will
	print a debug message in that case too. */
	if ((rc=openpgp_md_test_algo (backsig->digest_algo)))
	return rc;

	if(!opt.no_sig_cache && backsig->flags.checked)
	return backsig->flags.valid? 0 : gpg_error (GPG_ERR_BAD_SIGNATURE);

	rc = gcry_md_open (&md, backsig->digest_algo,0);
	if (!rc)
	{
	hash_public_key(md,main_pk);
	hash_public_key(md,sub_pk);
	rc = check_signature_end (sub_pk, backsig, md, NULL, 0, NULL, NULL, NULL);
	cache_sig_result(backsig,rc);
	gcry_md_close(md);
	}

	return rc;
	}


	/* Check that a signature over a key is valid. This is a
	* specialization of check_key_signature2 with the unnamed parameters
	* passed as NULL. See the documentation for that function for more
	* details. */
	int
	check_key_signature (ctrl_t ctrl, kbnode_t root, kbnode_t node,
	int *is_selfsig)
	{
	return check_key_signature2 (ctrl, root, node, NULL, NULL,
	is_selfsig, NULL, NULL);
	}


	/* Returns whether SIGNER generated the signature SIG over the packet
	* PACKET, which is a key, subkey or uid, and comes from the key block
	* KB. (KB is PACKET's corresponding keyblock; we don't assume that
	* SIG has been added to the keyblock.)
	*
	* If SIGNER is set, then checks whether SIGNER generated the
	* signature. Otherwise, uses SIG->KEYID to find the alleged signer.
	* This parameter can be used to effectively override the alleged
	* signer that is stored in SIG.
	*
	* KB may be NULL if SIGNER is set.
	*
	* Unlike check_key_signature, this function ignores any cached
	* results! That is, it does not consider SIG->FLAGS.CHECKED and
	* SIG->FLAGS.VALID nor does it set them.
	*
	* This doesn't check the signature's semantic mean. Concretely, it
	* doesn't check whether a non-self signed revocation signature was
	* created by a designated revoker. In fact, it doesn't return an
	* error for a binding generated by a completely different key!
	*
	* Returns 0 if the signature is valid. Returns GPG_ERR_SIG_CLASS if
	* this signature can't be over PACKET. Returns GPG_ERR_NOT_FOUND if
	* the key that generated the signature (according to SIG) could not
	* be found. Returns GPG_ERR_BAD_SIGNATURE if the signature is bad.
	* Other errors codes may be returned if something else goes wrong.
	*
	* IF IS_SELFSIG is not NULL, sets *IS_SELFSIG to 1 if this is a
	* self-signature (by the key's primary key) or 0 if not.
	*
	* If RET_PK is not NULL, returns a copy of the public key that
	* generated the signature (i.e., the signer) on success. This must
	* be released by the caller using release_public_key_parts (). */
	gpg_error_t
	check_signature_over_key_or_uid (ctrl_t ctrl, PKT_public_key *signer,
	PKT_signature sig, KBNODE kb, PACKET packet,
	int is_selfsig, PKT_public_key ret_pk)
	{
	int rc;
	PKT_public_key *pripk = kb->pkt->pkt.public_key;
	gcry_md_hd_t md;
	int signer_alloced = 0;
	int stub_is_selfsig;

	if (!is_selfsig)
	is_selfsig = &stub_is_selfsig;

	rc = openpgp_pk_test_algo (sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo (sig->digest_algo);
	if (rc)
	return rc;

	/* A signature's class indicates the type of packet that it
	signs. */
	if (IS_BACK_SIG (sig) \|\| IS_KEY_SIG (sig) \|\| IS_KEY_REV (sig))
	{
	/* Key revocations can only be over primary keys. */
	if (packet->pkttype != PKT_PUBLIC_KEY)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (IS_SUBKEY_SIG (sig) \|\| IS_SUBKEY_REV (sig))
	{
	if (packet->pkttype != PKT_PUBLIC_SUBKEY)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	if (packet->pkttype != PKT_USER_ID)
	return gpg_error (GPG_ERR_SIG_CLASS);
	}
	else
	return gpg_error (GPG_ERR_SIG_CLASS);

	/* PACKET is the right type for SIG. */

	if (signer)
	{
	if (signer->keyid[0] == pripk->keyid[0]
	&& signer->keyid[1] == pripk->keyid[1])
	*is_selfsig = 1;
	else
	*is_selfsig = 0;
	}
	else
	{
	/* Get the signer. If possible, avoid a look up. */
	if (sig->keyid[0] == pripk->keyid[0]
	&& sig->keyid[1] == pripk->keyid[1])
	{
	/* Issued by the primary key. */
	signer = pripk;
	*is_selfsig = 1;
	}
	else
	{
	/* See if one of the subkeys was the signer (although this
	* is extremely unlikely). */
	kbnode_t ctx = NULL;
	kbnode_t n;

	while ((n = walk_kbnode (kb, &ctx, 0)))
	{
	PKT_public_key *subk;

	if (n->pkt->pkttype != PKT_PUBLIC_SUBKEY)
	continue;

	subk = n->pkt->pkt.public_key;
	if (sig->keyid[0] == subk->keyid[0]
	&& sig->keyid[1] == subk->keyid[1])
	{
	/* Issued by a subkey. */
	signer = subk;
	break;
	}
	}

	if (! signer)
	{
	/* Signer by some other key. */
	*is_selfsig = 0;
	if (ret_pk)
	{
	signer = ret_pk;
	/* FIXME: Using memset here is probematic because it
	* assumes that there are no allocated fields in
	* SIGNER. */
	memset (signer, 0, sizeof (*signer));
	signer_alloced = 1;
	}
	else
	{
	signer = xmalloc_clear (sizeof (*signer));
	signer_alloced = 2;
	}

	if (IS_CERT (sig))
	signer->req_usage = PUBKEY_USAGE_CERT;

	- rc = get_pubkey_for_sig (ctrl, signer, sig);
	+ rc = get_pubkey_for_sig (ctrl, signer, sig, NULL);
	if (rc)
	{
	xfree (signer);
	signer = NULL;
	signer_alloced = 0;
	goto leave;
	}
	}
	}
	}

	/* We checked above that we supported this algo, so an error here is
	* a bug. */
	if (gcry_md_open (&md, sig->digest_algo, 0))
	BUG ();

	/* Hash the relevant data. */

	if (IS_KEY_SIG (sig) \|\| IS_KEY_REV (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md, NULL, 0);
	}
	else if (IS_BACK_SIG (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_KEY);
	hash_public_key (md, packet->pkt.public_key);
	hash_public_key (md, signer);
	rc = check_signature_end_simple (signer, sig, md, NULL, 0);
	}
	else if (IS_SUBKEY_SIG (sig) \|\| IS_SUBKEY_REV (sig))
	{
	log_assert (packet->pkttype == PKT_PUBLIC_SUBKEY);
	hash_public_key (md, pripk);
	hash_public_key (md, packet->pkt.public_key);
	rc = check_signature_end_simple (signer, sig, md, NULL, 0);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	log_assert (packet->pkttype == PKT_USER_ID);
	if (sig->digest_algo == DIGEST_ALGO_SHA1 && !*is_selfsig
	&& !opt.flags.allow_weak_key_signatures)
	{
	/* If the signature was created using SHA-1 we consider this
	* signature invalid because it makes it possible to mount a
	* chosen-prefix collision. We don't do this for
	* self-signatures, though. */
	print_sha1_keysig_rejected_note ();
	rc = gpg_error (GPG_ERR_DIGEST_ALGO);
	}
	else
	{
	hash_public_key (md, pripk);
	hash_uid_packet (packet->pkt.user_id, md, sig);
	rc = check_signature_end_simple (signer, sig, md, NULL, 0);
	}
	}
	else
	{
	/* We should never get here. (The first if above should have
	* already caught this error.) */
	BUG ();
	}

	gcry_md_close (md);

	leave:
	if (! rc && ret_pk && ret_pk != signer)
	copy_public_key (ret_pk, signer);

	if (signer_alloced)
	{
	/* We looked up SIGNER; it is not a pointer into KB. */
	release_public_key_parts (signer);
	/* Free if we also allocated the memory. */
	if (signer_alloced == 2)
	xfree (signer);
	}

	return rc;
	}


	/* Check that a signature over a key (e.g., a key revocation, key
	* binding, user id certification, etc.) is valid. If the function
	* detects a self-signature, it uses the public key from the specified
	* key block and does not bother looking up the key specified in the
	* signature packet.
	*
	* ROOT is a keyblock.
	*
	* NODE references a signature packet that appears in the keyblock
	* that should be verified.
	*
	* If CHECK_PK is set, the specified key is sometimes preferred for
	* verifying signatures. See the implementation for details.
	*
	* If RET_PK is not NULL, the public key that successfully verified
	* the signature is copied into *RET_PK.
	*
	* If IS_SELFSIG is not NULL, *IS_SELFSIG is set to 1 if NODE is a
	* self-signature.
	*
	* If R_EXPIREDATE is not NULL, *R_EXPIREDATE is set to the expiry
	* date.
	*
	* If R_EXPIRED is not NULL, *R_EXPIRED is set to 1 if PK has been
	* expired (0 otherwise). Note: PK being revoked does not cause this
	* function to fail.
	*
	*
	* If OPT.NO_SIG_CACHE is not set, this function will first check if
	* the result of a previous verification is already cached in the
	* signature packet's data structure.
	*
	* TODO: add r_revoked here as well. It has the same problems as
	* r_expiredate and r_expired and the cache [nw]. Which problems [wk]? */
	int
	check_key_signature2 (ctrl_t ctrl,
	kbnode_t root, kbnode_t node, PKT_public_key *check_pk,
	PKT_public_key ret_pk, int is_selfsig,
	u32 r_expiredate, int r_expired )
	{
	PKT_public_key *pk;
	PKT_signature *sig;
	int algo;
	int rc;

	if (is_selfsig)
	*is_selfsig = 0;
	if (r_expiredate)
	*r_expiredate = 0;
	if (r_expired)
	*r_expired = 0;
	log_assert (node->pkt->pkttype == PKT_SIGNATURE);
	log_assert (root->pkt->pkttype == PKT_PUBLIC_KEY);

	pk = root->pkt->pkt.public_key;
	sig = node->pkt->pkt.signature;
	algo = sig->digest_algo;

	/* Check whether we have cached the result of a previous signature
	* check. Note that we may no longer have the pubkey or hash
	* needed to verify a sig, but can still use the cached value. A
	* cache refresh detects and clears these cases. */
	if ( !opt.no_sig_cache )
	{
	cache_stats.total++;
	if (sig->flags.checked) /* Cached status available. */
	{
	cache_stats.cached++;
	if (is_selfsig)
	{
	u32 keyid[2];

	keyid_from_pk (pk, keyid);
	if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1])
	*is_selfsig = 1;
	}
	/* BUG: This is wrong for non-self-sigs... needs to be the
	* actual pk. */
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (rc)
	return rc;
	if (sig->flags.valid)
	{
	cache_stats.goodsig++;
	return 0;
	}
	cache_stats.badsig++;
	return gpg_error (GPG_ERR_BAD_SIGNATURE);
	}
	}

	rc = openpgp_pk_test_algo(sig->pubkey_algo);
	if (rc)
	return rc;
	rc = openpgp_md_test_algo(algo);
	if (rc)
	return rc;

	if (IS_KEY_REV (sig))
	{
	u32 keyid[2];
	keyid_from_pk( pk, keyid );

	/* Is it a designated revoker? */
	if (keyid[0] != sig->keyid[0] \|\| keyid[1] != sig->keyid[1])
	rc = check_revocation_keys (ctrl, pk, sig);
	else
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (ctrl, pk, sig,
	root, root->pkt,
	is_selfsig, ret_pk);
	}
	}
	else if (IS_SUBKEY_REV (sig) \|\| IS_SUBKEY_SIG (sig))
	{
	kbnode_t snode = find_prev_kbnode (root, node, PKT_PUBLIC_SUBKEY);

	if (snode)
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	{
	/* A subkey revocation (0x28) must be a self-sig, but a
	* subkey signature (0x18) needn't be. */
	rc = check_signature_over_key_or_uid (ctrl,
	IS_SUBKEY_SIG (sig)
	? NULL : pk,
	sig, root, snode->pkt,
	is_selfsig, ret_pk);
	}
	}
	else
	{
	if (opt.verbose)
	{
	if (IS_SUBKEY_REV (sig))
	log_info (_("key %s: no subkey for subkey"
	" revocation signature\n"), keystr_from_pk(pk));
	else if (sig->sig_class == 0x18)
	log_info(_("key %s: no subkey for subkey"
	" binding signature\n"), keystr_from_pk(pk));
	}
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else if (IS_KEY_SIG (sig)) /* direct key signature */
	{
	rc = check_signature_metadata_validity (pk, sig,
	r_expired, NULL);
	if (! rc)
	rc = check_signature_over_key_or_uid (ctrl, pk, sig, root, root->pkt,
	is_selfsig, ret_pk);
	}
	else if (IS_UID_SIG (sig) \|\| IS_UID_REV (sig))
	{
	kbnode_t unode = find_prev_kbnode (root, node, PKT_USER_ID);

	if (unode)
	{
	rc = check_signature_metadata_validity (pk, sig, r_expired, NULL);
	if (! rc)
	{
	/* If this is a self-sig, ignore check_pk. */
	rc = check_signature_over_key_or_uid
	(ctrl,
	keyid_cmp (pk_keyid (pk), sig->keyid) == 0 ? pk : check_pk,
	sig, root, unode->pkt, NULL, ret_pk);
	}
	}
	else
	{
	if (!opt.quiet)
	log_info ("key %s: no user ID for key signature packet"
	" of class %02x\n",keystr_from_pk(pk),sig->sig_class);
	rc = GPG_ERR_SIG_CLASS;
	}
	}
	else
	{
	log_info ("sig issued by %s with class %d (digest: %02x %02x)"
	" is not valid over a user id or a key id, ignoring.\n",
	keystr (sig->keyid), sig->sig_class,
	sig->digest_start[0], sig->digest_start[1]);
	rc = gpg_error (GPG_ERR_BAD_SIGNATURE);
	}

	cache_sig_result (sig, rc);

	return rc;
	}
	diff --git a/g10/test-stubs.c b/g10/test-stubs.c
	index ffff83d06..8b39484ef 100644
	--- a/g10/test-stubs.c
	+++ b/g10/test-stubs.c
	@@ -1,554 +1,567 @@
	/* test-stubs.c - The GnuPG signature verify utility
	* Copyright (C) 1998, 1999, 2000, 2001, 2002, 2005, 2006,
	* 2008, 2009, 2012 Free Software Foundation, Inc.
	*
	* This file is part of GnuPG.
	*
	* GnuPG is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 3 of the License, or
	* (at your option) any later version.
	*
	* GnuPG is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program; if not, see <https://www.gnu.org/licenses/>.
	*/

	#include <config.h>
	#include <errno.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#include <unistd.h>

	#define INCLUDED_BY_MAIN_MODULE 1
	#include "gpg.h"
	#include "../common/util.h"
	#include "packet.h"
	#include "../common/iobuf.h"
	#include "main.h"
	#include "options.h"
	#include "keydb.h"
	#include "trustdb.h"
	#include "filter.h"
	#include "../common/ttyio.h"
	#include "../common/i18n.h"
	#include "../common/sysutils.h"
	#include "../common/status.h"
	#include "call-agent.h"

	int g10_errors_seen;


	void
	g10_exit( int rc )
	{
	rc = rc? rc : log_get_errorcount(0)? 2 : g10_errors_seen? 1 : 0;
	exit(rc );
	}


	/* Stub:
	* We have to override the trustcheck from pkclist.c because
	* this utility assumes that all keys in the keyring are trustworthy
	*/
	int
	check_signatures_trust (ctrl_t ctrl, PKT_signature *sig)
	{
	(void)ctrl;
	(void)sig;
	return 0;
	}

	void
	read_trust_options (ctrl_t ctrl,
	byte trust_model, ulong created, ulong *nextcheck,
	byte marginals, byte completes, byte *cert_depth,
	byte *min_cert_level)
	{
	(void)ctrl;
	(void)trust_model;
	(void)created;
	(void)nextcheck;
	(void)marginals;
	(void)completes;
	(void)cert_depth;
	(void)min_cert_level;
	}

	/* Stub:
	* We don't have the trustdb , so we have to provide some stub functions
	* instead
	*/

	int
	cache_disabled_value (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return 0;
	}

	void
	check_trustdb_stale (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	int
	get_validity_info (ctrl_t ctrl, kbnode_t kb, PKT_public_key *pk,
	PKT_user_id *uid)
	{
	(void)ctrl;
	(void)kb;
	(void)pk;
	(void)uid;
	return '?';
	}

	unsigned int
	get_validity (ctrl_t ctrl, kbnode_t kb, PKT_public_key pk, PKT_user_id uid,
	PKT_signature *sig, int may_ask)
	{
	(void)ctrl;
	(void)kb;
	(void)pk;
	(void)uid;
	(void)sig;
	(void)may_ask;
	return 0;
	}

	const char *
	trust_value_to_string (unsigned int value)
	{
	(void)value;
	return "err";
	}

	const char *
	uid_trust_string_fixed (ctrl_t ctrl, PKT_public_key key, PKT_user_id uid)
	{
	(void)ctrl;
	(void)key;
	(void)uid;
	return "err";
	}

	int
	get_ownertrust_info (ctrl_t ctrl, PKT_public_key *pk, int no_create)
	{
	(void)ctrl;
	(void)pk;
	(void)no_create;
	return '?';
	}

	unsigned int
	get_ownertrust (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return TRUST_UNKNOWN;
	}


	/* Stubs:
	* Because we only work with trusted keys, it does not make sense to
	* get them from a keyserver
	*/

	struct keyserver_spec *
	keyserver_match (struct keyserver_spec *spec)
	{
	(void)spec;
	return NULL;
	}

	int
	keyserver_any_configured (ctrl_t ctrl)
	{
	(void)ctrl;
	return 0;
	}

	int
	keyserver_import_keyid (u32 keyid, void dummy, int quick)
	{
	(void)keyid;
	(void)dummy;
	(void)quick;
	return -1;
	}

	int
	keyserver_import_fprint (ctrl_t ctrl, const byte *fprint,size_t fprint_len,
	struct keyserver_spec *keyserver, int quick)
	{
	(void)ctrl;
	(void)fprint;
	(void)fprint_len;
	(void)keyserver;
	(void)quick;
	return -1;
	}

	int
	keyserver_import_cert (const char *name)
	{
	(void)name;
	return -1;
	}

	int
	keyserver_import_pka (const char name,unsigned char fpr)
	{
	(void)name;
	(void)fpr;
	return -1;
	}

	gpg_error_t
	keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
	unsigned char *fpr, size_t fpr_len)
	{
	(void)ctrl;
	(void)name;
	(void)quick;
	(void)fpr;
	(void)fpr_len;
	return GPG_ERR_BUG;
	}

	int
	keyserver_import_name (const char name,struct keyserver_spec spec)
	{
	(void)name;
	(void)spec;
	return -1;
	}

	int
	keyserver_import_ldap (const char *name)
	{
	(void)name;
	return -1;
	}

	gpg_error_t
	-read_key_from_file (ctrl_t ctrl, const char fname, kbnode_t r_keyblock)
	+read_key_from_file_or_buffer (ctrl_t ctrl, const char *fname,
	+ const void *buffer, size_t buflen,
	+ kbnode_t *r_keyblock)
	{
	(void)ctrl;
	(void)fname;
	+ (void)buffer;
	+ (void)buflen;
	(void)r_keyblock;
	return -1;
	}

	+gpg_error_t
	+import_included_key_block (ctrl_t ctrl, kbnode_t keyblock)
	+{
	+ (void)ctrl;
	+ (void)keyblock;
	+ return -1;
	+}
	+
	+
	/* Stub:
	* No encryption here but mainproc links to these functions.
	*/
	gpg_error_t
	get_session_key (ctrl_t ctrl, struct pubkey_enc_list k, DEK dek)
	{
	(void)ctrl;
	(void)k;
	(void)dek;
	return GPG_ERR_GENERAL;
	}

	/* Stub: */
	gpg_error_t
	get_override_session_key (DEK dek, const char string)
	{
	(void)dek;
	(void)string;
	return GPG_ERR_GENERAL;
	}

	/* Stub: */
	int
	decrypt_data (ctrl_t ctrl, void procctx, PKT_encrypted ed, DEK *dek)
	{
	(void)ctrl;
	(void)procctx;
	(void)ed;
	(void)dek;
	return GPG_ERR_GENERAL;
	}


	/* Stub:
	* No interactive commands, so we don't need the helptexts
	*/
	void
	display_online_help (const char *keyword)
	{
	(void)keyword;
	}

	/* Stub:
	* We don't use secret keys, but getkey.c links to this
	*/
	int
	check_secret_key (PKT_public_key *pk, int n)
	{
	(void)pk;
	(void)n;
	return GPG_ERR_GENERAL;
	}

	/* Stub:
	* No secret key, so no passphrase needed
	*/
	DEK *
	passphrase_to_dek (int cipher_algo, STRING2KEY *s2k, int create, int nocache,
	const char tmp, int canceled)
	{
	(void)cipher_algo;
	(void)s2k;
	(void)create;
	(void)nocache;
	(void)tmp;

	if (canceled)
	*canceled = 0;
	return NULL;
	}

	void
	passphrase_clear_cache (const char *cacheid)
	{
	(void)cacheid;
	}

	struct keyserver_spec *
	parse_preferred_keyserver(PKT_signature *sig)
	{
	(void)sig;
	return NULL;
	}

	struct keyserver_spec *
	parse_keyserver_uri (const char *uri, int require_scheme,
	const char *configname, unsigned int configlineno)
	{
	(void)uri;
	(void)require_scheme;
	(void)configname;
	(void)configlineno;
	return NULL;
	}

	void
	free_keyserver_spec (struct keyserver_spec *keyserver)
	{
	(void)keyserver;
	}

	/* Stubs to avoid linking to photoid.c */
	void
	show_photos (const struct user_attribute attrs, int count, PKT_public_key pk)
	{
	(void)attrs;
	(void)count;
	(void)pk;
	}

	int
	parse_image_header (const struct user_attribute attr, byte type, u32 *len)
	{
	(void)attr;
	(void)type;
	(void)len;
	return 0;
	}

	char *
	image_type_to_string (byte type, int string)
	{
	(void)type;
	(void)string;
	return NULL;
	}

	#ifdef ENABLE_CARD_SUPPORT
	int
	agent_scd_getattr (const char name, struct agent_card_info_s info)
	{
	(void)name;
	(void)info;
	return 0;
	}
	#endif /* ENABLE_CARD_SUPPORT */

	/* We do not do any locking, so use these stubs here */
	void
	dotlock_disable (void)
	{
	}

	dotlock_t
	dotlock_create (const char *file_to_lock, unsigned int flags)
	{
	(void)file_to_lock;
	(void)flags;
	return NULL;
	}

	void
	dotlock_destroy (dotlock_t h)
	{
	(void)h;
	}

	int
	dotlock_take (dotlock_t h, long timeout)
	{
	(void)h;
	(void)timeout;
	return 0;
	}

	int
	dotlock_release (dotlock_t h)
	{
	(void)h;
	return 0;
	}

	void
	dotlock_remove_lockfiles (void)
	{
	}

	int
	agent_probe_secret_key (ctrl_t ctrl, PKT_public_key *pk)
	{
	(void)ctrl;
	(void)pk;
	return 0;
	}

	gpg_error_t
	agent_probe_any_secret_key (ctrl_t ctrl, kbnode_t keyblock)
	{
	(void)ctrl;
	(void)keyblock;
	return gpg_error (GPG_ERR_NO_SECKEY);
	}

	gpg_error_t
	agent_get_keyinfo (ctrl_t ctrl, const char *hexkeygrip,
	char *r_serialno, int r_cleartext)
	{
	(void)ctrl;
	(void)hexkeygrip;
	(void)r_cleartext;
	*r_serialno = NULL;
	return gpg_error (GPG_ERR_NO_SECKEY);
	}

	gpg_error_t
	gpg_dirmngr_get_pka (ctrl_t ctrl, const char *userid,
	unsigned char *r_fpr, size_t r_fprlen,
	char **r_url)
	{
	(void)ctrl;
	(void)userid;
	if (r_fpr)
	*r_fpr = NULL;
	if (r_fprlen)
	*r_fprlen = 0;
	if (r_url)
	*r_url = NULL;
	return gpg_error (GPG_ERR_NOT_FOUND);
	}

	gpg_error_t
	export_pubkey_buffer (ctrl_t ctrl, const char *keyspec, unsigned int options,
	const void *prefix, size_t prefixlen,
	export_stats_t stats,
	kbnode_t r_keyblock, void r_data, size_t r_datalen)
	{
	(void)ctrl;
	(void)keyspec;
	(void)options;
	(void)prefix;
	(void)prefixlen;
	(void)stats;

	*r_keyblock = NULL;
	*r_data = NULL;
	*r_datalen = 0;
	return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
	}

	gpg_error_t
	tofu_write_tfs_record (ctrl_t ctrl, estream_t fp,
	PKT_public_key pk, const char user_id)
	{
	(void)ctrl;
	(void)fp;
	(void)pk;
	(void)user_id;
	return gpg_error (GPG_ERR_GENERAL);
	}

	gpg_error_t
	tofu_get_policy (ctrl_t ctrl, PKT_public_key pk, PKT_user_id user_id,
	enum tofu_policy *policy)
	{
	(void)ctrl;
	(void)pk;
	(void)user_id;
	(void)policy;
	return gpg_error (GPG_ERR_GENERAL);
	}

	const char *
	tofu_policy_str (enum tofu_policy policy)
	{
	(void)policy;

	return "unknown";
	}

	void
	tofu_begin_batch_update (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	void
	tofu_end_batch_update (ctrl_t ctrl)
	{
	(void)ctrl;
	}

	gpg_error_t
	tofu_notice_key_changed (ctrl_t ctrl, kbnode_t kb)
	{
	(void) ctrl;
	(void) kb;

	return 0;
	}

	int
	get_revocation_reason (PKT_signature sig, char *r_reason,
	char *r_comment, size_t r_commentlen)
	{
	(void)sig;
	(void)r_commentlen;

	if (r_reason)
	*r_reason = NULL;
	if (r_comment)
	*r_comment = NULL;
	return 0;
	}

File Metadata

Mime Type: text/x-diff
Expires: Thu, Mar 19, 5:22 AM (1 d, 20 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: 39/53/0c774f3b310f3d0ed1c69d7590ea

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions