From cvs at cvs.gnupg.org  Thu Dec  1 09:13:04 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 01 Dec 2016 09:13:04 +0100
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-3-gc5c7bee
Message-ID: <E1cCMUM-0007IM-Vi@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  c5c7bee68730c9f66a27f9bb0d023480623a2bfb (commit)
      from  d015020b56dc11848d638d8a0f22c11971f896ea (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c5c7bee68730c9f66a27f9bb0d023480623a2bfb
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 1 09:10:08 2016 +0100

    Fix linkage problem in tty and emacs pinentries.
    
    * emacs/pinentry-emacs.c (curses_cmd_handler): Remove var.
    * tty/pinentry-tty.c (curses_cmd_handler): Remove var.
    * pinentry/pinentry.c (flavor_flag): New local var.
    (pinentry_set_flavor_flag): New function.
    (cmd_getinfo): Use FLAVOR_FLAG for the "flavor" sub-command.
    * gnome3/pinentry-gnome3.c (main): Call pinentry_set_flavor_flag.
    * gtk+-2/pinentry-gtk-2.c (main): Ditto.
    * pinentry/pinentry-emacs.c (initial_emacs_cmd_handler): Ditto.
    * qt/main.cpp (main): Ditto.
    --
    
    Fixes-commit: e4e3a9cc88704dcffac660d0b92fd1ed8abecc11
    Fixes-commit: d126036671e7dd631babc118cb4113f723f15748
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/emacs/pinentry-emacs.c b/emacs/pinentry-emacs.c
index b6b3eb8..3c39a96 100644
--- a/emacs/pinentry-emacs.c
+++ b/emacs/pinentry-emacs.c
@@ -29,10 +29,6 @@
 
 pinentry_cmd_handler_t pinentry_cmd_handler = emacs_cmd_handler;
 
-/* needed to link cleanly; should never be used except for comparison
- * in pinentry/pinentry.c's cmd_getinfo(): */
-pinentry_cmd_handler_t curses_cmd_handler = NULL;
-
 
 

 int
diff --git a/gnome3/pinentry-gnome3.c b/gnome3/pinentry-gnome3.c
index a040f9b..d5a49d6 100644
--- a/gnome3/pinentry-gnome3.c
+++ b/gnome3/pinentry-gnome3.c
@@ -517,18 +517,21 @@ main (int argc, char *argv[])
       fprintf (stderr, "No $DBUS_SESSION_BUS_ADDRESS found,"
                " falling back to curses\n");
       pinentry_cmd_handler = curses_cmd_handler;
+      pinentry_set_flavor_flag ("curses");
     }
   else if (!pe_gcr_system_prompt_available ())
     {
       fprintf (stderr, "No Gcr System Prompter available,"
                " falling back to curses\n");
       pinentry_cmd_handler = curses_cmd_handler;
+      pinentry_set_flavor_flag ("curses");
     }
   else if (pe_gnome_screen_locked ())
     {
       fprintf (stderr, "GNOME screensaver is locked,"
                " falling back to curses\n");
       pinentry_cmd_handler = curses_cmd_handler;
+      pinentry_set_flavor_flag ("curses");
     }
 #endif
 
diff --git a/gtk+-2/pinentry-gtk-2.c b/gtk+-2/pinentry-gtk-2.c
index 6037533..473c4aa 100644
--- a/gtk+-2/pinentry-gtk-2.c
+++ b/gtk+-2/pinentry-gtk-2.c
@@ -938,10 +938,16 @@ main (int argc, char *argv[])
   if (pinentry_have_display (argc, argv))
     {
       if (! gtk_init_check (&argc, &argv))
-	pinentry_cmd_handler = curses_cmd_handler;
+        {
+          pinentry_cmd_handler = curses_cmd_handler;
+          pinentry_set_flavor_flag ("curses");
+        }
     }
   else
-    pinentry_cmd_handler = curses_cmd_handler;
+    {
+      pinentry_cmd_handler = curses_cmd_handler;
+      pinentry_set_flavor_flag ("curses");
+    }
 #else
   gtk_init (&argc, &argv);
 #endif
diff --git a/pinentry/pinentry-emacs.c b/pinentry/pinentry-emacs.c
index df12f1b..50ba406 100644
--- a/pinentry/pinentry-emacs.c
+++ b/pinentry/pinentry-emacs.c
@@ -644,7 +644,10 @@ initial_emacs_cmd_handler (pinentry_t pe)
   if (emacs_socket < 0)
     pinentry_cmd_handler = fallback_cmd_handler;
   else
-    pinentry_cmd_handler = emacs_cmd_handler;
+    {
+      pinentry_cmd_handler = emacs_cmd_handler;
+      pinentry_set_flavor_flag ("emacs");
+    }
 
   return (* pinentry_cmd_handler) (pe);
 }
diff --git a/pinentry/pinentry.c b/pinentry/pinentry.c
index 322a651..a198fb3 100644
--- a/pinentry/pinentry.c
+++ b/pinentry/pinentry.c
@@ -67,6 +67,10 @@ static char this_pgmname[50];
 
 struct pinentry pinentry;
 
+
+static const char *flavor_flag;
+
+
 static void
 pinentry_reset (int use_defaults)
 {
@@ -793,6 +797,16 @@ pinentry_parse_opts (int argc, char *argv[])
     }
 }
 
+
+/* Set the optional flag used with getinfo. */
+void
+pinentry_set_flavor_flag (const char *string)
+{
+  flavor_flag = string;
+}
+
+
+
 

 static gpg_error_t
 option_handler (assuan_context_t ctx, const char *key, const char *value)
@@ -1444,27 +1458,15 @@ cmd_getinfo (assuan_context_t ctx, char *line)
     }
   else if (!strcmp (line, "flavor"))
     {
-      const char *flags;
-
       if (!strncmp (this_pgmname, "pinentry-", 9) && this_pgmname[9])
         s = this_pgmname + 9;
       else
         s = this_pgmname;
 
-      if (0)
-        ;
-#ifdef INSIDE_EMACS
-      else if (pinentry_cmd_handler == emacs_cmd_handler)
-        flags = ":emacs";
-#endif
-#ifdef FALLBACK_CURSES
-      else if (pinentry_cmd_handler == curses_cmd_handler)
-        flags = ":curses";
-#endif
-      else
-        flags = "";
-
-      snprintf (buffer, sizeof buffer, "%s%s", s, flags);
+      snprintf (buffer, sizeof buffer, "%s%s%s",
+                s,
+                flavor_flag? ":":"",
+                flavor_flag? flavor_flag : "");
       buffer[sizeof buffer -1] = 0;
       rc = assuan_send_data (ctx, buffer, strlen (buffer));
     }
diff --git a/pinentry/pinentry.h b/pinentry/pinentry.h
index 01fb373..45d35ad 100644
--- a/pinentry/pinentry.h
+++ b/pinentry/pinentry.h
@@ -275,6 +275,10 @@ int pinentry_have_display (int argc, char **argv);
    or version output is requested.  */
 void pinentry_parse_opts (int argc, char *argv[]);
 
+/* Set the optional flag used with getinfo. */
+void pinentry_set_flavor_flag (const char *string);
+
+
 

 /* The caller must define this variable to process assuan commands.  */
 extern pinentry_cmd_handler_t pinentry_cmd_handler;
diff --git a/qt/main.cpp b/qt/main.cpp
index 8284960..225c06b 100644
--- a/qt/main.cpp
+++ b/qt/main.cpp
@@ -308,6 +308,7 @@ main(int argc, char *argv[])
 #ifdef FALLBACK_CURSES
     if (!pinentry_have_display(argc, argv)) {
         pinentry_cmd_handler = curses_cmd_handler;
+        pinentry_set_flavor_flag ("curses");
     } else
 #endif
     {
diff --git a/tty/pinentry-tty.c b/tty/pinentry-tty.c
index 3d6cd5a..a509d79 100644
--- a/tty/pinentry-tty.c
+++ b/tty/pinentry-tty.c
@@ -556,9 +556,6 @@ tty_cmd_handler(pinentry_t pinentry)
 
 pinentry_cmd_handler_t pinentry_cmd_handler = tty_cmd_handler;
 
-/* needed to link cleanly; should never be used except for comparison
- * in pinentry/pinentry.c's cmd_getinfo(): */
-pinentry_cmd_handler_t curses_cmd_handler = NULL;
 
 
 int

-----------------------------------------------------------------------

Summary of changes:
 emacs/pinentry-emacs.c    |  4 ----
 gnome3/pinentry-gnome3.c  |  3 +++
 gtk+-2/pinentry-gtk-2.c   | 10 ++++++++--
 pinentry/pinentry-emacs.c |  5 ++++-
 pinentry/pinentry.c       | 34 ++++++++++++++++++----------------
 pinentry/pinentry.h       |  4 ++++
 qt/main.cpp               |  1 +
 tty/pinentry-tty.c        |  3 ---
 8 files changed, 38 insertions(+), 26 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 09:40:27 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 01 Dec 2016 09:40:27 +0100
Subject: [git] GPA - branch, master, updated. gpa-0.9.10-4-g26443b0
Message-ID: <E1cCMur-0000j5-CD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Assistant".

The branch, master has been updated
       via  26443b0c76b24b9a4d60d8d015461b0f4e7536e3 (commit)
       via  b711104afd1e069271e386d7982b3b5e65eec165 (commit)
      from  dc05f46e07626d468d090564fec23cc598368589 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 26443b0c76b24b9a4d60d8d015461b0f4e7536e3
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 1 09:38:03 2016 +0100

    Typo fix in NEWS
    
    --

diff --git a/NEWS b/NEWS
index 10fba57..d73aca5 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,7 @@ Noteworthy changes in version 0.9.11 (unreleased)
 Noteworthy changes in version 0.9.10 (2016-11-19)
 -------------------------------------------------
 
- * Addded basic support for TOFU information.
+ * Added basic support for TOFU information.
 
  * Removed key-ID from some listings in favor of using the
    fingerprint.

commit b711104afd1e069271e386d7982b3b5e65eec165
Author: Zden?k Hata? <zdenek.hatas at gmail.com>
Date:   Mon Nov 21 12:46:23 2016 +0100

    po: czech translation update

diff --git a/po/cs.po b/po/cs.po
index 59af0ed..ad284f4 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -4,17 +4,16 @@
 msgid ""
 msgstr ""
 "Project-Id-Version: cs\n"
-"Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2014-09-11 09:17+0100\n"
+"Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n"
+"PO-Revision-Date: 2016-11-21 12:44+0100\n"
 "Last-Translator: Zden?k Hata? <zdenek.hatas at gmail.com>\n"
 "Language-Team: czech <cs at li.org>\n"
 "Language: cs\n"
 "MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=utf-8\n"
+"Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Generator: Poedit 1.5.4\n"
-"Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
-"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
+"X-Generator: Poedit 1.8.7.1\n"
+"Plural-Forms: nplurals=3; plural=(n==1) ? 0 : (n>=2 && n<=4) ? 1 : 2;\n"
 
 msgid "Open File"
 msgstr "Otev??t soubor"
@@ -25,8 +24,8 @@ msgstr "Zpr?va GPA"
 #. TRANSLATORS: The arguments are the filename, the integer size
 #. and the unit (such as KB or MB).
 #, c-format
-msgid "The file %s is %llu%s large.  Do you really  want to open it?"
-msgstr "Soubor %s je %llu%s  velk?. Opravdu jej chcete otev??t?"
+msgid "The file %s is %lli%s large.  Do you really  want to open it?"
+msgstr "Soubor %s je %lli%s velk?. Opravdu jej chcete otev??t?"
 
 msgid "Save As..."
 msgstr "Ulo?it jako..."
@@ -97,6 +96,9 @@ msgstr "Soubory"
 msgid "Card"
 msgstr "Karta"
 
+msgid "GNU Privacy Assistant - Clipboard"
+msgstr "GNU Privacy Assistant - Schr?nka"
+
 msgid "<b>Main</b>"
 msgstr "<b>Hlavn?</b>"
 
@@ -119,11 +121,11 @@ msgid "Use default argument"
 msgstr "Pou??t v?choz? argument"
 
 msgid ""
-"There are unapplied changes by you. Changing the expert setting will apply "
-"those changes.  Do you want to continue?"
+"There are unapplied changes by you. Changing the expert setting will apply those changes.  "
+"Do you want to continue?"
 msgstr ""
-"Nebyly ulo?eny zm?ny, kter? jste provedl. P?epnut? nastaven? ?rovn? expert "
-"tyto zm?ny ulo??. P?ejete si pokra?ovat?"
+"Nebyly ulo?eny zm?ny, kter? jste provedl. P?epnut? nastaven? ?rovn? expert tyto zm?ny "
+"ulo??. P?ejete si pokra?ovat?"
 
 msgid "Crypto Backend Configuration"
 msgstr "Nastaven? ?ifrovac?ho backendu"
@@ -146,23 +148,6 @@ msgstr "Pokro?il?"
 msgid "Expert"
 msgstr "Expert"
 
-msgid "A keyserver has not been configured."
-msgstr ""
-
-#, fuzzy
-msgid "Configure backend to use a keyserver?"
-msgstr "Nastavit programy backednu"
-
-msgid "_Yes"
-msgstr "_Ano"
-
-msgid "_No"
-msgstr "_Ne"
-
-#, fuzzy
-msgid "Configuring the backend to use a keyserver failed"
-msgstr "Nastavit programy backednu"
-
 msgid "days"
 msgstr "dny"
 
@@ -244,6 +229,9 @@ msgstr "Vybrat v?echny soubory"
 msgid "File"
 msgstr "Soubor"
 
+msgid "GNU Privacy Assistant - File Manager"
+msgstr "GNU Privacy Assistant - Spr?vce soubor?"
+
 msgid "File Manager"
 msgstr "Spr?vce soubor?"
 
@@ -286,8 +274,8 @@ msgstr "Otev??t schr?nku"
 msgid "Open the settings dialog"
 msgstr "Otev??t dialog nastaven?"
 
-msgid "Only start the UI server"
-msgstr "Spustit pouze UI server"
+msgid "Enable the UI server"
+msgstr "Povolit UI server"
 
 msgid "Disable support for X.509"
 msgstr "Vypnout podporu pro X.509"
@@ -295,9 +283,6 @@ msgstr "Vypnout podporu pro X.509"
 msgid "Read options from file"
 msgstr "??st mo?nosti ze souboru"
 
-msgid "Do not connect to a running instance"
-msgstr "Nep?ipojujte se k b???c? instanci"
-
 msgid "[FILE...]"
 msgstr "[SOUBOR...]"
 
@@ -328,14 +313,14 @@ msgstr "Na_staven? backendu"
 msgid "Configure the backend programs"
 msgstr "Nastavit programy backednu"
 
-#, fuzzy, c-format
+#, c-format
 msgid ""
 "A copy of your secret key has been made to the file:\n"
 "\n"
 "\t\"%s\"\n"
 "\n"
 "This is sensitive information, and should be stored carefully\n"
-"(for example, on a USB stick kept in a safe place)."
+"(for example, in a floppy disk kept in a safe place)."
 msgstr ""
 "Kopie va?eho soukrom?ho kl??e byla ulo?ena v souboru:\n"
 "\n"
@@ -351,8 +336,8 @@ msgid "Backup key to file"
 msgstr "Z?lohovat kl?? do souboru"
 
 #, c-format
-msgid "Generating backup of key: 0x%s"
-msgstr "Vytv??? se z?lohu kl??e: 0x%s"
+msgid "Generating backup of key: %s"
+msgstr "Vytv??? se z?loha kl??e: %s"
 
 msgid "The keys have been copied to the clipboard."
 msgstr "Kl??e byly zkop?rov?ny do schr?nky."
@@ -367,25 +352,21 @@ msgstr "ASCII-z_ak?dovat"
 msgid "The keys have been exported to %s."
 msgstr "Kl??e byly exportov?ny do %s."
 
-msgid "Only keys of the same procotol may be exported as a collection."
-msgstr "Pouze kl??e stejn?ho protokolu sm?j? b?t exportov?ny jako kolekce."
-
-#, fuzzy, c-format
+#, c-format
 msgid ""
-"The selected key(s) will be sent to a public key\n"
-"server (\"%s\")."
+"The selected key will be sent to a public key\n"
+"server (\"%s\").\n"
+"Are you sure you want to distribute this key?"
 msgstr ""
 "Vybran? kl?? bude odesl?n na server kl???\n"
 "(\"%s\").\n"
 "Ur?it? chcete ???it tento kl???"
 
-#, fuzzy
-msgid "Are you sure you want to distribute this key?"
-msgstr "Jste si jist?, ?e chcete smazat tento kl???"
+msgid "_Yes"
+msgstr "_Ano"
 
-#, fuzzy
-msgid "Error sending key(s) to the server."
-msgstr "Odeslat kl??e na server..."
+msgid "_No"
+msgstr "_Ne"
 
 msgid "The keys have been sent to the server."
 msgstr "Kl??e byly odesl?ny na server."
@@ -405,8 +386,8 @@ msgstr "Soubor \"%s\" neobsahoval OpenPGP data."
 msgid "\"%s\" contained no valid encrypted data."
 msgstr "\"%s\" neobsahoval platn? ?ifrovan? data."
 
-#, fuzzy, c-format
-msgid "The file \"%s\" contained no valid encrypted data."
+#, c-format
+msgid "The file \"%s\" contained no validencrypted data."
 msgstr "Soubor \"%s\" neobsahoval platn? ?ifrovan? data."
 
 msgid "Wrong passphrase!"
@@ -444,12 +425,11 @@ msgid "The following key expired on %s:"
 msgstr "N?sleduj?c?mu kl??i vypr?ela platnost %s:"
 
 msgid ""
-"The selected certificates are not all of the same type. That is, you mixed "
-"OpenPGP and X.509 certificates. Please make sure to select only certificates "
-"of the same type."
+"The selected certificates are not all of the same type. That is, you mixed OpenPGP and "
+"X.509 certificates. Please make sure to select only certificates of the same type."
 msgstr ""
-"Vybran? certifik?ty nejsou stejn?ho typu. To znamen?, ?e m?ch?te certifik?ty "
-"OpenPGP a X.509. Ujist?te se pros?m, ?e vol?te certifik?ty stejn?ho typu."
+"Vybran? certifik?ty nejsou stejn?ho typu. To znamen?, ?e m?ch?te certifik?ty OpenPGP a "
+"X.509. Ujist?te se pros?m, ?e vol?te certifik?ty stejn?ho typu."
 
 msgid "You didn't select any key for signing"
 msgstr "Nevybrali jste ??dn? kl?? pro podpis"
@@ -462,13 +442,11 @@ msgstr "Ov??uji ..."
 
 #, c-format
 msgid ""
-"GPA found a file that could be a signature of %s. Would you like to verify "
-"it instead?\n"
+"GPA found a file that could be a signature of %s. Would you like to verify it instead?\n"
 "\n"
 "The file found is: %s"
 msgstr ""
-"GPA nalezl soubor, kter? by mohl b?t podpisem %s. Chcete jej rad?ji "
-"zkontrolovat?\n"
+"GPA nalezl soubor, kter? by mohl b?t podpisem %s. Chcete jej rad?ji zkontrolovat?\n"
 "\n"
 "Nalezen? soubor: %s"
 
@@ -478,25 +456,32 @@ msgstr "Vytv??? se kl?? ..."
 msgid "Import keys from file"
 msgstr "Importovat kl??e ze souboru"
 
+msgid "No keys were found."
+msgstr "Nebyly nalezeny ??dn? kl??e."
+
 #, c-format
 msgid ""
-"More than %d keys match your search pattern.\n"
-"Use the long keyid or a fingerprint for a better match"
+"%i public keys read\n"
+"%i public keys imported\n"
+"%i public keys unchanged\n"
+"%i secret keys read\n"
+"%i secret keys imported\n"
+"%i secret keys unchanged"
 msgstr ""
-
-msgid "No keys were found."
-msgstr "Nebyly nalezeny ??dn? kl??e."
+"%i p?e?teno ve?ejn?ch kl???\n"
+"%i z?sk?no ve?ejn?ch kl???\n"
+"%i nezm?n?n?ch ve?ejn?ch kl???\n"
+"%i p?e?teno soukrom?ch kl???\n"
+"%i z?sk?no soukrom?ch kl???\n"
+"%i nezm?n?n?ch soukrom?ch kl???"
 
 msgid ""
 "Invalid time given.\n"
 "(you may not set the expiration time to the past.)"
 msgstr "Neplatn? ?as.(nem??ete nastavit ?as vypr?en? do minulosti.)"
 
-msgid "Created"
-msgstr "Vytvo?en"
-
-msgid "The Creation Date is the date the certificate was created."
-msgstr "Datum vytvo?en? je datum, kdy byl certifik?t vytvo?en."
+msgid "Key ID"
+msgstr "ID kl??e"
 
 msgid "User Name"
 msgstr "Jm?no u?ivatele"
@@ -513,10 +498,6 @@ msgstr "Tento kl?? u? jste s?m podepsal!"
 msgid "You haven't selected a default key to sign with!"
 msgstr "Nebyl vybr?n v?choz? kl?? pro podepisov?n?!"
 
-#, fuzzy
-msgid "Which key do you want to import?"
-msgstr "Kter? kl?? chcete z?skat? (Mus?te zadat ID kl??e)."
-
 msgid "Which key do you want to import? (The key must be specified by key ID)."
 msgstr "Kter? kl?? chcete z?skat? (Mus?te zadat ID kl??e)."
 
@@ -550,41 +531,41 @@ msgstr "ID podkl??e"
 msgid "Status"
 msgstr "Stav"
 
-msgid "Algo"
+msgid "Algorithm"
 msgstr "Algoritmus"
 
 msgid "Size"
 msgstr "Velikost"
 
-msgid "Expires"
-msgstr "Vypr?? platnost"
+msgid "Expiry Date"
+msgstr "Platnost do"
 
-msgid "S"
-msgstr "P"
+msgid "[S]"
+msgstr "[S]"
 
 msgid "Can sign"
 msgstr "Sm? podepisovat"
 
-msgid "C"
-msgstr "C"
+msgid "[C]"
+msgstr "[C]"
 
 msgid "Can certify"
 msgstr "Sm? certifikovat"
 
-msgid "E"
-msgstr "?"
+msgid "[E]"
+msgstr "[E]"
 
 msgid "Can encrypt"
 msgstr "Sm? ?ifrovat"
 
-msgid "A"
-msgstr "A"
+msgid "[A]"
+msgstr "[A]"
 
 msgid "Can authenticate"
 msgstr "Sm? autentizovat"
 
-msgid "T"
-msgstr "K"
+msgid "[T]"
+msgstr "[T]"
 
 msgid "Secret key stored on a smartcard."
 msgstr "Soukrom? kl?? byl ulo?en na kart?."
@@ -619,9 +600,6 @@ msgstr "Jm?na u?ivatel?:"
 msgid "Key ID:"
 msgstr "ID kl??e:"
 
-msgid "Fingerprint:"
-msgstr "Otisk:"
-
 msgid "Expiration"
 msgstr "Platnost do"
 
@@ -670,20 +648,20 @@ msgstr ""
 #, c-format
 msgid ""
 "The GPGME library returned an unexpected\n"
-"error at %s:%d. The error was:\n"
+"error. The error was:\n"
 "\n"
 "\t%s\n"
 "\n"
-"This is either an installation problem or a bug in %s.\n"
-"%s will now try to recover from this error."
+"This is probably a bug in GPA.\n"
+"GPA will now try to recover from this error."
 msgstr ""
 "Knihovna GPGME vr?tila neo?ek?vanou\n"
-"chybu v %s:%d . Chyba je:\n"
+"chybu. Chyba je:\n"
 "\n"
 "\t%s\n"
 "\n"
-"Toto je z?ejm? probl?m v instalaci nebo chyba v %s.\n"
-"%s se pokus? obnovit z chybov?ho stavu."
+"Toto je z?ejm? chyba v GPA.\n"
+"GPA se pokus? obnovit z chybov?ho stavu."
 
 #, c-format
 msgid ""
@@ -693,12 +671,6 @@ msgstr ""
 "Soubor %s ji? existuje.\n"
 "Chcete jej p?epsat?"
 
-msgid "_Use a different filename"
-msgstr ""
-
-msgid "_Open"
-msgstr ""
-
 msgid ""
 "************************************************************************\n"
 "* WARNING: This file is a backup of your secret key. Please keep it in *\n"
@@ -707,8 +679,7 @@ msgid ""
 "\n"
 msgstr ""
 "************************************************************************\n"
-"* POZOR: Toto je z?loha va?eho soukrom?ho kl??e. Uschovejte ji "
-"pros?m                  *\n"
+"* POZOR: Toto je z?loha va?eho soukrom?ho kl??e. Uschovejte ji pros?m                  *\n"
 "* na bezpe?n?m "
 "m?st?.                                                                                      "
 "*\n"
@@ -845,10 +816,8 @@ msgstr "Nejist? podpis nezn?m?m kl??em"
 msgid "The key can be used for certification, signing and encryption."
 msgstr "Tento kl?? sm? b?t pou?it pro certifikaci, podpis a ?ifrov?n?."
 
-msgid ""
-"The key can be used for certification and signing, but not for encryption."
-msgstr ""
-"Tento kl?? sm? b?t pou?it pro certifikaci a podpis, ne v?ak pro ?ifrov?n?."
+msgid "The key can be used for certification and signing, but not for encryption."
+msgstr "Tento kl?? sm? b?t pou?it pro certifikaci a podpis, ne v?ak pro ?ifrov?n?."
 
 msgid "The key can be used for certification and encryption."
 msgstr "Tento kl?? sm? b?t pou?it pro certifikaci a ?ifrov?n?."
@@ -856,12 +825,8 @@ msgstr "Tento kl?? sm? b?t pou?it pro certifikaci a ?ifrov?n?."
 msgid "The key can be used only for certification."
 msgstr "Tento kl?? sm? b?t pou?it pouze pro certifikaci."
 
-msgid ""
-"The key can be used only for signing and encryption, but not for "
-"certification."
-msgstr ""
-"Tento kl?? sm? b?t pou?it pouze pro ?ifrov?n? a podpis, ne v?ak pro "
-"certifikaci."
+msgid "The key can be used only for signing and encryption, but not for certification."
+msgstr "Tento kl?? sm? b?t pou?it pouze pro ?ifrov?n? a podpis, ne v?ak pro certifikaci."
 
 msgid "The key can be used only for signing."
 msgstr "Tento kl?? sm? b?t pou?it pouze pro podpis."
@@ -872,31 +837,6 @@ msgstr "Tento kl?? sm? b?t pou?it pouze pro ?ifrov?n?."
 msgid "This key is useless."
 msgstr "Tento kl?? je nepou?iteln?."
 
-#, c-format
-msgid ""
-"%u file(s) read\n"
-"%u file(s) with errors"
-msgstr ""
-
-#, c-format
-msgid ""
-"%i public keys read\n"
-"%i public keys imported\n"
-"%i public keys unchanged\n"
-"%i secret keys read\n"
-"%i secret keys imported\n"
-"%i secret keys unchanged"
-msgstr ""
-"%i p?e?teno ve?ejn?ch kl???\n"
-"%i z?sk?no ve?ejn?ch kl???\n"
-"%i nezm?n?n?ch ve?ejn?ch kl???\n"
-"%i p?e?teno soukrom?ch kl???\n"
-"%i z?sk?no soukrom?ch kl???\n"
-"%i nezm?n?n?ch soukrom?ch kl???"
-
-msgid "A required engine component is not installed."
-msgstr "Po?adovan? komponenta stroje nen? instalovan?."
-
 msgid "Calling the crypto engine program failed."
 msgstr "Vol?n? programu ?ifrovac?ho stroje selhalo."
 
@@ -918,6 +858,9 @@ msgstr "E-mailov? adresa nen? platn?."
 msgid "Invalid character in comments."
 msgstr "Neplatn? znak v koment???ch."
 
+msgid "GPA Error"
+msgstr "Chyba GPA"
+
 msgid "GPA is the GNU Privacy Assistant."
 msgstr "GPA je GNU Privacy Assistant"
 
@@ -986,19 +929,16 @@ msgid "You have selected the following key for removal:"
 msgstr "Vybrali jste n?sleduj?c? kl?? pro odstran?n?:"
 
 msgid ""
-"This key has a secret key. Deleting this key cannot be undone, unless you "
-"have a backup copy."
-msgstr ""
-"Toto je soukrom? kl??.  Pokud nem?te jeho z?lo?n? kopii, operace nem??e b?t "
-"odvol?na."
+"This key has a secret key. Deleting this key cannot be undone, unless you have a backup "
+"copy."
+msgstr "Toto je soukrom? kl??.  Pokud nem?te jeho z?lo?n? kopii, operace nem??e b?t odvol?na."
 
 msgid ""
-"This key is a public key. Deleting this key cannot be undone easily, "
-"although you may be able to get a new copy  from the owner or from a key "
-"server."
+"This key is a public key. Deleting this key cannot be undone easily, although you may be "
+"able to get a new copy  from the owner or from a key server."
 msgstr ""
-"Toto je ve?ejn? kl??. Smaz?n? nem??e b?t jednodu?e vr?ceno, nicm?n? je "
-"mo?nost z?skat jeho novou kopii od vlastn?ka nebo ze serveru kl???."
+"Toto je ve?ejn? kl??. Smaz?n? nem??e b?t jednodu?e vr?ceno, nicm?n? je mo?nost z?skat jeho "
+"novou kopii od vlastn?ka nebo ze serveru kl???."
 
 msgid "Are you sure you want to delete this key?"
 msgstr "Jste si jist?, ?e chcete smazat tento kl???"
@@ -1009,9 +949,6 @@ msgstr "Upravit kl??"
 msgid "Change _passphrase"
 msgstr "Zm?nit _heslo"
 
-msgid "Expiry Date"
-msgstr "Platnost do"
-
 msgid "Change _expiration"
 msgstr "Zm?nit _dobu platnosti"
 
@@ -1061,24 +998,22 @@ msgid "Backup: "
 msgstr "Z?loha:"
 
 msgid ""
-"If checked the encryption key will be created and stored to a backup file "
-"and then loaded into the card.  This is recommended so that encrypted "
-"messages can be decrypted even if the card has a malfunction."
+"If checked the encryption key will be created and stored to a backup file and then loaded "
+"into the card.  This is recommended so that encrypted messages can be decrypted even if the "
+"card has a malfunction."
 msgstr ""
-"Pokud je za?krtnuto, bude ?ifrovac? kl?? vytvo?en a ulo?en v z?lo?n?m "
-"souboru a pot? nahr?n do karty. Tato volba je doporu?ena v p??pad?, kdy mus? "
-"b?t za?ifrovan? zpr?va de?ifrovateln? i v p??pad? poruchy karty."
+"Pokud je za?krtnuto, bude ?ifrovac? kl?? vytvo?en a ulo?en v z?lo?n?m souboru a pot? nahr?n "
+"do karty. Tato volba je doporu?ena v p??pad?, kdy mus? b?t za?ifrovan? zpr?va "
+"de?ifrovateln? i v p??pad? poruchy karty."
 
 msgid ""
 "Please insert your full name.\n"
 "\n"
-"Your name will be part of the new key to make it easier for others to "
-"identify keys."
+"Your name will be part of the new key to make it easier for others to identify keys."
 msgstr ""
 "Vlo?te pros?m cel? jm?no\n"
 "\n"
-"Va?e jm?no bude ??st? nov?ho kl??e.Umo?n? snaz?? identifikaci kl??? pro "
-"ostatn?."
+"Va?e jm?no bude ??st? nov?ho kl??e.Umo?n? snaz?? identifikaci kl??? pro ostatn?."
 
 msgid "Your Name:"
 msgstr "Va?e jm?no:"
@@ -1086,21 +1021,20 @@ msgstr "Va?e jm?no:"
 msgid ""
 "Please insert your email address.\n"
 "\n"
-"Your email address will be part of the new key to make it easier for others "
-"to identify keys. If you have several email addresses, you can add further "
-"email addresses later."
+"Your email address will be part of the new key to make it easier for others to identify "
+"keys. If you have several email addresses, you can add further email addresses later."
 msgstr ""
 "Vlo?te pros?m svoji e-mailovou adresu.\n"
 "\n"
-"Ta bude sou??st? nov?ho kl??e. Umo?n? snaz?? identifikaci kl??? pro ostatn?. "
-"Pokud pou??v?te v?ce adres,m??ete je p?idat pozd?ji."
+"Ta bude sou??st? nov?ho kl??e. Umo?n? snaz?? identifikaci kl??? pro ostatn?. Pokud "
+"pou??v?te v?ce adres,m??ete je p?idat pozd?ji."
 
 msgid "Your Email Address:"
 msgstr "Va?e E-Mail adresa:"
 
 msgid ""
-"It is recommended that you create a backup copy of your new key, once it has "
-"been generated.\n"
+"It is recommended that you create a backup copy of your new key, once it has been "
+"generated.\n"
 "\n"
 "Do you want to create a backup copy?"
 msgstr ""
@@ -1126,13 +1060,12 @@ msgstr ""
 msgid ""
 "Congratulations!\n"
 "\n"
-"You have successfully generated a key. The key is indefinitely valid and has "
-"a length of %d bits."
+"You have successfully generated a key. The key is indefinitely valid and has a length of %d "
+"bits."
 msgstr ""
 "Gratuluji!\n"
 "\n"
-"Pr?v? jste ?sp??n? vytvo?ili kl??. Tento kl?? je trvale platn?, jeho d?lka "
-"je %d bit?."
+"Pr?v? jste ?sp??n? vytvo?ili kl??. Tento kl?? je trvale platn?, jeho d?lka je %d bit?."
 
 msgid ""
 "GnuPG is rebuilding the trust database.\n"
@@ -1142,11 +1075,14 @@ msgstr ""
 "Toto m??e p?r sekund trvat."
 
 msgid ""
-"This columns lists the type of the certificate.  A 'P' denotes OpenPGP and a "
-"'X' denotes X.509 (S/MIME)."
+"This columns lists the type of the certificate.  A 'P' denotes OpenPGP and a 'X' denotes "
+"X.509 (S/MIME)."
 msgstr ""
-"Tento sloupec indikuje typ certifik?tu. P?smeno 'P' znamen? OpenPGP, 'X' "
-"znamen? X.509 (S/MIME)."
+"Tento sloupec indikuje typ certifik?tu. P?smeno 'P' znamen? OpenPGP, 'X' znamen? X.509 (S/"
+"MIME)."
+
+msgid "The key ID is a short number to identify a certificate."
+msgstr "ID kl??e je kr?tk? ??slo k identifikaci certifik?tu."
 
 msgid "The Expiry Date is the date until the certificate is valid."
 msgstr "Datum vypr?en? je datum, do kter?ho je certifik?t platn?."
@@ -1155,50 +1091,43 @@ msgid "Owner Trust"
 msgstr "D?v?ra ve vlastn?ka"
 
 msgid ""
-"The Owner Trust has been set by you and describes how far you trust the "
-"holder of the certificate to correctly sign (certify) other certificates.  "
-"It is only meaningful for OpenPGP."
+"The Owner Trust has been set by you and describes how far you trust the holder of the "
+"certificate to correctly sign (certify) other certificates.  It is only meaningful for "
+"OpenPGP."
 msgstr ""
-"V?mi nastaven? d?v?ra ve vlastn?ka popisuje jak dalece v???te, ?e dr?itel "
-"certifik?tu korektn? podepisuje (certifikuje) ostatn? certifik?ty. To m? "
-"smysl pouze pro OpenPGP."
+"V?mi nastaven? d?v?ra ve vlastn?ka popisuje jak dalece v???te, ?e dr?itel certifik?tu "
+"korektn? podepisuje (certifikuje) ostatn? certifik?ty. To m? smysl pouze pro OpenPGP."
 
 msgid "Validity"
 msgstr "Platnost"
 
 msgid ""
-"The Validity describes the trust level the system has in this certificate.  "
-"That is how sure it is that the named user is actually that user."
+"The Validity describes the trust level the system has in this certificate.  That is how "
+"sure it is that the named user is actually that user."
 msgstr ""
-"Platnost popisuje ?rove? d?v?ry syst?mu v??i tomuto certifik?tu. ??k?, jak "
-"jste si jisti, ?e dan? u?ivatel je skute?n? t?m, za koho se vyd?v?."
+"Platnost popisuje ?rove? d?v?ry syst?mu v??i tomuto certifik?tu. ??k?, jak jste si jisti, "
+"?e dan? u?ivatel je skute?n? t?m, za koho se vyd?v?."
 
-msgid ""
-"The User Name is the name and often also the email address  of the "
-"certificate."
-msgstr ""
-"U?ivatelsk? jm?no je vlastn? jm?no a v?t?inou tak? emailov? adresa "
-"certifik?tu."
+msgid "The User Name is the name and often also the email address  of the certificate."
+msgstr "U?ivatelsk? jm?no je vlastn? jm?no a v?t?inou tak? emailov? adresa certifik?tu."
 
 msgid "No keys selected for signing."
 msgstr "Nebyl vybr?n kl?? pro podpis."
 
 msgid ""
-"You do not have a private key yet. Do you want to generate one now "
-"(recommended) or do it later?"
+"You do not have a private key yet. Do you want to generate one now (recommended) or do it "
+"later?"
 msgstr ""
-"Je?t? nem?te ??dn? soukrom? kl??. Chcete jej vytvo?it nyn? (doporu?eno), "
-"nebo pozd?ji?"
+"Je?t? nem?te ??dn? soukrom? kl??. Chcete jej vytvo?it nyn? (doporu?eno), nebo pozd?ji?"
 
 msgid "_Generate key now"
 msgstr "_Vytvo?it kl?? nyn?"
 
 msgid ""
-"You do not have a backup copy of your private key yet. Do you want to backup "
-"your key now (recommended) or do it later?"
+"You do not have a backup copy of your private key yet. Do you want to backup your key now "
+"(recommended) or do it later?"
 msgstr ""
-"Nem?te z?lo?n? kopii soukrom?ho kl??e. Chcete ji vytvo?it nyn? (doporu?eno), "
-"nebo pozd?ji?"
+"Nem?te z?lo?n? kopii soukrom?ho kl??e. Chcete ji vytvo?it nyn? (doporu?eno), nebo pozd?ji?"
 
 msgid "_Backup key now"
 msgstr "_Z?lohovat kl?? nyn?"
@@ -1269,14 +1198,6 @@ msgstr "_Z?skat kl??e..."
 msgid "Retrieve keys from server"
 msgstr "Z?skat kl??e ze serveru"
 
-#, fuzzy
-msgid "Re_fresh Keys"
-msgstr "Aktualizovat keyring"
-
-#, fuzzy
-msgid "Refresh keys from server"
-msgstr "Z?skat kl??e ze serveru"
-
 msgid "_Send Keys..."
 msgstr "Ode_slat kl??e..."
 
@@ -1310,6 +1231,9 @@ msgstr "Zvolen? v?choz? kl??:"
 msgid "No default key selected in the preferences."
 msgstr "V p?edvolb?ch nebyl zvolen ??dn? v?choz? kl??."
 
+msgid "GNU Privacy Assistant - Key Manager"
+msgstr "GNU Privacy Assistant - Spr?vce kl???"
+
 msgid "Key Manager"
 msgstr "Spr?vce kl???"
 
@@ -1339,6 +1263,9 @@ msgstr[2] "%d kl??? vybr?no"
 msgid "User name:"
 msgstr "U?ivatelsk? jm?no:"
 
+msgid "Fingerprint:"
+msgstr "Otisk:"
+
 msgid "Expires at:"
 msgstr "Vypr??:"
 
@@ -1375,9 +1302,6 @@ msgstr "Podkl??e"
 msgid "Key"
 msgstr "Kl??"
 
-msgid "Tofu"
-msgstr ""
-
 msgid "Sign Key"
 msgstr "Podepsat kl??"
 
@@ -1385,11 +1309,11 @@ msgid "Do you want to sign the following key?"
 msgstr "Chcete podepsat tento kl???"
 
 msgid ""
-"Check the name and fingerprint carefully to be sure that it really is the "
-"key you want to sign."
+"Check the name and fingerprint carefully to be sure that it really is the key you want to "
+"sign."
 msgstr ""
-"Zkontrolujte pe?liv? jm?no a otisk kl??e abyste se ujistili, ?e je to "
-"opravdu kl?? kter? chcete podepsat."
+"Zkontrolujte pe?liv? jm?no a otisk kl??e abyste se ujistili, ?e je to opravdu kl?? kter? "
+"chcete podepsat."
 
 msgid "All user names in this key will be signed."
 msgstr "V?echna jm?na u?ivatele v tomto kl??i budou podeps?na."
@@ -1401,18 +1325,18 @@ msgid "Sign only _locally"
 msgstr "Podepsat pouze _lok?ln?"
 
 msgid ""
-"It seems that no CMS engine is installed.\n"
+"It seems that GPGSM is not installed.\n"
 "\n"
 "Temporary disabling support for X.509.\n"
 "\n"
-"Please install a CMS engine or invoke this program\n"
+"Please install GPGSM or invoke this program\n"
 "with the option --disable-x509 ."
 msgstr ""
-"Nejsp?? nen? nainstalov?n ??dn? CMS.\n"
+"GPGSM z?ejm? nen? nainstalov?n.\n"
 "\n"
 "Podpora X.509 bude do?asn? vypnuta.\n"
 "\n"
-"Nainstalujte pros?m CMS nebo spou?t?jte tento program\n"
+"Nainstalujte pros?m GPGSM nebo spus?te tento program\n"
 "s parametrem --disable-x509 ."
 
 msgid ""
@@ -1428,62 +1352,54 @@ msgstr "Zm?nit ?rove? d?v?ry ve vlastn?ka kl??e"
 msgid "_Unknown"
 msgstr "Ne_zn?m?"
 
-msgid ""
-"You don't know how much to trust this user to verify other people's keys.\n"
-msgstr ""
-"Nev?m zda mohu v??it, ?e tento u?ivatel je schopen ov??it kl??e jin?ch "
-"osob.\n"
+msgid "You don't know how much to trust this user to verify other people's keys.\n"
+msgstr "Nev?m zda mohu v??it, ?e tento u?ivatel je schopen ov??it kl??e jin?ch osob.\n"
 
 msgid "_Never"
 msgstr "??d_n?"
 
 msgid ""
-"You don't trust this user at all to verify the validity of other people's "
-"keys at all.\n"
+"You don't trust this user at all to verify the validity of other people's keys at all.\n"
 msgstr ""
-"V?bec nev???m, ?e tento u?ivatel je schopen spr?vn? ov??it validitu kl??? "
-"jin?ch osob.\n"
+"V?bec nev???m, ?e tento u?ivatel je schopen spr?vn? ov??it validitu kl??? jin?ch osob.\n"
 
 msgid "_Marginal"
 msgstr "??ste?n?"
 
 msgid ""
-"You don't trust this user's ability to verify the validity of other people's "
-"keys enough to consider keys valid based on his/her sole word.\n"
-"However, provided this user's key is valid, you will consider a key signed "
-"by this user valid if it is also signed by at least other two marginally "
-"trusted users with valid keys\n"
+"You don't trust this user's ability to verify the validity of other people's keys enough to "
+"consider keys valid based on his/her sole word.\n"
+"However, provided this user's key is valid, you will consider a key signed by this user "
+"valid if it is also signed by at least other two marginally trusted users with valid keys\n"
 msgstr ""
-"Nev???m, ?e tento u?ivatel je schopen dostate?n? ov??it validitu kl??? "
-"jin?ch osob, abych mohl pova?ovat tyto kl??e za d?v?ryhodn? pouze na z?klad? "
-"jeho prohl??en?.\n"
+"Nev???m, ?e tento u?ivatel je schopen dostate?n? ov??it validitu kl??? jin?ch osob, abych "
+"mohl pova?ovat tyto kl??e za d?v?ryhodn? pouze na z?klad? jeho prohl??en?.\n"
 
 msgid "_Full"
 msgstr "_Pln?"
 
 msgid ""
-"You trust this user's ability to verify the validity of other people's keys "
-"so much, that you'll consider valid any key signed by him/her, provided this "
-"user's key is valid.\n"
+"You trust this user's ability to verify the validity of other people's keys so much, that "
+"you'll consider valid any key signed by him/her, provided this user's key is valid.\n"
 msgstr ""
-"V???m, ?e tento u?ivatel je schopen dostate?n? ov??it kl??e jin?ch osob, "
-"abych mohl kl??e j?m podepsan? pova?ovat za d?v?ryhodn?.\n"
+"V???m, ?e tento u?ivatel je schopen dostate?n? ov??it kl??e jin?ch osob, abych mohl kl??e "
+"j?m podepsan? pova?ovat za d?v?ryhodn?.\n"
 
 msgid "U_ltimate"
 msgstr "Absolutn?"
 
 msgid ""
-"You consider this key valid, and trust the user so much that you will "
-"consider any key signed by him/her fully valid.\n"
+"You consider this key valid, and trust the user so much that you will consider any key "
+"signed by him/her fully valid.\n"
 "\n"
-"(Warning: This is intended to be used for keys you own. Don't use it with "
-"other people's keys unless you really know what you are doing)\n"
+"(Warning: This is intended to be used for keys you own. Don't use it with other people's "
+"keys unless you really know what you are doing)\n"
 msgstr ""
-"Pova?uji kl?? za validn? a d?v??uji tomuto u?ivateli natolik, ?e v?echny "
-"kl??e kter? podepsal pova?uji za naprosto d?v?ryhodn?.\n"
+"Pova?uji kl?? za validn? a d?v??uji tomuto u?ivateli natolik, ?e v?echny kl??e kter? "
+"podepsal pova?uji za naprosto d?v?ryhodn?.\n"
 "\n"
-"(Pozor: tato ?rove? je ur?ena pro kl??e, kter? vlastn?te. Nepou??vejte ji "
-"pro kl??e jin?ch osob pokud si nejste opravdu jist?/? co d?l?te.)\n"
+"(Pozor: tato ?rove? je ur?ena pro kl??e, kter? vlastn?te. Nepou??vejte ji pro kl??e jin?ch "
+"osob pokud si nejste opravdu jist?/? co d?l?te.)\n"
 
 msgid ""
 "In \"Passphrase\" and \"Repeat passphrase\",\n"
@@ -1528,28 +1444,18 @@ msgstr "Opakovat heslo: "
 msgid "Recipient"
 msgstr "P??jemce"
 
-msgid ""
-"Shows the recipients of the message. A key needs to be assigned to each "
-"recipient."
+msgid "Shows the recipients of the message. A key needs to be assigned to each recipient."
 msgstr "Zobraz? p??jemce zpr?vy. Ke ka?d?mu p??jemci mus? b?t p?i?azen kl??."
 
 msgid "Checked if at least one matching OpenPGP certificate has been found."
-msgstr ""
-"Zkontrolujte zda byl nalezen alespo? jeden odpov?daj?c? OpenPGP certifik?t."
+msgstr "Zkontrolujte zda byl nalezen alespo? jeden odpov?daj?c? OpenPGP certifik?t."
 
-msgid ""
-"Checked if at least one matching X.509 certificate for use with S/MIME has "
-"been found."
+msgid "Checked if at least one matching X.509 certificate for use with S/MIME has been found."
 msgstr ""
-"Zkontrolujte zda byl nalezen alespo? jeden odpov?daj?c? X.509 certifik?t pro "
-"pou?it? s S/MIME."
-
-msgid "Key ID"
-msgstr "ID kl??e"
+"Zkontrolujte zda byl nalezen alespo? jeden odpov?daj?c? X.509 certifik?t pro pou?it? s S/"
+"MIME."
 
-msgid ""
-"Shows the key ID of the selected key or an indication that a key needs to be "
-"selected."
+msgid "Shows the key ID of the selected key or an indication that a key needs to be selected."
 msgstr "Zobraz? ID vybran?ho kl??e  nebo upozorn?n?, ?e kl?? mus? b?t vybr?n."
 
 msgid ""
@@ -1567,12 +1473,11 @@ msgstr ""
 "V?b?r provedete kliknut?m prav?ho tla??tka my?i na p??slu?n? ??dek."
 
 msgid ""
-"Although you selected keys for all recipients a common encryption protocol "
-"can't be used. Please decide on one protocol by clicking one of the above "
-"radio buttons."
+"Although you selected keys for all recipients a common encryption protocol can't be used. "
+"Please decide on one protocol by clicking one of the above radio buttons."
 msgstr ""
-"P?esto?e jste vybrali kl??e pro v?echny p??jemce, nem??e b?t pou?it obvykl? "
-"?ifrovac? protokol. Vyberte a za?krtn?te pros?m jeden z nab?zen?ch protokol?."
+"P?esto?e jste vybrali kl??e pro v?echny p??jemce, nem??e b?t pou?it obvykl? ?ifrovac? "
+"protokol. Vyberte a za?krtn?te pros?m jeden z nab?zen?ch protokol?."
 
 msgid "Using OpenPGP for encryption."
 msgstr "Pou??t OpenPGP pro ?ifrov?n?."
@@ -1724,15 +1629,14 @@ msgid "Show advanced _options"
 msgstr "Zobrazit roz???en? v_olby"
 
 msgid ""
-"No default key has been selected.  This may lead to problems when signing or "
-"encrypting.  For example you might later not be able to read a mail written "
-"by you and encrypted to someone else.\n"
+"No default key has been selected.  This may lead to problems when signing or encrypting.  "
+"For example you might later not be able to read a mail written by you and encrypted to "
+"someone else.\n"
 "\n"
 "Please consider creating your own key and select it then."
 msgstr ""
-"Nebyl zvolen ??dn? v?choz? kl??. To m??e v?st k probl?m?m p?i podepisov?n? "
-"nebo ?ifrov?n?. Nemus? b?t nap??klad mo?n? p?e??st v?mi vytvo?enou zpr?vu "
-"za?ifrovanou pro n?koho jin?ho.\n"
+"Nebyl zvolen ??dn? v?choz? kl??. To m??e v?st k probl?m?m p?i podepisov?n? nebo ?ifrov?n?. "
+"Nemus? b?t nap??klad mo?n? p?e??st v?mi vytvo?enou zpr?vu za?ifrovanou pro n?koho jin?ho.\n"
 "\n"
 "Zva?te pros?m vytvo?en? vlastn?ho kl??e a ozna?te jej."
 
@@ -1753,8 +1657,8 @@ msgstr "<b>Automatick? na_lezen? kl??e</b>"
 
 msgid ""
 "The list of methods to locate keys via an email address.\n"
-"All given methods are used in turn until a matching key is found.  The "
-"supported methods are:\n"
+"All given methods are used in turn until a matching key is found.  The supported methods "
+"are:\n"
 " Local\n"
 "   - Use the local keyring.\n"
 " Keyserver\n"
@@ -1767,8 +1671,8 @@ msgid ""
 "   - Configured in the backend dialog.\n"
 msgstr ""
 "Seznam metod nalezen? kl??? prost?ednictv?m emailov? adresy.\n"
-"V?echny uveden? metody jsou pou?ity v dan?m po?ad? dokud nen? nalezen kl??. "
-"Podporov?ny jsou:\n"
+"V?echny uveden? metody jsou pou?ity v dan?m po?ad? dokud nen? nalezen kl??. Podporov?ny "
+"jsou:\n"
 " Lok?ln?\n"
 "   - Pou??t lok?ln? kl??enku.\n"
 " Keyserver\n"
@@ -1795,8 +1699,8 @@ msgstr "Zadan? URL serveru kl??? nen? platn?."
 msgid "The data given for \"Auto key locate\" is not valid."
 msgstr "Data p?edan? pro \"Automatick? nalezen? kl??e\" nejsou platn?."
 
-msgid "Settings"
-msgstr "Nastaven?"
+msgid "GNU Privacy Assistant - Settings"
+msgstr "GNU Privacy Assistant - Nastaven?"
 
 msgid "Level"
 msgstr "?rove?"
@@ -1824,8 +1728,8 @@ msgstr "Podpis: %s"
 msgid "Signatures:"
 msgstr "Podpisy:"
 
-msgid "Card Manager"
-msgstr "Spr?vce karet"
+msgid "GNU Privacy Assistant - Card Manager"
+msgstr "GNU Privacy Assistant - Spr?vce karet"
 
 #, c-format
 msgid "%s card detected."
@@ -1841,11 +1745,9 @@ msgid "The selected card application is currently not available."
 msgstr "Zvolen? aplikace karty v tuto chv?li nen? dostupn?."
 
 msgid ""
-"Another process is using a different card application than the selected "
-"one.\n"
+"Another process is using a different card application than the selected one.\n"
 "\n"
-"You may change the application selection mode to \"Auto\" to select the "
-"active application."
+"You may change the application selection mode to \"Auto\" to select the active application."
 msgstr ""
 "Jin? proces pou??v? odli?nou aplikaci karty ne? tu kter? je vybr?na.\n"
 "\n"
@@ -1875,6 +1777,9 @@ msgstr "Vytvo?it nov? kl?? na kart?"
 msgid "This card application is not yet supported."
 msgstr "Tato aplikace karty nen? zat?m podporov?na."
 
+msgid "Card Manager"
+msgstr "Spr?vce karet"
+
 msgid "Application selection:"
 msgstr "Volba aplikace: "
 
@@ -1887,29 +1792,27 @@ msgstr "Knihovna GPGME je p??li? zastaral? aby podporovala ?ipov? karty."
 msgid ""
 "<b>Admin-PIN Required</b>\n"
 "\n"
-"Depending on the previous operations you may now be asked for the Admin-"
-"PIN.  Entering a wrong value for the Admin-PIN decrements the corresponding "
-"retry counter. If the retry counter is down to zero, the Admin-PIN can't be "
-"restored anymore and thus the data on the card can't be modified.\n"
+"Depending on the previous operations you may now be asked for the Admin-PIN.  Entering a "
+"wrong value for the Admin-PIN decrements the corresponding retry counter. If the retry "
+"counter is down to zero, the Admin-PIN can't be restored anymore and thus the data on the "
+"card can't be modified.\n"
 "\n"
-"Unless changed, a fresh standard card has set the Admin-PIN to the value "
-"<i>12345678</i>.  However, the issuer of your card might have initialized "
-"the card with a different Admin-PIN and that Admin-PIN might only be known "
-"to the issuer.  Please check the instructions of your issuer.\n"
+"Unless changed, a fresh standard card has set the Admin-PIN to the value <i>12345678</i>.  "
+"However, the issuer of your card might have initialized the card with a different Admin-PIN "
+"and that Admin-PIN might only be known to the issuer.  Please check the instructions of "
+"your issuer.\n"
 "\n"
 "This notice will be shown only once per session."
 msgstr ""
 "<b>Admin-PIN po?adov?n</b>\n"
 "\n"
-"V z?vislosti na p?edchoz?ch operac?ch m??ete b?t nyn? po??d?ni o Admin-PIN. "
-"Vlo?en? ?patn? hodnoty Admin-PIN sn??? odpov?daj?c? ??ta? opakov?n?. Pokud "
-"??ta? dos?hne nuly, Admin-PIN nelze obnovit a data na kart? nemohu b?t "
-"zm?n?na.\n"
+"V z?vislosti na p?edchoz?ch operac?ch m??ete b?t nyn? po??d?ni o Admin-PIN. Vlo?en? ?patn? "
+"hodnoty Admin-PIN sn??? odpov?daj?c? ??ta? opakov?n?. Pokud ??ta? dos?hne nuly, Admin-PIN "
+"nelze obnovit a data na kart? nemohu b?t zm?n?na.\n"
 "\n"
-"Pokud nebyl zm?n?n, nov? standardn? karta m? nastaven Admin-PIN na hodnotu "
-"<i>12345678</i>. Nicm?n? vydavatel mohl va?i kartu inicializovat s jin?m "
-"Admin-PIN a ten tedy bude zn?m pouze vydavateli. Zkontrolujte pros?m "
-"instrukce od va?eho vydavatele.\n"
+"Pokud nebyl zm?n?n, nov? standardn? karta m? nastaven Admin-PIN na hodnotu <i>12345678</i>. "
+"Nicm?n? vydavatel mohl va?i kartu inicializovat s jin?m Admin-PIN a ten tedy bude zn?m "
+"pouze vydavateli. Zkontrolujte pros?m instrukce od va?eho vydavatele.\n"
 "\n"
 "Toto ozn?men? bude zobrazeno pouze jednou za relaci."
 
@@ -1948,8 +1851,7 @@ msgstr "Znak \"<\" nelze pou??t."
 msgid "Double spaces are not allowed."
 msgstr "V?ce mezer nen? povoleno."
 
-msgid ""
-"Total length of first and last name may not be longer than 39 characters."
+msgid "Total length of first and last name may not be longer than 39 characters."
 msgstr "Celkov? d?lka k?estn?ho jm?na a p??jmen? nesm? p?es?hnout 39 znak?."
 
 msgid "Saving the field failed."
@@ -1969,127 +1871,115 @@ msgid ""
 "\n"
 "The retry counter of the PIN is down to zero but a Reset Code has been set.\n"
 "\n"
-"The Reset Code is similar to a PUK (PIN Unblocking Code)and used to unblock "
-"a PIN without the need to know the Admin-PIN.\n"
+"The Reset Code is similar to a PUK (PIN Unblocking Code)and used to unblock a PIN without "
+"the need to know the Admin-PIN.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the <b>Reset "
-"Code</b> and then to enter a new value for the PIN and repeat that new value "
-"at another prompt."
+"If you proceed you will be asked to enter the current value of the <b>Reset Code</b> and "
+"then to enter a new value for the PIN and repeat that new value at another prompt."
 msgstr ""
 "<b>Odblokov?n? PIN</b>\n"
 "\n"
 "??ta? opakovan?ho zad?n? PIN je na nule, ale je nastaven Reset k?d.\n"
 "\n"
-"Reset k?d je podobn? PUK (PIN Unblocking Code) a je pou??v?n pro odblokov?n? "
-"PIN bez nutnosti zn?t Admin-PIN.\n"
+"Reset k?d je podobn? PUK (PIN Unblocking Code) a je pou??v?n pro odblokov?n? PIN bez "
+"nutnosti zn?t Admin-PIN.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu "
-"<b>Reset k?du</b> , pot? novou hodnotu PIN a tu na dal??m ??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu <b>Reset k?du</"
+"b> , pot? novou hodnotu PIN a tu na dal??m ??dku zopakovali."
 
-#, fuzzy
 msgid ""
 "<b>Changing the PIN</b>\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the PIN and "
-"then to enter a new value and repeat that value at another prompt.\n"
+"If you proceed you will be asked to enter the current value of the PIN and then to enter a "
+"new value and repeat that value at another prompt.\n"
 "\n"
-"Entering a wrong value for the PIN decrements the retry counter.  If the "
-"retry counters of the PIN and of the Reset Code are both down to zero, the "
-"PIN can still be reset by using the Admin-PIN.\n"
+"Entering a wrong value for the PIN decrements the retry counter.  If the retry counters of "
+"the PIN and of the Reset Code are both down to zero, the PIN can still be reseted by using "
+"the Admin-PIN.\n"
 "\n"
-"A fresh standard card has set the PIN to the value <i>123456</i>.  However, "
-"the issuer of your card might have initialized the card with a different "
-"PIN.  Please check the instructions of your issuer."
+"A fresh standard card has set the PIN to the value <i>123456</i>.  However, the issuer of "
+"your card might have initialized the card with a different PIN.  Please check the "
+"instructions of your issuer."
 msgstr ""
 "<b>Zm?na PIN</b>\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu "
-"PIN, pot? novou hodnotu a tu na dal??m ??dku zopakovali.\n"
+"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu PIN, pot? novou "
+"hodnotu a tu na dal??m ??dku zopakovali.\n"
 "\n"
-"Vlo?en? nespr?vn? hodnoty PIN sn??? ??ta? opakovan?ho zad?n?. Pokud oba "
-"??ta?e opakov?n? pro PIN a Reset k?d klesnou na nulu, m??e b?t PIN "
-"odblokov?n pou?it?m Admin-PIN.\n"
+"Vlo?en? nespr?vn? hodnoty PIN sn??? ??ta? opakovan?ho zad?n?. Pokud oba ??ta?e opakov?n? "
+"pro PIN a Reset k?d klesnou na nulu, m??e b?t PIN odblokov?n pou?it?m Admin-PIN.\n"
 "\n"
-"?ist? standardn? karta m? PIN nastaven na hodnotu <i>12345678</i>. Nicm?n? "
-"vydavatel mohl va?i kartu inicializovat s jin?m PIN. Zkontrolujte pros?m "
-"instrukce od va?eho vydavatele."
+"?ist? standardn? karta m? PIN nastaven na hodnotu <i>12345678</i>. Nicm?n? vydavatel mohl "
+"va?i kartu inicializovat s jin?m PIN. Zkontrolujte pros?m instrukce od va?eho vydavatele."
 
 msgid ""
 "<b>Changing the Reset Code</b>\n"
 "\n"
-"The Reset Code is similar to a PUK (PIN Unblocking Code) and used to unblock "
-"a PIN without the need to know the Admin-PIN.\n"
+"The Reset Code is similar to a PUK (PIN Unblocking Code) and used to unblock a PIN without "
+"the need to know the Admin-PIN.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the PIN and "
-"then to enter a new value for the Reset Code and repeat that new value at "
-"another prompt."
+"If you proceed you will be asked to enter the current value of the PIN and then to enter a "
+"new value for the Reset Code and repeat that new value at another prompt."
 msgstr ""
 "<b>Zm?na Reset k?du</b>\n"
 "\n"
-"Reset k?d je podobn? PUK (PIN Unblocking Code) a je pou??v?n pro odblokov?n? "
-"PIN bez nutnosti zn?t Admin-PIN.\n"
+"Reset k?d je podobn? PUK (PIN Unblocking Code) a je pou??v?n pro odblokov?n? PIN bez "
+"nutnosti zn?t Admin-PIN.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu "
-"PIN, pot? novou hodnotu Reset k?du a tu na dal??m ??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu PIN, pot? novou "
+"hodnotu Reset k?du a tu na dal??m ??dku zopakovali."
 
-#, fuzzy
 msgid ""
-"<b>Resetting the PIN or the Reset Code</b>\n"
+"<b>Reseting the PIN or the Reset Code</b>\n"
 "\n"
-"If the retry counters of the PIN and of the Reset Code are both down to "
-"zero, it is only possible to reset them if you have access to the Admin-"
-"PIN.\n"
+"If the retry counters of the PIN and of the Reset Code are both down to zero, it is only "
+"possible to reset them if you have access to the Admin-PIN.\n"
 "\n"
-"A fresh standard card has set the Admin-PIN to the value <i>12345678</i>.  "
-"However, the issuer of your card might have initialized the card with a "
-"different Admin-PIN and that Admin-PIN might only be known to the issuer.  "
-"Please check the instructions of your issuer.\n"
+"A fresh standard card has set the Admin-PIN to the value <i>12345678</i>.  However, the "
+"issuer of your card might have initialized the card with a different Admin-PIN and that "
+"Admin-PIN might only be nown to the issuer.  Please check the instructions of your issuer.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the <b>Admin-"
-"PIN</b> and then to enter a new value for the PIN or the Reset Code and "
-"repeat that new value at another prompt."
+"If you proceed you will be asked to enter the current value of the <b>Admin-PIN</b> and "
+"then to enter a new value for the PIN or the Reset Code and repeat that new value at "
+"another prompt."
 msgstr ""
 "<b>Resetov?n? PIN nebo Reset k?du</b>\n"
 "\n"
-"Pokud klesnou oba ??ta?e opakov?n? PIN a Reset k?du na nulu, bude jedinou "
-"mo?nost? jejich resetu pou?it? Admin-PIN\n"
+"Pokud klesnou oba ??ta?e opakov?n? PIN a Reset k?du na nulu, bude jedinou mo?nost? jejich "
+"resetu pou?it? Admin-PIN\n"
 "\n"
-"?ist? standardn? karta m? Admin-PIN nastaven na hodnotu <i>12345678</i>. "
-"Nicm?n? vydavatel mohl va?i kartu inicializovat s jin?m Admin-PIN a ten tedy "
-"bude zn?m pouze jemu. Zkontrolujte pros?m instrukce od va?eho vydavatele.\n"
+"?ist? standardn? karta m? Admin-PIN nastaven na hodnotu <i>12345678</i>. Nicm?n? vydavatel "
+"mohl va?i kartu inicializovat s jin?m Admin-PIN a ten tedy bude zn?m pouze jemu. "
+"Zkontrolujte pros?m instrukce od va?eho vydavatele.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu "
-"<b>Admin-PIN</b>, pot? novou hodnotu PIN nebo Reset k?du a tu na dal??m "
-"??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu <b>Admin-PIN</b>, "
+"pot? novou hodnotu PIN nebo Reset k?du a tu na dal??m ??dku zopakovali."
 
 msgid ""
 "<b>Changing the Admin-PIN</b>\n"
 "\n"
 "If you know the Admin-PIN you may change the Admin-PIN.\n"
 "\n"
-"The Admin-PIN is required to create keys on the card and to change other "
-"data.  You may or may not know the Admin-PIN.  A fresh standard card has set "
-"the Admin-PIN to the value <i>12345678</i>.  However, the issuer of your "
-"card might have initialized the card with a different Admin-PIN and that "
-"Admin-PIN might only be known to the issuer.  Please check the instructions "
-"of your issuer.\n"
+"The Admin-PIN is required to create keys on the card and to change other data.  You may or "
+"may not know the Admin-PIN.  A fresh standard card has set the Admin-PIN to the value "
+"<i>12345678</i>.  However, the issuer of your card might have initialized the card with a "
+"different Admin-PIN and that Admin-PIN might only be known to the issuer.  Please check the "
+"instructions of your issuer.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the <b>Admin-"
-"PIN</b> and then to enter a new value for that Admin-PIN and repeat that new "
-"value at another prompt."
+"If you proceed you will be asked to enter the current value of the <b>Admin-PIN</b> and "
+"then to enter a new value for that Admin-PIN and repeat that new value at another prompt."
 msgstr ""
 "<b>Zm?na Admin-PIN</b>\n"
 "\n"
 "Zn?te-li Admin-PIN, m??ete jej zm?nit.\n"
 "\n"
-"Admin-PIN je vy?adovan? p?i tvorb? kl??? na kart? a zm?n? dal??ch dat. Admin-"
-"PIN m??ete, ale tak? nemus?te zn?t. ?ist? standardn? karta m? Admin-PIN "
-"nastaven na hodnotu <i>12345678</i>. Nicm?n? vydavatel mohl va?i kartu "
-"inicializovat s jin?m Admin-PIN a ten tedy bude zn?m pouze jemu. "
-"Zkontrolujte pros?m instrukce od va?eho vydavatele.\n"
+"Admin-PIN je vy?adovan? p?i tvorb? kl??? na kart? a zm?n? dal??ch dat. Admin-PIN m??ete, "
+"ale tak? nemus?te zn?t. ?ist? standardn? karta m? Admin-PIN nastaven na hodnotu "
+"<i>12345678</i>. Nicm?n? vydavatel mohl va?i kartu inicializovat s jin?m Admin-PIN a ten "
+"tedy bude zn?m pouze jemu. Zkontrolujte pros?m instrukce od va?eho vydavatele.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu "
-"<b>Admin-PIN</b>, pot? novou hodnotu a tu na dal??m ??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?n?, abyste vlo?ili sou?asnou hodnotu <b>Admin-PIN</b>, "
+"pot? novou hodnotu a tu na dal??m ??dku zopakovali."
 
 #, c-format
 msgid ""
@@ -2181,23 +2071,22 @@ msgid "Learn keys"
 msgstr "U?it kl??e"
 
 msgid ""
-"For some or all of the keys available on the card, the GnuPG crypto engine "
-"does not yet know the corresponding certificates.\n"
+"For some or all of the keys available on the card, the GnuPG crypto engine does not yet "
+"know the corresponding certificates.\n"
 "\n"
-"If you click this button, GnuPG will be asked to \"learn\" this card and "
-"import all certificates stored on the card into its own certificate store.  "
-"This is not done automatically because it may take several seconds to read "
-"all certificates from the card.\n"
+"If you click this button, GnuPG will be asked to \"learn\" this card and import all "
+"certificates stored on the card into its own certificate store.  This is not done "
+"automatically because it may take several seconds to read all certificates from the card.\n"
 "\n"
 "If you are unsure what to do, just click the button."
 msgstr ""
-"Pro n?kter? nebo v?echny kl??e dostupn? na kart? nezn? GnuPG ?ifrovac? stroj "
-"odpov?daj?c? certifik?ty.\n"
+"Pro n?kter? nebo v?echny kl??e dostupn? na kart? nezn? GnuPG ?ifrovac? stroj odpov?daj?c? "
+"certifik?ty.\n"
 "\n"
-"Pokud kliknete na toto tla??tko, GnuPG bude po??d?n, aby se \"nau?il\" tuto "
-"kartu a importoval v?echny certifik?ty ulo?en? na kart? do sv?ho vlastn?ho "
-"?lo?i?t? certifik?t?. Tato operace nen? prov?d?na automaticky. ?ten? v?ech "
-"certifik?t? z karty m??e trvat n?kolik sekund.\n"
+"Pokud kliknete na toto tla??tko, GnuPG bude po??d?n, aby se \"nau?il\" tuto kartu a "
+"importoval v?echny certifik?ty ulo?en? na kart? do sv?ho vlastn?ho ?lo?i?t? certifik?t?. "
+"Tato operace nen? prov?d?na automaticky. ?ten? v?ech certifik?t? z karty m??e trvat n?kolik "
+"sekund.\n"
 "\n"
 "Pokud si nejste jist? co d?lat, klikn?te na tla??tko."
 
@@ -2208,49 +2097,42 @@ msgstr "Kl??e jsou u?eny"
 msgid ""
 "<b>Setting the Initial PIN</b> (%s)\n"
 "\n"
-"You selected to set the initial PIN of your card.  The PIN is currently set "
-"to the NullPIN.  Setting an initial PIN is <b>required but can't be "
-"reverted</b>.\n"
+"You selected to set the initial PIN of your card.  The PIN is currently set to the "
+"NullPIN.  Setting an initial PIN is <b>required but can't be reverted</b>.\n"
 "\n"
-"Please check the documentation of your card to learn for what the NullPIN is "
-"good.\n"
+"Please check the documentation of your card to learn for what the NullPIN is good.\n"
 "\n"
-"If you proceeed you will be asked to enter a new PIN and later to repeat "
-"that PIN.  Make sure that you will remember that PIN - it will not be "
-"possible to recover the PIN if it has been entered wrongly more than %d "
-"times.\n"
+"If you proceeed you will be asked to enter a new PIN and later to repeat that PIN.  Make "
+"sure that you will remember that PIN - it will not be possible to recover the PIN if it has "
+"been entered wrongly more than %d times.\n"
 "\n"
 "%s"
 msgstr ""
 "<b>Nastaven? v?choz?ho PIN</b> (%s)\n"
 "\n"
-"Zvolili jste mo?nost nastavit v?choz? PIN va?? karty. PIN je v tuto chv?li "
-"nastaven na NullPIN. Nastaven? v?choz?ho PIN je <b>vy?adov?n? ale nem??e b?t "
-"odvol?no</b>.\n"
+"Zvolili jste mo?nost nastavit v?choz? PIN va?? karty. PIN je v tuto chv?li nastaven na "
+"NullPIN. Nastaven? v?choz?ho PIN je <b>vy?adov?n? ale nem??e b?t odvol?no</b>.\n"
 "\n"
-"Zkontrolujte pros?m dokumentaci va?? karty a pod?vejte se k ?emu je NullPIN "
-"dobr?.\n"
+"Zkontrolujte pros?m dokumentaci va?? karty a pod?vejte se k ?emu je NullPIN dobr?.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?ni abyste vlo?ili nov? PIN, pozd?ji "
-"abyste jej opakovali. Ujist?te se, ?e si PIN pamatujete - nebude mo?n? jej "
-"obnovit pokud bude zad?n v?ce ne? %d kr?t nespr?vn?.\n"
+"Pokud budete pokra?ovat, budete vyzv?ni abyste vlo?ili nov? PIN, pozd?ji abyste jej "
+"opakovali. Ujist?te se, ?e si PIN pamatujete - nebude mo?n? jej obnovit pokud bude zad?n "
+"v?ce ne? %d kr?t nespr?vn?.\n"
 "\n"
 "%s"
 
 msgid ""
-"You are now setting the PIN for the SigG key used to create <b>qualified "
-"signatures</b>.  You may want to set the PIN to the same value as used for "
-"the NKS keys."
+"You are now setting the PIN for the SigG key used to create <b>qualified signatures</b>.  "
+"You may want to set the PIN to the same value as used for the NKS keys."
 msgstr ""
-"Nyn? nastavujete PIN pro SigG kl??e pou??van? pro vytv??en? "
-"<b>kvalifikovan?ch podpis?</b>. PIN m??ete nastavit stejn? jako u NKS kl???."
+"Nyn? nastavujete PIN pro SigG kl??e pou??van? pro vytv??en? <b>kvalifikovan?ch podpis?</b>. "
+"PIN m??ete nastavit stejn? jako u NKS kl???."
 
 msgid ""
-"You are now setting the PIN for the NKS keys used for standard signatures, "
-"encryption and authentication."
+"You are now setting the PIN for the NKS keys used for standard signatures, encryption and "
+"authentication."
 msgstr ""
-"Nyn? nastavujete PIN pro NKS kl??e pou??van? pro b??n? podpisy, ?ifrov?n? a "
-"autentizaci."
+"Nyn? nastavujete PIN pro NKS kl??e pou??van? pro b??n? podpisy, ?ifrov?n? a autentizaci."
 
 #, c-format
 msgid ""
@@ -2263,70 +2145,63 @@ msgstr ""
 msgid ""
 "<b>Changing a PIN or PUK</b>\n"
 "\n"
-"If you proceed you will be asked to enter the current value and then to "
-"enter a new value and repeat that value at another prompt.\n"
+"If you proceed you will be asked to enter the current value and then to enter a new value "
+"and repeat that value at another prompt.\n"
 "\n"
-"Entering a wrong value for the current value decrements the retry counter.  "
-"If the retry counters of the PIN and the corresponding PUK are both down to "
-"zero, the keys controlled by the PIN are not anymore usable and there is no "
-"way to unblock them!"
+"Entering a wrong value for the current value decrements the retry counter.  If the retry "
+"counters of the PIN and the corresponding PUK are both down to zero, the keys controlled by "
+"the PIN are not anymore usable and there is no way to unblock them!"
 msgstr ""
 "<b>Zm?na PIN nebo PUK</b>\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu, "
-"pot? novou a zopakovali ji na dal??m ??dku.\n"
+"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu, pot? novou a "
+"zopakovali ji na dal??m ??dku.\n"
 "\n"
-"Vlo?en?m nespr?vn? hodnoty pro sou?asn? PIN/PUK sn???te ??ta? opakov?n?. "
-"Pokud oba ??ta?e (PIN a odpov?daj?c? PUK) klesnou na nulu, kl??e chr?n?n? "
-"t?mto PIN nebudou v?ce pou?iteln?. Ani je nebude mo?n? nikdy odblokovat!"
+"Vlo?en?m nespr?vn? hodnoty pro sou?asn? PIN/PUK sn???te ??ta? opakov?n?. Pokud oba ??ta?e "
+"(PIN a odpov?daj?c? PUK) klesnou na nulu, kl??e chr?n?n? t?mto PIN nebudou v?ce pou?iteln?. "
+"Ani je nebude mo?n? nikdy odblokovat!"
 
 msgid ""
 "<b>Resetting a PUK</b>\n"
 "\n"
-"Although <i>PUK</i> stands for <i>PIN Unblocking Code</i> the TCOS operating "
-"system of the NetKey card implements it as an alternative PIN and thus it is "
-"possible to use the PIN to unblock the PUK.\n"
+"Although <i>PUK</i> stands for <i>PIN Unblocking Code</i> the TCOS operating system of the "
+"NetKey card implements it as an alternative PIN and thus it is possible to use the PIN to "
+"unblock the PUK.\n"
 "\n"
-"If the PUK is blocked (the retry counter is down to zero), you may unblock "
-"it by using the non-blocked PIN.  The retry counter is then set back to its "
-"initial value.\n"
+"If the PUK is blocked (the retry counter is down to zero), you may unblock it by using the "
+"non-blocked PIN.  The retry counter is then set back to its initial value.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the PIN and "
-"then to enter a new value for the blocked PUK and repeat that new value at "
-"another prompt."
+"If you proceed you will be asked to enter the current value of the PIN and then to enter a "
+"new value for the blocked PUK and repeat that new value at another prompt."
 msgstr ""
 "<b>Resetov?n? PUK</b>\n"
 "\n"
-"P?esto?e <i>PUK</i> znamen? <i>k?d k odblokov?n? PIN (PIN Unblocking Code)</"
-"i> implementuje jej opera?n? syst?m TCOS karty NetKey jako alternativn? PIN "
-"a tut?? je mo?n? pou??t PIN pro odblokov?n? PUK.\n"
+"P?esto?e <i>PUK</i> znamen? <i>k?d k odblokov?n? PIN (PIN Unblocking Code)</i> implementuje "
+"jej opera?n? syst?m TCOS karty NetKey jako alternativn? PIN a tut?? je mo?n? pou??t PIN pro "
+"odblokov?n? PUK.\n"
 "\n"
-"Pokud je PUK zablokovan? (??ta? opakov?n? klesl na nulu), m??ete jej "
-"odblokovat pou?it?m neblokovan?ho PIN. ??ta? opakovan?ho zad?n? se vr?t? "
-"zp?t na p?vodn? hodnotu.\n"
+"Pokud je PUK zablokovan? (??ta? opakov?n? klesl na nulu), m??ete jej odblokovat pou?it?m "
+"neblokovan?ho PIN. ??ta? opakovan?ho zad?n? se vr?t? zp?t na p?vodn? hodnotu.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu PIN, "
-"pot? novou hodnotu pro blokovan? PUK a tu na dal??m ??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu PIN, pot? novou "
+"hodnotu pro blokovan? PUK a tu na dal??m ??dku zopakovali."
 
 msgid ""
 "<b>Resetting a PIN</b>\n"
 "\n"
-"If the PIN is blocked (the retry counter is down to zero), you may unblock "
-"it by using the non-blocked PUK.  The retry counter is then set back to its "
-"initial value.\n"
+"If the PIN is blocked (the retry counter is down to zero), you may unblock it by using the "
+"non-blocked PUK.  The retry counter is then set back to its initial value.\n"
 "\n"
-"If you proceed you will be asked to enter the current value of the PUK and "
-"then to enter a new value for the blocked PIN and repeat that new value at "
-"another prompt."
+"If you proceed you will be asked to enter the current value of the PUK and then to enter a "
+"new value for the blocked PIN and repeat that new value at another prompt."
 msgstr ""
 "<b>Resetovat PIN</b>\n"
 "\n"
-"Pokud je PIN zablokovan? (??ta? opakov?n? klesl na nulu), m??ete jej "
-"odblokovat pou?it?m neblokovan?ho PUK. ??ta? opakovan?ho zad?n? se vr?t? "
-"zp?t na p?vodn? hodnotu.\n"
+"Pokud je PIN zablokovan? (??ta? opakov?n? klesl na nulu), m??ete jej odblokovat pou?it?m "
+"neblokovan?ho PUK. ??ta? opakovan?ho zad?n? se vr?t? zp?t na p?vodn? hodnotu.\n"
 "\n"
-"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu PUK, "
-"pot? novou hodnotu pro blokovan? PIN a tu na dal??m ??dku zopakovali."
+"Pokud budete pokra?ovat, budete vyzv?ni abyste zadali sou?asnou hodnotu PUK, pot? novou "
+"hodnotu pro blokovan? PIN a tu na dal??m ??dku zopakovali."
 
 msgid ""
 "<b>A NullPIN is still active on this card</b>.\n"
@@ -2349,33 +2224,78 @@ msgstr "??ta? opakov?n? SigG PUK:"
 
 #, c-format
 msgid ""
-"There is not much information to display for a %s card.  You may want to use "
-"the application selector button to switch to another application available "
-"on this card."
+"There is not much information to display for a %s card.  You may want to use the "
+"application selector button to switch to another application available on this card."
 msgstr ""
-"Pro kartu %s nen? mnoho informac? ke zobrazen?. Zkuste pou??t tla??tko pro "
-"volbu aplikace pro p?epnut? na jinou aplikaci, kter? je na kart? k dispozici."
+"Pro kartu %s nen? mnoho informac? ke zobrazen?. Zkuste pou??t tla??tko pro volbu aplikace "
+"pro p?epnut? na jinou aplikaci, kter? je na kart? k dispozici."
 
-#~ msgid "The key ID is a short number to identify a certificate."
-#~ msgstr "ID kl??e je kr?tk? ??slo k identifikaci certifik?tu."
+#, fuzzy
+#~ msgid "Configure backend to use a keyserver?"
+#~ msgstr "Nastavit programy backednu"
 
-#~ msgid "Error"
-#~ msgstr "Fehler"
+#, fuzzy
+#~ msgid "Configuring the backend to use a keyserver failed"
+#~ msgstr "Nastavit programy backednu"
 
-#~ msgid "Message"
-#~ msgstr "Zpr?va"
+#~ msgid "Do not connect to a running instance"
+#~ msgstr "Nep?ipojujte se k b???c? instanci"
 
-#~ msgid "[S]"
-#~ msgstr "[S]"
+#~ msgid "Only keys of the same procotol may be exported as a collection."
+#~ msgstr "Pouze kl??e stejn?ho protokolu sm?j? b?t exportov?ny jako kolekce."
 
-#~ msgid "[C]"
-#~ msgstr "[C]"
+#, fuzzy
+#~ msgid "Are you sure you want to distribute this key?"
+#~ msgstr "Jste si jist?, ?e chcete smazat tento kl???"
 
-#~ msgid "[E]"
-#~ msgstr "[E]"
+#, fuzzy
+#~ msgid "Error sending key(s) to the server."
+#~ msgstr "Odeslat kl??e na server..."
+
+#~ msgid "Created"
+#~ msgstr "Vytvo?en"
+
+#~ msgid "The Creation Date is the date the certificate was created."
+#~ msgstr "Datum vytvo?en? je datum, kdy byl certifik?t vytvo?en."
+
+#, fuzzy
+#~ msgid "Which key do you want to import?"
+#~ msgstr "Kter? kl?? chcete z?skat? (Mus?te zadat ID kl??e)."
+
+#~ msgid "Algo"
+#~ msgstr "Algoritmus"
+
+#~ msgid "Expires"
+#~ msgstr "Vypr?? platnost"
+
+#~ msgid "S"
+#~ msgstr "P"
+
+#~ msgid "C"
+#~ msgstr "C"
+
+#~ msgid "E"
+#~ msgstr "?"
 
-#~ msgid "[A]"
-#~ msgstr "[A]"
+#~ msgid "A"
+#~ msgstr "A"
 
-#~ msgid "[T]"
-#~ msgstr "[T]"
+#~ msgid "T"
+#~ msgstr "K"
+
+#~ msgid "A required engine component is not installed."
+#~ msgstr "Po?adovan? komponenta stroje nen? instalovan?."
+
+#, fuzzy
+#~ msgid "Re_fresh Keys"
+#~ msgstr "Aktualizovat keyring"
+
+#, fuzzy
+#~ msgid "Refresh keys from server"
+#~ msgstr "Z?skat kl??e ze serveru"
+
+#~ msgid "Settings"
+#~ msgstr "Nastaven?"
+
+#~ msgid "Message"
+#~ msgstr "Zpr?va"

-----------------------------------------------------------------------

Summary of changes:
 NEWS     |   2 +-
 po/cs.po | 874 +++++++++++++++++++++++++++++----------------------------------
 2 files changed, 398 insertions(+), 478 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Assistant
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 11:18:01 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 01 Dec 2016 11:18:01 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-42-g12af8e8
Message-ID: <E1cCORI-0005mq-1e@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  12af8e84a32df728462da09a00a8bec24a487720 (commit)
      from  3c0569e99498c7470ebdb639b4c5ae829af92761 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 12af8e84a32df728462da09a00a8bec24a487720
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 1 11:16:31 2016 +0100

    tests: Add test for '--verify --multifile'.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/verify-multifile.scm: New file.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index c62f61e..8be66a1 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -72,6 +72,7 @@ XTESTS = \
 	conventional-mdc.scm \
 	multisig.scm \
 	verify.scm \
+	verify-multifile.scm \
 	gpgv-forged-keyring.scm \
 	armor.scm \
 	import.scm \
diff --git a/tests/openpgp/verify-multifile.scm b/tests/openpgp/verify-multifile.scm
new file mode 100755
index 0000000..f1cbe99
--- /dev/null
+++ b/tests/openpgp/verify-multifile.scm
@@ -0,0 +1,41 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+(define files '("clearsig-1-key-1.asc" "signed-1-key-1.asc"))
+
+(info "Checking verification of supplied files using --multifile.")
+
+(let* ((status
+	(call-popen
+	 `(, at gpg --verify --multifile --status-fd=1
+		 ,@(map (lambda (name) (in-srcdir "samplemsgs" name)) files))
+	 ""))
+       (lines (map (lambda (l)
+		     (assert (string-prefix? l "[GNUPG:] "))
+		     ;; Split, and strip the prefix.
+		     (cdr (string-split l #\space)))
+		   (string-split-newlines status))))
+  (assert
+   (= 2 (length (filter (lambda (l)
+			  (and (equal? (car l) "GOODSIG")
+			       (equal? (caddr l) "steve.biko at example.net")))
+			lines)))))

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am                          |  1 +
 ...{encrypt-multifile.scm => verify-multifile.scm} | 32 ++++++++++++----------
 2 files changed, 18 insertions(+), 15 deletions(-)
 copy tests/openpgp/{encrypt-multifile.scm => verify-multifile.scm} (55%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 13:48:55 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 01 Dec 2016 13:48:55 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-43-gfbdfe6a
Message-ID: <E1cCQnJ-0004Qp-GG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  fbdfe6a514a95fb46f2b811a13709024e2baf252 (commit)
      from  12af8e84a32df728462da09a00a8bec24a487720 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fbdfe6a514a95fb46f2b811a13709024e2baf252
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 1 13:40:08 2016 +0100

    tests,build: Fix distcheck.
    
    * tests/openpgp/Makefile.am (sample_msgs): Add messages required for
    the new test 'verify-multifile.scm'.
    
    Fixes-commit: 12af8e84a32df728462da09a00a8bec24a487720
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 8be66a1..49db18e 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -194,7 +194,9 @@ sample_keys = samplekeys/README \
 	      samplekeys/authenticate-only.pub.asc \
 	      samplekeys/authenticate-only.sec.asc
 
-sample_msgs = samplemsgs/issue2419.asc
+sample_msgs = samplemsgs/issue2419.asc \
+	      samplemsgs/clearsig-1-key-1.asc \
+	      samplemsgs/signed-1-key-1.asc
 
 EXTRA_DIST = defs.scm $(XTESTS) $(TEST_FILES) \
 	     mkdemodirs signdemokey $(priv_keys) $(sample_keys)   \

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 15:49:52 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 15:49:52 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-197-g1bc698e
Message-ID: <E1cCSgN-0001Wl-0r@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  1bc698e7d222120abf87e103771551c2d374ed2b (commit)
       via  ad40a5e502f1ea8e01d72fdeb114a44d50415d3c (commit)
       via  dc078f53bc6a837d5a942d1e2a26251ccae45c9a (commit)
       via  ab0d0ea2f913e1648cd3be83bd05cb139e3f2230 (commit)
       via  e275102e683e648f41aee0ffc29c8ffeb848df74 (commit)
      from  fd987b7b5500506515b0a9913d9fa304ff35ad6c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1bc698e7d222120abf87e103771551c2d374ed2b
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 15:48:12 2016 +0100

    Change wording in signature details
    
    * src/mail.cpp (Mail::get_signature_status): Change wording.
    * src/ribbon-callbacks.cpp (get_sig_label): Use trust instead
    verified.
    
    --
    Trusted Sender is still very easygoing but we now have a better
    distinction between fully trusted and marginally trusted.

diff --git a/src/mail.cpp b/src/mail.cpp
index 31076c6..1882ea0 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1414,23 +1414,27 @@ Mail::get_signature_status()
 
   const auto pair = get_valid_sig ();
   bool keyFound = false;
-  char *buf;
   bool isOpenPGP = pair.first.key().protocol() == Protocol::OpenPGP;
+  char *buf;
+  bool hasConflict = false;
   if (!pair.first.isNull () && !pair.second.isNull ())
     {
       const auto sig = pair.first;
       const auto uid = pair.second;
       /* We are valid */
       keyFound = true;
-      gpgrt_asprintf (&buf, _("The sender is verified because:\n\n%s %s"),
-                      isOpenPGP ? _("The used key") : _(" The used certificate"),
-                      sig.validity() == Signature::Validity::Ultimate ?
+      message += _("The sender address is trusted because:");
+      message += "\n\n";
+      message += isOpenPGP ? _("The used key") : _("The used certificate");
+      message += " ";
+      message += sig.validity() == Signature::Validity::Ultimate ?
                       _("is marked as your own.") :
+                      sig.validity() == Signature::Validity::Full && isOpenPGP &&
+                      uid.tofuInfo().policy() == TofuInfo::PolicyGood ?
+                      _("was marked to be the right key for this address") :
                       sig.validity() == Signature::Validity::Full && isOpenPGP ?
-                      _("was certified by enough trusted keys.") :
-                      "");
-      message += buf;
-      xfree (buf);
+                      _("was certified by enough trusted keys or yourself.") :
+                      "";
       if (sig.validity() == Signature::Validity::Full && !isOpenPGP)
         {
           gpgrt_asprintf (&buf, _("is cerified by the trusted issuer:\n'%s'\n"),
@@ -1441,7 +1445,9 @@ Mail::get_signature_status()
       else if (sig.validity() == Signature::Validity::Marginal)
         {
           char *time = format_date_from_gpgme (uid.tofuInfo().signFirst());
-          gpgrt_asprintf (&buf, _("was consistently used for %i messages since %s."),
+          /* i18n note signcount is always pulral because with signcount 1 we
+           * would not be in this branch. */
+          gpgrt_asprintf (&buf, _("was used for %i messages since %s."),
                           uid.tofuInfo().signCount (), time);
           xfree (time);
           message += buf;
@@ -1457,15 +1463,17 @@ Mail::get_signature_status()
         }
       /* We only handle the first signature. */
       const auto sig = m_verify_result.signature (0);
-      isOpenPGP = sig.key().protocol() == Protocol::OpenPGP;
+      isOpenPGP = !is_smime();
       keyFound = !(sig.summary() & Signature::Summary::KeyMissing);
 
       log_debug ("%s:%s: Formatting sig. Validity: %x Summary: %x",
                  SRCNAME, __func__, sig.validity(), sig.summary());
 
       /* There is a signature but we don't accepted it as fully valid. */
-      message += _("The sender is not verified because:\n\n");
+      message += _("The sender address is not trusted because:");
+      message += "\n\n";
 
+      bool general_problem = true;
       /* First the general stuff. */
       if (sig.summary() & Signature::Summary::Red)
         {
@@ -1484,15 +1492,16 @@ Mail::get_signature_status()
         }
       else
         {
-          message += isOpenPGP ? _("The used key") : _("The used certificate")
-                  + std::string(" ");
+          message += isOpenPGP ? _("The used key") : _("The used certificate");
+          message += " ";
+          general_problem = false;
         }
 
       const auto uid = get_uid_for_sender (sig.key(), get_sender().c_str());
       /* Now the key problems */
       if ((sig.summary() & Signature::Summary::KeyMissing))
         {
-          message += _("is not in your keyring.");
+          message += _("is not available for verification.");
         }
       else if ((sig.summary() & Signature::Summary::KeyRevoked))
         {
@@ -1514,9 +1523,11 @@ Mail::get_signature_status()
         {
           message += _("could not be checked for revocation.");
         }
-      else if ((sig.summary() & Signature::Summary::TofuConflict))
+      else if ((sig.summary() & Signature::Summary::TofuConflict) ||
+               uid.tofuInfo().validity() == TofuInfo::Conflict)
         {
           message += _("conflicts with another key that was used in the past by the sender.");
+          hasConflict = true;
         }
       else if (uid.isNull())
         {
@@ -1532,18 +1543,25 @@ Mail::get_signature_status()
             {
               message += _("is not certified by enough trusted keys.");
             }
+          else if (tofuInfo.signCount() == 1)
+            {
+              message += _("is seen for the first time.");
+            }
           else
             {
-              message += _("does not have enough history for basic trust.");
+              gpgrt_asprintf (&buf, "was only used for %i messages.",
+                              tofuInfo.signCount());
+              message += buf;
+              xfree (buf);
             }
         }
-      else if ((sig.validity() & Signature::Validity::Undefined) ||
+      else if (((sig.validity() & Signature::Validity::Undefined) ||
                (sig.validity() & Signature::Validity::Unknown) ||
                (sig.summary() == Signature::Summary::None) ||
-               (sig.validity() == 0))
+               (sig.validity() == 0))&& !general_problem)
         {
            /* Bit of a catch all for weird results. */
-           message += _("is not certified by any trusted key.");
+          message += _("is not certified by any trusted key.");
         }
       else if ((sig.validity() & Signature::Validity::Never))
         {
@@ -1551,10 +1569,14 @@ Mail::get_signature_status()
         }
     }
   message += "\n\n";
-  if (keyFound)
+  if (hasConflict)
+    {
+      message += _("Click here to resolve the conflict.");
+    }
+  else if (keyFound)
     {
       message +=  isOpenPGP ? _("Click here for details about the key.") :
-                              _("Click here for details about the key.");
+                              _("Click here for details about the certificate.");
     }
   else
     {
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 596d74f..5930775 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1528,11 +1528,11 @@ HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result)
     }
   if (mail && mail->is_valid_sig ())
     {
-      w_result = utf8_to_wchar (_("Verified Sender"));
+      w_result = utf8_to_wchar (_("Trusted Address"));
     }
   else
     {
-      w_result = utf8_to_wchar (_("Unverified Sender"));
+      w_result = utf8_to_wchar (_("Untrusted Address"));
     }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);

commit ad40a5e502f1ea8e01d72fdeb114a44d50415d3c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 15:47:30 2016 +0100

    Log if a uid was skipped because of no email
    
    * src/mail.cpp (get_uid_for_sender): Log if mail is null.

diff --git a/src/mail.cpp b/src/mail.cpp
index 9a21687..31076c6 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1181,6 +1181,8 @@ get_uid_for_sender (const Key k, const char *sender)
     {
       if (!uid.email())
         {
+          log_error ("%s:%s: skipping uid without email.",
+                     SRCNAME, __func__);
           continue;
         }
       auto normalized_uid = uid.addrSpec();

commit dc078f53bc6a837d5a942d1e2a26251ccae45c9a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 15:45:36 2016 +0100

    Change valid category to Trusted Sender Address
    
    * src/gpgoladdin.cpp (GpgolAddin::OnStartupComplete): Change
    category name.
    (Mail::remove_categories, Mail::update_categories): Use new
    name.
    
    --
    Verified Sender was too strong, we now relate to the
    address.

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index fda79a5..d291ab4 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -442,7 +442,7 @@ GpgolAddin::OnStartupComplete (SAFEARRAY** custom)
 
   /* Set up categories */
   const char *decCategory = _("GpgOL: Encrypted Message");
-  const char *verifyCategory = _("GpgOL: Verified Sender");
+  const char *verifyCategory = _("GpgOL: Trusted Sender Address");
   ensure_category_exists (m_application, decCategory, 8);
   ensure_category_exists (m_application, verifyCategory, 5);
   install_forms ();
diff --git a/src/mail.cpp b/src/mail.cpp
index c113b2d..9a21687 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1297,7 +1297,7 @@ void
 Mail::remove_categories ()
 {
   const char *decCategory = _("GpgOL: Encrypted Message");
-  const char *verifyCategory = _("GpgOL: Verified Sender");
+  const char *verifyCategory = _("GpgOL: Trusted Sender Address");
   remove_category (m_mailitem, decCategory);
   remove_category (m_mailitem, verifyCategory);
 }
@@ -1306,7 +1306,7 @@ void
 Mail::update_categories ()
 {
   const char *decCategory = _("GpgOL: Encrypted Message");
-  const char *verifyCategory = _("GpgOL: Verified Sender");
+  const char *verifyCategory = _("GpgOL: Trusted Sender Address");
   if (m_decrypt_result.numRecipients())
     {
       /* We use the number of recipients as we don't care

commit ab0d0ea2f913e1648cd3be83bd05cb139e3f2230
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 15:44:17 2016 +0100

    Enable clearsigned support again for reading
    
    * src/mapihelp.cpp (get_msgcls_from_pgp_lines): Enable clearsigned
    support.
    
    --
    I just forgot that this was disabled. We can support this now.

diff --git a/src/mapihelp.cpp b/src/mapihelp.cpp
index de325c5..8b0c45a 100644
--- a/src/mapihelp.cpp
+++ b/src/mapihelp.cpp
@@ -698,8 +698,7 @@ get_msgcls_from_pgp_lines (LPMESSAGE message)
         {
           /* Enabling clearsigned detection for Outlook 2010 and later
              would result in data loss as the signature is not reverted. */
-          if (g_ol_version_major < 14
-              && !strncmp (p+15, "SIGNED MESSAGE-----", 19)
+          if (!strncmp (p+15, "SIGNED MESSAGE-----", 19)
               && trailing_ws_p (p+15+19))
             msgcls = xstrdup ("IPM.Note.GpgOL.ClearSigned");
           else if (!strncmp (p+15, "MESSAGE-----", 12)

commit e275102e683e648f41aee0ffc29c8ffeb848df74
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 15:42:32 2016 +0100

    Add yellow checker for basic / marginal trust
    
    * src/dialogs.h, src/dialogs.rc: Update accordingly.
    * src/icons/emblem-success-yellow.svg,
    src/icons/emblem-success-yellow-64.png: New.
    * src/icons/Makefile.am (EXTRA_DIST): Add new icon and
    svg icons.
    * srC/mail.cpp (Mail::get_signature_icon_id): Use it.

diff --git a/src/dialogs.h b/src/dialogs.h
index daf8873..8e57468 100644
--- a/src/dialogs.h
+++ b/src/dialogs.h
@@ -118,5 +118,6 @@
 #define IDI_EMBLEM_SUCCESS_64_PNG       0x6072
 #define IDI_EMBLEM_INFORMATION_64_PNG   0x6073
 #define IDI_EMBLEM_QUESTION_64_PNG      0x6074
+#define IDI_EMBLEM_SUCCESS_YELLOW_64_PNG 0x6075
 
 #endif /*DIALOGS_H*/
diff --git a/src/dialogs.rc b/src/dialogs.rc
index 359169d..c20cb43 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -54,6 +54,7 @@ IDI_ENCSIGN_FILE_48_PNG   RCDATA               "icons/encrypt-sign-file-48.png"
 
 IDI_EMBLEM_WARNING_64_PNG RCDATA               "icons/emblem-warning-64.png"
 IDI_EMBLEM_SUCCESS_64_PNG RCDATA               "icons/emblem-success-64.png"
+IDI_EMBLEM_SUCCESS_YELLOW_64_PNG RCDATA        "icons/emblem-success-yellow-64.png"
 IDI_EMBLEM_INFORMATION_64_PNG RCDATA           "icons/emblem-information-64.png"
 IDI_EMBLEM_QUESTION_64_PNG RCDATA              "icons/emblem-question-64.png"
 
diff --git a/src/icons/Makefile.am b/src/icons/Makefile.am
index cfe1261..6f06833 100644
--- a/src/icons/Makefile.am
+++ b/src/icons/Makefile.am
@@ -26,4 +26,9 @@ EXTRA_DIST= \
     emblem-question-64.png \
     emblem-warning-64.png \
     emblem-success-64.png \
-    emblem-information-64.png
+    emblem-information-64.png \
+    emblem-success-yellow-64.png \
+    emblem-question.svg \
+    emblem-warning.svg \
+    emblem-information.svg \
+    emblem-success-yellow.svg
diff --git a/src/icons/emblem-success-yellow.svg b/src/icons/emblem-success-yellow.svg
new file mode 100644
index 0000000..563d047
--- /dev/null
+++ b/src/icons/emblem-success-yellow.svg
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   viewBox="0 0 8 8"
+   id="svg2"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   width="100%"
+   height="100%"
+   sodipodi:docname="emblem-success.svg">
+  <metadata
+     id="metadata12">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <sodipodi:namedview
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1"
+     objecttolerance="10"
+     gridtolerance="10"
+     guidetolerance="10"
+     inkscape:pageopacity="0"
+     inkscape:pageshadow="2"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     id="namedview10"
+     showgrid="false"
+     inkscape:zoom="29.5"
+     inkscape:cx="4"
+     inkscape:cy="4.0169492"
+     inkscape:window-x="-2"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="svg2" />
+  <defs
+     id="defs3051">
+    <style
+       type="text/css"
+       id="current-color-scheme">
+      .ColorScheme-PositiveText {
+        color:#27ae60;
+      }
+      </style>
+  </defs>
+  <path
+     style="fill:currentColor;fill-opacity:1;stroke:none"
+     class="ColorScheme-PositiveText"
+     d="M 4 0 C 1.784 0 0 1.784 0 4 C 0 6.216 1.784 8 4 8 C 6.216 8 8 6.216 8 4 C 8 1.784 6.216 0 4 0 z "
+     id="path6" />
+  <path
+     style="fill:#ffffff;fill-opacity:1;stroke:none"
+     d="M 6 2 L 3 5 L 2 4 L 1 5 L 2 6 L 3 7 L 7 3 L 6 2 z "
+     id="path8" />
+  <path
+     style="fill:#ffd42a;fill-opacity:0.94117647000000004;stroke:#000000;stroke-width:0.03389831000000000;stroke-opacity:1"
+     d="M 3.3232154,7.9242607 C 1.7484941,7.6251271 0.55453708,6.5163227 0.13835987,4.9665485 0.05799792,4.6672939 0.04884008,4.5726417 0.0471396,4.0237288 0.0451555,3.3832678 0.08992259,3.0957175 0.26471592,2.6261812 0.89372244,0.93652085 2.5766492,-0.12563207 4.3576271,0.04300418 5.1376464,0.11686222 5.7769136,0.36446515 6.4033722,0.83536851 8.1559719,2.1527823 8.4949549,4.6703692 7.1555471,6.4216864 6.6061339,7.1400614 5.8250061,7.6445356 4.9084746,7.8729092 4.5347946,7.9660197 3.6875275,7.9934651 3.3232154,7.9242607 l 0,0 z M 6.5186969,2.4814089 6.0107349,1.9725985 4.5104525,3.4725966 3.0101703,4.9725949 2.5104404,4.4728651 2.0107105,3.9731349 1.4933899,4.4896481 0.97606936,5.006161 1.9845212,6.0150332 2.9929729,7.0239054 5.0098159,5.0070624 7.026659,2.9902192 6.5186969,2.4814089 z"
+     id="path2989"
+     inkscape:connector-curvature="0" />
+</svg>
diff --git a/src/mail.cpp b/src/mail.cpp
index 950acd3..c113b2d 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1569,18 +1569,25 @@ Mail::get_signature_icon_id () const
     {
       return IDI_EMBLEM_INFORMATION_64_PNG;
     }
-  if (m_is_valid)
-    {
-      return IDI_EMBLEM_SUCCESS_64_PNG;
-    }
   const auto sig = m_verify_result.signature (0);
   if ((sig.summary() & Signature::Summary::KeyMissing))
     {
       return IDI_EMBLEM_QUESTION_64_PNG;
     }
-
-  /* Maybe warning for unsigned and invalid sigs? */
-
+  if (m_is_valid && sig.validity() == Signature::Validity::Full)
+    {
+      return IDI_EMBLEM_SUCCESS_64_PNG;
+    }
+  else if (m_is_valid)
+    {
+      return IDI_EMBLEM_SUCCESS_YELLOW_64_PNG;
+    }
+  const auto uid = get_uid_for_sender (sig.key(), m_sender.c_str());
+  if (sig.summary() & Signature::Summary::TofuConflict ||
+      uid.tofuInfo().validity() == TofuInfo::Conflict)
+    {
+      return IDI_EMBLEM_WARNING_64_PNG;
+    }
   return IDI_EMBLEM_INFORMATION_64_PNG;
 }
 

-----------------------------------------------------------------------

Summary of changes:
 src/dialogs.h                       |  1 +
 src/dialogs.rc                      |  1 +
 src/gpgoladdin.cpp                  |  2 +-
 src/icons/Makefile.am               |  7 ++-
 src/icons/emblem-success-yellow.svg | 73 +++++++++++++++++++++++++++++
 src/mail.cpp                        | 91 +++++++++++++++++++++++++------------
 src/mapihelp.cpp                    |  3 +-
 src/ribbon-callbacks.cpp            |  4 +-
 8 files changed, 146 insertions(+), 36 deletions(-)
 create mode 100644 src/icons/emblem-success-yellow.svg


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 16:49:48 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 16:49:48 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-198-gb3fdbb2
Message-ID: <E1cCTcM-0004aC-Dw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  b3fdbb2244f2d049b458160d7f3da6340745ad7a (commit)
      from  1bc698e7d222120abf87e103771551c2d374ed2b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b3fdbb2244f2d049b458160d7f3da6340745ad7a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 16:47:39 2016 +0100

    Change wording to better distinguish fully trusted
    
    * src/mail.cpp (Mail::get_signature_status): Distinguish between
    trusted and fully trusted.
    * src/ribbon-callbacks.cpp (get_sig_label): Use three labels
    instead of two.
    
    --
    Only changing the icon color was a too weak distinction. Especially
    regarding accessibility.

diff --git a/src/mail.cpp b/src/mail.cpp
index 1882ea0..b8e02ac 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1423,7 +1423,15 @@ Mail::get_signature_status()
       const auto uid = pair.second;
       /* We are valid */
       keyFound = true;
-      message += _("The sender address is trusted because:");
+      if (sig.validity() == Signature::Validity::Full ||
+          sig.validity() == Signature::Validity::Ultimate)
+        {
+          message += _("The sender address is fully trusted because:");
+        }
+      else
+        {
+          message += _("The sender address is trusted because:");
+        }
       message += "\n\n";
       message += isOpenPGP ? _("The used key") : _("The used certificate");
       message += " ";
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 5930775..f02ab89 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1526,13 +1526,21 @@ HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result)
       log_debug ("%s:%s: No mail.",
                  SRCNAME, __func__);
     }
-  if (mail && mail->is_valid_sig ())
+  bool valid = mail->is_valid_sig ();
+  const auto pair = mail->get_valid_sig ();
+  bool fully = pair.first.validity() == GpgME::Signature::Validity::Full ||
+               pair.first.validity() == GpgME::Signature::Validity::Ultimate;
+  if (valid && fully)
     {
-      w_result = utf8_to_wchar (_("Trusted Address"));
+      w_result = utf8_to_wchar (_("Fully Trusted"));
+    }
+  else if (valid)
+    {
+      w_result = utf8_to_wchar (_("Trusted"));
     }
   else
     {
-      w_result = utf8_to_wchar (_("Untrusted Address"));
+      w_result = utf8_to_wchar (_("Not Trusted"));
     }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp             | 10 +++++++++-
 src/ribbon-callbacks.cpp | 14 +++++++++++---
 2 files changed, 20 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 16:49:58 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 01 Dec 2016 16:49:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-45-g304566d
Message-ID: <E1cCTcX-0004bT-18@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  304566d3327ef0a85188cce3109d46d5ff47177a (commit)
       via  86efc3ee53abaf1e22b53c1b360c51829e476115 (commit)
      from  fbdfe6a514a95fb46f2b811a13709024e2baf252 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 304566d3327ef0a85188cce3109d46d5ff47177a
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 1 15:45:51 2016 +0100

    dirmngr: Add option --standard-resolver.
    
    * dirmngr/dirmngr.c (oStandardResolver): New constant.
    (opts): New option --standard-resolver.
    (parse_rereadable_options): Set option.
    * dirmngr/dns-stuff.c: Refactor all code to support the new option.
    (standard_resolver): New var.
    (enable_standard_resolver, standard_resolver_p): New func.
    * dirmngr/http.c (connect_server): Remove USE_DNS_SRV build
    conditional.
    * dirmngr/ks-engine-hkp.c (map_host): Ditto.
    * dirmngr/server.c (cmd_getinfo) <dnsinfo>: Take care of new option
    * configure.ac (HAVE_ADNS_IF_TORMODE): Remove var ADNSLIB.  ac_define
    USE_ADNS in the adns checking code.  Remove options --disable-dns-srv
    and --disable-dns-cert.  Always look for the system resolver.  Print
    warning if no system resolver was found.
    (USE_DNS_CERT, USE_DNS_SRV): Remove ac_defines.
    (HAVE_SYSTEM_RESOLVER): New ac_define.
    (USE_DNS_SRV): Remove am_conditional; not used anyway.
    --
    
    This option allows for runtime switching to the system's standard
    resolver.  This is mainly useful to work around possible bugs in the
    optional resolver libraries (as of now ADNS).  Note that on Windows
    there is no code to use systems's resolver and thus for full
    functionality dirmngr must be build with a separate resolver.
    
    This patch also does way with configure options to disable the use of
    CERT and SRV records.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/configure.ac b/configure.ac
index f196e1b..f3576c7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -103,6 +103,7 @@ have_sqlite=no
 have_npth=no
 have_libusb=no
 have_adns=no
+have_system_resolver=no
 gnupg_have_ldap="n/a"
 
 use_zip=yes
@@ -1025,58 +1026,39 @@ fi
 CPPFLAGS=${_cppflags}
 LDFLAGS=${_ldflags}
 if test "$have_adns" = "yes"; then
-  ADNSLIBS="-ladns"
+  DNSLIBS="-ladns"
+  AC_DEFINE(USE_ADNS,1,[Use ADNS as resolver library.])
+else
+  DNSLIBS=""
 fi
 
 
 #
-# Now try for the resolver functions so we can use DNS for SRV, PA and CERT.
+# Check standard resolver functions.
 #
-AC_ARG_ENABLE(dns-srv,
-              AC_HELP_STRING([--disable-dns-srv],
-                             [disable the use of DNS SRV in HKP and HTTP]),
-              use_dns_srv=$enableval,use_dns_srv=yes)
-
-AC_ARG_ENABLE(dns-cert,
-   AC_HELP_STRING([--disable-dns-cert],
-	[disable the use of CERT records in DNS]),
-   use_dns_cert=$enableval,use_dns_cert=yes)
-
-if test x"$use_dns_srv" = xyes || test x"$use_dns_cert" = xyes; then
+if test "$build_dirmngr" = "yes"; then
   _dns_save_libs=$LIBS
   LIBS=""
 
-  if test x"$have_adns" = xyes ; then
-    # We prefer ADNS.
-    DNSLIBS="$ADNSLIBS"
-    AC_DEFINE(USE_ADNS,1,[Use ADNS as resolver library.])
-
-    if test x"$use_dns_srv" = xyes ; then
-        AC_DEFINE(USE_DNS_SRV,1)
-    fi
-
-    if test x"$use_dns_cert" = xyes ; then
-        AC_DEFINE(USE_DNS_CERT,1,[define to use DNS CERT])
-    fi
-  else
-    # With no ADNS find the system resolver.
+  # Find the system resolver which can always be enabled with
+  # the dirmngr option --standard-resolver.
 
-    # the double underscore thing is a glibc-ism?
-    AC_SEARCH_LIBS(res_query,resolv bind,,
-                   AC_SEARCH_LIBS(__res_query,resolv bind,,have_resolver=no))
-    AC_SEARCH_LIBS(dn_expand,resolv bind,,
-                   AC_SEARCH_LIBS(__dn_expand,resolv bind,,have_resolver=no))
+  # the double underscore thing is a glibc-ism?
+  AC_SEARCH_LIBS(res_query,resolv bind,,
+                 AC_SEARCH_LIBS(__res_query,resolv bind,,have_resolver=no))
+  AC_SEARCH_LIBS(dn_expand,resolv bind,,
+                 AC_SEARCH_LIBS(__dn_expand,resolv bind,,have_resolver=no))
 
-    # macOS renames dn_skipname into res_9_dn_skipname in <resolv.h>,
-    # and for some reason fools us into believing we don't need
-    # -lresolv even if we do.  Since the test program checking for the
-    # symbol does not include <resolv.h>, we need to check for the
-    # renamed symbol explicitly.
-    AC_SEARCH_LIBS(res_9_dn_skipname,resolv bind,,
-        AC_SEARCH_LIBS(dn_skipname,resolv bind,,
-            AC_SEARCH_LIBS(__dn_skipname,resolv bind,,have_resolver=no)))
+  # macOS renames dn_skipname into res_9_dn_skipname in <resolv.h>,
+  # and for some reason fools us into believing we don't need
+  # -lresolv even if we do.  Since the test program checking for the
+  # symbol does not include <resolv.h>, we need to check for the
+  # renamed symbol explicitly.
+  AC_SEARCH_LIBS(res_9_dn_skipname,resolv bind,,
+      AC_SEARCH_LIBS(dn_skipname,resolv bind,,
+          AC_SEARCH_LIBS(__dn_skipname,resolv bind,,have_resolver=no)))
 
-    if test x"$have_resolver" != xno ; then
+  if test x"$have_resolver" != xno ; then
 
       # Make sure that the BIND 4 resolver interface is workable before
       # enabling any code that calls it.  At some point I'll rewrite the
@@ -1084,8 +1066,8 @@ if test x"$use_dns_srv" = xyes || test x"$use_dns_cert" = xyes; then
       # We might also want to use adns instead.  Problem with ADNS is that
       # it does not support v6.
 
-      AC_MSG_CHECKING([whether the resolver is usable])
-      AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
+    AC_MSG_CHECKING([whether the resolver is usable])
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
 #include <resolv.h>]],
@@ -1094,15 +1076,15 @@ if test x"$use_dns_srv" = xyes || test x"$use_dns_cert" = xyes; then
   dn_skipname(0,0);
   dn_expand(0,0,0,0,0);
 ]])],have_resolver=yes,have_resolver=no)
-      AC_MSG_RESULT($have_resolver)
+    AC_MSG_RESULT($have_resolver)
 
-      # This is Apple-specific and somewhat bizarre as they changed the
-      # define in bind 8 for some reason.
+    # This is Apple-specific and somewhat bizarre as they changed the
+    # define in bind 8 for some reason.
 
-      if test x"$have_resolver" != xyes ; then
-         AC_MSG_CHECKING(
-             [whether I can make the resolver usable with BIND_8_COMPAT])
-        AC_LINK_IFELSE([AC_LANG_PROGRAM([[#define BIND_8_COMPAT
+    if test x"$have_resolver" != xyes ; then
+      AC_MSG_CHECKING(
+           [whether I can make the resolver usable with BIND_8_COMPAT])
+      AC_LINK_IFELSE([AC_LANG_PROGRAM([[#define BIND_8_COMPAT
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
@@ -1111,28 +1093,23 @@ if test x"$use_dns_srv" = xyes || test x"$use_dns_cert" = xyes; then
   res_query("foo.bar",C_IN,T_A,answer,PACKETSZ);
   dn_skipname(0,0); dn_expand(0,0,0,0,0);
 ]])],[have_resolver=yes ; need_compat=yes])
-         AC_MSG_RESULT($have_resolver)
-      fi
+      AC_MSG_RESULT($have_resolver)
     fi
+  fi
 
-    if test x"$have_resolver" = xyes ; then
-      DNSLIBS=$LIBS
-
-      if test x"$use_dns_srv" = xyes ; then
-         AC_DEFINE(USE_DNS_SRV,1,[define to use DNS SRV])
-      fi
-
-      if test x"$use_dns_cert" = xyes ; then
-        AC_DEFINE(USE_DNS_CERT,1,[define to use DNS CERT])
-      fi
-
-      if test x"$need_compat" = xyes ; then
-        AC_DEFINE(BIND_8_COMPAT,1,[an Apple OSXism])
-      fi
-    else
-      use_dns_srv=no
-      use_dns_cert=no
+  if test x"$have_resolver" = xyes ; then
+    AC_DEFINE(HAVE_SYSTEM_RESOLVER,1,[The system's resolver is usable.])
+    DNSLIBS="$DNSLIBS $LIBS"
+    if test x"$need_compat" = xyes ; then
+      AC_DEFINE(BIND_8_COMPAT,1,[an Apple OSXism])
     fi
+  else
+    AC_MSG_WARN([[
+***
+*** The system's DNS resolver is not usable.
+*** Dirmngr functionality is limited.
+***]])
+   show_tor_support="${show_tor_support} (no system resolver)"
   fi
 
   LIBS=$_dns_save_libs
@@ -1140,8 +1117,6 @@ fi
 
 AC_SUBST(DNSLIBS)
 
-AM_CONDITIONAL(USE_DNS_SRV, test x"$use_dns_srv" = xyes)
-
 
 #
 # Check for LDAP
@@ -1963,7 +1938,6 @@ echo "
         Dirmngr auto start:  $dirmngr_auto_start
         Readline support:    $gnupg_cv_have_readline
         LDAP support:        $gnupg_have_ldap
-        DNS SRV support:     $use_dns_srv
         TLS support:         $use_tls_library
         TOFU support:        $use_tofu
         Tor support:         $show_tor_support
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 191f772..c26a468 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -140,6 +140,7 @@ enum cmd_and_opt_values {
   oKeyServer,
   oNameServer,
   oDisableCheckOwnSocket,
+  oStandardResolver,
   aTest
 };
 
@@ -236,6 +237,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_s (oHTTPWrapperProgram, "http-wrapper-program", "@"),
   ARGPARSE_s_n (oHonorHTTPProxy, "honor-http-proxy", "@"),
   ARGPARSE_s_s (oIgnoreCertExtension,"ignore-cert-extension", "@"),
+  ARGPARSE_s_n (oStandardResolver, "standard-resolver", "@"),
 
   ARGPARSE_group (302,N_("@\n(See the \"info\" manual for a complete listing "
                          "of all commands and options)\n")),
@@ -543,6 +545,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
       FREE_STRLIST (opt.keyserver);
       /* Note: We do not allow resetting of opt.use_tor at runtime.  */
       disable_check_own_socket = 0;
+      enable_standard_resolver (0);
       return 1;
     }
 
@@ -617,6 +620,8 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
 
     case oUseTor: opt.use_tor = 1; break;
 
+    case oStandardResolver: enable_standard_resolver (1); break;
+
     case oKeyServer:
       if (*pargs->r.ret_str)
         add_to_strlist (&opt.keyserver, pargs->r.ret_str);
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 6849af4..7924fd3 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -1,6 +1,6 @@
 /* dns-stuff.c - DNS related code including CERT RR (rfc-4398)
  * Copyright (C) 2003, 2005, 2006, 2009 Free Software Foundation, Inc.
- * Copyright (C) 2005, 2006, 2009, 2015 Werner Koch
+ * Copyright (C) 2005, 2006, 2009, 2015. 2016 Werner Koch
  *
  * This file is part of GnuPG.
  *
@@ -36,9 +36,11 @@
 # endif
 # include <windows.h>
 #else
-# include <netinet/in.h>
-# include <arpa/nameser.h>
-# include <resolv.h>
+# if HAVE_SYSTEM_RESOLVER
+#  include <netinet/in.h>
+#  include <arpa/nameser.h>
+#  include <resolv.h>
+# endif
 # include <netdb.h>
 #endif
 #include <string.h>
@@ -101,6 +103,8 @@
 /* The default nameserver used with ADNS in Tor mode.  */
 #define DEFAULT_NAMESERVER "8.8.8.8"
 
+/* If set force the use of the standard resolver.  */
+static int standard_resolver;
 
 /* If set Tor mode shall be used.  */
 static int tor_mode;
@@ -114,6 +118,25 @@ static char tor_nameserver[40+20];
 static char tor_credentials[50];
 #endif
 
+
+/* Calling this function with YES set to True forces the use of the
+ * standard resolver even if dirmngr has been built with support for
+ * an alternative resolver.  */
+void
+enable_standard_resolver (int yes)
+{
+  standard_resolver = yes;
+}
+
+
+/* Return true if the standard resolver is used.  */
+int
+standard_resolver_p (void)
+{
+  return standard_resolver;
+}
+
+
 /* Sets the module in Tor mode.  Returns 0 is this is possible or an
    error code.  */
 gpg_error_t
@@ -121,7 +144,7 @@ enable_dns_tormode (int new_circuit)
 {
   (void) new_circuit;
 
-#if defined(USE_DNS_CERT) && defined(USE_ADNS)
+#ifdef USE_ADNS
 # if HAVE_ADNS_IF_TORMODE
    if (!*tor_credentials || new_circuit)
      {
@@ -367,7 +390,6 @@ resolve_name_adns (const char *name, unsigned short port,
 #endif /*USE_ADNS*/
 
 
-#ifndef USE_ADNS
 /* Resolve a name using the standard system function.  */
 static gpg_error_t
 resolve_name_standard (const char *name, unsigned short port,
@@ -472,7 +494,6 @@ resolve_name_standard (const char *name, unsigned short port,
     *r_dai = daihead;
   return err;
 }
-#endif /*!USE_ADNS*/
 
 
 /* Resolve an address using the standard system function.  */
@@ -552,12 +573,12 @@ resolve_dns_name (const char *name, unsigned short port,
                   dns_addrinfo_t *r_ai, char **r_canonname)
 {
 #ifdef USE_ADNS
-  return resolve_name_adns (name, port, want_family, want_socktype,
-                            r_ai, r_canonname);
-#else
+  if (!standard_resolver)
+    return resolve_name_adns (name, port, want_family, want_socktype,
+                              r_ai, r_canonname);
+#endif
   return resolve_name_standard (name, port, want_family, want_socktype,
                                 r_ai, r_canonname);
-#endif
 }
 
 
@@ -565,11 +586,7 @@ gpg_error_t
 resolve_dns_addr (const struct sockaddr *addr, int addrlen,
                   unsigned int flags, char **r_name)
 {
-#ifdef USE_ADNS_disabled_for_now
-  return resolve_addr_adns (addr, addrlen, flags, r_name);
-#else
   return resolve_addr_standard (addr, addrlen, flags, r_name);
-#endif
 }
 
 
@@ -654,23 +671,13 @@ is_onion_address (const char *name)
 }
 
 
-/* Returns 0 on success or an error code.  If a PGP CERT record was
-   found, the malloced data is returned at (R_KEY, R_KEYLEN) and
-   the other return parameters are set to NULL/0.  If an IPGP CERT
-   record was found the fingerprint is stored as an allocated block at
-   R_FPR and its length at R_FPRLEN; an URL is is allocated as a
-   string and returned at R_URL.  If WANT_CERTTYPE is 0 this function
-   returns the first CERT found with a supported type; it is expected
-   that only one CERT record is used.  If WANT_CERTTYPE is one of the
-   supported certtypes only records with this certtype are considered
-   and the first found is returned.  (R_KEY,R_KEYLEN) are optional. */
-gpg_error_t
-get_dns_cert (const char *name, int want_certtype,
-              void **r_key, size_t *r_keylen,
-              unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
-{
-#ifdef USE_DNS_CERT
 #ifdef USE_ADNS
+/* ADNS version of get_dns_cert.  */
+static gpg_error_t
+get_dns_cert_adns (const char *name, int want_certtype,
+                   void **r_key, size_t *r_keylen,
+                   unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
+{
   gpg_error_t err;
   int ret;
   adns_state state;
@@ -678,14 +685,6 @@ get_dns_cert (const char *name, int want_certtype,
   unsigned int ctype;
   int count;
 
-  if (r_key)
-    *r_key = NULL;
-  if (r_keylen)
-    *r_keylen = 0;
-  *r_fpr = NULL;
-  *r_fprlen = 0;
-  *r_url = NULL;
-
   err = my_adns_init (&state);
   if (err)
     return err;
@@ -812,22 +811,22 @@ get_dns_cert (const char *name, int want_certtype,
   adns_free (answer);
   adns_finish (state);
   return err;
+}
+#endif /*!USE_ADNS */
 
-#else /*!USE_ADNS*/
 
+/* Standard resolver version of get_dns_cert.  */
+static gpg_error_t
+get_dns_cert_standard (const char *name, int want_certtype,
+                       void **r_key, size_t *r_keylen,
+                       unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
+{
+#ifdef HAVE_SYSTEM_RESOLVER
   gpg_error_t err;
   unsigned char *answer;
   int r;
   u16 count;
 
-  if (r_key)
-    *r_key = NULL;
-  if (r_keylen)
-    *r_keylen = 0;
-  *r_fpr = NULL;
-  *r_fprlen = 0;
-  *r_url = NULL;
-
   /* Allocate a 64k buffer which is the limit for an DNS response.  */
   answer = xtrymalloc (65536);
   if (!answer)
@@ -1004,9 +1003,36 @@ get_dns_cert (const char *name, int want_certtype,
   xfree (answer);
   return err;
 
-#endif /*!USE_ADNS */
-#else /* !USE_DNS_CERT */
+#else /*!HAVE_SYSTEM_RESOLVER*/
+
   (void)name;
+  (void)want_certtype;
+  (void)r_key;
+  (void)r_keylen;
+  (void)r_fpr;
+  (void)r_fprlen;
+  (void)r_url;
+  return gpg_error (GPG_ERR_NOT_SUPPORTED);
+
+#endif /*!HAVE_SYSTEM_RESOLVER*/
+}
+
+
+/* Returns 0 on success or an error code.  If a PGP CERT record was
+   found, the malloced data is returned at (R_KEY, R_KEYLEN) and
+   the other return parameters are set to NULL/0.  If an IPGP CERT
+   record was found the fingerprint is stored as an allocated block at
+   R_FPR and its length at R_FPRLEN; an URL is is allocated as a
+   string and returned at R_URL.  If WANT_CERTTYPE is 0 this function
+   returns the first CERT found with a supported type; it is expected
+   that only one CERT record is used.  If WANT_CERTTYPE is one of the
+   supported certtypes only records with this certtype are considered
+   and the first found is returned.  (R_KEY,R_KEYLEN) are optional. */
+gpg_error_t
+get_dns_cert (const char *name, int want_certtype,
+              void **r_key, size_t *r_keylen,
+              unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
+{
   if (r_key)
     *r_key = NULL;
   if (r_keylen)
@@ -1015,11 +1041,16 @@ get_dns_cert (const char *name, int want_certtype,
   *r_fprlen = 0;
   *r_url = NULL;
 
-  return gpg_error (GPG_ERR_NOT_SUPPORTED);
-#endif
+#ifdef USE_ADNS
+  if (!standard_resolver)
+    return get_dns_cert_adns (name, want_certtype, r_key, r_keylen,
+                              r_fpr, r_fprlen, r_url);
+#endif /*!USE_ADNS */
+  return get_dns_cert_standard (name, want_certtype, r_key, r_keylen,
+                                r_fpr, r_fprlen, r_url);
 }
 
-#ifdef USE_DNS_SRV
+
 static int
 priosort(const void *a,const void *b)
 {
@@ -1033,170 +1064,215 @@ priosort(const void *a,const void *b)
 }
 
 
-int
-getsrv (const char *name,struct srventry **list)
+#ifdef USE_ADNS
+/* ADNS based helper for getsrv.  */
+static int
+getsrv_adns (const char *name, struct srventry **list)
 {
-  int srvcount=0;
+  int srvcount = 0;
   u16 count;
-  int i, rc;
-
-  *list = NULL;
+  int rc;
+  adns_state state;
+  adns_answer *answer = NULL;
 
-#ifdef USE_ADNS
-  {
-    adns_state state;
-    adns_answer *answer = NULL;
+  if (my_adns_init (&state))
+    return -1;
 
-    if (my_adns_init (&state))
+  my_unprotect ();
+  rc = adns_synchronous (state, name, adns_r_srv, adns_qf_quoteok_query,
+                         &answer);
+  my_protect ();
+  if (rc)
+    {
+      log_error ("DNS query failed: %s\n", strerror (rc));
+      adns_finish (state);
       return -1;
-
-    my_unprotect ();
-    rc = adns_synchronous (state, name, adns_r_srv, adns_qf_quoteok_query,
-                           &answer);
-    my_protect ();
-    if (rc)
-      {
-        log_error ("DNS query failed: %s\n", strerror (rc));
-        adns_finish (state);
-        return -1;
-      }
-    if (answer->status != adns_s_ok
-        || answer->type != adns_r_srv || !answer->nrrs)
-      {
+    }
+  if (answer->status != adns_s_ok
+      || answer->type != adns_r_srv || !answer->nrrs)
+    {
         log_error ("DNS query returned an error or no records: %s (%s)\n",
                    adns_strerror (answer->status),
                    adns_errabbrev (answer->status));
         adns_free (answer);
         adns_finish (state);
         return 0;
-      }
+    }
 
-    for (count = 0; count < answer->nrrs; count++)
-      {
-        struct srventry *srv = NULL;
-        struct srventry *newlist;
-
-        if (strlen (answer->rrs.srvha[count].ha.host) >= sizeof srv->target)
-          {
-            log_info ("hostname in SRV record too long - skipped\n");
-            continue;
-          }
-
-        newlist = xtryrealloc (*list, (srvcount+1)*sizeof(struct srventry));
-        if (!newlist)
-          goto fail;
-        *list = newlist;
-        memset (&(*list)[srvcount], 0, sizeof(struct srventry));
-        srv = &(*list)[srvcount];
-        srvcount++;
-
-        srv->priority = answer->rrs.srvha[count].priority;
-        srv->weight   = answer->rrs.srvha[count].weight;
-        srv->port     = answer->rrs.srvha[count].port;
-        strcpy (srv->target, answer->rrs.srvha[count].ha.host);
-      }
+  for (count = 0; count < answer->nrrs; count++)
+    {
+      struct srventry *srv = NULL;
+      struct srventry *newlist;
 
-    adns_free (answer);
-    adns_finish (state);
-  }
-#else /*!USE_ADNS*/
-  {
-    union {
-      unsigned char ans[2048];
-      HEADER header[1];
-    } res;
-    unsigned char *answer = res.ans;
-    HEADER *header = res.header;
-    unsigned char *pt, *emsg;
-    int r;
-    u16 dlen;
-
-    /* Do not allow a query using the standard resolver in Tor mode.  */
-    if (tor_mode)
-      return -1;
+      if (strlen (answer->rrs.srvha[count].ha.host) >= sizeof srv->target)
+        {
+          log_info ("hostname in SRV record too long - skipped\n");
+          continue;
+        }
 
-    my_unprotect ();
-    r = res_query (name, C_IN, T_SRV, answer, sizeof answer);
-    my_protect ();
-    if (r < sizeof (HEADER) || r > sizeof answer
-        || header->rcode != NOERROR || !(count=ntohs (header->ancount)))
-      return 0; /* Error or no record found.  */
+      newlist = xtryrealloc (*list, (srvcount+1)*sizeof(struct srventry));
+      if (!newlist)
+        {
+          xfree (*list);
+          *list = NULL;
+          return -1;
+        }
+      *list = newlist;
+      memset (&(*list)[srvcount], 0, sizeof(struct srventry));
+      srv = &(*list)[srvcount];
+      srvcount++;
+
+      srv->priority = answer->rrs.srvha[count].priority;
+      srv->weight   = answer->rrs.srvha[count].weight;
+      srv->port     = answer->rrs.srvha[count].port;
+      strcpy (srv->target, answer->rrs.srvha[count].ha.host);
+    }
 
-    emsg = &answer[r];
-    pt = &answer[sizeof(HEADER)];
+  adns_free (answer);
+  adns_finish (state);
 
-    /* Skip over the query */
-    rc = dn_skipname (pt, emsg);
-    if (rc == -1)
-      goto fail;
+  return srvcount;
+}
+#endif /*USE_ADNS*/
 
-    pt += rc + QFIXEDSZ;
 
-    while (count-- > 0 && pt < emsg)
-      {
-        struct srventry *srv=NULL;
-        u16 type,class;
-        struct srventry *newlist;
-
-        newlist = xtryrealloc (*list, (srvcount+1)*sizeof(struct srventry));
-        if (!newlist)
-          goto fail;
-        *list = newlist;
-        memset(&(*list)[srvcount],0,sizeof(struct srventry));
-        srv=&(*list)[srvcount];
-        srvcount++;
-
-        rc = dn_skipname(pt,emsg); /* the name we just queried for */
-        if (rc == -1)
-          goto fail;
-        pt+=rc;
-
-        /* Truncated message? */
-        if((emsg-pt)<16)
-          goto fail;
-
-        type = buf16_to_u16 (pt);
-        pt += 2;
-        /* We asked for SRV and got something else !? */
-        if(type!=T_SRV)
-          goto fail;
-
-        class = buf16_to_u16 (pt);
-        pt += 2;
-        /* We asked for IN and got something else !? */
-        if(class!=C_IN)
-          goto fail;
-
-        pt += 4; /* ttl */
-        dlen = buf16_to_u16 (pt);
-        pt += 2;
-
-        srv->priority = buf16_to_ushort (pt);
-        pt += 2;
-        srv->weight = buf16_to_ushort (pt);
-        pt += 2;
-        srv->port = buf16_to_ushort (pt);
-        pt += 2;
-
-        /* Get the name.  2782 doesn't allow name compression, but
-           dn_expand still works to pull the name out of the
-           packet. */
-        rc = dn_expand(answer,emsg,pt,srv->target, sizeof srv->target);
-        if (rc == 1 && srv->target[0] == 0) /* "." */
-          {
-            xfree(*list);
-            *list = NULL;
-            return 0;
-          }
-        if (rc == -1)
-          goto fail;
-        pt += rc;
-        /* Corrupt packet? */
-        if (dlen != rc+6)
-          goto fail;
-      }
-  }
+/* Standard resolver based helper for getsrv.  */
+static int
+getsrv_standard (const char *name, struct srventry **list)
+{
+#ifdef HAVE_SYSTEM_RESOLVER
+  union {
+    unsigned char ans[2048];
+    HEADER header[1];
+  } res;
+  unsigned char *answer = res.ans;
+  HEADER *header = res.header;
+  unsigned char *pt, *emsg;
+  int r, rc;
+  u16 dlen;
+  int srvcount=0;
+  u16 count;
+
+  /* Do not allow a query using the standard resolver in Tor mode.  */
+  if (tor_mode)
+    return -1;
+
+  my_unprotect ();
+  r = res_query (name, C_IN, T_SRV, answer, sizeof answer);
+  my_protect ();
+  if (r < sizeof (HEADER) || r > sizeof answer
+      || header->rcode != NOERROR || !(count=ntohs (header->ancount)))
+    return 0; /* Error or no record found.  */
+
+  emsg = &answer[r];
+  pt = &answer[sizeof(HEADER)];
+
+  /* Skip over the query */
+  rc = dn_skipname (pt, emsg);
+  if (rc == -1)
+    goto fail;
+
+  pt += rc + QFIXEDSZ;
+
+  while (count-- > 0 && pt < emsg)
+    {
+      struct srventry *srv = NULL;
+      u16 type, class;
+      struct srventry *newlist;
+
+      newlist = xtryrealloc (*list, (srvcount+1)*sizeof(struct srventry));
+      if (!newlist)
+        goto fail;
+      *list = newlist;
+      memset (&(*list)[srvcount], 0, sizeof(struct srventry));
+      srv = &(*list)[srvcount];
+      srvcount++;
+
+      rc = dn_skipname (pt, emsg); /* The name we just queried for.  */
+      if (rc == -1)
+        goto fail;
+      pt += rc;
+
+      /* Truncated message? */
+      if ((emsg-pt) < 16)
+        goto fail;
+
+      type = buf16_to_u16 (pt);
+      pt += 2;
+      /* We asked for SRV and got something else !? */
+      if (type != T_SRV)
+        goto fail;
+
+      class = buf16_to_u16 (pt);
+      pt += 2;
+      /* We asked for IN and got something else !? */
+      if (class != C_IN)
+        goto fail;
+
+      pt += 4; /* ttl */
+      dlen = buf16_to_u16 (pt);
+      pt += 2;
+
+      srv->priority = buf16_to_ushort (pt);
+      pt += 2;
+      srv->weight = buf16_to_ushort (pt);
+      pt += 2;
+      srv->port = buf16_to_ushort (pt);
+      pt += 2;
+
+      /* Get the name.  2782 doesn't allow name compression, but
+       * dn_expand still works to pull the name out of the packet. */
+      rc = dn_expand (answer, emsg, pt, srv->target, sizeof srv->target);
+      if (rc == 1 && srv->target[0] == 0) /* "." */
+        {
+          xfree(*list);
+          *list = NULL;
+          return 0;
+        }
+      if (rc == -1)
+        goto fail;
+      pt += rc;
+      /* Corrupt packet? */
+      if (dlen != rc+6)
+        goto fail;
+    }
+
+  return srvcount;
+
+ fail:
+  xfree (*list);
+  *list = NULL;
+  return -1;
+
+#else /*!HAVE_SYSTEM_RESOLVER*/
+
+  (void)name;
+  (void)list;
+  return -1;
+
+#endif /*!HAVE_SYSTEM_RESOLVER*/
+}
+
+
+int
+getsrv (const char *name, struct srventry **list)
+{
+  int srvcount;
+  int i;
+
+  *list = NULL;
+
+  if (0)
+    ;
+#ifdef USE_ADNS
+  else if (!standard_resolver)
+    srvcount = getsrv_adns (name, list);
 #endif /*!USE_ADNS*/
+  else
+    srvcount = getsrv_standard (name, list);
+
+  if (srvcount <= 0)
+    return srvcount;
 
   /* Now we have an array of all the srv records. */
 
@@ -1272,125 +1348,144 @@ getsrv (const char *name,struct srventry **list)
     }
 
   return srvcount;
-
- fail:
-  xfree(*list);
-  *list=NULL;
-  return -1;
 }
-#endif /*USE_DNS_SRV*/
 
 
+#ifdef USE_ADNS
+/* ADNS version of get_dns_cname.  */
 gpg_error_t
-get_dns_cname (const char *name, char **r_cname)
+get_dns_cname_adns (const char *name, char **r_cname)
 {
   gpg_error_t err;
   int rc;
+  adns_state state;
+  adns_answer *answer = NULL;
 
-  *r_cname = NULL;
+  if (my_adns_init (&state))
+    return gpg_error (GPG_ERR_GENERAL);
 
-#ifdef USE_ADNS
-  {
-    adns_state state;
-    adns_answer *answer = NULL;
+  my_unprotect ();
+  rc = adns_synchronous (state, name, adns_r_cname, adns_qf_quoteok_query,
+                         &answer);
+  my_protect ();
+  if (rc)
+    {
+      err = gpg_error (gpg_err_code_from_errno (rc));
+      log_error ("DNS query failed: %s\n", gpg_strerror (err));
+      adns_finish (state);
+      return err;
+    }
+  if (answer->status != adns_s_ok
+      || answer->type != adns_r_cname || answer->nrrs != 1)
+    {
+      err = map_adns_status_to_gpg_error (answer->status);
+      log_error ("DNS query returned an error or no records: %s (%s)\n",
+                 adns_strerror (answer->status),
+                 adns_errabbrev (answer->status));
+      adns_free (answer);
+      adns_finish (state);
+      return err;
+    }
+  *r_cname = xtrystrdup (answer->rrs.str[0]);
+  if (!*r_cname)
+    err = gpg_error_from_syserror ();
+  else
+    err = 0;
 
-    if (my_adns_init (&state))
-      return gpg_error (GPG_ERR_GENERAL);
+  adns_free (answer);
+  adns_finish (state);
+  return err;
+}
+#endif /*USE_ADNS*/
 
-    my_unprotect ();
-    rc = adns_synchronous (state, name, adns_r_cname, adns_qf_quoteok_query,
-                           &answer);
-    my_protect ();
-    if (rc)
-      {
-        err = gpg_error (gpg_err_code_from_errno (rc));
-        log_error ("DNS query failed: %s\n", gpg_strerror (err));
-        adns_finish (state);
-        return err;
-      }
-    if (answer->status != adns_s_ok
-        || answer->type != adns_r_cname || answer->nrrs != 1)
-      {
-        err = map_adns_status_to_gpg_error (answer->status);
-        log_error ("DNS query returned an error or no records: %s (%s)\n",
-                   adns_strerror (answer->status),
-                   adns_errabbrev (answer->status));
-        adns_free (answer);
-        adns_finish (state);
-        return err;
-      }
-    *r_cname = xtrystrdup (answer->rrs.str[0]);
-    if (!*r_cname)
-      err = gpg_error_from_syserror ();
-    else
-      err = 0;
 
-    adns_free (answer);
-    adns_finish (state);
-    return err;
-  }
-#else /*!USE_ADNS*/
-  {
-    union {
-      unsigned char ans[2048];
-      HEADER header[1];
-    } res;
-    unsigned char *answer = res.ans;
-    HEADER *header = res.header;
-    unsigned char *pt, *emsg;
-    int r;
-    char *cname;
-    int cnamesize = 1025;
-    u16 count;
-
-    /* Do not allow a query using the standard resolver in Tor mode.  */
-    if (tor_mode)
-      return -1;
+/* Standard resolver version of get_dns_cname.  */
+gpg_error_t
+get_dns_cname_standard (const char *name, char **r_cname)
+{
+#ifdef HAVE_SYSTEM_RESOLVER
+  gpg_error_t err;
+  int rc;
+  union {
+    unsigned char ans[2048];
+    HEADER header[1];
+  } res;
+  unsigned char *answer = res.ans;
+  HEADER *header = res.header;
+  unsigned char *pt, *emsg;
+  int r;
+  char *cname;
+  int cnamesize = 1025;
+  u16 count;
 
-    r = res_query (name, C_IN, T_CERT, answer, sizeof answer);
-    if (r < sizeof (HEADER) || r > sizeof answer)
-      return gpg_error (GPG_ERR_SERVER_FAILED);
-    if (header->rcode != NOERROR || !(count=ntohs (header->ancount)))
-      return gpg_error (GPG_ERR_NO_NAME); /* Error or no record found.  */
-    if (count != 1)
-      return gpg_error (GPG_ERR_SERVER_FAILED);
+  /* Do not allow a query using the standard resolver in Tor mode.  */
+  if (tor_mode)
+    return -1;
 
-    emsg = &answer[r];
-    pt = &answer[sizeof(HEADER)];
-    rc = dn_skipname (pt, emsg);
-    if (rc == -1)
-      return gpg_error (GPG_ERR_SERVER_FAILED);
+  r = res_query (name, C_IN, T_CERT, answer, sizeof answer);
+  if (r < sizeof (HEADER) || r > sizeof answer)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+  if (header->rcode != NOERROR || !(count=ntohs (header->ancount)))
+    return gpg_error (GPG_ERR_NO_NAME); /* Error or no record found.  */
+  if (count != 1)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+
+  emsg = &answer[r];
+  pt = &answer[sizeof(HEADER)];
+  rc = dn_skipname (pt, emsg);
+  if (rc == -1)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+
+  pt += rc + QFIXEDSZ;
+  if (pt >= emsg)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+
+  rc = dn_skipname (pt, emsg);
+  if (rc == -1)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+  pt += rc + 2 + 2 + 4;
+  if (pt+2 >= emsg)
+    return gpg_error (GPG_ERR_SERVER_FAILED);
+  pt += 2;  /* Skip rdlen */
+
+  cname = xtrymalloc (cnamesize);
+  if (!cname)
+    return gpg_error_from_syserror ();
 
-    pt += rc + QFIXEDSZ;
-    if (pt >= emsg)
+  rc = dn_expand (answer, emsg, pt, cname, cnamesize -1);
+  if (rc == -1)
+    {
+      xfree (cname);
       return gpg_error (GPG_ERR_SERVER_FAILED);
+    }
+  *r_cname = xtryrealloc (cname, strlen (cname)+1);
+  if (!*r_cname)
+    {
+      err = gpg_error_from_syserror ();
+      xfree (cname);
+      return err;
+    }
+  return 0;
 
-    rc = dn_skipname (pt, emsg);
-    if (rc == -1)
-      return gpg_error (GPG_ERR_SERVER_FAILED);
-    pt += rc + 2 + 2 + 4;
-    if (pt+2 >= emsg)
-      return gpg_error (GPG_ERR_SERVER_FAILED);
-    pt += 2;  /* Skip rdlen */
+#else /*!HAVE_SYSTEM_RESOLVER*/
 
-    cname = xtrymalloc (cnamesize);
-    if (!cname)
-      return gpg_error_from_syserror ();
+  (void)name;
+  (void)r_cname;
+  return -1;
 
-    rc = dn_expand (answer, emsg, pt, cname, cnamesize -1);
-    if (rc == -1)
-      {
-        xfree (cname);
-        return gpg_error (GPG_ERR_SERVER_FAILED);
-      }
-    *r_cname = xtryrealloc (cname, strlen (cname)+1);
-    if (!*r_cname)
-      {
-        err = gpg_error_from_syserror ();
-        xfree (cname);
-        return err;
-      }
-    return 0;
-  }
+#endif /*!HAVE_SYSTEM_RESOLVER*/
+}
+
+
+gpg_error_t
+get_dns_cname (const char *name, char **r_cname)
+{
+  *r_cname = NULL;
+
+#ifdef USE_ADNS
+  if (!standard_resolver)
+    return get_dns_cname_adns (name, r_cname);
 #endif /*!USE_ADNS*/
+
+  return get_dns_cname_standard (name, r_cname);
 }
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 10e6d8d..c3c0946 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -92,6 +92,14 @@ struct srventry
 };
 
 
+/* Calling this function with YES set to True forces the use of the
+ * standard resolver even if dirmngr has been built with support for
+ * an alternative resolver.  */
+void enable_standard_resolver (int yes);
+
+/* Return true if the standard resolver is used.  */
+int standard_resolver_p (void);
+
 /* Calling this function switches the DNS code into Tor mode if
    possibe.  Return 0 on success.  */
 gpg_error_t enable_dns_tormode (int new_circuit);
diff --git a/dirmngr/http.c b/dirmngr/http.c
index bc62c82..1078be9 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2323,7 +2323,6 @@ connect_server (const char *server, unsigned short port,
 #endif /*!HASSUAN_SOCK_TOR*/
     }
 
-#ifdef USE_DNS_SRV
   /* Do the SRV thing */
   if (srvtag)
     {
@@ -2347,10 +2346,6 @@ connect_server (const char *server, unsigned short port,
             }
 	}
     }
-#else
-  (void)flags;
-  (void)srvtag;
-#endif /*USE_DNS_SRV*/
 
   if (!serverlist)
     {
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 3b5e75d..8f53432 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -426,11 +426,9 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
       int refidx;
       int is_pool = 0;
       char *cname;
-#ifdef	USE_DNS_SRV
       char *srvrecord;
       struct srventry *srvs;
       int srvscount;
-#endif	/* USE_DNS_SRV */
 
       reftblsize = 100;
       reftbl = xtrymalloc (reftblsize * sizeof *reftbl);
@@ -447,7 +445,6 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
         }
       hi = hosttable[idx];
 
-#ifdef USE_DNS_SRV
       if (!is_ip_address (name))
         {
           /* Check for SRV records.  */
@@ -488,7 +485,6 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
               xfree (srvs);
             }
         }
-#endif /* USE_DNS_SRV */
 
       /* Find all A records for this entry and put them into the pool
          list - if any.  */
diff --git a/dirmngr/server.c b/dirmngr/server.c
index 0088498..f1d762d 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -2309,13 +2309,19 @@ cmd_getinfo (assuan_context_t ctx, char *line)
     }
   else if (!strcmp (line, "dnsinfo"))
     {
+      if (standard_resolver_p ())
+        assuan_set_okay_line
+          (ctx, "- Forced use of System resolver (w/o Tor support)");
+      else
+        {
 #if USE_ADNS && HAVE_ADNS_IF_TORMODE
-      assuan_set_okay_line (ctx, "- ADNS with Tor support");
+          assuan_set_okay_line (ctx, "- ADNS with Tor support");
 #elif USE_ADNS
-      assuan_set_okay_line (ctx, "- ADNS w/o Tor support");
+          assuan_set_okay_line (ctx, "- ADNS w/o Tor support");
 #else
-      assuan_set_okay_line (ctx, "- System resolver w/o Tor support");
+          assuan_set_okay_line (ctx, "- System resolver (w/o Tor support)");
 #endif
+        }
       err = 0;
     }
   else
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index 5e8bf22..8d2cba6 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -64,14 +64,15 @@ main (int argc, char **argv)
         {
           fputs ("usage: " PGM " [HOST]\n"
                  "Options:\n"
-                 "  --verbose         print timings etc.\n"
-                 "  --debug           flyswatter\n"
-                 "  --use-tor         use Tor\n"
-                 "  --new-circuit     use a new Tor circuit\n"
-                 "  --bracket         enclose v6 addresses in brackets\n"
-                 "  --cert            lookup a CERT RR\n"
-                 "  --srv             lookup a SRV RR\n"
-                 "  --cname           lookup a CNAME RR\n"
+                 "  --verbose           print timings etc.\n"
+                 "  --debug             flyswatter\n"
+                 "  --standard-resolver use the system's resolver\n"
+                 "  --use-tor           use Tor\n"
+                 "  --new-circuit       use a new Tor circuit\n"
+                 "  --bracket           enclose v6 addresses in brackets\n"
+                 "  --cert              lookup a CERT RR\n"
+                 "  --srv               lookup a SRV RR\n"
+                 "  --cname             lookup a CNAME RR\n"
                  , stdout);
           exit (0);
         }
@@ -96,6 +97,11 @@ main (int argc, char **argv)
           opt_new_circuit = 1;
           argc--; argv++;
         }
+      else if (!strcmp (*argv, "--standard-resolver"))
+        {
+          enable_standard_resolver (1);
+          argc--; argv++;
+        }
       else if (!strcmp (*argv, "--bracket"))
         {
           opt_bracket = 1;
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 963dff8..62a41b6 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -244,6 +244,13 @@ this still leaks the DNS queries; e.g. to lookup the hosts in a
 keyserver pool.  Certain other features are disabled if this mode is
 active.
 
+ at item --standard-resolver
+ at opindex standard-resolver
+This option forces the use of the system's standard DNS resolver code.
+This is mainly used for debugging.  Note that on Windows a standard
+resolver is not used and all DNS access will return the error ``Not
+Implemented'' if this function is used.
+
 @item --allow-version-check
 @opindex allow-version-check
 Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get

commit 86efc3ee53abaf1e22b53c1b360c51829e476115
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 1 13:08:02 2016 +0100

    gpg: Let only Dirmngr decide whether CERT is supported.
    
    * g10/getkey.c (parse_auto_key_locate): Do not build parts depending
    on USE_DNS_CERT.
    --
    
    This also removes USE_DNS_SRV from commented code.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/getkey.c b/g10/getkey.c
index 6eec087..e39de28 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -4153,10 +4153,8 @@ parse_auto_key_locate (char *options)
 	akl->type = AKL_LDAP;
       else if (ascii_strcasecmp (tok, "keyserver") == 0)
 	akl->type = AKL_KEYSERVER;
-#ifdef USE_DNS_CERT
       else if (ascii_strcasecmp (tok, "cert") == 0)
 	akl->type = AKL_CERT;
-#endif
       else if (ascii_strcasecmp (tok, "pka") == 0)
 	akl->type = AKL_PKA;
       else if (ascii_strcasecmp (tok, "dane") == 0)
diff --git a/g10/keyserver.c b/g10/keyserver.c
index 9148e7d..c7363c9 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -2084,11 +2084,9 @@ keyserver_import_ldap (ctrl_t ctrl,
   struct keyserver_spec *keyserver;
   strlist_t list=NULL;
   int rc,hostlen=1;
-#ifdef USE_DNS_SRV
   struct srventry *srvlist=NULL;
   int srvcount,i;
   char srvname[MAXDNAME];
-#endif
 
   /* Parse out the domain */
   domain=strrchr(name,'@');
@@ -2102,7 +2100,6 @@ keyserver_import_ldap (ctrl_t ctrl,
   keyserver->host=xmalloc(1);
   keyserver->host[0]='\0';
 
-#ifdef USE_DNS_SRV
   snprintf(srvname,MAXDNAME,"_pgpkey-ldap._tcp.%s",domain);
 
   FIXME("network related - move to dirmngr or drop the code");
@@ -2130,7 +2127,6 @@ keyserver_import_ldap (ctrl_t ctrl,
     }
 
   free(srvlist);
-#endif
 
   /* If all else fails, do the PGP Universal trick of
      ldap://keys.(domain) */

-----------------------------------------------------------------------

Summary of changes:
 configure.ac            | 118 ++++-----
 dirmngr/dirmngr.c       |   5 +
 dirmngr/dns-stuff.c     | 693 +++++++++++++++++++++++++++---------------------
 dirmngr/dns-stuff.h     |   8 +
 dirmngr/http.c          |   5 -
 dirmngr/ks-engine-hkp.c |   4 -
 dirmngr/server.c        |  12 +-
 dirmngr/t-dns-stuff.c   |  22 +-
 doc/dirmngr.texi        |   7 +
 g10/getkey.c            |   2 -
 g10/keyserver.c         |   4 -
 11 files changed, 483 insertions(+), 397 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 16:53:04 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 16:53:04 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-199-g602f299
Message-ID: <E1cCTfW-0004hD-Dd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  602f299383b9d06a6d520e2c3cf52a6d0a3d3f56 (commit)
      from  b3fdbb2244f2d049b458160d7f3da6340745ad7a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 602f299383b9d06a6d520e2c3cf52a6d0a3d3f56
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 16:52:35 2016 +0100

    Remove some development debugs
    
    * src/mail.cpp (update_oom_data): Remove some development
    debug statements.

diff --git a/src/mail.cpp b/src/mail.cpp
index b8e02ac..1e820c6 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -856,7 +856,6 @@ Mail::update_oom_data ()
           if (senderMail)
             {
               m_sender = senderMail;
-              log_debug ("Sender %i is now: %s",__LINE__, m_sender.c_str());
               xfree (senderMail);
               xfree (type);
               return 0;
@@ -869,7 +868,6 @@ Mail::update_oom_data ()
     {
       char *buf = get_oom_string (sender, "SmtpAddress");
       m_sender = buf;
-          log_debug ("Sender %i is now: %s",__LINE__, m_sender.c_str());
       xfree (buf);
       gpgol_release (sender);
       return 0;
@@ -880,7 +878,6 @@ Mail::update_oom_data ()
     {
       char *buf = get_pa_string (sender, PR_SMTP_ADDRESS_DASL);
       m_sender = buf;
-          log_debug ("Sender %i is now: %s",__LINE__, m_sender.c_str());
       xfree (buf);
       gpgol_release (sender);
       return 0;
@@ -892,7 +889,6 @@ Mail::update_oom_data ()
     {
       char *buf = get_pa_string (sender, PR_SMTP_ADDRESS_DASL);
       m_sender = buf;
-          log_debug ("Sender %i is now: %s",__LINE__, m_sender.c_str());
       xfree (buf);
       gpgol_release (sender);
       return 0;

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp | 4 ----
 1 file changed, 4 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 16:58:17 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 16:58:17 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-200-g589fc6d
Message-ID: <E1cCTkZ-0004np-OT@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  589fc6d790969979d2ae1c0e2c947967241d7741 (commit)
      from  602f299383b9d06a6d520e2c3cf52a6d0a3d3f56 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 589fc6d790969979d2ae1c0e2c947967241d7741
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 16:57:43 2016 +0100

    Add missing icon
    
    * src/icons/emblem-success-yellow-64.png: New.

diff --git a/src/icons/emblem-success-yellow-64.png b/src/icons/emblem-success-yellow-64.png
new file mode 100644
index 0000000..b81aed1
Binary files /dev/null and b/src/icons/emblem-success-yellow-64.png differ

-----------------------------------------------------------------------

Summary of changes:
 src/icons/emblem-success-yellow-64.png | Bin 0 -> 2519 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 src/icons/emblem-success-yellow-64.png


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 17:14:15 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 17:14:15 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-202-gdff5213
Message-ID: <E1cCU01-0005RY-Oj@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  dff5213c6a57984c3a06d2d0289697ffbf872950 (commit)
       via  fd7d8e2325a08695838b9ba217bbd57066822a1f (commit)
      from  589fc6d790969979d2ae1c0e2c947967241d7741 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dff5213c6a57984c3a06d2d0289697ffbf872950
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 17:13:14 2016 +0100

    Add supertip for unsigned messages
    
    * src/ribbon-callbacks.cpp (get_sig_stip): Handle mail not found
    case.
    
    --
    Mail not found means no crypto mail

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 59afca1..374885d 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1567,7 +1567,7 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
     }
   else
     {
-      w_result = utf8_to_wchar (_("This message is not cryptographically signed"));
+      w_result = utf8_to_wchar (_("This message is not cryptographically signed."));
     }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);
@@ -1583,7 +1583,10 @@ HRESULT get_sig_stip (LPDISPATCH ctrl, VARIANT *result)
     {
       log_debug ("%s:%s: No mail.",
                  SRCNAME, __func__);
-      result->bstrVal = SysAllocString (L"");
+      wchar_t *w_result;
+      w_result = utf8_to_wchar (_("You cannot be sure who wrote the message."));
+      result->bstrVal = SysAllocString (w_result);
+      xfree (w_result);
       return S_OK;
     }
   const auto message = mail->get_signature_status ();

commit fd7d8e2325a08695838b9ba217bbd57066822a1f
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 17:09:30 2016 +0100

    Fix crash when viewing unsigned mails
    
    * src/ribbon-callbacks.cpp (get_sig_label): Return early
    if mail not found.
    
    --
    Ooops. Although it could be considered a security feature ;-)

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index f02ab89..59afca1 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1525,6 +1525,10 @@ HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result)
     {
       log_debug ("%s:%s: No mail.",
                  SRCNAME, __func__);
+      w_result = utf8_to_wchar (_("Not Trusted"));
+      result->bstrVal = SysAllocString (w_result);
+      xfree (w_result);
+      return S_OK;
     }
   bool valid = mail->is_valid_sig ();
   const auto pair = mail->get_valid_sig ();

-----------------------------------------------------------------------

Summary of changes:
 src/ribbon-callbacks.cpp | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 17:21:30 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 01 Dec 2016 17:21:30 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-46-gd0bfe3d
Message-ID: <E1cCU73-0006Dy-7C@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d0bfe3de1f8d1abdcda573188eaea9dc5fd495c7 (commit)
      from  304566d3327ef0a85188cce3109d46d5ff47177a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d0bfe3de1f8d1abdcda573188eaea9dc5fd495c7
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 1 17:19:26 2016 +0100

    Register DCO for Tobias Mueller.
    
    --
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/AUTHORS b/AUTHORS
index 2bbacd9..29264d3 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -191,6 +191,9 @@ Kyle Butt <kylebutt at gmail.com>
 Stefan Tomanek <tomanek at internet-sicherheit.de>
 2014-01-30:20140129234449.GY30808 at zirkel.wertarbyte.de:
 
+Tobias Mueller <muelli at cryptobitch.de>
+2016-11-23:1479937342.11180.3.camel at cryptobitch.de:
+
 Werner Koch <wk at gnupg.org>
 2013-03-29:87620ahchj.fsf at vigenere.g10code.de:
 

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS | 3 +++
 1 file changed, 3 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 17:23:30 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 17:23:30 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-203-g5e58582
Message-ID: <E1cCU8y-0006G6-Ba@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  5e58582a83da40ea2b0e234e1a9f638c6ccfd9c7 (commit)
      from  dff5213c6a57984c3a06d2d0289697ffbf872950 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5e58582a83da40ea2b0e234e1a9f638c6ccfd9c7
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 17:22:05 2016 +0100

    Fix Reply event ID
    
    * src/mailitem-events.cpp (MailEvent): Fix reply id.
    
    --
    This explains why the reply event behaved surprisingly as
    it was actually the ReadComplete event...

diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index 101e2a8..c23aa9d 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -66,7 +66,7 @@ typedef enum
     PropertyChange = 0xF009,
     Read = 0xF001,
     ReadComplete = 0xFC8F,
-    Reply = 0xFC8F,
+    Reply = 0xF466,
     ReplyAll = 0xF467,
     Send = 0xF005,
     Unload = 0xFBAD,

-----------------------------------------------------------------------

Summary of changes:
 src/mailitem-events.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 17:40:04 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 01 Dec 2016 17:40:04 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-204-gb527d97
Message-ID: <E1cCUP0-00072C-Fh@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  b527d97b06c684bc00df3023407c60c4338a71ec (commit)
      from  5e58582a83da40ea2b0e234e1a9f638c6ccfd9c7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b527d97b06c684bc00df3023407c60c4338a71ec
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 1 17:37:57 2016 +0100

    Preselect sign / encrypt for reply / forward
    
    * src/mail.cpp (Mail::Mail): Initalize crypto flags.
    (Mail::get_crypto_flags): New.
    (Mail::parsing_done): Set crypto flags.
    * src/mailitem-events.cpp (EVENT_SINK_INVOKE): Handle reply, forward
    and ReplyAll.
    
    --
    This sets sign for signed mails, encrypt for encrypted mails
    and sign & encrypt for signed and encrypted mails.

diff --git a/src/mail.cpp b/src/mail.cpp
index 1e820c6..162b817 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -78,6 +78,7 @@ Mail::Mail (LPDISPATCH mailitem) :
     m_close_triggered(false),
     m_is_html_alternative(false),
     m_moss_position(0),
+    m_crypto_flags(0),
     m_type(MSGTYPE_UNKNOWN)
 {
   if (get_mail_for_item (mailitem))
@@ -711,6 +712,16 @@ Mail::parsing_done()
   m_decrypt_result = m_parser->decrypt_result ();
   m_verify_result = m_parser->verify_result ();
 
+  m_crypto_flags = 0;
+  if (m_decrypt_result.numRecipients())
+    {
+      m_crypto_flags |= 1;
+    }
+  if (m_verify_result.numSignatures())
+    {
+      m_crypto_flags |= 2;
+    }
+
   update_sigstate ();
   m_needs_wipe = true;
 
@@ -1703,3 +1714,9 @@ Mail::get_cached_html_body () const
 {
   return m_html_body;
 }
+
+int
+Mail::get_crypto_flags () const
+{
+  return m_crypto_flags;
+}
diff --git a/src/mail.h b/src/mail.h
index 7eddf34..680ea1c 100644
--- a/src/mail.h
+++ b/src/mail.h
@@ -299,6 +299,11 @@ public:
 
   /** Get the html body. It is updated in update_oom_data. */
   const std::string & get_cached_html_body () const;
+
+  /** Returns 1 if the mail was encrypted, 2 if signed, 3 if both.
+      Only valid after decrypt_verify.
+  */
+  int get_crypto_flags () const;
 private:
   void update_categories ();
   void update_body ();
@@ -317,6 +322,7 @@ private:
        m_close_triggered, /* We have programtically triggered a close */
        m_is_html_alternative; /* Body Format is not plain text */
   int m_moss_position; /* The number of the original message attachment. */
+  int m_crypto_flags;
   std::string m_sender;
   std::string m_html_body; /* Cached html body. */
   msgtype_t m_type; /* Our messagetype as set in mapi */
diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index c23aa9d..4ae4ec3 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -418,6 +418,38 @@ EVENT_SINK_INVOKE(MailItemEvents)
           delete m_mail;
           return S_OK;
         }
+      case Forward:
+      case Reply:
+      case ReplyAll:
+        {
+          log_oom_extra ("%s:%s: Reply Forward ReplyAll: %p",
+                         SRCNAME, __func__, m_mail);
+          int crypto_flags = 0;
+          if (!(crypto_flags = m_mail->get_crypto_flags ()))
+            {
+              break;
+            }
+          if (parms->cArgs != 2 || parms->rgvarg[1].vt != (VT_DISPATCH) ||
+              parms->rgvarg[0].vt != (VT_BOOL | VT_BYREF))
+            {
+              /* This happens in the weird case */
+              log_debug ("%s:%s: Unexpected args %i %x %x named: %i",
+                         SRCNAME, __func__, parms->cArgs, parms->rgvarg[0].vt, parms->rgvarg[1].vt,
+                         parms->cNamedArgs);
+              break;
+            }
+          LPMESSAGE msg = get_oom_base_message (parms->rgvarg[1].pdispVal);
+          if (!msg)
+            {
+              log_debug ("%s:%s: Failed to get base message",
+                         SRCNAME, __func__);
+              break;
+            }
+          set_gpgol_draft_info_flags (msg, crypto_flags);
+          gpgol_release (msg);
+          break;
+        }
+
       default:
         log_oom_extra ("%s:%s: Message:%p Unhandled Event: %lx \n",
                        SRCNAME, __func__, m_object, dispid);

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp            | 17 +++++++++++++++++
 src/mail.h              |  6 ++++++
 src/mailitem-events.cpp | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 17:45:08 2016
From: cvs at cvs.gnupg.org (by Tobias Mueller)
Date: Thu, 01 Dec 2016 17:45:08 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-7-gae21d27
Message-ID: <E1cCUTu-0007AN-KM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ae21d2705fc46725e1f9af1651b68d16155d1501 (commit)
       via  154389f2a5e4c13081cf0624222aad29ee480b56 (commit)
       via  db2f6c1ca3d2ef228f4ca6653d594537622c8588 (commit)
      from  fd4d476214ae06e33f4a6dac534d3deca5cc6cd3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ae21d2705fc46725e1f9af1651b68d16155d1501
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Wed Nov 30 23:08:47 2016 +0100

    python: Check "buffer" when writing to sys.stdout for python2 compat.
    
    * lang/python/tests/support.py (print_data): Add check for buffer.
    --
    
    When running with something like make -C lang/python check verbose=2 the
    test would fail under python2, because the file objects do not have a
    buffer property.
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/tests/support.py b/lang/python/tests/support.py
index f991c6d..0b04bb6 100644
--- a/lang/python/tests/support.py
+++ b/lang/python/tests/support.py
@@ -48,7 +48,11 @@ def print_data(data):
         except:
             # Hope for the best.
             pass
-        sys.stdout.buffer.write(data)
+
+        if hasattr(sys.stdout, "buffer"):
+            sys.stdout.buffer.write(data)
+        else:
+            sys.stdout.write(data)
 
 def mark_key_trusted(ctx, key):
     class Editor(object):

commit 154389f2a5e4c13081cf0624222aad29ee480b56
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Tue Nov 29 23:26:20 2016 +0100

    python: Make Context have a repr method.
    
    * lang/python/gpg/core.py (Context.__repr__): New function.
    --
    
    This makes Context objects look nicer in a REPL.
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/gpg/core.py b/lang/python/gpg/core.py
index 748bcbb..43856ab 100644
--- a/lang/python/gpg/core.py
+++ b/lang/python/gpg/core.py
@@ -204,6 +204,14 @@ class Context(GpgmeWrapper):
         self.pinentry_mode = pinentry_mode
         self.protocol = protocol
 
+    def __repr__(self):
+        return (
+            "Context(armor={0.armor}, "
+            "textmode={0.textmode}, offline={0.offline}, "
+            "signers={0.signers}, pinentry_mode={0.pinentry_mode}, "
+            "protocol={0.protocol}"
+            ")").format(self)
+
     def encrypt(self, plaintext, recipients=[], sign=True, sink=None,
                 passphrase=None, always_trust=False, add_encrypt_to=False,
                 prepare=False, expect_sign=False, compress=True):

commit db2f6c1ca3d2ef228f4ca6653d594537622c8588
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Wed Nov 30 08:47:29 2016 +0100

    python: Make Results have a nicer __repr__.
    
    * lang/python/gpg/results.py (Result.__str__): Renamed to '__repr__'
    ...
    * lang/python/gpg/results.py (Result.__repr__): ... and added fields.
    --
    
    So that it looks a bit nicer in the Python REPL.
    
    It looked like this before:
    
    In [2]: gpg.core.get_engine_info()[0]
    Out[2]:
    <gpg.results.EngineInfo at 0x7fb23509a240>
    
    Now the output is
    
    In [2]: gpg.core.get_engine_info()[0]
    Out[2]:
    EngineInfo(file_name='/usr/bin/gpg2', home_dir=None,
    protocol=0, req_version='1.4.0', version='2.1.11')
    
    This also applies to other results, e.g. the ImportResult.
    
    Note that the format now changed from "<Class >" to "Class()". The
    Python documentation on repr states: "For many object types, including
    most builtins, eval(repr(obj)) == obj."
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/gpg/results.py b/lang/python/gpg/results.py
index 3383896..46ebeec 100644
--- a/lang/python/gpg/results.py
+++ b/lang/python/gpg/results.py
@@ -64,10 +64,10 @@ class Result(object):
 
             setattr(self, key, getattr(fragile, key))
 
-    def __str__(self):
-        return '<{} {}>'.format(
+    def __repr__(self):
+        return '{}({})'.format(
             self.__class__.__name__,
-            ', '.join('{}: {}'.format(k, getattr(self, k))
+            ', '.join('{}={!r}'.format(k, getattr(self, k))
                       for k in dir(self) if not k.startswith('_')))
 
 class InvalidKey(Result):

-----------------------------------------------------------------------

Summary of changes:
 lang/python/gpg/core.py      | 8 ++++++++
 lang/python/gpg/results.py   | 6 +++---
 lang/python/tests/support.py | 6 +++++-
 3 files changed, 16 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  1 22:13:41 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Thu, 01 Dec 2016 22:13:41 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-47-gbd1a1d8
Message-ID: <E1cCYfo-0002qp-2L@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  bd1a1d8582abcfd7f29812942fa70f88d0aec7cf (commit)
      from  d0bfe3de1f8d1abdcda573188eaea9dc5fd495c7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit bd1a1d8582abcfd7f29812942fa70f88d0aec7cf
Author: Neal H. Walfield <neal at g10code.com>
Date:   Thu Dec 1 21:25:08 2016 +0100

    g10: In the TOFU module, make strings easier to translate.
    
    * g10/tofu.c: Remove dead code.
    (time_ago_str): Simplify implementation since we only want the most
    significant unit.
    (format_conflict_msg_part1): Use ngettext.
    (ask_about_binding): Likewise and only emit full sentences.
    (show_statistics): Likewise.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index 14e4f1d..c307d25 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -1296,21 +1296,6 @@ signature_stats_collect_cb (void *cookie, int argc, char **argv,
   return 0;
 }
 
-/* Convert from seconds to time units.
-
-   Note: T should already be a multiple of TIME_AGO_UNIT_SMALL or
-   TIME_AGO_UNIT_MEDIUM or TIME_AGO_UNIT_LARGE.  */
-signed long
-time_ago_scale (signed long t)
-{
-  if (t < TIME_AGO_UNIT_MEDIUM)
-    return t / TIME_AGO_UNIT_SMALL;
-  if (t < TIME_AGO_UNIT_LARGE)
-    return t / TIME_AGO_UNIT_MEDIUM;
-  return t / TIME_AGO_UNIT_LARGE;
-}
-
-
 /* Format the first part of a conflict message and return that as a
  * malloced string.  */
 static char *
@@ -1340,8 +1325,11 @@ format_conflict_msg_part1 (int policy, strlist_t conflict_set,
   else if (policy == TOFU_POLICY_ASK && conflict_set->next)
     {
       int conflicts = strlist_length (conflict_set);
-      es_fprintf (fp, _("The email address \"%s\" is associated with %d keys!"),
-                  email, conflicts);
+      es_fprintf
+        (fp, ngettext("The email address \"%s\" is associated with %d key!",
+                      "The email address \"%s\" is associated with %d keys!",
+                      conflicts),
+         email, conflicts);
       if (opt.verbose)
         es_fprintf (fp,
                     _("  Since this binding's policy was 'auto', it has been "
@@ -1743,6 +1731,7 @@ ask_about_binding (ctrl_t ctrl,
       char *key = NULL;
       strlist_t binding;
       int seen_in_past = 0;
+      int encrypted = 1;
 
       es_fprintf (fp, _("Statistics for keys"
                         " with the email address \"%s\":\n"),
@@ -1756,6 +1745,14 @@ ask_about_binding (ctrl_t ctrl,
                      stats_iter->count);
 #endif
 
+          if (stats_iter->time_ago > 0 && encrypted)
+            {
+              /* We've change from the encrypted stats to the verified
+               * stats.  Reset SEEN_IN_PAST.  */
+              encrypted = 0;
+              seen_in_past = 0;
+            }
+
           if (! key || strcmp (key, stats_iter->fingerprint))
             {
               int this_key;
@@ -1805,50 +1802,92 @@ ask_about_binding (ctrl_t ctrl,
           seen_in_past += stats_iter->count;
 
           es_fputs ("    ", fp);
-          /* TANSLATORS: This string is concatenated with one of
-           * the day/week/month strings to form one sentence.  */
-          if (stats_iter->time_ago > 0)
-            es_fprintf (fp, ngettext("Verified %d message",
-                                     "Verified %d messages",
-                                     seen_in_past), seen_in_past);
-          else
-            es_fprintf (fp, ngettext("Encrypted %d message",
-                                     "Encrypted %d messages",
-                                     seen_in_past), seen_in_past);
 
           if (!stats_iter->count)
-            es_fputs (".", fp);
+            {
+              if (stats_iter->time_ago > 0)
+                es_fprintf (fp, ngettext("Verified %d message.",
+                                         "Verified %d messages.",
+                                         seen_in_past), seen_in_past);
+              else
+                es_fprintf (fp, ngettext("Encrypted %d message.",
+                                         "Encrypted %d messages.",
+                                         seen_in_past), seen_in_past);
+            }
           else if (labs(stats_iter->time_ago) == 2)
             {
-              es_fprintf (fp, "in the future.");
+              if (stats_iter->time_ago > 0)
+                es_fprintf (fp, ngettext("Verified %d message in the future.",
+                                         "Verified %d messages in the future.",
+                                         seen_in_past), seen_in_past);
+              else
+                es_fprintf (fp, ngettext("Encrypted %d message in the future.",
+                                         "Encrypted %d messages in the future.",
+                                         seen_in_past), seen_in_past);
               /* Reset it.  */
               seen_in_past = 0;
             }
           else
             {
               if (labs(stats_iter->time_ago) == 3)
-                es_fprintf (fp, ngettext(" over the past day.",
-                                         " over the past %d days.",
-                                         TIME_AGO_SMALL_THRESHOLD
-                                         / TIME_AGO_UNIT_SMALL),
-                            TIME_AGO_SMALL_THRESHOLD
-                            / TIME_AGO_UNIT_SMALL);
+                {
+                  int days = 1 + stats_iter->time_ago / TIME_AGO_UNIT_SMALL;
+                  if (stats_iter->time_ago > 0)
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages verified over the past %d day: %d.",
+                                "Messages verified over the past %d days: %d.",
+                                days), days, seen_in_past);
+                  else
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages encrypted over the past %d day: %d.",
+                                "Messages encrypted over the past %d days: %d.",
+                                days), days, seen_in_past);
+                }
               else if (labs(stats_iter->time_ago) == 4)
-                es_fprintf (fp, ngettext(" over the past month.",
-                                         " over the past %d months.",
-                                         TIME_AGO_MEDIUM_THRESHOLD
-                                         / TIME_AGO_UNIT_MEDIUM),
-                            TIME_AGO_MEDIUM_THRESHOLD
-                            / TIME_AGO_UNIT_MEDIUM);
+                {
+                  int months = 1 + stats_iter->time_ago / TIME_AGO_UNIT_MEDIUM;
+                  if (stats_iter->time_ago > 0)
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages verified over the past %d month: %d.",
+                                "Messages verified over the past %d months: %d.",
+                                months), months, seen_in_past);
+                  else
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages encrypted over the past %d month: %d.",
+                                "Messages encrypted over the past %d months: %d.",
+                                months), months, seen_in_past);
+                }
               else if (labs(stats_iter->time_ago) == 5)
-                es_fprintf (fp, ngettext(" over the past year.",
-                                         " over the past %d years.",
-                                         TIME_AGO_LARGE_THRESHOLD
-                                         / TIME_AGO_UNIT_LARGE),
-                            TIME_AGO_LARGE_THRESHOLD
-                            / TIME_AGO_UNIT_LARGE);
+                {
+                  int years = 1 + stats_iter->time_ago / TIME_AGO_UNIT_LARGE;
+                  if (stats_iter->time_ago > 0)
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages verified over the past %d year: %d.",
+                                "Messages verified over the past %d years: %d.",
+                                years), years, seen_in_past);
+                  else
+                    es_fprintf
+                      (fp,
+                       ngettext("Messages encrypted over the past %d year: %d.",
+                                "Messages encrypted over the past %d years: %d.",
+                                years), years, seen_in_past);
+                }
               else if (labs(stats_iter->time_ago) == 6)
-                es_fprintf (fp, _(" in the past."));
+                {
+                  if (stats_iter->time_ago > 0)
+                    es_fprintf
+                      (fp, _("Messages verified in the past: %d."),
+                       seen_in_past);
+                  else
+                    es_fprintf
+                      (fp, _("Messages encrypted in the past: %d."),
+                       seen_in_past);
+                }
               else
                 log_assert (! "Broken SQL.\n");
             }
@@ -2751,7 +2790,7 @@ get_trust (ctrl_t ctrl, PKT_public_key *pk,
 
 
 /* Return a malloced string of the form
- *    "7 months, 1 day, 5 minutes, 0 seconds"
+ *    "7~months"
  * The caller should replace all '~' in the returned string by a space
  * and also free the returned string.
  *
@@ -2761,127 +2800,46 @@ get_trust (ctrl_t ctrl, PKT_public_key *pk,
 static char *
 time_ago_str (long long int t)
 {
-  estream_t fp;
-  int years = 0;
-  int months = 0;
-  int days = 0;
-  int hours = 0;
-  int minutes = 0;
-  int seconds = 0;
-
-  /* The number of units that we've printed so far.  */
-  int count = 0;
-  /* The first unit that we printed (year = 0, month = 1,
-     etc.).  */
-  int first = -1;
-  /* The current unit.  */
-  int i = 0;
-
-  char *str;
-
   /* It would be nice to use a macro to do this, but gettext
      works on the unpreprocessed code.  */
 #define MIN_SECS (60)
 #define HOUR_SECS (60 * MIN_SECS)
 #define DAY_SECS (24 * HOUR_SECS)
+#define WEEK_SECS (7 * DAY_SECS)
 #define MONTH_SECS (30 * DAY_SECS)
 #define YEAR_SECS (365 * DAY_SECS)
 
-  if (t > YEAR_SECS)
-    {
-      years = t / YEAR_SECS;
-      t -= years * YEAR_SECS;
-    }
-  if (t > MONTH_SECS)
+  if (t > 2 * YEAR_SECS)
     {
-      months = t / MONTH_SECS;
-      t -= months * MONTH_SECS;
+      long long int c = t / YEAR_SECS;
+      return xtryasprintf (ngettext("%lld~year", "%lld~years", c), c);
     }
-  if (t > DAY_SECS)
+  if (t > 2 * MONTH_SECS)
     {
-      days = t / DAY_SECS;
-      t -= days * DAY_SECS;
+      long long int c = t / MONTH_SECS;
+      return xtryasprintf (ngettext("%lld~month", "%lld~months", c), c);
     }
-  if (t > HOUR_SECS)
+  if (t > 2 * WEEK_SECS)
     {
-      hours = t / HOUR_SECS;
-      t -= hours * HOUR_SECS;
+      long long int c = t / WEEK_SECS;
+      return xtryasprintf (ngettext("%lld~week", "%lld~weeks", c), c);
     }
-  if (t > MIN_SECS)
+  if (t > 2 * DAY_SECS)
     {
-      minutes = t / MIN_SECS;
-      t -= minutes * MIN_SECS;
+      long long int c = t / DAY_SECS;
+      return xtryasprintf (ngettext("%lld~day", "%lld~days", c), c);
     }
-  seconds = t;
-
-#undef MIN_SECS
-#undef HOUR_SECS
-#undef DAY_SECS
-#undef MONTH_SECS
-#undef YEAR_SECS
-
-  fp = es_fopenmem (0, "rw,samethread");
-  if (! fp)
-    log_fatal ("error creating memory stream: %s\n",
-               gpg_strerror (gpg_error_from_syserror()));
-
-  if (years)
+  if (t > 2 * HOUR_SECS)
     {
-      /* TRANSLATORS: The tilde ('~') is used here to indicate a
-       * non-breakable space  */
-      es_fprintf (fp, ngettext("%d~year", "%d~years", years), years);
-      count ++;
-      first = i;
+      long long int c = t / HOUR_SECS;
+      return xtryasprintf (ngettext("%lld~hour", "%lld~hours", c), c);
     }
-  i ++;
-  if ((first == -1 || i - first <= 3) && count <= 0 && months)
+  if (t > 2 * MIN_SECS)
     {
-      if (count)
-        es_fprintf (fp, ", ");
-      es_fprintf (fp, ngettext("%d~month", "%d~months", months), months);
-      count ++;
-      first = i;
+      long long int c = t / MIN_SECS;
+      return xtryasprintf (ngettext("%lld~minute", "%lld~minutes", c), c);
     }
-  i ++;
-  if ((first == -1 || i - first <= 3) && count <= 0 && days)
-    {
-      if (count)
-        es_fprintf (fp, ", ");
-      es_fprintf (fp, ngettext("%d~day", "%d~days", days), days);
-      count ++;
-      first = i;
-    }
-  i ++;
-  if ((first == -1 || i - first <= 3) && count <= 0 && hours)
-    {
-      if (count)
-        es_fprintf (fp, ", ");
-      es_fprintf (fp, ngettext("%d~hour", "%d~hours", hours), hours);
-      count ++;
-      first = i;
-    }
-  i ++;
-  if ((first == -1 || i - first <= 3) && count <= 0 && minutes)
-    {
-      if (count)
-        es_fprintf (fp, ", ");
-      es_fprintf (fp, ngettext("%d~minute", "%d~minutes", minutes), minutes);
-      count ++;
-      first = i;
-    }
-  i ++;
-  if ((first == -1 || i - first <= 3) && count <= 0)
-    {
-      if (count)
-        es_fprintf (fp, ", ");
-      es_fprintf (fp, ngettext("%d~second", "%d~seconds", seconds), seconds);
-    }
-
-  es_fputc (0, fp);
-  if (es_fclose_snatch (fp, (void **) &str, NULL))
-    log_fatal ("error snatching memory stream\n");
-
-  return str;
+  return xtryasprintf (ngettext("%lld~second", "%lld~seconds", t), t);
 }
 
 
@@ -3066,56 +3024,55 @@ show_statistics (tofu_dbs_t dbs, PKT_public_key *pk, const char *fingerprint,
         log_fatal ("error creating memory stream: %s\n",
                    gpg_strerror (gpg_error_from_syserror()));
 
-      es_fprintf (fp, _("%s: "), email);
-
-      if (signature_count == 0)
+      if (signature_count == 0 && encryption_count == 0)
         {
-          es_fprintf (fp, _("Verified %ld signatures"), 0L);
-          es_fputc ('\n', fp);
-        }
-      else
-        {
-          char *first_seen_ago_str = time_ago_str (now - signature_first_seen);
-
-          /* TRANSLATORS: The final %s is replaced by a string like
-             "7 months, 1 day, 5 minutes, 0 seconds". */
           es_fprintf (fp,
-                      ngettext("Verified %ld signature in the past %s",
-                               "Verified %ld signatures in the past %s",
-                               signature_count),
-                      signature_count, first_seen_ago_str);
-
-          xfree (first_seen_ago_str);
-        }
-
-      if (encryption_count == 0)
-        {
-          es_fprintf (fp, _(", and encrypted %ld messages"), 0L);
+                      _("%s: Verified 0~signatures and encrypted 0~messages."),
+                      email);
         }
       else
         {
-          char *first_done_ago_str = time_ago_str (now - encryption_first_done);
+          if (signature_count == 0)
+            es_fprintf (fp, _("%s: Verified 0 signatures."), email);
+          else
+            {
+              /* TRANSLATORS: The final %s is replaced by a string like
+                 "7~months". */
+              char *ago_str = time_ago_str (now - signature_first_seen);
+              es_fprintf
+                (fp,
+                 ngettext("%s: Verified %ld~signature in the past %s.",
+                          "%s: Verified %ld~signatures in the past %s.",
+                          signature_count),
+                 email, signature_count, ago_str);
+              xfree (ago_str);
+            }
 
-          /* TRANSLATORS: The final %s is replaced by a string like
-             "7 months, 1 day, 5 minutes, 0 seconds". */
-          es_fprintf (fp,
-                      ngettext(", and encrypted %ld message in the past %s",
-                               ", and encrypted %ld messages in the past %s",
-                               encryption_count),
-                      encryption_count, first_done_ago_str);
+          es_fputs ("  ", fp);
 
-          xfree (first_done_ago_str);
+          if (encryption_count == 0)
+            es_fprintf (fp, _("Encrypted 0 messages."));
+          else
+            {
+              char *ago_str = time_ago_str (now - encryption_first_done);
+
+              /* TRANSLATORS: The final %s is replaced by a string like
+                 "7~months". */
+              es_fprintf (fp,
+                          ngettext("Encrypted %ld~message in the past %s.",
+                                   "Encrypted %ld~messages in the past %s.",
+                                   encryption_count),
+                          encryption_count, ago_str);
+              xfree (ago_str);
+            }
         }
 
       if (opt.verbose)
         {
           es_fputs ("  ", fp);
-          es_fputc ('(', fp);
-          es_fprintf (fp, _("policy: %s"), tofu_policy_str (policy));
-          es_fputs (").\n", fp);
+          es_fprintf (fp, _("(policy: %s)"), tofu_policy_str (policy));
         }
-      else
-        es_fputs (".\n", fp);
+      es_fputs ("\n", fp);
 
 
       {

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c | 331 +++++++++++++++++++++++++++----------------------------------
 1 file changed, 144 insertions(+), 187 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  2 11:07:20 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Fri, 02 Dec 2016 11:07:20 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-48-gcd532bb
Message-ID: <E1cCkkV-0006P7-P0@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  cd532bb7b866e104304e2443cc942799c385daa5 (commit)
      from  bd1a1d8582abcfd7f29812942fa70f88d0aec7cf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cd532bb7b866e104304e2443cc942799c385daa5
Author: Neal H. Walfield <neal at g10code.com>
Date:   Fri Dec 2 11:06:25 2016 +0100

    g10: Improve debugging output.
    
    * g10/tofu.c (string_to_long): Improve debugging output.
    (string_to_ulong): Likewise.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index c307d25..18f9c54 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -410,9 +410,12 @@ string_to_long (long *r_value, const char *string, long fallback, int line)
   if (errno || !(!strcmp (tail, ".0") || !*tail))
     {
       err = errno? gpg_error_from_errno (errno) : gpg_error (GPG_ERR_BAD_DATA);
-      log_debug ("%s:%d: "
-                 "strtol failed for DB returned string (tail=%.10s): %s\n",
-                 __FILE__, line, tail, gpg_strerror (err));
+      log_debug ("%s:%d: strtol failed for TOFU DB data; returned string"
+                 " (string='%.10s%s'; tail='%.10s%s'): %s\n",
+                 __FILE__, line,
+                 string, string && strlen(string) > 10 ? "..." : "",
+                 tail, tail && strlen(tail) > 10 ? "..." : "",
+                 gpg_strerror (err));
       *r_value = fallback;
     }
   else
@@ -438,9 +441,12 @@ string_to_ulong (unsigned long *r_value, const char *string,
   if (errno || !(!strcmp (tail, ".0") || !*tail))
     {
       err = errno? gpg_error_from_errno (errno) : gpg_error (GPG_ERR_BAD_DATA);
-      log_debug ("%s:%d: "
-                 "strtoul failed for DB returned string (tail=%.10s): %s\n",
-                 __FILE__, line, tail, gpg_strerror (err));
+      log_debug ("%s:%d: strtoul failed for TOFU DB data; returned string"
+                 " (string='%.10s%s'; tail='%.10s%s'): %s\n",
+                 __FILE__, line,
+                 string, string && strlen(string) > 10 ? "..." : "",
+                 tail, tail && strlen(tail) > 10 ? "..." : "",
+                 gpg_strerror (err));
       *r_value = fallback;
     }
   else

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  2 19:51:15 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 02 Dec 2016 19:51:15 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-49-gce29272
Message-ID: <E1cCsvV-00079J-U5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ce29272e24e7b718b8fca9b84bc728e65f3dea24 (commit)
      from  cd532bb7b866e104304e2443cc942799c385daa5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ce29272e24e7b718b8fca9b84bc728e65f3dea24
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 2 19:43:36 2016 +0100

    gpg: New option --default-new-key-algo.
    
    * common/openpgp-oid.c (openpgp_is_curve_supported): Add optional arg
    R_ALGO and change all callers.
    * common/util.h (GPG_ERR_UNKNOWN_FLAG): New error code.
    * g10/options.h (struct opt): Add field DEF_NEW_KEY_ALGO.
    * g10/gpg.c (oDefaultNewKeyAlgo): New enum.
    (opts): New option "--default-new-key-algo".
    (main): Set the option.
    * g10/keygen.c: Remove DEFAULT_STD_ FUTURE_STD_ constants and replace
    them by ...
    (DEFAULT_STD_KEY_PARAM, FUTURE_STD_KEY_PARAM): new string constants.
    (get_keysize_range): Remove arg R_DEF and return that value instead.
    Change all callers.
    (gen_rsa): Use get_keysize_range instead of the removed
    DEFAULT_STD_KEYSIZE.
    (parse_key_parameter_part): New function.
    (parse_key_parameter_string): New function.
    (quick_generate_keypair): Refactor using parse_key_parameter_string.
    (generate_keypair): Ditto.
    (parse_algo_usage_expire): Ditto.
    --
    
    This new option is intended to be used in the forthcoming
    --set-profile command of gpgconf.  It allows to provide a gpg
    configuration with custom defaults for a new key using the simple
    commands which use the default algorithm set.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 2031008..d11c5ff 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 Noteworthy changes in version 2.1.17 (unreleased)
 -------------------------------------------------
 
+ * gpg: New option --default-new-key-algo.
+
 
 Noteworthy changes in version 2.1.16 (2016-11-18)
 -------------------------------------------------
diff --git a/common/openpgp-oid.c b/common/openpgp-oid.c
index 270bdf1..e7c68f2 100644
--- a/common/openpgp-oid.c
+++ b/common/openpgp-oid.c
@@ -411,17 +411,21 @@ openpgp_enum_curves (int *iterp)
 }
 
 
-/* Return the Libgcrypt name for for the gpg curve NAME if supported.
- * If R_ALGO is not NULL the required OpenPGP public key algo or 0 is
- * stored at that address.  NULL is returned if the curev is not
- * supported. */
+/* Return the Libgcrypt name for the gpg curve NAME if supported.  If
+ * R_ALGO is not NULL the required OpenPGP public key algo or 0 is
+ * stored at that address.  If R_NBITS is not NULL the nominal bitsize
+ * of the curves is stored there.  NULL is returned if the curve is
+ * not supported. */
 const char *
-openpgp_is_curve_supported (const char *name, int *r_algo)
+openpgp_is_curve_supported (const char *name, int *r_algo,
+                            unsigned int *r_nbits)
 {
   int idx;
 
   if (r_algo)
     *r_algo = 0;
+  if (r_nbits)
+    *r_nbits = 0;
   for (idx = 0; idx < DIM (oidtable) && oidtable[idx].name; idx++)
     {
       if ((!strcmp (name, oidtable[idx].name)
@@ -430,6 +434,8 @@ openpgp_is_curve_supported (const char *name, int *r_algo)
         {
           if (r_algo)
             *r_algo = oidtable[idx].pubkey_algo;
+          if (r_nbits)
+            *r_nbits = oidtable[idx].nbits;
           return oidtable[idx].name;
         }
     }
diff --git a/common/util.h b/common/util.h
index 2f82fb0..6e437b9 100644
--- a/common/util.h
+++ b/common/util.h
@@ -39,6 +39,9 @@
  * libgpg-error version.  Define them here.
  * Example: (#if GPG_ERROR_VERSION_NUMBER < 0x011500 // 1.21)
  */
+#if GPG_ERROR_VERSION_NUMBER < 0x011a00 /* 1.26 */
+# define GPG_ERR_UNKNOWN_FLAG 309
+#endif
 
 
 /* Hash function used with libksba. */
@@ -210,7 +213,8 @@ int openpgp_oid_is_cv25519 (gcry_mpi_t a);
 const char *openpgp_curve_to_oid (const char *name, unsigned int *r_nbits);
 const char *openpgp_oid_to_curve (const char *oid, int canon);
 const char *openpgp_enum_curves (int *idxp);
-const char *openpgp_is_curve_supported (const char *name, int *r_algo);
+const char *openpgp_is_curve_supported (const char *name,
+                                        int *r_algo, unsigned int *r_nbits);
 
 
 /*-- homedir.c --*/
diff --git a/doc/gpg.texi b/doc/gpg.texi
index e3756e9..b01d0a3 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1159,7 +1159,11 @@ filename given on the command line, gpg might still need to read from
 STDIN (in particular if gpg figures that the input is a
 detached signature and no data file has been specified).  Thus if you
 do not want to feed data via STDIN, you should connect STDIN to
- at file{/dev/null}.
+g at file{/dev/null}.
+
+It is highly recommended to use this option along with the options
+ at option{--status-fd} and @option{--with-colons} for any unattended of
+ at command{gpg}.
 
 @item --no-tty
 @opindex no-tty
@@ -3162,6 +3166,13 @@ letter d (for days), w (for weeks), m (for months), or y (for years)
 (for example "2m" for two months, or "5y" for five years), or an
 absolute date in the form YYYY-MM-DD. Defaults to "0".
 
+ at item --default-new-key-algo @var{string}
+ at opindex default-new-key-algo @var{string}
+This option can be used to change the default algorithms for key
+generation.  Note that the advanced key generation commands can always
+be used to specify a key algorithm directly.  Please consult the
+source code to learn the syntax of @var{string}.
+
 @item --allow-secret-key-import
 @opindex allow-secret-key-import
 This is an obsolete option and is not used anywhere.
diff --git a/g10/call-agent.c b/g10/call-agent.c
index 1d4bd66..fd9b964 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -624,7 +624,8 @@ learn_status_cb (void *opaque, const char *line)
         parm->key_attr[keyno].nbits = strtoul (line+n+3, NULL, 10);
       else if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ECDSA
                || algo == PUBKEY_ALGO_EDDSA)
-        parm->key_attr[keyno].curve = openpgp_is_curve_supported (line+n, NULL);
+        parm->key_attr[keyno].curve = openpgp_is_curve_supported (line + n,
+                                                                  NULL, NULL);
     }
   else if (keywordlen == 12 && !memcmp (keyword, "PRIVATE-DO-", 11)
            && strchr("1234", keyword[11]))
diff --git a/g10/gpg.c b/g10/gpg.c
index caa0653..7cf51f2 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -407,6 +407,7 @@ enum cmd_and_opt_values
     oPrintDANERecords,
     oTOFUDefaultPolicy,
     oTOFUDBFormat,
+    oDefaultNewKeyAlgo,
     oWeakDigest,
     oUnwrap,
     oOnlySignTextIDs,
@@ -836,6 +837,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_n (oNoAllowMultipleMessages, "no-allow-multiple-messages", "@"),
   ARGPARSE_s_n (oAllowWeakDigestAlgos, "allow-weak-digest-algos", "@"),
 
+  ARGPARSE_s_s (oDefaultNewKeyAlgo, "default-new-key-algo", "@"),
+
   /* These two are aliases to help users of the PGP command line
      product use gpg with minimal pain.  Many commands are common
      already as they seem to have borrowed commands from us.  Now I'm
@@ -3469,6 +3472,10 @@ main (int argc, char **argv)
 
           case oNoAutostart: opt.autostart = 0; break;
 
+	  case oDefaultNewKeyAlgo:
+            opt.def_new_key_algo = pargs.r.ret_str;
+            break;
+
 	  case oNoop: break;
 
 	  default:
diff --git a/g10/keygen.c b/g10/keygen.c
index d249556..ad96cdd 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -48,24 +48,10 @@
 
 /* The default algorithms.  If you change them remember to change them
    also in gpg.c:gpgconf_list.  You should also check that the value
-   is inside the bounds enforced by ask_keysize and gen_xxx.  */
-#define DEFAULT_STD_ALGO       PUBKEY_ALGO_RSA
-#define DEFAULT_STD_KEYSIZE    2048
-#define DEFAULT_STD_KEYUSE     (PUBKEY_USAGE_CERT|PUBKEY_USAGE_SIG)
-#define DEFAULT_STD_CURVE      NULL
-#define DEFAULT_STD_SUBALGO    PUBKEY_ALGO_RSA
-#define DEFAULT_STD_SUBKEYSIZE 2048
-#define DEFAULT_STD_SUBKEYUSE  PUBKEY_USAGE_ENC
-#define DEFAULT_STD_SUBCURVE   NULL
-
-#define FUTURE_STD_ALGO        PUBKEY_ALGO_EDDSA
-#define FUTURE_STD_KEYSIZE     0
-#define FUTURE_STD_KEYUSE      (PUBKEY_USAGE_CERT|PUBKEY_USAGE_SIG)
-#define FUTURE_STD_CURVE       "Ed25519"
-#define FUTURE_STD_SUBALGO     PUBKEY_ALGO_ECDH
-#define FUTURE_STD_SUBKEYSIZE  0
-#define FUTURE_STD_SUBKEYUSE   PUBKEY_USAGE_ENC
-#define FUTURE_STD_SUBCURVE    "Curve25519"
+   is inside the bounds enforced by ask_keysize and gen_xxx.  See also
+   get_keysize_range which encodes the allowed ranges.  */
+#define DEFAULT_STD_KEY_PARAM  "rsa2048/cert,sign+rsa2048/encr"
+#define FUTURE_STD_KEY_PARAM   "ed25519/cert,sign+cv25519/encr"
 
 /* Flag bits used during key generation.  */
 #define KEYGEN_FLAG_NO_PROTECTION 1
@@ -157,8 +143,12 @@ static int write_keyblock (iobuf_t out, kbnode_t node);
 static gpg_error_t gen_card_key (int keyno, int algo, int is_primary,
                                  kbnode_t pub_root, u32 *timestamp,
                                  u32 expireval);
+static unsigned int get_keysize_range (int algo,
+                                       unsigned int *min, unsigned int *max);
 
 
+

+
 static void
 print_status_key_created (int letter, PKT_public_key *pk, const char *handle)
 {
@@ -1602,7 +1592,7 @@ gen_rsa (int algo, unsigned int nbits, KBNODE pub_root,
   log_assert (is_RSA(algo));
 
   if (!nbits)
-    nbits = DEFAULT_STD_KEYSIZE;
+    nbits = get_keysize_range (algo, NULL, NULL);
 
   if (nbits < 1024)
     {
@@ -2056,36 +2046,46 @@ ask_algo (ctrl_t ctrl, int addmode, int *r_subkey_algo, unsigned int *r_usage,
 }
 
 
-static void
-get_keysize_range (int algo,
-                   unsigned int *min, unsigned int *def, unsigned int *max)
+static unsigned int
+get_keysize_range (int algo, unsigned int *min, unsigned int *max)
 {
-  *min = opt.compliance == CO_DE_VS ? 2048: 1024;
-  *def = DEFAULT_STD_KEYSIZE;
-  *max = 4096;
+  unsigned int def;
+  unsigned int dummy1, dummy2;
+
+  if (!min)
+    min = &dummy1;
+  if (!max)
+    max = &dummy2;
 
-  /* Deviations from the standard values.  */
   switch(algo)
     {
     case PUBKEY_ALGO_DSA:
       *min = opt.expert? 768 : 1024;
-      *def=2048;
       *max=3072;
+      def=2048;
       break;
 
     case PUBKEY_ALGO_ECDSA:
     case PUBKEY_ALGO_ECDH:
       *min=256;
-      *def=256;
       *max=521;
+      def=256;
       break;
 
     case PUBKEY_ALGO_EDDSA:
       *min=255;
-      *def=255;
       *max=441;
+      def=255;
+      break;
+
+    default:
+      *min = opt.compliance == CO_DE_VS ? 2048: 1024;
+      *max = 4096;
+      def = 2048;
       break;
     }
+
+  return def;
 }
 
 
@@ -2147,7 +2147,7 @@ ask_keysize (int algo, unsigned int primary_keysize)
   int for_subkey = !!primary_keysize;
   int autocomp = 0;
 
-  get_keysize_range (algo, &min, &def, &max);
+  def = get_keysize_range (algo, &min, &max);
 
   if (primary_keysize && !opt.expert)
     {
@@ -2854,6 +2854,292 @@ generate_user_id (KBNODE keyblock, const char *uidstr)
 }
 
 
+/* Helper for parse_key_parameter_string for one part of the
+ * specification string; i.e.  ALGO/FLAGS.  If STRING is NULL or empty
+ * success is returned.  On error an error code is returned.  Note
+ * that STRING may be modified by this function.  NULL may be passed
+ * for any parameter.  FOR_SUBKEY shall be true if this is used as a
+ * subkey.  */
+static gpg_error_t
+parse_key_parameter_part (char *string, int for_subkey,
+                          int *r_algo, unsigned int *r_size,
+                          unsigned int *r_keyuse,
+                          char const **r_curve)
+{
+  char *flags;
+  int algo = 0;
+  char *endp;
+  const char *curve = NULL;
+  int ecdh_or_ecdsa = 0;
+  unsigned int size;
+  int keyuse;
+  int i;
+  const char *s;
+
+  if (!string || !*string)
+    return 0; /* Success.  */
+
+  flags = strchr (string, '/');
+  if (flags)
+    *flags++ = 0;
+
+  if (strlen (string) > 3 && digitp (string+3))
+    {
+      if (!ascii_memcasecmp (string, "rsa", 3))
+        algo = PUBKEY_ALGO_RSA;
+      else if (!ascii_memcasecmp (string, "dsa", 3))
+        algo = PUBKEY_ALGO_DSA;
+      else if (!ascii_memcasecmp (string, "elg", 3))
+        algo = PUBKEY_ALGO_ELGAMAL_E;
+    }
+  if (algo)
+    {
+      size = strtoul (string+3, &endp, 10);
+      if (size < 512 || size > 16384 || *endp)
+        return gpg_error (GPG_ERR_INV_VALUE);
+    }
+  else if ((curve = openpgp_is_curve_supported (string, &algo, &size)))
+    {
+      if (!algo)
+        {
+          algo = PUBKEY_ALGO_ECDH; /* Default ECC algorithm.  */
+          ecdh_or_ecdsa = 1;       /* We may need to switch the algo.  */
+        }
+    }
+  else
+    return gpg_error (GPG_ERR_UNKNOWN_CURVE);
+
+  /* Parse the flags.  */
+  keyuse = 0;
+  if (flags)
+    {
+      char **tokens = NULL;
+
+      tokens = strtokenize (flags, ",");
+      if (!tokens)
+        return gpg_error_from_syserror ();
+
+      for (i=0; (s = tokens[i]); i++)
+        {
+          if (!*s)
+            ;
+          else if (!ascii_strcasecmp (s, "sign"))
+            keyuse |= PUBKEY_USAGE_SIG;
+          else if (!ascii_strcasecmp (s, "encrypt")
+                   || !ascii_strcasecmp (s, "encr"))
+            keyuse |= PUBKEY_USAGE_ENC;
+          else if (!ascii_strcasecmp (s, "auth"))
+            keyuse |= PUBKEY_USAGE_AUTH;
+          else if (!ascii_strcasecmp (s, "cert"))
+            keyuse |= PUBKEY_USAGE_CERT;
+          else if (!ascii_strcasecmp (s, "ecdsa"))
+            {
+              if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ECDSA)
+                algo = PUBKEY_ALGO_ECDSA;
+              else
+                {
+                  xfree (tokens);
+                  return gpg_error (GPG_ERR_INV_FLAG);
+                }
+              ecdh_or_ecdsa = 0;
+            }
+          else if (!ascii_strcasecmp (s, "ecdh"))
+            {
+              if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ECDSA)
+                algo = PUBKEY_ALGO_ECDH;
+              else
+                {
+                  xfree (tokens);
+                  return gpg_error (GPG_ERR_INV_FLAG);
+                }
+              ecdh_or_ecdsa = 0;
+            }
+          else if (!ascii_strcasecmp (s, "eddsa"))
+            {
+              /* Not required but we allow it for consistency.  */
+              if (algo == PUBKEY_ALGO_EDDSA)
+                ;
+              else
+                {
+                  xfree (tokens);
+                  return gpg_error (GPG_ERR_INV_FLAG);
+                }
+            }
+          else
+            {
+              xfree (tokens);
+              return gpg_error (GPG_ERR_UNKNOWN_FLAG);
+            }
+        }
+
+      xfree (tokens);
+    }
+
+  /* If not yet decided switch between ecdh and ecdsa.  */
+  if (ecdh_or_ecdsa && keyuse)
+    algo = (keyuse & PUBKEY_USAGE_ENC)? PUBKEY_ALGO_ECDH : PUBKEY_ALGO_ECDSA;
+  else if (ecdh_or_ecdsa)
+    algo = for_subkey? PUBKEY_ALGO_ECDH : PUBKEY_ALGO_ECDSA;
+
+  /* Set or fix key usage.  */
+  if (!keyuse)
+    {
+      if (algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_EDDSA
+          || algo == PUBKEY_ALGO_DSA)
+        keyuse = PUBKEY_USAGE_SIG;
+      else if (algo == PUBKEY_ALGO_RSA)
+        keyuse = for_subkey? PUBKEY_USAGE_ENC : PUBKEY_USAGE_SIG;
+      else
+        keyuse = PUBKEY_USAGE_ENC;
+    }
+  else if (algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_EDDSA
+           || algo == PUBKEY_ALGO_DSA)
+    {
+      keyuse &= ~PUBKEY_USAGE_ENC; /* Forbid encryption.  */
+    }
+  else if (algo == PUBKEY_ALGO_ECDH || algo == PUBKEY_ALGO_ELGAMAL_E)
+    {
+      keyuse = PUBKEY_USAGE_ENC;   /* Allow only encryption.  */
+    }
+
+  /* Make sure a primary key can certify.  */
+  if (!for_subkey)
+    keyuse |= PUBKEY_USAGE_CERT;
+
+  /* Check that usage is actually possible.  */
+  if (/**/((keyuse & (PUBKEY_USAGE_SIG|PUBKEY_USAGE_AUTH|PUBKEY_USAGE_CERT))
+           && !pubkey_get_nsig (algo))
+       || ((keyuse & PUBKEY_USAGE_ENC)
+           && !pubkey_get_nenc (algo))
+       || (for_subkey && (keyuse & PUBKEY_USAGE_CERT)))
+    return gpg_error (GPG_ERR_WRONG_KEY_USAGE);
+
+  /* Return values.  */
+  if (r_algo)
+    *r_algo = algo;
+  if (r_size)
+    {
+      unsigned int min, def, max;
+
+      /* Make sure the keysize is in the allowed range.  */
+      def = get_keysize_range (algo, &min, &max);
+      if (!size)
+        size = def;
+      else if (size < min)
+        size = min;
+      else if (size > max)
+        size = max;
+
+      *r_size = fixup_keysize (size, algo, 1);
+    }
+  if (r_keyuse)
+    *r_keyuse = keyuse;
+  if (r_curve)
+    *r_curve = curve;
+
+  return 0;
+}
+
+/* Parse and return the standard key generation parameter.
+ * The string is expected to be in this format:
+ *
+ *   ALGO[/FLAGS][+SUBALGO[/FLAGS]]
+ *
+ * Here ALGO is a string in the same format as printed by the
+ * keylisting.  For example:
+ *
+ *   rsa3072 := RSA with 3072 bit.
+ *   dsa2048 := DSA with 2048 bit.
+ *   elg2048 := Elgamal with 2048 bit.
+ *   ed25519 := EDDSA using curve Ed25519.
+ *   cv25519 := ECDH using curve Curve25519.
+ *   nistp256:= ECDSA or ECDH using curve NIST P-256
+ *
+ * All strings with an unknown prefix are considered an elliptic
+ * curve.  Curves which have no implicit algorithm require that FLAGS
+ * is given to select whether ECDSA or ECDH is used; this can eoither
+ * be done using an algorithm keyword or usage keywords.
+ *
+ * FLAGS is a comma delimited string of keywords:
+ *
+ *   cert := Allow usage Certify
+ *   sign := Allow usage Sign
+ *   encr := Allow usage Encrypt
+ *   auth := Allow usage Authentication
+ *   encrypt := Alias for "encr"
+ *   ecdsa := Use algorithm ECDSA.
+ *   eddsa := Use algorithm EdDSA.
+ *   ecdh  := Use algorithm ECDH.
+ *
+ * There are several defaults and fallbacks depending on the
+ * algorithm.  PART can be used to select which part of STRING is
+ * used:
+ *   -1 := Both parts
+ *    0 := Only the part of the primary key
+ *    1 := Only the part of the secondary key is parsed but returned
+ *         in the args for the primary key (R_ALGO,....)
+ *
+ */
+gpg_error_t
+parse_key_parameter_string (const char *string, int part,
+                            int *r_algo, unsigned int *r_size,
+                            unsigned *r_keyuse,
+                            char const **r_curve,
+                            int *r_subalgo, unsigned int *r_subsize,
+                            unsigned *r_subkeyuse,
+                            char const **r_subcurve)
+{
+  gpg_error_t err = 0;
+  char *primary, *secondary;
+
+  if (r_algo)
+    *r_algo = 0;
+  if (r_size)
+    *r_size = 0;
+  if (r_keyuse)
+    *r_keyuse = 0;
+  if (r_curve)
+    *r_curve = NULL;
+  if (r_subalgo)
+    *r_subalgo = 0;
+  if (r_subsize)
+    *r_subsize = 0;
+  if (r_subkeyuse)
+    *r_subkeyuse = 0;
+  if (r_subcurve)
+    *r_subcurve = NULL;
+
+  if (!string || !*string
+      || !strcmp (string, "default") || !strcmp (string, "-"))
+    string = opt.def_new_key_algo? opt.def_new_key_algo : DEFAULT_STD_KEY_PARAM;
+  else if (!strcmp (string, "future-default"))
+    string = FUTURE_STD_KEY_PARAM;
+
+  primary = xstrdup (string);
+  secondary = strchr (primary, '+');
+  if (secondary)
+    *secondary++ = 0;
+  if (part == -1 || part == 0)
+    {
+      err = parse_key_parameter_part (primary, 0, r_algo, r_size,
+                                      r_keyuse, r_curve);
+      if (!err && part == -1)
+        err = parse_key_parameter_part (secondary, 1, r_subalgo, r_subsize,
+                                        r_subkeyuse, r_subcurve);
+    }
+  else if (part == 1)
+    {
+      err = parse_key_parameter_part (secondary, 1, r_algo, r_size,
+                                      r_keyuse, r_curve);
+    }
+
+  xfree (primary);
+
+  return err;
+}
+
+
+
 /* Append R to the linked list PARA.  */
 static void
 append_to_parameter (struct para_data_s *para, struct para_data_s *r)
@@ -2926,8 +3212,15 @@ get_parameter_algo( struct para_data_s *para, enum para_name key,
   if (!ascii_strcasecmp (r->u.value, "default"))
     {
       /* Note: If you change this default algo, remember to change it
-         also in gpg.c:gpgconf_list.  */
-      i = DEFAULT_STD_ALGO;
+       * also in gpg.c:gpgconf_list.  */
+      /* FIXME: We only allow the algo here and have a separate thing
+       * for the curve etc.  That is a ugly but demanded for backward
+       * compatibility with the batch key generation.  It would be
+       * better to make full use of parse_key_parameter_string.  */
+      parse_key_parameter_string (NULL, 0,
+                                  &i, NULL, NULL, NULL,
+                                  NULL, NULL, NULL, NULL);
+
       if (r_default)
         *r_default = 1;
     }
@@ -2952,8 +3245,8 @@ get_parameter_algo( struct para_data_s *para, enum para_name key,
 
 
 /* Parse a usage string.  The usage keywords "auth", "sign", "encr"
- * may be elimited by space, tab, or comma.  On error -1 is returned
- * instead of the usage flags/  */
+ * may be delimited by space, tab, or comma.  On error -1 is returned
+ * instead of the usage flags.  */
 static int
 parse_usagestr (const char *usagestr)
 {
@@ -3639,25 +3932,27 @@ quick_generate_keypair (ctrl_t ctrl, const char *uid, const char *algostr,
       && (!*usagestr || !strcmp (usagestr, "default")
           || !strcmp (usagestr, "-")))
     {
-      if (!strcmp (algostr, "future-default"))
-        {
-          para = quickgen_set_para (para, 0,
-                                    FUTURE_STD_ALGO, FUTURE_STD_KEYSIZE,
-                                    FUTURE_STD_CURVE, 0);
-          para = quickgen_set_para (para, 1,
-                                    FUTURE_STD_SUBALGO,  FUTURE_STD_SUBKEYSIZE,
-                                    FUTURE_STD_SUBCURVE, 0);
-        }
-      else
+      /* Use default key parameters.  */
+      int algo, subalgo;
+      unsigned int size, subsize;
+      unsigned int keyuse, subkeyuse;
+      const char *curve, *subcurve;
+
+      err = parse_key_parameter_string (algostr, -1,
+                                        &algo, &size, &keyuse, &curve,
+                                        &subalgo, &subsize, &subkeyuse,
+                                        &subcurve);
+      if (err)
         {
-          para = quickgen_set_para (para, 0,
-                                    DEFAULT_STD_ALGO, DEFAULT_STD_KEYSIZE,
-                                    DEFAULT_STD_CURVE, 0);
-          para = quickgen_set_para (para, 1,
-                                    DEFAULT_STD_SUBALGO, DEFAULT_STD_SUBKEYSIZE,
-                                    DEFAULT_STD_SUBCURVE, 0);
+          log_error (_("Key generation failed: %s\n"), gpg_strerror (err));
+          goto leave;
         }
 
+      para = quickgen_set_para (para, 0, algo, size, curve, keyuse);
+      if (subalgo)
+        para = quickgen_set_para (para, 1,
+                                  subalgo, subsize, subcurve, subkeyuse);
+
       if (*expirestr)
         {
           u32 expire;
@@ -3736,6 +4031,7 @@ void
 generate_keypair (ctrl_t ctrl, int full, const char *fname,
                   const char *card_serialno, int card_backup_key)
 {
+  gpg_error_t err;
   unsigned int nbits;
   char *uid = NULL;
   int algo;
@@ -3768,14 +4064,14 @@ generate_keypair (ctrl_t ctrl, int full, const char *fname,
   if (card_serialno)
     {
 #ifdef ENABLE_CARD_SUPPORT
-      gpg_error_t err;
       struct agent_card_info_s info;
 
       memset (&info, 0, sizeof (info));
       err = agent_scd_getattr ("KEY-ATTR", &info);
       if (err)
         {
-          log_error (_("error getting current key info: %s\n"), gpg_strerror (err));
+          log_error (_("error getting current key info: %s\n"),
+                     gpg_strerror (err));
           return;
         }
 
@@ -3978,6 +4274,11 @@ generate_keypair (ctrl_t ctrl, int full, const char *fname,
     }
   else /* Default key generation.  */
     {
+      int subalgo;
+      unsigned int size, subsize;
+      unsigned int keyuse, subkeyuse;
+      const char *curve, *subcurve;
+
       tty_printf ( _("Note: Use \"%s %s\""
                      " for a full featured key generation dialog.\n"),
 #if USE_GPG2_HACK
@@ -3986,12 +4287,22 @@ generate_keypair (ctrl_t ctrl, int full, const char *fname,
                    GPG_NAME
 #endif
                    , "--full-gen-key" );
-      para = quickgen_set_para (para, 0,
-                                DEFAULT_STD_ALGO, DEFAULT_STD_KEYSIZE,
-                                DEFAULT_STD_CURVE, 0);
-      para = quickgen_set_para (para, 1,
-                                DEFAULT_STD_SUBALGO, DEFAULT_STD_SUBKEYSIZE,
-                                DEFAULT_STD_SUBCURVE, 0);
+
+      err = parse_key_parameter_string (NULL, -1,
+                                        &algo, &size, &keyuse, &curve,
+                                        &subalgo, &subsize,
+                                        &subkeyuse, &subcurve);
+      if (err)
+        {
+          log_error (_("Key generation failed: %s\n"), gpg_strerror (err));
+          return;
+        }
+      para = quickgen_set_para (para, 0, algo, size, curve, keyuse);
+      if (subalgo)
+        para = quickgen_set_para (para, 1,
+                                  subalgo, subsize, subcurve, subkeyuse);
+
+
     }
 
 
@@ -4479,87 +4790,38 @@ parse_algo_usage_expire (ctrl_t ctrl, int for_subkey,
                          int *r_algo, unsigned int *r_usage, u32 *r_expire,
                          unsigned int *r_nbits, char **r_curve)
 {
+  gpg_error_t err;
   int algo;
   unsigned int use, nbits;
   u32 expire;
   int wantuse;
-  unsigned int min, def, max;
   const char *curve = NULL;
-  int eccalgo = 0;
 
   *r_curve = NULL;
 
   nbits = 0;
+
   /* Parse the algo string.  */
-  if (!algostr || !*algostr
-      || !strcmp (algostr, "default") || !strcmp (algostr, "-"))
-    {
-      algo  = for_subkey? DEFAULT_STD_SUBALGO    : DEFAULT_STD_ALGO;
-      use   = for_subkey? DEFAULT_STD_SUBKEYUSE  : DEFAULT_STD_KEYUSE;
-      nbits = for_subkey? DEFAULT_STD_SUBKEYSIZE : DEFAULT_STD_KEYSIZE;
-      curve = for_subkey? DEFAULT_STD_SUBCURVE   : DEFAULT_STD_CURVE;
-    }
-  else if (!strcmp (algostr, "future-default"))
-    {
-      algo  = for_subkey? FUTURE_STD_SUBALGO    : FUTURE_STD_ALGO;
-      use   = for_subkey? FUTURE_STD_SUBKEYUSE  : FUTURE_STD_KEYUSE;
-      nbits = for_subkey? FUTURE_STD_SUBKEYSIZE : FUTURE_STD_KEYSIZE;
-      curve = for_subkey? FUTURE_STD_SUBCURVE   : FUTURE_STD_CURVE;
-    }
-  else if (*algostr == '&' && strlen (algostr) == 41)
+  if (algostr && *algostr == '&' && strlen (algostr) == 41)
     {
       /* Take algo from existing key.  */
       algo = check_keygrip (ctrl, algostr+1);
       /* FIXME: We need the curve name as well.  */
       return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
     }
-  else if (!strncmp (algostr, "rsa", 3))
-    {
-      algo = PUBKEY_ALGO_RSA;
-      use = for_subkey? DEFAULT_STD_SUBKEYUSE : DEFAULT_STD_KEYUSE;
-      if (algostr[3])
-        nbits = atoi (algostr + 3);
-    }
-  else if (!strncmp (algostr, "elg", 3))
-    {
-      algo = PUBKEY_ALGO_ELGAMAL_E;
-      use = PUBKEY_USAGE_ENC;
-      if (algostr[3])
-        nbits = atoi (algostr + 3);
-    }
-  else if (!strncmp (algostr, "dsa", 3))
-    {
-      algo = PUBKEY_ALGO_DSA;
-      use = PUBKEY_USAGE_SIG;
-      if (algostr[3])
-        nbits = atoi (algostr + 3);
-    }
-  else if ((curve = openpgp_is_curve_supported (algostr, &algo)))
-    {
-      if (!algo)
-        {
-          algo = PUBKEY_ALGO_ECDH; /* Default ECC algorithm.  */
-          eccalgo = 1;  /* Remember - we may need to fix it up.  */
-        }
 
-      if (algo == PUBKEY_ALGO_ECDSA || algo == PUBKEY_ALGO_EDDSA)
-        use = PUBKEY_USAGE_SIG;
-      else
-        use = PUBKEY_USAGE_ENC;
-    }
-  else
-    return gpg_error (GPG_ERR_UNKNOWN_CURVE);
+  err = parse_key_parameter_string (algostr, for_subkey? 1 : 0,
+                                    &algo, &nbits, &use, &curve,
+                                    NULL, NULL, NULL, NULL);
+  if (err)
+    return err;
 
   /* Parse the usage string.  */
   if (!usagestr || !*usagestr
       || !strcmp (usagestr, "default") || !strcmp (usagestr, "-"))
-    ; /* Keep default usage */
+    ; /* Keep usage from parse_key_parameter_string.  */
   else if ((wantuse = parse_usagestr (usagestr)) != -1)
-    {
-      use = wantuse;
-      if (eccalgo && !(use & PUBKEY_USAGE_ENC))
-        algo = PUBKEY_ALGO_ECDSA; /* Switch from ECDH to ECDSA.  */
-    }
+    use = wantuse;
   else
     return gpg_error (GPG_ERR_INV_VALUE);
 
@@ -4567,7 +4829,9 @@ parse_algo_usage_expire (ctrl_t ctrl, int for_subkey,
   if (!for_subkey)
     use |= PUBKEY_USAGE_CERT;
 
-  /* Check that usage is possible.  */
+  /* Check that usage is possible.  NB: We have the same check in
+   * parse_key_parameter_string but need it here again in case the
+   * separate usage value has been given. */
   if (/**/((use & (PUBKEY_USAGE_SIG|PUBKEY_USAGE_AUTH|PUBKEY_USAGE_CERT))
            && !pubkey_get_nsig (algo))
        || ((use & PUBKEY_USAGE_ENC)
@@ -4580,17 +4844,6 @@ parse_algo_usage_expire (ctrl_t ctrl, int for_subkey,
   if (expire == (u32)-1 )
     return gpg_error (GPG_ERR_INV_VALUE);
 
-  /* Make sure the keysize is in the allowed range.  */
-  get_keysize_range (algo, &min, &def, &max);
-  if (!nbits)
-    nbits = def;
-  else if (nbits < min)
-    nbits = min;
-  else if (nbits > max)
-    nbits = max;
-
-  nbits = fixup_keysize (nbits, algo, 1);
-
   if (curve)
     {
       *r_curve = xtrystrdup (curve);
diff --git a/g10/options.h b/g10/options.h
index 8ed2cdb..2449042 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -120,6 +120,8 @@ struct
   const char *agent_program;
   const char *dirmngr_program;
 
+  const char *def_new_key_algo;
+
   /* Options to be passed to the gpg-agent */
   session_env_t session_env;
   char *lc_ctype;
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 8de9b80..5fa4fd2 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -3454,7 +3454,7 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **),
 
           memcpy (curve_name, tok, toklen);
           curve_name[toklen] = 0;
-          curve = openpgp_is_curve_supported (curve_name, NULL);
+          curve = openpgp_is_curve_supported (curve_name, NULL, NULL);
           xfree (curve_name);
         }
       else if (tok && toklen == 5 && !memcmp (tok, "flags", 5))

-----------------------------------------------------------------------

Summary of changes:
 NEWS                 |   2 +
 common/openpgp-oid.c |  16 +-
 common/util.h        |   6 +-
 doc/gpg.texi         |  13 +-
 g10/call-agent.c     |   3 +-
 g10/gpg.c            |   7 +
 g10/keygen.c         | 511 ++++++++++++++++++++++++++++++++++++++-------------
 g10/options.h        |   2 +
 scd/app-openpgp.c    |   2 +-
 9 files changed, 424 insertions(+), 138 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  2 22:54:33 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 02 Dec 2016 22:54:33 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-10-gc761c98
Message-ID: <E1cCvmt-0006zL-Fa@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  c761c981b38741421d13bb7102b1ea7625d2d639 (commit)
       via  b462d603f5110842489edce9e01e4ea40ac05cba (commit)
      from  f769450924367d4f495eda981025fed391cd68a8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c761c981b38741421d13bb7102b1ea7625d2d639
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 2 22:49:54 2016 +0100

    New error code GPG_ERR_INV_FLAG

diff --git a/NEWS b/NEWS
index 46ecdc9..f1da8b0 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,12 @@
 Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
 -----------------------------------------------
 
+ * New option --desc for gpg-error.
+
+ * Interface changes relative to the 1.25 release:
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ GPG_ERR_UNKNOWN_FLAG             NEW.
+
 
 Noteworthy changes in version 1.25 (2016-11-14) [C20/A20/R0]
 -----------------------------------------------
diff --git a/doc/errorref.txt b/doc/errorref.txt
index 496a2a2..70d94da 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -1016,6 +1016,14 @@ GPG_ERR_TOO_OLD                         Objects is too old
     Used if an object is too old to be used.  This is a more generic
     code than GPG_ERR_ENGINE_TOO_OLD or GPG_ERR_CRL_TOO_OLD.
 
+GPG_ERR_UNKNOWN_FLAG            Unknown flag
+
+    The flag is not known.
+
+    GNUPG: - The flag part of the string given to the
+             option --default-new-key-algo value is not known.
+
+
 GPG_ERR_LDAP_GENERAL            LDAP General error
 
    Catch all error for LDAP.  Use if if can't map an erro rocde to an
diff --git a/src/err-codes.h.in b/src/err-codes.h.in
index de703d7..0669d35 100644
--- a/src/err-codes.h.in
+++ b/src/err-codes.h.in
@@ -328,6 +328,7 @@
 306	GPG_ERR_DUP_NAME		Duplicated name
 307	GPG_ERR_TOO_YOUNG		Object is too young
 308	GPG_ERR_TOO_OLD			Object is too old
+309	GPG_ERR_UNKNOWN_FLAG		Unknown flag
 # This range is free for use.
 
 #

commit b462d603f5110842489edce9e01e4ea40ac05cba
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 2 22:46:07 2016 +0100

    New option --desc for gpg-error.
    
    * doc/errorref.txt: Remove all tabs.
    * doc/Makefile.am (install-data-local): New to install errorref.txt.
    (uninstall-local): New.
    (errorref.txt.x): New.
    * src/Makefile.am (gpg_error_CPPFLAGS): Define PKGDATADIR
    * src/gpg-error.c (print_desc): New.
    (show_usage): New.
    (main): Improve option parser.  Add new option --desc.  Call
    print_desc.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 3d7b143..565bb09 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -21,7 +21,7 @@ EXTRA_DIST = HACKING errorref.txt \
 	     yat2m.c
 
 DISTCLEANFILES = gpgrt.cps yat2m-stamp.tmp yat2m-stamp $(myman_pages)
-CLEANFILES = yat2m
+CLEANFILES = yat2m errorref.txt.x
 
 info_TEXINFOS = gpgrt.texi
 gpgrt_TEXINFOS = lgpl.texi gpl.texi
@@ -66,3 +66,14 @@ $(myman_pages) : yat2m-stamp
 # updates the release date.
 gpgrt.texi : $(gpgrt_TEXINFOS)
 	touch $(srcdir)/gpgrt.texi
+
+errorref.txt.x : errorref.txt
+	sed '/^##/ d' $< >$@
+	echo "# Installed by $(PACKAGE_NAME) $(PACKAGE_VERSION)" >>$@
+
+install-data-local: errorref.txt.x
+	$(mkinstalldirs) $(DESTDIR)$(pkgdatadir)
+	$(INSTALL_DATA) errorref.txt.x $(DESTDIR)$(pkgdatadir)/errorref.txt
+
+uninstall-local:
+	- at rm $(DESTDIR)$(pkgdatadir)/errorref.txt
diff --git a/doc/errorref.txt b/doc/errorref.txt
index d389398..496a2a2 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -1,17 +1,38 @@
-# find ~/s/{gnupg,libgpg-error,libksba,libgcrypt,gpgme,gpa} -type f \
-#        -name '*.[ch]' -print0 | xargs -0 grep -n GPG_ERR_
-
-
-GPG_ERR_UNKNOWN_PACKET (1)	Unknown packet
+# errorref.txt - Description of error codes
+# Copyright (C) 2003-2004, 2010, 2013-2016 g10 Code GmbH
+#
+# This file is part of libgpg-error.
+#
+# libgpg-error is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public License
+# as published by the Free Software Foundation; either version 2.1 of
+# the License, or (at your option) any later version.
+#
+# libgpg-error is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this program; if not, see <https://www.gnu.org/licenses/>.
+##
+## Note that lines with a leading double hash will not installed.
+## Please do not put any tabs into this file.
+##
+## find ~/s/{gnupg,libgpg-error,libksba,libgcrypt,gpgme,gpa} -type f \
+##        -name '*.[ch]' -print0 | xargs -0 grep -n GPG_ERR_
+
+
+GPG_ERR_UNKNOWN_PACKET          Unknown packet
 
     GNUPG:  - Redefined to G10ERR_UNKNOWN_PACKET in gpg.
 
-GPG_ERR_UNKNOWN_VERSION (2)	Unknown version in packet
+GPG_ERR_UNKNOWN_VERSION         Unknown version in packet
 
     Used by GnuPG 2.1 to identify valid OpenPGP packets with an
     unknown version.
 
-GPG_ERR_PUBKEY_ALGO		Invalid public key algorithm
+GPG_ERR_PUBKEY_ALGO             Invalid public key algorithm
 
     GNUPG:  - Redefined to G10ERR_PUBKEY_ALGO in gpg.
             - Public key algorithm is not allowed by OpenPGP.
@@ -21,7 +42,7 @@ GPG_ERR_PUBKEY_ALGO		Invalid public key algorithm
             - [version < 1.5] Checking of the RSA secret key failed
                               (consistency check).
 
-GPG_ERR_DIGEST_ALGO		Invalid digest algorithm
+GPG_ERR_DIGEST_ALGO             Invalid digest algorithm
 
     GNUPG:  - Digest algorithm is not supported.
             - Redefined to G10ERR_PUBKEY_ALGO in gpg.
@@ -40,14 +61,14 @@ GPG_ERR_DIGEST_ALGO		Invalid digest algorithm
               message algorithm enabled for the hash context.
             - Bad digest algorithm given to public key function.
 
-GPG_ERR_BAD_PUBKEY		Bad public key
+GPG_ERR_BAD_PUBKEY              Bad public key
 
     GNUPG:  - Redefined to G10ERR_BAD_PUBKEY in gpg.
             - Missing public or domain parameter in an s-expression.
               If the curve name is mssing GPG_ERR_INV_CURVE may be
               used as well.
 
-GPG_ERR_BAD_SECKEY		Bad secret key
+GPG_ERR_BAD_SECKEY              Bad secret key
 
     GNUPG:  - Invalid format of a S-expression encoded private key in
               gpg-agent.
@@ -62,7 +83,7 @@ GPG_ERR_BAD_SECKEY		Bad secret key
     GCRYPT: - Checking the secret key failed (consistency check).
 
 
-GPG_ERR_BAD_SIGNATURE		Bad signature
+GPG_ERR_BAD_SIGNATURE           Bad signature
 
     GNUPG:  - Redefined to G10ERR_BAD_SIGN in gpg.
             - The MDC check of an OpenPGP encrypted message failed.
@@ -70,7 +91,7 @@ GPG_ERR_BAD_SIGNATURE		Bad signature
             - A signature with a key flagged as "never trust" was made.
     GCRYPT: - A public key signature did not verify.
 
-GPG_ERR_NO_PUBKEY		No public key
+GPG_ERR_NO_PUBKEY               No public key
 
     GNUPG:  - Redefined to G10ERR_NO_PUBKEY in gpg.
             - A key was requested from an OpenPGP card but the key is
@@ -93,31 +114,34 @@ GPG_ERR_NO_PUBKEY		No public key
     GPA:    - No key was given for encryption.
             - The selected encryption protocol is not available.
 
-GPG_ERR_CHECKSUM		Checksum error
+GPG_ERR_CHECKSUM                Checksum error
 
     GNUPG:  - The checksum of an unprotected OpenPGP secret key packet
               is wrong.
     GCRYPT: - Decryption in AESWRAP mode does not match the expected IV.
     [more to come]
 
-GPG_ERR_BAD_PASSPHRASE		Bad passphrase
+GPG_ERR_BAD_PASSPHRASE          Bad passphrase
 
     GNUPG: - The entered passphrase does not verify
 
+GPG_ERR_CIPHER_ALGO             Invalid cipher algorithm
+
+GPG_ERR_KEYRING_OPEN            Cannot open keyring
+
+GPG_ERR_INV_PACKET              Invalid packet
+
+GPG_ERR_INV_ARMOR               Invalid armor
 
-12	GPG_ERR_CIPHER_ALGO		Invalid cipher algorithm
-13	GPG_ERR_KEYRING_OPEN		Cannot open keyring
-14	GPG_ERR_INV_PACKET		Invalid packet
-15	GPG_ERR_INV_ARMOR		Invalid armor
-16	GPG_ERR_NO_USER_ID		No user ID
+GPG_ERR_NO_USER_ID              No user ID
 
-GPG_ERR_NO_SECKEY		No secret key
+GPG_ERR_NO_SECKEY               No secret key
 
    NTBTLS: - No private key or pre-shared key available.
 
-18	GPG_ERR_WRONG_SECKEY		Wrong secret key used
+GPG_ERR_WRONG_SECKEY            Wrong secret key used
 
-GPG_ERR_BAD_KEY			Bad session key
+GPG_ERR_BAD_KEY                         Bad session key
 
     GNUPG: - gpg-agent's command IMPORT_KEY or EXPORT_KEY is used
              without a prior KEYWRAP_KEY command.
@@ -125,15 +149,20 @@ GPG_ERR_BAD_KEY			Bad session key
     [more to come]
 
 
-20	GPG_ERR_COMPR_ALGO		Unknown compression algorithm
-21	GPG_ERR_NO_PRIME		Number is not prime
-22	GPG_ERR_NO_ENCODING_METHOD	Invalid encoding method
-23	GPG_ERR_NO_ENCRYPTION_SCHEME	Invalid encryption scheme
-24	GPG_ERR_NO_SIGNATURE_SCHEME	Invalid signature scheme
-25	GPG_ERR_INV_ATTR		Invalid attribute
+GPG_ERR_COMPR_ALGO              Unknown compression algorithm
+
+GPG_ERR_NO_PRIME                Number is not prime
+
+GPG_ERR_NO_ENCODING_METHOD      Invalid encoding method
+
+GPG_ERR_NO_ENCRYPTION_SCHEME    Invalid encryption scheme
+
+GPG_ERR_NO_SIGNATURE_SCHEME     Invalid signature scheme
 
+GPG_ERR_INV_ATTR                Invalid attribute
 
-GPG_ERR_NO_VALUE		No value
+
+GPG_ERR_NO_VALUE                No value
 
     GNUPG:  - A timestamp value is expect but there is none.
     KSBA:   - A timestamp value is expect but there is none.
@@ -142,45 +171,51 @@ GPG_ERR_NO_VALUE		No value
             - Converting a Distinguised Name to an RFC2253 string failed.
 
 
-GPG_ERR_NOT_FOUND		Not found
+GPG_ERR_NOT_FOUND               Not found
 
     A search operation did not return a matching value.
 
 
-GPG_ERR_VALUE_NOT_FOUND		Value not found
+GPG_ERR_VALUE_NOT_FOUND                 Value not found
 
     GNUPG:  - A keyblock or a cert object was requested but not
               found.  This might indicate an internal error here.
 
 
-29	GPG_ERR_SYNTAX			Syntax error
-30	GPG_ERR_BAD_MPI			Bad MPI value
+GPG_ERR_SYNTAX                  Syntax error
+
+GPG_ERR_BAD_MPI                         Bad MPI value
 
-GPG_ERR_INV_PASSPHRASE		Invalid passphrase
+GPG_ERR_INV_PASSPHRASE          Invalid passphrase
 
     GNUPG:  - Required constraints of the passphrase are not met.
 
-32	GPG_ERR_SIG_CLASS		Invalid signature class
-33	GPG_ERR_RESOURCE_LIMIT		Resources exhausted
-34	GPG_ERR_INV_KEYRING		Invalid keyring
-35	GPG_ERR_TRUSTDB			Trust DB error
+GPG_ERR_SIG_CLASS               Invalid signature class
+
+GPG_ERR_RESOURCE_LIMIT          Resources exhausted
+
+GPG_ERR_INV_KEYRING             Invalid keyring
+
+GPG_ERR_TRUSTDB                         Trust DB error
 
 
-GPG_ERR_BAD_CERT		Bad certificate
+GPG_ERR_BAD_CERT                Bad certificate
 
 
-GPG_ERR_INV_USER_ID		Invalid user ID
+GPG_ERR_INV_USER_ID             Invalid user ID
 
     GNUPG:  - Used to indicate a bad specification of a user id.
     [more to come]
 
 
-38	GPG_ERR_UNEXPECTED		Unexpected error
-39	GPG_ERR_TIME_CONFLICT		Time conflict
-40	GPG_ERR_KEYSERVER		Keyserver error
+GPG_ERR_UNEXPECTED              Unexpected error
 
+GPG_ERR_TIME_CONFLICT           Time conflict
 
-GPG_ERR_WRONG_PUBKEY_ALGO	Wrong public key algorithm
+GPG_ERR_KEYSERVER               Keyserver error
+
+
+GPG_ERR_WRONG_PUBKEY_ALGO       Wrong public key algorithm
 
     GNUPG: - The algorithm is not expected.  For example a DSA
              algorithm is used where a non-DSA algorithm is expected
@@ -189,11 +224,13 @@ GPG_ERR_WRONG_PUBKEY_ALGO	Wrong public key algorithm
               different key type than requested.
 
 
-42	GPG_ERR_TRIBUTE_TO_D_A		Tribute to D. A.
-43	GPG_ERR_WEAK_KEY		Weak encryption key
-44	GPG_ERR_INV_KEYLEN		Invalid key length
+GPG_ERR_TRIBUTE_TO_D_A          Tribute to D. A.
+
+GPG_ERR_WEAK_KEY                Weak encryption key
+
+GPG_ERR_INV_KEYLEN              Invalid key length
 
-GPG_ERR_INV_ARG			Invalid argument
+GPG_ERR_INV_ARG                         Invalid argument
 
     GCRYPT:  - Unsupported length of input data in encrypt or decrypt
                cipher functions.  For example not matching the block
@@ -203,30 +240,37 @@ GPG_ERR_INV_ARG			Invalid argument
     [more to come]
 
 
-46	GPG_ERR_BAD_URI			Syntax error in URI
-47	GPG_ERR_INV_URI			Invalid URI
-48	GPG_ERR_NETWORK			Network error
-49	GPG_ERR_UNKNOWN_HOST		Unknown host
+GPG_ERR_BAD_URI                         Syntax error in URI
+
+GPG_ERR_INV_URI                         Invalid URI
+
+GPG_ERR_NETWORK                         Network error
+
+GPG_ERR_UNKNOWN_HOST            Unknown host
 
         Used instead of the non-portbale EHOSTNOTFOUND which is
         returned by some systems as a mapping of h_errno's
         HOST_NOT_FOUND
 
 
-50	GPG_ERR_SELFTEST_FAILED		Selftest failed
-51	GPG_ERR_NOT_ENCRYPTED		Data not encrypted
-52	GPG_ERR_NOT_PROCESSED		Data not processed
-53	GPG_ERR_UNUSABLE_PUBKEY		Unusable public key
-54	GPG_ERR_UNUSABLE_SECKEY		Unusable secret key
+GPG_ERR_SELFTEST_FAILED                 Selftest failed
+
+GPG_ERR_NOT_ENCRYPTED           Data not encrypted
+
+GPG_ERR_NOT_PROCESSED           Data not processed
 
-GPG_ERR_INV_VALUE		Invalid value
+GPG_ERR_UNUSABLE_PUBKEY                 Unusable public key
+
+GPG_ERR_UNUSABLE_SECKEY                 Unusable secret key
+
+GPG_ERR_INV_VALUE               Invalid value
 
     NTBTLS: - A DH parameter is out of range
 
 
-56	GPG_ERR_BAD_CERT_CHAIN		Bad certificate chain
+GPG_ERR_BAD_CERT_CHAIN          Bad certificate chain
 
-GPG_ERR_MISSING_CERT		Missing certificate
+GPG_ERR_MISSING_CERT            Missing certificate
 
     NTBTLS: - The server needs to send a certifciate but none has been
               set.  See also GPG_ERR_MISSING_ISSUER_CERT and
@@ -234,10 +278,11 @@ GPG_ERR_MISSING_CERT		Missing certificate
 
 
 
-58	GPG_ERR_NO_DATA			No data
-59	GPG_ERR_BUG			Bug
+GPG_ERR_NO_DATA                         No data
 
-60	GPG_ERR_NOT_SUPPORTED		Not supported
+GPG_ERR_BUG                     Bug
+
+GPG_ERR_NOT_SUPPORTED           Not supported
 
         Used if a feature is currently not supported but may be
         enabled for example using a program option.  Commonly used if
@@ -246,20 +291,27 @@ GPG_ERR_MISSING_CERT		Missing certificate
         are not yet supported.
 
 
-61	GPG_ERR_INV_OP			Invalid operation code
-62	GPG_ERR_TIMEOUT			Timeout
-63	GPG_ERR_INTERNAL		Internal error
-64	GPG_ERR_EOF_GCRYPT		EOF (gcrypt)
-65	GPG_ERR_INV_OBJ			Invalid object
-66	GPG_ERR_TOO_SHORT		Provided object is too short
-67	GPG_ERR_TOO_LARGE		Provided object is too large
-68	GPG_ERR_NO_OBJ			Missing item in object
+GPG_ERR_INV_OP                  Invalid operation code
+
+GPG_ERR_TIMEOUT                         Timeout
 
-GPG_ERR_NOT_IMPLEMENTED		Not implemented
+GPG_ERR_INTERNAL                Internal error
+
+GPG_ERR_EOF_GCRYPT              EOF (gcrypt)
+
+GPG_ERR_INV_OBJ                         Invalid object
+
+GPG_ERR_TOO_SHORT               Provided object is too short
+
+GPG_ERR_TOO_LARGE               Provided object is too large
+
+GPG_ERR_NO_OBJ                  Missing item in object
+
+GPG_ERR_NOT_IMPLEMENTED                 Not implemented
 
     NTBTLS: - The requested feature is not implemented.
 
-GPG_ERR_CONFLICT		Conflicting use
+GPG_ERR_CONFLICT                Conflicting use
 
     NTBTLS: - Function has already been called and may not be called
               again at this protocol state.
@@ -267,42 +319,53 @@ GPG_ERR_CONFLICT		Conflicting use
               which seems to be in use.
 
 
-71	GPG_ERR_INV_CIPHER_MODE		Invalid cipher mode
-72	GPG_ERR_INV_FLAG		Invalid flag
+GPG_ERR_INV_CIPHER_MODE                 Invalid cipher mode
+
+GPG_ERR_INV_FLAG                Invalid flag
 
    GPGME: Used to indicate an invalid combination of flags.
 
 
-73	GPG_ERR_INV_HANDLE		Invalid handle
-74	GPG_ERR_TRUNCATED		Result truncated
-75	GPG_ERR_INCOMPLETE_LINE		Incomplete line
-76	GPG_ERR_INV_RESPONSE		Invalid response
-77	GPG_ERR_NO_AGENT		No agent running
-78	GPG_ERR_AGENT			agent error
+GPG_ERR_INV_HANDLE              Invalid handle
+
+GPG_ERR_TRUNCATED               Result truncated
+
+GPG_ERR_INCOMPLETE_LINE                 Incomplete line
 
-GPG_ERR_INV_DATA		Invalid data
+GPG_ERR_INV_RESPONSE            Invalid response
+
+GPG_ERR_NO_AGENT                No agent running
+
+GPG_ERR_AGENT                   agent error
+
+GPG_ERR_INV_DATA                Invalid data
 
     GNUPG:  - Used in app-openpgp.c for a badly formatted request.
     GCRYPT: - No passphrase given for gcry_kdf_derive.
             - An opaque MPI is given to a public key function but not
               expected.
 
-80	GPG_ERR_ASSUAN_SERVER_FAULT	Unspecific Assuan server fault
+GPG_ERR_ASSUAN_SERVER_FAULT     Unspecific Assuan server fault
 
-GPG_ERR_ASSUAN			General Assuan error
+GPG_ERR_ASSUAN                  General Assuan error
 
     GNUPG: - Used by Assuan command handler if they fail to do basic
              things like an es_fdopen or es_fopencookie.
 
 
-82	GPG_ERR_INV_SESSION_KEY		Invalid session key
-83	GPG_ERR_INV_SEXP		Invalid S-expression
-84	GPG_ERR_UNSUPPORTED_ALGORITHM	Unsupported algorithm
-85	GPG_ERR_NO_PIN_ENTRY		No pinentry
-86	GPG_ERR_PIN_ENTRY		pinentry error
-87	GPG_ERR_BAD_PIN			Bad PIN
+GPG_ERR_INV_SESSION_KEY                 Invalid session key
+
+GPG_ERR_INV_SEXP                Invalid S-expression
+
+GPG_ERR_UNSUPPORTED_ALGORITHM   Unsupported algorithm
 
-GPG_ERR_INV_NAME		Invalid name
+GPG_ERR_NO_PIN_ENTRY            No pinentry
+
+GPG_ERR_PIN_ENTRY               pinentry error
+
+GPG_ERR_BAD_PIN                         Bad PIN
+
+GPG_ERR_INV_NAME                Invalid name
 
     GNUPG:  - Formerly used in GPGSM to indicate an error in
               the specification of a user id.  Later replaced by
@@ -316,47 +379,76 @@ GPG_ERR_INV_NAME		Invalid name
 
     [more to come]
 
-GPG_ERR_BAD_DATA		Bad data
+GPG_ERR_BAD_DATA                Bad data
 
-GPG_ERR_INV_PARAMETER		Invalid parameter
+GPG_ERR_INV_PARAMETER           Invalid parameter
 
     GNUPG:  - Returned if gpg-agent sends a new generated key with
               unknown parameter names.
             - Invalid parameter in the parameter file for key
               generation by gpgsm.
 
-91	GPG_ERR_WRONG_CARD		Wrong card
-92	GPG_ERR_NO_DIRMNGR		No dirmngr
-93	GPG_ERR_DIRMNGR			dirmngr error
-94	GPG_ERR_CERT_REVOKED		Certificate revoked
-95	GPG_ERR_NO_CRL_KNOWN		No CRL known
-96	GPG_ERR_CRL_TOO_OLD		CRL too old
-97	GPG_ERR_LINE_TOO_LONG		Line too long
-98	GPG_ERR_NOT_TRUSTED		Not trusted
-99	GPG_ERR_CANCELED		Operation cancelled
-100	GPG_ERR_BAD_CA_CERT		Bad CA certificate
-101	GPG_ERR_CERT_EXPIRED		Certificate expired
-102	GPG_ERR_CERT_TOO_YOUNG		Certificate too young
-103	GPG_ERR_UNSUPPORTED_CERT	Unsupported certificate
-104	GPG_ERR_UNKNOWN_SEXP		Unknown S-expression
-105	GPG_ERR_UNSUPPORTED_PROTECTION	Unsupported protection
-106	GPG_ERR_CORRUPTED_PROTECTION	Corrupted protection
-107	GPG_ERR_AMBIGUOUS_NAME		Ambiguous name
-108	GPG_ERR_CARD			Card error
-109	GPG_ERR_CARD_RESET		Card reset required
-110	GPG_ERR_CARD_REMOVED		Card removed
-111	GPG_ERR_INV_CARD		Invalid card
-112	GPG_ERR_CARD_NOT_PRESENT	Card not present
-113	GPG_ERR_NO_PKCS15_APP		No PKCS15 application
-114	GPG_ERR_NOT_CONFIRMED		Not confirmed
-115	GPG_ERR_CONFIGURATION		Configuration error
-116	GPG_ERR_NO_POLICY_MATCH		No policy match
-117	GPG_ERR_INV_INDEX		Invalid index
-118	GPG_ERR_INV_ID			Invalid ID
-119	GPG_ERR_NO_SCDAEMON		No SmartCard daemon
-120	GPG_ERR_SCDAEMON		SmartCard daemon error
-
-GPG_ERR_UNSUPPORTED_PROTOCOL	Unsupported protocol
+GPG_ERR_WRONG_CARD              Wrong card
+
+GPG_ERR_NO_DIRMNGR              No dirmngr
+
+GPG_ERR_DIRMNGR                         dirmngr error
+
+GPG_ERR_CERT_REVOKED            Certificate revoked
+
+GPG_ERR_NO_CRL_KNOWN            No CRL known
+
+GPG_ERR_CRL_TOO_OLD             CRL too old
+
+GPG_ERR_LINE_TOO_LONG           Line too long
+
+GPG_ERR_NOT_TRUSTED             Not trusted
+
+GPG_ERR_CANCELED                Operation cancelled
+
+GPG_ERR_BAD_CA_CERT             Bad CA certificate
+
+GPG_ERR_CERT_EXPIRED            Certificate expired
+
+GPG_ERR_CERT_TOO_YOUNG          Certificate too young
+
+GPG_ERR_UNSUPPORTED_CERT        Unsupported certificate
+
+GPG_ERR_UNKNOWN_SEXP            Unknown S-expression
+
+GPG_ERR_UNSUPPORTED_PROTECTION  Unsupported protection
+
+GPG_ERR_CORRUPTED_PROTECTION    Corrupted protection
+
+GPG_ERR_AMBIGUOUS_NAME          Ambiguous name
+
+GPG_ERR_CARD                    Card error
+
+GPG_ERR_CARD_RESET              Card reset required
+
+GPG_ERR_CARD_REMOVED            Card removed
+
+GPG_ERR_INV_CARD                Invalid card
+
+GPG_ERR_CARD_NOT_PRESENT        Card not present
+
+GPG_ERR_NO_PKCS15_APP           No PKCS15 application
+
+GPG_ERR_NOT_CONFIRMED           Not confirmed
+
+GPG_ERR_CONFIGURATION           Configuration error
+
+GPG_ERR_NO_POLICY_MATCH                 No policy match
+
+GPG_ERR_INV_INDEX               Invalid index
+
+GPG_ERR_INV_ID                  Invalid ID
+
+GPG_ERR_NO_SCDAEMON             No SmartCard daemon
+
+GPG_ERR_SCDAEMON                SmartCard daemon error
+
+GPG_ERR_UNSUPPORTED_PROTOCOL    Unsupported protocol
 
     GPG:        - An unsupported keyserver protocol.
     GPG_AGENT:  - Invalid shadow_info protocol (not "t1-v1")
@@ -364,46 +456,55 @@ GPG_ERR_UNSUPPORTED_PROTOCOL	Unsupported protocol
     GPGME:      - GPGME_PROTOCOL_xxx not supported.
     NTBTLS:     - Handshake protocol version not supported.
 
-122	GPG_ERR_BAD_PIN_METHOD		Bad PIN method
+GPG_ERR_BAD_PIN_METHOD          Bad PIN method
 
-GPG_ERR_CARD_NOT_INITIALIZED	Card not initialized
+GPG_ERR_CARD_NOT_INITIALIZED    Card not initialized
 
     SCDAEMON: - A card function is called but the card has not yet
                 been initialized.  This may be due to a conflict with
                 another card using connection or due to a bug.
 
-124	GPG_ERR_UNSUPPORTED_OPERATION	Unsupported operation
-125	GPG_ERR_WRONG_KEY_USAGE		Wrong key usage
+GPG_ERR_UNSUPPORTED_OPERATION   Unsupported operation
+
+GPG_ERR_WRONG_KEY_USAGE                 Wrong key usage
 
     GNUPG: - Key usage not possible with selected algorithm.
 
-GPG_ERR_NOTHING_FOUND		Nothing found
+GPG_ERR_NOTHING_FOUND           Nothing found
 
   Indicates that the operation was not possible because nothing has
   been found.  For example an update request for non existent data.
 
+GPG_ERR_WRONG_BLOB_TYPE                 Wrong blob type
 
-127	GPG_ERR_WRONG_BLOB_TYPE		Wrong blob type
-
-GPG_ERR_MISSING_VALUE		Missing value
+GPG_ERR_MISSING_VALUE           Missing value
 
     GNUPG: - Not enough parameters for a secret key send to gpg-agent.
 
     GCRYPT: - A required parameter has not been given.
 
 
-129	GPG_ERR_HARDWARE		Hardware problem
-130	GPG_ERR_PIN_BLOCKED		PIN blocked
-131	GPG_ERR_USE_CONDITIONS		Conditions of use not satisfied
-132	GPG_ERR_PIN_NOT_SYNCED		PINs are not synced
-133	GPG_ERR_INV_CRL			Invalid CRL
-134	GPG_ERR_BAD_BER			BER error
-135	GPG_ERR_INV_BER			Invalid BER
-136	GPG_ERR_ELEMENT_NOT_FOUND	Element not found
-137	GPG_ERR_IDENTIFIER_NOT_FOUND	Identifier not found
-138	GPG_ERR_INV_TAG			Invalid tag
+GPG_ERR_HARDWARE                Hardware problem
+
+GPG_ERR_PIN_BLOCKED             PIN blocked
+
+GPG_ERR_USE_CONDITIONS          Conditions of use not satisfied
+
+GPG_ERR_PIN_NOT_SYNCED          PINs are not synced
+
+GPG_ERR_INV_CRL                         Invalid CRL
+
+GPG_ERR_BAD_BER                         BER error
 
-GPG_ERR_INV_LENGTH		Invalid length
+GPG_ERR_INV_BER                         Invalid BER
+
+GPG_ERR_ELEMENT_NOT_FOUND       Element not found
+
+GPG_ERR_IDENTIFIER_NOT_FOUND    Identifier not found
+
+GPG_ERR_INV_TAG                         Invalid tag
+
+GPG_ERR_INV_LENGTH              Invalid length
 
     GCRYPT: - Bad block length for certain cipher algorithms and
               modes.
@@ -417,41 +518,46 @@ GPG_ERR_INV_LENGTH		Invalid length
     GNUPG:  - Invalid hash length for a pubkey
     [more to come]
 
-GPG_ERR_INV_KEYINFO		Invalid key info
+GPG_ERR_INV_KEYINFO             Invalid key info
 
     KSBA: - Returned if the ASN.1 Keyinfo structure is not valid
 
-141	GPG_ERR_UNEXPECTED_TAG		Unexpected tag
-142	GPG_ERR_NOT_DER_ENCODED		Not DER encoded
-143	GPG_ERR_NO_CMS_OBJ		No CMS object
-144	GPG_ERR_INV_CMS_OBJ		Invalid CMS object
-145	GPG_ERR_UNKNOWN_CMS_OBJ		Unknown CMS object
-146	GPG_ERR_UNSUPPORTED_CMS_OBJ	Unsupported CMS object
+GPG_ERR_UNEXPECTED_TAG          Unexpected tag
+
+GPG_ERR_NOT_DER_ENCODED                 Not DER encoded
+
+GPG_ERR_NO_CMS_OBJ              No CMS object
+
+GPG_ERR_INV_CMS_OBJ             Invalid CMS object
+
+GPG_ERR_UNKNOWN_CMS_OBJ                 Unknown CMS object
+
+GPG_ERR_UNSUPPORTED_CMS_OBJ     Unsupported CMS object
 
-GPG_ERR_UNSUPPORTED_ENCODING	Unsupported encoding
+GPG_ERR_UNSUPPORTED_ENCODING    Unsupported encoding
 
     GNUPG: - Returned by Dirmngr if a keyserver returns a HTML document.
 
 
-148	GPG_ERR_UNSUPPORTED_CMS_VERSION	Unsupported CMS version
+GPG_ERR_UNSUPPORTED_CMS_VERSION         Unsupported CMS version
 
 
-149	GPG_ERR_UNKNOWN_ALGORITHM	Unknown algorithm
+GPG_ERR_UNKNOWN_ALGORITHM       Unknown algorithm
 
     GCRYPT:  gcry_kdf_proc for an unknown kdf algorithm
 
-150	GPG_ERR_INV_ENGINE		Invalid crypto engine
+GPG_ERR_INV_ENGINE              Invalid crypto engine
 
     GPGME: Several uses use cases.  For example:
            - Unexpected format of a status line.
 
-151	GPG_ERR_PUBKEY_NOT_TRUSTED	Public key not trusted
-152	GPG_ERR_DECRYPT_FAILED		Decryption failed
-153	GPG_ERR_KEY_EXPIRED		Key expired
-154	GPG_ERR_SIG_EXPIRED		Signature expired
-155	GPG_ERR_ENCODING_PROBLEM	Encoding problem
+GPG_ERR_PUBKEY_NOT_TRUSTED      Public key not trusted
+GPG_ERR_DECRYPT_FAILED          Decryption failed
+GPG_ERR_KEY_EXPIRED             Key expired
+GPG_ERR_SIG_EXPIRED             Signature expired
+GPG_ERR_ENCODING_PROBLEM        Encoding problem
 
-GPG_ERR_INV_STATE		Invalid state
+GPG_ERR_INV_STATE               Invalid state
 
     The state (of a protocol) is not possible or not defined at all.
 
@@ -459,9 +565,9 @@ GPG_ERR_INV_STATE		Invalid state
 
 
 
-157	GPG_ERR_DUP_VALUE		Duplicated value
+GPG_ERR_DUP_VALUE               Duplicated value
 
-GPG_ERR_MISSING_ACTION		Missing action
+GPG_ERR_MISSING_ACTION          Missing action
 
     GNUPG: - In G13 the server command "MOUNT" is used without prior
              use of the command "OPEN".
@@ -470,21 +576,25 @@ GPG_ERR_MISSING_ACTION		Missing action
               indicate that the client did not conncted to the server
               as requested.
 
-159	GPG_ERR_MODULE_NOT_FOUND	ASN.1 module not found
-160	GPG_ERR_INV_OID_STRING		Invalid OID string
-161	GPG_ERR_INV_TIME		Invalid time
-162	GPG_ERR_INV_CRL_OBJ		Invalid CRL object
-163	GPG_ERR_UNSUPPORTED_CRL_VERSION	Unsupported CRL version
+GPG_ERR_MODULE_NOT_FOUND        ASN.1 module not found
 
+GPG_ERR_INV_OID_STRING          Invalid OID string
 
-GPG_ERR_INV_CERT_OBJ		Invalid certificate object
+GPG_ERR_INV_TIME                Invalid time
+
+GPG_ERR_INV_CRL_OBJ             Invalid CRL object
+
+GPG_ERR_UNSUPPORTED_CRL_VERSION         Unsupported CRL version
+
+
+GPG_ERR_INV_CERT_OBJ            Invalid certificate object
 
     GPGME: - A bad certificate (gpgme_key_t) has been passed to a
              function.  For example it might be incomplete due to a
              missing fingerprint.
 
 
-165	GPG_ERR_UNKNOWN_NAME		Unknown name
+GPG_ERR_UNKNOWN_NAME            Unknown name
 
         Used by GPG to indicate an unknown ECC curve name (may also
         indicate missing ECC support).  It is also used to indicate an
@@ -492,39 +602,49 @@ GPG_ERR_INV_CERT_OBJ		Invalid certificate object
         value to update state.  Note that GPG_ERR_UNKNOWN_CURVE is
         used instead by newer code.
 
-166	GPG_ERR_LOCALE_PROBLEM		A locale function failed
-167	GPG_ERR_NOT_LOCKED		Not locked
+GPG_ERR_LOCALE_PROBLEM          A locale function failed
+
+GPG_ERR_NOT_LOCKED              Not locked
 
-GPG_ERR_PROTOCOL_VIOLATION	Protocol violation
+GPG_ERR_PROTOCOL_VIOLATION      Protocol violation
 
     GNUPG: - Used for invalid HTTP responses.
 
 
-GPG_ERR_INV_MAC			Invalid MAC
+GPG_ERR_INV_MAC                         Invalid MAC
 
         The length, algo, or other properties of a MAC are not met.
         See also GPG_ERR_BAD_MAC.
 
 
-170	GPG_ERR_INV_REQUEST		Invalid request
-171	GPG_ERR_UNKNOWN_EXTN		Unknown extension
-172	GPG_ERR_UNKNOWN_CRIT_EXTN	Unknown critical extension
-173	GPG_ERR_LOCKED			Locked
-174	GPG_ERR_UNKNOWN_OPTION		Unknown option
-175	GPG_ERR_UNKNOWN_COMMAND		Unknown command
-176	GPG_ERR_NOT_OPERATIONAL		Not operational
-177	GPG_ERR_NO_PASSPHRASE		No passphrase given
-178	GPG_ERR_NO_PIN			No PIN given
+GPG_ERR_INV_REQUEST             Invalid request
+
+GPG_ERR_UNKNOWN_EXTN            Unknown extension
+
+GPG_ERR_UNKNOWN_CRIT_EXTN       Unknown critical extension
+
+GPG_ERR_LOCKED                  Locked
+
+GPG_ERR_UNKNOWN_OPTION          Unknown option
 
-GPG_ERR_NOT_ENABLED		Not enabled
+GPG_ERR_UNKNOWN_COMMAND         Unknown command
+
+GPG_ERR_NOT_OPERATIONAL         Not operational
+
+GPG_ERR_NO_PASSPHRASE           No passphrase given
+
+GPG_ERR_NO_PIN                  No PIN given
+
+GPG_ERR_NOT_ENABLED             Not enabled
 
         Similar to GPG_ERR_NOT_SUPPORTED.  In general this error is
         used for disabled features which can be expected to be enabled
         by the user.
 
 
-180	GPG_ERR_NO_ENGINE		No crypto engine
-181	GPG_ERR_MISSING_KEY		Missing key
+GPG_ERR_NO_ENGINE               No crypto engine
+
+GPG_ERR_MISSING_KEY             Missing key
 
 GPG_ERR_TOO_MANY                Too many objects
 
@@ -540,27 +660,27 @@ GPG_ERR_LIMIT_REACHED           Limit reached
         GnuPG: gpgtar: Extract directory can't be created because too
         many of directories with a similar name are already existing.
 
-GPG_ERR_NOT_INITIALIZED		Not initialized
+GPG_ERR_NOT_INITIALIZED                 Not initialized
 
     An operation can't be performed because something has not been
     initialized.  This might be a missing initialization of an entire
     subsystems or a prerequisite for using a function is not
     fulfilled.
 
-185	GPG_ERR_MISSING_ISSUER_CERT	Missing issuer certificate
+GPG_ERR_MISSING_ISSUER_CERT     Missing issuer certificate
 
-GPG_ERR_NO_KEYSERVER		No keyserver available
+GPG_ERR_NO_KEYSERVER            No keyserver available
 
         No keyserver configured or no keyserver available due to
         missing support for the requested protocol.  Found in Dirmngr.
 
-GPG_ERR_INV_CURVE		Invalid elliptic curve
+GPG_ERR_INV_CURVE               Invalid elliptic curve
 
         The curve parameter is missing or the curve is invalid; for
         example it is not possible to get affine coordinates for the
         public key.
 
-GPG_ERR_UNKNOWN_CURVE		Unknown elliptic curve
+GPG_ERR_UNKNOWN_CURVE           Unknown elliptic curve
 
         The curve is not known or not supported by the protocol.
 
@@ -571,17 +691,17 @@ GPG_ERR_DUP_KEY                 Duplicated key
         database occurred more than once.  Also used if in a protocol
         an expected key was returned more than once.
 
-GPG_ERR_AMBIGUOUS		Ambiguous search
+GPG_ERR_AMBIGUOUS               Ambiguous search
 
         A search etc returned an ambigious result.  This usually means
         that the search string was not specific enough.
 
-GPG_ERR_NO_CRYPT_CTX		No crypto context
+GPG_ERR_NO_CRYPT_CTX            No crypto context
 
         A crypto context was expected but not given.  Commonly used by
         Libgcrypt.
 
-GPG_ERR_WRONG_CRYPT_CTX		Wrong crypto context
+GPG_ERR_WRONG_CRYPT_CTX                 Wrong crypto context
 
         The given crypto context does not match the requirements.  For
         example in Libgcrypt a crypto context has private data
@@ -589,18 +709,18 @@ GPG_ERR_WRONG_CRYPT_CTX		Wrong crypto context
         returned if a crypto context initialized for a different
         algorithm is used.
 
-GPG_ERR_BAD_CRYPT_CTX		Bad crypto context
+GPG_ERR_BAD_CRYPT_CTX           Bad crypto context
 
         The is a problem with the crypto context.  For example it has
         not been properly initialized.
 
-GPG_ERR_CRYPT_CTX_CONFLICT	Conflict in the crypto context
+GPG_ERR_CRYPT_CTX_CONFLICT      Conflict in the crypto context
 
         Conflicting use of a crypto context.  For example if a context
         is used with objects that don't match the state of the
         context.
 
-GPG_ERR_BROKEN_PUBKEY		Broken public key
+GPG_ERR_BROKEN_PUBKEY           Broken public key
 
         The public key was mathematically not correctly generated.
         (It would have been nicer if we would have used BAD_PUBKEY for
@@ -608,7 +728,7 @@ GPG_ERR_BROKEN_PUBKEY		Broken public key
         example policy and encoding problems with a key.  Using
         INV_PUBKEY would have been better for these purposes)
 
-GPG_ERR_BROKEN_SECKEY		Broken secret key
+GPG_ERR_BROKEN_SECKEY           Broken secret key
 
         The secret key was mathematically not correctly generated.
 
@@ -617,40 +737,53 @@ GPG_ERR_MAC_ALGO
     GCRYPT: - MAC key algorithm is not defined or not available.
 
 
-198     GPG_ERR_FULLY_CANCELED          Operation fully cancelled
-199	GPG_ERR_UNFINISHED		Operation not yet finished
-200	GPG_ERR_BUFFER_TOO_SHORT	Buffer too short
+GPG_ERR_FULLY_CANCELED        Operation fully cancelled
+
+GPG_ERR_UNFINISHED            Operation not yet finished
+
+GPG_ERR_BUFFER_TOO_SHORT      Buffer too short
+
+GPG_ERR_SEXP_INV_LEN_SPEC     Invalid length specifier in S-expression
+
+GPG_ERR_SEXP_STRING_TOO_LONG  String too long in S-expression
 
-201	GPG_ERR_SEXP_INV_LEN_SPEC	Invalid length specifier in S-expression
-202	GPG_ERR_SEXP_STRING_TOO_LONG	String too long in S-expression
-203	GPG_ERR_SEXP_UNMATCHED_PAREN	Unmatched parentheses in S-expression
-204	GPG_ERR_SEXP_NOT_CANONICAL	S-expression not canonical
-205	GPG_ERR_SEXP_BAD_CHARACTER	Bad character in S-expression
-206	GPG_ERR_SEXP_BAD_QUOTATION	Bad quotation in S-expression
-207	GPG_ERR_SEXP_ZERO_PREFIX	Zero prefix in S-expression
-208	GPG_ERR_SEXP_NESTED_DH		Nested display hints in S-expression
-209	GPG_ERR_SEXP_UNMATCHED_DH	Unmatched display hints
-210	GPG_ERR_SEXP_UNEXPECTED_PUNC	Unexpected reserved punctuation in S-expression
-211	GPG_ERR_SEXP_BAD_HEX_CHAR	Bad hexadecimal character in S-expression
-212	GPG_ERR_SEXP_ODD_HEX_NUMBERS	Odd hexadecimal numbers in S-expression
-213	GPG_ERR_SEXP_BAD_OCT_CHAR	Bad octal character in S-expression
+GPG_ERR_SEXP_UNMATCHED_PAREN  Unmatched parentheses in S-expression
 
+GPG_ERR_SEXP_NOT_CANONICAL    S-expression not canonical
 
-GPG_ERR_SUBKEYS_EXP_REV (217)           All subkeys are expired or revoked
+GPG_ERR_SEXP_BAD_CHARACTER    Bad character in S-expression
 
-GPG_ERR_DB_CORRUPTED (218)		Database is corrupted
+GPG_ERR_SEXP_BAD_QUOTATION    Bad quotation in S-expression
 
-GPG_ERR_SERVER_FAILED (219)		Server indicated a failure
+GPG_ERR_SEXP_ZERO_PREFIX      Zero prefix in S-expression
 
-GPG_ERR_NO_NAME	(220)		No name
+GPG_ERR_SEXP_NESTED_DH        Nested display hints in S-expression
+
+GPG_ERR_SEXP_UNMATCHED_DH     Unmatched display hints
+
+GPG_ERR_SEXP_UNEXPECTED_PUNC  Unexpected reserved punctuation in S-expression
+
+GPG_ERR_SEXP_BAD_HEX_CHAR     Bad hexadecimal character in S-expression
+
+GPG_ERR_SEXP_ODD_HEX_NUMBERS  Odd hexadecimal numbers in S-expression
+
+GPG_ERR_SEXP_BAD_OCT_CHAR     Bad octal character in S-expression
+
+GPG_ERR_SUBKEYS_EXP_REV           All subkeys are expired or revoked
+
+GPG_ERR_DB_CORRUPTED            Database is corrupted
+
+GPG_ERR_SERVER_FAILED           Server indicated a failure
+
+GPG_ERR_NO_NAME                         No name
 
     EAI_NONAME may be mapped to this code.
 
-GPG_ERR_NO_KEY (221)		No key
+GPG_ERR_NO_KEY          No key
 
     Some kind of key was not found.
 
-GPG_ERR_LEGACY_KEY (222)        Legacy key
+GPG_ERR_LEGACY_KEY        Legacy key
 
     Used by GnuPG to identify version 2 and 3 OpenPGP key packets.
 
@@ -664,16 +797,16 @@ GPG_ERR_REQUEST_TOO_LONG        Request too long
     be due to an internal limitation, a protocol violation, or due to
     the use of a newer version of a protocol.
 
-GPG_ERR_OBJ_TERM_STATE		Object is in termination state
+GPG_ERR_OBJ_TERM_STATE          Object is in termination state
 
     For cards this is the ISO status word 0x6285 (file is in
     termnation state).
 
-GPG_ERR_NO_CERT_CHAIN		No certificate chain
+GPG_ERR_NO_CERT_CHAIN           No certificate chain
 
     NTBTLS: - A CA chain has not been set but is required.
 
-GPG_ERR_CERT_TOO_LARGE		Certificate is too large
+GPG_ERR_CERT_TOO_LARGE          Certificate is too large
 
     NTBTLS: - A certificate is too large to be used by the protocol.
 
@@ -681,7 +814,7 @@ GPG_ERR_INV_RECORD              Invalid record
 
     NTBTLS: - An invalid record was received
 
-GPG_ERR_BAD_MAC			The MAC does not verify
+GPG_ERR_BAD_MAC                         The MAC does not verify
 
     NTBTLS: - MAC verification of the message failed.
 
@@ -776,7 +909,7 @@ GPG_ERR_BOGUS_STRING            Bogus string
     possible dangerous characters (e.g. control characters in a domain
     name).
 
-GPG_ERR_FORBIDDEN		Forbidden
+GPG_ERR_FORBIDDEN               Forbidden
 
     The use of a features is not allowed due to insufficient rights.
     Use by gpg-agent as an error codes for restricted commands.
@@ -785,104 +918,130 @@ GPG_ERR_KEY_DISABLED            Key disabled
 
     GNUPG: - The key has been disabled by the user.
 
-GPG_ERR_KEY_ON_CARD		Not possible with a card based key
+GPG_ERR_KEY_ON_CARD             Not possible with a card based key
 
     GNUPG: - The gpg-agent returns this if a DELETE_KEY commands is
              used for a smartcard based key.
 
-GPG_ERR_INV_LOCK_OBJ		Invalid lock object
+GPG_ERR_INV_LOCK_OBJ            Invalid lock object
 
     GPGRT: - The provided lock object is not valid.  This indicates an
              internal problem in libgpg-error or more likely a
              programming error.
 
-GPG_ERR_TRUE			True
+GPG_ERR_TRUE                    True
 
     Used to return the boolean value True.  Note that GPG_ERR_NO_ERROR
     (with the value 0) is also often used to indicate the value true.
 
-GPG_ERR_FALSE			False
+GPG_ERR_FALSE                   False
 
     Used to return the boolean value False.
 
 
-GPG_ERR_ASS_GENERAL (257)            General IPC error
-GPG_ERR_ASS_ACCEPT_FAILED (258)      IPC accept call failed
-GPG_ERR_ASS_CONNECT_FAILED (259)     IPC connect call failed
-GPG_ERR_ASS_INV_RESPONSE (260)       Invalid IPC response
-GPG_ERR_ASS_INV_VALUE (261)          Invalid value passed to IPC
-GPG_ERR_ASS_INCOMPLETE_LINE (262)    Incomplete line passed to IPC
-GPG_ERR_ASS_LINE_TOO_LONG (263)      Line passed to IPC too long
-GPG_ERR_ASS_NESTED_COMMANDS (264)    Nested IPC commands
-GPG_ERR_ASS_NO_DATA_CB (265)         No data callback in IPC
-GPG_ERR_ASS_NO_INQUIRE_CB (266)      No inquire callback in IPC
-GPG_ERR_ASS_NOT_A_SERVER (267)       Not an IPC server
-GPG_ERR_ASS_NOT_A_CLIENT (268)       Not an IPC client
-GPG_ERR_ASS_SERVER_START (269)       Problem starting IPC server
-GPG_ERR_ASS_READ_ERROR (270)         IPC read error
-GPG_ERR_ASS_WRITE_ERROR	(271)        IPC write error
-GPG_ERR_ASS_TOO_MUCH_DATA  (273)     Too much data for IPC layer
-GPG_ERR_ASS_UNEXPECTED_CMD (274)     Unexpected IPC command
-GPG_ERR_ASS_UNKNOWN_CMD	(275)        Unknown IPC command
-GPG_ERR_ASS_SYNTAX (276)             IPC syntax error
-GPG_ERR_ASS_CANCELED (277)           IPC call has been cancelled
-GPG_ERR_ASS_NO_INPUT (278)           No input source for IPC
-GPG_ERR_ASS_NO_OUTPUT (279)          No output source for IPC
-GPG_ERR_ASS_PARAMETER (280)          IPC parameter error
-GPG_ERR_ASS_UNKNOWN_INQUIRE (281)    Unknown IPC inquire
-
-
-GPG_ERR_ENGINE_TOO_OLD (300)	Crypto engine too old
-
-GPG_ERR_WINDOW_TOO_SMALL(301)	Screen or window too small
+GPG_ERR_ASS_GENERAL            General IPC error
+
+GPG_ERR_ASS_ACCEPT_FAILED      IPC accept call failed
+
+GPG_ERR_ASS_CONNECT_FAILED     IPC connect call failed
+
+GPG_ERR_ASS_INV_RESPONSE       Invalid IPC response
+
+GPG_ERR_ASS_INV_VALUE          Invalid value passed to IPC
+
+GPG_ERR_ASS_INCOMPLETE_LINE    Incomplete line passed to IPC
+
+GPG_ERR_ASS_LINE_TOO_LONG      Line passed to IPC too long
+
+GPG_ERR_ASS_NESTED_COMMANDS    Nested IPC commands
+
+GPG_ERR_ASS_NO_DATA_CB         No data callback in IPC
+
+GPG_ERR_ASS_NO_INQUIRE_CB      No inquire callback in IPC
+
+GPG_ERR_ASS_NOT_A_SERVER       Not an IPC server
+
+GPG_ERR_ASS_NOT_A_CLIENT       Not an IPC client
+
+GPG_ERR_ASS_SERVER_START       Problem starting IPC server
+
+GPG_ERR_ASS_READ_ERROR         IPC read error
+
+GPG_ERR_ASS_WRITE_ERROR         IPC write error
+
+GPG_ERR_ASS_TOO_MUCH_DATA      Too much data for IPC layer
+
+GPG_ERR_ASS_UNEXPECTED_CMD     Unexpected IPC command
+
+GPG_ERR_ASS_UNKNOWN_CMD         Unknown IPC command
+
+GPG_ERR_ASS_SYNTAX             IPC syntax error
+
+GPG_ERR_ASS_CANCELED           IPC call has been cancelled
+
+GPG_ERR_ASS_NO_INPUT           No input source for IPC
+
+GPG_ERR_ASS_NO_OUTPUT          No output source for IPC
+
+GPG_ERR_ASS_PARAMETER          IPC parameter error
+
+GPG_ERR_ASS_UNKNOWN_INQUIRE    Unknown IPC inquire
+
+GPG_ERR_ENGINE_TOO_OLD  Crypto engine too old
+
+GPG_ERR_WINDOW_TOO_SMALL        Screen or window too small
 
     Pinentry: - The size of the screen is too small.
 
-GPG_ERR_WINDOW_TOO_LARGE (302)	Screen or window too large
+GPG_ERR_WINDOW_TOO_LARGE        Screen or window too large
 
-GPG_ERR_MISSING_ENVVAR (303)	Required environment variable not set
+GPG_ERR_MISSING_ENVVAR  Required environment variable not set
 
     Pinentry: - The size of the screen can't be determined.
 
-GPG_ERR_USER_ID_EXISTS (304)	User ID already exists
+GPG_ERR_USER_ID_EXISTS  User ID already exists
 
     GNUPG: - Existing user ID in --quick-gen-key.
 
-GPG_ERR_NAME_EXISTS (305)	Name already exists
-GPG_ERR_DUP_NAME (306)		Duplicated name
+GPG_ERR_NAME_EXISTS     Name already exists
 
-GPG_ERR_TOO_YOUNG (307)		Objects is too young
+GPG_ERR_DUP_NAME                Duplicated name
+
+GPG_ERR_TOO_YOUNG               Objects is too young
 
     For example used if a file is younger than expected.
 
-GPG_ERR_TOO_OLD	(308		Objects is too old
+GPG_ERR_TOO_OLD                         Objects is too old
 
     Used if an object is too old to be used.  This is a more generic
     code than GPG_ERR_ENGINE_TOO_OLD or GPG_ERR_CRL_TOO_OLD.
 
-GPG_ERR_LDAP_GENERAL		LDAP General error
+GPG_ERR_LDAP_GENERAL            LDAP General error
 
    Catch all error for LDAP.  Use if if can't map an erro rocde to an
    gpg-error code.
 
-GPG_ERR_LDAP_ATTR_GENERAL	LDAP General attribute error
-GPG_ERR_LDAP_NAME_GENERAL	LDAP General name error
-GPG_ERR_LDAP_SECURITY_GENERAL	LDAP General security error
-GPG_ERR_LDAP_SERVICE_GENERAL	LDAP General service error
-GPG_ERR_LDAP_UPDATE_GENERAL	LDAP General update error
-GPG_ERR_LDAP_E_GENERAL		LDAP Experimental error code
-GPG_ERR_LDAP_X_GENERAL	        LDAP Private error code
-GPG_ERR_LDAP_OTHER_GENERAL	LDAP Other general error
-
-  All above may be used to map ranges of LDAP errors to one specific
-  code. OpenLDAP uses LDAP_xxx_RANGE(n) macros for tha mapping.
-  "Other general error" may be used similar to "General error" for
-  mapping of ranges.  Here are macros from OpenLDAP for reference
-
-  #define LDAP_ATTR_ERROR(n)	 LDAP_RANGE((n),0x10,0x15) /* 16-21 */
-  #define LDAP_NAME_ERROR(n)	 LDAP_RANGE((n),0x20,0x24) /* 32-34,36 */
+GPG_ERR_LDAP_ATTR_GENERAL       LDAP General attribute error
+GPG_ERR_LDAP_NAME_GENERAL       LDAP General name error
+GPG_ERR_LDAP_SECURITY_GENERAL   LDAP General security error
+GPG_ERR_LDAP_SERVICE_GENERAL    LDAP General service error
+GPG_ERR_LDAP_UPDATE_GENERAL     LDAP General update error
+GPG_ERR_LDAP_E_GENERAL          LDAP Experimental error code
+GPG_ERR_LDAP_X_GENERAL          LDAP Private error code
+GPG_ERR_LDAP_OTHER_GENERAL      LDAP Other general error
+
+  The 8 GPG_ERR_LDAP_*_GENERAL error codes may be used to map ranges
+  of LDAP errors to one specific code. OpenLDAP uses LDAP_xxx_RANGE(n)
+  macros for that mapping.  "Other general error" may be used similar
+  to "General error" for mapping of ranges.  Here are macros from
+  OpenLDAP for reference:
+
+  #define LDAP_ATTR_ERROR(n)     LDAP_RANGE((n),0x10,0x15) /* 16-21 */
+  #define LDAP_NAME_ERROR(n)     LDAP_RANGE((n),0x20,0x24) /* 32-34,36 */
   #define LDAP_SECURITY_ERROR(n) LDAP_RANGE((n),0x2F,0x32) /* 47-50 */
-  #define LDAP_SERVICE_ERROR(n)	 LDAP_RANGE((n),0x33,0x36) /* 51-54 */
-  #define LDAP_UPDATE_ERROR(n)	 LDAP_RANGE((n),0x40,0x47) /* 64-69,71 */
-  #define LDAP_E_ERROR(n)	 LDAP_RANGE((n),0x1000,0x3FFF)
-  #define LDAP_X_ERROR(n)	 LDAP_RANGE((n),0x4000,0xFFFF)
+  #define LDAP_SERVICE_ERROR(n)  LDAP_RANGE((n),0x33,0x36) /* 51-54 */
+  #define LDAP_UPDATE_ERROR(n)   LDAP_RANGE((n),0x40,0x47) /* 64-69,71 */
+  #define LDAP_E_ERROR(n)        LDAP_RANGE((n),0x1000,0x3FFF)
+  #define LDAP_X_ERROR(n)        LDAP_RANGE((n),0x4000,0xFFFF)
+
+## end of errorref.txt
diff --git a/src/Makefile.am b/src/Makefile.am
index e5e907d..1eb8287 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -192,8 +192,9 @@ libgpg_error_la_CPPFLAGS = -DLOCALEDIR=\"$(localedir)\" $(extra_cppflags)
 libgpg_error_la_LIBADD = $(gpg_error_res) $(intllibs) $(LIBTHREAD)
 
 gpg_error_SOURCES = strsource-sym.c strerror-sym.c gpg-error.c
-gpg_error_CPPFLAGS = -DLOCALEDIR=\"$(localedir)\" $(extra_cppflags)
-gpg_error_LDADD = ./libgpg-error.la @LTLIBINTL@
+gpg_error_CPPFLAGS = -DPKGDATADIR=\"$(pkgdatadir)\" \
+                     -DLOCALEDIR=\"$(localedir)\" $(extra_cppflags)
+gpg_error_LDADD = ./libgpg-error.la $(LTLIBINTL)
 
 # We build err-sources.h and err-codes.h in the source directory.
 # This is needed because gettext does only look into the source
diff --git a/src/gpg-error.c b/src/gpg-error.c
index 117b367..4a09e1d 100644
--- a/src/gpg-error.c
+++ b/src/gpg-error.c
@@ -1,5 +1,5 @@
 /* gpg-error.c - Determining gpg-error error codes.
-   Copyright (C) 2004 g10 Code GmbH
+   Copyright (C) 2004, 2016 g10 Code GmbH
 
    This file is part of libgpg-error.
 
@@ -370,12 +370,107 @@ get_err_from_str (char *str, gpg_error_t *err)
 }
 
 
+static void
+print_desc (const char *symbol)
+{
+  static int initialized;
+  static FILE *fp;
+  char line[512];
+  char *p;
+  int indesc = 0;
+  int blanklines = 0;
+  int last_was_keyword = 0;
+
+  if (!initialized)
+    {
+      initialized = 1;
+      fp = fopen (PKGDATADIR "/errorref.txt", "r");
+    }
+  if (!fp)
+    return;
+  rewind (fp);
+  while (fgets (line, sizeof line, fp))
+    {
+      if (*line == '#')
+        continue;
+      if (*line && line[strlen(line)-1] == '\n')
+        line[strlen(line)-1] = 0;
+
+      if (!strncmp (line, "GPG_ERR_", 8))
+        {
+          if (indesc == 1 && last_was_keyword)
+            continue; /* Skip keywords immediately following a matched
+                       * keyword.  */
+          last_was_keyword = 1;
+
+          indesc = 0;
+          p = strchr (line, ' ');
+          if (!p)
+            continue;
+          *p = 0;
+          if (!strcmp (line, symbol))
+            {
+              indesc = 1;
+              continue; /* Skip this line.  */
+            }
+        }
+      else
+        last_was_keyword = 0;
+      if (!indesc)
+        continue;
+      if (indesc == 1 && !*line)
+        continue; /* Skip leading empty lines in a description.  */
+      if (indesc == 1)
+        putchar ('\n'); /* One leading empty line.  */
+      indesc = 2;
+      if (!*line)
+        {
+          blanklines++;
+          continue;
+        }
+      for (; blanklines; blanklines--)
+        putchar ('\n');
+      printf ("%s\n", line);
+    }
+  putchar ('\n'); /* One trailing blank line.  */
+}
+
+
+
 

+
+static int
+show_usage (const char *name)
+{
+  if (name)
+    {
+      fprintf (stderr, _("Usage: %s GPG-ERROR [...]\n"),
+               strrchr (name,'/')? (strrchr (name, '/')+1): name);
+      exit (1);
+    }
+
+  fputs ("gpg-error (" PACKAGE_NAME ") " PACKAGE_VERSION "\n", stdout);
+  fputs ("Options:\n"
+         "  --version      Print version\n"
+         "  --lib-version  Print library version\n"
+         "  --help         Print this help\n"
+         "  --list         Print all error codes\n"
+         "  --defines      Print all error codes as #define lines\n"
+         "  --desc         Print with error description\n"
+         , stdout);
+  exit (0);
+}
+
+
+
 int
 main (int argc, char *argv[])
 {
-  int i = 1;
+  const char *pgmname = argv[0];
+  int last_argc = -1;
+  int i;
   int listmode = 0;
+  int desc = 0;
   const char *source_sym;
   const char *error_sym;
   gpg_error_t err;
@@ -383,46 +478,60 @@ main (int argc, char *argv[])
   gpgrt_init ();
   i18n_init ();
 
-  if (argc == 1)
-    {
-      fprintf (stderr, _("Usage: %s GPG-ERROR [...]\n"),
-               strrchr (argv[0],'/')? (strrchr (argv[0], '/')+1): argv[0]);
-      exit (1);
-    }
-  else if (argc == 2 && !strcmp (argv[1], "--version"))
-    {
-      fputs ("gpg-error (" PACKAGE_NAME ") " PACKAGE_VERSION "\n", stdout);
-      exit (0);
-    }
-  else if (argc == 2 && !strcmp (argv[1], "--help"))
-    {
-      fputs ("gpg-error (" PACKAGE_NAME ") " PACKAGE_VERSION "\n", stdout);
-      fputs ("Options:\n"
-             "  --version      Print version\n"
-             "  --lib-version  Print library version\n"
-             "  --help         Print this help\n"
-             "  --list         Print all error codes\n"
-             "  --defines      Print all error codes as #define lines\n"
-             , stdout);
-      exit (0);
-    }
-  else if (argc == 2 && !strcmp (argv[1], "--lib-version"))
-    {
-      printf ("Version from header: %s (0x%06x)\n",
-              GPG_ERROR_VERSION, GPG_ERROR_VERSION_NUMBER);
-      printf ("Version from binary: %s\n", gpg_error_check_version (NULL));
-      printf ("Copyright blurb ...:%s\n", gpg_error_check_version ("\x01\x01"));
-      exit (0);
-    }
-  else if (argc == 2 && !strcmp (argv[1], "--list"))
+
+  if (argc)
     {
-      listmode = 1;
+      argc--; argv++;
     }
-  else if (argc == 2 && !strcmp (argv[1], "--defines"))
+  while (argc && last_argc != argc )
     {
-      listmode = 2;
+      last_argc = argc;
+      if (!strcmp (*argv, "--"))
+        {
+          argc--; argv++;
+          break;
+        }
+      else if (!strcmp (*argv, "--version"))
+        {
+          fputs ("gpg-error (" PACKAGE_NAME ") " PACKAGE_VERSION "\n", stdout);
+          exit (0);
+        }
+      else if (!strcmp (*argv, "--help"))
+        {
+          show_usage (NULL);
+        }
+      else if (!strcmp (*argv, "--lib-version"))
+        {
+          argc--; argv++;
+          printf ("Version from header: %s (0x%06x)\n",
+                  GPG_ERROR_VERSION, GPG_ERROR_VERSION_NUMBER);
+          printf ("Version from binary: %s\n", gpg_error_check_version (NULL));
+          printf ("Copyright blurb ...:%s\n",
+                  gpg_error_check_version ("\x01\x01"));
+          exit (0);
+        }
+      else if (!strcmp (*argv, "--list"))
+        {
+          listmode = 1;
+          argc--; argv++;
+        }
+      else if (!strcmp (*argv, "--defines"))
+        {
+          listmode = 2;
+          argc--; argv++;
+        }
+      else if (!strcmp (*argv, "--desc"))
+        {
+          desc = 1;
+          argc--; argv++;
+        }
+      else if (!strncmp (*argv, "--", 2))
+        show_usage (pgmname);
     }
 
+  if ((argc && listmode) || (!argc && !listmode))
+    show_usage (pgmname);
+
 
   if (listmode == 1)
     {
@@ -434,18 +543,26 @@ main (int argc, char *argv[])
           err -= 1;
 	  source_sym = gpg_strsource_sym (err);
           if (source_sym)
-            printf ("%u = (%u, -) = (%s, -) = (%s, -)\n",
-                    err, gpg_err_source (err),
-                    source_sym, gpg_strsource (err));
+            {
+              printf ("%u = (%u, -) = (%s, -) = (%s, -)\n",
+                      err, gpg_err_source (err),
+                      source_sym, gpg_strsource (err));
+              if (desc)
+                print_desc (source_sym);
+            }
         }
       for (i=0; i <  GPG_ERR_CODE_DIM; i++)
         {
           err = gpg_err_make (GPG_ERR_SOURCE_UNKNOWN, i);
 	  error_sym = gpg_strerror_sym (err);
           if (error_sym)
-            printf ("%u = (-, %u) = (-, %s) = (-, %s)\n",
-                    err, gpg_err_code (err),
-                    error_sym, gpg_strerror (err));
+            {
+              printf ("%u = (-, %u) = (-, %s) = (-, %s)\n",
+                      err, gpg_err_code (err),
+                      error_sym, gpg_strerror (err));
+              if (desc)
+                print_desc (error_sym);
+            }
         }
     }
   else if (listmode == 2)
@@ -493,7 +610,7 @@ main (int argc, char *argv[])
     }
   else /* Standard mode.  */
     {
-      while (i < argc)
+      for (i=0; i < argc; i++)
         {
           if (get_err_from_number (argv[i], &err)
               || get_err_from_symbol (argv[i], &err)
@@ -506,11 +623,12 @@ main (int argc, char *argv[])
                       err, gpg_err_source (err), gpg_err_code (err),
                       source_sym ? source_sym : "-", error_sym ? error_sym:"-",
                       gpg_strsource (err), gpg_strerror (err));
+              if (desc)
+                print_desc (error_sym);
             }
           else
             fprintf (stderr, _("%s: warning: could not recognize %s\n"),
                      argv[0], argv[i]);
-          i++;
         }
     }
 

-----------------------------------------------------------------------

Summary of changes:
 NEWS               |   6 +
 doc/Makefile.am    |  13 +-
 doc/errorref.txt   | 739 ++++++++++++++++++++++++++++++++---------------------
 src/Makefile.am    |   5 +-
 src/err-codes.h.in |   1 +
 src/gpg-error.c    | 208 +++++++++++----
 6 files changed, 638 insertions(+), 334 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  2 22:59:39 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 02 Dec 2016 22:59:39 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-11-g140a196
Message-ID: <E1cCvrp-00079N-Ji@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  140a19617c78d5f0e2ac8d7e2c8e7092862ec2fb (commit)
      from  c761c981b38741421d13bb7102b1ea7625d2d639 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 140a19617c78d5f0e2ac8d7e2c8e7092862ec2fb
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 2 22:57:09 2016 +0100

    Fix NULL segv in new option --desc
    
    * src/gpg-error.c (print_desc): Shortcur for unknown symbols.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gpg-error.c b/src/gpg-error.c
index 4a09e1d..f890883 100644
--- a/src/gpg-error.c
+++ b/src/gpg-error.c
@@ -381,6 +381,9 @@ print_desc (const char *symbol)
   int blanklines = 0;
   int last_was_keyword = 0;
 
+  if (!symbol)
+    return;
+
   if (!initialized)
     {
       initialized = 1;

-----------------------------------------------------------------------

Summary of changes:
 src/gpg-error.c | 3 +++
 1 file changed, 3 insertions(+)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Dec  3 21:38:49 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sat, 03 Dec 2016 21:38:49 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-50-gef10c34
Message-ID: <E1cDH5A-0003Nk-UD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ef10c348bffc7dad19e1832bebc453755d209420 (commit)
      from  ce29272e24e7b718b8fca9b84bc728e65f3dea24 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ef10c348bffc7dad19e1832bebc453755d209420
Author: Werner Koch <wk at gnupg.org>
Date:   Sat Dec 3 21:35:45 2016 +0100

    gpg: Fix error code arg in ERRSIG status line.
    
    * g10/mainproc.c (check_sig_and_print): Use gpg_err_code to return an
    error code in ERRSIG.
    --
    
    Debian-bug-id: 846834
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/mainproc.c b/g10/mainproc.c
index 30e19fe..ac2ab03 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -2223,7 +2223,7 @@ check_sig_and_print (CTX c, kbnode_t node)
       snprintf (buf, sizeof buf, "%08lX%08lX %d %d %02x %lu %d",
                 (ulong)sig->keyid[0], (ulong)sig->keyid[1],
                 sig->pubkey_algo, sig->digest_algo,
-                sig->sig_class, (ulong)sig->timestamp, rc);
+                sig->sig_class, (ulong)sig->timestamp, gpg_err_code (rc));
       write_status_text (STATUS_ERRSIG, buf);
       if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
         {

-----------------------------------------------------------------------

Summary of changes:
 g10/mainproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec  5 10:45:09 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 05 Dec 2016 10:45:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-51-gfae4d06
Message-ID: <E1cDppg-0000CN-Qg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  fae4d06b0ccaa9803e0c0da56c327b0bcfffcac5 (commit)
      from  ef10c348bffc7dad19e1832bebc453755d209420 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fae4d06b0ccaa9803e0c0da56c327b0bcfffcac5
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 5 10:37:31 2016 +0100

    tests: New test for '--enarmor' and '--dearmor'.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/enarmor.scm: New file.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 49db18e..350b60a 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -45,6 +45,7 @@ TESTS_ENVIRONMENT = LC_ALL=C \
 
 XTESTS = \
 	version.scm \
+	enarmor.scm \
 	mds.scm \
 	decrypt.scm \
 	decrypt-multifile.scm \
diff --git a/tests/openpgp/enarmor.scm b/tests/openpgp/enarmor.scm
new file mode 100755
index 0000000..a301ccd
--- /dev/null
+++ b/tests/openpgp/enarmor.scm
@@ -0,0 +1,31 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+(for-each-p
+ "Checking armor encoding and decoding"
+ (lambda (source)
+   (tr:do
+    (tr:open source)
+    (tr:gpg "" `(--enarmor))
+    (tr:gpg "" '(--dearmor))
+    (tr:assert-identity source)))
+ (append plain-files data-files))

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am                     | 1 +
 tests/openpgp/{armencrypt.scm => enarmor.scm} | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)
 copy tests/openpgp/{armencrypt.scm => enarmor.scm} (87%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec  5 11:03:43 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 05 Dec 2016 11:03:43 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-52-g41b3d09
Message-ID: <E1cDq7e-0001N7-0r@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  41b3d0975de65d1654f5e37c626d7c9b7c9a7a4d (commit)
      from  fae4d06b0ccaa9803e0c0da56c327b0bcfffcac5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 41b3d0975de65d1654f5e37c626d7c9b7c9a7a4d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 5 10:58:39 2016 +0100

    gpg: New option --quick-set-expire.
    
    * g10/gpg.c (aQuickSetExpire): New.
    (opts): New option --quick-set-expire.
    (main): Implement option.
    * g10/keyedit.c (menu_expire): Add args FORCE_MAINKEY and
    NEWEXPIRATION.  Change semantics of the return value.  Change caller.
    (keyedit_quick_set_expire): New.
    --
    
    This patch partly solves
    GnuPG-bug-id: 2701

diff --git a/doc/gpg.texi b/doc/gpg.texi
index b01d0a3..9d51dcb 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -632,6 +632,12 @@ supplied passphrase is used for the new key and the agent does not ask
 for it.  To create a key without any protection @code{--passphrase ''}
 may be used.
 
+ at item --quick-set-expire @code{fpr} @code{expire}
+ at opindex quick-set-expire
+Directly set the expiration time of the primary key to @code{expire}.
+To remove the expiration time @code{0} can be used.
+
+
 @item --quick-addkey @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
 @opindex quick-addkey
 Directly add a subkey to the key identified by the fingerprint
diff --git a/g10/export.c b/g10/export.c
index 6a5597c..ad42b41 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -1144,9 +1144,9 @@ print_status_exported (PKT_public_key *pk)
 /*
  * Receive a secret key from agent specified by HEXGRIP.
  *
- * Since the key data from agant is encrypted, decrypt it by CIPHERHD.
- * Then, parse the decrypted key data in transfer format, and put
- * secret parameters into PK.
+ * Since the key data from the agent is encrypted, decrypt it using
+ * CIPHERHD context.  Then, parse the decrypted key data into transfer
+ * format, and put secret parameters into PK.
  *
  * If CLEARTEXT is 0, store the secret key material
  * passphrase-protected.  Otherwise, store secret key material in the
diff --git a/g10/gpg.c b/g10/gpg.c
index 7cf51f2..2deb27a 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -123,6 +123,7 @@ enum cmd_and_opt_values
     aQuickAddUid,
     aQuickAddKey,
     aQuickRevUid,
+    aQuickSetExpire,
     aListConfig,
     aListGcryptConfig,
     aGPGConfList,
@@ -448,6 +449,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aQuickAddKey,  "quick-addkey", "@"),
   ARGPARSE_c (aQuickRevUid,  "quick-revuid",
               N_("quickly revoke a user-id")),
+  ARGPARSE_c (aQuickSetExpire,  "quick-set-expire",
+              N_("quickly set a new expiration date")),
   ARGPARSE_c (aFullKeygen,  "full-gen-key" ,
               N_("full featured key pair generation")),
   ARGPARSE_c (aGenRevoke, "gen-revoke",N_("generate a revocation certificate")),
@@ -2549,6 +2552,7 @@ main (int argc, char **argv)
 	  case aQuickAddUid:
 	  case aQuickAddKey:
 	  case aQuickRevUid:
+	  case aQuickSetExpire:
 	  case aExportOwnerTrust:
 	  case aImportOwnerTrust:
           case aRebuildKeydbCaches:
@@ -4384,6 +4388,18 @@ main (int argc, char **argv)
         }
 	break;
 
+      case aQuickSetExpire:
+        {
+          const char *x_fpr, *x_expire;
+
+          if (argc != 2)
+            wrong_args ("--quick-set-exipre FINGERPRINT EXPIRE");
+          x_fpr = *argv++; argc--;
+          x_expire = *argv++; argc--;
+          keyedit_quick_set_expire (ctrl, x_fpr, x_expire);
+        }
+	break;
+
       case aFastImport:
         opt.import_options |= IMPORT_FAST;
       case aImport:
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 94fa8c4..dadf586 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -69,7 +69,8 @@ static int menu_delsig (KBNODE pub_keyblock);
 static int menu_clean (KBNODE keyblock, int self_only);
 static void menu_delkey (KBNODE pub_keyblock);
 static int menu_addrevoker (ctrl_t ctrl, kbnode_t pub_keyblock, int sensitive);
-static int menu_expire (KBNODE pub_keyblock);
+static gpg_error_t menu_expire (kbnode_t pub_keyblock,
+                                int force_mainkey, u32 newexpiration);
 static int menu_changeusage (kbnode_t keyblock);
 static int menu_backsign (KBNODE pub_keyblock);
 static int menu_set_primary_uid (KBNODE pub_keyblock);
@@ -2599,7 +2600,7 @@ keyedit_menu (ctrl_t ctrl, const char *username, strlist_t locusr,
 	  break;
 
 	case cmdEXPIRE:
-	  if (menu_expire (keyblock))
+	  if (gpg_err_code (menu_expire (keyblock, 0, 0)) == GPG_ERR_TRUE)
 	    {
 	      merge_keys_and_selfsig (keyblock);
               run_subkey_warnings = 1;
@@ -3342,6 +3343,86 @@ keyedit_quick_addkey (ctrl_t ctrl, const char *fpr, const char *algostr,
 }
 
 
+/* Unattended expiration setting function for the main key.
+ *
+ */
+void
+keyedit_quick_set_expire (ctrl_t ctrl, const char *fpr, const char *expirestr)
+{
+  gpg_error_t err;
+  kbnode_t keyblock;
+  KEYDB_HANDLE kdbhd;
+  int modified = 0;
+  PKT_public_key *pk;
+  u32 expire;
+
+#ifdef HAVE_W32_SYSTEM
+  /* See keyedit_menu for why we need this.  */
+  check_trustdb_stale (ctrl);
+#endif
+
+  /* We require a fingerprint because only this uniquely identifies a
+   * key and may thus be used to select a key for unattended
+   * expiration setting.  */
+  err = find_by_primary_fpr (ctrl, fpr, &keyblock, &kdbhd);
+  if (err)
+    goto leave;
+
+  if (fix_keyblock (&keyblock))
+    modified++;
+
+  pk = keyblock->pkt->pkt.public_key;
+  if (pk->flags.revoked)
+    {
+      if (!opt.verbose)
+        show_key_with_all_names (ctrl, es_stdout, keyblock, 0, 0, 0, 0, 0, 1);
+      log_error ("%s%s", _("Key is revoked."), "\n");
+      err = gpg_error (GPG_ERR_CERT_REVOKED);
+      goto leave;
+    }
+
+
+  expire = parse_expire_string (expirestr);
+  if (expire == (u32)-1 )
+    {
+      log_error (_("'%s' is not a valid expiration time\n"), expirestr);
+      err = gpg_error (GPG_ERR_INV_VALUE);
+      goto leave;
+    }
+  if (expire)
+    expire += make_timestamp ();
+
+  /* Set the new expiration date.  */
+  err = menu_expire (keyblock, 1, expire);
+  if (gpg_err_code (err) == GPG_ERR_TRUE)
+    modified = 1;
+  else if (err)
+    goto leave;
+  es_fflush (es_stdout);
+
+  /* Store.  */
+  if (modified)
+    {
+      err = keydb_update_keyblock (ctrl, kdbhd, keyblock);
+      if (err)
+        {
+          log_error (_("update failed: %s\n"), gpg_strerror (err));
+          goto leave;
+        }
+      if (update_trust)
+        revalidation_mark ();
+    }
+  else
+    log_info (_("Key not changed so no update needed.\n"));
+
+ leave:
+  release_kbnode (keyblock);
+  keydb_release (kdbhd);
+  if (err)
+    write_status_error ("set_expire", err);
+}
+
+
 

 static void
 tty_print_notations (int indent, PKT_signature * sig)
@@ -4736,36 +4817,50 @@ fail:
 }
 
 
-static int
-menu_expire (KBNODE pub_keyblock)
+/* With FORCE_MAINKEY cleared this function handles the interactive
+ * menu option "expire".  With FORCE_MAINKEY set this functions only
+ * sets the expiration date of the primary key to NEWEXPIRATION and
+ * avoid all interactivity.  Retirns 0 if nothing was done,
+ * GPG_ERR_TRUE if the key was modified, or any other error code. */
+static gpg_error_t
+menu_expire (kbnode_t pub_keyblock, int force_mainkey, u32 newexpiration)
 {
-  int n1, signumber, rc;
+  int signumber, rc;
   u32 expiredate;
   int mainkey = 0;
   PKT_public_key *main_pk, *sub_pk;
   PKT_user_id *uid;
-  KBNODE node;
+  kbnode_t node;
   u32 keyid[2];
 
-  n1 = count_selected_keys (pub_keyblock);
-  if (n1 > 1)
+  if (force_mainkey)
     {
-      if (!cpr_get_answer_is_yes
-          ("keyedit.expire_multiple_subkeys.okay",
-           _("Are you sure you want to change the"
-             " expiration time for multiple subkeys? (y/N) ")))
-	return 0;
+      mainkey = 1;
+      expiredate = newexpiration;
     }
-  else if (n1)
-    tty_printf (_("Changing expiration time for a subkey.\n"));
   else
     {
-      tty_printf (_("Changing expiration time for the primary key.\n"));
-      mainkey = 1;
-      no_primary_warning (pub_keyblock);
+      int n1 = count_selected_keys (pub_keyblock);
+      if (n1 > 1)
+        {
+          if (!cpr_get_answer_is_yes
+              ("keyedit.expire_multiple_subkeys.okay",
+               _("Are you sure you want to change the"
+                 " expiration time for multiple subkeys? (y/N) ")))
+            return gpg_error (GPG_ERR_CANCELED);;
+        }
+      else if (n1)
+        tty_printf (_("Changing expiration time for a subkey.\n"));
+      else
+        {
+          tty_printf (_("Changing expiration time for the primary key.\n"));
+          mainkey = 1;
+          no_primary_warning (pub_keyblock);
+        }
+
+      expiredate = ask_expiredate ();
     }
 
-  expiredate = ask_expiredate ();
 
   /* Now we can actually change the self-signature(s) */
   main_pk = sub_pk = NULL;
@@ -4781,7 +4876,7 @@ menu_expire (KBNODE pub_keyblock)
 	}
       else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
 	{
-          if (node->flag & NODFLG_SELKEY)
+          if ((node->flag & NODFLG_SELKEY) && !force_mainkey)
             {
               sub_pk = node->pkt->pkt.public_key;
               sub_pk->expiredate = expiredate;
@@ -4795,6 +4890,7 @@ menu_expire (KBNODE pub_keyblock)
 	       && (mainkey || sub_pk))
 	{
 	  PKT_signature *sig = node->pkt->pkt.signature;
+
 	  if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
 	      && ((mainkey && uid
 		   && uid->created && (sig->sig_class & ~3) == 0x10)
@@ -4812,7 +4908,7 @@ menu_expire (KBNODE pub_keyblock)
 		{
 		  log_info
                     (_("You can't change the expiration date of a v3 key\n"));
-		  return 0;
+		  return gpg_error (GPG_ERR_LEGACY_KEY);
 		}
 
 	      if (mainkey)
@@ -4827,7 +4923,9 @@ menu_expire (KBNODE pub_keyblock)
 		{
 		  log_error ("make_keysig_packet failed: %s\n",
 			     gpg_strerror (rc));
-		  return 0;
+                  if (gpg_err_code (rc) == GPG_ERR_TRUE)
+                    rc = GPG_ERR_GENERAL;
+		  return rc;
 		}
 
 	      /* Replace the packet.  */
@@ -4843,7 +4941,7 @@ menu_expire (KBNODE pub_keyblock)
     }
 
   update_trust = 1;
-  return 1;
+  return gpg_error (GPG_ERR_TRUE);
 }
 
 
diff --git a/g10/main.h b/g10/main.h
index 63aec47..1822ee4 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -295,6 +295,8 @@ void keyedit_quick_revuid (ctrl_t ctrl, const char *username,
                            const char *uidtorev);
 void keyedit_quick_sign (ctrl_t ctrl, const char *fpr,
                          strlist_t uids, strlist_t locusr, int local);
+void keyedit_quick_set_expire (ctrl_t ctrl,
+                               const char *fpr, const char *expirestr);
 void show_basic_key_info (KBNODE keyblock);
 
 /*-- keygen.c --*/

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi  |   6 +++
 g10/export.c  |   6 +--
 g10/gpg.c     |  16 +++++++
 g10/keyedit.c | 144 ++++++++++++++++++++++++++++++++++++++++++++++++----------
 g10/main.h    |   2 +
 5 files changed, 148 insertions(+), 26 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec  5 12:58:43 2016
From: cvs at cvs.gnupg.org (by Tobias Mueller)
Date: Mon, 05 Dec 2016 12:58:43 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-9-g05896c2
Message-ID: <E1cDruv-0006Fk-WE@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  05896c210f7fa9ce7b97784a75e49dc4489e9252 (commit)
       via  fb7f4cb973abc9f5eb05eb240607be35c1be986c (commit)
      from  ae21d2705fc46725e1f9af1651b68d16155d1501 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 05896c210f7fa9ce7b97784a75e49dc4489e9252
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Fri Dec 2 23:37:27 2016 +0100

    python: Try to be more helpful when given a string to encrypt().
    
    * lang/python/helpers.c (_gpg_obj2gpgme_data_t): Extended error
    message.
    * lang/python/tests/t-encrypt.py: Test for "encode" in error message.
    --
    The motivation is to help the user when encrypting fails. I claim that
    it is not obvious to not being able to encrypt a string directly.  To
    nudge the user into encoding it to bytes, the error message is a bit
    extended.
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/helpers.c b/lang/python/helpers.c
index 8f71a30..576767c 100644
--- a/lang/python/helpers.c
+++ b/lang/python/helpers.c
@@ -293,8 +293,10 @@ _gpg_obj2gpgme_data_t(PyObject *input, int argnum, gpgme_data_t *wrapper,
     return _gpg_obj2gpgme_t(data, "gpgme_data_t", argnum);
 
   return PyErr_Format(PyExc_TypeError,
-                      "arg %d: expected gpg.Data, file, or an object "
-                      "implementing the buffer protocol, got %s",
+                      "arg %d: expected gpg.Data, file, "
+                      "bytes (not string!), or an object "
+                      "implementing the buffer protocol. Got: %s. "
+                      "If you provided a string, try to encode() it.",
                       argnum, data->ob_type->tp_name);
 }
 
diff --git a/lang/python/tests/t-encrypt.py b/lang/python/tests/t-encrypt.py
index 0c0ca35..3cbe8f2 100755
--- a/lang/python/tests/t-encrypt.py
+++ b/lang/python/tests/t-encrypt.py
@@ -62,3 +62,18 @@ with gpg.Context(armor=True) as c:
         assert support.sign_only.endswith(e.recipients[0].fpr)
     else:
         assert False, "Expected an InvalidRecipients error, got none"
+
+
+
+    try:
+        # People might be tempted to provide strings.
+        # We should raise something useful.
+        ciphertext, _, _ = c.encrypt("Hallo Leute\n",
+                                     recipients=keys,
+                                     sign=False,
+                                     always_trust=True)
+    except TypeError as e:
+        # This test is a bit fragile, because the message
+        # may very well change. So if the behaviour will change
+        # this test can easily be deleted.
+        assert "encode" in str(e)

commit fb7f4cb973abc9f5eb05eb240607be35c1be986c
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Thu Dec 1 21:15:12 2016 +0100

    python: Define a macro for wrapping fragile result objects.
    
    * lang/python/gpgme.i (wrapresult): New Macro.
    --
    
    This reduces the amount of copy and pasted code at the expense of a
    slightly more complicated logic with a macro.
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/gpgme.i b/lang/python/gpgme.i
index 783531f..73533d0 100644
--- a/lang/python/gpgme.i
+++ b/lang/python/gpgme.i
@@ -424,69 +424,24 @@
 

 
 /* Wrap the fragile result objects into robust Python ones.  */
-%typemap(out) gpgme_encrypt_result_t {
+%define wrapresult(cls, name)
+%typemap(out) cls {
   PyObject *fragile;
   fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
                                %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "EncryptResult");
+  $result = _gpg_wrap_result(fragile, name);
   Py_DECREF(fragile);
 }
+%enddef
 
-%typemap(out) gpgme_decrypt_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "DecryptResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_sign_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "SignResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_verify_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "VerifyResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_import_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "ImportResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_genkey_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "GenkeyResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_keylist_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "KeylistResult");
-  Py_DECREF(fragile);
-}
-
-%typemap(out) gpgme_vfs_mount_result_t {
-  PyObject *fragile;
-  fragile = SWIG_NewPointerObj(SWIG_as_voidptr($1), $1_descriptor,
-                               %newpointer_flags);
-  $result = _gpg_wrap_result(fragile, "VFSMountResult");
-  Py_DECREF(fragile);
-}
+wrapresult(gpgme_encrypt_result_t, "EncryptResult")
+wrapresult(gpgme_decrypt_result_t, "DecryptResult")
+wrapresult(gpgme_sign_result_t, "SignResult")
+wrapresult(gpgme_verify_result_t, "VerifyResult")
+wrapresult(gpgme_import_result_t, "ImportResult")
+wrapresult(gpgme_genkey_result_t, "GenkeyResult")
+wrapresult(gpgme_keylist_result_t, "KeylistResult")
+wrapresult(gpgme_vfs_mount_result_t, "VFSMountResult")
 
 %typemap(out) gpgme_engine_info_t {
   int i;

-----------------------------------------------------------------------

Summary of changes:
 lang/python/gpgme.i            | 69 ++++++++----------------------------------
 lang/python/helpers.c          |  6 ++--
 lang/python/tests/t-encrypt.py | 15 +++++++++
 3 files changed, 31 insertions(+), 59 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec  5 17:44:29 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 05 Dec 2016 17:44:29 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-211-g209490b
Message-ID: <E1cDwNT-0003qB-Rb@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  209490bfa1054e52ffed0a3fc01182ec213486a7 (commit)
       via  2424a72898912287b8dcde2c23536e7a2a191949 (commit)
       via  07e6004ae619f61dc4f8d71eb8b69ebb659edbe5 (commit)
       via  6749896725f84c0c11feb278399d8e02afd9b83f (commit)
       via  3c221f684b1407f03efb38bf9dfeec9c4f7d9c1a (commit)
       via  38f98dfeb754ad4992c86ab295415c5346ca7bb6 (commit)
       via  c774a46f5b59bc811452e643492d7fdddf933213 (commit)
      from  b527d97b06c684bc00df3023407c60c4338a71ec (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 209490bfa1054e52ffed0a3fc01182ec213486a7
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:43:43 2016 +0100

    Fix multipart/alternative html mails
    
    * src/mimemaker.cpp (add_body_and_attachments): Properly
    handle the case when inner and outer boundary is null.

diff --git a/src/mimemaker.cpp b/src/mimemaker.cpp
index 18bc271..dbed524 100644
--- a/src/mimemaker.cpp
+++ b/src/mimemaker.cpp
@@ -1366,6 +1366,8 @@ add_body_and_attachments (sink_t sink, LPMESSAGE message,
   int rc = 0;
   char inner_boundary[BOUNDARYSIZE+1];
   char outer_boundary[BOUNDARYSIZE+1];
+  *outer_boundary = 0;
+  *inner_boundary = 0;
 
   if (((body && n_att_usable) || n_att_usable > 1) && related == 1)
     {
@@ -1386,10 +1388,8 @@ add_body_and_attachments (sink_t sink, LPMESSAGE message,
                                  NULL)))
         return rc;
     }
-  else
-  /* Only one part.  */
-    *outer_boundary = 0;
 
+  /* Only one part.  */
   if (*outer_boundary && related == 2)
     {
       /* We have attachments that are related to the body and unrelated
@@ -1407,13 +1407,10 @@ add_body_and_attachments (sink_t sink, LPMESSAGE message,
           return rc;
         }
     }
-  else
-    {
-      *inner_boundary = 0;
-    }
 
 
-  if ((rc=add_body (mail, *inner_boundary ? inner_boundary : outer_boundary,
+  if ((rc=add_body (mail, *inner_boundary ? inner_boundary :
+                          *outer_boundary ? outer_boundary : NULL,
                     sink, body)))
     {
       log_error ("%s:%s: Adding the body failed.",

commit 2424a72898912287b8dcde2c23536e7a2a191949
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:42:00 2016 +0100

    Use MAPI message for mapi_get_uid
    
    * src/mapihelp.cpp, src/mapihelp.h (mapi_get_message):
    Change to take message as argument.
    * src/ribbon-callbacks.cpp (get_mail_from_control): Update usage.

diff --git a/src/mapihelp.cpp b/src/mapihelp.cpp
index 8b0c45a..92def26 100644
--- a/src/mapihelp.cpp
+++ b/src/mapihelp.cpp
@@ -292,31 +292,28 @@ get_gpgoluid_tag (LPMESSAGE message, ULONG *r_tag)
 }
 
 char *
-mapi_get_uid (LPDISPATCH mail)
+mapi_get_uid (LPMESSAGE msg)
 {
   /* If the UUID is not in OOM maybe we find it in mapi. */
-  LPMESSAGE msg = get_oom_base_message (mail);
   if (!msg)
     {
-      log_debug ("%s:%s: Failed to get message for '%p'",
-                 SRCNAME, __func__, mail);
-      gpgol_release (msg);
+      log_error ("%s:%s: Called without message",
+                 SRCNAME, __func__);
+      return NULL;
     }
   ULONG tag;
   if (get_gpgoluid_tag (msg, &tag))
     {
       log_debug ("%s:%s: Failed to get tag for '%p'",
-                 SRCNAME, __func__, mail);
-      gpgol_release (msg);
+                 SRCNAME, __func__, msg);
       return NULL;
     }
   LPSPropValue propval = NULL;
   HRESULT hr = HrGetOneProp ((LPMAPIPROP)msg, tag, &propval);
-  gpgol_release (msg);
   if (hr)
     {
       log_debug ("%s:%s: Failed to get prop for '%p'",
-                 SRCNAME, __func__, mail);
+                 SRCNAME, __func__, msg);
       return NULL;
     }
   char *ret = NULL;
@@ -324,13 +321,13 @@ mapi_get_uid (LPDISPATCH mail)
     {
       ret = wchar_to_utf8 (propval->Value.lpszW);
       log_debug ("%s:%s: Fund uuid in MAPI for %p",
-                 SRCNAME, __func__, mail);
+                 SRCNAME, __func__, msg);
     }
   else if (PROP_TYPE (propval->ulPropTag) == PT_STRING8)
     {
       ret = strdup (propval->Value.lpszA);
       log_debug ("%s:%s: Fund uuid in MAPI for %p",
-                 SRCNAME, __func__, mail);
+                 SRCNAME, __func__, msg);
     }
   MAPIFreeBuffer (propval);
   return ret;
diff --git a/src/mapihelp.h b/src/mapihelp.h
index 9bcd58f..4985d58 100644
--- a/src/mapihelp.h
+++ b/src/mapihelp.h
@@ -131,7 +131,8 @@ int mapi_mark_or_create_moss_attach (LPMESSAGE message, msgtype_t msgtype);
 /* Copy the MAPI body to a PGPBODY type attachment. */
 int mapi_body_to_attachment (LPMESSAGE message);
 
-char * mapi_get_uid (LPDISPATCH mail);
+/* Get malloced uid of a message */
+char * mapi_get_uid (LPMESSAGE message);
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 374885d..f14f43b 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1468,7 +1468,9 @@ get_mail_from_control (LPDISPATCH ctrl)
   uid = get_unique_id (mailitem, 0, nullptr);
   if (!uid)
     {
-      uid = mapi_get_uid (mailitem);
+      LPMESSAGE msg = get_oom_base_message (mailitem);
+      uid = mapi_get_uid (msg);
+      gpgol_release (msg);
       if (!uid)
         {
           log_debug ("%s:%s: Failed to get uid for %p",

commit 07e6004ae619f61dc4f8d71eb8b69ebb659edbe5
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:21:23 2016 +0100

    Mention srcname / func in debug of invalidation
    
    * src/gpgoladdin.cpp (gpgoladdin_invalidate_ui): Put srcname
    and func in debug.
    
    --
    Makes debug output easier to read.

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index d291ab4..3b26107 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -1298,7 +1298,8 @@ void gpgoladdin_invalidate_ui ()
 
   for (it = g_ribbon_uis.begin(); it != g_ribbon_uis.end(); ++it)
     {
-      log_debug ("Invalidating ribbon: %p", *it);
+      log_debug ("%s:%s: Invalidating ribbon: %p",
+                 SRCNAME, __func__, *it);
       invoke_oom_method (*it, "Invalidate", NULL);
     }
 }

commit 6749896725f84c0c11feb278399d8e02afd9b83f
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:19:50 2016 +0100

    Prepare OOM Event handler for OL 2007
    
    * src/mailitem-events.cpp (EVENT_SINK_INVOKE): Set uuid
    on Open and pre_process in Read for OL 2007.

diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index 110f7ce..b6ad311 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -128,6 +128,16 @@ EVENT_SINK_INVOKE(MailItemEvents)
           log_oom_extra ("%s:%s: Open : %p",
                          SRCNAME, __func__, m_mail);
           LPMESSAGE message;
+          if (g_ol_version_major < 14 && m_mail->set_uuid ())
+            {
+              /* In Outlook 2007 we need the uid for every
+                 open mail to track the message in case
+                 it is sent and crypto is required. */
+              log_debug ("%s:%s: Failed to set uuid.",
+                         SRCNAME, __func__);
+              delete m_mail; /* deletes this, too */
+              return S_OK;
+            }
           int draft_flags = 0;
           if (!opt.encrypt_default && !opt.sign_default)
             {
@@ -165,6 +175,20 @@ EVENT_SINK_INVOKE(MailItemEvents)
         }
       case Read:
         {
+          if (g_ol_version_major < 14)
+            {
+              /* In Outlook 2007 there is no Before read event.
+                 We change the message class in message-events to
+                 prevent that outlook parses the mail itself but
+                 we still need to update our mail object accordingly.
+                 So we call pre_process here gain although the message
+                 class already was changed. */
+              if (m_mail->pre_process_message ())
+                {
+                  log_error ("%s:%s: Pre process message failed.",
+                             SRCNAME, __func__);
+                }
+            }
           log_oom_extra ("%s:%s: Read : %p",
                          SRCNAME, __func__, m_mail);
           if (!m_mail->is_crypto_mail())

commit 3c221f684b1407f03efb38bf9dfeec9c4f7d9c1a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:17:54 2016 +0100

    Add send_seen as member variable to Mail object
    
    * src/mail.cpp, src/mail.h (Mail::needs_encrypt),
    (Mail::set_needs_encrypt): New.
    * src/mailitem-events.cpp (EVENT_SINK_INVOKE): Use new functions.
    
    --
    This puts the last state variable from the event handler into
    the Mail object. It will be needed to Support Outlook 2007
    where we have two event handlers.

diff --git a/src/mail.cpp b/src/mail.cpp
index 162b817..395c75a 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -77,6 +77,7 @@ Mail::Mail (LPDISPATCH mailitem) :
     m_is_valid(false),
     m_close_triggered(false),
     m_is_html_alternative(false),
+    m_needs_encrypt(false),
     m_moss_position(0),
     m_crypto_flags(0),
     m_type(MSGTYPE_UNKNOWN)
@@ -1720,3 +1721,15 @@ Mail::get_crypto_flags () const
 {
   return m_crypto_flags;
 }
+
+void
+Mail::set_needs_encrypt (bool value)
+{
+  m_needs_encrypt = value;
+}
+
+bool
+Mail::needs_encrypt() const
+{
+  return m_needs_encrypt;
+}
diff --git a/src/mail.h b/src/mail.h
index 680ea1c..340b7e3 100644
--- a/src/mail.h
+++ b/src/mail.h
@@ -304,6 +304,11 @@ public:
       Only valid after decrypt_verify.
   */
   int get_crypto_flags () const;
+
+  /** Returns true if the mail should be encrypted in the
+      after write event. */
+  bool needs_encrypt () const;
+  void set_needs_encrypt (bool val);
 private:
   void update_categories ();
   void update_body ();
@@ -320,7 +325,8 @@ private:
        m_is_signed, /* Mail is signed */
        m_is_valid, /* Mail is valid signed. */
        m_close_triggered, /* We have programtically triggered a close */
-       m_is_html_alternative; /* Body Format is not plain text */
+       m_is_html_alternative, /* Body Format is not plain text */
+       m_needs_encrypt; /* Send was triggered we want to encrypt. */
   int m_moss_position; /* The number of the original message attachment. */
   int m_crypto_flags;
   std::string m_sender;
diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index 4ae4ec3..110f7ce 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -79,7 +79,6 @@ BEGIN_EVENT_SINK(MailItemEvents, IDispatch)
 
 private:
   Mail * m_mail; /* The mail object related to this mailitem */
-  bool m_send_seen;   /* The message is about to be submitted */
 };
 
 MailItemEvents::MailItemEvents() :
@@ -87,8 +86,7 @@ MailItemEvents::MailItemEvents() :
     m_pCP(NULL),
     m_cookie(0),
     m_ref(1),
-    m_mail(NULL),
-    m_send_seen (false)
+    m_mail(NULL)
 {
 }
 
@@ -307,13 +305,12 @@ EVENT_SINK_INVOKE(MailItemEvents)
              break;
            }
           m_mail->update_oom_data ();
-          m_send_seen = true;
+          m_mail->set_needs_encrypt (true);
           invoke_oom_method (m_object, "Save", NULL);
           if (m_mail->crypto_successful ())
             {
                log_debug ("%s:%s: Passing send event for message %p.",
                           SRCNAME, __func__, m_object);
-               m_send_seen = false;
                break;
             }
           else
@@ -363,9 +360,8 @@ EVENT_SINK_INVOKE(MailItemEvents)
         {
           log_oom_extra ("%s:%s: AfterWrite : %p",
                          SRCNAME, __func__, m_mail);
-          if (m_send_seen)
+          if (m_mail->needs_encrypt ())
             {
-              m_send_seen = false;
               m_mail->encrypt_sign ();
               return S_OK;
             }

commit 38f98dfeb754ad4992c86ab295415c5346ca7bb6
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:14:54 2016 +0100

    Add fallback to create categories
    
    * src/oomhelp.cpp (ensure_category_exists): Fallback to
    Session.Categories.
    
    --
    If there are not multiple sessions this fallback is needed
    t least for outlook 2007.

diff --git a/src/oomhelp.cpp b/src/oomhelp.cpp
index 49eaca5..9570eaf 100644
--- a/src/oomhelp.cpp
+++ b/src/oomhelp.cpp
@@ -1490,8 +1490,12 @@ ensure_category_exists (LPDISPATCH application, const char *category, int color)
       gpgol_release (store);
       if (!categories)
         {
-          TRACEPOINT;
-          continue;
+          categories = get_oom_object (application, "Session.Categories");
+          if (!categories)
+            {
+              TRACEPOINT;
+              continue;
+            }
         }
 
       auto count = get_oom_int (categories, "Count");

commit c774a46f5b59bc811452e643492d7fdddf933213
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 5 17:12:56 2016 +0100

    Always initialize execpinfo
    
    * src/oomhelp.cpp (get_oom_object, put_oom_string),
    (add_oom_attachment, get_pa_variant, invoke_oom_method_with_parms):
    Initialize execepinfo.
    
    --
    It is not assured that invoke sets excepinfo. This might have
    lead to crashes in dump_excepinfo.

diff --git a/src/oomhelp.cpp b/src/oomhelp.cpp
index 1b23d75..49eaca5 100644
--- a/src/oomhelp.cpp
+++ b/src/oomhelp.cpp
@@ -181,6 +181,8 @@ get_oom_object (LPDISPATCH pStart, const char *fullname)
       unsigned int argErr = 0;
       EXCEPINFO execpinfo;
 
+      init_excepinfo (&execpinfo);
+
       if (pDisp)
         {
           gpgol_release (pDisp);
@@ -487,6 +489,7 @@ put_oom_string (LPDISPATCH pDisp, const char *name, const char *string)
   BSTR bstring;
   EXCEPINFO execpinfo;
 
+  init_excepinfo (&execpinfo);
   dispid = lookup_oom_dispid (pDisp, name);
   if (dispid == DISPID_UNKNOWN)
     return -1;
@@ -934,6 +937,7 @@ int get_pa_variant (LPDISPATCH pDisp, const char *dasl_id, VARIANT *rVariant)
   wchar_t *w_property;
   unsigned int argErr = 0;
 
+  init_excepinfo (&execpinfo);
   log_oom ("%s:%s: Looking up property: %s;",
              SRCNAME, __func__, dasl_id);
 
@@ -1128,6 +1132,7 @@ add_oom_attachment (LPDISPATCH disp, const wchar_t* inFileW,
   unsigned int argErr = 0;
   EXCEPINFO execpinfo;
 
+  init_excepinfo (&execpinfo);
   dispid = lookup_oom_dispid (attachments, "Add");
 
   if (dispid == DISPID_UNKNOWN)
@@ -1307,6 +1312,7 @@ invoke_oom_method_with_parms (LPDISPATCH pDisp, const char *name,
   if (dispid != DISPID_UNKNOWN)
     {
       EXCEPINFO execpinfo;
+      init_excepinfo (&execpinfo);
       DISPPARAMS dispparams = {NULL, NULL, 0, 0};
 
       hr = pDisp->Invoke (dispid, IID_NULL, LOCALE_SYSTEM_DEFAULT,

-----------------------------------------------------------------------

Summary of changes:
 src/gpgoladdin.cpp       |  3 ++-
 src/mail.cpp             | 13 +++++++++++++
 src/mail.h               |  8 +++++++-
 src/mailitem-events.cpp  | 34 +++++++++++++++++++++++++++-------
 src/mapihelp.cpp         | 19 ++++++++-----------
 src/mapihelp.h           |  3 ++-
 src/mimemaker.cpp        | 13 +++++--------
 src/oomhelp.cpp          | 14 ++++++++++++--
 src/ribbon-callbacks.cpp |  4 +++-
 9 files changed, 79 insertions(+), 32 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 12:20:16 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Tue, 06 Dec 2016 12:20:16 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-58-g7572d27
Message-ID: <E1cEDnJ-0005Wo-4r@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  7572d270fcda1614648c6f08d711d5096ffebbe6 (commit)
       via  6102099985c1b82b6c0bba0464c1f913cc673e96 (commit)
       via  db6d8cfdc118131f497596ef1ffc121949377754 (commit)
       via  17c717d7c92d9a52101fea7e396fc133322a8786 (commit)
       via  d5b18d6c55d65e8df2dd112651e3b9b3d9e6e27a (commit)
       via  bd9ebe1404c1395edd0e029023a9e780c90f6d73 (commit)
      from  41b3d0975de65d1654f5e37c626d7c9b7c9a7a4d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7572d270fcda1614648c6f08d711d5096ffebbe6
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 12:16:15 2016 +0100

    doc: Improve the text in the gpg manual
    
    * doc/gpg.texi: Improve the text.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 9d51dcb..3f54fe2 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -61,21 +61,24 @@
 @command{@gpgname} is the OpenPGP part of the GNU Privacy Guard (GnuPG). It
 is a tool to provide digital encryption and signing services using the
 OpenPGP standard. @command{@gpgname} features complete key management and
-all bells and whistles you can expect from a decent OpenPGP
+all the bells and whistles you would expect from a full OpenPGP
 implementation.
 
+There are two main versions of GnuPG: GnuPG 1.x and GnuPG 2.x.  GnuPG
+2.x supports modern encryption algorithms and thus should be preferred
+over GnuPG 1.x.  You only need to use GnuPG 1.x if your platform
+doesn't support GnuPG 2.x, or you need support for some features that
+GnuPG 2.x has deprecated, e.g., decrypting data created with PGP-2
+keys.
+
 @ifclear gpgtwohack
-Note that this version of GnuPG features all modern algorithms and
-should thus be preferred over older GnuPG versions.  If you are
-looking for version 1 of GnuPG, you may find that version installed
-under the name @command{gpg1}.
+If you are looking for version 1 of GnuPG, you may find that version
+installed under the name @command{gpg1}.
 @end ifclear
 @ifset gpgtwohack
-In contrast to the standalone command gpg from GnuPG 1.x, which
-might be better suited for server and embedded platforms, the 2.x
-version is commonly installed under the name @command{@gpgname} and
-targeted to the desktop as it requires several other modules to be
-installed.
+In contrast to the standalone command @command{gpg} from GnuPG 1.x,
+the 2.x version is commonly installed under the name
+ at command{@gpgname}.
 @end ifset
 
 @manpause
@@ -106,16 +109,18 @@ Developer information:
 @section Commands
 
 Commands are not distinguished from options except for the fact that
-only one command is allowed.
+only one command is allowed.  Generally speaking, irrelevant options
+are silently ignored, and may not be checked for correctness.
 
- at command{@gpgname} may be run with no commands, in which case it will
+ at command{@gpgname} may be run with no commands. In this case it will
 perform a reasonable action depending on the type of file it is given
 as input (an encrypted message is decrypted, a signature is verified,
-a file containing keys is listed).
+a file containing keys is listed, etc.).
 
-Please remember that option as well as command parsing stops as soon as
-a non-option is encountered, you can explicitly stop parsing by
-using the special option @option{--}.
+Please remember that option and command parsing stops as soon as a
+non-option is encountered.  Thus, options must precede the command.
+You can explicitly stop parsing by using the special option
+ at option{--}.
 
 
 @menu
@@ -140,7 +145,7 @@ cannot abbreviate this command.
 @item --help
 @itemx -h
 @opindex help
-Print a usage message summarizing the most useful command line options.
+Print a usage message summarizing the most useful command-line options.
 Note that you cannot abbreviate this command.
 
 @item --warranty
@@ -166,22 +171,22 @@ abbreviate this command.
 @item --sign
 @itemx -s
 @opindex sign
-Make a signature. This command may be combined with @option{--encrypt}
-(for a signed and encrypted message), @option{--symmetric} (for a
-signed and symmetrically encrypted message), or @option{--encrypt} and
- at option{--symmetric} together (for a signed message that may be
-decrypted via a secret key or a passphrase).  The key to be used for
-signing is chosen by default or can be set with the
+Sign a message. This command may be combined with @option{--encrypt}
+(to sign and encrypt a message), @option{--symmetric} (to sign and
+symmetrically encrypt a message), or both @option{--encrypt} and
+ at option{--symmetric} (to sign and encrypt a message that can be
+decrypted using a secret key or a passphrase).  The signing key is
+chosen by default or can be set explicitly using the
 @option{--local-user} and @option{--default-key} options.
 
 @item --clearsign
 @opindex clearsign
-Make a clear text signature.  The content in a clear text signature is
+Make a cleartext signature.  The content in a cleartext signature is
 readable without any special software. OpenPGP software is only needed
-to verify the signature.  Clear text signatures may modify end-of-line
+to verify the signature.  cleartext signatures may modify end-of-line
 whitespace for platform independence and are not intended to be
-reversible.  The key to be used for signing is chosen by default or
-can be set with the @option{--local-user} and @option{--default-key}
+reversible.  The signing key is chosen by default or can be set
+explicitly using the @option{--local-user} and @option{--default-key}
 options.
 
 
@@ -193,11 +198,11 @@ Make a detached signature.
 @item --encrypt
 @itemx -e
 @opindex encrypt
-Encrypt data. This command may be combined with @option{--sign} (for a
-signed and encrypted message), @option{--symmetric} (for a message that
-may be decrypted via a secret key or a passphrase), or @option{--sign}
-and @option{--symmetric} together (for a signed message that may be
-decrypted via a secret key or a passphrase).
+Encrypt data. This command may be combined with @option{--sign} (to
+sign and encrypt a message), @option{--symmetric} (to encrypt a
+message that can decrypted using a secret key or a passphrase), or
+ at option{--sign} and @option{--symmetric} together (for a signed
+message that can be decrypted using a secret key or a passphrase).
 
 @item --symmetric
 @itemx -c
@@ -223,32 +228,33 @@ is specified) and write it to STDOUT (or the file specified with
 @option{--output}). If the decrypted file is signed, the signature is also
 verified. This command differs from the default operation, as it never
 writes to the filename which is included in the file and it rejects
-files which don't begin with an encrypted message.
+files that don't begin with an encrypted message.
 
 @item --verify
 @opindex verify
 Assume that the first argument is a signed file and verify it without
 generating any output.  With no arguments, the signature packet is
-read from STDIN.  If only a one argument is given, it is expected to
-be a complete signature.
+read from STDIN.  If only one argument is given, the specified file is
+expected to include a complete signature.
 
-With more than 1 argument, the first should be a detached signature
-and the remaining files make up the the signed data. To read the signed
-data from STDIN, use @samp{-} as the second filename.  For security
-reasons a detached signature cannot read the signed material from
-STDIN without denoting it in the above way.
+With more than one argument, the first argument should specify a file
+with a detached signature and the remaining files should contain the
+signed data. To read the signed data from STDIN, use @samp{-} as the
+second filename.  For security reasons, a detached signature will not
+read the signed material from STDIN if not explicitly specified.
 
 Note: If the option @option{--batch} is not used, @command{@gpgname}
-may assume that a single argument is a file with a detached signature
+may assume that a single argument is a file with a detached signature,
 and it will try to find a matching data file by stripping certain
 suffixes.  Using this historical feature to verify a detached
-signature is strongly discouraged; always specify the data file too.
+signature is strongly discouraged; you should always specify the data file
+explicitly.
 
-Note: When verifying a cleartext signature, @command{gpg} verifies
+Note: When verifying a cleartext signature, @command{@gpgname} verifies
 only what makes up the cleartext signed data and not any extra data
-outside of the cleartext signature or header lines following directly
+outside of the cleartext signature or the header lines directly following
 the dash marker line.  The option @code{--output} may be used to write
-out the actual signed data; but there are other pitfalls with this
+out the actual signed data, but there are other pitfalls with this
 format as well.  It is suggested to avoid cleartext signatures in
 favor of detached signatures.
 
@@ -277,22 +283,23 @@ Identical to @option{--multifile --decrypt}.
 @itemx -k
 @itemx --list-public-keys
 @opindex list-keys
-List all keys from the public keyrings, or just the keys given on the
-command line.
+List the specified keys.  If no keys are specified, then all keys from
+the configured public keyrings are listed.
 
-Avoid using the output of this command in scripts or other programs as
-it is likely to change as GnuPG changes.  See @option{--with-colons}
-for a machine-parseable key listing command that is appropriate for
-use in scripts and other programs.  Never use the regular output for
-scripts --- it is only for human consumption.
+Never use the output of this command in scripts or other programs.
+The output is intended only for humans and its format is likely to
+change.  The @option{--with-colons} option emits the output in a
+stable, machine-parseable format, which is intended for use by scripts
+and other programs.
 
 @item --list-secret-keys
 @itemx -K
 @opindex list-secret-keys
-List all keys from the secret keyrings, or just the ones given on the
-command line. A @code{#} after the letters @code{sec} means that the
-secret key is not usable (for example, if it was created via
- at option{--export-secret-subkeys}).  See also @option{--list-keys}.
+List the specified secret keys.  If no keys are specified, then all
+known secret keys are listed.  A @code{#} after the letters @code{sec}
+means that the secret key is not usable (for example, if it was
+exported using @option{--export-secret-subkeys}).  See also
+ at option{--list-keys}.
 
 @item --list-sigs
 @opindex list-sigs
@@ -382,7 +389,7 @@ safeguard against accidental deletion of multiple keys.
 Remove key from the secret keyring. In batch mode the key must be
 specified by fingerprint.  The option @option{--yes} can be used to
 advice gpg-agent not to request a confirmation.  This extra
-pre-caution is done because @command{gpg} can't be sure that the
+pre-caution is done because @command{@gpgname} can't be sure that the
 secret key (as controlled by gpg-agent) is only used for the given
 OpenPGP public key.
 
@@ -408,7 +415,7 @@ Similar to @option{--export} but sends the keys to a keyserver.
 Fingerprints may be used instead of key IDs. Option @option{--keyserver}
 must be used to give the name of this keyserver. Don't send your
 complete keyring to a keyserver --- select only those keys which are new
-or changed by you.  If no key IDs are given, @command{gpg} does nothing.
+or changed by you.  If no key IDs are given, @command{@gpgname} does nothing.
 
 @item --export-secret-keys
 @itemx --export-secret-subkeys
@@ -417,21 +424,20 @@ or changed by you.  If no key IDs are given, @command{gpg} does nothing.
 Same as @option{--export}, but exports the secret keys instead.  The
 exported keys are written to STDOUT or to the file given with option
 @option{--output}.  This command is often used along with the option
- at option{--armor} to allow easy printing of the key for paper backup;
-however the external tool @command{paperkey} does a better job for
+ at option{--armor} to allow for easy printing of the key for paper backup;
+however the external tool @command{paperkey} does a better job of
 creating backups on paper.  Note that exporting a secret key can be a
 security risk if the exported keys are sent over an insecure channel.
 
 The second form of the command has the special property to render the
 secret part of the primary key useless; this is a GNU extension to
 OpenPGP and other implementations can not be expected to successfully
-import such a key.  Its intended use is to generated a full key with
-an additional signing subkey on a dedicated machine and then using
-this command to export the key without the primary key to the main
-machine.
+import such a key.  Its intended use is in generating a full key with
+an additional signing subkey on a dedicated machine.  This command
+then exports the key without the primary key to the main machine.
 
 GnuPG may ask you to enter the passphrase for the key.  This is
-required because the internal protection method of the secret key is
+required, because the internal protection method of the secret key is
 different from the one specified by the OpenPGP protocol.
 
 @item --export-ssh-key
@@ -2038,7 +2044,7 @@ limited countermeasure against traffic analysis. If this option or
 @opindex recipient-file
 This option is similar to @option{--recipient} except that it
 encrypts to a key stored in the given file.  @var{file} must be the
-name of a file containing exactly one key.  @command{gpg} assumes that
+name of a file containing exactly one key.  @command{@gpgname} assumes that
 the key in this file is fully valid.
 
 @item --hidden-recipient-file @var{file}
@@ -2046,7 +2052,7 @@ the key in this file is fully valid.
 @opindex hidden-recipient-file
 This option is similar to @option{--hidden-recipient} except that it
 encrypts to a key stored in the given file.  @var{file} must be the
-name of a file containing exactly one key.  @command{gpg} assumes that
+name of a file containing exactly one key.  @command{@gpgname} assumes that
 the key in this file is fully valid.
 
 @item --encrypt-to @code{name}
@@ -2754,7 +2760,7 @@ file @code{file}.
 @item --comment @code{string}
 @itemx --no-comments
 @opindex comment
-Use @code{string} as a comment string in clear text signatures and ASCII
+Use @code{string} as a comment string in cleartext signatures and ASCII
 armored messages or keys (see @option{--armor}). The default behavior is
 not to use a comment string. @option{--comment} may be repeated multiple
 times to get multiple comment strings. @option{--no-comments} removes
@@ -3245,7 +3251,7 @@ internally used by the @command{gpgconf} tool.
 @opindex gpgconf-test
 This is more or less dummy action.  However it parses the configuration
 file and returns with failure if the configuration file would prevent
- at command{gpg} from startup.  Thus it may be used to run a syntax check
+ at command{@gpgname} from startup.  Thus it may be used to run a syntax check
 on the configuration file.
 
 @end table
@@ -3453,7 +3459,7 @@ Operation is further controlled by a few environment variables:
 sign and encrypt for user Bob
 
 @item gpg --clearsign @code{file}
-make a clear text signature
+make a cleartext signature
 
 @item gpg -sb @code{file}
 make a detached signature
@@ -3704,7 +3710,7 @@ already been reported to our bug tracker at http://bugs.gnupg.org .
 @node Unattended Usage of GPG
 @section Unattended Usage
 
- at command{gpg} is often used as a backend engine by other software.  To help
+ at command{@gpgname} is often used as a backend engine by other software.  To help
 with this a machine interface has been defined to have an unambiguous
 way to do this.  The options @option{--status-fd} and @option{--batch}
 are almost always required for this.

commit 6102099985c1b82b6c0bba0464c1f913cc673e96
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 12:14:49 2016 +0100

    g10: Avoid a memory leak.
    
    * g10/gpg.c (main): Free KB when we're done with it.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/gpg.c b/g10/gpg.c
index 2deb27a..19a7a41 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4845,6 +4845,8 @@ main (int argc, char **argv)
 	      merge_keys_and_selfsig (kb);
 	      if (tofu_set_policy (ctrl, kb, policy))
 		g10_exit (1);
+
+              release_kbnode (kb);
 	    }
 
           tofu_end_batch_update (ctrl);

commit db6d8cfdc118131f497596ef1ffc121949377754
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 12:13:22 2016 +0100

    tests: Change (interactive-shell) to start an interactive shell
    
    * tests/gpgscm/tests.scm (interactive-shell): Start an interactive
    shell.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index 72afa99..1c170b0 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -492,4 +492,4 @@
 
 ;; Spawn an os shell.
 (define (interactive-shell)
-  (call-with-fds `(,(getenv "SHELL")) 0 1 2))
+  (call-with-fds `(,(getenv "SHELL") -i) 0 1 2))

commit 17c717d7c92d9a52101fea7e396fc133322a8786
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 12:05:45 2016 +0100

    tests: Check the signature count in the TOFU TFS record.
    
    * tests/openpgp/tofu.scm: Check the signature count in the TOFU TFS
    record.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index c433085..bc45d99 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -164,6 +164,62 @@
 (checkpolicy "1C005AF3" "bad")
 (checkpolicy "B662E42F" "ask")
 
+;; Check that the stats are emitted correctly.
+
+(display "Checking TOFU stats...\n")
+
+(define (check-counts keyid expected-sigs expected-encs . args)
+  (let*
+      ((tfs (assoc "tfs"
+                   (gpg-with-colons
+                    `(--trust-model=tofu --with-tofu-info
+                                         , at args --list-keys ,keyid))))
+       (sigs (string->number (list-ref tfs 3)))
+       (encs (string->number (list-ref tfs 4))))
+    (display tfs)
+    (unless (= sigs expected-sigs)
+            (error keyid ": # signatures (" sigs ") does not match expected"
+                   "# signatures (" expected-sigs ").\n"))
+    (unless (= encs expected-encs)
+            (error keyid ": # encryptions (" encs ") does not match expected"
+                   "# encryptions (" expected-encs ").\n"))
+    ))
+
+;; Carefully remove the TOFU db.
+(catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
+
+(check-counts "1C005AF3" 0 0)
+(check-counts "BE04EB2B" 0 0)
+(check-counts "B662E42F" 0 0)
+
+;; Verify a message.  The signature count should increase by 1.
+(call-check `(, at GPG --trust-model=tofu
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-1.txt")))
+(check-counts "1C005AF3" 1 0)
+
+;; Verify the same message.  The signature count should remain the
+;; same.
+(call-check `(, at GPG --trust-model=tofu
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-1.txt")))
+(check-counts "1C005AF3" 1 0)
+
+;; Verify another message.
+(call-check `(, at GPG --trust-model=tofu
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-2.txt")))
+(check-counts "1C005AF3" 2 0)
+
+;; Verify another message.
+(call-check `(, at GPG --trust-model=tofu
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-3.txt")))
+(check-counts "1C005AF3" 3 0)
+
+;; Verify a message from a different sender.  The signature count
+;; should increase by 1 for that key.
+(call-check `(, at GPG --trust-model=tofu
+		    --verify ,(in-srcdir "tofu/conflicting/BE04EB2B-1.txt")))
+(check-counts "1C005AF3" 3 0)
+(check-counts "BE04EB2B" 1 0)
+(check-counts "B662E42F" 0 0)
 
 
 ;; Check that we detect the following attack:

commit d5b18d6c55d65e8df2dd112651e3b9b3d9e6e27a
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 11:17:13 2016 +0100

    tests: Replace data used by the TOFU conflict test.
    
    * tests/openpgp/tofu-2183839A-1.txt: Remove file.
    * tests/openpgp/tofu-BC15C85A-1.txt: Remove file.
    * tests/openpgp/tofu-EE37CF96-1.txt: Remove file.
    * tests/openpgp/tofu-keys-secret.asc: Remove file.
    * tests/openpgp/tofu-keys.asc: Remove file.
    * tests/openpgp/tofu/conflicting/1C005AF3.gpg: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-1.txt: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-2.txt: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-3.txt: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-4.txt: New file.
    * tests/openpgp/tofu/conflicting/1C005AF3-5.txt: New file.
    * tests/openpgp/tofu/conflicting/B662E42F.gpg: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-secret.gpg: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-1.txt: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-2.txt: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-3.txt: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-4.txt: New file.
    * tests/openpgp/tofu/conflicting/B662E42F-5.txt: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B.gpg: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-1.txt: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-2.txt: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-3.txt: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-4.txt: New file.
    * tests/openpgp/tofu/conflicting/BE04EB2B-5.txt: New file.
    * tests/openpgp/tofu/conflicting/README: New file.
    * tests/openpgp/tofu.scm: Update accordingly.
    
    --
    Signed-off-by: Neal H. Walfield <neal at g10code.com>
    
    There are two motivations for this change.  First, we decided that
    test data should live in a subdirectory rather than in tests/openpgp.
    Second, secret key material is password protected, and I don't
    remember the password that I used.  (The new data is not password
    protected.)  I have also added some new examples of signed messages.

diff --git a/tests/openpgp/tofu-2183839A-1.txt b/tests/openpgp/tofu-2183839A-1.txt
deleted file mode 100644
index 521b3bb..0000000
Binary files a/tests/openpgp/tofu-2183839A-1.txt and /dev/null differ
diff --git a/tests/openpgp/tofu-BC15C85A-1.txt b/tests/openpgp/tofu-BC15C85A-1.txt
deleted file mode 100644
index 88cc649..0000000
--- a/tests/openpgp/tofu-BC15C85A-1.txt
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PGP MESSAGE-----
-Version: GnuPG v2
-
-owGbwMvMwMF46tzNaXtET0QxnmZPYgj9/c+Sq2MOCwMjBwMbKxOIy8DFKQBTo/SK
-hWFThVuj19r3R/6VzQkpaZuQx7s3r9BQ46v8KXkjb58dSjmXyr7enlCzb7dg1zE7
-aynbc6YTF+wXZI4IlAgPuLJhUeSXo0+WllxbFXUz39407cv15TcXThLj+3tFkSnZ
-YFXwM9+nfAoHpt6I/ZY96SJT3XFZKzO1jeZNJhZsV4Vfrjp0UmnH3E4A
-=X9WM
------END PGP MESSAGE-----
diff --git a/tests/openpgp/tofu-EE37CF96-1.txt b/tests/openpgp/tofu-EE37CF96-1.txt
deleted file mode 100644
index 33a38db..0000000
--- a/tests/openpgp/tofu-EE37CF96-1.txt
+++ /dev/null
@@ -1,9 +0,0 @@
------BEGIN PGP MESSAGE-----
-Version: GnuPG v2
-
-owGbwMvMwMEY0Tqz9J35+WmMp9mTGEJ//xPk6pjDwsDIwcDGygTiMnBxCsDULFZm
-/sk4S36iQ6FuZZPMPdOSe/rZOxNThTmzvJN4l1qe9XGdlLhtpumfzh0uhRnzT2Xc
-jmra+ZdN9+XBhml//i7v6XrfuWu56OuEI/fXH0i3P5HELb+j++6SO85VemLq/tvO
-hNvWtddvuZ7+z2JJaqnP4wiu2t+sEze/MWKZ9zz+u2FV6a3OIyJxjwA=
-=JMtb
------END PGP MESSAGE-----
diff --git a/tests/openpgp/tofu-keys-secret.asc b/tests/openpgp/tofu-keys-secret.asc
deleted file mode 100755
index 68e0d20..0000000
--- a/tests/openpgp/tofu-keys-secret.asc
+++ /dev/null
@@ -1,95 +0,0 @@
------BEGIN PGP PRIVATE KEY BLOCK-----
-Version: GnuPG v2
-
-lgAAAgYEVfv86AEEAN20yizZgtnQaJPUV++9Z+rRg4XzjWpLvmiWMpTsn8qhjpyS
-kAa4/4P4/MRWVvSXiRC1uJ7T59Sbm/KFs8TdKaqIMuON3QYjztxm2NmDMA/f5FTv
-RuLkgKAEpwGOqI1Zvm3uleH8hkx0n45tHxCI3bLCfW+12lZxJCGNDBnhvj+5ABEB
-AAH+BwMCeYHLsHWjaoTufvOw6/xINpFQV8JcwSc+RaEIfmIwEwO242+vUEZefkia
-yMMJTd20C144zMr/3Tsx/+c8ULAbR/NBtuG49jsGWFJH2uN/5pi40x2S/afJuwru
-0co5xQSnpZtM4v9mvFM517IROhHY1pl6KpK87pZm5JHGB4525DpAYJ7vTTmHE2NW
-e5jr7a7SpXwTU7dKHbLxY+kofH7DLvMX6KjOJ/kDLIqnK3AeCwfhXkkRRP8UI/0J
-pZEPUyImag6FryRdoZJPTPX7TMWM4zrdnT6xOffIe1REpo59LVkvg6TiPtnlnuY8
-Y9NVZ+mWz0RHtxFh1b70G6D5C5Mdi/iGUAAfTwNhjdnmYsN1qKxcO533qlj/rXHn
-6uxauiR4d+7Ioy2RsPpY2FqTkgymhBLn6ZcYvzwEXaAygLUs8HmzPuiVm5Ls5UXn
-VKaRMc+DBQPz3W3CuMWsHAyKsg4ibp/6MSf0klYHUG8WVXI4tLGOkbg5HbQTVGVz
-dGluZyAoaW5zZWN1cmUhKYi9BBMBCAAnBQJV+/zoAhsDBQkB4TOABQsJCAcCBhUI
-CQoLAgQWAgMBAh4BAheAAAoJEFiFmXXuN8+WqPYEAIW+qAoFnc2emFnx/b+vKW9X
-1g3NLmsLyUUBI34GCh+sGa6C0SptdKc68uvKUc6daBiHuoukN4F+1rYUuNG8WNMs
-V/JwGPKVADPIFrgGiotMW770ZnzZsoqGWvwUnyrlaUI6AYHe4Uj9YAmnmi647A/u
-UxcI1H20M3dENSUyiS1zngAAAgUEVfv86AEEAMgaJrwhFOhEmHHgqyzx2KFzG4SD
-F6jyAg1CIVKmiLSBfNXWa43vJwfxLo7vbT1wy0iiJF8+ALD/ghppmZb9NpsiUC+X
-xT4ublOSvRgN+527WdUX8ym0EXxjpuSSW+hVZZwUP0K0fBdIVaVCawJGEp5Lc/mX
-KnjmXvLQxWSQYgB9ABEBAAH+BwMCtE0VqaVadDju5hPxFcvSTjNkKwGVZZgQBWVZ
-sYj/Sd/Pbc90xb3TSf/VQGVQhKei+GBmUPYOPqStOP30pJvK0SBxkJ2BYb876RJC
-lj48lkTGFPZwhw69BZq6QA5nfBm41V+W6iakdyEww6g1Q93AyzuAirBJraR+oQ6Q
-beqo52TtYAhpAQbUBsQ/1VO/1zx8eHOG298kYpU2Jo7Te81d03rWcSaDbJqcEmsI
-jJe1ccvQ8oU+k6ttbY3xTiKYWfJCxEaOcYpO4z1/94CPFYv1D5rJqJ/C0/SPmS4t
-4ZMqenEhsAGhMgPLKXNmQadQA2WBOATsSxmKCcC9LNjw1YudXPiLfHEnBKGQSbRF
-sZ2xZqRm7wRTQ/eXAJGGiQ41owstwSUAcFTGIhHunw9dy41CdgnZIEQCxb7R8tBv
-isRlG0cIpO5159LB3NECR4++xBB02nq6lOjysKDmYuWYuQakD1u9L6R+LQBVTxYL
-/iEK8wyf18n/iKUEGAEIAA8FAlX7/OgCGwwFCQHhM4AACgkQWIWZde43z5ZTvAP9
-EWGZu97aZhjIbD18Y2HjbXQn4L6iyeDMuM++Tsnnn57li+HLUAX8ieRHy1l/VE3t
-HhdcqRqAsrxnkGAWKMlYYZS9WHDzrffxtQlszOwpAOWdNDsWsPdbko95XvLatoqk
-t9KxB19sLao6eCBKwB9muMs10i86P+Cehwh97n/UNGOWAAACBgRV+/07AQQAxCWd
-rsUW2IhexMxOvMi32Z63bOEC5JkEy8tntGYwk54I2XGXRebdutMrXqh0nKO7p23k
-gfWjRp1dpbSp20AzdIkwsRlAjOuqhZ3Q6t+kP6xWtxAQI8YZ6lQ0VeZC0dTBllr3
-UlY4tw0emLcScNsGuDVUPYhQoJBMkk4oNw+wWfUAEQEAAf4HAwJNRwdntiqzHO76
-GxxlNilWuwitCGbGwZfmo8K8m2uAMzSKsxUp16rcLVvfQsEzS6rDhF4VbJQyLvZJ
-LDkXB0/DFbPVrxG8byJ2i6WKUzsqcevM29OXOmFfH1NVuVi5oUWbwCR6ctsNQSL7
-Bje0E6+6pme9YQtKgUIBzc2Dw+nq6WjfLc0aEc+rrXzWsJKEUKkjnaUa/AeAVYyO
-rTOk5fLrw6vy/sKsuScvLNvQUrr7U+g69gpk53Cyw2WILlADxbysg2CDMDsDmXk/
-sK6zikAgDjQTRaOJkX4BzCBoqZRaDbLMfze6kA6cwQqDTsUELy1ziH56FjRXuBqj
-D4IziA0/XE8gyMRtoMYXmF0pKBQh0RLoudorcPQE9PCFvKaXmASA80nMeBoYxlIm
-kPMBkkkwiXU4irc1m8phlcrZjYE12pxzWgSYBEwTbbzNe2EcFKf+H1vp9DXqZSua
-wLdiUx6JrSHGzoPl3XFAQXNFoOEGvlFN9nH+tBNUZXN0aW5nIChpbnNlY3VyZSEp
-iL0EEwEIACcFAlX7/TsCGwMFCQHhM4AFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AA
-CgkQys7ZlrwVyFq0NgP/cazey0+qJrTaQ0Z6eab1p8PMFE8BpcegrokxfJn61zo7
-JECjQW+htoOBBIQH32mtqjO/J/SbiBDp3xNcdabCnkphW4jkcgn+FoUbLA3GFk9f
-xtElNDGXHcQNimvhhxfrEr2Mi1yo2rKShiIO0N2yySXCJJIC9CXpDCAIhNdEYeCe
-AAACBQRV+/07AQQA3BJN5N1RI6uesA03xwTW1ABTV4tbjLROKLlTPbxb+TjWQAfQ
-lztbSavzjTO6wPPmHnGv2sXPiH2guET+thKAw1WchItKx+MiT8nnsBJHl950mqI8
-uTHGljkQBuKARVl1ELS3do6CQvGyG+5qHyl3crpED152Q5C/F53b4EfgNXEAEQEA
-Af4HAwL449o07unvl+6XONg4R9pVE0Qp0xCL5CmjhwlL8lUuGTvjciN+lXD6k7VH
-Xj9Wu86alkKZQKyZxESPtsRR5dGWgrvhmUrvPftRmO4PV7A5AS0yi54CQGaWSnOL
-nqVkENUs85Pq1LLfnM8MRIdGpS9225bwsAoB/eJk7zKNRGOUlzCDGW3f12aemyrR
-2RHGVPOvn6SVb8r8RkqCDMApR0j76cTMDiMyaGByi93y8qhXiu88Y+J/+fK5wQis
-FwPJGZVCqNTiglclgrNG4+z8G4SUvkA6W5yDiZyftN67TXqxJKKBXFS5gzWujPti
-boDzivsY9sP4Mkoc94TAmJeaLtNrqHy4UMo/m9YBmuP4hRJ7TCKmvVN4hZCN2mvJ
-4S1vi4Z9GnyxJAbxq9Gb1UA9glVAVt6bQVYO6ySIp4W29xFnoRUm4i0tCovWBn9x
-MWSkG5SLznbh2tKLN0uJGzh4G8xo2fdfx6tWy2x0gw95T5WDg7S2oe6IpQQYAQgA
-DwUCVfv9OwIbDAUJAeEzgAAKCRDKztmWvBXIWqexA/9nZUXs9BGcwpodhqjGY+H9
-/IUJua95jti9t0BleEu+h0R9O+XDEE/77IK9ET4f0t9WMfMhPO7ZIgUxFutB/Z7U
-MuyVteIvGxF/TTbQAKuCrnLYuPWkGiYjR9e0ZDbgmKrRZ/jwhdaxF0IHrR1PJLUn
-vO97qfZC7097/urCsWDMo5YAAAIGBFX8ElYBBACfcdcAcR6BJ2Ba3/HnQR1S0rG3
-8bWq8Rdtt072hDd16oQCNFpQs5WQNruCCpobmB6yOmjKJv8Cf9mxBdcQDxobcw6M
-lHPWZl04SoQKQOa5h6ptITxr+UFFFqfh7AZ7ZtDYaFfBqQX9fvdOX99C18SIcCcN
-0rHoxXfG7D/AaHEysQARAQAB/gcDAj0P/+idN7Q87sZYs1aBo3OqKKdl+a51tcgd
-80HdoEQWyIwOStl9+XleUHyrU5f9kni1I2NCrl+hLyPGaT8dGJinH103fgsGvY/L
-Z2lg5gsPdfb5U5Kyn8MfgAuAEVh0XiLOAVZf4tVjcn3jGW9VM/cDHQI9uwz0MtN0
-xxj1iw151/ydtFt4Qw+Ljh0cwBauiHSaG8rhfObJGbKpXNBJG6QfaGBlOAErO1my
-fr7UgWbul6xCZe/t7Um2rp5GxTJsN+AwDDLqSbwCzmArXRJiEnL5qaw891HuXTIC
-+lxtGNxP6bqe+4Bg/T+MIjJVWzx9avGR2WweSKBqbsyRkmZQCIkWDmp/g9t17ujo
-RrzNUT60Y0gMhJOQxZcgdXJtlT/X0RvP+tGAiVEAlvpQ+9RTzqvf4sZAPndpE4PY
-dKXJF5Pua9cWU+UceQV/Nr+JAlLzNWOlwSOJUVGsQ+RzeFJyB2D5xoG6tRI9idYU
-V+vcNGRpJzsXO6S0E1Rlc3RpbmcgKGluc2VjdXJlISmIvQQTAQgAJwUCVfwSVgIb
-AwUJAeEzgAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRA8WpFfIYODmknrA/96
-90yhjN3ELmWSJetKzvt7MlUS0j6UkA5VvDObCmAm+bDrQSGdwDJj6gu88b4biNEx
-Cz/Dmo67R9Z+gLE6LGvzYCPZ+GE/ZQ9VMo/AeUEZO44Aa7vRwnYFU0VmMJUeGQbC
-Je4JnLjF/+0yIgh/CtwFL3J/+9eayf6e6L/9WhUZ5J4AAAIGBFX8ElYBBADXznv8
-7J5i/EN8dMtjzx99LXtJdSJ3iJfp69d5V1FygvsDSlMZVekflWKF2ipHRulxLXea
-8mH0salQviQ32qPAyfCWpELLL2srTVezj6ntKVF9hZruQ2d1KBVV+syq6nSY9Eg8
-0mHizvIV5cR2b2X/X6qybJrwhW10oWh+cuLg6QARAQAB/gcDAkwZfkpx6rGW7qkb
-iuwl3c6d1o2x9HeiZG8fZ8UGU5n0Nx4bp4a60j/d+bJowww8sPRcJ+8mi/dNi9dC
-1Dls2CmmOP8U2DsPT189d+JiqlXUumhRyTo5ptglMrHkrMp489QpyCIUhW6HVopI
-ppdOJGE0kTJ7pRx0fevz3la5553IyglJ9iUqgxz2+9XlvDhSplz8zVhyZd5UPW94
-hi+vHCDf3TSakMFFZEVPCQaMunB7urI1wXx/mOT5BTSOp1PVq4SE5TtC2/GrHBU6
-/5wuqyhlT3oH+jF/GfvZQgattnkaFn/JY77/mfTCzyQb1/2iQMO8uTe8KjWAKd5h
-AoCcgxoX0rqSxe7YS2Obl1v0icWbg4wvI8WUAv5pRL7EMVcuUugrb40rWzOiJzYY
-IwEmO+tp08Ev+arbjEMzk+IXLTr3wDip/2oHHU3P2OSi46iLdueUvVnnNXff0H4e
-mqT2zlJQoPCbYMaKxL0yxvFnZLfCWolLOJaIpQQYAQgADwUCVfwSVgIbDAUJAeEz
-gAAKCRA8WpFfIYODmqzxBACNLC9j2EJvoiKhRMAUJTGCQvDWNWAI/2Ln/61Ftqu5
-+OoOI0N7uL1LjWNHrhS/PMKwcIu9iZn/uQV/OGj9YuKw58WeyKkTIEnD7bU5aUQk
-8jdRITPnr/InyHvs21P9hh18MZvDk9L9rL+uwK+9BkeL0MDL3wlAG57Fay9OXgY1
-CQ==
-=2SlE
------END PGP PRIVATE KEY BLOCK-----
diff --git a/tests/openpgp/tofu-keys.asc b/tests/openpgp/tofu-keys.asc
deleted file mode 100755
index 2de1cf7..0000000
--- a/tests/openpgp/tofu-keys.asc
+++ /dev/null
@@ -1,47 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
-
-mI0EVfv86AEEAN20yizZgtnQaJPUV++9Z+rRg4XzjWpLvmiWMpTsn8qhjpySkAa4
-/4P4/MRWVvSXiRC1uJ7T59Sbm/KFs8TdKaqIMuON3QYjztxm2NmDMA/f5FTvRuLk
-gKAEpwGOqI1Zvm3uleH8hkx0n45tHxCI3bLCfW+12lZxJCGNDBnhvj+5ABEBAAG0
-E1Rlc3RpbmcgKGluc2VjdXJlISmIvQQTAQgAJwUCVfv86AIbAwUJAeEzgAULCQgH
-AgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBYhZl17jfPlqj2BACFvqgKBZ3NnphZ8f2/
-rylvV9YNzS5rC8lFASN+BgofrBmugtEqbXSnOvLrylHOnWgYh7qLpDeBfta2FLjR
-vFjTLFfycBjylQAzyBa4BoqLTFu+9GZ82bKKhlr8FJ8q5WlCOgGB3uFI/WAJp5ou
-uOwP7lMXCNR9tDN3RDUlMoktc7iNBFX7/OgBBADIGia8IRToRJhx4Kss8dihcxuE
-gxeo8gINQiFSpoi0gXzV1muN7ycH8S6O7209cMtIoiRfPgCw/4IaaZmW/TabIlAv
-l8U+Lm5Tkr0YDfudu1nVF/MptBF8Y6bkklvoVWWcFD9CtHwXSFWlQmsCRhKeS3P5
-lyp45l7y0MVkkGIAfQARAQABiKUEGAEIAA8FAlX7/OgCGwwFCQHhM4AACgkQWIWZ
-de43z5ZTvAP9EWGZu97aZhjIbD18Y2HjbXQn4L6iyeDMuM++Tsnnn57li+HLUAX8
-ieRHy1l/VE3tHhdcqRqAsrxnkGAWKMlYYZS9WHDzrffxtQlszOwpAOWdNDsWsPdb
-ko95XvLatoqkt9KxB19sLao6eCBKwB9muMs10i86P+Cehwh97n/UNGOYjQRV+/07
-AQQAxCWdrsUW2IhexMxOvMi32Z63bOEC5JkEy8tntGYwk54I2XGXRebdutMrXqh0
-nKO7p23kgfWjRp1dpbSp20AzdIkwsRlAjOuqhZ3Q6t+kP6xWtxAQI8YZ6lQ0VeZC
-0dTBllr3UlY4tw0emLcScNsGuDVUPYhQoJBMkk4oNw+wWfUAEQEAAbQTVGVzdGlu
-ZyAoaW5zZWN1cmUhKYi9BBMBCAAnBQJV+/07AhsDBQkB4TOABQsJCAcCBhUICQoL
-AgQWAgMBAh4BAheAAAoJEMrO2Za8FchatDYD/3Gs3stPqia02kNGenmm9afDzBRP
-AaXHoK6JMXyZ+tc6OyRAo0FvobaDgQSEB99praozvyf0m4gQ6d8TXHWmwp5KYVuI
-5HIJ/haFGywNxhZPX8bRJTQxlx3EDYpr4YcX6xK9jItcqNqykoYiDtDdssklwiSS
-AvQl6QwgCITXRGHguI0EVfv9OwEEANwSTeTdUSOrnrANN8cE1tQAU1eLW4y0Tii5
-Uz28W/k41kAH0Jc7W0mr840zusDz5h5xr9rFz4h9oLhE/rYSgMNVnISLSsfjIk/J
-57ASR5fedJqiPLkxxpY5EAbigEVZdRC0t3aOgkLxshvuah8pd3K6RA9edkOQvxed
-2+BH4DVxABEBAAGIpQQYAQgADwUCVfv9OwIbDAUJAeEzgAAKCRDKztmWvBXIWqex
-A/9nZUXs9BGcwpodhqjGY+H9/IUJua95jti9t0BleEu+h0R9O+XDEE/77IK9ET4f
-0t9WMfMhPO7ZIgUxFutB/Z7UMuyVteIvGxF/TTbQAKuCrnLYuPWkGiYjR9e0ZDbg
-mKrRZ/jwhdaxF0IHrR1PJLUnvO97qfZC7097/urCsWDMo5iNBFX8ElYBBACfcdcA
-cR6BJ2Ba3/HnQR1S0rG38bWq8Rdtt072hDd16oQCNFpQs5WQNruCCpobmB6yOmjK
-Jv8Cf9mxBdcQDxobcw6MlHPWZl04SoQKQOa5h6ptITxr+UFFFqfh7AZ7ZtDYaFfB
-qQX9fvdOX99C18SIcCcN0rHoxXfG7D/AaHEysQARAQABtBNUZXN0aW5nIChpbnNl
-Y3VyZSEpiL0EEwEIACcFAlX8ElYCGwMFCQHhM4AFCwkIBwIGFQgJCgsCBBYCAwEC
-HgECF4AACgkQPFqRXyGDg5pJ6wP/evdMoYzdxC5lkiXrSs77ezJVEtI+lJAOVbwz
-mwpgJvmw60EhncAyY+oLvPG+G4jRMQs/w5qOu0fWfoCxOixr82Aj2fhhP2UPVTKP
-wHlBGTuOAGu70cJ2BVNFZjCVHhkGwiXuCZy4xf/tMiIIfwrcBS9yf/vXmsn+nui/
-/VoVGeS4jQRV/BJWAQQA1857/OyeYvxDfHTLY88ffS17SXUid4iX6evXeVdRcoL7
-A0pTGVXpH5VihdoqR0bpcS13mvJh9LGpUL4kN9qjwMnwlqRCyy9rK01Xs4+p7SlR
-fYWa7kNndSgVVfrMqup0mPRIPNJh4s7yFeXEdm9l/1+qsmya8IVtdKFofnLi4OkA
-EQEAAYilBBgBCAAPBQJV/BJWAhsMBQkB4TOAAAoJEDxakV8hg4OarPEEAI0sL2PY
-Qm+iIqFEwBQlMYJC8NY1YAj/Yuf/rUW2q7n46g4jQ3u4vUuNY0euFL88wrBwi72J
-mf+5BX84aP1i4rDnxZ7IqRMgScPttTlpRCTyN1EhM+ev8ifIe+zbU/2GHXwxm8OT
-0v2sv67Ar70GR4vQwMvfCUAbnsVrL05eBjUJ
-=Btw1
------END PGP PUBLIC KEY BLOCK-----
diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index e1fa001..c433085 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -22,7 +22,7 @@
 
 ;; Redefine GPG without --always-trust and a fixed time.
 (define GPG `(,(tool 'gpg) --no-permission-warning
-	      --faked-system-time=1466684990))
+	      --faked-system-time=1480943782))
 (define GNUPGHOME (getenv "GNUPGHOME"))
 (if (string=? "" GNUPGHOME)
     (error "GNUPGHOME not set"))
@@ -30,13 +30,13 @@
 (catch (skip "Tofu not supported")
        (call-check `(, at GPG --trust-model=tofu --list-config)))
 
-(define KEYS '("2183839A" "BC15C85A" "EE37CF96"))
+(define KEYS '("1C005AF3" "BE04EB2B" "B662E42F"))
 
 ;; Import the test keys.
-(call-check `(, at GPG --import ,(in-srcdir "tofu-keys.asc")))
-
-;; Make sure the keys are imported.
 (for-each (lambda (keyid)
+            (call-check `(, at GPG --import
+                                ,(in-srcdir "tofu/conflicting/"
+                                            (string-append keyid ".gpg"))))
 	    (catch (error "Missing key" keyid)
 		   (call-check `(, at GPG --list-keys ,keyid))))
 	  KEYS)
@@ -104,18 +104,18 @@
 ;; Verify a message.  There should be no conflict and the trust
 ;; policy should be set to auto.
 (call-check `(, at GPG --trust-model=tofu
-		    --verify ,(in-srcdir "tofu-2183839A-1.txt")))
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-1.txt")))
 
-(checkpolicy "2183839A" "auto")
+(checkpolicy "1C005AF3" "auto")
 ;; Check default trust.
-(checktrust "2183839A" "m")
+(checktrust "1C005AF3" "m")
 
 ;; Trust should be derived lazily.  Thus, if the policy is set to
 ;; auto and we change --tofu-default-policy, then the trust should
 ;; change as well.  Try it.
-(checktrust "2183839A" "f" '--tofu-default-policy=good)
-(checktrust "2183839A" "-" '--tofu-default-policy=unknown)
-(checktrust "2183839A" "n" '--tofu-default-policy=bad)
+(checktrust "1C005AF3" "f" '--tofu-default-policy=good)
+(checktrust "1C005AF3" "-" '--tofu-default-policy=unknown)
+(checktrust "1C005AF3" "n" '--tofu-default-policy=bad)
 
 ;; Change the policy to something other than auto and make sure the
 ;; policy and the trust are correct.
@@ -127,42 +127,42 @@
 	   ((string=? "good" policy) "f")
 	   ((string=? "unknown" policy) "-")
 	   (else "n"))))
-     (setpolicy "2183839A" policy)
+     (setpolicy "1C005AF3" policy)
 
      ;; Since we have a fixed policy, the trust level shouldn't
      ;; change if we change the default policy.
      (for-each-p
       ""
       (lambda (default-policy)
-	(checkpolicy "2183839A" policy
+	(checkpolicy "1C005AF3" policy
 		     '--tofu-default-policy default-policy)
-	(checktrust "2183839A" expected-trust
+	(checktrust "1C005AF3" expected-trust
 		    '--tofu-default-policy default-policy))
       '("auto" "good" "unknown" "bad" "ask"))))
  '("good" "unknown" "bad"))
 
-;; At the end, 2183839A's policy should be bad.
-(checkpolicy "2183839A" "bad")
+;; At the end, 1C005AF3's policy should be bad.
+(checkpolicy "1C005AF3" "bad")
 
-;; BC15C85A and 2183839A conflict.  A policy setting of "auto"
-;; (BC15C85A's state) will result in an effective policy of ask.  But,
+;; 1C005AF3 and BE04EB2B conflict.  A policy setting of "auto"
+;; (BE04EB2B's state) will result in an effective policy of ask.  But,
 ;; a policy setting of "bad" will result in an effective policy of
 ;; bad.
-(setpolicy "BC15C85A" "auto")
-(checkpolicy "BC15C85A" "ask")
-(checkpolicy "2183839A" "bad")
-
-;; EE37CF96, 2183839A, and BC15C85A conflict.  We change BC15C85A's
-;; policy to auto and leave 2183839A's policy at bad.  This conflict
-;; should cause BC15C85A's policy to be changed to ask (since it is
-;; auto), but not affect 2183839A's policy.
-(setpolicy "BC15C85A" "auto")
-(checkpolicy "BC15C85A" "ask")
+(setpolicy "BE04EB2B" "auto")
+(checkpolicy "BE04EB2B" "ask")
+(checkpolicy "1C005AF3" "bad")
+
+;; 1C005AF3, B662E42F, and BE04EB2B conflict.  We change BE04EB2B's
+;; policy to auto and leave 1C005AF3's policy at bad.  This conflict
+;; should cause BE04EB2B's effective policy to be ask (since it is
+;; auto), but not affect 1C005AF3's policy.
+(setpolicy "BE04EB2B" "auto")
+(checkpolicy "BE04EB2B" "ask")
 (call-check `(, at GPG --trust-model=tofu
-		    --verify ,(in-srcdir "tofu-EE37CF96-1.txt")))
-(checkpolicy "BC15C85A" "ask")
-(checkpolicy "2183839A" "bad")
-(checkpolicy "EE37CF96" "ask")
+		    --verify ,(in-srcdir "tofu/conflicting/B662E42F-1.txt")))
+(checkpolicy "BE04EB2B" "ask")
+(checkpolicy "1C005AF3" "bad")
+(checkpolicy "B662E42F" "ask")
 
 
 
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-1.txt b/tests/openpgp/tofu/conflicting/1C005AF3-1.txt
new file mode 100644
index 0000000..dba581d
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-1.txt differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-2.txt b/tests/openpgp/tofu/conflicting/1C005AF3-2.txt
new file mode 100644
index 0000000..fde9fb8
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-2.txt differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-3.txt b/tests/openpgp/tofu/conflicting/1C005AF3-3.txt
new file mode 100644
index 0000000..e6aa4ac
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-3.txt differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-4.txt b/tests/openpgp/tofu/conflicting/1C005AF3-4.txt
new file mode 100644
index 0000000..6a14891
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-4.txt differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-5.txt b/tests/openpgp/tofu/conflicting/1C005AF3-5.txt
new file mode 100644
index 0000000..12fb5fb
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-5.txt differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg b/tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg
new file mode 100644
index 0000000..5f1e78a
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/1C005AF3.gpg b/tests/openpgp/tofu/conflicting/1C005AF3.gpg
new file mode 100644
index 0000000..7a75011
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/1C005AF3.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-1.txt b/tests/openpgp/tofu/conflicting/B662E42F-1.txt
new file mode 100644
index 0000000..c39056c
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F-1.txt differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-2.txt b/tests/openpgp/tofu/conflicting/B662E42F-2.txt
new file mode 100644
index 0000000..a96ef9f
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F-2.txt differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-3.txt b/tests/openpgp/tofu/conflicting/B662E42F-3.txt
new file mode 100644
index 0000000..2e6e81b
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F-3.txt differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-4.txt b/tests/openpgp/tofu/conflicting/B662E42F-4.txt
new file mode 100644
index 0000000..470882f
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F-4.txt differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-5.txt b/tests/openpgp/tofu/conflicting/B662E42F-5.txt
new file mode 100644
index 0000000..21d54bc
--- /dev/null
+++ b/tests/openpgp/tofu/conflicting/B662E42F-5.txt
@@ -0,0 +1 @@
+?
???????%??[?}??I?i??\???,??b?,?&?k?h???????)ee?c????h&q0l?;S????`??K??>??}i???w???5?V??F+'	|]?$?/??j?m???J???TjY?????<???i??6%?|????a??GVkg?4e??<ak????B? U?o?ff??Z<????U[??h??Je???n??????????????
f~?[?dm"v???P3}=????}?#"?^????j-????T?????+/q?=?&??>???????????%??k?z??N???l?????????:??????7z?????\o??s??J?s1????

\ No newline at end of file
diff --git a/tests/openpgp/tofu/conflicting/B662E42F-secret.gpg b/tests/openpgp/tofu/conflicting/B662E42F-secret.gpg
new file mode 100644
index 0000000..7362ded
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F-secret.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/B662E42F.gpg b/tests/openpgp/tofu/conflicting/B662E42F.gpg
new file mode 100644
index 0000000..6c07520
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/B662E42F.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-1.txt b/tests/openpgp/tofu/conflicting/BE04EB2B-1.txt
new file mode 100644
index 0000000..1b3de47
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-1.txt differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-2.txt b/tests/openpgp/tofu/conflicting/BE04EB2B-2.txt
new file mode 100644
index 0000000..f4f5487
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-2.txt differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-3.txt b/tests/openpgp/tofu/conflicting/BE04EB2B-3.txt
new file mode 100644
index 0000000..7451073
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-3.txt differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-4.txt b/tests/openpgp/tofu/conflicting/BE04EB2B-4.txt
new file mode 100644
index 0000000..f15496d
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-4.txt differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-5.txt b/tests/openpgp/tofu/conflicting/BE04EB2B-5.txt
new file mode 100644
index 0000000..39078f1
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-5.txt differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg b/tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg
new file mode 100644
index 0000000..5d393aa
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/BE04EB2B.gpg b/tests/openpgp/tofu/conflicting/BE04EB2B.gpg
new file mode 100644
index 0000000..787b238
Binary files /dev/null and b/tests/openpgp/tofu/conflicting/BE04EB2B.gpg differ
diff --git a/tests/openpgp/tofu/conflicting/README b/tests/openpgp/tofu/conflicting/README
new file mode 100644
index 0000000..e2c48f2
--- /dev/null
+++ b/tests/openpgp/tofu/conflicting/README
@@ -0,0 +1,8 @@
+This directory contains three keys (1C005AF3, B662E42F, and BE04EB2B),
+which all have the same user id, namely "Joke Factory
+<joke.factory at example.com>".
+
+The keys are stored in KEYID.gpg.  The secret key material is stored
+in KEYID-secret.gpg (the secret key material is not password
+protected).  The files KEYID-N.txt contain messages, which are signed
+by KEYID.  The message is "N\n".

commit bd9ebe1404c1395edd0e029023a9e780c90f6d73
Author: Neal H. Walfield <neal at g10code.com>
Date:   Fri Dec 2 11:42:38 2016 +0100

    g10: Remove dead code.
    
    * g10/tofu.c (tofu_set_policy_by_keyid): Remove function.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index 18f9c54..5b3e84c 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -3760,23 +3760,6 @@ tofu_set_policy (ctrl_t ctrl, kbnode_t kb, enum tofu_policy policy)
   return err;
 }
 
-/* Set the TOFU policy for all non-revoked user ids in the KEY with
-   the key id KEYID to POLICY.
-
-   If no key is available with the specified key id, then this
-   function returns GPG_ERR_NO_PUBKEY.
-
-   Returns 0 on success and an error code otherwise.  */
-gpg_error_t
-tofu_set_policy_by_keyid (ctrl_t ctrl, u32 *keyid, enum tofu_policy policy)
-{
-  kbnode_t keyblock = get_pubkeyblock (keyid);
-  if (! keyblock)
-    return gpg_error (GPG_ERR_NO_PUBKEY);
-
-  return tofu_set_policy (ctrl, keyblock, policy);
-}
-
 /* Return the TOFU policy for the specified binding in *POLICY.  If no
    policy has been set for the binding, sets *POLICY to
    TOFU_POLICY_NONE.
diff --git a/g10/tofu.h b/g10/tofu.h
index 3ee2f41..7b1beea 100644
--- a/g10/tofu.h
+++ b/g10/tofu.h
@@ -120,11 +120,6 @@ int tofu_get_validity (ctrl_t ctrl,
    POLICY.  */
 gpg_error_t tofu_set_policy (ctrl_t ctrl, kbnode_t kb, enum tofu_policy policy);
 
-/* Set the TOFU policy for all non-revoked users in the key with the
-   key id KEYID to POLICY.  */
-gpg_error_t tofu_set_policy_by_keyid (ctrl_t ctrl,
-                                      u32 *keyid, enum tofu_policy policy);
-
 /* Return the TOFU policy for the specified binding in *POLICY.  */
 gpg_error_t tofu_get_policy (ctrl_t ctrl,
                              PKT_public_key *pk, PKT_user_id *user_id,

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi                                       | 148 +++++++++++----------
 g10/gpg.c                                          |   2 +
 g10/tofu.c                                         |  17 ---
 g10/tofu.h                                         |   5 -
 tests/gpgscm/tests.scm                             |   2 +-
 tests/openpgp/tofu-2183839A-1.txt                  | Bin 191 -> 0 bytes
 tests/openpgp/tofu-BC15C85A-1.txt                  |   9 --
 tests/openpgp/tofu-EE37CF96-1.txt                  |   9 --
 tests/openpgp/tofu-keys-secret.asc                 |  95 -------------
 tests/openpgp/tofu-keys.asc                        |  47 -------
 tests/openpgp/tofu.scm                             | 120 ++++++++++++-----
 tests/openpgp/tofu/conflicting/1C005AF3-1.txt      | Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-2.txt      | Bin 0 -> 338 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-3.txt      | Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-4.txt      | Bin 0 -> 338 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-5.txt      | Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg | Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/1C005AF3.gpg        | Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/B662E42F-1.txt      | Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/B662E42F-2.txt      | Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/B662E42F-3.txt      | Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/B662E42F-4.txt      | Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/B662E42F-5.txt      |   1 +
 tests/openpgp/tofu/conflicting/B662E42F-secret.gpg | Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/B662E42F.gpg        | Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-1.txt      | Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-2.txt      | Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-3.txt      | Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-4.txt      | Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-5.txt      | Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg | Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B.gpg        | Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/README              |   8 ++
 33 files changed, 177 insertions(+), 286 deletions(-)
 delete mode 100644 tests/openpgp/tofu-2183839A-1.txt
 delete mode 100644 tests/openpgp/tofu-BC15C85A-1.txt
 delete mode 100644 tests/openpgp/tofu-EE37CF96-1.txt
 delete mode 100755 tests/openpgp/tofu-keys-secret.asc
 delete mode 100755 tests/openpgp/tofu-keys.asc
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/README


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 14:26:51 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Tue, 06 Dec 2016 14:26:51 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-59-g87972fd
Message-ID: <E1cEFlm-0002fb-J4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  87972fdef2cd853fb97624d0765686674a19e3c4 (commit)
      from  7572d270fcda1614648c6f08d711d5096ffebbe6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 87972fdef2cd853fb97624d0765686674a19e3c4
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 6 14:26:36 2016 +0100

    tests: Update distributed files
    
    * tests/openpgp/Makefile.am (TEST_FILES): Remove tofu-keys.asc,
    tofu-keys-secret.asc, tofu-2183839A-1.txt, tofu-BC15C85A-1.txt and
    tofu-EE37CF96-1.txt.  Add tofu/conflicting/1C005AF3.gpg,
    tofu/conflicting/1C005AF3-secret.gpg, tofu/conflicting/1C005AF3-1.txt,
    tofu/conflicting/1C005AF3-2.txt, tofu/conflicting/1C005AF3-3.txt,
    tofu/conflicting/1C005AF3-4.txt, tofu/conflicting/1C005AF3-5.txt,
    tofu/conflicting/B662E42F.gpg, tofu/conflicting/B662E42F-secret.gpg,
    tofu/conflicting/B662E42F-1.txt, tofu/conflicting/B662E42F-2.txt,
    tofu/conflicting/B662E42F-3.txt, tofu/conflicting/B662E42F-4.txt,
    tofu/conflicting/B662E42F-5.txt, tofu/conflicting/BE04EB2B.gpg,
    tofu/conflicting/BE04EB2B-secret.gpg, tofu/conflicting/BE04EB2B-1.txt,
    tofu/conflicting/BE04EB2B-2.txt, tofu/conflicting/BE04EB2B-3.txt,
    tofu/conflicting/BE04EB2B-4.txt, tofu/conflicting/BE04EB2B-5.txt and
    tofu/conflicting/README.
    
    --
    Signed-off-by: Neal H. Walfield <neal at g10code.com>
    Fixes-commit: d5b18d6

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 350b60a..43b00b0 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -113,8 +113,27 @@ TEST_FILES = pubring.asc secring.asc plain-1o.asc plain-2o.asc plain-3o.asc \
              gpg.conf.tmpl gpg-agent.conf.tmpl \
 	     bug537-test.data.asc bug894-test.asc \
 	     bug1223-good.asc bug1223-bogus.asc 4gb-packet.asc \
-	     tofu-keys.asc tofu-keys-secret.asc \
-	     tofu-2183839A-1.txt tofu-BC15C85A-1.txt tofu-EE37CF96-1.txt \
+	     tofu/conflicting/1C005AF3.gpg \
+	     tofu/conflicting/1C005AF3-secret.gpg \
+	     tofu/conflicting/1C005AF3-1.txt \
+	     tofu/conflicting/1C005AF3-2.txt \
+	     tofu/conflicting/1C005AF3-3.txt \
+	     tofu/conflicting/1C005AF3-4.txt \
+	     tofu/conflicting/1C005AF3-5.txt \
+	     tofu/conflicting/B662E42F.gpg \
+	     tofu/conflicting/B662E42F-secret.gpg \
+	     tofu/conflicting/B662E42F-1.txt \
+	     tofu/conflicting/B662E42F-2.txt \
+	     tofu/conflicting/B662E42F-3.txt \
+	     tofu/conflicting/B662E42F-4.txt \
+	     tofu/conflicting/B662E42F-5.txt \
+	     tofu/conflicting/BE04EB2B.gpg \
+	     tofu/conflicting/BE04EB2B-secret.gpg \
+	     tofu/conflicting/BE04EB2B-1.txt \
+	     tofu/conflicting/BE04EB2B-2.txt \
+	     tofu/conflicting/BE04EB2B-3.txt \
+	     tofu/conflicting/BE04EB2B-4.txt \
+	     tofu/conflicting/BE04EB2B-5.txt \
 	     tofu/cross-sigs/EC38277E-secret.gpg \
 	     tofu/cross-sigs/EC38277E-1.gpg \
 	     tofu/cross-sigs/EC38277E-1.txt \

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 15:39:44 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 06 Dec 2016 15:39:44 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-62-ge352ead
Message-ID: <E1cEGuK-0006lX-4l@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e352ead43fbb0180e1f1c71bf1a000d1954eb777 (commit)
       via  5b5d881f47c82f320abf440c20b7a1bac078a987 (commit)
       via  89ac071eb4c7539e98c7dc17e11f57c620b54e90 (commit)
      from  87972fdef2cd853fb97624d0765686674a19e3c4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e352ead43fbb0180e1f1c71bf1a000d1954eb777
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 6 15:15:52 2016 +0100

    tests: Add test importing a revocation certificate.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/import-revocation-certificate.scm: New file.
    * tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 43b00b0..2f43644 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -77,6 +77,7 @@ XTESTS = \
 	gpgv-forged-keyring.scm \
 	armor.scm \
 	import.scm \
+	import-revocation-certificate.scm \
 	ecc.scm \
 	4gb-packet.scm \
 	tofu.scm \
@@ -216,7 +217,8 @@ sample_keys = samplekeys/README \
 
 sample_msgs = samplemsgs/issue2419.asc \
 	      samplemsgs/clearsig-1-key-1.asc \
-	      samplemsgs/signed-1-key-1.asc
+	      samplemsgs/signed-1-key-1.asc \
+	      samplemsgs/revoke-2D727CC768697734.asc
 
 EXTRA_DIST = defs.scm $(XTESTS) $(TEST_FILES) \
 	     mkdemodirs signdemokey $(priv_keys) $(sample_keys)   \
diff --git a/tests/openpgp/import-revocation-certificate.scm b/tests/openpgp/import-revocation-certificate.scm
new file mode 100644
index 0000000..9231afc
--- /dev/null
+++ b/tests/openpgp/import-revocation-certificate.scm
@@ -0,0 +1,37 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+;; XXX because of --always-trust, the trustdb is not created.
+;; Therefore, we redefine GPG without --always-trust.
+(define gpg `(,(tool 'gpg) --no-permission-warning))
+
+(info "Checking key revocation.")
+(call-check `(, at gpg --import ,(in-srcdir "samplemsgs"
+					 "revoke-2D727CC768697734.asc")))
+(let loop ((output (gpg-with-colons '(--list-secret-keys "2D727CC768697734"))))
+  (unless (null? output)
+	  (let ((line (car output))
+		(rest (cdr output)))
+	    (when (member (car line) '("sec" "uid" "ssb"))
+		  (unless (equal? (cadr line) "r")
+			  (fail (car line) "not revoked.")))
+	    (loop rest))))
diff --git a/tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc b/tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc
new file mode 100644
index 0000000..f20029c
--- /dev/null
+++ b/tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc
@@ -0,0 +1,8 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: This is a revocation certificate
+
+iGAEIBECACAWIQSg/0WQu2Ei7e9uPFQtcnzHaGl3NAUCWEaoMAIdAAAKCRAtcnzH
+aGl3NISuAJ9rsxoazHvPs89Ki33o/SgKMjOg/wCggbFG8V5wXU1njwuiviPUKap3
+uqA=
+=79yW
+-----END PGP PUBLIC KEY BLOCK-----

commit 5b5d881f47c82f320abf440c20b7a1bac078a987
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 6 15:21:30 2016 +0100

    tests: Rename 'error' to 'fail'.
    
    * tests/gpgscm/tests.scm (error): Rename to 'fail'.  'error' is a
    primitive function (an opcode) of the TinySCHEME vm, and 'error' is
    also defined by R6RS.  Better avoid redefining that.  Fix all call
    sites.
    * tests/openpgp/4gb-packet.scm: Adapt.
    * tests/openpgp/decrypt-multifile.scm: Likewise.
    * tests/openpgp/ecc.scm: Likewise.
    * tests/openpgp/export.scm: Likewise.
    * tests/openpgp/gpgtar.scm: Likewise.
    * tests/openpgp/gpgv-forged-keyring.scm: Likewise.
    * tests/openpgp/import.scm: Likewise.
    * tests/openpgp/issue2015.scm: Likewise.
    * tests/openpgp/issue2346.scm: Likewise.
    * tests/openpgp/issue2419.scm: Likewise.
    * tests/openpgp/key-selection.scm: Likewise.
    * tests/openpgp/mds.scm: Likewise.
    * tests/openpgp/multisig.scm: Likewise.
    * tests/openpgp/setup.scm: Likewise.
    * tests/openpgp/signencrypt.scm: Likewise.
    * tests/openpgp/ssh-import.scm: Likewise.
    * tests/openpgp/tofu.scm: Likewise.
    * tests/openpgp/verify.scm: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index 1c170b0..e2b38f5 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -42,7 +42,7 @@
   (if (> (*verbose*) 0)
       (apply info msg)))
 
-(define (error . msg)
+(define (fail . msg)
   (apply info msg)
   (exit 1))
 
@@ -325,7 +325,7 @@
   (lettmp (sink)
 	  (transformer source sink)
 	  (if (not (file=? source sink))
-	      (error "mismatch"))))
+	      (fail "mismatch"))))
 
 ;;
 ;; Monadic pipe support.
@@ -440,7 +440,7 @@
 (define (tr:spawn input command)
   (lambda (tmpfiles source)
     (if (and (member '**in** command) (not source))
-	(error (string-append (stringify cmd) " needs an input")))
+	(fail (string-append (stringify cmd) " needs an input")))
     (let* ((t (make-temporary-file))
 	   (cmd (map (lambda (x)
 		       (cond
@@ -450,7 +450,7 @@
       (catch (list (cons t tmpfiles) t *error*)
 	     (call-popen cmd input)
 	     (if (and (member '**out** command) (not (file-exists? t)))
-		 (error (string-append (stringify cmd)
+		 (fail (string-append (stringify cmd)
 				       " did not produce '" t "'.")))
 	     (list (cons t tmpfiles) t #f)))))
 
@@ -471,13 +471,13 @@
 (define (tr:assert-identity reference)
   (lambda (tmpfiles source)
     (if (not (file=? source reference))
-	(error "mismatch"))
+	(fail "mismatch"))
     (list tmpfiles source #f)))
 
 (define (tr:assert-weak-identity reference)
   (lambda (tmpfiles source)
     (if (not (text-file=? source reference))
-	(error "mismatch"))
+	(fail "mismatch"))
     (list tmpfiles source #f)))
 
 (define (tr:call-with-content function . args)
diff --git a/tests/openpgp/4gb-packet.scm b/tests/openpgp/4gb-packet.scm
index 9c387af..b827181 100755
--- a/tests/openpgp/4gb-packet.scm
+++ b/tests/openpgp/4gb-packet.scm
@@ -25,4 +25,4 @@
 
 (if (= 0 (call `(, at GPG --list-packets ,(in-srcdir "4gb-packet.asc"))))
   (info "Can parse 4GB packets.")
-  (error "Failed to parse 4GB packet."))
+  (fail "Failed to parse 4GB packet."))
diff --git a/tests/openpgp/decrypt-multifile.scm b/tests/openpgp/decrypt-multifile.scm
index 4efdf66..a7695b1 100755
--- a/tests/openpgp/decrypt-multifile.scm
+++ b/tests/openpgp/decrypt-multifile.scm
@@ -43,5 +43,5 @@
   "Verifying files:"
   (lambda (name)
     (unless (file=? (path-join my-wd name) name)
-	    (error "decrypted file differs")))
+	    (fail "decrypted file differs")))
   plain-files))
diff --git a/tests/openpgp/ecc.scm b/tests/openpgp/ecc.scm
index 2190b9b..a40869d 100755
--- a/tests/openpgp/ecc.scm
+++ b/tests/openpgp/ecc.scm
@@ -103,7 +103,7 @@ Ic1RdzgeCfosMF+l/zVRchcLKzenEQA=
 	   x (lambda (p) (display (eval test (current-environment)) p)))
        (call-check `(,(tool 'gpg) --verify ,x))
        (call-check `(,(tool 'gpg) --output ,y ,x))
-       (unless (file=? y z) (error "mismatch"))))
+       (unless (file=? y z) (fail "mismatch"))))
    '(msg_opaque_signed_256 msg_opaque_signed_384 msg_opaque_signed_521)))
 
 ;;
@@ -182,7 +182,7 @@ Rg==
        (call-with-output-file
 	   x (lambda (p) (display (eval test (current-environment)) p)))
        (call-check `(, at GPG --yes --output ,y ,x))
-       (unless (file=? y z) (error "mismatch"))))
+       (unless (file=? y z) (fail "mismatch"))))
    '(msg_encrypted_256 msg_encrypted_384 msg_encrypted_521)))
 
 ;;
diff --git a/tests/openpgp/export.scm b/tests/openpgp/export.scm
index a79411c..c10fc81 100755
--- a/tests/openpgp/export.scm
+++ b/tests/openpgp/export.scm
@@ -22,7 +22,7 @@
 
 (define (check-for predicate lines message)
   (unless (any predicate lines)
-	  (error message)))
+	  (fail message)))
 
 (define (check-exported-key dump keyid)
   (check-for (lambda (l)
@@ -68,7 +68,7 @@
      (lambda (port)
        (unless
 	(eof-object? (peek-char port))
-	(error (string-append
+	(fail (string-append
 		"Expected all passphrases to be consumed, but found: "
 		(read-all port)))))))
 
diff --git a/tests/openpgp/gpgtar.scm b/tests/openpgp/gpgtar.scm
index cd692de..c88589f 100755
--- a/tests/openpgp/gpgtar.scm
+++ b/tests/openpgp/gpgtar.scm
@@ -43,7 +43,7 @@
      (tr:call-with-content
       (lambda (c)
 	(unless (all (lambda (f) (string-contains? c f)) testfiles)
-		(error "some file(s) are missing from archive")))))
+		(fail "some file(s) are missing from archive")))))
 
     (with-temporary-working-directory
      (call-check `(,(tool 'gpgtar) --gpg ,(tool 'gpg) --gpg-args ,gpgargs
@@ -53,7 +53,7 @@
 
      (for-each
       (lambda (f) (unless (call-with-input-file f (lambda (x) #t))
-			  (error (string-append "missing file: " f))))
+			  (fail (string-append "missing file: " f))))
       testfiles))))
 
 (info "Checking gpgtar without encryption")
diff --git a/tests/openpgp/gpgv-forged-keyring.scm b/tests/openpgp/gpgv-forged-keyring.scm
index 65d21c5..6885cd9 100755
--- a/tests/openpgp/gpgv-forged-keyring.scm
+++ b/tests/openpgp/gpgv-forged-keyring.scm
@@ -64,5 +64,5 @@ N1Glbw1OJfP1q+QFPMPKoCsTYmZpuugq2b5gV/eH0Abvk2pG4Fo/YTDPHhec7Jk=
 	  (pipe:do
 	   (pipe:echo (eval armored-file (current-environment)))
 	   (pipe:spawn `(, at GPGV --keyring ,(in-srcdir "forged-keyring.gpg"))))
-	  (error "verification succeeded but should not")))
+	  (fail "verification succeeded but should not")))
  '(msg_signed_asc))
diff --git a/tests/openpgp/import.scm b/tests/openpgp/import.scm
index c354753..3b41746 100755
--- a/tests/openpgp/import.scm
+++ b/tests/openpgp/import.scm
@@ -58,4 +58,4 @@
 			(string-contains? line ":4096:1:DDA252EBB8EBE1AF:")))
 		 (string-split-newlines c))))
       (unless (= 2 (length keys))
-	      (error "Importing keys with long id collision failed"))))))
+	      (fail "Importing keys with long id collision failed"))))))
diff --git a/tests/openpgp/issue2015.scm b/tests/openpgp/issue2015.scm
index 4f151aa..39df333 100755
--- a/tests/openpgp/issue2015.scm
+++ b/tests/openpgp/issue2015.scm
@@ -28,4 +28,4 @@
 			    "GET_PASSPHRASE --no-ask some_id X X X")))
   (unless (string=? (string-rtrim char-whitespace? response)
 		    "OK 736F6D655F70617373706872617365")
-	  (error "Could not retrieve passphrase from cache:" response)))
+	  (fail "Could not retrieve passphrase from cache:" response)))
diff --git a/tests/openpgp/issue2346.scm b/tests/openpgp/issue2346.scm
index cbe03f9..9765453 100755
--- a/tests/openpgp/issue2346.scm
+++ b/tests/openpgp/issue2346.scm
@@ -25,4 +25,4 @@
 (info "Checking import statistics (issue2346)...")
 (let ((status (call-popen `(, at GPG --status-fd=1 --import ,key) "")))
   (unless (string-contains? status "IMPORT_RES 1 0 1 0 0 0 0 0 0 1 1 0 0 0 0")
-	  (error "Unexpected number of keys imported" status)))
+	  (fail "Unexpected number of keys imported" status)))
diff --git a/tests/openpgp/issue2419.scm b/tests/openpgp/issue2419.scm
index 9b67851..e397a88 100755
--- a/tests/openpgp/issue2419.scm
+++ b/tests/openpgp/issue2419.scm
@@ -26,4 +26,4 @@
  (dearmor (in-srcdir "samplemsgs/issue2419.asc") onebyte)
  (catch (assert (string-contains? (car *error*) "invalid packet"))
 	(call-popen `(, at GPG --list-packets ,onebyte) "")
-	(error "Expected an error but got none")))
+	(fail "Expected an error but got none")))
diff --git a/tests/openpgp/key-selection.scm b/tests/openpgp/key-selection.scm
index 93bd001..020c9b4 100644
--- a/tests/openpgp/key-selection.scm
+++ b/tests/openpgp/key-selection.scm
@@ -76,7 +76,7 @@
 	     (display (call-popen `(, at gpg --locate-key ,mailbox) ""))
 	     (echo "This is the key we expected:")
 	     (display (call-popen `(, at gpg --list-keys ,expected) ""))
-	     (error "Expected" expected "but got" fpr)))
+	     (fail "Expected" expected "but got" fpr)))
    (delete-keys set))
  (lambda (set)
    (length set))
diff --git a/tests/openpgp/mds.scm b/tests/openpgp/mds.scm
index bf598eb..fb468e5 100755
--- a/tests/openpgp/mds.scm
+++ b/tests/openpgp/mds.scm
@@ -49,7 +49,7 @@
 (define (test-hash hash ref)
   (unless (eq? #f ref)
 	  (if (not (string=? (:value hash) (:value ref)))
-	    (error "failed"))))
+	    (fail "failed"))))
 
 ;; Test whether the hashes computed over S match the REFERENCE set.
 (define (test-hashes msg s reference)
diff --git a/tests/openpgp/multisig.scm b/tests/openpgp/multisig.scm
index 7f1c4c5..c643ac8 100755
--- a/tests/openpgp/multisig.scm
+++ b/tests/openpgp/multisig.scm
@@ -164,6 +164,6 @@ cnksIEkgY2FuJ3QgZG8gdGhhdAo=
       (pipe:write-to file (logior O_WRONLY O_CREAT O_BINARY) #o600))
 
      (if (= 0 (call `(, at GPG --verify ,file)))
-	 (error "Bad signature verified ok"))))
+	 (fail "Bad signature verified ok"))))
  '(sig-1ls1ls-valid sig-ls-valid sig-1lsls-invalid
 		    sig-lsls-invalid sig-lss-invalid sig-slsl-invalid))
diff --git a/tests/openpgp/setup.scm b/tests/openpgp/setup.scm
index d2e125e..fc0615f 100755
--- a/tests/openpgp/setup.scm
+++ b/tests/openpgp/setup.scm
@@ -20,7 +20,7 @@
 (load (with-path "defs.scm"))
 
 (unless (member "--create-tarball" *args*)
-	(error "Usage: setup.scm --create-tarball <file>"))
+	(fail "Usage: setup.scm --create-tarball <file>"))
 
 (with-temporary-working-directory
  (setenv "GNUPGHOME" (getcwd) #t)
diff --git a/tests/openpgp/signencrypt.scm b/tests/openpgp/signencrypt.scm
index b4c3bd6..35ac89a 100755
--- a/tests/openpgp/signencrypt.scm
+++ b/tests/openpgp/signencrypt.scm
@@ -37,4 +37,4 @@
 	      usrpass1)
   (if (not (string=? "4336AE2A528FAE091E73E59E325B588FEE795F9B"
 		     (cadar (gpg-hash-string `(--print-md SHA1 ,tmp) ""))))
-      (error "bug537-test.data.asc: mismatch (bug 537)")))
+      (fail "bug537-test.data.asc: mismatch (bug 537)")))
diff --git a/tests/openpgp/ssh-import.scm b/tests/openpgp/ssh-import.scm
index a825409..e8f12d3 100755
--- a/tests/openpgp/ssh-import.scm
+++ b/tests/openpgp/ssh-import.scm
@@ -22,7 +22,7 @@
 
 (define GNUPGHOME (getenv "GNUPGHOME"))
 (if (string=? "" GNUPGHOME)
-    (error "GNUPGHOME not set"))
+    (fail "GNUPGHOME not set"))
 
 (setenv "SSH_AUTH_SOCK"
         (call-check `(,(tool 'gpgconf) --null --list-dirs agent-ssh-socket))
@@ -51,7 +51,7 @@
       (pipe:open file (logior O_RDONLY O_BINARY))
       (pipe:spawn `(,SSH-ADD -)))
      (unless (string-contains? (call-popen `(,SSH-ADD -l "-E" md5) "") hash)
-	     (error "key not added"))))
+	     (fail "key not added"))))
  car keys)
 
 (info "Checking for issue2316...")
@@ -64,4 +64,4 @@
 (unless
  (string-contains? (call-popen `(,SSH-ADD -l "-E" md5) "")
 		   "c9:85:b5:55:00:84:a9:82:5a:df:d6:62:1b:5a:28:22")
- (error "known private key not (re-)added to sshcontrol"))
+ (fail "known private key not (re-)added to sshcontrol"))
diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index f9dc411..47c3dd0 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -25,7 +25,7 @@
 	      --faked-system-time=1480943782))
 (define GNUPGHOME (getenv "GNUPGHOME"))
 (if (string=? "" GNUPGHOME)
-    (error "GNUPGHOME not set"))
+    (fail "GNUPGHOME not set"))
 
 (catch (skip "Tofu not supported")
        (call-check `(, at GPG --trust-model=tofu --list-config)))
@@ -37,7 +37,7 @@
             (call-check `(, at GPG --import
                                 ,(in-srcdir "tofu/conflicting/"
                                             (string-append keyid ".gpg"))))
-	    (catch (error "Missing key" keyid)
+	    (catch (fail "Missing key" keyid)
 		   (call-check `(, at GPG --list-keys ,keyid))))
 	  KEYS)
 
@@ -52,7 +52,7 @@
 				   , at args
 				   --list-keys ,keyid))) 5)))
     (unless (member policy '("auto" "good" "unknown" "bad" "ask"))
-	    (error "Bad policy:" policy))
+	    (fail "Bad policy:" policy))
     policy))
 
 ;; Check that KEYID's tofu policy matches EXPECTED-POLICY.  Any
@@ -62,7 +62,7 @@
 (define (checkpolicy keyid expected-policy . args)
   (let ((policy (apply getpolicy `(,keyid , at args))))
     (unless (string=? policy expected-policy)
-	    (error keyid ": Expected policy to be" expected-policy
+	    (fail keyid ": Expected policy to be" expected-policy
 		   "but got" policy))))
 
 ;; Get the trust level for KEYID.  Any remaining arguments are simply
@@ -77,7 +77,7 @@
 				   --list-keys ,keyid))) 1)))
     (unless (and (= 1 (string-length trust))
 		 (member (string-ref trust 0) (string->list "oidreqnmfuws-")))
-	    (error "Bad trust value:" trust))
+	    (fail "Bad trust value:" trust))
     trust))
 
 ;; Check that KEYID's trust level matches EXPECTED-TRUST.  Any
@@ -87,7 +87,7 @@
 (define (checktrust keyid expected-trust . args)
   (let ((trust (apply gettrust `(,keyid , at args))))
     (unless (string=? trust expected-trust)
-	    (error keyid ": Expected trust to be" expected-trust
+	    (fail keyid ": Expected trust to be" expected-trust
 		   "but got" trust))))
 
 ;; Set key KEYID's policy to POLICY.  Any remaining arguments are
@@ -177,10 +177,10 @@
        (sigs (string->number (list-ref tfs 3)))
        (encs (string->number (list-ref tfs 4))))
     (unless (= sigs expected-sigs)
-            (error keyid ": # signatures (" sigs ") does not match expected"
+            (fail keyid ": # signatures (" sigs ") does not match expected"
                    "# signatures (" expected-sigs ").\n"))
     (unless (= encs expected-encs)
-            (error keyid ": # encryptions (" encs ") does not match expected"
+            (fail keyid ": # encryptions (" encs ") does not match expected"
                    "# encryptions (" expected-encs ").\n"))
     ))
 
diff --git a/tests/openpgp/verify.scm b/tests/openpgp/verify.scm
index 2c2c14a..a398a14 100755
--- a/tests/openpgp/verify.scm
+++ b/tests/openpgp/verify.scm
@@ -33,7 +33,7 @@
 	(display (make-string 64 (integer->char (string->number char)))
 		 port)))
      (if (= 0 (call `(, at GPG --verify ,x data-500)))
-	 (error "no error code from verify"))))
+	 (fail "no error code from verify"))))
  '("#x2d" "#xca"))
 
 ;; A plain signed message created using
@@ -324,7 +324,7 @@ GisM
 	   (pipe:defer (lambda (sink)
 			 (display armored-file (fdopen sink "w"))))
 	   (pipe:spawn `(, at GPG --verify)))
-	  (error "verification succeeded but should not")))
+	  (fail "verification succeeded but should not")))
  '(msg_olsols_asc_multiple msg_clsclss_asc_multiple))
 
 (for-each-p
@@ -334,7 +334,7 @@ GisM
 	  (pipe:do
 	   (pipe:echo (eval armored-file (current-environment)))
 	   (pipe:spawn `(, at GPG --verify)))
-	  (error "verification succeeded but should not")))
+	  (fail "verification succeeded but should not")))
  '(bad_ls_asc bad_fols_asc bad_olsf_asc bad_ools_asc))
 
 

commit 89ac071eb4c7539e98c7dc17e11f57c620b54e90
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 6 12:55:11 2016 +0100

    tests: Remove debugging display.
    
    * tests/openpgp/tofu.scm: Remove debugging display.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index bc45d99..f9dc411 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -176,7 +176,6 @@
                                          , at args --list-keys ,keyid))))
        (sigs (string->number (list-ref tfs 3)))
        (encs (string->number (list-ref tfs 4))))
-    (display tfs)
     (unless (= sigs expected-sigs)
             (error keyid ": # signatures (" sigs ") does not match expected"
                    "# signatures (" expected-sigs ").\n"))

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/tests.scm                             | 12 +++++-----
 tests/openpgp/4gb-packet.scm                       |  2 +-
 tests/openpgp/Makefile.am                          |  4 +++-
 tests/openpgp/decrypt-multifile.scm                |  2 +-
 tests/openpgp/ecc.scm                              |  4 ++--
 tests/openpgp/export.scm                           |  4 ++--
 tests/openpgp/gpgtar.scm                           |  4 ++--
 tests/openpgp/gpgv-forged-keyring.scm              |  2 +-
 ...tachm.scm => import-revocation-certificate.scm} | 27 +++++++++++-----------
 tests/openpgp/import.scm                           |  2 +-
 tests/openpgp/issue2015.scm                        |  2 +-
 tests/openpgp/issue2346.scm                        |  2 +-
 tests/openpgp/issue2419.scm                        |  2 +-
 tests/openpgp/key-selection.scm                    |  2 +-
 tests/openpgp/mds.scm                              |  2 +-
 tests/openpgp/multisig.scm                         |  2 +-
 .../openpgp/samplemsgs/revoke-2D727CC768697734.asc |  8 +++++++
 tests/openpgp/setup.scm                            |  2 +-
 tests/openpgp/signencrypt.scm                      |  2 +-
 tests/openpgp/ssh-import.scm                       |  6 ++---
 tests/openpgp/tofu.scm                             | 17 +++++++-------
 tests/openpgp/verify.scm                           |  6 ++---
 22 files changed, 63 insertions(+), 53 deletions(-)
 copy tests/openpgp/{detachm.scm => import-revocation-certificate.scm} (56%)
 mode change 100755 => 100644
 create mode 100644 tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 18:07:16 2016
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Tue, 06 Dec 2016 18:07:16 +0100
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-4-gcc0d783
Message-ID: <E1cEJD4-0005Y7-3J@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  cc0d783cf03a814df48c03ddcbb4d09115e9596d (commit)
      from  c5c7bee68730c9f66a27f9bb0d023480623a2bfb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cc0d783cf03a814df48c03ddcbb4d09115e9596d
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Tue Dec 6 12:04:25 2016 -0500

    Fix spelling errors.
    
    --
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>

diff --git a/doc/pinentry.texi b/doc/pinentry.texi
index feef4f0..23c1c5e 100644
--- a/doc/pinentry.texi
+++ b/doc/pinentry.texi
@@ -386,9 +386,9 @@ a GETPIN or CONFIRM, and is only displayed when asking for a PIN.
 @item Enable a passphrase quality indicator
 Adds a quality indicator to the GETPIN window.  This indicator is
 updated as the passphrase is typed.  The clients needs to implement an
-inquiry named "QUALITY" which gets passed the current passpharse
+inquiry named "QUALITY" which gets passed the current passphrase
 (percent-plus escaped) and should send back a string with a single
-numerical vauelue between -100 and 100.  Negative values will be
+numerical value between -100 and 100.  Negative values will be
 displayed in red.
 @example
   C: SETQUALITYBAR

-----------------------------------------------------------------------

Summary of changes:
 doc/pinentry.texi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 21:24:48 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 06 Dec 2016 21:24:48 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-21-g603f479
Message-ID: <E1cEMIE-0006Kn-BG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  603f479a919311f720a05da738150c2192d5e562 (commit)
      from  a0580d446fef648a177ca4ab060d0e449780db84 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 603f479a919311f720a05da738150c2192d5e562
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 6 21:20:54 2016 +0100

    Reorganize code in secmem.c.
    
    * src/secmem.c (pooldesc_t): New type to collect information about one
    pool.
    (pool_size): Remove.  Now a member of pooldesc_t.
    (pool_okay): Ditto.
    (pool_is_mmapped): Ditto.
    (pool): Rename variable ...
    (mainpool): And change type to pooldesc_t.
    (ptr_into_pool_p): Add arg 'pool'.
    (mb_get_next): Ditto.
    (mb_get_prev): Ditto.
    (mb_merge): Ditto.
    (mb_get_new): Ditto.
    (init_pool): Ditto.
    (lock_pool): Rename to ...
    (look_pool_pages: this.
    (secmem_init): Rename to ...
    (_gcry_secmem_init_internal): this.  Add local var POOL and init with
    address of MAINPOOL.
    (_gcry_secmem_malloc_internal): Add local var POOL and init with
    address of MAINPOOL.
    (_gcry_private_is_secure): Ditto.
    (_gcry_secmem_term): Ditto.
    (_gcry_secmem_dump_stats): Ditto.
    (_gcry_secmem_free_internal): Ditto.  Remove check for NULL arg.
    (_gcry_secmem_free): Add check for NULL arg before taking the lock.
    (_gcry_secmem_realloc): Factor most code out to ...
    (_gcry_secmem_realloc_internal): this.
    --
    
    This change prepares future work to allow the use of several pools.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/secmem.c b/src/secmem.c
index c4e8414..1f92f17 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -1,7 +1,7 @@
 /* secmem.c  -	memory allocation from a secure heap
  * Copyright (C) 1998, 1999, 2000, 2001, 2002,
  *               2003, 2007 Free Software Foundation, Inc.
- * Copyright (C) 2013 g10 Code GmbH
+ * Copyright (C) 2013, 2016 g10 Code GmbH
  *
  * This file is part of Libgcrypt.
  *
@@ -59,20 +59,30 @@ typedef struct memblock
 /* This flag specifies that the memory block is in use.  */
 #define MB_FLAG_ACTIVE (1 << 0)
 
-/* The pool of secure memory.  */
-static void *pool;
+/* An object describing a memory pool.  */
+typedef struct pooldesc_s
+{
+  /* A memory buffer used as allocation pool.  */
+  void *mem;
+
+  /* The allocated size of MEM. */
+  size_t size;
+
+  /* Flag indicating that this memory pool is ready for use.  May be
+   * checked in an atexit function.  */
+  volatile int okay;
 
-/* Size of POOL in bytes.  */
-static size_t pool_size;
+  /* Flag indicating whether MEM is mmapped.  */
+  volatile int is_mmapped;
 
-/* True, if the memory pool is ready for use.  May be checked in an
-   atexit function.  */
-static volatile int pool_okay;
+} pooldesc_t;
 
-/* True, if the memory pool is mmapped.  */
-static volatile int pool_is_mmapped;
 
-/* FIXME?  */
+/* The pool of secure memory.  */
+static pooldesc_t mainpool;
+
+
+/* A couple of flags whith some beeing set early. */
 static int disable_secmem;
 static int show_warning;
 static int not_locked;
@@ -84,7 +94,7 @@ static int no_priv_drop;
 /* Stats.  */
 static unsigned int cur_alloced, cur_blocks;
 
-/* Lock protecting accesses to the memory pool.  */
+/* Lock protecting accesses to the memory pools.  */
 GPGRT_LOCK_DEFINE (secmem_lock);
 
 /* Convenient macros.  */
@@ -100,18 +110,18 @@ GPGRT_LOCK_DEFINE (secmem_lock);
 #define ADDR_TO_BLOCK(addr) \
   (memblock_t *) (void *) ((char *) addr - BLOCK_HEAD_SIZE)
 
-/* Check whether P points into the pool.  */
+/* Check whether P points into POOL.  */
 static int
-ptr_into_pool_p (const void *p)
+ptr_into_pool_p (pooldesc_t *pool, const void *p)
 {
   /* We need to convert pointers to addresses.  This is required by
      C-99 6.5.8 to avoid undefined behaviour.  See also
      http://lists.gnupg.org/pipermail/gcrypt-devel/2007-February/001102.html
   */
   uintptr_t p_addr    = (uintptr_t)p;
-  uintptr_t pool_addr = (uintptr_t)pool;
+  uintptr_t pool_addr = (uintptr_t)pool->mem;
 
-  return p_addr >= pool_addr && p_addr <  pool_addr + pool_size;
+  return p_addr >= pool_addr && p_addr <  pool_addr + pool->size;
 }
 
 /* Update the stats.  */
@@ -132,13 +142,13 @@ stats_update (size_t add, size_t sub)
 
 /* Return the block following MB or NULL, if MB is the last block.  */
 static memblock_t *
-mb_get_next (memblock_t *mb)
+mb_get_next (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_next;
 
   mb_next = (memblock_t *) (void *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size);
 
-  if (! ptr_into_pool_p (mb_next))
+  if (! ptr_into_pool_p (pool, mb_next))
     mb_next = NULL;
 
   return mb_next;
@@ -147,18 +157,18 @@ mb_get_next (memblock_t *mb)
 /* Return the block preceding MB or NULL, if MB is the first
    block.  */
 static memblock_t *
-mb_get_prev (memblock_t *mb)
+mb_get_prev (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_prev, *mb_next;
 
-  if (mb == pool)
+  if (mb == pool->mem)
     mb_prev = NULL;
   else
     {
-      mb_prev = (memblock_t *) pool;
+      mb_prev = (memblock_t *) pool->mem;
       while (1)
 	{
-	  mb_next = mb_get_next (mb_prev);
+	  mb_next = mb_get_next (pool, mb_prev);
 	  if (mb_next == mb)
 	    break;
 	  else
@@ -172,12 +182,12 @@ mb_get_prev (memblock_t *mb)
 /* If the preceding block of MB and/or the following block of MB
    exist and are not active, merge them to form a bigger block.  */
 static void
-mb_merge (memblock_t *mb)
+mb_merge (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_prev, *mb_next;
 
-  mb_prev = mb_get_prev (mb);
-  mb_next = mb_get_next (mb);
+  mb_prev = mb_get_prev (pool, mb);
+  mb_next = mb_get_next (pool, mb);
 
   if (mb_prev && (! (mb_prev->flags & MB_FLAG_ACTIVE)))
     {
@@ -190,11 +200,11 @@ mb_merge (memblock_t *mb)
 
 /* Return a new block, which can hold SIZE bytes.  */
 static memblock_t *
-mb_get_new (memblock_t *block, size_t size)
+mb_get_new (pooldesc_t *pool, memblock_t *block, size_t size)
 {
   memblock_t *mb, *mb_split;
 
-  for (mb = block; ptr_into_pool_p (mb); mb = mb_get_next (mb))
+  for (mb = block; ptr_into_pool_p (pool, mb); mb = mb_get_next (pool, mb))
     if (! (mb->flags & MB_FLAG_ACTIVE) && mb->size >= size)
       {
 	/* Found a free block.  */
@@ -211,14 +221,14 @@ mb_get_new (memblock_t *block, size_t size)
 
 	    mb->size = size;
 
-	    mb_merge (mb_split);
+	    mb_merge (pool, mb_split);
 
 	  }
 
 	break;
       }
 
-  if (! ptr_into_pool_p (mb))
+  if (! ptr_into_pool_p (pool, mb))
     {
       gpg_err_set_errno (ENOMEM);
       mb = NULL;
@@ -235,9 +245,11 @@ print_warn (void)
     log_info (_("Warning: using insecure memory!\n"));
 }
 
-/* Lock the memory pages into core and drop privileges.  */
+
+/* Lock the memory pages of pool P of size N into core and drop
+ * privileges.  */
 static void
-lock_pool (void *p, size_t n)
+lock_pool_pages (void *p, size_t n)
 {
 #if defined(USE_CAPABILITIES) && defined(HAVE_MLOCK)
   int err;
@@ -367,11 +379,11 @@ lock_pool (void *p, size_t n)
 
 /* Initialize POOL.  */
 static void
-init_pool (size_t n)
+init_pool (pooldesc_t *pool, size_t n)
 {
   memblock_t *mb;
 
-  pool_size = n;
+  pool->size = n;
 
   if (disable_secmem)
     log_bug ("secure memory is disabled");
@@ -391,10 +403,10 @@ init_pool (size_t n)
 # endif
     pgsize = (pgsize_val != -1 && pgsize_val > 0)? pgsize_val:DEFAULT_PAGE_SIZE;
 
-    pool_size = (pool_size + pgsize - 1) & ~(pgsize - 1);
+    pool->size = (pool->size + pgsize - 1) & ~(pgsize - 1);
 # ifdef MAP_ANONYMOUS
-    pool = mmap (0, pool_size, PROT_READ | PROT_WRITE,
-                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    pool->mem = mmap (0, pool->size, PROT_READ | PROT_WRITE,
+                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 # else /* map /dev/zero instead */
     {
       int fd;
@@ -403,40 +415,40 @@ init_pool (size_t n)
       if (fd == -1)
         {
           log_error ("can't open /dev/zero: %s\n", strerror (errno));
-          pool = (void *) -1;
+          pool->mem = (void *) -1;
         }
       else
         {
-          pool = mmap (0, pool_size,
-                       (PROT_READ | PROT_WRITE), MAP_PRIVATE, fd, 0);
+          pool->mem = mmap (0, pool->size,
+                           (PROT_READ | PROT_WRITE), MAP_PRIVATE, fd, 0);
           close (fd);
         }
     }
 # endif
-    if (pool == (void *) -1)
+    if (pool->mem == (void *) -1)
       log_info ("can't mmap pool of %u bytes: %s - using malloc\n",
-                (unsigned) pool_size, strerror (errno));
+                (unsigned) pool->size, strerror (errno));
     else
       {
-        pool_is_mmapped = 1;
-        pool_okay = 1;
+        pool->is_mmapped = 1;
+        pool->okay = 1;
       }
   }
 #endif /*HAVE_MMAP*/
 
-  if (!pool_okay)
+  if (!pool->okay)
     {
-      pool = malloc (pool_size);
-      if (!pool)
+      pool->mem = malloc (pool->size);
+      if (!pool->mem)
 	log_fatal ("can't allocate memory pool of %u bytes\n",
-		   (unsigned) pool_size);
+		   (unsigned) pool->size);
       else
-	pool_okay = 1;
+	pool->okay = 1;
     }
 
   /* Initialize first memory block.  */
-  mb = (memblock_t *) pool;
-  mb->size = pool_size;
+  mb = (memblock_t *) pool->mem;
+  mb->size = pool->size;
   mb->flags = 0;
 }
 
@@ -482,11 +494,14 @@ _gcry_secmem_get_flags (void)
 }
 
 
-/* See _gcry_secmem_init.  This function is expected to be called with
-   the secmem lock held. */
+/* This function initializes the main memory pool MAINPOOL.  Itis
+ * expected to be called with the secmem lock held.  */
 static void
-secmem_init (size_t n)
+_gcry_secmem_init_internal (size_t n)
 {
+  pooldesc_t *pool;
+
+  pool = &mainpool;
   if (!n)
     {
 #ifdef USE_CAPABILITIES
@@ -516,10 +531,10 @@ secmem_init (size_t n)
     {
       if (n < MINIMUM_POOL_SIZE)
 	n = MINIMUM_POOL_SIZE;
-      if (! pool_okay)
+      if (! pool->okay)
 	{
-	  init_pool (n);
-	  lock_pool (pool, n);
+	  init_pool (pool, n);
+	  lock_pool_pages (pool->mem, n);
 	}
       else
 	log_error ("Oops, secure memory pool already initialized\n");
@@ -537,7 +552,7 @@ _gcry_secmem_init (size_t n)
 {
   SECMEM_LOCK;
 
-  secmem_init (n);
+  _gcry_secmem_init_internal (n);
 
   SECMEM_UNLOCK;
 }
@@ -554,13 +569,16 @@ _gcry_secmem_module_init ()
 static void *
 _gcry_secmem_malloc_internal (size_t size)
 {
+  pooldesc_t *pool;
   memblock_t *mb;
 
-  if (!pool_okay)
+  pool = &mainpool;
+
+  if (!pool->okay)
     {
       /* Try to initialize the pool if the user forgot about it.  */
-      secmem_init (STANDARD_POOL_SIZE);
-      if (!pool_okay)
+      _gcry_secmem_init_internal (STANDARD_POOL_SIZE);
+      if (!pool->okay)
         {
           log_info (_("operation is not possible without "
                       "initialized secure memory\n"));
@@ -583,7 +601,7 @@ _gcry_secmem_malloc_internal (size_t size)
   /* Blocks are always a multiple of 32. */
   size = ((size + 31) / 32) * 32;
 
-  mb = mb_get_new ((memblock_t *) pool, size);
+  mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
   if (mb)
     stats_update (size, 0);
 
@@ -605,11 +623,11 @@ _gcry_secmem_malloc (size_t size)
 static void
 _gcry_secmem_free_internal (void *a)
 {
+  pooldesc_t *pool;
   memblock_t *mb;
   int size;
 
-  if (!a)
-    return;
+  pool = &mainpool;
 
   mb = ADDR_TO_BLOCK (a);
   size = mb->size;
@@ -624,34 +642,35 @@ _gcry_secmem_free_internal (void *a)
   MB_WIPE_OUT (0x55);
   MB_WIPE_OUT (0x00);
 
+  /* Update stats.  */
   stats_update (0, size);
 
   mb->flags &= ~MB_FLAG_ACTIVE;
 
-  /* Update stats.  */
 
-  mb_merge (mb);
+  mb_merge (pool, mb);
 }
 
 /* Wipe out and release memory.  */
 void
 _gcry_secmem_free (void *a)
 {
+  if (!a)
+    return;
+
   SECMEM_LOCK;
   _gcry_secmem_free_internal (a);
   SECMEM_UNLOCK;
 }
 
-/* Realloc memory.  */
-void *
-_gcry_secmem_realloc (void *p, size_t newsize)
+
+static void *
+_gcry_secmem_realloc_internal (void *p, size_t newsize)
 {
   memblock_t *mb;
   size_t size;
   void *a;
 
-  SECMEM_LOCK;
-
   mb = (memblock_t *) (void *) ((char *) p
 				- ((size_t) &((memblock_t *) 0)->aligned.c));
   size = mb->size;
@@ -671,6 +690,18 @@ _gcry_secmem_realloc (void *p, size_t newsize)
 	}
     }
 
+  return a;
+}
+
+
+/* Realloc memory.  */
+void *
+_gcry_secmem_realloc (void *p, size_t newsize)
+{
+  void *a;
+
+  SECMEM_LOCK;
+  a = _gcry_secmem_realloc_internal (p, newsize);
   SECMEM_UNLOCK;
 
   return a;
@@ -681,7 +712,10 @@ _gcry_secmem_realloc (void *p, size_t newsize)
 int
 _gcry_private_is_secure (const void *p)
 {
-  return pool_okay && ptr_into_pool_p (p);
+  pooldesc_t *pool;
+
+  pool = &mainpool;
+  return pool->okay && ptr_into_pool_p (pool, p);
 }
 
 
@@ -696,20 +730,23 @@ _gcry_private_is_secure (const void *p)
 void
 _gcry_secmem_term ()
 {
-  if (!pool_okay)
+  pooldesc_t *pool;
+
+  pool = &mainpool;
+  if (!pool->okay)
     return;
 
-  wipememory2 (pool, 0xff, pool_size);
-  wipememory2 (pool, 0xaa, pool_size);
-  wipememory2 (pool, 0x55, pool_size);
-  wipememory2 (pool, 0x00, pool_size);
+  wipememory2 (pool->mem, 0xff, pool->size);
+  wipememory2 (pool->mem, 0xaa, pool->size);
+  wipememory2 (pool->mem, 0x55, pool->size);
+  wipememory2 (pool->mem, 0x00, pool->size);
 #if HAVE_MMAP
-  if (pool_is_mmapped)
-    munmap (pool, pool_size);
+  if (pool->is_mmapped)
+    munmap (pool->mem, pool->size);
 #endif
-  pool = NULL;
-  pool_okay = 0;
-  pool_size = 0;
+  pool->mem = NULL;
+  pool->okay = 0;
+  pool->size = 0;
   not_locked = 0;
 }
 
@@ -717,12 +754,15 @@ _gcry_secmem_term ()
 void
 _gcry_secmem_dump_stats ()
 {
+  pooldesc_t *pool;
+
 #if 1
   SECMEM_LOCK;
 
- if (pool_okay)
+  pool = &mainpool;
+  if (pool->okay)
     log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
-	      cur_alloced, (unsigned long)pool_size, cur_blocks);
+	      cur_alloced, (unsigned long)pool->size, cur_blocks);
   SECMEM_UNLOCK;
 #else
   memblock_t *mb;
@@ -730,9 +770,10 @@ _gcry_secmem_dump_stats ()
 
   SECMEM_LOCK;
 
-  for (i = 0, mb = (memblock_t *) pool;
-       ptr_into_pool_p (mb);
-       mb = mb_get_next (mb), i++)
+  pool = &mainpool;
+  for (i = 0, mb = (memblock_t *) pool->mem;
+       ptr_into_pool_p (pool, mb);
+       mb = mb_get_next (pool, mb), i++)
     log_info ("SECMEM: [%s] block: %i; size: %i\n",
 	      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
 	      i,

-----------------------------------------------------------------------

Summary of changes:
 src/secmem.c | 213 +++++++++++++++++++++++++++++++++++------------------------
 1 file changed, 127 insertions(+), 86 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 21:51:16 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 06 Dec 2016 21:51:16 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-22-g984a97f
Message-ID: <E1cEMhq-0007jJ-Kk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  984a97f0750f812f0ad3c343ee6a67560953a504 (commit)
      from  603f479a919311f720a05da738150c2192d5e562 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 984a97f0750f812f0ad3c343ee6a67560953a504
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 6 21:44:33 2016 +0100

    Fix possible NULL-deref in gcry_log_debugsxp
    
    * src/misc.c (_gcry_log_printsxp): Prevent passing NULL to strlen.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/misc.c b/src/misc.c
index 413d7d8..9d8b7bd 100644
--- a/src/misc.c
+++ b/src/misc.c
@@ -406,7 +406,7 @@ _gcry_log_printsxp (const char *text, gcry_sexp_t sexp)
       do
         {
           if (any && !with_lf)
-            log_debug ("%*s  ", (int)strlen(text), "");
+            log_debug ("%*s  ", text?(int)strlen(text):0, "");
           else
             any = 1;
           pend = strchr (p, '\n');

-----------------------------------------------------------------------

Summary of changes:
 src/misc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 21:58:16 2016
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Tue, 06 Dec 2016 21:58:16 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-63-g8636ad5
Message-ID: <E1cEMoc-0007qU-P0@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  8636ad5023a1bdc527add40a5508f8c5b7c35221 (commit)
      from  e352ead43fbb0180e1f1c71bf1a000d1954eb777 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8636ad5023a1bdc527add40a5508f8c5b7c35221
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Tue Dec 6 11:01:22 2016 -0500

    agent: Respect --enable-large-secmem
    
    * agent/gpg-agent.c (main): Initialize secmem to the configured buffer
    size.
    
    --
    
    This patch is a step toward addressing
    GnuPG-bug-id: 2857
    
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 710357c..5e2e4bf 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -1055,7 +1055,7 @@ main (int argc, char **argv )
     }
 
   /* Initialize the secure memory. */
-  gcry_control (GCRYCTL_INIT_SECMEM, 32768, 0);
+  gcry_control (GCRYCTL_INIT_SECMEM, SECMEM_BUFFER_SIZE, 0);
   maybe_setuid = 0;
 
   /*

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec  6 22:21:41 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 06 Dec 2016 22:21:41 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-23-g995ce69
Message-ID: <E1cENBH-0000hy-Mf@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  995ce697308320c6a52a307f83dc49eeb8d784b4 (commit)
      from  984a97f0750f812f0ad3c343ee6a67560953a504 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 995ce697308320c6a52a307f83dc49eeb8d784b4
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 6 22:19:04 2016 +0100

    Fix compiler warning about possible-NULL-dreference
    
    * src/mpi.h (mpi_is_const, mpi_is_immutable): Do check arg before
    deref-ing.  The are only used at places where the arg shall not be NULL.
    --
    
    This was designed as a general purpose macro and written in a
    defensive way.  However, if it a NULL would be passed to that macro
    code run in the else branch will deref the arg anyway.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/mpi.h b/src/mpi.h
index cd539f5..b5385b5 100644
--- a/src/mpi.h
+++ b/src/mpi.h
@@ -109,8 +109,8 @@ struct gcry_mpi
 void _gcry_mpi_immutable_failed (void);
 #define mpi_immutable_failed() _gcry_mpi_immutable_failed ()
 
-#define mpi_is_const(a)       ((a) && ((a)->flags&32))
-#define mpi_is_immutable(a)   ((a) && ((a)->flags&16))
+#define mpi_is_const(a)       ((a)->flags&32)
+#define mpi_is_immutable(a)   ((a)->flags&16)
 #define mpi_is_opaque(a)      ((a) && ((a)->flags&4))
 #define mpi_is_secure(a)      ((a) && ((a)->flags&1))
 #define mpi_clear(a)          _gcry_mpi_clear ((a))

-----------------------------------------------------------------------

Summary of changes:
 src/mpi.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec  7 15:13:43 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 07 Dec 2016 15:13:43 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-65-gdec2ae3
Message-ID: <E1cEcyg-0006zd-Se@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dec2ae31a46a0f41886c7ad228865cc573f2dea9 (commit)
       via  92df40a3a2ae471fbba00d6d7040230404931fd4 (commit)
      from  8636ad5023a1bdc527add40a5508f8c5b7c35221 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dec2ae31a46a0f41886c7ad228865cc573f2dea9
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 7 15:12:19 2016 +0100

    tests: Add test for '--quick-set-expire'.
    
    * tests/openpgp/quick-key-manipulation.scm: Test '--quick-set-expire'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index 4f0eec2..d6bdde0 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -49,6 +49,9 @@
 
 (assert (= 1 (count-uids-of-secret-key alpha)))
 
+(define fpr (list-ref (assoc "fpr" (gpg-with-colons `(-k ,(exact alpha))))
+		      9))
+
 (info "Checking that we can add a user ID...")
 
 ;; Make sure the key capabilities don't change when we add a user id.
@@ -75,3 +78,22 @@
 (call-check `(, at GPG --quick-revuid ,(exact bravo) ,alpha))
 
 (assert (= 1 (count-uids-of-secret-key bravo)))
+
+(info "Checking that we can change the expiration time.")
+
+(define (expiration-time id)
+  (list-ref (assoc "pub" (gpg-with-colons `(-k ,id)))
+	    6))
+
+;; XXX This assumes that by default keys are created without
+;; expiration date.  See issue2701.
+(assert (equal? "" (expiration-time fpr)))
+
+;; Make the key expire in one year.
+(call-check `(, at gpg --quick-set-expire ,fpr "1y"))
+;; XXX It'd be nice to check that the value is right.
+(assert (not (equal? "" (expiration-time fpr))))
+
+;; And remove the expiration date.
+(call-check `(, at gpg --quick-set-expire ,fpr "0"))
+(assert (equal? "" (expiration-time fpr)))

commit 92df40a3a2ae471fbba00d6d7040230404931fd4
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 7 14:49:49 2016 +0100

    tests: Improve quick key manipulation test.
    
    * tests/openpgp/quick-key-manipulation.scm: Do not update the trust
    database, rather be more specific when filtering the user ids.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index 4579081..4f0eec2 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -29,7 +29,7 @@
 
 (define (count-uids-of-secret-key id)
   (length (filter (lambda (x) (and (string=? "uid" (car x))
-				   (string=? "u" (cadr x))))
+				   (not (string=? "r" (cadr x)))))
 		  (gpg-with-colons
 		   `(--with-fingerprint
 		     --list-secret-keys ,(exact id))))))
@@ -47,8 +47,6 @@
 (info "Checking quick key generation...")
 (call-check `(, at GPG --quick-gen-key ,alpha))
 
-(call-check `(, at GPG --check-trustdb)) ; XXX why?
-
 (assert (= 1 (count-uids-of-secret-key alpha)))
 
 (info "Checking that we can add a user ID...")
@@ -70,14 +68,10 @@
 	(newline)
 	(exit 1))))
 
-(call-check `(, at GPG --check-trustdb)) ; XXX why?
-
 (assert (= 2 (count-uids-of-secret-key alpha)))
 (assert (= 2 (count-uids-of-secret-key bravo)))
 
 (info "Checking that we can revoke a user ID...")
 (call-check `(, at GPG --quick-revuid ,(exact bravo) ,alpha))
 
-(call-check `(, at GPG --check-trustdb)) ; XXX why?
-
 (assert (= 1 (count-uids-of-secret-key bravo)))

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/quick-key-manipulation.scm | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec  7 17:04:41 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 07 Dec 2016 17:04:41 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-27-g95bac31
Message-ID: <E1cEei3-0003ki-St@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  95bac312644ad45e486c94c2efd25d0748b9a20b (commit)
       via  b6870cf25c0b1eb9c127a94af8326c446421a472 (commit)
       via  b7df907dca4d525f8930c533b763ffce44ceed87 (commit)
       via  e366c19b34922c770af82cd035fd815680b29dee (commit)
      from  995ce697308320c6a52a307f83dc49eeb8d784b4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 95bac312644ad45e486c94c2efd25d0748b9a20b
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 17:01:19 2016 +0100

    Document the overflow pools and add a stupid test case.
    
    * tests/t-secmem.c (test_secmem_overflow): New func.
    (main): Disable warning and call new function.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index 933d22d..cb539da 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -422,8 +422,11 @@ and freed memory, you need to initialize Libgcrypt this way:
      process might still be running with increased privileges and that
      the secure memory has not been initialized.  */
 
-  /* Allocate a pool of 16k secure memory.  This make the secure memory
-     available and also drops privileges where needed.  */
+  /* Allocate a pool of 16k secure memory.  This makes the secure memory
+     available and also drops privileges where needed.  Note that by
+     using functions like gcry_xmalloc_secure and gcry_mpi_snew Libgcrypt
+     may extend the secure memory pool with memory which lacks the
+     property of not being swapped out to disk.   */
   gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
 
 @anchor{sample-use-resume-secmem}
@@ -667,7 +670,10 @@ it right away.  This command should be executed right after
 This command disables the use of the mlock call for secure memory.
 Disabling the use of mlock may for example be done if an encrypted
 swap space is in use.  This command should be executed right after
- at code{gcry_check_version}.
+ at code{gcry_check_version}.  Note that by using functions like
+gcry_xmalloc_secure and gcry_mpi_snew Libgcrypt may extend the secure
+memory pool with memory which lacks the property of not being swapped
+out to disk (but will still be zeroed out on free).
 
 @item GCRYCTL_DISABLE_PRIV_DROP; Arguments: none
 This command sets a global flag to tell the secure memory subsystem
diff --git a/tests/t-secmem.c b/tests/t-secmem.c
index b464d02..cb2313e 100644
--- a/tests/t-secmem.c
+++ b/tests/t-secmem.c
@@ -57,6 +57,31 @@ test_secmem (void)
 }
 
 
+static void
+test_secmem_overflow (void)
+{
+  void *a[150];
+  int i;
+
+  memset (a, 0, sizeof a);
+
+  /* Allocating 150*512=75k should require more than one overflow buffer.  */
+  for (i=0; i < DIM(a); i++)
+    {
+      a[i] = gcry_xmalloc_secure (512);
+      if (verbose && !(i %40))
+        gcry_control (GCRYCTL_DUMP_SECMEM_STATS, 0 , 0);
+    }
+
+  if (debug)
+    gcry_control (PRIV_CTL_DUMP_SECMEM_STATS, 0 , 0);
+  if (verbose)
+    gcry_control (GCRYCTL_DUMP_SECMEM_STATS, 0 , 0);
+  for (i=0; i < DIM(a); i++)
+    xfree (a[i]);
+}
+
+
 /* This function is called when we ran out of core and there is no way
  * to return that error to the caller (xmalloc or mpi allocation).  */
 static int
@@ -132,10 +157,24 @@ main (int argc, char **argv)
   gcry_set_outofcore_handler (outofcore_handler, NULL);
   gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
 
+  /* Libgcrypt prints a warning when the first overflow is allocated;
+   * we do not want to see that.  */
+  if (!verbose)
+    gcry_control (GCRYCTL_DISABLE_SECMEM_WARN, 0);
+
+
   test_secmem ();
+  test_secmem_overflow ();
+  /* FIXME: We need to improve the tests, for example by registering
+   * our own log handler and comparing the output of
+   * PRIV_CTL_DUMP_SECMEM_STATS to expected pattern.  */
 
   if (verbose)
-    gcry_control (PRIV_CTL_DUMP_SECMEM_STATS, 0 , 0);
+    {
+      gcry_control (PRIV_CTL_DUMP_SECMEM_STATS, 0 , 0);
+      gcry_control (GCRYCTL_DUMP_SECMEM_STATS, 0 , 0);
+    }
   info ("All tests completed.  Errors: %d\n", errorcount);
+  gcry_control (GCRYCTL_TERM_SECMEM, 0 , 0);
   return !!errorcount;
 }

commit b6870cf25c0b1eb9c127a94af8326c446421a472
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 16:59:57 2016 +0100

    Implement overflow secmem pools for xmalloc style allocators.
    
    * src/secmem.c (pooldesc_s): Add fields next, cur_alloced, and
    cur_blocks.
    (cur_alloced, cur_blocks): Remove vars.
    (ptr_into_pool_p): Make it inline.
    (stats_update): Add arg pool and update the new pool specific
    counters.
    (_gcry_secmem_malloc_internal): Add arg xhint and allocate overflow
    pools as needed.
    (_gcry_secmem_malloc): Pass XHINTS along.
    (_gcry_secmem_realloc_internal): Ditto.
    (_gcry_secmem_realloc): Ditto.
    (_gcry_secmem_free_internal): Take multiple pools in account.  Add
    return value to indicate whether the arg was freed.
    (_gcry_secmem_free): Add return value to indicate whether the arg was
    freed.
    (_gcry_private_is_secure): Take multiple pools in account.
    (_gcry_secmem_term): Release all pools.
    (_gcry_secmem_dump_stats): Print stats for all pools.
    * src/stdmem.c (_gcry_private_free): Replace _gcry_private_is_secure
    test with a direct call of _gcry_secmem_free to avoid double checking.
    --
    
    This patch avoids process termination due to an out-of-secure-memory
    condition in the MPI subsystem.  We consider it more important to have
    reliable MPI computations than process termination due the need for
    memory which is protected against being swapped out.  Using encrypted
    swap is anyway a more reliable protection than those mlock'ed pages.
    Note also that mlock'ed pages won't help against hibernation.
    
    GnuPG-bug-id: 2857
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/secmem.c b/src/secmem.c
index 928e03f..4fa267b 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -62,6 +62,10 @@ typedef struct memblock
 /* An object describing a memory pool.  */
 typedef struct pooldesc_s
 {
+  /* A link to the next pool.  This is used to connect the overflow
+   * pools.  */
+  struct pooldesc_s *next;
+
   /* A memory buffer used as allocation pool.  */
   void *mem;
 
@@ -75,10 +79,15 @@ typedef struct pooldesc_s
   /* Flag indicating whether MEM is mmapped.  */
   volatile int is_mmapped;
 
+  /* The number of allocated bytes and the number of used blocks in
+   * this pool.  */
+  unsigned int cur_alloced, cur_blocks;
 } pooldesc_t;
 
 
-/* The pool of secure memory.  */
+/* The pool of secure memory.  This is the head of a linked list with
+ * the first element being the standard mlock-ed pool and the
+ * following elements being the overflow pools. */
 static pooldesc_t mainpool;
 
 
@@ -91,9 +100,6 @@ static int suspend_warning;
 static int no_mlock;
 static int no_priv_drop;
 
-/* Stats.  */
-static unsigned int cur_alloced, cur_blocks;
-
 /* Lock protecting accesses to the memory pools.  */
 GPGRT_LOCK_DEFINE (secmem_lock);
 
@@ -111,7 +117,7 @@ GPGRT_LOCK_DEFINE (secmem_lock);
   (memblock_t *) (void *) ((char *) addr - BLOCK_HEAD_SIZE)
 
 /* Check whether P points into POOL.  */
-static int
+static inline int
 ptr_into_pool_p (pooldesc_t *pool, const void *p)
 {
   /* We need to convert pointers to addresses.  This is required by
@@ -126,17 +132,17 @@ ptr_into_pool_p (pooldesc_t *pool, const void *p)
 
 /* Update the stats.  */
 static void
-stats_update (size_t add, size_t sub)
+stats_update (pooldesc_t *pool, size_t add, size_t sub)
 {
   if (add)
     {
-      cur_alloced += add;
-      cur_blocks++;
+      pool->cur_alloced += add;
+      pool->cur_blocks++;
     }
   if (sub)
     {
-      cur_alloced -= sub;
-      cur_blocks--;
+      pool->cur_alloced -= sub;
+      pool->cur_blocks--;
     }
 }
 
@@ -567,7 +573,7 @@ _gcry_secmem_module_init ()
 
 
 static void *
-_gcry_secmem_malloc_internal (size_t size)
+_gcry_secmem_malloc_internal (size_t size, int xhint)
 {
   pooldesc_t *pool;
   memblock_t *mb;
@@ -603,9 +609,63 @@ _gcry_secmem_malloc_internal (size_t size)
 
   mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
   if (mb)
-    stats_update (size, 0);
+    {
+      stats_update (pool, size, 0);
+      return &mb->aligned.c;
+    }
+
+  /* If we are called from xmalloc style function resort to the
+   * overflow pools to return memory.  We don't do this in FIPS mode,
+   * though. */
+  if (xhint && !fips_mode ())
+    {
+      for (pool = pool->next; pool; pool = pool->next)
+        {
+          mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
+          if (mb)
+            {
+              stats_update (pool, size, 0);
+              return &mb->aligned.c;
+            }
+        }
+      /* Allocate a new overflow pool.  We put a new pool right after
+       * the mainpool so that the next allocation will happen in that
+       * pool and not in one of the older pools.  When this new pool
+       * gets full we will try to find space in the older pools.  */
+      pool = calloc (1, sizeof *pool);
+      if (!pool)
+        return NULL;  /* Not enough memory for a new pool descriptor.  */
+      pool->size = STANDARD_POOL_SIZE;
+      pool->mem = malloc (pool->size);
+      if (!pool->mem)
+        return NULL; /* Not enough memory available for a new pool.  */
+      /* Initialize first memory block.  */
+      mb = (memblock_t *) pool->mem;
+      mb->size = pool->size;
+      mb->flags = 0;
+
+      pool->okay = 1;
+
+      /* Take care: in _gcry_private_is_secure we do not lock and thus
+       * we assume that the second assignment below is atomic.  */
+      pool->next = mainpool.next;
+      mainpool.next = pool;
+
+      /* After the first time we allocated an overflow pool, print a
+       * warning.  */
+      if (!pool->next)
+        print_warn ();
+
+      /* Allocate.  */
+      mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
+      if (mb)
+        {
+          stats_update (pool, size, 0);
+          return &mb->aligned.c;
+        }
+    }
 
-  return mb ? &mb->aligned.c : NULL;
+  return NULL;
 }
 
 
@@ -617,20 +677,24 @@ _gcry_secmem_malloc (size_t size, int xhint)
   void *p;
 
   SECMEM_LOCK;
-  p = _gcry_secmem_malloc_internal (size);
+  p = _gcry_secmem_malloc_internal (size, xhint);
   SECMEM_UNLOCK;
 
   return p;
 }
 
-static void
+static int
 _gcry_secmem_free_internal (void *a)
 {
   pooldesc_t *pool;
   memblock_t *mb;
   int size;
 
-  pool = &mainpool;
+  for (pool = &mainpool; pool; pool = pool->next)
+    if (pool->okay && ptr_into_pool_p (pool, a))
+      break;
+  if (!pool)
+    return 0; /* A does not belong to use.  */
 
   mb = ADDR_TO_BLOCK (a);
   size = mb->size;
@@ -646,29 +710,35 @@ _gcry_secmem_free_internal (void *a)
   MB_WIPE_OUT (0x00);
 
   /* Update stats.  */
-  stats_update (0, size);
+  stats_update (pool, 0, size);
 
   mb->flags &= ~MB_FLAG_ACTIVE;
 
-
   mb_merge (pool, mb);
+
+  return 1; /* Freed.  */
 }
 
-/* Wipe out and release memory.  */
-void
+
+/* Wipe out and release memory.  Returns true if this function
+ * actually released A.  */
+int
 _gcry_secmem_free (void *a)
 {
+  int mine;
+
   if (!a)
-    return;
+    return 1; /* Tell caller that we handled it.  */
 
   SECMEM_LOCK;
-  _gcry_secmem_free_internal (a);
+  mine = _gcry_secmem_free_internal (a);
   SECMEM_UNLOCK;
+  return mine;
 }
 
 
 static void *
-_gcry_secmem_realloc_internal (void *p, size_t newsize)
+_gcry_secmem_realloc_internal (void *p, size_t newsize, int xhint)
 {
   memblock_t *mb;
   size_t size;
@@ -684,7 +754,7 @@ _gcry_secmem_realloc_internal (void *p, size_t newsize)
     }
   else
     {
-      a = _gcry_secmem_malloc_internal (newsize);
+      a = _gcry_secmem_malloc_internal (newsize, xhint);
       if (a)
 	{
 	  memcpy (a, p, size);
@@ -705,21 +775,27 @@ _gcry_secmem_realloc (void *p, size_t newsize, int xhint)
   void *a;
 
   SECMEM_LOCK;
-  a = _gcry_secmem_realloc_internal (p, newsize);
+  a = _gcry_secmem_realloc_internal (p, newsize, xhint);
   SECMEM_UNLOCK;
 
   return a;
 }
 
 
-/* Return true if P points into the secure memory area.  */
+/* Return true if P points into the secure memory areas.  */
 int
 _gcry_private_is_secure (const void *p)
 {
   pooldesc_t *pool;
 
-  pool = &mainpool;
-  return pool->okay && ptr_into_pool_p (pool, p);
+  /* We do no lock here because once a pool is allocatred it will not
+   * be removed anymore (except for gcry_secmem_term).  Further,
+   * adding a new pool to the list should be atomic.  */
+  for (pool = &mainpool; pool; pool = pool->next)
+    if (pool->okay && ptr_into_pool_p (pool, p))
+      return 1;
+
+  return 0;
 }
 
 
@@ -734,23 +810,33 @@ _gcry_private_is_secure (const void *p)
 void
 _gcry_secmem_term ()
 {
-  pooldesc_t *pool;
+  pooldesc_t *pool, *next;
 
-  pool = &mainpool;
-  if (!pool->okay)
-    return;
-
-  wipememory2 (pool->mem, 0xff, pool->size);
-  wipememory2 (pool->mem, 0xaa, pool->size);
-  wipememory2 (pool->mem, 0x55, pool->size);
-  wipememory2 (pool->mem, 0x00, pool->size);
+  for (pool = &mainpool; pool; pool = next)
+    {
+      next = pool->next;
+      if (!pool->okay)
+        continue;
+
+      wipememory2 (pool->mem, 0xff, pool->size);
+      wipememory2 (pool->mem, 0xaa, pool->size);
+      wipememory2 (pool->mem, 0x55, pool->size);
+      wipememory2 (pool->mem, 0x00, pool->size);
+      if (0)
+        ;
 #if HAVE_MMAP
-  if (pool->is_mmapped)
-    munmap (pool->mem, pool->size);
+      else if (pool->is_mmapped)
+        munmap (pool->mem, pool->size);
 #endif
-  pool->mem = NULL;
-  pool->okay = 0;
-  pool->size = 0;
+      else
+        free (pool->mem);
+      pool->mem = NULL;
+      pool->okay = 0;
+      pool->size = 0;
+      if (pool != &mainpool)
+        free (pool);
+    }
+  mainpool.next = NULL;
   not_locked = 0;
 }
 
@@ -762,28 +848,31 @@ _gcry_secmem_dump_stats (int extended)
 {
   pooldesc_t *pool;
   memblock_t *mb;
-  int i;
+  int i, poolno;
 
   SECMEM_LOCK;
 
-  pool = &mainpool;
-  if (!extended)
+  for (pool = &mainpool, poolno = 0; pool; pool = pool->next, poolno++)
     {
-      if (pool->okay)
-        log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
-                  cur_alloced, (unsigned long)pool->size, cur_blocks);
+      if (!extended)
+        {
+          if (pool->okay)
+            log_info ("%-13s %u/%lu bytes in %u blocks\n",
+                      pool == &mainpool? "secmem usage:":"",
+                      pool->cur_alloced, (unsigned long)pool->size,
+                      pool->cur_blocks);
+        }
+      else
+        {
+          for (i = 0, mb = (memblock_t *) pool->mem;
+               ptr_into_pool_p (pool, mb);
+               mb = mb_get_next (pool, mb), i++)
+            log_info ("SECMEM: pool %d %s block %i size %i\n",
+                      poolno,
+                      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
+                      i,
+                      mb->size);
+        }
     }
-  else
-    {
-      for (i = 0, mb = (memblock_t *) pool->mem;
-           ptr_into_pool_p (pool, mb);
-           mb = mb_get_next (pool, mb), i++)
-        log_info ("SECMEM: pool %p %s block %i size %i\n",
-                  pool,
-                  (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
-                  i,
-                  mb->size);
-      }
-
   SECMEM_UNLOCK;
 }
diff --git a/src/secmem.h b/src/secmem.h
index c69fe88..29dd64f 100644
--- a/src/secmem.h
+++ b/src/secmem.h
@@ -25,7 +25,7 @@ void _gcry_secmem_init (size_t npool);
 void _gcry_secmem_term (void);
 void *_gcry_secmem_malloc (size_t size, int xhint) _GCRY_GCC_ATTR_MALLOC;
 void *_gcry_secmem_realloc (void *a, size_t newsize, int xhint);
-void _gcry_secmem_free (void *a);
+int  _gcry_secmem_free (void *a);
 void _gcry_secmem_dump_stats (int extended);
 void _gcry_secmem_set_flags (unsigned flags);
 unsigned _gcry_secmem_get_flags(void);
diff --git a/src/stdmem.c b/src/stdmem.c
index cf937ff..cbda8d8 100644
--- a/src/stdmem.c
+++ b/src/stdmem.c
@@ -230,15 +230,13 @@ _gcry_private_free (void *a)
   if (use_m_guard )
     {
       _gcry_private_check_heap(p);
-      if ( _gcry_private_is_secure(a) )
-        _gcry_secmem_free(p-EXTRA_ALIGN-4);
-      else
+      if (! _gcry_secmem_free (p - EXTRA_ALIGN - 4))
         {
-          free(p-EXTRA_ALIGN-4);
+          free (p - EXTRA_ALIGN - 4);
 	}
     }
-  else if ( _gcry_private_is_secure(a) )
-    _gcry_secmem_free(p);
-  else
-    free(p);
+  else if (!_gcry_secmem_free (p))
+    {
+      free(p);
+    }
 }

commit b7df907dca4d525f8930c533b763ffce44ceed87
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 10:37:50 2016 +0100

    Give the secmem allocators a hint when a xmalloc calls them.
    
    * src/secmem.c (_gcry_secmem_malloc): New not yet used arg XHINT.
    (_gcry_secmem_realloc): Ditto.
    * src/stdmem.c (_gcry_private_malloc_secure): New arg XHINT to be
    passed to the secmem functions.
    (_gcry_private_realloc): Ditto.
    * src/g10lib.h (GCRY_ALLOC_FLAG_XHINT): New.
    * src/global.c (do_malloc): Pass this flag as XHINT to the private
    allocator.
    (_gcry_malloc_secure): Factor code out to ...
    (_gcry_malloc_secure_core): this.  Add arg XHINT.
    (_gcry_realloc): Factor code out to ...
    (_gcry_realloc_core): here.  Add arg XHINT.
    (_gcry_strdup): Factor code out to ...
    (_gcry_strdup_core): here.  Add arg XHINT.
    (_gcry_xrealloc): Use the core function and pass true for XHINT.
    (_gcry_xmalloc_secure): Ditto.
    (_gcry_xstrdup): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/g10lib.h b/src/g10lib.h
index d4e3fef..f0a4628 100644
--- a/src/g10lib.h
+++ b/src/g10lib.h
@@ -392,6 +392,7 @@ gcry_err_code_t _gcry_mpi_init (void);
 
 /* Memory management.  */
 #define GCRY_ALLOC_FLAG_SECURE (1 << 0)
+#define GCRY_ALLOC_FLAG_XHINT  (1 << 1)  /* Called from xmalloc.  */
 
 
 /*-- sexp.c --*/
diff --git a/src/global.c b/src/global.c
index be112b7..cfb7618 100644
--- a/src/global.c
+++ b/src/global.c
@@ -787,7 +787,7 @@ do_malloc (size_t n, unsigned int flags, void **mem)
       if (alloc_secure_func)
 	m = (*alloc_secure_func) (n);
       else
-	m = _gcry_private_malloc_secure (n);
+	m = _gcry_private_malloc_secure (n, !!(flags & GCRY_ALLOC_FLAG_XHINT));
     }
   else
     {
@@ -821,16 +821,23 @@ _gcry_malloc (size_t n)
   return mem;
 }
 
-void *
-_gcry_malloc_secure (size_t n)
+static void *
+_gcry_malloc_secure_core (size_t n, int xhint)
 {
   void *mem = NULL;
 
-  do_malloc (n, GCRY_ALLOC_FLAG_SECURE, &mem);
+  do_malloc (n, (GCRY_ALLOC_FLAG_SECURE | (xhint? GCRY_ALLOC_FLAG_XHINT:0)),
+             &mem);
 
   return mem;
 }
 
+void *
+_gcry_malloc_secure (size_t n)
+{
+  return _gcry_malloc_secure_core (n, 0);
+}
+
 int
 _gcry_is_secure (const void *a)
 {
@@ -855,8 +862,8 @@ _gcry_check_heap( const void *a )
 #endif
 }
 
-void *
-_gcry_realloc (void *a, size_t n)
+static void *
+_gcry_realloc_core (void *a, size_t n, int xhint)
 {
   void *p;
 
@@ -873,12 +880,20 @@ _gcry_realloc (void *a, size_t n)
   if (realloc_func)
     p = realloc_func (a, n);
   else
-    p =  _gcry_private_realloc (a, n);
+    p =  _gcry_private_realloc (a, n, xhint);
   if (!p && !errno)
     gpg_err_set_errno (ENOMEM);
   return p;
 }
 
+
+void *
+_gcry_realloc (void *a, size_t n)
+{
+  return _gcry_realloc_core (a, n, 0);
+}
+
+
 void
 _gcry_free (void *p)
 {
@@ -941,12 +956,8 @@ _gcry_calloc_secure (size_t n, size_t m)
 }
 
 
-/* Create and return a copy of the null-terminated string STRING.  If
-   it is contained in secure memory, the copy will be contained in
-   secure memory as well.  In an out-of-memory condition, NULL is
-   returned.  */
-char *
-_gcry_strdup (const char *string)
+static char *
+_gcry_strdup_core (const char *string, int xhint)
 {
   char *string_cp = NULL;
   size_t string_n = 0;
@@ -954,7 +965,7 @@ _gcry_strdup (const char *string)
   string_n = strlen (string);
 
   if (_gcry_is_secure (string))
-    string_cp = _gcry_malloc_secure (string_n + 1);
+    string_cp = _gcry_malloc_secure_core (string_n + 1, xhint);
   else
     string_cp = _gcry_malloc (string_n + 1);
 
@@ -964,6 +975,15 @@ _gcry_strdup (const char *string)
   return string_cp;
 }
 
+/* Create and return a copy of the null-terminated string STRING.  If
+ * it is contained in secure memory, the copy will be contained in
+ * secure memory as well.  In an out-of-memory condition, NULL is
+ * returned.  */
+char *
+_gcry_strdup (const char *string)
+{
+  return _gcry_strdup_core (string, 0);
+}
 
 void *
 _gcry_xmalloc( size_t n )
@@ -987,7 +1007,7 @@ _gcry_xrealloc( void *a, size_t n )
 {
   void *p;
 
-  while ( !(p = _gcry_realloc( a, n )) )
+  while (!(p = _gcry_realloc_core (a, n, 1)))
     {
       if ( fips_mode ()
            || !outofcore_handler
@@ -1005,7 +1025,7 @@ _gcry_xmalloc_secure( size_t n )
 {
   void *p;
 
-  while ( !(p = _gcry_malloc_secure( n )) )
+  while (!(p = _gcry_malloc_secure_core (n, 1)))
     {
       if ( fips_mode ()
            || !outofcore_handler
@@ -1060,7 +1080,7 @@ _gcry_xstrdup (const char *string)
 {
   char *p;
 
-  while ( !(p = _gcry_strdup (string)) )
+  while ( !(p = _gcry_strdup_core (string, 1)) )
     {
       size_t n = strlen (string);
       int is_sec = !!_gcry_is_secure (string);
diff --git a/src/secmem.c b/src/secmem.c
index 54bbda1..928e03f 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -608,8 +608,11 @@ _gcry_secmem_malloc_internal (size_t size)
   return mb ? &mb->aligned.c : NULL;
 }
 
+
+/* Allocate a block from the secmem of SIZE.  With XHINT set assume
+ * that the caller is a xmalloc style function.  */
 void *
-_gcry_secmem_malloc (size_t size)
+_gcry_secmem_malloc (size_t size, int xhint)
 {
   void *p;
 
@@ -694,9 +697,10 @@ _gcry_secmem_realloc_internal (void *p, size_t newsize)
 }
 
 
-/* Realloc memory.  */
+/* Realloc memory.  With XHINT set assume that the caller is a xmalloc
+ * style function.  */
 void *
-_gcry_secmem_realloc (void *p, size_t newsize)
+_gcry_secmem_realloc (void *p, size_t newsize, int xhint)
 {
   void *a;
 
diff --git a/src/secmem.h b/src/secmem.h
index 764bfeb..c69fe88 100644
--- a/src/secmem.h
+++ b/src/secmem.h
@@ -23,8 +23,8 @@
 
 void _gcry_secmem_init (size_t npool);
 void _gcry_secmem_term (void);
-void *_gcry_secmem_malloc (size_t size) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_secmem_realloc (void *a, size_t newsize);
+void *_gcry_secmem_malloc (size_t size, int xhint) _GCRY_GCC_ATTR_MALLOC;
+void *_gcry_secmem_realloc (void *a, size_t newsize, int xhint);
 void _gcry_secmem_free (void *a);
 void _gcry_secmem_dump_stats (int extended);
 void _gcry_secmem_set_flags (unsigned flags);
diff --git a/src/stdmem.c b/src/stdmem.c
index 189da37..cf937ff 100644
--- a/src/stdmem.c
+++ b/src/stdmem.c
@@ -117,10 +117,11 @@ _gcry_private_malloc (size_t n)
 
 /*
  * Allocate memory of size N from the secure memory pool.  Return NULL
- * if we are out of memory.
+ * if we are out of memory.  XHINT tells the allocator that the caller
+ * used an xmalloc style call.
  */
 void *
-_gcry_private_malloc_secure (size_t n)
+_gcry_private_malloc_secure (size_t n, int xhint)
 {
   if (!n)
     {
@@ -133,7 +134,7 @@ _gcry_private_malloc_secure (size_t n)
     {
       char *p;
 
-      if ( !(p = _gcry_secmem_malloc (n +EXTRA_ALIGN+ 5)) )
+      if (!(p = _gcry_secmem_malloc (n + EXTRA_ALIGN + 5, xhint)))
         return NULL;
       ((byte*)p)[EXTRA_ALIGN+0] = n;
       ((byte*)p)[EXTRA_ALIGN+1] = n >> 8 ;
@@ -144,17 +145,18 @@ _gcry_private_malloc_secure (size_t n)
     }
   else
     {
-      return _gcry_secmem_malloc( n );
+      return _gcry_secmem_malloc (n, xhint);
     }
 }
 
 
 /*
- * Realloc and clear the old space
- * Return NULL if there is not enough memory.
+ * Realloc and clear the old space.  XHINT tells the allocator that
+ * the caller used an xmalloc style call.  Returns NULL if there is
+ * not enough memory.
  */
 void *
-_gcry_private_realloc ( void *a, size_t n )
+_gcry_private_realloc (void *a, size_t n, int xhint)
 {
   if (use_m_guard)
     {
@@ -172,7 +174,7 @@ _gcry_private_realloc ( void *a, size_t n )
       if( len >= n ) /* We don't shrink for now. */
         return a;
       if (p[-1] == MAGIC_SEC_BYTE)
-        b = _gcry_private_malloc_secure(n);
+        b = _gcry_private_malloc_secure (n, xhint);
       else
         b = _gcry_private_malloc(n);
       if (!b)
@@ -184,7 +186,7 @@ _gcry_private_realloc ( void *a, size_t n )
     }
   else if ( _gcry_private_is_secure(a) )
     {
-      return _gcry_secmem_realloc( a, n );
+      return _gcry_secmem_realloc (a, n, xhint);
     }
   else
     {
diff --git a/src/stdmem.h b/src/stdmem.h
index b476e7e..c52aab5 100644
--- a/src/stdmem.h
+++ b/src/stdmem.h
@@ -24,8 +24,8 @@
 void _gcry_private_enable_m_guard(void);
 
 void *_gcry_private_malloc (size_t n) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_private_malloc_secure (size_t n) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_private_realloc (void *a, size_t n);
+void *_gcry_private_malloc_secure (size_t n, int xhint) _GCRY_GCC_ATTR_MALLOC;
+void *_gcry_private_realloc (void *a, size_t n, int xhint);
 void _gcry_private_check_heap (const void *a);
 void _gcry_private_free (void *a);
 

commit e366c19b34922c770af82cd035fd815680b29dee
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 10:01:39 2016 +0100

    tests: New test t-secmem.
    
    * src/secmem.c (_gcry_secmem_dump_stats): Add arg EXTENDED and adjust
    caller.
    * src/gcrypt-testapi.h (PRIV_CTL_DUMP_SECMEM_STATS): New.
    * src/global.c (_gcry_vcontrol): Implement that.
    * tests/t-secmem.c: New.
    * tests/Makefile.am (tests_bin): Add that test.
    --
    
    This test does not much right now.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gcrypt-testapi.h b/src/gcrypt-testapi.h
index 23d3800..0417754 100644
--- a/src/gcrypt-testapi.h
+++ b/src/gcrypt-testapi.h
@@ -31,6 +31,7 @@
 #define PRIV_CTL_RUN_EXTRNG_TEST    59
 #define PRIV_CTL_DEINIT_EXTRNG_TEST 60
 #define PRIV_CTL_EXTERNAL_LOCK_TEST 61
+#define PRIV_CTL_DUMP_SECMEM_STATS  62
 
 #define EXTERNAL_LOCK_TEST_INIT       30111
 #define EXTERNAL_LOCK_TEST_LOCK       30112
diff --git a/src/global.c b/src/global.c
index 8e54efe..be112b7 100644
--- a/src/global.c
+++ b/src/global.c
@@ -380,7 +380,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr)
       break;
 
     case GCRYCTL_DUMP_SECMEM_STATS:
-      _gcry_secmem_dump_stats ();
+      _gcry_secmem_dump_stats (0);
       break;
 
     case GCRYCTL_DROP_PRIVS:
@@ -613,7 +613,8 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr)
     case PRIV_CTL_EXTERNAL_LOCK_TEST:  /* Run external lock test */
       rc = external_lock_test (va_arg (arg_ptr, int));
       break;
-    case 62:  /* RFU */
+    case PRIV_CTL_DUMP_SECMEM_STATS:
+      _gcry_secmem_dump_stats (1);
       break;
 #if _GCRY_GCC_VERSION >= 40600
 # pragma GCC diagnostic pop
diff --git a/src/secmem.c b/src/secmem.c
index 1f92f17..54bbda1 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -751,33 +751,35 @@ _gcry_secmem_term ()
 }
 
 
+/* Print stats of the secmem allocator.  With EXTENDED passwed as true
+ * a detiled listing is returned (used for testing).  */
 void
-_gcry_secmem_dump_stats ()
+_gcry_secmem_dump_stats (int extended)
 {
   pooldesc_t *pool;
-
-#if 1
-  SECMEM_LOCK;
-
-  pool = &mainpool;
-  if (pool->okay)
-    log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
-	      cur_alloced, (unsigned long)pool->size, cur_blocks);
-  SECMEM_UNLOCK;
-#else
   memblock_t *mb;
   int i;
 
   SECMEM_LOCK;
 
   pool = &mainpool;
-  for (i = 0, mb = (memblock_t *) pool->mem;
-       ptr_into_pool_p (pool, mb);
-       mb = mb_get_next (pool, mb), i++)
-    log_info ("SECMEM: [%s] block: %i; size: %i\n",
-	      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
-	      i,
-	      mb->size);
+  if (!extended)
+    {
+      if (pool->okay)
+        log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
+                  cur_alloced, (unsigned long)pool->size, cur_blocks);
+    }
+  else
+    {
+      for (i = 0, mb = (memblock_t *) pool->mem;
+           ptr_into_pool_p (pool, mb);
+           mb = mb_get_next (pool, mb), i++)
+        log_info ("SECMEM: pool %p %s block %i size %i\n",
+                  pool,
+                  (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
+                  i,
+                  mb->size);
+      }
+
   SECMEM_UNLOCK;
-#endif
 }
diff --git a/src/secmem.h b/src/secmem.h
index 3577381..764bfeb 100644
--- a/src/secmem.h
+++ b/src/secmem.h
@@ -26,7 +26,7 @@ void _gcry_secmem_term (void);
 void *_gcry_secmem_malloc (size_t size) _GCRY_GCC_ATTR_MALLOC;
 void *_gcry_secmem_realloc (void *a, size_t newsize);
 void _gcry_secmem_free (void *a);
-void _gcry_secmem_dump_stats (void);
+void _gcry_secmem_dump_stats (int extended);
 void _gcry_secmem_set_flags (unsigned flags);
 unsigned _gcry_secmem_get_flags(void);
 int _gcry_private_is_secure (const void *p);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d462f30..374e72e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -19,7 +19,7 @@
 ## Process this file with automake to produce Makefile.in
 
 tests_bin = \
-        version mpitests t-sexp t-convert \
+        version t-secmem mpitests t-sexp t-convert \
 	t-mpi-bit t-mpi-point curves t-lock \
 	prime basic keygen pubkey hmac hashtest t-kdf keygrip \
 	fips186-dsa aeswrap pkcs1v2 random dsa-rfc6979 t-ed25519 t-cv25519
diff --git a/tests/t-secmem.c b/tests/t-secmem.c
new file mode 100644
index 0000000..b464d02
--- /dev/null
+++ b/tests/t-secmem.c
@@ -0,0 +1,141 @@
+/* t-secmem.c - Test the secmem memory allocator
+ * Copyright (C) 2016 g10 Code GmbH
+ *
+ * This file is part of Libgcrypt.
+ *
+ * Libgcrypt is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * Libgcrypt is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+#define PGMNAME "t-secmem"
+
+#include "t-common.h"
+#include "../src/gcrypt-testapi.h"
+
+
+static void
+test_secmem (void)
+{
+  void *a[28];
+  void *b;
+  int i;
+
+  memset (a, 0, sizeof a);
+
+  /* Allocating 28*512=14k should work in the default 16k pool even
+   * with extrem alignment requirements.  */
+  for (i=0; i < DIM(a); i++)
+    a[i] = gcry_xmalloc_secure (512);
+
+  /* Allocating another 2k should fail for the default 16k pool.  */
+  b = gcry_malloc_secure (2048);
+  if (b)
+    fail ("allocation did not fail as expected\n");
+
+  for (i=0; i < DIM(a); i++)
+    xfree (a[i]);
+  xfree (b);
+}
+
+
+/* This function is called when we ran out of core and there is no way
+ * to return that error to the caller (xmalloc or mpi allocation).  */
+static int
+outofcore_handler (void *opaque, size_t req_n, unsigned int flags)
+{
+  static int been_here;  /* Used to protect against recursive calls. */
+
+  (void)opaque;
+
+  /* Protect against a second call.  */
+  if (been_here)
+    return 0; /* Let libgcrypt call its own fatal error handler.  */
+  been_here = 1;
+
+  info ("outofcore handler invoked");
+  gcry_control (PRIV_CTL_DUMP_SECMEM_STATS, 0 , 0);
+  fail ("out of core%s while allocating %lu bytes",
+       (flags & 1)?" in secure memory":"", (unsigned long)req_n);
+
+  die ("stopped");
+  /*NOTREACHED*/
+  return 0;
+}
+
+
+int
+main (int argc, char **argv)
+{
+  int last_argc = -1;
+
+  if (argc)
+    { argc--; argv++; }
+
+  while (argc && last_argc != argc )
+    {
+      last_argc = argc;
+      if (!strcmp (*argv, "--"))
+        {
+          argc--; argv++;
+          break;
+        }
+      else if (!strcmp (*argv, "--help"))
+        {
+          fputs ("usage: " PGMNAME " [options]\n"
+                 "Options:\n"
+                 "  --verbose       print timings etc.\n"
+                 "  --debug         flyswatter\n"
+                 , stdout);
+          exit (0);
+        }
+      else if (!strcmp (*argv, "--verbose"))
+        {
+          verbose++;
+          argc--; argv++;
+        }
+      else if (!strcmp (*argv, "--debug"))
+        {
+          verbose += 2;
+          debug++;
+          argc--; argv++;
+        }
+      else if (!strncmp (*argv, "--", 2))
+        die ("unknown option '%s'", *argv);
+    }
+
+  if (!gcry_check_version (GCRYPT_VERSION))
+    die ("version mismatch; pgm=%s, library=%s\n",
+         GCRYPT_VERSION, gcry_check_version (NULL));
+  if (debug)
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
+  gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
+  gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
+  gcry_set_outofcore_handler (outofcore_handler, NULL);
+  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+
+  test_secmem ();
+
+  if (verbose)
+    gcry_control (PRIV_CTL_DUMP_SECMEM_STATS, 0 , 0);
+  info ("All tests completed.  Errors: %d\n", errorcount);
+  return !!errorcount;
+}

-----------------------------------------------------------------------

Summary of changes:
 doc/gcrypt.texi      |  12 ++-
 src/g10lib.h         |   1 +
 src/gcrypt-testapi.h |   1 +
 src/global.c         |  59 ++++++++-----
 src/secmem.c         | 227 ++++++++++++++++++++++++++++++++++++---------------
 src/secmem.h         |   8 +-
 src/stdmem.c         |  34 ++++----
 src/stdmem.h         |   4 +-
 tests/Makefile.am    |   2 +-
 tests/t-secmem.c     | 180 ++++++++++++++++++++++++++++++++++++++++
 10 files changed, 416 insertions(+), 112 deletions(-)
 create mode 100644 tests/t-secmem.c


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec  7 17:33:16 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 07 Dec 2016 17:33:16 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.3-23-g1f1ab84
Message-ID: <E1cEf9i-0005Cg-KU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  1f1ab84fd1dea3fee596d3223fe96b154b37aa6f (commit)
       via  73dca02b9cc6d542af153c527190832f9c421ef3 (commit)
       via  1433fce11c90bb44ada51071f342ad67b469ea81 (commit)
       via  2bc361485d8bc0d8cdb3b4ae6e304885eeaab889 (commit)
      from  a8b2d8b502d9cbc9157c261f12e4623ec20b3960 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1f1ab84fd1dea3fee596d3223fe96b154b37aa6f
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 17:01:19 2016 +0100

    doc: Document the overflow pools.
    
    --

diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index c2c39ad..5b5fce2 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -422,8 +422,11 @@ and freed memory, you need to initialize Libgcrypt this way:
      process might still be running with increased privileges and that
      the secure memory has not been initialized.  */
 
-  /* Allocate a pool of 16k secure memory.  This make the secure memory
-     available and also drops privileges where needed.  */
+  /* Allocate a pool of 16k secure memory.  This makes the secure memory
+     available and also drops privileges where needed.  Note that by
+     using functions like gcry_xmalloc_secure and gcry_mpi_snew Libgcrypt
+     may extend the secure memory pool with memory which lacks the
+     property of not being swapped out to disk.   */
   gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
 
 @anchor{sample-use-resume-secmem}
@@ -667,7 +670,10 @@ it right away.  This command should be executed right after
 This command disables the use of the mlock call for secure memory.
 Disabling the use of mlock may for example be done if an encrypted
 swap space is in use.  This command should be executed right after
- at code{gcry_check_version}.
+ at code{gcry_check_version}.  Note that by using functions like
+gcry_xmalloc_secure and gcry_mpi_snew Libgcrypt may extend the secure
+memory pool with memory which lacks the property of not being swapped
+out to disk (but will still be zeroed out on free).
 
 @item GCRYCTL_DISABLE_PRIV_DROP; Arguments: none
 This command sets a global flag to tell the secure memory subsystem

commit 73dca02b9cc6d542af153c527190832f9c421ef3
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 16:59:57 2016 +0100

    Implement overflow secmem pools for xmalloc style allocators.
    
    * src/secmem.c (pooldesc_s): Add fields next, cur_alloced, and
    cur_blocks.
    (cur_alloced, cur_blocks): Remove vars.
    (ptr_into_pool_p): Make it inline.
    (stats_update): Add arg pool and update the new pool specific
    counters.
    (_gcry_secmem_malloc_internal): Add arg xhint and allocate overflow
    pools as needed.
    (_gcry_secmem_malloc): Pass XHINTS along.
    (_gcry_secmem_realloc_internal): Ditto.
    (_gcry_secmem_realloc): Ditto.
    (_gcry_secmem_free_internal): Take multiple pools in account.  Add
    return value to indicate whether the arg was freed.
    (_gcry_secmem_free): Add return value to indicate whether the arg was
    freed.
    (_gcry_private_is_secure): Take multiple pools in account.
    (_gcry_secmem_term): Release all pools.
    (_gcry_secmem_dump_stats): Print stats for all pools.
    * src/stdmem.c (_gcry_private_free): Replace _gcry_private_is_secure
    test with a direct call of _gcry_secmem_free to avoid double checking.
    --
    
    This patch avoids process termination due to an out-of-secure-memory
    condition in the MPI subsystem.  We consider it more important to have
    reliable MPI computations than process termination due the need for
    memory which is protected against being swapped out.  Using encrypted
    swap is anyway a more reliable protection than those mlock'ed pages.
    Note also that mlock'ed pages won't help against hibernation.
    
    GnuPG-bug-id: 2857
    Signed-off-by: Werner Koch <wk at gnupg.org>
    
    (cherry picked from b6870cf25c0b1eb9c127a94af8326c446421a472)
    
    Resolved conflicts:
    * src/secmem.c (_gcry_secmem_dump_stats): Add arg extended.
    * src/secmem.h: Adjust prototype.
    * src/global.c (_gcry_vcontrol): Call _gcry_secmem_dump_stats with
    parm 0.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/global.c b/src/global.c
index f12f7d7..4283460 100644
--- a/src/global.c
+++ b/src/global.c
@@ -367,7 +367,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd, va_list arg_ptr)
       break;
 
     case GCRYCTL_DUMP_SECMEM_STATS:
-      _gcry_secmem_dump_stats ();
+      _gcry_secmem_dump_stats (0);
       break;
 
     case GCRYCTL_DROP_PRIVS:
diff --git a/src/secmem.c b/src/secmem.c
index e838162..9f228f0 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -62,6 +62,10 @@ typedef struct memblock
 /* An object describing a memory pool.  */
 typedef struct pooldesc_s
 {
+  /* A link to the next pool.  This is used to connect the overflow
+   * pools.  */
+  struct pooldesc_s *next;
+
   /* A memory buffer used as allocation pool.  */
   void *mem;
 
@@ -75,10 +79,15 @@ typedef struct pooldesc_s
   /* Flag indicating whether MEM is mmapped.  */
   volatile int is_mmapped;
 
+  /* The number of allocated bytes and the number of used blocks in
+   * this pool.  */
+  unsigned int cur_alloced, cur_blocks;
 } pooldesc_t;
 
 
-/* The pool of secure memory.  */
+/* The pool of secure memory.  This is the head of a linked list with
+ * the first element being the standard mlock-ed pool and the
+ * following elements being the overflow pools. */
 static pooldesc_t mainpool;
 
 
@@ -91,9 +100,6 @@ static int suspend_warning;
 static int no_mlock;
 static int no_priv_drop;
 
-/* Stats.  */
-static unsigned int cur_alloced, cur_blocks;
-
 /* Lock protecting accesses to the memory pools.  */
 GPGRT_LOCK_DEFINE (secmem_lock);
 
@@ -111,7 +117,7 @@ GPGRT_LOCK_DEFINE (secmem_lock);
   (memblock_t *) (void *) ((char *) addr - BLOCK_HEAD_SIZE)
 
 /* Check whether P points into POOL.  */
-static int
+static inline int
 ptr_into_pool_p (pooldesc_t *pool, const void *p)
 {
   /* We need to convert pointers to addresses.  This is required by
@@ -126,17 +132,17 @@ ptr_into_pool_p (pooldesc_t *pool, const void *p)
 
 /* Update the stats.  */
 static void
-stats_update (size_t add, size_t sub)
+stats_update (pooldesc_t *pool, size_t add, size_t sub)
 {
   if (add)
     {
-      cur_alloced += add;
-      cur_blocks++;
+      pool->cur_alloced += add;
+      pool->cur_blocks++;
     }
   if (sub)
     {
-      cur_alloced -= sub;
-      cur_blocks--;
+      pool->cur_alloced -= sub;
+      pool->cur_blocks--;
     }
 }
 
@@ -567,7 +573,7 @@ _gcry_secmem_module_init ()
 
 
 static void *
-_gcry_secmem_malloc_internal (size_t size)
+_gcry_secmem_malloc_internal (size_t size, int xhint)
 {
   pooldesc_t *pool;
   memblock_t *mb;
@@ -603,9 +609,63 @@ _gcry_secmem_malloc_internal (size_t size)
 
   mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
   if (mb)
-    stats_update (size, 0);
+    {
+      stats_update (pool, size, 0);
+      return &mb->aligned.c;
+    }
 
-  return mb ? &mb->aligned.c : NULL;
+  /* If we are called from xmalloc style function resort to the
+   * overflow pools to return memory.  We don't do this in FIPS mode,
+   * though. */
+  if (xhint && !fips_mode ())
+    {
+      for (pool = pool->next; pool; pool = pool->next)
+        {
+          mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
+          if (mb)
+            {
+              stats_update (pool, size, 0);
+              return &mb->aligned.c;
+            }
+        }
+      /* Allocate a new overflow pool.  We put a new pool right after
+       * the mainpool so that the next allocation will happen in that
+       * pool and not in one of the older pools.  When this new pool
+       * gets full we will try to find space in the older pools.  */
+      pool = calloc (1, sizeof *pool);
+      if (!pool)
+        return NULL;  /* Not enough memory for a new pool descriptor.  */
+      pool->size = STANDARD_POOL_SIZE;
+      pool->mem = malloc (pool->size);
+      if (!pool->mem)
+        return NULL; /* Not enough memory available for a new pool.  */
+      /* Initialize first memory block.  */
+      mb = (memblock_t *) pool->mem;
+      mb->size = pool->size;
+      mb->flags = 0;
+
+      pool->okay = 1;
+
+      /* Take care: in _gcry_private_is_secure we do not lock and thus
+       * we assume that the second assignment below is atomic.  */
+      pool->next = mainpool.next;
+      mainpool.next = pool;
+
+      /* After the first time we allocated an overflow pool, print a
+       * warning.  */
+      if (!pool->next)
+        print_warn ();
+
+      /* Allocate.  */
+      mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
+      if (mb)
+        {
+          stats_update (pool, size, 0);
+          return &mb->aligned.c;
+        }
+    }
+
+  return NULL;
 }
 
 
@@ -617,20 +677,24 @@ _gcry_secmem_malloc (size_t size, int xhint)
   void *p;
 
   SECMEM_LOCK;
-  p = _gcry_secmem_malloc_internal (size);
+  p = _gcry_secmem_malloc_internal (size, xhint);
   SECMEM_UNLOCK;
 
   return p;
 }
 
-static void
+static int
 _gcry_secmem_free_internal (void *a)
 {
   pooldesc_t *pool;
   memblock_t *mb;
   int size;
 
-  pool = &mainpool;
+  for (pool = &mainpool; pool; pool = pool->next)
+    if (pool->okay && ptr_into_pool_p (pool, a))
+      break;
+  if (!pool)
+    return 0; /* A does not belong to use.  */
 
   mb = ADDR_TO_BLOCK (a);
   size = mb->size;
@@ -646,29 +710,35 @@ _gcry_secmem_free_internal (void *a)
   MB_WIPE_OUT (0x00);
 
   /* Update stats.  */
-  stats_update (0, size);
+  stats_update (pool, 0, size);
 
   mb->flags &= ~MB_FLAG_ACTIVE;
 
-
   mb_merge (pool, mb);
+
+  return 1; /* Freed.  */
 }
 
-/* Wipe out and release memory.  */
-void
+
+/* Wipe out and release memory.  Returns true if this function
+ * actually released A.  */
+int
 _gcry_secmem_free (void *a)
 {
+  int mine;
+
   if (!a)
-    return;
+    return 1; /* Tell caller that we handled it.  */
 
   SECMEM_LOCK;
-  _gcry_secmem_free_internal (a);
+  mine = _gcry_secmem_free_internal (a);
   SECMEM_UNLOCK;
+  return mine;
 }
 
 
 static void *
-_gcry_secmem_realloc_internal (void *p, size_t newsize)
+_gcry_secmem_realloc_internal (void *p, size_t newsize, int xhint)
 {
   memblock_t *mb;
   size_t size;
@@ -684,7 +754,7 @@ _gcry_secmem_realloc_internal (void *p, size_t newsize)
     }
   else
     {
-      a = _gcry_secmem_malloc_internal (newsize);
+      a = _gcry_secmem_malloc_internal (newsize, xhint);
       if (a)
 	{
 	  memcpy (a, p, size);
@@ -705,21 +775,27 @@ _gcry_secmem_realloc (void *p, size_t newsize, int xhint)
   void *a;
 
   SECMEM_LOCK;
-  a = _gcry_secmem_realloc_internal (p, newsize);
+  a = _gcry_secmem_realloc_internal (p, newsize, xhint);
   SECMEM_UNLOCK;
 
   return a;
 }
 
 
-/* Return true if P points into the secure memory area.  */
+/* Return true if P points into the secure memory areas.  */
 int
 _gcry_private_is_secure (const void *p)
 {
   pooldesc_t *pool;
 
-  pool = &mainpool;
-  return pool->okay && ptr_into_pool_p (pool, p);
+  /* We do no lock here because once a pool is allocatred it will not
+   * be removed anymore (except for gcry_secmem_term).  Further,
+   * adding a new pool to the list should be atomic.  */
+  for (pool = &mainpool; pool; pool = pool->next)
+    if (pool->okay && ptr_into_pool_p (pool, p))
+      return 1;
+
+  return 0;
 }
 
 
@@ -734,54 +810,68 @@ _gcry_private_is_secure (const void *p)
 void
 _gcry_secmem_term ()
 {
-  pooldesc_t *pool;
+  pooldesc_t *pool, *next;
 
-  pool = &mainpool;
-  if (!pool->okay)
-    return;
-
-  wipememory2 (pool->mem, 0xff, pool->size);
-  wipememory2 (pool->mem, 0xaa, pool->size);
-  wipememory2 (pool->mem, 0x55, pool->size);
-  wipememory2 (pool->mem, 0x00, pool->size);
+  for (pool = &mainpool; pool; pool = next)
+    {
+      next = pool->next;
+      if (!pool->okay)
+        continue;
+
+      wipememory2 (pool->mem, 0xff, pool->size);
+      wipememory2 (pool->mem, 0xaa, pool->size);
+      wipememory2 (pool->mem, 0x55, pool->size);
+      wipememory2 (pool->mem, 0x00, pool->size);
+      if (0)
+        ;
 #if HAVE_MMAP
-  if (pool->is_mmapped)
-    munmap (pool->mem, pool->size);
+      else if (pool->is_mmapped)
+        munmap (pool->mem, pool->size);
 #endif
-  pool->mem = NULL;
-  pool->okay = 0;
-  pool->size = 0;
+      else
+        free (pool->mem);
+      pool->mem = NULL;
+      pool->okay = 0;
+      pool->size = 0;
+      if (pool != &mainpool)
+        free (pool);
+    }
+  mainpool.next = NULL;
   not_locked = 0;
 }
 
 
 void
-_gcry_secmem_dump_stats ()
+_gcry_secmem_dump_stats (int extended)
 {
   pooldesc_t *pool;
-
-#if 1
-  SECMEM_LOCK;
-
-  pool = &mainpool;
-  if (pool->okay)
-    log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
-	      cur_alloced, (unsigned long)pool->size, cur_blocks);
-  SECMEM_UNLOCK;
-#else
   memblock_t *mb;
-  int i;
+  int i, poolno;
 
   SECMEM_LOCK;
 
-  pool = &mainpool;
-  for (i = 0, mb = (memblock_t *) pool->mem;
-       ptr_into_pool_p (pool, mb);
-       mb = mb_get_next (pool, mb), i++)
-    log_info ("SECMEM: [%s] block: %i; size: %i\n",
-	      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
-	      i,
-	      mb->size);
+  for (pool = &mainpool, poolno = 0; pool; pool = pool->next, poolno++)
+    {
+      if (!extended)
+        {
+          if (pool->okay)
+            log_info ("%-13s %u/%lu bytes in %u blocks\n",
+                      pool == &mainpool? "secmem usage:":"",
+                      pool->cur_alloced, (unsigned long)pool->size,
+                      pool->cur_blocks);
+        }
+      else
+        {
+          for (i = 0, mb = (memblock_t *) pool->mem;
+               ptr_into_pool_p (pool, mb);
+               mb = mb_get_next (pool, mb), i++)
+            log_info ("SECMEM: pool %d %s block %i size %i\n",
+                      poolno,
+                      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
+                      i,
+                      mb->size);
+        }
+    }
+
   SECMEM_UNLOCK;
-#endif
 }
diff --git a/src/secmem.h b/src/secmem.h
index 1c39f2a..29dd64f 100644
--- a/src/secmem.h
+++ b/src/secmem.h
@@ -25,8 +25,8 @@ void _gcry_secmem_init (size_t npool);
 void _gcry_secmem_term (void);
 void *_gcry_secmem_malloc (size_t size, int xhint) _GCRY_GCC_ATTR_MALLOC;
 void *_gcry_secmem_realloc (void *a, size_t newsize, int xhint);
-void _gcry_secmem_free (void *a);
-void _gcry_secmem_dump_stats (void);
+int  _gcry_secmem_free (void *a);
+void _gcry_secmem_dump_stats (int extended);
 void _gcry_secmem_set_flags (unsigned flags);
 unsigned _gcry_secmem_get_flags(void);
 int _gcry_private_is_secure (const void *p);
diff --git a/src/stdmem.c b/src/stdmem.c
index cf937ff..cbda8d8 100644
--- a/src/stdmem.c
+++ b/src/stdmem.c
@@ -230,15 +230,13 @@ _gcry_private_free (void *a)
   if (use_m_guard )
     {
       _gcry_private_check_heap(p);
-      if ( _gcry_private_is_secure(a) )
-        _gcry_secmem_free(p-EXTRA_ALIGN-4);
-      else
+      if (! _gcry_secmem_free (p - EXTRA_ALIGN - 4))
         {
-          free(p-EXTRA_ALIGN-4);
+          free (p - EXTRA_ALIGN - 4);
 	}
     }
-  else if ( _gcry_private_is_secure(a) )
-    _gcry_secmem_free(p);
-  else
-    free(p);
+  else if (!_gcry_secmem_free (p))
+    {
+      free(p);
+    }
 }

commit 1433fce11c90bb44ada51071f342ad67b469ea81
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 10:37:50 2016 +0100

    Give the secmem allocators a hint when a xmalloc calls them.
    
    * src/secmem.c (_gcry_secmem_malloc): New not yet used arg XHINT.
    (_gcry_secmem_realloc): Ditto.
    * src/stdmem.c (_gcry_private_malloc_secure): New arg XHINT to be
    passed to the secmem functions.
    (_gcry_private_realloc): Ditto.
    * src/g10lib.h (GCRY_ALLOC_FLAG_XHINT): New.
    * src/global.c (do_malloc): Pass this flag as XHINT to the private
    allocator.
    (_gcry_malloc_secure): Factor code out to ...
    (_gcry_malloc_secure_core): this.  Add arg XHINT.
    (_gcry_realloc): Factor code out to ...
    (_gcry_realloc_core): here.  Add arg XHINT.
    (_gcry_strdup): Factor code out to ...
    (_gcry_strdup_core): here.  Add arg XHINT.
    (_gcry_xrealloc): Use the core function and pass true for XHINT.
    (_gcry_xmalloc_secure): Ditto.
    (_gcry_xstrdup): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/g10lib.h b/src/g10lib.h
index 444c868..376b0bf 100644
--- a/src/g10lib.h
+++ b/src/g10lib.h
@@ -390,6 +390,7 @@ gcry_err_code_t _gcry_mpi_init (void);
 
 /* Memory management.  */
 #define GCRY_ALLOC_FLAG_SECURE (1 << 0)
+#define GCRY_ALLOC_FLAG_XHINT  (1 << 1)  /* Called from xmalloc.  */
 
 
 /*-- sexp.c --*/
diff --git a/src/global.c b/src/global.c
index 8669a46..f12f7d7 100644
--- a/src/global.c
+++ b/src/global.c
@@ -768,7 +768,7 @@ do_malloc (size_t n, unsigned int flags, void **mem)
       if (alloc_secure_func)
 	m = (*alloc_secure_func) (n);
       else
-	m = _gcry_private_malloc_secure (n);
+	m = _gcry_private_malloc_secure (n, !!(flags & GCRY_ALLOC_FLAG_XHINT));
     }
   else
     {
@@ -802,16 +802,23 @@ _gcry_malloc (size_t n)
   return mem;
 }
 
-void *
-_gcry_malloc_secure (size_t n)
+static void *
+_gcry_malloc_secure_core (size_t n, int xhint)
 {
   void *mem = NULL;
 
-  do_malloc (n, GCRY_ALLOC_FLAG_SECURE, &mem);
+  do_malloc (n, (GCRY_ALLOC_FLAG_SECURE | (xhint? GCRY_ALLOC_FLAG_XHINT:0)),
+             &mem);
 
   return mem;
 }
 
+void *
+_gcry_malloc_secure (size_t n)
+{
+  return _gcry_malloc_secure_core (n, 0);
+}
+
 int
 _gcry_is_secure (const void *a)
 {
@@ -836,8 +843,8 @@ _gcry_check_heap( const void *a )
 #endif
 }
 
-void *
-_gcry_realloc (void *a, size_t n)
+static void *
+_gcry_realloc_core (void *a, size_t n, int xhint)
 {
   void *p;
 
@@ -854,12 +861,20 @@ _gcry_realloc (void *a, size_t n)
   if (realloc_func)
     p = realloc_func (a, n);
   else
-    p =  _gcry_private_realloc (a, n);
+    p =  _gcry_private_realloc (a, n, xhint);
   if (!p && !errno)
     gpg_err_set_errno (ENOMEM);
   return p;
 }
 
+
+void *
+_gcry_realloc (void *a, size_t n)
+{
+  return _gcry_realloc_core (a, n, 0);
+}
+
+
 void
 _gcry_free (void *p)
 {
@@ -922,12 +937,8 @@ _gcry_calloc_secure (size_t n, size_t m)
 }
 
 
-/* Create and return a copy of the null-terminated string STRING.  If
-   it is contained in secure memory, the copy will be contained in
-   secure memory as well.  In an out-of-memory condition, NULL is
-   returned.  */
-char *
-_gcry_strdup (const char *string)
+static char *
+_gcry_strdup_core (const char *string, int xhint)
 {
   char *string_cp = NULL;
   size_t string_n = 0;
@@ -935,7 +946,7 @@ _gcry_strdup (const char *string)
   string_n = strlen (string);
 
   if (_gcry_is_secure (string))
-    string_cp = _gcry_malloc_secure (string_n + 1);
+    string_cp = _gcry_malloc_secure_core (string_n + 1, xhint);
   else
     string_cp = _gcry_malloc (string_n + 1);
 
@@ -945,6 +956,15 @@ _gcry_strdup (const char *string)
   return string_cp;
 }
 
+/* Create and return a copy of the null-terminated string STRING.  If
+ * it is contained in secure memory, the copy will be contained in
+ * secure memory as well.  In an out-of-memory condition, NULL is
+ * returned.  */
+char *
+_gcry_strdup (const char *string)
+{
+  return _gcry_strdup_core (string, 0);
+}
 
 void *
 _gcry_xmalloc( size_t n )
@@ -968,7 +988,7 @@ _gcry_xrealloc( void *a, size_t n )
 {
   void *p;
 
-  while ( !(p = _gcry_realloc( a, n )) )
+  while (!(p = _gcry_realloc_core (a, n, 1)))
     {
       if ( fips_mode ()
            || !outofcore_handler
@@ -986,7 +1006,7 @@ _gcry_xmalloc_secure( size_t n )
 {
   void *p;
 
-  while ( !(p = _gcry_malloc_secure( n )) )
+  while (!(p = _gcry_malloc_secure_core (n, 1)))
     {
       if ( fips_mode ()
            || !outofcore_handler
@@ -1041,7 +1061,7 @@ _gcry_xstrdup (const char *string)
 {
   char *p;
 
-  while ( !(p = _gcry_strdup (string)) )
+  while ( !(p = _gcry_strdup_core (string, 1)) )
     {
       size_t n = strlen (string);
       int is_sec = !!_gcry_is_secure (string);
diff --git a/src/secmem.c b/src/secmem.c
index 1f92f17..e838162 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -608,8 +608,11 @@ _gcry_secmem_malloc_internal (size_t size)
   return mb ? &mb->aligned.c : NULL;
 }
 
+
+/* Allocate a block from the secmem of SIZE.  With XHINT set assume
+ * that the caller is a xmalloc style function.  */
 void *
-_gcry_secmem_malloc (size_t size)
+_gcry_secmem_malloc (size_t size, int xhint)
 {
   void *p;
 
@@ -694,9 +697,10 @@ _gcry_secmem_realloc_internal (void *p, size_t newsize)
 }
 
 
-/* Realloc memory.  */
+/* Realloc memory.  With XHINT set assume that the caller is a xmalloc
+ * style function.  */
 void *
-_gcry_secmem_realloc (void *p, size_t newsize)
+_gcry_secmem_realloc (void *p, size_t newsize, int xhint)
 {
   void *a;
 
diff --git a/src/secmem.h b/src/secmem.h
index 3577381..1c39f2a 100644
--- a/src/secmem.h
+++ b/src/secmem.h
@@ -23,8 +23,8 @@
 
 void _gcry_secmem_init (size_t npool);
 void _gcry_secmem_term (void);
-void *_gcry_secmem_malloc (size_t size) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_secmem_realloc (void *a, size_t newsize);
+void *_gcry_secmem_malloc (size_t size, int xhint) _GCRY_GCC_ATTR_MALLOC;
+void *_gcry_secmem_realloc (void *a, size_t newsize, int xhint);
 void _gcry_secmem_free (void *a);
 void _gcry_secmem_dump_stats (void);
 void _gcry_secmem_set_flags (unsigned flags);
diff --git a/src/stdmem.c b/src/stdmem.c
index 189da37..cf937ff 100644
--- a/src/stdmem.c
+++ b/src/stdmem.c
@@ -117,10 +117,11 @@ _gcry_private_malloc (size_t n)
 
 /*
  * Allocate memory of size N from the secure memory pool.  Return NULL
- * if we are out of memory.
+ * if we are out of memory.  XHINT tells the allocator that the caller
+ * used an xmalloc style call.
  */
 void *
-_gcry_private_malloc_secure (size_t n)
+_gcry_private_malloc_secure (size_t n, int xhint)
 {
   if (!n)
     {
@@ -133,7 +134,7 @@ _gcry_private_malloc_secure (size_t n)
     {
       char *p;
 
-      if ( !(p = _gcry_secmem_malloc (n +EXTRA_ALIGN+ 5)) )
+      if (!(p = _gcry_secmem_malloc (n + EXTRA_ALIGN + 5, xhint)))
         return NULL;
       ((byte*)p)[EXTRA_ALIGN+0] = n;
       ((byte*)p)[EXTRA_ALIGN+1] = n >> 8 ;
@@ -144,17 +145,18 @@ _gcry_private_malloc_secure (size_t n)
     }
   else
     {
-      return _gcry_secmem_malloc( n );
+      return _gcry_secmem_malloc (n, xhint);
     }
 }
 
 
 /*
- * Realloc and clear the old space
- * Return NULL if there is not enough memory.
+ * Realloc and clear the old space.  XHINT tells the allocator that
+ * the caller used an xmalloc style call.  Returns NULL if there is
+ * not enough memory.
  */
 void *
-_gcry_private_realloc ( void *a, size_t n )
+_gcry_private_realloc (void *a, size_t n, int xhint)
 {
   if (use_m_guard)
     {
@@ -172,7 +174,7 @@ _gcry_private_realloc ( void *a, size_t n )
       if( len >= n ) /* We don't shrink for now. */
         return a;
       if (p[-1] == MAGIC_SEC_BYTE)
-        b = _gcry_private_malloc_secure(n);
+        b = _gcry_private_malloc_secure (n, xhint);
       else
         b = _gcry_private_malloc(n);
       if (!b)
@@ -184,7 +186,7 @@ _gcry_private_realloc ( void *a, size_t n )
     }
   else if ( _gcry_private_is_secure(a) )
     {
-      return _gcry_secmem_realloc( a, n );
+      return _gcry_secmem_realloc (a, n, xhint);
     }
   else
     {
diff --git a/src/stdmem.h b/src/stdmem.h
index b476e7e..c52aab5 100644
--- a/src/stdmem.h
+++ b/src/stdmem.h
@@ -24,8 +24,8 @@
 void _gcry_private_enable_m_guard(void);
 
 void *_gcry_private_malloc (size_t n) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_private_malloc_secure (size_t n) _GCRY_GCC_ATTR_MALLOC;
-void *_gcry_private_realloc (void *a, size_t n);
+void *_gcry_private_malloc_secure (size_t n, int xhint) _GCRY_GCC_ATTR_MALLOC;
+void *_gcry_private_realloc (void *a, size_t n, int xhint);
 void _gcry_private_check_heap (const void *a);
 void _gcry_private_free (void *a);
 

commit 2bc361485d8bc0d8cdb3b4ae6e304885eeaab889
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 6 21:20:54 2016 +0100

    Reorganize code in secmem.c.
    
    * src/secmem.c (pooldesc_t): New type to collect information about one
    pool.
    (pool_size): Remove.  Now a member of pooldesc_t.
    (pool_okay): Ditto.
    (pool_is_mmapped): Ditto.
    (pool): Rename variable ...
    (mainpool): And change type to pooldesc_t.
    (ptr_into_pool_p): Add arg 'pool'.
    (mb_get_next): Ditto.
    (mb_get_prev): Ditto.
    (mb_merge): Ditto.
    (mb_get_new): Ditto.
    (init_pool): Ditto.
    (lock_pool): Rename to ...
    (look_pool_pages: this.
    (secmem_init): Rename to ...
    (_gcry_secmem_init_internal): this.  Add local var POOL and init with
    address of MAINPOOL.
    (_gcry_secmem_malloc_internal): Add local var POOL and init with
    address of MAINPOOL.
    (_gcry_private_is_secure): Ditto.
    (_gcry_secmem_term): Ditto.
    (_gcry_secmem_dump_stats): Ditto.
    (_gcry_secmem_free_internal): Ditto.  Remove check for NULL arg.
    (_gcry_secmem_free): Add check for NULL arg before taking the lock.
    (_gcry_secmem_realloc): Factor most code out to ...
    (_gcry_secmem_realloc_internal): this.
    --
    
    This change prepares future work to allow the use of several pools.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/secmem.c b/src/secmem.c
index c4e8414..1f92f17 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -1,7 +1,7 @@
 /* secmem.c  -	memory allocation from a secure heap
  * Copyright (C) 1998, 1999, 2000, 2001, 2002,
  *               2003, 2007 Free Software Foundation, Inc.
- * Copyright (C) 2013 g10 Code GmbH
+ * Copyright (C) 2013, 2016 g10 Code GmbH
  *
  * This file is part of Libgcrypt.
  *
@@ -59,20 +59,30 @@ typedef struct memblock
 /* This flag specifies that the memory block is in use.  */
 #define MB_FLAG_ACTIVE (1 << 0)
 
-/* The pool of secure memory.  */
-static void *pool;
+/* An object describing a memory pool.  */
+typedef struct pooldesc_s
+{
+  /* A memory buffer used as allocation pool.  */
+  void *mem;
+
+  /* The allocated size of MEM. */
+  size_t size;
+
+  /* Flag indicating that this memory pool is ready for use.  May be
+   * checked in an atexit function.  */
+  volatile int okay;
 
-/* Size of POOL in bytes.  */
-static size_t pool_size;
+  /* Flag indicating whether MEM is mmapped.  */
+  volatile int is_mmapped;
 
-/* True, if the memory pool is ready for use.  May be checked in an
-   atexit function.  */
-static volatile int pool_okay;
+} pooldesc_t;
 
-/* True, if the memory pool is mmapped.  */
-static volatile int pool_is_mmapped;
 
-/* FIXME?  */
+/* The pool of secure memory.  */
+static pooldesc_t mainpool;
+
+
+/* A couple of flags whith some beeing set early. */
 static int disable_secmem;
 static int show_warning;
 static int not_locked;
@@ -84,7 +94,7 @@ static int no_priv_drop;
 /* Stats.  */
 static unsigned int cur_alloced, cur_blocks;
 
-/* Lock protecting accesses to the memory pool.  */
+/* Lock protecting accesses to the memory pools.  */
 GPGRT_LOCK_DEFINE (secmem_lock);
 
 /* Convenient macros.  */
@@ -100,18 +110,18 @@ GPGRT_LOCK_DEFINE (secmem_lock);
 #define ADDR_TO_BLOCK(addr) \
   (memblock_t *) (void *) ((char *) addr - BLOCK_HEAD_SIZE)
 
-/* Check whether P points into the pool.  */
+/* Check whether P points into POOL.  */
 static int
-ptr_into_pool_p (const void *p)
+ptr_into_pool_p (pooldesc_t *pool, const void *p)
 {
   /* We need to convert pointers to addresses.  This is required by
      C-99 6.5.8 to avoid undefined behaviour.  See also
      http://lists.gnupg.org/pipermail/gcrypt-devel/2007-February/001102.html
   */
   uintptr_t p_addr    = (uintptr_t)p;
-  uintptr_t pool_addr = (uintptr_t)pool;
+  uintptr_t pool_addr = (uintptr_t)pool->mem;
 
-  return p_addr >= pool_addr && p_addr <  pool_addr + pool_size;
+  return p_addr >= pool_addr && p_addr <  pool_addr + pool->size;
 }
 
 /* Update the stats.  */
@@ -132,13 +142,13 @@ stats_update (size_t add, size_t sub)
 
 /* Return the block following MB or NULL, if MB is the last block.  */
 static memblock_t *
-mb_get_next (memblock_t *mb)
+mb_get_next (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_next;
 
   mb_next = (memblock_t *) (void *) ((char *) mb + BLOCK_HEAD_SIZE + mb->size);
 
-  if (! ptr_into_pool_p (mb_next))
+  if (! ptr_into_pool_p (pool, mb_next))
     mb_next = NULL;
 
   return mb_next;
@@ -147,18 +157,18 @@ mb_get_next (memblock_t *mb)
 /* Return the block preceding MB or NULL, if MB is the first
    block.  */
 static memblock_t *
-mb_get_prev (memblock_t *mb)
+mb_get_prev (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_prev, *mb_next;
 
-  if (mb == pool)
+  if (mb == pool->mem)
     mb_prev = NULL;
   else
     {
-      mb_prev = (memblock_t *) pool;
+      mb_prev = (memblock_t *) pool->mem;
       while (1)
 	{
-	  mb_next = mb_get_next (mb_prev);
+	  mb_next = mb_get_next (pool, mb_prev);
 	  if (mb_next == mb)
 	    break;
 	  else
@@ -172,12 +182,12 @@ mb_get_prev (memblock_t *mb)
 /* If the preceding block of MB and/or the following block of MB
    exist and are not active, merge them to form a bigger block.  */
 static void
-mb_merge (memblock_t *mb)
+mb_merge (pooldesc_t *pool, memblock_t *mb)
 {
   memblock_t *mb_prev, *mb_next;
 
-  mb_prev = mb_get_prev (mb);
-  mb_next = mb_get_next (mb);
+  mb_prev = mb_get_prev (pool, mb);
+  mb_next = mb_get_next (pool, mb);
 
   if (mb_prev && (! (mb_prev->flags & MB_FLAG_ACTIVE)))
     {
@@ -190,11 +200,11 @@ mb_merge (memblock_t *mb)
 
 /* Return a new block, which can hold SIZE bytes.  */
 static memblock_t *
-mb_get_new (memblock_t *block, size_t size)
+mb_get_new (pooldesc_t *pool, memblock_t *block, size_t size)
 {
   memblock_t *mb, *mb_split;
 
-  for (mb = block; ptr_into_pool_p (mb); mb = mb_get_next (mb))
+  for (mb = block; ptr_into_pool_p (pool, mb); mb = mb_get_next (pool, mb))
     if (! (mb->flags & MB_FLAG_ACTIVE) && mb->size >= size)
       {
 	/* Found a free block.  */
@@ -211,14 +221,14 @@ mb_get_new (memblock_t *block, size_t size)
 
 	    mb->size = size;
 
-	    mb_merge (mb_split);
+	    mb_merge (pool, mb_split);
 
 	  }
 
 	break;
       }
 
-  if (! ptr_into_pool_p (mb))
+  if (! ptr_into_pool_p (pool, mb))
     {
       gpg_err_set_errno (ENOMEM);
       mb = NULL;
@@ -235,9 +245,11 @@ print_warn (void)
     log_info (_("Warning: using insecure memory!\n"));
 }
 
-/* Lock the memory pages into core and drop privileges.  */
+
+/* Lock the memory pages of pool P of size N into core and drop
+ * privileges.  */
 static void
-lock_pool (void *p, size_t n)
+lock_pool_pages (void *p, size_t n)
 {
 #if defined(USE_CAPABILITIES) && defined(HAVE_MLOCK)
   int err;
@@ -367,11 +379,11 @@ lock_pool (void *p, size_t n)
 
 /* Initialize POOL.  */
 static void
-init_pool (size_t n)
+init_pool (pooldesc_t *pool, size_t n)
 {
   memblock_t *mb;
 
-  pool_size = n;
+  pool->size = n;
 
   if (disable_secmem)
     log_bug ("secure memory is disabled");
@@ -391,10 +403,10 @@ init_pool (size_t n)
 # endif
     pgsize = (pgsize_val != -1 && pgsize_val > 0)? pgsize_val:DEFAULT_PAGE_SIZE;
 
-    pool_size = (pool_size + pgsize - 1) & ~(pgsize - 1);
+    pool->size = (pool->size + pgsize - 1) & ~(pgsize - 1);
 # ifdef MAP_ANONYMOUS
-    pool = mmap (0, pool_size, PROT_READ | PROT_WRITE,
-                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    pool->mem = mmap (0, pool->size, PROT_READ | PROT_WRITE,
+                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 # else /* map /dev/zero instead */
     {
       int fd;
@@ -403,40 +415,40 @@ init_pool (size_t n)
       if (fd == -1)
         {
           log_error ("can't open /dev/zero: %s\n", strerror (errno));
-          pool = (void *) -1;
+          pool->mem = (void *) -1;
         }
       else
         {
-          pool = mmap (0, pool_size,
-                       (PROT_READ | PROT_WRITE), MAP_PRIVATE, fd, 0);
+          pool->mem = mmap (0, pool->size,
+                           (PROT_READ | PROT_WRITE), MAP_PRIVATE, fd, 0);
           close (fd);
         }
     }
 # endif
-    if (pool == (void *) -1)
+    if (pool->mem == (void *) -1)
       log_info ("can't mmap pool of %u bytes: %s - using malloc\n",
-                (unsigned) pool_size, strerror (errno));
+                (unsigned) pool->size, strerror (errno));
     else
       {
-        pool_is_mmapped = 1;
-        pool_okay = 1;
+        pool->is_mmapped = 1;
+        pool->okay = 1;
       }
   }
 #endif /*HAVE_MMAP*/
 
-  if (!pool_okay)
+  if (!pool->okay)
     {
-      pool = malloc (pool_size);
-      if (!pool)
+      pool->mem = malloc (pool->size);
+      if (!pool->mem)
 	log_fatal ("can't allocate memory pool of %u bytes\n",
-		   (unsigned) pool_size);
+		   (unsigned) pool->size);
       else
-	pool_okay = 1;
+	pool->okay = 1;
     }
 
   /* Initialize first memory block.  */
-  mb = (memblock_t *) pool;
-  mb->size = pool_size;
+  mb = (memblock_t *) pool->mem;
+  mb->size = pool->size;
   mb->flags = 0;
 }
 
@@ -482,11 +494,14 @@ _gcry_secmem_get_flags (void)
 }
 
 
-/* See _gcry_secmem_init.  This function is expected to be called with
-   the secmem lock held. */
+/* This function initializes the main memory pool MAINPOOL.  Itis
+ * expected to be called with the secmem lock held.  */
 static void
-secmem_init (size_t n)
+_gcry_secmem_init_internal (size_t n)
 {
+  pooldesc_t *pool;
+
+  pool = &mainpool;
   if (!n)
     {
 #ifdef USE_CAPABILITIES
@@ -516,10 +531,10 @@ secmem_init (size_t n)
     {
       if (n < MINIMUM_POOL_SIZE)
 	n = MINIMUM_POOL_SIZE;
-      if (! pool_okay)
+      if (! pool->okay)
 	{
-	  init_pool (n);
-	  lock_pool (pool, n);
+	  init_pool (pool, n);
+	  lock_pool_pages (pool->mem, n);
 	}
       else
 	log_error ("Oops, secure memory pool already initialized\n");
@@ -537,7 +552,7 @@ _gcry_secmem_init (size_t n)
 {
   SECMEM_LOCK;
 
-  secmem_init (n);
+  _gcry_secmem_init_internal (n);
 
   SECMEM_UNLOCK;
 }
@@ -554,13 +569,16 @@ _gcry_secmem_module_init ()
 static void *
 _gcry_secmem_malloc_internal (size_t size)
 {
+  pooldesc_t *pool;
   memblock_t *mb;
 
-  if (!pool_okay)
+  pool = &mainpool;
+
+  if (!pool->okay)
     {
       /* Try to initialize the pool if the user forgot about it.  */
-      secmem_init (STANDARD_POOL_SIZE);
-      if (!pool_okay)
+      _gcry_secmem_init_internal (STANDARD_POOL_SIZE);
+      if (!pool->okay)
         {
           log_info (_("operation is not possible without "
                       "initialized secure memory\n"));
@@ -583,7 +601,7 @@ _gcry_secmem_malloc_internal (size_t size)
   /* Blocks are always a multiple of 32. */
   size = ((size + 31) / 32) * 32;
 
-  mb = mb_get_new ((memblock_t *) pool, size);
+  mb = mb_get_new (pool, (memblock_t *) pool->mem, size);
   if (mb)
     stats_update (size, 0);
 
@@ -605,11 +623,11 @@ _gcry_secmem_malloc (size_t size)
 static void
 _gcry_secmem_free_internal (void *a)
 {
+  pooldesc_t *pool;
   memblock_t *mb;
   int size;
 
-  if (!a)
-    return;
+  pool = &mainpool;
 
   mb = ADDR_TO_BLOCK (a);
   size = mb->size;
@@ -624,34 +642,35 @@ _gcry_secmem_free_internal (void *a)
   MB_WIPE_OUT (0x55);
   MB_WIPE_OUT (0x00);
 
+  /* Update stats.  */
   stats_update (0, size);
 
   mb->flags &= ~MB_FLAG_ACTIVE;
 
-  /* Update stats.  */
 
-  mb_merge (mb);
+  mb_merge (pool, mb);
 }
 
 /* Wipe out and release memory.  */
 void
 _gcry_secmem_free (void *a)
 {
+  if (!a)
+    return;
+
   SECMEM_LOCK;
   _gcry_secmem_free_internal (a);
   SECMEM_UNLOCK;
 }
 
-/* Realloc memory.  */
-void *
-_gcry_secmem_realloc (void *p, size_t newsize)
+
+static void *
+_gcry_secmem_realloc_internal (void *p, size_t newsize)
 {
   memblock_t *mb;
   size_t size;
   void *a;
 
-  SECMEM_LOCK;
-
   mb = (memblock_t *) (void *) ((char *) p
 				- ((size_t) &((memblock_t *) 0)->aligned.c));
   size = mb->size;
@@ -671,6 +690,18 @@ _gcry_secmem_realloc (void *p, size_t newsize)
 	}
     }
 
+  return a;
+}
+
+
+/* Realloc memory.  */
+void *
+_gcry_secmem_realloc (void *p, size_t newsize)
+{
+  void *a;
+
+  SECMEM_LOCK;
+  a = _gcry_secmem_realloc_internal (p, newsize);
   SECMEM_UNLOCK;
 
   return a;
@@ -681,7 +712,10 @@ _gcry_secmem_realloc (void *p, size_t newsize)
 int
 _gcry_private_is_secure (const void *p)
 {
-  return pool_okay && ptr_into_pool_p (p);
+  pooldesc_t *pool;
+
+  pool = &mainpool;
+  return pool->okay && ptr_into_pool_p (pool, p);
 }
 
 
@@ -696,20 +730,23 @@ _gcry_private_is_secure (const void *p)
 void
 _gcry_secmem_term ()
 {
-  if (!pool_okay)
+  pooldesc_t *pool;
+
+  pool = &mainpool;
+  if (!pool->okay)
     return;
 
-  wipememory2 (pool, 0xff, pool_size);
-  wipememory2 (pool, 0xaa, pool_size);
-  wipememory2 (pool, 0x55, pool_size);
-  wipememory2 (pool, 0x00, pool_size);
+  wipememory2 (pool->mem, 0xff, pool->size);
+  wipememory2 (pool->mem, 0xaa, pool->size);
+  wipememory2 (pool->mem, 0x55, pool->size);
+  wipememory2 (pool->mem, 0x00, pool->size);
 #if HAVE_MMAP
-  if (pool_is_mmapped)
-    munmap (pool, pool_size);
+  if (pool->is_mmapped)
+    munmap (pool->mem, pool->size);
 #endif
-  pool = NULL;
-  pool_okay = 0;
-  pool_size = 0;
+  pool->mem = NULL;
+  pool->okay = 0;
+  pool->size = 0;
   not_locked = 0;
 }
 
@@ -717,12 +754,15 @@ _gcry_secmem_term ()
 void
 _gcry_secmem_dump_stats ()
 {
+  pooldesc_t *pool;
+
 #if 1
   SECMEM_LOCK;
 
- if (pool_okay)
+  pool = &mainpool;
+  if (pool->okay)
     log_info ("secmem usage: %u/%lu bytes in %u blocks\n",
-	      cur_alloced, (unsigned long)pool_size, cur_blocks);
+	      cur_alloced, (unsigned long)pool->size, cur_blocks);
   SECMEM_UNLOCK;
 #else
   memblock_t *mb;
@@ -730,9 +770,10 @@ _gcry_secmem_dump_stats ()
 
   SECMEM_LOCK;
 
-  for (i = 0, mb = (memblock_t *) pool;
-       ptr_into_pool_p (mb);
-       mb = mb_get_next (mb), i++)
+  pool = &mainpool;
+  for (i = 0, mb = (memblock_t *) pool->mem;
+       ptr_into_pool_p (pool, mb);
+       mb = mb_get_next (pool, mb), i++)
     log_info ("SECMEM: [%s] block: %i; size: %i\n",
 	      (mb->flags & MB_FLAG_ACTIVE) ? "used" : "free",
 	      i,

-----------------------------------------------------------------------

Summary of changes:
 doc/gcrypt.texi |  12 +-
 src/g10lib.h    |   1 +
 src/global.c    |  56 ++++++---
 src/secmem.c    | 377 ++++++++++++++++++++++++++++++++++++++------------------
 src/secmem.h    |   8 +-
 src/stdmem.c    |  34 ++---
 src/stdmem.h    |   4 +-
 7 files changed, 327 insertions(+), 165 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec  7 21:46:33 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 07 Dec 2016 21:46:33 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-10-g7880335
Message-ID: <E1cEj6p-0000DX-9x@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  7880335273382f05cbbe38aa965a566c4127ba6a (commit)
      from  05896c210f7fa9ce7b97784a75e49dc4489e9252 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7880335273382f05cbbe38aa965a566c4127ba6a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Dec 7 21:41:34 2016 +0100

    Clarify what "checking on bit" means
    
    * doc/gpgme.texi (gpgme_sigsum_t summary): Clarify what "you
    can check one bit means"
    
    --
    It was unclear which bit to test for is. And tests
    with students have shown that they would "test" for
    this one bit by using if(sig.summary == GPGME_SIGSUM_VALID)
    which would fail because valid sigs are also SIGSUM_GREEN.
    
    So lets give an example for people not used to checking bits and
    clarify through this example which bit is meant to be checked.

diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index 32e0861..ee82b27 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -4948,7 +4948,19 @@ list, or @code{NULL} if this is the last element.
 This is a bit vector giving a summary of the signature status.  It
 provides an easy interface to a defined semantic of the signature
 status.  Checking just one bit is sufficient to see whether a
-signature is valid without any restrictions.
+signature is valid without any restrictions. This means that
+you can check for GPGME_SIGSUM_VALID like this:
+
+ at example
+if (sig.summary & GPGME_SIGSUM_VALID)
+@{
+   ..do stuff if valid..
+@}
+else
+@{
+   ..do stuff if not fully valid..
+@}
+ at end example
 
 The defined bits are:
   @table @code

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgme.texi | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec  7 23:28:29 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 07 Dec 2016 23:28:29 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-11-gecb0e32
Message-ID: <E1cEkhT-0004Wa-IB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ecb0e3280a7db0e8f6ef395cf64f36a36b15be37 (commit)
      from  7880335273382f05cbbe38aa965a566c4127ba6a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ecb0e3280a7db0e8f6ef395cf64f36a36b15be37
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 23:25:50 2016 +0100

    doc: Let's suggest GNU guidelines for bit checking.
    
    --
    
    While educating students we can also get them to use useful habits, in
    particular to parenthese bit tests.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index ee82b27..511384f 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -4952,7 +4952,7 @@ signature is valid without any restrictions. This means that
 you can check for GPGME_SIGSUM_VALID like this:
 
 @example
-if (sig.summary & GPGME_SIGSUM_VALID)
+if ((sig.summary & GPGME_SIGSUM_VALID))
 @{
    ..do stuff if valid..
 @}

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgme.texi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 09:11:42 2016
From: cvs at cvs.gnupg.org (by Stephan Mueller)
Date: Thu, 08 Dec 2016 09:11:42 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-32-g656395b
Message-ID: <E1cEtnt-0006gh-1m@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  656395ba4cf34f42dda3a120bda3ed1220755a3d (commit)
       via  20886fdcb841b0bf89bb1d44303d42f1804e38cb (commit)
       via  227099f179df9dcf083d0ef6be9883c775df0874 (commit)
       via  df8634d8e2b595430dc1e6575a7452c242cffca1 (commit)
       via  677ddf5bbd9c172a72607c7d5d7006907071c2cf (commit)
      from  95bac312644ad45e486c94c2efd25d0748b9a20b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 656395ba4cf34f42dda3a120bda3ed1220755a3d
Author: Stephan Mueller <smueller at chronox.de>
Date:   Sat Dec 3 19:18:01 2016 +0100

    random: Eliminate unneeded memcpy invocations in the DRBG.
    
    * random/random-drbg.c (drbg_hash): Remove arg 'outval' and return a
    pointer instead.
    (drbg_instantiate): Reduce size of scratchpad.
    (drbg_hmac_update): Avoid use of scratch buffers for the hash.
    (drbg_hmac_generate, drbg_hash_df): Ditto.
    (drbg_hash_process_addtl): Ditto.
    (drbg_hash_hashgen): Ditto.
    (drbg_hash_generate): Ditto.
    
    --
    The gcry_md_read returns a pointer to the hash which can be directly
    used instead of copying it into a scratch buffer. This eliminates a
    number of memcpy invocations for HMAC and Hash DRBG and reduces the
    memory footprint of the Hash DRBG by the block size of the used hash.
    
    The performance increase is between 1 and 3 MB/s depending on the output
    buffer size.
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChangeLog entries above written by -wk.

diff --git a/random/random-drbg.c b/random/random-drbg.c
index dc8e8f3..e2fe861 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -374,9 +374,7 @@ static gpg_err_code_t drbg_hmac_init (drbg_state_t drbg);
 static gpg_err_code_t drbg_hmac_setkey (drbg_state_t drbg,
 					const unsigned char *key);
 static void drbg_hash_fini (drbg_state_t drbg);
-static gpg_err_code_t drbg_hash (drbg_state_t drbg,
-                                 unsigned char *outval,
-                                 const drbg_string_t *buf);
+static byte *drbg_hash (drbg_state_t drbg, const drbg_string_t *buf);
 static gpg_err_code_t drbg_sym_init (drbg_state_t drbg);
 static void drbg_sym_fini (drbg_state_t drbg);
 static gpg_err_code_t drbg_sym_setkey (drbg_state_t drbg,
@@ -1042,24 +1040,21 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
   /* we execute two rounds of V/K massaging */
   for (i = 2; 0 < i; i--)
     {
+      byte *retval;
       /* first round uses 0x0, second 0x1 */
       unsigned char prefix = DRBG_PREFIX0;
       if (1 == i)
 	prefix = DRBG_PREFIX1;
       /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
       seed2.buf = &prefix;
-      ret = drbg_hash (drbg, drbg->C, &seed1);
-      if (ret)
-	return ret;
-
-      ret = drbg_hmac_setkey (drbg, drbg->C);
+      retval = drbg_hash (drbg, &seed1);
+      ret = drbg_hmac_setkey (drbg, retval);
       if (ret)
 	return ret;
 
       /* 10.1.2.2 step 2 and 5 -- HMAC for V */
-      ret = drbg_hash (drbg, drbg->V, &cipherin);
-      if (ret)
-	return ret;
+      retval = drbg_hash (drbg, &cipherin);
+      memcpy(drbg->V, retval, drbg_blocklen (drbg));
 
       /* 10.1.2.2 step 3 */
       if (!seed || 0 == seed->len)
@@ -1091,9 +1086,8 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
     {
       unsigned int outlen = 0;
       /* 10.1.2.5 step 4.1 */
-      ret = drbg_hash (drbg, drbg->V, &data);
-      if (ret)
-	return ret;
+      byte *retval = drbg_hash (drbg, &data);
+      memcpy(drbg->V, retval, drbg_blocklen (drbg));
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
 	drbg_blocklen (drbg) : (buflen - len);
 
@@ -1137,14 +1131,10 @@ drbg_hash_df (drbg_state_t drbg,
               unsigned char *outval, size_t outlen,
               drbg_string_t *entropy)
 {
-  gpg_err_code_t ret = 0;
   size_t len = 0;
   unsigned char input[5];
-  unsigned char *tmp = drbg->scratchpad + drbg_statelen (drbg);
   drbg_string_t data1;
 
-  memset (tmp, 0, drbg_blocklen (drbg));
-
   /* 10.4.1 step 3 */
   input[0] = 1;
   drbg_cpu_to_be32 ((outlen * 8), &input[1]);
@@ -1158,20 +1148,16 @@ drbg_hash_df (drbg_state_t drbg,
     {
       short blocklen = 0;
       /* 10.4.1 step 4.1 */
-      ret = drbg_hash (drbg, tmp, &data1);
-      if (ret)
-	goto out;
+      byte *retval = drbg_hash (drbg, &data1);
       /* 10.4.1 step 4.2 */
       input[0]++;
       blocklen = (drbg_blocklen (drbg) < (outlen - len)) ?
 	drbg_blocklen (drbg) : (outlen - len);
-      memcpy (outval + len, tmp, blocklen);
+      memcpy (outval + len, retval, blocklen);
       len += blocklen;
     }
 
- out:
-  memset (tmp, 0, drbg_blocklen (drbg));
-  return ret;
+  return 0;
 }
 
 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
@@ -1227,13 +1213,10 @@ drbg_hash_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
 static gpg_err_code_t
 drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
 {
-  gpg_err_code_t ret = 0;
   drbg_string_t data1, data2;
   drbg_string_t *data3;
   unsigned char prefix = DRBG_PREFIX2;
-
-  /* this is value w as per documentation */
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
+  byte *retval;
 
   /* 10.1.1.4 step 2 */
   if (!addtl || 0 == addtl->len)
@@ -1247,37 +1230,25 @@ drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
   data2.next = data3;
   data3->next = NULL;
   /* 10.1.1.4 step 2a -- cipher invocation */
-  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
-  if (ret)
-    goto out;
+  retval = drbg_hash (drbg, &data1);
 
   /* 10.1.1.4 step 2b */
-  drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		drbg->scratchpad, drbg_blocklen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), retval, drbg_blocklen (drbg));
 
- out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
-  return ret;
+  return 0;
 }
 
 /*
  * Hashgen defined in 10.1.1.4
  */
 static gpg_err_code_t
-drbg_hash_hashgen (drbg_state_t drbg,
-                   unsigned char *buf, unsigned int buflen)
+drbg_hash_hashgen (drbg_state_t drbg, unsigned char *buf, unsigned int buflen)
 {
-  gpg_err_code_t ret = 0;
   unsigned int len = 0;
   unsigned char *src = drbg->scratchpad;
-  unsigned char *dst = drbg->scratchpad + drbg_statelen (drbg);
   drbg_string_t data;
   unsigned char prefix = DRBG_PREFIX1;
 
-  /* use the scratchpad as a lookaside buffer */
-  memset (src, 0, drbg_statelen (drbg));
-  memset (dst, 0, drbg_blocklen (drbg));
-
   /* 10.1.1.4 step hashgen 2 */
   memcpy (src, drbg->V, drbg_statelen (drbg));
 
@@ -1286,44 +1257,36 @@ drbg_hash_hashgen (drbg_state_t drbg,
     {
       unsigned int outlen = 0;
       /* 10.1.1.4 step hashgen 4.1 */
-      ret = drbg_hash (drbg, dst, &data);
-      if (ret)
-	goto out;
+      byte *retval = drbg_hash (drbg, &data);
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
 	drbg_blocklen (drbg) : (buflen - len);
       /* 10.1.1.4 step hashgen 4.2 */
-      memcpy (buf + len, dst, outlen);
+      memcpy (buf + len, retval, outlen);
       len += outlen;
       /* 10.1.1.4 hashgen step 4.3 */
       if (len < buflen)
 	drbg_add_buf (src, drbg_statelen (drbg), &prefix, 1);
     }
 
- out:
-  memset (drbg->scratchpad, 0,
-	  (drbg_statelen (drbg) + drbg_blocklen (drbg)));
-  return ret;
+  memset (drbg->scratchpad, 0, drbg_statelen (drbg));
+  return 0;
 }
 
 /* Generate function for Hash DRBG as defined in 10.1.1.4  */
 static gpg_err_code_t
-drbg_hash_generate (drbg_state_t drbg,
-			 unsigned char *buf, unsigned int buflen,
-			 drbg_string_t *addtl)
+drbg_hash_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
+		    drbg_string_t *addtl)
 {
-  gpg_err_code_t ret = 0;
+  gpg_err_code_t ret;
   unsigned char prefix = DRBG_PREFIX3;
   drbg_string_t data1, data2;
+  byte *retval;
   union
   {
     unsigned char req[8];
     u64 req_int;
   } u;
 
-  /*
-   * scratchpad usage: drbg_hash_process_addtl uses the scratchpad, but
-   * fully completes before returning. Thus, we can reuse the scratchpad
-   */
   /* 10.1.1.4 step 2 */
   ret = drbg_hash_process_addtl (drbg, addtl);
   if (ret)
@@ -1334,27 +1297,20 @@ drbg_hash_generate (drbg_state_t drbg,
   if (ret)
     return ret;
 
-  /* this is the value H as documented in 10.1.1.4 */
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   /* 10.1.1.4 step 4 */
   drbg_string_fill (&data1, &prefix, 1);
   drbg_string_fill (&data2, drbg->V, drbg_statelen (drbg));
   data1.next = &data2;
-  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
-  if (ret)
-    goto out;
+
+  /* this is the value H as documented in 10.1.1.4 */
+  retval = drbg_hash (drbg, &data1);
 
   /* 10.1.1.4 step 5 */
-  drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		     drbg->scratchpad, drbg_blocklen (drbg));
-  drbg_add_buf (drbg->V, drbg_statelen (drbg), drbg->C,
-		     drbg_statelen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), retval, drbg_blocklen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), drbg->C, drbg_statelen (drbg));
   u.req_int = be_bswap64 (drbg->reseed_ctr);
-  drbg_add_buf (drbg->V, drbg_statelen (drbg), u.req,
-		     sizeof (u.req));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), u.req, sizeof (u.req));
 
- out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   return ret;
 }
 
@@ -1699,7 +1655,7 @@ drbg_instantiate (drbg_state_t drbg,
       drbg_blocklen (drbg) +	/* iv */
       drbg_statelen (drbg) + drbg_blocklen (drbg);	/* temp */
   else
-    sb_size = drbg_statelen (drbg) + drbg_blocklen (drbg);
+    sb_size = drbg_statelen (drbg);
 
   if (0 < sb_size)
     {
@@ -2626,8 +2582,8 @@ drbg_hash_fini (drbg_state_t drbg)
   _gcry_md_close (hd);
 }
 
-static gpg_err_code_t
-drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+static byte *
+drbg_hash (drbg_state_t drbg, const drbg_string_t *buf)
 {
   gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
 
@@ -2635,9 +2591,7 @@ drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
   for (; NULL != buf; buf = buf->next)
     _gcry_md_write (hd, buf->buf, buf->len);
   _gcry_md_final (hd);
-  memcpy (outval, _gcry_md_read (hd, drbg->core->backend_cipher),
-	  drbg_blocklen (drbg));
-  return 0;
+  return _gcry_md_read (hd, drbg->core->backend_cipher);
 }
 
 static void

commit 20886fdcb841b0bf89bb1d44303d42f1804e38cb
Author: Stephan Mueller <smueller at chronox.de>
Date:   Thu Dec 1 17:15:10 2016 +0100

    random: Add performance improvements for the DRBG.
    
    * random/random-drbg.c (struct drbg_state_ops_s): New function
    pointers 'crypto_init' and 'crypto-fini'.
    (struct drbg_state_s): New fields 'priv_data', 'ctr_handle', and
    'ctr_null'.
    (drbg_hash_init, drbg_hash_fini): New.
    (drbg_hmac_init, drbg_hmac_setkey): New.
    (drbg_sym_fini, drbg_sym_init, drbg_sym_setkey): New.
    (drbg_sym_ctr): New.
    (drbg_ctr_bcc): Set the key.
    (drbg_ctr_df): Ditto.
    (drbg_hmac_update): Ditto.
    (drbg_hmac_generate): Replace drgb_hmac by drbg_hash.
    (drbg_hash_df): Ditto.
    (drbg_hash_process_addtl): Ditto.
    (drbg_hash_hashgen): Ditto.
    (drbg_ctr_update): Rework.
    (drbg_ctr_generate): Rework.
    (drbg_ctr_ops): Init new functions pointers.
    (drbg_uninstantiate): Call fini function.
    (drbg_instantiate): Call init function.
    
    --
    The performance improvements can be categorized as follows:
    
    * Initialize the cipher handle of the backend ciphers once and re-use
      them for subsequent cipher invocations.
    
    * Limit the invocation of setkey to the cases when the key is newly
      created.
    
    * Use the AES CTR mode and rip out the counter maintenance in the DRBG
      code. This allows the use of accelerated CTR AES implementations. To
      use the CTR AES mode, a NULL buffer is created that is used as the
      "plaintext" to the CTR mode, because the DRBG CTR AES operation is the
      result of the encryption of the CTR (i.e. the NULL buffer makes the
      final XOR of the CTR AES mode a noop).
    
    The following timing measurements are made. The measurement do not use a
    precise timing operation and should rather serve as a general hint to
    the performance improvements.
    
     On a Broadwell i7 CPU:
    
    	block size	4096		1024		128		32		16
     aes256 old		28MB/s	27MB/s	19MB/s	11MB/s	6MB/s
     aes128 old		29MB/s	32MB/s	23MB/s	15MB/s	9MB/s
     sha256 old		48MB/s	48MB/s	33MB/s	16MB/s	8MB/s
     hmac sha256 old	15MB/s	15MB/s	10MB/s	5MB/s	2MB/s
    
     aes256 new		180MB/s	169MB/s	93MB/s	37MB/s	20MB/s
     aes128 new		240MB/s	221MB/s	125MB/s	51MB/s	27MB/s
     sha256 new		75MB/s	69MB/s	48MB/s	23MB/s	11MB/s
     hmac sha256 new	37MB/s	34MB/s	21MB/s	8MB/s	4MB/s
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChnageLog entries above written by -wk

diff --git a/random/random-drbg.c b/random/random-drbg.c
index 9676f0e..dc8e8f3 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -289,6 +289,8 @@ struct drbg_state_ops_s
   gpg_err_code_t (*generate) (drbg_state_t drbg,
 			      unsigned char *buf, unsigned int buflen,
 			      drbg_string_t *addtl);
+  gpg_err_code_t (*crypto_init) (drbg_state_t drbg);
+  void		 (*crypto_fini) (drbg_state_t drbg);
 };
 
 struct drbg_test_data_s
@@ -309,6 +311,10 @@ struct drbg_state_s
 				 * 10.1.1.1 1c) */
   unsigned char *scratchpad;	/* some memory the DRBG can use for its
 				 * operation -- allocated during init */
+  void *priv_data;		/* Cipher handle */
+  gcry_cipher_hd_t ctr_handle;	/* CTR mode cipher handle */
+#define DRBG_CTR_NULL_LEN 128
+  unsigned char *ctr_null;	/* CTR mode zero buffer */
   int seeded:1;			/* DRBG fully seeded? */
   int pr:1;			/* Prediction resistance enabled? */
   /* Taken from libgcrypt ANSI X9.31 DRNG: We need to keep track of the
@@ -363,14 +369,23 @@ static const struct drbg_core_s drbg_cores[] = {
   {DRBG_CTRAES | DRBG_SYM256, 48, 16, GCRY_CIPHER_AES256}
 };
 
-static gpg_err_code_t drbg_sym (drbg_state_t drbg,
-                                const unsigned char *key,
-                                unsigned char *outval,
-                                const drbg_string_t *buf);
-static gpg_err_code_t drbg_hmac (drbg_state_t drbg,
-                                 const unsigned char *key,
+static gpg_err_code_t drbg_hash_init (drbg_state_t drbg);
+static gpg_err_code_t drbg_hmac_init (drbg_state_t drbg);
+static gpg_err_code_t drbg_hmac_setkey (drbg_state_t drbg,
+					const unsigned char *key);
+static void drbg_hash_fini (drbg_state_t drbg);
+static gpg_err_code_t drbg_hash (drbg_state_t drbg,
                                  unsigned char *outval,
                                  const drbg_string_t *buf);
+static gpg_err_code_t drbg_sym_init (drbg_state_t drbg);
+static void drbg_sym_fini (drbg_state_t drbg);
+static gpg_err_code_t drbg_sym_setkey (drbg_state_t drbg,
+				       const unsigned char *key);
+static gpg_err_code_t drbg_sym (drbg_state_t drbg, unsigned char *outval,
+				const drbg_string_t *buf);
+static gpg_err_code_t drbg_sym_ctr (drbg_state_t drbg,
+			const unsigned char *inbuf, unsigned int inbuflen,
+			unsigned char *outbuf, unsigned int outbuflen);
 
 /******************************************************************
  ******************************************************************
@@ -666,6 +681,10 @@ drbg_ctr_bcc (drbg_state_t drbg,
   /* 10.4.3 step 1 */
   memset (out, 0, drbg_blocklen (drbg));
 
+  ret = drbg_sym_setkey(drbg, key);
+  if (ret)
+    return ret;
+
   /* 10.4.3 step 2 / 4 */
   while (inpos)
     {
@@ -698,7 +717,7 @@ drbg_ctr_bcc (drbg_state_t drbg,
 	    }
 	}
       /* 10.4.3 step 4.2 */
-      ret = drbg_sym (drbg, key, out, &data);
+      ret = drbg_sym (drbg, out, &data);
       if (ret)
 	return ret;
       /* 10.4.3 step 2 */
@@ -839,6 +858,9 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
   /* 10.4.2 step 12: overwriting of outval */
 
   /* 10.4.2 step 13 */
+  ret = drbg_sym_setkey(drbg, temp);
+  if (ret)
+    goto out;
   while (generated_len < bytes_to_return)
     {
       short blocklen = 0;
@@ -846,11 +868,10 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
       /* the truncation of the key length is implicit as the key
        * is only drbg_blocklen in size -- check for the implementation
        * of the cipher function callback */
-      ret = drbg_sym (drbg, temp, X, &cipherin);
+      ret = drbg_sym (drbg, X, &cipherin);
       if (ret)
 	goto out;
-      blocklen = (drbg_blocklen (drbg) <
-		  (bytes_to_return - generated_len)) ?
+      blocklen = (drbg_blocklen (drbg) < (bytes_to_return - generated_len)) ?
 	drbg_blocklen (drbg) : (bytes_to_return - generated_len);
       /* 10.4.2 step 13.2 and 14 */
       memcpy (df_data + generated_len, X, blocklen);
@@ -889,54 +910,51 @@ drbg_ctr_update (drbg_state_t drbg, drbg_string_t *addtl, int reseed)
   unsigned char *temp = drbg->scratchpad;
   unsigned char *df_data = drbg->scratchpad +
     drbg_statelen (drbg) + drbg_blocklen (drbg);
-  unsigned char *temp_p, *df_data_p;	/* pointer to iterate over buffers */
-  unsigned int len = 0;
-  drbg_string_t cipherin;
   unsigned char prefix = DRBG_PREFIX1;
 
   memset (temp, 0, drbg_statelen (drbg) + drbg_blocklen (drbg));
   if (3 > reseed)
     memset (df_data, 0, drbg_statelen (drbg));
 
-  /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
-  if (addtl && 0 < addtl->len)
+  if (!reseed)
     {
-      ret =
-	drbg_ctr_df (drbg, df_data, drbg_statelen (drbg), addtl);
+      /*
+       * The DRBG uses the CTR mode of the underlying AES cipher. The
+       * CTR mode increments the counter value after the AES operation
+       * but SP800-90A requires that the counter is incremented before
+       * the AES operation. Hence, we increment it at the time we set
+       * it by one.
+       */
+      drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
+
+      ret = _gcry_cipher_setkey (drbg->ctr_handle, drbg->C, drbg_keylen (drbg));
       if (ret)
-	goto out;
+        goto out;
     }
 
-  drbg_string_fill (&cipherin, drbg->V, drbg_blocklen (drbg));
-  /* 10.2.1.3.2 step 2 and 3 -- are already covered as we memset(0)
-   * all memory during initialization */
-  while (len < (drbg_statelen (drbg)))
+  /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
+  if (addtl && 0 < addtl->len)
     {
-      /* 10.2.1.2 step 2.1 */
-      drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-      /* 10.2.1.2 step 2.2 */
-      /* using target of temp + len: 10.2.1.2 step 2.3 and 3 */
-      ret = drbg_sym (drbg, drbg->C, temp + len, &cipherin);
+      ret =
+	drbg_ctr_df (drbg, df_data, drbg_statelen (drbg), addtl);
       if (ret)
 	goto out;
-      /* 10.2.1.2 step 2.3 and 3 */
-      len += drbg_blocklen (drbg);
     }
 
-  /* 10.2.1.2 step 4 */
-  temp_p = temp;
-  df_data_p = df_data;
-  for (len = 0; len < drbg_statelen (drbg); len++)
-    {
-      *temp_p ^= *df_data_p;
-      df_data_p++;
-      temp_p++;
-    }
+  ret = drbg_sym_ctr (drbg, df_data, drbg_statelen(drbg),
+		      temp, drbg_statelen(drbg));
+  if (ret)
+    goto out;
 
   /* 10.2.1.2 step 5 */
-  memcpy (drbg->C, temp, drbg_keylen (drbg));
+  ret = _gcry_cipher_setkey (drbg->ctr_handle, temp, drbg_keylen (drbg));
+  if (ret)
+    goto out;
+
   /* 10.2.1.2 step 6 */
   memcpy (drbg->V, temp + drbg_keylen (drbg), drbg_blocklen (drbg));
+  /* See above: increment counter by one to compensate timing of CTR op */
+  drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
   ret = 0;
 
  out:
@@ -957,9 +975,6 @@ drbg_ctr_generate (drbg_state_t drbg,
                    drbg_string_t *addtl)
 {
   gpg_err_code_t ret = 0;
-  unsigned int len = 0;
-  drbg_string_t data;
-  unsigned char prefix = DRBG_PREFIX1;
 
   memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
 
@@ -973,24 +988,9 @@ drbg_ctr_generate (drbg_state_t drbg,
     }
 
   /* 10.2.1.5.2 step 4.1 */
-  drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-  drbg_string_fill (&data, drbg->V, drbg_blocklen (drbg));
-  while (len < buflen)
-    {
-      unsigned int outlen = 0;
-      /* 10.2.1.5.2 step 4.2 */
-      ret = drbg_sym (drbg, drbg->C, drbg->scratchpad, &data);
-      if (ret)
-	goto out;
-      outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
-	drbg_blocklen (drbg) : (buflen - len);
-      /* 10.2.1.5.2 step 4.3 */
-      memcpy (buf + len, drbg->scratchpad, outlen);
-      len += outlen;
-      /* 10.2.1.5.2 step 6 */
-      if (len < buflen)
-	drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-    }
+  ret = drbg_sym_ctr (drbg, drbg->ctr_null, DRBG_CTR_NULL_LEN, buf, buflen);
+  if (ret)
+    goto out;
 
   /* 10.2.1.5.2 step 6 */
   if (addtl)
@@ -998,13 +998,14 @@ drbg_ctr_generate (drbg_state_t drbg,
   ret = drbg_ctr_update (drbg, addtl, 3);
 
  out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   return ret;
 }
 
 static struct drbg_state_ops_s drbg_ctr_ops = {
   drbg_ctr_update,
-  drbg_ctr_generate
+  drbg_ctr_generate,
+  drbg_sym_init,
+  drbg_sym_fini,
 };
 
 /******************************************************************
@@ -1023,6 +1024,9 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
       /* 10.1.2.3 step 2 already implicitly covered with
        * the initial memset(0) of drbg->C */
       memset (drbg->V, 1, drbg_statelen (drbg));
+      ret = drbg_hmac_setkey (drbg, drbg->C);
+      if (ret)
+	return ret;
     }
 
   /* build linked list which implements the concatenation and fill
@@ -1044,12 +1048,16 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
 	prefix = DRBG_PREFIX1;
       /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
       seed2.buf = &prefix;
-      ret = drbg_hmac (drbg, drbg->C, drbg->C, &seed1);
+      ret = drbg_hash (drbg, drbg->C, &seed1);
+      if (ret)
+	return ret;
+
+      ret = drbg_hmac_setkey (drbg, drbg->C);
       if (ret)
 	return ret;
 
       /* 10.1.2.2 step 2 and 5 -- HMAC for V */
-      ret = drbg_hmac (drbg, drbg->C, drbg->V, &cipherin);
+      ret = drbg_hash (drbg, drbg->V, &cipherin);
       if (ret)
 	return ret;
 
@@ -1083,7 +1091,7 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
     {
       unsigned int outlen = 0;
       /* 10.1.2.5 step 4.1 */
-      ret = drbg_hmac (drbg, drbg->C, drbg->V, &data);
+      ret = drbg_hash (drbg, drbg->V, &data);
       if (ret)
 	return ret;
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
@@ -1104,7 +1112,9 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
 
 static struct drbg_state_ops_s drbg_hmac_ops = {
   drbg_hmac_update,
-  drbg_hmac_generate
+  drbg_hmac_generate,
+  drbg_hmac_init,
+  drbg_hash_fini,
 };
 
 /******************************************************************
@@ -1148,7 +1158,7 @@ drbg_hash_df (drbg_state_t drbg,
     {
       short blocklen = 0;
       /* 10.4.1 step 4.1 */
-      ret = drbg_hmac (drbg, NULL, tmp, &data1);
+      ret = drbg_hash (drbg, tmp, &data1);
       if (ret)
 	goto out;
       /* 10.4.1 step 4.2 */
@@ -1237,13 +1247,13 @@ drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
   data2.next = data3;
   data3->next = NULL;
   /* 10.1.1.4 step 2a -- cipher invocation */
-  ret = drbg_hmac (drbg, NULL, drbg->scratchpad, &data1);
+  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
   if (ret)
     goto out;
 
   /* 10.1.1.4 step 2b */
   drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		     drbg->scratchpad, drbg_blocklen (drbg));
+		drbg->scratchpad, drbg_blocklen (drbg));
 
  out:
   memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
@@ -1276,7 +1286,7 @@ drbg_hash_hashgen (drbg_state_t drbg,
     {
       unsigned int outlen = 0;
       /* 10.1.1.4 step hashgen 4.1 */
-      ret = drbg_hmac (drbg, NULL, dst, &data);
+      ret = drbg_hash (drbg, dst, &data);
       if (ret)
 	goto out;
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
@@ -1330,7 +1340,7 @@ drbg_hash_generate (drbg_state_t drbg,
   drbg_string_fill (&data1, &prefix, 1);
   drbg_string_fill (&data2, drbg->V, drbg_statelen (drbg));
   data1.next = &data2;
-  ret = drbg_hmac (drbg, NULL, drbg->scratchpad, &data1);
+  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
   if (ret)
     goto out;
 
@@ -1354,7 +1364,9 @@ drbg_hash_generate (drbg_state_t drbg,
  */
 static struct drbg_state_ops_s drbg_hash_ops = {
   drbg_hash_update,
-  drbg_hash_generate
+  drbg_hash_generate,
+  drbg_hash_init,
+  drbg_hash_fini,
 };
 
 /******************************************************************
@@ -1599,6 +1611,7 @@ drbg_uninstantiate (drbg_state_t drbg)
 {
   if (!drbg)
     return GPG_ERR_INV_ARG;
+  drbg->d_ops->crypto_fini(drbg);
   xfree (drbg->V);
   drbg->V = NULL;
   xfree (drbg->C);
@@ -1666,13 +1679,16 @@ drbg_instantiate (drbg_state_t drbg,
 
   /* 9.1 step 4 is implicit in  drbg_sec_strength */
 
-  /* no allocation of drbg as this is done by the kernel crypto API */
+  ret = drbg->d_ops->crypto_init(drbg);
+  if (ret)
+    goto err;
+
   drbg->V = xcalloc_secure (1, drbg_statelen (drbg));
   if (!drbg->V)
-    goto err;
+    goto fini;
   drbg->C = xcalloc_secure (1, drbg_statelen (drbg));
   if (!drbg->C)
-    goto err;
+    goto fini;
   /* scratchpad is only generated for CTR and Hash */
   if (drbg->core->flags & DRBG_HMAC)
     sb_size = 0;
@@ -1689,19 +1705,21 @@ drbg_instantiate (drbg_state_t drbg,
     {
       drbg->scratchpad = xcalloc_secure (1, sb_size);
       if (!drbg->scratchpad)
-	goto err;
+	goto fini;
     }
   dbg (("DRBG: state allocated with scratchpad size %u bytes\n", sb_size));
 
   /* 9.1 step 6 through 11 */
   ret = drbg_seed (drbg, pers, 0);
   if (ret)
-    goto err;
+    goto fini;
 
   dbg (("DRBG: core %d %s prediction resistance successfully initialized\n",
 	coreref, pr ? "with" : "without"));
   return 0;
 
+ fini:
+  drbg->d_ops->crypto_fini(drbg);
  err:
   drbg_uninstantiate (drbg);
   return ret;
@@ -2563,59 +2581,160 @@ _gcry_rngdrbg_selftest (selftest_report_func_t report)
  ***************************************************************/
 
 static gpg_err_code_t
-drbg_hmac (drbg_state_t drbg, const unsigned char *key,
-		unsigned char *outval, const drbg_string_t *buf)
+drbg_hash_init (drbg_state_t drbg)
 {
+  gcry_md_hd_t hd;
   gpg_error_t err;
+
+  err = _gcry_md_open (&hd, drbg->core->backend_cipher, 0);
+  if (err)
+    return err;
+
+  drbg->priv_data = hd;
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_hmac_init (drbg_state_t drbg)
+{
   gcry_md_hd_t hd;
+  gpg_error_t err;
 
-  if (key)
-    {
-      err =
-	_gcry_md_open (&hd, drbg->core->backend_cipher, GCRY_MD_FLAG_HMAC);
-      if (err)
-	return err;
-      err = _gcry_md_setkey (hd, key, drbg_statelen (drbg));
-      if (err)
-	return err;
-    }
-  else
-    {
-      err = _gcry_md_open (&hd, drbg->core->backend_cipher, 0);
-      if (err)
-	return err;
-    }
+  err = _gcry_md_open (&hd, drbg->core->backend_cipher, GCRY_MD_FLAG_HMAC);
+  if (err)
+    return err;
+
+  drbg->priv_data = hd;
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_hmac_setkey (drbg_state_t drbg, const unsigned char *key)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  return _gcry_md_setkey (hd, key, drbg_statelen (drbg));
+}
+
+static void
+drbg_hash_fini (drbg_state_t drbg)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  _gcry_md_close (hd);
+}
+
+static gpg_err_code_t
+drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  _gcry_md_reset(hd);
   for (; NULL != buf; buf = buf->next)
     _gcry_md_write (hd, buf->buf, buf->len);
   _gcry_md_final (hd);
   memcpy (outval, _gcry_md_read (hd, drbg->core->backend_cipher),
 	  drbg_blocklen (drbg));
-  _gcry_md_close (hd);
   return 0;
 }
 
+static void
+drbg_sym_fini (drbg_state_t drbg)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  if (hd)
+    _gcry_cipher_close (hd);
+  if (drbg->ctr_handle)
+    _gcry_cipher_close (drbg->ctr_handle);
+  if (drbg->ctr_null)
+    free(drbg->ctr_null);
+}
+
 static gpg_err_code_t
-drbg_sym (drbg_state_t drbg, const unsigned char *key,
-          unsigned char *outval, const drbg_string_t *buf)
+drbg_sym_init (drbg_state_t drbg)
 {
-  gpg_error_t err;
   gcry_cipher_hd_t hd;
+  gpg_error_t err;
+
+  drbg->ctr_null = calloc(1, DRBG_CTR_NULL_LEN);
+  if (!drbg->ctr_null)
+    return GPG_ERR_ENOMEM;
 
   err = _gcry_cipher_open (&hd, drbg->core->backend_cipher,
-                           GCRY_CIPHER_MODE_ECB, 0);
+			   GCRY_CIPHER_MODE_ECB, 0);
   if (err)
-    return err;
+    {
+      drbg_sym_fini (drbg);
+      return err;
+    }
+  drbg->priv_data = hd;
+
+  err = _gcry_cipher_open (&drbg->ctr_handle, drbg->core->backend_cipher,
+			   GCRY_CIPHER_MODE_CTR, 0);
+  if (err)
+    {
+      drbg_sym_fini (drbg);
+      return err;
+    }
+
+
   if (drbg_blocklen (drbg) !=
       _gcry_cipher_get_algo_blklen (drbg->core->backend_cipher))
-    return -GPG_ERR_NO_ERROR;
+    {
+      drbg_sym_fini (drbg);
+      return -GPG_ERR_NO_ERROR;
+    }
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_sym_setkey (drbg_state_t drbg, const unsigned char *key)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  return _gcry_cipher_setkey (hd, key, drbg_keylen (drbg));
+}
+
+static gpg_err_code_t
+drbg_sym (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  _gcry_cipher_reset(hd);
   if (drbg_blocklen (drbg) < buf->len)
     return -GPG_ERR_NO_ERROR;
-  err = _gcry_cipher_setkey (hd, key, drbg_keylen (drbg));
+  /* in is only component */
+  return _gcry_cipher_encrypt (hd, outval, drbg_blocklen (drbg), buf->buf,
+			       buf->len);
+}
+
+static gpg_err_code_t
+drbg_sym_ctr (drbg_state_t drbg,
+	      const unsigned char *inbuf, unsigned int inbuflen,
+	      unsigned char *outbuf, unsigned int outbuflen)
+{
+  gpg_error_t err;
+
+  _gcry_cipher_reset(drbg->ctr_handle);
+  err = _gcry_cipher_setctr(drbg->ctr_handle, drbg->V, drbg_blocklen (drbg));
   if (err)
     return err;
-  /* in is only component */
-  _gcry_cipher_encrypt (hd, outval, drbg_blocklen (drbg), buf->buf,
-			buf->len);
-  _gcry_cipher_close (hd);
-  return 0;
+
+  while (outbuflen)
+    {
+       unsigned int cryptlen = (inbuflen > outbuflen) ? outbuflen : inbuflen;
+
+       err = _gcry_cipher_encrypt (drbg->ctr_handle, outbuf, cryptlen, inbuf,
+				   cryptlen);
+       if (err)
+         return err;
+
+       outbuflen -= cryptlen;
+       outbuf += cryptlen;
+    }
+  return _gcry_cipher_getctr(drbg->ctr_handle, drbg->V, drbg_blocklen (drbg));
 }

commit 227099f179df9dcf083d0ef6be9883c775df0874
Author: Stephan Mueller <smueller at chronox.de>
Date:   Thu Dec 1 17:11:42 2016 +0100

    cipher: New function for reading the counter in CTR mode
    
    * cipher/cipher.c (gcry_cipher_getctr): New.
    --
    The API call allows reading the current counter of the CTR mode. The API
    remains internal to libgcrypt and is not exported to external callers.
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChangeLog entry above added by -wk

diff --git a/cipher/cipher.c b/cipher/cipher.c
index ff3340f..55853da 100644
--- a/cipher/cipher.c
+++ b/cipher/cipher.c
@@ -1117,6 +1117,16 @@ _gcry_cipher_setctr (gcry_cipher_hd_t hd, const void *ctr, size_t ctrlen)
   return 0;
 }
 
+gpg_err_code_t
+_gcry_cipher_getctr (gcry_cipher_hd_t hd, void *ctr, size_t ctrlen)
+{
+  if (ctr && ctrlen == hd->spec->blocksize)
+    memcpy (ctr, hd->u_ctr.ctr, hd->spec->blocksize);
+  else
+    return GPG_ERR_INV_ARG;
+
+  return 0;
+}
 
 gcry_err_code_t
 _gcry_cipher_authenticate (gcry_cipher_hd_t hd, const void *abuf,
diff --git a/src/gcrypt-int.h b/src/gcrypt-int.h
index 729f54a..ef5337b 100644
--- a/src/gcrypt-int.h
+++ b/src/gcrypt-int.h
@@ -77,6 +77,8 @@ gpg_err_code_t _gcry_cipher_checktag (gcry_cipher_hd_t hd, const void *intag,
                                       size_t taglen);
 gpg_err_code_t _gcry_cipher_setctr (gcry_cipher_hd_t hd,
                                     const void *ctr, size_t ctrlen);
+gpg_err_code_t _gcry_cipher_getctr (gcry_cipher_hd_t hd,
+                                    void *ctr, size_t ctrlen);
 size_t _gcry_cipher_get_algo_keylen (int algo);
 size_t _gcry_cipher_get_algo_blklen (int algo);
 

commit df8634d8e2b595430dc1e6575a7452c242cffca1
Author: Stephan Mueller <smueller at chronox.de>
Date:   Sun Nov 27 10:14:21 2016 +0100

    doc: Remove comment that is not applicable any more.
    
    --
    Signed-off-by: Stephan Mueller <smueller at chronox.de>

diff --git a/random/random-drbg.c b/random/random-drbg.c
index f9d11a3..9676f0e 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -899,8 +899,6 @@ drbg_ctr_update (drbg_state_t drbg, drbg_string_t *addtl, int reseed)
     memset (df_data, 0, drbg_statelen (drbg));
 
   /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
-  /* TODO use reseed variable to avoid re-doing DF operation */
-  (void) reseed;
   if (addtl && 0 < addtl->len)
     {
       ret =

commit 677ddf5bbd9c172a72607c7d5d7006907071c2cf
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 7 18:55:06 2016 +0100

    doc: Update NEWS.
    
    --

diff --git a/NEWS b/NEWS
index 0aaf863..722172a 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,14 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
      blocking read of /dev/random.  This allows other nPth threads to
      run while Libgcrypt is gathering entropy.
 
+   - When secure memory is requested by the MPI functions or by
+     gcry_xmalloc_secure, they do not anymore lead to a fatal error if
+     the secure memory pool is used up.  Instead new pools are
+     allocated as needed.  These new pools are not protected against
+     being swapped out (mlock can't be used).  However, these days
+     this is considered a minor issue and can easily be mitigated by
+     using encrypted swap space.
+
 
  * Interface changes relative to the 1.6.0 release:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----------------------------------------------------------------------

Summary of changes:
 NEWS                 |   8 +
 cipher/cipher.c      |  10 ++
 random/random-drbg.c | 421 ++++++++++++++++++++++++++++++---------------------
 src/gcrypt-int.h     |   2 +
 4 files changed, 266 insertions(+), 175 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 11:37:32 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 11:37:32 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 55eb257c40313f8fbaee6938d0c9f0eeb9ceef10
Message-ID: <E1cEw50-0005h7-UK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  55eb257c40313f8fbaee6938d0c9f0eeb9ceef10 (commit)
      from  1c99eac456264ffc8979578a7e907ec238af59fc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 55eb257c40313f8fbaee6938d0c9f0eeb9ceef10
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 11:34:23 2016 +0100

    jenkins: Add scripts from our jenkins installation

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
new file mode 100755
index 0000000..23f78eb
--- /dev/null
+++ b/misc/jenkins/bin/build.bash
@@ -0,0 +1,167 @@
+#!/bin/bash
+
+set -xe
+
+renice -n 10 -p $$
+
+PREFIX=$HOME/prefix/$XTARGET
+ORIGINAL_PREFIX=$HOME/prefix/$XTARGET
+export PATH=$PREFIX/bin:$PATH
+
+env
+
+# Tweak the prefix we're installing this project into.  For gnupg-1.4
+# and friends.
+case "$JOB_NAME" in
+    *-1.4*)
+        PREFIX=$PREFIX-1.4
+        ;;
+    *-2.0*)
+        PREFIX=$PREFIX-2.0
+        ;;
+    *-2.2*)
+        PREFIX=$PREFIX-2.2
+        ;;
+esac
+mkdir -p $PREFIX
+
+fix_permissions()
+{
+  find $1 -type d -exec chmod +w {} + || true
+}
+
+fix_permissions .
+git clean -fdx
+./autogen.sh
+
+MAKEFLAGS="-j2"
+SCANBUILD=
+if [ "$(uname)" = Linux ]; then
+    # XXX: We should really have an analyzer target
+    SCANBUILD="scan-build -o ${WORKSPACE}/clangScanBuildReports -v"
+fi
+CONFIGUREFLAGS=
+SANFLAGS=""
+if [ "$(uname)" = Linux ]; then
+    # XXX: We should really have an analyzer target
+    SANFLAGS="-fsanitize=undefined -fsanitize=address"
+fi
+
+if [ "$(uname)" = Darwin ]; then
+    # XXX until we properly set this somewhere else
+    cversion="_DARWIN_C_SOURCE=900000L"
+    CFLAGS="$CFLAGS -D$cversion"
+    CXXFLAGS="$CXXFLAGS -D$cversion"
+fi
+
+case "$JOB_NAME" in
+    *tgpg*)
+        MAKEFLAGS="$MAKEFLAGS GPG=/usr/bin/gpg2"
+        ;;
+    *gpgme*)
+        # using libasan for python broke again, so disable the python bindings for the native build
+        if [ "$XTARGET" = native ] && [ "$label" != macos ]; then
+            CONFIGUREFLAGS_0="--enable-languages=cpp qt"
+        fi
+        ;;
+    *gnupg*)
+        if [ "$XTARGET" = native ]; then
+            CONFIGUREFLAGS="--enable-wks-tools --enable-g13 --enable-symcryptrun --enable-gpg2-is-gpg"
+        fi
+        if [ "$XTARGET" = w32 ]; then
+            CONFIGUREFLAGS="--enable-wks-tools --enable-gpg2-is-gpg --with-zlib=$ORIGINAL_PREFIX --with-bzip2=$ORIGINAL_PREFIX"
+        fi
+	if [ "$NODE_NAME" = zygalski ]; then
+	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=$HOME/pkg"
+	fi
+        ;;
+esac
+
+abs_configure="$(pwd)/configure"
+mkdir -p obj
+cd obj
+
+case "$XTARGET" in
+    native)
+        ASAN_OPTIONS=detect_leaks=0 \
+        $SCANBUILD \
+            ../configure --prefix=$PREFIX --enable-maintainer-mode \
+	           $CONFIGUREFLAGS \
+	           "$CONFIGUREFLAGS_0" \
+	           CFLAGS="$CFLAGS $SANFLAGS -fPIC" \
+	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
+        $SCANBUILD make $MAKEFLAGS
+
+        # so make sure the asan runtime is there for e.g. python
+        PATH=/home/jenkins/bin:$PATH \
+        LD_LIBRARY_PATH=$PREFIX/lib \
+          make check verbose=2 LD_LIBRARY_PATH=$PREFIX/lib || true
+        # Jenkins looks for "tests? failed" to mark a build unstable,
+        # hence || true here
+
+        make install
+        ;;
+    w32)
+        export w32root=$PREFIX
+
+	# autogen.rc adds --with-gpg-error-prefix=@SYSROOT@, so we cannot
+	# install to a prefix that doesn't also contain all the dependencies,
+	# patch that out, so that the gpg-error-config and friends are located
+	# using PATH
+	if [ -f "/home/jenkins/bin/$(dirname $JOB_NAME)-w32.patch" ]; then
+	  ( cd .. && patch -p1 <"/home/jenkins/bin/$(dirname $JOB_NAME)-w32.patch" )
+	fi
+	# We need to point it to npth and adns then...
+	CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-npth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"
+
+        # gpg1's autogen.sh does not add --enable-maintainer-mode, so
+        # version.texi is not generated.  we add it here to be sure.
+        # likewise for --prefix
+        ../autogen.sh --build-w32 --enable-maintainer-mode --prefix=$PREFIX \
+          $CONFIGUREFLAGS
+        make $MAKEFLAGS
+        make install
+
+	case "$JOB_NAME" in
+		gnupg/*|gnupg-2.2/*)
+			bash /home/jenkins/bin/make-windows-cd.sh
+			;;
+	esac
+        ;;
+    distcheck)
+        CONFIGUREFLAGS=
+	WORKDIR="$(mktemp -d)"
+	cleanup()
+	{
+	  cd /tmp
+	  fix_permissions "$WORKDIR"
+	  rm -rf -- "$WORKDIR" || true
+	}
+	trap cleanup EXIT
+
+	  cd "$WORKDIR"
+          $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
+                   $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
+          make $MAKEFLAGS distcheck
+          tarname=$(awk <config.h '
+	             /^#define PACKAGE_TARNAME/ {gsub(/"/,"",$3);name=$3};
+	             /^#define PACKAGE_VERSION/ {gsub(/"/,"",$3);vers=$3};
+		     END {print name "-" vers}')
+	  if [ -f "${tarname}.tar.bz2" ]; then
+	     bzcat "${tarname}.tar.bz2" | tar xf -
+	  elif [ -f "${tarname}.tar.gz" ]; then
+	     zcat "${tarname}.tar.gz" | tar xf -
+          else
+	     echo "No tarball named $tarname found - skipping installation" >&2
+	     exit 0
+	  fi
+	  cd ${tarname}
+	  ./configure --prefix=$PREFIX $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
+	  make $MAKEFLAGS
+	  make $MAKEFLAGS install
+
+        ;;
+    *)
+        echo "Bad XTARGET: '$XTARGET'"
+        exit 2
+esac
diff --git a/misc/jenkins/bin/make-windows-cd.sh b/misc/jenkins/bin/make-windows-cd.sh
new file mode 100644
index 0000000..a66c38a
--- /dev/null
+++ b/misc/jenkins/bin/make-windows-cd.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+set -ex
+
+if ! [ -f config.log ] || ! grep -q mingw config.log; then
+    echo "must be run from a configured windows build environment"
+fi
+
+[ -z "$w32root" ] && w32root="$HOME/w32root"
+ADDITIONAL_FILES=
+IMAGE=gnupg-test.iso
+
+[ -f make-windows-cd.rc ] && . make-windows-cd.rc
+
+# we pick binaries from the prefix, so make sure they are current.
+make install
+
+WORKDIR="$(mktemp --directory)"
+TARGET="${WORKDIR}/gnupg"
+
+mkdir "$TARGET"
+
+[ "$ADDITIONAL_FILES" ] && cp -v $(ls -1 $ADDITIONAL_FILES) $TARGET
+cp -v $w32root/bin/*.exe $w32root/bin/*.dll $TARGET
+cp -v tests/gpgscm/*.exe $TARGET
+# XXX mk-tdata is on the way out
+cp -v tools/mk-tdata.exe $TARGET || true
+cp -v agent/gpg-preset-passphrase.exe $TARGET
+cp -v -a ../tests $TARGET
+cp -v tests/openpgp/fake-pinentry.exe $TARGET
+cp -v /home/jenkins/bin/run-tests.bat $WORKDIR
+genisoimage --output "$IMAGE" -J "$WORKDIR"
+[ "${WORKDIR}" ] && rm -rf -- "${WORKDIR}"
diff --git a/misc/jenkins/bin/python.txt b/misc/jenkins/bin/python.txt
new file mode 100644
index 0000000..6eaf41a
--- /dev/null
+++ b/misc/jenkins/bin/python.txt
@@ -0,0 +1 @@
+leak:python
diff --git a/misc/jenkins/bin/python3 b/misc/jenkins/bin/python3
new file mode 100755
index 0000000..fed5c24
--- /dev/null
+++ b/misc/jenkins/bin/python3
@@ -0,0 +1,4 @@
+#!/bin/sh
+LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libasan.so.2 \
+LSAN_OPTIONS=suppressions=/home/jenkins/bin/python.txt \
+exec /usr/bin/python3 "$@"
diff --git a/misc/jenkins/bin/run-tests.bat b/misc/jenkins/bin/run-tests.bat
new file mode 100644
index 0000000..d88e197
--- /dev/null
+++ b/misc/jenkins/bin/run-tests.bat
@@ -0,0 +1,27 @@
+ at echo off
+cd /d d:\
+
+set TARGET=gnupg-test
+
+set GNUPGHOME=c:/%TARGET%/tests/openpgp
+c:/%TARGET%/gpg-connect-agent.exe killagent /bye
+rem is there a nicer way to sleep?
+ping -n 1 localhost > nul
+set GNUPGHOME=
+
+rmdir /q /s c:\%TARGET%
+mkdir c:\%TARGET%
+xcopy /q /s d:\gnupg c:\%TARGET%
+
+set GPGSCM_PATH=c:/%TARGET%/tests/gpgscm;c:/%TARGET%/tests/openpgp
+set EXEEXT=.exe
+set srcdir=/%TARGET%/tests/openpgp
+set BIN_PREFIX=c:/%TARGET%
+set TMP=c:\temp
+mkdir %TMP%
+
+cd /d c:\%TARGET%
+c:\%TARGET%\gpgscm.exe --verbose tests/gpgscm/t-child.scm
+
+cd /d c:\%TARGET%\tests\openpgp
+c:\%TARGET%\gpgscm.exe run-tests.scm --shared version.scm mds.scm decrypt.scm decrypt-dsa.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-dsa.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm gpgv-forged-keyring.scm armor.scm import.scm ecc.scm 4gb-packet.scm tofu.scm gpgtar.scm use-exact-key.scm default-key.scm export.scm ssh.scm quick-key-manipulation.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash         | 167 ++++++++++++++++++++++++++++++++++++
 misc/jenkins/bin/make-windows-cd.sh |  33 +++++++
 misc/jenkins/bin/python.txt         |   1 +
 misc/jenkins/bin/python3            |   4 +
 misc/jenkins/bin/run-tests.bat      |  27 ++++++
 5 files changed, 232 insertions(+)
 create mode 100755 misc/jenkins/bin/build.bash
 create mode 100644 misc/jenkins/bin/make-windows-cd.sh
 create mode 100644 misc/jenkins/bin/python.txt
 create mode 100755 misc/jenkins/bin/python3
 create mode 100644 misc/jenkins/bin/run-tests.bat


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 13:11:04 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 13:11:04 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-68-gdd03667
Message-ID: <E1cExXY-0002Go-5n@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dd03667ab1062bba3b9413c3f8007d63302d1b31 (commit)
       via  b265969154741bf9f93167699fe7ddda1d485265 (commit)
       via  c3008bffac68b6f31e9ae9bad837cdce5de7c0db (commit)
      from  dec2ae31a46a0f41886c7ad228865cc573f2dea9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dd03667ab1062bba3b9413c3f8007d63302d1b31
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 13:04:06 2016 +0100

    tools: Fix use of uninitialized var in mime-maker.
    
    * tools/mime-maker.c (ensure_part): Make sure to set R_PARENT on
    error.
    (add_missing_headers): Ensure that ERR is set on success.
    
    * tools/wks-util.c (wks_parse_policy): Fix indentation.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/mime-maker.c b/tools/mime-maker.c
index ca05f1d..2e32069 100644
--- a/tools/mime-maker.c
+++ b/tools/mime-maker.c
@@ -251,7 +251,11 @@ ensure_part (mime_maker_t ctx, part_t *r_parent)
     {
       ctx->mail = xtrycalloc (1, sizeof *ctx->mail);
       if (!ctx->mail)
-        return gpg_error_from_syserror ();
+        {
+          if (r_parent)
+            *r_parent = NULL;
+          return gpg_error_from_syserror ();
+        }
       log_assert (!ctx->current_part);
       ctx->current_part = ctx->mail;
       ctx->current_part->headers_tail = &ctx->current_part->headers;
@@ -722,6 +726,7 @@ add_missing_headers (mime_maker_t ctx)
         goto leave;
     }
 
+  err = 0;
 
  leave:
   return err;
diff --git a/tools/wks-util.c b/tools/wks-util.c
index 183bdcd..1b47612 100644
--- a/tools/wks-util.c
+++ b/tools/wks-util.c
@@ -164,7 +164,8 @@ wks_parse_policy (policy_flags_t flags, estream_t stream, int ignore_unknown)
 
   if (!err && !es_feof (stream))
     err = gpg_error_from_syserror ();
-    leave:
+
+ leave:
   if (err)
     log_error ("error reading '%s', line %d: %s\n",
                es_fname_get (stream), lnr, gpg_strerror (err));

commit b265969154741bf9f93167699fe7ddda1d485265
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 13:02:37 2016 +0100

    tools: Fix memleak in gpgconf.
    
    * tools/gpgconf.c (main): Free SOCKETDIR.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index 67a0dce..5f7912a 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -691,6 +691,7 @@ main (int argc, char **argv)
             if (gnupg_mkdir (socketdir, "-rwx"))
               gc_error (1, errno, "error creating '%s'", socketdir);
             /* Try again.  */
+            xfree (socketdir);
             socketdir = _gnupg_socketdir_internal (1, &flags);
           }
 

commit c3008bffac68b6f31e9ae9bad837cdce5de7c0db
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 13:06:10 2016 +0100

    gpg: Fix portability problem.
    
    * g10/tofu.c (build_conflict_set): Replace variable dynamic array.
    --
    
    Note that clang complained that CONFLICT_SET_COUNT could be negative.
    Thus I added an assert.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/tofu.c b/g10/tofu.c
index 5b3e84c..d095bce 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2227,9 +2227,15 @@ build_conflict_set (tofu_dbs_t dbs,
     int j;
     strlist_t *prevp;
     strlist_t iter_next;
-    int die[conflict_set_count];
+    int *die;
 
-    memset (die, 0, sizeof (die));
+    log_assert (conflict_set_count > 0);
+    die = xtrycalloc (1, conflict_set_count);
+    if (!die)
+      {
+        /*err = gpg_error_from_syserror ();*/
+        xoutofcore (); /* Fixme: Let the fucntion return an error.  */
+      }
 
     for (i = 0; i < conflict_set_count; i ++)
       {
@@ -2269,6 +2275,7 @@ build_conflict_set (tofu_dbs_t dbs,
     /* We shouldn't have removed the head.  */
     log_assert (conflict_set);
     log_assert (conflict_set_count >= 1);
+    xfree (die);
   }
   xfree (kb_all);
 

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c         | 11 +++++++++--
 tools/gpgconf.c    |  1 +
 tools/mime-maker.c |  7 ++++++-
 tools/wks-util.c   |  3 ++-
 4 files changed, 18 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 15:41:30 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 08 Dec 2016 15:41:30 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-70-ga2bedc8
Message-ID: <E1cEzt7-0001kt-6a@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a2bedc8ac6fcdcd1de0a9fa3d540006481387dff (commit)
       via  3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a (commit)
      from  dd03667ab1062bba3b9413c3f8007d63302d1b31 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a2bedc8ac6fcdcd1de0a9fa3d540006481387dff
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 8 15:39:05 2016 +0100

    gpgscm: Generalize 'for-each-p'.
    
    * tests/gpgscm/tests.scm (for-each-p): Generalize to N lists like
    for-each.
    (for-each-p'): Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index e2b38f5..bd51819 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -77,17 +77,18 @@
 	(flush-stdio)))
   (set! *progress-nesting* (- *progress-nesting* 1)))
 
-(define (for-each-p msg proc lst)
-  (for-each-p' msg proc (lambda (x) x) lst))
+(define (for-each-p msg proc lst . lsts)
+  (apply for-each-p' `(,msg ,proc ,(lambda (x . xs) x) ,lst , at lsts)))
 
-(define (for-each-p' msg proc fmt lst)
+(define (for-each-p' msg proc fmt lst . lsts)
   (call-with-progress
    msg
    (lambda (progress)
-     (for-each (lambda (a)
-		 (progress (fmt a))
-		 (proc a))
-	       lst))))
+     (apply for-each
+	    `(,(lambda args
+		 (progress (apply fmt args))
+		 (apply proc args))
+	      ,lst , at lsts)))))
 
 ;; Process management.
 (define CLOSED_FD -1)

commit 3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 8 14:17:50 2016 +0100

    g10: Fix out-of-bounds access.
    
    * g10/tofu.c (build_conflict_set): Use 'char'.
    
    Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index d095bce..abf1ab4 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2227,7 +2227,7 @@ build_conflict_set (tofu_dbs_t dbs,
     int j;
     strlist_t *prevp;
     strlist_t iter_next;
-    int *die;
+    char *die;
 
     log_assert (conflict_set_count > 0);
     die = xtrycalloc (1, conflict_set_count);

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c             |  2 +-
 tests/gpgscm/tests.scm | 15 ++++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 17:07:08 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 17:07:08 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-73-ga75790b
Message-ID: <E1cF1E0-0005rI-1W@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a75790b74095828f967c012eff7033f570d93077 (commit)
       via  d8c5e8ccfdb53cc327f7520fc7badc31d0c9c666 (commit)
       via  c3138decd77d788906885b638b344d0d1faf32c0 (commit)
      from  a2bedc8ac6fcdcd1de0a9fa3d540006481387dff (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a75790b74095828f967c012eff7033f570d93077
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 17:03:26 2016 +0100

    gpg: Fix the fix out-of-bounds access.
    
    * g10/tofu.c (build_conflict_set): Revert to int* and fix calloc.
    --
    
    The original code used an int array and thus better keep that and do
    not limit it to 128 entries.
    
    Fixes-commit: c3008bffac68b6f31e9ae9bad837cdce5de7c0db
    Fixes-commit: 3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/tofu.c b/g10/tofu.c
index abf1ab4..d15b25f 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2227,10 +2227,10 @@ build_conflict_set (tofu_dbs_t dbs,
     int j;
     strlist_t *prevp;
     strlist_t iter_next;
-    char *die;
+    int *die;
 
     log_assert (conflict_set_count > 0);
-    die = xtrycalloc (1, conflict_set_count);
+    die = xtrycalloc (conflict_set_count, sizeof *die);
     if (!die)
       {
         /*err = gpg_error_from_syserror ();*/

commit d8c5e8ccfdb53cc327f7520fc7badc31d0c9c666
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 16:57:21 2016 +0100

    wks: New option --check for gpg-wks-client.
    
    * tools/call-dirmngr.c (wkd_get_key): New.
    * tools/gpg-wks-client.c (aCheck): New constant.
    (opts): New option "--check".
    (main): Call command_check.
    (command_check): New.
    --
    
    GnuPG-bug-id: 2866
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/call-dirmngr.c b/tools/call-dirmngr.c
index c5ee244..51f1fa1 100644
--- a/tools/call-dirmngr.c
+++ b/tools/call-dirmngr.c
@@ -258,3 +258,55 @@ wkd_get_policy_flags (const char *addrspec, estream_t *r_buffer)
   assuan_release (ctx);
   return err;
 }
+
+
+/* Ask the dirmngr for the key for ADDRSPEC.  On success a stream with
+ * the key is stored at R_KEY.  */
+gpg_error_t
+wkd_get_key (const char *addrspec, estream_t *r_key)
+{
+  gpg_error_t err;
+  assuan_context_t ctx;
+  struct wkd_get_parm_s parm;
+  char *line = NULL;
+
+  memset (&parm, 0, sizeof parm);
+  *r_key = NULL;
+
+  err = connect_dirmngr (&ctx);
+  if (err)
+    return err;
+
+  line = es_bsprintf ("WKD_GET -- %s", addrspec);
+  if (!line)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+  if (strlen (line) + 2 >= ASSUAN_LINELENGTH)
+    {
+      err = gpg_error (GPG_ERR_TOO_LARGE);
+      goto leave;
+    }
+
+  parm.memfp = es_fopenmem (0, "rwb");
+  if (!parm.memfp)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+  err = assuan_transact (ctx, line, wkd_get_data_cb, &parm,
+                         NULL, NULL, wkd_get_status_cb, &parm);
+  if (err)
+    goto leave;
+
+  es_rewind (parm.memfp);
+  *r_key = parm.memfp;
+  parm.memfp = NULL;
+
+ leave:
+  es_fclose (parm.memfp);
+  xfree (line);
+  assuan_release (ctx);
+  return err;
+}
diff --git a/tools/call-dirmngr.h b/tools/call-dirmngr.h
index 83ebd2c..32486b1 100644
--- a/tools/call-dirmngr.h
+++ b/tools/call-dirmngr.h
@@ -25,5 +25,7 @@ gpg_error_t wkd_get_submission_address (const char *addrspec,
                                         char **r_addrspec);
 gpg_error_t wkd_get_policy_flags (const char *addrspec, estream_t *r_buffer);
 
+gpg_error_t wkd_get_key (const char *addrspec, estream_t *r_key);
+
 
 #endif /*GNUPG_TOOLS_CALL_DIRMNGR_H*/
diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
index 9bf5403..1a53f39 100644
--- a/tools/gpg-wks-client.c
+++ b/tools/gpg-wks-client.c
@@ -50,6 +50,7 @@ enum cmd_and_opt_values
     oDebug      = 500,
 
     aSupported,
+    aCheck,
     aCreate,
     aReceive,
     aRead,
@@ -68,6 +69,8 @@ static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_c (aSupported, "supported",
               ("check whether provider supports WKS")),
+  ARGPARSE_c (aCheck, "check",
+              ("check whether a key is available")),
   ARGPARSE_c (aCreate,   "create",
               ("create a publication request")),
   ARGPARSE_c (aReceive,   "receive",
@@ -111,6 +114,7 @@ const char *fake_submission_addr;
 
 static void wrong_args (const char *text) GPGRT_ATTR_NORETURN;
 static gpg_error_t command_supported (char *userid);
+static gpg_error_t command_check (char *userid);
 static gpg_error_t command_send (const char *fingerprint, char *userid);
 static gpg_error_t encrypt_response (estream_t *r_output, estream_t input,
                                      const char *addrspec,
@@ -198,6 +202,7 @@ parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
 	case aCreate:
 	case aReceive:
 	case aRead:
+        case aCheck:
           cmd = pargs->r_opt;
           break;
 
@@ -290,6 +295,12 @@ main (int argc, char **argv)
         log_error ("processing mail failed: %s\n", gpg_strerror (err));
       break;
 
+    case aCheck:
+      if (argc != 1)
+        wrong_args ("--check USER-ID");
+      command_check (argv[0]);
+      break;
+
     default:
       usage (1);
       break;
@@ -532,6 +543,96 @@ command_supported (char *userid)
 
 
 

+/* Check whether the key for USERID is available in the WKD.  */
+static gpg_error_t
+command_check (char *userid)
+{
+  gpg_error_t err;
+  char *addrspec = NULL;
+  estream_t key = NULL;
+  char *fpr = NULL;
+  strlist_t mboxes = NULL;
+  strlist_t sl;
+  int found = 0;
+
+  addrspec = mailbox_from_userid (userid);
+  if (!addrspec)
+    {
+      log_error (_("\"%s\" is not a proper mail address\n"), userid);
+      err = gpg_error (GPG_ERR_INV_USER_ID);
+      goto leave;
+    }
+
+  /* Get the submission address.  */
+  err = wkd_get_key (addrspec, &key);
+  switch (gpg_err_code (err))
+    {
+    case 0:
+      if (opt.verbose)
+        log_info ("public key for '%s' found via WKD\n", addrspec);
+      /* Fixme: Check that the key contains the user id.  */
+      break;
+
+    case GPG_ERR_NO_DATA: /* No such key.  */
+      if (opt.verbose)
+        log_info ("public key for '%s' NOT found via WKD\n", addrspec);
+      err = gpg_error (GPG_ERR_NO_PUBKEY);
+      log_inc_errorcount ();
+      break;
+
+    case GPG_ERR_UNKNOWN_HOST:
+      if (opt.verbose)
+        log_info ("error looking up '%s' via WKD: %s\n",
+                  addrspec, gpg_strerror (err));
+      err = gpg_error (GPG_ERR_NOT_SUPPORTED);
+      break;
+
+    default:
+      log_error ("error looking up '%s' via WKD: %s\n",
+                 addrspec, gpg_strerror (err));
+      break;
+    }
+
+  if (err)
+    goto leave;
+
+  /* Look closer at the key.  */
+  err = wks_list_key (key, &fpr, &mboxes);
+  if (err || !fpr)
+    {
+      log_error ("error parsing key: %s\n",
+                 err? gpg_strerror (err) : "no fingerprint found");
+      err = gpg_error (GPG_ERR_NO_PUBKEY);
+      goto leave;
+    }
+
+  if (opt.verbose)
+    log_info ("fingerprint: %s\n", fpr);
+
+  for (sl = mboxes; sl; sl = sl->next)
+    {
+      if (!strcmp (sl->d, addrspec))
+        found = 1;
+      if (opt.verbose)
+        log_info ("  addr-spec: %s\n", sl->d);
+    }
+  if (!found)
+    {
+      log_error ("public key for '%s' has no user id with the mail address\n",
+                 addrspec);
+      err = gpg_error (GPG_ERR_CERT_REVOKED);
+    }
+
+ leave:
+  xfree (fpr);
+  free_strlist (mboxes);
+  es_fclose (key);
+  xfree (addrspec);
+  return err;
+}
+
+
+

 /* Locate the key by fingerprint and userid and send a publication
  * request.  */
 static gpg_error_t

commit c3138decd77d788906885b638b344d0d1faf32c0
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 16:11:42 2016 +0100

    tools: Move a function from gpg-wks-server to wks-util.c.
    
    * tools/gpg-wks-server.c (list_key_status_cb): Remove.
    (list_key): Move to ...
    * tools/wks-util.c (wks_list_key): here and rename.  Add new args
    R_FPR and R_MBOXES and remove the CTX.
    (list_key_status_cb): New.
    * tools/wks-util.c: Include ccparray.h, exectool.h, and mbox-util.h.
    * tools/gpg-wks-server.c (process_new_key): Replace list_key by
    wks_list_key.
    (check_and_publish): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpg-wks-server.c b/tools/gpg-wks-server.c
index fd65b40..1a91858 100644
--- a/tools/gpg-wks-server.c
+++ b/tools/gpg-wks-server.c
@@ -348,168 +348,6 @@ main (int argc, char **argv)
 }
 
 
-

-static void
-list_key_status_cb (void *opaque, const char *keyword, char *args)
-{
-  server_ctx_t ctx = opaque;
-  (void)ctx;
-  if (DBG_CRYPTO)
-    log_debug ("gpg status: %s %s\n", keyword, args);
-}
-
-
-static gpg_error_t
-list_key (server_ctx_t ctx, estream_t key)
-{
-  gpg_error_t err;
-  ccparray_t ccp;
-  const char **argv;
-  estream_t listing;
-  char *line = NULL;
-  size_t length_of_line = 0;
-  size_t  maxlen;
-  ssize_t len;
-  char **fields = NULL;
-  int nfields;
-  int lnr;
-  char *mbox = NULL;
-
-  /* We store our results in the context - clear it first.  */
-  xfree (ctx->fpr);
-  ctx->fpr = NULL;
-  free_strlist (ctx->mboxes);
-  ctx->mboxes = NULL;
-
-  /* Open a memory stream.  */
-  listing = es_fopenmem (0, "w+b");
-  if (!listing)
-    {
-      err = gpg_error_from_syserror ();
-      log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
-      return err;
-    }
-
-  ccparray_init (&ccp, 0);
-
-  ccparray_put (&ccp, "--no-options");
-  if (!opt.verbose)
-    ccparray_put (&ccp, "--quiet");
-  else if (opt.verbose > 1)
-    ccparray_put (&ccp, "--verbose");
-  ccparray_put (&ccp, "--batch");
-  ccparray_put (&ccp, "--status-fd=2");
-  ccparray_put (&ccp, "--always-trust");
-  ccparray_put (&ccp, "--with-colons");
-  ccparray_put (&ccp, "--dry-run");
-  ccparray_put (&ccp, "--import-options=import-minimal,import-show");
-  ccparray_put (&ccp, "--import");
-
-  ccparray_put (&ccp, NULL);
-  argv = ccparray_get (&ccp, NULL);
-  if (!argv)
-    {
-      err = gpg_error_from_syserror ();
-      goto leave;
-    }
-  err = gnupg_exec_tool_stream (opt.gpg_program, argv, key,
-                                NULL, listing,
-                                list_key_status_cb, ctx);
-  if (err)
-    {
-      log_error ("import failed: %s\n", gpg_strerror (err));
-      goto leave;
-    }
-
-  es_rewind (listing);
-  lnr = 0;
-  maxlen = 2048; /* Set limit.  */
-  while ((len = es_read_line (listing, &line, &length_of_line, &maxlen)) > 0)
-    {
-      lnr++;
-      if (!maxlen)
-        {
-          log_error ("received line too long\n");
-          err = gpg_error (GPG_ERR_LINE_TOO_LONG);
-          goto leave;
-        }
-      /* Strip newline and carriage return, if present.  */
-      while (len > 0
-	     && (line[len - 1] == '\n' || line[len - 1] == '\r'))
-	line[--len] = '\0';
-      /* log_debug ("line '%s'\n", line); */
-
-      xfree (fields);
-      fields = strtokenize (line, ":");
-      if (!fields)
-        {
-          err = gpg_error_from_syserror ();
-          log_error ("strtokenize failed: %s\n", gpg_strerror (err));
-          goto leave;
-        }
-      for (nfields = 0; fields[nfields]; nfields++)
-        ;
-      if (!nfields)
-        {
-          err = gpg_error (GPG_ERR_INV_ENGINE);
-          goto leave;
-        }
-      if (!strcmp (fields[0], "sec"))
-        {
-          /* gpg may return "sec" as the first record - but we do not
-           * accept secret keys.  */
-          err = gpg_error (GPG_ERR_NO_PUBKEY);
-          goto leave;
-        }
-      if (lnr == 1 && strcmp (fields[0], "pub"))
-        {
-          /* First record is not a public key.  */
-          err = gpg_error (GPG_ERR_INV_ENGINE);
-          goto leave;
-        }
-      if (lnr > 1 && !strcmp (fields[0], "pub"))
-        {
-          /* More than one public key.  */
-          err = gpg_error (GPG_ERR_TOO_MANY);
-          goto leave;
-        }
-      if (!strcmp (fields[0], "sub") || !strcmp (fields[0], "ssb"))
-        break; /* We can stop parsing here.  */
-
-      if (!strcmp (fields[0], "fpr") && nfields > 9 && !ctx->fpr)
-        {
-          ctx->fpr = xtrystrdup (fields[9]);
-          if (!ctx->fpr)
-            {
-              err = gpg_error_from_syserror ();
-              goto leave;
-            }
-        }
-      else if (!strcmp (fields[0], "uid") && nfields > 9)
-        {
-          /* Fixme: Unescape fields[9] */
-          xfree (mbox);
-          mbox = mailbox_from_userid (fields[9]);
-          if (mbox && !append_to_strlist_try (&ctx->mboxes, mbox))
-            {
-              err = gpg_error_from_syserror ();
-              goto leave;
-            }
-        }
-    }
-  if (len < 0 || es_ferror (listing))
-    log_error ("error reading memory stream\n");
-
- leave:
-  xfree (mbox);
-  xfree (fields);
-  es_free (line);
-  xfree (argv);
-  es_fclose (listing);
-  return err;
-}
-
-
 /* Take the key in KEYFILE and write it to OUTFILE in binary encoding.
  * If ADDRSPEC is given only matching user IDs are included in the
  * output.  */
@@ -1216,7 +1054,9 @@ process_new_key (server_ctx_t ctx, estream_t key)
   struct policy_flags_s policybuf;
 
   /* First figure out the user id from the key.  */
-  err = list_key (ctx, key);
+  xfree (ctx->fpr);
+  free_strlist (ctx->mboxes);
+  err = wks_list_key (key, &ctx->fpr, &ctx->mboxes);
   if (err)
     goto leave;
   if (!ctx->fpr)
@@ -1457,7 +1297,9 @@ check_and_publish (server_ctx_t ctx, const char *address, const char *nonce)
     }
 
   /* We need to get the fingerprint from the key.  */
-  err = list_key (ctx, key);
+  xfree (ctx->fpr);
+  free_strlist (ctx->mboxes);
+  err = wks_list_key (key, &ctx->fpr, &ctx->mboxes);
   if (err)
     goto leave;
   if (!ctx->fpr)
diff --git a/tools/gpg-wks.h b/tools/gpg-wks.h
index f7cccb3..7f347eb 100644
--- a/tools/gpg-wks.h
+++ b/tools/gpg-wks.h
@@ -65,6 +65,7 @@ typedef struct policy_flags_s *policy_flags_t;
 
 
 /*-- wks-util.c --*/
+gpg_error_t wks_list_key (estream_t key, char **r_fpr, strlist_t *r_mboxes);
 gpg_error_t wks_send_mime (mime_maker_t mime);
 gpg_error_t wks_parse_policy (policy_flags_t flags, estream_t stream,
                               int ignore_unknown);
diff --git a/tools/wks-util.c b/tools/wks-util.c
index 1b47612..f4f44f6 100644
--- a/tools/wks-util.c
+++ b/tools/wks-util.c
@@ -23,11 +23,190 @@
 #include <string.h>
 
 #include "util.h"
+#include "ccparray.h"
+#include "exectool.h"
+#include "mbox-util.h"
 #include "mime-maker.h"
 #include "send-mail.h"
 #include "gpg-wks.h"
 
 
+

+/* Helper for wks_list_key.  */
+static void
+list_key_status_cb (void *opaque, const char *keyword, char *args)
+{
+  (void)opaque;
+
+  if (DBG_CRYPTO)
+    log_debug ("gpg status: %s %s\n", keyword, args);
+}
+
+
+/* Run gpg on KEY and store the primary fingerprint at R_FPR and the
+ * list of mailboxes at R_MBOXES.  Returns 0 on success; on error NULL
+ * is stored at R_FPR and R_MBOXES and an error code is returned.  */
+gpg_error_t
+wks_list_key (estream_t key, char **r_fpr, strlist_t *r_mboxes)
+{
+  gpg_error_t err;
+  ccparray_t ccp;
+  const char **argv;
+  estream_t listing;
+  char *line = NULL;
+  size_t length_of_line = 0;
+  size_t  maxlen;
+  ssize_t len;
+  char **fields = NULL;
+  int nfields;
+  int lnr;
+  char *mbox = NULL;
+  char *fpr = NULL;
+  strlist_t mboxes = NULL;
+
+  *r_fpr = NULL;
+  *r_mboxes = NULL;
+
+  /* Open a memory stream.  */
+  listing = es_fopenmem (0, "w+b");
+  if (!listing)
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error allocating memory buffer: %s\n", gpg_strerror (err));
+      return err;
+    }
+
+  ccparray_init (&ccp, 0);
+
+  ccparray_put (&ccp, "--no-options");
+  if (!opt.verbose)
+    ccparray_put (&ccp, "--quiet");
+  else if (opt.verbose > 1)
+    ccparray_put (&ccp, "--verbose");
+  ccparray_put (&ccp, "--batch");
+  ccparray_put (&ccp, "--status-fd=2");
+  ccparray_put (&ccp, "--always-trust");
+  ccparray_put (&ccp, "--with-colons");
+  ccparray_put (&ccp, "--dry-run");
+  ccparray_put (&ccp, "--import-options=import-minimal,import-show");
+  ccparray_put (&ccp, "--import");
+
+  ccparray_put (&ccp, NULL);
+  argv = ccparray_get (&ccp, NULL);
+  if (!argv)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+  err = gnupg_exec_tool_stream (opt.gpg_program, argv, key,
+                                NULL, listing,
+                                list_key_status_cb, NULL);
+  if (err)
+    {
+      log_error ("import failed: %s\n", gpg_strerror (err));
+      goto leave;
+    }
+
+  es_rewind (listing);
+  lnr = 0;
+  maxlen = 2048; /* Set limit.  */
+  while ((len = es_read_line (listing, &line, &length_of_line, &maxlen)) > 0)
+    {
+      lnr++;
+      if (!maxlen)
+        {
+          log_error ("received line too long\n");
+          err = gpg_error (GPG_ERR_LINE_TOO_LONG);
+          goto leave;
+        }
+      /* Strip newline and carriage return, if present.  */
+      while (len > 0
+	     && (line[len - 1] == '\n' || line[len - 1] == '\r'))
+	line[--len] = '\0';
+      /* log_debug ("line '%s'\n", line); */
+
+      xfree (fields);
+      fields = strtokenize (line, ":");
+      if (!fields)
+        {
+          err = gpg_error_from_syserror ();
+          log_error ("strtokenize failed: %s\n", gpg_strerror (err));
+          goto leave;
+        }
+      for (nfields = 0; fields[nfields]; nfields++)
+        ;
+      if (!nfields)
+        {
+          err = gpg_error (GPG_ERR_INV_ENGINE);
+          goto leave;
+        }
+      if (!strcmp (fields[0], "sec"))
+        {
+          /* gpg may return "sec" as the first record - but we do not
+           * accept secret keys.  */
+          err = gpg_error (GPG_ERR_NO_PUBKEY);
+          goto leave;
+        }
+      if (lnr == 1 && strcmp (fields[0], "pub"))
+        {
+          /* First record is not a public key.  */
+          err = gpg_error (GPG_ERR_INV_ENGINE);
+          goto leave;
+        }
+      if (lnr > 1 && !strcmp (fields[0], "pub"))
+        {
+          /* More than one public key.  */
+          err = gpg_error (GPG_ERR_TOO_MANY);
+          goto leave;
+        }
+      if (!strcmp (fields[0], "sub") || !strcmp (fields[0], "ssb"))
+        break; /* We can stop parsing here.  */
+
+      if (!strcmp (fields[0], "fpr") && nfields > 9 && !fpr)
+        {
+          fpr = xtrystrdup (fields[9]);
+          if (!fpr)
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+        }
+      else if (!strcmp (fields[0], "uid") && nfields > 9)
+        {
+          /* Fixme: Unescape fields[9] */
+          xfree (mbox);
+          mbox = mailbox_from_userid (fields[9]);
+          if (mbox && !append_to_strlist_try (&mboxes, mbox))
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
+        }
+    }
+  if (len < 0 || es_ferror (listing))
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error reading memory stream\n");
+      goto leave;
+    }
+
+  *r_fpr = fpr;
+  fpr = NULL;
+  *r_mboxes = mboxes;
+  mboxes = NULL;
+
+ leave:
+  xfree (fpr);
+  xfree (mboxes);
+  xfree (mbox);
+  xfree (fields);
+  es_free (line);
+  xfree (argv);
+  es_fclose (listing);
+  return err;
+}
+
+
 /* Helper to write mail to the output(s).  */
 gpg_error_t
 wks_send_mime (mime_maker_t mime)

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c             |   4 +-
 tools/call-dirmngr.c   |  52 ++++++++++++++
 tools/call-dirmngr.h   |   2 +
 tools/gpg-wks-client.c | 101 ++++++++++++++++++++++++++++
 tools/gpg-wks-server.c | 170 ++--------------------------------------------
 tools/gpg-wks.h        |   1 +
 tools/wks-util.c       | 179 +++++++++++++++++++++++++++++++++++++++++++++++++
 7 files changed, 343 insertions(+), 166 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 17:25:37 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 08 Dec 2016 17:25:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-78-ge7429b1
Message-ID: <E1cF1Vt-0006bF-3y@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e7429b1ced0c69fa7901f888f8dc25f00fc346a4 (commit)
       via  404e8a4136bbbab39df7dd5119841e131998cc15 (commit)
       via  01256694f006405c54bc2adef63ef0c8f07da9ee (commit)
       via  a4a69163d9d7e4d9f3339eb5cda0afb947180b26 (commit)
       via  fcf5aea44627def43425d03881e20902e7c0331e (commit)
      from  a75790b74095828f967c012eff7033f570d93077 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e7429b1ced0c69fa7901f888f8dc25f00fc346a4
Author: Justus Winter <justus at g10code.com>
Date:   Fri Nov 18 13:36:23 2016 +0100

    gpgscm: Better error reporting.
    
    * tests/gpgscm/ffi.scm: Move the customized exception handling and
    atexit logic...
    * tests/gpgscm/init.scm: ... here.
    (throw): Record the current history.
    (throw'): New function that is history-aware.
    (rethrow): New function.
    (*error-hook*): Use the new throw'.
    * tests/gpgscm/main.c (load): Fix error handling.
    (main): Save and use the 'sc->retcode' as exit code.
    * tests/gpgscm/repl.scm (repl): Print call history.
    * tests/gpgscm/scheme.c (_Error_1): Make a snapshot of the history,
    use it to provide a accurate location of the expression causing the
    error at runtime, and hand the history trace to the '*error-hook*'.
    (opexe_5): Tag all lists at parse time with the current location.
    * tests/gpgscm/tests.scm: Update calls to 'throw', use 'rethrow'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/ffi.scm b/tests/gpgscm/ffi.scm
index c5f373c..b62fd1f 100644
--- a/tests/gpgscm/ffi.scm
+++ b/tests/gpgscm/ffi.scm
@@ -47,39 +47,3 @@
 
 ;; Low-level mechanism to terminate the process.
 (ffi-define (_exit status))
-
-;; High-level mechanism to terminate the process is to throw an error
-;; of the form (*interpreter-exit* status).  This gives automatic
-;; resource management a chance to clean up.
-(define *interpreter-exit* (gensym))
-(define (throw . x)
-  (cond
-   ((more-handlers?)
-    (apply (pop-handler) x))
-   ((and (= 2 (length x)) (equal? *interpreter-exit* (car x)))
-    (*run-atexit-handlers*)
-    (_exit (cadr x)))
-   (else
-    (apply error x))))
-(set! *error-hook* throw)
-
-;; Terminate the process returning STATUS to the parent.
-(define (exit status)
-  (throw *interpreter-exit* status))
-
-;; A list of functions run at interpreter shutdown.
-(define *atexit-handlers* (list))
-
-;; Execute all these functions.
-(define (*run-atexit-handlers*)
-  (unless (null? *atexit-handlers*)
-	  (let ((proc (car *atexit-handlers*)))
-	    ;; Drop proc from the list so that it will not get
-	    ;; executed again even if it raises an exception.
-	    (set! *atexit-handlers* (cdr *atexit-handlers*))
-	    (proc)
-	    (*run-atexit-handlers*))))
-
-;; Register a function to be run at interpreter shutdown.
-(define (atexit proc)
-  (set! *atexit-handlers* (cons proc *atexit-handlers*)))
diff --git a/tests/gpgscm/init.scm b/tests/gpgscm/init.scm
index b03eb43..04f088c 100644
--- a/tests/gpgscm/init.scm
+++ b/tests/gpgscm/init.scm
@@ -567,7 +567,7 @@
 ;    "Catch" establishes a scope spanning multiple call-frames until
 ;    another "catch" is encountered.  Within the recovery expression
 ;    the thrown exception is bound to *error*.  Errors can be rethrown
-;    using (apply throw *error*).
+;    using (rethrow *error*).
 ;
 ;    Exceptions are thrown with:
 ;
@@ -588,10 +588,30 @@
 (define (more-handlers?)
      (pair? *handlers*))
 
-(define (throw . x)
-     (if (more-handlers?)
-          (apply (pop-handler) x)
-          (apply error x)))
+;; This throws an exception.
+(define (throw message . args)
+  (throw' message args (cdr (*vm-history*))))
+
+;; This is used by the vm to throw exceptions.
+(define (throw' message args history)
+  (cond
+   ((more-handlers?)
+    ((pop-handler) message args history))
+   ((and args (= 2 (length args)) (equal? *interpreter-exit* (car args)))
+    (*run-atexit-handlers*)
+    (quit (cadr args)))
+   (else
+    (display message)
+    (if args (begin
+	      (display ": ")
+	      (write args)))
+    (newline)
+    (vm-history-print history)
+    (quit 1))))
+
+;; Convenience function to rethrow the error.
+(define (rethrow e)
+  (apply throw' e))
 
 (macro (catch form)
      (let ((label (gensym)))
@@ -601,8 +621,38 @@
                     (pop-handler)
                     ,label)))))
 
-(define *error-hook* throw)
+;; Make the vm use throw'.
+(define *error-hook* throw')
+
+

+
+;; High-level mechanism to terminate the process is to throw an error
+;; of the form (*interpreter-exit* status).  This gives automatic
+;; resource management a chance to clean up.
+(define *interpreter-exit* (gensym))
+
+;; Terminate the process returning STATUS to the parent.
+(define (exit status)
+  (throw "interpreter exit" *interpreter-exit* status))
+
+;; A list of functions run at interpreter shutdown.
+(define *atexit-handlers* (list))
+
+;; Execute all these functions.
+(define (*run-atexit-handlers*)
+  (unless (null? *atexit-handlers*)
+	  (let ((proc (car *atexit-handlers*)))
+	    ;; Drop proc from the list so that it will not get
+	    ;; executed again even if it raises an exception.
+	    (set! *atexit-handlers* (cdr *atexit-handlers*))
+	    (proc)
+	    (*run-atexit-handlers*))))
+
+;; Register a function to be run at interpreter shutdown.
+(define (atexit proc)
+  (set! *atexit-handlers* (cons proc *atexit-handlers*)))
 
+

 
 ;;;;; Definition of MAKE-ENVIRONMENT, to be used with two-argument EVAL
 
diff --git a/tests/gpgscm/main.c b/tests/gpgscm/main.c
index 2f77ac5..c96dcf1 100644
--- a/tests/gpgscm/main.c
+++ b/tests/gpgscm/main.c
@@ -150,7 +150,10 @@ load (scheme *sc, char *file_name,
 
         h = fopen (qualified_name, "r");
         if (h)
-          break;
+          {
+            err = 0;
+            break;
+          }
 
         if (n > 1)
           {
@@ -170,23 +173,23 @@ load (scheme *sc, char *file_name,
         fprintf (stderr,
                  "Consider using GPGSCM_PATH to specify the location "
                  "of the Scheme library.\n");
-      return err;
+      goto leave;
     }
   if (verbose > 1)
     fprintf (stderr, "Loading %s...\n", qualified_name);
   scheme_load_named_file (sc, h, qualified_name);
   fclose (h);
 
-  if (sc->retcode)
+  if (sc->retcode && sc->nesting)
     {
-      if (sc->nesting)
-        fprintf (stderr, "%s: Unbalanced parenthesis\n", qualified_name);
-      return gpg_error (GPG_ERR_GENERAL);
+      fprintf (stderr, "%s: Unbalanced parenthesis\n", qualified_name);
+      err = gpg_error (GPG_ERR_GENERAL);
     }
 
+ leave:
   if (file_name != qualified_name)
     free (qualified_name);
-  return 0;
+  return err;
 }
 
 

@@ -194,6 +197,7 @@ load (scheme *sc, char *file_name,
 int
 main (int argc, char **argv)
 {
+  int retcode;
   gpg_error_t err;
   char *argv0;
   ARGPARSE_ARGS pargs;
@@ -291,8 +295,9 @@ main (int argc, char **argv)
         log_fatal ("%s: %s", script, gpg_strerror (err));
     }
 
+  retcode = sc->retcode;
   scheme_load_string (sc, "(*run-atexit-handlers*)");
   scheme_deinit (sc);
   xfree (sc);
-  return EXIT_SUCCESS;
+  return retcode;
 }
diff --git a/tests/gpgscm/repl.scm b/tests/gpgscm/repl.scm
index 78b8151..84454dc 100644
--- a/tests/gpgscm/repl.scm
+++ b/tests/gpgscm/repl.scm
@@ -34,7 +34,14 @@
 			      (read (open-input-string next)))))
 	       (if (not (eof-object? c))
 		   (begin
-		     (catch (echo "Error:" *error*)
+		     (catch (begin
+			      (display (car *error*))
+			      (when (and (cadr *error*)
+					 (not (null? (cadr *error*))))
+				    (display ": ")
+				    (write (cadr *error*)))
+			      (newline)
+			      (vm-history-print (caddr *error*)))
 			    (echo "    ===>" (eval c environment)))
 		     (exit (loop ""))))
 	       (exit (loop next)))))))))
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 60b5a41..3abe12a 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -2656,6 +2656,7 @@ static INLINE pointer slot_value_in_env(pointer slot)
 
 static pointer _Error_1(scheme *sc, const char *s, pointer a) {
      const char *str = s;
+     pointer history;
 #if USE_ERROR_HOOK
      pointer x;
      pointer hdl=sc->ERROR_HOOK;
@@ -2663,19 +2664,34 @@ static pointer _Error_1(scheme *sc, const char *s, pointer a) {
 
 #if SHOW_ERROR_LINE
      char sbuf[STRBUFFSIZE];
+#endif
+
+     history = history_flatten(sc);
 
+#if SHOW_ERROR_LINE
      /* make sure error is not in REPL */
      if (sc->load_stack[sc->file_i].kind & port_file &&
          sc->load_stack[sc->file_i].rep.stdio.file != stdin) {
-       int ln = sc->load_stack[sc->file_i].rep.stdio.curr_line;
-       const char *fname = sc->load_stack[sc->file_i].rep.stdio.filename;
+       pointer tag;
+       const char *fname;
+       int ln;
+
+       if (history != sc->NIL && has_tag(car(history))
+	   && (tag = get_tag(sc, car(history)))
+	   && is_string(car(tag)) && is_integer(cdr(tag))) {
+	 fname = string_value(car(tag));
+	 ln = ivalue_unchecked(cdr(tag));
+       } else {
+	 fname = sc->load_stack[sc->file_i].rep.stdio.filename;
+	 ln = sc->load_stack[sc->file_i].rep.stdio.curr_line;
+       }
 
        /* should never happen */
        if(!fname) fname = "<unknown>";
 
        /* we started from 0 */
        ln++;
-       snprintf(sbuf, STRBUFFSIZE, "(%s : %i) %s", fname, ln, s);
+       snprintf(sbuf, STRBUFFSIZE, "%s:%i: %s", fname, ln, s);
 
        str = (const char*)sbuf;
      }
@@ -2684,11 +2700,15 @@ static pointer _Error_1(scheme *sc, const char *s, pointer a) {
 #if USE_ERROR_HOOK
      x=find_slot_in_env(sc,sc->envir,hdl,1);
     if (x != sc->NIL) {
+	 sc->code = cons(sc, cons(sc, sc->QUOTE,
+				  cons(sc, history, sc->NIL)),
+			 sc->NIL);
          if(a!=0) {
-               sc->code = cons(sc, cons(sc, sc->QUOTE, cons(sc,(a), sc->NIL)), sc->NIL);
+	   sc->code = cons(sc, cons(sc, sc->QUOTE, cons(sc, a, sc->NIL)),
+	                   sc->code);
          } else {
-               sc->code = sc->NIL;
-         }
+	   sc->code = cons(sc, sc->F, sc->code);
+	 }
          sc->code = cons(sc, mk_string(sc, str), sc->code);
          setimmutable(car(sc->code));
          sc->code = cons(sc, slot_value_in_env(x), sc->code);
@@ -4808,6 +4828,19 @@ static pointer opexe_5(scheme *sc, enum scheme_opcodes op) {
                     Error_0(sc,"syntax error: illegal dot expression");
                } else {
                     sc->nesting_stack[sc->file_i]++;
+#if USE_TAGS && SHOW_ERROR_LINE
+		    {
+		      const char *filename =
+			sc->load_stack[sc->file_i].rep.stdio.filename;
+		      int lineno =
+			sc->load_stack[sc->file_i].rep.stdio.curr_line;
+
+		      s_save(sc, OP_TAG_VALUE,
+			     cons(sc, mk_string(sc, filename),
+				  cons(sc, mk_integer(sc, lineno), sc->NIL)),
+			     sc->NIL);
+		    }
+#endif
                     s_save(sc,OP_RDLIST, sc->NIL, sc->NIL);
                     s_thread_to(sc,OP_RDSEXPR);
                }
diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index bd51819..bec1922 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -130,7 +130,8 @@
   (let ((result (call-with-io what "")))
     (if (= 0 (:retcode result))
 	(:stdout result)
-	(throw (list what "failed:" (:stderr result))))))
+	(throw (string-append (stringify what) " failed")
+	       (:stderr result)))))
 
 (define (call-popen command input-string)
   (let ((result (call-with-io command input-string)))
@@ -246,7 +247,7 @@
 	(let ((,result-sym
 	       ,(if (= 1 (length (cadr form)))
 		    `(catch (begin (close ,(caaadr form))
-				   (apply throw *error*))
+				   (rethrow *error*))
 			    ,@(cddr form))
 		    `(letfd ,(cdadr form) ,@(cddr form)))))
 	  (close ,(caaadr form))
@@ -257,7 +258,7 @@
     `(let* ((,cwd-sym (getcwd))
 	    (_ (if ,(cadr form) (chdir ,(cadr form))))
 	    (,result-sym (catch (begin (chdir ,cwd-sym)
-				       (apply throw *error*))
+				       (rethrow *error*))
 				,@(cddr form))))
        (chdir ,cwd-sym)
        ,result-sym)))
@@ -281,7 +282,7 @@
 	    (_ (chdir ,tmp-sym))
 	    (,result-sym (catch (begin (chdir ,cwd-sym)
 				       (unlink-recursively ,tmp-sym)
-				       (apply throw *error*))
+				       (rethrow *error*))
 				,@(cdr form))))
        (chdir ,cwd-sym)
        (unlink-recursively ,tmp-sym)
@@ -312,7 +313,7 @@
 	(let ((,result-sym
 	       ,(if (= 1 (length (cadr form)))
 		    `(catch (begin (remove-temporary-file ,(caadr form))
-				   (apply throw *error*))
+				   (rethrow *error*))
 			    ,@(cddr form))
 		    `(lettmp ,(cdadr form) ,@(cddr form)))))
 	  (remove-temporary-file ,(caadr form))

commit 404e8a4136bbbab39df7dd5119841e131998cc15
Author: Justus Winter <justus at g10code.com>
Date:   Fri Nov 18 10:58:18 2016 +0100

    gpgscm: Keep a history of calls for error messages.
    
    * tests/gpgscm/init.scm (vm-history-print): New function.
    * tests/gpgscm/opdefines.h: New opcodes 'CALLSTACK_POP', 'APPLY_CODE',
    and 'VM_HISTORY'.
    * tests/gpgscm/scheme-private.h (struct history): New definition.
    (struct scheme): New field 'history'.
    * tests/gpgscm/scheme.c (gc): Mark objects in the history.
    (history_free): New function.
    (history_init): Likewise.
    (history_mark): Likewise.
    (add_mod): New macro.
    (sub_mod): Likewise.
    (tailstack_clear): New function.
    (callstack_pop): Likewise.
    (callstack_push): Likewise.
    (tailstack_push): Likewise.
    (tailstack_flatten): Likewise.
    (callstack_flatten): Likewise.
    (history_flatten): Likewise.
    (opexe_0): New variable 'callsite', keep track of the expression if it
    is a call, implement the new opcodes, record function applications in
    the history.
    (opexe_6): Implement new opcode.
    (scheme_init_custom_alloc): Initialize history.
    (scheme_deinit): Free history.
    * tests/gpgscm/scheme.h (USE_HISTORY): New macro.
    --
    
    This patch makes TinySCHEME keep a history of function calls.  This
    history can be used to produce helpful error messages.  The history
    data structure is inspired by MIT/GNU Scheme.
    
    Signed-off-by: Justus Winter <justus at g10code.com>
    
    fu history

diff --git a/tests/gpgscm/init.scm b/tests/gpgscm/init.scm
index f8fd71a..b03eb43 100644
--- a/tests/gpgscm/init.scm
+++ b/tests/gpgscm/init.scm
@@ -534,6 +534,28 @@
      `(define ,(cadr form)
           (call/cc (lambda (return) ,@(cddr form)))))
 
+;; Print the given history.
+(define (vm-history-print history)
+  (let loop ((n 0) (skip 0) (frames history))
+    (cond
+     ((null? frames)
+      #t)
+     ((> skip 0)
+      (loop 0 (- skip 1) (cdr frames)))
+     (else
+      (let ((f (car frames)))
+	(display n)
+	(display ": ")
+	(let ((tag (get-tag f)))
+	  (unless (null? tag)
+		  (display (basename (car tag)))
+		  (display ":")
+		  (display (+ 1 (cdr tag)))
+		  (display ": ")))
+	(write f))
+	(newline)
+	(loop (+ n 1) skip (cdr frames))))))
+
 ;;;; Simple exception handling
 ;
 ;    Exceptions are caught as follows:
diff --git a/tests/gpgscm/opdefines.h b/tests/gpgscm/opdefines.h
index a2328fa..2d17720 100644
--- a/tests/gpgscm/opdefines.h
+++ b/tests/gpgscm/opdefines.h
@@ -10,6 +10,10 @@
 #endif
     _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_E0ARGS           )
     _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_E1ARGS           )
+#if USE_HISTORY
+    _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_CALLSTACK_POP    )
+#endif
+    _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_APPLY_CODE       )
     _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_APPLY            )
 #if USE_TRACING
     _OP_DEF(opexe_0, 0,                                0,  0,       0,                               OP_REAL_APPLY       )
@@ -197,4 +201,6 @@
     _OP_DEF(opexe_6, "get-closure-code",               1,  1,       TST_NONE,                        OP_GET_CLOSURE      )
     _OP_DEF(opexe_6, "closure?",                       1,  1,       TST_NONE,                        OP_CLOSUREP         )
     _OP_DEF(opexe_6, "macro?",                         1,  1,       TST_NONE,                        OP_MACROP           )
+    _OP_DEF(opexe_6, "*vm-history*",                   0,  0,       TST_NONE,                        OP_VM_HISTORY       )
+
 #undef _OP_DEF
diff --git a/tests/gpgscm/scheme-private.h b/tests/gpgscm/scheme-private.h
index 40a4211..7f19a6e 100644
--- a/tests/gpgscm/scheme-private.h
+++ b/tests/gpgscm/scheme-private.h
@@ -62,6 +62,34 @@ struct cell {
   } _object;
 };
 
+#if USE_HISTORY
+/* The history is a two-dimensional ring buffer.  A donut-shaped data
+ * structure.  This data structure is inspired by MIT/GNU Scheme.  */
+struct history {
+  /* Number of calls to store.  Must be a power of two.  */
+  size_t N;
+
+  /* Number of tail-calls to store in each call frame.  Must be a
+   * power of two.  */
+  size_t M;
+
+  /* Masks for fast index calculations.  */
+  size_t mask_N;
+  size_t mask_M;
+
+  /* A vector of size N containing calls.  */
+  pointer callstack;
+
+  /* A vector of size N containing vectors of size M containing tail
+   * calls.  */
+  pointer tailstacks;
+
+  /* Our current position.  */
+  size_t n;
+  size_t *m;
+};
+#endif
+
 struct scheme {
 /* arrays for segments */
 func_alloc malloc;
@@ -88,6 +116,11 @@ pointer envir;           /* stack register for current environment */
 pointer code;            /* register for current code */
 pointer dump;            /* stack register for next evaluation */
 
+#if USE_HISTORY
+struct history history;  /* we keep track of the call history for
+                          * error messages */
+#endif
+
 int interactive_repl;    /* are we in an interactive REPL? */
 
 struct cell _sink;
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 8cec9cf..60b5a41 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -308,6 +308,14 @@ INTERFACE INLINE void setimmutable(pointer p) { typeflag(p) |= T_IMMUTABLE; }
 #define cadddr(p)        car(cdr(cdr(cdr(p))))
 #define cddddr(p)        cdr(cdr(cdr(cdr(p))))
 
+#if USE_HISTORY
+static pointer history_flatten(scheme *sc);
+static void history_mark(scheme *sc);
+#else
+# define history_mark(SC)	(void) 0
+# define history_flatten(SC)	(SC)->NIL
+#endif
+
 #if USE_CHAR_CLASSIFIERS
 static INLINE int Cisalpha(int c) { return isascii(c) && isalpha(c); }
 static INLINE int Cisdigit(int c) { return isascii(c) && isdigit(c); }
@@ -1593,6 +1601,7 @@ static void gc(scheme *sc, pointer a, pointer b) {
   mark(sc->args);
   mark(sc->envir);
   mark(sc->code);
+  history_mark(sc);
   dump_stack_mark(sc);
   mark(sc->value);
   mark(sc->inport);
@@ -2830,10 +2839,236 @@ static INLINE void dump_stack_mark(scheme *sc)
   mark(sc->dump);
 }
 
+

+
+#if USE_HISTORY
+
+static void
+history_free(scheme *sc)
+{
+  sc->free(sc->history.m);
+  sc->history.tailstacks = sc->NIL;
+  sc->history.callstack = sc->NIL;
+}
+
+static pointer
+history_init(scheme *sc, size_t N, size_t M)
+{
+  size_t i;
+  struct history *h = &sc->history;
+
+  h->N = N;
+  h->mask_N = N - 1;
+  h->n = N - 1;
+  assert ((N & h->mask_N) == 0);
+
+  h->M = M;
+  h->mask_M = M - 1;
+  assert ((M & h->mask_M) == 0);
+
+  h->callstack = mk_vector(sc, N);
+  if (h->callstack == sc->sink)
+    goto fail;
+
+  h->tailstacks = mk_vector(sc, N);
+  for (i = 0; i < N; i++) {
+    pointer tailstack = mk_vector(sc, M);
+    if (tailstack == sc->sink)
+      goto fail;
+    set_vector_elem(h->tailstacks, i, tailstack);
+  }
+
+  h->m = sc->malloc(N * sizeof *h->m);
+  if (h->m == NULL)
+    goto fail;
+
+  for (i = 0; i < N; i++)
+    h->m[i] = 0;
+
+  return sc->T;
+
+fail:
+  history_free(sc);
+  return sc->F;
+}
+
+static void
+history_mark(scheme *sc)
+{
+  struct history *h = &sc->history;
+  mark(h->callstack);
+  mark(h->tailstacks);
+}
+
+#define add_mod(a, b, mask)	(((a) + (b)) & (mask))
+#define sub_mod(a, b, mask)	add_mod(a, (mask) + 1 - (b), mask)
+
+static INLINE void
+tailstack_clear(scheme *sc, pointer v)
+{
+  assert(is_vector(v));
+  /* XXX optimize */
+  fill_vector(v, sc->NIL);
+}
+
+static pointer
+callstack_pop(scheme *sc)
+{
+  struct history *h = &sc->history;
+  size_t n = h->n;
+  pointer item;
+
+  if (h->callstack == sc->NIL)
+    return sc->NIL;
+
+  item = vector_elem(h->callstack, n);
+  /* Clear our frame so that it can be gc'ed and we don't run into it
+   * when walking the history.  */
+  set_vector_elem(h->callstack, n, sc->NIL);
+  tailstack_clear(sc, vector_elem(h->tailstacks, n));
+
+  /* Exit from the frame.  */
+  h->n = sub_mod(h->n, 1, h->mask_N);
+
+  return item;
+}
+
+static void
+callstack_push(scheme *sc, pointer item)
+{
+  struct history *h = &sc->history;
+  size_t n = h->n;
+
+  if (h->callstack == sc->NIL)
+    return;
+
+  /* Enter a new frame.  */
+  n = h->n = add_mod(n, 1, h->mask_N);
+
+  /* Initialize tail stack.  */
+  tailstack_clear(sc, vector_elem(h->tailstacks, n));
+  h->m[n] = h->mask_M;
+
+  set_vector_elem(h->callstack, n, item);
+}
+
+static void
+tailstack_push(scheme *sc, pointer item)
+{
+  struct history *h = &sc->history;
+  size_t n = h->n;
+  size_t m = h->m[n];
+
+  if (h->callstack == sc->NIL)
+    return;
+
+  /* Enter a new tail frame.  */
+  m = h->m[n] = add_mod(m, 1, h->mask_M);
+  set_vector_elem(vector_elem(h->tailstacks, n), m, item);
+}
+
+static pointer
+tailstack_flatten(scheme *sc, pointer tailstack, size_t i, size_t n,
+		  pointer acc)
+{
+  struct history *h = &sc->history;
+  pointer frame;
+
+  assert(i <= h->M);
+  assert(n < h->M);
+
+  if (acc == sc->sink)
+    return sc->sink;
+
+  if (i == 0) {
+    /* We reached the end, but we did not see a unused frame.  Signal
+       this using '... .  */
+    return cons(sc, mk_symbol(sc, "..."), acc);
+  }
+
+  frame = vector_elem(tailstack, n);
+  if (frame == sc->NIL) {
+    /* A unused frame.  We reached the end of the history.  */
+    return acc;
+  }
+
+  /* Add us.  */
+  acc = cons(sc, frame, acc);
+
+  return tailstack_flatten(sc, tailstack, i - 1, sub_mod(n, 1, h->mask_M),
+			   acc);
+}
+
+static pointer
+callstack_flatten(scheme *sc, size_t i, size_t n, pointer acc)
+{
+  struct history *h = &sc->history;
+  pointer frame;
+
+  assert(i <= h->N);
+  assert(n < h->N);
+
+  if (acc == sc->sink)
+    return sc->sink;
+
+  if (i == 0) {
+    /* We reached the end, but we did not see a unused frame.  Signal
+       this using '... .  */
+    return cons(sc, mk_symbol(sc, "..."), acc);
+  }
+
+  frame = vector_elem(h->callstack, n);
+  if (frame == sc->NIL) {
+    /* A unused frame.  We reached the end of the history.  */
+    return acc;
+  }
+
+  /* First, emit the tail calls.  */
+  acc = tailstack_flatten(sc, vector_elem(h->tailstacks, n), h->M, h->m[n],
+			  acc);
+
+  /* Then us.  */
+  acc = cons(sc, frame, acc);
+
+  return callstack_flatten(sc, i - 1, sub_mod(n, 1, h->mask_N), acc);
+}
+
+static pointer
+history_flatten(scheme *sc)
+{
+  struct history *h = &sc->history;
+  pointer history;
+
+  if (h->callstack == sc->NIL)
+    return sc->NIL;
+
+  history = callstack_flatten(sc, h->N, h->n, sc->NIL);
+  if (history == sc->sink)
+    return sc->sink;
+
+  return reverse_in_place(sc, sc->NIL, history);
+}
+
+#undef add_mod
+#undef sub_mod
+
+#else	/* USE_HISTORY */
+
+#define history_init(SC, A, B)	(void) 0
+#define history_free(SC)	(void) 0
+#define callstack_pop(SC)	(void) 0
+#define callstack_push(SC, X)	(void) 0
+#define tailstack_push(SC, X)	(void) 0
+
+#endif	/* USE_HISTORY */
+
+

+
 #define s_retbool(tf)    s_return(sc,(tf) ? sc->T : sc->F)
 
 static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
      pointer x, y;
+     pointer callsite;
 
      switch (op) {
      CASE(OP_LOAD):       /* load */
@@ -2959,7 +3194,10 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
 	       s_clear_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_APPLY);
           } else {
-               sc->code = cdr(sc->code);
+	       gc_disable(sc, 1);
+	       sc->args = cons(sc, sc->code, sc->NIL);
+	       gc_enable(sc);
+	       sc->code = cdr(sc->code);
                s_thread_to(sc,OP_E1ARGS);
           }
 
@@ -2975,9 +3213,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                s_thread_to(sc,OP_EVAL);
           } else {  /* end */
                sc->args = reverse_in_place(sc, sc->NIL, sc->args);
-               sc->code = car(sc->args);
-               sc->args = cdr(sc->args);
-               s_thread_to(sc,OP_APPLY);
+               s_thread_to(sc,OP_APPLY_CODE);
           }
 
 #if USE_TRACING
@@ -2989,6 +3225,20 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
      }
 #endif
 
+#if USE_HISTORY
+     CASE(OP_CALLSTACK_POP):      /* pop the call stack */
+	  callstack_pop(sc);
+	  s_return(sc, sc->value);
+#endif
+
+     CASE(OP_APPLY_CODE): /* apply 'cadr(args)' to 'cddr(args)',
+			   * record in the history as invoked from
+			   * 'car(args)' */
+	  free_cons(sc, sc->args, &callsite, &sc->args);
+	  sc->code = car(sc->args);
+	  sc->args = cdr(sc->args);
+	  /* Fallthrough.  */
+
      CASE(OP_APPLY):      /* apply 'code' to 'args' */
 #if USE_TRACING
        if(sc->tracing) {
@@ -3001,6 +3251,18 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
        /* fall through */
      CASE(OP_REAL_APPLY):
 #endif
+#if USE_HISTORY
+          if (op != OP_APPLY_CODE)
+            callsite = sc->code;
+          if (s_get_flag(sc, TAIL_CONTEXT)) {
+            /* We are evaluating a tail call.  */
+            tailstack_push(sc, callsite);
+          } else {
+            callstack_push(sc, callsite);
+            s_save(sc, OP_CALLSTACK_POP, sc->NIL, sc->NIL);
+          }
+#endif
+
           if (is_proc(sc->code)) {
                s_goto(sc,procnum(sc->code));   /* PROCEDURE */
           } else if (is_foreign(sc->code))
@@ -4805,6 +5067,8 @@ static pointer opexe_6(scheme *sc, enum scheme_opcodes op) {
           s_retbool(is_closure(car(sc->args)));
      CASE(OP_MACROP):          /* macro? */
           s_retbool(is_macro(car(sc->args)));
+     CASE(OP_VM_HISTORY):          /* *vm-history* */
+          s_return(sc, history_flatten(sc));
      default:
           snprintf(sc->strbuff,STRBUFFSIZE,"%d: illegal operator", sc->op);
           Error_0(sc,sc->strbuff);
@@ -5235,6 +5499,8 @@ int scheme_init_custom_alloc(scheme *sc, func_alloc malloc, func_dealloc free) {
     }
   }
 
+  history_init(sc, 8, 8);
+
   /* initialization of global pointers to special symbols */
   sc->LAMBDA = mk_symbol(sc, "lambda");
   sc->QUOTE = mk_symbol(sc, "quote");
@@ -5284,6 +5550,7 @@ void scheme_deinit(scheme *sc) {
   dump_stack_free(sc);
   sc->envir=sc->NIL;
   sc->code=sc->NIL;
+  history_free(sc);
   sc->args=sc->NIL;
   sc->value=sc->NIL;
   if(is_port(sc->inport)) {
diff --git a/tests/gpgscm/scheme.h b/tests/gpgscm/scheme.h
index 5e7d90d..8560f7d 100644
--- a/tests/gpgscm/scheme.h
+++ b/tests/gpgscm/scheme.h
@@ -45,6 +45,7 @@ extern "C" {
 # define USE_PLIST 0
 # define USE_SMALL_INTEGERS 0
 # define USE_TAGS 0
+# define USE_HISTORY 0
 #endif
 
 
@@ -82,6 +83,12 @@ extern "C" {
 # define USE_TAGS 1
 #endif
 
+/* Keep a history of function calls.  This enables a feature similar
+ * to stack traces.  */
+#ifndef USE_HISTORY
+# define USE_HISTORY 1
+#endif
+
 /* To force system errors through user-defined error handling (see *error-hook*) */
 #ifndef USE_ERROR_HOOK
 # define USE_ERROR_HOOK 1

commit 01256694f006405c54bc2adef63ef0c8f07da9ee
Author: Justus Winter <justus at g10code.com>
Date:   Mon Nov 21 17:25:10 2016 +0100

    gpgscm: Add flag TAIL_CONTEXT.
    
    * tests/gpgscm/scheme.c (S_FLAG_TAIL_CONTEXT): New macro.  This flag
    indicates that the interpreter is evaluating an expression in a tail
    context (see R5RS, section 3.5).
    (opexe_0): Clear and set the flag according to the rules layed out in
    R5RS, section 3.5.
    (opexe_1): Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index ab3491b..8cec9cf 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -2715,6 +2715,12 @@ static pointer _Error_1(scheme *sc, const char *s, pointer a) {
 #define S_OP_MASK	0x000000ff
 #define S_FLAG_MASK	0xffffff00
 
+/* Set if the interpreter evaluates an expression in a tail context
+ * (see R5RS, section 3.5).  If a function, procedure, or continuation
+ * is invoked while this flag is set, the call is recorded as tail
+ * call in the history buffer.  */
+#define S_FLAG_TAIL_CONTEXT	0x00000100
+
 /* Set flag F.  */
 #define s_set_flag(sc, f)			\
 	   BEGIN				\
@@ -2936,6 +2942,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                     s_save(sc,OP_E0ARGS, sc->NIL, sc->code);
                     /* If no macros => s_save(sc,OP_E1ARGS, sc->NIL, cdr(sc->code));*/
                     sc->code = car(sc->code);
+		    s_clear_flag(sc, TAIL_CONTEXT);
                     s_thread_to(sc,OP_EVAL);
                }
           } else {
@@ -2949,6 +2956,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                sc->args = cons(sc,sc->code, sc->NIL);
 	       gc_enable(sc);
                sc->code = sc->value;
+	       s_clear_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_APPLY);
           } else {
                sc->code = cdr(sc->code);
@@ -2963,6 +2971,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                s_save(sc,OP_E1ARGS, sc->args, cdr(sc->code));
                sc->code = car(sc->code);
                sc->args = sc->NIL;
+	       s_clear_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_EVAL);
           } else {  /* end */
                sc->args = reverse_in_place(sc, sc->NIL, sc->args);
@@ -3026,6 +3035,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                }
                sc->code = cdr(closure_code(sc->code));
                sc->args = sc->NIL;
+	       s_set_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_BEGIN);
           } else if (is_continuation(sc->code)) { /* CONTINUATION */
                sc->dump = cont_dump(sc->code);
@@ -3138,18 +3148,29 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
 
 
      CASE(OP_BEGIN):      /* begin */
-          if (!is_pair(sc->code)) {
-               s_return(sc,sc->code);
-          }
-          if (cdr(sc->code) != sc->NIL) {
-               s_save(sc,OP_BEGIN, sc->NIL, cdr(sc->code));
-          }
-          sc->code = car(sc->code);
-          s_thread_to(sc,OP_EVAL);
+	  {
+	    int last;
+
+	    if (!is_pair(sc->code)) {
+	      s_return(sc,sc->code);
+	    }
+
+	    last = cdr(sc->code) == sc->NIL;
+	    if (!last) {
+	      s_save(sc,OP_BEGIN, sc->NIL, cdr(sc->code));
+	    }
+	    sc->code = car(sc->code);
+	    if (! last)
+	      /* This is not the end of the list.  This is not a tail
+	       * position.  */
+	      s_clear_flag(sc, TAIL_CONTEXT);
+	    s_thread_to(sc,OP_EVAL);
+	  }
 
      CASE(OP_IF0):        /* if */
           s_save(sc,OP_IF1, sc->NIL, cdr(sc->code));
           sc->code = car(sc->code);
+	  s_clear_flag(sc, TAIL_CONTEXT);
           s_thread_to(sc,OP_EVAL);
 
      CASE(OP_IF1):        /* if */
@@ -3179,6 +3200,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
 	       gc_enable(sc);
                sc->code = cadar(sc->code);
                sc->args = sc->NIL;
+	       s_clear_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_EVAL);
           } else {  /* end */
 	       gc_enable(sc);
@@ -3227,6 +3249,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
           }
           s_save(sc,OP_LET1AST, cdr(sc->code), car(sc->code));
           sc->code = cadaar(sc->code);
+	  s_clear_flag(sc, TAIL_CONTEXT);
           s_thread_to(sc,OP_EVAL);
 
      CASE(OP_LET1AST):    /* let* (make new frame) */
@@ -3240,6 +3263,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                s_save(sc,OP_LET2AST, sc->args, sc->code);
                sc->code = cadar(sc->code);
                sc->args = sc->NIL;
+	       s_clear_flag(sc, TAIL_CONTEXT);
                s_thread_to(sc,OP_EVAL);
           } else {  /* end */
                sc->code = sc->args;
@@ -3276,6 +3300,7 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                s_save(sc,OP_LET1REC, sc->args, cdr(sc->code));
                sc->code = cadar(sc->code);
                sc->args = sc->NIL;
+	       s_clear_flag(sc, TAIL_CONTEXT);
                s_goto(sc,OP_EVAL);
           } else {  /* end */
                sc->args = reverse_in_place(sc, sc->NIL, sc->args);
@@ -3298,6 +3323,7 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
           }
           s_save(sc,OP_COND1, sc->NIL, sc->code);
           sc->code = caar(sc->code);
+	  s_clear_flag(sc, TAIL_CONTEXT);
           s_goto(sc,OP_EVAL);
 
      CASE(OP_COND1):      /* cond */
@@ -3322,6 +3348,7 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                } else {
                     s_save(sc,OP_COND1, sc->NIL, sc->code);
                     sc->code = caar(sc->code);
+		    s_clear_flag(sc, TAIL_CONTEXT);
                     s_goto(sc,OP_EVAL);
                }
           }
@@ -3337,6 +3364,8 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                s_return(sc,sc->T);
           }
           s_save(sc,OP_AND1, sc->NIL, cdr(sc->code));
+	  if (cdr(sc->code) != sc->NIL)
+	       s_clear_flag(sc, TAIL_CONTEXT);
           sc->code = car(sc->code);
           s_goto(sc,OP_EVAL);
 
@@ -3347,6 +3376,8 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                s_return(sc,sc->value);
           } else {
                s_save(sc,OP_AND1, sc->NIL, cdr(sc->code));
+	       if (cdr(sc->code) != sc->NIL)
+		    s_clear_flag(sc, TAIL_CONTEXT);
                sc->code = car(sc->code);
                s_goto(sc,OP_EVAL);
           }
@@ -3356,6 +3387,8 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                s_return(sc,sc->F);
           }
           s_save(sc,OP_OR1, sc->NIL, cdr(sc->code));
+	  if (cdr(sc->code) != sc->NIL)
+	       s_clear_flag(sc, TAIL_CONTEXT);
           sc->code = car(sc->code);
           s_goto(sc,OP_EVAL);
 
@@ -3366,6 +3399,8 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
                s_return(sc,sc->value);
           } else {
                s_save(sc,OP_OR1, sc->NIL, cdr(sc->code));
+	       if (cdr(sc->code) != sc->NIL)
+		    s_clear_flag(sc, TAIL_CONTEXT);
                sc->code = car(sc->code);
                s_goto(sc,OP_EVAL);
           }
@@ -3411,6 +3446,7 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
      CASE(OP_CASE0):      /* case */
           s_save(sc,OP_CASE1, sc->NIL, cdr(sc->code));
           sc->code = car(sc->code);
+	  s_clear_flag(sc, TAIL_CONTEXT);
           s_goto(sc,OP_EVAL);
 
      CASE(OP_CASE1):      /* case */

commit a4a69163d9d7e4d9f3339eb5cda0afb947180b26
Author: Justus Winter <justus at g10code.com>
Date:   Mon Nov 21 12:38:44 2016 +0100

    gpgscm: Add flags to the interpreter.
    
    * tests/gpgscm/scheme-private.h (struct scheme): Add field 'flags'.
    * tests/gpgscm/scheme.c (S_OP_MASK): New macro.
    (S_FLAG_MASK, s_set_flag, s_clear_flag, s_get_flag): Likewise.
    (_s_return): Unpack the encoded opcode and flags.
    (s_save): Encode the flags along with the opcode.  Use normal
    integers to encode the result.
    (scheme_init_custom_alloc): Initialize 'op' and 'flags'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme-private.h b/tests/gpgscm/scheme-private.h
index 2c5c749..40a4211 100644
--- a/tests/gpgscm/scheme-private.h
+++ b/tests/gpgscm/scheme-private.h
@@ -163,6 +163,7 @@ int tok;
 int print_flag;
 pointer value;
 int op;
+unsigned int flags;
 
 void *ext_data;     /* For the benefit of foreign functions */
 long gensym_cnt;
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index c73a832..ab3491b 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -2705,6 +2705,34 @@ static pointer _Error_1(scheme *sc, const char *s, pointer a) {
 # define  BEGIN     do {
 # define  END  } while (0)
 
+

+
+/* Flags.  The interpreter has a flags field.  When the interpreter
+ * pushes a frame to the dump stack, it is encoded with the opcode.
+ * Therefore, we do not use the least significant byte.  */
+
+/* Masks used to encode and decode opcode and flags.  */
+#define S_OP_MASK	0x000000ff
+#define S_FLAG_MASK	0xffffff00
+
+/* Set flag F.  */
+#define s_set_flag(sc, f)			\
+	   BEGIN				\
+	   (sc)->flags |= S_FLAG_ ## f;		\
+	   END
+
+/* Clear flag F.  */
+#define s_clear_flag(sc, f)			\
+	   BEGIN				\
+	   (sc)->flags &= ~ S_FLAG_ ## f;	\
+	   END
+
+/* Check if flag F is set.  */
+#define s_get_flag(sc, f)			\
+	   !!((sc)->flags & S_FLAG_ ## f)
+
+

+
 /* Bounce back to Eval_Cycle and execute A.  */
 #define s_goto(sc,a) BEGIN                                  \
     sc->op = (int)(a);                                      \
@@ -2757,16 +2785,23 @@ static void dump_stack_free(scheme *sc)
 static pointer _s_return(scheme *sc, pointer a, int enable_gc) {
   pointer dump = sc->dump;
   pointer op;
+  unsigned long v;
   sc->value = (a);
   if (enable_gc)
        gc_enable(sc);
   if (dump == sc->NIL)
     return sc->NIL;
   free_cons(sc, dump, &op, &dump);
-  sc->op = ivalue(op);
-#ifndef USE_SMALL_INTEGERS
-  free_cell(sc, op);
+  v = (unsigned long) ivalue_unchecked(op);
+  sc->op = (int) (v & S_OP_MASK);
+  sc->flags = v & S_FLAG_MASK;
+#ifdef USE_SMALL_INTEGERS
+  if (v < MAX_SMALL_INTEGER) {
+    /* This is a small integer, we must not free it.  */
+  } else
+    /* Normal integer.  Recover the cell.  */
 #endif
+    free_cell(sc, op);
   free_cons(sc, dump, &sc->args, &dump);
   free_cons(sc, dump, &sc->envir, &dump);
   free_cons(sc, dump, &sc->code, &sc->dump);
@@ -2774,12 +2809,13 @@ static pointer _s_return(scheme *sc, pointer a, int enable_gc) {
 }
 
 static void s_save(scheme *sc, enum scheme_opcodes op, pointer args, pointer code) {
-#define s_save_allocates	(4 + mk_small_integer_allocates)
+#define s_save_allocates	5
     pointer dump;
+    unsigned long v = sc->flags | ((unsigned long) op);
     gc_disable(sc, gc_reservations (s_save));
     dump = cons(sc, sc->envir, cons(sc, (code), sc->dump));
     dump = cons(sc, (args), dump);
-    sc->dump = cons(sc, mk_small_integer(sc, (long)(op)), dump);
+    sc->dump = cons(sc, mk_integer(sc, (long) v), dump);
     gc_enable(sc);
 }
 
@@ -5111,6 +5147,8 @@ int scheme_init_custom_alloc(scheme *sc, func_alloc malloc, func_dealloc free) {
   dump_stack_initialize(sc);
   sc->code = sc->NIL;
   sc->tracing=0;
+  sc->op = -1;
+  sc->flags = 0;
 
   /* init sc->NIL */
   typeflag(sc->NIL) = (T_NIL | T_ATOM | MARK);

commit fcf5aea44627def43425d03881e20902e7c0331e
Author: Justus Winter <justus at g10code.com>
Date:   Fri Nov 18 13:23:11 2016 +0100

    gpgscm: Implement tags.
    
    * tests/gpgscm/opdefines.h: Add opcodes to create and retrieve tags.
    * tests/gpgscm/scheme.c (T_TAGGED): New macro.
    (mk_tagged_value): New function.
    (has_tag): Likewise.
    (get_tag): Likewise.
    (mark): Mark tag.
    (opexe_4): Implement new opcodes.
    * tests/gpgscm/scheme.h (USE_TAGS): New macro.
    --
    
    Tags are similar to property lists, but property lists can only be
    attached to symbols.  Tags can not be attached to an existing object,
    but a tagged copy can be created.  Once done, the tag can be
    manipulated in constant time.
    
    Using this during parsing will enable us to produce meaningful error
    messages.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/opdefines.h b/tests/gpgscm/opdefines.h
index c7347fd..a2328fa 100644
--- a/tests/gpgscm/opdefines.h
+++ b/tests/gpgscm/opdefines.h
@@ -149,6 +149,11 @@
     _OP_DEF(opexe_4, "set-symbol-property!",           3,  3,       TST_SYMBOL TST_SYMBOL TST_ANY,   OP_SET_SYMBOL_PROPERTY )
     _OP_DEF(opexe_4, "symbol-property",                2,  2,       TST_SYMBOL TST_SYMBOL,           OP_SYMBOL_PROPERTY  )
 #endif
+#if USE_TAGS
+    _OP_DEF(opexe_4, NULL,                             0,  0,       TST_NONE,                        OP_TAG_VALUE        )
+    _OP_DEF(opexe_4, "make-tagged-value",              2,  2,       TST_ANY TST_PAIR,                 OP_MK_TAGGED        )
+    _OP_DEF(opexe_4, "get-tag",                        1,  1,       TST_ANY,                         OP_GET_TAG          )
+#endif
     _OP_DEF(opexe_4, "quit",                           0,  1,       TST_NUMBER,                      OP_QUIT             )
     _OP_DEF(opexe_4, "gc",                             0,  0,       0,                               OP_GC               )
     _OP_DEF(opexe_4, "gc-verbose",                     0,  1,       TST_NONE,                        OP_GCVERB           )
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 30b5915..c73a832 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -166,6 +166,7 @@ type_to_string (enum scheme_types typ)
 #define ADJ 32
 #define TYPE_BITS 5
 #define T_MASKTYPE      31    /* 0000000000011111 */
+#define T_TAGGED      1024    /* 0000010000000000 */
 #define T_FINALIZE    2048    /* 0000100000000000 */
 #define T_SYNTAX      4096    /* 0001000000000000 */
 #define T_IMMUTABLE   8192    /* 0010000000000000 */
@@ -599,6 +600,59 @@ static long binary_decode(const char *s) {
  return x;
 }
 
+

+
+/* Tags are like property lists, but can be attached to arbitrary
+ * values.  */
+
+#if USE_TAGS
+
+static pointer
+mk_tagged_value(scheme *sc, pointer v, pointer tag_car, pointer tag_cdr)
+{
+  pointer r, t;
+
+  assert(! is_vector(v));
+
+  r = get_consecutive_cells(sc, 2);
+  if (r == sc->sink)
+    return sc->sink;
+
+  memcpy(r, v, sizeof *v);
+  typeflag(r) |= T_TAGGED;
+
+  t = r + 1;
+  typeflag(t) = T_PAIR;
+  car(t) = tag_car;
+  cdr(t) = tag_cdr;
+
+  return r;
+}
+
+static INLINE int
+has_tag(pointer v)
+{
+  return !! (typeflag(v) & T_TAGGED);
+}
+
+static INLINE pointer
+get_tag(scheme *sc, pointer v)
+{
+  if (has_tag(v))
+    return v + 1;
+  return sc->NIL;
+}
+
+#else
+
+#define mk_tagged_value(SC, X, A, B)	(X)
+#define has_tag(V)			0
+#define get_tag(SC, V)			(SC)->NIL
+
+#endif
+
+

+
 /* Allocate a new cell segment but do not make it available yet.  */
 static int
 _alloc_cellseg(scheme *sc, size_t len, void **alloc, pointer *cells)
@@ -1481,6 +1535,9 @@ E2:  setmark(p);
                mark(p+1+i);
           }
      }
+     /* Mark tag if p has one.  */
+     if (has_tag(p))
+       mark(p + 1);
      if (is_atom(p))
           goto E6;
      /* E4: down car */
@@ -4183,6 +4240,29 @@ static pointer opexe_4(scheme *sc, enum scheme_opcodes op) {
      CASE(OP_SYMBOL_PROPERTY):  /* symbol-property */
 	  s_return(sc, get_property(sc, car(sc->args), cadr(sc->args)));
 #endif /* USE_PLIST */
+
+#if USE_TAGS
+     CASE(OP_TAG_VALUE): {      /* not exposed */
+	  /* This tags sc->value with car(sc->args).  Useful to tag
+	   * results of opcode evaluations.  */
+	  pointer a, b, c;
+	  free_cons(sc, sc->args, &a, &b);
+	  free_cons(sc, b, &b, &c);
+	  assert(c == sc->NIL);
+          s_return(sc, mk_tagged_value(sc, sc->value, a, b));
+	}
+
+     CASE(OP_MK_TAGGED):        /* make-tagged-value */
+	  if (is_vector(car(sc->args)))
+	       Error_0(sc, "cannot tag vector");
+          s_return(sc, mk_tagged_value(sc, car(sc->args),
+				       car(cadr(sc->args)),
+				       cdr(cadr(sc->args))));
+
+     CASE(OP_GET_TAG):        /* get-tag */
+	  s_return(sc, get_tag(sc, car(sc->args)));
+#endif /* USE_TAGS */
+
      CASE(OP_QUIT):       /* quit */
           if(is_pair(sc->args)) {
                sc->retcode=ivalue(car(sc->args));
diff --git a/tests/gpgscm/scheme.h b/tests/gpgscm/scheme.h
index 2b5b066..5e7d90d 100644
--- a/tests/gpgscm/scheme.h
+++ b/tests/gpgscm/scheme.h
@@ -44,6 +44,7 @@ extern "C" {
 # define USE_DL 0
 # define USE_PLIST 0
 # define USE_SMALL_INTEGERS 0
+# define USE_TAGS 0
 #endif
 
 
@@ -76,6 +77,11 @@ extern "C" {
 # define USE_PLIST 0
 #endif
 
+/* If set, then every object can be tagged.  */
+#ifndef USE_TAGS
+# define USE_TAGS 1
+#endif
+
 /* To force system errors through user-defined error handling (see *error-hook*) */
 #ifndef USE_ERROR_HOOK
 # define USE_ERROR_HOOK 1

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/ffi.scm          |  36 ---
 tests/gpgscm/init.scm         |  84 ++++++-
 tests/gpgscm/main.c           |  21 +-
 tests/gpgscm/opdefines.h      |  11 +
 tests/gpgscm/repl.scm         |   9 +-
 tests/gpgscm/scheme-private.h |  34 +++
 tests/gpgscm/scheme.c         | 500 ++++++++++++++++++++++++++++++++++++++++--
 tests/gpgscm/scheme.h         |  13 ++
 tests/gpgscm/tests.scm        |  11 +-
 9 files changed, 640 insertions(+), 79 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 17:58:57 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 17:58:57 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-79-g4a04277
Message-ID: <E1cF227-0007xD-UA@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4a04277ad112e0966296133795f93cf6a3daa48e (commit)
      from  e7429b1ced0c69fa7901f888f8dc25f00fc346a4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4a04277ad112e0966296133795f93cf6a3daa48e
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 17:55:36 2016 +0100

    wks: New option --status-fd for gpg-wks-client.
    
    * tools/wks-util.c: Include status.h.
    (statusfp): New global var.
    (wks_set_status_fd): New func.
    (wks_write_status): New func.
    * tools/gpg-wks-client.c: Include status.h.
    (oStatusFD): New constant.
    (opts): New option --status-fd.
    (parse_arguments): Handle that option.
    (main): Return STATUS_SUCCESS or STATUS_FAILURE.
    --
    
    This option is useful in case gpg-wks-client is spawed using a double
    fork approach which does not allow to return the exit code.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
index 1a53f39..0f90424 100644
--- a/tools/gpg-wks-client.c
+++ b/tools/gpg-wks-client.c
@@ -23,6 +23,7 @@
 #include <string.h>
 
 #include "util.h"
+#include "status.h"
 #include "i18n.h"
 #include "sysutils.h"
 #include "init.h"
@@ -58,6 +59,7 @@ enum cmd_and_opt_values
     oGpgProgram,
     oSend,
     oFakeSubmissionAddr,
+    oStatusFD,
 
     oDummy
   };
@@ -86,6 +88,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_s (oGpgProgram, "gpg", "@"),
   ARGPARSE_s_n (oSend, "send", "send the mail using sendmail"),
   ARGPARSE_s_s (oOutput, "output", "|FILE|write the mail to FILE"),
+  ARGPARSE_s_i (oStatusFD, "status-fd", N_("|FD|write status info to this FD")),
 
   ARGPARSE_s_s (oFakeSubmissionAddr, "fake-submission-addr", "@"),
 
@@ -197,6 +200,9 @@ parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
         case oFakeSubmissionAddr:
           fake_submission_addr = pargs->r.ret_str;
           break;
+        case oStatusFD:
+          wks_set_status_fd (translate_sys2libc_fd_int (pargs->r.ret_int, 1));
+          break;
 
 	case aSupported:
 	case aCreate:
@@ -298,14 +304,21 @@ main (int argc, char **argv)
     case aCheck:
       if (argc != 1)
         wrong_args ("--check USER-ID");
-      command_check (argv[0]);
+      err = command_check (argv[0]);
       break;
 
     default:
       usage (1);
+      err = 0;
       break;
     }
 
+  if (err)
+    wks_write_status (STATUS_FAILURE, "- %u", err);
+  else if (log_get_errorcount (0))
+    wks_write_status (STATUS_FAILURE, "- %u", GPG_ERR_GENERAL);
+  else
+    wks_write_status (STATUS_SUCCESS, NULL);
   return log_get_errorcount (0)? 1:0;
 }
 
diff --git a/tools/gpg-wks.h b/tools/gpg-wks.h
index 7f347eb..62ceb34 100644
--- a/tools/gpg-wks.h
+++ b/tools/gpg-wks.h
@@ -65,6 +65,8 @@ typedef struct policy_flags_s *policy_flags_t;
 
 
 /*-- wks-util.c --*/
+void wks_set_status_fd (int fd);
+void wks_write_status (int no, const char *format, ...) GPGRT_ATTR_PRINTF(2,3);
 gpg_error_t wks_list_key (estream_t key, char **r_fpr, strlist_t *r_mboxes);
 gpg_error_t wks_send_mime (mime_maker_t mime);
 gpg_error_t wks_parse_policy (policy_flags_t flags, estream_t stream,
diff --git a/tools/wks-util.c b/tools/wks-util.c
index f4f44f6..e6f6b7a 100644
--- a/tools/wks-util.c
+++ b/tools/wks-util.c
@@ -23,6 +23,7 @@
 #include <string.h>
 
 #include "util.h"
+#include "status.h"
 #include "ccparray.h"
 #include "exectool.h"
 #include "mbox-util.h"
@@ -30,6 +31,65 @@
 #include "send-mail.h"
 #include "gpg-wks.h"
 
+/* The stream to output the status information.  Output is disabled if
+   this is NULL.  */
+static estream_t statusfp;
+
+
+

+/* Set the status FD.  */
+void
+wks_set_status_fd (int fd)
+{
+  static int last_fd = -1;
+
+  if (fd != -1 && last_fd == fd)
+    return;
+
+  if (statusfp && statusfp != es_stdout && statusfp != es_stderr)
+    es_fclose (statusfp);
+  statusfp = NULL;
+  if (fd == -1)
+    return;
+
+  if (fd == 1)
+    statusfp = es_stdout;
+  else if (fd == 2)
+    statusfp = es_stderr;
+  else
+    statusfp = es_fdopen (fd, "w");
+  if (!statusfp)
+    {
+      log_fatal ("can't open fd %d for status output: %s\n",
+                 fd, gpg_strerror (gpg_error_from_syserror ()));
+    }
+  last_fd = fd;
+}
+
+
+/* Write a status line with code NO followed by the outout of the
+ * printf style FORMAT.  The caller needs to make sure that LFs and
+ * CRs are not printed.  */
+void
+wks_write_status (int no, const char *format, ...)
+{
+  va_list arg_ptr;
+
+  if (!statusfp)
+    return;  /* Not enabled.  */
+
+  es_fputs ("[GNUPG:] ", statusfp);
+  es_fputs (get_status_string (no), statusfp);
+  if (format)
+    {
+      es_putc (' ', statusfp);
+      va_start (arg_ptr, format);
+      es_vfprintf (statusfp, format, arg_ptr);
+      va_end (arg_ptr);
+    }
+  es_putc ('\n', statusfp);
+}
+
 
 

 /* Helper for wks_list_key.  */

-----------------------------------------------------------------------

Summary of changes:
 tools/gpg-wks-client.c | 15 ++++++++++++-
 tools/gpg-wks.h        |  2 ++
 tools/wks-util.c       | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 76 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 19:15:31 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 19:15:31 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-80-gcb4c7ab
Message-ID: <E1cF3ED-0003DU-Fj@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  cb4c7abb774e2d95806d8b0ec6ea5cd130c1b5b8 (commit)
      from  4a04277ad112e0966296133795f93cf6a3daa48e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cb4c7abb774e2d95806d8b0ec6ea5cd130c1b5b8
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 19:02:56 2016 +0100

    Fix 2 compiler warnings.
    
    * dirmngr/loadswdb.c: Set ERR on malloc failure.
    * g10/passphrase.c (passphrase_to_dek): Initialize all fields of
    HELP_S2K.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/loadswdb.c b/dirmngr/loadswdb.c
index bc56c2a..2d6bdc1 100644
--- a/dirmngr/loadswdb.c
+++ b/dirmngr/loadswdb.c
@@ -272,7 +272,10 @@ dirmngr_load_swdb (ctrl_t ctrl, int force)
   /* Create the filename of the file with the keys. */
   keyfile_fname = make_filename_try (gnupg_datadir (), "distsigkey.gpg", NULL);
   if (!keyfile_fname)
-    goto leave;
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
 
   /* Fetch the swdb from the web.  */
   err = fetch_file (ctrl, "https://versions.gnupg.org/swdb.lst", &swdb);
diff --git a/g10/passphrase.c b/g10/passphrase.c
index ccd232a..fb4ec4c 100644
--- a/g10/passphrase.c
+++ b/g10/passphrase.c
@@ -319,8 +319,8 @@ passphrase_to_dek (int cipher_algo, STRING2KEY *s2k,
       log_assert (create && !nocache);
       /* This is used for the old rfc1991 mode
        * Note: This must match the code in encode.c with opt.rfc1991 set */
+      memset (&help_s2k, 0, sizeof (help_s2k));
       s2k = &help_s2k;
-      s2k->mode = 0;
       s2k->hash_algo = S2K_DIGEST_ALGO;
     }
 

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/loadswdb.c | 5 ++++-
 g10/passphrase.c   | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec  8 20:29:08 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 08 Dec 2016 20:29:08 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-81-g5c7d582
Message-ID: <E1cF4NS-0006tx-Dd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5c7d58222834793629a30248e72b6ea96e832dc4 (commit)
      from  cb4c7abb774e2d95806d8b0ec6ea5cd130c1b5b8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5c7d58222834793629a30248e72b6ea96e832dc4
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 8 20:25:48 2016 +0100

    common: Skip the Byte Order Mark in conf files.
    
    * common/argparse.c (optfile_parse): Detect and skip the UTF-8 BOM.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/argparse.c b/common/argparse.c
index 240fdce..dce725a 100644
--- a/common/argparse.c
+++ b/common/argparse.c
@@ -568,17 +568,35 @@ optfile_parse (FILE *fp, const char *filename, unsigned *lineno,
   char *buffer = NULL;
   size_t buflen = 0;
   int in_alias=0;
+  int unread_buf[3];  /* We use an int so that we can store EOF.  */
+  int unread_buf_count = 0;
 
   if (!fp) /* Divert to to arg_parse() in this case.  */
     return arg_parse (arg, opts);
 
   initialize (arg, filename, lineno);
 
+  /* If the LINENO is zero we assume that we are at the start of a
+   * file and we skip over a possible Byte Order Mark.  */
+  if (!*lineno)
+    {
+      unread_buf[0] = getc (fp);
+      unread_buf[1] = getc (fp);
+      unread_buf[2] = getc (fp);
+      if (unread_buf[0] != 0xef
+          || unread_buf[1] != 0xbb
+          || unread_buf[2] != 0xbf)
+        unread_buf_count = 3;
+    }
+
   /* Find the next keyword.  */
   state = i = 0;
   for (;;)
     {
-      c = getc (fp);
+      if (unread_buf_count)
+        c = unread_buf[3 - unread_buf_count--];
+      else
+        c = getc (fp);
       if (c == '\n' || c== EOF )
         {
           if ( c != EOF )

-----------------------------------------------------------------------

Summary of changes:
 common/argparse.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 13:23:28 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 09 Dec 2016 13:23:28 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-85-gb778d8d
Message-ID: <E1cFKD6-0002Lv-PI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b778d8deedf344c8116362633925b8153c7f1bf1 (commit)
       via  59f1562c25119a4fe27411e6350f2149d6147148 (commit)
       via  c8100fc0faadf8ba35e4df32b4760cc975e3a83d (commit)
       via  3de9bad359e28ced4a2539e411d222ffd82a4a62 (commit)
      from  5c7d58222834793629a30248e72b6ea96e832dc4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b778d8deedf344c8116362633925b8153c7f1bf1
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 8 15:40:27 2016 +0100

    tests: Add a test for '--quick-addkey'.
    
    * tests/openpgp/quick-key-manipulation.scm: Test '--quick-addkey'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index d6bdde0..360c48e 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -97,3 +97,68 @@
 ;; And remove the expiration date.
 (call-check `(, at gpg --quick-set-expire ,fpr "0"))
 (assert (equal? "" (expiration-time fpr)))
+
+
+;;
+;; Check --quick-addkey
+;;
+
+;; Get the subkeys.
+(define (get-subkeys)
+  (filter (lambda (x) (equal? "sub" (car x)))
+	  (gpg-with-colons `(-k ,fpr))))
+
+;; This keeps track of the number of subkeys.
+(define count (length (get-subkeys)))
+
+;; Convenient accessors for the colon output.
+(define (:length x) (string->number (list-ref x 2)))
+(define (:alg x) (string->number (list-ref x 3)))
+(define (:expire x) (list-ref x 6))
+(define (:cap x) (list-ref x 11))
+
+(for-each-p
+ "Checking that we can add subkeys..."
+ (lambda (args check)
+   (set! count (+ 1 count))
+   (call-check `(, at gpg --quick-addkey ,fpr , at args))
+   (let ((subkeys (get-subkeys)))
+     (assert (= count (length subkeys)))
+     (if check (check (last subkeys)))))
+ ;; A bunch of arguments...
+ '(()
+   (- - -)
+   (default default never)
+   (rsa sign "2d")
+   (rsa1024 sign "2w")
+   (rsa2048 encr "2m")
+   (rsa4096 sign,auth "2y")
+   (future-default))
+ ;; ... with functions to check that the created key matches the
+ ;; expectations (or #f for no tests).
+ (list
+  #f
+  #f
+  (lambda (subkey)
+    (assert (equal? "" (:expire subkey))))
+  (lambda (subkey)
+    (assert (= 1 (:alg subkey)))
+    (assert (string-contains? (:cap subkey) "s"))
+    (assert (not (equal? "" (:expire subkey)))))
+  (lambda (subkey)
+    (assert (= 1 (:alg subkey)))
+    (assert (= 1024 (:length subkey)))
+    (assert (string-contains? (:cap subkey) "s"))
+    (assert (not (equal? "" (:expire subkey)))))
+  (lambda (subkey)
+    (assert (= 1 (:alg subkey)))
+    (assert (= 2048 (:length subkey)))
+    (assert (string-contains? (:cap subkey) "e"))
+    (assert (not (equal? "" (:expire subkey)))))
+  (lambda (subkey)
+    (assert (= 1 (:alg subkey)))
+    (assert (= 4096 (:length subkey)))
+    (assert (string-contains? (:cap subkey) "s"))
+    (assert (string-contains? (:cap subkey) "a"))
+    (assert (not (equal? "" (:expire subkey)))))
+  #f))

commit 59f1562c25119a4fe27411e6350f2149d6147148
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 9 11:49:24 2016 +0100

    tests: New test using all available compression algorithms.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/compression.scm: New file.
    * tests/openpgp/defs.scm (all-compression-algos): New variable.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 2f43644..deed63d 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -55,6 +55,7 @@ XTESTS = \
 	encrypt.scm \
 	encrypt-multifile.scm \
 	encrypt-dsa.scm \
+	compression.scm \
 	seat.scm \
 	clearsig.scm \
 	encryptp.scm \
diff --git a/tests/openpgp/compression.scm b/tests/openpgp/compression.scm
new file mode 100755
index 0000000..f39c132
--- /dev/null
+++ b/tests/openpgp/compression.scm
@@ -0,0 +1,36 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+(for-each-p
+ "Checking encryption using a specific compression algorithm"
+ (lambda (compression)
+   (for-each-p
+    ""
+    (lambda (source)
+      (tr:do
+       (tr:open source)
+       (tr:gpg "" `(--yes --encrypt --recipient ,usrname2
+			  --compress-algo ,compression))
+       (tr:gpg "" '(--yes))
+       (tr:assert-identity source)))
+    (append plain-files data-files)))
+ (force all-compression-algos))
diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index bdb86ca..b198cdd 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -102,6 +102,7 @@
 (define all-pubkey-algos (delay (get-config "pubkeyname")))
 (define all-hash-algos (delay (get-config "digestname")))
 (define all-cipher-algos (delay (get-config "ciphername")))
+(define all-compression-algos (delay (get-config "compressname")))
 
 (define (have-pubkey-algo? x)
   (not (not (member x (force all-pubkey-algos)))))

commit c8100fc0faadf8ba35e4df32b4760cc975e3a83d
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 9 11:46:49 2016 +0100

    g10: List compression algorithms using human-readable names.
    
    * g10/gpg.c (list_config): List all enabled compression algorithms
    under the key 'compressname'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/gpg.c b/g10/gpg.c
index 19a7a41..ddb7715 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -1757,6 +1757,15 @@ list_config(char *items)
 	  any=1;
 	}
 
+      if(show_all || ascii_strcasecmp (name, "compressname") == 0)
+	{
+	  es_printf ("cfg:compressname:");
+	  print_algo_names (check_compress_algo,
+			    compress_algo_to_string);
+	  es_printf ("\n");
+	  any=1;
+	}
+
       if (show_all || !ascii_strcasecmp(name,"ccid-reader-id"))
 	{
           /* We ignore this for GnuPG 1.4 backward compatibility.  */

commit 3de9bad359e28ced4a2539e411d222ffd82a4a62
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 9 13:12:30 2016 +0100

    g10: Fix memory leak.
    
    * g10/sign.c (do_sign): Release old signature data.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/sign.c b/g10/sign.c
index 19ca484..acc894c 100644
--- a/g10/sign.c
+++ b/g10/sign.c
@@ -282,7 +282,9 @@ do_sign (PKT_public_key *pksk, PKT_signature *sig,
   sig->digest_algo = mdalgo;
   sig->digest_start[0] = dp[0];
   sig->digest_start[1] = dp[1];
+  mpi_release (sig->data[0]);
   sig->data[0] = NULL;
+  mpi_release (sig->data[1]);
   sig->data[1] = NULL;
 
 

-----------------------------------------------------------------------

Summary of changes:
 g10/gpg.c                                          |  9 +++
 g10/sign.c                                         |  2 +
 tests/openpgp/Makefile.am                          |  1 +
 tests/openpgp/{encrypt-dsa.scm => compression.scm} | 20 ++-----
 tests/openpgp/defs.scm                             |  1 +
 tests/openpgp/quick-key-manipulation.scm           | 65 ++++++++++++++++++++++
 6 files changed, 83 insertions(+), 15 deletions(-)
 copy tests/openpgp/{encrypt-dsa.scm => compression.scm} (68%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 14:42:15 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 09 Dec 2016 14:42:15 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-86-gd568a15
Message-ID: <E1cFLRJ-0005bZ-N4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d568a1561642ed9b7b7b6282b86c56786d10a956 (commit)
      from  b778d8deedf344c8116362633925b8153c7f1bf1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d568a1561642ed9b7b7b6282b86c56786d10a956
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 9 14:33:50 2016 +0100

    g10: Create keys that expire in simple key generation mode.
    
    * g10/keygen.c (default_expiration_interval): New variable.
    (generate_keypair): Use the new default.
    --
    Cursory discussion on gnupg-devel@ suggested two years as a good
    default expiration interval.
    
    GnuPG-bug-id: 2701
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/keygen.c b/g10/keygen.c
index ad96cdd..ebb2d70 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -53,6 +53,10 @@
 #define DEFAULT_STD_KEY_PARAM  "rsa2048/cert,sign+rsa2048/encr"
 #define FUTURE_STD_KEY_PARAM   "ed25519/cert,sign+cv25519/encr"
 
+/* When generating keys using the streamlined key generation dialog,
+   use this as a default expiration interval.  */
+const char *default_expiration_interval = "2y";
+
 /* Flag bits used during key generation.  */
 #define KEYGEN_FLAG_NO_PROTECTION 1
 #define KEYGEN_FLAG_TRANSIENT_KEY 2
@@ -4306,7 +4310,8 @@ generate_keypair (ctrl_t ctrl, int full, const char *fname,
     }
 
 
-  expire = full? ask_expire_interval (0, NULL) : 0;
+  expire = full? ask_expire_interval (0, NULL)
+               : parse_expire_string (default_expiration_interval);
   r = xcalloc (1, sizeof *r + 20);
   r->key = pKEYEXPIRE;
   r->u.expire = expire;

-----------------------------------------------------------------------

Summary of changes:
 g10/keygen.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 15:25:26 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 09 Dec 2016 15:25:26 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-214-gfff2ff1
Message-ID: <E1cFM76-0007xM-RS@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  fff2ff17e509ba9e73c13b4059d27f5c9f4be0f4 (commit)
       via  e2e7785efe1310b27fa902128c45db8ab987e475 (commit)
       via  5444ba05ad530f9ab70fd3f7cd29a6c4767240ac (commit)
      from  209490bfa1054e52ffed0a3fc01182ec213486a7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fff2ff17e509ba9e73c13b4059d27f5c9f4be0f4
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 9 15:19:22 2016 +0100

    Recuce Sign and Encrypt to single split button
    
    * src/dialogs.h: Add new icon ids.
    * src/ribbon-callbacks.h: Add new ids.
    * src/ribbon-callbacks.cpp (GpgolRibbonExtender::GetIDsOfNames),
    (GpgolRibbonExtender::Invoke): Handle new ids.
    (GetCustomUI_MIME): Use split button.
    * src/ribbon-callbacks.cpp (mark_mime_action): Invalidate ui.
    (get_crypt_pressed): Handle queries for multiple flags.

diff --git a/src/dialogs.h b/src/dialogs.h
index 8e57468..54bbede 100644
--- a/src/dialogs.h
+++ b/src/dialogs.h
@@ -119,5 +119,8 @@
 #define IDI_EMBLEM_INFORMATION_64_PNG   0x6073
 #define IDI_EMBLEM_QUESTION_64_PNG      0x6074
 #define IDI_EMBLEM_SUCCESS_YELLOW_64_PNG 0x6075
+#define IDI_SIGN_ENCRYPT_40_PNG         0x6075
+#define IDI_ENCRYPT_20_PNG              0x6076
+#define IDI_SIGN_20_PNG                 0x6077
 
 #endif /*DIALOGS_H*/
diff --git a/src/dialogs.rc b/src/dialogs.rc
index c20cb43..b51f556 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -58,7 +58,9 @@ IDI_EMBLEM_SUCCESS_YELLOW_64_PNG RCDATA        "icons/emblem-success-yellow-64.p
 IDI_EMBLEM_INFORMATION_64_PNG RCDATA           "icons/emblem-information-64.png"
 IDI_EMBLEM_QUESTION_64_PNG RCDATA              "icons/emblem-question-64.png"
 
-
+IDI_SIGN_ENCRYPT_40_PNG    RCDATA              "icons/sing-enc-40.png"
+IDI_ENCRYPT_20_PNG         RCDATA              "icons/encrypt-20.png"
+IDI_SIGN_20_PNG            RCDATA              "icons/sign-20.png"
 
 IDD_GPG_OPTIONS  DIALOG DISCARDABLE  0, 0, 266, 274
 STYLE DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index 3b26107..a649ffe 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -613,6 +613,9 @@ GpgolRibbonExtender::GetIDsOfNames (REFIID riid, LPOLESTR *rgszNames,
       ID_MAPPER (L"btnDecryptLarge", ID_BTN_DECRYPT_LARGE)
       ID_MAPPER (L"btnEncrypt", ID_BTN_ENCRYPT)
       ID_MAPPER (L"btnEncryptLarge", ID_BTN_ENCRYPT_LARGE)
+      ID_MAPPER (L"btnEncryptSmall", IDI_ENCRYPT_20_PNG)
+      ID_MAPPER (L"btnSignSmall", IDI_SIGN_20_PNG)
+      ID_MAPPER (L"btnSignEncryptLarge", IDI_SIGN_ENCRYPT_40_PNG)
       ID_MAPPER (L"btnEncryptFileLarge", ID_BTN_ENCSIGN_LARGE)
       ID_MAPPER (L"btnSignLarge", ID_BTN_SIGN_LARGE)
       ID_MAPPER (L"btnVerifyLarge", ID_BTN_VERIFY_LARGE)
@@ -626,13 +629,17 @@ GpgolRibbonExtender::GetIDsOfNames (REFIID riid, LPOLESTR *rgszNames,
 
       /* MIME support: */
       ID_MAPPER (L"encryptMime", ID_CMD_MIME_ENCRYPT)
-      ID_MAPPER (L"signMime", ID_CMD_MIME_SIGN)
-      ID_MAPPER (L"getEncryptPressed", ID_GET_ENCRYPT_PRESSED)
-      ID_MAPPER (L"getSignPressed", ID_GET_SIGN_PRESSED)
       ID_MAPPER (L"encryptMimeEx", ID_CMD_MIME_ENCRYPT_EX)
+      ID_MAPPER (L"signMime", ID_CMD_MIME_SIGN)
       ID_MAPPER (L"signMimeEx", ID_CMD_MIME_SIGN_EX)
+      ID_MAPPER (L"encryptSignMime", ID_CMD_SIGN_ENCRYPT_MIME)
+      ID_MAPPER (L"encryptSignMimeEx", ID_CMD_SIGN_ENCRYPT_MIME_EX)
+      ID_MAPPER (L"getEncryptPressed", ID_GET_ENCRYPT_PRESSED)
       ID_MAPPER (L"getEncryptPressedEx", ID_GET_ENCRYPT_PRESSED_EX)
+      ID_MAPPER (L"getSignPressed", ID_GET_SIGN_PRESSED)
       ID_MAPPER (L"getSignPressedEx", ID_GET_SIGN_PRESSED_EX)
+      ID_MAPPER (L"getSignEncryptPressed", ID_GET_SIGN_ENCRYPT_PRESSED)
+      ID_MAPPER (L"getSignEncryptPressedEx", ID_GET_SIGN_ENCRYPT_PRESSED_EX)
       ID_MAPPER (L"ribbonLoaded", ID_ON_LOAD)
       ID_MAPPER (L"openOptions", ID_CMD_OPEN_OPTIONS)
       ID_MAPPER (L"getSigLabel", ID_GET_SIG_LABEL)
@@ -690,10 +697,18 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
         return signBody (parms->rgvarg[0].pdispVal);
       case ID_CMD_VERIFY_BODY:
         return verifyBody (parms->rgvarg[0].pdispVal);
-      case ID_CMD_MIME_SIGN:
-        return mark_mime_action (parms->rgvarg[1].pdispVal, OP_SIGN, false);
+      case ID_CMD_SIGN_ENCRYPT_MIME:
+        return mark_mime_action (parms->rgvarg[1].pdispVal,
+                                 OP_SIGN|OP_ENCRYPT, false);
+      case ID_CMD_SIGN_ENCRYPT_MIME_EX:
+        return mark_mime_action (parms->rgvarg[1].pdispVal,
+                                 OP_SIGN|OP_ENCRYPT, true);
       case ID_CMD_MIME_ENCRYPT:
         return mark_mime_action (parms->rgvarg[1].pdispVal, OP_ENCRYPT,
+
+                                 false);
+      case ID_CMD_MIME_SIGN:
+        return mark_mime_action (parms->rgvarg[1].pdispVal, OP_SIGN,
                                  false);
       case ID_GET_ENCRYPT_PRESSED:
         return get_crypt_pressed (parms->rgvarg[0].pdispVal, OP_ENCRYPT,
@@ -701,6 +716,10 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
       case ID_GET_SIGN_PRESSED:
         return get_crypt_pressed (parms->rgvarg[0].pdispVal, OP_SIGN,
                                   result, false);
+      case ID_GET_SIGN_ENCRYPT_PRESSED:
+        return get_crypt_pressed (parms->rgvarg[0].pdispVal,
+                                  OP_SIGN | OP_ENCRYPT,
+                                  result, false);
       case ID_CMD_MIME_SIGN_EX:
         return mark_mime_action (parms->rgvarg[1].pdispVal, OP_SIGN, true);
       case ID_CMD_MIME_ENCRYPT_EX:
@@ -711,6 +730,9 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
       case ID_GET_SIGN_PRESSED_EX:
         return get_crypt_pressed (parms->rgvarg[0].pdispVal, OP_SIGN,
                                   result, true);
+      case ID_GET_SIGN_ENCRYPT_PRESSED_EX:
+        return get_crypt_pressed (parms->rgvarg[0].pdispVal, OP_SIGN | OP_ENCRYPT,
+                                  result, true);
       case ID_GET_SIG_STIP:
         return get_sig_stip (parms->rgvarg[0].pdispVal, result);
       case ID_GET_SIG_TTIP:
@@ -740,6 +762,9 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
       case ID_BTN_ENCSIGN_LARGE:
       case ID_BTN_SIGN_LARGE:
       case ID_BTN_VERIFY_LARGE:
+      case IDI_SIGN_ENCRYPT_40_PNG:
+      case IDI_ENCRYPT_20_PNG:
+      case IDI_SIGN_20_PNG:
         return getIcon (dispid, result);
       case ID_BTN_SIGSTATE_LARGE:
         return get_sigstate_icon (parms->rgvarg[0].pdispVal, result);
@@ -777,6 +802,13 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
     _("Sign the message.");
   const char *signSTip =
     _("Sign the message and all attachments before sending.");
+
+  const char *secureTTip =
+    _("Encrypt and sign the message.");
+  const char *secureSTip =
+    _("Encrypting and cryptographically signing a message means that the "
+      "recipient can be sure that no one modified the message and only the "
+      "recipients can read it.\nNot even the NSA.");
   const char *optsSTip =
     _("Open the settings dialog for GpgOL.");
   log_debug ("%s:%s: GetCustomUI_MIME for id: %ls", SRCNAME, __func__, RibbonID);
@@ -794,22 +826,30 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "    <tab idMso=\"TabNewMailMessage\">"
         "     <group id=\"general\""
         "            label=\"%s\">"
-        "       <toggleButton id=\"mimeEncrypt\""
-        "               getImage=\"btnEncryptLarge\""
-        "               size=\"large\""
-        "               label=\"%s\""
-        "               screentip=\"%s\""
-        "               supertip=\"%s\""
-        "               onAction=\"encryptMime\""
-        "               getPressed=\"getEncryptPressed\"/>"
-        "       <toggleButton id=\"mimeSign\""
-        "               getImage=\"btnSignLarge\""
-        "               size=\"large\""
-        "               label=\"%s\""
-        "               screentip=\"%s\""
-        "               supertip=\"%s\""
-        "               onAction=\"signMime\""
-        "               getPressed=\"getSignPressed\"/>"
+        "       <splitButton id=\"splitty\" size=\"large\">"
+        "         <toggleButton id=\"mimeSignEncrypt\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 getPressed=\"getSignEncryptPressed\""
+        "                 getImage=\"btnSignEncryptLarge\""
+        "                 onAction=\"encryptSignMime\"""/>"
+        "         <menu id=\"encMenu\" showLabel=\"true\">"
+        "         <toggleButton id=\"mimeSign\""
+        "                 getImage=\"btnSignSmall\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 onAction=\"signMime\""
+        "                 getPressed=\"getSignPressed\"/>"
+        "         <toggleButton id=\"mimeEncrypt\""
+        "                 getImage=\"btnEncryptSmall\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 onAction=\"encryptMime\""
+        "                 getPressed=\"getEncryptPressed\"/>"
+        "       </menu></splitButton>"
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn\""
         "                 onAction=\"openOptions\""
@@ -820,8 +860,9 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "   </tabs>"
         " </ribbon>"
         "</customUI>", _("GpgOL"),
-        _("Encrypt"), encryptTTip, encryptSTip,
+        _("Sign Encrypt"), secureTTip, secureSTip,
         _("Sign"), signTTip, signSTip,
+        _("Encrypt"), encryptTTip, encryptSTip,
         optsSTip
         );
     }
@@ -899,28 +940,36 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "    <tab idMso=\"TabMessage\">"
         "     <group id=\"general\""
         "            label=\"%s\">"
-        "       <toggleButton id=\"mimeEncryptEx\""
-        "               getImage=\"btnEncryptLarge\""
-        "               size=\"large\""
-        "               label=\"%s\""
-        "               screentip=\"%s\""
-        "               supertip=\"%s\""
-        "               onAction=\"encryptMimeEx\""
-        "               getPressed=\"getEncryptPressedEx\"/>"
-        "       <toggleButton id=\"mimeSignEx\""
-        "               getImage=\"btnSignLarge\""
-        "               size=\"large\""
-        "               label=\"%s\""
-        "               screentip=\"%s\""
-        "               supertip=\"%s\""
-        "               onAction=\"signMimeEx\""
-        "               getPressed=\"getSignPressedEx\"/>"
+        "       <splitButton id=\"splitty\" size=\"large\">"
+        "         <toggleButton id=\"mimeSignEncrypt\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 getPressed=\"getSignEncryptPressedEx\""
+        "                 getImage=\"btnSignEncryptLarge\""
+        "                 onAction=\"encryptSignMimeEx\"""/>"
+        "         <menu id=\"encMenu\" showLabel=\"true\">"
+        "         <toggleButton id=\"mimeSign\""
+        "                 getImage=\"btnSignSmall\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 onAction=\"signMimeEx\""
+        "                 getPressed=\"getSignPressedEx\"/>"
+        "         <toggleButton id=\"mimeEncrypt\""
+        "                 getImage=\"btnEncryptSmall\""
+        "                 label=\"%s\""
+        "                 screentip=\"%s\""
+        "                 supertip=\"%s\""
+        "                 onAction=\"encryptMimeEx\""
+        "                 getPressed=\"getEncryptPressedEx\"/>"
+        "       </menu></splitButton>"
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn\""
         "                 onAction=\"openOptions\""
         "                 screentip=\"%s\"/>"
         "       </dialogBoxLauncher>"
-        "     </group>"
+        "      </group>"
         "    </tab>"
         "   </tabSet>"
         "   </contextualTabs>"
@@ -929,8 +978,9 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         _("GpgOL"),
         optsSTip,
         _("GpgOL"),
-        _("Encrypt"), encryptTTip, encryptSTip,
+        _("Sign Encrypt"), secureTTip, secureSTip,
         _("Sign"), signTTip, signSTip,
+        _("Encrypt"), encryptTTip, encryptSTip,
         optsSTip
         );
     }
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index f14f43b..2dbe80e 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1342,6 +1342,11 @@ mark_mime_action (LPDISPATCH ctrl, int flags, bool is_explorer)
 
   rc = S_OK;
 
+  /*  We need to invalidate the UI to update the toggle
+      states of the subbuttons and the top button. Yeah,
+      we invalidate a lot *sigh* */
+  gpgoladdin_invalidate_ui ();
+
 done:
   gpgol_release (context);
   gpgol_release (mailitem);
@@ -1353,12 +1358,13 @@ done:
 /* Get the state of encrypt / sign toggle buttons.
   flag values: 1 get the state of the encrypt button.
                2 get the state of the sign button.
-  If is_explorer is set to true
-               */
+  If is_explorer is set to true we look at the inline response.
+*/
 HRESULT get_crypt_pressed (LPDISPATCH ctrl, int flags, VARIANT *result,
                            bool is_explorer)
 {
   HRESULT hr;
+  bool value;
   LPDISPATCH context = NULL,
              mailitem = NULL;
   LPMESSAGE message = NULL;
@@ -1402,9 +1408,9 @@ HRESULT get_crypt_pressed (LPDISPATCH ctrl, int flags, VARIANT *result,
       goto done;
     }
 
-  *(result->pboolVal) = get_gpgol_draft_info_flags (message) & flags ?
-                                                        VARIANT_TRUE :
-                                                        VARIANT_FALSE;
+  value = (get_gpgol_draft_info_flags (message) & flags) == flags;
+
+  *(result->pboolVal) = value ? VARIANT_TRUE : VARIANT_FALSE;
 
 done:
   gpgol_release (context);
diff --git a/src/ribbon-callbacks.h b/src/ribbon-callbacks.h
index be64eb5..f2a33f7 100644
--- a/src/ribbon-callbacks.h
+++ b/src/ribbon-callbacks.h
@@ -52,6 +52,10 @@
 #define ID_GET_SIG_LABEL        27
 #define ID_LAUNCH_CERT_DETAILS  28
 #define ID_BTN_SIGSTATE_LARGE   29
+#define ID_GET_SIGN_ENCRYPT_PRESSED   30
+#define ID_GET_SIGN_ENCRYPT_PRESSED_EX 31
+#define ID_CMD_SIGN_ENCRYPT_MIME 32
+#define ID_CMD_SIGN_ENCRYPT_MIME_EX 33
 
 #define ID_BTN_CERTMANAGER       IDI_KEY_MANAGER_64_PNG
 #define ID_BTN_DECRYPT           IDI_DECRYPT_16_PNG

commit e2e7785efe1310b27fa902128c45db8ab987e475
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 9 15:17:13 2016 +0100

    Improve messagelist icon
    
    * encr-s.ico, encr-s.xcf: Imrpove 1bit alpha use by mixing more
    white into the still transparent colors. Remove line in the middle
    this was too small for 16x16

diff --git a/forms/encr-s.ico b/forms/encr-s.ico
index b143440..031a5b7 100755
Binary files a/forms/encr-s.ico and b/forms/encr-s.ico differ
diff --git a/forms/encr-s.xcf b/forms/encr-s.xcf
index 3d10ecc..b164371 100644
Binary files a/forms/encr-s.xcf and b/forms/encr-s.xcf differ

commit 5444ba05ad530f9ab70fd3f7cd29a6c4767240ac
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 9 15:23:08 2016 +0100

    Add new icons for sign / encrypt
    
    * src/icons/Makefile.am (EXTRA_DIST): Update accordingly.
    * encrypt-20.png, encrypt.svg, sign-20.png, sign-enc-40.png,
    sign-enc.svg, sign.svg: New.
    
    --
    This is more in the visual language of Outlook with the ribbon
    as a signature icon. It's also using the new lock of gpgol.

diff --git a/src/icons/Makefile.am b/src/icons/Makefile.am
index 6f06833..c65e707 100644
--- a/src/icons/Makefile.am
+++ b/src/icons/Makefile.am
@@ -31,4 +31,6 @@ EXTRA_DIST= \
     emblem-question.svg \
     emblem-warning.svg \
     emblem-information.svg \
-    emblem-success-yellow.svg
+    emblem-success-yellow.svg \
+    sign.svg sign-enc.svg enc.svg \
+    sign-enc-40.png sign-20.png encrypt-20.png
diff --git a/src/icons/encrypt-20.png b/src/icons/encrypt-20.png
new file mode 100644
index 0000000..b772255
Binary files /dev/null and b/src/icons/encrypt-20.png differ
diff --git a/src/icons/encrypt.svg b/src/icons/encrypt.svg
new file mode 100644
index 0000000..8257a0f
--- /dev/null
+++ b/src/icons/encrypt.svg
@@ -0,0 +1,77 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/secure-64.png"
+   inkscape:export-xdpi="120"
+   inkscape:export-ydpi="120"
+   sodipodi:docname="sign-enc.svg">
+  <defs
+     id="defs3022" />
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="4"
+     inkscape:cx="-21.886084"
+     inkscape:cy="11.467242"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1003"
+     inkscape:window-x="1918"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1" />
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <polygon
+       id="polygon4191"
+       points="0,316.6 81.19,316.6 81.19,247.55 40.6,281.41 40.6,281.41 0,247.55 "
+       class="cls-4"
+       style="fill:#1f8ece"
+       transform="matrix(0.44696256,0,0,0.35766585,6.1519517,-65.132907)" />
+    <polygon
+       id="polygon4193"
+       points="0,242.65 40.6,276.5 81.19,242.65 0,242.65 "
+       class="cls-4"
+       style="fill:#1f8ece"
+       transform="matrix(0.44696256,0,0,0.35766585,6.1519517,-65.132907)" />
+    <path
+       id="path4195"
+       d="m 9.4684144,12.888323 v 7.353608 h 6.3200506 v -7.353608 c 0,-4.027318 3.81706,-7.3071137 8.492289,-7.3071137 4.675228,0 8.492289,3.2762188 8.492289,7.3071137 v 7.353608 h 6.32005 v -7.353608 c 0,-6.9101042 -6.646333,-12.51830551 -14.825748,-12.51830551 h 0 c -8.174945,0 -14.8257472,5.62250781 -14.8257472,12.51830551"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#3d3d3b" />
+  </g>
+</svg>
diff --git a/src/icons/sign-20.png b/src/icons/sign-20.png
new file mode 100644
index 0000000..26e6e07
Binary files /dev/null and b/src/icons/sign-20.png differ
diff --git a/src/icons/sign-enc-40.png b/src/icons/sign-enc-40.png
new file mode 100644
index 0000000..fb984fa
Binary files /dev/null and b/src/icons/sign-enc-40.png differ
diff --git a/src/icons/sign-enc.svg b/src/icons/sign-enc.svg
new file mode 100644
index 0000000..91d95d4
--- /dev/null
+++ b/src/icons/sign-enc.svg
@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/secure-64.png"
+   inkscape:export-xdpi="120"
+   inkscape:export-ydpi="120"
+   sodipodi:docname="New document 2">
+  <defs
+     id="defs3022" />
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="4"
+     inkscape:cx="-21.886084"
+     inkscape:cy="11.467242"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1003"
+     inkscape:window-x="1918"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1" />
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <polygon
+       id="polygon4191"
+       points="0,316.6 81.19,316.6 81.19,247.55 40.6,281.41 40.6,281.41 0,247.55 "
+       class="cls-4"
+       style="fill:#1f8ece"
+       transform="matrix(0.44696256,0,0,0.35766585,6.1519517,-65.132907)" />
+    <polygon
+       id="polygon4193"
+       points="0,242.65 40.6,276.5 81.19,242.65 0,242.65 "
+       class="cls-4"
+       style="fill:#1f8ece"
+       transform="matrix(0.44696256,0,0,0.35766585,6.1519517,-65.132907)" />
+    <path
+       id="path4195"
+       d="m 9.4684144,12.888323 v 7.353608 h 6.3200506 v -7.353608 c 0,-4.027318 3.81706,-7.3071137 8.492289,-7.3071137 4.675228,0 8.492289,3.2762188 8.492289,7.3071137 v 7.353608 h 6.32005 v -7.353608 c 0,-6.9101042 -6.646333,-12.51830551 -14.825748,-12.51830551 h 0 c -8.174945,0 -14.8257472,5.62250781 -14.8257472,12.51830551"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#3d3d3b" />
+    <polygon
+       transform="matrix(0.03995009,0,0,0.06006972,22.624966,15.642646)"
+       style="fill:#d65533;fill-opacity:1"
+       points="338.235,308.602 173.765,308.602 173.765,512 256.001,459.841 338.235,512 "
+       id="polygon3338" />
+    <polygon
+       transform="matrix(0.03995009,0,0,0.03995009,22.624966,21.851606)"
+       style="fill:#ff9070;fill-opacity:1"
+       points="415.425,92.01 408.732,143.13 440.064,184.064 408.732,224.999 415.425,276.119 367.779,295.844 348.053,343.49 296.935,336.796 256.001,368.129 215.065,336.796 163.945,343.488 144.221,295.843 96.575,276.119 103.268,224.999 71.936,184.064 103.268,143.13 96.575,92.01 144.221,72.285 163.946,24.639 215.065,31.333 256.001,0 296.935,31.333 348.055,24.639 367.779,72.286 "
+       id="polygon3340" />
+    <circle
+       transform="matrix(0.03995009,0,0,0.03995009,22.624966,21.851606)"
+       sodipodi:ry="112.206"
+       sodipodi:rx="112.206"
+       sodipodi:cy="184.06599"
+       sodipodi:cx="255.996"
+       style="fill:#d65533;fill-opacity:1"
+       cx="255.996"
+       cy="184.06599"
+       r="112.206"
+       id="circle3342" />
+  </g>
+</svg>
diff --git a/src/icons/sign.svg b/src/icons/sign.svg
new file mode 100644
index 0000000..35433fd
--- /dev/null
+++ b/src/icons/sign.svg
@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg4223"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/sign-20.png"
+   inkscape:export-xdpi="37.5"
+   inkscape:export-ydpi="37.5"
+   sodipodi:docname="New document 23">
+  <defs
+     id="defs4225" />
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="7"
+     inkscape:cx="24"
+     inkscape:cy="24"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1003"
+     inkscape:window-x="1918"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid4242" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata4228">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <polygon
+       transform="matrix(0.07831286,0,0,0.11775271,4.9522209,-11.798783)"
+       style="fill:#d65533;fill-opacity:1"
+       points="338.235,308.602 173.765,308.602 173.765,512 256.001,459.841 338.235,512 "
+       id="polygon3338" />
+    <polygon
+       transform="matrix(0.07831286,0,0,0.07831286,4.9522209,0.3724384)"
+       style="fill:#ff9070;fill-opacity:1"
+       points="163.945,343.488 144.221,295.843 96.575,276.119 103.268,224.999 71.936,184.064 103.268,143.13 96.575,92.01 144.221,72.285 163.946,24.639 215.065,31.333 256.001,0 296.935,31.333 348.055,24.639 367.779,72.286 415.425,92.01 408.732,143.13 440.064,184.064 408.732,224.999 415.425,276.119 367.779,295.844 348.053,343.49 296.935,336.796 256.001,368.129 215.065,336.796 "
+       id="polygon3340" />
+    <circle
+       transform="matrix(0.07831286,0,0,0.07831286,4.9522209,0.3724384)"
+       sodipodi:ry="112.206"
+       sodipodi:rx="112.206"
+       sodipodi:cy="184.06599"
+       sodipodi:cx="255.996"
+       style="fill:#d65533;fill-opacity:1"
+       cx="255.996"
+       cy="184.06599"
+       r="112.206"
+       id="circle3342" />
+  </g>
+</svg>

-----------------------------------------------------------------------

Summary of changes:
 forms/encr-s.ico          | Bin 2238 -> 2238 bytes
 forms/encr-s.xcf          | Bin 1588 -> 1412 bytes
 src/dialogs.h             |   3 ++
 src/dialogs.rc            |   4 +-
 src/gpgoladdin.cpp        | 130 ++++++++++++++++++++++++++++++++--------------
 src/icons/Makefile.am     |   4 +-
 src/icons/encrypt-20.png  | Bin 0 -> 554 bytes
 src/icons/encrypt.svg     |  77 +++++++++++++++++++++++++++
 src/icons/sign-20.png     | Bin 0 -> 604 bytes
 src/icons/sign-enc-40.png | Bin 0 -> 1303 bytes
 src/icons/sign-enc.svg    |  98 ++++++++++++++++++++++++++++++++++
 src/icons/sign.svg        |  84 ++++++++++++++++++++++++++++++
 src/ribbon-callbacks.cpp  |  16 ++++--
 src/ribbon-callbacks.h    |   4 ++
 14 files changed, 373 insertions(+), 47 deletions(-)
 create mode 100644 src/icons/encrypt-20.png
 create mode 100644 src/icons/encrypt.svg
 create mode 100644 src/icons/sign-20.png
 create mode 100644 src/icons/sign-enc-40.png
 create mode 100644 src/icons/sign-enc.svg
 create mode 100644 src/icons/sign.svg


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 15:26:01 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 09 Dec 2016 15:26:01 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-33-g618b897
Message-ID: <E1cFM7f-0007yu-FK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  618b8978f46f4011c11512fd5f30c15e01652e2e (commit)
      from  656395ba4cf34f42dda3a120bda3ed1220755a3d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 618b8978f46f4011c11512fd5f30c15e01652e2e
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 12:10:54 2016 +0100

    Improve handling of mlock error codes.
    
    * acinclude.m4 (GNUPG_CHECK_MLOCK): Check also for EAGAIN which is a
    legitimate return code and does not indicate a broken mlock().
    * src/secmem.c (lock_pool_pages): Test ERR instead of ERRNO which
    could have been overwritten by cap_from+text et al.
    --
    
      On FreeBSD, if there are not enough free pages, mlock() can return
      EAGAIN, as documented in mlock(2). That doesn't mean that mlock is
      broken. I suspect this same issue also exists on the other BSD's.
    
    Suggested-by: Ruben Kerkhof <ruben at rubenkerkhof.com>
    
    This is (now) also true for Linux.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/acinclude.m4 b/acinclude.m4
index 96be833..90b3cb9 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -242,7 +242,7 @@ int main()
     pool += (pgsize - ((long int)pool % pgsize));
 
     err = mlock( pool, 4096 );
-    if( !err || errno == EPERM )
+    if( !err || errno == EPERM || errno == EGAIN)
         return 0; /* okay */
 
     return 1;  /* hmmm */
diff --git a/src/secmem.c b/src/secmem.c
index 4fa267b..55424f2 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -282,15 +282,15 @@ lock_pool_pages (void *p, size_t n)
 
   if (err)
     {
-      if (errno != EPERM
-#ifdef EAGAIN	/* OpenBSD returns this */
-	  && errno != EAGAIN
+      if (err != EPERM
+#ifdef EAGAIN	/* BSD and also Linux may return EAGAIN */
+	  && err != EAGAIN
 #endif
 #ifdef ENOSYS	/* Some SCOs return this (function not implemented) */
-	  && errno != ENOSYS
+	  && err != ENOSYS
 #endif
 #ifdef ENOMEM  /* Linux might return this. */
-            && errno != ENOMEM
+            && err != ENOMEM
 #endif
 	  )
 	log_error ("can't lock memory: %s\n", strerror (err));
@@ -341,15 +341,15 @@ lock_pool_pages (void *p, size_t n)
 
   if (err)
     {
-      if (errno != EPERM
-#ifdef EAGAIN	/* OpenBSD returns this. */
-	  && errno != EAGAIN
+      if (err != EPERM
+#ifdef EAGAIN	/* BSD and also Linux may return this. */
+	  && err != EAGAIN
 #endif
 #ifdef ENOSYS	/* Some SCOs return this (function not implemented). */
-	  && errno != ENOSYS
+	  && err != ENOSYS
 #endif
 #ifdef ENOMEM  /* Linux might return this. */
-            && errno != ENOMEM
+            && err != ENOMEM
 #endif
 	  )
 	log_error ("can't lock memory: %s\n", strerror (err));

-----------------------------------------------------------------------

Summary of changes:
 acinclude.m4 |  2 +-
 src/secmem.c | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 15:58:09 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 09 Dec 2016 15:58:09 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.3-30-gacb7003
Message-ID: <E1cFMcl-0001J2-O5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  acb7003a9a6faf5d3c0e7961a6d36e351910bd97 (commit)
       via  a72ce0a1fbb3648d80696885d6a7e78b3029bebc (commit)
       via  d6f84f4fc59235795ae393d8fab0081eb5889120 (commit)
       via  008fd92917547981d3c4dc77fd1e8c242bf4a7ea (commit)
       via  c6b7041bbc11391b7c6b0bf649aa4979ad3d0b52 (commit)
       via  9678a9f3dcbd2944d62f12c63fa27a8fd72b1201 (commit)
       via  71612fd517468c9d25a7f65f081fb88f40904787 (commit)
      from  1f1ab84fd1dea3fee596d3223fe96b154b37aa6f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit acb7003a9a6faf5d3c0e7961a6d36e351910bd97
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 15:55:19 2016 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index c49c8c1..ecfa180 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.7.5 (unreleased)  [C21/A1/R_]
+------------------------------------------------
+
+
 Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
 ------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 5d0844d..267438a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,7 +30,7 @@ min_automake_version="1.14"
 # for the LT versions.
 m4_define(mym4_version_major, [1])
 m4_define(mym4_version_minor, [7])
-m4_define(mym4_version_micro, [4])
+m4_define(mym4_version_micro, [5])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit a72ce0a1fbb3648d80696885d6a7e78b3029bebc
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 15:41:34 2016 +0100

    Release 1.7.4.
    
    * configure.ac: Bump LT version to C21/A1/R4.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index cdf1ef4..c49c8c1 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,36 @@
-Noteworthy changes in version 1.7.4 (unreleased)  [C21/A1/R_]
+Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
 ------------------------------------------------
 
+ * Performance:
+
+   - More ARMv8/AArch32 improvements for AES, GCM, SHA-256, and SHA-1.
+
+   - Add ARMv8/AArch32 assembly implementation for Twofish and
+     Camellia.
+
+   - Add bulk processing implementation for ARMv8/AArch32.
+
+   - Add Stribog OIDs.
+
+   - Improve the DRBG performance and sync the code with the Linux
+     version.
+
+ * Internal changes:
+
+   - When secure memory is requested by the MPI functions or by
+     gcry_xmalloc_secure, they do not anymore lead to a fatal error if
+     the secure memory pool is used up.  Instead new pools are
+     allocated as needed.  These new pools are not protected against
+     being swapped out (mlock can't be used).  However, these days
+     this is considered a minor issue and can easily be mitigated by
+     using encrypted swap space.
+
+ * Bug fixes:
+
+   - Fix GOST 28147 CryptoPro-B S-box.
+
+   - Fix error code handling of mlock calls.
+
 
 Noteworthy changes in version 1.7.3 (2016-08-17)  [C21/A1/R3]
 ------------------------------------------------
diff --git a/configure.ac b/configure.ac
index 7bbf4bd..5d0844d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -56,7 +56,7 @@ AC_INIT([libgcrypt],[mym4_full_version],[http://bugs.gnupg.org])
 #   (No interfaces changed:                   REVISION++)
 LIBGCRYPT_LT_CURRENT=21
 LIBGCRYPT_LT_AGE=1
-LIBGCRYPT_LT_REVISION=3
+LIBGCRYPT_LT_REVISION=4
 
 
 # If the API is changed in an incompatible way: increment the next counter.

commit d6f84f4fc59235795ae393d8fab0081eb5889120
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 12:10:54 2016 +0100

    Improve handling of mlock error codes.
    
    * acinclude.m4 (GNUPG_CHECK_MLOCK): Check also for EAGAIN which is a
    legitimate return code and does not indicate a broken mlock().
    * src/secmem.c (lock_pool_pages): Test ERR instead of ERRNO which
    could have been overwritten by cap_from+text et al.
    --
    
      On FreeBSD, if there are not enough free pages, mlock() can return
      EAGAIN, as documented in mlock(2). That doesn't mean that mlock is
      broken. I suspect this same issue also exists on the other BSD's.
    
    Suggested-by: Ruben Kerkhof <ruben at rubenkerkhof.com>
    
    This is (now) also true for Linux.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/acinclude.m4 b/acinclude.m4
index 96be833..90b3cb9 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -242,7 +242,7 @@ int main()
     pool += (pgsize - ((long int)pool % pgsize));
 
     err = mlock( pool, 4096 );
-    if( !err || errno == EPERM )
+    if( !err || errno == EPERM || errno == EGAIN)
         return 0; /* okay */
 
     return 1;  /* hmmm */
diff --git a/src/secmem.c b/src/secmem.c
index 9f228f0..46bbf82 100644
--- a/src/secmem.c
+++ b/src/secmem.c
@@ -282,15 +282,15 @@ lock_pool_pages (void *p, size_t n)
 
   if (err)
     {
-      if (errno != EPERM
-#ifdef EAGAIN	/* OpenBSD returns this */
-	  && errno != EAGAIN
+      if (err != EPERM
+#ifdef EAGAIN	/* BSD and also Linux may return EAGAIN */
+	  && err != EAGAIN
 #endif
 #ifdef ENOSYS	/* Some SCOs return this (function not implemented) */
-	  && errno != ENOSYS
+	  && err != ENOSYS
 #endif
 #ifdef ENOMEM  /* Linux might return this. */
-            && errno != ENOMEM
+            && err != ENOMEM
 #endif
 	  )
 	log_error ("can't lock memory: %s\n", strerror (err));
@@ -341,15 +341,15 @@ lock_pool_pages (void *p, size_t n)
 
   if (err)
     {
-      if (errno != EPERM
-#ifdef EAGAIN	/* OpenBSD returns this. */
-	  && errno != EAGAIN
+      if (err != EPERM
+#ifdef EAGAIN	/* BSD and also Linux may return this. */
+	  && err != EAGAIN
 #endif
 #ifdef ENOSYS	/* Some SCOs return this (function not implemented). */
-	  && errno != ENOSYS
+	  && err != ENOSYS
 #endif
 #ifdef ENOMEM  /* Linux might return this. */
-            && errno != ENOMEM
+            && err != ENOMEM
 #endif
 	  )
 	log_error ("can't lock memory: %s\n", strerror (err));

commit 008fd92917547981d3c4dc77fd1e8c242bf4a7ea
Author: Stephan Mueller <smueller at chronox.de>
Date:   Sat Dec 3 19:18:01 2016 +0100

    random: Eliminate unneeded memcpy invocations in the DRBG.
    
    * random/random-drbg.c (drbg_hash): Remove arg 'outval' and return a
    pointer instead.
    (drbg_instantiate): Reduce size of scratchpad.
    (drbg_hmac_update): Avoid use of scratch buffers for the hash.
    (drbg_hmac_generate, drbg_hash_df): Ditto.
    (drbg_hash_process_addtl): Ditto.
    (drbg_hash_hashgen): Ditto.
    (drbg_hash_generate): Ditto.
    
    --
    The gcry_md_read returns a pointer to the hash which can be directly
    used instead of copying it into a scratch buffer. This eliminates a
    number of memcpy invocations for HMAC and Hash DRBG and reduces the
    memory footprint of the Hash DRBG by the block size of the used hash.
    
    The performance increase is between 1 and 3 MB/s depending on the output
    buffer size.
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChangeLog entries above written by -wk.

diff --git a/random/random-drbg.c b/random/random-drbg.c
index dc8e8f3..e2fe861 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -374,9 +374,7 @@ static gpg_err_code_t drbg_hmac_init (drbg_state_t drbg);
 static gpg_err_code_t drbg_hmac_setkey (drbg_state_t drbg,
 					const unsigned char *key);
 static void drbg_hash_fini (drbg_state_t drbg);
-static gpg_err_code_t drbg_hash (drbg_state_t drbg,
-                                 unsigned char *outval,
-                                 const drbg_string_t *buf);
+static byte *drbg_hash (drbg_state_t drbg, const drbg_string_t *buf);
 static gpg_err_code_t drbg_sym_init (drbg_state_t drbg);
 static void drbg_sym_fini (drbg_state_t drbg);
 static gpg_err_code_t drbg_sym_setkey (drbg_state_t drbg,
@@ -1042,24 +1040,21 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
   /* we execute two rounds of V/K massaging */
   for (i = 2; 0 < i; i--)
     {
+      byte *retval;
       /* first round uses 0x0, second 0x1 */
       unsigned char prefix = DRBG_PREFIX0;
       if (1 == i)
 	prefix = DRBG_PREFIX1;
       /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
       seed2.buf = &prefix;
-      ret = drbg_hash (drbg, drbg->C, &seed1);
-      if (ret)
-	return ret;
-
-      ret = drbg_hmac_setkey (drbg, drbg->C);
+      retval = drbg_hash (drbg, &seed1);
+      ret = drbg_hmac_setkey (drbg, retval);
       if (ret)
 	return ret;
 
       /* 10.1.2.2 step 2 and 5 -- HMAC for V */
-      ret = drbg_hash (drbg, drbg->V, &cipherin);
-      if (ret)
-	return ret;
+      retval = drbg_hash (drbg, &cipherin);
+      memcpy(drbg->V, retval, drbg_blocklen (drbg));
 
       /* 10.1.2.2 step 3 */
       if (!seed || 0 == seed->len)
@@ -1091,9 +1086,8 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
     {
       unsigned int outlen = 0;
       /* 10.1.2.5 step 4.1 */
-      ret = drbg_hash (drbg, drbg->V, &data);
-      if (ret)
-	return ret;
+      byte *retval = drbg_hash (drbg, &data);
+      memcpy(drbg->V, retval, drbg_blocklen (drbg));
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
 	drbg_blocklen (drbg) : (buflen - len);
 
@@ -1137,14 +1131,10 @@ drbg_hash_df (drbg_state_t drbg,
               unsigned char *outval, size_t outlen,
               drbg_string_t *entropy)
 {
-  gpg_err_code_t ret = 0;
   size_t len = 0;
   unsigned char input[5];
-  unsigned char *tmp = drbg->scratchpad + drbg_statelen (drbg);
   drbg_string_t data1;
 
-  memset (tmp, 0, drbg_blocklen (drbg));
-
   /* 10.4.1 step 3 */
   input[0] = 1;
   drbg_cpu_to_be32 ((outlen * 8), &input[1]);
@@ -1158,20 +1148,16 @@ drbg_hash_df (drbg_state_t drbg,
     {
       short blocklen = 0;
       /* 10.4.1 step 4.1 */
-      ret = drbg_hash (drbg, tmp, &data1);
-      if (ret)
-	goto out;
+      byte *retval = drbg_hash (drbg, &data1);
       /* 10.4.1 step 4.2 */
       input[0]++;
       blocklen = (drbg_blocklen (drbg) < (outlen - len)) ?
 	drbg_blocklen (drbg) : (outlen - len);
-      memcpy (outval + len, tmp, blocklen);
+      memcpy (outval + len, retval, blocklen);
       len += blocklen;
     }
 
- out:
-  memset (tmp, 0, drbg_blocklen (drbg));
-  return ret;
+  return 0;
 }
 
 /* update function for Hash DRBG as defined in 10.1.1.2 / 10.1.1.3 */
@@ -1227,13 +1213,10 @@ drbg_hash_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
 static gpg_err_code_t
 drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
 {
-  gpg_err_code_t ret = 0;
   drbg_string_t data1, data2;
   drbg_string_t *data3;
   unsigned char prefix = DRBG_PREFIX2;
-
-  /* this is value w as per documentation */
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
+  byte *retval;
 
   /* 10.1.1.4 step 2 */
   if (!addtl || 0 == addtl->len)
@@ -1247,37 +1230,25 @@ drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
   data2.next = data3;
   data3->next = NULL;
   /* 10.1.1.4 step 2a -- cipher invocation */
-  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
-  if (ret)
-    goto out;
+  retval = drbg_hash (drbg, &data1);
 
   /* 10.1.1.4 step 2b */
-  drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		drbg->scratchpad, drbg_blocklen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), retval, drbg_blocklen (drbg));
 
- out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
-  return ret;
+  return 0;
 }
 
 /*
  * Hashgen defined in 10.1.1.4
  */
 static gpg_err_code_t
-drbg_hash_hashgen (drbg_state_t drbg,
-                   unsigned char *buf, unsigned int buflen)
+drbg_hash_hashgen (drbg_state_t drbg, unsigned char *buf, unsigned int buflen)
 {
-  gpg_err_code_t ret = 0;
   unsigned int len = 0;
   unsigned char *src = drbg->scratchpad;
-  unsigned char *dst = drbg->scratchpad + drbg_statelen (drbg);
   drbg_string_t data;
   unsigned char prefix = DRBG_PREFIX1;
 
-  /* use the scratchpad as a lookaside buffer */
-  memset (src, 0, drbg_statelen (drbg));
-  memset (dst, 0, drbg_blocklen (drbg));
-
   /* 10.1.1.4 step hashgen 2 */
   memcpy (src, drbg->V, drbg_statelen (drbg));
 
@@ -1286,44 +1257,36 @@ drbg_hash_hashgen (drbg_state_t drbg,
     {
       unsigned int outlen = 0;
       /* 10.1.1.4 step hashgen 4.1 */
-      ret = drbg_hash (drbg, dst, &data);
-      if (ret)
-	goto out;
+      byte *retval = drbg_hash (drbg, &data);
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
 	drbg_blocklen (drbg) : (buflen - len);
       /* 10.1.1.4 step hashgen 4.2 */
-      memcpy (buf + len, dst, outlen);
+      memcpy (buf + len, retval, outlen);
       len += outlen;
       /* 10.1.1.4 hashgen step 4.3 */
       if (len < buflen)
 	drbg_add_buf (src, drbg_statelen (drbg), &prefix, 1);
     }
 
- out:
-  memset (drbg->scratchpad, 0,
-	  (drbg_statelen (drbg) + drbg_blocklen (drbg)));
-  return ret;
+  memset (drbg->scratchpad, 0, drbg_statelen (drbg));
+  return 0;
 }
 
 /* Generate function for Hash DRBG as defined in 10.1.1.4  */
 static gpg_err_code_t
-drbg_hash_generate (drbg_state_t drbg,
-			 unsigned char *buf, unsigned int buflen,
-			 drbg_string_t *addtl)
+drbg_hash_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
+		    drbg_string_t *addtl)
 {
-  gpg_err_code_t ret = 0;
+  gpg_err_code_t ret;
   unsigned char prefix = DRBG_PREFIX3;
   drbg_string_t data1, data2;
+  byte *retval;
   union
   {
     unsigned char req[8];
     u64 req_int;
   } u;
 
-  /*
-   * scratchpad usage: drbg_hash_process_addtl uses the scratchpad, but
-   * fully completes before returning. Thus, we can reuse the scratchpad
-   */
   /* 10.1.1.4 step 2 */
   ret = drbg_hash_process_addtl (drbg, addtl);
   if (ret)
@@ -1334,27 +1297,20 @@ drbg_hash_generate (drbg_state_t drbg,
   if (ret)
     return ret;
 
-  /* this is the value H as documented in 10.1.1.4 */
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   /* 10.1.1.4 step 4 */
   drbg_string_fill (&data1, &prefix, 1);
   drbg_string_fill (&data2, drbg->V, drbg_statelen (drbg));
   data1.next = &data2;
-  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
-  if (ret)
-    goto out;
+
+  /* this is the value H as documented in 10.1.1.4 */
+  retval = drbg_hash (drbg, &data1);
 
   /* 10.1.1.4 step 5 */
-  drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		     drbg->scratchpad, drbg_blocklen (drbg));
-  drbg_add_buf (drbg->V, drbg_statelen (drbg), drbg->C,
-		     drbg_statelen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), retval, drbg_blocklen (drbg));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), drbg->C, drbg_statelen (drbg));
   u.req_int = be_bswap64 (drbg->reseed_ctr);
-  drbg_add_buf (drbg->V, drbg_statelen (drbg), u.req,
-		     sizeof (u.req));
+  drbg_add_buf (drbg->V, drbg_statelen (drbg), u.req, sizeof (u.req));
 
- out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   return ret;
 }
 
@@ -1699,7 +1655,7 @@ drbg_instantiate (drbg_state_t drbg,
       drbg_blocklen (drbg) +	/* iv */
       drbg_statelen (drbg) + drbg_blocklen (drbg);	/* temp */
   else
-    sb_size = drbg_statelen (drbg) + drbg_blocklen (drbg);
+    sb_size = drbg_statelen (drbg);
 
   if (0 < sb_size)
     {
@@ -2626,8 +2582,8 @@ drbg_hash_fini (drbg_state_t drbg)
   _gcry_md_close (hd);
 }
 
-static gpg_err_code_t
-drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+static byte *
+drbg_hash (drbg_state_t drbg, const drbg_string_t *buf)
 {
   gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
 
@@ -2635,9 +2591,7 @@ drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
   for (; NULL != buf; buf = buf->next)
     _gcry_md_write (hd, buf->buf, buf->len);
   _gcry_md_final (hd);
-  memcpy (outval, _gcry_md_read (hd, drbg->core->backend_cipher),
-	  drbg_blocklen (drbg));
-  return 0;
+  return _gcry_md_read (hd, drbg->core->backend_cipher);
 }
 
 static void

commit c6b7041bbc11391b7c6b0bf649aa4979ad3d0b52
Author: Stephan Mueller <smueller at chronox.de>
Date:   Thu Dec 1 17:15:10 2016 +0100

    random: Add performance improvements for the DRBG.
    
    * random/random-drbg.c (struct drbg_state_ops_s): New function
    pointers 'crypto_init' and 'crypto-fini'.
    (struct drbg_state_s): New fields 'priv_data', 'ctr_handle', and
    'ctr_null'.
    (drbg_hash_init, drbg_hash_fini): New.
    (drbg_hmac_init, drbg_hmac_setkey): New.
    (drbg_sym_fini, drbg_sym_init, drbg_sym_setkey): New.
    (drbg_sym_ctr): New.
    (drbg_ctr_bcc): Set the key.
    (drbg_ctr_df): Ditto.
    (drbg_hmac_update): Ditto.
    (drbg_hmac_generate): Replace drgb_hmac by drbg_hash.
    (drbg_hash_df): Ditto.
    (drbg_hash_process_addtl): Ditto.
    (drbg_hash_hashgen): Ditto.
    (drbg_ctr_update): Rework.
    (drbg_ctr_generate): Rework.
    (drbg_ctr_ops): Init new functions pointers.
    (drbg_uninstantiate): Call fini function.
    (drbg_instantiate): Call init function.
    
    --
    The performance improvements can be categorized as follows:
    
    * Initialize the cipher handle of the backend ciphers once and re-use
      them for subsequent cipher invocations.
    
    * Limit the invocation of setkey to the cases when the key is newly
      created.
    
    * Use the AES CTR mode and rip out the counter maintenance in the DRBG
      code. This allows the use of accelerated CTR AES implementations. To
      use the CTR AES mode, a NULL buffer is created that is used as the
      "plaintext" to the CTR mode, because the DRBG CTR AES operation is the
      result of the encryption of the CTR (i.e. the NULL buffer makes the
      final XOR of the CTR AES mode a noop).
    
    The following timing measurements are made. The measurement do not use a
    precise timing operation and should rather serve as a general hint to
    the performance improvements.
    
     On a Broadwell i7 CPU:
    
    	block size	4096		1024		128		32		16
     aes256 old		28MB/s	27MB/s	19MB/s	11MB/s	6MB/s
     aes128 old		29MB/s	32MB/s	23MB/s	15MB/s	9MB/s
     sha256 old		48MB/s	48MB/s	33MB/s	16MB/s	8MB/s
     hmac sha256 old	15MB/s	15MB/s	10MB/s	5MB/s	2MB/s
    
     aes256 new		180MB/s	169MB/s	93MB/s	37MB/s	20MB/s
     aes128 new		240MB/s	221MB/s	125MB/s	51MB/s	27MB/s
     sha256 new		75MB/s	69MB/s	48MB/s	23MB/s	11MB/s
     hmac sha256 new	37MB/s	34MB/s	21MB/s	8MB/s	4MB/s
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChnageLog entries above written by -wk

diff --git a/random/random-drbg.c b/random/random-drbg.c
index 9676f0e..dc8e8f3 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -289,6 +289,8 @@ struct drbg_state_ops_s
   gpg_err_code_t (*generate) (drbg_state_t drbg,
 			      unsigned char *buf, unsigned int buflen,
 			      drbg_string_t *addtl);
+  gpg_err_code_t (*crypto_init) (drbg_state_t drbg);
+  void		 (*crypto_fini) (drbg_state_t drbg);
 };
 
 struct drbg_test_data_s
@@ -309,6 +311,10 @@ struct drbg_state_s
 				 * 10.1.1.1 1c) */
   unsigned char *scratchpad;	/* some memory the DRBG can use for its
 				 * operation -- allocated during init */
+  void *priv_data;		/* Cipher handle */
+  gcry_cipher_hd_t ctr_handle;	/* CTR mode cipher handle */
+#define DRBG_CTR_NULL_LEN 128
+  unsigned char *ctr_null;	/* CTR mode zero buffer */
   int seeded:1;			/* DRBG fully seeded? */
   int pr:1;			/* Prediction resistance enabled? */
   /* Taken from libgcrypt ANSI X9.31 DRNG: We need to keep track of the
@@ -363,14 +369,23 @@ static const struct drbg_core_s drbg_cores[] = {
   {DRBG_CTRAES | DRBG_SYM256, 48, 16, GCRY_CIPHER_AES256}
 };
 
-static gpg_err_code_t drbg_sym (drbg_state_t drbg,
-                                const unsigned char *key,
-                                unsigned char *outval,
-                                const drbg_string_t *buf);
-static gpg_err_code_t drbg_hmac (drbg_state_t drbg,
-                                 const unsigned char *key,
+static gpg_err_code_t drbg_hash_init (drbg_state_t drbg);
+static gpg_err_code_t drbg_hmac_init (drbg_state_t drbg);
+static gpg_err_code_t drbg_hmac_setkey (drbg_state_t drbg,
+					const unsigned char *key);
+static void drbg_hash_fini (drbg_state_t drbg);
+static gpg_err_code_t drbg_hash (drbg_state_t drbg,
                                  unsigned char *outval,
                                  const drbg_string_t *buf);
+static gpg_err_code_t drbg_sym_init (drbg_state_t drbg);
+static void drbg_sym_fini (drbg_state_t drbg);
+static gpg_err_code_t drbg_sym_setkey (drbg_state_t drbg,
+				       const unsigned char *key);
+static gpg_err_code_t drbg_sym (drbg_state_t drbg, unsigned char *outval,
+				const drbg_string_t *buf);
+static gpg_err_code_t drbg_sym_ctr (drbg_state_t drbg,
+			const unsigned char *inbuf, unsigned int inbuflen,
+			unsigned char *outbuf, unsigned int outbuflen);
 
 /******************************************************************
  ******************************************************************
@@ -666,6 +681,10 @@ drbg_ctr_bcc (drbg_state_t drbg,
   /* 10.4.3 step 1 */
   memset (out, 0, drbg_blocklen (drbg));
 
+  ret = drbg_sym_setkey(drbg, key);
+  if (ret)
+    return ret;
+
   /* 10.4.3 step 2 / 4 */
   while (inpos)
     {
@@ -698,7 +717,7 @@ drbg_ctr_bcc (drbg_state_t drbg,
 	    }
 	}
       /* 10.4.3 step 4.2 */
-      ret = drbg_sym (drbg, key, out, &data);
+      ret = drbg_sym (drbg, out, &data);
       if (ret)
 	return ret;
       /* 10.4.3 step 2 */
@@ -839,6 +858,9 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
   /* 10.4.2 step 12: overwriting of outval */
 
   /* 10.4.2 step 13 */
+  ret = drbg_sym_setkey(drbg, temp);
+  if (ret)
+    goto out;
   while (generated_len < bytes_to_return)
     {
       short blocklen = 0;
@@ -846,11 +868,10 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
       /* the truncation of the key length is implicit as the key
        * is only drbg_blocklen in size -- check for the implementation
        * of the cipher function callback */
-      ret = drbg_sym (drbg, temp, X, &cipherin);
+      ret = drbg_sym (drbg, X, &cipherin);
       if (ret)
 	goto out;
-      blocklen = (drbg_blocklen (drbg) <
-		  (bytes_to_return - generated_len)) ?
+      blocklen = (drbg_blocklen (drbg) < (bytes_to_return - generated_len)) ?
 	drbg_blocklen (drbg) : (bytes_to_return - generated_len);
       /* 10.4.2 step 13.2 and 14 */
       memcpy (df_data + generated_len, X, blocklen);
@@ -889,54 +910,51 @@ drbg_ctr_update (drbg_state_t drbg, drbg_string_t *addtl, int reseed)
   unsigned char *temp = drbg->scratchpad;
   unsigned char *df_data = drbg->scratchpad +
     drbg_statelen (drbg) + drbg_blocklen (drbg);
-  unsigned char *temp_p, *df_data_p;	/* pointer to iterate over buffers */
-  unsigned int len = 0;
-  drbg_string_t cipherin;
   unsigned char prefix = DRBG_PREFIX1;
 
   memset (temp, 0, drbg_statelen (drbg) + drbg_blocklen (drbg));
   if (3 > reseed)
     memset (df_data, 0, drbg_statelen (drbg));
 
-  /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
-  if (addtl && 0 < addtl->len)
+  if (!reseed)
     {
-      ret =
-	drbg_ctr_df (drbg, df_data, drbg_statelen (drbg), addtl);
+      /*
+       * The DRBG uses the CTR mode of the underlying AES cipher. The
+       * CTR mode increments the counter value after the AES operation
+       * but SP800-90A requires that the counter is incremented before
+       * the AES operation. Hence, we increment it at the time we set
+       * it by one.
+       */
+      drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
+
+      ret = _gcry_cipher_setkey (drbg->ctr_handle, drbg->C, drbg_keylen (drbg));
       if (ret)
-	goto out;
+        goto out;
     }
 
-  drbg_string_fill (&cipherin, drbg->V, drbg_blocklen (drbg));
-  /* 10.2.1.3.2 step 2 and 3 -- are already covered as we memset(0)
-   * all memory during initialization */
-  while (len < (drbg_statelen (drbg)))
+  /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
+  if (addtl && 0 < addtl->len)
     {
-      /* 10.2.1.2 step 2.1 */
-      drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-      /* 10.2.1.2 step 2.2 */
-      /* using target of temp + len: 10.2.1.2 step 2.3 and 3 */
-      ret = drbg_sym (drbg, drbg->C, temp + len, &cipherin);
+      ret =
+	drbg_ctr_df (drbg, df_data, drbg_statelen (drbg), addtl);
       if (ret)
 	goto out;
-      /* 10.2.1.2 step 2.3 and 3 */
-      len += drbg_blocklen (drbg);
     }
 
-  /* 10.2.1.2 step 4 */
-  temp_p = temp;
-  df_data_p = df_data;
-  for (len = 0; len < drbg_statelen (drbg); len++)
-    {
-      *temp_p ^= *df_data_p;
-      df_data_p++;
-      temp_p++;
-    }
+  ret = drbg_sym_ctr (drbg, df_data, drbg_statelen(drbg),
+		      temp, drbg_statelen(drbg));
+  if (ret)
+    goto out;
 
   /* 10.2.1.2 step 5 */
-  memcpy (drbg->C, temp, drbg_keylen (drbg));
+  ret = _gcry_cipher_setkey (drbg->ctr_handle, temp, drbg_keylen (drbg));
+  if (ret)
+    goto out;
+
   /* 10.2.1.2 step 6 */
   memcpy (drbg->V, temp + drbg_keylen (drbg), drbg_blocklen (drbg));
+  /* See above: increment counter by one to compensate timing of CTR op */
+  drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
   ret = 0;
 
  out:
@@ -957,9 +975,6 @@ drbg_ctr_generate (drbg_state_t drbg,
                    drbg_string_t *addtl)
 {
   gpg_err_code_t ret = 0;
-  unsigned int len = 0;
-  drbg_string_t data;
-  unsigned char prefix = DRBG_PREFIX1;
 
   memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
 
@@ -973,24 +988,9 @@ drbg_ctr_generate (drbg_state_t drbg,
     }
 
   /* 10.2.1.5.2 step 4.1 */
-  drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-  drbg_string_fill (&data, drbg->V, drbg_blocklen (drbg));
-  while (len < buflen)
-    {
-      unsigned int outlen = 0;
-      /* 10.2.1.5.2 step 4.2 */
-      ret = drbg_sym (drbg, drbg->C, drbg->scratchpad, &data);
-      if (ret)
-	goto out;
-      outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
-	drbg_blocklen (drbg) : (buflen - len);
-      /* 10.2.1.5.2 step 4.3 */
-      memcpy (buf + len, drbg->scratchpad, outlen);
-      len += outlen;
-      /* 10.2.1.5.2 step 6 */
-      if (len < buflen)
-	drbg_add_buf (drbg->V, drbg_blocklen (drbg), &prefix, 1);
-    }
+  ret = drbg_sym_ctr (drbg, drbg->ctr_null, DRBG_CTR_NULL_LEN, buf, buflen);
+  if (ret)
+    goto out;
 
   /* 10.2.1.5.2 step 6 */
   if (addtl)
@@ -998,13 +998,14 @@ drbg_ctr_generate (drbg_state_t drbg,
   ret = drbg_ctr_update (drbg, addtl, 3);
 
  out:
-  memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
   return ret;
 }
 
 static struct drbg_state_ops_s drbg_ctr_ops = {
   drbg_ctr_update,
-  drbg_ctr_generate
+  drbg_ctr_generate,
+  drbg_sym_init,
+  drbg_sym_fini,
 };
 
 /******************************************************************
@@ -1023,6 +1024,9 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
       /* 10.1.2.3 step 2 already implicitly covered with
        * the initial memset(0) of drbg->C */
       memset (drbg->V, 1, drbg_statelen (drbg));
+      ret = drbg_hmac_setkey (drbg, drbg->C);
+      if (ret)
+	return ret;
     }
 
   /* build linked list which implements the concatenation and fill
@@ -1044,12 +1048,16 @@ drbg_hmac_update (drbg_state_t drbg, drbg_string_t *seed, int reseed)
 	prefix = DRBG_PREFIX1;
       /* 10.1.2.2 step 1 and 4 -- concatenation and HMAC for key */
       seed2.buf = &prefix;
-      ret = drbg_hmac (drbg, drbg->C, drbg->C, &seed1);
+      ret = drbg_hash (drbg, drbg->C, &seed1);
+      if (ret)
+	return ret;
+
+      ret = drbg_hmac_setkey (drbg, drbg->C);
       if (ret)
 	return ret;
 
       /* 10.1.2.2 step 2 and 5 -- HMAC for V */
-      ret = drbg_hmac (drbg, drbg->C, drbg->V, &cipherin);
+      ret = drbg_hash (drbg, drbg->V, &cipherin);
       if (ret)
 	return ret;
 
@@ -1083,7 +1091,7 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
     {
       unsigned int outlen = 0;
       /* 10.1.2.5 step 4.1 */
-      ret = drbg_hmac (drbg, drbg->C, drbg->V, &data);
+      ret = drbg_hash (drbg, drbg->V, &data);
       if (ret)
 	return ret;
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
@@ -1104,7 +1112,9 @@ drbg_hmac_generate (drbg_state_t drbg, unsigned char *buf, unsigned int buflen,
 
 static struct drbg_state_ops_s drbg_hmac_ops = {
   drbg_hmac_update,
-  drbg_hmac_generate
+  drbg_hmac_generate,
+  drbg_hmac_init,
+  drbg_hash_fini,
 };
 
 /******************************************************************
@@ -1148,7 +1158,7 @@ drbg_hash_df (drbg_state_t drbg,
     {
       short blocklen = 0;
       /* 10.4.1 step 4.1 */
-      ret = drbg_hmac (drbg, NULL, tmp, &data1);
+      ret = drbg_hash (drbg, tmp, &data1);
       if (ret)
 	goto out;
       /* 10.4.1 step 4.2 */
@@ -1237,13 +1247,13 @@ drbg_hash_process_addtl (drbg_state_t drbg, drbg_string_t *addtl)
   data2.next = data3;
   data3->next = NULL;
   /* 10.1.1.4 step 2a -- cipher invocation */
-  ret = drbg_hmac (drbg, NULL, drbg->scratchpad, &data1);
+  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
   if (ret)
     goto out;
 
   /* 10.1.1.4 step 2b */
   drbg_add_buf (drbg->V, drbg_statelen (drbg),
-		     drbg->scratchpad, drbg_blocklen (drbg));
+		drbg->scratchpad, drbg_blocklen (drbg));
 
  out:
   memset (drbg->scratchpad, 0, drbg_blocklen (drbg));
@@ -1276,7 +1286,7 @@ drbg_hash_hashgen (drbg_state_t drbg,
     {
       unsigned int outlen = 0;
       /* 10.1.1.4 step hashgen 4.1 */
-      ret = drbg_hmac (drbg, NULL, dst, &data);
+      ret = drbg_hash (drbg, dst, &data);
       if (ret)
 	goto out;
       outlen = (drbg_blocklen (drbg) < (buflen - len)) ?
@@ -1330,7 +1340,7 @@ drbg_hash_generate (drbg_state_t drbg,
   drbg_string_fill (&data1, &prefix, 1);
   drbg_string_fill (&data2, drbg->V, drbg_statelen (drbg));
   data1.next = &data2;
-  ret = drbg_hmac (drbg, NULL, drbg->scratchpad, &data1);
+  ret = drbg_hash (drbg, drbg->scratchpad, &data1);
   if (ret)
     goto out;
 
@@ -1354,7 +1364,9 @@ drbg_hash_generate (drbg_state_t drbg,
  */
 static struct drbg_state_ops_s drbg_hash_ops = {
   drbg_hash_update,
-  drbg_hash_generate
+  drbg_hash_generate,
+  drbg_hash_init,
+  drbg_hash_fini,
 };
 
 /******************************************************************
@@ -1599,6 +1611,7 @@ drbg_uninstantiate (drbg_state_t drbg)
 {
   if (!drbg)
     return GPG_ERR_INV_ARG;
+  drbg->d_ops->crypto_fini(drbg);
   xfree (drbg->V);
   drbg->V = NULL;
   xfree (drbg->C);
@@ -1666,13 +1679,16 @@ drbg_instantiate (drbg_state_t drbg,
 
   /* 9.1 step 4 is implicit in  drbg_sec_strength */
 
-  /* no allocation of drbg as this is done by the kernel crypto API */
+  ret = drbg->d_ops->crypto_init(drbg);
+  if (ret)
+    goto err;
+
   drbg->V = xcalloc_secure (1, drbg_statelen (drbg));
   if (!drbg->V)
-    goto err;
+    goto fini;
   drbg->C = xcalloc_secure (1, drbg_statelen (drbg));
   if (!drbg->C)
-    goto err;
+    goto fini;
   /* scratchpad is only generated for CTR and Hash */
   if (drbg->core->flags & DRBG_HMAC)
     sb_size = 0;
@@ -1689,19 +1705,21 @@ drbg_instantiate (drbg_state_t drbg,
     {
       drbg->scratchpad = xcalloc_secure (1, sb_size);
       if (!drbg->scratchpad)
-	goto err;
+	goto fini;
     }
   dbg (("DRBG: state allocated with scratchpad size %u bytes\n", sb_size));
 
   /* 9.1 step 6 through 11 */
   ret = drbg_seed (drbg, pers, 0);
   if (ret)
-    goto err;
+    goto fini;
 
   dbg (("DRBG: core %d %s prediction resistance successfully initialized\n",
 	coreref, pr ? "with" : "without"));
   return 0;
 
+ fini:
+  drbg->d_ops->crypto_fini(drbg);
  err:
   drbg_uninstantiate (drbg);
   return ret;
@@ -2563,59 +2581,160 @@ _gcry_rngdrbg_selftest (selftest_report_func_t report)
  ***************************************************************/
 
 static gpg_err_code_t
-drbg_hmac (drbg_state_t drbg, const unsigned char *key,
-		unsigned char *outval, const drbg_string_t *buf)
+drbg_hash_init (drbg_state_t drbg)
 {
+  gcry_md_hd_t hd;
   gpg_error_t err;
+
+  err = _gcry_md_open (&hd, drbg->core->backend_cipher, 0);
+  if (err)
+    return err;
+
+  drbg->priv_data = hd;
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_hmac_init (drbg_state_t drbg)
+{
   gcry_md_hd_t hd;
+  gpg_error_t err;
 
-  if (key)
-    {
-      err =
-	_gcry_md_open (&hd, drbg->core->backend_cipher, GCRY_MD_FLAG_HMAC);
-      if (err)
-	return err;
-      err = _gcry_md_setkey (hd, key, drbg_statelen (drbg));
-      if (err)
-	return err;
-    }
-  else
-    {
-      err = _gcry_md_open (&hd, drbg->core->backend_cipher, 0);
-      if (err)
-	return err;
-    }
+  err = _gcry_md_open (&hd, drbg->core->backend_cipher, GCRY_MD_FLAG_HMAC);
+  if (err)
+    return err;
+
+  drbg->priv_data = hd;
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_hmac_setkey (drbg_state_t drbg, const unsigned char *key)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  return _gcry_md_setkey (hd, key, drbg_statelen (drbg));
+}
+
+static void
+drbg_hash_fini (drbg_state_t drbg)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  _gcry_md_close (hd);
+}
+
+static gpg_err_code_t
+drbg_hash (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+{
+  gcry_md_hd_t hd = (gcry_md_hd_t)drbg->priv_data;
+
+  _gcry_md_reset(hd);
   for (; NULL != buf; buf = buf->next)
     _gcry_md_write (hd, buf->buf, buf->len);
   _gcry_md_final (hd);
   memcpy (outval, _gcry_md_read (hd, drbg->core->backend_cipher),
 	  drbg_blocklen (drbg));
-  _gcry_md_close (hd);
   return 0;
 }
 
+static void
+drbg_sym_fini (drbg_state_t drbg)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  if (hd)
+    _gcry_cipher_close (hd);
+  if (drbg->ctr_handle)
+    _gcry_cipher_close (drbg->ctr_handle);
+  if (drbg->ctr_null)
+    free(drbg->ctr_null);
+}
+
 static gpg_err_code_t
-drbg_sym (drbg_state_t drbg, const unsigned char *key,
-          unsigned char *outval, const drbg_string_t *buf)
+drbg_sym_init (drbg_state_t drbg)
 {
-  gpg_error_t err;
   gcry_cipher_hd_t hd;
+  gpg_error_t err;
+
+  drbg->ctr_null = calloc(1, DRBG_CTR_NULL_LEN);
+  if (!drbg->ctr_null)
+    return GPG_ERR_ENOMEM;
 
   err = _gcry_cipher_open (&hd, drbg->core->backend_cipher,
-                           GCRY_CIPHER_MODE_ECB, 0);
+			   GCRY_CIPHER_MODE_ECB, 0);
   if (err)
-    return err;
+    {
+      drbg_sym_fini (drbg);
+      return err;
+    }
+  drbg->priv_data = hd;
+
+  err = _gcry_cipher_open (&drbg->ctr_handle, drbg->core->backend_cipher,
+			   GCRY_CIPHER_MODE_CTR, 0);
+  if (err)
+    {
+      drbg_sym_fini (drbg);
+      return err;
+    }
+
+
   if (drbg_blocklen (drbg) !=
       _gcry_cipher_get_algo_blklen (drbg->core->backend_cipher))
-    return -GPG_ERR_NO_ERROR;
+    {
+      drbg_sym_fini (drbg);
+      return -GPG_ERR_NO_ERROR;
+    }
+
+  return 0;
+}
+
+static gpg_err_code_t
+drbg_sym_setkey (drbg_state_t drbg, const unsigned char *key)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  return _gcry_cipher_setkey (hd, key, drbg_keylen (drbg));
+}
+
+static gpg_err_code_t
+drbg_sym (drbg_state_t drbg, unsigned char *outval, const drbg_string_t *buf)
+{
+  gcry_cipher_hd_t hd = (gcry_cipher_hd_t)drbg->priv_data;
+
+  _gcry_cipher_reset(hd);
   if (drbg_blocklen (drbg) < buf->len)
     return -GPG_ERR_NO_ERROR;
-  err = _gcry_cipher_setkey (hd, key, drbg_keylen (drbg));
+  /* in is only component */
+  return _gcry_cipher_encrypt (hd, outval, drbg_blocklen (drbg), buf->buf,
+			       buf->len);
+}
+
+static gpg_err_code_t
+drbg_sym_ctr (drbg_state_t drbg,
+	      const unsigned char *inbuf, unsigned int inbuflen,
+	      unsigned char *outbuf, unsigned int outbuflen)
+{
+  gpg_error_t err;
+
+  _gcry_cipher_reset(drbg->ctr_handle);
+  err = _gcry_cipher_setctr(drbg->ctr_handle, drbg->V, drbg_blocklen (drbg));
   if (err)
     return err;
-  /* in is only component */
-  _gcry_cipher_encrypt (hd, outval, drbg_blocklen (drbg), buf->buf,
-			buf->len);
-  _gcry_cipher_close (hd);
-  return 0;
+
+  while (outbuflen)
+    {
+       unsigned int cryptlen = (inbuflen > outbuflen) ? outbuflen : inbuflen;
+
+       err = _gcry_cipher_encrypt (drbg->ctr_handle, outbuf, cryptlen, inbuf,
+				   cryptlen);
+       if (err)
+         return err;
+
+       outbuflen -= cryptlen;
+       outbuf += cryptlen;
+    }
+  return _gcry_cipher_getctr(drbg->ctr_handle, drbg->V, drbg_blocklen (drbg));
 }

commit 9678a9f3dcbd2944d62f12c63fa27a8fd72b1201
Author: Stephan Mueller <smueller at chronox.de>
Date:   Thu Dec 1 17:11:42 2016 +0100

    cipher: New function for reading the counter in CTR mode
    
    * cipher/cipher.c (gcry_cipher_getctr): New.
    --
    The API call allows reading the current counter of the CTR mode. The API
    remains internal to libgcrypt and is not exported to external callers.
    
    Signed-off-by: Stephan Mueller <smueller at chronox.de>
    
    ChangeLog entry above added by -wk

diff --git a/cipher/cipher.c b/cipher/cipher.c
index ff3340f..55853da 100644
--- a/cipher/cipher.c
+++ b/cipher/cipher.c
@@ -1117,6 +1117,16 @@ _gcry_cipher_setctr (gcry_cipher_hd_t hd, const void *ctr, size_t ctrlen)
   return 0;
 }
 
+gpg_err_code_t
+_gcry_cipher_getctr (gcry_cipher_hd_t hd, void *ctr, size_t ctrlen)
+{
+  if (ctr && ctrlen == hd->spec->blocksize)
+    memcpy (ctr, hd->u_ctr.ctr, hd->spec->blocksize);
+  else
+    return GPG_ERR_INV_ARG;
+
+  return 0;
+}
 
 gcry_err_code_t
 _gcry_cipher_authenticate (gcry_cipher_hd_t hd, const void *abuf,
diff --git a/src/gcrypt-int.h b/src/gcrypt-int.h
index d367307..549605b 100644
--- a/src/gcrypt-int.h
+++ b/src/gcrypt-int.h
@@ -88,6 +88,8 @@ gpg_err_code_t _gcry_cipher_checktag (gcry_cipher_hd_t hd, const void *intag,
                                       size_t taglen);
 gpg_err_code_t _gcry_cipher_setctr (gcry_cipher_hd_t hd,
                                     const void *ctr, size_t ctrlen);
+gpg_err_code_t _gcry_cipher_getctr (gcry_cipher_hd_t hd,
+                                    void *ctr, size_t ctrlen);
 size_t _gcry_cipher_get_algo_keylen (int algo);
 size_t _gcry_cipher_get_algo_blklen (int algo);
 

commit 71612fd517468c9d25a7f65f081fb88f40904787
Author: Stephan Mueller <smueller at chronox.de>
Date:   Sun Nov 27 10:14:21 2016 +0100

    doc: Remove comment that is not applicable any more.
    
    --
    Signed-off-by: Stephan Mueller <smueller at chronox.de>

diff --git a/random/random-drbg.c b/random/random-drbg.c
index f9d11a3..9676f0e 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -899,8 +899,6 @@ drbg_ctr_update (drbg_state_t drbg, drbg_string_t *addtl, int reseed)
     memset (df_data, 0, drbg_statelen (drbg));
 
   /* 10.2.1.3.2 step 2 and 10.2.1.4.2 step 2 */
-  /* TODO use reseed variable to avoid re-doing DF operation */
-  (void) reseed;
   if (addtl && 0 < addtl->len)
     {
       ret =

-----------------------------------------------------------------------

Summary of changes:
 NEWS                 |  36 ++++-
 acinclude.m4         |   2 +-
 cipher/cipher.c      |  10 ++
 configure.ac         |   4 +-
 random/random-drbg.c | 421 ++++++++++++++++++++++++++++++---------------------
 src/gcrypt-int.h     |   2 +
 src/secmem.c         |  20 +--
 7 files changed, 306 insertions(+), 189 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 16:00:19 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 09 Dec 2016 16:00:19 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-34-ge232c12
Message-ID: <E1cFMer-0001O3-5F@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  e232c12efac539b2fd2a4472259693b4364a349e (commit)
      from  618b8978f46f4011c11512fd5f30c15e01652e2e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e232c12efac539b2fd2a4472259693b4364a349e
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 15:57:33 2016 +0100

    Add release info from 1.7.4
    
    --

diff --git a/NEWS b/NEWS
index 722172a..146e208 100644
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,41 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
 
+
+Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
+------------------------------------------------
+
+ * Performance:
+
+   - More ARMv8/AArch32 improvements for AES, GCM, SHA-256, and SHA-1.
+
+   - Add ARMv8/AArch32 assembly implementation for Twofish and
+     Camellia.
+
+   - Add bulk processing implementation for ARMv8/AArch32.
+
+   - Add Stribog OIDs.
+
+   - Improve the DRBG performance and sync the code with the Linux
+     version.
+
+ * Internal changes:
+
+   - When secure memory is requested by the MPI functions or by
+     gcry_xmalloc_secure, they do not anymore lead to a fatal error if
+     the secure memory pool is used up.  Instead new pools are
+     allocated as needed.  These new pools are not protected against
+     being swapped out (mlock can't be used).  However, these days
+     this is considered a minor issue and can easily be mitigated by
+     using encrypted swap space.
+
+ * Bug fixes:
+
+   - Fix GOST 28147 CryptoPro-B S-box.
+
+   - Fix error code handling of mlock calls.
+
+
 Noteworthy changes in version 1.7.3 (2016-08-17)  [C21/A1/R3]
 ------------------------------------------------
 

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec  9 16:06:07 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 09 Dec 2016 16:06:07 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 66a6c274988eb35ebe3205a4a8e0185dbb6d5e10
Message-ID: <E1cFMkT-00025M-T7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  66a6c274988eb35ebe3205a4a8e0185dbb6d5e10 (commit)
      from  55eb257c40313f8fbaee6938d0c9f0eeb9ceef10 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66a6c274988eb35ebe3205a4a8e0185dbb6d5e10
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 9 16:03:30 2016 +0100

    swdb: Release Libgcrypt 1.7.4

diff --git a/web/swdb.mac b/web/swdb.mac
index 0b74259..1ff1b29 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -82,11 +82,11 @@
 #
 # LIBGCRYPT
 #
-#+macro: libgcrypt_ver  1.7.3
-#+macro: libgcrypt_date 2016-08-17
-#+macro: libgcrypt_size 2794k
-#+macro: libgcrypt_sha1 5a034291e7248592605db448481478e6c963aa9c
-#+macro: libgcrypt_sha2 ddac6111077d0a1612247587be238c5294dd0ee4d76dc7ba783cc55fb0337071
+#+macro: libgcrypt_ver  1.7.4
+#+macro: libgcrypt_date 2016-12-09
+#+macro: libgcrypt_size 2815k
+#+macro: libgcrypt_sha1 8b3f96f8cfd6791c228c3ba282c83860c83c8844
+#+macro: libgcrypt_sha2 3b67862e2f4711e25c4ce3cc4b48d52a58a3afdcd1d8c6a57f93a1c0ef03e5c6
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/swdb.mac | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Dec 10 12:13:48 2016
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Sat, 10 Dec 2016 12:13:48 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-40-gc83d0d2
Message-ID: <E1cFfbD-0005mP-GH@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  c83d0d2a26059cf471d09f5cb8e7fc5d76c4907b (commit)
       via  2b7b227b8a0bd5ff286258bc187782efac180a7e (commit)
       via  5c418e597f0f20a546d953161695e6caf1f57689 (commit)
       via  2d2e5286d53e1f62fe040dff4c6e01961f00afe2 (commit)
       via  161d339f48c03be7fd0f4249d730f7f1767ef8e4 (commit)
       via  0b03b658bebc69a84d87ef13f9b60a27b0c42305 (commit)
      from  e232c12efac539b2fd2a4472259693b4364a349e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c83d0d2a26059cf471d09f5cb8e7fc5d76c4907b
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    hwfeatures: add 'all' for disabling all hardware features
    
    * .gitignore: Add 'tests/basic-disable-all-hwf'.
    * configure.ac: Ditto.
    * tests/Makefile.am: Ditto.
    * src/hwfeatures.c (_gcry_disable_hw_feature): Match 'all' for
    masking all HW features off.
    (parse_hwf_deny_file): Use '_gcry_disable_hw_feature' for matching.
    * tests/basic-disable-all-hwf.in: New.
    --
    
    Also add new test to run 'basic' with all HWF disable. With current
    assembly implementations and build servers using new CPUs, generic
    implementations are not being tested enough anymore and compiler
    problems might end up unnoticed.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/.gitignore b/.gitignore
index 3cd83a2..5d481aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -73,6 +73,7 @@ tests/ac-data
 tests/ac-schemes
 tests/aeswrap
 tests/basic
+tests/basic-disable-all-hwf
 tests/bench-slope
 tests/benchmark
 tests/curves
diff --git a/configure.ac b/configure.ac
index 17ff407..91562a9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2555,6 +2555,7 @@ src/versioninfo.rc
 tests/Makefile
 ])
 AC_CONFIG_FILES([tests/hashtest-256g], [chmod +x tests/hashtest-256g])
+AC_CONFIG_FILES([tests/basic-disable-all-hwf], [chmod +x tests/basic-disable-all-hwf])
 AC_OUTPUT
 
 
diff --git a/src/hwfeatures.c b/src/hwfeatures.c
index 07221e8..99aba34 100644
--- a/src/hwfeatures.c
+++ b/src/hwfeatures.c
@@ -83,6 +83,12 @@ _gcry_disable_hw_feature (const char *name)
 {
   int i;
 
+  if (!strcmp(name, "all"))
+    {
+      disabled_hw_features = ~0;
+      return 0;
+    }
+
   for (i=0; i < DIM (hwflist); i++)
     if (!strcmp (hwflist[i].desc, name))
       {
@@ -159,15 +165,7 @@ parse_hwf_deny_file (void)
       if (!*p || *p == '#')
         continue;
 
-      for (i=0; i < DIM (hwflist); i++)
-        {
-          if (!strcmp (hwflist[i].desc, p))
-            {
-              disabled_hw_features |= hwflist[i].flag;
-              break;
-            }
-        }
-      if (i == DIM (hwflist))
+      if (_gcry_disable_hw_feature (p) == GPG_ERR_INV_NAME)
         {
 #ifdef HAVE_SYSLOG
           syslog (LOG_USER|LOG_WARNING,
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 374e72e..db51cbd 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -26,7 +26,7 @@ tests_bin = \
 
 tests_bin_last = benchmark bench-slope
 
-tests_sh =
+tests_sh = basic-disable-all-hwf
 
 tests_sh_last = hashtest-256g
 
@@ -58,7 +58,8 @@ noinst_HEADERS = t-common.h
 EXTRA_DIST = README rsa-16k.key cavs_tests.sh cavs_driver.pl \
 	     pkcs1v2-oaep.h pkcs1v2-pss.h pkcs1v2-v15c.h pkcs1v2-v15s.h \
 	     t-ed25519.inp stopwatch.h hashtest-256g.in \
-	     sha3-224.h sha3-256.h sha3-384.h sha3-512.h
+	     sha3-224.h sha3-256.h sha3-384.h sha3-512.h \
+	     basic-disable-all-hwf.in
 
 LDADD = $(standard_ldadd) $(GPG_ERROR_LIBS)
 t_lock_LDADD = $(standard_ldadd) $(GPG_ERROR_MT_LIBS)
diff --git a/tests/basic-disable-all-hwf.in b/tests/basic-disable-all-hwf.in
new file mode 100644
index 0000000..1f0a4de
--- /dev/null
+++ b/tests/basic-disable-all-hwf.in
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "      now running 'basic' test with all hardware features disabled."
+exec ./basic at EXEEXT@ --disable-hwf all

commit 2b7b227b8a0bd5ff286258bc187782efac180a7e
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    tests/hashtest-256g: add missing executable extension for Win32
    
    * tests/hashtest-256g.in: Add @EXEEXT at .
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/tests/hashtest-256g.in b/tests/hashtest-256g.in
index e897c54..92b1c1b 100755
--- a/tests/hashtest-256g.in
+++ b/tests/hashtest-256g.in
@@ -4,4 +4,4 @@ algos="SHA1 SHA256 SHA512"
 
 test "@RUN_LARGE_DATA_TESTS@" = yes || exit 77
 echo "      now running 256 GiB tests for $algos - this takes looong"
-exec ./hashtest --gigs 256 $algos
+exec ./hashtest at EXEEXT@ --gigs 256 $algos

commit 5c418e597f0f20a546d953161695e6caf1f57689
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    OCB ARM CE: Move ocb_get_l handling to assembly part
    
    * cipher/rijndael-armv8-aarch32-ce.S: Add OCB 'L_{ntz(i)}' calculation.
    * cipher/rijndael-armv8-aarch64-ce.S: Ditto.
    * cipher/rijndael-armv8-ce.c (_gcry_aes_ocb_enc_armv8_ce)
    (_gcry_aes_ocb_dec_armv8_ce, _gcry_aes_ocb_auth_armv8_ce)
    (ocb_cryt_fn_t): Updated arguments.
    (_gcry_aes_armv8_ce_ocb_crypt, _gcry_aes_armv8_ce_ocb_auth): Remove
    'ocb_get_l' handling and splitting input to 32 block chunks, instead
    pass full buffers to assembly.
    --
    
    Performance on Cortex-A53 (AArch32):
    
    Before:
     AES            |  nanosecs/byte   mebibytes/sec   cycles/byte
            OCB enc |      1.63 ns/B     583.8 MiB/s      1.88 c/B
            OCB dec |      1.67 ns/B     572.1 MiB/s      1.92 c/B
           OCB auth |      1.33 ns/B     717.1 MiB/s      1.53 c/B
    
    After (~12% faster):
     AES            |  nanosecs/byte   mebibytes/sec   cycles/byte
            OCB enc |      1.47 ns/B     650.2 MiB/s      1.69 c/B
            OCB dec |      1.48 ns/B     644.5 MiB/s      1.70 c/B
           OCB auth |      1.19 ns/B     798.2 MiB/s      1.38 c/B
    
    Performance on Cortex-A53 (AArch64):
    
    Before:
     AES            |  nanosecs/byte   mebibytes/sec   cycles/byte
            OCB enc |      1.29 ns/B     738.5 MiB/s      1.49 c/B
            OCB dec |      1.32 ns/B     723.5 MiB/s      1.52 c/B
           OCB auth |      1.15 ns/B     827.0 MiB/s      1.33 c/B
    
    After (~8% faster):
     AES            |  nanosecs/byte   mebibytes/sec   cycles/byte
            OCB enc |      1.21 ns/B     789.1 MiB/s      1.39 c/B
            OCB dec |      1.21 ns/B     789.2 MiB/s      1.39 c/B
           OCB auth |      1.10 ns/B     867.0 MiB/s      1.27 c/B
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/rijndael-armv8-aarch32-ce.S b/cipher/rijndael-armv8-aarch32-ce.S
index bf68f20..f375f67 100644
--- a/cipher/rijndael-armv8-aarch32-ce.S
+++ b/cipher/rijndael-armv8-aarch32-ce.S
@@ -1021,9 +1021,10 @@ _gcry_aes_ctr_enc_armv8_ce:
  *                                  const unsigned char *inbuf,
  *                                  unsigned char *offset,
  *                                  unsigned char *checksum,
- *                                  void **Ls,
+ *                                  unsigned char *L_table,
  *                                  size_t nblocks,
- *                                  unsigned int nrounds);
+ *                                  unsigned int nrounds,
+ *                                  unsigned int blkn);
  */
 
 .align 3
@@ -1039,6 +1040,7 @@ _gcry_aes_ocb_enc_armv8_ce:
    *    %st+4: Ls => r5
    *    %st+8: nblocks => r6  (0 < nblocks <= 32)
    *    %st+12: nrounds => r7
+   *    %st+16: blkn => lr
    */
 
   vpush {q4-q7}
@@ -1047,6 +1049,7 @@ _gcry_aes_ocb_enc_armv8_ce:
   ldr r4, [sp, #(104+0)]
   ldr r5, [sp, #(104+4)]
   ldr r6, [sp, #(104+8)]
+  ldr lr, [sp, #(104+16)]
 
   cmp r7, #12
   vld1.8 {q0}, [r3] /* load offset */
@@ -1059,6 +1062,7 @@ _gcry_aes_ocb_enc_armv8_ce:
 #define OCB_ENC(bits, ...) \
   .Locb_enc_entry_##bits: \
     cmp r6, #4; \
+    add lr, #1; \
     blo .Locb_enc_loop_##bits; \
     \
   .Locb_enc_loop4_##bits: \
@@ -1067,7 +1071,23 @@ _gcry_aes_ocb_enc_armv8_ce:
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */ \
     \
-    ldm r5!, {r8, r9, r10, r11}; \
+    add r9, lr, #1; \
+    add r10, lr, #2; \
+    add r11, lr, #3; \
+    rbit r8, lr; \
+    add lr, lr, #4; \
+    rbit r9, r9; \
+    rbit r10, r10; \
+    rbit r11, r11; \
+    clz r8, r8; /* ntz(i+0) */ \
+    clz r9, r9; /* ntz(i+1) */ \
+    clz r10, r10; /* ntz(i+2) */ \
+    clz r11, r11; /* ntz(i+3) */ \
+    add r8, r5, r8, lsl #4; \
+    add r9, r5, r9, lsl #4; \
+    add r10, r5, r10, lsl #4; \
+    add r11, r5, r11, lsl #4; \
+    \
     sub r6, #4; \
     \
     vld1.8 {q9}, [r8];     /* load L_{ntz(i+0)} */ \
@@ -1120,7 +1140,11 @@ _gcry_aes_ocb_enc_armv8_ce:
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */ \
     \
-    ldr r8, [r5], #4; \
+    rbit r8, lr; \
+    add lr, #1; \
+    clz r8, r8; /* ntz(i) */ \
+    add r8, r5, r8, lsl #4; \
+    \
     vld1.8 {q1}, [r2]!; /* load plaintext */ \
     vld1.8 {q2}, [r8]; /* load L_{ntz(i)} */ \
     vld1.8 {q3}, [r4]; /* load checksum */ \
@@ -1171,9 +1195,10 @@ _gcry_aes_ocb_enc_armv8_ce:
  *                                  const unsigned char *inbuf,
  *                                  unsigned char *offset,
  *                                  unsigned char *checksum,
- *                                  void **Ls,
+ *                                  unsigned char *L_table,
  *                                  size_t nblocks,
- *                                  unsigned int nrounds);
+ *                                  unsigned int nrounds,
+ *                                  unsigned int blkn);
  */
 
 .align 3
@@ -1189,6 +1214,7 @@ _gcry_aes_ocb_dec_armv8_ce:
    *    %st+4: Ls => r5
    *    %st+8: nblocks => r6  (0 < nblocks <= 32)
    *    %st+12: nrounds => r7
+   *    %st+16: blkn => lr
    */
 
   vpush {q4-q7}
@@ -1197,6 +1223,7 @@ _gcry_aes_ocb_dec_armv8_ce:
   ldr r4, [sp, #(104+0)]
   ldr r5, [sp, #(104+4)]
   ldr r6, [sp, #(104+8)]
+  ldr lr, [sp, #(104+16)]
 
   cmp r7, #12
   vld1.8 {q0}, [r3] /* load offset */
@@ -1209,6 +1236,7 @@ _gcry_aes_ocb_dec_armv8_ce:
 #define OCB_DEC(bits, ...) \
   .Locb_dec_entry_##bits: \
     cmp r6, #4; \
+    add lr, #1; \
     blo .Locb_dec_loop_##bits; \
     \
   .Locb_dec_loop4_##bits: \
@@ -1217,7 +1245,23 @@ _gcry_aes_ocb_dec_armv8_ce:
     /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */ \
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     \
-    ldm r5!, {r8, r9, r10, r11}; \
+    add r9, lr, #1; \
+    add r10, lr, #2; \
+    add r11, lr, #3; \
+    rbit r8, lr; \
+    add lr, lr, #4; \
+    rbit r9, r9; \
+    rbit r10, r10; \
+    rbit r11, r11; \
+    clz r8, r8; /* ntz(i+0) */ \
+    clz r9, r9; /* ntz(i+1) */ \
+    clz r10, r10; /* ntz(i+2) */ \
+    clz r11, r11; /* ntz(i+3) */ \
+    add r8, r5, r8, lsl #4; \
+    add r9, r5, r9, lsl #4; \
+    add r10, r5, r10, lsl #4; \
+    add r11, r5, r11, lsl #4; \
+    \
     sub r6, #4; \
     \
     vld1.8 {q9}, [r8];     /* load L_{ntz(i+0)} */ \
@@ -1270,7 +1314,11 @@ _gcry_aes_ocb_dec_armv8_ce:
     /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */ \
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     \
-    ldr r8, [r5], #4; \
+    rbit r8, lr; \
+    add lr, #1; \
+    clz r8, r8; /* ntz(i) */ \
+    add r8, r5, r8, lsl #4; \
+    \
     vld1.8 {q2}, [r8]; /* load L_{ntz(i)} */ \
     vld1.8 {q1}, [r2]!; /* load ciphertext */ \
     subs r6, #1; \
@@ -1320,9 +1368,10 @@ _gcry_aes_ocb_dec_armv8_ce:
  *                                   const unsigned char *abuf,
  *                                   unsigned char *offset,
  *                                   unsigned char *checksum,
- *                                   void **Ls,
+ *                                   unsigned char *L_table,
  *                                   size_t nblocks,
- *                                   unsigned int nrounds);
+ *                                   unsigned int nrounds,
+ *                                   unsigned int blkn);
  */
 
 .align 3
@@ -1337,6 +1386,7 @@ _gcry_aes_ocb_auth_armv8_ce:
    *    %st+0: Ls => r5
    *    %st+4: nblocks => r6  (0 < nblocks <= 32)
    *    %st+8: nrounds => r7
+   *    %st+12: blkn => lr
    */
 
   vpush {q4-q7}
@@ -1344,6 +1394,7 @@ _gcry_aes_ocb_auth_armv8_ce:
   ldr r7, [sp, #(104+8)]
   ldr r5, [sp, #(104+0)]
   ldr r6, [sp, #(104+4)]
+  ldr lr, [sp, #(104+12)]
 
   cmp r7, #12
   vld1.8 {q0}, [r2] /* load offset */
@@ -1356,6 +1407,7 @@ _gcry_aes_ocb_auth_armv8_ce:
 #define OCB_AUTH(bits, ...) \
   .Locb_auth_entry_##bits: \
     cmp r6, #4; \
+    add lr, #1; \
     blo .Locb_auth_loop_##bits; \
     \
   .Locb_auth_loop4_##bits: \
@@ -1363,7 +1415,23 @@ _gcry_aes_ocb_auth_armv8_ce:
     /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ \
     /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */ \
     \
-    ldm r5!, {r8, r9, r10, r11}; \
+    add r9, lr, #1; \
+    add r10, lr, #2; \
+    add r11, lr, #3; \
+    rbit r8, lr; \
+    add lr, lr, #4; \
+    rbit r9, r9; \
+    rbit r10, r10; \
+    rbit r11, r11; \
+    clz r8, r8; /* ntz(i+0) */ \
+    clz r9, r9; /* ntz(i+1) */ \
+    clz r10, r10; /* ntz(i+2) */ \
+    clz r11, r11; /* ntz(i+3) */ \
+    add r8, r5, r8, lsl #4; \
+    add r9, r5, r9, lsl #4; \
+    add r10, r5, r10, lsl #4; \
+    add r11, r5, r11, lsl #4; \
+    \
     sub r6, #4; \
     \
     vld1.8 {q9}, [r8];     /* load L_{ntz(i+0)} */ \
@@ -1401,8 +1469,12 @@ _gcry_aes_ocb_auth_armv8_ce:
     /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ \
     /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */ \
     \
-    ldr r8, [r5], #4; \
-    vld1.8 {q2}, [r8]; /* load L_{ntz(i)} */ \
+    rbit r8, lr; \
+    add lr, #1; \
+    clz r8, r8; /* ntz(i) */ \
+    add r8, r5, r8, lsl #4; \
+    \
+    vld1.8 {q2}, [r8];  /* load L_{ntz(i)} */ \
     vld1.8 {q1}, [r1]!; /* load aadtext */ \
     subs r6, #1; \
     veor q0, q0, q2; \
diff --git a/cipher/rijndael-armv8-aarch64-ce.S b/cipher/rijndael-armv8-aarch64-ce.S
index 21d0aec..1ebb363 100644
--- a/cipher/rijndael-armv8-aarch64-ce.S
+++ b/cipher/rijndael-armv8-aarch64-ce.S
@@ -28,23 +28,6 @@
 .text
 
 
-#if (SIZEOF_VOID_P == 4)
-  #define ptr8   w8
-  #define ptr9   w9
-  #define ptr10  w10
-  #define ptr11  w11
-  #define ptr_sz 4
-#elif (SIZEOF_VOID_P == 8)
-  #define ptr8   x8
-  #define ptr9   x9
-  #define ptr10  x10
-  #define ptr11  x11
-  #define ptr_sz 8
-#else
-  #error "missing SIZEOF_VOID_P"
-#endif
-
-
 #define GET_DATA_POINTER(reg, name) \
 	adrp    reg, :got:name ; \
 	ldr     reg, [reg, #:got_lo12:name] ;
@@ -855,9 +838,10 @@ _gcry_aes_cfb_dec_armv8_ce:
  *                                  const unsigned char *inbuf,
  *                                  unsigned char *offset,
  *                                  unsigned char *checksum,
- *                                  void **Ls,
+ *                                  unsigned char *L_table,
  *                                  size_t nblocks,
- *                                  unsigned int nrounds);
+ *                                  unsigned int nrounds,
+ *                                  unsigned int blkn);
  */
 
 .align 3
@@ -870,11 +854,13 @@ _gcry_aes_ocb_enc_armv8_ce:
    *    x2: inbuf
    *    x3: offset
    *    x4: checksum
-   *    x5: Ls
+   *    x5: Ltable
    *    x6: nblocks (0 < nblocks <= 32)
    *    w7: nrounds
+   *    %st+0: blkn => w12
    */
 
+  ldr w12, [sp]
   ld1 {v0.16b}, [x3] /* load offset */
   ld1 {v16.16b}, [x4] /* load checksum */
 
@@ -886,6 +872,7 @@ _gcry_aes_ocb_enc_armv8_ce:
 #define OCB_ENC(bits, ...) \
   .Locb_enc_entry_##bits: \
     cmp x6, #4; \
+    add x12, x12, #1; \
     b.lo .Locb_enc_loop_##bits; \
     \
   .Locb_enc_loop4_##bits: \
@@ -894,10 +881,24 @@ _gcry_aes_ocb_enc_armv8_ce:
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */ \
     \
-    ldp ptr8, ptr9, [x5], #(ptr_sz*2); \
+    add w9, w12, #1; \
+    add w10, w12, #2; \
+    add w11, w12, #3; \
+    rbit w8, w12; \
+    add w12, w12, #4; \
+    rbit w9, w9; \
+    rbit w10, w10; \
+    rbit w11, w11; \
+    clz w8, w8; /* ntz(i+0) */ \
+    clz w9, w9; /* ntz(i+1) */ \
+    clz w10, w10; /* ntz(i+2) */ \
+    clz w11, w11; /* ntz(i+3) */ \
+    add x8, x5, x8, lsl #4; \
+    ld1 {v1.16b-v4.16b}, [x2], #64;   /* load P_i+<0-3> */ \
+    add x9, x5, x9, lsl #4; \
+    add x10, x5, x10, lsl #4; \
+    add x11, x5, x11, lsl #4; \
     \
-    ld1 {v1.16b-v4.16b}, [x2], #64; /* load P_i+<0-3> */ \
-    ldp ptr10, ptr11, [x5], #(ptr_sz*2); \
     sub x6, x6, #4; \
     \
     ld1 {v5.16b}, [x8];               /* load L_{ntz(i+0)} */ \
@@ -940,7 +941,11 @@ _gcry_aes_ocb_enc_armv8_ce:
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */ \
     \
-    ldr ptr8, [x5], #(ptr_sz); \
+    rbit x8, x12; \
+    add x12, x12, #1; \
+    clz x8, x8; /* ntz(i) */ \
+    add x8, x5, x8, lsl #4; \
+    \
     ld1 {v1.16b}, [x2], #16; /* load plaintext */ \
     ld1 {v2.16b}, [x8]; /* load L_{ntz(i)} */ \
     sub x6, x6, #1; \
@@ -983,9 +988,10 @@ _gcry_aes_ocb_enc_armv8_ce:
  *                                  const unsigned char *inbuf,
  *                                  unsigned char *offset,
  *                                  unsigned char *checksum,
- *                                  void **Ls,
+ *                                  unsigned char *L_table,
  *                                  size_t nblocks,
- *                                  unsigned int nrounds);
+ *                                  unsigned int nrounds,
+ *                                  unsigned int blkn);
  */
 
 .align 3
@@ -998,11 +1004,13 @@ _gcry_aes_ocb_dec_armv8_ce:
    *    x2: inbuf
    *    x3: offset
    *    x4: checksum
-   *    x5: Ls
+   *    x5: Ltable
    *    x6: nblocks (0 < nblocks <= 32)
    *    w7: nrounds
+   *    %st+0: blkn => w12
    */
 
+  ldr w12, [sp]
   ld1 {v0.16b}, [x3] /* load offset */
   ld1 {v16.16b}, [x4] /* load checksum */
 
@@ -1014,6 +1022,7 @@ _gcry_aes_ocb_dec_armv8_ce:
 #define OCB_DEC(bits) \
   .Locb_dec_entry_##bits: \
     cmp x6, #4; \
+    add w12, w12, #1; \
     b.lo .Locb_dec_loop_##bits; \
     \
   .Locb_dec_loop4_##bits: \
@@ -1022,10 +1031,24 @@ _gcry_aes_ocb_dec_armv8_ce:
     /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */ \
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     \
-    ldp ptr8, ptr9, [x5], #(ptr_sz*2); \
+    add w9, w12, #1; \
+    add w10, w12, #2; \
+    add w11, w12, #3; \
+    rbit w8, w12; \
+    add w12, w12, #4; \
+    rbit w9, w9; \
+    rbit w10, w10; \
+    rbit w11, w11; \
+    clz w8, w8; /* ntz(i+0) */ \
+    clz w9, w9; /* ntz(i+1) */ \
+    clz w10, w10; /* ntz(i+2) */ \
+    clz w11, w11; /* ntz(i+3) */ \
+    add x8, x5, x8, lsl #4; \
+    ld1 {v1.16b-v4.16b}, [x2], #64;   /* load C_i+<0-3> */ \
+    add x9, x5, x9, lsl #4; \
+    add x10, x5, x10, lsl #4; \
+    add x11, x5, x11, lsl #4; \
     \
-    ld1 {v1.16b-v4.16b}, [x2], #64; /* load C_i+<0-3> */ \
-    ldp ptr10, ptr11, [x5], #(ptr_sz*2); \
     sub x6, x6, #4; \
     \
     ld1 {v5.16b}, [x8];               /* load L_{ntz(i+0)} */ \
@@ -1068,7 +1091,11 @@ _gcry_aes_ocb_dec_armv8_ce:
     /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */ \
     /* Checksum_i = Checksum_{i-1} xor P_i  */ \
     \
-    ldr ptr8, [x5], #(ptr_sz); \
+    rbit w8, w12; \
+    add w12, w12, #1; \
+    clz w8, w8; /* ntz(i) */ \
+    add x8, x5, x8, lsl #4; \
+    \
     ld1 {v1.16b}, [x2], #16; /* load ciphertext */ \
     ld1 {v2.16b}, [x8]; /* load L_{ntz(i)} */ \
     sub x6, x6, #1; \
@@ -1110,9 +1137,10 @@ _gcry_aes_ocb_dec_armv8_ce:
  *                                   const unsigned char *abuf,
  *                                   unsigned char *offset,
  *                                   unsigned char *checksum,
- *                                   void **Ls,
+ *                                   unsigned char *L_table,
  *                                   size_t nblocks,
- *                                   unsigned int nrounds);
+ *                                   unsigned int nrounds,
+ *                                   unsigned int blkn);
  */
 
 .align 3
@@ -1124,10 +1152,12 @@ _gcry_aes_ocb_auth_armv8_ce:
    *    x1: abuf
    *    x2: offset => x3
    *    x3: checksum => x4
-   *    x4: Ls => x5
+   *    x4: Ltable => x5
    *    x5: nblocks => x6  (0 < nblocks <= 32)
    *    w6: nrounds => w7
+   *    w7: blkn => w12
    */
+  mov x12, x7
   mov x7, x6
   mov x6, x5
   mov x5, x4
@@ -1145,6 +1175,7 @@ _gcry_aes_ocb_auth_armv8_ce:
 #define OCB_AUTH(bits) \
   .Locb_auth_entry_##bits: \
     cmp x6, #4; \
+    add w12, w12, #1; \
     b.lo .Locb_auth_loop_##bits; \
     \
   .Locb_auth_loop4_##bits: \
@@ -1152,10 +1183,24 @@ _gcry_aes_ocb_auth_armv8_ce:
     /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ \
     /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */ \
     \
-    ldp ptr8, ptr9, [x5], #(ptr_sz*2); \
+    add w9, w12, #1; \
+    add w10, w12, #2; \
+    add w11, w12, #3; \
+    rbit w8, w12; \
+    add w12, w12, #4; \
+    rbit w9, w9; \
+    rbit w10, w10; \
+    rbit w11, w11; \
+    clz w8, w8; /* ntz(i+0) */ \
+    clz w9, w9; /* ntz(i+1) */ \
+    clz w10, w10; /* ntz(i+2) */ \
+    clz w11, w11; /* ntz(i+3) */ \
+    add x8, x5, x8, lsl #4; \
+    ld1 {v1.16b-v4.16b}, [x1], #64;   /* load A_i+<0-3> */ \
+    add x9, x5, x9, lsl #4; \
+    add x10, x5, x10, lsl #4; \
+    add x11, x5, x11, lsl #4; \
     \
-    ld1 {v1.16b-v4.16b}, [x1], #64; /* load A_i+<0-3> */ \
-    ldp ptr10, ptr11, [x5], #(ptr_sz*2); \
     sub x6, x6, #4; \
     \
     ld1 {v5.16b}, [x8];               /* load L_{ntz(i+0)} */ \
@@ -1192,7 +1237,11 @@ _gcry_aes_ocb_auth_armv8_ce:
     /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */ \
     /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */ \
     \
-    ldr ptr8, [x5], #(ptr_sz); \
+    rbit w8, w12; \
+    add w12, w12, #1; \
+    clz w8, w8; /* ntz(i) */ \
+    add x8, x5, x8, lsl #4; \
+    \
     ld1 {v1.16b}, [x1], #16; /* load aadtext */ \
     ld1 {v2.16b}, [x8]; /* load L_{ntz(i)} */ \
     sub x6, x6, #1; \
diff --git a/cipher/rijndael-armv8-ce.c b/cipher/rijndael-armv8-ce.c
index 1bf74da..334cf68 100644
--- a/cipher/rijndael-armv8-ce.c
+++ b/cipher/rijndael-armv8-ce.c
@@ -80,30 +80,33 @@ extern void _gcry_aes_ocb_enc_armv8_ce (const void *keysched,
                                         const unsigned char *inbuf,
                                         unsigned char *offset,
                                         unsigned char *checksum,
-                                        void **Ls,
+                                        unsigned char *L_table,
                                         size_t nblocks,
-                                        unsigned int nrounds);
+                                        unsigned int nrounds,
+                                        unsigned int blkn);
 extern void _gcry_aes_ocb_dec_armv8_ce (const void *keysched,
                                         unsigned char *outbuf,
                                         const unsigned char *inbuf,
                                         unsigned char *offset,
                                         unsigned char *checksum,
-                                        void **Ls,
+                                        unsigned char *L_table,
                                         size_t nblocks,
-                                        unsigned int nrounds);
+                                        unsigned int nrounds,
+                                        unsigned int blkn);
 extern void _gcry_aes_ocb_auth_armv8_ce (const void *keysched,
                                          const unsigned char *abuf,
                                          unsigned char *offset,
                                          unsigned char *checksum,
-                                         void **Ls,
+                                         unsigned char *L_table,
                                          size_t nblocks,
-                                         unsigned int nrounds);
+                                         unsigned int nrounds,
+                                         unsigned int blkn);
 
 typedef void (*ocb_crypt_fn_t) (const void *keysched, unsigned char *outbuf,
                                 const unsigned char *inbuf,
                                 unsigned char *offset, unsigned char *checksum,
-                                void **Ls, size_t nblocks,
-                                unsigned int nrounds);
+                                unsigned char *L_table, size_t nblocks,
+                                unsigned int nrounds, unsigned int blkn);
 
 void
 _gcry_aes_armv8_ce_setkey (RIJNDAEL_context *ctx, const byte *key)
@@ -334,62 +337,11 @@ _gcry_aes_armv8_ce_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
   const unsigned char *inbuf = inbuf_arg;
   unsigned int nrounds = ctx->rounds;
   u64 blkn = c->u_mode.ocb.data_nblocks;
-  u64 blkn_offs = blkn - blkn % 32;
-  unsigned int n = 32 - blkn % 32;
-  void *Ls[32];
-  void **l;
-  size_t i;
 
   c->u_mode.ocb.data_nblocks = blkn + nblocks;
 
-  if (nblocks >= 32)
-    {
-      for (i = 0; i < 32; i += 8)
-        {
-          Ls[(i + 0 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 1 + n) % 32] = (void *)c->u_mode.ocb.L[1];
-          Ls[(i + 2 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 3 + n) % 32] = (void *)c->u_mode.ocb.L[2];
-          Ls[(i + 4 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 5 + n) % 32] = (void *)c->u_mode.ocb.L[1];
-          Ls[(i + 6 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-        }
-
-      Ls[(7 + n) % 32] = (void *)c->u_mode.ocb.L[3];
-      Ls[(15 + n) % 32] = (void *)c->u_mode.ocb.L[4];
-      Ls[(23 + n) % 32] = (void *)c->u_mode.ocb.L[3];
-      l = &Ls[(31 + n) % 32];
-
-      /* Process data in 32 block chunks. */
-      while (nblocks >= 32)
-        {
-          blkn_offs += 32;
-          *l = (void *)ocb_get_l(c, blkn_offs);
-
-          crypt_fn(keysched, outbuf, inbuf, c->u_iv.iv, c->u_ctr.ctr, Ls, 32,
-                    nrounds);
-
-          nblocks -= 32;
-          outbuf += 32 * 16;
-          inbuf  += 32 * 16;
-        }
-
-      if (nblocks && l < &Ls[nblocks])
-        {
-          *l = (void *)ocb_get_l(c, 32 + blkn_offs);
-        }
-    }
-  else
-    {
-      for (i = 0; i < nblocks; i++)
-        Ls[i] = (void *)ocb_get_l(c, ++blkn);
-    }
-
-  if (nblocks)
-    {
-      crypt_fn(keysched, outbuf, inbuf, c->u_iv.iv, c->u_ctr.ctr, Ls, nblocks,
-               nrounds);
-    }
+  crypt_fn(keysched, outbuf, inbuf, c->u_iv.iv, c->u_ctr.ctr,
+           c->u_mode.ocb.L[0], nblocks, nrounds, (unsigned int)blkn);
 }
 
 void
@@ -401,61 +353,12 @@ _gcry_aes_armv8_ce_ocb_auth (gcry_cipher_hd_t c, void *abuf_arg,
   const unsigned char *abuf = abuf_arg;
   unsigned int nrounds = ctx->rounds;
   u64 blkn = c->u_mode.ocb.aad_nblocks;
-  u64 blkn_offs = blkn - blkn % 32;
-  unsigned int n = 32 - blkn % 32;
-  void *Ls[32];
-  void **l;
-  size_t i;
 
   c->u_mode.ocb.aad_nblocks = blkn + nblocks;
 
-  if (nblocks >= 32)
-    {
-      for (i = 0; i < 32; i += 8)
-        {
-          Ls[(i + 0 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 1 + n) % 32] = (void *)c->u_mode.ocb.L[1];
-          Ls[(i + 2 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 3 + n) % 32] = (void *)c->u_mode.ocb.L[2];
-          Ls[(i + 4 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-          Ls[(i + 5 + n) % 32] = (void *)c->u_mode.ocb.L[1];
-          Ls[(i + 6 + n) % 32] = (void *)c->u_mode.ocb.L[0];
-        }
-
-      Ls[(7 + n) % 32] = (void *)c->u_mode.ocb.L[3];
-      Ls[(15 + n) % 32] = (void *)c->u_mode.ocb.L[4];
-      Ls[(23 + n) % 32] = (void *)c->u_mode.ocb.L[3];
-      l = &Ls[(31 + n) % 32];
-
-      /* Process data in 32 block chunks. */
-      while (nblocks >= 32)
-        {
-          blkn_offs += 32;
-          *l = (void *)ocb_get_l(c, blkn_offs);
-
-          _gcry_aes_ocb_auth_armv8_ce(keysched, abuf, c->u_mode.ocb.aad_offset,
-                                      c->u_mode.ocb.aad_sum, Ls, 32, nrounds);
-
-          nblocks -= 32;
-          abuf += 32 * 16;
-        }
-
-      if (nblocks && l < &Ls[nblocks])
-        {
-          *l = (void *)ocb_get_l(c, 32 + blkn_offs);
-        }
-    }
-  else
-    {
-      for (i = 0; i < nblocks; i++)
-        Ls[i] = (void *)ocb_get_l(c, ++blkn);
-    }
-
-  if (nblocks)
-    {
-      _gcry_aes_ocb_auth_armv8_ce(keysched, abuf, c->u_mode.ocb.aad_offset,
-                                  c->u_mode.ocb.aad_sum, Ls, nblocks, nrounds);
-    }
+  _gcry_aes_ocb_auth_armv8_ce(keysched, abuf, c->u_mode.ocb.aad_offset,
+			      c->u_mode.ocb.aad_sum, c->u_mode.ocb.L[0],
+			      nblocks, nrounds, (unsigned int)blkn);
 }
 
 #endif /* USE_ARM_CE */

commit 2d2e5286d53e1f62fe040dff4c6e01961f00afe2
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    OCB: Move large L handling from bottom to upper level
    
    * cipher/cipher-ocb.c (_gcry_cipher_ocb_get_l): Remove.
    (ocb_get_L_big): New.
    (_gcry_cipher_ocb_authenticate): L-big handling done in upper
    processing loop, so that lower level never sees the case where
    'aad_nblocks % 65536 == 0'; Add missing stack burn.
    (ocb_aad_finalize): Add missing stack burn.
    (ocb_crypt): L-big handling done in upper processing loop, so that
    lower level never sees the case where 'data_nblocks % 65536 == 0'.
    * cipher/cipher-internal.h (_gcry_cipher_ocb_get_l): Remove.
    (ocb_get_l): Remove 'l_tmp' usage and simplify since input
    is more limited now, 'N is not multiple of 65536'.
    * cipher/rijndael-aesni.c (get_l): Remove.
    (aesni_ocb_enc, aesni_ocb_dec, _gcry_aes_aesni_ocb_auth): Remove
    l_tmp; Use 'ocb_get_l'.
    * cipher/rijndael-ssse3-amd64.c (get_l): Remove.
    (ssse3_ocb_enc, ssse3_ocb_dec, _gcry_aes_ssse3_ocb_auth): Remove
    l_tmp; Use 'ocb_get_l'.
    * cipher/camellia-glue.c: Remove OCB l_tmp usage.
    * cipher/rijndael-armv8-ce.c: Ditto.
    * cipher/rijndael.c: Ditto.
    * cipher/serpent.c: Ditto.
    * cipher/twofish.c: Ditto.
    --
    
    Move large L value generation to up-most level to simplify lower level
    ocb_get_l for greater performance and simpler implementation. This helps
    implementing OCB in assembly as 'ocb_get_l' no longer has function call
    on slow-path.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/camellia-glue.c b/cipher/camellia-glue.c
index 1be35c9..7687094 100644
--- a/cipher/camellia-glue.c
+++ b/cipher/camellia-glue.c
@@ -619,7 +619,6 @@ _gcry_camellia_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
   CAMELLIA_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
-  unsigned char l_tmp[CAMELLIA_BLOCK_SIZE];
   int burn_stack_depth;
   u64 blkn = c->u_mode.ocb.data_nblocks;
 
@@ -664,9 +663,8 @@ _gcry_camellia_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 	  /* Process data in 32 block chunks. */
 	  while (nblocks >= 32)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 32;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 32);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 32);
 
 	      if (encrypt)
 		_gcry_camellia_aesni_avx2_ocb_enc(ctx, outbuf, inbuf, c->u_iv.iv,
@@ -725,9 +723,8 @@ _gcry_camellia_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 	  /* Process data in 16 block chunks. */
 	  while (nblocks >= 16)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 16;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 16);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 16);
 
 	      if (encrypt)
 		_gcry_camellia_aesni_avx_ocb_enc(ctx, outbuf, inbuf, c->u_iv.iv,
@@ -759,8 +756,6 @@ _gcry_camellia_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 #if defined(USE_AESNI_AVX) || defined(USE_AESNI_AVX2)
   c->u_mode.ocb.data_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #endif
@@ -776,7 +771,6 @@ _gcry_camellia_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 #if defined(USE_AESNI_AVX) || defined(USE_AESNI_AVX2)
   CAMELLIA_context *ctx = (void *)&c->context.c;
   const unsigned char *abuf = abuf_arg;
-  unsigned char l_tmp[CAMELLIA_BLOCK_SIZE];
   int burn_stack_depth;
   u64 blkn = c->u_mode.ocb.aad_nblocks;
 
@@ -818,9 +812,8 @@ _gcry_camellia_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 	  /* Process data in 32 block chunks. */
 	  while (nblocks >= 32)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 32;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 32);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 32);
 
 	      _gcry_camellia_aesni_avx2_ocb_auth(ctx, abuf,
 						 c->u_mode.ocb.aad_offset,
@@ -875,9 +868,8 @@ _gcry_camellia_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 	  /* Process data in 16 block chunks. */
 	  while (nblocks >= 16)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 16;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 16);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 16);
 
 	      _gcry_camellia_aesni_avx_ocb_auth(ctx, abuf,
 						c->u_mode.ocb.aad_offset,
@@ -905,8 +897,6 @@ _gcry_camellia_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 #if defined(USE_AESNI_AVX) || defined(USE_AESNI_AVX2)
   c->u_mode.ocb.aad_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #endif
diff --git a/cipher/cipher-internal.h b/cipher/cipher-internal.h
index 01352f3..7204d48 100644
--- a/cipher/cipher-internal.h
+++ b/cipher/cipher-internal.h
@@ -459,28 +459,28 @@ gcry_err_code_t _gcry_cipher_ocb_get_tag
 gcry_err_code_t _gcry_cipher_ocb_check_tag
 /*           */ (gcry_cipher_hd_t c,
                  const unsigned char *intag, size_t taglen);
-const unsigned char *_gcry_cipher_ocb_get_l
-/*           */ (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 n);
 
 
-/* Inline version of _gcry_cipher_ocb_get_l, with hard-coded fast paths for
-   most common cases.  */
+/* Return the L-value for block N.  Note: 'cipher_ocb.c' ensures that N
+ * will never be multiple of 65536 (1 << OCB_L_TABLE_SIZE), thus N can
+ * be directly passed to _gcry_ctz() function and resulting index will
+ * never overflow the table.  */
 static inline const unsigned char *
-ocb_get_l (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 n)
+ocb_get_l (gcry_cipher_hd_t c, u64 n)
 {
-  if (n & 1)
-    return c->u_mode.ocb.L[0];
-  else if (n & 2)
-    return c->u_mode.ocb.L[1];
-  else
-    {
-      unsigned int ntz = _gcry_ctz64 (n);
-
-      if (ntz < OCB_L_TABLE_SIZE)
-	return c->u_mode.ocb.L[ntz];
-      else
-	return _gcry_cipher_ocb_get_l (c, l_tmp, n);
-    }
+  unsigned long ntz;
+
+#if ((defined(__i386__) || defined(__x86_64__)) && __GNUC__ >= 4)
+  /* Assumes that N != 0. */
+  asm ("rep;bsfl %k[low], %k[ntz]\n\t"
+        : [ntz] "=r" (ntz)
+        : [low] "r" ((unsigned long)n)
+        : "cc");
+#else
+  ntz = _gcry_ctz (n);
+#endif
+
+  return c->u_mode.ocb.L[ntz];
 }
 
 #endif /*G10_CIPHER_INTERNAL_H*/
diff --git a/cipher/cipher-ocb.c b/cipher/cipher-ocb.c
index d1f01d5..db42aaf 100644
--- a/cipher/cipher-ocb.c
+++ b/cipher/cipher-ocb.c
@@ -109,25 +109,17 @@ bit_copy (unsigned char *d, const unsigned char *s,
 }
 
 
-/* Return the L-value for block N.  In most cases we use the table;
-   only if the lower OCB_L_TABLE_SIZE bits of N are zero we need to
-   compute it.  With a table size of 16 we need to this this only
-   every 65536-th block.  L_TMP is a helper buffer of size
-   OCB_BLOCK_LEN which is used to hold the computation if not taken
-   from the table.  */
-const unsigned char *
-_gcry_cipher_ocb_get_l (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 n)
+/* Get L_big value for block N, where N is multiple of 65536. */
+static void
+ocb_get_L_big (gcry_cipher_hd_t c, u64 n, unsigned char *l_buf)
 {
   int ntz = _gcry_ctz64 (n);
 
-  if (ntz < OCB_L_TABLE_SIZE)
-    return c->u_mode.ocb.L[ntz];
+  gcry_assert(ntz >= OCB_L_TABLE_SIZE);
 
-  double_block_cpy (l_tmp, c->u_mode.ocb.L[OCB_L_TABLE_SIZE - 1]);
+  double_block_cpy (l_buf, c->u_mode.ocb.L[OCB_L_TABLE_SIZE - 1]);
   for (ntz -= OCB_L_TABLE_SIZE; ntz; ntz--)
-    double_block (l_tmp);
-
-  return l_tmp;
+    double_block (l_buf);
 }
 
 
@@ -241,7 +233,11 @@ gcry_err_code_t
 _gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
                                size_t abuflen)
 {
+  const size_t table_maxblks = 1 << OCB_L_TABLE_SIZE;
+  const u32 table_size_mask = ((1 << OCB_L_TABLE_SIZE) - 1);
   unsigned char l_tmp[OCB_BLOCK_LEN];
+  unsigned int burn = 0;
+  unsigned int nburn;
 
   /* Check that a nonce and thus a key has been set and that we have
      not yet computed the tag.  We also return an error if the aad has
@@ -264,14 +260,24 @@ _gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
         {
           c->u_mode.ocb.aad_nblocks++;
 
+          if ((c->u_mode.ocb.aad_nblocks % table_maxblks) == 0)
+            {
+              /* Table overflow, L needs to be generated. */
+              ocb_get_L_big(c, c->u_mode.ocb.aad_nblocks + 1, l_tmp);
+            }
+          else
+            {
+              buf_cpy (l_tmp, ocb_get_l (c, c->u_mode.ocb.aad_nblocks),
+                       OCB_BLOCK_LEN);
+            }
+
           /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
-          buf_xor_1 (c->u_mode.ocb.aad_offset,
-                     ocb_get_l (c, l_tmp, c->u_mode.ocb.aad_nblocks),
-                     OCB_BLOCK_LEN);
+          buf_xor_1 (c->u_mode.ocb.aad_offset, l_tmp, OCB_BLOCK_LEN);
           /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
           buf_xor (l_tmp, c->u_mode.ocb.aad_offset,
                    c->u_mode.ocb.aad_leftover, OCB_BLOCK_LEN);
-          c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+          nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+          burn = nburn > burn ? nburn : burn;
           buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);
 
           c->u_mode.ocb.aad_nleftover = 0;
@@ -279,40 +285,83 @@ _gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
     }
 
   if (!abuflen)
-    return 0;
-
-  /* Use a bulk method if available.  */
-  if (abuflen >= OCB_BLOCK_LEN && c->bulk.ocb_auth)
     {
-      size_t nblks;
-      size_t nleft;
-      size_t ndone;
+      if (burn > 0)
+        _gcry_burn_stack (burn + 4*sizeof(void*));
 
-      nblks = abuflen / OCB_BLOCK_LEN;
-      nleft = c->bulk.ocb_auth (c, abuf, nblks);
-      ndone = nblks - nleft;
-
-      abuf += ndone * OCB_BLOCK_LEN;
-      abuflen -= ndone * OCB_BLOCK_LEN;
-      nblks = nleft;
+      return 0;
     }
 
-  /* Hash all full blocks.  */
+  /* Full blocks handling. */
   while (abuflen >= OCB_BLOCK_LEN)
     {
-      c->u_mode.ocb.aad_nblocks++;
+      size_t nblks = abuflen / OCB_BLOCK_LEN;
+      size_t nmaxblks;
 
-      /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
-      buf_xor_1 (c->u_mode.ocb.aad_offset,
-                 ocb_get_l (c, l_tmp, c->u_mode.ocb.aad_nblocks),
-                 OCB_BLOCK_LEN);
-      /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
-      buf_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf, OCB_BLOCK_LEN);
-      c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
-      buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);
+      /* Check how many blocks to process till table overflow. */
+      nmaxblks = (c->u_mode.ocb.aad_nblocks + 1) % table_maxblks;
+      nmaxblks = (table_maxblks - nmaxblks) % table_maxblks;
+
+      if (nmaxblks == 0)
+        {
+          /* Table overflow, generate L and process one block. */
+          c->u_mode.ocb.aad_nblocks++;
+          ocb_get_L_big(c, c->u_mode.ocb.aad_nblocks, l_tmp);
+
+          /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
+          buf_xor_1 (c->u_mode.ocb.aad_offset, l_tmp, OCB_BLOCK_LEN);
+          /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
+          buf_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf, OCB_BLOCK_LEN);
+          nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+          burn = nburn > burn ? nburn : burn;
+          buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);
+
+          abuf += OCB_BLOCK_LEN;
+          abuflen -= OCB_BLOCK_LEN;
+          nblks--;
+
+          /* With overflow handled, retry loop again. Next overflow will
+           * happen after 65535 blocks. */
+          continue;
+        }
+
+      nblks = nblks < nmaxblks ? nblks : nmaxblks;
+
+      /* Use a bulk method if available.  */
+      if (nblks && c->bulk.ocb_auth)
+        {
+          size_t nleft;
+          size_t ndone;
+
+          nleft = c->bulk.ocb_auth (c, abuf, nblks);
+          ndone = nblks - nleft;
+
+          abuf += ndone * OCB_BLOCK_LEN;
+          abuflen -= ndone * OCB_BLOCK_LEN;
+          nblks = nleft;
+        }
+
+      /* Hash all full blocks.  */
+      while (nblks)
+        {
+          c->u_mode.ocb.aad_nblocks++;
+
+          gcry_assert(c->u_mode.ocb.aad_nblocks & table_size_mask);
+
+          /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
+          buf_xor_1 (c->u_mode.ocb.aad_offset,
+                     ocb_get_l (c, c->u_mode.ocb.aad_nblocks),
+                     OCB_BLOCK_LEN);
+          /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
+          buf_xor (l_tmp, c->u_mode.ocb.aad_offset, abuf, OCB_BLOCK_LEN);
+          nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+          burn = nburn > burn ? nburn : burn;
+          buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);
 
-      abuf += OCB_BLOCK_LEN;
-      abuflen -= OCB_BLOCK_LEN;
+          abuf += OCB_BLOCK_LEN;
+          abuflen -= OCB_BLOCK_LEN;
+          nblks--;
+        }
     }
 
   /* Store away the remaining data.  */
@@ -321,6 +370,9 @@ _gcry_cipher_ocb_authenticate (gcry_cipher_hd_t c, const unsigned char *abuf,
     c->u_mode.ocb.aad_leftover[c->u_mode.ocb.aad_nleftover++] = *abuf;
   gcry_assert (!abuflen);
 
+  if (burn > 0)
+    _gcry_burn_stack (burn + 4*sizeof(void*));
+
   return 0;
 }
 
@@ -330,6 +382,8 @@ static void
 ocb_aad_finalize (gcry_cipher_hd_t c)
 {
   unsigned char l_tmp[OCB_BLOCK_LEN];
+  unsigned int burn = 0;
+  unsigned int nburn;
 
   /* Check that a nonce and thus a key has been set and that we have
      not yet computed the tag.  We also skip this if the aad has been
@@ -352,7 +406,8 @@ ocb_aad_finalize (gcry_cipher_hd_t c)
       l_tmp[c->u_mode.ocb.aad_nleftover] = 0x80;
       buf_xor_1 (l_tmp, c->u_mode.ocb.aad_offset, OCB_BLOCK_LEN);
       /* Sum = Sum_m xor ENCIPHER(K, CipherInput)  */
-      c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+      nburn = c->spec->encrypt (&c->context.c, l_tmp, l_tmp);
+      burn = nburn > burn ? nburn : burn;
       buf_xor_1 (c->u_mode.ocb.aad_sum, l_tmp, OCB_BLOCK_LEN);
 
       c->u_mode.ocb.aad_nleftover = 0;
@@ -361,6 +416,9 @@ ocb_aad_finalize (gcry_cipher_hd_t c)
   /* Mark AAD as finalized so that gcry_cipher_ocb_authenticate can
    * return an erro when called again.  */
   c->u_mode.ocb.aad_finalized = 1;
+
+  if (burn > 0)
+    _gcry_burn_stack (burn + 4*sizeof(void*));
 }
 
 
@@ -387,10 +445,13 @@ ocb_crypt (gcry_cipher_hd_t c, int encrypt,
            unsigned char *outbuf, size_t outbuflen,
            const unsigned char *inbuf, size_t inbuflen)
 {
+  const size_t table_maxblks = 1 << OCB_L_TABLE_SIZE;
+  const u32 table_size_mask = ((1 << OCB_L_TABLE_SIZE) - 1);
   unsigned char l_tmp[OCB_BLOCK_LEN];
   unsigned int burn = 0;
   unsigned int nburn;
-  size_t nblks = inbuflen / OCB_BLOCK_LEN;
+  gcry_cipher_encrypt_t crypt_fn =
+      encrypt ? c->spec->encrypt : c->spec->decrypt;
 
   /* Check that a nonce and thus a key has been set and that we are
      not yet in end of data state. */
@@ -407,58 +468,112 @@ ocb_crypt (gcry_cipher_hd_t c, int encrypt,
   else if ((inbuflen % OCB_BLOCK_LEN))
     return GPG_ERR_INV_LENGTH;  /* We support only full blocks for now.  */
 
-  /* Use a bulk method if available.  */
-  if (nblks && c->bulk.ocb_crypt)
-    {
-      size_t nleft;
-      size_t ndone;
-
-      nleft = c->bulk.ocb_crypt (c, outbuf, inbuf, nblks, encrypt);
-      ndone = nblks - nleft;
-
-      inbuf += ndone * OCB_BLOCK_LEN;
-      outbuf += ndone * OCB_BLOCK_LEN;
-      inbuflen -= ndone * OCB_BLOCK_LEN;
-      outbuflen -= ndone * OCB_BLOCK_LEN;
-      nblks = nleft;
-    }
-
-  if (nblks)
+  /* Full blocks handling. */
+  while (inbuflen >= OCB_BLOCK_LEN)
     {
-      gcry_cipher_encrypt_t crypt_fn =
-          encrypt ? c->spec->encrypt : c->spec->decrypt;
+      size_t nblks = inbuflen / OCB_BLOCK_LEN;
+      size_t nmaxblks;
 
-      if (encrypt)
-        {
-          /* Checksum_i = Checksum_{i-1} xor P_i  */
-          ocb_checksum (c->u_ctr.ctr, inbuf, nblks);
-        }
+      /* Check how many blocks to process till table overflow. */
+      nmaxblks = (c->u_mode.ocb.data_nblocks + 1) % table_maxblks;
+      nmaxblks = (table_maxblks - nmaxblks) % table_maxblks;
 
-      /* Encrypt all full blocks.  */
-      while (inbuflen >= OCB_BLOCK_LEN)
+      if (nmaxblks == 0)
         {
+          /* Table overflow, generate L and process one block. */
           c->u_mode.ocb.data_nblocks++;
+          ocb_get_L_big(c, c->u_mode.ocb.data_nblocks, l_tmp);
+
+          if (encrypt)
+            {
+              /* Checksum_i = Checksum_{i-1} xor P_i  */
+              ocb_checksum (c->u_ctr.ctr, inbuf, 1);
+            }
 
           /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
-          buf_xor_1 (c->u_iv.iv,
-                     ocb_get_l (c, l_tmp, c->u_mode.ocb.data_nblocks),
-                     OCB_BLOCK_LEN);
+          buf_xor_1 (c->u_iv.iv, l_tmp, OCB_BLOCK_LEN);
           /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */
           buf_xor (outbuf, c->u_iv.iv, inbuf, OCB_BLOCK_LEN);
           nburn = crypt_fn (&c->context.c, outbuf, outbuf);
           burn = nburn > burn ? nburn : burn;
           buf_xor_1 (outbuf, c->u_iv.iv, OCB_BLOCK_LEN);
 
+          if (!encrypt)
+            {
+              /* Checksum_i = Checksum_{i-1} xor P_i  */
+              ocb_checksum (c->u_ctr.ctr, outbuf, 1);
+            }
+
           inbuf += OCB_BLOCK_LEN;
           inbuflen -= OCB_BLOCK_LEN;
           outbuf += OCB_BLOCK_LEN;
           outbuflen =- OCB_BLOCK_LEN;
+          nblks--;
+
+          /* With overflow handled, retry loop again. Next overflow will
+           * happen after 65535 blocks. */
+          continue;
+        }
+
+      nblks = nblks < nmaxblks ? nblks : nmaxblks;
+
+      /* Use a bulk method if available.  */
+      if (nblks && c->bulk.ocb_crypt)
+        {
+          size_t nleft;
+          size_t ndone;
+
+          nleft = c->bulk.ocb_crypt (c, outbuf, inbuf, nblks, encrypt);
+          ndone = nblks - nleft;
+
+          inbuf += ndone * OCB_BLOCK_LEN;
+          outbuf += ndone * OCB_BLOCK_LEN;
+          inbuflen -= ndone * OCB_BLOCK_LEN;
+          outbuflen -= ndone * OCB_BLOCK_LEN;
+          nblks = nleft;
         }
 
-      if (!encrypt)
+      if (nblks)
         {
-          /* Checksum_i = Checksum_{i-1} xor P_i  */
-          ocb_checksum (c->u_ctr.ctr, outbuf - nblks * OCB_BLOCK_LEN, nblks);
+          size_t nblks_chksum = nblks;
+
+          if (encrypt)
+            {
+              /* Checksum_i = Checksum_{i-1} xor P_i  */
+              ocb_checksum (c->u_ctr.ctr, inbuf, nblks_chksum);
+            }
+
+          /* Encrypt all full blocks.  */
+          while (nblks)
+            {
+              c->u_mode.ocb.data_nblocks++;
+
+              gcry_assert(c->u_mode.ocb.data_nblocks & table_size_mask);
+
+              /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
+              buf_xor_1 (c->u_iv.iv,
+                         ocb_get_l (c, c->u_mode.ocb.data_nblocks),
+                         OCB_BLOCK_LEN);
+              /* C_i = Offset_i xor ENCIPHER(K, P_i xor Offset_i)  */
+              buf_xor (outbuf, c->u_iv.iv, inbuf, OCB_BLOCK_LEN);
+              nburn = crypt_fn (&c->context.c, outbuf, outbuf);
+              burn = nburn > burn ? nburn : burn;
+              buf_xor_1 (outbuf, c->u_iv.iv, OCB_BLOCK_LEN);
+
+              inbuf += OCB_BLOCK_LEN;
+              inbuflen -= OCB_BLOCK_LEN;
+              outbuf += OCB_BLOCK_LEN;
+              outbuflen =- OCB_BLOCK_LEN;
+              nblks--;
+            }
+
+          if (!encrypt)
+            {
+              /* Checksum_i = Checksum_{i-1} xor P_i  */
+              ocb_checksum (c->u_ctr.ctr,
+                            outbuf - nblks_chksum * OCB_BLOCK_LEN,
+                            nblks_chksum);
+            }
         }
     }
 
diff --git a/cipher/rijndael-aesni.c b/cipher/rijndael-aesni.c
index 8b28b3a..7852e19 100644
--- a/cipher/rijndael-aesni.c
+++ b/cipher/rijndael-aesni.c
@@ -1331,74 +1331,10 @@ _gcry_aes_aesni_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
 }
 
 
-static inline const unsigned char *
-get_l (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 i, unsigned char *iv,
-       unsigned char *ctr)
-{
-  const unsigned char *l;
-  unsigned int ntz;
-
-  if (i & 0xffffffffU)
-    {
-      asm ("rep;bsf %k[low], %k[ntz]\n\t"
-           : [ntz] "=r" (ntz)
-           : [low] "r" (i & 0xffffffffU)
-           : "cc");
-    }
-  else
-    {
-      if (OCB_L_TABLE_SIZE < 32)
-        {
-          ntz = 32;
-        }
-      else if (i)
-        {
-          asm ("rep;bsf %k[high], %k[ntz]\n\t"
-               : [ntz] "=r" (ntz)
-               : [high] "r" (i >> 32)
-               : "cc");
-          ntz += 32;
-        }
-      else
-        {
-          ntz = 64;
-        }
-    }
-
-  if (ntz < OCB_L_TABLE_SIZE)
-    {
-      l = c->u_mode.ocb.L[ntz];
-    }
-  else
-    {
-      /* Store Offset & Checksum before calling external function */
-      asm volatile ("movdqu %%xmm5, %[iv]\n\t"
-                    "movdqu %%xmm6, %[ctr]\n\t"
-                    : [iv] "=m" (*iv),
-                      [ctr] "=m" (*ctr)
-                    :
-                    : "memory" );
-
-      l = _gcry_cipher_ocb_get_l (c, l_tmp, i);
-
-      /* Restore Offset & Checksum */
-      asm volatile ("movdqu %[iv], %%xmm5\n\t"
-                    "movdqu %[ctr], %%xmm6\n\t"
-                    : /* No output */
-                    : [iv] "m" (*iv),
-                      [ctr] "m" (*ctr)
-                    : "memory" );
-    }
-
-  return l;
-}
-
-
 static void
 aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
                const void *inbuf_arg, size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
@@ -1420,7 +1356,7 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks && n % 4; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Checksum_i = Checksum_{i-1} xor P_i  */
@@ -1449,9 +1385,8 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks > 3 ; nblocks -= 4 )
     {
-      /* l_tmp will be used only every 65536-th block. */
       n += 4;
-      l = get_l(c, l_tmp.x1, n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Checksum_i = Checksum_{i-1} xor P_i  */
@@ -1522,7 +1457,7 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Checksum_i = Checksum_{i-1} xor P_i  */
@@ -1559,8 +1494,6 @@ aesni_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
 
   aesni_cleanup ();
   aesni_cleanup_2_6 ();
-
-  wipememory(&l_tmp, sizeof(l_tmp));
 }
 
 
@@ -1568,7 +1501,6 @@ static void
 aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
                const void *inbuf_arg, size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
@@ -1589,7 +1521,7 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks && n % 4; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */
@@ -1618,9 +1550,8 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks > 3 ; nblocks -= 4 )
     {
-      /* l_tmp will be used only every 65536-th block. */
       n += 4;
-      l = get_l(c, l_tmp.x1, n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */
@@ -1691,7 +1622,7 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 
   for ( ;nblocks; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */
@@ -1728,8 +1659,6 @@ aesni_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
 
   aesni_cleanup ();
   aesni_cleanup_2_6 ();
-
-  wipememory(&l_tmp, sizeof(l_tmp));
 }
 
 
@@ -1748,7 +1677,6 @@ void
 _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
                           size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   const unsigned char *abuf = abuf_arg;
   u64 n = c->u_mode.ocb.aad_nblocks;
@@ -1768,8 +1696,7 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
   for ( ;nblocks && n % 4; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_mode.ocb.aad_offset,
-                c->u_mode.ocb.aad_sum);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
@@ -1794,10 +1721,8 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
   for ( ;nblocks > 3 ; nblocks -= 4 )
     {
-      /* l_tmp will be used only every 65536-th block. */
       n += 4;
-      l = get_l(c, l_tmp.x1, n, c->u_mode.ocb.aad_offset,
-		c->u_mode.ocb.aad_sum);
+      l = ocb_get_l(c, n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
@@ -1849,8 +1774,7 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
   for ( ;nblocks; nblocks-- )
     {
-      l = get_l(c, l_tmp.x1, ++n, c->u_mode.ocb.aad_offset,
-                c->u_mode.ocb.aad_sum);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
@@ -1883,8 +1807,6 @@ _gcry_aes_aesni_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
   aesni_cleanup ();
   aesni_cleanup_2_6 ();
-
-  wipememory(&l_tmp, sizeof(l_tmp));
 }
 
 
diff --git a/cipher/rijndael-armv8-ce.c b/cipher/rijndael-armv8-ce.c
index bed4066..1bf74da 100644
--- a/cipher/rijndael-armv8-ce.c
+++ b/cipher/rijndael-armv8-ce.c
@@ -336,7 +336,6 @@ _gcry_aes_armv8_ce_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
   u64 blkn = c->u_mode.ocb.data_nblocks;
   u64 blkn_offs = blkn - blkn % 32;
   unsigned int n = 32 - blkn % 32;
-  unsigned char l_tmp[16];
   void *Ls[32];
   void **l;
   size_t i;
@@ -364,9 +363,8 @@ _gcry_aes_armv8_ce_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
       /* Process data in 32 block chunks. */
       while (nblocks >= 32)
         {
-          /* l_tmp will be used only every 65536-th block. */
           blkn_offs += 32;
-          *l = (void *)ocb_get_l(c, l_tmp, blkn_offs);
+          *l = (void *)ocb_get_l(c, blkn_offs);
 
           crypt_fn(keysched, outbuf, inbuf, c->u_iv.iv, c->u_ctr.ctr, Ls, 32,
                     nrounds);
@@ -378,13 +376,13 @@ _gcry_aes_armv8_ce_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 
       if (nblocks && l < &Ls[nblocks])
         {
-          *l = (void *)ocb_get_l(c, l_tmp, 32 + blkn_offs);
+          *l = (void *)ocb_get_l(c, 32 + blkn_offs);
         }
     }
   else
     {
       for (i = 0; i < nblocks; i++)
-        Ls[i] = (void *)ocb_get_l(c, l_tmp, ++blkn);
+        Ls[i] = (void *)ocb_get_l(c, ++blkn);
     }
 
   if (nblocks)
@@ -392,8 +390,6 @@ _gcry_aes_armv8_ce_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
       crypt_fn(keysched, outbuf, inbuf, c->u_iv.iv, c->u_ctr.ctr, Ls, nblocks,
                nrounds);
     }
-
-  wipememory(&l_tmp, sizeof(l_tmp));
 }
 
 void
@@ -407,7 +403,6 @@ _gcry_aes_armv8_ce_ocb_auth (gcry_cipher_hd_t c, void *abuf_arg,
   u64 blkn = c->u_mode.ocb.aad_nblocks;
   u64 blkn_offs = blkn - blkn % 32;
   unsigned int n = 32 - blkn % 32;
-  unsigned char l_tmp[16];
   void *Ls[32];
   void **l;
   size_t i;
@@ -435,9 +430,8 @@ _gcry_aes_armv8_ce_ocb_auth (gcry_cipher_hd_t c, void *abuf_arg,
       /* Process data in 32 block chunks. */
       while (nblocks >= 32)
         {
-          /* l_tmp will be used only every 65536-th block. */
           blkn_offs += 32;
-          *l = (void *)ocb_get_l(c, l_tmp, blkn_offs);
+          *l = (void *)ocb_get_l(c, blkn_offs);
 
           _gcry_aes_ocb_auth_armv8_ce(keysched, abuf, c->u_mode.ocb.aad_offset,
                                       c->u_mode.ocb.aad_sum, Ls, 32, nrounds);
@@ -448,13 +442,13 @@ _gcry_aes_armv8_ce_ocb_auth (gcry_cipher_hd_t c, void *abuf_arg,
 
       if (nblocks && l < &Ls[nblocks])
         {
-          *l = (void *)ocb_get_l(c, l_tmp, 32 + blkn_offs);
+          *l = (void *)ocb_get_l(c, 32 + blkn_offs);
         }
     }
   else
     {
       for (i = 0; i < nblocks; i++)
-        Ls[i] = (void *)ocb_get_l(c, l_tmp, ++blkn);
+        Ls[i] = (void *)ocb_get_l(c, ++blkn);
     }
 
   if (nblocks)
@@ -462,8 +456,6 @@ _gcry_aes_armv8_ce_ocb_auth (gcry_cipher_hd_t c, void *abuf_arg,
       _gcry_aes_ocb_auth_armv8_ce(keysched, abuf, c->u_mode.ocb.aad_offset,
                                   c->u_mode.ocb.aad_sum, Ls, nblocks, nrounds);
     }
-
-  wipememory(&l_tmp, sizeof(l_tmp));
 }
 
 #endif /* USE_ARM_CE */
diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index 937d868..a8e89d4 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -527,92 +527,10 @@ _gcry_aes_ssse3_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
 }
 
 
-static inline const unsigned char *
-get_l (gcry_cipher_hd_t c, unsigned char *l_tmp, u64 i, unsigned char *iv,
-       unsigned char *ctr, const void **aes_const_ptr,
-       byte ssse3_state[SSSE3_STATE_SIZE], int encrypt)
-{
-  const unsigned char *l;
-  unsigned int ntz;
-
-  if (i & 1)
-    return c->u_mode.ocb.L[0];
-  else if (i & 2)
-    return c->u_mode.ocb.L[1];
-  else if (i & 0xffffffffU)
-    {
-      asm ("rep;bsf %k[low], %k[ntz]\n\t"
-           : [ntz] "=r" (ntz)
-           : [low] "r" (i & 0xffffffffU)
-           : "cc");
-    }
-  else
-    {
-      if (OCB_L_TABLE_SIZE < 32)
-        {
-          ntz = 32;
-        }
-      else if (i)
-        {
-          asm ("rep;bsf %k[high], %k[ntz]\n\t"
-               : [ntz] "=r" (ntz)
-               : [high] "r" (i >> 32)
-               : "cc");
-          ntz += 32;
-        }
-      else
-        {
-          ntz = 64;
-        }
-    }
-
-  if (ntz < OCB_L_TABLE_SIZE)
-    {
-      l = c->u_mode.ocb.L[ntz];
-    }
-  else
-    {
-      /* Store Offset & Checksum before calling external function */
-      asm volatile ("movdqu %%xmm7, %[iv]\n\t"
-                    "movdqu %%xmm6, %[ctr]\n\t"
-                    : [iv] "=m" (*iv),
-                      [ctr] "=m" (*ctr)
-                    :
-                    : "memory" );
-
-      /* Restore SSSE3 state. */
-      vpaes_ssse3_cleanup();
-
-      l = _gcry_cipher_ocb_get_l (c, l_tmp, i);
-
-      /* Save SSSE3 state. */
-      if (encrypt)
-	{
-	  vpaes_ssse3_prepare_enc (*aes_const_ptr);
-	}
-      else
-	{
-	  vpaes_ssse3_prepare_dec (*aes_const_ptr);
-	}
-
-      /* Restore Offset & Checksum */
-      asm volatile ("movdqu %[iv], %%xmm7\n\t"
-                    "movdqu %[ctr], %%xmm6\n\t"
-                    : /* No output */
-                    : [iv] "m" (*iv),
-                      [ctr] "m" (*ctr)
-                    : "memory" );
-    }
-
-  return l;
-}
-
-
 static void
 ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
                const void *inbuf_arg, size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
@@ -635,8 +553,7 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
     {
       const unsigned char *l;
 
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr, &aes_const_ptr,
-		ssse3_state, 1);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Checksum_i = Checksum_{i-1} xor P_i  */
@@ -671,7 +588,6 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
                 :
                 : "memory" );
 
-  wipememory(&l_tmp, sizeof(l_tmp));
   vpaes_ssse3_cleanup ();
 }
 
@@ -679,7 +595,6 @@ static void
 ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
                const void *inbuf_arg, size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
@@ -702,8 +617,7 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
     {
       const unsigned char *l;
 
-      l = get_l(c, l_tmp.x1, ++n, c->u_iv.iv, c->u_ctr.ctr, &aes_const_ptr,
-		ssse3_state, 0);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* P_i = Offset_i xor DECIPHER(K, C_i xor Offset_i)  */
@@ -738,7 +652,6 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
                 :
                 : "memory" );
 
-  wipememory(&l_tmp, sizeof(l_tmp));
   vpaes_ssse3_cleanup ();
 }
 
@@ -758,7 +671,6 @@ void
 _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
                           size_t nblocks)
 {
-  union { unsigned char x1[16] ATTR_ALIGNED_16; u32 x32[4]; } l_tmp;
   RIJNDAEL_context *ctx = (void *)&c->context.c;
   const unsigned char *abuf = abuf_arg;
   u64 n = c->u_mode.ocb.aad_nblocks;
@@ -780,8 +692,7 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
     {
       const unsigned char *l;
 
-      l = get_l(c, l_tmp.x1, ++n, c->u_mode.ocb.aad_offset,
-                c->u_mode.ocb.aad_sum, &aes_const_ptr, ssse3_state, 1);
+      l = ocb_get_l(c, ++n);
 
       /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
       /* Sum_i = Sum_{i-1} xor ENCIPHER(K, A_i xor Offset_i)  */
@@ -812,7 +723,6 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
                 :
                 : "memory" );
 
-  wipememory(&l_tmp, sizeof(l_tmp));
   vpaes_ssse3_cleanup ();
 }
 
diff --git a/cipher/rijndael.c b/cipher/rijndael.c
index cc6a722..66ea0f3 100644
--- a/cipher/rijndael.c
+++ b/cipher/rijndael.c
@@ -1353,7 +1353,7 @@ _gcry_aes_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
       for ( ;nblocks; nblocks-- )
         {
           u64 i = ++c->u_mode.ocb.data_nblocks;
-          const unsigned char *l = ocb_get_l(c, l_tmp.x1, i);
+          const unsigned char *l = ocb_get_l(c, i);
 
           /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
           buf_xor_1 (c->u_iv.iv, l, BLOCKSIZE);
@@ -1378,7 +1378,7 @@ _gcry_aes_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
       for ( ;nblocks; nblocks-- )
         {
           u64 i = ++c->u_mode.ocb.data_nblocks;
-          const unsigned char *l = ocb_get_l(c, l_tmp.x1, i);
+          const unsigned char *l = ocb_get_l(c, i);
 
           /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
           buf_xor_1 (c->u_iv.iv, l, BLOCKSIZE);
@@ -1445,7 +1445,7 @@ _gcry_aes_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg, size_t nblocks)
       for ( ;nblocks; nblocks-- )
         {
           u64 i = ++c->u_mode.ocb.aad_nblocks;
-          const unsigned char *l = ocb_get_l(c, l_tmp.x1, i);
+          const unsigned char *l = ocb_get_l(c, i);
 
           /* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
           buf_xor_1 (c->u_mode.ocb.aad_offset, l, BLOCKSIZE);
diff --git a/cipher/serpent.c b/cipher/serpent.c
index ef19d3b..ea4b8ed 100644
--- a/cipher/serpent.c
+++ b/cipher/serpent.c
@@ -1235,7 +1235,6 @@ _gcry_serpent_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
   serpent_context_t *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
-  unsigned char l_tmp[sizeof(serpent_block_t)];
   int burn_stack_depth = 2 * sizeof (serpent_block_t);
   u64 blkn = c->u_mode.ocb.data_nblocks;
 #else
@@ -1275,9 +1274,8 @@ _gcry_serpent_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 	  /* Process data in 16 block chunks. */
 	  while (nblocks >= 16)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 16;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 16);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 16);
 
 	      if (encrypt)
 		_gcry_serpent_avx2_ocb_enc(ctx, outbuf, inbuf, c->u_iv.iv,
@@ -1327,9 +1325,8 @@ _gcry_serpent_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 	/* Process data in 8 block chunks. */
 	while (nblocks >= 8)
 	  {
-	    /* l_tmp will be used only every 65536-th block. */
 	    blkn += 8;
-	    *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 8);
+	    *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 8);
 
 	    if (encrypt)
 	      _gcry_serpent_sse2_ocb_enc(ctx, outbuf, inbuf, c->u_iv.iv,
@@ -1378,9 +1375,8 @@ _gcry_serpent_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 	  /* Process data in 8 block chunks. */
 	  while (nblocks >= 8)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 8;
-	      *l = ocb_get_l(c, l_tmp, blkn - blkn % 8);
+	      *l = ocb_get_l(c,  blkn - blkn % 8);
 
 	      if (encrypt)
 		_gcry_serpent_neon_ocb_enc(ctx, outbuf, inbuf, c->u_iv.iv,
@@ -1410,8 +1406,6 @@ _gcry_serpent_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 #if defined(USE_AVX2) || defined(USE_SSE2) || defined(USE_NEON)
   c->u_mode.ocb.data_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #endif
@@ -1427,7 +1421,6 @@ _gcry_serpent_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 #if defined(USE_AVX2) || defined(USE_SSE2) || defined(USE_NEON)
   serpent_context_t *ctx = (void *)&c->context.c;
   const unsigned char *abuf = abuf_arg;
-  unsigned char l_tmp[sizeof(serpent_block_t)];
   int burn_stack_depth = 2 * sizeof(serpent_block_t);
   u64 blkn = c->u_mode.ocb.aad_nblocks;
 #else
@@ -1465,9 +1458,8 @@ _gcry_serpent_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 	  /* Process data in 16 block chunks. */
 	  while (nblocks >= 16)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 16;
-	      *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 16);
+	      *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 16);
 
 	      _gcry_serpent_avx2_ocb_auth(ctx, abuf, c->u_mode.ocb.aad_offset,
 					  c->u_mode.ocb.aad_sum, Ls);
@@ -1512,9 +1504,8 @@ _gcry_serpent_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 	/* Process data in 8 block chunks. */
 	while (nblocks >= 8)
 	  {
-	    /* l_tmp will be used only every 65536-th block. */
 	    blkn += 8;
-	    *l = (uintptr_t)(void *)ocb_get_l(c, l_tmp, blkn - blkn % 8);
+	    *l = (uintptr_t)(void *)ocb_get_l(c, blkn - blkn % 8);
 
 	    _gcry_serpent_sse2_ocb_auth(ctx, abuf, c->u_mode.ocb.aad_offset,
 					c->u_mode.ocb.aad_sum, Ls);
@@ -1558,9 +1549,8 @@ _gcry_serpent_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 	  /* Process data in 8 block chunks. */
 	  while (nblocks >= 8)
 	    {
-	      /* l_tmp will be used only every 65536-th block. */
 	      blkn += 8;
-	      *l = ocb_get_l(c, l_tmp, blkn - blkn % 8);
+	      *l = ocb_get_l(c, blkn - blkn % 8);
 
 	      _gcry_serpent_neon_ocb_auth(ctx, abuf, c->u_mode.ocb.aad_offset,
 					  c->u_mode.ocb.aad_sum, Ls);
@@ -1585,8 +1575,6 @@ _gcry_serpent_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 #if defined(USE_AVX2) || defined(USE_SSE2) || defined(USE_NEON)
   c->u_mode.ocb.aad_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #endif
diff --git a/cipher/twofish.c b/cipher/twofish.c
index 7a4d26a..55f6fb9 100644
--- a/cipher/twofish.c
+++ b/cipher/twofish.c
@@ -1261,7 +1261,6 @@ _gcry_twofish_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
   TWOFISH_context *ctx = (void *)&c->context.c;
   unsigned char *outbuf = outbuf_arg;
   const unsigned char *inbuf = inbuf_arg;
-  unsigned char l_tmp[TWOFISH_BLOCKSIZE];
   unsigned int burn, burn_stack_depth = 0;
   u64 blkn = c->u_mode.ocb.data_nblocks;
 
@@ -1273,10 +1272,9 @@ _gcry_twofish_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
     /* Process data in 3 block chunks. */
     while (nblocks >= 3)
       {
-	/* l_tmp will be used only every 65536-th block. */
-	Ls[0] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 1);
-	Ls[1] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 2);
-	Ls[2] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 3);
+	Ls[0] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 1);
+	Ls[1] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 2);
+	Ls[2] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 3);
 	blkn += 3;
 
 	if (encrypt)
@@ -1300,8 +1298,6 @@ _gcry_twofish_ocb_crypt (gcry_cipher_hd_t c, void *outbuf_arg,
 
   c->u_mode.ocb.data_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #else
@@ -1322,7 +1318,6 @@ _gcry_twofish_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 #ifdef USE_AMD64_ASM
   TWOFISH_context *ctx = (void *)&c->context.c;
   const unsigned char *abuf = abuf_arg;
-  unsigned char l_tmp[TWOFISH_BLOCKSIZE];
   unsigned int burn, burn_stack_depth = 0;
   u64 blkn = c->u_mode.ocb.aad_nblocks;
 
@@ -1334,10 +1329,9 @@ _gcry_twofish_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
     /* Process data in 3 block chunks. */
     while (nblocks >= 3)
       {
-	/* l_tmp will be used only every 65536-th block. */
-	Ls[0] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 1);
-	Ls[1] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 2);
-	Ls[2] = (uintptr_t)(const void *)ocb_get_l(c, l_tmp, blkn + 3);
+	Ls[0] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 1);
+	Ls[1] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 2);
+	Ls[2] = (uintptr_t)(const void *)ocb_get_l(c, blkn + 3);
 	blkn += 3;
 
 	twofish_amd64_ocb_auth(ctx, abuf, c->u_mode.ocb.aad_offset,
@@ -1356,8 +1350,6 @@ _gcry_twofish_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
 
   c->u_mode.ocb.aad_nblocks = blkn;
 
-  wipememory(&l_tmp, sizeof(l_tmp));
-
   if (burn_stack_depth)
     _gcry_burn_stack (burn_stack_depth + 4 * sizeof(void *));
 #else

commit 161d339f48c03be7fd0f4249d730f7f1767ef8e4
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    OCB: remove 'int64_t' usage
    
    * cipher/cipher-ocb.c (double_block): Use alternative way to generate
    sign-bit mask, without 'int64_t'.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/cipher-ocb.c b/cipher/cipher-ocb.c
index 92260d2..d1f01d5 100644
--- a/cipher/cipher-ocb.c
+++ b/cipher/cipher-ocb.c
@@ -66,7 +66,7 @@ double_block (unsigned char *b)
   l = buf_get_be64 (b);
   r = buf_get_be64 (b + 8);
 
-  l_0 = (int64_t)l >> 63;
+  l_0 = -(l >> 63);
   l = (l + l) ^ (r >> 63);
   r = (r + r) ^ (l_0 & 135);
 

commit 0b03b658bebc69a84d87ef13f9b60a27b0c42305
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Dec 10 12:29:12 2016 +0200

    random-drbg: use bufhelp function for big-endian store
    
    * random/random-drbg.c (drbg_cpu_to_be32): Remove.
    (drbg_ctr_df, drbg_hash_df): Use 'buf_put_be32' instead of
    'drbg_cpu_to_be32'.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/random/random-drbg.c b/random/random-drbg.c
index e2fe861..baaa65a 100644
--- a/random/random-drbg.c
+++ b/random/random-drbg.c
@@ -155,7 +155,7 @@
 #include "g10lib.h"
 #include "random.h"
 #include "rand-internal.h"
-#include "../cipher/bithelp.h"
+#include "../cipher/bufhelp.h"
 
 
 

@@ -546,27 +546,6 @@ drbg_sec_strength (u32 flags)
     return 32;
 }
 
-/*
- * Convert an integer into a byte representation of this integer.
- * The byte representation is big-endian
- *
- * @val value to be converted
- * @buf buffer holding the converted integer -- caller must ensure that
- *      buffer size is at least 32 bit
- */
-static inline void
-drbg_cpu_to_be32 (u32 val, unsigned char *buf)
-{
-  /* FIXME: This may raise a bus error.  */
-  struct s
-  {
-    u32 conv;
-  };
-  struct s *conversion = (struct s *) buf;
-
-  conversion->conv = be_bswap32 (val);
-}
-
 static void
 drbg_add_buf (unsigned char *dst, size_t dstlen,
               unsigned char *add, size_t addlen)
@@ -802,10 +781,10 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
   /* 10.4.2 step 2 -- calculate the entire length of all input data */
   for (; NULL != tempstr; tempstr = tempstr->next)
     inputlen += tempstr->len;
-  drbg_cpu_to_be32 (inputlen, &L_N[0]);
+  buf_put_be32 (&L_N[0], inputlen);
 
   /* 10.4.2 step 3 */
-  drbg_cpu_to_be32 (bytes_to_return, &L_N[4]);
+  buf_put_be32 (&L_N[4], bytes_to_return);
 
   /* 10.4.2 step 5: length is size of L_N, input_string, one byte, padding */
   padlen = (inputlen + sizeof (L_N) + 1) % (drbg_blocklen (drbg));
@@ -838,7 +817,7 @@ drbg_ctr_df (drbg_state_t drbg, unsigned char *df_data,
       /* 10.4.2 step 9.1 - the padding is implicit as the buffer
        * holds zeros after allocation -- even the increment of i
        * is irrelevant as the increment remains within length of i */
-      drbg_cpu_to_be32 (i, iv);
+      buf_put_be32 (iv, i);
       /* 10.4.2 step 9.2 -- BCC and concatenation with temp */
       ret = drbg_ctr_bcc (drbg, temp + templen, K, &S1);
       if (ret)
@@ -1137,7 +1116,7 @@ drbg_hash_df (drbg_state_t drbg,
 
   /* 10.4.1 step 3 */
   input[0] = 1;
-  drbg_cpu_to_be32 ((outlen * 8), &input[1]);
+  buf_put_be32 (&input[1], (outlen * 8));
 
   /* 10.4.1 step 4.1 -- concatenation of data for input into hash */
   drbg_string_fill (&data1, input, 5);

-----------------------------------------------------------------------

Summary of changes:
 .gitignore                         |   1 +
 cipher/camellia-glue.c             |  18 +--
 cipher/cipher-internal.h           |  36 ++---
 cipher/cipher-ocb.c                | 273 ++++++++++++++++++++++++++-----------
 cipher/rijndael-aesni.c            |  96 ++-----------
 cipher/rijndael-armv8-aarch32-ce.S |  98 +++++++++++--
 cipher/rijndael-armv8-aarch64-ce.S | 125 +++++++++++------
 cipher/rijndael-armv8-ce.c         | 137 +++----------------
 cipher/rijndael-ssse3-amd64.c      |  96 +------------
 cipher/rijndael.c                  |   6 +-
 cipher/serpent.c                   |  24 +---
 cipher/twofish.c                   |  20 +--
 configure.ac                       |   1 +
 random/random-drbg.c               |  31 +----
 src/hwfeatures.c                   |  16 +--
 tests/Makefile.am                  |   5 +-
 tests/basic-disable-all-hwf.in     |   4 +
 tests/hashtest-256g.in             |   2 +-
 18 files changed, 453 insertions(+), 536 deletions(-)
 create mode 100644 tests/basic-disable-all-hwf.in


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 10:32:23 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 12 Dec 2016 10:32:23 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-87-g522e6f7
Message-ID: <E1cGMyA-00027a-7S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  522e6f798db9f3f3a9e0123fdc389a86ac69dedf (commit)
      from  d568a1561642ed9b7b7b6282b86c56786d10a956 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 522e6f798db9f3f3a9e0123fdc389a86ac69dedf
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 12 09:55:48 2016 +0100

    gpg: Fix algo string parsing of --quick-addkey.
    
    * g10/keygen.c (parse_key_parameter_string): Fix handling of PART==1.
    (parse_key_parameter_part): Use default key size if only "rsa", "dsa",
    or "elg" is given.
    --
    
    The first change is the actual fix.  The second change avoids the
    error "Invalid Curve" when only "rsa" instead of RSA2048 is given.
    
    Fixes-commit: ce29272e24e7b718b8fca9b84bc728e65f3dea24
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keygen.c b/g10/keygen.c
index ebb2d70..80ad0ba 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -2871,7 +2871,7 @@ parse_key_parameter_part (char *string, int for_subkey,
                           char const **r_curve)
 {
   char *flags;
-  int algo = 0;
+  int algo;
   char *endp;
   const char *curve = NULL;
   int ecdh_or_ecdsa = 0;
@@ -2887,7 +2887,8 @@ parse_key_parameter_part (char *string, int for_subkey,
   if (flags)
     *flags++ = 0;
 
-  if (strlen (string) > 3 && digitp (string+3))
+  algo = 0;
+  if (strlen (string) >= 3 && (digitp (string+3) || !string[3]))
     {
       if (!ascii_memcasecmp (string, "rsa", 3))
         algo = PUBKEY_ALGO_RSA;
@@ -2898,9 +2899,14 @@ parse_key_parameter_part (char *string, int for_subkey,
     }
   if (algo)
     {
-      size = strtoul (string+3, &endp, 10);
-      if (size < 512 || size > 16384 || *endp)
-        return gpg_error (GPG_ERR_INV_VALUE);
+      if (!string[3])
+        size = get_keysize_range (algo, NULL, NULL);
+      else
+        {
+          size = strtoul (string+3, &endp, 10);
+          if (size < 512 || size > 16384 || *endp)
+            return gpg_error (GPG_ERR_INV_VALUE);
+        }
     }
   else if ((curve = openpgp_is_curve_supported (string, &algo, &size)))
     {
@@ -3080,8 +3086,9 @@ parse_key_parameter_part (char *string, int for_subkey,
  * used:
  *   -1 := Both parts
  *    0 := Only the part of the primary key
- *    1 := Only the part of the secondary key is parsed but returned
- *         in the args for the primary key (R_ALGO,....)
+ *    1 := If there is one part parse that one, if there are
+ *         two parts parse the second part.  Always return
+ *         in the args for the primary key (R_ALGO,....).
  *
  */
 gpg_error_t
@@ -3133,8 +3140,10 @@ parse_key_parameter_string (const char *string, int part,
     }
   else if (part == 1)
     {
-      err = parse_key_parameter_part (secondary, 1, r_algo, r_size,
-                                      r_keyuse, r_curve);
+      /* If we have SECONDARY, use that part.  If there is only one
+       * part consider this to be the subkey algo.  */
+      err = parse_key_parameter_part (secondary? secondary : primary, 1,
+                                      r_algo, r_size, r_keyuse, r_curve);
     }
 
   xfree (primary);
diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index 31e2a92..7f44ce5 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -3050,7 +3050,7 @@ parse_mdc (IOBUF inp, int pkttype, unsigned long pktlen,
 
 
 /*
- * This packet is internally generated by us (ibn armor.c) to transfer
+ * This packet is internally generated by us (in armor.c) to transfer
  * some information to the lower layer.  To make sure that this packet
  * is really a GPG faked one and not one coming from outside, we
  * first check that there is a unique tag in it.

-----------------------------------------------------------------------

Summary of changes:
 g10/keygen.c       | 27 ++++++++++++++++++---------
 g10/parse-packet.c |  2 +-
 2 files changed, 19 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 10:56:07 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 12 Dec 2016 10:56:07 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-88-gf1304ee
Message-ID: <E1cGNL7-0002zp-RB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f1304ee9b21e6ceac6c13d04ceddd23fadb5c7f1 (commit)
      from  522e6f798db9f3f3a9e0123fdc389a86ac69dedf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f1304ee9b21e6ceac6c13d04ceddd23fadb5c7f1
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 12 10:50:21 2016 +0100

    gpg: Do not use a fixed string for --gpgconf-list:default_pubkey_algo.
    
    * g10/keygen.c (get_default_pubkey_algo): New.
    (parse_key_parameter_string): Use it.
    * g10/gpg.c (gpgconf_list): Take value from new function.
    --
    
    Note that consumers of that gpgconf-list value may need to be adjusted
    to that new value.  It should anyway only be used to display the
    default algorithm.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/gpg.c b/g10/gpg.c
index ddb7715..c087387 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -1832,7 +1832,7 @@ gpgconf_list (const char *configfile)
   /* The next one is an info only item and should match the macros at
      the top of keygen.c  */
   es_printf ("default_pubkey_algo:%lu:\"%s:\n", GC_OPT_FLAG_DEFAULT,
-             "RSA-2048");
+             get_default_pubkey_algo ());
 
   xfree (configfile_esc);
 }
diff --git a/g10/keygen.c b/g10/keygen.c
index 80ad0ba..c1abc70 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -152,6 +152,23 @@ static unsigned int get_keysize_range (int algo,
 
 
 

+/* Return the algo string for a default new key.  */
+const char *
+get_default_pubkey_algo (void)
+{
+  if (opt.def_new_key_algo)
+    {
+      if (*opt.def_new_key_algo && !strchr (opt.def_new_key_algo, ':'))
+        return opt.def_new_key_algo;
+      /* To avoid checking that option every time we delay that until
+       * here.  The only thing we really need to make sure is that
+       * there is no colon in the string so that the --gpgconf-list
+       * command won't mess up its output.  */
+      log_info (_("invalid value for option '%s'\n"), "--default-new-key-algo");
+    }
+  return DEFAULT_STD_KEY_PARAM;
+}
+
 
 static void
 print_status_key_created (int letter, PKT_public_key *pk, const char *handle)
@@ -3122,7 +3139,7 @@ parse_key_parameter_string (const char *string, int part,
 
   if (!string || !*string
       || !strcmp (string, "default") || !strcmp (string, "-"))
-    string = opt.def_new_key_algo? opt.def_new_key_algo : DEFAULT_STD_KEY_PARAM;
+    string = get_default_pubkey_algo ();
   else if (!strcmp (string, "future-default"))
     string = FUTURE_STD_KEY_PARAM;
 
diff --git a/g10/main.h b/g10/main.h
index 1822ee4..5ed501b 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -300,6 +300,7 @@ void keyedit_quick_set_expire (ctrl_t ctrl,
 void show_basic_key_info (KBNODE keyblock);
 
 /*-- keygen.c --*/
+const char *get_default_pubkey_algo (void);
 u32 parse_expire_string(const char *string);
 u32 ask_expire_interval(int object,const char *def_expire);
 u32 ask_expiredate(void);

-----------------------------------------------------------------------

Summary of changes:
 g10/gpg.c    |  2 +-
 g10/keygen.c | 19 ++++++++++++++++++-
 g10/main.h   |  1 +
 3 files changed, 20 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 14:05:13 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 12 Dec 2016 14:05:13 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-89-g98433c7
Message-ID: <E1cGQI7-0003dT-EF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  98433c70431dfbde99b0e89416856d1eef9ebc88 (commit)
      from  f1304ee9b21e6ceac6c13d04ceddd23fadb5c7f1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 98433c70431dfbde99b0e89416856d1eef9ebc88
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 12 14:02:14 2016 +0100

    gpg: Fix memory leak in ecc key generation.
    
    * g10/keygen.c (ecckey_from_sexp): Release curve.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keygen.c b/g10/keygen.c
index c1abc70..c937084 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -1102,7 +1102,7 @@ ecckey_from_sexp (gcry_mpi_t *array, gcry_sexp_t sexp, int algo)
 {
   gpg_error_t err;
   gcry_sexp_t list, l2;
-  char *curve;
+  char *curve = NULL;
   int i;
   const char *oidstr;
   unsigned int nbits;
@@ -1171,6 +1171,7 @@ ecckey_from_sexp (gcry_mpi_t *array, gcry_sexp_t sexp, int algo)
     }
 
  leave:
+  xfree (curve);
   if (err)
     {
       for (i=0; i < 3; i++)

-----------------------------------------------------------------------

Summary of changes:
 g10/keygen.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 16:52:19 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 12 Dec 2016 16:52:19 +0100
Subject: [git] GnuPG - branch, justus/libdns-0,
 updated. gnupg-2.1.16-90-g135d878
Message-ID: <E1cGStp-00031x-LQ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, justus/libdns-0 has been updated
       via  135d878504bb1c1c830ff6183ece31fb6697eda2 (commit)
      from  1e766d35d12daf49cbaff1387c555ed1a3761b69 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 135d878504bb1c1c830ff6183ece31fb6697eda2
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 12 16:48:41 2016 +0100

    New libdns snapshot

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index f29158c..de7fa72 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -4585,10 +4585,11 @@ dns_error_t dns_trace_fput(const struct dns_trace_event *te, const void *data, s
 }
 
 static void dns_trace_setcname(struct dns_trace *trace, const char *host, const struct sockaddr *addr) {
+	struct dns_trace_cname *cname;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_cname *cname = &trace->cnames.base[trace->cnames.p];
+	cname = &trace->cnames.base[trace->cnames.p];
 	dns_strlcpy(cname->host, host, sizeof cname->host);
 	memcpy(&cname->addr, addr, DNS_PP_MIN(dns_sa_len(addr), sizeof cname->addr));
 
@@ -4609,10 +4610,10 @@ static const char *dns_trace_cname(struct dns_trace *trace, const struct sockadd
 }
 
 static void dns_trace_res_submit(struct dns_trace *trace, const char *qname, enum dns_type qtype, enum dns_class qclass, int error) {
+	struct dns_trace_event te;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_RES_SUBMIT);
 	dns_strlcpy(te.res_submit.qname, qname, sizeof te.res_submit.qname);
 	te.res_submit.qtype = qtype;
@@ -4622,25 +4623,27 @@ static void dns_trace_res_submit(struct dns_trace *trace, const char *qname, enu
 }
 
 static void dns_trace_res_fetch(struct dns_trace *trace, const struct dns_packet *packet, int error) {
+	struct dns_trace_event te;
+	const void *data;
+	size_t datasize;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_RES_FETCH);
-	const void *data = (packet)? packet->data : NULL;
-	size_t datasize = (packet)? packet->end : 0;
+	data = (packet)? packet->data : NULL;
+	datasize = (packet)? packet->end : 0;
 	te.res_fetch.error = error;
 	dns_trace_tag_and_put(trace, &te, data, datasize);
 }
 
 static void dns_trace_so_submit(struct dns_trace *trace, const struct dns_packet *packet, const struct sockaddr *haddr, int error) {
+	struct dns_trace_event te;
+	const char *cname;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SO_SUBMIT);
 	memcpy(&te.so_submit.haddr, haddr, DNS_PP_MIN(dns_sa_len(haddr), sizeof te.so_submit.haddr));
-	const char *cname;
 	if ((cname = dns_trace_cname(trace, haddr)))
 		dns_strlcpy(te.so_submit.hname, cname, sizeof te.so_submit.hname);
 	te.so_submit.error = error;
@@ -4648,32 +4651,34 @@ static void dns_trace_so_submit(struct dns_trace *trace, const struct dns_packet
 }
 
 static void dns_trace_so_verify(struct dns_trace *trace, const struct dns_packet *packet, int error) {
+	struct dns_trace_event te;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SO_VERIFY);
 	te.so_verify.error = error;
 	dns_trace_tag_and_put(trace, &te, packet->data, packet->end);
 }
 
 static void dns_trace_so_fetch(struct dns_trace *trace, const struct dns_packet *packet, int error) {
+	struct dns_trace_event te;
+	const void *data;
+	size_t datasize;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SO_FETCH);
-	const void *data = (packet)? packet->data : NULL;
-	size_t datasize = (packet)? packet->end : 0;
+	data = (packet)? packet->data : NULL;
+	datasize = (packet)? packet->end : 0;
 	te.so_fetch.error = error;
 	dns_trace_tag_and_put(trace, &te, data, datasize);
 }
 
 static void dns_trace_sys_connect(struct dns_trace *trace, int fd, int socktype, const struct sockaddr *dst, int error) {
+	struct dns_trace_event te;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SYS_CONNECT);
 	dns_te_initname(&te.sys_connect.src, fd, &getsockname);
 	memcpy(&te.sys_connect.dst, dst, DNS_PP_MIN(dns_sa_len(dst), sizeof te.sys_connect.dst));
@@ -4683,10 +4688,10 @@ static void dns_trace_sys_connect(struct dns_trace *trace, int fd, int socktype,
 }
 
 static void dns_trace_sys_send(struct dns_trace *trace, int fd, int socktype, const void *data, size_t datasize, int error) {
+	struct dns_trace_event te;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SYS_SEND);
 	dns_te_initnames(&te.sys_send.src, &te.sys_send.dst, fd);
 	te.sys_send.socktype = socktype;
@@ -4695,10 +4700,10 @@ static void dns_trace_sys_send(struct dns_trace *trace, int fd, int socktype, co
 }
 
 static void dns_trace_sys_recv(struct dns_trace *trace, int fd, int socktype, const void *data, size_t datasize, int error) {
+	struct dns_trace_event te;
 	if (!trace || !trace->fp)
 		return;
 
-	struct dns_trace_event te;
 	dns_te_init(&te, DNS_TE_SYS_RECV);
 	dns_te_initnames(&te.sys_recv.dst, &te.sys_recv.src, fd);
 	te.sys_recv.socktype = socktype;
@@ -4710,6 +4715,9 @@ static dns_error_t dns_trace_dump_packet(struct dns_trace *trace, const char *pr
 	struct dns_packet *packet = NULL;
 	char *line = NULL, *p;
 	size_t size = 1, skip = 0;
+	struct dns_rr_i records;
+	struct dns_p_lines_i lines;
+	size_t len, count;
 	int error;
 
 	if (!(packet = dns_p_make(datasize, &error)))
@@ -4724,9 +4732,9 @@ resize:
 	line = p;
 	size *= 2;
 
-	struct dns_rr_i records = { 0 };
-	struct dns_p_lines_i lines = { 0 };
-	size_t len, count = 0;
+	memset(&records, 0, sizeof records);
+	memset(&lines, 0, sizeof lines);
+	count = 0;
 
 	while ((len = dns_p_lines(line, size, &error, packet, &records, &lines))) {
 		if (!(len < size)) {
@@ -4899,22 +4907,22 @@ dns_error_t dns_trace_dump(struct dns_trace *trace, FILE *fp) {
 
 			break;
 		case DNS_TE_SYS_CONNECT: {
+			int socktype = te->sys_connect.socktype;
 			fprintf(fp, "dns_sys_connect:\n");
 			dns_trace_dump_meta(trace, "  ", te, state.elapsed, fp);
 			dns_trace_dump_addr(trace, "  src: ", &te->sys_connect.src, fp);
 			dns_trace_dump_addr(trace, "  dst: ", &te->sys_connect.dst, fp);
-			int socktype = te->sys_connect.socktype;
 			fprintf(fp, "  socktype: %d (%s)\n", socktype, ((socktype == SOCK_STREAM)? "SOCK_STREAM" : (socktype == SOCK_DGRAM)? "SOCK_DGRAM" : "?"));
 			dns_trace_dump_error(trace, "  error: ", te->sys_connect.error, fp);
 
 			break;
 		}
 		case DNS_TE_SYS_SEND: {
+			int socktype = te->sys_send.socktype;
 			fprintf(fp, "dns_sys_send:\n");
 			dns_trace_dump_meta(trace, "  ", te, state.elapsed, fp);
 			dns_trace_dump_addr(trace, "  src: ", &te->sys_send.src, fp);
 			dns_trace_dump_addr(trace, "  dst: ", &te->sys_send.dst, fp);
-			int socktype = te->sys_send.socktype;
 			fprintf(fp, "  socktype: %d (%s)\n", socktype, ((socktype == SOCK_STREAM)? "SOCK_STREAM" : (socktype == SOCK_DGRAM)? "SOCK_DGRAM" : "?"));
 			dns_trace_dump_error(trace, "  error: ", te->sys_send.error, fp);
 
@@ -4927,11 +4935,11 @@ dns_error_t dns_trace_dump(struct dns_trace *trace, FILE *fp) {
 			break;
 		}
 		case DNS_TE_SYS_RECV: {
+			int socktype = te->sys_recv.socktype;
 			fprintf(fp, "dns_sys_recv:\n");
 			dns_trace_dump_meta(trace, "  ", te, state.elapsed, fp);
 			dns_trace_dump_addr(trace, "  src: ", &te->sys_recv.src, fp);
 			dns_trace_dump_addr(trace, "  dst: ", &te->sys_recv.dst, fp);
-			int socktype = te->sys_recv.socktype;
 			fprintf(fp, "  socktype: %d (%s)\n", socktype, ((socktype == SOCK_STREAM)? "SOCK_STREAM" : (socktype == SOCK_DGRAM)? "SOCK_DGRAM" : "?"));
 			dns_trace_dump_error(trace, "  error: ", te->sys_recv.error, fp);
 
@@ -7118,8 +7126,11 @@ enum {
 
 	DNS_SO_SOCKS_INIT,
 	DNS_SO_SOCKS_CONN,
+	DNS_SO_SOCKS_HELLO_SEND,
+	DNS_SO_SOCKS_HELLO_RECV,
 	DNS_SO_SOCKS_AUTH_SEND,
 	DNS_SO_SOCKS_AUTH_RECV,
+	DNS_SO_SOCKS_REQUEST_PREPARE,
 	DNS_SO_SOCKS_REQUEST_SEND,
 	DNS_SO_SOCKS_REQUEST_RECV,
 	DNS_SO_SOCKS_REQUEST_RECV_V6,
@@ -7424,6 +7435,30 @@ static _Bool dns_so_tcp_keep(struct dns_socket *so) {
 } /* dns_so_tcp_keep() */
 
 
+/* Convenience functions for sending non-DNS data.  */
+
+/* Set up everything for sending LENGTH octets.  Returns the buffer
+   for the data.  */
+static unsigned char *dns_so_tcp_send_buffer(struct dns_socket *so, size_t length) {
+	/* Skip the length octets, we are not doing DNS.  */
+	so->qout = 2;
+	so->query->end = length;
+	return so->query->data;
+}
+
+/* Set up everything for receiving LENGTH octets.  */
+static void dns_so_tcp_recv_expect(struct dns_socket *so, size_t length) {
+	/* Skip the length octets, we are not doing DNS.  */
+	so->apos = 2;
+	so->alen = length;
+}
+
+/* Returns the buffer containing the received data.  */
+static unsigned char *dns_so_tcp_recv_buffer(struct dns_socket *so) {
+	return so->answer->data;
+}
+
+
 #if defined __clang__
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Warray-bounds"
@@ -7500,10 +7535,7 @@ static int dns_so_tcp_recv(struct dns_socket *so) {
 int dns_so_check(struct dns_socket *so) {
 	int error;
 	size_t n;
-
-	/* XXX */
 	unsigned char *buffer;
-	int method;
 
 retry:
 	switch (so->state) {
@@ -7595,7 +7627,9 @@ retry:
 			goto error;
 
 		so->state++;
-	case DNS_SO_SOCKS_CONN:
+	case DNS_SO_SOCKS_CONN: {
+		unsigned char method;
+
 		error = dns_connect(so->tcp, (struct sockaddr *)so->opts.socks_host, dns_sa_len(so->opts.socks_host));
 		dns_trace_sys_connect(so->trace, so->tcp, SOCK_STREAM, (struct sockaddr *)so->opts.socks_host, error);
 		if (error && error != DNS_EISCONN)
@@ -7609,37 +7643,32 @@ retry:
 		/* Create a new buffer for the handshake.  */
 		dns_p_grow(&so->query);
 
-		/* Skip the two octets length field when
-		   transmitting, send three octets.  */
-		so->qout = 2;
-		so->query->end = 3;
-		buffer = so->query->data;
-
 		/* Negotiate method.  */
+		buffer = dns_so_tcp_send_buffer(so, 3);
 		buffer[0] = 5; /* RFC-1928 VER field.  */
 		buffer[1] = 1; /* NMETHODS */
-		if (0 /* XXX */)
+		if (so->opts.socks_user)
 			method = 2;  /* Method: username/password authentication. */
 		else
 			method = 0;  /* Method: No authentication required. */
 		buffer[2] = method;
 
 		so->state++;
-	case DNS_SO_SOCKS_AUTH_SEND:
+	}
+	case DNS_SO_SOCKS_HELLO_SEND:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
 
-		/* Skip the two length octets, and receive two octets.  */
-		so->apos = 2;
-		so->alen = 2;
-
+		dns_so_tcp_recv_expect(so, 2);
 		so->state++;
-	case DNS_SO_SOCKS_AUTH_RECV:
+	case DNS_SO_SOCKS_HELLO_RECV: {
+		unsigned char method;
+
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
 
-		buffer = so->answer->data;
-		method = 0; /* XXX authentication not yet supported */
+		buffer = dns_so_tcp_recv_buffer(so);
+		method = so->opts.socks_user ? 2 : 0;
 		if (buffer[0] != 5 || buffer[1] != method) {
 			/* Socks server returned wrong version or does
 			   not support our requested method.  */
@@ -7647,12 +7676,67 @@ retry:
 			goto error;
 		}
 
-		/* Skip the two octets length field when
-		   transmitting.  */
-		so->qout = 2;
-		buffer = so->query->data;
+		if (method == 0) {
+			/* No authentication, go ahead and send the
+			   request.  */
+			so->state = DNS_SO_SOCKS_REQUEST_PREPARE;
+			goto retry;
+		}
+
+		/* Prepare username/password sub-negotiation.  */
+		if (! so->opts.socks_password) {
+			error = EINVAL; /* No password given.  */
+			goto error;
+		} else {
+			size_t buflen, ulen, plen;
+
+			ulen = strlen(so->opts.socks_user);
+			plen = strlen(so->opts.socks_password);
+			if (!ulen || ulen > 255 || !plen || plen > 255) {
+				error = EINVAL; /* Credentials too long or too short.  */
+				goto error;
+			}
+
+			buffer = dns_so_tcp_send_buffer(so, 3 + ulen + plen);
+			buffer[0] = 1; /* VER of the sub-negotiation. */
+			buffer[1] = (unsigned char) ulen;
+			buflen = 2;
+			memcpy (buffer+buflen, so->opts.socks_user, ulen);
+			buflen += ulen;
+			buffer[buflen++] = (unsigned char) plen;
+			memcpy (buffer+buflen, so->opts.socks_password, plen);
+		}
+
+		so->state++;
+	}
+	case DNS_SO_SOCKS_AUTH_SEND:
+		if ((error = dns_so_tcp_send(so)))
+			goto error;
 
+		/* Skip the two length octets, and receive two octets.  */
+		dns_so_tcp_recv_expect(so, 2);
+
+		so->state++;
+	case DNS_SO_SOCKS_AUTH_RECV:
+		if ((error = dns_so_tcp_recv(so)))
+			goto error;
+
+		buffer = dns_so_tcp_recv_buffer(so);
+		if (buffer[0] != 1) {
+			/* SOCKS server returned wrong version.  */
+			error = EPROTO;
+			goto error;
+		}
+		if (buffer[1]) {
+			/* SOCKS server denied access.  */
+			error = EACCES;
+			goto error;
+		}
+
+		so->state++;
+	case DNS_SO_SOCKS_REQUEST_PREPARE:
 		/* Send request details (rfc-1928, 4).  */
+		buffer = dns_so_tcp_send_buffer(so, so->remote.ss_family == AF_INET6 ? 22 : 10);
 		buffer[0] = 5; /* VER  */
 		buffer[1] = 1; /* CMD = CONNECT  */
 		buffer[2] = 0; /* RSV  */
@@ -7662,14 +7746,12 @@ retry:
 			buffer[3] = 4; /* ATYP = IPv6 */
 			memcpy (buffer+ 4, &addr_in6->sin6_addr.s6_addr, 16); /* DST.ADDR */
 			memcpy (buffer+20, &addr_in6->sin6_port, 2);          /* DST.PORT */
-			so->query->end = 22;
 		} else {
 			struct sockaddr_in *addr_in = (struct sockaddr_in *)&so->remote;
 
 			buffer[3] = 1; /* ATYP = IPv4 */
 			memcpy (buffer+4, &addr_in->sin_addr.s_addr, 4); /* DST.ADDR */
 			memcpy (buffer+8, &addr_in->sin_port, 2);        /* DST.PORT */
-			so->query->end = 10;
 		}
 
 		so->state++;
@@ -7677,19 +7759,16 @@ retry:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
 
-		/* Skip the two length octets, and receive ten octets.
-		 * This is the length of the response assuming a IPv4
-		 * address is used.  */
-		so->apos = 2;
-		so->alen = 10;
-
+		/* Expect ten octets.  This is the length of the
+		 * response assuming a IPv4 address is used.  */
+		dns_so_tcp_recv_expect(so, 10);
 		so->state++;
 	case DNS_SO_SOCKS_REQUEST_RECV:
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
 
-		buffer = so->answer->data;
-		if (buffer[0] != 5 || buffer[2] != 0 ) {
+		buffer = dns_so_tcp_recv_buffer(so);
+		if (buffer[0] != 5 || buffer[2] != 0) {
 			/* Socks server returned wrong version or the
 			   reserved field is not zero.  */
 			error = EPROTO;
@@ -7737,13 +7816,10 @@ retry:
 			goto error;
 		}
 
-		/* ATYP indicates a v6 address.  Skip the two length
-		 * octets, and receive twelve octets.  This accounts
-		 * for the remaining bytes assuming an IPv6 address is
+		/* Expect receive twelve octets.  This accounts for
+		 * the remaining bytes assuming an IPv6 address is
 		 * used.  */
-		so->apos = 2;
-		so->alen = 12;
-
+		dns_so_tcp_recv_expect(so, 12);
 		so->state++;
 	case DNS_SO_SOCKS_REQUEST_RECV_V6:
 		if ((error = dns_so_tcp_recv(so)))
@@ -9997,6 +10073,8 @@ struct {
 	} memo;
 
 	struct sockaddr_storage socks_host;
+	const char *socks_user;
+	const char *socks_password;
 } MAIN = {
 	.sort	= &dns_rr_i_packet,
 };
@@ -10679,7 +10757,9 @@ static int resolve_query(int argc DNS_NOTUSED, char *argv[]) {
 	resconf()->options.recurse = recurse;
 
 	if (!(R = dns_res_open(resconf(), hosts(), dns_hints_mortal(hints(resconf(), &error)), cache(),
-			       dns_opts(.socks_host=&MAIN.socks_host), &error)))
+			       dns_opts(.socks_host=&MAIN.socks_host,
+					.socks_user=MAIN.socks_user,
+					.socks_password=MAIN.socks_password), &error)))
 		panic("%s: %s", MAIN.qname, dns_strerror(error));
 
 	dns_res_settrace(R, trace("w+b"));
@@ -10966,6 +11046,7 @@ static void print_usage(const char *progname, FILE *fp) {
 		"  -s HOW    Sort records\n"
 		"  -S ADDR   Address of SOCKS server to use\n"
 		"  -P PORT   Port of SOCKS server to use\n"
+		"  -A USER:PASSWORD Credentials for the SOCKS server\n"
 		"  -f PATH   Path to trace file\n"
 		"  -v        Be more verbose (-vv show packets; -vvv hexdump packets)\n"
 		"  -V        Print version info\n"
@@ -11022,7 +11103,7 @@ int main(int argc, char **argv) {
 
 	atexit(&main_exit);
 
-	while (-1 != (ch = getopt(argc, argv, "q:t:c:n:l:z:s:S:P:f:vVh"))) {
+	while (-1 != (ch = getopt(argc, argv, "q:t:c:n:l:z:s:S:P:A:f:vVh"))) {
 		switch (ch) {
 		case 'c':
 			assert(MAIN.resconf.count < lengthof(MAIN.resconf.path));
@@ -11102,6 +11183,18 @@ int main(int argc, char **argv) {
 			*dns_sa_port(MAIN.socks_host.ss_family, &MAIN.socks_host) = htons(atoi(optarg));
 
 			break;
+		case 'A': {
+			char *password;
+			if (! MAIN.socks_host.ss_family)
+				panic("-A without prior -S");
+			if (! (password = strchr(optarg, ':')))
+				panic("Usage: -A USER:PASSWORD");
+			*password = 0;
+			password += 1;
+			MAIN.socks_user = optarg;
+			MAIN.socks_password = password;
+			break;
+		}
 		case 'f':
 			MAIN.trace = optarg;
 
diff --git a/dirmngr/dns.h b/dirmngr/dns.h
index 65911bc..30d0b45 100644
--- a/dirmngr/dns.h
+++ b/dirmngr/dns.h
@@ -533,7 +533,7 @@ struct dns_rr_i {
 
 	int follow;
 
-	int (*sort)();
+	int (*sort)(struct dns_rr *, struct dns_rr *, struct dns_rr_i *, struct dns_packet *);
 	unsigned args[2];
 
 	struct {
@@ -1076,7 +1076,11 @@ struct dns_options {
 	} events;
 
 	/* Use this SOCKS server.  */
-	struct sockaddr_storage *socks_host;
+	const struct sockaddr_storage *socks_host;
+
+	/* Credentials for the SOCKS server (optional).  */
+	const char *socks_user;
+	const char *socks_password;
 }; /* struct dns_options */
 
 

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns.c | 215 +++++++++++++++++++++++++++++++++++++++++-----------------
 dirmngr/dns.h |   8 ++-
 2 files changed, 160 insertions(+), 63 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 18:01:30 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 12 Dec 2016 18:01:30 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-12-g56ab574
Message-ID: <E1cGTym-0006JC-F4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  56ab574c28586fccd95a08acdc9ee4962ab0db50 (commit)
      from  140a19617c78d5f0e2ac8d7e2c8e7092862ec2fb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 56ab574c28586fccd95a08acdc9ee4962ab0db50
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 12 17:55:08 2016 +0100

    New error codes to support libdns.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index f1da8b0..5d24426 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,16 @@ Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
  * Interface changes relative to the 1.25 release:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  GPG_ERR_UNKNOWN_FLAG             NEW.
+ GPG_ERR_INV_ORDER                NEW.
+ GPG_ERR_ALREADY_FETCHED          NEW.
+ GPG_ERR_SYSTEM_BUG               NEW.
+ GPG_ERR_DNS_UNKNOWN	          NEW.
+ GPG_ERR_DNS_SECTION	          NEW.
+ GPG_ERR_DNS_ADDRESS	          NEW.
+ GPG_ERR_DNS_NO_QUERY	          NEW.
+ GPG_ERR_DNS_NO_ANSWER	          NEW.
+ GPG_ERR_DNS_CLOSED	          NEW.
+ GPG_ERR_DNS_VERIFY	          NEW.
 
 
 Noteworthy changes in version 1.25 (2016-11-14) [C20/A20/R0]
diff --git a/doc/errorref.txt b/doc/errorref.txt
index 70d94da..5fffac9 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -1023,6 +1023,50 @@ GPG_ERR_UNKNOWN_FLAG            Unknown flag
     GNUPG: - The flag part of the string given to the
              option --default-new-key-algo value is not known.
 
+GPG_ERR_INV_ORDER               Invalid execution order
+
+    GNUPG: - In Dirmngr used for the libdns error code DNS_EORDER.
+
+GPG_ERR_ALREADY_FETCHED         Already fetched
+
+    GNUPG: - In Dirmngr used for the libdns error code DNS_EFETCHED.
+
+
+GPG_ERR_SYSTEM_BUG              System bug detected
+
+   The underlying operating system misbehaved.  For example it wrote
+   more to a buffer than the told maximum size.
+
+
+GPG_ERR_DNS_UNKNOWN             Unknown DNS error
+
+   Used by Dirmngr for DNS errors from libdns (DNS_EUNKNOWN);
+
+GPG_ERR_DNS_SECTION             Invalid DNS section
+
+   Used by Dirmngr for DNS errors from libdns (DNS_ESECTION);
+
+GPG_ERR_DNS_ADDRESS             Invalid textual address form
+
+   Used by Dirmngr for DNS errors from libdns (DNS_EADDRESS);
+
+GPG_ERR_DNS_NO_QUERY            Missing DNS query packet
+
+   Used by Dirmngr for DNS errors from libdns (DNS_ENOQUERY);
+
+GPG_ERR_DNS_NO_ANSWER           Missing DNS answer packet
+
+   Used by Dirmngr for DNS errors from libdns (DNS_ENOANSWER);
+
+GPG_ERR_DNS_CLOSED              Connection closed in DNS
+
+   Used by Dirmngr for DNS errors from libdns (DNS_ECONNFIN);
+
+GPG_ERR_DNS_VERIFY              Verification failed in DNS
+
+   Used by Dirmngr for DNS errors from libdns (DNS_EVERIFY);
+
+
 
 GPG_ERR_LDAP_GENERAL            LDAP General error
 
diff --git a/src/err-codes.h.in b/src/err-codes.h.in
index 0669d35..b3eaf3c 100644
--- a/src/err-codes.h.in
+++ b/src/err-codes.h.in
@@ -329,8 +329,23 @@
 307	GPG_ERR_TOO_YOUNG		Object is too young
 308	GPG_ERR_TOO_OLD			Object is too old
 309	GPG_ERR_UNKNOWN_FLAG		Unknown flag
+310	GPG_ERR_INV_ORDER		Invalid execution order
+311	GPG_ERR_ALREADY_FETCHED		Already fetched
 # This range is free for use.
 
+666	GPG_ERR_SYSTEM_BUG		System bug detected
+
+#
+# Mapping of some error codes from libdns.
+#
+711	GPG_ERR_DNS_UNKNOWN		Unknown DNS error
+712	GPG_ERR_DNS_SECTION		Invalid DNS section
+713	GPG_ERR_DNS_ADDRESS		Invalid textual address form
+714	GPG_ERR_DNS_NO_QUERY		Missing DNS query packet
+715	GPG_ERR_DNS_NO_ANSWER		Missing DNS answer packet
+716	GPG_ERR_DNS_CLOSED		Connection closed in DNS
+717	GPG_ERR_DNS_VERIFY		Verification failed in DNS
+
 #
 # Mapping of LDAP error codes
 #

-----------------------------------------------------------------------

Summary of changes:
 NEWS               | 10 ++++++++++
 doc/errorref.txt   | 44 ++++++++++++++++++++++++++++++++++++++++++++
 src/err-codes.h.in | 15 +++++++++++++++
 3 files changed, 69 insertions(+)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 12 19:48:08 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 12 Dec 2016 19:48:08 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-13-g90b4dfa
Message-ID: <E1cGVdy-0002iu-DW@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  90b4dfad438900c7808b8c2995ba984fa3587bb2 (commit)
      from  56ab574c28586fccd95a08acdc9ee4962ab0db50 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 90b4dfad438900c7808b8c2995ba984fa3587bb2
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 12 19:26:17 2016 +0100

    New error code GPG_ERR_DNS_TIMEOUT.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 5d24426..3b3ffb2 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
  GPG_ERR_DNS_NO_ANSWER	          NEW.
  GPG_ERR_DNS_CLOSED	          NEW.
  GPG_ERR_DNS_VERIFY	          NEW.
+ GPG_ERR_DNS_TIMEOUT	          NEW.
 
 
 Noteworthy changes in version 1.25 (2016-11-14) [C20/A20/R0]
diff --git a/doc/errorref.txt b/doc/errorref.txt
index 5fffac9..ce626eb 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -293,7 +293,9 @@ GPG_ERR_NOT_SUPPORTED           Not supported
 
 GPG_ERR_INV_OP                  Invalid operation code
 
-GPG_ERR_TIMEOUT                         Timeout
+GPG_ERR_TIMEOUT                 Timeout
+
+    Some function or network access timed out.
 
 GPG_ERR_INTERNAL                Internal error
 
@@ -1066,12 +1068,14 @@ GPG_ERR_DNS_VERIFY              Verification failed in DNS
 
    Used by Dirmngr for DNS errors from libdns (DNS_EVERIFY);
 
+GPG_ERR_DNS_TIMEOUT             DNS Timeout
 
+   A DNS query timed out
 
 GPG_ERR_LDAP_GENERAL            LDAP General error
 
-   Catch all error for LDAP.  Use if if can't map an erro rocde to an
-   gpg-error code.
+   Catch all error for LDAP.  Use when an error code could not be
+   mapped to a gpg-error code.
 
 GPG_ERR_LDAP_ATTR_GENERAL       LDAP General attribute error
 GPG_ERR_LDAP_NAME_GENERAL       LDAP General name error
diff --git a/src/err-codes.h.in b/src/err-codes.h.in
index b3eaf3c..efc40e4 100644
--- a/src/err-codes.h.in
+++ b/src/err-codes.h.in
@@ -336,7 +336,7 @@
 666	GPG_ERR_SYSTEM_BUG		System bug detected
 
 #
-# Mapping of some error codes from libdns.
+# Mapping of some error codes from libdns and other DNS specific error codes
 #
 711	GPG_ERR_DNS_UNKNOWN		Unknown DNS error
 712	GPG_ERR_DNS_SECTION		Invalid DNS section
@@ -345,6 +345,7 @@
 715	GPG_ERR_DNS_NO_ANSWER		Missing DNS answer packet
 716	GPG_ERR_DNS_CLOSED		Connection closed in DNS
 717	GPG_ERR_DNS_VERIFY		Verification failed in DNS
+718	GPG_ERR_DNS_TIMEOUT		DNS Timeout
 
 #
 # Mapping of LDAP error codes

-----------------------------------------------------------------------

Summary of changes:
 NEWS               |  1 +
 doc/errorref.txt   | 10 +++++++---
 src/err-codes.h.in |  3 ++-
 3 files changed, 10 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 13 07:13:35 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 13 Dec 2016 07:13:35 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-90-gab3cdeb
Message-ID: <E1cGgLK-0008ON-8c@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ab3cdeb4414fecb7ebf4cf93e20c2c70a18c52e6 (commit)
      from  98433c70431dfbde99b0e89416856d1eef9ebc88 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ab3cdeb4414fecb7ebf4cf93e20c2c70a18c52e6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Dec 13 15:11:34 2016 +0900

    po: Update Japanese translation.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/po/ja.po b/po/ja.po
index e94e34f..e8f0152 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -8,9 +8,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: gnupg 2.1.15\n"
+"Project-Id-Version: gnupg 2.1.16\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-09-02 16:58+0200\n"
+"PO-Revision-Date: 2016-12-13 15:05+0900\n"
 "Last-Translator: NIIBE Yutaka <gniibe at fsij.org>\n"
 "Language-Team: none\n"
 "Language: ja\n"
@@ -296,10 +296,8 @@ msgstr "??????????? (????????)"
 msgid "run in server mode (foreground)"
 msgstr "?????????? (????????)"
 
-#, fuzzy
-#| msgid "run in server mode"
 msgid "run in supervised mode"
-msgstr "??????????"
+msgstr "???????????????"
 
 msgid "verbose"
 msgstr "??"
@@ -742,10 +740,9 @@ msgstr "??: '%s'???????? \"%s\"\n"
 msgid "Warning: unsafe permissions on %s \"%s\"\n"
 msgstr "??: '%s'???????? \"%s\"\n"
 
-#, fuzzy, c-format
-#| msgid "waiting for the agent to come up ... (%ds)\n"
+#, c-format
 msgid "waiting for file '%s' to become accessible ...\n"
-msgstr "agent???????%d?????\n"
+msgstr "????'%s'??????????????...\n"
 
 #, c-format
 msgid "renaming '%s' to '%s' failed: %s\n"
@@ -1769,6 +1766,9 @@ msgstr "??????????ID???"
 msgid "quickly revoke a user-id"
 msgstr "???????ID???"
 
+msgid "quickly set a new expiration date"
+msgstr "??????????????"
+
 msgid "full featured key pair generation"
 msgstr "??????????"
 
@@ -2025,10 +2025,9 @@ msgstr "?????????????????"
 msgid "show expiration dates during signature listings"
 msgstr "???????????????????"
 
-#, fuzzy, c-format
-#| msgid "invalid argument for option \"%.50s\"\n"
+#, c-format
 msgid "valid values for option '%s':\n"
-msgstr "?????\"%.50s\"?????????\n"
+msgstr "?????'%s'?????:\n"
 
 #, c-format
 msgid "unknown TOFU policy '%s'\n"
@@ -2037,10 +2036,9 @@ msgstr "???TOFU????'%s'\n"
 msgid "(use \"help\" to list choices)\n"
 msgstr "(????????\"help\"????????)\n"
 
-#, fuzzy, c-format
-#| msgid "invalid argument for option \"%.50s\"\n"
+#, c-format
 msgid "invalid value for option '%s'\n"
-msgstr "?????\"%.50s\"?????????\n"
+msgstr "?????'%s'???????\n"
 
 #, c-format
 msgid "Note: old default options file '%s' ignored\n"
@@ -3293,6 +3291,10 @@ msgstr "????????ID???????"
 msgid "Nothing to sign.\n"
 msgstr "?????????????\n"
 
+#, c-format
+msgid "'%s' is not a valid expiration time\n"
+msgstr "'%s'????????????????\n"
+
 msgid "Digest: "
 msgstr "??????: "
 
@@ -4683,24 +4685,18 @@ msgstr "??????????????\n"
 msgid "This key belongs to us\n"
 msgstr "???????????\n"
 
-#, fuzzy, c-format
-#| msgid "root certificate has now been marked as trusted\n"
+#, c-format
 msgid "%s: This key is bad!  It has been marked as untrusted!\n"
-msgstr "??????????????????????\n"
+msgstr "%s: ????????! ????????????????!\n"
 
-#, fuzzy
-#| msgid ""
-#| "It is NOT certain that the key belongs to the person named\n"
-#| "in the user ID.  If you *really* know what you are doing,\n"
-#| "you may answer the next question with yes.\n"
 msgid ""
 "This key has is bad!  It has been marked as untrusted!  If you\n"
 "*really* know what you are doing, you may answer the next\n"
 "question with yes.\n"
 msgstr ""
-"??????????ID?????????????????\n"
-"?????????????????????????????\n"
-"??????no?????????\n"
+"?????????! ????????????????! *???*\n"
+"?????????????????????????? yes ?\n"
+"????????\n"
 
 msgid ""
 "It is NOT certain that the key belongs to the person named\n"
@@ -5306,6 +5302,13 @@ msgid "unsupported TOFU database version: %s\n"
 msgstr "??????????TOFU???????????: %s\n"
 
 #, c-format
+msgid "error creating 'ultimately_trusted_keys' TOFU table: %s\n"
+msgstr "'ultimately_trusted_keys' TOFU?????????: %s\n"
+
+msgid "TOFU DB error"
+msgstr "TOFU DB???"
+
+#, c-format
 msgid "error reading TOFU database: %s\n"
 msgstr "TOFU??????????????: %s\n"
 
@@ -5318,6 +5321,14 @@ msgid "error initializing TOFU database: %s\n"
 msgstr "TOFU?????????????: %s\n"
 
 #, c-format
+msgid "error creating 'encryptions' TOFU table: %s\n"
+msgstr "'encryptions' TOFU????????????: %s\n"
+
+#, c-format
+msgid "adding column effective_policy to bindings DB: %s\n"
+msgstr "???????DB????effective_policy???: %s\n"
+
+#, c-format
 msgid "error opening TOFU database '%s': %s\n"
 msgstr "TOFU??????????????? '%s': %s\n"
 
@@ -5325,42 +5336,35 @@ msgstr "TOFU??????????????? '%s': %s\n"
 msgid "error updating TOFU database: %s\n"
 msgstr "TOFU????????????: %s\n"
 
-#, fuzzy, c-format
-#| msgid "The email address \"%s\" is associated with %d key:\n"
-#| msgid_plural "The email address \"%s\" is associated with %d keys:\n"
+#, c-format
 msgid ""
 "This is the first time the email address \"%s\" is being used with key %s."
-msgstr "?????????\"%s\"?%d????????????:\n"
-
-#, fuzzy, c-format
-#| msgid "The email address \"%s\" is associated with %d key:\n"
-#| msgid_plural "The email address \"%s\" is associated with %d keys:\n"
-msgid "The email address \"%s\" is associated with %d keys!"
-msgstr "?????????\"%s\"?%d????????????:\n"
-
-#, fuzzy
-#| msgid ""
-#| "The key with fingerprint %s raised a conflict with the binding %s.  Since "
-#| "this binding's policy was 'auto', it was changed to 'ask'."
+msgstr ""
+"?????????\"%s\"??%s???????????????"
+
+#, c-format
+msgid "The email address \"%s\" is associated with %d key!"
+msgid_plural "The email address \"%s\" is associated with %d keys!"
+msgstr[0] "?????????\"%s\"?%d????????????!"
+
 msgid "  Since this binding's policy was 'auto', it has been changed to 'ask'."
 msgstr ""
-"???????????%s????????%s?????????????????"
-"?????'auto'??????'ask'?????????"
+"  ??????????????'auto'??????'ask'?????????"
 
 #, c-format
 msgid ""
 "Please indicate whether this email address should be associated with key %s "
 "or whether you think someone is impersonating \"%s\"."
 msgstr ""
+"????????????? %s ???????????????????"
+"\"%s\" ??????????????????????"
 
 #, c-format
 msgid "error gathering other user IDs: %s\n"
 msgstr "??????ID??????: %s\n"
 
-#, fuzzy
-#| msgid "list key and user IDs"
 msgid "This key's user IDs:\n"
-msgstr "?????ID???"
+msgstr "???????ID:\n"
 
 #, c-format
 msgid "policy: %s"
@@ -5380,48 +5384,68 @@ msgid "Statistics for keys with the email address \"%s\":\n"
 msgstr "???????????\"%s\"?????:\n"
 
 msgid ", "
-msgstr ""
+msgstr ", "
 
 msgid "this key"
 msgstr "???"
 
-#, fuzzy, c-format
-#| msgid "Verified %ld messages signed by \"%s\"."
-msgid "Verified %d message"
-msgid_plural "Verified %d messages"
-msgstr[0] "%ld??????????????(\"%s\"????????)?"
+#, c-format
+msgid "Verified %d message."
+msgid_plural "Verified %d messages."
+msgstr[0] "%d???????????????"
 
 #, c-format
-msgid "Encrypted %d message"
-msgid_plural "Encrypted %d messages"
-msgstr[0] ""
+msgid "Encrypted %d message."
+msgid_plural "Encrypted %d messages."
+msgstr[0] "%d????????????????"
+
+#, c-format
+msgid "Verified %d message in the future."
+msgid_plural "Verified %d messages in the future."
+msgstr[0] "%d???????????????????"
+
+#, c-format
+msgid "Encrypted %d message in the future."
+msgid_plural "Encrypted %d messages in the future."
+msgstr[0] "%d????????????????????"
+
+#, c-format
+msgid "Messages verified over the past %d day: %d."
+msgid_plural "Messages verified over the past %d days: %d."
+msgstr[0] "??%d???????????????: %d."
 
-#, fuzzy, c-format
-#| msgid " over the past %ld day."
-#| msgid_plural " over the past %ld days."
-msgid " over the past day."
-msgid_plural " over the past %d days."
-msgstr[0] "??%ld???"
-
-#, fuzzy, c-format
-#| msgid " over the past %ld month."
-#| msgid_plural " over the past %ld months."
-msgid " over the past month."
-msgid_plural " over the past %d months."
-msgstr[0] "??%ld???"
-
-#, fuzzy, c-format
-#| msgid " over the past %ld day."
-#| msgid_plural " over the past %ld days."
-msgid " over the past year."
-msgid_plural " over the past %d years."
-msgstr[0] "??%ld???"
-
-#, fuzzy
-#| msgid " over the past %ld day."
-#| msgid_plural " over the past %ld days."
-msgid " in the past."
-msgstr "??%ld???"
+#, c-format
+msgid "Messages encrypted over the past %d day: %d."
+msgid_plural "Messages encrypted over the past %d days: %d."
+msgstr[0] "??%d????????????????: %d."
+
+#, c-format
+msgid "Messages verified over the past %d month: %d."
+msgid_plural "Messages verified over the past %d months: %d."
+msgstr[0] "??%d????????????????: %d."
+
+#, c-format
+msgid "Messages encrypted over the past %d month: %d."
+msgid_plural "Messages encrypted over the past %d months: %d."
+msgstr[0] "??%d?????????????????: %d."
+
+#, c-format
+msgid "Messages verified over the past %d year: %d."
+msgid_plural "Messages verified over the past %d years: %d."
+msgstr[0] "??%d???????????????: %d."
+
+#, c-format
+msgid "Messages encrypted over the past %d year: %d."
+msgid_plural "Messages encrypted over the past %d years: %d."
+msgstr[0] "??%d????????????????: %d."
+
+#, c-format
+msgid "Messages verified in the past: %d."
+msgstr "?????????????????: %d."
+
+#, c-format
+msgid "Messages encrypted in the past: %d."
+msgstr "??????????????????: %d."
 
 #. TRANSLATORS: Please translate the text found in the source
 #. * file below.  We don't directly internationalize that text so
@@ -5437,133 +5461,103 @@ msgstr "gGaAuUrRbB"
 
 msgid "(G)ood, (A)ccept once, (U)nknown, (R)eject once, (B)ad? "
 msgstr ""
-"(G)ood-?, (A)ccept once-?????, (U)nknown-??, (R)eject once-????"
+"(G)ood-?, (A)ccept once-???????, (U)nknown-??, (R)eject once-????"
 "?, (B)ad-??? "
 
 msgid "Defaulting to unknown."
-msgstr ""
+msgstr "???????????"
 
 msgid "TOFU db corruption detected.\n"
-msgstr ""
+msgstr "TOFU db?????????????????\n"
 
-#, fuzzy, c-format
-#| msgid "error writing key: %s\n"
+#, c-format
 msgid "resetting keydb: %s\n"
-msgstr "?????????: %s\n"
+msgstr "keydb?????: %s\n"
 
 #, c-format
-msgid "error setting TOFU binding's trust level to %s\n"
-msgstr "TOFU??????????????????: %s\n"
+msgid "error setting TOFU binding's policy to %s\n"
+msgstr "TOFU????????????? %s ??????\n"
 
 #, c-format
 msgid "error changing TOFU policy: %s\n"
 msgstr "TOFU??????????: %s\n"
 
-#. TRANSLATORS: The tilde ('~') is used here to indicate a
-#. * non-breakable space
 #, c-format
-msgid "%d~year"
-msgid_plural "%d~years"
-msgstr[0] "%d~?"
+msgid "%lld~year"
+msgid_plural "%lld~years"
+msgstr[0] "%lld?"
 
 #, c-format
-msgid "%d~month"
-msgid_plural "%d~months"
-msgstr[0] "%d~?"
+msgid "%lld~month"
+msgid_plural "%lld~months"
+msgstr[0] "%lld?"
 
 #, c-format
-msgid "%d~day"
-msgid_plural "%d~days"
-msgstr[0] "%d~?"
+msgid "%lld~week"
+msgid_plural "%lld~weeks"
+msgstr[0] "%lld?"
 
 #, c-format
-msgid "%d~hour"
-msgid_plural "%d~hours"
-msgstr[0] "%d~??"
+msgid "%lld~day"
+msgid_plural "%lld~days"
+msgstr[0] "%lld?"
 
 #, c-format
-msgid "%d~minute"
-msgid_plural "%d~minutes"
-msgstr[0] "%d~?"
+msgid "%lld~hour"
+msgid_plural "%lld~hours"
+msgstr[0] "%lld??"
 
 #, c-format
-msgid "%d~second"
-msgid_plural "%d~seconds"
-msgstr[0] "%d~?"
+msgid "%lld~minute"
+msgid_plural "%lld~minutes"
+msgstr[0] "%lld?"
 
 #, c-format
-msgid "%s: "
-msgstr ""
+msgid "%lld~second"
+msgid_plural "%lld~seconds"
+msgstr[0] "%lld?"
 
-#, fuzzy, c-format
-#| msgid "Deleted %d signatures.\n"
-msgid "Verified %ld signatures"
-msgstr "%d????????????\n"
-
-#, fuzzy, c-format
-#| msgid ""
-#| "Verified %ld message signed by \"%s\"\n"
-#| "in the past %s."
-#| msgid_plural ""
-#| "Verified %ld messages signed by \"%s\"\n"
-#| "in the past %s."
-msgid "Verified %ld signature in the past %s"
-msgid_plural "Verified %ld signatures in the past %s"
-msgstr[0] "??????%ld???????(\"%s\"???????????? %s)?"
-
-#, fuzzy, c-format
-#| msgid "encrypted with %lu passphrases\n"
-msgid ", and encrypted %ld messages"
-msgstr "%lu ????????????\n"
+#, c-format
+msgid "%s: Verified 0~signatures and encrypted 0~messages."
+msgstr "%s: 0????????0????????????????"
+
+#, c-format
+msgid "%s: Verified 0 signatures."
+msgstr "%s: 0????????????"
+
+#, c-format
+msgid "%s: Verified %ld~signature in the past %s."
+msgid_plural "%s: Verified %ld~signatures in the past %s."
+msgstr[0] "%s: ???%ld???????(???? %s ?)?"
+
+msgid "Encrypted 0 messages."
+msgstr "0 ????????????????"
+
+#, c-format
+msgid "Encrypted %ld~message in the past %s."
+msgid_plural "Encrypted %ld~messages in the past %s."
+msgstr[0] "??????%ld????????(???? %s ?)?"
+
+msgid "(policy: %s)"
+msgstr "(????: %s)"
 
-#, fuzzy, c-format
-#| msgid ""
-#| "Verified %ld message signed by \"%s\"\n"
-#| "in the past %s."
-#| msgid_plural ""
-#| "Verified %ld messages signed by \"%s\"\n"
-#| "in the past %s."
-msgid ", and encrypted %ld message in the past %s"
-msgid_plural ", and encrypted %ld messages in the past %s"
-msgstr[0] "??????%ld???????(\"%s\"???????????? %s)?"
-
-#, fuzzy
-#| msgid "Warning: we've have yet to see a message signed by this key!\n"
 msgid ""
 "Warning: we have yet to see a message signed using this key and user id!\n"
-msgstr "??: ???????????????????????????!\n"
+msgstr "??: ???????ID????????????????????!\n"
 
-#, fuzzy
-#| msgid "Warning: we've only seen a single message signed by this key!\n"
 msgid ""
 "Warning: we've only seen one message signed using this key and user id!\n"
 msgstr ""
-"??: ???????????????????????????????!\n"
+"??: ???????ID?????????????????????!\n"
 
-#, fuzzy
-#| msgid "Warning: we've have yet to see a message signed by this key!\n"
 msgid "Warning: you have yet to encrypt a message to this key!\n"
-msgstr "??: ???????????????????????????!\n"
+msgstr "??: ???????????????????????????!\n"
 
-#, fuzzy
-#| msgid "Warning: we've only seen a single message signed by this key!\n"
 msgid "Warning: you have only encrypted one message to this key!\n"
 msgstr ""
-"??: ???????????????????????????????!\n"
-
-#, fuzzy, c-format
-#| msgid ""
-#| "Warning: if you think you've seen more than %ld message signed by this "
-#| "key, then this key might be a forgery!  Carefully examine the email "
-#| "address for small variations.  If the key is suspect, then use\n"
-#| "  %s\n"
-#| "to mark it as being bad.\n"
-#| msgid_plural ""
-#| "Warning: if you think you've seen more than %ld messages signed by this "
-#| "key, then this key might be a forgery!  Carefully examine the email "
-#| "address for small variations.  If the key is suspect, then use\n"
-#| "  %s\n"
-#| "to mark it as being bad.\n"
+"??: ????????????????????????????!\n"
+
+#, c-format
 msgid ""
 "Warning: if you think you've seen more signatures by this key and user id, "
 "then this key might be a forgery!  Carefully examine the email address for "
@@ -5577,8 +5571,8 @@ msgid_plural ""
 "  %s\n"
 "to mark it as being bad.\n"
 msgstr[0] ""
-"??: ???????????????%ld???????????????????"
-"???! ??????????????????????????????????"
+"??: ???????ID????????????????????????????"
+"????! ??????????????????????????????????"
 "?????????????\n"
 "  %s\n"
 "??????????????\n"
@@ -5589,12 +5583,11 @@ msgstr "TOFU???????????????: %s\n"
 
 #, c-format
 msgid "WARNING: Encrypting to %s, which has nonon-revoked user ids.\n"
-msgstr ""
+msgstr "*??*: %s ??????????????????ID???????????\n"
 
-#, fuzzy, c-format
-#| msgid "error writing public keyring '%s': %s\n"
+#, c-format
 msgid "error setting policy for key %s, user id \"%s\": %s"
-msgstr "??????'%s'????????: %s\n"
+msgstr "?%s, ???ID \"%s\"???????????: %s"
 
 #, c-format
 msgid "'%s' is not a valid long keyID\n"
@@ -5837,10 +5830,8 @@ msgstr "???RSA???????????????\n"
 msgid "response does not contain the RSA public exponent\n"
 msgstr "???RSA?????????????\n"
 
-#, fuzzy
-#| msgid "response does not contain the EC public point\n"
 msgid "response does not contain the EC public key\n"
-msgstr "????????????????????\n"
+msgstr "????????????????????\n"
 
 msgid "response does not contain the public key data\n"
 msgstr "??????????????????\n"
@@ -7397,7 +7388,7 @@ msgid "allow sending OCSP requests"
 msgstr "OCSP?????????"
 
 msgid "allow online software version check"
-msgstr ""
+msgstr "??????????????????????????"
 
 msgid "inhibit the use of HTTP"
 msgstr "HTTP????????"
@@ -8104,31 +8095,23 @@ msgstr "LDAP???????"
 msgid "Configuration for OCSP"
 msgstr "OCSP???????????"
 
-#, fuzzy
-#| msgid "GPG for OpenPGP"
 msgid "OpenPGP"
-msgstr "OpenPGP????GPG"
+msgstr "OpenPGP"
 
 msgid "Private Keys"
-msgstr ""
+msgstr "???????"
 
-#, fuzzy
-#| msgid "Smartcard Daemon"
 msgid "Smartcards"
-msgstr "????????????"
+msgstr "???????"
 
-#, fuzzy
-#| msgid "GPG for S/MIME"
 msgid "S/MIME"
-msgstr "S/MIME ????GPG"
+msgstr "S/MIME"
 
 msgid "Network"
-msgstr ""
+msgstr "??????"
 
-#, fuzzy
-#| msgid "PIN and Passphrase Entry"
 msgid "Passphrase Entry"
-msgstr "PIN??????????"
+msgstr "????????"
 
 msgid "Component not suitable for launching"
 msgstr "????????????????????????"
@@ -8167,10 +8150,8 @@ msgstr "????????????????????????
 msgid "check global configuration file"
 msgstr "????????????????????????????"
 
-#, fuzzy
-#| msgid "update the trust database"
 msgid "query the software version database"
-msgstr "???????????"
+msgstr "??????????????????????????"
 
 msgid "reload all or a given component"
 msgstr "???????????????????????????"
@@ -8369,10 +8350,6 @@ msgstr ""
 #~ msgid "Known user IDs associated with this key:\n"
 #~ msgstr "????????????????????ID:\n"
 
-#~ msgid "%ld message signed in the future."
-#~ msgid_plural "%ld messages signed in the future."
-#~ msgstr[0] "%ld???????????????????"
-
 #~ msgid "%ld message signed"
 #~ msgid_plural "%ld messages signed"
 #~ msgstr[0] "%ld??????????????"

-----------------------------------------------------------------------

Summary of changes:
 po/ja.po | 373 ++++++++++++++++++++++++++++++---------------------------------
 1 file changed, 175 insertions(+), 198 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 13 15:41:38 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 13 Dec 2016 15:41:38 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-95-g429891a
Message-ID: <E1cGoH0-0006Rb-6x@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  429891a704057437517cb0b45d11392b40fa1ee8 (commit)
       via  d43dabf4607d3bcfc217eb9aea34d093f5aa698f (commit)
       via  1a176b92a8aad42056ed2c4e1f49a5feb40770cf (commit)
       via  fe36e63763c9c595bb057ac50160d2aff7c7a63f (commit)
       via  e3876f16eb237bdeb9f79aca2e7db5e9e2d86686 (commit)
      from  ab3cdeb4414fecb7ebf4cf93e20c2c70a18c52e6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 429891a704057437517cb0b45d11392b40fa1ee8
Author: Justus Winter <justus at g10code.com>
Date:   Thu Nov 17 13:12:38 2016 +0100

    gpgscm: Print failed and skipped tests.
    
    * tests/gpgscm/tests.scm (test-pool::report): Print failed and skipped
    tests at the end.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index b5df9b7..7b8d489 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -538,11 +538,19 @@
 			   (= 99 p::retcode))))
 		procs))
       (define (report)
-	(echo (length procs) "tests run,"
-	      (length (passed)) "succeeded,"
-	      (length (failed)) "failed,"
-	      (length (skipped)) "skipped.")
-	(length (failed)))))))
+	(define (print-tests tests message)
+	  (unless (null? tests)
+		  (apply echo (cons message
+				    (map (lambda (t) t::name) tests)))))
+
+	(let ((failed' (failed)) (skipped' (skipped)))
+	  (echo (length procs) "tests run,"
+		(length (passed)) "succeeded,"
+		(length failed') "failed,"
+		(length skipped') "skipped.")
+	  (print-tests failed' "Failed tests:")
+	  (print-tests skipped' "Skipped tests:")
+	  (length failed')))))))
 
 (define (verbosity n)
   (if (= 0 n) '() (cons '--verbose (verbosity (- n 1)))))

commit d43dabf4607d3bcfc217eb9aea34d093f5aa698f
Author: Justus Winter <justus at g10code.com>
Date:   Thu Nov 17 11:06:42 2016 +0100

    gpgscm: Generalize the test runner.
    
    * tests/gpgscm/tests.scm (test::scm) Add explicit name argument.
    (test::binary): Likewise.  Also, add missing unquote.
    * tests/openpgp/run-tests.scm: Adapt accordingly.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index dd4c69f..b5df9b7 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -553,18 +553,19 @@
 ;; A single test.
 (define test
   (package
-   (define (scm path . args)
+   (define (scm name path . args)
      ;; Start the process.
-     (define (spawn-scm args in out err)
+     (define (spawn-scm args' in out err)
        (spawn-process-fd `(,*argv0* ,@(verbosity (*verbose*))
-				    ,(locate-test path) , at args) in out err))
-     (new (basename path) #f spawn-scm #f #f CLOSED_FD))
+				    ,(locate-test path)
+				    , at args' , at args) in out err))
+     (new name #f spawn-scm #f #f CLOSED_FD))
 
-   (define (binary path . args)
+   (define (binary name path . args)
      ;; Start the process.
-     (define (spawn-binary args in out err)
-       (spawn-process-fd `(path , at args) in out err))
-     (new (basename path) #f spawn-binary #f #f CLOSED_FD))
+     (define (spawn-binary args' in out err)
+       (spawn-process-fd `(,path , at args' , at args) in out err))
+     (new name #f spawn-binary #f #f CLOSED_FD))
 
    (define (new name directory spawn pid retcode logfd)
      (package
diff --git a/tests/openpgp/run-tests.scm b/tests/openpgp/run-tests.scm
index a7c282e..4146411 100644
--- a/tests/openpgp/run-tests.scm
+++ b/tests/openpgp/run-tests.scm
@@ -30,4 +30,5 @@
 		   run-tests-parallel
 		   run-tests-sequential))
        (tests (filter (lambda (arg) (not (string-prefix? arg "--"))) *args*)))
-  (runner (test::scm "setup.scm") (map test::scm tests)))
+  (runner (test::scm "setup.scm" "setup.scm")
+	  (map (lambda (t) (test::scm t t)) tests)))

commit 1a176b92a8aad42056ed2c4e1f49a5feb40770cf
Author: Justus Winter <justus at g10code.com>
Date:   Wed Nov 16 12:32:17 2016 +0100

    gpgscm: Move the test runner to the Scheme library.
    
    * tests/openpgp/run-tests.scm: Move most of the code...
    * tests/gpgscm/tests.scm: ... here.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index d360272..dd4c69f 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -498,3 +498,154 @@
 ;; Spawn an os shell.
 (define (interactive-shell)
   (call-with-fds `(,(getenv "SHELL") -i) 0 1 2))
+
+;;
+;; The main test framework.
+;;
+
+;; A pool of tests.
+(define test-pool
+  (package
+   (define (new procs)
+     (package
+      (define (add test)
+	(new (cons test procs)))
+      (define (wait)
+	(let ((unfinished (filter (lambda (t) (not t::retcode)) procs)))
+	  (if (null? unfinished)
+	      (package)
+	      (let* ((names (map (lambda (t) t::name) unfinished))
+		     (pids (map (lambda (t) t::pid) unfinished))
+		     (results
+		      (map (lambda (pid retcode) (list pid retcode))
+			   pids
+			   (wait-processes (map stringify names) pids #t))))
+		(new
+		 (map (lambda (t)
+			(if t::retcode
+			    t
+			    (t::set-retcode (cadr (assoc t::pid results)))))
+		      procs))))))
+      (define (passed)
+	(filter (lambda (p) (= 0 p::retcode)) procs))
+      (define (skipped)
+	(filter (lambda (p) (= 77 p::retcode)) procs))
+      (define (hard-errored)
+	(filter (lambda (p) (= 99 p::retcode)) procs))
+      (define (failed)
+	(filter (lambda (p)
+		  (not (or (= 0 p::retcode) (= 77 p::retcode)
+			   (= 99 p::retcode))))
+		procs))
+      (define (report)
+	(echo (length procs) "tests run,"
+	      (length (passed)) "succeeded,"
+	      (length (failed)) "failed,"
+	      (length (skipped)) "skipped.")
+	(length (failed)))))))
+
+(define (verbosity n)
+  (if (= 0 n) '() (cons '--verbose (verbosity (- n 1)))))
+
+(define (locate-test path)
+  (if (absolute-path? path) path (in-srcdir path)))
+
+;; A single test.
+(define test
+  (package
+   (define (scm path . args)
+     ;; Start the process.
+     (define (spawn-scm args in out err)
+       (spawn-process-fd `(,*argv0* ,@(verbosity (*verbose*))
+				    ,(locate-test path) , at args) in out err))
+     (new (basename path) #f spawn-scm #f #f CLOSED_FD))
+
+   (define (binary path . args)
+     ;; Start the process.
+     (define (spawn-binary args in out err)
+       (spawn-process-fd `(path , at args) in out err))
+     (new (basename path) #f spawn-binary #f #f CLOSED_FD))
+
+   (define (new name directory spawn pid retcode logfd)
+     (package
+      (define (set-directory x)
+	(new name x spawn pid retcode logfd))
+      (define (set-retcode x)
+	(new name directory spawn pid x logfd))
+      (define (set-pid x)
+	(new name directory spawn x retcode logfd))
+      (define (set-logfd x)
+	(new name directory spawn pid retcode x))
+      (define (open-log-file)
+	(let ((filename (string-append (basename name) ".log")))
+	  (catch '() (unlink filename))
+	  (open filename (logior O_RDWR O_BINARY O_CREAT) #o600)))
+      (define (run-sync . args)
+	(letfd ((log (open-log-file)))
+	  (with-working-directory directory
+	    (let* ((p (inbound-pipe))
+		   (pid (spawn args 0 (:write-end p) (:write-end p))))
+	      (close (:write-end p))
+	      (splice (:read-end p) STDERR_FILENO log)
+	      (close (:read-end p))
+	      (let ((t' (set-retcode (wait-process name pid #t))))
+		(t'::report)
+		t')))))
+      (define (run-sync-quiet . args)
+	(with-working-directory directory
+	  (set-retcode
+	   (wait-process
+	    name (spawn args CLOSED_FD CLOSED_FD CLOSED_FD) #t))))
+      (define (run-async . args)
+	(let ((log (open-log-file)))
+	  (with-working-directory directory
+	    (new name directory spawn
+		 (spawn args CLOSED_FD log log)
+		 retcode log))))
+      (define (status)
+	(let ((t (assoc retcode '((0 "PASS") (77 "SKIP") (99 "ERROR")))))
+	  (if (not t) "FAIL" (cadr t))))
+      (define (report)
+	(unless (= logfd CLOSED_FD)
+		(seek logfd 0 SEEK_SET)
+		(splice logfd STDERR_FILENO)
+		(close logfd))
+	(echo (string-append (status retcode) ":") name))))))
+
+;; Run the setup target to create an environment, then run all given
+;; tests in parallel.
+(define (run-tests-parallel setup tests)
+  (lettmp (gpghome-tar)
+    (setup::run-sync '--create-tarball gpghome-tar)
+    (let loop ((pool (test-pool::new '())) (tests' tests))
+      (if (null? tests')
+	  (let ((results (pool::wait)))
+	    (for-each (lambda (t)
+			(catch (echo "Removing" t::directory "failed:" *error*)
+			       (unlink-recursively t::directory))
+			(t::report)) (reverse results::procs))
+	    (exit (results::report)))
+	  (let* ((wd (mkdtemp))
+		 (test (car tests'))
+		 (test' (test::set-directory wd)))
+	    (loop (pool::add (test'::run-async '--unpack-tarball gpghome-tar))
+		  (cdr tests')))))))
+
+;; Run the setup target to create an environment, then run all given
+;; tests in sequence.
+(define (run-tests-sequential setup tests)
+  (lettmp (gpghome-tar)
+    (setup::run-sync '--create-tarball gpghome-tar)
+    (let loop ((pool (test-pool::new '())) (tests' tests))
+      (if (null? tests')
+	  (let ((results (pool::wait)))
+	    (for-each (lambda (t)
+			(catch (echo "Removing" t::directory "failed:" *error*)
+			       (unlink-recursively t::directory)))
+		      results::procs)
+	    (exit (results::report)))
+	  (let* ((wd (mkdtemp))
+		 (test (car tests'))
+		 (test' (test::set-directory wd)))
+	    (loop (pool::add (test'::run-sync '--unpack-tarball gpghome-tar))
+		  (cdr tests')))))))
diff --git a/tests/openpgp/run-tests.scm b/tests/openpgp/run-tests.scm
index cea50db..a7c282e 100644
--- a/tests/openpgp/run-tests.scm
+++ b/tests/openpgp/run-tests.scm
@@ -26,147 +26,6 @@
 ;; Set objdir so that the tests can locate built programs.
 (setenv "objdir" (getcwd) #f)
 
-(define test-pool
-  (package
-   (define (new procs)
-     (package
-      (define (add test)
-	(new (cons test procs)))
-      (define (wait)
-	(let ((unfinished (filter (lambda (t) (not t::retcode)) procs)))
-	  (if (null? unfinished)
-	      (package)
-	      (let* ((names (map (lambda (t) t::name) unfinished))
-		     (pids (map (lambda (t) t::pid) unfinished))
-		     (results
-		      (map (lambda (pid retcode) (list pid retcode))
-			   pids
-			   (wait-processes (map stringify names) pids #t))))
-		(new
-		 (map (lambda (t)
-			(if t::retcode
-			    t
-			    (t::set-retcode (cadr (assoc t::pid results)))))
-		      procs))))))
-      (define (passed)
-	(filter (lambda (p) (= 0 p::retcode)) procs))
-      (define (skipped)
-	(filter (lambda (p) (= 77 p::retcode)) procs))
-      (define (hard-errored)
-	(filter (lambda (p) (= 99 p::retcode)) procs))
-      (define (failed)
-	(filter (lambda (p)
-		  (not (or (= 0 p::retcode) (= 77 p::retcode)
-			   (= 99 p::retcode))))
-		procs))
-      (define (report)
-	(echo (length procs) "tests run,"
-	      (length (passed)) "succeeded,"
-	      (length (failed)) "failed,"
-	      (length (skipped)) "skipped.")
-	(length (failed)))))))
-
-(define (verbosity n)
-  (if (= 0 n) '() (cons '--verbose (verbosity (- n 1)))))
-
-(define (locate-test path)
-  (if (absolute-path? path) path (in-srcdir path)))
-
-(define test
-  (package
-   (define (scm path . args)
-     ;; Start the process.
-     (define (spawn-scm args in out err)
-       (spawn-process-fd `(,*argv0* ,@(verbosity (*verbose*))
-				    ,(locate-test path) , at args) in out err))
-     (new (basename path) #f spawn-scm #f #f CLOSED_FD))
-
-   (define (binary path . args)
-     ;; Start the process.
-     (define (spawn-binary args in out err)
-       (spawn-process-fd `(path , at args) in out err))
-     (new (basename path) #f spawn-binary #f #f CLOSED_FD))
-
-   (define (new name directory spawn pid retcode logfd)
-     (package
-      (define (set-directory x)
-	(new name x spawn pid retcode logfd))
-      (define (set-retcode x)
-	(new name directory spawn pid x logfd))
-      (define (set-pid x)
-	(new name directory spawn x retcode logfd))
-      (define (set-logfd x)
-	(new name directory spawn pid retcode x))
-      (define (open-log-file)
-	(let ((filename (string-append (basename name) ".log")))
-	  (catch '() (unlink filename))
-	  (open filename (logior O_RDWR O_BINARY O_CREAT) #o600)))
-      (define (run-sync . args)
-	(letfd ((log (open-log-file)))
-	  (with-working-directory directory
-	    (let* ((p (inbound-pipe))
-		   (pid (spawn args 0 (:write-end p) (:write-end p))))
-	      (close (:write-end p))
-	      (splice (:read-end p) STDERR_FILENO log)
-	      (close (:read-end p))
-	      (let ((t' (set-retcode (wait-process name pid #t))))
-		(t'::report)
-		t')))))
-      (define (run-sync-quiet . args)
-	(with-working-directory directory
-	  (set-retcode
-	   (wait-process
-	    name (spawn args CLOSED_FD CLOSED_FD CLOSED_FD) #t))))
-      (define (run-async . args)
-	(let ((log (open-log-file)))
-	  (with-working-directory directory
-	    (new name directory spawn
-		 (spawn args CLOSED_FD log log)
-		 retcode log))))
-      (define (status)
-	(let ((t (assoc retcode '((0 "PASS") (77 "SKIP") (99 "ERROR")))))
-	  (if (not t) "FAIL" (cadr t))))
-      (define (report)
-	(unless (= logfd CLOSED_FD)
-		(seek logfd 0 SEEK_SET)
-		(splice logfd STDERR_FILENO)
-		(close logfd))
-	(echo (string-append (status retcode) ":") name))))))
-
-(define (run-tests-parallel setup tests)
-  (lettmp (gpghome-tar)
-    (setup::run-sync '--create-tarball gpghome-tar)
-    (let loop ((pool (test-pool::new '())) (tests' tests))
-      (if (null? tests')
-	  (let ((results (pool::wait)))
-	    (for-each (lambda (t)
-			(catch (echo "Removing" t::directory "failed:" *error*)
-			       (unlink-recursively t::directory))
-			(t::report)) (reverse results::procs))
-	    (exit (results::report)))
-	  (let* ((wd (mkdtemp))
-		 (test (car tests'))
-		 (test' (test::set-directory wd)))
-	    (loop (pool::add (test'::run-async '--unpack-tarball gpghome-tar))
-		  (cdr tests')))))))
-
-(define (run-tests-sequential setup tests)
-  (lettmp (gpghome-tar)
-    (setup::run-sync '--create-tarball gpghome-tar)
-    (let loop ((pool (test-pool::new '())) (tests' tests))
-      (if (null? tests')
-	  (let ((results (pool::wait)))
-	    (for-each (lambda (t)
-			(catch (echo "Removing" t::directory "failed:" *error*)
-			       (unlink-recursively t::directory)))
-		      results::procs)
-	    (exit (results::report)))
-	  (let* ((wd (mkdtemp))
-		 (test (car tests'))
-		 (test' (test::set-directory wd)))
-	    (loop (pool::add (test'::run-sync '--unpack-tarball gpghome-tar))
-		  (cdr tests')))))))
-
 (let* ((runner (if (member "--parallel" *args*)
 		   run-tests-parallel
 		   run-tests-sequential))

commit fe36e63763c9c595bb057ac50160d2aff7c7a63f
Author: Justus Winter <justus at g10code.com>
Date:   Wed Nov 16 09:19:33 2016 +0100

    tests: Refactor test runner.
    
    * tests/openpgp/run-tests.scm (locate-test): New function.
    (test): Factor-out the code starting the child process.
    (test::binary): New function.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/run-tests.scm b/tests/openpgp/run-tests.scm
index 90879a6..cea50db 100644
--- a/tests/openpgp/run-tests.scm
+++ b/tests/openpgp/run-tests.scm
@@ -36,12 +36,12 @@
 	(let ((unfinished (filter (lambda (t) (not t::retcode)) procs)))
 	  (if (null? unfinished)
 	      (package)
-	      (let* ((commands (map (lambda (t) t::command) unfinished))
+	      (let* ((names (map (lambda (t) t::name) unfinished))
 		     (pids (map (lambda (t) t::pid) unfinished))
 		     (results
 		      (map (lambda (pid retcode) (list pid retcode))
 			   pids
-			   (wait-processes (map stringify commands) pids #t))))
+			   (wait-processes (map stringify names) pids #t))))
 		(new
 		 (map (lambda (t)
 			(if t::retcode
@@ -69,31 +69,43 @@
 (define (verbosity n)
   (if (= 0 n) '() (cons '--verbose (verbosity (- n 1)))))
 
+(define (locate-test path)
+  (if (absolute-path? path) path (in-srcdir path)))
+
 (define test
   (package
-   (define (scm name . args)
-     (new name #f `(,*argv0* ,@(verbosity (*verbose*)) , at args
-			     ,(in-srcdir name)) #f #f CLOSED_FD))
-   (define (new name directory command pid retcode logfd)
+   (define (scm path . args)
+     ;; Start the process.
+     (define (spawn-scm args in out err)
+       (spawn-process-fd `(,*argv0* ,@(verbosity (*verbose*))
+				    ,(locate-test path) , at args) in out err))
+     (new (basename path) #f spawn-scm #f #f CLOSED_FD))
+
+   (define (binary path . args)
+     ;; Start the process.
+     (define (spawn-binary args in out err)
+       (spawn-process-fd `(path , at args) in out err))
+     (new (basename path) #f spawn-binary #f #f CLOSED_FD))
+
+   (define (new name directory spawn pid retcode logfd)
      (package
       (define (set-directory x)
-	(new name x command pid retcode logfd))
+	(new name x spawn pid retcode logfd))
       (define (set-retcode x)
-	(new name directory command pid x logfd))
+	(new name directory spawn pid x logfd))
       (define (set-pid x)
-	(new name directory command x retcode logfd))
+	(new name directory spawn x retcode logfd))
       (define (set-logfd x)
-	(new name directory command pid retcode x))
+	(new name directory spawn pid retcode x))
       (define (open-log-file)
-	(let ((filename (string-append name ".log")))
+	(let ((filename (string-append (basename name) ".log")))
 	  (catch '() (unlink filename))
 	  (open filename (logior O_RDWR O_BINARY O_CREAT) #o600)))
       (define (run-sync . args)
 	(letfd ((log (open-log-file)))
 	  (with-working-directory directory
 	    (let* ((p (inbound-pipe))
-		   (pid (spawn-process-fd (append command args) 0
-					  (:write-end p) (:write-end p))))
+		   (pid (spawn args 0 (:write-end p) (:write-end p))))
 	      (close (:write-end p))
 	      (splice (:read-end p) STDERR_FILENO log)
 	      (close (:read-end p))
@@ -104,13 +116,12 @@
 	(with-working-directory directory
 	  (set-retcode
 	   (wait-process
-	    name (spawn-process-fd (append command args)
-				   CLOSED_FD CLOSED_FD CLOSED_FD) #t))))
+	    name (spawn args CLOSED_FD CLOSED_FD CLOSED_FD) #t))))
       (define (run-async . args)
 	(let ((log (open-log-file)))
 	  (with-working-directory directory
-	    (new name directory command
-		 (spawn-process-fd (append command args) CLOSED_FD log log)
+	    (new name directory spawn
+		 (spawn args CLOSED_FD log log)
 		 retcode log))))
       (define (status)
 	(let ((t (assoc retcode '((0 "PASS") (77 "SKIP") (99 "ERROR")))))

commit e3876f16eb237bdeb9f79aca2e7db5e9e2d86686
Author: Justus Winter <justus at g10code.com>
Date:   Wed Nov 16 12:02:03 2016 +0100

    gpgscm: Improve library functions.
    
    * tests/gpgscm/tests.scm (absolute-path?): New function.
    (canonical-path): Use the new function.
    * tests/gpgscm/lib.scm (string-split-pln): New function.
    (string-indexp, string-splitp): Likewise.
    (string-splitn): Express using the above function.
    (string-ltrim, string-rtrim): Fix corner case.
    (list->string-reversed): New function.
    (read-line): Fix performance.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/lib.scm b/tests/gpgscm/lib.scm
index 4e19eae..fabbef8 100644
--- a/tests/gpgscm/lib.scm
+++ b/tests/gpgscm/lib.scm
@@ -86,18 +86,47 @@
 (assert (equal? #f (string-rindex "Hallo" #\a 2)))
 (assert (equal? #f (string-rindex "Hallo" #\.)))
 
-;; Split haystack at delimiter at most n times.
-(define (string-splitn haystack delimiter n)
+;; Split HAYSTACK at each character that makes PREDICATE true at most
+;; N times.
+(define (string-split-pln haystack predicate lookahead n)
   (let ((length (string-length haystack)))
-    (define (split acc delimiter offset n)
+    (define (split acc offset n)
       (if (>= offset length)
 	  (reverse acc)
-	  (let ((i (string-index haystack delimiter offset)))
+	  (let ((i (lookahead haystack offset)))
 	    (if (or (eq? i #f) (= 0 n))
 		(reverse (cons (substring haystack offset length) acc))
 		(split (cons (substring haystack offset i) acc)
-		       delimiter (+ i 1) (- n 1))))))
-    (split '() delimiter 0 n)))
+		       (+ i 1) (- n 1))))))
+    (split '() 0 n)))
+
+(define (string-indexp haystack offset predicate)
+  (cond
+   ((= (string-length haystack) offset)
+    #f)
+   ((predicate (string-ref haystack offset))
+    offset)
+   (else
+    (string-indexp haystack (+ 1 offset) predicate))))
+
+;; Split HAYSTACK at each character that makes PREDICATE true at most
+;; N times.
+(define (string-splitp haystack predicate n)
+  (string-split-pln haystack predicate
+		    (lambda (haystack offset)
+		      (string-indexp haystack offset predicate))
+		    n))
+(assert (equal? '("a" "b") (string-splitp "a b" char-whitespace? -1)))
+(assert (equal? '("a" "b") (string-splitp "a\tb" char-whitespace? -1)))
+(assert (equal? '("a" "" "b") (string-splitp "a \tb" char-whitespace? -1)))
+
+;; Split haystack at delimiter at most n times.
+(define (string-splitn haystack delimiter n)
+  (string-split-pln haystack
+		    (lambda (c) (char=? c delimiter))
+		    (lambda (haystack offset)
+		      (string-index haystack delimiter offset))
+		    n))
 (assert (= 2 (length (string-splitn "foo:bar:baz" #\: 1))))
 (assert (string=? "foo" (car (string-splitn "foo:bar:baz" #\: 1))))
 (assert (string=? "bar:baz" (cadr (string-splitn "foo:bar:baz" #\: 1))))
@@ -122,25 +151,32 @@
 ;; Trim the prefix of S containing only characters that make PREDICATE
 ;; true.
 (define (string-ltrim predicate s)
-  (let loop ((s' (string->list s)))
-    (if (predicate (car s'))
-	(loop (cdr s'))
-	(list->string s'))))
+  (if (string=? s "")
+      ""
+      (let loop ((s' (string->list s)))
+	(if (predicate (car s'))
+	    (loop (cdr s'))
+	    (list->string s')))))
+(assert (string=? "" (string-ltrim char-whitespace? "")))
 (assert (string=? "foo" (string-ltrim char-whitespace? "  foo")))
 
 ;; Trim the suffix of S containing only characters that make PREDICATE
 ;; true.
 (define (string-rtrim predicate s)
-  (let loop ((s' (reverse (string->list s))))
-    (if (predicate (car s'))
-	(loop (cdr s'))
-	(list->string (reverse s')))))
+  (if (string=? s "")
+      ""
+      (let loop ((s' (reverse (string->list s))))
+	(if (predicate (car s'))
+	    (loop (cdr s'))
+	    (list->string (reverse s'))))))
+(assert (string=? "" (string-rtrim char-whitespace? "")))
 (assert (string=? "foo" (string-rtrim char-whitespace? "foo 	")))
 
 ;; Trim both the prefix and suffix of S containing only characters
 ;; that make PREDICATE true.
 (define (string-trim predicate s)
   (string-ltrim predicate (string-rtrim predicate s)))
+(assert (string=? "" (string-trim char-whitespace? "")))
 (assert (string=? "foo" (string-trim char-whitespace? " 	foo 	")))
 
 ;; Check if needle is contained in haystack.
@@ -162,19 +198,34 @@
 	 (apply read-char p)
 	 '()))))))
 
+(define (list->string-reversed lst)
+  (let* ((len (length lst))
+	 (str (make-string len)))
+    (let loop ((i (- len 1))
+	       (l lst))
+      (if (< i 0)
+	  (begin
+	    (assert (null? l))
+	    str)
+	  (begin
+	    (string-set! str i (car l))
+	    (loop (- i 1) (cdr l)))))))
+
 ;; Read a line from port P.
 (define (read-line . p)
-  (list->string
-   (let f ()
-     (let ((c (apply peek-char p)))
-       (cond
-	((eof-object? c) '())
-	((char=? c #\newline)
-	 (apply read-char p)
-	 '())
-	(else
-	 (apply read-char p)
-	 (cons c (f))))))))
+  (let loop ((acc '()))
+    (let ((c (apply peek-char p)))
+      (cond
+       ((eof-object? c)
+	(if (null? acc)
+	    c ;; #eof
+	    (list->string-reversed acc)))
+       ((char=? c #\newline)
+	(apply read-char p)
+	(list->string-reversed acc))
+       (else
+	(apply read-char p)
+	(loop (cons c acc)))))))
 
 ;; Read everything from port P.
 (define (read-all . p)
diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index bec1922..d360272 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -186,16 +186,19 @@
 (assert (string=? (path-join "foo" "bar" "baz") "foo/bar/baz"))
 (assert (string=? (path-join "" "bar" "baz") "bar/baz"))
 
+;; Is PATH an absolute path?
+(define (absolute-path? path)
+  (or (char=? #\/ (string-ref path 0))
+      (and *win32* (char=? #\\ (string-ref path 0)))
+      (and *win32*
+	   (char-alphabetic? (string-ref path 0))
+	   (char=? #\: (string-ref path 1))
+	   (or (char=? #\/ (string-ref path 2))
+	       (char=? #\\ (string-ref path 2))))))
+
+;; Make PATH absolute.
 (define (canonical-path path)
-  (if (or (char=? #\/ (string-ref path 0))
-	  (and *win32* (char=? #\\ (string-ref path 0)))
-	  (and *win32*
-	       (char-alphabetic? (string-ref path 0))
-	       (char=? #\: (string-ref path 1))
-	       (or (char=? #\/ (string-ref path 2))
-		   (char=? #\\ (string-ref path 2)))))
-      path
-      (path-join (getcwd) path)))
+  (if (absolute-path? path) path (path-join (getcwd) path)))
 
 (define (in-srcdir . names)
   (canonical-path (apply path-join (cons (getenv "srcdir") names))))

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/lib.scm        | 101 ++++++++++++++++++------
 tests/gpgscm/tests.scm      | 181 +++++++++++++++++++++++++++++++++++++++++---
 tests/openpgp/run-tests.scm | 133 +-------------------------------
 3 files changed, 250 insertions(+), 165 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 13 16:47:30 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 13 Dec 2016 16:47:30 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-96-gdd3dde0
Message-ID: <E1cGpIj-0001PW-Gj@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dd3dde07a9a46130ac01d849f8edf0566e44f11f (commit)
      from  429891a704057437517cb0b45d11392b40fa1ee8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dd3dde07a9a46130ac01d849f8edf0566e44f11f
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 13 16:30:47 2016 +0100

    g10: Create expiring keys in quick key generation mode.
    
    * doc/gpg.texi: Document that fact.
    * g10/keygen.c (quick_generate_keypair): Use a default value.
    * tests/openpgp/quick-key-manipulation.scm: Test that fact.
    
    GnuPG-bug-id: 2701
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 3f54fe2..c7c7db6 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -630,6 +630,12 @@ For a description of these optional arguments see the command
 ``cert'' which can be used to create a certification only primary key;
 the default is to a create certification and signing key.
 
+The @code{expire} argument can be used to specify an expiration date
+for the key.  Several formats are supported; commonly the ISO
+YYYY-MM-DD format is used.  The values ``never'', ``none'' can be used
+for no expiration date.  Not specifying a value, or using ``-''
+results in a key expiring in a reasonable default interval.
+
 If this command is used with @option{--batch},
 @option{--pinentry-mode} has been set to @code{loopback}, and one of
 the passphrase options (@option{--passphrase},
diff --git a/g10/keygen.c b/g10/keygen.c
index c937084..9fa4a07 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -3957,6 +3957,8 @@ quick_generate_keypair (ctrl_t ctrl, const char *uid, const char *algostr,
       }
   }
 
+  if (!*expirestr || strcmp (expirestr, "-") == 0)
+    expirestr = default_expiration_interval;
 
   if ((!*algostr || !strcmp (algostr, "default")
        || !strcmp (algostr, "future-default"))
diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index 360c48e..639fd62 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -27,6 +27,13 @@
 (define (exact id)
   (string-append "=" id))
 
+;; Convenient accessors for the colon output.
+(define (:length x) (string->number (list-ref x 2)))
+(define (:alg x) (string->number (list-ref x 3)))
+(define (:expire x) (list-ref x 6))
+(define (:fpr x) (list-ref x 9))
+(define (:cap x) (list-ref x 11))
+
 (define (count-uids-of-secret-key id)
   (length (filter (lambda (x) (and (string=? "uid" (car x))
 				   (not (string=? "r" (cadr x)))))
@@ -47,10 +54,11 @@
 (info "Checking quick key generation...")
 (call-check `(, at GPG --quick-gen-key ,alpha))
 
-(assert (= 1 (count-uids-of-secret-key alpha)))
+(define keyinfo (gpg-with-colons `(-k ,(exact alpha))))
+(define fpr (:fpr (assoc "fpr" keyinfo)))
 
-(define fpr (list-ref (assoc "fpr" (gpg-with-colons `(-k ,(exact alpha))))
-		      9))
+(assert (= 1 (count-uids-of-secret-key alpha)))
+(assert (not (equal? "" (:expire (assoc "pub" keyinfo)))))
 
 (info "Checking that we can add a user ID...")
 
@@ -82,11 +90,10 @@
 (info "Checking that we can change the expiration time.")
 
 (define (expiration-time id)
-  (list-ref (assoc "pub" (gpg-with-colons `(-k ,id)))
-	    6))
+  (:expire (assoc "pub" (gpg-with-colons `(-k ,id)))))
 
-;; XXX This assumes that by default keys are created without
-;; expiration date.  See issue2701.
+;; Remove the expiration date.
+(call-check `(, at gpg --quick-set-expire ,fpr "0"))
 (assert (equal? "" (expiration-time fpr)))
 
 ;; Make the key expire in one year.
@@ -94,10 +101,6 @@
 ;; XXX It'd be nice to check that the value is right.
 (assert (not (equal? "" (expiration-time fpr))))
 
-;; And remove the expiration date.
-(call-check `(, at gpg --quick-set-expire ,fpr "0"))
-(assert (equal? "" (expiration-time fpr)))
-
 
 ;;
 ;; Check --quick-addkey
@@ -111,12 +114,6 @@
 ;; This keeps track of the number of subkeys.
 (define count (length (get-subkeys)))
 
-;; Convenient accessors for the colon output.
-(define (:length x) (string->number (list-ref x 2)))
-(define (:alg x) (string->number (list-ref x 3)))
-(define (:expire x) (list-ref x 6))
-(define (:cap x) (list-ref x 11))
-
 (for-each-p
  "Checking that we can add subkeys..."
  (lambda (args check)

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi                             |  6 ++++++
 g10/keygen.c                             |  2 ++
 tests/openpgp/quick-key-manipulation.scm | 31 ++++++++++++++-----------------
 3 files changed, 22 insertions(+), 17 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 13 17:58:07 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 13 Dec 2016 17:58:07 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-104-gc1c35fb
Message-ID: <E1cGqP6-0004d4-QM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c1c35fb887061de05661f3411eda97546e1a52d7 (commit)
       via  ec1bd3ae685e95563e38077ab3c1655fd55dea07 (commit)
       via  09163a6390bd9713f3a7946de739765b30ef6f64 (commit)
       via  892c827e72b1396e3b58e2f8869cc48328a2b59c (commit)
       via  9147737f1c6894f38b855f3cf38cd33122a1ae2a (commit)
       via  a6d6e4afe488bc05ee730e85da6a9505c6cd245a (commit)
       via  04754ce3a704b1e6d38cb9a28dacf2821dc3f15f (commit)
       via  ca598152345b40f3a236227dfc63ae04ddf777d7 (commit)
      from  dd3dde07a9a46130ac01d849f8edf0566e44f11f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c1c35fb887061de05661f3411eda97546e1a52d7
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 13 17:49:47 2016 +0100

    g10,sm: Spell out --passwd.
    
    * g10/gpg.c (opts): Spell out option.
    * sm/gpgsm.c (opts): Likewise.
    * doc/gpg.texi: Update accordingly.
    * doc/gpgsm.texi: Likewise.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 3b5167d..c5068b9 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1073,8 +1073,8 @@ you want to specify a different revocation reason, or to supply
 supplementary revocation text, you should use the interactive
 sub-command @code{revuid} of @option{--edit-key}.
 
- at item --passwd @var{user_id}
- at opindex passwd
+ at item --change-passphrase @var{user_id}
+ at opindex change-passphrase
 Change the passphrase of the secret key belonging to the certificate
 specified as @var{user_id}.  This is a shortcut for the sub-command
 @code{passwd} of the edit key menu.
diff --git a/doc/gpgsm.texi b/doc/gpgsm.texi
index 2e53a56..d7d3770 100644
--- a/doc/gpgsm.texi
+++ b/doc/gpgsm.texi
@@ -283,8 +283,8 @@ Read information about the private keys from the smartcard and import
 the certificates from there.  This command utilizes the @command{gpg-agent}
 and in turn the @command{scdaemon}.
 
- at item --passwd @var{user_id}
- at opindex passwd
+ at item --change-passphrase @var{user_id}
+ at opindex change-passphrase
 Change the passphrase of the private key belonging to the certificate
 specified as @var{user_id}.  Note, that changing the passphrase/PIN of a
 smartcard is not yet supported.
diff --git a/g10/gpg.c b/g10/gpg.c
index a586388..6003d04 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -474,7 +474,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aLSignKey, "lsign-key"  ,N_("sign a key locally")),
   ARGPARSE_c (aEditKey,  "edit-key"   ,N_("sign or edit a key")),
   ARGPARSE_c (aEditKey,  "key-edit"   ,"@"),
-  ARGPARSE_c (aPasswd,   "passwd",     N_("change a passphrase")),
+  ARGPARSE_c (aPasswd,   "change-passphrase", N_("change a passphrase")),
+  ARGPARSE_c (aPasswd,   "passwd", "@"),
   ARGPARSE_c (aDesigRevoke, "desig-revoke","@" ),
   ARGPARSE_c (aExport, "export"           , N_("export keys") ),
   ARGPARSE_c (aSendKeys, "send-keys"     , N_("export keys to a keyserver") ),
@@ -4243,7 +4244,7 @@ main (int argc, char **argv)
 
       case aPasswd:
         if (argc != 1)
-          wrong_args (_("--passwd <user-id>"));
+          wrong_args (_("--change-passphrase <user-id>"));
         else
           {
             username = make_username (fname);
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index a2ec441..79508e6 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -231,7 +231,8 @@ static ARGPARSE_OPTS opts[] = {
               N_("pass a command to the dirmngr")),
   ARGPARSE_c (aCallProtectTool, "call-protect-tool",
               N_("invoke gpg-protect-tool")),
-  ARGPARSE_c (aPasswd, "passwd", N_("change a passphrase")),
+  ARGPARSE_c (aPasswd, "change-passphrase", N_("change a passphrase")),
+  ARGPARSE_c (aPasswd, "passwd", "@"),
   ARGPARSE_c (aGPGConfList, "gpgconf-list", "@"),
   ARGPARSE_c (aGPGConfTest, "gpgconf-test", "@"),
 
@@ -1995,7 +1996,7 @@ main ( int argc, char **argv)
 
     case aPasswd:
       if (argc != 1)
-        wrong_args ("--passwd <key-Id>");
+        wrong_args ("--change-passphrase <key-Id>");
       else
         {
           int rc;

commit ec1bd3ae685e95563e38077ab3c1655fd55dea07
Author: Justus Winter <justus at g10code.com>
Date:   Tue Dec 13 17:43:22 2016 +0100

    g10: Spell out --gen-revoke.
    
    * g10/gpg.c (opts): Spell out option.
    * doc/gpg.texi: Update accordingly.
    * po: Update translations.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index ff99864..3b5167d 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -698,8 +698,8 @@ mode. See the manual section ``Unattended key generation'' on how
 to use this.
 
 
- at item --gen-revoke @code{name}
- at opindex gen-revoke
+ at item --generate-revocation-certificate @code{name}
+ at opindex generate-revocation-certificate
 Generate a revocation certificate for the complete key.  To only revoke
 a subkey or a key signature, use the @option{--edit} command.
 
diff --git a/g10/gpg.c b/g10/gpg.c
index 02bbdd3..a586388 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -459,7 +459,9 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aFullKeygen,  "full-generate-key" ,
               N_("full featured key pair generation")),
   ARGPARSE_c (aFullKeygen,  "full-gen-key", "@"),
-  ARGPARSE_c (aGenRevoke, "gen-revoke",N_("generate a revocation certificate")),
+  ARGPARSE_c (aGenRevoke, "generate-revocation-certificate",
+	      N_("generate a revocation certificate")),
+  ARGPARSE_c (aGenRevoke, "gen-revoke", "@"),
   ARGPARSE_c (aDeleteKeys,"delete-keys",
               N_("remove keys from the public keyring")),
   ARGPARSE_c (aDeleteSecretKeys, "delete-secret-keys",
@@ -4544,7 +4546,7 @@ main (int argc, char **argv)
 
       case aGenRevoke:
 	if( argc != 1 )
-	    wrong_args("--gen-revoke user-id");
+	    wrong_args("--generate-revocation-certificate user-id");
 	username =  make_username(*argv);
 	gen_revoke( username );
 	xfree( username );
diff --git a/g10/revoke.c b/g10/revoke.c
index 68fc44a..17c9b8c 100644
--- a/g10/revoke.c
+++ b/g10/revoke.c
@@ -571,7 +571,8 @@ gen_standard_revoke (PKT_public_key *psk, const char *cache_nonce)
        "the secret key.  However, if the secret key is still accessible,\n"
        "it is better to generate a new revocation certificate and give\n"
        "a reason for the revocation.  For details see the description of\n"
-       "of the gpg command \"--gen-revoke\" in the GnuPG manual."),
+       "of the gpg command \"--generate-revocation-certificate\" in the "
+       "GnuPG manual."),
      _("To avoid an accidental use of this file, a colon has been inserted\n"
        "before the 5 dashes below.  Remove this colon with a text editor\n"
        "before importing and publishing this revocation certificate."));
diff --git a/po/ca.po b/po/ca.po
index d841639..b4cd9c7 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -5478,7 +5478,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/cs.po b/po/cs.po
index 8e5f60e..f2cb0d7 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -5116,7 +5116,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "Pou?ijte jej pro odvol?n? tohoto kl??e v?p??pad? zneu?it? nebo ztr?ty\n"
 "soukrom?ho kl??e. Av?ak bude-li soukrom? kl?? st?le p??stupn?, bude\n"
diff --git a/po/da.po b/po/da.po
index 94f0719..eed0e6c 100644
--- a/po/da.po
+++ b/po/da.po
@@ -5373,7 +5373,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/de.po b/po/de.po
index d5fbb7b..21dcc87 100644
--- a/po/de.po
+++ b/po/de.po
@@ -5134,14 +5134,14 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "Benutzen Sie es, um einen Schl?ssel zu widerrufen, falls der private\n"
 "Schl?ssel verloren wurde oder kompromittiert ist.  Falls jedoch auf\n"
 "den privaten Schl?ssel noch zugegriffen werden kann, so ist es besser,\n"
 "ein neues Widerrufszertifikat zu erzeugen, um den Grund des Widerrufs\n"
 "mit angeben zu k?nnen.  Weitere Informationen finden Sie im GnuPG\n"
-"Handbuch unter der Beschreibung des gpg Kommandos \"--gen-revoke\"."
+"Handbuch unter der Beschreibung des gpg Kommandos \"--generate-revocation-certificate\"."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/el.po b/po/el.po
index 02e871e..e2b238a 100644
--- a/po/el.po
+++ b/po/el.po
@@ -5360,7 +5360,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/eo.po b/po/eo.po
index 3839b48..0e93051 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -5328,7 +5328,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/es.po b/po/es.po
index a4695cd..64e348e 100644
--- a/po/es.po
+++ b/po/es.po
@@ -5366,7 +5366,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/et.po b/po/et.po
index 7ed6f68..6247351 100644
--- a/po/et.po
+++ b/po/et.po
@@ -5302,7 +5302,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/fi.po b/po/fi.po
index f529d23..83ba0c1 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -5350,7 +5350,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/fr.po b/po/fr.po
index b06d2d0..d88ed36 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -5237,7 +5237,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "Utilisez-le pour r?voquer cette clef en cas de compromis ou de\n"
 "perte de la clef secr?te. Cependant, si la clef secr?te est\n"
diff --git a/po/gl.po b/po/gl.po
index 31e02da..0995161 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -5359,7 +5359,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/hu.po b/po/hu.po
index 8955315..d437321 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -5324,7 +5324,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/id.po b/po/id.po
index 2b1f67c..5b6d49c 100644
--- a/po/id.po
+++ b/po/id.po
@@ -5316,7 +5316,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/it.po b/po/it.po
index 8e4b3ff..2ffcf83 100644
--- a/po/it.po
+++ b/po/it.po
@@ -5344,7 +5344,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ja.po b/po/ja.po
index ba2dd0d..6766470 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -4933,12 +4933,12 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "???????????????????????????????????\n"
 "???????????????????????????????????\n"
 "??????????????????????GnuPG??????gpg???? \"--"
-"gen-revoke\"???????????"
+"generate-revocation-certificate\"???????????"
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/nb.po b/po/nb.po
index 6706183..770768c 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -5008,13 +5008,13 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "Bruk det for ? oppheve denne n?kkelen hvis den blir kompromittert\n"
 "eller hvis du mister den hemmelige n?kkelen. Hvis du fremdeles har\n"
 "tilgang til den hemmelige n?kkelen, er det lurt ? heller lage et nytt\n"
 "opphevelsessertifikat og oppgi en grunn til opphevelsen.\n"
-"Se beskrivelse av kommandoen ?--gen-revoke? i GnuPG-\n"
+"Se beskrivelse av kommandoen ?--generate-revocation-certificate? i GnuPG-\n"
 "bruksanvisninga for detaljer."
 
 msgid ""
diff --git a/po/pl.po b/po/pl.po
index 3ff745a..a6650af 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -5397,7 +5397,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/pt.po b/po/pt.po
index a44b082..51fdc52 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -5329,7 +5329,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ro.po b/po/ro.po
index 422e1e4..ce70c89 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -5344,7 +5344,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ru.po b/po/ru.po
index 43cd056..94052d0 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -5018,12 +5018,12 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "??????????? ?? ??? ?????? ????? ????? ? ?????? ????????? ??? ??????\n"
 "?????????? ?????. ??????, ???? ????????? ???? ????????, ????? ???????\n"
 "????? ?????????? ? ????????? ??????? ??????. ??????????? ??. ? ????????\n"
-"??????? gpg \"--gen-revoke\" ? ??????????? ?? GnuPG."
+"??????? gpg \"--generate-revocation-certificate\" ? ??????????? ?? GnuPG."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/sk.po b/po/sk.po
index c5611a6..4566b3b 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -5337,7 +5337,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/sv.po b/po/sv.po
index 1cc318e..ccc6ee5 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -5463,7 +5463,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/tr.po b/po/tr.po
index 5420cbf..1ab27c9 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -5398,7 +5398,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/uk.po b/po/uk.po
index 3c207e5..4e8e7b5 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -5117,14 +5117,14 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "????????????? ??? ??? ??????????? ????? ????? ? ??????? ????\n"
 "????????????? ??? ?????? ???????? ???????. ????, ???? ?????? ??\n"
 "????????? ????? ?? ????????, ????? ???????? ????? ??????????\n"
 "??????????? ? ??????? ??????? ???????????. ??????????? ????\n"
 "????? ?????? ? ???????? ?????????? ? GnuPG ???? ???????\n"
-"gpg ?--gen-revoke?."
+"gpg ?--generate-revocation-certificate?."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 23b1474..740a7e9 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -5212,7 +5212,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/zh_TW.po b/po/zh_TW.po
index e3e8a3c..0955613 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -5001,7 +5001,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--gen-revoke\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
 msgstr ""
 "??????????, ????????.\n"
 "??, ???????????, ?????\n"

commit 09163a6390bd9713f3a7946de739765b30ef6f64
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 9 15:10:39 2016 +0100

    g10: Spell out --full-gen-key.
    
    * g10/gpg.c (opts): Spell out option.
    (main): Likewise.
    * g10/keygen.c (generate_keypair): Likewise.
    * doc/gpg.texi: Update accordingly.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 3f73754..ff99864 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -688,7 +688,7 @@ the standard command to create a new key.  In addition to the key a
 revocation certificate is created and stored in the
 @file{openpgp-revocs.d} directory below the GnuPG home directory.
 
- at item --full-gen-key
+ at item --full-generate-key
 @opindex gen-key
 Generate a new key pair with dialogs for all options.  This is an
 extended version of @option{--generate-key}.
diff --git a/g10/gpg.c b/g10/gpg.c
index 96a8ab9..02bbdd3 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -456,8 +456,9 @@ static ARGPARSE_OPTS opts[] = {
               N_("quickly revoke a user-id")),
   ARGPARSE_c (aQuickSetExpire,  "quick-set-expire",
               N_("quickly set a new expiration date")),
-  ARGPARSE_c (aFullKeygen,  "full-gen-key" ,
+  ARGPARSE_c (aFullKeygen,  "full-generate-key" ,
               N_("full featured key pair generation")),
+  ARGPARSE_c (aFullKeygen,  "full-gen-key", "@"),
   ARGPARSE_c (aGenRevoke, "gen-revoke",N_("generate a revocation certificate")),
   ARGPARSE_c (aDeleteKeys,"delete-keys",
               N_("remove keys from the public keyring")),
@@ -4342,13 +4343,13 @@ main (int argc, char **argv)
 	if (opt.batch)
           {
 	    if (argc > 1)
-              wrong_args ("--full-gen-key [parameterfile]");
+              wrong_args ("--full-generate-key [parameterfile]");
 	    generate_keypair (ctrl, 1, argc? *argv : NULL, NULL, 0);
           }
 	else
           {
 	    if (argc)
-              wrong_args("--full-gen-key");
+              wrong_args("--full-generate-key");
 	    generate_keypair (ctrl, 1, NULL, NULL, 0);
 	}
 	break;
diff --git a/g10/keygen.c b/g10/keygen.c
index 9fa4a07..b4fddba 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -4319,7 +4319,7 @@ generate_keypair (ctrl_t ctrl, int full, const char *fname,
 #else
                    GPG_NAME
 #endif
-                   , "--full-gen-key" );
+                   , "--full-generate-key" );
 
       err = parse_key_parameter_string (NULL, -1,
                                         &algo, &size, &keyuse, &curve,

commit 892c827e72b1396e3b58e2f8869cc48328a2b59c
Author: Justus Winter <justus at g10code.com>
Date:   Mon Nov 14 16:59:23 2016 +0100

    g10,sm: Spell out --gen-key.
    
    * g10/gpg.c (opts): Spell out option.
    * sm/gpgsm.c (opts): Likewise.
    * doc/gpg.texi: Update accordingly.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/debugging.texi b/doc/debugging.texi
index 7fde49a..42a1a15 100644
--- a/doc/debugging.texi
+++ b/doc/debugging.texi
@@ -235,7 +235,8 @@ gpg: fatal: WriteConsole failed: Access denied
 @noindent
 The solution is to use the command @command{wineconsole}.
 
-Some operations like gen-key really want to talk to the console directly
+Some operations like @option{--generate-key} really want to talk to
+the console directly
 for increased security (for example to prevent the passphrase from
 appearing on the screen).  So, you should use @command{wineconsole}
 instead of @command{wine}, which will launch a windows console that
diff --git a/doc/faq.org b/doc/faq.org
index 22d07f0..8fc3775 100644
--- a/doc/faq.org
+++ b/doc/faq.org
@@ -1243,7 +1243,7 @@ update this FAQ in the next month.  See the section "Changes" for recent updates
 
     To generate a secret/public keypair, run:
 
-    : $ gpg --gen-key
+    : $ gpg --generate-key
 
     and choose the default values.
 
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 015b930..3f73754 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -611,7 +611,7 @@ This section explains the main commands for key management.
 @item --quick-gen-key @code{user-id} [@code{algo} [@code{usage} [@code{expire}]]]
 @opindex quick-gen-key
 This is a simple command to generate a standard key with one user id.
-In contrast to @option{--gen-key} the key is generated directly
+In contrast to @option{--generate-key} the key is generated directly
 without the need to answer a bunch of prompts.  Unless the option
 @option{--yes} is given, the key creation will be canceled if the
 given user id already exists in the keyring.
@@ -681,8 +681,8 @@ for the subkey.  Several formats are supported; commonly the ISO
 YYYY-MM-DD format is used.  The values ``never'', ``none'', or ``-''
 can be used for no expiration date.
 
- at item --gen-key
- at opindex gen-key
+ at item --generate-key
+ at opindex generate-key
 Generate a new key pair using the current default parameters.  This is
 the standard command to create a new key.  In addition to the key a
 revocation certificate is created and stored in the
@@ -691,7 +691,7 @@ revocation certificate is created and stored in the
 @item --full-gen-key
 @opindex gen-key
 Generate a new key pair with dialogs for all options.  This is an
-extended version of @option{--gen-key}.
+extended version of @option{--generate-key}.
 
 There is also a feature which allows you to create keys in batch
 mode. See the manual section ``Unattended key generation'' on how
@@ -1342,7 +1342,7 @@ the opposite meaning. The options are:
 @itemx --disable-large-rsa
 @opindex enable-large-rsa
 @opindex disable-large-rsa
-With --gen-key and --batch, enable the creation of RSA secret keys as
+With --generate-key and --batch, enable the creation of RSA secret keys as
 large as 8192 bit.  Note: 8192 bit is more than is generally
 recommended.  These large keys don't significantly improve security,
 but they are more expensive to use, and their signatures and
@@ -3729,7 +3729,7 @@ are almost always required for this.
 @node Unattended GPG key generation
 @subsection Unattended key generation
 
-The command @option{--gen-key} may be used along with the option
+The command @option{--generate-key} may be used along with the option
 @option{--batch} for unattended key generation.  The parameters are
 either read from stdin or given as a file on the command line.
 The format of the parameter file is as follows:
@@ -3921,7 +3921,7 @@ $ cat >foo <<EOF
      %commit
      %echo done
 EOF
-$ @gpgname --batch --gen-key foo
+$ @gpgname --batch --generate-key foo
  [...]
 $ @gpgname --no-default-keyring --secret-keyring ./foo.sec \
        --keyring ./foo.pub --list-secret-keys
diff --git a/doc/gpgsm.texi b/doc/gpgsm.texi
index e3e852c..2e53a56 100644
--- a/doc/gpgsm.texi
+++ b/doc/gpgsm.texi
@@ -165,8 +165,8 @@ use @samp{--help} to get a list of supported operations.
 @subsection How to manage the certificates and keys
 
 @table @gnupgtabopt
- at item --gen-key
- at opindex gen-key
+ at item --generate-key
+ at opindex generate-key
 This command allows the creation of a certificate signing request or a
 self-signed certificate.  It is commonly used along with the
 @option{--output} option to save the created CSR or certificate into a
@@ -1005,7 +1005,7 @@ this is a missing certificate.
 @node CSR and certificate creation
 @subsection CSR and certificate creation
 
-The command @option{--gen-key} may be used along with the option
+The command @option{--generate-key} may be used along with the option
 @option{--batch} to either create a certificate signing request (CSR)
 or an X.509 certificate.  This is controlled by a parameter file; the
 format of this file is as follows:
diff --git a/doc/howto-create-a-server-cert.texi b/doc/howto-create-a-server-cert.texi
index ea0ce71..55f1a91 100644
--- a/doc/howto-create-a-server-cert.texi
+++ b/doc/howto-create-a-server-cert.texi
@@ -12,7 +12,7 @@ is no need for a configuration file, you may simply enter:
 
 @cartouche
 @example
-  $ gpgsm --gen-key >example.com.cert-req.pem
+  $ gpgsm --generate-key >example.com.cert-req.pem
   Please select what kind of key you want:
      (1) RSA
      (2) Existing key
diff --git a/g10/gpg.c b/g10/gpg.c
index dd959c9..96a8ab9 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -444,8 +444,9 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aCheckKeys, "check-sigs", "@"),
   ARGPARSE_c (oFingerprint, "fingerprint", N_("list keys and fingerprints")),
   ARGPARSE_c (aListSecretKeys, "list-secret-keys", N_("list secret keys")),
-  ARGPARSE_c (aKeygen,	    "gen-key",
+  ARGPARSE_c (aKeygen,	    "generate-key",
               N_("generate a new key pair")),
+  ARGPARSE_c (aKeygen,	    "gen-key", "@"),
   ARGPARSE_c (aQuickKeygen, "quick-gen-key" ,
               N_("quickly generate a new key pair")),
   ARGPARSE_c (aQuickAddUid,  "quick-adduid",
@@ -4318,20 +4319,20 @@ main (int argc, char **argv)
       case aKeygen: /* generate a key */
 	if( opt.batch ) {
 	    if( argc > 1 )
-		wrong_args("--gen-key [parameterfile]");
+		wrong_args("--generate-key [parameterfile]");
 	    generate_keypair (ctrl, 0, argc? *argv : NULL, NULL, 0);
 	}
 	else {
             if (opt.command_fd != -1 && argc)
               {
                 if( argc > 1 )
-                  wrong_args("--gen-key [parameterfile]");
+                  wrong_args("--generate-key [parameterfile]");
 
                 opt.batch = 1;
                 generate_keypair (ctrl, 0, argc? *argv : NULL, NULL, 0);
               }
             else if (argc)
-              wrong_args ("--gen-key");
+              wrong_args ("--generate-key");
             else
               generate_keypair (ctrl, 0, NULL, NULL, 0);
 	}
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index 9582996..a2ec441 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -210,7 +210,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aListSecretKeys, "list-secret-keys", N_("list secret keys")),
   ARGPARSE_c (aListChain,   "list-chain",  N_("list certificate chain")),
   ARGPARSE_c (aFingerprint, "fingerprint", N_("list keys and fingerprints")),
-  ARGPARSE_c (aKeygen, "gen-key", N_("generate a new key pair")),
+  ARGPARSE_c (aKeygen, "generate-key", N_("generate a new key pair")),
+  ARGPARSE_c (aKeygen, "gen-key", "@"),
   ARGPARSE_c (aDeleteKey, "delete-keys",
               N_("remove keys from the public keyring")),
 /*ARGPARSE_c (aSendKeys, "send-keys", N_("export keys to a keyserver")),*/
@@ -1904,7 +1905,7 @@ main ( int argc, char **argv)
             else if (argc == 1) /* From file. */
               fpin = open_es_fread (*argv, "r");
             else
-              wrong_args ("--gen-key --batch [parmfile]");
+              wrong_args ("--generate-key --batch [parmfile]");
           }
 
         fpout = open_es_fwrite (opt.outfile?opt.outfile:"-");
diff --git a/tests/openpgp/genkey1024.scm b/tests/openpgp/genkey1024.scm
index e5008c3..60eba0b 100755
--- a/tests/openpgp/genkey1024.scm
+++ b/tests/openpgp/genkey1024.scm
@@ -23,7 +23,7 @@
 (define (genkey config)
   (pipe:do
    (pipe:echo config)
-   (pipe:spawn `(,(tool 'gpg) --quiet --batch --gen-key))))
+   (pipe:spawn `(,(tool 'gpg) --quiet --batch --generate-key))))
 
 (info "Checking batch key generation")
 (genkey "Key-Type: DSA

commit 9147737f1c6894f38b855f3cf38cd33122a1ae2a
Author: Justus Winter <justus at g10code.com>
Date:   Mon Oct 10 15:20:14 2016 +0200

    g10,sm: Spell out --check-sigs.
    
    * g10/gpg.c (opts): Spell out option.
    * sm/gpgsm.c (opts): Likewise.
    * doc/gpg.texi: Update accordingly.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 5b4584d..015b930 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -320,8 +320,8 @@ notation (see @option{--cert-notation}), "X" for an eXpired signature
 above to indicate trust signature levels (see the @option{--edit-key}
 command "tsign").
 
- at item --check-sigs
- at opindex check-sigs
+ at item --check-signatures
+ at opindex check-signatures
 Same as @option{--list-signatures}, but the signatures are verified.  Note
 that for performance reasons the revocation status of a signing key is
 not shown.
@@ -348,7 +348,7 @@ be used to locate a key.  Only public keys are listed.
 List all keys (or the specified ones) along with their
 fingerprints. This is the same output as @option{--list-keys} but with
 the additional output of a line with the fingerprint. May also be
-combined with @option{--list-signatures} or @option{--check-sigs}.  If this
+combined with @option{--list-signatures} or @option{--check-signatures}.  If this
 command is given twice, the fingerprints of all secondary keys are
 listed too.  This command also forces pretty printing of fingerprints
 if the keyid format has been set to "none".
@@ -1227,7 +1227,7 @@ give the opposite meaning.  The options are:
 
   @item show-policy-urls
   @opindex list-options:show-policy-urls
-  Show policy URLs in the @option{--list-signatures} or @option{--check-sigs}
+  Show policy URLs in the @option{--list-signatures} or @option{--check-signatures}
   listings.  Defaults to no.
 
   @item show-notations
@@ -1237,12 +1237,12 @@ give the opposite meaning.  The options are:
   @opindex list-options:show-std-notations
   @opindex list-options:show-user-notations
   Show all, IETF standard, or user-defined signature notations in the
-  @option{--list-signatures} or @option{--check-sigs} listings. Defaults to no.
+  @option{--list-signatures} or @option{--check-signatures} listings. Defaults to no.
 
   @item show-keyserver-urls
   @opindex list-options:show-keyserver-urls
   Show any preferred keyserver URL in the @option{--list-signatures} or
-  @option{--check-sigs} listings. Defaults to no.
+  @option{--check-signatures} listings. Defaults to no.
 
   @item show-uid-validity
   @opindex list-options:show-uid-validity
@@ -1265,7 +1265,7 @@ give the opposite meaning.  The options are:
   @item show-sig-expire
   @opindex list-options:show-sig-expire
   Show signature expiration dates (if any) during @option{--list-signatures} or
-  @option{--check-sigs} listings. Defaults to no.
+  @option{--check-signatures} listings. Defaults to no.
 
   @item show-sig-subpackets
   @opindex list-options:show-sig-subpackets
@@ -1273,7 +1273,7 @@ give the opposite meaning.  The options are:
   optional argument list of the subpackets to list. If no argument is
   passed, list all subpackets. Defaults to no. This option is only
   meaningful when using @option{--with-colons} along with
-  @option{--list-signatures} or @option{--check-sigs}.
+  @option{--list-signatures} or @option{--check-signatures}.
 
 @end table
 
@@ -3293,7 +3293,7 @@ Identical to @option{--trust-model always}. This option is deprecated.
 @item --show-notation
 @itemx --no-show-notation
 @opindex show-notation
-Show signature notations in the @option{--list-signatures} or @option{--check-sigs} listings
+Show signature notations in the @option{--list-signatures} or @option{--check-signatures} listings
 as well as when verifying a signature with a notation in it. These
 options are deprecated. Use @option{--list-options [no-]show-notation}
 and/or @option{--verify-options [no-]show-notation} instead.
@@ -3301,7 +3301,7 @@ and/or @option{--verify-options [no-]show-notation} instead.
 @item --show-policy-url
 @itemx --no-show-policy-url
 @opindex show-policy-url
-Show policy URLs in the @option{--list-signatures} or @option{--check-sigs}
+Show policy URLs in the @option{--list-signatures} or @option{--check-signatures}
 listings as well as when verifying a signature with a policy URL in
 it. These options are deprecated. Use @option{--list-options
 [no-]show-policy-url} and/or @option{--verify-options
diff --git a/g10/gpg.c b/g10/gpg.c
index 5361d6c..dd959c9 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -439,7 +439,9 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aListKeys, "list-public-keys", "@" ),
   ARGPARSE_c (aListSigs, "list-signatures", N_("list keys and signatures")),
   ARGPARSE_c (aListSigs, "list-sigs", "@"),
-  ARGPARSE_c (aCheckKeys, "check-sigs",N_("list and check key signatures")),
+  ARGPARSE_c (aCheckKeys, "check-signatures",
+	      N_("list and check key signatures")),
+  ARGPARSE_c (aCheckKeys, "check-sigs", "@"),
   ARGPARSE_c (oFingerprint, "fingerprint", N_("list keys and fingerprints")),
   ARGPARSE_c (aListSecretKeys, "list-secret-keys", N_("list secret keys")),
   ARGPARSE_c (aKeygen,	    "gen-key",
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index a25edce..9582996 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -406,7 +406,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aListKeys, "list-key", "@"),
   ARGPARSE_c (aListChain, "list-signatures", "@"),
   ARGPARSE_c (aListChain, "list-sigs", "@"),
-  ARGPARSE_c (aListChain, "check-sig", "@"),
+  ARGPARSE_c (aListChain, "check-signatures", "@"),
   ARGPARSE_c (aListChain, "check-sigs", "@"),
   ARGPARSE_c (aDeleteKey, "delete-key", "@"),
 

commit a6d6e4afe488bc05ee730e85da6a9505c6cd245a
Author: Justus Winter <justus at g10code.com>
Date:   Mon Oct 10 14:55:27 2016 +0200

    g10,sm: Spell out --list-sigs.
    
    * g10/gpg.c (opts): Spell out option.
    * sm/gpgsm.c (opts): Likewise.
    * doc/gpg.texi: Update accordingly.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index b079eda..5b4584d 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -301,8 +301,8 @@ means that the secret key is not usable (for example, if it was
 exported using @option{--export-secret-subkeys}).  See also
 @option{--list-keys}.
 
- at item --list-sigs
- at opindex list-sigs
+ at item --list-signatures
+ at opindex list-signatures
 Same as @option{--list-keys}, but the signatures are listed too.
 This command has the same effect as
 using @option{--list-keys} with @option{--with-sig-list}.
@@ -322,7 +322,7 @@ command "tsign").
 
 @item --check-sigs
 @opindex check-sigs
-Same as @option{--list-sigs}, but the signatures are verified.  Note
+Same as @option{--list-signatures}, but the signatures are verified.  Note
 that for performance reasons the revocation status of a signing key is
 not shown.
 This command has the same effect as
@@ -330,7 +330,7 @@ using @option{--list-keys} with @option{--with-sig-check}.
 
 The status of the verification is indicated by a flag directly following
 the "sig" tag (and thus before the flags described above for
- at option{--list-sigs}).  A "!" indicates that the signature has been
+ at option{--list-signatures}).  A "!" indicates that the signature has been
 successfully verified, a "-" denotes a bad signature and a "%" is used
 if an error occurred while checking the signature (e.g. a non supported
 algorithm).
@@ -348,7 +348,7 @@ be used to locate a key.  Only public keys are listed.
 List all keys (or the specified ones) along with their
 fingerprints. This is the same output as @option{--list-keys} but with
 the additional output of a line with the fingerprint. May also be
-combined with @option{--list-sigs} or @option{--check-sigs}.  If this
+combined with @option{--list-signatures} or @option{--check-sigs}.  If this
 command is given twice, the fingerprints of all secondary keys are
 listed too.  This command also forces pretty printing of fingerprints
 if the keyid format has been set to "none".
@@ -1202,7 +1202,7 @@ Assume "no" on most questions.
 @opindex list-options
 This is a space or comma delimited string that gives options used when
 listing keys and signatures (that is, @option{--list-keys},
- at option{--list-sigs}, @option{--list-public-keys},
+ at option{--list-signatures}, @option{--list-public-keys},
 @option{--list-secret-keys}, and the @option{--edit-key} functions).
 Options can be prepended with a @option{no-} (after the two dashes) to
 give the opposite meaning.  The options are:
@@ -1211,7 +1211,7 @@ give the opposite meaning.  The options are:
 
   @item show-photos
   @opindex list-options:show-photos
-  Causes @option{--list-keys}, @option{--list-sigs},
+  Causes @option{--list-keys}, @option{--list-signatures},
   @option{--list-public-keys}, and @option{--list-secret-keys} to
   display any photo IDs attached to the key.  Defaults to no. See also
   @option{--photo-viewer}.  Does not work with @option{--with-colons}:
@@ -1227,7 +1227,7 @@ give the opposite meaning.  The options are:
 
   @item show-policy-urls
   @opindex list-options:show-policy-urls
-  Show policy URLs in the @option{--list-sigs} or @option{--check-sigs}
+  Show policy URLs in the @option{--list-signatures} or @option{--check-sigs}
   listings.  Defaults to no.
 
   @item show-notations
@@ -1237,11 +1237,11 @@ give the opposite meaning.  The options are:
   @opindex list-options:show-std-notations
   @opindex list-options:show-user-notations
   Show all, IETF standard, or user-defined signature notations in the
-  @option{--list-sigs} or @option{--check-sigs} listings. Defaults to no.
+  @option{--list-signatures} or @option{--check-sigs} listings. Defaults to no.
 
   @item show-keyserver-urls
   @opindex list-options:show-keyserver-urls
-  Show any preferred keyserver URL in the @option{--list-sigs} or
+  Show any preferred keyserver URL in the @option{--list-signatures} or
   @option{--check-sigs} listings. Defaults to no.
 
   @item show-uid-validity
@@ -1264,7 +1264,7 @@ give the opposite meaning.  The options are:
 
   @item show-sig-expire
   @opindex list-options:show-sig-expire
-  Show signature expiration dates (if any) during @option{--list-sigs} or
+  Show signature expiration dates (if any) during @option{--list-signatures} or
   @option{--check-sigs} listings. Defaults to no.
 
   @item show-sig-subpackets
@@ -1273,7 +1273,7 @@ give the opposite meaning.  The options are:
   optional argument list of the subpackets to list. If no argument is
   passed, list all subpackets. Defaults to no. This option is only
   meaningful when using @option{--with-colons} along with
-  @option{--list-sigs} or @option{--check-sigs}.
+  @option{--list-signatures} or @option{--check-sigs}.
 
 @end table
 
@@ -3273,7 +3273,7 @@ on the configuration file.
 @item --show-photos
 @itemx --no-show-photos
 @opindex show-photos
-Causes @option{--list-keys}, @option{--list-sigs},
+Causes @option{--list-keys}, @option{--list-signatures},
 @option{--list-public-keys}, @option{--list-secret-keys}, and verifying
 a signature to also display the photo ID attached to the key, if
 any. See also @option{--photo-viewer}. These options are deprecated. Use
@@ -3293,7 +3293,7 @@ Identical to @option{--trust-model always}. This option is deprecated.
 @item --show-notation
 @itemx --no-show-notation
 @opindex show-notation
-Show signature notations in the @option{--list-sigs} or @option{--check-sigs} listings
+Show signature notations in the @option{--list-signatures} or @option{--check-sigs} listings
 as well as when verifying a signature with a notation in it. These
 options are deprecated. Use @option{--list-options [no-]show-notation}
 and/or @option{--verify-options [no-]show-notation} instead.
@@ -3301,7 +3301,7 @@ and/or @option{--verify-options [no-]show-notation} instead.
 @item --show-policy-url
 @itemx --no-show-policy-url
 @opindex show-policy-url
-Show policy URLs in the @option{--list-sigs} or @option{--check-sigs}
+Show policy URLs in the @option{--list-signatures} or @option{--check-sigs}
 listings as well as when verifying a signature with a policy URL in
 it. These options are deprecated. Use @option{--list-options
 [no-]show-policy-url} and/or @option{--verify-options
diff --git a/g10/gpg.c b/g10/gpg.c
index 6ee755f..5361d6c 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -437,7 +437,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aVerifyFiles, "verify-files" , "@" ),
   ARGPARSE_c (aListKeys, "list-keys", N_("list keys")),
   ARGPARSE_c (aListKeys, "list-public-keys", "@" ),
-  ARGPARSE_c (aListSigs, "list-sigs", N_("list keys and signatures")),
+  ARGPARSE_c (aListSigs, "list-signatures", N_("list keys and signatures")),
+  ARGPARSE_c (aListSigs, "list-sigs", "@"),
   ARGPARSE_c (aCheckKeys, "check-sigs",N_("list and check key signatures")),
   ARGPARSE_c (oFingerprint, "fingerprint", N_("list keys and fingerprints")),
   ARGPARSE_c (aListSecretKeys, "list-secret-keys", N_("list secret keys")),
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index 08d4830..a25edce 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -404,7 +404,7 @@ static ARGPARSE_OPTS opts[] = {
 
   /* Command aliases.  */
   ARGPARSE_c (aListKeys, "list-key", "@"),
-  ARGPARSE_c (aListChain, "list-sig", "@"),
+  ARGPARSE_c (aListChain, "list-signatures", "@"),
   ARGPARSE_c (aListChain, "list-sigs", "@"),
   ARGPARSE_c (aListChain, "check-sig", "@"),
   ARGPARSE_c (aListChain, "check-sigs", "@"),

commit 04754ce3a704b1e6d38cb9a28dacf2821dc3f15f
Author: Justus Winter <justus at g10code.com>
Date:   Fri Sep 23 14:10:07 2016 +0200

    g10: Hyphenate --clearsign.
    
    * g10/gpg.c (opts): Hyphenate option.
    * doc/gpg.texi: Update accordingly.
    * po: Update translations.
    * tests/openpgp: Update tests.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 9ea3b80..b079eda 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -179,8 +179,8 @@ decrypted using a secret key or a passphrase).  The signing key is
 chosen by default or can be set explicitly using the
 @option{--local-user} and @option{--default-key} options.
 
- at item --clearsign
- at opindex clearsign
+ at item --clear-sign
+ at opindex clear-sign
 Make a cleartext signature.  The content in a cleartext signature is
 readable without any special software. OpenPGP software is only needed
 to verify the signature.  cleartext signatures may modify end-of-line
@@ -2521,7 +2521,7 @@ to safely override the algorithm chosen by the recipient key
 preferences, as GPG will only select an algorithm that is usable by
 all recipients.  The most highly ranked digest algorithm in this list
 is also used when signing without encryption
-(e.g. @option{--clearsign} or @option{--sign}).
+(e.g. @option{--clear-sign} or @option{--sign}).
 
 @item --personal-compress-preferences @code{string}
 @opindex personal-compress-preferences
@@ -3464,7 +3464,7 @@ Operation is further controlled by a few environment variables:
 @item gpg -se -r @code{Bob} @code{file}
 sign and encrypt for user Bob
 
- at item gpg --clearsign @code{file}
+ at item gpg --clear-sign @code{file}
 make a cleartext signature
 
 @item gpg -sb @code{file}
diff --git a/g10/gpg.c b/g10/gpg.c
index 7de62fd..6ee755f 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -424,7 +424,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_group (300, N_("@Commands:\n ")),
 
   ARGPARSE_c (aSign, "sign", N_("make a signature")),
-  ARGPARSE_c (aClearsign, "clearsign", N_("make a clear text signature")),
+  ARGPARSE_c (aClearsign, "clear-sign", N_("make a clear text signature")),
+  ARGPARSE_c (aClearsign, "clearsign", "@"),
   ARGPARSE_c (aDetachedSign, "detach-sign", N_("make a detached signature")),
   ARGPARSE_c (aEncr, "encrypt",   N_("encrypt data")),
   ARGPARSE_c (aEncrFiles, "encrypt-files", "@"),
@@ -661,7 +662,7 @@ static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_group (303, N_("@\nExamples:\n\n"
     " -se -r Bob [file]          sign and encrypt for user Bob\n"
-    " --clearsign [file]         make a clear text signature\n"
+    " --clear-sign [file]        make a clear text signature\n"
     " --detach-sign [file]       make a detached signature\n"
     " --list-keys [names]        show keys\n"
     " --fingerprint [names]      show fingerprints\n")),
@@ -3750,7 +3751,7 @@ main (int argc, char **argv)
 	    cmdname="--sign --encrypt";
 	    break;
 	  case aClearsign:
-	    cmdname="--clearsign";
+	    cmdname="--clear-sign";
 	    break;
 	  case aDetachedSign:
 	    cmdname="--detach-sign";
@@ -4137,11 +4138,11 @@ main (int argc, char **argv)
 
       case aClearsign: /* make a clearsig */
 	if( argc > 1 )
-	    wrong_args(_("--clearsign [filename]"));
+	    wrong_args(_("--clear-sign [filename]"));
 	if( (rc = clearsign_file (ctrl, fname, locusr, NULL)) )
           {
             write_status_failure ("sign", rc);
-	    log_error("%s: clearsign failed: %s\n",
+	    log_error("%s: clear-sign failed: %s\n",
                       print_fname_stdin(fname), gpg_strerror (rc) );
           }
 	break;
diff --git a/po/ca.po b/po/ca.po
index 9df52ad..d841639 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -2116,7 +2116,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2125,7 +2125,7 @@ msgstr ""
 "Exemples:\n"
 "\n"
 " -se -r Bob [fitxer]        signa i xifra per a l'usuari Bob\n"
-" --clearsign [fitxer]       crea una signatura en text clar\n"
+" --clear-sign [fitxer]       crea una signatura en text clar\n"
 " --detach-sign [fitxer]     crea una signatura separada\n"
 " --list-keys [noms]         mostra claus\n"
 " --fingerprint [noms]       mostra empremtes digitals\n"
@@ -2561,8 +2561,8 @@ msgstr "no podeu usar %s mentre esteu en mode %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [nom_del_fitxer]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [nom_del_fitxer]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [nom_del_fitxer]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [nom_del_fitxer]"
diff --git a/po/cs.po b/po/cs.po
index 56e61d9..8e5f60e 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -1950,14 +1950,14 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
 msgstr ""
 "@\n"
 " -se -r Bob [soubor]        podepsat a za?ifrovat pro u?ivatele Bob\n"
-" --clearsign [soubor]       vytvo?it podpis ?iteln?ho dokumentu\n"
+" --clear-sign [soubor]       vytvo?it podpis ?iteln?ho dokumentu\n"
 " --detach-sign [soubor]     vytvo?it podpis odd?len? od dokumentu\n"
 " --list-keys [jm?na]        vypsat kl??e\n"
 " --fingerprint [jm?na]      vypsat otisky\n"
@@ -2377,8 +2377,8 @@ msgstr "nelze pou??t --symmetric --sign --encrypt v m?du %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [jm?no souboru]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [jm?no souboru]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [jm?no souboru]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [jm?no souboru]"
diff --git a/po/da.po b/po/da.po
index 018bab0..94f0719 100644
--- a/po/da.po
+++ b/po/da.po
@@ -2063,7 +2063,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2072,7 +2072,7 @@ msgstr ""
 "Eksempler:\n"
 "\n"
 " -se -r Mikael [fil]        underskriv og krypter for bruger Mikael\n"
-" --clearsign [fil]          lav en ren tekstunderskrift\n"
+" --clear-sign [fil]          lav en ren tekstunderskrift\n"
 " --detach-sign [fil]        lav en separat underskrift\n"
 " --list-keys [navne]        vis n?gler\n"
 " --fingerprint [navne]      vis fingeraftryk\n"
@@ -2513,8 +2513,8 @@ msgstr "du kan ikke bruge --symmetric --sign --encrypt i tilstanden %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [filnavn]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [filnavn]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [filnavn]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [filnavn]"
diff --git a/po/de.po b/po/de.po
index aad4cd1..d5fbb7b 100644
--- a/po/de.po
+++ b/po/de.po
@@ -1934,7 +1934,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1943,7 +1943,7 @@ msgstr ""
 "Beispiele:\n"
 "\n"
 " -se -r Bob [Datei]         Signieren und verschl?sseln f?r Benutzer Bob\n"
-" --clearsign [Datei]        Eine Klartextsignatur erzeugen\n"
+" --clear-sign [Datei]        Eine Klartextsignatur erzeugen\n"
 " --detach-sign [Datei]      Eine abgetrennte Signatur erzeugen\n"
 " --list-keys [Namen]        Schl?ssel anzeigen\n"
 " --fingerprint [Namen]      \"Fingerabdr?cke\" anzeigen\n"
@@ -2358,8 +2358,8 @@ msgstr ""
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [Dateiname]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [Dateiname]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [Dateiname]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [Dateiname]"
diff --git a/po/el.po b/po/el.po
index 705cc78..02e871e 100644
--- a/po/el.po
+++ b/po/el.po
@@ -2043,7 +2043,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2052,7 +2052,7 @@ msgstr ""
 "????????????:\n"
 "\n"
 " -se -r Bob [??????]          ???????? ??? ????????????? ??? ?? Bob\n"
-" --clearsign [??????]         ?????????? ?? ???????????????? ?????????\n"
+" --clear-sign [??????]         ?????????? ?? ???????????????? ?????????\n"
 " --detach-sign [??????]       ?????????? ??????????? ?????????\n"
 " --list-keys [???????]        ?????????? ????????\n"
 " --fingerprint [???????]      ?????????? ???????????? (fingerprints)\n"
@@ -2483,8 +2483,8 @@ msgstr "??????????? ? ????? ??? %s ???? ????????
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [????? ???????]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [????? ???????]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [????? ???????]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [????? ???????]"
diff --git a/po/eo.po b/po/eo.po
index 20b047a..3839b48 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -2029,7 +2029,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2038,7 +2038,7 @@ msgstr ""
 "Ekzemploj:\n"
 "\n"
 " -se -r Bob [dosiero]       subskribi kaj ?ifri por uzanto Bob\n"
-" --clearsign [dosiero]      fari klartekstan subskribon\n"
+" --clear-sign [dosiero]      fari klartekstan subskribon\n"
 " --detach-sign [dosiero]    fari apartan subskribon\n"
 " --list-keys [nomoj]        montri ?losilojn\n"
 " --fingerprint [nomoj]      montri fingro?purojn\n"
@@ -2469,8 +2469,8 @@ msgstr "Tiu komando ne eblas en la re?imo %s.\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [dosiero]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [dosiero]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [dosiero]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [dosiero]"
diff --git a/po/es.po b/po/es.po
index 510dedf..a4695cd 100644
--- a/po/es.po
+++ b/po/es.po
@@ -2086,7 +2086,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2095,7 +2095,7 @@ msgstr ""
 "Ejemplos:\n"
 "\n"
 " -se -r Bob [fichero]       firma y cifra para el usuario Bob\n"
-" --clearsign [fichero]      hace una firma manteniendo el texto sin cifrar\n"
+" --clear-sign [fichero]      hace una firma manteniendo el texto sin cifrar\n"
 " --detach-sign [fichero]    hace una firma separada\n"
 " --list-keys [nombres]      muestra las claves\n"
 " --fingerprint [nombres]    muestra las huellas dactilares\n"
@@ -2538,8 +2538,8 @@ msgstr "no puede usar --symmetric --sign --encrypt en modo %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [nombre_fichero]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [nombre_fichero]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [nombre_fichero]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [nombre_fichero]"
diff --git a/po/et.po b/po/et.po
index 8a8e8c2..7ed6f68 100644
--- a/po/et.po
+++ b/po/et.po
@@ -2036,7 +2036,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2045,7 +2045,7 @@ msgstr ""
 "N?ited:\n"
 "\n"
 " -se -r Bob [fail]          allkirjasta ja kr?pti kasutajale Bob\n"
-" --clearsign [fail]         loo avateksti allkiri\n"
+" --clear-sign [fail]         loo avateksti allkiri\n"
 " --detach-sign [fail]       loo eraldiseisev allkiri\n"
 " --list-keys [nimed]        n?ita v?tmeid\n"
 " --fingerprint [nimed]      n?ita s?rmej?lgi\n"
@@ -2468,8 +2468,8 @@ msgstr "%s ei ole moodis %s lubatud.\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [failinimi]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [failinimi]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [failinimi]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [failinimi]"
diff --git a/po/fi.po b/po/fi.po
index d2eefc1..f529d23 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -2052,7 +2052,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2060,7 +2060,7 @@ msgstr ""
 "@\n"
 "Esim:\n"
 " -se -r Pekka [tiedosto]    allekirjoita ja salaa Pekalle\n"
-" --clearsign [tiedosto]     tee tekstimuotoinen allekirjoitus\n"
+" --clear-sign [tiedosto]     tee tekstimuotoinen allekirjoitus\n"
 " --detach-sign [tiedosto]   tee erillinen allekirjoitus\n"
 " --list-keys [nimet]        n?yt? avaimet\n"
 " --fingerprint [nimet]      n?yt? sormenj?ljet\n"
@@ -2484,8 +2484,8 @@ msgstr "valitsinta %s ei voi k?ytt?? %s-tilassa\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [tiedostonimi]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [tiedostonimi]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [tiedostonimi]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [tiedostonimi]"
diff --git a/po/fr.po b/po/fr.po
index 4cb138f..b06d2d0 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -1976,7 +1976,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1985,7 +1985,7 @@ msgstr ""
 "Exemples?:\n"
 "\n"
 " -se -r Alice [fichier]     signer et chiffrer pour l'utilisateur Alice\n"
-" --clearsign [fichier]      faire une signature en texte clair\n"
+" --clear-sign [fichier]      faire une signature en texte clair\n"
 " --detach-sign [fichier]    faire une signature d?tach?e\n"
 " --list-keys [noms]         montrer les clefs\n"
 " --fingerprint [noms]       montrer les empreintes\n"
@@ -2415,8 +2415,8 @@ msgstr "impossible d'utiliser --symmetric --sign --encrypt en mode %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [fichier]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [fichier]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [fichier]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [fichier]"
diff --git a/po/gl.po b/po/gl.po
index 0b5d876..31e02da 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -2044,7 +2044,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2478,8 +2478,8 @@ msgstr "non se pode empregar %s no modo %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [ficheiro]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [ficheiro]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [ficheiro]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [ficheiro]"
diff --git a/po/hu.po b/po/hu.po
index 18228f6..8955315 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -2032,7 +2032,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2041,7 +2041,7 @@ msgstr ""
 "P?ld?k:\n"
 "\n"
 " -se -r Bob [f?jl]          titkos?t?s ?s al??r?s Bob r?sz?re\n"
-" --clearsign [f?jl]         olvashat? sz?veg al??r?sa\n"
+" --clear-sign [f?jl]         olvashat? sz?veg al??r?sa\n"
 " --detach-sign [f?jl]       k?l?n?ll? al??r?s k?sz?t?se\n"
 " --list-keys [nevek]        kulcsok ki?rat?sa\n"
 " --fingerprint [nevek]      ujjlenyomatok ki?rat?sa\n"
@@ -2466,8 +2466,8 @@ msgstr "Lehet, hogy nem haszn?lhatja %s-t %s m?dban!\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [f?jln?v]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [f?jln?v]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [f?jln?v]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [f?jln?v]"
diff --git a/po/id.po b/po/id.po
index fc9af08..2b1f67c 100644
--- a/po/id.po
+++ b/po/id.po
@@ -2035,7 +2035,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2044,7 +2044,7 @@ msgstr ""
 "Contoh:\n"
 "\n"
 " -se -r Bob [file]       tandai dan enkripsi untuk user Bob\n"
-" --clearsign [file]      buat signature berbentuk teks\n"
+" --clear-sign [file]      buat signature berbentuk teks\n"
 " --detach-sign [file]    buat signature detached\n"
 " --list-keys [nama]      tampilkan kunci\n"
 " --fingerprint [nama]    tampilkan fingerprint\n"
@@ -2471,8 +2471,8 @@ msgstr "anda tidak boleh menggunakan %s saat dalam mode %s.\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [namafile]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [namafile]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [namafile]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [namafile]"
diff --git a/po/it.po b/po/it.po
index ea6c820..8e4b3ff 100644
--- a/po/it.po
+++ b/po/it.po
@@ -2042,7 +2042,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2051,7 +2051,7 @@ msgstr ""
 "Esempi:\n"
 "\n"
 " -se -r Bob [file]          firma e cifra per l'utente Bob\n"
-" --clearsign [file]         fai una firma mantenendo il testo in chiaro\n"
+" --clear-sign [file]         fai una firma mantenendo il testo in chiaro\n"
 " --detach-sign [file]       fai una firma separata\n"
 " --list-keys [nomi]         mostra le chiavi\n"
 " --fingerprint [nomi]       mostra le impronte digitali\n"
@@ -2477,8 +2477,8 @@ msgstr "non ? possibile usare %s in modalit? %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [nomefile]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [nomefile]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [nomefile]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [nomefile]"
diff --git a/po/ja.po b/po/ja.po
index e8f0152..ba2dd0d 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -1877,7 +1877,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1886,7 +1886,7 @@ msgstr ""
 "?:\n"
 "\n"
 " -se -r Bob [????]      ???Bob???????\n"
-" --clearsign [????]     ?????????????\n"
+" --clear-sign [????]     ?????????????\n"
 " --detach-sign [????]   ???????\n"
 " --list-keys [??]         ????\n"
 " --fingerprint [??]       ????????????\n"
@@ -2282,8 +2282,8 @@ msgstr "--symmetric --sign --encrypt?%s?????????????
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [?????]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [?????]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [?????]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [?????]"
diff --git a/po/nb.po b/po/nb.po
index c6bfb7f..6706183 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -1888,7 +1888,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1897,7 +1897,7 @@ msgstr ""
 "Eksempler:\n"
 "\n"
 " -se -r Bob [fil]           signer og krypter for brukeren Bob\n"
-" --clearsign [fil]          lag klartekst-signatur\n"
+" --clear-sign [fil]          lag klartekst-signatur\n"
 " --detach-sign [fil]        lag adskilt signatur\n"
 " --list-keys [navn]         vis n?kler\n"
 " --fingerprint [navn]       vis fingeravtrykk\n"
@@ -2295,8 +2295,8 @@ msgstr "du kan ikke velge ?--symmtric?, ?--sign? og ?--encrypt? i ?%s?-m
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [filnavn]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [filnavn]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [filnavn]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [filnavn]"
diff --git a/po/pl.po b/po/pl.po
index 6b77df7..3ff745a 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -2050,7 +2050,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2059,7 +2059,7 @@ msgstr ""
 "Przyk?ady:\n"
 "\n"
 " -se -r Bob [plik]          podpisanie i zaszyfrowanie kluczem Boba\n"
-" --clearsign [plik]         podpisanie z pozostawieniem czytelno?ci "
+" --clear-sign [plik]         podpisanie z pozostawieniem czytelno?ci "
 "dokumentu\n"
 " --detach-sign [plik]       podpisanie z umieszczeniem podpisu w osobnym "
 "pliku\n"
@@ -2520,8 +2520,8 @@ msgstr "nie mo?na u?y? --symmetric --sign --encrypt w trybie %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [plik]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [plik]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [plik]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [plik]"
diff --git a/po/pt.po b/po/pt.po
index f0bbe97..a44b082 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -2038,7 +2038,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2047,7 +2047,7 @@ msgstr ""
 "Exemplos:\n"
 "\n"
 " -se -r Bob [ficheiro]      assinar e cifrar para o utilizador Bob\n"
-" --clearsign [ficheiro]     criar uma assinatura em texto puro\n"
+" --clear-sign [ficheiro]     criar uma assinatura em texto puro\n"
 " --detach-sign [ficheiro]   criar uma assinatura separada\n"
 " --list-keys [nomes]        mostrar chaves\n"
 " --fingerprint [nomes]      mostrar impress?es digitais\n"
@@ -2472,8 +2472,8 @@ msgstr "n?o pode utilizar %s enquanto estiver no modo %s\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [nome_do_ficheiro]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [nome_do_ficheiro]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [nome_do_ficheiro]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [nome_do_ficheiro]"
diff --git a/po/ro.po b/po/ro.po
index ea68dc3..422e1e4 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -2035,7 +2035,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2044,7 +2044,7 @@ msgstr ""
 "Exemple:\n"
 "\n"
 " -se -r Dan [fi?ier]        semneaz? ?i cifreaz? pentru utilizatorul Dan\n"
-" --clearsign [fi?ier]       creaz? o semn?tur? text ?n clar\n"
+" --clear-sign [fi?ier]       creaz? o semn?tur? text ?n clar\n"
 " --detach-sign [fi?ier]     creaz? o semn?tur? deta?at?\n"
 " --list-keys [nume]         arat? chei\n"
 " --fingerprint [nume]       arat? amprente\n"
@@ -2502,8 +2502,8 @@ msgstr "nu pute?i folosi --symmetric --sign --encrypt c?t? vreme ?n modul %s
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [nume_fi?ier]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [nume_fi?ier]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [nume_fi?ier]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [nume_fi?ier]"
diff --git a/po/ru.po b/po/ru.po
index 53bb489..43cd056 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -1895,7 +1895,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1904,7 +1904,7 @@ msgstr ""
 "???????:\n"
 "\n"
 " -se -r ???? [????]          ????????? ? ??????????? ??? ?????????? ????\n"
-" --clearsign [????]         ??????? ????????? ???????\n"
+" --clear-sign [????]         ??????? ????????? ???????\n"
 " --detach-sign [????]       ??????? ?????????? ???????\n"
 " --list-keys [?????]        ???????? ?????\n"
 " --fingerprint [?????]      ???????? ?????????\n"
@@ -2312,8 +2312,8 @@ msgstr "? ?????? %s ?????? ???????????? --symmetric --s
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [????]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [????]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [????]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [????]"
diff --git a/po/sk.po b/po/sk.po
index c44b6c3..c5611a6 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -2045,7 +2045,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2054,7 +2054,7 @@ msgstr ""
 "Pr?klady:\n"
 "\n"
 " -se -r Bob [s?bor]        podp?sa? a za?ifrova? pre u??vate?a Bob\n"
-" --clearsign [s?bor]       vytvori? podpis ?itate?n?ho dokumentu\n"
+" --clear-sign [s?bor]       vytvori? podpis ?itate?n?ho dokumentu\n"
 " --detach-sign [s?bor]     vytvori? podpis oddelen? od dokumentu\n"
 " --list-keys [men?]        vyp?sa? k???e\n"
 " --fingerprint [men?]      vyp?sa? fingerprinty\n"
@@ -2484,8 +2484,8 @@ msgstr ""
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [meno s?boru]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [meno s?boru]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [meno s?boru]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [meno s?boru]"
diff --git a/po/sv.po b/po/sv.po
index de350a1..1cc318e 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -2099,7 +2099,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2108,7 +2108,7 @@ msgstr ""
 "Exempel:\n"
 "\n"
 "-se -r Bosse [fil]          signera och kryptera f?r anv?ndaren Bosse\n"
-"--clearsign [fil]           skapa en klartextsignatur\n"
+"--clear-sign [fil]           skapa en klartextsignatur\n"
 "--detach-sign [fil]         skapa signatur i en separat fil\n"
 "--list-keys [namn]          visa nycklar\n"
 "--fingerprint [namn]        visa fingeravtryck\n"
@@ -2569,8 +2569,8 @@ msgstr ""
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [filnamn]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [filnamn]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [filnamn]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [filnamn]"
diff --git a/po/tr.po b/po/tr.po
index 093de7a..5420cbf 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -2044,7 +2044,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2053,7 +2053,7 @@ msgstr ""
 "?rnekler:\n"
 "\n"
 " -se -r Ali [dosya]         kullan?c? Ali i?in imzalar ve ?ifreler\n"
-" --clearsign [dosya]        a??k?a okunabilir bir imza yapar\n"
+" --clear-sign [dosya]        a??k?a okunabilir bir imza yapar\n"
 " --detach-sign [dosya]      ba??ms?z bir imza yapar\n"
 " --list-keys [isimler]      anahtarlar? listeler\n"
 " --fingerprint [isimler]    parmak izlerini g?sterir\n"
@@ -2500,8 +2500,8 @@ msgstr "%s kipindeyken --symmetric --sign --encrypt kullanamazs?n?z.\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [DOSYA]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [dosyaismi]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [dosyaismi]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [dosyaismi]"
diff --git a/po/uk.po b/po/uk.po
index 65529e2..3c207e5 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -1914,7 +1914,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1924,7 +1924,7 @@ msgstr ""
 "\n"
 " -se -r Bob [????]          ????????? ? ??????????? ???? ??? ??????????? "
 "Bob\n"
-" --clearsign [????]         ???????? ????????? ??????\n"
+" --clear-sign [????]         ???????? ????????? ??????\n"
 " --detach-sign [????]       ???????? ??????????? ??????\n"
 " --list-keys [?????]        ???????? ?????\n"
 " --fingerprint [?????]      ???????? ????????\n"
@@ -2356,8 +2356,8 @@ msgstr ""
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [????? ?????]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [????? ?????]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [????? ?????]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [????? ?????]"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 00025a9..23b1474 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -2005,7 +2005,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2014,7 +2014,7 @@ msgstr ""
 "???\n"
 "\n"
 " -se -r Bob [???]          ? Bob ??????????\n"
-" --clearsign [???]         ??????\n"
+" --clear-sign [???]         ??????\n"
 " --detach-sign [???]       ???????\n"
 " --list-keys [??]           ????\n"
 " --fingerprint [??]         ????\n"
@@ -2447,8 +2447,8 @@ msgstr "???? %s ????? --symmetric --sign -encrypt\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [???]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [???]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [???]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [???]"
diff --git a/po/zh_TW.po b/po/zh_TW.po
index e4a9afb..e3e8a3c 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -1899,7 +1899,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clearsign [file]         make a clear text signature\n"
+" --clear-sign [file]         make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1908,7 +1908,7 @@ msgstr ""
 "??:\n"
 "\n"
 " -se -r Bob [??]          ? Bob ??????????\n"
-" --clearsign [??]         ??????\n"
+" --clear-sign [??]         ??????\n"
 " --detach-sign [??]       ???????\n"
 " --list-keys [??]         ????\n"
 " --fingerprint [??]       ????\n"
@@ -2307,8 +2307,8 @@ msgstr "???? %s ????? --symmetric --sign --encrypt\n"
 msgid "--sign --symmetric [filename]"
 msgstr "--sign --symmetric [??]"
 
-msgid "--clearsign [filename]"
-msgstr "--clearsign [??]"
+msgid "--clear-sign [filename]"
+msgstr "--clear-sign [??]"
 
 msgid "--decrypt [filename]"
 msgstr "--decrypt [??]"
diff --git a/tests/openpgp/clearsig.scm b/tests/openpgp/clearsig.scm
index 7b95561..cdbf603 100755
--- a/tests/openpgp/clearsig.scm
+++ b/tests/openpgp/clearsig.scm
@@ -37,7 +37,7 @@
 	;; Otherwise, we do check that we recover the original file.
 	check-identity)
     source
-    (check-signing '(--passphrase-fd "0" --clearsign) usrpass1)))
+    (check-signing '(--passphrase-fd "0" --clear-sign) usrpass1)))
  (append plain-files '("plain-large")))
 
 ;; The test vectors are lists of length three, containing
@@ -102,7 +102,7 @@ there is a blank line after this
        (with-output-to-file tmp (lambda () (display (:string vec))))
        ((if (:check-equality vec) check-identity check-execution)
 	tmp
-	(check-signing `(--passphrase-fd "0" --clearsign ,@(:options vec))
+	(check-signing `(--passphrase-fd "0" --clear-sign ,@(:options vec))
 		       usrpass1))))
    (lambda (vec) (counter))
    vectors))

commit ca598152345b40f3a236227dfc63ae04ddf777d7
Author: Justus Winter <justus at g10code.com>
Date:   Fri Sep 23 13:40:55 2016 +0200

    g10: Spell out --recv-keys.
    
    * g10/gpg.c (opts): Spell out option.
    * doc/gpg.texi: Update accordingly.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index c7c7db6..9ea3b80 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -464,8 +464,8 @@ Most notable here is the @option{--import-options merge-only} option
 which does not insert new keys but does only the merging of new
 signatures, user-IDs and subkeys.
 
- at item --recv-keys @code{key IDs}
- at opindex recv-keys
+ at item --receive-keys @code{key IDs}
+ at opindex receive-keys
 Import the keys with the given key IDs from a keyserver. Option
 @option{--keyserver} must be used to give the name of this keyserver.
 
@@ -1757,7 +1757,7 @@ This option is deprecated - please use the @option{--keyserver} in
 @file{dirmngr.conf} instead.
 
 Use @code{name} as your keyserver. This is the server that
- at option{--recv-keys}, @option{--send-keys}, and @option{--search-keys}
+ at option{--receive-keys}, @option{--send-keys}, and @option{--search-keys}
 will communicate with to receive keys from, send keys to, and search for
 keys on. The format of the @code{name} is a URI:
 `scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
@@ -1825,9 +1825,9 @@ are available for all keyserver types, some common options are:
   Tell the keyserver helper program how long (in seconds) to try and
   perform a keyserver action before giving up. Note that performing
   multiple actions at the same time uses this timeout value per action.
-  For example, when retrieving multiple keys via @option{--recv-keys}, the
+  For example, when retrieving multiple keys via @option{--receive-keys}, the
   timeout applies separately to each key retrieval, and not to the
-  @option{--recv-keys} command as a whole. Defaults to 30 seconds.
+  @option{--receive-keys} command as a whole. Defaults to 30 seconds.
 
   @item http-proxy=@code{value}
   This option is deprecated.
@@ -2229,7 +2229,7 @@ opposite meaning. The options are:
   that this cannot completely repair the damaged key as some crucial data
   is removed by the keyserver, but it does at least give you back one
   subkey. Defaults to no for regular @option{--import} and to yes for
-  keyserver @option{--recv-keys}.
+  keyserver @option{--receive-keys}.
 
   @item import-show
   Show a listing of the key as imported right before it is stored.
diff --git a/g10/gpg.c b/g10/gpg.c
index c087387..7de62fd 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -470,7 +470,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aDesigRevoke, "desig-revoke","@" ),
   ARGPARSE_c (aExport, "export"           , N_("export keys") ),
   ARGPARSE_c (aSendKeys, "send-keys"     , N_("export keys to a keyserver") ),
-  ARGPARSE_c (aRecvKeys, "recv-keys"     , N_("import keys from a keyserver") ),
+  ARGPARSE_c (aRecvKeys, "receive-keys" , N_("import keys from a keyserver") ),
+  ARGPARSE_c (aRecvKeys, "recv-keys"     , "@"),
   ARGPARSE_c (aSearchKeys, "search-keys" ,
               N_("search for keys on a keyserver") ),
   ARGPARSE_c (aRefreshKeys, "refresh-keys",

-----------------------------------------------------------------------

Summary of changes:
 doc/debugging.texi                  |  3 +-
 doc/faq.org                         |  2 +-
 doc/gpg.texi                        | 82 ++++++++++++++++++-------------------
 doc/gpgsm.texi                      | 10 ++---
 doc/howto-create-a-server-cert.texi |  2 +-
 g10/gpg.c                           | 48 +++++++++++++---------
 g10/keygen.c                        |  2 +-
 g10/revoke.c                        |  3 +-
 po/ca.po                            | 10 ++---
 po/cs.po                            | 10 ++---
 po/da.po                            | 10 ++---
 po/de.po                            | 12 +++---
 po/el.po                            | 10 ++---
 po/eo.po                            | 10 ++---
 po/es.po                            | 10 ++---
 po/et.po                            | 10 ++---
 po/fi.po                            | 10 ++---
 po/fr.po                            | 10 ++---
 po/gl.po                            |  8 ++--
 po/hu.po                            | 10 ++---
 po/id.po                            | 10 ++---
 po/it.po                            | 10 ++---
 po/ja.po                            | 12 +++---
 po/nb.po                            | 12 +++---
 po/pl.po                            | 10 ++---
 po/pt.po                            | 10 ++---
 po/ro.po                            | 10 ++---
 po/ru.po                            | 12 +++---
 po/sk.po                            | 10 ++---
 po/sv.po                            | 10 ++---
 po/tr.po                            | 10 ++---
 po/uk.po                            | 12 +++---
 po/zh_CN.po                         | 10 ++---
 po/zh_TW.po                         | 10 ++---
 sm/gpgsm.c                          | 14 ++++---
 tests/openpgp/clearsig.scm          |  4 +-
 tests/openpgp/genkey1024.scm        |  2 +-
 37 files changed, 227 insertions(+), 213 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 14 08:24:42 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 14 Dec 2016 08:24:42 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-105-g57aa42c
Message-ID: <E1cH3vg-0002L1-Mo@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  57aa42ce9b28bc17ac24491d595766fbf80762af (commit)
      from  c1c35fb887061de05661f3411eda97546e1a52d7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 57aa42ce9b28bc17ac24491d595766fbf80762af
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Dec 14 16:17:03 2016 +0900

    dirmngr: Improve ntbtls support.
    
    * dirmngr/http.c [HTTP_USE_NTBTLS] (close_tls_session): Release.
    (send_request): Call ntbtls_set_transport.
    (cookie_read, cookie_write): Implement.
    (cookie_close): Add initial implementation for ntbtls.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 1078be9..ebf80b1 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -533,7 +533,13 @@ close_tls_session (http_session_t sess)
 {
   if (sess->tls_session)
     {
-# ifdef HTTP_USE_GNUTLS
+# if HTTP_USE_NTBTLS
+      /* FIXME!!
+         Possibly, ntbtls_get_transport and close those streams.
+         Somehow get SOCK to call my_socket_unref.
+      */
+      ntbtls_release (sess->tls_session);
+# elif HTTP_USE_GNUTLS
       my_socket_t sock = gnutls_transport_get_ptr (sess->tls_session);
       my_socket_unref (sock, NULL, NULL);
       gnutls_deinit (sess->tls_session);
@@ -601,6 +607,8 @@ http_session_new (http_session_t *r_session, const char *tls_priority,
   {
     (void)tls_priority;
 
+    /* ntbtls_set_debug (99, NULL, NULL); */
+
     err = ntbtls_new (&sess->tls_session, NTBTLS_CLIENT);
     if (err)
       {
@@ -1685,8 +1693,36 @@ send_request (http_t hd, const char *httphost, const char *auth,
 #if HTTP_USE_NTBTLS
   if (hd->uri->use_tls)
     {
+      estream_t in, out;
+
       my_socket_ref (hd->sock);
 
+      in = es_fdopen_nc (hd->sock->fd, "rb");
+      if (!in)
+        {
+          err = gpg_error_from_syserror ();
+          xfree (proxy_authstr);
+          return err;
+        }
+
+      out = es_fdopen_nc (hd->sock->fd, "wb");
+      if (!out)
+        {
+          err = gpg_error_from_syserror ();
+          es_fclose (in);
+          xfree (proxy_authstr);
+          return err;
+        }
+
+      err = ntbtls_set_transport (hd->session->tls_session, in, out);
+      if (err)
+        {
+          log_info ("TLS set_transport failed: %s <%s>\n",
+                    gpg_strerror (err), gpg_strsource (err));
+          xfree (proxy_authstr);
+          return err;
+        }
+
       while ((err = ntbtls_handshake (hd->session->tls_session)))
         {
           switch (err)
@@ -2508,7 +2544,17 @@ cookie_read (void *cookie, void *buffer, size_t size)
         size = c->content_length;
     }
 
-#ifdef HTTP_USE_GNUTLS
+#if HTTP_USE_NTBTLS
+  if (c->use_tls && c->session && c->session->tls_session)
+    {
+      estream_t in, out;
+
+      ntbtls_get_stream (c->session->tls_session, &in, &out);
+      nread = es_fread (buffer, 1, size, in);
+      log_debug ("TLS network read: %d/%u\n", nread, size);
+    }
+  else
+#elif HTTP_USE_GNUTLS
   if (c->use_tls && c->session && c->session->tls_session)
     {
     again:
@@ -2587,7 +2633,20 @@ cookie_write (void *cookie, const void *buffer_arg, size_t size)
   cookie_t c = cookie;
   int nwritten = 0;
 
-#ifdef HTTP_USE_GNUTLS
+#if HTTP_USE_NTBTLS
+  if (c->use_tls && c->session && c->session->tls_session)
+    {
+      estream_t in, out;
+
+      ntbtls_get_stream (c->session->tls_session, &in, &out);
+      if (size == 0)
+        es_fflush (out);
+      else
+        nwritten = es_fwrite (buffer, 1, size, out);
+      log_debug ("TLS network write: %d/%u\n", nwritten, size);
+    }
+  else
+#elif HTTP_USE_GNUTLS
   if (c->use_tls && c->session && c->session->tls_session)
     {
       int nleft = size;
@@ -2666,7 +2725,15 @@ cookie_close (void *cookie)
   if (!c)
     return 0;
 
-#ifdef HTTP_USE_GNUTLS
+#if HTTP_USE_NTBTLS
+  if (c->use_tls && c->session && c->session->tls_session)
+    {
+      /* FIXME!! Possibly call ntbtls_close_notify for close
+         of write stream.  */
+      my_socket_unref (c->sock, NULL, NULL);
+    }
+  else
+#elif HTTP_USE_GNUTLS
   if (c->use_tls && c->session && c->session->tls_session)
     my_socket_unref (c->sock, send_gnutls_bye, c->session->tls_session);
   else

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 71 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 14 16:36:26 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 14 Dec 2016 16:36:26 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-14-gf02a657
Message-ID: <E1cHBbY-00084u-LO@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  f02a657f0129b30700b2f36956ee37b40cc2da82 (commit)
      from  90b4dfad438900c7808b8c2995ba984fa3587bb2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f02a657f0129b30700b2f36956ee37b40cc2da82
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 13 12:42:43 2016 +0100

    New error code GPG_ERR_TRY_LATER.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 3b3ffb2..21637bc 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
  GPG_ERR_UNKNOWN_FLAG             NEW.
  GPG_ERR_INV_ORDER                NEW.
  GPG_ERR_ALREADY_FETCHED          NEW.
+ GPG_ERR_TRY_LATER                NEW.
  GPG_ERR_SYSTEM_BUG               NEW.
  GPG_ERR_DNS_UNKNOWN	          NEW.
  GPG_ERR_DNS_SECTION	          NEW.
diff --git a/doc/errorref.txt b/doc/errorref.txt
index ce626eb..6cea1b7 100644
--- a/doc/errorref.txt
+++ b/doc/errorref.txt
@@ -248,7 +248,7 @@ GPG_ERR_NETWORK                         Network error
 
 GPG_ERR_UNKNOWN_HOST            Unknown host
 
-        Used instead of the non-portbale EHOSTNOTFOUND which is
+        Used instead of the non-portable EHOSTNOTFOUND which is
         returned by some systems as a mapping of h_errno's
         HOST_NOT_FOUND
 
@@ -1033,6 +1033,11 @@ GPG_ERR_ALREADY_FETCHED         Already fetched
 
     GNUPG: - In Dirmngr used for the libdns error code DNS_EFETCHED.
 
+GPG_ERR_TRY_LATER               Try again later
+
+    This indicates that a server asked to try again later; thus it is
+    different from EAGAIN which is used by the local system.  This
+    code is for example used instead of h_error's TRY_AGAIN.
 
 GPG_ERR_SYSTEM_BUG              System bug detected
 
diff --git a/src/err-codes.h.in b/src/err-codes.h.in
index efc40e4..1c46948 100644
--- a/src/err-codes.h.in
+++ b/src/err-codes.h.in
@@ -331,6 +331,7 @@
 309	GPG_ERR_UNKNOWN_FLAG		Unknown flag
 310	GPG_ERR_INV_ORDER		Invalid execution order
 311	GPG_ERR_ALREADY_FETCHED		Already fetched
+312	GPG_ERR_TRY_LATER		Try again later
 # This range is free for use.
 
 666	GPG_ERR_SYSTEM_BUG		System bug detected

-----------------------------------------------------------------------

Summary of changes:
 NEWS               | 1 +
 doc/errorref.txt   | 7 ++++++-
 src/err-codes.h.in | 1 +
 3 files changed, 8 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 14 16:53:44 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 14 Dec 2016 16:53:44 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-119-g948cca9
Message-ID: <E1cHBsJ-0000NR-Uw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  948cca9c99e701a1668bb5fd6e25f07e35381b4d (commit)
       via  ca1e9749bfb069d90aa44efbf6f3d611b6104c1b (commit)
       via  55dc81125abc43cd3cc8db951fc3b8a81767942d (commit)
       via  d6e332422f7a8adc01a45685b067b977e28444e2 (commit)
      from  d34a2bb410c7c770d26430d69ff77bd83fc407f1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 948cca9c99e701a1668bb5fd6e25f07e35381b4d
Author: Justus Winter <justus at g10code.com>
Date:   Thu Nov 17 13:11:48 2016 +0100

    tests: Reuse GPGME's tests.
    
    * configure.ac (AC_CONFIG_FILES): Add new Makefile.
    * tests/Makefile.am (SUBDIRS): Add new directory.
    * tests/gpgme/Makefile.am: New file.
    * tests/gpgme/gpgme-defs.scm: Likewise.
    * tests/gpgme/run-tests.scm: Likewise.
    * tests/gpgme/setup.scm: Likewise.
    * tests/gpgme/wrap.scm: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/configure.ac b/configure.ac
index 066e963..1c467bf 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1888,6 +1888,7 @@ tests/Makefile
 tests/gpgscm/Makefile
 tests/openpgp/Makefile
 tests/migrations/Makefile
+tests/gpgme/Makefile
 tests/pkits/Makefile
 g10/gpg.w32-manifest
 ])
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 2fbdc7f..c022e2a 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -18,7 +18,7 @@
 
 ## Process this file with automake to produce Makefile.in
 
-SUBDIRS = gpgscm openpgp migrations pkits .
+SUBDIRS = gpgscm openpgp migrations gpgme pkits .
 
 GPGSM = ../sm/gpgsm
 
diff --git a/tests/gpgme/Makefile.am b/tests/gpgme/Makefile.am
new file mode 100644
index 0000000..21e0e14
--- /dev/null
+++ b/tests/gpgme/Makefile.am
@@ -0,0 +1,58 @@
+# Makefile.am - For tests/gpgme
+# Copyright (C) 2016 g10 Code GmbH
+#
+# This file is part of GnuPG.
+#
+# GnuPG is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# GnuPG is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <https://www.gnu.org/licenses/>.
+# Process this file with automake to create Makefile.in
+
+
+# Programs required before we can run these tests.
+required_pgms = ../../g10/gpg$(EXEEXT) ../../agent/gpg-agent$(EXEEXT) \
+                ../../tools/gpg-connect-agent$(EXEEXT) \
+		../gpgscm/gpgscm$(EXEEXT)
+
+AM_CPPFLAGS = -I$(top_srcdir)/common
+include $(top_srcdir)/am/cmacros.am
+
+AM_CFLAGS =
+
+TMP ?= /tmp
+
+TESTS_ENVIRONMENT = LC_ALL=C \
+	EXEEXT=$(EXEEXT) \
+	PATH=../gpgscm:$(PATH) \
+	TMP=$(TMP) \
+	srcdir=$(abs_srcdir) \
+	objdir=$(abs_top_builddir) \
+	GPGSCM_PATH=$(abs_top_srcdir)/tests/gpgscm:$(abs_top_srcdir)/tests/openpgp:$(abs_top_srcdir)/tests/gpgme
+
+# XXX: Currently, one cannot override automake's 'check' target.  As a
+# workaround, we avoid defining 'TESTS', thus automake will not emit
+# the 'check' target.  For extra robustness, we merely define a
+# dependency on 'xcheck', so this hack should also work even if
+# automake would emit the 'check' target, as adding dependencies to
+# targets is okay.
+check: xcheck
+
+.PHONY: xcheck
+xcheck:
+	$(TESTS_ENVIRONMENT) $(abs_top_builddir)/tests/gpgscm/gpgscm \
+	  $(abs_srcdir)/run-tests.scm $(TESTFLAGS) $(XTESTS)
+
+EXTRA_DIST = gpgme-defs.scm run-tests.scm setup.scm wrap.scm
+
+# We need to depend on a couple of programs so that the tests don't
+# start before all programs are built.
+all-local: $(required_pgms)
diff --git a/tests/gpgme/gpgme-defs.scm b/tests/gpgme/gpgme-defs.scm
new file mode 100644
index 0000000..2490666
--- /dev/null
+++ b/tests/gpgme/gpgme-defs.scm
@@ -0,0 +1,167 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+
+(define gpgme-srcdir (getenv "XTEST_GPGME_SRCDIR"))
+(when (string=? "" gpgme-srcdir)
+    (info
+     "SKIP: Environment variable 'XTEST_GPGME_SRCDIR' not set.  Please"
+     "point it to a recent GPGME source tree to run the GPGME test suite.")
+    (exit 0))
+
+(define (in-gpgme-srcdir . names)
+  (canonical-path (apply path-join (cons gpgme-srcdir names))))
+
+(define gpgme-builddir (getenv "XTEST_GPGME_BUILDDIR"))
+(when (string=? "" gpgme-builddir)
+    (info
+     "SKIP: Environment variable 'XTEST_GPGME_BUILDDIR' not set.  Please"
+     "point it to a recent GPGME build tree to run the GPGME test suite.")
+    (exit 0))
+
+;; Make sure that GPGME picks up our gpgconf.  This makes GPGME use
+;; and thus executes the tests with GnuPG components from the build
+;; tree.
+(setenv "PATH" (string-append (path-join (getenv "GNUPG_BUILDDIR") "tools")
+			      (string *pathsep*) (getenv "PATH")) #t)
+
+(define (create-file name content)
+  (letfd ((fd (open name (logior O_WRONLY O_CREAT O_BINARY) #o600)))
+    (display content (fdopen fd "wb"))))
+
+(define (create-gpgmehome . path)
+  (create-file "gpg.conf" "no-force-v3-sigs\n")
+  (create-file
+   "gpg-agent.conf"
+   (string-append "pinentry-program "
+		  (in-gpgme-srcdir "tests" "gpg" "pinentry") "\n"))
+  (mkdir "private-keys-v1.d" "-rwx")
+
+  (log "Storing private keys")
+  (for-each
+   (lambda (name)
+     (file-copy (apply in-gpgme-srcdir `(, at path ,name))
+		(path-join "private-keys-v1.d"
+			   (string-append name ".key"))))
+   '("13CD0F3BDF24BE53FE192D62F18737256FF6E4FD"
+     "76F7E2B35832976B50A27A282D9B87E44577EB66"
+     "A0747D5F9425E6664F4FFBEED20FBCA79FDED2BD"
+     "13CBE3758AFE42B5E5E2AE4CED27AFA455E3F87F"
+     "7A030357C0F253A5BBCD282FFC4E521B37558F5C"))
+
+  (log "Importing public demo and test keys")
+  (for-each
+   (lambda (file)
+     (call-check `(, at GPG --yes --import ,(apply in-gpgme-srcdir
+						`(, at path ,file)))))
+   (list "pubdemo.asc" "secdemo.asc"))
+  (stop-agent))
+
+;; Initialize the test environment, install appropriate configuration
+;; and start the agent, with the keys from the legacy test suite.
+(define (setup-gpgme-environment . path)
+  (if (member "--unpack-tarball" *args*)
+      (begin
+	(call-check `(,(tool 'gpgtar) --extract --directory=. ,(cadr *args*)))
+	(start-agent))
+      (apply create-gpgme-gpghome path)))
+
+;; Command line flag handling.  Returns the elements following KEY in
+;; ARGUMENTS up to the next argument, or #f if KEY is not in
+;; ARGUMENTS.
+(define (flag key arguments)
+  (cond
+   ((null? arguments)
+    #f)
+   ((string=? key (car arguments))
+    (let loop ((acc '())
+	       (args (cdr arguments)))
+      (if (or (null? args) (string-prefix? (car args) "--"))
+	  (reverse acc)
+	  (loop (cons (car args) acc) (cdr args)))))
+   ((string=? "--" (car arguments))
+    #f)
+   (else
+    (flag key (cdr arguments)))))
+(assert (equal? (flag "--xxx" '("--yyy")) #f))
+(assert (equal? (flag "--xxx" '("--xxx")) '()))
+(assert (equal? (flag "--xxx" '("--xxx" "yyy")) '("yyy")))
+(assert (equal? (flag "--xxx" '("--xxx" "yyy" "zzz")) '("yyy" "zzz")))
+(assert (equal? (flag "--xxx" '("--xxx" "yyy" "zzz" "--")) '("yyy" "zzz")))
+(assert (equal? (flag "--xxx" '("--xxx" "yyy" "--" "zzz")) '("yyy")))
+(assert (equal? (flag "--" '("--" "xxx" "yyy" "--" "zzz")) '("xxx" "yyy")))
+
+(define (parse-makefile port key)
+  (define (is-continuation? tokens)
+    (string=? (last tokens) "\\"))
+  (define (valid-token? s)
+    (< 0 (string-length s)))
+  (define (drop-continuations tokens)
+    (let loop ((acc '()) (tks tokens))
+      (if (null? tks)
+	  (reverse acc)
+	  (loop (if (string=? "\\" (car tks))
+		    acc
+		    (cons (car tks) acc)) (cdr tks)))))
+  (let next ((acc '()) (found #f))
+    (let ((line (read-line port)))
+      (if (eof-object? line)
+	  acc
+	  (let ((tokens (filter valid-token?
+				(string-splitp (string-trim char-whitespace?
+							    line)
+					       char-whitespace? -1))))
+	    (cond
+	     ((or (null? tokens)
+		  (string-prefix? (car tokens) "#")
+		  (and (not found) (not (and (string=? key (car tokens))
+					     (string=? "=" (cadr tokens))))))
+	      (next acc found))
+	     ((not found)
+	      (assert (and (string=? key (car tokens))
+			   (string=? "=" (cadr tokens))))
+	      (if (is-continuation? tokens)
+		  (next (drop-continuations (cddr tokens)) #t)
+		  (drop-continuations (cddr tokens))))
+	     (else
+	      (assert found)
+	      (if (is-continuation? tokens)
+		  (next (append acc (drop-continuations tokens)) found)
+		  (append acc (drop-continuations tokens))))))))))
+
+(define (parse-makefile-expand filename expand key)
+  (define (variable? v)
+    (and (string-prefix? v "$(") (string-suffix? v ")")))
+
+  (let expand-all ((values (parse-makefile (open-input-file filename) key)))
+    (if (any variable? values)
+	(expand-all
+	 (let expand-one ((acc '()) (v values))
+	   (cond
+	    ((null? v)
+	     acc)
+	    ((variable? (car v))
+	     (let ((makefile (open-input-file filename))
+		   (key (substring (car v) 2 (- (string-length (car v)) 1))))
+	       (expand-one (append acc (expand filename makefile key))
+			   (cdr v))))
+	    (else
+	     (expand-one (append acc (list (car v))) (cdr v))))))
+	values)))
diff --git a/tests/gpgme/run-tests.scm b/tests/gpgme/run-tests.scm
new file mode 100644
index 0000000..bce5584
--- /dev/null
+++ b/tests/gpgme/run-tests.scm
@@ -0,0 +1,69 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "gpgme-defs.scm"))
+
+(info "Running GPGME's test suite...")
+
+(define (gpgme-makefile-expand filename port key)
+  ;;(interactive-repl (current-environment))
+  (cond
+   ((string=? key "tests_unix")
+    (if *win32*
+	(parse-makefile port key)   ;; Use win32 definition.
+	(begin
+	  (parse-makefile port key) ;; Skip win32 definition.
+	  (parse-makefile port key))))
+   (else
+    (parse-makefile port key))))
+
+(define (all-tests filename key)
+  (parse-makefile-expand filename gpgme-makefile-expand key))
+
+(let* ((runner (if (member "--parallel" *args*)
+		   run-tests-parallel
+		   run-tests-sequential))
+       (tests (filter (lambda (arg) (not (string-prefix? arg "--"))) *args*)))
+  (runner
+   (test::scm "setup.scm" (in-srcdir "setup.scm") "--" "tests" "gpg")
+   (apply
+    append
+    (map (lambda (cmpnts)
+	   (define (compiled? name)
+	     (not (or (string-suffix? name ".py")
+		      (string-suffix? name ".test"))))
+	   (define :path car)
+	   (define :key cadr)
+	   (define (find-test name)
+	     (apply path-join
+		    `(,(if (compiled? name)
+			   gpgme-builddir
+			   gpgme-srcdir) ,@(:path cmpnts),name)))
+	   (let ((makefile (apply path-join `(,gpgme-srcdir ,@(:path cmpnts)
+							    "Makefile.am"))))
+	     (map (lambda (name)
+		    (apply test::scm
+			   `(,name ,(in-srcdir "wrap.scm") --executable
+				   ,(find-test name)
+				   -- ,@(:path cmpnts))))
+		  (if (null? tests) (all-tests makefile (:key cmpnts)) tests))))
+	 '((("tests" "gpg") "c_tests")
+	   ;; XXX: Not yet.
+	   ;; (("lang" "python" "tests") "py_tests")
+	   (("lang" "qt" "tests") "TESTS"))))))
diff --git a/tests/gpgme/setup.scm b/tests/gpgme/setup.scm
new file mode 100644
index 0000000..0116a74
--- /dev/null
+++ b/tests/gpgme/setup.scm
@@ -0,0 +1,35 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "gpgme-defs.scm"))
+
+(define tarball (flag "--create-tarball" *args*))
+(unless (and tarball (not (null? tarball)))
+	(error "Usage: setup.scm --create-tarball <file> ..."))
+
+(define components (flag "--" *args*))
+(unless (and components (not (null? components)))
+	(error "Usage: setup.scm --create-tarball " (cadr tarball)
+	       " -- component [component ...]"))
+
+(with-temporary-working-directory
+ (setenv "GNUPGHOME" (getcwd) #t)
+ (apply create-gpgmehome components)
+ (stop-agent)
+ (call-check `(,(tool 'gpgtar) --create --output ,(car tarball) ".")))
diff --git a/tests/gpgme/wrap.scm b/tests/gpgme/wrap.scm
new file mode 100644
index 0000000..4f3ae7d
--- /dev/null
+++ b/tests/gpgme/wrap.scm
@@ -0,0 +1,60 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "gpgme-defs.scm"))
+
+(define executable (flag "--executable" *args*))
+(unless (and executable (not (null? executable)))
+	(error "Usage: wrap.scm --executable <file> [args...]"))
+
+(setup-gpgme-environment "tests" "gpg")
+
+(setenv "abs_builddir" (getcwd) #t)
+(setenv "top_srcdir" gpgme-srcdir #t)
+(setenv "srcdir" (path-join gpgme-srcdir "tests" "gpg") #t)
+
+(define (run what)
+  (if (string-suffix? (car what) ".py")
+      (begin
+	(setenv "LD_LIBRARY_PATH"
+		(if (< 0 (string-length (getenv "LD_LIBRARY_PATH")))
+		    (string-append (path-join gpgme-builddir "src/.libs")
+				   (string *pathsep*)
+				   (getenv "LD_LIBRARY_PATH"))
+		    (path-join gpgme-builddir "src/.libs"))
+		#t)
+	(call-with-fds
+	 `("/usr/bin/python"
+	   ,(in-gpgme-srcdir "lang" "python" "tests" "run-tests.py")
+	   --quiet
+	   --interpreters=/usr/bin/python
+	   --builddir ,(path-join gpgme-builddir "lang" "python" "tests")
+	   , at what)
+	 STDIN_FILENO STDOUT_FILENO STDERR_FILENO))
+      (if #f 77 (call-with-fds what STDIN_FILENO STDOUT_FILENO STDERR_FILENO))))
+
+(let ((name (basename (car executable))))
+  (cond
+   ((string=? "t-keylist" name)
+    ;; This test assumes that 't-import' imported a key.
+    (log "Importing extra key...")
+    (call-check `(, at GPG --yes --import ,(in-srcdir "pubkey-1.asc"))))))
+
+(log "Running" (car executable))
+(exit (run executable))

commit ca1e9749bfb069d90aa44efbf6f3d611b6104c1b
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 14:18:22 2016 +0100

    common: Support locating components in the build tree.
    
    * common/homedir.c (gnupg_build_directory): New variable.
    (gnupg_module_name_called): Likewise.
    (gnupg_set_builddir): New function.
    (gnupg_set_builddir_from_env): Likewise.
    (gnupg_module_name): Support locating components in the build tree.
    * common/util.h (gnupg_set_builddir): New prototype.
    * tests/openpgp/defs.scm (tools): Drop 'gpg and 'gpg-agent.
    (tool): Rename to 'tool-hardcoded.
    (gpg-conf): New function, with accessors for the results.
    (gpg-components): New variable.
    (tool): New function.
    * tools/gpgconf.c (enum cmd_and_opt_values): New key.
    (opts): New option '--build-prefix'.
    (main): Handle new option.
    --
    
    This change makes sure that the components from the build tree are
    used, and not some older installed version in PATH.  It also lets us
    make GPGME use components from the build tree, making it possible to
    execute GPGME's test suite with them.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/common/homedir.c b/common/homedir.c
index 59b7135..6b40bb6 100644
--- a/common/homedir.c
+++ b/common/homedir.c
@@ -884,15 +884,60 @@ get_default_pinentry_name (int reset)
 }
 
 
+/* If set, 'gnupg_module_name' returns modules from that build
+ * directory.  */
+static char *gnupg_build_directory;
+
+/* For sanity checks.  */
+static int gnupg_module_name_called;
+
+
+/* Set NEWDIR as the new build directory.  This will make
+ * 'gnupg_module_name' return modules from that build directory.  Must
+ * be called before any invocation of 'gnupg_module_name', and must
+ * not be called twice.  It can be used by test suites to make sure
+ * the components from the build directory are used instead of
+ * potentially outdated installed ones.  */
+void
+gnupg_set_builddir (const char *newdir)
+{
+  log_assert (! gnupg_module_name_called);
+  log_assert (! gnupg_build_directory);
+  gnupg_build_directory = xtrystrdup (newdir);
+}
+
+
+/* If no build directory has been configured, try to set it from the
+ * environment.  We only do this in development builds to avoid
+ * increasing the set of influential environment variables and hence
+ * the attack surface of production builds.  */
+static void
+gnupg_set_builddir_from_env (void)
+{
+#ifdef IS_DEVELOPMENT_VERSION
+  if (gnupg_build_directory)
+    return;
+
+  gnupg_build_directory = getenv ("GNUPG_BUILDDIR");
+#endif
+}
+
+
 /* Return the file name of a helper tool.  WHICH is one of the
    GNUPG_MODULE_NAME_foo constants.  */
 const char *
 gnupg_module_name (int which)
 {
-#define X(a,b) do {                                                     \
+  gnupg_set_builddir_from_env ();
+  gnupg_module_name_called = 1;
+
+#define X(a,b,c) do {                                                   \
     static char *name;                                                  \
     if (!name)                                                          \
-      name = xstrconcat (gnupg_ ## a (), DIRSEP_S b EXEEXT_S, NULL);    \
+      name = gnupg_build_directory                                      \
+        ? xstrconcat (gnupg_build_directory,                            \
+                      DIRSEP_S b DIRSEP_S c EXEEXT_S, NULL)             \
+        : xstrconcat (gnupg_ ## a (), DIRSEP_S c EXEEXT_S, NULL);       \
     return name;                                                        \
   } while (0)
 
@@ -902,7 +947,7 @@ gnupg_module_name (int which)
 #ifdef GNUPG_DEFAULT_AGENT
       return GNUPG_DEFAULT_AGENT;
 #else
-      X(bindir, "gpg-agent");
+      X(bindir, "agent", "gpg-agent");
 #endif
 
     case GNUPG_MODULE_NAME_PINENTRY:
@@ -916,55 +961,57 @@ gnupg_module_name (int which)
 #ifdef GNUPG_DEFAULT_SCDAEMON
       return GNUPG_DEFAULT_SCDAEMON;
 #else
-      X(libexecdir, "scdaemon");
+      X(libexecdir, "scd", "scdaemon");
 #endif
 
     case GNUPG_MODULE_NAME_DIRMNGR:
 #ifdef GNUPG_DEFAULT_DIRMNGR
       return GNUPG_DEFAULT_DIRMNGR;
 #else
-      X(bindir, DIRMNGR_NAME);
+      X(bindir, "dirmngr", DIRMNGR_NAME);
 #endif
 
     case GNUPG_MODULE_NAME_PROTECT_TOOL:
 #ifdef GNUPG_DEFAULT_PROTECT_TOOL
       return GNUPG_DEFAULT_PROTECT_TOOL;
 #else
-      X(libexecdir, "gpg-protect-tool");
+      X(libexecdir, "agent", "gpg-protect-tool");
 #endif
 
     case GNUPG_MODULE_NAME_DIRMNGR_LDAP:
 #ifdef GNUPG_DEFAULT_DIRMNGR_LDAP
       return GNUPG_DEFAULT_DIRMNGR_LDAP;
 #else
-      X(libexecdir, "dirmngr_ldap");
+      X(libexecdir, "dirmngr", "dirmngr_ldap");
 #endif
 
     case GNUPG_MODULE_NAME_CHECK_PATTERN:
-      X(libexecdir, "gpg-check-pattern");
+      X(libexecdir, "tools", "gpg-check-pattern");
 
     case GNUPG_MODULE_NAME_GPGSM:
-      X(bindir, "gpgsm");
+      X(bindir, "sm", "gpgsm");
 
     case GNUPG_MODULE_NAME_GPG:
 #if USE_GPG2_HACK
-      X(bindir, GPG_NAME "2");
-#else
-      X(bindir, GPG_NAME);
+      if (! gnupg_build_directory)
+        X(bindir, "g10", GPG_NAME "2");
+      else
 #endif
+        X(bindir, "g10", GPG_NAME);
 
     case GNUPG_MODULE_NAME_GPGV:
 #if USE_GPG2_HACK
-      X(bindir, GPG_NAME "v2");
-#else
-      X(bindir, GPG_NAME "v");
+      if (! gnupg_build_directory)
+        X(bindir, "g10", GPG_NAME "v2");
+      else
 #endif
+        X(bindir, "g10", GPG_NAME "v");
 
     case GNUPG_MODULE_NAME_CONNECT_AGENT:
-      X(bindir, "gpg-connect-agent");
+      X(bindir, "tools", "gpg-connect-agent");
 
     case GNUPG_MODULE_NAME_GPGCONF:
-      X(bindir, "gpgconf");
+      X(bindir, "tools", "gpgconf");
 
     default:
       BUG ();
diff --git a/common/util.h b/common/util.h
index 2ff2bbc..f7a53e1 100644
--- a/common/util.h
+++ b/common/util.h
@@ -263,6 +263,7 @@ char *_gnupg_socketdir_internal (int skip_checks, unsigned *r_info);
 #define GNUPG_MODULE_NAME_GPGV          12
 const char *gnupg_module_name (int which);
 void gnupg_module_name_flush_some (void);
+void gnupg_set_builddir (const char *newdir);
 
 
 
diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 5249ca9..ef81f99 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -56,9 +56,7 @@
 	value)))
 
 (define tools
-  '((gpg "GPG" "g10/gpg")
-    (gpgv "GPGV" "g10/gpgv")
-    (gpg-agent "GPG_AGENT" "agent/gpg-agent")
+  '((gpgv "GPGV" "g10/gpgv")
     (gpg-connect-agent "GPG_CONNECT_AGENT" "tools/gpg-connect-agent")
     (gpgconf "GPGCONF" "tools/gpgconf")
     (gpg-preset-passphrase "GPG_PRESET_PASSPHRASE"
@@ -67,7 +65,7 @@
     (gpg-zip "GPGZIP" "tools/gpg-zip")
     (pinentry "PINENTRY" "tests/openpgp/fake-pinentry")))
 
-(define (tool which)
+(define (tool-hardcoded which)
   (let ((t (assoc which tools))
 	(prefix (getenv "BIN_PREFIX")))
     (getenv' (cadr t)
@@ -75,6 +73,24 @@
 			  (string-append (getenv "objdir") "/" (caddr t))
 			  (string-append prefix "/" (basename (caddr t))))))))
 
+(define (gpg-conf . args)
+  (let ((s (call-popen `(,(tool-hardcoded 'gpgconf) , at args) "")))
+    (map (lambda (line) (string-split line #\:))
+	 (string-split-newlines s))))
+(define :gc:c:name car)
+(define :gc:c:description cadr)
+(define :gc:c:pgmname caddr)
+
+(setenv "GNUPG_BUILDDIR" (getenv "objdir") #t)
+(define gpg-components (gpg-conf '--build-prefix (getenv "objdir")
+				 '--list-components))
+
+(define (tool which)
+  (case which
+    ((gpg gpg-agent scdaemon gpgsm dirmngr)
+     (:gc:c:pgmname (assoc (symbol->string which) gpg-components)))
+    (else
+     (tool-hardcoded which))))
 
 (define (gpg-has-option? option)
   (string-contains? (call-popen `(,(tool 'gpg) --dump-options) "")
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index 5f7912a..d056f4f 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -44,6 +44,7 @@ enum cmd_and_opt_values
     oNull       = '0',
     oNoVerbose	= 500,
     oHomedir,
+    oBuilddir,
 
     aListComponents,
     aCheckPrograms,
@@ -98,6 +99,7 @@ static ARGPARSE_OPTS opts[] =
     { oRuntime, "runtime",  0, N_("activate changes at runtime, if possible") },
     /* hidden options */
     { oHomedir, "homedir", 2, "@" },
+    { oBuilddir, "build-prefix", 2, "@" },
     { oNull, "null", 0, "@" },
     { oNoVerbose, "no-verbose",  0, "@"},
     {0}
@@ -483,6 +485,7 @@ main (int argc, char **argv)
         case oVerbose:   opt.verbose++; break;
         case oNoVerbose: opt.verbose = 0; break;
         case oHomedir:   gnupg_set_homedir (pargs.r.ret_str); break;
+        case oBuilddir:  gnupg_set_builddir (pargs.r.ret_str); break;
         case oNull:      opt.null = 1; break;
 
 	case aListDirs:

commit 55dc81125abc43cd3cc8db951fc3b8a81767942d
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 11:45:52 2016 +0100

    tests: Rework check for trust models.
    
    * tests/openpgp/defs.scm (gpg-has-option?): New function.
    (have-opt-always-trust): Use a simpler test for that option.  This way
    that is less distracting when we run the tests with verbose=3.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index b198cdd..5249ca9 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -76,9 +76,14 @@
 			  (string-append prefix "/" (basename (caddr t))))))))
 
 
-(define have-opt-always-trust
+(define (gpg-has-option? option)
   (string-contains? (call-popen `(,(tool 'gpg) --dump-options) "")
-			"--always-trust"))
+		    option))
+
+(define have-opt-always-trust
+  (catch #f
+	 (call-check `(,(tool 'gpg) --gpgconf-test --always-trust))
+	 #t))
 
 (define GPG `(,(tool 'gpg) --no-permission-warning
 	      ,@(if have-opt-always-trust '(--always-trust) '())))

commit d6e332422f7a8adc01a45685b067b977e28444e2
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 11:35:44 2016 +0100

    common: Fix typo.
    
    --
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/common/util.h b/common/util.h
index a7d7e86..2ff2bbc 100644
--- a/common/util.h
+++ b/common/util.h
@@ -281,7 +281,7 @@ const char *gnupg_messages_locale_name (void);
    logging subsystem. */
 void setup_libgcrypt_logging (void);
 
-/* Print an out of core emssage and die.  */
+/* Print an out of core message and die.  */
 void xoutofcore (void);
 
 /* Same as estream_asprintf but die on memory failure.  */

-----------------------------------------------------------------------

Summary of changes:
 common/homedir.c                        |  81 ++++++++++++----
 common/util.h                           |   3 +-
 configure.ac                            |   1 +
 tests/Makefile.am                       |   2 +-
 tests/{migrations => gpgme}/Makefile.am |  47 +++++----
 tests/gpgme/gpgme-defs.scm              | 167 ++++++++++++++++++++++++++++++++
 tests/gpgme/run-tests.scm               |  69 +++++++++++++
 tests/{openpgp => gpgme}/setup.scm      |  17 ++--
 tests/gpgme/wrap.scm                    |  60 ++++++++++++
 tests/openpgp/defs.scm                  |  33 +++++--
 tools/gpgconf.c                         |   3 +
 11 files changed, 428 insertions(+), 55 deletions(-)
 copy tests/{migrations => gpgme}/Makefile.am (56%)
 create mode 100644 tests/gpgme/gpgme-defs.scm
 create mode 100644 tests/gpgme/run-tests.scm
 copy tests/{openpgp => gpgme}/setup.scm (63%)
 mode change 100755 => 100644
 create mode 100644 tests/gpgme/wrap.scm


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 14 17:07:32 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 14 Dec 2016 17:07:32 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-217-g51e10a7
Message-ID: <E1cHC5e-00010v-UX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  51e10a77dcb393f80b89945d8425595cfcc4f5f8 (commit)
       via  ed101ddff74fd6f77073944e8fd0cfea408abab2 (commit)
       via  3de7888d0512c08617fe98f4427324e33efeb815 (commit)
      from  fff2ff17e509ba9e73c13b4059d27f5c9f4be0f4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 51e10a77dcb393f80b89945d8425595cfcc4f5f8
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Dec 14 17:04:08 2016 +0100

    Fix / improve inline PGP decryption
    
    * src/mapihelp.cpp (change_message_class_ipm_note): Look for
    PGP Lines even without content type.
    * src/mimedataprovider.cpp (MimeDataProvider::write): Respect
    m_collect_everything.
    * src/parsecontroller.cpp (ParseController::ParseController): Don't
    expect MIME headers for inline pgp data.
    (expect_no_mime): New.

diff --git a/src/mapihelp.cpp b/src/mapihelp.cpp
index 92def26..eb23503 100644
--- a/src/mapihelp.cpp
+++ b/src/mapihelp.cpp
@@ -959,41 +959,37 @@ change_message_class_ipm_note (LPMESSAGE message)
   char *ct, *proto;
 
   ct = mapi_get_message_content_type (message, &proto, NULL);
-  if (ct)
+  log_debug ("%s:%s: content type is '%s'", SRCNAME, __func__,
+             ct ? ct : "null");
+  if (ct && proto)
     {
-      log_debug ("%s:%s: content type is '%s'", SRCNAME, __func__, ct);
-      if (proto)
+      log_debug ("%s:%s:     protocol is '%s'", SRCNAME, __func__, proto);
+
+      if (!strcmp (ct, "multipart/encrypted")
+          && !strcmp (proto, "application/pgp-encrypted"))
         {
-          log_debug ("%s:%s:     protocol is '%s'", SRCNAME, __func__, proto);
-          
-          if (!strcmp (ct, "multipart/encrypted")
-              && !strcmp (proto, "application/pgp-encrypted"))
-            {
-              newvalue = xstrdup ("IPM.Note.GpgOL.MultipartEncrypted");
-            }
-          else if (!strcmp (ct, "multipart/signed")
-                   && !strcmp (proto, "application/pgp-signature"))
-            {
-              /* Sometimes we receive a PGP/MIME signed message with a
-                 class IPM.Note.  */
-              newvalue = xstrdup ("IPM.Note.GpgOL.MultipartSigned");
-            }
-          xfree (proto);
+          newvalue = xstrdup ("IPM.Note.GpgOL.MultipartEncrypted");
         }
-      else if (!strcmp (ct, "text/plain") ||
-               !strcmp (ct, "multipart/mixed") ||
-               !strcmp (ct, "multipart/alternative"))
+      else if (!strcmp (ct, "multipart/signed")
+               && !strcmp (proto, "application/pgp-signature"))
         {
-          /* It is quite common to have a multipart/mixed or alternative
-             mail with separate encrypted PGP parts.  Look at the body to
-             decide.  */
-          newvalue = get_msgcls_from_pgp_lines (message);
+          /* Sometimes we receive a PGP/MIME signed message with a
+             class IPM.Note.  */
+          newvalue = xstrdup ("IPM.Note.GpgOL.MultipartSigned");
         }
-
-      xfree (ct);
+      xfree (proto);
     }
-  else
-    log_debug ("%s:%s: message has no content type", SRCNAME, __func__);
+  else if (!ct || !strcmp (ct, "text/plain") ||
+           !strcmp (ct, "multipart/mixed") ||
+           !strcmp (ct, "multipart/alternative"))
+    {
+      /* It is quite common to have a multipart/mixed or alternative
+         mail with separate encrypted PGP parts.  Look at the body to
+         decide.  */
+      newvalue = get_msgcls_from_pgp_lines (message);
+    }
+
+  xfree (ct);
 
   return newvalue;
 }
diff --git a/src/mimedataprovider.cpp b/src/mimedataprovider.cpp
index f0273cf..9ae3e2d 100644
--- a/src/mimedataprovider.cpp
+++ b/src/mimedataprovider.cpp
@@ -833,21 +833,30 @@ MimeDataProvider::collect_data(FILE *stream)
 
 ssize_t MimeDataProvider::write(const void *buffer, size_t bufSize)
 {
-    m_rawbuf += std::string ((const char*)buffer, bufSize);
-    size_t not_taken = collect_input_lines (m_rawbuf.c_str(),
-                                            m_rawbuf.size());
-
-    if (not_taken == m_rawbuf.size())
-      {
-        log_error ("%s:%s: Write failed to consume anything.\n"
-                   "Buffer too small? or no newlines in text?",
-                   SRCNAME, __func__);
-        return bufSize;
-      }
-    log_mime_parser ("%s:%s: Write Consumed: " SIZE_T_FORMAT " bytes",
-                     SRCNAME, __func__, m_rawbuf.size() - not_taken);
-    m_rawbuf.erase (0, m_rawbuf.size() - not_taken);
-    return bufSize;
+  if (m_collect_everything)
+    {
+      /* Writing with collect everything one means that we are outputprovider.
+         In this case for inline messages we want to collect everything. */
+      log_mime_parser ("%s:%s: Using complete input as body " SIZE_T_FORMAT " bytes.",
+                       SRCNAME, __func__, bufSize);
+      m_body += std::string ((const char *) buffer, bufSize);
+      return bufSize;
+    }
+  m_rawbuf += std::string ((const char*)buffer, bufSize);
+  size_t not_taken = collect_input_lines (m_rawbuf.c_str(),
+                                          m_rawbuf.size());
+
+  if (not_taken == m_rawbuf.size())
+    {
+      log_error ("%s:%s: Write failed to consume anything.\n"
+                 "Buffer too small? or no newlines in text?",
+                 SRCNAME, __func__);
+      return bufSize;
+    }
+  log_mime_parser ("%s:%s: Write Consumed: " SIZE_T_FORMAT " bytes",
+                   SRCNAME, __func__, m_rawbuf.size() - not_taken);
+  m_rawbuf.erase (0, m_rawbuf.size() - not_taken);
+  return bufSize;
 }
 
 off_t
diff --git a/src/parsecontroller.cpp b/src/parsecontroller.cpp
index f0ddfaa..f053d87 100644
--- a/src/parsecontroller.cpp
+++ b/src/parsecontroller.cpp
@@ -64,22 +64,31 @@ expect_no_headers (msgtype_t type)
   return type != MSGTYPE_GPGOL_MULTIPART_SIGNED;
 }
 
+static bool
+expect_no_mime (msgtype_t type)
+{
+  return type == MSGTYPE_GPGOL_PGP_MESSAGE ||
+         type == MSGTYPE_GPGOL_CLEAR_SIGNED;
+}
+
 #ifdef HAVE_W32_SYSTEM
 ParseController::ParseController(LPSTREAM instream, msgtype_t type):
     m_inputprovider  (new MimeDataProvider(instream,
                           expect_no_headers(type))),
-    m_outputprovider (new MimeDataProvider()),
+    m_outputprovider (new MimeDataProvider(expect_no_mime(type))),
     m_type (type)
 {
-  log_mime_parser ("%s:%s: Creating parser for stream: %p of type %i",
-                   SRCNAME, __func__, instream, type);
+  log_mime_parser ("%s:%s: Creating parser for stream: %p of type %i"
+                   " expect headers: %i expect no mime: %i",
+                   SRCNAME, __func__, instream, type,
+                   expect_no_headers (type), expect_no_mime (type));
 }
 #endif
 
 ParseController::ParseController(FILE *instream, msgtype_t type):
     m_inputprovider  (new MimeDataProvider(instream,
                           expect_no_headers(type))),
-    m_outputprovider (new MimeDataProvider()),
+    m_outputprovider (new MimeDataProvider(expect_no_mime(type))),
     m_type (type)
 {
   log_mime_parser ("%s:%s: Creating parser for stream: %p of type %i",

commit ed101ddff74fd6f77073944e8fd0cfea408abab2
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Dec 14 17:03:20 2016 +0100

    Update copyright year
    
    --

diff --git a/src/versioninfo.rc.in b/src/versioninfo.rc.in
index bc0da84..7d03c5f 100644
--- a/src/versioninfo.rc.in
+++ b/src/versioninfo.rc.in
@@ -39,7 +39,7 @@ BEGIN
             VALUE "FileDescription", "GpgOL - GnuPG plugin for Outlook\0"
             VALUE "FileVersion", "@VERSION@\0"
             VALUE "InternalName", "gpgol\0"
-            VALUE "LegalCopyright", "Copyright ? 2013 g10 Code GmbH\0"
+            VALUE "LegalCopyright", "Copyright ? 2016 g10 Code GmbH\0"
             VALUE "LegalTrademarks", "\0"
             VALUE "OriginalFilename", "gpgol.dll\0"
             VALUE "PrivateBuild", "\0"

commit 3de7888d0512c08617fe98f4427324e33efeb815
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Dec 14 16:51:17 2016 +0100

    Update signature status display
    
    * src/icons: Add new Icons, remove old icons.
    * src/icons/Makefile.am (EXTRA_DIST): Update accordingly.
    * src/dialogs.h: Define ids
    * src/dialogs.rc: Include new icons.
    * src/gpgoladdin.cpp: Update some function names.
    * src/mail.cpp (Mail::update_sigstate): Use tofu validity
    from gnupg.
    (Mail::get_valid_sig): Removed. Too confusing.
    (Mail::is_signed): Constify.
    (Mail::is_encrypted): New, similar to is_signed.
    (level_4_check): Helper to figure out the correct message
    for level 4.
    (Mail::get_crypto_summary): New. More differntiated title.
    (Mail::get_signature_level): New. defines levels.
    (Mail::get_crypto_details): New. Replacement for get_signature_status
    (Mail::get_crypto_icon_id): Use levels and new icons.
    * src/mail.h: Update accordingly.
    * src/ribbon-callbacks.cpp (get_is_crypto): Renamed from
    get_is_signed.
    (get_sig_label): Use get_crypto_summary.
    (get_sig_ttip): Use get_crypto_summary.
    (get_sig_stip): Use get_crypto_details.
    (get_crypto_icon): Use renamed function.
    * src/ribbon-callbacks.h: Update accordingly.
    
    --
    This commits starts implementing signature / crypto status
    display as discussed on:
    https://wiki.gnupg.org/EasyGpg2016/AutomatedEncryption
    
    Apologies for the large commits that mushes the string
    and icon changes.
    
    There are still bugs but I needed to commit some changes so
    that I won't get lost completely.

diff --git a/src/dialogs.h b/src/dialogs.h
index 54bbede..0574444 100644
--- a/src/dialogs.h
+++ b/src/dialogs.h
@@ -115,12 +115,23 @@
 #define IDI_SIGN_48_PNG                 0x6060
 #define IDI_VERIFY_48_PNG               0x6070
 #define IDI_EMBLEM_WARNING_64_PNG       0x6071
-#define IDI_EMBLEM_SUCCESS_64_PNG       0x6072
-#define IDI_EMBLEM_INFORMATION_64_PNG   0x6073
 #define IDI_EMBLEM_QUESTION_64_PNG      0x6074
-#define IDI_EMBLEM_SUCCESS_YELLOW_64_PNG 0x6075
 #define IDI_SIGN_ENCRYPT_40_PNG         0x6075
 #define IDI_ENCRYPT_20_PNG              0x6076
 #define IDI_SIGN_20_PNG                 0x6077
 
+/* Status icons */
+#define ENCRYPT_ICON_OFFSET             0x10
+
+#define IDI_LEVEL_0                     0x6080
+#define IDI_LEVEL_1                     0x6081
+#define IDI_LEVEL_2                     0x6082
+#define IDI_LEVEL_3                     0x6083
+#define IDI_LEVEL_4                     0x6084
+#define IDI_LEVEL_0_ENC                 (IDI_LEVEL_0 + ENCRYPT_ICON_OFFSET)
+#define IDI_LEVEL_1_ENC                 (IDI_LEVEL_1 + ENCRYPT_ICON_OFFSET)
+#define IDI_LEVEL_2_ENC                 (IDI_LEVEL_2 + ENCRYPT_ICON_OFFSET)
+#define IDI_LEVEL_3_ENC                 (IDI_LEVEL_3 + ENCRYPT_ICON_OFFSET)
+#define IDI_LEVEL_4_ENC                 (IDI_LEVEL_4 + ENCRYPT_ICON_OFFSET)
+
 #endif /*DIALOGS_H*/
diff --git a/src/dialogs.rc b/src/dialogs.rc
index b51f556..a3ee628 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -52,13 +52,18 @@ IDB_DECRYPT_VERIFY_16M    BITMAP  DISCARDABLE  "icons/decrypt-verify-16m.bmp"
 
 IDI_ENCSIGN_FILE_48_PNG   RCDATA               "icons/encrypt-sign-file-48.png"
 
-IDI_EMBLEM_WARNING_64_PNG RCDATA               "icons/emblem-warning-64.png"
-IDI_EMBLEM_SUCCESS_64_PNG RCDATA               "icons/emblem-success-64.png"
-IDI_EMBLEM_SUCCESS_YELLOW_64_PNG RCDATA        "icons/emblem-success-yellow-64.png"
-IDI_EMBLEM_INFORMATION_64_PNG RCDATA           "icons/emblem-information-64.png"
-IDI_EMBLEM_QUESTION_64_PNG RCDATA              "icons/emblem-question-64.png"
-
-IDI_SIGN_ENCRYPT_40_PNG    RCDATA              "icons/sing-enc-40.png"
+IDI_LEVEL_0_ENC             RCDATA             "icons/level-0-enc.png"
+IDI_LEVEL_1_ENC             RCDATA             "icons/level-1-enc.png"
+IDI_LEVEL_2_ENC             RCDATA             "icons/level-2-enc.png"
+IDI_LEVEL_3_ENC             RCDATA             "icons/level-3-enc.png"
+IDI_LEVEL_4_ENC             RCDATA             "icons/level-4-enc.png"
+IDI_LEVEL_0                 RCDATA             "icons/level-0.png"
+IDI_LEVEL_1                 RCDATA             "icons/level-1.png"
+IDI_LEVEL_2                 RCDATA             "icons/level-2.png"
+IDI_LEVEL_3                 RCDATA             "icons/level-3.png"
+IDI_LEVEL_4                 RCDATA             "icons/level-4.png"
+
+IDI_SIGN_ENCRYPT_40_PNG    RCDATA              "icons/sign-enc-40.png"
 IDI_ENCRYPT_20_PNG         RCDATA              "icons/encrypt-20.png"
 IDI_SIGN_20_PNG            RCDATA              "icons/sign-20.png"
 
diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index a649ffe..eaafd18 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -646,7 +646,7 @@ GpgolRibbonExtender::GetIDsOfNames (REFIID riid, LPOLESTR *rgszNames,
       ID_MAPPER (L"getSigSTip", ID_GET_SIG_STIP)
       ID_MAPPER (L"getSigTip", ID_GET_SIG_TTIP)
       ID_MAPPER (L"launchDetails", ID_LAUNCH_CERT_DETAILS)
-      ID_MAPPER (L"getIsSigned", ID_GET_IS_SIGNED)
+      ID_MAPPER (L"getIsCrypto", ID_GET_IS_CRYPTO)
     }
 
   if (cNames > 1)
@@ -741,8 +741,8 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
         return get_sig_label (parms->rgvarg[0].pdispVal, result);
       case ID_LAUNCH_CERT_DETAILS:
         return launch_cert_details (parms->rgvarg[0].pdispVal);
-      case ID_GET_IS_SIGNED:
-        return get_is_signed (parms->rgvarg[0].pdispVal, result);
+      case ID_GET_IS_CRYPTO:
+        return get_is_crypto (parms->rgvarg[0].pdispVal, result);
 
       case ID_ON_LOAD:
           {
@@ -767,7 +767,7 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
       case IDI_SIGN_20_PNG:
         return getIcon (dispid, result);
       case ID_BTN_SIGSTATE_LARGE:
-        return get_sigstate_icon (parms->rgvarg[0].pdispVal, result);
+        return get_crypto_icon (parms->rgvarg[0].pdispVal, result);
     }
 
   log_debug ("%s:%s: leave", SRCNAME, __func__);
@@ -883,7 +883,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "               getScreentip=\"getSigTip\""
         "               getSupertip=\"getSigSTip\""
         "               onAction=\"launchDetails\""
-        "               getEnabled=\"getIsSigned\"/>"
+        "               getEnabled=\"getIsCrypto\"/>"
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn\""
         "                 onAction=\"openOptions\""
@@ -926,7 +926,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "               getScreentip=\"getSigTip\""
         "               getSupertip=\"getSigSTip\""
         "               onAction=\"launchDetails\""
-        "               getEnabled=\"getIsSigned\"/>"
+        "               getEnabled=\"getIsCrypto\"/>"
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn_read\""
         "                 onAction=\"openOptions\""
diff --git a/src/icons/Makefile.am b/src/icons/Makefile.am
index c65e707..914742a 100644
--- a/src/icons/Makefile.am
+++ b/src/icons/Makefile.am
@@ -23,14 +23,10 @@ EXTRA_DIST= \
     encrypt-sign-file-48.png \
     sign-48.png verify-48.png \
     README.icons\
-    emblem-question-64.png \
-    emblem-warning-64.png \
-    emblem-success-64.png \
-    emblem-information-64.png \
-    emblem-success-yellow-64.png \
-    emblem-question.svg \
-    emblem-warning.svg \
-    emblem-information.svg \
-    emblem-success-yellow.svg \
     sign.svg sign-enc.svg enc.svg \
-    sign-enc-40.png sign-20.png encrypt-20.png
+    sign-enc-40.png sign-20.png encrypt-20.png \
+    level-0.svg level-0-enc.svg level-0.png level-0-enc.png \
+    level-1.svg level-1-enc.svg level-1.png level-1-enc.png \
+    level-2.svg level-2-enc.svg level-2.png level-2-enc.png \
+    level-3.svg level-3-enc.svg level-3.png level-3-enc.png \
+    level-4.svg level-4-enc.svg level-4.png level-4-enc.png
diff --git a/src/icons/emblem-information-64.png b/src/icons/emblem-information-64.png
deleted file mode 100644
index cce8e5e..0000000
Binary files a/src/icons/emblem-information-64.png and /dev/null differ
diff --git a/src/icons/emblem-information.svg b/src/icons/emblem-information.svg
deleted file mode 100644
index 2deec9a..0000000
--- a/src/icons/emblem-information.svg
+++ /dev/null
@@ -1,21 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8">
-  <defs id="defs3051">
-    <style type="text/css" id="current-color-scheme">
-      .ColorScheme-Highlight {
-        color:#3daee9;
-      }
-      </style>
-  </defs>
-  <g
-     transform="translate(-7,-1037.3622)">
-    <path
-       style="fill:currentColor;fill-opacity:1;stroke:none"
-       d="m 15,1041.3622 a 4,4 0 0 1 -4,4 4,4 0 0 1 -4,-4 4,4 0 0 1 4,-4 4,4 0 0 1 4,4 z"
-       class="ColorScheme-Highlight" />
-    <path
-       style="opacity:1;fill:#ffffff;fill-opacity:1;stroke:none"
-       d="M 3.5 1 L 3.5 2 L 4.5 2 L 4.5 1 L 3.5 1 z M 3.5 3 L 3.5 7 L 4.5 7 L 4.5 3 L 3.5 3 z "
-       transform="translate(7,1037.3622)"
-       id="rect4241" />
-  </g>
-</svg>
diff --git a/src/icons/emblem-question-64.png b/src/icons/emblem-question-64.png
deleted file mode 100644
index 05c1312..0000000
Binary files a/src/icons/emblem-question-64.png and /dev/null differ
diff --git a/src/icons/emblem-question.svg b/src/icons/emblem-question.svg
deleted file mode 100644
index f015e64..0000000
--- a/src/icons/emblem-question.svg
+++ /dev/null
@@ -1,10 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8">
- <path
-     style="fill:#9b59b6;fill-opacity:1;stroke:none"
-     d="M 2 0 C 0.8919807 0 0 0.892 0 2 L 0 6 C 0 7.1081 0.8919807 8 2 8 L 6 8 C 7.108019 8 8 7.1081 8 6 L 8 2 C 8 0.892 7.108019 0 6 0 L 2 0 z "
-     />
- <path
-     style="fill:#ffffff;fill-opacity:1;stroke:none"
-     d="M 4 1 C 3.51389 1 3.0599989 1.1705344 2.7402344 1.4902344 C 2.4204694 1.8100344 2.25 2.2639 2.25 2.75 L 3.25 2.75 C 3.25 2.4861 3.3295286 2.3149656 3.4472656 2.1972656 C 3.5650006 2.0795656 3.736112 2 4 2 C 4.26389 2 4.4349984 2.0799656 4.5527344 2.1972656 C 4.6704694 2.3149656 4.75 2.4861 4.75 2.75 C 4.75 2.9792 4.7048303 3.0776625 4.6445312 3.1640625 C 4.5842412 3.2500625 4.4849756 3.3305938 4.3378906 3.4335938 C 4.1908036 3.5364937 3.9968862 3.6547344 3.8164062 3.8652344 C 3.6359262 4.0758344 3.5 4.3959 3.5 4.75 L 3.5 5 L 4.5 5 L 4.5 4.75 C 4.5 4.6042 4.5203088 4.578525 4.5742188 4.515625 C 4.6281087 4.452625 4.7466934 4.3697062 4.9121094 4.2539062 C 5.0775214 4.1381062 5.2907638 3.983975 5.4648438 3.734375 C 5.6389238 3.484875 5.75 3.1458 5.75 2.75 C 5.75 2.2639 5.5795326 1.8100344 5.2597656 1.4902344 C 4.9400006 1.1705344 4.486112 1 4 1 z M 3.5 6 L 3.5 7 L 4.5 7 L 4.5 6 L 3.5 6 z "
-     />
-</svg>
diff --git a/src/icons/emblem-success-64.png b/src/icons/emblem-success-64.png
deleted file mode 100644
index b955af1..0000000
Binary files a/src/icons/emblem-success-64.png and /dev/null differ
diff --git a/src/icons/emblem-success-yellow-64.png b/src/icons/emblem-success-yellow-64.png
deleted file mode 100644
index b81aed1..0000000
Binary files a/src/icons/emblem-success-yellow-64.png and /dev/null differ
diff --git a/src/icons/emblem-success-yellow.svg b/src/icons/emblem-success-yellow.svg
deleted file mode 100644
index 563d047..0000000
--- a/src/icons/emblem-success-yellow.svg
+++ /dev/null
@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   viewBox="0 0 8 8"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.48.5 r10040"
-   width="100%"
-   height="100%"
-   sodipodi:docname="emblem-success.svg">
-  <metadata
-     id="metadata12">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <sodipodi:namedview
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1"
-     objecttolerance="10"
-     gridtolerance="10"
-     guidetolerance="10"
-     inkscape:pageopacity="0"
-     inkscape:pageshadow="2"
-     inkscape:window-width="1920"
-     inkscape:window-height="1060"
-     id="namedview10"
-     showgrid="false"
-     inkscape:zoom="29.5"
-     inkscape:cx="4"
-     inkscape:cy="4.0169492"
-     inkscape:window-x="-2"
-     inkscape:window-y="-3"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="svg2" />
-  <defs
-     id="defs3051">
-    <style
-       type="text/css"
-       id="current-color-scheme">
-      .ColorScheme-PositiveText {
-        color:#27ae60;
-      }
-      </style>
-  </defs>
-  <path
-     style="fill:currentColor;fill-opacity:1;stroke:none"
-     class="ColorScheme-PositiveText"
-     d="M 4 0 C 1.784 0 0 1.784 0 4 C 0 6.216 1.784 8 4 8 C 6.216 8 8 6.216 8 4 C 8 1.784 6.216 0 4 0 z "
-     id="path6" />
-  <path
-     style="fill:#ffffff;fill-opacity:1;stroke:none"
-     d="M 6 2 L 3 5 L 2 4 L 1 5 L 2 6 L 3 7 L 7 3 L 6 2 z "
-     id="path8" />
-  <path
-     style="fill:#ffd42a;fill-opacity:0.94117647000000004;stroke:#000000;stroke-width:0.03389831000000000;stroke-opacity:1"
-     d="M 3.3232154,7.9242607 C 1.7484941,7.6251271 0.55453708,6.5163227 0.13835987,4.9665485 0.05799792,4.6672939 0.04884008,4.5726417 0.0471396,4.0237288 0.0451555,3.3832678 0.08992259,3.0957175 0.26471592,2.6261812 0.89372244,0.93652085 2.5766492,-0.12563207 4.3576271,0.04300418 5.1376464,0.11686222 5.7769136,0.36446515 6.4033722,0.83536851 8.1559719,2.1527823 8.4949549,4.6703692 7.1555471,6.4216864 6.6061339,7.1400614 5.8250061,7.6445356 4.9084746,7.8729092 4.5347946,7.9660197 3.6875275,7.9934651 3.3232154,7.9242607 l 0,0 z M 6.5186969,2.4814089 6.0107349,1.9725985 4.5104525,3.4725966 3.0101703,4.9725949 2.5104404,4.4728651 2.0107105,3.9731349 1.4933899,4.4896481 0.97606936,5.006161 1.9845212,6.0150332 2.9929729,7.0239054 5.0098159,5.0070624 7.026659,2.9902192 6.5186969,2.4814089 z"
-     id="path2989"
-     inkscape:connector-curvature="0" />
-</svg>
diff --git a/src/icons/emblem-success.svg b/src/icons/emblem-success.svg
deleted file mode 100644
index faa74e3..0000000
--- a/src/icons/emblem-success.svg
+++ /dev/null
@@ -1,18 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8">
-  <defs id="defs3051">
-    <style type="text/css" id="current-color-scheme">
-      .ColorScheme-PositiveText {
-        color:#27ae60;
-      }
-      </style>
-  </defs>
-  <path
-      style="fill:currentColor;fill-opacity:1;stroke:none"
-     class="ColorScheme-PositiveText"
-    d="M 4 0 C 1.784 0 0 1.784 0 4 C 0 6.216 1.784 8 4 8 C 6.216 8 8 6.216 8 4 C 8 1.784 6.216 0 4 0 z "
-      />
-    <path
-       style="fill:#ffffff;fill-opacity:1;stroke:none"
-       d="M 6 2 L 3 5 L 2 4 L 1 5 L 2 6 L 3 7 L 7 3 L 6 2 z "
-        />
-</svg>
diff --git a/src/icons/emblem-warning-64.png b/src/icons/emblem-warning-64.png
deleted file mode 100644
index 31bbbb8..0000000
Binary files a/src/icons/emblem-warning-64.png and /dev/null differ
diff --git a/src/icons/emblem-warning.svg b/src/icons/emblem-warning.svg
deleted file mode 100644
index 1cad345..0000000
--- a/src/icons/emblem-warning.svg
+++ /dev/null
@@ -1,18 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8">
-  <defs id="defs3051">
-    <style type="text/css" id="current-color-scheme">
-      .ColorScheme-NeutralText {
-        color:#f67400;
-      }
-      </style>
-  </defs>
-  <path
-      style="fill:currentColor;fill-opacity:1;stroke:none"
-     class="ColorScheme-NeutralText"
-    d="M 4 0 C 3.7964835 0.00025315917 3.644678 0.09649124 3.5371094 0.3125 C 3.5371094 0.3125 0.077246535 7.200596 0.080078125 7.2285156 C 0.043417505 7.3055016 -1.2456632e-05 7.403681 0 7.5 C 0 7.7761424 0.22385763 8 0.5 8 L 7.5 8 C 7.7761424 8 8 7.7761424 8 7.5 C 8.0002021 7.3873383 7.9818808 7.3677538 7.8925781 7.1894531 L 4.4550781 0.29101562 C 4.346001 0.097741395 4.1955491 -0.00033128801 4 0 z "
-      />
-    <path
-       style="fill:#ffffff;fill-opacity:1;stroke:none"
-       d="M 3.5 2 L 3.5 5 L 4.5 5 L 4.5 2 L 3.5 2 z M 3.5 6 L 3.5 7 L 4.5 7 L 4.5 6 L 3.5 6 z "
-        />
-</svg>
diff --git a/src/icons/level-0-enc.png b/src/icons/level-0-enc.png
new file mode 100644
index 0000000..8b00eff
Binary files /dev/null and b/src/icons/level-0-enc.png differ
diff --git a/src/icons/level-0-enc.svg b/src/icons/level-0-enc.svg
new file mode 100644
index 0000000..990493f
--- /dev/null
+++ b/src/icons/level-0-enc.svg
@@ -0,0 +1,111 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48"
+   height="48"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-0-enc.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-0-enc.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="11.313708"
+     inkscape:cx="-11.284963"
+     inkscape:cy="25.539672"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432"
+       empspacing="5"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       id="path4195-5"
+       d="M 4.235958,11.38487 4.0179328,22.175169 9.170461,22.10315 9.1051629,11.384873 C 9.0837653,7.8717472 12.045973,5.0105893 15.64795,5.0105893 c 3.601974,0 6.542783,2.8579736 6.542783,6.3742837 l 0.04141,10.7335 4.827804,0.203709 0,-10.937209 c 0,-6.0279569 -5.12059,-10.92021124 -11.422323,-10.92021124 l 0,0 c -6.2982915,0 -11.4223248,4.90473444 -11.4223248,10.92021124"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       sodipodi:nodetypes="cccsssccsccc" />
+    <rect
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       id="rect4451"
+       width="29.070675"
+       height="21.932192"
+       x="0.46466279"
+       y="22.103146" />
+    <g
+       id="g5274"
+       transform="matrix(3.9839401,0,0,3.9837562,16.06424,16.064971)"
+       style="stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none">
+      <path
+         id="path5264"
+         d="M 2,0 C 0.8919807,0 0,0.892 0,2 L 0,6 C 0,7.1081 0.8919807,8 2,8 L 6,8 C 7.108019,8 8,7.1081 8,6 L 8,2 C 8,0.892 7.108019,0 6,0 L 2,0 z"
+         style="fill:#9b59b6;fill-opacity:1;stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+      <path
+         id="path5266"
+         d="M 4,1 C 3.51389,1 3.0599989,1.1705344 2.7402344,1.4902344 2.4204694,1.8100344 2.25,2.2639 2.25,2.75 l 1,0 C 3.25,2.4861 3.3295286,2.3149656 3.4472656,2.1972656 3.5650006,2.0795656 3.736112,2 4,2 4.26389,2 4.4349984,2.0799656 4.5527344,2.1972656 4.6704694,2.3149656 4.75,2.4861 4.75,2.75 4.75,2.9792 4.70483,3.0776625 4.6445312,3.1640625 4.5842412,3.2500625 4.4849756,3.3305938 4.3378906,3.4335938 4.1908036,3.5364937 3.9968862,3.6547344 3.8164062,3.8652344 3.6359262,4.0758344 3.5,4.3959 3.5,4.75 l 0,0.25 1,0 0,-0.25 C 4.5,4.6042 4.520309,4.578525 4.574219,4.515625 4.628109,4.452625 4.7466936,4.3697062 4.9121096,4.2539062 5.0775214,4.1381062 5.2907638,3.983975 5.4648438,3.734375 5.6389238,3.484875 5.75,3.1458 5.75,2.75 5.75,2.2639 5.5795326,1.8100344 5.2597656,1.4902344 4.9400006,1.1705344 4.486112,1 4,1 z m -0.5,5 0,1 1,0 0,-1 -1,0 z"
+         style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+    </g>
+  </g>
+</svg>
diff --git a/src/icons/level-0.png b/src/icons/level-0.png
new file mode 100644
index 0000000..dac009d
Binary files /dev/null and b/src/icons/level-0.png differ
diff --git a/src/icons/level-0.svg b/src/icons/level-0.svg
new file mode 100644
index 0000000..063e228
--- /dev/null
+++ b/src/icons/level-0.svg
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48"
+   height="48"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-0.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-0.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="11.313708"
+     inkscape:cx="-11.284963"
+     inkscape:cy="25.539672"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432"
+       empspacing="5"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <g
+       id="g5274"
+       transform="matrix(5.9799555,0,0,5.9799555,0.08017817,0.0801784)"
+       style="stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none">
+      <path
+         id="path5264"
+         d="M 2,0 C 0.8919807,0 0,0.892 0,2 L 0,6 C 0,7.1081 0.8919807,8 2,8 L 6,8 C 7.108019,8 8,7.1081 8,6 L 8,2 C 8,0.892 7.108019,0 6,0 L 2,0 z"
+         style="fill:#9b59b6;fill-opacity:1;stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+      <path
+         id="path5266"
+         d="M 4,1 C 3.51389,1 3.0599989,1.1705344 2.7402344,1.4902344 2.4204694,1.8100344 2.25,2.2639 2.25,2.75 l 1,0 C 3.25,2.4861 3.3295286,2.3149656 3.4472656,2.1972656 3.5650006,2.0795656 3.736112,2 4,2 4.26389,2 4.4349984,2.0799656 4.5527344,2.1972656 4.6704694,2.3149656 4.75,2.4861 4.75,2.75 4.75,2.9792 4.70483,3.0776625 4.6445312,3.1640625 4.5842412,3.2500625 4.4849756,3.3305938 4.3378906,3.4335938 4.1908036,3.5364937 3.9968862,3.6547344 3.8164062,3.8652344 3.6359262,4.0758344 3.5,4.3959 3.5,4.75 l 0,0.25 1,0 0,-0.25 C 4.5,4.6042 4.520309,4.578525 4.574219,4.515625 4.628109,4.452625 4.7466936,4.3697062 4.9121096,4.2539062 5.0775214,4.1381062 5.2907638,3.983975 5.4648438,3.734375 5.6389238,3.484875 5.75,3.1458 5.75,2.75 5.75,2.2639 5.5795326,1.8100344 5.2597656,1.4902344 4.9400006,1.1705344 4.486112,1 4,1 z m -0.5,5 0,1 1,0 0,-1 -1,0 z"
+         style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:0.02681564;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+    </g>
+  </g>
+</svg>
diff --git a/src/icons/level-1-enc.png b/src/icons/level-1-enc.png
new file mode 100644
index 0000000..961cbc4
Binary files /dev/null and b/src/icons/level-1-enc.png differ
diff --git a/src/icons/level-1-enc.svg b/src/icons/level-1-enc.svg
new file mode 100644
index 0000000..b18ab67
--- /dev/null
+++ b/src/icons/level-1-enc.svg
@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-1-enc.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-1-enc.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+    <style
+       id="current-color-scheme-6"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="26.835933"
+     inkscape:cx="32.000001"
+     inkscape:cy="16.506905"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       id="path4195-5"
+       d="m 4.735958,11.384869 -0.2180253,10.7903 5.1525285,-0.07202 -0.065299,-10.718276 C 9.5837615,7.8717472 12.545973,5.0105892 16.147949,5.0105892 c 3.601974,0 6.542785,2.8579738 6.542785,6.3742838 l 0.04141,10.733498 4.827806,0.203711 0,-10.937209 c 0,-6.027957 -5.120591,-10.92021125 -11.422324,-10.92021125 l 0,0 c -6.2982911,0 -11.4223248,4.90473425 -11.4223248,10.92021125"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       sodipodi:nodetypes="cccsssccsccc" />
+    <rect
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       id="rect4451"
+       width="29.070675"
+       height="21.93219"
+       x="0.96466279"
+       y="22.103146" />
+    <g
+       id="g5434"
+       transform="matrix(3.9845616,0,0,3.9843743,-11.829435,-4117.1768)"
+       style="stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none">
+      <path
+         id="path5436"
+         class="ColorScheme-Highlight"
+         d="m 15,1041.3622 a 4,4 0 0 1 -4,4 4,4 0 0 1 -4,-4 4,4 0 0 1 4,-4 4,4 0 0 1 4,4 z"
+         style="color:#3daee9;fill:currentColor;fill-opacity:1;stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+      <path
+         id="rect4241"
+         transform="translate(7,1037.3622)"
+         d="m 3.5,1 0,1 1,0 0,-1 -1,0 z m 0,2 0,4 1,0 0,-4 -1,0 z"
+         style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+    </g>
+  </g>
+</svg>
diff --git a/src/icons/level-1.png b/src/icons/level-1.png
new file mode 100644
index 0000000..a8245c5
Binary files /dev/null and b/src/icons/level-1.png differ
diff --git a/src/icons/level-1.svg b/src/icons/level-1.svg
new file mode 100644
index 0000000..0cd2a08
--- /dev/null
+++ b/src/icons/level-1.svg
@@ -0,0 +1,102 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-1.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-1.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+    <style
+       id="current-color-scheme-6"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="11.313708"
+     inkscape:cx="-11.284963"
+     inkscape:cy="25.539672"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <g
+       id="g5434"
+       transform="matrix(5.9818121,0,0,5.9818121,-41.799933,-6205.233)"
+       style="stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none">
+      <path
+         id="path5436"
+         class="ColorScheme-Highlight"
+         d="m 15,1041.3622 a 4,4 0 0 1 -4,4 4,4 0 0 1 -4,-4 4,4 0 0 1 4,-4 4,4 0 0 1 4,4 z"
+         style="color:#3daee9;fill:currentColor;fill-opacity:1;stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+      <path
+         id="rect4241"
+         transform="translate(7,1037.3622)"
+         d="m 3.5,1 0,1 1,0 0,-1 -1,0 z m 0,2 0,4 1,0 0,-4 -1,0 z"
+         style="fill:#ffffff;fill-opacity:1;stroke:#000000;stroke-width:0.02432432;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+         inkscape:connector-curvature="0" />
+    </g>
+  </g>
+</svg>
diff --git a/src/icons/level-2-enc.png b/src/icons/level-2-enc.png
new file mode 100644
index 0000000..88c8c5c
Binary files /dev/null and b/src/icons/level-2-enc.png differ
diff --git a/src/icons/level-2-enc.svg b/src/icons/level-2-enc.svg
new file mode 100644
index 0000000..2669bd6
--- /dev/null
+++ b/src/icons/level-2-enc.svg
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-2-enc.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-2-enc.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="5.6568543"
+     inkscape:cx="-39.439085"
+     inkscape:cy="39.861995"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="false">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,48"
+       id="guide4453" />
+    <sodipodi:guide
+       position="48,0"
+       orientation="-48,0"
+       id="guide4455" />
+    <sodipodi:guide
+       position="48,48"
+       orientation="0,-48"
+       id="guide4457" />
+    <sodipodi:guide
+       position="0,48"
+       orientation="48,0"
+       id="guide4459" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       id="path4195"
+       d="M 4.2359594,11.38487 4.0179339,22.175169 9.1704627,22.10315 9.1051672,11.384873 C 9.0837656,7.8717479 12.045977,5.0105895 15.647953,5.0105895 c 3.601975,0 6.542785,2.8579742 6.542785,6.3742835 l 0.04141,10.733499 4.827805,0.20371 0,-10.937209 c 0,-6.0279566 -5.120591,-10.92021125 -11.422324,-10.92021125 l 0,0 c -6.2982906,0 -11.4223243,4.90473485 -11.4223243,10.92021125"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       sodipodi:nodetypes="cccsssccsccc" />
+    <rect
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       id="rect4451"
+       width="29.070675"
+       height="21.93219"
+       x="0.46466279"
+       y="22.103146" />
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#141414;stroke-width:0.47197506;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 31.999994,16.235986 c -8.733266,0 -15.764006,7.030749 -15.764006,15.764013 0,8.733264 7.03074,15.764013 15.764006,15.764013 8.733265,0 15.764015,-7.030749 15.764015,-15.764013 0,-8.733264 -7.03075,-15.764013 -15.764015,-15.764013 z"
+       id="path4387"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       style="stroke:#ffffff;stroke-width:6.65334034;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       inkscape:connector-curvature="0"
+       d="M 22.704998,31.346016 H 42.71243 M 32.708712,21.3423 v 20.007434"
+       id="path6" />
+  </g>
+</svg>
diff --git a/src/icons/level-2.png b/src/icons/level-2.png
new file mode 100644
index 0000000..505f9de
Binary files /dev/null and b/src/icons/level-2.png differ
diff --git a/src/icons/level-2.svg b/src/icons/level-2.svg
new file mode 100644
index 0000000..bca880e
--- /dev/null
+++ b/src/icons/level-2.svg
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-2.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-2.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="16"
+     inkscape:cx="21.252968"
+     inkscape:cy="41.031963"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1003"
+     inkscape:window-x="1918"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="false">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,48"
+       id="guide4453" />
+    <sodipodi:guide
+       position="48,0"
+       orientation="-48,0"
+       id="guide4455" />
+    <sodipodi:guide
+       position="48,48"
+       orientation="0,-48"
+       id="guide4457" />
+    <sodipodi:guide
+       position="0,48"
+       orientation="48,0"
+       id="guide4459" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#141414;stroke-width:0.70796257;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 23.999998,0.35398141 c -13.099895,0 -23.64601671,10.54612459 -23.64601671,23.64601959 0,13.099895 10.54612171,23.646018 23.64601671,23.646018 13.099896,0 23.646021,-10.546123 23.646021,-23.646018 0,-13.099895 -10.546125,-23.64601959 -23.646021,-23.64601959 z"
+       id="path4387"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       style="stroke:#ffffff;stroke-width:9.98001003;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       inkscape:connector-curvature="0"
+       d="M 10.0575,23.019027 H 40.06865 M 25.063075,8.0134522 V 38.024602"
+       id="path6" />
+  </g>
+</svg>
diff --git a/src/icons/level-3-enc.png b/src/icons/level-3-enc.png
new file mode 100644
index 0000000..fccbd9d
Binary files /dev/null and b/src/icons/level-3-enc.png differ
diff --git a/src/icons/level-3-enc.svg b/src/icons/level-3-enc.svg
new file mode 100644
index 0000000..9346cd1
--- /dev/null
+++ b/src/icons/level-3-enc.svg
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-3-enc.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-3-enc.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="5.6568543"
+     inkscape:cx="-39.439085"
+     inkscape:cy="37.210344"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="false">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,48"
+       id="guide4453" />
+    <sodipodi:guide
+       position="48,0"
+       orientation="-48,0"
+       id="guide4455" />
+    <sodipodi:guide
+       position="48,48"
+       orientation="0,-48"
+       id="guide4457" />
+    <sodipodi:guide
+       position="0,48"
+       orientation="48,0"
+       id="guide4459" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       id="path4195"
+       d="M 4.7359594,11.38487 4.5179339,22.175169 9.6704627,22.10315 9.6051672,11.384873 C 9.5837656,7.8717479 12.545977,5.0105895 16.147953,5.0105895 c 3.601975,0 6.542785,2.8579742 6.542785,6.3742835 l 0.04141,10.733499 4.827805,0.20371 0,-10.937209 c 0,-6.0279566 -5.120591,-10.92021125 -11.422324,-10.92021125 l 0,0 c -6.2982906,0 -11.4223243,4.90473485 -11.4223243,10.92021125"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       sodipodi:nodetypes="cccsssccsccc" />
+    <rect
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       id="rect4451"
+       width="29.070675"
+       height="21.93219"
+       x="0.96466279"
+       y="22.103146" />
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#141414;stroke-width:0.47290644;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 32,16.236454 c -8.733005,0 -15.763547,7.030541 -15.763547,15.763547 0,8.733005 7.030542,15.763546 15.763547,15.763546 8.733006,0 15.763547,-7.030541 15.763547,-15.763546 0,-8.733006 -7.030541,-15.763547 -15.763547,-15.763547 z"
+       id="path4387"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       d="m 40.334027,23.533934 -11.9037,11.9037 -3.9679,-3.967899 -3.967901,3.967899 3.967901,3.967901 3.9679,3.9679 15.8716,-15.8716 -3.9679,-3.967901 z"
+       id="path4389" />
+  </g>
+</svg>
diff --git a/src/icons/level-3.png b/src/icons/level-3.png
new file mode 100644
index 0000000..e62ba2f
Binary files /dev/null and b/src/icons/level-3.png differ
diff --git a/src/icons/level-3.svg b/src/icons/level-3.svg
new file mode 100644
index 0000000..d0867e0
--- /dev/null
+++ b/src/icons/level-3.svg
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-3.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-2.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="5.6568543"
+     inkscape:cx="-39.439085"
+     inkscape:cy="39.950383"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="false">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,48"
+       id="guide4453" />
+    <sodipodi:guide
+       position="48,0"
+       orientation="-48,0"
+       id="guide4455" />
+    <sodipodi:guide
+       position="48,48"
+       orientation="0,-48"
+       id="guide4457" />
+    <sodipodi:guide
+       position="0,48"
+       orientation="48,0"
+       id="guide4459" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#141414;stroke-width:0.70935965;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 23.999999,0.35468014 c -13.099507,0 -23.64531919,10.54581186 -23.64531919,23.64532086 0,13.099507 10.54581219,23.645319 23.64531919,23.645319 13.099509,0 23.645321,-10.545812 23.645321,-23.645319 0,-13.099509 -10.545812,-23.64532086 -23.645321,-23.64532086 z"
+       id="path4387"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       d="m 36.50104,11.300901 -17.85555,17.85555 -5.95185,-5.951849 -5.9518507,5.951849 5.9518507,5.951851 5.95185,5.95185 23.8074,-23.8074 -5.95185,-5.951851 z"
+       id="path4389" />
+  </g>
+</svg>
diff --git a/src/icons/level-4-enc.png b/src/icons/level-4-enc.png
new file mode 100644
index 0000000..da1d2ff
Binary files /dev/null and b/src/icons/level-4-enc.png differ
diff --git a/src/icons/level-4-enc.svg b/src/icons/level-4-enc.svg
new file mode 100644
index 0000000..5bda835
--- /dev/null
+++ b/src/icons/level-4-enc.svg
@@ -0,0 +1,110 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48"
+   height="48"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-4-enc.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-4-enc.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="8"
+     inkscape:cx="-31.305587"
+     inkscape:cy="30.034712"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1060"
+     inkscape:window-x="3838"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432"
+       empspacing="5"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       id="path4195-5"
+       d="m 4.235958,11.384869 -0.2180253,10.7903 5.1525285,-0.07202 -0.065299,-10.718276 C 9.0837615,7.8717472 12.045973,5.0105892 15.647949,5.0105892 c 3.601974,0 6.542785,2.8579738 6.542785,6.3742838 l 0.04141,10.733498 4.827806,0.203711 0,-10.937209 c 0,-6.027957 -5.120591,-10.92021125 -11.422324,-10.92021125 l 0,0 c -6.2982911,0 -11.4223248,4.90473425 -11.4223248,10.92021125"
+       class="cls-3"
+       inkscape:connector-curvature="0"
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       sodipodi:nodetypes="cccsssccsccc" />
+    <rect
+       style="fill:#ffffff;fill-opacity:1;stroke:#141414;stroke-width:0.92932558;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       id="rect4451"
+       width="29.070675"
+       height="21.93219"
+       x="0.46466279"
+       y="22.103146" />
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#000000;stroke-width:0.33065793;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 32,16.16533 c -8.772408,0 -15.834671,7.062262 -15.834671,15.834672 0,8.772406 7.062263,15.83467 15.834671,15.83467 8.772408,0 15.834672,-7.062264 15.834672,-15.83467 C 47.834672,23.227592 40.772408,16.16533 32,16.16533 z"
+       id="path4387-2"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       class="ColorScheme-Text"
+       id="rect4161-9"
+       d="m 32.42467,17.908178 -3.92122,8.337264 -8.745447,1.335889 6.333333,6.494136 -1.496756,9.166044 7.83009,-4.329403 7.83009,4.329403 -1.496757,-9.166044 6.333334,-6.494136 -8.745446,-1.335889 -3.921221,-8.337264 z"
+       style="color:#4d4d4d;fill:#ffffff;fill-opacity:1;stroke:none"
+       inkscape:connector-curvature="0" />
+  </g>
+</svg>
diff --git a/src/icons/level-4.png b/src/icons/level-4.png
new file mode 100644
index 0000000..90773ce
Binary files /dev/null and b/src/icons/level-4.png differ
diff --git a/src/icons/level-4.svg b/src/icons/level-4.svg
new file mode 100644
index 0000000..f79fe94
--- /dev/null
+++ b/src/icons/level-4.svg
@@ -0,0 +1,92 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="48px"
+   height="48px"
+   id="svg3020"
+   version="1.1"
+   inkscape:version="0.48.5 r10040"
+   inkscape:export-filename="/home/aheinecke/arbeit/kf5/src/gpgol/src/icons/level-4.png"
+   inkscape:export-xdpi="75"
+   inkscape:export-ydpi="75"
+   sodipodi:docname="level-4.svg">
+  <defs
+     id="defs3022">
+    <style
+       id="current-color-scheme"
+       type="text/css">
+      .ColorScheme-Highlight {
+        color:#3daee9;
+      }
+      </style>
+    <style
+       id="current-color-scheme-7"
+       type="text/css">
+      .ColorScheme-Text {
+        color:#4d4d4d;
+      }
+      </style>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="16"
+     inkscape:cx="18.719905"
+     inkscape:cy="24.701895"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     inkscape:grid-bbox="true"
+     inkscape:document-units="px"
+     inkscape:window-width="1920"
+     inkscape:window-height="1003"
+     inkscape:window-x="1918"
+     inkscape:window-y="27"
+     inkscape:window-maximized="1">
+    <inkscape:grid
+       type="xygrid"
+       id="grid5432" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata3025">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer">
+    <path
+       inkscape:connector-curvature="0"
+       style="fill:#27ae60;fill-opacity:1;stroke:#000000;stroke-width:0.49598691;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
+       class="ColorScheme-PositiveText"
+       d="m 24.362995,0.32944437 c -13.158611,0 -23.75200602,10.59339463 -23.75200602,23.75200763 0,13.15861 10.59339502,23.752005 23.75200602,23.752005 13.158612,0 23.752007,-10.593395 23.752007,-23.752005 0,-13.158613 -10.593395,-23.75200763 -23.752007,-23.75200763 z"
+       id="path4387"
+       inkscape:export-xdpi="75"
+       inkscape:export-ydpi="75" />
+    <path
+       class="ColorScheme-Text"
+       id="rect4161"
+       d="M 25,2.943716 19.11817,15.449612 6,17.453446 15.499999,27.19465 13.254865,40.943716 25,34.449611 36.745135,40.943716 34.499999,27.19465 44,17.453446 30.881831,15.449612 25,2.943716 z"
+       style="color:#4d4d4d;fill:#ffffff;fill-opacity:1;stroke:none"
+       inkscape:connector-curvature="0" />
+  </g>
+</svg>
diff --git a/src/mail.cpp b/src/mail.cpp
index 395c75a..a872095 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -60,11 +60,6 @@ static std::set<std::string> uids_searched;
 
 #define COPYBUFSIZE (8 * 1024)
 
-/* Our own basic trust level for tofu.
-   GnuPG's can't be trusted. See comment
-   in get_valid_sig why.*/
-#define GPGOL_BASIC_TOFU_TRUST 10
-
 Mail::Mail (LPDISPATCH mailitem) :
     m_mailitem(mailitem),
     m_processed(false),
@@ -1238,44 +1233,33 @@ Mail::update_sigstate ()
   for (const auto sig: m_verify_result.signatures())
     {
       m_is_signed = true;
-      if (sig.validity() != Signature::Validity::Marginal &&
+      m_uid = get_uid_for_sender (sig.key(), sender.c_str());
+      if (!m_uid.isNull() && sig.validity() != Signature::Validity::Marginal &&
           sig.validity() != Signature::Validity::Full &&
           sig.validity() != Signature::Validity::Ultimate)
         {
-          /* For our category we only care about trusted sigs. */
+          /* For our category we only care about trusted sigs. And
+          the UID needs to match.*/
           continue;
         }
-      const auto uid = get_uid_for_sender (sig.key(), sender.c_str());
       if (sig.validity() == Signature::Validity::Marginal)
         {
-          const auto tofu = uid.tofuInfo();
+          const auto tofu = m_uid.tofuInfo();
           if (tofu.isNull() ||
-              (tofu.validity() != TofuInfo::Validity::LittleHistory &&
-               tofu.validity() != TofuInfo::Validity::BasicHistory &&
+              (tofu.validity() != TofuInfo::Validity::BasicHistory &&
                tofu.validity() != TofuInfo::Validity::LargeHistory))
             {
               /* Marginal is not good enough without tofu.
                  We also wait for basic trust. */
-              log_debug ("%s:%s: Discarding marginal signature.",
+              log_debug ("%s:%s: Discarding marginal signature."
+                         "With too little history.",
                          SRCNAME, __func__);
               continue;
             }
-          /* GnuPG uses the encrypt count to determine validity.
-             This does not make sense for us. E.g. Drafts may have
-             been encrypted and encryption is no communication so
-             it does not track communication history or consistency.
-             So basically "our" tofu validity is that more then 10 messages
-             have been exchanged. Which was the original code in GnuPG */
-          if (!tofu.isNull() && tofu.signCount() <= GPGOL_BASIC_TOFU_TRUST) {
-              log_debug ("%s:%s: Tofu signcount too small.",
-                         SRCNAME, __func__);
-              continue;
-          }
         }
       log_debug ("%s:%s: Classified sender as verified",
                  SRCNAME, __func__);
       m_sig = sig;
-      m_uid = uid;
       m_is_valid = true;
       return;
     }
@@ -1286,17 +1270,6 @@ Mail::update_sigstate ()
   return;
 }
 
-const std::pair <Signature, UserID>
-Mail::get_valid_sig ()
-{
-  std::pair <Signature, UserID> ret;
-  if (!m_is_valid)
-    {
-      return ret;
-    }
-  return std::pair<Signature, UserID> (m_sig, m_uid);
-}
-
 bool
 Mail::is_valid_sig ()
 {
@@ -1342,11 +1315,17 @@ Mail::update_categories ()
 }
 
 bool
-Mail::is_signed()
+Mail::is_signed() const
 {
   return m_verify_result.numSignatures() > 0;
 }
 
+bool
+Mail::is_encrypted() const
+{
+  return m_decrypt_result.numRecipients() > 0;
+}
+
 int
 Mail::set_uuid()
 {
@@ -1409,100 +1388,204 @@ Mail::set_uuid()
   return 0;
 }
 
+/* Returns -1 if the mail was signed by a uid with ownertrust
+   ultimate and to which we have the secret key.
+   This basically means "mail was signed by yourself"
+
+   Returns the number of the signature fromt the uid that belongs
+   made it ultimately or fully trusted if the mail was signed by some
+   ultimate key for which we don't have the secret key.
+   This is direct trust or CA Style PGP.
+
+   0 otherwise */
+static int
+level_4_check (const UserID &uid)
+{
+  if (uid.validity() == UserID::Validity::Ultimate)
+    {
+      /* TODO look for the signature that caused this
+         to be ultimate. And check if it is our own. */
+      return -1;
+    }
+  else if (uid.validity() == UserID::Validity::Full)
+    {
+      return 1;
+    }
+  return 0;
+}
+
 std::string
-Mail::get_signature_status()
+Mail::get_crypto_summary ()
 {
-  std::string message;
-  if (!is_signed())
+  const int level = get_signature_level ();
+
+  bool enc = is_encrypted ();
+  if (level > 3 && enc)
+    {
+      return _("Highly Secure");
+    }
+  if (level > 3)
     {
-      message =_("This message is not signed.\n");
-      message += _("You cannot be sure who wrote the message.");
-      return message;
+      return _("Highly Trustworthy");
     }
+  if (level >= 2 && enc)
+    {
+      return _("Secure");
+    }
+  if (level >= 2)
+    {
+      return _("Trustworthy");
+    }
+  if (enc)
+    {
+      return _("Encrypted");
+    }
+  if (is_signed ())
+    {
+      return _("Signed");
+    }
+  return _("Insecure");
+}
 
-  const auto pair = get_valid_sig ();
-  bool keyFound = false;
-  bool isOpenPGP = pair.first.key().protocol() == Protocol::OpenPGP;
+std::string
+Mail::get_crypto_details()
+{
+  /* Handle encrypt only */
+  if (!is_encrypted () && !is_signed ())
+    {
+      return _("You cannot be sure who sent, "
+               "modified and read the message in transit.");
+    }
+  else if (is_encrypted() && !is_signed ())
+    {
+      return _("You cannot be sure who sent the message as "
+               "it is not signed.");
+    }
+
+  std::string message;
+
+  bool keyFound = true;
+  bool isOpenPGP = m_sig.key().protocol() == Protocol::OpenPGP;
   char *buf;
   bool hasConflict = false;
-  if (!pair.first.isNull () && !pair.second.isNull ())
-    {
-      const auto sig = pair.first;
-      const auto uid = pair.second;
-      /* We are valid */
-      keyFound = true;
-      if (sig.validity() == Signature::Validity::Full ||
-          sig.validity() == Signature::Validity::Ultimate)
+  int level = get_signature_level ();
+
+  log_debug ("%s:%s: Formatting sig. Validity: %x Summary: %x Level: %i",
+             SRCNAME, __func__, m_sig.validity(), m_sig.summary(),
+             level);
+
+  if (level == 4)
+    {
+      /* level 4 check for direct trust */
+      int four_check = level_4_check (m_uid);
+
+      if (four_check == -1)
+        {
+          message = _("And you signed this message.");
+        }
+      else if (four_check >= 0)
         {
-          message += _("The sender address is fully trusted because:");
+          /* TODO
+            And you certified the identity of the sender.
+            And <uid with ultimate trust> certified the identity
+            of the sender.
+          */
         }
       else
         {
-          message += _("The sender address is trusted because:");
+          log_error ("%s:%s:%i BUG: Invalid sigstate.",
+                     SRCNAME, __func__, __LINE__);
+          return message;
         }
-      message += "\n\n";
-      message += isOpenPGP ? _("The used key") : _("The used certificate");
-      message += " ";
-      message += sig.validity() == Signature::Validity::Ultimate ?
-                      _("is marked as your own.") :
-                      sig.validity() == Signature::Validity::Full && isOpenPGP &&
-                      uid.tofuInfo().policy() == TofuInfo::PolicyGood ?
-                      _("was marked to be the right key for this address") :
-                      sig.validity() == Signature::Validity::Full && isOpenPGP ?
-                      _("was certified by enough trusted keys or yourself.") :
-                      "";
-      if (sig.validity() == Signature::Validity::Full && !isOpenPGP)
+    }
+  else if (level == 3 && isOpenPGP)
+    {
+      /* Level three is only reachable through web of trust and no
+         direct signature. */
+      message = _("And the senders identity was certified by several trusted people.");
+    }
+  else if (level == 3 && !isOpenPGP)
+    {
+      /* Level three is the only level for trusted S/MIME keys. */
+      gpgrt_asprintf (&buf, _("And the senders identity is cerified by the trusted issuer:\n'%s'\n"),
+                      m_sig.key().issuerName());
+      message = buf;
+      xfree (buf);
+    }
+  else if (level == 2)
+    {
+      /* Only reachable through TOFU Trust. */
+      if (m_uid.tofuInfo ().isNull ())
         {
-          gpgrt_asprintf (&buf, _("is cerified by the trusted issuer:\n'%s'\n"),
-                          sig.key().issuerName());
-          message += buf;
-          xfree (buf);
+          log_error ("%s:%s:%i BUG: Invalid sigstate.",
+                     SRCNAME, __func__, __LINE__);
+          return message;
         }
-      else if (sig.validity() == Signature::Validity::Marginal)
+
+      unsigned long first_contact = std::max (m_uid.tofuInfo().signFirst(),
+                                              m_uid.tofuInfo().encrFirst());
+      char *time = format_date_from_gpgme (first_contact);
+      /* i18n note signcount is always pulral because with signcount 1 we
+       * would not be in this branch. */
+      gpgrt_asprintf (&buf, _("And the senders address is trustworthy, because "
+                              "you have established a communication history "
+                              "with this address starting on %s.\n"
+                              "You encrypted %i times to this address and verified %i since."),
+                              time, m_uid.tofuInfo().signCount (),
+                              m_uid.tofuInfo().encrCount());
+      xfree (time);
+      message = buf;
+      xfree (buf);
+    }
+  else if (level == 1)
+    {
+      /* This could be marginal trust through pgp, or tofu with little
+         history. */
+      if (m_uid.tofuInfo ().validity() == TofuInfo::Validity::LittleHistory)
         {
-          char *time = format_date_from_gpgme (uid.tofuInfo().signFirst());
-          /* i18n note signcount is always pulral because with signcount 1 we
-           * would not be in this branch. */
-          gpgrt_asprintf (&buf, _("was used for %i messages since %s."),
-                          uid.tofuInfo().signCount (), time);
+          unsigned long first_contact = std::max (m_uid.tofuInfo().signFirst(),
+                                                  m_uid.tofuInfo().encrFirst());
+          char *time = format_date_from_gpgme (first_contact);
+          gpgrt_asprintf (&buf, _("But the senders address is not trustworthy yet because "
+                                  "you only verified %i messages and encrypted %i messages to "
+                                  "it since %s."),
+                                  m_uid.tofuInfo().signCount (),
+                                  m_uid.tofuInfo().encrCount (), time);
           xfree (time);
-          message += buf;
+          message = buf;
           xfree (buf);
         }
+      else if (m_uid.tofuInfo ().signCount() == 1)
+        {
+          message += _("But the senders signature was verified for the first time.");
+        }
+      else
+        {
+          /* Marginal trust through pgp */
+          message = _("Not enough trusted people or yourself "
+                      "have certified the senders identity.");
+        }
     }
   else
     {
-      if (m_verify_result.numSignatures() > 1)
-        {
-          log_debug ("%s:%s: More then one signature found on %p",
-                     SRCNAME, __func__, m_mailitem);
-        }
-      /* We only handle the first signature. */
-      const auto sig = m_verify_result.signature (0);
-      isOpenPGP = !is_smime();
-      keyFound = !(sig.summary() & Signature::Summary::KeyMissing);
-
-      log_debug ("%s:%s: Formatting sig. Validity: %x Summary: %x",
-                 SRCNAME, __func__, sig.validity(), sig.summary());
-
-      /* There is a signature but we don't accepted it as fully valid. */
-      message += _("The sender address is not trusted because:");
+      /* Now we are in level 0, this could be a technical problem, no key
+         or just unkown. */
+      message = _("But the sender address is not trustworthy because:");
       message += "\n\n";
+      keyFound = !(m_sig.summary() & Signature::Summary::KeyMissing);
 
       bool general_problem = true;
       /* First the general stuff. */
-      if (sig.summary() & Signature::Summary::Red)
+      if (m_sig.summary() & Signature::Summary::Red)
         {
           message += _("The signature is invalid.\n");
-          message += _("You cannot be sure who wrote the message.");
         }
-      else if (sig.summary() & Signature::Summary::SysError ||
+      else if (m_sig.summary() & Signature::Summary::SysError ||
                m_verify_result.numSignatures() < 1)
         {
           message += _("There was an error verifying the signature.\n");
-          message += _("You cannot be sure who wrote the message.");
         }
-      else if (sig.summary() & Signature::Summary::SigExpired)
+      else if (m_sig.summary() & Signature::Summary::SigExpired)
         {
           message += _("The signature is expired.\n");
         }
@@ -1513,81 +1596,62 @@ Mail::get_signature_status()
           general_problem = false;
         }
 
-      const auto uid = get_uid_for_sender (sig.key(), get_sender().c_str());
       /* Now the key problems */
-      if ((sig.summary() & Signature::Summary::KeyMissing))
+      if ((m_sig.summary() & Signature::Summary::KeyMissing))
         {
-          message += _("is not available for verification.");
+          message += _("is not available.");
         }
-      else if ((sig.summary() & Signature::Summary::KeyRevoked))
+      else if ((m_sig.summary() & Signature::Summary::KeyRevoked))
         {
           message += _("is revoked.");
         }
-      else if ((sig.summary() & Signature::Summary::KeyExpired))
+      else if ((m_sig.summary() & Signature::Summary::KeyExpired))
         {
           message += _("is expired.");
         }
-      else if ((sig.summary() & Signature::Summary::BadPolicy))
+      else if ((m_sig.summary() & Signature::Summary::BadPolicy))
         {
           message += _("is not meant for signing.");
         }
-      else if ((sig.summary() & Signature::Summary::CrlMissing))
+      else if ((m_sig.summary() & Signature::Summary::CrlMissing))
         {
           message += _("could not be checked for revocation.");
         }
-      else if ((sig.summary() & Signature::Summary::CrlTooOld))
+      else if ((m_sig.summary() & Signature::Summary::CrlTooOld))
         {
           message += _("could not be checked for revocation.");
         }
-      else if ((sig.summary() & Signature::Summary::TofuConflict) ||
-               uid.tofuInfo().validity() == TofuInfo::Conflict)
+      else if ((m_sig.summary() & Signature::Summary::TofuConflict) ||
+               m_uid.tofuInfo().validity() == TofuInfo::Conflict)
         {
           message += _("conflicts with another key that was used in the past by the sender.");
           hasConflict = true;
         }
-      else if (uid.isNull())
+      else if (m_uid.isNull())
         {
           gpgrt_asprintf (&buf, _("does not claim the address: \"%s\"."),
                           get_sender().c_str());
           message += buf;
           xfree (buf);
         }
-      else if ((sig.validity() & Signature::Validity::Marginal))
-        {
-          const auto tofuInfo = uid.tofuInfo();
-          if (tofuInfo.isNull() || !tofuInfo.signCount())
-            {
-              message += _("is not certified by enough trusted keys.");
-            }
-          else if (tofuInfo.signCount() == 1)
-            {
-              message += _("is seen for the first time.");
-            }
-          else
-            {
-              gpgrt_asprintf (&buf, "was only used for %i messages.",
-                              tofuInfo.signCount());
-              message += buf;
-              xfree (buf);
-            }
-        }
-      else if (((sig.validity() & Signature::Validity::Undefined) ||
-               (sig.validity() & Signature::Validity::Unknown) ||
-               (sig.summary() == Signature::Summary::None) ||
-               (sig.validity() == 0))&& !general_problem)
+      else if (((m_sig.validity() & Signature::Validity::Undefined) ||
+               (m_sig.validity() & Signature::Validity::Unknown) ||
+               (m_sig.summary() == Signature::Summary::None) ||
+               (m_sig.validity() == 0))&& !general_problem)
         {
            /* Bit of a catch all for weird results. */
-          message += _("is not certified by any trusted key.");
+          message += _("is not certified by any trustworthy key.");
         }
-      else if ((sig.validity() & Signature::Validity::Never))
+      else if ((m_sig.validity() & Signature::Validity::Never))
         {
-          message += _("is explicitly marked as invalid.");
+          message += _("is marked as not trustworthy.");
         }
     }
+  message += _("You cannot be sure who wrote or modified the message.");
   message += "\n\n";
   if (hasConflict)
     {
-      message += _("Click here to resolve the conflict.");
+      message += _("Click here to change the key used for this address.");
     }
   else if (keyFound)
     {
@@ -1602,33 +1666,52 @@ Mail::get_signature_status()
   return message;
 }
 
+
 int
-Mail::get_signature_icon_id () const
+Mail::get_signature_level () const
 {
-  if (!m_is_signed)
+  if (!m_is_signed || !is_encrypted ())
     {
-      return IDI_EMBLEM_INFORMATION_64_PNG;
+      return 0;
     }
-  const auto sig = m_verify_result.signature (0);
-  if ((sig.summary() & Signature::Summary::KeyMissing))
+
+  if (m_uid.isNull ())
     {
-      return IDI_EMBLEM_QUESTION_64_PNG;
+      /* No m_uid matches our sender. */
+      return 0;
+    }
+  if (m_is_valid && (m_uid.validity () == UserID::Validity::Ultimate ||
+      (m_uid.validity () == UserID::Validity::Full &&
+      level_4_check (m_uid))))
+    {
+      return 4;
     }
-  if (m_is_valid && sig.validity() == Signature::Validity::Full)
+  if (m_is_valid && m_uid.validity () == UserID::Validity::Full)
     {
-      return IDI_EMBLEM_SUCCESS_64_PNG;
+      return 3;
     }
-  else if (m_is_valid)
+  if (m_is_valid)
     {
-      return IDI_EMBLEM_SUCCESS_YELLOW_64_PNG;
+      return 2;
+    }
+  if (m_sig.validity() == Signature::Validity::Marginal)
+    {
+      return 1;
     }
-  const auto uid = get_uid_for_sender (sig.key(), m_sender.c_str());
-  if (sig.summary() & Signature::Summary::TofuConflict ||
-      uid.tofuInfo().validity() == TofuInfo::Conflict)
+  if (m_sig.summary() & Signature::Summary::TofuConflict ||
+      m_uid.tofuInfo().validity() == TofuInfo::Conflict)
     {
-      return IDI_EMBLEM_WARNING_64_PNG;
+      return 1;
     }
-  return IDI_EMBLEM_INFORMATION_64_PNG;
+  return 0;
+}
+
+int
+Mail::get_crypto_icon_id () const
+{
+  int level = get_signature_level ();
+  int offset = is_encrypted () ? ENCRYPT_ICON_OFFSET : 0;
+  return IDI_LEVEL_0 + level + offset;
 }
 
 const char*
diff --git a/src/mail.h b/src/mail.h
index 340b7e3..0767df4 100644
--- a/src/mail.h
+++ b/src/mail.h
@@ -234,15 +234,13 @@ public:
 
   /** Returns true if the mail was verified and has at least one
     signature. Regardless of the validity of the mail */
-  bool is_signed ();
+  bool is_signed () const;
 
-  /** Returns a non null signature / uid if the mail was verified and the validity
-    was high enough that we treat it as "verified sender" in
-    the UI. The signature / uid pair returned is the signature that was used
-    to determine the verified sender in that case. */
-  const std::pair<GpgME::Signature, GpgME::UserID> get_valid_sig ();
+  /** Returns true if the mail is encrypted to at least one
+    recipient. Regardless if it could be decrypted. */
+  bool is_encrypted () const;
 
-  /** Small helper to check if get_valid_sig returns non null results. */
+  /** Are we "green" */
   bool is_valid_sig ();
 
   /** Get UID gets UniqueID property of this mail. Returns
@@ -254,12 +252,16 @@ public:
     accessible. Returns -1 on error. */
   int set_uuid ();
 
-  /** Returns a localized string describing the signature state
-    of this mail. */
-  std::string get_signature_status ();
+  /** Returns a localized string describing in one or two
+    words the crypto status of this mail. */
+  std::string get_crypto_summary ();
+
+  /** Returns a localized string describing the detailed
+    crypto state of this mail. */
+  std::string get_crypto_details ();
 
   /** Get the icon id of the appropiate icon for this mail */
-  int get_signature_icon_id () const;
+  int get_crypto_icon_id () const;
 
   /** Get the fingerprint of an associated signature or null
       if it is not signed. */
@@ -309,6 +311,11 @@ public:
       after write event. */
   bool needs_encrypt () const;
   void set_needs_encrypt (bool val);
+
+  /** Gets the level of the signature. See:
+    https://wiki.gnupg.org/EasyGpg2016/AutomatedEncryption for
+    a definition of the levels. */
+  int get_signature_level () const;
 private:
   void update_categories ();
   void update_body ();
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 2dbe80e..ae15756 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1511,14 +1511,16 @@ get_mail_from_control (LPDISPATCH ctrl)
                SRCNAME, __func__, __LINE__); \
     }
 
-HRESULT get_is_signed (LPDISPATCH ctrl, VARIANT *result)
+HRESULT get_is_crypto (LPDISPATCH ctrl, VARIANT *result)
 {
   MY_MAIL_GETTER
 
   result->vt = VT_BOOL | VT_BYREF;
   result->pboolVal = (VARIANT_BOOL*) xmalloc (sizeof (VARIANT_BOOL));
-  *(result->pboolVal) = !mail ? VARIANT_FALSE :
-                        mail->is_signed () ? VARIANT_TRUE : VARIANT_FALSE;
+  *(result->pboolVal) = !mail ?
+                        VARIANT_FALSE :
+                        (mail->is_signed () || mail->is_encrypted ()) ?
+                        VARIANT_TRUE : VARIANT_FALSE;
 
   return S_OK;
 }
@@ -1533,27 +1535,12 @@ HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result)
     {
       log_debug ("%s:%s: No mail.",
                  SRCNAME, __func__);
-      w_result = utf8_to_wchar (_("Not Trusted"));
+      w_result = utf8_to_wchar (_("Insecure"));
       result->bstrVal = SysAllocString (w_result);
       xfree (w_result);
       return S_OK;
     }
-  bool valid = mail->is_valid_sig ();
-  const auto pair = mail->get_valid_sig ();
-  bool fully = pair.first.validity() == GpgME::Signature::Validity::Full ||
-               pair.first.validity() == GpgME::Signature::Validity::Ultimate;
-  if (valid && fully)
-    {
-      w_result = utf8_to_wchar (_("Fully Trusted"));
-    }
-  else if (valid)
-    {
-      w_result = utf8_to_wchar (_("Trusted"));
-    }
-  else
-    {
-      w_result = utf8_to_wchar (_("Not Trusted"));
-    }
+  w_result = utf8_to_wchar (mail->get_crypto_summary ().c_str ());
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);
   return S_OK;
@@ -1565,17 +1552,16 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
 
   result->vt = VT_BSTR;
   wchar_t *w_result;
-  if (mail && mail->is_signed ())
+  if (mail && (mail->is_signed () || mail->is_encrypted ()))
     {
       char *buf;
-      gpgrt_asprintf (&buf, _("This is a signed %s message."),
-                      mail->is_smime() ? _("S/MIME") : _("OpenPGP"));
+      gpgrt_asprintf (&buf, _("%s message."), mail->get_crypto_summary ().c_str());
       w_result = utf8_to_wchar (buf);
       xfree(buf);
     }
   else
     {
-      w_result = utf8_to_wchar (_("This message is not cryptographically signed."));
+      w_result = utf8_to_wchar (_("Insecure message."));
     }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);
@@ -1587,17 +1573,16 @@ HRESULT get_sig_stip (LPDISPATCH ctrl, VARIANT *result)
   MY_MAIL_GETTER
 
   result->vt = VT_BSTR;
-  if (!mail)
+  if (!mail || (!mail->is_signed () && !mail->is_encrypted ()))
     {
-      log_debug ("%s:%s: No mail.",
-                 SRCNAME, __func__);
       wchar_t *w_result;
-      w_result = utf8_to_wchar (_("You cannot be sure who wrote the message."));
+      w_result = utf8_to_wchar (_("You cannot be sure who sent, "
+                                  "modified and read the message in transit."));
       result->bstrVal = SysAllocString (w_result);
       xfree (w_result);
       return S_OK;
     }
-  const auto message = mail->get_signature_status ();
+  const auto message = mail->get_crypto_details ();
   wchar_t *w_message = utf8_to_wchar (message.c_str());
   result->bstrVal = SysAllocString (w_message);
   xfree (w_message);
@@ -1665,13 +1650,13 @@ HRESULT launch_cert_details (LPDISPATCH ctrl)
   return S_OK;
 }
 
-HRESULT get_sigstate_icon (LPDISPATCH ctrl, VARIANT *result)
+HRESULT get_crypto_icon (LPDISPATCH ctrl, VARIANT *result)
 {
   MY_MAIL_GETTER
 
   if (mail)
     {
-      return getIcon (mail->get_signature_icon_id (), result);
+      return getIcon (mail->get_crypto_icon_id (), result);
     }
-  return getIcon (IDI_EMBLEM_INFORMATION_64_PNG, result);
+  return getIcon (IDI_LEVEL_0, result);
 }
diff --git a/src/ribbon-callbacks.h b/src/ribbon-callbacks.h
index f2a33f7..7b4bd37 100644
--- a/src/ribbon-callbacks.h
+++ b/src/ribbon-callbacks.h
@@ -42,7 +42,7 @@
 #define ID_GET_ENCRYPT_PRESSED  16
 #define ID_ON_LOAD              17
 #define ID_CMD_OPEN_OPTIONS     18
-#define ID_GET_IS_SIGNED        19
+#define ID_GET_IS_CRYPTO        19
 #define ID_CMD_MIME_SIGN_EX     21
 #define ID_CMD_MIME_ENCRYPT_EX  22
 #define ID_GET_SIGN_PRESSED_EX  23
@@ -86,7 +86,7 @@ HRESULT get_crypt_pressed (LPDISPATCH ctrl, int flags, VARIANT *result, bool is_
 /* Mark the mail to be mime encrypted on send. Flags as above */
 HRESULT mark_mime_action (LPDISPATCH ctrl, int flags, bool is_explorer);
 /* Check the if the mail was signed. Returns BOOL */
-HRESULT get_is_signed (LPDISPATCH ctrl, VARIANT *result);
+HRESULT get_is_crypto (LPDISPATCH ctrl, VARIANT *result);
 /* Get the label for the signature. Returns BSTR */
 HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result);
 /* Get the tooltip for the signature. Returns BSTR */
@@ -96,7 +96,7 @@ HRESULT get_sig_stip (LPDISPATCH ctrl, VARIANT *result);
 /* Show a certificate details dialog. Returns nothing. */
 HRESULT launch_cert_details (LPDISPATCH ctrl);
 /* Callback to get the sigstate icon. */
-HRESULT get_sigstate_icon (LPDISPATCH ctrl, VARIANT *result);
+HRESULT get_crypto_icon (LPDISPATCH ctrl, VARIANT *result);
 /* Callback to get our own control reference */
 HRESULT ribbon_loaded (LPDISPATCH ctrl);
 #endif

-----------------------------------------------------------------------

Summary of changes:
 src/dialogs.h                          |  17 +-
 src/dialogs.rc                         |  19 +-
 src/gpgoladdin.cpp                     |  12 +-
 src/icons/Makefile.am                  |  16 +-
 src/icons/emblem-information-64.png    | Bin 1266 -> 0 bytes
 src/icons/emblem-information.svg       |  21 --
 src/icons/emblem-question-64.png       | Bin 1518 -> 0 bytes
 src/icons/emblem-question.svg          |  10 -
 src/icons/emblem-success-64.png        | Bin 1462 -> 0 bytes
 src/icons/emblem-success-yellow-64.png | Bin 2519 -> 0 bytes
 src/icons/emblem-success-yellow.svg    |  73 -------
 src/icons/emblem-success.svg           |  18 --
 src/icons/emblem-warning-64.png        | Bin 1117 -> 0 bytes
 src/icons/emblem-warning.svg           |  18 --
 src/icons/level-0-enc.png              | Bin 0 -> 1662 bytes
 src/icons/level-0-enc.svg              | 111 ++++++++++
 src/icons/level-0.png                  | Bin 0 -> 1257 bytes
 src/icons/level-0.svg                  |  97 +++++++++
 src/icons/level-1-enc.png              | Bin 0 -> 1648 bytes
 src/icons/level-1-enc.svg              | 116 ++++++++++
 src/icons/level-1.png                  | Bin 0 -> 1134 bytes
 src/icons/level-1.svg                  | 102 +++++++++
 src/icons/level-2-enc.png              | Bin 0 -> 1653 bytes
 src/icons/level-2-enc.svg              | 115 ++++++++++
 src/icons/level-2.png                  | Bin 0 -> 1182 bytes
 src/icons/level-2.svg                  | 101 +++++++++
 src/icons/level-3-enc.png              | Bin 0 -> 1928 bytes
 src/icons/level-3-enc.svg              | 115 ++++++++++
 src/icons/level-3.png                  | Bin 0 -> 1299 bytes
 src/icons/level-3.svg                  | 101 +++++++++
 src/icons/level-4-enc.png              | Bin 0 -> 1934 bytes
 src/icons/level-4-enc.svg              | 110 ++++++++++
 src/icons/level-4.png                  | Bin 0 -> 1989 bytes
 src/icons/level-4.svg                  |  92 ++++++++
 src/mail.cpp                           | 385 ++++++++++++++++++++-------------
 src/mail.h                             |  29 ++-
 src/mapihelp.cpp                       |  54 +++--
 src/mimedataprovider.cpp               |  39 ++--
 src/parsecontroller.cpp                |  17 +-
 src/ribbon-callbacks.cpp               |  49 ++---
 src/ribbon-callbacks.h                 |   6 +-
 src/versioninfo.rc.in                  |   2 +-
 42 files changed, 1433 insertions(+), 412 deletions(-)
 delete mode 100644 src/icons/emblem-information-64.png
 delete mode 100644 src/icons/emblem-information.svg
 delete mode 100644 src/icons/emblem-question-64.png
 delete mode 100644 src/icons/emblem-question.svg
 delete mode 100644 src/icons/emblem-success-64.png
 delete mode 100644 src/icons/emblem-success-yellow-64.png
 delete mode 100644 src/icons/emblem-success-yellow.svg
 delete mode 100644 src/icons/emblem-success.svg
 delete mode 100644 src/icons/emblem-warning-64.png
 delete mode 100644 src/icons/emblem-warning.svg
 create mode 100644 src/icons/level-0-enc.png
 create mode 100644 src/icons/level-0-enc.svg
 create mode 100644 src/icons/level-0.png
 create mode 100644 src/icons/level-0.svg
 create mode 100644 src/icons/level-1-enc.png
 create mode 100644 src/icons/level-1-enc.svg
 create mode 100644 src/icons/level-1.png
 create mode 100644 src/icons/level-1.svg
 create mode 100644 src/icons/level-2-enc.png
 create mode 100644 src/icons/level-2-enc.svg
 create mode 100644 src/icons/level-2.png
 create mode 100644 src/icons/level-2.svg
 create mode 100644 src/icons/level-3-enc.png
 create mode 100644 src/icons/level-3-enc.svg
 create mode 100644 src/icons/level-3.png
 create mode 100644 src/icons/level-3.svg
 create mode 100644 src/icons/level-4-enc.png
 create mode 100644 src/icons/level-4-enc.svg
 create mode 100644 src/icons/level-4.png
 create mode 100644 src/icons/level-4.svg


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 08:56:22 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 15 Dec 2016 08:56:22 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-46-g0a90f87
Message-ID: <E1cHQts-0003Uw-Ju@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  0a90f87799903a3fb97189ef7cba19e7b3534e1c (commit)
      from  92abfca650397e1f5dfa3a5c7752eb380cc94d0e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0a90f87799903a3fb97189ef7cba19e7b3534e1c
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 08:50:40 2016 +0100

    Fix regression in broken mlock detection.
    
    * acinclude.m4 (GNUPG_CHECK_MLOCK): Fix typo EGAIN->EAGAIN.
    --
    
    GnuPG-bug-id: 2870
    Fixes-commit: 618b8978f46f4011c11512fd5f30c15e01652e2e
    Co-authored-by: Nicolas Porcel <nicolasporcel06 at gmail.com>
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/acinclude.m4 b/acinclude.m4
index 90b3cb9..dcdadfd 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -242,7 +242,7 @@ int main()
     pool += (pgsize - ((long int)pool % pgsize));
 
     err = mlock( pool, 4096 );
-    if( !err || errno == EPERM || errno == EGAIN)
+    if( !err || errno == EPERM || errno == EAGAIN)
         return 0; /* okay */
 
     return 1;  /* hmmm */

-----------------------------------------------------------------------

Summary of changes:
 acinclude.m4 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 09:47:31 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 15 Dec 2016 09:47:31 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.4-4-g4dc4748
Message-ID: <E1cHRhO-00069U-3C@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  4dc4748bb6de79cb89c4cd39052b56de3a7b8227 (commit)
       via  89ec6c103739d41624bb5b899926efc26b215dda (commit)
       via  b4d1ab824172b8221011680cda00d7623de5c9f5 (commit)
      from  acb7003a9a6faf5d3c0e7961a6d36e351910bd97 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4dc4748bb6de79cb89c4cd39052b56de3a7b8227
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 09:29:33 2016 +0100

    Post release updates.
    
    --

diff --git a/NEWS b/NEWS
index 34e02b4..ccb04f5 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.7.6 (unreleased)  [C21/A1/R_]
+------------------------------------------------
+
+
 Noteworthy changes in version 1.7.5 (2016-12-15)  [C21/A1/R5]
 ------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index be30027..7dfbd60 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,7 +30,7 @@ min_automake_version="1.14"
 # for the LT versions.
 m4_define(mym4_version_major, [1])
 m4_define(mym4_version_minor, [7])
-m4_define(mym4_version_micro, [5])
+m4_define(mym4_version_micro, [6])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 89ec6c103739d41624bb5b899926efc26b215dda
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 09:18:02 2016 +0100

    Release 1.7.5.
    
    * configure.ac: Set LT version to C21/A1/R5.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index ecfa180..34e02b4 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,10 @@
-Noteworthy changes in version 1.7.5 (unreleased)  [C21/A1/R_]
+Noteworthy changes in version 1.7.5 (2016-12-15)  [C21/A1/R5]
 ------------------------------------------------
 
+ * Bug fixes:
+
+   - Fix regression in mlock detection [bug#2870].
+
 
 Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
 ------------------------------------------------
diff --git a/configure.ac b/configure.ac
index 267438a..be30027 100644
--- a/configure.ac
+++ b/configure.ac
@@ -56,7 +56,7 @@ AC_INIT([libgcrypt],[mym4_full_version],[http://bugs.gnupg.org])
 #   (No interfaces changed:                   REVISION++)
 LIBGCRYPT_LT_CURRENT=21
 LIBGCRYPT_LT_AGE=1
-LIBGCRYPT_LT_REVISION=4
+LIBGCRYPT_LT_REVISION=5
 
 
 # If the API is changed in an incompatible way: increment the next counter.

commit b4d1ab824172b8221011680cda00d7623de5c9f5
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 08:50:40 2016 +0100

    Fix regression in broken mlock detection.
    
    * acinclude.m4 (GNUPG_CHECK_MLOCK): Fix typo EGAIN->EAGAIN.
    --
    
    GnuPG-bug-id: 2870
    Fixes-commit: 618b8978f46f4011c11512fd5f30c15e01652e2e
    Co-authored-by: Nicolas Porcel <nicolasporcel06 at gmail.com>
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/acinclude.m4 b/acinclude.m4
index 90b3cb9..dcdadfd 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -242,7 +242,7 @@ int main()
     pool += (pgsize - ((long int)pool % pgsize));
 
     err = mlock( pool, 4096 );
-    if( !err || errno == EPERM || errno == EGAIN)
+    if( !err || errno == EPERM || errno == EAGAIN)
         return 0; /* okay */
 
     return 1;  /* hmmm */

-----------------------------------------------------------------------

Summary of changes:
 NEWS         | 10 +++++++++-
 acinclude.m4 |  2 +-
 configure.ac |  4 ++--
 3 files changed, 12 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 09:52:34 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 15 Dec 2016 09:52:34 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-47-g0996d5f
Message-ID: <E1cHRmG-0006Gs-Dl@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  0996d5f1c34a3d3012facd098a139d8abbde085f (commit)
      from  0a90f87799903a3fb97189ef7cba19e7b3534e1c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0996d5f1c34a3d3012facd098a139d8abbde085f
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 09:49:47 2016 +0100

    Add release info from 1.7.5
    
    --

diff --git a/NEWS b/NEWS
index 146e208..ef882b7 100644
--- a/NEWS
+++ b/NEWS
@@ -24,11 +24,19 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
      using encrypted swap space.
 
 
- * Interface changes relative to the 1.6.0 release:
+ * Interface changes relative to the 1.7.0 release:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
 
 
+Noteworthy changes in version 1.7.5 (2016-12-15)  [C21/A1/R5]
+------------------------------------------------
+
+ * Bug fixes:
+
+   - Fix regression in mlock detection [bug#2870].
+
+
 Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
 ------------------------------------------------
 

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 10:53:41 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 15 Dec 2016 10:53:41 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 70e237ec44ca73b2d7fe8f812042e8446306a69b
Message-ID: <E1cHSjP-0000r8-Vq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  70e237ec44ca73b2d7fe8f812042e8446306a69b (commit)
      from  66a6c274988eb35ebe3205a4a8e0185dbb6d5e10 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 70e237ec44ca73b2d7fe8f812042e8446306a69b
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 09:28:03 2016 +0100

    swdb: Release libgcrypt 1.7.5

diff --git a/web/index.org b/web/index.org
index b71f915..2691139 100644
--- a/web/index.org
+++ b/web/index.org
@@ -65,6 +65,12 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+** Libgcrypt 1.7.5 released (2016-12-15)
+
+We are pleased to announce the availability of Libgcrypt version
+1.7.5.  This is a maintenance release for the stable version of
+[[file:related_software/libgcrypt/index.org][Libgcrypt]] with a few bug fixes. [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000399.html][{more}]]
+
 ** Pinentry 1.0.0 released (2016-11-22)
 
 After 14 years is was time to bump up the version of [[file:related_software/pinentry/index.org][Pinentry]] to 1.0.
diff --git a/web/swdb.mac b/web/swdb.mac
index 1ff1b29..67d884d 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -82,11 +82,11 @@
 #
 # LIBGCRYPT
 #
-#+macro: libgcrypt_ver  1.7.4
-#+macro: libgcrypt_date 2016-12-09
-#+macro: libgcrypt_size 2815k
-#+macro: libgcrypt_sha1 8b3f96f8cfd6791c228c3ba282c83860c83c8844
-#+macro: libgcrypt_sha2 3b67862e2f4711e25c4ce3cc4b48d52a58a3afdcd1d8c6a57f93a1c0ef03e5c6
+#+macro: libgcrypt_ver  1.7.5
+#+macro: libgcrypt_date 2016-12-15
+#+macro: libgcrypt_size 2816k
+#+macro: libgcrypt_sha1 fa485d854748fc06ea041b3057b2de2f12fbc17f
+#+macro: libgcrypt_sha2 d1fea4128beef2bb30a470af6bafabccc503ced350534fb9dd8f5a53ffbae800
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/index.org |  6 ++++++
 web/swdb.mac  | 10 +++++-----
 2 files changed, 11 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 11:03:19 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 15 Dec 2016 11:03:19 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-120-g0e2055c
Message-ID: <E1cHSsk-0001ph-2X@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0e2055c7d30d987a7a74923a7080b80cce470601 (commit)
      from  948cca9c99e701a1668bb5fd6e25f07e35381b4d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0e2055c7d30d987a7a74923a7080b80cce470601
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 11:02:24 2016 +0100

    build: Fix distcheck.
    
    * tests/gpgme/Makefile.am (CLEANFILES): New variable, clean test logs.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgme/Makefile.am b/tests/gpgme/Makefile.am
index 21e0e14..d7fd87c 100644
--- a/tests/gpgme/Makefile.am
+++ b/tests/gpgme/Makefile.am
@@ -53,6 +53,8 @@ xcheck:
 
 EXTRA_DIST = gpgme-defs.scm run-tests.scm setup.scm wrap.scm
 
+CLEANFILES = *.log
+
 # We need to depend on a couple of programs so that the tests don't
 # start before all programs are built.
 all-local: $(required_pgms)

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgme/Makefile.am | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 11:08:48 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 15 Dec 2016 11:08:48 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-121-g2d1760f
Message-ID: <E1cHSy2-00022p-QX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2d1760ffe2ff46b77bd0f38db8b781d9564ae999 (commit)
      from  0e2055c7d30d987a7a74923a7080b80cce470601 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2d1760ffe2ff46b77bd0f38db8b781d9564ae999
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 15 10:59:36 2016 +0100

    dirmngr: First patch to re-enable Tor support.
    
    * dirmngr/dns-stuff.c (SOCKS_PORT, TOR_PORT, TOR_PORT2): New
    constants.
    (libdns_init): Start adding tor support.
    (resolve_name_libdns): Pass socks hosts to dns_res_open.
    (get_dns_cert_libdns): Ditto.
    (getsrv_libdns): Ditto.
    (get_dns_cname_libdns): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 8d5d168..1fbe2ea 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -96,6 +96,11 @@
 # define T_CERT 37
 #endif
 
+/* The standard SOCKS and TOR ports.  */
+#define SOCKS_PORT 1080
+#define TOR_PORT   9050
+#define TOR_PORT2  9150   /* (Used by the Tor browser) */
+
 
 /* The default nameserver used in Tor mode.  */
 #define DEFAULT_NAMESERVER "8.8.8.8"
@@ -118,7 +123,7 @@ static char tor_credentials[50];
 
 #ifdef USE_LIBDNS
 /* Libdns gobal data.  */
-struct
+struct libdns_s
 {
   struct dns_resolv_conf *resolv_conf;
   struct dns_hosts *hosts;
@@ -298,44 +303,107 @@ libdns_error_to_gpg_error (int serr)
 
 
 #ifdef USE_LIBDNS
+/* Initialize libdns.  Returns 0 on success; prints a diagnostic and
+ * returns an error code on failure.  */
 static gpg_error_t
 libdns_init (void)
 {
-  int error;
+  gpg_error_t err;
+  struct libdns_s ld;
+  int derr;
+  const char *fname;
+  char *cfgstr = NULL;
 
-  libdns.resolv_conf = dns_resconf_open (&error);
-  if (! libdns.resolv_conf)
-    goto leave;
+  memset (&ld, 0, sizeof ld);
 
-#if 0
-  error = dns_resconf_pton (&libdns.resolv_conf->nameserver[0],
-                            "[127.0.0.1]:53");
-  if (error)
-    goto leave;
-#else
-  error	= dns_resconf_loadpath (libdns.resolv_conf, "/etc/resolv.conf");
-  if (error)
-    goto leave;
+  ld.resolv_conf = dns_resconf_open (&derr);
+  if (!ld.resolv_conf)
+    {
+      err = libdns_error_to_gpg_error (derr);
+      log_error ("failed to allocate DNS resconf object: %s\n",
+                 gpg_strerror (err));
+      goto leave;
+    }
 
-  error	= dns_nssconf_loadpath (libdns.resolv_conf, "/etc/nsswitch.conf");
-  if (error)
-    goto leave;
-#endif
+  if (tor_mode)
+    {
+      if (!*tor_nameserver)
+        set_dns_nameserver (NULL);
 
-  libdns.hosts = dns_hosts_open (&error);
-  if (! libdns.hosts)
-    goto leave;
+      cfgstr = xtryasprintf ("[%s]:53", tor_nameserver);
+      if (!cfgstr)
+        err = gpg_error_from_syserror ();
+      else
+        err = libdns_error_to_gpg_error
+          (dns_resconf_pton (&ld.resolv_conf->nameserver[0], cfgstr));
+      if (err)
+        log_error ("failed to set nameserver '%s': %s\n",
+                   cfgstr, gpg_strerror (err));
+      if (err)
+        goto leave;
+
+      ld.resolv_conf->options.tcp = DNS_RESCONF_TCP_SOCKS;
+
+      xfree (cfgstr);
+      cfgstr = xtryasprintf ("[%s]:%d", "127.0.0.1", TOR_PORT);
+      if (!cfgstr)
+        err = gpg_error_from_syserror ();
+      else
+        err = libdns_error_to_gpg_error
+          (dns_resconf_pton (&ld.socks_host, cfgstr));
+      if (err)
+        {
+          log_error ("failed to set socks server '%s': %s\n",
+                     cfgstr, gpg_strerror (err));
+          goto leave;
+        }
+    }
+  else
+    {
+      fname = "/etc/resolv.conf";
+      err = libdns_error_to_gpg_error
+        (dns_resconf_loadpath (ld.resolv_conf, fname));
+      if (err)
+        {
+          log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
+          goto leave;
+        }
+
+      fname = "/etc/nsswitch.conf";
+      err = libdns_error_to_gpg_error
+        (dns_nssconf_loadpath (ld.resolv_conf, fname));
+      if (err)
+        {
+          log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
+          goto leave;
+        }
+    }
+
+  ld.hosts = dns_hosts_open (&derr);
+  if (!ld.hosts)
+    {
+      log_error ("failed to load hosts file: %s\n", gpg_strerror (err));
+      err = libdns_error_to_gpg_error (derr);
+      goto leave;
+    }
 
   /* dns_hints_local for stub mode, dns_hints_root for recursive.  */
-  libdns.hints = (recursive_resolver
-                  ? dns_hints_root  (libdns.resolv_conf, &error)
-                  : dns_hints_local (libdns.resolv_conf, &error));
-  if (! libdns.hints)
-    goto leave;
+  ld.hints = (recursive_resolver
+              ? dns_hints_root  (ld.resolv_conf, &derr)
+              : dns_hints_local (ld.resolv_conf, &derr));
+  if (!ld.hints)
+    {
+      log_error ("failed to load DNS hints: %s\n", gpg_strerror (err));
+      err = libdns_error_to_gpg_error (derr);
+      goto leave;
+    }
+
+  /* All fine.  Make the data global.  */
+  libdns = ld;
 
-  /* XXX */
  leave:
-  return libdns_error_to_gpg_error (error);
+  xfree (cfgstr);
+  return err;
 }
 #endif /*USE_LIBDNS*/
 
@@ -379,7 +447,7 @@ resolve_name_libdns (const char *name, unsigned short port,
     }
 
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (/*.socks_host=&libdns.socks_host*/), &derr);
+                      dns_opts (.socks_host=&libdns.socks_host), &derr);
   if (!res)
     {
       err = libdns_error_to_gpg_error (derr);
@@ -778,7 +846,7 @@ get_dns_cert_libdns (const char *name, int want_certtype,
     goto leave;
 
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (/*.socks_host=&libdns.socks_host*/), &derr);
+                      dns_opts (.socks_host=&libdns.socks_host), &derr);
   if (!res)
     {
       err = libdns_error_to_gpg_error (derr);
@@ -1218,7 +1286,7 @@ getsrv_libdns (const char *name, struct srventry **list, int *r_count)
     goto leave;
 
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (/*.socks_host=&libdns.socks_host*/), &derr);
+                      dns_opts (.socks_host=&libdns.socks_host), &derr);
   if (!res)
     {
       err = libdns_error_to_gpg_error (derr);
@@ -1558,7 +1626,7 @@ get_dns_cname_libdns (const char *name, char **r_cname)
     goto leave;
 
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (/*.socks_host=&libdns.socks_host*/), &derr);
+                      dns_opts (.socks_host=&libdns.socks_host), &derr);
   if (!res)
     {
       err = libdns_error_to_gpg_error (derr);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c | 132 +++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 100 insertions(+), 32 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 11:30:30 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 15 Dec 2016 11:30:30 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 76d1d716ba2fa6ebe0a4d9d6597d2facd36614ae
Message-ID: <E1cHTJ2-0002pr-Ba@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  76d1d716ba2fa6ebe0a4d9d6597d2facd36614ae (commit)
       via  567ca86d3fe4b56f47b7c241fd4dcd938a3b0c35 (commit)
       via  bb6a2cb7ca5506cb993e35e830cc78b59512c37e (commit)
       via  878f87e1892e1125e3f57cab7062e88273350a2a (commit)
      from  70e237ec44ca73b2d7fe8f812042e8446306a69b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 76d1d716ba2fa6ebe0a4d9d6597d2facd36614ae
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 11:04:01 2016 +0100

    jenkins: Only do scan-builds on nightly builds.

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index f5a48bd..956884c 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -50,9 +50,9 @@ MAKEFLAGS="-j2"
 
 SCANBUILD=
 if [ "$(uname)" = Linux ] \
-       && [ "$GIT_PREVIOUS_COMMIT" = "$GIT_COMMIT" ]; then
-    # We only do scan-builds (which are really slow), if the tree is
-    # stable (most commonly on nightly builds).
+       && [ "$ROOT_BUILD_CAUSE_TIMERTRIGGER" = true ]; then
+    # We only do scan-builds (which are really slow) on nightly
+    # builds.
     SCANBUILD="scan-build -o ${WORKSPACE}/clangScanBuildReports -v"
 fi
 CONFIGUREFLAGS=

commit 567ca86d3fe4b56f47b7c241fd4dcd938a3b0c35
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 17:27:39 2016 +0100

    jenkins: Use GPGMEs test suite for GnuPG

diff --git a/misc/jenkins/README.org b/misc/jenkins/README.org
new file mode 100644
index 0000000..8691018
--- /dev/null
+++ b/misc/jenkins/README.org
@@ -0,0 +1,12 @@
+* Notes
+** GPGME tests for GnuPG
+There is a reasonably up-to-date (but this is currently a manual
+process) GPGME source at
+
+  $HOME/src/gpgme-for-gnupgs-tests
+
+and a build tree at
+
+  $HOME/src/gpgme-for-gnupgs-tests/obj
+
+The tests from there are executed in GnuPG's test suite.
diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index fd3f5a1..f5a48bd 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -93,6 +93,13 @@ case "$JOB_NAME" in
         ;;
 esac
 
+# See if we have a GPGME checkout for the tesets.
+xtest_gpgme_srcdir="$HOME/src/gpgme-for-gnupgs-tests"
+if [ -d "$xtest_gpgme_srcdir/obj" ]; then
+    export XTEST_GPGME_SRCDIR="$xtest_gpgme_srcdir"
+    export XTEST_GPGME_BUILDDIR="$xtest_gpgme_srcdir/obj"
+fi
+
 # We build on the "obj" subdir.
 abs_configure="$(pwd)/configure"
 mkdir -p obj

commit bb6a2cb7ca5506cb993e35e830cc78b59512c37e
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 14:54:30 2016 +0100

    jenkins: Run scan-build only if the tree is stable.

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 8388d6d..fd3f5a1 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -49,8 +49,10 @@ MAKEFLAGS="-j2"
 
 
 SCANBUILD=
-if [ "$(uname)" = Linux ]; then
-    # XXX: We should really have an analyzer target
+if [ "$(uname)" = Linux ] \
+       && [ "$GIT_PREVIOUS_COMMIT" = "$GIT_COMMIT" ]; then
+    # We only do scan-builds (which are really slow), if the tree is
+    # stable (most commonly on nightly builds).
     SCANBUILD="scan-build -o ${WORKSPACE}/clangScanBuildReports -v"
 fi
 CONFIGUREFLAGS=

commit 878f87e1892e1125e3f57cab7062e88273350a2a
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 14 14:39:59 2016 +0100

    jenkins: Update build script

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 23f78eb..8388d6d 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -1,14 +1,18 @@
 #!/bin/bash
+# Script used jenkins to run builds for GnuPG and related packages.
 
+# Stop on error and be nice to other processes.
 set -xe
-
 renice -n 10 -p $$
 
+# Setup important envars
 PREFIX=$HOME/prefix/$XTARGET
 ORIGINAL_PREFIX=$HOME/prefix/$XTARGET
-export PATH=$PREFIX/bin:$PATH
+export PATH=/home/jenkins/bin:$PREFIX/bin:$PATH
 
+# Print the environment.
 env
+ulimit -a
 
 # Tweak the prefix we're installing this project into.  For gnupg-1.4
 # and friends.
@@ -25,16 +29,25 @@ case "$JOB_NAME" in
 esac
 mkdir -p $PREFIX
 
+
 fix_permissions()
 {
   find $1 -type d -exec chmod +w {} + || true
 }
 
 fix_permissions .
+
+# Clean everything
 git clean -fdx
+
+# Run out autogen - note that --force is not required due to the git clean.
 ./autogen.sh
 
+# Out current box seems to have cache coherency problems, thus we have
+# disabled all but one CPU.
 MAKEFLAGS="-j2"
+
+
 SCANBUILD=
 if [ "$(uname)" = Linux ]; then
     # XXX: We should really have an analyzer target
@@ -54,6 +67,7 @@ if [ "$(uname)" = Darwin ]; then
     CXXFLAGS="$CXXFLAGS -D$cversion"
 fi
 
+# Tweak the build depending on the package.
 case "$JOB_NAME" in
     *tgpg*)
         MAKEFLAGS="$MAKEFLAGS GPG=/usr/bin/gpg2"
@@ -77,10 +91,12 @@ case "$JOB_NAME" in
         ;;
 esac
 
+# We build on the "obj" subdir.
 abs_configure="$(pwd)/configure"
 mkdir -p obj
 cd obj
 
+# Switch on the different targets.
 case "$XTARGET" in
     native)
         ASAN_OPTIONS=detect_leaks=0 \
@@ -89,12 +105,10 @@ case "$XTARGET" in
 	           $CONFIGUREFLAGS \
 	           "$CONFIGUREFLAGS_0" \
 	           CFLAGS="$CFLAGS $SANFLAGS -fPIC" \
-	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
+	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11" \
+                   LD_LIBRARY_PATH=$PREFIX/lib
         $SCANBUILD make $MAKEFLAGS
 
-        # so make sure the asan runtime is there for e.g. python
-        PATH=/home/jenkins/bin:$PATH \
-        LD_LIBRARY_PATH=$PREFIX/lib \
           make check verbose=2 LD_LIBRARY_PATH=$PREFIX/lib || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
@@ -139,10 +153,14 @@ case "$XTARGET" in
 	}
 	trap cleanup EXIT
 
+          # We use a different WORKDIR to avoid problems with too long
+          # file names
 	  cd "$WORKDIR"
           $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
                    $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
-          make $MAKEFLAGS distcheck
+          make $MAKEFLAGS distcheck LD_LIBRARY_PATH=$PREFIX/lib
+
+          # Extract the tarname from the package
           tarname=$(awk <config.h '
 	             /^#define PACKAGE_TARNAME/ {gsub(/"/,"",$3);name=$3};
 	             /^#define PACKAGE_VERSION/ {gsub(/"/,"",$3);vers=$3};
@@ -155,10 +173,11 @@ case "$XTARGET" in
 	     echo "No tarball named $tarname found - skipping installation" >&2
 	     exit 0
 	  fi
+          # And do a final build using the generated tarball
 	  cd ${tarname}
 	  ./configure --prefix=$PREFIX $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
-	  make $MAKEFLAGS
-	  make $MAKEFLAGS install
+	  make $MAKEFLAGS         LD_LIBRARY_PATH=$PREFIX/lib
+	  make $MAKEFLAGS install LD_LIBRARY_PATH=$PREFIX/lib
 
         ;;
     *)

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/README.org     | 12 +++++++++++
 misc/jenkins/bin/build.bash | 50 +++++++++++++++++++++++++++++++++++----------
 2 files changed, 51 insertions(+), 11 deletions(-)
 create mode 100644 misc/jenkins/README.org


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 11:39:29 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 15 Dec 2016 11:39:29 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-13-g85e0553
Message-ID: <E1cHTRj-0003U9-Os@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  85e05537e15346896a271d3f62bead9dd7e3f180 (commit)
       via  5673f3e54af535155893290a685b3afb44c7f58d (commit)
      from  ecb0e3280a7db0e8f6ef395cf64f36a36b15be37 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 85e05537e15346896a271d3f62bead9dd7e3f180
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 11:31:14 2016 +0100

    cpp: Fix addrSpec for keys without email
    
    * lang/cpp/src/key.cpp (UserID::addrSpec): Use uid->address instead
    of normalizing again.
    (&operator<<(std::ostream &, const UserID &): Print it.
    
    --
    This saves a normalization and fixes the case where a user id
    is just a mail address without name, in that case gpgme sets
    "address" but not email. Because the email is then the name.

diff --git a/lang/cpp/src/key.cpp b/lang/cpp/src/key.cpp
index 235a3c8..d621a81 100644
--- a/lang/cpp/src/key.cpp
+++ b/lang/cpp/src/key.cpp
@@ -894,7 +894,11 @@ std::string UserID::addrSpecFromString(const char *userid)
 
 std::string UserID::addrSpec() const
 {
-    return addrSpecFromString(email());
+    if (!uid || !uid->address) {
+        return std::string();
+    }
+
+    return uid->address;
 }
 
 std::ostream &operator<<(std::ostream &os, const UserID &uid)
@@ -903,6 +907,7 @@ std::ostream &operator<<(std::ostream &os, const UserID &uid)
     if (!uid.isNull()) {
         os << "\n name:      " << protect(uid.name())
            << "\n email:     " << protect(uid.email())
+           << "\n mbox:      " << uid.addrSpec()
            << "\n comment:   " << protect(uid.comment())
            << "\n validity:  " << uid.validityAsString()
            << "\n revoked:   " << uid.isRevoked()

commit 5673f3e54af535155893290a685b3afb44c7f58d
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 11:24:43 2016 +0100

    cpp: Fix update of partial key in verifyresult
    
    * lang/cpp/src/verificationresult.cpp
    (Signature::key(bool,bool)): Don't update the returned copy
    but the actual key of the signature.
    
    --
    The whole point of the update is to change the partial key
    from the signature (e.g. only fingerprint and one uid as we
    would have from tofu) to a fully keylisted one.

diff --git a/lang/cpp/src/verificationresult.cpp b/lang/cpp/src/verificationresult.cpp
index 23c458e..42e483c 100644
--- a/lang/cpp/src/verificationresult.cpp
+++ b/lang/cpp/src/verificationresult.cpp
@@ -413,7 +413,8 @@ GpgME::Key GpgME::Signature::key(bool search, bool update) const
         }
     }
     if (update) {
-        ret.update();
+        d->keys[idx].update();
+        ret = d->keys[idx];
     }
     return ret;
 }

-----------------------------------------------------------------------

Summary of changes:
 lang/cpp/src/key.cpp                | 7 ++++++-
 lang/cpp/src/verificationresult.cpp | 3 ++-
 2 files changed, 8 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 12:59:54 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 15 Dec 2016 12:59:54 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. cb04299eadbe2ca9022a5e54217a872368073a77
Message-ID: <E1cHUhY-0007R2-1H@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  cb04299eadbe2ca9022a5e54217a872368073a77 (commit)
      from  76d1d716ba2fa6ebe0a4d9d6597d2facd36614ae (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cb04299eadbe2ca9022a5e54217a872368073a77
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 12:57:30 2016 +0100

    jenkins: avoid LD_LIBRARY_PATH
    
    If memory serves this was added merely to run the Python bindings
    compiled with -fsanitize-address, and that was brittle enough to break
    soon.  Now we don't even build the Python bindings when instrumenting
    the code, so this can safely be omitted.

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 956884c..e886ca1 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -108,17 +108,17 @@ cd obj
 # Switch on the different targets.
 case "$XTARGET" in
     native)
+	# asan breaks the configure tests, so we disable it here.
         ASAN_OPTIONS=detect_leaks=0 \
         $SCANBUILD \
             ../configure --prefix=$PREFIX --enable-maintainer-mode \
 	           $CONFIGUREFLAGS \
 	           "$CONFIGUREFLAGS_0" \
 	           CFLAGS="$CFLAGS $SANFLAGS -fPIC" \
-	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11" \
-                   LD_LIBRARY_PATH=$PREFIX/lib
+	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
         $SCANBUILD make $MAKEFLAGS
 
-          make check verbose=2 LD_LIBRARY_PATH=$PREFIX/lib || true
+        make check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
@@ -166,8 +166,8 @@ case "$XTARGET" in
           # file names
 	  cd "$WORKDIR"
           $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
-                   $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
-          make $MAKEFLAGS distcheck LD_LIBRARY_PATH=$PREFIX/lib
+                   $CONFIGUREFLAGS
+          make $MAKEFLAGS distcheck
 
           # Extract the tarname from the package
           tarname=$(awk <config.h '
@@ -185,8 +185,8 @@ case "$XTARGET" in
           # And do a final build using the generated tarball
 	  cd ${tarname}
 	  ./configure --prefix=$PREFIX $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
-	  make $MAKEFLAGS         LD_LIBRARY_PATH=$PREFIX/lib
-	  make $MAKEFLAGS install LD_LIBRARY_PATH=$PREFIX/lib
+	  make $MAKEFLAGS
+	  make $MAKEFLAGS install
 
         ;;
     *)

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 16:16:18 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 15 Dec 2016 16:16:18 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-127-g6b16b02
Message-ID: <E1cHXle-0000by-P3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6b16b02109f4bb5b934e456667ff4c0ba7bc85fd (commit)
       via  41ad04d403de05abe54280d2a84aa51a603194e4 (commit)
       via  6e4396723e9e5865015ebf7033628fa3919cf7d1 (commit)
       via  3c691097ca144e9a1d4c9185636c59a848bec85c (commit)
       via  c252627c6fd93bc305c5a5a2f013c3de2d45c6b0 (commit)
       via  bc6b76ef26f31c54ae1c29c761b8ecc437fcf565 (commit)
      from  2d1760ffe2ff46b77bd0f38db8b781d9564ae999 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6b16b02109f4bb5b934e456667ff4c0ba7bc85fd
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 16:06:49 2016 +0100

    g10: Avoid translating simple error messages.
    
    * g10/gpg.c (main): Avoid translating arguments to 'wrong_args'.
    --
    Translating these messages is a burden for translators, and we only
    have translations for very few of them as it is.
    
    If we want to localize these messages, I'd suggest to translate the
    placeholders (e.g. 'filename').
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/gpg.c b/g10/gpg.c
index e680748..cab5d53 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4010,7 +4010,7 @@ main (int argc, char **argv)
 
       case aStore: /* only store the file */
 	if( argc > 1 )
-	    wrong_args(_("--store [filename]"));
+	    wrong_args("--store [filename]");
 	if( (rc = encrypt_store(fname)) )
           {
             write_status_failure ("store", rc);
@@ -4020,7 +4020,7 @@ main (int argc, char **argv)
 	break;
       case aSym: /* encrypt the given file only with the symmetric cipher */
 	if( argc > 1 )
-	    wrong_args(_("--symmetric [filename]"));
+	    wrong_args("--symmetric [filename]");
 	if( (rc = encrypt_symmetric(fname)) )
           {
             write_status_failure ("symencrypt", rc);
@@ -4035,7 +4035,7 @@ main (int argc, char **argv)
 	else
 	  {
 	    if( argc > 1 )
-	      wrong_args(_("--encrypt [filename]"));
+	      wrong_args("--encrypt [filename]");
 	    if( (rc = encrypt_crypt (ctrl, -1, fname, remusr, 0, NULL, -1)) )
               {
                 write_status_failure ("encrypt", rc);
@@ -4051,7 +4051,7 @@ main (int argc, char **argv)
 	   might work with 7, but alas, I don't have a copy to test
 	   with right now. */
 	if( argc > 1 )
-	  wrong_args(_("--symmetric --encrypt [filename]"));
+	  wrong_args("--symmetric --encrypt [filename]");
 	else if(opt.s2k_mode==0)
 	  log_error(_("you cannot use --symmetric --encrypt"
 		      " with --s2k-mode 0\n"));
@@ -4077,7 +4077,7 @@ main (int argc, char **argv)
 	}
 	else {
 	    if( argc > 1 )
-		wrong_args(_("--sign [filename]"));
+		wrong_args("--sign [filename]");
 	    if( argc ) {
 		sl = xmalloc_clear( sizeof *sl + strlen(fname));
 		strcpy(sl->d, fname);
@@ -4093,7 +4093,7 @@ main (int argc, char **argv)
 
       case aSignEncr: /* sign and encrypt the given file */
 	if( argc > 1 )
-	    wrong_args(_("--sign --encrypt [filename]"));
+	    wrong_args("--sign --encrypt [filename]");
 	if( argc ) {
 	    sl = xmalloc_clear( sizeof *sl + strlen(fname));
 	    strcpy(sl->d, fname);
@@ -4111,7 +4111,7 @@ main (int argc, char **argv)
 
       case aSignEncrSym: /* sign and encrypt the given file */
 	if( argc > 1 )
-	    wrong_args(_("--symmetric --sign --encrypt [filename]"));
+	    wrong_args("--symmetric --sign --encrypt [filename]");
 	else if(opt.s2k_mode==0)
 	  log_error(_("you cannot use --symmetric --sign --encrypt"
 		      " with --s2k-mode 0\n"));
@@ -4140,7 +4140,7 @@ main (int argc, char **argv)
 
       case aSignSym: /* sign and conventionally encrypt the given file */
 	if (argc > 1)
-	    wrong_args(_("--sign --symmetric [filename]"));
+	    wrong_args("--sign --symmetric [filename]");
 	rc = sign_symencrypt_file (ctrl, fname, locusr);
         if (rc)
           {
@@ -4152,7 +4152,7 @@ main (int argc, char **argv)
 
       case aClearsign: /* make a clearsig */
 	if( argc > 1 )
-	    wrong_args(_("--clear-sign [filename]"));
+	    wrong_args("--clear-sign [filename]");
 	if( (rc = clearsign_file (ctrl, fname, locusr, NULL)) )
           {
             write_status_failure ("sign", rc);
@@ -4182,7 +4182,7 @@ main (int argc, char **argv)
 	else
 	  {
 	    if( argc > 1 )
-	      wrong_args(_("--decrypt [filename]"));
+	      wrong_args("--decrypt [filename]");
 	    if( (rc = decrypt_message (ctrl, fname) ))
               {
                 write_status_failure ("decrypt", rc);
@@ -4209,11 +4209,11 @@ main (int argc, char **argv)
 
       case aSignKey:
 	if( argc != 1 )
-	  wrong_args(_("--sign-key user-id"));
+	  wrong_args("--sign-key user-id");
 	/* fall through */
       case aLSignKey:
 	if( argc != 1 )
-	  wrong_args(_("--lsign-key user-id"));
+	  wrong_args("--lsign-key user-id");
 	/* fall through */
 
 	sl=NULL;
@@ -4234,7 +4234,7 @@ main (int argc, char **argv)
 
       case aEditKey: /* Edit a key signature */
 	if( !argc )
-	    wrong_args(_("--edit-key user-id [commands]"));
+	    wrong_args("--edit-key user-id [commands]");
 	username = make_username( fname );
 	if( argc > 1 ) {
 	    sl = NULL;
@@ -4250,7 +4250,7 @@ main (int argc, char **argv)
 
       case aPasswd:
         if (argc != 1)
-          wrong_args (_("--change-passphrase <user-id>"));
+          wrong_args("--change-passphrase <user-id>");
         else
           {
             username = make_username (fname);
@@ -4884,7 +4884,7 @@ main (int argc, char **argv)
       case aListPackets:
       default:
 	if( argc > 1 )
-	    wrong_args(_("[filename]"));
+	    wrong_args("[filename]");
 	/* Issue some output for the unix newbie */
 	if (!fname && !opt.outfile
             && gnupg_isatty (fileno (stdin))

commit 41ad04d403de05abe54280d2a84aa51a603194e4
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 15:32:51 2016 +0100

    g10: Rework the --quick-* interface.
    
    * g10/gpg.c (opts): Rename options.
    (main): Update errors.
    * doc/gpg.texi: Update accordingly.
    --
    I decided not to keep the old versions as aliases in the documentation
    because the interface is a fairly recent addition.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 81588e1..ab0289d 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -618,8 +618,8 @@ This section explains the main commands for key management.
 
 @table @gnupgtabopt
 
- at item --quick-gen-key @code{user-id} [@code{algo} [@code{usage} [@code{expire}]]]
- at opindex quick-gen-key
+ at item --quick-generate-key @code{user-id} [@code{algo} [@code{usage} [@code{expire}]]]
+ at opindex quick-generate-key
 This is a simple command to generate a standard key with one user id.
 In contrast to @option{--generate-key} the key is generated directly
 without the need to answer a bunch of prompts.  Unless the option
@@ -636,7 +636,7 @@ created and no prompts are shown.  To specify an expiration date but
 still create a primary and subkey use ``default'' or
 ``future-default'' for @code{algo} and ``default'' for @code{usage}.
 For a description of these optional arguments see the command
- at code{--quick-addkey}.  The @code{usage} accepts also the value
+ at code{--quick-add-key}.  The @code{usage} accepts also the value
 ``cert'' which can be used to create a certification only primary key;
 the default is to a create certification and signing key.
 
@@ -660,8 +660,8 @@ Directly set the expiration time of the primary key to @code{expire}.
 To remove the expiration time @code{0} can be used.
 
 
- at item --quick-addkey @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
- at opindex quick-addkey
+ at item --quick-add-key @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
+ at opindex quick-add-key
 Directly add a subkey to the key identified by the fingerprint
 @code{fpr}.  Without the optional arguments an encryption subkey is
 added.  If any of the arguments are given a more specific subkey is
@@ -1074,16 +1074,16 @@ full flexibility of the "sign" subcommand from @option{--edit-key}.
 Its intended use is to help unattended key signing by utilizing a list
 of verified fingerprints.
 
- at item --quick-adduid  @var{user-id} @var{new-user-id}
- at opindex quick-adduid
+ at item --quick-add-uid  @var{user-id} @var{new-user-id}
+ at opindex quick-add-uid
 This command adds a new user id to an existing key.  In contrast to
 the interactive sub-command @code{adduid} of @option{--edit-key} the
 @var{new-user-id} is added verbatim with only leading and trailing
 white space removed, it is expected to be UTF-8 encoded, and no checks
 on its form are applied.
 
- at item --quick-revuid  @var{user-id} @var{user-id-to-revoke}
- at opindex quick-revuid
+ at item --quick-revoke-uid  @var{user-id} @var{user-id-to-revoke}
+ at opindex quick-revoke-uid
 This command revokes a User ID on an existing key.  It cannot be used
 to revoke the last User ID on key (some non-revoked User ID must
 remain), with revocation reason ``User ID is no longer valid''.  If
diff --git a/g10/gpg.c b/g10/gpg.c
index f382a7a..e680748 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -447,13 +447,17 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aKeygen,	    "generate-key",
               N_("generate a new key pair")),
   ARGPARSE_c (aKeygen,	    "gen-key", "@"),
-  ARGPARSE_c (aQuickKeygen, "quick-gen-key" ,
+  ARGPARSE_c (aQuickKeygen, "quick-generate-key" ,
               N_("quickly generate a new key pair")),
-  ARGPARSE_c (aQuickAddUid,  "quick-adduid",
+  ARGPARSE_c (aQuickKeygen, "quick-gen-key", "@"),
+  ARGPARSE_c (aQuickAddUid,  "quick-add-uid",
               N_("quickly add a new user-id")),
+  ARGPARSE_c (aQuickAddUid,  "quick-adduid", "@"),
+  ARGPARSE_c (aQuickAddKey,  "quick-add-key", "@"),
   ARGPARSE_c (aQuickAddKey,  "quick-addkey", "@"),
-  ARGPARSE_c (aQuickRevUid,  "quick-revuid",
+  ARGPARSE_c (aQuickRevUid,  "quick-revoke-uid",
               N_("quickly revoke a user-id")),
+  ARGPARSE_c (aQuickRevUid,  "quick-revuid", "@"),
   ARGPARSE_c (aQuickSetExpire,  "quick-set-expire",
               N_("quickly set a new expiration date")),
   ARGPARSE_c (aFullKeygen,  "full-generate-key" ,
@@ -4299,7 +4303,7 @@ main (int argc, char **argv)
           const char *x_algo, *x_usage, *x_expire;
 
           if (argc < 1 || argc > 4)
-            wrong_args("--quick-gen-key USER-ID [ALGO [USAGE [EXPIRE]]]");
+            wrong_args("--quick-generate-key USER-ID [ALGO [USAGE [EXPIRE]]]");
           username = make_username (fname);
           argv++, argc--;
           x_algo = "";
@@ -4364,7 +4368,7 @@ main (int argc, char **argv)
           const char *uid, *newuid;
 
           if (argc != 2)
-            wrong_args ("--quick-adduid USER-ID NEW-USER-ID");
+            wrong_args ("--quick-add-uid USER-ID NEW-USER-ID");
           uid = *argv++; argc--;
           newuid = *argv++; argc--;
           keyedit_quick_adduid (ctrl, uid, newuid);
@@ -4376,7 +4380,7 @@ main (int argc, char **argv)
           const char *x_fpr, *x_algo, *x_usage, *x_expire;
 
           if (argc < 1 || argc > 4)
-            wrong_args ("--quick-addkey FINGERPRINT [ALGO [USAGE [EXPIRE]]]");
+            wrong_args ("--quick-add-key FINGERPRINT [ALGO [USAGE [EXPIRE]]]");
           x_fpr = *argv++; argc--;
           x_algo = "";
           x_usage = "";
@@ -4402,7 +4406,7 @@ main (int argc, char **argv)
           const char *uid, *uidtorev;
 
           if (argc != 2)
-            wrong_args ("--quick-revuid USER-ID USER-ID-TO-REVOKE");
+            wrong_args ("--quick-revoke-uid USER-ID USER-ID-TO-REVOKE");
           uid = *argv++; argc--;
           uidtorev = *argv++; argc--;
           keyedit_quick_revuid (ctrl, uid, uidtorev);
diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index 639fd62..9b9c919 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -52,7 +52,7 @@
 (setenv "PINENTRY_USER_DATA" "test" #t)
 
 (info "Checking quick key generation...")
-(call-check `(, at GPG --quick-gen-key ,alpha))
+(call-check `(, at GPG --quick-generate-key ,alpha))
 
 (define keyinfo (gpg-with-colons `(-k ,(exact alpha))))
 (define fpr (:fpr (assoc "fpr" keyinfo)))
@@ -65,7 +65,7 @@
 ;; Make sure the key capabilities don't change when we add a user id.
 ;; (See bug #2697.)
 (let ((pre (key-data (exact alpha)))
-      (result (call-check `(, at GPG --quick-adduid ,(exact alpha) ,bravo)))
+      (result (call-check `(, at GPG --quick-add-uid ,(exact alpha) ,bravo)))
       (post (key-data (exact alpha))))
   (if (not (equal? pre post))
       (begin
@@ -83,7 +83,7 @@
 (assert (= 2 (count-uids-of-secret-key bravo)))
 
 (info "Checking that we can revoke a user ID...")
-(call-check `(, at GPG --quick-revuid ,(exact bravo) ,alpha))
+(call-check `(, at GPG --quick-revoke-uid ,(exact bravo) ,alpha))
 
 (assert (= 1 (count-uids-of-secret-key bravo)))
 
@@ -118,7 +118,7 @@
  "Checking that we can add subkeys..."
  (lambda (args check)
    (set! count (+ 1 count))
-   (call-check `(, at gpg --quick-addkey ,fpr , at args))
+   (call-check `(, at gpg --quick-add-key ,fpr , at args))
    (let ((subkeys (get-subkeys)))
      (assert (= count (length subkeys)))
      (if check (check (last subkeys)))))

commit 6e4396723e9e5865015ebf7033628fa3919cf7d1
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 14:50:10 2016 +0100

    g10: Rename 'card-edit' to 'edit-card'.
    
    * g10/gpg.c (opts): Rename option.
    * g10/call-agent.c (agent_scd_learn): Update comment.
    * doc/gpg.texi: Update accordingly.
    --
    This change has a surprising side effect.  Previously, --edit was an
    alias for --edit-key, because the argument parser actually accepts
    unique prefixes of all options.  With this change, however, --edit is
    ambiguous.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index d24584a..81588e1 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -367,7 +367,9 @@ values are dumped and not only their lengths.  Note that the output of
 this command may change with new releases.
 
 
- at item --card-edit
+ at item --edit-card
+ at opindex edit-card
+ at itemx --card-edit
 @opindex card-edit
 Present a menu to work with a smartcard. The subcommand "help" provides
 an overview on available commands. For a detailed description, please
@@ -382,7 +384,7 @@ Show the content of the smart card.
 @opindex change-pin
 Present a menu to allow changing the PIN of a smartcard. This
 functionality is also available as the subcommand "passwd" with the
- at option{--card-edit} command.
+ at option{--edit-card} command.
 
 @item --delete-keys @code{name}
 @itemx --delete-keys @code{name}
diff --git a/g10/call-agent.c b/g10/call-agent.c
index fd9b964..335e12a 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -660,7 +660,7 @@ agent_scd_learn (struct agent_card_info_s *info, int force)
      care about the data returned.  If the card has already been
      initialized, this is a very fast command.  The main reason we
      need to do this here is to handle a card removed case so that an
-     "l" command in --card-edit can be used to show ta newly inserted
+     "l" command in --edit-card can be used to show ta newly inserted
      card.  We request the openpgp card because that is what we
      expect. */
   rc = assuan_transact (agent_ctx, "SCD SERIALNO openpgp",
diff --git a/g10/gpg.c b/g10/gpg.c
index f0eb930..f382a7a 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -495,7 +495,8 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aFastImport, "fast-import", "@"),
 #ifdef ENABLE_CARD_SUPPORT
   ARGPARSE_c (aCardStatus,  "card-status", N_("print the card status")),
-  ARGPARSE_c (aCardEdit,   "card-edit",  N_("change data on a card")),
+  ARGPARSE_c (aCardEdit,   "edit-card",  N_("change data on a card")),
+  ARGPARSE_c (aCardEdit,   "card-edit", "@"),
   ARGPARSE_c (aChangePIN,  "change-pin", N_("change a card's PIN")),
 #endif
   ARGPARSE_c (aListConfig, "list-config", "@"),

commit 3c691097ca144e9a1d4c9185636c59a848bec85c
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 13:59:48 2016 +0100

    g10: Spell out --desig-revoke.
    
    * g10/gpg.c (opts): Rename option.
    * doc/gpg.texi: Update accordingly.
    --
    This is a rather long name, but I believe that this command is rarely
    used, and in places where it is used frequently, the process is likely
    automated.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 753bec3..d24584a 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -727,7 +727,9 @@ published, which is best done by sending the key to a keyserver
 to a file which is then send to frequent communication partners.
 
 
- at item --desig-revoke @code{name}
+ at item --generate-designated-revocation @code{name}
+ at opindex generate-designated-revocation
+ at itemx --desig-revoke @code{name}
 @opindex desig-revoke
 Generate a designated revocation certificate for a key. This allows a
 user (with the permission of the keyholder) to revoke someone else's
diff --git a/g10/gpg.c b/g10/gpg.c
index 7702bb3..f0eb930 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -476,6 +476,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aEditKey,  "key-edit"   ,"@"),
   ARGPARSE_c (aPasswd,   "change-passphrase", N_("change a passphrase")),
   ARGPARSE_c (aPasswd,   "passwd", "@"),
+  ARGPARSE_c (aDesigRevoke, "generate-designated-revocation", "@"),
   ARGPARSE_c (aDesigRevoke, "desig-revoke","@" ),
   ARGPARSE_c (aExport, "export"           , N_("export keys") ),
   ARGPARSE_c (aSendKeys, "send-keys"     , N_("export keys to a keyserver") ),
@@ -4555,7 +4556,7 @@ main (int argc, char **argv)
 
       case aDesigRevoke:
 	if (argc != 1)
-	    wrong_args ("--desig-revoke user-id");
+	    wrong_args ("--generate-designated-revocation user-id");
 	username = make_username (*argv);
 	gen_desig_revoke (ctrl, username, locusr);
 	xfree (username);

commit c252627c6fd93bc305c5a5a2f013c3de2d45c6b0
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 13:01:03 2016 +0100

    g10: Shorten unreasonably long option.
    
    * g10/gpg.c (opts): Rename 'generate-revocation-certificate' to
    'generate-revocation'.
    * doc/gpg.texi: Update accordingly.
    * po: Update translations.
    
    GnuPG-bug-id: 2700
    Fixes-commit: ec1bd3ae685e95563e38077ab3c1655fd55dea07
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 9b230c8..753bec3 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -710,8 +710,8 @@ mode. See the manual section ``Unattended key generation'' on how
 to use this.
 
 
- at item --generate-revocation-certificate @code{name}
- at opindex generate-revocation-certificate
+ at item --generate-revocation @code{name}
+ at opindex generate-revocation
 @itemx --gen-revoke @code{name}
 @opindex gen-revoke
 Generate a revocation certificate for the complete key.  To only revoke
diff --git a/g10/gpg.c b/g10/gpg.c
index 6003d04..7702bb3 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -459,7 +459,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_c (aFullKeygen,  "full-generate-key" ,
               N_("full featured key pair generation")),
   ARGPARSE_c (aFullKeygen,  "full-gen-key", "@"),
-  ARGPARSE_c (aGenRevoke, "generate-revocation-certificate",
+  ARGPARSE_c (aGenRevoke, "generate-revocation",
 	      N_("generate a revocation certificate")),
   ARGPARSE_c (aGenRevoke, "gen-revoke", "@"),
   ARGPARSE_c (aDeleteKeys,"delete-keys",
@@ -4547,7 +4547,7 @@ main (int argc, char **argv)
 
       case aGenRevoke:
 	if( argc != 1 )
-	    wrong_args("--generate-revocation-certificate user-id");
+	    wrong_args("--generate-revocation user-id");
 	username =  make_username(*argv);
 	gen_revoke( username );
 	xfree( username );
diff --git a/g10/revoke.c b/g10/revoke.c
index 17c9b8c..591b641 100644
--- a/g10/revoke.c
+++ b/g10/revoke.c
@@ -571,7 +571,7 @@ gen_standard_revoke (PKT_public_key *psk, const char *cache_nonce)
        "the secret key.  However, if the secret key is still accessible,\n"
        "it is better to generate a new revocation certificate and give\n"
        "a reason for the revocation.  For details see the description of\n"
-       "of the gpg command \"--generate-revocation-certificate\" in the "
+       "of the gpg command \"--generate-revocation\" in the "
        "GnuPG manual."),
      _("To avoid an accidental use of this file, a colon has been inserted\n"
        "before the 5 dashes below.  Remove this colon with a text editor\n"
diff --git a/po/ca.po b/po/ca.po
index b4cd9c7..6f383f4 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -5478,7 +5478,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/cs.po b/po/cs.po
index f2cb0d7..7550f44 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -5116,7 +5116,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "Pou?ijte jej pro odvol?n? tohoto kl??e v?p??pad? zneu?it? nebo ztr?ty\n"
 "soukrom?ho kl??e. Av?ak bude-li soukrom? kl?? st?le p??stupn?, bude\n"
diff --git a/po/da.po b/po/da.po
index eed0e6c..4aa7cfb 100644
--- a/po/da.po
+++ b/po/da.po
@@ -5373,7 +5373,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/de.po b/po/de.po
index 21dcc87..3af9918 100644
--- a/po/de.po
+++ b/po/de.po
@@ -5134,14 +5134,14 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "Benutzen Sie es, um einen Schl?ssel zu widerrufen, falls der private\n"
 "Schl?ssel verloren wurde oder kompromittiert ist.  Falls jedoch auf\n"
 "den privaten Schl?ssel noch zugegriffen werden kann, so ist es besser,\n"
 "ein neues Widerrufszertifikat zu erzeugen, um den Grund des Widerrufs\n"
 "mit angeben zu k?nnen.  Weitere Informationen finden Sie im GnuPG\n"
-"Handbuch unter der Beschreibung des gpg Kommandos \"--generate-revocation-certificate\"."
+"Handbuch unter der Beschreibung des gpg Kommandos \"--generate-revocation\"."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/el.po b/po/el.po
index e2b238a..7ac9e40 100644
--- a/po/el.po
+++ b/po/el.po
@@ -5360,7 +5360,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/eo.po b/po/eo.po
index 0e93051..ad08839 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -5328,7 +5328,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/es.po b/po/es.po
index 64e348e..772b685 100644
--- a/po/es.po
+++ b/po/es.po
@@ -5366,7 +5366,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/et.po b/po/et.po
index 6247351..bde0be1 100644
--- a/po/et.po
+++ b/po/et.po
@@ -5302,7 +5302,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/fi.po b/po/fi.po
index 83ba0c1..9fdf162 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -5350,7 +5350,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/fr.po b/po/fr.po
index d88ed36..2e76ddd 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -5237,7 +5237,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "Utilisez-le pour r?voquer cette clef en cas de compromis ou de\n"
 "perte de la clef secr?te. Cependant, si la clef secr?te est\n"
diff --git a/po/gl.po b/po/gl.po
index 0995161..95cfe9e 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -5359,7 +5359,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/hu.po b/po/hu.po
index d437321..bcc5c30 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -5324,7 +5324,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/id.po b/po/id.po
index 5b6d49c..6ad3f70 100644
--- a/po/id.po
+++ b/po/id.po
@@ -5316,7 +5316,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/it.po b/po/it.po
index 2ffcf83..ef271eb 100644
--- a/po/it.po
+++ b/po/it.po
@@ -5344,7 +5344,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ja.po b/po/ja.po
index 6766470..228a959 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -4933,12 +4933,12 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "???????????????????????????????????\n"
 "???????????????????????????????????\n"
 "??????????????????????GnuPG??????gpg???? \"--"
-"generate-revocation-certificate\"???????????"
+"generate-revocation\"???????????"
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/nb.po b/po/nb.po
index 770768c..63a153c 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -5008,13 +5008,13 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "Bruk det for ? oppheve denne n?kkelen hvis den blir kompromittert\n"
 "eller hvis du mister den hemmelige n?kkelen. Hvis du fremdeles har\n"
 "tilgang til den hemmelige n?kkelen, er det lurt ? heller lage et nytt\n"
 "opphevelsessertifikat og oppgi en grunn til opphevelsen.\n"
-"Se beskrivelse av kommandoen ?--generate-revocation-certificate? i GnuPG-\n"
+"Se beskrivelse av kommandoen ?--generate-revocation? i GnuPG-\n"
 "bruksanvisninga for detaljer."
 
 msgid ""
diff --git a/po/pl.po b/po/pl.po
index a6650af..8421f33 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -5397,7 +5397,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/pt.po b/po/pt.po
index 51fdc52..fe98eaf 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -5329,7 +5329,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ro.po b/po/ro.po
index ce70c89..c7d8e3f 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -5344,7 +5344,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/ru.po b/po/ru.po
index 94052d0..2625e9c 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -5018,12 +5018,12 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "??????????? ?? ??? ?????? ????? ????? ? ?????? ????????? ??? ??????\n"
 "?????????? ?????. ??????, ???? ????????? ???? ????????, ????? ???????\n"
 "????? ?????????? ? ????????? ??????? ??????. ??????????? ??. ? ????????\n"
-"??????? gpg \"--generate-revocation-certificate\" ? ??????????? ?? GnuPG."
+"??????? gpg \"--generate-revocation\" ? ??????????? ?? GnuPG."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/sk.po b/po/sk.po
index 4566b3b..ae53979 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -5337,7 +5337,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/sv.po b/po/sv.po
index ccc6ee5..5c364f8 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -5463,7 +5463,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/tr.po b/po/tr.po
index 1ab27c9..2746f7c 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -5398,7 +5398,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/uk.po b/po/uk.po
index 4e8e7b5..6cf2360 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -5117,14 +5117,14 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "????????????? ??? ??? ??????????? ????? ????? ? ??????? ????\n"
 "????????????? ??? ?????? ???????? ???????. ????, ???? ?????? ??\n"
 "????????? ????? ?? ????????, ????? ???????? ????? ??????????\n"
 "??????????? ? ??????? ??????? ???????????. ??????????? ????\n"
 "????? ?????? ? ???????? ?????????? ? GnuPG ???? ???????\n"
-"gpg ?--generate-revocation-certificate?."
+"gpg ?--generate-revocation?."
 
 msgid ""
 "To avoid an accidental use of this file, a colon has been inserted\n"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 740a7e9..a067cf3 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -5212,7 +5212,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 
 msgid ""
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 0955613..6762660 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -5001,7 +5001,7 @@ msgid ""
 "the secret key.  However, if the secret key is still accessible,\n"
 "it is better to generate a new revocation certificate and give\n"
 "a reason for the revocation.  For details see the description of\n"
-"of the gpg command \"--generate-revocation-certificate\" in the GnuPG manual."
+"of the gpg command \"--generate-revocation\" in the GnuPG manual."
 msgstr ""
 "??????????, ????????.\n"
 "??, ???????????, ?????\n"

commit bc6b76ef26f31c54ae1c29c761b8ecc437fcf565
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 15 12:44:52 2016 +0100

    doc: Add aliases of all changed options.
    
    * doc/gpg.texi: Add the old version of every option that was updated
    with the last change set.
    * doc/gpgsm.texi: Likewise.
    
    GnuPG-bug-id: 2700
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index c5068b9..9b230c8 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -181,6 +181,8 @@ chosen by default or can be set explicitly using the
 
 @item --clear-sign
 @opindex clear-sign
+ at itemx --clearsign
+ at opindex clearsign
 Make a cleartext signature.  The content in a cleartext signature is
 readable without any special software. OpenPGP software is only needed
 to verify the signature.  cleartext signatures may modify end-of-line
@@ -303,6 +305,8 @@ exported using @option{--export-secret-subkeys}).  See also
 
 @item --list-signatures
 @opindex list-signatures
+ at itemx --list-sigs
+ at opindex list-sigs
 Same as @option{--list-keys}, but the signatures are listed too.
 This command has the same effect as
 using @option{--list-keys} with @option{--with-sig-list}.
@@ -322,6 +326,8 @@ command "tsign").
 
 @item --check-signatures
 @opindex check-signatures
+ at itemx --check-sigs
+ at opindex check-sigs
 Same as @option{--list-signatures}, but the signatures are verified.  Note
 that for performance reasons the revocation status of a signing key is
 not shown.
@@ -466,6 +472,8 @@ signatures, user-IDs and subkeys.
 
 @item --receive-keys @code{key IDs}
 @opindex receive-keys
+ at itemx --recv-keys @code{key IDs}
+ at opindex recv-keys
 Import the keys with the given key IDs from a keyserver. Option
 @option{--keyserver} must be used to give the name of this keyserver.
 
@@ -683,13 +691,17 @@ can be used for no expiration date.
 
 @item --generate-key
 @opindex generate-key
+ at itemx --gen-key
+ at opindex gen-key
 Generate a new key pair using the current default parameters.  This is
 the standard command to create a new key.  In addition to the key a
 revocation certificate is created and stored in the
 @file{openpgp-revocs.d} directory below the GnuPG home directory.
 
 @item --full-generate-key
- at opindex gen-key
+ at opindex full-generate-key
+ at itemx --full-gen-key
+ at opindex full-gen-key
 Generate a new key pair with dialogs for all options.  This is an
 extended version of @option{--generate-key}.
 
@@ -700,6 +712,8 @@ to use this.
 
 @item --generate-revocation-certificate @code{name}
 @opindex generate-revocation-certificate
+ at itemx --gen-revoke @code{name}
+ at opindex gen-revoke
 Generate a revocation certificate for the complete key.  To only revoke
 a subkey or a key signature, use the @option{--edit} command.
 
@@ -1075,6 +1089,8 @@ sub-command @code{revuid} of @option{--edit-key}.
 
 @item --change-passphrase @var{user_id}
 @opindex change-passphrase
+ at itemx --passwd @var{user_id}
+ at opindex passwd
 Change the passphrase of the secret key belonging to the certificate
 specified as @var{user_id}.  This is a shortcut for the sub-command
 @code{passwd} of the edit key menu.
diff --git a/doc/gpgsm.texi b/doc/gpgsm.texi
index d7d3770..b92eaea 100644
--- a/doc/gpgsm.texi
+++ b/doc/gpgsm.texi
@@ -167,6 +167,8 @@ use @samp{--help} to get a list of supported operations.
 @table @gnupgtabopt
 @item --generate-key
 @opindex generate-key
+ at itemx --gen-key
+ at opindex gen-key
 This command allows the creation of a certificate signing request or a
 self-signed certificate.  It is commonly used along with the
 @option{--output} option to save the created CSR or certificate into a
@@ -285,6 +287,8 @@ and in turn the @command{scdaemon}.
 
 @item --change-passphrase @var{user_id}
 @opindex change-passphrase
+ at itemx --passwd @var{user_id}
+ at opindex passwd
 Change the passphrase of the private key belonging to the certificate
 specified as @var{user_id}.  Note, that changing the passphrase/PIN of a
 smartcard is not yet supported.

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi                             | 50 ++++++++++++++++++---------
 doc/gpgsm.texi                           |  4 +++
 g10/call-agent.c                         |  2 +-
 g10/gpg.c                                | 58 ++++++++++++++++++--------------
 g10/revoke.c                             |  2 +-
 po/ca.po                                 |  2 +-
 po/cs.po                                 |  2 +-
 po/da.po                                 |  2 +-
 po/de.po                                 |  4 +--
 po/el.po                                 |  2 +-
 po/eo.po                                 |  2 +-
 po/es.po                                 |  2 +-
 po/et.po                                 |  2 +-
 po/fi.po                                 |  2 +-
 po/fr.po                                 |  2 +-
 po/gl.po                                 |  2 +-
 po/hu.po                                 |  2 +-
 po/id.po                                 |  2 +-
 po/it.po                                 |  2 +-
 po/ja.po                                 |  4 +--
 po/nb.po                                 |  4 +--
 po/pl.po                                 |  2 +-
 po/pt.po                                 |  2 +-
 po/ro.po                                 |  2 +-
 po/ru.po                                 |  4 +--
 po/sk.po                                 |  2 +-
 po/sv.po                                 |  2 +-
 po/tr.po                                 |  2 +-
 po/uk.po                                 |  4 +--
 po/zh_CN.po                              |  2 +-
 po/zh_TW.po                              |  2 +-
 tests/openpgp/quick-key-manipulation.scm |  8 ++---
 32 files changed, 108 insertions(+), 78 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 15 17:55:43 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 15 Dec 2016 17:55:43 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-226-g829c656
Message-ID: <E1cHZJu-00058L-2w@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  829c65658073aabc75c56442b85fe78296df6f9c (commit)
       via  7d7356f0ba829f127816194203288f1c3c9decf6 (commit)
       via  b1251956bbf6efd7187fc0fd55304d81dbec27d5 (commit)
       via  9767ec7cf6e3a8987e4df10896f6f3c76b53953d (commit)
       via  671572bcb85d116ba716416d72dc6f499733c306 (commit)
       via  72f6089351919ea1922b7d729bd03e7843c7e77d (commit)
       via  55fd5a0109f0638dc55912cdc4d412bb01ffadc7 (commit)
       via  c5cd68ac9577b418aedbad81d59f2c58d25f6eac (commit)
       via  1975900a147f65b6363663900bd9753adc5039c1 (commit)
      from  51e10a77dcb393f80b89945d8425595cfcc4f5f8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 829c65658073aabc75c56442b85fe78296df6f9c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:55:11 2016 +0100

    Don't add a dot after the tooltip
    
    * src/ribbon-callbacks.cpp (get_sig_ttip): Remove dot.

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 59859f8..079779f 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1555,13 +1555,13 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
   if (mail && (mail->is_signed () || mail->is_encrypted ()))
     {
       char *buf;
-      gpgrt_asprintf (&buf, _("%s message."), mail->get_crypto_summary ().c_str());
+      gpgrt_asprintf (&buf, _("%s message"), mail->get_crypto_summary ().c_str());
       w_result = utf8_to_wchar (buf);
       xfree(buf);
     }
   else
     {
-      w_result = utf8_to_wchar (_("Insecure message."));
+      w_result = utf8_to_wchar (_("Insecure message"));
     }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);

commit 7d7356f0ba829f127816194203288f1c3c9decf6
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:54:20 2016 +0100

    Fix signature level for unencrypted mails
    
    * src/mail.cpp (Mail::get_signature_level): Don't always
    return 0 for unencrytped mails.

diff --git a/src/mail.cpp b/src/mail.cpp
index 53d2631..42222f6 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1677,7 +1677,7 @@ Mail::get_crypto_details()
 int
 Mail::get_signature_level () const
 {
-  if (!m_is_signed || !is_encrypted ())
+  if (!m_is_signed)
     {
       return 0;
     }
@@ -1708,7 +1708,7 @@ Mail::get_signature_level () const
   if (m_sig.summary() & Signature::Summary::TofuConflict ||
       m_uid.tofuInfo().validity() == TofuInfo::Conflict)
     {
-      return 1;
+      return 0;
     }
   return 0;
 }

commit b1251956bbf6efd7187fc0fd55304d81dbec27d5
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:53:41 2016 +0100

    Various string fixes for crypto_details
    
    * src/mail.cpp (Mail::get_crypto_details): Various string
    fixes.

diff --git a/src/mail.cpp b/src/mail.cpp
index 6b06f03..53d2631 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1462,14 +1462,15 @@ Mail::get_crypto_details()
     }
   else if (is_encrypted() && !is_signed ())
     {
-      return _("You cannot be sure who sent the message as "
+      return _("But you cannot be sure who sent the message because "
                "it is not signed.");
     }
 
   std::string message;
 
   bool keyFound = true;
-  bool isOpenPGP = m_sig.key().protocol() == Protocol::OpenPGP;
+  bool isOpenPGP = m_sig.key().isNull() ? !is_smime() :
+                   m_sig.key().protocol() == Protocol::OpenPGP;
   char *buf;
   bool hasConflict = false;
   int level = get_signature_level ();
@@ -1485,7 +1486,7 @@ Mail::get_crypto_details()
 
       if (four_check == -1)
         {
-          message = _("And you signed this message.");
+          message = _("You signed this message.");
         }
       else if (four_check >= 0)
         {
@@ -1494,6 +1495,7 @@ Mail::get_crypto_details()
             And <uid with ultimate trust> certified the identity
             of the sender.
           */
+          message = _("The senders identity was certified by yourself.");
         }
       else
         {
@@ -1506,12 +1508,12 @@ Mail::get_crypto_details()
     {
       /* Level three is only reachable through web of trust and no
          direct signature. */
-      message = _("And the senders identity was certified by several trusted people.");
+      message = _("The senders identity was certified by several trusted people.");
     }
   else if (level == 3 && !isOpenPGP)
     {
       /* Level three is the only level for trusted S/MIME keys. */
-      gpgrt_asprintf (&buf, _("And the senders identity is cerified by the trusted issuer:\n'%s'\n"),
+      gpgrt_asprintf (&buf, _("The senders identity is cerified by the trusted issuer:\n'%s'\n"),
                       m_sig.key().issuerName());
       message = buf;
       xfree (buf);
@@ -1531,12 +1533,12 @@ Mail::get_crypto_details()
       char *time = format_date_from_gpgme (first_contact);
       /* i18n note signcount is always pulral because with signcount 1 we
        * would not be in this branch. */
-      gpgrt_asprintf (&buf, _("And the senders address is trustworthy, because "
+      gpgrt_asprintf (&buf, _("The senders address is trustworthy, because "
                               "you have established a communication history "
                               "with this address starting on %s.\n"
-                              "You encrypted %i times to this address and verified %i since."),
-                              time, m_uid.tofuInfo().signCount (),
-                              m_uid.tofuInfo().encrCount());
+                              "You encrypted %i and verified %i messages since."),
+                              time, m_uid.tofuInfo().encrCount(),
+                              m_uid.tofuInfo().signCount ());
       xfree (time);
       message = buf;
       xfree (buf);
@@ -1545,12 +1547,16 @@ Mail::get_crypto_details()
     {
       /* This could be marginal trust through pgp, or tofu with little
          history. */
-      if (m_uid.tofuInfo ().validity() == TofuInfo::Validity::LittleHistory)
+      if (m_uid.tofuInfo ().signCount() == 1)
+        {
+          message += _("The senders signature was verified for the first time.");
+        }
+      else if (m_uid.tofuInfo ().validity() == TofuInfo::Validity::LittleHistory)
         {
           unsigned long first_contact = std::max (m_uid.tofuInfo().signFirst(),
                                                   m_uid.tofuInfo().encrFirst());
           char *time = format_date_from_gpgme (first_contact);
-          gpgrt_asprintf (&buf, _("But the senders address is not trustworthy yet because "
+          gpgrt_asprintf (&buf, _("The senders address is not trustworthy yet because "
                                   "you only verified %i messages and encrypted %i messages to "
                                   "it since %s."),
                                   m_uid.tofuInfo().signCount (),
@@ -1559,10 +1565,6 @@ Mail::get_crypto_details()
           message = buf;
           xfree (buf);
         }
-      else if (m_uid.tofuInfo ().signCount() == 1)
-        {
-          message += _("But the senders signature was verified for the first time.");
-        }
       else
         {
           /* Marginal trust through pgp */
@@ -1574,7 +1576,8 @@ Mail::get_crypto_details()
     {
       /* Now we are in level 0, this could be a technical problem, no key
          or just unkown. */
-      message = _("But the sender address is not trustworthy because:");
+      message = is_encrypted () ? _("But the sender address is not trustworthy because:") :
+                                  _("The sender address is not trustworthy because:");
       message += "\n\n";
       keyFound = !(m_sig.summary() & Signature::Summary::KeyMissing);
 
@@ -1628,7 +1631,8 @@ Mail::get_crypto_details()
       else if ((m_sig.summary() & Signature::Summary::TofuConflict) ||
                m_uid.tofuInfo().validity() == TofuInfo::Conflict)
         {
-          message += _("conflicts with another key that was used in the past by the sender.");
+          message += _("is not the same as the key that was used "
+                       "for this address in the past.");
           hasConflict = true;
         }
       else if (m_uid.isNull())
@@ -1651,7 +1655,6 @@ Mail::get_crypto_details()
           message += _("is marked as not trustworthy.");
         }
     }
-  message += _("You cannot be sure who wrote or modified the message.");
   message += "\n\n";
   if (hasConflict)
     {

commit 9767ec7cf6e3a8987e4df10896f6f3c76b53953d
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:52:13 2016 +0100

    Invert category order
    
    * src/mail.cpp (Mail::update_categories): Invert order.
    
    --
    This should help when outlook decides to only show one category
    because now the verified sender which is more important is shown
    first.

diff --git a/src/mail.cpp b/src/mail.cpp
index 6358951..6b06f03 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1290,6 +1290,15 @@ Mail::update_categories ()
 {
   const char *decCategory = _("GpgOL: Encrypted Message");
   const char *verifyCategory = _("GpgOL: Trusted Sender Address");
+  if (is_valid_sig())
+    {
+      add_category (m_mailitem, verifyCategory);
+    }
+  else
+    {
+      remove_category (m_mailitem, verifyCategory);
+    }
+
   if (m_decrypt_result.numRecipients())
     {
       /* We use the number of recipients as we don't care
@@ -1302,15 +1311,6 @@ Mail::update_categories ()
          categories */
       remove_category (m_mailitem, decCategory);
     }
-
-  if (is_valid_sig())
-    {
-      add_category (m_mailitem, verifyCategory);
-    }
-  else
-    {
-      remove_category (m_mailitem, verifyCategory);
-    }
   return;
 }
 

commit 671572bcb85d116ba716416d72dc6f499733c306
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:50:58 2016 +0100

    Use insecure instead of signed to sum up lvl1
    
    * src/mail.cpp (Mail::get_crypto_summary): Use insecure instead
    of signed.
    
    --
    The word signed implies security and so might make phishing
    easier if a signed phishing mail is shown as signed and not
    as insecure.

diff --git a/src/mail.cpp b/src/mail.cpp
index dc3ac58..6358951 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1442,7 +1442,11 @@ Mail::get_crypto_summary ()
     }
   if (is_signed ())
     {
-      return _("Signed");
+      /* Even if it is signed, if it is not validly
+         signed it's still completly insecure as anyone
+         could have signed this. So we avoid the label
+         "signed" here as this already leaves */
+      return _("Insecure");
     }
   return _("Insecure");
 }

commit 72f6089351919ea1922b7d729bd03e7843c7e77d
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:50:10 2016 +0100

    Fix sigstate setting
    
    * src/mail.cpp (Mail::update_sigstate): Skip empty uids
    instead of non empty ones :-)

diff --git a/src/mail.cpp b/src/mail.cpp
index 00e4244..dc3ac58 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1234,9 +1234,9 @@ Mail::update_sigstate ()
     {
       m_is_signed = true;
       m_uid = get_uid_for_sender (sig.key(), sender.c_str());
-      if (!m_uid.isNull() && sig.validity() != Signature::Validity::Marginal &&
+      if (m_uid.isNull() || (sig.validity() != Signature::Validity::Marginal &&
           sig.validity() != Signature::Validity::Full &&
-          sig.validity() != Signature::Validity::Ultimate)
+          sig.validity() != Signature::Validity::Ultimate))
         {
           /* For our category we only care about trusted sigs. And
           the UID needs to match.*/
@@ -1257,8 +1257,8 @@ Mail::update_sigstate ()
               continue;
             }
         }
-      log_debug ("%s:%s: Classified sender as verified",
-                 SRCNAME, __func__);
+      log_debug ("%s:%s: Classified sender as verified uid validity: %i",
+                 SRCNAME, __func__, m_uid.validity());
       m_sig = sig;
       m_is_valid = true;
       return;

commit 55fd5a0109f0638dc55912cdc4d412bb01ffadc7
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:48:48 2016 +0100

    Pass key by reference to get_uid
    
    * src/mail.cpp (get_uid_for_sender): Pass key by reference
    to avoid a copy.

diff --git a/src/mail.cpp b/src/mail.cpp
index a872095..00e4244 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1164,7 +1164,7 @@ Mail::get_close_triggered () const
 }
 
 static const UserID
-get_uid_for_sender (const Key k, const char *sender)
+get_uid_for_sender (const Key &k, const char *sender)
 {
   UserID ret;
 

commit c5cd68ac9577b418aedbad81d59f2c58d25f6eac
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 17:07:09 2016 +0100

    Always activate the GpgOL read button
    
    * src/gpgoladdin.cpp (getCustomUI_MIME): Always enable button.
    * src/ribbon-callbacks.cpp (launch_cert_details): Open
    the emailselfdefense infographic for unencrypted / unsigned
    mails.
    
    --
    Maybe a bit too much, but the idea is to raise awareness
    that unencrypted / unsigned mails are insecure.

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index eaafd18..1903ec0 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -833,7 +833,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "                 supertip=\"%s\""
         "                 getPressed=\"getSignEncryptPressed\""
         "                 getImage=\"btnSignEncryptLarge\""
-        "                 onAction=\"encryptSignMime\"""/>"
+        "                 onAction=\"encryptSignMime\"/>"
         "         <menu id=\"encMenu\" showLabel=\"true\">"
         "         <toggleButton id=\"mimeSign\""
         "                 getImage=\"btnSignSmall\""
@@ -882,8 +882,8 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "               getLabel=\"getSigLabel\""
         "               getScreentip=\"getSigTip\""
         "               getSupertip=\"getSigSTip\""
-        "               onAction=\"launchDetails\""
-        "               getEnabled=\"getIsCrypto\"/>"
+        "               onAction=\"launchDetails\"/>"
+       /* "               getEnabled=\"getIsCrypto\"/>" */
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn\""
         "                 onAction=\"openOptions\""
@@ -925,8 +925,8 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "               getLabel=\"getSigLabel\""
         "               getScreentip=\"getSigTip\""
         "               getSupertip=\"getSigSTip\""
-        "               onAction=\"launchDetails\""
-        "               getEnabled=\"getIsCrypto\"/>"
+        "               onAction=\"launchDetails\"/>"
+       /* "               getEnabled=\"getIsCrypto\"/>" */
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn_read\""
         "                 onAction=\"openOptions\""
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index ae15756..59859f8 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1577,7 +1577,8 @@ HRESULT get_sig_stip (LPDISPATCH ctrl, VARIANT *result)
     {
       wchar_t *w_result;
       w_result = utf8_to_wchar (_("You cannot be sure who sent, "
-                                  "modified and read the message in transit."));
+                                  "modified and read the message in transit.\n\n"
+                                  "Click here to learn more."));
       result->bstrVal = SysAllocString (w_result);
       xfree (w_result);
       return S_OK;
@@ -1593,10 +1594,10 @@ HRESULT launch_cert_details (LPDISPATCH ctrl)
 {
   MY_MAIL_GETTER
 
-  if (!mail)
+  if (!mail || (!mail->is_signed () && !mail->is_encrypted ()))
     {
-      log_debug ("%s:%s: No mail.",
-                 SRCNAME, __func__);
+      ShellExecuteA(NULL, NULL, "https://emailselfdefense.fsf.org/infographic",
+                    0, 0, SW_SHOWNORMAL);
       return S_OK;
     }
 

commit 1975900a147f65b6363663900bd9753adc5039c1
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Dec 15 12:01:25 2016 +0100

    Handle opaque signed inline pgp messages
    
    * src/parsecontroller.cpp (ParseController::parse):
    Handle opaque signed PGP Messages.
    
    --
    For signed only messages decryptandverify would create no
    output we need to just verify in that case.

diff --git a/src/parsecontroller.cpp b/src/parsecontroller.cpp
index f053d87..2752fad 100644
--- a/src/parsecontroller.cpp
+++ b/src/parsecontroller.cpp
@@ -203,9 +203,19 @@ ParseController::parse()
   // Wrap the input stream in an attachment / GpgME Data
   Protocol protocol;
   bool decrypt, verify;
-  operation_for_type (m_type, &decrypt, &verify);
 
   Data input (m_inputprovider);
+
+  if (input.type () == Data::Type::PGPSigned)
+    {
+      verify = true;
+      decrypt = false;
+    }
+  else
+    {
+      operation_for_type (m_type, &decrypt, &verify);
+    }
+
   if ((m_inputprovider->signature() && is_smime (*m_inputprovider->signature())) ||
       is_smime (input))
     {
@@ -256,7 +266,8 @@ ParseController::parse()
       if ((!m_decrypt_result.error () &&
           m_verify_result.signatures ().empty() &&
           m_outputprovider->signature ()) ||
-          is_smime (output))
+          is_smime (output) ||
+          output.type() == Data::Type::PGPSigned)
         {
           /* There is a signature in the output. So we have
              to verify it now as an extra step. */
@@ -315,6 +326,10 @@ ParseController::parse()
     {
        std::stringstream ss;
        ss << m_decrypt_result << '\n' << m_verify_result;
+      for (const auto sig: m_verify_result.signatures())
+        {
+          ss << '\n' << sig.key();
+        }
        log_debug ("Decrypt / Verify result: %s", ss.str().c_str());
     }
   TRACEPOINT;

-----------------------------------------------------------------------

Summary of changes:
 src/gpgoladdin.cpp       | 10 +++----
 src/mail.cpp             | 77 ++++++++++++++++++++++++++----------------------
 src/parsecontroller.cpp  | 19 ++++++++++--
 src/ribbon-callbacks.cpp | 13 ++++----
 4 files changed, 71 insertions(+), 48 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 08:44:29 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 08:44:29 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 0a766e5a7c2074b33ed800c91ec310285675c174
Message-ID: <E1cHnBv-0006wg-GM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  0a766e5a7c2074b33ed800c91ec310285675c174 (commit)
      from  cb04299eadbe2ca9022a5e54217a872368073a77 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0a766e5a7c2074b33ed800c91ec310285675c174
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 08:40:10 2016 +0100

    web: Add Stripe logo

diff --git a/web/donate/kudos.org b/web/donate/kudos.org
index d279954..0aef606 100644
--- a/web/donate/kudos.org
+++ b/web/donate/kudos.org
@@ -72,6 +72,7 @@ The [[https://gnupg.org/blog/20140512-rewards-sent.html][Goteo crowdfunding]] ca
   [[http://eof.eu.org][file:logos/eof.eu.org-logo.png]]
   [[https://www.wauland.de][file:logos/whs-logo.png]]
   [[https://facebook.com][file:logos/facebook-06-2015-blue_x.png]]
+  [[https://stripe.com][file:logos/stripe-blue.png]]
 #+HTML: </div>
 
 * Hardware and service donations
diff --git a/web/donate/logos/stripe-blue.png b/web/donate/logos/stripe-blue.png
new file mode 100644
index 0000000..d4df440
Binary files /dev/null and b/web/donate/logos/stripe-blue.png differ

-----------------------------------------------------------------------

Summary of changes:
 web/donate/kudos.org             |   1 +
 web/donate/logos/stripe-blue.png | Bin 0 -> 2539 bytes
 2 files changed, 1 insertion(+)
 create mode 100644 web/donate/logos/stripe-blue.png


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 09:13:43 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 09:13:43 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 1591b7d04ace4026685a65f9feef7cbc5b4f33dd
Message-ID: <E1cHneD-00006d-SG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  1591b7d04ace4026685a65f9feef7cbc5b4f33dd (commit)
      from  0a766e5a7c2074b33ed800c91ec310285675c174 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1591b7d04ace4026685a65f9feef7cbc5b4f33dd
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 09:11:00 2016 +0100

    web: Fix rendering of the hardware sponsor's logo.

diff --git a/web/donate/kudos.org b/web/donate/kudos.org
index 0aef606..7ecb0cd 100644
--- a/web/donate/kudos.org
+++ b/web/donate/kudos.org
@@ -81,6 +81,13 @@ The [[https://gnupg.org/blog/20140512-rewards-sent.html][Goteo crowdfunding]] ca
   provide rack space, connectivity, and are fast in fixing problems
   with the machines.
 
+# Without doing this in HTML we get an extra div figure around the
+# link which messes up the rendering.  Funnily this does not happen
+# with the logo box above.
+#
 #+HTML: <div class="logobox">
-  [[https://www.openit.de][file:../share/logo-sponsor.png]]
+#+HTML: <p>
+#+HTML: <a href="https://www.openit.de"><img src="../share/logo-sponsor.png"
+#+HTML:    alt="Logo OpenIT" /></a>
+#+HTML: </p>
 #+HTML: </div>

-----------------------------------------------------------------------

Summary of changes:
 web/donate/kudos.org | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 13:07:24 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Fri, 16 Dec 2016 13:07:24 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-129-gfea9da4
Message-ID: <E1cHrIO-0003Ei-0T@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  fea9da4a8afab6f3a49cdbbcc4a7a21f27a6d3e8 (commit)
       via  6caa2d0ba2bfc0ae93878738b0169483f6b6b462 (commit)
      from  6b16b02109f4bb5b934e456667ff4c0ba7bc85fd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fea9da4a8afab6f3a49cdbbcc4a7a21f27a6d3e8
Author: Neal H. Walfield <neal at g10code.com>
Date:   Wed Dec 7 10:11:46 2016 +0100

    g10: On a TOFU conflict, write the conflicting keys to the status fd
    
    * g10/tofu.c (ask_about_binding): Emit all of the conflicting keys and
    their statistics on the status fd.
    (get_trust): Likewise, if we don't call ask_about_binding.
    (show_statistics): Have the caller pass the policy as returned by
    get_policy.  Add argument only_status_fd and don't emit any output on
    stdout if it is set.  Update callers.
    
    --
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index 4fc18b6..c574171 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -112,8 +112,10 @@ struct tofu_dbs_s
 /* Local prototypes.  */
 static gpg_error_t end_transaction (ctrl_t ctrl, int only_batch);
 static char *email_from_user_id (const char *user_id);
-
-
+static int show_statistics (tofu_dbs_t dbs,
+                            const char *fingerprint, const char *email,
+                            enum tofu_policy policy,
+                            estream_t outfp, int only_status_fd, time_t now);
 

 const char *
 tofu_policy_str (enum tofu_policy policy)
@@ -1797,6 +1799,9 @@ ask_about_binding (ctrl_t ctrl,
               xfree (key_pp);
 
               seen_in_past = 0;
+
+              show_statistics (dbs, stats_iter->fingerprint, email,
+                               TOFU_POLICY_ASK, NULL, 1, now);
             }
 
           if (labs(stats_iter->time_ago) == 1)
@@ -2752,7 +2757,13 @@ get_trust (ctrl_t ctrl, PKT_public_key *pk,
                          now);
     }
   else
-    trust_level = TRUST_UNDEFINED;
+    {
+      for (iter = conflict_set; iter; iter = iter->next)
+        show_statistics (dbs, iter->d, email,
+                         TOFU_POLICY_ASK, NULL, 1, now);
+
+      trust_level = TRUST_UNDEFINED;
+    }
 
   /* Mark any conflicting bindings that have an automatic policy as
    * now requiring confirmation.  Note: we do this after we ask for
@@ -2920,17 +2931,18 @@ write_stats_status (estream_t fp,
 /* Note: If OUTFP is not NULL, this function merely prints a "tfs" record
  * to OUTFP.
  *
- * Returns whether the caller should call show_warning after iterating
- * over all user ids.
+ * POLICY is the key's policy (as returned by get_policy).
+ *
+ * Returns 0 if if ONLY_STATUS_FD is set.  Otherwise, returns whether
+ * the caller should call show_warning after iterating over all user
+ * ids.
  */
 static int
-show_statistics (tofu_dbs_t dbs, PKT_public_key *pk, const char *fingerprint,
-		 const char *email, const char *user_id,
-		 estream_t outfp, time_t now)
+show_statistics (tofu_dbs_t dbs,
+                 const char *fingerprint, const char *email,
+                 enum tofu_policy policy,
+		 estream_t outfp, int only_status_fd, time_t now)
 {
-  enum tofu_policy policy =
-    get_policy (dbs, pk, fingerprint, user_id, email, NULL, now);
-
   char *fingerprint_pp;
   int rc;
   strlist_t strlist = NULL;
@@ -2945,7 +2957,8 @@ show_statistics (tofu_dbs_t dbs, PKT_public_key *pk, const char *fingerprint,
 
   int show_warning = 0;
 
-  (void) user_id;
+  if (only_status_fd && ! is_status_enabled ())
+    return 0;
 
   fingerprint_pp = format_hexfingerprint (fingerprint, NULL, 0);
 
@@ -3027,7 +3040,7 @@ show_statistics (tofu_dbs_t dbs, PKT_public_key *pk, const char *fingerprint,
                       encryption_first_done,
                       encryption_most_recent);
 
-  if (!outfp)
+  if (!outfp && !only_status_fd)
     {
       estream_t fp;
       char *msg;
@@ -3555,6 +3568,7 @@ tofu_write_tfs_record (ctrl_t ctrl, estream_t fp,
   tofu_dbs_t dbs;
   char *fingerprint;
   char *email;
+  enum tofu_policy policy;
 
   if (!*user_id)
     return 0;  /* No TOFU stats possible for an empty ID.  */
@@ -3569,8 +3583,9 @@ tofu_write_tfs_record (ctrl_t ctrl, estream_t fp,
 
   fingerprint = hexfingerprint (pk, NULL, 0);
   email = email_from_user_id (user_id);
+  policy = get_policy (dbs, pk, fingerprint, user_id, email, NULL, now);
 
-  show_statistics (dbs, pk, fingerprint, email, user_id, fp, now);
+  show_statistics (dbs, fingerprint, email, policy, fp, 0, now);
 
   xfree (email);
   xfree (fingerprint);
@@ -3645,8 +3660,13 @@ tofu_get_validity (ctrl_t ctrl, PKT_public_key *pk, strlist_t user_id_list,
         bindings_valid ++;
 
       if (may_ask && tl != TRUST_ULTIMATE && tl != TRUST_EXPIRED)
-        need_warning |=
-          show_statistics (dbs, pk, fingerprint, email, user_id->d, NULL, now);
+        {
+          enum tofu_policy policy =
+            get_policy (dbs, pk, fingerprint, user_id->d, email, NULL, now);
+
+          need_warning |=
+            show_statistics (dbs, fingerprint, email, policy, NULL, 0, now);
+        }
 
       if (tl == TRUST_NEVER)
         trust_level = TRUST_NEVER;

commit 6caa2d0ba2bfc0ae93878738b0169483f6b6b462
Author: Neal H. Walfield <neal at g10code.com>
Date:   Tue Dec 13 09:16:54 2016 +0100

    g10: Add missing space.
    
    * g10/tofu.c (tofu_register_encryption): Add missing space.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index d15b25f..4fc18b6 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -3419,7 +3419,7 @@ tofu_register_encryption (ctrl_t ctrl,
       free_user_id_list = 1;
 
       if (! user_id_list)
-        log_info (_("WARNING: Encrypting to %s, which has no"
+        log_info (_("WARNING: Encrypting to %s, which has no "
                     "non-revoked user ids.\n"),
                   keystr (pk->keyid));
     }

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c | 54 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 17 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 14:31:09 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 16 Dec 2016 14:31:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-131-gca02a8b
Message-ID: <E1cHsbQ-0007nz-J4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  ca02a8b78fca8815388a859962584d75169ae3ee (commit)
       via  116a78eb869c4c589228bd0d6deff7c7a9f92dfb (commit)
      from  fea9da4a8afab6f3a49cdbbcc4a7a21f27a6d3e8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ca02a8b78fca8815388a859962584d75169ae3ee
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 16 13:52:03 2016 +0100

    doc: Improve section on unattended key generation.
    
    * doc/gpg.texi: Improve the subsection on unattended key generation by
    suggesting the quick key manipulation interface as an alternative, and
    by suggesting alternatives to '%pubring' and '%secring'.  Simplify
    examples accordingly.
    
    GnuPG-bug-id: 2400
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index a7e9204..b1e1a2a 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3796,9 +3796,14 @@ interface is described in the subsection ``How to manage your keys''.
 @subsection Unattended key generation
 
 The command @option{--generate-key} may be used along with the option
- at option{--batch} for unattended key generation.  The parameters are
-either read from stdin or given as a file on the command line.
-The format of the parameter file is as follows:
+ at option{--batch} for unattended key generation.  This is the most
+flexible way of generating keys, but it is also the most complex one.
+Consider using the quick key manipulation interface described in the
+previous subsection ``The quick key manipulation interface''.
+
+The parameters for the key are either read from stdin or given as a
+file on the command line.  The format of the parameter file is as
+follows:
 
 @itemize @bullet
   @item Text only, line length is limited to about 1000 characters.
@@ -3841,16 +3846,21 @@ Perform the key generation.  Note that an implicit commit is done at
 the next @asis{Key-Type} parameter.
 
 @item %pubring @var{filename}
- at itemx %secring @var{filename}
 Do not write the key to the default or commandline given keyring but
 to @var{filename}.  This must be given before the first commit to take
 place, duplicate specification of the same filename is ignored, the
 last filename before a commit is used.  The filename is used until a
 new filename is used (at commit points) and all keys are written to
 that file. If a new filename is given, this file is created (and
-overwrites an existing one).  For GnuPG versions prior to 2.1, both
-control statements must be given. For GnuPG 2.1 and later
- at samp{%secring} is a no-op.
+overwrites an existing one).
+
+See the previous subsection ``Ephemeral home directories'' for a more
+robust way to contain side-effects.
+
+ at item %secring @var{filename}
+This option is a no-op for GnuPG 2.1 and later.
+
+See the previous subsection ``Ephemeral home directories''.
 
 @item %ask-passphrase
 @itemx %no-ask-passphrase
@@ -3968,8 +3978,9 @@ generation to associate a key parameter block with a status line.
 @end table
 
 @noindent
-Here is an example on how to create a key:
+Here is an example on how to create a key in an ephemeral home directory:
 @smallexample
+$ export GNUPGHOME="$(mktemp -d)"
 $ cat >foo <<EOF
      %echo Generating a basic OpenPGP key
      Key-Type: DSA
@@ -3981,23 +3992,21 @@ $ cat >foo <<EOF
      Name-Email: joe@@foo.bar
      Expire-Date: 0
      Passphrase: abc
-     %pubring foo.pub
-     %secring foo.sec
      # Do a commit here, so that we can later print "done" :-)
      %commit
      %echo done
 EOF
 $ @gpgname --batch --generate-key foo
  [...]
-$ @gpgname --no-default-keyring --secret-keyring ./foo.sec \
-       --keyring ./foo.pub --list-secret-keys
-/home/wk/work/gnupg-stable/scratch/foo.sec
-------------------------------------------
-sec  1024D/915A878D 2000-03-09 Joe Tester (with stupid passphrase) <joe@@foo.bar>
-ssb  1024g/8F70E2C0 2000-03-09
+$ @gpgname --list-secret-keys
+/tmp/tmp.0NQxB74PEf/pubring.kbx
+-------------------------------
+sec   dsa1024 2016-12-16 [SCA]
+      768E895903FC1C44045C8CB95EEBDB71E9E849D0
+uid           [ultimate] Joe Tester (with stupid passphrase) <joe@@foo.bar>
+ssb   elg1024 2016-12-16 [E]
 @end smallexample
 
-
 @noindent
 If you want to create a key with the default algorithms you would use
 these parameters:
@@ -4010,8 +4019,6 @@ these parameters:
      Name-Email: joe@@foo.bar
      Expire-Date: 0
      Passphrase: abc
-     %pubring foo.pub
-     %secring foo.sec
      # Do a commit here, so that we can later print "done" :-)
      %commit
      %echo done

commit 116a78eb869c4c589228bd0d6deff7c7a9f92dfb
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 16 13:49:16 2016 +0100

    doc: Add documentation for programmatic use of GnuPG.
    
    * doc/gpg.texi: New subsections on programmatic use of GnuPG,
    ephemeral home directories, and the quick key manipulation interface.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index ab0289d..a7e9204 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3742,10 +3742,56 @@ way to do this.  The options @option{--status-fd} and @option{--batch}
 are almost always required for this.
 
 @menu
+* Programmatic use of GnuPG:: Programmatic use of GnuPG
+* Ephemeral home directories:: Ephemeral home directories
+* The quick key manipulation interface:: The quick key manipulation interface
 * Unattended GPG key generation::  Unattended key generation
 @end menu
 
 
+ at node Programmatic use of GnuPG
+ at subsection Programmatic use of GnuPG
+
+Please consider using GPGME instead of calling @command{@gpgname}
+directly.  GPGME offers a stable, backend-independent interface for
+many cryptographic operations.  It supports OpenPGP and S/MIME, and
+also allows interaction with various GnuPG components.
+
+GPGME provides a C-API, and comes with bindings for C++, Qt, and
+Python.  Bindings for other languages are available.
+
+ at node Ephemeral home directories
+ at subsection Ephemeral home directories
+
+Sometimes you want to contain effects of some operation, for example
+you want to import a key to inspect it, but you do not want this key
+to be added to your keyring.  In earlier versions of GnuPG, it was
+possible to specify alternate keyring files for both public and secret
+keys.  In modern GnuPG versions, however, we changed how secret keys
+are stored in order to better protect secret key material, and it was
+not possible to preserve this interface.
+
+The preferred way to do this is to use ephemeral home directories.
+This technique works across all versions of GnuPG.
+
+Create a temporary directory, create (or copy) a configuration that
+meets your needs, make @command{@gpgname} use this directory either
+using the environment variable @var{GNUPGHOME}, or the option
+ at option{--homedir}.  GPGME supports this too on a per-context basis,
+by modifying the engine info of contexts.  Now execute whatever
+operation you like, import and export key material as necessary.  Once
+finished, you can delete the directory.  All GnuPG backend services
+that were started will detect this and shut down.
+
+ at node The quick key manipulation interface
+ at subsection The quick key manipulation interface
+
+Recent versions of GnuPG have an interface to manipulate keys without
+using the interactive command @option{--edit-key}.  This interface was
+added mainly for the benefit of GPGME (please consider using GPGME,
+see the manual subsection ``Programmatic use of GnuPG'').  This
+interface is described in the subsection ``How to manage your keys''.
+
 @node Unattended GPG key generation
 @subsection Unattended key generation
 

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 91 +++++++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 72 insertions(+), 19 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 14:37:45 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Fri, 16 Dec 2016 14:37:45 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-132-g94f6b90
Message-ID: <E1cHshn-0007vP-Ll@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  94f6b9010d2e80a75ccbb21426faf0b30195f1ab (commit)
      from  ca02a8b78fca8815388a859962584d75169ae3ee (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 94f6b9010d2e80a75ccbb21426faf0b30195f1ab
Author: Neal H. Walfield <neal at g10code.com>
Date:   Fri Dec 16 14:32:27 2016 +0100

    g10: Extend TOFU_STATS to emit <sign-days> and <encyrption-days>
    
    * doc/DETAILS: Add SIGN-DAYS and ENCRYPT-DAYS to the TOFU_STATS status
    line.
    * g10/tofu.c (write_stats_status): Take additional parameters
    signature_days and encryption_days.  Update callers.  Include them in
    the tfs record and TOFU status lines.
    (show_statistics): Compute the number of days on which we saw a
    message signed by FINGERPRINT, and the number of days on which we
    encrypted a message to it.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/doc/DETAILS b/doc/DETAILS
index 534c48c..ab70960 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -722,7 +722,7 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     userid encoded in UTF-8 and percent escaped.  The fingerprint is
     identical for all TOFU_USER lines up to a NEWSIG line.
 
-*** TOFU_STATS <summary> <sign-count> <encryption-count> [<policy> [<tm1> <tm2> <tm3> <tm4> [<validity>]]]
+*** TOFU_STATS <summary> <sign-count> <encryption-count> [<policy> [<tm1> <tm2> <tm3> <tm4> [<validity> [<sign-days> <encrypt-days>]]]]
 
     Statistics for the current user id.
 
@@ -742,7 +742,7 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     - unknown :: Policy is "unknown" (TOFU information does not
                  contribute to the key's validity)
 
-    TM1 ist the time the first message was verified.  TM2 is the time
+    TM1 is the time the first message was verified.  TM2 is the time
     the most recent message was verified.  TM3 is the time the first
     message was encrypted.  TM4 is the most recent encryption. All may
     either be seconds since Epoch or an ISO time string
@@ -753,6 +753,14 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     takes on value 0.  Instead, if there is a conflict, VALIDITY still
     reflects the key's validity (values: 1-4).
 
+    SIGN-COUNT and ENCRYPTION-COUNT are the number of messages that we
+    have seen that have been signed by this key / encryption to this
+    key.
+
+    SIGN-DAYS and ENCRYPTION-DAYS are similar, but the number of days
+    (in UTC) on which we have seen messages signed by this key /
+    encrypted to this key.
+
 *** TOFU_STATS_SHORT <long_string>
 
     Information about the TOFU binding for the signature.
diff --git a/g10/tofu.c b/g10/tofu.c
index c574171..5f92de6 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2875,9 +2875,11 @@ write_stats_status (estream_t fp,
                     unsigned long signature_count,
                     unsigned long signature_first_seen,
                     unsigned long signature_most_recent,
+                    unsigned long signature_days,
                     unsigned long encryption_count,
                     unsigned long encryption_first_done,
-                    unsigned long encryption_most_recent)
+                    unsigned long encryption_most_recent,
+                    unsigned long encryption_days)
 {
   int summary;
   int validity;
@@ -2905,17 +2907,17 @@ write_stats_status (estream_t fp,
 
   if (fp)
     {
-      es_fprintf (fp, "tfs:1:%d:%lu:%lu:%s:%lu:%lu:%lu:%lu:%d:\n",
+      es_fprintf (fp, "tfs:1:%d:%lu:%lu:%s:%lu:%lu:%lu:%lu:%d:%lu:%lu:\n",
                   summary, signature_count, encryption_count,
                   tofu_policy_str (policy),
                   signature_first_seen, signature_most_recent,
                   encryption_first_done, encryption_most_recent,
-                  validity);
+                  validity, signature_days, encryption_days);
     }
   else
     {
       write_status_printf (STATUS_TOFU_STATS,
-                           "%d %lu %lu %s %lu %lu %lu %lu %d",
+                           "%d %lu %lu %s %lu %lu %lu %lu %d %lu %lu",
                            summary,
                            signature_count,
                            encryption_count,
@@ -2924,7 +2926,8 @@ write_stats_status (estream_t fp,
                            signature_most_recent,
                            encryption_first_done,
                            encryption_most_recent,
-                           validity);
+                           validity,
+                           signature_days, encryption_days);
     }
 }
 
@@ -2951,9 +2954,11 @@ show_statistics (tofu_dbs_t dbs,
   unsigned long signature_first_seen = 0;
   unsigned long signature_most_recent = 0;
   unsigned long signature_count = 0;
+  unsigned long signature_days = 0;
   unsigned long encryption_first_done = 0;
   unsigned long encryption_most_recent = 0;
   unsigned long encryption_count = 0;
+  unsigned long encryption_days = 0;
 
   int show_warning = 0;
 
@@ -2978,18 +2983,38 @@ show_statistics (tofu_dbs_t dbs,
       rc = gpg_error (GPG_ERR_GENERAL);
       goto out;
     }
+  rc = gpgsql_exec_printf
+    (dbs->db, strings_collect_cb, &strlist, &err,
+     "select count (*) from\n"
+     "  (select round(signatures.time / (24 * 60 * 60)) day\n"
+     "    from signatures\n"
+     "    left join bindings on signatures.binding = bindings.oid\n"
+     "    where fingerprint = %Q and email = %Q\n"
+     "    group by day);",
+     fingerprint, email);
+  if (rc)
+    {
+      log_error (_("error reading TOFU database: %s\n"), err);
+      print_further_info ("getting signature statistics (by day)");
+      sqlite3_free (err);
+      rc = gpg_error (GPG_ERR_GENERAL);
+      goto out;
+    }
 
   if (strlist)
     {
-      /* We expect exactly 3 elements.  */
+      /* We expect exactly 4 elements.  */
       log_assert (strlist->next);
       log_assert (strlist->next->next);
-      log_assert (! strlist->next->next->next);
+      log_assert (strlist->next->next->next);
+      log_assert (! strlist->next->next->next->next);
 
-      string_to_ulong (&signature_count, strlist->d, -1, __LINE__);
-      string_to_ulong (&signature_first_seen, strlist->next->d, -1, __LINE__);
-      string_to_ulong (&signature_most_recent,
+      string_to_ulong (&signature_days, strlist->d, -1, __LINE__);
+      string_to_ulong (&signature_count, strlist->next->d, -1, __LINE__);
+      string_to_ulong (&signature_first_seen,
                        strlist->next->next->d, -1, __LINE__);
+      string_to_ulong (&signature_most_recent,
+                       strlist->next->next->next->d, -1, __LINE__);
 
       free_strlist (strlist);
       strlist = NULL;
@@ -3011,18 +3036,38 @@ show_statistics (tofu_dbs_t dbs,
       rc = gpg_error (GPG_ERR_GENERAL);
       goto out;
     }
+  rc = gpgsql_exec_printf
+    (dbs->db, strings_collect_cb, &strlist, &err,
+     "select count (*) from\n"
+     "  (select round(encryptions.time / (24 * 60 * 60)) day\n"
+     "    from encryptions\n"
+     "    left join bindings on encryptions.binding = bindings.oid\n"
+     "    where fingerprint = %Q and email = %Q\n"
+     "    group by day);",
+     fingerprint, email);
+  if (rc)
+    {
+      log_error (_("error reading TOFU database: %s\n"), err);
+      print_further_info ("getting encryption statistics (by day)");
+      sqlite3_free (err);
+      rc = gpg_error (GPG_ERR_GENERAL);
+      goto out;
+    }
 
   if (strlist)
     {
-      /* We expect exactly 3 elements.  */
+      /* We expect exactly 4 elements.  */
       log_assert (strlist->next);
       log_assert (strlist->next->next);
-      log_assert (! strlist->next->next->next);
+      log_assert (strlist->next->next->next);
+      log_assert (! strlist->next->next->next->next);
 
-      string_to_ulong (&encryption_count, strlist->d, -1, __LINE__);
-      string_to_ulong (&encryption_first_done, strlist->next->d, -1, __LINE__);
-      string_to_ulong (&encryption_most_recent,
+      string_to_ulong (&encryption_days, strlist->d, -1, __LINE__);
+      string_to_ulong (&encryption_count, strlist->next->d, -1, __LINE__);
+      string_to_ulong (&encryption_first_done,
                        strlist->next->next->d, -1, __LINE__);
+      string_to_ulong (&encryption_most_recent,
+                       strlist->next->next->next->d, -1, __LINE__);
 
       free_strlist (strlist);
       strlist = NULL;
@@ -3036,9 +3081,11 @@ show_statistics (tofu_dbs_t dbs,
                       signature_count,
                       signature_first_seen,
                       signature_most_recent,
+                      signature_days,
                       encryption_count,
                       encryption_first_done,
-                      encryption_most_recent);
+                      encryption_most_recent,
+                      encryption_days);
 
   if (!outfp && !only_status_fd)
     {

-----------------------------------------------------------------------

Summary of changes:
 doc/DETAILS | 12 ++++++++--
 g10/tofu.c  | 79 ++++++++++++++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 73 insertions(+), 18 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 14:51:24 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Fri, 16 Dec 2016 14:51:24 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-133-g4a2c210
Message-ID: <E1cHsv0-00009L-Ob@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4a2c210b75d4266e289712e73a42c286aabb07f0 (commit)
      from  94f6b9010d2e80a75ccbb21426faf0b30195f1ab (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4a2c210b75d4266e289712e73a42c286aabb07f0
Author: Neal H. Walfield <neal at g10code.com>
Date:   Fri Dec 16 14:49:10 2016 +0100

    g10: Use total days, not total messages to compute TOFU validity
    
    * g10/tofu.c (write_stats_status): Use the number of days with
    signatures / encryptions to compute the validity, not the total number
    of signatures / encryptions.
    (BASIC_TRUST_THRESHOLD): Adjust given the new semantics.
    (FULL_TRUST_THRESHOLD): Likewise.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/g10/tofu.c b/g10/tofu.c
index 5f92de6..2bded9e 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -49,12 +49,12 @@
 
 #define CONTROL_L ('L' - 'A' + 1)
 
-/* Number of signed messages required to indicate that enough history
- * is available for basic trust.  */
-#define BASIC_TRUST_THRESHOLD  10
-/* Number of signed messages required to indicate that a lot of
- * history is available.  */
-#define FULL_TRUST_THRESHOLD  100
+/* Number of days with signed / ecnrypted messages required to
+ * indicate that enough history is available for basic trust.  */
+#define BASIC_TRUST_THRESHOLD  4
+/* Number of days with signed / encrypted messages required to
+ * indicate that a lot of history is available.  */
+#define FULL_TRUST_THRESHOLD  21
 
 
 /* A struct with data pertaining to the tofu DB.  There is one such
@@ -2883,19 +2883,19 @@ write_stats_status (estream_t fp,
 {
   int summary;
   int validity;
-  unsigned long messages;
+  unsigned long days;
 
   /* Use the euclidean distance (m = sqrt(a^2 + b^2)) rather then the
      sum of the magnitudes (m = a + b) to ensure a balance between
      verified signatures and encrypted messages.  */
-  messages = sqrtu32 (signature_count * signature_count
-                      + encryption_count * encryption_count);
+  days = sqrtu32 (signature_days * signature_days
+                  + encryption_days * encryption_days);
 
-  if (messages < 1)
+  if (days < 1)
     validity = 1; /* Key without history.  */
-  else if (messages < 2 * BASIC_TRUST_THRESHOLD)
+  else if (days < 2 * BASIC_TRUST_THRESHOLD)
     validity = 2; /* Key with too little history.  */
-  else if (messages < 2 * FULL_TRUST_THRESHOLD)
+  else if (days < 2 * FULL_TRUST_THRESHOLD)
     validity = 3; /* Key with enough history for basic trust.  */
   else
     validity = 4; /* Key with a lot of history.  */

-----------------------------------------------------------------------

Summary of changes:
 g10/tofu.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 14:55:57 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Fri, 16 Dec 2016 14:55:57 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-134-ga165fa0
Message-ID: <E1cHszQ-0000E5-5W@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a165fa09be4bfbeb97ebe25d551a9045255e5028 (commit)
      from  4a2c210b75d4266e289712e73a42c286aabb07f0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a165fa09be4bfbeb97ebe25d551a9045255e5028
Author: Neal H. Walfield <neal at g10code.com>
Date:   Fri Dec 16 14:55:54 2016 +0100

    doc: Fix manual.
    
    * doc/gpg.texi: Remove comment about options being parsed in-order.
    They aren't.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>
    Fixes-commit: 7572d27

diff --git a/doc/gpg.texi b/doc/gpg.texi
index b1e1a2a..e02c5c1 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -117,11 +117,6 @@ perform a reasonable action depending on the type of file it is given
 as input (an encrypted message is decrypted, a signature is verified,
 a file containing keys is listed, etc.).
 
-Please remember that option and command parsing stops as soon as a
-non-option is encountered.  Thus, options must precede the command.
-You can explicitly stop parsing by using the special option
- at option{--}.
-
 
 @menu
 * General GPG Commands::        Commands not specific to the functionality.

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 5 -----
 1 file changed, 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 16:02:56 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 16 Dec 2016 16:02:56 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-136-g12a5265
Message-ID: <E1cHu2F-00044T-8U@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  12a5265afa7f87ad92fb571e0882e57b07a3c267 (commit)
       via  3c7d6a1769ed6cc90d86247a814a0dce341512a3 (commit)
      from  a165fa09be4bfbeb97ebe25d551a9045255e5028 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 12a5265afa7f87ad92fb571e0882e57b07a3c267
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 16 15:58:14 2016 +0100

    doc: Mention extra information in pinentry status lines.
    
    * doc/DETAILS: Mention that 'PINENTRY_LAUNCHED may carry extra
    information.
    
    Fixes-commit: c1ea0b577a468030d2b006317ba27fc1746c4b14
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/DETAILS b/doc/DETAILS
index ab70960..95d5e4f 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -1008,7 +1008,7 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     This may either be the specified mountpoint or one randomly
     chosen by g13.
 
-*** PINENTRY_LAUNCHED <pid>
+*** PINENTRY_LAUNCHED <pid>[:<extra>]
     This status line is emitted by gpg to notify a client that a
     Pinentry has been launched.  <pid> is the PID of the Pinentry.  It
     may be used to display a hint to the user but can't be used to

commit 3c7d6a1769ed6cc90d86247a814a0dce341512a3
Author: Justus Winter <justus at g10code.com>
Date:   Fri Dec 16 15:50:17 2016 +0100

    sm: Fix agent communication.
    
    * sm/call-agent.c (gpgsm_agent_pksign): Fix passing the control handle
    to the callback.
    (gpgsm_scd_pksign): Likewise.
    (gpgsm_agent_reaedkey): Likewise.
    
    GnuPG-bug-id: 2874
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/sm/call-agent.c b/sm/call-agent.c
index 11e6ae7..16a2497 100644
--- a/sm/call-agent.c
+++ b/sm/call-agent.c
@@ -234,6 +234,7 @@ gpgsm_agent_pksign (ctrl_t ctrl, const char *keygrip, const char *desc,
   rc = start_agent (ctrl);
   if (rc)
     return rc;
+  inq_parm.ctrl = ctrl;
   inq_parm.ctx = agent_ctx;
 
   if (digestlen*2 + 50 > DIM(line))
@@ -319,6 +320,7 @@ gpgsm_scd_pksign (ctrl_t ctrl, const char *keyid, const char *desc,
   rc = start_agent (ctrl);
   if (rc)
     return rc;
+  inq_parm.ctrl = ctrl;
   inq_parm.ctx = agent_ctx;
 
   if (digestlen*2 + 50 > DIM(line))
@@ -583,6 +585,7 @@ gpgsm_agent_readkey (ctrl_t ctrl, int fromcard, const char *hexkeygrip,
   rc = start_agent (ctrl);
   if (rc)
     return rc;
+  inq_parm.ctrl = ctrl;
   inq_parm.ctx = agent_ctx;
 
   rc = assuan_transact (agent_ctx, "RESET",NULL, NULL, NULL, NULL, NULL, NULL);

-----------------------------------------------------------------------

Summary of changes:
 doc/DETAILS     | 2 +-
 sm/call-agent.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 16:03:48 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 16 Dec 2016 16:03:48 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-229-g66ab616
Message-ID: <E1cHu34-00046o-1W@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  66ab61651831db028131a9b5dba3be3b0c0aec71 (commit)
       via  ee7e740a20b5c2d0e9dbaff06821e83fb60d7de1 (commit)
       via  439406a258c1d0c46c6517a011f5f46e2b185179 (commit)
      from  829c65658073aabc75c56442b85fe78296df6f9c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66ab61651831db028131a9b5dba3be3b0c0aec71
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 16:01:28 2016 +0100

    Handle button click for encrypted only mails
    
    * src/ribbon-callbacks.cpp (launch_cert_details): Handle
    the case were a mail is unsigned.

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 382fa2d..3817184 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1609,6 +1609,27 @@ HRESULT launch_cert_details (LPDISPATCH ctrl)
       return S_OK;
     }
 
+  if (!mail->is_signed () && mail->is_encrypted ())
+    {
+      /* Encrypt only, no information but show something. because
+         we want the button to be active.
+
+         Aheinecke: I don't think we should show to which keys the message
+         is encrypted here. This would confuse users if they see keyids
+         of unknown keys and the information can't be "true" because the
+         sender could have sent the same information to other people or
+         used throw keyids etc.
+         */
+      char * buf;
+      gpgrt_asprintf (&buf, _("The message was not cryptographically signed.\n"
+                      "There is no additional information available if it "
+                      "was actually sent by '%s' or if someone faked the sender address."), mail->get_sender ().c_str());
+      MessageBox (NULL, buf, _("GpgOL"),
+                  MB_ICONINFORMATION|MB_OK);
+      xfree (buf);
+      return S_OK;
+    }
+
   char *uiserver = get_uiserver_name ();
   bool showError = false;
   if (uiserver)

commit ee7e740a20b5c2d0e9dbaff06821e83fb60d7de1
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 15:58:20 2016 +0100

    Use signed and encrypted again in tooltip
    
    * src/ribbon-callbacks.cpp (get_sig_ttip): Use signed
    and encrypted again.
    
    --
    This makes it more transparent and obvious for our existing
    users what the new UI language means by secure, signed but
    not secure etc.

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 079779f..382fa2d 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1554,10 +1554,18 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
   wchar_t *w_result;
   if (mail && (mail->is_signed () || mail->is_encrypted ()))
     {
-      char *buf;
-      gpgrt_asprintf (&buf, _("%s message"), mail->get_crypto_summary ().c_str());
-      w_result = utf8_to_wchar (buf);
-      xfree(buf);
+      if (mail->is_signed () && mail->is_encrypted ())
+        {
+          w_result = utf8_to_wchar (_("Signed and encrypted message"));
+        }
+      else if (mail->is_signed ())
+        {
+          w_result = utf8_to_wchar (_("Signed message"));
+        }
+      else if (mail->is_encrypted ())
+        {
+          w_result = utf8_to_wchar (_("Encrypted message"));
+        }
     }
   else
     {

commit 439406a258c1d0c46c6517a011f5f46e2b185179
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 15:53:28 2016 +0100

    Implement direct trust handling
    
    * src/mail.cpp (level_4_check): Do the actual check for direct
    trust.
    (Mail::get_crypto_details): Handle level 4 subcases with different
    details.
    * src/parsecontroller.cpp (ParseController::parse): Fetch
    ultimately trusted keys if a sig was fully or ultimately valid.
    (ParseController::get_ultimate_keys): New Helper function
    to cache the ultimately valid keys.
    * src/parsecontroller.h: Update accordingly.

diff --git a/src/mail.cpp b/src/mail.cpp
index 42222f6..feb0ca4 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1388,28 +1388,81 @@ Mail::set_uuid()
   return 0;
 }
 
-/* Returns -1 if the mail was signed by a uid with ownertrust
-   ultimate and to which we have the secret key.
-   This basically means "mail was signed by yourself"
+/* Returns 1 if the userid is ultimately trusted.
 
-   Returns the number of the signature fromt the uid that belongs
-   made it ultimately or fully trusted if the mail was signed by some
-   ultimate key for which we don't have the secret key.
-   This is direct trust or CA Style PGP.
+   Returns 1 if the userid is fully trusted but has
+   a signature by a key for which we have a secret
+   and which is ultimately trusted. (Direct trust)
 
    0 otherwise */
 static int
 level_4_check (const UserID &uid)
 {
-  if (uid.validity() == UserID::Validity::Ultimate)
+  if (uid.isNull())
     {
-      /* TODO look for the signature that caused this
-         to be ultimate. And check if it is our own. */
-      return -1;
+      return 0;
     }
-  else if (uid.validity() == UserID::Validity::Full)
+  if (uid.validity () == UserID::Validity::Ultimate)
     {
-      return 1;
+      return 2;
+    }
+  if (uid.validity () == UserID::Validity::Full)
+    {
+      for (const auto sig: uid.signatures ())
+        {
+          const char *sigID = sig.signerKeyID ();
+          if (sig.isNull() || !sigID)
+            {
+              /* should not happen */
+              TRACEPOINT;
+              continue;
+            }
+          /* Direct trust information is not available
+             through gnupg so we cached the keys with ultimate
+             trust during parsing and now see if we find a direct
+             trust path.*/
+          for (const auto secKey: ParseController::get_ultimate_keys ())
+            {
+              /* Check that the Key id of the key matches */
+              const char *secKeyID = secKey.keyID ();
+              if (!secKeyID || strcmp (secKeyID, sigID))
+                {
+                  continue;
+                }
+              /* Check that the userID of the signature is the ultimately
+                 trusted one. */
+              const char *signed_uid_str = uid.id ();
+              if (!signed_uid_str)
+                {
+                  /* should not happen */
+                  TRACEPOINT;
+                  continue;
+                }
+              for (const auto signer_uid: secKey.userIDs ())
+                {
+                  if (signer_uid.validity() != UserID::Validity::Ultimate)
+                    {
+                      continue;
+                    }
+                  const char *signer_uid_str = uid.id ();
+                  if (!signer_uid_str)
+                    {
+                      /* should not happen */
+                      TRACEPOINT;
+                      continue;
+                    }
+                  if (!strcmp(signer_uid_str, signed_uid_str))
+                    {
+                      /* We have a match */
+                      log_debug ("%s:%s: classified %s as ultimate because "
+                                 "it was signed by uid %s of key %s",
+                                 SRCNAME, __func__, signed_uid_str, signer_uid_str,
+                                 secKeyID);
+                      return 1;
+                    }
+                }
+            }
+        }
     }
   return 0;
 }
@@ -1484,17 +1537,16 @@ Mail::get_crypto_details()
       /* level 4 check for direct trust */
       int four_check = level_4_check (m_uid);
 
-      if (four_check == -1)
+      if (four_check == 1 && m_sig.key().hasSecret ())
         {
           message = _("You signed this message.");
         }
-      else if (four_check >= 0)
+      else if (four_check == 1)
+        {
+          message = _("The sender is allowed to manage your mail trust.");
+        }
+      else if (four_check == 2)
         {
-          /* TODO
-            And you certified the identity of the sender.
-            And <uid with ultimate trust> certified the identity
-            of the sender.
-          */
           message = _("The senders identity was certified by yourself.");
         }
       else
diff --git a/src/parsecontroller.cpp b/src/parsecontroller.cpp
index 2752fad..60e03a7 100644
--- a/src/parsecontroller.cpp
+++ b/src/parsecontroller.cpp
@@ -320,6 +320,13 @@ ParseController::parse()
   for (const auto sig: m_verify_result.signatures())
     {
       sig.key(true, true);
+      if (sig.validity() == Signature::Validity::Full ||
+          sig.validity() == Signature::Validity::Ultimate)
+        {
+          /* Ensure that we have the keys with ultimate
+             trust cached for the ui. */
+          get_ultimate_keys ();
+        }
     }
 
   if (opt.enable_debug)
@@ -401,3 +408,63 @@ ParseController::get_attachments() const
       return std::vector<std::shared_ptr<Attachment> >();
     }
 }
+
+GPGRT_LOCK_DEFINE(keylist_lock);
+/* static */
+std::vector<Key>
+ParseController::get_ultimate_keys()
+{
+  static bool s_keys_listed;
+  static std::vector<Key> s_ultimate_keys;
+  gpgrt_lock_lock (&keylist_lock);
+  if (s_keys_listed)
+    {
+      gpgrt_lock_unlock (&keylist_lock);
+      return s_ultimate_keys;
+    }
+  log_debug ("%s:%s: Starting keylisting.",
+             SRCNAME, __func__);
+  auto ctx = Context::createForProtocol (OpenPGP);
+  if (!ctx)
+    {
+      /* Maybe PGP broken and not S/MIME */
+      log_error ("%s:%s: broken installation no ctx.",
+                 SRCNAME, __func__);
+      gpgrt_lock_unlock (&keylist_lock);
+      return s_ultimate_keys;
+    }
+  ctx->setKeyListMode (KeyListMode::Local);
+  Error err;
+  if ((err = ctx->startKeyListing ()))
+    {
+      log_error ("%s:%s: Failed to start keylisting err: %i: %s",
+                 SRCNAME, __func__, err.code (), err.asString());
+      delete ctx;
+      gpgrt_lock_unlock (&keylist_lock);
+      return s_ultimate_keys;
+    }
+  while (!err)
+    {
+      const auto key = ctx->nextKey(err);
+      if (key.isNull() || err)
+        {
+          break;
+        }
+      for (const auto uid: key.userIDs())
+        {
+          if (uid.validity() == UserID::Validity::Ultimate)
+            {
+              s_ultimate_keys.push_back (key);
+              log_debug ("adding ultimate uid: %s", uid.id());
+              break;
+            }
+        }
+    }
+  delete ctx;
+  log_debug ("%s:%s: keylisting done.",
+             SRCNAME, __func__);
+
+  s_keys_listed = true;
+  gpgrt_lock_unlock (&keylist_lock);
+  return s_ultimate_keys;
+}
diff --git a/src/parsecontroller.h b/src/parsecontroller.h
index 19d622f..ec45982 100644
--- a/src/parsecontroller.h
+++ b/src/parsecontroller.h
@@ -61,6 +61,13 @@ public:
 
   ~ParseController();
 
+  /* Get a list of ultimately keys where at least one
+     userid has ultimate trust. This list
+     will be initialized only once when the first signature
+     is validity full or ultimate is encountered. */
+  static std::vector<GpgME::Key> get_ultimate_keys();
+
+
   /** Main entry point. After execution getters will become
   valid. */
   void parse();

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp             | 92 +++++++++++++++++++++++++++++++++++++-----------
 src/parsecontroller.cpp  | 67 +++++++++++++++++++++++++++++++++++
 src/parsecontroller.h    |  7 ++++
 src/ribbon-callbacks.cpp | 37 ++++++++++++++++---
 4 files changed, 179 insertions(+), 24 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 16:08:01 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 16:08:01 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-139-g48671f2
Message-ID: <E1cHu7A-0004CK-9I@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  48671f295ff233765689b6a73021f83ab845a28f (commit)
       via  76cd64a5baf6057b199c01f7999b327f1f4a87bc (commit)
       via  6ca3c28da46873416822bf6ab7893db6c56a49d6 (commit)
      from  12a5265afa7f87ad92fb571e0882e57b07a3c267 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 48671f295ff233765689b6a73021f83ab845a28f
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 16:02:02 2016 +0100

    gpg,sm: A few more option for --gpgconf-list.
    
    * g10/gpg.c (gpgconf_list): Add --compliance and
    --default-new-key-algo.
    (parse_compliance_option):
    * sm/gpgsm.c (main) <gpgconf-list>: Add --enable-crl-checks.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/gpg.c b/g10/gpg.c
index cab5d53..a8f731b 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -1844,6 +1844,8 @@ gpgconf_list (const char *configfile)
   es_printf ("log-file:%lu:\n", GC_OPT_FLAG_NONE);
   es_printf ("debug-level:%lu:\"none:\n", GC_OPT_FLAG_DEFAULT);
   es_printf ("group:%lu:\n", GC_OPT_FLAG_NONE);
+  es_printf ("compliance:%lu:\"%s:\n", GC_OPT_FLAG_DEFAULT, "gnupg");
+  es_printf ("default-new-key-algo:%lu:\n", GC_OPT_FLAG_NONE);
 
   /* The next one is an info only item and should match the macros at
      the top of keygen.c  */
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index 79508e6..e0ad3e3 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -1719,6 +1719,7 @@ main ( int argc, char **argv)
 	es_printf ("debug-level:%lu:\"none:\n", GC_OPT_FLAG_DEFAULT);
 	es_printf ("log-file:%lu:\n", GC_OPT_FLAG_NONE);
         es_printf ("disable-crl-checks:%lu:\n", GC_OPT_FLAG_NONE);
+        es_printf ("enable-crl-checks:%lu:\n", GC_OPT_FLAG_NONE);
         es_printf ("disable-trusted-cert-crl-check:%lu:\n", GC_OPT_FLAG_NONE);
         es_printf ("enable-ocsp:%lu:\n", GC_OPT_FLAG_NONE);
         es_printf ("include-certs:%lu:%d:\n", GC_OPT_FLAG_DEFAULT,

commit 76cd64a5baf6057b199c01f7999b327f1f4a87bc
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 16:00:15 2016 +0100

    gpgconf: New command --apply-profile.
    
    * tools/gpgconf.c (aApplyProfile): New.
    (opts): New command --apply-profile.
    (main): Implement that command.
    * tools/gpgconf-comp.c (option_check_validity): Add arg VERBATIM.
    (change_options_program): Ditto.
    (change_one_value): Ditto.
    (gc_component_change_options): Ditto.
    (gc_apply_profile): New.
    
    --
    
    Here is an example for a profile
    
    --8<---------------cut here---------------start------------->8---
    # foo.prf - Sample profile
    
    [gpg]
    compliance de-vs
    default-new-key-algo brainpoolP256r1+brainpoolP256r1
    
    [gpgsm]
    enable-crl-checks
    
    [gpg-agent]
    default-cache-ttl 900
    max-cache-ttl [] 3600
    no-allow-mark-trusted
    no-allow-external-cache
    enforce-passphrase-constraints
    min-passphrase-len 9
    min-passphrase-nonalpha 0
    
    [dirmngr]
    keyserver hkp://keys.gnupg.net
    allow-ocsp
    --8<---------------cut here---------------end--------------->8---
    
    Note that flags inside of brackets are allowed after the option name.
    The only defined flag for now is "[default]".  In case the value
    starts with a bracket, it is possible to insert "[]" as a nop-flag.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 5638530..0c2f2c9 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -40,6 +40,8 @@ helpfiles = help.txt help.be.txt help.ca.txt help.cs.txt		\
             help.pt_BR.txt help.ro.txt help.ru.txt help.sk.txt		\
             help.sv.txt help.tr.txt help.zh_CN.txt help.zh_TW.txt
 
+profiles =
+
 EXTRA_DIST = samplekeys.asc mksamplekeys com-certs.pem qualified.txt \
 	     gnupg-logo.eps gnupg-logo.pdf gnupg-logo.png gnupg-logo-tr.png \
 	     gnupg-module-overview.png gnupg-module-overview.pdf \
@@ -54,7 +56,7 @@ BUILT_SOURCES = gnupg-module-overview.png gnupg-module-overview.pdf \
 
 info_TEXINFOS = gnupg.texi
 
-dist_pkgdata_DATA =  $(helpfiles)
+dist_pkgdata_DATA =  $(helpfiles) $(profiles)
 
 nobase_dist_doc_DATA = FAQ DETAILS HACKING DCO TRANSLATE OpenPGP KEYSERVER \
                        $(examples)
diff --git a/doc/examples/gpgconf.conf b/doc/examples/gpgconf.conf
index ec8685a..f401602 100644
--- a/doc/examples/gpgconf.conf
+++ b/doc/examples/gpgconf.conf
@@ -8,7 +8,7 @@
 # Empty lines and comment lines, indicated by a hash mark as first non
 # white space character, are ignored.  The line is separated by white
 # space into fields. The first field is used to match the user or
-# group and must start at the first column, the file is processes
+# group and must start at the first column, the file is processed
 # sequential until a matching rule is found.  A rule may contain
 # several lines; continuation lines are indicated by a indenting them.
 #
@@ -23,7 +23,7 @@
 #   *           - Matches any user.
 # All other variants are not defined and reserved for future use.
 #
-# <component> and <option> are as specified by gpgconf. 
+# <component> and <option> are as specified by gpgconf.
 # <flag> may be one of:
 #   default     - Delete the option so that the default is used.
 #   no-change   - Mark the field as non changeable by gpgconf.
@@ -35,7 +35,7 @@
 #         gpg-agent min-passphrase-len 6
 #
 # *       gpg-agent min-passphrase-len [no-change] 8
-#         gpg-agent min-passphrase-nonalpha [no-change] 1 
+#         gpg-agent min-passphrase-nonalpha [no-change] 1
 #         gpg-agent max-passphrase-days [no-change] 700
 #         gpg-agent enable-passphrase-history [no-change]
 #         gpg-agent enforce-passphrase-constraints [default]
@@ -44,7 +44,7 @@
 #         gpg-agent max-cache-ttl-ssh [no-change] 10800
 #         gpg-agent allow-mark-trusted [default]
 #         gpg-agent allow-mark-trusted [no-change]
-#         gpgsm     enable-ocsp           
+#         gpgsm     enable-ocsp
 #===========
 # All users in the group "staff" are allowed to change the value for
 # --allow-mark-trusted; gpgconf's default is not to allow a change
diff --git a/doc/tools.texi b/doc/tools.texi
index b1ed615..d321b69 100644
--- a/doc/tools.texi
+++ b/doc/tools.texi
@@ -279,6 +279,15 @@ Change the options of the component @var{component}.
 @item --check-options @var{component}
 Check the options for the component @var{component}.
 
+ at item --apply-profile @var{file}
+Apply the configuration settings listed in @var{file} to the
+configuration files.  If @var{file} has no suffix and no slashes the
+command first tries to read a file with the suffix @code{.prf} from
+the the data directory (@code{gpgconf --list-dirs datadir}) before it
+reads the file verbatim.  A profile is divided into sections using the
+bracketed  component name.  Each section then lists the option which
+shall go into the respective configuration file.
+
 @item --apply-defaults
 Update all configuration files with values taken from the global
 configuration file (usually @file{/etc/gnupg/gpgconf.conf}).
diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 3fddc7c..e45857d 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -1,6 +1,6 @@
 /* gpgconf-comp.c - Configuration utility for GnuPG.
- * Copyright (C) 2004, 2007, 2008, 2009, 2010,
- *               2011 Free Software Foundation, Inc.
+ * Copyright (C) 2004, 2007-2011 Free Software Foundation, Inc.
+ * Copyright (C) 2016 Werner Koch
  *
  * This file is part of GnuPG.
  *
@@ -703,9 +703,15 @@ static gc_option_t gc_options_gpg[] =
    { "group", GC_OPT_FLAG_LIST, GC_LEVEL_ADVANCED,
      "gnupg", N_("|SPEC|set up email aliases"),
      GC_ARG_TYPE_ALIAS_LIST, GC_BACKEND_GPG },
-   { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
-     "gnupg", "|FILE|read options from FILE",
+   { "options", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
      GC_ARG_TYPE_FILENAME, GC_BACKEND_GPG },
+   { "compliance", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
+     GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
+   { "default-new-key-algo", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
+     GC_ARG_TYPE_STRING, GC_BACKEND_GPG },
    { "default_pubkey_algo",
      (GC_OPT_FLAG_ARG_OPT|GC_OPT_FLAG_NO_CHANGE), GC_LEVEL_INVISIBLE,
      NULL, NULL,
@@ -816,6 +822,9 @@ static gc_option_t gc_options_gpgsm[] =
    { "disable-crl-checks", GC_OPT_FLAG_NONE, GC_LEVEL_BASIC,
      "gnupg", "never consult a CRL",
      GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
+   { "enable-crl-checks", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
+     GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
    { "disable-trusted-cert-crl-check", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
      "gnupg", N_("do not check CRLs for root certificates"),
      GC_ARG_TYPE_NONE, GC_BACKEND_GPGSM },
@@ -2333,11 +2342,13 @@ gc_component_retrieve_options (int component)
 
 

 /* Perform a simple validity check based on the type.  Return in
-   NEW_VALUE_NR the value of the number in NEW_VALUE if OPTION is of
-   type GC_ARG_TYPE_NONE.  */
+ * NEW_VALUE_NR the value of the number in NEW_VALUE if OPTION is of
+ * type GC_ARG_TYPE_NONE.  If VERBATIM is set the profile parsing mode
+ * is used. */
 static void
 option_check_validity (gc_option_t *option, unsigned long flags,
-		       char *new_value, unsigned long *new_value_nr)
+		       char *new_value, unsigned long *new_value_nr,
+                       int verbatim)
 {
   char *arg;
 
@@ -2391,17 +2402,17 @@ option_check_validity (gc_option_t *option, unsigned long flags,
   arg = new_value;
   do
     {
-      if (*arg == '\0' || *arg == ',')
+      if (*arg == '\0' || (*arg == ',' && !verbatim))
 	{
 	  if (!(option->flags & GC_OPT_FLAG_ARG_OPT))
 	    gc_error (1, 0, "argument required for option %s", option->name);
 
-	  if (*arg == ',' && !(option->flags & GC_OPT_FLAG_LIST))
+	  if (*arg == ',' && !verbatim && !(option->flags & GC_OPT_FLAG_LIST))
 	    gc_error (1, 0, "list found for non-list option %s", option->name);
 	}
       else if (gc_arg_type[option->arg_type].fallback == GC_ARG_TYPE_STRING)
 	{
-	  if (*arg != '"')
+	  if (*arg != '"' && !verbatim)
 	    gc_error (1, 0, "string argument for option %s must begin "
 		      "with a quote (\") character", option->name);
 
@@ -2409,7 +2420,7 @@ option_check_validity (gc_option_t *option, unsigned long flags,
 	     we do not quote arguments in configuration files, and
 	     thus no argument is indistinguishable from the empty
 	     string.  */
-	  if (arg[1] == '\0' || arg[1] == ',')
+	  if (arg[1] == '\0' || (arg[1] == ',' && !verbatim))
 	    gc_error (1, 0, "empty string argument for option %s is "
 		      "currently not allowed.  Please report this!",
 		      option->name);
@@ -2426,7 +2437,7 @@ option_check_validity (gc_option_t *option, unsigned long flags,
 	    gc_error (1, errno, "invalid argument for option %s",
 		      option->name);
 
-	  if (*arg != '\0' && *arg != ',')
+	  if (*arg != '\0' && (*arg != ',' || verbatim))
 	    gc_error (1, 0, "garbage after argument for option %s",
 		      option->name);
 	}
@@ -2442,17 +2453,18 @@ option_check_validity (gc_option_t *option, unsigned long flags,
 	    gc_error (1, errno, "invalid argument for option %s",
 		      option->name);
 
-	  if (*arg != '\0' && *arg != ',')
+	  if (*arg != '\0' && (*arg != ',' || verbatim))
 	    gc_error (1, 0, "garbage after argument for option %s",
 		      option->name);
 	}
-      arg = strchr (arg, ',');
+      arg = verbatim? strchr (arg, ',') : NULL;
       if (arg)
 	arg++;
     }
   while (arg && *arg);
 }
 
+
 #ifdef HAVE_W32_SYSTEM
 int
 copy_file (const char *src_name, const char *dst_name)
@@ -2816,11 +2828,13 @@ change_options_file (gc_component_t component, gc_backend_t backend,
 
 
 /* Create and verify the new configuration file for the specified
-   backend and component.  Returns 0 on success and -1 on error.  */
+ * backend and component.  Returns 0 on success and -1 on error.  If
+ * VERBATIM is set the profile mode is used. */
 static int
 change_options_program (gc_component_t component, gc_backend_t backend,
 			char **src_filenamep, char **dest_filenamep,
-			char **orig_filenamep)
+			char **orig_filenamep,
+                        int verbatim)
 {
   static const char marker[] = "###+++--- " GPGCONF_DISP_NAME " ---+++###";
   /* True if we are within the marker in the config file.  */
@@ -3008,15 +3022,20 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 		{
 		  char *end;
 
-		  assert (*arg == '"');
-		  arg++;
+                  if (!verbatim)
+                    {
+                      log_assert (*arg == '"');
+                      arg++;
 
-		  end = strchr (arg, ',');
-		  if (end)
-		    *end = '\0';
+                      end = strchr (arg, ',');
+                      if (end)
+                        *end = '\0';
+                    }
+                  else
+                    end = NULL;
 
 		  fprintf (src_file, "%s %s\n", option->name,
-			   percent_deescape (arg));
+			   verbatim? arg : percent_deescape (arg));
 		  if (ferror (src_file))
 		    goto change_one_err;
 
@@ -3117,14 +3136,15 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 
 
 /* Common code for gc_component_change_options and
-   gc_process_gpgconf_conf.  */
+ * gc_process_gpgconf_conf.  If VERBATIM is set the profile parsing
+ * mode is used.  */
 static void
 change_one_value (gc_option_t *option, int *runtime,
-                  unsigned long flags, char *new_value)
+                  unsigned long flags, char *new_value, int verbatim)
 {
   unsigned long new_value_nr = 0;
 
-  option_check_validity (option, flags, new_value, &new_value_nr);
+  option_check_validity (option, flags, new_value, &new_value_nr, verbatim);
 
   if (option->flags & GC_OPT_FLAG_RUNTIME)
     runtime[option->backend] = 1;
@@ -3158,9 +3178,10 @@ change_one_value (gc_option_t *option, int *runtime,
 
 /* Read the modifications from IN and apply them.  If IN is NULL the
    modifications are expected to already have been set to the global
-   table. */
+   table.  If VERBATIM is set the profile mode is used.  */
 void
-gc_component_change_options (int component, estream_t in, estream_t out)
+gc_component_change_options (int component, estream_t in, estream_t out,
+                             int verbatim)
 {
   int err = 0;
   int runtime[GC_BACKEND_NR];
@@ -3247,7 +3268,7 @@ gc_component_change_options (int component, estream_t in, estream_t out)
               continue;
             }
 
-          change_one_value (option, runtime, flags, new_value);
+          change_one_value (option, runtime, flags, new_value, 0);
         }
     }
 
@@ -3271,7 +3292,8 @@ gc_component_change_options (int component, estream_t in, estream_t out)
 	  err = change_options_program (component, option->backend,
 					&src_filename[option->backend],
 					&dest_filename[option->backend],
-					&orig_filename[option->backend]);
+					&orig_filename[option->backend],
+                                        verbatim);
 	  if (! err)
 	    {
 	      /* External verification.  */
@@ -3789,7 +3811,7 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
                   xfree (option_info->new_value);
                   option_info->new_value = NULL;
                 }
-              change_one_value (option_info, runtime, newflags, value);
+              change_one_value (option_info, runtime, newflags, value, 0);
             }
         }
     }
@@ -3814,7 +3836,7 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
 
       for (component_id = 0; component_id < GC_COMPONENT_NR; component_id++)
         {
-          gc_component_change_options (component_id, NULL, NULL);
+          gc_component_change_options (component_id, NULL, NULL, 0);
         }
       opt.runtime = save_opt_runtime;
 
@@ -3829,3 +3851,210 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
   xfree (fname);
   return result;
 }
+
+
+/*
+ * Apply the profile FNAME to all known configure files.
+ */
+gpg_error_t
+gc_apply_profile (const char *fname)
+{
+  gpg_error_t err;
+  char *fname_buffer = NULL;
+  char *line = NULL;
+  size_t line_len = 0;
+  ssize_t length;
+  estream_t fp;
+  int lineno = 0;
+  int runtime[GC_BACKEND_NR];
+  int backend_id;
+  int component_id = -1;
+  int skip_section = 0;
+  int error_count = 0;
+  int newflags;
+
+  if (!fname)
+    fname = "-";
+
+  for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
+    runtime[backend_id] = 0;
+
+
+  if (!(!strcmp (fname, "-")
+        || strchr (fname, '/')
+#ifdef HAVE_W32_SYSTEM
+        || strchr (fname, '\\')
+#endif
+        || strchr (fname, '.')))
+    {
+      /* FNAME looks like a standard profile name.  Check whether one
+       * is installed and use that instead of the given file name.  */
+      fname_buffer = xstrconcat (gnupg_datadir (), DIRSEP_S,
+                                 fname, ".prf", NULL);
+      if (!access (fname_buffer, F_OK))
+        fname = fname_buffer;
+    }
+
+  fp = !strcmp (fname, "-")? es_stdin : es_fopen (fname, "r");
+  if (!fp)
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("can't open '%s': %s\n", fname, gpg_strerror (err));
+      return err;
+    }
+
+  if (opt.verbose)
+    log_info ("applying profile '%s'\n", fname);
+
+  err = 0;
+  while ((length = es_read_line (fp, &line, &line_len, NULL)) > 0)
+    {
+      char *name, *flags, *value;
+      gc_option_t *option_info = NULL;
+      char *p;
+
+      lineno++;
+      name = line;
+      while (*name == ' ' || *name == '\t')
+        name++;
+      if (!*name || *name == '#' || *name == '\r' || *name == '\n')
+        continue;
+      trim_trailing_spaces (name);
+
+      /* Check whether this is a new section.  */
+      if (*name == '[')
+        {
+          name++;
+          skip_section = 0;
+          /* New section: Get the name of the component.  */
+          p = strchr (name, ']');
+          if (!p)
+            {
+              error_count++;
+              log_info ("%s:%d:%d: error: syntax error in section tag\n",
+                        fname, lineno, (int)(name - line));
+              skip_section = 1;
+              continue;
+            }
+          *p++ = 0;
+          if (*p)
+            log_info ("%s:%d:%d: warning: garbage after section tag\n",
+                      fname, lineno, (int)(p - line));
+
+          trim_spaces (name);
+          component_id = gc_component_find (name);
+          if (component_id < 0)
+            {
+              log_info ("%s:%d:%d: warning: skipping unknown section '%s'\n",
+                        fname, lineno, (int)(name - line), name );
+              skip_section = 1;
+            }
+          continue;
+        }
+
+      if (skip_section)
+        continue;
+      if (component_id < 0)
+        {
+          error_count++;
+          log_info ("%s:%d:%d: error: not in a valid section\n",
+                    fname, lineno, (int)(name - line));
+          skip_section = 1;
+          continue;
+        }
+
+      /* Parse the option name.  */
+      for (p = name; *p && !spacep (p); p++)
+        ;
+      *p++ = 0;
+      value = p;
+
+      option_info = find_option (component_id, name, GC_BACKEND_ANY);
+      if (!option_info)
+        {
+          error_count++;
+          log_info ("%s:%d:%d: error: unknown option '%s' in section '%s'\n",
+                    fname, lineno, (int)(name - line),
+                    name, gc_component[component_id].name);
+          continue;
+        }
+
+      /* Parse the optional flags. */
+      trim_spaces (value);
+      flags = value;
+      if (*flags == '[')
+        {
+          flags++;
+          p = strchr (flags, ']');
+          if (!p)
+            {
+              log_info ("%s:%d:%d: warning: invalid flag specification\n",
+                        fname, lineno, (int)(p - line));
+              continue;
+            }
+          *p++ = 0;
+          value = p;
+          trim_spaces (value);
+        }
+      else /* No flags given.  */
+        flags = NULL;
+
+      /* Set required defaults.  */
+      if (gc_arg_type[option_info->arg_type].fallback == GC_ARG_TYPE_NONE
+          && !*value)
+        value = "1";
+
+      /* Check and save this option.  */
+      newflags = 0;
+      if (flags && !strcmp (flags, "default"))
+        newflags |= GC_OPT_FLAG_DEFAULT;
+
+      if (newflags)
+        option_info->new_flags = 0;
+      if (*value)
+        {
+          xfree (option_info->new_value);
+          option_info->new_value = NULL;
+        }
+      change_one_value (option_info, runtime, newflags, value, 1);
+    }
+
+  if (length < 0 || es_ferror (fp))
+    {
+      err = gpg_error_from_syserror ();
+      error_count++;
+      log_error (_("%s:%u: read error: %s\n"),
+                 fname, lineno, gpg_strerror (err));
+    }
+  if (es_fclose (fp))
+    log_error (_("error closing '%s'\n"), fname);
+  if (error_count)
+    log_error (_("error parsing '%s'\n"), fname);
+
+  xfree (line);
+
+  /* If it all worked, process the options. */
+  if (!err)
+    {
+      /* We need to switch off the runtime update, so that we can do
+         it later all at once. */
+      int save_opt_runtime = opt.runtime;
+      opt.runtime = 0;
+
+      for (component_id = 0; component_id < GC_COMPONENT_NR; component_id++)
+        {
+          gc_component_change_options (component_id, NULL, NULL, 1);
+        }
+      opt.runtime = save_opt_runtime;
+
+      if (opt.runtime)
+        {
+          for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
+            if (runtime[backend_id] && gc_backend[backend_id].runtime_change)
+              (*gc_backend[backend_id].runtime_change) (0);
+        }
+    }
+
+  xfree (fname_buffer);
+  return err;
+}
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index d056f4f..af65424 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -60,6 +60,7 @@ enum cmd_and_opt_values
     aKill,
     aCreateSocketDir,
     aRemoveSocketDir,
+    aApplyProfile,
     aReload
   };
 
@@ -76,6 +77,8 @@ static ARGPARSE_OPTS opts[] =
     { aCheckOptions, "check-options", 256, N_("|COMPONENT|check options") },
     { aApplyDefaults, "apply-defaults", 256,
       N_("apply global default values") },
+    { aApplyProfile, "apply-profile", 256,
+      N_("|FILE|update configuration files using FILE") },
     { aListDirs, "list-dirs", 256,
       N_("get the configuration directories for @GPGCONF@") },
     { aListConfig,   "list-config", 256,
@@ -495,6 +498,7 @@ main (int argc, char **argv)
         case aChangeOptions:
         case aCheckOptions:
         case aApplyDefaults:
+        case aApplyProfile:
         case aListConfig:
         case aCheckConfig:
         case aQuerySWDB:
@@ -568,7 +572,8 @@ main (int argc, char **argv)
               if (cmd == aListOptions)
                 gc_component_list_options (idx, get_outfp (&outfp));
               else if (cmd == aChangeOptions)
-                gc_component_change_options (idx, es_stdin, get_outfp (&outfp));
+                gc_component_change_options (idx, es_stdin,
+                                             get_outfp (&outfp), 0);
             }
 	}
       break;
@@ -659,6 +664,12 @@ main (int argc, char **argv)
         exit (1);
       break;
 
+    case aApplyProfile:
+      gc_component_retrieve_options (-1);
+      if (gc_apply_profile (fname))
+        exit (1);
+      break;
+
     case aListDirs:
       /* Show the system configuration directories for gpgconf.  */
       get_outfp (&outfp);
diff --git a/tools/gpgconf.h b/tools/gpgconf.h
index e99042f..39d34b6 100644
--- a/tools/gpgconf.h
+++ b/tools/gpgconf.h
@@ -72,7 +72,8 @@ void gc_component_retrieve_options (int component);
 void gc_component_list_options (int component, estream_t out);
 
 /* Read the modifications from IN and apply them.  */
-void gc_component_change_options (int component, estream_t in, estream_t out);
+void gc_component_change_options (int component, estream_t in, estream_t out,
+                                  int verbatim);
 
 /* Check the options of a single component.  Returns 0 if everything
    is OK.  */
@@ -83,5 +84,8 @@ int gc_component_check_options (int component, estream_t out,
 int gc_process_gpgconf_conf (const char *fname, int update, int defaults,
                              estream_t listfp);
 
+/* Apply a profile.  */
+gpg_error_t gc_apply_profile (const char *fname);
+
 
 #endif /*GPGCONF_H*/

commit 6ca3c28da46873416822bf6ab7893db6c56a49d6
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 14:25:47 2016 +0100

    gpgconf: Fix --apply-defaults.
    
    * tools/gpgconf-comp.c: Skip pinentry also in process_all mode.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index cd99c81..3fddc7c 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -2286,9 +2286,6 @@ gc_component_retrieve_options (int component)
   gc_backend_t backend;
   gc_option_t *option;
 
-  if (component == GC_COMPONENT_PINENTRY)
-    return; /* Dummy module for now.  */
-
   for (backend = 0; backend < GC_BACKEND_NR; backend++)
     backend_seen[backend] = 0;
 
@@ -2301,6 +2298,9 @@ gc_component_retrieve_options (int component)
 
   do
     {
+      if (component == GC_COMPONENT_PINENTRY)
+        continue; /* Skip this dummy component.  */
+
       option = gc_component[component].options;
 
       while (option && option->name)

-----------------------------------------------------------------------

Summary of changes:
 doc/Makefile.am           |   4 +-
 doc/examples/gpgconf.conf |   8 +-
 doc/tools.texi            |   9 ++
 g10/gpg.c                 |   2 +
 sm/gpgsm.c                |   1 +
 tools/gpgconf-comp.c      | 297 ++++++++++++++++++++++++++++++++++++++++------
 tools/gpgconf.c           |  13 +-
 tools/gpgconf.h           |   6 +-
 8 files changed, 299 insertions(+), 41 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 19:08:50 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 16 Dec 2016 19:08:50 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-232-g3029cf6
Message-ID: <E1cHww8-0003rI-Qp@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  3029cf63dcb05d57b8c77c759cbb7f4469bef567 (commit)
       via  52ac388b38b2ce600680fc701a052044066b8fed (commit)
       via  980791862ea2acaff19a1180d1faf6ac1a9b0843 (commit)
      from  66ab61651831db028131a9b5dba3be3b0c0aec71 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3029cf63dcb05d57b8c77c759cbb7f4469bef567
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 19:08:04 2016 +0100

    Fix direct trust handling
    
    * mail.cpp (level_4_check): Fix it.
    (Mail::get_crypto_details): Use it correctly.

diff --git a/src/mail.cpp b/src/mail.cpp
index 4e51265..71eec62 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1388,7 +1388,7 @@ Mail::set_uuid()
   return 0;
 }
 
-/* Returns 1 if the userid is ultimately trusted.
+/* Returns 2 if the userid is ultimately trusted.
 
    Returns 1 if the userid is fully trusted but has
    a signature by a key for which we have a secret
@@ -1431,8 +1431,8 @@ level_4_check (const UserID &uid)
                 }
               /* Check that the userID of the signature is the ultimately
                  trusted one. */
-              const char *signed_uid_str = uid.id ();
-              if (!signed_uid_str)
+              const char *sig_uid_str = sig.signerUserID();
+              if (!sig_uid_str)
                 {
                   /* should not happen */
                   TRACEPOINT;
@@ -1442,21 +1442,22 @@ level_4_check (const UserID &uid)
                 {
                   if (signer_uid.validity() != UserID::Validity::Ultimate)
                     {
+                      TRACEPOINT;
                       continue;
                     }
-                  const char *signer_uid_str = uid.id ();
-                  if (!signer_uid_str)
+                  const char *signer_uid_str = signer_uid.id ();
+                  if (!sig_uid_str)
                     {
                       /* should not happen */
                       TRACEPOINT;
                       continue;
                     }
-                  if (!strcmp(signer_uid_str, signed_uid_str))
+                  if (!strcmp(sig_uid_str, signer_uid_str))
                     {
                       /* We have a match */
                       log_debug ("%s:%s: classified %s as ultimate because "
                                  "it was signed by uid %s of key %s",
-                                 SRCNAME, __func__, signed_uid_str, signer_uid_str,
+                                 SRCNAME, __func__, signer_uid_str, sig_uid_str,
                                  secKeyID);
                       return 1;
                     }
@@ -1537,17 +1538,17 @@ Mail::get_crypto_details()
       /* level 4 check for direct trust */
       int four_check = level_4_check (m_uid);
 
-      if (four_check == 1 && m_sig.key().hasSecret ())
+      if (four_check == 2 && m_sig.key().hasSecret ())
         {
           message = _("You signed this message.");
         }
       else if (four_check == 1)
         {
-          message = _("The sender is allowed to manage your mail trust.");
+          message = _("The senders identity was certified by yourself.");
         }
       else if (four_check == 2)
         {
-          message = _("The senders identity was certified by yourself.");
+          message = _("The sender is allowed to manage your mail trust.");
         }
       else
         {

commit 52ac388b38b2ce600680fc701a052044066b8fed
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 19:06:44 2016 +0100

    Improve some strings
    
    * src/gpgoladdin.cpp (GetCustomUI_MIME): Change some strings.
    * src/mail.cpp(Mail::get_crypto_summary): Use trusted instead
    of trustworthy.
    (Mail::get_crypto_details): Update some strings.

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index 1903ec0..15ba34d 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -795,22 +795,22 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
       "You can use this you to generate your "
       "own certificates. ");*/
   const char *encryptTTip =
-    _("Encrypt the message.");
+    _("Encrypt the message");
   const char *encryptSTip =
-    _("Encrypts the message and all attachments before sending.");
+    _("Encrypts the message and all attachments before sending");
   const char *signTTip =
-    _("Sign the message.");
+    _("Sign the message");
   const char *signSTip =
-    _("Sign the message and all attachments before sending.");
+    _("Sign the message and all attachments before sending");
 
   const char *secureTTip =
-    _("Encrypt and sign the message.");
+    _("Sign and encrypt the message");
   const char *secureSTip =
     _("Encrypting and cryptographically signing a message means that the "
       "recipient can be sure that no one modified the message and only the "
-      "recipients can read it.\nNot even the NSA.");
+      "recipients can read it");
   const char *optsSTip =
-    _("Open the settings dialog for GpgOL.");
+    _("Open the settings dialog for GpgOL");
   log_debug ("%s:%s: GetCustomUI_MIME for id: %ls", SRCNAME, __func__, RibbonID);
 
   if (!RibbonXml || !RibbonID)
@@ -860,7 +860,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "   </tabs>"
         " </ribbon>"
         "</customUI>", _("GpgOL"),
-        _("Sign Encrypt"), secureTTip, secureSTip,
+        _("Secure"), secureTTip, secureSTip,
         _("Sign"), signTTip, signSTip,
         _("Encrypt"), encryptTTip, encryptSTip,
         optsSTip
@@ -978,7 +978,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         _("GpgOL"),
         optsSTip,
         _("GpgOL"),
-        _("Sign Encrypt"), secureTTip, secureSTip,
+        _("Secure"), secureTTip, secureSTip,
         _("Sign"), signTTip, signSTip,
         _("Encrypt"), encryptTTip, encryptSTip,
         optsSTip
diff --git a/src/mail.cpp b/src/mail.cpp
index feb0ca4..4e51265 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1479,7 +1479,7 @@ Mail::get_crypto_summary ()
     }
   if (level > 3)
     {
-      return _("Highly Trustworthy");
+      return _("Highly Trusted");
     }
   if (level >= 2 && enc)
     {
@@ -1487,7 +1487,7 @@ Mail::get_crypto_summary ()
     }
   if (level >= 2)
     {
-      return _("Trustworthy");
+      return _("Trusted");
     }
   if (enc)
     {
@@ -1630,14 +1630,14 @@ Mail::get_crypto_details()
          or just unkown. */
       message = is_encrypted () ? _("But the sender address is not trustworthy because:") :
                                   _("The sender address is not trustworthy because:");
-      message += "\n\n";
+      message += "\n";
       keyFound = !(m_sig.summary() & Signature::Summary::KeyMissing);
 
       bool general_problem = true;
       /* First the general stuff. */
       if (m_sig.summary() & Signature::Summary::Red)
         {
-          message += _("The signature is invalid.\n");
+          message += _("The signature is invalid: \n");
         }
       else if (m_sig.summary() & Signature::Summary::SysError ||
                m_verify_result.numSignatures() < 1)
@@ -1702,6 +1702,10 @@ Mail::get_crypto_details()
            /* Bit of a catch all for weird results. */
           message += _("is not certified by any trustworthy key.");
         }
+      else if (m_uid.isRevoked())
+        {
+          message += _("The sender marked this address as revoked.");
+        }
       else if ((m_sig.validity() & Signature::Validity::Never))
         {
           message += _("is marked as not trustworthy.");

commit 980791862ea2acaff19a1180d1faf6ac1a9b0843
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 19:05:10 2016 +0100

    Update icons for level 2
    
    * src/icons: Update level2 icon
    * src/icons/level-3-enc.png: Reexport

diff --git a/src/icons/level-2-enc.png b/src/icons/level-2-enc.png
index 88c8c5c..78cb90e 100644
Binary files a/src/icons/level-2-enc.png and b/src/icons/level-2-enc.png differ
diff --git a/src/icons/level-2-enc.svg b/src/icons/level-2-enc.svg
index 2669bd6..0f88c88 100644
--- a/src/icons/level-2-enc.svg
+++ b/src/icons/level-2-enc.svg
@@ -102,14 +102,19 @@
        inkscape:connector-curvature="0"
        style="fill:#27ae60;fill-opacity:1;stroke:#141414;stroke-width:0.47197506;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
        class="ColorScheme-PositiveText"
-       d="m 31.999994,16.235986 c -8.733266,0 -15.764006,7.030749 -15.764006,15.764013 0,8.733264 7.03074,15.764013 15.764006,15.764013 8.733265,0 15.764015,-7.030749 15.764015,-15.764013 0,-8.733264 -7.03075,-15.764013 -15.764015,-15.764013 z"
+       d="m 31.999997,16.235987 c -8.733263,0 -15.76401,7.03075 -15.76401,15.764013 0,8.733263 7.030747,15.764012 15.76401,15.764012 8.733265,0 15.764015,-7.030749 15.764015,-15.764012 0,-8.733263 -7.03075,-15.764013 -15.764015,-15.764013 z"
        id="path4387"
        inkscape:export-xdpi="75"
        inkscape:export-ydpi="75" />
     <path
-       style="stroke:#ffffff;stroke-width:6.65334034;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
-       inkscape:connector-curvature="0"
-       d="M 22.704998,31.346016 H 42.71243 M 32.708712,21.3423 v 20.007434"
-       id="path6" />
+       sodipodi:type="arc"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       id="path2990"
+       sodipodi:cx="15"
+       sodipodi:cy="13"
+       sodipodi:rx="11.4375"
+       sodipodi:ry="11.0625"
+       d="m 26.4375,13 a 11.4375,11.0625 0 1 1 -22.875,0 11.4375,11.0625 0 1 1 22.875,0 z"
+       transform="matrix(0.69945359,0,0,0.72316383,21.508194,22.598869)" />
   </g>
 </svg>
diff --git a/src/icons/level-2.png b/src/icons/level-2.png
index 505f9de..17fb28b 100644
Binary files a/src/icons/level-2.png and b/src/icons/level-2.png differ
diff --git a/src/icons/level-2.svg b/src/icons/level-2.svg
index bca880e..1a2c145 100644
--- a/src/icons/level-2.svg
+++ b/src/icons/level-2.svg
@@ -36,8 +36,8 @@
      inkscape:pageopacity="0.0"
      inkscape:pageshadow="2"
      inkscape:zoom="16"
-     inkscape:cx="21.252968"
-     inkscape:cy="41.031963"
+     inkscape:cx="10.034218"
+     inkscape:cy="26.031963"
      inkscape:current-layer="layer1"
      showgrid="true"
      inkscape:grid-bbox="true"
@@ -76,7 +76,7 @@
         <dc:format>image/svg+xml</dc:format>
         <dc:type
            rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
+        <dc:title />
       </cc:Work>
     </rdf:RDF>
   </metadata>
@@ -93,9 +93,14 @@
        inkscape:export-xdpi="75"
        inkscape:export-ydpi="75" />
     <path
-       style="stroke:#ffffff;stroke-width:9.98001003;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
-       inkscape:connector-curvature="0"
-       d="M 10.0575,23.019027 H 40.06865 M 25.063075,8.0134522 V 38.024602"
-       id="path6" />
+       sodipodi:type="arc"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       id="path2990"
+       sodipodi:cx="15"
+       sodipodi:cy="13"
+       sodipodi:rx="11.4375"
+       sodipodi:ry="11.0625"
+       d="m 26.4375,13 a 11.4375,11.0625 0 1 1 -22.875,0 11.4375,11.0625 0 1 1 22.875,0 z"
+       transform="matrix(1.0491803,0,0,1.0847458,8.2622952,9.8983042)" />
   </g>
 </svg>
diff --git a/src/icons/level-3-enc.png b/src/icons/level-3-enc.png
index fccbd9d..6a46cd0 100644
Binary files a/src/icons/level-3-enc.png and b/src/icons/level-3-enc.png differ

-----------------------------------------------------------------------

Summary of changes:
 src/gpgoladdin.cpp        |  18 +++++++++---------
 src/icons/level-2-enc.png | Bin 1653 -> 1783 bytes
 src/icons/level-2-enc.svg |  15 ++++++++++-----
 src/icons/level-2.png     | Bin 1182 -> 1314 bytes
 src/icons/level-2.svg     |  19 ++++++++++++-------
 src/icons/level-3-enc.png | Bin 1928 -> 1861 bytes
 src/mail.cpp              |  33 +++++++++++++++++++--------------
 7 files changed, 50 insertions(+), 35 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 19:09:13 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 19:09:13 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-140-g41a426a
Message-ID: <E1cHwwV-0003sC-J4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  41a426a1a01e2726c3c318786f29b4974bf1f689 (commit)
      from  48671f295ff233765689b6a73021f83ab845a28f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 41a426a1a01e2726c3c318786f29b4974bf1f689
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 19:03:28 2016 +0100

    doc: Wrap a too long line in DETAILS.
    
    --

diff --git a/doc/DETAILS b/doc/DETAILS
index 95d5e4f..00b55c5 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -722,10 +722,18 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     userid encoded in UTF-8 and percent escaped.  The fingerprint is
     identical for all TOFU_USER lines up to a NEWSIG line.
 
-*** TOFU_STATS <summary> <sign-count> <encryption-count> [<policy> [<tm1> <tm2> <tm3> <tm4> [<validity> [<sign-days> <encrypt-days>]]]]
+*** TOFU_STATS <MANY_ARGS>
 
     Statistics for the current user id.
 
+    The <MANY_ARGS> are the usual space delimited arguments.  Here we
+    have too many of them to fit on one printed line and thus they are
+    given on 3 printed lines:
+
+    : <summary> <sign-count> <encryption-count>
+    : [<policy> [<tm1> <tm2> <tm3> <tm4>
+    : [<validity> [<sign-days> <encrypt-days>]]]]
+
     Values for SUMMARY are:
     - 0 :: attention, an interaction with the user is required (conflict)
     - 1 :: key with no verification/encryption history

-----------------------------------------------------------------------

Summary of changes:
 doc/DETAILS | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 19:11:03 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 16 Dec 2016 19:11:03 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-14-gda5343a
Message-ID: <E1cHwyH-0003wf-I9@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  da5343a9d2c8c0ca6431162aac4bd5c73b4ae6dd (commit)
      from  85e05537e15346896a271d3f62bead9dd7e3f180 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit da5343a9d2c8c0ca6431162aac4bd5c73b4ae6dd
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Dec 16 19:09:13 2016 +0100

    cpp: Ensure that hasSecret is correct after update
    
    * lang/cpp/src/key.cpp (Key::update): Check for
    a secret key first before listing public keys.
    
    --
    This is a performance delay but the update should
    only be called in a non gui thread anyway. The information
    if we have the secret key for this key is important to provide
    after update.

diff --git a/lang/cpp/src/key.cpp b/lang/cpp/src/key.cpp
index d621a81..4f7ec54 100644
--- a/lang/cpp/src/key.cpp
+++ b/lang/cpp/src/key.cpp
@@ -341,7 +341,12 @@ void Key::update()
                         KeyListMode::Validate |
                         KeyListMode::WithTofu);
     Error err;
-    auto newKey = ctx->key(primaryFingerprint(), err, hasSecret());
+    auto newKey = ctx->key(primaryFingerprint(), err, true);
+    // Not secret so we get the information from the pubring.
+    if (newKey.isNull())
+      {
+        newKey = ctx->key(primaryFingerprint(), err, false);
+      }
     delete ctx;
     if (err) {
         return;

-----------------------------------------------------------------------

Summary of changes:
 lang/cpp/src/key.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 21:09:33 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 21:09:33 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-143-gc4e8a31
Message-ID: <E1cHyoy-0001IP-J5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c4e8a3194d6b92f596a6483e486c645de7d2ddd1 (commit)
       via  ddb48086833f8b86f0f0d69b21a23f245090ea7a (commit)
       via  59d3c3e4baffff52548fb5d1766ebf02dd8e1bec (commit)
      from  41a426a1a01e2726c3c318786f29b4974bf1f689 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c4e8a3194d6b92f596a6483e486c645de7d2ddd1
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 21:00:14 2016 +0100

    dirmngr: Use one context for all libdns queries.
    
    * dirmngr/dns-stuff.c (libdns_reinit_pending): New var.
    (enable_recursive_resolver): Set var.
    (set_dns_nameserver): Ditto.
    (libdns_init): Avoid double initialization.
    (libdns_deinit): New.
    (reload_dns_stuff): New.
    (libdns_res_open): Act upon LIBDNS_REINIT_PENDING.
    * dirmngr/t-dns-stuff.c (main): Call reload_dns_stuff to release
    memory.
    * dirmngr/dirmngr.c (cleanup): Ditto.
    (dirmngr_sighup_action): Call reload_dns_stuff to set
    LIBDNS_REINIT_PENDING.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index a118327..ef30d2c 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -1383,6 +1383,7 @@ cleanup (void)
 {
   crl_cache_deinit ();
   cert_cache_deinit (1);
+  reload_dns_stuff (1);
 
 #if USE_LDAP
   ldapserver_list_free (opt.ldapservers);
@@ -1689,6 +1690,7 @@ dirmngr_sighup_action (void)
   crl_cache_deinit ();
   cert_cache_init ();
   crl_cache_init ();
+  reload_dns_stuff (0);
 }
 
 
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 0f1f0ed..63951e5 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -133,8 +133,13 @@ struct libdns_s
 
   struct sockaddr_storage socks_host;
 } libdns;
+
+/* If this flag is set, libdns shall be reinited for the next use.  */
+static int libdns_reinit_pending;
+
 #endif /*USE_LIBDNS*/
 
+
 /* Calling this function with YES set to True forces the use of the
  * standard resolver even if dirmngr has been built with support for
  * an alternative resolver.  */
@@ -159,6 +164,7 @@ void
 enable_recursive_resolver (int yes)
 {
   recursive_resolver = yes;
+  libdns_reinit_pending = 1;
 }
 
 
@@ -203,6 +209,7 @@ set_dns_nameserver (const char *ipaddr)
   strncpy (tor_nameserver, ipaddr? ipaddr : DEFAULT_NAMESERVER,
            sizeof tor_nameserver -1);
   tor_nameserver[sizeof tor_nameserver -1] = 0;
+  libdns_reinit_pending = 1;
 }
 
 
@@ -315,6 +322,9 @@ libdns_init (void)
   const char *fname;
   char *cfgstr = NULL;
 
+  if (libdns.resolv_conf)
+    return 0; /* Already initialized.  */
+
   memset (&ld, 0, sizeof ld);
 
   ld.resolv_conf = dns_resconf_open (&derr);
@@ -410,6 +420,41 @@ libdns_init (void)
 
 
 #ifdef USE_LIBDNS
+/* Deinitialize libdns.  */
+static void
+libdns_deinit (void)
+{
+  struct libdns_s ld;
+
+  if (!libdns.resolv_conf)
+    return; /* Not initialized.  */
+
+  ld = libdns;
+  memset (&libdns, 0, sizeof libdns);
+  dns_hints_close (ld.hints);
+  dns_hosts_close (ld.hosts);
+  dns_resconf_close (ld.resolv_conf);
+}
+#endif /*USE_LIBDNS*/
+
+/* SIGHUP action handler for this module.  With FORCE set objects are
+ * all immediately released. */
+void
+reload_dns_stuff (int force)
+{
+  if (force)
+    {
+#ifdef USE_LIBDNS
+      libdns_deinit ();
+#endif
+      libdns_reinit_pending = 0;
+    }
+  else
+    libdns_reinit_pending = 1;
+}
+
+
+#ifdef USE_LIBDNS
 /*
  * Initialize libdns if needed and open a dns_resolver context.
  * Returns 0 on success and stores the new context at R_RES.  On
@@ -424,6 +469,12 @@ libdns_res_open (struct dns_resolver **r_res)
 
   *r_res = NULL;
 
+  if (libdns_reinit_pending)
+    {
+      libdns_reinit_pending = 0;
+      libdns_deinit ();
+    }
+
   err = libdns_init ();
   if (err)
     return err;
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 20a4b41..2be972a 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -116,6 +116,8 @@ gpg_error_t enable_dns_tormode (int new_circuit);
    next DNS query.  Note that this is only used in Tor mode.  */
 void set_dns_nameserver (const char *ipaddr);
 
+/* SIGHUP action handler for this module.  */
+void reload_dns_stuff (int force);
 
 void free_dns_addrinfo (dns_addrinfo_t ai);
 
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index 224e948..5315138 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -217,7 +217,6 @@ main (int argc, char **argv)
         {
           printf ("CNAME found: '%s'\n", cname);
         }
-
       xfree (cname);
     }
   else if (opt_srv)
@@ -291,6 +290,7 @@ main (int argc, char **argv)
       free_dns_addrinfo (aibuf);
     }
 
+  reload_dns_stuff (1); /* Release objects.  */
 
   return 0;
 }

commit ddb48086833f8b86f0f0d69b21a23f245090ea7a
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 20:25:02 2016 +0100

    dirmngr: Pass Tor credentials to libdns.
    
    * dirmngr/dns-stuff.c (tor_credentials): Replace by ...
    (tor_socks_user, tor_socks_password): new vars.
    (enable_dns_tormode): Set these new vars.
    (libdns_res_open): Tell libdns the socks credentials.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index eec7112..0f1f0ed 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -118,8 +118,10 @@ static int tor_mode;
   (40 should be sufficient for v6 but we add some extra for a scope.) */
 static char tor_nameserver[40+20];
 
-/* A string to hold the credentials presented to Tor.  */
-static char tor_credentials[50];
+/* Two strings to hold the credentials presented to Tor.  */
+static char tor_socks_user[30];
+static char tor_socks_password[20];
+
 
 #ifdef USE_LIBDNS
 /* Libdns gobal data.  */
@@ -177,15 +179,14 @@ recursive_resolver_p (void)
 gpg_error_t
 enable_dns_tormode (int new_circuit)
 {
-  /* XXX: dns.c doesn't support SOCKS credentials.  */
-
-  if (!*tor_credentials || new_circuit)
+  if (!*tor_socks_user || new_circuit)
     {
       static unsigned int counter;
 
-      gpgrt_snprintf (tor_credentials, sizeof tor_credentials,
-                      "dirmngr-%lu:p%u",
-                      (unsigned long)getpid (), counter);
+      gpgrt_snprintf (tor_socks_user, sizeof tor_socks_user,
+                      "dirmngr-%lu", (unsigned long)getpid ());
+      gpgrt_snprintf (tor_socks_password, sizeof tor_socks_password,
+                      "p%u", counter);
       counter++;
     }
   tor_mode = 1;
@@ -428,7 +429,10 @@ libdns_res_open (struct dns_resolver **r_res)
     return err;
 
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (.socks_host=&libdns.socks_host), &derr);
+                      dns_opts (.socks_host     = &libdns.socks_host,
+                                .socks_user     = tor_socks_user,
+                                .socks_password = tor_socks_password ),
+                      &derr);
   if (!res)
     return libdns_error_to_gpg_error (derr);
 

commit 59d3c3e4baffff52548fb5d1766ebf02dd8e1bec
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 20:09:27 2016 +0100

    dirmngr: Factor common libdns code out.
    
    * dirmngr/dns-stuff.c (libdns_res_open): New.  Replace all libdns_init
    and dns-res_open by a call to this func.
    (libdns_res_submit): New wrapper.  Replace all dns_res_sumbit calls.
    (libdns_res_wait): New function.
    (resolve_name_libdns): Replace loop by libdns_res_wait.
    (get_dns_cert_libdns): Ditto.
    (getsrv_libdns): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 1fbe2ea..eec7112 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -409,6 +409,73 @@ libdns_init (void)
 
 
 #ifdef USE_LIBDNS
+/*
+ * Initialize libdns if needed and open a dns_resolver context.
+ * Returns 0 on success and stores the new context at R_RES.  On
+ * failure an error code is returned and NULL stored at R_RES.
+ */
+static gpg_error_t
+libdns_res_open (struct dns_resolver **r_res)
+{
+  gpg_error_t err;
+  struct dns_resolver *res;
+  int derr;
+
+  *r_res = NULL;
+
+  err = libdns_init ();
+  if (err)
+    return err;
+
+  res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
+                      dns_opts (.socks_host=&libdns.socks_host), &derr);
+  if (!res)
+    return libdns_error_to_gpg_error (derr);
+
+  *r_res = res;
+  return 0;
+}
+#endif /*USE_LIBDNS*/
+
+
+#ifdef USE_LIBDNS
+/* Wrapper around dns_res_submit.  */
+static gpg_error_t
+libdns_res_submit (struct dns_resolver *res, const char *qname,
+                   enum dns_type qtype, enum dns_class qclass)
+{
+  return libdns_error_to_gpg_error (dns_res_submit (res, qname, qtype, qclass));
+}
+#endif /*USE_LIBDNS*/
+
+
+#ifdef USE_LIBDNS
+/* Standard event handling loop.  */
+gpg_error_t
+libdns_res_wait (struct dns_resolver *res)
+{
+  gpg_error_t err;
+
+  while ((err = libdns_error_to_gpg_error (dns_res_check (res)))
+         && gpg_err_code (err) == GPG_ERR_EAGAIN)
+    {
+      if (dns_res_elapsed (res) > 30)
+        {
+          err = gpg_error (GPG_ERR_DNS_TIMEOUT);
+          break;
+        }
+
+      my_unprotect ();
+      dns_res_poll (res, 1);
+      my_protect ();
+    }
+
+  return err;
+}
+#endif /*USE_LIBDNS*/
+
+
+#ifdef USE_LIBDNS
 static gpg_error_t
 resolve_name_libdns (const char *name, unsigned short port,
                      int want_family, int want_socktype,
@@ -429,10 +496,6 @@ resolve_name_libdns (const char *name, unsigned short port,
   if (r_canonname)
     *r_canonname = NULL;
 
-  err = libdns_init ();
-  if (err)
-    goto leave;
-
   memset (&hints, 0, sizeof hints);
   hints.ai_family = want_family;
   hints.ai_socktype = want_socktype;
@@ -446,13 +509,9 @@ resolve_name_libdns (const char *name, unsigned short port,
       portstr = portstr_;
     }
 
-  res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (.socks_host=&libdns.socks_host), &derr);
-  if (!res)
-    {
-      err = libdns_error_to_gpg_error (derr);
-      goto leave;
-    }
+  err = libdns_res_open (&res);
+  if (err)
+    goto leave;
 
   ai = dns_ai_open (name, portstr, 0, &hints, res, &derr);
   if (!ai)
@@ -841,46 +900,24 @@ get_dns_cert_libdns (const char *name, int want_certtype,
            : (want_certtype - DNS_CERTTYPE_RRBASE));
 
 
-  err = libdns_init ();
+  err = libdns_res_open (&res);
   if (err)
     goto leave;
 
-  res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (.socks_host=&libdns.socks_host), &derr);
-  if (!res)
-    {
-      err = libdns_error_to_gpg_error (derr);
-      goto leave;
-    }
-
   if (dns_d_anchor (host, sizeof host, name, strlen (name)) >= sizeof host)
     {
       err = gpg_error (GPG_ERR_ENAMETOOLONG);
       goto leave;
     }
 
-  err = libdns_error_to_gpg_error (dns_res_submit (res, name, qtype, DNS_C_IN));
+  err = libdns_res_submit (res, name, qtype, DNS_C_IN);
   if (err)
     goto leave;
 
-  /* Loop until we found a record.  */
-  while ((err = libdns_error_to_gpg_error (dns_res_check (res))))
-    {
-      if (gpg_err_code (err) == GPG_ERR_EAGAIN)
-        {
-          if (dns_res_elapsed (res) > 30)
-            {
-              err = gpg_error (GPG_ERR_DNS_TIMEOUT);
-              goto leave;
-            }
+  err = libdns_res_wait (res);
+  if (err)
+    goto leave;
 
-          my_unprotect ();
-          dns_res_poll (res, 1);
-          my_protect ();
-        }
-      else if (err)
-        goto leave;
-    }
   ans = dns_res_fetch (res, &derr);
   if (!ans)
     {
@@ -1281,47 +1318,24 @@ getsrv_libdns (const char *name, struct srventry **list, int *r_count)
   int derr;
   int srvcount=0;
 
-  err = libdns_init ();
+  err = libdns_res_open (&res);
   if (err)
     goto leave;
 
-  res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (.socks_host=&libdns.socks_host), &derr);
-  if (!res)
-    {
-      err = libdns_error_to_gpg_error (derr);
-      goto leave;
-    }
-
   if (dns_d_anchor (host, sizeof host, name, strlen (name)) >= sizeof host)
     {
       err = gpg_error (GPG_ERR_ENAMETOOLONG);
       goto leave;
     }
 
-  err = libdns_error_to_gpg_error
-    (dns_res_submit (res, name, DNS_T_SRV, DNS_C_IN));
+  err = libdns_res_submit (res, name, DNS_T_SRV, DNS_C_IN);
   if (err)
     goto leave;
 
-  /* Loop until we found a record.  */
-  while ((err = libdns_error_to_gpg_error (dns_res_check (res))))
-    {
-      if (gpg_err_code (err) == GPG_ERR_EAGAIN)
-        {
-          if (dns_res_elapsed (res) > 30)
-            {
-              err = gpg_error (GPG_ERR_DNS_TIMEOUT);
-              goto leave;
-            }
+  err = libdns_res_wait (res);
+  if (err)
+    goto leave;
 
-          my_unprotect ();
-          dns_res_poll (res, 1);
-          my_protect ();
-        }
-      else if (err)
-        goto leave;
-    }
   ans = dns_res_fetch (res, &derr);
   if (!ans)
     {
@@ -1616,46 +1630,23 @@ gpg_error_t
 get_dns_cname_libdns (const char *name, char **r_cname)
 {
   gpg_error_t err;
-  struct dns_resolver *res = NULL;
+  struct dns_resolver *res;
   struct dns_packet *ans = NULL;
   struct dns_cname cname;
   int derr;
 
-  err = libdns_init ();
+  err = libdns_res_open (&res);
   if (err)
     goto leave;
 
-  res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
-                      dns_opts (.socks_host=&libdns.socks_host), &derr);
-  if (!res)
-    {
-      err = libdns_error_to_gpg_error (derr);
-      goto leave;
-    }
-
-  err = libdns_error_to_gpg_error
-    (dns_res_submit (res, name, DNS_T_CNAME, DNS_C_IN));
+  err = libdns_res_submit (res, name, DNS_T_CNAME, DNS_C_IN);
   if (err)
     goto leave;
 
-  /* Loop until we found a record.  */
-  while ((err = libdns_error_to_gpg_error (dns_res_check (res))))
-    {
-      if (gpg_err_code (err) == GPG_ERR_EAGAIN)
-        {
-          if (dns_res_elapsed (res) > 30)
-            {
-              err = gpg_error (GPG_ERR_DNS_TIMEOUT);
-              goto leave;
-            }
+  err = libdns_res_wait (res);
+  if (err)
+    goto leave;
 
-          my_unprotect ();
-          dns_res_poll (res, 1);
-          my_protect ();
-        }
-      else if (err)
-        goto leave;
-    }
   ans = dns_res_fetch (res, &derr);
   if (!ans)
     {

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c     |   2 +
 dirmngr/dns-stuff.c   | 252 +++++++++++++++++++++++++++++---------------------
 dirmngr/dns-stuff.h   |   2 +
 dirmngr/t-dns-stuff.c |   2 +-
 4 files changed, 154 insertions(+), 104 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 16 21:59:46 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 16 Dec 2016 21:59:46 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-144-g024dbd7
Message-ID: <E1cHzbZ-0003Xa-4N@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  024dbd7162fc1a7694176ebad3c21ee3ea67c024 (commit)
      from  c4e8a3194d6b92f596a6483e486c645de7d2ddd1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 024dbd7162fc1a7694176ebad3c21ee3ea67c024
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Dec 16 21:56:23 2016 +0100

    dirmngr: Auto-switch from Tor port to Torbrowser port.
    
    * dirmngr/dns-stuff.c (libdns_tor_port): New var.
    (set_dns_nameserver): Clear that var.
    (libdns_init): Init var to the default port.
    (libdns_switch_port_p): New func.
    (resolve_dns_name): Use function to switch the port
    (get_dns_cert): Ditto.
    (getsrv): Ditto.
    (get_dns_cname): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 63951e5..1fc81b2 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -137,6 +137,9 @@ struct libdns_s
 /* If this flag is set, libdns shall be reinited for the next use.  */
 static int libdns_reinit_pending;
 
+/* The Tor port to be used.  */
+static int libdns_tor_port;
+
 #endif /*USE_LIBDNS*/
 
 
@@ -210,6 +213,7 @@ set_dns_nameserver (const char *ipaddr)
            sizeof tor_nameserver -1);
   tor_nameserver[sizeof tor_nameserver -1] = 0;
   libdns_reinit_pending = 1;
+  libdns_tor_port = 0;  /* Start again with the default port.  */
 }
 
 
@@ -341,6 +345,9 @@ libdns_init (void)
       if (!*tor_nameserver)
         set_dns_nameserver (NULL);
 
+      if (!libdns_tor_port)
+        libdns_tor_port = TOR_PORT;
+
       cfgstr = xtryasprintf ("[%s]:53", tor_nameserver);
       if (!cfgstr)
         err = gpg_error_from_syserror ();
@@ -356,7 +363,7 @@ libdns_init (void)
       ld.resolv_conf->options.tcp = DNS_RESCONF_TCP_SOCKS;
 
       xfree (cfgstr);
-      cfgstr = xtryasprintf ("[%s]:%d", "127.0.0.1", TOR_PORT);
+      cfgstr = xtryasprintf ("[%s]:%d", "127.0.0.1", libdns_tor_port);
       if (!cfgstr)
         err = gpg_error_from_syserror ();
       else
@@ -437,6 +444,7 @@ libdns_deinit (void)
 }
 #endif /*USE_LIBDNS*/
 
+
 /* SIGHUP action handler for this module.  With FORCE set objects are
  * all immediately released. */
 void
@@ -494,6 +502,25 @@ libdns_res_open (struct dns_resolver **r_res)
 
 
 #ifdef USE_LIBDNS
+/* Helper to test whether we need totry again after having swicthed
+ * the Tor port.  */
+static int
+libdns_switch_port_p (gpg_error_t err)
+{
+  if (tor_mode && gpg_err_code (err) == GPG_ERR_ECONNREFUSED
+      && libdns_tor_port == TOR_PORT)
+    {
+      /* Switch port and try again.  */
+      libdns_tor_port = TOR_PORT2;
+      libdns_reinit_pending = 1;
+      return 1;
+    }
+  return 0;
+}
+#endif /*USE_LIBDNS*/
+
+
+#ifdef USE_LIBDNS
 /* Wrapper around dns_res_submit.  */
 static gpg_error_t
 libdns_res_submit (struct dns_resolver *res, const char *qname,
@@ -834,8 +861,16 @@ resolve_dns_name (const char *name, unsigned short port,
 {
 #ifdef USE_LIBDNS
   if (!standard_resolver)
-    return resolve_name_libdns (name, port, want_family, want_socktype,
-                                r_ai, r_canonname);
+    {
+      gpg_error_t err;
+
+      err = resolve_name_libdns (name, port, want_family, want_socktype,
+                                  r_ai, r_canonname);
+      if (err && libdns_switch_port_p (err))
+        err = resolve_name_libdns (name, port, want_family, want_socktype,
+                                   r_ai, r_canonname);
+      return err;
+    }
 #endif /*USE_LIBDNS*/
 
   return resolve_name_standard (name, port, want_family, want_socktype,
@@ -1335,8 +1370,16 @@ get_dns_cert (const char *name, int want_certtype,
 
 #ifdef USE_LIBDNS
   if (!standard_resolver)
-    return get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
-                                r_fpr, r_fprlen, r_url);
+    {
+      gpg_error_t err;
+
+      err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
+                                 r_fpr, r_fprlen, r_url);
+      if (err && libdns_switch_port_p (err))
+        err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
+                                   r_fpr, r_fprlen, r_url);
+      return err;
+    }
 #endif /*USE_LIBDNS*/
 
   return get_dns_cert_standard (name, want_certtype, r_key, r_keylen,
@@ -1593,7 +1636,11 @@ getsrv (const char *name, struct srventry **list)
   srvcount = 0;
 #ifdef USE_LIBDNS
   if (!standard_resolver)
-    err = getsrv_libdns (name, list, &srvcount);
+    {
+      err = getsrv_libdns (name, list, &srvcount);
+      if (err && libdns_switch_port_p (err))
+        err = getsrv_libdns (name, list, &srvcount);
+    }
   else
 #endif /*USE_LIBDNS*/
     err = getsrv_standard (name, list, &srvcount);
@@ -1834,7 +1881,14 @@ get_dns_cname (const char *name, char **r_cname)
 
 #ifdef USE_LIBDNS
   if (!standard_resolver)
-    return get_dns_cname_libdns (name, r_cname);
+    {
+      gpg_error_t err;
+
+      err = get_dns_cname_libdns (name, r_cname);
+      if (err && libdns_switch_port_p (err))
+        err = get_dns_cname_libdns (name, r_cname);
+      return err;
+    }
 #endif /*USE_LIBDNS*/
 
   return get_dns_cname_standard (name, r_cname);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 61 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Dec 17 06:36:49 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Sat, 17 Dec 2016 06:36:49 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-145-gb653e76
Message-ID: <E1cI7fv-0004BV-Uw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b653e763c856dcefdd6755eb47e3702b3057ac56 (commit)
      from  024dbd7162fc1a7694176ebad3c21ee3ea67c024 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b653e763c856dcefdd6755eb47e3702b3057ac56
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Sat Dec 17 14:35:36 2016 +0900

    po: Update Japanese translation.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/po/ja.po b/po/ja.po
index 228a959..e393dba 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.1.16\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-12-13 15:05+0900\n"
+"PO-Revision-Date: 2016-12-17 14:34+0900\n"
 "Last-Translator: NIIBE Yutaka <gniibe at fsij.org>\n"
 "Language-Team: none\n"
 "Language: ja\n"
@@ -1877,7 +1877,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clear-sign [file]         make a clear text signature\n"
+" --clear-sign [file]        make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -2240,22 +2240,10 @@ msgstr "???????????????????: %s\n"
 msgid "WARNING: recipients (-r) given without using public key encryption\n"
 msgstr "*??*: ?????????????? (-r) ????????\n"
 
-msgid "--store [filename]"
-msgstr "--store [?????]"
-
-msgid "--symmetric [filename]"
-msgstr "--symmetric [?????]"
-
 #, c-format
 msgid "symmetric encryption of '%s' failed: %s\n"
 msgstr "'%s'?????????????: %s\n"
 
-msgid "--encrypt [filename]"
-msgstr "--encrypt [?????]"
-
-msgid "--symmetric --encrypt [filename]"
-msgstr "--symmetric --encrypt [?????]"
-
 msgid "you cannot use --symmetric --encrypt with --s2k-mode 0\n"
 msgstr "--symmetric --encrypt?--s2k-mode 0???????????\n"
 
@@ -2263,15 +2251,6 @@ msgstr "--symmetric --encrypt?--s2k-mode 0???????????\n"
 msgid "you cannot use --symmetric --encrypt while in %s mode\n"
 msgstr "--symmetric --encrypt?%s??????????????\n"
 
-msgid "--sign [filename]"
-msgstr "--sign [?????]"
-
-msgid "--sign --encrypt [filename]"
-msgstr "--sign --encrypt [?????]"
-
-msgid "--symmetric --sign --encrypt [filename]"
-msgstr "--symmetric --sign --encrypt [?????]"
-
 msgid "you cannot use --symmetric --sign --encrypt with --s2k-mode 0\n"
 msgstr "--symmetric --sign --encrypt?--s2k-mode 0???????????\n"
 
@@ -2279,27 +2258,6 @@ msgstr "--symmetric --sign --encrypt?--s2k-mode 0?????????
 msgid "you cannot use --symmetric --sign --encrypt while in %s mode\n"
 msgstr "--symmetric --sign --encrypt?%s??????????????\n"
 
-msgid "--sign --symmetric [filename]"
-msgstr "--sign --symmetric [?????]"
-
-msgid "--clear-sign [filename]"
-msgstr "--clear-sign [?????]"
-
-msgid "--decrypt [filename]"
-msgstr "--decrypt [?????]"
-
-msgid "--sign-key user-id"
-msgstr "--sign-key ???id"
-
-msgid "--lsign-key user-id"
-msgstr "--lsign-key ???id"
-
-msgid "--edit-key user-id [commands]"
-msgstr "--edit-key ???id [????]"
-
-msgid "--passwd <user-id>"
-msgstr "--passwd <???id>"
-
 #, c-format
 msgid "keyserver send failed: %s\n"
 msgstr "???????????????: %s\n"
@@ -2344,9 +2302,6 @@ msgstr "???'%s'????????: %s\n"
 msgid "'%s' does not appear to be a valid key ID, fingerprint or keygrip\n"
 msgstr "'%s'?????ID, ??????????keygrip?????????\n"
 
-msgid "[filename]"
-msgstr "[?????]"
-
 msgid "Go ahead and type your message ...\n"
 msgstr "??????????????????? ...\n"
 
@@ -5339,8 +5294,7 @@ msgstr "TOFU????????????: %s\n"
 #, c-format
 msgid ""
 "This is the first time the email address \"%s\" is being used with key %s."
-msgstr ""
-"?????????\"%s\"??%s???????????????"
+msgstr "?????????\"%s\"??%s???????????????"
 
 #, c-format
 msgid "The email address \"%s\" is associated with %d key!"
@@ -5356,8 +5310,8 @@ msgid ""
 "Please indicate whether this email address should be associated with key %s "
 "or whether you think someone is impersonating \"%s\"."
 msgstr ""
-"????????????? %s ???????????????????"
-"\"%s\" ??????????????????????"
+"????????????? %s ???????????????????\"%s\" ?"
+"?????????????????????"
 
 #, c-format
 msgid "error gathering other user IDs: %s\n"
@@ -5461,8 +5415,8 @@ msgstr "gGaAuUrRbB"
 
 msgid "(G)ood, (A)ccept once, (U)nknown, (R)eject once, (B)ad? "
 msgstr ""
-"(G)ood-?, (A)ccept once-???????, (U)nknown-??, (R)eject once-????"
-"?, (B)ad-??? "
+"(G)ood-?, (A)ccept once-???????, (U)nknown-??, (R)eject once-???"
+"??, (B)ad-??? "
 
 msgid "Defaulting to unknown."
 msgstr "???????????"
@@ -5538,6 +5492,7 @@ msgid "Encrypted %ld~message in the past %s."
 msgid_plural "Encrypted %ld~messages in the past %s."
 msgstr[0] "??????%ld????????(???? %s ?)?"
 
+#, c-format
 msgid "(policy: %s)"
 msgstr "(????: %s)"
 
@@ -5547,15 +5502,13 @@ msgstr "??: ???????ID?????????????
 
 msgid ""
 "Warning: we've only seen one message signed using this key and user id!\n"
-msgstr ""
-"??: ???????ID?????????????????????!\n"
+msgstr "??: ???????ID?????????????????????!\n"
 
 msgid "Warning: you have yet to encrypt a message to this key!\n"
 msgstr "??: ???????????????????????????!\n"
 
 msgid "Warning: you have only encrypted one message to this key!\n"
-msgstr ""
-"??: ????????????????????????????!\n"
+msgstr "??: ????????????????????????????!\n"
 
 #, c-format
 msgid ""
@@ -5571,9 +5524,9 @@ msgid_plural ""
 "  %s\n"
 "to mark it as being bad.\n"
 msgstr[0] ""
-"??: ???????ID????????????????????????????"
-"????! ??????????????????????????????????"
-"?????????????\n"
+"??: ???????ID???????????????????????????"
+"?????! ????????????????????????????????"
+"???????????????\n"
 "  %s\n"
 "??????????????\n"
 
@@ -5582,8 +5535,9 @@ msgid "error opening TOFU database: %s\n"
 msgstr "TOFU???????????????: %s\n"
 
 #, c-format
-msgid "WARNING: Encrypting to %s, which has nonon-revoked user ids.\n"
-msgstr "*??*: %s ??????????????????ID???????????\n"
+msgid "WARNING: Encrypting to %s, which has no non-revoked user ids.\n"
+msgstr ""
+"*??*: %s ??????????????????ID???????????\n"
 
 #, c-format
 msgid "error setting policy for key %s, user id \"%s\": %s"
@@ -6582,6 +6536,25 @@ msgstr "|NAME|?????????NAME???"
 msgid "|NAME|use message digest algorithm NAME"
 msgstr "|NAME|??????????????NAME???"
 
+msgid ""
+"@\n"
+"Examples:\n"
+"\n"
+" -se -r Bob [file]          sign and encrypt for user Bob\n"
+" --clearsign [file]         make a clear text signature\n"
+" --detach-sign [file]       make a detached signature\n"
+" --list-keys [names]        show keys\n"
+" --fingerprint [names]      show fingerprints\n"
+msgstr ""
+"@\n"
+"?:\n"
+"\n"
+" -se -r Bob [????]      ???Bob???????\n"
+" --clearsign [????]     ?????????????\n"
+" --detach-sign [????]   ???????\n"
+" --list-keys [??]         ????\n"
+" --fingerprint [??]       ????????????\n"
+
 msgid "Usage: @GPGSM@ [options] [files] (-h for help)"
 msgstr "???: @GPGSM@ [?????] [????] (???? -h)"
 
@@ -8123,6 +8096,14 @@ msgstr "???????%s?????????????"
 msgid "Note that group specifications are ignored\n"
 msgstr "?????????????????????????\n"
 
+#, c-format
+msgid "error closing '%s'\n"
+msgstr "'%s'?????????\n"
+
+#, c-format
+msgid "error parsing '%s'\n"
+msgstr "'%s'????????: %s\n"
+
 msgid "list all components"
 msgstr "?????????????????"
 
@@ -8141,6 +8122,9 @@ msgstr "|COMPONENT|????????????"
 msgid "apply global default values"
 msgstr "?????????????????"
 
+msgid "|FILE|update configuration files using FILE"
+msgstr "|FILE|FILE????????????????????????"
+
 msgid "get the configuration directories for @GPGCONF@"
 msgstr "@GPGCONF@??????????????????????????"
 
@@ -8331,6 +8315,51 @@ msgstr ""
 "??: gpg-check-pattern [?????] ????????\n"
 "????????????????????????????\n"
 
+#~ msgid "--store [filename]"
+#~ msgstr "--store [?????]"
+
+#~ msgid "--symmetric [filename]"
+#~ msgstr "--symmetric [?????]"
+
+#~ msgid "--encrypt [filename]"
+#~ msgstr "--encrypt [?????]"
+
+#~ msgid "--symmetric --encrypt [filename]"
+#~ msgstr "--symmetric --encrypt [?????]"
+
+#~ msgid "--sign [filename]"
+#~ msgstr "--sign [?????]"
+
+#~ msgid "--sign --encrypt [filename]"
+#~ msgstr "--sign --encrypt [?????]"
+
+#~ msgid "--symmetric --sign --encrypt [filename]"
+#~ msgstr "--symmetric --sign --encrypt [?????]"
+
+#~ msgid "--sign --symmetric [filename]"
+#~ msgstr "--sign --symmetric [?????]"
+
+#~ msgid "--clear-sign [filename]"
+#~ msgstr "--clear-sign [?????]"
+
+#~ msgid "--decrypt [filename]"
+#~ msgstr "--decrypt [?????]"
+
+#~ msgid "--sign-key user-id"
+#~ msgstr "--sign-key ???id"
+
+#~ msgid "--lsign-key user-id"
+#~ msgstr "--lsign-key ???id"
+
+#~ msgid "--edit-key user-id [commands]"
+#~ msgstr "--edit-key ???id [????]"
+
+#~ msgid "--passwd <user-id>"
+#~ msgstr "--passwd <???id>"
+
+#~ msgid "[filename]"
+#~ msgstr "[?????]"
+
 #~ msgid "shadowing the key failed: %s\n"
 #~ msgstr "??????????????: %s\n"
 

-----------------------------------------------------------------------

Summary of changes:
 po/ja.po | 153 +++++++++++++++++++++++++++++++++++++--------------------------
 1 file changed, 91 insertions(+), 62 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Dec 17 08:30:33 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Sat, 17 Dec 2016 08:30:33 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-146-gc3c6084
Message-ID: <E1cI9S0-0001S9-3Y@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c3c60843ea25213a1a6cbfd26e79b717ff2c2a60 (commit)
      from  b653e763c856dcefdd6755eb47e3702b3057ac56 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c3c60843ea25213a1a6cbfd26e79b717ff2c2a60
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Sat Dec 17 16:29:44 2016 +0900

    po: Fix Japanese translation.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/po/ja.po b/po/ja.po
index e393dba..2ee7d4c 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.1.16\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-12-17 14:34+0900\n"
+"PO-Revision-Date: 2016-12-17 16:29+0900\n"
 "Last-Translator: NIIBE Yutaka <gniibe at fsij.org>\n"
 "Language-Team: none\n"
 "Language: ja\n"
@@ -8102,7 +8102,7 @@ msgstr "'%s'?????????\n"
 
 #, c-format
 msgid "error parsing '%s'\n"
-msgstr "'%s'????????: %s\n"
+msgstr "'%s'????????\n"
 
 msgid "list all components"
 msgstr "?????????????????"

-----------------------------------------------------------------------

Summary of changes:
 po/ja.po | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Dec 17 21:59:55 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sat, 17 Dec 2016 21:59:55 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-147-ge77b924
Message-ID: <E1cIM5G-0005ml-KP@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e77b924fec1082faae48cdd2ff8474874a22bdf7 (commit)
      from  c3c60843ea25213a1a6cbfd26e79b717ff2c2a60 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e77b924fec1082faae48cdd2ff8474874a22bdf7
Author: Werner Koch <wk at gnupg.org>
Date:   Sat Dec 17 21:54:45 2016 +0100

    dirmngr: Fix setup of libdns for W32.
    
    * configure.ac (DNSLIB) {W32]: Add -liphlpapi.
    * dirmngr/dns-stuff.c [W32]: Include iphlpapi.h and define
    WIN32_LEAN_AND_MEAN.
    (libdns_init) [W32]: Use GetNetworkParams to get the nameserver.
    * dirmngr/t-dns-stuff.c (init_sockets): New.
    (main): Call it.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/configure.ac b/configure.ac
index 1c467bf..6630610 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1088,6 +1088,12 @@ if test "$build_dirmngr" = "yes"; then
     show_tor_support="${show_tor_support} (no system resolver)"
   fi
 
+  if test "$have_w32_system" = yes; then
+    if test "$use_libdns" = yes; then
+      DNSLIBS="$DNSLIBS -liphlpapi"
+    fi
+  fi
+
   LIBS=$_dns_save_libs
 fi
 
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 1fc81b2..eae674f 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -31,10 +31,12 @@
 #include <config.h>
 #include <sys/types.h>
 #ifdef HAVE_W32_SYSTEM
+# define WIN32_LEAN_AND_MEAN
 # ifdef HAVE_WINSOCK2_H
 #  include <winsock2.h>
 # endif
 # include <windows.h>
+# include <iphlpapi.h>
 #else
 # if HAVE_SYSTEM_RESOLVER
 #  include <netinet/in.h>
@@ -46,6 +48,7 @@
 #include <string.h>
 #include <unistd.h>
 
+
 /* William Ahern's DNS library, included as a source copy.  */
 #ifdef USE_LIBDNS
 # include "dns.h"
@@ -229,6 +232,8 @@ free_dns_addrinfo (dns_addrinfo_t ai)
     }
 }
 
+
+#ifndef HAVE_W32_SYSTEM
 /* Return H_ERRNO mapped to a gpg-error code.  Will never return 0. */
 static gpg_error_t
 get_h_errno_as_gpg_error (void)
@@ -245,7 +250,7 @@ get_h_errno_as_gpg_error (void)
     }
   return gpg_error (ec);
 }
-
+#endif /*!HAVE_W32_SYSTEM*/
 
 static gpg_error_t
 map_eai_to_gpg_error (int ec)
@@ -323,7 +328,6 @@ libdns_init (void)
   gpg_error_t err;
   struct libdns_s ld;
   int derr;
-  const char *fname;
   char *cfgstr = NULL;
 
   if (libdns.resolv_conf)
@@ -378,6 +382,47 @@ libdns_init (void)
     }
   else
     {
+#ifdef HAVE_W32_SYSTEM
+      ULONG ninfo_len;
+      PFIXED_INFO ninfo;
+      PIP_ADDR_STRING pip;
+      int idx;
+
+      ninfo_len = 2048;
+      ninfo = xtrymalloc (ninfo_len);
+      if (!ninfo)
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
+
+      if (GetNetworkParams (ninfo, &ninfo_len))
+        {
+          log_error ("GetNetworkParms failed: %s\n", w32_strerror (-1));
+          err = gpg_error (GPG_ERR_GENERAL);
+          xfree (ninfo);
+          goto leave;
+        }
+
+      for (idx=0, pip = &(ninfo->DnsServerList);
+           pip && idx < DIM (ld.resolv_conf->nameserver);
+           pip = pip->Next)
+        {
+          log_debug ("ninfo->dnsserver[%d] '%s'\n", idx, pip->IpAddress.String);
+          err = libdns_error_to_gpg_error
+            (dns_resconf_pton (&ld.resolv_conf->nameserver[idx],
+                               pip->IpAddress.String));
+          if (err)
+            log_error ("failed to set nameserver[%d] '%s': %s\n",
+                       idx, pip->IpAddress.String, gpg_strerror (err));
+          else
+            idx++;
+        }
+      xfree (ninfo);
+
+#else /* Unix */
+      const char *fname;
+
       fname = "/etc/resolv.conf";
       err = libdns_error_to_gpg_error
         (dns_resconf_loadpath (ld.resolv_conf, fname));
@@ -395,6 +440,8 @@ libdns_init (void)
           log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
           goto leave;
         }
+
+#endif /* Unix */
     }
 
   ld.hosts = dns_hosts_open (&derr);
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index 5315138..dd8e21e 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -33,6 +33,16 @@ static int verbose;
 static int debug;
 
 
+static void
+init_sockets (void)
+{
+#ifdef HAVE_W32_SYSTEM
+  WSADATA wsadat;
+
+  WSAStartup (0x202, &wsadat);
+#endif
+}
+
 
 int
 main (int argc, char **argv)
@@ -147,6 +157,8 @@ main (int argc, char **argv)
       exit (1);
     }
 
+  init_sockets ();
+
   if (opt_tor)
     {
       err = enable_dns_tormode (opt_new_circuit);

-----------------------------------------------------------------------

Summary of changes:
 configure.ac          |  6 ++++++
 dirmngr/dns-stuff.c   | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
 dirmngr/t-dns-stuff.c | 12 ++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 09:44:38 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 19 Dec 2016 09:44:38 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-148-ge384405
Message-ID: <E1cItYn-0003uV-85@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e384405b6e251629fb36bcbba4f5f9ac15a39d10 (commit)
      from  e77b924fec1082faae48cdd2ff8474874a22bdf7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e384405b6e251629fb36bcbba4f5f9ac15a39d10
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 09:41:15 2016 +0100

    Remove unused debug flags and add "dns" and "network".
    
    * g10/options.h (DBG_CARD_IO_VALUE, DBG_CARD_IO): Remove.
    * g10/gpg.c (debug_flags): Remove "cardio".
    * agent/agent.h (DBG_COMMAND_VALUE, DBG_COMMAND): Remove.
    * agent/gpg-agent.c (debug_flags): Remove "command".
    * scd/scdaemon.h (DBG_COMMAND_VALUE, DBG_COMMAND): Remove.
    * scd/scdaemon.c (debug_flags): Remove "command".
    * dirmngr/dirmngr.h (DBG_DNS_VALUE, DBG_DNS): New.
    (DBG_NETWORK_VALUE, DNG_NETWORK): New.
    * dirmngr/dirmngr.c (debug_flags): Add "dns" and "network".
    --
    
    Note that "dns" and "network" are not yet used but will soon be added
    to dirmngr.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/agent.h b/agent/agent.h
index 2dfbf5c..89dc46d 100644
--- a/agent/agent.h
+++ b/agent/agent.h
@@ -168,7 +168,6 @@ struct
 
 
 /* Bit values for the --debug option.  */
-#define DBG_COMMAND_VALUE 1	/* debug commands i/o */
 #define DBG_MPI_VALUE	  2	/* debug mpi details */
 #define DBG_CRYPTO_VALUE  4	/* debug low level crypto */
 #define DBG_MEMORY_VALUE  32	/* debug memory allocation stuff */
@@ -178,7 +177,6 @@ struct
 #define DBG_IPC_VALUE     1024  /* Enable Assuan debugging.  */
 
 /* Test macros for the debug option.  */
-#define DBG_COMMAND (opt.debug & DBG_COMMAND_VALUE)
 #define DBG_CRYPTO  (opt.debug & DBG_CRYPTO_VALUE)
 #define DBG_MEMORY  (opt.debug & DBG_MEMORY_VALUE)
 #define DBG_CACHE   (opt.debug & DBG_CACHE_VALUE)
diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 5e2e4bf..f4ed6c5 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -251,7 +251,6 @@ static ARGPARSE_OPTS opts[] = {
 /* The list of supported debug flags.  */
 static struct debug_flags_s debug_flags [] =
   {
-    { DBG_COMMAND_VALUE, "command"  },
     { DBG_MPI_VALUE    , "mpi"     },
     { DBG_CRYPTO_VALUE , "crypto"  },
     { DBG_MEMORY_VALUE , "memory"  },
@@ -520,10 +519,9 @@ set_debug (void)
   else if (!strcmp (debug_level, "basic") || (numok && numlvl <= 2))
     opt.debug = DBG_IPC_VALUE;
   else if (!strcmp (debug_level, "advanced") || (numok && numlvl <= 5))
-    opt.debug = DBG_IPC_VALUE|DBG_COMMAND_VALUE;
+    opt.debug = DBG_IPC_VALUE;
   else if (!strcmp (debug_level, "expert") || (numok && numlvl <= 8))
-    opt.debug = (DBG_IPC_VALUE|DBG_COMMAND_VALUE
-                 |DBG_CACHE_VALUE);
+    opt.debug = (DBG_IPC_VALUE | DBG_CACHE_VALUE);
   else if (!strcmp (debug_level, "guru") || numok)
     {
       opt.debug = ~0;
diff --git a/common/miscellaneous.c b/common/miscellaneous.c
index 9924943..c988975 100644
--- a/common/miscellaneous.c
+++ b/common/miscellaneous.c
@@ -480,6 +480,8 @@ gnupg_compare_version (const char *a, const char *b)
  *          supplied variable is updated by the parsed flags.
  *
  * If STRING is NULL the enabled debug flags are printed.
+ *
+ * See doc/DETAILS for a summary of used debug options.
  */
 int
 parse_debug_flag (const char *string, unsigned int *debugvar,
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index ef30d2c..0d896f1 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -257,6 +257,8 @@ static struct debug_flags_s debug_flags [] =
     { DBG_MEMSTAT_VALUE, "memstat" },
     { DBG_HASHING_VALUE, "hashing" },
     { DBG_IPC_VALUE    , "ipc"     },
+    { DBG_DNS_VALUE    , "dns"     },
+    { DBG_NETWORK_VALUE, "network" },
     { DBG_LOOKUP_VALUE , "lookup"  },
     { 77, NULL } /* 77 := Do not exit on "help" or "?".  */
   };
diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index da1c4be..9a87878 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -136,19 +136,23 @@ struct
 
 #define DBG_X509_VALUE    1	/* debug x.509 parsing */
 #define DBG_CRYPTO_VALUE  4	/* debug low level crypto */
+#define DBG_DNS_VALUE     16    /* debug DNS calls.  */
 #define DBG_MEMORY_VALUE  32	/* debug memory allocation stuff */
 #define DBG_CACHE_VALUE   64	/* debug the caching */
 #define DBG_MEMSTAT_VALUE 128	/* show memory statistics */
 #define DBG_HASHING_VALUE 512	/* debug hashing operations */
 #define DBG_IPC_VALUE     1024  /* debug assuan communication */
+#define DBG_NETWORK_VALUE 2048  /* debug network I/O.  */
 #define DBG_LOOKUP_VALUE  8192  /* debug lookup details */
 
 #define DBG_X509    (opt.debug & DBG_X509_VALUE)
 #define DBG_CRYPTO  (opt.debug & DBG_CRYPTO_VALUE)
+#define DBG_DNS     (opt.debug & DBG_DNS_VALUE)
 #define DBG_MEMORY  (opt.debug & DBG_MEMORY_VALUE)
 #define DBG_CACHE   (opt.debug & DBG_CACHE_VALUE)
 #define DBG_HASHING (opt.debug & DBG_HASHING_VALUE)
 #define DBG_IPC     (opt.debug & DBG_IPC_VALUE)
+#define DBG_NETWORK (opt.debug & DBG_NETWORK_VALUE)
 #define DBG_LOOKUP  (opt.debug & DBG_LOOKUP_VALUE)
 
 /* A simple list of certificate references. */
diff --git a/doc/DETAILS b/doc/DETAILS
index 00b55c5..568500e 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -1328,6 +1328,43 @@ Status codes are:
 
 
 
+* Debug flags
+
+This tables gives the flag values for the --debug option along with
+the alternative names used by the components.
+
+|       | gpg     | gpgsm   | agent   | scd     | dirmngr | g13     | wks     |
+|-------+---------+---------+---------+---------+---------+---------+---------|
+|     1 | packet  | x509    |         |         | x509    | mount   | mime    |
+|     2 | mpi     | mpi     | mpi     | mpi     |         |         | parser  |
+|     4 | crypto  | crypto  | crypto  | crypto  | crypto  | crypto  | crypto  |
+|     8 | filter  |         |         |         |         |         |         |
+|    16 | iobuf   |         |         |         | dns     |         |         |
+|    32 | memory  | memory  | memory  | memory  | memory  | memory  | memory  |
+|    64 | cache   | cache   | cache   | cache   | cache   |         |         |
+|   128 | memstat | memstat | memstat | memstat | memstat | memstat | memstat |
+|   256 | trust   |         |         |         |         |         |         |
+|   512 | hashing | hashing | hashing | hashing | hashing |         |         |
+|  1024 | ipc     | ipc     | ipc     | ipc     | ipc     | ipc     | ipc     |
+|  2048 |         |         |         | cardio  | network |         |         |
+|  4096 | clock   |         |         | reader  |         |         |         |
+|  8192 | lookup  |         |         |         | lookup  |         |         |
+| 16384 | extprog |         |         |         |         |         | extprog |
+
+Description of some debug flags:
+
+  - cardio :: Used by scdaemon to trace the APDUs exchange with the
+              card.
+  - clock  :: Show execution times of certain functions.
+  - crypto :: Trace crypto operations.
+  - hashing :: Create files with the hashed data.
+  - ipc :: Trace the Assuan commands.
+  - mpi :: Show the values of the MPIs.
+  - reader :: Used by scdaemon to trace card reader related code.  For
+              example: Open and close reader.
+
+
+
 * Miscellaneous notes
 
 ** v3 fingerprints
diff --git a/g10/gpg.c b/g10/gpg.c
index a8f731b..8c5b505 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -913,7 +913,6 @@ static struct debug_flags_s debug_flags [] =
     { DBG_MEMSTAT_VALUE, "memstat" },
     { DBG_TRUST_VALUE  , "trust"   },
     { DBG_HASHING_VALUE, "hashing" },
-    { DBG_CARD_IO_VALUE, "cardio"  },
     { DBG_IPC_VALUE    , "ipc"     },
     { DBG_CLOCK_VALUE  , "clock"   },
     { DBG_LOOKUP_VALUE , "lookup"  },
diff --git a/g10/options.h b/g10/options.h
index 2449042..589b68e 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -300,7 +300,6 @@ struct {
 #define DBG_TRUST_VALUE   256	/* debug the trustdb */
 #define DBG_HASHING_VALUE 512	/* debug hashing operations */
 #define DBG_IPC_VALUE     1024  /* debug assuan communication */
-#define DBG_CARD_IO_VALUE 2048  /* debug smart card I/O.  */
 #define DBG_CLOCK_VALUE   4096
 #define DBG_LOOKUP_VALUE  8192	/* debug the key lookup */
 #define DBG_EXTPROG_VALUE 16384 /* debug external program calls */
@@ -314,7 +313,6 @@ struct {
 #define DBG_TRUST  (opt.debug & DBG_TRUST_VALUE)
 #define DBG_HASHING (opt.debug & DBG_HASHING_VALUE)
 #define DBG_IPC     (opt.debug & DBG_IPC_VALUE)
-#define DBG_CARD_IO (opt.debug & DBG_CARD_IO_VALUE)
 #define DBG_IPC     (opt.debug & DBG_IPC_VALUE)
 #define DBG_CLOCK   (opt.debug & DBG_CLOCK_VALUE)
 #define DBG_LOOKUP  (opt.debug & DBG_LOOKUP_VALUE)
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 064cae9..38e3c40 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -165,7 +165,6 @@ static ARGPARSE_OPTS opts[] = {
 /* The list of supported debug flags.  */
 static struct debug_flags_s debug_flags [] =
   {
-    { DBG_COMMAND_VALUE, "command"  },
     { DBG_MPI_VALUE    , "mpi"     },
     { DBG_CRYPTO_VALUE , "crypto"  },
     { DBG_MEMORY_VALUE , "memory"  },
@@ -328,10 +327,9 @@ set_debug (const char *level)
   else if (!strcmp (level, "basic") || (numok && numlvl <= 2))
     opt.debug = DBG_IPC_VALUE;
   else if (!strcmp (level, "advanced") || (numok && numlvl <= 5))
-    opt.debug = DBG_IPC_VALUE|DBG_COMMAND_VALUE;
+    opt.debug = DBG_IPC_VALUE;
   else if (!strcmp (level, "expert") || (numok && numlvl <= 8))
-    opt.debug = (DBG_IPC_VALUE|DBG_COMMAND_VALUE
-                 |DBG_CACHE_VALUE|DBG_CARD_IO_VALUE);
+    opt.debug = (DBG_IPC_VALUE|DBG_CACHE_VALUE|DBG_CARD_IO_VALUE);
   else if (!strcmp (level, "guru") || numok)
     {
       opt.debug = ~0;
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 31e9c79..38aa490 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -65,7 +65,6 @@ struct
 } opt;
 
 
-#define DBG_COMMAND_VALUE 1	/* debug commands i/o */
 #define DBG_MPI_VALUE	  2	/* debug mpi details */
 #define DBG_CRYPTO_VALUE  4	/* debug low level crypto */
 #define DBG_MEMORY_VALUE  32	/* debug memory allocation stuff */
@@ -76,7 +75,6 @@ struct
 #define DBG_CARD_IO_VALUE 2048
 #define DBG_READER_VALUE  4096  /* Trace reader related functions.  */
 
-#define DBG_COMMAND (opt.debug & DBG_COMMAND_VALUE)
 #define DBG_CRYPTO  (opt.debug & DBG_CRYPTO_VALUE)
 #define DBG_MEMORY  (opt.debug & DBG_MEMORY_VALUE)
 #define DBG_CACHE   (opt.debug & DBG_CACHE_VALUE)

-----------------------------------------------------------------------

Summary of changes:
 agent/agent.h          |  2 --
 agent/gpg-agent.c      |  6 ++----
 common/miscellaneous.c |  2 ++
 dirmngr/dirmngr.c      |  2 ++
 dirmngr/dirmngr.h      |  4 ++++
 doc/DETAILS            | 37 +++++++++++++++++++++++++++++++++++++
 g10/gpg.c              |  1 -
 g10/options.h          |  2 --
 scd/scdaemon.c         |  6 ++----
 scd/scdaemon.h         |  2 --
 10 files changed, 49 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 10:36:49 2016
From: cvs at cvs.gnupg.org (by Raphael Kubo da Costa)
Date: Mon, 19 Dec 2016 10:36:49 +0100
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-5-g1acb06a
Message-ID: <E1cIuNH-0007CA-1d@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  1acb06aac3dd08f573d7c2e3be75226346e61ed2 (commit)
      from  cc0d783cf03a814df48c03ddcbb4d09115e9596d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1acb06aac3dd08f573d7c2e3be75226346e61ed2
Author: Raphael Kubo da Costa <rakuco at FreeBSD.org>
Date:   Sun Dec 18 11:41:33 2016 +0100

    Qt: Make sure extended grep is used with '|'.
    
    * m4/qt.m4: Use grep -E when using the alternation character.
    --
    
    POSIX specifies '|' is only supposed to work as an alternation special
    character when grep is used in extended mode. The code worked fine
    with GNU grep because it accepts extended regular expressions by
    default, but other POSIX-compliant implementations might fail and take
    it literally.
    
    Signed-off-by: Raphael Kubo da Costa <rakuco at FreeBSD.org>

diff --git a/m4/qt.m4 b/m4/qt.m4
index 90c4a6e..35d9ae2 100644
--- a/m4/qt.m4
+++ b/m4/qt.m4
@@ -60,18 +60,18 @@ AC_DEFUN([FIND_QT],
     AC_CHECK_TOOL(MOC, moc)
     AC_MSG_CHECKING([moc version])
     mocversion=`$MOC -v 2>&1`
-    mocversiongrep=`echo $mocversion | grep "Qt 5\|moc 5"`
+    mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc 5"`
     if test x"$mocversiongrep" != x"$mocversion"; then
       AC_MSG_RESULT([no])
       # moc was not the qt5 one, try with moc-qt5
       AC_CHECK_TOOL(MOC2, moc-qt5)
       mocversion=`$MOC2 -v 2>&1`
-      mocversiongrep=`echo $mocversion | grep "Qt 5\|moc-qt5 5\|moc 5"`
+      mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc-qt5 5|moc 5"`
       if test x"$mocversiongrep" != x"$mocversion"; then
         AC_CHECK_TOOL(QTCHOOSER, qtchooser)
         qt5tooldir=`QT_SELECT=qt5 qtchooser -print-env | grep QTTOOLDIR | cut -d '=' -f 2 | cut -d \" -f 2`
         mocversion=`$qt5tooldir/moc -v 2>&1`
-        mocversiongrep=`echo $mocversion | grep "Qt 5\|moc 5"`
+        mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc 5"`
         if test x"$mocversiongrep" != x"$mocversion"; then
           # no valid moc found
           have_qt5_libs="no";

-----------------------------------------------------------------------

Summary of changes:
 m4/qt.m4 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 10:36:58 2016
From: cvs at cvs.gnupg.org (by Raphael Kubo da Costa)
Date: Mon, 19 Dec 2016 10:36:58 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-15-g211844f
Message-ID: <E1cIuNP-0007D9-TX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  211844f049d714cd4d5aab96347705cb0c209c5d (commit)
      from  da5343a9d2c8c0ca6431162aac4bd5c73b4ae6dd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 211844f049d714cd4d5aab96347705cb0c209c5d
Author: Raphael Kubo da Costa <rakuco at FreeBSD.org>
Date:   Sun Dec 18 11:41:33 2016 +0100

    Qt: Make sure extended grep is used with '|'.
    
    * m4/qt.m4: Use grep -E when using the alternation character.
    --
    
    POSIX specifies '|' is only supposed to work as an alternation special
    character when grep is used in extended mode. The code worked fine
    with GNU grep because it accepts extended regular expressions by
    default, but other POSIX-compliant implementations might fail and take
    it literally.
    
    Signed-off-by: Raphael Kubo da Costa <rakuco at FreeBSD.org>

diff --git a/m4/qt.m4 b/m4/qt.m4
index e7aac41..700f4e0 100644
--- a/m4/qt.m4
+++ b/m4/qt.m4
@@ -32,18 +32,18 @@ AC_DEFUN([FIND_QT],
     AC_CHECK_TOOL(MOC, moc)
     AC_MSG_CHECKING([moc version])
     mocversion=`$MOC -v 2>&1`
-    mocversiongrep=`echo $mocversion | grep "Qt 5\|moc 5"`
+    mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc 5"`
     if test x"$mocversiongrep" != x"$mocversion"; then
       AC_MSG_RESULT([no])
       # moc was not the qt5 one, try with moc-qt5
       AC_CHECK_TOOL(MOC2, moc-qt5)
       mocversion=`$MOC2 -v 2>&1`
-      mocversiongrep=`echo $mocversion | grep "Qt 5\|moc-qt5 5\|moc 5"`
+      mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc-qt5 5|moc 5"`
       if test x"$mocversiongrep" != x"$mocversion"; then
         AC_CHECK_TOOL(QTCHOOSER, qtchooser)
         qt5tooldir=`QT_SELECT=qt5 qtchooser -print-env | grep QTTOOLDIR | cut -d '=' -f 2 | cut -d \" -f 2`
         mocversion=`$qt5tooldir/moc -v 2>&1`
-        mocversiongrep=`echo $mocversion | grep "Qt 5\|moc 5"`
+        mocversiongrep=`echo $mocversion | grep -E "Qt 5|moc 5"`
         if test x"$mocversiongrep" != x"$mocversion"; then
           # no valid moc found
           have_qt5_libs="no";

-----------------------------------------------------------------------

Summary of changes:
 m4/qt.m4 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 15:17:09 2016
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 19 Dec 2016 15:17:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-149-g026bbf0
Message-ID: <E1cIyka-0005Ii-CH@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  026bbf0d5ee4510967e5f1dd3db2dee4687b0612 (commit)
      from  e384405b6e251629fb36bcbba4f5f9ac15a39d10 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 026bbf0d5ee4510967e5f1dd3db2dee4687b0612
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Dec 19 15:10:44 2016 +0100

    speedo,w32: Use nsExec::ExecToLog to avoid popups
    
    * build-aux/speedo/w32/inst.nsi: Use ExecToLog instead of
    ExecWait.
    
    --
    nsExec is a standard nsis call to spawn a process and
    wait for it to finish. ExecToLog redirects stdout and stderr
    of the process call and adds it to the log window instead
    of opening a temporary console window.
    
    Signed-off-by: Andre Heinecke <aheinecke at intevation.de>

diff --git a/build-aux/speedo/w32/inst.nsi b/build-aux/speedo/w32/inst.nsi
index 24d5d4d..164e26b 100644
--- a/build-aux/speedo/w32/inst.nsi
+++ b/build-aux/speedo/w32/inst.nsi
@@ -545,15 +545,16 @@ Section "-gnupginst"
   # If we are reinstalling, try to kill a possible running gpa using
   # an already installed gpa.
   ifFileExists "$INSTDIR\bin\launch-gpa.exe"  0 no_uiserver
-    ExecWait '"$INSTDIR\bin\launch-gpa" --stop-server'
+    nsExec::ExecToLog '"$INSTDIR\bin\launch-gpa" "--stop-server"'
 
   no_uiserver:
 
   # If we are reinstalling, try to kill a possible running agent using
   # an already installed gpgconf.
+
   ifFileExists "$INSTDIR\bin\gpgconf.exe"  0 no_gpgconf
-    ExecWait '"$INSTDIR\bin\gpgconf" --kill dirmngr'
-    ExecWait '"$INSTDIR\bin\gpgconf" --kill gpg-agent'
+    nsExec::ExecToLog '"$INSTDIR\bin\gpgconf" "--kill" "dirmngr"'
+    nsExec::ExecToLog '"$INSTDIR\bin\gpgconf" "--kill" "gpg-agent"'
 
   no_gpgconf:
 
@@ -976,7 +977,7 @@ ${If} ${RunningX64}
   # RegDLL can't be used for 64 bit and InstallLib seems to be a
   # registry hack.
   ClearErrors
-  ExecWait '"$SYSDIR\regsvr32" /s "$INSTDIR\bin\gpgex6.dll"'
+  nsExec::ExecToLog '"$SYSDIR\regsvr32" "/s" "$INSTDIR\bin\gpgex6.dll"'
   ifErrors 0 +2
      MessageBox MB_OK "$(T_GPGEX_RegFailed) (64 bit)"
 
@@ -1007,11 +1008,11 @@ SectionEnd
 
 Section "-un.gnupglast"
   ifFileExists "$INSTDIR\bin\launch-gpa.exe"  0 no_uiserver
-    ExecWait '"$INSTDIR\bin\launch-gpa" --stop-server'
+    nsExec::ExecToLog '"$INSTDIR\bin\launch-gpa" "--stop-server"'
   no_uiserver:
   ifFileExists "$INSTDIR\bin\gpgconf.exe"  0 no_gpgconf
-    ExecWait '"$INSTDIR\bin\gpgconf" --kill gpg-agent'
-    ExecWait '"$INSTDIR\bin\gpgconf" --kill dirmngr'
+    nsExec::ExecToLog '"$INSTDIR\bin\gpgconf" "--kill" "gpg-agent"'
+    nsExec::ExecToLog '"$INSTDIR\bin\gpgconf" "--kill" "dirmngr"'
   no_gpgconf:
 SectionEnd
 
@@ -1021,7 +1022,7 @@ Section "-un.gpgex"
   Delete /REBOOTOK "$INSTDIR\bin\gpgex.dll"
 
 ${If} ${RunningX64}
-  ExecWait '"$SYSDIR\regsvr32" /u /s "$INSTDIR\bin\gpgex6.dll"'
+  nsExec::ExecToLog '"$SYSDIR\regsvr32" "/u" "/s" "$INSTDIR\bin\gpgex6.dll"'
   Delete /REBOOTOK "$INSTDIR\bin\gpgex6.dll"
 ${EndIf}
 SectionEnd

-----------------------------------------------------------------------

Summary of changes:
 build-aux/speedo/w32/inst.nsi | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 15:42:56 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 19 Dec 2016 15:42:56 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-154-ga76fe9e
Message-ID: <E1cIz9Y-0006F4-0E@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a76fe9e86d7802e67373218bd1759168585e92ab (commit)
       via  a1afc450e182af02ad5e6f6ba79e9dc4332ca2bc (commit)
       via  a45dc0849da0d944ec8c759bc8e3e733b1eb0079 (commit)
       via  3949cbd1128585c9b810713aeffaa1455fb5aed9 (commit)
       via  df00745d6eed7034b218a0c482a46d975425798a (commit)
      from  026bbf0d5ee4510967e5f1dd3db2dee4687b0612 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a76fe9e86d7802e67373218bd1759168585e92ab
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 15:40:16 2016 +0100

    doc: Clarify that delkey deletes public keys.
    
    --
    GnuPG-bug-id: 2878
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index e02c5c1..469e548 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -930,7 +930,8 @@ signing.
   @opindex keyedit:delkey
   Remove a subkey (secondary key). Note that it is not possible to retract
   a subkey, once it has been send to the public (i.e. to a keyserver).  In
-  that case you better use @code{revkey}.
+  that case you better use @code{revkey}.  Also note that this only
+  deletes the public part of a key.
 
   @item revkey
   @opindex keyedit:revkey

commit a1afc450e182af02ad5e6f6ba79e9dc4332ca2bc
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 15:33:55 2016 +0100

    tests: New test for --delete-[secret-]keys.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/defs.scm (keys): New variable.
    (have-public-key?): New function.
    (have-secret-key?): Likewise.
    (have-secret-key-file?): Likewise.
    * tests/openpgp/delete-keys.scm: New file.
    * tests/openpgp/quick-key-manipulation.scm: Move the accessors to
    'defs.scm'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index deed63d..0670531 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -90,6 +90,7 @@ XTESTS = \
 	ssh-export.scm \
 	quick-key-manipulation.scm \
 	key-selection.scm \
+	delete-keys.scm \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index ef81f99..7867080 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -35,6 +35,31 @@
 ;; first and then search for the encryption subkey.)
 (define dsa-usrname2 "0xCB879DE9")
 
+(define keys
+  (package
+   (define (new fpr grip uids subkeys)
+     (package))
+   (define (subkey fpr grip)
+     (package))
+   (define alfa (new "A0FF4590BB6122EDEF6E3C542D727CC768697734"
+		     "76F7E2B35832976B50A27A282D9B87E44577EB66"
+		     '("alfa at example.net" "alpha at example.net")
+		     (list
+		      (subkey "3B3FBC948FE59301ED629EFB6AE6D7EE46A871F8"
+			      "A0747D5F9425E6664F4FFBEED20FBCA79FDED2BD"))))
+   (define one (new "289B0EF1D105E124B6F626020EF77096D74C5F22"
+		    "50B2D4FA4122C212611048BC5FC31BD44393626E"
+		    '("one at example.com")
+		    (list
+		     (subkey "EB467DCA4AD7676A6A62B2ABABAB28A247BE2775"
+			     "7E201E28B6FEB2927B321F443205F4724EBE637E"))))
+   (define two (new "C1DEBB34EA8B71009EAFA474973D50E1C40FDECF"
+		    "343D8AF79796EE107D645A2787A9D9252F924E6F"
+		    '("two at example.com")
+		    (list
+		     (subkey "CD3D0F5701CBFCACB2A4907305A37887B27907AA"
+			     "8B5ABF3EF9EB8D96B91A0B8C2C4401C91C834C34"))))))
+
 (define key-file1 "samplekeys/rsa-rsa-sample-1.asc")
 (define key-file2 "samplekeys/ed25519-cv25519-sample-1.asc")
 
@@ -117,6 +142,30 @@
     (map (lambda (line) (string-split line #\:))
 	 (string-split-newlines s))))
 
+;; Convenient accessors for the colon output.
+(define (:type x)   (string->symbol (list-ref x 0)))
+(define (:length x) (string->number (list-ref x 2)))
+(define (:alg x) (string->number (list-ref x 3)))
+(define (:expire x) (list-ref x 6))
+(define (:fpr x) (list-ref x 9))
+(define (:cap x) (list-ref x 11))
+
+(define (have-public-key? key)
+  (catch #f
+	 (pair? (filter (lambda (l) (and (equal? 'fpr (:type l))
+					 (equal? key::fpr (:fpr l))))
+			(gpg-with-colons `(--list-keys ,key::fpr))))))
+
+(define (have-secret-key? key)
+  (catch #f
+	 (pair? (filter (lambda (l) (and (equal? 'fpr (:type l))
+					 (equal? key::fpr (:fpr l))))
+			(gpg-with-colons `(--list-secret-keys ,key::fpr))))))
+
+(define (have-secret-key-file? key)
+  (file-exists? (path-join (getenv "GNUPGHOME") "private-keys-v1.d"
+			   (string-append key::grip ".key"))))
+
 (define (get-config what)
   (string-split (caddar (gpg-with-colons `(--list-config ,what))) #\;))
 
diff --git a/tests/openpgp/delete-keys.scm b/tests/openpgp/delete-keys.scm
new file mode 100755
index 0000000..9a187a2
--- /dev/null
+++ b/tests/openpgp/delete-keys.scm
@@ -0,0 +1,103 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+(let* ((key keys::alfa)
+      (subkey (car key::subkeys)))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  (assert (have-secret-key? key))
+  (assert (have-secret-key-file? key))
+  (assert (have-secret-key? subkey))
+  (assert (have-secret-key-file? subkey))
+
+  ;; Firstly, delete the secret key.
+  (call-check `(, at gpg --delete-secret-keys ,key::fpr))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  (assert (not (have-secret-key? key)))
+  (assert (not (have-secret-key-file? key)))
+  (assert (not (have-secret-key? subkey)))
+  (assert (not (have-secret-key-file? subkey)))
+
+  ;; Now, delete the public key.
+  (call-check `(, at gpg --delete-keys ,key::fpr))
+  (assert (not (have-public-key? key)))
+  (assert (not (have-public-key? subkey))))
+
+;; Do the same for key one, but do the subkeys separately.
+(let* ((key keys::one)
+       (subkey (car key::subkeys)))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  (assert (have-secret-key? key))
+  (assert (have-secret-key-file? key))
+  (assert (have-secret-key-file? key))
+  (assert (have-secret-key? subkey))
+  (assert (have-secret-key-file? subkey))
+
+  ;; Firstly, delete the secret subkey.
+  (call-check `(, at gpg --delete-secret-keys ,subkey::fpr))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  ;; JW: Deleting the secret subkey also deletes the secret key.
+  ;; XXX (assert (have-secret-key? key))
+  ;; XXX (assert (have-secret-key-file? key))
+  (assert (not (have-secret-key? subkey)))
+  (assert (not (have-secret-key-file? subkey)))
+
+  ;; Then, delete the secret key.
+  ;; XXX (call-check `(, at gpg --delete-secret-keys ,key::fpr))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  (assert (not (have-secret-key? key)))
+  (assert (not (have-secret-key-file? key)))
+  (assert (not (have-secret-key? subkey)))
+  (assert (not (have-secret-key-file? subkey)))
+
+  ;; Now, delete the public subkey.
+  (call-check `(, at gpg --delete-keys ,subkey::fpr))
+  ;; JW: Deleting the subkey also deletes the key.
+  ;; XXX (assert (have-public-key? key))
+  (assert (not (have-public-key? subkey)))
+
+  ;; Now, delete the public key.
+  ;; XXX (call-check `(, at gpg --delete-keys ,key::fpr))
+  (assert (not (have-public-key? key)))
+  (assert (not (have-public-key? subkey))))
+
+(let* ((key keys::two)
+      (subkey (car key::subkeys)))
+  (assert (have-public-key? key))
+  (assert (have-public-key? subkey))
+  (assert (have-secret-key? key))
+  (assert (have-secret-key-file? key))
+  (assert (have-secret-key? subkey))
+  (assert (have-secret-key-file? subkey))
+
+  ;; Delete everything at once.
+  (call-check `(, at gpg --delete-secret-and-public-key ,key::fpr))
+  (assert (not (have-public-key? key)))
+  (assert (not (have-public-key? subkey)))
+  (assert (not (have-secret-key? key)))
+  (assert (not (have-secret-key-file? key)))
+  (assert (not (have-secret-key? subkey)))
+  (assert (not (have-secret-key-file? subkey))))
diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
index 9b9c919..d43f7b5 100755
--- a/tests/openpgp/quick-key-manipulation.scm
+++ b/tests/openpgp/quick-key-manipulation.scm
@@ -27,13 +27,6 @@
 (define (exact id)
   (string-append "=" id))
 
-;; Convenient accessors for the colon output.
-(define (:length x) (string->number (list-ref x 2)))
-(define (:alg x) (string->number (list-ref x 3)))
-(define (:expire x) (list-ref x 6))
-(define (:fpr x) (list-ref x 9))
-(define (:cap x) (list-ref x 11))
-
 (define (count-uids-of-secret-key id)
   (length (filter (lambda (x) (and (string=? "uid" (car x))
 				   (not (string=? "r" (cadr x)))))

commit a45dc0849da0d944ec8c759bc8e3e733b1eb0079
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 15:29:07 2016 +0100

    gpgscm: Change associativity of ::.
    
    * tests/gpgscm/scheme.c (mk_atom): Change associativity of the ::
    infix-operator.  This makes it possible to naturally express accessing
    nested structures (e.g. a::b::c).
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 3abe12a..a5b7691 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -1409,14 +1409,23 @@ static pointer mk_atom(scheme *sc, char *q) {
      int has_fp_exp = 0;
 
 #if USE_COLON_HOOK
-     if((p=strstr(q,"::"))!=0) {
+     char *next;
+     next = p = q;
+     while ((next = strstr(next, "::")) != 0) {
+	  /* Keep looking for the last occurrence.  */
+	  p = next;
+	  next = next + 2;
+     }
+
+     if (p != q) {
           *p=0;
           return cons(sc, sc->COLON_HOOK,
                           cons(sc,
                               cons(sc,
                                    sc->QUOTE,
-                                   cons(sc, mk_atom(sc,p+2), sc->NIL)),
-                              cons(sc, mk_symbol(sc,strlwr(q)), sc->NIL)));
+                                   cons(sc, mk_symbol(sc, strlwr(p + 2)),
+					sc->NIL)),
+                              cons(sc, mk_atom(sc, q), sc->NIL)));
      }
 #endif
 

commit 3949cbd1128585c9b810713aeffaa1455fb5aed9
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 15:28:07 2016 +0100

    gpgscm: Display location when assertions fail.
    
    * tests/gpgscm/lib.scm (assert): Use location information if
    available.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/lib.scm b/tests/gpgscm/lib.scm
index fabbef8..6959aa4 100644
--- a/tests/gpgscm/lib.scm
+++ b/tests/gpgscm/lib.scm
@@ -18,13 +18,16 @@
 ;; along with this program; if not, see <http://www.gnu.org/licenses/>.
 
 (macro (assert form)
-  `(if (not ,(cadr form))
-       (begin
-	 (display "Assertion failed: ")
-	 (write (quote ,(cadr form)))
-	 (newline)
-	 (exit 1))))
+  (let ((tag (get-tag form)))
+    `(if (not ,(cadr form))
+	 (throw ,(if (pair? tag)
+		     `(string-append ,(car tag) ":"
+				     ,(number->string (+ 1 (cdr tag)))
+				     ": Assertion failed: ")
+		     "Assertion failed: ")
+		(quote ,(cadr form))))))
 (assert #t)
+(assert (not #f))
 
 (define (filter pred lst)
   (cond ((null? lst) '())

commit df00745d6eed7034b218a0c482a46d975425798a
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 15:25:52 2016 +0100

    gpgscm: Make exception handling more robust.
    
    * tests/gpgscm/init.scm (throw'): Check that args is a list.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/init.scm b/tests/gpgscm/init.scm
index 04f088c..106afd5 100644
--- a/tests/gpgscm/init.scm
+++ b/tests/gpgscm/init.scm
@@ -597,7 +597,8 @@
   (cond
    ((more-handlers?)
     ((pop-handler) message args history))
-   ((and args (= 2 (length args)) (equal? *interpreter-exit* (car args)))
+   ((and args (list? args) (= 2 (length args))
+	 (equal? *interpreter-exit* (car args)))
     (*run-atexit-handlers*)
     (quit (cadr args)))
    (else

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi                             |   3 +-
 tests/gpgscm/init.scm                    |   3 +-
 tests/gpgscm/lib.scm                     |  15 +++--
 tests/gpgscm/scheme.c                    |  15 ++++-
 tests/openpgp/Makefile.am                |   1 +
 tests/openpgp/defs.scm                   |  49 +++++++++++++++
 tests/openpgp/delete-keys.scm            | 103 +++++++++++++++++++++++++++++++
 tests/openpgp/quick-key-manipulation.scm |   7 ---
 8 files changed, 178 insertions(+), 18 deletions(-)
 create mode 100755 tests/openpgp/delete-keys.scm


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 16:06:19 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 19 Dec 2016 16:06:19 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-155-gaec89a7
Message-ID: <E1cIzW9-0007dV-EX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  aec89a7297bae30f79a63fdc830530e82bab6170 (commit)
      from  a76fe9e86d7802e67373218bd1759168585e92ab (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit aec89a7297bae30f79a63fdc830530e82bab6170
Author: Neal H. Walfield <neal at g10code.com>
Date:   Mon Dec 19 15:59:56 2016 +0100

    test: Extend TOFU tests to also check the days with signatures.
    
    * tests/openpgp/tofu.scm (GPGTIME): Define the "standard" base time.
    (faketime): New function.
    (days->seconds): Likewise.
    (GPG): Use faketime.
    (check-counts): Also check the number of expected days with signatures
    and encryptions.  Update callers.  Extend tests.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index 47c3dd0..20c130a 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -20,9 +20,16 @@
 (load (with-path "defs.scm"))
 (setup-environment)
 
+(define GPGTIME 1480943782)
+
+;; Generate a --faked-system-time parameter for a particular offset.
+(define (faketime delta)
+  (string-append "--faked-system-time=" (number->string (+ GPGTIME delta))))
+;; A convenience function for the above.
+(define (days->seconds days) (* days 24 60 60))
+
 ;; Redefine GPG without --always-trust and a fixed time.
-(define GPG `(,(tool 'gpg) --no-permission-warning
-	      --faked-system-time=1480943782))
+(define GPG `(,(tool 'gpg) --no-permission-warning ,(faketime GPGTIME)))
 (define GNUPGHOME (getenv "GNUPGHOME"))
 (if (string=? "" GNUPGHOME)
     (fail "GNUPGHOME not set"))
@@ -168,58 +175,107 @@
 
 (display "Checking TOFU stats...\n")
 
-(define (check-counts keyid expected-sigs expected-encs . args)
+(define (check-counts keyid expected-sigs expected-sig-days
+                      expected-encs expected-enc-days . args)
   (let*
       ((tfs (assoc "tfs"
                    (gpg-with-colons
                     `(--trust-model=tofu --with-tofu-info
                                          , at args --list-keys ,keyid))))
        (sigs (string->number (list-ref tfs 3)))
-       (encs (string->number (list-ref tfs 4))))
+       (sig-days (string->number (list-ref tfs 11)))
+       (encs (string->number (list-ref tfs 4)))
+       (enc-days (string->number (list-ref tfs 12)))
+       )
+    ; (display keyid) (display ": ") (display tfs) (display "\n")
     (unless (= sigs expected-sigs)
             (fail keyid ": # signatures (" sigs ") does not match expected"
                    "# signatures (" expected-sigs ").\n"))
+    (unless (= sig-days expected-sig-days)
+            (fail keyid ": # signature days (" sig-days ")"
+                  "does not match expected"
+                  "# signature days (" expected-sig-days ").\n"))
     (unless (= encs expected-encs)
             (fail keyid ": # encryptions (" encs ") does not match expected"
                    "# encryptions (" expected-encs ").\n"))
+    (unless (= enc-days expected-enc-days)
+            (fail keyid ": # encryption days (" encs ")"
+                  "does not match expected"
+                  "# encryption days (" expected-enc-days ").\n"))
     ))
 
 ;; Carefully remove the TOFU db.
 (catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
 
-(check-counts "1C005AF3" 0 0)
-(check-counts "BE04EB2B" 0 0)
-(check-counts "B662E42F" 0 0)
+(check-counts "1C005AF3" 0 0 0 0)
+(check-counts "BE04EB2B" 0 0 0 0)
+(check-counts "B662E42F" 0 0 0 0)
 
 ;; Verify a message.  The signature count should increase by 1.
 (call-check `(, at GPG --trust-model=tofu
 		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-1.txt")))
-(check-counts "1C005AF3" 1 0)
+
+(check-counts "1C005AF3" 1 1 0 0)
 
 ;; Verify the same message.  The signature count should remain the
 ;; same.
 (call-check `(, at GPG --trust-model=tofu
 		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-1.txt")))
-(check-counts "1C005AF3" 1 0)
+(check-counts "1C005AF3" 1 1 0 0)
 
 ;; Verify another message.
 (call-check `(, at GPG --trust-model=tofu
 		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-2.txt")))
-(check-counts "1C005AF3" 2 0)
+(check-counts "1C005AF3" 2 1 0 0)
 
 ;; Verify another message.
 (call-check `(, at GPG --trust-model=tofu
 		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-3.txt")))
-(check-counts "1C005AF3" 3 0)
+(check-counts "1C005AF3" 3 1 0 0)
 
 ;; Verify a message from a different sender.  The signature count
 ;; should increase by 1 for that key.
 (call-check `(, at GPG --trust-model=tofu
 		    --verify ,(in-srcdir "tofu/conflicting/BE04EB2B-1.txt")))
-(check-counts "1C005AF3" 3 0)
-(check-counts "BE04EB2B" 1 0)
-(check-counts "B662E42F" 0 0)
-
+(check-counts "1C005AF3" 3 1 0 0)
+(check-counts "BE04EB2B" 1 1 0 0)
+(check-counts "B662E42F" 0 0 0 0)
+
+;; Verify another message on a new day.  (Recall: we are interested in
+;; when the message was first verified, not when the signer claimed
+;; that it was signed.)
+(call-check `(, at GPG --trust-model=tofu ,(faketime (days->seconds 2))
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-4.txt")))
+(check-counts "1C005AF3" 4 2 0 0)
+(check-counts "BE04EB2B" 1 1 0 0)
+(check-counts "B662E42F" 0 0 0 0)
+
+;; And another.
+(call-check `(, at GPG --trust-model=tofu ,(faketime (days->seconds 2))
+		    --verify ,(in-srcdir "tofu/conflicting/1C005AF3-5.txt")))
+(check-counts "1C005AF3" 5 2 0 0)
+(check-counts "BE04EB2B" 1 1 0 0)
+(check-counts "B662E42F" 0 0 0 0)
+
+;; Another, but for a different key.
+(call-check `(, at GPG --trust-model=tofu ,(faketime (days->seconds 2))
+		    --verify ,(in-srcdir "tofu/conflicting/BE04EB2B-2.txt")))
+(check-counts "1C005AF3" 5 2 0 0)
+(check-counts "BE04EB2B" 2 2 0 0)
+(check-counts "B662E42F" 0 0 0 0)
+
+;; And add a third day.
+(call-check `(, at GPG --trust-model=tofu ,(faketime (days->seconds 4))
+		    --verify ,(in-srcdir "tofu/conflicting/BE04EB2B-3.txt")))
+(check-counts "1C005AF3" 5 2 0 0)
+(check-counts "BE04EB2B" 3 3 0 0)
+(check-counts "B662E42F" 0 0 0 0)
+
+(call-check `(, at GPG --trust-model=tofu ,(faketime (days->seconds 4))
+		    --verify ,(in-srcdir "tofu/conflicting/BE04EB2B-4.txt")))
+(check-counts "1C005AF3" 5 2 0 0)
+(check-counts "BE04EB2B" 4 3 0 0)
+(check-counts "B662E42F" 0 0 0 0)
 
 ;; Check that we detect the following attack:
 ;;

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/tofu.scm | 86 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 71 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 16:43:19 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 19 Dec 2016 16:43:19 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-158-g63c7bf1
Message-ID: <E1cJ05z-0000d8-3y@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  63c7bf1a62d1d801c79a75fdb2ef7d7cac68e1d1 (commit)
       via  10dae1518633760db28e6f46cd0c6f4b6123013a (commit)
       via  d51499fdc522a696f23c6776c3ab248742f4e06a (commit)
      from  aec89a7297bae30f79a63fdc830530e82bab6170 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 63c7bf1a62d1d801c79a75fdb2ef7d7cac68e1d1
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 16:29:44 2016 +0100

    po: Some updates to the German translation.
    
    --

diff --git a/po/de.po b/po/de.po
index 3af9918..a93bf7a 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.1.0\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-11-18 15:40+0100\n"
+"PO-Revision-Date: 2016-12-18 20:17+0100\n"
 "Last-Translator: Werner Koch <wk at gnupg.org>\n"
 "Language-Team: German <de at li.org>\n"
 "Language: de\n"
@@ -1825,6 +1825,9 @@ msgstr "Schnell eine neue User-ID anf?gen"
 msgid "quickly revoke a user-id"
 msgstr "Schnell eine User-ID widerrufen"
 
+msgid "quickly set a new expiration date"
+msgstr "Schnell ein neues Ablaufdatum setzen"
+
 msgid "full featured key pair generation"
 msgstr "Ein neues Schl?sselpaar erzeugen (alle Optionen)"
 
@@ -1934,7 +1937,7 @@ msgid ""
 "Examples:\n"
 "\n"
 " -se -r Bob [file]          sign and encrypt for user Bob\n"
-" --clear-sign [file]         make a clear text signature\n"
+" --clear-sign [file]        make a clear text signature\n"
 " --detach-sign [file]       make a detached signature\n"
 " --list-keys [names]        show keys\n"
 " --fingerprint [names]      show fingerprints\n"
@@ -1943,7 +1946,7 @@ msgstr ""
 "Beispiele:\n"
 "\n"
 " -se -r Bob [Datei]         Signieren und verschl?sseln f?r Benutzer Bob\n"
-" --clear-sign [Datei]        Eine Klartextsignatur erzeugen\n"
+" --clear-sign [Datei]       Eine Klartextsignatur erzeugen\n"
 " --detach-sign [Datei]      Eine abgetrennte Signatur erzeugen\n"
 " --list-keys [Namen]        Schl?ssel anzeigen\n"
 " --fingerprint [Namen]      \"Fingerabdr?cke\" anzeigen\n"
@@ -3414,6 +3417,10 @@ msgstr "Keine passende User-ID"
 msgid "Nothing to sign.\n"
 msgstr "Nichts zu beglaubigen\n"
 
+#, c-format
+msgid "'%s' is not a valid expiration time\n"
+msgstr "'%s' ist kein g?ltiges Ablaufdatum\n"
+
 msgid "Digest: "
 msgstr "Digest: "
 
@@ -5536,6 +5543,14 @@ msgstr ""
 msgid "unsupported TOFU database version: %s\n"
 msgstr "Nicht unterst?tzte TOFU Datenbank Version: %s\n"
 
+#, fuzzy, c-format
+#| msgid "error creating temporary file: %s\n"
+msgid "error creating 'ultimately_trusted_keys' TOFU table: %s\n"
+msgstr "Fehler beim Erstellen einer tempor?ren Datei: %s\n"
+
+msgid "TOFU DB error"
+msgstr "TOFU (Trust on First Use) database error"
+
 #, c-format
 msgid "error reading TOFU database: %s\n"
 msgstr "Fehler beim Lesen der TOFU Datenbank: %s\n"

commit 10dae1518633760db28e6f46cd0c6f4b6123013a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 16:27:21 2016 +0100

    typo: Fix a string in do_we_trust_pre.
    
    --

diff --git a/g10/pkclist.c b/g10/pkclist.c
index 0426da8..288affc 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -481,7 +481,7 @@ do_we_trust_pre( PKT_public_key *pk, unsigned int trustlevel )
 
       if ((trustlevel & TRUST_MASK) == TRUST_NEVER)
         tty_printf(
-          _("This key has is bad!  It has been marked as untrusted!  If you\n"
+          _("This key is bad!  It has been marked as untrusted!  If you\n"
             "*really* know what you are doing, you may answer the next\n"
             "question with yes.\n"));
       else

commit d51499fdc522a696f23c6776c3ab248742f4e06a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 16:37:50 2016 +0100

    dirmngr,w32: Hack around a select problem.
    
    * dirmngr/dns.c (FD_SETSIZE): Bump up to 1024.
    (dns_poll): Return an error instead of hitting an assertion failure.
    --
    
    For unknown reasons socket() return fd with values 244, 252, 268.  The
    latter is above the FD_SETSIZE of 256.  It seems that select has been
    build with a highler FD_SETSIZE limit.  Bump up to a reasonable large
    value.
    
    A better solution would be to grab some code from npth_eselect to
    replace select.  We could also use npth_eselect direclty in
    dns-stuff.c instead of using dns_res_poll.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index de7fa72..4b61b72 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -50,7 +50,7 @@
 
 #if _WIN32
 #ifndef FD_SETSIZE
-#define FD_SETSIZE 256
+#define FD_SETSIZE 1024
 #endif
 #include <winsock2.h>
 #include <ws2tcpip.h>
@@ -1107,7 +1107,8 @@ static int dns_poll(int fd, short events, int timeout) {
 	if (!events)
 		return 0;
 
-	assert(fd >= 0 && (unsigned)fd < FD_SETSIZE);
+        if (fd < 0 || (unsigned)fd >= FD_SETSIZE)
+          return EINVAL;
 
 	FD_ZERO(&rset);
 	FD_ZERO(&wset);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns.c |  5 +++--
 g10/pkclist.c |  2 +-
 po/de.po      | 21 ++++++++++++++++++---
 3 files changed, 22 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 17:51:26 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 19 Dec 2016 17:51:26 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-160-g65a0d6a
Message-ID: <E1cJ19s-0003tk-NR@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  65a0d6a24e6299682793f213a9d2bae17c5b12d9 (commit)
       via  0bf16d702665a269ce5ef724c927fbbd8f7f1ce9 (commit)
      from  63c7bf1a62d1d801c79a75fdb2ef7d7cac68e1d1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 65a0d6a24e6299682793f213a9d2bae17c5b12d9
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 17:28:43 2016 +0100

    tests: Use the common test framework for the migration tests.
    
    * tests/migrations/Makefile.am (reqired_pgms): Add 'gpgscm'.
    (TESTS_ENVIRONMENT): Populate.
    (TESTS): Rename to 'XTESTS'.
    (xcheck): New target.
    (EXTRA_DIST): Add new files.
    (CLEANFILES): Remove log files.
    * tests/migrations/common.scm: Honor 'verbose', fix paths.
    * tests/migrations/run-tests.scm: New file.
    * tests/migrations/setup.scm: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/migrations/Makefile.am b/tests/migrations/Makefile.am
index 2773969..d0cd9ee 100644
--- a/tests/migrations/Makefile.am
+++ b/tests/migrations/Makefile.am
@@ -20,7 +20,8 @@
 
 # Programs required before we can run these tests.
 required_pgms = ../../g10/gpg$(EXEEXT) ../../agent/gpg-agent$(EXEEXT) \
-	../../tools/gpgtar$(EXEEXT)
+	../../tools/gpgtar$(EXEEXT) \
+	../gpgscm/gpgscm$(EXEEXT)
 
 AM_CPPFLAGS = -I$(top_srcdir)/common
 include $(top_srcdir)/am/cmacros.am
@@ -30,11 +31,14 @@ AM_CFLAGS =
 TMP ?= /tmp
 
 TESTS_ENVIRONMENT = GPG_AGENT_INFO= LC_ALL=C \
+	EXEEXT=$(EXEEXT) \
 	PATH=../gpgscm:$(PATH) \
 	TMP=$(TMP) \
-	GPGSCM_PATH=$(top_srcdir)/tests/gpgscm:$(top_srcdir)/tests/migrations
+	srcdir=$(abs_srcdir) \
+	objdir=$(abs_top_builddir) \
+	GPGSCM_PATH=$(abs_top_srcdir)/tests/gpgscm:$(abs_top_srcdir)/tests/migrations
 
-TESTS = from-classic.scm \
+XTESTS = from-classic.scm \
 	extended-pkf.scm \
 	issue2276.scm
 
@@ -42,17 +46,22 @@ TEST_FILES = from-classic.tar.asc \
 	     extended-pkf.tar.asc \
 	     issue2276.tar.asc
 
-EXTRA_DIST = common.scm $(TESTS) $(TEST_FILES)
+# XXX: Currently, one cannot override automake's 'check' target.  As a
+# workaround, we avoid defining 'TESTS', thus automake will not emit
+# the 'check' target.  For extra robustness, we merely define a
+# dependency on 'xcheck', so this hack should also work even if
+# automake would emit the 'check' target, as adding dependencies to
+# targets is okay.
+check: xcheck
 
-CLEANFILES = prepared.stamp x y yy z out err  $(data_files) \
-	     plain-1 plain-2 plain-3 trustdb.gpg *.lock .\#lk* \
-	     *.test.log gpg_dearmor gpg.conf gpg-agent.conf S.gpg-agent \
-	     pubring.gpg pubring.gpg~ pubring.kbx pubring.kbx~ \
-	     secring.gpg pubring.pkr secring.skr \
-	     gnupg-test.stop random_seed gpg-agent.log tofu.db
+.PHONY: xcheck
+xcheck:
+	$(TESTS_ENVIRONMENT) $(abs_top_builddir)/tests/gpgscm/gpgscm \
+	  run-tests.scm $(TESTFLAGS) $(XTESTS)
 
-clean-local:
-	-rm -rf from-classic.gpghome/*.gpg
+EXTRA_DIST = common.scm run-tests.scm setup.scm $(XTESTS) $(TEST_FILES)
+
+CLEANFILES = *.log
 
 # We need to depend on a couple of programs so that the tests don't
 # start before all programs are built.
diff --git a/tests/migrations/common.scm b/tests/migrations/common.scm
index 944d4f6..30ac62b 100644
--- a/tests/migrations/common.scm
+++ b/tests/migrations/common.scm
@@ -18,14 +18,16 @@
 (if (string=? "" (getenv "srcdir"))
     (error "not called from make"))
 
-(setenv "GNUPGHOME" "" #t)
+(let ((verbose (string->number (getenv "verbose"))))
+  (if (number? verbose)
+      (*set-verbose!* verbose)))
 
 (define (qualify executable)
   (string-append executable (getenv "EXEEXT")))
 
 ;; We may not use a relative name for gpg-agent.
-(define GPG-AGENT (qualify (string-append (getcwd) "/../../agent/gpg-agent")))
-(define GPG `(,(qualify (string-append (getcwd) "/../../g10/gpg"))
+(define GPG-AGENT (path-join (getenv "objdir") "agent" (qualify "gpg-agent")))
+(define GPG `(,(path-join (getenv "objdir") "g10" (qualify "gpg"))
 	      --no-permission-warning --no-greeting
 	      --no-secmem-warning --batch
 	      ,(string-append "--agent-program=" GPG-AGENT
@@ -33,7 +35,7 @@
 (define GPG-no-batch
   (filter (lambda (arg) (not (equal? arg '--batch))) GPG))
 
-(define GPGTAR (qualify (string-append (getcwd) "/../../tools/gpgtar")))
+(define GPGTAR (path-join (getenv "objdir") "tools" (qualify "gpgtar")))
 
 (define (untar-armored source-name)
   (pipe:do
diff --git a/tests/migrations/run-tests.scm b/tests/migrations/run-tests.scm
new file mode 100644
index 0000000..069af5b
--- /dev/null
+++ b/tests/migrations/run-tests.scm
@@ -0,0 +1,26 @@
+;; Test-suite runner.
+;;
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(let* ((tests (filter (lambda (arg) (not (string-prefix? arg "--"))) *args*))
+       (runner (if (and (member "--parallel" *args*)
+			(> (length tests) 1))
+		   run-tests-parallel
+		   run-tests-sequential)))
+  (runner (test::scm "setup.scm" "setup.scm")
+	  (map (lambda (t) (test::scm t t)) tests)))
diff --git a/tests/migrations/setup.scm b/tests/migrations/setup.scm
new file mode 100644
index 0000000..76a5840
--- /dev/null
+++ b/tests/migrations/setup.scm
@@ -0,0 +1,20 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2016 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+;; Nothing to do for now.

commit 0bf16d702665a269ce5ef724c927fbbd8f7f1ce9
Author: Justus Winter <justus at g10code.com>
Date:   Mon Dec 19 17:23:56 2016 +0100

    tests: Use sequential test runner if only one test is given.
    
    * tests/openpgp/run-tests.scm: Use sequential test runner if only one
    test is given.
    --
    
    This allows one to set the environment variable TESTFLAGS to
    '--parallel' and enjoy faster test execution times without interfering
    with stdio when one works on a single test.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/run-tests.scm b/tests/openpgp/run-tests.scm
index 4146411..546d7d4 100644
--- a/tests/openpgp/run-tests.scm
+++ b/tests/openpgp/run-tests.scm
@@ -26,9 +26,10 @@
 ;; Set objdir so that the tests can locate built programs.
 (setenv "objdir" (getcwd) #f)
 
-(let* ((runner (if (member "--parallel" *args*)
+(let* ((tests (filter (lambda (arg) (not (string-prefix? arg "--"))) *args*))
+       (runner (if (and (member "--parallel" *args*)
+			(> (length tests) 1))
 		   run-tests-parallel
-		   run-tests-sequential))
-       (tests (filter (lambda (arg) (not (string-prefix? arg "--"))) *args*)))
+		   run-tests-sequential)))
   (runner (test::scm "setup.scm" "setup.scm")
 	  (map (lambda (t) (test::scm t t)) tests)))

-----------------------------------------------------------------------

Summary of changes:
 tests/migrations/Makefile.am                       | 33 ++++++++++++++--------
 tests/migrations/common.scm                        | 10 ++++---
 .../decrypt.scm => migrations/run-tests.scm}       | 22 ++++++---------
 .../{openpgp/version.scm => migrations/setup.scm}  |  7 +----
 tests/openpgp/run-tests.scm                        |  7 +++--
 5 files changed, 41 insertions(+), 38 deletions(-)
 copy tests/{openpgp/decrypt.scm => migrations/run-tests.scm} (68%)
 mode change 100755 => 100644
 copy tests/{openpgp/version.scm => migrations/setup.scm} (81%)
 mode change 100755 => 100644


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 18:37:59 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 19 Dec 2016 18:37:59 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-161-g284ec54
Message-ID: <E1cJ1sv-0005uy-Rt@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  284ec54495dddc9eb0232e959cf994234097578a (commit)
      from  65a0d6a24e6299682793f213a9d2bae17c5b12d9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 284ec54495dddc9eb0232e959cf994234097578a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 18:34:24 2016 +0100

    build: Add target to sign the windows installer.
    
    * build-aux/speedo.mk (w32-sign-installer): New.
    (AUTHENTICODE_KEY): New.
    (installer-from-source): Use cp instead of mv.  Factor code out to ...
    (MKSWDB_commands): new macro.
    (sign-installer): New.
    --
    
    Obviously this is more convenient then doing this all by hand.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/build-aux/speedo.mk b/build-aux/speedo.mk
index fbe258c..8a366e6 100644
--- a/build-aux/speedo.mk
+++ b/build-aux/speedo.mk
@@ -52,12 +52,13 @@ SPEEDO_MK := $(realpath $(lastword $(MAKEFILE_LIST)))
 help:
 	@echo 'usage: make -f speedo.mk TARGET'
 	@echo '       with TARGET being one of:'
-	@echo '  help           This help'
-	@echo '  native         Native build of the GnuPG core'
-	@echo '  native-gui     Ditto but with pinentry and GPA'
-	@echo '  w32-installer  Build a Windows installer'
-	@echo '  w32-source     Pack a source archive'
-	@echo '  w32-release    Build a Windows release'
+	@echo '  help               This help'
+	@echo '  native             Native build of the GnuPG core'
+	@echo '  native-gui         Ditto but with pinentry and GPA'
+	@echo '  w32-installer      Build a Windows installer'
+	@echo '  w32-source         Pack a source archive'
+	@echo '  w32-release        Build a Windows release'
+	@echo '  w32-sign-installer Sign the installer'
 	@echo
 	@echo 'You may append INSTALL_PREFIX=<dir> for native builds.'
 	@echo 'Prepend TARGET with "git-" to build from GIT repos.'
@@ -109,6 +110,10 @@ w32-release: check-tools
 	$(SPEEDOMAKE) TARGETOS=w32 WHAT=release    WITH_GUI=0 SELFCHECK=0 \
                                                    installer-from-source
 
+w32-sign-installer: check-tools
+	$(SPEEDOMAKE) TARGETOS=w32 WHAT=release    WITH_GUI=0 SELFCHECK=0 \
+                                                   sign-installer
+
 w32-release-offline: check-tools
 	$(SPEEDOMAKE) TARGETOS=w32 WHAT=release    WITH_GUI=0 SELFCHECK=0 \
 	  CUSTOM_SWDB=1 pkgrep=${HOME}/b pkg10rep=${HOME}/b  \
@@ -148,6 +153,9 @@ INST_NAME=gnupg-w32
 # Use this to override the installaion directory for native builds.
 INSTALL_PREFIX=none
 
+# The Authenticode key used to sign the Windows installer
+AUTHENTICODE_KEY=${HOME}/.gnupg/g10code-authenticode-key.p12
+
 
 # Directory names.
 # They must be absolute, as we switch directories pretty often.
@@ -1162,6 +1170,18 @@ installer: all w32_insthelpers $(w32src)/inst-options.ini $(bdir)/README.txt
 		    $(extra_installer_options) $(w32src)/inst.nsi
 	@echo "Ready: $(idir)/$(INST_NAME)-$(INST_VERSION)_$(BUILD_DATESTR).exe"
 
+
+define MKSWDB_commands
+ ( pref="#+macro: gnupg21_w32_" ;\
+   echo "$${pref}ver  $(INST_VERSION)_$(BUILD_DATESTR)"  ;\
+   echo "$${pref}date $(2)" ;\
+   echo "$${pref}size $$(wc -c <$(1)|awk '{print int($$1/1024)}')k";\
+   echo "$${pref}sha1 $$(sha1sum <$(1)|cut -d' ' -f1)" ;\
+   echo "$${pref}sha2 $$(sha256sum <$(1)|cut -d' ' -f1)" ;\
+ ) | tee $(1).swdb
+endef
+
+
 # Build the installer from the source tarball.
 installer-from-source: dist-source
 	(set -e;\
@@ -1173,17 +1193,36 @@ installer-from-source: dist-source
          $(MAKE) -f build-aux/speedo.mk this-w32-installer SELFCHECK=0;\
 	 reldate="$$(date -u +%Y-%m-%d)" ;\
 	 exefile="$(INST_NAME)-$(INST_VERSION)_$(BUILD_DATESTR).exe" ;\
-	 mv "PLAY/inst/$$exefile" ../.. ;\
+	 cp "PLAY/inst/$$exefile" ../.. ;\
+	 exefile="../../$$exefile" ;\
+	 $(call MKSWDB_commands,$${exefile},$${reldate}); \
+	)
+
+# This target repeats some of the installer-from-source steps but it
+# is intended to be called interactively, so that the passphrase can be
+# entered.
+sign-installer:
+	@(set -e; \
+	 cd PLAY-release; \
+	 cd $(INST_NAME)-$(INST_VERSION); \
+	 reldate="$$(date -u +%Y-%m-%d)" ;\
+	 exefile="$(INST_NAME)-$(INST_VERSION)_$(BUILD_DATESTR).exe" ;\
+	 echo "speedo: /*" ;\
+	 echo "speedo:  * Signing installer" ;\
+	 echo "speedo:  * Key: $(AUTHENTICODE_KEY)";\
+	 echo "speedo:  */" ;\
+	 osslsigncode sign -pkcs12 $(AUTHENTICODE_KEY) -askpass \
+            -h sha256 -in "PLAY/inst/$$exefile" -out "../../$$exefile" ;\
 	 exefile="../../$$exefile" ;\
-	 ( pref="#+macro: gnupg21_w32_" ;\
-         echo "$${pref}ver  $(INST_VERSION)_$(BUILD_DATESTR)"  ;\
-         echo "$${pref}date $${reldate}" ;\
-         echo "$${pref}size $$(wc -c <$$exefile|awk '{print int($$1/1024)}')k";\
-	 echo "$${pref}sha1 $$(sha1sum <$$exefile|cut -d' ' -f1)" ;\
-	 echo "$${pref}sha2 $$(sha256sum <$$exefile|cut -d' ' -f1)" ;\
-	 ) | tee $$exefile.swdb ;\
+	 $(call MKSWDB_commands,$${exefile},$${reldate}); \
+	 echo "speedo: /*" ;\
+	 echo "speedo:  * Verification result" ;\
+	 echo "speedo:  */" ;\
+         osslsigncode verify $${exefile} \
 	)
 
+
+
 endif
 # }}} W32
 

-----------------------------------------------------------------------

Summary of changes:
 build-aux/speedo.mk | 67 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 53 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Dec 19 23:30:29 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 19 Dec 2016 23:30:29 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-162-gaf8b68f
Message-ID: <E1cJ6Rz-0002JC-V3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  af8b68fae39b1378c769e0de6ba6437ea1aac7e3 (commit)
      from  284ec54495dddc9eb0232e959cf994234097578a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit af8b68fae39b1378c769e0de6ba6437ea1aac7e3
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 19 23:27:02 2016 +0100

    dirmngr: Fix problems with the getsrv function.
    
    * dirmngr/dns-stuff.c (opt_debug, opt_verbose): New vars.
    (set_dns_verbose): New func.
    (libdns_switch_port_p): Add debug output.
    (resolve_dns_name): Ditto.
    (get_dns_cert): Ditto.
    (get_dns_cname): Ditto.
    (getsrv_libdns, getsrv_standard): Change SRVCOUNT to an unsigend int.
    (getsrv): Rename to ...
    ((get_dns_srv): this.  Add arg R_COUNT and return an error.  Add debug
    output.
    * dirmngr/http.c: Adjust for chnaged getsrv().
    * dirmngr/ks-engine-hkp.c (map_host): Ditto.
    * dirmngr/t-dns-stuff.c (main): Ditto.  Call set_dns_verbose.
    * dirmngr/dirmngr.c (parse_rereadable_options): Call set_dns_verbose.
    --
    
    Due to our switch to Libdns getsrv didn't worked correctly because it
    returned -1 for an NXDOMAIN.  However, it is perfectly okay to have no
    SRV record and thus we change the way this function is called to be
    aligned with the other functions and also map NXDOMAIN to a zero SRV
    record count.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 0d896f1..bb4d9f3 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -640,6 +640,8 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
       return 0; /* Not handled. */
     }
 
+  set_dns_verbose (opt.verbose, !!DBG_DNS);
+
   return 1; /* Handled. */
 }
 
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index eae674f..08270a6 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -108,6 +108,10 @@
 /* The default nameserver used in Tor mode.  */
 #define DEFAULT_NAMESERVER "8.8.8.8"
 
+/* Two flags to enable verbose and debug mode.  */
+static int opt_verbose;
+static int opt_debug;
+
 /* If set force the use of the standard resolver.  */
 static int standard_resolver;
 
@@ -206,6 +210,15 @@ enable_dns_tormode (int new_circuit)
 }
 
 
+/* Set verbosity and debug mode for this module. */
+void
+set_dns_verbose (int verbose, int debug)
+{
+  opt_verbose = verbose;
+  opt_debug = debug;
+}
+
+
 /* Change the default IP address of the nameserver to IPADDR.  The
    address needs to be a numerical IP address and will be used for the
    next DNS query.  Note that this is only used in Tor mode.  */
@@ -558,6 +571,9 @@ libdns_switch_port_p (gpg_error_t err)
       && libdns_tor_port == TOR_PORT)
     {
       /* Switch port and try again.  */
+      if (opt_debug)
+        log_debug ("dns: switching from SOCKS port %d to %d\n",
+                   TOR_PORT, TOR_PORT2);
       libdns_tor_port = TOR_PORT2;
       libdns_reinit_pending = 1;
       return 1;
@@ -906,22 +922,24 @@ resolve_dns_name (const char *name, unsigned short port,
                   int want_family, int want_socktype,
                   dns_addrinfo_t *r_ai, char **r_canonname)
 {
+  gpg_error_t err;
+
 #ifdef USE_LIBDNS
   if (!standard_resolver)
     {
-      gpg_error_t err;
-
       err = resolve_name_libdns (name, port, want_family, want_socktype,
                                   r_ai, r_canonname);
       if (err && libdns_switch_port_p (err))
         err = resolve_name_libdns (name, port, want_family, want_socktype,
                                    r_ai, r_canonname);
-      return err;
     }
+  else
 #endif /*USE_LIBDNS*/
-
-  return resolve_name_standard (name, port, want_family, want_socktype,
-                                r_ai, r_canonname);
+    err = resolve_name_standard (name, port, want_family, want_socktype,
+                                 r_ai, r_canonname);
+  if (opt_debug)
+    log_debug ("dns: resolve_dns_name(%s): %s\n", name, gpg_strerror (err));
+  return err;
 }
 
 
@@ -1407,6 +1425,8 @@ get_dns_cert (const char *name, int want_certtype,
               void **r_key, size_t *r_keylen,
               unsigned char **r_fpr, size_t *r_fprlen, char **r_url)
 {
+  gpg_error_t err;
+
   if (r_key)
     *r_key = NULL;
   if (r_keylen)
@@ -1418,19 +1438,20 @@ get_dns_cert (const char *name, int want_certtype,
 #ifdef USE_LIBDNS
   if (!standard_resolver)
     {
-      gpg_error_t err;
-
       err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
                                  r_fpr, r_fprlen, r_url);
       if (err && libdns_switch_port_p (err))
         err = get_dns_cert_libdns (name, want_certtype, r_key, r_keylen,
                                    r_fpr, r_fprlen, r_url);
-      return err;
     }
+  else
 #endif /*USE_LIBDNS*/
+    err = get_dns_cert_standard (name, want_certtype, r_key, r_keylen,
+                                 r_fpr, r_fprlen, r_url);
 
-  return get_dns_cert_standard (name, want_certtype, r_key, r_keylen,
-                                r_fpr, r_fprlen, r_url);
+  if (opt_debug)
+    log_debug ("dns: get_dns_cert(%s): %s\n", name, gpg_strerror (err));
+  return err;
 }
 
 
@@ -1452,7 +1473,7 @@ priosort(const void *a,const void *b)
  * R_COUNT.  */
 #ifdef USE_LIBDNS
 static gpg_error_t
-getsrv_libdns (const char *name, struct srventry **list, int *r_count)
+getsrv_libdns (const char *name, struct srventry **list, unsigned int *r_count)
 {
   gpg_error_t err;
   struct dns_resolver *res = NULL;
@@ -1461,7 +1482,7 @@ getsrv_libdns (const char *name, struct srventry **list, int *r_count)
   struct dns_rr_i rri;
   char host[DNS_D_MAXNAME + 1];
   int derr;
-  int srvcount=0;
+  unsigned int srvcount = 0;
 
   err = libdns_res_open (&res);
   if (err)
@@ -1549,7 +1570,8 @@ getsrv_libdns (const char *name, struct srventry **list, int *r_count)
  * expected that NULL is stored at the address of LIST and 0 is stored
  * at the address of R_COUNT.  */
 static gpg_error_t
-getsrv_standard (const char *name, struct srventry **list, int *r_count)
+getsrv_standard (const char *name,
+                 struct srventry **list, unsigned int *r_count)
 {
 #ifdef HAVE_SYSTEM_RESOLVER
   union {
@@ -1561,7 +1583,7 @@ getsrv_standard (const char *name, struct srventry **list, int *r_count)
   unsigned char *pt, *emsg;
   int r, rc;
   u16 dlen;
-  int srvcount=0;
+  unsigned int srvcount = 0;
   u16 count;
 
   /* Do not allow a query using the standard resolver in Tor mode.  */
@@ -1672,14 +1694,16 @@ getsrv_standard (const char *name, struct srventry **list, int *r_count)
 }
 
 
-int
-getsrv (const char *name, struct srventry **list)
+/* Note that we do not return NONAME but simply store 0 at R_COUNT.  */
+gpg_error_t
+get_dns_srv (const char *name, struct srventry **list, unsigned int *r_count)
 {
   gpg_error_t err;
-  int srvcount;
+  unsigned int srvcount;
   int i;
 
   *list = NULL;
+  *r_count = 0;
   srvcount = 0;
 #ifdef USE_LIBDNS
   if (!standard_resolver)
@@ -1693,7 +1717,11 @@ getsrv (const char *name, struct srventry **list)
     err = getsrv_standard (name, list, &srvcount);
 
   if (err)
-    return -1;  /* Ugly.  FIXME: Return an error code. */
+    {
+      if (gpg_err_code (err) == GPG_ERR_NO_NAME)
+        err = 0;
+      goto leave;
+    }
 
   /* Now we have an array of all the srv records. */
 
@@ -1768,7 +1796,17 @@ getsrv (const char *name, struct srventry **list)
         }
     }
 
-  return srvcount;
+ leave:
+  if (opt_debug)
+    {
+      if (err)
+        log_debug ("dns: getsrv(%s): %s\n", name, gpg_strerror (err));
+      else
+        log_debug ("dns: getsrv(%s) -> %u records\n", name, srvcount);
+    }
+  if (!err)
+    *r_count = srvcount;
+  return err;
 }
 
 
@@ -1924,13 +1962,13 @@ get_dns_cname_standard (const char *name, char **r_cname)
 gpg_error_t
 get_dns_cname (const char *name, char **r_cname)
 {
+  gpg_error_t err;
+
   *r_cname = NULL;
 
 #ifdef USE_LIBDNS
   if (!standard_resolver)
     {
-      gpg_error_t err;
-
       err = get_dns_cname_libdns (name, r_cname);
       if (err && libdns_switch_port_p (err))
         err = get_dns_cname_libdns (name, r_cname);
@@ -1938,5 +1976,10 @@ get_dns_cname (const char *name, char **r_cname)
     }
 #endif /*USE_LIBDNS*/
 
-  return get_dns_cname_standard (name, r_cname);
+  err = get_dns_cname_standard (name, r_cname);
+  if (opt_debug)
+    log_debug ("get_dns_cname(%s)%s%s\n", name,
+               err ? ": " : " -> ",
+               err ? gpg_strerror (err) : *r_cname);
+  return err;
 }
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 2be972a..075aeaf 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -92,6 +92,9 @@ struct srventry
 };
 
 
+/* Set verbosity and debug mode for this module. */
+void set_dns_verbose (int verbose, int debug);
+
 /* Calling this function with YES set to True forces the use of the
  * standard resolver even if dirmngr has been built with support for
  * an alternative resolver.  */
@@ -145,8 +148,9 @@ gpg_error_t get_dns_cert (const char *name, int want_certtype,
                           unsigned char **r_fpr, size_t *r_fprlen,
                           char **r_url);
 
-
-int getsrv (const char *name,struct srventry **list);
+/* Return an array of SRV records.  */
+gpg_error_t get_dns_srv (const char *name,
+                         struct srventry **list, unsigned int *r_count);
 
 
 #endif /*GNUPG_DIRMNGR_DNS_STUFF_H*/
diff --git a/dirmngr/http.c b/dirmngr/http.c
index ebf80b1..619f2f1 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2321,7 +2321,7 @@ connect_server (const char *server, unsigned short port,
 {
   gpg_error_t err;
   assuan_fd_t sock = ASSUAN_INVALID_FD;
-  int srvcount = 0;
+  unsigned int srvcount = 0;
   int hostfound = 0;
   int anyhostaddr = 0;
   int srv, connected;
@@ -2377,8 +2377,12 @@ connect_server (const char *server, unsigned short port,
             {
               stpcpy (stpcpy (stpcpy (stpcpy (srvname,"_"), srvtag),
                               "._tcp."), server);
-              srvcount = getsrv (srvname, &serverlist);
+              err = get_dns_srv (srvname, &serverlist, &srvcount);
               xfree (srvname);
+              if (err)
+                log_info ("getting SRV '%s' failed: %s\n",
+                          serverlist[srv].target, gpg_strerror (err));
+              /* Note that on error SRVCOUNT is zero.  */
             }
 	}
     }
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 8f53432..a6c22f8 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -428,7 +428,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
       char *cname;
       char *srvrecord;
       struct srventry *srvs;
-      int srvscount;
+      unsigned int srvscount;
 
       reftblsize = 100;
       reftbl = xtrymalloc (reftblsize * sizeof *reftbl);
@@ -456,11 +456,10 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
               return err;
             }
 
-          srvscount = getsrv (srvrecord, &srvs);
+          err = get_dns_srv (srvrecord, &srvs, &srvscount);
           xfree (srvrecord);
-          if (srvscount < 0)
+          if (err)
             {
-              err = gpg_error_from_syserror ();
               xfree (reftbl);
               return err;
             }
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index dd8e21e..f58f323 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -157,6 +157,7 @@ main (int argc, char **argv)
       exit (1);
     }
 
+  set_dns_verbose (verbose, debug);
   init_sockets ();
 
   if (opt_tor)
@@ -234,19 +235,27 @@ main (int argc, char **argv)
   else if (opt_srv)
     {
       struct srventry *srv;
-      int rc,i;
+      unsigned int count;
+      int i;
 
-      rc=getsrv (name? name : "_hkp._tcp.wwwkeys.pgp.net", &srv);
-      printf("Count=%d\n",rc);
-      for(i=0;i<rc;i++)
+      err = get_dns_srv (name? name : "_hkp._tcp.wwwkeys.pgp.net",
+                         &srv, &count);
+      if (err)
+        printf ("get_dns_srv failed: %s <%s>\n",
+                gpg_strerror (err), gpg_strsource (err));
+      else
         {
-          printf("priority=%-8hu  ",srv[i].priority);
-          printf("weight=%-8hu  ",srv[i].weight);
-          printf("port=%-5hu  ",srv[i].port);
-          printf("target=%s\n",srv[i].target);
-        }
+          printf ("count=%u\n",count);
+          for (i=0; i < count; i++)
+            {
+              printf("priority=%-8hu  ",srv[i].priority);
+              printf("weight=%-8hu  ",srv[i].weight);
+              printf("port=%-5hu  ",srv[i].port);
+              printf("target=%s\n",srv[i].target);
+            }
 
-      xfree(srv);
+          xfree(srv);
+        }
     }
   else /* Standard lookup.  */
     {
@@ -289,7 +298,7 @@ main (int argc, char **argv)
                                   (opt_bracket? DNS_WITHBRACKET:0),
                                   &host);
           if (err)
-            printf ("[resolve_dns_addr failed (2): %s]", gpg_strerror (err));
+            printf ("  [resolve_dns_addr failed (2): %s]", gpg_strerror (err));
           else
             {
               if (!is_ip_address (host))

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c       |  2 ++
 dirmngr/dns-stuff.c     | 89 ++++++++++++++++++++++++++++++++++++-------------
 dirmngr/dns-stuff.h     |  8 +++--
 dirmngr/http.c          |  8 +++--
 dirmngr/ks-engine-hkp.c |  7 ++--
 dirmngr/t-dns-stuff.c   | 31 +++++++++++------
 6 files changed, 103 insertions(+), 42 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 09:58:34 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 09:58:34 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-163-g81c0127
Message-ID: <E1cJGFp-0000xd-0c@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  81c012787fabf734d9c952c6f18ecac21929d4d8 (commit)
      from  af8b68fae39b1378c769e0de6ba6437ea1aac7e3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 81c012787fabf734d9c952c6f18ecac21929d4d8
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 09:53:58 2016 +0100

    dirmngr: New option --resolver-timeout.
    
    * dirmngr/dns-stuff.c (DEFAULT_TIMEOUT): New.
    (opt_timeout): New var.
    (set_dns_timeout): New.
    (libdns_res_open): Set the default timeout.
    (libdns_res_wait): Use configurable timeout.
    (resolve_name_libdns): Ditto.
    
    * dirmngr/dirmngr.c (oResolverTimeout): New const.
    (opts): New option --resolver-timeout.
    (parse_rereadable_options): Set that option.
    (main) <aGPGConfList>: Add --nameserver and --resolver-timeout.
    * tools/gpgconf-comp.c (gc_options_dirmngr): Add --resolver-timeout
    and --nameserver.
    
    * dirmngr/http.c (connect_server): Fix yesterday introduced bug in
    error diagnostic.
    --
    
    This timeout is a pretty crude thing because libdns has a few other
    internal timeouts as well.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index bb4d9f3..5ee589e 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -142,6 +142,7 @@ enum cmd_and_opt_values {
   oDisableCheckOwnSocket,
   oStandardResolver,
   oRecursiveResolver,
+  oResolverTimeout,
   aTest
 };
 
@@ -240,6 +241,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_s (oIgnoreCertExtension,"ignore-cert-extension", "@"),
   ARGPARSE_s_n (oStandardResolver, "standard-resolver", "@"),
   ARGPARSE_s_n (oRecursiveResolver, "recursive-resolver", "@"),
+  ARGPARSE_s_i (oResolverTimeout, "resolver-timeout", "@"),
 
   ARGPARSE_group (302,N_("@\n(See the \"info\" manual for a complete listing "
                          "of all commands and options)\n")),
@@ -550,6 +552,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
       /* Note: We do not allow resetting of opt.use_tor at runtime.  */
       disable_check_own_socket = 0;
       enable_standard_resolver (0);
+      set_dns_timeout (0);
       return 1;
     }
 
@@ -636,6 +639,10 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
       set_dns_nameserver (pargs->r.ret_str);
       break;
 
+    case oResolverTimeout:
+      set_dns_timeout (pargs->r.ret_int);
+      break;
+
     default:
       return 0; /* Not handled. */
     }
@@ -1376,6 +1383,9 @@ main (int argc, char **argv)
 
       es_printf ("use-tor:%lu:\n", flags | GC_OPT_FLAG_NONE);
       es_printf ("keyserver:%lu:\n", flags | GC_OPT_FLAG_NONE);
+      es_printf ("nameserver:%lu:\n", flags | GC_OPT_FLAG_NONE);
+      es_printf ("resolver-timeout:%lu:%u\n",
+                 flags | GC_OPT_FLAG_DEFAULT, 0);
     }
   cleanup ();
   return !!rc;
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 08270a6..491fcce 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -108,10 +108,17 @@
 /* The default nameserver used in Tor mode.  */
 #define DEFAULT_NAMESERVER "8.8.8.8"
 
+/* The default timeout in seconds for libdns requests.  */
+#define DEFAULT_TIMEOUT 30
+
+
 /* Two flags to enable verbose and debug mode.  */
 static int opt_verbose;
 static int opt_debug;
 
+/* The timeout in seconds for libdns requests.  */
+static int opt_timeout;
+
 /* If set force the use of the standard resolver.  */
 static int standard_resolver;
 
@@ -219,6 +226,22 @@ set_dns_verbose (int verbose, int debug)
 }
 
 
+/* Set the timeout for libdns requests to SECONDS.  A value of 0 sets
+ * the default timeout and values are capped at 10 minutes.  */
+void
+set_dns_timeout (int seconds)
+{
+  if (!seconds)
+    seconds = DEFAULT_TIMEOUT;
+  else if (seconds < 1)
+    seconds = 1;
+  else if (seconds > 600)
+    seconds = 600;
+
+  opt_timeout = seconds;
+}
+
+
 /* Change the default IP address of the nameserver to IPADDR.  The
    address needs to be a numerical IP address and will be used for the
    next DNS query.  Note that this is only used in Tor mode.  */
@@ -421,7 +444,8 @@ libdns_init (void)
            pip && idx < DIM (ld.resolv_conf->nameserver);
            pip = pip->Next)
         {
-          log_debug ("ninfo->dnsserver[%d] '%s'\n", idx, pip->IpAddress.String);
+          if (opt_debug)
+            log_debug ("dns: dnsserver[%d] '%s'\n", idx, pip->IpAddress.String);
           err = libdns_error_to_gpg_error
             (dns_resconf_pton (&ld.resolv_conf->nameserver[idx],
                                pip->IpAddress.String));
@@ -547,6 +571,9 @@ libdns_res_open (struct dns_resolver **r_res)
   if (err)
     return err;
 
+  if (!opt_timeout)
+    set_dns_timeout (0);
+
   res = dns_res_open (libdns.resolv_conf, libdns.hosts, libdns.hints, NULL,
                       dns_opts (.socks_host     = &libdns.socks_host,
                                 .socks_user     = tor_socks_user,
@@ -604,7 +631,7 @@ libdns_res_wait (struct dns_resolver *res)
   while ((err = libdns_error_to_gpg_error (dns_res_check (res)))
          && gpg_err_code (err) == GPG_ERR_EAGAIN)
     {
-      if (dns_res_elapsed (res) > 30)
+      if (dns_res_elapsed (res) > opt_timeout)
         {
           err = gpg_error (GPG_ERR_DNS_TIMEOUT);
           break;
@@ -677,7 +704,7 @@ resolve_name_libdns (const char *name, unsigned short port,
         }
       if (gpg_err_code (err) == GPG_ERR_EAGAIN)
         {
-          if (dns_ai_elapsed (ai) > 30)
+          if (dns_ai_elapsed (ai) > opt_timeout)
             {
               err = gpg_error (GPG_ERR_DNS_TIMEOUT);
               goto leave;
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 075aeaf..0a4a4de 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -95,6 +95,9 @@ struct srventry
 /* Set verbosity and debug mode for this module. */
 void set_dns_verbose (int verbose, int debug);
 
+/* Set the timeout for libdns requests to SECONDS.  */
+void set_dns_timeout (int seconds);
+
 /* Calling this function with YES set to True forces the use of the
  * standard resolver even if dirmngr has been built with support for
  * an alternative resolver.  */
diff --git a/dirmngr/http.c b/dirmngr/http.c
index 619f2f1..14d60df 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2378,10 +2378,10 @@ connect_server (const char *server, unsigned short port,
               stpcpy (stpcpy (stpcpy (stpcpy (srvname,"_"), srvtag),
                               "._tcp."), server);
               err = get_dns_srv (srvname, &serverlist, &srvcount);
-              xfree (srvname);
               if (err)
                 log_info ("getting SRV '%s' failed: %s\n",
-                          serverlist[srv].target, gpg_strerror (err));
+                          srvname, gpg_strerror (err));
+              xfree (srvname);
               /* Note that on error SRVCOUNT is zero.  */
             }
 	}
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index f58f323..b087b5e 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -83,6 +83,7 @@ main (int argc, char **argv)
                  "  --cert              lookup a CERT RR\n"
                  "  --srv               lookup a SRV RR\n"
                  "  --cname             lookup a CNAME RR\n"
+                 "  --timeout SECONDS   timeout after SECONDS\n"
                  , stdout);
           exit (0);
         }
@@ -137,6 +138,15 @@ main (int argc, char **argv)
           any_options = opt_cname = 1;
           argc--; argv++;
         }
+      else if (!strcmp (*argv, "--timeout"))
+        {
+          argc--; argv++;
+          if (argc)
+            {
+              set_dns_timeout (atoi (*argv));
+              argc--; argv++;
+            }
+        }
       else if (!strncmp (*argv, "--", 2))
         {
           fprintf (stderr, PGM ": unknown option '%s'\n", *argv);
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 94ef35d..5b4e68b 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -255,6 +255,10 @@ Implemented'' if this function is used.
 @opindex recursive-resolver
 When possible use a recursive resolver instead of a stub resolver.
 
+ at item --resolver-timeout @var{n}
+Set the timeout for the DNS resolver to N seconds.  The default are 30
+seconds.
+
 @item --allow-version-check
 @opindex allow-version-check
 Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get
diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index e45857d..925f1cf 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -889,6 +889,12 @@ static gc_option_t gc_options_dirmngr[] =
    { "options", GC_OPT_FLAG_NONE, GC_LEVEL_EXPERT,
      "dirmngr", "|FILE|read options from FILE",
      GC_ARG_TYPE_FILENAME, GC_BACKEND_DIRMNGR },
+   { "resolver-timeout", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
+     GC_ARG_TYPE_INT32, GC_BACKEND_DIRMNGR },
+   { "nameserver", GC_OPT_FLAG_NONE, GC_LEVEL_INVISIBLE,
+     NULL, NULL,
+     GC_ARG_TYPE_STRING, GC_BACKEND_DIRMNGR },
 
    { "Debug",
      GC_OPT_FLAG_GROUP, GC_LEVEL_ADVANCED,

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c     | 10 ++++++++++
 dirmngr/dns-stuff.c   | 33 ++++++++++++++++++++++++++++++---
 dirmngr/dns-stuff.h   |  3 +++
 dirmngr/http.c        |  4 ++--
 dirmngr/t-dns-stuff.c | 10 ++++++++++
 doc/dirmngr.texi      |  4 ++++
 tools/gpgconf-comp.c  |  6 ++++++
 7 files changed, 65 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 10:25:02 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 10:25:02 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-164-gb8b0d2f
Message-ID: <E1cJGfQ-0002dv-Mf@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b8b0d2f4c1824020563946805ade7271e579db5a (commit)
      from  81c012787fabf734d9c952c6f18ecac21929d4d8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b8b0d2f4c1824020563946805ade7271e579db5a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 10:22:05 2016 +0100

    build: Update distributed signature key.
    
    --
    
    This update is required because gniibe prolonged his key.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/distsigkey.gpg b/g10/distsigkey.gpg
index 8ad154a..17de53f 100644
Binary files a/g10/distsigkey.gpg and b/g10/distsigkey.gpg differ

-----------------------------------------------------------------------

Summary of changes:
 g10/distsigkey.gpg | Bin 4114 -> 3452 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 10:58:25 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 10:58:25 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-165-g2051f29
Message-ID: <E1cJHBj-000481-RK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2051f29da2a6053356ef37daf04f6648d818d2ea (commit)
      from  b8b0d2f4c1824020563946805ade7271e579db5a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2051f29da2a6053356ef37daf04f6648d818d2ea
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 10:55:31 2016 +0100

    doc: Update NEWS
    
    --

diff --git a/NEWS b/NEWS
index d11c5ff..5633c55 100644
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,38 @@
-Noteworthy changes in version 2.1.17 (unreleased)
+Noteworthy changes in version 2.1.17 (2016-12-20)
 -------------------------------------------------
 
+ * gpg: By default new keys expire after 2 years.
+
+ * gpg: New command --quick-set-expire to conveniently change the
+   expiration date of keys.
+
+ * gpg: Option and command names have been changed for easier
+   comprehension.  The old names are still available as aliases.
+
+ * gpg: Improved the TOFU trust model.
+
  * gpg: New option --default-new-key-algo.
 
+ * scd: Support OpenPGP card V3 for RSA.
+
+ * dirmngr: Support for the ADNS library has been removed.  Instead
+   William Ahern's Libdns is now source included and used on all
+   platforms.  This enables Tor support on all platforms.  The new
+   option --standard-resolver can be used to disable this code at
+   runtime.  In case of build problems the new configure option
+   --disable-libdns can be used to build without Libdns.
+
+ * dirmngr: Lazily launch ldap reaper thread.
+
+ * tools: New options --check and --status-fd for gpg-wks-client.
+
+ * The UTF-8 byte order mark is now skipped when reading conf files.
+
+ * Fixed many bugs and regressions.
+
+ * Major improvements to the test suite.  For example it is possible
+   to run the external test suite of GPGME.
+
 
 Noteworthy changes in version 2.1.16 (2016-11-18)
 -------------------------------------------------

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 11:21:00 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 11:21:00 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-168-g4a283b5
Message-ID: <E1cJHXb-0005P2-Uo@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4a283b51734616bc91c02639b000585219ea7551 (commit)
       via  13465e708bb67e816e4fb3a37c117ad91dc6383f (commit)
       via  7185f734eb76e429e2325b7f6c0b445fa39b39cc (commit)
      from  2051f29da2a6053356ef37daf04f6648d818d2ea (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4a283b51734616bc91c02639b000585219ea7551
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 11:16:38 2016 +0100

    po: Update German translation.
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/po/de.po b/po/de.po
index a93bf7a..feac198 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.1.0\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-12-18 20:17+0100\n"
+"PO-Revision-Date: 2016-12-20 11:14+0100\n"
 "Last-Translator: Werner Koch <wk at gnupg.org>\n"
 "Language-Team: German <de at li.org>\n"
 "Language: de\n"
@@ -2315,22 +2315,10 @@ msgid "WARNING: recipients (-r) given without using public key encryption\n"
 msgstr ""
 "WARNUNG: Empf?nger (-r) angegeben ohne Verwendung von Public-Key-Verfahren\n"
 
-msgid "--store [filename]"
-msgstr "--store [Dateiname]"
-
-msgid "--symmetric [filename]"
-msgstr "--symmetric [Dateiname]"
-
 #, c-format
 msgid "symmetric encryption of '%s' failed: %s\n"
 msgstr "Symmetrische Entschl?sselung von `%s' fehlgeschlagen: %s\n"
 
-msgid "--encrypt [filename]"
-msgstr "--encrypt [Dateiname]"
-
-msgid "--symmetric --encrypt [filename]"
-msgstr "--symmetric --encrypt [Dateiname]"
-
 msgid "you cannot use --symmetric --encrypt with --s2k-mode 0\n"
 msgstr ""
 "--symmetric --encrypt kann nicht zusammen mit --s2k-mode 0 verwendet werden\n"
@@ -2339,15 +2327,6 @@ msgstr ""
 msgid "you cannot use --symmetric --encrypt while in %s mode\n"
 msgstr "Im %s-Modus kann --symmetric --encrypt nicht verwendet werden.\n"
 
-msgid "--sign [filename]"
-msgstr "--sign [Dateiname]"
-
-msgid "--sign --encrypt [filename]"
-msgstr "--sign --encrypt [Dateiname]"
-
-msgid "--symmetric --sign --encrypt [filename]"
-msgstr "--symmetric --sign --encrypt [Dateiname]"
-
 msgid "you cannot use --symmetric --sign --encrypt with --s2k-mode 0\n"
 msgstr ""
 "--symmetric --sign --encrypt kann nicht zusammen mit --s2k-mode 0 verwendet "
@@ -2358,27 +2337,6 @@ msgid "you cannot use --symmetric --sign --encrypt while in %s mode\n"
 msgstr ""
 "Im %s-Modus kann --symmetric --sign --encrypt nicht verwendet werden.\n"
 
-msgid "--sign --symmetric [filename]"
-msgstr "--sign --symmetric [Dateiname]"
-
-msgid "--clear-sign [filename]"
-msgstr "--clear-sign [Dateiname]"
-
-msgid "--decrypt [filename]"
-msgstr "--decrypt [Dateiname]"
-
-msgid "--sign-key user-id"
-msgstr "--sign-key User-ID"
-
-msgid "--lsign-key user-id"
-msgstr "--lsign-key User-ID"
-
-msgid "--edit-key user-id [commands]"
-msgstr "--edit-key User-ID [Befehle]"
-
-msgid "--passwd <user-id>"
-msgstr "--passwd User-ID"
-
 #, c-format
 msgid "keyserver send failed: %s\n"
 msgstr "Senden an Schl?sselserver fehlgeschlagen: %s\n"
@@ -2425,9 +2383,6 @@ msgstr ""
 "'%s\" sieht nicht nach einer g?ltigen Schl?ssel-ID, einem Fingerabdruck oder "
 "einem \"Keygrip\" aus\n"
 
-msgid "[filename]"
-msgstr "[Dateiname]"
-
 msgid "Go ahead and type your message ...\n"
 msgstr "Auf geht's - Botschaft eintippen ...\n"
 
@@ -4873,24 +4828,20 @@ msgstr ""
 "Dieser Schl?ssel geh?rt uns (da wir n?mlich den geheimen Schl?ssel dazu "
 "haben)\n"
 
-#, fuzzy, c-format
-#| msgid "root certificate has now been marked as trusted\n"
+#, c-format
 msgid "%s: This key is bad!  It has been marked as untrusted!\n"
-msgstr "Das Wurzelzertifikat wurde nun als vertrauensw?rdig markiert\n"
+msgstr ""
+"%s: Der Schl?ssel ist gef?lscht!  Er wurde als nicht vertrauensw?rdig "
+"markiert.\n"
 
-#, fuzzy
-#| msgid ""
-#| "It is NOT certain that the key belongs to the person named\n"
-#| "in the user ID.  If you *really* know what you are doing,\n"
-#| "you may answer the next question with yes.\n"
 msgid ""
-"This key has is bad!  It has been marked as untrusted!  If you\n"
+"This key is bad!  It has been marked as untrusted!  If you\n"
 "*really* know what you are doing, you may answer the next\n"
 "question with yes.\n"
 msgstr ""
-"Es ist NICHT sicher, da? der Schl?ssel zu dem in der User-ID\n"
-"Genannten geh?rt. Wenn Sie *wirklich* wissen, was Sie tun,\n"
-"k?nnen Sie die n?chste Frage mit ja beantworten\n"
+"Der Schl?ssel ist gef?lscht!  Er wurde als als nicht vertrauensw?rdig\n"
+"markiert.  Wenn Sie *wirklich* wissen, was Sie tun, k?nnen Sie die\n"
+"n?chste Frage mit ja beantworten.\n"
 
 msgid ""
 "It is NOT certain that the key belongs to the person named\n"
@@ -5563,6 +5514,15 @@ msgstr "Fehler beim Feststellen der TOFU Datenbank Version: %s\n"
 msgid "error initializing TOFU database: %s\n"
 msgstr "Fehler beim Initialisieren der TOFU Datenbank: %s\n"
 
+#, fuzzy, c-format
+#| msgid "error creating temporary file: %s\n"
+msgid "error creating 'encryptions' TOFU table: %s\n"
+msgstr "Fehler beim Erstellen einer tempor?ren Datei: %s\n"
+
+#, c-format
+msgid "adding column effective_policy to bindings DB: %s\n"
+msgstr ""
+
 #, c-format
 msgid "error opening TOFU database '%s': %s\n"
 msgstr "Fehler beim ?ffner der TOFU Datenbank '%s': %s\n"
@@ -5581,8 +5541,10 @@ msgstr "Die Email-Adresse \"%s\" ist mit einem Schl?ssel assoziert:\n"
 #, fuzzy, c-format
 #| msgid "The email address \"%s\" is associated with %d key:\n"
 #| msgid_plural "The email address \"%s\" is associated with %d keys:\n"
-msgid "The email address \"%s\" is associated with %d keys!"
-msgstr "Die Email-Adresse \"%s\" ist mit einem Schl?ssel assoziert:\n"
+msgid "The email address \"%s\" is associated with %d key!"
+msgid_plural "The email address \"%s\" is associated with %d keys!"
+msgstr[0] "Die Email-Adresse \"%s\" ist mit einem Schl?ssel assoziert:\n"
+msgstr[1] "Die Email-Adresse \"%s\" ist mit einem Schl?ssel assoziert:\n"
 
 #, fuzzy
 #| msgid ""
@@ -5635,47 +5597,100 @@ msgstr "dieser Schl?ssel"
 
 #, fuzzy, c-format
 #| msgid "Verified %ld messages signed by \"%s\"."
-msgid "Verified %d message"
-msgid_plural "Verified %d messages"
+msgid "Verified %d message."
+msgid_plural "Verified %d messages."
 msgstr[0] "%ld ?berpr?fte Nachrichten von \"%s\"."
 msgstr[1] "%ld ?berpr?fte Nachrichten von \"%s\"."
 
-#, c-format
-msgid "Encrypted %d message"
-msgid_plural "Encrypted %d messages"
-msgstr[0] ""
-msgstr[1] ""
+#, fuzzy, c-format
+#| msgid "encrypted with %lu passphrases\n"
+msgid "Encrypted %d message."
+msgid_plural "Encrypted %d messages."
+msgstr[0] "Verschl?sselt mit %lu Passphrases\n"
+msgstr[1] "Verschl?sselt mit %lu Passphrases\n"
+
+#, fuzzy, c-format
+#| msgid "%ld message signed in the future."
+#| msgid_plural "%ld messages signed in the future."
+msgid "Verified %d message in the future."
+msgid_plural "Verified %d messages in the future."
+msgstr[0] "%ld Nachricht in der Zukunft signiert."
+msgstr[1] "%ld Nachrichten in der Zukunf signiert."
+
+#, fuzzy, c-format
+#| msgid "%ld message signed in the future."
+#| msgid_plural "%ld messages signed in the future."
+msgid "Encrypted %d message in the future."
+msgid_plural "Encrypted %d messages in the future."
+msgstr[0] "%ld Nachricht in der Zukunft signiert."
+msgstr[1] "%ld Nachrichten in der Zukunf signiert."
+
+#, fuzzy, c-format
+#| msgid " over the past %ld day."
+#| msgid_plural " over the past %ld days."
+msgid "Messages verified over the past %d day: %d."
+msgid_plural "Messages verified over the past %d days: %d."
+msgstr[0] " innerhalb des letzten Tages."
+msgstr[1] " innerhalb der letzten %ld Tage."
 
 #, fuzzy, c-format
 #| msgid " over the past %ld day."
 #| msgid_plural " over the past %ld days."
-msgid " over the past day."
-msgid_plural " over the past %d days."
+msgid "Messages encrypted over the past %d day: %d."
+msgid_plural "Messages encrypted over the past %d days: %d."
 msgstr[0] " innerhalb des letzten Tages."
 msgstr[1] " innerhalb der letzten %ld Tage."
 
 #, fuzzy, c-format
 #| msgid " over the past %ld month."
 #| msgid_plural " over the past %ld months."
-msgid " over the past month."
-msgid_plural " over the past %d months."
+msgid "Messages verified over the past %d month: %d."
+msgid_plural "Messages verified over the past %d months: %d."
+msgstr[0] " innerhalb des letzten Monats."
+msgstr[1] " innerhalb der letzten %ld Monate."
+
+#, fuzzy, c-format
+#| msgid " over the past %ld month."
+#| msgid_plural " over the past %ld months."
+msgid "Messages encrypted over the past %d month: %d."
+msgid_plural "Messages encrypted over the past %d months: %d."
 msgstr[0] " innerhalb des letzten Monats."
 msgstr[1] " innerhalb der letzten %ld Monate."
 
 #, fuzzy, c-format
 #| msgid " over the past %ld day."
 #| msgid_plural " over the past %ld days."
-msgid " over the past year."
-msgid_plural " over the past %d years."
+msgid "Messages verified over the past %d year: %d."
+msgid_plural "Messages verified over the past %d years: %d."
 msgstr[0] " innerhalb des letzten Tages."
 msgstr[1] " innerhalb der letzten %ld Tage."
 
-#, fuzzy
+#, fuzzy, c-format
 #| msgid " over the past %ld day."
 #| msgid_plural " over the past %ld days."
-msgid " in the past."
+msgid "Messages encrypted over the past %d year: %d."
+msgid_plural "Messages encrypted over the past %d years: %d."
+msgstr[0] " innerhalb des letzten Tages."
+msgstr[1] " innerhalb der letzten %ld Tage."
+
+#, fuzzy, c-format
+#| msgid " over the past %ld day."
+#| msgid_plural " over the past %ld days."
+msgid "Messages verified in the past: %d."
 msgstr " innerhalb des letzten Tages."
 
+#, fuzzy, c-format
+#| msgid ""
+#| "Verified %ld message signed by \"%s\"\n"
+#| "in the past %s."
+#| msgid_plural ""
+#| "Verified %ld messages signed by \"%s\"\n"
+#| "in the past %s."
+msgid "Messages encrypted in the past: %d."
+msgstr ""
+"%ld ?berpr?fte Nachricht von \"%s\"\n"
+"in den letzten %s."
+
 #. TRANSLATORS: Please translate the text found in the source
 #. * file below.  We don't directly internationalize that text so
 #. * that we can tweak it without breaking translations.
@@ -5709,59 +5724,84 @@ msgstr ""
 msgid "resetting keydb: %s\n"
 msgstr "Fehler beim Schreiben des Schl?ssels: %s\n"
 
-#, c-format
-msgid "error setting TOFU binding's trust level to %s\n"
+#, fuzzy, c-format
+#| msgid "error setting TOFU binding's trust level to %s\n"
+msgid "error setting TOFU binding's policy to %s\n"
 msgstr "Fehler beim Setzen der TOFU Binding Vertrauensstufe auf %s\n"
 
 #, c-format
 msgid "error changing TOFU policy: %s\n"
 msgstr "Fehler beim ?ndern der TOFU Richtlinie: %s\n"
 
-#. TRANSLATORS: The tilde ('~') is used here to indicate a
-#. * non-breakable space
-#, c-format
-msgid "%d~year"
-msgid_plural "%d~years"
+#, fuzzy, c-format
+#| msgid "%d~year"
+#| msgid_plural "%d~years"
+msgid "%lld~year"
+msgid_plural "%lld~years"
 msgstr[0] "%d~Jahr"
 msgstr[1] "%d~Jahre"
 
-#, c-format
-msgid "%d~month"
-msgid_plural "%d~months"
+#, fuzzy, c-format
+#| msgid "%d~month"
+#| msgid_plural "%d~months"
+msgid "%lld~month"
+msgid_plural "%lld~months"
 msgstr[0] "%d~Monat"
 msgstr[1] "%d~Monate"
 
 #, c-format
-msgid "%d~day"
-msgid_plural "%d~days"
+msgid "%lld~week"
+msgid_plural "%lld~weeks"
+msgstr[0] ""
+msgstr[1] ""
+
+#, fuzzy, c-format
+#| msgid "%d~day"
+#| msgid_plural "%d~days"
+msgid "%lld~day"
+msgid_plural "%lld~days"
 msgstr[0] "%d~Tag"
 msgstr[1] "%d~Tage"
 
-#, c-format
-msgid "%d~hour"
-msgid_plural "%d~hours"
+#, fuzzy, c-format
+#| msgid "%d~hour"
+#| msgid_plural "%d~hours"
+msgid "%lld~hour"
+msgid_plural "%lld~hours"
 msgstr[0] "%d~Stunde"
 msgstr[1] "%d~Stunden"
 
-#, c-format
-msgid "%d~minute"
-msgid_plural "%d~minutes"
+#, fuzzy, c-format
+#| msgid "%d~minute"
+#| msgid_plural "%d~minutes"
+msgid "%lld~minute"
+msgid_plural "%lld~minutes"
 msgstr[0] "%d~Minute"
 msgstr[1] "%d~Minuten"
 
-#, c-format
-msgid "%d~second"
-msgid_plural "%d~seconds"
+#, fuzzy, c-format
+#| msgid "%d~second"
+#| msgid_plural "%d~seconds"
+msgid "%lld~second"
+msgid_plural "%lld~seconds"
 msgstr[0] "%d~Sekunde"
 msgstr[1] "%d~Sekunden"
 
-#, c-format
-msgid "%s: "
+#, fuzzy, c-format
+#| msgid "TOFU: few signatures %d message %s"
+#| msgid_plural "TOFU: few signatures %d messages %s"
+msgid "%s: Verified 0~signatures and encrypted 0~messages."
 msgstr ""
+"WARNUNG: Falls sie glauben, mehr als %d mit diesem Schl?ssel signierte\n"
+"Nachricht erhalten zu haben, so kann es sich bei diesem Schl?ssel um\n"
+"eine F?lschung handeln!  Pr?fen Sie die Email-Adresse genau auf kleine\n"
+"Variationen (z.B. zus?tzliche Leerzeichen).  Falls Ihnen der Schl?ssel\n"
+"suspekt erscheint, so benutzen Sie '%s' um den Schl?ssel als F?lschung\n"
+"zu markieren."
 
 #, fuzzy, c-format
 #| msgid "Deleted %d signatures.\n"
-msgid "Verified %ld signatures"
+msgid "%s: Verified 0 signatures."
 msgstr "%d Beglaubigungen entfernt.\n"
 
 #, fuzzy, c-format
@@ -5771,8 +5811,8 @@ msgstr "%d Beglaubigungen entfernt.\n"
 #| msgid_plural ""
 #| "Verified %ld messages signed by \"%s\"\n"
 #| "in the past %s."
-msgid "Verified %ld signature in the past %s"
-msgid_plural "Verified %ld signatures in the past %s"
+msgid "%s: Verified %ld~signature in the past %s."
+msgid_plural "%s: Verified %ld~signatures in the past %s."
 msgstr[0] ""
 "%ld ?berpr?fte Nachricht von \"%s\"\n"
 "in den letzten %s."
@@ -5780,9 +5820,9 @@ msgstr[1] ""
 "%ld ?berpr?fte Nachrichten von \"%s\"\n"
 "in den letzten %s."
 
-#, fuzzy, c-format
+#, fuzzy
 #| msgid "encrypted with %lu passphrases\n"
-msgid ", and encrypted %ld messages"
+msgid "Encrypted 0 messages."
 msgstr "Verschl?sselt mit %lu Passphrases\n"
 
 #, fuzzy, c-format
@@ -5792,8 +5832,8 @@ msgstr "Verschl?sselt mit %lu Passphrases\n"
 #| msgid_plural ""
 #| "Verified %ld messages signed by \"%s\"\n"
 #| "in the past %s."
-msgid ", and encrypted %ld message in the past %s"
-msgid_plural ", and encrypted %ld messages in the past %s"
+msgid "Encrypted %ld~message in the past %s."
+msgid_plural "Encrypted %ld~messages in the past %s."
 msgstr[0] ""
 "%ld ?berpr?fte Nachricht von \"%s\"\n"
 "in den letzten %s."
@@ -5801,6 +5841,11 @@ msgstr[1] ""
 "%ld ?berpr?fte Nachrichten von \"%s\"\n"
 "in den letzten %s."
 
+#, fuzzy, c-format
+#| msgid "policy: %s"
+msgid "(policy: %s)"
+msgstr "Richtlinie: %s"
+
 #, fuzzy
 #| msgid "Warning: we've have yet to see a message signed by this key!\n"
 msgid ""
@@ -5876,7 +5921,7 @@ msgid "error opening TOFU database: %s\n"
 msgstr "Fehler beim ?ffnen der TOFU Datenbank: %s\n"
 
 #, c-format
-msgid "WARNING: Encrypting to %s, which has nonon-revoked user ids.\n"
+msgid "WARNING: Encrypting to %s, which has no non-revoked user ids.\n"
 msgstr ""
 
 #, fuzzy, c-format
@@ -8500,6 +8545,14 @@ msgstr "Die externe ?berpr?fung der Komponente %s war nicht erfolgreich"
 msgid "Note that group specifications are ignored\n"
 msgstr "Beachten Sie, da? Gruppenspezifiaktionen ignoriert werden\n"
 
+#, c-format
+msgid "error closing '%s'\n"
+msgstr "Fehler beim Schlie?en von '%s'\n"
+
+#, c-format
+msgid "error parsing '%s'\n"
+msgstr "Fehler beim Hashen von '%s'\n"
+
 msgid "list all components"
 msgstr "Liste aller Komponenten"
 
@@ -8518,6 +8571,9 @@ msgstr "|KOMPONENTE|Pr?fe die Optionen"
 msgid "apply global default values"
 msgstr "Wende die gobalen Voreinstellungen an"
 
+msgid "|FILE|update configuration files using FILE"
+msgstr "|DATEI|Konfigurationsdateien mittels DATEI ?ndern"
+
 msgid "get the configuration directories for @GPGCONF@"
 msgstr "Hole die Einstellungsverzeichnisse von @GPGCONF@"
 
@@ -8708,6 +8764,86 @@ msgstr ""
 "Syntax: gpg-check-pattern [optionen] Musterdatei\n"
 "Die von stdin gelesene Passphrase gegen die Musterdatei pr?fen\n"
 
+#, fuzzy
+#~| msgid ""
+#~| "@\n"
+#~| "Examples:\n"
+#~| "\n"
+#~| " -se -r Bob [file]          sign and encrypt for user Bob\n"
+#~| " --clear-sign [file]        make a clear text signature\n"
+#~| " --detach-sign [file]       make a detached signature\n"
+#~| " --list-keys [names]        show keys\n"
+#~| " --fingerprint [names]      show fingerprints\n"
+#~ msgid ""
+#~ "@\n"
+#~ "Examples:\n"
+#~ "\n"
+#~ " -se -r Bob [file]          sign and encrypt for user Bob\n"
+#~ " --clearsign [file]         make a clear text signature\n"
+#~ " --detach-sign [file]       make a detached signature\n"
+#~ " --list-keys [names]        show keys\n"
+#~ " --fingerprint [names]      show fingerprints\n"
+#~ msgstr ""
+#~ "@\n"
+#~ "Beispiele:\n"
+#~ "\n"
+#~ " -se -r Bob [Datei]         Signieren und verschl?sseln f?r Benutzer Bob\n"
+#~ " --clear-sign [Datei]       Eine Klartextsignatur erzeugen\n"
+#~ " --detach-sign [Datei]      Eine abgetrennte Signatur erzeugen\n"
+#~ " --list-keys [Namen]        Schl?ssel anzeigen\n"
+#~ " --fingerprint [Namen]      \"Fingerabdr?cke\" anzeigen\n"
+
+#~ msgid "--store [filename]"
+#~ msgstr "--store [Dateiname]"
+
+#~ msgid "--symmetric [filename]"
+#~ msgstr "--symmetric [Dateiname]"
+
+#~ msgid "--encrypt [filename]"
+#~ msgstr "--encrypt [Dateiname]"
+
+#~ msgid "--symmetric --encrypt [filename]"
+#~ msgstr "--symmetric --encrypt [Dateiname]"
+
+#~ msgid "--sign [filename]"
+#~ msgstr "--sign [Dateiname]"
+
+#~ msgid "--sign --encrypt [filename]"
+#~ msgstr "--sign --encrypt [Dateiname]"
+
+#~ msgid "--symmetric --sign --encrypt [filename]"
+#~ msgstr "--symmetric --sign --encrypt [Dateiname]"
+
+#~ msgid "--sign --symmetric [filename]"
+#~ msgstr "--sign --symmetric [Dateiname]"
+
+#~ msgid "--clear-sign [filename]"
+#~ msgstr "--clear-sign [Dateiname]"
+
+#~ msgid "--decrypt [filename]"
+#~ msgstr "--decrypt [Dateiname]"
+
+#~ msgid "--sign-key user-id"
+#~ msgstr "--sign-key User-ID"
+
+#~ msgid "--lsign-key user-id"
+#~ msgstr "--lsign-key User-ID"
+
+#~ msgid "--edit-key user-id [commands]"
+#~ msgstr "--edit-key User-ID [Befehle]"
+
+#~ msgid "--passwd <user-id>"
+#~ msgstr "--passwd User-ID"
+
+#~ msgid "[filename]"
+#~ msgstr "[Dateiname]"
+
+#, fuzzy
+#~| msgid " over the past %ld day."
+#~| msgid_plural " over the past %ld days."
+#~ msgid " in the past."
+#~ msgstr " innerhalb des letzten Tages."
+
 #~ msgid "shadowing the key failed: %s\n"
 #~ msgstr "\"Shadowing\" des Schl?ssels schlug fehl: %s\n"
 
@@ -8728,11 +8864,6 @@ msgstr ""
 #~ msgid "Known user IDs associated with this key:\n"
 #~ msgstr "Bekannte, mit diesem Schl?ssel assozierte, User-IDs:\n"
 
-#~ msgid "%ld message signed in the future."
-#~ msgid_plural "%ld messages signed in the future."
-#~ msgstr[0] "%ld Nachricht in der Zukunft signiert."
-#~ msgstr[1] "%ld Nachrichten in der Zukunf signiert."
-
 #~ msgid "%ld message signed"
 #~ msgid_plural "%ld messages signed"
 #~ msgstr[0] "%ld Nachricht signiert"
@@ -8839,23 +8970,6 @@ msgstr ""
 #~ msgstr[0] "%d Tag"
 #~ msgstr[1] "%d Tage"
 
-#~ msgid "TOFU: few signatures %d message %s"
-#~ msgid_plural "TOFU: few signatures %d messages %s"
-#~ msgstr[0] ""
-#~ "WARNUNG: Falls sie glauben, mehr als %d mit diesem Schl?ssel signierte\n"
-#~ "Nachricht erhalten zu haben, so kann es sich bei diesem Schl?ssel um\n"
-#~ "eine F?lschung handeln!  Pr?fen Sie die Email-Adresse genau auf kleine\n"
-#~ "Variationen (z.B. zus?tzliche Leerzeichen).  Falls Ihnen der Schl?ssel\n"
-#~ "suspekt erscheint, so benutzen Sie '%s' um den Schl?ssel als F?lschung\n"
-#~ "zu markieren."
-#~ msgstr[1] ""
-#~ "WARNUNG: Falls sie glauben, mehr als %d mit diesem Schl?ssel signierte\n"
-#~ "Nachrichten erhalten zu haben, so kann es sich bei diesem Schl?ssel um\n"
-#~ "eine F?lschung handeln!  Pr?fen Sie die Email-Adresse genau auf kleine\n"
-#~ "Variationen (z.B. zus?tzliche Leerzeichen).  Falls Ihnen der Schl?ssel\n"
-#~ "suspekt erscheint, so benutzen Sie '%s' um den Schl?ssel als F?lschung\n"
-#~ "zu markieren."
-
 #~ msgid "sending key %s to %s server %s\n"
 #~ msgstr "sende Schl?ssel %s auf den %s-Server %s\n"
 

commit 13465e708bb67e816e4fb3a37c117ad91dc6383f
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 11:15:34 2016 +0100

    sm: Remove wrong example from gpgsm --help.
    
    * sm/gpgsm.c (opts): Remove group 303.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index e0ad3e3..34a9b96 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -357,12 +357,6 @@ static ARGPARSE_OPTS opts[] = {
   "@\n(See the man page for a complete listing of all commands and options)\n"
   )),
 
-  ARGPARSE_group (303, N_("@\nExamples:\n\n"
-    " -se -r Bob [file]          sign and encrypt for user Bob\n"
-    " --clearsign [file]         make a clear text signature\n"
-    " --detach-sign [file]       make a detached signature\n"
-    " --list-keys [names]        show keys\n"
-    " --fingerprint [names]      show fingerprints\n"  )),
 
   /* Hidden options. */
   ARGPARSE_s_s (oCompliance, "compliance",   "@"),

commit 7185f734eb76e429e2325b7f6c0b445fa39b39cc
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 11:00:31 2016 +0100

    po: Update one English string in Japanese translation.
    
    --

diff --git a/po/ja.po b/po/ja.po
index 2ee7d4c..8a332ae 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -4645,7 +4645,7 @@ msgid "%s: This key is bad!  It has been marked as untrusted!\n"
 msgstr "%s: ????????! ????????????????!\n"
 
 msgid ""
-"This key has is bad!  It has been marked as untrusted!  If you\n"
+"This key is bad!  It has been marked as untrusted!  If you\n"
 "*really* know what you are doing, you may answer the next\n"
 "question with yes.\n"
 msgstr ""

-----------------------------------------------------------------------

Summary of changes:
 po/de.po   | 370 ++++++++++++++++++++++++++++++++++++++++---------------------
 po/ja.po   |   2 +-
 sm/gpgsm.c |   6 -
 3 files changed, 243 insertions(+), 135 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 11:22:11 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 11:22:11 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.1.16-168-g4a283b5
Message-ID: <E1cJHYj-0005QW-Np@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  4a283b51734616bc91c02639b000585219ea7551 (commit)
       via  13465e708bb67e816e4fb3a37c117ad91dc6383f (commit)
       via  7185f734eb76e429e2325b7f6c0b445fa39b39cc (commit)
       via  2051f29da2a6053356ef37daf04f6648d818d2ea (commit)
       via  b8b0d2f4c1824020563946805ade7271e579db5a (commit)
       via  81c012787fabf734d9c952c6f18ecac21929d4d8 (commit)
       via  af8b68fae39b1378c769e0de6ba6437ea1aac7e3 (commit)
       via  284ec54495dddc9eb0232e959cf994234097578a (commit)
       via  65a0d6a24e6299682793f213a9d2bae17c5b12d9 (commit)
       via  0bf16d702665a269ce5ef724c927fbbd8f7f1ce9 (commit)
       via  63c7bf1a62d1d801c79a75fdb2ef7d7cac68e1d1 (commit)
       via  10dae1518633760db28e6f46cd0c6f4b6123013a (commit)
       via  d51499fdc522a696f23c6776c3ab248742f4e06a (commit)
       via  aec89a7297bae30f79a63fdc830530e82bab6170 (commit)
       via  a76fe9e86d7802e67373218bd1759168585e92ab (commit)
       via  a1afc450e182af02ad5e6f6ba79e9dc4332ca2bc (commit)
       via  a45dc0849da0d944ec8c759bc8e3e733b1eb0079 (commit)
       via  3949cbd1128585c9b810713aeffaa1455fb5aed9 (commit)
       via  df00745d6eed7034b218a0c482a46d975425798a (commit)
       via  026bbf0d5ee4510967e5f1dd3db2dee4687b0612 (commit)
       via  e384405b6e251629fb36bcbba4f5f9ac15a39d10 (commit)
       via  e77b924fec1082faae48cdd2ff8474874a22bdf7 (commit)
       via  c3c60843ea25213a1a6cbfd26e79b717ff2c2a60 (commit)
       via  b653e763c856dcefdd6755eb47e3702b3057ac56 (commit)
       via  024dbd7162fc1a7694176ebad3c21ee3ea67c024 (commit)
       via  c4e8a3194d6b92f596a6483e486c645de7d2ddd1 (commit)
       via  ddb48086833f8b86f0f0d69b21a23f245090ea7a (commit)
       via  59d3c3e4baffff52548fb5d1766ebf02dd8e1bec (commit)
       via  41a426a1a01e2726c3c318786f29b4974bf1f689 (commit)
       via  48671f295ff233765689b6a73021f83ab845a28f (commit)
       via  76cd64a5baf6057b199c01f7999b327f1f4a87bc (commit)
       via  6ca3c28da46873416822bf6ab7893db6c56a49d6 (commit)
       via  12a5265afa7f87ad92fb571e0882e57b07a3c267 (commit)
       via  3c7d6a1769ed6cc90d86247a814a0dce341512a3 (commit)
       via  a165fa09be4bfbeb97ebe25d551a9045255e5028 (commit)
       via  4a2c210b75d4266e289712e73a42c286aabb07f0 (commit)
       via  94f6b9010d2e80a75ccbb21426faf0b30195f1ab (commit)
       via  ca02a8b78fca8815388a859962584d75169ae3ee (commit)
       via  116a78eb869c4c589228bd0d6deff7c7a9f92dfb (commit)
       via  fea9da4a8afab6f3a49cdbbcc4a7a21f27a6d3e8 (commit)
       via  6caa2d0ba2bfc0ae93878738b0169483f6b6b462 (commit)
       via  6b16b02109f4bb5b934e456667ff4c0ba7bc85fd (commit)
       via  41ad04d403de05abe54280d2a84aa51a603194e4 (commit)
       via  6e4396723e9e5865015ebf7033628fa3919cf7d1 (commit)
       via  3c691097ca144e9a1d4c9185636c59a848bec85c (commit)
       via  c252627c6fd93bc305c5a5a2f013c3de2d45c6b0 (commit)
       via  bc6b76ef26f31c54ae1c29c761b8ecc437fcf565 (commit)
       via  2d1760ffe2ff46b77bd0f38db8b781d9564ae999 (commit)
       via  0e2055c7d30d987a7a74923a7080b80cce470601 (commit)
       via  948cca9c99e701a1668bb5fd6e25f07e35381b4d (commit)
       via  ca1e9749bfb069d90aa44efbf6f3d611b6104c1b (commit)
       via  55dc81125abc43cd3cc8db951fc3b8a81767942d (commit)
       via  d6e332422f7a8adc01a45685b067b977e28444e2 (commit)
       via  d34a2bb410c7c770d26430d69ff77bd83fc407f1 (commit)
       via  3c2a7918eac024b5e1258ea9b272b4e8a1f1af43 (commit)
       via  4c13e4e3debe0e55e86ae29c095f2d86eb0a6f11 (commit)
       via  4a030f682ef48542ed324b28207f2c2b4847dbef (commit)
       via  392966aed9b2a5e1456c671e5d13b561a27e4bb2 (commit)
       via  d84f5a88233c073a82fd47728574b001343784ee (commit)
       via  aae68a3ccd3d9870162b3ffd49eae08d5bf1b1e1 (commit)
       via  f8ab2c4c70ad15c4b2e45492606fb94ddaccdac7 (commit)
       via  f6acd0426453d3a18536ca69d63baa0d971082ef (commit)
       via  2e734a3ce159de8fb60df2bd5d454f98ca710717 (commit)
       via  57aa42ce9b28bc17ac24491d595766fbf80762af (commit)
       via  c1c35fb887061de05661f3411eda97546e1a52d7 (commit)
       via  ec1bd3ae685e95563e38077ab3c1655fd55dea07 (commit)
       via  09163a6390bd9713f3a7946de739765b30ef6f64 (commit)
       via  892c827e72b1396e3b58e2f8869cc48328a2b59c (commit)
       via  9147737f1c6894f38b855f3cf38cd33122a1ae2a (commit)
       via  a6d6e4afe488bc05ee730e85da6a9505c6cd245a (commit)
       via  04754ce3a704b1e6d38cb9a28dacf2821dc3f15f (commit)
       via  ca598152345b40f3a236227dfc63ae04ddf777d7 (commit)
       via  dd3dde07a9a46130ac01d849f8edf0566e44f11f (commit)
       via  429891a704057437517cb0b45d11392b40fa1ee8 (commit)
       via  d43dabf4607d3bcfc217eb9aea34d093f5aa698f (commit)
       via  1a176b92a8aad42056ed2c4e1f49a5feb40770cf (commit)
       via  fe36e63763c9c595bb057ac50160d2aff7c7a63f (commit)
       via  e3876f16eb237bdeb9f79aca2e7db5e9e2d86686 (commit)
       via  ab3cdeb4414fecb7ebf4cf93e20c2c70a18c52e6 (commit)
       via  98433c70431dfbde99b0e89416856d1eef9ebc88 (commit)
       via  f1304ee9b21e6ceac6c13d04ceddd23fadb5c7f1 (commit)
       via  522e6f798db9f3f3a9e0123fdc389a86ac69dedf (commit)
       via  d568a1561642ed9b7b7b6282b86c56786d10a956 (commit)
       via  b778d8deedf344c8116362633925b8153c7f1bf1 (commit)
       via  59f1562c25119a4fe27411e6350f2149d6147148 (commit)
       via  c8100fc0faadf8ba35e4df32b4760cc975e3a83d (commit)
       via  3de9bad359e28ced4a2539e411d222ffd82a4a62 (commit)
       via  5c7d58222834793629a30248e72b6ea96e832dc4 (commit)
       via  cb4c7abb774e2d95806d8b0ec6ea5cd130c1b5b8 (commit)
       via  4a04277ad112e0966296133795f93cf6a3daa48e (commit)
       via  e7429b1ced0c69fa7901f888f8dc25f00fc346a4 (commit)
       via  404e8a4136bbbab39df7dd5119841e131998cc15 (commit)
       via  01256694f006405c54bc2adef63ef0c8f07da9ee (commit)
       via  a4a69163d9d7e4d9f3339eb5cda0afb947180b26 (commit)
       via  fcf5aea44627def43425d03881e20902e7c0331e (commit)
       via  a75790b74095828f967c012eff7033f570d93077 (commit)
       via  d8c5e8ccfdb53cc327f7520fc7badc31d0c9c666 (commit)
       via  c3138decd77d788906885b638b344d0d1faf32c0 (commit)
       via  a2bedc8ac6fcdcd1de0a9fa3d540006481387dff (commit)
       via  3b5b94ceab7c0ed9501c5cf54b4efa17fcd7300a (commit)
       via  dd03667ab1062bba3b9413c3f8007d63302d1b31 (commit)
       via  b265969154741bf9f93167699fe7ddda1d485265 (commit)
       via  c3008bffac68b6f31e9ae9bad837cdce5de7c0db (commit)
       via  dec2ae31a46a0f41886c7ad228865cc573f2dea9 (commit)
       via  92df40a3a2ae471fbba00d6d7040230404931fd4 (commit)
       via  8636ad5023a1bdc527add40a5508f8c5b7c35221 (commit)
       via  e352ead43fbb0180e1f1c71bf1a000d1954eb777 (commit)
       via  5b5d881f47c82f320abf440c20b7a1bac078a987 (commit)
       via  89ac071eb4c7539e98c7dc17e11f57c620b54e90 (commit)
       via  87972fdef2cd853fb97624d0765686674a19e3c4 (commit)
       via  7572d270fcda1614648c6f08d711d5096ffebbe6 (commit)
       via  6102099985c1b82b6c0bba0464c1f913cc673e96 (commit)
       via  db6d8cfdc118131f497596ef1ffc121949377754 (commit)
       via  17c717d7c92d9a52101fea7e396fc133322a8786 (commit)
       via  d5b18d6c55d65e8df2dd112651e3b9b3d9e6e27a (commit)
       via  bd9ebe1404c1395edd0e029023a9e780c90f6d73 (commit)
       via  41b3d0975de65d1654f5e37c626d7c9b7c9a7a4d (commit)
       via  fae4d06b0ccaa9803e0c0da56c327b0bcfffcac5 (commit)
       via  ef10c348bffc7dad19e1832bebc453755d209420 (commit)
       via  ce29272e24e7b718b8fca9b84bc728e65f3dea24 (commit)
       via  cd532bb7b866e104304e2443cc942799c385daa5 (commit)
       via  bd1a1d8582abcfd7f29812942fa70f88d0aec7cf (commit)
       via  d0bfe3de1f8d1abdcda573188eaea9dc5fd495c7 (commit)
       via  304566d3327ef0a85188cce3109d46d5ff47177a (commit)
       via  86efc3ee53abaf1e22b53c1b360c51829e476115 (commit)
       via  fbdfe6a514a95fb46f2b811a13709024e2baf252 (commit)
       via  12af8e84a32df728462da09a00a8bec24a487720 (commit)
       via  3c0569e99498c7470ebdb639b4c5ae829af92761 (commit)
       via  aa6ab9e0bc67fe9ce5601047e84ea4a875e8eb64 (commit)
       via  854adc8ae19749e44cb79dfa0c5401f48012b13a (commit)
       via  8489b12211098ad58c008cfb74b5cb91849cf68d (commit)
       via  81d6e98cdf4caa3aa92398fc3b8bed397b40f58d (commit)
       via  a5910e00ace882b8a17169faf4607163ab454af9 (commit)
       via  60b4982836a00ef6b2a97d16f735b3f6b74dce62 (commit)
       via  52385a2ba1bf7e53f500ffde5fd34f28e69cf76b (commit)
       via  9fb5e9c14557f7567cbc7c50b9881b7d7bfa2f12 (commit)
       via  522f74f7e377135cf098b6b0b9b35284c1dfc963 (commit)
       via  2f27cb12e30c9f6e780354eecc3ff0039ed52c63 (commit)
       via  bde4fddadc75ad6071e3fc6c0980905de14c03cb (commit)
       via  e062bc4da8062b822ee85096d9adfcbca8dcb56a (commit)
       via  f6728d13e8e544dbd4b9351ed981613e5504293f (commit)
       via  ecc126a7cef371e3b88e65715ba37fb77e92ea0f (commit)
       via  47b8b9e2ce5af7fba117ae0b00e10bec414dcfb0 (commit)
       via  4db9a425644dccaf81b51ebc97b32a9cc21941a4 (commit)
       via  cc1d21342659a7def5d662d0547579f9e0d3b109 (commit)
       via  b89e63e5c326af71470124b410e6429cbd2b5c43 (commit)
       via  005d326d19ba28005182205f25edc4f7499ec0b5 (commit)
       via  3fb9954c43425775a517060959dad01fa00238f7 (commit)
       via  7856e3efaad7614979bc0b91379a0a4dcbc739d5 (commit)
       via  03a65a53231cc3132a50a1871e81a512c44da169 (commit)
       via  bfeafe2d3f9bbaa7f11f3ad870a446141c038b0d (commit)
       via  44c17bcb003a3330f595a6ab144e8439b7b630cb (commit)
       via  5c2db9dedfe9dbb14ffec24751ca23a69cead94e (commit)
       via  a3b258d1d15953816e0567511ecc527a4ccdd626 (commit)
       via  d8df80427238cdbb9ae0f6dae8bc7e9c24f6e265 (commit)
       via  7b4e2ea274ace22245264f1759279390d0300a62 (commit)
       via  66834eb838a8892d088f6b7332084a64d9f15008 (commit)
       via  893a3f7fb46021961914a8acdf1292a80e3eba93 (commit)
       via  6ce14a805f1da687dfb8535db57730d5c7403db7 (commit)
       via  037f9de09298a31026ea2ab5fbd4a599b11cc34f (commit)
       via  182efc5b5d20ac0d43501a22f349a23dc06a27a4 (commit)
       via  7142b293c870d73ce0146bfb90e6a556e0079650 (commit)
       via  91a0483c5db8ee4510981448a705981ee1cce199 (commit)
       via  362afb4f6074aaf5c9a6cacdf6a3530ec3f55d2d (commit)
       via  2c97fa84c11f6087872392d83bbf17fbd4f6fb0f (commit)
       via  0540cfbee455b197edd89b602a4b47ebf0be8588 (commit)
       via  9a707a223a3d45ccf245dee7989ca144e4e6bb49 (commit)
      from  7e174fcc746644bbfa77ab5df9ee775e221c663b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                                            |    16 +-
 COPYING.other                                      |    60 +
 Makefile.am                                        |     3 +-
 NEWS                                               |    34 +-
 README                                             |    10 +
 agent/agent.h                                      |     2 -
 agent/gpg-agent.c                                  |    28 +-
 autogen.rc                                         |     1 -
 build-aux/append-signature.sh                      |   108 +
 build-aux/gitlog-to-changelog                      |     5 +-
 build-aux/speedo.mk                                |    67 +-
 build-aux/speedo/w32/inst.nsi                      |    17 +-
 build-aux/speedo/w32/pkg-copyright.txt             |    25 +
 common/argparse.c                                  |    20 +-
 common/homedir.c                                   |    81 +-
 common/iobuf.c                                     |    37 +-
 common/iobuf.h                                     |     8 +-
 common/miscellaneous.c                             |     2 +
 common/openpgp-oid.c                               |    16 +-
 common/sysutils.c                                  |    36 +-
 common/sysutils.h                                  |     2 +
 common/util.h                                      |    21 +-
 configure.ac                                       |   180 +-
 dirmngr/Makefile.am                                |    20 +-
 dirmngr/dirmngr.c                                  |    70 +-
 dirmngr/dirmngr.h                                  |     4 +
 dirmngr/dns-stuff.c                                |  1686 ++-
 dirmngr/dns-stuff.h                                |    28 +-
 dirmngr/dns.c                                      | 11246 +++++++++++++++++++
 dirmngr/dns.h                                      |  1365 +++
 dirmngr/http.c                                     |    88 +-
 dirmngr/ks-engine-hkp.c                            |    11 +-
 dirmngr/ldap-wrapper.c                             |     5 +-
 dirmngr/loadswdb.c                                 |     5 +-
 dirmngr/server.c                                   |    16 +-
 dirmngr/t-dns-stuff.c                              |    82 +-
 doc/DETAILS                                        |    75 +-
 doc/Makefile.am                                    |     5 +-
 doc/debugging.texi                                 |     3 +-
 doc/dirmngr.texi                                   |    22 +-
 doc/examples/gpgconf.conf                          |     8 +-
 doc/faq.org                                        |     2 +-
 doc/gpg.texi                                       |   380 +-
 doc/gpgsm.texi                                     |    10 +-
 doc/howto-create-a-server-cert.texi                |     2 +-
 doc/tools.texi                                     |     9 +
 g10/armor.c                                        |     3 +
 g10/call-agent.c                                   |     5 +-
 g10/cpr.c                                          |     2 +-
 g10/decrypt.c                                      |     9 +-
 g10/distsigkey.gpg                                 |   Bin 4114 -> 3452 bytes
 g10/export.c                                       |     6 +-
 g10/getkey.c                                       |     6 +-
 g10/gpg.c                                          |   141 +-
 g10/gpgv.c                                         |    18 +-
 g10/import.c                                       |    11 +-
 g10/keydb.c                                        |     6 +-
 g10/keydb.h                                        |     9 +-
 g10/keyedit.c                                      |   163 +-
 g10/keygen.c                                       |   551 +-
 g10/keylist.c                                      |     4 +-
 g10/keyserver.c                                    |     4 -
 g10/main.h                                         |     3 +
 g10/mainproc.c                                     |    17 +-
 g10/options.h                                      |     4 +-
 g10/packet.h                                       |     6 +-
 g10/parse-packet.c                                 |     6 +-
 g10/passphrase.c                                   |     2 +-
 g10/photoid.c                                      |     2 +-
 g10/pkclist.c                                      |     9 +-
 g10/plaintext.c                                    |    22 +-
 g10/revoke.c                                       |     3 +-
 g10/sign.c                                         |    34 +-
 g10/test-stubs.c                                   |    16 +-
 g10/tofu.c                                         |  1594 +--
 g10/tofu.h                                         |    10 +-
 g10/trust.c                                        |    63 +-
 g10/trustdb.c                                      |    41 +-
 g10/trustdb.h                                      |    11 +-
 po/ca.po                                           |    10 +-
 po/cs.po                                           |    10 +-
 po/da.po                                           |    10 +-
 po/de.po                                           |   393 +-
 po/el.po                                           |    10 +-
 po/eo.po                                           |    10 +-
 po/es.po                                           |    10 +-
 po/et.po                                           |    10 +-
 po/fi.po                                           |    10 +-
 po/fr.po                                           |    10 +-
 po/gl.po                                           |     8 +-
 po/hu.po                                           |    10 +-
 po/id.po                                           |    10 +-
 po/it.po                                           |    10 +-
 po/ja.po                                           |   510 +-
 po/nb.po                                           |    12 +-
 po/pl.po                                           |    10 +-
 po/pt.po                                           |    10 +-
 po/ro.po                                           |    10 +-
 po/ru.po                                           |    12 +-
 po/sk.po                                           |    10 +-
 po/sv.po                                           |    10 +-
 po/tr.po                                           |    10 +-
 po/uk.po                                           |    12 +-
 po/zh_CN.po                                        |    10 +-
 po/zh_TW.po                                        |    10 +-
 scd/apdu.c                                         |     5 +-
 scd/app-openpgp.c                                  |    63 +-
 scd/scdaemon.c                                     |     6 +-
 scd/scdaemon.h                                     |     2 -
 sm/call-agent.c                                    |     3 +
 sm/decrypt.c                                       |     8 +-
 sm/gpgsm.c                                         |    54 +-
 tests/Makefile.am                                  |     2 +-
 tests/{migrations => gpgme}/Makefile.am            |    49 +-
 tests/gpgme/gpgme-defs.scm                         |   167 +
 tests/gpgme/run-tests.scm                          |    69 +
 tests/{openpgp => gpgme}/setup.scm                 |    17 +-
 tests/gpgme/wrap.scm                               |    60 +
 tests/gpgscm/ffi.scm                               |    35 -
 tests/gpgscm/init.scm                              |    85 +-
 tests/gpgscm/lib.scm                               |   116 +-
 tests/gpgscm/main.c                                |    21 +-
 tests/gpgscm/opdefines.h                           |    15 +-
 tests/gpgscm/repl.scm                              |     9 +-
 tests/gpgscm/scheme-private.h                      |    40 +
 tests/gpgscm/scheme.c                              |   731 +-
 tests/gpgscm/scheme.h                              |    21 +
 tests/gpgscm/tests.scm                             |   221 +-
 tests/migrations/Makefile.am                       |    33 +-
 tests/migrations/common.scm                        |    10 +-
 .../decrypt-dsa.scm => migrations/run-tests.scm}   |    22 +-
 .../{openpgp/version.scm => migrations/setup.scm}  |     7 +-
 tests/openpgp/4gb-packet.scm                       |     2 +-
 tests/openpgp/Makefile.am                          |    44 +-
 tests/openpgp/clearsig.scm                         |     4 +-
 tests/openpgp/{encrypt-dsa.scm => compression.scm} |    20 +-
 tests/openpgp/conventional-mdc.scm                 |     2 +-
 tests/openpgp/conventional.scm                     |     2 +-
 tests/openpgp/{setup.scm => decrypt-multifile.scm} |    31 +-
 tests/openpgp/defs.scm                             |   103 +-
 tests/openpgp/delete-keys.scm                      |   103 +
 tests/openpgp/ecc.scm                              |     4 +-
 tests/openpgp/{armencrypt.scm => enarmor.scm}      |     6 +-
 tests/openpgp/encrypt-dsa.scm                      |     2 +-
 .../{armencrypt.scm => encrypt-multifile.scm}      |    16 +-
 tests/openpgp/encrypt.scm                          |     2 +-
 tests/openpgp/export.scm                           |     4 +-
 tests/openpgp/genkey1024.scm                       |     2 +-
 tests/openpgp/gpgtar.scm                           |     7 +-
 tests/openpgp/gpgv-forged-keyring.scm              |     2 +-
 ...tachm.scm => import-revocation-certificate.scm} |    27 +-
 tests/openpgp/import.scm                           |     2 +-
 tests/openpgp/issue2015.scm                        |     2 +-
 tests/openpgp/issue2346.scm                        |     2 +-
 tests/openpgp/issue2419.scm                        |     2 +-
 tests/openpgp/key-selection.scm                    |     2 +-
 tests/openpgp/mds.scm                              |     2 +-
 tests/openpgp/multisig.scm                         |     2 +-
 tests/openpgp/quick-key-manipulation.scm           |    89 +-
 tests/openpgp/run-tests.scm                        |   140 +-
 tests/openpgp/samplekeys/authenticate-only.pub.asc |    31 +
 tests/openpgp/samplekeys/authenticate-only.sec.asc |    60 +
 .../openpgp/samplemsgs/revoke-2D727CC768697734.asc |     8 +
 tests/openpgp/setup.scm                            |     2 +-
 tests/openpgp/signencrypt.scm                      |     2 +-
 tests/openpgp/sigs.scm                             |     2 +-
 tests/openpgp/ssh-export.scm                       |    52 +
 tests/openpgp/{ssh.scm => ssh-import.scm}          |     6 +-
 tests/openpgp/tofu-2183839A-1.txt                  |   Bin 191 -> 0 bytes
 tests/openpgp/tofu-BC15C85A-1.txt                  |     9 -
 tests/openpgp/tofu-EE37CF96-1.txt                  |     9 -
 tests/openpgp/tofu-keys-secret.asc                 |    95 -
 tests/openpgp/tofu-keys.asc                        |    47 -
 tests/openpgp/tofu.scm                             |   216 +-
 tests/openpgp/tofu/conflicting/1C005AF3-1.txt      |   Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-2.txt      |   Bin 0 -> 338 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-3.txt      |   Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-4.txt      |   Bin 0 -> 338 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-5.txt      |   Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg |   Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/1C005AF3.gpg        |   Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/B662E42F-1.txt      |   Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/B662E42F-2.txt      |   Bin 0 -> 339 bytes
 tests/openpgp/tofu/conflicting/B662E42F-3.txt      |   Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/B662E42F-4.txt      |   Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/B662E42F-5.txt      |     1 +
 tests/openpgp/tofu/conflicting/B662E42F-secret.gpg |   Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/B662E42F.gpg        |   Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-1.txt      |   Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-2.txt      |   Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-3.txt      |   Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-4.txt      |   Bin 0 -> 342 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-5.txt      |   Bin 0 -> 340 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg |   Bin 0 -> 2537 bytes
 tests/openpgp/tofu/conflicting/BE04EB2B.gpg        |   Bin 0 -> 1235 bytes
 tests/openpgp/tofu/conflicting/README              |     8 +
 .../openpgp/{detachm.scm => verify-multifile.scm}  |    31 +-
 tests/openpgp/verify.scm                           |     6 +-
 tools/Makefile.am                                  |     4 +-
 tools/call-dirmngr.c                               |    52 +
 tools/call-dirmngr.h                               |     2 +
 tools/gpg-wks-client.c                             |   114 +
 tools/gpg-wks-server.c                             |   170 +-
 tools/gpg-wks.h                                    |     3 +
 tools/gpgconf-comp.c                               |   303 +-
 tools/gpgconf.c                                    |    17 +-
 tools/gpgconf.h                                    |     6 +-
 tools/mime-maker.c                                 |     7 +-
 tools/wks-util.c                                   |   242 +-
 209 files changed, 20415 insertions(+), 3436 deletions(-)
 create mode 100644 COPYING.other
 create mode 100755 build-aux/append-signature.sh
 create mode 100644 dirmngr/dns.c
 create mode 100644 dirmngr/dns.h
 copy tests/{migrations => gpgme}/Makefile.am (55%)
 create mode 100644 tests/gpgme/gpgme-defs.scm
 create mode 100644 tests/gpgme/run-tests.scm
 copy tests/{openpgp => gpgme}/setup.scm (63%)
 mode change 100755 => 100644
 create mode 100644 tests/gpgme/wrap.scm
 copy tests/{openpgp/decrypt-dsa.scm => migrations/run-tests.scm} (68%)
 mode change 100755 => 100644
 copy tests/{openpgp/version.scm => migrations/setup.scm} (81%)
 mode change 100755 => 100644
 copy tests/openpgp/{encrypt-dsa.scm => compression.scm} (68%)
 copy tests/openpgp/{setup.scm => decrypt-multifile.scm} (50%)
 create mode 100755 tests/openpgp/delete-keys.scm
 copy tests/openpgp/{armencrypt.scm => enarmor.scm} (87%)
 copy tests/openpgp/{armencrypt.scm => encrypt-multifile.scm} (72%)
 copy tests/openpgp/{detachm.scm => import-revocation-certificate.scm} (56%)
 mode change 100755 => 100644
 create mode 100644 tests/openpgp/samplekeys/authenticate-only.pub.asc
 create mode 100644 tests/openpgp/samplekeys/authenticate-only.sec.asc
 create mode 100644 tests/openpgp/samplemsgs/revoke-2D727CC768697734.asc
 create mode 100755 tests/openpgp/ssh-export.scm
 rename tests/openpgp/{ssh.scm => ssh-import.scm} (94%)
 delete mode 100644 tests/openpgp/tofu-2183839A-1.txt
 delete mode 100644 tests/openpgp/tofu-BC15C85A-1.txt
 delete mode 100644 tests/openpgp/tofu-EE37CF96-1.txt
 delete mode 100755 tests/openpgp/tofu-keys-secret.asc
 delete mode 100755 tests/openpgp/tofu-keys.asc
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/1C005AF3.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/B662E42F.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-1.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-2.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-3.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-4.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-5.txt
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B-secret.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/BE04EB2B.gpg
 create mode 100644 tests/openpgp/tofu/conflicting/README
 copy tests/openpgp/{detachm.scm => verify-multifile.scm} (55%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 12:10:57 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 12:10:57 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.16-171-gbff47f6
Message-ID: <E1cJIJv-0007qM-Ae@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  bff47f6ec0825ca8b144ce66a5dd9849af719378 (commit)
       via  ade32464a25fdb35cc0f39e46d303ceba68ea8f6 (commit)
       via  192a5cbcd5ccdd2e78e15f798b7c1d02a663dda2 (commit)
      from  4a283b51734616bc91c02639b000585219ea7551 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 NEWS         |   4 +
 README       |   7 +-
 configure.ac |   2 +-
 po/ca.po     | 266 ++++++++++++++++++++++++++++--------------
 po/cs.po     | 277 ++++++++++++++++++++++++++++++--------------
 po/da.po     | 270 +++++++++++++++++++++++++++++--------------
 po/el.po     | 266 ++++++++++++++++++++++++++++--------------
 po/eo.po     | 265 ++++++++++++++++++++++++++++--------------
 po/es.po     | 281 ++++++++++++++++++++++++++++++--------------
 po/et.po     | 266 ++++++++++++++++++++++++++++--------------
 po/fi.po     | 266 ++++++++++++++++++++++++++++--------------
 po/fr.po     | 270 +++++++++++++++++++++++++++++--------------
 po/gl.po     | 266 ++++++++++++++++++++++++++++--------------
 po/hu.po     | 266 ++++++++++++++++++++++++++++--------------
 po/id.po     | 266 ++++++++++++++++++++++++++++--------------
 po/it.po     | 266 ++++++++++++++++++++++++++++--------------
 po/ja.po     |  38 +++---
 po/nb.po     | 339 ++++++++++++++++++++++++++++++++++++-----------------
 po/pl.po     | 277 ++++++++++++++++++++++++++++++--------------
 po/pt.po     | 265 ++++++++++++++++++++++++++++--------------
 po/ro.po     | 264 ++++++++++++++++++++++++++++--------------
 po/ru.po     | 371 ++++++++++++++++++++++++++++++++++++++++++-----------------
 po/sk.po     | 266 ++++++++++++++++++++++++++++--------------
 po/sv.po     | 270 +++++++++++++++++++++++++++++--------------
 po/tr.po     | 272 +++++++++++++++++++++++++++++--------------
 po/uk.po     | 338 +++++++++++++++++++++++++++++++++++++----------------
 po/zh_CN.po  | 264 ++++++++++++++++++++++++++++--------------
 po/zh_TW.po  | 263 ++++++++++++++++++++++++++++--------------
 28 files changed, 4595 insertions(+), 2136 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 12:36:26 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 12:36:26 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 2923c1a9b27df6581d735a8e858edff231c5079d
Message-ID: <E1cJIia-0001Ix-U1@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  2923c1a9b27df6581d735a8e858edff231c5079d (commit)
       via  4bf95e03eae2bf864b8b542f228f6de2d3ddfad8 (commit)
      from  1591b7d04ace4026685a65f9feef7cbc5b4f33dd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2923c1a9b27df6581d735a8e858edff231c5079d
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 12:06:34 2016 +0100

    swdb: Release GnuPG 2.1.17

diff --git a/web/index.org b/web/index.org
index 2691139..8373104 100644
--- a/web/index.org
+++ b/web/index.org
@@ -65,6 +65,12 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+
+** GnuPG 2.1.17 released (2016-12-20)
+
+A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000400.html][announcement
+mail]] for details.
+
 ** Libgcrypt 1.7.5 released (2016-12-15)
 
 We are pleased to announce the availability of Libgcrypt version
diff --git a/web/swdb.mac b/web/swdb.mac
index 67d884d..47398b0 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -21,17 +21,17 @@
 #
 # GnuPG-2.1
 #
-#+macro: gnupg21_ver  2.1.16
-#+macro: gnupg21_date 2016-11-18
-#+macro: gnupg21_size 5703k
-#+macro: gnupg21_sha1 67540161c9fe289153c4a5ea60f7cdce0ef48897
-#+macro: gnupg21_sha2 49b9a6a6787ad00d4d2d69d8c7ee8905923782583f06078a064a0c80531d8844
-#
-#+macro: gnupg21_w32_ver  2.1.16_20161118
-#+macro: gnupg21_w32_date 2016-11-18
-#+macro: gnupg21_w32_size 3681k
-#+macro: gnupg21_w32_sha1 50b0bd286faa90e5c71417b5f2f36cf5de964084
-#+macro: gnupg21_w32_sha2 14b17454b32f93099133056833b17dafc76946560be4439fb1894d5dc52fd9dc
+#+macro: gnupg21_ver  2.1.17
+#+macro: gnupg21_date 2016-12-20
+#+macro: gnupg21_size 5830k
+#+macro: gnupg21_sha1 d83ab893faab35f37ace772ca29b939e6a5aa6a7
+#+macro: gnupg21_sha2 c5dc54db432209fa8f9bdb071c8fb60a765ff28e363150e30bdd4543160243cb
+#
+#+macro: gnupg21_w32_ver  2.1.17_20161220
+#+macro: gnupg21_w32_date 2016-12-20
+#+macro: gnupg21_w32_size 3665k
+#+macro: gnupg21_w32_sha1 a95758912ed5354235ff9947a3c402108d5ec67e
+#+macro: gnupg21_w32_sha2 f727fd5126f98dc7a0473a01e2fb404bd1870473bf4f6d15e3a29f8b5fa5ad23
 
 
 #

commit 4bf95e03eae2bf864b8b542f228f6de2d3ddfad8
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 10:21:12 2016 +0100

    web: Update signature key
    
    This update is required because gniibe prolonged his key.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/web/signature_key.org b/web/signature_key.org
index e25fbb7..a9d1b4b 100644
--- a/web/signature_key.org
+++ b/web/signature_key.org
@@ -23,7 +23,7 @@ Current releases are signed by one or more of these four keys:
         Key fingerprint = 46CC 7308 65BB 5C78 EBAB  ADCF 0437 6F3E E085 6959
   uid   David Shaw (GnuPG Release Signing Key) <dshaw 'at' jabberwocky.com>
 
-  pub   rsa2048/33BD3F06 2014-10-29 [expires: 2016-10-28]
+  pub   rsa2048/33BD3F06 2014-10-29 [expires: 2020-10-30]
         Key fingerprint = 031E C253 6E58 0D8E A286  A9F2 2071 B08A 33BD 3F06
   uid   NIIBE Yutaka (GnuPG Release Key) <gniibe 'at' fsij.org>
 
@@ -54,7 +54,6 @@ Here is a public key block with all required keys:
 
 #+BEGIN_EXAMPLE
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2
 
 mQENBE0ti4EBCACqGtKlX9jI/enhlBdy2cyQP6Q7JoyxtaG6/ckAKWHYrqFTQk3I
 Ue8TuDrGT742XFncG9PoMBfJDUNltIPgKFn8E9tYQqAOlpSA25bOb30cA2ADkrjg
@@ -68,88 +67,99 @@ hKZOAKw3RUePTU80SRLPdg4AH+vkm1JMWFFpwvHlgfxqnE9rp13o7L/4UwNUwqH8
 5zCwu7SHz9cX3d4UUwzcP6qQP4BQEH9/xlpQS9eTK9b2RMyggqwd/J8mxjvoWzL8
 Klf/wl6jXHn/yP92xG9/YA86lNOL1N3/PhlZzLuJ6bdD9WzsEp/+kh3UDfjkIrOc
 WkqwupB+d01R4bHPu9tvXy8Xut8Sok2zku2xVkEOsV2TXHbwuHO2AGC5pWDX6wgC
-E4F5XeCB/0ovao2/bk22w1TxzP6PMxo6sLkmaF6D0frhM2bl4C/uSsqInAQQAQIA
-BgUCTS2NBAAKCRBTtiDQHODGMEZPBACLmrMjpwmyVvI6X5N4NlWctXQWY+4ODx2i
-O9CtUM/F96YiPFlmgwsJUzyXLwALYk+shh83TjQLfjexohzS1O07DCZUy7Lsb9R7
-HbYJ1Yf/QcEykbiAW465CZb1BAOMR2HUODBTaABaidfnhmUzJtayz7Y0KKRHAx+V
-VS6kfnsFq5kBDQRUUF8HAQgAh1mo8r+kVWVTNsNlyurm2tdZKiQbdeVgpBgcDnqI
-3fAV58C3nC8DVuK5qVGZPB/jbu42jc8BXGP1l6UP+515LQL5GpTtV0pRWUO02WOu
-TLZBVQcq53vzbg1xVo31rWV96mqGAPs8lGUCm09fpuiVKQojO6/Ihkg7/bnzeSbc
-X5Xk9eKLhyB7tnakuYJeRYm4bjs+YDApK8IFQyevYF8pjTcbLTSNJPW9WLCsozsy
-11r4xdfRcTWjARVz5VzTnQ+Px8YtsnjQ3qwNJBpsqMLCdDN7YGhh/mlwPjgdq/UF
-f5+bY6f3ew0vshBqInBQycBSmYyoX0Ye3sAS/OR4nu5ZaQARAQABtD5EYXZpZCBT
-aGF3IChHbnVQRyBSZWxlYXNlIFNpZ25pbmcgS2V5KSA8ZHNoYXdAamFiYmVyd29j
-a3kuY29tPokBPgQTAQIAKAUCVFBfBwIbAwUJCbp27gYLCQgHAwIGFQgCCQoLBBYC
-AwECHgECF4AACgkQBDdvPuCFaVmIoQf+POxCWkCTicRVlq0kust/iwYO1egK9FWG
-130e2Irnv2lAZZN/0S5ibjHCYFp9gfMgmtVTF5oWXjSDAy/kIykQBBcUVx4SCJbd
-MtKSdsSIQMz6P4DxXumxQm79msOsbi5TsdtUwjqdrbu2sHloE7ck/hTXUCkX3zuq
-txY7W23BCQxVVT5qUaFuAHkkQaaBgAb8gdgixmkIBfu9u8k3k9zUKm/PNfMjxClv
-ORkP8gev+XyzNgcXM49h5YYlmDT+Ahv99nUM1wg8yJTjefBAY0fL982Scx30nDQO
-3w7ihALUoj5+TXQjhs3sWPJ8u3pstr9XcfzEZC77/CZmRYNr8g5hBokBHAQQAQgA
-BgUCVFOBbwAKCRAkmznSTyXjtmHeB/0X00v959Oyc0EsSLOlfC52qsEn5cU7vxFb
-+KY9aKtG4+hApJxemkqpCgA5+xZwXp3SQOf0sYFwz5OsukIjRF0HgSEdjoMTH6b7
-lT0nCwKo8AMU0nJbopVIJikHOzk2gUqh1gxu5iml1RbSkmFhiGjYeqM+ONQynCeX
-Gg3LLZCQ1eeoaX69bvbWQFDtTIn2HYvjZLjuGC6PGH/naZ7GchiiiK0bs4UOdJFX
-HtITC/7DcgEiHMHOMT3XlwINTexZG0grl2LuWuyyhurJh5IO6geArPKUmR8SjJjV
-azpwbutZhYjTzfUpPvKK8kCSan9Df5eeekDrKCU8x8aqLDVyoQcRmQENBFRQOyMB
-CADmEHA30Xc6op/72ZcJdQMriVvnAyN22L3rEbTiACfvBajs6fpzme2uJlC5F1Hk
-Ydx3DvdcLoIV6Ed6j95JViJaoE0EB8T1TNuQRL5xj7jAPOpVpyqErF3vReYdCDIr
-umlEb8zCQvVTICsIYYAo3oxX/Z/M7ogZDDeOe1G57f/Y8YacZqKw0AqW+20dZn3W
-7Lgpjl8EzX25AKBl3Hi/z+s/T7JCqxZPAlQq/KbHkYh81oIm+AX6/5o+vCynEEx/
-2OkdeoNeeHgujwL8axAwPoYKVV9COy+/NQcofZ6gvig1+S75RrkG4AdiL64C7OpX
-1N2kX08KlAzI9+65lyUw8t0zABEBAAG0Mk5JSUJFIFl1dGFrYSAoR251UEcgUmVs
-ZWFzZSBLZXkpIDxnbmlpYmVAZnNpai5vcmc+iQE8BBMBCAAmBQJUUDsjAhsDBQkD
-wmcABQsHCAkDBBUICQoFFgIDAQACHgECF4AACgkQIHGwijO9PwZ1/wgA0LKal1wF
-Za8FPUonc2GzwE9YhkZiJB8KA/a7T6//cW4N46/GswiqZJxN1RdKs1B+rp7EMMU3
-bhoXstLBcIYveljqh4lPBWCsTT2+/OpwAmgnzjgdTHcpnCMTEOdZktD5SKrTj2tV
-aWXAlWK/UsEEanA3cvzofy44n7rm+Eoa7P1YGCHL++Ihsi66ElbehilTT/xxckHX
-Uji1XDvoagEENEHk5j4Z2mhWtjnGclvuiBkS4XezezNMW/fPAypZX4bkURNbGd8j
-tkb3Eqt+bv+ZQoSA+Ukv8APaAzj8lRSw+CYjDxpoM0jtmiPrk+u/Do46COVA/IX2
-2aYNT2Y2KoWJV4kBHAQQAQgABgUCVFOCHQAKCRAkmznSTyXjtoIhB/0ZE/ppI2Gc
-qDxSwPKkRkkoMD8oXdKkPxjUF2jgP+bceHKiz1F78cx/eZltB4av8OujO1IwqH2C
-0aVr46W3eSyIcpmmw6F9sjLcTfyZJfWJrvobb7WQSKvWw0eHFgNGR6Z+BA3ohjws
-aCZtzzkH2gXI+EM7qaZozMw+eSkZ4qTE9B4/hkMZZpBO0oGy9PQzSlADGftyyuTt
-oSUvepfs+EvYSddQ7skXWq0zePuOhng2Mppl690A+aTywyetbPvVeqjiAbI7NB5f
-8Tw7dk0Febe9NHvbwzgiStMPmIKrTcthvgIClBkZvmkBFWAPxYPdHfLzAlpDGxJt
-R31c0zNFBH68mQENBFRDqVIBCAC0k8eZKDmNqdmawOlJ/m62L2g8uXT/+/vAEGb1
-yaib09xI6tfGXzbqlDwrLIZcJsSIT/nt/ajJnIVbc3137va4XbwMzsDpAMH4mmiT
-oqk+izEChGm2knzrLwhoflR8aGsKL35QoZT/erdjfgPeCRLvf25fHsN2Jb0WIMzC
-56VkMeFoza+9HZ5hrkemmm+gPvIvhEUopxCyOS8mK5WjB4zzIdyDJfkqVpHvafNP
-0N4LIsedKdyHcj/K3kY4Kejl99GW1z1snBgPamoN2/e52Pf6KTw2FjsSGZ72oalc
-rkBR4wacUizGxKcRD2Y6Xa0g9mwToWdNBQCIII+uTzOzq1EDABEBAAG0IVdlcm5l
-ciBLb2NoIChSZWxlYXNlIFNpZ25pbmcgS2V5KYkBPQQTAQgAJwUCVEOpUgIbAwUJ
-C6oF9QULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRCKhhscfv1g2aH7B/wIW6mV
-mTmzW2xc1q1MUdssExQBhEeONrbWJ/HiGZP/MaabgQ/+wZuThTAwfGM5zFQBOvrB
-OGURhINU6lYQlcOrVo+V8Z1mNQKFWaKxJaY5Ku1bB1OuX9FHLEiMibogHu5fjJIX
-BE8XrnvueejyFQ5g/uX2xcGgCWlMe49sR3K+lEl3n93xTmSNhP52r0gTjMjbqKWK
-UaIGJ5OcWSrvawdfqLXkxR8phq2AlHHEfxpcZsOp9mZirWYQ5jcgGgFP0LYXUw/R
-nxFpOcrj45qufmyEL9QJKjBV5RaHJbqukefwUInPQtVUmINqQxztSh5QxQP2tsUP
-IeEi5RAoCwLJam8ziQEcBBABCAAGBQJUU4JUAAoJECSbOdJPJeO2c+cH+wevKc8w
-bkWSoGOJiYDglVMJa4x5utgHyXP4PyqelIQ7yibfQq3YyOU9RWRGxfvuofPXpx1E
-u/XtCGgw03r4HZhauauYe27IDpA5P/Go7+WqufT6gMBoZf/1cD2ykQZpFyszEKHf
-Y+BlzqPJcRaXy4+uQG3O+bh/R2eIGAJDao/AclJI+kfckeY5DzRTibPex+rGAkxZ
-8qHtlCb0WeUbL3mgl9f3LlbPH77w1on6XqqIaQ+ODSS/3CUOIhNI3lrGO7mIqhSC
-0n+rpqLHeVLpLkz0IFvsJOp9UOHDCA8oL0cQtJGP1pN7muKR9nCVtoNuN41JapoO
-4ZaHe5Y0r5MIofSYjgRDt/rHAQQA0JkZeitcyQMqk2xGd/5mGoc4+YNwQo8OSmVw
-IvY8UAI3tBorhF6ha9niaqZU4vdldTnXMU0j1oPckAhOgRPaOvaEZhYUTF0F/15p
-iAF5dkZQ6dsmXVUkPNYMZTpkc2nA+IACBiOmygGBkLFuXvHRW1i6SNz28iRH/UZc
-YLi/2iEAIIFWUJm0Jldlcm5lciBLb2NoIChkaXN0IHNpZykgPGRkOWpuQGdudS5v
-cmc+iLwEEwECACYCGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAUCTS2MtwUJClRO
-YQAKCRBTtiDQHODGMPB4A/0U1DJR9LbkWuBs8Ko6KJoKLMVI6iYNJBhAtm3dxWeU
-xA16eYDWW/b9Lk5KnjtSWuGOeqa7MCsXnkyHkO88KE9IcM3mFnhfFN2qagd/nRch
-l9MPsdOgf/ug7j72Alv2V8s28R10HTjfwySe/omXWwK3qn8ou6N7ID+EwCV7i2e2
-u5kBogQ1oh4eEQQA/pdK4Oafa1uDN7Cr5nss4bNpg8YUSg01VVJ08KTCEdpCAPaU
-+NzaP3KD2ow74WU2gzP70s9uSGQ2Vie4BLvOkaaBHba/3ivBrg3ILFrxbOfmKQg8
-Fhtncd/TBOwzfkkbxBNcVJuBPRtjZ3dlDbS4IPNsIIv2SuCIfQmA8qNGvWsAoIrJ
-90b2fzERCZkKtfkoyYA8fnNrBADhJ8RmIrKiCnDk3Tzk04nu6O8fp3ptrmnO7jlu
-vDfsEVsYRjyMbDnbnjCGu1PeFoP2HZ+H9lp4CaQbyjWh2JlvI9UOc72V16SFkV0r
-8k0euNQXHhhzXWIkfz4gwSbBkN2nO5+6cIVeKnsdyFYkQyVs+Q86/PMfjo7utyrc
-WLq1CAQAou3da1JR6+KJO4gUZVh2F1NoaVCEPAvlDhNV10/hwe5mS0kTjUJ1jMl5
-6mwAFvhFFF9saW+eAnrwIOHjopbdHrPBmTJlOnNMHVLJzFlqjihwRRZQyL8iNu2m
-farn9Mr28ut5BQmp0CnNEJ6hl0Cs7l2xagWFtlEK2II144vK3fG0J1dlcm5lciBL
-b2NoIChnbnVwZyBzaWcpIDxkZDlqbkBnbnUub3JnPohhBBMRAgAhAheABQkOFIf9
-BQJBvGheBgsJCAcDAgMVAgMDFgIBAh4BAAoJEGi3q4lXVI3NBJMAn01313ag0tgj
-rGUZtDlKYbmNIeMeAJ0UpVsjxpylBcSjsPE8MAki7Hb2Rw==
-=W3eM
+E4F5XeCB/0ovao2/bk22w1TxzP6PMxo6sLkmaF6D0frhM2bl4C/uSsqIVgQQEQgA
+BgUCTS3FNwAKCRDyrYWsHkKzZysEAN93fd8HXhcZ/KXcO2bhx8RR8sJxhdY1ozL5
+maaCAN9zyHJx4YDZdw9OFDs3rXeiL5wfM7hcLyjW2igOiJwEEAECAAYFAk0tjQQA
+CgkQU7Yg0BzgxjBGTwQAi5qzI6cJslbyOl+TeDZVnLV0FmPuDg8dojvQrVDPxfem
+IjxZZoMLCVM8ly8AC2JPrIYfN040C343saIc0tTtOwwmVMuy7G/Uex22CdWH/0HB
+MpG4gFuOuQmW9QQDjEdh1DgwU2gAWonX54ZlMybWss+2NCikRwMflVUupH57BauZ
+AQ0EVFBfBwEIAIdZqPK/pFVlUzbDZcrq5trXWSokG3XlYKQYHA56iN3wFefAt5wv
+A1biualRmTwf427uNo3PAVxj9ZelD/udeS0C+RqU7VdKUVlDtNljrky2QVUHKud7
+824NcVaN9a1lfepqhgD7PJRlAptPX6bolSkKIzuvyIZIO/2583km3F+V5PXii4cg
+e7Z2pLmCXkWJuG47PmAwKSvCBUMnr2BfKY03Gy00jST1vViwrKM7Mtda+MXX0XE1
+owEVc+Vc050Pj8fGLbJ40N6sDSQabKjCwnQze2BoYf5pcD44Hav1BX+fm2On93sN
+L7IQaiJwUMnAUpmMqF9GHt7AEvzkeJ7uWWkAEQEAAbQ+RGF2aWQgU2hhdyAoR251
+UEcgUmVsZWFzZSBTaWduaW5nIEtleSkgPGRzaGF3QGphYmJlcndvY2t5LmNvbT6J
+AT4EEwECACgFAlRQXwcCGwMFCQm6du4GCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheA
+AAoJEAQ3bz7ghWlZiKEH/jzsQlpAk4nEVZatJLrLf4sGDtXoCvRVhtd9HtiK579p
+QGWTf9EuYm4xwmBafYHzIJrVUxeaFl40gwMv5CMpEAQXFFceEgiW3TLSknbEiEDM
++j+A8V7psUJu/ZrDrG4uU7HbVMI6na27trB5aBO3JP4U11ApF987qrcWO1ttwQkM
+VVU+alGhbgB5JEGmgYAG/IHYIsZpCAX7vbvJN5Pc1CpvzzXzI8QpbzkZD/IHr/l8
+szYHFzOPYeWGJZg0/gIb/fZ1DNcIPMiU43nwQGNHy/fNknMd9Jw0Dt8O4oQC1KI+
+fk10I4bN7FjyfLt6bLa/V3H8xGQu+/wmZkWDa/IOYQaJARwEEAEIAAYFAlRTgW8A
+CgkQJJs50k8l47Zh3gf9F9NL/efTsnNBLEizpXwudqrBJ+XFO78RW/imPWirRuPo
+QKScXppKqQoAOfsWcF6d0kDn9LGBcM+TrLpCI0RdB4EhHY6DEx+m+5U9JwsCqPAD
+FNJyW6KVSCYpBzs5NoFKodYMbuYppdUW0pJhYYho2HqjPjjUMpwnlxoNyy2QkNXn
+qGl+vW721kBQ7UyJ9h2L42S47hgujxh/52mexnIYooitG7OFDnSRVx7SEwv+w3IB
+IhzBzjE915cCDU3sWRtIK5di7lrssobqyYeSDuoHgKzylJkfEoyY1Ws6cG7rWYWI
+0831KT7yivJAkmp/Q3+XnnpA6yglPMfGqiw1cqEHEZkBDQRUUDsjAQgA5hBwN9F3
+OqKf+9mXCXUDK4lb5wMjdti96xG04gAn7wWo7On6c5ntriZQuRdR5GHcdw73XC6C
+FehHeo/eSVYiWqBNBAfE9UzbkES+cY+4wDzqVacqhKxd70XmHQgyK7ppRG/MwkL1
+UyArCGGAKN6MV/2fzO6IGQw3jntRue3/2PGGnGaisNAKlvttHWZ91uy4KY5fBM19
+uQCgZdx4v8/rP0+yQqsWTwJUKvymx5GIfNaCJvgF+v+aPrwspxBMf9jpHXqDXnh4
+Lo8C/GsQMD6GClVfQjsvvzUHKH2eoL4oNfku+Ua5BuAHYi+uAuzqV9TdpF9PCpQM
+yPfuuZclMPLdMwARAQABtDJOSUlCRSBZdXRha2EgKEdudVBHIFJlbGVhc2UgS2V5
+KSA8Z25paWJlQGZzaWoub3JnPokBPAQTAQgAJgIbAwULBwgJAwQVCAkKBRYCAwEA
+Ah4BAheABQJYDxRZBQkLS5A2AAoJECBxsIozvT8GvG8IAMBIlGz9voYcSSXAdQOu
+vz2gM2kOjvMHzN6VlS9VP06IjnTz2DnejFZwLmxJw8e8mZjUo0jw22uo1HREQhDr
+ne3S1IazPMeTUCUNzpWFMxXNc6SAyrw9apWa8gouGUWJv3HOwVs8EFA2E9UdtDJ2
+uG7MY/+eC5K/aeOAyudZEbvS8rgZypTFrBtBcNKUWZhz7FRn63HxEmYLE3p6I19Z
+DXrc1WTazF2oz18zym6cuURr6waRbdSemUTshpLnKCBZXzJ82bXBgXNnfdmc3gtS
+24ZmM3ZfK/rYztEDkiTks2R1gwDwf5RtDpaf5LD2ufESdbLuT+8blAlscbgYLBcw
+DquJATwEEwEIACYFAlRQOyMCGwMFCQPCZwAFCwcICQMEFQgJCgUWAgMBAAIeAQIX
+gAAKCRAgcbCKM70/BnX/CADQspqXXAVlrwU9SidzYbPAT1iGRmIkHwoD9rtPr/9x
+bg3jr8azCKpknE3VF0qzUH6unsQwxTduGhey0sFwhi96WOqHiU8FYKxNPb786nAC
+aCfOOB1MdymcIxMQ51mS0PlIqtOPa1VpZcCVYr9SwQRqcDdy/Oh/Ljifuub4Shrs
+/VgYIcv74iGyLroSVt6GKVNP/HFyQddSOLVcO+hqAQQ0QeTmPhnaaFa2OcZyW+6I
+GRLhd7N7M0xb988DKllfhuRRE1sZ3yO2RvcSq35u/5lChID5SS/wA9oDOPyVFLD4
+JiMPGmgzSO2aI+uT678OjjoI5UD8hfbZpg1PZjYqhYlXiQEcBBABCAAGBQJUU4Id
+AAoJECSbOdJPJeO2giEH/RkT+mkjYZyoPFLA8qRGSSgwPyhd0qQ/GNQXaOA/5tx4
+cqLPUXvxzH95mW0Hhq/w66M7UjCofYLRpWvjpbd5LIhymabDoX2yMtxN/Jkl9Ymu
++htvtZBIq9bDR4cWA0ZHpn4EDeiGPCxoJm3POQfaBcj4QzuppmjMzD55KRnipMT0
+Hj+GQxlmkE7SgbL09DNKUAMZ+3LK5O2hJS96l+z4S9hJ11DuyRdarTN4+46GeDYy
+mmXr3QD5pPLDJ61s+9V6qOIBsjs0Hl/xPDt2TQV5t700e9vDOCJK0w+YgqtNy2G+
+AgKUGRm+aQEVYA/Fg90d8vMCWkMbEm1HfVzTM0UEfryZAQ0EVEOpUgEIALSTx5ko
+OY2p2ZrA6Un+brYvaDy5dP/7+8AQZvXJqJvT3Ejq18ZfNuqUPCsshlwmxIhP+e39
+qMmchVtzfXfu9rhdvAzOwOkAwfiaaJOiqT6LMQKEabaSfOsvCGh+VHxoawovflCh
+lP96t2N+A94JEu9/bl8ew3YlvRYgzMLnpWQx4WjNr70dnmGuR6aab6A+8i+ERSin
+ELI5LyYrlaMHjPMh3IMl+SpWke9p80/Q3gsix50p3IdyP8reRjgp6OX30ZbXPWyc
+GA9qag3b97nY9/opPDYWOxIZnvahqVyuQFHjBpxSLMbEpxEPZjpdrSD2bBOhZ00F
+AIggj65PM7OrUQMAEQEAAbQhV2VybmVyIEtvY2ggKFJlbGVhc2UgU2lnbmluZyBL
+ZXkpiQE9BBMBCAAnBQJUQ6lSAhsDBQkLqgX1BQsJCAcCBhUICQoLAgQWAgMBAh4B
+AheAAAoJEIqGGxx+/WDZofsH/AhbqZWZObNbbFzWrUxR2ywTFAGER442ttYn8eIZ
+k/8xppuBD/7Bm5OFMDB8YznMVAE6+sE4ZRGEg1TqVhCVw6tWj5XxnWY1AoVZorEl
+pjkq7VsHU65f0UcsSIyJuiAe7l+MkhcETxeue+556PIVDmD+5fbFwaAJaUx7j2xH
+cr6USXef3fFOZI2E/navSBOMyNuopYpRogYnk5xZKu9rB1+oteTFHymGrYCUccR/
+Glxmw6n2ZmKtZhDmNyAaAU/QthdTD9GfEWk5yuPjmq5+bIQv1AkqMFXlFocluq6R
+5/BQic9C1VSYg2pDHO1KHlDFA/a2xQ8h4SLlECgLAslqbzOIVgQQEQgABgUCVFN/
+cwAKCRDyrYWsHkKzZwgvAOClyPiQdDr/1/iTrX/Vf4auT9MnSnJnnfegszGTAN9Q
+9Y/aNPd4F1ujAAj1qgvOoJ3bZXmuspURV1uaiQEcBBABCAAGBQJUU4JUAAoJECSb
+OdJPJeO2c+cH+wevKc8wbkWSoGOJiYDglVMJa4x5utgHyXP4PyqelIQ7yibfQq3Y
+yOU9RWRGxfvuofPXpx1Eu/XtCGgw03r4HZhauauYe27IDpA5P/Go7+WqufT6gMBo
+Zf/1cD2ykQZpFyszEKHfY+BlzqPJcRaXy4+uQG3O+bh/R2eIGAJDao/AclJI+kfc
+keY5DzRTibPex+rGAkxZ8qHtlCb0WeUbL3mgl9f3LlbPH77w1on6XqqIaQ+ODSS/
+3CUOIhNI3lrGO7mIqhSC0n+rpqLHeVLpLkz0IFvsJOp9UOHDCA8oL0cQtJGP1pN7
+muKR9nCVtoNuN41JapoO4ZaHe5Y0r5MIofSYjgRDt/rHAQQA0JkZeitcyQMqk2xG
+d/5mGoc4+YNwQo8OSmVwIvY8UAI3tBorhF6ha9niaqZU4vdldTnXMU0j1oPckAhO
+gRPaOvaEZhYUTF0F/15piAF5dkZQ6dsmXVUkPNYMZTpkc2nA+IACBiOmygGBkLFu
+XvHRW1i6SNz28iRH/UZcYLi/2iEAIIFWUJm0Jldlcm5lciBLb2NoIChkaXN0IHNp
+ZykgPGRkOWpuQGdudS5vcmc+iLwEEwECACYCGwMGCwkIBwMCBBUCCAMEFgIDAQIe
+AQIXgAUCTS2MtwUJClROYQAKCRBTtiDQHODGMPB4A/0U1DJR9LbkWuBs8Ko6KJoK
+LMVI6iYNJBhAtm3dxWeUxA16eYDWW/b9Lk5KnjtSWuGOeqa7MCsXnkyHkO88KE9I
+cM3mFnhfFN2qagd/nRchl9MPsdOgf/ug7j72Alv2V8s28R10HTjfwySe/omXWwK3
+qn8ou6N7ID+EwCV7i2e2u5kBogQ1oh4eEQQA/pdK4Oafa1uDN7Cr5nss4bNpg8YU
+Sg01VVJ08KTCEdpCAPaU+NzaP3KD2ow74WU2gzP70s9uSGQ2Vie4BLvOkaaBHba/
+3ivBrg3ILFrxbOfmKQg8Fhtncd/TBOwzfkkbxBNcVJuBPRtjZ3dlDbS4IPNsIIv2
+SuCIfQmA8qNGvWsAoIrJ90b2fzERCZkKtfkoyYA8fnNrBADhJ8RmIrKiCnDk3Tzk
+04nu6O8fp3ptrmnO7jluvDfsEVsYRjyMbDnbnjCGu1PeFoP2HZ+H9lp4CaQbyjWh
+2JlvI9UOc72V16SFkV0r8k0euNQXHhhzXWIkfz4gwSbBkN2nO5+6cIVeKnsdyFYk
+QyVs+Q86/PMfjo7utyrcWLq1CAQAou3da1JR6+KJO4gUZVh2F1NoaVCEPAvlDhNV
+10/hwe5mS0kTjUJ1jMl56mwAFvhFFF9saW+eAnrwIOHjopbdHrPBmTJlOnNMHVLJ
+zFlqjihwRRZQyL8iNu2mfarn9Mr28ut5BQmp0CnNEJ6hl0Cs7l2xagWFtlEK2II1
+44vK3fG0J1dlcm5lciBLb2NoIChnbnVwZyBzaWcpIDxkZDlqbkBnbnUub3JnPohh
+BBMRAgAhAheABQkOFIf9BQJBvGheBgsJCAcDAgMVAgMDFgIBAh4BAAoJEGi3q4lX
+VI3NBJMAn01313ag0tgjrGUZtDlKYbmNIeMeAJ0UpVsjxpylBcSjsPE8MAki7Hb2
+Rw==
+=iaRC
 -----END PGP PUBLIC KEY BLOCK-----
 #+END_EXAMPLE

-----------------------------------------------------------------------

Summary of changes:
 web/index.org         |   6 ++
 web/signature_key.org | 180 ++++++++++++++++++++++++++------------------------
 web/swdb.mac          |  22 +++---
 3 files changed, 112 insertions(+), 96 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 18:43:06 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 18:43:06 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-6-g6204f81
Message-ID: <E1cJORQ-0003r5-Uw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6204f8104fea42d706a68e77e2dc0bca4704bddc (commit)
      from  36c14139285982def6ad942d4b2d8bef7ed4ea76 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6204f8104fea42d706a68e77e2dc0bca4704bddc
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 18:38:12 2016 +0100

    tests: Avoid skipping exectool tests.
    
    * common/t-exectool.c (test_executing_true): Try also /usr/bin/true.
    (test_executing_false): Try also /usr/bin/false.
    --
    
    Reported-by: Nelson H. F. Beebe
      I then ran a test on all our test lab systems, and found that
      /bin/false is missing on DragonFlyBSD, FreeBSD, GhostBSD,
      HardenedBSD, Mac OS X, MidnightBSD, Minix, one version of MirBSD,
      NetBSD, OpenBSD, PacBSD, PCBSD, and TrueOS.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/t-exectool.c b/common/t-exectool.c
index 8b6ee6a..9cea2d1 100644
--- a/common/t-exectool.c
+++ b/common/t-exectool.c
@@ -39,21 +39,27 @@ static void
 test_executing_true (void)
 {
   gpg_error_t err;
-  const char *argv[] = { "/bin/true", NULL };
+  const char *pgmname     = "/bin/true";
+  const char *alt_pgmname = "/usr/bin/true";
+  const char *argv[]     = { NULL, NULL };
   char *result;
   size_t len;
 
-  if (access (argv[0], X_OK))
+  if (access (pgmname, X_OK))
     {
-      fprintf (stderr, "skipping test: %s not executable: %s",
-               argv[0], strerror (errno));
-      return;
+      if (access (alt_pgmname, X_OK))
+        {
+          fprintf (stderr, "skipping test: %s not executable: %s\n",
+                   pgmname, strerror (errno));
+          return;
+        }
+      pgmname = alt_pgmname;
     }
 
   if (verbose)
-    fprintf (stderr, "Executing %s...\n", argv[0]);
+    fprintf (stderr, "Executing %s...\n", pgmname);
 
-  err = gnupg_exec_tool (argv[0], &argv[1], "", &result, &len);
+  err = gnupg_exec_tool (pgmname, argv, "", &result, &len);
   if (err)
     fail ("gnupg_exec_tool", err);
 
@@ -66,24 +72,31 @@ static void
 test_executing_false (void)
 {
   gpg_error_t err;
-  const char *argv[] = { "/bin/false", NULL };
+  const char *pgmname     = "/bin/false";
+  const char *alt_pgmname = "/usr/bin/false";
+  const char *argv[]     = { NULL, NULL };
   char *result;
   size_t len;
 
-  if (access (argv[0], X_OK))
+  if (access (pgmname, X_OK))
     {
-      fprintf (stderr, "skipping test: %s not executable: %s",
-               argv[0], strerror (errno));
-      return;
+      if (access (alt_pgmname, X_OK))
+        {
+          fprintf (stderr, "skipping test: %s not executable: %s\n",
+                   pgmname, strerror (errno));
+          return;
+        }
+      pgmname = alt_pgmname;
     }
 
   if (verbose)
-    fprintf (stderr, "Executing %s...\n", argv[0]);
+    fprintf (stderr, "Executing %s...\n", pgmname);
 
-  err = gnupg_exec_tool (argv[0], &argv[1], "", &result, &len);
+  err = gnupg_exec_tool (pgmname, argv, "", &result, &len);
   assert (err == GPG_ERR_GENERAL);
 }
 
+
 static void
 test_executing_cat (const char *vector)
 {
@@ -94,7 +107,7 @@ test_executing_cat (const char *vector)
 
   if (access (argv[0], X_OK))
     {
-      fprintf (stderr, "skipping test: %s not executable: %s",
+      fprintf (stderr, "skipping test: %s not executable: %s\n",
                argv[0], strerror (errno));
       return;
     }
@@ -131,7 +144,7 @@ test_catting_cat (void)
 
   if (access (argv[0], X_OK))
     {
-      fprintf (stderr, "skipping test: %s not executable: %s",
+      fprintf (stderr, "skipping test: %s not executable: %s\n",
                argv[0], strerror (errno));
       return;
     }
@@ -139,7 +152,7 @@ test_catting_cat (void)
   in = es_fopen (argv[1], "r");
   if (in == NULL)
     {
-      fprintf (stderr, "skipping test: could not open %s: %s",
+      fprintf (stderr, "skipping test: could not open %s: %s\n",
                argv[1], strerror (errno));
       return;
     }
@@ -147,7 +160,7 @@ test_catting_cat (void)
   err = es_fseek (in, 0L, SEEK_END);
   if (err)
     {
-      fprintf (stderr, "skipping test: could not seek in %s: %s",
+      fprintf (stderr, "skipping test: could not seek in %s: %s\n",
                argv[1], gpg_strerror (err));
       return;
     }

-----------------------------------------------------------------------

Summary of changes:
 common/t-exectool.c | 49 +++++++++++++++++++++++++++++++------------------
 1 file changed, 31 insertions(+), 18 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 20 23:48:13 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 20 Dec 2016 23:48:13 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 4af1636c04e8e893f1f6c295a9e30202f28c6fc3
Message-ID: <E1cJTCi-0001VZ-4v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  4af1636c04e8e893f1f6c295a9e30202f28c6fc3 (commit)
      from  2923c1a9b27df6581d735a8e858edff231c5079d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4af1636c04e8e893f1f6c295a9e30202f28c6fc3
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Dec 20 23:45:26 2016 +0100

    faq: Update why-not-idea.org

diff --git a/web/documentation/pressreview.org b/web/documentation/pressreview.org
index 8a7b747..7ed99ea 100644
--- a/web/documentation/pressreview.org
+++ b/web/documentation/pressreview.org
@@ -11,6 +11,11 @@
 
 Here are articles originally published in English.
 
+** ArsTechnica UK 2016-12-20
+
+  [[http://arstechnica.co.uk/information-technology/2016/12/signal-does-not-replace-pgp/][Op-ed: Why I?m not giving up on PGP]]
+
+
 ** ProPublica 2015-02-05
   The World?s Email Encryption Software Relies on One Guy, Who is Going Broke\\
   Julia Angwin
diff --git a/web/faq/why-not-idea.org b/web/faq/why-not-idea.org
index 7c81c36..4df907b 100644
--- a/web/faq/why-not-idea.org
+++ b/web/faq/why-not-idea.org
@@ -1,5 +1,15 @@
 #+TITLE: GnuPG - Why not IDEA
 
+* Update
+
+  Note that the IDEA patent has expired and IDEA is now directly
+  supported since GnuPG 1.4.13 respective 2.x with Libgcrypt 1.6.  The
+  use of IDEA is not suggested due to its short block length and it is
+  only provided to allow decryption of archived data.
+
+  The section below is thus only of historic interest.
+
+
 * Why not IDEA
 
    IDEA is a patented algorithm and therefore the use of IDEA in

-----------------------------------------------------------------------

Summary of changes:
 web/documentation/pressreview.org |  5 +++++
 web/faq/why-not-idea.org          | 10 ++++++++++
 2 files changed, 15 insertions(+)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 21 14:03:36 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 21 Dec 2016 14:03:36 +0100
Subject: [git] GPG-ERROR - branch, wk-master,
 created. libgpg-error-1.26-1-g8976310
Message-ID: <E1cJgYU-0006DV-J5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, wk-master has been created
        at  8976310a1a203507b0ed8357be02e84f06d44135 (commit)

- Log -----------------------------------------------------------------
commit 8976310a1a203507b0ed8357be02e84f06d44135
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 21 14:00:09 2016 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index f58245e..b19fd11 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.27 (unreleased) [C2_/A2_/R_]
+-----------------------------------------------
+
+
 Noteworthy changes in version 1.26 (2016-12-21) [C21/A21/R0]
 -----------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 3d8bb12..6dca8f9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -27,7 +27,7 @@ min_automake_version="1.14"
 # another commit, and a push so that the git magic is able to work.
 # See below for the LT versions.
 m4_define([mym4_version_major], [1])
-m4_define([mym4_version_minor], [26])
+m4_define([mym4_version_minor], [27])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 82266defa39901ec9f97533623af5638a35e5a77
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 21 13:03:16 2016 +0100

    Release 1.26
    
    * configure.ac: Bump LT version to C21/A21/R0.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 21637bc..f58245e 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
+Noteworthy changes in version 1.26 (2016-12-21) [C21/A21/R0]
 -----------------------------------------------
 
  * New option --desc for gpg-error.
diff --git a/configure.ac b/configure.ac
index e3ca56e..3d8bb12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -51,8 +51,8 @@ AC_INIT([libgpg-error],[mym4_full_version],[https://bugs.gnupg.org])
 #   (Interfaces added:			AGE++)
 #   (Interfaces removed:		AGE=0)
 # Note that added error codes don't constitute an interface change.
-LIBGPG_ERROR_LT_CURRENT=20
-LIBGPG_ERROR_LT_AGE=20
+LIBGPG_ERROR_LT_CURRENT=21
+LIBGPG_ERROR_LT_AGE=21
 LIBGPG_ERROR_LT_REVISION=0
 ################################################
 

commit 5eedc159ef962999cae92abf9cef0b88b739f003
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 21 13:02:53 2016 +0100

    po: Auto-update
    
    --

diff --git a/po/cs.po b/po/cs.po
index 4ff6ef0..62da9d9 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -974,6 +974,61 @@ msgid "Object is too old"
 msgstr "Dodan? objekt je p??li? kr?tk?"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nezn?m? jm?no"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Neplatn? k?d operace"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Nezn?m? chyba syst?mu"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Neplatn? ?et?zec OID"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Neplatn? S-v?raz"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Chyb? certifik?t vydavatele"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "De?ifrov?n? selhalo"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "?as vypr?el"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Obecn? chyba IPC"
@@ -1410,11 +1465,6 @@ msgstr "%s: pozor: %s nebylo mo?n? rozpoznat\n"
 #~ msgstr "Neplatn? data"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "De?ifrov?n? selhalo"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Obecn? chyba"
diff --git a/po/da.po b/po/da.po
index 61ba1e2..bf6e7a6 100644
--- a/po/da.po
+++ b/po/da.po
@@ -970,6 +970,61 @@ msgid "Object is too old"
 msgstr "Angivet objekt er for kort"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Ukendt navn"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Ugyldig handlingskode"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Ukendt systemfejl"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Ugyldig OID-streng"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Ugyldigt S-udtryk"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Manglende udstedercertfikat"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Afkryptering mislykkedes"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tidsudl?b"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Generel IPC-fejl"
@@ -1405,11 +1460,6 @@ msgstr "%s: advarsel: kunne ikke genkende %s\n"
 #~ msgstr "Ugyldige data"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Afkryptering mislykkedes"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Generel fejl"
diff --git a/po/eo.po b/po/eo.po
index 5948f9a..fd2c336 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -1028,6 +1028,61 @@ msgid "Object is too old"
 msgstr "Provizita objekto tro mallongas"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nekonata nomo"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Malvalida operacia kodo"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Nekonata sistem-eraro"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Malvalida ?eno OID"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Malvalida S-esprimo"
+
+#, fuzzy
+#| msgid "Missing certificate"
+msgid "Missing DNS query packet"
+msgstr "Mankas atestilo"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Mal?ifro fiaskis"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tempofino"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "?enerala eraro de IPC"
@@ -1459,11 +1514,6 @@ msgstr "%s: averto: ne eblis rekoni %s\n"
 #~ msgstr "Malvalida datumaro"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Mal?ifro fiaskis"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "?enerala eraro"
diff --git a/po/fr.po b/po/fr.po
index db1cdcb..6a28821 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -967,6 +967,61 @@ msgid "Object is too old"
 msgstr "L'objet fourni est trop petit"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nom inconnu"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Code d'op?ration incorrect"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Erreur syst?me inconnue"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Cha?ne OID incorrecte"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Expression symbolique incorrecte"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Certificat de l'?metteur manquant"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "?chec de d?chiffrement"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "D?lai d'attente d?pass?"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Erreur g?n?rale IPC"
@@ -1402,11 +1457,6 @@ msgstr "%s?: attention?: impossible de reconna?tre %s\n"
 #~ msgstr "Donn?es incorrectes"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "?chec de d?chiffrement"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Erreur g?n?rale"
diff --git a/po/hu.po b/po/hu.po
index cb143e0..6db001c 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -1026,6 +1026,61 @@ msgid "Object is too old"
 msgstr "A megadott objektum t?l kicsi"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Ismeretlen n?v"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "?rv?nytelen m?veletk?d"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Ismeretlen rendszerhiba"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "?rv?nytelen OID karakterl?nc"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "?rv?nytelen S-kifejez?s"
+
+#, fuzzy
+#| msgid "Missing certificate"
+msgid "Missing DNS query packet"
+msgstr "Hi?nyz? tan?s?tv?ny"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Visszafejt?s sikertelen"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Id?t?ll?p?s"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "?ltal?nos IPC hiba"
@@ -1457,11 +1512,6 @@ msgstr "%s: figyelmeztet?s: nem siker?lt felismerni: %s\n"
 #~ msgstr "?rv?nytelen adatok"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Visszafejt?s sikertelen"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "?ltal?nos hiba"
diff --git a/po/it.po b/po/it.po
index dc17bcb..27976c6 100644
--- a/po/it.po
+++ b/po/it.po
@@ -965,6 +965,61 @@ msgid "Object is too old"
 msgstr "L'oggetto fornito ? troppo piccolo"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nome sconosciuto"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Codice di operazione non valido"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Errore di sistema sconosciuto"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Testo per l'OID non valido"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "S-expression non valida"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Manca il certificato dell'emittente"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Decifratura non riuscita"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tempo scaduto"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Errore IPC generale"
@@ -1400,11 +1455,6 @@ msgstr "%s: avviso: impossibile riconoscere %s\n"
 #~ msgstr "Dati non validi"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Decifratura non riuscita"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Errore generale"
diff --git a/po/ja.po b/po/ja.po
index e0e76c5..90ff7e8 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -959,6 +959,61 @@ msgstr "?????????"
 msgid "Object is too old"
 msgstr "??????????????????"
 
+#, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "???????"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "??????????"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "??????????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "??? OID ?????"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "??? S-???"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "????????????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "?????????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "????????"
+
 msgid "General LDAP error"
 msgstr "??LDAP?????"
 
diff --git a/po/nl.po b/po/nl.po
index d90ac4f..2d5b311 100644
--- a/po/nl.po
+++ b/po/nl.po
@@ -966,6 +966,61 @@ msgid "Object is too old"
 msgstr "Geleverd object is te kort"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Onbekende naam"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Ongeldige bewerkingscode"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Onbekende systeemfout"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Ongeldige OID-tekenreeks"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Ongeldige S-expressie"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Ontbrekend certificaat van uitgever"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Ontcijfering is mislukt"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tijdslimiet"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Algemene IPC-fout"
@@ -1401,11 +1456,6 @@ msgstr "%s: waarschuwing: kon %s niet herkennen\n"
 #~ msgstr "Ongeldige gegevens"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Ontcijfering is mislukt"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Algemene fout"
diff --git a/po/pl.po b/po/pl.po
index 66f66f2..96efcdc 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -957,6 +957,61 @@ msgstr "Certyfikat zbyt m?ody"
 msgid "Object is too old"
 msgstr "Dostarczony obiekt jest zbyt ma?y"
 
+#, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nieznana nazwa"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Niepoprawny kod operacji"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Nieznany b??d systemu"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Niepoprawny ?a?cuch OID"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Niepoprawne S-wyra?enie"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Brak certyfikatu wystawcy"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Odszyfrowywanie nie powiod?o si?"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Up?yn?? limit czasu"
+
 msgid "General LDAP error"
 msgstr "B??d og?lny LDAP"
 
diff --git a/po/pt.po b/po/pt.po
index 822d307..f01d975 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -966,6 +966,61 @@ msgid "Object is too old"
 msgstr "O objecto fornecido ? demasiado curto"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nome desconhecido"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "C?digo de opera??o inv?lido"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Erro de sistema desconhecido"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Sequ?ncia OID inv?lida"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Express?o simb?lica inv?lida"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "Certificado do emissor em falta"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Desencripta??o falhada"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tempo limite"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Erro gen?rico de IPC"
@@ -1401,11 +1456,6 @@ msgstr "%s: aviso: n?o consegui reconhecer %s\n"
 #~ msgstr "Dados inv?lidos"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Desencripta??o falhada"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Erro gen?rico"
diff --git a/po/ro.po b/po/ro.po
index 6354580..c99aea1 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -1039,6 +1039,60 @@ msgid "Object is too old"
 msgstr "Obiectul furnizat e prea scurt"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Nume necunoscut"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Cod opera?ie invalid"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Eroare de sistem necunoscut?"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "?ir OID invalid"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Expresie-S invalid?"
+
+#, fuzzy
+msgid "Missing DNS query packet"
+msgstr "Certificat lips?"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Decriptarea a e?uat"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Pauz?"
+
+#, fuzzy
 msgid "General LDAP error"
 msgstr "Eroare general?"
 
@@ -1454,11 +1508,6 @@ msgstr "%s: avertisment: nu am putut recunoa?te %s\n"
 #~ msgstr "Date invalide"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Decriptarea a e?uat"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Eroare general?"
diff --git a/po/ru.po b/po/ru.po
index 8ff628b..84a6442 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -963,6 +963,61 @@ msgstr "?????????? ??????? ?????"
 msgid "Object is too old"
 msgstr "????????? ?????? ??????? ???"
 
+#, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "??????????? ???"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "???????????? ??? ????????"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "??????????? ????????? ??????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "???????????? ?????? OID"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "???????????? S-?????????"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "?? ??????? ??????????? ????????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "???? ???????????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "????? ???????"
+
 msgid "General LDAP error"
 msgstr "????? ?????? LDAP"
 
diff --git a/po/sr.po b/po/sr.po
index 1a0f4f4..99815c7 100644
--- a/po/sr.po
+++ b/po/sr.po
@@ -1025,6 +1025,61 @@ msgid "Object is too old"
 msgstr "?????????? ??????? ?? ?????????"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "???????? ?????"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "?????????? ????? ?????"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "????????? ?????? ???????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "?????????? ??? ?????"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "?????????? ?-?????"
+
+#, fuzzy
+#| msgid "Missing certificate"
+msgid "Missing DNS query packet"
+msgstr "????????? ???????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "??????????? ???? ??????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "????? ?? ???????"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "????? ?????? ???-?"
@@ -1456,11 +1511,6 @@ msgstr "%s: ?????????: ?? ???? ?? ????????? ?%s?\n
 #~ msgstr "?????????? ??????"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "??????????? ???? ??????"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "????? ??????"
diff --git a/po/sv.po b/po/sv.po
index 5ed1db1..1b4dd93 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -1014,6 +1014,60 @@ msgid "Object is too old"
 msgstr "Tillhandah?llet objekt ?r f?r kort"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "Ok?nt namn"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "Ogiltig ?tg?rdskod"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "Ok?nt systemfel"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Ogiltig OID-str?ng"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Ogiltigt S-uttryck"
+
+#, fuzzy
+msgid "Missing DNS query packet"
+msgstr "Saknar certifikat"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "Dekryptering misslyckades"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Tidsgr?ns"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "Allm?nt IPC-fel"
@@ -1445,11 +1499,6 @@ msgstr "%s: varning: k?nde inte igen %s\n"
 #~ msgstr "Ogiltig data"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "Dekryptering misslyckades"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "Allm?nt fel"
diff --git a/po/uk.po b/po/uk.po
index 173bacd..7286479 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -974,6 +974,61 @@ msgstr "?????????? ? ????? ?????"
 msgid "Object is too old"
 msgstr "??????? ?????? ? ????? ????????"
 
+#, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "???????? ?????"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "??????????? ??? ???"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "???????? ???????? ???????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "??????????? ????? OID"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "??????????? S-?????"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "?? ???????? ??????????? ???????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "?????? ????????????? ??????? ???????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "??? ??????????"
+
 msgid "General LDAP error"
 msgstr "???????? ??????? LDAP"
 
@@ -1296,11 +1351,6 @@ msgstr "%s: ????????????: ?? ??????? ?????????? %
 #~ msgstr "?????????? ????"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "?????? ????????????? ??????? ???????"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "???????? ???????"
diff --git a/po/vi.po b/po/vi.po
index 1179fca..27f97f5 100644
--- a/po/vi.po
+++ b/po/vi.po
@@ -1016,6 +1016,60 @@ msgid "Object is too old"
 msgstr "?? cung c?p m?t ??i t??ng qu? ng?n"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "T?n kh?ng r?"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "M? thao t?c kh?ng h?p l?"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "G?p l?i h? th?ng kh?ng r?"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "Chu?i OID kh?ng h?p l?"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "Bi?u th?c S kh?ng h?p l?"
+
+#, fuzzy
+msgid "Missing DNS query packet"
+msgstr "Ch?ng nh?n c?n thi?u"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "L?i gi?i m?t m?"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "Qu? gi?"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "L?i IPC chung"
@@ -1447,11 +1501,6 @@ msgstr "%s: c?nh b?o : kh?ng th? nh?n ra %s\n"
 #~ msgstr "D? li?u kh?ng h?p l?"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "L?i gi?i m?t m?"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "L?i chung"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index a65757e..cedf74e 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -1013,6 +1013,58 @@ msgid "Object is too old"
 msgstr "??????"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "????"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "??????"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "???????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "???OID ???"
+
+msgid "Invalid textual address form"
+msgstr ""
+
+#, fuzzy
+msgid "Missing DNS query packet"
+msgstr "????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "??"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "??IPC ??"
@@ -1444,11 +1496,6 @@ msgstr "%s???????? %s\n"
 #~ msgstr "?????"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "????"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "????"
diff --git a/po/zh_TW.po b/po/zh_TW.po
index afa8ae4..3c3aa8e 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -968,6 +968,61 @@ msgid "Object is too old"
 msgstr "???????"
 
 #, fuzzy
+#| msgid "Unknown name"
+msgid "Unknown flag"
+msgstr "?????"
+
+#, fuzzy
+#| msgid "Invalid operation code"
+msgid "Invalid execution order"
+msgstr "??????"
+
+msgid "Already fetched"
+msgstr ""
+
+msgid "Try again later"
+msgstr ""
+
+msgid "System bug detected"
+msgstr ""
+
+#, fuzzy
+#| msgid "Unknown system error"
+msgid "Unknown DNS error"
+msgstr "???????"
+
+#, fuzzy
+#| msgid "Invalid OID string"
+msgid "Invalid DNS section"
+msgstr "??? OID ??"
+
+#, fuzzy
+#| msgid "Invalid S-expression"
+msgid "Invalid textual address form"
+msgstr "??? S-???"
+
+#, fuzzy
+#| msgid "Missing issuer certificate"
+msgid "Missing DNS query packet"
+msgstr "???????"
+
+msgid "Missing DNS answer packet"
+msgstr ""
+
+msgid "Connection closed in DNS"
+msgstr ""
+
+#, fuzzy
+#| msgid "Decryption failed"
+msgid "Verification failed in DNS"
+msgstr "????"
+
+#, fuzzy
+#| msgid "Timeout"
+msgid "DNS Timeout"
+msgstr "??"
+
+#, fuzzy
 #| msgid "General IPC error"
 msgid "General LDAP error"
 msgstr "???? IPC ??"
@@ -1403,11 +1458,6 @@ msgstr "%s: ??: ???? %s\n"
 #~ msgstr "?????"
 
 #, fuzzy
-#~| msgid "Decryption failed"
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "????"
-
-#, fuzzy
 #~| msgid "General error"
 #~ msgid "LDAP Other general error"
 #~ msgstr "????"

commit 591f829322453c4a112c465b18895f66c1f148b9
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 21 12:57:42 2016 +0100

    po: Update German translation
    
    --

diff --git a/po/de.po b/po/de.po
index 1a8ebcc..9736aa3 100644
--- a/po/de.po
+++ b/po/de.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: libgpg-error-1.19\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-11-14 17:12+0100\n"
+"PO-Revision-Date: 2016-12-21 12:56+0100\n"
 "Last-Translator: Werner Koch <wk at gnupg.org>\n"
 "Language-Team: none\n"
 "Language: de\n"
@@ -951,6 +951,48 @@ msgstr "Objekt zu jung"
 msgid "Object is too old"
 msgstr "Objekt zu alt"
 
+msgid "Unknown flag"
+msgstr "Unbekanntes Flag"
+
+msgid "Invalid execution order"
+msgstr "Ung?ltige Verarbeitungsreihenfolge"
+
+msgid "Already fetched"
+msgstr "Bereits abgeholt"
+
+msgid "Try again later"
+msgstr "Sp?ter erneut versuchen"
+
+msgid "System bug detected"
+msgstr "Fehler im Betriebssystem entdeckt"
+
+msgid "Unknown DNS error"
+msgstr "Unbekannter DNS Fehlercode"
+
+msgid "Invalid DNS section"
+msgstr "Ung?ltige DNS Section"
+
+msgid "Invalid textual address form"
+msgstr "Ung?ltiges Textadressformat"
+
+# "in der Kette" ist part of the message because many users know about
+# certificate chains and thus that keyword might give them a good hint
+# what might be wrong.
+msgid "Missing DNS query packet"
+msgstr "Fehlendes DNS Anfragepaket"
+
+msgid "Missing DNS answer packet"
+msgstr "Fehlendes DNS Antwortpaket"
+
+msgid "Connection closed in DNS"
+msgstr "Verbindung f?r DNS wurde geschlossen"
+
+msgid "Verification failed in DNS"
+msgstr "?berpr?fung im DNS fehlgeschlagen"
+
+msgid "DNS Timeout"
+msgstr "DNS Zeit?berschreitung"
+
 msgid "General LDAP error"
 msgstr "Allgemeiner LDAP Fehler"
 
@@ -1268,9 +1310,6 @@ msgstr "%s: Warnung: %s konnte nicht erkannt werden\n"
 #~ msgid "LCUP Invalid data"
 #~ msgstr "LCUP Ung?ltige Daten"
 
-#~ msgid "Assertion failed in lDAP"
-#~ msgstr "\"Assertion\" in LDAP fehlgeschlagen"
-
 #~ msgid "LDAP Other general error"
 #~ msgstr "Sonstiger allgemeiner LDAP Fehler"
 

-----------------------------------------------------------------------


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 21 16:23:33 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 21 Dec 2016 16:23:33 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 4e257c976be2efb0e8edeb6312cf3abb2be3c7af
Message-ID: <E1cJijv-00049Z-Ck@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  4e257c976be2efb0e8edeb6312cf3abb2be3c7af (commit)
      from  4af1636c04e8e893f1f6c295a9e30202f28c6fc3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4e257c976be2efb0e8edeb6312cf3abb2be3c7af
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Dec 21 14:02:16 2016 +0100

    swdb: Release gpg-error 1.26

diff --git a/web/swdb.mac b/web/swdb.mac
index 47398b0..39c6ce6 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -111,11 +111,11 @@
 #
 # LIBGPG-ERROR
 #
-#+macro: libgpg_error_ver  1.25
-#+macro: libgpg_error_date 2016-11-14
-#+macro: libgpg_error_size 778k
-#+macro: libgpg_error_sha1 8ab7494e40f80f4138edc9516981bf4afe7d9dbf
-#+macro: libgpg_error_sha2 f628f75843433b38b05af248121beb7db5bd54bb2106f384edac39934261320c
+#+macro: libgpg_error_ver  1.26
+#+macro: libgpg_error_date 2016-12-21
+#+macro: libgpg_error_size 779k
+#+macro: libgpg_error_sha1 9a926e7ee6309e539313443555535d49a2a5c9f1
+#+macro: libgpg_error_sha2 4c4bcbc90116932e3acd37b37812d8653b1b189c1904985898e860af818aee69
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/swdb.mac | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 21 16:27:09 2016
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 21 Dec 2016 16:27:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-7-g6e96cdd
Message-ID: <E1cJinP-0004D7-NC@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6e96cdd41a0e55b672309431062f37c4a4a9f485 (commit)
      from  6204f8104fea42d706a68e77e2dc0bca4704bddc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6e96cdd41a0e55b672309431062f37c4a4a9f485
Author: Justus Winter <justus at g10code.com>
Date:   Wed Dec 21 16:14:45 2016 +0100

    gpgscm: Guard use of union member.
    
    * tests/gpgscm/scheme.c (opexe_5): Check that we have a file port
    before accessing filename.  Fixes a crash on 32-bit architectures.
    
    Fixes-commit: e7429b1ced0c69fa7901f888f8dc25f00fc346a4
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index a5b7691..2844545 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -4838,7 +4838,7 @@ static pointer opexe_5(scheme *sc, enum scheme_opcodes op) {
                } else {
                     sc->nesting_stack[sc->file_i]++;
 #if USE_TAGS && SHOW_ERROR_LINE
-		    {
+		    if (sc->load_stack[sc->file_i].kind & port_file) {
 		      const char *filename =
 			sc->load_stack[sc->file_i].rep.stdio.filename;
 		      int lineno =

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/scheme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 00:18:34 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 22 Dec 2016 00:18:34 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.25-15-gb257cd7
Message-ID: <E1cJq9b-0008Ag-W7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  b257cd7fe711e4f856b0df6390f4f43cb05f26c8 (commit)
      from  f02a657f0129b30700b2f36956ee37b40cc2da82 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b257cd7fe711e4f856b0df6390f4f43cb05f26c8
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Dec 22 08:17:42 2016 +0900

    po: Update Japanese translation.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/po/ja.po b/po/ja.po
index e0e76c5..a0262d6 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -1,14 +1,14 @@
 # Japanese messages for GnuPG libgpg-error
-# Copyright (C) 2010, 2012, 2014, 2015 Free Software Foundation, Inc.
+# Copyright (C) 2010, 2012, 2014, 2015, 2016 Free Software Foundation, Inc.
 # This file is distributed under the same license as the libgpg-error package.
 # Yasuaki Taniguchi <yasuakit at gmail.com>, 2010.
 # Takeshi Hamasaki <hmatrjp at users.sourceforge.jp>, 2012.
 # NIIBE Yutaka <gniibe at fsij.org>, 2014, 2015, 2016.
 msgid ""
 msgstr ""
-"Project-Id-Version: libgpg-error 1.19\n"
+"Project-Id-Version: libgpg-error 1.26\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-02-26 09:42+0900\n"
+"PO-Revision-Date: 2016-12-22 08:12+0900\n"
 "Last-Translator: NIIBE Yutaka <gniibe at fsij.org>\n"
 "Language-Team: none\n"
 "Language: ja\n"
@@ -125,7 +125,7 @@ msgstr "???????????"
 msgid "Invalid cipher algorithm"
 msgstr "?????????????"
 
-msgid "Cannot open keyring"
+msgid "Keyring open"
 msgstr "????????"
 
 msgid "Invalid packet"
@@ -728,9 +728,6 @@ msgstr "S??????16???????????"
 msgid "Bad octal character in S-expression"
 msgstr "S??????8???????????"
 
-msgid "All subkeys are expired or revoked"
-msgstr ""
-
 msgid "Database is corrupted"
 msgstr "????????????????"
 
@@ -920,45 +917,6 @@ msgstr "IPC??????????"
 msgid "Unknown IPC inquire"
 msgstr "???IPC???????"
 
-#, fuzzy
-#| msgid "No crypto engine"
-msgid "Crypto engine too old"
-msgstr "????????????"
-
-msgid "Screen or window too small"
-msgstr ""
-
-msgid "Screen or window too large"
-msgstr ""
-
-msgid "Required environment variable not set"
-msgstr ""
-
-#, fuzzy
-#| msgid "Already exists (LDAP)"
-msgid "User ID already exists"
-msgstr "??????? (LDAP)"
-
-#, fuzzy
-#| msgid "Already exists (LDAP)"
-msgid "Name already exists"
-msgstr "??????? (LDAP)"
-
-#, fuzzy
-#| msgid "Duplicated value"
-msgid "Duplicated name"
-msgstr "???????"
-
-#, fuzzy
-#| msgid "Certificate too young"
-msgid "Object is too young"
-msgstr "?????????"
-
-#, fuzzy
-#| msgid "Provided object is too short"
-msgid "Object is too old"
-msgstr "??????????????????"
-
 msgid "General LDAP error"
 msgstr "??LDAP?????"
 

-----------------------------------------------------------------------

Summary of changes:
 po/ja.po | 50 ++++----------------------------------------------
 1 file changed, 4 insertions(+), 46 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 09:34:15 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 22 Dec 2016 09:34:15 +0100
Subject: [git] GPG-ERROR - branch, release-1.26,
 created. libgpg-error-1.26-1-g8976310
Message-ID: <E1cJypN-0008IN-Gs@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, release-1.26 has been created
        at  8976310a1a203507b0ed8357be02e84f06d44135 (commit)

- Log -----------------------------------------------------------------
-----------------------------------------------------------------------


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 09:44:00 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 22 Dec 2016 09:44:00 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.26-3-g8d844f6
Message-ID: <E1cJyyo-0008Mc-W7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  8d844f6c23f6ca2192248f8d7eb7bf52b645b25b (commit)
       via  8976310a1a203507b0ed8357be02e84f06d44135 (commit)
       via  82266defa39901ec9f97533623af5638a35e5a77 (commit)
       via  5eedc159ef962999cae92abf9cef0b88b739f003 (commit)
       via  591f829322453c4a112c465b18895f66c1f148b9 (commit)
      from  b257cd7fe711e4f856b0df6390f4f43cb05f26c8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8d844f6c23f6ca2192248f8d7eb7bf52b645b25b
Merge: b257cd7 8976310
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 22 09:38:01 2016 +0100

    Merge branch 'release-1.26'
    
    --
    
    The 1.26 release was accidently not pushed to git.gnupg.org master.
    Instead the supposed to be local wk-master branch made it to that
    server.  The new relealse-1.26 branch tries to fix that problem.


-----------------------------------------------------------------------

Summary of changes:


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 13:25:01 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 22 Dec 2016 13:25:01 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-8-g8431f5a
Message-ID: <E1cK2Qi-0001sA-3b@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  8431f5a7e88e1f42d75c4a4b61f4aa9b35457204 (commit)
      from  6e96cdd41a0e55b672309431062f37c4a4a9f485 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8431f5a7e88e1f42d75c4a4b61f4aa9b35457204
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Dec 22 21:14:26 2016 +0900

    scd: Clean up internal API for APP.
    
    * scd/app-common.h (app_readcert, app_readkey, app_setattr, app_sign,
    app_auth, app_decipher, app_get_challenge, app_check_pin): Add CTRL as
    the second argument.
    * scd/app.c: Supply CTRL to lock_reader calls.
    * scd/command.c (cmd_readcert, cmd_readkey, cmd_pksign, cmd_auth,
    cmd_pkdecrypt, cmd_setattr, cmd_random, cmd_checkpin): Follow the
    change.
    
    --
    
    APP is an abstraction of the "card application".  Most methods of APP
    should have CTRL argument to report back progress to the session.  This
    change fixes FIXMEs for missing CTRL.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index e12b4fb..21f659e 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -152,26 +152,26 @@ gpg_error_t app_munge_serialno (app_t app);
 gpg_error_t app_get_serial_and_stamp (app_t app, char **serial, time_t *stamp);
 gpg_error_t app_write_learn_status (app_t app, ctrl_t ctrl,
                                     unsigned int flags);
-gpg_error_t app_readcert (app_t app, const char *certid,
+gpg_error_t app_readcert (app_t app, ctrl_t ctrl, const char *certid,
                   unsigned char **cert, size_t *certlen);
-gpg_error_t app_readkey (app_t app, int advanced, const char *keyid,
-                 unsigned char **pk, size_t *pklen);
+gpg_error_t app_readkey (app_t app, ctrl_t ctrl, int advanced,
+                 const char *keyid, unsigned char **pk, size_t *pklen);
 gpg_error_t app_getattr (app_t app, ctrl_t ctrl, const char *name);
-gpg_error_t app_setattr (app_t app, const char *name,
+gpg_error_t app_setattr (app_t app, ctrl_t ctrl, const char *name,
                  gpg_error_t (*pincb)(void*, const char *, char **),
                  void *pincb_arg,
                  const unsigned char *value, size_t valuelen);
-gpg_error_t app_sign (app_t app, const char *keyidstr, int hashalgo,
+gpg_error_t app_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg,
               const void *indata, size_t indatalen,
               unsigned char **outdata, size_t *outdatalen );
-gpg_error_t app_auth (app_t app, const char *keyidstr,
+gpg_error_t app_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
                       gpg_error_t (*pincb)(void*, const char *, char **),
                       void *pincb_arg,
                       const void *indata, size_t indatalen,
                       unsigned char **outdata, size_t *outdatalen);
-gpg_error_t app_decipher (app_t app, const char *keyidstr,
+gpg_error_t app_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
                           gpg_error_t (*pincb)(void*, const char *, char **),
                           void *pincb_arg,
                           const void *indata, size_t indatalen,
@@ -192,13 +192,13 @@ gpg_error_t app_genkey (app_t app, ctrl_t ctrl,
                         time_t createtime,
                         gpg_error_t (*pincb)(void*, const char *, char **),
                         void *pincb_arg);
-gpg_error_t app_get_challenge (app_t app, size_t nbytes,
+gpg_error_t app_get_challenge (app_t app, ctrl_t ctrl, size_t nbytes,
                                unsigned char *buffer);
 gpg_error_t app_change_pin (app_t app, ctrl_t ctrl,
                     const char *chvnostr, int reset_mode,
                     gpg_error_t (*pincb)(void*, const char *, char **),
                     void *pincb_arg);
-gpg_error_t app_check_pin (app_t app, const char *keyidstr,
+gpg_error_t app_check_pin (app_t app, ctrl_t ctrl, const char *keyidstr,
                    gpg_error_t (*pincb)(void*, const char *, char **),
                    void *pincb_arg);
 
diff --git a/scd/app.c b/scd/app.c
index 40bdd22..6868cc3 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -584,7 +584,7 @@ app_write_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
    buffer put into CERT and the length of the certificate put into
    CERTLEN. */
 gpg_error_t
-app_readcert (app_t app, const char *certid,
+app_readcert (app_t app, ctrl_t ctrl, const char *certid,
               unsigned char **cert, size_t *certlen)
 {
   gpg_error_t err;
@@ -595,7 +595,7 @@ app_readcert (app_t app, const char *certid,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.readcert)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL/* FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.readcert (app, certid, cert, certlen);
@@ -612,7 +612,7 @@ app_readcert (app_t app, const char *certid,
 
    This function might not be supported by all applications.  */
 gpg_error_t
-app_readkey (app_t app, int advanced, const char *keyid,
+app_readkey (app_t app, ctrl_t ctrl, int advanced, const char *keyid,
              unsigned char **pk, size_t *pklen)
 {
   gpg_error_t err;
@@ -628,7 +628,7 @@ app_readkey (app_t app, int advanced, const char *keyid,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.readkey)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err= app->fnc.readkey (app, advanced, keyid, pk, pklen);
@@ -680,7 +680,7 @@ app_getattr (app_t app, ctrl_t ctrl, const char *name)
 
 /* Perform a SETATTR operation.  */
 gpg_error_t
-app_setattr (app_t app, const char *name,
+app_setattr (app_t app, ctrl_t ctrl, const char *name,
              gpg_error_t (*pincb)(void*, const char *, char **),
              void *pincb_arg,
              const unsigned char *value, size_t valuelen)
@@ -693,7 +693,7 @@ app_setattr (app_t app, const char *name,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.setattr)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.setattr (app, name, pincb, pincb_arg, value, valuelen);
@@ -705,7 +705,7 @@ app_setattr (app_t app, const char *name,
    If a PIN is required the PINCB will be used to ask for the PIN; it
    should return the PIN in an allocated buffer and put it into PIN.  */
 gpg_error_t
-app_sign (app_t app, const char *keyidstr, int hashalgo,
+app_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
           gpg_error_t (*pincb)(void*, const char *, char **),
           void *pincb_arg,
           const void *indata, size_t indatalen,
@@ -719,7 +719,7 @@ app_sign (app_t app, const char *keyidstr, int hashalgo,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.sign)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.sign (app, keyidstr, hashalgo,
@@ -737,7 +737,7 @@ app_sign (app_t app, const char *keyidstr, int hashalgo,
    PINCB will be used to ask for the PIN; it should return the PIN in
    an allocated buffer and put it into PIN.  */
 gpg_error_t
-app_auth (app_t app, const char *keyidstr,
+app_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
           gpg_error_t (*pincb)(void*, const char *, char **),
           void *pincb_arg,
           const void *indata, size_t indatalen,
@@ -751,7 +751,7 @@ app_auth (app_t app, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.auth)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.auth (app, keyidstr,
@@ -769,7 +769,7 @@ app_auth (app_t app, const char *keyidstr,
    If a PIN is required the PINCB will be used to ask for the PIN; it
    should return the PIN in an allocated buffer and put it into PIN.  */
 gpg_error_t
-app_decipher (app_t app, const char *keyidstr,
+app_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
               gpg_error_t (*pincb)(void*, const char *, char **),
               void *pincb_arg,
               const void *indata, size_t indatalen,
@@ -786,7 +786,7 @@ app_decipher (app_t app, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.decipher)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.decipher (app, keyidstr,
@@ -888,7 +888,7 @@ app_genkey (app_t app, ctrl_t ctrl, const char *keynostr, unsigned int flags,
    directly accesses the card without any application specific
    wrapper. */
 gpg_error_t
-app_get_challenge (app_t app, size_t nbytes, unsigned char *buffer)
+app_get_challenge (app_t app, ctrl_t ctrl, size_t nbytes, unsigned char *buffer)
 {
   gpg_error_t err;
 
@@ -896,7 +896,7 @@ app_get_challenge (app_t app, size_t nbytes, unsigned char *buffer)
     return gpg_error (GPG_ERR_INV_VALUE);
   if (!app->ref_count)
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = iso7816_get_challenge (app->slot, nbytes, buffer);
@@ -936,7 +936,7 @@ app_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr, int reset_mode,
    be used to initialze a the PIN cache for long lasting other
    operations.  Its use is highly application dependent. */
 gpg_error_t
-app_check_pin (app_t app, const char *keyidstr,
+app_check_pin (app_t app, ctrl_t ctrl, const char *keyidstr,
                gpg_error_t (*pincb)(void*, const char *, char **),
                void *pincb_arg)
 {
@@ -948,7 +948,7 @@ app_check_pin (app_t app, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.check_pin)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, NULL /*FIXME*/);
+  err = lock_reader (app->slot, ctrl);
   if (err)
     return err;
   err = app->fnc.check_pin (app, keyidstr, pincb, pincb_arg);
diff --git a/scd/command.c b/scd/command.c
index e771a74..31443c7 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -710,7 +710,7 @@ cmd_readcert (assuan_context_t ctx, char *line)
     return rc;
 
   line = xstrdup (line); /* Need a copy of the line. */
-  rc = app_readcert (ctrl->app_ctx, line, &cert, &ncert);
+  rc = app_readcert (ctrl->app_ctx, ctrl, line, &cert, &ncert);
   if (rc)
     log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
   xfree (line);
@@ -761,7 +761,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
   /* If the application supports the READKEY function we use that.
      Otherwise we use the old way by extracting it from the
      certificate.  */
-  rc = app_readkey (ctrl->app_ctx, advanced, line, &pk, &pklen);
+  rc = app_readkey (ctrl->app_ctx, ctrl, advanced, line, &pk, &pklen);
   if (!rc)
     { /* Yeah, got that key - send it back.  */
       rc = assuan_send_data (ctx, pk, pklen);
@@ -775,7 +775,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
     log_error ("app_readkey failed: %s\n", gpg_strerror (rc));
   else
     {
-      rc = app_readcert (ctrl->app_ctx, line, &cert, &ncert);
+      rc = app_readcert (ctrl->app_ctx, ctrl, line, &cert, &ncert);
       if (rc)
         log_error ("app_readcert failed: %s\n", gpg_strerror (rc));
     }
@@ -985,7 +985,7 @@ cmd_pksign (assuan_context_t ctx, char *line)
   if (!keyidstr)
     return out_of_core ();
 
-  rc = app_sign (ctrl->app_ctx,
+  rc = app_sign (ctrl->app_ctx, ctrl,
                  keyidstr, hash_algo,
                  pin_cb, ctx,
                  ctrl->in_data.value, ctrl->in_data.valuelen,
@@ -1036,9 +1036,7 @@ cmd_pkauth (assuan_context_t ctx, char *line)
   if (!keyidstr)
     return out_of_core ();
 
-  rc = app_auth (ctrl->app_ctx,
-                 keyidstr,
-                 pin_cb, ctx,
+  rc = app_auth (ctrl->app_ctx, ctrl, keyidstr, pin_cb, ctx,
                  ctrl->in_data.value, ctrl->in_data.valuelen,
                  &outdata, &outdatalen);
   xfree (keyidstr);
@@ -1080,9 +1078,7 @@ cmd_pkdecrypt (assuan_context_t ctx, char *line)
   keyidstr = xtrystrdup (line);
   if (!keyidstr)
     return out_of_core ();
-  rc = app_decipher (ctrl->app_ctx,
-                     keyidstr,
-                     pin_cb, ctx,
+  rc = app_decipher (ctrl->app_ctx, ctrl, keyidstr, pin_cb, ctx,
                      ctrl->in_data.value, ctrl->in_data.valuelen,
                      &outdata, &outdatalen, &infoflags);
 
@@ -1194,7 +1190,7 @@ cmd_setattr (assuan_context_t ctx, char *orig_line)
     line++;
   nbytes = percent_plus_unescape_inplace (line, 0);
 
-  rc = app_setattr (ctrl->app_ctx, keyword, pin_cb, ctx,
+  rc = app_setattr (ctrl->app_ctx, ctrl, keyword, pin_cb, ctx,
                     (const unsigned char*)line, nbytes);
   xfree (linebuf);
 
@@ -1441,7 +1437,7 @@ cmd_random (assuan_context_t ctx, char *line)
   if (!buffer)
     return out_of_core ();
 
-  rc = app_get_challenge (ctrl->app_ctx, nbytes, buffer);
+  rc = app_get_challenge (ctrl->app_ctx, ctrl, nbytes, buffer);
   if (!rc)
     {
       rc = assuan_send_data (ctx, buffer, nbytes);
@@ -1562,7 +1558,7 @@ cmd_checkpin (assuan_context_t ctx, char *line)
   if (!idstr)
     return out_of_core ();
 
-  rc = app_check_pin (ctrl->app_ctx, idstr, pin_cb, ctx);
+  rc = app_check_pin (ctrl->app_ctx, ctrl, idstr, pin_cb, ctx);
   xfree (idstr);
   if (rc)
     log_error ("app_check_pin failed: %s\n", gpg_strerror (rc));

-----------------------------------------------------------------------

Summary of changes:
 scd/app-common.h | 18 +++++++++---------
 scd/app.c        | 32 ++++++++++++++++----------------
 scd/command.c    | 22 +++++++++-------------
 3 files changed, 34 insertions(+), 38 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 14:43:34 2016
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 22 Dec 2016 14:43:34 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-9-ge917dfc
Message-ID: <E1cK3ei-0005hr-Dl@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e917dfcd973a3ebbf5eb584e819ffa89f932bfef (commit)
      from  8431f5a7e88e1f42d75c4a4b61f4aa9b35457204 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e917dfcd973a3ebbf5eb584e819ffa89f932bfef
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Dec 22 14:39:11 2016 +0100

    wks: Let the client ignore missing policy flags.
    
    * tools/gpg-wks-client.c (command_send): Ignore missing policy flags.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 1a8a989..79bbbbc 100644
--- a/NEWS
+++ b/NEWS
@@ -591,7 +591,7 @@ Noteworthy changes in version 2.1.3 (2015-04-11)
 
  * gpg: New option --print-pka-records.  Changed the PKA method to use
    CERT records and hashed names.  [Update: --print-pka-records
-   replaced in 2.1.4.]
+   replaced in 2.1.14.]
 
  * gpg: New command --list-gcrypt-config.  New parameter "curve"
    for --list-config.
diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
index 0f90424..d58c81b 100644
--- a/tools/gpg-wks-client.c
+++ b/tools/gpg-wks-client.c
@@ -699,7 +699,7 @@ command_send (const char *fingerprint, char *userid)
       estream_t mbuf;
 
       err = wkd_get_policy_flags (addrspec, &mbuf);
-      if (err)
+      if (err && gpg_err_code (err) != GPG_ERR_NO_DATA)
         {
           log_error ("error reading policy flags for '%s': %s\n",
                      submission_to, gpg_strerror (err));

-----------------------------------------------------------------------

Summary of changes:
 NEWS                   | 2 +-
 tools/gpg-wks-client.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 22 16:06:19 2016
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Thu, 22 Dec 2016 16:06:19 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-10-g1909e99
Message-ID: <E1cK4wo-0001Bp-9G@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1909e994cb87d6c6866a465f0c20a456d4df46cc (commit)
      from  e917dfcd973a3ebbf5eb584e819ffa89f932bfef (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1909e994cb87d6c6866a465f0c20a456d4df46cc
Author: Neal H. Walfield <neal at g10code.com>
Date:   Thu Dec 22 16:06:13 2016 +0100

    tools: Show a clearer error message if a server doesn't support WKS
    
    * tools/gpg-wks-client.c (command_send): If we fail to lookup the
    submission address, print a better error message.  If it is because
    the corresponding file doesn't exist, provide the hint that the server
    probably doesn't support WKS.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>

diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
index d58c81b..5814b40 100644
--- a/tools/gpg-wks-client.c
+++ b/tools/gpg-wks-client.c
@@ -690,7 +690,16 @@ command_send (const char *fingerprint, char *userid)
   else
     err = wkd_get_submission_address (addrspec, &submission_to);
   if (err)
-    goto leave;
+    {
+      char *domain = strchr (addrspec, '@');
+      if (domain)
+        domain = domain + 1;
+      log_error (_("looking up WKS submission address for %s: %s\n"),
+                 domain ? domain : addrspec, gpg_strerror (err));
+      if (gpg_err_code (err) == GPG_ERR_NO_DATA)
+        log_error (_("this domain probably doesn't support WKS.\n"));
+      goto leave;
+    }
   log_info ("submitting request to '%s'\n", submission_to);
 
   /* Get the policy flags.  */
@@ -704,7 +713,7 @@ command_send (const char *fingerprint, char *userid)
           log_error ("error reading policy flags for '%s': %s\n",
                      submission_to, gpg_strerror (err));
           goto leave;
-      }
+        }
       if (mbuf)
         {
           err = wks_parse_policy (&policy, mbuf, 1);

-----------------------------------------------------------------------

Summary of changes:
 tools/gpg-wks-client.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 23 08:12:09 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 23 Dec 2016 08:12:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-11-gd26c518
Message-ID: <E1cKK1T-0007gt-Eg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d26c51825e2255fe58305cbc1cd74fa43f80d93e (commit)
      from  1909e994cb87d6c6866a465f0c20a456d4df46cc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d26c51825e2255fe58305cbc1cd74fa43f80d93e
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Dec 23 16:05:01 2016 +0900

    dirmngr: Fix for --disable-libdns usage.
    
    * dirmngr/dns-stuff.c (enable_recursive_resolver, set_dns_nameserver)
    (reload_dns_stuff): Conditionalize with USE_LIBDNS.
    (get_h_errno_as_gpg_error): Map HOST_NOT_FOUND to GPG_ERR_NO_NAME.
    
    --
    
    get_dns_srv assumes error code of GPG_ERR_NO_NAME when no SRV record
    available.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>
    GnuPG-bug-id: 2889

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 491fcce..a31b073 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -181,7 +181,9 @@ void
 enable_recursive_resolver (int yes)
 {
   recursive_resolver = yes;
+#ifdef USE_LIBDNS
   libdns_reinit_pending = 1;
+#endif
 }
 
 
@@ -251,8 +253,10 @@ set_dns_nameserver (const char *ipaddr)
   strncpy (tor_nameserver, ipaddr? ipaddr : DEFAULT_NAMESERVER,
            sizeof tor_nameserver -1);
   tor_nameserver[sizeof tor_nameserver -1] = 0;
+#ifdef USE_LIBDNS
   libdns_reinit_pending = 1;
   libdns_tor_port = 0;  /* Start again with the default port.  */
+#endif
 }
 
 
@@ -278,7 +282,7 @@ get_h_errno_as_gpg_error (void)
 
   switch (h_errno)
     {
-    case HOST_NOT_FOUND: ec = GPG_ERR_UNKNOWN_HOST; break;
+    case HOST_NOT_FOUND: ec = GPG_ERR_NO_NAME; break;
     case TRY_AGAIN:      ec = GPG_ERR_TRY_LATER; break;
     case NO_RECOVERY:    ec = GPG_ERR_SERVER_FAILED; break;
     case NO_DATA:        ec = GPG_ERR_NO_DATA; break;
@@ -534,15 +538,17 @@ libdns_deinit (void)
 void
 reload_dns_stuff (int force)
 {
+#ifdef USE_LIBDNS
   if (force)
     {
-#ifdef USE_LIBDNS
       libdns_deinit ();
-#endif
       libdns_reinit_pending = 0;
     }
   else
     libdns_reinit_pending = 1;
+#else
+  (void)force;
+#endif
 }
 
 

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 27 02:02:23 2016
From: cvs at cvs.gnupg.org (by Ben Kibbey)
Date: Tue, 27 Dec 2016 02:02:23 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-16-gd83b8f0
Message-ID: <E1cLg9p-0004Qn-Gd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  d83b8f0dc84d6cf7fe2e091bd1b103ceedfa3d6c (commit)
      from  211844f049d714cd4d5aab96347705cb0c209c5d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d83b8f0dc84d6cf7fe2e091bd1b103ceedfa3d6c
Author: Ben Kibbey <bjk at luxsci.net>
Date:   Mon Dec 26 19:57:22 2016 -0500

    Fix GPGME_CREATE_NOPASSWD without pinentry loopback.
    
    * src/engine-gpg.c(gpg_createkey): Pass --batch to gpg when
    GPGME_CREATE_NOPASSWD is set.
    
    --
    Signed-off-by: Ben Kibbey <bjk at luxsci.net>

diff --git a/src/engine-gpg.c b/src/engine-gpg.c
index 3ddaa07..1b0e4c9 100644
--- a/src/engine-gpg.c
+++ b/src/engine-gpg.c
@@ -2136,6 +2136,8 @@ gpg_createkey (engine_gpg_t gpg,
       err = add_arg (gpg, "--passphrase");
       if (!err)
         err = add_arg (gpg, "");
+      if (!err)
+        err = add_arg (gpg, "--batch");
     }
   if (!err && (flags & GPGME_CREATE_FORCE))
     err = add_arg (gpg, "--yes");

-----------------------------------------------------------------------

Summary of changes:
 src/engine-gpg.c | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Dec 27 04:03:17 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 27 Dec 2016 04:03:17 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-12-gc7ec9c4
Message-ID: <E1cLi2p-0000dD-NC@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c7ec9c42246033e14ebad679d11f3b1fbeed23b7 (commit)
      from  d26c51825e2255fe58305cbc1cd74fa43f80d93e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c7ec9c42246033e14ebad679d11f3b1fbeed23b7
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Dec 27 11:58:54 2016 +0900

    scd: Improve internal CCID driver.
    
    * scd/ccid-driver.c (scan_or_find_usb_device): Fix return value.
    Support device with multiple CCID interfaces.  Fix the case with
    READERNO.  Support partial string match of "reader-port" like PC/SC
    driver.
    
    --
    
    I don't know any device with multiple CCID interfaces, though.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 0917105..7d70819 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -952,10 +952,10 @@ parse_ccid_descriptor (ccid_driver_t handle,
      lower than that:
         64 - 10 CCID header -  4 T1frame - 2 reserved = 48
      Product Ids:
-	 0xe001 - SCR 331
-	 0x5111 - SCR 331-DI
-	 0x5115 - SCR 335
-	 0xe003 - SPR 532
+         0xe001 - SCR 331
+         0x5111 - SCR 331-DI
+         0x5115 - SCR 335
+         0xe003 - SPR 532
      The
          0x5117 - SCR 3320 USB ID-000 reader
      seems to be very slow but enabling this workaround boosts the
@@ -1117,7 +1117,7 @@ find_endpoint (const struct libusb_interface_descriptor *ifcdesc, int mode)
    for other reasons. */
 static int
 scan_or_find_usb_device (int scan_mode,
-                         int *readerno, int *count, char **rid_list,
+                         int readerno, int *count, char **rid_list,
                          const char *readerid,
                          struct libusb_device *dev,
                          char **r_rid,
@@ -1133,12 +1133,12 @@ scan_or_find_usb_device (int scan_mode,
   int set_no;
   const struct libusb_interface_descriptor *ifcdesc;
   char *rid;
-  libusb_device_handle *idev;
+  libusb_device_handle *idev = NULL;
   int err;
 
   err = libusb_get_device_descriptor (dev, desc);
   if (err < 0)
-    return err;
+    return 0;
 
   *r_idev = NULL;
 
@@ -1150,7 +1150,7 @@ scan_or_find_usb_device (int scan_mode,
       if (err < 0)
         {
           if (err == LIBUSB_ERROR_NO_MEM)
-            return err;
+            return 0;
           continue;
         }
 
@@ -1176,6 +1176,11 @@ scan_or_find_usb_device (int scan_mode,
                           && desc->idVendor == VENDOR_CHERRY
                           && desc->idProduct == CHERRY_ST2000)))
                 {
+                  ++*count;
+                  if (!scan_mode
+                      && ((readerno > 0 && readerno != *count - 1)))
+                    continue;
+
                   err = libusb_open (dev, &idev);
                   if (err < 0)
                     {
@@ -1184,100 +1189,93 @@ scan_or_find_usb_device (int scan_mode,
                       continue; /* with next setting. */
                     }
 
-                  rid = make_reader_id (idev,
-                                        desc->idVendor,
-                                        desc->idProduct,
+                  rid = make_reader_id (idev, desc->idVendor, desc->idProduct,
                                         desc->iSerialNumber);
-                  if (rid)
+                  if (!rid)
                     {
-                      if (scan_mode)
+                      libusb_free_config_descriptor (config);
+                      return 0;
+                    }
+
+                  if (!scan_mode && readerno == -1 && readerid
+                      && strncmp (rid, readerid, strlen (readerid)))
+                    continue;
+
+                  if (scan_mode)
+                    {
+                      char *p;
+
+                      /* We are collecting infos about all
+                         available CCID readers.  Store them and
+                         continue. */
+                      DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n",
+                                  *count, rid );
+                      p = malloc ((*rid_list? strlen (*rid_list):0) + 1
+                                  + strlen (rid) + 1);
+                      if (p)
                         {
-                          char *p;
-
-                          /* We are collecting infos about all
-                             available CCID readers.  Store them and
-                             continue. */
-                          DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n",
-                                      *count, rid );
-                          p = malloc ((*rid_list? strlen (*rid_list):0) + 1
-                                      + strlen (rid) + 1);
-                          if (p)
+                          *p = 0;
+                          if (*rid_list)
                             {
-                              *p = 0;
-                              if (*rid_list)
-                                {
-                                  strcat (p, *rid_list);
-                                  free (*rid_list);
-                                }
-                              strcat (p, rid);
-                              strcat (p, "\n");
-                              *rid_list = p;
+                              strcat (p, *rid_list);
+                              free (*rid_list);
                             }
-                          else /* Out of memory. */
-                            free (rid);
-
-                          rid = NULL;
-                          ++*count;
+                          strcat (p, rid);
+                          strcat (p, "\n");
+                          *rid_list = p;
                         }
-                      else if (!*readerno
-                               || (*readerno < 0
-                                   && readerid
-                                   && !strcmp (readerid, rid)))
+                      else /* Out of memory. */
                         {
-                          /* We found the requested reader. */
-                          if (ifcdesc_extra && ifcdesc_extra_len)
+                          libusb_free_config_descriptor (config);
+                          free (rid);
+                          return 0;
+                        }
+                    }
+                  else
+                    {
+                      /* We found the requested reader. */
+                      if (ifcdesc_extra && ifcdesc_extra_len)
+                        {
+                          *ifcdesc_extra = malloc (ifcdesc
+                                                   ->extra_length);
+                          if (!*ifcdesc_extra)
                             {
-                              *ifcdesc_extra = malloc (ifcdesc
-                                                       ->extra_length);
-                              if (!*ifcdesc_extra)
-                                {
-                                  libusb_close (idev);
-                                  free (rid);
-                                  libusb_free_config_descriptor (config);
-                                  return 1; /* Out of core. */
-                                }
-                              memcpy (*ifcdesc_extra, ifcdesc->extra,
-                                      ifcdesc->extra_length);
-                              *ifcdesc_extra_len = ifcdesc->extra_length;
+                              libusb_close (idev);
+                              free (rid);
+                              libusb_free_config_descriptor (config);
+                              return 1; /* Out of core. */
                             }
+                          memcpy (*ifcdesc_extra, ifcdesc->extra,
+                                  ifcdesc->extra_length);
+                          *ifcdesc_extra_len = ifcdesc->extra_length;
+                        }
 
-                          if (interface_number)
-                            *interface_number = (ifcdesc->bInterfaceNumber);
-
-                          if (ep_bulk_out)
-                            *ep_bulk_out = find_endpoint (ifcdesc, 0);
-                          if (ep_bulk_in)
-                            *ep_bulk_in = find_endpoint (ifcdesc, 1);
-                          if (ep_intr)
-                            *ep_intr = find_endpoint (ifcdesc, 2);
+                      if (interface_number)
+                        *interface_number = (ifcdesc->bInterfaceNumber);
 
-                          if (r_rid)
-                            {
-                              *r_rid = rid;
-                              rid = NULL;
-                            }
-                          else
-                            free (rid);
+                      if (ep_bulk_out)
+                        *ep_bulk_out = find_endpoint (ifcdesc, 0);
+                      if (ep_bulk_in)
+                        *ep_bulk_in = find_endpoint (ifcdesc, 1);
+                      if (ep_intr)
+                        *ep_intr = find_endpoint (ifcdesc, 2);
 
-                          *r_idev = idev;
-                          libusb_free_config_descriptor (config);
-                          return 1; /* Found requested device. */
-                        }
-                      else
+                      if (r_rid)
                         {
-                          /* This is not yet the reader we want.
-                             fixme: We should avoid the extra usb_open
-                             in this case. */
-                          if (*readerno >= 0)
-                            --*readerno;
+                          *r_rid = rid;
+                          rid = NULL;
                         }
-                      free (rid);
+                      else
+                        free (rid);
+
+                      *r_idev = idev;
+                      libusb_free_config_descriptor (config);
+                      return 1; /* Found requested device. */
                     }
 
+                  free (rid);
                   libusb_close (idev);
                   idev = NULL;
-                  libusb_free_config_descriptor (config);
-                  return 0;
                 }
             }
         }
@@ -1371,7 +1369,7 @@ scan_or_find_devices (int readerno, const char *readerid,
   for (i = 0; i < n; i++)
     {
       dev = dev_list[i];
-      if (scan_or_find_usb_device (scan_mode, &readerno, &count, &rid_list,
+      if (scan_or_find_usb_device (scan_mode, readerno, &count, &rid_list,
                                    readerid,
                                    dev,
                                    r_rid,
@@ -1802,19 +1800,19 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
         case PC_to_RDR_IccPowerOff:
           print_p2r_iccpoweroff (msg, msglen);
           break;
-	case PC_to_RDR_GetSlotStatus:
+        case PC_to_RDR_GetSlotStatus:
           print_p2r_getslotstatus (msg, msglen);
           break;
         case PC_to_RDR_XfrBlock:
           print_p2r_xfrblock (msg, msglen);
           break;
-	case PC_to_RDR_GetParameters:
+        case PC_to_RDR_GetParameters:
           print_p2r_getparameters (msg, msglen);
           break;
         case PC_to_RDR_ResetParameters:
           print_p2r_resetparameters (msg, msglen);
           break;
-	case PC_to_RDR_SetParameters:
+        case PC_to_RDR_SetParameters:
           print_p2r_setparameters (msg, msglen);
           break;
         case PC_to_RDR_Escape:
@@ -1823,7 +1821,7 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
         case PC_to_RDR_IccClock:
           print_p2r_iccclock (msg, msglen);
           break;
-	case PC_to_RDR_T0APDU:
+        case PC_to_RDR_T0APDU:
           print_p2r_to0apdu (msg, msglen);
           break;
         case PC_to_RDR_Secure:

-----------------------------------------------------------------------

Summary of changes:
 scd/ccid-driver.c | 176 +++++++++++++++++++++++++++---------------------------
 1 file changed, 87 insertions(+), 89 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 28 03:26:33 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 28 Dec 2016 03:26:33 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-13-gf9882d8
Message-ID: <E1cM3wp-0001E6-U3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f9882d8336feea96e3b5e250e9093f8cca01e08b (commit)
      from  c7ec9c42246033e14ebad679d11f3b1fbeed23b7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f9882d8336feea96e3b5e250e9093f8cca01e08b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Dec 28 11:14:29 2016 +0900

    scd: Simplify monitoring card removal.
    
    * scd/apdu.c (struct reader_table_s): Remove any_status, last_status,
    status, and change_counter field.
    (new_reader_slot, dump_reader_status, ct_activate_card, open_ct_reader)
    (connect_pcsc_card, open_pcsc_reader_direct, open_pcsc_reader_wrapped)
    (open_ccid_reader, apdu_reset): Follow the change.
    (ct_dump_reader_status): Remove.
    (apdu_get_status_internal, apdu_get_status): Remove CHANGED arg.
    (apdu_connect): Follow the change.
    * scd/command.c (struct vreader_s): Remove reset_failed, any, and
    changed field.
    (cmd_getinfo, update_reader_status_file): Follow the change.
    
    --
    
    In the past, scdaemon monitors card insertion (as well as removal), so
    the code has been complicated, and there has been duplication in two
    layers.  Now, it only monitors card removal, it's now simplified.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index b32fe80..177cd8e 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -134,9 +134,6 @@ struct reader_table_s {
   } rapdu;
 #endif /*USE_G10CODE_RAPDU*/
   char *rdrname;     /* Name of the connected reader or NULL if unknown. */
-  int any_status;    /* True if we have seen any status.  */
-  int last_status;
-  int status;
   int is_t0;         /* True if we know that we are running T=0. */
   int is_spr532;     /* True if we know that the reader is a SPR532.  */
   int pinpad_varlen_supported;  /* True if we know that the reader
@@ -146,7 +143,6 @@ struct reader_table_s {
   size_t atrlen;           /* A zero length indicates that the ATR has
                               not yet been read; i.e. the card is not
                               ready for use. */
-  unsigned int change_counter;
 #ifdef USE_NPTH
   int lock_initialized;
   npth_mutex_t lock;
@@ -217,7 +213,7 @@ static char (* DLSTDCALL CT_close) (unsigned short ctn);
 #define PCSC_STATE_ATRMATCH    0x0040  /* ATR matches card. */
 #define PCSC_STATE_EXCLUSIVE   0x0080  /* Exclusive Mode.  */
 #define PCSC_STATE_INUSE       0x0100  /* Shared mode.  */
-#define PCSC_STATE_MUTE	       0x0200  /* Unresponsive card.  */
+#define PCSC_STATE_MUTE        0x0200  /* Unresponsive card.  */
 #ifdef HAVE_W32_SYSTEM
 # define PCSC_STATE_UNPOWERED  0x0400  /* Card not powerred up.  */
 #endif
@@ -251,7 +247,7 @@ static char (* DLSTDCALL CT_close) (unsigned short ctn);
 #ifdef _WIN32
 #include <winioctl.h>
 #define SCARD_CTL_CODE(code) CTL_CODE(FILE_DEVICE_SMARTCARD, (code), \
-				      METHOD_BUFFERED, FILE_ANY_ACCESS)
+                                      METHOD_BUFFERED, FILE_ANY_ACCESS)
 #else
 #define SCARD_CTL_CODE(code) (0x42000000 + (code))
 #endif
@@ -361,8 +357,7 @@ static int pcsc_vendor_specific_init (int slot);
 static int pcsc_get_status (int slot, unsigned int *status);
 static int reset_pcsc_reader (int slot);
 static int apdu_get_status_internal (int slot, int hang, int no_atr_reset,
-                                     unsigned int *status,
-                                     unsigned int *changed);
+                                     unsigned int *status);
 static int check_pcsc_pinpad (int slot, int command, pininfo_t *pininfo);
 static int pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1,
                                pininfo_t *pininfo);
@@ -471,8 +466,6 @@ new_reader_slot (void)
   reader_table[reader].pinpad_modify = pcsc_pinpad_modify;
 
   reader_table[reader].used = 1;
-  reader_table[reader].any_status = 0;
-  reader_table[reader].last_status = 0;
   reader_table[reader].is_t0 = 1;
   reader_table[reader].is_spr532 = 0;
   reader_table[reader].pinpad_varlen_supported = 0;
@@ -499,8 +492,7 @@ dump_reader_status (int slot)
   if (reader_table[slot].dump_status_reader)
     reader_table[slot].dump_status_reader (slot);
 
-  if (reader_table[slot].status != -1
-      && reader_table[slot].atrlen)
+  if (reader_table[slot].atrlen)
     {
       log_info ("slot %d: ATR=", slot);
       log_printhex ("", reader_table[slot].atr, reader_table[slot].atrlen);
@@ -590,16 +582,6 @@ ct_error_string (long err)
 }
 
 
-static void
-ct_dump_reader_status (int slot)
-{
-  log_info ("reader slot %d: %s\n", slot,
-            reader_table[slot].status == 1? "Processor ICC present" :
-            reader_table[slot].status == 0? "Memory ICC present" :
-            "ICC not present" );
-}
-
-
 /* Wait for the card in SLOT and activate it.  Return a status word
    error or 0 on success. */
 static int
@@ -658,7 +640,6 @@ ct_activate_card (int slot)
       return SW_HOST_CARD_IO_ERROR;
     }
 
-  reader_table[slot].status = buf[buflen - 1];
   memcpy (reader_table[slot].atr, buf, buflen - 2);
   reader_table[slot].atrlen = buflen - 2;
   return 0;
@@ -763,7 +744,7 @@ open_ct_reader (int port)
   reader_table[reader].get_status_reader = ct_get_status;
   reader_table[reader].send_apdu_reader = ct_send_apdu;
   reader_table[reader].check_pinpad = NULL;
-  reader_table[reader].dump_status_reader = ct_dump_reader_status;
+  reader_table[reader].dump_status_reader = NULL;
   reader_table[reader].pinpad_verify = NULL;
   reader_table[reader].pinpad_modify = NULL;
 
@@ -984,7 +965,7 @@ pcsc_get_status_direct (int slot, unsigned int *status)
     {
       *status |= APDU_CARD_PRESENT;
       if ( !(rdrstates[0].event_state & PCSC_STATE_MUTE) )
-	*status |= APDU_CARD_ACTIVE;
+        *status |= APDU_CARD_ACTIVE;
     }
 #ifndef HAVE_W32_SYSTEM
   /* We indicate a useful card if it is not in use by another
@@ -1553,7 +1534,6 @@ connect_pcsc_card (int slot)
     return SW_HOST_ALREADY_CONNECTED;
 
   reader_table[slot].atrlen = 0;
-  reader_table[slot].last_status = 0;
   reader_table[slot].is_t0 = 0;
 
   err = pcsc_connect (reader_table[slot].pcsc.context,
@@ -1591,11 +1571,6 @@ connect_pcsc_card (int slot)
           if (atrlen > DIM (reader_table[0].atr))
             log_bug ("ATR returned by pcsc_status is too large\n");
           reader_table[slot].atrlen = atrlen;
-          /* If we got to here we know that a card is present
-             and usable.  Remember this.  */
-          reader_table[slot].last_status = (   APDU_CARD_USABLE
-                                             | APDU_CARD_PRESENT
-                                             | APDU_CARD_ACTIVE);
           reader_table[slot].is_t0 = !!(card_protocol & PCSC_PROTOCOL_T0);
         }
     }
@@ -1955,7 +1930,7 @@ open_pcsc_reader_direct (const char *portstr)
           log_error ("error allocating memory for reader list\n");
           pcsc_release_context (reader_table[slot].pcsc.context);
           reader_table[slot].used = 0;
-	  unlock_slot (slot);
+          unlock_slot (slot);
           return -1 /*SW_HOST_OUT_OF_CORE*/;
         }
       err = pcsc_list_readers (reader_table[slot].pcsc.context,
@@ -2006,7 +1981,6 @@ open_pcsc_reader_direct (const char *portstr)
 
   reader_table[slot].pcsc.card = 0;
   reader_table[slot].atrlen = 0;
-  reader_table[slot].last_status = 0;
 
   reader_table[slot].connect_card = connect_pcsc_card;
   reader_table[slot].disconnect_card = disconnect_pcsc_card;
@@ -2188,8 +2162,6 @@ open_pcsc_reader_wrapped (const char *portstr)
       goto command_failed;
     }
 
-  slotp->last_status = 0;
-
   /* The open request may return a zero for the ATR length to
      indicate that no card is present.  */
   n = len;
@@ -2201,11 +2173,6 @@ open_pcsc_reader_wrapped (const char *portstr)
                      i? strerror (errno) : "premature EOF");
           goto command_failed;
         }
-      /* If we got to here we know that a card is present
-         and usable.  Thus remember this.  */
-      slotp->last_status = (  APDU_CARD_USABLE
-                            | APDU_CARD_PRESENT
-                            | APDU_CARD_ACTIVE);
     }
   slotp->atrlen = len;
 
@@ -2353,7 +2320,7 @@ pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1,
 
   if (DBG_CARD_IO)
     log_debug ("send secure: c=%02X i=%02X p1=%02X p2=%02X len=%d pinmax=%d\n",
-	       class, ins, p0, p1, len, pininfo->maxlen);
+               class, ins, p0, p1, len, pininfo->maxlen);
 
   sw = control_pcsc (slot, reader_table[slot].pcsc.verify_ioctl,
                      pin_verify, len, result, &resultlen);
@@ -2439,7 +2406,7 @@ pcsc_pinpad_modify (int slot, int class, int ins, int p0, int p1,
 
   if (DBG_CARD_IO)
     log_debug ("send secure: c=%02X i=%02X p1=%02X p2=%02X len=%d pinmax=%d\n",
-	       class, ins, p0, p1, len, (int)pininfo->maxlen);
+               class, ins, p0, p1, len, (int)pininfo->maxlen);
 
   sw = control_pcsc (slot, reader_table[slot].pcsc.modify_ioctl,
                      pin_modify, len, result, &resultlen);
@@ -2573,13 +2540,13 @@ check_ccid_pinpad (int slot, int command, pininfo_t *pininfo)
 
   apdu[1] = command;
   return ccid_transceive_secure (reader_table[slot].ccid.handle, apdu,
-				 sizeof apdu, pininfo, NULL, 0, NULL);
+                                 sizeof apdu, pininfo, NULL, 0, NULL);
 }
 
 
 static int
 ccid_pinpad_operation (int slot, int class, int ins, int p0, int p1,
-		       pininfo_t *pininfo)
+                       pininfo_t *pininfo)
 {
   unsigned char apdu[4];
   int err, sw;
@@ -2633,14 +2600,6 @@ open_ccid_reader (const char *portstr)
       slotp->atrlen = 0;
       err = 0;
     }
-  else
-    {
-      /* If we got to here we know that a card is present
-         and usable.  Thus remember this.  */
-      reader_table[slot].last_status = (APDU_CARD_USABLE
-                                        | APDU_CARD_PRESENT
-                                        | APDU_CARD_ACTIVE);
-    }
 
   reader_table[slot].close_reader = close_ccid_reader;
   reader_table[slot].reset_reader = reset_ccid_reader;
@@ -3309,7 +3268,7 @@ apdu_connect (int slot)
      Without that we would force a reset of the card with the next
      call to apdu_get_status.  */
   if (!sw)
-    sw = apdu_get_status_internal (slot, 1, 1, &status, NULL);
+    sw = apdu_get_status_internal (slot, 1, 1, &status);
 
   if (sw)
     ;
@@ -3406,19 +3365,9 @@ apdu_reset (int slot)
       return sw;
     }
 
-  reader_table[slot].last_status = 0;
   if (reader_table[slot].reset_reader)
     sw = reader_table[slot].reset_reader (slot);
 
-  if (!sw)
-    {
-      /* If we got to here we know that a card is present
-         and usable.  Thus remember this.  */
-      reader_table[slot].last_status = (APDU_CARD_USABLE
-                                        | APDU_CARD_PRESENT
-                                        | APDU_CARD_ACTIVE);
-    }
-
   unlock_slot (slot);
   if (DBG_READER)
     log_debug ("leave: apdu_reset => sw=0x%x\n", sw);
@@ -3476,14 +3425,10 @@ apdu_get_atr (int slot, size_t *atrlen)
                        (bit 3) = card access locked [not yet implemented]
 
    For must applications, testing bit 0 is sufficient.
-
-   CHANGED will receive the value of the counter tracking the number
-   of card insertions.  This value may be used to detect a card
-   change.
 */
 static int
 apdu_get_status_internal (int slot, int hang, int no_atr_reset,
-                          unsigned int *status, unsigned int *changed)
+                          unsigned int *status)
 {
   int sw;
   unsigned int s;
@@ -3501,52 +3446,31 @@ apdu_get_status_internal (int slot, int hang, int no_atr_reset,
 
   if (sw)
     {
-      reader_table[slot].last_status = 0;
-      return sw;
-    }
-
-  /* Keep track of changes.  */
-  if (s != reader_table[slot].last_status
-      || !reader_table[slot].any_status )
-    {
-      reader_table[slot].change_counter++;
-      /* Make sure that the ATR is invalid so that a reset will be
-         triggered by apdu_activate.  */
       if (!no_atr_reset)
         reader_table[slot].atrlen = 0;
+      s = 0;
     }
-  reader_table[slot].any_status = 1;
-  reader_table[slot].last_status = s;
 
   if (status)
     *status = s;
-  if (changed)
-    *changed = reader_table[slot].change_counter;
-  return 0;
+  return sw;
 }
 
 
 /* See above for a description.  */
 int
-apdu_get_status (int slot, int hang,
-                 unsigned int *status, unsigned int *changed)
+apdu_get_status (int slot, int hang, unsigned int *status)
 {
   int sw;
 
   if (DBG_READER)
     log_debug ("enter: apdu_get_status: slot=%d hang=%d\n", slot, hang);
-  sw = apdu_get_status_internal (slot, hang, 0, status, changed);
+  sw = apdu_get_status_internal (slot, hang, 0, status);
   if (DBG_READER)
     {
-      if (status && changed)
-        log_debug ("leave: apdu_get_status => sw=0x%x status=%u changecnt=%u\n",
-                   sw, *status, *changed);
-      else if (status)
+      if (status)
         log_debug ("leave: apdu_get_status => sw=0x%x status=%u\n",
                    sw, *status);
-      else if (changed)
-        log_debug ("leave: apdu_get_status => sw=0x%x changed=%u\n",
-                   sw, *changed);
       else
         log_debug ("leave: apdu_get_status => sw=0x%x\n", sw);
     }
@@ -3584,7 +3508,7 @@ apdu_check_pinpad (int slot, int command, pininfo_t *pininfo)
 
 int
 apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
-		    pininfo_t *pininfo)
+                    pininfo_t *pininfo)
 {
   if (slot < 0 || slot >= MAX_READER || !reader_table[slot].used )
     return SW_HOST_NO_DRIVER;
@@ -3597,7 +3521,7 @@ apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
         return sw;
 
       sw = reader_table[slot].pinpad_verify (slot, class, ins, p0, p1,
-					     pininfo);
+                                             pininfo);
       unlock_slot (slot);
       return sw;
     }
@@ -3608,7 +3532,7 @@ apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
 
 int
 apdu_pinpad_modify (int slot, int class, int ins, int p0, int p1,
-		    pininfo_t *pininfo)
+                    pininfo_t *pininfo)
 {
   if (slot < 0 || slot >= MAX_READER || !reader_table[slot].used )
     return SW_HOST_NO_DRIVER;
diff --git a/scd/apdu.h b/scd/apdu.h
index e29c971..ba856af 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -112,8 +112,7 @@ int apdu_disconnect (int slot);
 int apdu_set_progress_cb (int slot, gcry_handler_progress_t cb, void *cb_arg);
 
 int apdu_reset (int slot);
-int apdu_get_status (int slot, int hang,
-                     unsigned int *status, unsigned int *changed);
+int apdu_get_status (int slot, int hang, unsigned int *status);
 int apdu_check_pinpad (int slot, int command, pininfo_t *pininfo);
 int apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
 			pininfo_t *pininfo);
diff --git a/scd/command.c b/scd/command.c
index 31443c7..02bf76f 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -89,13 +89,7 @@ struct vreader_s
   int valid;  /* True if the other objects are valid. */
   int slot;   /* APDU slot number of the reader or -1 if not open. */
 
-  int reset_failed; /* A reset failed. */
-
-  int any;    /* Flag indicating whether any status check has been
-                 done.  This is set once to indicate that the status
-                 tracking for the slot has been initialized.  */
   unsigned int status;  /* Last status of the reader. */
-  unsigned int changed; /* Last change counter of the reader. */
 };
 
 
@@ -1707,7 +1701,7 @@ cmd_getinfo (assuan_context_t ctx, char *line)
 	    BUG ();
 
 	  vr = &vreader_table[vrdr];
-	  if (vr->valid && vr->any && (vr->status & 1))
+	  if (vr->valid && (vr->status & 1))
 	    flag = 'u';
 	}
       rc = assuan_send_data (ctx, &flag, 1);
@@ -2248,7 +2242,7 @@ static void
 update_reader_status_file (int set_card_removed_flag)
 {
   int idx;
-  unsigned int status, changed;
+  unsigned int status;
 
   /* Note, that we only try to get the status, because it does not
      make sense to wait here for a operation to complete.  If we are
@@ -2263,13 +2257,11 @@ update_reader_status_file (int set_card_removed_flag)
       if (!vr->valid || vr->slot == -1)
         continue; /* Not valid or reader not yet open. */
 
-      sw_apdu = apdu_get_status (vr->slot, 0, &status, &changed);
+      sw_apdu = apdu_get_status (vr->slot, 0, &status);
       if (sw_apdu == SW_HOST_NO_READER)
         {
           /* Most likely the _reader_ has been unplugged.  */
-          apdu_close_reader (vr->slot);
           status = 0;
-          changed = vr->changed;
         }
       else if (sw_apdu)
         {
@@ -2277,16 +2269,14 @@ update_reader_status_file (int set_card_removed_flag)
           continue;
         }
 
-      if (!vr->any || vr->status != status || vr->changed != changed )
+      if (vr->status != status)
         {
           char *fname;
           char templ[50];
           FILE *fp;
 
-          log_info ("updating reader %d (%d) status: 0x%04X->0x%04X (%u->%u)\n",
-                    idx, vr->slot, vr->status, status, vr->changed, changed);
-          vr->status = status;
-          vr->changed = changed;
+          log_info ("updating reader %d (%d) status: 0x%04X->0x%04X\n",
+                    idx, vr->slot, vr->status, status);
 
 	  /* FIXME: Should this be IDX instead of vr->slot?  This
 	     depends on how client sessions will associate the reader
@@ -2346,10 +2336,10 @@ update_reader_status_file (int set_card_removed_flag)
           }
 
           /* Set the card removed flag for all current sessions.  */
-          if (vr->any && vr->status == 0 && set_card_removed_flag)
+          if (status == 0 && set_card_removed_flag)
             update_card_removed (idx, 1);
 
-          vr->any = 1;
+          vr->status = status;
 
           /* Send a signal to all clients who applied for it.  */
           send_client_notifications ();

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c    | 118 +++++++++++-----------------------------------------------
 scd/apdu.h    |   3 +-
 scd/command.c |  26 ++++---------
 3 files changed, 30 insertions(+), 117 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Dec 28 04:45:24 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 28 Dec 2016 04:45:24 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-14-g4cc9fc5
Message-ID: <E1cM5B9-0006Eb-BK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4cc9fc5eb9bd91d943c185d59da4a2b4cb885ee6 (commit)
      from  f9882d8336feea96e3b5e250e9093f8cca01e08b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4cc9fc5eb9bd91d943c185d59da4a2b4cb885ee6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Dec 28 12:29:17 2016 +0900

    scd: APP centric approach for device management.
    
    * scd/app.c (lock_app): Rename from lock_reader and use internal field
    of APP.
    (unlock_app): Likewise.
    (app_dump_state): Use APP.
    (application_notify_card_reset): Remove.
    (check_conflict): Change API for APP, instead of SLOT.
    (check_application_conflict): Likewise.
    (release_application_internal): New.
    (app_reset): New.
    (app_new_register): New.
    (select_application): Change API for APP, instead of SLOT.
    (deallocate_app, release_application): Modify for manage link.
    (report_change): New.
    (scd_update_reader_status_file): Moved from command.c and
    use APP list, instead of VREADER.
    (initialize_module_command): Moved from command.c.
    
    * scd/command.c (TEST_CARD_REMOVAL): Remove.
    (IS_LOCKED): Simplify.
    (vreader_table): Remove.
    (vreader_slot, update_card_removed): Remove.
    (do_reset): Call app_reset.
    (get_current_reader): Remove.
    (open_card): Add SCAN arg.
    (cmd_serialno): No retry, since retry is done in lower layer in apdu.c.
    No do_reset, since it is done in lower layer.
    Add clearing card_removed flag.
    (cmd_disconnect): Call apdu_disconnect.
    (send_client_notifications): Modify for APP.
    (update_reader_status_file): Remove.
    
    --
    
    APP is the abstraction of the card application.  For management of
    cards, it is better to focus on the APP instead of the physical reader.
    This change makes support of multiple card/token easier.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index 21f659e..781bf46 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -22,13 +22,8 @@
 #ifndef GNUPG_SCD_APP_COMMON_H
 #define GNUPG_SCD_APP_COMMON_H
 
-#if GNUPG_MAJOR_VERSION == 1
-# ifdef ENABLE_AGENT_SUPPORT
-# include "assuan.h"
-# endif
-#else
-# include <ksba.h>
-#endif
+#include <npth.h>
+#include <ksba.h>
 
 
 #define APP_CHANGE_FLAG_RESET    1
@@ -41,6 +36,10 @@
 struct app_local_s;  /* Defined by all app-*.c.  */
 
 struct app_ctx_s {
+  struct app_ctx_s *next;
+
+  npth_mutex_t lock;
+
   /* Number of connections currently using this application context.
      If this is not 0 the application has been initialized and the
      function pointers may be used.  Note that for unsupported
@@ -50,18 +49,12 @@ struct app_ctx_s {
   /* Used reader slot. */
   int slot;
 
-  /* If this is used by GnuPG 1.4 we need to know the assuan context
-     in case we need to divert the operation to an already running
-     agent.  This if ASSUAN_CTX is not NULL we take this as indication
-     that all operations are diverted to gpg-agent. */
-#if GNUPG_MAJOR_VERSION == 1
-  assuan_context_t assuan_ctx;
-#endif /*GNUPG_MAJOR_VERSION == 1*/
-
   unsigned char *serialno; /* Serialnumber in raw form, allocated. */
   size_t serialnolen;      /* Length in octets of serialnumber. */
   const char *apptype;
   unsigned int card_version;
+  unsigned int card_status;
+  unsigned int require_get_status:1;
   unsigned int did_chv1:1;
   unsigned int force_chv1:1;   /* True if the card does not cache CHV1. */
   unsigned int did_chv2:1;
@@ -119,20 +112,8 @@ struct app_ctx_s {
                       gpg_error_t (*pincb)(void*, const char *, char **),
                       void *pincb_arg);
   } fnc;
-
 };
 
-#if GNUPG_MAJOR_VERSION == 1
-gpg_error_t app_select_openpgp (app_t app);
-gpg_error_t app_get_serial_and_stamp (app_t app, char **serial, time_t *stamp);
-gpg_error_t app_openpgp_storekey (app_t app, int keyno,
-                          unsigned char *template, size_t template_len,
-                          time_t created_at,
-                          const unsigned char *m, size_t mlen,
-                          const unsigned char *e, size_t elen,
-                          gpg_error_t (*pincb)(void*, const char *, char **),
-                          void *pincb_arg);
-#else
 /*-- app-help.c --*/
 unsigned int app_help_count_bits (const unsigned char *a, size_t len);
 gpg_error_t app_help_get_keygrip_string (ksba_cert_t cert, char *hexkeygrip);
@@ -142,10 +123,10 @@ size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 /*-- app.c --*/
 void app_dump_state (void);
 void application_notify_card_reset (int slot);
-gpg_error_t check_application_conflict (ctrl_t ctrl, int slot,
-                                        const char *name);
-gpg_error_t select_application (ctrl_t ctrl, int slot, const char *name,
-                                app_t *r_app);
+gpg_error_t check_application_conflict (const char *name, app_t app);
+gpg_error_t app_reset (app_t app, ctrl_t ctrl, int send_reset);
+gpg_error_t select_application (ctrl_t ctrl, const char *name, app_t *r_app,
+                                int scan);
 char *get_supported_applications (void);
 void release_application (app_t app);
 gpg_error_t app_munge_serialno (app_t app);
@@ -222,8 +203,4 @@ gpg_error_t app_select_geldkarte (app_t app);
 gpg_error_t app_select_sc_hsm (app_t app);
 
 
-#endif
-
-
-
 #endif /*GNUPG_SCD_APP_COMMON_H*/
diff --git a/scd/app.c b/scd/app.c
index 6868cc3..a78d652 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -1,5 +1,5 @@
 /* app.c - Application selection.
- *	Copyright (C) 2003, 2004, 2005 Free Software Foundation, Inc.
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -25,27 +25,14 @@
 #include <npth.h>
 
 #include "scdaemon.h"
+#include "exechelp.h"
 #include "app-common.h"
 #include "iso7816.h"
 #include "apdu.h"
 #include "tlv.h"
 
-/* This table is used to keep track of locks on a per reader base.
-   The index into the table is the slot number of the reader.  The
-   mutex will be initialized on demand (one of the advantages of a
-   userland threading system). */
-static struct
-{
-  int initialized;
-  npth_mutex_t lock;
-  app_t app;        /* Application context in use or NULL. */
-} lock_table[10];
-
-
-
-static void deallocate_app (app_t app);
-
-
+static npth_mutex_t app_list_lock;
+static app_t app_top;
 

 static void
 print_progress_line (void *opaque, const char *what, int pc, int cur, int tot)
@@ -69,54 +56,35 @@ print_progress_line (void *opaque, const char *what, int pc, int cur, int tot)
    success; only then the unlock_reader function must be called after
    returning from the handler. */
 static gpg_error_t
-lock_reader (int slot, ctrl_t ctrl)
+lock_app (app_t app, ctrl_t ctrl)
 {
-  int res;
-
-  if (slot < 0 || slot >= DIM (lock_table))
-    return gpg_error (slot<0? GPG_ERR_INV_VALUE : GPG_ERR_RESOURCE_LIMIT);
-
-  if (!lock_table[slot].initialized)
-    {
-      res = npth_mutex_init (&lock_table[slot].lock, NULL);
-      if (res)
-        {
-          log_error ("error initializing mutex: %s\n", strerror (res));
-          return gpg_error_from_errno (res);
-        }
-      lock_table[slot].initialized = 1;
-      lock_table[slot].app = NULL;
-    }
+  gpg_error_t err;
 
-  res = npth_mutex_lock (&lock_table[slot].lock);
-  if (res)
+  err = npth_mutex_lock (&app->lock);
+  if (err)
     {
-      log_error ("failed to acquire APP lock for slot %d: %s\n",
-                 slot, strerror (res));
-      return gpg_error_from_errno (res);
+      log_error ("failed to acquire APP lock for %p: %s\n",
+                 app, strerror (err));
+      return gpg_error_from_errno (err);
     }
 
-  apdu_set_progress_cb (slot, print_progress_line, ctrl);
+  apdu_set_progress_cb (app->slot, print_progress_line, ctrl);
 
   return 0;
 }
 
 /* Release a lock on the reader.  See lock_reader(). */
 static void
-unlock_reader (int slot)
+unlock_app (app_t app)
 {
-  int res;
-
-  if (slot < 0 || slot >= DIM (lock_table)
-      || !lock_table[slot].initialized)
-    log_bug ("unlock_reader called for invalid slot %d\n", slot);
+  gpg_error_t err;
 
-  apdu_set_progress_cb (slot, NULL, NULL);
+  apdu_set_progress_cb (app->slot, NULL, NULL);
 
-  res = npth_mutex_unlock (&lock_table[slot].lock);
-  if (res)
-    log_error ("failed to release APP lock for slot %d: %s\n",
-               slot, strerror (res));
+  err = npth_mutex_unlock (&app->lock);
+  if (err)
+    log_error ("failed to release APP lock for %p: %s\n",
+               app, strerror (err));
 }
 
 
@@ -125,20 +93,12 @@ unlock_reader (int slot)
 void
 app_dump_state (void)
 {
-  int slot;
+  app_t a;
 
-  for (slot=0; slot < DIM (lock_table); slot++)
-    if (lock_table[slot].initialized)
-      {
-        log_info ("app_dump_state: slot=%d", slot);
-        if (lock_table[slot].app)
-          {
-            log_printf (" app=%p", lock_table[slot].app);
-            if (lock_table[slot].app->apptype)
-              log_printf (" type='%s'", lock_table[slot].app->apptype);
-          }
-        log_printf ("\n");
-      }
+  npth_mutex_lock (&app_list_lock);
+  for (a = app_top; a; a = a->next)
+    log_info ("app_dump_state: app=%p type='%s'\n", a, a->apptype);
+  npth_mutex_unlock (&app_list_lock);
 }
 
 /* Check wether the application NAME is allowed.  This does not mean
@@ -155,54 +115,16 @@ is_app_allowed (const char *name)
 }
 
 
-/* This may be called to tell this module about a removed or resetted card. */
-void
-application_notify_card_reset (int slot)
-{
-  if (slot < 0 || slot >= DIM (lock_table))
-    return;
-
-  /* FIXME: We are ignoring any error value here.  */
-  lock_reader (slot, NULL);
-
-  /* Release the APP, as it's not reusable any more.  */
-  if (lock_table[slot].app)
-    {
-      if (lock_table[slot].app->ref_count)
-        log_bug ("trying to release active context\n");
-
-      deallocate_app (lock_table[slot].app);
-      lock_table[slot].app = NULL;
-      log_debug ("application has been released\n");
-    }
-
-  unlock_reader (slot);
-}
-
-
-/*
- * This function is called with lock held.
- */
 static gpg_error_t
-check_conflict (int slot, const char *name)
+check_conflict (app_t app, const char *name)
 {
-  app_t app = lock_table[slot].app;
-
   if (!app || !name || (app->apptype && !ascii_strcasecmp (app->apptype, name)))
     return 0;
 
-  if (!app->ref_count)
-    {
-      lock_table[slot].app = NULL;
-      deallocate_app (app);
-      return 0;
-    }
-  else
-    {
-      log_info ("application '%s' in use by reader %d - can't switch\n",
-                app->apptype? app->apptype : "<null>", slot);
-      return gpg_error (GPG_ERR_CONFLICT);
-    }
+  log_info ("application '%s' in use - can't switch\n",
+            app->apptype? app->apptype : "<null>");
+
+  return gpg_error (GPG_ERR_CONFLICT);
 }
 
 /* This function is used by the serialno command to check for an
@@ -210,85 +132,85 @@ check_conflict (int slot, const char *name)
    used to request a specific application and the connection has
    already done a select_application. */
 gpg_error_t
-check_application_conflict (ctrl_t ctrl, int slot, const char *name)
+check_application_conflict (const char *name, app_t app)
 {
-  gpg_error_t err;
+  return check_conflict (app, name);
+}
 
-  if (slot < 0 || slot >= DIM (lock_table))
-    return gpg_error (GPG_ERR_INV_VALUE);
 
-  err = lock_reader (slot, ctrl);
-  if (err)
-    return err;
+static void
+release_application_internal (app_t app)
+{
+  if (!app->ref_count)
+    log_bug ("trying to release an already released context\n");
 
-  err = check_conflict (slot, name);
-  unlock_reader (slot);
-  return err;
+  --app->ref_count;
 }
 
-
-/* If called with NAME as NULL, select the best fitting application
-   and return a context; otherwise select the application with NAME
-   and return a context.  SLOT identifies the reader device. Returns
-   an error code and stores NULL at R_APP if no application was found
-   or no card is present. */
 gpg_error_t
-select_application (ctrl_t ctrl, int slot, const char *name, app_t *r_app)
+app_reset (app_t app, ctrl_t ctrl, int send_reset)
 {
   gpg_error_t err;
-  app_t app = NULL;
-  unsigned char *result = NULL;
-  size_t resultlen;
-  int want_undefined;
-
-  (void)ctrl;
 
-  *r_app = NULL;
-
-  want_undefined = (name && !strcmp (name, "undefined"));
-
-  err = lock_reader (slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
 
-  /* First check whether we already have an application to share. */
-  err = check_conflict (slot, name);
-  if (err)
+  if (send_reset)
     {
-      unlock_reader (slot);
-      return err;
-    }
-
-  app = lock_table[slot].app;
+      int sw = apdu_reset (app->slot);
+      if (sw)
+        err = gpg_error (GPG_ERR_CARD_RESET);
 
-  /* If we can reuse an application, bump the reference count and
-     return it.  */
-  if (app)
+      /* Release the same application which is used by other sessions.  */
+      send_client_notifications (app);
+    }
+  else
     {
-      if (app->slot != slot)
-        log_bug ("slot mismatch %d/%d\n", app->slot, slot);
-      app->slot = slot;
-
-      app->ref_count++;
-      *r_app = app;
-      unlock_reader (slot);
-      return 0; /* Okay: We share that one. */
+      ctrl->app_ctx = NULL;
+      release_application_internal (app);
     }
 
+  unlock_app (app);
+  return err;
+}
+
+static gpg_error_t
+app_new_register (int slot, ctrl_t ctrl, const char *name)
+{
+  gpg_error_t err = 0;
+  app_t app = NULL;
+  unsigned char *result = NULL;
+  size_t resultlen;
+  int want_undefined;
+
   /* Need to allocate a new one.  */
   app = xtrycalloc (1, sizeof *app);
   if (!app)
     {
       err = gpg_error_from_syserror ();
       log_info ("error allocating context: %s\n", gpg_strerror (err));
-      unlock_reader (slot);
       return err;
     }
+
   app->slot = slot;
+  err = npth_mutex_init (&app->lock, NULL);
+  if (err)
+    {
+      err = gpg_error_from_syserror ();
+      log_error ("error initializing mutex: %s\n", strerror (err));
+      xfree (app);
+      return err;
+    }
 
+  err = lock_app (app, ctrl);
+  if (err)
+    {
+      xfree (app);
+      return err;
+    }
 
-  /* Fixme: We should now first check whether a card is at all
-     present. */
+  want_undefined = (name && !strcmp (name, "undefined"));
 
   /* Try to read the GDO file first to get a default serial number.
      We skip this if the undefined application has been requested. */
@@ -377,19 +299,87 @@ select_application (ctrl_t ctrl, int slot, const char *name, app_t *r_app)
       else
         log_info ("no supported card application found: %s\n",
                   gpg_strerror (err));
+      unlock_app (app);
       xfree (app);
-      unlock_reader (slot);
       return err;
     }
 
-  app->ref_count = 1;
+  app->require_get_status = 1;   /* For token, this can be 0.  */
 
-  lock_table[slot].app = app;
-  *r_app = app;
-  unlock_reader (slot);
+  npth_mutex_lock (&app_list_lock);
+  app->next = app_top;
+  app_top = app;
+  npth_mutex_unlock (&app_list_lock);
+  unlock_app (app);
   return 0;
 }
 
+/* If called with NAME as NULL, select the best fitting application
+   and return a context; otherwise select the application with NAME
+   and return a context.  Returns an error code and stores NULL at
+   R_APP if no application was found or no card is present. */
+gpg_error_t
+select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
+{
+  gpg_error_t err;
+  app_t app;
+  int slot;
+
+  *r_app = NULL;
+
+  if (scan
+      /* FIXME: Here, we can change code to support multiple readers.
+         For now, we only open a single reader.
+      */
+      && !app_top)
+    {
+      slot = apdu_open_reader (opt.reader_port);
+      if (slot >= 0)
+        {
+          int sw = apdu_connect (slot);
+
+          if (sw == SW_HOST_CARD_INACTIVE)
+            {
+              /* Try again.  */
+              sw = apdu_reset (slot);
+            }
+
+          if (!sw || sw == SW_HOST_ALREADY_CONNECTED)
+            err = 0;
+          else
+            err = gpg_error (GPG_ERR_ENODEV);
+        }
+      else
+        err = gpg_error (GPG_ERR_ENODEV);
+
+      if (!err)
+        err = app_new_register (slot, ctrl, name);
+      else
+        apdu_close_reader (slot);
+    }
+  else
+    err = 0;
+
+  if (!err)
+    app = app_top;
+  else
+    app = NULL;
+
+  if (app)
+    {
+      lock_app (app, ctrl);
+      err = check_conflict (app, name);
+      if (!err)
+        {
+          app->ref_count++;
+          *r_app = app;
+        }
+      unlock_app (app);
+    }
+
+  return err;
+}
+
 
 char *
 get_supported_applications (void)
@@ -425,10 +415,27 @@ get_supported_applications (void)
 }
 
 
-/* Deallocate the application. */
+/* Deallocate the application.  */
 static void
 deallocate_app (app_t app)
 {
+  app_t a, a_prev = NULL;
+
+  for (a = app_top; a; a = a->next)
+    if (a == app)
+      {
+        if (a_prev == NULL)
+          app_top = a->next;
+        else
+          a_prev->next = a->next;
+        break;
+      }
+    else
+      a_prev = a;
+
+  if (app->ref_count)
+    log_error ("trying to release context used yet (%d)\n", app->ref_count);
+
   if (app->fnc.deinit)
     {
       app->fnc.deinit (app);
@@ -447,33 +454,17 @@ deallocate_app (app_t app)
 void
 release_application (app_t app)
 {
-  int slot;
-
   if (!app)
     return;
 
-  if (!app->ref_count)
-    log_bug ("trying to release an already released context\n");
-  if (--app->ref_count)
-    return;
-
-  /* Move the reference to the application in the lock table. */
-  slot = app->slot;
-  /* FIXME: We are ignoring any error value.  */
-  lock_reader (slot, NULL);
-  if (lock_table[slot].app != app)
-    {
-      unlock_reader (slot);
-      log_bug ("app mismatch %p/%p\n", app, lock_table[slot].app);
-      deallocate_app (app);
-      return;
-    }
-
   /* We don't deallocate app here.  Instead, we keep it.  This is
      useful so that a card does not get reset even if only one session
      is using the card - this way the PIN cache and other cached data
      are preserved.  */
-  unlock_reader (slot);
+
+  lock_app (app, NULL);
+  release_application_internal (app);
+  unlock_app (app);
 }
 
 
@@ -570,11 +561,11 @@ app_write_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
   if (app->apptype && !(flags & 1))
     send_status_info (ctrl, "APPTYPE",
                       app->apptype, strlen (app->apptype), NULL, 0);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.learn_status (app, ctrl, flags);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -595,11 +586,11 @@ app_readcert (app_t app, ctrl_t ctrl, const char *certid,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.readcert)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.readcert (app, certid, cert, certlen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -628,11 +619,11 @@ app_readkey (app_t app, ctrl_t ctrl, int advanced, const char *keyid,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.readkey)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err= app->fnc.readkey (app, advanced, keyid, pk, pklen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -670,11 +661,11 @@ app_getattr (app_t app, ctrl_t ctrl, const char *name)
 
   if (!app->fnc.getattr)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err =  app->fnc.getattr (app, ctrl, name);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -693,11 +684,11 @@ app_setattr (app_t app, ctrl_t ctrl, const char *name,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.setattr)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.setattr (app, name, pincb, pincb_arg, value, valuelen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -719,14 +710,14 @@ app_sign (app_t app, ctrl_t ctrl, const char *keyidstr, int hashalgo,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.sign)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.sign (app, keyidstr, hashalgo,
                        pincb, pincb_arg,
                        indata, indatalen,
                        outdata, outdatalen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation sign result: %s\n", gpg_strerror (err));
   return err;
@@ -751,14 +742,14 @@ app_auth (app_t app, ctrl_t ctrl, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.auth)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.auth (app, keyidstr,
                        pincb, pincb_arg,
                        indata, indatalen,
                        outdata, outdatalen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation auth result: %s\n", gpg_strerror (err));
   return err;
@@ -786,7 +777,7 @@ app_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.decipher)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.decipher (app, keyidstr,
@@ -794,7 +785,7 @@ app_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
                            indata, indatalen,
                            outdata, outdatalen,
                            r_info);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation decipher result: %s\n", gpg_strerror (err));
   return err;
@@ -817,12 +808,12 @@ app_writecert (app_t app, ctrl_t ctrl,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.writecert)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.writecert (app, ctrl, certidstr,
                             pincb, pincb_arg, data, datalen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation writecert result: %s\n", gpg_strerror (err));
   return err;
@@ -845,12 +836,12 @@ app_writekey (app_t app, ctrl_t ctrl,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.writekey)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.writekey (app, ctrl, keyidstr, flags,
                            pincb, pincb_arg, keydata, keydatalen);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation writekey result: %s\n", gpg_strerror (err));
   return err;
@@ -872,12 +863,12 @@ app_genkey (app_t app, ctrl_t ctrl, const char *keynostr, unsigned int flags,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.genkey)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.genkey (app, ctrl, keynostr, flags,
                          createtime, pincb, pincb_arg);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation genkey result: %s\n", gpg_strerror (err));
   return err;
@@ -896,11 +887,11 @@ app_get_challenge (app_t app, ctrl_t ctrl, size_t nbytes, unsigned char *buffer)
     return gpg_error (GPG_ERR_INV_VALUE);
   if (!app->ref_count)
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = iso7816_get_challenge (app->slot, nbytes, buffer);
-  unlock_reader (app->slot);
+  unlock_app (app);
   return err;
 }
 
@@ -920,12 +911,12 @@ app_change_pin (app_t app, ctrl_t ctrl, const char *chvnostr, int reset_mode,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.change_pin)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.change_pin (app, ctrl, chvnostr, reset_mode,
                              pincb, pincb_arg);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation change_pin result: %s\n", gpg_strerror (err));
   return err;
@@ -948,12 +939,134 @@ app_check_pin (app_t app, ctrl_t ctrl, const char *keyidstr,
     return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.check_pin)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
-  err = lock_reader (app->slot, ctrl);
+  err = lock_app (app, ctrl);
   if (err)
     return err;
   err = app->fnc.check_pin (app, keyidstr, pincb, pincb_arg);
-  unlock_reader (app->slot);
+  unlock_app (app);
   if (opt.verbose)
     log_info ("operation check_pin result: %s\n", gpg_strerror (err));
   return err;
 }
+
+static void
+report_change (int slot, int old_status, int cur_status)
+{
+  char *homestr, *envstr;
+  char *fname;
+  char templ[50];
+  FILE *fp;
+
+  snprintf (templ, sizeof templ, "reader_%d.status", slot);
+  fname = make_filename (gnupg_homedir (), templ, NULL );
+  fp = fopen (fname, "w");
+  if (fp)
+    {
+      fprintf (fp, "%s\n",
+               (cur_status & 1)? "USABLE":
+               (cur_status & 4)? "ACTIVE":
+               (cur_status & 2)? "PRESENT": "NOCARD");
+      fclose (fp);
+    }
+  xfree (fname);
+
+  homestr = make_filename (gnupg_homedir (), NULL);
+  if (gpgrt_asprintf (&envstr, "GNUPGHOME=%s", homestr) < 0)
+    log_error ("out of core while building environment\n");
+  else
+    {
+      gpg_error_t err;
+      const char *args[9], *envs[2];
+      char numbuf1[30], numbuf2[30], numbuf3[30];
+
+      envs[0] = envstr;
+      envs[1] = NULL;
+
+      sprintf (numbuf1, "%d", slot);
+      sprintf (numbuf2, "0x%04X", old_status);
+      sprintf (numbuf3, "0x%04X", cur_status);
+      args[0] = "--reader-port";
+      args[1] = numbuf1;
+      args[2] = "--old-code";
+      args[3] = numbuf2;
+      args[4] = "--new-code";
+      args[5] = numbuf3;
+      args[6] = "--status";
+      args[7] = ((cur_status & 1)? "USABLE":
+                 (cur_status & 4)? "ACTIVE":
+                 (cur_status & 2)? "PRESENT": "NOCARD");
+      args[8] = NULL;
+
+      fname = make_filename (gnupg_homedir (), "scd-event", NULL);
+      err = gnupg_spawn_process_detached (fname, args, envs);
+      if (err && gpg_err_code (err) != GPG_ERR_ENOENT)
+        log_error ("failed to run event handler '%s': %s\n",
+                   fname, gpg_strerror (err));
+      xfree (fname);
+      xfree (envstr);
+    }
+  xfree (homestr);
+}
+
+void
+scd_update_reader_status_file (void)
+{
+  app_t a, app_next;
+
+  npth_mutex_lock (&app_list_lock);
+  for (a = app_top; a; a = app_next)
+    {
+      app_next = a->next;
+      if (a->require_get_status)
+        {
+          int sw;
+          unsigned int status;
+          sw = apdu_get_status (a->slot, 0, &status);
+
+          if (sw == SW_HOST_NO_READER)
+            {
+              /* Most likely the _reader_ has been unplugged.  */
+              status = 0;
+            }
+          else if (sw)
+            {
+              /* Get status failed.  Ignore that.  */
+              continue;
+            }
+
+          if (a->card_status != status)
+            {
+              report_change (a->slot, a->card_status, status);
+              send_client_notifications (a);
+
+              if (status == 0)
+                {
+                  log_debug ("Removal of a card: %d\n", a->slot);
+                  apdu_close_reader (a->slot);
+                  deallocate_app (a);
+                }
+              else
+                a->card_status = status;
+            }
+        }
+    }
+  npth_mutex_unlock (&app_list_lock);
+}
+
+/* This function must be called once to initialize this module.  This
+   has to be done before a second thread is spawned.  We can't do the
+   static initialization because Pth emulation code might not be able
+   to do a static init; in particular, it is not possible for W32. */
+void
+initialize_module_command (void)
+{
+  static int initialized;
+  int err;
+
+  if (!initialized)
+    {
+      err = npth_mutex_init (&app_list_lock, NULL);
+      if (!err)
+        initialized = 1;
+    }
+}
diff --git a/scd/command.c b/scd/command.c
index 02bf76f..0c823d2 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -37,7 +37,6 @@
 #include "iso7816.h"
 #include "apdu.h" /* Required for apdu_*_reader (). */
 #include "atr.h"
-#include "exechelp.h"
 #ifdef HAVE_LIBUSB
 #include "ccid-driver.h"
 #endif
@@ -59,38 +58,7 @@
 
 #define set_error(e,t) assuan_set_error (ctx, gpg_error (e), (t))
 
-
-/* Macro to flag a removed card.  ENODEV is also tested to catch the
-   case of a removed reader.  */
-#define TEST_CARD_REMOVAL(c,r)                              \
-       do {                                                 \
-          int _r = (r);                                     \
-          if (gpg_err_code (_r) == GPG_ERR_CARD_NOT_PRESENT \
-              || gpg_err_code (_r) == GPG_ERR_CARD_REMOVED  \
-              || gpg_err_code (_r) == GPG_ERR_CARD_RESET    \
-              || gpg_err_code (_r) == GPG_ERR_ENODEV )      \
-            update_card_removed ((c)->server_local->vreader_idx, 1);      \
-       } while (0)
-
-#define IS_LOCKED(c)                                                    \
-  (locked_session                                                       \
-   && locked_session != (c)->server_local                               \
-   && (c)->server_local->vreader_idx != -1                              \
-   && locked_session->ctrl_backlink                                     \
-   && ((c)->server_local->vreader_idx                                   \
-       == locked_session->ctrl_backlink->server_local->vreader_idx))
-
-
-/* This structure is used to keep track of user readers.  To
-   eventually accommodate this structure for RFID cards, where more
-   than one card is used per reader, we name it virtual reader.  */
-struct vreader_s
-{
-  int valid;  /* True if the other objects are valid. */
-  int slot;   /* APDU slot number of the reader or -1 if not open. */
-
-  unsigned int status;  /* Last status of the reader. */
-};
+#define IS_LOCKED(c) (locked_session && locked_session != (c)->server_local)
 
 
 /* Data used to associate an Assuan context with local server data.
@@ -116,16 +84,10 @@ struct server_local_s
   int event_signal;             /* Or 0 if not used. */
 #endif
 
-  /* Index into the vreader table (command.c) or -1 if not open. */
-  int vreader_idx;
-
   /* True if the card has been removed and a reset is required to
      continue operation. */
   int card_removed;
 
-  /* A disconnect command has been sent.  */
-  int disconnect_allowed;
-
   /* If set to true we will be terminate ourself at the end of the
      this session.  */
   int stopme;
@@ -133,10 +95,6 @@ struct server_local_s
 };
 
 
-/* The table with information on all used virtual readers.  */
-static struct vreader_s vreader_table[10];
-
-
 /* To keep track of all running sessions, we link all active server
    contexts and the anchor in this variable.  */
 static struct server_local_s *session_list;
@@ -145,88 +103,7 @@ static struct server_local_s *session_list;
    in this variable. */
 static struct server_local_s *locked_session;
 
-/* While doing a reset we need to make sure that the ticker does not
-   call scd_update_reader_status_file while we are using it. */
-static npth_mutex_t status_file_update_lock;
-
-

-/*-- Local prototypes --*/
-static void update_reader_status_file (int set_card_removed_flag);
-
-
 

-
-/* This function must be called once to initialize this module.  This
-   has to be done before a second thread is spawned.  We can't do the
-   static initialization because Pth emulation code might not be able
-   to do a static init; in particular, it is not possible for W32. */
-void
-initialize_module_command (void)
-{
-  static int initialized;
-  int err;
-
-  if (!initialized)
-    {
-      err = npth_mutex_init (&status_file_update_lock, NULL);
-      if (!err)
-        initialized = 1;
-    }
-}
-
-
-/* Helper to return the slot number for a given virtual reader index
-   VRDR.  In case on an error -1 is returned.  */
-static int
-vreader_slot (int vrdr)
-{
-  if (vrdr == -1 || !(vrdr >= 0 && vrdr < DIM(vreader_table)))
-    return -1;
-  if (!vreader_table [vrdr].valid)
-    return -1;
-  return vreader_table[vrdr].slot;
-}
-
-
-/* Update the CARD_REMOVED element of all sessions using the virtual
-   reader given by VRDR to VALUE.  */
-static void
-update_card_removed (int vrdr, int value)
-{
-  struct server_local_s *sl;
-
-  if (vrdr == -1)
-    return;
-
-  for (sl=session_list; sl; sl = sl->next_session)
-    {
-      ctrl_t ctrl = sl->ctrl_backlink;
-
-      if (ctrl && ctrl->server_local->vreader_idx == vrdr)
-        {
-          sl->card_removed = value;
-          if (value)
-            {
-              struct app_ctx_s *app = ctrl->app_ctx;
-              ctrl->app_ctx = NULL;
-              release_application (app);
-            }
-        }
-    }
-
-  /* Let the card application layer know about the removal.  */
-  if (value)
-    {
-      int slot = vreader_slot (vrdr);
-
-      log_debug ("Removal of a card: %d\n", vrdr);
-      apdu_close_reader (slot);
-      application_notify_card_reset (slot);
-      vreader_table[vrdr].slot = -1;
-    }
-}
-
-
 /* Convert the STRING into a newly allocated buffer while translating
    the hex numbers.  Stops at the first invalid character.  Blanks and
    colons are allowed to separate the hex digits.  Returns NULL on
@@ -265,61 +142,10 @@ hex_to_buffer (const char *string, size_t *r_length)
 static void
 do_reset (ctrl_t ctrl, int send_reset)
 {
-  int vrdr = ctrl->server_local->vreader_idx;
-  int slot;
-  int err;
-  struct app_ctx_s *app = ctrl->app_ctx;
-
-  if (!(vrdr == -1 || (vrdr >= 0 && vrdr < DIM(vreader_table))))
-    BUG ();
+  app_t app = ctrl->app_ctx;
 
-  /* If there is an active application, release it. */
   if (app)
-    {
-      ctrl->app_ctx = NULL;
-      release_application (app);
-    }
-
-  /* Release the same application which is used by other sessions.  */
-  if (send_reset)
-    {
-      struct server_local_s *sl;
-
-      for (sl=session_list; sl; sl = sl->next_session)
-        {
-          ctrl_t c = sl->ctrl_backlink;
-
-          if (c && c != ctrl && c->server_local->vreader_idx == vrdr)
-            {
-              struct app_ctx_s *app0 = c->app_ctx;
-              if (app0)
-                {
-                  c->app_ctx = NULL;
-                  release_application (app0);
-                }
-            }
-        }
-    }
-
-  /* If we want a real reset for the card, send the reset APDU and
-     tell the application layer about it.  */
-  slot = vreader_slot (vrdr);
-  if (slot != -1 && send_reset && !IS_LOCKED (ctrl) )
-    {
-      application_notify_card_reset (slot);
-      switch (apdu_reset (slot))
-        {
-        case 0:
-          break;
-        case SW_HOST_NO_CARD:
-        case SW_HOST_CARD_INACTIVE:
-          break;
-        default:
-          apdu_close_reader (slot);
-          vreader_table[vrdr].slot = -1;
-          break;
-        }
-    }
+    app_reset (app, ctrl, IS_LOCKED (ctrl)? 0: send_reset);
 
   /* If we hold a lock, unlock now. */
   if (locked_session && ctrl->server_local == locked_session)
@@ -327,30 +153,7 @@ do_reset (ctrl_t ctrl, int send_reset)
       locked_session = NULL;
       log_info ("implicitly unlocking due to RESET\n");
     }
-
-  /* Reset the card removed flag for the current reader.  We need to
-     take the lock here so that the ticker thread won't concurrently
-     try to update the file.  Calling update_reader_status_file is
-     required to get hold of the new status of the card in the vreader
-     table.  */
-  err = npth_mutex_lock (&status_file_update_lock);
-  if (err)
-    {
-      log_error ("failed to acquire status_file_update lock\n");
-      ctrl->server_local->vreader_idx = -1;
-      return;
-    }
-  update_reader_status_file (0);  /* Update slot status table.  */
-  update_card_removed (vrdr, 0);  /* Clear card_removed flag.  */
-  err = npth_mutex_unlock (&status_file_update_lock);
-  if (err)
-    log_error ("failed to release status_file_update lock: %s\n",
-	       strerror (err));
-
-  /* Do this last, so that the update_card_removed above does its job.  */
-  ctrl->server_local->vreader_idx = -1;
 }
-
 

 static gpg_error_t
 reset_notify (assuan_context_t ctx, char *line)
@@ -388,50 +191,11 @@ option_handler (assuan_context_t ctx, const char *key, const char *value)
 }
 
 
-/* Return the index of the current reader or open the reader if no
-   other sessions are using that reader.  If it is not possible to
-   open the reader -1 is returned.  Note, that we currently support
-   only one reader but most of the code (except for this function)
-   should be able to cope with several readers.  */
-static int
-get_current_reader (void)
-{
-  struct vreader_s *vr;
-
-  /* We only support one reader for now.  */
-  vr = &vreader_table[0];
-
-  /* Initialize the vreader item if not yet done. */
-  if (!vr->valid)
-    {
-      vr->slot = -1;
-      vr->valid = 1;
-    }
-
-  /* Try to open the reader. */
-  if (vr->slot == -1)
-    {
-      vr->slot = apdu_open_reader (opt.reader_port);
-
-      /* If we still don't have a slot, we have no readers.
-	 Invalidate for now until a reader is attached. */
-      if (vr->slot == -1)
-	{
-	  vr->valid = 0;
-	}
-    }
-
-  /* Return the vreader index or -1.  */
-  return vr->valid ? 0 : -1;
-}
-
-
 /* If the card has not yet been opened, do it.  */
 static gpg_error_t
-open_card (ctrl_t ctrl, const char *apptype)
+open_card (ctrl_t ctrl, const char *apptype, int scan)
 {
   gpg_error_t err;
-  int vrdr;
 
   /* If we ever got a card not present error code, return that.  Only
      the SERIALNO command and a reset are able to clear from that
@@ -445,43 +209,11 @@ open_card (ctrl_t ctrl, const char *apptype)
   /* If we are already initialized for one specific application we
      need to check that the client didn't requested a specific
      application different from the one in use before we continue. */
-  if (ctrl->app_ctx)
-    {
-      return check_application_conflict
-        (ctrl, vreader_slot (ctrl->server_local->vreader_idx), apptype);
-    }
+  if (!scan && ctrl->app_ctx)
+    return check_application_conflict (apptype, ctrl->app_ctx);
 
-  /* Setup the vreader and select the application.  */
-  if (ctrl->server_local->vreader_idx != -1)
-    vrdr = ctrl->server_local->vreader_idx;
-  else
-    vrdr = get_current_reader ();
-  ctrl->server_local->vreader_idx = vrdr;
-  if (vrdr == -1)
-    err = gpg_error (GPG_ERR_CARD);
-  else
-    {
-      /* Fixme: We should move the apdu_connect call to
-         select_application.  */
-      int sw;
-      int slot = vreader_slot (vrdr);
-
-      ctrl->server_local->disconnect_allowed = 0;
-      sw = apdu_connect (slot);
-      if (sw && sw != SW_HOST_ALREADY_CONNECTED)
-        {
-          if (sw == SW_HOST_NO_CARD)
-            err = gpg_error (GPG_ERR_CARD_NOT_PRESENT);
-          else if (sw == SW_HOST_CARD_INACTIVE)
-            err = gpg_error (GPG_ERR_CARD_RESET);
-          else
-            err = gpg_error (GPG_ERR_ENODEV);
-        }
-      else
-        err = select_application (ctrl, slot, apptype, &ctrl->app_ctx);
-    }
+  err = select_application (ctrl, apptype, &ctrl->app_ctx, scan);
 
-  TEST_CARD_REMOVAL (ctrl, err);
   return err;
 }
 
@@ -509,28 +241,35 @@ static gpg_error_t
 cmd_serialno (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
+  struct server_local_s *sl;
   int rc = 0;
   char *serial;
   time_t stamp;
-  int retries = 0;
 
   /* Clear the remove flag so that the open_card is able to reread it.  */
- retry:
   if (ctrl->server_local->card_removed)
     {
       if ( IS_LOCKED (ctrl) )
         return gpg_error (GPG_ERR_LOCKED);
-      do_reset (ctrl, 1);
+
+      ctrl->server_local->card_removed = 0;
     }
 
-  if ((rc = open_card (ctrl, *line? line:NULL)))
+  if ((rc = open_card (ctrl, *line? line:NULL, 1)))
     {
-      /* In case of an inactive card, retry once.  */
-      if (gpg_err_code (rc) == GPG_ERR_CARD_RESET && retries++ < 1)
-        goto retry;
+      ctrl->server_local->card_removed = 1;
       return rc;
     }
 
+  /* Success, clear the card_removed flag for all sessions.  */
+  for (sl=session_list; sl; sl = sl->next_session)
+    {
+      ctrl_t c = sl->ctrl_backlink;
+
+      if (c != ctrl)
+        c->server_local->card_removed = 0;
+    }
+
   rc = app_get_serial_and_stamp (ctrl->app_ctx, &serial, &stamp);
   if (rc)
     return rc;
@@ -618,7 +357,7 @@ cmd_learn (assuan_context_t ctx, char *line)
   int rc = 0;
   int only_keypairinfo = has_option (line, "--keypairinfo");
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   /* Unless the force option is used we try a shortcut by identifying
@@ -627,13 +366,15 @@ cmd_learn (assuan_context_t ctx, char *line)
      knows about this card */
   if (!only_keypairinfo)
     {
-      int slot;
       const char *reader;
       char *serial;
       time_t stamp;
+      app_t app = ctrl->app_ctx;
+
+      if (!app)
+        return gpg_error (GPG_ERR_CARD_NOT_PRESENT);
 
-      slot = vreader_slot (ctrl->server_local->vreader_idx);
-      reader = apdu_get_reader_name (slot);
+      reader = apdu_get_reader_name (app->slot);
       if (!reader)
         return out_of_core ();
       send_status_direct (ctrl, "READER", reader);
@@ -682,7 +423,6 @@ cmd_learn (assuan_context_t ctx, char *line)
   if (!rc)
     rc = app_write_learn_status (ctrl->app_ctx, ctrl, only_keypairinfo);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -700,7 +440,7 @@ cmd_readcert (assuan_context_t ctx, char *line)
   unsigned char *cert;
   size_t ncert;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   line = xstrdup (line); /* Need a copy of the line. */
@@ -717,7 +457,6 @@ cmd_readcert (assuan_context_t ctx, char *line)
         return rc;
     }
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -743,7 +482,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
   unsigned char *pk;
   size_t pklen;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (has_option (line, "--advanced"))
@@ -804,7 +543,6 @@ cmd_readkey (assuan_context_t ctx, char *line)
  leave:
   ksba_cert_release (kc);
   xfree (cert);
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -966,10 +704,7 @@ cmd_pksign (assuan_context_t ctx, char *line)
 
   line = skip_options (line);
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   /* We have to use a copy of the key ID because the function may use
@@ -998,7 +733,6 @@ cmd_pksign (assuan_context_t ctx, char *line)
         return rc; /* that is already an assuan error code */
     }
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1014,10 +748,7 @@ cmd_pkauth (assuan_context_t ctx, char *line)
   size_t outdatalen;
   char *keyidstr;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1046,7 +777,6 @@ cmd_pkauth (assuan_context_t ctx, char *line)
         return rc; /* that is already an assuan error code */
     }
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1063,10 +793,7 @@ cmd_pkdecrypt (assuan_context_t ctx, char *line)
   char *keyidstr;
   unsigned int infoflags;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   keyidstr = xtrystrdup (line);
@@ -1096,7 +823,6 @@ cmd_pkdecrypt (assuan_context_t ctx, char *line)
         return rc; /* that is already an assuan error code */
     }
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1120,7 +846,7 @@ cmd_getattr (assuan_context_t ctx, char *line)
   int rc;
   const char *keyword;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   keyword = line;
@@ -1135,7 +861,6 @@ cmd_getattr (assuan_context_t ctx, char *line)
      is locked.  */
   rc = app_getattr (ctrl->app_ctx, ctrl, keyword);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1163,10 +888,7 @@ cmd_setattr (assuan_context_t ctx, char *orig_line)
   size_t nbytes;
   char *line, *linebuf;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   /* We need to use a copy of LINE, because PIN_CB uses the same
@@ -1188,7 +910,6 @@ cmd_setattr (assuan_context_t ctx, char *orig_line)
                     (const unsigned char*)line, nbytes);
   xfree (linebuf);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1213,9 +934,6 @@ cmd_writecert (assuan_context_t ctx, char *line)
   unsigned char *certdata;
   size_t certdatalen;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
   line = skip_options (line);
 
   if (!*line)
@@ -1225,7 +943,7 @@ cmd_writecert (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1250,7 +968,6 @@ cmd_writecert (assuan_context_t ctx, char *line)
   xfree (certid);
   xfree (certdata);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1279,9 +996,6 @@ cmd_writekey (assuan_context_t ctx, char *line)
   unsigned char *keydata;
   size_t keydatalen;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
   line = skip_options (line);
 
   if (!*line)
@@ -1291,7 +1005,7 @@ cmd_writekey (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1317,7 +1031,6 @@ cmd_writekey (assuan_context_t ctx, char *line)
   xfree (keyid);
   xfree (keydata);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1357,9 +1070,6 @@ cmd_genkey (assuan_context_t ctx, char *line)
   const char *s;
   time_t timestamp;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
   force = has_option (line, "--force");
 
   if ((s=has_option_name (line, "--timestamp")))
@@ -1382,7 +1092,7 @@ cmd_genkey (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1395,7 +1105,6 @@ cmd_genkey (assuan_context_t ctx, char *line)
                    timestamp, pin_cb, ctx);
   xfree (keyno);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1421,7 +1130,7 @@ cmd_random (assuan_context_t ctx, char *line)
                       "number of requested bytes missing");
   nbytes = strtoul (line, NULL, 0);
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1440,7 +1149,6 @@ cmd_random (assuan_context_t ctx, char *line)
     }
   xfree (buffer);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1466,9 +1174,6 @@ cmd_passwd (assuan_context_t ctx, char *line)
   if (has_option (line, "--nullpin"))
     flags |= APP_CHANGE_FLAG_NULLPIN;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
   line = skip_options (line);
 
   if (!*line)
@@ -1478,7 +1183,7 @@ cmd_passwd (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1492,7 +1197,6 @@ cmd_passwd (assuan_context_t ctx, char *line)
     log_error ("command passwd failed: %s\n", gpg_strerror (rc));
   xfree (chvnostr);
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1536,10 +1240,7 @@ cmd_checkpin (assuan_context_t ctx, char *line)
   int rc;
   char *idstr;
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1557,7 +1258,6 @@ cmd_checkpin (assuan_context_t ctx, char *line)
   if (rc)
     log_error ("app_check_pin failed: %s\n", gpg_strerror (rc));
 
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -1592,8 +1292,8 @@ cmd_lock (assuan_context_t ctx, char *line)
     {
       rc = 0;
       npth_sleep (1); /* Better implement an event mechanism. However,
-			 for card operations this should be
-			 sufficient. */
+                         for card operations this should be
+                         sufficient. */
       /* FIXME: Need to check that the connection is still alive.
          This can be done by issuing status messages. */
       goto retry;
@@ -1690,20 +1390,12 @@ cmd_getinfo (assuan_context_t ctx, char *line)
   else if (!strcmp (line, "status"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
-      int vrdr = ctrl->server_local->vreader_idx;
+      app_t app = ctrl->app_ctx;
       char flag = 'r';
 
-      if (!ctrl->server_local->card_removed && vrdr != -1)
-	{
-	  struct vreader_s *vr;
-
-	  if (!(vrdr >= 0 && vrdr < DIM(vreader_table)))
-	    BUG ();
+      if (!ctrl->server_local->card_removed && app)
+        flag = 'u';
 
-	  vr = &vreader_table[vrdr];
-	  if (vr->valid && (vr->status & 1))
-	    flag = 'u';
-	}
       rc = assuan_send_data (ctx, &flag, 1);
     }
   else if (!strcmp (line, "reader_list"))
@@ -1751,7 +1443,7 @@ static gpg_error_t
 cmd_restart (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
-  struct app_ctx_s *app = ctrl->app_ctx;
+  app_t app = ctrl->app_ctx;
 
   (void)line;
 
@@ -1772,8 +1464,7 @@ cmd_restart (assuan_context_t ctx, char *line)
 static const char hlp_disconnect[] =
   "DISCONNECT\n"
   "\n"
-  "Disconnect the card if it is not any longer used by other\n"
-  "connections and the backend supports a disconnect operation.";
+  "Disconnect the card if the backend supports a disconnect operation.";
 static gpg_error_t
 cmd_disconnect (assuan_context_t ctx, char *line)
 {
@@ -1781,7 +1472,10 @@ cmd_disconnect (assuan_context_t ctx, char *line)
 
   (void)line;
 
-  ctrl->server_local->disconnect_allowed = 1;
+  if (!ctrl->app_ctx)
+    return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
+
+  apdu_disconnect (ctrl->app_ctx->slot);
   return 0;
 }
 
@@ -1810,6 +1504,7 @@ static gpg_error_t
 cmd_apdu (assuan_context_t ctx, char *line)
 {
   ctrl_t ctrl = assuan_get_pointer (ctx);
+  app_t app;
   int rc;
   unsigned char *apdu;
   size_t apdulen;
@@ -1817,7 +1512,6 @@ cmd_apdu (assuan_context_t ctx, char *line)
   int handle_more;
   const char *s;
   size_t exlen;
-  int slot;
 
   if (has_option (line, "--dump-atr"))
     with_atr = 2;
@@ -1837,13 +1531,12 @@ cmd_apdu (assuan_context_t ctx, char *line)
 
   line = skip_options (line);
 
-  if ( IS_LOCKED (ctrl) )
-    return gpg_error (GPG_ERR_LOCKED);
-
-  if ((rc = open_card (ctrl, NULL)))
+  if ((rc = open_card (ctrl, NULL, 0)))
     return rc;
 
-  slot = vreader_slot (ctrl->server_local->vreader_idx);
+  app = ctrl->app_ctx;
+  if (!app)
+    return gpg_error (GPG_ERR_CARD_NOT_PRESENT);
 
   if (with_atr)
     {
@@ -1851,7 +1544,7 @@ cmd_apdu (assuan_context_t ctx, char *line)
       size_t atrlen;
       char hexbuf[400];
 
-      atr = apdu_get_atr (slot, &atrlen);
+      atr = apdu_get_atr (app->slot, &atrlen);
       if (!atr || atrlen > sizeof hexbuf - 2 )
         {
           rc = gpg_error (GPG_ERR_INV_CARD);
@@ -1896,7 +1589,7 @@ cmd_apdu (assuan_context_t ctx, char *line)
       unsigned char *result = NULL;
       size_t resultlen;
 
-      rc = apdu_send_direct (slot, exlen,
+      rc = apdu_send_direct (app->slot, exlen,
                              apdu, apdulen, handle_more,
                              &result, &resultlen);
       if (rc)
@@ -1910,7 +1603,6 @@ cmd_apdu (assuan_context_t ctx, char *line)
   xfree (apdu);
 
  leave:
-  TEST_CARD_REMOVAL (ctrl, rc);
   return rc;
 }
 
@@ -2015,7 +1707,7 @@ scd_command_handler (ctrl_t ctrl, int fd)
   else
     {
       rc = assuan_init_socket_server (ctx, INT2FD(fd),
-				      ASSUAN_SOCKET_SERVER_ACCEPTED);
+                                      ASSUAN_SOCKET_SERVER_ACCEPTED);
     }
   if (rc)
     {
@@ -2040,10 +1732,6 @@ scd_command_handler (ctrl_t ctrl, int fd)
   ctrl->server_local->ctrl_backlink = ctrl;
   ctrl->server_local->assuan_ctx = ctx;
 
-  /* We open the reader right at startup so that the ticker is able to
-     update the status file. */
-  ctrl->server_local->vreader_idx = get_current_reader ();
-
   /* Command processing loop. */
   for (;;)
     {
@@ -2160,8 +1848,8 @@ send_status_direct (ctrl_t ctrl, const char *keyword, const char *args)
 
 
 /* Helper to send the clients a status change notification.  */
-static void
-send_client_notifications (void)
+void
+send_client_notifications (app_t app)
 {
   struct {
     pid_t pid;
@@ -2177,7 +1865,8 @@ send_client_notifications (void)
 
   for (sl=session_list; sl; sl = sl->next_session)
     {
-      if (sl->event_signal && sl->assuan_ctx)
+      if (sl->event_signal && sl->assuan_ctx
+          && sl->ctrl_backlink->app_ctx == app)
         {
           pid_t pid = assuan_get_pid (sl->assuan_ctx);
 #ifdef HAVE_W32_SYSTEM
@@ -2230,153 +1919,10 @@ send_client_notifications (void)
                 }
             }
 #endif /*!HAVE_W32_SYSTEM*/
-        }
-    }
-}
-
-
-
-/* This is the core of scd_update_reader_status_file but the caller
-   needs to take care of the locking.  */
-static void
-update_reader_status_file (int set_card_removed_flag)
-{
-  int idx;
-  unsigned int status;
-
-  /* Note, that we only try to get the status, because it does not
-     make sense to wait here for a operation to complete.  If we are
-     busy working with a card, delays in the status file update should
-     be acceptable. */
-  for (idx=0; idx < DIM(vreader_table); idx++)
-    {
-      struct vreader_s *vr = vreader_table + idx;
-      struct server_local_s *sl;
-      int sw_apdu;
 
-      if (!vr->valid || vr->slot == -1)
-        continue; /* Not valid or reader not yet open. */
-
-      sw_apdu = apdu_get_status (vr->slot, 0, &status);
-      if (sw_apdu == SW_HOST_NO_READER)
-        {
-          /* Most likely the _reader_ has been unplugged.  */
-          status = 0;
-        }
-      else if (sw_apdu)
-        {
-          /* Get status failed.  Ignore that.  */
-          continue;
+          sl->ctrl_backlink->app_ctx = NULL;
+          sl->card_removed = 1;
+          release_application (app);
         }
-
-      if (vr->status != status)
-        {
-          char *fname;
-          char templ[50];
-          FILE *fp;
-
-          log_info ("updating reader %d (%d) status: 0x%04X->0x%04X\n",
-                    idx, vr->slot, vr->status, status);
-
-	  /* FIXME: Should this be IDX instead of vr->slot?  This
-	     depends on how client sessions will associate the reader
-	     status with their session.  */
-          snprintf (templ, sizeof templ, "reader_%d.status", vr->slot);
-          fname = make_filename (gnupg_homedir (), templ, NULL );
-          fp = fopen (fname, "w");
-          if (fp)
-            {
-              fprintf (fp, "%s\n",
-                       (status & 1)? "USABLE":
-                       (status & 4)? "ACTIVE":
-                       (status & 2)? "PRESENT": "NOCARD");
-              fclose (fp);
-            }
-          xfree (fname);
-
-          /* If a status script is executable, run it. */
-          {
-            const char *args[9], *envs[2];
-            char numbuf1[30], numbuf2[30], numbuf3[30];
-            char *homestr, *envstr;
-            gpg_error_t err;
-
-            homestr = make_filename (gnupg_homedir (), NULL);
-            if (gpgrt_asprintf (&envstr, "GNUPGHOME=%s", homestr) < 0)
-              log_error ("out of core while building environment\n");
-            else
-              {
-                envs[0] = envstr;
-                envs[1] = NULL;
-
-                sprintf (numbuf1, "%d", vr->slot);
-                sprintf (numbuf2, "0x%04X", vr->status);
-                sprintf (numbuf3, "0x%04X", status);
-                args[0] = "--reader-port";
-                args[1] = numbuf1;
-                args[2] = "--old-code";
-                args[3] = numbuf2;
-                args[4] = "--new-code";
-                args[5] = numbuf3;
-                args[6] = "--status";
-                args[7] = ((status & 1)? "USABLE":
-                           (status & 4)? "ACTIVE":
-                           (status & 2)? "PRESENT": "NOCARD");
-                args[8] = NULL;
-
-                fname = make_filename (gnupg_homedir (), "scd-event", NULL);
-                err = gnupg_spawn_process_detached (fname, args, envs);
-                if (err && gpg_err_code (err) != GPG_ERR_ENOENT)
-                  log_error ("failed to run event handler '%s': %s\n",
-                             fname, gpg_strerror (err));
-                xfree (fname);
-                xfree (envstr);
-              }
-            xfree (homestr);
-          }
-
-          /* Set the card removed flag for all current sessions.  */
-          if (status == 0 && set_card_removed_flag)
-            update_card_removed (idx, 1);
-
-          vr->status = status;
-
-          /* Send a signal to all clients who applied for it.  */
-          send_client_notifications ();
-        }
-
-      /* Check whether a disconnect is pending.  */
-      if (opt.card_timeout)
-        {
-          for (sl=session_list; sl; sl = sl->next_session)
-            if (!sl->disconnect_allowed)
-              break;
-          if (session_list && !sl)
-            {
-              /* FIXME: Use a real timeout.  */
-              /* At least one connection and all allow a disconnect.  */
-              log_info ("disconnecting card in reader %d (%d)\n",
-                        idx, vr->slot);
-              apdu_disconnect (vr->slot);
-            }
-        }
-
     }
 }
-
-/* This function is called by the ticker thread to check for changes
-   of the reader stati.  It updates the reader status files and if
-   requested by the caller also send a signal to the caller.  */
-void
-scd_update_reader_status_file (void)
-{
-  int err;
-  err = npth_mutex_lock (&status_file_update_lock);
-  if (err)
-    return; /* locked - give up. */
-  update_reader_status_file (1);
-  err = npth_mutex_unlock (&status_file_update_lock);
-  if (err)
-    log_error ("failed to release status_file_update lock: %s\n",
-	       strerror (err));
-}
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 38aa490..e18ebfe 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -124,6 +124,7 @@ void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
 void scd_update_reader_status_file (void);
+void send_client_notifications (app_t app);
 
 
 #endif /*SCDAEMON_H*/

-----------------------------------------------------------------------

Summary of changes:
 scd/app-common.h |  47 ++---
 scd/app.c        | 535 ++++++++++++++++++++++++++++++--------------------
 scd/command.c    | 586 +++++++------------------------------------------------
 scd/scdaemon.h   |   1 +
 4 files changed, 403 insertions(+), 766 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 29 02:23:50 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 29 Dec 2016 02:23:50 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-15-gc48cf7e
Message-ID: <E1cMPRh-0000o2-Fu@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c48cf7e32ffa02ebdf00265543344c611bef0431 (commit)
      from  4cc9fc5eb9bd91d943c185d59da4a2b4cb885ee6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c48cf7e32ffa02ebdf00265543344c611bef0431
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Dec 29 10:07:43 2016 +0900

    scd: Fix a race condition for new_reader_slot.
    
    * scd/apdu.c (reader_table_lock, apdu_init): New.
    (new_reader_slot): Serialize by reader_table_lock.
    * scd/app.c (lock_app, unlock_app, app_new_register): Fix error code
    usage.
    (initialize_module_command): Call apdu_init.
    * scd/scdaemon.c (main): Handle error for initialize_module_command.
    
    --
    
    This is a long standing bug.  There are two different things; The
    serialization of allocating a new SLOT, and the serialization of using
    the SLOT.  The latter was implemented in new_reader_slot by lock_slot.
    However, the former was not done.  Thus, there was a possible race where
    a same SLOT is allocated to multiple threads.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index 177cd8e..d0b75c8 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -144,7 +144,6 @@ struct reader_table_s {
                               not yet been read; i.e. the card is not
                               ready for use. */
 #ifdef USE_NPTH
-  int lock_initialized;
   npth_mutex_t lock;
 #endif
 };
@@ -153,6 +152,10 @@ typedef struct reader_table_s *reader_table_t;
 /* A global table to keep track of active readers. */
 static struct reader_table_s reader_table[MAX_READER];
 
+#ifdef USE_NPTH
+static npth_mutex_t reader_table_lock;
+#endif
+
 
 /* ct API function pointer. */
 static char (* DLSTDCALL CT_init) (unsigned short ctn, unsigned short Pn);
@@ -424,35 +427,29 @@ static int
 new_reader_slot (void)
 {
   int i, reader = -1;
-  int err;
 
+  npth_mutex_lock (&reader_table_lock);
   for (i=0; i < MAX_READER; i++)
-    {
-      if (!reader_table[i].used && reader == -1)
+    if (!reader_table[i].used)
+      {
         reader = i;
-    }
+        reader_table[reader].used = 1;
+        break;
+      }
+  npth_mutex_unlock (&reader_table_lock);
+
   if (reader == -1)
     {
       log_error ("new_reader_slot: out of slots\n");
       return -1;
     }
-#ifdef USE_NPTH
-  if (!reader_table[reader].lock_initialized)
-    {
-      err = npth_mutex_init (&reader_table[reader].lock, NULL);
-      if (err)
-        {
-          log_error ("error initializing mutex: %s\n", strerror (err));
-          return -1;
-        }
-      reader_table[reader].lock_initialized = 1;
-    }
-#endif /*USE_NPTH*/
+
   if (lock_slot (reader))
     {
-      log_error ("error locking mutex: %s\n", strerror (errno));
+      reader_table[reader].used = 0;
       return -1;
     }
+
   reader_table[reader].connect_card = NULL;
   reader_table[reader].disconnect_card = NULL;
   reader_table[reader].close_reader = NULL;
@@ -465,7 +462,6 @@ new_reader_slot (void)
   reader_table[reader].pinpad_verify = pcsc_pinpad_verify;
   reader_table[reader].pinpad_modify = pcsc_pinpad_modify;
 
-  reader_table[reader].used = 1;
   reader_table[reader].is_t0 = 1;
   reader_table[reader].is_spr532 = 0;
   reader_table[reader].pinpad_varlen_supported = 0;
@@ -650,7 +646,6 @@ static int
 close_ct_reader (int slot)
 {
   CT_close (slot);
-  reader_table[slot].used = 0;
   return 0;
 }
 
@@ -1435,7 +1430,6 @@ close_pcsc_reader_direct (int slot)
   pcsc_release_context (reader_table[slot].pcsc.context);
   xfree (reader_table[slot].rdrname);
   reader_table[slot].rdrname = NULL;
-  reader_table[slot].used = 0;
   return 0;
 }
 #endif /*!NEED_PCSC_WRAPPER*/
@@ -2439,7 +2433,6 @@ close_ccid_reader (int slot)
 {
   ccid_close_reader (reader_table[slot].ccid.handle);
   reader_table[slot].rdrname = NULL;
-  reader_table[slot].used = 0;
   return 0;
 }
 
@@ -2670,7 +2663,6 @@ static int
 close_rapdu_reader (int slot)
 {
   rapdu_release (reader_table[slot].rapdu.handle);
-  reader_table[slot].used = 0;
   return 0;
 }
 
@@ -3180,10 +3172,12 @@ apdu_close_reader (int slot)
   if (reader_table[slot].close_reader)
     {
       sw = reader_table[slot].close_reader (slot);
+      reader_table[slot].used = 0;
       if (DBG_READER)
         log_debug ("leave: apdu_close_reader => 0x%x (close_reader)\n", sw);
       return sw;
     }
+  reader_table[slot].used = 0;
   if (DBG_READER)
     log_debug ("leave: apdu_close_reader => SW_HOST_NOT_SUPPORTED\n");
   return SW_HOST_NOT_SUPPORTED;
@@ -3203,6 +3197,7 @@ apdu_prepare_exit (void)
   if (!sentinel)
     {
       sentinel = 1;
+      npth_mutex_lock (&reader_table_lock);
       for (slot = 0; slot < MAX_READER; slot++)
         if (reader_table[slot].used)
           {
@@ -3211,6 +3206,7 @@ apdu_prepare_exit (void)
               reader_table[slot].close_reader (slot);
             reader_table[slot].used = 0;
           }
+      npth_mutex_unlock (&reader_table_lock);
       sentinel = 0;
     }
 }
@@ -4222,3 +4218,28 @@ apdu_get_reader_name (int slot)
 {
   return reader_table[slot].rdrname;
 }
+
+gpg_error_t
+apdu_init (void)
+{
+#ifdef USE_NPTH
+  gpg_error_t err;
+  int i;
+
+  if (npth_mutex_init (&reader_table_lock, NULL))
+    goto leave;
+
+  for (i = 0; i < MAX_READER; i++)
+    if (npth_mutex_init (&reader_table[i].lock, NULL))
+      goto leave;
+
+  /* All done well.  */
+  return 0;
+
+ leave:
+  err = gpg_error_from_syserror ();
+  log_error ("apdu: error initializing mutex: %s\n", gpg_strerror (err));
+  return err;
+#endif /*USE_NPTH*/
+  return 0;
+}
diff --git a/scd/apdu.h b/scd/apdu.h
index ba856af..3021cf7 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -84,6 +84,8 @@ enum {
 #define APDU_CARD_ACTIVE   (4)    /* Card is active.  */
 
 
+gpg_error_t apdu_init (void);
+
 /* Note, that apdu_open_reader returns no status word but -1 on error. */
 int apdu_open_reader (const char *portstr);
 int apdu_open_remote_reader (const char *portstr,
diff --git a/scd/app.c b/scd/app.c
index a78d652..fa05475 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -58,14 +58,12 @@ print_progress_line (void *opaque, const char *what, int pc, int cur, int tot)
 static gpg_error_t
 lock_app (app_t app, ctrl_t ctrl)
 {
-  gpg_error_t err;
-
-  err = npth_mutex_lock (&app->lock);
-  if (err)
+  if (npth_mutex_lock (&app->lock))
     {
+      gpg_error_t err = gpg_error_from_syserror ();
       log_error ("failed to acquire APP lock for %p: %s\n",
-                 app, strerror (err));
-      return gpg_error_from_errno (err);
+                 app, gpg_strerror (err));
+      return err;
     }
 
   apdu_set_progress_cb (app->slot, print_progress_line, ctrl);
@@ -77,14 +75,14 @@ lock_app (app_t app, ctrl_t ctrl)
 static void
 unlock_app (app_t app)
 {
-  gpg_error_t err;
-
   apdu_set_progress_cb (app->slot, NULL, NULL);
 
-  err = npth_mutex_unlock (&app->lock);
-  if (err)
-    log_error ("failed to release APP lock for %p: %s\n",
-               app, strerror (err));
+  if (npth_mutex_unlock (&app->lock))
+    {
+      gpg_error_t err = gpg_error_from_syserror ();
+      log_error ("failed to release APP lock for %p: %s\n",
+                 app, gpg_strerror (err));
+    }
 }
 
 
@@ -194,11 +192,11 @@ app_new_register (int slot, ctrl_t ctrl, const char *name)
     }
 
   app->slot = slot;
-  err = npth_mutex_init (&app->lock, NULL);
-  if (err)
+
+  if (npth_mutex_init (&app->lock, NULL))
     {
       err = gpg_error_from_syserror ();
-      log_error ("error initializing mutex: %s\n", strerror (err));
+      log_error ("error initializing mutex: %s\n", gpg_strerror (err));
       xfree (app);
       return err;
     }
@@ -1057,16 +1055,17 @@ scd_update_reader_status_file (void)
    has to be done before a second thread is spawned.  We can't do the
    static initialization because Pth emulation code might not be able
    to do a static init; in particular, it is not possible for W32. */
-void
+gpg_error_t
 initialize_module_command (void)
 {
-  static int initialized;
-  int err;
+  gpg_error_t err;
 
-  if (!initialized)
+  if (npth_mutex_init (&app_list_lock, NULL))
     {
-      err = npth_mutex_init (&app_list_lock, NULL);
-      if (!err)
-        initialized = 1;
+      err = gpg_error_from_syserror ();
+      log_error ("app: error initializing mutex: %s\n", gpg_strerror (err));
+      return err;
     }
+
+  return apdu_init ();
 }
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 38e3c40..74fed44 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -640,7 +640,12 @@ main (int argc, char **argv )
 
   set_debug (debug_level);
 
-  initialize_module_command ();
+  if (initialize_module_command ())
+    {
+      log_error ("initialization failed\n");
+      cleanup ();
+      exit (1);
+    }
 
   if (gpgconf_list == 2)
     scd_exit (0);
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index e18ebfe..22b17b4 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -118,7 +118,7 @@ void scd_exit (int rc);
 const char *scd_get_socket_name (void);
 
 /*-- command.c --*/
-void initialize_module_command (void);
+gpg_error_t initialize_module_command (void);
 int  scd_command_handler (ctrl_t, int);
 void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c     | 67 ++++++++++++++++++++++++++++++++++++++--------------------
 scd/apdu.h     |  2 ++
 scd/app.c      | 43 ++++++++++++++++++-------------------
 scd/scdaemon.c |  7 +++++-
 scd/scdaemon.h |  2 +-
 5 files changed, 74 insertions(+), 47 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Dec 29 03:34:58 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 29 Dec 2016 03:34:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-16-gcdc8d0b
Message-ID: <E1cMQYX-0003f1-5e@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  cdc8d0bd933b958db878861587322bc541b580b3 (commit)
      from  c48cf7e32ffa02ebdf00265543344c611bef0431 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cdc8d0bd933b958db878861587322bc541b580b3
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Dec 29 11:31:25 2016 +0900

    scd: Improve internal CCID driver.
    
    * scd/ccid-driver.c (scan_or_find_usb_device): Don't scan for
    configuration but use active configuration.  Support alt_setting.
    (scan_or_find_devices): Support alt_setting.
    (ccid_open_reader): Support alt_setting.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 7d70819..6d81122 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1125,163 +1125,150 @@ scan_or_find_usb_device (int scan_mode,
                          libusb_device_handle **r_idev,
                          unsigned char **ifcdesc_extra,
                          size_t *ifcdesc_extra_len,
-                         int *interface_number,
+                         int *interface_number, int *setting_number,
                          int *ep_bulk_out, int *ep_bulk_in, int *ep_intr)
 {
-  int cfg_no;
   int ifc_no;
   int set_no;
   const struct libusb_interface_descriptor *ifcdesc;
   char *rid;
   libusb_device_handle *idev = NULL;
   int err;
+  struct libusb_config_descriptor *config;
 
   err = libusb_get_device_descriptor (dev, desc);
-  if (err < 0)
+  if (err)
     return 0;
 
   *r_idev = NULL;
 
-  for (cfg_no=0; cfg_no < desc->bNumConfigurations; cfg_no++)
-    {
-      struct libusb_config_descriptor *config;
+  err = libusb_get_active_config_descriptor (dev, &config);
+  if (err)
+    return 0;
 
-      err = libusb_get_config_descriptor (dev, cfg_no, &config);
-      if (err < 0)
-        {
-          if (err == LIBUSB_ERROR_NO_MEM)
-            return 0;
-          continue;
-        }
+  for (ifc_no=0; ifc_no < config->bNumInterfaces; ifc_no++)
+    for (set_no=0; set_no < config->interface[ifc_no].num_altsetting; set_no++)
+      {
+        ifcdesc = (config->interface[ifc_no].altsetting + set_no);
+        /* The second condition is for older SCM SPR 532 who did
+           not know about the assigned CCID class.  The third
+           condition does the same for a Cherry SmartTerminal
+           ST-2000.  Instead of trying to interpret the strings
+           we simply check the product ID. */
+        if (ifcdesc && ifcdesc->extra
+            && ((ifcdesc->bInterfaceClass == 11
+                 && ifcdesc->bInterfaceSubClass == 0
+                 && ifcdesc->bInterfaceProtocol == 0)
+                || (ifcdesc->bInterfaceClass == 255
+                    && desc->idVendor == VENDOR_SCM
+                    && desc->idProduct == SCM_SPR532)
+                || (ifcdesc->bInterfaceClass == 255
+                    && desc->idVendor == VENDOR_CHERRY
+                    && desc->idProduct == CHERRY_ST2000)))
+          {
+            ++*count;
+            if (!scan_mode && ((readerno > 0 && readerno != *count - 1)))
+              continue;
 
-      for (ifc_no=0; ifc_no < config->bNumInterfaces; ifc_no++)
-        {
-          for (set_no=0; set_no < config->interface[ifc_no].num_altsetting;
-               set_no++)
-            {
-              ifcdesc = (config->interface[ifc_no].altsetting + set_no);
-              /* The second condition is for older SCM SPR 532 who did
-                 not know about the assigned CCID class.  The third
-                 condition does the same for a Cherry SmartTerminal
-                 ST-2000.  Instead of trying to interpret the strings
-                 we simply check the product ID. */
-              if (ifcdesc && ifcdesc->extra
-                  && ((ifcdesc->bInterfaceClass == 11
-                       && ifcdesc->bInterfaceSubClass == 0
-                       && ifcdesc->bInterfaceProtocol == 0)
-                      || (ifcdesc->bInterfaceClass == 255
-                          && desc->idVendor == VENDOR_SCM
-                          && desc->idProduct == SCM_SPR532)
-                      || (ifcdesc->bInterfaceClass == 255
-                          && desc->idVendor == VENDOR_CHERRY
-                          && desc->idProduct == CHERRY_ST2000)))
-                {
-                  ++*count;
-                  if (!scan_mode
-                      && ((readerno > 0 && readerno != *count - 1)))
-                    continue;
-
-                  err = libusb_open (dev, &idev);
-                  if (err < 0)
-                    {
-                      DEBUGOUT_1 ("usb_open failed: %s\n",
-                                  libusb_error_name (err));
-                      continue; /* with next setting. */
-                    }
-
-                  rid = make_reader_id (idev, desc->idVendor, desc->idProduct,
-                                        desc->iSerialNumber);
-                  if (!rid)
-                    {
-                      libusb_free_config_descriptor (config);
-                      return 0;
-                    }
-
-                  if (!scan_mode && readerno == -1 && readerid
-                      && strncmp (rid, readerid, strlen (readerid)))
-                    continue;
-
-                  if (scan_mode)
-                    {
-                      char *p;
-
-                      /* We are collecting infos about all
-                         available CCID readers.  Store them and
-                         continue. */
-                      DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n",
-                                  *count, rid );
-                      p = malloc ((*rid_list? strlen (*rid_list):0) + 1
-                                  + strlen (rid) + 1);
-                      if (p)
-                        {
-                          *p = 0;
-                          if (*rid_list)
-                            {
-                              strcat (p, *rid_list);
-                              free (*rid_list);
-                            }
-                          strcat (p, rid);
-                          strcat (p, "\n");
-                          *rid_list = p;
-                        }
-                      else /* Out of memory. */
-                        {
-                          libusb_free_config_descriptor (config);
-                          free (rid);
-                          return 0;
-                        }
-                    }
-                  else
-                    {
-                      /* We found the requested reader. */
-                      if (ifcdesc_extra && ifcdesc_extra_len)
-                        {
-                          *ifcdesc_extra = malloc (ifcdesc
-                                                   ->extra_length);
-                          if (!*ifcdesc_extra)
-                            {
-                              libusb_close (idev);
-                              free (rid);
-                              libusb_free_config_descriptor (config);
-                              return 1; /* Out of core. */
-                            }
-                          memcpy (*ifcdesc_extra, ifcdesc->extra,
-                                  ifcdesc->extra_length);
-                          *ifcdesc_extra_len = ifcdesc->extra_length;
-                        }
-
-                      if (interface_number)
-                        *interface_number = (ifcdesc->bInterfaceNumber);
-
-                      if (ep_bulk_out)
-                        *ep_bulk_out = find_endpoint (ifcdesc, 0);
-                      if (ep_bulk_in)
-                        *ep_bulk_in = find_endpoint (ifcdesc, 1);
-                      if (ep_intr)
-                        *ep_intr = find_endpoint (ifcdesc, 2);
-
-                      if (r_rid)
-                        {
-                          *r_rid = rid;
-                          rid = NULL;
-                        }
-                      else
+            err = libusb_open (dev, &idev);
+            if (err)
+              {
+                DEBUGOUT_1 ("usb_open failed: %s\n", libusb_error_name (err));
+                continue; /* with next setting. */
+              }
+
+            rid = make_reader_id (idev, desc->idVendor, desc->idProduct,
+                                  desc->iSerialNumber);
+            if (!rid)
+              {
+                libusb_free_config_descriptor (config);
+                return 0;
+              }
+
+            if (!scan_mode && readerno == -1 && readerid
+                && strncmp (rid, readerid, strlen (readerid)))
+              continue;
+
+            if (scan_mode)
+              {
+                char *p;
+
+                /* We are collecting infos about all
+                   available CCID readers.  Store them and
+                   continue. */
+                DEBUGOUT_2 ("found CCID reader %d (ID=%s)\n", *count, rid);
+                p = malloc ((*rid_list? strlen (*rid_list):0) + 1
+                            + strlen (rid) + 1);
+                if (p)
+                  {
+                    *p = 0;
+                    if (*rid_list)
+                      {
+                        strcat (p, *rid_list);
+                        free (*rid_list);
+                      }
+                    strcat (p, rid);
+                    strcat (p, "\n");
+                    *rid_list = p;
+                  }
+                else /* Out of memory. */
+                  {
+                    libusb_free_config_descriptor (config);
+                    free (rid);
+                    return 0;
+                  }
+              }
+            else
+              {
+                /* We found the requested reader. */
+                if (ifcdesc_extra && ifcdesc_extra_len)
+                  {
+                    *ifcdesc_extra = malloc (ifcdesc->extra_length);
+                    if (!*ifcdesc_extra)
+                      {
+                        libusb_close (idev);
                         free (rid);
+                        libusb_free_config_descriptor (config);
+                        return 1; /* Out of core. */
+                      }
+                    memcpy (*ifcdesc_extra, ifcdesc->extra,
+                            ifcdesc->extra_length);
+                    *ifcdesc_extra_len = ifcdesc->extra_length;
+                  }
+
+                if (interface_number)
+                  *interface_number = ifc_no;
+
+                if (setting_number)
+                  *setting_number = set_no;
+
+                if (ep_bulk_out)
+                  *ep_bulk_out = find_endpoint (ifcdesc, 0);
+                if (ep_bulk_in)
+                  *ep_bulk_in = find_endpoint (ifcdesc, 1);
+                if (ep_intr)
+                  *ep_intr = find_endpoint (ifcdesc, 2);
+
+                if (r_rid)
+                  {
+                    *r_rid = rid;
+                    rid = NULL;
+                  }
+                else
+                  free (rid);
 
-                      *r_idev = idev;
-                      libusb_free_config_descriptor (config);
-                      return 1; /* Found requested device. */
-                    }
+                *r_idev = idev;
+                libusb_free_config_descriptor (config);
+                return 1; /* Found requested device. */
+              }
 
-                  free (rid);
-                  libusb_close (idev);
-                  idev = NULL;
-                }
-            }
-        }
+            free (rid);
+            libusb_close (idev);
+            idev = NULL;
+          }
+      }
 
-      libusb_free_config_descriptor (config);
-    }
+  libusb_free_config_descriptor (config);
 
   return 0;
 }
@@ -1329,7 +1316,7 @@ scan_or_find_devices (int readerno, const char *readerid,
                       struct libusb_device_descriptor *r_desc,
                       unsigned char **ifcdesc_extra,
                       size_t *ifcdesc_extra_len,
-                      int *interface_number,
+                      int *interface_number, int *setting_number,
                       int *ep_bulk_out, int *ep_bulk_in, int *ep_intr,
                       libusb_device_handle **r_idev,
                       int *r_fd)
@@ -1353,6 +1340,8 @@ scan_or_find_devices (int readerno, const char *readerid,
     *ifcdesc_extra_len = 0;
   if (interface_number)
     *interface_number = 0;
+  if (setting_number)
+    *setting_number = 0;
   if (r_idev)
     *r_idev = NULL;
   if (r_fd)
@@ -1377,7 +1366,7 @@ scan_or_find_devices (int readerno, const char *readerid,
                                    &idev,
                                    ifcdesc_extra,
                                    ifcdesc_extra_len,
-                                   interface_number,
+                                   interface_number, setting_number,
                                    ep_bulk_out, ep_bulk_in, ep_intr))
         {
           libusb_free_device_list (dev_list, 1);
@@ -1512,7 +1501,7 @@ ccid_get_reader_list (void)
     }
 
   if (scan_or_find_devices (-1, NULL, &reader_list, NULL, NULL, NULL, NULL,
-                            NULL, NULL, NULL, NULL, NULL))
+                            NULL, NULL, NULL, NULL, NULL, NULL))
     return NULL; /* Error. */
   return reader_list;
 }
@@ -1558,7 +1547,7 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid,
   unsigned char *ifcdesc_extra = NULL;
   size_t ifcdesc_extra_len;
   int readerno;
-  int ifc_no, ep_bulk_out, ep_bulk_in, ep_intr;
+  int ifc_no, set_no, ep_bulk_out, ep_bulk_in, ep_intr;
   struct libusb_device_descriptor desc;
 
   *handle = NULL;
@@ -1587,10 +1576,9 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid,
   else
     readerno = 0;  /* Default. */
 
-  if (scan_or_find_devices (readerno, readerid, &rid, &desc,
-                            &ifcdesc_extra, &ifcdesc_extra_len,
-                            &ifc_no, &ep_bulk_out, &ep_bulk_in, &ep_intr,
-                            &idev, &dev_fd) )
+  if (scan_or_find_devices (readerno, readerid, &rid, &desc, &ifcdesc_extra,
+                            &ifcdesc_extra_len, &ifc_no, &set_no, &ep_bulk_out,
+                            &ep_bulk_in, &ep_intr, &idev, &dev_fd))
     {
       if (readerno == -1)
         DEBUGOUT_1 ("no CCID reader with ID %s\n", readerid );
@@ -1646,12 +1634,23 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid,
         }
 
       rc = libusb_claim_interface (idev, ifc_no);
-      if (rc < 0)
+      if (rc)
         {
           DEBUGOUT_1 ("usb_claim_interface failed: %d\n", rc);
           rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
           goto leave;
         }
+
+      if (set_no != 0)
+        {
+          rc = libusb_set_interface_alt_setting (idev, ifc_no, set_no);
+          if (rc)
+            {
+              DEBUGOUT_1 ("usb_set_interface_alt_setting failed: %d\n", rc);
+              rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
+              goto leave;
+            }
+        }
     }
 
   rc = ccid_vendor_specific_init (*handle);
@@ -1852,7 +1851,7 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
       if (rc == 0 && transferred == msglen)
         return 0;
 
-      if (rc < 0)
+      if (rc)
         {
           DEBUGOUT_1 ("usb_bulk_write error: %s\n", libusb_error_name (rc));
           if (rc == LIBUSB_ERROR_NO_DEVICE)
@@ -1899,7 +1898,7 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
     {
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
                                  (char*)buffer, length, &msglen, timeout);
-      if (rc < 0)
+      if (rc)
         {
           DEBUGOUT_1 ("usb_bulk_read error: %s\n", libusb_error_name (rc));
           if (rc == LIBUSB_ERROR_NO_DEVICE)
@@ -2041,7 +2040,7 @@ abort_cmd (ccid_driver_t handle, int seqno)
                                 handle->ifc_no,
                                 dummybuf, 0,
                                 1000 /* ms timeout */);
-  if (rc < 0)
+  if (rc)
     {
       DEBUGOUT_1 ("usb_control_msg error: %s\n", libusb_error_name (rc));
       return CCID_DRIVER_ERR_CARD_IO_ERROR;
@@ -2070,7 +2069,7 @@ abort_cmd (ccid_driver_t handle, int seqno)
                                  5000 /* ms timeout */);
       if (rc == 0 && transferred == msglen)
         rc = 0;
-      else if (rc < 0)
+      else if (rc)
         DEBUGOUT_1 ("usb_bulk_write error in abort_cmd: %s\n",
                     libusb_error_name (rc));
 
@@ -2080,7 +2079,7 @@ abort_cmd (ccid_driver_t handle, int seqno)
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
                                  (char*)msg, sizeof msg, &msglen,
                                  5000 /*ms timeout*/);
-      if (rc < 0)
+      if (rc)
         {
           DEBUGOUT_1 ("usb_bulk_read error in abort_cmd: %s\n",
                       libusb_error_name (rc));
@@ -2205,7 +2204,7 @@ ccid_poll (ccid_driver_t handle)
   else
     return 0;
 
-  if (rc < 0)
+  if (rc)
     {
       DEBUGOUT_1 ("usb_intr_read error: %s\n", libusb_error_name (rc));
       return CCID_DRIVER_ERR_CARD_IO_ERROR;

-----------------------------------------------------------------------

Summary of changes:
 scd/ccid-driver.c | 303 +++++++++++++++++++++++++++---------------------------
 1 file changed, 151 insertions(+), 152 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 30 05:19:57 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 30 Dec 2016 05:19:57 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-17-gf300e12
Message-ID: <E1cMofg-0000hy-Hx@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f300e12a793d59deb1a369713384eaabfa39b3e6 (commit)
      from  cdc8d0bd933b958db878861587322bc541b580b3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f300e12a793d59deb1a369713384eaabfa39b3e6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Dec 30 13:17:49 2016 +0900

    scd: Fix card removal monitor.
    
    * scd/app.c (app_reset): Call send_client_notification with REMOVAL.
    (scd_update_reader_status_file): Likewise.
    * scd/command.c (send_client_notifications): Distinguish removal.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app.c b/scd/app.c
index fa05475..39910d2 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -161,7 +161,7 @@ app_reset (app_t app, ctrl_t ctrl, int send_reset)
         err = gpg_error (GPG_ERR_CARD_RESET);
 
       /* Release the same application which is used by other sessions.  */
-      send_client_notifications (app);
+      send_client_notifications (app, 1);
     }
   else
     {
@@ -1035,7 +1035,7 @@ scd_update_reader_status_file (void)
           if (a->card_status != status)
             {
               report_change (a->slot, a->card_status, status);
-              send_client_notifications (a);
+              send_client_notifications (a, status == 0);
 
               if (status == 0)
                 {
diff --git a/scd/command.c b/scd/command.c
index 0c823d2..ce2be34 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -1849,7 +1849,7 @@ send_status_direct (ctrl_t ctrl, const char *keyword, const char *args)
 
 /* Helper to send the clients a status change notification.  */
 void
-send_client_notifications (app_t app)
+send_client_notifications (app_t app, int removal)
 {
   struct {
     pid_t pid;
@@ -1864,65 +1864,75 @@ send_client_notifications (app_t app)
   struct server_local_s *sl;
 
   for (sl=session_list; sl; sl = sl->next_session)
-    {
-      if (sl->event_signal && sl->assuan_ctx
-          && sl->ctrl_backlink->app_ctx == app)
-        {
-          pid_t pid = assuan_get_pid (sl->assuan_ctx);
+    if (sl->ctrl_backlink && sl->ctrl_backlink->app_ctx == app)
+      {
+        pid_t pid;
+#ifdef HAVE_W32_SYSTEM
+        HANDLE handle;
+#else
+        int signo;
+#endif
+
+        if (removal)
+          {
+            sl->ctrl_backlink->app_ctx = NULL;
+            sl->card_removed = 1;
+            release_application (app);
+          }
+
+        if (!sl->event_signal || !sl->assuan_ctx)
+          continue;
+
+        pid = assuan_get_pid (sl->assuan_ctx);
+
 #ifdef HAVE_W32_SYSTEM
-          HANDLE handle = (void *)sl->event_signal;
-
-          for (kidx=0; kidx < killidx; kidx++)
-            if (killed[kidx].pid == pid
-                && killed[kidx].handle == handle)
-              break;
-          if (kidx < killidx)
-            log_info ("event %lx (%p) already triggered for client %d\n",
+        handle = (void *)sl->event_signal;
+        for (kidx=0; kidx < killidx; kidx++)
+          if (killed[kidx].pid == pid
+              && killed[kidx].handle == handle)
+            break;
+        if (kidx < killidx)
+          log_info ("event %lx (%p) already triggered for client %d\n",
+                    sl->event_signal, handle, (int)pid);
+        else
+          {
+            log_info ("triggering event %lx (%p) for client %d\n",
                       sl->event_signal, handle, (int)pid);
-          else
-            {
-              log_info ("triggering event %lx (%p) for client %d\n",
-                        sl->event_signal, handle, (int)pid);
-              if (!SetEvent (handle))
-                log_error ("SetEvent(%lx) failed: %s\n",
-                           sl->event_signal, w32_strerror (-1));
-              if (killidx < DIM (killed))
-                {
-                  killed[killidx].pid = pid;
-                  killed[killidx].handle = handle;
-                  killidx++;
-                }
-            }
+            if (!SetEvent (handle))
+              log_error ("SetEvent(%lx) failed: %s\n",
+                         sl->event_signal, w32_strerror (-1));
+            if (killidx < DIM (killed))
+              {
+                killed[killidx].pid = pid;
+                killed[killidx].handle = handle;
+                killidx++;
+              }
+          }
 #else /*!HAVE_W32_SYSTEM*/
-          int signo = sl->event_signal;
-
-          if (pid != (pid_t)(-1) && pid && signo > 0)
-            {
-              for (kidx=0; kidx < killidx; kidx++)
-                if (killed[kidx].pid == pid
-                    && killed[kidx].signo == signo)
-                  break;
-              if (kidx < killidx)
-                log_info ("signal %d already sent to client %d\n",
+        signo = sl->event_signal;
+
+        if (pid != (pid_t)(-1) && pid && signo > 0)
+          {
+            for (kidx=0; kidx < killidx; kidx++)
+              if (killed[kidx].pid == pid
+                  && killed[kidx].signo == signo)
+                break;
+            if (kidx < killidx)
+              log_info ("signal %d already sent to client %d\n",
+                        signo, (int)pid);
+            else
+              {
+                log_info ("sending signal %d to client %d\n",
                           signo, (int)pid);
-              else
-                {
-                  log_info ("sending signal %d to client %d\n",
-                            signo, (int)pid);
-                  kill (pid, signo);
-                  if (killidx < DIM (killed))
-                    {
-                      killed[killidx].pid = pid;
-                      killed[killidx].signo = signo;
-                      killidx++;
-                    }
-                }
-            }
+                kill (pid, signo);
+                if (killidx < DIM (killed))
+                  {
+                    killed[killidx].pid = pid;
+                    killed[killidx].signo = signo;
+                    killidx++;
+                  }
+              }
+          }
 #endif /*!HAVE_W32_SYSTEM*/
-
-          sl->ctrl_backlink->app_ctx = NULL;
-          sl->card_removed = 1;
-          release_application (app);
-        }
-    }
+      }
 }
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 22b17b4..d0bc98e 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -124,7 +124,7 @@ void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
 void scd_update_reader_status_file (void);
-void send_client_notifications (app_t app);
+void send_client_notifications (app_t app, int removal);
 
 
 #endif /*SCDAEMON_H*/

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c      |   4 +-
 scd/command.c  | 124 +++++++++++++++++++++++++++++++--------------------------
 scd/scdaemon.h |   2 +-
 3 files changed, 70 insertions(+), 60 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Dec 30 07:18:58 2016
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 30 Dec 2016 07:18:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-18-g3376904
Message-ID: <E1cMqWq-0006Uq-D0@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  337690441fcb19343fe56b139f5649bed7d25c83 (commit)
      from  f300e12a793d59deb1a369713384eaabfa39b3e6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 337690441fcb19343fe56b139f5649bed7d25c83
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Dec 30 15:17:50 2016 +0900

    scd: Fix select_application.
    
    * scd/app.c (select_application): Fix the condition for open.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app.c b/scd/app.c
index 39910d2..a499724 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -325,11 +325,11 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
 
   *r_app = NULL;
 
-  if (scan
+  if ((scan && !app_top)
       /* FIXME: Here, we can change code to support multiple readers.
          For now, we only open a single reader.
       */
-      && !app_top)
+      || !app_top)
     {
       slot = apdu_open_reader (opt.reader_port);
       if (slot >= 0)
@@ -374,6 +374,8 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
         }
       unlock_app (app);
     }
+  else
+    err = gpg_error (GPG_ERR_ENODEV);
 
   return err;
 }

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org