 @@ -1,16 +1,16 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.63 for netpgp 20090518.
+# Generated by GNU Autoconf 2.63 for netpgp 20090520.
+#
 # Report bugs to <Alistair Crooks <agc@netbsd.org> c0596823>.
+#
 # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
 # 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
 # This configure script is free software; the Free Software Foundation
 # gives unlimited permission to copy, distribute and modify it.
 ## --------------------- ##
 ## M4sh Initialization.  ##
 ## --------------------- ##
 # Be more Bourne compatible
 DUALCASE=1; export DUALCASE # for MKS sh
 @@ -586,28 +586,28 @@ ac_hostname=`(hostname || uname -n) 2>/d
 ac_default_prefix=/usr/local
 ac_clean_files=
 ac_config_libobj_dir=.
 LIBOBJS=
 cross_compiling=no
 subdirs=
 MFLAGS=
 MAKEFLAGS=
 SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='netpgp'
 PACKAGE_TARNAME='netpgp'
-PACKAGE_VERSION='20090518'
+PACKAGE_VERSION='20090520'
-PACKAGE_STRING='netpgp 20090518'
+PACKAGE_STRING='netpgp 20090520'
 PACKAGE_BUGREPORT='Alistair Crooks <agc@netbsd.org> c0596823'
 ac_unique_file="src/bin/netpgp.c"
 # Factoring default headers for most tests.
 ac_includes_default="\
 #include <stdio.h>
 #ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
 #ifdef HAVE_SYS_STAT_H
 # include <sys/stat.h>
 #endif
 #ifdef STDC_HEADERS
 @@ -1258,27 +1258,27 @@ for ac_var in $ac_precious_vars; do
   eval ac_env_${ac_var}_set=\${${ac_var}+set}
   eval ac_env_${ac_var}_value=\$${ac_var}
   eval ac_cv_env_${ac_var}_set=\${${ac_var}+set}
   eval ac_cv_env_${ac_var}_value=\$${ac_var}
 done
+#
 # Report the --help message.
+#
 if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures netpgp 20090518 to adapt to many kinds of systems.
+\`configure' configures netpgp 20090520 to adapt to many kinds of systems.
 Usage: $0 [OPTION]... [VAR=VALUE]...
 To assign environment variables (e.g., CC, CFLAGS...), specify them as
 VAR=VALUE.  See below for descriptions of some of the useful variables.
 Defaults for the options are specified in brackets.
 Configuration:
   -h, --help              display this help and exit
       --help=short        display options specific to this package
       --help=recursive    display the short help of all the included packages
   -V, --version           display version information and exit
 @@ -1328,27 +1328,27 @@ _ACEOF
 Program names:
   --program-prefix=PREFIX            prepend PREFIX to installed program names
   --program-suffix=SUFFIX            append SUFFIX to installed program names
   --program-transform-name=PROGRAM   run sed PROGRAM on installed program names
 System types:
   --build=BUILD     configure for building on BUILD [guessed]
   --host=HOST       cross-compile to build programs to run on HOST [BUILD]
 _ACEOF
 fi
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of netpgp 20090518:";;
+     short | recursive ) echo "Configuration of netpgp 20090520:";;
    esac
   cat <<\_ACEOF
 Some influential environment variables:
   CC          C compiler command
   CFLAGS      C compiler flags
   LDFLAGS     linker flags, e.g. -L<lib dir> if you have libraries in a
               nonstandard directory <lib dir>
   LIBS        libraries to pass to the linker, e.g. -l<library>
   CPPFLAGS    C/C++/Objective C preprocessor flags, e.g. -I<include dir> if
               you have headers in a nonstandard directory <include dir>
   CPP         C preprocessor
 @@ -1408,41 +1408,41 @@ ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_
     elif test -f "$ac_srcdir/configure"; then
       echo &&
       $SHELL "$ac_srcdir/configure" --help=recursive
     else
       $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2
     fi || ac_status=$?
     cd "$ac_pwd" || { ac_status=$?; break; }
   done
 fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-netpgp configure 20090518
+netpgp configure 20090520
 generated by GNU Autoconf 2.63
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
 , 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
 _ACEOF
   exit
 fi
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
-It was created by netpgp $as_me 20090518, which was
+It was created by netpgp $as_me 20090520, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
   $ $0 $@
 _ACEOF
 exec 5>>config.log
+{
 cat <<_ASUNAME
 ## --------- ##
 ## Platform. ##
 ## --------- ##
 hostname = `(hostname || uname -n) 2>/dev/null | sed 1q`
 @@ -6151,27 +6151,27 @@ as_executable_p=$as_test_x
 # Sed expression to map a string onto a valid CPP name.
 as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'"
 # Sed expression to map a string onto a valid variable name.
 as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'"
 exec 6>&1
 # Save the log message, to keep $[0] and so on meaningful, and to
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by netpgp $as_me 20090518, which was
+This file was extended by netpgp $as_me 20090520, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
   CONFIG_LINKS    = $CONFIG_LINKS
   CONFIG_COMMANDS = $CONFIG_COMMANDS
   $ $0 $@
 on `(hostname || uname -n) 2>/dev/null | sed 1q`
+"
 _ACEOF
 @@ -6210,27 +6210,27 @@ Usage: $0 [OPTION]... [FILE]...
                    instantiate the configuration header FILE
 Configuration files:
 $config_files
 Configuration headers:
 $config_headers
 Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_version="\\
-netpgp config.status 20090518
+netpgp config.status 20090520
 configured by $0, generated by GNU Autoconf 2.63,
   with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 Copyright (C) 2008 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it."
 ac_pwd='$ac_pwd'
 srcdir='$srcdir'
 INSTALL='$INSTALL'
 AWK='$AWK'
 test -n "\$AWK" || AWK=awk
 _ACEOF

 @@ -1,14 +1,14 @@
-.\" $NetBSD: netpgp.1,v 1.9 2009/05/16 06:30:38 agc Exp $
+.\" $NetBSD: netpgp.1,v 1.10 2009/05/21 00:33:31 agc Exp $
 .\"
 .\" Copyright (c) 2009 The NetBSD Foundation, Inc.
 .\" All rights reserved.
 .\"
 .\" This manual page is derived from software contributed to
 .\" The NetBSD Foundation by Alistair Crooks (agc@NetBSD.org).
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 @@ -17,102 +17,198 @@
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 .\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 .\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 .\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd May 15, 2009
+.Dd May 20, 2009
 .Dt NETPGP 1
 .Os
 .Sh NAME
 .Nm netpgp
 .Nd signing, verification, encryption, and decryption utility
 .Sh SYNOPSIS
-.Nm netpgp
+.Nm
-.Op Fl Fl armour
+.Fl Fl encrypt
-.Op Fl Fl clearsign
+.Op options
-.Op Fl Fl decrypt
+.Ar file ...
-.Op Fl Fl detached
+.Nm
-.Op Fl Fl encrypt
+.Fl Fl decrypt
-.Op Fl Fl export-key
+.Op options
-.Op Fl Fl find-key
+.Ar file ...
-.Op Fl Fl generate-key
+.sp
-.Op Fl Fl hash-alg Ns = Ns Ar hash-algorithm
+.Nm
 .Fl Fl sign
 .Op Fl Fl armor
 .Op Fl Fl detach
 .Op Fl Fl hash Ns = Ns Ar algorithm
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl verify
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl cat
 .Op Fl Fl output Ns = Ns Ar filename
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl clearsign
 .Op options
 .Ar file ...
 .sp
 .Nm
 .Fl Fl export-key ,
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl find-key
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl generate-key
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl import-key
 .Op options
 .Ar file ...
 .Nm
 .Fl Fl list-keys
 .Op options
 .Ar file ...
 .sp
 .Nm
 .Fl Fl list-packets
 .Nm
 .Fl Fl version
 .sp
 where the options for all commands are:
 .sp
 .Op Fl Fl homedir Ns = Ns Ar home-directory
-.Op Fl Fl import-key
+.br
 .Op Fl Fl keyring Ns = Ns Ar keyring
-.Op Fl Fl list-keys
+.br
 .Op Fl Fl list-packets
 .Op Fl Fl numbits Ns = Ns Ar numbits
 .Op Fl Fl sign
 .Op Fl Fl userid Ns = Ns Ar userid
 .br
 .Op Fl Fl verbose
 .Op Fl Fl verify
 .Op Fl Fl version
 .Ar file ...
 .Sh DESCRIPTION
 The
 .Nm
 command can digitally sign files and verify that the signatures
 attached to files were signed by a given user identifier.
 .Nm
 can also encrypt files using the public or private keys of
 users and, in the same manner, decrypt files which were encrypted.
 .Pp
 For signing and encryption, a unique identity is needed.
 This identity is made up of a private and public key.
 The public key part is made available and known to everyone.
 The private key is kept secret, and known only to the user
 who created the identity.
 The secret key is protected with a passphrase.
 .Pp
 In rough terms, a digital signature
 is a digest of a file's contents,
 encrypted with the user's private key.
 Since together, the private and public keys identify the user
 uniquely, the signature can be used to identify the exact version
 of the file, and any changes made to the file will mean that the
 signature no longer matches.
 .Pp
 As a corollary, the file can be transformed using a user's public key,
 into text such that the contents can only be viewed by someone
 with the corresponding private key. This is called encryption.
 .Pp
 The
 .Nm
 utility can also be used to generate a new key-pair for a user.
-This key is in two parts, the public key (which can be
+As mentioned before,
-used by other people) and a private key.
+this key is in two parts, the public key (which is known
 by other people) and the private key.
 .Pp
 In addition to these primary uses, the third way of using
 .Nm
 is to maintain keyrings.
 Key and keyring management commands available are:
 .Fl Fl export-key ,
 .Fl Fl find-key ,
 .Fl Fl generate-key ,
 .Fl Fl import-key , and
 .Fl Fl list-keys .
 Keyrings are collections of public keys belonging to other users.
 By using other means of identification, it is possible to establish
 the bona fides of other users.
 Once trust has been established, the public key of the other
 user will be signed.
 The other user's public key can be added to our keyring.
 The other user will add our public key to their keyring.
 .Pp
 Keys can be listed, exported (i.e. made available to others),
 and imported (i.e. users who have signed our public key).
 .Pp
-One of the following commands must be present:
+The
 .Fl Fl list-packets
 command can be used for debugging purposes.
 .Pp
 The following commands are used to sign and verify signatures:
 .Bl -tag -width Ar
 .It Fl Fl cat
 The signature of the signed file named on the command line
 is verified against the contents of the file itself.
 If the two match, then the original contents
 are sent to standard out.
 If the signature does not match, no output is generated.
 .It Fl Fl clearsign
 The signature of the file named on the command line is calculated
 in the same manner as the
 .Fl Fl sign
 command, but the text is added to the file such that
 the text itself is not in binary format, but can be read by mere mortals.
 .It Fl Fl sign
 The private key is used to digitally sign the files named on the
 command line.
 The file and its attached signature are created with a
 .Dq Pa .gpg
 extension to the original file name.
 The user will be prompted for their pass phrase using
 .Xr getpass 3 .
 .It Fl Fl verify
 For each of the files named on the command line, the signature of the file
 is verified, checking the contents against the user's public signature.
 .El
 .Pp
 The following commands can be used to encrypt and decrypt files:
 .Bl -tag -width Ar
 .It Fl Fl decrypt
 Decrypt the file using the user's private key.
 The pass phrase will be optained by prompting the user
 to type it in, using
 .Xr getpass 3 .
 .It Fl Fl detached
 when signing a file, place the resulting signature in a separate
 file from the one being signed.
 .It Fl Fl encrypt
 Use the user's public key to encrypt the files named on the command line.
 .El
 .Pp
 In addition, key and keyring management can be done with the
 following commands:
 .Bl -tag -width Ar
 .It Fl Fl export-key
 Display the current public key in a format suitable for export.
 This can be used to place the keyring on one of the
 public key servers, for example.
 .It Fl Fl find-key
 Find the appropriate public key from the current keyring.
 If no keyring is provided, the user's public keyring is used.
 .It Fl Fl generate-key
 This command is used to generate a new public and private key pair.
 The user id is taken from the command line, and the user will be
 prompted to provide a suitable pass phrase.
 .It Fl Fl import-key
 Import a public key as retrieved from one of the public key servers.
 @@ -120,56 +216,41 @@ This is in the form of a file which has
 retrieved from elsewhere.
 .It Fl Fl list-keys
 List all the public keys in the current keyring.
 If no keyring is provided, the user's public keyring is used.
 .It Fl Fl list-packets
 List all the
 .Dq packets
 in an encrypted or signed file.
 Internally,
 .Nm
 splits an encrypted or signed file into separate packets, and
 this option is used to give a verbose representation
 of these packets on standard output.
 .It Fl Fl sign
 The private key is used to digitally sign the files named on the
 command line.
 Extra text is added to the file.
 In rough terms, this text is a digest of the file's contents,
 encrypted with the user's private key.
 Since together, the private and public keys identify the user
 uniquely, the added text can be used to identify the exact version
 of the file, and any changes made to the file will mean that the
 signature no longer matches.
 The file and its attached signature are created with a
 .Dq Pa .gpg
 extension to the original file name.
 The user will be prompted for their pass phrase using
 .Xr getpass 3 .
 .It Fl Fl verify
 For each of the files named on the command line, the signature of the file
 is verified, checking the contents against the user's public signature.
 .It Fl Fl version
 Print the version information from the
 .Xr libnetpgp 3
 library.
 .El
 .Pp
 In addition to one of the preceding commands, a number of qualifiers
 or options may be given.
 .Bl -tag -width Ar
 .It Fl Fl armour , Fl armor
 This option, however it is spelled, wraps the signature as an
 ASCII-encoded piece of text, for ease of use.
 .It Fl Fl detached
 when signing a file, place the resulting signature in a separate
 file from the one being signed.
 .It Fl Fl hash-alg Ar hash-algorithm
 can be used to specify the hash algorithm (sometimes called
 a digest algorithm) which is used with RSA keys when signing
 text.
 The default hash algorithm is the
 .Dq SHA256
 algorithm.
 At the present time,
 .Dq SHA1
 may also be used, although it is recommended that
 SHA256 be used, due to recent advances in generating
 collisions for the SHA1 hashing algorithm.
 .It Fl Fl homedir Ar home-directory
 @@ -179,26 +260,33 @@ the user's home directory in a subdirect
 and this option specifies an alternative location in which to
 find that sub-directory.
 .It Fl Fl keyring Ar keyring
 This option specifies an alternative keyring to be used.
 All keyring operations will be relative to this alternative keyring.
 .It Fl Fl numbits Ar numbits
 specifies the number of bits to be used when generating a key.
 The default number of bits is 2048.
 This is considered the absolute
 minimum which should be chosen at the time of writing (2009).
 Due to advances in computing power every year, this number should
 be reviewed, and increased when it becomes easier to factor 2048
 bit numbers.
 .It Fl Fl output
 specifies a filename to which verified otuput from a signed file
 may be redirected.
 The default is to send the verified output to stdout,
 and this may also be specified using the
 .Dq -
 value.
 .It Fl Fl userid Ar userid
 This option specifies the user identity to be used for all operations.
 This identity can either be in the form of the full name, or as an
 email address.
 Care should be exercised with these ways of specifying the user identity,
 since the
 .Nm
 utility has no way of verifying that an email address is valid, or
 that a key belongs to a certain individual.
 The trust for a signed key is given by the other signers of that key.
 The 16 hexadecimal digit user identity should be used when specifying
 user identities - email addresses and names are provided as aliases.
 .It Fl Fl verbose
 @@ -223,30 +311,26 @@ needed,
 such as during signing or encryption, or key generation,
 so that any secret information cannot be viewed by other users
 using the
 .Xr ps 1
 or
 .Xr top 1
 commands, or by looking over the shoulder at the screen.
 .Pp
 Since the public and private key pair can be used to verify
 a person's identity, and since identity theft can have
 far-reaching consequences, users are strongly encouraged to
 enter their pass phrases only when prompted by the application.
 .Pp
 The
 .Fl Fl passphrase
 option is deprecated, and will be removed in future versions
 of the tool.
 .Sh SIGNING AND VERIFICATION
 Signing and verification of a file is best viewed using the following example:
 .Bd -literal
 % netpgp --sign --userid=agc@netbsd.org a
 pub 2048/RSA (Encrypt or Sign) 1b68dcfcc0596823 2004-01-12
 Key fingerprint: d415 9deb 336d e4cc cdfa 00cd 1b68 dcfc c059 6823
 uid              Alistair Crooks \*[Lt]agc@netbsd.org\*[Gt]
 uid              Alistair Crooks \*[Lt]agc@pkgsrc.org\*[Gt]
 uid              Alistair Crooks \*[Lt]agc@alistaircrooks.com\*[Gt]
 uid              Alistair Crooks \*[Lt]alistair@hockley-crooks.com\*[Gt]
 netpgp passphrase:
 % netpgp --verify a.gpg
 Good signature for a.gpg made Thu Jan 29 03:06:00 2009
 @@ -264,26 +348,51 @@ In the example above, a signature is mad
 .Dq a
 using a user identity corresponding to
 .Dq agc@netbsd.org
 The key located for the user identity is displayed, and
 the user is prompted to type in their passphrase.
 The resulting file, called
 .Dq a.gpg
 is placed in the same directory.
 The second part of the example shows a verification of the signed file
 taking place.
 The time and user identity of the signatory is displayed, followed
 by a fuller description of the public key of the signatory.
 In both cases, the exit value from the utility was a successful one.
 .Pp
 If a detached signature of a file called
 .Dq a
 is requested, the signature would be placed
 in a file called
 .Dq a.sig .
 .Pp
 To encrypt a file, the user's public key is used.
 Subsequent decryption of the file requires that the secret
 key is known.
 When decrypting, the key is displayed,
 and the passphrase protecting
 the secret key must be typed in to access the data in the encrypted file.
 .Bd -literal
 % netpgp --encrypt --userid=c0596823 a
 % netpgp --decrypt a.gpg
 pub 2048/RSA (Encrypt or Sign) 1b68dcfcc0596823 2004-01-12
 Key fingerprint: d415 9deb 336d e4cc cdfa 00cd 1b68 dcfc c059 6823
 uid              Alistair Crooks \*[Lt]agc@netbsd.org\*[Gt]
 uid              Alistair Crooks \*[Lt]agc@pkgsrc.org\*[Gt]
 uid              Alistair Crooks \*[Lt]agc@alistaircrooks.com\*[Gt]
 uid              Alistair Crooks \*[Lt]alistair@hockley-crooks.com\*[Gt]
 netpgp passphrase:
+%
 .Ed
 .Sh RETURN VALUES
 The
 .Nm
 utility will return 0 for success,
 if the file's signature does not match what was expected,
 or 2 if any other error occurs.
 .Sh SEE ALSO
 .Xr getpass 3 ,
 .\" .Xr libbz2 3 ,
 .Xr libnetpgp 3 ,
 .Xr ssl 3 ,
 .Xr zlib 3
 .Sh STANDARDS

 @@ -93,99 +93,105 @@ static const char *usage_clearsign =
 enum optdefs {
 	/* commands */
 	LIST_KEYS = 1,
 	FIND_KEY,
 	EXPORT_KEY,
 	IMPORT_KEY,
 	GENERATE_KEY,
 	ENCRYPT,
 	DECRYPT,
 	SIGN,
 	CLEARSIGN,
 	VERIFY,
-	VERIFY_SHOW,
+	VERIFY_CAT,
 	LIST_PACKETS,
 	VERSION_CMD,
 	HELP_CMD,
 	/* options */
 	KEYRING,
 	USERID,
 	ARMOUR,
 	HOMEDIR,
 	NUMBITS,
 	DETACHED,
 	HASH_ALG,
 	OUTPUT,
 	VERBOSE,
 	/* debug */
 	OPS_DEBUG
 };
 #define EXIT_ERROR	2
 static struct option options[] = {
 	/* commands */
 	{"list-keys",	no_argument,		NULL,	LIST_KEYS},
 	{"find-key",	no_argument,		NULL,	FIND_KEY},
 	{"export-key",	no_argument,		NULL,	EXPORT_KEY},
 	{"import-key",	no_argument,		NULL,	IMPORT_KEY},
 	{"generate-key", no_argument,		NULL,	GENERATE_KEY},
 	{"encrypt",	no_argument,		NULL,	ENCRYPT},
 	{"decrypt",	no_argument,		NULL,	DECRYPT},
 	{"sign",	no_argument,		NULL,	SIGN},
 	{"clearsign",	no_argument,		NULL,	CLEARSIGN},
 	{"verify",	no_argument,		NULL,	VERIFY},
-	{"verify-show",	no_argument,		NULL,	VERIFY_SHOW},
+	{"cat",		no_argument,		NULL,	VERIFY_CAT},
-	{"verifyshow",	no_argument,		NULL,	VERIFY_SHOW},
+	{"vericat",	no_argument,		NULL,	VERIFY_CAT},
 	{"verify-cat",	no_argument,		NULL,	VERIFY_CAT},
 	{"verify-show",	no_argument,		NULL,	VERIFY_CAT},
 	{"verifyshow",	no_argument,		NULL,	VERIFY_CAT},
 	{"list-packets", no_argument,		NULL,	LIST_PACKETS},
 	{"help",	no_argument,		NULL,	HELP_CMD},
 	{"version",	no_argument,		NULL,	VERSION_CMD},
 	/* options */
 	{"keyring",	required_argument, 	NULL,	KEYRING},
 	{"userid",	required_argument, 	NULL,	USERID},
 	{"home",	required_argument, 	NULL,	HOMEDIR},
 	{"homedir",	required_argument, 	NULL,	HOMEDIR},
 	{"armor",	no_argument,		NULL,	ARMOUR},
 	{"armour",	no_argument,		NULL,	ARMOUR},
 	{"numbits",	required_argument, 	NULL,	NUMBITS},
 	{"detach",	no_argument,		NULL,	DETACHED},
 	{"detached",	no_argument,		NULL,	DETACHED},
 	{"hash-alg",	required_argument, 	NULL,	HASH_ALG},
 	{"hash",	required_argument, 	NULL,	HASH_ALG},
 	{"algorithm",	required_argument, 	NULL,	HASH_ALG},
 	{"verbose",	no_argument, 		NULL,	VERBOSE},
 	{"output",	required_argument, 	NULL,	OUTPUT},
 	/* debug */
 	{"debug",	required_argument, 	NULL,	OPS_DEBUG},
 	{ NULL,		0,			NULL,	0},
 };
 /* gather up program variables into one struct */
 typedef struct prog_t {
 	char	 keyring[MAXBUF + 1];		/* name of keyring */
 	char	*userid;			/* user identifier */
 	char	 myring_name[MAXBUF + 1];	/* myring filename */
 	char	 pubring_name[MAXBUF + 1];	/* pubring filename */
 	char	 secring_name[MAXBUF + 1];	/* secret ring file */
 	char	*progname;			/* program name */
 	char	*output;			/* output file name */
 	int	 overwrite;			/* overwrite files? */
 	int	 numbits;			/* # of bits */
 	int	 armour;			/* ASCII armor */
 	int	 detached;			/* use separate file */
 	int	 cmd;				/* netpgp command */
 } prog_t;
 /* print a usage message */
 static void
 print_usage(const char *usagemsg, char *progname)
+{
 	(void) fprintf(stderr,
 @@ -214,28 +220,28 @@ netpgp_cmd(netpgp_t *netpgp, prog_t *p,
 	case ENCRYPT:
 		return netpgp_encrypt_file(netpgp, p->userid, f, NULL,
 					p->armour);
 	case DECRYPT:
 		return netpgp_decrypt_file(netpgp, f, NULL, p->armour);
 	case SIGN:
 		return netpgp_sign_file(netpgp, p->userid, f, NULL, p->armour,
 , p->detached);
 	case CLEARSIGN:
 		return netpgp_sign_file(netpgp, p->userid, f, NULL, p->armour,
 , p->detached);
 	case VERIFY:
 		return netpgp_verify_file(netpgp, f, NULL, p->armour);
-	case VERIFY_SHOW:
+	case VERIFY_CAT:
-		return netpgp_verify_file(netpgp, f, "-", p->armour);
+		return netpgp_verify_file(netpgp, f, p->output, p->armour);
 	case LIST_PACKETS:
 		return netpgp_list_packets(netpgp, f, p->armour, NULL);
 	case HELP_CMD:
 	default:
 		print_usage(usage, p->progname);
 		exit(EXIT_SUCCESS);
+	}
+}
 /* get even more lippy */
 static void
 give_it_large(netpgp_t *netpgp)
+{
 @@ -258,52 +264,53 @@ main(int argc, char **argv)
 	prog_t          p;
 	char            homedir[MAXPATHLEN];
 	int             optindex;
 	int             ret;
 	int             ch;
 	int             i;
 	(void) memset(&p, 0x0, sizeof(p));
 	(void) memset(homedir, 0x0, sizeof(homedir));
 	(void) memset(&netpgp, 0x0, sizeof(netpgp));
 	p.progname = argv[0];
 	p.numbits = DEFAULT_NUMBITS;
 	p.overwrite = 1;
 	p.output = strdup("-");	/* default --cat to stdout */
 	if (argc < 2) {
 		print_usage(usage, p.progname);
 		exit(EXIT_ERROR);
+	}
 	netpgp_setvar(&netpgp, "hash", "SHA256");
 	/* set default homedir */
 	(void) snprintf(homedir, sizeof(homedir), "%s/.gnupg", getenv("HOME"));
 	optindex = 0;
 	while ((ch = getopt_long(argc, argv, "", options, &optindex)) != -1) {
 		switch (options[optindex].val) {
 		case LIST_KEYS:
 			p.cmd = options[optindex].val;
 			break;
 		case FIND_KEY:
 		case EXPORT_KEY:
 		case IMPORT_KEY:
 		case GENERATE_KEY:
 		case ENCRYPT:
 		case DECRYPT:
 		case SIGN:
 		case CLEARSIGN:
 		case VERIFY:
-		case VERIFY_SHOW:
+		case VERIFY_CAT:
 		case LIST_PACKETS:
 		case HELP_CMD:
 			p.cmd = options[optindex].val;
 			break;
 		case VERSION_CMD:
 			printf(
 "%s\nAll bug reports, praise and chocolate, please, to:\n%s\n",
 				netpgp_get_info("version"),
 				netpgp_get_info("maintainer"));
 			exit(EXIT_SUCCESS);
 			/* options */
 @@ -358,26 +365,36 @@ main(int argc, char **argv)
+			}
 			p.numbits = atoi(optarg);
 			break;
 		case HASH_ALG:
 			if (optarg == NULL) {
 				(void) fprintf(stderr,
 				"No hash algorithm argument provided\n");
 				exit(EXIT_ERROR);
+			}
 			netpgp_setvar(&netpgp, "hash", optarg);
 			break;
 		case OUTPUT:
 			if (optarg == NULL) {
 				(void) fprintf(stderr,
 				"No output filename argument provided\n");
 				exit(EXIT_ERROR);
+			}
 			(void) free(p.output);
 			p.output = strdup(optarg);
 			break;
 		case OPS_DEBUG:
 			netpgp_set_debug(optarg);
 			break;
 		default:
 			p.cmd = HELP_CMD;
 			break;
+		}
+	}
 	/* initialise, and read keys from file */
 	if (!netpgp_init(&netpgp, p.userid, NULL, NULL)) {
 		printf("can't initialise\n");

 @@ -44,59 +44,67 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: validate.c,v 1.12 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: validate.c,v 1.13 2009/05/21 00:33:32 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <string.h>
 #include <stdio.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 #include "packet-parse.h"
 #include "packet-show.h"
 #include "keyring.h"
 #include "signature.h"
 #include "netpgpsdk.h"
 #include "readerwriter.h"
 #include "netpgpdefs.h"
 #include "memory.h"
 #include "packet.h"
 #include "crypto.h"
 #include "validate.h"
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 /* Does the signed hash match the given hash? */
-static          unsigned
+static unsigned
 check_binary_sig(const unsigned len,
-		       const unsigned char *data,
+		const unsigned char *data,
-		       const __ops_sig_t *sig,
+		const __ops_sig_t *sig,
-		    const __ops_pubkey_t *signer)
+		const __ops_pubkey_t *signer)
+{
 	unsigned char   hashout[OPS_MAX_HASH_SIZE];
 	unsigned char   trailer[6];
 	unsigned int    hashedlen;
 	__ops_hash_t	hash;
 	unsigned	n = 0;
 	__OPS_USED(signer);
 	__ops_hash_any(&hash, sig->info.hash_alg);
 	hash.init(&hash);
 	hash.add(&hash, data, len);
 	switch (sig->info.version) {
 	case OPS_V3:
 @@ -108,31 +116,31 @@ check_binary_sig(const unsigned len,
 		hash.add(&hash, &trailer[0], 5);
 		break;
 	case OPS_V4:
 		hash.add(&hash, sig->info.v4_hashed_data,
 				sig->info.v4_hashed_data_length);
 		trailer[0] = 0x04;	/* version */
 		trailer[1] = 0xFF;
 		hashedlen = sig->info.v4_hashed_data_length;
 		trailer[2] = hashedlen >> 24;
 		trailer[3] = hashedlen >> 16;
 		trailer[4] = hashedlen >> 8;
 		trailer[5] = hashedlen;
-		hash.add(&hash, &trailer[0], 6);
+		hash.add(&hash, trailer, 6);
 		break;
 	default:
-		fprintf(stderr, "Invalid signature version %d\n",
+		(void) fprintf(stderr, "Invalid signature version %d\n",
 				sig->info.version);
 		return 0;
+	}
 	n = hash.finish(&hash, hashout);
 	if (__ops_get_debug_level(__FILE__)) {
 		printf("check_binary_sig: hash length %" PRIsize "u\n",
 			hash.size);
+	}
 	return __ops_check_sig(hashout, n, sig, signer);
+}
 static int
 @@ -235,27 +243,27 @@ __ops_validate_key_cb(const __ops_packet
 	case OPS_PTAG_CT_SECRET_KEY:
 		key->seckey = content->seckey;
 		key->pubkey = key->seckey.pubkey;
 		return OPS_KEEP_MEMORY;
 	case OPS_PTAG_CT_USER_ID:
 		if (key->userid.userid)
 			__ops_userid_free(&key->userid);
 		key->userid = content->userid;
 		key->last_seen = ID;
 		return OPS_KEEP_MEMORY;
-	case OPS_PTAG_CT_USER_ATTRIBUTE:
+	case OPS_PTAG_CT_USER_ATTR:
 		if (content->userattr.data.len == 0) {
 			(void) fprintf(stderr,
 			"__ops_validate_key_cb: user attribute length 0");
 			return OPS_FINISHED;
+		}
 		printf("user attribute, length=%d\n",
 			(int) content->userattr.data.len);
 		if (key->userattr.data.len)
 			__ops_userattr_free(&key->userattr);
 		key->userattr = content->userattr;
 		key->last_seen = ATTRIBUTE;
 		return OPS_KEEP_MEMORY;
 @@ -410,27 +418,27 @@ validate_data_cb(const __ops_packet_t *p
 		if (__ops_get_debug_level(__FILE__)) {
 			unsigned i = 0;
 			printf("\n*** hashed data:\n");
 			for (i = 0;
 			     i < content->sig.info.v4_hashed_data_length;
 			     i++) {
 				printf("0x%02x ",
 				content->sig.info.v4_hashed_data[i]);
+			}
 			printf("\n");
 			printf("  type=%02x signer_id=",
 				content->sig.info.type);
-			hexdump(content->sig.info.signer_id,
+			hexdump(stdout, content->sig.info.signer_id,
 				sizeof(content->sig.info.signer_id), "");
 			printf("\n");
+		}
 		signer = __ops_keyring_find_key_by_id(data->keyring,
 					 content->sig.info.signer_id);
 		if (!signer) {
 			OPS_ERROR(errors, OPS_E_V_UNKNOWN_SIGNER,
 					"Unknown Signer");
 			add_sig_to_list(&content->sig.info,
 					&data->result->unknown_sigs,
 					&data->result->unknownc);
 			break;
+		}
 @@ -451,47 +459,45 @@ validate_data_cb(const __ops_packet_t *p
 					__ops_mem_data(data->mem),
 					&content->sig,
 					__ops_get_pubkey(signer));
 			break;
 		default:
 			OPS_ERROR_1(errors, OPS_E_UNIMPLEMENTED,
 				    "No Sig Verification type 0x%02x yet\n",
 				    content->sig.info.type);
 			break;
+		}
 		__ops_memory_free(data->mem);
 		if (valid) {
 			add_sig_to_list(&content->sig.info,
 					&data->result->valid_sigs,
 					&data->result->validc);
 		} else {
 			OPS_ERROR(errors, OPS_E_V_BAD_SIGNATURE,
 					"Bad Signature");
 			add_sig_to_list(&content->sig.info,
 					&data->result->invalid_sigs,
 					&data->result->invalidc);
+		}
 		break;
 		/* ignore these */
 	case OPS_PARSER_PTAG:
 	case OPS_PTAG_CT_SIGNATURE_HEADER:
 	case OPS_PTAG_CT_ARMOUR_HEADER:
 	case OPS_PTAG_CT_ARMOUR_TRAILER:
-	case OPS_PTAG_CT_ONE_PASS_SIGNATURE:
+	case OPS_PTAG_CT_1_PASS_SIG:
 		break;
 	case OPS_PARSER_PACKET_END:
 		break;
 	default:
 		OPS_ERROR(errors, OPS_E_V_NO_SIGNATURE, "No signature");
 		break;
+	}
 	return OPS_RELEASE_MEMORY;
+}
 static void
 @@ -639,28 +645,28 @@ __ops_validate_result_free(__ops_validat
    \note It is the caller's responsiblity to call
    	__ops_validate_result_free(result) after use.
 */
 unsigned
 __ops_validate_file(__ops_validation_t *result,
 			const char *infile,
 			const char *outfile,
 			const int armoured,
 			const __ops_keyring_t *keyring)
+{
 	validate_data_cb_t	 validation;
 	__ops_parseinfo_t	*parse = NULL;
 	struct stat		 st;
 	unsigned		 ret;
 	int64_t		 	 sigsize;
 	char			*filename;
 	char			 origfile[MAXPATHLEN];
 	char			*detachname;
 	int			 outfd = 0;
 	int			 infd;
 	int			 cc;
 #define SIG_OVERHEAD	284 /* XXX - depends on sig size? */
 	if (stat(infile, &st) < 0) {
 		(void) fprintf(stderr, "can't validate \"%s\"\n", infile);
 		return 0;
+	}
 	sigsize = st.st_size;
 @@ -674,62 +680,86 @@ __ops_validate_file(__ops_validation_t *
+		}
+	}
 	(void) memset(&validation, 0x0, sizeof(validation));
 	infd = __ops_setup_file_read(&parse, infile, &validation,
 				validate_data_cb, 1);
 	if (infd < 0) {
 		return 0;
+	}
 	validation.detachname = detachname;
 	/* setup output filename */
 	filename = NULL;
 	if (outfile) {
 		if (strcmp(outfile, "-") == 0) {
 			outfile = NULL;
 		outfd = __ops_setup_file_write(&parse->cbinfo.output, NULL, 0);
 		if (outfd < 0) {
 			__ops_teardown_file_read(parse, infd);
 			return 0;
 	/* Set verification reader and handling options */
 	validation.result = result;
 	validation.keyring = keyring;
 	validation.mem = __ops_memory_new();
 	__ops_memory_init(validation.mem, 128);
 	/* Note: Coverity incorrectly reports an error that validation.reader */
 	/* is never used. */
 	validation.reader = parse->readinfo.arg;
 	if (armoured) {
 		__ops_reader_push_dearmour(parse);
+	}
 	/* Do the verification */
 	__ops_parse(parse, 0);
 	/* Tidy up */
 	if (armoured) {
 		__ops_reader_pop_dearmour(parse);
+	}
 	__ops_teardown_file_read(parse, infd);
-	return validate_result_status(result);
+	ret = validate_result_status(result);
 	/* this is triggered only for --cat output */
 	if (outfile) {
 		/* need to send validated output somewhere */
 		if (strcmp(outfile, "-") == 0) {
 			outfd = STDOUT_FILENO;
 		} else {
 			outfd = open(outfile, O_WRONLY | O_CREAT, 0666);
+		}
 		if (outfd < 0) {
 			/* even if the signature was good, we can't
 			* write the file, so send back a bad return
 			* code */
 			ret = 0;
 		} else if (validate_result_status(result)) {
 			unsigned	 len;
 			char		*cp;
 			int		 i;
 			len = __ops_mem_len(validation.mem);
 			cp = __ops_mem_data(validation.mem);
 			for (i = 0 ; i < (int)len ; i += cc) {
 				cc = write(outfd, &cp[i], len - i);
 				if (cc < 0) {
 					(void) fprintf(stderr,
 						"netpgp: short write\n");
 					ret = 0;
 					break;
+				}
+			}
 			if (strcmp(outfile, "-") != 0) {
 				(void) close(outfd);
+			}
+		}
+	}
 	__ops_memory_free(validation.mem);
 	return ret;
+}
 /**
    \ingroup HighLevel_Verify
    \brief Verifies the signatures in a __ops_memory_t struct
    \param result Where to put the result
    \param mem Memory to be validated
    \param armoured Treat data as armoured, if set
    \param keyring Keyring to use
    \return 1 if signature validates successfully; 0 if not
    \note After verification, result holds the details of all keys which
    have passed, failed and not been recognised.
    \note It is the caller's responsiblity to call
 @@ -759,16 +789,17 @@ __ops_validate_mem(__ops_validation_t *r
 	if (armoured) {
 		__ops_reader_push_dearmour(pinfo);
+	}
 	/* Do the verification */
 	__ops_parse(pinfo, 0);
 	/* Tidy up */
 	if (armoured) {
 		__ops_reader_pop_dearmour(pinfo);
+	}
 	__ops_teardown_memory_read(pinfo, mem);
 	__ops_memory_free(validation.mem);
 	return validate_result_status(result);
+}

 @@ -48,27 +48,27 @@
  */
 /*
  * ! \file \brief Standard API print functions
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: packet-print.c,v 1.11 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: packet-print.c,v 1.12 2009/05/21 00:33:31 agc Exp $");
 #endif
 #include <string.h>
 #include <stdio.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 #include "crypto.h"
 #include "keyring.h"
 #include "packet-show.h"
 #include "signature.h"
 @@ -141,52 +141,42 @@ showtime(const char *name, time_t t)
 	printf("%s=%" PRItime "d (%.24s)", name, (long long) t, ctime(&t));
+}
 static void
 print_time(const char *name, time_t t)
+{
 	print_indent();
 	printf("%s: ", name);
 	showtime("time", t);
 	printf("\n");
+}
 static void
-showtime_short(time_t t)
+print_time_short(FILE *fp, time_t t)
+{
 	struct tm      *tm;
 	tm = gmtime(&t);
-	printf("%04d-%02d-%02d",
+	(void) fprintf(fp, "%04d-%02d-%02d",
 		tm->tm_year + 1900,
 		tm->tm_mon + 1,
 		tm->tm_mday);
+}
 static void
-print_time_short(time_t t)
+print_string_and_value(const char *name, const char *str, unsigned char value)
 	showtime_short(t);
 static void
 print_string_and_value(const char *name, const char *str,
 		       unsigned char value)
+{
 	print_name(name);
 	printf("%s (0x%x)\n", str, value);
 	printf("%s", str);
 	printf(" (0x%x)", value);
 	printf("\n");
+}
 static void
 print_tagname(const char *str)
+{
 	print_indent();
 	printf("%s packet\n", str);
+}
 static void
 print_data(const char *name, const __ops_data_t * data)
+{
 	print_hexdump(name, data->contents, data->len);
 @@ -209,27 +199,27 @@ print_bn(const char *name, const BIGNUM
 static void
 print_packet_hex(const __ops_subpacket_t *pkt)
+{
 	unsigned char  *cur;
 	unsigned	rem;
 	unsigned	blksz = 4;
 	int             i;
 	printf("\nhexdump of packet contents follows:\n");
 	for (i = 1, cur = pkt->raw;
 	     cur < (pkt->raw + pkt->length);
 	     cur += blksz, i++) {
 		rem = pkt->raw + pkt->length - cur;
-		hexdump(cur, (rem <= blksz) ? rem : blksz, "");
+		hexdump(stdout, cur, (rem <= blksz) ? rem : blksz, "");
 		printf(" ");
 		if (i % 8 == 0) {
 			printf("\n");
+		}
+	}
 	printf("\n");
+}
 static void
 print_escaped(const unsigned char *data, size_t length)
+{
 	while (length-- > 0) {
 @@ -384,42 +374,42 @@ numkeybits(const __ops_pubkey_t *pubkey)
 	default:
 		return -1;
+	}
+}
 /**
    \ingroup Core_Print
    Prints a public key in succinct detail
    \param key Ptr to public key
 */
 void
-__ops_print_pubkeydata(const __ops_keydata_t * key)
+__ops_print_pubkeydata(FILE *fp, const __ops_keydata_t * key)
+{
 	unsigned int    i;
-	printf("pub %d/%s ",
+	(void) fprintf(fp, "pub %d/%s ",
 		numkeybits(&key->key.pubkey),
 		__ops_show_pka(key->key.pubkey.alg));
-	hexdump(key->key_id, OPS_KEY_ID_SIZE, "");
+	hexdump(fp, key->key_id, OPS_KEY_ID_SIZE, "");
-	printf(" ");
+	(void) fprintf(fp, " ");
-	print_time_short(key->key.pubkey.birthtime);
+	print_time_short(fp, key->key.pubkey.birthtime);
-	printf("\nKey fingerprint: ");
+	(void) fprintf(fp, "\nKey fingerprint: ");
-	hexdump(key->fingerprint.fingerprint, 20, " ");
+	hexdump(fp, key->fingerprint.fingerprint, 20, " ");
-	printf("\n");
+	(void) fprintf(fp, "\n");
 	for (i = 0; i < key->nuids; i++) {
-		printf("uid              %s\n", key->uids[i].userid);
+		(void) fprintf(fp, "uid              %s\n",
 			key->uids[i].userid);
+	}
+}
 /**
 \ingroup Core_Print
 \param pubkey
 */
 void
 __ops_print_pubkey(const __ops_pubkey_t * pubkey)
+{
 	printf("------- PUBLIC KEY ------\n");
 	print_unsigned_int("Version", (unsigned)pubkey->version);
 	print_time("Creation Time", pubkey->birthtime);
 @@ -464,30 +454,30 @@ __ops_print_pubkey(const __ops_pubkey_t
    Prints a secret key
    \param key Ptr to public key
 */
 void
 __ops_print_seckeydata(const __ops_keydata_t * key)
+{
 	printf("sec ");
 	__ops_show_pka(key->key.pubkey.alg);
 	printf(" ");
-	hexdump(key->key_id, OPS_KEY_ID_SIZE, "");
+	hexdump(stdout, key->key_id, OPS_KEY_ID_SIZE, "");
 	printf(" ");
-	print_time_short(key->key.pubkey.birthtime);
+	print_time_short(stdout, key->key.pubkey.birthtime);
 	printf(" ");
 	if (key->nuids == 1) {
 		/* print on same line as other info */
 		printf("%s\n", key->uids[0].userid);
 	} else {
 		/* print all uids on separate line  */
 		unsigned int    i;
 		printf("\n");
 		for (i = 0; i < key->nuids; i++) {
 			printf("uid              %s\n", key->uids[i].userid);
+		}
+	}
 @@ -588,27 +578,27 @@ __ops_print_pk_sesskey(__ops_content_tag
 		       __ops_show_symm_alg(key->symm_alg));
 		print_hexdump("Key", key->key, __ops_key_size(key->symm_alg));
 		printf("Checksum: %04x\n", key->checksum);
+	}
+}
 static void
 start_subpacket(int type)
+{
 	indent++;
 	print_indent();
 	printf("-- %s (type 0x%02x)\n",
 	       __ops_show_ss_type(type),
-	       type - OPS_PTAG_SIGNATURE_SUBPACKET_BASE);
+	       type - OPS_PTAG_SIG_SUBPKT_BASE);
+}
 static void
 end_subpacket(void)
+{
 	indent--;
+}
 /**
 \ingroup Core_Print
 \param contents
 */
 int
 @@ -666,27 +656,27 @@ __ops_print_packet(const __ops_packet_t
 	case OPS_PTAG_CT_SE_IP_DATA_HEADER:
 		print_tagname(
 			"SYMMETRIC ENCRYPTED INTEGRITY PROTECTED DATA HEADER");
 		printf("Version: %d\n", content->se_ip_data_header.version);
 		break;
 	case OPS_PTAG_CT_SE_IP_DATA_BODY:
 		print_tagname(
 			"SYMMETRIC ENCRYPTED INTEGRITY PROTECTED DATA BODY");
 		printf("  data body length=%d\n",
 		       content->se_data_body.length);
 		printf("    data=");
-		hexdump(content->se_data_body.data,
+		hexdump(stdout, content->se_data_body.data,
 			content->se_data_body.length, "");
 		printf("\n");
 		break;
 	case OPS_PTAG_CT_PUBLIC_KEY:
 	case OPS_PTAG_CT_PUBLIC_SUBKEY:
 		print_tagname((pkt->tag == OPS_PTAG_CT_PUBLIC_KEY) ?
 			"PUBLIC KEY" :
 			"PUBLIC SUBKEY");
 		__ops_print_pubkey(&content->pubkey);
 		break;
 	case OPS_PTAG_CT_TRUST:
 @@ -756,83 +746,83 @@ __ops_print_packet(const __ops_packet_t
+		}
 		if (content->sig.hash)
 			printf("data hash is set\n");
 		break;
 	case OPS_PTAG_CT_COMPRESSED:
 		print_tagname("COMPRESSED");
 		print_unsigned_int("Compressed Data Type",
 			(unsigned)content->compressed.type);
 		break;
-	case OPS_PTAG_CT_ONE_PASS_SIGNATURE:
+	case OPS_PTAG_CT_1_PASS_SIG:
 		print_tagname("ONE PASS SIGNATURE");
 		print_unsigned_int("Version",
 			(unsigned)content->one_pass_sig.version);
 		print_string_and_value("Signature Type",
 		    __ops_show_sig_type(content->one_pass_sig.sig_type),
 				       content->one_pass_sig.sig_type);
 		print_string_and_value("Hash Algorithm",
 			__ops_show_hash_alg(content->one_pass_sig.hash_alg),
 			content->one_pass_sig.hash_alg);
 		print_string_and_value("Public Key Algorithm",
 			__ops_show_pka(content->one_pass_sig.key_alg),
 			content->one_pass_sig.key_alg);
 		print_hexdump_data("Signer ID",
 				   content->one_pass_sig.keyid,
 				   sizeof(content->one_pass_sig.keyid));
 		print_unsigned_int("Nested",
 				   content->one_pass_sig.nested);
 		break;
-	case OPS_PTAG_CT_USER_ATTRIBUTE:
+	case OPS_PTAG_CT_USER_ATTR:
 		print_tagname("USER ATTRIBUTE");
 		print_hexdump("User Attribute",
 			      content->userattr.data.contents,
 			      content->userattr.data.len);
 		break;
 	case OPS_PTAG_RAW_SS:
 		if (pkt->critical) {
 			(void) fprintf(stderr, "contents are critical\n");
 			return 0;
+		}
 		start_subpacket(pkt->tag);
 		print_unsigned_int("Raw Signature Subpacket: tag",
 			(unsigned)(content->ss_raw.tag -
-		   	OPS_PTAG_SIGNATURE_SUBPACKET_BASE));
+		   	OPS_PTAG_SIG_SUBPKT_BASE));
 		print_hexdump("Raw Data",
 			      content->ss_raw.raw,
 			      content->ss_raw.length);
 		break;
 	case OPS_PTAG_SS_CREATION_TIME:
 		start_subpacket(pkt->tag);
 		print_time("Signature Creation Time", content->ss_time.time);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_EXPIRATION_TIME:
 		start_subpacket(pkt->tag);
 		print_duration("Signature Expiration Time",
 			content->ss_time.time);
 		end_subpacket();
 		break;
-	case OPS_PTAG_SS_KEY_EXPIRATION_TIME:
+	case OPS_PTAG_SS_KEY_EXPIRY:
 		start_subpacket(pkt->tag);
 		print_duration("Key Expiration Time", content->ss_time.time);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_TRUST:
 		start_subpacket(pkt->tag);
 		print_string("Trust Signature", "");
 		print_unsigned_int("Level",
 				   (unsigned)content->ss_trust.level);
 		print_unsigned_int("Amount",
 				   (unsigned)content->ss_trust.amount);
 		end_subpacket();
 @@ -844,27 +834,27 @@ __ops_print_packet(const __ops_packet_t
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_REVOCATION_KEY:
 		start_subpacket(pkt->tag);
 		/* not yet tested */
 		printf("  revocation key: class=0x%x",
 		       content->ss_revocation_key.class);
 		if (content->ss_revocation_key.class & 0x40)
 			printf(" (sensitive)");
 		printf(", algid=0x%x",
 		       content->ss_revocation_key.algid);
 		printf(", fingerprint=");
-		hexdump(content->ss_revocation_key.fingerprint, 20, "");
+		hexdump(stdout, content->ss_revocation_key.fingerprint, 20, "");
 		printf("\n");
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_ISSUER_KEY_ID:
 		start_subpacket(pkt->tag);
 		print_hexdump("Issuer Key Id",
 			      &content->ss_issuer_key_id.key_id[0],
 			      sizeof(content->ss_issuer_key_id.key_id));
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_PREFERRED_SKA:
 @@ -887,49 +877,49 @@ __ops_print_packet(const __ops_packet_t
 		break;
 	case OPS_PTAG_SS_PREFERRED_HASH:
 		start_subpacket(pkt->tag);
 		print_data("Preferred Hash Algorithms",
 			   &content->ss_hashpref.data);
 		text = __ops_showall_ss_hashpref(content->ss_hashpref);
 		print_text_breakdown(text);
 		__ops_text_free(text);
 		end_subpacket();
 		break;
-	case OPS_PTAG_SS_PREFERRED_COMPRESSION:
+	case OPS_PTAG_SS_PREF_COMPRESS:
 		start_subpacket(pkt->tag);
 		print_data("Preferred Compression Algorithms",
 			   &content->ss_zpref.data);
 		text = __ops_showall_ss_zpref(content->ss_zpref);
 		print_text_breakdown(text);
 		__ops_text_free(text);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_KEY_FLAGS:
 		start_subpacket(pkt->tag);
 		print_data("Key Flags", &content->ss_key_flags.data);
 		text = __ops_showall_ss_key_flags(content->ss_key_flags);
 		print_text_breakdown(text);
 		__ops_text_free(text);
 		end_subpacket();
 		break;
-	case OPS_PTAG_SS_KEY_SERVER_PREFS:
+	case OPS_PTAG_SS_KEYSERV_PREFS:
 		start_subpacket(pkt->tag);
 		print_data("Key Server Preferences",
 			   &content->ss_key_server_prefs.data);
 		text = __ops_show_keyserv_prefs(content->ss_key_server_prefs);
 		print_text_breakdown(text);
 		__ops_text_free(text);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_FEATURES:
 		start_subpacket(pkt->tag);
 @@ -976,27 +966,27 @@ __ops_print_packet(const __ops_packet_t
 	case OPS_PTAG_SS_POLICY_URI:
 		start_subpacket(pkt->tag);
 		print_string("Policy URL", content->ss_policy.url);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_SIGNERS_USER_ID:
 		start_subpacket(pkt->tag);
 		print_utf8_string("Signer's User ID",
 			content->ss_signer.userid);
 		end_subpacket();
 		break;
-	case OPS_PTAG_SS_PREFERRED_KEY_SERVER:
+	case OPS_PTAG_SS_PREF_KEYSERV:
 		start_subpacket(pkt->tag);
 		print_string("Preferred Key Server", content->ss_keyserv.name);
 		end_subpacket();
 		break;
 	case OPS_PTAG_SS_EMBEDDED_SIGNATURE:
 		start_subpacket(pkt->tag);
 		end_subpacket();/* \todo print out contents? */
 		break;
 	case OPS_PTAG_SS_USERDEFINED00:
 	case OPS_PTAG_SS_USERDEFINED01:
 	case OPS_PTAG_SS_USERDEFINED02:

 @@ -47,27 +47,27 @@
  * limitations under the License.
  */
 /** \file
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: misc.c,v 1.10 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: misc.c,v 1.11 2009/05/21 00:33:31 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/mman.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 @@ -212,39 +212,39 @@ __ops_parse_and_accumulate(__ops_keyring
 	ret = __ops_parse(parse, 0);
 	keyring->nkeys += 1;
 	return ret;
+}
 static void
 dump_one_keydata(const __ops_keydata_t * key)
+{
 	unsigned        n;
 	printf("Key ID: ");
-	hexdump(key->key_id, OPS_KEY_ID_SIZE, "");
+	hexdump(stdout, key->key_id, OPS_KEY_ID_SIZE, "");
 	printf("\nFingerpint: ");
-	hexdump(key->fingerprint.fingerprint, key->fingerprint.length, "");
+	hexdump(stdout, key->fingerprint.fingerprint, key->fingerprint.length, "");
 	printf("\n\nUIDs\n====\n\n");
 	for (n = 0; n < key->nuids; ++n)
 		printf("%s\n", key->uids[n].userid);
 	printf("\nPackets\n=======\n");
 	for (n = 0; n < key->npackets; ++n) {
 		printf("\n%03d: ", n);
-		hexdump(key->packets[n].raw, key->packets[n].length, "");
+		hexdump(stdout, key->packets[n].raw, key->packets[n].length, "");
+	}
 	printf("\n\n");
+}
 /* XXX: not a maintained part of the API - use __ops_keyring_list() */
 /** __ops_dump_keyring
 */
 void
 __ops_dump_keyring(const __ops_keyring_t * keyring)
+{
 	int             n;
 	for (n = 0; n < keyring->nkeys; ++n) {
 @@ -1039,33 +1039,33 @@ str_from_map_or_null(int type, __ops_map
  * Returns a readable string if found, "Unknown" if not.
  */
 const char     *
 __ops_str_from_map(int type, __ops_map_t *map)
+{
 	const char     *str;
 	str = str_from_map_or_null(type, map);
 	return (str) ? str : "Unknown";
+}
 void
-hexdump(const unsigned char *src, size_t length, const char *sep)
+hexdump(FILE *fp, const unsigned char *src, size_t length, const char *sep)
+{
 	unsigned i;
 	for (i = 0 ; i < length ; i += 2) {
-		printf("%02x", *src++);
+		(void) fprintf(fp, "%02x", *src++);
-		printf("%02x%s", *src++, sep);
+		(void) fprintf(fp, "%02x%s", *src++, sep);
+	}
+}
 /**
  * \ingroup HighLevel_Functions
  * \brief Initialises OpenPGP::SDK. To be called before any other OPS function.
+ *
  * Initialises OpenPGP::SDK and the underlying openssl library.
  */
 void
 __ops_init(void)
+{

 @@ -24,27 +24,27 @@
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: netpgp.c,v 1.14 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: netpgp.c,v 1.15 2009/05/21 00:33:31 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/param.h>
 #include <sys/mman.h>
 #ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
 #endif
 #ifdef HAVE_OPENSSL_CAST_H
 #include <openssl/cast.h>
 @@ -102,27 +102,28 @@ conffile(netpgp_t *netpgp, char *homedir
 	__OPS_USED(netpgp);
 	(void) snprintf(buf, sizeof(buf), "%s/.gnupg/gpg.conf", homedir);
 	if ((fp = fopen(buf, "r")) == NULL) {
 		return 0;
+	}
 	(void) memset(&keyre, 0x0, sizeof(keyre));
 	(void) regcomp(&keyre, "^[ \t]*default-key[ \t]+([0-9a-zA-F]+)",
 		REG_EXTENDED);
 	while (fgets(buf, sizeof(buf), fp) != NULL) {
 		if (regexec(&keyre, buf, 10, matchv, 0) == 0) {
 			(void) memcpy(userid, &buf[(int)matchv[1].rm_so],
 				MIN((unsigned)(matchv[1].rm_eo -
 						matchv[1].rm_so), length));
-			printf("netpgp: default key set to \"%.*s\"\n",
+			(void) fprintf(stderr,
 				"netpgp: default key set to \"%.*s\"\n",
 				(int)(matchv[1].rm_eo - matchv[1].rm_so),
 				&buf[(int)matchv[1].rm_so]);
+		}
+	}
 	(void) fclose(fp);
 	return 1;
+}
 /* wrapper to get a pass phrase from the user */
 static void
 get_pass_phrase(char *phrase, size_t size)
+{
 	char           *p;
 @@ -154,27 +155,27 @@ psuccess(FILE *fp, char *f, __ops_valida
 	const __ops_keydata_t	*pubkey;
 	unsigned		 i;
 	char			 id[MAX_ID_LENGTH + 1];
 	for (i = 0; i < res->validc; i++) {
 		(void) fprintf(fp,
 			"Good signature for %s made %susing %s key %s\n",
 			f,
 			ctime(&res->valid_sigs[i].birthtime),
 			__ops_show_pka(res->valid_sigs[i].key_alg),
 			userid_to_id(res->valid_sigs[i].signer_id, id));
 		pubkey = __ops_keyring_find_key_by_id(pubring,
 			(const unsigned char *) res->valid_sigs[i].signer_id);
-		__ops_print_pubkeydata(pubkey);
+		__ops_print_pubkeydata(fp, pubkey);
+	}
+}
 /***************************************************************************/
 /* exported functions start here */
 /***************************************************************************/
 /* initialise a netpgp_t structure */
 int
 netpgp_init(netpgp_t *netpgp, char *userid, char *fpubring, char *fsecring)
+{
 	__ops_keyring_t	*keyring;
 	char		*homedir;
 @@ -394,27 +395,27 @@ netpgp_sign_file(netpgp_t *netpgp, char
 	if (userid == NULL) {
 		userid = netpgp->userid;
+	}
 	/* get key with which to sign */
 	keypair = __ops_find_key_by_userid(netpgp->secring, userid);
 	if (keypair == NULL) {
 		(void) fprintf(stderr, "Userid '%s' not found in keyring\n",
 				userid);
 		return 0;
+	}
 	do {
 		/* print out the user id */
-		__ops_print_pubkeydata(keypair);
+		__ops_print_pubkeydata(stderr, keypair);
 		/* get the passphrase */
 		get_pass_phrase(passphrase, sizeof(passphrase));
 		/* now decrypt key */
 		seckey = __ops_decrypt_seckey(keypair, passphrase);
 		if (seckey == NULL) {
 			(void) fprintf(stderr, "Bad passphrase\n");
+		}
 	} while (seckey == NULL);
 	/* sign file */
 	hashalg = netpgp_getvar(netpgp, "hash");
 	if (cleartext) {
 		__ops_sign_file_as_cleartext(f, out, seckey, hashalg, 1U);
 	} else if (detached) {

 @@ -48,27 +48,27 @@
  */
 /** \file
  * \brief Parser for OpenPGP packets
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: packet-parse.c,v 1.13 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: packet-parse.c,v 1.14 2009/05/21 00:33:31 agc Exp $");
 #endif
 #ifdef HAVE_OPENSSL_CAST_H
 #include <openssl/cast.h>
 #endif
 #include <stdarg.h>
 #include <stdlib.h>
 #include <string.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
 @@ -1079,30 +1079,30 @@ ss_embedded_sig_free(__ops_ss_embedded_s
 /**
 \ingroup Core_Create
 \brief Free allocated memory
 */
 /* ! Free any memory allocated when parsing the packet content */
 void
 __ops_parser_content_free(__ops_packet_t *c)
+{
 	switch (c->tag) {
 	case OPS_PARSER_PTAG:
 	case OPS_PTAG_CT_COMPRESSED:
 	case OPS_PTAG_SS_CREATION_TIME:
 	case OPS_PTAG_SS_EXPIRATION_TIME:
-	case OPS_PTAG_SS_KEY_EXPIRATION_TIME:
+	case OPS_PTAG_SS_KEY_EXPIRY:
 	case OPS_PTAG_SS_TRUST:
 	case OPS_PTAG_SS_ISSUER_KEY_ID:
-	case OPS_PTAG_CT_ONE_PASS_SIGNATURE:
+	case OPS_PTAG_CT_1_PASS_SIG:
 	case OPS_PTAG_SS_PRIMARY_USER_ID:
 	case OPS_PTAG_SS_REVOCABLE:
 	case OPS_PTAG_SS_REVOCATION_KEY:
 	case OPS_PTAG_CT_LITERAL_DATA_HEADER:
 	case OPS_PTAG_CT_LITERAL_DATA_BODY:
 	case OPS_PTAG_CT_SIGNED_CLEARTEXT_BODY:
 	case OPS_PTAG_CT_UNARMOURED_TEXT:
 	case OPS_PTAG_CT_ARMOUR_TRAILER:
 	case OPS_PTAG_CT_SIGNATURE_HEADER:
 	case OPS_PTAG_CT_SE_DATA_HEADER:
 	case OPS_PTAG_CT_SE_IP_DATA_HEADER:
 	case OPS_PTAG_CT_SE_IP_DATA_BODY:
 	case OPS_PTAG_CT_MDC:
 @@ -1133,67 +1133,67 @@ __ops_parser_content_free(__ops_packet_t
 	case OPS_PTAG_CT_PUBLIC_KEY:
 	case OPS_PTAG_CT_PUBLIC_SUBKEY:
 		__ops_pubkey_free(&c->u.pubkey);
 		break;
 	case OPS_PTAG_CT_USER_ID:
 		__ops_userid_free(&c->u.userid);
 		break;
 	case OPS_PTAG_SS_SIGNERS_USER_ID:
 		__ops_userid_free(&c->u.ss_signer);
 		break;
-	case OPS_PTAG_CT_USER_ATTRIBUTE:
+	case OPS_PTAG_CT_USER_ATTR:
 		__ops_userattr_free(&c->u.userattr);
 		break;
 	case OPS_PTAG_SS_PREFERRED_SKA:
 		ss_skapref_free(&c->u.ss_skapref);
 		break;
 	case OPS_PTAG_SS_PREFERRED_HASH:
 		ss_hashpref_free(&c->u.ss_hashpref);
 		break;
-	case OPS_PTAG_SS_PREFERRED_COMPRESSION:
+	case OPS_PTAG_SS_PREF_COMPRESS:
 		ss_zpref_free(&c->u.ss_zpref);
 		break;
 	case OPS_PTAG_SS_KEY_FLAGS:
 		ss_key_flags_free(&c->u.ss_key_flags);
 		break;
-	case OPS_PTAG_SS_KEY_SERVER_PREFS:
+	case OPS_PTAG_SS_KEYSERV_PREFS:
 		ss_key_server_prefs_free(&c->u.ss_key_server_prefs);
 		break;
 	case OPS_PTAG_SS_FEATURES:
 		ss_features_free(&c->u.ss_features);
 		break;
 	case OPS_PTAG_SS_NOTATION_DATA:
 		ss_notation_free(&c->u.ss_notation);
 		break;
 	case OPS_PTAG_SS_REGEXP:
 		ss_regexp_free(&c->u.ss_regexp);
 		break;
 	case OPS_PTAG_SS_POLICY_URI:
 		ss_policy_free(&c->u.ss_policy);
 		break;
-	case OPS_PTAG_SS_PREFERRED_KEY_SERVER:
+	case OPS_PTAG_SS_PREF_KEYSERV:
 		ss_keyserv_free(&c->u.ss_keyserv);
 		break;
 	case OPS_PTAG_SS_USERDEFINED00:
 	case OPS_PTAG_SS_USERDEFINED01:
 	case OPS_PTAG_SS_USERDEFINED02:
 	case OPS_PTAG_SS_USERDEFINED03:
 	case OPS_PTAG_SS_USERDEFINED04:
 	case OPS_PTAG_SS_USERDEFINED05:
 	case OPS_PTAG_SS_USERDEFINED06:
 	case OPS_PTAG_SS_USERDEFINED07:
 	case OPS_PTAG_SS_USERDEFINED08:
 	case OPS_PTAG_SS_USERDEFINED09:
 @@ -1446,27 +1446,27 @@ parse_userattr(__ops_region_t *region, _
 	 * xxx- treat as raw data for now. Could break down further into
 	 * attribute sub-packets later - rachel
 	 */
 	if (region->readc != 0) {
 		/* We should not have read anything so far */
 		(void) fprintf(stderr, "parse_userattr: bad length\n");
 		return 0;
+	}
 	if (!read_data(&pkt.u.userattr.data, region, pinfo))
 		return 0;
-	CALLBACK(&pinfo->cbinfo, OPS_PTAG_CT_USER_ATTRIBUTE, &pkt);
+	CALLBACK(&pinfo->cbinfo, OPS_PTAG_CT_USER_ATTR, &pkt);
 	return 1;
+}
 /**
 \ingroup Core_Create
 \brief Free allocated memory
 */
 /* ! Free the memory used when parsing this packet type */
 void
 __ops_userid_free(__ops_userid_t *id)
+{
 	(void) free(id->userid);
 @@ -1686,44 +1686,44 @@ parse_one_sig_subpacket(__ops_sig_t *sig
 	if (subregion.length > region->length) {
 		ERRP(&pinfo->cbinfo, pkt, "Subpacket too long");
+	}
 	if (!limited_read(&c, 1, &subregion, pinfo)) {
 		return 0;
+	}
 	t8 = (c & 0x7f) / 8;
 	t7 = 1 << (c & 7);
 	pkt.critical = (unsigned)c >> 7;
-	pkt.tag = OPS_PTAG_SIGNATURE_SUBPACKET_BASE + (c & 0x7f);
+	pkt.tag = OPS_PTAG_SIG_SUBPKT_BASE + (c & 0x7f);
 	/* Application wants it delivered raw */
 	if (pinfo->ss_raw[t8] & t7) {
 		pkt.u.ss_raw.tag = pkt.tag;
 		pkt.u.ss_raw.length = subregion.length - 1;
 		pkt.u.ss_raw.raw = calloc(1, pkt.u.ss_raw.length);
 		if (!limited_read(pkt.u.ss_raw.raw, pkt.u.ss_raw.length,
 				&subregion, pinfo)) {
 			return 0;
+		}
 		CALLBACK(&pinfo->cbinfo, OPS_PTAG_RAW_SS, &pkt);
 		return 1;
+	}
 	switch (pkt.tag) {
 	case OPS_PTAG_SS_CREATION_TIME:
 	case OPS_PTAG_SS_EXPIRATION_TIME:
-	case OPS_PTAG_SS_KEY_EXPIRATION_TIME:
+	case OPS_PTAG_SS_KEY_EXPIRY:
 		if (!limited_read_time(&pkt.u.ss_time.time, &subregion, pinfo))
 			return 0;
 		if (pkt.tag == OPS_PTAG_SS_CREATION_TIME) {
 			sig->info.birthtime = pkt.u.ss_time.time;
 			sig->info.birthtime_set = 1;
+		}
 		break;
 	case OPS_PTAG_SS_TRUST:
 		if (!limited_read(&pkt.u.ss_trust.level, 1, &subregion, pinfo)
 		 || !limited_read(&pkt.u.ss_trust.amount, 1, &subregion, pinfo))
 			return 0;
 		break;
 @@ -1747,47 +1747,47 @@ parse_one_sig_subpacket(__ops_sig_t *sig
 	case OPS_PTAG_SS_PREFERRED_SKA:
 		if (!read_data(&pkt.u.ss_skapref.data, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_PREFERRED_HASH:
 		if (!read_data(&pkt.u.ss_hashpref.data, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
-	case OPS_PTAG_SS_PREFERRED_COMPRESSION:
+	case OPS_PTAG_SS_PREF_COMPRESS:
 		if (!read_data(&pkt.u.ss_zpref.data,
 				&subregion, pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_PRIMARY_USER_ID:
 		if (!limited_read(&bools, 1, &subregion, pinfo)) {
 			return 0;
+		}
 		pkt.u.ss_primary_userid.primary_userid = !!bools;
 		break;
 	case OPS_PTAG_SS_KEY_FLAGS:
 		if (!read_data(&pkt.u.ss_key_flags.data, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
-	case OPS_PTAG_SS_KEY_SERVER_PREFS:
+	case OPS_PTAG_SS_KEYSERV_PREFS:
 		if (!read_data(&pkt.u.ss_key_server_prefs.data, &subregion,
 				pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_FEATURES:
 		if (!read_data(&pkt.u.ss_features.data, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_SIGNERS_USER_ID:
 @@ -1833,27 +1833,27 @@ parse_one_sig_subpacket(__ops_sig_t *sig
 	case OPS_PTAG_SS_POLICY_URI:
 		if (!read_string(&pkt.u.ss_policy.url, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_REGEXP:
 		if (!read_string(&pkt.u.ss_regexp.regexp, &subregion, pinfo)) {
 			return 0;
+		}
 		break;
-	case OPS_PTAG_SS_PREFERRED_KEY_SERVER:
+	case OPS_PTAG_SS_PREF_KEYSERV:
 		if (!read_string(&pkt.u.ss_keyserv.name, &subregion,
 				pinfo)) {
 			return 0;
+		}
 		break;
 	case OPS_PTAG_SS_USERDEFINED00:
 	case OPS_PTAG_SS_USERDEFINED01:
 	case OPS_PTAG_SS_USERDEFINED02:
 	case OPS_PTAG_SS_USERDEFINED03:
 	case OPS_PTAG_SS_USERDEFINED04:
 	case OPS_PTAG_SS_USERDEFINED05:
 	case OPS_PTAG_SS_USERDEFINED06:
 @@ -2284,27 +2284,27 @@ parse_one_pass(__ops_region_t * region,
 		return 0;
+	}
 	pkt.u.one_pass_sig.key_alg = c;
 	if (!limited_read(pkt.u.one_pass_sig.keyid,
 			  sizeof(pkt.u.one_pass_sig.keyid), region, pinfo)) {
 		return 0;
+	}
 	if (!limited_read(&c, 1, region, pinfo)) {
 		return 0;
+	}
 	pkt.u.one_pass_sig.nested = !!c;
-	CALLBACK(&pinfo->cbinfo, OPS_PTAG_CT_ONE_PASS_SIGNATURE, &pkt);
+	CALLBACK(&pinfo->cbinfo, OPS_PTAG_CT_1_PASS_SIG, &pkt);
 	/* XXX: we should, perhaps, let the app choose whether to hash or not */
 	parse_hash_init(pinfo, pkt.u.one_pass_sig.hash_alg,
 			    pkt.u.one_pass_sig.keyid);
 	return 1;
+}
 /**
  \ingroup Core_ReadPackets
  \brief Parse a Trust packet
 */
 static int
 parse_trust(__ops_region_t *region, __ops_parseinfo_t *pinfo)
+{
 @@ -3226,35 +3226,35 @@ __ops_parse_packet(__ops_parseinfo_t *pi
 	case OPS_PTAG_CT_TRUST:
 		ret = parse_trust(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_USER_ID:
 		ret = parse_userid(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_COMPRESSED:
 		ret = parse_compressed(&region, pinfo);
 		break;
-	case OPS_PTAG_CT_ONE_PASS_SIGNATURE:
+	case OPS_PTAG_CT_1_PASS_SIG:
 		ret = parse_one_pass(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_LITERAL_DATA:
 		ret = parse_litdata(&region, pinfo);
 		break;
-	case OPS_PTAG_CT_USER_ATTRIBUTE:
+	case OPS_PTAG_CT_USER_ATTR:
 		ret = parse_userattr(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_SECRET_KEY:
 		ret = parse_seckey(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_SECRET_SUBKEY:
 		ret = parse_seckey(&region, pinfo);
 		break;
 	case OPS_PTAG_CT_PK_SESSION_KEY:
 		ret = parse_pk_sesskey(&region, pinfo);
 @@ -3369,38 +3369,38 @@ __ops_parse(__ops_parseinfo_t *pinfo, in
  * \todo Make all packet types optional, not just subpackets */
 void
 __ops_parse_options(__ops_parseinfo_t *pinfo,
 		  __ops_content_tag_t tag,
 		  __ops_parse_type_t type)
+{
 	int             t8, t7;
 	if (tag == OPS_PTAG_SS_ALL) {
 		int             n;
 		for (n = 0; n < 256; ++n) {
 			__ops_parse_options(pinfo,
-				OPS_PTAG_SIGNATURE_SUBPACKET_BASE + n,
+				OPS_PTAG_SIG_SUBPKT_BASE + n,
 				type);
+		}
 		return;
+	}
-	if (tag < OPS_PTAG_SIGNATURE_SUBPACKET_BASE ||
+	if (tag < OPS_PTAG_SIG_SUBPKT_BASE ||
-	    tag > OPS_PTAG_SIGNATURE_SUBPACKET_BASE + NTAGS - 1) {
+	    tag > OPS_PTAG_SIG_SUBPKT_BASE + NTAGS - 1) {
 		(void) fprintf(stderr, "__ops_parse_options: bad tag\n");
 		return;
+	}
-	t8 = (tag - OPS_PTAG_SIGNATURE_SUBPACKET_BASE) / 8;
+	t8 = (tag - OPS_PTAG_SIG_SUBPKT_BASE) / 8;
-	t7 = 1 << ((tag - OPS_PTAG_SIGNATURE_SUBPACKET_BASE) & 7);
+	t7 = 1 << ((tag - OPS_PTAG_SIG_SUBPKT_BASE) & 7);
 	switch (type) {
 	case OPS_PARSE_RAW:
 		pinfo->ss_raw[t8] |= t7;
 		pinfo->ss_parsed[t8] &= ~t7;
 		break;
 	case OPS_PARSE_PARSED:
 		pinfo->ss_raw[t8] &= ~t7;
 		pinfo->ss_parsed[t8] |= t7;
 		break;
 	case OPS_PARSE_IGNORE:
 		pinfo->ss_raw[t8] &= ~t7;

 @@ -47,27 +47,27 @@
  * limitations under the License.
  */
 /** \file
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: signature.c,v 1.13 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: signature.c,v 1.14 2009/05/21 00:33:32 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/param.h>
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 #include <string.h>
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 @@ -75,36 +75,34 @@ __RCSID("$NetBSD: signature.c,v 1.13 200
 #ifdef HAVE_OPENSSL_DSA_H
 #include <openssl/dsa.h>
 #endif
 #include "signature.h"
 #include "crypto.h"
 #include "create.h"
 #include "netpgpsdk.h"
 #include "readerwriter.h"
 #include "validate.h"
 #include "netpgpdefs.h"
 #define MAXBUF 1024		/* <! Standard buffer size to use */
 /** \ingroup Core_Create
  * needed for signature creation
  */
-struct __ops_create_sig {
+struct __ops_create_sig_t {
 	__ops_hash_t		 hash;
 	__ops_sig_t		 sig;
 	__ops_memory_t		*mem;
-	__ops_output_t		*output;/* !< how to do the writing */
+	__ops_output_t		*output;	/* how to do the writing */
 	unsigned		 hashoff;	/* hashed count offset */
 	unsigned		 hashlen;
 	unsigned 		 unhashoff;
 };
 /**
    \ingroup Core_Signature
    Creates new __ops_create_sig_t
    \return new __ops_create_sig_t
    \note It is the caller's responsibility to call __ops_create_sig_delete()
    \sa __ops_create_sig_delete()
 */
 __ops_create_sig_t *
 @@ -345,31 +343,28 @@ rsa_verify(__ops_hash_alg_t type,
 		printf("\n");
 		printf("hash from sig\n");
 		for (uu = 0; uu < hash_length; uu++) {
 			printf("%02x ", hashbuf_from_sig[n + plen + uu]);
+		}
 		printf("\n");
 		printf("hash passed in (should match hash from sig)\n");
 		for (uu = 0; uu < hash_length; uu++) {
 			printf("%02x ", hash[uu]);
+		}
 		printf("\n");
+	}
-	if (memcmp(&hashbuf_from_sig[n], prefix, plen) != 0 ||
+	return (memcmp(&hashbuf_from_sig[n], prefix, plen) == 0 &&
-	    memcmp(&hashbuf_from_sig[n + plen], hash, hash_length) != 0) {
+	        memcmp(&hashbuf_from_sig[n + plen], hash, hash_length) == 0);
 		return 0;
 	return 1;
+}
 static void
 hash_add_key(__ops_hash_t *hash, const __ops_pubkey_t *key)
+{
 	__ops_memory_t	*mem = __ops_memory_new();
 	size_t		 len;
 	__ops_build_pubkey(mem, key, 0);
 	len = __ops_mem_len(mem);
 	__ops_hash_add_int(hash, 0x99, 1);
 	__ops_hash_add_int(hash, len, 2);
 	hash->add(hash, __ops_mem_data(mem), len);
 @@ -417,27 +412,27 @@ hash_add_trailer(__ops_hash_t *hash, con
    \param sig The Signature to be checked
    \param signer The signer's public key
    \return 1 if good; else 0
 */
 unsigned
 __ops_check_sig(const unsigned char *hash, unsigned length,
 		    const __ops_sig_t * sig,
 		    const __ops_pubkey_t * signer)
+{
 	unsigned   ret;
 	if (__ops_get_debug_level(__FILE__)) {
 		printf("__ops_check_sig: (length %d) hash=", length);
-		hexdump(hash, length, "");
+		hexdump(stdout, hash, length, "");
+	}
 	ret = 0;
 	switch (sig->info.key_alg) {
 	case OPS_PKA_DSA:
 		ret = __ops_dsa_verify(hash, length, &sig->info.sig.dsa,
 				&signer->key.dsa);
 		break;
 	case OPS_PKA_RSA:
 		ret = rsa_verify(sig->info.hash_alg, hash, length,
 				&sig->info.sig.rsa,
 				&signer->key.rsa);
 		break;
 @@ -475,30 +470,30 @@ finalise_sig(__ops_hash_t * hash,
 /**
  * \ingroup Core_Signature
+ *
  * \brief Verify a certification signature.
+ *
  * \param key The public key that was signed.
  * \param id The user ID that was signed
  * \param sig The signature.
  * \param signer The public key of the signer.
  * \param raw_packet The raw signature packet.
  * \return 1 if OK; else 0
  */
 unsigned
-__ops_check_useridcert_sig(const __ops_pubkey_t * key,
+__ops_check_useridcert_sig(const __ops_pubkey_t *key,
-			  const __ops_userid_t * id,
+			  const __ops_userid_t *id,
-			  const __ops_sig_t * sig,
+			  const __ops_sig_t *sig,
-			  const __ops_pubkey_t * signer,
+			  const __ops_pubkey_t *signer,
 			  const unsigned char *raw_packet)
+{
 	__ops_hash_t	hash;
 	size_t          userid_len = strlen((char *) id->userid);
 	init_key_sig(&hash, sig, key);
 	if (sig->info.version == OPS_V4) {
 		__ops_hash_add_int(&hash, 0xb4, 1);
 		__ops_hash_add_int(&hash, userid_len, 4);
+	}
 	hash.add(&hash, id->userid, userid_len);
 @@ -540,55 +535,55 @@ __ops_check_userattrcert_sig(const __ops
 /**
  * \ingroup Core_Signature
+ *
  * Verify a subkey signature.
+ *
  * \param key The public key whose subkey was signed.
  * \param subkey The subkey of the public key that was signed.
  * \param sig The signature.
  * \param signer The public key of the signer.
  * \param raw_packet The raw signature packet.
  * \return 1 if OK; else 0
  */
 unsigned
-__ops_check_subkey_sig(const __ops_pubkey_t * key,
+__ops_check_subkey_sig(const __ops_pubkey_t *key,
-			   const __ops_pubkey_t * subkey,
+			   const __ops_pubkey_t *subkey,
-			   const __ops_sig_t * sig,
+			   const __ops_sig_t *sig,
-			   const __ops_pubkey_t * signer,
+			   const __ops_pubkey_t *signer,
 			   const unsigned char *raw_packet)
+{
 	__ops_hash_t      hash;
 	init_key_sig(&hash, sig, key);
 	hash_add_key(&hash, subkey);
 	return finalise_sig(&hash, sig, signer, raw_packet);
+}
 /**
  * \ingroup Core_Signature
+ *
  * Verify a direct signature.
+ *
  * \param key The public key which was signed.
  * \param sig The signature.
  * \param signer The public key of the signer.
  * \param raw_packet The raw signature packet.
  * \return 1 if OK; else 0
  */
 unsigned
-__ops_check_direct_sig(const __ops_pubkey_t * key,
+__ops_check_direct_sig(const __ops_pubkey_t *key,
-			   const __ops_sig_t * sig,
+			   const __ops_sig_t *sig,
-			   const __ops_pubkey_t * signer,
+			   const __ops_pubkey_t *signer,
 			   const unsigned char *raw_packet)
+{
 	__ops_hash_t      hash;
 	init_key_sig(&hash, sig, key);
 	return finalise_sig(&hash, sig, signer, raw_packet);
+}
 /**
  * \ingroup Core_Signature
+ *
  * Verify a signature on a hash (the hash will have already been fed
  * the material that was being signed, for example signed cleartext).
 @@ -600,27 +595,27 @@ __ops_check_direct_sig(const __ops_pubke
  * \return 1 if OK; else 0
  */
 unsigned
 __ops_check_hash_sig(__ops_hash_t *hash,
 			 const __ops_sig_t *sig,
 			 const __ops_pubkey_t *signer)
+{
 	return (sig->info.hash_alg == hash->alg) ?
 		finalise_sig(hash, sig, signer, NULL) :
 ;
+}
 static void
-start_sig_in_mem(__ops_create_sig_t * sig)
+start_sig_in_mem(__ops_create_sig_t *sig)
+{
 	/* since this has subpackets and stuff, we have to buffer the whole */
 	/* thing to get counts before writing. */
 	sig->mem = __ops_memory_new();
 	__ops_memory_init(sig->mem, 100);
 	__ops_writer_set_memory(sig->output, sig->mem);
 	/* write nearly up to the first subpacket */
 	__ops_write_scalar(sig->output, (unsigned)sig->sig.info.version, 1);
 	__ops_write_scalar(sig->output, (unsigned)sig->sig.info.type, 1);
 	__ops_write_scalar(sig->output, (unsigned)sig->sig.info.key_alg, 1);
 	__ops_write_scalar(sig->output, (unsigned)sig->sig.info.hash_alg, 1);
 @@ -716,87 +711,83 @@ __ops_sig_add_data(__ops_create_sig_t *s
+{
 	sig->hash.add(&sig->hash, buf, length);
+}
 /**
  * \ingroup Core_Signature
+ *
  * Mark the end of the hashed subpackets in the signature
+ *
  * \param sig
  */
 unsigned
-__ops_end_hashed_subpkts(__ops_create_sig_t * sig)
+__ops_end_hashed_subpkts(__ops_create_sig_t *sig)
+{
-	sig->hashlen = __ops_mem_len(sig->mem)
+	sig->hashlen = __ops_mem_len(sig->mem) - sig->hashoff - 2;
-	- sig->hashoff - 2;
+	__ops_memory_place_int(sig->mem, sig->hashoff, sig->hashlen, 2);
 	__ops_memory_place_int(sig->mem, sig->hashoff,
 			     sig->hashlen, 2);
 	/* dummy unhashed subpacket count */
 	sig->unhashoff = __ops_mem_len(sig->mem);
 	return __ops_write_scalar(sig->output, 0, 2);
+}
 /**
  * \ingroup Core_Signature
+ *
  * Write out a signature
+ *
  * \param sig
  * \param key
  * \param seckey
  * \param info
+ *
  */
 unsigned
 __ops_write_sig(__ops_output_t *output,
-			__ops_create_sig_t * sig,
+			__ops_create_sig_t *sig,
 			const __ops_pubkey_t *key,
 			const __ops_seckey_t *seckey)
+{
 	unsigned	ret = 0;
 	size_t		len = __ops_mem_len(sig->mem);
 	/* check key not decrypted */
 	switch (seckey->pubkey.alg) {
 	case OPS_PKA_RSA:
 	case OPS_PKA_RSA_ENCRYPT_ONLY:
 	case OPS_PKA_RSA_SIGN_ONLY:
 		if (seckey->key.rsa.d == NULL) {
-			(void) fprintf(stderr,
+			(void) fprintf(stderr, "__ops_write_sig: null rsa.d\n");
 				"__ops_write_sig: null rsa.d\n");
 			return 0;
+		}
 		break;
 	case OPS_PKA_DSA:
 		if (seckey->key.dsa.x == NULL) {
-			(void) fprintf(stderr,
+			(void) fprintf(stderr, "__ops_write_sig: null dsa.x\n");
 				"__ops_write_sig: null dsa.x\n");
 			return 0;
+		}
 		break;
 	default:
 		(void) fprintf(stderr, "Unsupported algorithm %d\n",
 				seckey->pubkey.alg);
 		return 0;
+	}
 	if (sig->hashlen == (unsigned) -1) {
 		(void) fprintf(stderr,
-			"ops_write_sig: bad hashed data len\n");
+				"ops_write_sig: bad hashed data len\n");
 		return 0;
+	}
 	__ops_memory_place_int(sig->mem, sig->unhashoff,
 			     len - sig->unhashoff - 2, 2);
 	/* add the packet from version number to end of hashed subpackets */
 	if (__ops_get_debug_level(__FILE__)) {
 		(void) fprintf(stderr, "ops_write_sig: hashed packet info\n");
+	}
 	sig->hash.add(&sig->hash, __ops_mem_data(sig->mem), sig->unhashoff);
 	/* add final trailer */
 @@ -852,27 +843,28 @@ __ops_write_sig(__ops_output_t *output,
+}
 /**
  * \ingroup Core_Signature
+ *
  * __ops_add_birthtime() adds a creation time to the signature.
+ *
  * \param sig
  * \param when
  */
 unsigned
 __ops_add_birthtime(__ops_create_sig_t * sig, time_t when)
+{
-	return __ops_write_ss_header(sig->output, 5, OPS_PTAG_SS_CREATION_TIME) &&
+	return __ops_write_ss_header(sig->output, 5,
 					OPS_PTAG_SS_CREATION_TIME) &&
 		__ops_write_scalar(sig->output, (unsigned)when, 4);
+}
 /**
  * \ingroup Core_Signature
+ *
  * Adds issuer's key ID to the signature
+ *
  * \param sig
  * \param keyid
  */
 unsigned

 @@ -50,85 +50,85 @@
 /** \file
+ *
  * Creates printable text strings from packet contents
+ *
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: packet-show.c,v 1.7 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: packet-show.c,v 1.8 2009/05/21 00:33:31 agc Exp $");
 #endif
 #include <stdlib.h>
 #include <string.h>
 #include "packet-show.h"
 #include "netpgpdefs.h"
 /*
  * Arrays of value->text maps
  */
 static __ops_map_t packet_tag_map[] =
+{
 	{OPS_PTAG_CT_RESERVED, "Reserved"},
 	{OPS_PTAG_CT_PK_SESSION_KEY, "Public-Key Encrypted Session Key"},
 	{OPS_PTAG_CT_SIGNATURE, "Signature"},
 	{OPS_PTAG_CT_SK_SESSION_KEY, "Symmetric-Key Encrypted Session Key"},
-	{OPS_PTAG_CT_ONE_PASS_SIGNATURE, "One-Pass Signature"},
+	{OPS_PTAG_CT_1_PASS_SIG, "One-Pass Signature"},
 	{OPS_PTAG_CT_SECRET_KEY, "Secret Key"},
 	{OPS_PTAG_CT_PUBLIC_KEY, "Public Key"},
 	{OPS_PTAG_CT_SECRET_SUBKEY, "Secret Subkey"},
 	{OPS_PTAG_CT_COMPRESSED, "Compressed Data"},
 	{OPS_PTAG_CT_SE_DATA, "Symmetrically Encrypted Data"},
 	{OPS_PTAG_CT_MARKER, "Marker"},
 	{OPS_PTAG_CT_LITERAL_DATA, "Literal Data"},
 	{OPS_PTAG_CT_TRUST, "Trust"},
 	{OPS_PTAG_CT_USER_ID, "User ID"},
 	{OPS_PTAG_CT_PUBLIC_SUBKEY, "Public Subkey"},
-	{OPS_PTAG_CT_RESERVED2, "reserved"},
+	{OPS_PTAG_CT_RESERVED2, "reserved2"},
-	{OPS_PTAG_CT_RESERVED3, "reserved"},
+	{OPS_PTAG_CT_RESERVED3, "reserved3"},
-	{OPS_PTAG_CT_USER_ATTRIBUTE, "User Attribute"},
+	{OPS_PTAG_CT_USER_ATTR, "User Attribute"},
-	{OPS_PTAG_CT_SE_IP_DATA, "Sym. Encrypted and Integrity Protected Data"},
+	{OPS_PTAG_CT_SE_IP_DATA,
 		"Symmetric Encrypted and Integrity Protected Data"},
 	{OPS_PTAG_CT_MDC, "Modification Detection Code"},
 	{OPS_PARSER_PTAG, "OPS_PARSER_PTAG"},
 	{OPS_PTAG_RAW_SS, "OPS_PTAG_RAW_SS"},
 	{OPS_PTAG_SS_ALL, "OPS_PTAG_SS_ALL"},
 	{OPS_PARSER_PACKET_END, "OPS_PARSER_PACKET_END"},
-	{OPS_PTAG_SIGNATURE_SUBPACKET_BASE, "OPS_PTAG_SIGNATURE_SUBPACKET_BASE"},
+	{OPS_PTAG_SIG_SUBPKT_BASE, "OPS_PTAG_SIG_SUBPKT_BASE"},
 	{OPS_PTAG_SS_CREATION_TIME, "SS: Signature Creation Time"},
 	{OPS_PTAG_SS_EXPIRATION_TIME, "SS: Signature Expiration Time"},
-	{OPS_PTAG_SS_EXPORTABLE_CERTIFICATION, "SS: Exportable Certification"},
+	{OPS_PTAG_SS_EXPORT_CERT, "SS: Exportable Certification"},
 	{OPS_PTAG_SS_TRUST, "SS: Trust Signature"},
 	{OPS_PTAG_SS_REGEXP, "SS: Regular Expression"},
 	{OPS_PTAG_SS_REVOCABLE, "SS: Revocable"},
-	{OPS_PTAG_SS_KEY_EXPIRATION_TIME, "SS: Key Expiration Time"},
+	{OPS_PTAG_SS_KEY_EXPIRY, "SS: Key Expiration Time"},
 	{OPS_PTAG_SS_RESERVED, "SS: Reserved"},
 	{OPS_PTAG_SS_PREFERRED_SKA, "SS: Preferred Secret Key Algorithm"},
 	{OPS_PTAG_SS_REVOCATION_KEY, "SS: Revocation Key"},
 	{OPS_PTAG_SS_ISSUER_KEY_ID, "SS: Issuer Key Id"},
 	{OPS_PTAG_SS_NOTATION_DATA, "SS: Notation Data"},
 	{OPS_PTAG_SS_PREFERRED_HASH, "SS: Preferred Hash Algorithm"},
-	{OPS_PTAG_SS_PREFERRED_COMPRESSION, "SS: Preferred Compression Algorithm"},
+	{OPS_PTAG_SS_PREF_COMPRESS, "SS: Preferred Compression Algorithm"},
-	{OPS_PTAG_SS_KEY_SERVER_PREFS, "SS: Key Server Preferences"},
+	{OPS_PTAG_SS_KEYSERV_PREFS, "SS: Key Server Preferences"},
-	{OPS_PTAG_SS_PREFERRED_COMPRESSION, "SS: Preferred Key Server"},
+	{OPS_PTAG_SS_PREF_KEYSERV, "SS: Preferred Key Server"},
 	{OPS_PTAG_SS_PRIMARY_USER_ID, "SS: Primary User ID"},
 	{OPS_PTAG_SS_POLICY_URI, "SS: Policy URI"},
 	{OPS_PTAG_SS_KEY_FLAGS, "SS: Key Flags"},
 	{OPS_PTAG_SS_SIGNERS_USER_ID, "SS: Signer's User ID"},
 	{OPS_PTAG_SS_REVOCATION_REASON, "SS: Reason for Revocation"},
 	{OPS_PTAG_SS_FEATURES, "SS: Features"},
 	{OPS_PTAG_SS_SIGNATURE_TARGET, "SS: Signature Target"},
 	{OPS_PTAG_SS_EMBEDDED_SIGNATURE, "SS: Embedded Signature"},
 	{OPS_PTAG_CT_LITERAL_DATA_HEADER, "CT: Literal Data Header"},
 	{OPS_PTAG_CT_LITERAL_DATA_BODY, "CT: Literal Data Body"},
 	{OPS_PTAG_CT_SIGNATURE_HEADER, "CT: Signature Header"},
 	{OPS_PTAG_CT_SIGNATURE_FOOTER, "CT: Signature Footer"},
 @@ -150,35 +150,35 @@ static __ops_map_t packet_tag_map[] =
 	{OPS_PARSER_ERRCODE, "OPS_PARSER_ERRCODE"},
 	{0x00, NULL},		/* this is the end-of-array marker */
 };
 typedef __ops_map_t packet_tag_map_t;
 static __ops_map_t ss_type_map[] =
+{
 	{OPS_PTAG_SS_CREATION_TIME, "Signature Creation Time"},
 	{OPS_PTAG_SS_EXPIRATION_TIME, "Signature Expiration Time"},
 	{OPS_PTAG_SS_TRUST, "Trust Signature"},
 	{OPS_PTAG_SS_REGEXP, "Regular Expression"},
 	{OPS_PTAG_SS_REVOCABLE, "Revocable"},
-	{OPS_PTAG_SS_KEY_EXPIRATION_TIME, "Key Expiration Time"},
+	{OPS_PTAG_SS_KEY_EXPIRY, "Key Expiration Time"},
 	{OPS_PTAG_SS_PREFERRED_SKA, "Preferred Symmetric Algorithms"},
 	{OPS_PTAG_SS_REVOCATION_KEY, "Revocation Key"},
 	{OPS_PTAG_SS_ISSUER_KEY_ID, "Issuer key ID"},
 	{OPS_PTAG_SS_NOTATION_DATA, "Notation Data"},
 	{OPS_PTAG_SS_PREFERRED_HASH, "Preferred Hash Algorithms"},
-	{OPS_PTAG_SS_PREFERRED_COMPRESSION, "Preferred Compression Algorithms"},
+	{OPS_PTAG_SS_PREF_COMPRESS, "Preferred Compression Algorithms"},
-	{OPS_PTAG_SS_KEY_SERVER_PREFS, "Key Server Preferences"},
+	{OPS_PTAG_SS_KEYSERV_PREFS, "Key Server Preferences"},
-	{OPS_PTAG_SS_PREFERRED_KEY_SERVER, "Preferred Key Server"},
+	{OPS_PTAG_SS_PREF_KEYSERV, "Preferred Key Server"},
 	{OPS_PTAG_SS_PRIMARY_USER_ID, "Primary User ID"},
 	{OPS_PTAG_SS_POLICY_URI, "Policy URI"},
 	{OPS_PTAG_SS_KEY_FLAGS, "Key Flags"},
 	{OPS_PTAG_SS_REVOCATION_REASON, "Reason for Revocation"},
 	{OPS_PTAG_SS_FEATURES, "Features"},
 	{0x00, NULL},		/* this is the end-of-array marker */
 };
 typedef __ops_map_t ss_type_map_t;
 static __ops_map_t ss_rr_code_map[] =
+{
 	{0x00, "No reason specified"},

 @@ -165,84 +165,83 @@ typedef enum {
  * signature subpacket type values that we understand.
+ *
  * \see RFC4880 4.3
  * \see RFC4880 5.2.3.1
  */
 typedef enum {
 	OPS_PTAG_CT_RESERVED = 0,	/* Reserved - a packet tag must
 					 * not have this value */
 	OPS_PTAG_CT_PK_SESSION_KEY = 1,	/* Public-Key Encrypted Session
 					 * Key Packet */
 	OPS_PTAG_CT_SIGNATURE = 2,	/* Signature Packet */
 	OPS_PTAG_CT_SK_SESSION_KEY = 3,	/* Symmetric-Key Encrypted Session
 					 * Key Packet */
-	OPS_PTAG_CT_ONE_PASS_SIGNATURE = 4,	/* One-Pass Signature
+	OPS_PTAG_CT_1_PASS_SIG = 4,	/* One-Pass Signature
 						 * Packet */
 	OPS_PTAG_CT_SECRET_KEY = 5,	/* Secret Key Packet */
 	OPS_PTAG_CT_PUBLIC_KEY = 6,	/* Public Key Packet */
 	OPS_PTAG_CT_SECRET_SUBKEY = 7,	/* Secret Subkey Packet */
 	OPS_PTAG_CT_COMPRESSED = 8,	/* Compressed Data Packet */
 	OPS_PTAG_CT_SE_DATA = 9,/* Symmetrically Encrypted Data Packet */
 	OPS_PTAG_CT_MARKER = 10,/* Marker Packet */
 	OPS_PTAG_CT_LITERAL_DATA = 11,	/* Literal Data Packet */
 	OPS_PTAG_CT_TRUST = 12,	/* Trust Packet */
 	OPS_PTAG_CT_USER_ID = 13,	/* User ID Packet */
 	OPS_PTAG_CT_PUBLIC_SUBKEY = 14,	/* Public Subkey Packet */
 	OPS_PTAG_CT_RESERVED2 = 15,	/* reserved */
 	OPS_PTAG_CT_RESERVED3 = 16,	/* reserved */
-	OPS_PTAG_CT_USER_ATTRIBUTE = 17,	/* User Attribute Packet */
+	OPS_PTAG_CT_USER_ATTR = 17,	/* User Attribute Packet */
 	OPS_PTAG_CT_SE_IP_DATA = 18,	/* Sym. Encrypted and Integrity
 					 * Protected Data Packet */
 	OPS_PTAG_CT_MDC = 19,	/* Modification Detection Code Packet */
 	OPS_PARSER_PTAG = 0x100,/* Internal Use: The packet is the "Packet
 				 * Tag" itself - used when callback sends
 				 * back the PTag. */
 	OPS_PTAG_RAW_SS = 0x101,/* Internal Use: content is raw sig subtag */
 	OPS_PTAG_SS_ALL = 0x102,/* Internal Use: select all subtags */
 	OPS_PARSER_PACKET_END = 0x103,
 	/* signature subpackets (0x200-2ff) (type+0x200) */
 	/* only those we can parse are listed here */
-	OPS_PTAG_SIGNATURE_SUBPACKET_BASE = 0x200,	/* Base for signature
+	OPS_PTAG_SIG_SUBPKT_BASE = 0x200,	/* Base for signature
 							 * subpacket types - All
 							 * signature type values
 							 * are relative to this
 							 * value. */
 	OPS_PTAG_SS_CREATION_TIME = 0x200 + 2,	/* signature creation time */
 	OPS_PTAG_SS_EXPIRATION_TIME = 0x200 + 3,	/* signature
 							 * expiration time */
-	OPS_PTAG_SS_EXPORTABLE_CERTIFICATION = 0x200 + 4,	/* exportable
+	OPS_PTAG_SS_EXPORT_CERT = 0x200 + 4,	/* exportable certification */
 								 * certification */
 	OPS_PTAG_SS_TRUST = 0x200 + 5,	/* trust signature */
 	OPS_PTAG_SS_REGEXP = 0x200 + 6,	/* regular expression */
 	OPS_PTAG_SS_REVOCABLE = 0x200 + 7,	/* revocable */
-	OPS_PTAG_SS_KEY_EXPIRATION_TIME = 0x200 + 9,	/* key expiration
+	OPS_PTAG_SS_KEY_EXPIRY = 0x200 + 9,	/* key expiration
 							 * time */
 	OPS_PTAG_SS_RESERVED = 0x200 + 10,	/* reserved */
 	OPS_PTAG_SS_PREFERRED_SKA = 0x200 + 11,	/* preferred symmetric
 						 * algs */
 	OPS_PTAG_SS_REVOCATION_KEY = 0x200 + 12,	/* revocation key */
 	OPS_PTAG_SS_ISSUER_KEY_ID = 0x200 + 16,	/* issuer key ID */
 	OPS_PTAG_SS_NOTATION_DATA = 0x200 + 20,	/* notation data */
 	OPS_PTAG_SS_PREFERRED_HASH = 0x200 + 21,	/* preferred hash
 							 * algs */
-	OPS_PTAG_SS_PREFERRED_COMPRESSION = 0x200 + 22,	/* preferred
+	OPS_PTAG_SS_PREF_COMPRESS = 0x200 + 22,	/* preferred
 							 * compression
 							 * algorithms */
-	OPS_PTAG_SS_KEY_SERVER_PREFS = 0x200 + 23,	/* key server
+	OPS_PTAG_SS_KEYSERV_PREFS = 0x200 + 23,	/* key server
 							 * preferences */
-	OPS_PTAG_SS_PREFERRED_KEY_SERVER = 0x200 + 24,	/* Preferred Key
+	OPS_PTAG_SS_PREF_KEYSERV = 0x200 + 24,	/* Preferred Key
 							 * Server */
 	OPS_PTAG_SS_PRIMARY_USER_ID = 0x200 + 25,	/* primary User ID */
 	OPS_PTAG_SS_POLICY_URI = 0x200 + 26,	/* Policy URI */
 	OPS_PTAG_SS_KEY_FLAGS = 0x200 + 27,	/* key flags */
 	OPS_PTAG_SS_SIGNERS_USER_ID = 0x200 + 28,	/* Signer's User ID */
 	OPS_PTAG_SS_REVOCATION_REASON = 0x200 + 29,	/* reason for
 							 * revocation */
 	OPS_PTAG_SS_FEATURES = 0x200 + 30,	/* features */
 	OPS_PTAG_SS_SIGNATURE_TARGET = 0x200 + 31,	/* signature target */
 	OPS_PTAG_SS_EMBEDDED_SIGNATURE = 0x200 + 32,	/* embedded signature */
 	OPS_PTAG_SS_USERDEFINED00 = 0x200 + 100,	/* internal or
 							 * user-defined */

 @@ -1,17 +1,18 @@
 To Do
 =====
--bit offsets
+separate verify program
 separate from libcrypto?
 -bit offsets
 need a netpgp_set_{pub,sec}key()? vs _init()?
 default compression when signing?
 get rid of ops_memory after used literal_data_body
 sort out callback - ops_export_key, packet-parse callback etc
 Simplify IO
 Make into SHA1Init, SHA1End, SHA1File style of calls
 Multiple recipients for encryption
 Done
 ====
 autoconf
 libtool
 name change
 @@ -44,13 +45,14 @@ Install man pages
 WARNS=4 (again)
 detached sig
 get rid of assert()s
 disable core dumps
 add a --help option
 sha256 digests
 print out size of key in --list-keys
 decryption - print encrypted key info
 get rid of local files
 hash algorithm selection
 detached verification
 RCS Ids
 Look at inefficiencies - read() etc
 cat command to display a verified file without signature

 @@ -1,17 +1,17 @@
-dnl $Id: configure.ac,v 1.8 2009/05/19 05:13:09 agc Exp $
+dnl $Id: configure.ac,v 1.9 2009/05/21 00:33:31 agc Exp $
 dnl Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.57)
-AC_INIT([netpgp],[20090518],[Alistair Crooks <agc@netbsd.org> c0596823])
+AC_INIT([netpgp],[20090520],[Alistair Crooks <agc@netbsd.org> c0596823])
 AC_CONFIG_SRCDIR([src/bin/netpgp.c])
 AC_CONFIG_HEADER(src/lib/config.h)
 AC_ARG_PROGRAM
 AC_CANONICAL_HOST
 CANONICAL_HOST=$host
 AC_SUBST(CANONICAL_HOST)
 # Checks for programs.
 AC_PROG_MAKE_SET
 AC_PROG_AWK
 AC_PROG_CC
 AC_PROG_INSTALL

 @@ -1,41 +1,47 @@
 #! /bin/sh
 env USETOOLS=no MAKEOBJDIRPREFIX=/usr/obj/i386 sh -c 'cd ../lib && \
 	make cleandir ; \
 	make ; \
 	su root -c "make install"'
 env USETOOLS=no MAKEOBJDIRPREFIX=/usr/obj/i386 sh -c 'cd ../bin && \
 	make cleandir ; \
 	make ; \
 	su root -c "make install"'
 echo "======> sign/verify 180938 file"
 cp configure a
 /usr/bin/netpgp --sign a
-/usr/bin/netpgp --verify a.gpg
+/usr/bin/netpgp --verify a.gpg && echo "[Verified OK]"
 echo "======> attempt to verify an unsigned file"
-/usr/bin/netpgp --verify a
+/usr/bin/netpgp --verify a  && echo "[Verified OK]"
 echo "======> encrypt/decrypt 10809 file"
 cp src/bin/netpgp.1 b
 /usr/bin/netpgp --encrypt b
 /usr/bin/netpgp --decrypt b.gpg
-diff src/bin/netpgp.1 b && echo "No differences found"
+diff src/bin/netpgp.1 b && echo "[No differences found]"
 echo "======> encrypt/decrypt 180938 file"
 cp configure c
 /usr/bin/netpgp --encrypt c
 /usr/bin/netpgp --decrypt c.gpg
-diff configure c && echo "No differences found"
+diff configure c && echo "[No differences found]"
 echo "======> encrypt/decrypt bigass file"
 cat configure configure configure configure configure configure > d
 ls -l d
 cp d e
 /usr/bin/netpgp --encrypt d
 /usr/bin/netpgp --decrypt d.gpg
-diff e d && echo "No differences found"
+diff e d && echo "[No differences found]"
 echo "======> sign/verify detached signature file"
 cat configure configure configure configure configure configure > f
 /usr/bin/netpgp --sign --detached f
 ls -l f f.sig
-/usr/bin/netpgp --verify f.sig
+/usr/bin/netpgp --verify f.sig && echo "[Verified OK]"
 echo "======> cat signature - verified cat command"
 /usr/bin/netpgp --cat a.gpg > a2
 diff a a2 && echo "[No differences found]"
 echo "======> another cat signature - verified cat command"
 /usr/bin/netpgp --cat --output=a3 a.gpg
 diff a a3 && echo "[No differences found]"
 echo "======> version information"
 /usr/bin/netpgp --version
-rm -f a a.gpg b b.gpg c c.gpg d d.gpg e f f.sig
+rm -f a a.gpg b b.gpg c c.gpg d d.gpg e f f.sig a2 a3

 @@ -112,33 +112,33 @@
 /* Define to 1 if you have the <unistd.h> header file. */
 #define HAVE_UNISTD_H 1
 /* Define to 1 if you have the <zlib.h> header file. */
 #define HAVE_ZLIB_H 1
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT "Alistair Crooks <agc@netbsd.org> c0596823"
 /* Define to the full name of this package. */
 #define PACKAGE_NAME "netpgp"
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "netpgp 20090518"
+#define PACKAGE_STRING "netpgp 20090520"
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "netpgp"
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "20090518"
+#define PACKAGE_VERSION "20090520"
 /* Define to 1 if you have the ANSI C header files. */
 #define STDC_HEADERS 1
 /* Define for Solaris 2.5.1 so the uint32_t typedef from <sys/synch.h>,
    <pthread.h>, or <semaphore.h> is not used. If the typedef were allowed, the
    #define below would cause a syntax error. */
 /* #undef _UINT32_T */
 /* Define for Solaris 2.5.1 so the uint64_t typedef from <sys/synch.h>,
    <pthread.h>, or <semaphore.h> is not used. If the typedef were allowed, the
    #define below would cause a syntax error. */
 /* #undef _UINT64_T */

 @@ -103,23 +103,23 @@ void __ops_add_signed_userid(__ops_keyda
 					const __ops_userid_t *,
 					const __ops_subpacket_t *);
 unsigned __ops_add_selfsigned_userid(__ops_keydata_t *, __ops_userid_t *);
 __ops_keydata_t  *__ops_keydata_new(void);
 void __ops_keydata_init(__ops_keydata_t *, const __ops_content_tag_t);
 void __ops_copy_userid(__ops_userid_t *, const __ops_userid_t *);
 void __ops_copy_packet(__ops_subpacket_t *, const __ops_subpacket_t *);
 int __ops_parse_and_accumulate(__ops_keyring_t *, __ops_parseinfo_t *);
-void __ops_print_pubkeydata(const __ops_keydata_t *);
+void __ops_print_pubkeydata(FILE *, const __ops_keydata_t *);
 void __ops_print_pubkey(const __ops_pubkey_t *);
 void __ops_print_seckeydata(const __ops_keydata_t *);
 void __ops_list_packets(char *, unsigned, __ops_keyring_t *,
 				__ops_cbfunc_t *);
 int __ops_export_key(const __ops_keydata_t *, unsigned char *);
 #endif /* KEYRING_H_ */

 @@ -47,27 +47,27 @@
  * limitations under the License.
  */
 /** \file
  */
 #ifndef SIGNATURE_H_
 #define SIGNATURE_H_
 #include "packet.h"
 #include "create.h"
 #include "memory.h"
-typedef struct __ops_create_sig __ops_create_sig_t;
+typedef struct __ops_create_sig_t	 __ops_create_sig_t;
 __ops_create_sig_t *__ops_create_sig_new(void);
 void __ops_create_sig_delete(__ops_create_sig_t *);
 unsigned __ops_check_useridcert_sig(const __ops_pubkey_t *,
 			  const __ops_userid_t *,
 			  const __ops_sig_t *,
 			  const __ops_pubkey_t *,
 			  const unsigned char *);
 unsigned __ops_check_userattrcert_sig(const __ops_pubkey_t *,
 			  const __ops_userattr_t *,
 			  const __ops_sig_t *,
 			  const __ops_pubkey_t *,

 @@ -48,20 +48,20 @@
  */
 #ifndef VERSION_H_
 #define VERSION_H_	1
 #ifndef NETPGP_AUTOCONF_VERSION
 #define NETPGP_AUTOCONF_VERSION	PACKAGE_VERSION
 #endif
 #ifndef NETPGP_MAINTAINER
 #define NETPGP_MAINTAINER	PACKAGE_BUGREPORT
 #endif
 /* development versions have .99 suffix */
-#define NETPGP_BASE_VERSION	"1.99.1"
+#define NETPGP_BASE_VERSION	"1.99.2"
 #define NETPGP_VERSION_CAT(a, b)	"NetPGP portable " a "/[" b "]"
 #define NETPGP_VERSION_STRING \
 	NETPGP_VERSION_CAT(NETPGP_BASE_VERSION, NETPGP_AUTOCONF_VERSION)
 #endif /* !VERSION_H_ */

 @@ -47,27 +47,27 @@
  * limitations under the License.
  */
 /** \file
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: create.c,v 1.12 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: create.c,v 1.13 2009/05/21 00:33:31 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <sys/mman.h>
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 #include <string.h>
 @@ -93,27 +93,27 @@ __RCSID("$NetBSD: create.c,v 1.12 2009/0
  * \param length
  * \param type
  * \param output
  * \return 1 if OK, otherwise 0
  */
 unsigned
 __ops_write_ss_header(__ops_output_t *output,
 			unsigned length,
 			__ops_content_tag_t type)
+{
 	return __ops_write_length(output, length) &&
 		__ops_write_scalar(output, (unsigned)(type -
-			OPS_PTAG_SIGNATURE_SUBPACKET_BASE), 1);
+				OPS_PTAG_SIG_SUBPKT_BASE), 1);
+}
 /*
  * XXX: the general idea of _fast_ is that it doesn't copy stuff the safe
  * (i.e. non _fast_) version will, and so will also need to be freed.
  */
 /**
  * \ingroup Core_Create
+ *
  * __ops_fast_create_userid() sets id->userid to the given userid.
  * This is fast because it is only copying a char*. However, if userid
  * is changed or freed in the future, this could have injurious results.
 @@ -1263,22 +1263,22 @@ __ops_write_symm_enc_data(const unsigned
 \param sig_type Signature type
 \param output Write settings
 \return 1 if OK; else 0
 */
 unsigned
 __ops_write_one_pass_sig(__ops_output_t *output,
 			const __ops_seckey_t *seckey,
 			const __ops_hash_alg_t hash_alg,
 			const __ops_sig_type_t sig_type)
+{
 	unsigned char   keyid[OPS_KEY_ID_SIZE];
 	__ops_keyid(keyid, OPS_KEY_ID_SIZE, OPS_KEY_ID_SIZE, &seckey->pubkey);
-	return __ops_write_ptag(output, OPS_PTAG_CT_ONE_PASS_SIGNATURE) &&
+	return __ops_write_ptag(output, OPS_PTAG_CT_1_PASS_SIG) &&
 		__ops_write_length(output, 1 + 1 + 1 + 1 + 8 + 1) &&
 		__ops_write_scalar(output, 3, 1)	/* version */ &&
 		__ops_write_scalar(output, (unsigned)sig_type, 1) &&
 		__ops_write_scalar(output, (unsigned)hash_alg, 1) &&
 		__ops_write_scalar(output, (unsigned)seckey->pubkey.alg, 1) &&
 		__ops_write(output, keyid, 8) &&
 		__ops_write_scalar(output, 1, 1);
+}

 @@ -44,27 +44,27 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: reader.c,v 1.12 2009/05/16 06:30:38 agc Exp $");
+__RCSID("$NetBSD: reader.c,v 1.13 2009/05/21 00:33:32 agc Exp $");
 #endif
 #include <sys/types.h>
 #include <sys/stat.h>
 #ifdef HAVE_SYS_MMAN_H
 #include <sys/mman.h>
 #endif
 #ifdef HAVE_SYS_PARAM_H
 #include <sys/param.h>
 #endif
 @@ -2207,27 +2207,27 @@ __ops_malloc_passphrase(char *pp)
  \param cbinfo
 */
 __ops_parse_cb_return_t
 get_passphrase_cb(const __ops_packet_t *pkt, __ops_callback_data_t *cbinfo)
+{
 	const __ops_parser_content_union_t	*content = &pkt->u;
 	if (__ops_get_debug_level(__FILE__)) {
 		__ops_print_packet(pkt);
+	}
 	if (cbinfo->cryptinfo.keydata == NULL) {
 		(void) fprintf(stderr, "get_passphrase_cb: NULL keydata\n");
 	} else {
-		__ops_print_pubkeydata(cbinfo->cryptinfo.keydata);
+		__ops_print_pubkeydata(stderr, cbinfo->cryptinfo.keydata);
+	}
 	switch (pkt->tag) {
 	case OPS_PARSER_CMD_GET_SK_PASSPHRASE:
 		*(content->skey_passphrase.passphrase) =
 			__ops_malloc_passphrase(getpass("netpgp passphrase: "));
 		return OPS_KEEP_MEMORY;
 	default:
 		break;
+	}
 	return OPS_RELEASE_MEMORY;
+}
 unsigned

 @@ -47,27 +47,27 @@
  * limitations under the License.
  */
 /** \file
  */
 #include "config.h"
 #ifdef HAVE_SYS_CDEFS_H
 #include <sys/cdefs.h>
 #endif
 #if defined(__NetBSD__)
 __COPYRIGHT("@(#) Copyright (c) 2009 The NetBSD Foundation, Inc. All rights reserved.");
-__RCSID("$NetBSD: keyring.c,v 1.10 2009/05/19 05:13:10 agc Exp $");
+__RCSID("$NetBSD: keyring.c,v 1.11 2009/05/21 00:33:31 agc Exp $");
 #endif
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 #include <stdlib.h>
 #include <string.h>
 #ifdef HAVE_TERMIOS_H
 #include <termios.h>
 #endif
 @@ -937,27 +937,27 @@ __ops_find_key_by_userid(const __ops_key
    \return none
 */
 void
 __ops_keyring_list(const __ops_keyring_t * keyring)
+{
 	int             n;
 	__ops_keydata_t  *key;
 	printf("%d keys\n", keyring->nkeys);
 	for (n = 0, key = &keyring->keys[n]; n < keyring->nkeys; ++n, ++key) {
 		if (__ops_is_key_secret(key)) {
 			__ops_print_seckeydata(key);
 		} else {
-			__ops_print_pubkeydata(key);
+			__ops_print_pubkeydata(stdout, key);
+		}
 		(void) fputc('\n', stdout);
+	}
+}
 static unsigned
 get_contents_type(const __ops_keydata_t *keydata)
+{
 	return keydata->type;
+}
 /* this interface isn't right - hook into callback for getting passphrase */
 int

 @@ -47,27 +47,27 @@
 /*
  * These macros code ensures that you are casting what you intend to cast.
  * It works because in "a ? b : c", b and c must have the same type.
  * This is a copy of the macro defined in openssl/asn1.h.
  */
 #ifndef CHECKED_PTR_OF
 #define CHECKED_PTR_OF(type, p) ((void*) (/*CONSTCOND*/1 ? p : (type *)0))
 #endif
 #define CHECKED_INSTANCE_OF(type, p) (/*CONSTCOND*/1 ? p : (type)0)
 /* number of elements in an array */
 #define OPS_ARRAY_SIZE(a)       (sizeof(a)/sizeof(*(a)))
-void            hexdump(const unsigned char *, size_t, const char *);
+void            hexdump(FILE *, const unsigned char *, size_t, const char *);
 const char     *__ops_str_from_map(int, __ops_map_t *);
 int             __ops_set_debug_level(const char *);
 int             __ops_get_debug_level(const char *);
 #define NETPGP_BUFSIZ	8192
 #define CALLBACK(cbinfo, t, pc)	do {					\
 	(pc)->tag = (t);						\
 	if (__ops_parse_cb((pc), (cbinfo)) == OPS_RELEASE_MEMORY) {	\
 		__ops_parser_content_free(pc);				\
 	}								\