 @@ -884,1484 +884,1484 @@ read_compressed(pgpv_t *pgp, pgpv_compre
 		return 0;
+	}
 	switch(compressed->compalg) {
 	case UNCOMPRESSED:
 		printf("not implemented %d compression yet\n", compressed->compalg);
 		return 0;
 	default:
 		break;
+	}
 	ARRAY_EXPAND(pgp->areas);
 	ARRAY_COUNT(pgp->areas) += 1;
 	unzmem = &ARRAY_LAST(pgp->areas);
 	unzmem->size = len * 10;
 	unzmem->dealloc = FREE_MEM;
 	if ((unzmem->mem = calloc(1, unzmem->size)) == NULL) {
 		printf("read_compressed: calloc failed!\n");
 		return 0;
+	}
 	switch(compressed->compalg) {
 	case ZIP_COMPRESSION:
 	case ZLIB_COMPRESSION:
 		memset(&z, 0x0, sizeof(z));
 		z.next_in = p + 1;
 		z.avail_in = (unsigned)(len - 1);
 		z.total_in = (unsigned)(len - 1);
 		z.next_out = unzmem->mem;
 		z.avail_out = (unsigned)unzmem->size;
 		z.total_out = (unsigned)unzmem->size;
 		break;
 	case BZIP2_COMPRESSION:
 		memset(&bz, 0x0, sizeof(bz));
 		bz.avail_in = (unsigned)(len - 1);
 		bz.next_in = (char *)(void *)p + 1;
 		bz.next_out = (char *)(void *)unzmem->mem;
 		bz.avail_out = (unsigned)unzmem->size;
 		break;
+	}
 	switch(compressed->compalg) {
 	case ZIP_COMPRESSION:
 		ok = (inflateInit2(&z, -15) == Z_OK);
 		break;
 	case ZLIB_COMPRESSION:
 		ok = (inflateInit(&z) == Z_OK);
 		break;
 	case BZIP2_COMPRESSION:
 		ok = (BZ2_bzDecompressInit(&bz, 1, 0) == BZ_OK);
 		break;
+	}
 	if (!ok) {
 		printf("read_compressed: initialisation failed!\n");
 		return 0;
+	}
 	switch(compressed->compalg) {
 	case ZIP_COMPRESSION:
 	case ZLIB_COMPRESSION:
 		ok = (inflate(&z, Z_FINISH) == Z_STREAM_END);
 		unzmem->size = z.total_out;
 		break;
 	case BZIP2_COMPRESSION:
 		ok = (BZ2_bzDecompress(&bz) == BZ_STREAM_END);
 		unzmem->size = ((uint64_t)bz.total_out_hi32 << 32) | bz.total_out_lo32;
 		break;
+	}
 	if (!ok) {
 		printf("read_compressed: inflate failed!\n");
 		return 0;
+	}
 	return 1;
+}
 /* parse one pass signature packet */
 static int
 read_onepass_sig(pgpv_onepass_t *onepasspkt, uint8_t *mem)
+{
 	onepasspkt->version = mem[0];
 	onepasspkt->type = mem[1];
 	onepasspkt->hashalg = mem[2];
 	onepasspkt->keyalg = mem[3];
 	memcpy(onepasspkt->keyid, &mem[4], sizeof(onepasspkt->keyid));
 	onepasspkt->nested = mem[12];
 	return 1;
+}
 /* parse public key packet */
 static int
 read_pubkey(pgpv_pubkey_t *pubkey, uint8_t *mem, size_t pktlen, int pbn)
+{
 	size_t		 off;
 	off = 0;
 	pubkey->version = mem[off++];
 	pubkey->birth = get_32(&mem[off]);
 	off += 4;
 	if (pubkey->version == 2 || pubkey->version == 3) {
 		pubkey->expiry = get_16(&mem[off]) * DAYSECS;
 		off += 2;
+	}
 	if ((pubkey->keyalg = mem[off++]) == 0) {
 		pubkey->keyalg = PUBKEY_RSA_ENCRYPT_OR_SIGN;
 		printf("got unusual pubkey keyalg %u\n", mem[off - 1]);
+	}
 	switch(pubkey->keyalg) {
 	case PUBKEY_RSA_ENCRYPT_OR_SIGN:
 	case PUBKEY_RSA_ENCRYPT:
 	case PUBKEY_RSA_SIGN:
 		if (!get_mpi(&pubkey->bn[RSA_N], &mem[off], pktlen, &off) ||
 		    !get_mpi(&pubkey->bn[RSA_E], &mem[off], pktlen, &off)) {
 			return 0;
+		}
 		break;
 	case PUBKEY_ELGAMAL_ENCRYPT:
 	case PUBKEY_ELGAMAL_ENCRYPT_OR_SIGN:
 		if (!get_mpi(&pubkey->bn[ELGAMAL_P], &mem[off], pktlen, &off) ||
 		    !get_mpi(&pubkey->bn[ELGAMAL_Y], &mem[off], pktlen, &off)) {
 			return 0;
+		}
 		break;
 	case PUBKEY_DSA:
 		if (!get_mpi(&pubkey->bn[DSA_P], &mem[off], pktlen, &off) ||
 		    !get_mpi(&pubkey->bn[DSA_Q], &mem[off], pktlen, &off) ||
 		    !get_mpi(&pubkey->bn[DSA_G], &mem[off], pktlen, &off) ||
 		    !get_mpi(&pubkey->bn[DSA_Y], &mem[off], pktlen, &off)) {
 			return 0;
+		}
 		break;
 	default:
 		printf("hi, different type of pubkey here %u\n", pubkey->keyalg);
 		break;
+	}
 	if (pbn) {
 		print_key_mpis(pubkey->bn, pubkey->keyalg);
+	}
 	return 1;
+}
 /* parse a user attribute */
 static int
 read_userattr(pgpv_userattr_t *userattr, uint8_t *p, size_t pktlen)
+{
 	pgpv_string_t	subattr;
 	const int 	is_subpkt = 0;
 	const int	indian = 1;
 	unsigned	lenlen;
 	uint16_t	imagelen;
 	size_t		cc;
 	userattr->len = pktlen;
 	for (cc = 0 ; cc < pktlen ; cc += subattr.size + lenlen + 1) {
 		subattr.size = get_pkt_len(1, p, 0, is_subpkt);
 		lenlen = get_pkt_len_len(1, p, is_subpkt);
 		if (lenlen > pktlen) {
 			printf("weird lenlen %u\n", lenlen);
 			return 0;
+		}
 		p += lenlen;
 		if (*p++ != 1) {
 			printf("image type (%u) != 1. weird packet\n", *(p - 1));
+		}
 		memcpy(&imagelen, p, sizeof(imagelen));
 		if (!*(const char *)(const void *)&indian) {
 			/* big endian - byteswap length */
 			imagelen = (((unsigned)imagelen & 0xff) << 8) | (((unsigned)imagelen >> 8) & 0xff);
+		}
 		subattr.data = p + 3;
 		p += subattr.size;
 		ARRAY_APPEND(userattr->subattrs, subattr);
+	}
 	return 1;
+}
 #define LITDATA_BINARY	'b'
 #define LITDATA_TEXT	't'
 #define LITDATA_UTF8	'u'
 /* parse literal packet */
 static int
 read_litdata(pgpv_t *pgp, pgpv_litdata_t *litdata, uint8_t *p, size_t size)
+{
 	size_t	cc;
 	cc = 0;
 	switch(litdata->format = p[cc++]) {
 	case LITDATA_BINARY:
 	case LITDATA_TEXT:
 	case LITDATA_UTF8:
 		litdata->namelen = 0;
 		break;
 	default:
 		printf("weird litdata format %u\n", litdata->format);
 		break;
+	}
 	litdata->namelen = p[cc++];
 	litdata->filename = &p[cc];
 	cc += litdata->namelen;
 	litdata->secs = get_32(&p[cc]);
 	cc += 4;
 	litdata->s.data = &p[cc];
 	litdata->len = litdata->s.size = size - cc;
 	litdata->mem = ARRAY_COUNT(pgp->areas) - 1;
 	litdata->offset = cc;
 	return 1;
+}
 /* parse a single packet */
 static int
 read_pkt(pgpv_t *pgp, pgpv_mem_t *mem)
+{
 	const int	 isprimary = 1;
 	pgpv_pkt_t	 pkt;
 	pgpv_mem_t	*newmem;
 	unsigned	 lenlen;
 	uint8_t		 ispartial;
 	size_t		 size;
 	memset(&pkt, 0x0, sizeof(pkt));
 	pkt.tag = mem->mem[mem->cc++];
 	if (!(pkt.tag & PKT_ALWAYS_ON)) {
 		printf("BAD PACKET - bit 7 not 1, offset %zu!\n", mem->cc - 1);
+	}
 	pkt.newfmt = (pkt.tag & PKT_NEWFMT_MASK);
 	pkt.tag = (pkt.newfmt) ?
 		(pkt.tag & PKT_NEWFMT_TAG_MASK) :
 		(((unsigned)pkt.tag & PKT_OLDFMT_TAG_MASK) >> 2);
 	ispartial = (pkt.newfmt && IS_PARTIAL(mem->mem[mem->cc]));
 	pkt.s.size = get_pkt_len(pkt.newfmt, &mem->mem[mem->cc], mem->size - mem->cc, isprimary);
 	lenlen = get_pkt_len_len(pkt.newfmt, &mem->mem[mem->cc], isprimary);
 	pkt.offset = mem->cc;
 	mem->cc += lenlen;
 	pkt.mement = (uint8_t)(mem - ARRAY_ARRAY(pgp->areas));
 	pkt.s.data = &mem->mem[mem->cc];
 	if (strchr(mem->allowed, pkt.tag) == NULL) {
 		printf("packet %d not allowed for operation %s\n", pkt.tag, pgp->op);
 		return 0;
+	}
 	size = pkt.s.size;
 	if (ispartial) {
 		pkt.s.size = fixup_partials(pgp, &mem->mem[mem->cc - lenlen], pkt.s.size, mem->size, &size);
 		newmem = &ARRAY_LAST(pgp->areas);
 		pkt.mement = (uint8_t)(newmem - ARRAY_ARRAY(pgp->areas));
 		pkt.s.data = newmem->mem;
 		size -= 1;
+	}
 	switch(pkt.tag) {
 	case SIGNATURE_PKT:
 		if (!read_sigpkt(pgp, pkt.mement, &pkt.u.sigpkt, pkt.s.data, pkt.s.size)) {
 			return 0;
+		}
 		break;
 	case ONEPASS_SIGNATURE_PKT:
 		read_onepass_sig(&pkt.u.onepass, pkt.s.data);
 		break;
 	case PUBKEY_PKT:
 	case PUB_SUBKEY_PKT:
 		break;
 	case LITDATA_PKT:
 		read_litdata(pgp, &pkt.u.litdata, pkt.s.data, pkt.s.size);
 		break;
 	case TRUST_PKT:
 		pkt.u.trust.level = pkt.s.data[0];
 		pkt.u.trust.amount = pkt.s.data[1];
 		break;
 	case USERID_PKT:
 		pkt.u.userid.size = pkt.s.size;
 		pkt.u.userid.data = pkt.s.data;
 		break;
 	case COMPRESSED_DATA_PKT:
 		read_compressed(pgp, &pkt.u.compressed, pkt.s.data, pkt.s.size);
 		ARRAY_APPEND(pgp->pkts, pkt);
 		read_all_packets(pgp, &ARRAY_LAST(pgp->areas), pgp->op);
 		break;
 	case USER_ATTRIBUTE_PKT:
 		read_userattr(&pkt.u.userattr, pkt.s.data, pkt.s.size);
 		break;
 	default:
 		printf("hi, need to implement %d, offset %zu\n", pkt.tag, mem->cc);
 		break;
+	}
 	mem->cc += size;
 	if (pkt.tag != COMPRESSED_DATA_PKT) {
 		/* compressed was added earlier to preserve pkt ordering */
 		ARRAY_APPEND(pgp->pkts, pkt);
+	}
 	return 1;
+}
 /* checks the tag type of a packet */
 static int
 pkt_is(pgpv_t *pgp, int wanted)
+{
 	return (ARRAY_ELEMENT(pgp->pkts, pgp->pkt).tag == wanted);
+}
 /* checks the packet is a signature packet, and the signature type is the expected one */
 static int
 pkt_sigtype_is(pgpv_t *pgp, int wanted)
+{
 	if (!pkt_is(pgp, SIGNATURE_PKT)) {
 		return 0;
+	}
 	return (ARRAY_ELEMENT(pgp->pkts, pgp->pkt).u.sigpkt.sig.type == wanted);
+}
 /* check for expected type of packet, and move to the next */
 static int
 pkt_accept(pgpv_t *pgp, int expected)
+{
 	int	got;
 	if ((got = ARRAY_ELEMENT(pgp->pkts, pgp->pkt).tag) == expected) {
 		pgp->pkt += 1;
 		return 1;
+	}
 	printf("problem at token %zu, expcted %d, got %d\n", pgp->pkt, expected, got);
 	return 0;
+}
 /* recognise signature (and trust) packet */
 static int
 recog_signature(pgpv_t *pgp, pgpv_signature_t *signature)
+{
 	if (!pkt_is(pgp, SIGNATURE_PKT)) {
 		printf("recog_signature: not a signature packet\n");
 		return 0;
+	}
 	memcpy(signature, &ARRAY_ELEMENT(pgp->pkts, pgp->pkt).u.sigpkt.sig, sizeof(*signature));
 	pgp->pkt += 1;
 	if (pkt_is(pgp, TRUST_PKT)) {
 		pkt_accept(pgp, TRUST_PKT);
+	}
 	return 1;
+}
 /* recognise user id packet */
 static int
 recog_userid(pgpv_t *pgp, pgpv_signed_userid_t *userid)
+{
 	pgpv_signature_t	 signature;
 	pgpv_pkt_t		*pkt;
 	memset(userid, 0x0, sizeof(*userid));
 	if (!pkt_is(pgp, USERID_PKT)) {
 		printf("recog_userid: not %d\n", USERID_PKT);
 		return 0;
+	}
 	pkt = &ARRAY_ELEMENT(pgp->pkts, pgp->pkt);
 	userid->userid.size = pkt->s.size;
 	userid->userid.data = pkt->s.data;
 	pgp->pkt += 1;
 	while (pkt_is(pgp, SIGNATURE_PKT)) {
 		if (!recog_signature(pgp, &signature)) {
 			printf("recog_userid: can't recognise signature/trust\n");
 			return 0;
+		}
 		ARRAY_APPEND(userid->sigs, signature);
 		if (signature.primary_userid) {
 			userid->primary_userid = signature.primary_userid;
+		}
 		if (signature.revoked) {
 			userid->revoked = signature.revoked;
+		}
+	}
 	return 1;
+}
 /* recognise user attributes packet */
 static int
 recog_userattr(pgpv_t *pgp, pgpv_signed_userattr_t *userattr)
+{
 	pgpv_signature_t	 signature;
 	memset(userattr, 0x0, sizeof(*userattr));
 	if (!pkt_is(pgp, USER_ATTRIBUTE_PKT)) {
 		printf("recog_userattr: not %d\n", USER_ATTRIBUTE_PKT);
 		return 0;
+	}
 	userattr->userattr = ARRAY_ELEMENT(pgp->pkts, pgp->pkt).u.userattr;
 	pgp->pkt += 1;
 	while (pkt_is(pgp, SIGNATURE_PKT)) {
 		if (!recog_signature(pgp, &signature)) {
 			printf("recog_userattr: can't recognise signature/trust\n");
 			return 0;
+		}
 		ARRAY_APPEND(userattr->sigs, signature);
 		if (signature.revoked) {
 			userattr->revoked = signature.revoked;
+		}
+	}
 	return 1;
+}
 /* recognise a sub key */
 static int
 recog_subkey(pgpv_t *pgp, pgpv_signed_subkey_t *subkey)
+{
 	pgpv_signature_t	 signature;
 	pgpv_pkt_t		*pkt;
 	pkt = &ARRAY_ELEMENT(pgp->pkts, pgp->pkt);
 	memset(subkey, 0x0, sizeof(*subkey));
 	read_pubkey(&subkey->subkey, pkt->s.data, pkt->s.size, 0);
 	pgp->pkt += 1;
 	if (pkt_sigtype_is(pgp, SIGTYPE_KEY_REVOCATION) ||
 	    pkt_sigtype_is(pgp, SIGTYPE_SUBKEY_REVOCATION) ||
 	    pkt_sigtype_is(pgp, SIGTYPE_CERT_REVOCATION)) {
 		recog_signature(pgp, &signature);
 		subkey->revoc_self_sig = signature;
+	}
 	do {
 		if (!pkt_is(pgp, SIGNATURE_PKT)) {
 			printf("recog_subkey: not signature packet at %zu\n", pgp->pkt);
 			return 0;
+		}
 		if (!recog_signature(pgp, &signature)) {
 			printf("recog_subkey: bad signature/trust at %zu\n", pgp->pkt);
 			return 0;
+		}
 		ARRAY_APPEND(subkey->sigs, signature);
 		if (signature.keyexpiry) {
 			/* XXX - check it's a good key expiry */
 			subkey->subkey.expiry = signature.keyexpiry;
+		}
 	} while (pkt_is(pgp, SIGNATURE_PKT));
 	return 1;
+}
 /* use a sparse map for the text strings here to save space */
 static const char	*keyalgs[] = {
 	"[Unknown]",
 	"RSA (Encrypt or Sign)",
 	"RSA (Encrypt Only)",
 	"RSA (Sign Only)",
 	"Elgamal (Encrypt Only)",
 	"DSA",
 	"Elliptic Curve",
 	"ECDSA",
 	"Elgamal (Encrypt or Sign)"
 };
 #define MAX_KEYALG	21
 static const char *keyalgmap = "\0\01\02\03\0\0\0\0\0\0\0\0\0\0\0\0\04\05\06\07\010\011";
 /* return human readable name for key algorithm */
 static const char *
 fmtkeyalg(uint8_t keyalg)
+{
 	return keyalgs[(uint8_t)keyalgmap[(keyalg >= MAX_KEYALG) ? 0 : keyalg]];
+}
 /* return the number of bits in the public key */
 static unsigned
 numkeybits(const pgpv_pubkey_t *pubkey)
+{
 	switch(pubkey->keyalg) {
 	case PUBKEY_RSA_ENCRYPT_OR_SIGN:
 	case PUBKEY_RSA_ENCRYPT:
 	case PUBKEY_RSA_SIGN:
 		return pubkey->bn[RSA_N].bits;
 	case PUBKEY_DSA:
 	case PUBKEY_ECDSA:
 		return BITS_TO_BYTES(pubkey->bn[DSA_Q].bits) * 64;
 	case PUBKEY_ELGAMAL_ENCRYPT:
 	case PUBKEY_ELGAMAL_ENCRYPT_OR_SIGN:
 		return pubkey->bn[ELGAMAL_P].bits;
 	default:
 		return 0;
+	}
+}
 /* print a public key */
 static size_t
 fmt_pubkey(char *s, size_t size, pgpv_pubkey_t *pubkey, const char *leader)
+{
 	size_t	cc;
 	cc = snprintf(s, size, "%s %u/%s ", leader, numkeybits(pubkey), fmtkeyalg(pubkey->keyalg));
 	cc += fmt_binary(&s[cc], size - cc, pubkey->keyid, PGPV_KEYID_LEN);
 	cc += fmt_time(&s[cc], size - cc, " ", pubkey->birth, "", 0);
 	if (pubkey->expiry) {
 		cc += fmt_time(&s[cc], size - cc, " [Expiry ", pubkey->birth + pubkey->expiry, "]", 0);
+	}
 	cc += snprintf(&s[cc], size - cc, "\n");
 	cc += fmt_fingerprint(&s[cc], size - cc, &pubkey->fingerprint, "fingerprint: ");
 	return cc;
+}
 /* we add 1 to revocation value to denote compromised */
 #define COMPROMISED	(0x02 + 1)
 /* format a userid - used to order the userids when formatting */
 static size_t
 fmt_userid(char *s, size_t size, pgpv_primarykey_t *primary, uint8_t u)
+{
 	pgpv_signed_userid_t	*userid;
 	userid = &ARRAY_ELEMENT(primary->signed_userids, u);
 	return snprintf(s, size, "uid              %.*s%s\n",
 			(int)userid->userid.size, userid->userid.data,
 			(userid->revoked == COMPROMISED) ? " [COMPROMISED AND REVOKED]" :
 			(userid->revoked) ? " [REVOKED]" : "");
+}
 /* print a primary key, per RFC 4880 */
 static size_t
 fmt_primary(char *s, size_t size, pgpv_primarykey_t *primary)
+{
 	unsigned	 i;
 	size_t		 cc;
 	cc = fmt_pubkey(s, size, &primary->primary, "signature ");
 	cc += fmt_userid(&s[cc], size - cc, primary, primary->primary_userid);
 	for (i = 0 ; i < ARRAY_COUNT(primary->signed_userids) ; i++) {
 		if (i != primary->primary_userid) {
 			cc += fmt_userid(&s[cc], size - cc, primary, i);
+		}
+	}
 	for (i = 0 ; i < ARRAY_COUNT(primary->signed_subkeys) ; i++) {
 		cc += fmt_pubkey(&s[cc], size - cc, &ARRAY_ELEMENT(primary->signed_subkeys, i).subkey, "encryption");
+	}
 	cc += snprintf(&s[cc], size - cc, "\n");
 	return cc;
+}
 /* check the padding on the signature */
 static int
 rsa_padding_check_none(uint8_t *to, int tlen, const uint8_t *from, int flen, int num)
+{
 	USE_ARG(num);
 	if (flen > tlen) {
 		printf("from length larger than to length\n");
 		return -1;
+	}
 	(void) memset(to, 0x0, tlen - flen);
 	(void) memcpy(to + tlen - flen, from, flen);
 	return tlen;
+}
 #define RSA_MAX_MODULUS_BITS	16384
 #define RSA_SMALL_MODULUS_BITS	3072
 #define RSA_MAX_PUBEXP_BITS	64 /* exponent limit enforced for "large" modulus only */
 /* check against the exponent/moudulo operation */
 static int
 lowlevel_rsa_public_check(const uint8_t *encbuf, int enclen, uint8_t *dec, const rsa_pubkey_t *rsa)
+{
 	uint8_t		*decbuf;
 	BIGNUM		*decbn;
 	BIGNUM		*encbn;
 	int		 decbytes;
 	int		 nbytes;
 	int		 r;
 	nbytes = 0;
 	r = -1;
 	decbuf = NULL;
 	decbn = encbn = NULL;
 	if (BN_num_bits(rsa->n) > RSA_MAX_MODULUS_BITS) {
 		printf("rsa r modulus too large\n");
 		goto err;
+	}
 	if (BN_cmp(rsa->n, rsa->e) <= 0) {
 		printf("rsa r bad n value\n");
 		goto err;
+	}
 	if (BN_num_bits(rsa->n) > RSA_SMALL_MODULUS_BITS &&
 	    BN_num_bits(rsa->e) > RSA_MAX_PUBEXP_BITS) {
 		printf("rsa r bad exponent limit\n");
 		goto err;
+	}
 	if ((encbn = BN_new()) == NULL ||
 	    (decbn = BN_new()) == NULL ||
 	    (decbuf = calloc(1, nbytes = BN_num_bytes(rsa->n))) == NULL) {
 		printf("allocation failure\n");
 		goto err;
+	}
 	if (enclen > nbytes) {
 		printf("rsa r > mod len\n");
 		goto err;
+	}
 	if (BN_bin2bn(encbuf, enclen, encbn) == NULL) {
 		printf("null encrypted BN\n");
 		goto err;
+	}
 	if (BN_cmp(encbn, rsa->n) >= 0) {
 		printf("rsa r data too large for modulus\n");
 		goto err;
+	}
 	if (BN_mod_exp(decbn, encbn, rsa->e, rsa->n, NULL) < 0) {
 		printf("BN_mod_exp < 0\n");
 		goto err;
+	}
 	decbytes = BN_num_bytes(decbn);
 	(void) BN_bn2bin(decbn, decbuf);
 	if ((r = rsa_padding_check_none(dec, nbytes, decbuf, decbytes, 0)) < 0) {
 		printf("rsa r padding check failed\n");
+	}
 err:
 	BN_free(encbn);
 	BN_free(decbn);
 	if (decbuf != NULL) {
 		(void) memset(decbuf, 0x0, nbytes);
 		free(decbuf);
+	}
 	return r;
+}
 /* verify */
 static int
 rsa_public_decrypt(int enclen, const unsigned char *enc, unsigned char *dec, RSA *rsa, int padding)
+{
 	rsa_pubkey_t	pub;
 	int		ret;
 	if (enc == NULL || dec == NULL || rsa == NULL) {
 		return 0;
+	}
 	USE_ARG(padding);
 	(void) memset(&pub, 0x0, sizeof(pub));
 	pub.n = BN_dup(rsa->n);
 	pub.e = BN_dup(rsa->e);
 	ret = lowlevel_rsa_public_check(enc, enclen, dec, &pub);
 	BN_free(pub.n);
 	BN_free(pub.e);
 	return ret;
+}
 #define SUBKEY_LEN(x)	(80 + 80)
 #define SIG_LEN		80
 #define UID_LEN		80
 /* return worst case number of bytes needed to format a primary key */
 static size_t
 estimate_primarykey_size(pgpv_primarykey_t *primary)
+{
 	size_t		cc;
 	cc = SUBKEY_LEN("signature") +
 		(ARRAY_COUNT(primary->signed_userids) * UID_LEN) +
 		(ARRAY_COUNT(primary->signed_subkeys) * SUBKEY_LEN("encrypt uids"));
 	return cc;
+}
 /* use public decrypt to verify a signature */
 static int
 pgpv_rsa_public_decrypt(uint8_t *out, const uint8_t *in, size_t length, const pgpv_pubkey_t *pubkey)
+{
 	RSA            *orsa;
 	int             n;
 	if ((orsa = calloc(1, sizeof(*orsa))) == NULL) {
 		return 0;
+	}
 	orsa->n = pubkey->bn[RSA_N].bn;
 	orsa->e = pubkey->bn[RSA_E].bn;
 	n = rsa_public_decrypt((int)length, in, out, orsa, RSA_NO_PADDING);
 	orsa->n = orsa->e = NULL;
 	free(orsa);
 	return n;
+}
 /* verify rsa signature */
 static int
 rsa_verify(uint8_t *calculated, unsigned calclen, uint8_t hashalg, pgpv_bignum_t *bn, pgpv_pubkey_t *pubkey)
+{
 	unsigned	 prefixlen;
 	unsigned	 decryptc;
 	unsigned	 i;
 	uint8_t		 decrypted[8192];
 	uint8_t		 sigbn[8192];
 	uint8_t		 prefix[64];
 	size_t		 keysize;
 	keysize = BITS_TO_BYTES(pubkey->bn[RSA_N].bits);
 	BN_bn2bin(bn[RSA_SIG].bn, sigbn);
 	decryptc = pgpv_rsa_public_decrypt(decrypted, sigbn, BITS_TO_BYTES(bn[RSA_SIG].bits), pubkey);
 	if (decryptc != keysize || (decrypted[0] != 0 || decrypted[1] != 1)) {
 		return 0;
+	}
 	if ((prefixlen = digest_get_prefix((unsigned)hashalg, prefix, sizeof(prefix))) == 0) {
 		printf("rsa_verify: unknown hash algorithm: %d\n", hashalg);
 		return 0;
+	}
 	for (i = 2 ; i < keysize - prefixlen - calclen - 1 ; i++) {
 		if (decrypted[i] != 0xff) {
 			return 0;
+		}
+	}
 	if (decrypted[i++] != 0x0) {
 		return 0;
+	}
 	if (memcmp(&decrypted[i], prefix, prefixlen) != 0) {
 		printf("rsa_verify: wrong hash algorithm\n");
 		return 0;
+	}
 	return memcmp(&decrypted[i + prefixlen], calculated, calclen) == 0;
+}
 /* return 1 if bn <= 0 */
 static int
 bignum_is_bad(BIGNUM *bn)
+{
 	return BN_is_zero(bn) || BN_is_negative(bn);
+}
 #define BAD_BIGNUM(s, k)	\
 	(bignum_is_bad((s)->bn) || BN_cmp((s)->bn, (k)->bn) >= 0)
 #ifndef DSA_MAX_MODULUS_BITS
 #define DSA_MAX_MODULUS_BITS      10000
 #endif
 /* verify DSA signature */
 static int
 verify_dsa_sig(uint8_t *calculated, unsigned calclen, pgpv_bignum_t *sig, pgpv_pubkey_t *pubkey)
+{
 	unsigned	  qbits;
 	uint8_t		  calcnum[128];
 	uint8_t		  signum[128];
 	BIGNUM		 *M;
 	BIGNUM		 *W;
 	BIGNUM		 *t1;
 	int		  ret;
 	if (pubkey[DSA_P].bn == NULL || pubkey[DSA_Q].bn == NULL || pubkey[DSA_G].bn == NULL) {
 		return 0;
+	}
 	M = W = t1 = NULL;
 	qbits = pubkey->bn[DSA_Q].bits;
 	switch(qbits) {
 	case 160:
 	case 224:
 	case 256:
 		break;
 	default:
 		printf("dsa: bad # of Q bits\n");
 		return 0;
+	}
 	if (pubkey->bn[DSA_P].bits > DSA_MAX_MODULUS_BITS) {
 		printf("dsa: p too large\n");
 		return 0;
+	}
 	if (calclen > SHA256_DIGEST_LENGTH) {
 		printf("dsa: digest too long\n");
 		return 0;
+	}
 	ret = 0;
 	if ((M = BN_new()) == NULL || (W = BN_new()) == NULL || (t1 = BN_new()) == NULL ||
 	    BAD_BIGNUM(&sig[DSA_R], &pubkey->bn[DSA_Q]) ||
 	    BAD_BIGNUM(&sig[DSA_S], &pubkey->bn[DSA_Q]) ||
 	    BN_mod_inverse(W, sig[DSA_S].bn, pubkey->bn[DSA_Q].bn, NULL) == NULL) {
 		goto done;
+	}
 	if (calclen > qbits / 8) {
 		calclen = qbits / 8;
+	}
 	if (BN_bin2bn(calculated, (int)calclen, M) == NULL ||
 	    !BN_mod_mul(M, M, W, pubkey->bn[DSA_Q].bn, NULL) ||
 	    !BN_mod_mul(W, sig[DSA_R].bn, W, pubkey->bn[DSA_Q].bn, NULL) ||
 	    !BN_mod_exp(t1, pubkey->bn[DSA_G].bn, M, pubkey->bn[DSA_P].bn, NULL) ||
 	    !BN_mod_exp(W, pubkey->bn[DSA_Y].bn, W, pubkey->bn[DSA_P].bn, NULL) ||
 	    !BN_mod_mul(t1, t1, W, pubkey->bn[DSA_P].bn, NULL) ||
 	    !BN_div(NULL, t1, t1, pubkey->bn[DSA_Q].bn, NULL)) {
 		goto done;
+	}
 	/* only compare the first q bits */
 	BN_bn2bin(t1, calcnum);
 	BN_bn2bin(sig[DSA_R].bn, signum);
 	ret = memcmp(calcnum, signum, BITS_TO_BYTES(qbits)) == 0;
 done:
 	if (M) {
 		BN_free(M);
+	}
 	if (W) {
 		BN_free(W);
+	}
 	if (t1) {
 		BN_free(t1);
+	}
 	return ret;
+}
 #define TIME_SNPRINTF(_cc, _buf, _size, _fmt, _val)	do {		\
 	time_t	 _t;							\
 	char	*_s;							\
+									\
 	_t = _val;							\
 	_s = ctime(&_t);						\
 	_cc += snprintf(_buf, _size, _fmt, _s);				\
 } while(/*CONSTCOND*/0)
 /* check dates on signature and key are valid */
 static size_t
 valid_dates(pgpv_signature_t *signature, pgpv_pubkey_t *pubkey, char *buf, size_t size)
+{
 	time_t	 now;
 	time_t	 t;
 	size_t	 cc;
 	cc = 0;
 	if (signature->birth < pubkey->birth) {
 		TIME_SNPRINTF(cc, buf, size, "Signature time (%.24s) was before pubkey creation ", signature->birth);
 		TIME_SNPRINTF(cc, &buf[cc], size - cc, "(%s)\n", pubkey->birth);
 		return cc;
+	}
 	now = time(NULL);
 	if (signature->expiry != 0) {
 		if ((t = signature->birth + signature->expiry) < now) {
 			TIME_SNPRINTF(cc, buf, size, "Signature expired on %.24s\n", t);
 			return cc;
+		}
+	}
 	if (now < signature->birth) {
 		TIME_SNPRINTF(cc, buf, size, "Signature not valid before %.24s\n", signature->birth);
 		return cc;
+	}
 	return 0;
+}
 /* check if the signing key has expired */
 static int
 key_expired(pgpv_pubkey_t *pubkey, char *buf, size_t size)
+{
 	time_t	 now;
 	time_t	 t;
 	size_t	 cc;
 	now = time(NULL);
 	cc = 0;
 	if (pubkey->expiry != 0) {
 		if ((t = pubkey->birth + pubkey->expiry) < now) {
 			TIME_SNPRINTF(cc, buf, size, "Pubkey expired on %.24s\n", t);
 			return (int)cc;
+		}
+	}
 	if (now < pubkey->birth) {
 		TIME_SNPRINTF(cc, buf, size, "Pubkey not valid before %.24s\n", pubkey->birth);
 		return (int)cc;
+	}
 	return 0;
+}
 /* find the leading onepass packet */
 static size_t
 find_onepass(pgpv_cursor_t *cursor, size_t datastart)
+{
 	size_t	pkt;
 	for (pkt = datastart ; pkt < ARRAY_COUNT(cursor->pgp->pkts) ; pkt++) {
 		if (ARRAY_ELEMENT(cursor->pgp->pkts, pkt).tag == ONEPASS_SIGNATURE_PKT) {
 			return pkt + 1;
+		}
+	}
 	snprintf(cursor->why, sizeof(cursor->why), "No signature to verify");
 	return 0;
+}
 static const char	*armor_begins[] = {
 	"-----BEGIN PGP SIGNED MESSAGE-----\n",
 	"-----BEGIN PGP MESSAGE-----\n",
 	NULL
 };
 /* return non-zero if the buf introduces an armored message */
 static int
 is_armored(const char *buf, size_t size)
+{
 	const char	**arm;
 	const char	 *nl;
 	size_t		  n;
 	if ((nl = memchr(buf, '\n', size)) == NULL) {
 		return 0;
+	}
 	n = (size_t)(nl - buf);
 	for (arm = armor_begins ; *arm ; arm++) {
 		if (strncmp(buf, *arm, n) == 0) {
 			return 1;
+		}
+	}
 	return 0;
+}
 #define SIGSTART	"-----BEGIN PGP SIGNATURE-----\n"
 #define SIGEND		"-----END PGP SIGNATURE-----\n"
 /* for ascii armor, we don't get a onepass packet - make one */
 static const char 	*cons_onepass = "\304\015\003\0\0\0\0\377\377\377\377\377\377\377\377\1";
 /* read ascii armor */
 static int
 read_ascii_armor(pgpv_cursor_t *cursor, pgpv_mem_t *mem, const char *filename)
+{
 	pgpv_onepass_t	*onepass;
 	pgpv_sigpkt_t	*sigpkt;
 	pgpv_pkt_t	 litdata;
 	uint8_t		 binsig[8192];
 	uint8_t		*datastart;
 	uint8_t		*sigend;
 	uint8_t		*p;
 	size_t		 binsigsize;
 	/* cons up litdata pkt */
 	memset(&litdata, 0x0, sizeof(litdata));
 	litdata.u.litdata.mem = ARRAY_COUNT(cursor->pgp->areas) - 1;
 	p = mem->mem;
 	/* jump over signed message line */
 	if ((p = memmem(mem->mem, mem->size, "\n\n",  2)) == NULL) {
 		snprintf(cursor->why, sizeof(cursor->why), "malformed armor at offset 0");
 		return 0;
+	}
 	p += 2;
 	litdata.tag = LITDATA_PKT;
 	litdata.s.data = p;
 	litdata.u.litdata.offset = (size_t)(p - mem->mem);
 	litdata.u.litdata.filename = (uint8_t *)strdup(filename);
 	if ((p = memmem(datastart = p, mem->size - litdata.offset, SIGSTART, strlen(SIGSTART))) == NULL) {
 		snprintf(cursor->why, sizeof(cursor->why),
 			"malformed armor - no sig - at %zu", (size_t)(p - mem->mem));
 		return 0;
+	}
 	litdata.u.litdata.len = litdata.s.size = (size_t)(p - datastart);
 	p += strlen(SIGSTART);
 	if ((p = memmem(p, mem->size, "\n\n",  2)) == NULL) {
 		snprintf(cursor->why, sizeof(cursor->why),
 			"malformed armed signature at %zu", (size_t)(p - mem->mem));
 		return 0;
+	}
 	p += 2;
 	sigend = memmem(p, mem->size, SIGEND, strlen(SIGEND));
 	binsigsize = b64decode((char *)p, (size_t)(sigend - p), binsig, sizeof(binsig));
 	read_binary_memory(cursor->pgp, "signature", cons_onepass, 15);
 	ARRAY_APPEND(cursor->pgp->pkts, litdata);
 	read_binary_memory(cursor->pgp, "signature", binsig, binsigsize - 3);
 	/* XXX - hardwired - 3 is format and length */
 	/* fix up packets in the packet array now we have them there */
 	onepass = &ARRAY_ELEMENT(cursor->pgp->pkts, ARRAY_COUNT(cursor->pgp->pkts) - 1 - 2).u.onepass;
 	sigpkt = &ARRAY_LAST(cursor->pgp->pkts).u.sigpkt;
 	memcpy(onepass->keyid, sigpkt->sig.signer, sizeof(onepass->keyid));
 	onepass->hashalg = sigpkt->sig.hashalg;
 	onepass->keyalg = sigpkt->sig.keyalg;
 	return 1;
+}
 /* read ascii armor from a file */
 static int
 read_ascii_armor_file(pgpv_cursor_t *cursor, const char *filename)
+{
 	/* cons up litdata pkt */
 	read_file(cursor->pgp, filename);
 	return read_ascii_armor(cursor, &ARRAY_LAST(cursor->pgp->areas), filename);
+}
 /* read ascii armor from memory */
 static int
 read_ascii_armor_memory(pgpv_cursor_t *cursor, const void *p, size_t size)
+{
 	pgpv_mem_t	*mem;
 	/* cons up litdata pkt */
 	ARRAY_EXPAND(cursor->pgp->areas);
 	ARRAY_COUNT(cursor->pgp->areas) += 1;
 	mem = &ARRAY_LAST(cursor->pgp->areas);
 	memset(mem, 0x0, sizeof(*mem));
 	mem->size = size;
 	mem->mem = __UNCONST(p);
 	mem->dealloc = 0;
 	return read_ascii_armor(cursor, mem, "[stdin]");
+}
 /* set up the data to verify */
 static int
 setup_data(pgpv_cursor_t *cursor, pgpv_t *pgp, const void *p, ssize_t size)
+{
 	FILE		*fp;
 	char		 buf[BUFSIZ];
 	if (cursor == NULL || pgp == NULL || p == NULL) {
 		return 0;
+	}
 	memset(cursor, 0x0, sizeof(*cursor));
 	ARRAY_APPEND(pgp->datastarts, pgp->pkt);
 	cursor->pgp = pgp;
 	if (size < 0) {
 		/* we have a file name in p */
 		if ((fp = fopen(p, "r")) == NULL) {
 			snprintf(cursor->why, sizeof(cursor->why), "No such file '%s'", (const char *)p);
 			return 0;
+		}
 		if (fgets(buf, (int)sizeof(buf), fp) == NULL) {
 			fclose(fp);
 			snprintf(cursor->why, sizeof(cursor->why), "can't read file '%s'", (const char *)p);
 			return 0;
+		}
 		if (is_armored(buf, sizeof(buf))) {
 			read_ascii_armor_file(cursor, p);
 		} else {
-			read_binary_file(pgp, "signature", "%s", p);
+			read_binary_file(pgp, "signature", "%s", (const char *)p);
+		}
 		fclose(fp);
 	} else {
 		if (is_armored(p, (size_t)size)) {
 			read_ascii_armor_memory(cursor, p, (size_t)size);
 		} else {
 			read_binary_memory(pgp, "signature", p, (size_t)size);
+		}
+	}
 	return 1;
+}
 /* get the data and size from litdata packet */
 static uint8_t *
 get_literal_data(pgpv_cursor_t *cursor, pgpv_litdata_t *litdata, size_t *size)
+{
 	pgpv_mem_t	*mem;
 	if (litdata->s.data == NULL && litdata->s.size == 0) {
 		mem = &ARRAY_ELEMENT(cursor->pgp->areas, litdata->mem);
 		*size = litdata->len;
 		return &mem->mem[litdata->offset];
+	}
 	*size = litdata->s.size;
 	return litdata->s.data;
+}
 /*
 RFC 4880 describes the structure of v4 keys as:
            Primary-Key
               [Revocation Self Signature]
               [Direct Key Signature...]
                User ID [Signature ...]
               [User ID [Signature ...] ...]
               [User Attribute [Signature ...] ...]
               [[Subkey [Binding-Signature-Revocation]
                       Primary-Key-Binding-Signature] ...]
 and that's implemented below as a recursive descent parser.
 It has had to be modified, though: see the comment
 	some keys out there have user ids where they shouldn't
 to look like:
            Primary-Key
               [Revocation Self Signature]
               [Direct Key Signature...]
               [User ID [Signature ...]
                  [User ID [Signature ...] ...]
                  [User Attribute [Signature ...] ...]
                  [Subkey [Binding-Signature-Revocation]
                         Primary-Key-Binding-Signature] ...]
 to accommodate keyrings set up by gpg
 */
 /* recognise a primary key */
 static int
 recog_primary_key(pgpv_t *pgp, pgpv_primarykey_t *primary)
+{
 	pgpv_signed_userattr_t	 userattr;
 	pgpv_signed_userid_t	 userid;
 	pgpv_signed_subkey_t	 subkey;
 	pgpv_signature_t	 signature;
 	pgpv_pkt_t		*pkt;
 	pkt = &ARRAY_ELEMENT(pgp->pkts, pgp->pkt);
 	memset(primary, 0x0, sizeof(*primary));
 	read_pubkey(&primary->primary, pkt->s.data, pkt->s.size, 0);
 	pgp->pkt += 1;
 	if (pkt_sigtype_is(pgp, SIGTYPE_KEY_REVOCATION)) {
 		if (!recog_signature(pgp, &primary->revoc_self_sig)) {
 			printf("recog_primary_key: no signature/trust at PGPV_SIGTYPE_KEY_REVOCATION\n");
 			return 0;
+		}
+	}
 	while (pkt_sigtype_is(pgp, SIGTYPE_DIRECT_KEY)) {
 		if (!recog_signature(pgp, &signature)) {
 			printf("recog_primary_key: no signature/trust at PGPV_SIGTYPE_DIRECT_KEY\n");
 			return 0;
+		}
 		if (signature.keyexpiry) {
 			/* XXX - check it's a good key expiry */
 			primary->primary.expiry = signature.keyexpiry;
+		}
 		ARRAY_APPEND(primary->direct_sigs, signature);
+	}
 	/* some keys out there have user ids where they shouldn't */
 	do {
 		if (!recog_userid(pgp, &userid)) {
 			printf("recog_primary_key: not userid\n");
 			return 0;
+		}
 		ARRAY_APPEND(primary->signed_userids, userid);
 		if (userid.primary_userid) {
 			primary->primary_userid = ARRAY_COUNT(primary->signed_userids) - 1;
+		}
 		while (pkt_is(pgp, USERID_PKT)) {
 			if (!recog_userid(pgp, &userid)) {
 				printf("recog_primary_key: not signed secondary userid\n");
 				return 0;
+			}
 			ARRAY_APPEND(primary->signed_userids, userid);
 			if (userid.primary_userid) {
 				primary->primary_userid = ARRAY_COUNT(primary->signed_userids) - 1;
+			}
+		}
 		while (pkt_is(pgp, USER_ATTRIBUTE_PKT)) {
 			if (!recog_userattr(pgp, &userattr)) {
 				printf("recog_primary_key: not signed user attribute\n");
 				return 0;
+			}
 			ARRAY_APPEND(primary->signed_userattrs, userattr);
+		}
 		while (pkt_is(pgp, PUB_SUBKEY_PKT)) {
 			if (!recog_subkey(pgp, &subkey)) {
 				printf("recog_primary_key: not signed public subkey\n");
 				return 0;
+			}
 			pgpv_calc_keyid(&subkey.subkey);
 			ARRAY_APPEND(primary->signed_subkeys, subkey);
+		}
 	} while (pgp->pkt < ARRAY_COUNT(pgp->pkts) && pkt_is(pgp, USERID_PKT));
 	primary->fmtsize = estimate_primarykey_size(primary);
 	return 1;
+}
 /* parse all of the packets for a given operation */
 static int
 read_all_packets(pgpv_t *pgp, pgpv_mem_t *mem, const char *op)
+{
 	pgpv_primarykey_t	 primary;
 	if (op == NULL) {
 		return 0;
+	}
 	if (strcmp(pgp->op = op, "pubring") == 0) {
 		mem->allowed = PUBRING_ALLOWED;
 		/* pubrings have thousands of small packets */
 		ARRAY_EXPAND_SIZED(pgp->pkts, 0, 5000);
 	} else if (strcmp(op, "signature") == 0) {
 		mem->allowed = SIGNATURE_ALLOWED;
 	} else {
 		mem->allowed = "";
+	}
 	for (mem->cc = 0; mem->cc < mem->size ; ) {
 		if (!read_pkt(pgp, mem)) {
 			return 0;
+		}
+	}
 	if (strcmp(op, "pubring") == 0) {
 		for (pgp->pkt = 0; pgp->pkt < ARRAY_COUNT(pgp->pkts) && recog_primary_key(pgp, &primary) ; ) {
 			pgpv_calc_keyid(&primary.primary);
 			ARRAY_APPEND(pgp->primaries, primary);
+		}
 		if (pgp->pkt < ARRAY_COUNT(pgp->pkts)) {
 			printf("short pubring recognition???\n");
+		}
+	}
 	pgp->pkt = ARRAY_COUNT(pgp->pkts);
 	return 1;
+}
 /* create a filename, read it, and then parse according to "op" */
 static int
 read_binary_file(pgpv_t *pgp, const char *op, const char *fmt, ...)
+{
 	va_list	args;
 	char	buf[1024];
 	va_start(args, fmt);
 	vsnprintf(buf, sizeof(buf), fmt, args);
 	va_end(args);
 	if (!read_file(pgp, buf)) {
 		return 0;
+	}
 	return read_all_packets(pgp, &ARRAY_LAST(pgp->areas), op);
+}
 /* parse memory according to "op" */
 static int
 read_binary_memory(pgpv_t *pgp, const char *op, const void *memory, size_t size)
+{
 	pgpv_mem_t	*mem;
 	ARRAY_EXPAND(pgp->areas);
 	ARRAY_COUNT(pgp->areas) += 1;
 	mem = &ARRAY_LAST(pgp->areas);
 	memset(mem, 0x0, sizeof(*mem));
 	mem->size = size;
 	mem->mem = __UNCONST(memory);
 	mem->dealloc = 0;
 	return read_all_packets(pgp, mem, op);
+}
 /* fixup the detached signature packets */
 static int
 fixup_detached(pgpv_cursor_t *cursor, const char *f)
+{
 	pgpv_onepass_t	*onepass;
 	const char	*dot;
 	pgpv_pkt_t	 sigpkt;
 	pgpv_pkt_t	 litdata;
 	pgpv_mem_t	*mem;
 	size_t		 el;
 	char		 original[MAXPATHLEN];
 	/* cons up litdata pkt */
 	if ((dot = strrchr(f, '.')) == NULL || strcasecmp(dot, ".sig") != 0) {
 		printf("weird filename '%s'\n", f);
 		return 0;
+	}
 	/* hold sigpkt in a temp var while we insert onepass and litdata */
 	el = ARRAY_COUNT(cursor->pgp->pkts) - 1;
 	sigpkt = ARRAY_ELEMENT(cursor->pgp->pkts, el);
 	ARRAY_DELETE(cursor->pgp->pkts, el);
 	ARRAY_EXPAND(cursor->pgp->pkts);
 	/* get onepass packet, append to packets */
 	read_binary_memory(cursor->pgp, "signature", cons_onepass, 15);
 	onepass = &ARRAY_ELEMENT(cursor->pgp->pkts, el).u.onepass;
 	/* read the original file into litdata */
 	snprintf(original, sizeof(original), "%.*s", (int)(dot - f), f);
 	if (!read_file(cursor->pgp, original)) {
 		printf("can't read file '%s'\n", original);
 		return 0;
+	}
 	memset(&litdata, 0x0, sizeof(litdata));
 	mem = &ARRAY_LAST(cursor->pgp->areas);
 	litdata.tag = LITDATA_PKT;
 	litdata.s.data = mem->mem;
 	litdata.u.litdata.format = LITDATA_BINARY;
 	litdata.u.litdata.offset = 0;
 	litdata.u.litdata.filename = (uint8_t *)strdup(original);
 	litdata.u.litdata.mem = ARRAY_COUNT(cursor->pgp->areas) - 1;
 	litdata.u.litdata.len = litdata.s.size = mem->size;
 	ARRAY_APPEND(cursor->pgp->pkts, litdata);
 	ARRAY_APPEND(cursor->pgp->pkts, sigpkt);
 	memcpy(onepass->keyid, sigpkt.u.sigpkt.sig.signer, sizeof(onepass->keyid));
 	onepass->hashalg = sigpkt.u.sigpkt.sig.hashalg;
 	onepass->keyalg = sigpkt.u.sigpkt.sig.keyalg;
 	return 1;
+}
 /* match the calculated signature against the oen in the signature packet */
 static int
 match_sig(pgpv_cursor_t *cursor, pgpv_signature_t *signature, pgpv_pubkey_t *pubkey, uint8_t *data, size_t size)
+{
 	unsigned	calclen;
 	uint8_t		calculated[64];
 	int		match;
 	calclen = pgpv_digest_memory(calculated, sizeof(calculated),
 		data, size,
 		get_ref(&signature->hashstart), signature->hashlen,
 		(signature->type == SIGTYPE_TEXT) ? 't' : 'b');
 	if (ALG_IS_RSA(signature->keyalg)) {
 		match = rsa_verify(calculated, calclen, signature->hashalg, signature->bn, pubkey);
 	} else if (ALG_IS_DSA(signature->keyalg)) {
 		match = verify_dsa_sig(calculated, calclen, signature->bn, pubkey);
 	} else {
 		snprintf(cursor->why, sizeof(cursor->why), "Signature type %u not recognised", signature->keyalg);
 		return 0;
+	}
 	if (!match && signature->type == SIGTYPE_TEXT) {
 		/* second try for cleartext data, ignoring trailing whitespace */
 		calclen = pgpv_digest_memory(calculated, sizeof(calculated),
 			data, size,
 			get_ref(&signature->hashstart), signature->hashlen, 'w');
 		if (ALG_IS_RSA(signature->keyalg)) {
 			match = rsa_verify(calculated, calclen, signature->hashalg, signature->bn, pubkey);
 		} else if (ALG_IS_DSA(signature->keyalg)) {
 			match = verify_dsa_sig(calculated, calclen, signature->bn, pubkey);
+		}
+	}
 	if (!match) {
 		snprintf(cursor->why, sizeof(cursor->why), "Signature on data did not match");
 		return 0;
+	}
 	if (valid_dates(signature, pubkey, cursor->why, sizeof(cursor->why)) > 0) {
 		return 0;
+	}
 	if (key_expired(pubkey, cursor->why, sizeof(cursor->why))) {
 		return 0;
+	}
 	if (signature->revoked) {
 		snprintf(cursor->why, sizeof(cursor->why), "Signature was revoked");
 		return 0;
+	}
 	return 1;
+}
 /* check return value from getenv */
 static const char *
 nonnull_getenv(const char *key)
+{
 	char	*value;
 	return ((value = getenv(key)) == NULL) ? "" : value;
+}
 /************************************************************************/
 /* start of exported functions */
 /************************************************************************/
 /* close all stuff */
 int
 pgpv_close(pgpv_t *pgp)
+{
 	unsigned	i;
 	if (pgp == NULL) {
 		return 0;
+	}
 	for (i = 0 ; i < ARRAY_COUNT(pgp->areas) ; i++) {
 		if (ARRAY_ELEMENT(pgp->areas, i).size > 0) {
 			closemem(&ARRAY_ELEMENT(pgp->areas, i));
+		}
+	}
 	return 1;
+}
 /* return the formatted entry for the primary key desired */
 size_t
 pgpv_get_entry(pgpv_t *pgp, unsigned ent, char **ret)
+{
 	size_t	cc;
 	if (ret == NULL || pgp == NULL || ent >= ARRAY_COUNT(pgp->primaries)) {
 		return 0;
+	}
 	*ret = NULL;
 	cc = ARRAY_ELEMENT(pgp->primaries, ent).fmtsize;
 	if ((*ret = calloc(1, cc)) == NULL) {
 		return 0;
+	}
 	return fmt_primary(*ret, cc, &ARRAY_ELEMENT(pgp->primaries, ent));
+}
 /* find key id */
 int
 pgpv_find_keyid(pgpv_t *pgp, const char *strkeyid, uint8_t *keyid)
+{
 	unsigned	 i;
 	uint8_t		 binkeyid[PGPV_KEYID_LEN];
 	size_t		 off;
 	size_t		 cmp;
 	if (strkeyid == NULL && keyid == NULL) {
 		return 0;
+	}
 	if (strkeyid) {
 		str_to_keyid(strkeyid, binkeyid);
 		cmp = strlen(strkeyid) / 2;
 	} else {
 		memcpy(binkeyid, keyid, sizeof(binkeyid));
 		cmp = PGPV_KEYID_LEN;
+	}
 	off = PGPV_KEYID_LEN - cmp;
 	for (i = 0 ; i < ARRAY_COUNT(pgp->primaries) ; i++) {
 		if (memcmp(&ARRAY_ELEMENT(pgp->primaries, i).primary.keyid[off], &binkeyid[off], cmp) == 0) {
 			return i;
+		}
+	}
 	return -1;
+}
 /* verify the signed packets we have */
 size_t
 pgpv_verify(pgpv_cursor_t *cursor, pgpv_t *pgp, const void *p, ssize_t size)
+{
 	pgpv_signature_t	*signature;
 	pgpv_onepass_t		*onepass;
 	pgpv_litdata_t		*litdata;
 	pgpv_pubkey_t		*pubkey;
 	unsigned		 primary;
 	uint8_t			*data;
 	size_t			 pkt;
 	size_t			 insize;
 	char			 strkeyid[PGPV_STR_KEYID_LEN];
 	int			 j;
 	if (cursor == NULL || pgp == NULL || p == NULL) {
 		return 0;
+	}
 	if (!setup_data(cursor, pgp, p, size)) {
 		snprintf(cursor->why, sizeof(cursor->why), "No input data");
 		return 0;
+	}
 	if (ARRAY_COUNT(cursor->pgp->pkts) == ARRAY_LAST(cursor->pgp->datastarts) + 1) {
 		/* got detached signature here */
 		if (!fixup_detached(cursor, p)) {
 			snprintf(cursor->why, sizeof(cursor->why), "Can't read signed file '%s'", (const char *)p);
 			return 0;
+		}
+	}
 	if ((pkt = find_onepass(cursor, ARRAY_LAST(cursor->pgp->datastarts))) == 0) {
 		snprintf(cursor->why, sizeof(cursor->why), "No signature found");
 		return 0;
+	}
 	pkt -= 1;
 	onepass = &ARRAY_ELEMENT(cursor->pgp->pkts, pkt).u.onepass;
 	litdata = &ARRAY_ELEMENT(cursor->pgp->pkts, pkt + 1).u.litdata;
 	signature = &ARRAY_ELEMENT(cursor->pgp->pkts, pkt + 2).u.sigpkt.sig;
 	/* sanity check values in signature and onepass agree */
 	if (signature->birth == 0) {
 		fmt_time(cursor->why, sizeof(cursor->why), "Signature creation time [",
 			signature->birth, "] out of range", 0);
 		return 0;
+	}
 	if (memcmp(onepass->keyid, signature->signer, PGPV_KEYID_LEN) != 0) {
 		fmt_binary(strkeyid, sizeof(strkeyid), onepass->keyid, (unsigned)sizeof(onepass->keyid));
 		snprintf(cursor->why, sizeof(cursor->why), "Signature key id %s does not match onepass keyid",
 			strkeyid);
 		return 0;
+	}
 	if (onepass->hashalg != signature->hashalg) {
 		snprintf(cursor->why, sizeof(cursor->why), "Signature hashalg %u does not match onepass hashalg %u",
 			signature->hashalg, onepass->hashalg);
 		return 0;
+	}
 	if (onepass->keyalg != signature->keyalg) {
 		snprintf(cursor->why, sizeof(cursor->why), "Signature keyalg %u does not match onepass keyalg %u",
 			signature->keyalg, onepass->keyalg);
 		return 0;
+	}
 	if ((j = pgpv_find_keyid(cursor->pgp, NULL, onepass->keyid)) < 0) {
 		fmt_binary(strkeyid, sizeof(strkeyid), onepass->keyid, (unsigned)sizeof(onepass->keyid));
 		snprintf(cursor->why, sizeof(cursor->why), "Signature key id %s not found ", strkeyid);
 		return 0;
+	}
 	primary = (unsigned)j;
 	pubkey = &ARRAY_ELEMENT(cursor->pgp->primaries, primary).primary;
 	cursor->sigtime = signature->birth;
 	/* calc hash on data packet */
 	data = get_literal_data(cursor, litdata, &insize);
 	if (!match_sig(cursor, signature, pubkey, data, insize)) {
 		return 0;
+	}
 	ARRAY_APPEND(cursor->datacookies, pkt);
 	ARRAY_APPEND(cursor->found, primary);
 	return pkt + 1;
+}
 /* set up the pubkey keyring */
 int
 pgpv_read_pubring(pgpv_t *pgp, const void *keyring, ssize_t size)
+{
 	if (pgp == NULL) {
 		return 0;
+	}
 	if (keyring) {
 		return (size > 0) ?
 			read_binary_memory(pgp, "pubring", keyring, (size_t)size) :
 			read_binary_file(pgp, "pubring", "%s", (const char *)keyring);
+	}
 	return read_binary_file(pgp, "pubring", "%s/%s", nonnull_getenv("HOME"), ".gnupg/pubring.gpg");
+}
 /* get verified data as a string, return its size */
 size_t
 pgpv_get_verified(pgpv_cursor_t *cursor, size_t cookie, char **ret)
+{
 	pgpv_litdata_t		*litdata;
 	uint8_t			*data;
 	size_t			 size;
 	size_t			 pkt;
 	if (ret == NULL || cursor == NULL || cookie == 0) {
 		return 0;
+	}
 	*ret = NULL;
 	if ((pkt = find_onepass(cursor, cookie - 1)) == 0) {
 		return 0;
+	}
 	litdata = &ARRAY_ELEMENT(cursor->pgp->pkts, pkt).u.litdata;
 	data = get_literal_data(cursor, litdata, &size);
 	if ((*ret = calloc(1, size)) == NULL) {
 		return 0;
+	}
 	memcpy(*ret, data, size);
 	return size;
+}