Fixed the new key selection code

20 files changed, 211 insertions, 94 deletions

diff --git a/TODO b/TODO
index 3c01ffa12..447667a06 100644
--- a/TODO
+++ b/TODO
@@ -1,10 +1,13 @@
 
+  * check whether we can remove all the expire stuff in trustdb because this
+    is now done getkey.  
+
+  * ask for alternate filename?
+
   * Can we output things like the preferences?      
 
   * Add Dave's UTS patches
 
-  * Fix revoked subkey problem - see key 621cc013
-
   ** Check whether the use of -u and --clearsign created 2 signatures.
      removed dups from the skclist.
 
@@ -43,6 +46,7 @@
 
   * Add a way to show the fingerprint of an key signator's keys
 
+  * New option --file-remove path-to-wipe-program ?
 
 Scheduled for 1.1
 -----------------
diff --git a/checks/ChangeLog b/checks/ChangeLog
index 4fa2cb38b..c90710c60 100644
--- a/checks/ChangeLog
+++ b/checks/ChangeLog
@@ -1,3 +1,8 @@
+2001-02-12  Werner Koch  <[email protected]>
+
+	* multisig.test: new
+	* Makefile.am (TESTS): Added.
+
 2000-10-18  Werner Koch  <[email protected]>
 
 	* conventional-mdc.test: Add Rijndael and fix for empty plain texts.
diff --git a/checks/run-gpg.patterns b/checks/run-gpg.patterns
index 76cf6073a..a4eb47d41 100644
--- a/checks/run-gpg.patterns
+++ b/checks/run-gpg.patterns
@@ -11,3 +11,4 @@ gpg: NOTE: signature key expired
 NOTE: this is a development version!
 gpg: encrypted with 
 "test two (no pp) <[email protected]>"
+gpg: using secondary key
diff --git a/doc/ChangeLog b/doc/ChangeLog
index e7759a070..b9350b7df 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,7 @@
+2001-03-03  Werner Koch  <[email protected]>
+
+	* gpg.sgml: Tell something about the 0x12345678! key ID syntax.
+
 2001-01-18  Werner Koch  <[email protected]>
 
 	* README.W32: Changed building instructions for MinGW32/CPD 0.3 
diff --git a/doc/DETAILS b/doc/DETAILS
index 8577c13b2..731d7c091 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -67,6 +67,9 @@ more arguments in future versions.
 
     GOODSIG	<long keyid>  <username>
 	The signature with the keyid is good.
+        For each signature only one of the three codes GOODSIG, BADSIG
+        or ERRSIG will be emitted and they may be used as a marker for
+        a new signature.
 
     BADSIG	<long keyid>  <username>
 	The signature with the keyid has not been verified okay.
@@ -82,7 +85,7 @@ more arguments in future versions.
     VALIDSIG	<fingerprint in hex> <sig_creation_date> <sig-timestamp>
 	The signature with the keyid is good. This is the same
 	as GOODSIG but has the fingerprint as the argument. Both
-	status lines ere emitted for a good signature.
+	status lines are emitted for a good signature.
 	sig-timestamp is the signature creation time in seconds after
 	the epoch.
 
diff --git a/doc/gpg.sgml b/doc/gpg.sgml
index 48647fcd3..67af72bc7 100644
--- a/doc/gpg.sgml
+++ b/doc/gpg.sgml
@@ -1532,6 +1532,13 @@ in front.
 
     </variablelist>
 
+    <para>
+Note that you can append an exclamation mark to key IDs or
+fingerprints.  This flag which tells GnuPG to use exactly
+that primary or secondary key and don't try to figure out which 
+secondary or primary key to use.
+    </para>
+
 </refsect1>
 
 
diff --git a/g10/ChangeLog b/g10/ChangeLog
index 9c468a8e0..e21ec46e9 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,29 @@
+2001-03-03  Werner Koch  <[email protected]>
+
+	* getkey.c: Introduced a new lookup context flag "exact" and used 
+	it in all place where we once used primary.
+	(classify_user_id2): Replaced the old function and add an extra
+	argument to return whether an exact keyID has been requested.
+	(key_byname): Removed the unused ctx.primary flag
+	(get_seckey_byname2): Ditto.
+	(finish_lookup): Changed debugging output.
+
+2001-03-02  Werner Koch  <[email protected]>
+
+	* keylist.c (list_one): Remove the merge key calls. 
+
+2001-03-01  Werner Koch  <[email protected]>
+
+	* getkey.c (finish_lookup): Don't use it if we no specific usage
+	has been requested.
+	(merge_selfsigs_main): fix UID only if we have an signature.
+	(lookup): Return UNU_PUBKEY etc. instead of NO_PUBKEY if we found
+	a key but the requested usage does not allow this key.
+	* import.c (import_one): Take UNU_PUBKEY into account.
+	* mainproc.c (list_node): Ditto.
+	* keylist.c (list_keyblock): Ditto.
+	* keyedit.c (print_and_check_one_sig): Ditto. 
+
 2001-02-09  Werner Koch  <[email protected]>
 
 	* delkey.c (delete_key): Removed that silly assert which rendered
@@ -121,7 +147,7 @@
 	* g10.c: New option --allow-secret-key-import.
 	* import.c (import_keys,import_keys_stream): Honor this option.
 	(import): New arg allow_secret and pass that arg down to ...
-	(import_secret_one): to this and print a warnign if secret key
+	(import_secret_one): to this and print a warning if secret key
 	importing is not allowed.
 
 2000-12-05  Werner Koch  <[email protected]>
diff --git a/g10/getkey.c b/g10/getkey.c
index 25bd9ba23..b58dbccac 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -97,8 +97,7 @@ typedef struct {
 } getkey_item_t;
 
 struct getkey_ctx_s {
-    /* make an array or a linked list from dome fields */
-    int primary;
+    int exact;
     KBNODE keyblock;
     KBPOS  kbpos;
     KBNODE found_key; /* pointer into some keyblock */
@@ -418,6 +417,7 @@ get_pubkey( PKT_public_key *pk, u32 *keyid )
     {	struct getkey_ctx_s ctx;
         KBNODE kb = NULL;
 	memset( &ctx, 0, sizeof ctx );
+        ctx.exact = 1; /* use the key ID exactly as given */
 	ctx.not_allocated = 1;
 	ctx.nitems = 1;
 	ctx.items[0].mode = 11;
@@ -473,6 +473,7 @@ get_pubkeyblock( u32 *keyid )
     KBNODE keyblock = NULL;
 
     memset( &ctx, 0, sizeof ctx );
+    /* co need to set exact here because we want the entire block */
     ctx.not_allocated = 1;
     ctx.nitems = 1;
     ctx.items[0].mode = 11;
@@ -498,6 +499,7 @@ get_seckey( PKT_secret_key *sk, u32 *keyid )
     KBNODE kb = NULL;
 
     memset( &ctx, 0, sizeof ctx );
+    ctx.exact = 1; /* use the key ID exactly as given */
     ctx.not_allocated = 1;
     ctx.nitems = 1;
     ctx.items[0].mode = 11;
@@ -536,6 +538,7 @@ seckey_available( u32 *keyid )
     KBNODE kb = NULL;
 
     memset( &ctx, 0, sizeof ctx );
+    ctx.exact = 1; /* use the key ID exactly as given */
     ctx.not_allocated = 1;
     ctx.nitems = 1;
     ctx.items[0].mode = 11;
@@ -620,15 +623,16 @@ hextobyte( const byte *s )
  *   is not case sensitive.
  */
 
-int
-classify_user_id( const char *name, u32 *keyid, byte *fprint,
-		  const char **retstr, size_t *retlen )
+static int
+classify_user_id2( const char *name, u32 *keyid, byte *fprint,
+		  const char **retstr, size_t *retlen, int *force_exact )
 {
     const char *	s;
     int 		mode = 0;
     int 		hexprefix = 0;
     int 		hexlength;
-
+    
+    *force_exact = 0;
     /* skip leading spaces.   FIXME: what is with leading spaces? */
     for(s = name; *s && isspace(*s); s++ )
 	;
@@ -707,6 +711,10 @@ classify_user_id( const char *name, u32 *keyid, byte *fprint,
 	    }
 
 	    hexlength = strspn(s, "0123456789abcdefABCDEF");
+            if (hexlength >= 8 && s[hexlength] =='!') {
+                *force_exact = 1;
+                hexlength++; /* just for the following check */
+            }
 
 	    /* check if a hexadecimal number is terminated by EOS or blank */
 	    if (hexlength && s[hexlength] && !isspace(s[hexlength])) {
@@ -716,6 +724,9 @@ classify_user_id( const char *name, u32 *keyid, byte *fprint,
 		    hexlength = 0;  /* a hex number, but really were not. */
 	    }
 
+            if (*force_exact)
+                hexlength--;
+
 	    if (hexlength == 8
                 || (!hexprefix && hexlength == 9 && *s == '0')){
 		/* short keyid */
@@ -775,6 +786,7 @@ classify_user_id( const char *name, u32 *keyid, byte *fprint,
 		if (hexprefix)	/* This was a hex number with a prefix */
 		    return 0;	/* and a wrong length */
 
+                *force_exact = 0;
 		mode = 2;   /* Default is case insensitive substring search */
 	    }
     }
@@ -787,14 +799,20 @@ classify_user_id( const char *name, u32 *keyid, byte *fprint,
     return mode;
 }
 
-
+int
+classify_user_id( const char *name, u32 *keyid, byte *fprint,
+		  const char **retstr, size_t *retlen )
+{
+    int dummy;
+    return classify_user_id2 (name, keyid, fprint, retstr, retlen, &dummy);
+}
 
 /****************
  * Try to get the pubkey by the userid. This function looks for the
  * first pubkey certificate which has the given name in a user_id.
  * if pk/sk has the pubkey algo set, the function will only return
  * a pubkey with that algo.
- * The caller must provide provide storage for either the pk or the sk.
+ * The caller must provide storage for either the pk or the sk.
  * If ret_kb is not NULL the funtion will return the keyblock there.
  */
 
@@ -807,6 +825,7 @@ key_byname( GETKEY_CTX *retctx, STRLIST namelist,
     STRLIST r;
     GETKEY_CTX ctx;
     KBNODE help_kb = NULL;
+    int exact;
     
     if( retctx ) /* reset the returned context in case of error */
 	*retctx = NULL;
@@ -820,18 +839,14 @@ key_byname( GETKEY_CTX *retctx, STRLIST namelist,
     ctx->nitems = n;
 
     for(n=0, r=namelist; r; r = r->next, n++ ) {
-	int mode = classify_user_id( r->d,
-                                 ctx->items[n].keyid,
-                                 ctx->items[n].fprint,
-                                 &ctx->items[n].name,
-                                 NULL );
-
-        /* if we don't use one of the exact key specifications, we assume that
-         * the primary key is requested */
-        if ( mode != 10 && mode != 11
-             && mode != 16 && mode == 20 && mode != 21 )
-            ctx->primary = 1; 
-
+	int mode = classify_user_id2 ( r->d,
+                                       ctx->items[n].keyid,
+                                       ctx->items[n].fprint,
+                                       &ctx->items[n].name,
+                                       NULL, &exact );
+
+        if ( exact )
+            ctx->exact = 1;
 	ctx->items[n].mode = mode;
         if( !ctx->items[n].mode ) {
 	    m_free( ctx );
@@ -951,6 +966,7 @@ get_pubkey_byfprint( PKT_public_key *pk,
         KBNODE kb = NULL;
 
 	memset( &ctx, 0, sizeof ctx );
+        ctx.exact = 1 ;
 	ctx.not_allocated = 1;
 	ctx.nitems = 1;
 	ctx.items[0].mode = fprint_len;
@@ -1008,6 +1024,7 @@ get_keyblock_bylid( KBNODE *ret_keyblock, ulong lid )
     if( keyid_from_lid( lid, kid ) )
 	kid[0] = kid[1] = 0;
     memset( &ctx, 0, sizeof ctx );
+    ctx.exact = 1;
     ctx.not_allocated = 1;
     ctx.nitems = 1;
     ctx.items[0].mode = 12;
@@ -1047,7 +1064,6 @@ get_seckey_byname2( GETKEY_CTX *retctx,
         assert (!retblock);
 	memset( &ctx, 0, sizeof ctx );
 	ctx.not_allocated = 1;
-	ctx.primary = 1;
 	ctx.nitems = 1;
 	ctx.items[0].mode = 15;
 	rc = lookup( &ctx, &kb, 1 );
@@ -1255,7 +1271,11 @@ compare_name( const char *uid, size_t uidlen, const char *name, int mode )
 /****************
  * merge all selfsignatures with the keys.
  * FIXME: replace this at least for the public key parts
- *        by merge_selfsigs
+ *        by merge_selfsigs.
+ *        It is still used in keyedit.c and
+ *        at 2 or 3 other places - check whether it is really needed.
+ *        It might be needed by the key edit and import stuff because
+ *        the keylock is changed.
  */
 void
 merge_keys_and_selfsig( KBNODE keyblock )
@@ -1516,7 +1536,7 @@ merge_selfsigs_main( KBNODE keyblock, int *r_revoked )
             }
         }
     }
-    if ( uidnode ) {
+    if ( uidnode && signode ) {
         fixup_uidnode ( uidnode, signode );
         pk->is_valid = 1;
     }
@@ -1961,14 +1981,14 @@ find_by_fpr( KBNODE keyblock,  const char *name, int mode )
 
 /* See see whether the key fits
  * our requirements and in case we do not
- * request a the primary key, we should select
+ * request the primary key, we should select
  * a suitable subkey.
  * FIXME: Check against PGP 7 whether we still need a kludge
  *        to favor type 16 keys over type 20 keys when type 20
  *        has not been explitely requested.
  * Returns: True when a suitable key has been found.
  *
- * We have to distinguish four cases:
+ * We have to distinguish four cases:  FIXME!
  *  1. No usage and no primary key requested
  *     Examples for this case are that we have a keyID to be used
  *     for decrytion or verification.
@@ -1980,7 +2000,12 @@ find_by_fpr( KBNODE keyblock,  const char *name, int mode )
  *  4. Usage but no primary key requested
  *     FIXME
  * FIXME: Tell what is going to happen here and something about the rationale
+ * Note: We don't use this function if no specific usage is requested;
+ *       This way the getkey functions can be used for plain key listings.
  *
+ * CTX ist the keyblock we are investigating, if FOUNDK is not NULL this
+ * is the key we actually found by looking at the keyid or a fingerprint and
+ * may eitehr point to the primary or one of the subkeys.
  */
 
 static int
@@ -1998,17 +2023,29 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
     assert( keyblock->pkt->pkttype == PKT_PUBLIC_KEY );
    
     ctx->found_key = NULL;
-    
+
+    if (!ctx->exact)
+        foundk = NULL;
+
     if ( DBG_CACHE )
-        log_debug( "finish_lookup: checking %s (req_usage=%x)\n",
-                   foundk? "one key":"all keys", req_usage);
+        log_debug( "finish_lookup: checking key %08lX (%s)(req_usage=%x)\n",
+                   (ulong)keyid_from_pk( keyblock->pkt->pkt.public_key, NULL),
+                   foundk? "one":"all", req_usage);
 
+    if (!req_usage) {
+        latest_key = foundk? foundk:keyblock;
+        goto found;
+    }
+    
+    if (!req_usage) {
+        ctx->found_key = foundk;
+        cache_user_id( keyblock );
+        return 1; /* found */
+    }
+    
     latest_date = 0;
     latest_key  = NULL;
-    /* We do check the subkeys only if we either have requested a specific
-     * usage or have not requested to get the primary key. */
-    if ( (req_usage || !ctx->primary)
-         && (!foundk || foundk->pkt->pkttype == PKT_PUBLIC_SUBKEY) ) {
+    if ( !foundk || foundk->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
         KBNODE nextk;
         /* either start a loop or check just this one subkey */
         for (k=foundk?foundk:keyblock; k; k = nextk ) {
@@ -2019,6 +2056,9 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
             if ( foundk )
                 nextk = NULL;  /* what a hack */
             pk = k->pkt->pkt.public_key;
+            if (DBG_CACHE)
+                log_debug( "\tchecking subkey %08lX\n",
+                           (ulong)keyid_from_pk( pk, NULL));
             if ( !pk->is_valid ) {
                 if (DBG_CACHE)
                     log_debug( "\tsubkey not valid\n");
@@ -2035,8 +2075,7 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
                 continue;
             }
             
-            if ( req_usage &&
-                 !((pk->pubkey_usage&USAGE_MASK) & req_usage) ) {
+            if ( !((pk->pubkey_usage&USAGE_MASK) & req_usage) ) {
                 if (DBG_CACHE)
                     log_debug( "\tusage does not match: want=%x have=%x\n",
                                req_usage, pk->pubkey_usage );
@@ -2044,8 +2083,7 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
             }
 
             if (DBG_CACHE)
-                log_debug( "\tconsidering key %08lX\n",
-                           (ulong)keyid_from_pk( pk, NULL));
+                log_debug( "\tsubkey looks fine\n");
             if ( pk->created > latest_date ) {
                 latest_date = pk->created;
                 latest_key  = k;
@@ -2053,7 +2091,9 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
         }
     }
 
-    if ( !latest_key ) {
+    /* Okay now try the primary key unless we have want an exact 
+     * key ID match on a subkey */
+    if ( !latest_key && !(ctx->exact && foundk != keyblock) ) {
         PKT_public_key *pk;
         if (DBG_CACHE && !foundk )
             log_debug( "\tno suitable subkeys found - trying primary\n");
@@ -2070,10 +2110,10 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
             if (DBG_CACHE)
                 log_debug( "\tprimary key has expired\n");
         }
-        else  if ( req_usage
-                   && !((pk->pubkey_usage&USAGE_MASK) & req_usage) ) {
+        else  if ( !((pk->pubkey_usage&USAGE_MASK) & req_usage) ) {
             if (DBG_CACHE)
-                log_debug( "\tusage does not match: want=%x have=%x\n",
+                log_debug( "\tprimary key usage does not match: "
+                           "want=%x have=%x\n",
                            req_usage, pk->pubkey_usage );
         }
         else { /* okay */
@@ -2090,6 +2130,7 @@ finish_lookup( GETKEY_CTX ctx,  KBNODE foundk )
         return 0;
     }
 
+ found:
     if (DBG_CACHE)
         log_debug( "\tusing key %08lX\n",
                 (ulong)keyid_from_pk( latest_key->pkt->pkt.public_key, NULL) );
@@ -2117,6 +2158,7 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
     byte namehash[20];
     int use_namehash=0;
     KBNODE secblock = NULL; /* helper */
+    int no_suitable_key = 0;
 
     if( !ctx->count ) /* first time */
 	rc = enum_keyblocks( secmode? 5:0, &ctx->kbpos, NULL );
@@ -2180,6 +2222,7 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
                     /* this keyblock looks fine - do further investigation */
                     merge_selfsigs ( ctx->keyblock );
 		    if ( finish_lookup( ctx, k ) ) {
+                        no_suitable_key = 0;
                         if ( secmode ) {
                             merge_public_with_secret ( ctx->keyblock,
                                                        secblock);
@@ -2188,6 +2231,8 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
                         }
                         goto found;
                     }
+                    else
+                        no_suitable_key = 1;
 		}
 	    }
           skip:
@@ -2209,6 +2254,8 @@ lookup( GETKEY_CTX ctx, KBNODE *ret_keyblock, int secmode )
         *ret_keyblock = ctx->keyblock; /* return the keyblock */
         ctx->keyblock = NULL;
     }
+    else if (rc == -1 && no_suitable_key)
+        rc = secmode ? G10ERR_UNU_SECKEY : G10ERR_UNU_PUBKEY;
     else if( rc == -1 )
 	rc = secmode ? G10ERR_NO_SECKEY : G10ERR_NO_PUBKEY;
 
diff --git a/g10/import.c b/g10/import.c
index dc24edf48..fe0512b94 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -414,7 +414,7 @@ import_one( const char *fname, KBNODE keyblock, int fast )
     /* do we have this key already in one of our pubrings ? */
     pk_orig = m_alloc_clear( sizeof *pk_orig );
     rc = get_pubkey( pk_orig, keyid );
-    if( rc && rc != G10ERR_NO_PUBKEY ) {
+    if( rc && rc != G10ERR_NO_PUBKEY && rc != G10ERR_UNU_PUBKEY ) {
 	log_error( _("key %08lX: public key not found: %s\n"),
 				(ulong)keyid[1], g10_errstr(rc));
     }
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 8faf141d5..3141bceb8 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -100,7 +100,7 @@ get_keyblock_byname( KBNODE *keyblock, KBPOS *kbpos, const char *username )
     if( rc )
 	log_error("%s: keyblock read problem: %s\n", username, g10_errstr(rc));
     else
-	merge_keys_and_selfsig( *keyblock );
+	merge_keys_and_selfsig( *keyblock ); 
 
     return rc;
 }
@@ -131,6 +131,7 @@ print_and_check_one_sig( KBNODE keyblock, KBNODE node,
 	    ++*inv_sigs;
 	break;
       case G10ERR_NO_PUBKEY:
+      case G10ERR_UNU_PUBKEY:
 	node->flag = NODFLG_NOKEY;
 	sigrc = '?';
 	if( no_key )
diff --git a/g10/keylist.c b/g10/keylist.c
index 9408b2782..da7fdb0d2 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -91,7 +91,7 @@ list_all( int secret )
 		putchar('-');
 	    putchar('\n');
 	}
-	merge_keys_and_selfsig( keyblock );
+        merge_keys_and_selfsig( keyblock );
 	list_keyblock( keyblock, secret );
 	release_kbnode( keyblock ); keyblock = NULL;
     }
@@ -199,7 +199,6 @@ list_one( STRLIST names, int secret )
 	    return;
 	}
 	do {
-	    merge_keys_and_selfsig( keyblock );
 	    list_keyblock( keyblock, 1 );
 	    release_kbnode( keyblock );
 	} while( !get_seckey_next( ctx, NULL, &keyblock ) );
@@ -213,7 +212,6 @@ list_one( STRLIST names, int secret )
 	    return;
 	}
 	do {
-	    merge_keys_and_selfsig( keyblock );
 	    list_keyblock( keyblock, 0 );
 	    release_kbnode( keyblock );
 	} while( !get_pubkey_next( ctx, NULL, &keyblock ) );
@@ -480,7 +478,8 @@ list_keyblock( KBNODE keyblock, int secret )
 		switch( rc ) {
 		  case 0:		   sigrc = '!'; break;
 		  case G10ERR_BAD_SIGN:    sigrc = '-'; break;
-		  case G10ERR_NO_PUBKEY:   sigrc = '?'; break;
+		  case G10ERR_NO_PUBKEY: 
+		  case G10ERR_UNU_PUBKEY:  sigrc = '?'; break;
 		  default:		   sigrc = '%'; break;
 		}
 	    }
diff --git a/g10/mainproc.c b/g10/mainproc.c
index bb990a032..6a2d123ad 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -926,7 +926,8 @@ list_node( CTX c, KBNODE node )
 	    switch( (rc2=do_check_sig( c, node, &is_selfsig )) ) {
 	      case 0:		       sigrc = '!'; break;
 	      case G10ERR_BAD_SIGN:    sigrc = '-'; break;
-	      case G10ERR_NO_PUBKEY:   sigrc = '?'; break;
+	      case G10ERR_NO_PUBKEY: 
+	      case G10ERR_UNU_PUBKEY:  sigrc = '?'; break;
 	      default:		       sigrc = '%'; break;
 	    }
 	}
diff --git a/g10/pkclist.c b/g10/pkclist.c
index a65e01cda..e66d105be 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -819,7 +819,6 @@ build_pk_list( STRLIST remusr, PK_LIST *ret_pk_list, unsigned use )
 		log_error(_("%s: skipped: %s\n"), rov->d, g10_errstr(rc) );
 	    }
 	    else if( !(rc=check_pubkey_algo2(pk->pubkey_algo, use )) ) {
-
 		/* Skip the actual key if the key is already present
 		 * in the list */
 		if (key_present_in_pk_list(pk_list, pk) == 0) {
diff --git a/include/ChangeLog b/include/ChangeLog
index cfdcfa928..d485de0f2 100644
--- a/include/ChangeLog
+++ b/include/ChangeLog
@@ -1,3 +1,7 @@
+2001-03-01  Werner Koch  <[email protected]>
+
+	* errors.h (G10ERR_UNU_SECKEY,G10ERR_UNU_PUBKEY): New
+
 2000-11-30  Werner Koch  <[email protected]>
 
 	* iobuf.h (iobuf_translate_file_handle): Add prototype.
diff --git a/include/errors.h b/include/errors.h
index 11c97425f..f7a9fc570 100644
--- a/include/errors.h
+++ b/include/errors.h
@@ -72,6 +72,9 @@
 #define G10ERR_SELFTEST_FAILED 50
 #define G10ERR_NOT_ENCRYPTED  51
 #define G10ERR_NOT_PROCESSED  52
+#define G10ERR_UNU_PUBKEY     53
+#define G10ERR_UNU_SECKEY     54
+
 
 #ifndef HAVE_STRERROR
 char *strerror( int n );
diff --git a/po/ChangeLog b/po/ChangeLog
index 624843459..2002cca33 100644
--- a/po/ChangeLog
+++ b/po/ChangeLog
@@ -1,3 +1,7 @@
+2001-02-22  Werner Koch  <[email protected]>
+
+	* de.po, de.glo: Updated.
+
 2001-01-23  Werner Koch  <[email protected]>
 
 	* de.po: Removed superfluous \r.
diff --git a/po/de.po b/po/de.po
index ddf0837b0..153f97997 100644
--- a/po/de.po
+++ b/po/de.po
@@ -1,8 +1,16 @@
 # GnuPG german translation
 # Copyright (C) 1998, 1999, 2000 Free Software Foundation, Inc.
-# Walter Koch <[email protected]>, 1998, 1999, 2000
+# Walter Koch <[email protected]>, 1998, 1999, 2000, 2001
 msgid ""
-msgstr "POT-Creation-Date: 2001-02-07 16:46+0100\n"
+msgstr ""
+"Project-Id-Version: gnupg-1.0.4\n"
+"POT-Creation-Date: 2001-02-17 02:26+0000\n"
+"PO-Revision-Date: 2001-02-20 21:20+0200\n"
+"Last-Translator: Walter Koch <[email protected]>\n"
+"Language-Team: German <[email protected]>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
 
 #: util/secmem.c:79
 msgid "Warning: using insecure memory!\n"
@@ -830,9 +838,8 @@ msgid "--delete-key user-id"
 msgstr "--delete-key User-ID"
 
 #: g10/g10.c:1295
-#, fuzzy
 msgid "--delete-secret-and-public-key user-id"
-msgstr "--delete-secret-key User-ID"
+msgstr "--delete-secret-and-public-key User-ID"
 
 #: g10/encode.c:268 g10/g10.c:1332 g10/sign.c:393
 #, c-format
@@ -1230,7 +1237,7 @@ msgid ""
 "You did not specify a user ID. (you may use \"-r\")\n"
 "\n"
 msgstr ""
-"Sie gaben keine User-ID angegeben (Benutzen Sie die Option \"-r\").\n"
+"Sie haben keine User-ID angegeben (Benutzen Sie die Option \"-r\").\n"
 "\n"
 
 #: g10/pkclist.c:864
@@ -1687,29 +1694,24 @@ msgstr "WARNUNG: Nichts exportiert\n"
 msgid "too many entries in pk cache - disabled\n"
 msgstr "zu viele Eintr�ge im pk-Lager - abgeschaltet\n"
 
-#: g10/getkey.c:350
+#: g10/getkey.c:445
 msgid "too many entries in unk cache - disabled\n"
 msgstr "zu viele Eintr�ge im unk-Lager - abgeschaltet\n"
 
-#: g10/getkey.c:1308 g10/getkey.c:1347
-msgid "RSA key cannot be used in this version\n"
-msgstr "RSA-Schl�ssel k�nnen in dieser Version nicht verwendet werden\n"
-
-#: g10/getkey.c:1310 g10/getkey.c:1349
-msgid "No key for user ID\n"
-msgstr "Kein Schl�ssel f�r User-ID\n"
-
-#: g10/getkey.c:1388 g10/getkey.c:1428
-msgid "No user ID for key\n"
-msgstr "Keine User-ID f�r Schl�ssel\n"
-
-#: g10/getkey.c:1628 g10/getkey.c:1675 g10/getkey.c:1731
+#: g10/getkey.c:2100
 #, c-format
 msgid "using secondary key %08lX instead of primary key %08lX\n"
 msgstr ""
 "der Zweitschl�ssel %08lX wird anstelle des Hauptschl�ssels %08lX verwendet\n"
 
-#: g10/getkey.c:2050
+#: g10/getkey.c:2141 g10/trustdb.c:577
+#, c-format
+msgid "key %08lX: secret key without public key - skipped\n"
+msgstr ""
+"Schl�ssel %08lX: geheimer Schl�ssel, aber ohne �ffentlichen Schl�ssel - "
+"�bersprungen\n"
+
+#: g10/getkey.c:2424
 msgid "[User id not found]"
 msgstr "[User-ID nicht gefunden]"
 
@@ -2711,7 +2713,6 @@ msgid "Experimental algorithms should not be used!\n"
 msgstr "Experimentiermethoden sollten nicht benutzt werden!\n"
 
 #: g10/misc.c:237
-#, fuzzy
 msgid "this cipher algorithm is deprecated; please use a more standard one!x\n"
 msgstr "Es ist davon abzuraten, diese Verschl�sselungsmethode zu benutzen!\n"
 
@@ -2720,7 +2721,7 @@ msgstr "Es ist davon abzuraten, diese Verschl�sselungsmethode zu benutzen!\n"
 msgid "can't handle public key algorithm %d\n"
 msgstr "dieses Public-Key Verfahren %d kann nicht benutzt werden\n"
 
-#: g10/parse-packet.c:990
+#: g10/parse-packet.c:998
 #, c-format
 msgid "subpacket of type %d has critical bit set\n"
 msgstr "Im Unterpaket des Typs %d ist das \"critical bit\" gesetzt\n"
@@ -2903,11 +2904,11 @@ msgstr "Teile des geheimen Schl�ssels sind nicht vorhanden\n"
 msgid "protection algorithm %d is not supported\n"
 msgstr "Schutzverfahren %d wird nicht unterst�tzt\n"
 
-#: g10/seckey-cert.c:186
+#: g10/seckey-cert.c:184
 msgid "Invalid passphrase; please try again ...\n"
 msgstr "Ung�ltiges Mantra; versuchen Sie's doch noch einmal ...\n"
 
-#: g10/seckey-cert.c:242
+#: g10/seckey-cert.c:240
 msgid "WARNING: Weak key detected - please change passphrase again.\n"
 msgstr ""
 "WARNUNG: Unsicherer Schl�ssel entdeckt -\n"
@@ -3174,7 +3175,7 @@ msgid "key %08lX: accepted as trusted key.\n"
 msgstr "Schl�ssel %08lX: Akzeptiert als vertrauensw�rdiger Schl�ssel.\n"
 
 #: g10/trustdb.c:546
-#, fuzzy, c-format
+#, c-format
 msgid "key %08lX: no public key for trusted key - skipped\n"
 msgstr ""
 "Schl�ssel %08lX: kein �ffentlicher Schl�ssel f�r den vertrauensw�rdigen "
@@ -3185,13 +3186,6 @@ msgstr ""
 msgid "NOTE: secret key %08lX is NOT protected.\n"
 msgstr "HINWEIS: Geheimer Schl�ssel %08lX ist NICHT gesch�tzt.\n"
 
-#: g10/trustdb.c:577
-#, c-format
-msgid "key %08lX: secret key without public key - skipped\n"
-msgstr ""
-"Schl�ssel %08lX: geheimer Schl�ssel, aber ohne �ffentlichen Schl�ssel - "
-"�bersprungen\n"
-
 #: g10/trustdb.c:584
 #, c-format
 msgid "key %08lX: secret and public key don't match\n"
@@ -3532,9 +3526,8 @@ msgstr ""
 "Warnung: Botschaft wurde mit einem unsicheren Schl�ssel verschl�sselt.\n"
 
 #: g10/encr-data.c:97
-#, fuzzy
 msgid "problem handling encrypted packet\n"
-msgstr "Entferne Empf�nger-ID verschl�sselter Pakete"
+msgstr "Problem beim Bearbeiten des verschl�sselten Pakets\n"
 
 #: g10/seskey.c:52
 msgid "weak key created - retrying\n"
@@ -3559,11 +3552,11 @@ msgstr "Diesen Schl�ssel aus dem Schl�sselbund l�schen? "
 msgid "This is a secret key! - really delete? "
 msgstr "Dies ist ein privater Schl�ssel! - Wirklich l�schen? "
 
-#: g10/delkey.c:182
+#: g10/delkey.c:181
 msgid "there is a secret key for this public key!\n"
 msgstr "Es gibt einen privaten Schl�ssel zu diesem �ffentlichen Schl�ssel!\n"
 
-#: g10/delkey.c:184
+#: g10/delkey.c:183
 msgid "use option \"--delete-secret-key\" to delete it first.\n"
 msgstr ""
 "Benutzen Sie das Kommando \"--delete-secret-key\", um ihn vorab zu "
@@ -3862,6 +3855,15 @@ msgstr "Keine Hilfe vorhanden."
 msgid "No help available for `%s'"
 msgstr "Keine Hilfe f�r '%s' vorhanden."
 
+#~ msgid "RSA key cannot be used in this version\n"
+#~ msgstr "RSA-Schl�ssel k�nnen in dieser Version nicht verwendet werden\n"
+
+#~ msgid "No key for user ID\n"
+#~ msgstr "Kein Schl�ssel f�r User-ID\n"
+
+#~ msgid "No user ID for key\n"
+#~ msgstr "Keine User-ID f�r Schl�ssel\n"
+
 #~ msgid "no secret key for decryption available\n"
 #~ msgstr "kein geheimer Schl�ssel zur Entschl�sselung vorhanden\n"
 
diff --git a/tools/ring-a-party b/tools/ring-a-party
index 7cf05d78d..4b383f8ba 100755
--- a/tools/ring-a-party
+++ b/tools/ring-a-party
@@ -54,20 +54,20 @@ $1 == "sub" { if( $4 != 17 && $4 != 3 )  signencrypt=1 }
 function myflush()
 {
     # fixme: take lines to print here into account
-    if( lines > 50 || lines == -1 ) {
+    if( lines > 45 || lines == -1 ) {
 	if( lines != -1 ) printf "\f";
 	page++;
 	printf "%s  %-50.50s Page %d\n\n", now, KEYRING, page ;
-	printf "Type Bits KeyID      Created    Expires    Algorithm                 Use\n";
+	printf "    Type Bits KeyID      Created    Expires    Algorithm                 Use\n\n";
 	lines = 1;
     }
-    printf "pub  %04d 0x%s %10s %10s %-10s     %15s\n",
+    printf "[ ] pub  %04d 0x%s %10s %10s %-10s     %15s\n",
 	  nbits, keyid, created, expires == ""? "----------":expires, algostr,
 			signencrypt == 1? "Sign & Encrypt":"Sign only";
     length(fpr) == 40 ? printfpr20( fpr ) : printfpr16( fpr );
     lnes += 2;
     for( i=0; i < uidcount; i++ ) {
-	printf "uid  %s\n", uids[i];
+	printf "( ) uid  %s\n", uids[i];
 	lines++;
     }
     printf "\n\n";
@@ -84,7 +84,7 @@ function mapalgo( no )
 
 function printfpr16( s )
 {
-    printf "f16    Fingerprint16 =";
+    printf "    f16    Fingerprint16 =";
     for(i=0; i < 16; i++ ) {
 	if( i == 8 ) printf " ";
 	printf " %s", substr( s, i*2+1, 2 );
@@ -94,7 +94,7 @@ function printfpr16( s )
 
 function printfpr20( s )
 {
-    printf "f20    Fingerprint20 =";
+    printf "    f20    Fingerprint20 =";
     for(i=0; i < 10; i++ ) {
 	if( i == 5 ) printf " ";
 	printf " %s", substr( s, i*4+1, 4 );
diff --git a/util/ChangeLog b/util/ChangeLog
index fd1279ef9..45ac5abf1 100644
--- a/util/ChangeLog
+++ b/util/ChangeLog
@@ -1,3 +1,7 @@
+2001-03-01  Werner Koch  <[email protected]>
+
+	* errors.c (g10_errstr): New codes UNU_SECKEY and UNU_PUBKEY.
+
 2000-12-28  Werner Koch  <[email protected]>
 
 	* dotlock.c: Made all_lockfiles volatile.
diff --git a/util/errors.c b/util/errors.c
index e1551d03d..c4c1cb19e 100644
--- a/util/errors.c
+++ b/util/errors.c
@@ -101,6 +101,9 @@ g10_errstr( int err )
       X(SELFTEST_FAILED,"selftest failed")
       X(NOT_ENCRYPTED  ,N_("not encrypted"))
       X(NOT_PROCESSED  ,N_("not processed"))
+      /* the key cannot be used for a specific usage */
+      X(UNU_PUBKEY     ,N_("unusable public key"))
+      X(UNU_SECKEY     ,N_("unusable secret key"))
       default: p = buf; sprintf(buf, "g10err=%d", err); break;
     }
   #undef X