* verify.c (gpgsm_verify): Print STATUS_NEWSIG for each signature.

* certchain.c (gpgsm_validate_chain) <gpgsm_cert_use_cer_p>: Do
not just warn if a cert is not suitable; bail out immediately.

* call-dirmngr.c (isvalid_status_cb): New.
(unhexify_fpr): New. Taken from ../g10/call-agent.c
(gpgsm_dirmngr_isvalid): Add new arg CTRL, changed caller to pass
it thru.  Detect need to check the respondert cert and do that.
* certchain.c (gpgsm_validate_chain): Add new arg FLAGS.  Changed
all callers.

1 files changed, 3 insertions, 2 deletions

diff --git a/sm/certlist.c b/sm/certlist.c
index 6e694b781..0394a584f 100644
--- a/sm/certlist.c
+++ b/sm/certlist.c
@@ -130,7 +130,8 @@ cert_usage_p (ksba_cert_t cert, int mode)
     {
       if ((use & (KSBA_KEYUSAGE_KEY_CERT_SIGN)))
         return 0;
-      log_info ( _("certificate should have not been used certification\n"));
+      log_info (_("certificate should have not "
+                  "been used for certification\n"));
       return gpg_error (GPG_ERR_WRONG_KEY_USAGE);
     }
 
@@ -347,7 +348,7 @@ gpgsm_add_to_certlist (CTRL ctrl, const char *name, int secret,
                     }
                 }
               if (!rc)
-                rc = gpgsm_validate_chain (ctrl, cert, NULL, 0, NULL);
+                rc = gpgsm_validate_chain (ctrl, cert, NULL, 0, NULL, 0);
               if (!rc)
                 {
                   CERTLIST cl = xtrycalloc (1, sizeof *cl);