/* keylist.c - Print information about OpenPGP keys

 * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,

 *               2008, 2010, 2012 Free Software Foundation, Inc.

 * Copyright (C) 2013, 2014  Werner Koch

 *

 * This file is part of GnuPG.

 *

 * GnuPG is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * GnuPG is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, see <https://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#ifdef HAVE_DOSISH_SYSTEM

# include <fcntl.h>   /* for setmode() */

#endif

#include "gpg.h"

#include "options.h"

#include "packet.h"

#include "../common/status.h"

#include "keydb.h"

#include "photoid.h"

#include "../common/util.h"

#include "../common/ttyio.h"

#include "trustdb.h"

#include "main.h"

#include "../common/i18n.h"

#include "../common/status.h"

#include "call-agent.h"

#include "../common/mbox-util.h"

#include "../common/zb32.h"

#include "tofu.h"

#include "../common/init.h"

#include "../common/recsel.h"

#include "../common/compliance.h"

#include "../common/pkscreening.h"

static void list_all (ctrl_t, int, int);

static void list_one (ctrl_t ctrl,

                      strlist_t names, int secret, int mark_secret);

static void locate_one (ctrl_t ctrl, strlist_t names, int no_local);

static void print_card_serialno (const char *serialno);

struct keylist_context

{

  int check_sigs;  /* If set signatures shall be verified.  */

  int good_sigs;   /* Counter used if CHECK_SIGS is set.  */

  int inv_sigs;    /* Counter used if CHECK_SIGS is set.  */

  int no_key;      /* Counter used if CHECK_SIGS is set.  */

  int oth_err;     /* Counter used if CHECK_SIGS is set.  */

  int no_validity; /* Do not show validity.  */

};

/* An object and a global instance to store selectors created from

 * --list-filter select=EXPR.

 */

struct list_filter_s

{

  recsel_expr_t selkey;

};

struct list_filter_s list_filter;

/* The stream used to write attribute packets to.  */

static estream_t attrib_fp;

static gpg_error_t list_keyblock (ctrl_t ctrl,

                           kbnode_t keyblock, int secret, int has_secret,

                           int fpr, struct keylist_context *listctx);

/* Release resources from a keylist context.  */

static void

keylist_context_release (struct keylist_context *listctx)

{

  (void)listctx; /* Nothing to release.  */

}

static void

release_list_filter (struct list_filter_s *filt)

{

  recsel_release (filt->selkey);

  filt->selkey = NULL;

}

static void

cleanup_keylist_globals (void)

{

  release_list_filter (&list_filter);

}

/* Parse and set an list filter from string.  STRING has the format

 * "NAME=EXPR" with NAME being the name of the filter.  Spaces before

 * and after NAME are not allowed.  If this function is all called

 * several times all expressions for the same NAME are concatenated.

 * Supported filter names are:

 *

 *  - select :: If the expression evaluates to true for a certain key

 *              this key will be listed.  The expression may use any

 *              variable defined for the export and import filters.

 *

 */

gpg_error_t

parse_and_set_list_filter (const char *string)

{

  gpg_error_t err;

  /* Auto register the cleanup function.  */

  register_mem_cleanup_func (cleanup_keylist_globals);

  if (!strncmp (string, "select=", 7))

    err = recsel_parse_expr (&list_filter.selkey, string+7);

  else

    err = gpg_error (GPG_ERR_INV_NAME);

  if (!err && DBG_RECSEL)

    recsel_dump (list_filter.selkey);

  return err;

}

/* List the keys.  If list is NULL, all available keys are listed.

 * With LOCATE_MODE set the locate algorithm is used to find a key; if

 * in addition NO_LOCAL is set the locate does not look into the local

 * keyring.  */

void

public_key_list (ctrl_t ctrl, strlist_t list, int locate_mode, int no_local)

{

#ifndef NO_TRUST_MODELS

  if (opt.with_colons)

    {

      byte trust_model, marginals, completes, cert_depth, min_cert_level;

      ulong created, nextcheck;

      read_trust_options (ctrl, &trust_model, &created, &nextcheck,

        &marginals, &completes, &cert_depth, &min_cert_level);

      es_fprintf (es_stdout, "tru:");

      if (nextcheck && nextcheck <= make_timestamp ())

  es_fprintf (es_stdout, "o");

      if (trust_model != opt.trust_model)

  es_fprintf (es_stdout, "t");

      if (opt.trust_model == TM_PGP || opt.trust_model == TM_CLASSIC

    || opt.trust_model == TM_TOFU_PGP)

  {

    if (marginals != opt.marginals_needed)

      es_fprintf (es_stdout, "m");

    if (completes != opt.completes_needed)

      es_fprintf (es_stdout, "c");

    if (cert_depth != opt.max_cert_depth)

      es_fprintf (es_stdout, "d");

    if (min_cert_level != opt.min_cert_level)

      es_fprintf (es_stdout, "l");

  }

      es_fprintf (es_stdout, ":%d:%lu:%lu", trust_model, created, nextcheck);

      /* Only show marginals, completes, and cert_depth in the classic

         or PGP trust models since they are not meaningful

         otherwise. */

      if (trust_model == TM_PGP || trust_model == TM_CLASSIC)

  es_fprintf (es_stdout, ":%d:%d:%d", marginals, completes, cert_depth);

      es_fprintf (es_stdout, "\n");

    }

#endif /*!NO_TRUST_MODELS*/

  /* We need to do the stale check right here because it might need to

     update the keyring while we already have the keyring open.  This

     is very bad for W32 because of a sharing violation. For real OSes

     it might lead to false results if we are later listing a keyring

     which is associated with the inode of a deleted file.  */

  check_trustdb_stale (ctrl);

#ifdef USE_TOFU

  tofu_begin_batch_update (ctrl);

#endif

  if (locate_mode)

    locate_one (ctrl, list, no_local);

  else if (!list)

    list_all (ctrl, 0, opt.with_secret);

  else

    list_one (ctrl, list, 0, opt.with_secret);

#ifdef USE_TOFU

  tofu_end_batch_update (ctrl);

#endif

}

void

secret_key_list (ctrl_t ctrl, strlist_t list)

{

  (void)ctrl;

  check_trustdb_stale (ctrl);

  if (!list)

    list_all (ctrl, 1, 0);

  else        /* List by user id */

    list_one (ctrl, list, 1, 0);

}

/* Helper for print_key_info and print_key_info_log.  */

static char *

format_key_info (ctrl_t ctrl, PKT_public_key *pk, int secret)

{

  u32 keyid[2];

  char *p;

  char pkstrbuf[PUBKEY_STRING_SIZE];

  char *result;

  keyid_from_pk (pk, keyid);

  /* If the pk was chosen by a particular user ID, that is the one to

     print.  */

  if (pk->user_id)

    p = utf8_to_native (pk->user_id->name, pk->user_id->len, 0);

  else

    p = get_user_id_native (ctrl, keyid);

  result = xtryasprintf ("%s  %s/%s %s %s",

                         secret? (pk->flags.primary? "sec":"ssb")

                         /* */ : (pk->flags.primary? "pub":"sub"),

                         pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),

                         keystr (keyid), datestr_from_pk (pk), p);

  xfree (p);

  return result;

}

/* Print basic information about a public or secret key.  With FP

 * passed as NULL, the tty output interface is used, otherwise output

 * is directed to the given stream.  INDENT gives the requested

 * indentation; if that is a negative value indentation is suppressed

 * for the first line.  SECRET tells that the PK has a secret part.

 * FIXME: This is similar in use to print_key_line and thus both

 * functions should eventually be united.

 */

void

print_key_info (ctrl_t ctrl, estream_t fp,

                int indent, PKT_public_key *pk, int secret)

{

  int indentabs = indent >= 0? indent : -indent;

  char *info;

  /* Note: Negative values for INDENT are not yet needed. */

  info = format_key_info (ctrl, pk, secret);

  if (!fp && indent >= 0)

    tty_printf ("\n");  /* (Backward compatibility to old code) */

  tty_fprintf (fp, "%*s%s\n", indentabs, "",

               info? info : "[Ooops - out of core]");

  xfree (info);

}

/* Same as print_key_info put print using the log functions at

 * LOGLEVEL.  */

void

print_key_info_log (ctrl_t ctrl, int loglevel,

                    int indent, PKT_public_key *pk, int secret)

{

  int indentabs = indent >= 0? indent : -indent;

  char *info;

  info = format_key_info (ctrl, pk, secret);

  log_log (loglevel, "%*s%s\n", indentabs, "",

           info? info : "[Ooops - out of core]");

  xfree (info);

}

/* Print basic information of a secret key including the card serial

   number information.  */

#ifdef ENABLE_CARD_SUPPORT

void

print_card_key_info (estream_t fp, kbnode_t keyblock)

{

  kbnode_t node;

  char *hexgrip;

  char *serialno;

  int s2k_char;

  char pkstrbuf[PUBKEY_STRING_SIZE];

  int indent;

  for (node = keyblock; node; node = node->next)

    {

      if (node->pkt->pkttype == PKT_PUBLIC_KEY

          || node->pkt->pkttype == PKT_PUBLIC_SUBKEY)

        {

          int rc;

          PKT_public_key *pk = node->pkt->pkt.public_key;

          serialno = NULL;

          rc = hexkeygrip_from_pk (pk, &hexgrip);

          if (rc)

            {

              log_error ("error computing a keygrip: %s\n", gpg_strerror (rc));

              s2k_char = '?';

            }

          else if (!agent_get_keyinfo (NULL, hexgrip, &serialno, NULL))

            s2k_char = serialno? '>':' ';

          else

            s2k_char = '#';  /* Key not found.  */

          tty_fprintf (fp, "%s%c  %s/%s  %n",

                       node->pkt->pkttype == PKT_PUBLIC_KEY ? "sec" : "ssb",

                       s2k_char,

                       pubkey_string (pk, pkstrbuf, sizeof pkstrbuf),

                       keystr_from_pk (pk),

                       &indent);

          tty_fprintf (fp, _("created: %s"), datestr_from_pk (pk));

          tty_fprintf (fp, "  ");

          tty_fprintf (fp, _("expires: %s"), expirestr_from_pk (pk));

          if (serialno)

            {

              tty_fprintf (fp, "\n%*s%s", indent, "", _("card-no: "));

              if (strlen (serialno) == 32

                  && !strncmp (serialno, "D27600012401", 12))

                {

                  /* This is an OpenPGP card.  Print the relevant part.  */

                  /* Example: D2760001240101010001000003470000 */

                  /*                          xxxxyyyyyyyy     */

                  tty_fprintf (fp, "%.*s %.*s", 4, serialno+16, 8, serialno+20);

                }

              else

                tty_fprintf (fp, "%s", serialno);

            }

          tty_fprintf (fp, "\n");

          xfree (hexgrip);

          xfree (serialno);

        }

    }

}

#endif /*ENABLE_CARD_SUPPORT*/

/* Print the preferences line.  Allowed values for MODE are:

 *  -1 - print to the TTY

 *   0 - print to stdout.

 *   1 - use log_info

 *   2 - print colon delimited pfc record to stdout.

 */

void

show_preferences (PKT_user_id *uid, int indent, int mode, int verbose)

{

  estream_t fp;

  const prefitem_t fake = { 0, 0 };

  const prefitem_t *prefs;

  int i;

  if (!uid)

    return;

  if (uid->prefs)

    prefs = uid->prefs;

  else if (verbose)

    prefs = &fake;

  else

    return;

  if (mode < 0 )

    fp = NULL;

  else if (mode == 1)

    fp = log_get_stream ();

  else /* Mode 0 or 2 */

    fp = es_stdout;

  if (mode == 2)  /* Print preference record.  */

    {

      static char ptypes[] = { PREFTYPE_SYM, PREFTYPE_HASH,

                               PREFTYPE_ZIP, PREFTYPE_AEAD };

      int t, any;

      es_fputs ("pfc::", fp); /* Second field is RFU */

      for (t=0; t < DIM (ptypes); t++)

        {

          any = 0;

          for (i = 0; prefs[i].type; i++)

            if (prefs[i].type == ptypes[t])

              {

                es_fprintf (fp, "%s%d", any? ",":"", prefs[i].value);

                any = 1;

              }

          es_putc (':', fp);

        }

      es_putc (':', fp);  /* Two more reserved fields.  */

      es_putc (':', fp);

      any = 0;

      if (uid->flags.mdc)

        { es_fprintf (fp, "mdc"); any = 1; }

      if (uid->flags.aead)

        { es_fprintf (fp, "%saead", any?",":"");  any = 1; };

      if (!uid->flags.ks_modify)

        { es_fprintf (fp, "%sno-ks-modify", any?",":""); }

      es_putc (':', fp); /* One final colon for easier reading.  */

      es_putc ('\n', fp);

    }

  else if (verbose)

    {

      int any, des_seen = 0, sha1_seen = 0, uncomp_seen = 0;

      tty_fprintf (fp, "%*s %s", indent, "", _("Cipher: "));

      for (i = any = 0; prefs[i].type; i++)

  {

    if (prefs[i].type == PREFTYPE_SYM)

      {

        if (any)

    tty_fprintf (fp, ", ");

        any = 1;

        /* We don't want to display strings for experimental algos */

        if (!openpgp_cipher_test_algo (prefs[i].value)

      && prefs[i].value < 100)

    tty_fprintf (fp, "%s", openpgp_cipher_algo_name (prefs[i].value));

        else

    tty_fprintf (fp, "[%d]", prefs[i].value);

        if (prefs[i].value == CIPHER_ALGO_3DES)

    des_seen = 1;

      }

  }

      if (!des_seen)

  {

    if (any)

      tty_fprintf (fp, ", ");

    tty_fprintf (fp, "%s", openpgp_cipher_algo_name (CIPHER_ALGO_3DES));

  }

      tty_fprintf (fp, "\n%*s %s", indent, "", _("AEAD: "));

      for (i = any = 0; prefs[i].type; i++)

  {

    if (prefs[i].type == PREFTYPE_AEAD)

      {

        if (any)

    tty_fprintf (fp, ", ");

        any = 1;

        /* We don't want to display strings for experimental algos */

        if (!openpgp_aead_test_algo (prefs[i].value)

      && prefs[i].value < 100)

    tty_fprintf (fp, "%s", openpgp_aead_algo_name (prefs[i].value));

        else

    tty_fprintf (fp, "[%d]", prefs[i].value);

      }

  }

      tty_fprintf (fp, "\n%*s %s", indent, "", _("Digest: "));

      for (i = any = 0; prefs[i].type; i++)

  {

    if (prefs[i].type == PREFTYPE_HASH)

      {

        if (any)

    tty_fprintf (fp, ", ");

        any = 1;

        /* We don't want to display strings for experimental algos */

        if (!gcry_md_test_algo (prefs[i].value) && prefs[i].value < 100)

    tty_fprintf (fp, "%s", gcry_md_algo_name (prefs[i].value));

        else

    tty_fprintf (fp, "[%d]", prefs[i].value);

        if (prefs[i].value == DIGEST_ALGO_SHA1)

    sha1_seen = 1;

      }

  }

      if (!sha1_seen)

  {

    if (any)

      tty_fprintf (fp, ", ");

    tty_fprintf (fp, "%s", gcry_md_algo_name (DIGEST_ALGO_SHA1));

  }

      tty_fprintf (fp, "\n%*s %s", indent, "", _("Compression: "));

      for (i = any = 0; prefs[i].type; i++)

  {

    if (prefs[i].type == PREFTYPE_ZIP)

      {

        const char *s = compress_algo_to_string (prefs[i].value);

        if (any)

    tty_fprintf (fp, ", ");

        any = 1;

        /* We don't want to display strings for experimental algos */

        if (s && prefs[i].value < 100)

    tty_fprintf (fp, "%s", s);

        else

    tty_fprintf (fp, "[%d]", prefs[i].value);

        if (prefs[i].value == COMPRESS_ALGO_NONE)

    uncomp_seen = 1;

      }

  }

      if (!uncomp_seen)

  {

    if (any)

      tty_fprintf (fp, ", ");

    else

      {

        tty_fprintf (fp, "%s",

                           compress_algo_to_string (COMPRESS_ALGO_ZIP));

        tty_fprintf (fp, ", ");

      }

    tty_fprintf (fp, "%s", compress_algo_to_string (COMPRESS_ALGO_NONE));

  }

      if (uid->flags.mdc || uid->flags.aead || !uid->flags.ks_modify)

  {

          tty_fprintf (fp, "\n%*s %s", indent, "", _("Features: "));

    any = 0;

    if (uid->flags.mdc)

      {

        tty_fprintf (fp, "MDC");

        any = 1;

      }

    if (uid->flags.aead)

      {

        if (any)

    tty_fprintf (fp, ", ");

        tty_fprintf (fp, "AEAD");

      }

    if (!uid->flags.ks_modify)

      {

        if (any)

    tty_fprintf (fp, ", ");

        tty_fprintf (fp, _("Keyserver no-modify"));

      }

  }

      tty_fprintf (fp, "\n");

    }

  else

    {

      tty_fprintf (fp, "%*s", indent, "");

      for (i = 0; prefs[i].type; i++)

        {

          tty_fprintf (fp, " %c%d", prefs[i].type == PREFTYPE_SYM ? 'S' :

                       prefs[i].type == PREFTYPE_AEAD ? 'A' :

                       prefs[i].type == PREFTYPE_HASH ? 'H' :

                       prefs[i].type == PREFTYPE_ZIP ? 'Z' : '?',

                       prefs[i].value);

        }

      if (uid->flags.mdc)

        tty_fprintf (fp, " [mdc]");

      if (uid->flags.aead)

        tty_fprintf (fp, " [aead]");

      if (!uid->flags.ks_modify)

        tty_fprintf (fp, " [no-ks-modify]");

      tty_fprintf (fp, "\n");

    }

}

/* Flags = 0x01 hashed 0x02 critical.  */

static void

status_one_subpacket (sigsubpkttype_t type, size_t len, int flags,

          const byte * buf)

{

  char status[40];

  /* Don't print these. */

  if (len > 256)

    return;

  snprintf (status, sizeof status,

            "%d %u %u ", type, flags, (unsigned int) len);

  write_status_text_and_buffer (STATUS_SIG_SUBPACKET, status, buf, len, 0);

}

/* Print a policy URL.  Allowed values for MODE are:

 *  -1 - print to the TTY

 *   0 - print to stdout.

 *   1 - use log_info and emit status messages.

 *   2 - emit only status messages.

 */

void

show_policy_url (PKT_signature * sig, int indent, int mode)

{

  const byte *p;

  size_t len;

  int seq = 0, crit;

  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;

  while ((p = enum_sig_subpkt (sig, 1, SIGSUBPKT_POLICY, &len, &seq, &crit)))

    {

      if (mode != 2)

  {

    const char *str;

          tty_fprintf (fp, "%*s", indent, "");

    if (crit)

      str = _("Critical signature policy: ");

    else

      str = _("Signature policy: ");

    if (mode > 0)

      log_info ("%s", str);

    else

      tty_fprintf (fp, "%s", str);

    tty_print_utf8_string2 (fp, p, len, 0);

    tty_fprintf (fp, "\n");

  }

      if (mode > 0)

  write_status_buffer (STATUS_POLICY_URL, p, len, 0);

    }

}

/* Print a keyserver URL.  Allowed values for MODE are:

 *  -1 - print to the TTY

 *   0 - print to stdout.

 *   1 - use log_info and emit status messages.

 *   2 - emit only status messages.

 */

void

show_keyserver_url (PKT_signature * sig, int indent, int mode)

{

  const byte *p;

  size_t len;

  int seq = 0, crit;

  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;

  while ((p = enum_sig_subpkt (sig, 1, SIGSUBPKT_PREF_KS, &len, &seq, &crit)))

    {

      if (mode != 2)

  {

    const char *str;

          tty_fprintf (fp, "%*s", indent, "");

    if (crit)

      str = _("Critical preferred keyserver: ");

    else

      str = _("Preferred keyserver: ");

    if (mode > 0)

      log_info ("%s", str);

    else

      tty_fprintf (fp, "%s", str);

    tty_print_utf8_string2 (fp, p, len, 0);

    tty_fprintf (fp, "\n");

  }

      if (mode > 0)

  status_one_subpacket (SIGSUBPKT_PREF_KS, len,

            (crit ? 0x02 : 0) | 0x01, p);

    }

}

/* Print notation data.  Allowed values for MODE are:

 *  -1 - print to the TTY

 *   0 - print to stdout.

 *   1 - use log_info and emit status messages.

 *   2 - emit only status messages.

 *

 * Defined bits in WHICH:

 *   1 - standard notations

 *   2 - user notations

 *   4 - print notations normally hidden

 */

void

show_notation (PKT_signature * sig, int indent, int mode, int which)

{

  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;

  notation_t nd, notations;

  if (which == 0)

    which = 3;

  notations = sig_to_notation (sig);

  /* There may be multiple notations in the same sig. */

  for (nd = notations; nd; nd = nd->next)

    {

       if (!(which & 4) && !strcmp (nd->name, "manu"))

        continue;

      if (mode != 2)

  {

    int has_at = !!strchr (nd->name, '@');

    if ((which & 1 && !has_at) || (which & 2 && has_at))

      {

        const char *str;

              tty_fprintf (fp, "%*s", indent, "");

        if (nd->flags.critical)

    str = _("Critical signature notation: ");

        else

    str = _("Signature notation: ");

        if (mode > 0)

    log_info ("%s", str);

        else

    tty_fprintf (fp, "%s", str);

        /* This is all UTF8 */

        tty_print_utf8_string2 (fp, nd->name, strlen (nd->name), 0);

        tty_fprintf (fp, "=");

        tty_print_utf8_string2 (fp, nd->value, strlen (nd->value), 0);

              /* (We need to use log_printf so that the next call to a

                  log function does not insert an extra LF.)  */

              if (mode > 0)

                log_printf ("\n");

              else

                tty_fprintf (fp, "\n");

      }

  }

      if (mode > 0)

  {

    write_status_buffer (STATUS_NOTATION_NAME,

             nd->name, strlen (nd->name), 0);

          if (nd->flags.critical || nd->flags.human)

            write_status_text (STATUS_NOTATION_FLAGS,

                               nd->flags.critical && nd->flags.human? "1 1" :

                               nd->flags.critical? "1 0" : "0 1");

          if (!nd->flags.human && nd->bdat && nd->blen)

            write_status_buffer (STATUS_NOTATION_DATA,

                                 nd->bdat, nd->blen, 250);

          else

            write_status_buffer (STATUS_NOTATION_DATA,

                                 nd->value, strlen (nd->value), 50);

  }

    }

  free_notation (notations);

}

/* Output all the notation data in SIG matching a name given by

 * --print-notation to stdout.  */

void

print_matching_notations (PKT_signature *sig)

{

  notation_t nd, notations;

  strlist_t sl;

  const char *s;

  if (!opt.print_notations)

    return;

  notations = sig_to_notation (sig);

  for (nd = notations; nd; nd = nd->next)

    {

      for (sl=opt.print_notations; sl; sl = sl->next)

        if (!strcmp (sl->d, nd->name))

          break;

      if (!sl || !*nd->value)

        continue;

      es_fprintf (es_stdout, "%s: ", nd->name);

      for (s = nd->value; *s; s++)

        {

          if (*s == '\n')

            es_fprintf (es_stdout, "\n%*s", (int)strlen (nd->name)+2, "");

          else if (*s >= ' ' || *s != '\t')

            es_putc (*s, es_stdout);

        }

      es_putc ('\n', es_stdout);

    }

  free_notation (notations);

}

static void

print_signature_stats (struct keylist_context *s)

{

  if (!s->check_sigs)

    return;  /* Signature checking was not requested.  */

  /* Better flush stdout so that the stats are always printed after

   * the output.  */

  es_fflush (es_stdout);

  if (s->good_sigs)

    log_info (ngettext("%d good signature\n",

                       "%d good signatures\n", s->good_sigs), s->good_sigs);

  if (s->inv_sigs)

    log_info (ngettext("%d bad signature\n",

                       "%d bad signatures\n", s->inv_sigs), s->inv_sigs);

  if (s->no_key)

    log_info (ngettext("%d signature not checked due to a missing key\n",

                       "%d signatures not checked due to missing keys\n",

                       s->no_key), s->no_key);

  if (s->oth_err)

    log_info (ngettext("%d signature not checked due to an error\n",

                       "%d signatures not checked due to errors\n",

                       s->oth_err), s->oth_err);

}

/* List all keys.  If SECRET is true only secret keys are listed.  If

   MARK_SECRET is true secret keys are indicated in a public key

   listing.  */

static void

list_all (ctrl_t ctrl, int secret, int mark_secret)

{

  KEYDB_HANDLE hd;

  KBNODE keyblock = NULL;

  int rc = 0;

  int any_secret;

  const char *lastresname, *resname;

  struct keylist_context listctx;

  gpg_error_t listerr = 0;

  memset (&listctx, 0, sizeof (listctx));

  if (opt.check_sigs)

    listctx.check_sigs = 1;

  hd = keydb_new (ctrl);

  if (!hd)

    rc = gpg_error_from_syserror ();

  else

    rc = keydb_search_first (hd);

  if (rc)

    {

      if (gpg_err_code (rc) != GPG_ERR_NOT_FOUND)

  log_error ("keydb_search_first failed: %s\n", gpg_strerror (rc));

      goto leave;

    }

  lastresname = NULL;

  do

    {

      if (secret)

        glo_ctrl.silence_parse_warnings++;

      rc = keydb_get_keyblock (hd, &keyblock);

      if (secret)

        glo_ctrl.silence_parse_warnings--;

      if (rc)

  {

          if (gpg_err_code (rc) == GPG_ERR_LEGACY_KEY)

            continue;  /* Skip legacy keys.  */

    log_error ("keydb_get_keyblock failed: %s\n", gpg_strerror (rc));

    goto leave;

  }

      if (secret || mark_secret)

        any_secret = !agent_probe_any_secret_key (ctrl, keyblock);

      else

        any_secret = 0;

      if (secret && !any_secret)

        ; /* Secret key listing requested but this isn't one.  */

      else

        {

          if (!opt.with_colons && !(opt.list_options & LIST_SHOW_ONLY_FPR_MBOX))

            {

              resname = keydb_get_resource_name (hd);

              if (lastresname != resname)

                {

                  int i;

                  es_fprintf (es_stdout, "%s\n", resname);

                  for (i = strlen (resname); i; i--)

                    es_putc ('-', es_stdout);

                  es_putc ('\n', es_stdout);

                  lastresname = resname;

                }

            }

          merge_keys_and_selfsig (ctrl, keyblock);

          listerr = list_keyblock (ctrl, keyblock, secret, any_secret,

                                   opt.fingerprint, &listctx);

        }

      release_kbnode (keyblock);

      keyblock = NULL;