/* sign.c - sign data

 * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,

 *               2007, 2010, 2012 Free Software Foundation, Inc.

 *

 * This file is part of GnuPG.

 *

 * GnuPG is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * GnuPG is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, see <https://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include "gpg.h"

#include "options.h"

#include "packet.h"

#include "../common/status.h"

#include "../common/iobuf.h"

#include "keydb.h"

#include "../common/util.h"

#include "main.h"

#include "filter.h"

#include "../common/ttyio.h"

#include "trustdb.h"

#include "../common/status.h"

#include "../common/i18n.h"

#include "pkglue.h"

#include "../common/sysutils.h"

#include "call-agent.h"

#include "../common/mbox-util.h"

#include "../common/compliance.h"

#ifdef HAVE_DOSISH_SYSTEM

#define LF "\r\n"

#else

#define LF "\n"

#endif

/* Hack */

static int recipient_digest_algo;

/* A type for the extra data we hash into v5 signature packets.  */

struct pt_extra_hash_data_s

{

  unsigned char mode;

  u32 timestamp;

  unsigned char namelen;

  char name[1];

};

typedef struct pt_extra_hash_data_s *pt_extra_hash_data_t;

/*

 * Create notations and other stuff.  It is assumed that the strings

 * in STRLIST are already checked to contain only printable data and

 * have a valid NAME=VALUE format.  If with_manu is set a "manu"

 * notation is also added: a value of 1 includes it in the standard

 * way and a value of 23 assumes that the data is de-vs compliant.

 */

static void

mk_notation_policy_etc (ctrl_t ctrl, PKT_signature *sig,

      PKT_public_key *pk, PKT_public_key *pksk, int with_manu)

{

  const char *string;

  char *p = NULL;

  strlist_t pu = NULL;

  struct notation *nd = NULL;

  struct notation *ndmanu = NULL;

  struct expando_args args;

  log_assert (sig->version >= 4);

  memset (&args, 0, sizeof(args));

  args.pk = pk;

  args.pksk = pksk;

  /* Notation data. */

  if (IS_ATTST_SIGS(sig))

    ;

  else if (IS_SIG(sig) && opt.sig_notations)

    nd = opt.sig_notations;

  else if (IS_CERT(sig) && opt.cert_notations)

    nd = opt.cert_notations;

  if (with_manu)

    {

      ndmanu = name_value_to_notation

        ("manu",

         gnupg_manu_notation_value (with_manu == 23? CO_DE_VS : CO_GNUPG));

      ndmanu->next = nd;

      nd = ndmanu;

    }

  if (nd)

    {

      struct notation *item;

      for (item = nd; item; item = item->next)

        {

          item->altvalue = pct_expando (ctrl, item->value,&args);

          if (!item->altvalue)

            log_error (_("WARNING: unable to %%-expand notation "

                         "(too large).  Using unexpanded.\n"));

        }

      keygen_add_notations (sig, nd);

      for (item = nd; item; item = item->next)

        {

          xfree (item->altvalue);

          item->altvalue = NULL;

        }

      if (with_manu)

        {

          /* Restore the original nd and release ndmanu.  */

          nd = ndmanu;

          ndmanu->next = NULL;

          free_notation (ndmanu);

        }

    }

  /* Set policy URL. */

  if (IS_ATTST_SIGS(sig))

    ;

  else if (IS_SIG(sig) && opt.sig_policy_url)

    pu = opt.sig_policy_url;

  else if (IS_CERT(sig) && opt.cert_policy_url)

    pu = opt.cert_policy_url;

  for (; pu; pu = pu->next)

    {

      string = pu->d;

      p = pct_expando (ctrl, string, &args);

      if (!p)

        {

          log_error(_("WARNING: unable to %%-expand policy URL "

                      "(too large).  Using unexpanded.\n"));

          p = xstrdup(string);

        }

      build_sig_subpkt (sig, (SIGSUBPKT_POLICY

                              | ((pu->flags & 1)?SIGSUBPKT_FLAG_CRITICAL:0)),

                        p, strlen (p));

      xfree (p);

    }

  /* Preferred keyserver URL. */

  if (IS_SIG(sig) && opt.sig_keyserver_url)

    pu = opt.sig_keyserver_url;

  for (; pu; pu = pu->next)

    {

      string = pu->d;

      p = pct_expando (ctrl, string, &args);

      if (!p)

        {

          log_error (_("WARNING: unable to %%-expand preferred keyserver URL"

                       " (too large).  Using unexpanded.\n"));

          p = xstrdup (string);

        }

      build_sig_subpkt (sig, (SIGSUBPKT_PREF_KS

                              | ((pu->flags & 1)?SIGSUBPKT_FLAG_CRITICAL:0)),

                        p, strlen (p));

      xfree (p);

    }

  /* Set signer's user id.  */

  if (IS_SIG (sig) && !opt.flags.disable_signer_uid)

    {

      char *mbox;

      /* For now we use the uid which was used to locate the key.  */

      if (pksk->user_id

          && (mbox = mailbox_from_userid (pksk->user_id->name, 0)))

        {

          if (DBG_LOOKUP)

            log_debug ("setting Signer's UID to '%s'\n", mbox);

          build_sig_subpkt (sig, SIGSUBPKT_SIGNERS_UID, mbox, strlen (mbox));

          xfree (mbox);

        }

      else if (opt.sender_list)

        {

          /* If a list of --sender was given we scan that list and use

           * the first one matching a user id of the current key.  */

          /* FIXME: We need to get the list of user ids for the PKSK

           * packet.  That requires either a function to look it up

           * again or we need to extend the key packet struct to link

           * to the primary key which in turn could link to the user

           * ids.  Too much of a change right now.  Let's take just

           * one from the supplied list and hope that the caller

           * passed a matching one.  */

          build_sig_subpkt (sig, SIGSUBPKT_SIGNERS_UID,

                            opt.sender_list->d, strlen (opt.sender_list->d));

        }

    }

}

/*

 * Put the Key Block subpacket into SIG for key PKSK.  Returns an

 * error code on failure.

 */

static gpg_error_t

mk_sig_subpkt_key_block (ctrl_t ctrl, PKT_signature *sig, PKT_public_key *pksk)

{

  gpg_error_t err;

  char *mbox;

  char *filterexp = NULL;

  int save_opt_armor = opt.armor;

  int save_opt_verbose = opt.verbose;

  char hexfpr[2*MAX_FINGERPRINT_LEN + 1];

  void *data = NULL;

  size_t datalen;

  kbnode_t keyblock = NULL;

  push_export_filters ();

  opt.armor = 0;

  hexfingerprint (pksk, hexfpr, sizeof hexfpr);

  /* Get the user id so that we know which one to insert into the

   * key.  */

  if (pksk->user_id

      && (mbox = mailbox_from_userid (pksk->user_id->name, 0)))

    {

      if (DBG_LOOKUP)

        log_debug ("including key with UID '%s' (specified)\n", mbox);

      filterexp = xasprintf ("keep-uid= -- mbox = %s", mbox);

      xfree (mbox);

    }

  else if (opt.sender_list)

    {

      /* If --sender was given we use the first one from that list.  */

      if (DBG_LOOKUP)

        log_debug ("including key with UID '%s' (--sender)\n",

                   opt.sender_list->d);

      filterexp = xasprintf ("keep-uid= -- mbox = %s", opt.sender_list->d);

    }

  else  /* Use the primary user id.  */

    {

      if (DBG_LOOKUP)

        log_debug ("including key with primary UID\n");

      filterexp = xstrdup ("keep-uid= primary -t");

    }

  if (DBG_LOOKUP)

    log_debug ("export filter expression: %s\n", filterexp);

  err = parse_and_set_export_filter (filterexp);

  if (err)

    goto leave;

  xfree (filterexp);

  filterexp = xasprintf ("drop-subkey= fpr <> %s && usage !~ e", hexfpr);

  if (DBG_LOOKUP)

    log_debug ("export filter expression: %s\n", filterexp);

  err = parse_and_set_export_filter (filterexp);

  if (err)

    goto leave;

  opt.verbose = 0;

  err = export_pubkey_buffer (ctrl, hexfpr, EXPORT_MINIMAL|EXPORT_CLEAN,

                              "", 1, /* Prefix with the reserved byte. */

                              NULL, &keyblock, &data, &datalen);

  opt.verbose = save_opt_verbose;

  if (err)

    {

      log_error ("failed to get to be included key: %s\n", gpg_strerror (err));

      goto leave;

    }

  build_sig_subpkt (sig, SIGSUBPKT_KEY_BLOCK, data, datalen);

 leave:

  xfree (data);

  release_kbnode (keyblock);

  xfree (filterexp);

  opt.armor = save_opt_armor;

  pop_export_filters ();

  return err;

}

/*

 * Helper to hash a user ID packet.

 */

static void

hash_uid (gcry_md_hd_t md, int sigversion, const PKT_user_id *uid)

{

  byte buf[5];

  (void)sigversion;

  if (uid->attrib_data)

    {

      buf[0] = 0xd1;                 /* Indicates an attribute packet.  */

      buf[1] = uid->attrib_len >> 24;  /* Always use 4 length bytes.  */

      buf[2] = uid->attrib_len >> 16;

      buf[3] = uid->attrib_len >>  8;

      buf[4] = uid->attrib_len;

    }

  else

    {

      buf[0] = 0xb4;                 /* Indicates a userid packet.  */

      buf[1] = uid->len >> 24;         /* Always use 4 length bytes.  */

      buf[2] = uid->len >> 16;

      buf[3] = uid->len >>  8;

      buf[4] = uid->len;

    }

  gcry_md_write( md, buf, 5 );

  if (uid->attrib_data)

    gcry_md_write (md, uid->attrib_data, uid->attrib_len );

  else

    gcry_md_write (md, uid->name, uid->len );

}

/*

 * Helper to hash some parts from the signature.  EXTRAHASH gives the

 * extra data to be hashed into v5 signatures; it may by NULL for

 * detached signatures.

 */

static void

hash_sigversion_to_magic (gcry_md_hd_t md, const PKT_signature *sig,

                          pt_extra_hash_data_t extrahash)

{

  byte buf[10];

  int i;

  size_t n;

  gcry_md_putc (md, sig->version);

  gcry_md_putc (md, sig->sig_class);

  gcry_md_putc (md, sig->pubkey_algo);

  gcry_md_putc (md, sig->digest_algo);

  if (sig->hashed)

    {

      n = sig->hashed->len;

      gcry_md_putc (md, (n >> 8) );

      gcry_md_putc (md,  n       );

      gcry_md_write (md, sig->hashed->data, n );

      n += 6;

    }

  else

    {

      gcry_md_putc (md, 0);  /* Always hash the length of the subpacket.  */

      gcry_md_putc (md, 0);

      n = 6;

    }

  /* Hash data from the literal data packet.  */

  if (sig->version >= 5 && (sig->sig_class == 0x00 || sig->sig_class == 0x01))

    {

      /* - One octet content format

       * - File name (one octet length followed by the name)

       * - Four octet timestamp */

      if (extrahash)

        {

          buf[0] = extrahash->mode;

          buf[1] = extrahash->namelen;

          gcry_md_write (md, buf, 2);

          if (extrahash->namelen)

            gcry_md_write (md, extrahash->name, extrahash->namelen);

          buf[0] = extrahash->timestamp >> 24;

          buf[1] = extrahash->timestamp >> 16;

          buf[2] = extrahash->timestamp >>  8;

          buf[3] = extrahash->timestamp;

          gcry_md_write (md, buf, 4);

        }

      else /* Detached signatures */

        {

          memset (buf, 0, 6);

          gcry_md_write (md, buf, 6);

        }

    }

  /* Add some magic aka known as postscript.  The idea was to make it

   * impossible to make up a document with a v3 signature and then

   * turn this into a v4 signature for another document.  The last

   * hashed 5 bytes of a v4 signature should never look like a the

   * last 5 bytes of a v3 signature.  The length can be used to parse

   * from the end. */

  i = 0;

  buf[i++] = sig->version;  /* Hash convention version.  */

  buf[i++] = 0xff;          /* Not any sig type value.   */

  if (sig->version >= 5)

    {

      /* Note: We don't hashed any data larger than 2^32 and thus we

       * can always use 0 here.  See also note below.  */

      buf[i++] = 0;

      buf[i++] = 0;

      buf[i++] = 0;

      buf[i++] = 0;

    }

  buf[i++] = n >> 24;         /* (n is only 16 bit, so this is always 0) */

  buf[i++] = n >> 16;

  buf[i++] = n >>  8;

  buf[i++] = n;

  gcry_md_write (md, buf, i);

}

/* Perform the sign operation.  If CACHE_NONCE is given the agent is

 * advised to use that cached passphrase for the key.  SIGNHINTS has

 * hints so that we can do some additional checks. */

static int

do_sign (ctrl_t ctrl, PKT_public_key *pksk, PKT_signature *sig,

   gcry_md_hd_t md, int mdalgo,

         const char *cache_nonce, unsigned int signhints)

{

  gpg_error_t err;

  byte *dp;

  char *hexgrip;

  /* An ADSK key commonly has a creation date older than the primary

   * key.  For example because the ADSK is used as an archive key for

   * a group of users.  */

  if (pksk->timestamp > sig->timestamp && !(signhints & SIGNHINT_ADSK))

    {

      ulong d = pksk->timestamp - sig->timestamp;

      log_info (ngettext("key %s was created %lu second"

                         " in the future (time warp or clock problem)\n",

                         "key %s was created %lu seconds"

                         " in the future (time warp or clock problem)\n",

                         d), keystr_from_pk (pksk), d);

      if (!opt.ignore_time_conflict)

        return gpg_error (GPG_ERR_TIME_CONFLICT);

    }

  print_pubkey_algo_note (pksk->pubkey_algo);

  if (!mdalgo)

    mdalgo = gcry_md_get_algo (md);

  if ((signhints & SIGNHINT_KEYSIG) && !(signhints & SIGNHINT_SELFSIG)

      && mdalgo == GCRY_MD_SHA1

      && !opt.flags.allow_weak_key_signatures)

    {

      /* We do not allow the creation of third-party key signatures

       * using SHA-1 because we also reject them when verifying.  Note

       * that this will render dsa1024 keys unsuitable for such

       * keysigs and in turn the WoT. */

      print_sha1_keysig_rejected_note ();

      err = gpg_error (GPG_ERR_DIGEST_ALGO);

      goto leave;

    }

  /* Check compliance but always allow for key revocations. */

  if (!IS_KEY_REV (sig)

      && ! gnupg_digest_is_allowed (opt.compliance, 1, mdalgo))

    {

      log_error (_("digest algorithm '%s' may not be used in %s mode\n"),

     gcry_md_algo_name (mdalgo),

     gnupg_compliance_option_string (opt.compliance));

      err = gpg_error (GPG_ERR_DIGEST_ALGO);

      goto leave;

    }

  if (!IS_KEY_REV (sig)

      && ! gnupg_pk_is_allowed (opt.compliance, PK_USE_SIGNING,

                                pksk->pubkey_algo, 0,

                                pksk->pkey, nbits_from_pk (pksk), NULL))

    {

      log_error (_("key %s may not be used for signing in %s mode\n"),

                 keystr_from_pk (pksk),

                 gnupg_compliance_option_string (opt.compliance));

      err = gpg_error (GPG_ERR_PUBKEY_ALGO);

      goto leave;

    }

  if (!gnupg_rng_is_compliant (opt.compliance))

    {

      err = gpg_error (GPG_ERR_FORBIDDEN);

      log_error (_("%s is not compliant with %s mode\n"),

                 "RNG",

                 gnupg_compliance_option_string (opt.compliance));

      write_status_error ("random-compliance", err);

      goto leave;

    }

  print_digest_algo_note (mdalgo);

  dp = gcry_md_read  (md, mdalgo);

  sig->digest_algo = mdalgo;

  sig->digest_start[0] = dp[0];

  sig->digest_start[1] = dp[1];

  mpi_release (sig->data[0]);

  sig->data[0] = NULL;

  mpi_release (sig->data[1]);

  sig->data[1] = NULL;

  err = hexkeygrip_from_pk (pksk, &hexgrip);

  if (!err)

    {

      char *desc;

      gcry_sexp_t s_sigval;

      desc = gpg_format_keydesc (ctrl, pksk, FORMAT_KEYDESC_NORMAL, 1);

      /* FIXME: Eventually support composite keys.  */

      err = agent_pksign (NULL/*ctrl*/, cache_nonce, hexgrip, desc,

                          pksk->keyid, pksk->main_keyid, pksk->pubkey_algo,

                          dp, gcry_md_get_algo_dlen (mdalgo), mdalgo,

                          &s_sigval);

      xfree (desc);

      if (err)

        ;

      else if (pksk->pubkey_algo == GCRY_PK_RSA

               || pksk->pubkey_algo == GCRY_PK_RSA_S)

        sig->data[0] = get_mpi_from_sexp (s_sigval, "s", GCRYMPI_FMT_USG);

      else if (pksk->pubkey_algo == PUBKEY_ALGO_EDDSA

               && openpgp_oid_is_ed25519 (pksk->pkey[0]))

        {

          err = sexp_extract_param_sos_nlz (s_sigval, "r", &sig->data[0]);

          if (!err)

            err = sexp_extract_param_sos_nlz (s_sigval, "s", &sig->data[1]);

        }

      else if (pksk->pubkey_algo == PUBKEY_ALGO_ECDSA

               || pksk->pubkey_algo == PUBKEY_ALGO_EDDSA)

        {

          err = sexp_extract_param_sos (s_sigval, "r", &sig->data[0]);

          if (!err)

            err = sexp_extract_param_sos (s_sigval, "s", &sig->data[1]);

        }

      else

        {

          sig->data[0] = get_mpi_from_sexp (s_sigval, "r", GCRYMPI_FMT_USG);

          sig->data[1] = get_mpi_from_sexp (s_sigval, "s", GCRYMPI_FMT_USG);

        }

      gcry_sexp_release (s_sigval);

    }

  xfree (hexgrip);

 leave:

  if (err)

    log_error (_("signing failed: %s\n"), gpg_strerror (err));

  else

    {

      if (opt.verbose)

        {

          char *ustr = get_user_id_string_native (ctrl, sig->keyid);

          log_info (_("%s/%s signature from: \"%s\"\n"),

                    openpgp_pk_algo_name (pksk->pubkey_algo),

                    openpgp_md_algo_name (sig->digest_algo),

                    ustr);

          xfree (ustr);

  }

    }

  return err;

}

static int

complete_sig (ctrl_t ctrl,

              PKT_signature *sig, PKT_public_key *pksk, gcry_md_hd_t md,

              const char *cache_nonce, unsigned int signhints)

{

  int rc;

  /* if (!(rc = check_secret_key (pksk, 0))) */

  rc = do_sign (ctrl, pksk, sig, md, 0, cache_nonce, signhints);

  return rc;

}

/* Return true if the key seems to be on a version 1 OpenPGP card.

   This works by asking the agent and may fail if the card has not yet

   been used with the agent.  */

static int

openpgp_card_v1_p (PKT_public_key *pk)

{

  gpg_error_t err;

  int result;

  /* Shortcut if we are not using RSA: The v1 cards only support RSA

     thus there is no point in looking any further.  */

  if (!is_RSA (pk->pubkey_algo))

    return 0;

  if (!pk->flags.serialno_valid)

    {

      char *hexgrip;

      /* Note: No need to care about composite keys for non-RSA keys.  */

      err = hexkeygrip_from_pk (pk, &hexgrip);

      if (err)

        {

          log_error ("error computing a keygrip: %s\n", gpg_strerror (err));

          return 0; /* Ooops.  */

        }

      xfree (pk->serialno);

      agent_get_keyinfo (NULL, hexgrip, &pk->serialno, NULL);

      xfree (hexgrip);

      pk->flags.serialno_valid = 1;

    }

  if (!pk->serialno)

    result = 0; /* Error from a past agent_get_keyinfo or no card.  */

  else

    {

      /* The version number of the card is included in the serialno.  */

      result = !strncmp (pk->serialno, "D2760001240101", 14);

    }

  return result;

}

/* Get a matching hash algorithm for DSA and ECDSA.  */

static int

match_dsa_hash (unsigned int qbytes)

{

  if (qbytes <= 20)

    return DIGEST_ALGO_SHA1;

  if (qbytes <= 28)

    return DIGEST_ALGO_SHA224;

  if (qbytes <= 32)

    return DIGEST_ALGO_SHA256;

  if (qbytes <= 48)

    return DIGEST_ALGO_SHA384;

  if (qbytes <= 66 )  /* 66 corresponds to 521 (64 to 512) */

    return DIGEST_ALGO_SHA512;

  return DEFAULT_DIGEST_ALGO;

  /* DEFAULT_DIGEST_ALGO will certainly fail, but it's the best wrong

     answer we have if a digest larger than 512 bits is requested.  */

}

/*

  First try --digest-algo.  If that isn't set, see if the recipient

  has a preferred algorithm (which is also filtered through

  --personal-digest-prefs).  If we're making a signature without a

  particular recipient (i.e. signing, rather than signing+encrypting)

  then take the first algorithm in --personal-digest-prefs that is

  usable for the pubkey algorithm.  If --personal-digest-prefs isn't

  set, then take the OpenPGP default (i.e. SHA-1).

  Note that EdDSA takes an input of arbitrary length and thus

  we don't enforce any particular algorithm like we do for standard

  ECDSA. However, we use SHA256 as the default algorithm.

  Possible improvement: Use the highest-ranked usable algorithm from

  the signing key prefs either before or after using the personal

  list?

*/

static int

hash_for (PKT_public_key *pk)

{

  if (opt.def_digest_algo)

    {

      return opt.def_digest_algo;

    }

  else if (recipient_digest_algo && !is_weak_digest (recipient_digest_algo))

    {

      return recipient_digest_algo;

    }

  else if (pk->pubkey_algo == PUBKEY_ALGO_EDDSA)

    {

      if (opt.personal_digest_prefs)

        return opt.personal_digest_prefs[0].value;

      else

        if (gcry_mpi_get_nbits (pk->pkey[1]) > 256)

          return DIGEST_ALGO_SHA512;

        else

          return DIGEST_ALGO_SHA256;

    }

  else if (pk->pubkey_algo == PUBKEY_ALGO_DSA

           || pk->pubkey_algo == PUBKEY_ALGO_ECDSA)

    {

      unsigned int qbytes = gcry_mpi_get_nbits (pk->pkey[1]);

      if (pk->pubkey_algo == PUBKEY_ALGO_ECDSA)

        qbytes = ecdsa_qbits_from_Q (qbytes);

      qbytes = qbytes/8;

      /* It's a DSA key, so find a hash that is the same size as q or

   larger.  If q is 160, assume it is an old DSA key and use a

   160-bit hash unless --enable-dsa2 is set, in which case act

   like a new DSA key that just happens to have a 160-bit q

   (i.e. allow truncation).  If q is not 160, by definition it

   must be a new DSA key.  We ignore the personal_digest_prefs

   for ECDSA because they should always match the curve and

   truncated hashes are not useful either.  Even worse,

   smartcards may reject non matching hash lengths for curves

   (e.g. using SHA-512 with brainpooolP385r1 on a Yubikey).  */

      if (pk->pubkey_algo == PUBKEY_ALGO_DSA && opt.personal_digest_prefs)

  {

    prefitem_t *prefs;

    if (qbytes != 20 || opt.flags.dsa2)

      {

        for (prefs=opt.personal_digest_prefs; prefs->type; prefs++)

    if (gcry_md_get_algo_dlen (prefs->value) >= qbytes)

      return prefs->value;

      }

    else

      {

        for (prefs=opt.personal_digest_prefs; prefs->type; prefs++)

    if (gcry_md_get_algo_dlen (prefs->value) == qbytes)

      return prefs->value;

      }

  }

      return match_dsa_hash(qbytes);

    }

  else if (openpgp_card_v1_p (pk))

    {

      /* The sk lives on a smartcard, and old smartcards only handle

   SHA-1 and RIPEMD/160.  Newer smartcards (v2.0) don't have

   this restriction anymore.  Fortunately the serial number

   encodes the version of the card and thus we know that this

   key is on a v1 card. */

      if(opt.personal_digest_prefs)

  {

    prefitem_t *prefs;

    for (prefs=opt.personal_digest_prefs;prefs->type;prefs++)

      if (prefs->value==DIGEST_ALGO_SHA1

                || prefs->value==DIGEST_ALGO_RMD160)

        return prefs->value;

  }

      return DIGEST_ALGO_SHA1;

    }

  else if (opt.personal_digest_prefs)

    {

      /* It's not DSA, so we can use whatever the first hash algorithm

   is in the pref list */

      return opt.personal_digest_prefs[0].value;

    }

  else

    return DEFAULT_DIGEST_ALGO;

}

static void

print_status_sig_created (PKT_public_key *pk, PKT_signature *sig, int what)

{

  byte array[MAX_FINGERPRINT_LEN];

  char buf[100+MAX_FINGERPRINT_LEN*2];

  size_t n;

  snprintf (buf, sizeof buf - 2*MAX_FINGERPRINT_LEN, "%c %d %d %02x %lu ",

            what, sig->pubkey_algo, sig->digest_algo, sig->sig_class,

            (ulong)sig->timestamp );

  fingerprint_from_pk (pk, array, &n);

  bin2hex (array, n, buf + strlen (buf));

  write_status_text( STATUS_SIG_CREATED, buf );

}

/*

 * Loop over the secret certificates in SK_LIST and build the one pass

 * signature packets.  OpenPGP says that the data should be bracket by

 * the onepass-sig and signature-packet; so we build these onepass

 * packet here in reverse order.

 */

static int

write_onepass_sig_packets (SK_LIST sk_list, IOBUF out, int sigclass )

{

  int skcount;

  SK_LIST sk_rover;

  for (skcount=0, sk_rover=sk_list; sk_rover; sk_rover = sk_rover->next)

    skcount++;

  for (; skcount; skcount--)

    {

      PKT_public_key *pk;

      PKT_onepass_sig *ops;

      PACKET pkt;

      int i, rc;

      for (i=0, sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)

        if (++i == skcount)

          break;

      pk = sk_rover->pk;

      ops = xmalloc_clear (sizeof *ops);

      ops->sig_class = sigclass;

      ops->digest_algo = hash_for (pk);

      ops->pubkey_algo = pk->pubkey_algo;

      keyid_from_pk (pk, ops->keyid);

      ops->last = (skcount == 1);

      init_packet (&pkt);

      pkt.pkttype = PKT_ONEPASS_SIG;

      pkt.pkt.onepass_sig = ops;

      rc = build_packet (out, &pkt);

      free_packet (&pkt, NULL);

      if (rc)

        {

          log_error ("build onepass_sig packet failed: %s\n",

                     gpg_strerror (rc));

          return rc;

        }

    }

  return 0;

}

/*

 * Helper to write the plaintext (literal data) packet.  At

 * R_EXTRAHASH a malloced object with the extra data hashed

 * into v5 signatures is stored.

 */

static int

write_plaintext_packet (iobuf_t out, iobuf_t inp,

                        const char *fname, int ptmode,

                        pt_extra_hash_data_t *r_extrahash)

{

  PKT_plaintext *pt = NULL;

  u32 filesize;

  int rc = 0;

  if (!opt.no_literal)

    pt = setup_plaintext_name (fname, inp);

  /* Try to calculate the length of the data. */

  if ( !iobuf_is_pipe_filename (fname) && *fname)

    {

      uint64_t tmpsize;

      tmpsize = iobuf_get_filelength (inp);

      if (!tmpsize && opt.verbose)

        log_info (_("WARNING: '%s' is an empty file\n"), fname);

      /* We can't encode the length of very large files because

       * OpenPGP uses only 32 bit for file sizes.  So if the size of a

       * file is larger than 2^32 minus some bytes for packet headers,

       * we switch to partial length encoding. */

      if (tmpsize < (IOBUF_FILELENGTH_LIMIT - 65536))

        filesize = tmpsize;

      else

        filesize = 0;

      /* Because the text_filter modifies the length of the

       * data, it is not possible to know the used length

       * without a double read of the file - to avoid that

       * we simple use partial length packets. */

      if (ptmode == 't' || ptmode == 'u' || ptmode == 'm')

        filesize = 0;

    }

  else

    filesize = opt.set_filesize? opt.set_filesize : 0; /* stdin */

  if (!opt.no_literal)

    {

      PACKET pkt;

      /* Note that PT has been initialized above in no_literal mode.  */

      pt->timestamp = make_timestamp ();

      pt->mode = ptmode;

      pt->len = filesize;

      pt->new_ctb = !pt->len;

      pt->buf = inp;

      init_packet (&pkt);

      pkt.pkttype = PKT_PLAINTEXT;

      pkt.pkt.plaintext = pt;

      /*cfx.datalen = filesize? calc_packet_length( &pkt ) : 0;*/