lisp/epg.el

   1 ;;; epg.el --- the EasyPG Library -*- lexical-binding: t -*-
   2 ;; Copyright (C) 1999-2000, 2002-2017 Free Software Foundation, Inc.
   3
   4 ;; Author: Daiki Ueno <ueno@unixuser.org>
   5 ;; Keywords: PGP, GnuPG
   6 ;; Version: 1.0.0
   7
   8 ;; This file is part of GNU Emacs.
   9
  10 ;; GNU Emacs is free software: you can redistribute it and/or modify
  11 ;; it under the terms of the GNU General Public License as published by
  12 ;; the Free Software Foundation, either version 3 of the License, or
  13 ;; (at your option) any later version.
  14
  15 ;; GNU Emacs is distributed in the hope that it will be useful,
  16 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ;; GNU General Public License for more details.
  19
  20 ;; You should have received a copy of the GNU General Public License
  21 ;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
  22
  23 ;;; Code:
  24
  25 (require 'epg-config)
  26 (eval-when-compile (require 'cl-lib))
  27
  28 (defvar epg-user-id nil
  29   "GnuPG ID of your default identity.")
  30
  31 (defvar epg-user-id-alist nil
  32   "An alist mapping from key ID to user ID.")
  33
  34 (defvar epg-last-status nil)
  35 (defvar epg-read-point nil)
  36 (defvar epg-process-filter-running nil)
  37 (defvar epg-pending-status-list nil)
  38 (defvar epg-key-id nil)
  39 (defvar epg-context nil)
  40 (defvar epg-debug-buffer nil)
  41 (defvar epg-agent-file nil)
  42 (defvar epg-agent-mtime nil)
  43
  44 ;; from gnupg/include/cipher.h
  45 (defconst epg-cipher-algorithm-alist
  46   '((0 . "NONE")
  47     (1 . "IDEA")
  48     (2 . "3DES")
  49     (3 . "CAST5")
  50     (4 . "BLOWFISH")
  51     (7 . "AES")
  52     (8 . "AES192")
  53     (9 . "AES256")
  54     (10 . "TWOFISH")
  55     (11 . "CAMELLIA128")
  56     (12 . "CAMELLIA256")
  57     (110 . "DUMMY")))
  58
  59 ;; from gnupg/include/cipher.h
  60 (defconst epg-pubkey-algorithm-alist
  61   '((1 . "RSA")
  62     (2 . "RSA_E")
  63     (3 . "RSA_S")
  64     (16 . "ELGAMAL_E")
  65     (17 . "DSA")
  66     (20 . "ELGAMAL")))
  67
  68 ;; from gnupg/include/cipher.h
  69 (defconst epg-digest-algorithm-alist
  70   '((1 . "MD5")
  71     (2 . "SHA1")
  72     (3 . "RIPEMD160")
  73     (8 . "SHA256")
  74     (9 . "SHA384")
  75     (10 . "SHA512")
  76     (11 . "SHA224")))
  77
  78 ;; from gnupg/include/cipher.h
  79 (defconst epg-compress-algorithm-alist
  80   '((0 . "NONE")
  81     (1 . "ZIP")
  82     (2 . "ZLIB")
  83     (3 . "BZIP2")))
  84
  85 (defconst epg-invalid-recipients-reason-alist
  86   '((0 . "No specific reason given")
  87     (1 . "Not Found")
  88     (2 . "Ambiguous specification")
  89     (3 . "Wrong key usage")
  90     (4 . "Key revoked")
  91     (5 . "Key expired")
  92     (6 . "No CRL known")
  93     (7 . "CRL too old")
  94     (8 . "Policy mismatch")
  95     (9 . "Not a secret key")
  96     (10 . "Key not trusted")))
  97
  98 (defconst epg-delete-problem-reason-alist
  99   '((1 . "No such key")
 100     (2 . "Must delete secret key first")
 101     (3 . "Ambiguous specification")))
 102
 103 (defconst epg-import-ok-reason-alist
 104   '((0 . "Not actually changed")
 105     (1 . "Entirely new key")
 106     (2 . "New user IDs")
 107     (4 . "New signatures")
 108     (8 . "New subkeys")
 109     (16 . "Contains private key")))
 110
 111 (defconst epg-import-problem-reason-alist
 112   '((0 . "No specific reason given")
 113     (1 . "Invalid Certificate")
 114     (2 . "Issuer Certificate missing")
 115     (3 . "Certificate Chain too long")
 116     (4 . "Error storing certificate")))
 117
 118 (defconst epg-no-data-reason-alist
 119   '((1 . "No armored data")
 120     (2 . "Expected a packet but did not found one")
 121     (3 . "Invalid packet found, this may indicate a non OpenPGP message")
 122     (4 . "Signature expected but not found")))
 123
 124 (defconst epg-unexpected-reason-alist nil)
 125
 126 (defvar epg-key-validity-alist
 127   '((?o . unknown)
 128     (?i . invalid)
 129     (?d . disabled)
 130     (?r . revoked)
 131     (?e . expired)
 132     (?- . none)
 133     (?q . undefined)
 134     (?n . never)
 135     (?m . marginal)
 136     (?f . full)
 137     (?u . ultimate)))
 138
 139 (defvar epg-key-capability-alist
 140   '((?e . encrypt)
 141     (?s . sign)
 142     (?c . certify)
 143     (?a . authentication)
 144     (?D . disabled)))
 145
 146 (defvar epg-new-signature-type-alist
 147   '((?D . detached)
 148     (?C . clear)
 149     (?S . normal)))
 150
 151 (defvar epg-dn-type-alist
 152   '(("1.2.840.113549.1.9.1" . "EMail")
 153     ("2.5.4.12" . "T")
 154     ("2.5.4.42" . "GN")
 155     ("2.5.4.4" . "SN")
 156     ("0.2.262.1.10.7.20" . "NameDistinguisher")
 157     ("2.5.4.16" . "ADDR")
 158     ("2.5.4.15" . "BC")
 159     ("2.5.4.13" . "D")
 160     ("2.5.4.17" . "PostalCode")
 161     ("2.5.4.65" . "Pseudo")
 162     ("2.5.4.5" . "SerialNumber")))
 163
 164 (defvar epg-prompt-alist nil)
 165
 166 (define-error 'epg-error "GPG error")
 167
 168 (cl-defstruct (epg-data
 169                (:constructor nil)
 170                (:constructor epg-make-data-from-file (file))
 171                (:constructor epg-make-data-from-string (string))
 172                (:copier nil)
 173                (:predicate nil))
 174   (file nil :read-only t)
 175   (string nil :read-only t))
 176
 177 (defmacro epg--gv-nreverse (place)
 178   (gv-letplace (getter setter) place
 179     (funcall setter `(nreverse ,getter))))
 180
 181 (cl-defstruct (epg-context
 182                (:constructor nil)
 183                (:constructor epg-context--make
 184                 (protocol &optional armor textmode include-certs
 185                           cipher-algorithm digest-algorithm
 186                           compress-algorithm
 187                  &aux
 188                  (program
 189                   (let ((configuration (epg-find-configuration protocol)))
 190                     (unless configuration
 191                       (signal 'epg-error
 192                               (list "no usable configuration" protocol)))
 193                     (alist-get 'program configuration)))))
 194                (:copier nil)
 195                (:predicate nil))
 196   protocol
 197   program
 198   (home-directory epg-gpg-home-directory)
 199   armor
 200   textmode
 201   include-certs
 202   cipher-algorithm
 203   digest-algorithm
 204   compress-algorithm
 205   (passphrase-callback (list #'epg-passphrase-callback-function))
 206   progress-callback
 207   edit-callback
 208   signers
 209   sig-notations
 210   process
 211   output-file
 212   result
 213   operation
 214   pinentry-mode
 215   (error-output "")
 216   error-buffer)
 217
 218 ;; This is not an alias, just so we can mark it as autoloaded.
 219 ;;;###autoload
 220 (defun epg-make-context (&optional protocol armor textmode include-certs
 221                                    cipher-algorithm digest-algorithm
 222                                    compress-algorithm)
 223   "Return a context object."
 224   (epg-context--make (or protocol 'OpenPGP)
 225                      armor textmode include-certs
 226                      cipher-algorithm digest-algorithm
 227                      compress-algorithm))
 228
 229 (defun epg-context-set-armor (context armor)
 230   "Specify if the output should be ASCII armored in CONTEXT."
 231   (declare (obsolete setf "25.1"))
 232   (setf (epg-context-armor context) armor))
 233
 234 (defun epg-context-set-textmode (context textmode)
 235   "Specify if canonical text mode should be used in CONTEXT."
 236   (declare (obsolete setf "25.1"))
 237   (setf (epg-context-textmode context) textmode))
 238
 239 (defun epg-context-set-passphrase-callback (context
 240                                             passphrase-callback)
 241   "Set the function used to query passphrase.
 242
 243 PASSPHRASE-CALLBACK is either a function, or a cons-cell whose
 244 car is a function and cdr is a callback data.
 245
 246 The function gets three arguments: the context, the key-id in
 247 question, and the callback data (if any).
 248
 249 The callback may not be called if you use GnuPG 2.x, which relies
 250 on the external program called `gpg-agent' for passphrase query.
 251 If you really want to intercept passphrase query, consider
 252 installing GnuPG 1.x _along with_ GnuPG 2.x, which does passphrase
 253 query by itself and Emacs can intercept them."
 254   ;; (declare (obsolete setf "25.1"))
 255   (setf (epg-context-passphrase-callback context)
 256         (if (functionp passphrase-callback)
 257             (list passphrase-callback)
 258           passphrase-callback)))
 259
 260 (defun epg-context-set-progress-callback (context
 261                                           progress-callback)
 262   "Set the function which handles progress update.
 263
 264 PROGRESS-CALLBACK is either a function, or a cons-cell whose
 265 car is a function and cdr is a callback data.
 266
 267 The function gets six arguments: the context, the operation
 268 description, the character to display a progress unit, the
 269 current amount done, the total amount to be done, and the
 270 callback data (if any)."
 271   (setf (epg-context-progress-callback context)
 272         (if (functionp progress-callback)
 273             (list progress-callback)
 274           progress-callback)))
 275
 276 (defun epg-context-set-signers (context signers)
 277   "Set the list of key-id for signing."
 278   (declare (obsolete setf "25.1"))
 279   (setf (epg-context-signers context) signers))
 280
 281 (cl-defstruct (epg-signature
 282                (:constructor nil)
 283                (:constructor epg-make-signature
 284                 (status &optional key-id))
 285                (:copier nil)
 286                (:predicate nil))
 287   status
 288   key-id
 289   validity
 290   fingerprint
 291   creation-time
 292   expiration-time
 293   pubkey-algorithm
 294   digest-algorithm
 295   class
 296   version
 297   notations)
 298
 299 (cl-defstruct (epg-new-signature
 300                (:constructor nil)
 301                (:constructor epg-make-new-signature
 302                 (type pubkey-algorithm digest-algorithm
 303                       class creation-time fingerprint))
 304                (:copier nil)
 305                (:predicate nil))
 306   (type nil :read-only t)
 307   (pubkey-algorithm nil :read-only t)
 308   (digest-algorithm nil :read-only t)
 309   (class nil :read-only t)
 310   (creation-time nil :read-only t)
 311   (fingerprint nil :read-only t))
 312
 313 (cl-defstruct (epg-key
 314                (:constructor nil)
 315                (:constructor epg-make-key (owner-trust))
 316                (:copier nil)
 317                (:predicate nil))
 318   (owner-trust nil :read-only t)
 319   sub-key-list user-id-list)
 320
 321 (cl-defstruct (epg-sub-key
 322                (:constructor nil)
 323                (:constructor epg-make-sub-key
 324                 (validity capability secret-p algorithm length id
 325                           creation-time expiration-time))
 326                (:copier nil)
 327                (:predicate nil))
 328   validity capability secret-p algorithm length id
 329   creation-time expiration-time fingerprint)
 330
 331 (cl-defstruct (epg-user-id
 332                (:constructor nil)
 333                (:constructor epg-make-user-id (validity string))
 334                (:copier nil)
 335                (:predicate nil))
 336   validity string signature-list)
 337
 338 (cl-defstruct (epg-key-signature
 339                (:constructor nil)
 340                (:constructor epg-make-key-signature
 341                 (validity pubkey-algorithm key-id creation-time
 342                           expiration-time user-id class
 343                           exportable-p))
 344                (:copier nil)
 345                (:predicate nil))
 346   validity pubkey-algorithm key-id creation-time
 347   expiration-time user-id class
 348   exportable-p)
 349
 350 (cl-defstruct (epg-sig-notation
 351                (:constructor nil)
 352                (:constructor epg-make-sig-notation
 353                 (name value &optional human-readable critical))
 354                (:copier nil)
 355                (:predicate nil))
 356   name value human-readable critical)
 357
 358 (cl-defstruct (epg-import-status
 359                (:constructor nil)
 360                (:constructor epg-make-import-status
 361                 (fingerprint
 362                  &optional reason new user-id signature sub-key secret))
 363                (:copier nil)
 364                (:predicate nil))
 365   fingerprint reason new user-id signature sub-key secret)
 366
 367 (cl-defstruct (epg-import-result
 368                (:constructor nil)
 369                (:constructor epg-make-import-result
 370                 (considered no-user-id imported imported-rsa
 371                             unchanged new-user-ids new-sub-keys
 372                             new-signatures new-revocations
 373                             secret-read secret-imported
 374                             secret-unchanged not-imported
 375                             imports))
 376                (:copier nil)
 377                (:predicate nil))
 378   considered no-user-id imported imported-rsa
 379   unchanged new-user-ids new-sub-keys
 380   new-signatures new-revocations
 381   secret-read secret-imported
 382   secret-unchanged not-imported
 383   imports)
 384
 385 (defun epg-context-result-for (context name)
 386   "Return the result of CONTEXT associated with NAME."
 387   (cdr (assq name (epg-context-result context))))
 388
 389 (defun epg-context-set-result-for (context name value)
 390   "Set the result of CONTEXT associated with NAME to VALUE."
 391   (let* ((result (epg-context-result context))
 392          (entry (assq name result)))
 393     (if entry
 394         (setcdr entry value)
 395       (setf (epg-context-result context) (cons (cons name value) result)))))
 396
 397 (defun epg-signature-to-string (signature)
 398   "Convert SIGNATURE to a human readable string."
 399   (let* ((user-id (cdr (assoc (epg-signature-key-id signature)
 400                               epg-user-id-alist)))
 401          (pubkey-algorithm (epg-signature-pubkey-algorithm signature))
 402          (key-id (epg-signature-key-id signature)))
 403     (concat
 404      (cond ((eq (epg-signature-status signature) 'good)
 405             "Good signature from ")
 406            ((eq (epg-signature-status signature) 'bad)
 407             "Bad signature from ")
 408            ((eq (epg-signature-status signature) 'expired)
 409             "Expired signature from ")
 410            ((eq (epg-signature-status signature) 'expired-key)
 411             "Signature made by expired key ")
 412            ((eq (epg-signature-status signature) 'revoked-key)
 413             "Signature made by revoked key ")
 414            ((eq (epg-signature-status signature) 'no-pubkey)
 415             "No public key for "))
 416      key-id
 417      (if user-id
 418          (concat " "
 419                  (if (stringp user-id)
 420                      user-id
 421                    (epg-decode-dn user-id)))
 422        "")
 423      (if (epg-signature-validity signature)
 424          (format " (trust %s)"  (epg-signature-validity signature))
 425        "")
 426      (if (epg-signature-creation-time signature)
 427          (format-time-string " created at %Y-%m-%dT%T%z"
 428                              (epg-signature-creation-time signature))
 429        "")
 430      (if pubkey-algorithm
 431          (concat " using "
 432                  (or (cdr (assq pubkey-algorithm epg-pubkey-algorithm-alist))
 433                      (format "(unknown algorithm %d)" pubkey-algorithm)))
 434        ""))))
 435
 436 (defun epg-verify-result-to-string (verify-result)
 437   "Convert VERIFY-RESULT to a human readable string."
 438   (mapconcat #'epg-signature-to-string verify-result "\n"))
 439
 440 (defun epg-new-signature-to-string (new-signature)
 441   "Convert NEW-SIGNATURE to a human readable string."
 442   (concat
 443    (cond ((eq (epg-new-signature-type new-signature) 'detached)
 444           "Detached signature ")
 445          ((eq (epg-new-signature-type new-signature) 'clear)
 446           "Cleartext signature ")
 447          (t
 448           "Signature "))
 449    (cdr (assq (epg-new-signature-pubkey-algorithm new-signature)
 450               epg-pubkey-algorithm-alist))
 451    "/"
 452    (cdr (assq (epg-new-signature-digest-algorithm new-signature)
 453               epg-digest-algorithm-alist))
 454    " "
 455    (format "%02X " (epg-new-signature-class new-signature))
 456    (epg-new-signature-fingerprint new-signature)))
 457
 458 (defun epg-import-result-to-string (import-result)
 459   "Convert IMPORT-RESULT to a human readable string."
 460   (concat (format "Total number processed: %d\n"
 461                   (epg-import-result-considered import-result))
 462           (if (> (epg-import-result-not-imported import-result) 0)
 463               (format "      skipped new keys: %d\n"
 464                       (epg-import-result-not-imported import-result)))
 465           (if (> (epg-import-result-no-user-id import-result) 0)
 466               (format "          w/o user IDs: %d\n"
 467                       (epg-import-result-no-user-id import-result)))
 468           (if (> (epg-import-result-imported import-result) 0)
 469               (concat (format "              imported: %d"
 470                               (epg-import-result-imported import-result))
 471                       (if (> (epg-import-result-imported-rsa import-result) 0)
 472                           (format "  (RSA: %d)"
 473                                   (epg-import-result-imported-rsa
 474                                    import-result)))
 475                       "\n"))
 476           (if (> (epg-import-result-unchanged import-result) 0)
 477               (format "             unchanged: %d\n"
 478                       (epg-import-result-unchanged import-result)))
 479           (if (> (epg-import-result-new-user-ids import-result) 0)
 480               (format "          new user IDs: %d\n"
 481                       (epg-import-result-new-user-ids import-result)))
 482           (if (> (epg-import-result-new-sub-keys import-result) 0)
 483               (format "           new subkeys: %d\n"
 484                       (epg-import-result-new-sub-keys import-result)))
 485           (if (> (epg-import-result-new-signatures import-result) 0)
 486               (format "        new signatures: %d\n"
 487                       (epg-import-result-new-signatures import-result)))
 488           (if (> (epg-import-result-new-revocations import-result) 0)
 489               (format "   new key revocations: %d\n"
 490                       (epg-import-result-new-revocations import-result)))
 491           (if (> (epg-import-result-secret-read import-result) 0)
 492               (format "      secret keys read: %d\n"
 493                       (epg-import-result-secret-read import-result)))
 494           (if (> (epg-import-result-secret-imported import-result) 0)
 495               (format "  secret keys imported: %d\n"
 496                       (epg-import-result-secret-imported import-result)))
 497           (if (> (epg-import-result-secret-unchanged import-result) 0)
 498               (format " secret keys unchanged: %d\n"
 499                       (epg-import-result-secret-unchanged import-result)))))
 500
 501 (defun epg-error-to-string (error)
 502   (cond
 503    ((eq (car error) 'exit)
 504     "Exit")
 505    ((eq (car error) 'quit)
 506     "Canceled")
 507    ((eq (car error) 'no-data)
 508     (let ((entry (assq (cdr error) epg-no-data-reason-alist)))
 509       (if entry
 510           (format "No data (%s)" (downcase (cdr entry)))
 511         "No data")))
 512    ((eq (car error) 'unexpected)
 513     (let ((entry (assq (cdr error) epg-unexpected-reason-alist)))
 514       (if entry
 515           (format "Unexpected (%s)" (downcase (cdr entry)))
 516         "Unexpected")))
 517    ((eq (car error) 'bad-armor)
 518     "Bad armor")
 519    ((memq (car error) '(invalid-recipient invalid-signer))
 520     (concat
 521      (if (eq (car error) 'invalid-recipient)
 522          "Unusable public key"
 523        "Unusable secret key")
 524      (let ((entry (assq 'requested (cdr error))))
 525        (if entry
 526            (format ": %s" (cdr entry))
 527          ": <unknown>"))
 528      (let ((entry (assq 'reason (cdr error))))
 529        (if (and entry
 530                 (> (cdr entry) 0)       ;no specific reason given
 531                 (setq entry (assq (cdr entry)
 532                                   epg-invalid-recipients-reason-alist)))
 533            (format " (%s)" (downcase (cdr entry)))
 534          ""))))
 535    ((eq (car error) 'no-pubkey)
 536     (format "No public key: %s" (cdr error)))
 537    ((eq (car error) 'no-seckey)
 538     (format "No secret key: %s" (cdr error)))
 539    ((eq (car error) 'no-recipients)
 540     "No recipients")
 541    ((eq (car error) 'no-signers)
 542     "No signers")
 543    ((eq (car error) 'delete-problem)
 544     (let ((entry (assq (cdr error) epg-delete-problem-reason-alist)))
 545       (if entry
 546           (format "Delete problem (%s)" (downcase (cdr entry)))
 547         "Delete problem")))
 548    ((eq (car error) 'key-not-created)
 549     "Key not created")))
 550
 551 (defun epg-errors-to-string (errors)
 552   (mapconcat #'epg-error-to-string errors "; "))
 553
 554 (declare-function pinentry-start "pinentry" (&optional quiet))
 555
 556 (defun epg--start (context args)
 557   "Start `epg-gpg-program' in a subprocess with given ARGS."
 558   (if (and (epg-context-process context)
 559            (eq (process-status (epg-context-process context)) 'run))
 560       (error "%s is already running in this context"
 561              (epg-context-program context)))
 562   (let* ((agent-info (getenv "GPG_AGENT_INFO"))
 563          (args (append (list "--no-tty"
 564                              "--status-fd" "1"
 565                              "--yes")
 566                        (if (and (not (eq (epg-context-protocol context) 'CMS))
 567                                 (string-match ":" (or agent-info "")))
 568                            '("--use-agent"))
 569                        (if (and (not (eq (epg-context-protocol context) 'CMS))
 570                                 (epg-context-progress-callback context))
 571                            '("--enable-progress-filter"))
 572                        (if (epg-context-home-directory context)
 573                            (list "--homedir"
 574                                  (epg-context-home-directory context)))
 575                        (unless (eq (epg-context-protocol context) 'CMS)
 576                          '("--command-fd" "0"))
 577                        (if (epg-context-armor context) '("--armor"))
 578                        (if (epg-context-textmode context) '("--textmode"))
 579                        (if (epg-context-output-file context)
 580                            (list "--output" (epg-context-output-file context)))
 581                        (if (epg-context-pinentry-mode context)
 582                            (list "--pinentry-mode"
 583                                  (symbol-name (epg-context-pinentry-mode
 584                                                context))))
 585                        args))
 586          (process-environment process-environment)
 587          (buffer (generate-new-buffer " *epg*"))
 588          error-process
 589          process
 590          terminal-name
 591          agent-file
 592          (agent-mtime '(0 0 0 0)))
 593     ;; Set GPG_TTY and TERM for pinentry-curses.  Note that we can't
 594     ;; use `terminal-name' here to get the real pty name for the child
 595     ;; process, though /dev/fd/0" is not portable.
 596     (unless (memq system-type '(ms-dos windows-nt))
 597       (with-temp-buffer
 598         (condition-case nil
 599             (when (= (call-process "tty" "/dev/fd/0" t) 0)
 600               (delete-char -1)
 601               (setq terminal-name (buffer-string)))
 602           (file-error))))
 603     (when terminal-name
 604       (setq process-environment
 605             (cons (concat "GPG_TTY=" terminal-name)
 606                   (cons "TERM=xterm" process-environment))))
 607     ;; Automatically start the Emacs Pinentry server if appropriate.
 608     (when (and (fboundp 'pinentry-start)
 609                ;; Emacs Pinentry is useless if Emacs has no interactive session.
 610                (not noninteractive)
 611                ;; Prefer pinentry-mode over Emacs Pinentry.
 612                (null (epg-context-pinentry-mode context))
 613                ;; Check if the allow-emacs-pinentry option is set.
 614                (executable-find epg-gpgconf-program)
 615                (with-temp-buffer
 616                  (when (= (call-process epg-gpgconf-program nil t nil
 617                                         "--list-options" "gpg-agent")
 618                           0)
 619                    (goto-char (point-min))
 620                    (re-search-forward
 621                     "^allow-emacs-pinentry:\\(?:.*:\\)\\{8\\}1"
 622                     nil t))))
 623       (pinentry-start 'quiet))
 624     (setq process-environment
 625           (cons (format "INSIDE_EMACS=%s,epg" emacs-version)
 626                 process-environment))
 627     ;; Record modified time of gpg-agent socket to restore the Emacs
 628     ;; frame on text terminal in `epg-wait-for-completion'.
 629     ;; See
 630     ;; <https://lists.gnu.org/archive/html/emacs-devel/2007-02/msg00755.html>
 631     ;; for more details.
 632     (when (and agent-info (string-match "\\(.*\\):[0-9]+:[0-9]+" agent-info))
 633       (setq agent-file (match-string 1 agent-info)
 634             agent-mtime (or (nth 5 (file-attributes agent-file)) '(0 0 0 0))))
 635     (if epg-debug
 636         (save-excursion
 637           (unless epg-debug-buffer
 638             (setq epg-debug-buffer (generate-new-buffer " *epg-debug*")))
 639           (set-buffer epg-debug-buffer)
 640           (goto-char (point-max))
 641           (insert (if agent-info
 642                       (format "GPG_AGENT_INFO=%s\n" agent-info)
 643                     "GPG_AGENT_INFO is not set\n")
 644                   (format "%s %s\n"
 645                           (epg-context-program context)
 646                           (mapconcat #'identity args " ")))))
 647     (with-current-buffer buffer
 648       (if (fboundp 'set-buffer-multibyte)
 649           (set-buffer-multibyte nil))
 650       (make-local-variable 'epg-last-status)
 651       (setq epg-last-status nil)
 652       (make-local-variable 'epg-read-point)
 653       (setq epg-read-point (point-min))
 654       (make-local-variable 'epg-process-filter-running)
 655       (setq epg-process-filter-running nil)
 656       (make-local-variable 'epg-pending-status-list)
 657       (setq epg-pending-status-list nil)
 658       (make-local-variable 'epg-key-id)
 659       (setq epg-key-id nil)
 660       (make-local-variable 'epg-context)
 661       (setq epg-context context)
 662       (make-local-variable 'epg-agent-file)
 663       (setq epg-agent-file agent-file)
 664       (make-local-variable 'epg-agent-mtime)
 665       (setq epg-agent-mtime agent-mtime))
 666     (setq error-process
 667           (make-pipe-process :name "epg-error"
 668                              :buffer (generate-new-buffer " *epg-error*")
 669                              ;; Suppress "XXX finished" line.
 670                              :sentinel #'ignore
 671                              :noquery t))
 672     (setf (epg-context-error-buffer context) (process-buffer error-process))
 673     (with-file-modes 448
 674       (setq process (make-process :name "epg"
 675                                   :buffer buffer
 676                                   :command (cons (epg-context-program context)
 677                                                  args)
 678                                   :connection-type 'pipe
 679                                   :coding '(binary . binary)
 680                                   :filter #'epg--process-filter
 681                                   :stderr error-process
 682                                   :noquery t)))
 683     (setf (epg-context-process context) process)))
 684
 685 (defun epg--process-filter (process input)
 686   (if epg-debug
 687       (with-current-buffer
 688           (or epg-debug-buffer
 689               (setq epg-debug-buffer (generate-new-buffer " *epg-debug*")))
 690         (goto-char (point-max))
 691         (insert input)))
 692   (if (buffer-live-p (process-buffer process))
 693       (with-current-buffer (process-buffer process)
 694         (save-excursion
 695           (goto-char (point-max))
 696           (insert input)
 697           (unless epg-process-filter-running
 698             (let ((epg-process-filter-running t))
 699               (goto-char epg-read-point)
 700               (beginning-of-line)
 701               (while (looking-at ".*\n") ;the input line finished
 702                 (if (looking-at "\\[GNUPG:] \\([A-Z_]+\\) ?\\(.*\\)")
 703                     (let ((status (match-string 1))
 704                           (string (match-string 2))
 705                           symbol)
 706                       (if (member status epg-pending-status-list)
 707                           (setq epg-pending-status-list nil))
 708                       ;; When editing a key, delegate all interaction
 709                       ;; to edit-callback.
 710                       (if (eq (epg-context-operation epg-context) 'edit-key)
 711                           (funcall (car (epg-context-edit-callback
 712                                          epg-context))
 713                                    epg-context
 714                                    status
 715                                    string
 716                                    (cdr (epg-context-edit-callback
 717                                          epg-context)))
 718                         ;; Otherwise call epg--status-STATUS function.
 719                         (setq symbol (intern-soft (concat "epg--status-"
 720                                                           status)))
 721                         (if (and symbol
 722                                  (fboundp symbol))
 723                             (funcall symbol epg-context string)))
 724                       (setq epg-last-status (cons status string))))
 725                 (forward-line)
 726                 (setq epg-read-point (point)))))))))
 727
 728 (defun epg-read-output (context)
 729   "Read the output file CONTEXT and return the content as a string."
 730   (with-temp-buffer
 731     (if (fboundp 'set-buffer-multibyte)
 732         (set-buffer-multibyte nil))
 733     (if (file-exists-p (epg-context-output-file context))
 734         (let ((coding-system-for-read 'binary))
 735           (insert-file-contents (epg-context-output-file context))
 736           (buffer-string)))))
 737
 738 (defun epg-wait-for-status (context status-list)
 739   "Wait until one of elements in STATUS-LIST arrives."
 740   (with-current-buffer (process-buffer (epg-context-process context))
 741     (setq epg-pending-status-list status-list)
 742     (while (and (eq (process-status (epg-context-process context)) 'run)
 743                 epg-pending-status-list)
 744       (accept-process-output (epg-context-process context) 1))
 745     (if epg-pending-status-list
 746         (epg-context-set-result-for
 747          context 'error
 748          (cons '(exit)
 749                (epg-context-result-for context 'error))))))
 750
 751 (defun epg-wait-for-completion (context)
 752   "Wait until the `epg-gpg-program' process completes."
 753   (while (eq (process-status (epg-context-process context)) 'run)
 754     (accept-process-output (epg-context-process context) 1))
 755   ;; This line is needed to run the process-filter right now.
 756   (sleep-for 0.1)
 757   ;; Restore Emacs frame on text terminal, when pinentry-curses has terminated.
 758   (if (with-current-buffer (process-buffer (epg-context-process context))
 759         (and epg-agent-file
 760              (time-less-p epg-agent-mtime
 761                           (or (nth 5 (file-attributes epg-agent-file)) 0))))
 762       (redraw-frame))
 763   (epg-context-set-result-for
 764    context 'error
 765    (nreverse (epg-context-result-for context 'error)))
 766   (setf (epg-context-error-output context)
 767         (with-current-buffer (epg-context-error-buffer context)
 768           (buffer-string))))
 769
 770 (defun epg-reset (context)
 771   "Reset the CONTEXT."
 772   (if (and (epg-context-process context)
 773            (buffer-live-p (process-buffer (epg-context-process context))))
 774       (kill-buffer (process-buffer (epg-context-process context))))
 775   (if (buffer-live-p (epg-context-error-buffer context))
 776       (kill-buffer (epg-context-error-buffer context)))
 777   (setf (epg-context-process context) nil)
 778   (setf (epg-context-edit-callback context) nil))
 779
 780 (defun epg-delete-output-file (context)
 781   "Delete the output file of CONTEXT."
 782   (if (and (epg-context-output-file context)
 783            (file-exists-p (epg-context-output-file context)))
 784       (delete-file (epg-context-output-file context))))
 785
 786 (eval-and-compile
 787   (if (fboundp 'decode-coding-string)
 788       (defalias 'epg--decode-coding-string 'decode-coding-string)
 789     (defalias 'epg--decode-coding-string 'identity)))
 790
 791 (defun epg--status-USERID_HINT (_context string)
 792   (if (string-match "\\`\\([^ ]+\\) \\(.*\\)" string)
 793       (let* ((key-id (match-string 1 string))
 794              (user-id (match-string 2 string))
 795              (entry (assoc key-id epg-user-id-alist)))
 796         (condition-case nil
 797             (setq user-id (epg--decode-coding-string
 798                            (epg--decode-percent-escape user-id)
 799                            'utf-8))
 800           (error))
 801         (if entry
 802             (setcdr entry user-id)
 803           (setq epg-user-id-alist (cons (cons key-id user-id)
 804                                         epg-user-id-alist))))))
 805
 806 (defun epg--status-NEED_PASSPHRASE (_context string)
 807   (if (string-match "\\`\\([^ ]+\\)" string)
 808       (setq epg-key-id (match-string 1 string))))
 809
 810 (defun epg--status-NEED_PASSPHRASE_SYM (_context _string)
 811   (setq epg-key-id 'SYM))
 812
 813 (defun epg--status-NEED_PASSPHRASE_PIN (_context _string)
 814   (setq epg-key-id 'PIN))
 815
 816 (eval-and-compile
 817   (if (fboundp 'clear-string)
 818       (defalias 'epg--clear-string 'clear-string)
 819     (defun epg--clear-string (string)
 820       (fillarray string 0))))
 821
 822 (eval-and-compile
 823   (if (fboundp 'encode-coding-string)
 824       (defalias 'epg--encode-coding-string 'encode-coding-string)
 825     (defalias 'epg--encode-coding-string 'identity)))
 826
 827 (defun epg--status-GET_HIDDEN (context string)
 828   (when (and epg-key-id
 829              (string-match "\\`passphrase\\." string))
 830     (unless (epg-context-passphrase-callback context)
 831       (error "passphrase-callback not set"))
 832     (let (inhibit-quit
 833           passphrase
 834           passphrase-with-new-line
 835           encoded-passphrase-with-new-line)
 836       (unwind-protect
 837           (condition-case nil
 838               (progn
 839                 (setq passphrase
 840                       (funcall
 841                        (car (epg-context-passphrase-callback context))
 842                        context
 843                        epg-key-id
 844                        (cdr (epg-context-passphrase-callback context))))
 845                 (when passphrase
 846                   (setq passphrase-with-new-line (concat passphrase "\n"))
 847                   (epg--clear-string passphrase)
 848                   (setq passphrase nil)
 849                   (if epg-passphrase-coding-system
 850                       (progn
 851                         (setq encoded-passphrase-with-new-line
 852                               (epg--encode-coding-string
 853                                passphrase-with-new-line
 854                                (coding-system-change-eol-conversion
 855                                 epg-passphrase-coding-system 'unix)))
 856                         (epg--clear-string passphrase-with-new-line)
 857                         (setq passphrase-with-new-line nil))
 858                     (setq encoded-passphrase-with-new-line
 859                           passphrase-with-new-line
 860                           passphrase-with-new-line nil))
 861                   (process-send-string (epg-context-process context)
 862                                        encoded-passphrase-with-new-line)))
 863             (quit
 864              (epg-context-set-result-for
 865               context 'error
 866               (cons '(quit)
 867                     (epg-context-result-for context 'error)))
 868              (delete-process (epg-context-process context))))
 869         (if passphrase
 870             (epg--clear-string passphrase))
 871         (if passphrase-with-new-line
 872             (epg--clear-string passphrase-with-new-line))
 873         (if encoded-passphrase-with-new-line
 874             (epg--clear-string encoded-passphrase-with-new-line))))))
 875
 876 (defun epg--prompt-GET_BOOL (_context string)
 877   (let ((entry (assoc string epg-prompt-alist)))
 878     (y-or-n-p (if entry (cdr entry) (concat string "? ")))))
 879
 880 (defun epg--prompt-GET_BOOL-untrusted_key.override (_context _string)
 881   (y-or-n-p (if (and (equal (car epg-last-status) "USERID_HINT")
 882                      (string-match "\\`\\([^ ]+\\) \\(.*\\)"
 883                                    (cdr epg-last-status)))
 884                 (let* ((key-id (match-string 1 (cdr epg-last-status)))
 885                        (user-id (match-string 2 (cdr epg-last-status)))
 886                        (entry (assoc key-id epg-user-id-alist)))
 887                   (if entry
 888                       (setq user-id (cdr entry)))
 889                   (format "Untrusted key %s %s.  Use anyway? " key-id user-id))
 890               "Use untrusted key anyway? ")))
 891
 892 (defun epg--status-GET_BOOL (context string)
 893   (let (inhibit-quit)
 894     (condition-case nil
 895         (if (funcall (or (intern-soft (concat "epg--prompt-GET_BOOL-" string))
 896                          #'epg--prompt-GET_BOOL)
 897                      context string)
 898             (process-send-string (epg-context-process context) "y\n")
 899           (process-send-string (epg-context-process context) "n\n"))
 900       (quit
 901        (epg-context-set-result-for
 902         context 'error
 903         (cons '(quit)
 904               (epg-context-result-for context 'error)))
 905        (delete-process (epg-context-process context))))))
 906
 907 (defun epg--status-GET_LINE (context string)
 908   (let ((entry (assoc string epg-prompt-alist))
 909         inhibit-quit)
 910     (condition-case nil
 911         (process-send-string (epg-context-process context)
 912                              (concat (read-string
 913                                       (if entry
 914                                           (cdr entry)
 915                                         (concat string ": ")))
 916                                      "\n"))
 917       (quit
 918        (epg-context-set-result-for
 919         context 'error
 920         (cons '(quit)
 921               (epg-context-result-for context 'error)))
 922        (delete-process (epg-context-process context))))))
 923
 924 (defun epg--status-*SIG (context status string)
 925   (if (string-match "\\`\\([^ ]+\\) \\(.*\\)" string)
 926       (let* ((key-id (match-string 1 string))
 927              (user-id (match-string 2 string))
 928              (entry (assoc key-id epg-user-id-alist)))
 929         (epg-context-set-result-for
 930          context
 931          'verify
 932          (cons (epg-make-signature status key-id)
 933                (epg-context-result-for context 'verify)))
 934         (condition-case nil
 935             (if (eq (epg-context-protocol context) 'CMS)
 936                 (setq user-id (epg-dn-from-string user-id))
 937               (setq user-id (epg--decode-coding-string
 938                              (epg--decode-percent-escape user-id)
 939                              'utf-8)))
 940           (error))
 941         (if entry
 942             (setcdr entry user-id)
 943           (setq epg-user-id-alist
 944                 (cons (cons key-id user-id) epg-user-id-alist))))
 945     (epg-context-set-result-for
 946      context
 947      'verify
 948      (cons (epg-make-signature status)
 949            (epg-context-result-for context 'verify)))))
 950
 951 (defun epg--status-GOODSIG (context string)
 952   (epg--status-*SIG context 'good string))
 953
 954 (defun epg--status-EXPSIG (context string)
 955   (epg--status-*SIG context 'expired string))
 956
 957 (defun epg--status-EXPKEYSIG (context string)
 958   (epg--status-*SIG context 'expired-key string))
 959
 960 (defun epg--status-REVKEYSIG (context string)
 961   (epg--status-*SIG context 'revoked-key string))
 962
 963 (defun epg--status-BADSIG (context string)
 964   (epg--status-*SIG context 'bad string))
 965
 966 (defun epg--status-NO_PUBKEY (context string)
 967   (if (eq (epg-context-operation context) 'verify)
 968       (let ((signature (car (epg-context-result-for context 'verify))))
 969         (if (and signature
 970                  (eq (epg-signature-status signature) 'error)
 971                  (equal (epg-signature-key-id signature) string))
 972             (setf (epg-signature-status signature) 'no-pubkey)))
 973     (epg-context-set-result-for
 974      context 'error
 975      (cons (cons 'no-pubkey string)
 976            (epg-context-result-for context 'error)))))
 977
 978 (defun epg--status-NO_SECKEY (context string)
 979   (epg-context-set-result-for
 980    context 'error
 981    (cons (cons 'no-seckey string)
 982          (epg-context-result-for context 'error))))
 983
 984 (defun epg--time-from-seconds (seconds)
 985   (let ((number-seconds (string-to-number (concat seconds ".0"))))
 986     (cons (floor (/ number-seconds 65536))
 987           (floor (mod number-seconds 65536)))))
 988
 989 (defun epg--status-ERRSIG (context string)
 990   (if (string-match "\\`\\([^ ]+\\) \\([0-9]+\\) \\([0-9]+\\) \
 991 \\([0-9A-Fa-f][0-9A-Fa-f]\\) \\([^ ]+\\) \\([0-9]+\\)"
 992                     string)
 993       (let ((signature (epg-make-signature 'error)))
 994         (epg-context-set-result-for
 995          context
 996          'verify
 997          (cons signature
 998                (epg-context-result-for context 'verify)))
 999         (setf (epg-signature-key-id signature)
1000               (match-string 1 string))
1001         (setf (epg-signature-pubkey-algorithm signature)
1002               (string-to-number (match-string 2 string)))
1003         (setf (epg-signature-digest-algorithm signature)
1004               (string-to-number (match-string 3 string)))
1005         (setf (epg-signature-class signature)
1006               (string-to-number (match-string 4 string) 16))
1007         (setf (epg-signature-creation-time signature)
1008               (epg--time-from-seconds (match-string 5 string))))))
1009
1010 (defun epg--status-VALIDSIG (context string)
1011   (let ((signature (car (epg-context-result-for context 'verify))))
1012     (when (and signature
1013                (eq (epg-signature-status signature) 'good)
1014                (string-match "\\`\\([^ ]+\\) [^ ]+ \\([^ ]+\\) \\([^ ]+\\) \
1015 \\([0-9]+\\) [^ ]+ \\([0-9]+\\) \\([0-9]+\\) \\([0-9A-Fa-f][0-9A-Fa-f]\\) \
1016 \\(.*\\)"
1017                            string))
1018       (setf (epg-signature-fingerprint signature)
1019             (match-string 1 string))
1020       (setf (epg-signature-creation-time signature)
1021             (epg--time-from-seconds (match-string 2 string)))
1022       (unless (equal (match-string 3 string) "0")
1023         (setf (epg-signature-expiration-time signature)
1024               (epg--time-from-seconds (match-string 3 string))))
1025       (setf (epg-signature-version signature)
1026             (string-to-number (match-string 4 string)))
1027       (setf (epg-signature-pubkey-algorithm signature)
1028             (string-to-number (match-string 5 string)))
1029       (setf (epg-signature-digest-algorithm signature)
1030             (string-to-number (match-string 6 string)))
1031       (setf (epg-signature-class signature)
1032             (string-to-number (match-string 7 string) 16)))))
1033
1034 (defun epg--status-TRUST_UNDEFINED (context _string)
1035   (let ((signature (car (epg-context-result-for context 'verify))))
1036     (if (and signature
1037              (eq (epg-signature-status signature) 'good))
1038         (setf (epg-signature-validity signature) 'undefined))))
1039
1040 (defun epg--status-TRUST_NEVER (context _string)
1041   (let ((signature (car (epg-context-result-for context 'verify))))
1042     (if (and signature
1043              (eq (epg-signature-status signature) 'good))
1044         (setf (epg-signature-validity signature) 'never))))
1045
1046 (defun epg--status-TRUST_MARGINAL (context _string)
1047   (let ((signature (car (epg-context-result-for context 'verify))))
1048     (if (and signature
1049              (eq (epg-signature-status signature) 'good))
1050         (setf (epg-signature-validity signature) 'marginal))))
1051
1052 (defun epg--status-TRUST_FULLY (context _string)
1053   (let ((signature (car (epg-context-result-for context 'verify))))
1054     (if (and signature
1055              (eq (epg-signature-status signature) 'good))
1056         (setf (epg-signature-validity signature) 'full))))
1057
1058 (defun epg--status-TRUST_ULTIMATE (context _string)
1059   (let ((signature (car (epg-context-result-for context 'verify))))
1060     (if (and signature
1061              (eq (epg-signature-status signature) 'good))
1062         (setf (epg-signature-validity signature) 'ultimate))))
1063
1064 (defun epg--status-NOTATION_NAME (context string)
1065   (let ((signature (car (epg-context-result-for context 'verify))))
1066     (if signature
1067         (push (epg-make-sig-notation string nil t nil)
1068               (epg-signature-notations signature)))))
1069
1070 (defun epg--status-NOTATION_DATA (context string)
1071   (let ((signature (car (epg-context-result-for context 'verify)))
1072         notation)
1073     (if (and signature
1074              (setq notation (car (epg-signature-notations signature))))
1075         (setf (epg-sig-notation-value notation) string))))
1076
1077 (defun epg--status-POLICY_URL (context string)
1078   (let ((signature (car (epg-context-result-for context 'verify))))
1079     (if signature
1080         (push (epg-make-sig-notation nil string t nil)
1081               (epg-signature-notations signature)))))
1082
1083 (defun epg--status-PROGRESS (context string)
1084   (if (and (epg-context-progress-callback context)
1085            (string-match "\\`\\([^ ]+\\) \\([^ ]\\) \\([0-9]+\\) \\([0-9]+\\)"
1086                          string))
1087       (funcall (car (epg-context-progress-callback context))
1088                context
1089                (match-string 1 string)
1090                (match-string 2 string)
1091                (string-to-number (match-string 3 string))
1092                (string-to-number (match-string 4 string))
1093                (cdr (epg-context-progress-callback context)))))
1094
1095 (defun epg--status-ENC_TO (context string)
1096   (if (string-match "\\`\\([0-9A-Za-z]+\\) \\([0-9]+\\) \\([0-9]+\\)" string)
1097       (epg-context-set-result-for
1098        context 'encrypted-to
1099        (cons (list (match-string 1 string)
1100                    (string-to-number (match-string 2 string))
1101                    (string-to-number (match-string 3 string)))
1102              (epg-context-result-for context 'encrypted-to)))))
1103
1104 (defun epg--status-DECRYPTION_FAILED (context _string)
1105   (epg-context-set-result-for context 'decryption-failed t))
1106
1107 (defun epg--status-DECRYPTION_OKAY (context _string)
1108   (epg-context-set-result-for context 'decryption-okay t))
1109
1110 (defun epg--status-NODATA (context string)
1111   (epg-context-set-result-for
1112    context 'error
1113    (cons (cons 'no-data (string-to-number string))
1114          (epg-context-result-for context 'error))))
1115
1116 (defun epg--status-UNEXPECTED (context string)
1117   (epg-context-set-result-for
1118    context 'error
1119    (cons (cons 'unexpected (string-to-number string))
1120          (epg-context-result-for context 'error))))
1121
1122 (defun epg--status-KEYEXPIRED (context string)
1123   (epg-context-set-result-for
1124    context 'key
1125    (cons (list 'key-expired (cons 'expiration-time
1126                                   (epg--time-from-seconds string)))
1127          (epg-context-result-for context 'key))))
1128
1129 (defun epg--status-KEYREVOKED (context _string)
1130   (epg-context-set-result-for
1131    context 'key
1132    (cons '(key-revoked)
1133          (epg-context-result-for context 'key))))
1134
1135 (defun epg--status-BADARMOR (context _string)
1136   (epg-context-set-result-for
1137    context 'error
1138    (cons '(bad-armor)
1139          (epg-context-result-for context 'error))))
1140
1141 (defun epg--status-INV_RECP (context string)
1142   (if (string-match "\\`\\([0-9]+\\) \\(.*\\)" string)
1143       (epg-context-set-result-for
1144        context 'error
1145        (cons (list 'invalid-recipient
1146                    (cons 'reason
1147                          (string-to-number (match-string 1 string)))
1148                    (cons 'requested
1149                          (match-string 2 string)))
1150              (epg-context-result-for context 'error)))))
1151
1152 (defun epg--status-INV_SGNR (context string)
1153   (if (string-match "\\`\\([0-9]+\\) \\(.*\\)" string)
1154       (epg-context-set-result-for
1155        context 'error
1156        (cons (list 'invalid-signer
1157                    (cons 'reason
1158                          (string-to-number (match-string 1 string)))
1159                    (cons 'requested
1160                          (match-string 2 string)))
1161              (epg-context-result-for context 'error)))))
1162
1163 (defun epg--status-NO_RECP (context _string)
1164   (epg-context-set-result-for
1165    context 'error
1166    (cons '(no-recipients)
1167          (epg-context-result-for context 'error))))
1168
1169 (defun epg--status-NO_SGNR (context _string)
1170   (epg-context-set-result-for
1171    context 'error
1172    (cons '(no-signers)
1173          (epg-context-result-for context 'error))))
1174
1175 (defun epg--status-DELETE_PROBLEM (context string)
1176   (if (string-match "\\`\\([0-9]+\\)" string)
1177       (epg-context-set-result-for
1178        context 'error
1179        (cons (cons 'delete-problem
1180                    (string-to-number (match-string 1 string)))
1181              (epg-context-result-for context 'error)))))
1182
1183 (defun epg--status-SIG_CREATED (context string)
1184   (if (string-match "\\`\\([DCS]\\) \\([0-9]+\\) \\([0-9]+\\) \
1185 \\([0-9A-Fa-F][0-9A-Fa-F]\\) \\(.*\\) " string)
1186       (epg-context-set-result-for
1187        context 'sign
1188        (cons (epg-make-new-signature
1189               (cdr (assq (aref (match-string 1 string) 0)
1190                          epg-new-signature-type-alist))
1191               (string-to-number (match-string 2 string))
1192               (string-to-number (match-string 3 string))
1193               (string-to-number (match-string 4 string) 16)
1194               (epg--time-from-seconds (match-string 5 string))
1195               (substring string (match-end 0)))
1196              (epg-context-result-for context 'sign)))))
1197
1198 (defun epg--status-KEY_CREATED (context string)
1199   (if (string-match "\\`\\([BPS]\\) \\([^ ]+\\)" string)
1200       (epg-context-set-result-for
1201        context 'generate-key
1202        (cons (list (cons 'type (string-to-char (match-string 1 string)))
1203                    (cons 'fingerprint (match-string 2 string)))
1204              (epg-context-result-for context 'generate-key)))))
1205
1206 (defun epg--status-KEY_NOT_CREATED (context _string)
1207   (epg-context-set-result-for
1208    context 'error
1209    (cons '(key-not-created)
1210          (epg-context-result-for context 'error))))
1211
1212 (defun epg--status-IMPORTED (_context string)
1213   (if (string-match "\\`\\([^ ]+\\) \\(.*\\)" string)
1214       (let* ((key-id (match-string 1 string))
1215              (user-id (match-string 2 string))
1216              (entry (assoc key-id epg-user-id-alist)))
1217         (condition-case nil
1218             (setq user-id (epg--decode-coding-string
1219                            (epg--decode-percent-escape user-id)
1220                            'utf-8))
1221           (error))
1222         (if entry
1223             (setcdr entry user-id)
1224           (setq epg-user-id-alist (cons (cons key-id user-id)
1225                                         epg-user-id-alist))))))
1226
1227 (defun epg--status-IMPORT_OK (context string)
1228   (if (string-match "\\`\\([0-9]+\\)\\( \\(.+\\)\\)?" string)
1229       (let ((reason (string-to-number (match-string 1 string))))
1230         (epg-context-set-result-for
1231          context 'import-status
1232          (cons (epg-make-import-status (if (match-beginning 2)
1233                                            (match-string 3 string))
1234                                        nil
1235                                        (/= (logand reason 1) 0)
1236                                        (/= (logand reason 2) 0)
1237                                        (/= (logand reason 4) 0)
1238                                        (/= (logand reason 8) 0)
1239                                        (/= (logand reason 16) 0))
1240                (epg-context-result-for context 'import-status))))))
1241
1242 (defun epg--status-IMPORT_PROBLEM (context string)
1243   (if (string-match "\\`\\([0-9]+\\)\\( \\(.+\\)\\)?" string)
1244       (epg-context-set-result-for
1245        context 'import-status
1246        (cons (epg-make-import-status
1247               (if (match-beginning 2)
1248                   (match-string 3 string))
1249               (string-to-number (match-string 1 string)))
1250              (epg-context-result-for context 'import-status)))))
1251
1252 (defun epg--status-IMPORT_RES (context string)
1253   (when (string-match "\\`\\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \
1254 \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\) \
1255 \\([0-9]+\\) \\([0-9]+\\) \\([0-9]+\\)" string)
1256     (epg-context-set-result-for
1257      context 'import
1258      (epg-make-import-result (string-to-number (match-string 1 string))
1259                              (string-to-number (match-string 2 string))
1260                              (string-to-number (match-string 3 string))
1261                              (string-to-number (match-string 4 string))
1262                              (string-to-number (match-string 5 string))
1263                              (string-to-number (match-string 6 string))
1264                              (string-to-number (match-string 7 string))
1265                              (string-to-number (match-string 8 string))
1266                              (string-to-number (match-string 9 string))
1267                              (string-to-number (match-string 10 string))
1268                              (string-to-number (match-string 11 string))
1269                              (string-to-number (match-string 12 string))
1270                              (string-to-number (match-string 13 string))
1271                              (epg-context-result-for context 'import-status)))
1272     (epg-context-set-result-for context 'import-status nil)))
1273
1274 (defun epg-passphrase-callback-function (context key-id _handback)
1275   (declare (obsolete epa-passphrase-callback-function "23.1"))
1276   (if (eq key-id 'SYM)
1277       (read-passwd "Passphrase for symmetric encryption: "
1278                    (eq (epg-context-operation context) 'encrypt))
1279     (read-passwd
1280      (if (eq key-id 'PIN)
1281         "Passphrase for PIN: "
1282        (let ((entry (assoc key-id epg-user-id-alist)))
1283          (if entry
1284              (format "Passphrase for %s %s: " key-id (cdr entry))
1285            (format "Passphrase for %s: " key-id)))))))
1286
1287 (defun epg--list-keys-1 (context name mode)
1288   (let ((args (append (if (epg-context-home-directory context)
1289                           (list "--homedir"
1290                                 (epg-context-home-directory context)))
1291                       '("--with-colons" "--no-greeting" "--batch"
1292                         "--with-fingerprint" "--with-fingerprint")
1293                       (unless (eq (epg-context-protocol context) 'CMS)
1294                         '("--fixed-list-mode"))))
1295         (list-keys-option (if (memq mode '(t secret))
1296                               "--list-secret-keys"
1297                             (if (memq mode '(nil public))
1298                                 "--list-keys"
1299                               "--list-sigs")))
1300         (coding-system-for-read 'binary)
1301         keys string field index)
1302     (if name
1303         (progn
1304           (unless (listp name)
1305             (setq name (list name)))
1306           (while name
1307             (setq args (append args (list list-keys-option (car name)))
1308                   name (cdr name))))
1309       (setq args (append args (list list-keys-option))))
1310     (with-temp-buffer
1311       (apply #'call-process
1312              (epg-context-program context)
1313              nil (list t nil) nil args)
1314       (goto-char (point-min))
1315       (while (re-search-forward "^[a-z][a-z][a-z]:.*" nil t)
1316         (setq keys (cons (make-vector 15 nil) keys)
1317               string (match-string 0)
1318               index 0
1319               field 0)
1320         (while (and (< field (length (car keys)))
1321                     (eq index
1322                         (string-match "\\([^:]+\\)?:" string index)))
1323           (setq index (match-end 0))
1324           (aset (car keys) field (match-string 1 string))
1325           (setq field (1+ field))))
1326       (nreverse keys))))
1327
1328 (defun epg--make-sub-key-1 (line)
1329   (epg-make-sub-key
1330    (if (aref line 1)
1331        (cdr (assq (string-to-char (aref line 1)) epg-key-validity-alist)))
1332    (delq nil
1333          (mapcar (lambda (char) (cdr (assq char epg-key-capability-alist)))
1334                  (aref line 11)))
1335    (member (aref line 0) '("sec" "ssb"))
1336    (string-to-number (aref line 3))
1337    (string-to-number (aref line 2))
1338    (aref line 4)
1339    (epg--time-from-seconds (aref line 5))
1340    (if (aref line 6)
1341        (epg--time-from-seconds (aref line 6)))))
1342
1343 (defun epg-list-keys (context &optional name mode)
1344   "Return a list of epg-key objects matched with NAME.
1345 If MODE is nil or `public', only public keyring should be searched.
1346 If MODE is t or `secret', only secret keyring should be searched.
1347 Otherwise, only public keyring should be searched and the key
1348 signatures should be included.
1349 NAME is either a string or a list of strings."
1350   (let ((lines (epg--list-keys-1 context name mode))
1351         keys cert pointer pointer-1 index string)
1352     (while lines
1353       (cond
1354        ((member (aref (car lines) 0) '("pub" "sec" "crt" "crs"))
1355         (setq cert (member (aref (car lines) 0) '("crt" "crs"))
1356               keys (cons (epg-make-key
1357                           (if (aref (car lines) 8)
1358                               (cdr (assq (string-to-char (aref (car lines) 8))
1359                                          epg-key-validity-alist))))
1360                          keys))
1361         (push (epg--make-sub-key-1 (car lines))
1362               (epg-key-sub-key-list (car keys))))
1363        ((member (aref (car lines) 0) '("sub" "ssb"))
1364         (push (epg--make-sub-key-1 (car lines))
1365               (epg-key-sub-key-list (car keys))))
1366        ((equal (aref (car lines) 0) "uid")
1367         ;; Decode the UID name as a backslash escaped UTF-8 string,
1368         ;; generated by GnuPG/GpgSM.
1369         (setq string (copy-sequence (aref (car lines) 9))
1370               index 0)
1371         (while (string-match "\"" string index)
1372           (setq string (replace-match "\\\"" t t string)
1373                 index (1+ (match-end 0))))
1374         (condition-case nil
1375             (setq string (epg--decode-coding-string
1376                           (car (read-from-string (concat "\"" string "\"")))
1377                           'utf-8))
1378           (error
1379            (setq string (aref (car lines) 9))))
1380         (push (epg-make-user-id
1381                (if (aref (car lines) 1)
1382                    (cdr (assq (string-to-char (aref (car lines) 1))
1383                               epg-key-validity-alist)))
1384                (if cert
1385                    (condition-case nil
1386                        (epg-dn-from-string string)
1387                      (error string))
1388                  string))
1389               (epg-key-user-id-list (car keys))))
1390        ((equal (aref (car lines) 0) "fpr")
1391         (setf (epg-sub-key-fingerprint (car (epg-key-sub-key-list (car keys))))
1392               (aref (car lines) 9)))
1393        ((equal (aref (car lines) 0) "sig")
1394         (push
1395          (epg-make-key-signature
1396           (if (aref (car lines) 1)
1397               (cdr (assq (string-to-char (aref (car lines) 1))
1398                          epg-key-validity-alist)))
1399           (string-to-number (aref (car lines) 3))
1400           (aref (car lines) 4)
1401           (epg--time-from-seconds (aref (car lines) 5))
1402           (epg--time-from-seconds (aref (car lines) 6))
1403           (aref (car lines) 9)
1404           (string-to-number (aref (car lines) 10) 16)
1405           (eq (aref (aref (car lines) 10) 2) ?x))
1406          (epg-user-id-signature-list
1407           (car (epg-key-user-id-list (car keys)))))))
1408       (setq lines (cdr lines)))
1409     (setq keys (nreverse keys)
1410           pointer keys)
1411     (while pointer
1412       (epg--gv-nreverse (epg-key-sub-key-list (car pointer)))
1413       (setq pointer-1 (epg--gv-nreverse (epg-key-user-id-list (car pointer))))
1414       (while pointer-1
1415         (epg--gv-nreverse (epg-user-id-signature-list (car pointer-1)))
1416         (setq pointer-1 (cdr pointer-1)))
1417       (setq pointer (cdr pointer)))
1418     keys))
1419
1420 (eval-and-compile
1421   (if (fboundp 'make-temp-file)
1422       (defalias 'epg--make-temp-file 'make-temp-file)
1423     (defvar temporary-file-directory)
1424     ;; stolen from poe.el.
1425     (defun epg--make-temp-file (prefix)
1426       "Create a temporary file.
1427 The returned file name (created by appending some random characters at the end
1428 of PREFIX, and expanding against `temporary-file-directory' if necessary),
1429 is guaranteed to point to a newly created empty file.
1430 You can then use `write-region' to write new data into the file."
1431       (let ((orig-modes (default-file-modes))
1432             tempdir tempfile)
1433         (setq prefix (expand-file-name prefix
1434                                        (if (featurep 'xemacs)
1435                                            (temp-directory)
1436                                          temporary-file-directory)))
1437         (unwind-protect
1438             (let (file)
1439               ;; First, create a temporary directory.
1440               (set-default-file-modes #o700)
1441               (while (condition-case ()
1442                          (progn
1443                            (setq tempdir (make-temp-name
1444                                           (concat
1445                                            (file-name-directory prefix)
1446                                            "DIR")))
1447                            ;; return nil or signal an error.
1448                            (make-directory tempdir))
1449                        ;; let's try again.
1450                        (file-already-exists t)))
1451               ;; Second, create a temporary file in the tempdir.
1452               ;; There *is* a race condition between `make-temp-name'
1453               ;; and `write-region', but we don't care it since we are
1454               ;; in a private directory now.
1455               (setq tempfile (make-temp-name (concat tempdir "/EMU")))
1456               (write-region "" nil tempfile nil 'silent)
1457               ;; Finally, make a hard-link from the tempfile.
1458               (while (condition-case ()
1459                          (progn
1460                            (setq file (make-temp-name prefix))
1461                            ;; return nil or signal an error.
1462                            (add-name-to-file tempfile file))
1463                        ;; let's try again.
1464                        (file-already-exists t)))
1465               file)
1466           (set-default-file-modes orig-modes)
1467           ;; Cleanup the tempfile.
1468           (and tempfile
1469                (file-exists-p tempfile)
1470                (delete-file tempfile))
1471           ;; Cleanup the tempdir.
1472           (and tempdir
1473                (file-directory-p tempdir)
1474                (delete-directory tempdir)))))))
1475
1476 (defun epg--args-from-sig-notations (notations)
1477   (apply #'nconc
1478          (mapcar
1479           (lambda (notation)
1480             (if (and (epg-sig-notation-name notation)
1481                      (not (epg-sig-notation-human-readable notation)))
1482                 (error "Unreadable"))
1483             (if (epg-sig-notation-name notation)
1484                 (list "--sig-notation"
1485                       (if (epg-sig-notation-critical notation)
1486                           (concat "!" (epg-sig-notation-name notation)
1487                                   "=" (epg-sig-notation-value notation))
1488                         (concat (epg-sig-notation-name notation)
1489                                 "=" (epg-sig-notation-value notation))))
1490               (list "--sig-policy-url"
1491                     (if (epg-sig-notation-critical notation)
1492                         (concat "!" (epg-sig-notation-value notation))
1493                       (epg-sig-notation-value notation)))))
1494           notations)))
1495
1496 (defun epg-cancel (context)
1497   (if (buffer-live-p (process-buffer (epg-context-process context)))
1498       (with-current-buffer (process-buffer (epg-context-process context))
1499         (epg-context-set-result-for
1500          epg-context 'error
1501          (cons '(quit)
1502                (epg-context-result-for epg-context 'error)))))
1503   (if (eq (process-status (epg-context-process context)) 'run)
1504       (delete-process (epg-context-process context))))
1505
1506 (defun epg-start-decrypt (context cipher)
1507   "Initiate a decrypt operation on CIPHER.
1508 CIPHER must be a file data object.
1509
1510 If you use this function, you will need to wait for the completion of
1511 `epg-gpg-program' by using `epg-wait-for-completion' and call
1512 `epg-reset' to clear a temporary output file.
1513 If you are unsure, use synchronous version of this function
1514 `epg-decrypt-file' or `epg-decrypt-string' instead."
1515   (unless (epg-data-file cipher)
1516     (error "Not a file"))
1517   (setf (epg-context-operation context) 'decrypt)
1518   (setf (epg-context-result context) nil)
1519   (epg--start context (list "--decrypt" "--" (epg-data-file cipher)))
1520   ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
1521   (unless (eq (epg-context-protocol context) 'CMS)
1522     (epg-wait-for-status context '("BEGIN_DECRYPTION"))))
1523
1524 (defun epg--check-error-for-decrypt (context)
1525   (let ((errors (epg-context-result-for context 'error)))
1526     (if (epg-context-result-for context 'decryption-failed)
1527         (signal 'epg-error
1528                 (list "Decryption failed" (epg-errors-to-string errors))))
1529     (unless (epg-context-result-for context 'decryption-okay)
1530       (signal 'epg-error
1531               (list "Can't decrypt" (epg-errors-to-string errors))))))
1532
1533 (defun epg-decrypt-file (context cipher plain)
1534   "Decrypt a file CIPHER and store the result to a file PLAIN.
1535 If PLAIN is nil, it returns the result as a string."
1536   (unwind-protect
1537       (progn
1538         (setf (epg-context-output-file context)
1539               (or plain (epg--make-temp-file "epg-output")))
1540         (epg-start-decrypt context (epg-make-data-from-file cipher))
1541         (epg-wait-for-completion context)
1542         (epg--check-error-for-decrypt context)
1543         (unless plain
1544           (epg-read-output context)))
1545     (unless plain
1546       (epg-delete-output-file context))
1547     (epg-reset context)))
1548
1549 (defun epg-decrypt-string (context cipher)
1550   "Decrypt a string CIPHER and return the plain text."
1551   (let ((input-file (epg--make-temp-file "epg-input"))
1552         (coding-system-for-write 'binary))
1553     (unwind-protect
1554         (progn
1555           (write-region cipher nil input-file nil 'quiet)
1556           (setf (epg-context-output-file context)
1557                 (epg--make-temp-file "epg-output"))
1558           (epg-start-decrypt context (epg-make-data-from-file input-file))
1559           (epg-wait-for-completion context)
1560           (epg--check-error-for-decrypt context)
1561           (epg-read-output context))
1562       (epg-delete-output-file context)
1563       (if (file-exists-p input-file)
1564           (delete-file input-file))
1565       (epg-reset context))))
1566
1567 (defun epg-start-verify (context signature &optional signed-text)
1568   "Initiate a verify operation on SIGNATURE.
1569 SIGNATURE and SIGNED-TEXT are a data object if they are specified.
1570
1571 For a detached signature, both SIGNATURE and SIGNED-TEXT should be set.
1572 For a normal or a cleartext signature, SIGNED-TEXT should be nil.
1573
1574 If you use this function, you will need to wait for the completion of
1575 `epg-gpg-program' by using `epg-wait-for-completion' and call
1576 `epg-reset' to clear a temporary output file.
1577 If you are unsure, use synchronous version of this function
1578 `epg-verify-file' or `epg-verify-string' instead."
1579   (setf (epg-context-operation context) 'verify)
1580   (setf (epg-context-result context) nil)
1581   (if signed-text
1582       ;; Detached signature.
1583       (if (epg-data-file signed-text)
1584           (epg--start context (list "--verify" "--" (epg-data-file signature)
1585                                    (epg-data-file signed-text)))
1586         (epg--start context (list "--verify" "--" (epg-data-file signature)
1587                                   "-"))
1588         (if (eq (process-status (epg-context-process context)) 'run)
1589             (process-send-string (epg-context-process context)
1590                                  (epg-data-string signed-text)))
1591         (if (eq (process-status (epg-context-process context)) 'run)
1592             (process-send-eof (epg-context-process context))))
1593     ;; Normal (or cleartext) signature.
1594     (if (epg-data-file signature)
1595         (epg--start context (if (eq (epg-context-protocol context) 'CMS)
1596                                 (list "--verify" "--" (epg-data-file signature))
1597                               (list "--" (epg-data-file signature))))
1598       (epg--start context (if (eq (epg-context-protocol context) 'CMS)
1599                               '("--verify" "-")
1600                             '("-")))
1601       (if (eq (process-status (epg-context-process context)) 'run)
1602           (process-send-string (epg-context-process context)
1603                                (epg-data-string signature)))
1604       (if (eq (process-status (epg-context-process context)) 'run)
1605           (process-send-eof (epg-context-process context))))))
1606
1607 (defun epg-verify-file (context signature &optional signed-text plain)
1608   "Verify a file SIGNATURE.
1609 SIGNED-TEXT and PLAIN are also a file if they are specified.
1610
1611 For a detached signature, both SIGNATURE and SIGNED-TEXT should be
1612 string.  For a normal or a cleartext signature, SIGNED-TEXT should be
1613 nil.  In the latter case, if PLAIN is specified, the plaintext is
1614 stored into the file after successful verification.
1615
1616 Note that this function does not return verification result as t
1617 or nil, nor signal error on failure.  That's a design decision to
1618 handle the case where SIGNATURE has multiple signature.
1619
1620 To check the verification results, use `epg-context-result-for' as follows:
1621
1622 \(epg-context-result-for context \\='verify)
1623
1624 which will return a list of `epg-signature' object."
1625   (unwind-protect
1626       (progn
1627         (setf (epg-context-output-file context)
1628               (or plain (epg--make-temp-file "epg-output")))
1629         (if signed-text
1630             (epg-start-verify context
1631                               (epg-make-data-from-file signature)
1632                               (epg-make-data-from-file signed-text))
1633           (epg-start-verify context
1634                             (epg-make-data-from-file signature)))
1635         (epg-wait-for-completion context)
1636         (unless plain
1637           (epg-read-output context)))
1638     (unless plain
1639       (epg-delete-output-file context))
1640     (epg-reset context)))
1641
1642 (defun epg-verify-string (context signature &optional signed-text)
1643   "Verify a string SIGNATURE.
1644 SIGNED-TEXT is a string if it is specified.
1645
1646 For a detached signature, both SIGNATURE and SIGNED-TEXT should be
1647 string.  For a normal or a cleartext signature, SIGNED-TEXT should be
1648 nil.  In the latter case, this function returns the plaintext after
1649 successful verification.
1650
1651 Note that this function does not return verification result as t
1652 or nil, nor signal error on failure.  That's a design decision to
1653 handle the case where SIGNATURE has multiple signature.
1654
1655 To check the verification results, use `epg-context-result-for' as follows:
1656
1657 \(epg-context-result-for context \\='verify)
1658
1659 which will return a list of `epg-signature' object."
1660   (let ((coding-system-for-write 'binary)
1661         input-file)
1662     (unwind-protect
1663         (progn
1664           (setf (epg-context-output-file context)
1665                 (epg--make-temp-file "epg-output"))
1666           (if signed-text
1667               (progn
1668                 (setq input-file (epg--make-temp-file "epg-signature"))
1669                 (write-region signature nil input-file nil 'quiet)
1670                 (epg-start-verify context
1671                                   (epg-make-data-from-file input-file)
1672                                   (epg-make-data-from-string signed-text)))
1673             (epg-start-verify context (epg-make-data-from-string signature)))
1674           (epg-wait-for-completion context)
1675           (epg-read-output context))
1676       (epg-delete-output-file context)
1677       (if (and input-file
1678                (file-exists-p input-file))
1679           (delete-file input-file))
1680       (epg-reset context))))
1681
1682 (defun epg-start-sign (context plain &optional mode)
1683   "Initiate a sign operation on PLAIN.
1684 PLAIN is a data object.
1685
1686 If optional 3rd argument MODE is t or `detached', it makes a detached signature.
1687 If it is nil or `normal', it makes a normal signature.
1688 Otherwise, it makes a cleartext signature.
1689
1690 If you use this function, you will need to wait for the completion of
1691 `epg-gpg-program' by using `epg-wait-for-completion' and call
1692 `epg-reset' to clear a temporary output file.
1693 If you are unsure, use synchronous version of this function
1694 `epg-sign-file' or `epg-sign-string' instead."
1695   (setf (epg-context-operation context) 'sign)
1696   (setf (epg-context-result context) nil)
1697   (unless (memq mode '(t detached nil normal)) ;i.e. cleartext
1698     (epg-context-set-armor context nil)
1699     (epg-context-set-textmode context nil))
1700   (epg--start context
1701              (append (list (if (memq mode '(t detached))
1702                                "--detach-sign"
1703                              (if (memq mode '(nil normal))
1704                                  "--sign"
1705                                "--clearsign")))
1706                      (apply #'nconc
1707                             (mapcar
1708                              (lambda (signer)
1709                                (list "-u"
1710                                      (epg-sub-key-id
1711                                       (car (epg-key-sub-key-list signer)))))
1712                              (epg-context-signers context)))
1713                      (epg--args-from-sig-notations
1714                       (epg-context-sig-notations context))
1715                      (if (epg-data-file plain)
1716                          (list "--" (epg-data-file plain)))))
1717   ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
1718   (unless (eq (epg-context-protocol context) 'CMS)
1719     (epg-wait-for-status context '("BEGIN_SIGNING")))
1720   (when (epg-data-string plain)
1721     (if (eq (process-status (epg-context-process context)) 'run)
1722         (process-send-string (epg-context-process context)
1723                              (epg-data-string plain)))
1724     (if (eq (process-status (epg-context-process context)) 'run)
1725         (process-send-eof (epg-context-process context)))))
1726
1727 (defun epg-sign-file (context plain signature &optional mode)
1728   "Sign a file PLAIN and store the result to a file SIGNATURE.
1729 If SIGNATURE is nil, it returns the result as a string.
1730 If optional 3rd argument MODE is t or `detached', it makes a detached signature.
1731 If it is nil or `normal', it makes a normal signature.
1732 Otherwise, it makes a cleartext signature."
1733   (unwind-protect
1734       (progn
1735         (setf (epg-context-output-file context)
1736               (or signature (epg--make-temp-file "epg-output")))
1737         (epg-start-sign context (epg-make-data-from-file plain) mode)
1738         (epg-wait-for-completion context)
1739         (unless (epg-context-result-for context 'sign)
1740           (let ((errors (epg-context-result-for context 'error)))
1741             (signal 'epg-error
1742                     (list "Sign failed" (epg-errors-to-string errors)))))
1743         (unless signature
1744           (epg-read-output context)))
1745     (unless signature
1746       (epg-delete-output-file context))
1747     (epg-reset context)))
1748
1749 (defun epg-sign-string (context plain &optional mode)
1750   "Sign a string PLAIN and return the output as string.
1751 If optional 3rd argument MODE is t or `detached', it makes a detached signature.
1752 If it is nil or `normal', it makes a normal signature.
1753 Otherwise, it makes a cleartext signature."
1754   (let ((input-file
1755          (unless (eq (epg-context-protocol context) 'CMS)
1756            (epg--make-temp-file "epg-input")))
1757         (coding-system-for-write 'binary))
1758     (unwind-protect
1759         (progn
1760           (setf (epg-context-output-file context)
1761                 (epg--make-temp-file "epg-output"))
1762           (if input-file
1763               (write-region plain nil input-file nil 'quiet))
1764           (epg-start-sign context
1765                           (if input-file
1766                               (epg-make-data-from-file input-file)
1767                             (epg-make-data-from-string plain))
1768                           mode)
1769           (epg-wait-for-completion context)
1770           (unless (epg-context-result-for context 'sign)
1771             (if (epg-context-result-for context 'error)
1772                 (let ((errors (epg-context-result-for context 'error)))
1773                   (signal 'epg-error
1774                           (list "Sign failed" (epg-errors-to-string errors))))))
1775           (epg-read-output context))
1776       (epg-delete-output-file context)
1777       (if input-file
1778           (delete-file input-file))
1779       (epg-reset context))))
1780
1781 (defun epg-start-encrypt (context plain recipients
1782                                   &optional sign always-trust)
1783   "Initiate an encrypt operation on PLAIN.
1784 PLAIN is a data object.
1785 If RECIPIENTS is nil, it performs symmetric encryption.
1786
1787 If you use this function, you will need to wait for the completion of
1788 `epg-gpg-program' by using `epg-wait-for-completion' and call
1789 `epg-reset' to clear a temporary output file.
1790 If you are unsure, use synchronous version of this function
1791 `epg-encrypt-file' or `epg-encrypt-string' instead."
1792   (setf (epg-context-operation context) 'encrypt)
1793   (setf (epg-context-result context) nil)
1794   (epg--start context
1795              (append (if always-trust '("--always-trust"))
1796                      (if recipients '("--encrypt") '("--symmetric"))
1797                      (if sign '("--sign"))
1798                      (if sign
1799                          (apply #'nconc
1800                                 (mapcar
1801                                  (lambda (signer)
1802                                    (list "-u"
1803                                          (epg-sub-key-id
1804                                           (car (epg-key-sub-key-list
1805                                                 signer)))))
1806                                  (epg-context-signers context))))
1807                      (if sign
1808                          (epg--args-from-sig-notations
1809                           (epg-context-sig-notations context)))
1810                      (apply #'nconc
1811                             (mapcar
1812                              (lambda (recipient)
1813                                (list "-r"
1814                                      (epg-sub-key-id
1815                                       (car (epg-key-sub-key-list recipient)))))
1816                              recipients))
1817                      (if (epg-data-file plain)
1818                          (list "--" (epg-data-file plain)))))
1819   ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
1820   (unless (eq (epg-context-protocol context) 'CMS)
1821     (epg-wait-for-status context
1822                          (if sign '("BEGIN_SIGNING") '("BEGIN_ENCRYPTION"))))
1823   (when (epg-data-string plain)
1824     (if (eq (process-status (epg-context-process context)) 'run)
1825         (process-send-string (epg-context-process context)
1826                              (epg-data-string plain)))
1827     (if (eq (process-status (epg-context-process context)) 'run)
1828         (process-send-eof (epg-context-process context)))))
1829
1830 (defun epg-encrypt-file (context plain recipients
1831                                  cipher &optional sign always-trust)
1832   "Encrypt a file PLAIN and store the result to a file CIPHER.
1833 If CIPHER is nil, it returns the result as a string.
1834 If RECIPIENTS is nil, it performs symmetric encryption."
1835   (unwind-protect
1836       (progn
1837         (setf (epg-context-output-file context)
1838               (or cipher (epg--make-temp-file "epg-output")))
1839         (epg-start-encrypt context (epg-make-data-from-file plain)
1840                            recipients sign always-trust)
1841         (epg-wait-for-completion context)
1842         (let ((errors (epg-context-result-for context 'error)))
1843           (if (and sign
1844                    (not (epg-context-result-for context 'sign)))
1845               (signal 'epg-error
1846                       (list "Sign failed" (epg-errors-to-string errors))))
1847           (if errors
1848               (signal 'epg-error
1849                       (list "Encrypt failed" (epg-errors-to-string errors)))))
1850         (unless cipher
1851           (epg-read-output context)))
1852     (unless cipher
1853       (epg-delete-output-file context))
1854     (epg-reset context)))
1855
1856 (defun epg-encrypt-string (context plain recipients
1857                                    &optional sign always-trust)
1858   "Encrypt a string PLAIN.
1859 If RECIPIENTS is nil, it performs symmetric encryption."
1860   (let ((input-file
1861          (unless (or (not sign)
1862                      (eq (epg-context-protocol context) 'CMS))
1863            (epg--make-temp-file "epg-input")))
1864         (coding-system-for-write 'binary))
1865     (unwind-protect
1866         (progn
1867           (setf (epg-context-output-file context)
1868                 (epg--make-temp-file "epg-output"))
1869           (if input-file
1870               (write-region plain nil input-file nil 'quiet))
1871           (epg-start-encrypt context
1872                              (if input-file
1873                                  (epg-make-data-from-file input-file)
1874                                (epg-make-data-from-string plain))
1875                              recipients sign always-trust)
1876           (epg-wait-for-completion context)
1877           (let ((errors (epg-context-result-for context 'error)))
1878             (if (and sign
1879                      (not (epg-context-result-for context 'sign)))
1880                 (signal 'epg-error
1881                         (list "Sign failed" (epg-errors-to-string errors))))
1882             (if errors
1883                 (signal 'epg-error
1884                         (list "Encrypt failed" (epg-errors-to-string errors)))))
1885           (epg-read-output context))
1886       (epg-delete-output-file context)
1887       (if input-file
1888           (delete-file input-file))
1889       (epg-reset context))))
1890
1891 (defun epg-start-export-keys (context keys)
1892   "Initiate an export keys operation.
1893
1894 If you use this function, you will need to wait for the completion of
1895 `epg-gpg-program' by using `epg-wait-for-completion' and call
1896 `epg-reset' to clear a temporary output file.
1897 If you are unsure, use synchronous version of this function
1898 `epg-export-keys-to-file' or `epg-export-keys-to-string' instead."
1899   (setf (epg-context-operation context) 'export-keys)
1900   (setf (epg-context-result context) nil)
1901   (epg--start context (cons "--export"
1902                            (mapcar
1903                             (lambda (key)
1904                               (epg-sub-key-id
1905                                (car (epg-key-sub-key-list key))))
1906                             keys))))
1907
1908 (defun epg-export-keys-to-file (context keys file)
1909   "Extract public KEYS."
1910   (unwind-protect
1911       (progn
1912         (setf (epg-context-output-file context)
1913               (or file (epg--make-temp-file "epg-output")))
1914         (epg-start-export-keys context keys)
1915         (epg-wait-for-completion context)
1916         (let ((errors (epg-context-result-for context 'error)))
1917           (if errors
1918               (signal 'epg-error
1919                       (list "Export keys failed"
1920                             (epg-errors-to-string errors)))))
1921         (unless file
1922           (epg-read-output context)))
1923     (unless file
1924       (epg-delete-output-file context))
1925     (epg-reset context)))
1926
1927 (defun epg-export-keys-to-string (context keys)
1928   "Extract public KEYS and return them as a string."
1929   (epg-export-keys-to-file context keys nil))
1930
1931 (defun epg-start-import-keys (context keys)
1932   "Initiate an import keys operation.
1933 KEYS is a data object.
1934
1935 If you use this function, you will need to wait for the completion of
1936 `epg-gpg-program' by using `epg-wait-for-completion' and call
1937 `epg-reset' to clear a temporary output file.
1938 If you are unsure, use synchronous version of this function
1939 `epg-import-keys-from-file' or `epg-import-keys-from-string' instead."
1940   (setf (epg-context-operation context) 'import-keys)
1941   (setf (epg-context-result context) nil)
1942   (epg--start context (if (epg-data-file keys)
1943                           (list "--import" "--" (epg-data-file keys))
1944                         (list "--import")))
1945   (when (epg-data-string keys)
1946     (if (eq (process-status (epg-context-process context)) 'run)
1947         (process-send-string (epg-context-process context)
1948                              (epg-data-string keys)))
1949     (if (eq (process-status (epg-context-process context)) 'run)
1950         (process-send-eof (epg-context-process context)))))
1951
1952 (defun epg--import-keys-1 (context keys)
1953   (unwind-protect
1954       (progn
1955         (epg-start-import-keys context keys)
1956         (epg-wait-for-completion context)
1957         (let ((errors (epg-context-result-for context 'error)))
1958           (if errors
1959               (signal 'epg-error
1960                       (list "Import keys failed"
1961                             (epg-errors-to-string errors))))))
1962     (epg-reset context)))
1963
1964 (defun epg-import-keys-from-file (context keys)
1965   "Add keys from a file KEYS."
1966   (epg--import-keys-1 context (epg-make-data-from-file keys)))
1967
1968 (defun epg-import-keys-from-string (context keys)
1969   "Add keys from a string KEYS."
1970   (epg--import-keys-1 context (epg-make-data-from-string keys)))
1971
1972 (defun epg-start-receive-keys (context key-id-list)
1973   "Initiate a receive key operation.
1974 KEY-ID-LIST is a list of key IDs.
1975
1976 If you use this function, you will need to wait for the completion of
1977 `epg-gpg-program' by using `epg-wait-for-completion' and call
1978 `epg-reset' to clear a temporary output file.
1979 If you are unsure, use synchronous version of this function
1980 `epg-receive-keys' instead."
1981   (setf (epg-context-operation context) 'receive-keys)
1982   (setf (epg-context-result context) nil)
1983   (epg--start context (cons "--recv-keys" key-id-list)))
1984
1985 (defun epg-receive-keys (context keys)
1986   "Add keys from server.
1987 KEYS is a list of key IDs"
1988   (unwind-protect
1989       (progn
1990         (epg-start-receive-keys context keys)
1991         (epg-wait-for-completion context)
1992         (let ((errors (epg-context-result-for context 'error)))
1993           (if errors
1994               (signal 'epg-error
1995                       (list "Receive keys failed"
1996                             (epg-errors-to-string errors))))))
1997     (epg-reset context)))
1998
1999 (defalias 'epg-import-keys-from-server 'epg-receive-keys)
2000
2001 (defun epg-start-delete-keys (context keys &optional allow-secret)
2002   "Initiate a delete keys operation.
2003
2004 If you use this function, you will need to wait for the completion of
2005 `epg-gpg-program' by using `epg-wait-for-completion' and call
2006 `epg-reset' to clear a temporary output file.
2007 If you are unsure, use synchronous version of this function
2008 `epg-delete-keys' instead."
2009   (setf (epg-context-operation context) 'delete-keys)
2010   (setf (epg-context-result context) nil)
2011   (epg--start context (cons (if allow-secret
2012                                "--delete-secret-key"
2013                              "--delete-key")
2014                             (mapcar
2015                              (lambda (key)
2016                                (epg-sub-key-id
2017                                 (car (epg-key-sub-key-list key))))
2018                              keys))))
2019
2020 (defun epg-delete-keys (context keys &optional allow-secret)
2021   "Delete KEYS from the key ring."
2022   (unwind-protect
2023       (progn
2024         (epg-start-delete-keys context keys allow-secret)
2025         (epg-wait-for-completion context)
2026         (let ((errors (epg-context-result-for context 'error)))
2027           (if errors
2028               (signal 'epg-error
2029                       (list "Delete keys failed"
2030                             (epg-errors-to-string errors))))))
2031     (epg-reset context)))
2032
2033 (defun epg-start-sign-keys (context keys &optional local)
2034   "Initiate a sign keys operation.
2035
2036 If you use this function, you will need to wait for the completion of
2037 `epg-gpg-program' by using `epg-wait-for-completion' and call
2038 `epg-reset' to clear a temporary output file.
2039 If you are unsure, use synchronous version of this function
2040 `epg-sign-keys' instead."
2041   (declare (obsolete nil "23.1"))
2042   (setf (epg-context-operation context) 'sign-keys)
2043   (setf (epg-context-result context) nil)
2044   (epg--start context (cons (if local
2045                                "--lsign-key"
2046                              "--sign-key")
2047                            (mapcar
2048                             (lambda (key)
2049                               (epg-sub-key-id
2050                                (car (epg-key-sub-key-list key))))
2051                             keys))))
2052
2053 (defun epg-sign-keys (context keys &optional local)
2054   "Sign KEYS from the key ring."
2055   (declare (obsolete nil "23.1"))
2056   (unwind-protect
2057       (progn
2058         (epg-start-sign-keys context keys local)
2059         (epg-wait-for-completion context)
2060         (let ((errors (epg-context-result-for context 'error)))
2061           (if errors
2062               (signal 'epg-error
2063                       (list "Sign keys failed"
2064                             (epg-errors-to-string errors))))))
2065     (epg-reset context)))
2066
2067 (defun epg-start-generate-key (context parameters)
2068   "Initiate a key generation.
2069 PARAMETERS is a string which specifies parameters of the generated key.
2070 See Info node `(gnupg) Unattended GPG key generation' in the
2071 GnuPG manual for the format.
2072
2073 If you use this function, you will need to wait for the completion of
2074 `epg-gpg-program' by using `epg-wait-for-completion' and call
2075 `epg-reset' to clear a temporary output file.
2076 If you are unsure, use synchronous version of this function
2077 `epg-generate-key-from-file' or `epg-generate-key-from-string' instead."
2078   (setf (epg-context-operation context) 'generate-key)
2079   (setf (epg-context-result context) nil)
2080   (if (epg-data-file parameters)
2081       (epg--start context (list "--batch" "--gen-key" "--"
2082                                (epg-data-file parameters)))
2083     (epg--start context '("--batch" "--gen-key"))
2084     (if (eq (process-status (epg-context-process context)) 'run)
2085         (process-send-string (epg-context-process context)
2086                              (epg-data-string parameters)))
2087     (if (eq (process-status (epg-context-process context)) 'run)
2088         (process-send-eof (epg-context-process context)))))
2089
2090 (defun epg-generate-key-from-file (context parameters)
2091   "Generate a new key pair.
2092 PARAMETERS is a file which tells how to create the key."
2093   (unwind-protect
2094       (progn
2095         (epg-start-generate-key context (epg-make-data-from-file parameters))
2096         (epg-wait-for-completion context)
2097         (let ((errors (epg-context-result-for context 'error)))
2098           (if errors
2099               (signal 'epg-error
2100                       (list "Generate key failed"
2101                             (epg-errors-to-string errors))))))
2102     (epg-reset context)))
2103
2104 (defun epg-generate-key-from-string (context parameters)
2105   "Generate a new key pair.
2106 PARAMETERS is a string which tells how to create the key."
2107   (unwind-protect
2108       (progn
2109         (epg-start-generate-key context (epg-make-data-from-string parameters))
2110         (epg-wait-for-completion context)
2111         (let ((errors (epg-context-result-for context 'error)))
2112           (if errors
2113               (signal 'epg-error
2114                       (list "Generate key failed"
2115                             (epg-errors-to-string errors))))))
2116     (epg-reset context)))
2117
2118 (defun epg-start-edit-key (context key edit-callback handback)
2119   "Initiate an edit operation on KEY.
2120
2121 EDIT-CALLBACK is called from process filter and takes 3
2122 arguments: the context, a status, an argument string, and the
2123 handback argument.
2124
2125 If you use this function, you will need to wait for the completion of
2126 `epg-gpg-program' by using `epg-wait-for-completion' and call
2127 `epg-reset' to clear a temporary output file.
2128 If you are unsure, use synchronous version of this function
2129 `epg-edit-key' instead."
2130   (setf (epg-context-operation context) 'edit-key)
2131   (setf (epg-context-result context) nil)
2132   (setf (epg-context-edit-callback context) (cons edit-callback handback))
2133   (epg--start context (list "--edit-key"
2134                             (epg-sub-key-id
2135                              (car (epg-key-sub-key-list key))))))
2136
2137 (defun epg-edit-key (context key edit-callback handback)
2138   "Edit KEY in the keyring."
2139   (unwind-protect
2140       (progn
2141         (epg-start-edit-key context key edit-callback handback)
2142         (epg-wait-for-completion context)
2143         (let ((errors (epg-context-result-for context 'error)))
2144           (if errors
2145               (signal 'epg-error
2146                       (list "Edit key failed"
2147                             (epg-errors-to-string errors))))))
2148     (epg-reset context)))
2149
2150 (defun epg--decode-percent-escape (string)
2151   (let ((index 0))
2152     (while (string-match "%\\(\\(%\\)\\|\\([0-9A-Fa-f][0-9A-Fa-f]\\)\\)"
2153                          string index)
2154       (if (match-beginning 2)
2155           (setq string (replace-match "%" t t string)
2156                 index (1- (match-end 0)))
2157         (setq string (replace-match
2158                       (string (string-to-number (match-string 3 string) 16))
2159                       t t string)
2160               index (- (match-end 0) 2))))
2161     string))
2162
2163 (defun epg--decode-hexstring (string)
2164   (let ((index 0))
2165     (while (eq index (string-match "[0-9A-Fa-f][0-9A-Fa-f]" string index))
2166       (setq string (replace-match (string (string-to-number
2167                                            (match-string 0 string) 16))
2168                                   t t string)
2169             index (1- (match-end 0))))
2170     string))
2171
2172 (defun epg--decode-quotedstring (string)
2173   (let ((index 0))
2174     (while (string-match "\\\\\\(\\([,=+<>#;\\\"]\\)\\|\
2175 \\([0-9A-Fa-f][0-9A-Fa-f]\\)\\)"
2176                          string index)
2177       (if (match-beginning 2)
2178           (setq string (replace-match "\\2" t nil string)
2179                 index (1- (match-end 0)))
2180         (if (match-beginning 3)
2181             (setq string (replace-match (string (string-to-number
2182                                                  (match-string 0 string) 16))
2183                                         t t string)
2184                   index (- (match-end 0) 2)))))
2185     string))
2186
2187 (defun epg-dn-from-string (string)
2188   "Parse STRING as LADPv3 Distinguished Names (RFC2253).
2189 The return value is an alist mapping from types to values."
2190   (let ((index 0)
2191         (length (length string))
2192         alist type value group)
2193     (while (< index length)
2194       (if (eq index (string-match "[ \t\n\r]*" string index))
2195           (setq index (match-end 0)))
2196       (if (eq index (string-match
2197                      "\\([0-9]+\\(\\.[0-9]+\\)*\\)[ \t\n\r]*=[ \t\n\r]*"
2198                      string index))
2199           (setq type (match-string 1 string)
2200                 index (match-end 0))
2201         (if (eq index (string-match "\\([0-9A-Za-z]+\\)[ \t\n\r]*=[ \t\n\r]*"
2202                                     string index))
2203             (setq type (match-string 1 string)
2204                   index (match-end 0))))
2205       (unless type
2206         (error "Invalid type"))
2207       (if (eq index (string-match
2208                      "\\([^,=+<>#;\\\"]\\|\\\\.\\)+"
2209                      string index))
2210           (setq index (match-end 0)
2211                 value (epg--decode-quotedstring (match-string 0 string)))
2212         (if (eq index (string-match "#\\([0-9A-Fa-f]+\\)" string index))
2213             (setq index (match-end 0)
2214                   value (epg--decode-hexstring (match-string 1 string)))
2215           (if (eq index (string-match "\"\\([^\\\"]\\|\\\\.\\)*\""
2216                                       string index))
2217               (setq index (match-end 0)
2218                     value (epg--decode-quotedstring
2219                            (match-string 0 string))))))
2220       (if group
2221           (if (stringp (car (car alist)))
2222               (setcar alist (list (cons type value) (car alist)))
2223             (setcar alist (cons (cons type value) (car alist))))
2224         (if (consp (car (car alist)))
2225             (setcar alist (nreverse (car alist))))
2226         (setq alist (cons (cons type value) alist)
2227               type nil
2228               value nil))
2229       (if (eq index (string-match "[ \t\n\r]*\\([,;+]\\)" string index))
2230           (setq index (match-end 0)
2231                 group (eq (aref string (match-beginning 1)) ?+))))
2232     (nreverse alist)))
2233
2234 (defun epg-decode-dn (alist)
2235   "Convert ALIST returned by `epg-dn-from-string' to a human readable form.
2236 Type names are resolved using `epg-dn-type-alist'."
2237   (mapconcat
2238    (lambda (rdn)
2239      (if (stringp (car rdn))
2240          (let ((entry (assoc (car rdn) epg-dn-type-alist)))
2241            (if entry
2242                (format "%s=%s" (cdr entry) (cdr rdn))
2243              (format "%s=%s" (car rdn) (cdr rdn))))
2244        (concat "(" (epg-decode-dn rdn) ")")))
2245    alist
2246    ", "))
2247
2248 (provide 'epg)
2249
2250 ;;; epg.el ends here