Updated.
[gnupg.git] / g10 / keyedit.c
index 55fc685..56e30e5 100644 (file)
@@ -1,6 +1,6 @@
 /* keyedit.c - keyedit stuff
- * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004,
- *               2005 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
+ *               2006 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -57,8 +57,7 @@ static int menu_adduid( KBNODE keyblock, KBNODE sec_keyblock,
                        int photo, const char *photo_name );
 static void menu_deluid( KBNODE pub_keyblock, KBNODE sec_keyblock );
 static int menu_delsig( KBNODE pub_keyblock );
-static int menu_clean_sigs_from_uids(KBNODE keyblock);
-static int menu_clean_uids_from_key(KBNODE keyblock);
+static int menu_clean(KBNODE keyblock,int self_only);
 static void menu_delkey( KBNODE pub_keyblock, KBNODE sec_keyblock );
 static int menu_addrevoker( KBNODE pub_keyblock,
                            KBNODE sec_keyblock, int sensitive );
@@ -68,6 +67,8 @@ static int menu_set_primary_uid( KBNODE pub_keyblock, KBNODE sec_keyblock );
 static int menu_set_preferences( KBNODE pub_keyblock, KBNODE sec_keyblock );
 static int menu_set_keyserver_url (const char *url,
                                   KBNODE pub_keyblock, KBNODE sec_keyblock );
+static int menu_set_notation(const char *string,
+                            KBNODE pub_keyblock,KBNODE sec_keyblock);
 static int menu_select_uid( KBNODE keyblock, int idx );
 static int menu_select_uid_namehash( KBNODE keyblock, const char *namehash );
 static int menu_select_key( KBNODE keyblock, int idx );
@@ -547,7 +548,7 @@ sign_uids( KBNODE keyblock, STRLIST locusr, int *ret_modified,
        byte trust_depth=0,trust_value=0;
 
        if(local || nonrevocable || trust ||
-          opt.cert_policy_url || opt.cert_notation_data)
+          opt.cert_policy_url || opt.cert_notations)
          force_v4=1;
 
        /* we have to use a copy of the sk, because make_keysig_packet
@@ -1340,8 +1341,9 @@ enum cmdids
     cmdSAVE, cmdADDUID, cmdADDPHOTO, cmdDELUID, cmdADDKEY, cmdDELKEY,
     cmdADDREVOKER, cmdTOGGLE, cmdSELKEY, cmdPASSWD, cmdTRUST, cmdPREF,
     cmdEXPIRE, cmdBACKSIGN, cmdENABLEKEY, cmdDISABLEKEY, cmdSHOWPREF,
-    cmdSETPREF, cmdPREFKS, cmdINVCMD, cmdSHOWPHOTO, cmdUPDTRUST, cmdCHKTRUST,
-    cmdADDCARDKEY, cmdKEYTOCARD, cmdBKUPTOCARD, cmdCLEAN, cmdNOP
+    cmdSETPREF, cmdPREFKS, cmdNOTATION, cmdINVCMD, cmdSHOWPHOTO, cmdUPDTRUST,
+    cmdCHKTRUST, cmdADDCARDKEY, cmdKEYTOCARD, cmdBKUPTOCARD, cmdCLEAN,
+    cmdMINIMIZE, cmdNOP
   };
 
 static struct
@@ -1364,6 +1366,7 @@ static struct
     { "key"     , cmdSELKEY    , 0, N_("select subkey N") },
     { "check"   , cmdCHECK     , 0, N_("check signatures") },
     { "c"       , cmdCHECK     , 0, NULL },
+    { "cross-certify", cmdBACKSIGN  , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK, NULL },
     { "backsign", cmdBACKSIGN  , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK, NULL },
     { "sign"    , cmdSIGN      , KEYEDIT_NOT_SK|KEYEDIT_TAIL_MATCH,
       N_("sign selected user IDs [* see below for related commands]") },
@@ -1422,7 +1425,9 @@ static struct
     { "updpref" , cmdSETPREF   , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK, NULL },
 
     { "keyserver",cmdPREFKS    , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK,
-      N_("set preferred keyserver URL for the selected user IDs")},
+      N_("set the preferred keyserver URL for the selected user IDs")},
+    { "notation", cmdNOTATION  , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK,
+      N_("set a notation for the selected user IDs")},
     { "passwd"  , cmdPASSWD    , KEYEDIT_NOT_SK|KEYEDIT_NEED_SK,
       N_("change the passphrase") },
     /* Alias */
@@ -1442,11 +1447,12 @@ static struct
     { "disable" , cmdDISABLEKEY, KEYEDIT_NOT_SK, N_("disable key") },
     { "showphoto",cmdSHOWPHOTO , 0, N_("show selected photo IDs") },
     { "clean",    cmdCLEAN     , KEYEDIT_NOT_SK,
-      N_("clean unusable parts from key") },
+      N_("compact unusable user IDs and remove unusable signatures from key")},
+    { "minimize", cmdMINIMIZE  , KEYEDIT_NOT_SK,
+      N_("compact unusable user IDs and remove all signatures from key") },
     { NULL, cmdNONE, 0, NULL }
   };
 
-
 #ifdef HAVE_LIBREADLINE
 
 /* These two functions are used by readline for command completion. */
@@ -2150,6 +2156,16 @@ keyedit_menu( const char *username, STRLIST locusr,
              }
            break;
 
+         case cmdNOTATION:
+           if( menu_set_notation ( *arg_string?arg_string:NULL,
+                                   keyblock, sec_keyblock ) )
+             {
+               merge_keys_and_selfsig( keyblock );
+               modified = 1;
+               redisplay = 1;
+             }
+           break;
+
          case cmdNOP:
            break;
 
@@ -2173,26 +2189,11 @@ keyedit_menu( const char *username, STRLIST locusr,
            break;
 
          case cmdCLEAN:
-           {
-             if(*arg_string)
-               {
-                 if(ascii_strcasecmp(arg_string,"sigs")==0
-                    || ascii_strcasecmp(arg_string,"signatures")==0
-                    || ascii_strcasecmp(arg_string,"certs")==0
-                    || ascii_strcasecmp(arg_string,"certificates")==0)
-                   modified=menu_clean_sigs_from_uids(keyblock);
-                 else if(ascii_strcasecmp(arg_string,"uids")==0)
-                   redisplay=modified=menu_clean_uids_from_key(keyblock);
-                 else
-                   tty_printf("Unable to clean `%s'\n",arg_string);
-               }
-             else
-               {
-                 modified=menu_clean_sigs_from_uids(keyblock);
-                 modified+=menu_clean_uids_from_key(keyblock);
-                 redisplay=modified;
-               }
-           }
+           redisplay=modified=menu_clean(keyblock,0);
+           break;
+
+         case cmdMINIMIZE:
+           redisplay=modified=menu_clean(keyblock,1);
            break;
 
          case cmdQUIT:
@@ -2252,8 +2253,36 @@ keyedit_menu( const char *username, STRLIST locusr,
     xfree(answer);
 }
 
+static void
+tty_print_notations(int indent,PKT_signature *sig)
+{
+  int first=1;
+  struct notation *notation,*nd;
+
+  if(indent<0)
+    {
+      first=0;
+      indent=-indent;
+    }
+
+  notation=sig_to_notation(sig);
+
+  for(nd=notation;nd;nd=nd->next)
+    {
+      if(!first)
+       tty_printf("%*s",indent,"");
+      else
+       first=0;
+
+      tty_print_utf8_string(nd->name,strlen(nd->name));
+      tty_printf("=");
+      tty_print_utf8_string(nd->value,strlen(nd->value));
+      tty_printf("\n");
+    }
+
+  free_notation(notation);
+}
 
-\f
 /****************
  * show preferences of a public keyblock.
  */
@@ -2350,17 +2379,17 @@ show_prefs (PKT_user_id *uid, PKT_signature *selfsig, int verbose)
            }
            tty_printf ("%s",compress_algo_to_string(COMPRESS_ALGO_NONE));
         }
-       if(uid->mdc_feature || !uid->ks_modify)
+       if(uid->flags.mdc || !uid->flags.ks_modify)
          {
            tty_printf ("\n     ");
            tty_printf (_("Features: "));
            any=0;
-           if(uid->mdc_feature)
+           if(uid->flags.mdc)
              {
                tty_printf ("MDC");
                any=1;
              }
-           if(!uid->ks_modify)
+           if(!uid->flags.ks_modify)
              {
                if(any)
                  tty_printf (", ");
@@ -2383,6 +2412,13 @@ show_prefs (PKT_user_id *uid, PKT_signature *selfsig, int verbose)
                tty_print_utf8_string(pref_ks,pref_ks_len);
                tty_printf("\n");
              }
+
+           if(selfsig->flags.notation)
+             {
+               tty_printf ("     ");
+               tty_printf(_("Notations: "));
+               tty_print_notations(5+strlen(_("Notations: ")),selfsig);
+             }
          }
     }
     else {
@@ -2393,9 +2429,9 @@ show_prefs (PKT_user_id *uid, PKT_signature *selfsig, int verbose)
                                  prefs[i].type == PREFTYPE_ZIP ? 'Z':'?',
                                  prefs[i].value);
         }
-        if (uid->mdc_feature)
+        if (uid->flags.mdc)
             tty_printf (" [mdc]");
-        if (!uid->ks_modify)
+        if (!uid->flags.ks_modify)
             tty_printf (" [no-ks-modify]");
         tty_printf("\n");
     }
@@ -2457,24 +2493,7 @@ show_key_with_all_names_colon (KBNODE keyblock)
           putchar('\n');
           
           print_fingerprint (pk, NULL, 0);
-
-          /* print the revoker record */
-          if( !pk->revkey && pk->numrevkeys )
-            BUG();
-          else
-            {
-              for (i=0; i < pk->numrevkeys; i++)
-                {
-                  byte *p;
-
-                  printf ("rvk:::%d::::::", pk->revkey[i].algid);
-                  p = pk->revkey[i].fpr;
-                  for (j=0; j < 20; j++, p++ )
-                    printf ("%02X", *p);
-                  printf (":%02x%s:\n", pk->revkey[i].class,
-                          (pk->revkey[i].class&0x40)?"s":"");
-                }
-            }
+         print_revokers(pk);
         }
     }
   
@@ -2534,9 +2553,9 @@ show_key_with_all_names_colon (KBNODE keyblock)
                             prefs[j].type == PREFTYPE_ZIP ? 'Z':'?',
                             prefs[j].value);
                   } 
-                if (uid->mdc_feature)
+                if (uid->flags.mdc)
                   printf (",mdc");
-                if (!uid->ks_modify)
+                if (!uid->flags.ks_modify)
                   printf (",no-ks-modify");
               } 
             putchar (':');
@@ -3184,59 +3203,27 @@ menu_delsig( KBNODE pub_keyblock )
 }
 
 static int
-menu_clean_sigs_from_uids(KBNODE keyblock)
+menu_clean(KBNODE keyblock,int self_only)
 {
   KBNODE uidnode;
-  int modified=0;
-  int select_all=!count_selected_uids(keyblock);
+  int modified=0,select_all=!count_selected_uids(keyblock);
 
-  for(uidnode=keyblock->next;uidnode;uidnode=uidnode->next)
+  for(uidnode=keyblock->next;
+      uidnode && uidnode->pkt->pkttype!=PKT_PUBLIC_SUBKEY;
+      uidnode=uidnode->next)
     {
       if(uidnode->pkt->pkttype==PKT_USER_ID
         && (uidnode->flag&NODFLG_SELUID || select_all))
        {
-         int deleted;
+         int uids=0,sigs=0;
          char *user=utf8_to_native(uidnode->pkt->pkt.user_id->name,
                                    uidnode->pkt->pkt.user_id->len,
                                    0);
-         deleted=clean_sigs_from_uid(keyblock,uidnode,opt.verbose);
-         if(deleted)
-           {
-             tty_printf(deleted==1?
-                        "User ID \"%s\": %d signature removed.\n":
-                        "User ID \"%s\": %d signatures removed.\n",
-                        user,deleted);
-             modified=1;
-           }
-         else
-           tty_printf(_("User ID \"%s\": already clean.\n"),user);
-
-         xfree(user);
-       }
-    }
-
-  return modified;
-}
-
-static int
-menu_clean_uids_from_key(KBNODE keyblock)
-{
-  int modified=clean_uids_from_key(keyblock,0);
-
-  if(modified)
-    {
-      KBNODE node,uidnode=NULL;
 
-      for(node=keyblock->next;node;node=node->next)
-       {
-         if(node->pkt->pkttype==PKT_USER_ID)
-           uidnode=node;
-         else if(uidnode && node->pkt->pkttype==PKT_SIGNATURE
-                 && is_deleted_kbnode(node))
+         clean_one_uid(keyblock,uidnode,opt.verbose,self_only,&uids,&sigs);
+         if(uids)
            {
              const char *reason;
-             char *user=utf8_to_native(uidnode->pkt->pkt.user_id->name,
-                                       uidnode->pkt->pkt.user_id->len,0);
 
              if(uidnode->pkt->pkt.user_id->is_revoked)
                reason=_("revoked");
@@ -3247,14 +3234,23 @@ menu_clean_uids_from_key(KBNODE keyblock)
 
              tty_printf("User ID \"%s\" compacted: %s\n",user,reason);
 
-             uidnode=NULL;
+             modified=1;
+           }
+         else if(sigs)
+           {
+             tty_printf(sigs==1?
+                        "User ID \"%s\": %d signature removed\n":
+                        "User ID \"%s\": %d signatures removed\n",
+                        user,sigs);
 
-             xfree(user);
+             modified=1;
            }
+         else
+           tty_printf(_("User ID \"%s\": already clean\n"),user);
+
+         xfree(user);
        }
     }
-  else
-    tty_printf("No user IDs are compactable.\n");
 
   return modified;
 }
@@ -3380,9 +3376,11 @@ menu_addrevoker( KBNODE pub_keyblock, KBNODE sec_keyblock, int sensitive )
          goto fail;
        }
 
-      /* Note that I'm requesting SIG here and not CERT.  We're making
-        a certification, but it is okay to be a subkey. */
-      revoker_pk->req_usage=PUBKEY_USAGE_SIG;
+      /* Note that I'm requesting CERT here, which usually implies
+        primary keys only, but some casual testing shows that PGP and
+        GnuPG both can handle a designated revokation from a
+        subkey. */
+      revoker_pk->req_usage=PUBKEY_USAGE_CERT;
       rc=get_pubkey_byname(revoker_pk,answer,NULL,NULL,1);
       if(rc)
        {
@@ -3662,10 +3660,21 @@ menu_backsign(KBNODE pub_keyblock,KBNODE sec_keyblock)
        }
 
       /* Find a signing subkey with no backsig */
-      if(node->pkt->pkttype==PKT_PUBLIC_SUBKEY
-         && (node->pkt->pkt.public_key->pubkey_usage&PUBKEY_USAGE_SIG)
-         && !node->pkt->pkt.public_key->backsig)
-        sub_pk=node->pkt->pkt.public_key;
+      if(node->pkt->pkttype==PKT_PUBLIC_SUBKEY)
+       {
+         if(node->pkt->pkt.public_key->pubkey_usage&PUBKEY_USAGE_SIG)
+           {
+             if(node->pkt->pkt.public_key->backsig)
+               tty_printf(_("signing subkey %s is already cross-certified\n"),
+                          keystr_from_pk(node->pkt->pkt.public_key));
+             else
+               sub_pk=node->pkt->pkt.public_key;
+           }
+         else
+           tty_printf(_("subkey %s does not sign and so does"
+                        " not need to be cross-certified\n"),
+                      keystr_from_pk(node->pkt->pkt.public_key));
+       }
 
       if(!sub_pk)
        continue;
@@ -3694,16 +3703,21 @@ menu_backsign(KBNODE pub_keyblock,KBNODE sec_keyblock)
          }
 
       if(!sub_sk)
-       continue;
+       {
+         tty_printf(_("no secret subkey for public subkey %s - ignoring\n"),
+                    keystr_from_pk(sub_pk));
+         continue;
+       }
 
       /* Now finally find the matching selfsig on the secret subkey.
         We can't use chosen_selfsig here (it's not set for secret
         keys), so we just pick the selfsig with the right class.
         This is what menu_expire does as well. */
       for(node2=node2->next;
-         node2 && node2->pkt->pkttype==PKT_SIGNATURE;
+         node2 && node2->pkt->pkttype!=PKT_SECRET_SUBKEY;
          node2=node2->next)
-       if(node2->pkt->pkt.signature->version>=4
+       if(node2->pkt->pkttype==PKT_SIGNATURE
+          && node2->pkt->pkt.signature->version>=4
           && node2->pkt->pkt.signature->keyid[0]==sig_pk->pkt->pkt.signature->keyid[0]
           && node2->pkt->pkt.signature->keyid[1]==sig_pk->pkt->pkt.signature->keyid[1]
           && node2->pkt->pkt.signature->sig_class==sig_pk->pkt->pkt.signature->sig_class)
@@ -3712,11 +3726,8 @@ menu_backsign(KBNODE pub_keyblock,KBNODE sec_keyblock)
            break;
          }
 
-      if(!sig_sk)
-       continue;
-
       /* Now we can get to work.  We have a main key and secret part,
-        a signing subkey with signature and secret part with
+        a signing subkey with signature and secret part possibly with
         signature. */
 
       passphrase=get_last_passphrase();
@@ -3745,13 +3756,16 @@ menu_backsign(KBNODE pub_keyblock,KBNODE sec_keyblock)
              xfree(sig_pk->pkt);
              sig_pk->pkt=newpkt;
 
-             /* Put the new sig into place on the seckey */
-             newpkt=xmalloc_clear(sizeof(*newpkt));
-             newpkt->pkttype=PKT_SIGNATURE;
-             newpkt->pkt.signature=copy_signature(NULL,newsig);
-             free_packet(sig_sk->pkt);
-             xfree(sig_sk->pkt);
-             sig_sk->pkt=newpkt;
+             if(sig_sk)
+               {
+                 /* Put the new sig into place on the seckey */
+                 newpkt=xmalloc_clear(sizeof(*newpkt));
+                 newpkt->pkttype=PKT_SIGNATURE;
+                 newpkt->pkt.signature=copy_signature(NULL,newsig);
+                 free_packet(sig_sk->pkt);
+                 xfree(sig_sk->pkt);
+                 sig_sk->pkt=newpkt;
+               }
 
              modified=1;
            }
@@ -4152,6 +4166,219 @@ menu_set_keyserver_url (const char *url,
   return modified;
 }
 
+static int
+menu_set_notation(const char *string,KBNODE pub_keyblock,KBNODE sec_keyblock)
+{
+  PKT_secret_key *sk;    /* copy of the main sk */
+  PKT_public_key *main_pk;
+  PKT_user_id *uid;
+  KBNODE node;
+  u32 keyid[2];
+  int selected, select_all;
+  int modified = 0;
+  char *answer;
+  struct notation *notation;
+
+  no_primary_warning(pub_keyblock);
+
+  if(string)
+    answer=xstrdup(string);
+  else
+    {
+      answer=cpr_get_utf8("keyedit.add_notation",
+                         _("Enter the notation: "));
+      if(answer[0]=='\0' || answer[0]=='\004')
+       {
+         xfree(answer);
+         return 0;
+       }
+    }
+
+  if(ascii_strcasecmp(answer,"none")==0
+     || ascii_strcasecmp(answer,"-")==0)
+    notation=NULL; /* delete them all */
+  else
+    {
+      notation=string_to_notation(answer,0);
+      if(!notation)
+       {
+         xfree(answer);
+         return 0;
+       }
+    }
+
+  xfree(answer);
+
+  select_all = !count_selected_uids (pub_keyblock);
+
+  node = find_kbnode( sec_keyblock, PKT_SECRET_KEY );
+  sk = copy_secret_key( NULL, node->pkt->pkt.secret_key);
+
+  /* Now we can actually change the self signature(s) */
+  main_pk = NULL;
+  uid = NULL;
+  selected = 0;
+  for ( node=pub_keyblock; node; node = node->next )
+    {
+      if ( node->pkt->pkttype == PKT_PUBLIC_SUBKEY )
+       break; /* ready */
+
+      if ( node->pkt->pkttype == PKT_PUBLIC_KEY )
+       {
+         main_pk = node->pkt->pkt.public_key;
+         keyid_from_pk( main_pk, keyid );
+       }
+      else if ( node->pkt->pkttype == PKT_USER_ID )
+       {
+         uid = node->pkt->pkt.user_id;
+         selected = select_all || (node->flag & NODFLG_SELUID);
+       }
+      else if ( main_pk && uid && selected
+               && node->pkt->pkttype == PKT_SIGNATURE )
+       {
+         PKT_signature *sig = node->pkt->pkt.signature;
+         if ( keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
+              && (uid && (sig->sig_class&~3) == 0x10)
+              && sig->flags.chosen_selfsig)
+           {
+             char *user=utf8_to_native(uid->name,strlen(uid->name),0);
+             if( sig->version < 4 )
+               log_info(_("skipping v3 self-signature on user ID \"%s\"\n"),
+                        user);
+             else
+               {
+                 PKT_signature *newsig;
+                 PACKET *newpkt;
+                 int rc,skip=0,addonly=1;
+
+                 if(sig->flags.notation)
+                   {
+                     tty_printf("Current notations for user ID \"%s\":\n",
+                                user);
+                     tty_print_notations(-9,sig);
+                   }
+                 else
+                   {
+                     tty_printf("No notations on user ID \"%s\"\n",user);
+                     if(notation==NULL)
+                       {
+                         /* There are no current notations, so there
+                            is no point in trying to un-set them. */
+                         continue;
+                       }
+                   }
+
+                 if(notation)
+                   {
+                     struct notation *n;
+                     int deleting=0;
+
+                     notation->next=sig_to_notation(sig);
+
+                     for(n=notation->next;n;n=n->next)
+                       if(strcmp(n->name,notation->name)==0)
+                         {
+                           if(notation->value)
+                             {
+                               if(strcmp(n->value,notation->value)==0)
+                                 {
+                                   if(notation->flags.ignore)
+                                     {
+                                       /* Value match with a delete
+                                          flag. */
+                                       n->flags.ignore=1;
+                                       deleting=1;
+                                     }
+                                   else
+                                     {
+                                       /* Adding the same notation
+                                          twice, so don't add it at
+                                          all. */
+                                       skip=1;
+                                       tty_printf("Skipping notation:"
+                                                  " %s=%s\n",
+                                                  notation->name,
+                                                  notation->value);
+                                       break;
+                                     }
+                                 }
+                             }
+                           else
+                             {
+                               /* No value, so it means delete. */
+                               n->flags.ignore=1;
+                               deleting=1;
+                             }
+
+                           if(n->flags.ignore)
+                             {
+                               tty_printf("Removing notation: %s=%s\n",
+                                          n->name,n->value);
+                               addonly=0;
+                             }
+                         }
+
+                     if(!notation->flags.ignore && !skip)
+                       tty_printf("Adding notation: %s=%s\n",
+                                  notation->name,notation->value);
+
+                     /* We tried to delete, but had no matches */
+                     if(notation->flags.ignore && !deleting)
+                       continue;
+                   }
+                 else
+                   {
+                     tty_printf("Removing all notations\n");
+                     addonly=0;
+                   }
+
+                 if(skip
+                    || (!addonly
+                        && !cpr_get_answer_is_yes("keyedit.confirm_notation",
+                                                  _("Proceed? (y/N) "))))
+                   continue;
+
+                 rc = update_keysig_packet (&newsig, sig,
+                                            main_pk, uid, NULL,
+                                            sk,
+                                            keygen_add_notations, notation );
+                 if( rc )
+                   {
+                     log_error ("update_keysig_packet failed: %s\n",
+                                g10_errstr(rc));
+                     free_secret_key( sk );
+                     free_notation(notation);
+                     xfree(user);
+                     return 0;
+                   }
+
+                 /* replace the packet */
+                 newpkt = xmalloc_clear( sizeof *newpkt );
+                 newpkt->pkttype = PKT_SIGNATURE;
+                 newpkt->pkt.signature = newsig;
+                 free_packet( node->pkt );
+                 xfree( node->pkt );
+                 node->pkt = newpkt;
+                 modified = 1;
+
+                 if(notation)
+                   {
+                     /* Snip off the notation list from the sig */
+                     free_notation(notation->next);
+                     notation->next=NULL;
+                   }
+
+                 xfree(user);
+               }
+           }
+       }
+    }
+
+  free_notation(notation);
+  free_secret_key( sk );
+  return modified;
+}
+
 
 /****************
  * Select one user id or remove all selection if index is 0.