* keyserver.c (keyserver_spawn): Don't mess about with the $PATH.
[gnupg.git] / g10 / mainproc.c
index e6522f1..83bb5d8 100644 (file)
@@ -1,5 +1,6 @@
 /* mainproc.c - handle packets
- * Copyright (C) 1998,1999,2000,2001,2002,2003 Free Software Foundation, Inc.
+ * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004,
+ *               2005 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -49,7 +50,6 @@ struct kidlist_item {
 };
 
 
-
 /****************
  * Structure to hold the context
  */
@@ -70,7 +70,7 @@ struct mainproc_context {
     int have_data;
     IOBUF iobuf;    /* used to get the filename etc. */
     int trustletter; /* temp usage in list_node */
-    ulong local_id;    /* ditto */
+    ulong symkeys;
     struct kidlist_item *pkenc_list;   /* list of encryption packets */
     struct {
         int op;
@@ -238,37 +238,44 @@ add_signature( CTX c, PACKET *pkt )
     return 1;
 }
 
-static void
-symkey_decrypt_sesskey( DEK *dek, byte *sesskey, size_t slen )
+static int
+symkey_decrypt_seskey( DEK *dek, byte *seskey, size_t slen )
 {
     CIPHER_HANDLE hd;
-    int n;
+    unsigned int n;
 
     if ( slen < 17 || slen > 33 ) {
         log_error ( _("weird size for an encrypted session key (%d)\n"),
                    (int)slen);
-        return;   
+        return G10ERR_BAD_KEY;
     }
     hd = cipher_open( dek->algo, CIPHER_MODE_CFB, 1 );
     cipher_setkey( hd, dek->key, dek->keylen );
     cipher_setiv( hd, NULL, 0 );
-    cipher_decrypt( hd, sesskey, sesskey, slen );
+    cipher_decrypt( hd, seskey, seskey, slen );
     cipher_close( hd );
     /* check first byte (the cipher algo) */
-    if ( sesskey[0] > 10 ) {
-        log_error ( _("invalid symkey algorithm detected (%d)\n"),
-                    sesskey[0] );
-        return;
-    }
-    n = cipher_get_keylen (sesskey[0]) / 8;
+    if(check_cipher_algo(seskey[0]))
+      {
+       /* There is no way to tell the difference here between a bad
+          passphrase and a cipher algorithm that we don't have. */
+       log_error(_("bad passphrase or unknown cipher algorithm (%d)\n"),
+                 seskey[0]);
+       if(seskey[0]==CIPHER_ALGO_IDEA)
+         idea_cipher_warn(0);
+       return G10ERR_PASSPHRASE;
+      }
+    n = cipher_get_keylen (seskey[0]) / 8;
     if (n > DIM(dek->key))
          BUG ();
     /* now we replace the dek components with the real session key
        to decrypt the contents of the sequencing packet. */
-    dek->keylen = cipher_get_keylen( sesskey[0] ) / 8;
-    dek->algo = sesskey[0];
-    memcpy( dek->key, sesskey + 1, dek->keylen );
+    dek->keylen = cipher_get_keylen( seskey[0] ) / 8;
+    dek->algo = seskey[0];
+    memcpy( dek->key, seskey + 1, dek->keylen );
     /*log_hexdump( "thekey", dek->key, dek->keylen );*/
+
+    return 0;
 }   
 
 static void
@@ -279,26 +286,76 @@ proc_symkey_enc( CTX c, PACKET *pkt )
     enc = pkt->pkt.symkey_enc;
     if (!enc)
         log_error ("invalid symkey encrypted packet\n");
-    else {
+    else if(!c->dek)
+      {
         int algo = enc->cipher_algo;
-       const char *s;
+       const char *s = cipher_algo_to_string (algo);
 
-       s = cipher_algo_to_string (algo);
-       if( s )
-           log_info(_("%s encrypted data\n"), s );
+       if(s)
+         {
+           if(!opt.quiet)
+             {
+               if(enc->seskeylen)
+                 log_info(_("%s encrypted session key\n"), s );
+               else
+                 log_info(_("%s encrypted data\n"), s );
+             }
+         }
        else
-           log_info(_("encrypted with unknown algorithm %d\n"), algo );
+         log_error(_("encrypted with unknown algorithm %d\n"), algo );
+
+       if(check_digest_algo(enc->s2k.hash_algo))
+         {
+           log_error(_("passphrase generated with unknown digest"
+                       " algorithm %d\n"),enc->s2k.hash_algo);
+           s=NULL;
+         }
 
        c->last_was_session_key = 2;
-       if ( opt.list_only )
-           goto leave;
-       c->dek = passphrase_to_dek( NULL, 0, algo, &enc->s2k, 0, NULL, NULL );
-        if (c->dek)
-            c->dek->algo_info_printed = 1;
-        if ( c->dek && enc->seskeylen )
-            symkey_decrypt_sesskey( c->dek, enc->seskey, enc->seskeylen );
-    }
-leave:
+       if(!s || opt.list_only)
+         goto leave;
+
+       if(opt.override_session_key)
+         {
+           c->dek = m_alloc_clear( sizeof *c->dek );
+           if(get_override_session_key(c->dek, opt.override_session_key))
+             {
+               m_free(c->dek);
+               c->dek = NULL;
+             }
+         }
+       else
+         {
+           c->dek=passphrase_to_dek(NULL, 0, algo, &enc->s2k, 0, NULL, NULL);
+
+           if(c->dek)
+             {
+               c->dek->symmetric=1;
+
+               /* FIXME: This doesn't work perfectly if a symmetric
+                  key comes before a public key in the message - if
+                  the user doesn't know the passphrase, then there is
+                  a chance that the "decrypted" algorithm will happen
+                  to be a valid one, which will make the returned dek
+                  appear valid, so we won't try any public keys that
+                  come later. */
+               if(enc->seskeylen)
+                 {
+                   if(symkey_decrypt_seskey(c->dek, enc->seskey,
+                                            enc->seskeylen))
+                     {
+                       m_free(c->dek);
+                       c->dek=NULL;
+                     }
+                 }
+               else
+                 c->dek->algo_info_printed = 1;
+             }
+         }
+      }
+
+ leave:
+    c->symkeys++;
     free_packet(pkt);
 }
 
@@ -315,7 +372,7 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
     /* Hmmm: why do I have this algo check here - anyway there is
      * function to check it. */
     if( opt.verbose )
-       log_info(_("public key is %08lX\n"), (ulong)enc->keyid[1] );
+       log_info(_("public key is %s\n"), keystr(enc->keyid) );
 
     if( is_status_enabled() ) {
        char buf[50];
@@ -358,31 +415,21 @@ proc_pubkey_enc( CTX c, PACKET *pkt )
 
     if( result == -1 )
        ;
-    else {
-        if( !result ) {
-            if( opt.verbose > 1 )
-                log_info( _("public key encrypted data: good DEK\n") );
-            if ( opt.show_session_key ) {
-                int i;
-                char *buf = m_alloc ( c->dek->keylen*2 + 20 );
-                sprintf ( buf, "%d:", c->dek->algo );
-                for(i=0; i < c->dek->keylen; i++ )
-                    sprintf(buf+strlen(buf), "%02X", c->dek->key[i] );
-                log_info( "session key: \"%s\"\n", buf );
-                write_status_text ( STATUS_SESSION_KEY, buf );
-            }
-        }
+    else
+      {
         /* store it for later display */
-        {
-            struct kidlist_item *x = m_alloc( sizeof *x );
-            x->kid[0] = enc->keyid[0];
-            x->kid[1] = enc->keyid[1];
-            x->pubkey_algo = enc->pubkey_algo;
-            x->reason = result;
-            x->next = c->pkenc_list;
-            c->pkenc_list = x;
-        }
-    }
+       struct kidlist_item *x = m_alloc( sizeof *x );
+       x->kid[0] = enc->keyid[0];
+       x->kid[1] = enc->keyid[1];
+       x->pubkey_algo = enc->pubkey_algo;
+       x->reason = result;
+       x->next = c->pkenc_list;
+       c->pkenc_list = x;
+
+        if( !result && opt.verbose > 1 )
+         log_info( _("public key encrypted data: good DEK\n") );
+      }
+
     free_packet(pkt);
 }
 
@@ -410,22 +457,20 @@ print_pkenc_list( struct kidlist_item *list, int failed )
        if( !algstr )
            algstr = "[?]";
        pk->pubkey_algo = list->pubkey_algo;
-       if( !get_pubkey( pk, list->kid ) ) {
-           size_t n;
+       if( !get_pubkey( pk, list->kid ) )
+         {
            char *p;
-           log_info( _("encrypted with %u-bit %s key, ID %08lX, created %s\n"),
-                      nbits_from_pk( pk ), algstr, (ulong)list->kid[1],
-                      strtimestamp(pk->timestamp) );
-           fputs("      \"", log_stream() );
-           p = get_user_id( list->kid, &n );
-           print_utf8_string2 ( log_stream(), p, n, '"' );
+           log_info( _("encrypted with %u-bit %s key, ID %s, created %s\n"),
+                     nbits_from_pk( pk ), algstr, keystr_from_pk(pk),
+                     strtimestamp(pk->timestamp) );
+           p=get_user_id_native(list->kid);
+           fprintf(log_stream(),_("      \"%s\"\n"),p);
            m_free(p);
-           fputs("\"\n", log_stream() );
-       }
-       else {
-           log_info(_("encrypted with %s key, ID %08lX\n"),
-                       algstr, (ulong) list->kid[1] );
-       }
+         }
+       else
+         log_info(_("encrypted with %s key, ID %s\n"),
+                  algstr,keystr(list->kid));
+
        free_public_key( pk );
 
        if( list->reason == G10ERR_NO_SECKEY ) {
@@ -448,10 +493,15 @@ proc_encrypted( CTX c, PACKET *pkt )
 {
     int result = 0;
 
-    if (!opt.quiet) {
+    if (!opt.quiet)
+      {
+       if(c->symkeys>1)
+         log_info(_("encrypted with %lu passphrases\n"),c->symkeys);
+       else if(c->symkeys==1)
+         log_info(_("encrypted with 1 passphrase\n"));
         print_pkenc_list ( c->pkenc_list, 1 );
         print_pkenc_list ( c->pkenc_list, 0 );
-    }
+      }
 
     write_status( STATUS_BEGIN_DECRYPTION );
 
@@ -462,40 +512,55 @@ proc_encrypted( CTX c, PACKET *pkt )
         int algo;
         STRING2KEY s2kbuf, *s2k = NULL;
 
-       /* assume this is old style conventional encrypted data */
-        if ( (algo = opt.def_cipher_algo))
-            log_info (_("assuming %s encrypted data\n"),
+       if(opt.override_session_key)
+         {
+           c->dek = m_alloc_clear( sizeof *c->dek );
+           result=get_override_session_key(c->dek, opt.override_session_key);
+           if(result)
+             {
+               m_free(c->dek);
+               c->dek = NULL;
+             }
+         }
+       else
+         {
+           /* assume this is old style conventional encrypted data */
+           if ( (algo = opt.def_cipher_algo))
+             log_info (_("assuming %s encrypted data\n"),
                         cipher_algo_to_string(algo));
-        else if ( check_cipher_algo(CIPHER_ALGO_IDEA) ) {
-            algo = opt.def_cipher_algo;
-            if (!algo)
-                algo = opt.s2k_cipher_algo;
-           idea_cipher_warn(1);
-            log_info (_("IDEA cipher unavailable, "
-                        "optimistically attempting to use %s instead\n"),
-                       cipher_algo_to_string(algo));
-        }
-        else {
-            algo = CIPHER_ALGO_IDEA;
-            if (!opt.s2k_digest_algo) {
-                /* If no digest is given we assume MD5 */
-                s2kbuf.mode = 0;
-                s2kbuf.hash_algo = DIGEST_ALGO_MD5;
-                s2k = &s2kbuf;
-            }
-            log_info (_("assuming %s encrypted data\n"), "IDEA");
-        }
+           else if ( check_cipher_algo(CIPHER_ALGO_IDEA) )
+             {
+               algo = opt.def_cipher_algo;
+               if (!algo)
+                 algo = opt.s2k_cipher_algo;
+               idea_cipher_warn(1);
+               log_info (_("IDEA cipher unavailable, "
+                           "optimistically attempting to use %s instead\n"),
+                         cipher_algo_to_string(algo));
+             }
+           else
+             {
+               algo = CIPHER_ALGO_IDEA;
+               if (!opt.s2k_digest_algo)
+                 {
+                   /* If no digest is given we assume MD5 */
+                   s2kbuf.mode = 0;
+                   s2kbuf.hash_algo = DIGEST_ALGO_MD5;
+                   s2k = &s2kbuf;
+                 }
+               log_info (_("assuming %s encrypted data\n"), "IDEA");
+             }
 
-       c->dek = passphrase_to_dek ( NULL, 0, algo, s2k, 0, NULL, NULL );
-        if (c->dek)
-            c->dek->algo_info_printed = 1;
+           c->dek = passphrase_to_dek ( NULL, 0, algo, s2k, 0, NULL, NULL );
+           if (c->dek)
+             c->dek->algo_info_printed = 1;
+         }
     }
     else if( !c->dek )
        result = G10ERR_NO_SECKEY;
     if( !result )
        result = decrypt_data( c, pkt->pkt.encrypted, c->dek );
 
-    m_free(c->dek); c->dek = NULL;
     if( result == -1 )
        ;
     else if( !result || (result==G10ERR_BAD_SIGN && opt.ignore_mdc_error)) {
@@ -506,6 +571,16 @@ proc_encrypted( CTX c, PACKET *pkt )
            write_status( STATUS_GOODMDC );
        else if(!opt.no_mdc_warn)
            log_info (_("WARNING: message was not integrity protected\n"));
+       if(opt.show_session_key)
+         {
+           int i;
+           char *buf = m_alloc ( c->dek->keylen*2 + 20 );
+           sprintf ( buf, "%d:", c->dek->algo );
+           for(i=0; i < c->dek->keylen; i++ )
+             sprintf(buf+strlen(buf), "%02X", c->dek->key[i] );
+           log_info( "session key: `%s'\n", buf );
+           write_status_text ( STATUS_SESSION_KEY, buf );
+         }
     }
     else if( result == G10ERR_BAD_SIGN ) {
        log_error(_("WARNING: encrypted message has been manipulated!\n"));
@@ -518,6 +593,7 @@ proc_encrypted( CTX c, PACKET *pkt )
        /* Hmmm: does this work when we have encrypted using multiple
         * ways to specify the session key (symmmetric and PK)*/
     }
+    m_free(c->dek); c->dek = NULL;
     free_packet(pkt);
     c->last_was_session_key = 0;
     write_status( STATUS_END_DECRYPTION );
@@ -770,44 +846,38 @@ list_node( CTX c, KBNODE node )
             || node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {
        PKT_public_key *pk = node->pkt->pkt.public_key;
 
-       if( opt.with_colons ) {
+       if( opt.with_colons )
+         {
            u32 keyid[2];
            keyid_from_pk( pk, keyid );
-           if( mainkey ) {
-               c->local_id = pk->local_id;
-               c->trustletter = opt.fast_list_mode?
-                                          0 : get_validity_info( pk, NULL );
-           }
+           if( mainkey )
+             c->trustletter = opt.fast_list_mode?
+               0 : get_validity_info( pk, NULL );
            printf("%s:", mainkey? "pub":"sub" );
            if( c->trustletter )
-               putchar( c->trustletter );
-           printf(":%u:%d:%08lX%08lX:%s:%s:",
-                   nbits_from_pk( pk ),
-                   pk->pubkey_algo,
-                   (ulong)keyid[0],(ulong)keyid[1],
-                   colon_datestr_from_pk( pk ),
-                   colon_strtime (pk->expiredate) );
-           if( c->local_id )
-               printf("%lu", c->local_id );
-           putchar(':');
+             putchar( c->trustletter );
+           printf(":%u:%d:%08lX%08lX:%s:%s::",
+                  nbits_from_pk( pk ),
+                  pk->pubkey_algo,
+                  (ulong)keyid[0],(ulong)keyid[1],
+                  colon_datestr_from_pk( pk ),
+                  colon_strtime (pk->expiredate) );
            if( mainkey && !opt.fast_list_mode )
-                 putchar( get_ownertrust_info (pk) );
+             putchar( get_ownertrust_info (pk) );
            putchar(':');
            if( node->next && node->next->pkt->pkttype == PKT_RING_TRUST) {
-               putchar('\n'); any=1;
-               if( opt.fingerprint )
-                   print_fingerprint( pk, NULL, 0 );
-               printf("rtv:1:%u:\n",
-                           node->next->pkt->pkt.ring_trust->trustval );
+             putchar('\n'); any=1;
+             if( opt.fingerprint )
+               print_fingerprint( pk, NULL, 0 );
+             printf("rtv:1:%u:\n",
+                    node->next->pkt->pkt.ring_trust->trustval );
            }
-       }
+         }
        else
-           printf("%s  %4u%c/%08lX %s ",
-                                     mainkey? "pub":"sub",
-                                     nbits_from_pk( pk ),
-                                     pubkey_letter( pk->pubkey_algo ),
-                                     (ulong)keyid_from_pk( pk, NULL ),
-                                     datestr_from_pk( pk )     );
+         printf("%s  %4u%c/%s %s%s",
+                mainkey? "pub":"sub", nbits_from_pk( pk ),
+                pubkey_letter( pk->pubkey_algo ), keystr_from_pk( pk ),
+                datestr_from_pk( pk ), mainkey?" ":"");
 
        if( mainkey ) {
            /* and now list all userids with their signatures */
@@ -852,9 +922,22 @@ list_node( CTX c, KBNODE node )
                }
            }
        }
-       else if( pk->expiredate ) { /* of subkey */
-           printf(_(" [expires: %s]"), expirestr_from_pk( pk ) );
-       }
+       else
+         {
+           /* of subkey */
+           if( pk->is_revoked )
+             {
+               printf(" [");
+               printf(_("revoked: %s"),revokestr_from_pk(pk));
+               printf("]");
+             }
+           else if( pk->expiredate )
+             {
+               printf(" [");
+               printf(_("expires: %s"),expirestr_from_pk(pk));
+               printf("]");
+             }
+         }
 
        if( !any )
            putchar('\n');
@@ -865,25 +948,23 @@ list_node( CTX c, KBNODE node )
             || node->pkt->pkttype == PKT_SECRET_SUBKEY ) {
        PKT_secret_key *sk = node->pkt->pkt.secret_key;
 
-       if( opt.with_colons ) {
+       if( opt.with_colons )
+         {
            u32 keyid[2];
            keyid_from_sk( sk, keyid );
            printf("%s::%u:%d:%08lX%08lX:%s:%s:::",
-                   mainkey? "sec":"ssb",
-                   nbits_from_sk( sk ),
-                   sk->pubkey_algo,
-                   (ulong)keyid[0],(ulong)keyid[1],
-                   colon_datestr_from_sk( sk ),
-                   colon_strtime (sk->expiredate)
-                   /* fixme: add LID */ );
-       }
+                  mainkey? "sec":"ssb",
+                  nbits_from_sk( sk ),
+                  sk->pubkey_algo,
+                  (ulong)keyid[0],(ulong)keyid[1],
+                  colon_datestr_from_sk( sk ),
+                  colon_strtime (sk->expiredate)
+                  /* fixme: add LID */ );
+         }
        else
-           printf("%s  %4u%c/%08lX %s ",
-                                     mainkey? "sec":"ssb",
-                                     nbits_from_sk( sk ),
-                                     pubkey_letter( sk->pubkey_algo ),
-                                     (ulong)keyid_from_sk( sk, NULL ),
-                                     datestr_from_sk( sk )   );
+         printf("%s  %4u%c/%s %s ", mainkey? "sec":"ssb",
+                nbits_from_sk( sk ), pubkey_letter( sk->pubkey_algo ),
+                keystr_from_sk( sk ), datestr_from_sk( sk ));
        if( mainkey ) {
            /* and now list all userids with their signatures */
            for( node = node->next; node; node = node->next ) {
@@ -935,7 +1016,7 @@ list_node( CTX c, KBNODE node )
        char *p;
        int sigrc = ' ';
 
-       if( !opt.list_sigs )
+       if( !opt.verbose )
            return;
 
        if( sig->sig_class == 0x20 || sig->sig_class == 0x30 )
@@ -985,8 +1066,8 @@ list_node( CTX c, KBNODE node )
            printf(":");
        }
        else
-           printf("%c       %08lX %s   ",
-                   sigrc, (ulong)sig->keyid[1], datestr_from_sig(sig));
+         printf("%c       %s %s   ",
+                sigrc, keystr(sig->keyid), datestr_from_sig(sig));
        if( sigrc == '%' )
            printf("[%s] ", g10_errstr(rc2) );
        else if( sigrc == '?' )
@@ -1072,7 +1153,7 @@ do_proc_packets( CTX c, IOBUF a )
        if( rc ) {
            free_packet(pkt);
             /* stop processing when an invalid packet has been encountered
-             * but don't do so when we are doing a --list-packet. */
+             * but don't do so when we are doing a --list-packets. */
            if( rc == G10ERR_INVALID_PACKET && opt.list_packets != 2 )
                break;
            continue;
@@ -1202,7 +1283,7 @@ static int
 check_sig_and_print( CTX c, KBNODE node )
 {
     PKT_signature *sig = node->pkt->pkt.signature;
-    const char *astr, *tstr;
+    const char *astr;
     int rc, is_expkey=0, is_revkey=0;
 
     if( opt.skip_verify ) {
@@ -1265,27 +1346,21 @@ check_sig_and_print( CTX c, KBNODE node )
         }
     }
 
-    tstr = asctimestamp(sig->timestamp);
     astr = pubkey_algo_to_string( sig->pubkey_algo );
-    if(opt.verify_options&VERIFY_SHOW_LONG_KEYID)
+    if(keystrlen()>8)
       {
-       log_info(_("Signature made %.*s\n"),(int)strlen(tstr), tstr);
-       log_info(_("               using %s key %08lX%08lX\n"),
-                astr? astr: "?",(ulong)sig->keyid[0],(ulong)sig->keyid[1] );
+       log_info(_("Signature made %s\n"),asctimestamp(sig->timestamp));
+       log_info(_("               using %s key %s\n"),
+                astr? astr: "?",keystr(sig->keyid));
       }
     else
-      log_info(_("Signature made %.*s using %s key ID %08lX\n"),
-              (int)strlen(tstr), tstr, astr? astr: "?",
-              (ulong)sig->keyid[1] );
+      log_info(_("Signature made %s using %s key ID %s\n"),
+              asctimestamp(sig->timestamp), astr? astr: "?",
+              keystr(sig->keyid));
 
     rc = do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
-    if( rc == G10ERR_NO_PUBKEY && opt.keyserver_scheme && opt.keyserver_options.auto_key_retrieve) {
-       if( keyserver_import_keyid ( sig->keyid )==0 )
-           rc = do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
-    }
 
-    /* If the key still isn't found, try to inform the user where it
-       can be found. */
+    /* If the key isn't found, check for a preferred keyserver */
 
     if(rc==G10ERR_NO_PUBKEY && sig->flags.pref_ks)
       {
@@ -1300,11 +1375,48 @@ check_sig_and_print( CTX c, KBNODE node )
               page, but "from" if it is located on a keyserver.  I'm
               not going to even try to make two strings here :) */
            log_info(_("Key available at: ") );
-           print_string( log_stream(), p, n, 0 );
+           print_utf8_string( log_stream(), p, n );
            putc( '\n', log_stream() );
+
+           if(opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE
+              && opt.keyserver_options.options&KEYSERVER_HONOR_KEYSERVER_URL)
+             {
+               struct keyserver_spec *spec;
+
+               spec=parse_preferred_keyserver(sig);
+               if(spec)
+                 {
+                   int res;
+
+                   glo_ctrl.in_auto_key_retrieve++;
+                   res=keyserver_import_keyid(sig->keyid,spec);
+                   glo_ctrl.in_auto_key_retrieve--;
+                   if(!res)
+                     rc=do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
+                   free_keyserver_spec(spec);
+
+                   if(!rc)
+                     break;
+                 }
+             }
          }
       }
 
+    /* If the preferred keyserver thing above didn't work, this is a
+       second try. */
+
+    if( rc == G10ERR_NO_PUBKEY && opt.keyserver
+       && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE))
+      {
+       int res;
+
+       glo_ctrl.in_auto_key_retrieve++;
+       res=keyserver_import_keyid ( sig->keyid, opt.keyserver );
+       glo_ctrl.in_auto_key_retrieve--;
+       if(!res)
+         rc = do_check_sig(c, node, NULL, &is_expkey, &is_revkey );
+      }
+
     if( !rc || rc == G10ERR_BAD_SIGN ) {
        KBNODE un, keyblock;
        int count=0, statno;
@@ -1329,6 +1441,7 @@ check_sig_and_print( CTX c, KBNODE node )
 
         /* find and print the primary user ID */
        for( un=keyblock; un; un = un->next ) {
+           char *p;
            int valid;
            if(un->pkt->pkttype==PKT_PUBLIC_KEY)
              {
@@ -1362,19 +1475,28 @@ check_sig_and_print( CTX c, KBNODE node )
                                           un->pkt->pkt.user_id->len, 
                                           -1 );
 
-            log_info(rc? _("BAD signature from \"")
-                       : sig->flags.expired ? _("Expired signature from \"")
-                      : _("Good signature from \""));
-           print_utf8_string( log_stream(), un->pkt->pkt.user_id->name,
-                                            un->pkt->pkt.user_id->len );
-           if(opt.verify_options&VERIFY_SHOW_VALIDITY)
-             fprintf(log_stream(),"\" [%s]\n",trust_value_to_string(valid));
+           p=utf8_to_native(un->pkt->pkt.user_id->name,
+                            un->pkt->pkt.user_id->len,0);
+
+           if(rc)
+             log_info(_("BAD signature from \"%s\""),p);
+           else if(sig->flags.expired)
+             log_info(_("Expired signature from \"%s\""),p);
            else
-             fputs("\"\n", log_stream() );
+             log_info(_("Good signature from \"%s\""),p);
+
+           m_free(p);
+
+           if(opt.verify_options&VERIFY_SHOW_UID_VALIDITY)
+             fprintf(log_stream()," [%s]\n",trust_value_to_string(valid));
+           else
+             fputs("\n", log_stream() );
             count++;
        }
        if( !count ) {  /* just in case that we have no valid textual
                            userid */
+           char *p;
+
            /* Try for an invalid textual userid */
             for( un=keyblock; un; un = un->next ) {
                 if( un->pkt->pkttype == PKT_USER_ID &&
@@ -1398,22 +1520,30 @@ check_sig_and_print( CTX c, KBNODE node )
                                           un? un->pkt->pkt.user_id->len:3, 
                                           -1 );
 
-            log_info(rc? _("BAD signature from \"")
-                       : sig->flags.expired ? _("Expired signature from \"")
-                      : _("Good signature from \""));
-            if (opt.trust_model!=TM_ALWAYS && un) {
-                fputs(_("[uncertain]"), log_stream() );
+           if(un)
+             p=utf8_to_native(un->pkt->pkt.user_id->name,
+                               un->pkt->pkt.user_id->len,0);
+           else
+             p=m_strdup("[?]");
+
+           if(rc)
+             log_info(_("BAD signature from \"%s\""),p);
+           else if(sig->flags.expired)
+             log_info(_("Expired signature from \"%s\""),p);
+           else
+             log_info(_("Good signature from \"%s\""),p);
+            if (opt.trust_model!=TM_ALWAYS && un)
+             {
                 putc(' ', log_stream() );
-            }
-            print_utf8_string( log_stream(),
-                               un? un->pkt->pkt.user_id->name:"[?]",
-                               un? un->pkt->pkt.user_id->len:3 );
-           fputs("\"\n", log_stream() );
+                fputs(_("[uncertain]"), log_stream() );
+             }
+           fputs("\n", log_stream() );
        }
 
         /* If we have a good signature and already printed 
          * the primary user ID, print all the other user IDs */
         if ( count && !rc ) {
+           char *p;
             for( un=keyblock; un; un = un->next ) {
                 if( un->pkt->pkttype != PKT_USER_ID )
                     continue;
@@ -1435,11 +1565,12 @@ check_sig_and_print( CTX c, KBNODE node )
                                  un->pkt->pkt.user_id->numattribs,pk,NULL);
                  }
 
-               log_info(    _("                aka \""));
-                print_utf8_string( log_stream(), un->pkt->pkt.user_id->name,
-                                                 un->pkt->pkt.user_id->len );
+               p=utf8_to_native(un->pkt->pkt.user_id->name,
+                                un->pkt->pkt.user_id->len,0);
+               log_info(_("                aka \"%s\""),p);
+               m_free(p);
 
-               if(opt.verify_options&VERIFY_SHOW_VALIDITY)
+               if(opt.verify_options&VERIFY_SHOW_UID_VALIDITY)
                  {
                    const char *valid;
                    if(un->pkt->pkt.user_id->is_revoked)
@@ -1450,30 +1581,32 @@ check_sig_and_print( CTX c, KBNODE node )
                      valid=trust_value_to_string(get_validity(pk,
                                                               un->pkt->
                                                               pkt.user_id));
-                   fprintf(log_stream(),"\" [%s]\n",valid);
+                   fprintf(log_stream()," [%s]\n",valid);
                  }
                else
-                 fputs("\"\n", log_stream() );
+                 fputs("\n", log_stream() );
             }
        }
        release_kbnode( keyblock );
 
        if( !rc )
          {
-           if(opt.verify_options&VERIFY_SHOW_POLICY)
+           if(opt.verify_options&VERIFY_SHOW_POLICY_URLS)
              show_policy_url(sig,0,1);
            else
              show_policy_url(sig,0,2);
 
-           if(opt.verify_options&VERIFY_SHOW_KEYSERVER)
+           if(opt.verify_options&VERIFY_SHOW_KEYSERVER_URLS)
              show_keyserver_url(sig,0,1);
            else
              show_keyserver_url(sig,0,2);
 
-           if(opt.verify_options&VERIFY_SHOW_NOTATION)
-             show_notation(sig,0,1);
+           if(opt.verify_options&VERIFY_SHOW_NOTATIONS)
+             show_notation(sig,0,1,
+                       ((opt.verify_options&VERIFY_SHOW_STD_NOTATIONS)?1:0)+
+                       ((opt.verify_options&VERIFY_SHOW_USER_NOTATIONS)?2:0));
            else
-             show_notation(sig,0,2);
+             show_notation(sig,0,2,0);
          }
 
        if( !rc && is_status_enabled() ) {
@@ -1588,7 +1721,6 @@ proc_tree( CTX c, KBNODE node )
     if (!node)
         return;
 
-    c->local_id = 0;
     c->trustletter = ' ';
     if( node->pkt->pkttype == PKT_PUBLIC_KEY
        || node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) {