[Cvs-cvs] ccvs/src ChangeLog admin.c client.c gpg.c gpg.h... [signed-commits3]

[Derek Robert Price]

CVSROOT:        /cvsroot/cvs
Module name:    ccvs
Branch:         signed-commits3
Changes by:     Derek Robert Price <address@hidden>     06/01/11 04:37:08

Modified files:
        src            : ChangeLog admin.c client.c gpg.c gpg.h log.c 
                         rcs.c rcs.h sanity.sh server.c sign.c verify.c 
                         vers_ts.c vers_ts.h 

Log message:
        * admin.c: Use "wrapper.h".
        * client.c (client_base_signatures): Allow removal of signature files.
        (handle_base_signature): Support new clear argument for
        client_base_signatures.
        (handle_base_clear_signature): New file.
        (responses): Add Base-clear-signatures.
        * gpg.c (parse_signature): Preserve raw signature.
        * gpg.h (struct openpgp_signature): Add storage for raw signature.
        * log.c (log_version): Display only low 32 bits of key IDs to users,
        mimicing GnuPG.
        * rcs.c: Use stricter include formatting.
        (RCS_add_openpgp_signature): Use xalloc_die for memory errors.
        (RCS_delete_openpgp_signatures): New function.
        * rcs.h (RCS_delete_openpgp_signatures): Add proto.
        * server.c (server_base_signatures): Send clear when there are no
        signatures.
        * sign.c (struct sign_args): Caller data for sign_fileproc.
        (sign_fileproc, sign): Handle key deletion.
        * verify.c (verify_fileproc): Match warning messages in local and
        client/server mode.  Don't treat lack of signatures as an error.
        * vers_ts.c (Version_TS), vers_ts.h (Version_TS): Make args const.
        
        * sanity.sh (openpgp): Add signature deletion tests.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/ChangeLog.diff?only_with_tag=signed-commits3&tr1=1.3328.2.21&tr2=1.3328.2.22&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/admin.c.diff?only_with_tag=signed-commits3&tr1=1.111.2.3&tr2=1.111.2.4&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/client.c.diff?only_with_tag=signed-commits3&tr1=1.438.2.7&tr2=1.438.2.8&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/gpg.c.diff?only_with_tag=signed-commits3&tr1=1.1.6.7&tr2=1.1.6.8&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/gpg.h.diff?only_with_tag=signed-commits3&tr1=1.1.6.2&tr2=1.1.6.3&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/log.c.diff?only_with_tag=signed-commits3&tr1=1.103.6.4&tr2=1.103.6.5&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/rcs.c.diff?only_with_tag=signed-commits3&tr1=1.356.6.5&tr2=1.356.6.6&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/rcs.h.diff?only_with_tag=signed-commits3&tr1=1.82.8.3&tr2=1.82.8.4&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/sanity.sh.diff?only_with_tag=signed-commits3&tr1=1.1105.2.8&tr2=1.1105.2.9&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/server.c.diff?only_with_tag=signed-commits3&tr1=1.453.2.5&tr2=1.453.2.6&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/sign.c.diff?only_with_tag=signed-commits3&tr1=1.1.6.6&tr2=1.1.6.7&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/verify.c.diff?only_with_tag=signed-commits3&tr1=1.1.2.6&tr2=1.1.2.7&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/vers_ts.c.diff?only_with_tag=signed-commits3&tr1=1.65.6.1&tr2=1.65.6.2&r1=text&r2=text
http://cvs.savannah.gnu.org/viewcvs/cvs/ccvs/src/vers_ts.h.diff?only_with_tag=signed-commits3&tr1=1.1.4.2&tr2=1.1.4.3&r1=text&r2=text

Patches:
Index: ccvs/src/ChangeLog
diff -u ccvs/src/ChangeLog:1.3328.2.21 ccvs/src/ChangeLog:1.3328.2.22
--- ccvs/src/ChangeLog:1.3328.2.21      Tue Jan 10 18:49:34 2006
+++ ccvs/src/ChangeLog  Wed Jan 11 04:37:07 2006
@@ -1,5 +1,29 @@
 2006-01-10  Derek Price  <address@hidden>
 
+       * admin.c: Use "wrapper.h".
+       * client.c (client_base_signatures): Allow removal of signature files.
+       (handle_base_signature): Support new clear argument for
+       client_base_signatures.
+       (handle_base_clear_signature): New file.
+       (responses): Add Base-clear-signatures.
+       * gpg.c (parse_signature): Preserve raw signature.
+       * gpg.h (struct openpgp_signature): Add storage for raw signature.
+       * log.c (log_version): Display only low 32 bits of key IDs to users,
+       mimicing GnuPG.
+       * rcs.c: Use stricter include formatting.
+       (RCS_add_openpgp_signature): Use xalloc_die for memory errors.
+       (RCS_delete_openpgp_signatures): New function.
+       * rcs.h (RCS_delete_openpgp_signatures): Add proto.
+       * server.c (server_base_signatures): Send clear when there are no
+       signatures.
+       * sign.c (struct sign_args): Caller data for sign_fileproc.
+       (sign_fileproc, sign): Handle key deletion.
+       * verify.c (verify_fileproc): Match warning messages in local and
+       client/server mode.  Don't treat lack of signatures as an error.
+       * vers_ts.c (Version_TS), vers_ts.h (Version_TS): Make args const.
+
+       * sanity.sh (openpgp): Add signature deletion tests.
+
        * client.c (send_fileproc): Compare files to base revision when
        available.
        (send_files): Accept FORCE_SIGNATURE flag.
Index: ccvs/src/admin.c
diff -u ccvs/src/admin.c:1.111.2.3 ccvs/src/admin.c:1.111.2.4
--- ccvs/src/admin.c:1.111.2.3  Fri Jan  6 20:37:13 2006
+++ ccvs/src/admin.c    Wed Jan 11 04:37:08 2006
@@ -26,6 +26,7 @@
 /* CVS headers.  */
 #include "ignore.h"
 #include "recurse.h"
+#include "wrapper.h"
 
 #include "cvs.h"
 
Index: ccvs/src/client.c
diff -u ccvs/src/client.c:1.438.2.7 ccvs/src/client.c:1.438.2.8
--- ccvs/src/client.c:1.438.2.7 Tue Jan 10 18:49:34 2006
+++ ccvs/src/client.c   Wed Jan 11 04:37:08 2006
@@ -2423,20 +2423,28 @@
     char *rev;
     char *basefile;
     char *sigfile;
+    bool *clear = data_arg;
 
     TRACE (TRACE_FUNCTION, "client_base_signatures (%s)", short_pathname);
 
-    if (!stored_signatures)
+    if (!stored_signatures && !*clear)
        error (1, 0,
               "Server sent `Base-signatures' response without signature.");
 
-    /* Read OPTIONS, PREV, and REV from the server.  */
+    /* Read REV from the server.  */
     read_line (&rev);
 
     basefile = make_base_file_name (filename, rev);
     sigfile = Xasprintf ("%s.sig", basefile);
 
-    client_write_sigfile (sigfile, false);
+    if (*clear)
+    {
+       if (unlink_file (sigfile) < 0 && !existence_error (errno))
+           error (0, 0, "Failed to delete signature file `%s'",
+                  sigfile);
+    }
+    else
+       client_write_sigfile (sigfile, false);
 
     free (rev);
     free (basefile);
@@ -2448,9 +2456,21 @@
 static void
 handle_base_signatures (char *args, size_t len)
 {
+    bool clear = false;
+    if (suppress_bases)
+       error (1, 0, "Server sent Base-* response when asked not to.");
+    call_in_directory (args, client_base_signatures, &clear);
+}
+
+
+
+static void
+handle_base_clear_signatures (char *args, size_t len)
+{
+    bool clear = true;
     if (suppress_bases)
        error (1, 0, "Server sent Base-* response when asked not to.");
-    call_in_directory (args, client_base_signatures, NULL);
+    call_in_directory (args, client_base_signatures, &clear);
 }
 
 
@@ -3815,6 +3835,8 @@
 
     RSP_LINE("Base-signatures", handle_base_signatures, response_type_normal,
             rs_optional),
+    RSP_LINE("Base-clear-signatures", handle_base_clear_signatures,
+            response_type_normal, rs_optional),
     RSP_LINE("OpenPGP-signatures", handle_openpgp_signatures,
             response_type_normal, rs_optional),
 
Index: ccvs/src/gpg.c
diff -u ccvs/src/gpg.c:1.1.6.7 ccvs/src/gpg.c:1.1.6.8
--- ccvs/src/gpg.c:1.1.6.7      Fri Dec 30 23:26:32 2005
+++ ccvs/src/gpg.c      Wed Jan 11 04:37:08 2006
@@ -1,5 +1,5 @@
 /* gpgsplit.c - An OpenPGP signature packet splitting tool
- * Copyright (C) 2001, 2002, 2003 Free Software Foundation, Inc.
+ * Copyright (C) 2001, 2002, 2003, 2006 Free Software Foundation, Inc.
  *
  * This file is part of of CVS
  * (derived from gpgsplit.c distributed with GnuPG).
@@ -34,6 +34,7 @@
 
 /* GNULIB Headers.  */
 #include "error.h"
+#include "xalloc.h"
 
 
 
@@ -385,6 +386,7 @@
   int rc;
   uint8_t c;
   uint32_t tmp32;
+  size_t raw_idx = 0;
 
   if ((rc = parse_header (bpin, &pkttype, &pktlen, &partial, header,
                          &header_len)))
@@ -396,11 +398,16 @@
     error (1, 0, "Unhandled OpenPGP packet type (%s)",
           pkttype_to_string (pkttype));
 
+  spout->raw = xmalloc (header_len + pktlen);
+  memcpy (spout->raw + raw_idx, header, header_len);
+  raw_idx += header_len;
+
   if (pktlen < 19)
     error (1, 0, "Malformed OpenPGP signature packet (too short)");
 
   if ((rc = read_u8 (bpin, &c)))
     return rc;
+  spout->raw[raw_idx++] = c;
   pktlen -= 1;
 
   if (c != 3)
@@ -408,6 +415,7 @@
 
   if ((rc = read_u8 (bpin, &c)))
     return rc;
+  spout->raw[raw_idx++] = c;
   pktlen -= 1;
 
   if (c != 5)
@@ -415,6 +423,7 @@
 
   if ((rc = read_u8 (bpin, &c)))
     return rc;
+  spout->raw[raw_idx++] = c;
   pktlen -= 1;
 
   if (c & 0xF0)
@@ -424,11 +433,23 @@
   if ((rc = read_u32 (bpin, &tmp32)))
     return rc;
   spout->ctime = tmp32;
+  spout->raw[raw_idx++] = (tmp32 >> 24) & 0xFF;
+  spout->raw[raw_idx++] = (tmp32 >> 16) & 0xFF;
+  spout->raw[raw_idx++] = (tmp32 >> 8) & 0xFF;
+  spout->raw[raw_idx++] = tmp32 & 0xFF;
   pktlen -= 4;
 
   /* Read the key ID.  */
   if ((rc = read_u64 (bpin, &spout->keyid)))
     return rc;
+  spout->raw[raw_idx++] = (spout->keyid >> 56) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 48) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 40) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 32) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 24) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 16) & 0xFF;
+  spout->raw[raw_idx++] = (spout->keyid >> 8) & 0xFF;
+  spout->raw[raw_idx++] = spout->keyid & 0xFF;
   pktlen -= 8;
 
   /* Don't need the rest of the packet yet.  */
@@ -439,8 +460,11 @@
       if ((rc = buf_read_data (bpin, pktlen, &tmp, &got)) < 0)
        return rc;
       assert (got);  /* Blocking buffers cannot return 0 bytes.  */
+      memcpy (spout->raw + raw_idx, tmp, got);
+      raw_idx += got;
       pktlen -= got;
     }
 
+  spout->rawlen = raw_idx;
   return 0;
 }
Index: ccvs/src/gpg.h
diff -u ccvs/src/gpg.h:1.1.6.2 ccvs/src/gpg.h:1.1.6.3
--- ccvs/src/gpg.h:1.1.6.2      Fri Dec 30 23:26:32 2005
+++ ccvs/src/gpg.h      Wed Jan 11 04:37:08 2006
@@ -34,6 +34,8 @@
 {
   time_t ctime;
   uint64_t keyid;
+  uint8_t *raw;
+  size_t rawlen;
 };
 
 
Index: ccvs/src/log.c
diff -u ccvs/src/log.c:1.103.6.4 ccvs/src/log.c:1.103.6.5
--- ccvs/src/log.c:1.103.6.4    Tue Jan 10 18:42:38 2006
+++ ccvs/src/log.c      Wed Jan 11 04:37:08 2006
@@ -1705,7 +1705,8 @@
 
        while (!(rc = parse_signature (membuf, &sig)))
        {
-           unsigned long long printablesig = sig.keyid;
+           /* GnuPG truncates this too.  */
+           unsigned long long printablesig = sig.keyid & 0xFFFFFFFF;
            char *hexsig;
            cvs_output_tagged ("openpgp-keyid-header",
                               "OpenPGP signature using key ID 0x");
Index: ccvs/src/rcs.c
diff -u ccvs/src/rcs.c:1.356.6.5 ccvs/src/rcs.c:1.356.6.6
--- ccvs/src/rcs.c:1.356.6.5    Tue Jan 10 02:27:46 2006
+++ ccvs/src/rcs.c      Wed Jan 11 04:37:08 2006
@@ -21,14 +21,16 @@
 /* Verify interface.  */
 #include "rcs.h"
 
+/* GNULIB headers.  */
+#include "base64.h"
+
 /* CVS headers.  */
-#include "cvs.h"
 #include "edit.h"
-#include "hardlink.h"
+#include "gpg.h"
 #include "sign.h"
 
-/* GNULIB headers.  */
-#include "base64.h"
+#include "cvs.h"
+#include "hardlink.h"
 
 /* These need to be source after cvs.h or HAVE_MMAP won't be set... */
 #ifdef HAVE_MMAP
@@ -4835,7 +4837,7 @@
            error (1, 0, "Invalid binhex data in signature (`%s', rev %s)",
                   finfo->rcs->print_path, rev);
        if (!oldsigs)
-           error (1, errno, "Memory allocation error");
+           xalloc_die ();
        free (n->data);
     }
 
@@ -4861,6 +4863,106 @@
 
 
 
+int
+RCS_delete_openpgp_signatures (struct file_info *finfo, const char *rev,
+                              uint32_t keyid)
+{
+    RCSVers *vers;
+    Node *n;
+    char *oldsigs;
+    size_t oldlen;
+    struct buffer *membuf;
+    struct openpgp_signature sig;
+    char *newsigs = NULL;
+    size_t newlen = 0;
+    bool found = false;
+    int rc;
+
+    TRACE (TRACE_FUNCTION, "RCS_delete_openpgp_signatures (%s, %s, %llx)",
+          finfo->fullname, rev, (unsigned long long)keyid);
+
+    if (finfo->rcs->flags & PARTIAL)
+       RCS_reparsercsfile (finfo->rcs, NULL, NULL);
+
+    n = findnode (finfo->rcs->versions, rev);
+    if (!n)
+       error (1, 0, "internal error: no revision information for %s", rev);
+    vers = n->data;
+
+    n = findnode (vers->other_delta, "openpgp-signatures");
+    if (!n)
+    {
+       error (0, 0, "No signatures attached to revision %s of `%s'",
+              rev, finfo->fullname);
+       return 1;
+    }
+
+    TRACE (TRACE_DATA,
+          "RCS_delete_openpgp_signatures: found oldsigs = %s, len = %u",
+          (char *)n->data, (unsigned int)n->len);
+
+    if (!base64_decode_alloc (n->data, n->len, &oldsigs, &oldlen))
+       error (1, 0, "Invalid binhex data in signature (`%s', rev %s)",
+              finfo->rcs->print_path, rev);
+    if (!oldsigs)
+       xalloc_die ();
+    free (n->data);
+
+    membuf = buf_nonio_initialize (NULL);
+    buf_output (membuf, oldsigs, oldlen);
+
+    while (!(rc = parse_signature (membuf, &sig)))
+    {
+       char *hexid1 = Xasprintf ("0x%llx", (unsigned long long) keyid);
+       char *hexid2 = Xasprintf ("0x%llx", (unsigned long long) sig.keyid);
+       if ((sig.keyid & 0xFFFFFFFF) == keyid)
+       {
+           TRACE (TRACE_DATA, "%s is a match for %s", hexid1, hexid2);
+           found = true;
+       }
+       else
+       {
+           TRACE (TRACE_DATA, "%s is not a match for %s", hexid1, hexid2);
+           newsigs = xrealloc (newsigs, newlen + sig.rawlen);
+           memcpy (newsigs + newlen, sig.raw, sig.rawlen);
+           newlen += sig.rawlen;
+       }
+       free (hexid1);
+       free (hexid2);
+       free (sig.raw);
+    }
+
+    if (!found)
+    {
+       char *hexid = Xasprintf ("0x%llx", (unsigned long long) keyid);
+       error (0, 0,
+              "No signatures with key ID %s found in revision %s of `%s'",
+              hexid, rev, finfo->fullname);
+       free (hexid);
+       if (newsigs) free (newsigs);
+       return 1;
+    }
+
+    if (newsigs)
+    {
+       n->len = base64_encode_alloc (newsigs, newlen, (char **)&n->data);
+       free (newsigs);
+    }
+    else
+       delnode (n);
+
+
+    TRACE (TRACE_DATA,
+          "RCS_add_openpgp_signature: found oldsigs = %s, len = %u",
+          (char *)n->data, (unsigned int)n->len);
+
+    RCS_rewrite (finfo->rcs, NULL, NULL);
+
+    return 0;
+}
+
+
+
 /* Find the delta currently locked by the user.  From the `ci' man page:
 
        "If rev is omitted, ci tries to  derive  the  new  revision
Index: ccvs/src/rcs.h
diff -u ccvs/src/rcs.h:1.82.8.3 ccvs/src/rcs.h:1.82.8.4
--- ccvs/src/rcs.h:1.82.8.3     Tue Jan 10 02:27:46 2006
+++ ccvs/src/rcs.h      Wed Jan 11 04:37:08 2006
@@ -17,6 +17,7 @@
 #define RCS_H
 
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <sys/types.h>
 
@@ -277,6 +278,8 @@
 const char *RCS_get_openpgp_signatures (RCSNode *rcs, const char *rev,
                                        size_t *len);
 void RCS_add_openpgp_signature (struct file_info *finfo, const char *rev);
+int RCS_delete_openpgp_signatures (struct file_info *finfo, const char *rev,
+                                  uint32_t keyid);
 int RCS_checkin (RCSNode *rcs, const char *update_dir, const char *workfile,
                 const char *message, const char *rev, time_t citime,
                 int flags);
Index: ccvs/src/sanity.sh
diff -u ccvs/src/sanity.sh:1.1105.2.8 ccvs/src/sanity.sh:1.1105.2.9
--- ccvs/src/sanity.sh:1.1105.2.8       Tue Jan 10 02:27:46 2006
+++ ccvs/src/sanity.sh  Wed Jan 11 04:37:08 2006
@@ -32753,6 +32753,10 @@
 "$DOTSTAR Good signature from \"CVS Test Script $DOTSTAR
 $DOTSTAR Good signature from \"CVS Test Script $DOTSTAR"
 
+         dotest openpgp-6 "$testcvs sign -d0xF133BDE9 file1"
+         dotest_fail openpgp-7 "$testcvs verify file1" \
+"$SPROG verify: No signature available for \`file1'"
+
          dokeep
          cd ../..
          rm -rf openpgp
Index: ccvs/src/server.c
diff -u ccvs/src/server.c:1.453.2.5 ccvs/src/server.c:1.453.2.6
--- ccvs/src/server.c:1.453.2.5 Tue Jan 10 18:42:38 2006
+++ ccvs/src/server.c   Wed Jan 11 04:37:08 2006
@@ -8445,12 +8445,17 @@
 void
 server_base_signatures (struct file_info *finfo, const char *rev)
 {
-    if (!supported_response ("Base-signatures"))
+    if (!supported_response ("Base-signatures")
+       || !supported_response ("Base-clear-signatures"))
        return;
 
     server_send_signatures (finfo->rcs, rev);
 
-    buf_output0 (protocol, "Base-signatures ");
+    if (RCS_get_openpgp_signatures (finfo->rcs, rev, NULL))
+       buf_output0 (protocol, "Base-signatures ");
+    else
+       buf_output0 (protocol, "Base-clear-signatures ");
+
     output_dir (finfo->update_dir, finfo->repository);
     buf_output0 (protocol, finfo->file);
     buf_output (protocol, "\n", 1);
Index: ccvs/src/sign.c
diff -u ccvs/src/sign.c:1.1.6.6 ccvs/src/sign.c:1.1.6.7
--- ccvs/src/sign.c:1.1.6.6     Tue Jan 10 18:49:34 2006
+++ ccvs/src/sign.c     Wed Jan 11 04:37:08 2006
@@ -434,16 +434,34 @@
 
 
 
+struct sign_args
+{
+    uint32_t keyid;
+    const char *tag;
+};
+
 static int
 sign_fileproc (void *callerdat, struct file_info *finfo)
 {
     Vers_TS *vers;
     int err = 0;
     Ctype status;
-    const char *delkey = callerdat;
+    struct sign_args *args = callerdat;
 
     TRACE (TRACE_FUNCTION, "sign_fileproc (%s)", finfo->fullname);
 
+    if (args->keyid)
+    {
+       vers = Version_TS (finfo, NULL, args->tag, NULL, true, 0);
+       err = RCS_delete_openpgp_signatures (finfo,
+                                            vers->vn_rcs
+                                            ? vers->vn_rcs : vers->vn_user,
+                                            args->keyid);
+       if (server_active)
+           server_base_signatures (finfo, vers->vn_user);
+       return err;
+    }
+
     status = Classify_File (finfo, NULL, NULL, NULL, true,
                            false, &vers, false);
 
@@ -526,12 +544,14 @@
     int err = 0;
     bool local = false;
     char *delkey = NULL;
+    char *tag = NULL;
+    struct sign_args args;
 
     if (argc == -1)
        usage (sign_usage);
 
     optind = 0;
-    while ((c = getopt (argc, argv, "+d:lR")) != -1)
+    while ((c = getopt (argc, argv, "+d:lr:R")) != -1)
     {
        switch (c)
        {
@@ -542,6 +562,10 @@
            case 'l':
                local = 1;
                break;
+           case 'r':
+               if (tag) free (tag);
+               tag = xstrdup (optarg);
+               break;
            case 'R':
                local = 0;
                break;
@@ -554,6 +578,13 @@
     argc -= optind;
     argv += optind;
 
+    if (tag && !delkey)
+    {
+       error (0, 0,
+"`cvs sign' may only be used to sign unmodified files in the current sandbox");
+       error (1, 0, "(`-r' option to `cvs sign' is valid only with `-d')");
+    }
+
     if (!delkey)
        err = start_recursion
            (sign_check_fileproc, NULL, NULL, NULL, NULL,
@@ -569,13 +600,18 @@
 
        ign_setup ();
 
-       if (local)
-           send_arg ("-l");
        if (delkey)
        {
            send_arg ("-d");
            send_arg (delkey);
        }
+       if (local)
+           send_arg ("-l");
+       if (tag)
+       {
+           send_arg ("-r");
+           send_arg (tag);
+       }
        send_arg ("--");
 
        /* Full file contents need to be sent to the server when signing since
@@ -592,10 +628,35 @@
     }
 #endif
 
+    if (delkey)
+    {
+       char *n;
+       long long tmp;
+
+       tmp = strtoull (delkey, &n, 0);
+       if (n == delkey || *n != '\0' || tmp == 0)
+       {
+           error (0, 0, "invalid key ID `%s'", delkey);
+           return 1;
+       }
+       if (tmp > UINT32_MAX)
+       {
+           error (0, 0, "invalid key ID `%s'", delkey);
+           return 1;
+       }
+       args.keyid = (uint32_t) tmp;
+    }
+    else
+       args.keyid = 0;
+
     /* start the recursion processor */
-    err = start_recursion (sign_fileproc, NULL, NULL, NULL, delkey, argc, argv,
+    args.tag = tag;
+    err = start_recursion (sign_fileproc, NULL, NULL, NULL, &args, argc, argv,
                           local, W_LOCAL, false, CVS_LOCK_WRITE, NULL, true,
                           NULL);
 
+    if (delkey) free (delkey);
+    if (tag) free (tag);
+
     return err;
 }
Index: ccvs/src/verify.c
diff -u ccvs/src/verify.c:1.1.2.6 ccvs/src/verify.c:1.1.2.7
--- ccvs/src/verify.c:1.1.2.6   Tue Jan 10 02:27:47 2006
+++ ccvs/src/verify.c   Wed Jan 11 04:37:08 2006
@@ -402,27 +402,36 @@
 
     if (current_parsed_root->isremote)
     {
-       char *updateprefix = finfo->update_dir
-                            ? Xasprintf ("%s/", finfo->update_dir) : "";
+       char *updateprefix = finfo->update_dir && *finfo->update_dir
+                            ? Xasprintf ("%s/", finfo->update_dir)
+                            : xstrdup ("");
        char *fullbasefn = Xasprintf ("%s%s", updateprefix, basefn);
        char *fullsigfn = Xasprintf ("%s%s", updateprefix, basesigfn);
 
-       /* FIXME: These errors should refetch instead.  */
+       /* FIXME: These errors should attempt a refetch instead.  */
        if (!isfile (basefn))
            error (1, 0, "Base file missing `%s'", fullbasefn);
+
        if (!isfile (basesigfn))
-           error (1, 0, "Signature file missing `%s'", fullsigfn);
+       {
+           error (0, 0, "No signature available for `%s'", finfo->fullname);
+           errors = true;
+       }
 
        /* FIXME: Once a "soft" connect to the server is possible, then when
         * the server is available, the signatures should be updated here.
         */
 
-       if (userargs->pipeout)
-           get_file (basesigfn, fullsigfn, "rb", &sigdata, &buflen, &siglen);
-       else
+       if (!errors)
        {
-           signedfn = basefn;
-           sigfn = basesigfn;
+           if (userargs->pipeout)
+               get_file (basesigfn, fullsigfn, "rb",
+                         &sigdata, &buflen, &siglen);
+           else
+           {
+               signedfn = basefn;
+               sigfn = basesigfn;
+           }
        }
 
        free (updateprefix);
@@ -446,10 +455,10 @@
                       finfo->fullname);
                errors = true;
            }
+           else if (!b64sig)
+               xalloc_die ();
            /* else, got usable signature data in SIGDATA... fall out.  */
        }
-       else if (!b64sig)
-           error (1, ENOMEM, "Memory allocation failed");
        else
        {
            error (0, 0, "No signature available for `%s'",
Index: ccvs/src/vers_ts.c
diff -u ccvs/src/vers_ts.c:1.65.6.1 ccvs/src/vers_ts.c:1.65.6.2
--- ccvs/src/vers_ts.c:1.65.6.1 Wed Dec 21 13:25:10 2005
+++ ccvs/src/vers_ts.c  Wed Jan 11 04:37:08 2006
@@ -38,8 +38,8 @@
  *   Vers_TS structure for FINFO.
  */
 Vers_TS *
-Version_TS (struct file_info *finfo, char *options, char *tag, char *date,
-            int force_tag_match, int set_time)
+Version_TS (struct file_info *finfo, const char *options, const char *tag,
+           const char *date, int force_tag_match, int set_time)
 {
     Node *p;
     RCSNode *rcsdata;
Index: ccvs/src/vers_ts.h
diff -u ccvs/src/vers_ts.h:1.1.4.2 ccvs/src/vers_ts.h:1.1.4.3
--- ccvs/src/vers_ts.h:1.1.4.2  Tue Jan 10 18:42:38 2006
+++ ccvs/src/vers_ts.h  Wed Jan 11 04:37:08 2006
@@ -92,8 +92,9 @@
 };
 typedef struct vers_ts Vers_TS;
 
-Vers_TS *Version_TS (struct file_info *finfo, char *options, char *tag,
-                    char *date, int force_tag_match, int set_time);
+Vers_TS *Version_TS (struct file_info *finfo, const char *options,
+                    const char *tag, const char *date, int force_tag_match,
+                    int set_time);
 void freevers_ts (Vers_TS **versp);
 char *time_stamp (const char *file);