X-Git-Url: http://git.chise.org/gitweb/?a=blobdiff_plain;f=epg.el;h=0cf9722d6b3845ac75ebbd289cc5ddffcbbca65c;hb=1750e2f3d7b84648182886bfc282291a69a863d2;hp=3c183a4bbd4b3f7ada1fb84fc087eb209cea7ce9;hpb=aa49ed0dd74477e4f8342d1fe06bf892bebe7a4b;p=elisp%2Fepg.git

diff --git a/epg.el b/epg.el
index 3c183a4..0cf9722 100644
--- a/epg.el
+++ b/epg.el
@@ -33,6 +33,11 @@
   :group 'epg
   :type 'string)
 
+(defcustom epg-gpgsm-program "gpgsm"
+  "The `gpgsm' executable."
+  :group 'epg
+  :type 'string)
+
 (defconst epg-version-number "0.0.0")
 
 (defvar epg-user-id nil
@@ -46,6 +51,7 @@
 (defvar epg-key-id nil)
 (defvar epg-context nil)
 (defvar epg-debug nil)
+(defvar epg-debug-buffer nil)
 
 ;; from gnupg/include/cipher.h
 (defconst epg-cipher-algorithm-alist
@@ -122,6 +128,19 @@
     (?c . certify)
     (?a . authentication)))
 
+(defvar epg-dn-type-alist
+  '(("1.2.840.113549.1.9.1" . "EMail")
+    ("2.5.4.12" . "T")
+    ("2.5.4.42" . "GN")
+    ("2.5.4.4" . "SN")
+    ("0.2.262.1.10.7.20" . "NameDistinguisher")
+    ("2.5.4.16" . "ADDR")
+    ("2.5.4.15" . "BC")
+    ("2.5.4.13" . "D")
+    ("2.5.4.17" . "PostalCode")
+    ("2.5.4.65" . "Pseudo")
+    ("2.5.4.5" . "SerialNumber")))
+
 (defvar epg-prompt-alist nil)
 
 (defun epg-make-data-from-file (file)
@@ -405,11 +424,26 @@ This function is for internal use only."
 	(setcdr entry value)
       (epg-context-set-result context (cons (cons name value) result)))))
 
+(defun epg-signature-to-string (signature)
+  (format "%s signature from %s %s%s"
+	  (capitalize (symbol-name (epg-signature-status signature)))
+	  (epg-signature-key-id signature)
+	  (epg-signature-user-id signature)
+	  (if (epg-signature-validity signature)
+	      (format " (trust %s)"
+		      (epg-signature-validity signature))
+	    "")))
+
+(defun epg-verify-result-to-string (verify-result)
+  (mapconcat #'epg-signature-to-string verify-result "\n"))
+
 (defun epg-start (context args)
   "Start `epg-gpg-program' in a subprocess with given ARGS."
   (let* ((args (append (list "--no-tty"
 			     "--status-fd" "1"
-			     "--command-fd" "0")
+			     "--yes")
+		       (unless (eq (epg-context-protocol context) 'CMS)
+			 (list "--command-fd" "0"))
 		       (if (epg-context-armor context) '("--armor"))
 		       (if (epg-context-textmode context) '("--textmode"))
 		       (if (epg-context-output-file context)
@@ -422,9 +456,14 @@ This function is for internal use only."
 	 process)
     (if epg-debug
 	(save-excursion
-	  (set-buffer (get-buffer-create  " *epg-debug*"))
+	  (unless epg-debug-buffer
+	    (setq epg-debug-buffer (generate-new-buffer " *epg-debug*")))
+	  (set-buffer epg-debug-buffer)
 	  (goto-char (point-max))
-	  (insert (format "%s %s\n" epg-gpg-program
+	  (insert (format "%s %s\n"
+			  (if (eq (epg-context-protocol context) 'CMS)
+			      epg-gpgsm-program
+			   epg-gpg-program)
 			  (mapconcat #'identity args " ")))))
     (with-current-buffer buffer
       (make-local-variable 'epg-read-point)
@@ -439,15 +478,22 @@ This function is for internal use only."
 	(progn
 	  (set-default-file-modes 448)
 	  (setq process
-		(apply #'start-process "epg" buffer epg-gpg-program args)))
+		(apply #'start-process "epg" buffer
+		       (if (eq (epg-context-protocol context) 'CMS)
+			   epg-gpgsm-program
+			 epg-gpg-program)
+		       args)))
       (set-default-file-modes orig-mode))
     (set-process-filter process #'epg-process-filter)
+    (set-process-sentinel process #'epg-process-sentinel)
     (epg-context-set-process context process)))
 
 (defun epg-process-filter (process input)
   (if epg-debug
       (save-excursion
-	(set-buffer (get-buffer-create  " *epg-debug*"))
+	(unless epg-debug-buffer
+	  (setq epg-debug-buffer (generate-new-buffer " *epg-debug*")))
+	(set-buffer epg-debug-buffer)
 	(goto-char (point-max))
 	(insert input)))
   (if (buffer-live-p (process-buffer process))
@@ -467,15 +513,25 @@ This function is for internal use only."
 		      (setq epg-pending-status-list nil))
 		  (if (and symbol
 			   (fboundp symbol))
-		      (funcall symbol process string))
-		  (condition-case nil
-		      (run-hook-with-args-until-success
-		       (intern (concat "epg-after-status-" status "-function"))
-		       string)
-		    (error)))))
+		      (funcall symbol process string)))))
 	  (forward-line))
 	(setq epg-read-point (point)))))
 
+(defun epg-process-sentinel (process status)
+  (if (and (buffer-live-p (process-buffer process))
+	   (not (equal status "finished\n")))
+      (save-excursion
+	(set-buffer (process-buffer process))
+	;; gpg process exited abnormally, but we have not received an
+	;; error response from it.  Set it here.
+	(unless (epg-context-result-for epg-context 'error)
+	  (if (string-match "\\`exited abnormally with code \\(.*\\)\n" status)
+	      (epg-context-set-result-for
+	       epg-context 'error
+	       (list (cons 'exit (string-to-number (match-string 1 status)))))
+	    (epg-context-set-result-for epg-context 'error
+				    (list (cons 'signal status))))))))
+
 (defun epg-read-output (context)
   (with-temp-buffer
     (if (fboundp 'set-buffer-multibyte)
@@ -494,15 +550,16 @@ This function is for internal use only."
 		epg-pending-status-list)
       (accept-process-output (epg-context-process context) 1))))
 
-(defun epg-wait-for-completion (context &optional no-eof)
-  (if (and (not no-eof)
-	   (eq (process-status (epg-context-process context)) 'run))
-      (process-send-eof (epg-context-process context)))
+(defun epg-wait-for-completion (context)
   (while (eq (process-status (epg-context-process context)) 'run)
     ;; We can't use accept-process-output instead of sit-for here
     ;; because it may cause an interrupt during the sentinel execution.
     (sit-for 0.1)))
 
+(defun epg-flush (context)
+  (if (eq (process-status (epg-context-process context)) 'run)
+      (process-send-eof (epg-context-process context))))
+
 (defun epg-reset (context)
   (if (and (epg-context-process context)
 	   (buffer-live-p (process-buffer (epg-context-process context))))
@@ -535,42 +592,84 @@ This function is for internal use only."
   (setq epg-key-id 'PIN))
 
 (defun epg-status-GET_HIDDEN (process string)
-  (let ((passphrase
-	 (funcall (if (consp (epg-context-passphrase-callback epg-context))
-		      (car (epg-context-passphrase-callback epg-context))
-		    (epg-context-passphrase-callback epg-context))
-		  (if (consp (epg-context-passphrase-callback epg-context))
-		      (cdr (epg-context-passphrase-callback epg-context)))))
-	string)
-    (if passphrase
+  (if (and epg-key-id
+	   (string-match "\\`passphrase\\." string))
+      (let (inhibit-quit
+	    passphrase
+	    passphrase-with-new-line)
 	(unwind-protect
-	    (progn
-	      (setq string (concat passphrase "\n"))
-	      (fillarray passphrase 0)
-	      (setq passphrase nil)
-	      (process-send-string process string))
-	  (if string
-	      (fillarray string 0))))))
+	    (condition-case nil
+		(progn
+		  (setq passphrase
+			(funcall
+			 (if (consp (epg-context-passphrase-callback
+				     epg-context))
+			     (car (epg-context-passphrase-callback
+				   epg-context))
+			   (epg-context-passphrase-callback epg-context))
+			 epg-key-id
+			 (if (consp (epg-context-passphrase-callback
+				     epg-context))
+			     (cdr (epg-context-passphrase-callback
+				   epg-context)))))
+		  (when passphrase
+		    (setq passphrase-with-new-line (concat passphrase "\n"))
+		    (fillarray passphrase 0)
+		    (setq passphrase nil)
+		    (process-send-string process passphrase-with-new-line)))
+	      (quit
+	       (epg-context-set-result-for
+		epg-context 'error
+		(cons 'quit
+		      (epg-context-result-for epg-context 'error)))
+	       (delete-process process)))
+	  (if passphrase
+	      (fillarray passphrase 0))
+	  (if passphrase-with-new-line
+	      (fillarray passphrase-with-new-line 0))))))
 
 (defun epg-status-GET_BOOL (process string)
-  (let ((entry (assoc string epg-prompt-alist)))
-    (if (y-or-n-p (if entry (cdr entry) (concat string "? ")))
-	(process-send-string process "y\n")
-      (process-send-string process "n\n"))))
+  (let ((entry (assoc string epg-prompt-alist))
+	inhibit-quit)
+    (condition-case nil
+      (if (y-or-n-p (if entry (cdr entry) (concat string "? ")))
+	  (process-send-string process "y\n")
+	(process-send-string process "n\n"))
+      (quit
+       (epg-context-set-result-for
+	epg-context 'error
+	(cons 'quit
+	      (epg-context-result-for epg-context 'error)))
+       (delete-process process)))))
 
 (defun epg-status-GET_LINE (process string)
-  (let* ((entry (assoc string epg-prompt-alist))
-	 (string (read-string (if entry (cdr entry) (concat string ": ")))))
-    (process-send-string process (concat string "\n"))))
+  (let ((entry (assoc string epg-prompt-alist))
+	inhibit-quit)
+    (condition-case nil
+	(process-send-string
+	 process
+	 (concat (read-string (if entry (cdr entry) (concat string ": ")))
+		 "\n"))
+      (quit
+       (epg-context-set-result-for
+	epg-context 'error
+	(cons 'quit
+	      (epg-context-result-for epg-context 'error)))
+       (delete-process process)))))
 
 (defun epg-status-GOODSIG (process string)
   (if (string-match "\\`\\([^ ]+\\) \\(.*\\)" string)
       (epg-context-set-result-for
        epg-context
        'verify
-       (cons (epg-make-signature 'good
-				 (match-string 1 string)
-				 (match-string 2 string))
+       (cons (epg-make-signature
+	      'good
+	      (match-string 1 string)
+	      (if (eq (epg-context-protocol epg-context) 'CMS)
+		  (condition-case nil
+		      (epg-dn-from-string (match-string 2 string))
+		    (error (match-string 2 string)))
+		(match-string 2 string)))
 	     (epg-context-result-for epg-context 'verify)))))
 
 (defun epg-status-EXPSIG (process string)
@@ -578,9 +677,14 @@ This function is for internal use only."
       (epg-context-set-result-for
        epg-context
        'verify
-       (cons (epg-make-signature 'expired
-				 (match-string 1 string)
-				 (match-string 2 string))
+       (cons (epg-make-signature
+	      'expired
+	      (match-string 1 string)
+	      (if (eq (epg-context-protocol epg-context) 'CMS)
+		  (condition-case nil
+		      (epg-dn-from-string (match-string 2 string))
+		    (error (match-string 2 string)))
+		(match-string 2 string)))
 	     (epg-context-result-for epg-context 'verify)))))
 
 (defun epg-status-EXPKEYSIG (process string)
@@ -588,9 +692,14 @@ This function is for internal use only."
       (epg-context-set-result-for
        epg-context
        'verify
-       (cons (epg-make-signature 'expired-key
-				 (match-string 1 string)
-				 (match-string 2 string))
+       (cons (epg-make-signature
+	      'expired-key
+	      (match-string 1 string)
+	      (if (eq (epg-context-protocol epg-context) 'CMS)
+		  (condition-case nil
+		      (epg-dn-from-string (match-string 2 string))
+		    (error (match-string 2 string)))
+		(match-string 2 string)))
 	     (epg-context-result-for epg-context 'verify)))))
 
 (defun epg-status-REVKEYSIG (process string)
@@ -598,9 +707,14 @@ This function is for internal use only."
       (epg-context-set-result-for
        epg-context
        'verify
-       (cons (epg-make-signature 'revoked-key
-				 (match-string 1 string)
-				 (match-string 2 string))
+       (cons (epg-make-signature
+	      'revoked-key
+	      (match-string 1 string)
+	      (if (eq (epg-context-protocol epg-context) 'CMS)
+		  (condition-case nil
+		      (epg-dn-from-string (match-string 2 string))
+		    (error (match-string 2 string)))
+		(match-string 2 string)))
 	     (epg-context-result-for epg-context 'verify)))))
 
 (defun epg-status-BADSIG (process string)
@@ -608,9 +722,14 @@ This function is for internal use only."
       (epg-context-set-result-for
        epg-context
        'verify
-       (cons (epg-make-signature 'bad
-				 (match-string 1 string)
-				 (match-string 2 string))
+       (cons (epg-make-signature
+	      'bad
+	      (match-string 1 string)
+	      (if (eq (epg-context-protocol epg-context) 'CMS)
+		  (condition-case nil
+		      (epg-dn-from-string (match-string 2 string))
+		    (error (match-string 2 string)))
+		(match-string 2 string)))
 	     (epg-context-result-for epg-context 'verify)))))
 
 (defun epg-status-VALIDSIG (process string)
@@ -721,16 +840,31 @@ This function is for internal use only."
        (cons (cons 'delete-problem (string-to-number (match-string 1 string)))
 	     (epg-context-result-for epg-context 'error)))))
 
-(defun epg-passphrase-callback-function (handback)
+(defun epg-status-SIG_CREATED (process string)
+  (if (string-match "\\`\\([DCS]\\) \\([0-9]+\\) \\([0-9]+\\) \
+\\([0-9A-Fa-F][0-9A-Fa-F]\\) \\(.*\\) " string)
+      (epg-context-set-result-for
+       epg-context 'sign
+       (cons (list (cons 'type (string-to-char (match-string 1 string)))
+		   (cons 'pubkey-algorithm
+			 (string-to-number (match-string 2 string)))
+		   (cons 'digest-algorithm
+			 (string-to-number (match-string 3 string)))
+		   (cons 'class (string-to-number (match-string 4 string) 16))
+		   (cons 'creation-time (match-string 5 string))
+		   (cons 'fingerprint (substring string (match-end 0))))
+	     (epg-context-result-for epg-context 'sign)))))
+
+(defun epg-passphrase-callback-function (key-id handback)
   (read-passwd
-   (if (eq epg-key-id 'SYM)
+   (if (eq key-id 'SYM)
        "Passphrase for symmetric encryption: "
-     (if (eq epg-key-id 'PIN)
+     (if (eq key-id 'PIN)
 	 "Passphrase for PIN: "
-       (let ((entry (assoc epg-key-id epg-user-id-alist)))
+       (let ((entry (assoc key-id epg-user-id-alist)))
 	 (if entry
-	     (format "Passphrase for %s %s: " epg-key-id (cdr entry))
-	   (format "Passphrase for %s: " epg-key-id)))))))
+	     (format "Passphrase for %s %s: " key-id (cdr entry))
+	   (format "Passphrase for %s: " key-id)))))))
 
 (defun epg-progress-callback-function (what char current total handback)
   (message "%s: %d%%/%d%%" what current total))
@@ -755,15 +889,21 @@ This function is for internal use only."
 			   config))))
     config))
 
-(defun epg-list-keys-1 (name mode)
+(defun epg-list-keys-1 (context name mode)
   (let ((args (append (list "--with-colons" "--no-greeting" "--batch"
-			    "--fixed-list-mode" "--with-fingerprint"
+			    "--with-fingerprint"
 			    "--with-fingerprint"
 			    (if mode "--list-secret-keys" "--list-keys"))
+		      (unless (eq (epg-context-protocol context) 'CMS)
+			'("--fixed-list-mode"))
 		      (if name (list name))))
 	keys string field index)
     (with-temp-buffer
-      (apply #'call-process epg-gpg-program nil (list t nil) nil args)
+      (apply #'call-process
+	     (if (eq (epg-context-protocol context) 'CMS)
+		 epg-gpgsm-program
+	       epg-gpg-program)
+	     nil (list t nil) nil args)
       (goto-char (point-min))
       (while (re-search-forward "^[a-z][a-z][a-z]:.*" nil t)
 	(setq keys (cons (make-vector 15 nil) keys)
@@ -791,12 +931,12 @@ This function is for internal use only."
    (aref line 5)
    (aref line 6)))
 
-(defun epg-list-keys (&optional name mode)
-  (let ((lines (epg-list-keys-1 name mode))
-	keys)
+(defun epg-list-keys (context &optional name mode)
+  (let ((lines (epg-list-keys-1 context name mode))
+	keys cert)
     (while lines
       (cond
-       ((member (aref (car lines) 0) '("pub" "sec"))
+       ((member (aref (car lines) 0) '("pub" "sec" "crt" "crs"))
 	(when (car keys)
 	  (epg-key-set-sub-key-list
 	   (car keys)
@@ -804,7 +944,8 @@ This function is for internal use only."
 	  (epg-key-set-user-id-list
 	   (car keys)
 	   (nreverse (epg-key-user-id-list (car keys)))))
-	(setq keys (cons (epg-make-key
+	(setq cert (member (aref (car lines) 0) '("crt" "crs"))
+	      keys (cons (epg-make-key
 			  (if (aref (car lines) 8)
 			      (cdr (assq (string-to-char (aref (car lines) 8))
 					 epg-key-validity-alist))))
@@ -825,12 +966,23 @@ This function is for internal use only."
 		(if (aref (car lines) 1)
 		    (cdr (assq (string-to-char (aref (car lines) 1))
 			       epg-key-validity-alist)))
-		(aref (car lines) 9))
+		(if cert
+		    (condition-case nil
+			(epg-dn-from-string (aref (car lines) 9))
+		      (error (aref (car lines) 9)))
+		  (aref (car lines) 9)))
 	       (epg-key-user-id-list (car keys)))))
        ((equal (aref (car lines) 0) "fpr")
 	(epg-sub-key-set-fingerprint (car (epg-key-sub-key-list (car keys)))
 				     (aref (car lines) 9))))
       (setq lines (cdr lines)))
+    (when (car keys)
+      (epg-key-set-sub-key-list
+       (car keys)
+       (nreverse (epg-key-sub-key-list (car keys))))
+      (epg-key-set-user-id-list
+       (car keys)
+       (nreverse (epg-key-user-id-list (car keys)))))
     (nreverse keys)))
 
 (if (fboundp 'make-temp-file)
@@ -896,7 +1048,9 @@ If you are unsure, use synchronous version of this function
     (error "Not a file"))
   (epg-context-set-result context nil)
   (epg-start context (list "--decrypt" (epg-data-file cipher)))
-  (epg-wait-for-status context '("BEGIN_DECRYPTION")))
+  ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
+  (unless (eq (epg-context-protocol context) 'CMS)
+    (epg-wait-for-status context '("BEGIN_DECRYPTION"))))
 
 ;;;###autoload
 (defun epg-decrypt-file (context cipher plain)
@@ -909,7 +1063,7 @@ If PLAIN is nil, it returns the result as a string."
 	  (epg-context-set-output-file context
 				       (epg-make-temp-file "epg-output")))
 	(epg-start-decrypt context (epg-make-data-from-file cipher))
-	(epg-wait-for-completion context t)
+	(epg-wait-for-completion context)
 	(if (epg-context-result-for context 'error)
 	    (error "Decrypt failed: %S"
 		   (epg-context-result-for context 'error)))
@@ -926,10 +1080,11 @@ If PLAIN is nil, it returns the result as a string."
 	(coding-system-for-write 'binary))
     (unwind-protect
 	(progn
-	  (write-region cipher nil input-file)
+	  (write-region cipher nil input-file nil 'quiet)
 	  (epg-context-set-output-file context
 				       (epg-make-temp-file "epg-output"))
 	  (epg-start-decrypt context (epg-make-data-from-file input-file))
+	  (epg-flush context)
 	  (epg-wait-for-completion context)
 	  (if (epg-context-result-for context 'error)
 	      (error "Decrypt failed: %S"
@@ -990,7 +1145,7 @@ For a normal or a clear text signature, SIGNED-TEXT should be nil."
 			      (epg-make-data-from-file signed-text))
 	  (epg-start-verify context
 			    (epg-make-data-from-file signature)))
-	(epg-wait-for-completion context t)
+	(epg-wait-for-completion context)
 	(unless plain
 	  (epg-read-output context)))
     (unless plain
@@ -1013,11 +1168,12 @@ For a normal or a clear text signature, SIGNED-TEXT should be nil."
 	  (if signed-text
 	      (progn
 		(setq input-file (epg-make-temp-file "epg-signature"))
-		(write-region signature nil input-file)
+		(write-region signature nil input-file nil 'quiet)
 		(epg-start-verify context
 				  (epg-make-data-from-file input-file)
 				  (epg-make-data-from-string signed-text)))
 	    (epg-start-verify context (epg-make-data-from-string signature)))
+	  (epg-flush context)
 	  (epg-wait-for-completion context)
 	  (epg-read-output context))
       (epg-delete-output-file context)
@@ -1048,12 +1204,17 @@ If you are unsure, use synchronous version of this function
 				 "--detach-sign"
 			       "--sign")))
 		     (apply #'nconc
-			    (mapcar (lambda (signer)
-				      (list "-u" signer))
-				    (epg-context-signers context)))
+			    (mapcar
+			     (lambda (signer)
+			       (list "-u"
+				     (epg-sub-key-id
+				      (car (epg-key-sub-key-list signer)))))
+			     (epg-context-signers context)))
 		     (if (epg-data-file plain)
 			 (list (epg-data-file plain)))))
-  (epg-wait-for-status context '("BEGIN_SIGNING"))
+  ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
+  (unless (eq (epg-context-protocol context) 'CMS)
+    (epg-wait-for-status context '("BEGIN_SIGNING")))
   (if (and (epg-data-string plain)
 	   (eq (process-status (epg-context-process context)) 'run))
       (process-send-string (epg-context-process context)
@@ -1073,10 +1234,15 @@ Otherwise, it makes a normal signature."
 	  (epg-context-set-output-file context
 				       (epg-make-temp-file "epg-output")))
 	(epg-start-sign context (epg-make-data-from-file plain) mode)
-	(epg-wait-for-completion context t)
-	(if (epg-context-result-for context 'error)
-	    (error "Sign failed: %S"
-		   (epg-context-result-for context 'error)))
+	(epg-wait-for-completion context)
+	(if (epg-context-result-for context 'sign)
+	    (if (epg-context-result-for context 'error)
+		(message "Sign error: %S"
+			 (epg-context-result-for context 'error)))
+	  (if (epg-context-result-for context 'error)
+	      (error "Sign failed: %S"
+		     (epg-context-result-for context 'error))
+	    (error "Sign failed")))
 	(unless signature
 	  (epg-read-output context)))
     (unless signature
@@ -1094,10 +1260,16 @@ Otherwise, it makes a normal signature."
 	(epg-context-set-output-file context
 				     (epg-make-temp-file "epg-output"))
 	(epg-start-sign context (epg-make-data-from-string plain) mode)
+	(epg-flush context)
 	(epg-wait-for-completion context)
-	(if (epg-context-result-for context 'error)
-	    (error "Sign failed: %S"
-		   (epg-context-result-for context 'error)))
+	(if (epg-context-result-for context 'sign)
+	    (if (epg-context-result-for context 'error)
+		(message "Sign error: %S"
+			 (epg-context-result-for context 'error)))
+	  (if (epg-context-result-for context 'error)
+	      (error "Sign failed: %S"
+		     (epg-context-result-for context 'error))
+	    (error "Sign failed")))
 	(epg-read-output context))
     (epg-delete-output-file context)
     (epg-reset context)))
@@ -1125,14 +1297,19 @@ If you are unsure, use synchronous version of this function
 						(list "-u" signer))
 					      (epg-context-signers context)))))
 		     (apply #'nconc
-			    (mapcar (lambda (recipient)
-				      (list "-r" recipient))
-				    recipients))
+			    (mapcar
+			     (lambda (recipient)
+			       (list "-r"
+				     (epg-sub-key-id
+				      (car (epg-key-sub-key-list recipient)))))
+			     recipients))
 		     (if (epg-data-file plain)
 			 (list (epg-data-file plain)))))
-  (if sign
-      (epg-wait-for-status context '("BEGIN_SIGNING")))
-  (epg-wait-for-status context '("BEGIN_ENCRYPTION"))
+  ;; `gpgsm' does not read passphrase from stdin, so waiting is not needed.
+  (unless (eq (epg-context-protocol context) 'CMS)
+    (if sign
+	(epg-wait-for-status context '("BEGIN_SIGNING"))
+      (epg-wait-for-status context '("BEGIN_ENCRYPTION"))))
   (if (and (epg-data-string plain)
 	   (eq (process-status (epg-context-process context)) 'run))
       (process-send-string (epg-context-process context)
@@ -1152,7 +1329,16 @@ If RECIPIENTS is nil, it performs symmetric encryption."
 				       (epg-make-temp-file "epg-output")))
 	(epg-start-encrypt context (epg-make-data-from-file plain)
 			   recipients sign always-trust)
-	(epg-wait-for-completion context t)
+	(epg-wait-for-completion context)
+	(if sign
+	    (if (epg-context-result-for context 'sign)
+		(if (epg-context-result-for context 'error)
+		    (message "Sign error: %S"
+			     (epg-context-result-for context 'error)))
+	      (if (epg-context-result-for context 'error)
+		  (error "Sign failed: %S"
+			 (epg-context-result-for context 'error))
+		(error "Sign failed"))))
 	(if (epg-context-result-for context 'error)
 	    (error "Encrypt failed: %S"
 		   (epg-context-result-for context 'error)))
@@ -1173,7 +1359,17 @@ If RECIPIENTS is nil, it performs symmetric encryption."
 				     (epg-make-temp-file "epg-output"))
 	(epg-start-encrypt context (epg-make-data-from-string plain)
 			   recipients sign always-trust)
+	(epg-flush context)
 	(epg-wait-for-completion context)
+	(if sign
+	    (if (epg-context-result-for context 'sign)
+		(if (epg-context-result-for context 'error)
+		    (message "Sign error: %S"
+			     (epg-context-result-for context 'error)))
+	      (if (epg-context-result-for context 'error)
+		  (error "Sign failed: %S"
+			 (epg-context-result-for context 'error))
+		(error "Sign failed"))))
 	(if (epg-context-result-for context 'error)
 	    (error "Encrypt failed: %S"
 		   (epg-context-result-for context 'error)))
@@ -1210,7 +1406,8 @@ If you are unsure, use synchronous version of this function
 	(epg-start-export-keys context keys)
 	(epg-wait-for-completion context)
 	(if (epg-context-result-for context 'error)
-	    (error "Export keys failed"))
+	    (error "Export keys failed: %S"
+		   (epg-context-result-for context 'error)))
 	(unless file
 	  (epg-read-output context)))
     (unless file
@@ -1244,9 +1441,12 @@ If you are unsure, use synchronous version of this function
   (unwind-protect
       (progn
 	(epg-start-import-keys context keys)
-	(epg-wait-for-completion context (epg-data-file keys))
+	(if (epg-data-file keys)
+	    (epg-flush context))
+	(epg-wait-for-completion context)
 	(if (epg-context-result-for context 'error)
-	    (error "Import keys failed"))
+	    (error "Import keys failed: %S"
+		   (epg-context-result-for context 'error)))
 	(epg-read-output context))
     (epg-reset context)))
 
@@ -1284,12 +1484,126 @@ If you are unsure, use synchronous version of this function
   "Delete KEYS from the key ring."
   (unwind-protect
       (progn
-	(epg-start-delete-keys context keys)
-	(epg-wait-for-completion context t)
+	(epg-start-delete-keys context keys allow-secret)
+	(epg-wait-for-completion context)
 	(if (epg-context-result-for context 'error)
-	    (error "Delete key failed")))
+	    (error "Delete keys failed: %S"
+		   (epg-context-result-for context 'error))))
     (epg-reset context)))
 
+;;;###autoload
+(defun epg-start-sign-keys (context keys &optional local)
+  "Initiate an sign keys operation.
+
+If you use this function, you will need to wait for the completion of
+`epg-gpg-program' by using `epg-wait-for-completion' and call
+`epg-reset' to clear a temporaly output file.
+If you are unsure, use synchronous version of this function
+`epg-sign-keys' instead."
+  (epg-context-set-result context nil)
+  (epg-start context (cons (if local
+			       "--lsign-key"
+			     "--sign-key")
+			   (mapcar
+			    (lambda (key)
+			      (epg-sub-key-id
+			       (car (epg-key-sub-key-list key))))
+			    keys))))
+
+;;;###autoload
+(defun epg-sign-keys (context keys &optional local)
+  "Sign KEYS from the key ring."
+  (unwind-protect
+      (progn
+	(epg-start-sign-keys context keys local)
+	(epg-wait-for-completion context)
+	(if (epg-context-result-for context 'error)
+	    (error "Sign keys failed: %S"
+		   (epg-context-result-for context 'error))))
+    (epg-reset context)))
+
+(defun epg-decode-hexstring (string)
+  (let ((index 0))
+    (while (eq index (string-match "[0-9A-Fa-f][0-9A-Fa-f]" string index))
+      (setq string (replace-match "\\x\\&" t nil string)
+	    index (+ index 4)))
+    (car (read-from-string (concat "\"" string "\"")))))
+
+(defun epg-decode-quotedstring (string)
+  (let ((index 0))
+    (while (string-match "\\\\\\(\\([,=+<>#;\\\"]\\)\\|\
+\\([0-9A-Fa-f][0-9A-Fa-f]\\)\\|\\(.\\)\\)"
+			 string index)
+      (if (match-beginning 2)
+	  (setq string (replace-match "\\2" t nil string)
+		index (1+ index))
+	(if (match-beginning 3)
+	    (setq string (replace-match "\\x\\3" t nil string)
+		  index (+ index 4))
+	  (setq string (replace-match "\\\\\\\\\\4" t nil string)
+		index (+ index 3)))))
+    (car (read-from-string (concat "\"" string "\"")))))
+
+(defun epg-dn-from-string (string)
+  "Parse STRING as LADPv3 Distinguished Names (RFC2253).
+The return value is an alist mapping from types to values."
+  (let ((index 0)
+	(length (length string))
+	alist type value group)
+    (while (< index length)
+      (if (eq index (string-match "[ \t\n\r]*" string index))
+	  (setq index (match-end 0)))
+      (if (eq index (string-match
+		     "\\([0-9]+\\(\\.[0-9]+\\)*\\)\[ \t\n\r]*=[ \t\n\r]*"
+		     string index))
+	  (setq type (match-string 1 string)
+		index (match-end 0))
+	(if (eq index (string-match "\\([0-9A-Za-z]+\\)[ \t\n\r]*=[ \t\n\r]*"
+				    string index))
+	    (setq type (match-string 1 string)
+		  index (match-end 0))))
+      (unless type
+	(error "Invalid type"))
+      (if (eq index (string-match
+		     "\\([^,=+<>#;\\\"]\\|\\\\.\\)+"
+		     string index))
+	  (setq index (match-end 0)
+		value (epg-decode-quotedstring (match-string 0 string)))
+	(if (eq index (string-match "#\\([0-9A-Fa-f]+\\)" string index))
+	    (setq index (match-end 0)
+		  value (epg-decode-hexstring (match-string 1 string)))
+	  (if (eq index (string-match "\"\\([^\\\"]\\|\\\\.\\)*\""
+				      string index))
+	      (setq index (match-end 0)
+		    value (epg-decode-quotedstring (match-string 0 string))))))
+      (if group
+	  (if (stringp (car (car alist)))
+	      (setcar alist (list (cons type value) (car alist)))
+	    (setcar alist (cons (cons type value) (car alist))))
+	(if (consp (car (car alist)))
+	    (setcar alist (nreverse (car alist))))
+	(setq alist (cons (cons type value) alist)
+	      type nil
+	      value nil))
+      (if (eq index (string-match "[ \t\n\r]*\\([,;+]\\)" string index))
+	  (setq index (match-end 0)
+		group (eq (aref string (match-beginning 1)) ?+))))
+    (nreverse alist)))
+
+(defun epg-decode-dn (alist)
+  "Convert ALIST returned by `epg-dn-from-string' to a human readable form.
+Type names are resolved using `epg-dn-type-alist'."
+  (mapconcat
+   (lambda (rdn)
+     (if (stringp (car rdn))
+	 (let ((entry (assoc (car rdn) epg-dn-type-alist)))
+	   (if entry
+	       (format "%s=%s" (cdr entry) (cdr rdn))
+	     (format "%s=%s" (car rdn) (cdr rdn))))
+       (concat "(" (epg-decode-dn rdn) ")")))
+   alist
+   ", "))
+
 (provide 'epg)
 
 ;;; epg.el ends here