/*
 * Copyright (C) 2005-2007  Justin Karneges <justin@affinix.com>
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
 *
 */

#include <QtCrypto>

#include <QCoreApplication>
#include <QDebug>
#include <QDir>
#include <QFile>
#include <QFileInfo>
#include <QTextStream>
#include <QTimer>

#ifdef QT_STATICPLUGIN
#include "import_plugins.h"
#endif

const char *const APPNAME = "qcatool";
const char *const EXENAME = "qcatool";
const char *const VERSION = QCA_VERSION_STR;

static QStringList wrapstring(const QString &str, int width)
{
    QStringList out;
    QString     simp = str.simplified();
    QString     rest = simp;
    while (true) {
        int lastSpace = -1;
        int n;
        for (n = 0; n < rest.length(); ++n) {
            if (rest[n].isSpace())
                lastSpace = n;
            if (n == width)
                break;
        }
        if (n == rest.length()) {
            out += rest;
            break;
        }

        QString line;
        if (lastSpace != -1) {
            line = rest.mid(0, lastSpace);
            rest = rest.mid(lastSpace + 1);
        } else {
            line = rest.mid(0, n);
            rest = rest.mid(n);
        }
        out += line;
    }
    return out;
}

class StreamLogger : public QCA::AbstractLogDevice
{
    Q_OBJECT
public:
    StreamLogger(QTextStream &stream)
        : QCA::AbstractLogDevice(QStringLiteral("Stream logger"))
        , _stream(stream)
    {
        QCA::logger()->registerLogDevice(this);
    }

    ~StreamLogger() override
    {
        QCA::logger()->unregisterLogDevice(name());
    }

    void logTextMessage(const QString &message, enum QCA::Logger::Severity severity) override
    {
        _stream << now() << " " << severityName(severity) << " " << message << Qt::endl;
    }

    void logBinaryMessage(const QByteArray &blob, enum QCA::Logger::Severity severity) override
    {
        Q_UNUSED(blob);
        _stream << now() << " " << severityName(severity) << " "
                << "Binary blob not implemented yet" << Qt::endl;
    }

private:
    inline const char *severityName(enum QCA::Logger::Severity severity)
    {
        if (severity <= QCA::Logger::Debug) {
            return s_severityNames[severity];
        } else {
            return s_severityNames[QCA::Logger::Debug + 1];
        }
    }

    inline QString now()
    {
        static QString format = QStringLiteral("yyyy-MM-dd hh:mm:ss");
        return QDateTime::currentDateTime().toString(format);
    }

private:
    static const char *s_severityNames[];
    QTextStream       &_stream;
};

const char *StreamLogger::s_severityNames[] = {"Q", "M", "A", "C", "E", "W", "N", "I", "D", "U"};

static void output_plugin_diagnostic_text()
{
    QString str = QCA::pluginDiagnosticText();
    QCA::clearPluginDiagnosticText();
    if (str[str.length() - 1] == QLatin1Char('\n'))
        str.truncate(str.length() - 1);
    const QStringList lines = str.split(QLatin1Char('\n'), Qt::KeepEmptyParts);
    for (int n = 0; n < lines.count(); ++n)
        fprintf(stderr, "plugin: %s\n", qPrintable(lines[n]));
}

static void output_keystore_diagnostic_text()
{
    QString str = QCA::KeyStoreManager::diagnosticText();
    QCA::KeyStoreManager::clearDiagnosticText();
    if (str[str.length() - 1] == QLatin1Char('\n'))
        str.truncate(str.length() - 1);
    const QStringList lines = str.split(QLatin1Char('\n'), Qt::KeepEmptyParts);
    for (int n = 0; n < lines.count(); ++n)
        fprintf(stderr, "keystore: %s\n", qPrintable(lines[n]));
}

static void output_message_diagnostic_text(QCA::SecureMessage *msg)
{
    QString str = msg->diagnosticText();
    if (str[str.length() - 1] == QLatin1Char('\n'))
        str.truncate(str.length() - 1);
    const QStringList lines = str.split(QLatin1Char('\n'), Qt::KeepEmptyParts);
    for (int n = 0; n < lines.count(); ++n)
        fprintf(stderr, "message: %s\n", qPrintable(lines[n]));
}

class AnimatedKeyGen : public QObject
{
    Q_OBJECT
public:
    static QCA::PrivateKey makeKey(QCA::PKey::Type type, int bits, QCA::DLGroupSet set)
    {
        AnimatedKeyGen kg;
        kg.type = type;
        kg.bits = bits;
        kg.set  = set;
        QEventLoop eventLoop;
        kg.eventLoop = &eventLoop;
        QTimer::singleShot(0, &kg, &AnimatedKeyGen::start);
        eventLoop.exec();
        QCA::PrivateKey key = kg.key;
        return key;
    }

private:
    QCA::PKey::Type   type;
    int               bits;
    QCA::DLGroupSet   set;
    QEventLoop       *eventLoop;
    QCA::KeyGenerator gen;
    QCA::DLGroup      group;
    QCA::PrivateKey   key;
    QTimer            t;
    int               x;

    AnimatedKeyGen()
    {
        gen.setBlockingEnabled(false);
        connect(&gen, &QCA::KeyGenerator::finished, this, &AnimatedKeyGen::gen_finished);
        connect(&t, &QTimer::timeout, this, &AnimatedKeyGen::t_timeout);
    }

private Q_SLOTS:
    void start()
    {
        printf("Generating Key ...  ");
        fflush(stdout);
        x = 0;
        t.start(125);

        if (type == QCA::PKey::RSA)
            gen.createRSA(bits);
        else
            gen.createDLGroup(set);
    }

    void gen_finished()
    {
        if (type == QCA::PKey::DSA || type == QCA::PKey::DH) {
            if (group.isNull()) {
                group = gen.dlGroup();

                if (type == QCA::PKey::DSA)
                    gen.createDSA(group);
                else
                    gen.createDH(group);
                return;
            }
        }

        key = gen.key();

        printf("\b");
        if (!key.isNull())
            printf("Done\n");
        else
            printf("Error\n");

        eventLoop->exit();
    }

    void t_timeout()
    {
        if (x == 0)
            printf("\b/");
        else if (x == 1)
            printf("\b-");
        else if (x == 2)
            printf("\b\\");
        else if (x == 3)
            printf("\b|");
        fflush(stdout);

        ++x;
        x %= 4;
    }
};

class KeyStoreMonitor : public QObject
{
    Q_OBJECT
public:
    static void monitor()
    {
        KeyStoreMonitor monitor;
        QEventLoop      eventLoop;
        monitor.eventLoop = &eventLoop;
        QTimer::singleShot(0, &monitor, &KeyStoreMonitor::start);
        eventLoop.exec();
    }

private:
    QEventLoop            *eventLoop;
    QCA::KeyStoreManager  *ksm;
    QList<QCA::KeyStore *> keyStores;
    QCA::ConsolePrompt    *prompt;

private Q_SLOTS:
    void start()
    {
        // user can quit the monitoring by pressing enter
        printf("Monitoring keystores, press 'q' to quit.\n");
        prompt = new QCA::ConsolePrompt(this);
        connect(prompt, &QCA::ConsolePrompt::finished, this, &KeyStoreMonitor::prompt_finished);
        prompt->getChar();

        // kick off the subsystem
        QCA::KeyStoreManager::start();

        // setup keystore manager for monitoring
        ksm = new QCA::KeyStoreManager(this);
        connect(ksm, &QCA::KeyStoreManager::keyStoreAvailable, this, &KeyStoreMonitor::ks_available);
        foreach (const QString &keyStoreId, ksm->keyStores())
            ks_available(keyStoreId);
    }

    void ks_available(const QString &keyStoreId)
    {
        QCA::KeyStore *ks = new QCA::KeyStore(keyStoreId, ksm);
        connect(ks, &QCA::KeyStore::updated, this, &KeyStoreMonitor::ks_updated);
        connect(ks, &QCA::KeyStore::unavailable, this, &KeyStoreMonitor::ks_unavailable);
        keyStores += ks;

        printf("  available:   %s\n", qPrintable(ks->name()));
    }

    void ks_updated()
    {
        QCA::KeyStore *ks = (QCA::KeyStore *)sender();

        printf("  updated:     %s\n", qPrintable(ks->name()));
    }

    void ks_unavailable()
    {
        QCA::KeyStore *ks = (QCA::KeyStore *)sender();

        printf("  unavailable: %s\n", qPrintable(ks->name()));
        keyStores.removeAll(ks);
        delete ks;
    }

    void prompt_finished()
    {
        QChar c = prompt->resultChar();
        if (c == QLatin1Char('q') || c == QLatin1Char('Q')) {
            eventLoop->exit();
            return;
        }
        prompt->getChar();
    }
};

class PassphrasePrompt : public QObject
{
    Q_OBJECT
public:
    class Item
    {
    public:
        QString    promptStr;
        int        id;
        QCA::Event event;
    };

    QCA::EventHandler   handler;
    bool                allowPrompt;
    bool                warned;
    bool                have_pass;
    bool                used_pass;
    QCA::SecureArray    pass;
    QCA::ConsolePrompt *prompt;
    int                 prompt_id;
    QCA::Event          prompt_event;
    QList<Item>         pending;
    bool                auto_accept;

    QCA::KeyStoreManager   ksm;
    QList<QCA::KeyStore *> keyStores;

    PassphrasePrompt()
        : handler(this)
        , ksm(this)
    {
        allowPrompt = true;
        warned      = false;
        have_pass   = false;
        auto_accept = false;

        prompt = nullptr;

        connect(&handler, &QCA::EventHandler::eventReady, this, &PassphrasePrompt::ph_eventReady);
        handler.start();

        connect(&ksm, &QCA::KeyStoreManager::keyStoreAvailable, this, &PassphrasePrompt::ks_available);
        foreach (const QString &keyStoreId, ksm.keyStores())
            ks_available(keyStoreId);
    }

    ~PassphrasePrompt() override
    {
        qDeleteAll(keyStores);

        if (prompt) {
            handler.reject(prompt_id);
            delete prompt;
        }

        while (!pending.isEmpty())
            handler.reject(pending.takeFirst().id);
    }

    void setExplicitPassword(const QCA::SecureArray &_pass)
    {
        have_pass = true;
        used_pass = false;
        pass      = _pass;
    }

private Q_SLOTS:
    void ph_eventReady(int id, const QCA::Event &e)
    {
        if (have_pass) {
            // only allow using an explicit passphrase once
            if (used_pass) {
                handler.reject(id);
                return;
            }
            used_pass = true;
            handler.submitPassword(id, pass);
            return;
        }

        if (!allowPrompt) {
            if (!have_pass && !warned) {
                warned = true;
                fprintf(stderr, "Error: no passphrase specified (use '--pass=' for none).\n");
            }

            handler.reject(id);
            return;
        }

        if (e.type() == QCA::Event::Password) {
            QString type = QStringLiteral("password");
            if (e.passwordStyle() == QCA::Event::StylePassphrase)
                type = QStringLiteral("passphrase");
            else if (e.passwordStyle() == QCA::Event::StylePIN)
                type = QStringLiteral("PIN");

            QString str;
            if (e.source() == QCA::Event::KeyStore) {
                QString            name;
                QCA::KeyStoreEntry entry = e.keyStoreEntry();
                if (!entry.isNull()) {
                    name = entry.name();
                } else {
                    if (e.keyStoreInfo().type() == QCA::KeyStore::SmartCard)
                        name = QStringLiteral("the '") + e.keyStoreInfo().name() + QStringLiteral("' token");
                    else
                        name = e.keyStoreInfo().name();
                }
                str = QStringLiteral("Enter %1 for %2").arg(type, name);
            } else if (!e.fileName().isEmpty())
                str = QStringLiteral("Enter %1 for %2").arg(type, e.fileName());
            else
                str = QStringLiteral("Enter %1").arg(type);

            if (!prompt) {
                prompt = new QCA::ConsolePrompt(this);
                connect(prompt, &QCA::ConsolePrompt::finished, this, &PassphrasePrompt::prompt_finished);
                prompt_id    = id;
                prompt_event = e;
                prompt->getHidden(str);
            } else {
                Item i;
                i.promptStr = str;
                i.id        = id;
                i.event     = e;
                pending += i;
            }
        } else if (e.type() == QCA::Event::Token) {
            // even though we're being prompted for a missing token,
            //   we should still check if the token is present, due to
            //   a possible race between insert and token request.
            bool found = false;

            // token-only
            if (e.keyStoreEntry().isNull()) {
                foreach (QCA::KeyStore *ks, keyStores) {
                    if (ks->id() == e.keyStoreInfo().id()) {
                        found = true;
                        break;
                    }
                }
            }
            // token-entry
            else {
                QCA::KeyStoreEntry kse = e.keyStoreEntry();

                QCA::KeyStore *ks = nullptr;
                foreach (QCA::KeyStore *i, keyStores) {
                    if (i->id() == e.keyStoreInfo().id()) {
                        ks = i;
                        break;
                    }
                }
                if (ks) {
                    QList<QCA::KeyStoreEntry> list = ks->entryList();
                    foreach (const QCA::KeyStoreEntry &e, list) {
                        if (e.id() == kse.id() && kse.isAvailable()) {
                            found = true;
                            break;
                        }
                    }
                }
            }
            if (found) {
                // auto-accept
                handler.tokenOkay(id);
                return;
            }

            QCA::KeyStoreEntry entry = e.keyStoreEntry();
            QString            name;
            if (!entry.isNull()) {
                name = QStringLiteral("Please make ") + entry.name() + QStringLiteral(" (of ") + entry.storeName() +
                    QStringLiteral(") available");
            } else {
                name = QStringLiteral("Please insert the '") + e.keyStoreInfo().name() + QStringLiteral("' token");
            }

            QString str = QStringLiteral("%1 and press Enter (or 'q' to cancel) ...").arg(name);

            if (!prompt) {
                fprintf(stderr, "%s\n", qPrintable(str));
                prompt = new QCA::ConsolePrompt(this);
                connect(prompt, &QCA::ConsolePrompt::finished, this, &PassphrasePrompt::prompt_finished);
                prompt_id    = id;
                prompt_event = e;
                prompt->getChar();
            } else {
                Item i;
                i.promptStr = str;
                i.id        = id;
                i.event     = e;
                pending += i;
            }
        } else
            handler.reject(id);
    }

    void prompt_finished()
    {
        if (prompt_event.type() == QCA::Event::Password) {
            handler.submitPassword(prompt_id, prompt->result());
        } else {
            if (auto_accept) {
                auto_accept = false;
                handler.tokenOkay(prompt_id);
            } else {
                QChar c = prompt->resultChar();
                if (c == QLatin1Char('\r') || c == QLatin1Char('\n'))
                    handler.tokenOkay(prompt_id);
                else if (c == QLatin1Char('q') || c == QLatin1Char('Q'))
                    handler.reject(prompt_id);
                else {
                    // retry
                    prompt->getChar();
                    return;
                }
            }
        }

        if (!pending.isEmpty()) {
            Item i       = pending.takeFirst();
            prompt_id    = i.id;
            prompt_event = i.event;
            if (i.event.type() == QCA::Event::Password) {
                prompt->getHidden(i.promptStr);
            } else // Token
            {
                fprintf(stderr, "%s\n", qPrintable(i.promptStr));
                prompt->getChar();
            }
        } else {
            delete prompt;
            prompt = nullptr;
        }
    }

    void ks_available(const QString &keyStoreId)
    {
        QCA::KeyStore *ks = new QCA::KeyStore(keyStoreId, &ksm);
        connect(ks, &QCA::KeyStore::updated, this, &PassphrasePrompt::ks_updated);
        connect(ks, &QCA::KeyStore::unavailable, this, &PassphrasePrompt::ks_unavailable);
        keyStores += ks;
        ks->startAsynchronousMode();

        // are we currently in a token-only prompt?
        if (prompt && prompt_event.type() == QCA::Event::Token && prompt_event.keyStoreEntry().isNull()) {
            // was the token we're looking for just inserted?
            if (prompt_event.keyStoreInfo().id() == keyStoreId) {
                fprintf(stderr, "Token inserted!  Continuing...\n");

                // auto-accept
                auto_accept = true;
                prompt_finished();
            }
        }
    }

    void ks_unavailable()
    {
        QCA::KeyStore *ks = (QCA::KeyStore *)sender();
        keyStores.removeAll(ks);
        delete ks;
    }

    void ks_updated()
    {
        QCA::KeyStore *ks = (QCA::KeyStore *)sender();

        // are we currently in a token-entry prompt?
        if (prompt && prompt_event.type() == QCA::Event::Token && !prompt_event.keyStoreEntry().isNull()) {
            QCA::KeyStoreEntry kse = prompt_event.keyStoreEntry();

            // was the token of the entry we're looking for updated?
            if (prompt_event.keyStoreInfo().id() == ks->id()) {
                // is the entry available?
                bool                      avail = false;
                QList<QCA::KeyStoreEntry> list  = ks->entryList();
                foreach (const QCA::KeyStoreEntry &e, list) {
                    if (e.id() == kse.id()) {
                        avail = kse.isAvailable();
                        break;
                    }
                }
                if (avail) {
                    fprintf(stderr, "Entry available!  Continuing...\n");

                    // auto-accept
                    auto_accept = true;
                    prompt_finished();
                }
            }
        }
    }
};

class PassphrasePromptThread : public QCA::SyncThread
{
    Q_OBJECT
public:
    PassphrasePrompt *pp;

    PassphrasePromptThread()
    {
        start();
    }

    ~PassphrasePromptThread() override
    {
        stop();
    }

protected:
    void atStart() override
    {
        pp = new PassphrasePrompt;
    }

    void atEnd() override
    {
        delete pp;
    }
};

static bool promptForNewPassphrase(QCA::SecureArray *result)
{
    QCA::ConsolePrompt prompt;
    prompt.getHidden(QStringLiteral("Enter new passphrase"));
    prompt.waitForFinished();
    QCA::SecureArray out = prompt.result();

    prompt.getHidden(QStringLiteral("Confirm new passphrase"));
    prompt.waitForFinished();

    if (prompt.result() != out) {
        fprintf(stderr, "Error: confirmation does not match original entry.\n");
        return false;
    }
    *result = out;
    return true;
}

static void ksm_start_and_wait()
{
    // activate the KeyStoreManager and block until ready
    QCA::KeyStoreManager::start();
    {
        QCA::KeyStoreManager ksm;
        ksm.waitForBusyFinished();
    }
}

static QString line_encode(const QString &in)
{
    QString out;
    for (const QChar &c : in) {
        if (c == QLatin1Char('\\'))
            out += QStringLiteral("\\\\");
        else if (c == QLatin1Char('\n'))
            out += QStringLiteral("\\n");
        else
            out += c;
    }
    return out;
}

static QString line_decode(const QString &in)
{
    QString out;
    for (int n = 0; n < in.length(); ++n) {
        if (in[n] == QLatin1Char('\\')) {
            if (n + 1 < in.length()) {
                if (in[n + 1] == QLatin1Char('\\'))
                    out += QLatin1Char('\\');
                else if (in[n + 1] == QLatin1Char('n'))
                    out += QLatin1Char('\n');
                ++n;
            }
        } else
            out += in[n];
    }
    return out;
}

static QString make_ksentry_string(const QString &id)
{
    QString out;
    out += QStringLiteral("QCATOOL_KEYSTOREENTRY_1\n");
    out += line_encode(id) + QLatin1Char('\n');
    return out;
}

/*static bool write_ksentry_file(const QString &id, const QString &fileName)
{
    QFile f(fileName);
    if(!f.open(QFile::WriteOnly | QFile::Truncate))
        return false;
    f.write(make_ksentry_string(id).toUtf8());
    return true;
}*/

static QString read_ksentry_file(const QString &fileName)
{
    QString out;

    QFile f(fileName);
    if (!f.open(QFile::ReadOnly))
        return out;
    QTextStream ts(&f);
    int         linenum = 0;
    while (!ts.atEnd()) {
        QString line = ts.readLine();
        if (linenum == 0) {
            if (line != QLatin1String("QCATOOL_KEYSTOREENTRY_1"))
                return out;
        } else {
            out = line_decode(line);
            break;
        }
        ++linenum;
    }
    return out;
}

static bool is_pem_file(const QString &fileName)
{
    QFile f(fileName);
    if (!f.open(QFile::ReadOnly))
        return false;
    QTextStream ts(&f);
    if (!ts.atEnd()) {
        QString line = ts.readLine();
        if (line.startsWith(QLatin1String("-----BEGIN")))
            return true;
    }
    return false;
}

static QByteArray read_der_file(const QString &fileName)
{
    QFile f(fileName);
    if (!f.open(QFile::ReadOnly))
        return QByteArray();
    return f.readAll();
}

class InfoType
{
public:
    QCA::CertificateInfoType type;
    QString                  varname;
    QString                  shortname;
    QString                  name;
    QString                  desc;

    InfoType()
    {
    }

    InfoType(const QCA::CertificateInfoType &_type,
             const QString                  &_varname,
             const QString                  &_shortname,
             const QString                  &_name,
             const QString                  &_desc)
        : type(_type)
        , varname(_varname)
        , shortname(_shortname)
        , name(_name)
        , desc(_desc)
    {
    }
};

static QList<InfoType> makeInfoTypeList(bool legacyEmail = false)
{
    QList<InfoType> out;
    out += InfoType(QCA::CommonName,
                    QStringLiteral("CommonName"),
                    QStringLiteral("CN"),
                    QStringLiteral("Common Name (CN)"),
                    QStringLiteral("Full name, domain, anything"));
    out += InfoType(
        QCA::Email, QStringLiteral("Email"), QLatin1String(""), QStringLiteral("Email Address"), QLatin1String(""));
    if (legacyEmail)
        out += InfoType(QCA::EmailLegacy,
                        QStringLiteral("EmailLegacy"),
                        QLatin1String(""),
                        QStringLiteral("PKCS#9 Email Address"),
                        QLatin1String(""));
    out += InfoType(QCA::Organization,
                    QStringLiteral("Organization"),
                    QStringLiteral("O"),
                    QStringLiteral("Organization (O)"),
                    QStringLiteral("Company, group, etc"));
    out += InfoType(QCA::OrganizationalUnit,
                    QStringLiteral("OrganizationalUnit"),
                    QStringLiteral("OU"),
                    QStringLiteral("Organizational Unit (OU)"),
                    QStringLiteral("Division/branch of organization"));
    out += InfoType(QCA::Locality,
                    QStringLiteral("Locality"),
                    QLatin1String(""),
                    QStringLiteral("Locality (L)"),
                    QStringLiteral("City, shire, part of a state"));
    out += InfoType(QCA::State,
                    QStringLiteral("State"),
                    QLatin1String(""),
                    QStringLiteral("State (ST)"),
                    QStringLiteral("State within the country"));
    out += InfoType(QCA::Country,
                    QStringLiteral("Country"),
                    QStringLiteral("C"),
                    QStringLiteral("Country Code (C)"),
                    QStringLiteral("2-letter code"));
    out += InfoType(QCA::IncorporationLocality,
                    QStringLiteral("IncorporationLocality"),
                    QLatin1String(""),
                    QStringLiteral("Incorporation Locality"),
                    QStringLiteral("For EV certificates"));
    out += InfoType(QCA::IncorporationState,
                    QStringLiteral("IncorporationState"),
                    QLatin1String(""),
                    QStringLiteral("Incorporation State"),
                    QStringLiteral("For EV certificates"));
    out += InfoType(QCA::IncorporationCountry,
                    QStringLiteral("IncorporationCountry"),
                    QLatin1String(""),
                    QStringLiteral("Incorporation Country"),
                    QStringLiteral("For EV certificates"));
    out += InfoType(QCA::URI, QStringLiteral("URI"), QLatin1String(""), QStringLiteral("URI"), QLatin1String(""));
    out += InfoType(QCA::DNS,
                    QStringLiteral("DNS"),
                    QLatin1String(""),
                    QStringLiteral("Domain Name"),
                    QStringLiteral("Domain (dnsName)"));
    out += InfoType(QCA::IPAddress,
                    QStringLiteral("IPAddress"),
                    QLatin1String(""),
                    QStringLiteral("IP Adddress"),
                    QLatin1String(""));
    out += InfoType(QCA::XMPP,
                    QStringLiteral("XMPP"),
                    QLatin1String(""),
                    QStringLiteral("XMPP Address (JID)"),
                    QStringLiteral("From RFC 3920 (id-on-xmppAddr)"));
    return out;
}

class MyConstraintType
{
public:
    QCA::ConstraintType type;
    QString             varname;
    QString             name;
    QString             desc;

    MyConstraintType()
    {
    }

    MyConstraintType(const QCA::ConstraintType &_type,
                     const QString             &_varname,
                     const QString             &_name,
                     const QString             &_desc)
        : type(_type)
        , varname(_varname)
        , name(_name)
        , desc(_desc)
    {
    }
};

static QList<MyConstraintType> makeConstraintTypeList()
{
    QList<MyConstraintType> out;
    out += MyConstraintType(QCA::DigitalSignature,
                            QStringLiteral("DigitalSignature"),
                            QStringLiteral("Digital Signature"),
                            QStringLiteral("Can be used for signing"));
    out += MyConstraintType(QCA::NonRepudiation,
                            QStringLiteral("NonRepudiation"),
                            QStringLiteral("Non-Repudiation"),
                            QStringLiteral("Usage is legally binding"));
    out += MyConstraintType(QCA::KeyEncipherment,
                            QStringLiteral("KeyEncipherment"),
                            QStringLiteral("Key Encipherment"),
                            QStringLiteral("Can encrypt other keys"));
    out += MyConstraintType(QCA::DataEncipherment,
                            QStringLiteral("DataEncipherment"),
                            QStringLiteral("Data Encipherment"),
                            QStringLiteral("Can encrypt arbitrary data"));
    out += MyConstraintType(QCA::KeyAgreement,
                            QStringLiteral("KeyAgreement"),
                            QStringLiteral("Key Agreement"),
                            QStringLiteral("Can perform key agreement (DH)"));
    out += MyConstraintType(QCA::KeyCertificateSign,
                            QStringLiteral("KeyCertificateSign"),
                            QStringLiteral("Certificate Sign"),
                            QStringLiteral("Can sign other certificates"));
    out += MyConstraintType(
        QCA::CRLSign, QStringLiteral("CRLSign"), QStringLiteral("CRL Sign"), QStringLiteral("Can sign CRLs"));
    out += MyConstraintType(QCA::EncipherOnly,
                            QStringLiteral("EncipherOnly"),
                            QStringLiteral("Encipher Only"),
                            QStringLiteral("Can be used for encrypting"));
    out += MyConstraintType(QCA::DecipherOnly,
                            QStringLiteral("DecipherOnly"),
                            QStringLiteral("Decipher Only"),
                            QStringLiteral("Can be used for decrypting"));
    out += MyConstraintType(QCA::ServerAuth,
                            QStringLiteral("ServerAuth"),
                            QStringLiteral("Server Authentication"),
                            QStringLiteral("TLS Server"));
    out += MyConstraintType(QCA::ClientAuth,
                            QStringLiteral("ClientAuth"),
                            QStringLiteral("Client Authentication"),
                            QStringLiteral("TLS Client"));
    out += MyConstraintType(
        QCA::CodeSigning, QStringLiteral("CodeSigning"), QStringLiteral("Code Signing"), QLatin1String(""));
    out += MyConstraintType(QCA::EmailProtection,
                            QStringLiteral("EmailProtection"),
                            QStringLiteral("Email Protection"),
                            QStringLiteral("S/MIME"));
    out += MyConstraintType(
        QCA::IPSecEndSystem, QStringLiteral("IPSecEndSystem"), QStringLiteral("IPSec End-System"), QLatin1String(""));
    out += MyConstraintType(
        QCA::IPSecTunnel, QStringLiteral("IPSecTunnel"), QStringLiteral("IPSec Tunnel"), QLatin1String(""));
    out +=
        MyConstraintType(QCA::IPSecUser, QStringLiteral("IPSecUser"), QStringLiteral("IPSec User"), QLatin1String(""));
    out += MyConstraintType(
        QCA::TimeStamping, QStringLiteral("TimeStamping"), QStringLiteral("Time Stamping"), QLatin1String(""));
    out += MyConstraintType(
        QCA::OCSPSigning, QStringLiteral("OCSPSigning"), QStringLiteral("OCSP Signing"), QLatin1String(""));
    return out;
}

const char *crlEntryReasonToString(QCA::CRLEntry::Reason r)
{
    switch (r) {
    case QCA::CRLEntry::Unspecified:
        return "Unspecified";
    case QCA::CRLEntry::KeyCompromise:
        return "KeyCompromise";
    case QCA::CRLEntry::CACompromise:
        return "CACompromise";
    case QCA::CRLEntry::AffiliationChanged:
        return "AffiliationChanged";
    case QCA::CRLEntry::Superseded:
        return "Superseded";
    case QCA::CRLEntry::CessationOfOperation:
        return "CessationOfOperation";
    case QCA::CRLEntry::CertificateHold:
        return "CertificateHold";
    case QCA::CRLEntry::RemoveFromCRL:
        return "RemoveFromCRL";
    case QCA::CRLEntry::PrivilegeWithdrawn:
        return "PrivilegeWithdrawn";
    case QCA::CRLEntry::AACompromise:
        return "AACompromise";
    default:
        return "Unknown";
    }
}

static bool validOid(const QString &in)
{
    for (const QChar &c : in) {
        if (!c.isDigit() && c != QLatin1Char('.'))
            return false;
    }
    return true;
}

class ValidityLength
{
public:
    int years, months, days;
};

static int vl_getnext(const QString &in, int offset = 0)
{
    if (offset >= in.length())
        return in.length();

    int  n = offset;
    bool lookForNonDigit;

    if (in[n].isDigit())
        lookForNonDigit = true;
    else
        lookForNonDigit = false;

    for (++n; n < in.length(); ++n) {
        if (in[n].isDigit() != lookForNonDigit)
            break;
    }
    return n;
}

static QStringList vl_getparts(const QString &in)
{
    QStringList out;
    int         offset = 0;
    while (true) {
        int n = vl_getnext(in, offset);
        if (n == offset)
            break;
        out += in.mid(offset, n - offset);
        offset = n;
    }
    return out;
}

static bool parseValidityLength(const QString &in, ValidityLength *vl)
{
    vl->years  = -1;
    vl->months = -1;
    vl->days   = -1;

    QStringList parts = vl_getparts(in);
    while (true) {
        // first part should be a number
        if (parts.count() < 1)
            break;
        QString str = parts.takeFirst();
        bool    ok;
        int     x = str.toInt(&ok);
        if (!ok)
            return false;

        // next part should be 1 letter plus any amount of space
        if (parts.count() < 1)
            return false;
        str = parts.takeFirst();
        if (!str[0].isLetter())
            return false;
        str = str.trimmed(); // remove space

        if (str == QLatin1String("y")) {
            if (vl->years != -1)
                return false;
            vl->years = x;
        }
        if (str == QLatin1String("m")) {
            if (vl->months != -1)
                return false;
            vl->months = x;
        }
        if (str == QLatin1String("d")) {
            if (vl->days != -1)
                return false;
            vl->days = x;
        }
    }

    if (vl->years == -1)
        vl->years = 0;
    if (vl->months == -1)
        vl->months = 0;
    if (vl->days == -1)
        vl->days = 0;

    return true;
}

static QString prompt_for(const QString &prompt)
{
    printf("%s: ", prompt.toLatin1().data());
    fflush(stdout);
    QByteArray result(256, 0);
    if (fgets((char *)result.data(), result.size(), stdin))
        return QString::fromLocal8Bit(result).trimmed();
    else
        return QString();
}

static QCA::CertificateOptions promptForCertAttributes(bool advanced, bool req)
{
    QCA::CertificateOptions opts;

    if (advanced) {
        if (!req) {
            while (true) {
                QString str = prompt_for(
                    QStringLiteral("Create an end user ('user') certificate or a CA ('ca') certificate? [user]"));
                if (str.isEmpty())
                    str = QStringLiteral("user");
                if (str != QLatin1String("user") && str != QLatin1String("ca")) {
                    printf("'%s' is not a valid entry.\n", qPrintable(str));
                    continue;
                }

                if (str == QLatin1String("ca"))
                    opts.setAsCA();
                break;
            }
            printf("\n");

            while (true) {
                QString         str = prompt_for(QStringLiteral("Serial Number"));
                QCA::BigInteger num;
                if (str.isEmpty() || !num.fromString(str)) {
                    printf("'%s' is not a valid entry.\n", qPrintable(str));
                    continue;
                }

                opts.setSerialNumber(num);
                break;
            }
            printf("\n");
        }

        {
            QCA::CertificateInfoOrdered info;
            printf(
                "Choose the information attributes to add to the certificate.  They will be\n"
                "added in the order they are entered.\n\n");
            printf("Available information attributes:\n");
            QList<InfoType> list = makeInfoTypeList();
            for (int n = 0; n < list.count(); ++n) {
                const InfoType &i = list[n];
                char            c = 'a' + n;
                printf("  %c) %-32s        %s\n", c, qPrintable(i.name), qPrintable(i.desc));
            }
            printf("\n");
            while (true) {
                int index;
                while (true) {
                    QString str = prompt_for(QStringLiteral("Select an attribute to add, or enter to move on"));
                    if (str.isEmpty()) {
                        index = -1;
                        break;
                    }
                    if (str.length() == 1) {
                        index = str[0].toLatin1() - 'a';
                        if (index >= 0 && index < list.count())
                            break;
                    }
                    printf("'%s' is not a valid entry.\n", qPrintable(str));
                }
                if (index == -1)
                    break;

                QString val = prompt_for(list[index].name);
                info += QCA::CertificateInfoPair(list[index].type, val);
                printf("Added attribute.\n\n");
            }
            opts.setInfoOrdered(info);
        }

        {
            QCA::Constraints constraints;
            printf("\n");
            printf("Choose the constraint attributes to add to the certificate.\n\n");
            printf("Available attributes:\n");
            QList<MyConstraintType> list = makeConstraintTypeList();
            for (int n = 0; n < list.count(); ++n) {
                const MyConstraintType &i = list[n];
                char                    c = 'a' + n;
                printf("  %c) %-32s        %s\n", c, qPrintable(i.name), qPrintable(i.desc));
            }
            printf("\n");
            printf("If no constraints are added, then the certificate may be used for any purpose.\n\n");
            while (true) {
                int index;
                while (true) {
                    QString str = prompt_for(QStringLiteral("Select an attribute to add, or enter to move on"));
                    if (str.isEmpty()) {
                        index = -1;
                        break;
                    }
                    if (str.length() == 1) {
                        index = str[0].toLatin1() - 'a';
                        if (index >= 0 && index < list.count())
                            break;
                    }
                    printf("'%s' is not a valid entry.\n\n", qPrintable(str));
                }
                if (index == -1)
                    break;

                if (constraints.contains(list[index].type)) {
                    printf("You have already added '%s'.\n\n", qPrintable(list[index].name));
                    continue;
                }

                constraints += list[index].type;
                printf("Added attribute.\n\n");
            }
            opts.setConstraints(constraints);
        }

        {
            QStringList policies;
            printf("\n");
            printf(
                "Are there any policy OID attributes that you wish to add?  Use the dotted\n"
                "string format.\n\n");
            while (true) {
                QString str = prompt_for(QStringLiteral("Enter a policy OID to add, or enter to move on"));
                if (str.isEmpty())
                    break;
                if (!validOid(str)) {
                    printf("'%s' is not a valid entry.\n\n", qPrintable(str));
                    continue;
                }
                if (policies.contains(str)) {
                    printf("You have already added '%s'.\n\n", qPrintable(str));
                    continue;
                }

                policies += str;
                printf("Added attribute.\n\n");
            }
            opts.setPolicies(policies);
        }

        printf("\n");
    } else {
        QCA::CertificateInfo info;
        info.insert(QCA::CommonName, prompt_for(QStringLiteral("Common Name")));
        info.insert(QCA::Country, prompt_for(QStringLiteral("Country Code (2 letters)")));
        info.insert(QCA::Organization, prompt_for(QStringLiteral("Organization")));
        info.insert(QCA::Email, prompt_for(QStringLiteral("Email")));
        opts.setInfo(info);

        printf("\n");
    }

    if (!req) {
        while (true) {
            QString str = prompt_for(QStringLiteral("How long should the certificate be valid? (e.g. '1y2m3d')"));
            ValidityLength vl;
            if (!parseValidityLength(str, &vl)) {
                printf("'%s' is not a valid entry.\n\n", qPrintable(str));
                continue;
            }

            if (vl.years == 0 && vl.months == 0 && vl.days == 0) {
                printf("The certificate must be valid for at least one day.\n\n");
                continue;
            }

            QDateTime start = QDateTime::currentDateTimeUtc();
            QDateTime end   = start;
            if (vl.years > 0)
                end = end.addYears(vl.years);
            if (vl.months > 0)
                end = end.addMonths(vl.months);
            if (vl.days > 0)
                end = end.addDays(vl.days);
            opts.setValidityPeriod(start, end);

            QStringList parts;
            if (vl.years > 0)
                parts += QStringLiteral("%1 year(s)").arg(vl.years);
            if (vl.months > 0)
                parts += QStringLiteral("%1 month(s)").arg(vl.months);
            if (vl.days > 0)
                parts += QStringLiteral("%1 day(s)").arg(vl.days);
            QString out;
            if (parts.count() == 1)
                out = parts[0];
            else if (parts.count() == 2)
                out = parts[0] + QStringLiteral(" and ") + parts[1];
            else if (parts.count() == 3)
                out = parts[0] + QStringLiteral(", ") + parts[1] + QStringLiteral(", and ") + parts[2];
            printf("Certificate will be valid for %s.\n", qPrintable(out));
            break;
        }
        printf("\n");
    }

    return opts;
}

// qsettings seems to give us a string type for both bool and int (and
//   possibly others, but those are the only two we care about here).
//   in order to figure out what is actually a bool or an int, we need
//   to examine the string.  so for the functions below, we convert
//   the variant to a string, and then inspect it to see if it looks
//   like a bool or an int.

static bool string_is_bool(const QString &in)
{
    QString lc = in.toLower();
    if (lc == QLatin1String("true") || lc == QLatin1String("false"))
        return true;
    return false;
}

static bool string_is_int(const QString &in)
{
    bool ok;
    in.toInt(&ok);
    return ok;
}

static bool variant_is_bool(const QVariant &in)
{
    if (in.canConvert<QString>() && string_is_bool(in.toString()))
        return true;
    return false;
}

static bool variant_is_int(const QVariant &in)
{
    if (in.canConvert<QString>() && string_is_int(in.toString()))
        return true;
    return false;
}

static QString prompt_for_string(const QString &prompt, const QString &def = QString())
{
    printf("%s", prompt.toLatin1().data());
    fflush(stdout);
    QByteArray result(256, 0);
    if (!fgets((char *)result.data(), result.size(), stdin))
        return QString();
    if (result[result.length() - 1] == '\n')
        result.truncate(result.length() - 1);
    // empty input -> use default
    if (result.isEmpty())
        return def;
    // trimmed input could result in an empty value, but in that case
    //   it is treated as if the user wishes to submit an empty value.
    return QString::fromLocal8Bit(result).trimmed();
}

static int prompt_for_int(const QString &prompt, int def = 0)
{
    while (true) {
        QString str = prompt_for_string(prompt);
        if (str.isEmpty())
            return def;
        bool ok;
        int  x = str.toInt(&ok);
        if (ok)
            return x;
        printf("'%s' is not a valid entry.\n\n", qPrintable(str));
    }
}

static bool partial_compare_nocase(const QString &in, const QString &target, int min = 1)
{
    if (in.length() >= min && in.length() <= target.length() && target.mid(0, in.length()).toLower() == in.toLower())
        return true;
    return false;
}

static bool prompt_for_bool(const QString &prompt, bool def = false)
{
    while (true) {
        QString str = prompt_for_string(prompt);
        if (str.isEmpty())
            return def;
        if (partial_compare_nocase(str, QStringLiteral("true")))
            return true;
        else if (partial_compare_nocase(str, QStringLiteral("false")))
            return false;
        printf("'%s' is not a valid entry.\n\n", qPrintable(str));
    }
}

static bool prompt_for_yesno(const QString &prompt, bool def = false)
{
    while (true) {
        QString str = prompt_for_string(prompt);
        if (str.isEmpty())
            return def;
        if (partial_compare_nocase(str, QStringLiteral("yes")))
            return true;
        else if (partial_compare_nocase(str, QStringLiteral("no")))
            return false;
        printf("'%s' is not a valid entry.\n\n", qPrintable(str));
    }
}

static QString prompt_for_slotevent_method(const QString &prompt, const QString &def = QString())
{
    while (true) {
        QString str = prompt_for_string(prompt);
        if (str.isEmpty())
            return def;
        if (partial_compare_nocase(str, QStringLiteral("auto")))
            return QStringLiteral("auto");
        else if (partial_compare_nocase(str, QStringLiteral("trigger")))
            return QStringLiteral("trigger");
        else if (partial_compare_nocase(str, QStringLiteral("poll")))
            return QStringLiteral("poll");
        printf("'%s' is not a valid entry.\n\n", qPrintable(str));
    }
}

static QVariantMap provider_config_edit_generic(const QVariantMap &in)
{
    QVariantMap                            config = in;
    QMutableMapIterator<QString, QVariant> it(config);
    while (it.hasNext()) {
        it.next();
        QString var = it.key();
        if (var == QLatin1String("formtype"))
            continue;
        QVariant val = it.value();

        // fields must be bool, int, or string
        QVariant newval;
        QString  prompt = QStringLiteral("%1: [%2] ").arg(var, val.toString());
        if (variant_is_bool(val))
            newval = prompt_for_bool(QStringLiteral("bool   ") + prompt, val.toBool());
        else if (variant_is_int(val))
            newval = prompt_for_int(QStringLiteral("int    ") + prompt, val.toInt());
        else if (val.canConvert<QString>())
            newval = prompt_for_string(QStringLiteral("string ") + prompt, val.toString());
        else
            continue; // skip bogus fields

        it.setValue(newval);
    }

    return config;
}

class Pkcs11ProviderConfig
{
public:
    bool    allow_protected_authentication;
    bool    cert_private;
    bool    enabled;
    QString library;
    QString name;
    int     private_mask;
    QString slotevent_method;
    int     slotevent_timeout;

    Pkcs11ProviderConfig()
        : allow_protected_authentication(true)
        , cert_private(false)
        , enabled(false)
        , private_mask(0)
        , slotevent_method(QStringLiteral("auto"))
        , slotevent_timeout(0)
    {
    }

    QVariantMap toVariantMap() const
    {
        QVariantMap out;
        out[QStringLiteral("allow_protected_authentication")] = allow_protected_authentication;
        out[QStringLiteral("cert_private")]                   = cert_private;
        out[QStringLiteral("enabled")]                        = enabled;
        out[QStringLiteral("library")]                        = library;
        out[QStringLiteral("name")]                           = name;
        out[QStringLiteral("private_mask")]                   = private_mask;
        out[QStringLiteral("slotevent_method")]               = slotevent_method;
        out[QStringLiteral("slotevent_timeout")]              = slotevent_timeout;
        return out;
    }

    bool fromVariantMap(const QVariantMap &in)
    {
        allow_protected_authentication = in[QStringLiteral("allow_protected_authentication")].toBool();
        cert_private                   = in[QStringLiteral("cert_private")].toBool();
        enabled                        = in[QStringLiteral("enabled")].toBool();
        library                        = in[QStringLiteral("library")].toString();
        name                           = in[QStringLiteral("name")].toString();
        private_mask                   = in[QStringLiteral("private_mask")].toInt();
        slotevent_method               = in[QStringLiteral("slotevent_method")].toString();
        slotevent_timeout              = in[QStringLiteral("slotevent_timeout")].toInt();
        return true;
    }
};

class Pkcs11Config
{
public:
    bool                        allow_load_rootca;
    bool                        allow_protected_authentication;
    int                         log_level;
    int                         pin_cache;
    QList<Pkcs11ProviderConfig> providers;

    QVariantMap orig_config;

    Pkcs11Config()
        : allow_load_rootca(false)
        , allow_protected_authentication(true)
        , log_level(0)
        , pin_cache(-1)
    {
    }

    QVariantMap toVariantMap() const
    {
        QVariantMap out = orig_config;

        // form type
        out[QStringLiteral("formtype")] = QLatin1String("http://affinix.com/qca/forms/qca-pkcs11#1.0");

        // base settings
        out[QStringLiteral("allow_load_rootca")]              = allow_load_rootca;
        out[QStringLiteral("allow_protected_authentication")] = allow_protected_authentication;
        out[QStringLiteral("log_level")]                      = log_level;
        out[QStringLiteral("pin_cache")]                      = pin_cache;

        // provider settings (always write at least 10 providers)
        for (int n = 0; n < 10 || n < providers.count(); ++n) {
            QString prefix = QString::asprintf("provider_%02d_", n);

            Pkcs11ProviderConfig provider;
            if (n < providers.count())
                provider = providers[n];

            QVariantMap                     subconfig = provider.toVariantMap();
            QMapIterator<QString, QVariant> it(subconfig);
            while (it.hasNext()) {
                it.next();
                out.insert(prefix + it.key(), it.value());
            }
        }

        return out;
    }

    bool fromVariantMap(const QVariantMap &in)
    {
        if (in[QStringLiteral("formtype")] != QLatin1String("http://affinix.com/qca/forms/qca-pkcs11#1.0"))
            return false;

        allow_load_rootca              = in[QStringLiteral("allow_load_rootca")].toBool();
        allow_protected_authentication = in[QStringLiteral("allow_protected_authentication")].toBool();
        log_level                      = in[QStringLiteral("log_level")].toInt();
        pin_cache                      = in[QStringLiteral("pin_cache")].toInt();

        for (int n = 0;; ++n) {
            QString prefix = QString::asprintf("provider_%02d_", n);

            // collect all key/values with this prefix into a
            //   a separate container, leaving out the prefix
            //   from the keys.
            QVariantMap                     subconfig;
            QMapIterator<QString, QVariant> it(in);
            while (it.hasNext()) {
                it.next();
                if (it.key().startsWith(prefix))
                    subconfig.insert(it.key().mid(prefix.length()), it.value());
            }

            // if there are no config items with this prefix, we're done
            if (subconfig.isEmpty())
                break;

            Pkcs11ProviderConfig provider;
            if (!provider.fromVariantMap(subconfig))
                return false;

            // skip unnamed entries
            if (provider.name.isEmpty())
                continue;

            // skip duplicate entries
            bool have_name_already = false;
            foreach (const Pkcs11ProviderConfig &i, providers) {
                if (i.name == provider.name) {
                    have_name_already = true;
                    break;
                }
            }
            if (have_name_already)
                continue;

            providers += provider;
        }

        orig_config = in;
        return true;
    }
};

static QVariantMap provider_config_edit_pkcs11(const QVariantMap &in)
{
    Pkcs11Config config;
    if (!config.fromVariantMap(in)) {
        fprintf(stderr, "Error: unable to parse PKCS#11 provider configuration.\n");
        return QVariantMap();
    }

    while (true) {
        printf("\n");
        printf("Global settings:\n");
        printf("  Allow loading of root CAs: %s\n", config.allow_load_rootca ? "Yes" : "No");
        printf("  Allow protected authentication: %s\n", config.allow_protected_authentication ? "Yes" : "No");
        QString str;
        if (config.pin_cache == -1)
            str = QStringLiteral("No limit");
        else
            str = QStringLiteral("%1 seconds").arg(config.pin_cache);
        printf("  Maximum PIN cache time: %s\n", qPrintable(str));
        printf("  Log level: %d\n", config.log_level);
        printf("\n");
        printf("PKCS#11 modules:\n");
        if (!config.providers.isEmpty()) {
            foreach (const Pkcs11ProviderConfig &provider, config.providers)
                printf("  %s\n", qPrintable(provider.name));
        } else
            printf("  (None)\n");
        printf("\n");
        printf("Actions:\n");
        printf("  a) Edit global settings\n");
        printf("  b) Add PKCS#11 module\n");
        printf("  c) Edit PKCS#11 module\n");
        printf("  d) Remove PKCS#11 module\n");
        printf("\n");

        int index;
        while (true) {
            QString str = prompt_for(QStringLiteral("Select an action, or enter to quit"));
            if (str.isEmpty()) {
                index = -1;
                break;
            }
            if (str.length() == 1) {
                index = str[0].toLatin1() - 'a';
                if (index >= 0 && index < 4)
                    break;
            }
            printf("'%s' is not a valid entry.\n\n", qPrintable(str));
        }
        if (index == -1)
            break;

        if (index == 0) {
            printf("\n");

            QString prompt;
            prompt = QStringLiteral("Allow loading of root CAs: [%1] ")
                         .arg(config.allow_load_rootca ? QStringLiteral("Yes") : QStringLiteral("No"));
            config.allow_load_rootca = prompt_for_yesno(prompt, config.allow_load_rootca);
            prompt                   = QStringLiteral("Allow protected authentication: [%1] ")
                         .arg(config.allow_protected_authentication ? QStringLiteral("Yes") : QStringLiteral("No"));
            config.allow_protected_authentication = prompt_for_yesno(prompt, config.allow_protected_authentication);
            prompt = QStringLiteral("Maximum PIN cache time in seconds (-1 for no limit): [%1] ").arg(config.pin_cache);
            config.pin_cache = prompt_for_int(prompt, config.pin_cache);
            prompt           = QStringLiteral("Log level: [%1] ").arg(config.log_level);
            config.log_level = prompt_for_int(prompt, config.log_level);
        } else // 1, 2, 3
        {
            int at = -1;

            // for edit/remove, need to select provider
            if (index == 2 || index == 3) {
                printf("\nWhich PKCS#11 module?\n");
                for (int n = 0; n < config.providers.count(); ++n) {
                    const Pkcs11ProviderConfig &provider = config.providers[n];
                    char                        c        = 'a' + n;
                    printf("  %c) %s\n", c, qPrintable(provider.name));
                }
                printf("\n");

                int index;
                while (true) {
                    QString str = prompt_for(QStringLiteral("Select a module, or enter to go back"));
                    if (str.isEmpty()) {
                        index = -1;
                        break;
                    }
                    if (str.length() == 1) {
                        index = str[0].toLatin1() - 'a';
                        if (index >= 0 && index < config.providers.count())
                            break;
                    }
                    printf("'%s' is not a valid entry.\n", qPrintable(str));
                }

                // exit?
                if (index == -1)
                    continue;

                at = index;
            }

            // edit the entry
            if (index == 1 || index == 2) {
                Pkcs11ProviderConfig provider;
                if (index == 2) // edit
                    provider = config.providers[at];
                provider.enabled = true;
                printf("\n");

                QString prompt;

                // prompt for unique name
                while (true) {
                    if (index == 1)
                        prompt = QStringLiteral("Unique friendly name: ");
                    else
                        prompt = QStringLiteral("Unique friendly name: [%1] ").arg(provider.name);
                    provider.name = prompt_for_string(prompt, provider.name);

                    if (provider.name.isEmpty()) {
                        printf("The friendly name cannot be blank.\n\n");
                        continue;
                    }

                    bool have_name_already = false;
                    for (int n = 0; n < config.providers.count(); ++n) {
                        const Pkcs11ProviderConfig &i = config.providers[n];

                        // skip checking against the entry we are editing
                        if (at != -1 && n == at)
                            continue;

                        if (i.name == provider.name) {
                            have_name_already = true;
                            break;
                        }
                    }
                    if (have_name_already) {
                        printf("This name is already used by another module.\n\n");
                        continue;
                    }

                    break;
                }

                // prompt for library file
                QString last;
                while (true) {
                    if (index == 1)
                        prompt = QStringLiteral("Library filename: ");
                    else
                        prompt = QStringLiteral("Library filename: [%1] ").arg(provider.library);
                    provider.library = prompt_for_string(prompt, provider.library);

                    if (provider.library.isEmpty()) {
                        printf("The library filename cannot be blank.\n\n");
                        continue;
                    }

                    if (last != provider.library && !QFile::exists(provider.library)) {
                        last = provider.library;
                        printf("'%s' does not exist.\nPress enter again if you really want this.\n\n",
                               qPrintable(provider.library));
                        continue;
                    }

                    break;
                }

                prompt =
                    QStringLiteral("Allow protected authentication: [%1] ")
                        .arg(provider.allow_protected_authentication ? QStringLiteral("Yes") : QStringLiteral("No"));
                provider.allow_protected_authentication =
                    prompt_for_yesno(prompt, provider.allow_protected_authentication);
                prompt = QStringLiteral("Provider stores certificates as private objects: [%1] ")
                             .arg(provider.cert_private ? QStringLiteral("Yes") : QStringLiteral("No"));
                provider.cert_private = prompt_for_yesno(prompt, provider.cert_private);
                printf("\n");
                printf("Provider private key mask:\n");
                printf("    0        Determine automatically.\n");
                printf("    1        Use sign.\n");
                printf("    2        Use sign recover.\n");
                printf("    4        Use decrypt.\n");
                printf("    8        Use unwrap.\n");
                prompt                = QStringLiteral("Mask value: [%1] ").arg(provider.private_mask);
                provider.private_mask = prompt_for_int(prompt, provider.private_mask);
                printf("\n");
                printf("Slot event method:\n");
                printf("    auto     Determine automatically.\n");
                printf("    trigger  Use trigger.\n");
                printf("    poll     Use poll.\n");
                prompt                    = QStringLiteral("Method value: [%1] ").arg(provider.slotevent_method);
                provider.slotevent_method = prompt_for_slotevent_method(prompt, provider.slotevent_method);
                if (provider.slotevent_method == QLatin1String("poll")) {
                    prompt =
                        QStringLiteral("Poll timeout (0 for no preference): [%1] ").arg(provider.slotevent_timeout);
                    provider.slotevent_timeout = prompt_for_int(prompt, provider.slotevent_timeout);
                } else
                    provider.slotevent_timeout = 0;

                if (index == 1)
                    config.providers += provider;
                else // 2
                    config.providers[at] = provider;
            }
            // remove the entry
            else // 3
            {
                config.providers.removeAt(at);
            }
        }
    }

    return config.toVariantMap();
}

static QVariantMap provider_config_edit(const QVariantMap &in)
{
    // see if we have a configurator for a known form type
    if (in[QStringLiteral("formtype")] == QLatin1String("http://affinix.com/qca/forms/qca-pkcs11#1.0"))
        return provider_config_edit_pkcs11(in);

    // otherwise, use the generic configurator
    return provider_config_edit_generic(in);
}

static QString get_fingerprint(const QCA::Certificate &cert, const QString &hashType)
{
    QString hex = QCA::Hash(hashType).hashToString(cert.toDER());
    QString out;
    for (int n = 0; n < hex.size(); ++n) {
        if (n != 0 && n % 2 == 0)
            out += QLatin1Char(':');
        out += hex[n];
    }
    return out;
}

static QString kstype_to_string(QCA::KeyStore::Type _type)
{
    QString type;
    switch (_type) {
    case QCA::KeyStore::System:
        type = QStringLiteral("Sys ");
        break;
    case QCA::KeyStore::User:
        type = QStringLiteral("User");
        break;
    case QCA::KeyStore::Application:
        type = QStringLiteral("App ");
        break;
    case QCA::KeyStore::SmartCard:
        type = QStringLiteral("Card");
        break;
    case QCA::KeyStore::PGPKeyring:
        type = QStringLiteral("PGP ");
        break;
    default:
        type = QStringLiteral("XXXX");
        break;
    }
    return type;
}

static QString ksentrytype_to_string(QCA::KeyStoreEntry::Type _type)
{
    QString type;
    switch (_type) {
    case QCA::KeyStoreEntry::TypeKeyBundle:
        type = QStringLiteral("Key ");
        break;
    case QCA::KeyStoreEntry::TypeCertificate:
        type = QStringLiteral("Cert");
        break;
    case QCA::KeyStoreEntry::TypeCRL:
        type = QStringLiteral("CRL ");
        break;
    case QCA::KeyStoreEntry::TypePGPSecretKey:
        type = QStringLiteral("PSec");
        break;
    case QCA::KeyStoreEntry::TypePGPPublicKey:
        type = QStringLiteral("PPub");
        break;
    default:
        type = QStringLiteral("XXXX");
        break;
    }
    return type;
}

static void try_print_info(const char *name, const QStringList &values)
{
    if (!values.isEmpty()) {
        QString value = values.join(QStringLiteral(", "));
        printf("   %s: %s\n", name, value.toUtf8().data());
    }
}

static void print_info(const char *title, const QCA::CertificateInfo &info)
{
    QList<InfoType> list = makeInfoTypeList();
    printf("%s\n", title);
    foreach (const InfoType &t, list)
        try_print_info(qPrintable(t.name), info.values(t.type));
}

static void print_info_ordered(const char *title, const QCA::CertificateInfoOrdered &info)
{
    QList<InfoType> list = makeInfoTypeList(true);
    printf("%s\n", title);
    foreach (const QCA::CertificateInfoPair &pair, info) {
        QCA::CertificateInfoType type = pair.type();
        QString                  name;
        int                      at = -1;
        for (int n = 0; n < list.count(); ++n) {
            if (list[n].type == type) {
                at = n;
                break;
            }
        }

        // known type?
        if (at != -1) {
            name = list[at].name;
        } else {
            if (pair.type().section() == QCA::CertificateInfoType::DN)
                name = QStringLiteral("DN:") + pair.type().id();
            else
                name = QStringLiteral("AN:") + pair.type().id();
        }

        printf("   %s: %s\n", qPrintable(name), pair.value().toUtf8().data());
    }
}

static QString constraint_to_string(const QCA::ConstraintType &t)
{
    QList<MyConstraintType> list = makeConstraintTypeList();
    for (int n = 0; n < list.count(); ++n) {
        if (list[n].type == t)
            return list[n].name;
    }
    return t.id();
}

static QString sigalgo_to_string(QCA::SignatureAlgorithm algo)
{
    QString str;
    switch (algo) {
    case QCA::EMSA1_SHA1:
        str = QStringLiteral("EMSA1(SHA1)");
        break;
    case QCA::EMSA3_SHA1:
        str = QStringLiteral("EMSA3(SHA1)");
        break;
    case QCA::EMSA3_MD5:
        str = QStringLiteral("EMSA3(MD5)");
        break;
    case QCA::EMSA3_MD2:
        str = QStringLiteral("EMSA3(MD2)");
        break;
    case QCA::EMSA3_RIPEMD160:
        str = QStringLiteral("EMSA3(RIPEMD160)");
        break;
    case QCA::EMSA3_Raw:
        str = QStringLiteral("EMSA3(raw)");
        break;
    default:
        str = QStringLiteral("Unknown");
        break;
    }
    return str;
}

static void print_cert(const QCA::Certificate &cert, bool ordered = false)
{
    printf("Serial Number: %s\n", qPrintable(cert.serialNumber().toString()));

    if (ordered) {
        print_info_ordered("Subject", cert.subjectInfoOrdered());
        print_info_ordered("Issuer", cert.issuerInfoOrdered());
    } else {
        print_info("Subject", cert.subjectInfo());
        print_info("Issuer", cert.issuerInfo());
    }

    printf("Validity\n");
    printf("   Not before: %s\n", qPrintable(cert.notValidBefore().toString()));
    printf("   Not after:  %s\n", qPrintable(cert.notValidAfter().toString()));

    printf("Constraints\n");
    QCA::Constraints constraints = cert.constraints();
    int              n;
    if (!constraints.isEmpty()) {
        for (n = 0; n < constraints.count(); ++n)
            printf("   %s\n", qPrintable(constraint_to_string(constraints[n])));
    } else
        printf("   No constraints\n");

    printf("Policies\n");
    QStringList policies = cert.policies();
    if (!policies.isEmpty()) {
        for (n = 0; n < policies.count(); ++n)
            printf("   %s\n", qPrintable(policies[n]));
    } else
        printf("   No policies\n");

    QByteArray id;
    printf("Issuer Key ID: ");
    id = cert.issuerKeyId();
    if (!id.isEmpty())
        printf("%s\n", qPrintable(QCA::arrayToHex(id)));
    else
        printf("None\n");

    printf("Subject Key ID: ");
    id = cert.subjectKeyId();
    if (!id.isEmpty())
        printf("%s\n", qPrintable(QCA::arrayToHex(id)));
    else
        printf("None\n");

    printf("CA: %s\n", cert.isCA() ? "Yes" : "No");
    printf("Signature Algorithm: %s\n", qPrintable(sigalgo_to_string(cert.signatureAlgorithm())));

    QCA::PublicKey key = cert.subjectPublicKey();
    printf("Public Key:\n%s", key.toPEM().toLatin1().data());

    printf("SHA1 Fingerprint: %s\n", qPrintable(get_fingerprint(cert, QStringLiteral("sha1"))));
    printf("MD5 Fingerprint: %s\n", qPrintable(get_fingerprint(cert, QStringLiteral("md5"))));
}

static void print_certreq(const QCA::CertificateRequest &cert, bool ordered = false)
{
    if (ordered)
        print_info_ordered("Subject", cert.subjectInfoOrdered());
    else
        print_info("Subject", cert.subjectInfo());

    printf("Constraints\n");
    QCA::Constraints constraints = cert.constraints();
    int              n;
    if (!constraints.isEmpty()) {
        for (n = 0; n < constraints.count(); ++n)
            printf("   %s\n", qPrintable(constraint_to_string(constraints[n])));
    } else
        printf("   No constraints\n");

    printf("Policies\n");
    QStringList policies = cert.policies();
    if (!policies.isEmpty()) {
        for (n = 0; n < policies.count(); ++n)
            printf("   %s\n", qPrintable(policies[n]));
    } else
        printf("   No policies\n");

    printf("CA: %s\n", cert.isCA() ? "Yes" : "No");
    printf("Signature Algorithm: %s\n", qPrintable(sigalgo_to_string(cert.signatureAlgorithm())));

    QCA::PublicKey key = cert.subjectPublicKey();
    printf("Public Key:\n%s", key.toPEM().toLatin1().data());
}

static void print_crl(const QCA::CRL &crl, bool ordered = false)
{
    if (ordered)
        print_info_ordered("Issuer", crl.issuerInfoOrdered());
    else
        print_info("Issuer", crl.issuerInfo());

    int num = crl.number();
    if (num != -1)
        printf("Number: %d\n", num);

    printf("Validity\n");
    printf("   This update: %s\n", qPrintable(crl.thisUpdate().toString()));
    printf("   Next update: %s\n", qPrintable(crl.nextUpdate().toString()));

    QByteArray id;
    printf("Issuer Key ID: ");
    id = crl.issuerKeyId();
    if (!id.isEmpty())
        printf("%s\n", qPrintable(QCA::arrayToHex(id)));
    else
        printf("None\n");

    printf("Signature Algorithm: %s\n", qPrintable(sigalgo_to_string(crl.signatureAlgorithm())));

    QList<QCA::CRLEntry> revokedList = crl.revoked();
    foreach (const QCA::CRLEntry &entry, revokedList) {
        printf("   %s: %s, %s\n",
               qPrintable(entry.serialNumber().toString()),
               crlEntryReasonToString(entry.reason()),
               qPrintable(entry.time().toString()));
    }
}

static QString format_pgp_fingerprint(const QString &in)
{
    QString out;
    bool    first = true;
    for (int n = 0; n + 3 < in.length(); n += 4) {
        if (!first)
            out += QLatin1Char(' ');
        else
            first = false;
        out += in.mid(n, 4).toUpper();
    }
    return out;
}

static void print_pgp(const QCA::PGPKey &key)
{
    printf("Key ID: %s\n", qPrintable(key.keyId()));
    printf("User IDs:\n");
    foreach (const QString &s, key.userIds())
        printf("   %s\n", qPrintable(s));
    printf("Validity\n");
    printf("   Not before: %s\n", qPrintable(key.creationDate().toString()));
    if (!key.expirationDate().isNull())
        printf("   Not after:  %s\n", qPrintable(key.expirationDate().toString()));
    else
        printf("   Not after:  (no expiration)\n");
    printf("In Keyring: %s\n", key.inKeyring() ? "Yes" : "No");
    printf("Secret Key: %s\n", key.isSecret() ? "Yes" : "No");
    printf("Trusted:    %s\n", key.isTrusted() ? "Yes" : "No");
    printf("Fingerprint: %s\n", qPrintable(format_pgp_fingerprint(key.fingerprint())));
}

static QString validityToString(QCA::Validity v)
{
    QString s;
    switch (v) {
    case QCA::ValidityGood:
        s = QStringLiteral("Validated");
        break;
    case QCA::ErrorRejected:
        s = QStringLiteral("Root CA is marked to reject the specified purpose");
        break;
    case QCA::ErrorUntrusted:
        s = QStringLiteral("Certificate not trusted for the required purpose");
        break;
    case QCA::ErrorSignatureFailed:
        s = QStringLiteral("Invalid signature");
        break;
    case QCA::ErrorInvalidCA:
        s = QStringLiteral("Invalid CA certificate");
        break;
    case QCA::ErrorInvalidPurpose:
        s = QStringLiteral("Invalid certificate purpose");
        break;
    case QCA::ErrorSelfSigned:
        s = QStringLiteral("Certificate is self-signed");
        break;
    case QCA::ErrorRevoked:
        s = QStringLiteral("Certificate has been revoked");
        break;
    case QCA::ErrorPathLengthExceeded:
        s = QStringLiteral("Maximum certificate chain length exceeded");
        break;
    case QCA::ErrorExpired:
        s = QStringLiteral("Certificate has expired");
        break;
    case QCA::ErrorExpiredCA:
        s = QStringLiteral("CA has expired");
        break;
    case QCA::ErrorValidityUnknown:
    default:
        s = QStringLiteral("General certificate validation error");
        break;
    }
    return s;
}

static QString smIdentityResultToString(QCA::SecureMessageSignature::IdentityResult r)
{
    QString str;
    switch (r) {
    case QCA::SecureMessageSignature::Valid:
        str = QStringLiteral("Valid");
        break;
    case QCA::SecureMessageSignature::InvalidSignature:
        str = QStringLiteral("InvalidSignature");
        break;
    case QCA::SecureMessageSignature::InvalidKey:
        str = QStringLiteral("InvalidKey");
        break;
    case QCA::SecureMessageSignature::NoKey:
        str = QStringLiteral("NoKey");
        break;
    default:
        str = QStringLiteral("Unknown");
    }
    return str;
}

static QString smErrorToString(QCA::SecureMessage::Error e)
{
    QMap<QCA::SecureMessage::Error, QString> map;
    map[QCA::SecureMessage::ErrorPassphrase]       = QStringLiteral("ErrorPassphrase");
    map[QCA::SecureMessage::ErrorFormat]           = QStringLiteral("ErrorFormat");
    map[QCA::SecureMessage::ErrorSignerExpired]    = QStringLiteral("ErrorSignerExpired");
    map[QCA::SecureMessage::ErrorSignerInvalid]    = QStringLiteral("ErrorSignerInvalid");
    map[QCA::SecureMessage::ErrorEncryptExpired]   = QStringLiteral("ErrorEncryptExpired");
    map[QCA::SecureMessage::ErrorEncryptUntrusted] = QStringLiteral("ErrorEncryptUntrusted");
    map[QCA::SecureMessage::ErrorEncryptInvalid]   = QStringLiteral("ErrorEncryptInvalid");
    map[QCA::SecureMessage::ErrorNeedCard]         = QStringLiteral("ErrorNeedCard");
    map[QCA::SecureMessage::ErrorCertKeyMismatch]  = QStringLiteral("ErrorCertKeyMismatch");
    map[QCA::SecureMessage::ErrorUnknown]          = QStringLiteral("ErrorUnknown");
    return map[e];
}

static void smDisplaySignatures(const QList<QCA::SecureMessageSignature> &signers)
{
    foreach (const QCA::SecureMessageSignature &signer, signers) {
        QCA::SecureMessageSignature::IdentityResult r = signer.identityResult();
        fprintf(stderr, "IdentityResult: %s\n", qPrintable(smIdentityResultToString(r)));

        QCA::SecureMessageKey key = signer.key();
        if (!key.isNull()) {
            if (key.type() == QCA::SecureMessageKey::PGP) {
                QCA::PGPKey pub = key.pgpPublicKey();
                fprintf(stderr, "From: %s (%s)\n", qPrintable(pub.primaryUserId()), qPrintable(pub.keyId()));
            } else {
                QCA::Certificate     cert = key.x509CertificateChain().primary();
                QString              emailStr;
                QCA::CertificateInfo info = cert.subjectInfo();
                if (info.contains(QCA::Email))
                    emailStr = QStringLiteral(" (%1)").arg(info.value(QCA::Email));
                fprintf(stderr, "From: %s%s\n", qPrintable(cert.commonName()), qPrintable(emailStr));
            }
        }
    }
}

static const char *mime_signpart =
    "Content-Type: text/plain; charset=UTF-8\r\n"
    "Content-Transfer-Encoding: 8bit\r\n"
    "\r\n"
    "%1";

static const char *mime_signed =
    "Content-Type: multipart/signed;\r\n"
    "	micalg=%1;\r\n"
    "	boundary=QCATOOL-0001;\r\n"
    "	protocol=\"application/pkcs7-signature\"\r\n"
    "\r\n"
    "\r\n"
    "--QCATOOL-0001\r\n"
    "%2\r\n"
    "--QCATOOL-0001\r\n"
    "Content-Transfer-Encoding: base64\r\n"
    "Content-Type: application/pkcs7-signature;\r\n"
    "	name=smime.p7s\r\n"
    "Content-Disposition: attachment;\r\n"
    "	filename=smime.p7s\r\n"
    "\r\n"
    "%3\r\n"
    "\r\n"
    "--QCATOOL-0001--\r\n";

static const char *mime_enveloped =
    "Mime-Version: 1.0\r\n"
    "Content-Transfer-Encoding: base64\r\n"
    "Content-Type: application/pkcs7-mime;\r\n"
    "	name=smime.p7m;\r\n"
    "	smime-type=enveloped-data\r\n"
    "Content-Disposition: attachment;\r\n"
    "	filename=smime.p7m\r\n"
    "\r\n"
    "%1\r\n";

static QString add_cr(const QString &in)
{
    QString out = in;
    int     at  = 0;
    while (true) {
        at = out.indexOf(QLatin1Char('\n'), at);
        if (at == -1)
            break;
        if (at - 1 >= 0 && out[at - 1] != QLatin1Char('\r')) {
            out.insert(at, QLatin1Char('\r'));
            ++at;
        }
        ++at;
    }
    return out;
}

static QString rem_cr(const QString &in)
{
    QString out = in;
    out.replace(QLatin1String("\r\n"), QLatin1String("\n"));
    return out;
}

static int indexOf_newline(const QString &in, int offset = 0)
{
    for (int n = offset; n < in.length(); ++n) {
        if (n + 1 < in.length() && in[n] == QLatin1Char('\r') && in[n + 1] == QLatin1Char('\n'))
            return n;
        if (in[n] == QLatin1Char('\n'))
            return n;
    }
    return -1;
}

static int indexOf_doublenewline(const QString &in, int offset = 0)
{
    int at = -1;
    while (true) {
        int n = indexOf_newline(in, offset);
        if (n == -1)
            return -1;

        if (at != -1) {
            if (n == offset)
                break;
        }

        at = n;
        if (in[n] == QLatin1Char('\n'))
            offset = n + 1;
        else
            offset = n + 2;
    }
    return at;
}

// this is so gross
static int newline_len(const QString &in, int offset = 0)
{
    if (in[offset] == QLatin1Char('\r'))
        return 2;
    else
        return 1;
}

// all of this mime stuff is a total hack
static QString open_mime_envelope(const QString &in)
{
    int n = indexOf_doublenewline(in);
    if (n == -1)
        return QString();
    return in.mid(n + (newline_len(in, n) * 2)); // good lord
}

static bool open_mime_data_sig(const QString &in, QString *data, QString *sig)
{
    int n = in.indexOf(QLatin1String("boundary="));
    if (n == -1)
        return false;
    n += 9;
    int i = indexOf_newline(in, n);
    if (i == -1)
        return false;
    QString boundary;
    QString bregion = in.mid(n, i - n);
    n               = bregion.indexOf(QLatin1Char(';'));
    if (n != -1)
        boundary = bregion.mid(0, n);
    else
        boundary = bregion;

    if (boundary[0] == QLatin1Char('\"'))
        boundary.remove(0, 1);
    if (boundary[boundary.length() - 1] == QLatin1Char('\"'))
        boundary.remove(boundary.length() - 1, 1);
    // printf("boundary: [%s]\n", qPrintable(boundary));
    QString boundary_end = QStringLiteral("--") + boundary;
    boundary             = QStringLiteral("--") + boundary;

    QString work = open_mime_envelope(in);
    // printf("work: [%s]\n", qPrintable(work));

    n = work.indexOf(boundary);
    if (n == -1)
        return false;
    n += boundary.length();
    i = indexOf_newline(work, n);
    if (i == -1)
        return false;
    n += newline_len(work, i);
    int data_start = n;

    n = work.indexOf(boundary, data_start);
    if (n == -1)
        return false;
    int data_end = n;

    n = data_end + boundary.length();
    i = indexOf_newline(work, n);
    if (i == -1)
        return false;
    n += newline_len(work, i);
    int next = n;

    QString tmp_data = work.mid(data_start, data_end - data_start);
    n                = work.indexOf(boundary_end, next);
    if (n == -1)
        return false;
    QString tmp_sig = work.mid(next, n - next);

    // nuke some newlines
    if (tmp_data.right(2) == QLatin1String("\r\n"))
        tmp_data.truncate(tmp_data.length() - 2);
    else if (tmp_data.right(1) == QLatin1String("\n"))
        tmp_data.truncate(tmp_data.length() - 1);
    if (tmp_sig.right(2) == QLatin1String("\r\n"))
        tmp_sig.truncate(tmp_sig.length() - 2);
    else if (tmp_sig.right(1) == QLatin1String("\n"))
        tmp_sig.truncate(tmp_sig.length() - 1);

    tmp_sig = open_mime_envelope(tmp_sig);

    *data = tmp_data;
    *sig  = tmp_sig;
    return true;
}

static QString idHash(const QString &id)
{
    // hash the id and take the rightmost 4 hex characters
    return QCA::Hash(QStringLiteral("md5")).hashToString(id.toUtf8()).right(4);
}

// first = ids, second = names
static QPair<QStringList, QStringList> getKeyStoreStrings(const QStringList &list, QCA::KeyStoreManager *ksm)
{
    QPair<QStringList, QStringList> out;
    for (int n = 0; n < list.count(); ++n) {
        QCA::KeyStore ks(list[n], ksm);
        out.first.append(idHash(ks.id()));
        out.second.append(ks.name());
    }
    return out;
}

static QPair<QStringList, QStringList> getKeyStoreEntryStrings(const QList<QCA::KeyStoreEntry> &list)
{
    QPair<QStringList, QStringList> out;
    for (int n = 0; n < list.count(); ++n) {
        out.first.append(idHash(list[n].id()));
        out.second.append(list[n].name());
    }
    return out;
}

static QList<int> getPartialMatches(const QStringList &list, const QString &str)
{
    QList<int> out;
    for (int n = 0; n < list.count(); ++n) {
        if (list[n].contains(str, Qt::CaseInsensitive))
            out += n;
    }
    return out;
}

static int findByString(const QPair<QStringList, QStringList> &in, const QString &str)
{
    // exact id match
    int n = in.first.indexOf(str);
    if (n != -1)
        return n;

    // partial id match
    QList<int> ret = getPartialMatches(in.first, str);
    if (!ret.isEmpty())
        return ret.first();

    // partial name match
    ret = getPartialMatches(in.second, str);
    if (!ret.isEmpty())
        return ret.first();

    return -1;
}

static QString getKeyStore(const QString &name)
{
    QCA::KeyStoreManager ksm;
    QStringList          storeList = ksm.keyStores();
    int                  n         = findByString(getKeyStoreStrings(storeList, &ksm), name);
    if (n != -1)
        return storeList[n];
    return QString();
}

static QCA::KeyStoreEntry getKeyStoreEntry(QCA::KeyStore *store, const QString &name)
{
    QList<QCA::KeyStoreEntry> list = store->entryList();
    int                       n    = findByString(getKeyStoreEntryStrings(list), name);
    if (n != -1)
        return list[n];
    return QCA::KeyStoreEntry();
}

// here are a bunch of get_Foo functions for the various types

// E - generic entry
// K - private key
// C - cert
// X - keybundle
// P - pgp public key
// S - pgp secret key

// in all cases but K, the store:obj notation can be used.  if there
//   is no colon present, then we treat the input as a filename. we
//   try the file as an exported passive entry id, and if the type
//   is C or X, we'll fall back to regular files if necessary.

static QCA::KeyStoreEntry get_E(const QString &name, bool nopassiveerror = false)
{
    QCA::KeyStoreEntry entry;

    QCA::KeyStoreManager::start();

    int n = name.indexOf(QLatin1Char(':'));
    if (n != -1) {
        ksm_start_and_wait();

        // store:obj lookup
        QString storeName  = name.mid(0, n);
        QString objectName = name.mid(n + 1);

        QCA::KeyStoreManager ksm;
        QCA::KeyStore        store(getKeyStore(storeName), &ksm);
        if (!store.isValid()) {
            fprintf(stderr, "Error: no such store [%s].\n", qPrintable(storeName));
            return entry;
        }

        entry = getKeyStoreEntry(&store, objectName);
        if (entry.isNull()) {
            fprintf(stderr, "Error: no such object [%s].\n", qPrintable(objectName));
            return entry;
        }
    } else {
        // exported id
        QString serialized = read_ksentry_file(name);
        entry              = QCA::KeyStoreEntry(serialized);
        if (entry.isNull()) {
            if (!nopassiveerror)
                fprintf(stderr, "Error: invalid/unknown entry [%s].\n", qPrintable(name));
            return entry;
        }
    }

    return entry;
}

static QCA::PrivateKey get_K(const QString &name)
{
    QCA::PrivateKey key;

    int n = name.indexOf(QLatin1Char(':'));
    if (n != -1) {
        fprintf(stderr, "Error: cannot use store:obj notation for raw private keys.\n");
        return key;
    }

    if (is_pem_file(name))
        key = QCA::PrivateKey::fromPEMFile(name);
    else
        key = QCA::PrivateKey::fromDER(read_der_file(name));
    if (key.isNull()) {
        fprintf(stderr, "Error: unable to read/process private key file.\n");
        return key;
    }

    return key;
}

static QCA::Certificate get_C(const QString &name)
{
    QCA::KeyStoreEntry entry = get_E(name, true);
    if (!entry.isNull()) {
        if (entry.type() != QCA::KeyStoreEntry::TypeCertificate) {
            fprintf(stderr, "Error: entry is not a certificate.\n");
            return QCA::Certificate();
        }
        return entry.certificate();
    }

    if (!QCA::isSupported("cert")) {
        fprintf(stderr, "Error: need 'cert' feature.\n");
        return QCA::Certificate();
    }

    // try file
    QCA::Certificate cert;
    if (is_pem_file(name))
        cert = QCA::Certificate::fromPEMFile(name);
    else
        cert = QCA::Certificate::fromDER(read_der_file(name));
    if (cert.isNull()) {
        fprintf(stderr, "Error: unable to read/process certificate file.\n");
        return cert;
    }

    return cert;
}

static QCA::KeyBundle get_X(const QString &name)
{
    QCA::KeyStoreEntry entry = get_E(name, true);
    if (!entry.isNull()) {
        if (entry.type() != QCA::KeyStoreEntry::TypeKeyBundle) {
            fprintf(stderr, "Error: entry is not a keybundle.\n");
            return QCA::KeyBundle();
        }
        return entry.keyBundle();
    }

    if (!QCA::isSupported("pkcs12")) {
        fprintf(stderr, "Error: need 'pkcs12' feature.\n");
        return QCA::KeyBundle();
    }

    // try file
    QCA::KeyBundle key = QCA::KeyBundle::fromFile(name);
    if (key.isNull()) {
        fprintf(stderr, "Error: unable to read/process keybundle file.\n");
        return key;
    }

    return key;
}

static QCA::PGPKey get_P(const QString &name)
{
    QCA::KeyStoreEntry entry = get_E(name, true);
    if (!entry.isNull()) {
        if (entry.type() != QCA::KeyStoreEntry::TypePGPPublicKey &&
            entry.type() != QCA::KeyStoreEntry::TypePGPSecretKey) {
            fprintf(stderr, "Error: entry is not a pgp public key.\n");
            return QCA::PGPKey();
        }
        return entry.pgpPublicKey();
    }

    // try file
    QCA::PGPKey key = QCA::PGPKey::fromFile(name);
    if (key.isNull()) {
        fprintf(stderr, "Error: unable to read/process pgp key file.\n");
        return key;
    }

    return key;
}

static QPair<QCA::PGPKey, QCA::PGPKey> get_S(const QString &name, bool noerror = false)
{
    QPair<QCA::PGPKey, QCA::PGPKey> key;
    QCA::KeyStoreEntry              entry = get_E(name, true);
    if (!entry.isNull()) {
        if (entry.type() != QCA::KeyStoreEntry::TypePGPSecretKey) {
            if (!noerror)
                fprintf(stderr, "Error: entry is not a pgp secret key.\n");
            return key;
        }

        key.first  = entry.pgpSecretKey();
        key.second = entry.pgpPublicKey();
        return key;
    }
    return key;
}

static void usage()
{
    printf("%s: simple qca utility\n", APPNAME);
    printf("usage: %s (options) [command]\n", EXENAME);
    printf(" options: --pass=x, --newpass=x, --nonroots=x, --roots=x, --nosys,\n");
    printf("          --noprompt, --ordered, --debug, --log-file=x, --log-level=n,\n");
    printf("          --nobundle\n");
    printf("\n");
    printf(" help|--help|-h                        This help text\n");
    printf(" version|--version|-v                  Print version information\n");
    printf(" plugins                               List available plugins\n");
    printf(" config [command]\n");
    printf("   save [provider]                     Save default provider config\n");
    printf("   edit [provider]                     Edit provider config\n");
    printf(" key [command]\n");
    printf("   make rsa|dsa [bits]                 Create a key pair\n");
    printf("   changepass [K]                      Add/change/remove passphrase of a key\n");
    printf(" cert [command]\n");
    printf("   makereq [K]                         Create certificate request (CSR)\n");
    printf("   makeself [K]                        Create self-signed certificate\n");
    printf("   makereqadv [K]                      Advanced version of 'makereq'\n");
    printf("   makeselfadv [K]                     Advanced version of 'makeself'\n");
    printf("   validate [C]                        Validate certificate\n");
    printf(" keybundle [command]\n");
    printf("   make [K] [C]                        Create a keybundle\n");
    printf("   extract [X]                         Extract certificate(s) and key\n");
    printf("   changepass [X]                      Change passphrase of a keybundle\n");
    printf(" keystore [command]\n");
    printf("   list-stores                         List all available keystores\n");
    printf("   list [storeName]                    List content of a keystore\n");
    printf("   monitor                             Monitor for keystore availability\n");
    printf("   export [E]                          Export a keystore entry's content\n");
    printf("   exportref [E]                       Export a keystore entry reference\n");
    printf("   addkb [storeName] [cert.p12]        Add a keybundle into a keystore\n");
    printf("   addpgp [storeName] [key.asc]        Add a PGP key into a keystore\n");
    printf("   remove [E]                          Remove an object from a keystore\n");
    printf(" show [command]\n");
    printf("   cert [C]                            Examine a certificate\n");
    printf("   req [req.pem]                       Examine a certificate request (CSR)\n");
    printf("   crl [crl.pem]                       Examine a certificate revocation list\n");
    printf("   kb [X]                              Examine a keybundle\n");
    printf("   pgp [P|S]                           Examine a PGP key\n");
    printf(" message [command]\n");
    printf("   sign pgp|pgpdetach|smime [X|S]      Sign a message\n");
    printf("   encrypt pgp|smime [C|P]             Encrypt a message\n");
    printf("   signencrypt [S] [P]                 PGP sign & encrypt a message\n");
    printf("   verify pgp|smime                    Verify a message\n");
    printf("   decrypt pgp|smime ((X) ...)         Decrypt a message (S/MIME needs X)\n");
    printf("   exportcerts                         Export certs from S/MIME message\n");
    printf("\n");
    printf("Object types: K = private key, C = certificate, X = key bundle,\n");
    printf("  P = PGP public key, S = PGP secret key, E = generic entry\n");
    printf("\n");
    printf("An object must be either a filename or a keystore reference (\"store:obj\").\n");
    printf("\n");
    printf("Log level is from 0 (quiet) to 8 (debug)\n");
    printf("\n");
}

int main(int argc, char **argv)
{
    QCA::Initializer qcaInit;
    QCoreApplication app(argc, argv);
    QFile            logFile;
    QTextStream      logStream(stderr);
    StreamLogger     streamLogger(logStream);

    QStringList args;
    for (int n = 1; n < argc; ++n)
        args.append(QString::fromLocal8Bit(argv[n]));

    if (args.count() < 1) {
        usage();
        return 1;
    }

    bool             have_pass    = false;
    bool             have_newpass = false;
    QCA::SecureArray pass, newpass;
    bool             allowprompt = true;
    bool             ordered     = false;
    bool             debug       = false;
    bool             nosys       = false;
    bool             nobundle    = false;
    QString          rootsFile, nonRootsFile;

    for (int n = 0; n < args.count(); ++n) {
        QString s = args[n];
        if (!s.startsWith(QLatin1String("--")))
            continue;
        QString var;
        QString val;
        int     x = s.indexOf(QLatin1Char('='));
        if (x != -1) {
            var = s.mid(2, x - 2);
            val = s.mid(x + 1);
        } else {
            var = s.mid(2);
        }

        bool known = true;

        if (var == QLatin1String("pass")) {
            have_pass = true;
            pass      = val.toUtf8();
        } else if (var == QLatin1String("newpass")) {
            have_newpass = true;
            newpass      = val.toUtf8();
        } else if (var == QLatin1String("log-file")) {
            logFile.setFileName(val);
            logFile.open(QIODevice::Append | QIODevice::Text | QIODevice::Unbuffered);
            logStream.setDevice(&logFile);
        } else if (var == QLatin1String("log-level")) {
            QCA::logger()->setLevel((QCA::Logger::Severity)val.toInt());
        } else if (var == QLatin1String("noprompt"))
            allowprompt = false;
        else if (var == QLatin1String("ordered"))
            ordered = true;
        else if (var == QLatin1String("debug"))
            debug = true;
        else if (var == QLatin1String("roots"))
            rootsFile = val;
        else if (var == QLatin1String("nonroots"))
            nonRootsFile = val;
        else if (var == QLatin1String("nosys"))
            nosys = true;
        else if (var == QLatin1String("nobundle"))
            nobundle = true;
        else
            known = false;

        if (known) {
            args.removeAt(n);
            --n; // adjust position
        }
    }

    // help
    if (args.isEmpty() || args[0] == QLatin1String("help") || args[0] == QLatin1String("--help") ||
        args[0] == QLatin1String("-h")) {
        usage();
        return 0;
    }

    // version
    if (args[0] == QLatin1String("version") || args[0] == QLatin1String("--version") ||
        args[0] == QLatin1String("-v")) {
        int ver = qcaVersion();
        int maj = (ver >> 16) & 0xff;
        int min = (ver >> 8) & 0xff;
        int bug = ver & 0xff;
        printf("%s version %s by Justin Karneges\n", APPNAME, VERSION);
        printf("Using QCA version %d.%d.%d\n", maj, min, bug);
        return 0;
    }

    // show plugins
    if (args[0] == QLatin1String("plugins")) {
        QStringList paths = QCA::pluginPaths();
        if (!paths.isEmpty()) {
            for (int n = 0; n < paths.count(); ++n) {
                printf("  %s\n", qPrintable(QDir::toNativeSeparators(paths[n])));
            }
        } else
            printf("  (none)\n");

        QCA::ProviderList list = QCA::providers();

        if (debug)
            output_plugin_diagnostic_text();

        printf("Available Providers:\n");
        if (!list.isEmpty()) {
            for (int n = 0; n < list.count(); ++n) {
                printf("  %s\n", qPrintable(list[n]->name()));
                QString credit = list[n]->credit();
                if (!credit.isEmpty()) {
                    QStringList lines = wrapstring(credit, 74);
                    foreach (const QString &s, lines)
                        printf("    %s\n", qPrintable(s));
                }
                if (debug) {
                    QStringList capabilities = list[n]->features();
                    foreach (const QString &capability, capabilities) {
                        printf("    *%s", qPrintable(capability));
                        if (!QCA::isSupported(qPrintable(capability), list[n]->name())) {
                            printf("(NOT supported) - bug");
                        }
                        printf("\n");
                    }
                }
            }
        } else
            printf("  (none)\n");

        QCA::unloadAllPlugins();

        if (debug)
            output_plugin_diagnostic_text();

        return 0;
    }

    // config stuff
    if (args[0] == QLatin1String("config")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("save")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QString        name = args[2];
            QCA::Provider *p    = QCA::findProvider(name);
            if (!p) {
                fprintf(stderr, "Error: no such provider '%s'.\n", qPrintable(name));
                return 1;
            }

            QVariantMap map1 = p->defaultConfig();
            if (map1.isEmpty()) {
                fprintf(stderr, "Error: provider does not support configuration.\n");
                return 1;
            }

            // set and save
            QCA::setProviderConfig(name, map1);
            QCA::saveProviderConfig(name);
            printf("Done.\n");
            return 0;
        } else if (args[1] == QLatin1String("edit")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QString name = args[2];
            if (!QCA::findProvider(name)) {
                fprintf(stderr, "Error: no such provider '%s'.\n", qPrintable(name));
                return 1;
            }

            QVariantMap map1 = QCA::getProviderConfig(name);
            if (map1.isEmpty()) {
                fprintf(stderr, "Error: provider does not support configuration.\n");
                return 1;
            }

            printf("Editing configuration for %s ...\n", qPrintable(name));
            printf("Note: to clear a string entry, type whitespace and press enter.\n");

            map1 = provider_config_edit(map1);
            if (map1.isEmpty())
                return 1;

            // set and save
            QCA::setProviderConfig(name, map1);
            QCA::saveProviderConfig(name);
            printf("Done.\n");
            return 0;
        } else {
            usage();
            return 1;
        }
    }

    // enable console passphrase prompt
    PassphrasePromptThread passphrasePrompt;
    if (!allowprompt)
        passphrasePrompt.pp->allowPrompt = false;
    if (have_pass)
        passphrasePrompt.pp->setExplicitPassword(pass);

    if (args[0] == QLatin1String("key")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("make")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            bool genrsa;
            int  bits;

            if (args[2] == QLatin1String("rsa")) {
                if (!QCA::isSupported("rsa")) {
                    fprintf(stderr, "Error: need 'rsa' feature.\n");
                    return 1;
                }

                genrsa = true;
                bits   = args[3].toInt();
                if (bits < 512) {
                    fprintf(stderr, "Error: RSA bits must be at least 512.\n");
                    return 1;
                }
            } else if (args[2] == QLatin1String("dsa")) {
                if (!QCA::isSupported("dsa")) {
                    fprintf(stderr, "Error: need 'dsa' feature.\n");
                    return 1;
                }

                if (!QCA::isSupported("dlgroup")) {
                    fprintf(stderr, "Error: need 'dlgroup' feature.\n");
                    return 1;
                }

                genrsa = false;
                bits   = args[3].toInt();
                if (bits != 512 && bits != 768 && bits != 1024) {
                    fprintf(stderr, "Error: DSA bits must be 512, 768, or 1024.\n");
                    return 1;
                }
            } else {
                usage();
                return 1;
            }

            if (!allowprompt && !have_newpass) {
                fprintf(stderr, "Error: no passphrase specified (use '--newpass=' for none).\n");
                return 1;
            }

            QCA::PrivateKey priv;
            QString         pubFileName, privFileName;

            if (genrsa) {
                // note: third arg is bogus, doesn't apply to RSA
                priv         = AnimatedKeyGen::makeKey(QCA::PKey::RSA, bits, QCA::DSA_512);
                pubFileName  = QStringLiteral("rsapub.pem");
                privFileName = QStringLiteral("rsapriv.pem");
            } else // dsa
            {
                QCA::DLGroupSet set;
                if (bits == 512)
                    set = QCA::DSA_512;
                else if (bits == 768)
                    set = QCA::DSA_768;
                else // 1024
                    set = QCA::DSA_1024;

                // note: second arg is bogus, doesn't apply to DSA
                priv         = AnimatedKeyGen::makeKey(QCA::PKey::DSA, 0, set);
                pubFileName  = QStringLiteral("dsapub.pem");
                privFileName = QStringLiteral("dsapriv.pem");
            }

            if (priv.isNull()) {
                fprintf(stderr, "Error: unable to generate key.\n");
                return 1;
            }

            QCA::PublicKey pub = priv.toPublicKey();

            // prompt for new passphrase if necessary
            if (!have_newpass) {
                while (!promptForNewPassphrase(&newpass)) { }
                have_newpass = true;
            }

            if (pub.toPEMFile(pubFileName))
                printf("Public key saved to %s\n", qPrintable(pubFileName));
            else {
                fprintf(stderr, "Error: can't encode/write %s\n", qPrintable(pubFileName));
                return 1;
            }

            bool ok;
            if (!newpass.isEmpty())
                ok = priv.toPEMFile(privFileName, newpass);
            else
                ok = priv.toPEMFile(privFileName);
            if (ok)
                printf("Private key saved to %s\n", qPrintable(privFileName));
            else {
                fprintf(stderr, "Error: can't encode/write %s\n", qPrintable(privFileName));
                return 1;
            }
        } else if (args[1] == QLatin1String("changepass")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::PrivateKey priv = get_K(args[2]);
            if (priv.isNull())
                return 1;

            if (!allowprompt && !have_newpass) {
                fprintf(stderr, "Error: no passphrase specified (use '--newpass=' for none).\n");
                return 1;
            }

            // prompt for new passphrase if necessary
            if (!have_newpass) {
                while (!promptForNewPassphrase(&newpass)) { }
                have_newpass = true;
            }

            QString out;
            if (!newpass.isEmpty())
                out = priv.toPEM(newpass);
            else
                out = priv.toPEM();
            if (!out.isEmpty())
                printf("%s", qPrintable(out));
            else {
                fprintf(stderr, "Error: can't encode key.\n");
                return 1;
            }
        } else {
            usage();
            return 1;
        }
    } else if (args[0] == QLatin1String("cert")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("makereq") || args[1] == QLatin1String("makereqadv")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("csr")) {
                fprintf(stderr, "Error: need 'csr' feature.\n");
                return 1;
            }

            QCA::PrivateKey priv = get_K(args[2]);
            if (priv.isNull())
                return 1;

            printf("\n");

            bool advanced = (args[1] == QLatin1String("makereqadv")) ? true : false;

            QCA::CertificateOptions opts = promptForCertAttributes(advanced, true);
            QCA::CertificateRequest req(opts, priv);

            QString reqname = QStringLiteral("certreq.pem");
            if (req.toPEMFile(reqname))
                printf("Certificate request saved to %s\n", qPrintable(reqname));
            else {
                fprintf(stderr, "Error: can't encode/write %s\n", qPrintable(reqname));
                return 1;
            }
        } else if (args[1] == QLatin1String("makeself") || args[1] == QLatin1String("makeselfadv")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("cert")) {
                fprintf(stderr, "Error: need 'cert' feature.\n");
                return 1;
            }

            QCA::PrivateKey priv = get_K(args[2]);
            if (priv.isNull())
                return 1;

            printf("\n");

            bool advanced = (args[1] == QLatin1String("makeselfadv")) ? true : false;

            QCA::CertificateOptions opts = promptForCertAttributes(advanced, false);
            QCA::Certificate        cert(opts, priv);

            QString certname = QStringLiteral("cert.pem");
            if (cert.toPEMFile(certname))
                printf("Certificate saved to %s\n", qPrintable(certname));
            else {
                fprintf(stderr, "Error: can't encode/write %s\n", qPrintable(certname));
                return 1;
            }
        } else if (args[1] == QLatin1String("validate")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::Certificate target = get_C(args[2]);
            if (target.isNull())
                return 1;

            // get roots
            QCA::CertificateCollection roots;
            if (!nosys)
                roots += QCA::systemStore();
            if (!rootsFile.isEmpty())
                roots += QCA::CertificateCollection::fromFlatTextFile(rootsFile);

            // get nonroots
            QCA::CertificateCollection nonroots;
            if (!nonRootsFile.isEmpty())
                nonroots = QCA::CertificateCollection::fromFlatTextFile(nonRootsFile);

            QCA::Validity v = target.validate(roots, nonroots);
            if (v == QCA::ValidityGood)
                printf("Certificate is valid\n");
            else {
                printf("Certificate is NOT valid: %s\n", qPrintable(validityToString(v)));
                return 1;
            }
        } else {
            usage();
            return 1;
        }
    } else if (args[0] == QLatin1String("keybundle")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("make")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("pkcs12")) {
                fprintf(stderr, "Error: need 'pkcs12' feature.\n");
                return 1;
            }

            QCA::PrivateKey priv = get_K(args[2]);
            if (priv.isNull())
                return 1;

            QCA::Certificate cert = get_C(args[3]);
            if (cert.isNull())
                return 1;

            // get roots
            QCA::CertificateCollection roots;
            if (!nosys)
                roots += QCA::systemStore();
            if (!rootsFile.isEmpty())
                roots += QCA::CertificateCollection::fromFlatTextFile(rootsFile);

            // get nonroots
            QCA::CertificateCollection nonroots;
            if (!nonRootsFile.isEmpty())
                nonroots = QCA::CertificateCollection::fromFlatTextFile(nonRootsFile);

            QList<QCA::Certificate> issuer_pool = roots.certificates() + nonroots.certificates();

            QCA::CertificateChain chain;
            chain += cert;
            chain = chain.complete(issuer_pool);

            QCA::KeyBundle key;
            key.setName(chain.primary().commonName());
            key.setCertificateChainAndKey(chain, priv);

            if (!allowprompt && !have_newpass) {
                fprintf(stderr, "Error: no passphrase specified (use '--newpass=' for none).\n");
                return 1;
            }

            // prompt for new passphrase if necessary
            if (!have_newpass) {
                while (!promptForNewPassphrase(&newpass)) { }
                have_newpass = true;
            }

            if (newpass.isEmpty()) {
                fprintf(stderr, "Error: keybundles cannot have empty passphrases.\n");
                return 1;
            }

            QString newFileName = QStringLiteral("cert.p12");

            if (key.toFile(newFileName, newpass))
                printf("Keybundle saved to %s\n", qPrintable(newFileName));
            else {
                fprintf(stderr, "Error: can't encode keybundle.\n");
                return 1;
            }
        } else if (args[1] == QLatin1String("extract")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyBundle key = get_X(args[2]);
            if (key.isNull())
                return 1;

            QCA::PrivateKey priv        = key.privateKey();
            bool            export_priv = priv.canExport();

            if (export_priv) {
                fprintf(stderr, "You will need to create a passphrase for the extracted private key.\n");

                if (!allowprompt && !have_newpass) {
                    fprintf(stderr, "Error: no passphrase specified (use '--newpass=' for none).\n");
                    return 1;
                }

                // prompt for new passphrase if necessary
                if (!have_newpass) {
                    while (!promptForNewPassphrase(&newpass)) { }
                    have_newpass = true;
                }
            }

            printf("Certs: (first is primary)\n");
            QCA::CertificateChain chain = key.certificateChain();
            for (int n = 0; n < chain.count(); ++n)
                printf("%s", qPrintable(chain[n].toPEM()));
            printf("Private Key:\n");
            if (export_priv) {
                QString out;
                if (!newpass.isEmpty())
                    out = priv.toPEM(newpass);
                else
                    out = priv.toPEM();
                printf("%s", qPrintable(out));
            } else {
                printf("(Key is not exportable)\n");
            }
        } else if (args[1] == QLatin1String("changepass")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyBundle key = get_X(args[2]);
            if (key.isNull())
                return 1;

            if (!key.privateKey().canExport()) {
                fprintf(stderr, "Error: private key not exportable.\n");
                return 1;
            }

            if (!allowprompt && !have_newpass) {
                fprintf(stderr, "Error: no passphrase specified (use '--newpass=' for none).\n");
                return 1;
            }

            // prompt for new passphrase if necessary
            if (!have_newpass) {
                while (!promptForNewPassphrase(&newpass)) { }
                have_newpass = true;
            }

            if (newpass.isEmpty()) {
                fprintf(stderr, "Error: keybundles cannot have empty passphrases.\n");
                return 1;
            }

            QFileInfo fi(args[2]);
            QString   newFileName = fi.baseName() + QStringLiteral("_new.p12");

            if (key.toFile(newFileName, newpass))
                printf("Keybundle saved to %s\n", qPrintable(newFileName));
            else {
                fprintf(stderr, "Error: can't encode keybundle.\n");
                return 1;
            }
        } else {
            usage();
            return 1;
        }
    } else if (args[0] == QLatin1String("keystore")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("list-stores")) {
            ksm_start_and_wait();

            QCA::KeyStoreManager ksm;
            QStringList          storeList = ksm.keyStores();

            for (int n = 0; n < storeList.count(); ++n) {
                QCA::KeyStore ks(storeList[n], &ksm);
                QString       type = kstype_to_string(ks.type());
                printf("%s %s [%s]\n", qPrintable(type), qPrintable(idHash(ks.id())), qPrintable(ks.name()));
            }

            if (debug)
                output_keystore_diagnostic_text();
        } else if (args[1] == QLatin1String("list")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            ksm_start_and_wait();

            QCA::KeyStoreManager ksm;
            QCA::KeyStore        store(getKeyStore(args[2]), &ksm);
            if (!store.isValid()) {
                if (debug)
                    output_keystore_diagnostic_text();

                fprintf(stderr, "Error: no such store\n");
                return 1;
            }

            QList<QCA::KeyStoreEntry> list = store.entryList();
            for (int n = 0; n < list.count(); ++n) {
                QCA::KeyStoreEntry i    = list[n];
                QString            type = ksentrytype_to_string(i.type());
                printf("%s %s [%s]\n", qPrintable(type), qPrintable(idHash(i.id())), qPrintable(i.name()));
            }

            if (debug)
                output_keystore_diagnostic_text();
        } else if (args[1] == QLatin1String("monitor")) {
            KeyStoreMonitor::monitor();

            if (debug)
                output_keystore_diagnostic_text();
        } else if (args[1] == QLatin1String("export")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyStoreEntry entry = get_E(args[2]);
            if (entry.isNull())
                return 1;

            if (entry.type() == QCA::KeyStoreEntry::TypeCertificate)
                printf("%s", qPrintable(entry.certificate().toPEM()));
            else if (entry.type() == QCA::KeyStoreEntry::TypeCRL)
                printf("%s", qPrintable(entry.crl().toPEM()));
            else if (entry.type() == QCA::KeyStoreEntry::TypePGPPublicKey ||
                     entry.type() == QCA::KeyStoreEntry::TypePGPSecretKey)
                printf("%s", qPrintable(entry.pgpPublicKey().toString()));
            else if (entry.type() == QCA::KeyStoreEntry::TypeKeyBundle) {
                fprintf(stderr, "Error: use 'keybundle extract' command instead.\n");
                return 1;
            } else {
                fprintf(stderr, "Error: cannot export type '%d'.\n", entry.type());
                return 1;
            }
        } else if (args[1] == QLatin1String("exportref")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyStoreEntry entry = get_E(args[2]);
            if (entry.isNull())
                return 1;
            printf("%s", make_ksentry_string(entry.toString()).toUtf8().data());
        } else if (args[1] == QLatin1String("addkb")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            ksm_start_and_wait();

            QCA::KeyStoreManager ksm;
            QCA::KeyStore        store(getKeyStore(args[2]), &ksm);
            if (!store.isValid()) {
                fprintf(stderr, "Error: no such store\n");
                return 1;
            }

            QCA::KeyBundle key = get_X(args[3]);
            if (key.isNull())
                return 1;

            if (!store.writeEntry(key).isEmpty())
                printf("Entry written.\n");
            else {
                fprintf(stderr, "Error: unable to write entry.\n");
                return 1;
            }
        } else if (args[1] == QLatin1String("addpgp")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("openpgp")) {
                fprintf(stderr, "Error: need 'openpgp' feature.\n");
                return 1;
            }

            ksm_start_and_wait();

            QCA::KeyStoreManager ksm;
            QCA::KeyStore        store(getKeyStore(args[2]), &ksm);
            if (!store.isValid()) {
                fprintf(stderr, "Error: no such store\n");
                return 1;
            }

            QCA::PGPKey pub = QCA::PGPKey::fromFile(args[3]);
            if (pub.isNull())
                return 1;

            if (!store.writeEntry(pub).isEmpty())
                printf("Entry written.\n");
            else {
                fprintf(stderr, "Error: unable to write entry.\n");
                return 1;
            }
        } else if (args[1] == QLatin1String("remove")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyStoreEntry entry = get_E(args[2]);
            if (entry.isNull())
                return 1;

            QCA::KeyStoreManager ksm;
            QCA::KeyStore        store(entry.storeId(), &ksm);
            if (!store.isValid()) {
                fprintf(stderr, "Error: no such store\n");
                return 1;
            }

            if (store.removeEntry(entry.id()))
                printf("Entry removed.\n");
            else {
                fprintf(stderr, "Error: unable to remove entry.\n");
                return 1;
            }
        } else {
            usage();
            return 1;
        }
    } else if (args[0] == QLatin1String("show")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("cert")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::Certificate cert = get_C(args[2]);
            if (cert.isNull())
                return 1;

            print_cert(cert, ordered);
        } else if (args[1] == QLatin1String("req")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("csr")) {
                fprintf(stderr, "Error: need 'csr' feature.\n");
                return 1;
            }

            QCA::CertificateRequest req(args[2]);
            if (req.isNull()) {
                fprintf(stderr, "Error: can't read/process certificate request file.\n");
                return 1;
            }

            print_certreq(req, ordered);
        } else if (args[1] == QLatin1String("crl")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("crl")) {
                fprintf(stderr, "Error: need 'crl' feature.\n");
                return 1;
            }

            QCA::CRL crl;
            if (is_pem_file(args[2]))
                crl = QCA::CRL::fromPEMFile(args[2]);
            else
                crl = QCA::CRL::fromDER(read_der_file(args[2]));
            if (crl.isNull()) {
                fprintf(stderr, "Error: unable to read/process CRL file.\n");
                return 1;
            }

            print_crl(crl, ordered);
        } else if (args[1] == QLatin1String("kb")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::KeyBundle key = get_X(args[2]);
            if (key.isNull())
                return 1;

            printf("Keybundle contains %d certificates.  Displaying primary:\n", int(key.certificateChain().count()));
            print_cert(key.certificateChain().primary(), ordered);
        } else if (args[1] == QLatin1String("pgp")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            // try for secret key, then try public key
            QCA::PGPKey key = get_S(args[2], true).first;
            if (key.isNull()) {
                key = get_P(args[2]);
                if (key.isNull())
                    return 1;
            }

            print_pgp(key);
        } else {
            usage();
            return 1;
        }
    } else if (args[0] == QLatin1String("message")) {
        if (args.count() < 2) {
            usage();
            return 1;
        }

        if (args[1] == QLatin1String("sign")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            QCA::SecureMessageSystem    *sms;
            QCA::SecureMessageKey        skey;
            QCA::SecureMessage::SignMode mode;
            bool                         pgp = false;

            if (args[2] == QLatin1String("pgp")) {
                if (!QCA::isSupported("openpgp")) {
                    fprintf(stderr, "Error: need 'openpgp' feature.\n");
                    return 1;
                }

                QPair<QCA::PGPKey, QCA::PGPKey> key = get_S(args[3]);
                if (key.first.isNull())
                    return 1;

                sms = new QCA::OpenPGP;
                skey.setPGPSecretKey(key.first);
                mode = QCA::SecureMessage::Clearsign;
                pgp  = true;
            } else if (args[2] == QLatin1String("pgpdetach")) {
                if (!QCA::isSupported("openpgp")) {
                    fprintf(stderr, "Error: need 'openpgp' feature.\n");
                    return 1;
                }

                QPair<QCA::PGPKey, QCA::PGPKey> key = get_S(args[3]);
                if (key.first.isNull())
                    return 1;

                sms = new QCA::OpenPGP;
                skey.setPGPSecretKey(key.first);
                mode = QCA::SecureMessage::Detached;
                pgp  = true;
            } else if (args[2] == QLatin1String("smime")) {
                if (!QCA::isSupported("cms")) {
                    fprintf(stderr, "Error: need 'cms' feature.\n");
                    return 1;
                }

                QCA::KeyBundle key = get_X(args[3]);
                if (key.isNull())
                    return 1;

                // get nonroots
                QCA::CertificateCollection nonroots;
                if (!nonRootsFile.isEmpty())
                    nonroots = QCA::CertificateCollection::fromFlatTextFile(nonRootsFile);

                QList<QCA::Certificate> issuer_pool = nonroots.certificates();

                QCA::CertificateChain chain = key.certificateChain();
                chain                       = chain.complete(issuer_pool);

                sms = new QCA::CMS;
                skey.setX509CertificateChain(chain);
                skey.setX509PrivateKey(key.privateKey());
                mode = QCA::SecureMessage::Detached;
            } else {
                usage();
                return 1;
            }

            // read input data from stdin all at once
            QByteArray plain;
            while (!feof(stdin)) {
                QByteArray block(1024, 0);
                int        n = fread(block.data(), 1, 1024, stdin);
                if (n < 0)
                    break;
                block.resize(n);
                plain += block;
            }

            // smime envelope
            if (!pgp) {
                QString text = add_cr(QString::fromUtf8(plain));
                plain        = QString::fromLatin1(mime_signpart).arg(text).toUtf8();
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            msg->setSigner(skey);
            // pgp should always be ascii
            if (pgp)
                msg->setFormat(QCA::SecureMessage::Ascii);
            msg->setBundleSignerEnabled(!nobundle);
            msg->startSign(mode);
            msg->update(plain);
            msg->end();
            msg->waitForFinished(-1);

            if (debug) {
                output_keystore_diagnostic_text();
                output_message_diagnostic_text(msg);
            }

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;

                fprintf(stderr, "Error: unable to sign: %s\n", qPrintable(errstr));
                return 1;
            }

            QString hashName = msg->hashName();

            QByteArray output;
            if (mode == QCA::SecureMessage::Detached)
                output = msg->signature();
            else
                output = msg->read();

            delete msg;
            delete sms;

            // smime envelope
            if (!pgp) {
                QCA::Base64 enc;
                enc.setLineBreaksEnabled(true);
                enc.setLineBreaksColumn(76);
                QString sigtext = add_cr(enc.arrayToString(output));
                QString str     = QString::fromLatin1(mime_signed).arg(hashName, QString::fromUtf8(plain), sigtext);
                output          = str.toUtf8();
            }

            printf("%s", output.data());
        } else if (args[1] == QLatin1String("encrypt")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            QCA::SecureMessageSystem *sms;
            QCA::SecureMessageKey     skey;
            bool                      pgp = false;

            if (args[2] == QLatin1String("pgp")) {
                if (!QCA::isSupported("openpgp")) {
                    fprintf(stderr, "Error: need 'openpgp' feature.\n");
                    return 1;
                }

                QCA::PGPKey key = get_P(args[3]);
                if (key.isNull())
                    return 1;

                sms = new QCA::OpenPGP;
                skey.setPGPPublicKey(key);
                pgp = true;
            } else if (args[2] == QLatin1String("smime")) {
                if (!QCA::isSupported("cms")) {
                    fprintf(stderr, "Error: need 'cms' feature.\n");
                    return 1;
                }

                QCA::Certificate cert = get_C(args[3]);
                if (cert.isNull())
                    return 1;

                sms = new QCA::CMS;
                skey.setX509CertificateChain(cert);
            } else {
                usage();
                return 1;
            }

            // read input data from stdin all at once
            QByteArray plain;
            while (!feof(stdin)) {
                QByteArray block(1024, 0);
                int        n = fread(block.data(), 1, 1024, stdin);
                if (n < 0)
                    break;
                block.resize(n);
                plain += block;
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            msg->setRecipient(skey);
            // pgp should always be ascii
            if (pgp)
                msg->setFormat(QCA::SecureMessage::Ascii);
            msg->startEncrypt();
            msg->update(plain);
            msg->end();
            msg->waitForFinished(-1);

            if (debug) {
                output_keystore_diagnostic_text();
                output_message_diagnostic_text(msg);
            }

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;
                fprintf(stderr, "Error: unable to encrypt: %s\n", qPrintable(errstr));
                return 1;
            }

            QByteArray output = msg->read();
            delete msg;
            delete sms;

            // smime envelope
            if (!pgp) {
                QCA::Base64 enc;
                enc.setLineBreaksEnabled(true);
                enc.setLineBreaksColumn(76);
                QString enctext = add_cr(enc.arrayToString(output));
                QString str     = QString::fromLatin1(mime_enveloped).arg(enctext);
                output          = str.toUtf8();
            }

            printf("%s", output.data());
        } else if (args[1] == QLatin1String("signencrypt")) {
            if (args.count() < 4) {
                usage();
                return 1;
            }

            if (!QCA::isSupported("openpgp")) {
                fprintf(stderr, "Error: need 'openpgp' feature.\n");
                return 1;
            }

            QCA::SecureMessageSystem *sms;
            QCA::SecureMessageKey     skey;
            QCA::SecureMessageKey     rkey;

            {
                QPair<QCA::PGPKey, QCA::PGPKey> sec = get_S(args[2]);
                if (sec.first.isNull())
                    return 1;

                QCA::PGPKey pub = get_P(args[3]);
                if (pub.isNull())
                    return 1;

                sms = new QCA::OpenPGP;
                skey.setPGPSecretKey(sec.first);
                rkey.setPGPPublicKey(pub);
            }

            // read input data from stdin all at once
            QByteArray plain;
            while (!feof(stdin)) {
                QByteArray block(1024, 0);
                int        n = fread(block.data(), 1, 1024, stdin);
                if (n < 0)
                    break;
                block.resize(n);
                plain += block;
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            if (!msg->canSignAndEncrypt()) {
                delete msg;
                delete sms;
                fprintf(stderr, "Error: cannot perform integrated sign and encrypt.\n");
                return 1;
            }

            msg->setSigner(skey);
            msg->setRecipient(rkey);
            msg->setFormat(QCA::SecureMessage::Ascii);
            msg->startSignAndEncrypt();
            msg->update(plain);
            msg->end();
            msg->waitForFinished(-1);

            if (debug) {
                output_keystore_diagnostic_text();
                output_message_diagnostic_text(msg);
            }

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;
                fprintf(stderr, "Error: unable to sign and encrypt: %s\n", qPrintable(errstr));
                return 1;
            }

            QByteArray output = msg->read();
            delete msg;
            delete sms;

            printf("%s", output.data());
        } else if (args[1] == QLatin1String("verify")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::SecureMessageSystem *sms;
            bool                      pgp = false;

            if (args[2] == QLatin1String("pgp")) {
                if (!QCA::isSupported("openpgp")) {
                    fprintf(stderr, "Error: need 'openpgp' feature.\n");
                    return 1;
                }

                sms = new QCA::OpenPGP;
                pgp = true;
            } else if (args[2] == QLatin1String("smime")) {
                if (!QCA::isSupported("cms")) {
                    fprintf(stderr, "Error: need 'cms' feature.\n");
                    return 1;
                }

                // get roots
                QCA::CertificateCollection roots;
                if (!nosys)
                    roots += QCA::systemStore();
                if (!rootsFile.isEmpty())
                    roots += QCA::CertificateCollection::fromFlatTextFile(rootsFile);

                // get intermediates and possible signers, in case
                //   the message does not have them.
                QCA::CertificateCollection nonroots;
                if (!nonRootsFile.isEmpty())
                    nonroots += QCA::CertificateCollection::fromFlatTextFile(nonRootsFile);

                sms = new QCA::CMS;
                ((QCA::CMS *)sms)->setTrustedCertificates(roots);
                ((QCA::CMS *)sms)->setUntrustedCertificates(nonroots);
            } else {
                usage();
                return 1;
            }

            QByteArray data, sig;
            QString    smime_text;
            {
                // read input data from stdin all at once
                QByteArray plain;
                while (!feof(stdin)) {
                    QByteArray block(1024, 0);
                    int        n = fread(block.data(), 1, 1024, stdin);
                    if (n < 0)
                        break;
                    block.resize(n);
                    plain += block;
                }

                if (pgp) {
                    // pgp can be either a detached signature followed
                    //  by data, or an integrated message.

                    // detached signature?
                    if (plain.startsWith("-----BEGIN PGP SIGNATURE-----")) {
                        QByteArray footer = "-----END PGP SIGNATURE-----\n";
                        int        n      = plain.indexOf(footer);
                        if (n == -1) {
                            delete sms;
                            fprintf(stderr, "Error: pgp signature header, but no footer.\n");
                            return 1;
                        }

                        n += footer.length();
                        sig  = plain.mid(0, n);
                        data = plain.mid(n);
                    } else {
                        data = plain;
                    }
                } else {
                    // smime envelope
                    QString in = QString::fromUtf8(plain);
                    in         = add_cr(in); // change the line endings?!
                    QString str, sigtext;
                    if (!open_mime_data_sig(in, &str, &sigtext)) {
                        fprintf(stderr, "Error: can't parse message file.\n");
                        return 1;
                    }

                    data       = str.toUtf8();
                    smime_text = str;

                    QCA::Base64 dec;
                    dec.setLineBreaksEnabled(true);
                    sig = dec.stringToArray(rem_cr(sigtext)).toByteArray();
                }
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            if (pgp)
                msg->setFormat(QCA::SecureMessage::Ascii);
            msg->startVerify(sig);
            msg->update(data);
            msg->end();
            msg->waitForFinished(-1);

            if (debug) {
                output_keystore_diagnostic_text();
                output_message_diagnostic_text(msg);
            }

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;
                fprintf(stderr, "Error: verify failed: %s\n", qPrintable(errstr));
                return 1;
            }

            QByteArray output;
            if (pgp && sig.isEmpty())
                output = msg->read();

            QList<QCA::SecureMessageSignature> signers = msg->signers();
            delete msg;
            delete sms;

            // for pgp clearsign, pgp signed (non-detached), and smime,
            //   the signed content was inside of the message.  we need
            //   to print that content now
            if (pgp) {
                printf("%s", output.data());
            } else {
                QString str = open_mime_envelope(smime_text);
                printf("%s", str.toUtf8().data());
            }

            smDisplaySignatures(signers);

            bool allgood = true;
            foreach (const QCA::SecureMessageSignature &signer, signers) {
                if (signer.identityResult() != QCA::SecureMessageSignature::Valid) {
                    allgood = false;
                    break;
                }
            }

            if (!allgood)
                return 1;
        } else if (args[1] == QLatin1String("decrypt")) {
            if (args.count() < 3) {
                usage();
                return 1;
            }

            QCA::SecureMessageSystem *sms;
            bool                      pgp = false;

            if (args[2] == QLatin1String("pgp")) {
                if (!QCA::isSupported("openpgp")) {
                    fprintf(stderr, "Error: need 'openpgp' feature.\n");
                    return 1;
                }

                ksm_start_and_wait();

                sms = new QCA::OpenPGP;
                pgp = true;
            } else if (args[2] == QLatin1String("smime")) {
                if (args.count() < 4) {
                    usage();
                    return 1;
                }

                if (!QCA::isSupported("cms")) {
                    fprintf(stderr, "Error: need 'cms' feature.\n");
                    return 1;
                }

                // user can provide many possible decrypt keys
                QList<QCA::KeyBundle> keys;
                for (int n = 3; n < args.count(); ++n) {
                    QCA::KeyBundle key = get_X(args[n]);
                    if (key.isNull())
                        return 1;
                    keys += key;
                }

                sms = new QCA::CMS;

                QList<QCA::SecureMessageKey> skeys;
                foreach (const QCA::KeyBundle &key, keys) {
                    QCA::SecureMessageKey skey;
                    skey.setX509CertificateChain(key.certificateChain());
                    skey.setX509PrivateKey(key.privateKey());
                    skeys += skey;
                }

                ((QCA::CMS *)sms)->setPrivateKeys(skeys);
            } else {
                usage();
                return 1;
            }

            // read input data from stdin all at once
            QByteArray plain;
            while (!feof(stdin)) {
                QByteArray block(1024, 0);
                int        n = fread(block.data(), 1, 1024, stdin);
                if (n < 0)
                    break;
                block.resize(n);
                plain += block;
            }

            // smime envelope
            if (!pgp) {
                QString in  = QString::fromUtf8(plain);
                QString str = open_mime_envelope(in);
                if (str.isEmpty()) {
                    delete sms;
                    fprintf(stderr, "Error: can't parse message file.\n");
                    return 1;
                }

                QCA::Base64 dec;
                dec.setLineBreaksEnabled(true);
                plain = dec.stringToArray(rem_cr(str)).toByteArray();
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            if (pgp)
                msg->setFormat(QCA::SecureMessage::Ascii);
            msg->startDecrypt();
            msg->update(plain);
            msg->end();
            msg->waitForFinished(-1);

            if (debug) {
                output_keystore_diagnostic_text();
                output_message_diagnostic_text(msg);
            }

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;
                fprintf(stderr, "Error: decrypt failed: %s\n", qPrintable(errstr));
                return 1;
            }

            QByteArray output = msg->read();

            QList<QCA::SecureMessageSignature> signers;
            bool                               wasSigned = false;
            if (msg->wasSigned()) {
                signers   = msg->signers();
                wasSigned = true;
            }
            delete msg;
            delete sms;

            printf("%s", output.data());

            if (wasSigned) {
                fprintf(stderr, "Message was also signed:\n");

                smDisplaySignatures(signers);

                bool allgood = true;
                foreach (const QCA::SecureMessageSignature &signer, signers) {
                    if (signer.identityResult() != QCA::SecureMessageSignature::Valid) {
                        allgood = false;
                        break;
                    }
                }

                if (!allgood)
                    return 1;
            }
        } else if (args[1] == QLatin1String("exportcerts")) {
            if (!QCA::isSupported("cms")) {
                fprintf(stderr, "Error: need 'cms' feature.\n");
                return 1;
            }

            QCA::SecureMessageSystem *sms = new QCA::CMS;

            QByteArray data, sig;
            QString    smime_text;
            {
                // read input data from stdin all at once
                QByteArray plain;
                while (!feof(stdin)) {
                    QByteArray block(1024, 0);
                    int        n = fread(block.data(), 1, 1024, stdin);
                    if (n < 0)
                        break;
                    block.resize(n);
                    plain += block;
                }

                // smime envelope
                QString in = QString::fromUtf8(plain);
                QString str, sigtext;
                if (!open_mime_data_sig(in, &str, &sigtext)) {
                    delete sms;
                    fprintf(stderr, "Error: can't parse message file.\n");
                    return 1;
                }

                data       = str.toUtf8();
                smime_text = str;

                QCA::Base64 dec;
                dec.setLineBreaksEnabled(true);
                sig = dec.stringToArray(rem_cr(sigtext)).toByteArray();
            }

            QCA::SecureMessage *msg = new QCA::SecureMessage(sms);
            msg->startVerify(sig);
            msg->update(data);
            msg->end();
            msg->waitForFinished(-1);

            if (debug)
                output_message_diagnostic_text(msg);

            if (!msg->success()) {
                QString errstr = smErrorToString(msg->errorCode());
                delete msg;
                delete sms;
                fprintf(stderr, "Error: export failed: %s\n", qPrintable(errstr));
                return 1;
            }

            QList<QCA::SecureMessageSignature> signers = msg->signers();
            delete msg;
            delete sms;

            // print out all certs of all signers
            foreach (const QCA::SecureMessageSignature &signer, signers) {
                QCA::SecureMessageKey key = signer.key();
                if (!key.isNull()) {
                    foreach (const QCA::Certificate &c, key.x509CertificateChain())
                        printf("%s", qPrintable(c.toPEM()));
                }
            }
        } else {
            usage();
            return 1;
        }
    } else {
        usage();
        return 1;
    }

    return 0;
}

#include "main.moc"