#!@POSIXSHELL@
#
# swverify  -- Verify Software
# An IEEE 1387.2 Conforming Utility with Extensions.
#
# Copyright (C) 2004 Jim Lowe
#
# COPYING TERMS AND CONDITIONS:
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

trap '/bin/rm -fr /tmp/swverify.$$; exit 1' 1 2 15

SHELL="@POSIXSHELL@"
SWBISLIBEXECDIR="@SWBISLIBEXECDIR@/"
SWBIS_RELEASE=@SWBIS_RELEASE@
export GTAR="@SWBISGTAR@"
INSTALLED_SOFTWARE_CATALOG=var/lib/swbis/catalog

version() {
	echo "swverify (swbis) version" ${SWBIS_RELEASE}
	echo "Copyright (C) 2003,2004,2005,2006 Jim Lowe"
	echo "This software is distributed under the terms of the GNU General Public License"
	echo "and comes with NO WARRANTY to the extent permitted by law."
	echo "See the file named COPYING for details."
	exit 0;
}

help() {
		echo  -e -n "\
	Usage: swverify -r software_selections [@ target]\n\
	       swverify -d [@ target]\n\
	       swverify\n\
	       swverify --checksig [FILE]\n\
	       swverify [-Wd] {-WC|-WS}\n\
	       swverify -W emit-digest-file FILE\n\
        Other posix options not yet implemented.\n\
\n\
	     -r   verify installed software [posix option]\n\
	             Currently this only verifies the GPG signature\n\
	             of the exported catalog (which is the package signature).\n\
	     -d   verify a software distribution [posix option]\n\
	     -x verbose=N  Specify verbose level N, where N=1,2,3,... \n\
	     --checksig  [FILE]  Verifies the archive md5 (and sha1) and gpg\n\
		     signature. FILE may be a tar archive, directory name or \"-\".\n\
		     (performs same operations as -d @target)\n\
	     -W <option>[=value]   Implementation extension option\n\
	     -W show-auth-files  Applies to emit-signed-file and emit-digest-file\n\
	     -W sha1   applies to -Wshow-auth-files operation.\n\
	     -W d  same as -Wshow-auth-files.\n\
	     -W checksig [FILE]  same as --checksig.\n\
	     -W emit-signed-file [FILE]  Writes the signed data to stdout.\n\
	     -W C   same as -W emit-signed-file [FILE].\n\
	     -W emit-digest-file [FILE]  Writes the digested archive data to stdout.\n\
	     -W S   same as -W emit-digest-file.\n\
	     -W sig-number=N Verify the Nth signature, (0 is last, 1 is first). \n\
	     -W owner=OWNER    Specify OWNER\n\
	     -W group=GROUP    Specify GROUP\n\
	     -W get-sig-if=outputfile [FILE]  Verifies the archive digests \n\
	                 by comparing to the digests in the catalog and if they match\n\
	               write the sigfile to outputfile and the signed data to stdout.\n\
	\n\
	The --checksig option and package signing are implementation extensions\n\
	of the swbis project.  All other options are not implemented.\n\
	\n\
	To verify a signed tarball: \n\
		swverify -d @- <somepackage-0.1.tar.gz\n\
	\n\
	To verify a unpacked tarball: \n\
		swverify -d @`pwd`/somepackage-0.1\n\
	\n\
		Note: this requires the package contain the\n\
			somepackage-0.1/catalog/dfiles/checksig\n\
			control script.\n\
	\n\
	Identification: swverify  -- Date: 2006-02-18\n\
	\n\
	Report bugs to <bug-swbis@gnu.org>\n\
	" | sed -e 's/^[[:space:]]//'
}

missing_which() {
	pgm="$1"
	xxname=`which $pgm 2>/dev/null`
	test -f "$xxname" -o -h "$xxname"
	case "$?" in
		0)
			echo "$xxname"
			return 0
			;;
		*)
			echo "Missing $pgm" 1>&2
			echo "/"
			return 1
			;;
	esac
}

verify_sig_pax() {
	case "$PAX" in
		"/")
			return 1
			;;
		"")
			return 1
			;;
	esac

	"${FIND}" "$dirbase"/catalog  -print | $GREP -v '[^/]*/catalog/dfiles/signature*' |
	"${PAX}" -d -w -b 512 | "${GPG}" --verify "$sigfile" - 
	case "$?" in
		0)
			detected_username="$username"
			detected_groupname="$groupname"
			return 0
			;;
		*)
			detected_username="root"
			detected_groupname="root"
			return 1
			;;
	esac
	return 1
}

try_verify() {
	"${TAR}" cf - ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC} \
		--exclude=$sigfile  "$dirbase"/catalog |
	"${GPG}" --verify "$sigfile" - 
	return $?
}

verify_sig_tar_per_verbose() {
	if [ "$uverbose" -ge 3 ]; then
		verify_sig_tar
	else
		verify_sig_tar 1>/dev/null 2>&1
	fi
	return $?
}

verify_sig_pax_per_verbose() {
	if [ "$uverbose" -ge 3 ]; then
		verify_sig_pax
	else
		verify_sig_pax 1>/dev/null 2>&1
	fi
	return $?
}

emit_tar_option_lines() {
	l_gnu_tar_version="$1"
	case "$l_gnu_tar_version" in 
		1.14*|1.15*)
			echo "--format=ustar -b1"
			echo "--format=oldgnu -b1"
			echo "--format=gnu -b1"
			;;
		1.13*)
			echo "--posix -b1"
			echo "-b1"
			;;
		*)
			exit 31
			;;
	esac
}

check_for_gnu_tar()
{
	gnu_tar_version="`$TAR --version 2>&1 | $GREP GNU | $HEAD -1 | awk '{print $NF}'`"
	case "$gnu_tar_version" in 
		2.[0-9].*)
			echo 1>/dev/null
		;;
#		1.14*)
#			echo GNU tar version 1.13.17, 1.13.25 or 1.15.x is required for this test. 1>&2
#			echo You have tar [$gnu_tar_version]. 1>&2
#			return 1
#		;;
		1.14*|1.15*|1.13.17|1.13.25)
			echo 1>/dev/null
			#echo "It looks like you have a suitable version of GNU tar [$gnu_tar_version]." 1>&2
		;;
		*)
		echo GNU tar version 1.13.17 or 1.13.25 is required for this test. 1>&2
		echo You have tar [$gnu_tar_version]. 1>&2
		return 1
		;;
	esac
	return 0
}

make_format_option()
{
	case "$gnu_tar_version" in 
		1.15*)
			case "$opt_format" in
				gnu)
					GNUTAR_FORMAT_OPTIONS="--format=gnu"
					SWPACKAGE_FORMAT_OPTIONS="--format=gnu"
					;;
				gnutar|oldgnu)
					GNUTAR_FORMAT_OPTIONS="--format=oldgnu"
					SWPACKAGE_FORMAT_OPTIONS="--format=oldgnu"
					;;
				ustar)
					GNUTAR_FORMAT_OPTIONS="--format=ustar"
					SWPACKAGE_FORMAT_OPTIONS="--format=ustar"
					;;
			esac
		;;
		1.13.*)
			case "$opt_format" in
				gnu)
					echo "gnu format not supported by swign for GNU tar $gnu_tar_version" 1>&2 
					return 1
					;;
				gnutar|oldgnu)
					GNUTAR_FORMAT_OPTIONS=""
					SWPACKAGE_FORMAT_OPTIONS="--format=oldgnu"
					;;
				ustar)
					GNUTAR_FORMAT_OPTIONS="--posix"
					SWPACKAGE_FORMAT_OPTIONS="--format=ustar0"
					;;
			esac
		;;
		*)
			GNUTAR_FORMAT_OPTIONS=""
			echo internal error in make_format_options 1>&2
			return 1
		;;
	esac
	return 0
}

verify_sig_tar() {
	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=$username --group=$groupname"
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric=""
			detected_username="$username"
			detected_groupname="$groupname"
			return 0
			;;
	esac

	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=root --group=root"
	echo "swverify: Attempting to verify with root ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric=""
			detected_username="root"
			detected_groupname="root"
			return 0
			;;
	esac

	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=0 --group=0 --numeric-owner"
	echo "swverify: Attempting to verify with root numeric ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric="--numeric-owner"
			detected_username="0"
			detected_groupname="0"
			return 0
			;;
	esac

	tmpuid="$sesuid"	
	tmpgid="$sesgid"	
	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=$tmpuid --group=$tmpgid --numeric-owner"
	echo "swverify: Attempting to verify with session numeric ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric="--numeric-owner"
			detected_username="$tmpuid"
			detected_groupname="$tmpgid"
			return 0
			;;
	esac

	if [ "$opt_owner" -o "$opt_group" ]; then
	tmpuid=${opt_owner:-$sesuid}
	tmpgid=${opt_group:-$sesgid}
	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=$tmpuid --group=$tmpgid --numeric-owner"
	echo "swverify: Attempting to verify with specified numeric ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric="--numeric-owner"
			detected_username="$tmpuid"
			detected_groupname="$tmpgid"
			return 0
			;;
	esac

	tmpuid=${opt_owner:-$sesuid}
	tmpgid=${opt_group:-$sesgid}
	echo "swverify:"
	GNUTAR_OWNER_SPEC="--owner=$tmpuid --group=$tmpgid"
	echo "swverify: Attempting to verify with specified ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric=""
			detected_username="$tmpuid"
			detected_groupname="$tmpgid"
			return 0
			;;
	esac
	fi
	
	echo "swverify:"
	GNUTAR_OWNER_SPEC=""
	echo "swverify: Attempting to verify with root numeric ownerships."
	echo "swverify: GNU tar options: ${GNUTAR_OPTIONS} ${GNUTAR_OWNER_SPEC}"
	try_verify
	case "$?" in
		0)
			detected_is_numeric=""
			detected_username=""
			detected_groupname=""
			return 0
			;;
	esac

	detected_username=""
	detected_groupname=""
	return 1
}


is_ambig() {
	cn=""
	line=""
	while read line
	do
		cn="${cn}."
		last="$line"
		#echo "ambiglast=$line" 1>&2
	done
	echo "$last"
	return `[ ${#cn} -eq 1 ]`
}

resolve_selection() {
	sel="$1"
	target="$2"
	cd "$target"
	case $? in
		0) ;; *) return 1;;
	esac
	
	first=${sel%.*}
	second=${sel#*.}
	
	path0="${INSTALLED_SOFTWARE_CATALOG}"/"$first"
	path1="${INSTALLED_SOFTWARE_CATALOG}"/"$first"/"$second"
#echo "path0=[$path0]" 1>&2
#echo "path1=[$path1] " 1>&2
#echo "pwd: " `pwd`  1>&2
#echo path0: `ls -l $path0` 1>&2
#echo path1: `ls -l $path1` 1>&2

	last0=`ls -1drt "$path0" | is_ambig`
	case "$?" in 0) ;; *) return 8;; esac	

	last1=`ls -1drt "$path1" | is_ambig`
	case "$?" in 0) ;; *) return 10;; esac	
#echo "last0=[$last0]" 1>&2
#echo "last1=[$last1]" 1>&2

	lastrev=`ls -1drt "$last1"/* | is_ambig`
	lastseq=`ls -1drt "$lastrev"/* | is_ambig`
#echo "lastseq=[$lastseq]" 1>&2
	echo "$lastseq"
	return 0
}

if [ "$1" = "--help" ]; then
	help 
	exit 0
fi

GETOPT="${SWBISLIBEXECDIR}/swbis/getopt"
d=""
mode="checksig"
sigoutputfile=""
sha1=""
uverbose=2
signumber=0
posixmode=""
useform="distribution"
did_file=""

case "$GTAR" in "") GTAR=tar; ;; esac
BASH=/bin/bash
ID=`missing_which id` || exit 1
GPG=`missing_which gpg 2>/dev/null`
GPGBASENAME=`basename "$GPG"`
RM=`missing_which rm` || exit 1
PAX=`missing_which pax 2>/dev/null`
MKFIFO=`missing_which mkfifo` || exit 1
HEAD=`missing_which head` || exit 1
GREP=`missing_which grep` || exit 1
EGREP=`missing_which egrep` || exit 1
TAIL=`missing_which tail` || exit 1
EXPAND=`missing_which expand` || exit 1
SED=`missing_which sed` || exit 1
CAT=`missing_which cat` || exit 1
TAR=`missing_which $GTAR` || exit 1
SORT=`missing_which sort` || exit 1
FIND=`missing_which find` || exit 1
MKDIR=`missing_which mkdir` || exit 1
SUM=`PATH=/bin:/usr/bin: missing_which sum` || exit 1
UUIDGEN=`PATH=/bin:/usr/bin: missing_which uuidgen 2>/dev/null`
UUIDGEN=""

username=`${ID} |  ${SED} -e 's/.*uid=[0-9]*(\([^(]*\)).*/\1/'`
groupname=`${ID} |  ${SED} -e 's/.*gid=[0-9]*(\([^(]*\)).*/\1/'`
sigret=127

opt_owner=""
opt_group=""

TEMP=`${GETOPT} -o rdvVHYW:x: --long r,d,version,help,checksig,implementation-extension:,extended-option: \
     -n 'swverify' -- "$@"`

if [ $? != 0 ] ; then echo "Terminating..." >&2 ; exit 1 ; fi

# Note the quotes around `$TEMP': they are essential!
eval set -- "$TEMP"
nargs=$#

did_use_checksig=""
did_use_dash_d=""

while [ "true" ]; do
	case "$1" in
		-Y|--checksig)  mode="checksig"
				useform="distribution"
				did_use_checksig="yes"
				posixmode=""
				shift
				;;
		-x)
			shift;
			case "$1" in
				verbose=*)
					uverbose=`echo "$1" | sed -e 's/.*=//'`
					shift;
					;;
				*)
					echo "swverify: unsupported extended option" 1>&2
					exit 1
					;;
			esac
		;;
		-W|--implementation-extension|-x)
			shift;
			case "$1" in
				sha1)
					sha1="--sha1"
					shift;
					;;
				S)
					mode="emit-digest-file"
					shift;
					;;
				C)
					mode="emit-signed-file"
					shift;
					;;	
				checksig|emit-signed-file|emit-digest-file)
					mode="$1"
					shift;
					;;	
				d|show-auth-files)
					d="-d"
					shift;
					;;
				owner=*)
					opt_owner=`echo "$1" | sed -e 's/.*=//'`
					shift;
					;;
				group=*)
					opt_group=`echo "$1" | sed -e 's/.*=//'`
					shift;
					;;
				sig-number=*)
					signumber=`echo "$1" | sed -e 's/.*=//'`
					shift;
					;;
				get-sig-if=*)
					mode="get-sig-if"
					sigoutputfile=`echo "$1" | sed -e 's/.*=//'`
					shift;
					;;
			esac
			;;
		-d) mode="checksig"; posixmode=""; useform="distribution"
				did_use_dash_d="yes"
				shift
				;;
		-r) mode="posix"; posixmode="yes"; useform="installed"; shift;;
		-H|--help) help; exit 0 ;;
		-V|--version) version; exit 0 ;;
		-v|--verbose) uverbose=`expr $uverbose + 1`; shift; ;;
		--) shift;
			#case "$nargs" in
			#posixmode=""; useform="distribution";
			#;;
			#esac
			break ;;
		*) echo "$0"; help 1>&2; exit 1 ;;
	esac
done

TRUE=`missing_which true`

case "$mode" in
	checksig|emit-signed-file|emit-digest-file|get-sig-if|posix)
		;;
	*)
		#help  1>&2
		exit 1
		;;
esac

if [ "$useform" = "installed"  -a "$1" = "" ]; then
	echo "swverify: invalid usage, must supply a selection arg" 1>&2	
	exit 1;
fi

if [ "$1" = "" ]; then
	filename=""
else
	filename="$1"
	shift
fi

targetpath="$filename"
target="/"
arg=""

if [ "$mode" = "posix" -a "$useform" = "installed" ]; then
	while [ "$1" ]; do
		arg="$1"
		shift;
	done
	if [ "$arg" ]; then
		target="${arg#@}"
	fi
	selection="$filename"
	filename=`resolve_selection "$selection" "$target"`
	case "$filename" in
		"")
		echo "swverify: selection not found" 1>&2
		exit 1
		;;
	esac
	if [ "$uverbose" -ge 2 ]; then
		echo "swverify: verifying installed software at:"
		echo "swverify: $target/$filename"
	fi

	sigfilename=""
	tmpfilename="$filename"
	filename=`ls -d "$target"/"$tmpfilename"/export/catalog.tar 2>/dev/null`
	case "$filename" in
		"")
			filename=`ls -d "$target"/"$tmpfilename"/import2/catalog.tar.gz 2>/dev/null`
			case "$filename" in
				"")
				;;
				*)
					echo "swverify: error: the installed software catalog is an incompatible version" 1>&2
				exit 1
				;;
			esac	
			sigfile2=`ls -d "$target"/"$tmpfilename"/export/catalog.tar.sig 2>/dev/null`
			;;
	esac
	case "$filename" in
		"")
		echo "swverify: catalog appears corrupt or incompatible with current version" 1>&2
		exit 1
		;;
	esac

elif [ "$mode" = "checksig" -a "$useform" = "distribution" ]; then
	is_target=""
	case "$filename" in
		"@")
			is_target="yes"
			filename="$1"
			;;
		@*)
			is_target="yes"
			filename="${filename#@}"
			;;
	esac
	if [ "$uverbose" -ge 3 ]; then
		echo "target=$filename" 1>&2
	fi
	case "$filename" in
		"")
			filename="-"
			;;
		"@")
			filename="$1"
			;;
		@:*)
			filename="${filename#@}"
			filename="${filename#:}"
			;;
		@*)
			filename="${filename#@}"
			;;
		:*)
			filename="${filename#:}"
			;;
		/*)
			;;
		.)
			;;
		-)
			;;
		*)
			if [ ! "$is_target" -a ! "$did_use_checksig" ]; then
				echo "swverify: software selections not supported for this operation" 1>&2
				exit 1
			fi
			if [ "$is_target" -a "$did_use_dash_d" ]; then
				echo "swverify: remote operations not supported" 1>&2
				exit 1
			fi
			;;
	esac
fi

if [ "$filename" = "" ]; then
	filename="-"
fi

if [ "$filename" = "." ]; then
	filename=`pwd`
fi


case "$filename" in
	-|.)
		;;
	*) 
	if [ ! -e "$filename" ]; then
		echo "swverify: $filename : file not found." 1>&2
		echo "swverify: Package authenticity not confirmed." 1>&2
		exit 1
	fi
		;;
esac

sesuid=`$ID | $SED -e 's/^.*uid=\([0-9][0-9]*\)(.*/\1/'`
sesgid=`$ID | $SED -e 's/^.*gid=\([0-9][0-9]*\)(.*/\1/'`

detected_username="$username"
detected_groupname="$groupname"
detected_uid="$sesuid"
detected_uid="$sesgid"

GNUTAR_ROOT_OWNER_SPEC="--owner=root --group=root"
case "$username" in
	root)
		GNUTAR_ROOT_OWNER_SPEC=""
		;;		
esac

if [ -f "$filename" -a "$useform" = "installed" ]; then
	if [ "$uverbose" -ge 3 ]; then
		echo "swverify: "
		echo "swverify: Attempting to verify catalog.tar file."
	fi
	"${GPG}" --verify "$sigfile2" "$filename"
	sigret=$?
elif [ -d "$filename" -a "$useform" = "distribution" ]; then
	#
	# --checksig for a distribution directory.
	# Verify a directory containing a POSIX distribution.
	#
	did_file="yes"

	redir_error=""
	dir="$filename"
	dirbase=`basename "$dir"`
	cd "$dir" 
	case $? in
		0)
			;;
		*)
			echo "cd: $dir: No such file or directory" 1>&2
			exit 1
			;;
	esac
	cd ..
	
	sigfile=`$FIND "$dirbase"/catalog -print | ${GREP} /signature`
	check_for_gnu_tar
	case $? in
		0)
			;;
		*)
			echo "swverify: GNU tar not found" 1>&2
			exit 1
			;;	
	esac
	
	sigret=1
	if [ "$sigfile" ]; then
		#
		# Attempt to verify the unpack tar package
		#
		emit_tar_option_lines "$gnu_tar_version" |
		(
		sigret=1
		while read option_line 
		do
			#GNUTAR_OPTIONS="--posix -b1"
			GNUTAR_OPTIONS="$option_line"
			if [ "$uverbose" -ge 3 ]; then
				echo "swverify: "
				echo "swverify: Attempting to verify using $GNUTAR_OPTIONS options."
			fi
			verify_sig_tar_per_verbose
			sigret=$?
			case $sigret in
				0)
					break
					;;
			esac
		done
                exit $sigret
                )
                sigret=$?
	else
		#
		# The package is not signed
		#
		sigret=10001
	fi

	case $sigret in
		0)
			#
			# Good signature.
			#
			if [ "$uverbose" -ge 2 ]; then
				echo "swverify: GPG signature verified."
			fi
			;;
		10001)
			redir_error="1>&2"
			sigret=1
			if [ "$uverbose" -ge 2 ]; then
				echo "swverify: sig file not found" 1>&2
			fi
			exit 1
			;;
		*)
			redir_error="1>&2"
			case "$posixmode" in
				"")
				if [ "$uverbose" -ge 2 ]; then
				echo "swverify: Signature failed.  Vendor checksig script not executed." 1>&2
				echo "swverify: If attempting to verify the (unpacked) directory form then" 1>&2
				echo "swverify: there are many possible causes: GNU tar version mis-match," 1>&2
				echo "swverify: file system directory entry order incompatibility, or the user" 1>&2
				echo "swverify: name and ids on this system do not match the system that created" 1>&2
				echo "swverify: the package, and last but not least the package is corrupt." 1>&2
				echo "swverify: See the INDEX:tar_format_emulation_utility  attribute to" 1>&2
				echo "swverify: determine the tar format emulation.  GNU tar 1.14,1.15.x cannot" 1>&2
				echo "swverify: produce the signed bytestream of ustar packages created using" 1>&2
				echo "swverify: swbis versions <=0.420 since it emulated version 1.13.25." 1>&2
				echo "swverify: Another possible reason is you have GNU tar 1.13.25 and the" 1>&2
				echo "swverify: package was made with GNU swpackage version >0.420" 1>&2
				echo "swverify: To verify the unpacked form, an Ext2, almost any old Unix, or Ext3" 1>&2
				echo "swverify: (with b-tree indexes turn off) file system is required" 1>&2
				echo "swverify: Package authenticity not confirmed." 1>&2
				fi
				exit 1
				;;
				"yes") # posix mode (-r option)
					if [ "$uverbose" -ge 1 ]; then
				echo "swverify: error: installed software meta-data authenticity not confirmed" 1>&2
					fi
				exit 1
				;;
			esac
			;;
	esac 
else
        sigret=2
fi

case "$mode" in
	"checksig"|"posix")
	#
	# if checksig mode continue.
	#
	if [ -d "$dirbase" -a ! "$posixmode" -a "$sigret" = "0" -a "$useform" = "distribution" ]; then
		#
		# This is the non-posix checksig mode path.
		# If here, then the signature is good.
		#
		if [ "$uverbose" -ge 3 ]; then
			echo "swverify: Got it!"
			echo "swverify: The vendor checksig script can now be executed."
		fi
		cd "$dirbase" 
		case $? in
			0)
				;;
			*)
				echo "cd : $dirbase : no such file or directory" 1>&2
				exit 1
				;;
		esac
		if [ "$uverbose" -ge 3 ]; then
			bequiet="2>/dev/null"
		else
			bequiet=""
		fi
		checksig=`${FIND} catalog -print | ${GREP} /checksig`
		if [ -f "$checksig" ]; then
			SWBIS_CONTROL_NUMERIC_OWNER="$detected_is_numeric" \
			SWBIS_CONTROL_OWNER="$detected_username" \
			SWBIS_CONTROL_GROUP="$detected_groupname" \
			SW_PATH="$PATH" \
			SW_CONTROL_TAG=checksig \
				"${SHELL}" "$checksig" $bequiet
			ret=$?
			case "$ret" in
				0)
					echo "swverify: signature authenticity confirmed above." 1>&2
					echo "swverify: file authenticity confirmed by checksig script." 1>&2
					echo "swverify: exiting with status 0" 1>&2
					;;	
				*)
					echo "swverify: Package authenticity not confirmed." 1>&2
					;;
			esac
			exit "$ret"
		else 
			echo "swverify: checksig script not found" 1>&2
			echo "swverify: Package authenticity not confirmed." 1>&2
			exit 1
		fi
		exit 2;
	elif [ ! "$posixmode" ]; then
		if [ "$filename" = "-" -o -f "$filename" ]; then
		#
		# --checksig for a archive file
		#
		did_file="yes"
		ret=127
	
		case "$mode" in
		"checksig")
		#
		# --checksig for a serial archive file.
		#
		case "$UUIDGEN" in
			"")
				uuidpath=`date | sum | 
					expand |  sed -e 's/ .*//' | head -1`
				;;
			*)
				uuidpath=`$UUIDGEN -r | $SUM |
					expand | sed -e 's/  *//' |
					$GREP -e '[0-9][0-9]*'`
				;;
		esac

		#
		# Check that uuidpath is good
		#
		echo "$uuidpath" | $GREP -v " " | $GREP . 1>/dev/null
		case "$?" in
			0)
				;;
			*)
				echo \
			"swverify : internal error generating temp file name" 1>&2
				exit 1
				;;
		esac

		fifotopdirname="/tmp/swverify.$$"
		fifodirname="/tmp/swverify.$$/$uuidpath"
		${RM} -fr "$fifotopdirname"
		fifoname="$fifodirname/sigfifo"
		(umask 077; ${MKDIR} $fifotopdirname)
		case $? in
			0)
				;;
			*)
				echo "mkdir failed : $fifotopdirname" 1>&2
				exit 1
				;;
		esac
		(umask 077; ${MKDIR} $fifodirname)
		case $? in
			0)
				;;
			*)
				echo "$0: mkdir failed : $fifodirname" 1>&2
				exit 1
				;;
		esac

		"${RM}" -f "$fifoname"
		"${MKFIFO}" -m u+rw,o-rwx,g-rwx "$fifoname"
		case $? in
			0)
				;;
			*)
				echo "$0: mkfifo failed : $fifoname" 1>&2
				exit 1
				;;
		esac	

		ARF2ARF="${SWBISLIBEXECDIR}/swbis/arf2arf"
		if [ -z "$ARF2ARF" ]; then
			echo "swverify: Missing the arf2arf" 1>&2
			exit 2
		fi
	
		"${ARF2ARF}" --util-name=swverify --sig-number=$signumber --verbose-level="$uverbose" \
				--checksig-mode "$fifoname" \
				--gpg-prog "${GPGBASENAME}" "$filename"
		ret=$?
		"${RM}" -fr "$fifotopdirname"
		case "$ret" in
			0)
				;;
			63)
				echo \
	"swverify: Package authenticity not confirmed due to decompressor error." 1>&2
				ret=1;
				;;
			*)
				echo \
	"swverify: Package authenticity not confirmed." 1>&2
				ret=1;
				;;
		esac
		exit $ret
			;;	
		esac
		exit $ret
	fi
else
	#
	# posix mode
	#
	echo "swverify: Warning: file checks not implemented" 1>&2
	if [ "$sigret" -ne 0 -o "$uverbose" -ge 2 ]; then
		echo "swverify: signature verification return status=$sigret" |
		( case "$redir_error" in "") cat ;; *) cat 1>&2 ;; esac )
	fi
	# exit "$sigret"
	exit 1
fi
	;;
esac

if [ "$did_file" = "" ]; then
	ARF2ARF="${SWBISLIBEXECDIR}/swbis/arf2arf"
	if [ -z "$ARF2ARF" ]; then
		echo "swverify: Missing the arf2arf" 1>&2
		exit 2
	fi
	
	did_file=yes
	ret=127
	case "$mode" in
	"emit-signed-file")
		${ARF2ARF} --util-name=swverify --sig-number=$signumber --verbose-level="$uverbose" $d -C "$filename" 
		ret=$?
		;;
	"emit-digest-file")
		${ARF2ARF} --util-name=swverify --verbose-level="$uverbose" $sha1 $d -S "$filename" 
		ret=$?
		;;
	"get-sig-if")
		${ARF2ARF} --util-name=swverify --sig-number=$signumber --verbose-level="$uverbose" $d \
				-G "$sigoutputfile" "$filename" 
		ret=$?
		;;
	*)
		echo "swverify: invalid mode" 1>&2
		exit 1
		;;
	esac
	exit $ret
fi

if [ "$did_file" = "" ]; then
	echo "swverify: $filename : file not found." 1>&2
	echo "swverify: Package authenticity not confirmed." 1>&2
	exit 1
else
exit 1
fi
exit 1
