* merged changes from the conference

Patches applied:

 * apt@arch.ubuntu.com/apt--experimental--0.6--base-0
   tag of apt@arch.ubuntu.com/apt--MAIN--0--patch-1190

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-1
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-2
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-3
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-4
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-5
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-6
   Creation of branch v0_6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-7
   Merge working copy of v0.6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-8
   0.6.0 is headed for experimental, not unstable

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-9
   Date

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-10
   Update LIB_APT_PKG_MAJOR

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-11
   - Fix a heap corruption bug in pkgSrcRecords::pkgSrcRec...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-12
   Resynch

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-13
   * Merge apt 0.5.17

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-14
   * Rearrange Release file authentication code to be more...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-15
   * Convert distribution "../project/experimental" to "ex...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-16
   Merge 1.11

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-17
   Merge 1.7

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-18
   Merge 1.10

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-19
   * Make a number of Release file errors into warnings; f...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-20
   * Add space between package names when multiple unauthe...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-21
   * Provide apt-key with a secret keyring and a trustdb, ...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-22
   * Fix typo in apt-key(8) (standard input is '-', not '/')

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-23
   0.6.2

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-24
   Resynch

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-25
   * Fix MetaIndexURI for flat ("foo/") sources

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-26
   0.6.3

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-27
   * Use the top-level Release file in LoadReleaseInfo, ra...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-28
   0.6.4

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-29
   Clarify

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-30
   * Move the authentication check into a separate functio...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-31
   * Fix display of unauthenticated packages when they are...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-32
   * Move the authentication check into a separate functio...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-33
   * Restore the ugly hack I removed from indexRecords::Lo...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-34
   0.6.6

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-35
   * Forgot to revert part of the changes to tagfile in 0....

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-36
   * Add a config option and corresponding command line option

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-37
   0.6.8

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-38
   hopefully avoid more segfaults

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-39
   XXX

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-40
   * Another tagfile workaround

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-41
   * Use "Codename" (woody, sarge, etc.) to supply the val...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-42
   * Support IMS requests of Release.gpg and Release

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-43
   * Have pkgAcquireIndex calculate an MD5 sum if one is n...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-44
   * Merge 0.5.18

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-45
   apt (0.6.13) experimental; urgency=low

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-46
   0.6.13

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-47
   Merge 0.5.20

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-48
   The source list works a bit differently in 0.6; fix the...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-49
   * s/Debug::Acquire::gpg/&v/

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-50
   * Honor the [vendor] syntax in sources.list again (thou...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-51
   * Don't ship vendors.list(5) since it isn't used yet

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-52
   * Revert change from 0.6.10; it was right in the first ...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-53
   * Fix some cases where the .gpg file could be left in p...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-54
   Print a warning if gnupg is not installed

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-55
   * Handle more IMS stuff correctly

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-56
   0.6.17

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-57
   * Merge 0.5.21

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-58
   * Add new Debian Archive Automatic Signing Key to the d...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-59
   0.6.18

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-60
   * Merge 0.5.22

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-61
   * Convert apt-key(8) to docbook XML

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-62
   Merge 0.5.23

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-63
   Remove bogus partial 0.5.22 changelog entry

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-64
   Make the auth warning a bit less redundant

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-65
   * Merge 0.5.24

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-66
   * Make the unauthenticated packages prompt more intuiti...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-67
   Merge 0.5.25

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-68
   * Remove obsolete pkgIterator::TargetVer() (Closes: #230159)

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-69
   * Reverse test in CheckAuth to match new prompt (Closes...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-70
   Update version

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-71
   Fix backwards sense of CheckAuth prompt

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-72
   0.6.24

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-73
   Close bug

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-74
   * Fix handling of two-part sources for sources.list deb...

 * apt@arch.ubuntu.com/apt--experimental--0.6--patch-75
   0.6.25

 * apt@packages.debian.org/apt--authentication--0--base-0
   tag of apt@arch.ubuntu.com/apt--experimental--0.6--patch-75

 * apt@packages.debian.org/apt--authentication--0--patch-1
   Michael Vogt's merge of apt--experimental--0 onto apt--main--0

 * apt@packages.debian.org/apt--authentication--0--patch-2
   Merge from apt--main--0

 * apt@packages.debian.org/apt--authentication--0--patch-3
   Merge from main

 * apt@packages.debian.org/apt--authentication--0--patch-4
   Merge from main

 * apt@packages.debian.org/apt--authentication--0--patch-5
   Update version number in configure.in

 * apt@packages.debian.org/apt--authentication--0--patch-6
   Merge from main

 * apt@packages.debian.org/apt--authentication--0--patch-7
   Merge from main

 * apt@packages.debian.org/apt--authentication--0--patch-8
   Merge from mvo's branch

 * apt@packages.debian.org/apt--authentication--0--patch-9
   Merge from mvo's tree

 * apt@packages.debian.org/apt--authentication--0--patch-10
   Merge from mvo

 * apt@packages.debian.org/apt--authentication--0--patch-11
   Fix permissions AGAIN

 * apt@packages.debian.org/apt--bzip2-debs--0--base-0
   tag of apt@packages.debian.org/apt--main--0--patch-30

 * apt@packages.debian.org/apt--bzip2-debs--0--patch-1
   Create baz branch

 * apt@packages.debian.org/apt--bzip2-debs--0--patch-2
   Implement data.tar.bz2 support

 * apt@packages.debian.org/apt--main--0--patch-30
   Fix changelog

 * apt@packages.debian.org/apt--main--0--patch-31
   Fix permissions again

 * apt@packages.debian.org/apt--main--0--patch-32
   Fix permissions again

 * apt@packages.debian.org/apt--main--0--patch-33
   Use baz instead of tla

 * apt@packages.debian.org/apt--main--0--patch-34
   Merge bzip2-debs branch

 * apt@packages.debian.org/apt--main--0--patch-35
   Fix changelog

 * apt@packages.debian.org/apt--main--0--patch-36
   untagged-source precious

 * apt@packages.debian.org/apt--main--0--patch-37
   Add .arch-inventory files

 * apt@packages.debian.org/apt--main--0--patch-38
   Fix permissions again

 * apt@packages.debian.org/apt--main--0--patch-39
   Merge apt--authentication--0

 * apt@packages.debian.org/apt--main--0--patch-40
   Merge misc-abi-changes

 * apt@packages.debian.org/apt--main--0--patch-41
   Merge from mvo

 * apt@packages.debian.org/apt--misc-abi-changes--0--base-0
   tag of apt@packages.debian.org/apt--main--0--patch-16

 * apt@packages.debian.org/apt--misc-abi-changes--0--patch-1
   Fix apt-get -s remove to not display the candidate version

 * apt@packages.debian.org/apt--misc-abi-changes--0--patch-2
   Merge from main

 * apt@packages.debian.org/apt--misc-abi-changes--0--patch-3
   Use pid_t throughout to hold process IDs

 * michael.vogt@canonical.com--2004--laptop/apt--authentication-mvo--0--base-0
   tag of michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-12

 * michael.vogt@canonical.com--2004--laptop/apt--authentication-mvo--0--patch-1
   * star-merged matt's changes (bz2 support for data-members in debs)

 * michael.vogt@canonical.com--2004--laptop/apt--authentication-mvo--0--patch-2
   * ignore errors when a Packages.bz2/Sources.bz2 can't be found and try with Packages.gz/Sources.gz again

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--base-0
   tag of apt@packages.debian.org/apt--main--0--patch-34

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-1
   * merged matt's tree (with all those apt-authentication changes)

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-2
   don't display a error if a bzip2 package can not be downloaded, just ignore (Ign) it

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-3
   * "chmod 755 cmdline/apt-key", changed version to 0.6.27ubuntu1

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-4
   * fix for a stupid merge error (from 0.5->0.6)

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-5
   * unstable should really be hoary

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-6
   * stronger dependencies for libapt-pkg-dev (depends on the source version of apt and apt-watch now)

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-7
   * distro really should be hoary, not unstable :/

 * michael.vogt@canonical.com--2004--laptop/apt--mvo--0--patch-8
   * documented the "--allow-unauthenticated" switch

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-1
   tag of apt@packages.debian.org/apt--authentication--0--base-0

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-2
   merged "tla apply-delta -A foo@ apt@arch.ubuntu.com/apt--MAIN--0--patch-1190 apt@arch.ubuntu.com/apt--MAIN--0--patch-1343" and cleaned up conflicts

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-3
   * missing bits from the merge added

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-4
   * star-merged with apt@packages.debian.org/apt--main--0

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-5
   * tree-synced to the apt--authentication tree

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-6
   * use the ubuntu-key in this version

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-7
   * imported the patches from mdz

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-8
   * apt-get update --print-uris works now as before (fallback to 0.5.x behaviour)

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-9
   * fix for the "if any source unauthenticated, all other sources are unauthenticated too" problem

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-10
   * reworked the "--print-uris" patch. it no longer uses: "APT::Get::Print-URIs" in the library

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-11
   * version of the library set to 3.6

 * michael.vogt@canonical.com--2004/apt--authentication-mvo--0--patch-12
   * changelog finallized, will upload to people.ubuntulinux.org/~mvo/apt-authentication

 * michael.vogt@canonical.com--2004/apt--main-authentication--0--base-0
   tag of apt@packages.debian.org/apt--main--0--patch-22

 * michael.vogt@canonical.com--2004/apt--main-authentication--0--patch-1
   * star-merge from apt--experimental--0.6

 * michael.vogt@canonical.com--2004/apt--main-authentication--0--patch-2
   * compile failure fix for methods/http.cc, po-file fixes

1 files changed, 261 insertions, 0 deletions

diff --git a/methods/gpgv.cc b/methods/gpgv.cc
new file mode 100644
index 000000000..b34ea8d85
--- /dev/null
+++ b/methods/gpgv.cc
@@ -0,0 +1,261 @@
+#include <apt-pkg/error.h>
+#include <apt-pkg/acquire-method.h>
+#include <apt-pkg/strutl.h>
+
+#include <sys/stat.h>
+#include <unistd.h>
+#include <utime.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/wait.h>
+#include <iostream>
+
+#define GNUPGPREFIX "[GNUPG:]"
+#define GNUPGBADSIG "[GNUPG:] BADSIG"
+#define GNUPGNOPUBKEY "[GNUPG:] NO_PUBKEY"
+#define GNUPGVALIDSIG "[GNUPG:] VALIDSIG"
+
+class GPGVMethod : public pkgAcqMethod
+{
+   private:
+   const char *VerifyGetSigners(const char *file, const char *outfile,
+				vector<string> &GoodSigners, vector<string> &BadSigners,
+				vector<string> &NoPubKeySigners);
+   
+   protected:
+   virtual bool Fetch(FetchItem *Itm);
+   
+   public:
+   
+   GPGVMethod() : pkgAcqMethod("1.0",SingleInstance | SendConfig) {};
+};
+
+const char *GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
+					 vector<string> &GoodSigners,
+					 vector<string> &BadSigners,
+					 vector<string> &NoPubKeySigners)
+{
+   if (_config->FindB("Debug::Acquire::gpgv", false))
+   {
+      std::cerr << "inside VerifyGetSigners" << std::endl;
+   }
+   pid_t pid;
+   int fd[2];
+   FILE *pipein;
+   int status;
+   struct stat buff;
+   string gpgvpath = _config->Find("Dir::Bin::gpg", "/usr/bin/gpgv");
+   string pubringpath = _config->Find("Apt::GPGV::TrustedKeyring", "/etc/apt/trusted.gpg");
+   if (_config->FindB("Debug::Acquire::gpgv", false))
+   {
+      std::cerr << "gpgv path: " << gpgvpath << std::endl;
+      std::cerr << "Keyring path: " << pubringpath << std::endl;
+   }
+
+   if (stat(pubringpath.c_str(), &buff) != 0)
+      return (string("Couldn't access keyring: ") + strerror(errno)).c_str();
+
+   if (pipe(fd) < 0)
+   {
+      return "Couldn't create pipe";
+   }
+
+   pid = fork();
+   if (pid < 0)
+   {
+      return (string("Couldn't spawn new process") + strerror(errno)).c_str();
+   }
+   else if (pid == 0)
+   {
+      if (_config->FindB("Debug::Acquire::gpgv", false))
+      {
+         std::cerr << "Preparing to exec: " << gpgvpath
+		   << " --status-fd 3 --keyring " << pubringpath
+		   << " " << file << " " << outfile << std::endl;
+      }
+      int nullfd = open("/dev/null", O_RDONLY);
+      close(fd[0]);
+      // Redirect output to /dev/null; we read from the status fd
+      dup2(nullfd, STDOUT_FILENO); 
+      dup2(nullfd, STDERR_FILENO); 
+      // Redirect the pipe to the status fd (3)
+      dup2(fd[1], 3);
+
+      putenv("LANG=");
+      putenv("LC_ALL=");
+      putenv("LC_MESSAGES=");
+      execlp(gpgvpath.c_str(), gpgvpath.c_str(), "--status-fd", "3", "--keyring", 
+	     pubringpath.c_str(), file, outfile, NULL);
+             
+      exit(111);
+   }
+   close(fd[1]);
+
+   pipein = fdopen(fd[0], "r"); 
+   
+   // Loop over the output of gpgv, and check the signatures.
+   size_t buffersize = 64;
+   char *buffer = (char *) malloc(buffersize);
+   size_t bufferoff = 0;
+   while (1)
+   {
+      int c;
+
+      // Read a line.  Sigh.
+      while ((c = getc(pipein)) != EOF && c != '\n')
+      {
+         if (bufferoff == buffersize)
+            buffer = (char *) realloc(buffer, buffersize *= 2);
+         *(buffer+bufferoff) = c;
+         bufferoff++;
+      }
+      if (bufferoff == 0 && c == EOF)
+         break;
+      *(buffer+bufferoff) = '\0';
+      bufferoff = 0;
+      if (_config->FindB("Debug::Acquire::gpgv", false))
+         std::cerr << "Read: " << buffer << std::endl;
+
+      // Push the data into three separate vectors, which
+      // we later concatenate.  They're kept separate so
+      // if we improve the apt method communication stuff later
+      // it will be better.
+      if (strncmp(buffer, GNUPGBADSIG, sizeof(GNUPGBADSIG)-1) == 0)
+      {
+         if (_config->FindB("Debug::Acquire::gpgv", false))
+            std::cerr << "Got BADSIG! " << std::endl;
+         BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
+      }
+      
+      if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
+      {
+         if (_config->FindB("Debug::Acquire::gpgv", false))
+            std::cerr << "Got NO_PUBKEY " << std::endl;
+         NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
+      }
+
+      if (strncmp(buffer, GNUPGVALIDSIG, sizeof(GNUPGVALIDSIG)-1) == 0)
+      {
+         char *sig = buffer + sizeof(GNUPGPREFIX);
+         char *p = sig + sizeof("VALIDSIG");
+         while (*p && isxdigit(*p)) 
+            p++;
+         *p = 0;
+         if (_config->FindB("Debug::Acquire::gpgv", false))
+            std::cerr << "Got VALIDSIG, key ID:" << sig << std::endl;
+         GoodSigners.push_back(string(sig));
+      }
+   }
+   fclose(pipein);
+
+   waitpid(pid, &status, 0);
+   if (_config->FindB("Debug::Acquire::gpgv", false))
+   {
+      std::cerr <<"gpgv exited\n";
+   }
+   
+   if (WEXITSTATUS(status) == 0)
+   {
+      if (GoodSigners.empty())
+         return "Internal error: Good signature, but could not determine key fingerprint?!";
+      return NULL;
+   }
+   else if (WEXITSTATUS(status) == 1)
+   {
+      return "At least one invalid signature was encountered.";
+   }
+   else if (WEXITSTATUS(status) == 111)
+   {
+      return (string("Could not execute ") + gpgvpath +
+	      string(" to verify signature (is gnupg installed?)")).c_str();
+   }
+   else
+   {
+      return "Unknown error executing gpgv";
+   }
+}
+
+bool GPGVMethod::Fetch(FetchItem *Itm)
+{
+   URI Get = Itm->Uri;
+   string Path = Get.Host + Get.Path; // To account for relative paths
+   string keyID;
+   vector<string> GoodSigners;
+   vector<string> BadSigners;
+   vector<string> NoPubKeySigners;
+   
+   FetchResult Res;
+   Res.Filename = Itm->DestFile;
+   URIStart(Res);
+
+   // Run gpgv on file, extract contents and get the key ID of the signer
+   const char *msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(),
+				      GoodSigners, BadSigners, NoPubKeySigners);
+   if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty())
+   {
+      string errmsg;
+      // In this case, something bad probably happened, so we just go
+      // with what the other method gave us for an error message.
+      if (BadSigners.empty() && NoPubKeySigners.empty())
+         errmsg = msg;
+      else
+      {
+         if (!BadSigners.empty())
+         {
+            errmsg += "The following signatures were invalid:\n";
+            for (vector<string>::iterator I = BadSigners.begin();
+		 I != BadSigners.end(); I++)
+               errmsg += (*I + "\n");
+         }
+         if (!NoPubKeySigners.empty())
+         {
+             errmsg += "The following signatures couldn't be verified because the public key is not available:\n";
+            for (vector<string>::iterator I = NoPubKeySigners.begin();
+		 I != NoPubKeySigners.end(); I++)
+               errmsg += (*I + "\n");
+         }
+      }
+      return _error->Error(errmsg.c_str());
+   }
+      
+   // Transfer the modification times
+   struct stat Buf;
+   if (stat(Path.c_str(),&Buf) != 0)
+      return _error->Errno("stat","Failed to stat %s", Path.c_str());
+
+   struct utimbuf TimeBuf;
+   TimeBuf.actime = Buf.st_atime;
+   TimeBuf.modtime = Buf.st_mtime;
+   if (utime(Itm->DestFile.c_str(),&TimeBuf) != 0)
+      return _error->Errno("utime","Failed to set modification time");
+
+   if (stat(Itm->DestFile.c_str(),&Buf) != 0)
+      return _error->Errno("stat","Failed to stat");
+   
+   // Return a Done response
+   Res.LastModified = Buf.st_mtime;
+   Res.Size = Buf.st_size;
+   // Just pass the raw output up, because passing it as a real data
+   // structure is too difficult with the method stuff.  We keep it
+   // as three separate vectors for future extensibility.
+   Res.GPGVOutput = GoodSigners;
+   Res.GPGVOutput.insert(Res.GPGVOutput.end(),BadSigners.begin(),BadSigners.end());
+   Res.GPGVOutput.insert(Res.GPGVOutput.end(),NoPubKeySigners.begin(),NoPubKeySigners.end());
+   URIDone(Res);
+
+   if (_config->FindB("Debug::Acquire::gpgv", false))
+   {
+      std::cerr <<"gpgv suceeded\n";
+   }
+
+   return true;
+}
+
+
+int main()
+{
+   GPGVMethod Mth;
+
+   return Mth.Run();
+}