upgraded git portable version

lib/gpg/VERSION

@@ -1,2 +1,2 @@
 gnupg
-2.2.19
+2.2.23

lib/gpg/include/gcrypt.h

@@ -62,11 +62,11 @@ extern "C" {
    return the same version.  The purpose of this macro is to let
    autoconf (using the AM_PATH_GCRYPT macro) check that this header
    matches the installed library.  */
-#define GCRYPT_VERSION "1.8.5"
+#define GCRYPT_VERSION "1.8.6"
 
 /* The version number of this header.  It may be used to handle minor
    API incompatibilities.  */
-#define GCRYPT_VERSION_NUMBER 0x010805
+#define GCRYPT_VERSION_NUMBER 0x010806
 
 
 /* Internal: We can't use the convenience macros for the multi

lib/gpg/include/gpg-error.h

@@ -1,5 +1,5 @@
 /* gpg-error.h or gpgrt.h - Common code for GnuPG and others.    -*- c -*-
- * Copyright (C) 2001-2019 g10 Code GmbH
+ * Copyright (C) 2001-2020 g10 Code GmbH
  *
  * This file is part of libgpg-error (aka libgpgrt).
  *
@@ -66,12 +66,12 @@
 #include <stdarg.h>
 
 /* The version string of this header. */
-#define GPG_ERROR_VERSION "1.36"
-#define GPGRT_VERSION     "1.36"
+#define GPG_ERROR_VERSION "1.39"
+#define GPGRT_VERSION     "1.39"
 
 /* The version number of this header. */
-#define GPG_ERROR_VERSION_NUMBER 0x012400
-#define GPGRT_VERSION_NUMBER     0x012400
+#define GPG_ERROR_VERSION_NUMBER 0x012700
+#define GPGRT_VERSION_NUMBER     0x012700
 
 
 #ifdef __GNUC__
@@ -434,6 +434,10 @@ typedef enum
     GPG_ERR_WRONG_NAME = 313,
     GPG_ERR_NO_AUTH = 314,
     GPG_ERR_BAD_AUTH = 315,
+    GPG_ERR_NO_KEYBOXD = 316,
+    GPG_ERR_KEYBOXD = 317,
+    GPG_ERR_NO_SERVICE = 318,
+    GPG_ERR_SERVICE = 319,
     GPG_ERR_SYSTEM_BUG = 666,
     GPG_ERR_DNS_UNKNOWN = 711,
     GPG_ERR_DNS_SECTION = 712,
@@ -540,6 +544,37 @@ typedef enum
     GPG_ERR_USER_14 = 1037,
     GPG_ERR_USER_15 = 1038,
     GPG_ERR_USER_16 = 1039,
+    GPG_ERR_SQL_OK = 1500,
+    GPG_ERR_SQL_ERROR = 1501,
+    GPG_ERR_SQL_INTERNAL = 1502,
+    GPG_ERR_SQL_PERM = 1503,
+    GPG_ERR_SQL_ABORT = 1504,
+    GPG_ERR_SQL_BUSY = 1505,
+    GPG_ERR_SQL_LOCKED = 1506,
+    GPG_ERR_SQL_NOMEM = 1507,
+    GPG_ERR_SQL_READONLY = 1508,
+    GPG_ERR_SQL_INTERRUPT = 1509,
+    GPG_ERR_SQL_IOERR = 1510,
+    GPG_ERR_SQL_CORRUPT = 1511,
+    GPG_ERR_SQL_NOTFOUND = 1512,
+    GPG_ERR_SQL_FULL = 1513,
+    GPG_ERR_SQL_CANTOPEN = 1514,
+    GPG_ERR_SQL_PROTOCOL = 1515,
+    GPG_ERR_SQL_EMPTY = 1516,
+    GPG_ERR_SQL_SCHEMA = 1517,
+    GPG_ERR_SQL_TOOBIG = 1518,
+    GPG_ERR_SQL_CONSTRAINT = 1519,
+    GPG_ERR_SQL_MISMATCH = 1520,
+    GPG_ERR_SQL_MISUSE = 1521,
+    GPG_ERR_SQL_NOLFS = 1522,
+    GPG_ERR_SQL_AUTH = 1523,
+    GPG_ERR_SQL_FORMAT = 1524,
+    GPG_ERR_SQL_RANGE = 1525,
+    GPG_ERR_SQL_NOTADB = 1526,
+    GPG_ERR_SQL_NOTICE = 1527,
+    GPG_ERR_SQL_WARNING = 1528,
+    GPG_ERR_SQL_ROW = 1600,
+    GPG_ERR_SQL_DONE = 1601,
     GPG_ERR_MISSING_ERRNO = 16381,
     GPG_ERR_UNKNOWN_ERRNO = 16382,
     GPG_ERR_EOF = 16383,
@@ -982,6 +1017,13 @@ int gpg_err_code_to_errno (gpg_err_code_t code);
  * (report this) and GPG_ERR_MISSING_ERRNO if ERRNO has the value 0. */
 gpg_err_code_t gpg_err_code_from_syserror (void);
 
+/* Mapper for SQLite primary error codes.  */
+static GPG_ERR_INLINE gpg_error_t
+gpg_err_code_from_sqlite (int sqlres)
+{
+  return sqlres? GPG_ERR_SQL_OK + (sqlres & 0xff) : 0;
+}
+
 
 /* Set the ERRNO variable.  This function is the preferred way to set
  * ERRNO due to peculiarities on WindowsCE.  */
@@ -1094,6 +1136,7 @@ gpg_error_from_syserror (void)
  */
 
 void *gpgrt_realloc (void *a, size_t n);
+void *gpgrt_reallocarray (void *a, size_t oldnmemb, size_t nmemb, size_t size);
 void *gpgrt_malloc (size_t n);
 void *gpgrt_calloc (size_t n, size_t m);
 char *gpgrt_strdup (const char *string);
@@ -1344,6 +1387,7 @@ gpgrt_stream_t gpgrt_fopencookie (void *_GPGRT__RESTRICT cookie,
                                   const char *_GPGRT__RESTRICT mode,
                                   gpgrt_cookie_io_functions_t functions);
 int gpgrt_fclose (gpgrt_stream_t stream);
+int gpgrt_fcancel (gpgrt_stream_t stream);
 int gpgrt_fclose_snatch (gpgrt_stream_t stream,
                          void **r_buffer, size_t *r_buflen);
 int gpgrt_onclose (gpgrt_stream_t stream, int mode,
@@ -1836,7 +1880,12 @@ typedef struct
 #define ARGPARSE_FLAG_NOVERSION  64  /* No output for "--version".           */
 #define ARGPARSE_FLAG_RESET     128  /* Request to reset the internal state. */
 #define ARGPARSE_FLAG_STOP_SEEN 256  /* Set to true if a "--" has been seen. */
-#define ARGPARSE_FLAG_NOLINENO  512  /* Do not zero the lineno field.         */
+#define ARGPARSE_FLAG_NOLINENO  512  /* Do not zero the lineno field.        */
+#define ARGPARSE_FLAG_SYS      1024  /* Use system config file.              */
+#define ARGPARSE_FLAG_USER     2048  /* Use user config file.                */
+#define ARGPARSE_FLAG_VERBOSE  4096  /* Print additional argparser info.     */
+#define ARGPARSE_FLAG_USERVERS 8192  /* Try version-ed user config files.    */
+#define ARGPARSE_FLAG_WITHATTR 16384 /* Return attribute bits.               */
 
 /* Constants for (gpgrt_argparse_t).err.  */
 #define ARGPARSE_PRINT_WARNING  1    /* Print a diagnostic.                  */
@@ -1855,9 +1904,21 @@ typedef struct
 #define ARGPARSE_INVALID_ALIAS     (-10)
 #define ARGPARSE_OUT_OF_CORE       (-11)
 #define ARGPARSE_INVALID_ARG       (-12)
+#define ARGPARSE_PERMISSION_ERROR  (-13)
+#define ARGPARSE_NO_CONFFILE       (-14)
+#define ARGPARSE_CONFFILE          (-15)
+#define ARGPARSE_INVALID_META      (-16)
+#define ARGPARSE_UNKNOWN_META      (-17)
+#define ARGPARSE_UNEXPECTED_META   (-18)
 
-/* Flags for the option descriptor (gpgrt_opt_t)->flags.  Note that
- * a TYPE constant may be or-ed with the OPT constants.  */
+/* Flags for the option descriptor (gpgrt_opt_t)->flags.  Note that a
+ * TYPE constant may be or-ed with the OPT constants but when used as
+ * return value in r_type these OPT constants are normally not
+ * included.  However with ARGPARSE_FLAG_WITHATTR used and an option
+ * would normally not be returned, it is returned but
+ * ARGPARSE_OPT_IGNORE is then set; further ARPARSE_ATTR_* are set.
+ */
+#define ARGPARSE_TYPE_MASK   0x0007  /* Mask for the type bits.           */
 #define ARGPARSE_TYPE_NONE        0  /* Does not take an argument.        */
 #define ARGPARSE_TYPE_INT         1  /* Takes an int argument.            */
 #define ARGPARSE_TYPE_STRING      2  /* Takes a string argument.          */
@@ -1867,6 +1928,11 @@ typedef struct
 #define ARGPARSE_OPT_PREFIX   (1<<4) /* Allow 0x etc. prefixed values.    */
 #define ARGPARSE_OPT_IGNORE   (1<<6) /* Ignore command or option.         */
 #define ARGPARSE_OPT_COMMAND  (1<<7) /* The argument is a command.        */
+#define ARGPARSE_OPT_CONFFILE (1<<8) /* The value is a conffile.          */
+#define ARGPARSE_OPT_HEADER   (1<<9) /* The value is printed as a header. */
+#define ARGPARSE_OPT_VERBATIM (1<<10)/* The value is printed verbatim.    */
+#define ARGPARSE_ATTR_FORCE   (1<<14)/* Attribute force is set.           */
+#define ARGPARSE_ATTR_IGNORE  (1<<15)/* Attribute ignore is set.          */
 
 /* A set of macros to make option definitions easier to read.  */
 #define ARGPARSE_x(s,l,t,f,d) \
@@ -1933,28 +1999,55 @@ typedef struct
 #define ARGPARSE_c(s,l,d) \
      { (s), (l), (ARGPARSE_TYPE_NONE | ARGPARSE_OPT_COMMAND), (d) }
 
-#define ARGPARSE_ignore(s,l) \
-     { (s), (l), (ARGPARSE_OPT_IGNORE), "@" }
+#define ARGPARSE_conffile(s,l,d) \
+  { (s), (l), (ARGPARSE_TYPE_STRING|ARGPARSE_OPT_CONFFILE), (d) }
 
+#define ARGPARSE_noconffile(s,l,d) \
+  { (s), (l), (ARGPARSE_TYPE_NONE|ARGPARSE_OPT_CONFFILE), (d) }
+
+/* This macro is for stub or obsolete options.  */
+#define ARGPARSE_ignore(s,l)                    \
+  { (s), (l), (ARGPARSE_OPT_IGNORE), "@" }
+
+/* This is a legacy version of ARGPARSE_verbatim which really does
+ * verbatim printing.  */
 #define ARGPARSE_group(s,d) \
-     { (s), NULL, 0, (d) }
+  { (s), NULL, 0, (d) }
+
+/* Verbatim print the string D in the help output.  It does not make
+ * use of the "@" hack as ARGPARSE_group does.  */
+#define ARGPARSE_verbatim(d) \
+  { 1, NULL, (ARGPARSE_OPT_VERBATIM), (d) }
+
+/* Same as ARGPARSE_verbatim but also print a colon and a LF.  N can
+ * be used give a symbolic name to the header.  Nothing is printed if
+ * D is the empty string.  */
+#define ARGPARSE_header(n,d) \
+  { 1, (n), (ARGPARSE_OPT_HEADER), (d) }
 
 /* Mark the end of the list (mandatory).  */
 #define ARGPARSE_end() \
-     { 0, NULL, 0, NULL }
+  { 0, NULL, 0, NULL }
 
 #endif /* GPGRT_ENABLE_ARGPARSE_MACROS */
 
+/* Values used for gpgrt_set_confdir.  */
+#define GPGRT_CONFDIR_USER 1   /* The user's configuration dir.    */
+#define GPGRT_CONFDIR_SYS  2   /* The systems's configuration dir. */
+
 /* Take care: gpgrt_argparse keeps state in ARG and requires that
  * either ARGPARSE_FLAG_RESET is used after OPTS has been changed or
  * gpgrt_argparse (NULL, ARG, NULL) is called first.  */
 int gpgrt_argparse (gpgrt_stream_t fp,
                     gpgrt_argparse_t *arg, gpgrt_opt_t *opts);
+int gpgrt_argparser (gpgrt_argparse_t *arg, gpgrt_opt_t *opts,
+                     const char *confname);
 void gpgrt_usage (int level);
 const char *gpgrt_strusage (int level);
 void gpgrt_set_strusage (const char *(*f)(int));
 void gpgrt_set_usage_outfnc (int (*f)(int, const char *));
 void gpgrt_set_fixed_string_mapper (const char *(*f)(const char*));
+void gpgrt_set_confdir (int what, const char *name);
 
 
 /*
@@ -1965,6 +2058,12 @@ void gpgrt_set_fixed_string_mapper (const char *(*f)(const char*));
  * numbering scheme a LEVEL of 3 is suitable; see the manual.  */
 int gpgrt_cmp_version (const char *a, const char *b, int level);
 
+/* Construct a filename from the NULL terminated list of parts.  Tilde
+ * expansion is done for the first argument.  The caller must release
+ * the result using gpgrt_free; on error ERRNO is set and NULL
+ * returned.  The second function returns an absolute filename.  */
+char *gpgrt_fnameconcat (const char *first, ...) GPGRT_ATTR_SENTINEL(0);
+char *gpgrt_absfnameconcat (const char *first, ...) GPGRT_ATTR_SENTINEL(0);
 
 
 #ifdef __cplusplus

lib/gpg/include/gpgme.h

@@ -42,11 +42,11 @@ extern "C" {
  * instead.  The purpose of this macro is to let autoconf (using the
  * AM_PATH_GPGME macro) check that this header matches the installed
  * library.  */
-#define GPGME_VERSION "1.13.1"
+#define GPGME_VERSION "1.14.0"
 
 /* The version number of this header.  It may be used to handle minor
  * API incompatibilities.  */
-#define GPGME_VERSION_NUMBER 0x010d01
+#define GPGME_VERSION_NUMBER 0x010e00
 
 
 /* System specific typedefs.  */
@@ -321,7 +321,7 @@ typedef enum
 gpgme_sig_mode_t;
 
 
-/* The available validities for a trust item or key.  */
+/* The available validities for a key.  */
 typedef enum
   {
     GPGME_VALIDITY_UNKNOWN   = 0,
@@ -387,6 +387,7 @@ gpgme_protocol_t;
 #define GPGME_KEYLIST_MODE_SIG_NOTATIONS	8
 #define GPGME_KEYLIST_MODE_WITH_SECRET       	16
 #define GPGME_KEYLIST_MODE_WITH_TOFU       	32
+#define GPGME_KEYLIST_MODE_WITH_KEYGRIP       	64
 #define GPGME_KEYLIST_MODE_EPHEMERAL            128
 #define GPGME_KEYLIST_MODE_VALIDATE		256
 
@@ -414,6 +415,7 @@ gpgme_pinentry_mode_t;
 #define GPGME_EXPORT_MODE_RAW                  32
 #define GPGME_EXPORT_MODE_PKCS12               64
 #define GPGME_EXPORT_MODE_NOUID               128  /* Experimental(!)*/
+#define GPGME_EXPORT_MODE_SSH                 256
 
 typedef unsigned int gpgme_export_mode_t;
 
@@ -608,7 +610,7 @@ struct _gpgme_subkey
   /* The name of the curve for ECC algorithms or NULL.  */
   char *curve;
 
-  /* The keygrip of the subkey in hex digit form or NULL if not availabale.  */
+  /* The keygrip of the subkey in hex digit form or NULL if not available.  */
   char *keygrip;
 };
 typedef struct _gpgme_subkey *gpgme_subkey_t;
@@ -736,6 +738,9 @@ struct _gpgme_user_id
 
   /* Time of the last refresh of this user id.  0 if unknown.  */
   unsigned long last_update;
+
+  /* The string to exactly identify a userid.  Might be NULL.  */
+  char *uidhash;
 };
 typedef struct _gpgme_user_id *gpgme_user_id_t;
 
@@ -1058,7 +1063,7 @@ typedef enum
     GPGME_EVENT_START,
     GPGME_EVENT_DONE,
     GPGME_EVENT_NEXT_KEY,
-    GPGME_EVENT_NEXT_TRUSTITEM
+    GPGME_EVENT_NEXT_TRUSTITEM  /* NOT USED.  */
   }
 gpgme_event_io_t;
 
@@ -2006,63 +2011,32 @@ gpgme_error_t gpgme_op_passwd (gpgme_ctx_t ctx, gpgme_key_t key,
 
 
 /*
- * Trust items and operations.
+ * Trust items and operations.  DO NOT USE.
+ * Note: This does not work because the experimental support in the
+ * GnuPG engine has been removed a very long time; for API and ABI
+ * compatibilty we keep the functions but let them return an error.
+ * See https://dev.gnupg.org/T4834
  */
-
-/* An object to hold data of a trust item.
- * This structure shall be considered read-only and an application
- * must not allocate such a structure on its own.  */
 struct _gpgme_trust_item
 {
-  /* Internal to GPGME, do not use.  */
   unsigned int _refs;
-
-  /* The key ID to which the trust item belongs.  */
   char *keyid;
-
-  /* Internal to GPGME, do not use.  */
   char _keyid[16 + 1];
-
-  /* The type of the trust item, 1 refers to a key, 2 to a user ID.  */
   int type;
-
-  /* The trust level.  */
   int level;
-
-  /* The owner trust if TYPE is 1.  */
   char *owner_trust;
-
-  /* Internal to GPGME, do not use.  */
   char _owner_trust[2];
-
-  /* The calculated validity.  */
   char *validity;
-
-  /* Internal to GPGME, do not use.  */
   char _validity[2];
-
-  /* The user name if TYPE is 2.  */
   char *name;
 };
 typedef struct _gpgme_trust_item *gpgme_trust_item_t;
-
-/* Start a trustlist operation within CTX, searching for trust items
-   which match PATTERN.  */
 gpgme_error_t gpgme_op_trustlist_start (gpgme_ctx_t ctx,
 					const char *pattern, int max_level);
-
-/* Return the next trust item from the trustlist in R_ITEM.  */
 gpgme_error_t gpgme_op_trustlist_next (gpgme_ctx_t ctx,
 				       gpgme_trust_item_t *r_item);
-
-/* Terminate a pending trustlist operation within CTX.  */
 gpgme_error_t gpgme_op_trustlist_end (gpgme_ctx_t ctx);
-
-/* Acquire a reference to ITEM.  */
 void gpgme_trust_item_ref (gpgme_trust_item_t item);
-
-/* Release a reference to ITEM.  If this was the last one the trust
- * item is destroyed.  */
 void gpgme_trust_item_unref (gpgme_trust_item_t item);
 
 
@@ -2744,22 +2718,16 @@ unsigned long gpgme_key_sig_get_ulong_attr (gpgme_key_t key, int uid_idx,
 gpgme_error_t gpgme_op_import_ext (gpgme_ctx_t ctx, gpgme_data_t keydata,
 				   int *nr) _GPGME_DEPRECATED(0,4);
 
-/* Release the trust item ITEM.  Deprecated, use
- * gpgme_trust_item_unref.  */
+/* DO NOT USE.  */
 void gpgme_trust_item_release (gpgme_trust_item_t item) _GPGME_DEPRECATED(0,4);
 
-/* Return the value of the attribute WHAT of ITEM, which has to be
- * representable by a string.  Deprecated, use trust item structure
- * directly.  */
+/* DO NOT USE.  */
 const char *gpgme_trust_item_get_string_attr (gpgme_trust_item_t item,
 					      _gpgme_attr_t what,
 					      const void *reserved, int idx)
      _GPGME_DEPRECATED(0,4);
 
-/* Return the value of the attribute WHAT of KEY, which has to be
- * representable by an integer.  IDX specifies a running index if the
- * attribute appears more than once in the key.  Deprecated, use trust
- * item structure directly.  */
+/* DO NOT USE.  */
 int gpgme_trust_item_get_int_attr (gpgme_trust_item_t item, _gpgme_attr_t what,
 				   const void *reserved, int idx)
      _GPGME_DEPRECATED(0,4);

lib/gpg/include/ksba.h

@@ -1,6 +1,6 @@
 /* ksba.h - X.509 library used by GnuPG
  * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2010, 2011
- *               2012, 2013, 2104, 2015 g10 Code GmbH
+ *               2012, 2013, 2104, 2015, 2019 g10 Code GmbH
  *
  * This file is part of KSBA.
  *
@@ -42,6 +42,16 @@ extern "C" {
 #endif
 #endif
 
+/* The version of this header should match the one of the library.  Do
+ * not use this symbol in your application; use assuan_check_version
+ * instead.  */
+#define KSBA_VERSION "1.4.0"
+
+/* The version number of this header.  It may be used to handle minor
+ * API incompatibilities.  */
+#define KSBA_VERSION_NUMBER 0x010400
+
+
 
 /* Check for compiler features.  */
 #ifdef __GNUC__
@@ -58,6 +68,50 @@ extern "C" {
 #endif
 
 
+#define KSBA_CLASS_UNIVERSAL   0
+#define KSBA_CLASS_APPLICATION 1
+#define KSBA_CLASS_CONTEXT     2
+#define KSBA_CLASS_PRIVATE     3
+#define KSBA_CLASS_ENCAPSULATE 0x80  /* Pseudo class.  */
+
+#define KSBA_TYPE_BOOLEAN           1
+#define KSBA_TYPE_INTEGER           2
+#define KSBA_TYPE_BIT_STRING        3
+#define KSBA_TYPE_OCTET_STRING      4
+#define KSBA_TYPE_NULL              5
+#define KSBA_TYPE_OBJECT_ID         6
+#define KSBA_TYPE_OBJECT_DESCRIPTOR 7
+#define KSBA_TYPE_EXTERNAL          8
+#define KSBA_TYPE_REAL              9
+#define KSBA_TYPE_ENUMERATED       10
+#define KSBA_TYPE_EMBEDDED_PDV     11
+#define KSBA_TYPE_UTF8_STRING      12
+#define KSBA_TYPE_RELATIVE_OID     13
+#define KSBA_TYPE_TIME             14
+#define KSBA_TYPE_SEQUENCE         16
+#define KSBA_TYPE_SET              17
+#define KSBA_TYPE_NUMERIC_STRING   18
+#define KSBA_TYPE_PRINTABLE_STRING 19
+#define KSBA_TYPE_TELETEX_STRING   20
+#define KSBA_TYPE_VIDEOTEX_STRING  21
+#define KSBA_TYPE_IA5_STRING       22
+#define KSBA_TYPE_UTC_TIME         23
+#define KSBA_TYPE_GENERALIZED_TIME 24
+#define KSBA_TYPE_GRAPHIC_STRING   25
+#define KSBA_TYPE_VISIBLE_STRING   26
+#define KSBA_TYPE_GENERAL_STRING   27
+#define KSBA_TYPE_UNIVERSAL_STRING 28
+#define KSBA_TYPE_CHARACTER_STRING 29
+#define KSBA_TYPE_BMP_STRING       30
+#define KSBA_TYPE_DATE             31
+#define KSBA_TYPE_TIME_OF_DAY      32
+#define KSBA_TYPE_DATE_TIME        33
+#define KSBA_TYPE_DURATION         34
+#define KSBA_TYPE_OID_IRI          35
+#define KSBA_TYPE_RELATIVE_OID_IRI 36
+
+
+
 typedef gpg_error_t KsbaError _KSBA_DEPRECATED;
 
 typedef enum
@@ -69,7 +123,8 @@ typedef enum
     KSBA_CT_DIGESTED_DATA = 4,
     KSBA_CT_ENCRYPTED_DATA = 5,
     KSBA_CT_AUTH_DATA = 6,
-    KSBA_CT_PKCS12 = 7
+    KSBA_CT_PKCS12 = 7,
+    KSBA_CT_SPC_IND_DATA_CTX = 8
   }
 ksba_content_type_t;
 typedef ksba_content_type_t KsbaContentType _KSBA_DEPRECATED;
@@ -218,6 +273,11 @@ typedef const unsigned char *ksba_const_sexp_t;
 typedef const unsigned char *KsbaConstSexp _KSBA_DEPRECATED;
 
 
+/* This is a generic object used by various functions.  */
+struct ksba_der_s;
+typedef struct ksba_der_s *ksba_der_t;
+
+
 /*-- cert.c --*/
 gpg_error_t ksba_cert_new (ksba_cert_t *acert);
 void        ksba_cert_ref (ksba_cert_t cert);
@@ -527,6 +587,30 @@ const char *ksba_name_enum (ksba_name_t name, int idx);
 char       *ksba_name_get_uri (ksba_name_t name, int idx);
 
 
+/*-- der-builder.c --*/
+void ksba_der_release (ksba_der_t d);
+
+ksba_der_t ksba_der_builder_new (unsigned int nitems);
+void ksba_der_builder_reset (ksba_der_t d);
+
+void ksba_der_add_ptr (ksba_der_t d, int cls, int tag,
+                       void *value, size_t valuelen);
+void ksba_der_add_val (ksba_der_t d, int cls, int tag,
+                       const void *value, size_t valuelen);
+void ksba_der_add_int (ksba_der_t d, const void *value, size_t valuelen,
+                       int force_positive);
+void ksba_der_add_oid (ksba_der_t d, const char *oidstr);
+void ksba_der_add_bts (ksba_der_t d, const void *value, size_t valuelen,
+                       unsigned int unusedbits);
+void ksba_der_add_der (ksba_der_t d, const void *der, size_t derlen);
+void ksba_der_add_tag (ksba_der_t d, int cls, int tag);
+void ksba_der_add_end (ksba_der_t d);
+
+gpg_error_t ksba_der_builder_get (ksba_der_t d,
+                                  unsigned char **r_obj, size_t *r_objlen);
+
+
+
 /*-- util.c --*/
 void ksba_set_malloc_hooks ( void *(*new_alloc_func)(size_t n),
                              void *(*new_realloc_func)(void *p, size_t n),