make http size check work

10 files changed, 527 insertions, 300 deletions

diff --git a/cmdline/apt-cache.cc b/cmdline/apt-cache.cc
index 84b775390..0f4f7e1ce 100644
--- a/cmdline/apt-cache.cc
+++ b/cmdline/apt-cache.cc
@@ -191,7 +191,7 @@ static bool UnMet(CommandLine &CmdL)
    {
       CacheSetHelperVirtuals helper(true, GlobalError::NOTICE);
       APT::VersionList verset = APT::VersionList::FromCommandLine(CacheFile, CmdL.FileList + 1,
-				APT::VersionList::CANDIDATE, helper);
+				APT::CacheSetHelper::CANDIDATE, helper);
       for (APT::VersionList::iterator V = verset.begin(); V != verset.end(); ++V)
 	 if (ShowUnMet(V, Important) == false)
 	    return false;
@@ -264,6 +264,46 @@ static bool DumpPackage(CommandLine &CmdL)
    return true;
 }
 									/*}}}*/
+// ShowHashTableStats - Show stats about a hashtable			/*{{{*/
+// ---------------------------------------------------------------------
+/* */
+template<class T>
+static void ShowHashTableStats(std::string Type,
+                               T *StartP,
+                               map_pointer_t *Hashtable,
+                               unsigned long Size)
+{
+   // hashtable stats for the HashTable
+   unsigned long NumBuckets = Size;
+   unsigned long UsedBuckets = 0;
+   unsigned long UnusedBuckets = 0;
+   unsigned long LongestBucket = 0;
+   unsigned long ShortestBucket = NumBuckets;
+   unsigned long Entries = 0;
+   for (unsigned int i=0; i < NumBuckets; ++i)
+   {
+      T *P = StartP + Hashtable[i];
+      if(P == 0 || P == StartP)
+      {
+         ++UnusedBuckets;
+         continue;
+      }
+      ++UsedBuckets;
+      unsigned long ThisBucketSize = 0;
+      for (; P != StartP; P = StartP + P->Next)
+         ++ThisBucketSize;
+      Entries += ThisBucketSize;
+      LongestBucket = std::max(ThisBucketSize, LongestBucket);
+      ShortestBucket = std::min(ThisBucketSize, ShortestBucket);
+   }
+   cout << "Total buckets in " << Type << ": " << NumBuckets << std::endl;
+   cout << "  Unused: " << UnusedBuckets << std::endl;
+   cout << "  Used: " << UsedBuckets  << std::endl;
+   cout << "  Average entries: " << Entries/(double)NumBuckets << std::endl;
+   cout << "  Longest: " << LongestBucket << std::endl;
+   cout << "  Shortest: " << ShortestBucket << std::endl;
+}
+									/*}}}*/
 // Stats - Dump some nice statistics					/*{{{*/
 // ---------------------------------------------------------------------
 /* */
@@ -335,45 +375,84 @@ static bool Stats(CommandLine &)
       SizeToStr(Cache->Head().DescFileCount*Cache->Head().DescFileSz) << ')' << endl;
    cout << _("Total Provides mappings: ") << Cache->Head().ProvidesCount << " (" <<
       SizeToStr(Cache->Head().ProvidesCount*Cache->Head().ProvidesSz) << ')' << endl;
-   
-   // String list stats
-   unsigned long Size = 0;
-   unsigned long Count = 0;
-   for (pkgCache::StringItem *I = Cache->StringItemP + Cache->Head().StringList;
-        I!= Cache->StringItemP; I = Cache->StringItemP + I->NextItem)
-   {
-      Count++;
-      Size += strlen(Cache->StrP + I->String) + 1;
-   }
-   cout << _("Total globbed strings: ") << Count << " (" << SizeToStr(Size) << ')' << endl;
 
-   unsigned long DepVerSize = 0;
+   // String list stats
+   std::set<map_stringitem_t> stritems;
+   for (pkgCache::GrpIterator G = Cache->GrpBegin(); G.end() == false; ++G)
+      stritems.insert(G->Name);
    for (pkgCache::PkgIterator P = Cache->PkgBegin(); P.end() == false; ++P)
    {
+      stritems.insert(P->Arch);
       for (pkgCache::VerIterator V = P.VersionList(); V.end() == false; ++V)
       {
+	 if (V->VerStr != 0)
+	    stritems.insert(V->VerStr);
+	 if (V->Section != 0)
+	    stritems.insert(V->Section);
+	 stritems.insert(V->SourcePkgName);
+	 stritems.insert(V->SourceVerStr);
 	 for (pkgCache::DepIterator D = V.DependsList(); D.end() == false; ++D)
 	 {
 	    if (D->Version != 0)
-	       DepVerSize += strlen(D.TargetVer()) + 1;
+	       stritems.insert(D->Version);
 	 }
+	 for (pkgCache::DescIterator D = V.DescriptionList(); D.end() == false; ++D)
+	 {
+	    stritems.insert(D->md5sum);
+	    stritems.insert(D->language_code);
+	 }
+      }
+      for (pkgCache::PrvIterator Prv = P.ProvidesList(); Prv.end() == false; ++Prv)
+      {
+	 if (Prv->ProvideVersion != 0)
+	    stritems.insert(Prv->ProvideVersion);
       }
    }
-   cout << _("Total dependency version space: ") << SizeToStr(DepVerSize) << endl;
-   
+   for (pkgCache::PkgFileIterator F = Cache->FileBegin(); F != Cache->FileEnd(); ++F)
+   {
+      stritems.insert(F->FileName);
+      stritems.insert(F->Archive);
+      stritems.insert(F->Codename);
+      stritems.insert(F->Component);
+      stritems.insert(F->Version);
+      stritems.insert(F->Origin);
+      stritems.insert(F->Label);
+      stritems.insert(F->Architecture);
+      stritems.insert(F->Site);
+      stritems.insert(F->IndexType);
+   }
+   unsigned long Size = 0;
+   for (std::set<map_stringitem_t>::const_iterator i = stritems.begin(); i != stritems.end(); ++i)
+      Size += strlen(Cache->StrP + *i) + 1;
+
+   cout << _("Total globbed strings: ") << stritems.size() << " (" << SizeToStr(Size) << ')' << endl;
+   stritems.clear();
+
    unsigned long Slack = 0;
    for (int I = 0; I != 7; I++)
       Slack += Cache->Head().Pools[I].ItemSize*Cache->Head().Pools[I].Count;
    cout << _("Total slack space: ") << SizeToStr(Slack) << endl;
-   
+
    unsigned long Total = 0;
-   Total = Slack + Size + Cache->Head().DependsCount*Cache->Head().DependencySz + 
-           Cache->Head().VersionCount*Cache->Head().VersionSz +
-           Cache->Head().PackageCount*Cache->Head().PackageSz + 
-           Cache->Head().VerFileCount*Cache->Head().VerFileSz +
-           Cache->Head().ProvidesCount*Cache->Head().ProvidesSz;
+#define APT_CACHESIZE(X,Y) (Cache->Head().X * Cache->Head().Y)
+   Total = Slack + Size +
+      APT_CACHESIZE(GroupCount, GroupSz) +
+      APT_CACHESIZE(PackageCount, PackageSz) +
+      APT_CACHESIZE(VersionCount, VersionSz) +
+      APT_CACHESIZE(DescriptionCount, DescriptionSz) +
+      APT_CACHESIZE(DependsCount, DependencySz) +
+      APT_CACHESIZE(PackageFileCount, PackageFileSz) +
+      APT_CACHESIZE(VerFileCount, VerFileSz) +
+      APT_CACHESIZE(DescFileCount, DescFileSz) +
+      APT_CACHESIZE(ProvidesCount, ProvidesSz) +
+      (2 * Cache->Head().HashTableSize * sizeof(map_id_t));
    cout << _("Total space accounted for: ") << SizeToStr(Total) << endl;
-   
+#undef APT_CACHESIZE
+
+   // hashtable stats
+   ShowHashTableStats<pkgCache::Package>("PkgHashTable", Cache->PkgP, Cache->Head().PkgHashTable(), Cache->Head().HashTableSize);
+   ShowHashTableStats<pkgCache::Group>("GrpHashTable", Cache->GrpP, Cache->Head().GrpHashTable(), Cache->Head().HashTableSize);
+
    return true;
 }
 									/*}}}*/
@@ -507,7 +586,7 @@ static bool DumpAvail(CommandLine &)
 	 break;
       }
 
-      FileFd PkgF(File.FileName(),FileFd::ReadOnly);
+      FileFd PkgF(File.FileName(),FileFd::ReadOnly, FileFd::Extension);
       if (_error->PendingError() == true)
 	 break;
       
@@ -579,7 +658,7 @@ static bool ShowDepends(CommandLine &CmdL, bool const RevDepends)
       return false;
 
    CacheSetHelperVirtuals helper(false);
-   APT::VersionList verset = APT::VersionList::FromCommandLine(CacheFile, CmdL.FileList + 1, APT::VersionList::CANDIDATE, helper);
+   APT::VersionList verset = APT::VersionList::FromCommandLine(CacheFile, CmdL.FileList + 1, APT::CacheSetHelper::CANDIDATE, helper);
    if (verset.empty() == true && helper.virtualPkgs.empty() == true)
       return _error->Error(_("No packages found"));
    std::vector<bool> Shown(Cache->Head().PackageCount);
@@ -647,7 +726,7 @@ static bool ShowDepends(CommandLine &CmdL, bool const RevDepends)
 		if (Recurse == true && Shown[Trg->ID] == false)
 		{
 		  Shown[Trg->ID] = true;
-		  verset.insert(APT::VersionSet::FromPackage(CacheFile, Trg, APT::VersionSet::CANDIDATE, helper));
+		  verset.insert(APT::VersionSet::FromPackage(CacheFile, Trg, APT::CacheSetHelper::CANDIDATE, helper));
 		}
 
 	      }
@@ -666,7 +745,7 @@ static bool ShowDepends(CommandLine &CmdL, bool const RevDepends)
 		if (Recurse == true && Shown[V.ParentPkg()->ID] == false)
 		{
 		  Shown[V.ParentPkg()->ID] = true;
-		  verset.insert(APT::VersionSet::FromPackage(CacheFile, V.ParentPkg(), APT::VersionSet::CANDIDATE, helper));
+		  verset.insert(APT::VersionSet::FromPackage(CacheFile, V.ParentPkg(), APT::CacheSetHelper::CANDIDATE, helper));
 		}
 	    }
 
@@ -761,9 +840,9 @@ static bool XVcg(CommandLine &CmdL)
 
    // Load the list of packages from the command line into the show list
    APT::CacheSetHelper helper(true, GlobalError::NOTICE);
-   std::list<APT::PackageSet::Modifier> mods;
-   mods.push_back(APT::PackageSet::Modifier(0, ",", APT::PackageSet::Modifier::POSTFIX));
-   mods.push_back(APT::PackageSet::Modifier(1, "^", APT::PackageSet::Modifier::POSTFIX));
+   std::list<APT::CacheSetHelper::PkgModifier> mods;
+   mods.push_back(APT::CacheSetHelper::PkgModifier(0, ",", APT::PackageSet::Modifier::POSTFIX));
+   mods.push_back(APT::CacheSetHelper::PkgModifier(1, "^", APT::PackageSet::Modifier::POSTFIX));
    std::map<unsigned short, APT::PackageSet> pkgsets =
 		APT::PackageSet::GroupedFromCommandLine(CacheFile, CmdL.FileList + 1, mods, 0, helper);
 
@@ -973,9 +1052,9 @@ static bool Dotty(CommandLine &CmdL)
 
    // Load the list of packages from the command line into the show list
    APT::CacheSetHelper helper(true, GlobalError::NOTICE);
-   std::list<APT::PackageSet::Modifier> mods;
-   mods.push_back(APT::PackageSet::Modifier(0, ",", APT::PackageSet::Modifier::POSTFIX));
-   mods.push_back(APT::PackageSet::Modifier(1, "^", APT::PackageSet::Modifier::POSTFIX));
+   std::list<APT::CacheSetHelper::PkgModifier> mods;
+   mods.push_back(APT::CacheSetHelper::PkgModifier(0, ",", APT::PackageSet::Modifier::POSTFIX));
+   mods.push_back(APT::CacheSetHelper::PkgModifier(1, "^", APT::PackageSet::Modifier::POSTFIX));
    std::map<unsigned short, APT::PackageSet> pkgsets =
 		APT::PackageSet::GroupedFromCommandLine(CacheFile, CmdL.FileList + 1, mods, 0, helper);
 
@@ -1231,7 +1310,7 @@ static bool DisplayRecord(pkgCacheFile &CacheFile, pkgCache::VerIterator V)
 struct ExDescFile
 {
    pkgCache::DescFile *Df;
-   map_ptrloc ID;
+   map_id_t ID;
 };
 
 // Search - Perform a search						/*{{{*/
@@ -1278,8 +1357,8 @@ static bool Search(CommandLine &CmdL)
    ExDescFile *DFList = new ExDescFile[descCount];
    memset(DFList,0,sizeof(*DFList) * descCount);
 
-   bool PatternMatch[descCount * NumPatterns];
-   memset(PatternMatch,false,sizeof(PatternMatch));
+   bool *PatternMatch = new bool[descCount * NumPatterns];
+   memset(PatternMatch,false,sizeof(*PatternMatch) * descCount * NumPatterns);
 
    // Map versions that we want to write out onto the VerList array.
    for (pkgCache::GrpIterator G = Cache->GrpBegin(); G.end() == false; ++G)
@@ -1389,6 +1468,7 @@ static bool Search(CommandLine &CmdL)
    }
    
    delete [] DFList;
+   delete [] PatternMatch;
    for (unsigned I = 0; I != NumPatterns; I++)
       regfree(&Patterns[I]);
    if (ferror(stdout))
@@ -1428,8 +1508,8 @@ static bool ShowPackage(CommandLine &CmdL)
 {
    pkgCacheFile CacheFile;
    CacheSetHelperVirtuals helper(true, GlobalError::NOTICE);
-   APT::VersionList::Version const select = _config->FindB("APT::Cache::AllVersions", true) ?
-			APT::VersionList::ALL : APT::VersionList::CANDIDATE;
+   APT::CacheSetHelper::VerSelector const select = _config->FindB("APT::Cache::AllVersions", true) ?
+			APT::CacheSetHelper::ALL : APT::CacheSetHelper::CANDIDATE;
    APT::VersionList const verset = APT::VersionList::FromCommandLine(CacheFile, CmdL.FileList + 1, select, helper);
    for (APT::VersionList::const_iterator Ver = verset.begin(); Ver != verset.end(); ++Ver)
       if (DisplayRecord(CacheFile, Ver) == false)
diff --git a/cmdline/apt-dump-solver.cc b/cmdline/apt-dump-solver.cc
index 04e13bde9..424764b3c 100644
--- a/cmdline/apt-dump-solver.cc
+++ b/cmdline/apt-dump-solver.cc
@@ -40,6 +40,8 @@ int main(int argc,const char *argv[])					/*{{{*/
 		ShowHelp();
 		return 0;
 	}
+        // we really don't need anything
+        DropPrivs();
 
 	FILE* input = fdopen(STDIN_FILENO, "r");
 	FILE* output = fopen("/tmp/dump.edsp", "w");
diff --git a/cmdline/apt-extracttemplates.cc b/cmdline/apt-extracttemplates.cc
index 0d568106f..f95b9e5ba 100644
--- a/cmdline/apt-extracttemplates.cc
+++ b/cmdline/apt-extracttemplates.cc
@@ -140,7 +140,7 @@ bool DebFile::DoItem(Item &I, int &Fd)
 // ---------------------------------------------------------------------
 /* */
 bool DebFile::Process(Item &/*I*/, const unsigned char *data,
-		unsigned long size, unsigned long pos)
+		unsigned long long size, unsigned long long pos)
 {
 	switch (Which)
 	{
diff --git a/cmdline/apt-extracttemplates.h b/cmdline/apt-extracttemplates.h
index 6d2870a02..829cdae75 100644
--- a/cmdline/apt-extracttemplates.h
+++ b/cmdline/apt-extracttemplates.h
@@ -28,7 +28,7 @@ public:
 	~DebFile();
 	bool DoItem(Item &I, int &fd);
 	bool Process(pkgDirStream::Item &I, const unsigned char *data, 
-		unsigned long size, unsigned long pos);
+		unsigned long long size, unsigned long long pos);
 
 	bool Go();
 	bool ParseInfo();
diff --git a/cmdline/apt-get.cc b/cmdline/apt-get.cc
index 1943a0fa7..13a85d34b 100644
--- a/cmdline/apt-get.cc
+++ b/cmdline/apt-get.cc
@@ -76,6 +76,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/ioctl.h>
 #include <sys/stat.h>
 #include <sys/statfs.h>
 #include <sys/statvfs.h>
@@ -194,7 +195,7 @@ static std::string GetReleaseForSourceRecord(pkgSourceList *SrcList,
 // FindSrc - Find a source record					/*{{{*/
 // ---------------------------------------------------------------------
 /* */
-static pkgSrcRecords::Parser *FindSrc(const char *Name,pkgRecords &Recs,
+static pkgSrcRecords::Parser *FindSrc(const char *Name,
 			       pkgSrcRecords &SrcRecs,string &Src,
 			       CacheFile &CacheFile)
 {
@@ -302,16 +303,10 @@ static pkgSrcRecords::Parser *FindSrc(const char *Name,pkgRecords &Recs,
 		  (VF.File().Archive() != 0 && VF.File().Archive() == RelTag) ||
 		  (VF.File().Codename() != 0 && VF.File().Codename() == RelTag)) 
 	       {
-		  pkgRecords::Parser &Parse = Recs.Lookup(VF);
-		  Src = Parse.SourcePkg();
-		  // no SourcePkg name, so it is the "binary" name
-		  if (Src.empty() == true)
-		     Src = TmpSrc;
+		  Src = Ver.SourcePkgName();
 		  // the Version we have is possibly fuzzy or includes binUploads,
-		  // so we use the Version of the SourcePkg (empty if same as package)
-		  VerTag = Parse.SourceVer();
-		  if (VerTag.empty() == true)
-		     VerTag = Ver.VerStr();
+		  // so we use the Version of the SourcePkg
+		  VerTag = Ver.SourceVerStr();
 		  break;
 	       }
 	    }
@@ -342,10 +337,10 @@ static pkgSrcRecords::Parser *FindSrc(const char *Name,pkgRecords &Recs,
 	 pkgCache::VerIterator Ver = Cache->GetCandidateVer(Pkg);
 	 if (Ver.end() == false) 
 	 {
-	    pkgRecords::Parser &Parse = Recs.Lookup(Ver.FileList());
-	    Src = Parse.SourcePkg();
-	    if (VerTag.empty() == true)
-	       VerTag = Parse.SourceVer();
+	    if (strcmp(Ver.SourcePkgName(),Ver.ParentPkg().Name()) != 0)
+	       Src = Ver.SourcePkgName();
+	    if (VerTag.empty() == true && strcmp(Ver.SourceVerStr(),Ver.VerStr()) != 0)
+	       VerTag = Ver.SourceVerStr();
 	 }
       }
    }
@@ -539,7 +534,7 @@ static bool DoDSelectUpgrade(CommandLine &)
    }
 
    // Now upgrade everything
-   if (pkgAllUpgrade(Cache) == false)
+   if (APT::Upgrade::Upgrade(Cache, APT::Upgrade::FORBID_REMOVE_PACKAGES | APT::Upgrade::FORBID_INSTALL_NEW_PACKAGES) == false)
    {
       ShowBroken(c1out,Cache,false);
       return _error->Error(_("Internal error, problem resolver broke stuff"));
@@ -554,30 +549,44 @@ static bool DoDSelectUpgrade(CommandLine &)
 static bool DoClean(CommandLine &)
 {
    std::string const archivedir = _config->FindDir("Dir::Cache::archives");
-   std::string const pkgcache = _config->FindFile("Dir::cache::pkgcache");
-   std::string const srcpkgcache = _config->FindFile("Dir::cache::srcpkgcache");
+   std::string const listsdir = _config->FindDir("Dir::state::lists");
 
    if (_config->FindB("APT::Get::Simulate") == true)
    {
+      std::string const pkgcache = _config->FindFile("Dir::cache::pkgcache");
+      std::string const srcpkgcache = _config->FindFile("Dir::cache::srcpkgcache");
       cout << "Del " << archivedir << "* " << archivedir << "partial/*"<< endl
+	   << "Del " << listsdir << "partial/*" << endl
 	   << "Del " << pkgcache << " " << srcpkgcache << endl;
       return true;
    }
-   
+
+   bool const NoLocking = _config->FindB("Debug::NoLocking",false);
    // Lock the archive directory
    FileFd Lock;
-   if (_config->FindB("Debug::NoLocking",false) == false)
+   if (NoLocking == false)
    {
       int lock_fd = GetLock(archivedir + "lock");
       if (lock_fd < 0)
-	 return _error->Error(_("Unable to lock the download directory"));
+	 return _error->Error(_("Unable to lock directory %s"), archivedir.c_str());
       Lock.Fd(lock_fd);
    }
-   
+
    pkgAcquire Fetcher;
    Fetcher.Clean(archivedir);
    Fetcher.Clean(archivedir + "partial/");
 
+   if (NoLocking == false)
+   {
+      Lock.Close();
+      int lock_fd = GetLock(listsdir + "lock");
+      if (lock_fd < 0)
+	 return _error->Error(_("Unable to lock directory %s"), listsdir.c_str());
+      Lock.Fd(lock_fd);
+   }
+
+   Fetcher.Clean(listsdir + "partial/");
+
    pkgCacheFile::RemoveCaches();
 
    return true;
@@ -631,14 +640,14 @@ static bool DoDownload(CommandLine &CmdL)
 
    APT::CacheSetHelper helper(c0out);
    APT::VersionSet verset = APT::VersionSet::FromCommandLine(Cache,
-		CmdL.FileList + 1, APT::VersionSet::CANDIDATE, helper);
+		CmdL.FileList + 1, APT::CacheSetHelper::CANDIDATE, helper);
 
    if (verset.empty() == true)
       return false;
 
    AcqTextStatus Stat(ScreenWidth, _config->FindI("quiet", 0));
    pkgAcquire Fetcher;
-   if (Fetcher.Setup(&Stat) == false)
+   if (Fetcher.Setup(&Stat, "", false) == false)
       return false;
 
    pkgRecords Recs(Cache);
@@ -664,7 +673,7 @@ static bool DoDownload(CommandLine &CmdL)
    {
       pkgAcquire::UriIterator I = Fetcher.UriBegin();
       for (; I != Fetcher.UriEnd(); ++I)
-	 cout << '\'' << I->URI << "' " << flNotDir(I->Owner->DestFile) << ' ' <<
+	 cout << '\'' << I->URI << "' " << flNotDir(I->Owner->DestFile)  << ' ' <<
 	       I->Owner->FileSize << ' ' << I->Owner->HashSum() << endl;
       return true;
    }
@@ -730,7 +739,6 @@ static bool DoSource(CommandLine &CmdL)
    pkgSourceList *List = Cache.GetSourceList();
    
    // Create the text record parsers
-   pkgRecords Recs(Cache);
    pkgSrcRecords SrcRecs(*List);
    if (_error->PendingError() == true)
       return false;
@@ -755,14 +763,18 @@ static bool DoSource(CommandLine &CmdL)
 
    // Load the requestd sources into the fetcher
    unsigned J = 0;
+   std::string UntrustedList;
    for (const char **I = CmdL.FileList + 1; *I != 0; I++, J++)
    {
       string Src;
-      pkgSrcRecords::Parser *Last = FindSrc(*I,Recs,SrcRecs,Src,Cache);
+      pkgSrcRecords::Parser *Last = FindSrc(*I,SrcRecs,Src,Cache);
       
       if (Last == 0) {
 	 return _error->Error(_("Unable to find a source package for %s"),Src.c_str());
       }
+
+      if (Last->Index().IsTrusted() == false)
+         UntrustedList += Src + " ";
       
       string srec = Last->AsStr();
       string::size_type pos = srec.find("\nVcs-");
@@ -848,6 +860,10 @@ static bool DoSource(CommandLine &CmdL)
 			I->Hashes, I->Size, Last->Index().SourceInfo(*Last,*I), Src);
       }
    }
+
+   // check authentication status of the source as well
+   if (UntrustedList != "" && !AuthPrompt(UntrustedList, false))
+      return false;
    
    // Display statistics
    unsigned long long FetchBytes = Fetcher.FetchNeeded();
@@ -946,18 +962,19 @@ static bool DoSource(CommandLine &CmdL)
 	 else
 	 {
 	    // Call dpkg-source
-	    char S[500];
-	    snprintf(S,sizeof(S),"%s -x %s",
+	    std::string const sourceopts = _config->Find("DPkg::Source-Options", "-x");
+	    std::string S;
+	    strprintf(S, "%s %s %s",
 		     _config->Find("Dir::Bin::dpkg-source","dpkg-source").c_str(),
-		     Dsc[I].Dsc.c_str());
-	    if (system(S) != 0)
+		     sourceopts.c_str(), Dsc[I].Dsc.c_str());
+	    if (system(S.c_str()) != 0)
 	    {
-	       fprintf(stderr,_("Unpack command '%s' failed.\n"),S);
-	       fprintf(stderr,_("Check if the 'dpkg-dev' package is installed.\n"));
+	       fprintf(stderr, _("Unpack command '%s' failed.\n"), S.c_str());
+	       fprintf(stderr, _("Check if the 'dpkg-dev' package is installed.\n"));
 	       _exit(1);
-	    }	    
+	    }
 	 }
-	 
+
 	 // Try to compile it with dpkg-buildpackage
 	 if (_config->FindB("APT::Get::Compile",false) == true)
 	 {
@@ -973,20 +990,20 @@ static bool DoSource(CommandLine &CmdL)
 	    buildopts.append(_config->Find("DPkg::Build-Options","-b -uc"));
 
 	    // Call dpkg-buildpackage
-	    char S[500];
-	    snprintf(S,sizeof(S),"cd %s && %s %s",
+	    std::string S;
+	    strprintf(S, "cd %s && %s %s",
 		     Dir.c_str(),
 		     _config->Find("Dir::Bin::dpkg-buildpackage","dpkg-buildpackage").c_str(),
 		     buildopts.c_str());
-	    
-	    if (system(S) != 0)
+
+	    if (system(S.c_str()) != 0)
 	    {
-	       fprintf(stderr,_("Build command '%s' failed.\n"),S);
+	       fprintf(stderr, _("Build command '%s' failed.\n"), S.c_str());
 	       _exit(1);
-	    }	    
-	 }      
+	    }
+	 }
       }
-      
+
       _exit(0);
    }
 
@@ -1027,7 +1044,6 @@ static bool DoBuildDep(CommandLine &CmdL)
    pkgSourceList *List = Cache.GetSourceList();
    
    // Create the text record parsers
-   pkgRecords Recs(Cache);
    pkgSrcRecords SrcRecs(*List);
    if (_error->PendingError() == true)
       return false;
@@ -1056,9 +1072,12 @@ static bool DoBuildDep(CommandLine &CmdL)
       string Src;
       pkgSrcRecords::Parser *Last = 0;
 
-      // a unpacked debian source tree
-      if (DirectoryExists(*I))
+      // an unpacked debian source tree
+      using APT::String::Startswith;
+      if ((Startswith(*I, "./") || Startswith(*I, "/")) &&
+          DirectoryExists(*I))
       {
+         ioprintf(c1out, _("Note, using directory '%s' to get the build dependencies\n"), *I);
          // FIXME: how can we make this more elegant?
          std::string TypeName = "debian/control File Source Index";
          pkgIndexFile::Type *Type = pkgIndexFile::Type::GetType(TypeName.c_str());
@@ -1068,6 +1087,8 @@ static bool DoBuildDep(CommandLine &CmdL)
       // if its a local file (e.g. .dsc) use this
       else if (FileExists(*I))
       {
+         ioprintf(c1out, _("Note, using file '%s' to get the build dependencies\n"), *I);
+
          // see if we can get a parser for this pkgIndexFile type
          string TypeName = flExtension(*I) + " File Source Index";
          pkgIndexFile::Type *Type = pkgIndexFile::Type::GetType(TypeName.c_str());
@@ -1075,7 +1096,7 @@ static bool DoBuildDep(CommandLine &CmdL)
             Last = Type->CreateSrcPkgParser(*I);
       } else {
          // normal case, search the cache for the source file
-         Last = FindSrc(*I,Recs,SrcRecs,Src,Cache);
+         Last = FindSrc(*I,SrcRecs,Src,Cache);
       }
 
       if (Last == 0)
@@ -1426,21 +1447,15 @@ static bool DoBuildDep(CommandLine &CmdL)
  * pool/ next to the deb itself)
  * Example return: "pool/main/a/apt/apt_0.8.8ubuntu3" 
  */
-static string GetChangelogPath(CacheFile &Cache, 
-                        pkgCache::PkgIterator Pkg,
+static string GetChangelogPath(CacheFile &Cache,
                         pkgCache::VerIterator Ver)
 {
-   string path;
-
    pkgRecords Recs(Cache);
    pkgRecords::Parser &rec=Recs.Lookup(Ver.FileList());
-   string srcpkg = rec.SourcePkg().empty() ? Pkg.Name() : rec.SourcePkg();
-   string ver = Ver.VerStr();
-   // if there is a source version it always wins
-   if (rec.SourceVer() != "")
-      ver = rec.SourceVer();
-   path = flNotFile(rec.FileName());
-   path += srcpkg + "_" + StripEpoch(ver);
+   string path = flNotFile(rec.FileName());
+   path.append(Ver.SourcePkgName());
+   path.append("_");
+   path.append(StripEpoch(Ver.SourceVerStr()));
    return path;
 }
 									/*}}}*/
@@ -1454,7 +1469,6 @@ static string GetChangelogPath(CacheFile &Cache,
  *  http://packages.medibuntu.org/pool/non-free/m/mplayer/mplayer_1.0~rc4~try1.dsfg1-1ubuntu1+medibuntu1.changelog
  */
 static bool GuessThirdPartyChangelogUri(CacheFile &Cache, 
-                                 pkgCache::PkgIterator Pkg,
                                  pkgCache::VerIterator Ver,
                                  string &out_uri)
 {
@@ -1469,7 +1483,7 @@ static bool GuessThirdPartyChangelogUri(CacheFile &Cache,
       return false;
 
    // get archive uri for the binary deb
-   string path_without_dot_changelog = GetChangelogPath(Cache, Pkg, Ver);
+   string path_without_dot_changelog = GetChangelogPath(Cache, Ver);
    out_uri = index->ArchiveURI(path_without_dot_changelog + ".changelog");
 
    // now strip away the filename and add srcpkg_srcver.changelog
@@ -1487,25 +1501,20 @@ static bool DownloadChangelog(CacheFile &CacheFile, pkgAcquire &Fetcher,
  * GuessThirdPartyChangelogUri for details how)
  */
 {
-   string path;
-   string descr;
-   string server;
-   string changelog_uri;
-
-   // data structures we need
-   pkgCache::PkgIterator Pkg = Ver.ParentPkg();
-
    // make the server root configurable
-   server = _config->Find("Apt::Changelogs::Server",
+   string const server = _config->Find("Apt::Changelogs::Server",
                           "http://packages.debian.org/changelogs");
-   path = GetChangelogPath(CacheFile, Pkg, Ver);
+   string const path = GetChangelogPath(CacheFile, Ver);
+   string changelog_uri;
    strprintf(changelog_uri, "%s/%s/changelog", server.c_str(), path.c_str());
    if (_config->FindB("APT::Get::Print-URIs", false) == true)
    {
       std::cout << '\'' << changelog_uri << '\'' << std::endl;
       return true;
    }
+   pkgCache::PkgIterator const Pkg = Ver.ParentPkg();
 
+   string descr;
    strprintf(descr, _("Changelog for %s (%s)"), Pkg.Name(), changelog_uri.c_str());
    // queue it
    new pkgAcqFile(&Fetcher, changelog_uri, "", 0, descr, Pkg.Name(), "ignored", targetfile);
@@ -1516,7 +1525,7 @@ static bool DownloadChangelog(CacheFile &CacheFile, pkgAcquire &Fetcher,
    if (!FileExists(targetfile))
    {
       string third_party_uri;
-      if (GuessThirdPartyChangelogUri(CacheFile, Pkg, Ver, third_party_uri))
+      if (GuessThirdPartyChangelogUri(CacheFile, Ver, third_party_uri))
       {
          strprintf(descr, _("Changelog for %s (%s)"), Pkg.Name(), third_party_uri.c_str());
          new pkgAcqFile(&Fetcher, third_party_uri, "", 0, descr, Pkg.Name(), "ignored", targetfile);
@@ -1541,7 +1550,7 @@ static bool DoChangelog(CommandLine &CmdL)
    
    APT::CacheSetHelper helper(c0out);
    APT::VersionList verset = APT::VersionList::FromCommandLine(Cache,
-		CmdL.FileList + 1, APT::VersionList::CANDIDATE, helper);
+		CmdL.FileList + 1, APT::CacheSetHelper::CANDIDATE, helper);
    if (verset.empty() == true)
       return false;
    pkgAcquire Fetcher;
@@ -1556,7 +1565,8 @@ static bool DoChangelog(CommandLine &CmdL)
    }
 
    AcqTextStatus Stat(ScreenWidth, _config->FindI("quiet",0));
-   Fetcher.Setup(&Stat);
+   if (Fetcher.Setup(&Stat, "",false) == false)
+      return false;
 
    bool const downOnly = _config->FindB("APT::Get::Download-Only", false);
 
@@ -1578,7 +1588,7 @@ static bool DoChangelog(CommandLine &CmdL)
    {
       string changelogfile;
       if (downOnly == false)
-	 changelogfile.append(tmpname).append("changelog");
+	 changelogfile.append(tmpname).append("/changelog");
       else
 	 changelogfile.append(Ver.ParentPkg().Name()).append(".changelog");
       if (DownloadChangelog(Cache, Fetcher, Ver, changelogfile) && downOnly == false)
diff --git a/cmdline/apt-helper.cc b/cmdline/apt-helper.cc
index 2c1107d90..b89df61d6 100644
--- a/cmdline/apt-helper.cc
+++ b/cmdline/apt-helper.cc
@@ -16,6 +16,7 @@
 #include <apt-pkg/fileutl.h>
 #include <apt-pkg/acquire.h>
 #include <apt-pkg/acquire-item.h>
+#include <apt-pkg/proxy.h>
 
 #include <apt-private/acqprogress.h>
 #include <apt-private/private-output.h>
@@ -29,6 +30,19 @@
 #include <apti18n.h>
 									/*}}}*/
 
+static bool DoAutoDetectProxy(CommandLine &CmdL)
+{
+   if (CmdL.FileSize() != 2)
+      return _error->Error(_("Need one URL as argument"));
+   URI ServerURL(CmdL.FileList[1]);
+   AutoDetectProxy(ServerURL);
+   std::string SpecificProxy = _config->Find("Acquire::"+ServerURL.Access+"::Proxy::" + ServerURL.Host);
+   ioprintf(std::cout, "Using proxy '%s' for URL '%s'\n",
+            SpecificProxy.c_str(), std::string(ServerURL).c_str());
+
+   return true;
+}
+
 static bool DoDownloadFile(CommandLine &CmdL)
 {
    if (CmdL.FileSize() <= 2)
@@ -37,13 +51,15 @@ static bool DoDownloadFile(CommandLine &CmdL)
 
    pkgAcquire Fetcher;
    AcqTextStatus Stat(ScreenWidth, _config->FindI("quiet",0));
-   Fetcher.Setup(&Stat);
+   if (Fetcher.Setup(&Stat, "", false) == false)
+      return false;
    std::string download_uri = CmdL.FileList[1];
    std::string targetfile = CmdL.FileList[2];
    std::string hash;
    if (CmdL.FileSize() > 3)
       hash = CmdL.FileList[3];
-   new pkgAcqFile(&Fetcher, download_uri, hash, 0, "desc", "short-desc", 
+   // we use download_uri as descr and targetfile as short-descr
+   new pkgAcqFile(&Fetcher, download_uri, hash, 0, download_uri, targetfile, 
                   "dest-dir-ignored", targetfile);
    Fetcher.Run();
    bool Failed = false;
@@ -69,6 +85,7 @@ static bool ShowHelp(CommandLine &)
       "\n"
       "Commands:\n"
       "   download-file - download the given uri to the target-path\n"
+      "   auto-detect-proxy - detect proxy using apt.conf\n"
       "\n"
       "                       This APT helper has Super Meep Powers.\n");
    return true;
@@ -79,6 +96,7 @@ int main(int argc,const char *argv[])					/*{{{*/
 {
    CommandLine::Dispatch Cmds[] = {{"help",&ShowHelp},
 				   {"download-file", &DoDownloadFile},
+				   {"auto-detect-proxy", &DoAutoDetectProxy},
                                    {0,0}};
 
    std::vector<CommandLine::Args> Args = getCommandArgs(
diff --git a/cmdline/apt-internal-solver.cc b/cmdline/apt-internal-solver.cc
index b85c07c33..0f2ec6283 100644
--- a/cmdline/apt-internal-solver.cc
+++ b/cmdline/apt-internal-solver.cc
@@ -24,13 +24,16 @@
 #include <apt-pkg/depcache.h>
 #include <apt-pkg/pkgcache.h>
 #include <apt-pkg/cacheiterators.h>
+#include <apt-private/private-output.h>
 
 #include <string.h>
 #include <iostream>
+#include <sstream>
 #include <list>
 #include <string>
 #include <unistd.h>
 #include <cstdio>
+#include <stdlib.h>
 
 #include <apti18n.h>
 									/*}}}*/
@@ -56,6 +59,12 @@ static bool ShowHelp(CommandLine &) {
 	return true;
 }
 									/*}}}*/
+APT_NORETURN static void DIE(std::string const &message) {		/*{{{*/
+	std::cerr << "ERROR: " << message << std::endl;
+	_error->DumpErrors(std::cerr);
+	exit(EXIT_FAILURE);
+}
+									/*}}}*/
 int main(int argc,const char *argv[])					/*{{{*/
 {
 	CommandLine::Args Args[] = {
@@ -67,6 +76,9 @@ int main(int argc,const char *argv[])					/*{{{*/
 		{'o',"option",0,CommandLine::ArbItem},
 		{0,0,0,0}};
 
+        // we really don't need anything
+        DropPrivs();
+
 	CommandLine CmdL(Args,_config);
 	if (pkgInitConfig(*_config) == false ||
 	    CmdL.Parse(argc,argv) == false) {
@@ -115,34 +127,29 @@ int main(int argc,const char *argv[])					/*{{{*/
 
 	EDSP::WriteProgress(0, "Start up solver…", output);
 
-	if (pkgInitSystem(*_config,_system) == false) {
-		std::cerr << "System could not be initialized!" << std::endl;
-		return 1;
-	}
+	if (pkgInitSystem(*_config,_system) == false)
+		DIE("System could not be initialized!");
 
 	EDSP::WriteProgress(1, "Read request…", output);
 
 	if (WaitFd(input, false, 5) == false)
-		std::cerr << "WAIT timed out in the resolver" << std::endl;
+		DIE("WAIT timed out in the resolver");
 
 	std::list<std::string> install, remove;
 	bool upgrade, distUpgrade, autoRemove;
-	if (EDSP::ReadRequest(input, install, remove, upgrade, distUpgrade, autoRemove) == false) {
-		std::cerr << "Parsing the request failed!" << std::endl;
-		return 2;
-	}
+	if (EDSP::ReadRequest(input, install, remove, upgrade, distUpgrade, autoRemove) == false)
+		DIE("Parsing the request failed!");
 
 	EDSP::WriteProgress(5, "Read scenario…", output);
 
 	pkgCacheFile CacheFile;
-	CacheFile.Open(NULL, false);
+	if (CacheFile.Open(NULL, false) == false)
+		DIE("Failed to open CacheFile!");
 
 	EDSP::WriteProgress(50, "Apply request on scenario…", output);
 
-	if (EDSP::ApplyRequest(install, remove, CacheFile) == false) {
-		std::cerr << "Failed to apply request to depcache!" << std::endl;
-		return 3;
-	}
+	if (EDSP::ApplyRequest(install, remove, CacheFile) == false)
+		DIE("Failed to apply request to depcache!");
 
 	pkgProblemResolver Fix(CacheFile);
 	for (std::list<std::string>::const_iterator i = remove.begin();
@@ -166,27 +173,27 @@ int main(int argc,const char *argv[])					/*{{{*/
 
 	EDSP::WriteProgress(60, "Call problemresolver on current scenario…", output);
 
+	std::string failure;
 	if (upgrade == true) {
-		if (pkgAllUpgrade(CacheFile) == false) {
-			EDSP::WriteError("ERR_UNSOLVABLE_UPGRADE", "An upgrade error occurred", output);
-			return 0;
-		}
+		if (APT::Upgrade::Upgrade(CacheFile, APT::Upgrade::FORBID_REMOVE_PACKAGES | APT::Upgrade::FORBID_INSTALL_NEW_PACKAGES) == false)
+			failure = "ERR_UNSOLVABLE_UPGRADE";
 	} else if (distUpgrade == true) {
-		if (pkgDistUpgrade(CacheFile) == false) {
-			EDSP::WriteError("ERR_UNSOLVABLE_DIST_UPGRADE", "An dist-upgrade error occurred", output);
-			return 0;
-		}
-	} else if (Fix.Resolve() == false) {
-		EDSP::WriteError("ERR_UNSOLVABLE", "An error occurred", output);
+		if (APT::Upgrade::Upgrade(CacheFile, APT::Upgrade::ALLOW_EVERYTHING) == false)
+			failure = "ERR_UNSOLVABLE_DIST_UPGRADE";
+	} else if (Fix.Resolve() == false)
+		failure = "ERR_UNSOLVABLE";
+
+	if (failure.empty() == false) {
+		std::ostringstream broken;
+		ShowBroken(broken, CacheFile, false);
+		EDSP::WriteError(failure.c_str(), broken.str(), output);
 		return 0;
 	}
 
 	EDSP::WriteProgress(95, "Write solution…", output);
 
-	if (EDSP::WriteSolution(CacheFile, output) == false) {
-		std::cerr << "Failed to output the solution!" << std::endl;
-		return 4;
-	}
+	if (EDSP::WriteSolution(CacheFile, output) == false)
+		DIE("Failed to output the solution!");
 
 	EDSP::WriteProgress(100, "Done", output);
 
diff --git a/cmdline/apt-key.in b/cmdline/apt-key.in
index 0774cf4b7..7a3852ee8 100644
--- a/cmdline/apt-key.in
+++ b/cmdline/apt-key.in
@@ -3,29 +3,6 @@
 set -e
 unset GREP_OPTIONS
 
-GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring"
-
-# gpg needs (in different versions more or less) files to function correctly,
-# so we give it its own homedir and generate some valid content for it
-GPGHOMEDIR="$(mktemp -d)"
-CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
-trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
-chmod 700 "$GPGHOMEDIR"
-# We don't use a secret keyring, of course, but gpg panics and
-# implodes if there isn't one available - and writeable for imports
-SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
-touch $SECRETKEYRING
-GPG_CMD="$GPG_CMD --homedir $GPGHOMEDIR"
-# create the trustdb with an (empty) dummy keyring
-# older gpgs required it, newer gpgs even warn that it isn't needed,
-# but require it nonetheless for some commands, so we just play safe
-# here for the foreseeable future and create a dummy one
-$GPG_CMD --quiet --check-trustdb --keyring $SECRETKEYRING >/dev/null 2>&1
-# tell gpg that it shouldn't try to maintain a trustdb file
-GPG_CMD="$GPG_CMD --no-auto-check-trustdb --trust-model always"
-
-GPG="$GPG_CMD"
-
 APT_DIR="/"
 eval $(apt-config shell APT_DIR Dir)
 
@@ -37,22 +14,26 @@ REMOVED_KEYS='&keyring-removed-filename;'
 eval $(apt-config shell REMOVED_KEYS APT::Key::RemovedKeys)
 ARCHIVE_KEYRING_URI='&keyring-uri;'
 eval $(apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI)
-TMP_KEYRING=${APT_DIR}/var/lib/apt/keyrings/maybe-import-keyring.gpg
+
+aptkey_echo() { echo "$@"; }
 
 requires_root() {
 	if [ "$(id -u)" -ne 0 ]; then
-		echo >&1 "ERROR: This command can only be used by root."
+		echo >&2 "ERROR: This command can only be used by root."
 		exit 1
 	fi
 }
 
-# gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
-init_keyring() {
-    for path; do
-        if ! [ -e "$path" ]; then
-            touch -- "$path"
-            chmod 0644 -- "$path"
-        fi
+get_fingerprints_of_keyring() {
+    $GPG_CMD --keyring "$1" --with-colons --fingerprint | while read publine; do
+	# search for a public key
+	if [ "${publine%%:*}" != 'pub' ]; then continue; fi
+	# search for the associated fingerprint (should be the very next line)
+	while read fprline; do
+	   if [ "${fprline%%:*}" = 'sub' ]; then break; # should never happen
+	   elif [ "${fprline%%:*}" != 'fpr' ]; then continue; fi
+	   echo "$fprline" | cut -d':' -f 10
+	done
     done
 }
 
@@ -61,11 +42,11 @@ add_keys_with_verify_against_master_keyring() {
     MASTER=$2
 
     if [ ! -f "$ADD_KEYRING" ]; then
-	echo "ERROR: '$ADD_KEYRING' not found"
+	echo >&2 "ERROR: '$ADD_KEYRING' not found"
 	return
-    fi 
+    fi
     if [ ! -f "$MASTER" ]; then
-	echo "ERROR: '$MASTER' not found"
+	echo >&2 "ERROR: '$MASTER' not found"
 	return
     fi
 
@@ -73,7 +54,7 @@ add_keys_with_verify_against_master_keyring() {
     # is honored. so:
     #   all keys that are exported must have a valid signature
     #   from a key in the $distro-master-keyring
-    add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
+    add_keys="$(get_fingerprints_of_keyring "$ADD_KEYRING")"
     all_add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^[ps]ub | cut -d: -f5`
     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
 
@@ -86,24 +67,28 @@ add_keys_with_verify_against_master_keyring() {
             fi
         done
     done
-    
+
     for add_key in $add_keys; do
         # export the add keyring one-by-one
-        rm -f $TMP_KEYRING
-        $GPG_CMD --keyring $ADD_KEYRING --output $TMP_KEYRING --export $add_key 
-        # check if signed with the master key and only add in this case
-        ADDED=0
+	local TMP_KEYRING="${GPGHOMEDIR}/tmp-keyring.gpg"
+	$GPG_CMD --batch --yes --keyring "$ADD_KEYRING" --output "$TMP_KEYRING" --export "$add_key"
+	if ! $GPG_CMD --batch --yes --keyring "$TMP_KEYRING" --import "$MASTER" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+	    cat "${GPGHOMEDIR}/gpgoutput.log"
+	    false
+	fi
+	# check if signed with the master key and only add in this case
+	ADDED=0
 	for master_key in $master_keys; do
-	    if $GPG_CMD --keyring $MASTER --keyring $TMP_KEYRING --check-sigs --with-colons $add_key | grep '^sig:!:' | cut -d: -f5 | grep -q $master_key; then
-		$GPG --import $TMP_KEYRING
+	    if $GPG_CMD --keyring $TMP_KEYRING --check-sigs --with-colons $add_key | grep '^sig:!:' | cut -d: -f5 | grep -q $master_key; then
+		$GPG_CMD --batch --yes --keyring "$ADD_KEYRING" --export "$add_key" | $GPG --batch --yes --import
 		ADDED=1
 	    fi
 	done
 	if [ $ADDED = 0 ]; then
 	    echo >&2 "Key '$add_key' not added. It is not signed with a master key"
 	fi
+	rm -f "${TMP_KEYRING}"
     done
-    rm -f $TMP_KEYRING
 }
 
 # update the current archive signing keyring from a network URI
@@ -121,7 +106,6 @@ net_update() {
 	echo >&2 "ERROR: Your distribution is not supported in net-update as no uri for the archive-keyring is set"
 	exit 1
     fi
-    requires_root
     # in theory we would need to depend on wget for this, but this feature
     # isn't useable in debian anyway as we have no keyring uri nor a master key
     if ! which wget >/dev/null 2>&1; then
@@ -142,7 +126,7 @@ net_update() {
     fi
     new_mtime=$(stat -c %Y $keyring)
     if [ $new_mtime -ne $old_mtime ]; then
-	echo "Checking for new archive signing keys now"
+	aptkey_echo "Checking for new archive signing keys now"
 	add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
     fi
 }
@@ -153,7 +137,6 @@ update() {
 	echo >&2 "Is the &keyring-package; package installed?"
 	exit 1
     fi
-    requires_root
 
     # add new keys from the package;
 
@@ -166,71 +149,159 @@ update() {
 
     if [ -r "$REMOVED_KEYS" ]; then
 	# remove no-longer supported/used keys
-	keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
-	for key in $keys; do
-	    if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then
-		$GPG --quiet --batch --delete-key --yes ${key}
-	    fi
+	get_fingerprints_of_keyring "$REMOVED_KEYS" | while read key; do
+	    foreach_keyring_do 'remove_key_from_keyring' "$key"
 	done
     else
-	echo "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable" >&2
+	echo >&2 "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable"
     fi
 }
 
 remove_key_from_keyring() {
-    local GPG="$GPG_CMD --keyring $1"
-    # check if the key is in this keyring: the key id is in the 5 column at the end
-    if ! $GPG --with-colons --list-keys 2>&1 | grep -q "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]\+$2:"; then
-	return
-    fi
-    if [ ! -w "$1" ]; then
-	echo >&2 "Key ${2} is in keyring ${1}, but can't be removed as it is read only."
-	return
+    local KEYRINGFILE="$1"
+    shift
+    # non-existent keyrings have by definition no keys
+    if [ ! -e "$KEYRINGFILE" ]; then
+       return
     fi
-    # check if it is the only key in the keyring and if so remove the keyring altogether
-    if [ '1' = "$($GPG --with-colons --list-keys | grep "^pub:[^:]*:[^:]*:[^:]*:[0-9A-F]\+:" | wc -l)" ]; then
-	mv -f "$1" "${1}~" # behave like gpg
-	return
-    fi
-    # we can't just modify pointed to files as these might be in /usr or something
-    local REALTARGET
-    if [ -L "$1" ]; then
-	REALTARGET="$(readlink -f "$1")"
-	mv -f "$1" "${1}.dpkg-tmp"
-	cp -a "$REALTARGET" "$1"
-	ls "$(dirname $1)"
-    fi
-    # delete the key from the keyring
-    $GPG --batch --delete-key --yes "$2"
-    if [ -n "$REALTARGET" ]; then
-	# the real backup is the old link, not the copy we made
-	mv -f "${1}.dpkg-tmp" "${1}~"
-    fi
-}
 
-remove_key() {
-    requires_root
+    local GPG="$GPG_CMD --keyring $KEYRINGFILE"
+    for KEY in "$@"; do
+	# check if the key is in this keyring: the key id is in the 5 column at the end
+	if ! get_fingerprints_of_keyring "$KEYRINGFILE" | grep -q "^[0-9A-F]*${KEY}$"; then
+	    continue
+	fi
+	if [ ! -w "$KEYRINGFILE" ]; then
+	    echo >&2 "Key ${KEY} is in keyring ${KEYRINGFILE}, but can't be removed as it is read only."
+	    continue
+	fi
+	# check if it is the only key in the keyring and if so remove the keyring altogether
+	if [ '1' = "$(get_fingerprints_of_keyring "$KEYRINGFILE" | wc -l)" ]; then
+	    mv -f "$KEYRINGFILE" "${KEYRINGFILE}~" # behave like gpg
+	    return
+	fi
+	# we can't just modify pointed to files as these might be in /usr or something
+	local REALTARGET
+	if [ -L "$KEYRINGFILE" ]; then
+	    REALTARGET="$(readlink -f "$KEYRINGFILE")"
+	    mv -f "$KEYRINGFILE" "${KEYRINGFILE}.dpkg-tmp"
+	    cp -a "$REALTARGET" "$KEYRINGFILE"
+	fi
+	# delete the key from the keyring
+	$GPG --batch --delete-key --yes "$KEY"
+	if [ -n "$REALTARGET" ]; then
+	    # the real backup is the old link, not the copy we made
+	    mv -f "${KEYRINGFILE}.dpkg-tmp" "${KEYRINGFILE}~"
+	fi
+    done
+}
 
-    # if a --keyring was given, just remove from there
-    if [ -n "$FORCED_KEYRING" ]; then
-	remove_key_from_keyring "$FORCED_KEYRING" "$1"
-    else
+foreach_keyring_do() {
+   local ACTION="$1"
+   shift
+   # if a --keyring was given, just remove from there
+   if [ -n "$FORCED_KEYRING" ]; then
+	$ACTION "$FORCED_KEYRING" "$@"
+   else
 	# otherwise all known keyrings are up for inspection
-	local TRUSTEDFILE="/etc/apt/trusted.gpg"
-	eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
-	eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
-	remove_key_from_keyring "$TRUSTEDFILE" "$1"
-	TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
+	if [ -s "$TRUSTEDFILE" ]; then
+	    $ACTION "$TRUSTEDFILE" "$@"
+	fi
+	local TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 	eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 	if [ -d "$TRUSTEDPARTS" ]; then
+	    # strip / suffix as gpg will double-slash in that case (#665411)
+	    local STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
+	    if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
+		TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
+	    fi
 	    for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
-		remove_key_from_keyring "$trusted" "$1"
+		if [ -s "$trusted" ]; then
+		    $ACTION "$trusted" "$@"
+		fi
 	    done
 	fi
+   fi
+}
+
+run_cmd_on_keyring() {
+    local KEYRINGFILE="$1"
+    shift
+    # fingerprint and co will fail if key isn't in this keyring
+    $GPG_CMD --keyring "$KEYRINGFILE" --batch "$@" 2>/dev/null || true
+}
+
+import_keys_from_keyring() {
+    local IMPORT="$1"
+    local KEYRINGFILE="$2"
+    if ! $GPG_CMD --keyring "$KEYRINGFILE" --batch --import "$IMPORT" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+	cat "${GPGHOMEDIR}/gpgoutput.log"
+	false
+    fi
+}
+
+merge_keys_into_keyrings() {
+    local KEYRINGFILE="$1"
+    local IMPORT="$2"
+    if ! $GPG_CMD --keyring "$KEYRINGFILE" --batch --import --import-options 'merge-only' "$IMPORT" > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+	cat "${GPGHOMEDIR}/gpgoutput.log"
+	false
+    fi
+}
+
+merge_back_changes() {
+    if [ -n "$FORCED_KEYRING" ]; then
+	# if the keyring was forced merge is already done
+	return
+    fi
+    if [ -s "${GPGHOMEDIR}/pubring.gpg" ]; then
+	# merge all updated keys
+	foreach_keyring_do 'merge_keys_into_keyrings' "${GPGHOMEDIR}/pubring.gpg"
+    fi
+    # look for keys which were added or removed
+    get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.orig.gpg" > "${GPGHOMEDIR}/pubring.orig.keylst"
+    get_fingerprints_of_keyring "${GPGHOMEDIR}/pubring.gpg" > "${GPGHOMEDIR}/pubring.keylst"
+    sort "${GPGHOMEDIR}/pubring.keylst" "${GPGHOMEDIR}/pubring.orig.keylst" | uniq --unique | while read key; do
+	if grep -q "^${key}$" "${GPGHOMEDIR}/pubring.orig.keylst"; then
+	    # key isn't part of new keyring, so remove
+	    foreach_keyring_do 'remove_key_from_keyring' "$key"
+	elif grep -q "^${key}$" "${GPGHOMEDIR}/pubring.keylst"; then
+	    # key is part of new keyring, so we need to import it
+	    create_new_keyring "$TRUSTEDFILE"
+	    if ! $GPG --batch --yes --export "$key" | $GPG_CMD --keyring "$TRUSTEDFILE" --batch --yes --import > "${GPGHOMEDIR}/gpgoutput.log" 2>&1; then
+	       cat "${GPGHOMEDIR}/gpgoutput.log"
+	       false
+	    fi
+	else
+	    echo >&2 "Errror: Key ${key} (dis)appeared out of nowhere"
+	fi
+    done
+}
+
+setup_merged_keyring() {
+    if [ -z "$FORCED_KEYRING" ]; then
+	foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
+	if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
+	    cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
+	else
+	   touch "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
+	fi
+	GPG="$GPG --keyring ${GPGHOMEDIR}/pubring.gpg"
+    else
+	GPG="$GPG --keyring $TRUSTEDFILE"
+	create_new_keyring "$TRUSTEDFILE"
     fi
-    echo "OK"
 }
 
+create_new_keyring() {
+    # gpg defaults to mode 0600 for new keyrings. Create one with 0644 instead.
+    if ! [ -e "$TRUSTEDFILE" ]; then
+	if [ -w "$(dirname "$TRUSTEDFILE")" ]; then
+	    touch -- "$TRUSTEDFILE"
+	    chmod 0644 -- "$TRUSTEDFILE"
+	fi
+    fi
+}
 
 usage() {
     echo "Usage: apt-key [--keyring file] [command] [arguments]"
@@ -256,17 +327,19 @@ while [ -n "$1" ]; do
 	 shift
 	 TRUSTEDFILE="$1"
 	 FORCED_KEYRING="$1"
-	 if [ -r "$TRUSTEDFILE" ] || [ "$2" = 'add' ] || [ "$2" = 'adv' ]; then
-	    GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
-	 else
-	    echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable"
-	    exit 1
-	 fi
+	 ;;
+      --secret-keyring)
 	 shift
+	 FORCED_SECRET_KEYRING="$1"
+	 ;;
+      --readonly)
+	 merge_back_changes() { true; }
 	 ;;
       --fakeroot)
 	 requires_root() { true; }
-	 shift
+	 ;;
+      --quiet)
+	 aptkey_echo() { true; }
 	 ;;
       --*)
 	 echo >&2 "Unknown option: $1"
@@ -275,28 +348,13 @@ while [ -n "$1" ]; do
       *)
 	 break;;
    esac
+   shift
 done
 
 if [ -z "$TRUSTEDFILE" ]; then
    TRUSTEDFILE="/etc/apt/trusted.gpg"
    eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
    eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
-   if [ -r "$TRUSTEDFILE" ]; then
-      GPG="$GPG --keyring $TRUSTEDFILE"
-   fi
-   GPG="$GPG --primary-keyring $TRUSTEDFILE"
-   TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
-   eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
-   if [ -d "$TRUSTEDPARTS" ]; then
-      # strip / suffix as gpg will double-slash in that case (#665411)
-      STRIPPED_TRUSTEDPARTS="${TRUSTEDPARTS%/}"
-      if [ "${STRIPPED_TRUSTEDPARTS}/" = "$TRUSTEDPARTS" ]; then
-	 TRUSTEDPARTS="$STRIPPED_TRUSTEDPARTS"
-      fi
-      for trusted in $(run-parts --list "$TRUSTEDPARTS" --regex '^.*\.gpg$'); do
-	 GPG="$GPG --keyring $trusted"
-      done
-   fi
 fi
 
 command="$1"
@@ -306,52 +364,103 @@ if [ -z "$command" ]; then
 fi
 shift
 
-if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then
-    echo >&2 "Warning: gnupg does not seem to be installed."
-    echo >&2 "Warning: apt-key requires gnupg for most operations."
-    echo >&2
+if [ "$command" != "help" ]; then
+    eval $(apt-config shell GPG_EXE Apt::Key::gpgcommand)
+
+    if [ -n "$GPG_EXE" ] && which "$GPG_EXE" >/dev/null 2>&1; then
+	true
+    elif which gpg >/dev/null 2>&1; then
+	GPG_EXE="gpg"
+    elif which gpg2 >/dev/null 2>&1; then
+	GPG_EXE="gpg2"
+    else
+	echo >&2 "Error: gnupg or gnupg2 do not seem to be installed,"
+	echo >&2 "Error: but apt-key requires gnupg or gnupg2 for operation."
+	echo >&2
+	exit 255
+    fi
+
+    GPG_CMD="$GPG_EXE --ignore-time-conflict --no-options --no-default-keyring"
+
+    # gpg needs (in different versions more or less) files to function correctly,
+    # so we give it its own homedir and generate some valid content for it
+    if [ ! -d "$TMPDIR" ]; then
+        unset TMPDIR
+    fi
+    GPGHOMEDIR="$(mktemp -d)"
+    CURRENTTRAP="${CURRENTTRAP} rm -rf '${GPGHOMEDIR}';"
+    trap "${CURRENTTRAP}" 0 HUP INT QUIT ILL ABRT FPE SEGV PIPE TERM
+    chmod 700 "$GPGHOMEDIR"
+    # We don't use a secret keyring, of course, but gpg panics and
+    # implodes if there isn't one available - and writeable for imports
+    SECRETKEYRING="${GPGHOMEDIR}/secring.gpg"
+    touch $SECRETKEYRING
+    GPG_CMD="$GPG_CMD --homedir $GPGHOMEDIR"
+    # create the trustdb with an (empty) dummy keyring
+    # older gpgs required it, newer gpgs even warn that it isn't needed,
+    # but require it nonetheless for some commands, so we just play safe
+    # here for the foreseeable future and create a dummy one
+    $GPG_CMD --quiet --check-trustdb --keyring $SECRETKEYRING >/dev/null 2>&1
+    # tell gpg that it shouldn't try to maintain a trustdb file
+    GPG_CMD="$GPG_CMD --no-auto-check-trustdb --trust-model always"
+    GPG="$GPG_CMD"
+
+    # for advanced operations, we might really need a secret keyring after all
+    if [ -n "$FORCED_SECRET_KEYRING" ] && [ -r "$FORCED_SECRET_KEYRING" ]; then
+	rm -f "$SECRETKEYRING"
+	cp -a "$FORCED_SECRET_KEYRING" "$SECRETKEYRING"
+    fi
 fi
 
 case "$command" in
     add)
-        requires_root
-        init_keyring "$TRUSTEDFILE"
-        $GPG --quiet --batch --import "$1"
-        echo "OK"
+	requires_root
+	setup_merged_keyring
+	$GPG --quiet --batch --import "$@"
+	merge_back_changes
+	aptkey_echo "OK"
         ;;
     del|rm|remove)
-        init_keyring "$TRUSTEDFILE"
-	remove_key "$1"
+	requires_root
+	foreach_keyring_do 'remove_key_from_keyring' "$@"
+	aptkey_echo "OK"
         ;;
     update)
-        init_keyring "$TRUSTEDFILE"
+	requires_root
+	setup_merged_keyring
 	update
+	merge_back_changes
 	;;
     net-update)
-        init_keyring "$TRUSTEDFILE"
+	requires_root
+	setup_merged_keyring
 	net_update
+	merge_back_changes
 	;;
     list)
-        init_keyring "$TRUSTEDFILE"
-        $GPG --batch --list-keys
-        ;;
+	foreach_keyring_do 'run_cmd_on_keyring' --list-keys "$@"
+	;;
     finger*)
-        init_keyring "$TRUSTEDFILE"
-        $GPG --batch --fingerprint
-        ;;
-    export)
-        init_keyring "$TRUSTEDFILE"
-        $GPG --armor --export "$1"
-        ;;
-    exportall)
-        init_keyring "$TRUSTEDFILE"
-        $GPG --armor --export
-        ;;
+	foreach_keyring_do 'run_cmd_on_keyring' --fingerprint "$@"
+	;;
+    export|exportall)
+	foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
+	$GPG_CMD --keyring "${GPGHOMEDIR}/pubring.gpg" --armor --export "$@"
+	;;
     adv*)
-        init_keyring "$TRUSTEDFILE"
-        echo "Executing: $GPG $*"
-        $GPG $*
-        ;;
+	setup_merged_keyring
+	aptkey_echo "Executing: $GPG $*"
+	$GPG "$@"
+	merge_back_changes
+	;;
+    verify)
+	setup_merged_keyring
+	if which gpgv >/dev/null 2>&1; then
+	    gpgv --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
+	else
+	    $GPG --verify "$@"
+	fi
+	;;
     help)
         usage
         ;;
diff --git a/cmdline/apt.cc b/cmdline/apt.cc
index 72086af14..2cfdf8e8e 100644
--- a/cmdline/apt.cc
+++ b/cmdline/apt.cc
@@ -116,6 +116,7 @@ int main(int argc, const char *argv[])					/*{{{*/
    _config->CndSet("DPkg::Progress-Fancy", "1");
    _config->CndSet("Apt::Color", "1");
    _config->CndSet("APT::Get::Upgrade-Allow-New", true);
+   _config->CndSet("APT::Cmd::Show-Update-Stats", true);
 
    // Parse the command line and initialize the package library
    CommandLine CmdL(Args.data(), _config);
diff --git a/cmdline/makefile b/cmdline/makefile
index c4a249cd6..b7c35ddd1 100644
--- a/cmdline/makefile
+++ b/cmdline/makefile
@@ -8,49 +8,49 @@ include ../buildlib/defaults.mak
 # The apt program
 PROGRAM=apt
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt.cc
 include $(PROGRAM_H)
 
 # The apt-cache program
 PROGRAM=apt-cache
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-cache.cc
 include $(PROGRAM_H)
 
 # The apt-get program
 PROGRAM=apt-get
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-get.cc 
 include $(PROGRAM_H)
 
 # The apt-config program
 PROGRAM=apt-config
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-config.cc
 include $(PROGRAM_H)
 
 # The apt-cdrom program
 PROGRAM=apt-cdrom
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-cdrom.cc 
 include $(PROGRAM_H)
 
 # The apt-mark program
 PROGRAM=apt-mark
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-mark.cc
 include $(PROGRAM_H)
 
 # The apt-helper
 PROGRAM=apt-helper
 SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-helper.cc
 include $(PROGRAM_H)
 
@@ -75,14 +75,14 @@ include $(PROGRAM_H)
 # The apt-extracttemplates program
 PROGRAM=apt-extracttemplates
 SLIBS = -lapt-pkg -lapt-inst $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+LIB_MAKES = apt-pkg/makefile apt-inst/makefile
 SOURCE = apt-extracttemplates.cc 
 include $(PROGRAM_H)
 
 # The internal solver acting as an external
 PROGRAM=apt-internal-solver
-SLIBS = -lapt-pkg $(INTLLIBS)
-LIB_MAKES = apt-pkg/makefile
+SLIBS = -lapt-pkg -lapt-private $(INTLLIBS)
+LIB_MAKES = apt-pkg/makefile apt-private/makefile
 SOURCE = apt-internal-solver.cc
 include $(PROGRAM_H)