openpgp: Add support for v6 OPS packets, inline-signed messages.

todo:

  - finish facade, at least set_last

10 files changed, 717 insertions, 106 deletions

diff --git a/openpgp/src/packet/header/mod.rs b/openpgp/src/packet/header/mod.rs
index d0df418b..61eab916 100644
--- a/openpgp/src/packet/header/mod.rs
+++ b/openpgp/src/packet/header/mod.rs
@@ -181,7 +181,9 @@ impl Header {
                             // 10 bytes of fixed header, plus the
                             // encrypted session key.
                             10 < l && l < 10 * 1024,
-                        Tag::OnePassSig if ! future_compatible => l == 13,
+                        Tag::OnePassSig if ! future_compatible =>
+                            l == 13 // v3
+                            || (6 + 32..6 + 32 + 256).contains(&l), // v6
                         Tag::OnePassSig => l < 1024,
                         Tag::PublicKey | Tag::PublicSubkey
                             | Tag::SecretKey | Tag::SecretSubkey =>
diff --git a/openpgp/src/packet/mod.rs b/openpgp/src/packet/mod.rs
index 883b2792..21c192f5 100644
--- a/openpgp/src/packet/mod.rs
+++ b/openpgp/src/packet/mod.rs
@@ -168,9 +168,17 @@ pub use container::Body;
 
 pub mod prelude;
 
-use crate::crypto::{
-    KeyPair,
-    Password,
+use crate::{
+    crypto::{
+        KeyPair,
+        Password,
+    },
+    types::{
+        SignatureType,
+        PublicKeyAlgorithm,
+        HashAlgorithm,
+    },
+    KeyHandle,
 };
 
 mod any;
@@ -451,7 +459,8 @@ impl Deref for Packet {
         match self {
             Packet::Unknown(ref packet) => &packet.common,
             Packet::Signature(ref packet) => &packet.common,
-            Packet::OnePassSig(ref packet) => &packet.common,
+            Packet::OnePassSig(OnePassSig::V3(ref packet)) => &packet.common,
+            Packet::OnePassSig(OnePassSig::V6(ref packet)) => &packet.common.common,
             Packet::PublicKey(ref packet) => &packet.common,
             Packet::PublicSubkey(ref packet) => &packet.common,
             Packet::SecretKey(ref packet) => &packet.common,
@@ -478,7 +487,8 @@ impl DerefMut for Packet {
         match self {
             Packet::Unknown(ref mut packet) => &mut packet.common,
             Packet::Signature(ref mut packet) => &mut packet.common,
-            Packet::OnePassSig(ref mut packet) => &mut packet.common,
+            Packet::OnePassSig(OnePassSig::V3(ref mut packet)) => &mut packet.common,
+            Packet::OnePassSig(OnePassSig::V6(ref mut packet)) => &mut packet.common.common,
             Packet::PublicKey(ref mut packet) => &mut packet.common,
             Packet::PublicSubkey(ref mut packet) => &mut packet.common,
             Packet::SecretKey(ref mut packet) => &mut packet.common,
@@ -1091,6 +1101,8 @@ impl DerefMut for Signature {
 pub enum OnePassSig {
     /// OnePassSig packet version 3.
     V3(self::one_pass_sig::OnePassSig3),
+    /// OnePassSig packet version 6.
+    V6(self::one_pass_sig::OnePassSig6),
 }
 assert_send_and_sync!(OnePassSig);
 
@@ -1099,6 +1111,71 @@ impl OnePassSig {
     pub fn version(&self) -> u8 {
         match self {
             OnePassSig::V3(_) => 3,
+            OnePassSig::V6(_) => 6,
+        }
+    }
+
+    /// Gets the signature type.
+    pub fn typ(&self) -> SignatureType {
+        match self {
+            OnePassSig::V3(p) => p.typ(),
+            OnePassSig::V6(p) => p.typ(),
+        }
+    }
+
+    /// Gets the public key algorithm.
+    pub fn pk_algo(&self) -> PublicKeyAlgorithm {
+        match self {
+            OnePassSig::V3(p) => p.pk_algo(),
+            OnePassSig::V6(p) => p.pk_algo(),
+        }
+    }
+
+    /// Gets the hash algorithm.
+    pub fn hash_algo(&self) -> HashAlgorithm {
+        match self {
+            OnePassSig::V3(p) => p.hash_algo(),
+            OnePassSig::V6(p) => p.hash_algo(),
+        }
+    }
+
+    /// Gets the salt, if any.
+    pub fn salt(&self) -> Option<&[u8]> {
+        match self {
+            OnePassSig::V3(_) => None,
+            OnePassSig::V6(p) => Some(p.salt()),
+        }
+    }
+
+    /// Gets the issuer.
+    pub fn issuer(&self) -> KeyHandle {
+        match self {
+            OnePassSig::V3(p) => p.issuer().into(),
+            OnePassSig::V6(p) => p.issuer().into(),
+        }
+    }
+
+    /// Gets the last flag.
+    pub fn last(&self) -> bool {
+        match self {
+            OnePassSig::V3(p) => p.last(),
+            OnePassSig::V6(p) => p.last(),
+        }
+    }
+
+    /// Sets the last flag.
+    pub fn set_last(&mut self, last: bool) -> bool {
+        match self {
+            OnePassSig::V3(p) => p.set_last(last),
+            OnePassSig::V6(p) => p.set_last(last),
+        }
+    }
+
+    /// Gets the raw value of the last flag.
+    pub fn last_raw(&self) -> u8 {
+        match self {
+            OnePassSig::V3(p) => p.last_raw(),
+            OnePassSig::V6(p) => p.last_raw(),
         }
     }
 }
@@ -1115,28 +1192,9 @@ impl<'a> std::convert::TryFrom<&'a Signature> for OnePassSig {
     fn try_from(s: &'a Signature) -> Result<Self> {
         match s.version() {
             4 => one_pass_sig::OnePassSig3::try_from(s).map(Into::into),
+            6 => one_pass_sig::OnePassSig6::try_from(s).map(Into::into),
             n => Err(Error::InvalidOperation(
                 format!("Unsupported signature version {}", n)).into()),
-         }
-     }
-}
-
-// Trivial forwarder for singleton enum.
-impl Deref for OnePassSig {
-    type Target = one_pass_sig::OnePassSig3;
-
-    fn deref(&self) -> &Self::Target {
-        match self {
-            OnePassSig::V3(ops) => ops,
-        }
-    }
-}
-
-// Trivial forwarder for singleton enum.
-impl DerefMut for OnePassSig {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        match self {
-            OnePassSig::V3(ref mut ops) => ops,
         }
     }
 }
diff --git a/openpgp/src/packet/one_pass_sig.rs b/openpgp/src/packet/one_pass_sig.rs
index 14bad636..19242e40 100644
--- a/openpgp/src/packet/one_pass_sig.rs
+++ b/openpgp/src/packet/one_pass_sig.rs
@@ -19,6 +19,9 @@ use crate::HashAlgorithm;
 use crate::PublicKeyAlgorithm;
 use crate::SignatureType;
 
+mod v6;
+pub use v6::OnePassSig6;
+
 /// Holds a one-pass signature packet.
 ///
 /// See [Section 5.4 of RFC 4880] for details.
@@ -172,7 +175,11 @@ impl<'a> std::convert::TryFrom<&'a Signature> for OnePassSig3 {
 #[cfg(test)]
 impl Arbitrary for super::OnePassSig {
     fn arbitrary(g: &mut Gen) -> Self {
-        OnePassSig3::arbitrary(g).into()
+        if Arbitrary::arbitrary(g) {
+            OnePassSig3::arbitrary(g).into()
+        } else {
+            OnePassSig6::arbitrary(g).into()
+        }
     }
 }
 
diff --git a/openpgp/src/packet/one_pass_sig/v6.rs b/openpgp/src/packet/one_pass_sig/v6.rs
new file mode 100644
index 00000000..7fc83b2e
--- /dev/null
+++ b/openpgp/src/packet/one_pass_sig/v6.rs
@@ -0,0 +1,222 @@
+//! OpenPGP v6 signature implementation.
+
+use std::convert::TryFrom;
+use std::fmt;
+use std::mem;
+
+#[cfg(test)]
+use quickcheck::{Arbitrary, Gen};
+
+use crate::{
+    Error,
+    Fingerprint,
+    HashAlgorithm,
+    Packet,
+    PublicKeyAlgorithm,
+    Result,
+    SignatureType,
+    packet::{
+        Signature,
+        OnePassSig,
+        one_pass_sig::{
+            OnePassSig3,
+        },
+    },
+};
+
+/// Holds a v6 OnePassSig packet.
+///
+/// This holds a [version 6] OnePassSig packet.  Normally, you won't
+/// directly work with this data structure, but with the [`OnePassSig`]
+/// enum, which is version agnostic.  An exception is when you need to
+/// do version-specific operations.  But currently, there aren't any
+/// version-specific methods.
+///
+///   [version 6]: https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-08.html#name-one-pass-signature-packets-
+///   [`OnePassSig`]: crate::packet::OnePassSig
+#[derive(PartialEq, Eq, Hash, Clone)]
+pub struct OnePassSig6 {
+    pub(crate) common: OnePassSig3,
+    salt: Vec<u8>,
+    issuer: Fingerprint,
+}
+assert_send_and_sync!(OnePassSig6);
+
+impl TryFrom<OnePassSig> for OnePassSig6 {
+    type Error = anyhow::Error;
+
+    fn try_from(ops: OnePassSig) -> Result<Self> {
+        match ops {
+            OnePassSig::V6(ops) => Ok(ops),
+            ops => Err(
+                Error::InvalidArgument(
+                    format!(
+                        "Got a v{}, require a v6 one-pass signature",
+                        ops.version()))
+                    .into()),
+        }
+    }
+}
+
+impl fmt::Debug for OnePassSig6 {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.debug_struct("OnePassSig6")
+            .field("typ", &self.typ())
+            .field("hash_algo", &self.hash_algo())
+            .field("pk_algo", &self.pk_algo())
+            .field("salt", &crate::fmt::hex::encode(self.salt()))
+            .field("issuer", &self.issuer())
+            .field("last", &self.last())
+            .finish()
+    }
+}
+
+impl OnePassSig6 {
+    /// Returns a new One-Pass Signature packet.
+    pub fn new(typ: SignatureType, issuer: Fingerprint) ->  Self {
+        OnePassSig6 {
+            common: OnePassSig3::new(typ),
+            salt: vec![],
+            issuer,
+        }
+    }
+
+    /// Gets the signature type.
+    pub fn typ(&self) -> SignatureType {
+        self.common.typ()
+    }
+
+    /// Sets the signature type.
+    pub fn set_type(&mut self, t: SignatureType) -> SignatureType {
+        self.common.set_type(t)
+    }
+
+    /// Gets the public key algorithm.
+    pub fn pk_algo(&self) -> PublicKeyAlgorithm {
+        self.common.pk_algo()
+    }
+
+    /// Sets the public key algorithm.
+    pub fn set_pk_algo(&mut self, algo: PublicKeyAlgorithm) -> PublicKeyAlgorithm {
+        self.common.set_pk_algo(algo)
+    }
+
+    /// Gets the hash algorithm.
+    pub fn hash_algo(&self) -> HashAlgorithm {
+        self.common.hash_algo()
+    }
+
+    /// Sets the hash algorithm.
+    pub fn set_hash_algo(&mut self, algo: HashAlgorithm) -> HashAlgorithm {
+        self.common.set_hash_algo(algo)
+    }
+
+    /// Gets the salt.
+    pub fn salt(&self) -> &[u8] {
+        &self.salt
+    }
+
+    /// Sets the salt.
+    pub fn set_salt(&mut self, salt: Vec<u8>) -> Vec<u8> {
+        mem::replace(&mut self.salt, salt)
+    }
+
+    /// Gets the issuer.
+    pub fn issuer(&self) -> &Fingerprint {
+        &self.issuer
+    }
+
+    /// Sets the issuer.
+    pub fn set_issuer(&mut self, issuer: Fingerprint) -> Fingerprint {
+        mem::replace(&mut self.issuer, issuer)
+    }
+
+    /// Gets the last flag.
+    pub fn last(&self) -> bool {
+        self.common.last()
+    }
+
+    /// Sets the last flag.
+    pub fn set_last(&mut self, last: bool) -> bool {
+        self.common.set_last(last)
+    }
+
+    /// Gets the raw value of the last flag.
+    pub fn last_raw(&self) -> u8 {
+        self.common.last_raw()
+    }
+
+    /// Sets the raw value of the last flag.
+    pub fn set_last_raw(&mut self, last: u8) -> u8 {
+        self.common.set_last_raw(last)
+    }
+}
+
+impl From<OnePassSig6> for OnePassSig {
+    fn from(s: OnePassSig6) -> Self {
+        OnePassSig::V6(s)
+    }
+}
+
+impl From<OnePassSig6> for Packet {
+    fn from(p: OnePassSig6) -> Self {
+        OnePassSig::from(p).into()
+    }
+}
+
+impl<'a> std::convert::TryFrom<&'a Signature> for OnePassSig6 {
+    type Error = anyhow::Error;
+
+    fn try_from(s: &'a Signature) -> Result<Self> {
+        let s = if let Signature::V6(s) = s {
+            s
+        } else {
+            return Err(Error::InvalidArgument(format!(
+                "Can not derive a v6 OnePassSig from a v{} Signature",
+                s.version())).into());
+        };
+
+        let issuer = match s.issuer_fingerprints().next() {
+            Some(i) => i.clone(),
+            None =>
+                return Err(Error::InvalidArgument(
+                    "Signature has no issuer fingerprints".into()).into()),
+        };
+        let mut common = OnePassSig3::new(s.typ());
+        common.set_hash_algo(s.hash_algo());
+        common.set_pk_algo(s.pk_algo());
+        Ok(OnePassSig6 {
+            common,
+            salt: s.salt().to_vec(),
+            issuer,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::arbitrary_helper::arbitrary_bounded_vec;
+    use crate::parse::Parse;
+    use crate::serialize::MarshalInto;
+
+    impl Arbitrary for OnePassSig6 {
+        fn arbitrary(g: &mut Gen) -> Self {
+            let mut ops = OnePassSig6::new(SignatureType::arbitrary(g),
+                                           Fingerprint::arbitrary_v6(g));
+            ops.set_hash_algo(HashAlgorithm::arbitrary(g));
+            ops.set_pk_algo(PublicKeyAlgorithm::arbitrary(g));
+            ops.set_last_raw(u8::arbitrary(g));
+            ops.set_salt(arbitrary_bounded_vec(g, 256));
+            ops
+        }
+    }
+
+    quickcheck! {
+        fn roundtrip(p: OnePassSig6) -> bool {
+            let q = OnePassSig6::from_bytes(&p.to_vec().unwrap()).unwrap();
+            assert_eq!(p, q);
+            true
+        }
+    }
+}
diff --git a/openpgp/src/packet/prelude.rs b/openpgp/src/packet/prelude.rs
index 5c3d7782..c433dda9 100644
--- a/openpgp/src/packet/prelude.rs
+++ b/openpgp/src/packet/prelude.rs
@@ -48,6 +48,7 @@ pub use crate::packet::{
     key::Key6,
     key::SecretKeyMaterial,
     one_pass_sig::OnePassSig3,
+    one_pass_sig::OnePassSig6,
     pkesk::PKESK3,
     seip::SEIP1,
     signature,
diff --git a/openpgp/src/parse.rs b/openpgp/src/parse.rs
index b168c5f0..e7a72920 100644
--- a/openpgp/src/parse.rs
+++ b/openpgp/src/parse.rs
@@ -846,12 +846,25 @@ pub(crate) struct SignatureGroup {
     ops_count: usize,
 
     /// The hash contexts.
+    ///
+    /// We store a salt and the hash context as tuples.
+    ///
+    /// In v6, the hash is salted.  We store the salt here so that we
+    /// can find the right hash context again when we encounter the
+    /// signature packet.
+    ///
+    /// In v4, the hash is not salted.  Hence, salt is the zero-length
+    /// vector.  The fact that the hash is not salted allows for an
+    /// optimization: to verify two signatures using the same hash
+    /// algorithm, the hash must be computed just once.  We implement
+    /// this optimization for v4 signatures.
     pub(crate) hashes: Vec<HashingMode<Box<dyn crypto::hash::Digest>>>,
 }
 
 impl fmt::Debug for SignatureGroup {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        let algos = self.hashes.iter().map(|mode| mode.map(|ctx| ctx.algo()))
+        let algos = self.hashes.iter()
+            .map(|mode| mode.map(|ctx| ctx.algo()))
             .collect::<Vec<_>>();
 
         f.debug_struct("Cookie")
@@ -1405,7 +1418,7 @@ impl Signature {
     /// When parsing an inline-signed message, attaches the digest to
     /// the signature.
     fn parse_finish(indent: isize, mut pp: PacketParser,
-                    typ: SignatureType, hash_algo: HashAlgorithm)
+                    hash_algo: HashAlgorithm)
         -> Result<PacketParser>
     {
         tracer!(TRACE, "Signature::parse_finish", indent);
@@ -1424,7 +1437,7 @@ impl Signature {
             return Ok(pp);
         }
 
-        let need_hash = HashingMode::for_signature(hash_algo, typ);
+        let need_hash = HashingMode::for_signature(hash_algo, sig);
         t!("Need a {:?}", need_hash);
         if TRACE {
             pp.reader.dump(&mut std::io::stderr())?;
@@ -1470,10 +1483,15 @@ impl Signature {
                     if cookie.hashes_for == HashesFor::Signature
                         || cookie.hashes_for == HashesFor::CleartextSignature
                     {
+                        t!("Have: {:?}",
+                           cookie.sig_group().hashes.iter()
+                           .map(|h| h.map(|h| h.algo()))
+                           .collect::<Vec<_>>());
                         if let Some(hash) =
                             cookie.sig_group().hashes.iter().find_map(
                                 |mode|
-                                if mode.map(|ctx| ctx.algo()) == need_hash {
+                                if mode.map(|ctx| ctx.algo()) == need_hash
+                                {
                                     Some(mode.as_ref())
                                 } else {
                                     None
@@ -1555,7 +1573,7 @@ impl Signature6 {
             mpis));
         let pp = php.ok(sig.into())?;
 
-        Signature::parse_finish(indent, pp, typ, hash_algo)
+        Signature::parse_finish(indent, pp, hash_algo)
     }
 }
 
@@ -1599,7 +1617,7 @@ impl Signature4 {
             [digest_prefix1, digest_prefix2],
             mpis).into()))?;
 
-        Signature::parse_finish(indent, pp, typ, hash_algo)
+        Signature::parse_finish(indent, pp, hash_algo)
     }
 
     /// Returns whether the data appears to be a signature (no promises).
@@ -1687,7 +1705,7 @@ impl Signature3 {
             [digest_prefix1, digest_prefix2],
             mpis).into()))?;
 
-        Signature::parse_finish(indent, pp, typ, hash_algo)
+        Signature::parse_finish(indent, pp, hash_algo)
     }
 }
 
@@ -2082,6 +2100,7 @@ impl OnePassSig {
         let version = php_try!(php.parse_u8("version"));
         match version {
             3 => OnePassSig3::parse(php),
+            6 => OnePassSig6::parse(php),
             _ => {
                 t!("Ignoring version {} packet", version);
 
@@ -2116,7 +2135,7 @@ impl OnePassSig3 {
         sig.set_pk_algo(pk_algo.into());
         sig.set_issuer(KeyID::from_bytes(&issuer));
         sig.set_last_raw(last);
-        let need_hash = HashingMode::for_signature(hash_algo, typ);
+        let need_hash = HashingMode::for_salt_and_type(hash_algo, &[], typ);
 
         let recursion_depth = php.recursion_depth();
 
@@ -2160,7 +2179,8 @@ impl OnePassSig3 {
                                 {
                                     if let Ok(ctx) = hash_algo.context() {
                                         cookie.sig_group_mut().hashes.push(
-                                            HashingMode::for_signature(Box::new(ctx), typ)
+                                            HashingMode::for_salt_and_type(
+                                                Box::new(ctx), &[], typ)
                                         );
                                     }
                                 }
@@ -2196,7 +2216,7 @@ impl OnePassSig3 {
         // it explicitly.
         let mut algos = Vec::new();
         if pp.state.settings.automatic_hashing && hash_algo.is_supported() {
-            algos.push(need_hash);
+            algos.push(HashingMode::for_salt_and_type(hash_algo, &[], typ));
         }
 
         // We can't push the HashedReader on the BufferedReader stack:
@@ -2293,7 +2313,9 @@ impl PacketParser<'_> {
 
         let hash_algo = ops.hash_algo();
         let typ = ops.typ();
-        let need_hash = HashingMode::for_signature(hash_algo, typ);
+        let salt = ops.salt();
+        let need_hash = HashingMode::for_salt_and_type(
+            hash_algo, salt.unwrap_or(&[]), typ);
         let recursion_depth = self.recursion_depth();
         let want_hashes_for = if Cookie::processing_csf_message(&self.reader) {
             HashesFor::CleartextSignature
@@ -2323,8 +2345,9 @@ impl PacketParser<'_> {
                                 })
                             {
                                 cookie.sig_group_mut().hashes.push(
-                                    HashingMode::for_signature(
-                                        Box::new(hash_algo.context()?), typ));
+                                    HashingMode::for_salt_and_type(
+                                        Box::new(hash_algo.context()?),
+                                        salt.unwrap_or(&[]), typ));
                             }
                             break;
                         }
@@ -2340,7 +2363,7 @@ impl PacketParser<'_> {
 }
 
 #[test]
-fn one_pass_sig_parser_test () {
+fn one_pass_sig3_parser_test () {
     use crate::SignatureType;
     use crate::PublicKeyAlgorithm;
 
@@ -2365,12 +2388,164 @@ fn one_pass_sig_parser_test () {
 impl_parse_with_buffered_reader!(
     OnePassSig3,
     |reader| -> Result<Self> {
-        OnePassSig::from_reader(reader).map(|p| match p {
-            OnePassSig::V3(p) => p,
-            // XXX: Once we have a second variant.
-            //
-            // p => Err(Error::InvalidOperation(
-            //     format!("Not a OnePassSig::V3 packet: {:?}", p)).into()),
+        OnePassSig::from_reader(reader).and_then(|p| match p {
+            OnePassSig::V3(p) => Ok(p),
+            p => Err(Error::InvalidOperation(
+                format!("Not a OnePassSig::V3 packet: {:?}", p)).into()),
+        })
+    });
+
+impl OnePassSig6 {
+    #[allow(clippy::blocks_in_if_conditions)]
+    fn parse(mut php: PacketHeaderParser) -> Result<PacketParser> {
+        let indent = php.recursion_depth();
+        tracer!(TRACE, "OnePassSig6", indent);
+
+        make_php_try!(php);
+
+        let typ = php_try!(php.parse_u8("type"));
+        let hash_algo = php_try!(php.parse_u8("hash_algo"));
+        let pk_algo = php_try!(php.parse_u8("pk_algo"));
+        let salt_len = php_try!(php.parse_u8("salt_len"));
+        let salt = php_try!(php.parse_bytes("salt", salt_len.into()));
+        let mut issuer = [0u8; 32];
+        issuer.copy_from_slice(&php_try!(php.parse_bytes("issuer", 32)));
+        let last = php_try!(php.parse_u8("last"));
+
+        let hash_algo = hash_algo.into();
+        let typ = typ.into();
+        let mut sig = OnePassSig6::new(typ, Fingerprint::from_bytes(&issuer));
+        sig.set_salt(salt.clone());
+        sig.set_hash_algo(hash_algo);
+        sig.set_pk_algo(pk_algo.into());
+        sig.set_last_raw(last);
+
+        let recursion_depth = php.recursion_depth();
+
+        // Check if we are processing a cleartext signed message.
+        let want_hashes_for = if Cookie::processing_csf_message(&php.reader) {
+            HashesFor::CleartextSignature
+        } else {
+            HashesFor::Signature
+        };
+
+        // Walk up the reader chain to see if there is already a
+        // hashed reader on level recursion_depth - 1.
+        let done = {
+            let mut done = false;
+            let mut reader : Option<&mut dyn BufferedReader<Cookie>>
+                = Some(&mut php.reader);
+            while let Some(r) = reader {
+                {
+                    let cookie = r.cookie_mut();
+                    if let Some(br_level) = cookie.level {
+                        if br_level < recursion_depth - 1 {
+                            break;
+                        }
+                        if br_level == recursion_depth - 1
+                            && cookie.hashes_for == want_hashes_for {
+                                // We found a suitable hashed reader.
+                                if cookie.saw_last {
+                                    cookie.sig_group_push();
+                                    cookie.saw_last = false;
+                                    cookie.hash_stash =
+                                        Some(php.header_bytes.clone());
+                                }
+
+                                // Make sure that it uses the required
+                                // hash algorithm.
+                                if php.state.settings.automatic_hashing
+                                {
+                                    if let Ok(ctx) = hash_algo.context() {
+                                        cookie.sig_group_mut().hashes.push(
+                                            HashingMode::for_salt_and_type(
+                                                Box::new(ctx), &salt, typ)
+                                        );
+                                    }
+                                }
+
+                                // Account for this OPS packet.
+                                cookie.sig_group_mut().ops_count += 1;
+
+                                // Keep track of the last flag.
+                                cookie.saw_last = last > 0;
+
+                                // We're done.
+                                done = true;
+                                break;
+                            }
+                    } else {
+                        break;
+                    }
+                }
+                reader = r.get_mut();
+            }
+            done
+        };
+        // Commit here after potentially pushing a signature group.
+        let mut pp = php.ok(Packet::OnePassSig(sig.into()))?;
+        if done {
+            return Ok(pp);
+        }
+
+        // We create an empty hashed reader even if we don't support
+        // the hash algorithm so that we have something to match
+        // against when we get to the Signature packet.
+        let mut algos = Vec::new();
+        if pp.state.settings.automatic_hashing && hash_algo.is_supported() {
+            algos.push(HashingMode::for_salt_and_type(hash_algo, &salt, typ));
+        }
+
+        // We can't push the HashedReader on the BufferedReader stack:
+        // when we finish processing this OnePassSig packet, it will
+        // be popped.  Instead, we need to insert it at the next
+        // higher level.  Unfortunately, this isn't possible.  But,
+        // since we're done reading the current packet, we can pop the
+        // readers associated with it, and then push the HashedReader.
+        // This is a bit of a layering violation, but I (Neal) can't
+        // think of a more elegant solution.
+
+        assert!(pp.reader.cookie_ref().level <= Some(recursion_depth));
+        let (fake_eof, reader)
+            = buffered_reader_stack_pop(Box::new(pp.take_reader()),
+                                        recursion_depth)?;
+        // We only pop the buffered readers for the OPS, and we
+        // (currently) never use a fake eof