1 files changed, 37 insertions, 26 deletions

diff --git a/openpgp/src/serialize/tpk.rs b/openpgp/src/serialize/tpk.rs
index 75190785..f1eb134b 100644
--- a/openpgp/src/serialize/tpk.rs
+++ b/openpgp/src/serialize/tpk.rs
@@ -1,6 +1,6 @@
 use crate::Result;
 use crate::TPK;
-use crate::packet::{Key, Signature, Tag};
+use crate::packet::{key, Signature, Tag};
 use crate::serialize::{
     PacketRef, Serialize, SerializeInto,
     generic_serialize_into, generic_export_into,
@@ -294,7 +294,7 @@ impl TPK {
 /// # Ok(()) }
 pub struct TSK<'a> {
     tpk: &'a TPK,
-    filter: Option<Box<'a + Fn(&'a Key) -> bool>>,
+    filter: Option<Box<'a + Fn(&'a key::UnspecifiedSecret) -> bool>>,
 }
 
 impl<'a> TSK<'a> {
@@ -320,14 +320,18 @@ impl<'a> TSK<'a> {
     ///
     /// // Only write out the primary key's secret.
     /// let mut buf = Vec::new();
-    /// tpk.as_tsk().set_filter(|k| k == tpk.primary().key()).serialize(&mut buf)?;
+    /// tpk.as_tsk()
+    ///     .set_filter(
+    ///         |k| k == tpk.primary().key()
+    ///                 .mark_parts_secret_ref().mark_role_unspecified_ref())
+    ///     .serialize(&mut buf)?;
     ///
     /// let tpk_ = TPK::from_bytes(&buf)?;
     /// assert_eq!(tpk_.keys_valid().secret(true).count(), 1);
     /// assert!(tpk_.primary().key().secret().is_some());
     /// # Ok(()) }
     pub fn set_filter<P>(mut self, predicate: P) -> Self
-        where P: 'a + Fn(&'a Key) -> bool
+        where P: 'a + Fn(&'a key::UnspecifiedSecret) -> bool
     {
         self.filter = Some(Box::new(predicate));
         self
@@ -357,7 +361,8 @@ impl<'a> TSK<'a> {
 
         // Serializes public or secret key depending on the filter.
         let serialize_key =
-            |o: &mut dyn std::io::Write, key: &'a Key, tag_public, tag_secret|
+            |o: &mut dyn std::io::Write, key: &'a key::UnspecifiedSecret,
+             tag_public, tag_secret|
         {
             let tag = if key.secret().is_some()
                 && self.filter.as_ref().map(|f| f(key)).unwrap_or(true) {
@@ -366,17 +371,19 @@ impl<'a> TSK<'a> {
                 tag_public
             };
 
-            let packet = match tag {
-                Tag::PublicKey => PacketRef::PublicKey(key),
-                Tag::PublicSubkey => PacketRef::PublicSubkey(key),
-                Tag::SecretKey => PacketRef::SecretKey(key),
-                Tag::SecretSubkey => PacketRef::SecretSubkey(key),
+            match tag {
+                Tag::PublicKey =>
+                    PacketRef::PublicKey(key.into()).serialize(o),
+                Tag::PublicSubkey =>
+                    PacketRef::PublicSubkey(key.into()).serialize(o),
+                Tag::SecretKey =>
+                    PacketRef::SecretKey(key.into()).serialize(o),
+                Tag::SecretSubkey =>
+                    PacketRef::SecretSubkey(key.into()).serialize(o),
                 _ => unreachable!(),
-            };
-
-            packet.serialize(o)
+            }
         };
-        serialize_key(o, &self.tpk.primary().key(),
+        serialize_key(o, self.tpk.primary().key().into(),
                       Tag::PublicKey, Tag::SecretKey)?;
 
         for s in self.tpk.primary().selfsigs() {
@@ -446,7 +453,8 @@ impl<'a> TSK<'a> {
                 continue;
             }
 
-            serialize_key(o, k.key(), Tag::PublicSubkey, Tag::SecretSubkey)?;
+            serialize_key(o, k.key().into(),
+                          Tag::PublicSubkey, Tag::SecretSubkey)?;
             for s in k.self_revocations() {
                 serialize_sig(o, s)?;
             }
@@ -508,7 +516,8 @@ impl<'a> SerializeInto for TSK<'a> {
         let mut l = 0;
 
         // Serializes public or secret key depending on the filter.
-        let serialized_len_key = |key: &'a Key, tag_public, tag_secret|
+        let serialized_len_key
+            = |key: &'a key::UnspecifiedSecret, tag_public, tag_secret|
         {
             let tag = if key.secret().is_some()
                 && self.filter.as_ref().map(|f| f(key)).unwrap_or(true) {
@@ -518,16 +527,16 @@ impl<'a> SerializeInto for TSK<'a> {
             };
 
             let packet = match tag {
-                Tag::PublicKey => PacketRef::PublicKey(key),
-                Tag::PublicSubkey => PacketRef::PublicSubkey(key),
-                Tag::SecretKey => PacketRef::SecretKey(key),
-                Tag::SecretSubkey => PacketRef::SecretSubkey(key),
+                Tag::PublicKey => PacketRef::PublicKey(key.into()),
+                Tag::PublicSubkey => PacketRef::PublicSubkey(key.into()),
+                Tag::SecretKey => PacketRef::SecretKey(key.into()),
+                Tag::SecretSubkey => PacketRef::SecretSubkey(key.into()),
                 _ => unreachable!(),
             };
 
             packet.serialized_len()
         };
-        l += serialized_len_key(self.tpk.primary().key(),
+        l += serialized_len_key(self.tpk.primary().key().into(),
                                 Tag::PublicKey, Tag::SecretKey);
 
         for s in self.tpk.selfsigs() {
@@ -578,7 +587,7 @@ impl<'a> SerializeInto for TSK<'a> {
         }
 
         for k in self.tpk.subkeys() {
-            l += serialized_len_key(k.key(),
+            l += serialized_len_key(k.key().into(),
                                     Tag::PublicSubkey, Tag::SecretSubkey);
 
             for s in k.self_revocations() {
@@ -633,6 +642,7 @@ mod test {
     use super::*;
     use crate::parse::Parse;
     use crate::serialize::Serialize;
+    use crate::packet::key;
 
     /// Demonstrates that public keys and all components are
     /// serialized.
@@ -712,15 +722,16 @@ mod test {
         use crate::constants::{Curve, SignatureType};
         use crate::packet::{
             signature, UserID, user_attribute::{UserAttribute, Subpacket},
-            Key, KeyFlags, key::Key4,
+            KeyFlags, key::Key4,
         };
 
         let (tpk, _) = TPKBuilder::new().generate().unwrap();
-        let mut keypair = tpk.primary().key().clone().into_keypair().unwrap();
+        let mut keypair = tpk.primary().key().clone().mark_parts_secret()
+            .into_keypair().unwrap();
 
-        let key: Key =
+        let key: key::SecretSubkey =
             Key4::generate_ecc(false, Curve::Cv25519).unwrap().into();
-        let key_binding = key.bind(
+        let key_binding = key.mark_parts_public_ref().bind(
             &mut keypair, &tpk,
             signature::Builder::new(SignatureType::SubkeyBinding)
                 .set_key_flags(