=== modified file 'Makefile'
--- Makefile	2008-08-23 07:17:28 +0000
+++ Makefile	2008-08-24 06:17:02 +0000
@@ -14,11 +14,11 @@
 OPTIMIZE=-Os
 LANGUAGE=-std=gnu99
 # PREFIX=/usr/local
-PREFIX=/usr
+PREFIX=$(DESTDIR)/usr
 # CONFDIR=/usr/local/lib/mandos
-CONFDIR=/etc/mandos
+CONFDIR=$(DESTDIR)/etc/mandos
 # MANDIR=/usr/local/man
-MANDIR=/usr/share/man
+MANDIR=$(DESTDIR)/usr/share/man
 
 GNUTLS_CFLAGS=$(shell libgnutls-config --cflags)
 GNUTLS_LIBS=$(shell libgnutls-config --libs)
@@ -104,7 +104,7 @@
 install: install-server install-client
 
 install-server: doc
-	mkdir --mode=0755 --parents $(CONFDIR) $(MANDIR)/man5 \
+	install --directory --parents $(CONFDIR) $(MANDIR)/man5 \
 		$(MANDIR)/man8
 	install --mode=0755 mandos $(PREFIX)/sbin/mandos
 	install --mode=0644 --target-directory=$(CONFDIR) mandos.conf
@@ -118,9 +118,9 @@
 		> $(MANDIR)/man5/mandos-clients.conf.5.gz
 
 install-client: all doc /usr/share/initramfs-tools/hooks/.
-	mkdir --mode=0755 --parents $(PREFIX)/lib/mandos $(CONFDIR) \
-		$(MANDIR)/man8
-	-mkdir --mode=0700 $(PREFIX)/lib/mandos/plugins.d
+	install --directory --parents $(PREFIX)/lib/mandos \
+		$(CONFDIR) $(MANDIR)/man8
+	install --directory --mode=0700 $(PREFIX)/lib/mandos/plugins.d
 	chmod u=rwx,g=,o= $(PREFIX)/lib/mandos/plugins.d
 	install --mode=0755 --target-directory=$(PREFIX)/lib/mandos \
 		plugin-runner

=== modified file 'mandos-keygen'
--- mandos-keygen	2008-08-22 00:16:20 +0000
+++ mandos-keygen	2008-08-24 06:17:02 +0000
@@ -25,6 +25,8 @@
 KEYDIR="/etc/mandos"
 KEYTYPE=DSA
 KEYLENGTH=1024
+SUBKEYTYPE=ELG-E
+SUBKEYLENGTH=2048
 KEYNAME="`hostname --fqdn`"
 KEYEMAIL=""
 KEYCOMMENT="Mandos client key"
@@ -48,6 +50,10 @@
   -t TYPE, --type TYPE  Key type.  Default is DSA.
   -l BITS, --length BITS
                         Key length in bits.  Default is 1024.
+  -s TYPE, --subtype TYPE
+                        Subkey type.  Default is ELG-E.
+  -L BITS, --sublength BITS
+                        Subkey length in bits.  Default is 2048.
   -n NAME, --name NAME  Name of key.  Default is the FQDN.
   -e EMAIL, --email EMAIL
                         Email address of key.  Default is empty.
@@ -66,7 +72,9 @@
     case "$1" in
 	-d|--dir) KEYDIR="$2"; shift 2;;
 	-t|--type) KEYTYPE="$2"; shift 2;;
+	-s|--subtype) SUBKEYTYPE="$2"; shift 2;;
 	-l|--length) KEYLENGTH="$2"; shift 2;;
+	-L|--sublength) SUBKEYLENGTH="$2"; shift 2;;
 	-n|--name) KEYNAME="$2"; shift 2;;
 	-e|--email) KEYEMAIL="$2"; shift 2;;
 	-c|--comment) KEYCOMMENT="$2"; shift 2;;
@@ -143,10 +151,10 @@
 
 # Remove temporary files on exit
 trap "
-set +e
-rm --force $PUBRING $BATCHFILE;
-shred --remove $SECRING;
-stty echo
+set +e; \
+rm --force $PUBRING $BATCHFILE; \
+shred --remove $SECRING; \
+stty echo; \
 " EXIT
 
 # Create batch file for GnuPG
@@ -154,10 +162,15 @@
 Key-Type: $KEYTYPE
 Key-Length: $KEYLENGTH
 #Key-Usage: encrypt,sign,auth
+Subkey-Type: $SUBKEYTYPE
+Subkey-Length: $SUBKEYLENGTH
+#Subkey-Usage: encrypt,sign,auth
 Name-Real: $KEYNAME
 $KEYCOMMENTLINE
 $KEYEMAILLINE
 Expire-Date: $KEYEXPIRE
+#Preferences: <string>
+#Handle: <no-spaces>
 %pubring $PUBRING
 %secring $SECRING
 %commit
@@ -167,7 +180,7 @@
 
 # Generate a new key in the key rings
 gpg --no-random-seed-file --quiet --batch --no-tty \
-    --no-default-keyring --no-options --batch \
+    --no-default-keyring --no-options --enable-dsa2 \
     --secret-keyring "$SECRING" --keyring "$PUBRING" \
     --gen-key "$BATCHFILE"
 rm --force "$BATCHFILE"
@@ -193,15 +206,15 @@
 
 # Export keys from key rings to key files
 gpg --no-random-seed-file --quiet --batch --no-tty --armor \
-    --no-default-keyring --no-options --secret-keyring "$SECRING" \
-    --keyring "$PUBRING" --export-options export-minimal \
-    --comment "$FILECOMMENT" --output "$SECKEYFILE" \
-    --export-secret-keys
+    --no-default-keyring --no-options --enable-dsa2 \
+    --secret-keyring "$SECRING" --keyring "$PUBRING" \
+    --export-options export-minimal --comment "$FILECOMMENT" \
+    --output "$SECKEYFILE" --export-secret-keys
 gpg --no-random-seed-file --quiet --batch --no-tty --armor \
-    --no-default-keyring --no-options --secret-keyring "$SECRING" \
-    --keyring "$PUBRING" --export-options export-minimal \
-    --comment "$FILECOMMENT" --output "$PUBKEYFILE" \
-    --export
+    --no-default-keyring --no-options --enable-dsa2 \
+    --secret-keyring "$SECRING" --keyring "$PUBRING" \
+    --export-options export-minimal --comment "$FILECOMMENT" \
+    --output "$PUBKEYFILE" --export
 
 trap - EXIT
 

=== modified file 'mandos-keygen.xml'
--- mandos-keygen.xml	2008-08-20 00:35:41 +0000
+++ mandos-keygen.xml	2008-08-24 06:17:02 +0000
@@ -1,4 +1,4 @@
-<?xml version='1.0' encoding='UTF-8'?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
 <!ENTITY VERSION "1.0">
@@ -8,7 +8,7 @@
 <refentry xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>&COMMANDNAME;</title>
-    <!-- NWalsh's docbook scripts use this to generate the footer: -->
+    <!-- NWalsh’s docbook scripts use this to generate the footer: -->
     <productname>&COMMANDNAME;</productname>
     <productnumber>&VERSION;</productnumber>
     <authorgroup>
@@ -29,7 +29,8 @@
     </authorgroup>
     <copyright>
       <year>2008</year>
-      <holder>Teddy Hogeborn &amp; Björn Påhlsson</holder>
+      <holder>Teddy Hogeborn</holder>
+      <holder>Björn Påhlsson</holder>
     </copyright>
     <legalnotice>
       <para>
@@ -85,6 +86,14 @@
 	<replaceable>bits</replaceable></arg>
       </group>
       <group choice="opt">
+	<arg choice="plain"><option>--subtype</option>
+	<replaceable>type</replaceable></arg>
+      </group>
+      <group choice="opt">
+	<arg choice="plain"><option>--sublength</option>
+	<replaceable>bits</replaceable></arg>
+      </group>
+      <group choice="opt">
 	<arg choice="plain"><option>--name</option>
 	<replaceable>NAME</replaceable></arg>
       </group>
@@ -119,6 +128,14 @@
 	<replaceable>bits</replaceable></arg>
       </group>
       <group choice="opt">
+	<arg choice="plain"><option>-s</option>
+	<replaceable>type</replaceable></arg>
+      </group>
+      <group choice="opt">
+	<arg choice="plain"><option>-L</option>
+	<replaceable>bits</replaceable></arg>
+      </group>
+      <group choice="opt">
 	<arg choice="plain"><option>-n</option>
 	<replaceable>NAME</replaceable></arg>
       </group>
@@ -141,15 +158,15 @@
     <cmdsynopsis>
       <command>&COMMANDNAME;</command>
       <group choice="req">
-	<arg choice='plain'><option>-h</option></arg>
-	<arg choice='plain'><option>--help</option></arg>
+	<arg choice="plain"><option>-h</option></arg>
+	<arg choice="plain"><option>--help</option></arg>
       </group>
     </cmdsynopsis>
     <cmdsynopsis>
       <command>&COMMANDNAME;</command>
       <group choice="req">
-	<arg choice='plain'><option>-v</option></arg>
-	<arg choice='plain'><option>--version</option></arg>
+	<arg choice="plain"><option>-v</option></arg>
+	<arg choice="plain"><option>--version</option></arg>
       </group>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -207,7 +224,7 @@
 	<replaceable>type</replaceable></literal></term>
 	<listitem>
 	  <para>
-	    Key type.  Default is DSA.
+	    Key type.  Default is <quote>DSA</quote>.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -223,6 +240,27 @@
       </varlistentry>
 
       <varlistentry>
+	<term><literal>-s</literal>, <literal>--subtype
+	<replaceable>type</replaceable></literal></term>
+	<listitem>
+	  <para>
+	    Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
+	    encryption-only).
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term><literal>-L</literal>, <literal>--sublength
+	<replaceable>bits</replaceable></literal></term>
+	<listitem>
+	  <para>
+	    Subkey length in bits.  Default is 2048.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
 	<term><literal>-e</literal>, <literal>--email</literal>
 	<replaceable>address</replaceable></term>
 	<listitem>
@@ -238,7 +276,7 @@
 	<listitem>
 	  <para>
 	    Comment field for key.  The default value is
-	    "<literal>Mandos client key</literal>".
+	    <quote><literal>Mandos client key</literal></quote>.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -270,7 +308,7 @@
     <title>OVERVIEW</title>
     <xi:include href="overview.xml"/>
     <para>
-      This program is a small program to generate new OpenPGP keys for
+      This program is a small utility to generate new OpenPGP keys for
       new Mandos clients.
     </para>
   </refsect1>
@@ -371,7 +409,8 @@
   <refsect1 id="security">
     <title>SECURITY</title>
     <para>
-      The <option>--type</option> and <option>--length</option>
+      The <option>--type</option>, <option>--length</option>,
+      <option>--subtype</option>, and <option>--sublength</option>
       options can be used to create keys of insufficient security.  If
       in doubt, leave them to the default values.
     </para>