[pan2: 214/268] - win32 fixes for gthreads - removed gdk_threads in favor of g_idle_add - a few cleanups

[Heinrich MÃller <henmull src gnome org>]

commit d4b8b1cacc63ebc0384a2ab298816be73496a204
Author: Heinrich MÃller <sphemuel stud informatik uni-erlangen de>
Date:   Mon Nov 28 15:53:13 2011 +0100

    - win32 fixes for gthreads
    - removed gdk_threads in favor of g_idle_add
    - a few cleanups

 INSTALL                          |  243 +++++++++++++++++++++++++++++---------
 TODO                             |  199 -------------------------------
 pan/data-impl/rules-filter.cc    |    3 +-
 pan/data/cert-store.cc           |   10 +-
 pan/data/cert-store.h            |    7 +-
 pan/gui/group-prefs-dialog.cc    |    4 +-
 pan/gui/gui.cc                   |   90 +++++++++-----
 pan/gui/gui.h                    |   21 +++-
 pan/gui/pan.cc                   |    3 -
 pan/gui/post-ui.cc               |   22 +----
 pan/gui/prefs.cc                 |    9 ++
 pan/gui/prefs.h                  |    1 +
 pan/tasks/socket-impl-openssl.cc |    7 +-
 pan/usenet-utils/ssl-utils.h     |   15 ++-
 14 files changed, 294 insertions(+), 340 deletions(-)
---
diff --git a/INSTALL b/INSTALL
index 23e5f25..7d1c323 100644
--- a/INSTALL
+++ b/INSTALL
@@ -1,16 +1,25 @@
 Installation Instructions
 *************************
 
-Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005 Free
-Software Foundation, Inc.
+Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005,
+2006, 2007, 2008, 2009 Free Software Foundation, Inc.
 
-This file is free documentation; the Free Software Foundation gives
-unlimited permission to copy, distribute and modify it.
+   Copying and distribution of this file, with or without modification,
+are permitted in any medium without royalty provided the copyright
+notice and this notice are preserved.  This file is offered as-is,
+without warranty of any kind.
 
 Basic Installation
 ==================
 
-These are generic installation instructions.
+   Briefly, the shell commands `./configure; make; make install' should
+configure, build, and install this package.  The following
+more-detailed instructions are generic; see the `README' file for
+instructions specific to this package.  Some packages provide this
+`INSTALL' file but do not implement all of the features documented
+below.  The lack of an optional feature in a given package is not
+necessarily a bug.  More recommendations for GNU packages can be found
+in *note Makefile Conventions: (standards)Makefile Conventions.
 
    The `configure' shell script attempts to guess correct values for
 various system-dependent variables used during compilation.  It uses
@@ -23,9 +32,9 @@ debugging `configure').
 
    It can also use an optional file (typically called `config.cache'
 and enabled with `--cache-file=config.cache' or simply `-C') that saves
-the results of its tests to speed up reconfiguring.  (Caching is
+the results of its tests to speed up reconfiguring.  Caching is
 disabled by default to prevent problems with accidental use of stale
-cache files.)
+cache files.
 
    If you need to do unusual things to compile the package, please try
 to figure out how `configure' could check whether to do them, and mail
@@ -35,30 +44,37 @@ some point `config.cache' contains results you don't want to keep, you
 may remove or edit it.
 
    The file `configure.ac' (or `configure.in') is used to create
-`configure' by a program called `autoconf'.  You only need
-`configure.ac' if you want to change it or regenerate `configure' using
-a newer version of `autoconf'.
+`configure' by a program called `autoconf'.  You need `configure.ac' if
+you want to change it or regenerate `configure' using a newer version
+of `autoconf'.
 
-The simplest way to compile this package is:
+   The simplest way to compile this package is:
 
   1. `cd' to the directory containing the package's source code and type
-     `./configure' to configure the package for your system.  If you're
-     using `csh' on an old version of System V, you might need to type
-     `sh ./configure' instead to prevent `csh' from trying to execute
-     `configure' itself.
+     `./configure' to configure the package for your system.
 
-     Running `configure' takes awhile.  While running, it prints some
-     messages telling which features it is checking for.
+     Running `configure' might take a while.  While running, it prints
+     some messages telling which features it is checking for.
 
   2. Type `make' to compile the package.
 
   3. Optionally, type `make check' to run any self-tests that come with
-     the package.
+     the package, generally using the just-built uninstalled binaries.
 
   4. Type `make install' to install the programs and any data files and
-     documentation.
-
-  5. You can remove the program binaries and object files from the
+     documentation.  When installing into a prefix owned by root, it is
+     recommended that the package be configured and built as a regular
+     user, and only the `make install' phase executed with root
+     privileges.
+
+  5. Optionally, type `make installcheck' to repeat any self-tests, but
+     this time using the binaries in their final installed location.
+     This target does not install anything.  Running this target as a
+     regular user, particularly if the prior `make install' required
+     root privileges, verifies that the installation completed
+     correctly.
+
+  6. You can remove the program binaries and object files from the
      source code directory by typing `make clean'.  To also remove the
      files that `configure' created (so you can compile the package for
      a different kind of computer), type `make distclean'.  There is
@@ -67,45 +83,69 @@ The simplest way to compile this package is:
      all sorts of other programs in order to regenerate files that came
      with the distribution.
 
+  7. Often, you can also type `make uninstall' to remove the installed
+     files again.  In practice, not all packages have tested that
+     uninstallation works correctly, even though it is required by the
+     GNU Coding Standards.
+
+  8. Some packages, particularly those that use Automake, provide `make
+     distcheck', which can by used by developers to test that all other
+     targets like `make install' and `make uninstall' work correctly.
+     This target is generally not run by end users.
+
 Compilers and Options
 =====================
 
-Some systems require unusual options for compilation or linking that the
-`configure' script does not know about.  Run `./configure --help' for
-details on some of the pertinent environment variables.
+   Some systems require unusual options for compilation or linking that
+the `configure' script does not know about.  Run `./configure --help'
+for details on some of the pertinent environment variables.
 
    You can give `configure' initial values for configuration parameters
 by setting variables in the command line or in the environment.  Here
 is an example:
 
-     ./configure CC=c89 CFLAGS=-O2 LIBS=-lposix
+     ./configure CC=c99 CFLAGS=-g LIBS=-lposix
 
    *Note Defining Variables::, for more details.
 
 Compiling For Multiple Architectures
 ====================================
 
-You can compile the package for more than one kind of computer at the
+   You can compile the package for more than one kind of computer at the
 same time, by placing the object files for each architecture in their
-own directory.  To do this, you must use a version of `make' that
-supports the `VPATH' variable, such as GNU `make'.  `cd' to the
+own directory.  To do this, you can use GNU `make'.  `cd' to the
 directory where you want the object files and executables to go and run
 the `configure' script.  `configure' automatically checks for the
-source code in the directory that `configure' is in and in `..'.
+source code in the directory that `configure' is in and in `..'.  This
+is known as a "VPATH" build.
+
+   With a non-GNU `make', it is safer to compile the package for one
+architecture at a time in the source code directory.  After you have
+installed the package for one architecture, use `make distclean' before
+reconfiguring for another architecture.
 
-   If you have to use a `make' that does not support the `VPATH'
-variable, you have to compile the package for one architecture at a
-time in the source code directory.  After you have installed the
-package for one architecture, use `make distclean' before reconfiguring
-for another architecture.
+   On MacOS X 10.5 and later systems, you can create libraries and
+executables that work on multiple system types--known as "fat" or
+"universal" binaries--by specifying multiple `-arch' options to the
+compiler but only a single `-arch' option to the preprocessor.  Like
+this:
+
+     ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
+                 CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \
+                 CPP="gcc -E" CXXCPP="g++ -E"
+
+   This is not guaranteed to produce working output in all cases, you
+may have to build one architecture at a time and combine the results
+using the `lipo' tool if you have problems.
 
 Installation Names
 ==================
 
-By default, `make install' installs the package's commands under
+   By default, `make install' installs the package's commands under
 `/usr/local/bin', include files under `/usr/local/include', etc.  You
 can specify an installation prefix other than `/usr/local' by giving
-`configure' the option `--prefix=PREFIX'.
+`configure' the option `--prefix=PREFIX', where PREFIX must be an
+absolute file name.
 
    You can specify separate installation prefixes for
 architecture-specific files and architecture-independent files.  If you
@@ -116,16 +156,47 @@ Documentation and other data files still use the regular prefix.
    In addition, if you use an unusual directory layout you can give
 options like `--bindir=DIR' to specify different values for particular
 kinds of files.  Run `configure --help' for a list of the directories
-you can set and what kinds of files go in them.
+you can set and what kinds of files go in them.  In general, the
+default for these options is expressed in terms of `${prefix}', so that
+specifying just `--prefix' will affect all of the other directory
+specifications that were not explicitly provided.
+
+   The most portable way to affect installation locations is to pass the
+correct locations to `configure'; however, many packages provide one or
+both of the following shortcuts of passing variable assignments to the
+`make install' command line to change installation locations without
+having to reconfigure or recompile.
+
+   The first method involves providing an override variable for each
+affected directory.  For example, `make install
+prefix=/alternate/directory' will choose an alternate location for all
+directory configuration variables that were expressed in terms of
+`${prefix}'.  Any directories that were specified during `configure',
+but not in terms of `${prefix}', must each be overridden at install
+time for the entire installation to be relocated.  The approach of
+makefile variable overrides for each directory variable is required by
+the GNU Coding Standards, and ideally causes no recompilation.
+However, some platforms have known limitations with the semantics of
+shared libraries that end up requiring recompilation when using this
+method, particularly noticeable in packages that use GNU Libtool.
+
+   The second method involves providing the `DESTDIR' variable.  For
+example, `make install DESTDIR=/alternate/directory' will prepend
+`/alternate/directory' before all installation names.  The approach of
+`DESTDIR' overrides is not required by the GNU Coding Standards, and
+does not work on platforms that have drive letters.  On the other hand,
+it does better at avoiding recompilation issues, and works well even
+when some directory options were not specified in terms of `${prefix}'
+at `configure' time.
+
+Optional Features
+=================
 
    If the package supports it, you can cause programs to be installed
 with an extra prefix or suffix on their names by giving `configure' the
 option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
 
-Optional Features
-=================
-
-Some packages pay attention to `--enable-FEATURE' options to
+   Some packages pay attention to `--enable-FEATURE' options to
 `configure', where FEATURE indicates an optional part of the package.
 They may also pay attention to `--with-PACKAGE' options, where PACKAGE
 is something like `gnu-as' or `x' (for the X Window System).  The
@@ -137,14 +208,53 @@ find the X include and library files automatically, but if it doesn't,
 you can use the `configure' options `--x-includes=DIR' and
 `--x-libraries=DIR' to specify their locations.
 
+   Some packages offer the ability to configure how verbose the
+execution of `make' will be.  For these packages, running `./configure
+--enable-silent-rules' sets the default to minimal output, which can be
+overridden with `make V=1'; while running `./configure
+--disable-silent-rules' sets the default to verbose, which can be
+overridden with `make V=0'.
+
+Particular systems
+==================
+
+   On HP-UX, the default C compiler is not ANSI C compatible.  If GNU
+CC is not installed, it is recommended to use the following options in
+order to use an ANSI C compiler:
+
+     ./configure CC="cc -Ae -D_XOPEN_SOURCE=500"
+
+and if that doesn't work, install pre-built binaries of GCC for HP-UX.
+
+   On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot
+parse its `<wchar.h>' header file.  The option `-nodtk' can be used as
+a workaround.  If GNU CC is not installed, it is therefore recommended
+to try
+
+     ./configure CC="cc"
+
+and if that doesn't work, try
+
+     ./configure CC="cc -nodtk"
+
+   On Solaris, don't put `/usr/ucb' early in your `PATH'.  This
+directory contains several dysfunctional programs; working variants of
+these programs are available in `/usr/bin'.  So, if you need `/usr/ucb'
+in your `PATH', put it _after_ `/usr/bin'.
+
+   On Haiku, software installed for all users goes in `/boot/common',
+not `/usr/local'.  It is recommended to use the following options:
+
+     ./configure --prefix=/boot/common
+
 Specifying the System Type
 ==========================
 
-There may be some features `configure' cannot figure out automatically,
-but needs to determine by the type of machine the package will run on.
-Usually, assuming the package is built to be run on the _same_
-architectures, `configure' can figure that out, but if it prints a
-message saying it cannot guess the machine type, give it the
+   There may be some features `configure' cannot figure out
+automatically, but needs to determine by the type of machine the package
+will run on.  Usually, assuming the package is built to be run on the
+_same_ architectures, `configure' can figure that out, but if it prints
+a message saying it cannot guess the machine type, give it the
 `--build=TYPE' option.  TYPE can either be a short name for the system
 type, such as `sun4', or a canonical name which has the form:
 
@@ -152,7 +262,8 @@ type, such as `sun4', or a canonical name which has the form:
 
 where SYSTEM can have one of these forms:
 
-     OS KERNEL-OS
+     OS
+     KERNEL-OS
 
    See the file `config.sub' for the possible values of each field.  If
 `config.sub' isn't included in this package, then this package doesn't
@@ -170,9 +281,9 @@ eventually be run) with `--host=TYPE'.
 Sharing Defaults
 ================
 
-If you want to set default values for `configure' scripts to share, you
-can create a site shell script called `config.site' that gives default
-values for variables like `CC', `cache_file', and `prefix'.
+   If you want to set default values for `configure' scripts to share,
+you can create a site shell script called `config.site' that gives
+default values for variables like `CC', `cache_file', and `prefix'.
 `configure' looks for `PREFIX/share/config.site' if it exists, then
 `PREFIX/etc/config.site' if it exists.  Or, you can set the
 `CONFIG_SITE' environment variable to the location of the site script.
@@ -181,7 +292,7 @@ A warning: not all `configure' scripts look for a site script.
 Defining Variables
 ==================
 
-Variables not defined in a site shell script can be set in the
+   Variables not defined in a site shell script can be set in the
 environment passed to `configure'.  However, some packages may run
 configure again during the build, and the customized values of these
 variables may be lost.  In order to avoid this problem, you should set
@@ -190,21 +301,29 @@ them in the `configure' command line, using `VAR=value'.  For example:
      ./configure CC=/usr/local2/bin/gcc
 
 causes the specified `gcc' to be used as the C compiler (unless it is
-overridden in the site shell script).  Here is a another example:
+overridden in the site shell script).
 
-     /bin/bash ./configure CONFIG_SHELL=/bin/bash
+Unfortunately, this technique does not work for `CONFIG_SHELL' due to
+an Autoconf bug.  Until the bug is fixed you can use this workaround:
 
-Here the `CONFIG_SHELL=/bin/bash' operand causes subsequent
-configuration-related scripts to be executed by `/bin/bash'.
+     CONFIG_SHELL=/bin/bash /bin/bash ./configure CONFIG_SHELL=/bin/bash
 
 `configure' Invocation
 ======================
 
-`configure' recognizes the following options to control how it operates.
+   `configure' recognizes the following options to control how it
+operates.
 
 `--help'
 `-h'
-     Print a summary of the options to `configure', and exit.
+     Print a summary of all of the options to `configure', and exit.
+
+`--help=short'
+`--help=recursive'
+     Print a summary of the options unique to this package's
+     `configure', and exit.  The `short' variant lists options used
+     only in the top level, while the `recursive' variant lists options
+     also present in any nested packages.
 
 `--version'
 `-V'
@@ -231,6 +350,16 @@ configuration-related scripts to be executed by `/bin/bash'.
      Look for the package's source code in directory DIR.  Usually
      `configure' can determine that directory automatically.
 
+`--prefix=DIR'
+     Use DIR as the installation prefix.  *note Installation Names::
+     for more details, including other options available for fine-tuning
+     the installation locations.
+
+`--no-create'
+`-n'
+     Run the configure checks, but stop before creating any output
+     files.
+
 `configure' also accepts some other, not widely useful, options.  Run
 `configure --help' for more details.
 
diff --git a/pan/data-impl/rules-filter.cc b/pan/data-impl/rules-filter.cc
index 60a6fdc..98e449b 100644
--- a/pan/data-impl/rules-filter.cc
+++ b/pan/data-impl/rules-filter.cc
@@ -102,9 +102,8 @@ RulesFilter :: test_article ( Data        & data,
       break;
 
     default:
-     debug("error : unknown rules type "<<rules._type);
+//     debug("error : unknown rules type "<<rules._type);
      return true;
-     break;
   }
 
   return pass;
diff --git a/pan/data/cert-store.cc b/pan/data/cert-store.cc
index 390a7ab..accd07e 100644
--- a/pan/data/cert-store.cc
+++ b/pan/data/cert-store.cc
@@ -66,7 +66,7 @@ namespace pan
       if (mydata->ignore_all==1) { return 1; }
 
       X509 *cert = X509_STORE_CTX_get_current_cert(store);
-      int depth = X509_STORE_CTX_get_error_depth(store);
+      CRYPTO_add (&(cert->references), 1, CRYPTO_LOCK_X509); // refcount +1
       int err = X509_STORE_CTX_get_error(store);
 
       /* accept user-override on self-signed certificates */
@@ -136,7 +136,7 @@ namespace pan
   void
   CertStore :: remove (const Quark& server)
   {
-    if (_cert_to_server.count(server) > 0)
+    if (_cert_to_server.count(server))
     {
       _cert_to_server.erase(server);
       _certs.erase(server);
@@ -170,6 +170,8 @@ namespace pan
   CertStore :: add(X509* cert, const Quark& server)
   {
     if (!cert || server.empty()) return false;
+    debug(cert<<" "<<_data.get_server_address(server));
+    debug(X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0));
     X509_STORE_add_cert(get_store(),cert);
 
     std::string addr; int port;
@@ -184,7 +186,7 @@ namespace pan
 
     FILE * fp = fopen(buf, "wb");
     if (!fp) return false;
-    if (PEM_write_X509(fp, cert) != 1) { fclose(fp); return false; }
+    if (!PEM_write_X509(fp, cert)) { fclose(fp); return false; }
     fclose(fp);
     chmod (buf, 0600);
 
@@ -207,7 +209,7 @@ namespace pan
     else
       serv = server;
 
-    if (_cert_to_server.count(serv) > 0)
+    if (_cert_to_server.count(serv))
       ret = _cert_to_server.find(serv)->second;
     return ret;
   }
diff --git a/pan/data/cert-store.h b/pan/data/cert-store.h
index 0058ce4..5700ba8 100644
--- a/pan/data/cert-store.h
+++ b/pan/data/cert-store.h
@@ -33,8 +33,8 @@
 #endif
 
 #include <pan/data/data.h>
-
 #include <pan/tasks/socket.h>
+#include <pan/general/debug.h>
 #include <pan/general/quark.h>
 #include <pan/general/macros.h>
 #include <pan/general/worker-pool.h>
@@ -90,7 +90,7 @@ namespace pan
 
       bool in_blacklist (const Quark& s)
       {
-        return _blacklist.count(s) != 0;
+        return _blacklist.count(s);
       }
       void blacklist (const Quark& s)
       {
@@ -123,7 +123,7 @@ namespace pan
 
       bool add(X509*, const Quark&) ;
       void remove (const Quark&);
-      bool exist (const Quark& q) { /*dump_certs(); std::cerr<<"q "<<q<<"\n\n"; */ return (_certs.count(q) > 0); }
+      bool exist (const Quark& q) { return (_certs.count(q) > 0); }
 
       static std::string build_cert_name(std::string host);
 
@@ -144,6 +144,7 @@ namespace pan
       /* notify functions for listener list */
       void verify_failed (X509* c, std::string server, std::string cn, int nr)
       {
+        debug("verify failed listeners");
         for (listeners_t::iterator it(_listeners.begin()), end(_listeners.end()); it!=end; ++it)
           (*it)->on_verify_cert_failed (c, server, cn, nr);
       }
diff --git a/pan/gui/group-prefs-dialog.cc b/pan/gui/group-prefs-dialog.cc
index 838b452..cabf364 100644
--- a/pan/gui/group-prefs-dialog.cc
+++ b/pan/gui/group-prefs-dialog.cc
@@ -135,7 +135,7 @@ GroupPrefsDialog :: GroupPrefsDialog (Data            & data,
   t = HIG :: workarea_create ();
 
   char buf[512];
-  if (groups.size() > 1)
+  if (groups.size() != 1)
     g_snprintf (buf, sizeof(buf), _("Properties for Groups"));
   else
     g_snprintf (buf, sizeof(buf), _("Properties for %s"), groups[0].c_str());
@@ -148,7 +148,7 @@ GroupPrefsDialog :: GroupPrefsDialog (Data            & data,
     w = _save_path = file_entry_new (_("Directory for Saving Attachments"));
     char * pch = g_build_filename (g_get_home_dir(), "News", NULL);
     std::string dir;
-    if (groups.size() > 1)
+    if (groups.size() != 1)
       dir = pch;
     else
       dir = _group_prefs.get_string (groups[0], "default-group-save-path", pch);
diff --git a/pan/gui/gui.cc b/pan/gui/gui.cc
index 628ee9a..33dbcb0 100644
--- a/pan/gui/gui.cc
+++ b/pan/gui/gui.cc
@@ -317,9 +317,6 @@ GUI :: GUI (Data& data, Queue& queue, Prefs& prefs, GroupPrefs& group_prefs):
 
   upkeep_tag = g_timeout_add (3000, upkeep_timer_cb, this);
 
-  _queue.add_listener (this);
-  Log::get().add_listener (this);
-
   g_object_ref_sink (G_OBJECT(_info_image));
   g_object_ref_sink (G_OBJECT(_error_image));
   g_object_ref (_group_pane->root());
@@ -339,7 +336,10 @@ GUI :: GUI (Data& data, Queue& queue, Prefs& prefs, GroupPrefs& group_prefs):
   if (_prefs.get_flag ("get-new-headers-on-startup", false))
     activate_action ("get-new-headers-in-subscribed-groups");
 
+  _queue.add_listener (this);
   _prefs.add_listener (this);
+  _certstore.add_listener(this);
+  Log::get().add_listener (this);
 
   gtk_accel_map_load (get_accel_filename().c_str());
 
@@ -353,7 +353,6 @@ GUI :: GUI (Data& data, Queue& queue, Prefs& prefs, GroupPrefs& group_prefs):
         on_queue_task_active_changed (queue, *(*it), true);
     }
   }
-  _certstore.add_listener(this);
 }
 
 namespace
@@ -805,7 +804,6 @@ void GUI :: on_log_entry_added (const Log::Entry& e)
     set_bin_child (_event_log_button, _error_image);
 
   if (_queue.is_online() && (e.severity & Log::PAN_SEVERITY_URGENT)) {
-    gdk_threads_enter();
     GtkWidget * w = gtk_message_dialog_new (get_window(_root),
                                             GtkDialogFlags(GTK_DIALOG_MODAL|GTK_DIALOG_DESTROY_WITH_PARENT),
                                             GTK_MESSAGE_ERROR,
@@ -813,7 +811,6 @@ void GUI :: on_log_entry_added (const Log::Entry& e)
                                             "%s", e.message.c_str());
     g_signal_connect_swapped (w, "response", G_CALLBACK (gtk_widget_destroy), w);
     gtk_widget_show_all (w);
-    gdk_threads_leave();
   }
 }
 
@@ -861,7 +858,6 @@ void GUI :: do_show_preferences_dialog ()
 }
 void GUI :: do_show_group_preferences_dialog ()
 {
-//  const Quark group (_group_pane->get_first_selection ());
   quarks_v groups(_group_pane->get_full_selection());
   if (!groups.empty()) {
     GroupPrefsDialog * dialog = new GroupPrefsDialog (_data, groups, _group_prefs, get_window(_root));
@@ -1315,23 +1311,23 @@ bool GUI :: confirm_accept_new_cert_dialog(GtkWindow * parent, X509* cert, const
   std::string host; int port;
   _data.get_server_addr(server,host,port);
   pretty_print_x509(buf,sizeof(buf), host, cert,true);
-  gdk_threads_enter();
-    GtkWidget * d = gtk_message_dialog_new (
-      parent,
-      GtkDialogFlags(GTK_DIALOG_MODAL|GTK_DIALOG_DESTROY_WITH_PARENT),
-      GTK_MESSAGE_WARNING,
-      GTK_BUTTONS_NONE, NULL);
-
-    HIG :: message_dialog_set_text (GTK_MESSAGE_DIALOG(d), buf,
-      _("Do you want to accept it permanently (deletable afterwards) ?"));
-    gtk_dialog_add_buttons (GTK_DIALOG(d),
-                            GTK_STOCK_CANCEL, GTK_RESPONSE_NO,
-                            GTK_STOCK_APPLY, GTK_RESPONSE_YES,
-                            NULL);
-    gtk_dialog_set_default_response (GTK_DIALOG(d), GTK_RESPONSE_NO);
-    ret = gtk_dialog_run (GTK_DIALOG(d)) == GTK_RESPONSE_YES;
-    gtk_widget_destroy(d);
-  gdk_threads_leave();
+  GtkWidget * d = gtk_message_dialog_new (
+    parent,
+    GtkDialogFlags(GTK_DIALOG_MODAL|GTK_DIALOG_DESTROY_WITH_PARENT),
+    GTK_MESSAGE_WARNING,
+    GTK_BUTTONS_NONE, NULL);
+
+  HIG :: message_dialog_set_text (GTK_MESSAGE_DIALOG(d), buf,
+    _("Do you want to accept it permanently (deletable afterwards) ?"));
+  gtk_dialog_add_buttons (GTK_DIALOG(d),
+                          GTK_STOCK_CANCEL, GTK_RESPONSE_NO,
+                          GTK_STOCK_APPLY, GTK_RESPONSE_YES,
+                          NULL);
+  gtk_dialog_set_default_response (GTK_DIALOG(d), GTK_RESPONSE_NO);
+
+  debug("confirm cert gui");
+  ret = gtk_dialog_run (GTK_DIALOG(d)) == GTK_RESPONSE_YES;
+  gtk_widget_destroy(d);
   return ret;
 }
 #endif
@@ -2097,19 +2093,48 @@ GUI :: on_prefs_string_changed (const StringView& key, const StringView& value)
 }
 
 #ifdef HAVE_OPENSSL
+
 void
-GUI :: on_verify_cert_failed(X509* cert, std::string server, std::string cert_name, int nr)
+GUI :: do_show_cert_failed_dialog(VerifyData* data)
 {
-  if (!cert || cert_name.empty() || server.empty()) return;
-
-  if (GUI::confirm_accept_new_cert_dialog(get_window(_root),cert,server))
-    if (!_certstore.add(cert, server))
-      Log::add_urgent_va("Error adding certificate of server '%s' to Certificate Store",server.c_str());
+  debug("do show cert failed dialog");
+  const VerifyData& d(*data);
+  if (GUI::confirm_accept_new_cert_dialog(get_window(_root),d.cert,d.server))
+    if (!_certstore.add(d.cert, d.server))
+      Log::add_urgent_va("Error adding certificate of server '%s' to Certificate Store",d.server.c_str());
     else
     {
-      _data.set_server_cert(server, cert_name);
-      _data.save_server_info(server);
+      _data.set_server_cert(d.server, d.cert_name);
+      _data.save_server_info(d.server);
     }
+  X509_free(d.cert); // refcount -1
+  delete data;
+}
+
+gboolean
+GUI :: show_cert_failed_cb(gpointer gp)
+{
+  debug("show_cert_failed_cb");
+  VerifyData* d(static_cast<VerifyData*>(gp));
+  d->gui->do_show_cert_failed_dialog(d);
+  return false;
+}
+
+void
+GUI :: on_verify_cert_failed(X509* cert, std::string server, std::string cert_name, int nr)
+{
+  debug("on verify failed GUI ("<<cert<<") ("<<cert_name<<") ("<<server<<")");
+  if (!cert || server.empty()) return;
+
+  debug(X509_NAME_oneline(X509_get_issuer_name(cert), 0, 0));
+  VerifyData* data = new VerifyData();
+  data->cert = cert;
+  data->server = server;
+  data->cert_name = cert_name;
+  data->nr = nr;
+  data->gui = this;
+  g_idle_add(show_cert_failed_cb, data);
+
 }
 
 void
@@ -2117,7 +2142,6 @@ GUI :: on_valid_cert_added (X509* cert, std::string server)
 {
   /* whitelist to make avaible for nntp-pool */
   _certstore.whitelist(server);
-
 }
 
 
diff --git a/pan/gui/gui.h b/pan/gui/gui.h
index 4a4c760..32ab8e9 100644
--- a/pan/gui/gui.h
+++ b/pan/gui/gui.h
@@ -62,6 +62,15 @@ namespace pan
       GtkWidget* root () { return _root; }
       typedef std::vector<std::string> strings_t;
 
+      struct VerifyData
+      {
+        X509* cert;
+        std::string server;
+        std::string cert_name;
+        int nr;
+        GUI* gui;
+      };
+
     public: // ActionManager
       virtual bool is_action_active (const char * action_name) const;
       virtual void activate_action (const char * action_name) const;
@@ -128,9 +137,6 @@ namespace pan
       virtual void do_supersede_article ();
       virtual void do_delete_article ();
       virtual bool deletion_confirmation_dialog();
-#ifdef HAVE_OPENSSL
-      bool confirm_accept_new_cert_dialog(GtkWindow*, X509*, const Quark&);
-#endif
       virtual void do_clear_article_cache ();
       virtual void do_mark_article_read ();
       virtual void do_mark_article_unread ();
@@ -166,6 +172,10 @@ namespace pan
       virtual void do_refresh_groups ();
       virtual void do_subscribe_selected_groups ();
       virtual void do_unsubscribe_selected_groups ();
+#ifdef HAVE_OPENSSL
+      void do_show_cert_failed_dialog(VerifyData* data);
+      bool confirm_accept_new_cert_dialog(GtkWindow*, X509*, const Quark&);
+#endif
 
     public:
       static std::string prompt_user_for_save_path (GtkWindow * parent, const Prefs& prefs);
@@ -256,7 +266,10 @@ namespace pan
       static void prefs_dialog_destroyed_cb (GtkWidget * w, gpointer self);
       void prefs_dialog_destroyed (GtkWidget* w);
       int score_int_from_string(std::string val, const char* rules[]);
-
+#ifdef HAVE_OPENSSL
+      static gboolean show_cert_failed_cb(gpointer gp);
+//      static void cert_failed_dty(gpointer gp);
+#endif
     public:
       GtkUIManager* get_ui_manager() { return _ui_manager; }
   };
diff --git a/pan/gui/pan.cc b/pan/gui/pan.cc
index 0be4b3d..758ec50 100644
--- a/pan/gui/pan.cc
+++ b/pan/gui/pan.cc
@@ -75,9 +75,7 @@ namespace
       g_main_loop_run (nongui_gmainloop);
     else
     {
-      gdk_threads_enter();
       gtk_main ();
-      gdk_threads_leave();
     }
 #else
     while (gtk_events_pending ())
@@ -532,7 +530,6 @@ main (int argc, char *argv[])
   textdomain (GETTEXT_PACKAGE);
 
   g_thread_init (0);
-  gdk_threads_init ();
   g_mime_init (GMIME_ENABLE_RFC2047_WORKAROUNDS);
 
   bool gui(true), nzb(false), verbosed(false);
diff --git a/pan/gui/post-ui.cc b/pan/gui/post-ui.cc
index f8aba9c..78cf7b7 100644
--- a/pan/gui/post-ui.cc
+++ b/pan/gui/post-ui.cc
@@ -2760,26 +2760,6 @@ PostUI :: move_bottom (void)
   _upload_queue.move_bottom (get_selected_files());
 }
 
-//void
-//PostUI :: select_encode (GtkAction* a)
-//{
-//    tasks_t tasks = get_selected_files();
-//    const gchar* name = gtk_action_get_name(a);
-//
-//    TaskUpload::EncodeMode tmp;
-//    if (!strcmp(name, "yenc"))
-//        tmp = TaskUpload::YENC;
-//    if (!strcmp(name, "plain"))
-//        tmp = TaskUpload::PLAIN;
-//
-//    struct stat sb;
-//    foreach(tasks_t, tasks, it)
-//    {
-//      TaskUpload * tmp2 (dynamic_cast<TaskUpload*>(*it));
-//      if (tmp2) tmp2->_encode_mode = tmp;
-//    }
-//    update_filequeue_tab();
-//}
 
 int
 PostUI :: get_total_parts(const char* file)
@@ -2787,7 +2767,7 @@ PostUI :: get_total_parts(const char* file)
     struct stat sb;
     stat (file,&sb);
     int max (std::max(1,(int)std::ceil((double)sb.st_size /
-                                       _prefs.get_int("upload-option-bpf",512*1024))));
+                                       (double)_prefs.get_int_min("upload-option-bpf",512*1024))));
     return max;
 }
 
diff --git a/pan/gui/prefs.cc b/pan/gui/prefs.cc
index 73c7a09..449b838 100644
--- a/pan/gui/prefs.cc
+++ b/pan/gui/prefs.cc
@@ -273,6 +273,15 @@ Prefs :: get_int (const StringView& key, int fallback) const
   return _ints[key];
 }
 
+int
+Prefs :: get_int_min (const StringView& key, int fallback) const
+{
+  if (!_ints.count (key))
+    _ints[key] = fallback;
+  if (_ints[key] < fallback) _ints[key] = fallback;
+  return _ints[key];
+}
+
 void
 Prefs :: set_int (const StringView& key, int value)
 {
diff --git a/pan/gui/prefs.h b/pan/gui/prefs.h
index c0b5985..ce246e5 100644
--- a/pan/gui/prefs.h
+++ b/pan/gui/prefs.h
@@ -83,6 +83,7 @@ namespace pan
       bool get_flag (const StringView& key, bool fallback) const;
       void set_flag (const StringView& key, bool);
       int get_int (const StringView& key, int fallback) const;
+      int get_int_min  (const StringView& key, int fallback) const;
       void set_int (const StringView& key, int);
 
       std::string get_string (const StringView& key, const StringView& fallback) const;
diff --git a/pan/tasks/socket-impl-openssl.cc b/pan/tasks/socket-impl-openssl.cc
index debb549..d223880 100644
--- a/pan/tasks/socket-impl-openssl.cc
+++ b/pan/tasks/socket-impl-openssl.cc
@@ -430,7 +430,6 @@ namespace
     Quark setme;
     data.find_server_by_hn(host, setme);
     mydata.cert_name = data.get_server_cert(setme);
-    std::cerr<<"ssl handshake "<<mydata.cert_name<<"\n";
     mydata.server = server;
     SSL_set_ex_data(chan->ssl, SSL_get_fd(chan->ssl), &mydata);
 
@@ -854,13 +853,11 @@ void
 GIOChannelSocketSSL :: on_verify_cert_failed (X509* cert, std::string server,
                                               std::string cert_name, int nr)
 {
-  if (!_certstore.in_blacklist(server)) _certstore.blacklist(server);
+  _certstore.blacklist(server);
 }
 
 void
 GIOChannelSocketSSL :: on_valid_cert_added (X509* cert, std::string server)
-{
-
-}
+{}
 #endif  //HAVE_OPENSSL
 
diff --git a/pan/usenet-utils/ssl-utils.h b/pan/usenet-utils/ssl-utils.h
index b4346dd..f0422bb 100644
--- a/pan/usenet-utils/ssl-utils.h
+++ b/pan/usenet-utils/ssl-utils.h
@@ -200,7 +200,7 @@ namespace pan
     if (result != X509_V_OK) {
       unsigned char md[EVP_MAX_MD_SIZE];
       unsigned int n;
-      char *str;
+      char *str(0);
 
       g_warning("Could not verify SSL servers certificate: %s",
           X509_verify_cert_error_string(result));
@@ -278,7 +278,7 @@ namespace pan
   {
     if (map_init++ == 0) init_err_map();
     Quark ret;
-    if (ssl_err.count(i) > 0) return ssl_err[i];
+    if (ssl_err.count(i)) return ssl_err[i];
     return ret;
   }
 
@@ -425,10 +425,11 @@ namespace pan
 
     CertParser(X509* c) : cert(c), delim('/'), pos1(0), pos2(0), idx(0), num_tags(G_N_ELEMENTS(tags_idx))
     {
-      issuer  = X509_NAME_oneline(cert->cert_info->issuer,0,0);
-      subject = X509_NAME_oneline(cert->cert_info->subject, 0, 0);
+      issuer  = X509_NAME_oneline(X509_get_issuer_name(c),0, 0);
+      subject = X509_NAME_oneline(X509_get_subject_name(c), 0, 0);
       iss = issuer;
       sub = subject;
+
       /* init map */
       int i(0);
       tags.insert(quarks_p(cleaned_tags[i++],"Locality"));
@@ -502,8 +503,8 @@ namespace pan
 
     ~CertParser ()
     {
-      free(issuer);
-      free(subject);
+        free(issuer);
+        free(subject);
     }
   };
 
@@ -523,7 +524,7 @@ namespace pan
     cp.parse(p_issuer, p_subject);
 
 
-    time_t t = getTimeFromASN1(cert->cert_info->validity->notAfter);
+    time_t t  = getTimeFromASN1(cert->cert_info->validity->notAfter);
     time_t t2 = getTimeFromASN1(cert->cert_info->validity->notBefore);
     EvolutionDateMaker date_maker;
     char * until = date_maker.get_date_string (t);