merge: sync upstream profanity-im/profanity

Sync with upstream profanity-im/profanity.

Major upstream changes incorporated:

Memory management
  - Replace malloc+memset with g_new0 throughout codebase
  - Adopt auto_gchar / auto_gcharv / auto_gerror / auto_jid cleanup macros
  - Replace free() with g_free() for GAlloc'd memory

Editor rewrite
  - Remove pthread-based async editor; use GChildWatch callback API
  - New launch_editor(initial_content, callback, user_data) interface
  - Proper signal handling (SIGINT, SIGTSTP, SIGPIPE reset in child)
  - ui_suspend()/ui_resume() integration for TTY management

OMEMO improvements
  - Dual backend support: libsignal-protocol-c and libomemo-c
  - Proper pre-key removal after use (XEP-0384 compliance)
  - Automatic pre-key regeneration when store drops below threshold
  - New functions: omemo_is_device_active(), omemo_is_jid_trusted()
  - omemo_get_jid_untrusted_fingerprints() for better error messages
  - Fingerprint notifications on new device identity discovery
  - Deterministic pre-key ID generation tracking max_pre_key_id
  - omemo_trust_changed() UI updates on trust state changes

JID validation
  - RFC 6122-compliant validation in jid_is_valid()
  - Character-level checks (RFC 6122 forbidden chars: & ' / : < > @)
  - Length limits: 1023 per component, 3071 total
  - New jid_is_valid_user_jid() for user vs. service JID distinction

Database
  - Schema migration v3: UNIQUE constraint on archive_id for deduplication
  - Triggers for corrected message tracking (replaces_db_id / replaced_by_db_id)
  - db_history_result_t return type, _truncate_datetime_suffix()

UI / console
  - win_warn_needed() / win_warn_sent() warning deduplication hash table
  - PAD_MIN_HEIGHT dynamic pad sizing with PAD_THRESHOLD auto-cleanup
  - Spellcheck integration in input field with Unicode word detection
  - cons_spellcheck_setting() for /settings ui output
  - /[command]? shortcut for command help

Account config
  - Account name sanitization for GKeyFile special chars ([ ] = # \n \r)
  - Replace popen() with g_spawn_sync() for eval_password
  - TLS policy: add "direct" option alongside legacy

Connection
  - Port validation with g_assert (0–65535)
  - SHA-256 certificate fingerprint support (XMPP_CERT_PUBKEY_FINGERPRINT_SHA256)
  - "direct" TLS policy alias for legacy SSL

Common utilities
  - str_xml_sanitize() for XML 1.0 illegal character removal
  - string_matches_one_of() with formatted error messages
  - valid_tls_policy_option() helper
  - prof_date_time_format_iso8601() utility
  - Improved strip_arg_quotes() with backslash unescaping
  - prof_occurrences() uses g_slist_prepend + reverse for performance

PGP / OX
  - Proper GPGME resource cleanup with goto-cleanup pattern
  - g_string_free(xmppuri) leak fix in _ox_key_lookup

CSV export
  - Use GString + g_file_set_contents instead of raw write() syscalls

Tests
  - Restructured into subdirectories: command/, config/, xmpp/, ui/, omemo/, otr/, pgp/
  - New test_cmd_ac.c for autocompleter unit tests
  - Updated stubs for new UI suspend/resume functions

License headers
  - Migrate to SPDX-3.0 identifiers (GPL-3.0-or-later WITH OpenSSL-exception)

────────────────────────────────────────────────────
cproof-specific preservations:

  - XEP-0308 LMC: replace_id ?: id logic in message/stanza/omemo
  - Force encryption: cmd_force_encryption, test_forced_encryption
  - CWE-134: format string protection (cons_show("%s", ...))
  - y_start_pos-based paging in window.c
  - db_history_result_t return type, _truncate_datetime_suffix()

Merge-time fixes:

  - common.c: format-security (-Werror) — cons_show(errmsg) → cons_show("%s", errmsg)
  - database.c: null-deref guard — !msg->timestamp → msg && !msg->timestamp
  - console.c: implicit size_t → int cast — (int)(maxlen + 1)
  - tlscerts.c: %d for size_t — %zu

Build system:
  - Kept autotools (Makefile.am, configure.ac); upstream uses Meson
  - Restored deleted files: bootstrap.sh, autogen.sh, ax_valgrind_check.m4, configure-debug
  - Updated Makefile.am test paths for subdirectory structure
  - Added test_cmd_ac, test_forced_encryption to test sources

Functional tests:
  - Use cproof version; upstream requires stbbr_for_xmlns from updated stabber
  - Not yet available in devs/stabber fork

Closes #64

Merge author: jabber.developer2
Commits authors:
 Michael Vetter <jubalh@iodoru.org>
& Steffen Jaeckel <s@jaeckel.eu>

src/config/tlscerts.c

@@ -4,33 +4,7 @@
  *
  * Copyright (C) 2012 - 2019 James Booth <boothj5@gmail.com>
  *
- * This file is part of Profanity.
- *
- * Profanity is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Profanity is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with Profanity.  If not, see <https://www.gnu.org/licenses/>.
- *
- * In addition, as a special exception, the copyright holders give permission to
- * link the code of portions of this program with the OpenSSL library under
- * certain conditions as described in each individual source file, and
- * distribute linked combinations including the two.
- *
- * You must obey the GNU General Public License in all respects for all of the
- * code used other than OpenSSL. If you modify file(s) with this exception, you
- * may extend this exception to your version of the file(s), but you are not
- * obligated to do so. If you do not wish to do so, delete this exception
- * statement from your version. If you delete this exception statement from all
- * source files in the program, then also delete it here.
- *
+ * SPDX-License-Identifier: GPL-3.0-or-later WITH OpenSSL-exception
  */
 
 #include "config.h"
@@ -54,7 +28,7 @@ static void _save_tlscerts(void);
 
 static Autocomplete certs_ac;
 
-static char* current_fp;
+static gchar* current_fp;
 
 static void
 _tlscerts_close(void)
@@ -62,7 +36,7 @@ _tlscerts_close(void)
     free_keyfile(&tlscerts_prof_keyfile);
     tlscerts = NULL;
 
-    free(current_fp);
+    g_free(current_fp);
     current_fp = NULL;
 
     autocomplete_free(certs_ac);
@@ -82,7 +56,7 @@ tlscerts_init(void)
     gsize len = 0;
     auto_gcharv gchar** groups = g_key_file_get_groups(tlscerts, &len);
 
-    for (int i = 0; i < g_strv_length(groups); i++) {
+    for (guint i = 0; i < g_strv_length(groups); i++) {
         autocomplete_add(certs_ac, groups[i]);
     }
 
@@ -90,33 +64,116 @@ tlscerts_init(void)
 }
 
 void
-tlscerts_set_current(const char* const fp)
+tlscerts_set_current(const TLSCertificate* cert)
 {
     if (current_fp) {
-        free(current_fp);
+        g_free(current_fp);
     }
-    current_fp = strdup(fp);
+    current_fp = g_strdup(cert->fingerprint);
 }
 
-char*
-tlscerts_get_current(void)
+gboolean
+tlscerts_current_fingerprint_equals(const TLSCertificate* cert)
 {
-    return current_fp;
+    return g_strcmp0(current_fp, cert->fingerprint) == 0;
 }
 
 void
 tlscerts_clear_current(void)
 {
     if (current_fp) {
-        free(current_fp);
+        g_free(current_fp);
         current_fp = NULL;
     }
 }
 
 gboolean
-tlscerts_exists(const char* const fingerprint)
+tlscerts_exists(const TLSCertificate* cert)
 {
-    return g_key_file_has_group(tlscerts, fingerprint);
+    return g_key_file_has_group(tlscerts, cert->fingerprint);
+}
+
+#define _name_to_tlscert_name(in, cert, which)            \
+    do {                                                  \
+        _name_to_tlscert_name_(in, &cert->which, #which); \
+    } while (0)
+static void
+_name_to_tlscert_name_(const char* in, tls_cert_name_t* out, const char* name);
+
+static TLSCertificate*
+_tlscerts_new(gchar* fingerprint_sha1, int version, gchar* serialnumber, gchar* subjectname,
+              gchar* issuername, gchar* notbefore, gchar* notafter,
+              gchar* key_alg, gchar* signature_alg, gchar* pem,
+              gchar* fingerprint_sha256, gchar* pubkey_fingerprint)
+{
+    TLSCertificate* cert = g_new0(TLSCertificate, 1);
+
+    if (fingerprint_sha256 && fingerprint_sha1) {
+        cert->fingerprint_sha256 = fingerprint_sha256;
+        cert->fingerprint_sha1 = fingerprint_sha1;
+        cert->fingerprint = cert->fingerprint_sha256;
+    } else {
+        if (fingerprint_sha256) {
+            size_t s = strlen(fingerprint_sha256);
+            switch (s) {
+            case 40:
+                cert->fingerprint_sha1 = fingerprint_sha256;
+                cert->fingerprint = cert->fingerprint_sha1;
+                break;
+            case 64:
+                cert->fingerprint_sha256 = fingerprint_sha256;
+                cert->fingerprint = cert->fingerprint_sha256;
+                break;
+            default:
+                log_error("fingerprint_sha256 of length %zu unexpected: %s", s, fingerprint_sha256);
+            }
+        } else {
+            cert->fingerprint_sha1 = fingerprint_sha1;
+            cert->fingerprint = cert->fingerprint_sha1;
+        }
+    }
+
+    cert->version = version;
+    cert->serialnumber = serialnumber;
+    cert->subjectname = subjectname;
+    cert->issuername = issuername;
+    cert->notbefore = notbefore;
+    cert->notafter = notafter;
+    cert->key_alg = key_alg;
+    cert->signature_alg = signature_alg;
+    cert->pem = pem;
+    cert->pubkey_fingerprint = pubkey_fingerprint;
+
+    /* Do this check after assigning all values, in order to not leak them,
+     * even though the situation is most likely already FUBAR */
+    if (!fingerprint_sha256 && !fingerprint_sha1) {
+        log_error("No TLSCertificate w/o fingerprint");
+        tlscerts_free(cert);
+        return NULL;
+    }
+
+    _name_to_tlscert_name(subjectname, cert, subject);
+    _name_to_tlscert_name(issuername, cert, issuer);
+
+    return cert;
+}
+
+static TLSCertificate*
+_get_TLSCertificate(const gchar* fingerprint)
+{
+    int version = g_key_file_get_integer(tlscerts, fingerprint, "version", NULL);
+    gchar* serialnumber = g_key_file_get_string(tlscerts, fingerprint, "serialnumber", NULL);
+    gchar* subjectname = g_key_file_get_string(tlscerts, fingerprint, "subjectname", NULL);
+    gchar* issuername = g_key_file_get_string(tlscerts, fingerprint, "issuername", NULL);
+    gchar* notbefore = g_key_file_get_string(tlscerts, fingerprint, "start", NULL);
+    gchar* notafter = g_key_file_get_string(tlscerts, fingerprint, "end", NULL);
+    gchar* keyalg = g_key_file_get_string(tlscerts, fingerprint, "keyalg", NULL);
+    gchar* signaturealg = g_key_file_get_string(tlscerts, fingerprint, "signaturealg", NULL);
+    gchar* fingerprint_sha1 = g_key_file_get_string(tlscerts, fingerprint, "fingerprint_sha1", NULL);
+    gchar* pubkey_fingerprint = g_key_file_get_string(tlscerts, fingerprint, "pubkey_fingerprint", NULL);
+
+    return _tlscerts_new(fingerprint_sha1, version, serialnumber, subjectname, issuername, notbefore,
+                         notafter, keyalg, signaturealg, NULL, g_strdup(fingerprint), pubkey_fingerprint);
 }
 
 GList*
@@ -126,125 +183,81 @@ tlscerts_list(void)
     gsize len = 0;
     auto_gcharv gchar** groups = g_key_file_get_groups(tlscerts, &len);
 
-    for (int i = 0; i < g_strv_length(groups); i++) {
-        char* fingerprint = strdup(groups[i]);
-        int version = g_key_file_get_integer(tlscerts, fingerprint, "version", NULL);
-        auto_gchar gchar* serialnumber = g_key_file_get_string(tlscerts, fingerprint, "serialnumber", NULL);
-        auto_gchar gchar* subjectname = g_key_file_get_string(tlscerts, fingerprint, "subjectname", NULL);
-        auto_gchar gchar* issuername = g_key_file_get_string(tlscerts, fingerprint, "issuername", NULL);
-        auto_gchar gchar* notbefore = g_key_file_get_string(tlscerts, fingerprint, "start", NULL);
-        auto_gchar gchar* notafter = g_key_file_get_string(tlscerts, fingerprint, "end", NULL);
-        auto_gchar gchar* keyalg = g_key_file_get_string(tlscerts, fingerprint, "keyalg", NULL);
-        auto_gchar gchar* signaturealg = g_key_file_get_string(tlscerts, fingerprint, "signaturealg", NULL);
-
-        TLSCertificate* cert = tlscerts_new(fingerprint, version, serialnumber, subjectname, issuername, notbefore,
-                                            notafter, keyalg, signaturealg, NULL);
-
-        res = g_list_append(res, cert);
+    for (gsize i = 0; i < len; i++) {
+        res = g_list_append(res, _get_TLSCertificate(groups[i]));
     }
 
     return res;
 }
 
-TLSCertificate*
-tlscerts_new(const char* const fingerprint, int version, const char* const serialnumber, const char* const subjectname,
-             const char* const issuername, const char* const notbefore, const char* const notafter,
-             const char* const key_alg, const char* const signature_alg, const char* const pem)
+static void
+_name_to_tlscert_name_(const char* in, tls_cert_name_t* out, const char* name)
 {
-    TLSCertificate* cert = calloc(1, sizeof(TLSCertificate));
-
-    if (fingerprint) {
-        cert->fingerprint = strdup(fingerprint);
-    }
-    cert->version = version;
-    if (serialnumber) {
-        cert->serialnumber = strdup(serialnumber);
-    }
-    if (subjectname) {
-        cert->subjectname = strdup(subjectname);
-    }
-    if (issuername) {
-        cert->issuername = strdup(issuername);
-    }
-    if (notbefore) {
-        cert->notbefore = strdup(notbefore);
-    }
-    if (notafter) {
-        cert->notafter = strdup(notafter);
-    }
-    if (key_alg) {
-        cert->key_alg = strdup(key_alg);
-    }
-    if (signature_alg) {
-        cert->signature_alg = strdup(signature_alg);
-    }
-    if (pem) {
-        cert->pem = strdup(pem);
-    }
-
-    auto_gcharv gchar** fields = g_strsplit(subjectname, "/", 0);
-    for (int i = 0; i < g_strv_length(fields); i++) {
+    auto_gcharv gchar** fields = g_strsplit(in, "/", 0);
+    const guint fields_num = g_strv_length(fields);
+    for (guint i = 0; i < fields_num; i++) {
         auto_gcharv gchar** keyval = g_strsplit(fields[i], "=", 2);
         if (g_strv_length(keyval) == 2) {
+
+#define tls_cert_name_set(which)                                                \
+    do {                                                                        \
+        if (out->which) {                                                       \
+            log_warning("%s." #which " already set, skip %s", name, keyval[1]); \
+            continue;                                                           \
+        }                                                                       \
+        out->which = g_strdup(keyval[1]);                                       \
+    } while (0)
+
             if ((g_strcmp0(keyval[0], "C") == 0) || (g_strcmp0(keyval[0], "countryName") == 0)) {
-                cert->subject_country = strdup(keyval[1]);
+                tls_cert_name_set(country);
             }
             if ((g_strcmp0(keyval[0], "ST") == 0) || (g_strcmp0(keyval[0], "stateOrProvinceName") == 0)) {
-                cert->subject_state = strdup(keyval[1]);
+                tls_cert_name_set(state);
             }
             if (g_strcmp0(keyval[0], "dnQualifier") == 0) {
-                cert->subject_distinguishedname = strdup(keyval[1]);
+                tls_cert_name_set(distinguishedname);
             }
             if (g_strcmp0(keyval[0], "serialnumber") == 0) {
-                cert->subject_serialnumber = strdup(keyval[1]);
+                tls_cert_name_set(serialnumber);
             }
             if ((g_strcmp0(keyval[0], "CN") == 0) || (g_strcmp0(keyval[0], "commonName") == 0)) {
-                cert->subject_commonname = strdup(keyval[1]);
+                tls_cert_name_set(commonname);
             }
             if ((g_strcmp0(keyval[0], "O") == 0) || (g_strcmp0(keyval[0], "organizationName") == 0)) {
-                cert->subject_organisation = strdup(keyval[1]);
+                tls_cert_name_set(organisation);
             }
             if ((g_strcmp0(keyval[0], "OU") == 0) || (g_strcmp0(keyval[0], "organizationalUnitName") == 0)) {
-                cert->subject_organisation_unit = strdup(keyval[1]);
+                tls_cert_name_set(organisation_unit);
             }
             if (g_strcmp0(keyval[0], "emailAddress") == 0) {
-                cert->subject_email = strdup(keyval[1]);
+                tls_cert_name_set(email);
             }
+#undef tls_cert_name_set
         }
     }
+}
 
-    auto_gcharv gchar** fields2 = g_strsplit(issuername, "/", 0);
-    for (int i = 0; i < g_strv_length(fields2); i++) {
-        auto_gcharv gchar** keyval = g_strsplit(fields2[i], "=", 2);
-        if (g_strv_length(keyval) == 2) {
-            if ((g_strcmp0(keyval[0], "C") == 0) || (g_strcmp0(keyval[0], "countryName") == 0)) {
-                cert->issuer_country = strdup(keyval[1]);
-            }
-            if ((g_strcmp0(keyval[0], "ST") == 0) || (g_strcmp0(keyval[0], "stateOrProvinceName") == 0)) {
-                cert->issuer_state = strdup(keyval[1]);
-            }
-            if (g_strcmp0(keyval[0], "dnQualifier") == 0) {
-                cert->issuer_distinguishedname = strdup(keyval[1]);
-            }
-            if (g_strcmp0(keyval[0], "serialnumber") == 0) {
-                cert->issuer_serialnumber = strdup(keyval[1]);
-            }
-            if ((g_strcmp0(keyval[0], "CN") == 0) || (g_strcmp0(keyval[0], "commonName") == 0)) {
-                cert->issuer_commonname = strdup(keyval[1]);
-            }
-            if ((g_strcmp0(keyval[0], "O") == 0) || (g_strcmp0(keyval[0], "organizationName") == 0)) {
-                cert->issuer_organisation = strdup(keyval[1]);
-            }
-            if ((g_strcmp0(keyval[0], "OU") == 0) || (g_strcmp0(keyval[0], "organizationalUnitName") == 0)) {
-                cert->issuer_organisation_unit = strdup(keyval[1]);
-            }
-            if (g_strcmp0(keyval[0], "emailAddress") == 0) {
-                cert->issuer_email = strdup(keyval[1]);
-            }
-        }
-    }
+TLSCertificate*
+tlscerts_new(const char* fingerprint_sha1, int version, const char* serialnumber, const char* subjectname,
+             const char* issuername, const char* notbefore, const char* notafter,
+             const char* key_alg, const char* signature_alg, const char* pem,
+             const char* fingerprint_sha256, const char* pubkey_fingerprint)
+{
+    return _tlscerts_new(g_strdup(fingerprint_sha1), version, g_strdup(serialnumber), g_strdup(subjectname),
+                         g_strdup(issuername), g_strdup(notbefore), g_strdup(notafter),
+                         g_strdup(key_alg), g_strdup(signature_alg), g_strdup(pem),
+                         g_strdup(fingerprint_sha256), g_strdup(pubkey_fingerprint));
+}
 
-    return cert;
+static void
+_checked_g_key_file_set_string(GKeyFile* key_file,
+                               const gchar* group_name,
+                               const gchar* key,
+                               const gchar* string)
+{
+    if (string == NULL)
+        return;
+    g_key_file_set_string(key_file, group_name, key, string);
 }
 
 void
@@ -261,33 +274,21 @@ tlscerts_add(const TLSCertificate* cert)
     autocomplete_add(certs_ac, cert->fingerprint);
 
     g_key_file_set_integer(tlscerts, cert->fingerprint, "version", cert->version);
-    if (cert->serialnumber) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "serialnumber", cert->serialnumber);
-    }
-    if (cert->subjectname) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "subjectname", cert->subjectname);
-    }
-    if (cert->issuername) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "issuername", cert->issuername);
-    }
-    if (cert->notbefore) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "start", cert->notbefore);
-    }
-    if (cert->notafter) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "end", cert->notafter);
-    }
-    if (cert->key_alg) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "keyalg", cert->key_alg);
-    }
-    if (cert->signature_alg) {
-        g_key_file_set_string(tlscerts, cert->fingerprint, "signaturealg", cert->signature_alg);
-    }
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "serialnumber", cert->serialnumber);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "subjectname", cert->subjectname);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "issuername", cert->issuername);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "start", cert->notbefore);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "end", cert->notafter);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "keyalg", cert->key_alg);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "signaturealg", cert->signature_alg);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "fingerprint_sha1", cert->fingerprint_sha1);
+    _checked_g_key_file_set_string(tlscerts, cert->fingerprint, "pubkey_fingerprint", cert->pubkey_fingerprint);
 
     _save_tlscerts();
 }
 
 gboolean
-tlscerts_revoke(const char* const fingerprint)
+tlscerts_revoke(const char* fingerprint)
 {
     gboolean result = g_key_file_remove_group(tlscerts, fingerprint, NULL);
     if (result) {
@@ -300,28 +301,24 @@ tlscerts_revoke(const char* const fingerprint)
 }
 
 TLSCertificate*
-tlscerts_get_trusted(const char* const fingerprint)
+tlscerts_get_trusted(const gchar* fingerprint)
 {
     if (!g_key_file_has_group(tlscerts, fingerprint)) {
+        gsize len = 0;
+        auto_gcharv gchar** groups = g_key_file_get_groups(tlscerts, &len);
+        for (gsize i = 0; i < len; i++) {
+            auto_gchar gchar* fingerprint_sha1 = g_key_file_get_string(tlscerts, groups[i], "fingerprint_sha1", NULL);
+            if (g_strcmp0(fingerprint, fingerprint_sha1) == 0) {
+                return _get_TLSCertificate(fingerprint_sha1);
+            }
+        }
         return NULL;
     }
-
-    int version = g_key_file_get_integer(tlscerts, fingerprint, "version", NULL);
-    auto_gchar gchar* serialnumber = g_key_file_get_string(tlscerts, fingerprint, "serialnumber", NULL);
-    auto_gchar gchar* subjectname = g_key_file_get_string(tlscerts, fingerprint, "subjectname", NULL);
-    auto_gchar gchar* issuername = g_key_file_get_string(tlscerts, fingerprint, "issuername", NULL);
-    auto_gchar gchar* notbefore = g_key_file_get_string(tlscerts, fingerprint, "start", NULL);
-    auto_gchar gchar* notafter = g_key_file_get_string(tlscerts, fingerprint, "end", NULL);
-    auto_gchar gchar* keyalg = g_key_file_get_string(tlscerts, fingerprint, "keyalg", NULL);
-    auto_gchar gchar* signaturealg = g_key_file_get_string(tlscerts, fingerprint, "signaturealg", NULL);
-
-    TLSCertificate* cert = tlscerts_new(fingerprint, version, serialnumber, subjectname, issuername, notbefore,
-                                        notafter, keyalg, signaturealg, NULL);
-    return cert;
+    return _get_TLSCertificate(fingerprint);
 }
 
 char*
-tlscerts_complete(const char* const prefix, gboolean previous, void* context)
+tlscerts_complete(const char* prefix, gboolean previous, void* context)
 {
     return autocomplete_complete(certs_ac, prefix, TRUE, previous);
 }
@@ -332,40 +329,37 @@ tlscerts_reset_ac(void)
     autocomplete_reset(certs_ac);
 }
 
+static void
+_tls_cert_name_free(tls_cert_name_t* name)
+{
+    g_free(name->country);
+    g_free(name->state);
+    g_free(name->distinguishedname);
+    g_free(name->serialnumber);
+    g_free(name->commonname);
+    g_free(name->organisation);
+    g_free(name->organisation_unit);
+    g_free(name->email);
+}
+
 void
 tlscerts_free(TLSCertificate* cert)
 {
     if (cert) {
-        free(cert->serialnumber);
+        _tls_cert_name_free(&cert->subject);
+        _tls_cert_name_free(&cert->issuer);
 
-        free(cert->subjectname);
-        free(cert->subject_country);
-        free(cert->subject_state);
-        free(cert->subject_distinguishedname);
-        free(cert->subject_serialnumber);
-        free(cert->subject_commonname);
-        free(cert->subject_organisation);
-        free(cert->subject_organisation_unit);
-        free(cert->subject_email);
-
-        free(cert->issuername);
-        free(cert->issuer_country);
-        free(cert->issuer_state);
-        free(cert->issuer_distinguishedname);
-        free(cert->issuer_serialnumber);
-        free(cert->issuer_commonname);
-        free(cert->issuer_organisation);
-        free(cert->issuer_organisation_unit);
-        free(cert->issuer_email);
-
-        free(cert->notbefore);
-        free(cert->notafter);
-        free(cert->fingerprint);
-
-        free(cert->key_alg);
-        free(cert->signature_alg);
-
-        free(cert->pem);
+        g_free(cert->pubkey_fingerprint);
+        g_free(cert->pem);
+        g_free(cert->signature_alg);
+        g_free(cert->key_alg);
+        g_free(cert->notafter);
+        g_free(cert->notbefore);
+        g_free(cert->issuername);
+        g_free(cert->subjectname);
+        g_free(cert->serialnumber);
+        g_free(cert->fingerprint_sha1);
+        g_free(cert->fingerprint_sha256);
 
         free(cert);
     }