#
#
# patch "app_state.cc"
#  from [2ef7b90bb25a19730416fd0dfcd4ea7f8f1d2022]
#    to [7314b368c303924260ef63a337b6038a04574687]
# 
# patch "cmd_merging.cc"
#  from [22291270923c56d208f2c878eac5b7f04d4739db]
#    to [a814a5df1d5e8d17c79d2c039cf8b16ea8a0d696]
# 
# patch "cmd_packet.cc"
#  from [1e64bf637bd28cda2b019b229fadf93db3b206ee]
#    to [496a8848e5f9fc7d88c5cc018fde73bd43be923f]
# 
# patch "cmd_ws_commit.cc"
#  from [ebec7449ba110d4c11c4442b655b549a8561e6d7]
#    to [bab70117f3537004cb52329bd3b0e47afcfc61c2]
# 
# patch "key_store.cc"
#  from [647396cd291637e0c1d4c2465ca372f19a5762a3]
#    to [659df45fa50e6ef206de1d63207c7163361ed5d7]
# 
# patch "key_store.hh"
#  from [d33d2d1c872225920d74afe7b9350edae71607a2]
#    to [12d2b3e41e1824e5d41ccf7ee77c2745016454ef]
# 
# patch "netsync.cc"
#  from [a4c703b9007b142478b1d8ecddf9d6c389e6d00c]
#    to [6d68f94e8aa8974b06ea44797b8430edde6fff66]
# 
# patch "packet.cc"
#  from [1dd3e1b56ecdb676fc5bff8b948d3ccf79ad5900]
#    to [13b343e901ada870d2566703c7b33310b3da221b]
# 
# patch "packet.hh"
#  from [286ff5bfdef623d41d6087db8271dd1f26d36ff1]
#    to [e9931486cf34cc1f1649b29d3bdb6bee0a963cd3]
#
============================================================
--- app_state.cc	2ef7b90bb25a19730416fd0dfcd4ea7f8f1d2022
+++ app_state.cc	7314b368c303924260ef63a337b6038a04574687
@@ -36,7 +36,7 @@ app_state::app_state()
 
 app_state::app_state()
   : db(system_path()),
-    keys(this), work(lua),
+    keys(), work(lua),
 //    search_root(current_root_path()),
 //    diff_format(unified_diff),
     branch_is_sticky(false),
============================================================
--- cmd_merging.cc	22291270923c56d208f2c878eac5b7f04d4739db
+++ cmd_merging.cc	a814a5df1d5e8d17c79d2c039cf8b16ea8a0d696
@@ -22,6 +22,7 @@
 #include "update.hh"
 #include "work.hh"
 #include "safe_map.hh"
+#include "ui.hh"
 
 using std::cout;
 using std::make_pair;
============================================================
--- cmd_packet.cc	1e64bf637bd28cda2b019b229fadf93db3b206ee
+++ cmd_packet.cc	496a8848e5f9fc7d88c5cc018fde73bd43be923f
@@ -74,7 +74,7 @@ CMD(read, N_("packet i/o"), "[FILE1 [FIL
   size_t count = 0;
   if (args.empty())
     {
-      count += read_packets(cin, dbw, app);
+      count += read_packets(cin, dbw);
       N(count != 0, F("no packets found on stdin"));
     }
   else
@@ -85,7 +85,7 @@ CMD(read, N_("packet i/o"), "[FILE1 [FIL
           data dat;
           read_data(system_path(*i), dat);
           istringstream ss(dat());
-          count += read_packets(ss, dbw, app);
+          count += read_packets(ss, dbw);
         }
       N(count != 0, FP("no packets found in given file",
                        "no packets found in given files",
============================================================
--- cmd_ws_commit.cc	ebec7449ba110d4c11c4442b655b549a8561e6d7
+++ cmd_ws_commit.cc	bab70117f3537004cb52329bd3b0e47afcfc61c2
@@ -19,6 +19,7 @@
 #include "transforms.hh"
 #include "work.hh"
 #include "charset.hh"
+#include "ui.hh"
 
 using std::cout;
 using std::make_pair;
============================================================
--- key_store.cc	647396cd291637e0c1d4c2465ca372f19a5762a3
+++ key_store.cc	659df45fa50e6ef206de1d63207c7163361ed5d7
@@ -5,6 +5,7 @@
 #include "packet.hh"
 #include "keys.hh"
 #include "globish.hh"
+#include "database.hh"
 
 using std::make_pair;
 using std::istringstream;
@@ -38,6 +39,10 @@ struct keyreader : public packet_consume
                                   base64< rsa_pub_key > const & k)
   {E(false, F("Extraneous data in key store."));}
 
+  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+                                       base64< arc4<rsa_priv_key> > const & k)
+  {E(false, F("Extraneous data in key store."));}
+
   virtual void consume_key_pair(rsa_keypair_id const & ident,
                                 keypair const & kp)
   {
@@ -52,7 +57,7 @@ struct keyreader : public packet_consume
   }
 };
 
-key_store::key_store(app_state * a): have_read(false), app(a)
+key_store::key_store() : have_read(false)
 {
 }
 
@@ -87,7 +92,7 @@ key_store::read_key_dir()
       data dat;
       read_data(key_dir / (*i)(), dat);
       istringstream is(dat());
-      read_packets(is, kr, *app);
+      read_packets(is, kr);
     }
 }
 
@@ -101,27 +106,27 @@ void
 }
 
 void
-key_store::ensure_in_database(rsa_keypair_id const & ident)
+key_store::ensure_in_database(rsa_keypair_id const & ident, database & db)
 {
   maybe_read_key_dir();
-  if (app->db.public_key_exists(ident))
+  if (db.public_key_exists(ident))
     {
       L(FL("public key '%s' is already in db, not loading") % ident);
       return;
     }
   map<rsa_keypair_id, keypair>::iterator i = keys.find(ident);
   I(i != keys.end());
-  app->db.put_key(ident, i->second.pub);
+  db.put_key(ident, i->second.pub);
   L(FL("loaded public key '%s' into db") % ident);
 }
 
 bool
-key_store::try_ensure_in_db(hexenc<id> const & hash)
+key_store::try_ensure_in_db(hexenc<id> const & hash, database & db)
 {
   map<hexenc<id>, rsa_keypair_id>::const_iterator i = hashes.find(hash);
   if (i == hashes.end())
     return false;
-  ensure_in_database(i->second);
+  ensure_in_database(i->second, db);
   return true;
 }
 
============================================================
--- key_store.hh	d33d2d1c872225920d74afe7b9350edae71607a2
+++ key_store.hh	12d2b3e41e1824e5d41ccf7ee77c2745016454ef
@@ -5,10 +5,8 @@
 
 #include "vocab.hh"
 #include "paths.hh"
-#include "platform.hh"
 
-class app_state;
-
+class database;
 struct keyreader;
 
 class key_store
@@ -17,7 +15,6 @@ private:
   friend struct keyreader;
   system_path key_dir;
   bool have_read;
-  app_state * app;
   std::map<rsa_keypair_id, keypair> keys;
   std::map<hexenc<id>, rsa_keypair_id> hashes;
 
@@ -26,12 +23,12 @@ public:
   void read_key_dir();
   void maybe_read_key_dir();
 public:
-  key_store(app_state * a);
+  key_store();
   void set_key_dir(system_path const & kd);
   system_path const & get_key_dir();
 
-  void ensure_in_database(rsa_keypair_id const & ident);
-  bool try_ensure_in_db(hexenc<id> const & hash);
+  void ensure_in_database(rsa_keypair_id const & ident, database &);
+  bool try_ensure_in_db(hexenc<id> const & hash, database &);
 
   void get_key_ids(std::string const & pattern,
                    std::vector<rsa_keypair_id> & priv);
============================================================
--- netsync.cc	a4c703b9007b142478b1d8ecddf9d6c389e6d00c
+++ netsync.cc	6d68f94e8aa8974b06ea44797b8430edde6fff66
@@ -1507,7 +1507,7 @@ session::process_auth_cmd(protocol_role 
     {
       // If it's not in the db, it still could be in the keystore if we
       // have the private key that goes with it.
-      if (!app.keys.try_ensure_in_db(their_key_hash))
+      if (!app.keys.try_ensure_in_db(their_key_hash, app.db))
         {
           this->saved_nonce = id("");
 
@@ -3159,7 +3159,7 @@ session::rebuild_merkle_trees(app_state 
           if (!app.db.public_key_exists(*key))
             {
               if (app.keys.key_pair_exists(*key))
-                app.keys.ensure_in_database(*key);
+                app.keys.ensure_in_database(*key, app.db);
               else
                 W(F("Cannot find key '%s'") % *key);
             }
============================================================
--- packet.cc	1dd3e1b56ecdb676fc5bff8b948d3ccf79ad5900
+++ packet.cc	13b343e901ada870d2566703c7b33310b3da221b
@@ -253,6 +253,16 @@ packet_db_writer::consume_key_pair(rsa_k
   guard.commit();
 }
 
+void
+packet_db_writer::consume_old_private_key(rsa_keypair_id const & ident,
+                                          base64< arc4<rsa_priv_key> >
+                                          const & k)
+{
+  keypair kp;
+  migrate_private_key(app, ident, k, kp);
+  consume_key_pair(ident, kp);
+}
+
 // --- packet writer ---
 
 packet_writer::packet_writer(ostream & o) : ost(o) {}
@@ -321,13 +331,20 @@ packet_writer::consume_key_pair(rsa_keyp
       << "[end]\n";
 }
 
+void
+packet_writer::consume_old_private_key(rsa_keypair_id const & ident,
+                                       base64< arc4<rsa_priv_key> > const & k)
+{
+  I(!"packet_writer::consume_old_private_key called");
+}
 
-// -- remainder just deals with the regexes for reading packets off streams
 
+// -- remainder just deals with the regexes for reading packets off streams
+namespace
+{
 struct
 feed_packet_consumer
 {
-  app_state & app;
   size_t & count;
   packet_consumer & cons;
   string ident;
@@ -335,8 +352,8 @@ feed_packet_consumer
   string certname;
   string base;
   string sp;
-  feed_packet_consumer(size_t & count, packet_consumer & c, app_state & app_)
-   : app(app_), count(count), cons(c),
+  feed_packet_consumer(size_t & count, packet_consumer & c)
+   : count(count), cons(c),
      ident(constants::regex_legal_id_bytes),
      key(constants::regex_legal_key_name_bytes),
      certname(constants::regex_legal_cert_name_bytes),
@@ -436,12 +453,8 @@ feed_packet_consumer
         require(regex_match(args, regex(key)));
         require(regex_match(body, regex(base)));
         string contents(trim_ws(body));
-        keypair kp;
-        migrate_private_key(app,
-                            rsa_keypair_id(args),
-                            base64<arc4<rsa_priv_key> >(contents),
-                            kp);
-        cons.consume_key_pair(rsa_keypair_id(args), kp);
+        cons.consume_old_private_key(rsa_keypair_id(args),
+                                     base64<arc4<rsa_priv_key> >(contents));
       }
     else
       {
@@ -452,9 +465,10 @@ feed_packet_consumer
     return true;
   }
 };
+}
 
 static size_t
-extract_packets(string const & s, packet_consumer & cons, app_state & app)
+extract_packets(string const & s, packet_consumer & cons)
 {
   static string const head("\\[([a-z]+)[[:space:]]+([^\\[\\]]+)\\]");
   static string const body("([^\\[\\]]+)");
@@ -462,13 +476,13 @@ extract_packets(string const & s, packet
   static string const whole = head + body + tail;
   regex expr(whole);
   size_t count = 0;
-  regex_grep(feed_packet_consumer(count, cons, app), s, expr, match_default);
+  regex_grep(feed_packet_consumer(count, cons), s, expr, match_default);
   return count;
 }
 
 
 size_t
-read_packets(istream & in, packet_consumer & cons, app_state & app)
+read_packets(istream & in, packet_consumer & cons)
 {
   string accum, tmp;
   size_t count = 0;
@@ -485,7 +499,7 @@ read_packets(istream & in, packet_consum
         {
           endpos += end.size();
           string tmp = accum.substr(0, endpos);
-          count += extract_packets(tmp, cons, app);
+          count += extract_packets(tmp, cons);
           if (endpos < accum.size() - 1)
             accum = accum.substr(endpos+1);
           else
@@ -564,18 +578,13 @@ UNIT_TEST(packet, roundabout)
     tmp = oss.str();
   }
 
-  // read_packets needs this to convert privkeys to keypairs.
-  // This doesn't test privkey packets (theres a tests/ test for that),
-  // so we don't actually use the app_state for anything. So a default one
-  // is ok.
-  app_state aaa;
   for (int i = 0; i < 10; ++i)
     {
       // now spin around sending and receiving this a few times
       ostringstream oss;
       packet_writer pw(oss);
       istringstream iss(tmp);
-      read_packets(iss, pw, aaa);
+      read_packets(iss, pw);
       BOOST_CHECK(oss.str() == tmp);
       tmp = oss.str();
     }
============================================================
--- packet.hh	286ff5bfdef623d41d6087db8271dd1f26d36ff1
+++ packet.hh	e9931486cf34cc1f1649b29d3bdb6bee0a963cd3
@@ -11,14 +11,13 @@
 // PURPOSE.
 
 #include <iosfwd>
-#include <memory>
-
 #include <boost/function.hpp>
 
-#include "app_state.hh"
-#include "ui.hh"
 #include "vocab.hh"
 
+class app_state;
+struct cert;
+
 // the idea here is that monotone can produce and consume "packet streams",
 // where each packet is *informative* rather than transactional. that is to
 // say, they contain no information which needs to be replied to or processed
@@ -72,6 +71,10 @@ public:
                                   base64< rsa_pub_key > const & k) = 0;
   virtual void consume_key_pair(rsa_keypair_id const & ident,
                                 keypair const & kp) = 0;
+  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+                                       base64< arc4<rsa_priv_key> > const & k)
+  = 0;
+                                       
 };
 
 // this writer writes packets into a stream
@@ -95,6 +98,9 @@ struct packet_writer : public packet_con
                                   base64< rsa_pub_key > const & k);
   virtual void consume_key_pair(rsa_keypair_id const & ident,
                                 keypair const & kp);
+  // this one always I()s [stupid C++ won't let me leave it pure-virtual]
+  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+                                       base64< arc4<rsa_priv_key> > const & k);
 };
 
 // this writer injects packets it receives to the database.
@@ -119,9 +125,11 @@ public:
                                   base64< rsa_pub_key > const & k);
   virtual void consume_key_pair(rsa_keypair_id const & ident,
                                 keypair const & kp);
+  virtual void consume_old_private_key(rsa_keypair_id const & ident,
+                                       base64< arc4<rsa_priv_key> > const & k);
 };
 
-size_t read_packets(std::istream & in, packet_consumer & cons, app_state & app);
+size_t read_packets(std::istream & in, packet_consumer & cons);
 
 // Local Variables:
 // mode: C++