import_secret_one (ctrl_t ctrl, const char *fname, KBNODE keyblock,
                   struct stats_s *stats, unsigned int options)
{
  PKT_public_key *pk;
  struct seckey_info *ski;
  KBNODE node, uidnode;
  u32 keyid[2];
  int rc = 0;
  int nr_prev;
  kbnode_t pub_keyblock;

  /* Get the key and print some info about it */
  node = find_kbnode (keyblock, PKT_SECRET_KEY);
  if (!node)
    BUG ();

  pk = node->pkt->pkt.public_key;

  keyid_from_pk (pk, keyid);
  uidnode = find_next_kbnode (keyblock, PKT_USER_ID);

  if (opt.verbose)
    {
      log_info ("sec  %4u%c/%s %s   ",
                nbits_from_pk (pk),
                pubkey_letter (pk->pubkey_algo),
                keystr_from_pk (pk), datestr_from_pk (pk));
      if (uidnode)
        print_utf8_buffer (log_get_stream (), uidnode->pkt->pkt.user_id->name,
                           uidnode->pkt->pkt.user_id->len);
      log_printf ("\n");
    }
  stats->secret_read++;

  if (!uidnode)
    {
      log_error( _("key %s: no user ID\n"), keystr_from_pk (pk));
      return 0;
    }

  ski = pk->seckey_info;
  if (!ski)
    {
      /* Actually an internal error.  */
      log_error ("key %s: secret key info missing\n", keystr_from_pk (pk));
      return 0;
    }

  /* A quick check to not import keys with an invalid protection
     cipher algorithm (only checks the primary key, though).  */
  if (ski->algo > 110)
    {
      log_error (_("key %s: secret key with invalid cipher %d"
                   " - skipped\n"), keystr_from_pk (pk), ski->algo);
      return 0;
    }

#ifdef ENABLE_SELINUX_HACKS
  if (1)
    {
      /* We don't allow to import secret keys because that may be used
         to put a secret key into the keyring and the user might later
         be tricked into signing stuff with that key.  */
      log_error (_("importing secret keys not allowed\n"));
      return 0;
    }
#endif

  clear_kbnode_flags (keyblock);

  nr_prev = stats->skipped_new_keys;

  /* Make a public key out of the key. */
  pub_keyblock = sec_to_pub_keyblock (keyblock);
  if (!pub_keyblock)
    log_error ("key %s: failed to create public key from secret key\n",
                   keystr_from_pk (pk));
  else
    {
      /* Note that this outputs an IMPORT_OK status message for the
	 public key block, and below we will output another one for
	 the secret keys.  FIXME?  */
      import_one (ctrl, fname, pub_keyblock, stats,
		  NULL, NULL, options, 1);

      /* Fixme: We should check for an invalid keyblock and
	 cancel the secret key import in this case.  */
      release_kbnode (pub_keyblock);

      /* At least we cancel the secret key import when the public key
	 import was skipped due to MERGE_ONLY option and a new
	 key.  */
      if (stats->skipped_new_keys <= nr_prev)
	{
          /* Read the keyblock again to get the effects of a merge.  */
          /* Fixme: we should do this based on the fingerprint or
             even better let import_one return the merged
             keyblock.  */
          node = get_pubkeyblock (keyid);
          if (!node)
            log_error ("key %s: failed to re-lookup public key\n",
                       keystr_from_pk (pk));
          else
            {
	      nr_prev = stats->secret_imported;
              if (!transfer_secret_keys (ctrl, stats, keyblock))
                {
		  int status = 16;
                  if (!opt.quiet)
                    log_info (_("key %s: secret key imported\n"),
                              keystr_from_pk (pk));
		  if (stats->secret_imported > nr_prev)
		    status |= 1;
                  if (is_status_enabled ())
                    print_import_ok (pk, status);
                  check_prefs (ctrl, node);
                }
              release_kbnode (node);
            }
        }
    }

  return rc;
}