Checkpoint

svn path=/rpkid/Makefile; revision=1810

7 files changed, 1260 insertions, 118 deletions

diff --git a/rpkid/Makefile b/rpkid/Makefile
index cb0ea42c..6dc10f8e 100644
--- a/rpkid/Makefile
+++ b/rpkid/Makefile
@@ -7,21 +7,33 @@
 
 all:: left-right-protocol-samples/.stamp
 
-left-right-protocol-samples/.stamp: left-right-protocol-samples.xsl left-right-protocol-samples.xml
-	xsltproc left-right-protocol-samples.xsl left-right-protocol-samples.xml
+left-right-protocol-samples/.stamp: left-right-protocol-samples.xml split-protocol-samples.xsl 
+	xsltproc --stringparam dir left-right-protocol-samples split-protocol-samples.xsl left-right-protocol-samples.xml
 	touch $@
 
 all:: left-right-schema.rng
 
+rpki/relaxng.py: left-right-schema.rng
+
 left-right-schema.rng: left-right-schema.rnc
 	trang left-right-schema.rnc left-right-schema.rng
 
-all:: up-down-schema.rng
+all:: up-down-schema.rng 
+
+rpki/relaxng.py: up-down-schema.rng
 
 up-down-schema.rng: up-down-schema.rnc
 	trang up-down-schema.rnc up-down-schema.rng
 
-all:: publication-schema.rng
+all:: publication-protocol-samples/.stamp
+
+publication-protocol-samples/.stamp: publication-protocol-samples.xml split-protocol-samples.xsl 
+	xsltproc --stringparam dir publication-protocol-samples split-protocol-samples.xsl publication-protocol-samples.xml
+	touch $@
+
+all:: publication-schema.rng 
+
+rpki/relaxng.py: publication-schema.rng
 
 publication-schema.rng: publication-schema.rnc
 	trang publication-schema.rnc publication-schema.rng
@@ -35,9 +47,10 @@ install:
 dont-run-trang:
 	touch *.rng
 
-relaxng: left-right-protocol-samples/.stamp left-right-schema.rng up-down-schema.rng
-	xmllint --noout --relaxng left-right-schema.rng left-right-protocol-samples/*.xml
-	xmllint --noout --relaxng    up-down-schema.rng    up-down-protocol-samples/*.xml
+relaxng: left-right-protocol-samples/.stamp left-right-schema.rng up-down-schema.rng publication-protocol-samples/.stamp
+	xmllint --noout --relaxng  left-right-schema.rng  left-right-protocol-samples/*.xml
+	xmllint --noout --relaxng     up-down-schema.rng     up-down-protocol-samples/*.xml
+	xmllint --noout --relaxng publication-schema.rng publication-protocol-samples/*.xml
 
 unit-tests: all
 	PWD=`pwd`; for i in rpki/*.py; do echo "[$$i]"; PYTHONPATH=$$PWD python $$i; done
@@ -76,7 +89,7 @@ tags:
 
 all:: rpki/relaxng.py
 
-rpki/relaxng.py: left-right-schema.rng up-down-schema.rng make-relaxng.py
+rpki/relaxng.py: make-relaxng.py
 	python make-relaxng.py >$@.tmp
 	mv $@.tmp $@
 
diff --git a/rpkid/make-relaxng.py b/rpkid/make-relaxng.py
index 8011893a..6d12a348 100644
--- a/rpkid/make-relaxng.py
+++ b/rpkid/make-relaxng.py
@@ -20,8 +20,9 @@ print "# Automatically generated, do not edit."
 print
 print "import lxml.etree"
 
-for varname, filename in (("left_right", "left-right-schema.rng"),
-                          ("up_down",    "up-down-schema.rng")):
+for varname, filename in (("left_right",  "left-right-schema.rng"),
+                          ("up_down",     "up-down-schema.rng"),
+                          ("publication", "publication-schema.rng")):
   f = open(filename)
   print "\n## @var %s\n## Parsed RelaxNG %s schema\n%s = lxml.etree.RelaxNG(lxml.etree.fromstring('''%s'''))" % (varname, varname, varname, f.read())
   f.close()
diff --git a/rpkid/publication-protocol-samples.xml b/rpkid/publication-protocol-samples.xml
new file mode 100644
index 00000000..b1d5afa9
--- /dev/null
+++ b/rpkid/publication-protocol-samples.xml
@@ -0,0 +1,153 @@
+<!-- -*- SGML -*-
+  -  $Id$
+  -
+  - Copyright (C) 2008  American Registry for Internet Numbers ("ARIN")
+  -
+  - Permission to use, copy, modify, and distribute this software for any
+  - purpose with or without fee is hereby granted, provided that the above
+  - copyright notice and this permission notice appear in all copies.
+  -
+  - THE SOFTWARE IS PROVIDED "AS IS" AND ARIN DISCLAIMS ALL WARRANTIES WITH
+  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  - AND FITNESS.  IN NO EVENT SHALL ARIN BE LIABLE FOR ANY SPECIAL, DIRECT,
+  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  - PERFORMANCE OF THIS SOFTWARE.
+  -
+  -
+  - This is a collection of sample left-right protocol PDU samples
+  - to use as test cases for the left-right protocol RelaxNG schema.
+  -->
+
+<completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="create" base_uri="rsync://wombat.invalid/">
+            <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+        </client>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="create" client_id="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="set" client_id="3">
+            <bpki_glue>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_glue>
+        </client>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="set" client_id="3"/>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="get" client_id="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="get" client_id="3" base_uri="rsync://wombat.invalid/">
+            <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+        </client>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="list"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="list" client_id="3">
+            <bpki_cert>
+		MIIDGzCCAgOgAwIBAgIJAKi+/+wUhQlxMA0GCSqGSIb3DQEBBQUAMCQxIjAgBgNV
+		BAMTGVRlc3QgQ2VydGlmaWNhdGUgQm9iIFJvb3QwHhcNMDcwODAxMTk1MzEwWhcN
+		MDcwODMxMTk1MzEwWjAkMSIwIAYDVQQDExlUZXN0IENlcnRpZmljYXRlIEJvYiBS
+		b290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArKYUtJaM5PH5917S
+		G2ACc7iBYdQO2HYyu8Gb6i9Q2Gxc3cWEX7RTBvgOL79pWf3GIdnoupzMnoZVtY3G
+		Ux2G/0WkmLui2TCeDhcfXdQ4rcp8J3V/6ESj+yuEPPOG8UN17mUKKgujrch6ZvgC
+		DO9AyOK/uXu+ABQXTPsn2pVe2EVh3V004ShLi8GKgVdqb/rW/6GTg0Xb/zLT6WWM
+		uT++6sXTlztJdQYkRamJvKfQDU1naC8mAkGf79Tba0xyBGAUII0GfREY6t4/+NAP
+		2Yyb3xNlBqcJoTov0JfNKHZcCZePr79j7LK/hkZxxip+Na9xDpE+oQRV+DRukCRJ
+		diqg+wIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTDEsXJe6pjAQD4
+		ULlB7+GMDBlimTAfBgNVHSMEGDAWgBTDEsXJe6pjAQD4ULlB7+GMDBlimTANBgkq
+		hkiG9w0BAQUFAAOCAQEAWWkNcW6S1tKKqtzJsdfhjJiAAPQmOXJskv0ta/8f6Acg
+		cum1YieNdtT0n96P7CUHOWP8QBb91JzeewR7b6WJLwb1Offs3wNq3kk75pJe89r4
+		XY39EZHhMW+Dv0PhIKu2CgD4LeyH1FVTQkF/QObGEmkn+s+HTsuzd1l2VLwcP1Sm
+		sqep6LAlFj62qqaIJzNeQ9NVkBqtkygnYlBOkaBTHfQTux3jYNpEo8JJB5e/WFdH
+		YyMNrG2xMOtIC7T4+IOHgT8PgrNhaeDg9ctewj0X8Qi9nI9nXeinicLX8vj6hdEq
+		3ORv7RZMJNYqv1HQ3wUE2B7fCPFv7EUwzaCds1kgRQ==
+	    </bpki_cert>
+        </client>
+    </msg>
+    
+    <msg version="1" type="query" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="destroy" client_id="3"/>
+    </msg>
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <client action="destroy" client_id="3"/>
+    </msg>
+    
+    <!-- === -->
+    
+    <!-- === -->
+    
+    <msg version="1" type="reply" xmlns="http://www.hactrn.net/uris/rpki/publication-spec/">
+        <report_error error_code="your_hair_is_on_fire">bag_of_data</report_error>
+    </msg>
+    
+</completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint>
diff --git a/rpkid/publication-schema.rnc b/rpkid/publication-schema.rnc
index 8e3df9a0..e2dee26f 100644
--- a/rpkid/publication-schema.rnc
+++ b/rpkid/publication-schema.rnc
@@ -5,7 +5,7 @@
 # libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so
 # run the compact syntax through trang to get XML syntax.
 
-default namespace = "http://www.hactrn.net/uris/rpki/publication/"
+default namespace = "http://www.hactrn.net/uris/rpki/publication-spec/"
 
 # Top level PDU
 
@@ -16,19 +16,21 @@ start = element msg {
 }
 
 # PDUs allowed in a query
-query_elt = ( client_query | publish_query | retrieve_query | withdraw_query )
+query_elt = ( client_query | certificate_query | crl_query | manifest_query | roa_query )
 
 # PDUs allowed in a reply
-reply_elt = ( client_reply | publish_reply | retrieve_reply | withdraw_reply | report_error_reply )
+
+reply_elt = ( client_reply | certificate_reply | crl_reply | manifest_reply | roa_reply | report_error_reply )
 
 # Tag attributes for bulk operations
-tag = attribute tag { xsd:token {maxLength="1024" } }?
+tag = attribute tag { xsd:token {maxLength="1024" } }
 
 # Base64 encoded DER stuff
 base64 = xsd:base64Binary { maxLength="512000" }
 
 # Publication URLs
-url = attribute url { xsd:anyURI { maxLength="4096" } }
+uri_t = xsd:anyURI { maxLength="4096" }
+uri = attribute uri { uri_t }
 
 # Kinds of objects
 obj_type = attribute type { "certificate" | "crl" | "manifest" | "roa" }
@@ -37,39 +39,62 @@ obj_type = attribute type { "certificate" | "crl" | "manifest" | "roa" }
 
 client_id = attribute client_id { xsd:nonNegativeInteger }
 
-client_payload = (element bpki_cert { base64 }?, element bpki_glue { base64 }?)
-
-client_query |= element client { attribute action { "create" },  tag, client_payload }
-client_reply |= element client { attribute action { "create" },  tag, client_id }
-client_query |= element client { attribute action { "set" },     tag, client_id, client_payload }
-client_reply |= element client { attribute action { "set" },     tag, client_id }
-client_query |= element client { attribute action { "get" },     tag, client_id }
-client_reply |= element client { attribute action { "get" },     tag, client_id, client_payload }
-client_query |= element client { attribute action { "list" },    tag }
-client_reply |= element client { attribute action { "list" },    tag, client_id, client_payload }
-client_query |= element client { attribute action { "destroy" }, tag, client_id }
-client_reply |= element client { attribute action { "destroy" }, tag, client_id }
-
-# <publish/> element
-
-publish_query = element publish { tag, obj_type, url, base64 }
-publish_reply = element publish { tag, obj_type, url }
-
-# <retrieve/> element
-
-retrieve_query = element retrieve { tag, obj_type?, url? }
-retrieve_reply = element retrieve { tag, obj_type, url, base64 }
-
-# <withdraw/> element
-
-withdraw_query = element withdraw { tag, obj_type, url }
-withdraw_reply = element withdraw { tag, obj_type, url }
+client_payload = (attribute base_uri { uri_t }?, element bpki_cert { base64 }?, element bpki_glue { base64 }?)
+
+client_query |= element client { attribute action { "create" },  tag?, client_payload }
+client_reply |= element client { attribute action { "create" },  tag?, client_id }
+client_query |= element client { attribute action { "set" },     tag?, client_id, client_payload }
+client_reply |= element client { attribute action { "set" },     tag?, client_id }
+client_query |= element client { attribute action { "get" },     tag?, client_id }
+client_reply |= element client { attribute action { "get" },     tag?, client_id, client_payload }
+client_query |= element client { attribute action { "list" },    tag? }
+client_reply |= element client { attribute action { "list" },    tag?, client_id, client_payload }
+client_query |= element client { attribute action { "destroy" }, tag?, client_id }
+client_reply |= element client { attribute action { "destroy" }, tag?, client_id }
+
+# <certificate/> element
+
+certificate_query |= element certificate { attribute action { "publish" }, tag?, client_id?, uri, base64 }
+certificate_reply |= element certificate { attribute action { "publish" }, tag?, client_id?, uri }
+certificate_query |= element certificate { attribute action { "retrieve" }, tag?, client_id?, uri? }
+certificate_reply |= element certificate { attribute action { "retrieve" }, tag?, client_id?, uri, base64 }
+certificate_query |= element certificate { attribute action { "withdraw" }, tag?, client_id?, uri }
+certificate_reply |= element certificate { attribute action { "withdraw" }, tag?, client_id?, uri }
+
+# <crl/> element
+
+crl_query |= element crl { attribute action { "publish" }, tag?, client_id?, uri, base64 }
+crl_reply |= element crl { attribute action { "publish" }, tag?, client_id?, uri }
+crl_query |= element crl { attribute action { "retrieve" }, tag?, client_id?, uri? }
+crl_reply |= element crl { attribute action { "retrieve" }, tag?, client_id?, uri, base64 }
+crl_query |= element crl { attribute action { "withdraw" }, tag?, client_id?, uri }
+crl_reply |= element crl { attribute action { "withdraw" }, tag?, client_id?, uri }
+
+# <manifest/> element
+
+manifest_query |= element manifest { attribute action { "publish" }, tag?, client_id?, uri, base64 }
+manifest_reply |= element manifest { attribute action { "publish" }, tag?, client_id?, uri }
+manifest_query |= element manifest { attribute action { "retrieve" }, tag?, client_id?, uri? }
+manifest_reply |= element manifest { attribute action { "retrieve" }, tag?, client_id?, uri, base64 }
+manifest_query |= element manifest { attribute action { "withdraw" }, tag?, client_id?, uri }
+manifest_reply |= element manifest { attribute action { "withdraw" }, tag?, client_id?, uri }
+
+# <roa/> element
+
+roa_query |= element roa { attribute action { "publish" }, tag?, client_id?, uri, base64 }
+roa_reply |= element roa { attribute action { "publish" }, tag?, client_id?, uri }
+roa_query |= element roa { attribute action { "retrieve" }, tag?, client_id?, uri? }
+roa_reply |= element roa { attribute action { "retrieve" }, tag?, client_id?, uri, base64 }
+roa_query |= element roa { attribute action { "withdraw" }, tag?, client_id?, uri }
+roa_reply |= element roa { attribute action { "withdraw" }, tag?, client_id?, uri }
 
 # <report_error/> element
 
+error = xsd:token { maxLength="1024" }
+
 report_error_reply = element report_error {
-  tag,
-  attribute error_code { xsd:token { maxLength="1024" } },
+  tag?,
+  attribute error_code { error },
   xsd:string { maxLength="512000" }?
 }
 
diff --git a/rpkid/publication-schema.rng b/rpkid/publication-schema.rng
index ee8f178f..93f2315c 100644
--- a/rpkid/publication-schema.rng
+++ b/rpkid/publication-schema.rng
@@ -7,7 +7,7 @@
   libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so
   run the compact syntax through trang to get XML syntax.
 -->
-<grammar ns="http://www.hactrn.net/uris/rpki/publication/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
+<grammar ns="http://www.hactrn.net/uris/rpki/publication-spec/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
   <!-- Top level PDU -->
   <start>
     <element name="msg">
@@ -40,30 +40,30 @@
   <define name="query_elt">
     <choice>
       <ref name="client_query"/>
-      <ref name="publish_query"/>
-      <ref name="retrieve_query"/>
-      <ref name="withdraw_query"/>
+      <ref name="certificate_query"/>
+      <ref name="crl_query"/>
+      <ref name="manifest_query"/>
+      <ref name="roa_query"/>
     </choice>
   </define>
   <!-- PDUs allowed in a reply -->
   <define name="reply_elt">
     <choice>
       <ref name="client_reply"/>
-      <ref name="publish_reply"/>
-      <ref name="retrieve_reply"/>
-      <ref name="withdraw_reply"/>
+      <ref name="certificate_reply"/>
+      <ref name="crl_reply"/>
+      <ref name="manifest_reply"/>
+      <ref name="roa_reply"/>
       <ref name="report_error_reply"/>
     </choice>
   </define>
   <!-- Tag attributes for bulk operations -->
   <define name="tag">
-    <optional>
-      <attribute name="tag">
-        <data type="token">
-          <param name="maxLength">1024</param>
-        </data>
-      </attribute>
-    </optional>
+    <attribute name="tag">
+      <data type="token">
+        <param name="maxLength">1024</param>
+      </data>
+    </attribute>
   </define>
   <!-- Base64 encoded DER stuff -->
   <define name="base64">
@@ -72,11 +72,14 @@
     </data>
   </define>
   <!-- Publication URLs -->
-  <define name="url">
-    <attribute name="url">
-      <data type="anyURI">
-        <param name="maxLength">4096</param>
-      </data>
+  <define name="uri_t">
+    <data type="anyURI">
+      <param name="maxLength">4096</param>
+    </data>
+  </define>
+  <define name="uri">
+    <attribute name="uri">
+      <ref name="uri_t"/>
     </attribute>
   </define>
   <!-- Kinds of objects -->
@@ -98,6 +101,11 @@
   </define>
   <define name="client_payload">
     <optional>
+      <attribute name="base_uri">
+        <ref name="uri_t"/>
+      </attribute>
+    </optional>
+    <optional>
       <element name="bpki_cert">
         <ref name="base64"/>
       </element>
@@ -113,7 +121,9 @@
       <attribute name="action">
         <value>create</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_payload"/>
     </element>
   </define>
@@ -122,7 +132,9 @@
       <attribute name="action">
         <value>create</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
     </element>
   </define>
@@ -131,7 +143,9 @@
       <attribute name="action">
         <value>set</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
       <ref name="client_payload"/>
     </element>
@@ -141,7 +155,9 @@
       <attribute name="action">
         <value>set</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
     </element>
   </define>
@@ -150,7 +166,9 @@
       <attribute name="action">
         <value>get</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
     </element>
   </define>
@@ -159,7 +177,9 @@
       <attribute name="action">
         <value>get</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
       <ref name="client_payload"/>
     </element>
@@ -169,7 +189,9 @@
       <attribute name="action">
         <value>list</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
     </element>
   </define>
   <define name="client_reply" combine="choice">
@@ -177,7 +199,9 @@
       <attribute name="action">
         <value>list</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
       <ref name="client_payload"/>
     </element>
@@ -187,7 +211,9 @@
       <attribute name="action">
         <value>destroy</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
     </element>
   </define>
@@ -196,69 +222,381 @@
       <attribute name="action">
         <value>destroy</value>
       </attribute>
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <ref name="client_id"/>
     </element>
   </define>
-  <!-- <publish/> element -->
-  <define name="publish_query">
-    <element name="publish">
-      <ref name="tag"/>
-      <ref name="obj_type"/>
-      <ref name="url"/>
+  <!-- <certificate/> element -->
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
       <ref name="base64"/>
     </element>
   </define>
-  <define name="publish_reply">
-    <element name="publish">
-      <ref name="tag"/>
-      <ref name="obj_type"/>
-      <ref name="url"/>
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
     </element>
   </define>
-  <!-- <retrieve/> element -->
-  <define name="retrieve_query">
-    <element name="retrieve">
-      <ref name="tag"/>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
       <optional>
-        <ref name="obj_type"/>
+        <ref name="tag"/>
       </optional>
       <optional>
-        <ref name="url"/>
+        <ref name="client_id"/>
       </optional>
+      <ref name="uri"/>
     </element>
   </define>
-  <define name="retrieve_reply">
-    <element name="retrieve">
-      <ref name="tag"/>
-      <ref name="obj_type"/>
-      <ref name="url"/>
+  <!-- <crl/> element -->
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
       <ref name="base64"/>
     </element>
   </define>
-  <!-- <withdraw/> element -->
-  <define name="withdraw_query">
-    <element name="withdraw">
-      <ref name="tag"/>
-      <ref name="obj_type"/>
-      <ref name="url"/>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
     </element>
   </define>
-  <define name="withdraw_reply">
-    <element name="withdraw">
-      <ref name="tag"/>
-      <ref name="obj_type"/>
-      <ref name="url"/>
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <manifest/> element -->
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <roa/> element -->
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
     </element>
   </define>
   <!-- <report_error/> element -->
+  <define name="error">
+    <data type="token">
+      <param name="maxLength">1024</param>
+    </data>
+  </define>
   <define name="report_error_reply">
     <element name="report_error">
-      <ref name="tag"/>
+      <optional>
+        <ref name="tag"/>
+      </optional>
       <attribute name="error_code">
-        <data type="token">
-          <param name="maxLength">1024</param>
-        </data>
+        <ref name="error"/>
       </attribute>
       <optional>
         <data type="string">
diff --git a/rpkid/rpki/relaxng.py b/rpkid/rpki/relaxng.py
index 557d3a8b..cc93facf 100644
--- a/rpkid/rpki/relaxng.py
+++ b/rpkid/rpki/relaxng.py
@@ -1210,3 +1210,620 @@ up_down = lxml.etree.RelaxNG(lxml.etree.fromstring('''<?xml version="1.0" encodi
   End:
 -->
 '''))
+
+## @var publication
+## Parsed RelaxNG publication schema
+publication = lxml.etree.RelaxNG(lxml.etree.fromstring('''<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  $Id: publication-schema.rnc 1808 2008-05-22 04:55:02Z sra $
+  
+  RelaxNG Schema for RPKI publication protocol.
+  
+  libxml2 (including xmllint) only groks the XML syntax of RelaxNG, so
+  run the compact syntax through trang to get XML syntax.
+-->
+<grammar ns="http://www.hactrn.net/uris/rpki/publication-spec/" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
+  <!-- Top level PDU -->
+  <start>
+    <element name="msg">
+      <attribute name="version">
+        <data type="positiveInteger">
+          <param name="maxInclusive">1</param>
+        </data>
+      </attribute>
+      <choice>
+        <group>
+          <attribute name="type">
+            <value>query</value>
+          </attribute>
+          <zeroOrMore>
+            <ref name="query_elt"/>
+          </zeroOrMore>
+        </group>
+        <group>
+          <attribute name="type">
+            <value>reply</value>
+          </attribute>
+          <zeroOrMore>
+            <ref name="reply_elt"/>
+          </zeroOrMore>
+        </group>
+      </choice>
+    </element>
+  </start>
+  <!-- PDUs allowed in a query -->
+  <define name="query_elt">
+    <choice>
+      <ref name="client_query"/>
+      <ref name="certificate_query"/>
+      <ref name="crl_query"/>
+      <ref name="manifest_query"/>
+      <ref name="roa_query"/>
+    </choice>
+  </define>
+  <!-- PDUs allowed in a reply -->
+  <define name="reply_elt">
+    <choice>
+      <ref name="client_reply"/>
+      <ref name="certificate_reply"/>
+      <ref name="crl_reply"/>
+      <ref name="manifest_reply"/>
+      <ref name="roa_reply"/>
+      <ref name="report_error_reply"/>
+    </choice>
+  </define>
+  <!-- Tag attributes for bulk operations -->
+  <define name="tag">
+    <attribute name="tag">
+      <data type="token">
+        <param name="maxLength">1024</param>
+      </data>
+    </attribute>
+  </define>
+  <!-- Base64 encoded DER stuff -->
+  <define name="base64">
+    <data type="base64Binary">
+      <param name="maxLength">512000</param>
+    </data>
+  </define>
+  <!-- Publication URLs -->
+  <define name="uri_t">
+    <data type="anyURI">
+      <param name="maxLength">4096</param>
+    </data>
+  </define>
+  <define name="uri">
+    <attribute name="uri">
+      <ref name="uri_t"/>
+    </attribute>
+  </define>
+  <!-- Kinds of objects -->
+  <define name="obj_type">
+    <attribute name="type">
+      <choice>
+        <value>certificate</value>
+        <value>crl</value>
+        <value>manifest</value>
+        <value>roa</value>
+      </choice>
+    </attribute>
+  </define>
+  <!-- <client/> element (use restricted to repository operator) -->
+  <define name="client_id">
+    <attribute name="client_id">
+      <data type="nonNegativeInteger"/>
+    </attribute>
+  </define>
+  <define name="client_payload">
+    <optional>
+      <attribute name="base_uri">
+        <ref name="uri_t"/>
+      </attribute>
+    </optional>
+    <optional>
+      <element name="bpki_cert">
+        <ref name="base64"/>
+      </element>
+    </optional>
+    <optional>
+      <element name="bpki_glue">
+        <ref name="base64"/>
+      </element>
+    </optional>
+  </define>
+  <define name="client_query" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>create</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_payload"/>
+    </element>
+  </define>
+  <define name="client_reply" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>create</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+    </element>
+  </define>
+  <define name="client_query" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>set</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+      <ref name="client_payload"/>
+    </element>
+  </define>
+  <define name="client_reply" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>set</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+    </element>
+  </define>
+  <define name="client_query" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>get</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+    </element>
+  </define>
+  <define name="client_reply" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>get</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+      <ref name="client_payload"/>
+    </element>
+  </define>
+  <define name="client_query" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>list</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+    </element>
+  </define>
+  <define name="client_reply" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>list</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+      <ref name="client_payload"/>
+    </element>
+  </define>
+  <define name="client_query" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>destroy</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+    </element>
+  </define>
+  <define name="client_reply" combine="choice">
+    <element name="client">
+      <attribute name="action">
+        <value>destroy</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <ref name="client_id"/>
+    </element>
+  </define>
+  <!-- <certificate/> element -->
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="certificate_query" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="certificate_reply" combine="choice">
+    <element name="certificate">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <crl/> element -->
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="crl_query" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="crl_reply" combine="choice">
+    <element name="crl">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <manifest/> element -->
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="manifest_query" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="manifest_reply" combine="choice">
+    <element name="manifest">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <roa/> element -->
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>publish</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <optional>
+        <ref name="uri"/>
+      </optional>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>retrieve</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+      <ref name="base64"/>
+    </element>
+  </define>
+  <define name="roa_query" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <define name="roa_reply" combine="choice">
+    <element name="roa">
+      <attribute name="action">
+        <value>withdraw</value>
+      </attribute>
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <optional>
+        <ref name="client_id"/>
+      </optional>
+      <ref name="uri"/>
+    </element>
+  </define>
+  <!-- <report_error/> element -->
+  <define name="error">
+    <data type="token">
+      <param name="maxLength">1024</param>
+    </data>
+  </define>
+  <define name="report_error_reply">
+    <element name="report_error">
+      <optional>
+        <ref name="tag"/>
+      </optional>
+      <attribute name="error_code">
+        <ref name="error"/>
+      </attribute>
+      <optional>
+        <data type="string">
+          <param name="maxLength">512000</param>
+        </data>
+      </optional>
+    </element>
+  </define>
+</grammar>
+<!--
+  Local Variables:
+  indent-tabs-mode: nil
+  End:
+-->
+'''))
diff --git a/rpkid/left-right-protocol-samples.xsl b/rpkid/split-protocol-samples.xsl
index a152fa0e..8800b6da 100644
--- a/rpkid/left-right-protocol-samples.xsl
+++ b/rpkid/split-protocol-samples.xsl
@@ -14,26 +14,21 @@
   - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
   - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
   - PERFORMANCE OF THIS SOFTWARE.
-  -
-  -
-  - Generate test case PDUs for left-right protocol.  Invoke thusly:
-  -
-  - $ xsltproc left-right-protocol-samples.xsl left-right-protocol-samples.xml
  --> 
 
 <xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"
                xmlns:exsl="http://exslt.org/common"
 	       extension-element-prefixes="exsl">
 
-  <xsl:param name="dir">left-right-protocol-samples</xsl:param>
-  <xsl:param name="msgs" select="1"/>
+  <xsl:param name="dir">.</xsl:param>
+  <xsl:param name="verbose" select="1"/>
 
   <xsl:strip-space elements="*"/>
 
   <xsl:template match="/completely_gratuitous_wrapper_element_to_let_me_run_this_through_xmllint">
     <xsl:for-each select="*">
       <xsl:variable name="filename" select="concat($dir, '/pdu.', format-number(position(), '000'), '.xml')"/>
-      <xsl:if test="$msgs">
+      <xsl:if test="$verbose">
         <xsl:message><xsl:text>Writing </xsl:text><xsl:value-of select="$filename"/></xsl:message>
       </xsl:if>
       <exsl:document href="{$filename}" indent="yes" encoding="US-ASCII">